Function at 0xaedba6
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe68
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0xcec]
mov edx, 0x9fe920
push eax
push ecx
push 0x9feaf4
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00a41860
test eax, eax
js 0xaedbeb
cmp dword [ebp - 0xcec], 0
je 0xaedbeb
xor al, al
jmp 0xaf7fea
push ebx
xor ebx, ebx
mov edx, 0xc96238
push esi
mov dword [ebp - 0xbfc], ebx
mov dword [ebp - 0xc78], ebx
mov dword [ebp - 0xbac], ebx
mov dword [ebp - 0xbb4], ebx
mov dword [ebp - 0xa90], ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xaedc12
mov eax, dword [0xc95890]
or esi, 0xffffffff
mov dword [ebp - 0xb94], esi
mov dword [ebp - 0xb84], 0x9fbcf2
mov dword [ebp - 0xb80], 0x67
mov dword [ebp - 0xad8], 0x337
mov dword [ebp - 0xb6c], 0x10b
mov dword [ebp - 0xb60], 0x20b
push edi
push 0
pop ebx
test eax, eax
jne 0xaee294
mov edi, ebx
mov dword [ebp - 0xab0], ebx
mov ecx, 0x338
mov dword [ebp - 0xa88], edi
mov dword [ebp - 0xa94], ebx
call fcn.00ad193e
mov dword [ebp - 0xbe0], eax
test eax, eax
je 0xaee22d
mov edx, 0xab69605e
mov dword [ebp - 0xac4], esi
mov dword [ebp - 0x4e8], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xb70], ebx
mov edi, 0x9fbcf2
mov dword [ebp - 0x4e4], edx
mov cl, bl
mov dword [ebp - 0xb30], eax
mov esi, ebx
mov dword [ebp - 0xaac], edi
mov edx, ebx
mov dword [ebp - 0xb54], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xaac]
xor edx, ebx
mov dword [ebp - 0xa6c], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xaac]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xaac]
shl edi, 8
add dword [ebp - 0xaac], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
mov dword [ebp - 0xa8c], esi
mov esi, edx
xor esi, dword [ebp - 0xa8c]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, edx
mov dword [ebp - 0xa6c], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xa6c]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xa6c]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xa6c], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xa6c]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xa6c]
xor edx, eax
mov dword [ebp - 0xa6c], edx
mov eax, dword [ebp - 0xa6c]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, edx
mov dword [ebp - 0xa6c], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xa6c]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, edx
mov dword [ebp - 0xa6c], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xa6c]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0xa6c]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0xa8c], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xa8c]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xa8c]
xor eax, edx
mov dword [ebp - 0xa8c], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0xab69
rol esi, 7
rol eax, 5
imul eax, eax, 0x7f1
add eax, esi
mov esi, dword [ebp - 0xa8c]
xor esi, eax
mov dword [ebp - 0xa8c], esi
xor esi, edx
mov edx, dword [ebp - 0xa8c]
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xa8c], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xa8c]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xa8c]
xor eax, edx
mov dword [ebp - 0xa8c], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xa8c]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xa8c]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xa8c], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xa8c]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xa8c]
xor edx, dword [ebp - 0xb70]
xor eax, dword [ebp - 0xac4]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xa6c], esi
mov esi, dword [ebp - 0xb30]
mov dword [ebp - 0xac4], edi
mov edi, dword [ebp - 0xaac]
mov dword [ebp - 0xb70], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xb54], 1
mov dword [ebp - 0xb30], esi
mov esi, eax
mov dword [ebp - 0xa8c], eax
jne 0xaedcdd
mov esi, dword [ebp - 0xbe0]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xaee06a
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xaee09f
cmp edx, dword [0x9fc02c]
jne 0xaee09f
mov edi, esi
mov dword [ebp - 0xa88], esi
mov esi, ebx
mov dword [ebp - 0xb70], 0x337
jmp 0xaee0b2
or dword [ebp - 0xb70], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xa94], 0xc004d501
test esi, esi
je 0xaee0bd
mov ecx, esi
call fcn.00ad1951
cmp dword [ebp - 0xa94], ebx
jl 0xaee227
mov eax, dword [ebp - 0xb70]
mov esi, edi
push 0x40
push ebx
push 0xc960a0
mov byte [eax + edi], bl
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], bl
je 0xaee234
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb18], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xaee0fe
sub ecx, dword [ebp - 0xb18]
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xaee220
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xab8], ecx
cmp word [eax], dx
je 0xaee149
mov ecx, 0xc000007b
mov dword [ebp - 0xab8], ecx
jmp 0xaee191
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xaee13c
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xaee13c
cmp dword [edx], 0x4550
jne 0xaee13c
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xb6c]
je 0xaee17f
cmp ax, word [ebp - 0xb60]
je 0xaee17f
mov ecx, 0xc000000d
jmp 0xaee141
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xa78], eax
mov dword [ebp - 0xa94], ebx
test eax, eax
je 0xaee20d
mov edx, esi
mov dword [ebp - 0xa7c], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb18], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xaee1b9
sub edx, dword [ebp - 0xb18]
inc esi
add esi, edx
test ecx, ecx
js 0xaee1f2
push dword [ebp - 0xa7c]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xaee218
mov ecx, dword [ebp - 0xab0]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xab8]
mov eax, dword [ebp - 0xa94]
inc dword [ebp - 0xab0]
inc eax
mov dword [ebp - 0xa94], eax
cmp eax, dword [ebp - 0xa78]
jb 0xaee1a8
add edi, 0x10
cmp byte [esi], bl
jne 0xaee0f1
mov esi, dword [ebp - 0xab8]
jmp 0xaee236
mov esi, 0xc000007a
jmp 0xaee236
mov edi, dword [ebp - 0xa88]
mov esi, 0xc000007a
jmp 0xaee23c
mov esi, ebx
mov edi, dword [ebp - 0xa88]
test edi, edi
je 0xaee24f
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push edi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0xaee28f
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xaee266
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xaee255
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xaee29a
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
mov eax, dword fs:[0x30]
mov edi, ebx
mov dword [ebp - 0xc10], ebx
mov dword [ebp - 0xc14], ebx
cmp dword [eax + 0x1d4], ebx
je 0xaee58c
mov esi, dword [0xc93088]
mov ecx, esi
call dword [0xc99200]
call esi
mov edx, eax
mov dword [ebp - 0xb18], edx
test edx, edx
jne 0xaee309
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0xaee2f6
movzx edi, di
or edi, 0x80070000
test edi, edi
push 4
pop esi
js 0xaee597
mov edi, 0x80004005
jmp 0xaee597
mov eax, ebx
mov edi, ebx
mov dword [ebp - 0xab0], eax
mov ecx, ebx
mov dword [ebp - 0xbe8], eax
mov esi, dword [0xc93098]
lea edx, [ebp - 0xc60]
push edx
mov edx, dword [ebp - 0xb18]
push ecx
push eax
push 2
push edx
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xaee3a7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xaee392
cmp dword [ebp - 0xab0], 0
jne 0xaee38b
mov ecx, dword [ebp - 0xc60]
call fcn.00ad193e
push eax
lea ecx, [ebp - 0xbe8]
call fcn.00ad1916
mov eax, dword [ebp - 0xbe8]
mov dword [ebp - 0xab0], eax
test eax, eax
je 0xaee384
mov ecx, dword [ebp - 0xc60]
jmp 0xaee31b
mov edi, 0x8007000e
jmp 0xaee3b9
mov edi, 0x80004005
jmp 0xaee3b9
test eax, eax
je 0xaee38b
jg 0xaee39c
mov edi, eax
jmp 0xaee3b9
movzx edi, ax
or edi, 0x80070000
jmp 0xaee3b9
mov eax, dword [ebp - 0xab0]
mov dword [ebp - 0xbe8], ebx
mov dword [ebp - 0xc10], eax
lea ecx, [ebp - 0xbe8]
call fcn.00ad18c0
test edi, edi
js 0xaee594
mov esi, dword [0xc93094]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov edx, eax
mov dword [ebp - 0xb18], edx
test edx, edx
je 0xaee2df
mov eax, ebx
mov edi, ebx
mov dword [ebp - 0xab0], eax
mov ecx, ebx
mov dword [ebp - 0xbe4], eax
mov esi, dword [0xc93098]
lea edx, [ebp - 0xc5c]
push edx
mov edx, dword [ebp - 0xb18]
push ecx
push eax
push 2
push edx
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xaee491
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xaee47c
cmp dword [ebp - 0xab0], 0
jne 0xaee475
mov ecx, dword [ebp - 0xc5c]
call fcn.00ad193e
push eax
lea ecx, [ebp - 0xbe4]
call fcn.00ad1916
mov eax, dword [ebp - 0xbe4]
mov dword [ebp - 0xab0], eax
test eax, eax
je 0xaee46e
mov ecx, dword [ebp - 0xc5c]
jmp 0xaee405
mov edi, 0x8007000e
jmp 0xaee4a3
mov edi, 0x80004005
jmp 0xaee4a3
test eax, eax
je 0xaee475
jg 0xaee486
mov edi, eax
jmp 0xaee4a3
movzx edi, ax
or edi, 0x80070000
jmp 0xaee4a3
mov eax, dword [ebp - 0xab0]
mov dword [ebp - 0xbe4], ebx
mov dword [ebp - 0xc14], eax
lea ecx, [ebp - 0xbe4]
call fcn.00ad18c0
test edi, edi
js 0xaee594
mov eax, dword [ebp - 0xc10]
test eax, eax
je 0xaee58c
push 4
mov ecx, 0x9fb9c0
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xaee4f0
test dx, dx
je 0xaee4ec
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xaee4f0
add eax, esi
add ecx, esi
test dx, dx
jne 0xaee4cc
mov eax, ebx
jmp 0xaee4f5
sbb eax, eax
or eax, 1
test eax, eax
jne 0xaee58c
mov eax, dword [ebp - 0xc14]
test eax, eax
je 0xaee58c
mov ecx, 0x9f98b0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xaee534
test dx, dx
je 0xaee530
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xaee534
add eax, esi
add ecx, esi
test dx, dx
jne 0xaee510
mov eax, ebx
jmp 0xaee539
sbb eax, eax
or eax, 1
test eax, eax
jne 0xaee58c
push esi
lea eax, [ebp - 0xc34]
mov dword [ebp - 0xc34], ebx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
jne 0xaee57e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0xaee2f9
movzx edi, di
or edi, 0x80070000
test edi, edi
jmp 0xaee2f9
test byte [ebp - 0xc34], 0xf
jne 0xaee58c
xor eax, eax
inc eax
jmp 0xaee58e
mov eax, ebx
mov dword [ebp - 0xa90], eax
push 4
pop esi
lea ecx, [ebp - 0xc14]
call fcn.00ad18c0
lea ecx, [ebp - 0xc10]
call fcn.00ad18c0
test edi, edi
jns 0xaee5b7
mov dword [ebp - 0xa90], ebx
push esi
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
push eax
lea ecx, [ebp - 0xbb4]
call fcn.00ad18f7
cmp dword [ebp - 0xbb4], 0
jne 0xaee68d
mov dword [ebp - 0xa70], 0x8007000e
mov eax, dword [ebp - 0xc00]
mov dword [ebp - 0xbac], eax
xor ebx, ebx
mov edx, 0xc96238
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xaee5f6
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jle 0xaee653
sub eax, 1
mov dword [0xc95890], eax
jne 0xaee653
mov edi, ebx
mov eax, dword [edi + 0xc960a0]
test eax, eax
je 0xaee62c
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xaee61b
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
lea ecx, [ebp - 0xbb4]
call fcn.00ad18a9
mov eax, dword [ebp - 0xa70]
pop edi
test eax, eax
jns 0xaf7fa8
cmp eax, 0xd0000034
jne 0xaf7f6e
mov eax, 0xc004f012
mov esi, eax
jmp 0xaf7fc1
mov eax, dword [ebp - 0xbb4]
lea edi, [ebp - 0xba0]
mov dword [ebp - 0xa98], eax
mov eax, ebx
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xd54], eax
xor eax, eax
stosd dword es:[edi], eax
mov dword [ebp - 0xa7c], ebx
mov dword [ebp - 0xa94], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xa78], eax
