Function at 0x487efb
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0xcf8
mov eax, 0x4aed5d
call fcn.004a95a1
mov dword [ebp - 0xbf4], ecx
xor ebx, ebx
mov edx, 0x4ba824
mov dword [ebp - 0xb54], ebx
mov dword [ebp - 0xc0c], ebx
mov dword [ebp - 0xc08], ebx
mov dword [ebp - 0xbc8], ebx
mov dword [ebp - 0xbe4], ebx
mov dword [ebp - 0xbe0], ebx
mov dword [ebp - 0xaec], ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x487f41
mov eax, dword [0x4ba820]
mov edi, 0x7f1137f
mov dword [ebp - 0xbac], 0x41167a
mov dword [ebp - 0xbc4], 0x67
mov dword [ebp - 0xb58], 0x337
mov dword [ebp - 0xbcc], 0x10b
mov dword [ebp - 0xb40], 0x20b
push 0
pop ebx
test eax, eax
jne 0x488667
push 0x338
mov esi, ebx
mov dword [ebp - 0xb00], ebx
push ebx
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xad0], esi
mov dword [ebp - 0xaf8], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xadc], ebx
test ebx, ebx
je 0x488659
or dword [ebp - 0xb10], 0xffffffff
xor edx, edx
mov eax, edx
mov dword [ebp - 0xaf4], 0x7f1137f
xor dword [ebp - 0xaf4], 0xab69605e
mov cl, dl
mov dword [ebp - 0xb8c], eax
add ebx, 7
mov dword [ebp - 0x404], edi
mov eax, 0x7f1137f
mov edi, edx
mov dword [ebp - 0x408], 0xab69605e
movzx esi, word [ebp - 0x406]
mov dword [ebp - 0xba8], edx
movzx edx, word [ebp - 0x402]
mov dword [ebp - 0xaf0], ebx
mov ebx, 0x41167a
movzx eax, ax
mov dword [ebp - 0xad4], esi
mov esi, edi
mov dword [ebp - 0xbb0], edi
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xb20], edx
mov dword [ebp - 0xae4], ebx
mov dword [ebp - 0xb18], 0x67
movzx edx, byte [ebx - 2]
movzx eax, byte [ebx - 1]
shl edx, 8
or edx, eax
movzx eax, byte [ebx]
shl edx, 8
or edx, eax
movzx eax, byte [ebx + 1]
movzx ebx, byte [ebx + 2]
shl edx, 8
or edx, eax
shl ebx, 8
mov eax, dword [ebp - 0xae4]
xor edi, edx
mov dword [ebp - 0xb14], edx
movzx eax, byte [eax + 3]
or ebx, eax
mov eax, dword [ebp - 0xae4]
shl ebx, 8
movzx eax, byte [eax + 4]
or ebx, eax
mov eax, dword [ebp - 0xae4]
shl ebx, 8
add dword [ebp - 0xae4], 8
movzx eax, byte [eax + 5]
or ebx, eax
mov eax, dword [ebp - 0xae0]
xor esi, ebx
xor esi, edi
xor esi, dword [ebp - 0xaf4]
mov dword [ebp - 0xacc], esi
add esi, 0x54969fa2
mov edx, dword [ebp - 0xacc]
rol esi, 5
imul eax, esi
mov esi, 0x7f1137f
rol edx, 0xa
add edx, eax
mov eax, dword [ebp - 0xad4]
xor edi, edx
mov edx, edi
rol edx, 2
lea esi, [esi + edi]
ror esi, 9
imul eax, esi
mov esi, dword [ebp - 0xacc]
sub eax, edx
xor esi, eax
mov eax, esi
mov dword [ebp - 0xacc], esi
sub eax, dword [ebp - 0xae0]
imul edx, eax, 0x605e
mov eax, esi
mov esi, dword [ebp - 0xad4]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xb20]
xor edi, edx
xor esi, edi
mov edx, edi
rol esi, 6
imul eax, esi
mov esi, dword [ebp - 0xacc]
rol edx, 2
sub eax, edx
xor esi, eax
mov eax, 0x7f1137f
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor edi, eax
mov eax, dword [ebp - 0xae0]
xor eax, edi
mov edx, edi
imul eax, dword [ebp - 0xad4]
ror edx, 6
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov dword [ebp - 0xacc], esi
add eax, esi
ror eax, 0xf
mov edx, esi
imul eax, eax, 0x605e
rol edx, 2
add edx, eax
mov eax, dword [ebp - 0xb20]
xor edi, edx
mov edx, edi
rol edx, 8
lea esi, [edi + 0x54969fa2]
ror esi, 0xe
imul eax, esi
sub eax, edx
mov edx, dword [ebp - 0xacc]
xor edx, eax
mov eax, dword [ebp - 0xae0]
mov esi, edx
mov dword [ebp - 0xacc], edx
ror edx, 0xa
xor esi, 0xab69605e
ror esi, 0xc
imul eax, esi
mov esi, dword [ebp - 0xb20]
xor edx, eax
xor edi, edx
mov edx, esi
xor edx, edi
mov eax, edi
imul edx, dword [ebp - 0xad4]
shr eax, 0xa
xor edx, eax
xor edx, dword [ebp - 0xacc]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, esi
xor edi, eax
mov eax, esi
mov dword [ebp - 0xad8], edi
sub edi, esi
xor edi, edx
mov edx, dword [ebp - 0xae0]
xor edi, 0xab69605e
xor eax, edi
rol eax, 2
imul edx, eax
mov eax, edi
shr eax, 2
add edx, eax
mov eax, dword [ebp - 0xad8]
xor eax, edx
mov edx, 0x7f1137f
mov esi, eax
mov dword [ebp - 0xad8], eax
sub esi, edx
mov edx, eax
mov eax, dword [ebp - 0xad4]
ror esi, 6
imul eax, esi
mov esi, dword [ebp - 0xad4]
rol edx, 7
add edx, eax
mov eax, dword [ebp - 0xae0]
xor edi, edx
xor eax, edi
mov edx, edi
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
mov eax, dword [ebp - 0xad8]
xor eax, edx
xor esi, eax
mov dword [ebp - 0xad8], eax
mov edx, eax
rol esi, 5
mov eax, dword [ebp - 0xb20]
imul eax, esi
rol edx, 7
add edx, eax
xor edi, edx
mov esi, dword [ebp - 0xad8]
mov edx, 0x7f1137f
mov eax, dword [ebp - 0xaf4]
xor eax, edi
xor esi, eax
mov eax, esi
ror eax, 3
sub eax, dword [ebp - 0xad4]
imul eax, dword [ebp - 0xae0]
xor edi, eax
mov eax, edi
sub eax, edx
mov edx, edi
ror eax, 1
imul eax, eax, 0x605e
ror edx, 6
sub eax, edx
xor esi, eax
mov eax, dword [ebp - 0xb20]
mov dword [ebp - 0xad8], esi
add esi, 0xab69605e
mov edx, dword [ebp - 0xad8]
rol edx, 0xe
rol esi, 3
imul eax, esi
add edx, eax
xor edi, edx
mov eax, edi
ror eax, 0xe
lea edx, [edi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xae0]
sub edx, eax
mov eax, dword [ebp - 0xad8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xad8], eax
shr eax, 3
xor edx, 0x605e
imul edx, dword [ebp - 0xad4]
xor edx, eax
mov eax, 0x7f1137f
xor edi, edx
xor eax, edi
mov edx, edi
xor edi, dword [ebp - 0xb10]
rol eax, 4
imul eax, eax, 0x605e
rol edx, 2
mov dword [ebp - 0xb8c], edi
xor edx, eax
mov eax, dword [ebp - 0xad8]
xor edx, dword [ebp - 0xba8]
xor eax, edx
mov edx, dword [ebp - 0xaf0]
mov dword [ebp - 0xbb0], eax
mov byte [edx - 4], al
mov al, byte [ebp - 0xb8c]
ror dword [ebp - 0xbb0], 8
mov byte [edx], al
mov al, byte [ebp - 0xbb0]
ror dword [ebp - 0xb8c], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb8c]
ror dword [ebp - 0xbb0], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xbb0]
ror dword [ebp - 0xb8c], 8
mov byte [edx - 6], al
ror dword [ebp - 0xbb0], 8
mov al, byte [ebp - 0xb8c]
mov byte [edx - 2], al
mov al, byte [ebp - 0xbb0]
ror dword [ebp - 0xb8c], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb8c]
mov byte [edx - 3], al
mov eax, dword [ebp - 0xbb0]
ror eax, 8
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xbb0], eax
mov esi, dword [ebp - 0xb8c]
add edx, 8
mov eax, dword [ebp - 0xb14]
mov edi, dword [ebp - 0xad8]
ror esi, 8
sub dword [ebp - 0xb18], 1
mov dword [ebp - 0xb10], ebx
mov ebx, dword [ebp - 0xae4]
mov dword [ebp - 0xb8c], esi
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xaf0], edx
jne 0x48805f
mov ebx, dword [ebp - 0xadc]
xor eax, eax
mov edx, eax
xor cl, byte [edx + ebx]
inc edx
cmp edx, 0x338
jb 0x488443
movzx eax, cl
cdq
cmp eax, dword [0x4119b0]
jne 0x488481
cmp edx, dword [0x4119b4]
jne 0x488481
mov esi, dword [ebp - 0xaf8]
mov edi, ebx
xor eax, eax
mov dword [ebp - 0xad0], edi
mov ebx, eax
mov dword [ebp - 0xba8], 0x337
jmp 0x488493
or dword [ebp - 0xba8], 0xffffffff
mov esi, 0xc004d501
mov edi, dword [ebp - 0xad0]
test ebx, ebx
je 0x4884aa
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4884ac
xor ebx, ebx
test esi, esi
js 0x488653
mov eax, dword [ebp - 0xba8]
mov esi, edi
push 0x40
push ebx
mov byte [eax + edi], bl
mov ebx, 0x4b9980
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], 0
je 0x4885e9
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xb54]
jne 0x4884e2
sub ecx, ebx
xor ebx, ebx
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x48864c
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xac4], ecx
cmp word [eax], dx
je 0x48852c
mov ecx, 0xc000007b
mov dword [ebp - 0xac4], ecx
jmp 0x488574
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x48851f
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x48851f
cmp dword [edx], 0x4550
jne 0x48851f
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xbcc]
je 0x488562
cmp ax, word [ebp - 0xb40]
je 0x488562
mov ecx, 0xc000000d
jmp 0x488524
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xaf8], eax
test eax, eax
je 0x4885dd
mov edx, esi
mov dword [ebp - 0xadc], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb14], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x488595
sub edx, dword [ebp - 0xb14]
inc esi
add esi, edx
test ecx, ecx
js 0x4885ce
push dword [ebp - 0xadc]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4885e9
mov ecx, dword [ebp - 0xb00]
mov dword [ecx*4 + 0x4b7010], eax
mov ecx, dword [ebp - 0xac4]
inc dword [ebp - 0xb00]
inc ebx
cmp ebx, dword [ebp - 0xaf8]
jb 0x488584
add edi, 0x10
cmp byte [esi], 0
jne 0x4884db
mov ebx, dword [ebp - 0xac4]
mov esi, dword [ebp - 0xad0]
test esi, esi
je 0x48860a
push esi
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jns 0x488660
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0x4b9980]
test eax, eax
je 0x488623
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x488612
push 0x40
push ebx
push 0x4b9980
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x402210
mov edi, 0x4b7010
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x48866d
mov ebx, 0xc000007a
jmp 0x4885ef
mov esi, dword [ebp - 0xad0]
mov ebx, 0xc000007a
jmp 0x4885f5
mov eax, dword [0x4ba820]
xor ebx, ebx
inc eax
mov dword [0x4ba820], eax
xor eax, eax
mov ecx, 0x4ba824
xchg dword [ecx], eax
mov eax, dword fs:[0x30]
mov edi, ebx
mov dword [ebp - 0xc20], ebx
mov dword [ebp - 0xc24], ebx
mov dword [ebp - 0xae4], ebx
cmp dword [eax + 0x1d4], 0
je 0x48893a
mov esi, dword [0x4b7098]
mov ecx, esi
call dword [0x4bb544]
call esi
mov ebx, eax
test ebx, ebx
jne 0x4886da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x4886ca
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x488946
mov edi, 0x80004005
jmp 0x488946
xor ecx, ecx
mov dword [ebp - 0xbd0], ecx
mov edi, ecx
mov eax, ecx
mov esi, ecx
lea ecx, [ebp - 0xc38]
push ecx
push eax
push esi
mov esi, dword [0x4b70a8]
mov ecx, esi
push 2
push ebx
call dword [0x4bb544]
call esi
test eax, eax
jne 0x48877b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x488766
cmp dword [ebp - 0xbd0], edi
jne 0x48875f
push dword [ebp - 0xc38]
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xbd0]
mov esi, eax
call fcn.004a83ac
test esi, esi
je 0x488750
mov eax, dword [ebp - 0xc38]
mov dword [ebp - 0xbd0], esi
jmp 0x4886e8
xor eax, eax
mov edi, 0x8007000e
mov dword [ebp - 0xbd0], eax
jmp 0x48878f
mov edi, 0x80004005
jmp 0x48878f
test eax, eax
je 0x48875f
jg 0x488770
mov edi, eax
jmp 0x48878f
movzx edi, ax
or edi, 0x80070000
jmp 0x48878f
mov eax, dword [ebp - 0xbd0]
xor ecx, ecx
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xc20], eax
lea ecx, [ebp - 0xbd0]
call fcn.004a83ac
test edi, edi
js 0x488946
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [0x4b70a4]
mov ecx, esi
push eax
call dword [0x4bb544]
call esi
mov ebx, eax
test ebx, ebx
je 0x4886b3
xor ecx, ecx
mov dword [ebp - 0xbd4], ecx
mov edi, ecx
mov eax, ecx
mov esi, ecx
lea ecx, [ebp - 0xc3c]
push ecx
push eax
push esi
mov esi, dword [0x4b70a8]
mov ecx, esi
push 2
push ebx
call dword [0x4bb544]
call esi
test eax, eax
jne 0x48885e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x488847
cmp dword [ebp - 0xbd4], edi
jne 0x488840
push dword [ebp - 0xc3c]
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xbd4]
mov esi, eax
call fcn.004a83ac
test esi, esi
je 0x488839
mov eax, dword [ebp - 0xc3c]
mov dword [ebp - 0xbd4], esi
jmp 0x4887d1
mov edi, 0x8007000e
jmp 0x48886a
mov edi, 0x80004005
jmp 0x48885a
test eax, eax
je 0x488840
jg 0x488851
mov edi, eax
jmp 0x48885a
movzx edi, ax
or edi, 0x80070000
xor ebx, ebx
jmp 0x488872
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0xc24], eax
xor ebx, ebx
mov dword [ebp - 0xbd4], ebx
lea ecx, [ebp - 0xbd4]
call fcn.004a83ac
test edi, edi
js 0x488946
mov eax, dword [ebp - 0xc20]
test eax, eax
je 0x48893a
mov ecx, 0x41125c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4888c1
test dx, dx
je 0x4888ba
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4888c1
add eax, 4
add ecx, 4
test dx, dx
jne 0x488898
xor esi, esi
mov eax, ebx
inc esi
jmp 0x4888c8
sbb eax, eax
xor esi, esi
inc esi
or eax, esi
test eax, eax
jne 0x48893a
mov eax, dword [ebp - 0xc24]
test eax, eax
je 0x48893a
mov ecx, 0x41126c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x488901
test dx, dx
je 0x4888fd
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x488901
add eax, 4
add ecx, 4
test dx, dx
jne 0x4888db
mov eax, ebx
jmp 0x488905
sbb eax, eax
or eax, esi
test eax, eax
jne 0x48893a
push 4
lea eax, [ebp - 0xc40]
mov dword [ebp - 0xc40], ebx
push eax
push 0xb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
test eax, eax
je 0x4886b3
test byte [ebp - 0xc40], 0xf
mov eax, esi
je 0x488940
mov eax, dword [ebp - 0xae4]
mov dword [ebp - 0xaec], eax
lea ecx, [ebp - 0xc24]
call fcn.004a83ac
lea ecx, [ebp - 0xc20]
call fcn.004a83ac
test edi, edi
jns 0x488968
xor eax, eax
mov dword [ebp - 0xaec], eax
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
lea ecx, [ebp - 0xbe0]
mov dword [ebp - 0xaf8], ebx
call fcn.004a8395
xor eax, eax
test ebx, ebx
jne 0x48899b
mov ebx, eax
mov dword [ebp - 0xbe0], eax
mov dword [ebp - 0xaf8], ebx
jmp 0x4889a1
mov dword [ebp - 0xbe0], ebx
test ebx, ebx
jne 0x488a52
mov ebx, 0x8007000e
mov eax, dword [ebp - 0xc04]
mov dword [ebp - 0xbe4], eax
xor edx, edx
mov esi, 0x4ba824
lea ecx, [edx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x4889c1
mov eax, dword [0x4ba820]
push 0
pop edx
test eax, eax
jle 0x488a20
sub eax, 1
mov dword [0x4ba820], eax
jne 0x488a20
mov edi, edx
mov eax, dword [edi + 0x4b9980]
test eax, eax
je 0x4889f7
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0x4889e6
push 0x40
xor eax, eax
push eax
push 0x4b9980
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x402210
mov edi, 0x4b7010
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0x4ba824
xchg dword [ecx], eax
lea ecx, [ebp - 0xbe0]
call fcn.004a8395
test ebx, ebx
jns 0x491430
cmp ebx, 0xd0000034
jne 0x4913ed
mov ebx, 0xc004f012
jmp 0x491422
mov dword [ebp - 0xac8], eax
lea edi, [ebp - 0xb2c]
mov dword [ebp - 0xadc], eax
mov esi, 0xc0000095
xor eax, eax
mov dword [ebp - 0xba8], 0x38
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0xaf0], eax
lea edi, [ebp - 0xbf0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0xb20], eax
mov edi, 0xa0
test ebx, ebx
jne 0x488b13
mov ebx, 0x80070057
mov dword [ebp - 0xac0], ebx
mov edi, dword [ebp - 0xac8]
xor esi, esi
mov dword [ebp - 0xb28], esi
mov dword [ebp - 0xb2c], esi
cmp dword [ebp - 0xb24], esi
je 0x488adb
push dword [ebp - 0xb24]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xb24], esi
mov eax, dword [ebp - 0xbe8]
mov dword [ebp - 0xbec], esi
mov dword [ebp - 0xbf0], esi
test eax, eax
je 0x48adc4
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebp - 0xbe8], eax
jmp 0x48adc6
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xb14], ebx
test ebx, ebx
jne 0x488b39
mov ebx, 0xc0000017
jmp 0x488a9f
push edi
push 0x4b8ca0
push ebx
call sub.msvcrt.dll_memcpy
mov edi, ebx
add esp, 0xc
mov dword [ebp - 0xac8], edi
push 8
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xafc], ecx
test ecx, ecx
jne 0x488b7d
mov ebx, 0xc0000017
mov dword [ebp - 0xac0], ebx
jmp 0x488aab
mov eax, dword [0x4b8c98]
mov dword [ecx], eax
mov eax, dword [0x4b8c9c]
mov dword [ecx + 4], eax
mov dword [ebp - 0xadc], ecx
rdtsc
mov dword [ebp - 0xb78], eax
mov dword [ebp - 0xb1c], edx
push 0xc
pop edi
lea eax, [ebp - 0xc1c]
mov edx, SysReAllocString
push eax
mov ecx, 0x40ff70
call fcn.004a83cc
test eax, eax
jns 0x488bcf
xor ebx, ebx
mov dword [ebp - 0xc1c], ebx
mov ebx, 0xc000003e
jmp 0x488a9f
mov eax, dword [ebp - 0xc1c]
inc eax
mov dword [ebp - 0xc1c], eax
lea eax, [eax*2 + 4]
cmp eax, 4
jb 0x488bee
mov edi, eax
xor ebx, ebx
jmp 0x488bf0
mov ebx, esi
mov dword [ebp - 0xac0], ebx
test ebx, ebx
js 0x488aa5
lea ecx, [edi + 0xc4]
mov edx, 0xc4
cmp ecx, edx
jb 0x488c11
mov eax, ecx
jmp 0x488c14
or eax, 0xffffffff
cmp ecx, edx
mov edi, 0x10000000
sbb ebx, ebx
and ebx, esi
add ebx, edi
mov dword [ebp - 0xac0], ebx
cmp ecx, edx
jb 0x48ad93
lea edx, [eax + 8]
cmp edx, eax
jb 0x488c3a
mov ecx, edx
jmp 0x488c3d
or ecx, 0xffffffff
cmp edx, eax
sbb ebx, ebx
and ebx, esi
add ebx, edi
mov dword [ebp - 0xac0], ebx
cmp edx, eax
jb 0x48ad93
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x488c5e
mov edx, eax
jmp 0x488c61
or edx, 0xffffffff
cmp eax, ecx
sbb ebx, ebx
and ebx, esi
add ebx, edi
mov dword [ebp - 0xac0], ebx
cmp eax, ecx
jb 0x48ad93
push edx
push 8
mov dword [ebp - 0xb28], edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x488b2f
mov dword [ebp - 0xb24], edx
xor ebx, ebx
mov dword [ebp - 0xb2c], ebx
mov dword [ebp - 0xcf4], ebx
lea edi, [edx + 4]
cmp edi, edx
jb 0x48adbd
mov ecx, dword [ebp - 0xb28]
lea eax, [edx + 8]
add ecx, edx
cmp eax, ecx
jbe 0x488ccf
mov ebx, 0xc0000023
jmp 0x488a9f
mov dword [edx], 4
mov dword [edi], ebx
mov ecx, dword [ebp - 0xb2c]
inc ecx
mov dword [ebp - 0xb2c], ecx
cmp dword [ebp - 0xb24], ebx
jne 0x488d12
mov eax, dword [ebp - 0xb28]
lea edx, [eax + 0xa4]
cmp edx, eax
jb 0x48adbd
inc ecx
mov dword [ebp - 0xb28], edx
mov dword [ebp - 0xb2c], ecx
jmp 0x488d9c
mov edx, dword [ebp - 0xb24]
mov edi, ebx
test ecx, ecx
je 0x488d3d
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x488dd0
add eax, edx
cmp eax, edx
jb 0x48adbd
inc edi
mov edx, eax
cmp edi, ecx
jb 0x488d1e
lea edi, [edx + 4]
cmp edi, edx
jb 0x48adbd
mov ecx, dword [ebp - 0xb28]
lea eax, [edx + 0xa4]
add ecx, dword [ebp - 0xb24]
mov dword [ebp - 0xac0], ebx
cmp eax, ecx
ja 0x488cc5
mov eax, 0xa0
push eax
push dword [ebp - 0xb14]
mov dword [edx], eax
push edi
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xb2c]
add esp, 0xc
inc ecx
mov dword [ebp - 0xb2c], ecx
test ebx, ebx
js 0x488aa5
mov edx, dword [ebp - 0xb28]
xor ebx, ebx
cmp dword [ebp - 0xb24], 0
jne 0x488dda
lea eax, [edx + 0xc]
cmp eax, edx
jb 0x48adbd
mov edx, eax
inc ecx
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0xc7c], eax
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0xc78], eax
jmp 0x488e7e
mov ebx, esi
mov dword [ebp - 0xac0], ebx
jmp 0x488d8c
mov edi, dword [ebp - 0xb24]
test ecx, ecx
je 0x488e03
mov eax, dword [edi]
add eax, 4
cmp eax, 4
jb 0x488e9b
add eax, edi
cmp eax, edi
jb 0x48adbd
inc ebx
mov edi, eax
cmp ebx, ecx
jb 0x488de4
lea eax, [edi + 4]
cmp eax, edi
jb 0x48adbd
mov ecx, dword [ebp - 0xb24]
xor eax, eax
mov ebx, eax
add ecx, edx
lea eax, [edi + 0xc]
mov dword [ebp - 0xac0], ebx
cmp eax, ecx
ja 0x488cc5
mov ecx, dword [ebp - 0xafc]
mov dword [edi], 8
mov eax, dword [ecx]
mov dword [edi + 4], eax
mov eax, dword [ecx + 4]
mov dword [edi + 8], eax
mov ecx, dword [ebp - 0xb2c]
mov edx, dword [ebp - 0xb28]
inc ecx
mov dword [ebp - 0xb2c], ecx
test ebx, ebx
js 0x488aa5
cmp dword [ebp - 0xb24], 0
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0xc7c], eax
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0xc78], eax
jne 0x488ea5
lea eax, [edx + 0xc]
cmp eax, edx
jb 0x48adbd
inc ecx
mov dword [ebp - 0xb28], eax
mov dword [ebp - 0xb2c], ecx
jmp 0x488f20
mov ebx, esi
mov dword [ebp - 0xac0], ebx
jmp 0x488e55
mov edi, dword [ebp - 0xb24]
xor eax, eax
mov ebx, eax
test ecx, ecx
je 0x488ed2
mov eax, dword [edi]
add eax, 4
cmp eax, 4
jb 0x488f47
add eax, edi
cmp eax, edi
jb 0x48adbd
inc ebx
mov edi, eax
cmp ebx, ecx
jb 0x488eb3
lea eax, [edi + 4]
cmp eax, edi
jb 0x48adbd
mov ecx, dword [ebp - 0xb24]
xor eax, eax
mov ebx, eax
add ecx, edx
lea eax, [edi + 0xc]
mov dword [ebp - 0xac0], ebx
cmp eax, ecx
ja 0x488cc5
mov eax, dword [ebp - 0xb78]
mov dword [edi], 8
mov dword [edi + 4], eax
mov eax, dword [ebp - 0xb1c]
mov dword [edi + 8], eax
inc dword [ebp - 0xb2c]
test ebx, ebx
js 0x488aa5
lea eax, [ebp - 0xbfc]
mov edx, SysReAllocString
push eax
mov ecx, 0x40ff70
call fcn.004a83cc
test eax, eax
jns 0x488f51
xor ebx, ebx
mov dword [ebp - 0xbfc], ebx
jmp 0x488bc5
mov ebx, esi
mov dword [ebp - 0xac0], ebx
jmp 0x488f18
mov eax, dword [ebp - 0xbfc]
lea ecx, [eax + 1]
cmp ecx, eax
jb 0x48adb6
lea eax, [ecx + ecx]
mov dword [ebp - 0xbfc], ecx
mov dword [ebp - 0xb10], eax
test eax, eax
je 0x489049
cmp dword [ebp - 0xb24], 0
jne 0x488fc3
lea ecx, [eax + 4]
cmp ecx, 4
jb 0x488fbc
mov eax, dword [ebp - 0xb28]
lea edi, [ecx + eax]
cmp edi, eax
jb 0x488fac
inc dword [ebp - 0xb2c]
xor eax, eax
mov dword [ebp - 0xb28], edi
mov ebx, eax
jmp 0x489054
or edi, 0xffffffff
mov dword [ebp - 0xb28], edi
mov ebx, esi
jmp 0x489054
mov ebx, esi
jmp 0x48904e
mov edx, dword [ebp - 0xb24]
xor ebx, ebx
mov ecx, ebx
cmp dword [ebp - 0xb2c], ecx
jbe 0x488ff6
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x488fbc
add eax, edx
cmp eax, edx
jb 0x488fbc
inc ecx
mov edx, eax
cmp ecx, dword [ebp - 0xb2c]
jb 0x488fd5
mov eax, dword [ebp - 0xb10]
mov edi, dword [ebp - 0xb28]
lea ecx, [edx + 4]
cmp ecx, edx
jb 0x488fb5
lea ecx, [eax + 4]
mov dword [ebp - 0xac0], ebx
mov eax, dword [ebp - 0xb24]
add ecx, edx
add eax, edi
cmp ecx, eax
jbe 0x489021
mov ebx, 0xc0000023
jmp 0x489054
mov eax, dword [ebp - 0xb10]
push eax
mov dword [edx], eax
lea eax, [edx + 4]
push 0x40ff70
push eax
call sub.msvcrt.dll_memcpy
mov edi, dword [ebp - 0xb28]
add esp, 0xc
inc dword [ebp - 0xb2c]
jmp 0x48905a
mov ebx, 0xc000000d
mov edi, dword [ebp - 0xb28]
mov dword [ebp - 0xac0], ebx
test ebx, ebx
js 0x488aa5
cmp dword [ebp - 0xb24], 0
mov eax, dword [ebp - 0xaec]
mov dword [ebp - 0xcdc], eax
jne 0x489099
lea eax, [edi + 8]
cmp eax, edi
jb 0x48adbd
inc dword [ebp - 0xb2c]
mov edi, eax
mov dword [ebp - 0xc74], 4
jmp 0x489128
mov edx, dword [ebp - 0xb24]
xor ebx, ebx
mov ecx, ebx
cmp dword [ebp - 0xb2c], ecx
jbe 0x4890ce
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x489143
add eax, edx
cmp eax, edx
jb 0x48adbd
inc ecx
mov edx, eax
cmp ecx, dword [ebp - 0xb2c]
jb 0x4890ab
lea eax, [edx + 4]
cmp eax, edx
jb 0x48adbd
mov ecx, dword [ebp - 0xb24]
lea eax, [edx + 8]
add ecx, edi
mov dword [ebp - 0xac0], ebx
cmp eax, ecx
ja 0x488cc5
mov eax, dword [ebp - 0xaec]
mov dword [edx], 4
mov dword [edx + 4], eax
inc dword [ebp - 0xb2c]
mov edi, dword [ebp - 0xb28]
test ebx, ebx
js 0x488aa5
cmp dword [ebp - 0xb24], 0
mov dword [ebp - 0xc74], 4
jne 0x48914d
lea eax, [edi + 8]
cmp eax, edi
jb 0x48adbd
inc dword [ebp - 0xb2c]
mov edi, eax
mov dword [ebp - 0xb28], edi
jmp 0x4891c2
mov ebx, esi
mov dword [ebp - 0xac0], ebx
jmp 0x48910d
mov edx, dword [ebp - 0xb24]
xor ebx, ebx
mov ecx, ebx
cmp dword [ebp - 0xb2c], ecx
jbe 0x489182
