Function at 0x1002e9c2
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0xd44
mov eax, 0x10076d65
call fcn.1007568d
mov ebx, ecx
mov dword [ebp - 0xc38], ebx
mov eax, dword [ebp + 8]
test eax, eax
jne 0x1002e9eb
push 0x80004003
call dword [sym.imp.PhotoBase.dll_void___stdcall_Base::Throw_long_int_]
mov ecx, 0x4000
cmp word [eax], cx
je 0x1002e9fc
push 0x80070057
jmp 0x1002e9e5
mov eax, dword [eax + 8]
mov ecx, dword [ebx + 0x58]
mov dword [ebp - 0xc44], eax
push dword [eax]
call fcn.1005ef34
mov esi, dword [ebx + 0x58]
push 0xbcf
lea ecx, [esi + 0x9c]
call fcn.1005ec9c
mov eax, dword [esi + 0x9c]
mov dword [ebp - 0xc3c], eax
test eax, eax
je 0x10038d54
xor ebx, ebx
mov edx, 0x10088ab8
mov dword [ebp - 0xb74], ebx
mov dword [ebp - 0xc28], ebx
mov dword [ebp - 0xc00], ebx
mov dword [ebp - 0xbf0], ebx
mov dword [ebp - 0xbe8], ebx
mov dword [ebp - 0xaf4], ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x1002ea61
mov eax, dword [0x10088ab4]
mov edi, 0x7f1137f
mov dword [ebp - 0xb90], 0x1000723a
mov dword [ebp - 0xbc8], 0x67
mov dword [ebp - 0xb00], 0x337
mov dword [ebp - 0xbc4], 0x10b
mov dword [ebp - 0xb5c], 0x20b
push 0
pop ebx
test eax, eax
jne 0x1002f10a
push 0x338
mov esi, ebx
mov dword [ebp - 0xaf8], ebx
push ebx
mov dword [ebp - 0xad8], ebx
mov dword [ebp - 0xae8], esi
mov dword [ebp - 0xafc], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xae0], ebx
test ebx, ebx
je 0x1002f0fc
or dword [ebp - 0xb04], 0xffffffff
xor edx, edx
mov eax, edx
mov dword [ebp - 0x3dc], edi
mov dword [ebp - 0xaf0], eax
mov edi, edx
mov dword [ebp - 0xb8c], eax
mov cl, dl
mov eax, 0x7f1137f
mov dword [ebp - 0xadc], edx
mov edx, eax
mov dword [ebp - 0x3e0], 0xab69605e
movzx esi, word [ebp - 0x3de]
shr edx, 0x10
add ebx, 7
movzx eax, ax
mov dword [ebp - 0xaec], esi
mov esi, 0x1000723a
mov dword [ebp - 0xbb4], edi
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xb1c], edx
mov dword [ebp - 0xb24], ebx
mov dword [ebp - 0xb18], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edx, eax
mov dword [ebp - 0xb0c], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl edx, 8
or edx, eax
mov dword [ebp - 0xbcc], edi
movzx eax, byte [esi + 5]
mov edi, 0x7f1137f
mov ebx, dword [ebp - 0xbcc]
add esi, 8
shl edx, 8
or edx, eax
mov dword [ebp - 0xb48], esi
mov eax, dword [ebp - 0xaf0]
xor eax, edx
mov dword [ebp - 0xb28], edx
xor edi, eax
mov eax, dword [ebp - 0xae4]
xor edi, ebx
xor edi, 0xab69605e
mov edx, edi
rol edx, 0xa
lea esi, [edi + 0x54969fa2]
rol esi, 5
imul eax, esi
mov esi, dword [ebp - 0xae4]
add edx, eax
xor ebx, edx
mov edx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [ebp - 0xaec]
sub edx, eax
xor edi, edx
mov eax, edi
sub eax, esi
imul edx, eax, 0x605e
mov eax, edi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xaec]
rol edx, 6
imul edx, dword [ebp - 0xb1c]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor edi, edx
mov edx, edi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, 0x7f1137f
xor esi, ebx
mov edx, ebx
imul esi, dword [ebp - 0xaec]
ror edx, 6
xor edx, esi
xor edi, edx
add eax, edi
mov edx, edi
ror eax, 0xf
rol edx, 2
imul eax, eax, 0x605e
add edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 8
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
imul edx, dword [ebp - 0xb1c]
sub edx, eax
mov eax, dword [ebp - 0xae4]
xor edi, edx
mov esi, edi
mov edx, edi
ror edx, 0xa
xor esi, 0xab69605e
ror esi, 0xc
imul eax, esi
mov esi, dword [ebp - 0xb1c]
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, esi
shr eax, 0xa
imul edx, dword [ebp - 0xaec]
xor edx, eax
xor edx, edi
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, esi
xor ebx, eax
mov edi, ebx
sub edi, esi
xor edi, edx
xor edi, 0xab69605e
mov eax, edi
xor eax, esi
mov esi, dword [ebp - 0xae4]
rol eax, 2
mov edx, esi
imul edx, eax
mov eax, edi
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [ebp - 0xaec]
rol eax, 7
add eax, edx
xor edi, eax
mov eax, esi
xor eax, edi
mov edx, edi
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
xor ebx, edx
mov edx, ebx
mov dword [ebp - 0xbcc], ebx
xor edx, dword [ebp - 0xaec]
mov eax, ebx
rol edx, 5
imul edx, dword [ebp - 0xb1c]
rol eax, 7
add eax, edx
mov edx, 0x7f1137f
xor edi, eax
mov ebx, edx
xor ebx, edi
xor ebx, dword [ebp - 0xbcc]
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xaec]
imul eax, esi
xor edi, eax
mov eax, edi
sub eax, edx
mov edx, edi
ror eax, 1
imul eax, eax, 0x605e
ror edx, 6
sub eax, edx
xor ebx, eax
mov eax, ebx
rol eax, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [ebp - 0xb1c]
add eax, edx
xor edi, eax
mov eax, dword [ebp - 0xae4]
mov edx, edi
ror edx, 0xe
lea esi, [edi - 0x54969fa2]
rol esi, 0xf
imul eax, esi
mov esi, dword [ebp - 0xb48]
sub eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
shr eax, 3
xor edx, 0x605e
imul edx, dword [ebp - 0xaec]
xor edx, eax
mov eax, 0x7f1137f
xor edi, edx
xor eax, edi
mov edx, edi
xor edi, dword [ebp - 0xb04]
rol eax, 4
imul eax, eax, 0x605e
rol edx, 2
mov dword [ebp - 0xb8c], edi
xor edx, eax
xor edx, dword [ebp - 0xadc]
xor ebx, edx
mov edx, dword [ebp - 0xb24]
mov dword [ebp - 0xbb4], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb8c]
ror dword [ebp - 0xbb4], 8
mov byte [edx], al
mov al, byte [ebp - 0xbb4]
ror dword [ebp - 0xb8c], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb8c]
ror dword [ebp - 0xbb4], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xbb4]
ror dword [ebp - 0xb8c], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb8c]
ror dword [ebp - 0xbb4], 8
mov byte [edx - 2], al
ror dword [ebp - 0xb8c], 8
mov al, byte [ebp - 0xbb4]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb8c]
mov byte [edx - 3], al
add edx, 8
mov eax, dword [ebp - 0xb8c]
mov edi, dword [ebp - 0xbb4]
ror eax, 8
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0xb0c]
ror edi, 8
sub dword [ebp - 0xb18], 1
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0xb28]
mov dword [ebp - 0xbb4], edi
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xb24], edx
jne 0x1002eb67
mov ebx, dword [ebp - 0xae0]
xor eax, eax
mov edx, eax
xor cl, byte [edx + ebx]
inc edx
cmp edx, 0x338
jb 0x1002eee6
movzx eax, cl
cdq
cmp eax, dword [0x10007570]
jne 0x1002ef24
cmp edx, dword [0x10007574]
jne 0x1002ef24
mov esi, dword [ebp - 0xafc]
mov edi, ebx
xor eax, eax
mov dword [ebp - 0xae8], edi
mov ebx, eax
mov dword [ebp - 0xaf0], 0x337
jmp 0x1002ef36
or dword [ebp - 0xaf0], 0xffffffff
mov esi, 0xc004d501
mov edi, dword [ebp - 0xae8]
test ebx, ebx
je 0x1002ef4d
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1002ef4f
xor ebx, ebx
test esi, esi
js 0x1002f0f6
mov eax, dword [ebp - 0xaf0]
mov esi, edi
push 0x40
push ebx
mov byte [eax + edi], bl
mov ebx, 0x100883a0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], 0
je 0x1002f08c
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xb74]
jne 0x1002ef85
sub ecx, ebx
xor ebx, ebx
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x1002f0ef
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xad8], ecx
cmp word [eax], dx
je 0x1002efcf
mov ecx, 0xc000007b
mov dword [ebp - 0xad8], ecx
jmp 0x1002f017
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x1002efc2
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x1002efc2
cmp dword [edx], 0x4550
jne 0x1002efc2
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xbc4]
je 0x1002f005
cmp ax, word [ebp - 0xb5c]
je 0x1002f005
mov ecx, 0xc000000d
jmp 0x1002efc7
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb48], eax
test eax, eax
je 0x1002f080
mov edx, esi
mov dword [ebp - 0xb28], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb0c], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x1002f038
sub edx, dword [ebp - 0xb0c]
inc esi
add esi, edx
test ecx, ecx
js 0x1002f071
push dword [ebp - 0xb28]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002f08c
mov ecx, dword [ebp - 0xaf8]
mov dword [ecx*4 + 0x10087be0], eax
mov ecx, dword [ebp - 0xad8]
inc dword [ebp - 0xaf8]
inc ebx
cmp ebx, dword [ebp - 0xb48]
jb 0x1002f027
add edi, 0x10
cmp byte [esi], 0
jne 0x1002ef7e
mov ebx, dword [ebp - 0xad8]
mov esi, dword [ebp - 0xae8]
test esi, esi
je 0x1002f0ad
push esi
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jns 0x1002f103
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0x100883a0]
test eax, eax
je 0x1002f0c6
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x1002f0b5
push 0x40
push ebx
push 0x100883a0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x10002d80
mov edi, 0x10087be0
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x1002f110
mov ebx, 0xc000007a
jmp 0x1002f092
mov esi, dword [ebp - 0xae8]
mov ebx, 0xc000007a
jmp 0x1002f098
mov eax, dword [0x10088ab4]
xor ebx, ebx
inc eax
mov dword [0x10088ab4], eax
xor eax, eax
mov ecx, 0x10088ab8
xchg dword [ecx], eax
mov eax, dword fs:[0x30]
mov edi, ebx
mov dword [ebp - 0xc18], ebx
mov dword [ebp - 0xc20], ebx
mov dword [ebp - 0xae4], ebx
cmp dword [eax + 0x1d4], 0
je 0x1002f3e0
mov esi, dword [0x10087c68]
mov ecx, esi
call dword [0x10089918]
call esi
mov ebx, eax
test ebx, ebx
jne 0x1002f17d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x1002f16d
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x1002f3ec
mov edi, 0x80004005
jmp 0x1002f3ec
xor ecx, ecx
mov dword [ebp - 0xbd0], ecx
mov edi, ecx
mov eax, ecx
mov esi, ecx
lea ecx, [ebp - 0xc4c]
push ecx
push eax
push esi
mov esi, dword [0x10087c78]
mov ecx, esi
push 2
push ebx
call dword [0x10089918]
call esi
test eax, eax
jne 0x1002f21e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1002f209
cmp dword [ebp - 0xbd0], edi
jne 0x1002f202
push dword [ebp - 0xc4c]
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xbd0]
mov esi, eax
call fcn.1006cdc4
test esi, esi
je 0x1002f1f3
mov eax, dword [ebp - 0xc4c]
mov dword [ebp - 0xbd0], esi
jmp 0x1002f18b
xor eax, eax
mov edi, 0x8007000e
mov dword [ebp - 0xbd0], eax
jmp 0x1002f232
mov edi, 0x80004005
jmp 0x1002f232
test eax, eax
je 0x1002f202
jg 0x1002f213
mov edi, eax
jmp 0x1002f232
movzx edi, ax
or edi, 0x80070000
jmp 0x1002f232
mov eax, dword [ebp - 0xbd0]
xor ecx, ecx
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xc18], eax
lea ecx, [ebp - 0xbd0]
call fcn.1006cdc4
test edi, edi
js 0x1002f3ec
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [0x10087c74]
mov ecx, esi
push eax
call dword [0x10089918]
call esi
mov ebx, eax
test ebx, ebx
je 0x1002f156
xor ecx, ecx
mov dword [ebp - 0xbd4], ecx
mov edi, ecx
mov eax, ecx
mov esi, ecx
lea ecx, [ebp - 0xc48]
push ecx
push eax
push esi
mov esi, dword [0x10087c78]
mov ecx, esi
push 2
push ebx
call dword [0x10089918]
call esi
test eax, eax
jne 0x1002f301
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1002f2ea
cmp dword [ebp - 0xbd4], edi
jne 0x1002f2e3
push dword [ebp - 0xc48]
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xbd4]
mov esi, eax
call fcn.1002c4f4
test esi, esi
je 0x1002f2dc
mov eax, dword [ebp - 0xc48]
mov dword [ebp - 0xbd4], esi
jmp 0x1002f274
mov edi, 0x8007000e
jmp 0x1002f30d
mov edi, 0x80004005
jmp 0x1002f2fd
test eax, eax
je 0x1002f2e3
jg 0x1002f2f4
mov edi, eax
jmp 0x1002f2fd
movzx edi, ax
or edi, 0x80070000
xor ebx, ebx
jmp 0x1002f315
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0xc20], eax
xor ebx, ebx
mov dword [ebp - 0xbd4], ebx
lea ecx, [ebp - 0xbd4]
call fcn.1006cdc4
test edi, edi
js 0x1002f3ec
mov eax, dword [ebp - 0xc18]
test eax, eax
je 0x1002f3e0
mov ecx, 0x10006ddc
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002f364
test dx, dx
je 0x1002f35d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002f364
add eax, 4
add ecx, 4
test dx, dx
jne 0x1002f33b
xor esi, esi
mov eax, ebx
inc esi
jmp 0x1002f36b
sbb eax, eax
xor esi, esi
inc esi
or eax, esi
test eax, eax
jne 0x1002f3e0
mov eax, dword [ebp - 0xc20]
test eax, eax
je 0x1002f3e0
mov ecx, 0x10006e30
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002f3a4
test dx, dx
je 0x1002f3a0
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002f3a4
add eax, 4
add ecx, 4
test dx, dx
jne 0x1002f37e
mov eax, ebx
jmp 0x1002f3a8
sbb eax, eax
or eax, esi
test eax, eax
jne 0x1002f3e0
push 4
lea eax, [ebp - 0xc40]
mov dword [ebp - 0xc40], ebx
push eax
push 0xb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
test eax, eax
je 0x1002f156
test byte [ebp - 0xc40], 0xf
jne 0x1002f3e0
xor eax, eax
inc eax
jmp 0x1002f3e6
mov eax, dword [ebp - 0xae4]
mov dword [ebp - 0xaf4], eax
lea ecx, [ebp - 0xc20]
call fcn.1006cdc4
lea ecx, [ebp - 0xc18]
call fcn.1006cdc4
test edi, edi
jns 0x1002f40e
xor eax, eax
mov dword [ebp - 0xaf4], eax
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
lea ecx, [ebp - 0xbe8]
mov dword [ebp - 0xad4], ebx
call fcn.1006cdad
test ebx, ebx
jne 0x1002f4ea
xor edx, edx
mov ebx, 0x8007000e
mov dword [ebp - 0xbe8], edx
mov eax, dword [ebp - 0xc1c]
mov dword [ebp - 0xbf0], eax
xor edx, edx
mov esi, 0x10088ab8
lea ecx, [edx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x1002f453
mov eax, dword [0x10088ab4]
push 0
pop edx
test eax, eax
jle 0x1002f4b2
sub eax, 1
mov dword [0x10088ab4], eax
jne 0x1002f4b2
mov edi, edx
mov eax, dword [edi + 0x100883a0]
test eax, eax
je 0x1002f489
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0x1002f478
push 0x40
xor eax, eax
push eax
push 0x100883a0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x10002d80
mov edi, 0x10087be0
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0x10088ab8
xchg dword [ecx], eax
lea ecx, [ebp - 0xbe8]
call fcn.1006cdad
test ebx, ebx
jns 0x10038bc1
cmp ebx, 0xd0000034
jne 0x10038b7e
mov ebx, 0xc004f012
mov dword [ebp - 0xc00], ebx
jmp 0x10038bd8
xor eax, eax
mov dword [ebp - 0xbe8], ebx
lea edi, [ebp - 0xb38]
xor ebx, ebx
stosd dword es:[edi], eax
mov esi, ebx
mov dword [ebp - 0xae0], ebx
mov dword [ebp - 0xb14], ebx
mov dword [ebp - 0xb1c], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xbe4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xbcc], 0x38
mov dword [ebp - 0xb28], edi
test edi, edi
je 0x1002f57e
push 0xa0
push 0x10087e70
push edi
call sub.msvcrt.dll_memcpy
mov esi, edi
add esp, 0xc
mov dword [ebp - 0xac0], esi
push 8
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb48], ecx
test ecx, ecx
jne 0x1002f58b
mov ebx, 0xc0000017
mov dword [ebp - 0xac4], ebx
jmp 0x1002f5e2
mov eax, dword [0x10087e68]
mov dword [ecx], eax
mov eax, dword [0x10087e6c]
mov dword [ecx + 4], eax
mov dword [ebp - 0xae0], ecx
rdtsc
mov dword [ebp - 0xb4c], eax
mov dword [ebp - 0xb08], edx
push 0xc
pop esi
lea eax, [ebp - 0xc14]
mov edx, SysReAllocString
push eax
mov ecx, 0x10005aa0
call fcn.1006cdfb
test eax, eax
jns 0x1002f64a
mov dword [ebp - 0xc14], ebx
mov ebx, 0xc000003e
mov dword [ebp - 0xac4], ebx
mov esi, dword [ebp - 0xac0]
xor edi, edi
mov dword [ebp - 0xb34], edi
mov dword [ebp - 0xb38], edi
cmp dword [ebp - 0xb30], edi
je 0x1002f612
push dword [ebp - 0xb30]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xb30], edi
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xbe0], edi
mov dword [ebp - 0xbe4], edi
test eax, eax
je 0x10032001
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebp - 0xbdc], eax
jmp 0x10032003
mov eax, dword [ebp - 0xc14]
inc eax
push 4
mov dword [ebp - 0xc14], eax
pop edx
lea eax, [eax*2 + 4]
cmp eax, edx
jb 0x1002f669
mov ecx, eax
jmp 0x1002f66c
or ecx, 0xffffffff
cmp eax, edx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, edx
jb 0x1002f5dc
mov esi, ecx
lea ecx, [esi + 0xc4]
mov edx, 0xc4
cmp ecx, edx
jb 0x1002f699
mov eax, ecx
jmp 0x1002f69c
or eax, 0xffffffff
cmp ecx, edx
sbb ebx, ebx
and ebx, 0xc0000095
add ebx, 0x10000000
mov dword [ebp - 0xac4], ebx
cmp ecx, edx
jb 0x10031fde
lea edx, [eax + 8]
cmp edx, eax
jb 0x1002f6c5
mov ecx, edx
jmp 0x1002f6c8
or ecx, 0xffffffff
cmp edx, eax
mov esi, 0xc0000095
sbb ebx, ebx
and ebx, esi
add ebx, 0x10000000
mov dword [ebp - 0xac4], ebx
cmp edx, eax
jb 0x10031fde
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x1002f6f2
mov edx, eax
jmp 0x1002f6f5
or edx, 0xffffffff
cmp eax, ecx
sbb ebx, ebx
and ebx, esi
add ebx, 0x10000000
mov dword [ebp - 0xac4], ebx
cmp eax, ecx
jb 0x10031fde
push edx
push 8
mov dword [ebp - 0xb34], edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x1002f735
mov ebx, 0xc0000017
jmp 0x1002f5d6
mov dword [ebp - 0xb30], edx
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xb38], ecx
mov dword [ebp - 0xd38], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x1002f756
mov esi, eax
jmp 0x1002f759
or esi, 0xffffffff
cmp eax, edx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, edx
jb 0x1002f79f
mov ecx, dword [ebp - 0xb34]
lea eax, [edx + 8]
add ecx, edx
cmp eax, ecx
jbe 0x1002f786
mov ebx, 0xc0000023
jmp 0x1002f5d6
mov dword [edx], 4
xor eax, eax
mov dword [esi], eax
mov ecx, dword [ebp - 0xb38]
inc ecx
mov dword [ebp - 0xb38], ecx
jmp 0x1002f7a1
xor eax, eax
test ebx, ebx
js 0x1002f5dc
cmp dword [ebp - 0xb30], 0
jne 0x1002f7f3
mov esi, dword [ebp - 0xb34]
lea eax, [esi + 0xa4]
cmp eax, esi
jb 0x1002f7c6
mov edx, eax
jmp 0x1002f7c9
or edx, 0xffffffff
cmp eax, esi
mov dword [ebp - 0xb34], edx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, esi
jb 0x1002f8d7
inc ecx
mov dword [ebp - 0xb38], ecx
jmp 0x1002f8df
mov edx, dword [ebp - 0xb30]
mov esi, eax
test ecx, ecx
je 0x1002f876
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xb0c], edx
cmp eax, 4
jb 0x1002f813
mov edi, eax
jmp 0x1002f816
or edi, 0xffffffff
cmp eax, 4
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, 4
jb 0x1002f834
mov dword [ebp - 0xcb0], edi
jmp 0x1002f83a
mov edi, dword [ebp - 0xcb0]
cmp eax, 4
jb 0x1002f8d1
lea eax, [edx + edi]
mov ebx, edx
cmp eax, edx
jb 0x1002f850
mov edx, eax
jmp 0x1002f853
or edx, 0xffffffff
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, dword [ebp - 0xb0c]
jb 0x1002f8d1
inc esi
cmp esi, ecx
jb 0x1002f7ff
mov edi, dword [ebp - 0xb28]
lea eax, [edx + 4]
cmp eax, edx
jb 0x1002f881
mov esi, eax
jmp 0x1002f884
or esi, 0xffffffff
cmp eax, edx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, edx
jb 0x1002f8d1
mov ecx, dword [ebp - 0xb34]
lea eax, [edx + 0xa4]
add ecx, dword [ebp - 0xb30]
cmp eax, ecx
ja 0x1002f77c
mov eax, 0xa0
push eax
push edi
push esi
mov dword [edx], eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xb38]
add esp, 0xc
inc ecx
mov dword [ebp - 0xb38], ecx
mov edx, dword [ebp - 0xb34]
test ebx, ebx
js 0x1002f5dc
cmp dword [ebp - 0xb30], 0
jne 0x1002f938
mov eax, edx
lea edx, [eax + 0xc]
mov esi, edx
cmp edx, eax
jae 0x1002f8f6
or edx, 0xffffffff
cmp esi, eax
mov dword [ebp - 0xb34], edx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp esi, eax
jb 0x1002fa21
mov eax, dword [ebp - 0xb4c]
inc ecx
mov dword [ebp - 0xc80], eax
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0xb38], ecx
mov dword [ebp - 0xc7c], eax
jmp 0x1002fa4a
mov esi, dword [ebp - 0xb30]
xor eax, eax
mov edi, eax
test ecx, ecx
je 0x1002f9c3
mov eax, dword [esi]
add eax, 4
mov dword [ebp - 0xb0c], esi
cmp eax, 4
jb 0x1002f95e
mov dword [ebp - 0xaf0], eax
jmp 0x1002f965
or dword [ebp - 0xaf0], 0xffffffff
cmp eax, 4
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, 4
jb 0x1002fa21
mov ebx, dword [ebp - 0xaf0]
mov dword [ebp - 0xc78], ebx
mov ebx, dword [ebp - 0xac4]
mov eax, dword [ebp - 0xc78]
mov ebx, esi
add eax, esi
cmp eax, esi
jb 0x1002f9a3
mov esi, eax
jmp 0x1002f9a6
or esi, 0xffffffff
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, dword [ebp - 0xb0c]
jb 0x1002fa21
inc edi
cmp edi, ecx
jb 0x1002f946
lea eax, [esi + 4]
cmp eax, esi
jb 0x1002f9ce
mov edi, eax
jmp 0x1002f9d1
or edi, 0xffffffff
cmp eax, esi
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, esi
jb 0x1002fa21
mov ecx, dword [ebp - 0xb30]
lea eax, [esi + 0xc]
add ecx, edx
cmp eax, ecx
ja 0x1002f77c
mov ecx, dword [ebp - 0xb48]
mov dword [esi], 8
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov ecx, dword [ebp - 0xb38]
mov edx, dword [ebp - 0xb34]
inc ecx
mov dword [ebp - 0xb38], ecx
test ebx, ebx
js 0x1002f5dc
cmp dword [ebp - 0xb30], 0
mov eax, dword [ebp - 0xb4c]
mov dword [ebp - 0xc80], eax
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0xc7c], eax
jne 0x1002fa84
lea eax, [edx + 0xc]
cmp eax, edx
jb 0x1002fa59
mov dword [ebp - 0xb34], eax
jmp 0x1002fa60
or dword [ebp - 0xb34], 0xffffffff
cmp eax, edx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, edx
jb 0x1002fb61
inc ecx
mov dword [ebp - 0xb38], ecx
jmp 0x1002fb69
mov esi, dword [ebp - 0xb30]
xor eax, eax
mov edi, eax
test ecx, ecx
je 0x1002fb0f
mov eax, dword [esi]
add eax, 4
mov dword [ebp - 0xb0c], esi
cmp eax, 4
jb 0x1002faaa
mov dword [ebp - 0xaf0], eax
jmp 0x1002fab1
or dword [ebp - 0xaf0], 0xffffffff
cmp eax, 4
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, 4
jb 0x1002fb61
mov ebx, dword [ebp - 0xaf0]
mov dword [ebp - 0xc74], ebx
mov ebx, dword [ebp - 0xac4]
mov eax, dword [ebp - 0xc74]
mov ebx, esi
add eax, esi
cmp eax, esi
jb 0x1002faef
mov esi, eax
jmp 0x1002faf2
or esi, 0xffffffff
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, dword [ebp - 0xb0c]
jb 0x1002fb61
inc edi
cmp edi, ecx
jb 0x1002fa92
lea eax, [esi + 4]
cmp eax, esi
jb 0x1002fb1a
mov edi, eax
jmp 0x1002fb1d
or edi, 0xffffffff
cmp eax, esi
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, esi
jb 0x1002fb61
mov ecx, dword [ebp - 0xb30]
lea eax, [esi + 0xc]
add ecx, edx
cmp eax, ecx
ja 0x1002f77c
mov eax, dword [ebp - 0xb4c]
mov dword [esi], 8
mov dword [edi], eax
mov eax, dword [ebp - 0xb08]
mov dword [edi + 4], eax
inc dword [ebp - 0xb38]
test ebx, ebx
js 0x1002f5dc
lea eax, [ebp - 0xc10]
mov edx, SysReAllocString
push eax
mov ecx, 0x10005aa0
call fcn.1006cdfb
test eax, eax
jns 0x1002fb90
xor ebx, ebx
mov dword [ebp - 0xc10], ebx
jmp 0x1002f5d1
mov ecx, dword [ebp - 0xc10]
lea eax, [ecx + 1]
cmp eax, ecx
jb 0x1002fba1
mov esi, eax
jmp 0x1002fba4
or esi, 0xffffffff
cmp eax, ecx
mov dword [ebp - 0xc10], esi
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, ecx
jb 0x1002fd3f
add esi, esi
je 0x1002fd34
cmp dword [ebp - 0xb30], 0
jne 0x1002fc46
push 4
lea eax, [esi + 4]
pop ecx
cmp eax, ecx
jb 0x1002fbe1
mov edx, eax
jmp 0x1002fbe4
or edx, 0xffffffff
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, ecx
jae 0x1002fc03
mov edx, dword [ebp - 0xc70]
jmp 0x1002fd3f
mov ecx, dword [ebp - 0xb34]
lea eax, [ecx + edx]
cmp eax, ecx
jb 0x1002fc18
mov dword [ebp - 0xb34], eax
jmp 0x1002fc1f
or dword [ebp - 0xb34], 0xffffffff
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, ecx
jb 0x1002fd3f
inc dword [ebp - 0xb38]
xor eax, eax
mov ebx, eax
jmp 0x1002fd39
mov edx, dword [ebp - 0xb30]
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0xb38], eax
jbe 0x1002fcdd
mov edi, dword [ebp - 0xc70]
mov dword [ebp - 0xaf0], edi
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xb0c], edx
cmp eax, 4
jb 0x1002fc7c
mov edi, eax
jmp 0x1002fc7f
or edi, 0xffffffff
cmp eax, 4
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, 4
jb 0x1002fc9d
mov dword [ebp - 0xaf0], edi
jmp 0x1002fca3
mov edi, dword [ebp - 0xaf0]
cmp eax, 4
jb 0x1002fd3f
lea eax, [edx + edi]
mov ebx, edx
cmp eax, edx
jb 0x1002fcb9
mov edx, eax
jmp 0x1002fcbc
or edx, 0xffffffff
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, dword [ebp - 0xb0c]
jb 0x1002fd3f
inc ecx
cmp ecx, dword [ebp - 0xb38]
jb 0x1002fc68
lea eax, [edx + 4]
cmp eax, edx
jb 0x1002fce8
mov edi, eax
jmp 0x1002fceb
or edi, 0xffffffff
cmp eax, edx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, edx
jb 0x1002fd3f
mov ecx, dword [ebp - 0xb34]
lea eax, [esi + 4]
add ecx, dword [ebp - 0xb30]
add eax, edx
cmp eax, ecx
jbe 0x1002fd1b
mov ebx, 0xc0000023
jmp 0x1002fd39
push esi
push 0x10005aa0
push edi
mov dword [edx], esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
inc dword [ebp - 0xb38]
jmp 0x1002fd3f
mov ebx, 0xc000000d
mov dword [ebp - 0xac4], ebx
test ebx, ebx
js 0x1002f5dc
cmp dword [ebp - 0xb30], 0
mov edi, dword [ebp - 0xaf4]
mov dword [ebp - 0xd50], edi
jne 0x1002fda5
mov ecx, dword [ebp - 0xb34]
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x1002fd71
mov dword [ebp - 0xb34], eax
jmp 0x1002fd78
or dword [ebp - 0xb34], 0xffffffff
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, ecx
jb 0x1002fe6e
inc dword [ebp - 0xb38]
mov dword [ebp - 0xc6c], 4
jmp 0x1002fe89
mov edx, dword [ebp - 0xb30]
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0xb38], eax
jbe 0x1002fe27
mov edi, dword [ebp - 0xd30]
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xb0c], edx
cmp eax, 4
jb 0x1002fdd1
mov esi, eax
jmp 0x1002fdd4
or esi, 0xffffffff
cmp eax, 4
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, 4
jb 0x1002fe6e
mov edi, esi
lea eax, [edx + edi]
mov esi, edx
cmp eax, edx
jb 0x1002fdfd
mov edx, eax
jmp 0x1002fe00
or edx, 0xffffffff
cmp eax, esi
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, dword [ebp - 0xb0c]
jb 0x1002fe6e
inc ecx
cmp ecx, dword [ebp - 0xb38]
jb 0x1002fdbd
