Function at 0x408bd5
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
sub eax, eax
mov eax, 8
lea eax, [ebp - 0x18]
cmp eax, 0xae
ja 0x408bfc
mov edx, dword [ebp - 0x1c]
xor dword [ebp - 0x20], 0xffffff
cmp eax, dword [ebp - 0x1c]
je 0x408bfc
push 4
push 0x2000
push 0x400
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dword [ebp - 0x1c], edx
mov esi, dword [ebp]
lea ecx, [esp]
lea edi, [ebp - 0x1c]
mov edi, dword [esp]
mov dword [ebp - 0x1c], edi
mov di, 0xf2
mov dword [ebp - 0x1c], eax
sub ecx, ecx
lea edi, [esp]
mov esi, dword [ebp]
mov edi, eax
mov dword [ebp - 0x20], eax
mov dx, 0xb1
and dword [ebp - 0x20], 0x880088
lea esi, [ebp - 0x18]
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor edx, edx
and dword [ebp - 0x18], 0xcc00cc
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
add dword [ebp - 0x1c], 0x888888
or dword [ebp - 0x20], 0xdddd00dd
mov dword [ebp - 0x18], edi
sub dword [ebp - 0x1c], 0xcccccc
sub dword [ebp - 0x20], 0x11000011
add dword [ebp - 0x18], 0x33000033
mov edx, dword [esp]
mov edx, 0x300
mov dword [ebp - 0x1c], 4
cmp edx, dword [ebp - 0x20]
jne 0x408c9f
sub eax, eax
lea eax, [ebp - 0x1c]
mov ax, 0x10
sub ecx, ecx
lea ecx, [ebp - 0x20]
lea ecx, [ebp - 0x20]
cmp ecx, 0xa7
jbe 0x408cc5
mov eax, dword [ebp - 0x1c]
and dword [ebp - 0x1c], 0xffffff
sub ecx, ecx
mov ecx, 0x21
cmp ecx, 0
jae 0x408cc5
call fcn.0040b10e
mov eax, 0x200
lea eax, [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jbe 0x408ce4
mov edx, 0x64
add dword [ebp - 0x1c], 0x10
add dword [ebp - 0x1c], 4
call dword [sym.imp.KERNEL32.DLL_GetACP]
mov edi, dword [esp]
mov ecx, dword [ebp]
mov edi, 0x36
mov esi, 0xb4
mov dword [ebp - 0x18], eax
mov di, 0x25
mov ecx, dword [ebp - 0x18]
mov ax, 1
and dword [ebp - 0x1c], 0x88880088
mov dword [ebp - 0x18], 0x9e
lea edx, [esp]
and dword [ebp - 0x20], 0x77
sub dword [ebp - 0x18], 0x440044
mov dword [ebp - 0x20], 0x80
lea edx, [esp]
mov ecx, edi
lea esi, [ebp]
lea esi, [ebp]
sub dword [ebp - 0x18], 0x33
mov edi, dword [ebp - 0x18]
sub dword [ebp - 0x20], 0xdddddddd
and dword [ebp - 0x20], 0xaa0000aa
mov eax, dword [ebp - 0x1c]
sub esi, esi
lea ecx, [ebp]
and dword [ebp - 0x1c], 0x44
mov dword [ebp - 0x1c], 0x40
mov edi, 4
mov eax, dword [ebp - 0x1c]
and dword [ebp - 0x1c], 0xffff
mov dword [ebp - 0x1c], edi
add dword [ebp - 0x1c], 0xcc0000cc
mov eax, ecx
mov ecx, 0x300
mov ecx, 0x71
cmp dword [ebp - 0x20], ecx
je 0x408d8f
xor edx, edx
cmp edx, 0
je 0x408d8f
push 8
push 0x8000
push 0x400
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov eax, edi
mov dword [ebp - 0x20], edi
mov ecx, edx
mov edi, dword [ebp]
lea edx, [ebp - 0x20]
mov edx, edi
mov eax, dword [ebp - 0x1c]
mov edi, dword [esp]
mov esi, edi
lea eax, [ebp]
mov edx, 0xce
sub dword [ebp - 0x20], 0x33330033
mov cx, 1
and dword [ebp - 0x20], 0x777777
lea edi, [ebp - 0x1c]
add dword [ebp - 0x1c], 0xcccc
and dword [ebp - 0x18], 0xee00eeee
mov dword [ebp - 0x1c], edx
mov edx, 0x9d
or dword [ebp - 0x20], 0x990099
mov edi, 0x42
sub dword [ebp - 0x18], 0xbb00bbbb
mov edx, 0xe9
mov dword [ebp - 0x1c], 0x60
lea edi, [esp]
sub dword [ebp - 0x18], 0xaa00aaaa
mov dword [ebp - 0x1c], 0x10
lea edi, [esp]
mov edi, dword [esp]
lea edi, [esp]
mov ecx, 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 1
mov ecx, 0x80
cmp ecx, 0xb35
jbe 0x408e4d
xor eax, eax
sub eax, eax
lea ecx, [ebp - 0x1c]
add dword [ebp - 0x1c], 0x45
push 4
push 0x4000
push pe_nt_image_headers32
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x20], edi
mov cx, 0xc
mov edi, eax
mov ecx, dword [esp]
lea edx, [ebp - 0x1c]
mov eax, 0xd7
mov edx, dword [ebp - 0x20]
lea edi, [ebp - 0x20]
or dword [ebp - 0x20], 0xcc
sub dword [ebp - 0x20], 0x99999999
mov ax, 0x12
mov dword [ebp - 0x18], 0x25
mov cx, 2
xor dword [ebp - 0x18], 0xcccccccc
mov edi, dword [ebp]
xor dword [ebp - 0x1c], 0x55005555
lea esi, [ebp]
and dword [ebp - 0x18], 0x99009999
lea ecx, [ebp - 0x20]
mov edi, eax
add dword [ebp - 0x20], 0x55000055
mov dword [ebp - 0x20], edi
and dword [ebp - 0x1c], 0x1111
sub dword [ebp - 0x1c], 0xcc00cc
lea edx, [esp]
lea esi, [ebp - 0x18]
mov dword [ebp - 0x1c], edi
xor esi, esi
mov dword [ebp - 0x20], 0x20
and dword [ebp - 0x1c], 0xcccc
sub esi, esi
or dword [ebp - 0x18], 0x2222
mov edx, 0xc8
xor dword [ebp - 0x20], 0xff
and dword [ebp - 0x18], 0xff
test edx, edx
ja 0x408f18
mov ecx, 0x200
xor edx, edx
cmp dword [ebp - 0x1c], ecx
jbe 0x408f18
and dword [ebp - 0x18], 0xffffff
add dword [ebp - 0x20], 0x3d
push 8
push 0x8000
push 0xf00
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edi, dword [esp]
mov dx, 0x25
lea ecx, [esp]
lea eax, [ebp]
lea edx, [esp]
lea esi, [ebp]
mov eax, 0x20
mov eax, dword [esp]
sub edi, edi
mov ecx, dword [ebp - 0x1c]
xor edi, edi
lea ecx, [ebp]
mov dword [ebp - 0x1c], 0xea
and dword [ebp - 0x20], 0x33000033
sub dword [ebp - 0x18], 0xbbbbbbbb
mov ecx, dword [ebp]
lea esi, [ebp - 0x20]
lea ecx, [ebp]
or dword [ebp - 0x18], 0x888888
and dword [ebp - 0x1c], 0x11000011
mov eax, 1
xor dword [ebp - 0x1c], 0x22002222
sub edi, edi
or dword [ebp - 0x1c], 0xffffff
or dword [ebp - 0x20], 0x44
add dword [ebp - 0x20], 0xcccc00cc
and dword [ebp - 0x18], 0x220022
mov di, 0x10
and dword [ebp - 0x18], 0x33000033
mov dword [ebp - 0x20], edx
or dword [ebp - 0x18], 0xcc0000cc
sub ecx, ecx
mov dx, 8
sub edx, edx
sub edx, edx
and dword [ebp - 0x20], 0xff
or dword [ebp - 0x20], 0xff00ff
test edx, edx
jae 0x408ffa
and dword [ebp - 0x1c], 0xff
and dword [ebp - 0x20], 0xff
mov eax, 0x200
and dword [ebp - 0x18], 0xff
mov ecx, 0x64
mov ecx, 0x3f
mov ecx, 0x10
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ecx
jae 0x409017
sub edx, edx
mov edx, pe_nt_image_headers32
mov eax, 0x53
and dword [ebp - 0x1c], 0xff00ff
xor dword [ebp - 0x1c], 0xffff
xor edx, edx
cmp dword [ebp - 0x18], edx
jbe 0x409041
sub eax, eax
and dword [ebp - 0x20], 0xffff
sub edx, edx
add dword [ebp - 0x18], 8
mov eax, 0x17
sub eax, eax
mov ax, 0x80
mov ax, 0x5c
cmp dword [ebp - 0x18], eax
jne 0x409062
mov edx, 0x200
test edx, edx
je 0x409069
and dword [ebp - 0x20], 0xffff
mov ecx, dword [ebp - 0x18]