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x48924e
add eax, edx
cmp eax, edx
jb 0x48adbd
inc ecx
mov edx, eax
cmp ecx, dword [ebp - 0xb2c]
jb 0x48915f
lea eax, [edx + 4]
cmp eax, edx
jb 0x48adbd
mov ecx, dword [ebp - 0xb24]
lea eax, [edx + 8]
add ecx, edi
mov dword [ebp - 0xac0], ebx
cmp eax, ecx
ja 0x488cc5
push 4
pop eax
mov dword [edx], eax
mov dword [edx + 4], eax
inc dword [ebp - 0xb2c]
mov edi, dword [ebp - 0xb28]
test ebx, ebx
js 0x488aa5
xor ebx, ebx
rdtsc
mov dword [ebp - 0xb80], ebx
mov dword [ebp - 0xb00], ebx
mov dword [ebp - 0xad0], ebx
mov dword [ebp - 0xb34], ebx
mov dword [ebp - 0xb08], ebx
mov dword [ebp - 0xaf4], ebx
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xb18], ebx
mov dword [ebp - 0xb74], ebx
mov dword [ebp - 0xafc], ebx
mov dword [ebp - 0xb14], eax
mov dword [ebp - 0xb0c], edx
add edi, 8
cmp edi, 8
jb 0x4892d9
lea eax, [edi + 7]
and eax, 0xfffffff8
mov dword [ebp - 0xb10], eax
cmp eax, edi
jb 0x4892d9
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x48925b
mov ebx, 0xc0000017
jmp 0x4892db
mov ebx, esi
mov dword [ebp - 0xac0], ebx
jmp 0x4891ba
mov eax, dword [ebp - 0xb2c]
lea ecx, [edi + 4]
mov dword [edi], eax
cmp ecx, edi
jb 0x4892c0
mov eax, dword [ebp - 0xb28]
lea edx, [ecx + 4]
mov dword [ecx], eax
cmp edx, ecx
jb 0x4892c0
mov eax, dword [ebp - 0xb10]
mov ecx, dword [ebp - 0xb14]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xb0c]
mov dword [edi + eax - 4], ecx
push dword [ebp - 0xb28]
push dword [ebp - 0xb24]
push edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xb10]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xb80], edi
mov edi, ecx
mov dword [ebp - 0xb00], eax
jmp 0x4892c4
xor ecx, ecx
mov ebx, esi
test edi, edi
je 0x4892db
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4892db
mov ebx, esi
or ebx, 0x10000000
mov dword [ebp - 0xac0], ebx
jl 0x48a80b
mov ebx, dword [ebp - 0xb80]
xor ecx, ecx
mov dword [ebp - 0xb7c], ecx
test ebx, ebx
jne 0x489309
mov ebx, 0xc000000d
jmp 0x489994
mov edi, dword [ebp - 0xb00]
test edi, edi
je 0x48998f
lea eax, [edi + 8]
push eax
push ecx
mov dword [ebp - 0xb30], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb48], eax
test eax, eax
je 0x48998f
xor eax, eax
mov cl, al
mov edx, eax
test edi, edi
je 0x489351
xor cl, byte [edx + ebx]
inc edx
cmp edx, edi
jb 0x489347
xor eax, eax
mov dword [ebp - 0xb90], eax
or ebx, 0xffffffff
mov eax, edi
mov dword [ebp - 0x3c8], 0xb1b54a58
shr eax, 3
mov edx, 0xc81ecb17
mov dword [ebp - 0x3c4], edx
mov dword [ebp - 0xb94], ebx
mov dword [ebp - 0xb44], eax
test eax, eax
je 0x4897ad
movzx edx, word [ebp - 0x3c6]
mov eax, 0xc81ecb17
movzx esi, ax
movzx eax, word [ebp - 0x3c2]
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0xb48]
mov dword [ebp - 0xad8], edx
add eax, 7
mov edx, dword [ebp - 0xb80]
mov dword [ebp - 0xac0], eax
add edx, 2
xor eax, eax
mov dword [ebp - 0xacc], esi
mov dword [ebp - 0xb10], eax
mov dword [ebp - 0xae4], eax
movzx edi, byte [edx - 2]
movzx eax, byte [edx - 1]
movzx esi, byte [edx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [edx]
shl edi, 8
or edi, eax
movzx eax, byte [edx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [edx + 3]
or esi, eax
movzx eax, byte [edx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [edx + 5]
add edx, 8
shl esi, 8
or esi, eax
mov dword [ebp - 0xb14], edx
xor ebx, esi
mov eax, 0xc81ecb17
mov dword [ebp - 0xad4], ebx
add ebx, 0xffffb5a8
xor ebx, edi
xor ebx, dword [ebp - 0xb90]
xor ebx, eax
mov edx, ebx
xor edx, eax
mov eax, ebx
ror edx, 0xf
imul edx, dword [ebp - 0xad8]
ror eax, 7
add eax, edx
mov edx, dword [ebp - 0xad4]
xor edx, eax
mov dword [ebp - 0xad4], edx
add edx, 0xb1b54a58
mov eax, dword [ebp - 0xad4]
ror edx, 9
imul edx, dword [ebp - 0xacc]
ror eax, 0xa
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xacc]
rol edx, 4
imul edx, dword [ebp - 0xae0]
rol eax, 5
add eax, edx
mov edx, dword [ebp - 0xad4]
xor edx, eax
mov eax, 0xc81ecb17
mov dword [ebp - 0xad4], edx
xor edx, 0xb1b54a58
sub eax, edx
xor ebx, eax
mov eax, ebx
shr eax, 6
lea edx, [ebx - 0x4a58]
imul edx, dword [ebp - 0xad8]
sub edx, eax
xor dword [ebp - 0xad4], edx
mov edx, dword [ebp - 0xad4]
mov eax, edx
ror eax, 0xf
xor eax, dword [ebp - 0xacc]
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, dword [ebp - 0xae0]
imul eax, dword [ebp - 0xacc]
xor edx, eax
mov dword [ebp - 0xad4], edx
sub edx, 0xc81ecb17
sub edx, 0x4a58
xor ebx, edx
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xae0]
imul eax, dword [ebp - 0xad8]
ror edx, 0xa
xor edx, eax
mov eax, dword [ebp - 0xad4]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xad4], eax
xor edx, 0x4a58
ror eax, 3
rol edx, 6
imul edx, dword [ebp - 0xacc]
xor eax, edx
mov edx, dword [ebp - 0xad4]
xor ebx, eax
mov eax, ebx
ror eax, 0xf
sub eax, dword [ebp - 0xae0]
imul eax, eax, 0x4a58
xor edx, eax
mov dword [ebp - 0xad4], edx
xor edx, dword [ebp - 0xae0]
mov eax, dword [ebp - 0xad4]
imul edx, edx, 0x4a58
shr eax, 1
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xad4]
mov eax, edx
shr edx, 0xf
sub eax, dword [ebp - 0xacc]
rol eax, 3
imul eax, eax, 0x4a58
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
sub edx, dword [ebp - 0xacc]
imul edx, dword [ebp - 0xad8]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xad4]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xad4], eax
ror edx, 9
imul edx, dword [ebp - 0xacc]
ror eax, 0xb
xor eax, edx
mov edx, dword [ebp - 0xad4]
xor ebx, eax
mov eax, ebx
sub eax, dword [ebp - 0xae0]
add eax, 0x4e4ab5a8
xor edx, eax
mov dword [ebp - 0xad4], edx
mov eax, dword [ebp - 0xad4]
xor eax, dword [ebp - 0xad8]
imul eax, eax, 0x4a58
ror edx, 7
sub eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xae0]
rol edx, 4
imul edx, dword [ebp - 0xad8]
ror eax, 0x10
sub edx, eax
mov eax, dword [ebp - 0xad4]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xad4], eax
ror edx, 0xa
ror eax, 4
imul edx, dword [ebp - 0xacc]
add eax, edx
xor ebx, eax
mov eax, ebx
ror eax, 9
lea edx, [ebx + 0x4e4ab5a8]
ror edx, 4
imul edx, dword [ebp - 0xae0]
xor eax, edx
mov edx, dword [ebp - 0xad4]
xor edx, eax
mov eax, edx
mov dword [ebp - 0xad4], edx
xor eax, 0xc81ecb17
rol edx, 2
rol eax, 8
imul eax, eax, 0x4a58
sub eax, edx
mov edx, 0xc81ecb17
xor ebx, eax
sub edx, ebx
mov eax, ebx
ror edx, 0xb
imul edx, dword [ebp - 0xad8]
ror eax, 0xc
sub edx, eax
mov eax, dword [ebp - 0xad4]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xad4], eax
xor edx, dword [ebp - 0xad8]
imul edx, dword [ebp - 0xacc]
shr eax, 8
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xae4]
mov eax, ebx
mov dword [ebp - 0xae4], esi
xor ebx, dword [ebp - 0xb10]
xor edx, eax
xor edx, 0xc81ecb17
mov dword [ebp - 0xb90], ebx
xor edx, dword [ebp - 0xad4]
xor edx, 0xb1b54a58
mov dword [ebp - 0xb10], edi
mov dword [ebp - 0xb94], edx
mov edx, dword [ebp - 0xac0]
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb94]
ror dword [ebp - 0xb90], 8
mov byte [edx], al
ror dword [ebp - 0xb94], 8
mov al, byte [ebp - 0xb90]
mov byte [edx - 5], al
mov al, byte [ebp - 0xb94]
ror dword [ebp - 0xb90], 8
mov byte [edx - 1], al
ror dword [ebp - 0xb94], 8
mov al, byte [ebp - 0xb90]
mov byte [edx - 6], al
mov al, byte [ebp - 0xb94]
ror dword [ebp - 0xb90], 8
mov byte [edx - 2], al
ror dword [ebp - 0xb94], 8
mov al, byte [ebp - 0xb90]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb94]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [ebp - 0xb94]
ror dword [ebp - 0xb90], 8
ror ebx, 8
sub dword [ebp - 0xb44], 1
mov dword [ebp - 0xac0], edx
mov edx, dword [ebp - 0xb14]
mov dword [ebp - 0xb94], ebx
jne 0x4893d6
mov edi, dword [ebp - 0xb00]
mov esi, 0xc0000095
mov ebx, dword [ebp - 0xb48]
movzx eax, cl
cdq
mov dword [ebx + edi], eax
mov dword [ebx + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x4897df
mov ebx, 0xc0000017
jmp 0x4898f2
mov eax, dword [ebp - 0xb30]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x489807
mov ebx, 0xc0000017
xor edx, edx
jmp 0x48988b
mov dword [edi + 4], eax
push dword [ebp - 0xb30]
push ebx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4897fb
mov dword [edi + 0xc], eax
push 0xa0
push 0x4b8bf0
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [edi + 0x10], ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0x48986f
mov ebx, 0xc0000017
jmp 0x48988b
mov dword [edi + 0x14], ecx
mov ebx, edx
mov eax, dword [0x4b8c90]
mov dword [ecx], eax
mov eax, dword [0x4b8c94]
mov dword [ebp - 0xb7c], edi
mov edi, edx
mov dword [ecx + 4], eax
test edi, edi
je 0x4898f2
cmp dword [edi + 4], 0
je 0x4898ab
push dword [edi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
mov dword [edi + 4], edx
cmp dword [edi + 0xc], 0
je 0x4898c7
push dword [edi + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
mov dword [edi + 0xc], edx
cmp dword [edi + 0x14], 0
je 0x4898e3
push dword [edi + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
mov dword [edi + 0x14], edx
push edi
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
js 0x489908
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xad0], eax
xor eax, eax
mov edi, eax
jmp 0x48990e
mov edi, dword [ebp - 0xb7c]
mov eax, dword [ebp - 0xb48]
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x489994
xor eax, eax
cmp dword [edi + 4], eax
je 0x489946
push dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x489962
push dword [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0x48997e
push dword [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x489994
mov ebx, 0xc0000001
or ebx, 0x10000000
mov dword [ebp - 0xac0], ebx
jl 0x48a80b
mov edx, dword [ebp - 0xad0]
mov eax, dword [edx]
mov edi, dword [edx + 0x10]
add eax, 4
mov ecx, dword [edx + 8]
cmp eax, 4
jb 0x489ac9
lea edx, [eax + 4]
cmp edx, eax
jb 0x489ac9
add ecx, edx
cmp ecx, edx
jb 0x489ac9
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x489ac9
lea ecx, [eax + edi]
mov dword [ebp - 0xb14], ecx
cmp ecx, eax
jb 0x489ac9
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x489a11
mov ebx, 0xc0000017
jmp 0x489acb
mov edx, dword [ebp - 0xad0]
lea ebx, [edi + 4]
mov eax, dword [edx]
mov dword [edi], eax
cmp ebx, edi
jb 0x489ab0
push dword [edx]
push dword [edx + 4]
push ebx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0xad0]
add esp, 0xc
mov ecx, dword [edx]
add ecx, ebx
cmp ecx, ebx
jb 0x489ab0
mov eax, dword [edx + 8]
lea ebx, [ecx + 4]
mov dword [ecx], eax
cmp ebx, ecx
jb 0x489ab0
push dword [edx + 8]
push dword [edx + 0xc]
push ebx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0xad0]
add esp, 0xc
mov ecx, dword [edx + 8]
add ecx, ebx
cmp ecx, ebx
jb 0x489ab0
mov eax, dword [edx + 0x10]
lea ebx, [ecx + 4]
mov dword [ecx], eax
cmp ebx, ecx
jb 0x489ab0
push dword [edx + 0x10]
push dword [edx + 0x14]
push ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xad0]
add esp, 0xc
xor ecx, ecx
mov eax, dword [eax + 0x10]
add eax, ebx
cmp eax, ebx
jb 0x489ab2
mov eax, dword [ebp - 0xb14]
mov ebx, ecx
mov dword [ebp - 0xb34], edi
mov edi, ecx
mov dword [ebp - 0xb08], eax
jmp 0x489ab4
xor ecx, ecx
mov ebx, esi
test edi, edi
je 0x489acb
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x489acb
mov ebx, esi
or ebx, 0x10000000
mov dword [ebp - 0xac0], ebx
jl 0x48a80b
cmp dword [ebp - 0xb24], 0
jne 0x489af0
mov ebx, 0xc000000d
jmp 0x489b95
xor ebx, ebx
inc ebx
cmp dword [ebp - 0xb2c], ebx
jbe 0x489ae6
mov ecx, dword [ebp - 0xb24]
xor eax, eax
mov edx, eax
mov edi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x489b93
lea ecx, [edi + eax]
cmp ecx, eax
jb 0x489b93
inc edx
cmp edx, ebx
jb 0x489b05
mov ebx, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x489b93
cmp dword [ebp - 0xb2c], 2
jbe 0x489ae6
mov ecx, dword [ebp - 0xb24]
xor eax, eax
mov edx, eax
mov edi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x489b93
lea ecx, [edi + eax]
cmp ecx, eax
jb 0x489b93
inc edx
cmp edx, 2
jb 0x489b3a
mov edx, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x489b93
lea eax, [ebx + 0x50]
cmp eax, 0x50
jb 0x489b93
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x489b93
lea eax, [ecx + edx]
cmp eax, ecx
jb 0x489b93
mov edi, eax
mov dword [ebp - 0xac4], edi
xor eax, eax
mov ebx, eax
mov dword [ebp - 0xac0], ebx
cmp edi, 0x400000
jbe 0x489ba1
mov ebx, 0x8000ffff
jmp 0x48a805
mov ebx, esi
mov edi, dword [ebp - 0xac4]
mov dword [ebp - 0xac0], ebx
test ebx, ebx
js 0x48a80b
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x489bca
mov ecx, dword [ebp - 0xaf4]
mov ebx, 0xd0000017
jmp 0x489bd7
mov ecx, eax
mov dword [ebp - 0xaf4], ecx
mov ebx, 0x10000000
mov dword [ebp - 0xac0], ebx
test ebx, ebx
js 0x48a80b
mov eax, dword [ebp - 0xb34]
test eax, eax
jne 0x489bf9
mov ebx, 0x80070057
jmp 0x48a805
test ecx, ecx
je 0x489bef
mov dword [ebp - 0xcb8], eax
xor ebx, ebx
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0xcb0], eax
lea eax, [ebp - 0xc94]
push eax
push 0x411248
push 1
mov dword [ebp - 0xcb4], ecx
mov dword [ebp - 0xcac], edi
mov dword [ebp - 0xca8], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x489c73
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xac0], ebx
test ebx, ebx
jle 0x489c5e
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xac0], ebx
test ebx, ebx
mov eax, dword [ebp - 0xac4]
js 0x489cc7
mov ebx, 0x80004005
mov dword [ebp - 0xac0], ebx
jmp 0x489cc7
push 0x413650
push dword [ebp - 0xc94]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x489c3b
push ebx
push 0x14
lea eax, [ebp - 0xcb8]
mov ecx, edi
push eax
push 0x86
call dword [0x4bb544]
call edi
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xac0], ebx
jl 0x489cc1
mov eax, dword [ebp - 0xcac]
mov dword [ebp - 0xac4], eax
jmp 0x489cc7
mov eax, dword [ebp - 0xac4]
cmp ebx, 0xd0000023
jne 0x489cd9
mov ebx, 0x8007007a
jmp 0x48a805
test ebx, ebx
js 0x48a80b
xor ecx, ecx
mov dword [ebp - 0xb14], ecx
cmp eax, 4
jae 0x489cf8
mov ebx, 0xc000003e
jmp 0x48a041
mov ebx, dword [ebp - 0xaf4]
mov ecx, dword [ebx]
lea edx, [ebx + 4]
mov dword [ebp - 0xae0], ecx
cmp edx, ebx
jb 0x48a03d
add eax, 0xfffffffc
cmp eax, ecx
jae 0x489d22
mov ebx, 0xc000003e
jmp 0x48a03f
lea ebx, [ecx + edx]
cmp ebx, edx
jb 0x48a03d
lea edx, [ecx + 4]
cmp edx, 4
jb 0x48a03d
mov eax, dword [ebp - 0xac4]
sub eax, edx
cmp eax, 4
jb 0x489d18
mov eax, dword [ebp - 0xaf4]
mov ebx, dword [ebx]
add eax, 4
mov edi, dword [ebp - 0xb14]
add eax, ecx
lea edx, [eax + 4]
mov dword [ebp - 0xae4], edx
cmp edx, eax
lea edx, [ecx + 4]
jb 0x48a03d
lea eax, [edx + 4]
mov dword [ebp - 0xb14], eax
cmp eax, edx
jb 0x48a03d
mov eax, dword [ebp - 0xac4]
mov edx, dword [ebp - 0xb14]
sub eax, edx
cmp eax, ebx
jb 0x489d18
mov eax, dword [ebp - 0xae4]
add eax, ebx
cmp eax, dword [ebp - 0xae4]
jb 0x48a03d
lea eax, [ebx + edx]
mov dword [ebp - 0xb00], eax
cmp eax, edx
jb 0x48a03d
mov eax, dword [ebp - 0xac4]
sub eax, dword [ebp - 0xb00]
cmp eax, 4
jb 0x489d18
mov eax, dword [ebp - 0xae4]
add eax, ebx
mov edx, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xb0c], edx
mov dword [ebp - 0xb30], ecx
cmp ecx, eax
jb 0x48a03d
mov eax, dword [ebp - 0xb00]
add eax, 4
mov dword [ebp - 0xb08], eax
cmp eax, dword [ebp - 0xb00]
jb 0x48a03d
mov eax, dword [ebp - 0xac4]
sub eax, dword [ebp - 0xb08]
cmp eax, edx
jb 0x489d18
mov eax, dword [ebp - 0xb08]
lea ecx, [edx + eax]
mov dword [ebp - 0xb14], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0xae0]
jb 0x48a03d
mov esi, dword [ebp - 0xac4]
mov eax, esi
sub eax, dword [ebp - 0xb14]
jne 0x489d18
lea eax, [ebx + 0xc]
add eax, edx
add eax, ecx
cmp eax, esi
jne 0x489d18
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x489e7b
mov ebx, 0xc0000017
jmp 0x489fc6
mov eax, dword [ebp - 0xaf4]
add eax, 4
je 0x489ed0
mov eax, dword [ebp - 0xae0]
push eax
push 8
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x489eb0
mov ebx, 0xc0000017
xor eax, eax
jmp 0x489f5f
mov dword [esi + 4], ecx
mov edx, dword [ebp - 0xaf4]
push dword [ebp - 0xae0]
lea eax, [edx + 4]
push eax
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0x489ed7
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
cmp dword [ebp - 0xae4], edi
je 0x489f0d
push ebx
push 8
mov dword [esi + 8], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x489ea4
mov dword [esi + 0xc], eax
push ebx
push dword [ebp - 0xae4]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0x489f13
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
cmp dword [ebp - 0xb30], edi
je 0x489f53
mov ebx, dword [ebp - 0xb0c]
push ebx
push 8
mov dword [esi + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x489ea4
mov dword [esi + 0x14], eax
push ebx
push dword [ebp - 0xb30]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0x489f59
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov edi, esi
mov ebx, eax
mov esi, eax
test esi, esi
je 0x489fc6
cmp dword [esi + 4], 0
je 0x489f7f
push dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0x489f9b
push dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0x489fb7
push dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
test ebx, ebx
js 0x489fd4
mov dword [ebp - 0xb18], edi
mov edi, ecx
test edi, edi
je 0x48a041
cmp dword [edi + 4], 0
je 0x489ff4
push dword [edi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 4], ecx
cmp dword [edi + 0xc], 0
je 0x48a010
push dword [edi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0xc], ecx
cmp dword [edi + 0x14], 0
je 0x48a02c
push dword [edi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0x14], ecx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x48a03f
mov ebx, esi
xor ecx, ecx
or ebx, 0x10000000
mov dword [ebp - 0xac0], ebx
jl 0x48a80b
mov eax, dword [ebp - 0xb18]
mov edi, ecx
mov dword [ebp - 0xae8], edi
mov dword [ebp - 0xb0c], ecx
test eax, eax
jne 0x48a075
mov ebx, 0xd000000d
jmp 0x48a805
mov esi, dword [eax + 4]
mov dword [ebp - 0xb3c], esi
test esi, esi
je 0x48a06b
mov ebx, dword [eax]
test ebx, ebx
je 0x48a06b
add ebx, 0xfffffff8
mov dword [ebp - 0xb04], ecx
push ebx
push ecx
mov dword [ebp - 0xb48], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb10], eax
test eax, eax
je 0x48a6a9
xor ecx, ecx
mov dword [ebp - 0x3d0], 0xab69605e
mov dl, cl
mov edi, esi
mov ecx, 0x7f1137f
mov dword [ebp - 0xb30], edi
mov dword [ebp - 0x3cc], ecx
mov esi, ebx
mov ecx, eax
mov dword [ebp - 0xb00], ecx
and esi, 7
je 0x48a63c
or dword [ebp - 0xb50], 0xffffffff
xor eax, eax
mov dword [ebp - 0xb6c], eax
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xb08], eax
test esi, esi
je 0x48a152
push 0x38
pop ecx
mov ebx, ecx
cmp eax, 4
movzx eax, byte [edi]
jge 0x48a127
lea ecx, [ebx - 0x20]
shl eax, cl
or dword [ebp - 0xad8], eax
jmp 0x48a131
mov ecx, ebx
shl eax, cl
or dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0xb08]
inc edi
inc eax
sub ebx, 8
mov dword [ebp - 0xb08], eax
cmp eax, esi
jl 0x48a112
mov ecx, dword [ebp - 0xb00]
mov dword [ebp - 0xb30], edi
mov eax, dword [ebp - 0xad8]
xor edi, edi
mov ebx, dword [ebp - 0xac4]
xor eax, 0x92f65a5
xor ebx, 0x699a899c
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xb6c], eax
mov dword [ebp - 0xb50], ebx
test esi, esi
je 0x48a1b0
cmp edi, 4
jge 0x48a18d
rol eax, 8
mov byte [ecx], al
jmp 0x48a192
rol ebx, 8
mov byte [ecx], bl
inc ecx
inc edi
cmp edi, esi
jl 0x48a181
mov eax, dword [ebp - 0xb6c]
mov ebx, dword [ebp - 0xb50]
mov dword [ebp - 0xb00], ecx
mov dword [ebp - 0xae0], eax
cmp esi, 4
jbe 0x48a608
push 8
pop ecx
sub ecx, esi
shl ecx, 3
shr ebx, cl
shl ebx, cl
mov dword [ebp - 0xb7c], ebx
mov dword [ebp - 0xb50], ebx
mov edi, dword [ebp - 0xae0]
mov ebx, dword [ebp - 0xb48]
mov eax, ebx
shr eax, 3
mov dword [ebp - 0xb44], eax
test eax, eax
je 0x48a5c9
movzx ecx, word [ebp - 0x3ca]
mov eax, 0x7f1137f
movzx esi, word [ebp - 0x3ce]
movzx eax, ax
mov dword [ebp - 0xac0], eax
mov eax, dword [ebp - 0xb00]
mov dword [ebp - 0xae4], ecx
add eax, 7
mov ecx, dword [ebp - 0xb30]
add ecx, 2
mov dword [ebp - 0xacc], esi
mov esi, dword [ebp - 0xb7c]
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xad4], ecx
movzx ebx, byte [ecx - 2]
movzx eax, byte [ecx - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 1]
movzx ecx, byte [ecx + 2]
shl ecx, 8
shl ebx, 8
or ebx, eax
mov eax, dword [ebp - 0xad4]
xor edi, ebx
mov dword [ebp - 0xb14], ebx
mov dword [ebp - 0xae0], edi
mov edi, 0x7f1137f
mov ebx, dword [ebp - 0xae0]
movzx eax, byte [eax + 3]
or ecx, eax
mov eax, dword [ebp - 0xad4]
shl ecx, 8
movzx eax, byte [eax + 4]
or ecx, eax
mov eax, dword [ebp - 0xad4]
shl ecx, 8
add dword [ebp - 0xad4], 8
movzx eax, byte [eax + 5]
or ecx, eax
mov eax, dword [ebp - 0xac0]
xor esi, ecx
mov dword [ebp - 0xb30], ecx
xor edi, esi
xor edi, ebx
xor edi, 0xab69605e
mov ecx, edi
rol ecx, 0xa
lea esi, [edi + 0x54969fa2]
rol esi, 5
imul eax, esi
mov esi, dword [ebp - 0xac0]
add ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ebx + ecx]
ror ecx, 9
imul ecx, dword [ebp - 0xacc]
sub ecx, eax
xor edi, ecx
mov eax, edi
sub eax, esi
imul ecx, eax, 0x605e
mov eax, edi
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xacc]
rol ecx, 6
imul ecx, dword [ebp - 0xae4]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor edi, ecx
mov ecx, edi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, 0x7f1137f
xor esi, ebx
mov ecx, ebx
imul esi, dword [ebp - 0xacc]
ror ecx, 6
xor ecx, esi
xor edi, ecx
add eax, edi
mov ecx, edi
ror eax, 0xf
imul eax, eax, 0x605e
rol ecx, 2
add ecx, eax
xor ebx, ecx
mov eax, ebx
rol eax, 8
lea ecx, [ebx + 0x54969fa2]
ror ecx, 0xe
imul ecx, dword [ebp - 0xae4]
sub ecx, eax
mov eax, dword [ebp - 0xac0]
xor edi, ecx
mov esi, edi
mov ecx, edi
ror ecx, 0xa
xor esi, 0xab69605e
ror esi, 0xc
imul eax, esi
xor ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xae4]
imul ecx, dword [ebp - 0xacc]
shr eax, 0xa
xor ecx, eax
xor edi, ecx
mov eax, edi
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xae4]
xor ebx, eax
mov esi, ebx
sub esi, dword [ebp - 0xae4]
xor esi, edi
xor esi, 0xab69605e
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0xae4]
rol ecx, 2
imul ecx, dword [ebp - 0xac0]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 6
imul ecx, dword [ebp - 0xacc]
rol eax, 7
add eax, ecx
xor esi, eax
mov eax, esi
mov ecx, esi
xor eax, dword [ebp - 0xac0]
imul eax, eax, 0x605e
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov dword [ebp - 0xae0], ebx
xor ecx, dword [ebp - 0xacc]
mov eax, ebx
rol ecx, 5