mov edi, dword [ebp - 0xaf4]
lea eax, [edx + 4]
cmp eax, edx
jb 0x1002fe32
mov esi, eax
jmp 0x1002fe35
or esi, 0xffffffff
cmp eax, edx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, edx
jb 0x1002fe6e
mov ecx, dword [ebp - 0xb34]
lea eax, [edx + 8]
add ecx, dword [ebp - 0xb30]
cmp eax, ecx
ja 0x1002f77c
mov dword [edx], 4
mov dword [esi], edi
inc dword [ebp - 0xb38]
test ebx, ebx
js 0x1002f5dc
cmp dword [ebp - 0xb30], 0
mov dword [ebp - 0xc6c], 4
jne 0x1002fec8
mov ecx, dword [ebp - 0xb34]
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x1002fe9e
mov dword [ebp - 0xb34], eax
jmp 0x1002fea5
or dword [ebp - 0xb34], 0xffffffff
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, ecx
jb 0x1002ff86
inc dword [ebp - 0xb38]
jmp 0x1002ff8e
mov edx, dword [ebp - 0xb30]
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0xb38], eax
jbe 0x1002ff40
mov edi, dword [ebp - 0xd2c]
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xb0c], edx
cmp eax, 4
jb 0x1002fef4
mov esi, eax
jmp 0x1002fef7
or esi, 0xffffffff
cmp eax, 4
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, 4
jb 0x1002ff86
mov edi, esi
lea eax, [edx + edi]
mov esi, edx
cmp eax, edx
jb 0x1002ff1c
mov edx, eax
jmp 0x1002ff1f
or edx, 0xffffffff
cmp eax, esi
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, dword [ebp - 0xb0c]
jb 0x1002ff86
inc ecx
cmp ecx, dword [ebp - 0xb38]
jb 0x1002fee0
lea eax, [edx + 4]
cmp eax, edx
jb 0x1002ff4b
mov esi, eax
jmp 0x1002ff4e
or esi, 0xffffffff
cmp eax, edx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, edx
jb 0x1002ff86
mov ecx, dword [ebp - 0xb34]
lea eax, [edx + 8]
add ecx, dword [ebp - 0xb30]
cmp eax, ecx
ja 0x1002f77c
push 4
pop eax
mov dword [edx], eax
mov dword [esi], eax
inc dword [ebp - 0xb38]
test ebx, ebx
js 0x1002f5dc
xor edx, edx
mov esi, edx
mov dword [ebp - 0xb54], edx
mov dword [ebp - 0xae4], edx
mov dword [ebp - 0xb04], edx
mov dword [ebp - 0xb40], edx
mov dword [ebp - 0xafc], edx
mov dword [ebp - 0xac8], edx
mov dword [ebp - 0xadc], edx
mov dword [ebp - 0xb88], edx
mov dword [ebp - 0xb24], edx
rdtsc
mov dword [ebp - 0xacc], esi
mov dword [ebp - 0xb0c], eax
mov dword [ebp - 0xb28], edx
mov ecx, dword [ebp - 0xb34]
add ecx, 8
cmp ecx, 8
jb 0x1002ffee
mov eax, ecx
jmp 0x1002fff1
or eax, 0xffffffff
cmp ecx, 8
mov edx, 0xc0000095
sbb ebx, ebx
and ebx, edx
cmp ecx, 8
jb 0x100300d5
lea edi, [eax + 7]
and edi, 0xfffffff8
cmp edi, eax
jae 0x10030017
mov ebx, edx
jmp 0x100300d5
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x10030037
mov ebx, 0xc0000017
jmp 0x100300cf
mov eax, dword [ebp - 0xb38]
mov dword [esi], eax
lea eax, [esi + 4]
cmp eax, esi
jb 0x1003004a
mov ecx, eax
jmp 0x1003004d
or ecx, 0xffffffff
cmp eax, esi
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, esi
jb 0x100300ba
mov eax, dword [ebp - 0xb34]
mov dword [ecx], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x1003006e
mov edx, eax
jmp 0x10030071
or edx, 0xffffffff
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, ecx
jb 0x100300ba
mov eax, dword [ebp - 0xb0c]
mov dword [esi + edi - 8], eax
mov eax, dword [ebp - 0xb28]
mov dword [esi + edi - 4], eax
push dword [ebp - 0xb34]
push dword [ebp - 0xb30]
push edx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [ebp - 0xb54], esi
xor eax, eax
mov dword [ebp - 0xacc], edi
mov esi, eax
jmp 0x100300bc
xor eax, eax
test esi, esi
je 0x100300cf
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp - 0xacc]
or ebx, 0x10000000
mov dword [ebp - 0xac4], ebx
jl 0x1003193c
mov ebx, dword [ebp - 0xb54]
xor ecx, ecx
mov edi, ecx
mov dword [ebp - 0xb48], edi
test ebx, ebx
jne 0x10030105
mov ebx, 0xc000000d
jmp 0x10030751
test esi, esi
je 0x1003074c
lea eax, [esi + 8]
push eax
push ecx
mov dword [ebp - 0xac4], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xaf8], eax
test eax, eax
je 0x1003074c
xor eax, eax
mov cl, al
mov edx, eax
test esi, esi
je 0x10030147
xor cl, byte [edx + ebx]
inc edx
cmp edx, esi
jb 0x1003013d
xor eax, eax
mov dword [ebp - 0xba8], eax
or ebx, 0xffffffff
mov eax, esi
mov dword [ebp - 0x3d8], 0xb1b54a58
shr eax, 3
mov edx, 0xc81ecb17
mov dword [ebp - 0x3d4], edx
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xb2c], eax
test eax, eax
je 0x1003057c
movzx edx, word [ebp - 0x3d6]
mov eax, 0xc81ecb17
movzx esi, ax
shr eax, 0x10
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0xaf8]
mov dword [ebp - 0xad0], esi
add eax, 7
mov esi, dword [ebp - 0xb54]
mov dword [ebp - 0xbc0], eax
add esi, 2
xor eax, eax
mov dword [ebp - 0xaec], edx
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xb18], eax
movzx edx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl edx, 8
or edx, eax
shl edi, 8
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
or edi, eax
mov dword [ebp - 0xb0c], edx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
shl edi, 8
add esi, 8
or edi, eax
mov dword [ebp - 0xb28], esi
xor ebx, edi
mov eax, 0xc81ecb17
mov dword [ebp - 0xad8], ebx
add ebx, 0xffffb5a8
xor ebx, edx
xor ebx, dword [ebp - 0xba8]
xor ebx, eax
mov esi, ebx
mov edx, ebx
xor esi, eax
ror edx, 7
mov eax, dword [ebp - 0xaec]
ror esi, 0xf
imul eax, esi
add edx, eax
mov eax, dword [ebp - 0xad8]
xor eax, edx
mov dword [ebp - 0xad8], eax
mov edx, eax
ror edx, 0xa
lea esi, [eax - 0x4e4ab5a8]
mov eax, dword [ebp - 0xad0]
ror esi, 9
imul eax, esi
mov esi, dword [ebp - 0xad0]
sub eax, edx
xor ebx, eax
mov eax, dword [ebp - 0xae8]
xor esi, ebx
mov edx, ebx
rol esi, 4
imul eax, esi
mov esi, dword [ebp - 0xad8]
rol edx, 5
add edx, eax
mov eax, 0xc81ecb17
xor esi, edx
mov edx, esi
xor edx, 0xb1b54a58
sub eax, edx
xor ebx, eax
mov eax, ebx
shr eax, 6
lea edx, [ebx - 0x4a58]
imul edx, dword [ebp - 0xaec]
sub edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xf
xor eax, dword [ebp - 0xad0]
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, dword [ebp - 0xae8]
imul eax, dword [ebp - 0xad0]
xor esi, eax
mov eax, esi
sub eax, 0xc81ecb17
sub eax, 0x4a58
xor ebx, eax
mov eax, dword [ebp - 0xae8]
xor eax, ebx
mov edx, ebx
imul eax, dword [ebp - 0xaec]
ror edx, 0xa
xor edx, eax
mov eax, dword [ebp - 0xad0]
xor esi, edx
mov dword [ebp - 0xad8], esi
xor esi, 0x4a58
mov edx, dword [ebp - 0xad8]
ror edx, 3
rol esi, 6
imul eax, esi
mov esi, dword [ebp - 0xad8]
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xae8]
mov eax, ebx
ror eax, 0xf
sub eax, edx
imul eax, eax, 0x4a58
xor esi, eax
xor edx, esi
mov eax, esi
imul edx, edx, 0x4a58
shr eax, 1
xor edx, eax
mov eax, esi
sub eax, dword [ebp - 0xad0]
xor ebx, edx
rol eax, 3
mov edx, esi
imul eax, eax, 0x4a58
shr edx, 0xf
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
sub edx, dword [ebp - 0xad0]
imul edx, dword [ebp - 0xaec]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xad0]
xor esi, edx
mov dword [ebp - 0xad8], esi
mov esi, 0xb1b54a58
mov edx, dword [ebp - 0xad8]
sub esi, edx
ror esi, 9
imul eax, esi
mov esi, dword [ebp - 0xad8]
ror edx, 0xb
xor edx, eax
xor ebx, edx
mov eax, ebx
sub eax, dword [ebp - 0xae8]
add eax, 0x4e4ab5a8
xor esi, eax
mov eax, dword [ebp - 0xaec]
xor eax, esi
mov dword [ebp - 0xad8], esi
imul eax, eax, 0x4a58
mov edx, esi
mov esi, dword [ebp - 0xae8]
ror edx, 7
sub eax, edx
xor ebx, eax
mov eax, dword [ebp - 0xaec]
xor esi, ebx
mov edx, ebx
rol esi, 4
imul eax, esi
ror edx, 0x10
sub eax, edx
mov edx, dword [ebp - 0xad8]
xor edx, eax
mov eax, dword [ebp - 0xad0]
mov esi, 0xb1b54a58
sub esi, edx
mov dword [ebp - 0xad8], edx
ror edx, 4
ror esi, 0xa
imul eax, esi
add edx, eax
mov eax, dword [ebp - 0xae8]
xor ebx, edx
mov edx, ebx
ror edx, 9
lea esi, [ebx + 0x4e4ab5a8]
ror esi, 4
imul eax, esi
mov esi, dword [ebp - 0xad8]
xor edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0xc81ecb17
rol edx, 2
rol eax, 8
imul eax, eax, 0x4a58
sub eax, edx
mov edx, 0xc81ecb17
xor ebx, eax
sub edx, ebx
mov eax, ebx
ror edx, 0xb
imul edx, dword [ebp - 0xaec]
ror eax, 0xc
sub edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
xor edx, dword [ebp - 0xaec]
xor esi, 0xc81ecb17
imul edx, dword [ebp - 0xad0]
xor esi, dword [ebp - 0xb18]
shr eax, 8
mov dword [ebp - 0xb18], edi
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xbc0]
mov eax, ebx
xor ebx, dword [ebp - 0xaf0]
xor esi, eax
mov dword [ebp - 0xba8], ebx
xor esi, 0xb1b54a58
mov dword [ebp - 0xba4], esi
mov byte [edx - 4], bl
mov al, byte [ebp - 0xba4]
ror dword [ebp - 0xba8], 8
mov byte [edx], al
mov al, byte [ebp - 0xba8]
ror dword [ebp - 0xba4], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xba4]
ror dword [ebp - 0xba8], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xba8]
ror dword [ebp - 0xba4], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xba4]
ror dword [ebp - 0xba8], 8
mov byte [edx - 2], al
ror dword [ebp - 0xba4], 8
mov al, byte [ebp - 0xba8]
mov byte [edx - 7], al
mov al, byte [ebp - 0xba4]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [ebp - 0xba4]
ror dword [ebp - 0xba8], 8
mov eax, dword [ebp - 0xb0c]
ror ebx, 8
sub dword [ebp - 0xb2c], 1
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xbc0], edx
mov esi, dword [ebp - 0xb28]
jne 0x100301c8
mov edi, dword [ebp - 0xb48]
mov esi, dword [ebp - 0xacc]
mov ebx, dword [ebp - 0xaf8]
movzx eax, cl
cdq
mov dword [ebx + esi], eax
mov dword [ebx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x100305ae
mov ebx, 0xc0000017
jmp 0x100306bd
mov eax, dword [ebp - 0xac4]
push eax
push 8
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x100305d6
mov ebx, 0xc0000017
xor edx, edx
jmp 0x10030656
mov dword [esi + 4], eax
push dword [ebp - 0xac4]
push ebx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [esi + 8], eax
push eax
push 8
pop ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x100305ca
mov dword [esi + 0xc], eax
push 0xa0
push 0x10087dc0
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [esi + 0x10], ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0x1003063e
mov ebx, 0xc0000017
jmp 0x10030656
mov dword [esi + 0x14], ecx
mov edi, esi
mov eax, dword [0x10087e60]
mov ebx, edx
mov dword [ecx], eax
mov esi, edx
mov eax, dword [0x10087e64]
mov dword [ecx + 4], eax
test esi, esi
je 0x100306bd
cmp dword [esi + 4], 0
je 0x10030676
push dword [esi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
mov dword [esi + 4], edx
cmp dword [esi + 0xc], 0
je 0x10030692
push dword [esi + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
mov dword [esi + 0xc], edx
cmp dword [esi + 0x14], 0
je 0x100306ae
push dword [esi + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
mov dword [esi + 0x14], edx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
js 0x100306cb
xor eax, eax
mov dword [ebp - 0xae4], edi
mov edi, eax
mov eax, dword [ebp - 0xaf8]
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x10030751
xor eax, eax
cmp dword [edi + 4], eax
je 0x10030703
push dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x1003071f
push dword [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0x1003073b
push dword [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10030751
mov ebx, 0xc0000001
or ebx, 0x10000000
mov dword [ebp - 0xac4], ebx
jl 0x1003193c
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax]
mov edi, dword [eax + 0x10]
add ecx, 4
mov esi, dword [eax + 8]
cmp ecx, 4
jb 0x1003077d
mov eax, ecx
jmp 0x10030780
or eax, 0xffffffff
cmp ecx, 4
sbb ebx, ebx
and ebx, 0xc0000095
cmp ecx, 4
jb 0x10030805
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x1003079b
mov edx, ecx
jmp 0x1003079e
or edx, 0xffffffff
cmp ecx, eax
sbb ebx, ebx
and ebx, 0xc0000095
cmp ecx, eax
jb 0x10030805
lea eax, [edx + esi]
cmp eax, edx
jb 0x100307b7
mov ecx, eax
jmp 0x100307ba
or ecx, 0xffffffff
cmp eax, edx
mov esi, 0xc0000095
sbb ebx, ebx
and ebx, esi
cmp eax, edx
jb 0x10030805
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x100307d4
mov eax, edx
jmp 0x100307d7
or eax, 0xffffffff
cmp edx, ecx
sbb ebx, ebx
and ebx, esi
cmp edx, ecx
jb 0x10030805
lea ecx, [eax + edi]
cmp ecx, eax
jb 0x100307f2
mov edx, ecx
mov dword [ebp - 0xaf8], ecx
jmp 0x100307fb
or edx, 0xffffffff
mov dword [ebp - 0xaf8], edx
cmp ecx, eax
sbb ebx, ebx
and ebx, esi
cmp ecx, eax
jae 0x10030811
mov edx, dword [ebp - 0xd28]
mov dword [ebp - 0xaf8], edx
test ebx, ebx
js 0x10030966
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x10030839
mov ebx, 0xc0000017
jmp 0x10030966
mov ecx, dword [ebp - 0xae4]
mov eax, dword [ecx]
mov dword [esi], eax
lea eax, [esi + 4]
cmp eax, esi
jb 0x1003084e
mov edi, eax
jmp 0x10030851
or edi, 0xffffffff
cmp eax, esi
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, esi
jb 0x10030951
push dword [ecx]
push dword [ecx + 4]
push edi
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0xae4]
add esp, 0xc
mov eax, dword [edx]
add eax, edi
cmp eax, edi
jb 0x10030883
mov ecx, eax
jmp 0x10030886
or ecx, 0xffffffff
cmp eax, edi
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, edi
jb 0x10030951
mov eax, dword [edx + 8]
mov dword [ecx], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x100308a8
mov edi, eax
jmp 0x100308ab
or edi, 0xffffffff
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, ecx
jb 0x10030951
push dword [edx + 8]
push dword [edx + 0xc]
push edi
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0xae4]
add esp, 0xc
mov eax, dword [edx + 8]
add eax, edi
cmp eax, edi
jb 0x100308df
mov ecx, eax
jmp 0x100308e2
or ecx, 0xffffffff
cmp eax, edi
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, edi
jb 0x10030951
mov eax, dword [edx + 0x10]
mov dword [ecx], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x10030900
mov edi, eax
jmp 0x10030903
or edi, 0xffffffff
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, ecx
jb 0x10030951
push dword [edx + 0x10]
push dword [edx + 0x14]
push edi
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xae4]
add esp, 0xc
mov eax, dword [ecx + 0x10]
add eax, edi
cmp eax, edi
sbb ebx, ebx
xor ecx, ecx
and ebx, 0xc0000095
cmp eax, edi
jb 0x10030953
mov eax, dword [ebp - 0xaf8]
mov dword [ebp - 0xb04], esi
mov esi, ecx
mov dword [ebp - 0xb40], eax
jmp 0x10030953
xor ecx, ecx
test esi, esi
je 0x10030966
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
or ebx, 0x10000000
mov dword [ebp - 0xac4], ebx
jl 0x1003193c
xor eax, eax
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xaf8], eax
cmp dword [ebp - 0xb30], eax
jne 0x100309a0
mov ebx, 0xc000000d
mov edi, eax
mov dword [ebp - 0xac4], ebx
jmp 0x10030a39
xor ecx, ecx
inc ecx
cmp dword [ebp - 0xb38], ecx
jbe 0x1003098e
mov ecx, dword [ebp - 0xb30]
mov esi, eax
mov edi, dword [ecx]
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x100309c0
mov eax, edx
jmp 0x100309c3
or eax, 0xffffffff
cmp edx, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp edx, ecx
jb 0x10030a1b
lea ecx, [edi + eax]
mov edx, ecx
cmp ecx, eax
jae 0x100309e3
or ecx, 0xffffffff
cmp edx, eax
mov edi, 0xc0000095
sbb ebx, ebx
and ebx, edi
mov dword [ebp - 0xac4], ebx
cmp edx, eax
jb 0x10030a1b
xor eax, eax
inc esi
inc eax
cmp esi, eax
jb 0x100309b3
lea eax, [ecx + 4]
cmp eax, ecx
sbb ebx, ebx
and ebx, edi
mov dword [ebp - 0xac4], ebx
cmp eax, ecx
jb 0x10030a1b
mov eax, dword [ecx]
mov dword [ebp - 0xaf0], eax
test ebx, ebx
js 0x10030a33
cmp dword [ebp - 0xb38], 2
ja 0x10030a65
mov ebx, 0xc000000d
mov dword [ebp - 0xac4], ebx
mov edi, dword [ebp - 0xac8]
test ebx, ebx
js 0x1003193c
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x10030b7e
mov ebx, 0xd0000017
jmp 0x10031936
mov ecx, dword [ebp - 0xb30]
xor eax, eax
mov esi, eax
mov edi, dword [ecx]
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x10030a7c
mov eax, edx
jmp 0x10030a7f
or eax, 0xffffffff
cmp edx, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp edx, ecx
jb 0x10030ad4
lea ecx, [edi + eax]
mov edx, ecx
cmp ecx, eax
jae 0x10030a9f
or ecx, 0xffffffff
cmp edx, eax
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp edx, eax
jb 0x10030ad4
inc esi
cmp esi, 2
jb 0x10030a6f
lea eax, [ecx + 4]
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, ecx
jb 0x10030ad4
mov esi, dword [ecx]
jmp 0x10030ada
mov esi, dword [ebp - 0xaf8]
test ebx, ebx
js 0x10030a33
mov eax, dword [ebp - 0xaf0]
add eax, 0x50
cmp eax, 0x50
jb 0x10030af4
mov ecx, eax
jmp 0x10030af7
or ecx, 0xffffffff
cmp eax, 0x50
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp eax, 0x50
jb 0x10030b51
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x10030b18
mov eax, edx
jmp 0x10030b1b
or eax, 0xffffffff
cmp edx, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp edx, ecx
jb 0x10030b51
lea ecx, [eax + esi]
cmp ecx, eax
jb 0x10030b3a
mov edx, ecx
jmp 0x10030b3d
or edx, 0xffffffff
cmp ecx, eax
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp ecx, eax
jae 0x10030b57
mov edx, dword [ebp - 0xd24]
test ebx, ebx
js 0x10030a33
cmp edx, 0x400000
jbe 0x10030b71
mov ebx, 0x8000ffff
jmp 0x10031936
mov edi, edx
mov dword [ebp - 0xac8], edi
jmp 0x10030a39
mov dword [ebp - 0xafc], esi
mov eax, dword [ebp - 0xb04]
test eax, eax
jne 0x10030b98
mov ebx, 0x80070057
jmp 0x10031936
mov dword [ebp - 0xcd4], eax
xor ebx, ebx
mov eax, dword [ebp - 0xb40]
mov dword [ebp - 0xccc], eax
lea eax, [ebp - 0xc68]
push eax
xor eax, eax
mov dword [ebp - 0xcd0], esi
push 0x10006dc8
inc eax
mov dword [ebp - 0xcc8], edi
push eax
mov dword [ebp - 0xcc4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x10030c10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xac4], ebx
test ebx, ebx
jle 0x10030bfb
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xac4], ebx
test ebx, ebx
mov eax, dword [ebp - 0xac8]
js 0x10030c64
mov ebx, 0x80004005
mov dword [ebp - 0xac4], ebx
jmp 0x10030c64
push 0x10009210
push dword [ebp - 0xc68]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10030bd8
push ebx
push 0x14
lea eax, [ebp - 0xcd4]
mov ecx, edi
push eax
push 0x86
call dword [0x10089918]
call edi
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xac4], ebx
jl 0x10030c5e
mov eax, dword [ebp - 0xcc8]
mov dword [ebp - 0xac8], eax
jmp 0x10030c64
mov eax, dword [ebp - 0xac8]
cmp ebx, 0xd0000023
jne 0x10030c76
mov ebx, 0x8007007a
jmp 0x10031936
test ebx, ebx
js 0x1003193c
xor ecx, ecx
mov edi, ecx
cmp eax, 4
jae 0x10030c91
mov ebx, 0xc000003e
jmp 0x1003107b
mov ecx, dword [esi]
lea eax, [esi + 4]
mov dword [ebp - 0xaf8], ecx
cmp eax, esi
jb 0x10030caa
mov edx, eax
mov dword [ebp - 0xb2c], eax
jmp 0x10030cb3
or edx, 0xffffffff
mov dword [ebp - 0xb2c], edx
cmp eax, esi
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, esi
jb 0x10031079
mov eax, dword [ebp - 0xac8]
add eax, 0xfffffffc
cmp eax, ecx
jae 0x10030cdc
mov ebx, 0xc000003e
jmp 0x10031079
lea eax, [edx + ecx]
cmp eax, edx
jb 0x10030ce7
mov edx, eax
jmp 0x10030cea
or edx, 0xffffffff
cmp eax, dword [ebp - 0xb2c]
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, dword [ebp - 0xb2c]
jb 0x10031079
lea eax, [ecx + 4]
cmp eax, 4
jb 0x10030d10
mov ecx, eax
jmp 0x10030d13
or ecx, 0xffffffff
cmp eax, 4
mov esi, 0xc0000095
sbb ebx, ebx
and ebx, esi
cmp eax, 4
jb 0x10031079
mov eax, dword [ebp - 0xac8]
sub eax, ecx
cmp eax, 4
jb 0x10030cd2
mov eax, dword [edx]
mov dword [ebp - 0xb40], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x10030d4c
mov dword [ebp - 0xacc], eax
jmp 0x10030d53
or dword [ebp - 0xacc], 0xffffffff
cmp eax, edx
sbb ebx, ebx
and ebx, esi
cmp eax, edx
jb 0x10031079
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x10030d6c
mov esi, eax
jmp 0x10030d6f
or esi, 0xffffffff
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, ecx
jb 0x10031079
mov eax, dword [ebp - 0xac8]
mov edx, dword [ebp - 0xb40]
sub eax, esi
cmp eax, edx
jb 0x10030cd2
mov ebx, dword [ebp - 0xacc]
lea eax, [edx + ebx]
cmp eax, ebx
jb 0x10030da8
mov ecx, eax
jmp 0x10030dab
or ecx, 0xffffffff
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, dword [ebp - 0xacc]
jb 0x10031079
lea eax, [edx + esi]
cmp eax, esi
jb 0x10030dcc
mov edx, eax
jmp 0x10030dcf
or edx, 0xffffffff
cmp eax, esi
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, esi
jb 0x10031079
mov eax, dword [ebp - 0xac8]
sub eax, edx
cmp eax, 4
jb 0x10030cd2
mov esi, dword [ecx]
lea eax, [ecx + 4]
mov dword [ebp - 0xb0c], esi
cmp eax, ecx
jb 0x10030e09
mov dword [ebp - 0xb18], eax
jmp 0x10030e10
or dword [ebp - 0xb18], 0xffffffff
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, ecx
jb 0x10031079
lea eax, [edx + 4]
cmp eax, edx
jb 0x10030e2d
mov ecx, eax
jmp 0x10030e30
or ecx, 0xffffffff
cmp eax, edx
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, edx
jb 0x10031079
mov eax, dword [ebp - 0xac8]
sub eax, ecx
cmp eax, esi
jb 0x10030cd2
lea eax, [esi + ecx]
cmp eax, ecx
jb 0x10030e5d
mov edx, eax
jmp 0x10030e60
or edx, 0xffffffff
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, ecx
jb 0x10031079
mov eax, dword [ebp - 0xac8]
sub eax, edx
jne 0x10030cd2
mov ebx, dword [ebp - 0xb40]
mov ecx, dword [ebp - 0xaf8]
add ecx, 0xc
lea eax, [esi + ebx]
add eax, ecx
cmp eax, dword [ebp - 0xac8]
jne 0x10030cd2
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x10030ec1
mov ebx, 0xc0000017
jmp 0x10031004
cmp dword [ebp - 0xb2c], edi
je 0x10030f0e
mov eax, dword [ebp - 0xaf8]
push eax
push 8
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x10030ef1
mov ebx, 0xc0000017
xor eax, eax
jmp 0x10030f9d
mov dword [esi + 4], eax
mov ecx, dword [ebp - 0xaf8]
push ecx
push dword [ebp - 0xb2c]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0x10030f15
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
cmp dword [ebp - 0xacc], edi
je 0x10030f4b
push ebx
push 8
mov dword [esi + 8], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x10030ee5
mov dword [esi + 0xc], eax
push ebx
push dword [ebp - 0xacc]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0x10030f51
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
cmp dword [ebp - 0xb18], edi
je 0x10030f91
mov ebx, dword [ebp - 0xb0c]
push ebx
push 8
mov dword [esi + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x10030ee5
mov dword [esi + 0x14], eax
push ebx
push dword [ebp - 0xb18]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0x10030f97
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov edi, esi
mov ebx, eax
mov esi, eax
test esi, esi
je 0x10031004
cmp dword [esi + 4], 0
je 0x10030fbd
push dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0x10030fd9
push dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0x10030ff5
push dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
test ebx, ebx
js 0x10031012
mov dword [ebp - 0xadc], edi
mov edi, ecx
test edi, edi
je 0x1003107b
cmp dword [edi + 4], 0
je 0x10031032
push dword [edi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 4], ecx
cmp dword [edi + 0xc], 0
je 0x1003104e
push dword [edi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0xc], ecx
cmp dword [edi + 0x14], 0
je 0x1003106a
push dword [edi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0x14], ecx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
or ebx, 0x10000000
mov dword [ebp - 0xac4], ebx
jl 0x1003193c
mov eax, dword [ebp - 0xadc]
mov edi, ecx
mov dword [ebp - 0xb20], edi
mov dword [ebp - 0xb44], ecx
test eax, eax
jne 0x100310af
mov ebx, 0xd000000d
jmp 0x10031936
mov esi, dword [eax + 4]
mov dword [ebp - 0xb48], esi
test esi, esi
je 0x100310a5
mov ebx, dword [eax]
test ebx, ebx
je 0x100310a5
add ebx, 0xfffffff8
mov dword [ebp - 0xb58], ecx
push ebx
push ecx
mov dword [ebp - 0xb2c], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb50], eax
test eax, eax
je 0x10031701
xor ecx, ecx
mov dword [ebp - 0xb18], esi
mov dl, cl
mov dword [ebp - 0x410], 0xab69605e
mov ecx, 0x7f1137f
mov esi, ebx
mov dword [ebp - 0x40c], ecx
and esi, 7
mov ecx, eax
mov dword [ebp - 0xb28], esi
mov dword [ebp - 0xaf8], ecx
je 0x10031696
or dword [ebp - 0xb70], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0xb78], ebx
mov eax, ebx
mov dword [ebp - 0xac8], ebx
mov dword [ebp - 0xae8], eax
test esi, esi
je 0x1003119a
mov eax, dword [ebp - 0xb18]
push 0x38
pop edi
lea ecx, [eax + 1]
movzx eax, byte [eax]
mov dword [ebp - 0xb0c], ecx
cmp ebx, 4
jge 0x1003116e
lea ecx, [edi - 0x20]
shl eax, cl
or dword [ebp - 0xae8], eax
jmp 0x10031178
mov ecx, edi
shl eax, cl
or dword [ebp - 0xac8], eax
mov ecx, dword [ebp - 0xb0c]
inc ebx
sub edi, 8
mov eax, ecx
cmp ebx, esi
jl 0x10031150
mov eax, dword [ebp - 0xae8]
mov dword [ebp - 0xb18], ecx
mov ecx, dword [ebp - 0xaf8]
mov ebx, dword [ebp - 0xac8]
xor eax, 0x92f65a5
xor ebx, 0x699a899c
mov dword [ebp - 0xad8], eax
xor edi, edi
mov dword [ebp - 0xb78], eax
mov dword [ebp - 0xb70], ebx
test esi, esi
je 0x10031208
lea esi, [ecx + 1]
mov dword [ebp - 0xb40], esi
cmp edi, 4
jge 0x100311d8
rol eax, 8
mov byte [ecx], al
jmp 0x100311dd
rol ebx, 8
mov byte [ecx], bl
mov esi, dword [ebp - 0xb28]
inc edi
mov ecx, dword [ebp - 0xb40]
cmp edi, esi
jl 0x100311c3
mov ebx, dword [ebp - 0xb70]
mov eax, ecx
mov dword [ebp - 0xaf8], eax
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0xad8], eax