mov dword [ebp - 0xb18], 0x38
test eax, eax
jne 0xaee6f8
mov esi, 0xc0000017
mov edi, ebx
mov dword [ebp - 0xa70], esi
jmp 0xaf1516
push 0x28
pop ecx
mov esi, 0xc94ea0
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, eax
mov dword [ebp - 0xa74], edi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xa80], ecx
test ecx, ecx
jne 0xaee739
mov esi, 0xc0000017
mov dword [ebp - 0xa70], esi
jmp 0xaf1516
mov eax, dword [0xc94e98]
mov dword [ecx], eax
mov eax, dword [0xc94e9c]
mov dword [ecx + 4], eax
mov dword [ebp - 0xa7c], ecx
rdtsc
mov dword [ebp - 0xad0], eax
mov dword [ebp - 0xacc], edx
lea eax, [ebp - 0xcf4]
mov dword [ebp - 0xa8c], ebx
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov edi, dword [ebp - 0xcf4]
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
jns 0xaee792
mov edi, dword [ebp - 0xe0c]
jmp 0xaf1510
lea eax, [ebp - 0xa8c]
mov edx, edi
push eax
xor ecx, ecx
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xa70], esi
jl 0xaf1510
lea eax, [ebp - 0xd0c]
mov edx, 0xa0
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf1510
mov edi, dword [ebp - 0xd0c]
mov ecx, dword [ebp - 0xa8c]
lea eax, [ebp - 0xa8c]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xa70], esi
jl 0xaf1510
lea eax, [ebp - 0xd10]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf1510
mov edi, dword [ebp - 0xd10]
mov ecx, dword [ebp - 0xa8c]
lea eax, [ebp - 0xa8c]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xa70], esi
jl 0xaf1510
lea eax, [ebp - 0xd30]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf1510
mov edi, dword [ebp - 0xd30]
mov ecx, dword [ebp - 0xa8c]
lea eax, [ebp - 0xa8c]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xa70], esi
jl 0xaf1510
lea eax, [ebp - 0xc44]
mov edx, SysReAllocString
push eax
mov ecx, 0x9feb28
call fcn.00a41606
test eax, eax
jns 0xaee8d2
mov esi, 0xc000003e
jmp 0xaf150a
mov edx, dword [ebp - 0xc44]
lea eax, [ebp - 0xd34]
push eax
inc edx
push 4
pop eax
mov dword [ebp - 0xc44], edx
mov ecx, eax
add edx, edx
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf1510
mov edi, dword [ebp - 0xd34]
mov ecx, dword [ebp - 0xa8c]
lea eax, [ebp - 0xa8c]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xa70], esi
jl 0xaf1510
lea eax, [ebp - 0xc74]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf1510
mov edi, dword [ebp - 0xc74]
mov ecx, dword [ebp - 0xa8c]
lea eax, [ebp - 0xa8c]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xa70], esi
jl 0xaf1510
lea eax, [ebp - 0xc7c]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf1510
mov edi, dword [ebp - 0xc7c]
mov ecx, dword [ebp - 0xa8c]
lea eax, [ebp - 0xa8c]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xa70], esi
jl 0xaf1510
push dword [ebp - 0xa8c]
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xb14], edi
test edi, edi
jne 0xaee9fd
mov esi, 0xc0000017
jmp 0xaf150a
mov eax, edi
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xd54], eax
mov dword [ebp - 0xa6c], ebx
mov dword [ebp - 0xe10], ebx
mov dword [ebp - 0xbc0], edi
push 4
pop ecx
lea eax, [ebp - 0xd88]
mov dword [ebp - 0xd8c], ecx
mov edx, ecx
mov ecx, edi
push eax
call fcn.00a32533
mov esi, eax
mov ecx, ebx
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf1510
mov ecx, dword [ebp - 0xa8c]
lea eax, [edi + 8]
add ecx, edi
cmp eax, ecx
jbe 0xaeea61
mov esi, 0xc0000023
jmp 0xaf150a
push 4
pop eax
mov dword [edi], eax
mov eax, dword [ebp - 0xd88]
mov dword [eax], ebx
xor eax, eax
inc eax
mov dword [ebp - 0xa6c], eax
mov ecx, eax
test esi, esi
js 0xaf1510
mov dword [ebp - 0xab4], ebx
mov eax, edi
mov dword [ebp - 0xbb8], eax
test ecx, ecx
je 0xaeeb0d
mov edx, dword [eax]
lea ecx, [ebp - 0xc80]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaeeac0
mov eax, dword [ebp - 0xc80]
mov dword [ebp - 0xc84], eax
jmp 0xaeeac6
mov eax, dword [ebp - 0xc84]
test esi, esi
js 0xaeeb84
lea ecx, [ebp - 0xbb8]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xbb8]
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaeeb84
mov eax, dword [ebp - 0xab4]
inc eax
cmp eax, dword [ebp - 0xa6c]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xbb8]
jb 0xaeea93
lea ecx, [ebp - 0xd80]
mov dword [ebp - 0xd84], 0xa0
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaeeb84
mov esi, dword [ebp - 0xbb8]
mov ecx, dword [ebp - 0xa8c]
add ecx, edi
lea eax, [esi + 0xa4]
cmp eax, ecx
ja 0xaeea57
mov eax, dword [ebp - 0xa6c]
mov edi, dword [ebp - 0xd80]
inc eax
mov dword [esi], 0xa0
mov esi, dword [ebp - 0xa78]
push 0x28
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xa70]
mov edi, dword [ebp - 0xb14]
mov dword [ebp - 0xa6c], eax
jmp 0xaeeb8a
mov eax, dword [ebp - 0xa6c]
test esi, esi
js 0xaf1510
mov dword [ebp - 0xab4], ebx
mov ecx, edi
mov dword [ebp - 0xbdc], ecx
test eax, eax
je 0xaeec1e
mov edx, dword [ecx]
lea eax, [ebp - 0xc88]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaeebd1
mov eax, dword [ebp - 0xc88]
mov dword [ebp - 0xc94], eax
jmp 0xaeebd7
mov eax, dword [ebp - 0xc94]
test esi, esi
js 0xaeec89
lea ecx, [ebp - 0xbdc]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xbdc]
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaeec89
mov eax, dword [ebp - 0xab4]
mov ecx, dword [ebp - 0xbdc]
inc eax
mov dword [ebp - 0xab4], eax
cmp eax, dword [ebp - 0xa6c]
jb 0xaeeba4
lea eax, [ebp - 0xd78]
mov dword [ebp - 0xd7c], 8
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaeec89
mov edx, dword [ebp - 0xbdc]
mov ecx, dword [ebp - 0xa8c]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xaeea57
mov ecx, dword [ebp - 0xd78]
mov dword [edx], 8
mov edx, dword [ebp - 0xa80]
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xa6c]
inc eax
mov dword [ebp - 0xa6c], eax
jmp 0xaeec8f
mov eax, dword [ebp - 0xa6c]
test esi, esi
js 0xaf1510
mov ecx, dword [ebp - 0xad0]
mov dword [ebp - 0xe1c], ecx
mov ecx, dword [ebp - 0xacc]
mov dword [ebp - 0xe18], ecx
mov ecx, edi
mov dword [ebp - 0xbd8], ecx
mov dword [ebp - 0xab4], ebx
test eax, eax
je 0xaeed3b
mov edx, dword [ecx]
lea eax, [ebp - 0xc98]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaeecee
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0xc9c], eax
jmp 0xaeecf4
mov eax, dword [ebp - 0xc9c]
test esi, esi
js 0xaf1510
lea ecx, [ebp - 0xbd8]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xbd8]
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf1510
mov eax, dword [ebp - 0xab4]
mov ecx, dword [ebp - 0xbd8]
inc eax
mov dword [ebp - 0xab4], eax
cmp eax, dword [ebp - 0xa6c]
jb 0xaeecc1
lea eax, [ebp - 0xd70]
mov dword [ebp - 0xd74], 8
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf1510
mov edx, dword [ebp - 0xbd8]
mov ecx, dword [ebp - 0xa8c]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xaeea57
mov eax, dword [ebp - 0xd70]
mov ecx, dword [ebp - 0xad0]
inc dword [ebp - 0xa6c]
mov dword [edx], 8
mov dword [eax], ecx
mov ecx, dword [ebp - 0xacc]
mov dword [eax + 4], ecx
test esi, esi
js 0xaf1510
lea eax, [ebp - 0xc0c]
mov edx, SysReAllocString
push eax
mov ecx, 0x9feb28
call fcn.00a41606
test eax, eax
js 0xaee8c8
mov ecx, dword [ebp - 0xc0c]
lea eax, [ebp - 0xc0c]
push eax
xor eax, eax
lea edx, [eax + 1]
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf1510
mov eax, dword [ebp - 0xc0c]
add eax, eax
mov dword [ebp - 0xab0], eax
je 0xaeef0b
cmp dword [ebp - 0xa6c], 0
mov eax, edi
mov dword [ebp - 0xbd4], eax
mov dword [ebp - 0xab4], ebx
jbe 0xaeee94
mov edx, dword [eax]
lea ecx, [ebp - 0xca0]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaeee47
mov eax, dword [ebp - 0xca0]
mov dword [ebp - 0xca4], eax
jmp 0xaeee4d
mov eax, dword [ebp - 0xca4]
test esi, esi
js 0xaf1510
lea ecx, [ebp - 0xbd4]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xbd4]
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf1510
mov eax, dword [ebp - 0xab4]
inc eax
cmp eax, dword [ebp - 0xa6c]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xbd4]
jb 0xaeee1a
mov ecx, dword [ebp - 0xab0]
mov dword [ebp - 0xd6c], ecx
lea ecx, [ebp - 0xd68]
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf1510
mov ecx, dword [ebp - 0xab0]
mov eax, dword [ebp - 0xa8c]
add ecx, 4
mov edx, dword [ebp - 0xbd4]
add eax, edi
add ecx, edx
cmp ecx, eax
jbe 0xaeeee7
mov esi, 0xc0000023
jmp 0xaeef10
mov eax, dword [ebp - 0xab0]
push eax
push 0x9feb28
push dword [ebp - 0xd68]
mov dword [edx], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
inc dword [ebp - 0xa6c]
jmp 0xaeef16
mov esi, 0xc000000d
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf1510
cmp dword [ebp - 0xa6c], 0
mov eax, dword [ebp - 0xa90]
mov dword [ebp - 0xe08], eax
mov eax, edi
mov dword [ebp - 0xbbc], eax
mov dword [ebp - 0xab4], ebx
jbe 0xaeefb7
mov edx, dword [eax]
lea ecx, [ebp - 0xca8]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaeef6e
mov eax, dword [ebp - 0xca8]
mov dword [ebp - 0xcac], eax
jmp 0xaeef74
mov eax, dword [ebp - 0xcac]
test esi, esi
js 0xaef015
lea ecx, [ebp - 0xbbc]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xbbc]
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaef015
mov eax, dword [ebp - 0xab4]
inc eax
cmp eax, dword [ebp - 0xa6c]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xbbc]
jb 0xaeef41
push 4
pop edx
lea ecx, [ebp - 0xd60]
mov dword [ebp - 0xd64], edx
push ecx
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaef015
mov edx, dword [ebp - 0xbbc]
mov ecx, dword [ebp - 0xa8c]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xaeea57
mov ecx, dword [ebp - 0xa90]
push 4
pop eax
mov dword [edx], eax
mov eax, dword [ebp - 0xd60]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xa6c]
inc ecx
mov dword [ebp - 0xa6c], ecx
jmp 0xaef01b
mov ecx, dword [ebp - 0xa6c]
test esi, esi
js 0xaf1510
mov dword [ebp - 0xab4], ebx
mov eax, edi
mov dword [ebp - 0xbd0], eax
push 4
pop esi
mov dword [ebp - 0xe04], esi
test ecx, ecx
je 0xaef0b4
mov edx, dword [eax]
lea ecx, [ebp - 0xcb0]
push ecx
mov ecx, esi
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaef068
mov eax, dword [ebp - 0xcb0]
mov dword [ebp - 0xcb4], eax
jmp 0xaef06e
mov eax, dword [ebp - 0xcb4]
test esi, esi
js 0xaef104
lea ecx, [ebp - 0xbd0]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xbd0]
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
push 4
test esi, esi
js 0xaef106
mov eax, dword [ebp - 0xab4]
inc eax
cmp eax, dword [ebp - 0xa6c]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xbd0]
pop esi
jb 0xaef03e
lea ecx, [ebp - 0xd90]
mov dword [ebp - 0xd94], esi
push ecx
mov edx, esi
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaef104
mov edx, dword [ebp - 0xbd0]
mov ecx, dword [ebp - 0xa8c]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xaeea57
mov eax, dword [ebp - 0xd90]
inc dword [ebp - 0xa6c]
push 4
pop ecx
mov dword [edx], ecx
mov dword [eax], ecx
jmp 0xaef107
push 4
pop ecx
test esi, esi
js 0xaf1510
lea eax, [ebp - 0xcb8]
mov edx, ecx
push eax
call fcn.00a32533
mov edi, dword [ebp - 0xcb8]
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
jns 0xaef13a
mov edi, dword [ebp - 0xe00]
jmp 0xaef2b8
lea eax, [ebp - 0xcbc]
mov dword [ebp - 0xb48], edi
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaef2b8
mov edi, dword [ebp - 0xcbc]
mov ecx, dword [ebp - 0xb48]
lea eax, [ebp - 0xb48]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaef2b8