imul ecx, dword [ebp - 0xae4]
rol eax, 7
add eax, ecx
mov ecx, 0x7f1137f
xor esi, eax
mov ebx, ecx
xor ebx, esi
xor ebx, dword [ebp - 0xae0]
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xacc]
imul eax, dword [ebp - 0xac0]
xor esi, eax
mov eax, esi
sub eax, ecx
mov ecx, esi
ror eax, 1
imul eax, eax, 0x605e
ror ecx, 6
sub eax, ecx
xor ebx, eax
mov eax, ebx
rol eax, 0xe
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul ecx, dword [ebp - 0xae4]
add eax, ecx
xor esi, eax
mov eax, esi
ror eax, 0xe
lea ecx, [esi - 0x54969fa2]
rol ecx, 0xf
imul ecx, dword [ebp - 0xac0]
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, 0x605e
shr eax, 3
imul ecx, dword [ebp - 0xacc]
xor ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov eax, esi
xor eax, ecx
mov ecx, esi
xor esi, dword [ebp - 0xac4]
rol eax, 4
imul eax, eax, 0x605e
rol ecx, 2
mov dword [ebp - 0xb50], esi
xor ecx, eax
xor ecx, dword [ebp - 0xad8]
xor ebx, ecx
mov ecx, dword [ebp - 0xb08]
mov dword [ebp - 0xb6c], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb50]
ror dword [ebp - 0xb6c], 8
mov byte [ecx], al
mov al, byte [ebp - 0xb6c]
ror dword [ebp - 0xb50], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb50]
ror dword [ebp - 0xb6c], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xb6c]
ror dword [ebp - 0xb50], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xb50]
ror dword [ebp - 0xb6c], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xb50], 8
mov al, byte [ebp - 0xb6c]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb50]
mov byte [ecx - 3], al
add ecx, 8
mov edi, dword [ebp - 0xb6c]
mov esi, dword [ebp - 0xb50]
mov eax, dword [ebp - 0xb14]
ror edi, 8
ror esi, 8
sub dword [ebp - 0xb44], 1
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0xb30]
mov dword [ebp - 0xb08], ecx
mov ecx, dword [ebp - 0xad4]
mov dword [ebp - 0xb6c], edi
mov dword [ebp - 0xb50], esi
mov dword [ebp - 0xac4], eax
jne 0x48a23c
mov ebx, dword [ebp - 0xb48]
mov esi, dword [ebp - 0xb10]
xor eax, eax
mov ecx, eax
test ebx, ebx
je 0x48a5df
xor dl, byte [ecx + esi]
inc ecx
cmp ecx, ebx
jb 0x48a5d7
mov ecx, dword [ebp - 0xb3c]
movzx eax, dl
cdq
cmp eax, dword [ebx + ecx]
jne 0x48a666
cmp edx, dword [ebx + ecx + 4]
jne 0x48a666
xor eax, eax
mov dword [ebp - 0xb0c], ebx
mov ebx, dword [ebp - 0xb04]
mov edi, esi
mov esi, eax
jmp 0x48a673
xor ecx, ecx
mov dword [ebp - 0xb7c], ecx
mov dword [ebp - 0xb50], ecx
cmp esi, 4
jae 0x48a1d1
push 4
pop ecx
sub ecx, esi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xb6c], eax
jmp 0x48a1d1
xor eax, eax
or dword [ebp - 0xac4], 0xffffffff
mov ecx, eax
mov dword [ebp - 0xad8], eax
mov edi, eax
mov dword [ebp - 0xb7c], ecx
mov dword [ebp - 0xb50], ecx
mov dword [ebp - 0xb6c], edi
jmp 0x48a1dd
mov edi, dword [ebp - 0xae8]
mov ebx, 0xc004d501
xor eax, eax
test esi, esi
je 0x48a686
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
js 0x48a6a9
mov eax, dword [ebp - 0xb0c]
mov esi, edi
xor ecx, ecx
mov dword [ebp - 0xb74], esi
mov edi, ecx
mov dword [ebp - 0xafc], eax
mov ebx, 0x10000000
jmp 0x48a6b6
mov esi, dword [ebp - 0xb74]
mov ebx, 0xd0000001
xor ecx, ecx
mov dword [ebp - 0xac0], ebx
test edi, edi
je 0x48a6cf
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
js 0x48a80b
mov ebx, dword [ebp - 0xafc]
cmp ebx, 4
jae 0x48a6ec
mov ebx, 0xc000003e
jmp 0x48a7ff
mov eax, dword [esi]
lea ecx, [esi + 4]
mov dword [ebp - 0xae8], eax
cmp ecx, esi
jb 0x48a7fa
lea eax, [ebx - 4]
cmp eax, 4
jb 0x48a6e2
mov edi, dword [ecx]
lea esi, [ecx + 4]
cmp esi, ecx
jb 0x48a7fa
lea eax, [ebx - 8]
cmp eax, edi
jb 0x48a6e2
lea eax, [edi + 8]
cmp eax, 8
jb 0x48a7fa
mov ecx, dword [ebp - 0xb74]
lea edx, [esi + edi]
lea eax, [ebx + ecx]
cmp eax, edx
jb 0x48a6e2
sub ebx, esi
sub ebx, edi
add ebx, ecx
cmp ebx, 8
jae 0x48a6e2
xor eax, eax
mov dword [ebp - 0xb00], eax
mov ebx, eax
test esi, esi
je 0x48a78f
mov ecx, esi
cmp edx, esi
jb 0x48a7fa
jbe 0x48a78b
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x48a7fa
cmp eax, edx
ja 0x48a7b0
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0x48a7b7
add eax, ecx
cmp eax, ecx
jb 0x48a7fa
mov ecx, eax
cmp ecx, edx
ja 0x48a7b0
inc dword [ebp - 0xb00]
cmp ecx, edx
jb 0x48a75c
cmp ecx, edx
jne 0x48a7b0
test edi, edi
je 0x48a7be
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x48a7be
mov ebx, 0xc0000017
jmp 0x48a7e3
mov ebx, 0xc000000d
jmp 0x48a7ff
mov ebx, 0xc0000095
jmp 0x48a7e3
test esi, esi
je 0x48a7cd
push edi
push esi
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0xb00]
mov dword [ebp - 0xbe8], ebx
mov dword [ebp - 0xbf0], eax
xor eax, eax
mov ebx, eax
test ebx, ebx
js 0x48a7ff
mov eax, dword [ebp - 0xae8]
cmp eax, dword [ebp - 0xbf0]
je 0x48a7ff
jmp 0x48a6e2
mov ebx, 0xc0000095
or ebx, 0x10000000
mov dword [ebp - 0xac0], ebx
mov eax, dword [ebp - 0xb80]
test eax, eax
je 0x48a826
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp - 0xad0]
test esi, esi
je 0x48a894
xor eax, eax
cmp dword [esi + 4], eax
je 0x48a84d
push dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0x48a869
push dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0x48a885
push dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb34]
test eax, eax
je 0x48a8af
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xaf4]
test eax, eax
je 0x48a8ca
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp - 0xb18]
test esi, esi
je 0x48a938
xor eax, eax
cmp dword [esi + 4], eax
je 0x48a8f1
push dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0x48a90d
push dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0x48a929
push dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb74]
test eax, eax
je 0x48a953
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
js 0x488aa5
xor edi, edi
inc edi
cmp dword [ebp - 0xbf0], edi
jae 0x48a970
mov ebx, 0xc004d501
jmp 0x488a9f
cmp dword [ebp - 0xbe8], 0
jne 0x48a9dc
mov ebx, 0xc000000d
mov dword [ebp - 0xac0], ebx
mov eax, dword [ebp - 0xb20]
test ebx, ebx
js 0x488aa5
cmp eax, 0xd0000023
jne 0x48a9a4
mov eax, 0x8007007a
mov dword [ebp - 0xb20], eax
cmp eax, 0x8007007a
je 0x48a9bb
mov ebx, eax
mov dword [ebp - 0xac0], ebx
test eax, eax
js 0x488aa5
cmp dword [ebp - 0xbf0], 6
jne 0x48a966
cmp dword [ebp - 0xbe8], 0
jne 0x48aa40
mov ebx, 0xc000000d
mov esi, 0xc0000095
jmp 0x48aacd
cmp dword [ebp - 0xbf0], 0
jbe 0x48a979
mov eax, dword [ebp - 0xbe8]
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x48a9fa
xor eax, eax
mov ebx, eax
jmp 0x48aa02
or ecx, 0xffffffff
mov ebx, 0xc0000095
mov dword [ebp - 0xac0], ebx
test ebx, ebx
js 0x48aa16
mov eax, edx
neg eax
sbb eax, eax
and eax, ecx
jmp 0x48aa22
mov edx, dword [ebp - 0xcd8]
mov eax, dword [ebp - 0xcd4]
test ebx, ebx
js 0x48a984
cmp edx, 4
jne 0x488cc5
mov eax, dword [eax]
mov dword [ebp - 0xb20], eax
jmp 0x48a98a
mov eax, dword [ebp - 0xbe8]
xor ecx, ecx
mov edx, ecx
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x48aac6
lea eax, [esi + ecx]
cmp eax, ecx
jb 0x48aac6
inc edx
cmp edx, edi
jb 0x48aa4a
mov edi, dword [eax]
lea edx, [eax + 4]
cmp edx, eax
jb 0x48aa70
mov dword [ebp - 0xafc], edx
jmp 0x48aa77
or dword [ebp - 0xafc], 0xffffffff
cmp edx, eax
mov esi, 0xc0000095
sbb ebx, ebx
and ebx, esi
mov dword [ebp - 0xac0], ebx
cmp edx, eax
jb 0x48aa9a
mov ecx, edi
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xafc]
jmp 0x48aaa6
mov edi, dword [ebp - 0xcd0]
mov ecx, dword [ebp - 0xd00]
cmp edx, eax
jb 0x48aad3
cmp edi, 8
jne 0x488cc5
mov eax, dword [ecx]
mov dword [ebp - 0xc70], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0xc6c], eax
jmp 0x48aad3
mov esi, 0xc0000095
mov ebx, esi
mov dword [ebp - 0xac0], ebx
test ebx, ebx
js 0x488aa5
cmp dword [ebp - 0xbe8], 0
jne 0x48aaeb
mov ebx, 0xc000000d
jmp 0x48ab60
mov eax, dword [ebp - 0xbe8]
xor ecx, ecx
mov edx, ecx
mov edi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x48ab5e
lea eax, [edi + ecx]
cmp eax, ecx
jb 0x48ab5e
inc edx
cmp edx, 2
jb 0x48aaf5
mov edi, dword [eax]
lea edx, [eax + 4]
cmp edx, eax
jb 0x48ab1c
mov dword [ebp - 0xafc], edx
jmp 0x48ab23
or dword [ebp - 0xafc], 0xffffffff
cmp edx, eax
sbb ebx, ebx
and ebx, esi
mov dword [ebp - 0xac0], ebx
cmp edx, eax
jb 0x48ab41
mov ecx, edi
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xafc]
jmp 0x48ab4d
mov edi, dword [ebp - 0xcfc]
mov ecx, dword [ebp - 0xcf8]
cmp edx, eax
jb 0x48ab66
cmp edi, 4
jne 0x488cc5
mov eax, dword [ecx]
jmp 0x48ab6c
mov ebx, esi
mov dword [ebp - 0xac0], ebx
mov eax, dword [ebp - 0xc18]
mov dword [ebp - 0xad0], eax
test ebx, ebx
js 0x488aa5
cmp dword [ebp - 0xbe8], 0
jne 0x48ab8d
mov ebx, 0xc000000d
jmp 0x488a9f
mov eax, dword [ebp - 0xbe8]
xor ecx, ecx
mov edx, ecx
mov edi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x48adbd
lea eax, [edi + ecx]
cmp eax, ecx
jb 0x48adbd
inc edx
cmp edx, 3
jb 0x48ab97
mov edx, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xb08], edx
cmp ecx, eax
jb 0x48abc8
mov edi, ecx
jmp 0x48abcb
or edi, 0xffffffff
cmp ecx, eax
sbb ebx, ebx
and ebx, esi
mov dword [ebp - 0xac0], ebx
cmp ecx, eax
jb 0x48abe3
neg edx
sbb edx, edx
and edx, edi
jmp 0x48abf5
mov edx, dword [ebp - 0xce0]
mov dword [ebp - 0xb08], edx
mov edx, dword [ebp - 0xd04]
cmp ecx, eax
jb 0x488aa5
mov eax, dword [ebp - 0xbe8]
xor ecx, ecx
mov edi, ecx
mov ebx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x48ac84
lea eax, [ebx + ecx]
cmp eax, ecx
jb 0x48ac84
inc edi
cmp edi, 4
jb 0x48ac07
mov ecx, dword [eax]
lea edi, [eax + 4]
mov dword [ebp - 0xb0c], ecx
cmp edi, eax
jb 0x48ac34
mov dword [ebp - 0xafc], edi
jmp 0x48ac3b
or dword [ebp - 0xafc], 0xffffffff
cmp edi, eax
sbb ebx, ebx
and ebx, esi
mov dword [ebp - 0xac0], ebx
cmp edi, eax
jb 0x48ac57
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xafc]
jmp 0x48ac69
mov ecx, dword [ebp - 0xcf0]
mov dword [ebp - 0xb0c], ecx
mov ecx, dword [ebp - 0xcec]
cmp edi, eax
jb 0x48ac8c
cmp dword [ebp - 0xb0c], 4
jne 0x488cc5
mov eax, dword [ecx]
mov dword [ebp - 0xc60], eax
jmp 0x48ac8c
mov ebx, esi
mov dword [ebp - 0xac0], ebx
test ebx, ebx
js 0x488aa5
mov eax, dword [ebp - 0xbe8]
xor ecx, ecx
mov edi, ecx
mov ebx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x48ad07
lea eax, [ebx + ecx]
cmp eax, ecx
jb 0x48ad07
inc edi
cmp edi, 5
jb 0x48ac9e
lea edi, [eax + 4]
cmp edi, eax
jb 0x48acc3
mov dword [ebp - 0xafc], edi
jmp 0x48acca
or dword [ebp - 0xafc], 0xffffffff
cmp edi, eax
sbb ebx, ebx
and ebx, esi
mov dword [ebp - 0xac0], ebx
cmp edi, eax
jb 0x48acea
mov ecx, dword [eax]
mov esi, dword [eax]
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xafc]
jmp 0x48acf6
mov esi, dword [ebp - 0xce8]
mov ecx, dword [ebp - 0xce4]
cmp edi, eax
jb 0x48ad0f
cmp esi, 4
jne 0x488cc5
mov ecx, dword [ecx]
jmp 0x48ad15
mov ebx, esi
mov dword [ebp - 0xac0], ebx
mov ecx, dword [ebp - 0xaf0]
test ebx, ebx
js 0x488aa5
mov eax, dword [ebp - 0xb78]
cmp eax, dword [ebp - 0xc70]
jne 0x48a966
mov eax, dword [ebp - 0xb1c]
cmp eax, dword [ebp - 0xc6c]
jne 0x48a966
cmp dword [ebp - 0xc60], 4
mov dword [ebp - 0xaec], ecx
jbe 0x48ad6c
mov eax, dword [ebp - 0xad0]
mov ebx, 0x8007007a
mov dword [ebp - 0xac0], ebx
mov dword [ebp - 0xbe4], eax
jmp 0x488aa5
mov eax, dword [ebp - 0xb08]
cmp eax, 4
ja 0x48ad50
push eax
push edx
push dword [ebp - 0xaf8]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xad0]
add esp, 0xc
mov dword [ebp - 0xbe4], eax
test ebx, ebx
js 0x488aa5
mov eax, dword [ebp - 0xb20]
mov edi, dword [ebp - 0xac8]
test eax, eax
je 0x488aab
mov ebx, eax
jmp 0x488b72
or dword [ebp - 0xbfc], 0xffffffff
mov ebx, esi
jmp 0x488a9f
xor eax, eax
test edi, edi
je 0x48add9
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xadc]
test eax, eax
je 0x48adf4
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
js 0x4889ae
mov eax, dword [ebp - 0xaec]
test eax, eax
je 0x4913c9
mov dword [0x4b93f4], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x2cc]
xor ebx, ebx
push eax
push 0x400000
mov dword [ebp - 0xc98], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x48f924
cmp eax, esi
jne 0x48ae4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x48f924
mov esi, dword [0x4b708c]
mov ecx, esi
push 0x403
push ebx
push ebx
call dword [0x4bb544]
call esi
mov dword [ebp - 0xad4], eax
test eax, eax
jne 0x48ae76
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x48f924
mov esi, dword [0x4b705c]
mov ecx, esi
call dword [0x4bb544]
call esi
mov dword [0x4ba818], eax
mov eax, dword [0x4b93f4]
push 0x54
mov dword [ebp - 0xb30], eax
lea eax, [ebp - 0x7c8]
push ebx
push eax
mov dword [0x4ba81c], edx
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0xc68], ebx
lea edi, [ebp - 0x360]
mov dword [ebp - 0xc64], ebx
stosd dword es:[edi], eax
push 0x2c
push ebx
mov dword [ebp - 0xae0], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xb14], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x4c8]
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [ebp - 0xb10], ebx
mov esi, 0x4ba824
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x48aeec
mov eax, dword [0x4ba820]
test eax, eax
jne 0x48b5e1
push 0x338
mov esi, ebx
mov dword [ebp - 0xaf0], ebx
push ebx
mov dword [ebp - 0xacc], ebx
mov dword [ebp - 0xaf4], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xb04], ebx
test ebx, ebx
je 0x48b5d3
or dword [ebp - 0xaf8], 0xffffffff
xor edx, edx
mov eax, 0x7f1137f
mov dword [ebp - 0xb1c], 0x7f1137f
xor dword [ebp - 0xb1c], 0xab69605e
mov edi, edx
mov dword [ebp - 0x3fc], eax
add ebx, 7
mov eax, edx
mov dword [ebp - 0x400], 0xab69605e
movzx esi, word [ebp - 0x3fe]
mov cl, dl
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xb98], eax
mov eax, 0x7f1137f
mov dword [ebp - 0xadc], edx
movzx edx, word [ebp - 0x3fa]
mov dword [ebp - 0xafc], ebx
mov ebx, 0x41167a
movzx eax, ax
mov dword [ebp - 0xac8], esi
mov esi, edi
mov dword [ebp - 0xbb4], edi
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xad0], edx
mov dword [ebp - 0xaec], ebx
mov dword [ebp - 0xb0c], 0x67
movzx edx, byte [ebx - 2]
movzx eax, byte [ebx - 1]
shl edx, 8
or edx, eax
movzx eax, byte [ebx]
shl edx, 8
or edx, eax
movzx eax, byte [ebx + 1]
movzx ebx, byte [ebx + 2]
shl edx, 8
or edx, eax
shl ebx, 8
mov eax, dword [ebp - 0xaec]
xor edi, edx
mov dword [ebp - 0xac4], edi
mov edi, dword [ebp - 0xb1c]
mov dword [ebp - 0xae8], edx
movzx eax, byte [eax + 3]
or ebx, eax
mov eax, dword [ebp - 0xaec]
shl ebx, 8
movzx eax, byte [eax + 4]
or ebx, eax
mov eax, dword [ebp - 0xaec]
shl ebx, 8
add dword [ebp - 0xaec], 8
movzx eax, byte [eax + 5]
or ebx, eax
mov eax, dword [ebp - 0xad8]
xor esi, ebx
xor edi, esi
xor edi, dword [ebp - 0xac4]
mov edx, edi
rol edx, 0xa
lea esi, [edi + 0x54969fa2]
rol esi, 5
imul eax, esi
mov esi, 0x7f1137f
add edx, eax
mov eax, dword [ebp - 0xac4]
xor eax, edx
mov dword [ebp - 0xac4], eax
mov edx, eax
rol edx, 2
lea esi, [esi + eax]
mov eax, dword [ebp - 0xac8]
ror esi, 9
imul eax, esi
mov esi, dword [ebp - 0xac8]
sub eax, edx
xor edi, eax
mov eax, edi
sub eax, dword [ebp - 0xad8]
imul edx, eax, 0x605e
mov eax, edi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xac4]
xor eax, edx
xor esi, eax
mov dword [ebp - 0xac4], eax
mov edx, eax
rol esi, 6
mov eax, dword [ebp - 0xad0]
imul eax, esi
mov esi, dword [ebp - 0xac4]
rol edx, 2
sub eax, edx
xor edi, eax
mov eax, 0x7f1137f
mov edx, edi
xor edx, 0xab69605e
sub eax, edx
xor esi, eax
mov eax, dword [ebp - 0xad8]
xor eax, esi
mov edx, esi
imul eax, dword [ebp - 0xac8]
ror edx, 6
xor edx, eax
xor edi, edx
mov eax, 0x7f1137f
mov edx, edi
add eax, edi
rol edx, 2
ror eax, 0xf
imul eax, eax, 0x605e
add edx, eax
mov eax, dword [ebp - 0xad0]
xor esi, edx
mov dword [ebp - 0xac4], esi
add esi, 0x54969fa2
mov edx, dword [ebp - 0xac4]
rol edx, 8
ror esi, 0xe
imul eax, esi
sub eax, edx
xor edi, eax
mov eax, dword [ebp - 0xad8]
mov esi, edi
mov edx, edi
xor esi, 0xab69605e
ror edx, 0xa
ror esi, 0xc
imul eax, esi
mov esi, dword [ebp - 0xac4]
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xad0]
xor edx, esi
mov eax, esi
imul edx, dword [ebp - 0xac8]
shr eax, 0xa
xor edx, eax
xor edx, edi
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xad0]
xor esi, eax
mov eax, dword [ebp - 0xad0]
mov edi, esi
sub edi, eax
xor edi, edx
mov edx, dword [ebp - 0xad8]
xor edi, 0xab69605e
xor eax, edi
rol eax, 2
imul edx, eax
mov eax, edi
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov dword [ebp - 0xac4], esi
sub esi, eax
mov eax, dword [ebp - 0xac8]
mov edx, dword [ebp - 0xac4]
ror esi, 6
imul eax, esi
mov esi, dword [ebp - 0xac8]
rol edx, 7
add edx, eax
mov eax, dword [ebp - 0xad8]
xor edi, edx
xor eax, edi
mov edx, edi
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
mov eax, dword [ebp - 0xac4]
xor eax, edx
xor esi, eax
mov dword [ebp - 0xac4], eax
mov edx, eax
rol esi, 5
mov eax, dword [ebp - 0xad0]
imul eax, esi
rol edx, 7
add edx, eax
xor edi, edx
mov eax, dword [ebp - 0xb1c]
mov edx, 0x7f1137f
xor eax, edi
mov esi, dword [ebp - 0xac4]
xor esi, eax
mov eax, esi
ror eax, 3
sub eax, dword [ebp - 0xac8]
imul eax, dword [ebp - 0xad8]
xor edi, eax
mov eax, edi
sub eax, edx
mov edx, edi
ror eax, 1
imul eax, eax, 0x605e
ror edx, 6
sub eax, edx
xor esi, eax
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0xac4], esi
add esi, 0xab69605e
mov edx, dword [ebp - 0xac4]
rol edx, 0xe
rol esi, 3
imul eax, esi
add edx, eax
mov eax, dword [ebp - 0xad8]
xor edi, edx
mov edx, edi
ror edx, 0xe
lea esi, [edi - 0x54969fa2]
rol esi, 0xf
imul eax, esi
mov esi, dword [ebp - 0xac4]
sub eax, edx
xor esi, eax
mov edx, esi
mov dword [ebp - 0xac4], esi
xor edx, 0x605e
mov eax, esi
imul edx, dword [ebp - 0xac8]
shr eax, 3
xor edx, eax
mov eax, 0x7f1137f
xor edi, edx
xor eax, edi
mov edx, edi
xor edi, dword [ebp - 0xaf8]
rol eax, 4
imul eax, eax, 0x605e
rol edx, 2
mov dword [ebp - 0xb98], edi
xor edx, eax
mov eax, esi
xor edx, dword [ebp - 0xadc]
xor eax, edx
mov edx, dword [ebp - 0xafc]
mov dword [ebp - 0xbb4], eax
mov byte [edx - 4], al
mov al, byte [ebp - 0xb98]
ror dword [ebp - 0xbb4], 8
mov byte [edx], al
mov al, byte [ebp - 0xbb4]
ror dword [ebp - 0xb98], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb98]
ror dword [ebp - 0xbb4], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xbb4]
ror dword [ebp - 0xb98], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb98]
ror dword [ebp - 0xbb4], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xbb4]
ror dword [ebp - 0xb98], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb98]
mov byte [edx - 3], al
mov eax, dword [ebp - 0xbb4]
ror eax, 8
mov esi, dword [ebp - 0xb98]
add edx, 8
mov dword [ebp - 0xac4], eax
mov edi, dword [ebp - 0xac4]
ror esi, 8
sub dword [ebp - 0xb0c], 1
mov dword [ebp - 0xbb4], eax
mov eax, dword [ebp - 0xae8]
mov dword [ebp - 0xaf8], ebx
mov ebx, dword [ebp - 0xaec]
mov dword [ebp - 0xb98], esi
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xafc], edx
jne 0x48afd5
mov ebx, dword [ebp - 0xb04]
xor eax, eax
mov edx, eax
xor cl, byte [edx + ebx]
inc edx
cmp edx, 0x338
jb 0x48b3c1
movzx eax, cl
cdq
cmp eax, dword [0x4119b0]
jne 0x48b3fb
cmp edx, dword [0x4119b4]
jne 0x48b3fb
mov edi, ebx
mov dword [ebp - 0xadc], 0x337
xor eax, eax
mov dword [ebp - 0xaf4], edi
mov ebx, eax
mov esi, eax
jmp 0x48b40d
or dword [ebp - 0xadc], 0xffffffff
mov esi, 0xc004d501
mov edi, dword [ebp - 0xaf4]
test ebx, ebx
je 0x48b424
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x48b426
xor ebx, ebx
test esi, esi
js 0x48b5cd
mov eax, dword [ebp - 0xadc]
mov esi, edi
push 0x40
push ebx
mov byte [eax + edi], bl
mov ebx, 0x4b9980
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], 0
je 0x48b563
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xb54]
jne 0x48b45c
sub ecx, ebx
xor ebx, ebx
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x48b5c6
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xacc], ecx
cmp word [eax], dx
je 0x48b4a6
mov ecx, 0xc000007b
mov dword [ebp - 0xacc], ecx
jmp 0x48b4ee
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x48b499
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x48b499
cmp dword [edx], 0x4550
jne 0x48b499
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xbcc]
je 0x48b4dc
cmp ax, word [ebp - 0xb40]
je 0x48b4dc
mov ecx, 0xc000000d
jmp 0x48b49e
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb3c], eax
test eax, eax
je 0x48b557
mov edx, esi
mov dword [ebp - 0xb04], esi
lea eax, [edx + 1]
mov dword [ebp - 0xae8], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x48b50f
sub edx, dword [ebp - 0xae8]
inc esi
add esi, edx
test ecx, ecx
js 0x48b548
push dword [ebp - 0xb04]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b563
mov ecx, dword [ebp - 0xaf0]
mov dword [ecx*4 + 0x4b7010], eax
mov ecx, dword [ebp - 0xacc]
inc dword [ebp - 0xaf0]
inc ebx
cmp ebx, dword [ebp - 0xb3c]
jb 0x48b4fe
add edi, 0x10
cmp byte [esi], 0
jne 0x48b455
mov ebx, dword [ebp - 0xacc]
mov esi, dword [ebp - 0xaf4]
test esi, esi
je 0x48b584
push esi
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jns 0x48b5da
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0x4b9980]
test eax, eax
je 0x48b59d
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x48b58c
push 0x40
push ebx
push 0x4b9980
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x402210
mov edi, 0x4b7010
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x48b5e7
mov ebx, 0xc000007a
jmp 0x48b569
mov esi, dword [ebp - 0xaf4]
mov ebx, 0xc000007a
jmp 0x48b56f
mov eax, dword [0x4ba820]
xor ebx, ebx
inc eax
mov dword [0x4ba820], eax
xor eax, eax
mov edx, 0x4ba824
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0xc5c]
mov word [ebp - 0x14], bx
stosd dword es:[edi], eax
mov dword [ebp - 0xb78], ebx
mov dword [ebp - 0xb74], ebx
mov dword [ebp - 0xc10], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x418]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x48b620
mov eax, dword [0x4ba820]
test eax, eax
jne 0x48bcd5
push 0x338
push ebx
mov dword [ebp - 0xaf0], ebx
mov dword [ebp - 0xacc], ebx
mov dword [ebp - 0xb1c], ebx
mov dword [ebp - 0xb08], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xb04], edi
test edi, edi
je 0x48bcc7
or dword [ebp - 0xaf8], 0xffffffff
mov eax, 0x7f1137f
mov dword [ebp - 0x3f4], eax
add edi, 7
movzx edx, word [ebp - 0x3f2]
mov eax, ebx
mov dword [ebp - 0xac8], eax
mov cl, bl
mov dword [ebp - 0xbc0], eax
mov eax, 0x7f1137f
mov dword [ebp - 0x3f8], 0xab69605e
movzx esi, word [ebp - 0x3f6]