add esi, 0xfffffffc
test esi, esi
jle 0x10031664
push 4
pop ecx
sub ecx, esi
shl ecx, 3
shr ebx, cl
shl ebx, cl
mov dword [ebp - 0xbc0], ebx
mov dword [ebp - 0xb70], ebx
mov edi, dword [ebp - 0xad8]
mov ebx, dword [ebp - 0xb2c]
mov eax, ebx
shr eax, 3
mov dword [ebp - 0xaf0], eax
test eax, eax
je 0x10031625
movzx esi, word [ebp - 0x40e]
mov eax, 0x7f1137f
mov ecx, eax
mov dword [ebp - 0xad0], esi
mov esi, dword [ebp - 0xbc0]
movzx eax, ax
shr ecx, 0x10
mov dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0xaf8]
mov dword [ebp - 0xacc], ecx
add eax, 7
mov ecx, dword [ebp - 0xb18]
add ecx, 2
mov dword [ebp - 0xb40], eax
mov dword [ebp - 0xac4], ecx
movzx ebx, byte [ecx - 2]
movzx eax, byte [ecx - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 1]
movzx ecx, byte [ecx + 2]
shl ecx, 8
shl ebx, 8
or ebx, eax
mov eax, dword [ebp - 0xac4]
xor edi, ebx
mov dword [ebp - 0xb0c], ebx
mov ebx, 0x7f1137f
movzx eax, byte [eax + 3]
or ecx, eax
mov eax, dword [ebp - 0xac4]
shl ecx, 8
movzx eax, byte [eax + 4]
or ecx, eax
mov eax, dword [ebp - 0xac4]
shl ecx, 8
add dword [ebp - 0xac4], 8
movzx eax, byte [eax + 5]
or ecx, eax
mov eax, dword [ebp - 0xaec]
xor esi, ecx
mov dword [ebp - 0xb28], ecx
xor ebx, esi
xor ebx, edi
xor ebx, 0xab69605e
mov ecx, ebx
rol ecx, 0xa
lea esi, [ebx + 0x54969fa2]
rol esi, 5
imul eax, esi
mov esi, 0x7f1137f
add ecx, eax
mov eax, dword [ebp - 0xad0]
xor edi, ecx
mov ecx, edi
rol ecx, 2
lea esi, [esi + edi]
ror esi, 9
imul eax, esi
mov esi, dword [ebp - 0xad0]
sub eax, ecx
xor ebx, eax
mov eax, ebx
sub eax, dword [ebp - 0xaec]
imul ecx, eax, 0x605e
mov eax, ebx
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0xacc]
xor edi, ecx
xor esi, edi
mov ecx, edi
rol esi, 6
imul eax, esi
mov esi, 0x7f1137f
rol ecx, 2
sub eax, ecx
xor ebx, eax
mov eax, esi
mov ecx, ebx
xor ecx, 0xab69605e
sub eax, ecx
xor edi, eax
mov eax, dword [ebp - 0xaec]
xor eax, edi
mov ecx, edi
imul eax, dword [ebp - 0xad0]
ror ecx, 6
xor ecx, eax
xor ebx, ecx
mov ecx, ebx
lea eax, [esi + ebx]
ror eax, 0xf
imul eax, eax, 0x605e
rol ecx, 2
add ecx, eax
mov eax, dword [ebp - 0xacc]
xor edi, ecx
mov ecx, edi
rol ecx, 8
lea esi, [edi + 0x54969fa2]
ror esi, 0xe
imul eax, esi
sub eax, ecx
xor ebx, eax
mov eax, dword [ebp - 0xaec]
mov esi, ebx
mov ecx, ebx
ror ecx, 0xa
xor esi, 0xab69605e
ror esi, 0xc
imul eax, esi
mov esi, dword [ebp - 0xacc]
xor ecx, eax
xor edi, ecx
mov ecx, esi
xor ecx, edi
mov eax, edi
imul ecx, dword [ebp - 0xad0]
shr eax, 0xa
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xaec]
mov eax, ebx
not eax
ror eax, 5
add eax, 0x605e
imul eax, esi
xor edi, eax
mov eax, esi
mov dword [ebp - 0xad8], edi
sub edi, esi
xor edi, ebx
mov ebx, dword [ebp - 0xad8]
xor edi, 0xab69605e
xor eax, edi
rol eax, 2
imul ecx, eax
mov eax, edi
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov esi, ebx
mov ecx, ebx
sub esi, eax
rol ecx, 7
mov eax, dword [ebp - 0xad0]
ror esi, 6
imul eax, esi
mov esi, dword [ebp - 0xad0]
add ecx, eax
mov eax, dword [ebp - 0xaec]
xor edi, ecx
xor eax, edi
mov ecx, edi
imul eax, eax, 0x605e
ror ecx, 9
add ecx, eax
mov eax, dword [ebp - 0xacc]
xor ebx, ecx
xor esi, ebx
mov dword [ebp - 0xad8], ebx
rol esi, 5
mov ecx, ebx
imul eax, esi
rol ecx, 7
add ecx, eax
xor edi, ecx
mov ecx, 0x7f1137f
mov ebx, ecx
xor ebx, edi
xor ebx, dword [ebp - 0xad8]
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xad0]
imul eax, dword [ebp - 0xaec]
xor edi, eax
mov eax, edi
sub eax, ecx
mov ecx, edi
ror eax, 1
imul eax, eax, 0x605e
ror ecx, 6
sub eax, ecx
xor ebx, eax
mov eax, dword [ebp - 0xacc]
mov ecx, ebx
rol ecx, 0xe
lea esi, [ebx - 0x54969fa2]
rol esi, 3
imul eax, esi
add ecx, eax
mov eax, dword [ebp - 0xaec]
xor edi, ecx
mov ecx, edi
ror ecx, 0xe
lea esi, [edi - 0x54969fa2]
rol esi, 0xf
imul eax, esi
sub eax, ecx
xor ebx, eax
mov ecx, ebx
mov eax, ebx
shr eax, 3
xor ecx, 0x605e
imul ecx, dword [ebp - 0xad0]
xor ecx, eax
mov eax, 0x7f1137f
xor edi, ecx
xor eax, edi
mov ecx, edi
xor edi, dword [ebp - 0xac8]
rol eax, 4
imul eax, eax, 0x605e
rol ecx, 2
mov dword [ebp - 0xb70], edi
xor ecx, eax
xor ecx, dword [ebp - 0xae8]
xor ebx, ecx
mov ecx, dword [ebp - 0xb40]
mov dword [ebp - 0xb78], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb70]
ror dword [ebp - 0xb78], 8
mov byte [ecx], al
mov al, byte [ebp - 0xb78]
ror dword [ebp - 0xb70], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb70]
ror dword [ebp - 0xb78], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xb78]
ror dword [ebp - 0xb70], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xb70]
ror dword [ebp - 0xb78], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xb70], 8
mov al, byte [ebp - 0xb78]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb70]
mov byte [ecx - 3], al
mov edi, dword [ebp - 0xb78]
mov esi, dword [ebp - 0xb70]
mov eax, dword [ebp - 0xb0c]
ror edi, 8
ror esi, 8
add ecx, 8
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0xb28]
mov dword [ebp - 0xb78], edi
mov dword [ebp - 0xb70], esi
mov dword [ebp - 0xac8], eax
sub dword [ebp - 0xaf0], 1
mov dword [ebp - 0xb40], ecx
mov ecx, dword [ebp - 0xac4]
jne 0x10031294
mov ebx, dword [ebp - 0xb2c]
mov esi, dword [ebp - 0xb50]
xor eax, eax
mov ecx, eax
test ebx, ebx
je 0x1003163b
xor dl, byte [ecx + esi]
inc ecx
cmp ecx, ebx
jb 0x10031633
mov ecx, dword [ebp - 0xb48]
movzx eax, dl
cdq
cmp eax, dword [ebx + ecx]
jne 0x100316c0
cmp edx, dword [ebx + ecx + 4]
jne 0x100316c0
xor eax, eax
mov dword [ebp - 0xb44], ebx
mov ebx, dword [ebp - 0xb58]
mov edi, esi
mov esi, eax
jmp 0x100316cd
xor ecx, ecx
mov dword [ebp - 0xbc0], ecx
mov dword [ebp - 0xb70], ecx
test esi, esi
jns 0x1003122b
neg esi
shl esi, 3
mov ecx, esi
shr eax, cl
shl eax, cl
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xb78], eax
jmp 0x1003122b
xor eax, eax
or dword [ebp - 0xac8], 0xffffffff
mov ecx, eax
mov dword [ebp - 0xae8], eax
mov edi, eax
mov dword [ebp - 0xbc0], ecx
mov dword [ebp - 0xb70], ecx
mov dword [ebp - 0xb78], edi
jmp 0x10031237
mov edi, dword [ebp - 0xb20]
mov ebx, 0xc004d501
xor eax, eax
test esi, esi
je 0x100316e0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
js 0x10031701
mov esi, dword [ebp - 0xb44]
xor eax, eax
mov dword [ebp - 0xb88], edi
mov ebx, 0x10000000
mov edi, eax
mov dword [ebp - 0xb24], esi
jmp 0x1003170e
mov esi, dword [ebp - 0xb24]
mov ebx, 0xd0000001
xor eax, eax
mov dword [ebp - 0xac4], ebx
test edi, edi
je 0x10031727
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
js 0x1003193c
cmp esi, 4
jb 0x1003192b
mov edx, dword [ebp - 0xb88]
mov eax, dword [edx]
mov dword [ebp - 0xb58], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x10031751
mov ecx, eax
jmp 0x10031754
or ecx, 0xffffffff
cmp eax, edx
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, edx
jb 0x10031930
lea eax, [esi - 4]
cmp eax, 4
jb 0x1003192b
mov edi, dword [ecx]
lea eax, [ecx + 4]
mov dword [ebp - 0xb20], edi
cmp eax, ecx
jb 0x10031785
mov esi, eax
jmp 0x10031788
or esi, 0xffffffff
cmp eax, ecx
mov edx, 0xc0000095
sbb ebx, ebx
and ebx, edx
cmp eax, ecx
jb 0x10031930
mov ecx, dword [ebp - 0xb24]
lea eax, [ecx - 8]
cmp eax, edi
jb 0x1003192b
lea eax, [edi + 8]
cmp eax, 8
sbb ebx, ebx
and ebx, edx
cmp eax, 8
jb 0x10031930
mov ebx, dword [ebp - 0xb88]
lea edx, [edi + esi]
lea eax, [ecx + ebx]
cmp eax, edx
jb 0x1003192b
sub ecx, edi
sub ecx, esi
add ecx, ebx
cmp ecx, 8
jae 0x1003192b
xor ecx, ecx
mov dword [ebp - 0xaf8], ecx
mov eax, ecx
mov dword [ebp - 0xb24], eax
mov ebx, ecx
test esi, esi
je 0x100318c2
mov ecx, esi
cmp edx, esi
jb 0x10031806
mov edi, edx
jmp 0x10031809
or edi, 0xffffffff
cmp edx, esi
sbb ebx, ebx
and ebx, 0xc0000095
cmp edx, esi
jb 0x10031919
cmp esi, edi
jae 0x100318b8
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x1003182e
mov edx, eax
jmp 0x10031831
or edx, 0xffffffff
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, ecx
jb 0x10031919
cmp edx, edi
ja 0x100318e7
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0x10031859
mov edx, eax
jmp 0x1003185c
or edx, 0xffffffff
cmp eax, 4
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, 4
jb 0x10031874
mov dword [ebp - 0xcac], edx
jmp 0x1003187a
mov edx, dword [ebp - 0xcac]
cmp eax, 4
jb 0x10031919
add edx, ecx
cmp edx, ecx
jb 0x1003188d
mov eax, edx
jmp 0x10031890
or eax, 0xffffffff
cmp edx, ecx
sbb ebx, ebx
and ebx, 0xc0000095
cmp edx, ecx
jb 0x10031919
cmp eax, edi
ja 0x100318e7
inc dword [ebp - 0xaf8]
mov ecx, eax
cmp eax, edi
jb 0x10031823
mov eax, dword [ebp - 0xb24]
cmp ecx, edi
jne 0x100318e7
mov edi, dword [ebp - 0xb20]
test edi, edi
je 0x100318f2
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb24], eax
test eax, eax
jne 0x100318ee
mov ebx, 0xc0000017
jmp 0x10031919
mov ebx, 0xc000000d
jmp 0x10031930
xor ecx, ecx
mov ebx, ecx
test esi, esi
je 0x10031907
push edi
push esi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xb24]
add esp, 0xc
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xaf8]
mov dword [ebp - 0xbe4], eax
test ebx, ebx
js 0x10031930
mov eax, dword [ebp - 0xb58]
cmp eax, dword [ebp - 0xbe4]
je 0x10031930
mov ebx, 0xc000003e
or ebx, 0x10000000
mov dword [ebp - 0xac4], ebx
mov eax, dword [ebp - 0xb54]
test eax, eax
je 0x10031957
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp - 0xae4]
test esi, esi
je 0x100319c5
xor eax, eax
cmp dword [esi + 4], eax
je 0x1003197e
push dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0x1003199a
push dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0x100319b6
push dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb04]
test eax, eax
je 0x100319e0
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xafc]
test eax, eax
je 0x100319fb
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp - 0xadc]
test esi, esi
je 0x10031a69
xor eax, eax
cmp dword [esi + 4], eax
je 0x10031a22
push dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0x10031a3e
push dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0x10031a5a
push dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb88]
test eax, eax
je 0x10031a84
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
js 0x1002f5dc
xor eax, eax
inc eax
cmp dword [ebp - 0xbe4], eax
jae 0x10031aa1
mov ebx, 0xc004d501
jmp 0x1002f5d6
cmp dword [ebp - 0xbdc], 0
jne 0x10031b2e
mov ebx, 0xc000000d
mov dword [ebp - 0xac4], ebx
mov eax, dword [ebp - 0xb1c]
test ebx, ebx
js 0x1002f5dc
cmp eax, 0xd0000023
jne 0x10031ad9
mov eax, 0x8007007a
mov dword [ebp - 0xb1c], eax
cmp eax, 0x8007007a
je 0x10031af0
mov ebx, eax
mov dword [ebp - 0xac4], ebx
test eax, eax
js 0x1002f5dc
cmp dword [ebp - 0xbe4], 6
jne 0x10031a97
cmp dword [ebp - 0xbdc], 0
jne 0x10031ba1
mov edx, dword [ebp - 0xc9c]
mov ebx, 0xc000000d
mov ecx, dword [ebp - 0xca0]
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xb04], edx
mov dword [ebp - 0xadc], ecx
jmp 0x10031c66
cmp dword [ebp - 0xbe4], 0
jbe 0x10031aae
mov eax, dword [ebp - 0xbdc]
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x10031b4e
mov esi, ecx
jmp 0x10031b51
or esi, 0xffffffff
cmp ecx, dword [ebp - 0xbdc]
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp ecx, dword [ebp - 0xbdc]
jb 0x10031b77
mov eax, edx
neg eax
sbb eax, eax
and eax, esi
jmp 0x10031b83
mov edx, dword [ebp - 0xd20]
mov eax, dword [ebp - 0xd34]
test ebx, ebx
js 0x10031ab9
cmp edx, 4
jne 0x1002f77c
mov eax, dword [eax]
mov dword [ebp - 0xb1c], eax
jmp 0x10031abf
mov eax, dword [ebp - 0xbdc]
xor ecx, ecx
mov esi, ecx
mov edi, dword [eax]
lea edx, [eax + 4]
cmp edx, eax
jb 0x10031bb8
mov ecx, edx
jmp 0x10031bbb
or ecx, 0xffffffff
cmp edx, eax
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp edx, eax
jb 0x10031c22
lea eax, [edi + ecx]
mov edx, eax
cmp eax, ecx
jae 0x10031bdb
or eax, 0xffffffff
cmp edx, ecx
mov edi, 0xc0000095
sbb ebx, ebx
and ebx, edi
mov dword [ebp - 0xac4], ebx
cmp edx, ecx
jb 0x10031c22
xor ecx, ecx
inc esi
inc ecx
cmp esi, ecx
jb 0x10031bab
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x10031c05
mov esi, ecx
jmp 0x10031c08
or esi, 0xffffffff
cmp ecx, eax
sbb ebx, ebx
and ebx, edi
mov dword [ebp - 0xac4], ebx
cmp ecx, eax
jb 0x10031c22
mov eax, edx
neg eax
sbb eax, eax
and eax, esi
jmp 0x10031c2e
mov edx, dword [ebp - 0xd08]
mov eax, dword [ebp - 0xcfc]
test ebx, ebx
js 0x10031c4e
cmp edx, 8
jne 0x1002f77c
mov ecx, dword [eax]
mov dword [ebp - 0xadc], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xb04], ecx
jmp 0x10031c66
mov eax, dword [ebp - 0xc9c]
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp - 0xca0]
mov dword [ebp - 0xadc], eax
test ebx, ebx
js 0x1002f5dc
cmp dword [ebp - 0xbdc], 0
jne 0x10031cad
mov ebx, 0xc000000d
mov dword [ebp - 0xac4], ebx
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0xacc], eax
test ebx, ebx
js 0x1002f5dc
cmp dword [ebp - 0xbdc], 0
jne 0x10031d50
mov ebx, 0xc000000d
jmp 0x1002f5d6
mov eax, dword [ebp - 0xbdc]
xor ecx, ecx
mov esi, ecx
mov edi, dword [eax]
lea edx, [eax + 4]
cmp edx, eax
jb 0x10031cc4
mov ecx, edx
jmp 0x10031cc7
or ecx, 0xffffffff
cmp edx, eax
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp edx, eax
jb 0x10031d2c
lea eax, [edi + ecx]
mov edx, eax
cmp eax, ecx
jae 0x10031ce7
or eax, 0xffffffff
cmp edx, ecx
mov edi, 0xc0000095
sbb ebx, ebx
and ebx, edi
mov dword [ebp - 0xac4], ebx
cmp edx, ecx
jb 0x10031d2c
inc esi
cmp esi, 2
jb 0x10031cb7
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x10031d0f
mov esi, ecx
jmp 0x10031d12
or esi, 0xffffffff
cmp ecx, eax
sbb ebx, ebx
and ebx, edi
mov dword [ebp - 0xac4], ebx
cmp ecx, eax
jb 0x10031d2c
mov eax, edx
neg eax
sbb eax, eax
and eax, esi
jmp 0x10031d38
mov edx, dword [ebp - 0xd18]
mov eax, dword [ebp - 0xd0c]
test ebx, ebx
js 0x10031c82
cmp edx, 4
jne 0x1002f77c
mov eax, dword [eax]
jmp 0x10031c88
mov eax, dword [ebp - 0xbdc]
xor ecx, ecx
mov esi, ecx
mov edi, dword [eax]
lea edx, [eax + 4]
cmp edx, eax
jb 0x10031d67
mov ecx, edx
jmp 0x10031d6a
or ecx, 0xffffffff
cmp edx, eax
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp edx, eax
jb 0x10031dd8
lea eax, [edi + ecx]
mov edx, eax
cmp eax, ecx
jae 0x10031d8a
or eax, 0xffffffff
cmp edx, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp edx, ecx
jb 0x10031dd8
inc esi
cmp esi, 3
jb 0x10031d5a
mov edi, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xb44], edi
cmp ecx, eax
jb 0x10031db7
mov esi, ecx
jmp 0x10031dba
or esi, 0xffffffff
cmp ecx, eax
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp ecx, eax
jb 0x10031dd8
mov edx, edi
neg edx
sbb edx, edx
and edx, esi
jmp 0x10031dea
mov eax, dword [ebp - 0xd04]
mov edx, dword [ebp - 0xd00]
mov dword [ebp - 0xb44], eax
test ebx, ebx
js 0x1002f5dc
mov eax, dword [ebp - 0xbdc]
xor ecx, ecx
mov edi, ecx
mov ecx, dword [eax]
lea esi, [eax + 4]
mov dword [ebp - 0xb20], ecx
cmp esi, eax
jb 0x10031e0f
mov ecx, esi
jmp 0x10031e12
or ecx, 0xffffffff
cmp esi, eax
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp esi, eax
jb 0x10031e7f
mov eax, dword [ebp - 0xb20]
add eax, ecx
mov esi, eax
cmp eax, ecx
jae 0x10031e37
or eax, 0xffffffff
cmp esi, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp esi, ecx
jb 0x10031e7f
inc edi
cmp edi, 4
jb 0x10031dfc
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x10031e5e
mov edi, ecx
jmp 0x10031e61
or edi, 0xffffffff
cmp ecx, eax
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp ecx, eax
jb 0x10031e7f
mov eax, esi
neg eax
sbb eax, eax
and eax, edi
jmp 0x10031e8b
mov esi, dword [ebp - 0xcf8]
mov eax, dword [ebp - 0xd1c]
test ebx, ebx
js 0x10031e9c
cmp esi, 4
jne 0x1002f77c
mov eax, dword [eax]
jmp 0x10031ea2
mov eax, dword [ebp - 0xd4c]
mov dword [ebp - 0xafc], eax
test ebx, ebx
js 0x1002f5dc
mov eax, dword [ebp - 0xbdc]
xor ecx, ecx
mov edi, ecx
mov ecx, dword [eax]
lea esi, [eax + 4]
mov dword [ebp - 0xb20], ecx
cmp esi, eax
jb 0x10031ecd
mov ecx, esi
jmp 0x10031ed0
or ecx, 0xffffffff
cmp esi, eax
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp esi, eax
jb 0x10031f3d
mov eax, dword [ebp - 0xb20]
add eax, ecx
mov esi, eax
cmp eax, ecx
jae 0x10031ef5
or eax, 0xffffffff
cmp esi, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp esi, ecx
jb 0x10031f3d
inc edi
cmp edi, 5
jb 0x10031eba
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x10031f1c
mov edi, ecx
jmp 0x10031f1f
or edi, 0xffffffff
cmp ecx, eax
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xac4], ebx
cmp ecx, eax
jb 0x10031f3d
mov eax, esi
neg eax
sbb eax, eax
and eax, edi
jmp 0x10031f49
mov esi, dword [ebp - 0xd44]
mov eax, dword [ebp - 0xd40]
test ebx, ebx
js 0x10031f5a
cmp esi, 4
jne 0x1002f77c
mov ecx, dword [eax]
jmp 0x10031f60
mov ecx, dword [ebp - 0xb14]
test ebx, ebx
js 0x1002f5dc
mov eax, dword [ebp - 0xb4c]
cmp eax, dword [ebp - 0xadc]
jne 0x10031a97
mov eax, dword [ebp - 0xb08]
cmp eax, dword [ebp - 0xb04]
jne 0x10031a97
cmp dword [ebp - 0xafc], 4
mov dword [ebp - 0xaf4], ecx
jbe 0x10031fb7
mov eax, dword [ebp - 0xacc]
mov ebx, 0x8007007a
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xbf0], eax
jmp 0x1002f5dc
mov eax, dword [ebp - 0xb44]
cmp eax, 4
ja 0x10031f9b
push eax
push edx
push dword [ebp - 0xad4]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xacc]
add esp, 0xc
mov dword [ebp - 0xbf0], eax
test ebx, ebx
js 0x1002f5dc
mov eax, dword [ebp - 0xb1c]
mov esi, dword [ebp - 0xac0]
test eax, eax
je 0x1002f5e2
mov ebx, eax
jmp 0x1002f583
xor eax, eax
test esi, esi
je 0x10032016
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xae0]
test eax, eax
je 0x10032031
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
js 0x1002f440
mov eax, dword [ebp - 0xaf4]
test eax, eax
je 0x10038b65
mov dword [0x1008839c], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x2cc]
xor ebx, ebx
push eax
push 0x10000000
mov dword [ebp - 0xc60], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x10036acc
cmp eax, esi
jne 0x10032087
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x10036acc
mov esi, dword [0x10087c5c]
mov ecx, esi
push 0x403
push ebx
push ebx
call dword [0x10089918]
call esi
mov dword [ebp - 0xaec], eax
test eax, eax
jne 0x100320b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10036acc
mov esi, dword [0x10087c2c]
mov ecx, esi
call dword [0x10089918]
call esi
mov dword [0x10088aa8], eax
mov eax, dword [0x1008839c]
push 0x54
mov dword [ebp - 0xb28], eax
lea eax, [ebp - 0x7c8]
push ebx
push eax
mov dword [0x10088aac], edx
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0xca8], ebx
lea edi, [ebp - 0x360]
mov dword [ebp - 0xca4], ebx
stosd dword es:[edi], eax
push 0x2c
push ebx
mov dword [ebp - 0xad8], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xb0c], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x4b4]
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [ebp - 0xaf0], ebx
xor ebx, ebx
mov esi, 0x10088ab8
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x1003212b
mov eax, dword [0x10088ab4]
push 0
pop ebx
test eax, eax
jne 0x10032788
push 0x338
push ebx
mov dword [ebp - 0xadc], ebx
mov dword [ebp - 0xad0], ebx
mov dword [ebp - 0xb08], ebx
mov dword [ebp - 0xb40], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xb58], edi
test edi, edi
je 0x1003277a
or dword [ebp - 0xafc], 0xffffffff
mov eax, 0x7f1137f
mov dword [ebp - 0x404], eax
mov cl, bl
mov eax, ebx
mov dword [ebp - 0x408], 0xab69605e
movzx esi, word [ebp - 0x406]
mov dword [ebp - 0xacc], eax
mov dword [ebp - 0xbb0], eax
mov eax, 0x7f1137f
mov edx, eax
mov dword [ebp - 0xac0], esi
shr edx, 0x10
mov esi, ebx
add edi, 7
movzx eax, ax
mov dword [ebp - 0xb44], edi
mov edi, 0x1000723a
mov dword [ebp - 0xae0], ebx
mov dword [ebp - 0xb80], ebx
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xaf4], edx
mov dword [ebp - 0xb50], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
movzx edx, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edx, 8
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 3]
or edx, eax
mov dword [ebp - 0xad4], ebx
movzx eax, byte [edi + 4]
xor esi, ebx
shl edx, 8
mov ebx, esi
or edx, eax
mov dword [ebp - 0xacc], esi
movzx eax, byte [edi + 5]
add edi, 8
shl edx, 8
or edx, eax
mov dword [ebp - 0xb20], edi
mov eax, dword [ebp - 0xac8]
mov edi, 0x7f1137f
xor edi, edx
mov dword [ebp - 0xb14], edx
xor edi, dword [ebp - 0xb80]
xor edi, ebx
xor edi, 0xab69605e
mov edx, edi
rol edx, 0xa
lea esi, [edi + 0x54969fa2]
rol esi, 5
imul eax, esi
mov esi, 0x7f1137f
add edx, eax
mov eax, dword [ebp - 0xac0]
xor ebx, edx
mov edx, ebx
rol edx, 2
lea esi, [esi + ebx]
ror esi, 9
imul eax, esi
mov esi, dword [ebp - 0xac0]
sub eax, edx
xor edi, eax
mov eax, edi
sub eax, dword [ebp - 0xac8]
imul edx, eax, 0x605e
mov eax, edi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xaf4]
xor ebx, edx
xor esi, ebx
mov edx, ebx
rol esi, 6
imul eax, esi
mov esi, 0x7f1137f
rol edx, 2
sub eax, edx
xor edi, eax
mov eax, esi
mov edx, edi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, dword [ebp - 0xac8]
xor eax, ebx
mov edx, ebx
imul eax, dword [ebp - 0xac0]
ror edx, 6
xor edx, eax
xor edi, edx
mov edx, edi
lea eax, [esi + edi]
ror eax, 0xf
imul eax, eax, 0x605e
rol edx, 2
add edx, eax
mov eax, dword [ebp - 0xaf4]
xor ebx, edx
mov edx, ebx
rol edx, 8
lea esi, [ebx + 0x54969fa2]
ror esi, 0xe
imul eax, esi
sub eax, edx
xor edi, eax
mov eax, dword [ebp - 0xac8]
mov esi, edi
mov edx, edi
ror edx, 0xa
xor esi, 0xab69605e
ror esi, 0xc
imul eax, esi
mov esi, dword [ebp - 0xaf4]
xor edx, eax
xor ebx, edx
mov edx, esi
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0xac0]
shr eax, 0xa
xor edx, eax
xor edx, edi
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, esi
xor ebx, eax
mov eax, esi
mov edi, ebx
sub edi, esi
xor edi, edx
mov edx, dword [ebp - 0xac8]
xor edi, 0xab69605e
xor eax, edi
rol eax, 2
imul edx, eax
mov eax, edi
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov esi, ebx
mov edx, ebx
sub esi, eax
rol edx, 7
mov eax, dword [ebp - 0xac0]
ror esi, 6
imul eax, esi
mov esi, dword [ebp - 0xac0]
add edx, eax
mov eax, dword [ebp - 0xac8]
xor edi, edx
xor eax, edi
mov edx, edi
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
mov eax, dword [ebp - 0xaf4]
xor ebx, edx
xor esi, ebx
mov dword [ebp - 0xacc], ebx
rol esi, 5
mov edx, ebx
imul eax, esi
rol edx, 7
add edx, eax
xor edi, edx
mov edx, 0x7f1137f
mov ebx, edi
xor ebx, edx
xor ebx, dword [ebp - 0xacc]
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xac0]
imul eax, dword [ebp - 0xac8]
xor edi, eax
mov eax, edi
sub eax, edx
mov edx, edi
ror eax, 1
imul eax, eax, 0x605e
ror edx, 6
sub eax, edx
xor ebx, eax
mov eax, ebx
rol eax, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [ebp - 0xaf4]
add eax, edx
xor edi, eax
mov eax, dword [ebp - 0xac8]
mov edx, edi
ror edx, 0xe
lea esi, [edi - 0x54969fa2]
rol esi, 0xf
imul eax, esi
sub eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, 0x605e
shr eax, 3
imul edx, dword [ebp - 0xac0]
xor edx, eax
mov eax, 0x7f1137f
xor edi, edx
xor eax, edi
mov edx, edi
xor edi, dword [ebp - 0xafc]
rol eax, 4
imul eax, eax, 0x605e
rol edx, 2
mov dword [ebp - 0xb80], edi
mov edi, dword [ebp - 0xb20]
xor edx, eax
xor edx, dword [ebp - 0xae0]
xor ebx, edx
mov edx, dword [ebp - 0xb44]
mov dword [ebp - 0xbb0], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb80]
ror dword [ebp - 0xbb0], 8
mov byte [edx], al
mov al, byte [ebp - 0xbb0]
ror dword [ebp - 0xb80], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb80]
ror dword [ebp - 0xbb0], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xbb0]
ror dword [ebp - 0xb80], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb80]
ror dword [ebp - 0xbb0], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xbb0]
ror dword [ebp - 0xb80], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb80]
mov byte [edx - 3], al
add edx, 8
mov esi, dword [ebp - 0xbb0]
mov eax, dword [ebp - 0xad4]
ror dword [ebp - 0xb80], 8
ror esi, 8
sub dword [ebp - 0xb50], 1
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0xb14]
mov dword [ebp - 0xbb0], esi
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0xb44], edx
jne 0x100321fb
mov ebx, dword [ebp - 0xb58]
xor eax, eax
mov edx, eax
xor cl, byte [edx + ebx]
inc edx
cmp edx, 0x338
jb 0x10032578
movzx eax, cl
cdq
cmp eax, dword [0x10007570]
jne 0x100325ab
cmp edx, dword [0x10007574]
jne 0x100325ab
mov esi, ebx
xor eax, eax
mov dword [ebp - 0xb08], esi
mov ebx, eax
mov edi, 0x337
jmp 0x100325c0
mov esi, dword [ebp - 0xb08]
or edi, 0xffffffff
mov dword [ebp - 0xb40], 0xc004d501
xor eax, eax
test ebx, ebx
je 0x100325d3
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xb40], 0
jl 0x1003277a
mov ebx, dword [ebp - 0xb08]
xor eax, eax
push 0x40
push eax
push 0x100883a0
mov byte [edi + ebx], al
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [ebx], 0
je 0x10032717
mov edi, 0x100883a0
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xb74]
jne 0x10032610
sub ecx, ebx
xor ebx, ebx
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x1003277a