xor edx, edx
xor edx, edx
call dword [sym.imp.KERNEL32.DLL_GetACP]
mov dword [ebp - 0x20], edi
mov esi, ecx
mov di, 0x10
mov esi, 8
lea esi, [esp]
lea esi, [ebp]
mov di, 2
mov eax, edi
mov dword [ebp - 0x18], esi
sub ecx, ecx
and dword [ebp - 0x18], 0x77770077
xor dword [ebp - 0x18], 0x330033
lea esi, [ebp - 0x20]
sub esi, esi
xor esi, esi
and dword [ebp - 0x18], 0x11001111
sub dword [ebp - 0x20], 0xbbbbbb
mov dword [ebp - 0x1c], 8
sub edi, edi
mov ecx, edx
mov edx, dword [ebp - 0x1c]
mov esi, eax
xor dword [ebp - 0x18], 0x770077
xor ecx, ecx
mov cx, 0x34
mov eax, dword [esp]
mov edi, 0xcf
lea edx, [ebp]
xor edx, edx
sub edi, edi
and dword [ebp - 0x1c], 0x660066
xor edi, edi
xor edi, edi
xor ecx, ecx
mov cx, 8
test ecx, ecx
ja 0x409106
add dword [ebp - 0x20], 0x5c
sub edx, edx
and dword [ebp - 0x1c], 0xffffff
call dword [sym.imp.KERNEL32.DLL_GetACP]
mov dword [ebp - 0x20], edi
mov edx, dword [ebp]
mov edi, dword [ebp]
mov dword [ebp - 0x20], esi
mov cx, 8
mov cx, 0x67
mov edi, dword [esp]
mov edi, eax
add dword [ebp - 0x20], 0x66660066
mov edx, 2
and dword [ebp - 0x18], 0x11111111
mov cx, 0x10
mov eax, 0xbe
add dword [ebp - 0x20], 0x22220022
add dword [ebp - 0x18], 0x33333333
mov dword [ebp - 0x18], 0x40
mov edx, 0xb4
or dword [ebp - 0x1c], 0x33330033
mov ax, 0xd6
sub edx, edx
xor eax, eax
mov dword [ebp - 0x1c], 0x10
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov ecx, edi
add dword [ebp - 0x18], 0xaaaa00aa
sub dword [ebp - 0x1c], 0xffffff
mov si, 2
mov dword [ebp - 0x1c], edx
lea edi, [esp]
lea edi, [ebp - 0x20]
sub edi, edi
lea ecx, [ebp - 0x1c]
mov edx, 0x300
lea edx, [ebp - 0x18]
test edx, edx
ja 0x4091ae
xor ecx, ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0
jb 0x4091ae
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], edx
mov edi, dword [ebp]
mov edx, edi
mov edi, eax
mov esi, dword [ebp - 0x18]
mov si, 0x20
mov esi, dword [ebp - 0x18]
xor esi, esi
mov esi, 0xf
xor dword [ebp - 0x20], 0x44
lea edi, [ebp - 0x1c]
sub dword [ebp - 0x1c], 0xaaaaaa
add dword [ebp - 0x1c], 0xdddd00dd
mov esi, edi
and dword [ebp - 0x1c], 0x33000033
mov edi, ecx
mov dword [ebp - 0x20], eax
mov edi, esi
and dword [ebp - 0x1c], 0x22222222
add dword [ebp - 0x20], 0x666666
xor dword [ebp - 0x20], 0xaa00aa
sub ecx, ecx
lea eax, [ebp - 0x1c]
sub edi, edi
mov edi, dword [ebp]
sub dword [ebp - 0x20], 0x44440044
add dword [ebp - 0x20], 0x222222
mov eax, dword [ebp - 0x1c]
sub edi, edi
xor dword [ebp - 0x20], 0x77
mov ecx, 0
xor edx, edx
and dword [ebp - 0x20], 0xff
cmp dword [ebp - 0x20], ecx
jbe 0x40924c
sub edx, edx
xor ecx, ecx
sub dword [ebp - 0x18], 0x28
push 4
push 0x8000
push 0x800
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov ax, 0x20
mov dword [ebp - 0x20], eax
mov edi, dword [esp]
lea ecx, [ebp]
lea eax, [ebp - 0x20]
lea edi, [esp]
mov dword [ebp - 0x18], ecx
lea edi, [esp]
mov dx, 1
sub dword [ebp - 0x20], 0xffffff
mov edi, edx
lea eax, [ebp - 0x20]
mov edi, dword [esp]
mov dword [ebp - 0x18], edi
sub ecx, ecx
mov eax, 0x24
or dword [ebp - 0x1c], 0xaaaaaa
mov ecx, edx
mov eax, dword [ebp]
mov esi, dword [ebp]
mov dword [ebp - 0x1c], edi
and dword [ebp - 0x20], 0x2222
sub eax, eax
lea edi, [esp]
mov dword [ebp - 0x1c], eax
mov esi, ecx
mov ecx, dword [ebp]
mov ecx, dword [ebp]
xor edx, edx
sub dword [ebp - 0x1c], 0x777777
and dword [ebp - 0x1c], 0xcccc
mov edx, dword [ebp]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
sub edx, edx
sub dword [ebp - 0x1c], 1
xor dword [ebp - 0x1c], 0xffffff
xor edx, edx
mov edx, 0x5e
mov dword [ebp - 0x18], edx
mov edx, 8
cmp edx, 0
jb 0x409306
mov edi, 0
xor edi, edi
xor dword [ebp - 0x1c], 0xffffff
or dword [ebp - 0x1c], 0xff00ff
mov dword [ebp - 0x20], 2
mov ecx, dword [ebp - 0x20]
and dword [ebp - 0x18], 0xffffff
mov dword [ebp - 0x20], ecx
sub dword [ebp - 0x20], 0x10
test ecx, ecx
jae 0x409338
sub edx, edx
sub ecx, ecx
cmp edx, dword [ebp - 0x1c]
jae 0x409338
mov dword [ebp - 0x20], edx
lea edx, [ebp - 0x18]
mov edx, 0x40
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov edi, dword [ebp - 0x20]
mov edi, dword [esp]
mov ecx, dword [esp]
lea edi, [ebp - 0x1c]
lea edi, [ebp]
lea eax, [esp]
lea edi, [ebp]
mov edi, dword [esp]
lea esi, [ebp - 0x18]
add dword [ebp - 0x18], 0xbbbb
lea edi, [esp]
mov esi, dword [ebp]
xor eax, eax
mov edi, 0xc1
mov edx, dword [ebp - 0x18]
add dword [ebp - 0x1c], 0x6666
and dword [ebp - 0x1c], 0x66660066
mov esi, dword [esp]
mov eax, dword [ebp]
or dword [ebp - 0x20], 0x66666666
xor dword [ebp - 0x18], 0x999999
mov ax, 0xe7
lea edx, [ebp]
lea ecx, [ebp]
sub dword [ebp - 0x1c], 0x333333
lea edx, [ebp]
mov dword [ebp - 0x18], ecx
or dword [ebp - 0x20], 0xeeeeee
mov edx, eax
xor ecx, ecx
sub dword [ebp - 0x1c], 0xdd
sub eax, eax
mov edx, 0x20
xor edx, edx
xor edx, edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], 8
mov ecx, pe_nt_image_headers32
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov dword [ebp - 0x1c], eax
mov edx, dword [esp]
mov ecx, dword [esp]
mov dword [ebp - 0x20], eax
lea edi, [esp]
mov esi, dword [esp]
mov eax, 0x3a
mov edi, esi
lea edi, [ebp]
or dword [ebp - 0x20], 0x770077
mov esi, dword [esp]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
add dword [ebp - 0x1c], 0x440044
xor dword [ebp - 0x1c], 0x666666
xor dword [ebp - 0x20], 0x66666666
mov edx, 0x20
mov dword [ebp - 0x1c], 0xea
mov eax, dword [esp]
sub eax, eax
lea ecx, [esp]
and dword [ebp - 0x18], 0xffffffff
sub edx, edx
mov edx, dword [ebp - 0x20]
xor dword [ebp - 0x20], 0xff
or dword [ebp - 0x1c], 0x66006666
mov edx, ecx
lea eax, [ebp - 0x1c]
sub dword [ebp - 0x1c], 0xffff00ff
lea eax, [ebp]
mov eax, edx
xor esi, esi
mov edi, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
sub edx, edx
xor ecx, ecx
and dword [ebp - 0x1c], 0xff
xor dword [ebp - 0x20], 0xff00ff
sub dword [ebp - 0x18], 0xe
add dword [ebp - 0x1c], 0x6e
sub edx, edx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov ecx, dword [ebp]
mov dx, 0xc6
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x1c]
mov ecx, 1
mov ecx, dword [ebp - 0x1c]
lea edi, [esp]