movzx eax, ax
mov dword [ebp - 0xad0], edx
mov edx, ebx
mov dword [ebp - 0xac4], esi
mov esi, 0x41167a
mov dword [ebp - 0xadc], ebx
mov dword [ebp - 0xb84], ebx
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xafc], edi
mov dword [ebp - 0xb0c], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
mov dword [ebp - 0xac8], edx
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
add esi, 8
shl edi, 8
or edi, eax
mov dword [ebp - 0xae8], esi
mov esi, edx
mov eax, 0x7f1137f
xor esi, edi
xor esi, dword [ebp - 0xb84]
xor esi, eax
xor esi, 0xab69605e
mov eax, esi
rol eax, 0xa
lea edx, [esi + 0x54969fa2]
rol edx, 5
imul edx, dword [ebp - 0xad8]
add eax, edx
mov edx, dword [ebp - 0xac8]
xor edx, eax
mov eax, 0x7f1137f
mov dword [ebp - 0xac8], edx
add edx, eax
mov eax, dword [ebp - 0xac8]
ror edx, 9
imul edx, dword [ebp - 0xac4]
rol eax, 2
sub edx, eax
xor esi, edx
mov eax, esi
sub eax, dword [ebp - 0xad8]
imul edx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xac8], eax
xor edx, dword [ebp - 0xac4]
rol edx, 6
imul edx, dword [ebp - 0xad0]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xac8]
xor edx, eax
mov dword [ebp - 0xac8], edx
mov eax, dword [ebp - 0xac8]
xor eax, dword [ebp - 0xad8]
imul eax, dword [ebp - 0xac4]
ror edx, 6
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
add eax, esi
mov edx, esi
ror eax, 0xf
rol edx, 2
imul eax, eax, 0x605e
add edx, eax
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov dword [ebp - 0xac8], eax
lea edx, [eax + 0x54969fa2]
rol eax, 8
ror edx, 0xe
imul edx, dword [ebp - 0xad0]
sub edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, dword [ebp - 0xad8]
xor eax, edx
mov edx, dword [ebp - 0xac8]
xor edx, eax
mov dword [ebp - 0xac8], edx
xor edx, dword [ebp - 0xad0]
imul edx, dword [ebp - 0xac4]
mov eax, dword [ebp - 0xac8]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0xac8]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xad0]
xor esi, eax
mov dword [ebp - 0xac8], esi
sub esi, dword [ebp - 0xad0]
xor esi, edx
xor esi, 0xab69605e
mov edx, esi
mov eax, esi
xor edx, dword [ebp - 0xad0]
shr eax, 2
rol edx, 2
imul edx, dword [ebp - 0xad8]
add edx, eax
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov dword [ebp - 0xac8], eax
lea edx, [eax - 0x7f1137f]
rol eax, 7
ror edx, 6
imul edx, dword [ebp - 0xac4]
add eax, edx
xor esi, eax
mov eax, esi
mov edx, esi
xor eax, dword [ebp - 0xad8]
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xac8], eax
xor edx, dword [ebp - 0xac4]
rol eax, 7
rol edx, 5
imul edx, dword [ebp - 0xad0]
add eax, edx
mov edx, 0x7f1137f
xor esi, eax
mov eax, dword [ebp - 0xac8]
xor eax, edx
xor eax, esi
xor eax, 0xab69605e
mov dword [ebp - 0xac8], eax
ror eax, 3
sub eax, dword [ebp - 0xac4]
imul eax, dword [ebp - 0xad8]
xor esi, eax
mov eax, esi
sub eax, edx
mov edx, esi
ror eax, 1
imul eax, eax, 0x605e
ror edx, 6
sub eax, edx
mov edx, dword [ebp - 0xac8]
xor edx, eax
mov dword [ebp - 0xac8], edx
add edx, 0xab69605e
mov eax, dword [ebp - 0xac8]
rol edx, 3
imul edx, dword [ebp - 0xad0]
rol eax, 0xe
add eax, edx
xor esi, eax
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xad8]
sub edx, eax
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xac8], eax
xor edx, 0x605e
shr eax, 3
imul edx, dword [ebp - 0xac4]
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
xor eax, esi
mov edx, esi
xor esi, dword [ebp - 0xaf8]
rol eax, 4
imul eax, eax, 0x605e
mov dword [ebp - 0xb84], esi
mov esi, dword [ebp - 0xafc]
rol edx, 2
mov dword [ebp - 0xaf8], edi
xor edx, eax
mov eax, dword [ebp - 0xac8]
xor edx, dword [ebp - 0xadc]
xor eax, edx
mov dword [ebp - 0xadc], ebx
mov dword [ebp - 0xbc0], eax
mov byte [esi - 4], al
mov al, byte [ebp - 0xb84]
ror dword [ebp - 0xbc0], 8
mov byte [esi], al
ror dword [ebp - 0xb84], 8
mov al, byte [ebp - 0xbc0]
mov byte [esi - 5], al
mov al, byte [ebp - 0xb84]
ror dword [ebp - 0xbc0], 8
mov byte [esi - 1], al
ror dword [ebp - 0xb84], 8
mov al, byte [ebp - 0xbc0]
mov byte [esi - 6], al
ror dword [ebp - 0xbc0], 8
mov al, byte [ebp - 0xb84]
mov byte [esi - 2], al
ror dword [ebp - 0xb84], 8
mov al, byte [ebp - 0xbc0]
mov byte [esi - 7], al
mov al, byte [ebp - 0xb84]
mov byte [esi - 3], al
add esi, 8
mov edx, dword [ebp - 0xbc0]
ror dword [ebp - 0xb84], 8
ror edx, 8
sub dword [ebp - 0xb0c], 1
mov dword [ebp - 0xafc], esi
mov esi, dword [ebp - 0xae8]
mov dword [ebp - 0xbc0], edx
jne 0x48b6ef
mov ebx, dword [ebp - 0xb04]
xor eax, eax
mov edx, eax
xor cl, byte [edx + ebx]
inc edx
cmp edx, 0x338
jb 0x48bac5
movzx eax, cl
cdq
cmp eax, dword [0x4119b0]
jne 0x48baf8
cmp edx, dword [0x4119b4]
jne 0x48baf8
mov esi, ebx
xor eax, eax
mov dword [ebp - 0xb1c], esi
mov ebx, eax
mov edi, 0x337
jmp 0x48bb0d
mov esi, dword [ebp - 0xb1c]
or edi, 0xffffffff
mov dword [ebp - 0xb08], 0xc004d501
xor eax, eax
test ebx, ebx
je 0x48bb20
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xb08], 0
jl 0x48bcc7
mov ebx, dword [ebp - 0xb1c]
xor eax, eax
push 0x40
push eax
push 0x4b9980
mov byte [edi + ebx], al
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [ebx], 0
je 0x48bc64
mov edi, 0x4b9980
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xb54]
jne 0x48bb5d
sub ecx, ebx
xor ebx, ebx
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x48bcc7
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xacc], ecx
cmp word [eax], dx
je 0x48bba7
mov ecx, 0xc000007b
mov dword [ebp - 0xacc], ecx
jmp 0x48bbef
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x48bb9a
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x48bb9a
cmp dword [edx], 0x4550
jne 0x48bb9a
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xbcc]
je 0x48bbdd
cmp ax, word [ebp - 0xb40]
je 0x48bbdd
mov ecx, 0xc000000d
jmp 0x48bb9f
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb3c], eax
test eax, eax
je 0x48bc58
mov edx, esi
mov dword [ebp - 0xb04], esi
lea eax, [edx + 1]
mov dword [ebp - 0xae8], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x48bc10
sub edx, dword [ebp - 0xae8]
inc esi
add esi, edx
test ecx, ecx
js 0x48bc49
push dword [ebp - 0xb04]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48bc64
mov ecx, dword [ebp - 0xaf0]
mov dword [ecx*4 + 0x4b7010], eax
mov ecx, dword [ebp - 0xacc]
inc dword [ebp - 0xaf0]
inc ebx
cmp ebx, dword [ebp - 0xb3c]
jb 0x48bbff
add edi, 0x10
cmp byte [esi], 0
jne 0x48bb56
mov ebx, dword [ebp - 0xacc]
mov eax, dword [ebp - 0xb1c]
test eax, eax
je 0x48bc85
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jns 0x48bcce
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0x4b9980]
test eax, eax
je 0x48bc9e
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x48bc8d
push 0x40
push ebx
push 0x4b9980
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x402210
mov edi, 0x4b7010
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x48bcdb
mov ebx, 0xc000007a
jmp 0x48bc6a
mov eax, dword [0x4ba820]
xor ebx, ebx
inc eax
mov dword [0x4ba820], eax
xor eax, eax
mov edi, 0x4ba824
xchg dword [edi], eax
push 0x54
lea eax, [ebp - 0x7c8]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xb30]
add esp, 0xc
mov esi, dword [0x4b708c]
mov ecx, eax
mov dword [ebp - 0x360], ebx
push 0xf
pop edx
and ecx, edx
mov dword [ebp - 0xad8], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0x18], cx
mov ecx, eax
shr ecx, 8
push 0x403
and ecx, edx
shr eax, 0xc
push ebx
mov word [ebp - 0x16], cx
and eax, edx
push ebx
mov ecx, esi
mov word [ebp - 0x14], ax
call dword [0x4bb544]
call esi
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xac8], 0xffffff
test eax, eax
jne 0x48bd80
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x48bd70
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x48d26d
mov ebx, 0x80004005
jmp 0x48d26d
mov esi, dword [0x4b7060]
lea eax, [ebp - 0xc28]
push eax
xor ecx, ecx
mov dword [ebp - 0xc14], ebx
push ecx
lea eax, [ebp - 0xbf8]
mov dword [ebp - 0xc28], ecx
push eax
push 8
mov ecx, esi
mov dword [ebp - 0xc00], ebx
mov dword [ebp - 0xb30], ebx
mov dword [ebp - 0xb9c], ebx
mov dword [ebp - 0xbdc], ebx
mov dword [ebp - 0xbd8], ebx
mov dword [ebp - 0xac4], ebx
call dword [0x4bb544]
call esi
test eax, eax
jne 0x48be10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xac4], ebx
test ebx, ebx
jle 0x48bdfa
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xac4], ebx
test ebx, ebx
js 0x48bf68
mov ebx, 0x80004005
mov dword [ebp - 0xac4], ebx
jmp 0x48bf68
mov eax, dword [ebp - 0xc28]
add eax, eax
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xbdc]
mov esi, eax
call fcn.004a83ac
xor ecx, ecx
test esi, esi
jne 0x48be46
mov dword [ebp - 0xbdc], ecx
mov esi, ecx
jmp 0x48be4c
mov dword [ebp - 0xbdc], esi
test esi, esi
jne 0x48be57
mov ebx, 0x8007000e
jmp 0x48be05
mov eax, dword [ebp - 0xbf8]
lea eax, [eax*4 + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xbd8]
mov esi, eax
call fcn.004a83ac
test esi, esi
jne 0x48be90
xor eax, eax
mov dword [ebp - 0xbd8], eax
mov esi, eax
jmp 0x48be96
mov dword [ebp - 0xbd8], esi
test esi, esi
je 0x48be50
mov esi, dword [0x4b7060]
lea eax, [ebp - 0xc28]
push eax
push dword [ebp - 0xbdc]
lea eax, [ebp - 0xbf8]
mov ecx, esi
push eax
push 8
call dword [0x4bb544]
call esi
test eax, eax
je 0x48bdd7
mov edi, dword [ebp - 0xbdc]
xor ecx, ecx
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xadc], ecx
cmp dword [ebp - 0xbf8], ecx
jbe 0x48bf43
mov ebx, eax
mov esi, dword [0x4b7068]
push ecx
push edi
mov ecx, esi
call dword [0x4bb544]
call esi
mov ecx, edi
mov dword [ebx], eax
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x48bf01
mov eax, dword [ebp - 0xadc]
sub ecx, edx
sar ecx, 1
add ebx, 4
push 0
lea edi, [edi + ecx*2]
add edi, 2
inc eax
mov dword [ebp - 0xadc], eax
pop ecx
cmp eax, dword [ebp - 0xbf8]
jb 0x48bee6
mov dword [ebp - 0xaf0], ebx
mov ebx, dword [ebp - 0xac4]
mov eax, dword [ebp - 0xaf0]
mov dword [eax], 0x409
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xc14], eax
mov eax, dword [ebp - 0xbf8]
inc eax
mov dword [ebp - 0xbd8], ecx
mov dword [ebp - 0xadc], eax
lea ecx, [ebp - 0xbd8]
call fcn.004a83ac
lea ecx, [ebp - 0xbdc]
call fcn.004a83ac
test ebx, ebx
js 0x48c730
xor ecx, ecx
mov ebx, ecx
mov esi, ecx
mov dword [ebp - 0xb18], ebx
cmp dword [ebp - 0xadc], ecx
jbe 0x48bfcb
mov eax, dword [ebp - 0xc14]
mov edx, ecx
mov ecx, dword [eax + esi*4]
cmp ecx, dword [edx*4 + 0x411280]
je 0x48bfc1
inc edx
cmp edx, 0x26
jb 0x48bfa2
inc esi
xor ecx, ecx
cmp esi, dword [ebp - 0xadc]
jae 0x48bfcb
jmp 0x48bfa0
mov ebx, edx
xor ecx, ecx
mov dword [ebp - 0xb18], ebx
mov esi, dword [0x4b7064]
lea eax, [ebp - 0xc4]
push ecx
push 0x55
push eax
push dword [ebx*4 + 0x411280]
mov dword [ebp - 0xb08], ecx
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
je 0x48c034
mov esi, dword [0x4b7058]
lea eax, [ebp - 0x698]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xc4]
mov ecx, esi
push eax
call dword [0x4bb544]
call esi
test eax, eax
jle 0x48c034
mov ebx, dword [ebp - 0x68c]
shr ebx, 0x1b
and ebx, 1
mov dword [ebp - 0xb08], ebx
mov ebx, dword [ebp - 0xb18]
xor eax, eax
mov edx, 0x411398
mov esi, eax
mov ecx, edx
mov dword [ebp + esi*4 - 0x350], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xb54]
jne 0x48c049
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0x48c03d
imul ecx, ebx, 3
movzx eax, byte [ecx + 0x411318]
mov esi, dword [ebp + eax*4 - 0x350]
movzx eax, byte [ecx + 0x411319]
mov dword [ebp - 0xb1c], esi
mov dword [ebp - 0xc5c], esi
mov edi, dword [ebp + eax*4 - 0x350]
movzx eax, byte [ecx + 0x41131a]
mov dword [ebp - 0xb44], edi
mov dword [ebp - 0xc58], edi
mov esi, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xb34], esi
mov dword [ebp - 0xc54], esi
xor eax, eax
push 0x1c90
push eax
mov dword [ebp - 0xac4], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xb00], ebx
test ebx, ebx
jne 0x48c0f0
mov ebx, 0x8007000e
mov dword [ebp - 0xac4], ebx
jmp 0x48c754
or dword [ebp - 0xaf8], 0xffffffff
xor ecx, ecx
mov edi, ecx
mov dword [ebp - 0xadc], ecx
mov al, cl
mov dword [ebp - 0xb88], ecx
mov edx, 0x7f1137f
mov dword [ebp - 0x3d8], 0xab69605e
movzx esi, word [ebp - 0x3d6]
mov ecx, 0x7f1137f
mov dword [ebp - 0x3d4], edx
add ebx, 7
movzx edx, word [ebp - 0x3d2]
movzx ecx, cx
mov dword [ebp - 0xacc], esi
mov esi, 0x4119ba
mov dword [ebp - 0xbb8], edi
mov dword [ebp - 0xaf4], ecx
mov dword [ebp - 0xad0], edx
mov dword [ebp - 0xafc], ebx
mov dword [ebp - 0xb0c], 0x392
movzx ebx, byte [esi - 2]
movzx ecx, byte [esi - 1]
movzx edx, byte [esi + 2]
shl ebx, 8
or ebx, ecx
shl edx, 8
movzx ecx, byte [esi]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 3]
or edx, ecx
mov dword [ebp - 0xae8], ebx
movzx ecx, byte [esi + 4]
xor edi, ebx
shl edx, 8
or edx, ecx
mov dword [ebp - 0xaf0], edi
movzx ecx, byte [esi + 5]
add esi, 8
mov ebx, dword [ebp - 0xaf0]
shl edx, 8
or edx, ecx
mov dword [ebp - 0xb3c], esi
mov edi, edx
mov dword [ebp - 0xb04], edx
mov esi, 0x7f1137f
xor edi, esi
xor edi, ebx
xor edi, dword [ebp - 0xb88]
xor edi, 0xab69605e
mov ecx, edi
rol ecx, 0xa
lea edx, [edi + 0x54969fa2]
rol edx, 5
imul edx, dword [ebp - 0xaf4]
add ecx, edx
xor ebx, ecx
mov ecx, dword [ebp - 0xacc]
add esi, ebx
mov edx, ebx
ror esi, 9
imul ecx, esi
mov esi, dword [ebp - 0xacc]
rol edx, 2
sub ecx, edx
xor edi, ecx
mov ecx, edi
sub ecx, dword [ebp - 0xaf4]
imul edx, ecx, 0x605e
mov ecx, edi
shr ecx, 0xd
sub edx, ecx
mov ecx, dword [ebp - 0xad0]
xor ebx, edx
xor esi, ebx
mov edx, ebx
rol esi, 6
imul ecx, esi
mov esi, 0x7f1137f
rol edx, 2
sub ecx, edx
xor edi, ecx
mov ecx, esi
mov edx, edi
xor edx, 0xab69605e
sub ecx, edx
xor ebx, ecx
mov ecx, ebx
mov edx, ebx
xor ecx, dword [ebp - 0xaf4]
imul ecx, dword [ebp - 0xacc]
ror edx, 6
xor edx, ecx
xor edi, edx
mov edx, edi
lea ecx, [esi + edi]
ror ecx, 0xf
rol edx, 2
imul ecx, ecx, 0x605e
add edx, ecx
mov ecx, dword [ebp - 0xad0]
xor ebx, edx
mov edx, ebx
rol edx, 8
lea esi, [ebx + 0x54969fa2]
ror esi, 0xe
imul ecx, esi
sub ecx, edx
xor edi, ecx
mov edx, edi
mov ecx, edi
xor edx, 0xab69605e
ror ecx, 0xa
ror edx, 0xc
imul edx, dword [ebp - 0xaf4]
xor ecx, edx
mov edx, dword [ebp - 0xad0]
xor ebx, ecx
xor edx, ebx
mov ecx, ebx
imul edx, dword [ebp - 0xacc]
shr ecx, 0xa
xor edx, ecx
xor edx, edi
mov ecx, edx
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, dword [ebp - 0xad0]
xor ebx, ecx
mov edi, ebx
sub edi, dword [ebp - 0xad0]
xor edi, edx
mov edx, dword [ebp - 0xad0]
xor edi, 0xab69605e
xor edx, edi
mov ecx, edi
rol edx, 2
imul edx, dword [ebp - 0xaf4]
shr ecx, 2
add edx, ecx
mov ecx, 0x7f1137f
xor ebx, edx
mov esi, ebx
mov edx, ebx
sub esi, ecx
rol edx, 7
mov ecx, dword [ebp - 0xacc]
ror esi, 6
imul ecx, esi
mov esi, dword [ebp - 0xacc]
add edx, ecx
mov ecx, dword [ebp - 0xaf4]
xor edi, edx
xor ecx, edi
mov edx, edi
imul ecx, ecx, 0x605e
ror edx, 9
add edx, ecx
mov ecx, dword [ebp - 0xad0]
xor ebx, edx
xor esi, ebx
mov dword [ebp - 0xaf0], ebx
rol esi, 5
mov edx, ebx
imul ecx, esi
rol edx, 7
add edx, ecx
xor edi, edx
mov edx, 0x7f1137f
mov ebx, edi
xor ebx, dword [ebp - 0xaf0]
xor ebx, edx
xor ebx, 0xab69605e
mov ecx, ebx
ror ecx, 3
sub ecx, dword [ebp - 0xacc]
imul ecx, dword [ebp - 0xaf4]
xor edi, ecx
mov ecx, edi
sub ecx, edx
mov edx, edi
ror ecx, 1
imul ecx, ecx, 0x605e
ror edx, 6
sub ecx, edx
xor ebx, ecx
mov ecx, dword [ebp - 0xad0]
mov edx, ebx
rol edx, 0xe
lea esi, [ebx - 0x54969fa2]
rol esi, 3
imul ecx, esi
mov esi, dword [ebp - 0xb3c]
add edx, ecx
xor edi, edx
mov ecx, edi
ror ecx, 0xe
lea edx, [edi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xaf4]
sub edx, ecx
xor ebx, edx
mov edx, ebx
mov ecx, ebx
xor edx, 0x605e
shr ecx, 3
imul edx, dword [ebp - 0xacc]
xor edx, ecx
mov ecx, 0x7f1137f
xor edi, edx
xor ecx, edi
mov edx, edi
xor edi, dword [ebp - 0xaf8]
rol ecx, 4
imul ecx, ecx, 0x605e
rol edx, 2
mov dword [ebp - 0xb88], edi
xor edx, ecx
xor edx, dword [ebp - 0xadc]
xor ebx, edx
mov edx, dword [ebp - 0xafc]
mov dword [ebp - 0xbb8], ebx
mov byte [edx - 4], bl
mov cl, byte [ebp - 0xb88]
ror dword [ebp - 0xbb8], 8
mov byte [edx], cl
mov cl, byte [ebp - 0xbb8]
ror dword [ebp - 0xb88], 8
mov byte [edx - 5], cl
mov cl, byte [ebp - 0xb88]
ror dword [ebp - 0xbb8], 8
mov byte [edx - 1], cl
mov cl, byte [ebp - 0xbb8]
ror dword [ebp - 0xb88], 8
mov byte [edx - 6], cl
mov cl, byte [ebp - 0xb88]
ror dword [ebp - 0xbb8], 8
mov byte [edx - 2], cl
mov cl, byte [ebp - 0xbb8]
ror dword [ebp - 0xb88], 8
mov byte [edx - 7], cl
mov cl, byte [ebp - 0xb88]
mov byte [edx - 3], cl
add edx, 8
mov edi, dword [ebp - 0xbb8]
mov ecx, dword [ebp - 0xae8]
ror dword [ebp - 0xb88], 8
ror edi, 8
sub dword [ebp - 0xb0c], 1
mov dword [ebp - 0xadc], ecx
mov ecx, dword [ebp - 0xb04]
mov dword [ebp - 0xbb8], edi
mov dword [ebp - 0xaf8], ecx
mov dword [ebp - 0xafc], edx
jne 0x48c164
mov esi, dword [ebp - 0xb00]
xor ecx, ecx
mov edx, ecx
mov edi, 0x1c90
xor al, byte [edx + esi]
inc edx
cmp edx, edi
jb 0x48c4eb
movzx eax, al
cdq
cmp eax, dword [0x413648]
jne 0x48c51f
cmp edx, dword [0x41364c]
jne 0x48c51f
mov ebx, dword [ebp - 0xac4]
xor ecx, ecx
mov dword [ebp - 0xc00], esi
mov esi, ecx
mov dword [ebp - 0xb30], edi
jmp 0x48c52c
mov ebx, 0xc004d501
xor ecx, ecx
mov dword [ebp - 0xac4], ebx
test esi, esi
je 0x48c53f
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
js 0x48c754
mov edi, dword [ebp - 0xc00]
xor eax, eax
mov ebx, dword [ebp - 0xb18]
mov esi, eax
mov edx, eax
cmp ebx, edx
jne 0x48c564
mov dword [ebp + esi*4 - 0x304], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0xae8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x48c56f
sub ecx, dword [ebp - 0xae8]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0x48c559
inc esi
push 0
pop eax
cmp esi, 6
jb 0x48c557
push 0xc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xb9c]
mov edi, eax
call fcn.004a83ac
xor edx, edx
test edi, edi
jne 0x48c5bb
mov dword [ebp - 0xb9c], edx
mov edi, edx
jmp 0x48c5c1
mov dword [ebp - 0xb9c], edi
mov ebx, dword [ebp - 0xac4]
test edi, edi
je 0x48c0e0
xor eax, eax
lea ecx, [ebp - 0x18]
stosd dword es:[edi], eax
mov dword [ebp - 0xadc], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, edx
mov eax, edx
movzx edx, word [ecx]
cmp dx, word [eax*2 + 0x41138c]
je 0x48c5f9
inc eax
cmp eax, 6
jb 0x48c5e4
jmp 0x48c6bc
mov edx, dword [ebp + eax*4 - 0x304]
mov ecx, edx
mov dword [ebp - 0xae8], edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x48c60b
xor eax, eax
sub ecx, esi
mov esi, dword [0x4b7070]
push eax
push eax
lea eax, [ecx + 1]
mov ecx, esi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0x4bb544]
call esi
mov esi, eax
test esi, esi
je 0x48c6f4
lea ecx, [esi + esi]
xor eax, eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0xb9c]
xor edx, edx
mov dword [ecx + edi], eax
mov eax, dword [ebp - 0xb9c]
cmp dword [eax + edi], edx
je 0x48c723
mov edx, dword [ebp - 0xae8]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xae8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x48c67e
sub ecx, dword [ebp - 0xae8]
mov eax, dword [ebp - 0xb9c]
push esi
mov esi, dword [0x4b7070]
push dword [eax + edi]
lea eax, [ecx + 1]
mov ecx, esi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0x4bb544]
call esi
test eax, eax
je 0x48c6f4
mov ecx, dword [ebp - 0xadc]
add ecx, 2
add edi, 4
mov dword [ebp - 0xadc], ecx
push 0
pop edx
cmp edi, 0xc
jb 0x48c5df
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0xc10], eax
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0xb9c], edx
mov dword [ebp - 0x7c8], eax
jmp 0x48c756
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xac4], ebx
test ebx, ebx
jle 0x48c717
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xac4], ebx
test ebx, ebx
js 0x48c754
mov ebx, 0x80004005
jmp 0x48c0e5
mov ebx, 0x8007000e
mov dword [ebp - 0xac4], ebx
jmp 0x48c756
mov eax, dword [ebp - 0xc54]
mov dword [ebp - 0xb34], eax
mov eax, dword [ebp - 0xc58]
mov dword [ebp - 0xb44], eax
mov eax, dword [ebp - 0xc5c]
mov dword [ebp - 0xb1c], eax
xor edx, edx
cmp dword [ebp - 0xb9c], 0
je 0x48c7c6
mov esi, edx
mov eax, dword [ebp - 0xb9c]
cmp dword [eax + esi], edx
je 0x48c7b8
mov ecx, dword [eax + esi]
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x48c774
mov eax, dword [ebp - 0xb9c]
sub ecx, edx
sar ecx, 1
mov eax, dword [eax + esi]
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x48c79f
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x48c797
mov eax, dword [ebp - 0xb9c]
push dword [eax + esi]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
add esi, 4
cmp esi, 0xc
jb 0x48c761
mov ebx, dword [ebp - 0xac4]
mov eax, dword [ebp - 0xc00]
test eax, eax
je 0x48c7e2
mov ecx, dword [ebp - 0xb30]
test ecx, ecx
je 0x48c7e2
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x48c7da
lea ecx, [ebp - 0xb9c]
call fcn.004a83ac
lea ecx, [ebp - 0xc00]
call fcn.004a83ac
lea ecx, [ebp - 0xc14]
call fcn.004a83ac
test ebx, ebx
js 0x48d24f
mov eax, dword [ebp - 0xc10]
mov esi, dword [0x4b70c4]
mov ecx, dword [eax]
mov dword [ebp - 0x7c0], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x7bc], ecx
xor ecx, ecx
mov eax, dword [eax + 8]
mov edi, ecx
push ecx
mov dword [ebp - 0x7b8], eax
mov ebx, ecx
lea eax, [ebp - 0xca4]
mov dword [ebp - 0xca0], ecx
push eax
push ecx
mov dword [ebp - 0xc9c], ecx
mov ecx, esi
push 0x42
mov dword [ebp - 0xca4], 0xc
call dword [0x4bb544]
call esi
test eax, eax
jne 0x48c886
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x48c87d
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x48c88f
mov ebx, 0x80004005
jmp 0x48c88f
mov edi, dword [ebp - 0xca0]
and edi, 1
mov dword [ebp - 0x7c4], edi
test ebx, ebx
js 0x48d24f
mov ebx, dword [ebp - 0xad8]
mov eax, ebx
push 0x2a
pop ecx
mov dword [ebp - 0xb80], ecx
sub eax, 1
je 0x48c8dc
sub eax, 1
je 0x48c8d0
sub eax, 1
jne 0x48c8ec
mov eax, 0xe1
mov dword [ebp - 0xb78], eax
mov dword [ebp - 0xb74], eax
jmp 0x48c8ec
mov dword [ebp - 0xb78], 0xf
jmp 0x48c8e2
mov dword [ebp - 0xb78], ecx
mov dword [ebp - 0xb74], 0xb
push 0x60
pop edi
xor eax, eax
mov dword [ebp - 0xb48], edi
lea esi, [edi + 0x7c]
push esi
push eax
lea eax, [ebp - 0x774]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov word [ebp - 0x730], si
mov esi, dword [0x4b7080]
lea eax, [ebp - 0x774]
mov ecx, esi
push eax
push 0xffffffffffffffff
xor eax, eax
push eax
call dword [0x4bb544]
call esi
xor edx, edx
test eax, eax
je 0x48c981
movzx edi, word [ebp - 0x6ce]
mov eax, dword [ebp - 0x6c8]