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xad0], ecx
cmp word [eax], dx
je 0x1003265a
mov ecx, 0xc000007b
mov dword [ebp - 0xad0], ecx
jmp 0x100326a2
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x1003264d
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x1003264d
cmp dword [edx], 0x4550
jne 0x1003264d
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xbc4]
je 0x10032690
cmp ax, word [ebp - 0xb5c]
je 0x10032690
mov ecx, 0xc000000d
jmp 0x10032652
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb20], eax
test eax, eax
je 0x1003270b
mov edx, esi
mov dword [ebp - 0xb14], esi
lea eax, [edx + 1]
mov dword [ebp - 0xad4], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x100326c3
sub edx, dword [ebp - 0xad4]
inc esi
add esi, edx
test ecx, ecx
js 0x100326fc
push dword [ebp - 0xb14]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10032717
mov ecx, dword [ebp - 0xadc]
mov dword [ecx*4 + 0x10087be0], eax
mov ecx, dword [ebp - 0xad0]
inc dword [ebp - 0xadc]
inc ebx
cmp ebx, dword [ebp - 0xb20]
jb 0x100326b2
add edi, 0x10
cmp byte [esi], 0
jne 0x10032609
mov ebx, dword [ebp - 0xad0]
mov eax, dword [ebp - 0xb08]
test eax, eax
je 0x10032738
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jns 0x10032781
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0x100883a0]
test eax, eax
je 0x10032751
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10032740
push 0x40
push ebx
push 0x100883a0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x10002d80
mov edi, 0x10087be0
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x1003278e
mov ebx, 0xc000007a
jmp 0x1003271d
mov eax, dword [0x10088ab4]
xor ebx, ebx
inc eax
mov dword [0x10088ab4], eax
xor eax, eax
mov edx, 0x10088ab8
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0xc58]
mov word [ebp - 0x14], bx
stosd dword es:[edi], eax
mov dword [ebp - 0xb4c], ebx
mov dword [ebp - 0xb88], ebx
mov dword [ebp - 0xc04], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x3d0]
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x100327c9
mov eax, dword [0x10088ab4]
push 0
pop ebx
test eax, eax
jne 0x10032e46
push 0x338
push ebx
mov dword [ebp - 0xadc], ebx
mov dword [ebp - 0xad0], ebx
mov dword [ebp - 0xb08], ebx
mov dword [ebp - 0xb40], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xb20], edi
test edi, edi
je 0x10032e38
or dword [ebp - 0xafc], 0xffffffff
mov eax, 0x7f1137f
mov dword [ebp - 0x3fc], eax
mov cl, bl
mov eax, ebx
mov dword [ebp - 0x400], 0xab69605e
movzx esi, word [ebp - 0x3fe]
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0xacc], eax
mov dword [ebp - 0xbac], eax
mov eax, 0x7f1137f
mov edx, eax
mov dword [ebp - 0xac8], esi
shr edx, 0x10
mov esi, ebx
add edi, 7
mov dword [ebp - 0xb1c], edx
movzx eax, ax
mov edx, 0x1000723a
mov dword [ebp - 0xb44], edi
mov edi, ebx
mov dword [ebp - 0xae0], ebx
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xaf4], edx
mov dword [ebp - 0xb50], 0x67
movzx ebx, byte [edx - 2]
movzx eax, byte [edx - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 1]
movzx edx, byte [edx + 2]
shl edx, 8
shl ebx, 8
or ebx, eax
mov eax, dword [ebp - 0xaf4]
xor edi, ebx
mov dword [ebp - 0xad4], ebx
mov ebx, 0x7f1137f
movzx eax, byte [eax + 3]
or edx, eax
mov eax, dword [ebp - 0xaf4]
shl edx, 8
movzx eax, byte [eax + 4]
or edx, eax
mov eax, dword [ebp - 0xaf4]
shl edx, 8
add dword [ebp - 0xaf4], 8
movzx eax, byte [eax + 5]
or edx, eax
mov eax, dword [ebp - 0xae4]
xor esi, edx
mov dword [ebp - 0xb14], edx
xor ebx, esi
xor ebx, edi
xor ebx, 0xab69605e
mov edx, ebx
rol edx, 0xa
lea esi, [ebx + 0x54969fa2]
rol esi, 5
imul eax, esi
add edx, eax
xor edi, edx
mov edx, 0x7f1137f
mov eax, edi
rol eax, 2
lea edx, [edi + edx]
ror edx, 9
imul edx, dword [ebp - 0xac8]
sub edx, eax
xor ebx, edx
mov eax, ebx
sub eax, dword [ebp - 0xae4]
imul edx, eax, 0x605e
mov eax, ebx
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xb1c]
xor edi, edx
mov esi, edi
mov edx, edi
xor esi, dword [ebp - 0xac8]
rol esi, 6
imul eax, esi
mov esi, 0x7f1137f
rol edx, 2
sub eax, edx
xor ebx, eax
mov eax, esi
mov edx, ebx
xor edx, 0xab69605e
sub eax, edx
xor edi, eax
mov eax, dword [ebp - 0xae4]
xor eax, edi
mov edx, edi
imul eax, dword [ebp - 0xac8]
ror edx, 6
xor edx, eax
xor ebx, edx
mov edx, ebx
lea eax, [ebx + esi]
ror eax, 0xf
rol edx, 2
imul eax, eax, 0x605e
add edx, eax
mov eax, dword [ebp - 0xb1c]
xor edi, edx
mov edx, edi
rol edx, 8
lea esi, [edi + 0x54969fa2]
ror esi, 0xe
imul eax, esi
sub eax, edx
xor ebx, eax
mov eax, dword [ebp - 0xae4]
mov esi, ebx
mov edx, ebx
ror edx, 0xa
xor esi, 0xab69605e
ror esi, 0xc
imul eax, esi
mov esi, dword [ebp - 0xb1c]
xor edx, eax
xor edi, edx
mov edx, esi
xor edx, edi
mov eax, edi
imul edx, dword [ebp - 0xac8]
shr eax, 0xa
xor edx, eax
xor ebx, edx
mov eax, ebx
not eax
ror eax, 5
add eax, 0x605e
imul eax, esi
xor edi, eax
mov eax, esi
mov dword [ebp - 0xacc], edi
sub edi, esi
mov esi, dword [ebp - 0xae4]
xor edi, ebx
mov ebx, dword [ebp - 0xacc]
xor edi, 0xab69605e
xor eax, edi
mov edx, esi
rol eax, 2
imul edx, eax
mov eax, edi
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [ebp - 0xac8]
rol eax, 7
add eax, edx
xor edi, eax
xor esi, edi
mov edx, edi
imul eax, esi, 0x605e
mov esi, dword [ebp - 0xac8]
ror edx, 9
add edx, eax
mov eax, dword [ebp - 0xb1c]
xor ebx, edx
xor esi, ebx
mov dword [ebp - 0xacc], ebx
rol esi, 5
mov edx, ebx
imul eax, esi
rol edx, 7
add edx, eax
xor edi, edx
mov edx, 0x7f1137f
mov ebx, edx
xor ebx, edi
xor ebx, dword [ebp - 0xacc]
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xac8]
imul eax, dword [ebp - 0xae4]
xor edi, eax
mov eax, edi
sub eax, edx
mov edx, edi
ror eax, 1
imul eax, eax, 0x605e
ror edx, 6
sub eax, edx
xor ebx, eax
mov eax, dword [ebp - 0xb1c]
mov edx, ebx
rol edx, 0xe
lea esi, [ebx - 0x54969fa2]
rol esi, 3
imul eax, esi
add edx, eax
mov eax, dword [ebp - 0xae4]
xor edi, edx
mov edx, edi
ror edx, 0xe
lea esi, [edi - 0x54969fa2]
rol esi, 0xf
imul eax, esi
sub eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, 0x605e
shr eax, 3
imul edx, dword [ebp - 0xac8]
xor edx, eax
xor edi, edx
mov edx, 0x7f1137f
mov eax, edi
xor eax, edx
mov edx, edi
xor edi, dword [ebp - 0xafc]
rol eax, 4
imul eax, eax, 0x605e
rol edx, 2
mov dword [ebp - 0xba0], edi
xor edx, eax
xor edx, dword [ebp - 0xae0]
xor ebx, edx
mov edx, dword [ebp - 0xb44]
mov dword [ebp - 0xbac], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xba0]
ror dword [ebp - 0xbac], 8
mov byte [edx], al
mov al, byte [ebp - 0xbac]
ror dword [ebp - 0xba0], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xba0]
ror dword [ebp - 0xbac], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xbac]
ror dword [ebp - 0xba0], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xba0]
ror dword [ebp - 0xbac], 8
mov byte [edx - 2], al
ror dword [ebp - 0xba0], 8
mov al, byte [ebp - 0xbac]
mov byte [edx - 7], al
mov al, byte [ebp - 0xba0]
mov byte [edx - 3], al
mov edi, dword [ebp - 0xbac]
mov esi, dword [ebp - 0xba0]
mov eax, dword [ebp - 0xad4]
ror edi, 8
ror esi, 8
add edx, 8
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0xb14]
mov dword [ebp - 0xbac], edi
mov dword [ebp - 0xba0], esi
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0xb44], edx
sub dword [ebp - 0xb50], 1
mov edx, dword [ebp - 0xaf4]
jne 0x100328a7
mov ebx, dword [ebp - 0xb20]
xor eax, eax
mov edx, eax
xor cl, byte [edx + ebx]
inc edx
cmp edx, 0x338
jb 0x10032c36
movzx eax, cl
cdq
cmp eax, dword [0x10007570]
jne 0x10032c69
cmp edx, dword [0x10007574]
jne 0x10032c69
mov esi, ebx
xor eax, eax
mov dword [ebp - 0xb08], esi
mov ebx, eax
mov edi, 0x337
jmp 0x10032c7e
mov esi, dword [ebp - 0xb08]
or edi, 0xffffffff
mov dword [ebp - 0xb40], 0xc004d501
xor eax, eax
test ebx, ebx
je 0x10032c91
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xb40], 0
jl 0x10032e38
mov ebx, dword [ebp - 0xb08]
xor eax, eax
push 0x40
push eax
push 0x100883a0
mov byte [edi + ebx], al
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [ebx], 0
je 0x10032dd5
mov edi, 0x100883a0
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xb74]
jne 0x10032cce
sub ecx, ebx
xor ebx, ebx
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x10032e38
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xad0], ecx
cmp word [eax], dx
je 0x10032d18
mov ecx, 0xc000007b
mov dword [ebp - 0xad0], ecx
jmp 0x10032d60
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x10032d0b
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x10032d0b
cmp dword [edx], 0x4550
jne 0x10032d0b
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xbc4]
je 0x10032d4e
cmp ax, word [ebp - 0xb5c]
je 0x10032d4e
mov ecx, 0xc000000d
jmp 0x10032d10
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb20], eax
test eax, eax
je 0x10032dc9
mov edx, esi
mov dword [ebp - 0xb14], esi
lea eax, [edx + 1]
mov dword [ebp - 0xad4], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x10032d81
sub edx, dword [ebp - 0xad4]
inc esi
add esi, edx
test ecx, ecx
js 0x10032dba
push dword [ebp - 0xb14]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10032dd5
mov ecx, dword [ebp - 0xadc]
mov dword [ecx*4 + 0x10087be0], eax
mov ecx, dword [ebp - 0xad0]
inc dword [ebp - 0xadc]
inc ebx
cmp ebx, dword [ebp - 0xb20]
jb 0x10032d70
add edi, 0x10
cmp byte [esi], 0
jne 0x10032cc7
mov ebx, dword [ebp - 0xad0]
mov eax, dword [ebp - 0xb08]
test eax, eax
je 0x10032df6
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jns 0x10032e3f
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0x100883a0]
test eax, eax
je 0x10032e0f
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10032dfe
push 0x40
push ebx
push 0x100883a0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x10002d80
mov edi, 0x10087be0
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x10032e4c
mov ebx, 0xc000007a
jmp 0x10032ddb
mov eax, dword [0x10088ab4]
xor ebx, ebx
inc eax
mov dword [0x10088ab4], eax
xor eax, eax
mov edi, 0x10088ab8
xchg dword [edi], eax
push 0x54
lea eax, [ebp - 0x7c8]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xb28]
add esp, 0xc
mov esi, dword [0x10087c5c]
mov ecx, eax
mov dword [ebp - 0x360], ebx
push 0xf
pop edx
and ecx, edx
mov dword [ebp - 0xac8], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0x18], cx
mov ecx, eax
shr ecx, 8
push 0x403
and ecx, edx
shr eax, 0xc
push ebx
mov word [ebp - 0x16], cx
and eax, edx
push ebx
mov ecx, esi
mov word [ebp - 0x14], ax
call dword [0x10089918]
call esi
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xae8], 0xffffff
test eax, eax
jne 0x10032f03
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xac0], ebx
test ebx, ebx
jle 0x10032eed
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xac0], ebx
test ebx, ebx
js 0x10034489
mov ebx, 0x80004005
mov dword [ebp - 0xac0], ebx
jmp 0x10034489
mov esi, dword [0x10087c30]
lea eax, [ebp - 0xc0c]
push eax
xor ecx, ecx
mov dword [ebp - 0xc08], ebx
push ecx
lea eax, [ebp - 0xbf8]
mov dword [ebp - 0xc0c], ecx
push eax
push 8
mov ecx, esi
mov dword [ebp - 0xbfc], ebx
mov dword [ebp - 0xaf8], ebx
mov dword [ebp - 0xb9c], ebx
mov dword [ebp - 0xbec], ebx
mov dword [ebp - 0xbd8], ebx
mov dword [ebp - 0xac0], ebx
call dword [0x10089918]
call esi
test eax, eax
jne 0x10032f93
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xac0], ebx
test ebx, ebx
jle 0x10032f7d
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xac0], ebx
test ebx, ebx
js 0x100330df
mov ebx, 0x80004005
mov dword [ebp - 0xac0], ebx
jmp 0x100330df
mov eax, dword [ebp - 0xc0c]
add eax, eax
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xbec]
mov esi, eax
call fcn.1006cdc4
test esi, esi
jne 0x10032fcc
xor eax, eax
mov dword [ebp - 0xbec], eax
mov ebx, 0x8007000e
jmp 0x10032f88
mov eax, dword [ebp - 0xbf8]
mov dword [ebp - 0xbec], esi
lea eax, [eax*4 + 4]
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xbd8]
mov esi, eax
call fcn.1006cdc4
test esi, esi
jne 0x1003300b
xor eax, eax
mov dword [ebp - 0xbd8], eax
jmp 0x10032fc5
lea eax, [ebp - 0xc0c]
mov dword [ebp - 0xbd8], esi
mov esi, dword [0x10087c30]
mov ecx, esi
push eax
push dword [ebp - 0xbec]
lea eax, [ebp - 0xbf8]
push eax
push 8
call dword [0x10089918]
call esi
test eax, eax
je 0x10032f5a
mov edi, dword [ebp - 0xbec]
xor ecx, ecx
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xae0], ecx
cmp dword [ebp - 0xbf8], ecx
jbe 0x100330ba
mov ebx, eax
mov esi, dword [0x10087c38]
push ecx
push edi
mov ecx, esi
call dword [0x10089918]
call esi
mov ecx, edi
mov dword [ebx], eax
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x10033078
mov eax, dword [ebp - 0xae0]
sub ecx, edx
sar ecx, 1
add ebx, 4
push 0
lea edi, [edi + ecx*2]
add edi, 2
inc eax
mov dword [ebp - 0xae0], eax
pop ecx
cmp eax, dword [ebp - 0xbf8]
jb 0x1003305d
mov dword [ebp - 0xadc], ebx
mov ebx, dword [ebp - 0xac0]
mov eax, dword [ebp - 0xadc]
mov dword [eax], 0x409
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xc08], eax
mov eax, dword [ebp - 0xbf8]
inc eax
mov dword [ebp - 0xbd8], ecx
mov dword [ebp - 0xae0], eax
lea ecx, [ebp - 0xbd8]
call fcn.1006cdc4
lea ecx, [ebp - 0xbec]
call fcn.1006cdc4
test ebx, ebx
js 0x1003388f
xor ecx, ecx
mov ebx, ecx
mov esi, ecx
mov dword [ebp - 0xb04], ebx
cmp dword [ebp - 0xae0], ecx
jbe 0x10033142
mov eax, dword [ebp - 0xc08]
mov edx, ecx
mov ecx, dword [eax + esi*4]
cmp ecx, dword [edx*4 + 0x10006e40]
je 0x10033138
inc edx
cmp edx, 0x26
jb 0x10033119
inc esi
xor ecx, ecx
cmp esi, dword [ebp - 0xae0]
jae 0x10033142
jmp 0x10033117
mov ebx, edx
xor ecx, ecx
mov dword [ebp - 0xb04], ebx
mov esi, dword [0x10087c34]
lea eax, [ebp - 0xc4]
push ecx
push 0x55
push eax
push dword [ebx*4 + 0x10006e40]
mov dword [ebp - 0xb40], ecx
mov ecx, esi
call dword [0x10089918]
call esi
test eax, eax
je 0x100331ad
mov esi, dword [0x10087c28]
lea eax, [ebp - 0x698]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xc4]
mov ecx, esi
push eax
call dword [0x10089918]
call esi
test eax, eax
jle 0x100331ad
mov ebx, dword [ebp - 0x68c]
xor eax, eax
shr ebx, 0x1b
inc eax
and ebx, eax
mov dword [ebp - 0xb40], ebx
mov ebx, dword [ebp - 0xb04]
xor eax, eax
mov edx, 0x10006f58
mov esi, eax
mov ecx, edx
mov dword [ebp + esi*4 - 0x350], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xb74]
jne 0x100331c2
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0x100331b6
imul ecx, ebx, 3
movzx eax, byte [ecx + 0x10006ed8]
mov esi, dword [ebp + eax*4 - 0x350]
movzx eax, byte [ecx + 0x10006ed9]
mov dword [ebp - 0xb08], esi
mov dword [ebp - 0xc58], esi
mov edi, dword [ebp + eax*4 - 0x350]
movzx eax, byte [ecx + 0x10006eda]
mov dword [ebp - 0xb18], edi
mov dword [ebp - 0xc54], edi
mov esi, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xb24], esi
mov dword [ebp - 0xc50], esi
xor eax, eax
push 0x1c90
push eax
mov dword [ebp - 0xac0], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xb58], ebx
test ebx, ebx
jne 0x10033269
mov ebx, 0x8007000e
mov dword [ebp - 0xac0], ebx
jmp 0x100338b3
or dword [ebp - 0xafc], 0xffffffff
xor ecx, ecx
mov edx, 0x7f1137f
mov dword [ebp - 0xae0], ecx
mov edi, ecx
mov dword [ebp - 0xb84], ecx
mov al, cl
mov dword [ebp - 0x3f8], 0xab69605e
movzx esi, word [ebp - 0x3f6]
mov ecx, edx
mov dword [ebp - 0x3f4], edx
shr edx, 0x10
add ebx, 7
movzx ecx, cx
mov dword [ebp - 0xad0], esi
mov esi, 0x1000757a
mov dword [ebp - 0xbbc], edi
mov dword [ebp - 0xaf4], ecx
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xb44], ebx
mov dword [ebp - 0xb50], 0x392
movzx ebx, byte [esi - 2]
movzx ecx, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 3]
or edx, ecx
mov dword [ebp - 0xad4], ebx
movzx ecx, byte [esi + 4]
xor edi, ebx
shl edx, 8
or edx, ecx
mov dword [ebp - 0xadc], edi
movzx ecx, byte [esi + 5]
mov edi, 0x7f1137f
mov ebx, dword [ebp - 0xadc]
add esi, 8
shl edx, 8
or edx, ecx
mov dword [ebp - 0xb20], esi
xor edi, edx
mov ecx, dword [ebp - 0xaf4]
xor edi, dword [ebp - 0xb84]
xor edi, ebx
mov dword [ebp - 0xb14], edx
xor edi, 0xab69605e
mov edx, edi
rol edx, 0xa
lea esi, [edi + 0x54969fa2]
rol esi, 5
imul ecx, esi
add edx, ecx
xor ebx, edx
mov edx, 0x7f1137f
mov ecx, ebx
rol ecx, 2
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [ebp - 0xad0]
sub edx, ecx
xor edi, edx
mov ecx, edi
sub ecx, dword [ebp - 0xaf4]
imul edx, ecx, 0x605e
mov ecx, edi
shr ecx, 0xd
sub edx, ecx
mov ecx, dword [ebp - 0xacc]
xor ebx, edx
mov esi, ebx
mov edx, ebx
xor esi, dword [ebp - 0xad0]
rol esi, 6
imul ecx, esi
mov esi, 0x7f1137f
rol edx, 2
sub ecx, edx
xor edi, ecx
mov ecx, esi
mov edx, edi
xor edx, 0xab69605e
sub ecx, edx
xor ebx, ecx
mov ecx, dword [ebp - 0xaf4]
xor ecx, ebx
mov edx, ebx
imul ecx, dword [ebp - 0xad0]
ror edx, 6
xor edx, ecx
xor edi, edx
mov edx, edi
lea ecx, [esi + edi]
ror ecx, 0xf
rol edx, 2
imul ecx, ecx, 0x605e
add edx, ecx
mov ecx, dword [ebp - 0xacc]
xor ebx, edx
mov edx, ebx
rol edx, 8
lea esi, [ebx + 0x54969fa2]
ror esi, 0xe
imul ecx, esi
sub ecx, edx
xor edi, ecx
mov ecx, dword [ebp - 0xaf4]
mov esi, edi
mov edx, edi
ror edx, 0xa
xor esi, 0xab69605e
ror esi, 0xc
imul ecx, esi
mov esi, dword [ebp - 0xacc]
xor edx, ecx
xor ebx, edx
mov edx, esi
xor edx, ebx
mov ecx, ebx
imul edx, dword [ebp - 0xad0]
shr ecx, 0xa
xor edx, ecx
xor edx, edi
mov ecx, edx
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, esi
xor ebx, ecx
mov edi, ebx
sub edi, esi
xor edi, edx
xor edi, 0xab69605e
mov ecx, edi
xor ecx, esi
mov esi, dword [ebp - 0xaf4]
rol ecx, 2
mov edx, esi
imul edx, ecx
mov ecx, edi
shr ecx, 2
add edx, ecx
mov ecx, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, ecx
mov ecx, ebx
ror edx, 6
imul edx, dword [ebp - 0xad0]
rol ecx, 7
add ecx, edx
xor edi, ecx
mov ecx, esi
xor ecx, edi
mov edx, edi
imul ecx, ecx, 0x605e
ror edx, 9
add edx, ecx
xor ebx, edx
mov edx, dword [ebp - 0xad0]
xor edx, ebx
mov dword [ebp - 0xadc], ebx
rol edx, 5
mov ecx, ebx
imul edx, dword [ebp - 0xacc]
rol ecx, 7
add ecx, edx
mov edx, 0x7f1137f
xor edi, ecx
mov ebx, edx
xor ebx, dword [ebp - 0xadc]
xor ebx, edi
xor ebx, 0xab69605e
mov ecx, ebx
ror ecx, 3
sub ecx, dword [ebp - 0xad0]
imul ecx, esi
xor edi, ecx
mov ecx, edi
sub ecx, edx
mov edx, edi
ror ecx, 1
imul ecx, ecx, 0x605e
ror edx, 6
sub ecx, edx
xor ebx, ecx
mov ecx, ebx
rol ecx, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [ebp - 0xacc]
add ecx, edx
xor edi, ecx
mov ecx, dword [ebp - 0xaf4]
mov edx, edi
ror edx, 0xe
lea esi, [edi - 0x54969fa2]
rol esi, 0xf
imul ecx, esi
mov esi, dword [ebp - 0xb20]
sub ecx, edx
xor ebx, ecx
mov edx, ebx
mov ecx, ebx
xor edx, 0x605e
shr ecx, 3
imul edx, dword [ebp - 0xad0]
xor edx, ecx
mov ecx, 0x7f1137f
xor edi, edx
xor ecx, edi
mov edx, edi
xor edi, dword [ebp - 0xafc]
rol ecx, 4
imul ecx, ecx, 0x605e
rol edx, 2
mov dword [ebp - 0xb84], edi
xor edx, ecx
xor edx, dword [ebp - 0xae0]
xor ebx, edx
mov edx, dword [ebp - 0xb44]
mov dword [ebp - 0xbbc], ebx
mov byte [edx - 4], bl
mov cl, byte [ebp - 0xb84]
ror dword [ebp - 0xbbc], 8
mov byte [edx], cl
mov cl, byte [ebp - 0xbbc]
ror dword [ebp - 0xb84], 8
mov byte [edx - 5], cl
mov cl, byte [ebp - 0xb84]
ror dword [ebp - 0xbbc], 8
mov byte [edx - 1], cl
mov cl, byte [ebp - 0xbbc]
ror dword [ebp - 0xb84], 8
mov byte [edx - 6], cl
mov cl, byte [ebp - 0xb84]
ror dword [ebp - 0xbbc], 8
mov byte [edx - 2], cl
mov cl, byte [ebp - 0xbbc]
ror dword [ebp - 0xb84], 8
mov byte [edx - 7], cl
mov cl, byte [ebp - 0xb84]
mov byte [edx - 3], cl
add edx, 8
mov edi, dword [ebp - 0xbbc]
mov ecx, dword [ebp - 0xad4]
ror dword [ebp - 0xb84], 8
ror edi, 8
sub dword [ebp - 0xb50], 1
mov dword [ebp - 0xae0], ecx
mov ecx, dword [ebp - 0xb14]
mov dword [ebp - 0xbbc], edi
mov dword [ebp - 0xafc], ecx
mov dword [ebp - 0xb44], edx
jne 0x100332d6
mov esi, dword [ebp - 0xb58]
xor ecx, ecx
mov edx, ecx
mov edi, 0x1c90
xor al, byte [edx + esi]
inc edx
cmp edx, edi
jb 0x10033651
movzx eax, al
cdq
cmp eax, dword [0x10009208]
jne 0x10033685
cmp edx, dword [0x1000920c]
jne 0x10033685
mov ebx, dword [ebp - 0xac0]
xor ecx, ecx
mov dword [ebp - 0xbfc], esi
mov esi, ecx
mov dword [ebp - 0xaf8], edi
jmp 0x10033692
mov ebx, 0xc004d501
xor ecx, ecx
mov dword [ebp - 0xac0], ebx
test esi, esi
je 0x100336a5
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
js 0x100338b3
mov edi, dword [ebp - 0xbfc]
xor eax, eax
mov ebx, dword [ebp - 0xb04]
mov esi, eax
mov edx, eax
cmp ebx, edx
jne 0x100336ca
mov dword [ebp + esi*4 - 0x304], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0xad4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100336d5
sub ecx, dword [ebp - 0xad4]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0x100336bf
inc esi
push 0
pop eax
cmp esi, 6
jb 0x100336bd
push 0xc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xb9c]
mov edi, eax
call fcn.1006cdc4
mov ebx, dword [ebp - 0xac0]
test edi, edi
jne 0x10033733
xor edx, edx
mov dword [ebp - 0xb9c], edx
mov ebx, 0x8007000e
mov dword [ebp - 0xac0], ebx
jmp 0x100338b5
mov dword [ebp - 0xb9c], edi
lea ecx, [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0xae0], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov edi, eax
movzx edx, word [ecx]
cmp dx, word [eax*2 + 0x10006f4c]
je 0x10033763
inc eax
cmp eax, 6
jb 0x1003374e
jmp 0x10033826
mov edx, dword [ebp + eax*4 - 0x304]
mov ecx, edx
mov dword [ebp - 0xad4], edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10033775
xor eax, eax
sub ecx, esi
mov esi, dword [0x10087c40]
push eax
push eax
lea eax, [ecx + 1]
mov ecx, esi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0x10089918]
call esi
mov esi, eax
test esi, esi
je 0x10033860
lea ecx, [esi + esi]
xor eax, eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0xb9c]
xor edx, edx
mov dword [ecx + edi], eax
mov eax, dword [ebp - 0xb9c]
cmp dword [eax + edi], edx
je 0x10033723
mov edx, dword [ebp - 0xad4]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xad4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100337e8
sub ecx, dword [ebp - 0xad4]
mov eax, dword [ebp - 0xb9c]
push esi
mov esi, dword [0x10087c40]
push dword [eax + edi]
lea eax, [ecx + 1]
mov ecx, esi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0x10089918]
call esi
test eax, eax
je 0x10033860
mov ecx, dword [ebp - 0xae0]
add ecx, 2
add edi, 4
mov dword [ebp - 0xae0], ecx
push 0
pop eax
cmp edi, 0xc
jb 0x1003374b
mov eax, dword [ebp - 0xb9c]
xor edx, edx
mov dword [ebp - 0xc04], eax
mov eax, dword [ebp - 0xb40]
mov dword [ebp - 0xb9c], edx
mov dword [ebp - 0x7c8], eax
jmp 0x100338b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xac0], ebx
test ebx, ebx
jle 0x10033883
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xac0], ebx
test ebx, ebx
js 0x100338b3
mov ebx, 0x80004005
jmp 0x1003325e
mov eax, dword [ebp - 0xc50]
mov dword [ebp - 0xb24], eax
mov eax, dword [ebp - 0xc54]
mov dword [ebp - 0xb18], eax
mov eax, dword [ebp - 0xc58]
mov dword [ebp - 0xb08], eax
xor edx, edx
cmp dword [ebp - 0xb9c], 0
je 0x10033925
mov esi, edx
mov eax, dword [ebp - 0xb9c]
cmp dword [eax + esi], edx
je 0x10033917
mov ecx, dword [eax + esi]
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x100338d3
mov eax, dword [ebp - 0xb9c]
sub ecx, edx
sar ecx, 1
mov eax, dword [eax + esi]
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x100338fe
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x100338f6
mov eax, dword [ebp - 0xb9c]
push dword [eax + esi]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
add esi, 4
cmp esi, 0xc
jb 0x100338c0
mov ebx, dword [ebp - 0xac0]
mov eax, dword [ebp - 0xbfc]
test eax, eax
je 0x10033941
mov ecx, dword [ebp - 0xaf8]
test ecx, ecx
je 0x10033941
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x10033939
lea ecx, [ebp - 0xb9c]
call fcn.1006cdc4
lea ecx, [ebp - 0xbfc]
call fcn.1006cdc4
lea ecx, [ebp - 0xc08]
call fcn.1006cdc4
test ebx, ebx
js 0x1003446b
mov eax, dword [ebp - 0xc04]
lea edi, [ebp - 0xcf4]
mov esi, dword [0x10087c94]
mov ecx, dword [eax]
mov dword [ebp - 0x7c0], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x7bc], ecx
xor ecx, ecx
mov eax, dword [eax + 8]
mov ebx, ecx
mov dword [ebp - 0x7b8], eax
xor eax, eax
stosd dword es:[edi], eax
push ecx
mov dword [ebp - 0xac0], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xcf4]
push eax
push ecx
mov edi, ecx
mov dword [ebp - 0xcf4], 0xc
push 0x42
mov ecx, esi
call dword [0x10089918]
call esi
test eax, eax
jne 0x100339fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xac0], ebx
test ebx, ebx
jle 0x100339ed
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xac0], ebx
test ebx, ebx
js 0x10033a07
mov ebx, 0x80004005
mov dword [ebp - 0xac0], ebx
jmp 0x10033a07
mov edi, dword [ebp - 0xcf0]
xor eax, eax
inc eax
and edi, eax
mov dword [ebp - 0x7c4], edi
test ebx, ebx
js 0x1003446b
mov ebx, dword [ebp - 0xac8]
mov eax, ebx
push 0x2a
pop ecx
mov dword [ebp - 0xb2c], ecx
sub eax, 1
je 0x10033a5a
sub eax, 1
je 0x10033a4e
sub eax, 1
jne 0x10033a6a
mov ebx, 0xe1