sub dword [ebp - 0x1c], 0x33003333
mov dword [ebp - 0x20], 0x2f
add dword [ebp - 0x18], 0x11111111
mov ecx, dword [esp]
mov si, 0x10
mov ecx, dword [ebp]
mov cx, 0xd
mov ecx, dword [esp]
mov edi, dword [ebp]
or dword [ebp - 0x1c], 0x7777
mov edi, 0x10
xor dword [ebp - 0x18], 0xaa00aaaa
and dword [ebp - 0x18], 0xdd00dd
mov ecx, dword [esp]
lea eax, [ebp]
mov dword [ebp - 0x1c], eax
mov edi, 0
sub dword [ebp - 0x20], 0xdddddd
mov edi, 0x80
mov si, 0x20
or dword [ebp - 0x20], 0xbb
xor dword [ebp - 0x18], 0x222222
mov edi, dword [ebp]
or dword [ebp - 0x1c], 0xbb00bb
mov edx, 0x12c
mov dword [ebp - 0x20], 0x10
xor edx, edx
cmp edx, dword [ebp - 0x1c]
jb 0x40954a
sub dword [ebp - 0x18], 4
mov eax, 0x200
add dword [ebp - 0x18], 0x80
mov edx, 0x2e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], edx
lea edx, [ebp]
mov dword [ebp - 0x20], edx
mov edi, dword [esp]
mov edi, edx
lea esi, [esp]
mov si, 0xb1
or dword [ebp - 0x18], 0x22000022
and dword [ebp - 0x18], 0xeeeeeeee
lea edx, [ebp - 0x20]
mov edi, dword [esp]
xor dword [ebp - 0x1c], 0xffff00ff
mov ecx, dword [esp]
lea esi, [esp]
or dword [ebp - 0x18], 0xbbbb
mov edx, dword [esp]
mov dword [ebp - 0x18], edx
mov esi, 0x20
mov edi, esi
mov dword [ebp - 0x1c], edi
or dword [ebp - 0x1c], 0x440044
mov esi, dword [ebp]
mov ecx, dword [ebp - 0x18]
xor dword [ebp - 0x18], 0xbb
mov dword [ebp - 0x1c], 0x80
mov esi, 0xe6
add dword [ebp - 0x1c], 0x111111
lea edx, [ebp]
sub dword [ebp - 0x1c], 0x88880088
or dword [ebp - 0x1c], 0x440044
or dword [ebp - 0x20], 0x66666666
mov dword [ebp - 0x20], edi
mov ecx, eax
mov eax, 0x200
mov dword [ebp - 0x18], eax
sub eax, eax
and dword [ebp - 0x18], 0xff
cmp eax, 0
je 0x409606
mov ecx, 0x12c
and dword [ebp - 0x20], 0xff
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov dword [ebp - 0x20], eax
mov eax, edi
lea eax, [ebp - 0x1c]
lea esi, [ebp]
lea esi, [ebp]
lea esi, [ebp]
mov eax, dword [ebp - 0x20]
lea edi, [esp]
mov di, 2
mov edi, 8
mov esi, dword [ebp - 0x1c]
mov esi, edx
mov esi, 0xc3
mov edi, dword [ebp - 0x1c]
and dword [ebp - 0x20], 0x888888
sub edx, edx
sub dword [ebp - 0x1c], 0x1111
lea edi, [ebp]
mov dword [ebp - 0x18], 4
mov dx, 0x52
mov ecx, dword [ebp]
or dword [ebp - 0x1c], 0x66
xor eax, eax
mov esi, dword [esp]
mov edx, dword [ebp - 0x20]
mov edx, dword [ebp]
and dword [ebp - 0x20], 0xffff
mov edi, dword [ebp - 0x18]
mov edi, esi
mov ecx, esi
add dword [ebp - 0x1c], 0x55550055
lea edi, [ebp - 0x20]
xor dword [ebp - 0x20], 0x444444
mov eax, dword [esp]
mov ecx, dword [ebp - 0x1c]
sub dword [ebp - 0x18], 1
xor eax, eax
xor ecx, ecx
and dword [ebp - 0x1c], 0xff
sub dword [ebp - 0x20], 0x10
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov dx, 0x20
mov edx, edi
mov edx, dword [esp]
lea edi, [ebp - 0x18]
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
mov edx, dword [esp]
lea ecx, [ebp]
mov eax, dword [ebp - 0x20]
or dword [ebp - 0x20], 0x88880088
mov edi, dword [ebp - 0x18]
mov ecx, eax
lea eax, [ebp]
and dword [ebp - 0x1c], 0xee00eeee
xor dword [ebp - 0x20], 0xaa00aaaa
or dword [ebp - 0x18], 0xaaaa
mov edi, ecx
mov edx, dword [ebp]
lea esi, [esp]
mov ax, 1
and dword [ebp - 0x20], 0x777777
mov ecx, dword [esp]
or dword [ebp - 0x1c], 0x99990099
or dword [ebp - 0x20], 0x22222222
lea edi, [ebp - 0x20]
mov dword [ebp - 0x18], edx
xor edi, edi
xor dword [ebp - 0x20], 0xaa0000aa
or dword [ebp - 0x20], 0x11000011
mov cx, 0x80
mov edi, 8
lea edx, [ebp - 0x1c]
sub edx, edx
xor ecx, ecx
and dword [ebp - 0x18], 0xff
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov dword [ebp - 0x1c], eax
mov edi, 8
lea edi, [ebp - 0x1c]
lea edi, [ebp]
mov edi, esi
mov esi, dword [ebp]
mov di, 0x5f
mov si, 0xdc
and dword [ebp - 0x1c], 0x22220022
and dword [ebp - 0x18], 0xaa00aaaa
mov edx, dword [ebp - 0x18]
xor dword [ebp - 0x1c], 0x99009999
lea esi, [esp]
sub edi, edi
mov esi, edx
xor dword [ebp - 0x1c], 0xaaaaaaaa
and dword [ebp - 0x18], 0x77777777
mov edi, dword [ebp]
lea edi, [esp]
sub edi, edi
sub dword [ebp - 0x1c], 0xdddd00dd
add dword [ebp - 0x18], 0xaaaa
or dword [ebp - 0x20], 0x555555
or dword [ebp - 0x1c], 0x1111
and dword [ebp - 0x1c], 0xaa00aa
and dword [ebp - 0x20], 0x220022
lea edx, [esp]
add dword [ebp - 0x18], 0x666666
mov di, 0x20
mov ecx, dword [ebp - 0x20]
xor dword [ebp - 0x1c], 0xffff
mov dword [ebp - 0x20], 0x80
cmp dword [ebp - 0x18], ecx
je 0x4097ef
mov eax, 0
cmp ecx, dword [ebp - 0x1c]
jbe 0x4097ef
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, dword [ebp - 0x1c]
lea esi, [esp]
mov edx, edi
mov edi, 0x8b
lea edx, [esp]
mov ecx, dword [esp]
mov esi, dword [esp]
mov eax, dword [ebp]
xor esi, esi
lea edi, [ebp - 0x20]
sub eax, eax
lea edi, [ebp - 0x18]
sub edi, edi
and dword [ebp - 0x1c], 0x9999
and dword [ebp - 0x20], 0x55555555
add dword [ebp - 0x1c], 0x330033
mov edi, dword [ebp]
mov edi, dword [ebp]
or dword [ebp - 0x1c], 0xaa
mov ecx, edi
mov dword [ebp - 0x1c], ecx
and dword [ebp - 0x18], 0xff0000ff
mov edi, 0xa9
mov esi, dword [esp]
xor dword [ebp - 0x1c], 0xeeee
lea ecx, [ebp - 0x1c]
mov dx, 0x30
mov ecx, edx
xor dword [ebp - 0x18], 0x44004444
mov edi, dword [esp]
xor dword [ebp - 0x20], 0x44000044
mov ecx, edx
and dword [ebp - 0x20], 0x22000022
mov eax, 0xc8
and dword [ebp - 0x1c], 0xff
lea eax, [ebp - 0x20]
xor eax, eax
cmp eax, dword [ebp - 0x20]
jbe 0x40989a
mov edx, 0x12c
cmp edx, 0
jae 0x40989a
and dword [ebp - 0x18], 0xffffff
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov edx, edi
mov ecx, esi
mov edx, dword [esp]
lea edi, [esp]
mov esi, dword [ebp]
mov eax, 0x38
lea edi, [ebp]
mov edi, edx
and dword [ebp - 0x18], 0x55005555
mov edx, dword [esp]
sub dword [ebp - 0x1c], 0xbbbbbbbb
lea ecx, [ebp - 0x1c]
mov si, 0x10
lea edi, [ebp - 0x18]
sub dword [ebp - 0x1c], 0x440044
mov dword [ebp - 0x20], 0x80
mov ecx, dword [esp]
lea esi, [esp]
and dword [ebp - 0x18], 0x22222222
xor dword [ebp - 0x18], 0xdddd
mov ecx, dword [esp]
xor edi, edi
xor edi, edi
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], esi
sub dword [ebp - 0x18], 0x55555555
mov si, 0x20
mov edx, dword [ebp - 0x1c]
lea edx, [ebp - 0x1c]
sub edx, edx