mov ecx, dword [ebp - 0x6c4]
mov dword [ebp - 0xb48], edi
mov dword [ebp - 0x414], edx
mov dword [ebp - 0x418], edx
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0xaf8], ecx
mov dword [ebp - 0x40c], ecx
cmp edi, 0x60
jae 0x48c999
push 0x60
pop edi
mov dword [ebp - 0xb48], edi
jmp 0x48c999
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0xaf8], eax
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0xb1c]
cmp ebx, 1
je 0x48c9aa
mov eax, dword [ebp - 0xb34]
push 0x5c
mov dword [ebp - 0xadc], eax
lea eax, [ebp - 0x678]
push edx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x4b708c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0x4bb544]
call esi
mov dword [ebp - 0xae8], eax
test eax, eax
jne 0x48ca0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x48c9fe
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x48caae
mov ebx, 0x80004005
jmp 0x48d24f
mov esi, dword [0x4b706c]
mov ecx, esi
push 0x48
push edi
push dword [ebp - 0xb78]
call dword [0x4bb544]
call esi
push dword [ebp - 0xadc]
neg eax
mov dword [ebp - 0x668], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x65c]
mov dword [ebp - 0x678], eax
mov byte [ebp - 0x65e], 5
call fcn.00436775
mov esi, dword [0x4b7020]
lea eax, [ebp - 0x678]
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
jne 0x48ca8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x48ca86
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x48ca95
mov ebx, 0x80004005
jmp 0x48ca95
mov dword [ebp - 0x7b4], eax
push dword [ebp - 0xae8]
mov esi, dword [0x4b70c0]
xor eax, eax
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test ebx, ebx
js 0x48d24f
cmp dword [ebp - 0xad8], 1
je 0x48cacb
mov eax, dword [ebp - 0xb34]
mov dword [ebp - 0xb1c], eax
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0x61c]
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x4b708c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0x4bb544]
call esi
mov dword [ebp - 0xae8], eax
test eax, eax
jne 0x48cb9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x48cb1f
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0x48ca04
push 0x20
pop edi
test ebx, ebx
js 0x48d24f
mov ebx, dword [ebp - 0xad8]
xor eax, eax
mov ecx, eax
mov edx, eax
mov eax, ebx
sub eax, 1
je 0x48cb51
sub eax, 1
je 0x48cc43
sub eax, 1
jne 0x48cb5d
mov ecx, dword [ebp - 0xaf0]
mov edx, dword [ebp - 0xaf8]
mov dword [ebp - 0x358], ecx
mov dword [ebp - 0x354], edx
xor edx, edx
inc edx
cmp ebx, edx
je 0x48cc88
lea eax, [ebx - 2]
xor ebx, ebx
cmp eax, edx
ja 0x48cc5c
mov eax, ebx
mov dword [ebp - 0xb80], ebx
mov edx, ebx
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xb1c], ebx
jmp 0x48cc9d
mov esi, dword [0x4b706c]
mov ecx, esi
push 0x48
push edi
push dword [ebp - 0xb74]
call dword [0x4bb544]
call esi
push dword [ebp - 0xb1c]
neg eax
mov dword [ebp - 0x60c], 0x190
push 0x20
pop edi
mov edx, edi
mov dword [ebp - 0x61c], eax
lea ecx, [ebp - 0x600]
mov byte [ebp - 0x602], 5
call fcn.00436775
mov esi, dword [0x4b7020]
lea eax, [ebp - 0x61c]
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
jne 0x48cc1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x48cc16
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x48cc25
mov ebx, 0x80004005
jmp 0x48cc25
mov dword [ebp - 0x7b0], eax
push dword [ebp - 0xae8]
mov esi, dword [0x4b70c0]
xor eax, eax
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
jmp 0x48cb28
mov eax, dword [ebp - 0xaf0]
cdq
and edx, 3
lea ecx, [edx + eax]
sar ecx, 2
xor eax, eax
mov edx, eax
jmp 0x48cb5d
mov eax, dword [ebp - 0xbf4]
mov edx, dword [ebp - 0xbf4]
mov dword [ebp - 0xb1c], eax
mov eax, dword [ebp - 0xbf4]
mov dword [ebp - 0xb80], eax
mov eax, dword [ebp - 0xbf4]
mov dword [ebp - 0xaf0], eax
jmp 0x48cc9d
xor ebx, ebx
mov dword [ebp - 0xb1c], edi
mov edx, 0x96
mov dword [ebp - 0xaf0], ebx
mov eax, ebx
mov dword [ebp - 0xb18], edx
push dword [ebp - 0x7b4]
mov esi, dword [0x4b704c]
sub ecx, edx
push dword [ebp - 0xae4]
mov edi, dword [ebp - 0x7c0]
sub ecx, eax
mov dword [ebp - 0xb04], ecx
mov dword [ebp - 0x78c], ecx
mov dword [ebp - 0x79c], ecx
mov ecx, esi
call dword [0x4bb544]
call esi
mov esi, dword [0x4b707c]
mov ecx, esi
mov dword [ebp - 0xae8], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x7a4]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xae4]
push edi
call dword [0x4bb544]
call esi
test eax, eax
jne 0x48cd13
mov ebx, 0x80004005
mov eax, dword [ebp - 0xae8]
test eax, eax
je 0x48cd2f
mov esi, dword [0x4b704c]
mov ecx, esi
push eax
push edi
call dword [0x4bb544]
call esi
test ebx, ebx
js 0x48d24f
push dword [ebp - 0x7b0]
mov esi, dword [0x4b704c]
xor eax, eax
push dword [ebp - 0xae4]
mov edi, dword [ebp - 0x7bc]
mov ecx, esi
mov ebx, eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b707c]
mov ecx, esi
mov dword [ebp - 0xae8], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x794]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xae4]
push edi
call dword [0x4bb544]
call esi
test eax, eax
jne 0x48cd95
mov ebx, 0x80004005
mov eax, dword [ebp - 0xae8]
test eax, eax
je 0x48cdb1
mov esi, dword [0x4b704c]
mov ecx, esi
push eax
push edi
call dword [0x4bb544]
call esi
test ebx, ebx
js 0x48d24f
mov eax, dword [ebp - 0xad8]
cmp eax, 2
je 0x48cdc9
cmp eax, 3
jne 0x48cddf
mov edi, dword [ebp - 0x78c]
cmp dword [ebp - 0x79c], edi
jle 0x48cde5
mov edi, dword [ebp - 0x79c]
jmp 0x48cde5
mov edi, dword [ebp - 0xb04]
cmp dword [ebp - 0x7c8], 0
mov esi, dword [0x4b70b8]
mov ecx, esi
push dword [ebp - 0xb80]
je 0x48ce26
mov ebx, dword [ebp - 0xaf0]
mov eax, ebx
sub eax, dword [ebp - 0x79c]
add eax, edi
push eax
lea eax, [ebp - 0x7a4]
push eax
call dword [0x4bb544]
call esi
sub ebx, dword [ebp - 0x78c]
add ebx, edi
jmp 0x48ce3c
mov ebx, dword [ebp - 0xb18]
lea eax, [ebp - 0x7a4]
push ebx
push eax
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0x798]
add eax, dword [ebp - 0xb1c]
mov esi, dword [0x4b70b8]
mov ecx, esi
push eax
push ebx
lea eax, [ebp - 0x794]
push eax
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0xad8]
cmp eax, 2
je 0x48d12d
cmp eax, 3
je 0x48d12d
xor edx, edx
inc edx
cmp eax, edx
jne 0x48d14c
xor eax, eax
mov dword [ebp - 0x7a8], 0xffffff
push 0x5c
push eax
lea eax, [ebp - 0x5c0]
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x4b708c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0x4bb544]
call esi
mov dword [ebp - 0xae8], eax
test eax, eax
jne 0x48cee9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x48cede
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x48cf8a
jmp 0x48ca04
mov esi, dword [0x4b706c]
mov ecx, esi
push 0x48
push dword [ebp - 0xb48]
push 0xb
call dword [0x4bb544]
call esi
push dword [ebp - 0xb44]
neg eax
mov dword [ebp - 0x5b0], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x5a4]
mov dword [ebp - 0x5c0], eax
mov byte [ebp - 0x5a6], 5
call fcn.00436775
mov esi, dword [0x4b7020]
lea eax, [ebp - 0x5c0]
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
jne 0x48cf6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x48cf62
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x48cf71
mov ebx, 0x80004005
jmp 0x48cf71
mov dword [ebp - 0x7ac], eax
push dword [ebp - 0xae8]
mov esi, dword [0x4b70c0]
xor eax, eax
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test ebx, ebx
js 0x48d24f
push dword [ebp - 0x7ac]
mov esi, dword [0x4b704c]
xor eax, eax
push dword [ebp - 0xae4]
mov dword [ebp - 0x77c], edi
mov ecx, esi
mov edi, dword [ebp - 0x7b8]
mov ebx, eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b707c]
mov ecx, esi
mov dword [ebp - 0xae8], eax
xor eax, eax
push eax
push 0x460
lea eax, [ebp - 0x784]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xae4]
push edi
call dword [0x4bb544]
call esi
test eax, eax
jne 0x48cff6
mov ebx, 0x80004005
mov eax, dword [ebp - 0xae8]
test eax, eax
je 0x48d012
mov esi, dword [0x4b704c]
mov ecx, esi
push eax
push edi
call dword [0x4bb544]
call esi
test ebx, ebx
js 0x48d24f
mov eax, dword [ebp - 0x77c]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x77c], eax
cmp eax, ecx
jge 0x48d036
mov dword [ebp - 0x77c], ecx
mov ebx, dword [ebp - 0xb48]
mov esi, dword [0x4b706c]
mov ecx, esi
push 0x60
pop edi
push edi
push ebx
push dword [ebp - 0x784]
mov dword [ebp - 0x778], 0x20
call dword [0x4bb544]
call esi
mov esi, dword [0x4b706c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x780]
mov dword [ebp - 0x784], eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b706c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x77c]
mov dword [ebp - 0x780], eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b706c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x778]
mov dword [ebp - 0x77c], eax
call dword [0x4bb544]
call esi
cmp dword [ebp - 0x7c8], 0
mov dword [ebp - 0x778], eax
je 0x48d102
mov ecx, dword [ebp - 0x7a4]
cmp ecx, dword [ebp - 0x794]
jl 0x48d0de
mov ecx, dword [ebp - 0x794]
mov eax, dword [ebp - 0x788]
add eax, 0x24
mov esi, dword [0x4b70b8]
push eax
push ecx
lea eax, [ebp - 0x784]
mov ecx, esi
push eax
call dword [0x4bb544]
call esi
jmp 0x48d149
mov ecx, dword [ebp - 0x79c]
cmp ecx, dword [ebp - 0x78c]
jg 0x48d116
mov ecx, dword [ebp - 0x78c]
mov eax, dword [ebp - 0x788]
sub ecx, dword [ebp - 0x77c]
add eax, 0x24
add ecx, dword [ebp - 0x784]
jmp 0x48d0e7
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0x358], edi
mov dword [ebp - 0x354], eax
mov dword [ebp - 0x7a8], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x7c8]
lea edi, [ebp - 0x564]
mov ebx, dword [ebp - 0x358]
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0xadc], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xad8]
sub eax, 1
je 0x48d4d8
sub eax, 1
je 0x48d405
sub eax, 1
jne 0x48d24d
mov esi, dword [0x4b70b4]
lea edi, [ebp - 0x554]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7094]
lea ecx, [ebp - 0x554]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x554], 0x28
call dword [0x4bb544]
call esi
test eax, eax
je 0x48d24d
mov esi, dword [0x4b70b0]
lea eax, [ebp - 0x540]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b70b0]
lea eax, [ebp - 0x538]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0x538]
lea esi, [ebp - 0x540]
sub eax, ebx
lea edi, [ebp - 0x564]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x534]
sub eax, dword [ebp - 0xadc]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
mov dword [ebp - 0x35c], eax
xor ebx, ebx
push dword [ebp - 0xae4]
mov esi, dword [0x4b70c0]
xor eax, eax
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
mov edi, 0x4ba824
xor esi, esi
inc esi
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x48d270
mov eax, dword [0x4ba820]
test eax, eax
jle 0x48d2d5
sub eax, 1
mov dword [0x4ba820], eax
jne 0x48d2d5
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0x4b9980]
test eax, eax
je 0x48d2a4
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x48d293
push 0x40
xor eax, eax
push eax
push 0x4b9980
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x402210
mov edi, 0x4b7010
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0x4ba824
inc esi
xor eax, eax
xchg dword [edi], eax
lea ecx, [ebp - 0xc10]
call fcn.004a83ac
test ebx, ebx
js 0x48efcc
mov edi, dword [ebp - 0x360]
xor eax, eax
mov ebx, dword [ebp - 0x35c]
push 0x54
push eax
lea eax, [ebp - 0x81c]
mov dword [ebp - 0xc68], edi
push eax
mov dword [ebp - 0xc64], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xadc], esi
mov esi, dword [0x4b7038]
mov ecx, esi
push 7
push dword [ebp - 0xad4]
call dword [0x4bb544]
call esi
test eax, eax
je 0x48d37f
mov esi, dword [0x4b7044]
lea ecx, [ebp - 0x81c]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
je 0x48d37f
push 0x20
pop eax
cmp word [ebp - 0x80a], ax
jne 0x48d37f
cmp dword [ebp - 0x808], 0
je 0x48d37f
cmp dword [ebp - 0x818], 0
jle 0x48d37f
cmp dword [ebp - 0x814], 0
jg 0x48d394
xor eax, eax
cmp dword [ebp - 0xad8], 1
mov dword [ebp - 0xadc], eax
jne 0x48d4eb
mov esi, dword [0x4b70b8]
lea eax, [ebp - 0x7a4]
push ebx
push edi
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
mov esi, dword [0x4b70b8]
lea eax, [ebp - 0x794]
push ebx
push edi
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
mov ebx, dword [ebp - 0xad8]
cmp ebx, 1
jne 0x48d4f1
mov eax, dword [ebp - 0x7c4]
mov esi, dword [0x4b7024]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb10], eax
jmp 0x48d4f1
mov esi, dword [0x4b70b4]
lea edi, [ebp - 0x52c]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7094]
lea ecx, [ebp - 0x52c]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x52c], 0x28
call dword [0x4bb544]
call esi
test eax, eax
je 0x48d24d
mov esi, dword [0x4b70b0]
lea eax, [ebp - 0x518]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b70b0]
lea eax, [ebp - 0x510]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0x4bb544]
call esi
cmp dword [ebp - 0xae8], 0
lea esi, [ebp - 0x518]
lea edi, [ebp - 0x564]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x48d4b0
imul eax, dword [ebp - 0x510], 5
cdq
idiv ecx
add eax, dword [ebp - 0x518]
jmp 0x48d4be
mov eax, dword [ebp - 0x510]
sub eax, ebx
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x50c]
sub eax, dword [ebp - 0xadc]
imul eax, eax, 0x5f
jmp 0x48d244
xor ebx, ebx
mov dword [ebp - 0x360], ebx
mov dword [ebp - 0x35c], ebx
jmp 0x48d24f
mov ebx, dword [ebp - 0xad8]
mov esi, dword [0x4b7050]
mov ecx, esi
push 1
push dword [ebp - 0xad4]
call dword [0x4bb544]
call esi
cmp dword [ebp - 0x7c8], 0
mov dword [ebp - 0xb38], eax
mov dword [ebp - 0xacc], 0x810
je 0x48d52c
mov dword [ebp - 0xacc], 0x20812
cmp dword [ebp - 0xadc], 0
je 0x48e083
mov eax, dword [ebp - 0x7c4]
mov ebx, dword [ebp - 0x7c0]
mov dword [ebp - 0xb3c], eax
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0xae8], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x96c]
mov dword [ebp - 0xb04], ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa68]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0xaec], eax
lea eax, [ebp - 0x49c]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x3b0]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0x48efac
mov ebx, dword [ebp - 0xad4]
mov esi, dword [0x4b7038]
mov ecx, esi
push 7
push ebx
call dword [0x4bb544]
call esi
test eax, eax
je 0x48e0e6
mov esi, dword [0x4b7044]
lea ecx, [ebp - 0x96c]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
je 0x48d622
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0xb18], eax
mov eax, dword [ebp - 0x964]
mov dword [ebp - 0xaec], eax
mov esi, dword [0x4b7018]
mov ecx, esi
push ebx
call dword [0x4bb544]
call esi
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
je 0x48e0e6
mov eax, dword [ebp - 0x79c]
xor edx, edx
sub eax, dword [ebp - 0x7a4]
mov edi, edx
mov ecx, dword [ebp - 0x798]
sub ecx, dword [ebp - 0x7a0]
mov esi, dword [0x4b701c]
neg ecx
mov dword [ebp - 0x498], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x494], ecx
mov word [ebp - 0x490], ax
mov ecx, esi
pop eax
push edx
push edx
mov word [ebp - 0x48e], ax
lea eax, [ebp - 0xc80]
push eax
push edx
lea eax, [ebp - 0x49c]
mov dword [ebp - 0xc80], edx
push eax
push ebx
mov dword [ebp - 0xb08], edi
mov dword [ebp - 0x48c], edx
mov dword [ebp - 0x488], edx
mov dword [ebp - 0x484], edx
mov dword [ebp - 0x480], edx
mov dword [ebp - 0x47c], edx
mov dword [ebp - 0x478], edx
mov dword [ebp - 0x474], edx
mov dword [ebp - 0x49c], 0x28
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb30], eax
test eax, eax
jne 0x48d714
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x48d704
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x48dabb
mov edi, 0x80004005
jmp 0x48dabb
mov esi, dword [0x4b7044]
lea ecx, [ebp - 0xa68]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
je 0x48d73e
mov eax, dword [ebp - 0xa54]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0x79c]
sub eax, dword [ebp - 0x7a4]
push dword [ebp - 0xb30]
mov esi, dword [0x4b704c]
mov ecx, esi
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp - 0x798]
sub eax, dword [ebp - 0x7a0]
push ebx
mov dword [ebp - 0x3a4], eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7050]
xor eax, eax
inc eax
mov ecx, esi
push eax
push ebx
call dword [0x4bb544]
call esi
push dword [ebp - 0xae8]
mov esi, dword [0x4b704c]
mov ecx, esi
push ebx
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7048]
mov ecx, esi
mov dword [ebp - 0xb00], eax
xor eax, eax
push eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7084]
mov ecx, esi
push eax
lea eax, [ebp - 0x3b0]
push eax
push ebx
call dword [0x4bb544]
call esi
mov esi, dword [0x4b707c]
xor eax, eax
push eax
push dword [ebp - 0xacc]
lea eax, [ebp - 0x3b0]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb04]
push ebx
call dword [0x4bb544]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xad8], eax
jne 0x48d839
cmp dword [ebp - 0xb3c], edi
je 0x48d82d
mov esi, dword [0x4b709c]
mov ecx, esi
push 8
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb20], eax
jmp 0x48d843
mov dword [ebp - 0xb20], 0xffffff
jmp 0x48d843
mov dword [ebp - 0xb20], 0xffa8a8a8
mov edx, dword [ebp - 0x7a4]
xor ebx, ebx
mov eax, dword [ebp - 0x7a0]
mov esi, ebx
mov dword [ebp - 0xaf8], edx
mov ecx, ebx
test edx, edx
jns 0x48d86b
mov esi, edx
mov dword [ebp - 0xaf8], ebx
neg esi
mov edx, ebx
test eax, eax
jns 0x48d875
mov ecx, eax
mov eax, ebx
neg ecx
mov ebx, dword [ebp - 0x3a8]
mov edi, dword [ebp - 0xb18]
sub ebx, esi
mov dword [ebp - 0xaf0], edi
sub dword [ebp - 0xaf0], edx
mov edx, dword [ebp - 0xaf0]
mov dword [ebp - 0xb34], ebx
cmp ebx, edx
jl 0x48d8a7
mov ebx, edx
mov dword [ebp - 0xb34], edx
mov edx, dword [ebp - 0x3a4]
sub dword [ebp - 0xaec], eax
sub edx, ecx
mov dword [ebp - 0xaf0], edx
cmp edx, dword [ebp - 0xaec]
jl 0x48d8cf
mov edx, dword [ebp - 0xaec]
mov dword [ebp - 0xaf0], edx
mov edi, dword [ebp - 0xb08]
test ebx, ebx
jle 0x48da83
test edx, edx
jle 0x48da83
mov edi, dword [ebp - 0x3a8]
mov ebx, dword [ebp - 0xafc]
imul ecx, edi
shl edi, 2
mov dword [ebp - 0xae8], edi
add ecx, esi
mov esi, dword [ebp - 0xadc]
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xb18]
imul eax, esi
mov dword [ebp - 0xb0c], ecx
add eax, dword [ebp - 0xaf8]
shl esi, 2
mov dword [ebp - 0xb04], esi
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xb34]
mov dword [ebp - 0xafc], eax
test ebx, ebx
jle 0x48da5e
mov esi, eax
mov dword [ebp - 0xaf8], ebx
lea edx, [eax + 3]
sub esi, ecx
mov dword [ebp - 0xaec], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xadc], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x48da1f
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xb20]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xadc]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xaec]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xb20]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaec]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xb1e]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaec]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xadc]
cdq
idiv ecx
mov edx, dword [ebp - 0xaec]
add al, bl
mov ebx, dword [ebp - 0xaf8]
mov byte [edx], al
add edx, 4
add edi, 4
sub ebx, 1
mov dword [ebp - 0xaec], edx
mov dword [ebp - 0xaf8], ebx
jne 0x48d959
mov edx, dword [ebp - 0xaf0]
mov ebx, dword [ebp - 0xb34]
mov ecx, dword [ebp - 0xb0c]
mov eax, dword [ebp - 0xafc]
mov edi, dword [ebp - 0xae8]
mov esi, dword [ebp - 0xb04]
add ecx, edi
add eax, esi
sub edx, 1
mov dword [ebp - 0xb0c], ecx
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0xaf0], edx
jne 0x48d935
mov edi, dword [ebp - 0xb08]
push dword [ebp - 0xb30]
mov esi, dword [0x4b702c]
mov ecx, esi
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0xb00]
mov ebx, dword [ebp - 0xb44]
test eax, eax
je 0x48dabb
mov esi, dword [0x4b704c]
mov ecx, esi
push eax
push ebx
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7028]
mov ecx, esi
push ebx
call dword [0x4bb544]
call esi
test edi, edi
js 0x48efac
mov eax, dword [ebp - 0x7c4]
mov ebx, dword [ebp - 0x7bc]
mov dword [ebp - 0xb3c], eax
mov eax, dword [ebp - 0x7b0]
mov dword [ebp - 0xae8], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x918]
mov dword [ebp - 0xb04], ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa14]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0xaec], eax
lea eax, [ebp - 0x4f4]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x3c0]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0x48efac
mov ebx, dword [ebp - 0xad4]
mov esi, dword [0x4b7038]
mov ecx, esi
push 7
push ebx
call dword [0x4bb544]
call esi
test eax, eax
je 0x48e0e6
mov esi, dword [0x4b7044]
lea ecx, [ebp - 0x918]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
je 0x48dbbd
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0xb18], eax
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0xaec], eax
mov esi, dword [0x4b7018]
mov ecx, esi
push ebx
call dword [0x4bb544]
call esi
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
je 0x48e0e6
mov eax, dword [ebp - 0x78c]
xor edx, edx
sub eax, dword [ebp - 0x794]
mov edi, edx
mov ecx, dword [ebp - 0x788]
sub ecx, dword [ebp - 0x790]
mov esi, dword [0x4b701c]
neg ecx
mov dword [ebp - 0x4f0], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x4ec], ecx
mov word [ebp - 0x4e8], ax
mov ecx, esi
pop eax
push edx
push edx
mov word [ebp - 0x4e6], ax
lea eax, [ebp - 0xc84]
push eax
push edx
lea eax, [ebp - 0x4f4]
mov dword [ebp - 0xc84], edx
push eax
push ebx
mov dword [ebp - 0xb08], edi
mov dword [ebp - 0x4e4], edx
mov dword [ebp - 0x4e0], edx
mov dword [ebp - 0x4dc], edx
mov dword [ebp - 0x4d8], edx
mov dword [ebp - 0x4d4], edx
mov dword [ebp - 0x4d0], edx
mov dword [ebp - 0x4cc], edx
mov dword [ebp - 0x4f4], 0x28
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb30], eax
test eax, eax
jne 0x48dcaf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x48dc9f
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x48e065
mov edi, 0x80004005
jmp 0x48e065
mov esi, dword [0x4b7044]
lea ecx, [ebp - 0xa14]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
je 0x48dcd9
mov eax, dword [ebp - 0xa00]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0x78c]
sub eax, dword [ebp - 0x794]
push dword [ebp - 0xb30]
mov esi, dword [0x4b704c]
mov ecx, esi
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x788]
sub eax, dword [ebp - 0x790]
push ebx
mov dword [ebp - 0x3b4], eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7050]