lea eax, [ebp - 0xcc0]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaef2b8
mov edi, dword [ebp - 0xcc0]
mov ecx, dword [ebp - 0xb48]
lea eax, [ebp - 0xb48]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaef2b8
lea eax, [ebp - 0xcc4]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaef2b8
mov edi, dword [ebp - 0xcc4]
mov ecx, dword [ebp - 0xb48]
lea eax, [ebp - 0xb48]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaef2b8
lea eax, [ebp - 0xcc8]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaef2b8
mov edi, dword [ebp - 0xcc8]
mov ecx, dword [ebp - 0xb48]
lea eax, [ebp - 0xb48]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaef2b8
lea eax, [ebp - 0xccc]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaef2b8
mov edi, dword [ebp - 0xccc]
mov ecx, dword [ebp - 0xb48]
lea eax, [ebp - 0xb48]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0xb48]
mov dword [ebp - 0xa70], esi
test esi, esi
jns 0xaef2be
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xa80], eax
test esi, esi
js 0xaf1510
rdtsc
mov edi, ebx
mov dword [ebp - 0xa84], ebx
mov dword [ebp - 0xaf4], edi
mov dword [ebp - 0xaf8], ebx
mov dword [ebp - 0xb88], ebx
mov dword [ebp - 0xa78], ebx
mov dword [ebp - 0xb10], ebx
mov dword [ebp - 0xa88], ebx
mov dword [ebp - 0xab4], ebx
mov dword [ebp - 0xb04], ebx
mov dword [ebp - 0xb00], ebx
mov dword [ebp - 0xa9c], eax
mov dword [ebp - 0xaa8], edx
push 8
pop ecx
mov dword [ebp - 0xc08], ecx
mov edx, dword [ebp - 0xa8c]
lea eax, [ebp - 0xc08]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaef432
mov eax, dword [ebp - 0xc08]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0xab0], ecx
cmp ecx, eax
jae 0xaef35d
mov esi, 0xc0000095
jmp 0xaef432
mov dword [ebp - 0xc08], ecx
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xaef385
mov esi, 0xc0000017
mov edi, ebx
jmp 0xaef432
mov eax, dword [ebp - 0xa6c]
mov ecx, edi
mov dword [edi], eax
lea eax, [ebp - 0xbf0]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xbf0], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaef419
mov ecx, dword [ebp - 0xbf0]
mov eax, dword [ebp - 0xa8c]
mov dword [ecx], eax
lea eax, [ebp - 0xbf0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaef419
mov eax, dword [ebp - 0xab0]
push dword [ebp - 0xa8c]
mov ecx, dword [ebp - 0xa9c]
push dword [ebp - 0xb14]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xaa8]
push dword [ebp - 0xbf0]
mov dword [edi + eax - 4], ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xab0]
add esp, 0xc
mov dword [ebp - 0xa84], edi
mov edi, ebx
mov dword [ebp - 0xaf4], eax
test edi, edi
je 0xaef42c
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xaf4]
or esi, 0x10000000
mov dword [ebp - 0xa70], esi
jl 0xaf0de3
cmp dword [ebp - 0xa84], 0
mov dword [ebp - 0xab0], ebx
jne 0xaef45d
mov esi, 0xc000000d
jmp 0xaefa82
test edi, edi
je 0xaefa7d
lea eax, [edi + 8]
mov ecx, eax
mov dword [ebp - 0xa9c], eax
call fcn.00ad193e
mov esi, eax
mov dword [ebp - 0xae8], esi
test esi, esi
je 0xaefa7d
mov cl, bl
mov edx, ebx
test edi, edi
je 0xaef49b
mov eax, dword [ebp - 0xa84]
xor cl, byte [edx + eax]
inc edx
cmp edx, edi
jb 0xaef493
mov eax, 0xb1b54a58
mov dword [ebp - 0x3b4], eax
mov eax, 0xc81ecb17
mov dword [ebp - 0x3b0], eax
mov eax, edi
shr eax, 3
mov dword [ebp - 0xaa8], eax
test eax, eax
je 0xaef8ba
movzx edx, word [ebp - 0x3b2]
mov eax, 0xc81ecb17
movzx esi, ax
movzx eax, word [ebp - 0x3ae]
mov dword [ebp - 0xab8], eax
mov eax, 0xb1b54a58
movzx eax, ax
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0xae8]
mov dword [ebp - 0xabc], esi
add eax, 7
mov esi, dword [ebp - 0xa84]
add esi, 2
mov dword [ebp - 0xaa4], edx
or dword [ebp - 0xa70], 0xffffffff
mov edx, ebx
mov dword [ebp - 0xb14], ebx
mov dword [ebp - 0xb20], ebx
mov ebx, dword [ebp - 0xa70]
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xafc], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xafc]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xafc]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xafc]
shl esi, 8
add dword [ebp - 0xafc], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov eax, ebx
sub eax, dword [ebp - 0xaa0]
xor eax, edi
xor eax, edx
xor eax, 0xc81ecb17
mov edx, eax
mov dword [ebp - 0xa70], eax
xor edx, 0xc81ecb17
ror eax, 7
ror edx, 0xf
imul edx, dword [ebp - 0xaa4]
add edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
mov eax, ebx
ror eax, 0xa
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [ebp - 0xabc]
sub edx, eax
mov eax, dword [ebp - 0xa70]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xa70], eax
xor edx, dword [ebp - 0xabc]
rol edx, 4
imul edx, dword [ebp - 0xab8]
rol eax, 5
add edx, eax
mov eax, 0xc81ecb17
xor ebx, edx
mov edx, 0xb1b54a58
xor edx, ebx
sub eax, edx
mov edx, dword [ebp - 0xa70]
xor edx, eax
mov dword [ebp - 0xa70], edx
sub edx, dword [ebp - 0xaa0]
imul edx, dword [ebp - 0xaa4]
mov eax, dword [ebp - 0xa70]
shr eax, 6
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xa70]
mov eax, ebx
ror eax, 0xf
xor eax, dword [ebp - 0xabc]
imul eax, dword [ebp - 0xaa0]
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [ebp - 0xab8]
imul eax, dword [ebp - 0xabc]
xor ebx, eax
mov eax, ebx
sub eax, dword [ebp - 0xaa0]
sub eax, 0xc81ecb17
xor edx, eax
mov dword [ebp - 0xa70], edx
mov eax, dword [ebp - 0xa70]
xor eax, dword [ebp - 0xab8]
imul eax, dword [ebp - 0xaa4]
ror edx, 0xa
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xaa0]
rol edx, 6
imul edx, dword [ebp - 0xabc]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0xa70]
xor eax, edx
mov dword [ebp - 0xa70], eax
ror eax, 0xf
sub eax, dword [ebp - 0xab8]
imul eax, dword [ebp - 0xaa0]
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xab8]
imul edx, dword [ebp - 0xaa0]
shr eax, 1
xor edx, eax
mov eax, ebx
xor dword [ebp - 0xa70], edx
mov edx, ebx
sub edx, dword [ebp - 0xabc]
rol edx, 3
imul edx, dword [ebp - 0xaa0]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0xa70]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xa70], eax
sub edx, dword [ebp - 0xabc]
imul edx, dword [ebp - 0xaa4]
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 9
imul edx, dword [ebp - 0xabc]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0xa70]
xor eax, edx
mov dword [ebp - 0xa70], eax
sub eax, 0xb1b54a58
sub eax, dword [ebp - 0xab8]
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xaa4]
imul eax, dword [ebp - 0xaa0]
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0xa70]
xor edx, eax
mov dword [ebp - 0xa70], edx
xor edx, dword [ebp - 0xab8]
mov eax, dword [ebp - 0xa70]
rol edx, 4
imul edx, dword [ebp - 0xaa4]
ror eax, 0x10
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 0xa
imul edx, dword [ebp - 0xabc]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0xa70]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xa70], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, dword [ebp - 0xab8]
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, 0xc81ecb17
rol eax, 2
rol edx, 8
imul edx, dword [ebp - 0xaa0]
sub edx, eax
mov eax, dword [ebp - 0xa70]
xor eax, edx
mov edx, 0xc81ecb17
sub edx, eax
mov dword [ebp - 0xa70], eax
ror edx, 0xb
imul edx, dword [ebp - 0xaa4]
ror eax, 0xc
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xaa4]
imul edx, dword [ebp - 0xabc]
shr eax, 8
xor edx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xa70], edx
xor eax, 0xc81ecb17
mov edx, dword [ebp - 0xa70]
xor ebx, eax
mov eax, dword [ebp - 0xad4]
xor ebx, edx
xor edx, dword [ebp - 0xb14]
xor ebx, dword [ebp - 0xb20]
mov dword [ebp - 0xb20], esi
mov esi, dword [ebp - 0xafc]
mov byte [eax - 4], dl
mov byte [eax], bl
ror edx, 8
mov byte [eax - 5], dl
ror ebx, 8
mov byte [eax - 1], bl
ror edx, 8
mov byte [eax - 6], dl
ror ebx, 8
mov byte [eax - 2], bl
ror edx, 8
ror ebx, 8
mov byte [eax - 7], dl
mov byte [eax - 3], bl
add eax, 8
ror edx, 8
ror ebx, 8
sub dword [ebp - 0xaa8], 1
mov dword [ebp - 0xb14], edi
mov dword [ebp - 0xad4], eax
jne 0xaef533
mov edi, dword [ebp - 0xaf4]
xor ebx, ebx
mov esi, dword [ebp - 0xae8]
movzx eax, cl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xaa8], edi
test edi, edi
jne 0xaef8ec
mov esi, 0xc0000017
jmp 0xaef9eb
mov eax, dword [ebp - 0xa9c]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xaef90f
mov esi, 0xc0000017
jmp 0xaef98a
mov dword [edi + 4], eax
push dword [ebp - 0xa9c]
push esi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xaef908
mov dword [edi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
push 8
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xaa8]
pop eax
push eax
push eax
mov dword [edi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0xaef908
mov dword [edi + 0x14], ecx
mov eax, dword [0xc94e90]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ebp - 0xab0], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0xaef9eb
cmp dword [edi + 4], 0
je 0xaef9a8
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xaef9c2
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xaef9dc
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xaef9ff
mov eax, dword [ebp - 0xab0]
mov edi, ebx
mov dword [ebp - 0xaf8], eax
jmp 0xaefa05
mov edi, dword [ebp - 0xab0]
mov eax, dword [ebp - 0xae8]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xaefa82
cmp dword [edi + 4], 0
je 0xaefa38
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xaefa52
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xaefa6c
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xaefa82
mov esi, 0xc0000001
or esi, 0x10000000
mov dword [ebp - 0xa70], esi
jl 0xaf0de3
mov edi, dword [ebp - 0xaf8]
lea eax, [ebp - 0xaf0]
push 4
pop ecx
push eax
mov edx, dword [edi]
mov dword [ebp - 0xaf0], ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaefb2d
mov ecx, dword [ebp - 0xaf0]
lea eax, [ebp - 0xaf0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaefb2d
mov edx, dword [edi + 8]
lea eax, [ebp - 0xaf0]
mov ecx, dword [ebp - 0xaf0]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaefb2d
mov ecx, dword [ebp - 0xaf0]
lea eax, [ebp - 0xaf0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaefb2d
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0xaf0]
mov ecx, dword [ebp - 0xaf0]
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0xaf0]
test esi, esi
jns 0xaefb33
mov eax, dword [ebp - 0xdfc]
mov dword [ebp - 0xa9c], eax
test esi, esi
js 0xaefcaa
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xaefb61
mov esi, 0xc0000017
jmp 0xaefcaa
mov eax, dword [ebp - 0xaf8]
mov ecx, edi
mov dword [ebp - 0xac8], edi
mov eax, dword [eax]
mov dword [edi], eax
lea eax, [ebp - 0xac8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaefc97
mov esi, dword [ebp - 0xaf8]
push dword [esi]
push dword [esi + 4]
push dword [ebp - 0xac8]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [esi]
lea eax, [ebp - 0xac8]
mov ecx, dword [ebp - 0xac8]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaefc97
mov eax, dword [ebp - 0xaf8]
mov ecx, dword [ebp - 0xac8]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xac8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaefc97
mov esi, dword [ebp - 0xaf8]
push dword [esi + 8]
push dword [esi + 0xc]
push dword [ebp - 0xac8]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [esi + 8]
lea eax, [ebp - 0xac8]