mov dword [ebp - 0xb4c], ebx
mov dword [ebp - 0xb88], ebx
mov ebx, dword [ebp - 0xac8]
jmp 0x10033a6a
mov dword [ebp - 0xb4c], 0xf
jmp 0x10033a60
mov dword [ebp - 0xb4c], ecx
mov dword [ebp - 0xb88], 0xb
push 0x60
pop edi
xor eax, eax
mov dword [ebp - 0xb54], edi
lea esi, [edi + 0x7c]
push esi
push eax
lea eax, [ebp - 0x774]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov word [ebp - 0x730], si
mov esi, dword [0x10087c50]
lea eax, [ebp - 0x774]
mov ecx, esi
push eax
push 0xffffffffffffffff
xor eax, eax
push eax
call dword [0x10089918]
call esi
xor edx, edx
test eax, eax
je 0x10033aff
movzx edi, word [ebp - 0x6ce]
mov eax, dword [ebp - 0x6c8]
mov ecx, dword [ebp - 0x6c4]
mov dword [ebp - 0xb54], edi
mov dword [ebp - 0x3cc], edx
mov dword [ebp - 0x3d0], edx
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0xafc], ecx
mov dword [ebp - 0x3c4], ecx
cmp edi, 0x60
jae 0x10033b17
push 0x60
pop edi
mov dword [ebp - 0xb54], edi
jmp 0x10033b17
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0xadc], eax
xor eax, eax
inc eax
cmp ebx, eax
mov eax, dword [ebp - 0xb08]
je 0x10033b2a
mov eax, dword [ebp - 0xb24]
push 0x5c
mov dword [ebp - 0xae0], eax
lea eax, [ebp - 0x678]
push edx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x10087c5c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
mov dword [ebp - 0xac0], ebx
push 0x403
push eax
push eax
call dword [0x10089918]
call esi
mov dword [ebp - 0xad4], eax
test eax, eax
jne 0x10033ba0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xac0], ebx
test ebx, ebx
jle 0x10033b90
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xac0], ebx
test ebx, ebx
js 0x10033c52
mov ebx, 0x80004005
jmp 0x10034465
mov esi, dword [0x10087c3c]
mov ecx, esi
push 0x48
push edi
push dword [ebp - 0xb4c]
call dword [0x10089918]
call esi
push dword [ebp - 0xae0]
neg eax
mov dword [ebp - 0x668], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x65c]
mov dword [ebp - 0x678], eax
mov byte [ebp - 0x65e], 5
call fcn.1005eb81
mov esi, dword [0x10087bf0]
lea eax, [ebp - 0x678]
push eax
mov ecx, esi
call dword [0x10089918]
call esi
test eax, eax
jne 0x10033c33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xac0], ebx
test ebx, ebx
jle 0x10033c24
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xac0], ebx
test ebx, ebx
js 0x10033c39
mov ebx, 0x80004005
mov dword [ebp - 0xac0], ebx
jmp 0x10033c39
mov dword [ebp - 0x7b4], eax
push dword [ebp - 0xad4]
mov esi, dword [0x10087c90]
xor eax, eax
push eax
mov ecx, esi
call dword [0x10089918]
call esi
test ebx, ebx
js 0x1003446b
xor eax, eax
inc eax
cmp dword [ebp - 0xac8], eax
je 0x10033c71
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0xb08], eax
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0x61c]
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x10087c5c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
mov dword [ebp - 0xac0], ebx
push 0x403
push eax
push eax
call dword [0x10089918]
call esi
mov dword [ebp - 0xad4], eax
test eax, eax
jne 0x10033d54
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xac0], ebx
test ebx, ebx
jle 0x10033cd7
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xac0], ebx
test ebx, ebx
jns 0x10033b96
push 0x20
pop edi
test ebx, ebx
js 0x1003446b
mov ebx, dword [ebp - 0xac8]
xor eax, eax
mov ecx, eax
mov edx, eax
mov eax, ebx
sub eax, 1
je 0x10033d09
sub eax, 1
je 0x10033e0d
sub eax, 1
jne 0x10033d15
mov ecx, dword [ebp - 0xadc]
mov edx, dword [ebp - 0xafc]
mov dword [ebp - 0x358], ecx
mov dword [ebp - 0x354], edx
xor edx, edx
inc edx
cmp ebx, edx
je 0x10033e52
lea eax, [ebx - 2]
xor ebx, ebx
cmp eax, edx
ja 0x10033e26
mov eax, ebx
mov dword [ebp - 0xb2c], ebx
mov edx, ebx
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xb08], ebx
jmp 0x10033e67
mov esi, dword [0x10087c3c]
mov ecx, esi
push 0x48
push edi
push dword [ebp - 0xb88]
call dword [0x10089918]
call esi
push dword [ebp - 0xb08]
neg eax
mov dword [ebp - 0x60c], 0x190
push 0x20
pop edi
mov edx, edi
mov dword [ebp - 0x61c], eax
lea ecx, [ebp - 0x600]
mov byte [ebp - 0x602], 5
call fcn.1002c4f4
mov esi, dword [0x10087bf0]
lea eax, [ebp - 0x61c]
push eax
mov ecx, esi
call dword [0x10089918]
call esi
test eax, eax
jne 0x10033de9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xac0], ebx
test ebx, ebx
jle 0x10033dda
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xac0], ebx
test ebx, ebx
js 0x10033def
mov ebx, 0x80004005
mov dword [ebp - 0xac0], ebx
jmp 0x10033def
mov dword [ebp - 0x7b0], eax
push dword [ebp - 0xad4]
mov esi, dword [0x10087c90]
xor eax, eax
push eax
mov ecx, esi
call dword [0x10089918]
call esi
jmp 0x10033ce0
mov eax, dword [ebp - 0xadc]
cdq
and edx, 3
lea ecx, [edx + eax]
sar ecx, 2
xor eax, eax
mov edx, eax
jmp 0x10033d15
mov eax, dword [ebp - 0xbf4]
mov edx, dword [ebp - 0xbf4]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0xbf4]
mov dword [ebp - 0xb2c], eax
mov eax, dword [ebp - 0xbf4]
mov dword [ebp - 0xadc], eax
jmp 0x10033e67
xor ebx, ebx
mov dword [ebp - 0xb08], edi
mov edx, 0x96
mov dword [ebp - 0xadc], ebx
mov eax, ebx
mov dword [ebp - 0xb04], edx
push dword [ebp - 0x7b4]
mov esi, dword [0x10087c1c]
sub ecx, edx
push dword [ebp - 0xae4]
mov edi, dword [ebp - 0x7c0]
sub ecx, eax
mov dword [ebp - 0xb14], ecx
mov dword [ebp - 0x78c], ecx
mov dword [ebp - 0x79c], ecx
mov ecx, esi
mov dword [ebp - 0xac0], ebx
call dword [0x10089918]
call esi
mov esi, dword [0x10087c4c]
mov ecx, esi
mov dword [ebp - 0xad4], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x7a4]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xae4]
push edi
call dword [0x10089918]
call esi
test eax, eax
jne 0x10033ee9
mov ebx, 0x80004005
mov dword [ebp - 0xac0], ebx
mov eax, dword [ebp - 0xad4]
test eax, eax
je 0x10033f05
mov esi, dword [0x10087c1c]
mov ecx, esi
push eax
push edi
call dword [0x10089918]
call esi
test ebx, ebx
js 0x1003446b
push dword [ebp - 0x7b0]
mov esi, dword [0x10087c1c]
xor eax, eax
push dword [ebp - 0xae4]
mov edi, dword [ebp - 0x7bc]
mov ebx, eax
mov ecx, esi
mov dword [ebp - 0xac0], ebx
call dword [0x10089918]
call esi
mov esi, dword [0x10087c4c]
mov ecx, esi
mov dword [ebp - 0xad4], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x794]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xae4]
push edi
call dword [0x10089918]
call esi
test eax, eax
jne 0x10033f77
mov ebx, 0x80004005
mov dword [ebp - 0xac0], ebx
mov eax, dword [ebp - 0xad4]
test eax, eax
je 0x10033f93
mov esi, dword [0x10087c1c]
mov ecx, esi
push eax
push edi
call dword [0x10089918]
call esi
test ebx, ebx
js 0x1003446b
mov eax, dword [ebp - 0xac8]
cmp eax, 2
je 0x10033fab
cmp eax, 3
jne 0x10033fc1
mov edi, dword [ebp - 0x78c]
cmp dword [ebp - 0x79c], edi
jle 0x10033fc7
mov edi, dword [ebp - 0x79c]
jmp 0x10033fc7
mov edi, dword [ebp - 0xb14]
cmp dword [ebp - 0x7c8], 0
mov esi, dword [0x10087c88]
mov ecx, esi
push dword [ebp - 0xb2c]
je 0x10034008
mov ebx, dword [ebp - 0xadc]
mov eax, ebx
sub eax, dword [ebp - 0x79c]
add eax, edi
push eax
lea eax, [ebp - 0x7a4]
push eax
call dword [0x10089918]
call esi
sub ebx, dword [ebp - 0x78c]
add ebx, edi
jmp 0x1003401e
mov ebx, dword [ebp - 0xb04]
lea eax, [ebp - 0x7a4]
push ebx
push eax
call dword [0x10089918]
call esi
mov eax, dword [ebp - 0x798]
add eax, dword [ebp - 0xb08]
mov esi, dword [0x10087c88]
mov ecx, esi
push eax
push ebx
lea eax, [ebp - 0x794]
push eax
call dword [0x10089918]
call esi
mov eax, dword [ebp - 0xac8]
cmp eax, 2
je 0x10034343
cmp eax, 3
je 0x10034343
xor edx, edx
inc edx
cmp eax, edx
jne 0x10034362
xor eax, eax
mov dword [ebp - 0x7a8], 0xffffff
push 0x5c
push eax
lea eax, [ebp - 0x5c0]
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x10087c5c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
mov dword [ebp - 0xac0], ebx
push 0x403
push eax
push eax
call dword [0x10089918]
call esi
mov dword [ebp - 0xad4], eax
test eax, eax
jne 0x100340dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xac0], ebx
test ebx, ebx
jle 0x100340d2
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xac0], ebx
test ebx, ebx
js 0x10034190
jmp 0x10033b96
mov esi, dword [0x10087c3c]
mov ecx, esi
push 0x48
push dword [ebp - 0xb54]
push 0xb
call dword [0x10089918]
call esi
push dword [ebp - 0xb18]
neg eax
mov dword [ebp - 0x5b0], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x5a4]
mov dword [ebp - 0x5c0], eax
mov byte [ebp - 0x5a6], 5
call fcn.1005eb81
mov esi, dword [0x10087bf0]
lea eax, [ebp - 0x5c0]
push eax
mov ecx, esi
call dword [0x10089918]
call esi
test eax, eax
jne 0x10034171
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xac0], ebx
test ebx, ebx
jle 0x10034162
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xac0], ebx
test ebx, ebx
js 0x10034177
mov ebx, 0x80004005
mov dword [ebp - 0xac0], ebx
jmp 0x10034177
mov dword [ebp - 0x7ac], eax
push dword [ebp - 0xad4]
mov esi, dword [0x10087c90]
xor eax, eax
push eax
mov ecx, esi
call dword [0x10089918]
call esi
test ebx, ebx
js 0x1003446b
push dword [ebp - 0x7ac]
mov esi, dword [0x10087c1c]
xor eax, eax
push dword [ebp - 0xae4]
mov ebx, eax
mov dword [ebp - 0x77c], edi
mov edi, dword [ebp - 0x7b8]
mov ecx, esi
mov dword [ebp - 0xac0], ebx
call dword [0x10089918]
call esi
mov esi, dword [0x10087c4c]
mov ecx, esi
mov dword [ebp - 0xad4], eax
xor eax, eax
push eax
push 0x460
lea eax, [ebp - 0x784]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xae4]
push edi
call dword [0x10089918]
call esi
test eax, eax
jne 0x10034208
mov ebx, 0x80004005
mov dword [ebp - 0xac0], ebx
mov eax, dword [ebp - 0xad4]
test eax, eax
je 0x10034224
mov esi, dword [0x10087c1c]
mov ecx, esi
push eax
push edi
call dword [0x10089918]
call esi
test ebx, ebx
js 0x1003446b
mov eax, dword [ebp - 0x77c]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x77c], eax
cmp eax, ecx
jge 0x10034248
mov dword [ebp - 0x77c], ecx
mov ebx, dword [ebp - 0xb54]
mov esi, dword [0x10087c3c]
mov ecx, esi
push 0x60
pop edi
push edi
push ebx
push dword [ebp - 0x784]
mov dword [ebp - 0x778], 0x20
call dword [0x10089918]
call esi
mov esi, dword [0x10087c3c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x780]
mov dword [ebp - 0x784], eax
call dword [0x10089918]
call esi
mov esi, dword [0x10087c3c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x77c]
mov dword [ebp - 0x780], eax
call dword [0x10089918]
call esi
mov esi, dword [0x10087c3c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x778]
mov dword [ebp - 0x77c], eax
call dword [0x10089918]
call esi
cmp dword [ebp - 0x7c8], 0
mov dword [ebp - 0x778], eax
je 0x10034314
mov ecx, dword [ebp - 0x7a4]
cmp ecx, dword [ebp - 0x794]
jl 0x100342f0
mov ecx, dword [ebp - 0x794]
mov eax, dword [ebp - 0x788]
add eax, 0x24
push eax
push ecx
mov esi, dword [0x10087c88]
lea eax, [ebp - 0x784]
push eax
mov ecx, esi
call dword [0x10089918]
call esi
jmp 0x1003435f
mov ecx, dword [ebp - 0x79c]
cmp ecx, dword [ebp - 0x78c]
jg 0x10034328
mov ecx, dword [ebp - 0x78c]
mov eax, dword [ebp - 0x788]
add eax, 0x24
push eax
mov eax, dword [ebp - 0x784]
sub eax, dword [ebp - 0x77c]
add eax, ecx
push eax
jmp 0x100342fb
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0x358], edi
mov dword [ebp - 0x354], eax
mov dword [ebp - 0x7a8], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x7c8]
lea edi, [ebp - 0x488]
mov ebx, dword [ebp - 0x358]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0xae0], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xac8]
sub eax, 1
je 0x100346fa
sub eax, 1
je 0x10034627
sub eax, 1
jne 0x10034463
mov esi, dword [0x10087c84]
lea edi, [ebp - 0x478]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0x10089918]
call esi
mov esi, dword [0x10087c64]
lea ecx, [ebp - 0x478]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x478], 0x28
call dword [0x10089918]
call esi
test eax, eax
je 0x10034463
mov esi, dword [0x10087c80]
lea eax, [ebp - 0x464]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0x10089918]
call esi
mov esi, dword [0x10087c80]
lea eax, [ebp - 0x45c]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0x10089918]
call esi
mov eax, dword [ebp - 0x45c]
lea esi, [ebp - 0x464]
sub eax, ebx
lea edi, [ebp - 0x488]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x458]
sub eax, dword [ebp - 0xae0]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
mov dword [ebp - 0x35c], eax
xor ebx, ebx
mov dword [ebp - 0xac0], ebx
push dword [ebp - 0xae4]
mov esi, dword [0x10087c90]
xor eax, eax
push eax
mov ecx, esi
call dword [0x10089918]
call esi
mov edi, 0x10088ab8
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x1003448b
mov eax, dword [0x10088ab4]
mov ebx, dword [ebp - 0xac0]
test eax, eax
jle 0x100344f4
sub eax, 1
mov dword [0x10088ab4], eax
jne 0x100344f4
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0x100883a0]
test eax, eax
je 0x100344c6
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x100344b5
push 0x40
xor eax, eax
push eax
push 0x100883a0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x10002d80
mov edi, 0x10087be0
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x10088ab8
xor eax, eax
xchg dword [edi], eax
lea ecx, [ebp - 0xc04]
call fcn.1006cdc4
test ebx, ebx
js 0x10036181
mov edi, dword [ebp - 0x360]
xor eax, eax
mov ebx, dword [ebp - 0x35c]
push 0x54
push eax
lea eax, [ebp - 0x81c]
mov dword [ebp - 0xca8], edi
push eax
mov dword [ebp - 0xca4], ebx
call sub.msvcrt.dll_memset
mov esi, dword [0x10087c08]
add esp, 0xc
xor eax, eax
mov ecx, esi
inc eax
mov dword [ebp - 0xae0], eax
push 7
push dword [ebp - 0xaec]
call dword [0x10089918]
call esi
test eax, eax
je 0x100345a1
mov esi, dword [0x10087c14]
lea ecx, [ebp - 0x81c]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x10089918]
call esi
test eax, eax
je 0x100345a1
push 0x20
pop eax
cmp word [ebp - 0x80a], ax
jne 0x100345a1
cmp dword [ebp - 0x808], 0
je 0x100345a1
cmp dword [ebp - 0x818], 0
jle 0x100345a1
cmp dword [ebp - 0x814], 0
jg 0x100345b6
xor eax, eax
cmp dword [ebp - 0xac8], 1
mov dword [ebp - 0xae0], eax
jne 0x1003470d
mov esi, dword [0x10087c88]
lea eax, [ebp - 0x7a4]
push ebx
push edi
push eax
mov ecx, esi
call dword [0x10089918]
call esi
mov esi, dword [0x10087c88]
lea eax, [ebp - 0x794]
push ebx
push edi
push eax
mov ecx, esi
call dword [0x10089918]
call esi
mov ebx, dword [ebp - 0xac8]
cmp ebx, 1
jne 0x10034713
mov eax, dword [ebp - 0x7c4]
mov esi, dword [0x10087bf4]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0x10089918]
call esi
mov dword [ebp - 0xaf0], eax
jmp 0x10034713
mov esi, dword [0x10087c84]
lea edi, [ebp - 0x438]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0x10089918]
call esi
mov esi, dword [0x10087c64]
lea ecx, [ebp - 0x438]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x438], 0x28
call dword [0x10089918]
call esi
test eax, eax
je 0x10034463
mov esi, dword [0x10087c80]
lea eax, [ebp - 0x424]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0x10089918]
call esi
mov esi, dword [0x10087c80]
lea eax, [ebp - 0x41c]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0x10089918]
call esi
cmp dword [ebp - 0xad4], 0
lea esi, [ebp - 0x424]
lea edi, [ebp - 0x488]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x100346d2
imul eax, dword [ebp - 0x41c], 5
cdq
idiv ecx
add eax, dword [ebp - 0x424]
jmp 0x100346e0
mov eax, dword [ebp - 0x41c]
sub eax, ebx
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x418]
sub eax, dword [ebp - 0xae0]
imul eax, eax, 0x5f
jmp 0x1003445a
xor ebx, ebx
mov dword [ebp - 0x360], ebx
mov dword [ebp - 0x35c], ebx
jmp 0x10034465
mov ebx, dword [ebp - 0xac8]
mov esi, dword [0x10087c20]
mov ecx, esi
push 1
push dword [ebp - 0xaec]
call dword [0x10089918]
call esi
cmp dword [ebp - 0x7c8], 0
mov dword [ebp - 0xb10], eax
mov dword [ebp - 0xb54], 0x810
je 0x1003474e
mov dword [ebp - 0xb54], 0x20812
cmp dword [ebp - 0xae0], 0
je 0x10035264
mov eax, dword [ebp - 0x7c4]
mov ebx, dword [ebp - 0x7c0]
mov dword [ebp - 0xb20], eax
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0xad4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x870]
mov dword [ebp - 0xb14], ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa14]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xacc], eax
lea eax, [ebp - 0x4e0]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x3b0]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0x10036161
mov ebx, dword [ebp - 0xaec]
mov esi, dword [0x10087c08]
mov ecx, esi
push 7
push ebx
call dword [0x10089918]
call esi
test eax, eax
jne 0x10034809
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10036161
mov esi, dword [0x10087c14]
lea ecx, [ebp - 0x870]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x10089918]
call esi
test eax, eax
je 0x1003484b
mov eax, dword [ebp - 0x85c]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0x868]
mov dword [ebp - 0xacc], eax
mov esi, dword [0x10087be8]
mov ecx, esi
push ebx
call dword [0x10089918]
call esi
mov ebx, eax
mov dword [ebp - 0xaf8], ebx
test ebx, ebx
je 0x100347fe
mov edi, dword [ebp - 0x798]
xor eax, eax
mov esi, dword [ebp - 0x79c]
sub edi, dword [ebp - 0x7a0]
sub esi, dword [ebp - 0x7a4]
push 0x2c
push eax
mov dword [ebp - 0xc5c], eax
mov dword [ebp - 0xb4c], eax
lea eax, [ebp - 0x4e0]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x4dc], esi
mov esi, dword [0x10087bec]
xor eax, eax
inc eax
mov dword [ebp - 0x4e0], 0x28
mov word [ebp - 0x4d4], ax
xor ecx, ecx
push 0x20
pop eax
push ecx
push ecx
mov word [ebp - 0x4d2], ax
neg edi
lea eax, [ebp - 0xc5c]
mov dword [ebp - 0x4d8], edi
push eax
push ecx
lea eax, [ebp - 0x4e0]
mov ecx, esi
push eax
push ebx
call dword [0x10089918]
call esi
mov edi, eax
mov dword [ebp - 0xb58], edi
test edi, edi
jne 0x10034931
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb4c], eax
test eax, eax
jle 0x1003491c
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb4c], eax
test eax, eax
js 0x10034cb6
mov dword [ebp - 0xb4c], 0x80004005
jmp 0x10034cb6
mov esi, dword [0x10087c14]
lea eax, [ebp - 0xa14]
push eax
push 0x54
push edi
mov ecx, esi
call dword [0x10089918]
call esi
test eax, eax
je 0x1003495b
mov eax, dword [ebp - 0xa00]
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0x79c]
sub eax, dword [ebp - 0x7a4]
mov esi, dword [0x10087c1c]
mov ecx, esi
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp - 0x798]
sub eax, dword [ebp - 0x7a0]
push edi
push ebx
mov dword [ebp - 0x3a4], eax
call dword [0x10089918]
call esi
mov esi, dword [0x10087c20]
xor eax, eax
inc eax
mov ecx, esi
push eax
push ebx
call dword [0x10089918]
call esi
push dword [ebp - 0xad4]
mov esi, dword [0x10087c1c]
mov ecx, esi
push ebx
call dword [0x10089918]
call esi
mov esi, dword [0x10087c18]
mov ecx, esi
mov dword [ebp - 0xad4], eax
xor eax, eax
push eax
call dword [0x10089918]
call esi
mov esi, dword [0x10087c54]
mov ecx, esi
push eax
lea eax, [ebp - 0x3b0]
push eax
push ebx
call dword [0x10089918]
call esi
mov esi, dword [0x10087c4c]
xor eax, eax
push eax
push dword [ebp - 0xb54]
lea eax, [ebp - 0x3b0]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb14]
push ebx
call dword [0x10089918]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xac8], eax
jne 0x10034a52
cmp dword [ebp - 0xb20], 0
je 0x10034a46
mov esi, dword [0x10087c6c]
mov ecx, esi
push 8
call dword [0x10089918]
call esi
mov dword [ebp - 0xaf4], eax
jmp 0x10034a5c
mov dword [ebp - 0xaf4], 0xffffff
jmp 0x10034a5c
mov dword [ebp - 0xaf4], 0xffa8a8a8
mov edi, dword [ebp - 0x7a4]
xor edx, edx
mov eax, dword [ebp - 0x7a0]
mov esi, edx
mov ecx, edx
test edi, edi
jns 0x10034a78
mov esi, edi
mov edi, edx
neg esi
test eax, eax
jns 0x10034a82
mov ecx, eax
mov eax, edx
neg ecx
mov ebx, dword [ebp - 0x3a8]
mov edx, dword [ebp - 0xb08]
sub ebx, esi
sub edx, edi
mov dword [ebp - 0xb44], ebx
cmp ebx, edx
jl 0x10034aa4
mov ebx, edx
mov dword [ebp - 0xb44], edx
mov edx, dword [ebp - 0x3a4]
sub dword [ebp - 0xacc], eax
sub edx, ecx
mov dword [ebp - 0xadc], edx
cmp edx, dword [ebp - 0xacc]
jl 0x10034acc
mov edx, dword [ebp - 0xacc]
mov dword [ebp - 0xadc], edx
test ebx, ebx
jle 0x10034c7e
test edx, edx
jle 0x10034c7e
imul ecx, dword [ebp - 0x3a8]
imul eax, dword [ebp - 0xb08]
add ecx, esi
mov esi, dword [ebp - 0xae0]
add eax, edi
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xafc]
mov dword [ebp - 0xb04], ecx
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0x3a8]
shl esi, 2
mov dword [ebp - 0xb50], esi
mov esi, dword [ebp - 0xb08]
shl esi, 2
mov dword [ebp - 0xb40], esi
mov esi, dword [ebp - 0xb50]
mov edi, dword [ebp - 0xb40]
mov dword [ebp - 0xb24], eax
test ebx, ebx
jle 0x10034c5f
mov esi, eax
mov dword [ebp - 0xafc], ebx
lea edx, [eax + 3]
sub esi, ecx
mov dword [ebp - 0xacc], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xae0], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x10034c20
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xaf4]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xae0]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xacc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xaf4]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xaf2]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xae0]
cdq
idiv ecx
mov edx, dword [ebp - 0xacc]
add al, bl
mov ebx, dword [ebp - 0xafc]
mov byte [edx], al
add edx, 4
add edi, 4
sub ebx, 1
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xafc], ebx
jne 0x10034b5a
mov edx, dword [ebp - 0xadc]
mov ebx, dword [ebp - 0xb44]
mov ecx, dword [ebp - 0xb04]
mov eax, dword [ebp - 0xb24]
mov esi, dword [ebp - 0xb50]
mov edi, dword [ebp - 0xb40]
add ecx, esi
add eax, edi
sub edx, 1
mov dword [ebp - 0xb04], ecx
mov dword [ebp - 0xb24], eax
mov dword [ebp - 0xadc], edx
jne 0x10034b36
push dword [ebp - 0xb58]
mov esi, dword [0x10087bfc]
mov ecx, esi
call dword [0x10089918]
call esi
mov eax, dword [ebp - 0xad4]
mov ebx, dword [ebp - 0xaf8]
test eax, eax
je 0x10034cb6
mov esi, dword [0x10087c1c]
mov ecx, esi
push eax
push ebx
call dword [0x10089918]
call esi
mov esi, dword [0x10087bf8]
mov ecx, esi
push ebx
call dword [0x10089918]
call esi
cmp dword [ebp - 0xb4c], 0
jl 0x10036161
mov eax, dword [ebp - 0x7c4]
mov ebx, dword [ebp - 0x7bc]
mov dword [ebp - 0xb20], eax
mov eax, dword [ebp - 0x7b0]
mov dword [ebp - 0xad4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x96c]
mov dword [ebp - 0xb14], ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xabc]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xacc], eax
lea eax, [ebp - 0x50c]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x3a0]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0x10036161
mov ebx, dword [ebp - 0xaec]
mov esi, dword [0x10087c08]
mov ecx, esi
push 7
push ebx
call dword [0x10089918]
call esi
test eax, eax
je 0x100347fe
mov esi, dword [0x10087c14]
lea ecx, [ebp - 0x96c]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x10089918]
call esi
test eax, eax
je 0x10034dbd
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0x964]
mov dword [ebp - 0xacc], eax
mov esi, dword [0x10087be8]
mov ecx, esi
push ebx
call dword [0x10089918]
call esi
mov ebx, eax
mov dword [ebp - 0xb18], ebx
test ebx, ebx
je 0x100347fe
mov edi, dword [ebp - 0x788]
xor eax, eax
mov esi, dword [ebp - 0x78c]
sub edi, dword [ebp - 0x790]
sub esi, dword [ebp - 0x794]
push 0x2c
push eax
mov dword [ebp - 0xc94], eax
mov dword [ebp - 0xb4c], eax
lea eax, [ebp - 0x50c]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x508], esi
mov esi, dword [0x10087bec]
xor eax, eax
inc eax
mov dword [ebp - 0x50c], 0x28
mov word [ebp - 0x500], ax
xor ecx, ecx
push 0x20
pop eax
push ecx
push ecx
mov word [ebp - 0x4fe], ax
neg edi
lea eax, [ebp - 0xc94]
mov dword [ebp - 0x504], edi
push eax
push ecx
lea eax, [ebp - 0x50c]
mov ecx, esi
push eax
push ebx
call dword [0x10089918]
call esi
mov edi, eax
mov dword [ebp - 0xb58], edi
test edi, edi
jne 0x10034ea7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb4c], eax
test eax, eax
jle 0x10034e92
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb4c], eax
test eax, eax
js 0x1003523b
mov dword [ebp - 0xb4c], 0x80004005
jmp 0x1003523b
mov esi, dword [0x10087c14]
lea eax, [ebp - 0xabc]
push eax
push 0x54
push edi
mov ecx, esi
call dword [0x10089918]
call esi
test eax, eax
je 0x10034ed1
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0x78c]
sub eax, dword [ebp - 0x794]
mov esi, dword [0x10087c1c]
mov ecx, esi
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x788]
sub eax, dword [ebp - 0x790]
push edi
push ebx
mov dword [ebp - 0x394], eax
call dword [0x10089918]
call esi
mov esi, dword [0x10087c20]
xor eax, eax
inc eax
mov ecx, esi
push eax
push ebx
call dword [0x10089918]
call esi
push dword [ebp - 0xad4]
mov esi, dword [0x10087c1c]
mov ecx, esi
push ebx
call dword [0x10089918]
call esi
mov esi, dword [0x10087c18]
mov ecx, esi
mov dword [ebp - 0xad4], eax
xor eax, eax
push eax
call dword [0x10089918]
call esi
mov esi, dword [0x10087c54]