xor eax, eax
inc eax
mov ecx, esi
push eax
push ebx
call dword [0x4bb544]
call esi
push dword [ebp - 0xae8]
mov esi, dword [0x4b704c]
mov ecx, esi
push ebx
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7048]
mov ecx, esi
mov dword [ebp - 0xb7c], eax
xor eax, eax
push eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7084]
mov ecx, esi
push eax
lea eax, [ebp - 0x3c0]
push eax
push ebx
call dword [0x4bb544]
call esi
mov esi, dword [0x4b707c]
xor eax, eax
push eax
push dword [ebp - 0xacc]
lea eax, [ebp - 0x3c0]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb04]
push ebx
call dword [0x4bb544]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xad8], eax
jne 0x48dddc
cmp dword [ebp - 0xb3c], edi
je 0x48ddd0
mov esi, dword [0x4b709c]
mov ecx, esi
push 8
call dword [0x4bb544]
call esi
mov ebx, eax
mov dword [ebp - 0xac8], ebx
mov dword [ebp - 0xb34], ebx
jmp 0x48dded
mov dword [ebp - 0xb34], 0xffffff
jmp 0x48dded
mov eax, 0xffa8a8a8
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xb34], eax
mov edx, dword [ebp - 0x794]
xor ebx, ebx
mov eax, dword [ebp - 0x790]
mov esi, ebx
mov dword [ebp - 0xaf8], edx
mov ecx, ebx
test edx, edx
jns 0x48de15
mov esi, edx
mov dword [ebp - 0xaf8], ebx
neg esi
mov edx, ebx
test eax, eax
jns 0x48de1f
mov ecx, eax
mov eax, ebx
neg ecx
mov ebx, dword [ebp - 0x3b8]
mov edi, dword [ebp - 0xb18]
sub ebx, esi
mov dword [ebp - 0xaf0], edi
sub dword [ebp - 0xaf0], edx
mov edx, dword [ebp - 0xaf0]
mov dword [ebp - 0xb00], ebx
cmp ebx, edx
jl 0x48de51
mov ebx, edx
mov dword [ebp - 0xb00], edx
mov edx, dword [ebp - 0x3b4]
sub dword [ebp - 0xaec], eax
sub edx, ecx
mov dword [ebp - 0xaf0], edx
cmp edx, dword [ebp - 0xaec]
jl 0x48de79
mov edx, dword [ebp - 0xaec]
mov dword [ebp - 0xaf0], edx
mov edi, dword [ebp - 0xb08]
test ebx, ebx
jle 0x48e02d
test edx, edx
jle 0x48e02d
mov edi, dword [ebp - 0x3b8]
mov ebx, dword [ebp - 0xafc]
imul ecx, edi
shl edi, 2
mov dword [ebp - 0xae8], edi
add ecx, esi
mov esi, dword [ebp - 0xadc]
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xb18]
imul eax, esi
mov dword [ebp - 0xb0c], ecx
add eax, dword [ebp - 0xaf8]
shl esi, 2
mov dword [ebp - 0xb04], esi
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xb00]
mov dword [ebp - 0xafc], eax
test ebx, ebx
jle 0x48e008
mov esi, eax
mov dword [ebp - 0xaf8], ebx
lea edx, [eax + 3]
sub esi, ecx
mov dword [ebp - 0xaec], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xadc], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x48dfc9
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xac8]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xadc]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xaec]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xac8]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaec]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xb32]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaec]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xadc]
cdq
idiv ecx
mov edx, dword [ebp - 0xaec]
add al, bl
mov ebx, dword [ebp - 0xaf8]
mov byte [edx], al
add edx, 4
add edi, 4
sub ebx, 1
mov dword [ebp - 0xaec], edx
mov dword [ebp - 0xaf8], ebx
jne 0x48df03
mov edx, dword [ebp - 0xaf0]
mov ebx, dword [ebp - 0xb00]
mov ecx, dword [ebp - 0xb0c]
mov eax, dword [ebp - 0xafc]
mov edi, dword [ebp - 0xae8]
mov esi, dword [ebp - 0xb04]
add ecx, edi
add eax, esi
sub edx, 1
mov dword [ebp - 0xb0c], ecx
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0xaf0], edx
jne 0x48dedf
mov edi, dword [ebp - 0xb08]
push dword [ebp - 0xb30]
mov esi, dword [0x4b702c]
mov ecx, esi
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0xb7c]
mov ebx, dword [ebp - 0xb44]
test eax, eax
je 0x48e065
mov esi, dword [0x4b704c]
mov ecx, esi
push eax
push ebx
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7028]
mov ecx, esi
push ebx
call dword [0x4bb544]
call esi
test edi, edi
js 0x48efac
jmp 0x48ef5a
xor edx, edx
inc edx
cmp dword [ebp - 0x7c4], 0
jne 0x48e097
cmp ebx, edx
je 0x48e097
mov al, 0xc0
jmp 0x48e099
or al, 0xff
mov byte [ebp - 0xb7a], al
lea edi, [ebp - 0x380]
xor eax, eax
mov esi, dword [0x4b7018]
stosd dword es:[edi], eax
xor ecx, ecx
push dword [ebp - 0xad4]
mov word [ebp - 0xb7c], cx
mov ecx, esi
mov byte [ebp - 0xb79], dl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x370]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [0x4bb544]
call esi
mov dword [ebp - 0xae0], eax
test eax, eax
jne 0x48e0f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x48efac
xor eax, eax
inc eax
cmp ebx, eax
jne 0x48e20d
mov ebx, dword [ebp - 0x79c]
mov eax, ebx
mov edi, dword [ebp - 0x78c]
mov ecx, edi
sub ecx, dword [ebp - 0x794]
sub eax, dword [ebp - 0x7a4]
mov dword [ebp - 0xb20], ecx
cmp ecx, eax
jg 0x48e12a
mov ecx, eax
mov dword [ebp - 0xb20], eax
mov edx, dword [ebp - 0x788]
mov eax, edx
sub eax, dword [ebp - 0x7a0]
mov dword [ebp - 0xb00], eax
xor eax, eax
mov esi, eax
mov dword [ebp - 0xadc], eax
cmp dword [ebp - 0x7c8], eax
je 0x48e186
mov esi, dword [ebp - 0x7a4]
mov eax, dword [ebp - 0x794]
sub esi, ebx
add esi, ecx
sub eax, edi
mov ecx, esi
mov dword [ebp - 0xb78], ecx
mov dword [ebp - 0x380], ecx
mov ecx, dword [ebp - 0xb20]
add eax, ecx
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0x370], eax
jmp 0x48e198
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0xb78], eax
mov eax, dword [ebp - 0x370]
sub ebx, dword [ebp - 0x7a4]
sub edi, dword [ebp - 0x794]
add ebx, esi
add edi, dword [ebp - 0xadc]
sub edx, dword [ebp - 0x790]
mov dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0x798]
sub eax, dword [ebp - 0x7a0]
mov dword [ebp - 0xb1c], eax
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x790]
sub eax, dword [ebp - 0x7a0]
add edx, eax
mov dword [ebp - 0x378], ebx
mov dword [ebp - 0xb48], edi
mov dword [ebp - 0x368], edi
mov dword [ebp - 0xb34], eax
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0xac4], edx
mov dword [ebp - 0x364], edx
jmp 0x48e293
mov eax, dword [ebp - 0x354]
lea esi, [ebp - 0x7a4]
lea edi, [ebp - 0x380]
mov ecx, dword [ebp - 0x358]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb00], eax
mov dword [ebp - 0xb20], ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x374]
lea esi, [ebp - 0x794]
mov ebx, dword [ebp - 0x378]
lea edi, [ebp - 0x370]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb1c], eax
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0xb78], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0xb48], eax
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0xb34], eax
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0xaec], eax
mov edi, dword [ebp - 0xb00]
xor edx, edx
mov esi, dword [0x4b701c]
mov eax, edi
neg eax
mov dword [ebp - 0x4c4], ecx
mov dword [ebp - 0x4c0], eax
mov ecx, esi
xor eax, eax
mov dword [ebp - 0xc88], edx
push 0x20
inc eax
mov dword [ebp - 0x4b8], edx
mov word [ebp - 0x4bc], ax
pop eax
push edx
push edx
mov word [ebp - 0x4ba], ax
lea eax, [ebp - 0xc88]
push eax
push edx
lea eax, [ebp - 0x4c8]
mov dword [ebp - 0x4b4], edx
push eax
push dword [ebp - 0xae0]
mov dword [ebp - 0x4b0], edx
mov dword [ebp - 0x4ac], edx
mov dword [ebp - 0x4a8], edx
mov dword [ebp - 0x4a4], edx
mov dword [ebp - 0x4a0], edx
mov dword [ebp - 0x4c8], 0x28
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb14], eax
test eax, eax
jne 0x48e335
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x48ef91
mov esi, dword [0x4b704c]
mov ecx, esi
push eax
push dword [ebp - 0xae0]
call dword [0x4bb544]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xad8], eax
jne 0x48e39f
mov ecx, dword [ebp - 0xb10]
test ecx, ecx
je 0x48e39f
mov esi, dword [0x4b7084]
xor eax, eax
mov dword [ebp - 0x504], eax
mov dword [ebp - 0x500], eax
mov eax, dword [ebp - 0xb20]
push ecx
mov dword [ebp - 0x4fc], eax
mov ecx, esi
lea eax, [ebp - 0x504]
mov dword [ebp - 0x4f8], edi
push eax
push dword [ebp - 0xae0]
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0x7c4]
mov esi, dword [ebp - 0x7c0]
mov dword [ebp - 0xb3c], eax
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0xae8], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x8c4]
mov dword [ebp - 0xb04], esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xabc]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xaf8], eax
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xb74], eax
mov dword [ebp - 0xae4], eax
lea eax, [ebp - 0x444]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x390]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x48ef76
mov edi, dword [ebp - 0xae0]
mov esi, dword [0x4b7038]
mov ecx, esi
push 7
push edi
call dword [0x4bb544]
call esi
test eax, eax
jne 0x48e44d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x48ef76
mov esi, dword [0x4b7044]
lea ecx, [ebp - 0x8c4]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
je 0x48e48f
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0xaf8], eax
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0xae4], eax
mov esi, dword [0x4b7018]
mov ecx, esi
push edi
call dword [0x4bb544]
call esi
mov ecx, eax
mov dword [ebp - 0xaf4], ecx
test ecx, ecx
je 0x48e442
mov eax, dword [ebp - 0xb1c]
xor edx, edx
mov edi, dword [ebp - 0x37c]
sub eax, edi
sub ebx, dword [ebp - 0xb78]
mov esi, dword [0x4b701c]
mov dword [ebp - 0xb1c], eax
neg eax
mov dword [ebp - 0x43c], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc8c], edx
mov word [ebp - 0x438], ax
pop eax
push edx
push edx
mov word [ebp - 0x436], ax
lea eax, [ebp - 0xc8c]
push eax
push edx
lea eax, [ebp - 0x444]
mov dword [ebp - 0xb80], edx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x434], edx
mov dword [ebp - 0x430], edx
mov dword [ebp - 0x42c], edx
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], edx
mov dword [ebp - 0x420], edx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x444], 0x28
mov dword [ebp - 0x440], ebx
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb18], eax
test eax, eax
jne 0x48e591
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb80], eax
test eax, eax
jle 0x48e576
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb80], eax
test eax, eax
mov edi, dword [ebp - 0xaf4]
js 0x48e909
mov dword [ebp - 0xb80], 0x80004005
jmp 0x48e909
mov esi, dword [0x4b7044]
lea ecx, [ebp - 0xabc]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
je 0x48e5bb
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0xadc], eax
push dword [ebp - 0xb18]
mov eax, dword [ebp - 0xb1c]
mov esi, dword [0x4b704c]
mov ecx, esi
mov dword [ebp - 0x388], ebx
mov ebx, dword [ebp - 0xaf4]
push ebx
mov dword [ebp - 0x384], eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7050]
xor eax, eax
inc eax
mov ecx, esi
push eax
push ebx
call dword [0x4bb544]
call esi
push dword [ebp - 0xae8]
mov esi, dword [0x4b704c]
mov ecx, esi
push ebx
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7048]
mov ecx, esi
mov dword [ebp - 0xae8], eax
xor eax, eax
push eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7084]
mov ecx, esi
push eax
lea eax, [ebp - 0x390]
push eax
push ebx
call dword [0x4bb544]
call esi
mov esi, dword [0x4b707c]
xor eax, eax
push eax
push dword [ebp - 0xacc]
lea eax, [ebp - 0x390]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb04]
push ebx
call dword [0x4bb544]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xad8], eax
jne 0x48e6ab
cmp dword [ebp - 0xb3c], 0
je 0x48e69f
mov esi, dword [0x4b709c]
mov ecx, esi
push 8
call dword [0x4bb544]
call esi
mov dword [ebp - 0xad0], eax
jmp 0x48e6b5
mov dword [ebp - 0xad0], 0xffffff
jmp 0x48e6b5
mov dword [ebp - 0xad0], 0xffa8a8a8
mov ecx, dword [ebp - 0xb78]
xor edx, edx
mov esi, edx
mov eax, edx
test ecx, ecx
jns 0x48e6cb
mov esi, ecx
mov ecx, edx
neg esi
test edi, edi
jns 0x48e6d5
mov eax, edi
mov edi, edx
neg eax
mov ebx, dword [ebp - 0x388]
mov edx, dword [ebp - 0xb74]
sub ebx, esi
sub edx, ecx
mov dword [ebp - 0xafc], ebx
cmp ebx, edx
jl 0x48e6f7
mov ebx, edx
mov dword [ebp - 0xafc], edx
mov edx, dword [ebp - 0x384]
sub dword [ebp - 0xae4], edi
sub edx, eax
mov dword [ebp - 0xaf0], edx
cmp edx, dword [ebp - 0xae4]
jl 0x48e71f
mov edx, dword [ebp - 0xae4]
mov dword [ebp - 0xaf0], edx
test ebx, ebx
jle 0x48e8d1
test edx, edx
jle 0x48e8d1
imul eax, dword [ebp - 0x388]
imul edi, dword [ebp - 0xb74]
add eax, esi
mov esi, dword [ebp - 0xadc]
add edi, ecx
mov ecx, dword [ebp - 0xaf8]
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0x388]
shl esi, 2
lea ecx, [ecx + edi*4]
mov dword [ebp - 0xb0c], esi
mov esi, dword [ebp - 0xb74]
shl esi, 2
mov dword [ebp - 0xb08], esi
mov esi, dword [ebp - 0xb0c]
mov edi, dword [ebp - 0xb08]
mov dword [ebp - 0xb30], eax
mov dword [ebp - 0xb44], ecx
test ebx, ebx
jle 0x48e8b2
mov esi, ecx
mov dword [ebp - 0xaf8], ebx
lea edx, [ecx + 3]
sub esi, eax
mov dword [ebp - 0xae4], edx
lea edi, [eax + 2]
mov dword [ebp - 0xadc], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x48e873
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xad0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xadc]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xae4]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xad0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xae4]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xace]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xae4]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xadc]
cdq
idiv ecx
mov edx, dword [ebp - 0xae4]
add al, bl
mov ebx, dword [ebp - 0xaf8]
mov byte [edx], al
add edx, 4
add edi, 4
sub ebx, 1
mov dword [ebp - 0xae4], edx
mov dword [ebp - 0xaf8], ebx
jne 0x48e7ad
mov edx, dword [ebp - 0xaf0]
mov ebx, dword [ebp - 0xafc]
mov eax, dword [ebp - 0xb30]
mov ecx, dword [ebp - 0xb44]
mov esi, dword [ebp - 0xb0c]
mov edi, dword [ebp - 0xb08]
add eax, esi
add ecx, edi
sub edx, 1
mov dword [ebp - 0xb30], eax
mov dword [ebp - 0xb44], ecx
mov dword [ebp - 0xaf0], edx
jne 0x48e789
push dword [ebp - 0xb18]
mov esi, dword [0x4b702c]
mov ecx, esi
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0xae8]
mov edi, dword [ebp - 0xaf4]
test eax, eax
je 0x48e909
mov esi, dword [0x4b704c]
mov ecx, esi
push eax
push edi
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7028]
mov ecx, esi
push edi
call dword [0x4bb544]
call esi
cmp dword [ebp - 0xb80], 0
jl 0x48ef76
mov eax, dword [ebp - 0x7c4]
mov ebx, dword [ebp - 0x7bc]
mov dword [ebp - 0xb3c], eax
mov eax, dword [ebp - 0x7b0]
mov dword [ebp - 0xae8], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x870]
mov dword [ebp - 0xb04], ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x9c0]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xaf8], eax
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xad0], eax
lea eax, [ebp - 0x470]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x3a0]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0x48ef76
mov edi, dword [ebp - 0xae0]
mov esi, dword [0x4b7038]
mov ecx, esi
push 7
push edi
call dword [0x4bb544]
call esi
test eax, eax
je 0x48e442
mov esi, dword [0x4b7044]
lea ecx, [ebp - 0x870]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
je 0x48ea10
mov eax, dword [ebp - 0x85c]
mov dword [ebp - 0xaf8], eax
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0x868]
mov dword [ebp - 0xad0], eax
mov esi, dword [0x4b7018]
mov ecx, esi
push edi
call dword [0x4bb544]
call esi
mov ecx, eax
mov dword [ebp - 0xae4], ecx
test ecx, ecx
je 0x48e442
mov eax, dword [ebp - 0xb48]
xor esi, esi
sub eax, dword [ebp - 0xaec]
mov edi, esi
mov edx, dword [ebp - 0xac4]
mov ebx, dword [ebp - 0xb34]
sub edx, ebx
mov dword [ebp - 0xb48], eax
mov dword [ebp - 0x46c], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xac4], edx
neg edx
mov word [ebp - 0x464], ax
pop eax
mov dword [ebp - 0x468], edx
xor edx, edx
push edx
push edx
mov word [ebp - 0x462], ax
lea eax, [ebp - 0xc90]
push eax
push edx
lea eax, [ebp - 0x470]
mov dword [ebp - 0xc90], esi
push eax
mov dword [ebp - 0x460], esi
mov dword [ebp - 0x45c], esi
mov dword [ebp - 0x458], esi
mov dword [ebp - 0x454], esi
mov dword [ebp - 0x450], esi
mov dword [ebp - 0x44c], esi
mov dword [ebp - 0x448], esi
mov esi, dword [0x4b701c]
push ecx
mov ecx, esi
mov dword [ebp - 0xb30], edi
mov dword [ebp - 0x470], 0x28
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb08], eax
test eax, eax
jne 0x48eb12
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x48eb02
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x48eeb0
mov edi, 0x80004005
jmp 0x48eeb0
mov esi, dword [0x4b7044]
lea ecx, [ebp - 0x9c0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
je 0x48eb3c
mov eax, dword [ebp - 0x9ac]
mov dword [ebp - 0xadc], eax
push dword [ebp - 0xb08]
mov eax, dword [ebp - 0xb48]
push dword [ebp - 0xae4]
mov esi, dword [0x4b704c]
mov ecx, esi
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0xac4]
mov dword [ebp - 0x394], eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7050]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xae4]
call dword [0x4bb544]
call esi
push dword [ebp - 0xae8]
mov esi, dword [0x4b704c]
mov ecx, esi
push dword [ebp - 0xae4]
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7048]
mov ecx, esi
mov dword [ebp - 0xb44], eax
xor eax, eax
push eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7084]
mov ecx, esi
push eax
lea eax, [ebp - 0x3a0]
push eax
push dword [ebp - 0xae4]
call dword [0x4bb544]
call esi
mov esi, dword [0x4b707c]
xor eax, eax
push eax
push dword [ebp - 0xacc]
lea eax, [ebp - 0x3a0]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb04]
push dword [ebp - 0xae4]
call dword [0x4bb544]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xad8], eax
jne 0x48ec4c
cmp dword [ebp - 0xb3c], edi
je 0x48ec40
mov esi, dword [0x4b709c]
mov ecx, esi
push 8
call dword [0x4bb544]
call esi
mov ecx, eax
mov dword [ebp - 0xac8], ecx
mov dword [ebp - 0xb18], ecx
jmp 0x48ec5d
mov dword [ebp - 0xb18], 0xffffff
jmp 0x48ec5d
mov eax, 0xffa8a8a8
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xb18], eax
mov esi, dword [ebp - 0xaec]
xor ecx, ecx
mov edx, ecx
mov eax, ecx
test esi, esi
jns 0x48ec79
mov edx, esi
mov esi, ecx
neg edx
mov dword [ebp - 0xaec], esi
test ebx, ebx
jns 0x48ec83
mov eax, ebx
mov ebx, ecx
neg eax
mov ecx, dword [ebp - 0xaf0]
sub ecx, esi
mov esi, dword [ebp - 0x398]
sub esi, edx
mov dword [ebp - 0xb34], esi
cmp esi, ecx
jl 0x48eca5
mov esi, ecx
mov dword [ebp - 0xb34], ecx
mov ecx, dword [ebp - 0x394]
sub dword [ebp - 0xad0], ebx
sub ecx, eax
mov dword [ebp - 0xb1c], ecx
cmp ecx, dword [ebp - 0xad0]
jl 0x48eccd
mov ecx, dword [ebp - 0xad0]
mov dword [ebp - 0xb1c], ecx
test esi, esi
jle 0x48ee79
test ecx, ecx
jle 0x48ee79
mov edi, dword [ebp - 0x398]
mov esi, dword [ebp - 0xaf8]
imul eax, edi
shl edi, 2
mov dword [ebp - 0xae8], edi
add eax, edx
mov edx, dword [ebp - 0xadc]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0xaf0]
imul ebx, edx
mov dword [ebp - 0xafc], eax
add ebx, dword [ebp - 0xaec]
shl edx, 2
mov dword [ebp - 0xb04], edx
lea ebx, [esi + ebx*4]
mov esi, dword [ebp - 0xb34]
mov dword [ebp - 0xb0c], ebx
test esi, esi
jle 0x48ee54
lea edx, [ebx + 3]
mov dword [ebp - 0xaf8], esi
sub ebx, eax
mov dword [ebp - 0xaec], edx
lea edi, [eax + 2]
mov dword [ebp - 0xadc], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x48ee15
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xac8]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xadc]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xaec]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xac8]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaec]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xb16]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaec]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xaf8]
cdq
idiv ecx
mov edx, dword [ebp - 0xaec]
add al, bl
mov ebx, dword [ebp - 0xadc]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xaec], edx
mov dword [ebp - 0xaf8], esi
jne 0x48ed4f
mov ecx, dword [ebp - 0xb1c]
mov esi, dword [ebp - 0xb34]
mov eax, dword [ebp - 0xafc]
mov ebx, dword [ebp - 0xb0c]
mov edi, dword [ebp - 0xae8]
mov edx, dword [ebp - 0xb04]
add eax, edi
add ebx, edx
sub ecx, 1
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0xb0c], ebx
mov dword [ebp - 0xb1c], ecx
jne 0x48ed2d
mov edi, dword [ebp - 0xb30]
push dword [ebp - 0xb08]
mov esi, dword [0x4b702c]
mov ecx, esi
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0xb44]
test eax, eax
je 0x48eeb0
mov esi, dword [0x4b704c]
mov ecx, esi
push eax
push dword [ebp - 0xae4]
call dword [0x4bb544]
call esi
push dword [ebp - 0xae4]
mov esi, dword [0x4b7028]
mov ecx, esi
call dword [0x4bb544]
call esi
test edi, edi
js 0x48ef76
xor eax, eax
inc eax
cmp dword [ebp - 0xad8], eax
jne 0x48ef18
mov esi, dword [0x4b7010]
xor eax, eax
push 0xcc0020
push eax
push eax
push dword [ebp - 0xae0]
mov ecx, esi
push dword [ebp - 0xb00]
push dword [ebp - 0xb20]
push dword [ebp - 0x7a0]
push dword [ebp - 0x7a4]
push dword [ebp - 0xad4]
call dword [0x4bb544]
call esi
jmp 0x48ef5a
push dword [ebp - 0xb7c]
mov ecx, dword [ebp - 0xb00]
xor edx, edx
mov eax, dword [ebp - 0xb20]
mov esi, dword [0x4b7030]
push ecx
push eax
push edx
push edx
push dword [ebp - 0xae0]
push ecx
push eax
push dword [ebp - 0x35c]
mov ecx, esi
push dword [ebp - 0x360]
push dword [ebp - 0xad4]
call dword [0x4bb544]
call esi
push dword [ebp - 0xb38]
mov esi, dword [0x4b7050]
mov ecx, esi
push dword [ebp - 0xad4]
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0xb14]
test eax, eax
je 0x48ef91
mov esi, dword [0x4b702c]
mov ecx, esi
push eax
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0xae0]
test eax, eax
je 0x48efac
mov esi, dword [0x4b7028]
mov ecx, esi
push eax
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0xb10]
test eax, eax
je 0x48efc7
mov esi, dword [0x4b702c]
mov ecx, esi
push eax
call dword [0x4bb544]
call esi
mov edi, 0x4ba824
mov ecx, dword [ebp - 0x7c0]
xor ebx, ebx
test ecx, ecx
je 0x48f01d
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x48efdb
mov eax, dword [ebp - 0x7c0]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x48f003
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x48effb
push dword [ebp - 0x7c0]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x7c0], ebx
mov ecx, dword [ebp - 0x7bc]
test ecx, ecx
je 0x48f06c