sub dword [ebp - 0x18], 2
mov dx, 3
test edx, edx
jbe 0x40993a
mov ecx, 0x300
xor ecx, ecx
and dword [ebp - 0x1c], 0xffff
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [ebp]
lea edx, [ebp]
lea edi, [ebp - 0x18]
lea edi, [ebp - 0x20]
mov dword [ebp - 0x20], edx
mov eax, 0x5b
mov edx, dword [ebp]
mov cx, 0xa5
xor dword [ebp - 0x18], 0xee00eeee
or dword [ebp - 0x1c], 0x77
mov edi, dword [esp]
xor dword [ebp - 0x20], 0xcccc
mov edi, dword [ebp - 0x20]
lea edi, [esp]
xor edi, edi
mov dword [ebp - 0x20], esi
xor dword [ebp - 0x20], 0x88880088
mov dword [ebp - 0x20], 1
xor edi, edi
mov esi, dword [ebp]
mov esi, edi
xor edi, edi
mov ecx, dword [ebp]
sub dword [ebp - 0x1c], 0x44444444
xor dword [ebp - 0x20], 0xcccc00cc
and dword [ebp - 0x20], 0x880088
and dword [ebp - 0x18], 0xbb
mov dword [ebp - 0x20], 0x80
mov edx, dword [ebp]
sub ecx, ecx
add dword [ebp - 0x20], 0x80
test ecx, ecx
jne 0x4099e5
xor eax, eax
and dword [ebp - 0x1c], 0xff
mov dword [ebp - 0x20], 0x47
xor ecx, ecx
cmp eax, 0xec5
jb 0x4099e5
lea ecx, [ebp - 0x1c]
lea ecx, [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, esi
mov edi, dword [ebp]
lea edi, [ebp - 0x1c]
lea esi, [ebp]
lea esi, [esp]
mov ecx, edi
mov edx, dword [ebp]
mov edi, 2
mov edi, dword [ebp]
sub dword [ebp - 0x1c], 0x99009999
and dword [ebp - 0x18], 0xaaaa00aa
mov edx, dword [ebp]
mov ecx, dword [esp]
and dword [ebp - 0x1c], 0x3333
mov edx, 0xa2
add dword [ebp - 0x18], 0x11110011
mov edi, dword [ebp - 0x1c]
and dword [ebp - 0x1c], 0x99990099
lea esi, [ebp - 0x1c]
lea edi, [ebp]
sub eax, eax
lea eax, [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, edi
mov dx, 0x6a
and dword [ebp - 0x20], 0x5555
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov ecx, 0xec
mov edi, 0x5f
xor dword [ebp - 0x1c], 0x3333
mov ecx, 0
xor edx, edx
sub ecx, ecx
mov cx, 0x2a
mov edx, dword [ebp - 0x20]
lea esi, [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp]
mov eax, esi
mov di, 0xf9
lea edi, [ebp]
mov esi, dword [esp]
mov edi, ecx
mov edi, esi
mov esi, dword [esp]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
add dword [ebp - 0x18], 0x22000022
lea eax, [esp]
mov dword [ebp - 0x20], 2
xor dword [ebp - 0x18], 0x9999
mov edi, ecx
add dword [ebp - 0x20], 0x55555555
mov edx, edi
mov dword [ebp - 0x20], 1
sub dword [ebp - 0x1c], 0xaa
xor dword [ebp - 0x1c], 0x66660066
lea ecx, [ebp]
mov edi, 0x4e
lea edx, [ebp]
or dword [ebp - 0x1c], 0x88888888
mov edx, dword [ebp]
mov ecx, dword [ebp]
lea eax, [esp]
xor dword [ebp - 0x18], 0x333333
add dword [ebp - 0x1c], 0xaa00aa
lea edx, [ebp]
mov ecx, dword [ebp]
add dword [ebp - 0x20], 0xbbbb
and dword [ebp - 0x1c], 0xdddddddd
xor ecx, ecx
mov cx, 0x60
add dword [ebp - 0x20], 0x7b
lea ecx, [ebp - 0x1c]
cmp ecx, 0x2d
jb 0x409b37
mov edx, dword [ebp - 0x20]
mov edx, 0x5c
mov dword [ebp - 0x1c], ecx
mov edx, 0x19
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov eax, edi
mov edi, dword [ebp]
mov edi, dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
mov eax, 0x15
mov eax, 0xce
lea edx, [esp]
mov eax, dword [ebp - 0x1c]
mov ecx, eax
xor esi, esi
add dword [ebp - 0x1c], 0xdd0000dd
mov ecx, 0x90
xor dword [ebp - 0x18], 0xeeee00ee
mov esi, dword [ebp]
and dword [ebp - 0x20], 0x330033
and dword [ebp - 0x1c], 0xeeeeee
mov edi, dword [ebp - 0x1c]
lea esi, [esp]
xor edi, edi
xor dword [ebp - 0x18], 0x88888888
mov eax, dword [ebp]
lea ecx, [esp]
mov dword [ebp - 0x1c], 0x7c
lea edx, [ebp - 0x18]
sub ecx, ecx
xor edi, edi
mov ecx, esi
mov dx, 8
xor edx, edx
mov edi, dword [ebp]
mov dword [ebp - 0x20], 0x5e
lea edx, [ebp - 0x1c]
add dword [ebp - 0x1c], 0xdd00dd
sub dword [ebp - 0x1c], 0x2222
mov edx, pe_nt_image_headers32
and dword [ebp - 0x20], 0xff
and dword [ebp - 0x18], 0xffffff
xor eax, eax
mov dword [ebp - 0x20], 0x80
or dword [ebp - 0x18], 0xff
lea esi, [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea ecx, [esp]
lea edi, [ebp]
lea esi, [esp]
lea eax, [esp]
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp]
mov edx, dword [esp]
mov esi, 2
sub dword [ebp - 0x18], 0x110011
add dword [ebp - 0x18], 0xee
mov dx, 0x40
sub dword [ebp - 0x1c], 0xff00ff
sub eax, eax
or dword [ebp - 0x20], 0x444444
mov dword [ebp - 0x20], 8
add dword [ebp - 0x18], 0x1111
mov edi, dword [ebp - 0x18]
xor edi, edi
lea ecx, [ebp]
mov eax, dword [ebp]
lea ecx, [ebp - 0x18]
sub ecx, ecx
and dword [ebp - 0x20], 0x440044
mov edi, dword [esp]
xor dword [ebp - 0x20], 0x33003333
mov edi, 0x80
lea eax, [ebp]
mov edx, 2
mov edx, edi
mov si, 0x90
sub eax, eax
xor eax, eax
xor dword [ebp - 0x18], 0xbbbbbb
xor edx, edx
xor dword [ebp - 0x1c], 0xffffff
lea edx, [ebp - 0x18]
cmp edx, 0x20
ja 0x409cad
xor ecx, ecx
mov dword [ebp - 0x1c], 0x80
and dword [ebp - 0x18], 0xffff
or dword [ebp - 0x20], 0xff00ff
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [ebp - 0x1c]
lea esi, [ebp - 0x1c]
mov edi, eax
mov dx, 0x20
lea esi, [ebp - 0x20]
mov ecx, edx
lea ecx, [esp]
mov edx, 2
sub edx, edx
mov edx, dword [ebp]
mov esi, dword [esp]
mov eax, dword [esp]
lea eax, [ebp]
mov edx, dword [esp]
lea esi, [ebp - 0x20]
add dword [ebp - 0x1c], 0x88000088
mov edi, dword [ebp - 0x20]
and dword [ebp - 0x1c], 0x555555
xor dword [ebp - 0x18], 0x110011
xor edi, edi
xor edx, edx
or dword [ebp - 0x1c], 0x66660066
lea edi, [esp]
lea eax, [ebp]
mov edx, 0xfb
xor eax, eax
mov cx, 0xf3
and dword [ebp - 0x20], 0x7777
xor eax, eax
xor eax, eax
mov eax, 0xa
add dword [ebp - 0x1c], 8
cmp eax, dword [ebp - 0x20]
jne 0x409d3c
mov dword [ebp - 0x1c], eax
mov ecx, 0xc8
or dword [ebp - 0x18], 0xff00ff
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea edi, [ebp]
mov dword [ebp - 0x1c], edi
lea esi, [ebp]
mov edi, dword [esp]
mov edx, 4
mov edx, eax
mov edx, dword [ebp]
mov di, 4
mov dword [ebp - 0x20], ecx
add dword [ebp - 0x18], 0x110011
and dword [ebp - 0x1c], 0x88880088
mov edi, dword [ebp - 0x18]
and dword [ebp - 0x20], 0x660066
or dword [ebp - 0x20], 0x66000066
mov edi, dword [esp]
lea edi, [esp]
add dword [ebp - 0x18], 0xcccccc
sub dword [ebp - 0x20], 0xff00ff
sub dword [ebp - 0x18], 0xffff00ff
mov edi, esi