mov ecx, esi
push eax
lea eax, [ebp - 0x3a0]
push eax
push ebx
call dword [0x10089918]
call esi
mov esi, dword [0x10087c4c]
xor eax, eax
push eax
push dword [ebp - 0xb54]
lea eax, [ebp - 0x3a0]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb14]
push ebx
call dword [0x10089918]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xac8], eax
jne 0x10034fd0
cmp dword [ebp - 0xb20], 0
je 0x10034fc4
mov esi, dword [0x10087c6c]
mov ecx, esi
push 8
call dword [0x10089918]
call esi
mov edx, eax
mov dword [ebp - 0xae8], edx
mov dword [ebp - 0xadc], edx
jmp 0x10034fe1
mov dword [ebp - 0xadc], 0xffffff
jmp 0x10034fe1
mov eax, 0xffa8a8a8
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xadc], eax
mov edi, dword [ebp - 0x794]
xor edx, edx
mov eax, dword [ebp - 0x790]
mov esi, edx
mov ecx, edx
test edi, edi
jns 0x10034ffd
mov esi, edi
mov edi, edx
neg esi
test eax, eax
jns 0x10035007
mov ecx, eax
mov eax, edx
neg ecx
mov ebx, dword [ebp - 0x398]
mov edx, dword [ebp - 0xb08]
sub ebx, esi
sub edx, edi
mov dword [ebp - 0xb44], ebx
cmp ebx, edx
jl 0x10035029
mov ebx, edx
mov dword [ebp - 0xb44], edx
mov edx, dword [ebp - 0x394]
sub dword [ebp - 0xacc], eax
sub edx, ecx
mov dword [ebp - 0xb04], edx
cmp edx, dword [ebp - 0xacc]
jl 0x10035051
mov edx, dword [ebp - 0xacc]
mov dword [ebp - 0xb04], edx
test ebx, ebx
jle 0x10035203
test edx, edx
jle 0x10035203
imul ecx, dword [ebp - 0x398]
imul eax, dword [ebp - 0xb08]
add ecx, esi
mov esi, dword [ebp - 0xae0]
add eax, edi
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xafc]
mov dword [ebp - 0xb24], ecx
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0x398]
shl esi, 2
mov dword [ebp - 0xb50], esi
mov esi, dword [ebp - 0xb08]
shl esi, 2
mov dword [ebp - 0xb40], esi
mov esi, dword [ebp - 0xb50]
mov edi, dword [ebp - 0xb40]
mov dword [ebp - 0xaf8], eax
test ebx, ebx
jle 0x100351e4
mov esi, eax
mov dword [ebp - 0xafc], ebx
lea edx, [eax + 3]
sub esi, ecx
mov dword [ebp - 0xacc], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xae0], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x100351a5
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xae8]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xae0]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xacc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xae8]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xada]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xae0]
cdq
idiv ecx
mov edx, dword [ebp - 0xacc]
add al, bl
mov ebx, dword [ebp - 0xafc]
mov byte [edx], al
add edx, 4
add edi, 4
sub ebx, 1
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xafc], ebx
jne 0x100350df
mov edx, dword [ebp - 0xb04]
mov ebx, dword [ebp - 0xb44]
mov ecx, dword [ebp - 0xb24]
mov eax, dword [ebp - 0xaf8]
mov esi, dword [ebp - 0xb50]
mov edi, dword [ebp - 0xb40]
add ecx, esi
add eax, edi
sub edx, 1
mov dword [ebp - 0xb24], ecx
mov dword [ebp - 0xaf8], eax
mov dword [ebp - 0xb04], edx
jne 0x100350bb
push dword [ebp - 0xb58]
mov esi, dword [0x10087bfc]
mov ecx, esi
call dword [0x10089918]
call esi
mov eax, dword [ebp - 0xad4]
mov ebx, dword [ebp - 0xb18]
test eax, eax
je 0x1003523b
mov esi, dword [0x10087c1c]
mov ecx, esi
push eax
push ebx
call dword [0x10089918]
call esi
mov esi, dword [0x10087bf8]
mov ecx, esi
push ebx
call dword [0x10089918]
call esi
cmp dword [ebp - 0xb4c], 0
jl 0x10036161
mov edi, dword [ebp - 0xad8]
jmp 0x1003610d
xor edx, edx
inc edx
cmp dword [ebp - 0x7c4], 0
jne 0x10035278
cmp ebx, edx
je 0x10035278
mov al, 0xc0
jmp 0x1003527a
or al, 0xff
mov byte [ebp - 0xaf6], al
lea edi, [ebp - 0x380]
xor eax, eax
mov esi, dword [0x10087be8]
stosd dword es:[edi], eax
xor ecx, ecx
push dword [ebp - 0xaec]
mov byte [ebp - 0xaf8], cl
mov byte [ebp - 0xaf7], cl
mov ecx, esi
stosd dword es:[edi], eax
mov byte [ebp - 0xaf5], dl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x370]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [0x10089918]
call esi
mov dword [ebp - 0xad8], eax
test eax, eax
jne 0x100352d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10036161
xor eax, eax
inc eax
cmp ebx, eax
jne 0x100353f3
mov ebx, dword [ebp - 0x79c]
mov eax, ebx
mov edx, dword [ebp - 0x78c]
mov edi, edx
sub edi, dword [ebp - 0x794]
sub eax, dword [ebp - 0x7a4]
mov dword [ebp - 0xb1c], edi
cmp edi, eax
jg 0x10035310
mov edi, eax
mov dword [ebp - 0xb1c], eax
mov esi, dword [ebp - 0x788]
mov eax, esi
sub eax, dword [ebp - 0x7a0]
mov dword [ebp - 0xb2c], eax
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x7c8], eax
je 0x1003536e
mov eax, dword [ebp - 0x7a4]
sub eax, ebx
add eax, edi
mov ecx, eax
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0x794]
sub eax, edx
mov dword [ebp - 0xb4c], ecx
mov dword [ebp - 0x380], ecx
add eax, edi
mov ecx, eax
mov dword [ebp - 0xaf4], ecx
mov dword [ebp - 0x370], ecx
mov ecx, dword [ebp - 0xad4]
jmp 0x10035388
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0xb4c], eax
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0xaf4], eax
mov eax, ecx
sub edx, dword [ebp - 0x794]
sub ebx, dword [ebp - 0x7a4]
add edx, eax
mov eax, dword [ebp - 0x790]
add ebx, ecx
sub eax, dword [ebp - 0x7a0]
mov edi, dword [ebp - 0x798]
sub edi, dword [ebp - 0x7a0]
sub esi, dword [ebp - 0x790]
add esi, eax
mov dword [ebp - 0x378], ebx
mov dword [ebp - 0xb08], edi
mov dword [ebp - 0x374], edi
mov dword [ebp - 0xb18], edx
mov dword [ebp - 0x368], edx
mov dword [ebp - 0xb28], eax
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0xac0], esi
mov dword [ebp - 0x364], esi
jmp 0x10035479
mov eax, dword [ebp - 0x358]
lea esi, [ebp - 0x7a4]
lea edi, [ebp - 0x380]
mov dword [ebp - 0xb1c], eax
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0xb2c], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x374]
lea esi, [ebp - 0x794]
mov ebx, dword [ebp - 0x378]
lea edi, [ebp - 0x370]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0xb4c], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0xac0], eax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0xb18], eax
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0xb28], eax
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0xaf4], eax
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xc88], eax
lea eax, [ebp - 0x4b4]
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xb1c]
add esp, 0xc
mov edi, dword [ebp - 0xad8]
xor ecx, ecx
mov esi, dword [0x10087bec]
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0xb2c]
neg eax
mov dword [ebp - 0x4b4], 0x28
mov dword [ebp - 0x4ac], eax
xor eax, eax
push 0x20
inc eax
mov word [ebp - 0x4a8], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x4a6], ax
lea eax, [ebp - 0xc88]
push eax
push ecx
lea eax, [ebp - 0x4b4]
mov ecx, esi
push eax
push edi
call dword [0x10089918]
call esi
mov dword [ebp - 0xb0c], eax
test eax, eax
jne 0x1003550a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1003614c
mov esi, dword [0x10087c1c]
mov ecx, esi
push eax
push edi
call dword [0x10089918]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xac8], eax
jne 0x10035582
mov ecx, dword [ebp - 0xaf0]
test ecx, ecx
je 0x10035582
xor eax, eax
mov esi, dword [0x10087c54]
lea edi, [ebp - 0x3f0]
stosd dword es:[edi], eax
push ecx
mov ecx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x3f0], eax
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0xb2c]
mov dword [ebp - 0x3e4], eax
lea eax, [ebp - 0x3f0]
push eax
mov eax, dword [ebp - 0xad8]
push eax
call dword [0x10089918]
call esi
mov eax, dword [ebp - 0x7c4]
mov esi, dword [ebp - 0x7c0]
mov dword [ebp - 0xb20], eax
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0xad4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x918]
mov dword [ebp - 0xb14], esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x9c0]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xb88], eax
mov dword [ebp - 0xacc], eax
lea eax, [ebp - 0x564]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x390]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xad8]
test esi, esi
je 0x10036131
mov esi, dword [0x10087c08]
mov ecx, esi
push 7
push edi
call dword [0x10089918]
call esi
test eax, eax
jne 0x10035630
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10036131
mov esi, dword [0x10087c14]
lea ecx, [ebp - 0x918]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x10089918]
call esi
test eax, eax
je 0x10035672
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0xacc], eax
mov esi, dword [0x10087be8]
mov ecx, esi
push edi
call dword [0x10089918]
call esi
mov dword [ebp - 0xad0], eax
test eax, eax
je 0x10035625
mov esi, dword [ebp - 0xb08]
xor eax, eax
mov edi, dword [ebp - 0x37c]
sub esi, edi
sub ebx, dword [ebp - 0xb4c]
push 0x2c
push eax
mov dword [ebp - 0xc8c], eax
mov dword [ebp - 0xbc0], eax
lea eax, [ebp - 0x564]
push eax
mov dword [ebp - 0xb08], esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x564], 0x28
xor eax, eax
mov dword [ebp - 0x560], ebx
inc eax
xor ecx, ecx
mov word [ebp - 0x558], ax
neg esi
push 0x20
pop eax
push ecx
push ecx
mov word [ebp - 0x556], ax
lea eax, [ebp - 0xc8c]
push eax
push ecx
lea eax, [ebp - 0x564]
mov dword [ebp - 0x55c], esi
mov esi, dword [0x10087bec]
mov ecx, esi
push eax
push dword [ebp - 0xad0]
call dword [0x10089918]
call esi
mov dword [ebp - 0xb48], eax
test eax, eax
jne 0x1003575b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xbc0], eax
test eax, eax
jle 0x10035746
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xbc0], eax
test eax, eax
js 0x10035ad2
mov dword [ebp - 0xbc0], 0x80004005
jmp 0x10035ad2
mov esi, dword [0x10087c14]
lea ecx, [ebp - 0x9c0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x10089918]
call esi
test eax, eax
je 0x10035785
mov eax, dword [ebp - 0x9ac]
mov dword [ebp - 0xae0], eax
push dword [ebp - 0xb48]
mov eax, dword [ebp - 0xb08]
mov esi, dword [0x10087c1c]
mov ecx, esi
mov dword [ebp - 0x388], ebx
mov ebx, dword [ebp - 0xad0]
push ebx
mov dword [ebp - 0x384], eax
call dword [0x10089918]
call esi
mov esi, dword [0x10087c20]
xor eax, eax
inc eax
mov ecx, esi
push eax
push ebx
call dword [0x10089918]
call esi
push dword [ebp - 0xad4]
mov esi, dword [0x10087c1c]
mov ecx, esi
push ebx
call dword [0x10089918]
call esi
mov esi, dword [0x10087c18]
mov ecx, esi
mov dword [ebp - 0xad4], eax
xor eax, eax
push eax
call dword [0x10089918]
call esi
mov esi, dword [0x10087c54]
mov ecx, esi
push eax
lea eax, [ebp - 0x390]
push eax
push ebx
call dword [0x10089918]
call esi
mov esi, dword [0x10087c4c]
xor eax, eax
push eax
push dword [ebp - 0xb54]
lea eax, [ebp - 0x390]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb14]
push ebx
call dword [0x10089918]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xac8], eax
jne 0x10035875
cmp dword [ebp - 0xb20], 0
je 0x10035869
mov esi, dword [0x10087c6c]
mov ecx, esi
push 8
call dword [0x10089918]
call esi
mov dword [ebp - 0xae4], eax
jmp 0x1003587f
mov dword [ebp - 0xae4], 0xffffff
jmp 0x1003587f
mov dword [ebp - 0xae4], 0xffa8a8a8
mov ecx, dword [ebp - 0xb4c]
xor edx, edx
mov esi, edx
mov eax, edx
test ecx, ecx
jns 0x10035895
mov esi, ecx
mov ecx, edx
neg esi
test edi, edi
jns 0x1003589f
mov eax, edi
mov edi, edx
neg eax
mov ebx, dword [ebp - 0x388]
mov edx, dword [ebp - 0xb88]
sub ebx, esi
sub edx, ecx
mov dword [ebp - 0xb44], ebx
cmp ebx, edx
jl 0x100358c1
mov ebx, edx
mov dword [ebp - 0xb44], edx
mov edx, dword [ebp - 0x384]
sub dword [ebp - 0xacc], edi
sub edx, eax
mov dword [ebp - 0xadc], edx
cmp edx, dword [ebp - 0xacc]
jl 0x100358e9
mov edx, dword [ebp - 0xacc]
mov dword [ebp - 0xadc], edx
test ebx, ebx
jle 0x10035a9b
test edx, edx
jle 0x10035a9b
imul eax, dword [ebp - 0x388]
imul edi, dword [ebp - 0xb88]
add eax, esi
mov esi, dword [ebp - 0xae0]
add edi, ecx
mov ecx, dword [ebp - 0xafc]
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0x388]
shl esi, 2
lea ecx, [ecx + edi*4]
mov dword [ebp - 0xb50], esi
mov esi, dword [ebp - 0xb88]
shl esi, 2
mov dword [ebp - 0xb40], esi
mov esi, dword [ebp - 0xb50]
mov edi, dword [ebp - 0xb40]
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xb24], ecx
test ebx, ebx
jle 0x10035a7c
mov esi, ecx
mov dword [ebp - 0xafc], ebx
lea edx, [ecx + 3]
sub esi, eax
mov dword [ebp - 0xacc], edx
lea edi, [eax + 2]
mov dword [ebp - 0xae0], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x10035a3d
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xae4]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xae0]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xacc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xae4]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xae2]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xae0]
cdq
idiv ecx
mov edx, dword [ebp - 0xacc]
add al, bl
mov ebx, dword [ebp - 0xafc]
mov byte [edx], al
add edx, 4
add edi, 4
sub ebx, 1
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xafc], ebx
jne 0x10035977
mov edx, dword [ebp - 0xadc]
mov ebx, dword [ebp - 0xb44]
mov eax, dword [ebp - 0xb04]
mov ecx, dword [ebp - 0xb24]
mov esi, dword [ebp - 0xb50]
mov edi, dword [ebp - 0xb40]
add eax, esi
add ecx, edi
sub edx, 1
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xb24], ecx
mov dword [ebp - 0xadc], edx
jne 0x10035953
push dword [ebp - 0xb48]
mov esi, dword [0x10087bfc]
mov ecx, esi
call dword [0x10089918]
call esi
mov eax, dword [ebp - 0xad4]
test eax, eax
je 0x10035ad2
mov esi, dword [0x10087c1c]
mov ecx, esi
push eax
push dword [ebp - 0xad0]
call dword [0x10089918]
call esi
push dword [ebp - 0xad0]
mov esi, dword [0x10087bf8]
mov ecx, esi
call dword [0x10089918]
call esi
cmp dword [ebp - 0xbc0], 0
jl 0x1003612b
mov eax, dword [ebp - 0x7c4]
mov ebx, dword [ebp - 0x7bc]
mov dword [ebp - 0xb20], eax
mov eax, dword [ebp - 0x7b0]
mov dword [ebp - 0xad4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x8c4]
mov dword [ebp - 0xb14], ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa68]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xb48], eax
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xacc], eax
lea eax, [ebp - 0x538]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x3c0]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xad8]
test ebx, ebx
je 0x10036131
mov esi, dword [0x10087c08]
mov ecx, esi
push 7
push edi
call dword [0x10089918]
call esi
test eax, eax
je 0x10035625
mov esi, dword [0x10087c14]
lea ecx, [ebp - 0x8c4]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x10089918]
call esi
test eax, eax
je 0x10035bde
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0xacc], eax
mov esi, dword [0x10087be8]
mov ecx, esi
push edi
call dword [0x10089918]
call esi
mov dword [ebp - 0xad0], eax
test eax, eax
je 0x10035625
mov esi, dword [ebp - 0xb18]
xor eax, eax
sub esi, dword [ebp - 0xaf4]
mov edi, eax
mov ebx, dword [ebp - 0xb28]
sub dword [ebp - 0xac0], ebx
push 0x2c
push eax
mov dword [ebp - 0xc90], eax
lea eax, [ebp - 0x538]
push eax
mov dword [ebp - 0xb18], esi
mov dword [ebp - 0xb58], edi
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xac0]
add esp, 0xc
neg eax
mov dword [ebp - 0x534], esi
mov esi, dword [0x10087bec]
xor ecx, ecx
mov dword [ebp - 0x530], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x538], 0x28
mov word [ebp - 0x52c], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x52a], ax
lea eax, [ebp - 0xc90]
push eax
push ecx
lea eax, [ebp - 0x538]
mov ecx, esi
push eax
push dword [ebp - 0xad0]
call dword [0x10089918]
call esi
mov dword [ebp - 0xb44], eax
test eax, eax
jne 0x10035cc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x10035cb9
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x10036067
mov edi, 0x80004005
jmp 0x10036067
mov esi, dword [0x10087c14]
lea ecx, [ebp - 0xa68]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x10089918]
call esi
test eax, eax
je 0x10035cf3
mov eax, dword [ebp - 0xa54]
mov dword [ebp - 0xb48], eax
push dword [ebp - 0xb44]
mov eax, dword [ebp - 0xb18]
push dword [ebp - 0xad0]
mov esi, dword [0x10087c1c]
mov ecx, esi
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0x3b4], eax
call dword [0x10089918]
call esi
mov esi, dword [0x10087c20]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xad0]
call dword [0x10089918]
call esi
push dword [ebp - 0xad4]
mov esi, dword [0x10087c1c]
mov ecx, esi
push dword [ebp - 0xad0]
call dword [0x10089918]
call esi
mov esi, dword [0x10087c18]
mov ecx, esi
mov dword [ebp - 0xb50], eax
xor eax, eax
push eax
call dword [0x10089918]
call esi
mov esi, dword [0x10087c54]
mov ecx, esi
push eax
lea eax, [ebp - 0x3c0]
push eax
push dword [ebp - 0xad0]
call dword [0x10089918]
call esi
mov esi, dword [0x10087c4c]
xor eax, eax
push eax
push dword [ebp - 0xb54]
lea eax, [ebp - 0x3c0]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb14]
push dword [ebp - 0xad0]
call dword [0x10089918]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xac8], eax
jne 0x10035e03
cmp dword [ebp - 0xb20], edi
je 0x10035df7
mov esi, dword [0x10087c6c]
mov ecx, esi
push 8
call dword [0x10089918]
call esi
mov ecx, eax
mov dword [ebp - 0xae8], ecx
mov dword [ebp - 0xb04], ecx
jmp 0x10035e14
mov dword [ebp - 0xb04], 0xffffff
jmp 0x10035e14
mov eax, 0xffa8a8a8
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xb04], eax
mov esi, dword [ebp - 0xaf4]
xor ecx, ecx
mov edx, ecx
mov eax, ecx
test esi, esi
jns 0x10035e30
mov edx, esi
mov esi, ecx
neg edx
mov dword [ebp - 0xaf4], esi
test ebx, ebx
jns 0x10035e3a
mov eax, ebx
mov ebx, ecx
neg eax
mov ecx, dword [ebp - 0xadc]
sub ecx, esi
mov esi, dword [ebp - 0x3b8]
sub esi, edx
mov dword [ebp - 0xb24], esi
cmp esi, ecx
jl 0x10035e5c
mov esi, ecx
mov dword [ebp - 0xb24], ecx
mov ecx, dword [ebp - 0x3b4]
sub dword [ebp - 0xacc], ebx
sub ecx, eax
mov dword [ebp - 0xb18], ecx
cmp ecx, dword [ebp - 0xacc]
jl 0x10035e84
mov ecx, dword [ebp - 0xacc]
mov dword [ebp - 0xb18], ecx
test esi, esi
jle 0x10036030
test ecx, ecx
jle 0x10036030
mov edi, dword [ebp - 0x3b8]
mov esi, dword [ebp - 0xae0]
imul eax, edi
shl edi, 2
mov dword [ebp - 0xad4], edi
add eax, edx
mov edx, dword [ebp - 0xb48]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0xadc]
imul ebx, edx
mov dword [ebp - 0xafc], eax
add ebx, dword [ebp - 0xaf4]
shl edx, 2
mov dword [ebp - 0xb14], edx
lea ebx, [esi + ebx*4]
mov esi, dword [ebp - 0xb24]
mov dword [ebp - 0xae0], ebx
test esi, esi
jle 0x1003600b
lea edx, [ebx + 3]
mov dword [ebp - 0xb48], esi
sub ebx, eax
mov dword [ebp - 0xb54], edx
lea edi, [eax + 2]
mov dword [ebp - 0xb28], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x10035fcc
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xae8]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb28]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xb54]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xae8]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb54]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xb02]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb54]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xb48]
cdq
idiv ecx
mov edx, dword [ebp - 0xb54]
add al, bl
mov ebx, dword [ebp - 0xb28]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xb54], edx
mov dword [ebp - 0xb48], esi
jne 0x10035f06
mov ecx, dword [ebp - 0xb18]
mov esi, dword [ebp - 0xb24]
mov eax, dword [ebp - 0xafc]
mov ebx, dword [ebp - 0xae0]
mov edi, dword [ebp - 0xad4]
mov edx, dword [ebp - 0xb14]
add eax, edi
add ebx, edx
sub ecx, 1
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0xae0], ebx
mov dword [ebp - 0xb18], ecx
jne 0x10035ee4
mov edi, dword [ebp - 0xb58]
push dword [ebp - 0xb44]
mov esi, dword [0x10087bfc]
mov ecx, esi
call dword [0x10089918]
call esi
mov eax, dword [ebp - 0xb50]
test eax, eax
je 0x10036067
mov esi, dword [0x10087c1c]
mov ecx, esi
push eax
push dword [ebp - 0xad0]
call dword [0x10089918]
call esi
push dword [ebp - 0xad0]
mov esi, dword [0x10087bf8]
mov ecx, esi
call dword [0x10089918]
call esi
test edi, edi
mov edi, dword [ebp - 0xad8]
js 0x10036131
xor eax, eax
inc eax
cmp dword [ebp - 0xac8], eax
jne 0x100360d0
mov esi, dword [0x10087be0]
xor eax, eax
push 0xcc0020
push eax
push eax
push edi
push dword [ebp - 0xb2c]
mov ecx, esi
push dword [ebp - 0xb1c]
push dword [ebp - 0x7a0]
push dword [ebp - 0x7a4]
push dword [ebp - 0xaec]
call dword [0x10089918]
call esi
jmp 0x1003610d
push dword [ebp - 0xaf8]
mov ecx, dword [ebp - 0xb2c]
xor edx, edx
mov eax, dword [ebp - 0xb1c]
mov esi, dword [0x10087c00]
push ecx
push eax
push edx
push edx
push edi
push ecx
push eax
push dword [ebp - 0x35c]
mov ecx, esi
push dword [ebp - 0x360]
push dword [ebp - 0xaec]
call dword [0x10089918]
call esi
push dword [ebp - 0xb10]
mov esi, dword [0x10087c20]
mov ecx, esi
push dword [ebp - 0xaec]
call dword [0x10089918]
call esi
jmp 0x10036131
mov edi, dword [ebp - 0xad8]
mov eax, dword [ebp - 0xb0c]
test eax, eax
je 0x1003614c
mov esi, dword [0x10087bfc]
mov ecx, esi
push eax
call dword [0x10089918]
call esi
test edi, edi
je 0x10036161
mov esi, dword [0x10087bf8]
mov ecx, esi
push edi
call dword [0x10089918]
call esi
mov eax, dword [ebp - 0xaf0]
test eax, eax
je 0x1003617c
mov esi, dword [0x10087bfc]
mov ecx, esi
push eax
call dword [0x10089918]
call esi
mov edi, 0x10088ab8
mov ecx, dword [ebp - 0x7c0]
xor ebx, ebx
test ecx, ecx
je 0x100361d2
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10036190
mov eax, dword [ebp - 0x7c0]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x100361b8
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x100361b0
push dword [ebp - 0x7c0]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x7c0], ebx
mov ecx, dword [ebp - 0x7bc]
test ecx, ecx
je 0x10036221
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x100361df
mov eax, dword [ebp - 0x7bc]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x10036207
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x100361ff
push dword [ebp - 0x7bc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x7bc], ebx
mov edx, dword [ebp - 0x7b8]
test edx, edx
je 0x1003626d
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10036230
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x10036258
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0x1003624a
mov edx, dword [ebp - 0x7b8]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x7b8], ebx
cmp dword [ebp - 0x7b4], 0
je 0x10036292
push dword [ebp - 0x7b4]
mov esi, dword [0x10087bfc]
mov ecx, esi
call dword [0x10089918]
call esi
mov dword [ebp - 0x7b4], ebx
cmp dword [ebp - 0x7b0], 0
je 0x100362b7
push dword [ebp - 0x7b0]
mov esi, dword [0x10087bfc]
mov ecx, esi
call dword [0x10089918]
call esi
mov dword [ebp - 0x7b0], ebx
cmp dword [ebp - 0x7ac], 0
je 0x100362dc
push dword [ebp - 0x7ac]
mov esi, dword [0x10087bfc]
mov ecx, esi
call dword [0x10089918]
call esi
mov dword [ebp - 0x7ac], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x100362de
mov eax, dword [0x10088ab4]
push 0
pop ebx
test eax, eax
jle 0x10036340
sub eax, 1
mov dword [0x10088ab4], eax
jne 0x10036340
mov esi, ebx
mov eax, dword [esi + 0x100883a0]
test eax, eax
je 0x10036314
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10036303
push 0x40
push ebx
push 0x100883a0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x10002d80
mov edi, 0x10087be0
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x10088ab8
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0x1008839c]
mov esi, dword [0x10087c2c]
mov ecx, esi
mov dword [ebp - 0xae0], eax
call dword [0x10089918]
call esi
sub eax, dword [0x10088aa8]
lea edi, [ebp - 0x2ec]
push 8
mov dword [ebp - 0xb58], eax
mov esi, 0x10088ab8
xor eax, eax
xor ebx, ebx
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x1003637f
mov eax, dword [0x10088ab4]
push 0
pop ebx
test eax, eax
jne 0x100369da
push 0x338
mov esi, ebx
mov dword [ebp - 0xb04], ebx
push ebx
mov dword [ebp - 0xad8], ebx
mov dword [ebp - 0xae4], esi
mov dword [ebp - 0xb20], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xb14], ebx
test ebx, ebx
je 0x100369ce
or dword [ebp - 0xb28], 0xffffffff
xor edx, edx
mov eax, edx
mov dword [ebp - 0xb0c], edx
mov dword [ebp - 0xb10], eax
mov edi, edx
mov dword [ebp - 0xb98], eax
mov cl, dl
mov eax, 0x7f1137f
mov dword [ebp - 0x448], 0xab69605e
movzx esi, word [ebp - 0x446]
mov edx, eax
shr edx, 0x10
add ebx, 7
movzx eax, ax
mov dword [ebp - 0xae8], esi
mov esi, edi
mov dword [ebp - 0xbb8], edi
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xaf4], edx
mov dword [ebp - 0xb48], ebx
mov edx, dword [ebp - 0xb90]
movzx ebx, byte [edx - 2]
movzx eax, byte [edx - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 1]
movzx edx, byte [edx + 2]
shl edx, 8
shl ebx, 8
or ebx, eax
mov eax, dword [ebp - 0xb90]
xor edi, ebx
mov dword [ebp - 0xb10], ebx
mov dword [ebp - 0xaf0], edi
mov edi, 0x7f1137f
mov ebx, dword [ebp - 0xaf0]
movzx eax, byte [eax + 3]
or edx, eax
mov eax, dword [ebp - 0xb90]
shl edx, 8
movzx eax, byte [eax + 4]