mov ecx, dword [ebp - 0xac8]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaefc97
mov eax, dword [ebp - 0xaf8]
mov ecx, dword [ebp - 0xac8]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xac8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaefc97
mov esi, dword [ebp - 0xaf8]
push dword [esi + 0x10]
push dword [esi + 0x14]
push dword [ebp - 0xac8]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0xac8]
mov ecx, dword [ebp - 0xac8]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaefc97
mov eax, dword [ebp - 0xa9c]
mov dword [ebp - 0xb88], edi
mov edi, ebx
mov dword [ebp - 0xa78], eax
test edi, edi
je 0xaefcaa
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
mov dword [ebp - 0xa70], esi
jl 0xaf0de3
push 8
pop edi
mov dword [ebp - 0xa9c], ebx
mov dword [ebp - 0xaa8], ebx
mov dword [ebp - 0xc40], edi
mov edx, dword [ebp - 0xa80]
lea eax, [ebp - 0xc40]
push eax
mov ecx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xa70], esi
jl 0xaefd5d
mov eax, dword [ebp - 0xc40]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xaefd12
mov esi, 0xc0000095
mov dword [ebp - 0xa70], esi
jmp 0xaefd38
mov dword [ebp - 0xc3c], ecx
lea eax, [ebp - 0xc3c]
mov edx, edi
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0xc3c]
mov dword [ebp - 0xa70], esi
test esi, esi
jns 0xaefd3e
mov eax, dword [ebp - 0xcd0]
mov dword [ebp - 0xab0], eax
test esi, esi
js 0xaefd5d
mov eax, dword [ebp - 0xac0]
test eax, eax
jne 0xaefd8b
mov esi, 0xc000000d
mov dword [ebp - 0xa70], esi
mov edi, ebx
test esi, esi
js 0xaf0de3
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xaefff2
mov esi, 0xd0000017
mov ecx, ebx
jmp 0xaeffff
mov edi, dword [ebp - 0xa6c]
cmp edi, 1
jbe 0xaefd52
mov ecx, eax
mov dword [ebp - 0xa80], ebx
mov dword [ebp - 0xb74], ecx
mov eax, dword [ecx]
mov dword [ebp - 0xad4], eax
lea eax, [ebp - 0xb74]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaefd5d
mov edx, dword [ebp - 0xad4]
lea eax, [ebp - 0xb74]
mov ecx, dword [ebp - 0xb74]
push eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaefd5d
mov eax, dword [ebp - 0xa80]
mov ecx, dword [ebp - 0xb74]
inc eax
mov dword [ebp - 0xa80], eax
cmp eax, 1
jb 0xaefda4
mov eax, dword [ecx]
mov dword [ebp - 0xa80], eax
lea eax, [ebp - 0xb74]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaefd5d
mov eax, dword [ebp - 0xa80]
mov dword [ebp - 0xa9c], eax
neg eax
sbb eax, eax
and dword [ebp - 0xb74], eax
test esi, esi
js 0xaefd5d
cmp edi, 2
mov edi, ebx
ja 0xaefe67
mov esi, 0xc000000d
mov dword [ebp - 0xa70], esi
jmp 0xaefd5f
mov ecx, dword [ebp - 0xac0]
mov dword [ebp - 0xb78], ecx
mov eax, dword [ecx]
mov dword [ebp - 0xa80], eax
lea eax, [ebp - 0xb78]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaefd5d
mov edx, dword [ebp - 0xa80]
lea eax, [ebp - 0xb78]
mov ecx, dword [ebp - 0xb78]
push eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaefd5d
mov ecx, dword [ebp - 0xb78]
inc edi
cmp edi, 2
jb 0xaefe73
mov edi, dword [ecx]
lea eax, [ebp - 0xb78]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaefd5d
mov dword [ebp - 0xaa8], edi
neg edi
sbb edi, edi
and dword [ebp - 0xb78], edi
test esi, esi
js 0xaefd5d
mov edx, dword [ebp - 0xab0]
lea eax, [ebp - 0xaec]
push 4
pop edi
push eax
mov ecx, edi
mov dword [ebp - 0xaec], edi
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaeffc6
mov ecx, dword [ebp - 0xaec]
lea eax, [ebp - 0xaec]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaeffc6
mov edx, dword [ebp - 0xa9c]
lea eax, [ebp - 0xaec]
mov ecx, dword [ebp - 0xaec]
push eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaeffc6
mov ecx, dword [ebp - 0xaec]
lea eax, [ebp - 0xaec]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaeffc6
mov edx, dword [ebp - 0xaa8]
lea eax, [ebp - 0xaec]
mov ecx, dword [ebp - 0xaec]
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0xaec]
mov dword [ebp - 0xa70], esi
test esi, esi
jns 0xaeffd4
mov eax, dword [ebp - 0xe58]
test esi, esi
js 0xaefd5d
cmp eax, 0x400000
jbe 0xaeffe5
mov esi, 0x8000ffff
jmp 0xaf0ddd
mov edi, eax
mov dword [ebp - 0xa88], edi
jmp 0xaefd5f
mov ecx, eax
mov dword [ebp - 0xb10], ecx
mov esi, 0x10000000
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf0de3
mov eax, dword [ebp - 0xb88]
test eax, eax
jne 0xaf0021
mov esi, 0x80070057
jmp 0xaf0ddd
test ecx, ecx
je 0xaf0017
mov dword [ebp - 0xda8], eax
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0xda0], eax
lea eax, [ebp - 0xcdc]
push eax
xor eax, eax
mov dword [ebp - 0xda4], ecx
push 0x9f29b8
inc eax
mov dword [ebp - 0xd9c], edi
push eax
mov dword [ebp - 0xd98], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xaf0095
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
jle 0xaf0086
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf00e1
mov esi, 0x80004005
mov dword [ebp - 0xa70], esi
jmp 0xaf00e1
push 0x9fc030
push dword [ebp - 0xcdc]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xaf0063
push ebx
push 0x14
lea eax, [ebp - 0xda8]
mov ecx, esi
push eax
push 0x86
call dword [0xc99200]
call esi
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xa70], esi
jl 0xaf00e1
mov edi, dword [ebp - 0xd9c]
mov dword [ebp - 0xa88], edi
cmp esi, 0xd0000023
jne 0xaf00f3
mov esi, 0x8007007a
jmp 0xaf0ddd
test esi, esi
js 0xaf0de3
mov eax, dword [ebp - 0xb10]
push 4
pop edx
mov dword [ebp - 0xae8], ebx
mov dword [ebp - 0xb0c], ebx
mov dword [ebp - 0xb3c], eax
cmp edi, edx
jae 0xaf0124
mov esi, 0xc000003e
jmp 0xaf04fd
mov edi, dword [eax]
lea ecx, [ebp - 0xb3c]
push ecx
mov ecx, eax
mov dword [ebp - 0xa9c], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf04fd
lea eax, [ebp - 0xb0c]
xor ecx, ecx
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf04fd
mov eax, dword [ebp - 0xa88]
sub eax, dword [ebp - 0xb0c]
cmp eax, edi
jb 0xaf011a
mov eax, dword [ebp - 0xb3c]
lea ecx, [ebp - 0xb3c]
push ecx
mov edx, edi
mov dword [ebp - 0xa78], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf04fd
mov ecx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xb0c]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf04fd
mov eax, dword [ebp - 0xa88]
sub eax, dword [ebp - 0xb0c]
push 4
pop edx
cmp eax, edx
jb 0xaf011a
mov ecx, dword [ebp - 0xb3c]
lea eax, [ebp - 0xb3c]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0xaa8], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf04fd
mov ecx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xb0c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf04fd
mov eax, dword [ebp - 0xa88]
sub eax, dword [ebp - 0xb0c]
cmp eax, edi
jb 0xaf011a
mov eax, dword [ebp - 0xb3c]
lea ecx, [ebp - 0xb3c]
push ecx
mov edx, edi
mov dword [ebp - 0xa80], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf04fd
mov ecx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xb0c]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf04fd
mov eax, dword [ebp - 0xa88]
sub eax, dword [ebp - 0xb0c]
push 4
pop edx
cmp eax, edx
jb 0xaf011a
mov ecx, dword [ebp - 0xb3c]
mov eax, dword [ecx]
mov dword [ebp - 0xab0], eax
lea eax, [ebp - 0xb3c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf04fd
mov ecx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xb0c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf04fd
mov eax, dword [ebp - 0xa88]
sub eax, dword [ebp - 0xb0c]
mov ecx, dword [ebp - 0xab0]
cmp eax, ecx
jb 0xaf011a
lea eax, [ebp - 0xb0c]
mov edx, ecx
mov ecx, dword [ebp - 0xb0c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf04fd
mov edx, dword [ebp - 0xa88]
mov eax, edx
sub eax, dword [ebp - 0xb0c]
jne 0xaf011a
mov esi, dword [ebp - 0xa9c]
mov ecx, dword [ebp - 0xab0]
add ecx, 0xc
lea eax, [edi + esi]
add eax, ecx
cmp eax, edx
jne 0xaf011a
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xaf034e
mov esi, 0xc0000017
jmp 0xaf0482
cmp dword [ebp - 0xa78], 0
je 0xaf038c
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xaf0377
mov esi, 0xc0000017
jmp 0xaf0421
mov dword [edi + 4], eax
push esi
push dword [ebp - 0xa78]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xaf0391
mov dword [edi], ebx
mov dword [edi + 4], ebx
cmp dword [ebp - 0xa80], 0
je 0xaf03cc
mov esi, dword [ebp - 0xaa8]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xaf036d
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xa80]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xaf03d2
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [ebp - 0xb3c], 0
je 0xaf0411
mov esi, dword [ebp - 0xab0]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xaf036d
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xb3c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xaf0417
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 0xae8], edi
mov esi, ebx
mov edi, ebx
test edi, edi
je 0xaf0482
cmp dword [edi + 4], 0
je 0xaf043f
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xaf0459
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xaf0473
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xaf0496
mov eax, dword [ebp - 0xae8]
mov edi, ebx
mov dword [ebp - 0xab4], eax
jmp 0xaf049c
mov edi, dword [ebp - 0xae8]
test edi, edi
je 0xaf04fd
cmp dword [edi + 4], 0
je 0xaf04ba
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xaf04d4
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xaf04ee
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
mov dword [ebp - 0xa70], esi
jl 0xaf0de3
mov ecx, dword [ebp - 0xab4]
mov edi, ebx
mov dword [ebp - 0xad4], ebx
test ecx, ecx
jne 0xaf052b
mov esi, 0xd000000d
jmp 0xaf0ddd
mov eax, dword [ecx + 4]
mov dword [ebp - 0xaa8], eax
test eax, eax
je 0xaf0521
mov esi, dword [ecx]
test esi, esi
je 0xaf0521
add esi, 0xfffffff8
mov ecx, esi
mov dword [ebp - 0xae8], esi
call fcn.00ad193e
mov dword [ebp - 0xa9c], eax
test eax, eax
je 0xaf0b3a
mov ecx, 0xab69605e
mov dword [ebp - 0xb14], eax
mov dword [ebp - 0x3ac], ecx
mov edi, esi
mov ecx, 0x7f1137f
mov dl, bl
mov dword [ebp - 0x3a8], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xaa8]
mov dword [ebp - 0xa70], ecx
and edi, 7
je 0xaf0aed
mov dword [ebp - 0xaa0], ebx
mov ecx, ebx
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0xa78], ecx
test edi, edi
je 0xaf05fe
mov ebx, dword [ebp - 0xa70]
push 0x38
pop esi
movzx eax, byte [ebx]
inc ebx
cmp ecx, 4
jge 0xaf05ca
lea ecx, [esi - 0x20]
shl eax, cl
or dword [ebp - 0xafc], eax
jmp 0xaf05d4
mov ecx, esi
shl eax, cl
or dword [ebp - 0xaa0], eax
mov ecx, dword [ebp - 0xa78]
sub esi, 8
inc ecx
mov dword [ebp - 0xa78], ecx
cmp ecx, edi
jl 0xaf05b4
mov eax, ebx
mov dword [ebp - 0xa70], ebx
mov dword [ebp - 0xa70], eax
xor ebx, ebx
mov eax, dword [ebp - 0xafc]
mov esi, dword [ebp - 0xaa0]
xor eax, 0x92f65a5
xor esi, 0x699a899c
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0xa6c], esi
mov ecx, ebx
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xa88], esi
test edi, edi
je 0xaf0682
mov eax, dword [ebp - 0xb14]
push 4
pop esi
lea ebx, [eax + 1]
mov dword [ebp - 0xa78], ebx
cmp ecx, esi
jge 0xaf0652
rol dword [ebp - 0xab0], 8
mov ebx, dword [ebp - 0xab0]
jmp 0xaf065f
rol dword [ebp - 0xa88], 8
mov ebx, dword [ebp - 0xa88]
mov byte [eax], bl
inc ecx
mov ebx, dword [ebp - 0xa78]
mov eax, ebx
cmp ecx, edi
jl 0xaf0636
mov eax, dword [ebp - 0xaf4]
mov esi, dword [ebp - 0xa6c]
mov dword [ebp - 0xb14], ebx
xor ebx, ebx
push 4
pop ecx
cmp edi, ecx
jbe 0xaf0acd
push 8