lea edi, [ebp]
and dword [ebp - 0x20], 0x4444
lea edx, [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
and dword [ebp - 0x1c], 0x11111111
or dword [ebp - 0x1c], 0xbb
lea edx, [esp]
and dword [ebp - 0x20], 0xeeee
add dword [ebp - 0x18], 0x66
lea edx, [ebp]
sub eax, eax
lea eax, [ebp - 0x1c]
and dword [ebp - 0x18], 0xffff
test eax, eax
je 0x409ded
mov ecx, 0x200
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], 6
test eax, eax
je 0x409ded
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov eax, dword [ebp]
mov eax, 2
mov di, 0x84
mov eax, 0x6d
lea ecx, [ebp]
lea eax, [esp]
lea ecx, [ebp]
mov dword [ebp - 0x18], esi
mov edx, 0xfb
mov edx, dword [ebp]
and dword [ebp - 0x20], 0xaa00aaaa
or dword [ebp - 0x1c], 0xaa00aa
and dword [ebp - 0x1c], 0x77770077
lea edi, [esp]
mov dword [ebp - 0x1c], edi
add dword [ebp - 0x18], 0xcc0000cc
mov edx, dword [esp]
lea edi, [ebp - 0x20]
and dword [ebp - 0x1c], 0x8888
mov edi, dword [esp]
mov di, 4
sub esi, esi
mov edx, dword [ebp]
mov ecx, eax
mov eax, dword [ebp - 0x1c]
mov esi, dword [esp]
or dword [ebp - 0x1c], 0x3333
mov eax, dword [ebp - 0x20]
lea esi, [esp]
sub dword [ebp - 0x18], 0x44000044
sub dword [ebp - 0x18], 0xff00ffff
mov dword [ebp - 0x18], ecx
mov di, 0xf7
mov edi, dword [ebp]
xor ecx, ecx
mov ecx, 2
and dword [ebp - 0x20], 0xff
cmp dword [ebp - 0x1c], ecx
ja 0x409e9a
sub eax, eax
cmp ecx, 0
jb 0x409e9a
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov di, 4
mov di, 0x80
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edi
lea edx, [esp]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x1c]
mov esi, ecx
lea eax, [esp]
mov edi, 8
mov di, 0x59
mov edx, 0xe
sub edi, edi
mov dword [ebp - 0x20], 4
lea esi, [ebp]
mov dword [ebp - 0x18], eax
and dword [ebp - 0x20], 0x220022
mov cx, 4
and dword [ebp - 0x1c], 0x6666
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0x1c], 0x4444
lea eax, [esp]
mov dword [ebp - 0x1c], 0x9a
and dword [ebp - 0x1c], 0x8888
mov ecx, dword [esp]
mov eax, dword [esp]
xor dword [ebp - 0x1c], 0x33330033
mov dword [ebp - 0x18], 2
sub ecx, ecx
sub ecx, ecx
cmp ecx, dword [ebp - 0x20]
ja 0x409f3e
mov edx, 0
mov dword [ebp - 0x18], 4
cmp ecx, 0
jne 0x409f3e
and dword [ebp - 0x1c], 0xffff
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov dword [ebp - 0x20], eax
mov edi, 0x20
mov edx, dword [ebp]
mov esi, dword [ebp]
mov eax, dword [ebp]
mov dword [ebp - 0x18], edi
lea ecx, [esp]
mov esi, dword [ebp - 0x20]
mov edx, 0x7a
add dword [ebp - 0x18], 0xbbbb00bb
or dword [ebp - 0x18], 0x22002222
mov di, 4
mov ecx, dword [esp]
lea edi, [ebp]
and dword [ebp - 0x20], 0xff00ffff
or dword [ebp - 0x18], 0xcccccccc
and dword [ebp - 0x20], 0x88888888
mov esi, dword [ebp]
mov edx, dword [esp]
and dword [ebp - 0x1c], 0x111111
mov esi, dword [ebp]
lea esi, [esp]
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0x1c], 0xcc0000cc
lea ecx, [ebp - 0x18]
xor esi, esi
mov si, 0x3a
mov dword [ebp - 0x20], 0x20
mov si, 0x1a
sub edi, edi
and dword [ebp - 0x1c], 0xff00ff
mov eax, dword [ebp - 0x18]
mov ax, 0x2f
mov eax, 0x36
xor eax, eax
cmp eax, dword [ebp - 0x18]
ja 0x409ff0
xor edx, edx
and dword [ebp - 0x20], 0xff
cmp eax, 0
jb 0x409ff0
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov edx, dword [esp]
lea eax, [ebp]
mov esi, dword [ebp - 0x18]
mov edi, 0xf9
mov ax, 0x20
mov edi, 0x40
lea edi, [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
lea edx, [esp]
mov dword [ebp - 0x20], 1
mov eax, dword [esp]
sub eax, eax
or dword [ebp - 0x20], 0x88000088
and dword [ebp - 0x20], 0x555555
sub dword [ebp - 0x18], 0xaa00aa
mov edx, dword [ebp - 0x18]
xor dword [ebp - 0x18], 0x333333
mov edi, 1
xor ecx, ecx
xor esi, esi
mov dword [ebp - 0x18], eax
mov ecx, edi
lea eax, [ebp - 0x18]
sub edi, edi
lea edi, [esp]
xor ecx, ecx
lea edx, [ebp]
sub dword [ebp - 0x18], 0x88
and dword [ebp - 0x1c], 0x99999999
add dword [ebp - 0x18], 0xee0000ee
mov esi, 2
mov edx, dword [ebp - 0x1c]
add dword [ebp - 0x20], 0x6b
add dword [ebp - 0x20], 0x2a
xor edx, edx
xor eax, eax
or dword [ebp - 0x1c], 0xffffff
lea eax, [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea edx, [ebp]
mov ecx, esi
mov edx, eax
lea eax, [ebp]
mov ecx, dword [ebp]
mov cx, 0x6b
mov dx, 0x95
mov ecx, dword [esp]
mov edi, esi
lea eax, [esp]
and dword [ebp - 0x18], 0xcc00cccc
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add dword [ebp - 0x20], 0xbbbbbb
mov esi, edi
mov dword [ebp - 0x1c], 0xba
lea ecx, [esp]
lea esi, [esp]
lea edx, [esp]
or dword [ebp - 0x18], 0xffffff
mov eax, dword [esp]
mov edx, dword [ebp]
lea edx, [ebp]
and dword [ebp - 0x20], 0xee00eeee
xor edi, edi
mov edx, eax
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 0x18], 2
lea esi, [esp]
and dword [ebp - 0x1c], 0xbb00bb
lea edx, [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
mov ecx, 8
cmp dword [ebp - 0x1c], ecx
ja 0x40a131
xor eax, eax
or dword [ebp - 0x18], 0xff00ff
cmp eax, 0x71c
ja 0x40a131
mov dword [ebp - 0x1c], 0x3f
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov edi, dword [ebp]
lea ecx, [ebp]
mov ecx, 8
mov edx, dword [esp]
mov esi, edi
mov edx, dword [esp]
lea ecx, [esp]
mov ecx, 4
mov edi, dword [ebp]
mov eax, 0xee
xor eax, eax
xor dword [ebp - 0x20], 0x110011
lea eax, [esp]
lea esi, [ebp - 0x18]
lea edi, [esp]
mov dword [ebp - 0x20], 0x69
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x20]
xor edi, edi
mov esi, edx
xor dword [ebp - 0x18], 0xaa00aaaa
sub esi, esi
mov eax, dword [esp]
mov dword [ebp - 0x18], edi
lea esi, [esp]
and dword [ebp - 0x20], 0x111111
and dword [ebp - 0x1c], 0x77770077
lea edx, [ebp]
mov dword [ebp - 0x18], edi
and dword [ebp - 0x1c], 0x660066
mov esi, dword [ebp]
sub eax, eax
lea eax, [ebp - 0x18]
xor dword [ebp - 0x1c], 0xffffff
and dword [ebp - 0x20], 0xffffff
cmp eax, 0x93
jb 0x40a1eb
mov edx, 0xc8
mov dword [ebp - 0x1c], 1
mov edx, 0x2f
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov edi, ecx
lea edx, [esp]
mov si, 0xd6
lea edi, [ebp - 0x1c]
mov di, 0x80
mov edi, dword [ebp - 0x1c]
lea eax, [esp]
mov edi, ecx
xor eax, eax
sub dword [ebp - 0x20], 0xbbbb00bb