or edx, eax
mov eax, dword [ebp - 0xb90]
shl edx, 8
add dword [ebp - 0xb90], 8
movzx eax, byte [eax + 5]
or edx, eax
xor esi, edx
mov dword [ebp - 0xad4], edx
xor edi, esi
mov esi, dword [ebp - 0xadc]
xor edi, ebx
xor edi, 0xab69605e
mov eax, edi
rol eax, 0xa
lea edx, [edi + 0x54969fa2]
rol edx, 5
imul edx, esi
add eax, edx
mov edx, 0x7f1137f
xor ebx, eax
mov eax, ebx
rol eax, 2
lea edx, [ebx + edx]
ror edx, 9
imul edx, dword [ebp - 0xae8]
sub edx, eax
xor edi, edx
mov eax, edi
sub eax, esi
imul edx, eax, 0x605e
mov eax, edi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xae8]
rol edx, 6
imul edx, dword [ebp - 0xaf4]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor edi, edx
mov edx, edi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, esi
ror edx, 6
imul eax, dword [ebp - 0xae8]
xor edx, eax
mov eax, 0x7f1137f
xor edi, edx
add eax, edi
ror eax, 0xf
imul eax, eax, 0x605e
mov edx, edi
rol edx, 2
add edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 8
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
imul edx, dword [ebp - 0xaf4]
sub edx, eax
xor edi, edx
mov edx, edi
mov eax, edi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, esi
xor eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xaf4]
imul edx, dword [ebp - 0xae8]
shr eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xaf4]
xor ebx, eax
mov esi, ebx
sub esi, dword [ebp - 0xaf4]
xor esi, edi
xor esi, 0xab69605e
mov edx, esi
mov eax, esi
xor edx, dword [ebp - 0xaf4]
rol edx, 2
imul edx, dword [ebp - 0xadc]
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [ebp - 0xae8]
rol eax, 7
add eax, edx
xor esi, eax
mov eax, esi
mov edx, esi
xor eax, dword [ebp - 0xadc]
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
xor ebx, edx
mov edx, ebx
mov dword [ebp - 0xaf0], ebx
xor edx, dword [ebp - 0xae8]
mov eax, ebx
rol edx, 5
imul edx, dword [ebp - 0xaf4]
rol eax, 7
add eax, edx
mov edx, 0x7f1137f
xor esi, eax
mov ebx, edx
xor ebx, esi
xor ebx, dword [ebp - 0xaf0]
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xae8]
imul eax, dword [ebp - 0xadc]
xor esi, eax
mov eax, esi
sub eax, edx
mov edx, esi
ror eax, 1
imul eax, eax, 0x605e
ror edx, 6
sub eax, edx
xor ebx, eax
mov eax, ebx
rol eax, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [ebp - 0xaf4]
add eax, edx
xor esi, eax
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xadc]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, 0x605e
shr eax, 3
imul edx, dword [ebp - 0xae8]
xor edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
xor eax, edx
mov edx, esi
xor esi, dword [ebp - 0xb28]
rol eax, 4
imul eax, eax, 0x605e
rol edx, 2
mov dword [ebp - 0xb98], esi
xor edx, eax
xor edx, dword [ebp - 0xb0c]
xor ebx, edx
mov edx, dword [ebp - 0xb48]
mov dword [ebp - 0xbb8], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb98]
ror dword [ebp - 0xbb8], 8
mov byte [edx], al
mov al, byte [ebp - 0xbb8]
ror dword [ebp - 0xb98], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb98]
ror dword [ebp - 0xbb8], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xbb8]
ror dword [ebp - 0xb98], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb98]
ror dword [ebp - 0xbb8], 8
mov byte [edx - 2], al
ror dword [ebp - 0xb98], 8
mov al, byte [ebp - 0xbb8]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb98]
mov byte [edx - 3], al
add edx, 8
mov edi, dword [ebp - 0xbb8]
mov esi, dword [ebp - 0xb98]
mov eax, dword [ebp - 0xb10]
ror edi, 8
ror esi, 8
sub dword [ebp - 0xbc8], 1
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0xad4]
mov dword [ebp - 0xbb8], edi
mov dword [ebp - 0xb98], esi
mov dword [ebp - 0xb28], eax
mov dword [ebp - 0xb48], edx
jne 0x1003643b
mov ebx, dword [ebp - 0xb14]
xor eax, eax
mov edx, eax
xor cl, byte [edx + ebx]
inc edx
cmp edx, 0x338
jb 0x100367c2
movzx eax, cl
cdq
cmp eax, dword [0x10007570]
jne 0x100367f6
cmp edx, dword [0x10007574]
jne 0x100367f6
mov esi, dword [ebp - 0xb20]
mov edi, ebx
xor eax, eax
mov dword [ebp - 0xae4], edi
mov ebx, eax
jmp 0x10036808
or dword [ebp - 0xb00], 0xffffffff
mov esi, 0xc004d501
mov edi, dword [ebp - 0xae4]
test ebx, ebx
je 0x1003681f
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10036821
xor ebx, ebx
test esi, esi
js 0x100369c8
mov eax, dword [ebp - 0xb00]
mov esi, edi
push 0x40
push ebx
mov byte [eax + edi], bl
mov ebx, 0x100883a0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], 0
je 0x1003695e
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xb74]
jne 0x10036857
sub ecx, ebx
xor ebx, ebx
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x100369c1
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xad8], ecx
cmp word [eax], dx
je 0x100368a1
mov ecx, 0xc000007b
mov dword [ebp - 0xad8], ecx
jmp 0x100368e9
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x10036894
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x10036894
cmp dword [edx], 0x4550
jne 0x10036894
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xbc4]
je 0x100368d7
cmp ax, word [ebp - 0xb5c]
je 0x100368d7
mov ecx, 0xc000000d
jmp 0x10036899
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb14], eax
test eax, eax
je 0x10036952
mov edx, esi
mov dword [ebp - 0xad4], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb10], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x1003690a
sub edx, dword [ebp - 0xb10]
inc esi
add esi, edx
test ecx, ecx
js 0x10036943
push dword [ebp - 0xad4]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1003695e
mov ecx, dword [ebp - 0xb04]
mov dword [ecx*4 + 0x10087be0], eax
mov ecx, dword [ebp - 0xad8]
inc dword [ebp - 0xb04]
inc ebx
cmp ebx, dword [ebp - 0xb14]
jb 0x100368f9
add edi, 0x10
cmp byte [esi], 0
jne 0x10036850
mov ebx, dword [ebp - 0xad8]
mov esi, dword [ebp - 0xae4]
test esi, esi
je 0x1003697f
push esi
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jns 0x100369d5
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0x100883a0]
test eax, eax
je 0x10036998
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10036987
push 0x40
push ebx
push 0x100883a0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x10002d80
mov edi, 0x10087be0
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x100369e2
mov ebx, 0xc000007a
jmp 0x10036964
mov esi, dword [ebp - 0xae4]
mov ebx, 0xc000007a
jmp 0x1003696a
mov eax, dword [0x10088ab4]
inc eax
xor ebx, ebx
mov dword [0x10088ab4], eax
xor eax, eax
mov edi, 0x10088ab8
xchg dword [edi], eax
mov eax, dword [ebp - 0xb58]
xor ecx, ecx
mov esi, dword [0x10087c48]
inc ecx
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0xae0]
mov dword [ebp - 0x2d0], eax
lea eax, [ebp - 0x2ec]
push eax
push 4
push 0x2021
mov dword [ebp - 0x2ec], ecx
mov dword [ebp - 0x2e4], ecx
mov dword [ebp - 0x2d8], ecx
mov dword [ebp - 0x2dc], ecx
mov dword [ebp - 0x2d4], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x2e0], 0x9966f291
call dword [0x10089918]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x10036a4f
mov eax, dword [0x10088ab4]
push 0
pop ebx
test eax, eax
jle 0x10036ab1
sub eax, 1
mov dword [0x10088ab4], eax
jne 0x10036ab1
mov esi, ebx
mov eax, dword [esi + 0x100883a0]
test eax, eax
je 0x10036a85
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10036a74
push 0x40
push ebx
push 0x100883a0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x10002d80
mov edi, 0x10087be0
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x10088ab8
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xaec]
mov esi, dword [0x10087c90]
mov ecx, esi
push ebx
call dword [0x10089918]
call esi
lea ecx, [ebp - 0xc60]
call fcn.1006cde4
xor eax, eax
mov dword [ebp - 0xac0], ebx
lea edi, [ebp - 0xb68]
mov esi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xc34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xb14], ebx
test ebx, ebx
je 0x10038aea
push edi
push 0x10087e70
push ebx
call sub.msvcrt.dll_memcpy
mov esi, ebx
add esp, 0xc
mov dword [ebp - 0xad0], esi
push 8
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x10038aea
mov ecx, dword [0x10087e68]
mov edi, ebx
mov dword [ebx], ecx
mov ecx, dword [0x10087e6c]
mov dword [ebx + 4], ecx
mov dword [ebp - 0xac0], edi
rdtsc
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb58], edx
mov eax, 0xc4
push eax
push 8
mov dword [ebp - 0xb64], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x10038af0
mov dword [ebp - 0xb60], edx
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xb68], ecx
lea eax, [edx + 4]
cmp eax, edx
jb 0x10036bb3
mov edi, eax
jmp 0x10036bb6
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x10036beb
mov ecx, dword [ebp - 0xb64]
lea eax, [edx + 8]
add ecx, edx
cmp eax, ecx
ja 0x10038ae4
push 4
pop eax
mov dword [edx], eax
mov dword [edi], eax
mov ecx, dword [ebp - 0xb68]
inc ecx
mov dword [ebp - 0xb68], ecx
test esi, esi
js 0x10038ae4
cmp dword [ebp - 0xb60], 0
jne 0x10036c37
mov edx, dword [ebp - 0xb64]
lea eax, [edx + 0xa4]
cmp eax, edx
jb 0x10036c10
mov esi, eax
jmp 0x10036c13
or esi, 0xffffffff
cmp eax, edx
mov dword [ebp - 0xb64], esi
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x10036d07
inc ecx
mov dword [ebp - 0xb68], ecx
jmp 0x10036d0f
mov edx, dword [ebp - 0xb60]
xor eax, eax
mov esi, eax
test ecx, ecx
je 0x10036ca7
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xad4], edx
cmp eax, 4
jb 0x10036c59
mov edi, eax
jmp 0x10036c5c
or edi, 0xffffffff
cmp eax, 4
jb 0x10036c69
mov dword [ebp - 0xc64], edi
jmp 0x10036c6f
mov edi, dword [ebp - 0xc64]
cmp eax, 4
jb 0x10038ae4
lea eax, [edx + edi]
mov dword [ebp - 0xb10], edx
cmp eax, edx
jb 0x10036c89
mov edx, eax
jmp 0x10036c8c
or edx, 0xffffffff
cmp eax, dword [ebp - 0xb10]
sbb edi, edi
and edi, 0xc0000095
cmp eax, dword [ebp - 0xad4]
jb 0x10036d01
inc esi
cmp esi, ecx
jb 0x10036c45
lea eax, [edx + 4]
cmp eax, edx
jb 0x10036cb2
mov esi, eax
jmp 0x10036cb5
or esi, 0xffffffff
cmp eax, edx
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x10036d01
mov ecx, dword [ebp - 0xb64]
lea eax, [edx + 0xa4]
add ecx, dword [ebp - 0xb60]
cmp eax, ecx
ja 0x10038ae4
mov eax, 0xa0
push eax
push dword [ebp - 0xb14]
mov dword [edx], eax
push esi
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xb68]
add esp, 0xc
inc ecx
mov dword [ebp - 0xb68], ecx
mov esi, dword [ebp - 0xb64]
test edi, edi
js 0x10038ae4
cmp dword [ebp - 0xb60], 0
jne 0x10036d4a
mov eax, esi
lea esi, [eax + 0xc]
mov edx, esi
cmp esi, eax
jae 0x10036d26
or esi, 0xffffffff
cmp edx, eax
mov dword [ebp - 0xb64], esi
sbb edi, edi
and edi, 0xc0000095
cmp edx, eax
jb 0x10036e2c
inc ecx
mov dword [ebp - 0xb68], ecx
jmp 0x10036e3d
mov edx, dword [ebp - 0xb60]
xor eax, eax
mov dword [ebp - 0xb00], eax
test ecx, ecx
je 0x10036dca
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xad4], edx
cmp eax, 4
jb 0x10036d70
mov edi, eax
jmp 0x10036d73
or edi, 0xffffffff
cmp eax, 4
jb 0x10036d80
mov dword [ebp - 0xc84], edi
jmp 0x10036d86
mov edi, dword [ebp - 0xc84]
cmp eax, 4
jb 0x10038ae4
lea eax, [edx + edi]
mov dword [ebp - 0xb10], edx
cmp eax, edx
jb 0x10036da0
mov edx, eax
jmp 0x10036da3
or edx, 0xffffffff
cmp eax, dword [ebp - 0xb10]
sbb edi, edi
and edi, 0xc0000095
cmp eax, dword [ebp - 0xad4]
jb 0x10036e2c
mov edi, dword [ebp - 0xb00]
inc edi
mov dword [ebp - 0xb00], edi
cmp edi, ecx
jb 0x10036d5c
lea eax, [edx + 4]
cmp eax, edx
jb 0x10036dd9
mov dword [ebp - 0xb00], eax
jmp 0x10036de2
or edi, 0xffffffff
mov dword [ebp - 0xb00], edi
cmp eax, edx
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x10036e2c
mov ecx, dword [ebp - 0xb60]
lea eax, [edx + 0xc]
add ecx, esi
cmp eax, ecx
ja 0x10038ae4
mov ecx, dword [ebp - 0xb00]
mov dword [edx], 8
mov eax, dword [ebx]
mov dword [ecx], eax
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0xb68]
mov esi, dword [ebp - 0xb64]
inc ecx
mov dword [ebp - 0xb68], ecx
test edi, edi
js 0x10038ae4
cmp dword [ebp - 0xb60], 0
jne 0x10036e6f
mov eax, esi
lea esi, [eax + 0xc]
mov edx, esi
cmp esi, eax
jae 0x10036e4b
or esi, 0xffffffff
cmp edx, eax
mov dword [ebp - 0xb64], esi
sbb edi, edi
and edi, 0xc0000095
cmp edx, eax
jb 0x10036f38
inc ecx
mov dword [ebp - 0xb68], ecx
jmp 0x10036f40
mov edx, dword [ebp - 0xb60]
xor eax, eax
mov ebx, eax
test ecx, ecx
je 0x10036edf
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xad4], edx
cmp eax, 4
jb 0x10036e91
mov edi, eax
jmp 0x10036e94
or edi, 0xffffffff
cmp eax, 4
jb 0x10036ea1
mov dword [ebp - 0xcc0], edi
jmp 0x10036ea7
mov edi, dword [ebp - 0xcc0]
cmp eax, 4
jb 0x10038ae4
lea eax, [edx + edi]
mov dword [ebp - 0xb10], edx
cmp eax, edx
jb 0x10036ec1
mov edx, eax
jmp 0x10036ec4
or edx, 0xffffffff
cmp eax, dword [ebp - 0xb10]
sbb edi, edi
and edi, 0xc0000095
cmp eax, dword [ebp - 0xad4]
jb 0x10036f38
inc ebx
cmp ebx, ecx
jb 0x10036e7d
lea eax, [edx + 4]
cmp eax, edx
jb 0x10036eea
mov ebx, eax
jmp 0x10036eed
or ebx, 0xffffffff
cmp eax, edx
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x10036f38
mov ecx, dword [ebp - 0xb60]
lea eax, [edx + 0xc]
add ecx, esi
cmp eax, ecx
ja 0x10038ae4
mov eax, dword [ebp - 0xb20]
mov dword [edx], 8
mov dword [ebx], eax
mov eax, dword [ebp - 0xb58]
mov dword [ebx + 4], eax
mov ecx, dword [ebp - 0xb68]
mov esi, dword [ebp - 0xb64]
inc ecx
mov dword [ebp - 0xb68], ecx
test edi, edi
js 0x10038ae4
xor edx, edx
mov edi, edx
mov dword [ebp - 0xb2c], edx
mov ebx, edx
mov dword [ebp - 0xb24], edx
mov dword [ebp - 0xb48], edx
mov dword [ebp - 0xae0], edx
mov dword [ebp - 0xac8], edx
mov dword [ebp - 0xad8], edx
mov dword [ebp - 0xb18], edx
mov dword [ebp - 0xb04], edx
rdtsc
mov dword [ebp - 0xb74], edi
mov dword [ebp - 0xaf8], ebx
mov dword [ebp - 0xb10], eax
mov dword [ebp - 0xad4], edx
lea eax, [esi + 8]
cmp eax, 8
jb 0x10036f9c
mov edx, eax
jmp 0x10036f9f
or edx, 0xffffffff
cmp eax, 8
sbb esi, esi
and esi, 0xc0000095
cmp eax, 8
jb 0x1003709f
lea eax, [edx + 7]
and eax, 0xfffffff8
mov dword [ebp - 0xb00], eax
cmp eax, edx
jae 0x10036fcd
mov esi, 0xc0000095
jmp 0x1003709f
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x10036fef
mov esi, 0xc0000017
mov edi, ebx
jmp 0x10037099
mov eax, dword [ebp - 0xb68]
mov dword [edi], eax
lea eax, [edi + 4]
cmp eax, edi
jb 0x10037002
mov ecx, eax
jmp 0x10037005
or ecx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x1003707e
mov eax, dword [ebp - 0xb64]
mov dword [ecx], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x10037026
mov edx, eax
jmp 0x10037029
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1003707e
mov eax, dword [ebp - 0xb00]
mov ecx, dword [ebp - 0xb10]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xad4]
mov dword [edi + eax - 4], ecx
push dword [ebp - 0xb64]
push dword [ebp - 0xb60]
push edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xb00]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xb2c], edi
mov edi, ecx
mov dword [ebp - 0xb74], eax
jmp 0x10037080
xor ecx, ecx
test edi, edi
je 0x10037093
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xb74]
mov ecx, dword [ebp - 0xb68]
or esi, 0x10000000
jl 0x100388e7
xor edx, edx
mov dword [ebp - 0xaf0], edx
cmp dword [ebp - 0xb2c], edx
jne 0x100370c5
mov esi, 0xc000000d
jmp 0x1003772d
test edi, edi
je 0x10037728
lea eax, [edi + 8]
push eax
push edx
mov dword [ebp - 0xb14], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xb5c], esi
test esi, esi
je 0x10037722
xor ebx, ebx
mov cl, bl
mov edx, ebx
test edi, edi
je 0x10037113
mov esi, dword [ebp - 0xb2c]
xor cl, byte [edx + esi]
inc edx
cmp edx, edi
jb 0x10037105
mov esi, dword [ebp - 0xb5c]
mov eax, edi
mov dword [ebp - 0xb94], ebx
shr eax, 3
or ebx, 0xffffffff
mov dword [ebp - 0x450], 0xb1b54a58
mov dword [ebp - 0xb3c], ebx
mov dword [ebp - 0xb28], eax
test eax, eax
je 0x1003754c
movzx edx, word [ebp - 0x44e]
mov eax, 0xc81ecb17
movzx esi, ax
shr eax, 0x10
mov dword [ebp - 0xae4], eax
mov eax, dword [ebp - 0xb5c]
mov dword [ebp - 0xaec], esi
add eax, 7
mov esi, dword [ebp - 0xb2c]
mov dword [ebp - 0xb0c], eax
add esi, 2
xor eax, eax
mov dword [ebp - 0xae8], edx
mov dword [ebp - 0xb00], eax
mov dword [ebp - 0xbc8], eax
movzx edx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl edx, 8
or edx, eax
shl edi, 8
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
or edi, eax
mov dword [ebp - 0xb10], edx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
shl edi, 8
add esi, 8
or edi, eax
mov dword [ebp - 0xad4], esi
xor ebx, edi
mov eax, 0xc81ecb17
mov dword [ebp - 0xb3c], ebx
add ebx, 0xffffb5a8
xor ebx, edx
xor ebx, dword [ebp - 0xb94]
xor ebx, eax
mov esi, ebx
mov edx, ebx
xor esi, eax
ror edx, 7
mov eax, dword [ebp - 0xae8]
ror esi, 0xf
imul eax, esi
add edx, eax
mov eax, dword [ebp - 0xb3c]
xor eax, edx
mov dword [ebp - 0xb3c], eax
mov edx, eax
ror edx, 0xa
lea esi, [eax - 0x4e4ab5a8]
mov eax, dword [ebp - 0xaec]
ror esi, 9
imul eax, esi
mov esi, dword [ebp - 0xaec]
sub eax, edx
xor ebx, eax
mov eax, dword [ebp - 0xae4]
xor esi, ebx
mov edx, ebx
rol esi, 4
imul eax, esi
mov esi, dword [ebp - 0xb3c]
rol edx, 5
add edx, eax
mov eax, 0xc81ecb17
xor esi, edx
mov edx, esi
xor edx, 0xb1b54a58
sub eax, edx
xor ebx, eax
mov eax, ebx
shr eax, 6
lea edx, [ebx - 0x4a58]
imul edx, dword [ebp - 0xae8]
sub edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xf
xor eax, dword [ebp - 0xaec]
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, dword [ebp - 0xae4]
imul eax, dword [ebp - 0xaec]
xor esi, eax
mov eax, esi
sub eax, 0xc81ecb17
sub eax, 0x4a58
xor ebx, eax
mov eax, dword [ebp - 0xae4]
xor eax, ebx
mov edx, ebx
imul eax, dword [ebp - 0xae8]
ror edx, 0xa
xor edx, eax
mov eax, dword [ebp - 0xaec]
xor esi, edx
mov dword [ebp - 0xb3c], esi
xor esi, 0x4a58
mov edx, dword [ebp - 0xb3c]
ror edx, 3
rol esi, 6
imul eax, esi
mov esi, dword [ebp - 0xb3c]
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xae4]
mov eax, ebx
ror eax, 0xf
sub eax, edx
imul eax, eax, 0x4a58
xor esi, eax
xor edx, esi
mov eax, esi
shr eax, 1
imul edx, edx, 0x4a58
xor edx, eax
mov eax, esi
sub eax, dword [ebp - 0xaec]
xor ebx, edx
rol eax, 3
imul edx, eax, 0x4a58
mov eax, esi
shr eax, 0xf
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
sub edx, dword [ebp - 0xaec]
imul edx, dword [ebp - 0xae8]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xaec]
xor esi, edx
mov dword [ebp - 0xb3c], esi
mov esi, 0xb1b54a58
mov edx, dword [ebp - 0xb3c]
sub esi, edx
ror esi, 9
imul eax, esi
mov esi, dword [ebp - 0xb3c]
ror edx, 0xb
xor edx, eax
xor ebx, edx
mov eax, ebx
sub eax, dword [ebp - 0xae4]
add eax, 0x4e4ab5a8
xor esi, eax
mov eax, dword [ebp - 0xae8]
xor eax, esi
mov dword [ebp - 0xb3c], esi
imul eax, eax, 0x4a58
mov edx, esi
mov esi, dword [ebp - 0xae4]
ror edx, 7
sub eax, edx
xor ebx, eax
mov eax, dword [ebp - 0xae8]
xor esi, ebx
mov edx, ebx
rol esi, 4
imul eax, esi
ror edx, 0x10
sub eax, edx
mov edx, dword [ebp - 0xb3c]
xor edx, eax
mov eax, dword [ebp - 0xaec]
mov esi, 0xb1b54a58
sub esi, edx
mov dword [ebp - 0xb3c], edx
ror edx, 4
ror esi, 0xa
imul eax, esi
add edx, eax
mov eax, dword [ebp - 0xae4]
xor ebx, edx
mov edx, ebx
ror edx, 9
lea esi, [ebx + 0x4e4ab5a8]
ror esi, 4
imul eax, esi
mov esi, dword [ebp - 0xb3c]
xor edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xb3c], esi
xor eax, 0xc81ecb17
mov edx, esi
rol eax, 8
mov esi, 0xc81ecb17
imul eax, eax, 0x4a58
rol edx, 2
sub eax, edx
xor ebx, eax
mov eax, dword [ebp - 0xae8]
sub esi, ebx
mov edx, ebx
ror edx, 0xc
ror esi, 0xb
imul eax, esi
mov esi, dword [ebp - 0xb3c]
sub eax, edx
mov edx, dword [ebp - 0xae8]
xor esi, eax
xor edx, esi
mov eax, esi
imul edx, dword [ebp - 0xaec]
shr eax, 8
xor edx, eax
xor ebx, edx
mov edx, 0xc81ecb17
mov eax, ebx
xor ebx, dword [ebp - 0xb00]
xor edx, eax
mov dword [ebp - 0xb94], ebx
xor edx, esi
xor edx, dword [ebp - 0xbc8]
xor edx, 0xb1b54a58
mov dword [ebp - 0xb3c], edx
mov edx, dword [ebp - 0xb0c]
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb3c]
ror dword [ebp - 0xb94], 8
mov byte [edx], al
mov al, byte [ebp - 0xb94]
ror dword [ebp - 0xb3c], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb3c]
ror dword [ebp - 0xb94], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb94]
ror dword [ebp - 0xb3c], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb3c]
ror dword [ebp - 0xb94], 8
mov byte [edx - 2], al
ror dword [ebp - 0xb3c], 8
mov al, byte [ebp - 0xb94]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb3c]
mov byte [edx - 3], al
mov ebx, dword [ebp - 0xb3c]
ror dword [ebp - 0xb94], 8
mov eax, dword [ebp - 0xb10]
ror ebx, 8
mov dword [ebp - 0xb3c], ebx
mov dword [ebp - 0xb00], eax
mov esi, dword [ebp - 0xad4]
add edx, 8
sub dword [ebp - 0xb28], 1
mov dword [ebp - 0xbc8], edi
mov dword [ebp - 0xb0c], edx
jne 0x10037189
mov edi, dword [ebp - 0xb74]
mov esi, dword [ebp - 0xb5c]
movzx eax, cl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x10037578
mov esi, 0xc0000017
jmp 0x10037679
mov ebx, dword [ebp - 0xb14]
push ebx
push 8
mov dword [edi], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x1003759d
mov esi, 0xc0000017
xor ebx, ebx
jmp 0x10037618
mov dword [edi + 4], eax
push ebx
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov esi, 0xa0
mov dword [edi + 8], esi
push esi
push 8
pop ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x10037594
mov dword [edi + 0xc], eax
push esi
push 0x10087dc0
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [edi + 0x10], ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
xor ebx, ebx
test ecx, ecx
jne 0x100375fc
mov esi, 0xc0000017
jmp 0x10037618
mov dword [edi + 0x14], ecx
mov esi, ebx
mov eax, dword [0x10087e60]
mov dword [ecx], eax
mov eax, dword [0x10087e64]
mov dword [ebp - 0xaf0], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0x10037679
cmp dword [edi + 4], 0
je 0x10037636
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x10037650
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x1003766a
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x1003768f
mov edi, dword [ebp - 0xaf0]
xor eax, eax
mov dword [ebp - 0xaf8], edi
mov ebx, eax
jmp 0x10037695
mov ebx, dword [ebp - 0xaf0]
mov eax, dword [ebp - 0xb5c]
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x10037714
xor eax, eax
cmp dword [ebx + 4], eax
je 0x100376cd
push dword [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebx + 4], eax
cmp dword [ebx + 0xc], 0
je 0x100376e9
push dword [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0xc], eax
cmp dword [ebx + 0x14], 0
je 0x10037705
push dword [ebx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0x14], eax
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xb68]
mov ebx, dword [ebp - 0xaf8]
jmp 0x1003772d
mov ecx, dword [ebp - 0xb68]
mov esi, 0xc0000001
or esi, 0x10000000
jl 0x100388e1
mov edx, dword [ebx]
add edx, 4
cmp edx, 4
jb 0x10037747
mov eax, edx
jmp 0x1003774a
or eax, 0xffffffff
cmp edx, 4
sbb esi, esi
and esi, 0xc0000095
cmp edx, 4
jb 0x100377de
lea edx, [eax + 4]
cmp edx, eax
jb 0x10037769
mov edi, edx
jmp 0x1003776c
or edi, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
cmp edx, eax
jb 0x100377de
mov eax, dword [ebx + 8]
add eax, edi
cmp eax, edi
jb 0x10037787
mov edx, eax
jmp 0x1003778a
or edx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x100377de
lea edi, [edx + 4]
cmp edi, edx
jb 0x100377a3
mov eax, edi
jmp 0x100377a6
or eax, 0xffffffff
cmp edi, edx
sbb esi, esi
and esi, 0xc0000095
cmp edi, edx
jb 0x100377de
mov edx, dword [ebx + 0x10]
add edx, eax
cmp edx, eax
jb 0x100377c7
mov edi, edx
mov dword [ebp - 0xaf0], edx
jmp 0x100377d0
or edi, 0xffffffff
mov dword [ebp - 0xaf0], edi
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
cmp edx, eax
jae 0x100377ea
mov edi, dword [ebp - 0xd14]
mov dword [ebp - 0xaf0], edi
test esi, esi
js 0x10037963
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x10037812
mov esi, 0xc0000017
jmp 0x1003795d
mov eax, dword [ebx]
lea ecx, [edi + 4]
mov dword [edi], eax
cmp ecx, edi
jb 0x10037827
mov eax, ecx
mov dword [ebp - 0xb00], ecx
jmp 0x10037830
or eax, 0xffffffff
mov dword [ebp - 0xb00], eax
cmp ecx, edi
sbb esi, esi
and esi, 0xc0000095
cmp ecx, edi
jb 0x10037948
push dword [ebx]
push dword [ebx + 4]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebx]
add esp, 0xc
mov ecx, dword [ebp - 0xb00]
add eax, ecx
cmp eax, ecx
jb 0x10037862
mov edx, eax
jmp 0x10037865
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10037948
mov eax, dword [ebx + 8]
lea ecx, [edx + 4]
mov dword [edx], eax
cmp ecx, edx
jb 0x1003788d
mov eax, ecx
mov dword [ebp - 0xb00], ecx
jmp 0x10037896
or eax, 0xffffffff
mov dword [ebp - 0xb00], eax
cmp ecx, edx
sbb esi, esi
and esi, 0xc0000095
cmp ecx, edx
jb 0x10037948
push dword [ebx + 8]
push dword [ebx + 0xc]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebx + 8]
add esp, 0xc
mov edx, dword [ebp - 0xb00]
add eax, edx
cmp eax, edx
jb 0x100378ca
mov ecx, eax
jmp 0x100378cd
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x10037948
mov eax, dword [ebx + 0x10]
lea edx, [ecx + 4]
mov dword [ecx], eax
cmp edx, ecx