pop ecx
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xa6c], esi
mov esi, dword [ebp - 0xae8]
mov eax, esi
shr eax, 3
mov dword [ebp - 0xa80], eax
test eax, eax
je 0xaf0a96
movzx esi, word [ebp - 0x3aa]
mov ebx, 0x7f1137f
movzx ecx, word [ebp - 0x3a6]
mov edi, 0xab69605e
movzx eax, bx
xor ebx, edi
mov dword [ebp - 0xaa4], eax
movzx eax, di
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0xb14]
mov dword [ebp - 0xab8], esi
add eax, 7
mov esi, dword [ebp - 0xa70]
add esi, 2
mov dword [ebp - 0xb20], ebx
mov ebx, dword [ebp - 0xaf4]
mov dword [ebp - 0xa88], ecx
mov ecx, dword [ebp - 0xa6c]
mov dword [ebp - 0xa78], eax
mov dword [ebp - 0xa70], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xa70]
xor ebx, edi
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xa70]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xa70]
shl esi, 8
add dword [ebp - 0xa70], 8
movzx eax, byte [eax + 5]
or esi, eax
mov eax, 0xab69605e
xor ecx, esi
xor eax, 0x7f1137f
xor eax, ecx
xor eax, ebx
mov ecx, eax
mov dword [ebp - 0xa6c], eax
sub ecx, 0xab69605e
rol eax, 0xa
rol ecx, 5
imul ecx, dword [ebp - 0xaa4]
add ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ecx + ebx]
ror ecx, 9
imul ecx, dword [ebp - 0xab8]
sub ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xa6c], eax
sub ecx, dword [ebp - 0xaa4]
imul ecx, dword [ebp - 0xabc]
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xab8]
xor ecx, ebx
mov eax, ebx
rol ecx, 6
imul ecx, dword [ebp - 0xa88]
rol eax, 2
sub ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov ecx, 0xab69605e
xor ecx, eax
mov dword [ebp - 0xa6c], eax
mov eax, 0x7f1137f
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, dword [ebp - 0xaa4]
imul eax, dword [ebp - 0xab8]
ror ecx, 6
xor ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov ecx, 0x7f1137f
add ecx, eax
mov dword [ebp - 0xa6c], eax
ror ecx, 0xf
imul ecx, dword [ebp - 0xabc]
rol eax, 2
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0xa88]
sub ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov ecx, 0xab69605e
xor ecx, eax
mov dword [ebp - 0xa6c], eax
ror ecx, 0xc
imul ecx, dword [ebp - 0xaa4]
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xa88]
imul ecx, dword [ebp - 0xab8]
shr eax, 0xa
xor ecx, eax
xor dword [ebp - 0xa6c], ecx
mov ecx, dword [ebp - 0xa6c]
mov eax, ecx
not eax
ror eax, 5
add eax, dword [ebp - 0xabc]
imul eax, dword [ebp - 0xa88]
xor ebx, eax
mov eax, ebx
sub eax, dword [ebp - 0xa88]
xor eax, 0xab69605e
xor ecx, eax
mov dword [ebp - 0xa6c], ecx
xor ecx, dword [ebp - 0xa88]
mov eax, dword [ebp - 0xa6c]
rol ecx, 2
imul ecx, dword [ebp - 0xaa4]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 6
imul ecx, dword [ebp - 0xab8]
rol eax, 7
add ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov dword [ebp - 0xa6c], eax
mov ecx, eax
xor eax, dword [ebp - 0xaa4]
imul eax, dword [ebp - 0xabc]
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xab8]
xor ecx, ebx
mov eax, ebx
rol ecx, 5
imul ecx, dword [ebp - 0xa88]
rol eax, 7
add ecx, eax
mov eax, dword [ebp - 0xb20]
xor dword [ebp - 0xa6c], ecx
mov ecx, dword [ebp - 0xa6c]
xor eax, ecx
xor ebx, eax
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xab8]
imul eax, dword [ebp - 0xaa4]
xor ecx, eax
mov dword [ebp - 0xa6c], ecx
mov eax, 0x7f1137f
sub ecx, eax
mov eax, dword [ebp - 0xa6c]
ror ecx, 1
imul ecx, dword [ebp - 0xabc]
ror eax, 6
sub ecx, eax
xor ebx, ecx
mov ecx, 0xab69605e
mov eax, ebx
rol eax, 0xe
lea ecx, [ecx + ebx]
rol ecx, 3
imul ecx, dword [ebp - 0xa88]
add ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0xa6c], eax
rol ecx, 0xf
imul ecx, dword [ebp - 0xaa4]
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xabc]
xor ecx, ebx
mov eax, ebx
imul ecx, dword [ebp - 0xab8]
shr eax, 3
xor ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov ecx, 0x7f1137f
xor ecx, eax
mov dword [ebp - 0xa6c], eax
rol ecx, 4
imul ecx, dword [ebp - 0xabc]
rol eax, 2
xor ecx, eax
mov eax, dword [ebp - 0xa78]
xor ecx, dword [ebp - 0xafc]
xor ebx, ecx
mov dword [ebp - 0xafc], edi
mov ecx, dword [ebp - 0xa6c]
xor ecx, dword [ebp - 0xaa0]
mov byte [eax - 4], bl
mov byte [eax], cl
ror ebx, 8
mov byte [eax - 5], bl
ror ecx, 8
mov byte [eax - 1], cl
ror ebx, 8
mov byte [eax - 6], bl
ror ecx, 8
mov byte [eax - 2], cl
ror ebx, 8
ror ecx, 8
mov byte [eax - 7], bl
mov byte [eax - 3], cl
add eax, 8
ror ebx, 8
ror ecx, 8
sub dword [ebp - 0xa80], 1
mov dword [ebp - 0xaa0], esi
mov esi, dword [ebp - 0xa70]
mov dword [ebp - 0xa78], eax
jne 0xaf0720
mov esi, dword [ebp - 0xae8]
xor ebx, ebx
mov ecx, dword [ebp - 0xa9c]
mov eax, ebx
test esi, esi
je 0xaf0aaa
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0xaf0aa2
mov edi, dword [ebp - 0xaa8]
movzx eax, dl
cdq
cmp eax, dword [esi + edi]
jne 0xaf0b0b
cmp edx, dword [esi + edi + 4]
jne 0xaf0b0b
mov edi, ecx
mov dword [ebp - 0xad4], esi
mov ecx, ebx
mov esi, ebx
jmp 0xaf0b12
mov dword [ebp - 0xa6c], ebx
jae 0xaf069f
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xaf4], eax
jmp 0xaf069f
or dword [ebp - 0xaa0], 0xffffffff
mov dword [ebp - 0xafc], ebx
mov dword [ebp - 0xa6c], ebx
mov dword [ebp - 0xaf4], eax
jmp 0xaf06a5
mov esi, 0xc004d501
mov edi, ebx
test ecx, ecx
je 0xaf0b1b
call fcn.00ad1951
test esi, esi
js 0xaf0b3a
mov eax, dword [ebp - 0xad4]
mov esi, 0x10000000
mov dword [ebp - 0xb04], edi
mov edi, ebx
mov dword [ebp - 0xb00], eax
jmp 0xaf0b3f
mov esi, 0xd0000001
mov dword [ebp - 0xa70], esi
test edi, edi
je 0xaf0b58
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xaf0de3
mov edi, dword [ebp - 0xb00]
mov ecx, dword [ebp - 0xb04]
push 4
pop edx
mov dword [ebp - 0xb90], ebx
mov dword [ebp - 0xbb0], ecx
cmp edi, edx
jb 0xaf0dd2
mov eax, dword [ecx]
mov dword [ebp - 0xa9c], eax
lea eax, [ebp - 0xbb0]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf0dd7
lea eax, [ebp - 0xb90]
xor ecx, ecx
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf0dd7
mov eax, edi
sub eax, dword [ebp - 0xb90]
push 4
pop edx
cmp eax, edx
jb 0xaf0dd2
mov ecx, dword [ebp - 0xbb0]
lea eax, [ebp - 0xbb0]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0xa78], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf0dd7
mov ecx, dword [ebp - 0xb90]
lea eax, [ebp - 0xb90]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf0dd7
mov eax, dword [ebp - 0xb00]
mov ecx, dword [ebp - 0xb90]
sub eax, ecx
cmp eax, edi
jb 0xaf0dd2
lea eax, [ebp - 0xb90]
mov edx, edi
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf0dd7
mov edx, dword [ebp - 0xb00]
mov esi, dword [ebp - 0xb04]
mov ecx, dword [ebp - 0xbb0]
add ecx, edi
lea eax, [edx + esi]
cmp eax, ecx
jb 0xaf0dd2
mov eax, dword [ebp - 0xbb0]
sub edx, edi
sub edx, eax
add edx, esi
cmp edx, 8
jae 0xaf0dd2
mov dword [ebp - 0xb14], ebx
mov ecx, ebx
mov dword [ebp - 0xa80], ecx
mov esi, ebx
test eax, eax
je 0xaf0d63
mov edx, dword [ebp - 0xa78]
lea ecx, [ebp - 0xc04]
push ecx
mov ecx, eax
mov edi, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf0dd7
mov eax, dword [ebp - 0xc04]
jmp 0xaf0d4f
lea eax, [ebp - 0xce0]
mov ecx, edi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf0dd7
mov eax, dword [ebp - 0xc04]
cmp dword [ebp - 0xce0], eax
ja 0xaf0d8a
mov edx, dword [edi]
lea eax, [ebp - 0xce4]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf0d11
mov eax, dword [ebp - 0xce4]
mov dword [ebp - 0xce8], eax
jmp 0xaf0d17
mov eax, dword [ebp - 0xce8]
test esi, esi
js 0xaf0dd7
lea ecx, [ebp - 0xbc4]
mov edx, eax
push ecx
mov ecx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf0dd7
mov edi, dword [ebp - 0xbc4]
mov eax, dword [ebp - 0xc04]
cmp edi, eax
ja 0xaf0d8a
inc dword [ebp - 0xb14]
cmp edi, eax
jb 0xaf0cbb
cmp edi, eax
jne 0xaf0d8a
mov edi, dword [ebp - 0xa78]
mov ecx, ebx
test edi, edi
je 0xaf0d93
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xa80], ecx
test ecx, ecx
jne 0xaf0d91
mov esi, 0xc0000017
jmp 0xaf0dc0
mov esi, 0xc000000d
jmp 0xaf0dd7
mov esi, ebx
mov eax, dword [ebp - 0xbb0]
test eax, eax
je 0xaf0dae
push edi
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [ebp - 0xa80]
add esp, 0xc
mov eax, dword [ebp - 0xb14]
mov dword [ebp - 0xb98], ecx
mov dword [ebp - 0xba0], eax
test esi, esi
js 0xaf0dd7
mov eax, dword [ebp - 0xa9c]
cmp eax, dword [ebp - 0xba0]
je 0xaf0dd7
mov esi, 0xc000003e
or esi, 0x10000000
mov dword [ebp - 0xa70], esi
mov eax, dword [ebp - 0xa84]
test eax, eax
je 0xaf0dfc
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xaf8]
test edi, edi
je 0xaf0e63
cmp dword [edi + 4], 0
je 0xaf0e20
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xaf0e3a
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xaf0e54
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb88]
test eax, eax
je 0xaf0e7c
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb10]
test eax, eax
je 0xaf0e95
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xab4]
test edi, edi
je 0xaf0efc
cmp dword [edi + 4], 0
je 0xaf0eb9
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xaf0ed3
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xaf0eed
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb04]
test eax, eax
je 0xaf0f15
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xaf1510
xor eax, eax
inc eax
cmp dword [ebp - 0xba0], eax
jb 0xaf1505
cmp dword [ebp - 0xb98], 0
jne 0xaf0fbc
mov esi, 0xc000000d
mov dword [ebp - 0xa70], esi
push 4
mov eax, ebx
pop edx
test esi, esi
js 0xaf1510
cmp eax, 0xd0000023
jne 0xaf0f63
mov eax, 0x8007007a
mov dword [ebp - 0xa94], eax
cmp eax, 0x8007007a
je 0xaf0f7a
mov esi, eax
mov dword [ebp - 0xa70], esi
test eax, eax
js 0xaf1510
cmp dword [ebp - 0xba0], 6
jne 0xaf1505
cmp dword [ebp - 0xb98], 0
jne 0xaf1036
mov edx, dword [ebp - 0xc8c]
mov esi, 0xc000000d
mov ecx, dword [ebp - 0xc90]
mov dword [ebp - 0xa70], esi
mov dword [ebp - 0xb10], edx
mov dword [ebp - 0xab4], ecx
jmp 0xaf1112
cmp dword [ebp - 0xba0], 0
jbe 0xaf0f39
mov eax, dword [ebp - 0xb98]
lea ecx, [ebp - 0xb8c]
push ecx
push 4
pop ecx
mov edi, dword [eax]
mov edx, ecx
mov ecx, eax
mov dword [ebp - 0xb8c], eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf100a
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb8c]
mov dword [ebp - 0xb8c], eax
jmp 0xaf1016
mov edi, dword [ebp - 0xe14]
mov eax, dword [ebp - 0xe20]
test esi, esi
js 0xaf0f44
push 4
pop edx
cmp edi, edx
jne 0xaeea57
mov eax, dword [eax]
mov dword [ebp - 0xa94], eax
jmp 0xaf0f49
mov ecx, dword [ebp - 0xb98]
mov edi, ebx
mov dword [ebp - 0xb7c], ecx
mov eax, dword [ecx]
mov dword [ebp - 0xa78], eax
lea eax, [ebp - 0xb7c]
push eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf10ce
mov edx, dword [ebp - 0xa78]
lea eax, [ebp - 0xb7c]
mov ecx, dword [ebp - 0xb7c]
push eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf10ce
mov ecx, dword [ebp - 0xb7c]
xor eax, eax
inc edi
inc eax
cmp edi, eax
jae 0xaf109b
push 4
pop edx
jmp 0xaf1044
mov edi, dword [ecx]
lea eax, [ebp - 0xb7c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf10ce
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xb7c], eax
jmp 0xaf10da
mov edi, dword [ebp - 0xe24]
mov eax, dword [ebp - 0xe28]
test esi, esi
js 0xaf10fa
cmp edi, 8
jne 0xaeea57
mov ecx, dword [eax]
mov dword [ebp - 0xab4], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xb10], ecx
jmp 0xaf1112
mov eax, dword [ebp - 0xc8c]