or dword [ebp - 0x20], 0xee0000ee
lea edi, [ebp]
lea esi, [ebp]
mov esi, dword [esp]
sub ecx, ecx
and dword [ebp - 0x18], 0x11001111
sub dword [ebp - 0x18], 0x88880088
mov esi, dword [esp]
sub dword [ebp - 0x18], 0x660066
xor eax, eax
mov dword [ebp - 0x20], eax
and dword [ebp - 0x1c], 0x77770077
xor dword [ebp - 0x18], 0xffffff
or dword [ebp - 0x18], 0x66660066
mov dword [ebp - 0x20], 0x20
mov ecx, dword [ebp - 0x18]
mov si, 0xd8
mov dword [ebp - 0x1c], edi
mov edx, dword [esp]
lea edx, [ebp - 0x1c]
mov edi, 0x58
xor edx, edx
cmp edx, 0
jb 0x40a295
mov ecx, 0x12c
sub ecx, ecx
cmp dword [ebp - 0x18], edx
ja 0x40a295
and dword [ebp - 0x18], 0xffff
and dword [ebp - 0x20], 0xff00ff
xor edx, edx
xor edx, edx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp]
mov edi, dword [ebp]
lea edi, [ebp - 0x18]
lea eax, [ebp - 0x20]
mov eax, edi
mov edi, dword [ebp]
mov di, 0x40
mov edx, dword [esp]
lea edi, [ebp]
mov eax, edx
and dword [ebp - 0x20], 0x99
sub dword [ebp - 0x1c], 0x550055
mov dword [ebp - 0x20], ecx
add dword [ebp - 0x1c], 0x11000011
mov si, 2
xor eax, eax
mov edx, edi
mov ax, 0xf
xor dword [ebp - 0x18], 0xee00ee
mov edx, esi
mov ecx, dword [ebp - 0x1c]
mov di, 0x40
and dword [ebp - 0x20], 0xcccccc
mov ax, 0x40
mov eax, dword [ebp]
and dword [ebp - 0x18], 0xffff
sub dword [ebp - 0x20], 0xeeeeeeee
lea edi, [esp]
xor dword [ebp - 0x20], 0x333333
mov edx, dword [esp]
mov ecx, dword [esp]
sub edx, edx
mov eax, 2
sub eax, eax
mov ax, 0x3b
or dword [ebp - 0x20], 0xffffff
and dword [ebp - 0x20], 0xff
add dword [ebp - 0x20], 0x6b
mov eax, 0x64
mov ax, 0x59
mov dx, 2
mov edx, 0x59
or dword [ebp - 0x20], 0xffffff
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov edx, 0x20
lea esi, [ebp - 0x18]
mov esi, dword [ebp]
mov esi, dword [ebp - 0x1c]
lea eax, [ebp]
mov eax, 0x40
mov dword [ebp - 0x18], edi
lea eax, [ebp]
mov dword [ebp - 0x18], 0x32
mov eax, dword [esp]
and dword [ebp - 0x18], 0xdddd00dd
mov edi, ecx
xor edx, edx
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x18], edi
and dword [ebp - 0x1c], 0x22
and dword [ebp - 0x1c], 0xeeee
mov di, 0x2c
lea edi, [esp]
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0x18], 0xeeeeee
mov esi, 7
mov eax, esi
xor edx, edx
add dword [ebp - 0x20], 0x77777777
and dword [ebp - 0x20], 0x11001111
xor esi, esi
add dword [ebp - 0x1c], 0x33330033
mov eax, ecx
mov edi, edx
and dword [ebp - 0x18], 0x55555555
add dword [ebp - 0x20], 0x770077
mov ecx, 0
sub ecx, ecx
and dword [ebp - 0x20], 0xffff
mov edx, 0
xor edx, edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov edi, ecx
mov esi, eax
mov edi, dword [ebp]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp]
mov dword [ebp - 0x20], edx
mov edi, edx
mov edi, dword [esp]
lea esi, [esp]
add dword [ebp - 0x20], 0x333333
lea ecx, [esp]
mov dword [ebp - 0x20], 0x2a
lea eax, [ebp]
mov esi, dword [ebp - 0x20]
or dword [ebp - 0x1c], 0x55005555
lea ecx, [ebp - 0x18]
mov esi, dword [ebp]
mov si, 0x5b
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp]
mov eax, 0x6b
lea eax, [ebp - 0x18]
mov edi, 0x31
lea edi, [ebp]
and dword [ebp - 0x1c], 0x3333
mov ecx, dword [ebp - 0x20]
and dword [ebp - 0x18], 0x33003333
lea esi, [ebp]
sub eax, eax
mov dword [ebp - 0x18], edx
or dword [ebp - 0x18], 0xff
cmp dword [ebp - 0x20], eax
je 0x40a48f
mov edx, 0x300
mov dword [ebp - 0x1c], edx
cmp eax, dword [ebp - 0x20]
ja 0x40a491
add dword [ebp - 0x18], 0x31
sub edx, edx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea edi, [ebp]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [esp]
mov dword [ebp - 0x18], eax
mov edi, ecx
mov edi, dword [ebp]
mov eax, dword [esp]
mov ecx, edi
and dword [ebp - 0x1c], 0x88888888
and dword [ebp - 0x18], 0x9999
and dword [ebp - 0x1c], 0x990099
xor dword [ebp - 0x1c], 0x66000066
mov ax, 0xd6
mov edx, dword [ebp]
mov ecx, 0x40
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0x20], 0x22
sub dword [ebp - 0x20], 0x66660066
and dword [ebp - 0x20], 0xff00ff
mov ecx, edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x1c], 0x22002222
mov edx, dword [ebp]
sub eax, eax
and dword [ebp - 0x20], 0xdddddddd
and dword [ebp - 0x20], 0x66660066
add dword [ebp - 0x20], 0xcc00cccc
and dword [ebp - 0x20], 0x55550055
xor dword [ebp - 0x20], 0xdddddddd
mov ecx, dword [ebp - 0x18]
lea edx, [esp]
mov esi, ecx
mov eax, 0x64
sub dword [ebp - 0x20], 0x2c
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x18], edx
xor dword [ebp - 0x18], 0xff00ff
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov dword [ebp - 0x18], eax
mov edx, edi
mov ecx, 8
mov esi, edx
mov esi, 0x95
lea edi, [ebp - 0x18]
mov eax, edx
mov dx, 0x9f
mov edx, 0x69
mov eax, esi
or dword [ebp - 0x18], 0xffffff
lea eax, [ebp]
mov ecx, dword [esp]
lea ecx, [esp]
mov dword [ebp - 0x20], 0x80
and dword [ebp - 0x18], 0xeeee00ee
mov di, 0x10
add dword [ebp - 0x18], 0x22002222
lea edi, [ebp - 0x18]
sub dword [ebp - 0x18], 0x330033
mov eax, dword [esp]
and dword [ebp - 0x18], 0x33003333
sub eax, eax
mov eax, dword [ebp - 0x18]
and dword [ebp - 0x20], 0x99009999
xor dword [ebp - 0x20], 0xeeee00ee
xor dword [ebp - 0x18], 0x77777777
and dword [ebp - 0x20], 0xdddd00dd
xor ecx, ecx
and dword [ebp - 0x1c], 0x77007777
sub ecx, ecx
mov esi, dword [ebp - 0x20]
sub edx, edx
xor eax, eax
and dword [ebp - 0x20], 0xffff
cmp eax, dword [ebp - 0x18]
jne 0x40a5ff
lea edx, [ebp - 0x1c]
sub edx, edx
or dword [ebp - 0x1c], 0xff
mov eax, 8
and dword [ebp - 0x1c], 0xffffff
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x20]
mov esi, dword [esp]
mov si, 0x4d
lea edi, [ebp - 0x18]
lea edx, [ebp]
mov dword [ebp - 0x20], edi
mov di, 0x20
mov ax, 0xe5
mov dword [ebp - 0x1c], 0x10
lea edx, [ebp]
and dword [ebp - 0x18], 0x444444
sub eax, eax
mov cx, 0x3e
sub dword [ebp - 0x20], 0xcc0000cc
mov ecx, dword [ebp]
sub ecx, ecx
mov eax, 2
add dword [ebp - 0x20], 0x33000033
mov dword [ebp - 0x20], edi
mov si, 0x40
or dword [ebp - 0x18], 0xff
mov di, 8
or dword [ebp - 0x18], 0xdd00dd
or dword [ebp - 0x1c], 0x5555
lea edi, [esp]
mov dword [ebp - 0x20], 0x98
xor edx, edx
and dword [ebp - 0x18], 0xffffff