jb 0x100378f1
mov eax, edx
mov dword [ebp - 0xb00], edx
jmp 0x100378fa
or eax, 0xffffffff
mov dword [ebp - 0xb00], eax
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
cmp edx, ecx
jb 0x10037948
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xb00]
add esp, 0xc
mov eax, dword [ebx + 0x10]
add eax, ecx
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10037948
mov eax, dword [ebp - 0xaf0]
xor ecx, ecx
mov dword [ebp - 0xb24], edi
mov edi, ecx
mov dword [ebp - 0xb48], eax
jmp 0x1003794a
xor ecx, ecx
test edi, edi
je 0x1003795d
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xb68]
or esi, 0x10000000
jl 0x100388e1
xor eax, eax
mov dword [ebp - 0xb00], eax
mov dword [ebp - 0xaf0], eax
mov ebx, eax
cmp dword [ebp - 0xb60], eax
jne 0x10037991
mov esi, 0xc000000d
jmp 0x10037a16
xor edx, edx
inc edx
cmp ecx, edx
jbe 0x10037987
mov edx, dword [ebp - 0xb60]
mov eax, dword [edx]
lea edi, [edx + 4]
mov dword [ebp - 0xb10], eax
cmp edi, edx
jb 0x100379b1
mov eax, edi
jmp 0x100379b4
or eax, 0xffffffff
cmp edi, edx
sbb esi, esi
and esi, 0xc0000095
cmp edi, edx
jb 0x10037a02
mov edx, dword [ebp - 0xb10]
add edx, eax
mov edi, edx
cmp edx, eax
jae 0x100379d3
or edx, 0xffffffff
cmp edi, eax
sbb esi, esi
and esi, 0xc0000095
cmp edi, eax
jb 0x10037a02
xor eax, eax
inc ebx
inc eax
cmp ebx, eax
jb 0x1003799e
lea eax, [edx + 4]
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x10037a02
mov eax, dword [edx]
mov dword [ebp - 0xb00], eax
test esi, esi
js 0x10037a10
cmp ecx, 2
ja 0x10037a42
mov esi, 0xc000000d
mov ebx, dword [ebp - 0xac8]
test esi, esi
js 0x100388e1
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x10037b31
mov esi, 0xd0000017
jmp 0x100388e1
mov ecx, dword [ebp - 0xb60]
xor eax, eax
mov edi, eax
mov ebx, dword [ecx]
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x10037a59
mov eax, edx
jmp 0x10037a5c
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
cmp edx, ecx
jb 0x10037aa0
lea ecx, [ebx + eax]
mov edx, ecx
cmp ecx, eax
jae 0x10037a76
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
cmp edx, eax
jb 0x10037aa0
inc edi
cmp edi, 2
jb 0x10037a4c
lea eax, [ecx + 4]
mov edi, 0xc0000095
cmp eax, ecx
sbb esi, esi
and esi, edi
cmp eax, ecx
jb 0x10037aa5
mov ebx, dword [ecx]
jmp 0x10037aab
mov edi, 0xc0000095
mov ebx, dword [ebp - 0xaf0]
test esi, esi
js 0x10037a10
mov eax, dword [ebp - 0xb00]
add eax, 0x30
cmp eax, 0x30
jb 0x10037ac5
mov ecx, eax
jmp 0x10037ac8
or ecx, 0xffffffff
cmp eax, 0x30
sbb esi, esi
and esi, edi
cmp eax, 0x30
jb 0x10037b04
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x10037adf
mov eax, edx
jmp 0x10037ae2
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, edi
cmp edx, ecx
jb 0x10037b04
lea edx, [eax + ebx]
cmp edx, eax
jb 0x10037af7
mov ecx, edx
jmp 0x10037afa
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, edi
cmp edx, eax
jae 0x10037b0a
mov ecx, dword [ebp - 0xd10]
test esi, esi
js 0x10037a10
cmp ecx, 0x400000
jbe 0x10037b24
mov esi, 0x8000ffff
jmp 0x100388e1
mov ebx, ecx
mov dword [ebp - 0xac8], ebx
jmp 0x10037a16
mov dword [ebp - 0xae0], edi
mov eax, dword [ebp - 0xb24]
test eax, eax
jne 0x10037b4b
mov esi, 0x80070057
jmp 0x100388e1
mov dword [ebp - 0xce8], eax
mov eax, dword [ebp - 0xb48]
mov dword [ebp - 0xce0], eax
lea eax, [ebp - 0xc1c]
push eax
xor eax, eax
mov dword [ebp - 0xcdc], ebx
push 0x10006dc8
inc eax
mov dword [ebp - 0xce4], edi
xor ebx, ebx
push eax
mov dword [ebp - 0xcd8], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x10037bb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10037ba2
movzx esi, si
or esi, 0x80070000
test esi, esi
mov eax, dword [ebp - 0xac8]
js 0x10037bff
mov esi, 0x80004005
jmp 0x10037bff
push 0x10009210
push dword [ebp - 0xc1c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10037b8b
push ebx
push 0x14
lea eax, [ebp - 0xce8]
mov ecx, esi
push eax
push 0x86
call dword [0x10089918]
call esi
mov esi, eax
or esi, 0x10000000
jl 0x10037bf9
mov eax, dword [ebp - 0xcdc]
mov dword [ebp - 0xac8], eax
jmp 0x10037bff
mov eax, dword [ebp - 0xac8]
cmp esi, 0xd0000023
jne 0x10037c11
mov esi, 0x8007007a
jmp 0x100388e7
test esi, esi
js 0x100388e7
xor ecx, ecx
cmp eax, 4
jae 0x10037c2a
mov esi, 0xc000003e
jmp 0x1003801a
mov ecx, dword [edi]
lea eax, [edi + 4]
mov dword [ebp - 0xaf0], ecx
cmp eax, edi
jb 0x10037c43
mov edx, eax
mov dword [ebp - 0xb5c], eax
jmp 0x10037c4c
or edx, 0xffffffff
mov dword [ebp - 0xb5c], edx
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x10038018
mov eax, dword [ebp - 0xac8]
add eax, 0xfffffffc
cmp eax, ecx
jae 0x10037c75
mov esi, 0xc000003e
jmp 0x10038018
lea edi, [edx + ecx]
cmp edi, edx
jb 0x10037c80
mov edx, edi
jmp 0x10037c83
or edx, 0xffffffff
cmp edi, dword [ebp - 0xb5c]
sbb esi, esi
and esi, 0xc0000095
cmp edi, dword [ebp - 0xb5c]
jb 0x10038018
lea eax, [ecx + 4]
cmp eax, 4
jb 0x10037ca9
mov ecx, eax
jmp 0x10037cac
or ecx, 0xffffffff
cmp eax, 4
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
cmp eax, 4
jb 0x10038018
mov eax, dword [ebp - 0xac8]
sub eax, ecx
cmp eax, 4
jb 0x10037c6b
mov eax, dword [edx]
mov dword [ebp - 0xb00], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x10037ce5
mov dword [ebp - 0xbc4], eax
jmp 0x10037cec
or dword [ebp - 0xbc4], 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, edi
cmp eax, edx
jb 0x10038018
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x10037d05
mov edi, eax
jmp 0x10037d08
or edi, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10038018
mov eax, dword [ebp - 0xac8]
mov edx, dword [ebp - 0xb00]
sub eax, edi
cmp eax, edx
jb 0x10037c6b
mov eax, dword [ebp - 0xbc4]
lea esi, [edx + eax]
mov dword [ebp - 0xb10], esi
cmp esi, eax
jb 0x10037d47
mov ecx, esi
jmp 0x10037d4a
or ecx, 0xffffffff
cmp esi, eax
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xb10], eax
jb 0x10038018
lea eax, [edx + edi]
cmp eax, edi
jb 0x10037d6b
mov edx, eax
jmp 0x10037d6e
or edx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x10038018
mov eax, dword [ebp - 0xac8]
sub eax, edx
cmp eax, 4
jb 0x10037c6b
mov edi, dword [ecx]
lea eax, [ecx + 4]
mov dword [ebp - 0xb10], edi
cmp eax, ecx
jb 0x10037da8
mov dword [ebp - 0xadc], eax
jmp 0x10037daf
or dword [ebp - 0xadc], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10038018
lea eax, [edx + 4]
cmp eax, edx
jb 0x10037dcc
mov ecx, eax
jmp 0x10037dcf
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x10038018
mov eax, dword [ebp - 0xac8]
sub eax, ecx
cmp eax, edi
jb 0x10037c6b
lea eax, [edi + ecx]
cmp eax, ecx
jb 0x10037dfc
mov edx, eax
jmp 0x10037dff
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10038018
mov eax, dword [ebp - 0xac8]
sub eax, edx
jne 0x10037c6b
mov esi, dword [ebp - 0xb00]
mov ecx, dword [ebp - 0xaf0]
add ecx, 0xc
lea eax, [edi + esi]
add eax, ecx
cmp eax, dword [ebp - 0xac8]
jne 0x10037c6b
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x10037e60
mov esi, 0xc0000017
jmp 0x10037fa3
cmp dword [ebp - 0xb5c], ebx
je 0x10037ead
mov eax, dword [ebp - 0xaf0]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x10037e90
mov esi, 0xc0000017
xor eax, eax
jmp 0x10037f3c
mov dword [edi + 4], eax
mov ecx, dword [ebp - 0xaf0]
push ecx
push dword [ebp - 0xb5c]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0x10037eb4
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
cmp dword [ebp - 0xbc4], ebx
je 0x10037eea
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x10037e84
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xbc4]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0x10037ef0
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
cmp dword [ebp - 0xadc], ebx
je 0x10037f30
mov esi, dword [ebp - 0xb10]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x10037e84
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xadc]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0x10037f36
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov ebx, edi
mov esi, eax
mov edi, eax
test edi, edi
je 0x10037fa3
cmp dword [edi + 4], 0
je 0x10037f5c
push dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x10037f78
push dword [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0x10037f94
push dword [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
test esi, esi
js 0x10037fb1
mov dword [ebp - 0xad8], ebx
mov ebx, ecx
test ebx, ebx
je 0x1003801a
cmp dword [ebx + 4], 0
je 0x10037fd1
push dword [ebx + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 4], ecx
cmp dword [ebx + 0xc], 0
je 0x10037fed
push dword [ebx + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 0xc], ecx
cmp dword [ebx + 0x14], 0
je 0x10038009
push dword [ebx + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 0x14], ecx
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
or esi, 0x10000000
mov ebx, dword [ebp - 0xad8]
jl 0x100388e7
mov dword [ebp - 0xafc], ecx
mov edi, ecx
mov dword [ebp - 0xb48], edi
test ebx, ebx
jne 0x10038048
mov esi, 0xd000000d
jmp 0x100388e7
mov esi, dword [ebx + 4]
mov dword [ebp - 0xb20], esi
test esi, esi
je 0x1003803e
mov ebx, dword [ebx]
test ebx, ebx
jne 0x10038065
mov esi, 0xd000000d
jmp 0x100388e1
add ebx, 0xfffffff8
mov dword [ebp - 0xb58], ecx
push ebx
push ecx
mov dword [ebp - 0xb5c], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb28], eax
test eax, eax
je 0x10038696
xor ecx, ecx
mov dword [ebp - 0x440], 0xab69605e
mov edi, esi
mov dl, cl
mov esi, ebx
mov dword [ebp - 0xbc8], edi
mov ecx, eax
and esi, 7
mov dword [ebp - 0xaf0], ecx
mov dword [ebp - 0xad4], esi
je 0x10038629
or dword [ebp - 0xb6c], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0xb7c], ebx
mov eax, ebx
mov dword [ebp - 0xb1c], ebx
mov dword [ebp - 0xaf4], eax
test esi, esi
je 0x10038133
mov ecx, dword [ebp - 0xbcc]
lea eax, [edi + 1]
mov dword [ebp - 0xb10], eax
movzx eax, byte [edi]
cmp ebx, 4
jge 0x10038105
add ecx, 0xffffffe0
shl eax, cl
or dword [ebp - 0xaf4], eax
jmp 0x1003810d
shl eax, cl
or dword [ebp - 0xb1c], eax
sub dword [ebp - 0xbcc], 8
inc ebx
mov eax, dword [ebp - 0xb10]
mov edi, eax
cmp ebx, esi
jl 0x100380e1
mov ecx, dword [ebp - 0xaf0]
mov dword [ebp - 0xbc8], eax
mov eax, dword [ebp - 0xaf4]
mov ebx, dword [ebp - 0xb1c]
xor eax, 0x92f65a5
xor ebx, 0x699a899c
mov dword [ebp - 0xaec], eax
xor edi, edi
mov dword [ebp - 0xb7c], eax
mov dword [ebp - 0xb6c], ebx
test esi, esi
je 0x100381a1
lea esi, [ecx + 1]
mov dword [ebp - 0xb00], esi
cmp edi, 4
jge 0x10038171
rol eax, 8
mov byte [ecx], al
jmp 0x10038176
rol ebx, 8
mov byte [ecx], bl
mov esi, dword [ebp - 0xad4]
inc edi
mov ecx, dword [ebp - 0xb00]
cmp edi, esi
jl 0x1003815c
mov ebx, dword [ebp - 0xb6c]
mov eax, ecx
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xaec], eax
add esi, 0xfffffffc
test esi, esi
jle 0x100385f7
push 4
pop ecx
sub ecx, esi
shl ecx, 3
shr ebx, cl
shl ebx, cl
mov dword [ebp - 0xb90], ebx
mov dword [ebp - 0xb6c], ebx
mov edi, dword [ebp - 0xaec]
mov ebx, dword [ebp - 0xb5c]
mov eax, ebx
shr eax, 3
mov dword [ebp - 0xb0c], eax
test eax, eax
je 0x100385bc
movzx esi, word [ebp - 0x43e]
mov eax, 0x7f1137f
mov ecx, eax
mov dword [ebp - 0xac8], esi
mov esi, dword [ebp - 0xbc8]
movzx eax, ax
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0xaf0]
shr ecx, 0x10
add eax, 7
mov dword [ebp - 0xb74], ecx
add esi, 2
mov dword [ebp - 0xb00], eax
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx ecx, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl ecx, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or ecx, eax
mov dword [ebp - 0xb10], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl ecx, 8
or ecx, eax
mov dword [ebp - 0xaec], edi
movzx eax, byte [esi + 5]
add esi, 8
mov edi, dword [ebp - 0xb90]
mov ebx, dword [ebp - 0xaec]
shl ecx, 8
or ecx, eax
mov dword [ebp - 0xb14], esi
xor edi, ecx
mov dword [ebp - 0xad4], ecx
xor edi, ebx
mov eax, 0x7f1137f
xor edi, eax
mov eax, dword [ebp - 0xae8]
xor edi, 0xab69605e
mov ecx, edi
rol ecx, 0xa
lea esi, [edi + 0x54969fa2]
rol esi, 5
imul eax, esi
mov esi, 0x7f1137f
add ecx, eax
mov eax, dword [ebp - 0xac8]
xor ebx, ecx
mov ecx, ebx
rol ecx, 2
lea esi, [esi + ebx]
ror esi, 9
imul eax, esi
mov esi, dword [ebp - 0xac8]
sub eax, ecx
xor edi, eax
mov eax, edi
sub eax, dword [ebp - 0xae8]
imul ecx, eax, 0x605e
mov eax, edi
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0xb74]
xor ebx, ecx
xor esi, ebx
mov ecx, ebx
rol esi, 6
imul eax, esi
mov esi, 0x7f1137f
rol ecx, 2
sub eax, ecx
xor edi, eax
mov eax, esi
mov ecx, edi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, dword [ebp - 0xae8]
xor eax, ebx
mov ecx, ebx
imul eax, dword [ebp - 0xac8]
ror ecx, 6
xor ecx, eax
xor edi, ecx
lea eax, [esi + edi]
ror eax, 0xf
imul eax, eax, 0x605e
mov ecx, edi
rol ecx, 2
add ecx, eax
mov eax, dword [ebp - 0xb74]
xor ebx, ecx
mov ecx, ebx
rol ecx, 8
lea esi, [ebx + 0x54969fa2]
ror esi, 0xe
imul eax, esi
sub eax, ecx
xor edi, eax
mov eax, dword [ebp - 0xae8]
mov esi, edi
mov ecx, edi
ror ecx, 0xa
xor esi, 0xab69605e
ror esi, 0xc
imul eax, esi
mov esi, dword [ebp - 0xb74]
xor ecx, eax
xor ebx, ecx
mov ecx, esi
xor ecx, ebx
mov eax, ebx
imul ecx, dword [ebp - 0xac8]
shr eax, 0xa
xor ecx, eax
xor edi, ecx
mov ecx, dword [ebp - 0xae8]
mov eax, edi
mov dword [ebp - 0xb90], edi
not eax
ror eax, 5
add eax, 0x605e
imul eax, esi
xor ebx, eax
mov edi, ebx
sub edi, esi
xor edi, dword [ebp - 0xb90]
xor edi, 0xab69605e
mov eax, edi
xor eax, esi
rol eax, 2
imul ecx, eax
mov eax, edi
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov esi, ebx
mov ecx, ebx
sub esi, eax
rol ecx, 7
mov eax, dword [ebp - 0xac8]
ror esi, 6
imul eax, esi
add ecx, eax
xor edi, ecx
mov eax, edi
mov ecx, edi
xor eax, dword [ebp - 0xae8]
imul eax, eax, 0x605e
ror ecx, 9
add ecx, eax
mov eax, dword [ebp - 0xb74]
xor ebx, ecx
mov esi, ebx
mov dword [ebp - 0xaec], ebx
xor esi, dword [ebp - 0xac8]
mov ecx, ebx
rol esi, 5
imul eax, esi
rol ecx, 7
add ecx, eax
xor edi, ecx
mov ecx, 0x7f1137f
mov ebx, edi
xor ebx, dword [ebp - 0xaec]
xor ebx, ecx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xac8]
imul eax, dword [ebp - 0xae8]
xor edi, eax
mov eax, edi
sub eax, ecx
mov ecx, edi
ror eax, 1
imul eax, eax, 0x605e
ror ecx, 6
sub eax, ecx
xor ebx, eax
mov eax, dword [ebp - 0xb74]
mov ecx, ebx
rol ecx, 0xe
lea esi, [ebx - 0x54969fa2]
rol esi, 3
imul eax, esi
add ecx, eax
mov eax, dword [ebp - 0xae8]
xor edi, ecx
mov ecx, edi
ror ecx, 0xe
lea esi, [edi - 0x54969fa2]
rol esi, 0xf
imul eax, esi
mov esi, dword [ebp - 0xb00]
sub eax, ecx
xor ebx, eax
mov ecx, ebx
mov eax, ebx
xor ecx, 0x605e
shr eax, 3
imul ecx, dword [ebp - 0xac8]
xor ecx, eax
xor edi, ecx
mov ecx, 0x7f1137f
mov eax, edi
xor eax, ecx
mov ecx, edi
xor edi, dword [ebp - 0xb1c]
rol eax, 4
imul eax, eax, 0x605e
rol ecx, 2
mov dword [ebp - 0xb6c], edi
xor ecx, eax
xor ecx, dword [ebp - 0xaf4]
xor ebx, ecx
mov dword [ebp - 0xb7c], ebx
mov byte [esi - 4], bl
mov al, byte [ebp - 0xb6c]
ror dword [ebp - 0xb7c], 8
mov byte [esi], al
mov al, byte [ebp - 0xb7c]
ror dword [ebp - 0xb6c], 8
mov byte [esi - 5], al
mov al, byte [ebp - 0xb6c]
ror dword [ebp - 0xb7c], 8
mov byte [esi - 1], al
mov al, byte [ebp - 0xb7c]
ror dword [ebp - 0xb6c], 8
mov byte [esi - 6], al
mov al, byte [ebp - 0xb6c]
ror dword [ebp - 0xb7c], 8
mov byte [esi - 2], al
ror dword [ebp - 0xb6c], 8
mov al, byte [ebp - 0xb7c]
mov byte [esi - 7], al
mov al, byte [ebp - 0xb6c]
mov byte [esi - 3], al
mov edi, dword [ebp - 0xb7c]
mov ecx, dword [ebp - 0xb6c]
mov eax, dword [ebp - 0xb10]
ror edi, 8
ror ecx, 8
mov dword [ebp - 0xb7c], edi
mov dword [ebp - 0xb90], ecx
mov dword [ebp - 0xb6c], ecx
mov dword [ebp - 0xaf4], eax
mov eax, dword [ebp - 0xad4]
add esi, 8
sub dword [ebp - 0xb0c], 1
mov dword [ebp - 0xb00], esi
mov esi, dword [ebp - 0xb14]
mov dword [ebp - 0xb1c], eax
jne 0x10038221
mov ebx, dword [ebp - 0xb5c]
mov ecx, dword [ebp - 0xb28]
xor eax, eax
mov esi, eax
test ebx, ebx
je 0x100385d2
xor dl, byte [esi + ecx]
inc esi
cmp esi, ebx
jb 0x100385ca
mov esi, dword [ebp - 0xb20]
movzx eax, dl
cdq
cmp eax, dword [ebx + esi]
jne 0x10038653
cmp edx, dword [ebx + esi + 4]
jne 0x10038653
xor eax, eax
mov edi, ecx
mov esi, ebx
mov ecx, eax
mov ebx, dword [ebp - 0xb58]
jmp 0x10038666
xor ecx, ecx
mov dword [ebp - 0xb90], ecx
mov dword [ebp - 0xb6c], ecx
test esi, esi
jns 0x100381c4
neg esi
shl esi, 3
mov ecx, esi
shr eax, cl
shl eax, cl
mov dword [ebp - 0xaec], eax
mov dword [ebp - 0xb7c], eax
jmp 0x100381c4
xor eax, eax
or dword [ebp - 0xb1c], 0xffffffff
mov ecx, eax
mov dword [ebp - 0xaf4], eax
mov edi, eax
mov dword [ebp - 0xb90], ecx
mov dword [ebp - 0xb6c], ecx
mov dword [ebp - 0xb7c], edi
jmp 0x100381d0
mov edi, dword [ebp - 0xb48]
mov ebx, 0xc004d501
mov esi, dword [ebp - 0xafc]
xor eax, eax
test ecx, ecx
je 0x10038679
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
js 0x10038696
mov ebx, esi
mov dword [ebp - 0xb18], edi
xor eax, eax
mov dword [ebp - 0xb04], ebx
mov edi, eax
mov esi, 0x10000000
jmp 0x100386a3
mov ebx, dword [ebp - 0xb04]
mov esi, 0xd0000001
xor eax, eax
test edi, edi
je 0x100386b6
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x100388e1
cmp ebx, 4
jb 0x100388d6
mov edx, dword [ebp - 0xb18]
mov eax, dword [edx]
mov dword [ebp - 0xb14], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x100386e0
mov ecx, eax
jmp 0x100386e3
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x100388db
lea eax, [ebx - 4]
cmp eax, 4
jb 0x100388d6
mov ebx, dword [ecx]
lea eax, [ecx + 4]
mov dword [ebp - 0xb10], ebx
cmp eax, ecx
jb 0x10038714
mov edi, eax
jmp 0x10038717
or edi, 0xffffffff
cmp eax, ecx
mov edx, 0xc0000095
sbb esi, esi
and esi, edx
cmp eax, ecx
jb 0x100388db
mov ecx, dword [ebp - 0xb04]
lea eax, [ecx - 8]
cmp eax, ebx
jb 0x100388d6
lea eax, [ebx + 8]
cmp eax, 8
sbb esi, esi
and esi, edx
cmp eax, 8
jb 0x100388db
mov esi, dword [ebp - 0xb18]
lea edx, [edi + ebx]
lea eax, [ecx + esi]
cmp eax, edx
jb 0x100388d6
sub ecx, edi
sub ecx, ebx
add ecx, esi
cmp ecx, 8
jae 0x100388d6
xor ecx, ecx
mov dword [ebp - 0xadc], ecx
mov eax, ecx
mov dword [ebp - 0xaf0], eax
mov esi, ecx
test edi, edi
je 0x1003886d
mov ecx, edi
cmp edx, edi
jae 0x10038794
or edx, 0xffffffff
lea eax, [edi + ebx]
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x100388c4
cmp edi, edx
jae 0x10038863
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x100387c0
mov dword [ebp - 0xb00], eax
jmp 0x100387c7
or dword [ebp - 0xb00], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x100388c4
cmp dword [ebp - 0xb00], edx
ja 0x10038892
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0x100387f7
mov dword [ebp - 0xb00], eax
jmp 0x100387fe
or dword [ebp - 0xb00], 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
cmp eax, 4
jb 0x100388c4
mov ebx, dword [ebp - 0xb00]
mov dword [ebp - 0xcbc], ebx
mov ebx, dword [ebp - 0xb10]
mov esi, dword [ebp - 0xcbc]
add esi, ecx
mov dword [ebp - 0xad4], esi
cmp esi, ecx
jb 0x1003883a
mov eax, esi
jmp 0x1003883d
or eax, 0xffffffff
cmp esi, ecx
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xad4], ecx
jb 0x100388c4
cmp eax, edx
ja 0x10038892
inc dword [ebp - 0xadc]
mov ecx, eax
cmp eax, edx
jb 0x100387b1
cmp ecx, edx
jne 0x10038892
mov eax, dword [ebp - 0xaf0]
test ebx, ebx
je 0x1003889d
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xaf0], eax
test eax, eax
jne 0x10038899
mov esi, 0xc0000017
jmp 0x100388c4
mov esi, 0xc000000d
jmp 0x100388db
xor ecx, ecx
mov esi, ecx
test edi, edi
je 0x100388b2
push ebx
push edi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xaf0]
add esp, 0xc
mov dword [ebp - 0xc2c], eax
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0xc34], eax
test esi, esi
js 0x100388db
mov eax, dword [ebp - 0xb14]
cmp eax, dword [ebp - 0xc34]
je 0x100388db
mov esi, 0xc000003e
or esi, 0x10000000
mov ebx, dword [ebp - 0xad8]
mov eax, dword [ebp - 0xb2c]
test eax, eax
je 0x10038902
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xaf8]
test edi, edi
je 0x10038970
xor eax, eax
cmp dword [edi + 4], eax
je 0x10038929
push dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x10038945
push dword [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0x10038961
push dword [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb24]
test eax, eax
je 0x1003898b
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xae0]
test eax, eax
je 0x100389a6
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x10038a0e
xor eax, eax
cmp dword [ebx + 4], eax
je 0x100389c7
push dword [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebx + 4], eax
cmp dword [ebx + 0xc], 0
je 0x100389e3
push dword [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0xc], eax
cmp dword [ebx + 0x14], 0
je 0x100389ff
push dword [ebx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0x14], eax
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb18]
xor ebx, ebx
test eax, eax
je 0x10038a29
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x10038ae4
xor eax, eax
inc eax
cmp dword [ebp - 0xc34], eax
jb 0x10038ae4
mov eax, dword [ebp - 0xc2c]
test eax, eax
je 0x10038ae4
cmp dword [ebp - 0xc34], 0
jbe 0x10038ae4
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x10038a68
mov edi, ecx
jmp 0x10038a6b
or edi, 0xffffffff
cmp ecx, dword [ebp - 0xc2c]
sbb esi, esi
and esi, 0xc0000095
cmp ecx, dword [ebp - 0xc2c]
jb 0x10038a8b
mov eax, edx
neg eax
sbb eax, eax
and eax, edi
jmp 0x10038a97
mov edx, dword [ebp - 0xd3c]
mov eax, dword [ebp - 0xd48]
test esi, esi
js 0x10038ae4
cmp edx, 4
jne 0x10038ae4
cmp dword [eax], 0
jl 0x10038ae4
xor eax, eax
inc eax
cmp dword [ebp - 0xc34], eax
jbe 0x10038ae4
mov eax, dword [ebp - 0xc2c]
mov esi, ebx
mov edi, dword [eax]
lea edx, [eax + 4]
cmp edx, eax
jb 0x10038ac5
mov ecx, edx
jmp 0x10038ac8
or ecx, 0xffffffff
cmp edx, eax
jb 0x10038ae4
lea eax, [edi + ecx]
mov edx, eax
cmp eax, ecx
jae 0x10038ad8
or eax, 0xffffffff
cmp edx, ecx
jb 0x10038ae4
xor ecx, ecx
inc esi
inc ecx
cmp esi, ecx
jb 0x10038ab8
mov esi, dword [ebp - 0xad0]
mov edi, dword [ebp - 0xac0]
xor ebx, ebx
mov dword [ebp - 0xb64], ebx
mov dword [ebp - 0xb68], ebx
cmp dword [ebp - 0xb60], ebx
je 0x10038b20
push dword [ebp - 0xb60]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xb60], ebx
mov eax, dword [ebp - 0xc2c]
test eax, eax
je 0x10038b39
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x10038b4c
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x10038b5f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [ebp - 0xac4]
mov eax, dword [ebp - 0xbe8]
xor edx, edx
mov dword [ebp - 0xbe8], edx
mov dword [ebp - 0xc28], eax
jmp 0x1002f44c
cmp ebx, 0xd00000e5
je 0x10038ba0
cmp ebx, 0xc004d501
je 0x10038ba0
cmp ebx, 0xd000003e
jne 0x10038ba5
mov ebx, 0xc004f028
jmp 0x1002f4df
mov ebx, 0xc004f027
test ebx, ebx
jns 0x10038bc1
cmp ebx, 0x8007007a
jne 0x1002f4df
mov dword [ebp - 0xc00], 0xc004f01e
jmp 0x10038bd8
cmp dword [ebp - 0xbf0], 4
jne 0x10038bb5
mov eax, dword [ebp - 0xc28]
mov eax, dword [eax]
mov dword [ebp - 0xcb8], eax
lea ecx, [ebp - 0xc28]
call fcn.1006cdad
cmp dword [ebp - 0xc00], 0
jl 0x10038bf5
cmp dword [ebp - 0xcb8], 0
jne 0x10038c2c
mov ebx, dword [ebp - 0xc3c]
xor eax, eax
push eax
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov esi, eax
test esi, esi
je 0x10038c32
xor eax, eax
push eax
push 0xa22b
push esi
call dword [sym.imp.USER32.dll_DeleteMenu]
xor eax, eax
push 0x400
inc eax
push eax
push esi
call dword [sym.imp.USER32.dll_DeleteMenu]
jmp 0x10038c32
mov ebx, dword [ebp - 0xc3c]
push 0x36cf
lea ecx, [ebp - 0xbf4]
call fcn.1000fd4d
mov esi, eax
xor eax, eax
lea ecx, [ebp - 0xcb4]
push 0x36d0
mov dword [ebp - 4], eax
call fcn.1000fd4d
xor ecx, ecx
inc ecx
mov byte [ebp - 4], cl
mov edi, dword [eax]
xor eax, eax
mov esi, dword [esi]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov ebx, dword [ebp - 0xc38]
xor ecx, ecx
push esi
push edi
push 0xfe4c
push 0xfde9
inc ecx
add ebx, 0x5c
push ecx
push 0xfde8
push eax
mov ecx, ebx
call fcn.10057b09
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0xcb4]
lea ecx, [ecx - 0x10]
call fcn.1000fe6d
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0xbf4]
lea ecx, [ecx - 0x10]
call fcn.1000fe6d
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 0xc24], eax
mov edi, dword [ebp - 0xc38]
lea ecx, [ebp - 0xc24]
mov dword [ebp - 4], 6
push ecx
push edi
mov eax, dword [edi]
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x10089918]
call esi
test eax, eax
jns 0x10038cf4
push eax
jmp 0x1002e9e5
push dword [edi + 0x4c]
mov ecx, ebx
push dword [ebp - 0xc24]
call fcn.1005784a
mov eax, dword [ebp - 0xc44]
mov ecx, dword [edi + 0x58]
add eax, 4
push 0x102
push eax
call fcn.1005ef81
mov esi, eax
test esi, esi
je 0x10038d3e
mov eax, dword [ebp - 0xc44]
mov ecx, ebx
push esi
push dword [eax]
call fcn.100579c7
test al, al
jne 0x10038d3e
mov ecx, dword [edi + 0x58]
push esi
call fcn.1005f048
lea ecx, [ebp - 0xc24]
mov dword [ebp - 4], 7
call fcn.1002c4f4
or dword [ebp - 4], 0xffffffff
call fcn.1007563c
ret 4