mov dword [ebp - 0xb10], eax
mov eax, dword [ebp - 0xc90]
mov dword [ebp - 0xab4], eax
test esi, esi
js 0xaf1510
cmp dword [ebp - 0xb98], 0
jne 0xaf115c
mov esi, 0xc000000d
mov dword [ebp - 0xa70], esi
mov eax, dword [ebp - 0xcf0]
push 4
pop edx
mov dword [ebp - 0xa84], eax
test esi, esi
js 0xaf1510
cmp dword [ebp - 0xb98], 0
jne 0xaf1218
mov esi, 0xc000000d
jmp 0xaf150a
mov ecx, dword [ebp - 0xb98]
mov edi, ebx
mov dword [ebp - 0xb1c], ecx
mov eax, dword [ecx]
mov dword [ebp - 0xa78], eax
lea eax, [ebp - 0xb1c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf11f2
mov edx, dword [ebp - 0xa78]
lea eax, [ebp - 0xb1c]
mov ecx, dword [ebp - 0xb1c]
push eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf11f2
mov ecx, dword [ebp - 0xb1c]
inc edi
cmp edi, 2
jb 0xaf116a
mov edi, dword [ecx]
lea eax, [ebp - 0xb1c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf11f2
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb1c]
mov dword [ebp - 0xb1c], eax
jmp 0xaf11fe
mov edi, dword [ebp - 0xe4c]
mov eax, dword [ebp - 0xe50]
test esi, esi
js 0xaf112e
push 4
pop edx
cmp edi, edx
jne 0xaeea57
mov eax, dword [eax]
jmp 0xaf1137
mov ecx, dword [ebp - 0xb98]
mov edi, ebx
mov dword [ebp - 0xae0], ecx
mov eax, dword [ecx]
mov dword [ebp - 0xa78], eax
lea eax, [ebp - 0xae0]
push eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf12b2
mov edx, dword [ebp - 0xa78]
lea eax, [ebp - 0xae0]
mov ecx, dword [ebp - 0xae0]
push eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf12b2
mov ecx, dword [ebp - 0xae0]
inc edi
cmp edi, 3
jae 0xaf127b
push 4
pop edx
jmp 0xaf1226
mov edi, dword [ecx]
lea eax, [ebp - 0xae0]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xa9c], edi
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf12b2
neg edi
sbb edi, edi
and edi, dword [ebp - 0xae0]
mov dword [ebp - 0xae0], edi
jmp 0xaf12c4
mov eax, dword [ebp - 0xddc]
mov edi, dword [ebp - 0xde0]
mov dword [ebp - 0xa9c], eax
test esi, esi
js 0xaf1510
mov ecx, dword [ebp - 0xb98]
push 4
mov dword [ebp - 0xadc], ecx
mov dword [ebp - 0xa78], ebx
pop edx
mov eax, dword [ecx]
mov dword [ebp - 0xa80], eax
lea eax, [ebp - 0xadc]
push eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf1379
mov edx, dword [ebp - 0xa80]
lea eax, [ebp - 0xadc]
mov ecx, dword [ebp - 0xadc]
push eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf1379
mov eax, dword [ebp - 0xa78]
mov ecx, dword [ebp - 0xadc]
inc eax
push 4
pop edx
mov dword [ebp - 0xa78], eax
cmp eax, edx
jb 0xaf12e1
mov eax, dword [ecx]
mov dword [ebp - 0xa78], eax
lea eax, [ebp - 0xadc]
push eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf1379
mov ecx, dword [ebp - 0xa78]
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0xadc]
mov dword [ebp - 0xadc], eax
jmp 0xaf1385
mov ecx, dword [ebp - 0xde4]
mov eax, dword [ebp - 0xde8]
push 4
pop edx
test esi, esi
js 0xaf1398
cmp ecx, edx
jne 0xaeea57
mov eax, dword [eax]
jmp 0xaf139e
mov eax, dword [ebp - 0xdec]
mov dword [ebp - 0xa80], eax
test esi, esi
js 0xaf1510
mov ecx, dword [ebp - 0xb98]
mov dword [ebp - 0xaac], ecx
mov dword [ebp - 0xa78], ebx
mov eax, dword [ecx]
mov dword [ebp - 0xaa8], eax
lea eax, [ebp - 0xaac]
push eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf1462
mov edx, dword [ebp - 0xaa8]
lea eax, [ebp - 0xaac]
mov ecx, dword [ebp - 0xaac]
push eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf1462
mov eax, dword [ebp - 0xa78]
mov ecx, dword [ebp - 0xaac]
inc eax
mov dword [ebp - 0xa78], eax
cmp eax, 5
jae 0xaf1423
push 4
pop edx
jmp 0xaf13be
mov eax, dword [ecx]
mov dword [ebp - 0xa78], eax
lea eax, [ebp - 0xaac]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [ebp - 0xa70], esi
test esi, esi
js 0xaf1462
mov ecx, dword [ebp - 0xa78]
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0xaac]
mov dword [ebp - 0xaac], eax
jmp 0xaf146e
mov ecx, dword [ebp - 0xdf0]
mov eax, dword [ebp - 0xdf4]
push 4
pop edx
test esi, esi
js 0xaf1481
cmp ecx, edx
jne 0xaeea57
mov ecx, dword [eax]
jmp 0xaf1483
mov ecx, ebx
test esi, esi
js 0xaf1510
mov eax, dword [ebp - 0xad0]
cmp eax, dword [ebp - 0xab4]
jne 0xaf1505
mov eax, dword [ebp - 0xacc]
cmp eax, dword [ebp - 0xb10]
jne 0xaf1505
mov dword [ebp - 0xa90], ecx
cmp dword [ebp - 0xa80], edx
jbe 0xaf14c8
mov ecx, dword [ebp - 0xa84]
mov esi, 0x8007007a
mov dword [ebp - 0xbac], ecx
jmp 0xaf150a
mov eax, dword [ebp - 0xa9c]
cmp eax, edx
ja 0xaf14b5
push eax
push edi
push dword [ebp - 0xa98]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xa84]
add esp, 0xc
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xa94]
mov edi, dword [ebp - 0xa74]
test eax, eax
je 0xaf1516
mov esi, eax
jmp 0xaee72e
mov esi, 0xc004d501
mov dword [ebp - 0xa70], esi
mov edi, dword [ebp - 0xa74]
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0xd58], ebx
mov dword [ebp - 0xd5c], ebx
test eax, eax
je 0xaf1541
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xd54], ebx
mov eax, dword [ebp - 0xb98]
mov dword [ebp - 0xb9c], ebx
mov dword [ebp - 0xba0], ebx
test eax, eax
je 0xaf156c
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xb98], ebx
test edi, edi
je 0xaf157f
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xa7c]
test eax, eax
je 0xaf1598
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xaee5e3
mov eax, dword [ebp - 0xa90]
test eax, eax
je 0xaf7f44
mov dword [0xc95878], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x2c0]
mov dword [ebp - 0xc18], ebx
push eax
push 0x9d0000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0xaf5ead
cmp eax, esi
jne 0xaf15ec
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0xaf5ead
mov esi, dword [0xc9307c]
mov ecx, esi
push 0x403
push ebx
push ebx
call dword [0xc99200]
call esi
mov dword [ebp - 0xab8], eax
test eax, eax
jne 0xaf1618
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xaf5ead
mov esi, dword [0xc9304c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [0xc95870], eax
lea edi, [ebp - 0x350]
mov eax, dword [0xc95878]
mov dword [ebp - 0xad0], eax
xor eax, eax
stosd dword es:[edi], eax
push 0x2c
push ebx
mov dword [0xc95874], edx
stosd dword es:[edi], eax
mov dword [ebp - 0xcd8], ebx
mov dword [ebp - 0xcd4], ebx
mov dword [ebp - 0xaf8], ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x40c]
push eax
mov dword [ebp - 0xb14], ebx
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0xb88], ebx
xor ebx, ebx
mov edx, 0xc96238
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xaf1680
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jne 0xaf1c9c
mov ecx, 0x338
mov dword [ebp - 0xa94], ebx
mov dword [ebp - 0xaa4], ebx
mov dword [ebp - 0xaa8], ebx
call fcn.00ad193e
mov dword [ebp - 0xad4], eax
test eax, eax
je 0xaf1c36
or dword [ebp - 0xa78], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x4e0], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xa7c], ebx
mov dword [ebp - 0x4dc], edx
mov cl, bl
mov dword [ebp - 0xa74], ebx
mov edx, ebx
mov dword [ebp - 0xa80], eax
mov esi, 0x9fbcf2
mov dword [ebp - 0xa9c], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [ebp - 0xa6c], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [ebp - 0xa98], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [ebp - 0xa74]
xor esi, edx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, edx
mov dword [ebp - 0xa6c], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xa6c]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xa6c]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xa6c], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xa6c]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xa6c]
xor edx, eax
mov dword [ebp - 0xa6c], edx
mov eax, dword [ebp - 0xa6c]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, edx
mov dword [ebp - 0xa6c], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xa6c]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, edx
mov dword [ebp - 0xa6c], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xa6c]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xa6c]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0xa6c], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0xa6c]
xor eax, 0xab69605e
mov dword [ebp - 0xa74], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xa74]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xa74]
xor eax, edx
mov dword [ebp - 0xa74], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xa74], edx
mov edx, dword [ebp - 0xa74]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xa74], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xa74]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xa74]
xor eax, edx
mov dword [ebp - 0xa74], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xa74]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xa74]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xa74], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xa74]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xa74]
xor edx, dword [ebp - 0xa7c]
xor eax, dword [ebp - 0xa78]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xa6c], esi
mov esi, dword [ebp - 0xa80]
mov dword [ebp - 0xa7c], ebx
mov dword [ebp - 0xa78], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xa9c], 1
mov dword [ebp - 0xa80], esi
mov esi, dword [ebp - 0xa98]
mov dword [ebp - 0xa74], eax
jne 0xaf170c
mov esi, dword [ebp - 0xad4]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xaf1a85
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xaf1ab3
cmp edx, dword [0x9fc02c]
jne 0xaf1ab3
mov dword [ebp - 0xaa4], esi
mov edi, 0x337
mov esi, ebx
jmp 0xaf1ac0
mov dword [ebp - 0xaa8], 0xc004d501
or edi, 0xffffffff
test esi, esi
je 0xaf1acb
mov ecx, esi
call fcn.00ad1951
cmp dword [ebp - 0xaa8], ebx
jl 0xaf1c36
mov eax, dword [ebp - 0xaa4]
mov esi, eax
push 0x40
push ebx
push 0xc960a0
mov byte [edi + eax], bl
call fcn.00ab4bf6
mov eax, esi
add esp, 0xc
cmp byte [eax], bl
je 0xaf1c3d
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xa98], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xaf1b0e
sub ecx, dword [ebp - 0xa98]
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xaf1c36
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xa88], ecx
cmp word [eax], dx
je 0xaf1b59
mov ecx, 0xc000007b
mov dword [ebp - 0xa88], ecx
jmp 0xaf1ba1
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xaf1b4c
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xaf1b4c
cmp dword [edx], 0x4550
jne 0xaf1b4c
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xb6c]
je 0xaf1b8f
cmp ax, word [ebp - 0xb60]
je 0xaf1b8f
mov ecx, 0xc000000d
jmp 0xaf1b51
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xa80], eax
mov dword [ebp - 0xa7c], ebx
test eax, eax
je 0xaf1c1d
mov edx, esi
mov dword [ebp - 0xa78], esi
lea eax, [edx + 1]
mov dword [ebp - 0xa98], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xaf1bc9
sub edx, dword [ebp - 0xa98]
inc esi
add esi, edx
test ecx, ecx
js 0xaf1c02
push dword [ebp - 0xa78]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xaf1c28
mov ecx, dword [ebp - 0xa94]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xa88]
mov eax, dword [ebp - 0xa7c]
inc dword [ebp - 0xa94]
inc eax
mov dword [ebp - 0xa7c], eax
cmp eax, dword [ebp - 0xa80]
jb 0xaf1bb8
add edi, 0x10
cmp byte [esi], bl
jne 0xaf1b01
mov esi, dword [ebp - 0xa88]
mov eax, dword [ebp - 0xaa4]