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x48f02a
mov eax, dword [ebp - 0x7bc]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x48f052
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x48f04a
push dword [ebp - 0x7bc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x7bc], ebx
mov edx, dword [ebp - 0x7b8]
test edx, edx
je 0x48f0b8
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x48f07b
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x48f0a3
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0x48f095
mov edx, dword [ebp - 0x7b8]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x7b8], ebx
cmp dword [ebp - 0x7b4], 0
je 0x48f0dd
push dword [ebp - 0x7b4]
mov esi, dword [0x4b702c]
mov ecx, esi
call dword [0x4bb544]
call esi
mov dword [ebp - 0x7b4], ebx
cmp dword [ebp - 0x7b0], 0
je 0x48f102
push dword [ebp - 0x7b0]
mov esi, dword [0x4b702c]
mov ecx, esi
call dword [0x4bb544]
call esi
mov dword [ebp - 0x7b0], ebx
cmp dword [ebp - 0x7ac], 0
je 0x48f127
push dword [ebp - 0x7ac]
mov esi, dword [0x4b702c]
mov ecx, esi
call dword [0x4bb544]
call esi
mov dword [ebp - 0x7ac], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x48f129
mov eax, dword [0x4ba820]
push 0
pop ebx
test eax, eax
jle 0x48f18b
sub eax, 1
mov dword [0x4ba820], eax
jne 0x48f18b
mov esi, ebx
mov eax, dword [esi + 0x4b9980]
test eax, eax
je 0x48f15f
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x48f14e
push 0x40
push ebx
push 0x4b9980
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x402210
mov edi, 0x4b7010
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x4ba824
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0x4b93f4]
mov esi, dword [0x4b705c]
mov ecx, esi
mov dword [ebp - 0xb0c], eax
call dword [0x4bb544]
call esi
sub eax, dword [0x4ba818]
lea edi, [ebp - 0x2ec]
push 8
mov dword [ebp - 0xafc], eax
mov esi, 0x4ba824
xor eax, eax
xor ebx, ebx
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x48f1ca
mov eax, dword [0x4ba820]
push 0
pop ebx
test eax, eax
jne 0x48f832
push 0x338
mov esi, ebx
mov dword [ebp - 0xaf0], ebx
push ebx
mov dword [ebp - 0xacc], ebx
mov dword [ebp - 0xad0], esi
mov dword [ebp - 0xb3c], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xb04], ebx
test ebx, ebx
je 0x48f826
or dword [ebp - 0xadc], 0xffffffff
xor eax, eax
mov edi, eax
mov dword [ebp - 0xb14], eax
mov cl, al
mov dword [ebp - 0xb70], eax
mov edx, 0x7f1137f
mov dword [ebp - 0x3e0], 0xab69605e
movzx esi, word [ebp - 0x3de]
mov eax, 0x7f1137f
mov dword [ebp - 0x3dc], edx
add ebx, 7
movzx edx, word [ebp - 0x3da]
movzx eax, ax
mov dword [ebp - 0xae0], esi
mov esi, eax
mov dword [ebp - 0xbbc], edi
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xaec], edx
mov dword [ebp - 0xaf8], ebx
mov edx, dword [ebp - 0xbac]
movzx ebx, byte [edx - 2]
movzx eax, byte [edx - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 1]
movzx edx, byte [edx + 2]
shl edx, 8
shl ebx, 8
or ebx, eax
mov eax, dword [ebp - 0xbac]
xor edi, ebx
mov dword [ebp - 0xb38], ebx
movzx eax, byte [eax + 3]
or edx, eax
mov eax, dword [ebp - 0xbac]
shl edx, 8
movzx eax, byte [eax + 4]
or edx, eax
mov eax, dword [ebp - 0xbac]
shl edx, 8
add dword [ebp - 0xbac], 8
movzx eax, byte [eax + 5]
or edx, eax
mov eax, 0x7f1137f
mov ebx, edx
mov dword [ebp - 0xae8], edx
xor ebx, dword [ebp - 0xb70]
xor ebx, eax
xor ebx, edi
xor ebx, 0xab69605e
mov eax, ebx
rol eax, 0xa
lea edx, [ebx + 0x54969fa2]
rol edx, 5
imul edx, esi
mov esi, 0x7f1137f
add eax, edx
xor edi, eax
mov eax, dword [ebp - 0xae0]
mov edx, edi
rol edx, 2
lea esi, [edi + esi]
ror esi, 9
imul eax, esi
mov esi, dword [ebp - 0xae0]
sub eax, edx
xor ebx, eax
mov eax, ebx
sub eax, dword [ebp - 0xae4]
imul edx, eax, 0x605e
mov eax, ebx
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xaec]
xor edi, edx
xor esi, edi
mov edx, edi
rol esi, 6
imul eax, esi
rol edx, 2
sub eax, edx
xor ebx, eax
mov eax, 0x7f1137f
mov edx, ebx
xor edx, 0xab69605e
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, dword [ebp - 0xae4]
imul eax, dword [ebp - 0xae0]
ror edx, 6
xor edx, eax
mov eax, 0x7f1137f
xor ebx, edx
add eax, ebx
ror eax, 0xf
imul eax, eax, 0x605e
mov edx, ebx
rol edx, 2
add edx, eax
mov eax, dword [ebp - 0xaec]
xor edi, edx
mov edx, edi
rol edx, 8
lea esi, [edi + 0x54969fa2]
ror esi, 0xe
imul eax, esi
sub eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, dword [ebp - 0xae4]
xor eax, edx
mov edx, dword [ebp - 0xaec]
xor edi, eax
xor edx, edi
mov eax, edi
imul edx, dword [ebp - 0xae0]
shr eax, 0xa
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xaec]
mov eax, ebx
not eax
ror eax, 5
add eax, 0x605e
imul eax, edx
xor edi, eax
mov dword [ebp - 0xb10], edi
sub edi, edx
xor edi, ebx
mov ebx, dword [ebp - 0xb10]
xor edi, 0xab69605e
xor edx, edi
mov eax, edi
rol edx, 2
imul edx, dword [ebp - 0xae4]
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov esi, ebx
mov edx, ebx
sub esi, eax
rol edx, 7
mov eax, dword [ebp - 0xae0]
ror esi, 6
imul eax, esi
mov esi, dword [ebp - 0xae0]
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, dword [ebp - 0xae4]
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
mov eax, dword [ebp - 0xaec]
xor ebx, edx
xor esi, ebx
mov dword [ebp - 0xb10], ebx
rol esi, 5
mov edx, ebx
imul eax, esi
rol edx, 7
add edx, eax
xor edi, edx
mov edx, 0x7f1137f
mov ebx, edi
xor ebx, dword [ebp - 0xb10]
xor ebx, edx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xae0]
imul eax, dword [ebp - 0xae4]
xor edi, eax
mov eax, edi
sub eax, edx
mov edx, edi
ror eax, 1
imul eax, eax, 0x605e
ror edx, 6
sub eax, edx
xor ebx, eax
mov eax, dword [ebp - 0xaec]
mov edx, ebx
rol edx, 0xe
lea esi, [ebx - 0x54969fa2]
rol esi, 3
imul eax, esi
mov esi, dword [ebp - 0xae4]
add edx, eax
xor edi, edx
mov eax, edi
ror eax, 0xe
lea edx, [edi - 0x54969fa2]
rol edx, 0xf
imul edx, esi
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, 0x605e
shr eax, 3
imul edx, dword [ebp - 0xae0]
xor edx, eax
xor edi, edx
mov edx, 0x7f1137f
mov eax, edi
xor eax, edx
mov edx, edi
xor edi, dword [ebp - 0xadc]
rol eax, 4
imul eax, eax, 0x605e
rol edx, 2
mov dword [ebp - 0xb70], edi
xor edx, eax
xor edx, dword [ebp - 0xb14]
xor ebx, edx
mov edx, dword [ebp - 0xaf8]
mov dword [ebp - 0xbbc], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb70]
ror dword [ebp - 0xbbc], 8
mov byte [edx], al
mov al, byte [ebp - 0xbbc]
ror dword [ebp - 0xb70], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb70]
ror dword [ebp - 0xbbc], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xbbc]
ror dword [ebp - 0xb70], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb70]
ror dword [ebp - 0xbbc], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xbbc]
ror dword [ebp - 0xb70], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb70]
mov byte [edx - 3], al
add edx, 8
mov edi, dword [ebp - 0xbbc]
mov eax, dword [ebp - 0xb38]
ror dword [ebp - 0xb70], 8
ror edi, 8
sub dword [ebp - 0xbc4], 1
mov dword [ebp - 0xb14], eax
mov eax, dword [ebp - 0xae8]
mov dword [ebp - 0xbbc], edi
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xaf8], edx
jne 0x48f28b
mov ebx, dword [ebp - 0xb04]
xor eax, eax
mov edx, eax
xor cl, byte [edx + ebx]
inc edx
cmp edx, 0x338
jb 0x48f61a
movzx eax, cl
cdq
cmp eax, dword [0x4119b0]
jne 0x48f64e
cmp edx, dword [0x4119b4]
jne 0x48f64e
mov esi, dword [ebp - 0xb3c]
mov edi, ebx
xor eax, eax
mov dword [ebp - 0xad0], edi
mov ebx, eax
jmp 0x48f660
or dword [ebp - 0xb58], 0xffffffff
mov esi, 0xc004d501
mov edi, dword [ebp - 0xad0]
test ebx, ebx
je 0x48f677
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x48f679
xor ebx, ebx
test esi, esi
js 0x48f820
mov eax, dword [ebp - 0xb58]
mov esi, edi
push 0x40
push ebx
mov byte [eax + edi], bl
mov ebx, 0x4b9980
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], 0
je 0x48f7b6
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xb54]
jne 0x48f6af
sub ecx, ebx
xor ebx, ebx
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x48f819
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xacc], ecx
cmp word [eax], dx
je 0x48f6f9
mov ecx, 0xc000007b
mov dword [ebp - 0xacc], ecx
jmp 0x48f741
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x48f6ec
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x48f6ec
cmp dword [edx], 0x4550
jne 0x48f6ec
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xbcc]
je 0x48f72f
cmp ax, word [ebp - 0xb40]
je 0x48f72f
mov ecx, 0xc000000d
jmp 0x48f6f1
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb04], eax
test eax, eax
je 0x48f7aa
mov edx, esi
mov dword [ebp - 0xae8], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb38], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x48f762
sub edx, dword [ebp - 0xb38]
inc esi
add esi, edx
test ecx, ecx
js 0x48f79b
push dword [ebp - 0xae8]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48f7b6
mov ecx, dword [ebp - 0xaf0]
mov dword [ecx*4 + 0x4b7010], eax
mov ecx, dword [ebp - 0xacc]
inc dword [ebp - 0xaf0]
inc ebx
cmp ebx, dword [ebp - 0xb04]
jb 0x48f751
add edi, 0x10
cmp byte [esi], 0
jne 0x48f6a8
mov ebx, dword [ebp - 0xacc]
mov esi, dword [ebp - 0xad0]
test esi, esi
je 0x48f7d7
push esi
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jns 0x48f82d
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0x4b9980]
test eax, eax
je 0x48f7f0
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x48f7df
push 0x40
push ebx
push 0x4b9980
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x402210
mov edi, 0x4b7010
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x48f83a
mov ebx, 0xc000007a
jmp 0x48f7bc
mov esi, dword [ebp - 0xad0]
mov ebx, 0xc000007a
jmp 0x48f7c2
mov eax, dword [0x4ba820]
inc eax
xor ebx, ebx
mov dword [0x4ba820], eax
xor eax, eax
mov edi, 0x4ba824
xchg dword [edi], eax
mov eax, dword [ebp - 0xafc]
xor ecx, ecx
mov esi, dword [0x4b7078]
inc ecx
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0x2d0], eax
lea eax, [ebp - 0x2ec]
push eax
push 4
push 0x2021
mov dword [ebp - 0x2ec], ecx
mov dword [ebp - 0x2e4], ecx
mov dword [ebp - 0x2d8], ecx
mov dword [ebp - 0x2dc], ecx
mov dword [ebp - 0x2d4], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x2e0], 0x9966f291
call dword [0x4bb544]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x48f8a7
mov eax, dword [0x4ba820]
push 0
pop ebx
test eax, eax
jle 0x48f909
sub eax, 1
mov dword [0x4ba820], eax
jne 0x48f909
mov esi, ebx
mov eax, dword [esi + 0x4b9980]
test eax, eax
je 0x48f8dd
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x48f8cc
push 0x40
push ebx
push 0x4b9980
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x402210
mov edi, 0x4b7010
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x4ba824
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xad4]
mov esi, dword [0x4b70c0]
mov ecx, esi
push ebx
call dword [0x4bb544]
call esi
lea ecx, [ebp - 0xc98]
call fcn.00416ea5
xor eax, eax
mov dword [ebp - 0xad4], ebx
lea edi, [ebp - 0xb64]
mov esi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xc34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x49134e
push edi
push 0x4b8ca0
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [ebp - 0xac4], ebx
push 8
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x491348
mov ecx, dword [0x4b8c98]
mov edi, esi
mov dword [esi], ecx
mov ecx, dword [0x4b8c9c]
mov dword [esi + 4], ecx
mov dword [ebp - 0xad4], edi
rdtsc
mov dword [ebp - 0xb38], eax
mov dword [ebp - 0xae8], edx
mov eax, 0xc4
push eax
push 8
mov dword [ebp - 0xb60], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x4913e2
mov dword [ebp - 0xb5c], edx
xor eax, eax
mov dword [ebp - 0xb64], eax
lea edi, [edx + 4]
cmp edi, edx
jb 0x491348
mov ecx, dword [ebp - 0xb60]
lea eax, [edx + 8]
add ecx, edx
cmp eax, ecx
ja 0x491348
push 4
pop eax
mov dword [edx], eax
mov dword [edi], eax
mov edi, dword [ebp - 0xb64]
inc edi
mov dword [ebp - 0xb64], edi
cmp dword [ebp - 0xb5c], 0
jne 0x48fa56
mov eax, dword [ebp - 0xb60]
lea ecx, [eax + 0xa4]
cmp ecx, eax
jb 0x491348
lea eax, [edi + 1]
mov dword [ebp - 0xb60], ecx
mov dword [ebp - 0xb64], eax
jmp 0x48fac6
mov edx, dword [ebp - 0xb5c]
xor eax, eax
mov ecx, eax
test edi, edi
je 0x48fa83
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x491348
add eax, edx
cmp eax, edx
jb 0x491348
inc ecx
mov edx, eax
cmp ecx, edi
jb 0x48fa64
lea edi, [edx + 4]
cmp edi, edx
jb 0x491348
mov ecx, dword [ebp - 0xb60]
lea eax, [edx + 0xa4]
add ecx, dword [ebp - 0xb5c]
cmp eax, ecx
ja 0x491348
mov eax, 0xa0
push eax
push ebx
push edi
mov dword [edx], eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xb60]
add esp, 0xc
inc dword [ebp - 0xb64]
cmp dword [ebp - 0xb5c], 0
jne 0x48fae2
lea eax, [ecx + 0xc]
cmp eax, ecx
jb 0x491348
inc dword [ebp - 0xb64]
jmp 0x48fb5e
mov edx, dword [ebp - 0xb5c]
xor ebx, ebx
mov edi, ebx
cmp dword [ebp - 0xb64], ebx
jbe 0x48fb17
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x491348
add eax, edx
cmp eax, edx
jb 0x491348
inc edi
mov edx, eax
cmp edi, dword [ebp - 0xb64]
jb 0x48faf4
lea edi, [edx + 4]
cmp edi, edx
jb 0x491348
add ecx, dword [ebp - 0xb5c]
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0x491348
mov dword [edx], 8
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0xb64]
inc eax
mov dword [ebp - 0xb64], eax
cmp dword [ebp - 0xb5c], ebx
jne 0x48fb71
mov eax, dword [ebp - 0xb60]
lea ecx, [eax + 0xc]
cmp ecx, eax
jb 0x491348
mov dword [ebp - 0xb60], ecx
jmp 0x48fbdf
mov edx, dword [ebp - 0xb5c]
mov ecx, ebx
test eax, eax
je 0x48fba0
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x491348
add eax, edx
cmp eax, edx
jb 0x491348
inc ecx
mov edx, eax
cmp ecx, dword [ebp - 0xb64]
jb 0x48fb7d
lea esi, [edx + 4]
cmp esi, edx
jb 0x491348
mov ecx, dword [ebp - 0xb60]
lea eax, [edx + 0xc]
add ecx, dword [ebp - 0xb5c]
cmp eax, ecx
ja 0x491348
mov eax, dword [ebp - 0xb38]
mov dword [edx], 8
mov dword [esi], eax
mov eax, dword [ebp - 0xae8]
mov dword [esi + 4], eax
mov ecx, dword [ebp - 0xb60]
inc dword [ebp - 0xb64]
xor edx, edx
mov edi, edx
mov dword [ebp - 0xb20], edx
mov ebx, edx
mov dword [ebp - 0xb18], edx
mov dword [ebp - 0xaf8], edx
mov dword [ebp - 0xae4], edx
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xad8], edx
mov dword [ebp - 0xb00], edx
mov dword [ebp - 0xb08], edx
rdtsc
mov dword [ebp - 0xb54], edi
mov dword [ebp - 0xaf0], ebx
mov dword [ebp - 0xb38], eax
mov dword [ebp - 0xae8], edx
add ecx, 8
cmp ecx, 8
jb 0x48fd02
lea eax, [ecx + 7]
and eax, 0xfffffff8
mov dword [ebp - 0xb58], eax
cmp eax, ecx
jb 0x48fd02
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x48fc77
mov esi, 0xc0000017
mov edi, ebx
jmp 0x48fd07
mov eax, dword [ebp - 0xb64]
lea ecx, [edi + 4]
mov dword [edi], eax
cmp ecx, edi
jb 0x48fce0
mov eax, dword [ebp - 0xb60]
lea edx, [ecx + 4]
mov dword [ecx], eax
cmp edx, ecx
jb 0x48fce0
mov ecx, dword [ebp - 0xb38]
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0xb58]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xae8]
mov dword [edi + eax - 4], ecx
push dword [ebp - 0xb60]
push dword [ebp - 0xb5c]
push edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xb58]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xb20], edi
mov edi, ecx
mov dword [ebp - 0xb54], eax
jmp 0x48fce7
xor ecx, ecx
mov esi, 0xc0000095
test edi, edi
je 0x48fcfa
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xb54]
jmp 0x48fd07
mov esi, 0xc0000095
or esi, 0x10000000
jl 0x491190
xor ecx, ecx
mov dword [ebp - 0xb10], ecx
cmp dword [ebp - 0xb20], ecx
jne 0x48fd2d
mov esi, 0xc000000d
jmp 0x4903b1
test edi, edi
je 0x4903ac
lea eax, [edi + 8]
push eax
push ecx
mov dword [ebp - 0xae8], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xb40], esi
test esi, esi
je 0x4903ac
xor ebx, ebx
mov cl, bl
mov edx, ebx
test edi, edi
je 0x48fd7b
mov esi, dword [ebp - 0xb20]
xor cl, byte [edx + esi]
inc edx
cmp edx, edi
jb 0x48fd6d
mov esi, dword [ebp - 0xb40]
mov eax, 0xc81ecb17
mov dword [ebp - 0xba0], ebx
mov dword [ebp - 0x3e4], eax
or ebx, 0xffffffff
mov eax, edi
mov dword [ebp - 0x3e8], 0xb1b54a58
shr eax, 3
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xadc], eax
test eax, eax
je 0x4901dc
movzx edx, word [ebp - 0x3e6]
mov eax, 0xc81ecb17
movzx esi, ax
movzx eax, word [ebp - 0x3e2]
mov dword [ebp - 0xaf4], eax
mov eax, dword [ebp - 0xb40]
mov dword [ebp - 0xad0], edx
add eax, 7
mov edx, dword [ebp - 0xb20]
mov dword [ebp - 0xb14], eax
add edx, 2
xor eax, eax
mov dword [ebp - 0xae0], esi
mov dword [ebp - 0xb58], eax
mov dword [ebp - 0xbc4], eax
movzx edi, byte [edx - 2]
movzx eax, byte [edx - 1]
movzx esi, byte [edx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [edx]
shl edi, 8
or edi, eax
movzx eax, byte [edx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [edx + 3]
or esi, eax
movzx eax, byte [edx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [edx + 5]
add edx, 8
shl esi, 8
or esi, eax
mov dword [ebp - 0xb38], edx
xor ebx, esi
mov eax, 0xc81ecb17
mov dword [ebp - 0xac8], ebx
add ebx, 0xffffb5a8
xor ebx, edi
xor ebx, dword [ebp - 0xba0]
xor ebx, eax
mov edx, ebx
xor edx, eax
mov eax, ebx
ror edx, 0xf
imul edx, dword [ebp - 0xad0]
ror eax, 7
add eax, edx
mov edx, dword [ebp - 0xac8]
xor edx, eax
mov dword [ebp - 0xac8], edx
add edx, 0xb1b54a58
mov eax, dword [ebp - 0xac8]
ror edx, 9
imul edx, dword [ebp - 0xae0]
ror eax, 0xa
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xae0]
rol edx, 4
imul edx, dword [ebp - 0xaf4]
rol eax, 5
add eax, edx
mov edx, dword [ebp - 0xac8]
xor edx, eax
mov eax, 0xc81ecb17
mov dword [ebp - 0xac8], edx
xor edx, 0xb1b54a58
sub eax, edx
xor ebx, eax
mov eax, ebx
shr eax, 6
lea edx, [ebx - 0x4a58]
imul edx, dword [ebp - 0xad0]
sub edx, eax
xor dword [ebp - 0xac8], edx
mov edx, dword [ebp - 0xac8]
mov eax, edx
ror eax, 0xf
xor eax, dword [ebp - 0xae0]
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, dword [ebp - 0xaf4]
imul eax, dword [ebp - 0xae0]
xor edx, eax
mov dword [ebp - 0xac8], edx
sub edx, 0xc81ecb17
sub edx, 0x4a58
xor ebx, edx
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xaf4]
imul eax, dword [ebp - 0xad0]
ror edx, 0xa
xor edx, eax
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xac8], eax
xor edx, 0x4a58
ror eax, 3
rol edx, 6
imul edx, dword [ebp - 0xae0]
xor eax, edx
mov edx, dword [ebp - 0xac8]
xor ebx, eax
mov eax, ebx
ror eax, 0xf
sub eax, dword [ebp - 0xaf4]
imul eax, eax, 0x4a58
xor edx, eax
mov dword [ebp - 0xac8], edx
xor edx, dword [ebp - 0xaf4]
mov eax, dword [ebp - 0xac8]
imul edx, edx, 0x4a58
shr eax, 1
xor edx, eax
mov eax, dword [ebp - 0xac8]
sub eax, dword [ebp - 0xae0]
xor ebx, edx
rol eax, 3
imul edx, eax, 0x4a58
mov eax, dword [ebp - 0xac8]
shr eax, 0xf
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
sub edx, dword [ebp - 0xae0]
imul edx, dword [ebp - 0xad0]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xac8], eax
ror edx, 9
imul edx, dword [ebp - 0xae0]
ror eax, 0xb
xor eax, edx
mov edx, dword [ebp - 0xac8]
xor ebx, eax
mov eax, ebx
sub eax, dword [ebp - 0xaf4]
add eax, 0x4e4ab5a8
xor edx, eax
mov dword [ebp - 0xac8], edx
mov eax, dword [ebp - 0xac8]
xor eax, dword [ebp - 0xad0]
imul eax, eax, 0x4a58
ror edx, 7
sub eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xaf4]
rol edx, 4
imul edx, dword [ebp - 0xad0]
ror eax, 0x10
sub edx, eax
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xac8], eax
ror edx, 0xa
ror eax, 4
imul edx, dword [ebp - 0xae0]
add eax, edx
xor ebx, eax
mov eax, ebx
ror eax, 9
lea edx, [ebx + 0x4e4ab5a8]
ror edx, 4
imul edx, dword [ebp - 0xaf4]
xor eax, edx
mov edx, dword [ebp - 0xac8]
xor edx, eax
mov eax, edx
mov dword [ebp - 0xac8], edx
xor eax, 0xc81ecb17
rol edx, 2
rol eax, 8
imul eax, eax, 0x4a58
sub eax, edx
mov edx, 0xc81ecb17
xor ebx, eax
sub edx, ebx
mov eax, ebx
ror edx, 0xb
imul edx, dword [ebp - 0xad0]
ror eax, 0xc
sub edx, eax
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov edx, dword [ebp - 0xad0]
xor edx, eax
mov dword [ebp - 0xac8], eax
imul edx, dword [ebp - 0xae0]
shr eax, 8
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xac8]
xor edx, 0xc81ecb17
mov eax, ebx
xor edx, dword [ebp - 0xbc4]
xor ebx, dword [ebp - 0xb58]
xor edx, eax
xor edx, 0xb1b54a58
mov dword [ebp - 0xba0], ebx
mov dword [ebp - 0xba4], edx
mov edx, dword [ebp - 0xb14]
mov dword [ebp - 0xb58], edi
mov dword [ebp - 0xbc4], esi
mov byte [edx - 4], bl
mov al, byte [ebp - 0xba4]
ror dword [ebp - 0xba0], 8
mov byte [edx], al
ror dword [ebp - 0xba4], 8
mov al, byte [ebp - 0xba0]
mov byte [edx - 5], al
mov al, byte [ebp - 0xba4]
ror dword [ebp - 0xba0], 8
mov byte [edx - 1], al
ror dword [ebp - 0xba4], 8
mov al, byte [ebp - 0xba0]
mov byte [edx - 6], al
mov al, byte [ebp - 0xba4]
ror dword [ebp - 0xba0], 8
mov byte [edx - 2], al
ror dword [ebp - 0xba4], 8
mov al, byte [ebp - 0xba0]
mov byte [edx - 7], al
mov al, byte [ebp - 0xba4]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [ebp - 0xba4]
ror dword [ebp - 0xba0], 8
ror ebx, 8
sub dword [ebp - 0xadc], 1
mov dword [ebp - 0xb14], edx
mov edx, dword [ebp - 0xb38]
mov dword [ebp - 0xba4], ebx
jne 0x48fe00
mov edi, dword [ebp - 0xb54]
mov esi, dword [ebp - 0xb40]
movzx eax, cl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x490208
mov esi, 0xc0000017
jmp 0x490309
mov ebx, dword [ebp - 0xae8]
push ebx
push 8
mov dword [edi], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x49022d
mov esi, 0xc0000017
xor ebx, ebx
jmp 0x4902a8
mov dword [edi + 4], eax
push ebx
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov esi, 0xa0
mov dword [edi + 8], esi
push esi
push 8
pop ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x490224
mov dword [edi + 0xc], eax
push esi
push 0x4b8bf0
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [edi + 0x10], ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
xor ebx, ebx
test ecx, ecx
jne 0x49028c
mov esi, 0xc0000017
jmp 0x4902a8
mov dword [edi + 0x14], ecx
mov esi, ebx
mov eax, dword [0x4b8c90]
mov dword [ecx], eax
mov eax, dword [0x4b8c94]
mov dword [ebp - 0xb10], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0x490309
cmp dword [edi + 4], 0
je 0x4902c6
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x4902e0
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x4902fa
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x49031f
mov ebx, dword [ebp - 0xb10]
xor eax, eax
mov dword [ebp - 0xaf0], ebx
mov edi, eax
jmp 0x49032b