sub dword [ebp - 0x1c], 0x51
cmp edx, 0
je 0x40a698
mov ecx, 0
xor ecx, ecx
mov ecx, 0x70
sub ecx, ecx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea edi, [esp]
mov edx, dword [esp]
lea eax, [esp]
mov edi, dword [esp]
mov dword [ebp - 0x18], edx
mov ecx, dword [esp]
mov edi, dword [esp]
mov esi, edi
lea edi, [esp]
mov dword [ebp - 0x18], 0x10
mov edi, dword [esp]
lea ecx, [ebp - 0x1c]
sub dword [ebp - 0x20], 0xeeee00ee
mov esi, dword [ebp - 0x20]
mov edi, edx
and dword [ebp - 0x1c], 0xcc
mov esi, 0x80
or dword [ebp - 0x1c], 0x22000022
mov dword [ebp - 0x18], 4
mov ecx, dword [esp]
mov edi, edx
mov edx, dword [ebp]
lea eax, [ebp]
xor dword [ebp - 0x18], 0xee00ee
mov dword [ebp - 0x1c], 0x76
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0x5d
xor ecx, ecx
lea edi, [ebp]
xor dword [ebp - 0x20], 0x99000099
mov ecx, dword [ebp - 0xc]
xor eax, eax
xor dword [ebp - 0x20], 0xffffff
test eax, eax
ja 0x40a748
xor esi, esi
cmp eax, 0
je 0x40a748
mov ax, 0x80
xor eax, eax
or dword [ebp - 0x18], 0xff
sub eax, eax
mov eax, 0x41
and dword [ebp - 0x1c], 0xffff
mov dword [ebp - 0x20], 1
add dword [ebp - 0x18], 0x80
test eax, eax
jb 0x40a77e
mov esi, 0
lea esi, [ebp - 0x1c]
or dword [ebp - 0x20], 0xffff
mov dword [ebp - 0x1c], esi
mov si, 0x45
inc dword [ebp - 0xc]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x1c]
jbe 0x40a7ab
lea esi, [ebp - 0x18]
or dword [ebp - 0x18], 0xffff
and dword [ebp - 0x20], 0xffffff
mov esi, 0xc8
and dword [ebp - 0x20], 0xffffff
lea eax, [ebp - 0x20]
mov edx, 0
sub edx, 0x8a00e78b
xor eax, eax
mov ax, 0x40
xor eax, eax
and dword [ebp - 0x1c], 0xffff
xor esi, esi
xor eax, eax
xor edx, dword [ecx]
test edx, edx
jne 0x4092e4
mov eax, 0
or dword [ebp - 0x20], 0xff00ff
sub eax, eax
and dword [ebp - 0x20], 0xffffff
mov dword [ebp - 0x20], eax
cmp eax, 0
je 0x40a803
sub edx, edx
cmp edx, dword [ebp - 0x1c]
jbe 0x40a803
mov eax, 0x80
or dword [ebp - 0x18], 0xffff
lea esi, [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov esi, dword [esp]
lea esi, [esp]
mov si, 0x80
mov dx, 4
lea eax, [esp]
mov eax, ecx
mov ecx, 0x81
mov edx, 2
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x20
lea ecx, [ebp]
sub ecx, ecx
and dword [ebp - 0x20], 0x11000011
mov dword [ebp - 0x20], ecx
add dword [ebp - 0x18], 0xbbbbbb
and dword [ebp - 0x20], 0xdddddddd
lea esi, [ebp - 0x1c]
lea esi, [esp]
mov esi, dword [esp]
lea edi, [esp]
lea eax, [ebp]
or dword [ebp - 0x18], 0x77000077
xor edi, edi
xor edx, edx
xor eax, eax
sub eax, eax
lea edx, [ebp]
sub edi, edi
and dword [ebp - 0x1c], 0xdddddddd
mov edx, dword [ebp - 0x1c]
add dword [ebp - 0x1c], 0x4c
mov eax, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
sub ecx, ecx
and dword [ebp - 0x18], 0xff
add dword [ebp - 0x1c], 0x20
test ecx, ecx
je 0x40a8a2
xor eax, eax
xor dword [ebp - 0x1c], 0xff00ff
lea eax, [ebp - 0x18]
push 4
push 0x4000
push 0x600
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov cx, 0x40
lea eax, [esp]
mov di, 0x1c
mov esi, dword [ebp - 0x18]
mov edi, 0xe7
mov edi, dword [esp]
mov esi, ecx
lea edi, [esp]
mov edx, 0x2d
mov edx, 1
mov eax, 0xd0
mov ecx, 4
sub ecx, ecx
mov edi, dword [ebp - 0x1c]
lea ecx, [esp]
mov cx, 0x10
xor dword [ebp - 0x20], 0xbbbb
mov edi, edx
mov edx, dword [esp]
lea eax, [esp]
xor dword [ebp - 0x20], 0x44000044
xor dword [ebp - 0x20], 0x770077
and dword [ebp - 0x18], 0x22002222
mov edx, ecx
and dword [ebp - 0x1c], 0x88008888
mov dword [ebp - 0x18], edi
mov cx, 0x10
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], ecx
sub dword [ebp - 0x1c], 0x7777
lea ecx, [ebp]
sub esi, esi
mov eax, esi
mov dword [ebp - 0x20], edi
mov eax, 0xc8
lea eax, [ebp - 0x18]
test eax, eax
jae 0x40a960
sub edx, edx
and dword [ebp - 0x18], 0xffffff
cmp eax, dword [ebp - 0x1c]
jbe 0x40a960
xor dword [ebp - 0x20], 0xff
call dword [sym.imp.KERNEL32.DLL_GetACP]
lea esi, [ebp]
mov ecx, dword [ebp]
mov edi, dword [ebp - 0x18]
mov esi, 0x20
mov dword [ebp - 0x20], ecx
mov esi, 0x20
mov dword [ebp - 0x1c], edi
mov ecx, esi
sub edx, edx
mov esi, dword [ebp - 0x1c]
mov ecx, 8
sub dword [ebp - 0x20], 0xbbbbbbbb
mov dword [ebp - 0x20], ecx
or dword [ebp - 0x18], 0xee00eeee
xor edi, edi
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], 0xe1
add dword [ebp - 0x18], 0x99009999
and dword [ebp - 0x18], 0x66000066
mov edi, dword [ebp - 0x18]
mov eax, dword [esp]
mov dx, 1
lea edi, [esp]
mov edi, edx
or dword [ebp - 0x20], 0x88008888
lea edi, [ebp]
lea edi, [ebp - 0x18]
mov ax, 0x1c
lea edi, [ebp]
sub eax, eax
and dword [ebp - 0x1c], 0xee00eeee
and dword [ebp - 0x20], 0x11001111
mov ecx, eax
and dword [ebp - 0x20], 0xffffffff
mov eax, 0xc8
sub edx, edx
call dword [sym.imp.KERNEL32.DLL_GetACP]
lea esi, [esp]
mov cx, 0x6b
lea edi, [esp]
mov ecx, dword [ebp]
lea esi, [esp]
lea edi, [ebp - 0x1c]
lea ecx, [ebp - 0x20]
lea eax, [ebp - 0x18]
lea eax, [ebp - 0x1c]
mov edx, 0x62
sub dword [ebp - 0x20], 0xaaaaaaaa
or dword [ebp - 0x20], 0x880088
and dword [ebp - 0x20], 0xdd0000dd
xor edi, edi
sub dword [ebp - 0x20], 0xeeee00ee
xor dword [ebp - 0x18], 0x11000011
and dword [ebp - 0x1c], 0xdddddd
xor eax, eax
mov eax, 4
sub dword [ebp - 0x18], 0x77777777
mov edx, eax
mov dword [ebp - 0x1c], edi
mov edi, 0x44
lea eax, [ebp]
mov eax, edi
mov edx, dword [ebp - 0x18]
xor ecx, ecx
sub ecx, ecx
lea esi, [ebp - 0x1c]
mov edx, 0x200
and dword [ebp - 0x18], 0xff00ff
cmp edx, 0
jb 0x40aa9f
mov ecx, dword [ebp - 0x20]
cmp edx, 0xfc
ja 0x40aa9f
and dword [ebp - 0x18], 0xff
mov ecx, 0x40
xor dword [ebp - 0x20], 0xffff
mov dword [ebp - 0x1c], 0x2a
xor ecx, ecx
and dword [ebp - 0x1c], 0xffff
and dword [ebp - 0x20], 0xff00ff
and dword [ebp - 0x20], 0xff00ff
cmp ecx, dword [ebp - 0x18]
jne 0x40aad3
add dword [ebp - 0x1c], 0x76
mov eax, pe_nt_image_headers32
mov eax, 4
mov dword [ebp - 0x1c], ecx
sub dword [ebp - 0x20], 0x80
or dword [ebp - 0x18], 0xffff
mov esi, 0x64
mov si, 8
mov dword [ebp - 0x18], 0x80
add dword [ebp - 0x18], 8
add dword [ebp - 0x1c], 0x20
cmp esi, 4
je 0x40ab0c
sub edi, edi
or dword [ebp - 0x20], 0xffffff
cmp esi, 0
je 0x40ab0c
or dword [ebp - 0x18], 0xffff