jmp 0xaf1c3f
mov esi, 0xc000007a
jmp 0xaf1c2e
mov esi, ebx
test eax, eax
je 0xaf1c57
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push dword [ebp - 0xaa4]
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0xaf1c97
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xaf1c6e
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xaf1c5d
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xaf1ca2
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edx, 0xc96238
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0xac0], ebx
lea edi, [ebp - 0xdd8]
mov dword [ebp - 0xb04], ebx
stosd dword es:[edi], eax
mov esi, ebx
mov dword [ebp - 0xb00], ebx
mov dword [ebp - 0xb20], ebx
mov dword [ebp - 0xacc], ebx
xor ebx, ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xa84], esi
mov dword [ebp - 0xafc], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xaf1ce5
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jne 0xaf2314
mov ecx, 0x338
mov dword [ebp - 0xa94], ebx
mov dword [ebp - 0xaa4], ebx
mov dword [ebp - 0xaa8], ebx
call fcn.00ad193e
mov dword [ebp - 0xad4], eax
test eax, eax
je 0xaf22ae
or dword [ebp - 0xa78], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x4d0], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xa7c], ebx
mov dword [ebp - 0x4cc], edx
mov cl, bl
mov dword [ebp - 0xa74], ebx
mov edx, ebx
mov dword [ebp - 0xa80], eax
mov esi, 0x9fbcf2
mov dword [ebp - 0xa9c], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [ebp - 0xa6c], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [ebp - 0xa98], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [ebp - 0xa74]
xor esi, edx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, edx
mov dword [ebp - 0xa6c], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xa6c]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xa6c]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xa6c], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xa6c]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xa6c]
xor edx, eax
mov dword [ebp - 0xa6c], edx
mov eax, dword [ebp - 0xa6c]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, edx
mov dword [ebp - 0xa6c], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xa6c]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, edx
mov dword [ebp - 0xa6c], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xa6c]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xa6c]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0xa6c], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0xa6c]
xor eax, 0xab69605e
mov dword [ebp - 0xa74], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xa74]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xa74]
xor eax, edx
mov dword [ebp - 0xa74], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xa74], edx
mov edx, dword [ebp - 0xa74]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xa74], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xa74]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xa74]
xor eax, edx
mov dword [ebp - 0xa74], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xa74]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xa74]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xa74], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xa74]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xa74]
xor edx, dword [ebp - 0xa7c]
xor eax, dword [ebp - 0xa78]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xa6c], esi
mov esi, dword [ebp - 0xa80]
mov dword [ebp - 0xa7c], ebx
mov dword [ebp - 0xa78], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xa9c], 1
mov dword [ebp - 0xa80], esi
mov esi, dword [ebp - 0xa98]
mov dword [ebp - 0xa74], eax
jne 0xaf1d71
mov esi, dword [ebp - 0xad4]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xaf20ea
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xaf2118
cmp edx, dword [0x9fc02c]
jne 0xaf2118
mov dword [ebp - 0xaa4], esi
mov edi, 0x337
mov esi, ebx
jmp 0xaf2125
mov dword [ebp - 0xaa8], 0xc004d501
or edi, 0xffffffff
test esi, esi
je 0xaf2130
mov ecx, esi
call fcn.00ad1951
cmp dword [ebp - 0xaa8], ebx
jl 0xaf22ae
mov eax, dword [ebp - 0xaa4]
mov esi, eax
push 0x40
push ebx
push 0xc960a0
mov byte [edi + eax], bl
call fcn.00ab4bf6
mov eax, esi
add esp, 0xc
cmp byte [eax], bl
je 0xaf22b5
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xa98], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xaf2173
sub ecx, dword [ebp - 0xa98]
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xaf22a7
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xa88], ecx
cmp word [eax], dx
je 0xaf21be
mov ecx, 0xc000007b
mov dword [ebp - 0xa88], ecx
jmp 0xaf2206
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xaf21b1
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xaf21b1
cmp dword [edx], 0x4550
jne 0xaf21b1
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xb6c]
je 0xaf21f4
cmp ax, word [ebp - 0xb60]
je 0xaf21f4
mov ecx, 0xc000000d
jmp 0xaf21b6
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xa80], eax
mov dword [ebp - 0xa7c], ebx
test eax, eax
je 0xaf2282
mov edx, esi
mov dword [ebp - 0xa78], esi
lea eax, [edx + 1]
mov dword [ebp - 0xa98], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xaf222e
sub edx, dword [ebp - 0xa98]
inc esi
add esi, edx
test ecx, ecx
js 0xaf2267
push dword [ebp - 0xa78]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xaf228d
mov ecx, dword [ebp - 0xa94]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xa88]
mov eax, dword [ebp - 0xa7c]
inc dword [ebp - 0xa94]
inc eax
mov dword [ebp - 0xa7c], eax
cmp eax, dword [ebp - 0xa80]
jb 0xaf221d
add edi, 0x10
cmp byte [esi], bl
jne 0xaf2166
mov esi, dword [ebp - 0xa88]
mov eax, dword [ebp - 0xafc]
mov dword [ebp - 0xa84], eax
mov eax, dword [ebp - 0xaa4]
jmp 0xaf22b7
mov esi, 0xc000007a
jmp 0xaf2293
mov esi, 0xc000007a
jmp 0xaf229f
mov esi, ebx
test eax, eax
je 0xaf22cf
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push dword [ebp - 0xaa4]
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0xaf230f
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xaf22e6
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xaf22d5
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xaf231a
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
push 0x54
lea eax, [ebp - 0x774]
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
mov esi, dword [0xc9307c]
lea edi, [ebp - 0x354]
add esp, 0xc
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
pop edx
push 0x403
push ebx
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xad0]
mov ecx, eax
and ecx, edx
mov dword [ebp - 0xaa0], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
and ecx, edx
shr eax, 0xc
mov word [ebp - 0xa], cx
and eax, edx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0xc99200]
call esi
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xa88], 0xffffff
test eax, eax
jne 0xaf23d6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa74], edi
test edi, edi
jle 0xaf23c1
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa74], edi
test edi, edi
js 0xaf3996
mov dword [ebp - 0xa74], 0x80004005
jmp 0xaf3996
mov esi, dword [0xc93050]
lea eax, [ebp - 0xc1c]
push eax
push ebx
lea eax, [ebp - 0xbcc]
mov dword [ebp - 0xbec], ebx
push eax
mov edi, ebx
mov dword [ebp - 0xad4], ebx
push 8
mov ecx, esi
mov dword [ebp - 0xb50], edi
mov dword [ebp - 0xbf8], ebx
mov dword [ebp - 0xb4c], ebx
mov dword [ebp - 0xbc8], ebx
mov dword [ebp - 0xa74], ebx
mov dword [ebp - 0xc1c], ebx
call dword [0xc99200]
call esi
test eax, eax
jne 0xaf2462
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xa74], eax
test eax, eax
jle 0xaf244d
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xa74], eax
test eax, eax
js 0xaf25b2
mov dword [ebp - 0xa74], 0x80004005
jmp 0xaf25b2
mov eax, dword [ebp - 0xc1c]
lea ecx, [eax + eax]
call fcn.00ad193e
push eax
lea ecx, [ebp - 0xb4c]
call fcn.00ad1916
cmp dword [ebp - 0xb4c], 0
jne 0xaf2494
mov dword [ebp - 0xa74], 0x8007000e
jmp 0xaf25b2
mov eax, dword [ebp - 0xbcc]
lea ecx, [eax*4 + 4]
call fcn.00ad193e
push eax
lea ecx, [ebp - 0xbc8]
call fcn.00ad1916
mov esi, dword [ebp - 0xbc8]
test esi, esi
je 0xaf2485
mov ebx, dword [0xc93050]
lea eax, [ebp - 0xc1c]
push eax
push dword [ebp - 0xb4c]
lea eax, [ebp - 0xbcc]
mov ecx, ebx
push eax
push 8
call dword [0xc99200]
call ebx
test eax, eax
jne 0xaf2519
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xa74], eax
test eax, eax
jle 0xaf2506
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xa74], eax
test eax, eax
js 0xaf2512
mov dword [ebp - 0xa74], 0x80004005
xor ebx, ebx
jmp 0xaf25b2
xor ebx, ebx
mov edx, esi
mov dword [ebp - 0xa7c], edx
mov dword [ebp - 0xa78], ebx
cmp dword [ebp - 0xbcc], ebx
jbe 0xaf2591
mov esi, dword [ebp - 0xb4c]
mov edi, dword [0xc93058]
mov ecx, edi
push ebx
push esi
call dword [0xc99200]
call edi
mov edx, dword [ebp - 0xa7c]
mov ecx, esi
mov dword [edx], eax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xaf2556
sub ecx, edi
sar ecx, 1
push 4
pop eax
add edx, eax
mov eax, dword [ebp - 0xa78]
lea esi, [esi + ecx*2]
mov dword [ebp - 0xa7c], edx
add esi, 2
inc eax
mov dword [ebp - 0xa78], eax
cmp eax, dword [ebp - 0xbcc]
jb 0xaf2537
mov esi, dword [ebp - 0xbc8]
mov dword [edx], 0x409
mov edi, esi
mov eax, dword [ebp - 0xbcc]
inc eax
mov dword [ebp - 0xbc8], ebx
mov dword [ebp - 0xb50], edi
mov dword [ebp - 0xa7c], eax
lea ecx, [ebp - 0xbc8]
call fcn.00ad18c0
lea ecx, [ebp - 0xb4c]
call fcn.00ad18c0
cmp dword [ebp - 0xa74], 0
jl 0xaf2d67
cmp dword [ebp - 0xa7c], 0
mov eax, ebx
mov dword [ebp - 0xa94], eax
mov edx, ebx
jbe 0xaf260b
mov ecx, ebx
mov eax, dword [edi + edx*4]
cmp eax, dword [ecx*4 + 0xa192e8]
je 0xaf270d
inc ecx
cmp ecx, 0x26
jb 0xaf25ea
inc edx
cmp edx, dword [ebp - 0xa7c]
jb 0xaf25e8
mov eax, ebx
mov esi, dword [0xc93054]
lea ecx, [ebp - 0xb8]
push ebx
push 0x55
push ecx
push dword [eax*4 + 0xa192e8]
mov ecx, esi
mov dword [ebp - 0xaa8], ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xaf2670
mov esi, dword [0xc93048]
lea eax, [ebp - 0x644]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xb8]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
test eax, eax
jle 0xaf2670
mov edi, dword [ebp - 0x638]
xor eax, eax
shr edi, 0x1b
inc eax
and edi, eax
mov dword [ebp - 0xaa8], edi
mov edx, 0x9fba10
mov esi, ebx
mov ecx, edx
mov dword [ebp + esi*4 - 0x344], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xaf2683
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0xaf2677
imul ecx, dword [ebp - 0xa94], 3
movzx eax, byte [ecx + 0xa00b58]
mov eax, dword [ebp + eax*4 - 0x344]
mov dword [ebp - 0xb00], eax
movzx eax, byte [ecx + 0xa00b59]
mov eax, dword [ebp + eax*4 - 0x344]
mov dword [ebp - 0xb20], eax
movzx eax, byte [ecx + 0xa00b5a]
mov eax, dword [ebp + eax*4 - 0x344]
mov dword [ebp - 0xacc], eax
mov ecx, 0x1c90
mov dword [ebp - 0xa74], ebx
call fcn.00ad193e
mov ecx, eax
mov dword [ebp - 0xad0], ecx
test ecx, ecx
jne 0xaf271a
mov edi, 0x8007000e
mov dword [ebp - 0xa74], edi
jmp 0xaf2d6d
mov eax, ecx
mov dword [ebp - 0xa94], eax
jmp 0xaf260b
or dword [ebp - 0xa78], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x4d8], edx
add ecx, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xa7c], ebx
mov esi, 0xa19392