mov ebx, dword [ebp - 0xaf0]
mov edi, dword [ebp - 0xb10]
mov eax, dword [ebp - 0xb40]
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x4903b1
xor eax, eax
cmp dword [edi + 4], eax
je 0x490363
push dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x49037f
push dword [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0x49039b
push dword [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4903b1
mov esi, 0xc0000001
or esi, 0x10000000
jl 0x49118a
mov eax, dword [ebx]
mov esi, dword [ebx + 0x10]
add eax, 4
mov ecx, dword [ebx + 8]
cmp eax, 4
jb 0x4904cd
lea edx, [eax + 4]
cmp edx, eax
jb 0x4904cd
add ecx, edx
cmp ecx, edx
jb 0x4904cd
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x4904cd
lea ecx, [eax + esi]
mov dword [ebp - 0xb38], ecx
cmp ecx, eax
jb 0x4904cd
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x490427
mov esi, 0xc0000017
mov ebx, 0xc0000095
jmp 0x4904d4
mov eax, dword [ebx]
lea esi, [edi + 4]
mov dword [edi], eax
cmp esi, edi
jb 0x4904aa
push dword [ebx]
push dword [ebx + 4]
push esi
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebx]
add esp, 0xc
add ecx, esi
cmp ecx, esi
jb 0x4904aa
mov eax, dword [ebx + 8]
lea esi, [ecx + 4]
mov dword [ecx], eax
cmp esi, ecx
jb 0x4904aa
push dword [ebx + 8]
push dword [ebx + 0xc]
push esi
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebx + 8]
add esp, 0xc
add ecx, esi
cmp ecx, esi
jb 0x4904aa
mov eax, dword [ebx + 0x10]
lea esi, [ecx + 4]
mov dword [ecx], eax
cmp esi, ecx
jb 0x4904aa
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebx + 0x10]
add esp, 0xc
add eax, esi
xor ecx, ecx
cmp eax, esi
jb 0x4904ac
mov eax, dword [ebp - 0xb38]
mov esi, ecx
mov dword [ebp - 0xb18], edi
mov edi, ecx
mov dword [ebp - 0xaf8], eax
jmp 0x4904b1
xor ecx, ecx
mov esi, 0xc0000095
test edi, edi
je 0x49041d
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x49041d
mov ebx, 0xc0000095
mov esi, ebx
or esi, 0x10000000
jl 0x49118a
cmp dword [ebp - 0xb5c], 0
jne 0x4904f3
mov esi, 0xc000000d
jmp 0x490588
xor edi, edi
inc edi
cmp dword [ebp - 0xb64], edi
jbe 0x4904e9
mov ecx, dword [ebp - 0xb5c]
xor eax, eax
mov edx, eax
mov esi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x490586
lea ecx, [esi + eax]
cmp ecx, eax
jb 0x490586
inc edx
cmp edx, edi
jb 0x490508
mov edi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x490586
cmp dword [ebp - 0xb64], 2
jbe 0x4904e9
mov ecx, dword [ebp - 0xb5c]
xor eax, eax
mov edx, eax
mov esi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x490586
lea ecx, [esi + eax]
cmp ecx, eax
jb 0x490586
inc edx
cmp edx, 2
jb 0x490539
mov edx, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x490586
lea eax, [edi + 0x30]
cmp eax, 0x30
jb 0x490586
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x490586
lea edi, [ecx + edx]
cmp edi, ecx
jb 0x490586
xor eax, eax
mov esi, eax
cmp edi, 0x400000
jbe 0x49058e
mov esi, 0x8000ffff
mov ebx, eax
jmp 0x491190
mov esi, ebx
mov edi, dword [ebp - 0xacc]
test esi, esi
js 0x49118a
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x4905b7
mov eax, dword [ebp - 0xae4]
mov esi, 0xd0000017
jmp 0x4905c2
mov dword [ebp - 0xae4], eax
mov esi, 0x10000000
test esi, esi
js 0x49118a
mov ecx, dword [ebp - 0xb18]
test ecx, ecx
jne 0x4905de
mov esi, 0x80070057
jmp 0x49118a
test eax, eax
je 0x4905d4
mov dword [ebp - 0xcc8], eax
xor eax, eax
mov dword [ebp - 0xcbc], eax
lea eax, [ebp - 0xc04]
push eax
xor eax, eax
mov dword [ebp - 0xccc], ecx
mov ecx, dword [ebp - 0xaf8]
inc eax
push 0x411248
push eax
mov dword [ebp - 0xcc4], ecx
mov dword [ebp - 0xcc0], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x490642
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x490639
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x490684
mov esi, 0x80004005
jmp 0x490684
push 0x413650
push dword [ebp - 0xc04]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x490622
xor eax, eax
mov ecx, esi
push eax
push 0x14
lea eax, [ebp - 0xccc]
push eax
push 0x86
call dword [0x4bb544]
call esi
mov esi, eax
or esi, 0x10000000
jl 0x490684
mov edi, dword [ebp - 0xcc0]
cmp esi, 0xd0000023
jne 0x490696
mov esi, 0x8007007a
jmp 0x49118a
test esi, esi
js 0x49118a
xor eax, eax
mov dword [ebp - 0xb10], eax
cmp edi, 4
jae 0x4906b5
mov esi, 0xc000003e
jmp 0x4909db
mov eax, dword [ebp - 0xae4]
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x4909d7
lea eax, [edi - 4]
cmp eax, esi
jae 0x4906d9
mov esi, 0xc000003e
jmp 0x4909d9
lea edx, [esi + ecx]
mov dword [ebp - 0xb14], edx
cmp edx, ecx
jb 0x4909d7
lea ecx, [esi + 4]
cmp ecx, 4
jb 0x4909d7
mov eax, edi
sub eax, ecx
cmp eax, 4
jb 0x4906cf
mov ecx, dword [edx]
add edx, 4
mov dword [ebp - 0xb40], ecx
cmp edx, dword [ebp - 0xb14]
jb 0x4909d7
lea eax, [esi + 4]
lea ecx, [eax + 4]
mov dword [ebp - 0xb58], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0xb40]
jb 0x4909d7
mov eax, edi
sub eax, dword [ebp - 0xb58]
cmp eax, ecx
jb 0x4906cf
lea eax, [ecx + edx]
mov dword [ebp - 0xb38], eax
cmp eax, edx
jb 0x4909d7
mov eax, dword [ebp - 0xb58]
lea edx, [ecx + eax]
mov dword [ebp - 0xb58], edx
cmp edx, eax
jb 0x4909d7
mov eax, edi
sub eax, edx
cmp eax, 4
jb 0x4906cf
mov eax, dword [ebp - 0xb38]
mov edx, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xb04], edx
mov dword [ebp - 0xae8], ecx
cmp ecx, eax
jb 0x4909d7
mov eax, dword [ebp - 0xb58]
add eax, 4
mov dword [ebp - 0xbc4], eax
cmp eax, dword [ebp - 0xb58]
jb 0x4909d7
mov eax, edi
sub eax, dword [ebp - 0xbc4]
cmp eax, edx
jb 0x4906cf
mov eax, dword [ebp - 0xbc4]
lea ecx, [edx + eax]
mov dword [ebp - 0xb38], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0xb40]
jb 0x4909d7
mov eax, edi
sub eax, dword [ebp - 0xb38]
jne 0x4906cf
lea eax, [ecx + 0xc]
add eax, edx
add eax, esi
cmp eax, edi
jne 0x4906cf
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x490816
mov esi, 0xc0000017
jmp 0x490950
mov ebx, dword [ebp - 0xae4]
add ebx, 4
je 0x490855
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x490843
mov esi, 0xc0000017
xor ecx, ecx
jmp 0x4908e9
mov dword [edi + 4], eax
push esi
push ebx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor ecx, ecx
jmp 0x49085c
xor ecx, ecx
mov dword [edi], ecx
mov dword [edi + 4], ecx
mov ebx, dword [ebp - 0xb14]
add ebx, 4
je 0x490896
mov esi, dword [ebp - 0xb40]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x490837
mov dword [edi + 0xc], eax
push esi
push ebx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor ecx, ecx
jmp 0x49089c
mov dword [edi + 8], ecx
mov dword [edi + 0xc], ecx
mov ebx, dword [ebp - 0xae8]
test ebx, ebx
je 0x4908d9
mov esi, dword [ebp - 0xb04]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x490837
mov dword [edi + 0x14], eax
push esi
push ebx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor ecx, ecx
jmp 0x4908df
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], ecx
mov dword [ebp - 0xb10], edi
mov esi, ecx
mov edi, ecx
test edi, edi
je 0x490950
cmp dword [edi + 4], 0
je 0x490909
push dword [edi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 4], ecx
cmp dword [edi + 0xc], 0
je 0x490925
push dword [edi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0xc], ecx
cmp dword [edi + 0x14], 0
je 0x490941
push dword [edi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0x14], ecx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x490966
mov eax, dword [ebp - 0xb10]
mov dword [ebp - 0xad8], eax
xor eax, eax
mov ebx, eax
jmp 0x49096e
mov ebx, dword [ebp - 0xb10]
xor eax, eax
test ebx, ebx
je 0x4909db
cmp dword [ebx + 4], 0
je 0x49098e
push dword [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebx + 4], eax
cmp dword [ebx + 0xc], 0
je 0x4909aa
push dword [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0xc], eax
cmp dword [ebx + 0x14], 0
je 0x4909c6
push dword [ebx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0x14], eax
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4909d9
mov esi, ebx
xor eax, eax
or esi, 0x10000000
mov ebx, dword [ebp - 0xad8]
jl 0x491190
mov dword [ebp - 0xb0c], eax
mov edi, eax
mov dword [ebp - 0xafc], edi
test ebx, ebx
jne 0x490a09
mov esi, 0xd000000d
jmp 0x491190
mov esi, dword [ebx + 4]
mov dword [ebp - 0xb3c], esi
test esi, esi
je 0x4909ff
mov ebx, dword [ebx]
test ebx, ebx
jne 0x490a26
mov esi, 0xd000000d
jmp 0x49118a
add ebx, 0xfffffff8
mov dword [ebp - 0xaf8], eax
push ebx
push eax
mov dword [ebp - 0xbcc], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xadc], eax
test eax, eax
je 0x491034
xor ecx, ecx
mov dword [ebp - 0x3f0], 0xab69605e
mov dl, cl
mov edi, esi
mov ecx, 0x7f1137f
mov dword [ebp - 0xb58], edi
mov dword [ebp - 0x3ec], ecx
mov esi, ebx
mov ecx, eax
mov dword [ebp - 0xb10], ecx
and esi, 7
je 0x490fcd
or dword [ebp - 0xb4c], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0xb68], ebx
mov eax, ebx
mov dword [ebp - 0xaec], ebx
mov dword [ebp - 0xbac], eax
test esi, esi
je 0x490af7
push 0x38
pop eax
cmp ebx, 4
jge 0x490abf
lea ecx, [eax - 0x20]
movzx eax, byte [edi]
shl eax, cl
or dword [ebp - 0xbac], eax
jmp 0x490ad0
movzx eax, byte [edi]
mov ecx, dword [ebp - 0xba8]
shl eax, cl
or dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0xba8]
inc edi
inc ebx
sub eax, 8
mov dword [ebp - 0xba8], eax
cmp ebx, esi
jl 0x490aaa
mov ecx, dword [ebp - 0xb10]
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xb58], edi
mov ebx, dword [ebp - 0xaec]
xor eax, 0x92f65a5
xor ebx, 0x699a899c
mov dword [ebp - 0xae0], eax
xor edi, edi
mov dword [ebp - 0xb68], eax
mov dword [ebp - 0xb4c], ebx
test esi, esi
je 0x490b4f
cmp edi, 4
jge 0x490b2c
rol eax, 8
mov byte [ecx], al
jmp 0x490b31
rol ebx, 8
mov byte [ecx], bl
inc ecx
inc edi
cmp edi, esi
jl 0x490b20
mov eax, dword [ebp - 0xb68]
mov ebx, dword [ebp - 0xb4c]
mov dword [ebp - 0xb10], ecx
mov dword [ebp - 0xae0], eax
cmp esi, 4
jbe 0x490f99
push 8
pop ecx
sub ecx, esi
shl ecx, 3
shr ebx, cl
shl ebx, cl
mov dword [ebp - 0xb40], ebx
mov dword [ebp - 0xb4c], ebx
mov edi, dword [ebp - 0xae0]
mov ebx, dword [ebp - 0xbcc]
mov eax, ebx
shr eax, 3
mov dword [ebp - 0xb14], eax
test eax, eax
je 0x490f5e
movzx esi, word [ebp - 0x3ee]
mov eax, 0x7f1137f
movzx ecx, word [ebp - 0x3ea]
movzx eax, ax
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0xb10]
mov dword [ebp - 0xaf4], esi
add eax, 7
mov esi, dword [ebp - 0xb58]
mov dword [ebp - 0xb54], ecx
add esi, 2
mov dword [ebp - 0xbc4], eax
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx ecx, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl ecx, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or ecx, eax
mov dword [ebp - 0xb38], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 5]
shl ecx, 8
add esi, 8
or ecx, eax
mov dword [ebp - 0xb04], esi
mov ebx, ecx
mov dword [ebp - 0xae8], ecx
xor ebx, dword [ebp - 0xb40]
mov eax, 0x7f1137f
xor ebx, eax
mov eax, dword [ebp - 0xad0]
xor ebx, edi
xor ebx, 0xab69605e
mov ecx, ebx
rol ecx, 0xa
lea esi, [ebx + 0x54969fa2]
rol esi, 5
imul eax, esi
mov esi, 0x7f1137f
add ecx, eax
mov eax, dword [ebp - 0xaf4]
xor edi, ecx
mov ecx, edi
rol ecx, 2
lea esi, [edi + esi]
ror esi, 9
imul eax, esi
sub eax, ecx
xor ebx, eax
mov eax, ebx
sub eax, dword [ebp - 0xad0]
imul ecx, eax, 0x605e
mov eax, ebx
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0xb54]
xor edi, ecx
mov esi, edi
mov ecx, edi
xor esi, dword [ebp - 0xaf4]
rol esi, 6
imul eax, esi
mov esi, 0x7f1137f
rol ecx, 2
sub eax, ecx
xor ebx, eax
mov eax, esi
mov ecx, ebx
xor ecx, 0xab69605e
sub eax, ecx
xor edi, eax
mov eax, edi
mov ecx, edi
xor eax, dword [ebp - 0xad0]
imul eax, dword [ebp - 0xaf4]
ror ecx, 6
xor ecx, eax
xor ebx, ecx
mov ecx, ebx
lea eax, [ebx + esi]
ror eax, 0xf
rol ecx, 2
imul eax, eax, 0x605e
add ecx, eax
mov eax, dword [ebp - 0xb54]
xor edi, ecx
mov ecx, edi
rol ecx, 8
lea esi, [edi + 0x54969fa2]
ror esi, 0xe
imul eax, esi
sub eax, ecx
xor ebx, eax
mov eax, dword [ebp - 0xad0]
mov esi, ebx
mov ecx, ebx
ror ecx, 0xa
xor esi, 0xab69605e
ror esi, 0xc
imul eax, esi
mov esi, dword [ebp - 0xb54]
xor ecx, eax
xor edi, ecx
mov ecx, esi
xor ecx, edi
mov eax, edi
imul ecx, dword [ebp - 0xaf4]
shr eax, 0xa
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xad0]
mov eax, ebx
not eax
ror eax, 5
add eax, 0x605e
imul eax, esi
xor edi, eax
mov dword [ebp - 0xae0], edi
sub edi, esi
xor edi, ebx
mov ebx, dword [ebp - 0xae0]
xor edi, 0xab69605e
mov eax, edi
xor eax, esi
rol eax, 2
imul ecx, eax
mov eax, edi
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov esi, ebx
mov ecx, ebx
sub esi, eax
rol ecx, 7
mov eax, dword [ebp - 0xaf4]
ror esi, 6
imul eax, esi
add ecx, eax
xor edi, ecx
mov eax, edi
mov ecx, edi
xor eax, dword [ebp - 0xad0]
imul eax, eax, 0x605e
ror ecx, 9
add ecx, eax
mov eax, dword [ebp - 0xb54]
xor ebx, ecx
mov esi, ebx
mov dword [ebp - 0xae0], ebx
xor esi, dword [ebp - 0xaf4]
mov ecx, ebx
rol esi, 5
imul eax, esi
rol ecx, 7
add ecx, eax
xor edi, ecx
mov ecx, 0x7f1137f
mov ebx, edi
xor ebx, dword [ebp - 0xae0]
xor ebx, ecx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xaf4]
imul eax, dword [ebp - 0xad0]
xor edi, eax
mov eax, edi
sub eax, ecx
mov ecx, edi
ror eax, 1
imul eax, eax, 0x605e
ror ecx, 6
sub eax, ecx
xor ebx, eax
mov eax, dword [ebp - 0xb54]
mov ecx, ebx
rol ecx, 0xe
lea esi, [ebx - 0x54969fa2]
rol esi, 3
imul eax, esi
add ecx, eax
mov eax, dword [ebp - 0xad0]
xor edi, ecx
mov ecx, edi
ror ecx, 0xe
lea esi, [edi - 0x54969fa2]
rol esi, 0xf
imul eax, esi
sub eax, ecx
xor ebx, eax
mov ecx, ebx
mov eax, ebx
shr eax, 3
xor ecx, 0x605e
imul ecx, dword [ebp - 0xaf4]
xor ecx, eax
xor edi, ecx
mov ecx, 0x7f1137f
mov eax, edi
xor eax, ecx
mov ecx, edi
xor edi, dword [ebp - 0xaec]
rol eax, 4
imul eax, eax, 0x605e
rol ecx, 2
mov dword [ebp - 0xb4c], edi
xor ecx, eax
xor ecx, dword [ebp - 0xbac]
xor ebx, ecx
mov ecx, dword [ebp - 0xbc4]
mov dword [ebp - 0xb68], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb4c]
ror dword [ebp - 0xb68], 8
mov byte [ecx], al
mov al, byte [ebp - 0xb68]
ror dword [ebp - 0xb4c], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb4c]
ror dword [ebp - 0xb68], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xb68]
ror dword [ebp - 0xb4c], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xb4c]
ror dword [ebp - 0xb68], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xb4c], 8
mov al, byte [ebp - 0xb68]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb4c]
mov byte [ecx - 3], al
mov edi, dword [ebp - 0xb68]
mov eax, dword [ebp - 0xb4c]
ror edi, 8
ror eax, 8
mov dword [ebp - 0xb40], eax
mov dword [ebp - 0xb4c], eax
mov eax, dword [ebp - 0xb38]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xae8]
mov dword [ebp - 0xb68], edi
mov dword [ebp - 0xaec], eax
mov esi, dword [ebp - 0xb04]
add ecx, 8
sub dword [ebp - 0xb14], 1
mov dword [ebp - 0xbc4], ecx
jne 0x490bcf
mov ebx, dword [ebp - 0xbcc]
mov ecx, dword [ebp - 0xadc]
xor eax, eax
mov esi, eax
test ebx, ebx
je 0x490f74
xor dl, byte [esi + ecx]
inc esi
cmp esi, ebx
jb 0x490f6c
mov esi, dword [ebp - 0xb3c]
movzx eax, dl
cdq
cmp eax, dword [ebx + esi]
jne 0x490ff7
cmp edx, dword [ebx + esi + 4]
jne 0x490ff7
xor eax, eax
mov edi, ecx
mov esi, ebx
mov ecx, eax
mov ebx, dword [ebp - 0xaf8]
jmp 0x49100a
xor ecx, ecx
mov dword [ebp - 0xb40], ecx
mov dword [ebp - 0xb4c], ecx
cmp esi, 4
jae 0x490b70
push 4
pop ecx
sub ecx, esi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xb68], eax
jmp 0x490b70
xor ecx, ecx
or dword [ebp - 0xaec], 0xffffffff
mov eax, ecx
mov dword [ebp - 0xbac], ecx
mov edi, ecx
mov dword [ebp - 0xb40], eax
mov dword [ebp - 0xb4c], eax
mov dword [ebp - 0xb68], edi
jmp 0x490b7c
mov edi, dword [ebp - 0xafc]
mov ebx, 0xc004d501
mov esi, dword [ebp - 0xb0c]
xor eax, eax
test ecx, ecx
je 0x49101d
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
js 0x491034
xor eax, eax
mov dword [ebp - 0xb00], edi
mov ebx, esi
mov edi, eax
mov esi, 0x10000000
jmp 0x491041
mov ebx, dword [ebp - 0xb08]
mov esi, 0xd0000001
xor eax, eax
test edi, edi
je 0x491054
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x49118a
cmp ebx, 4
jae 0x49106b
mov esi, 0xc000003e
jmp 0x491184
mov edx, dword [ebp - 0xb00]
mov eax, dword [edx]
lea ecx, [edx + 4]
mov dword [ebp - 0xb38], eax
cmp ecx, edx
jb 0x49117f
lea eax, [ebx - 4]
cmp eax, 4
jb 0x491061
mov edi, dword [ecx]
lea esi, [ecx + 4]
cmp esi, ecx
jb 0x49117f
lea eax, [ebx - 8]
cmp eax, edi
jb 0x491061
lea eax, [edi + 8]
cmp eax, 8
jb 0x49117f
mov ecx, dword [ebp - 0xb00]
lea edx, [esi + edi]
lea eax, [ebx + ecx]
cmp eax, edx
jb 0x491061
sub ebx, esi
sub ebx, edi
add ebx, ecx
cmp ebx, 8
jae 0x491061
xor eax, eax
mov dword [ebp - 0xba8], eax
mov ebx, eax
test esi, esi
je 0x491114
mov ecx, esi
cmp edx, esi
jb 0x49117f
jbe 0x491110
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x49117f
cmp eax, edx
ja 0x491135
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0x49113c
add eax, ecx
cmp eax, ecx
jb 0x49117f
mov ecx, eax
cmp ecx, edx
ja 0x491135
inc dword [ebp - 0xba8]
cmp ecx, edx
jb 0x4910e1
cmp ecx, edx
jne 0x491135
test edi, edi
je 0x491143
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x491143
mov esi, 0xc0000017
jmp 0x491168
mov esi, 0xc000000d
jmp 0x491184
mov esi, 0xc0000095
jmp 0x491168
test esi, esi
je 0x491152
push edi
push esi
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xc2c], ebx
mov dword [ebp - 0xc34], eax
xor eax, eax
mov esi, eax
test esi, esi
js 0x491184
mov eax, dword [ebp - 0xb38]
cmp eax, dword [ebp - 0xc34]
je 0x491184
jmp 0x491061
mov esi, 0xc0000095
or esi, 0x10000000
mov ebx, dword [ebp - 0xad8]
mov eax, dword [ebp - 0xb20]
test eax, eax
je 0x4911ab
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xaf0]
test edi, edi
je 0x491219
xor eax, eax
cmp dword [edi + 4], eax
je 0x4911d2
push dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x4911ee
push dword [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0x49120a
push dword [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb18]
test eax, eax
je 0x491234
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xae4]
test eax, eax
je 0x49124f
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x4912bb
xor eax, eax
cmp dword [ebx + 4], eax
je 0x491270
push dword [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebx + 4], eax
cmp dword [ebx + 0xc], 0
je 0x49128c
push dword [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0xc], eax
cmp dword [ebx + 0x14], 0
je 0x4912a8
push dword [ebx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0x14], eax
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4912bd
xor ebx, ebx
mov eax, dword [ebp - 0xb00]
test eax, eax
je 0x4912d6
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x491348
xor edi, edi
inc edi
cmp dword [ebp - 0xc34], edi
jb 0x491348
mov eax, dword [ebp - 0xc2c]
test eax, eax
je 0x491348
cmp dword [ebp - 0xc34], 0
jbe 0x491348
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x491305
mov eax, ebx
jmp 0x49130d
or ecx, 0xffffffff
mov eax, 0xc0000095
test eax, eax
js 0x491348
mov eax, edx
neg eax
sbb eax, eax
and eax, ecx
cmp edx, 4
jne 0x491348
cmp dword [eax], 0
jl 0x491348
cmp dword [ebp - 0xc34], edi
jbe 0x491348
mov eax, dword [ebp - 0xc2c]
mov edx, ebx
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x491348
lea eax, [esi + ecx]
cmp eax, ecx
jb 0x491348
inc edx
cmp edx, edi
jb 0x491333
mov esi, dword [ebp - 0xac4]
mov edi, dword [ebp - 0xad4]
xor ebx, ebx
mov dword [ebp - 0xb60], ebx
mov dword [ebp - 0xb64], ebx
cmp dword [ebp - 0xb5c], ebx
je 0x491384
push dword [ebp - 0xb5c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xb5c], ebx
mov eax, dword [ebp - 0xc2c]
test eax, eax
je 0x49139d
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x4913b0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x4913c3
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [ebp - 0xac0]
mov eax, dword [ebp - 0xbe0]
xor edx, edx
mov dword [ebp - 0xbe0], edx
mov dword [ebp - 0xc08], eax
jmp 0x4889ba
mov esi, dword [ebp - 0xac4]
jmp 0x491354
cmp ebx, 0xd00000e5
je 0x49140c
cmp ebx, 0xc004d501
je 0x49140c
cmp ebx, 0xd000003e
jne 0x491411
mov ebx, 0xc004f028
jmp 0x491422
mov ebx, 0xc004f027
test ebx, ebx
jns 0x491430
cmp ebx, 0x8007007a
jne 0x491422
mov ebx, 0xc004f01e
mov esi, dword [ebp - 0xc0c]
mov dword [ebp - 0xbc8], ebx
jmp 0x491447
cmp dword [ebp - 0xbe4], 4
jne 0x49141d
mov eax, dword [ebp - 0xc08]
mov ebx, dword [ebp - 0xbc8]
mov esi, dword [eax]
lea ecx, [ebp - 0xc08]
call fcn.004a8395
test ebx, ebx
jns 0x491490
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x491482
test byte [eax + 0x1c], 2
je 0x491482
cmp byte [eax + 0x19], 2
jb 0x491482
push ebx
push dword [eax + 0x14]
mov edx, 0x410020
push dword [eax + 0x10]
push 0x3f
pop ecx
call fcn.0041610f
mov esi, dword [ebp - 0xbc8]
mov eax, esi
call fcn.004a9550
ret
test esi, esi
jne 0x49149b
mov esi, 0x80004005
jmp 0x491488
xor ecx, ecx
mov dword [ebp - 0xc50], ecx
mov dword [ebp - 0xc4c], ecx
mov dword [ebp - 0xc48], ecx
lea eax, [ebp - 0xc44]
mov dword [ebp - 4], ecx
push eax
push 0x20119
push ecx
push 0x4043b8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc44], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test ecx, ecx
jne 0x491581
lea ecx, [ebp - 0xc50]
call fcn.0041a5f7
mov ecx, eax
mov eax, dword [ebp - 0xc44]
mov dword [ebp - 0xc50], eax
test ecx, ecx
jne 0x491581
mov edi, dword [ebp - 0xbf4]
lea ecx, [ebp - 0xc50]
push edi
mov edx, 0x40ffb4
call fcn.00495d6d
mov esi, eax
test esi, esi
je 0x49156d
mov ecx, edi
call fcn.004171af
test esi, esi
jg 0x491532
mov ebx, esi
mov dword [ebp - 0xbc8], esi
jmp 0x491541
movzx ebx, si
or ebx, 0x80070000
mov dword [ebp - 0xbc8], ebx
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x49156d
test byte [eax + 0x1c], 2
je 0x49156d
cmp byte [eax + 0x19], 2
jb 0x49156d
push ebx
push dword [eax + 0x14]
mov edx, 0x410020
push dword [eax + 0x10]
push 0x41
pop ecx
call fcn.0041610f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc50]
call fcn.0041a5f7
jmp 0x491482
jg 0x491587
mov esi, ecx
jmp 0x491590
movzx esi, cx
or esi, 0x80070000
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x4915bc
test byte [eax + 0x1c], 2
je 0x4915bc
cmp byte [eax + 0x19], 2
jb 0x4915bc
push esi
push dword [eax + 0x14]
mov edx, 0x410020
push dword [eax + 0x10]
push 0x40
pop ecx
call fcn.0041610f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc50]
call fcn.0041a5f7
jmp 0x491488