and dword [ebp - 0x1c], 0xffff
push esi
push edi
call fcn.004045f5
mov eax, dword [ebp - 0x18]
and dword [ebp - 0x20], 0xffff
add dword [ebp - 0x20], 0x1c
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, 0xc8
cmp dword [ebp - 0x1c], ecx
jae 0x40ab41
sub eax, eax
mov eax, 0
lea eax, [ebp - 0x1c]
xor eax, eax
mov eax, 0x10
cmp dword [ebp - 0x1c], eax
jae 0x40ab5f
mov edx, dword [ebp - 0x18]
sub edx, edx
cmp edx, 0
jae 0x40ab5f
and dword [ebp - 0x18], 0xffff
mov esi, 0
or dword [ebp - 0x1c], 0xff
mov dword [ebp - 0x20], 0x2f
and dword [ebp - 0x20], 0xff00ff
mov edi, 0
mov dword [ebp - 0x1c], edi
or dword [ebp - 0x20], 0xff
sub edi, edi
sub dword [ebp - 0x18], 4
mov si, 0xc
push dword [ebp - 0x1c]
call fcn.004089c0
sub ecx, ecx
mov eax, dword [ebp - 0x20]
or dword [ebp - 0x20], 0xff
mov ecx, 0x12c
mov dword [ebp - 0x20], 0x2b
mov dword [ebp - 0x20], 0x7c
sub ecx, ecx
test ecx, ecx
jbe 0x40abd2
xor eax, eax
mov eax, 0x12
cmp dword [ebp - 0x18], eax
jne 0x40abd2
mov ecx, 0x12c
cmp ecx, 0xc4b
jne 0x40abe9
mov eax, 0x300
cmp eax, dword [ebp - 0x1c]
jb 0x40abe9
mov ecx, dword [ebp - 0x20]
cmp ecx, 0
jae 0x40ac0a
xor dword [ebp - 0x20], 0xffffff
mov dword [ebp - 0x20], 0x10
sub edi, edi
and dword [ebp - 0x18], 0xff
xor edi, edi
lea edi, [ebp - 0x1c]
mov di, 0x62
push ecx
push edi
call fcn.004045f5
xor edx, edx
sub edx, edx
mov dword [ebp - 0x18], 0x80
cmp edx, 0
jne 0x40ac36
mov eax, 0
or dword [ebp - 0x20], 0xffffff
xor edx, edx
mov eax, pe_nt_image_headers32
sub eax, eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], eax
cmp eax, 0
ja 0x40ac64
mov ecx, dword [ebp - 0x1c]
xor dword [ebp - 0x1c], 0xff00ff
and dword [ebp - 0x1c], 0xff
sub dword [ebp - 0x20], 0x7f
xor dword [ebp - 0x18], 0xffff
mov edx, dword [ebp - 0x18]
and dword [ebp - 0x20], 0xffff
xor dword [ebp - 0x1c], 0xffffff
cmp dword [ebp - 0x20], edx
je 0x40ac8d
sub ecx, ecx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], edx
and dword [ebp - 0x1c], 0xffffff
sub dword [ebp - 0x20], 0x40
call fcn.0040841b
mov edx, 0
mov ecx, 0
mov dx, 0x80
mov eax, 0
and dword [ebp - 0x1c], 0xffff
xor dword [ebp - 0x20], 0xffffff
mov eax, 0x51
and dword [ebp - 0x20], 0xff00ff
cmp eax, dword [ebp - 0x1c]
jb 0x40ace9
and dword [ebp - 0x1c], 0xffff
and dword [ebp - 0x18], 0xff00ff
sub ecx, ecx
or dword [ebp - 0x1c], 0xff00ff
and dword [ebp - 0x1c], 0xffff
mov dword [ebp - 0x1c], 0x32
mov cx, 0x60
sub esi, esi
mov si, 0x10
and dword [ebp - 0x18], 0xffffff
mov esi, 4
add dword [ebp - 0x20], 4
cmp esi, 0xc7c
jbe 0x40ad1b
lea esi, [ebp - 0x1c]
add dword [ebp - 0x18], 0x24
sub edi, edi
add dword [ebp - 0x20], 4
mov dword [ebp - 0x20], edi
push esi
push dword [ebp - 0x20]
push edi
push dword [ebp - 0x20]
call fcn.004089c0
mov ecx, 0
sub edx, edx
lea ecx, [ebp - 0x20]
cmp dword [ebp - 0x18], ecx
je 0x40ad4d
sub edx, edx
or dword [ebp - 0x18], 0xff00ff
sub dword [ebp - 0x18], 8
sub ecx, ecx
or dword [ebp - 0x18], 0xffffff
mov edx, 0x200
mov dx, 4
or dword [ebp - 0x1c], 0xffff
or dword [ebp - 0x1c], 0xffff
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, eax
sub eax, eax
sub edx, edx
call fcn.004045f5
sub edx, edx
mov eax, dword [ebp - 0x1c]
mov edi, 0x64
and dword [ebp - 0x20], 0xff
test edi, edi
jae 0x40ad93
sub edi, edi
cmp edi, 0x969
je 0x40ad93
push edi
push dword [ebp - 0x20]
push edi
push dword [ebp - 0x1c]
call fcn.004089c0
mov eax, 0x300
and dword [ebp - 0x1c], 0xffff
sub ecx, ecx
mov ax, 8
mov eax, 0x80
xor dword [ebp - 0x18], 0xffff
sub eax, eax
mov edx, 0
sub dword [ebp - 0x20], 1
mov eax, 0x200
mov dword [ebp - 0x1c], 0x29
sub esi, esi
and dword [ebp - 0x20], 0xff
sub dword [ebp - 0x20], 0x80
xor dword [ebp - 0x18], 0xff
mov si, 0x40
cmp esi, 0x25
jbe 0x40ae1c
mov ecx, 0x300
or dword [ebp - 0x1c], 0xffff
mov ecx, 0x10
cmp ecx, 0x91
ja 0x40ae1c
or dword [ebp - 0x1c], 0xff00ff
xor dword [ebp - 0x20], 0xffffff
push dword [ebp - 0x20]
push dword [ebp - 0x20]
call fcn.00404ad6
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
and dword [ebp - 0x20], 0xffff
mov dword [ebp - 0x20], 4
cmp ecx, dword [ebp - 0x20]
jae 0x40ae5b
sub dword [ebp - 0x20], 2
mov edx, 0x200
xor dword [ebp - 0x1c], 0xffff
and dword [ebp - 0x1c], 0xffff
mov cx, 0x4e
mov eax, 0xc8
and dword [ebp - 0x20], 0xffffff
mov ecx, 0x200
xor dword [ebp - 0x18], 0xffffff
mov eax, 0x300
and dword [ebp - 0x1c], 0xff
cmp eax, 0
jne 0x40ae90
mov edx, pe_nt_image_headers32
lea edx, [ebp - 0x20]
test edx, edx
ja 0x40ae90
push eax
push dword [ebp - 0x1c]
call fcn.004089c0
sub edx, edx
and dword [ebp - 0x1c], 0xffff
mov cx, 2
sub edx, edx
add dword [ebp - 0x1c], 0x43
test edx, edx
jne 0x40aec8
mov ecx, pe_nt_image_headers32
mov dword [ebp - 0x20], ecx
and dword [ebp - 0x18], 0xff00ff
mov dx, 8
mov edx, 8
xor edx, edx
mov dx, 0x20
mov edx, 1
test edx, edx
jb 0x40aeea
sub dword [ebp - 0x18], 4
mov eax, 0xc8
sub dword [ebp - 0x18], 0
add dword [ebp - 0x1c], 7
xor eax, eax
mov edi, 0xc8
cmp edi, 0x2a
je 0x40af03
mov edi, pe_nt_image_headers32
xor edi, edi
lea edi, [ebp - 0x1c]
cmp edi, 0
je 0x40af03
push edi
push dword [ebp - 0x20]
push edi
push dword [ebp - 0x20]
call fcn.004045f5
mov edx, 0x64
mov dword [ebp - 0x20], edx
and dword [ebp - 0x1c], 0xffff
mov edx, 2
add dword [ebp - 0x18], 0x6c
cmp edx, 0x1e
ja 0x40af3c
xor ecx, ecx
mov dword [ebp - 0x20], ecx
xor ecx, ecx
cmp edx, 0xa7
jae 0x40af3c
xor eax, eax
xor dword [ebp - 0x20], 0xffffff
add dword [ebp - 0x18], 0x2d
mov dword [ebp - 0x20], eax
and dword [ebp - 0x20], 0xff
cmp eax, 0
jb 0x40af64
mov edx, 0x12c
and dword [ebp - 0x1c], 0xffffff
mov eax, 0
lea eax, [ebp - 0x18]
add dword [ebp - 0x18], 4
test eax, eax
ja 0x40af84
sub ecx, ecx
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
cmp dword [ebp - 0x18], eax
jae 0x40af84
sub dword [ebp - 0x20], 0x10
call fcn.004089c0
mov eax, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x1c], 0x50
mov dword [ebp - 0x20], 0x80
or dword [ebp - 0x20], 0xff00ff
mov dword [ebp - 0x20], eax
test eax, eax
je 0x40afbe
mov edx, 0x300
xor dword [ebp - 0x18], 0xff
lea edx, [ebp - 0x1c]
cmp eax, 0
jne 0x40afc3
mov eax, 0x6f
leave
ret