mov dword [ebp - 0x4d4], edx
mov al, bl
mov dword [ebp - 0xa98], ebx
mov edx, ebx
mov dword [ebp - 0xa80], ecx
mov dword [ebp - 0xa90], esi
mov dword [ebp - 0xa9c], 0x392
movzx edi, byte [esi - 2]
movzx ecx, byte [esi - 1]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, ecx
shl esi, 8
mov ecx, dword [ebp - 0xa90]
xor edx, edi
mov dword [ebp - 0xa6c], edx
movzx ecx, byte [ecx + 3]
or esi, ecx
mov ecx, dword [ebp - 0xa90]
shl esi, 8
movzx ecx, byte [ecx + 4]
or esi, ecx
mov ecx, dword [ebp - 0xa90]
shl esi, 8
add dword [ebp - 0xa90], 8
movzx ecx, byte [ecx + 5]
or esi, ecx
xor ebx, esi
xor ebx, edx
xor ebx, 0xac987321
lea ecx, [ebx + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, ebx
rol ecx, 0xa
add edx, ecx
mov ecx, dword [ebp - 0xa6c]
xor ecx, edx
mov dword [ebp - 0xa6c], ecx
add ecx, 0x7f1137f
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0xa6c]
rol ecx, 2
sub edx, ecx
xor ebx, edx
imul edx, ebx, 0x605e
mov ecx, ebx
shr ecx, 0xd
sub edx, ecx
mov ecx, dword [ebp - 0xa6c]
sub edx, 0x756c8a2
xor ecx, edx
mov dword [ebp - 0xa6c], ecx
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0xa6c]
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor ebx, edx
mov edx, ebx
xor edx, 0xab69605e
sub ecx, edx
mov edx, dword [ebp - 0xa6c]
xor edx, ecx
mov dword [ebp - 0xa6c], edx
mov ecx, dword [ebp - 0xa6c]
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor ebx, edx
lea ecx, [ebx + 0x7f1137f]
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, ebx
rol ecx, 2
add edx, ecx
mov ecx, dword [ebp - 0xa6c]
xor ecx, edx
mov dword [ebp - 0xa6c], ecx
add ecx, 0x54969fa2
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0xa6c]
rol ecx, 8
sub edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0xab69605e
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, ebx
ror ecx, 0xa
xor edx, ecx
mov ecx, dword [ebp - 0xa6c]
xor ecx, edx
mov dword [ebp - 0xa6c], ecx
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0xa6c]
shr ecx, 0xa
xor edx, ecx
xor edx, ebx
mov ebx, dword [ebp - 0xa6c]
mov ecx, edx
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor ebx, ecx
mov dword [ebp - 0xa6c], ebx
add ebx, 0xfffff80f
xor ebx, edx
xor ebx, 0xab69605e
mov ecx, ebx
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, ebx
shr ecx, 2
add edx, ecx
mov ecx, dword [ebp - 0xa6c]
xor ecx, edx
mov dword [ebp - 0xa6c], ecx
add ecx, 0xf80eec81
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0xa6c]
rol ecx, 7
add edx, ecx
xor ebx, edx
mov ecx, ebx
mov edx, ebx
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
mov ecx, dword [ebp - 0xa6c]
xor ecx, edx
mov dword [ebp - 0xa6c], ecx
xor ecx, 0xab69
rol ecx, 5
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0xa6c]
rol ecx, 7
add edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, dword [ebp - 0xa6c]
xor ecx, 0xac987321
mov dword [ebp - 0xa6c], ecx
ror ecx, 3
imul ecx, ecx, 0x137f
sub ecx, 0xd0dd417
xor ebx, ecx
lea ecx, [ebx - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, ebx
ror ecx, 6
sub edx, ecx
mov ecx, dword [ebp - 0xa6c]
xor ecx, edx
mov dword [ebp - 0xa6c], ecx
add ecx, 0xab69605e
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0xa6c]
rol ecx, 0xe
add edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x54969fa2]
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, ebx
ror ecx, 0xe
sub edx, ecx
mov ecx, dword [ebp - 0xa6c]
xor ecx, edx
mov dword [ebp - 0xa6c], ecx
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0xa6c]
shr ecx, 3
xor edx, ecx
xor ebx, edx
mov edx, 0x7f1137f
mov ecx, ebx
xor ecx, edx
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, ebx
xor ebx, dword [ebp - 0xa78]
rol ecx, 2
mov dword [ebp - 0xa78], esi
mov esi, dword [ebp - 0xa90]
xor edx, ecx
mov ecx, dword [ebp - 0xa80]
xor edx, dword [ebp - 0xa7c]
xor dword [ebp - 0xa6c], edx
mov edx, dword [ebp - 0xa6c]
mov byte [ecx - 4], dl
mov byte [ecx], bl
ror edx, 8
mov byte [ecx - 5], dl
ror ebx, 8
mov byte [ecx - 1], bl
ror edx, 8
mov byte [ecx - 6], dl
ror ebx, 8
mov byte [ecx - 2], bl
ror edx, 8
ror ebx, 8
mov byte [ecx - 7], dl
mov byte [ecx - 3], bl
add ecx, 8
ror edx, 8
ror ebx, 8
sub dword [ebp - 0xa9c], 1
mov dword [ebp - 0xa7c], edi
mov dword [ebp - 0xa80], ecx
jne 0xaf2765
mov ecx, dword [ebp - 0xad0]
xor ebx, ebx
mov edx, ebx
mov esi, 0x1c90
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0xaf2aed
movzx eax, al
cdq
cmp eax, dword [0xa1b020]
jne 0xaf2b1f
cmp edx, dword [0xa1b024]
jne 0xaf2b1f
mov edi, dword [ebp - 0xa74]
mov dword [ebp - 0xbec], ecx
mov ecx, ebx
mov dword [ebp - 0xad4], esi
jmp 0xaf2b2a
mov edi, 0xc004d501
mov dword [ebp - 0xa74], edi
test ecx, ecx
je 0xaf2b33
call fcn.00ad1951
test edi, edi
js 0xaf2d6d
mov edi, dword [ebp - 0xbec]
mov esi, ebx
mov edx, ebx
mov ebx, dword [ebp - 0xa94]
cmp ebx, edx
jne 0xaf2b56
mov dword [ebp + esi*4 - 0x2f8], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0xa98], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xaf2b61
sub ecx, dword [ebp - 0xa98]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0xaf2b4b
inc esi
push 0
pop ebx
cmp esi, 6
jb 0xaf2b43
push 0xc
pop ecx
call fcn.00ad193e
push eax
lea ecx, [ebp - 0xbf8]
call fcn.00ad1916
mov esi, dword [ebp - 0xbf8]
test esi, esi
je 0xaf26fd
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, ebx
movzx ecx, word [ebp + edi*2 - 0xc]
mov eax, ebx
cmp cx, word [eax*2 + 0xa19380]
je 0xaf2bc7
inc eax
cmp eax, 6
jb 0xaf2bb2
jmp 0xaf2c94
mov ecx, dword [0xc93060]
mov edx, dword [ebp + eax*4 - 0x2f8]
mov dword [ebp - 0xa7c], ecx
mov ecx, edx
mov dword [ebp - 0xa78], edx
lea eax, [ecx + 1]
mov dword [ebp - 0xa98], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xaf2beb
sub ecx, dword [ebp - 0xa98]
push ebx
push ebx
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0xa7c]
push eax
push edx
push ebx
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0xa7c]
mov dword [ebp - 0xa80], eax
test eax, eax
je 0xaf2ccf
lea ecx, [eax + eax]
call fcn.00ad193e
mov dword [ebp - 0xa9c], eax
mov dword [esi + edi*4], eax
test eax, eax
je 0xaf2cc8
mov edx, dword [ebp - 0xa78]
mov ecx, edx
mov eax, dword [0xc93060]
mov dword [ebp - 0xa7c], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xa98], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xaf2c5a
push dword [ebp - 0xa80]
sub ecx, dword [ebp - 0xa98]
push dword [ebp - 0xa9c]
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0xa7c]
push eax
push edx
push ebx
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0xa7c]
test eax, eax
je 0xaf2ccf
inc edi
cmp edi, 3
jb 0xaf2bab
mov edi, dword [ebp - 0xa74]
mov eax, esi
mov dword [ebp - 0xa84], eax
mov esi, ebx
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0xbf8], esi
mov dword [ebp - 0x774], eax
jmp 0xaf2cff
mov edi, 0x8007000e
jmp 0xaf2cf9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa74], edi
test edi, edi
jle 0xaf2cf2
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa74], edi
test edi, edi
js 0xaf2cff
mov edi, 0x80004005
mov dword [ebp - 0xa74], edi
test esi, esi
je 0xaf2d6d
mov eax, ebx
mov dword [ebp - 0xa94], ebx
mov edx, dword [esi + eax*4]
test edx, edx
je 0xaf2d59
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0xa98], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xaf2d1d
sub ecx, dword [ebp - 0xa98]
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xaf2d4c
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xaf2d3b
mov edx, dword [ebp - 0xa94]
mov edx, dword [esi + edx*4]
mov ecx, edx
call fcn.00ad1951
mov eax, dword [ebp - 0xa94]
inc eax
mov dword [ebp - 0xa94], eax
cmp eax, 3
jb 0xaf2d0b
jmp 0xaf2d6d
mov edi, dword [ebp - 0xa74]
mov eax, dword [ebp - 0xbec]
test eax, eax
je 0xaf2d89
mov ecx, dword [ebp - 0xad4]
test ecx, ecx
je 0xaf2d89
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xaf2d81
lea ecx, [ebp - 0xbf8]
call fcn.00ad18c0
lea ecx, [ebp - 0xbec]
call fcn.00ad18c0
lea ecx, [ebp - 0xb50]
call fcn.00ad18c0
test edi, edi
js 0xaf397f
mov eax, dword [ebp - 0xa84]
mov edi, ebx
mov esi, dword [0xc930b4]
push ebx
mov dword [ebp - 0xa74], edi
mov ecx, dword [eax]
mov dword [ebp - 0x76c], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x768], ecx
mov ecx, esi
mov eax, dword [eax + 8]
mov dword [ebp - 0x764], eax
lea eax, [ebp - 0xd50]
push eax
push ebx
push 0x42
mov dword [ebp - 0xd4c], ebx
mov dword [ebp - 0xd48], ebx
mov dword [ebp - 0xd50], 0xc
call dword [0xc99200]
call esi
test eax, eax
jne 0xaf2e43
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa74], edi
test edi, edi
jle 0xaf2e32
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa74], edi
test edi, edi
mov eax, ebx
js 0xaf2e4c
mov edi, 0x80004005
mov dword [ebp - 0xa74], edi
jmp 0xaf2e4c
mov eax, dword [ebp - 0xd4c]
and eax, 1
mov dword [ebp - 0x770], eax
test edi, edi
js 0xaf397f
mov eax, dword [ebp - 0xaa0]
push 0x2a
pop ecx
mov dword [ebp - 0xae8], ecx
sub eax, 1
je 0xaf2e97
sub eax, 1
je 0xaf2e8b
sub eax, 1
jne 0xaf2ea7
mov edi, 0xe1
mov dword [ebp - 0xac0], edi
mov dword [ebp - 0xb04], edi
jmp 0xaf2ea7
mov dword [ebp - 0xac0], 0xf
jmp 0xaf2e9d
mov dword [ebp - 0xac0], ecx
mov dword [ebp - 0xb04], 0xb
mov esi, 0xdc
mov dword [ebp - 0xa90], 0x60
push esi
lea eax, [ebp - 0x720]
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov word [ebp - 0x6dc], si
mov esi, dword [0xc93070]
lea eax, [ebp - 0x720]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xaf2f2c
mov eax, dword [ebp - 0x674]
movzx edi, word [ebp - 0x67a]
mov ecx, dword [ebp - 0x670]
push 0x60
mov dword [ebp - 0xa94], eax
mov dword [ebp - 0xdd0], eax
pop eax
mov dword [ebp - 0xa90], edi
mov dword [ebp - 0xa78], ecx
mov dword [ebp - 0xdcc], ecx
cmp edi, eax
jae 0xaf2f44
mov dword [ebp - 0xa90], eax
jmp 0xaf2f44
mov eax, dword [ebp - 0xdcc]
mov dword [ebp - 0xa78], eax
mov eax, dword [ebp - 0xdd0]
mov dword [ebp - 0xa94], eax
xor eax, eax
inc eax
cmp dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0xb00]
je 0xaf2f5b
mov eax, dword [ebp - 0xacc]
push 0x5c
mov dword [ebp - 0xa7c], eax
lea eax, [ebp - 0x56c]
push ebx
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xa74], edi
push 0x403
push ebx
push ebx
call dword [0xc99200]
call esi
mov dword [ebp - 0xa98], eax
test eax, eax
jne 0xaf2fd4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa74], edi
test edi, edi
jle 0xaf2fbf
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa74], edi
test edi, edi
js 0xaf3089
mov dword [ebp - 0xa74], 0x80004005
jmp 0xaf397f
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0xa90]
push dword [ebp - 0xac0]
call dword [0xc99200]
call esi
push dword [ebp - 0xa7c]
neg eax
mov dword [ebp - 0x55c], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x550]
mov dword [ebp - 0x56c], eax
mov byte [ebp - 0x552], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0x56c]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xaf306c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa74], edi
test edi, edi
jle 0xaf305d
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa74], edi
test edi, edi
js 0xaf3072
mov edi, 0x80004005
mov dword [ebp - 0xa74], edi
jmp 0xaf3072
mov dword [ebp - 0x760], eax
push dword [ebp - 0xa98]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
test edi, edi
js 0xaf397f
xor eax, eax
inc eax
cmp dword [ebp - 0xaa0], eax
je 0xaf30a8
mov eax, dword [ebp - 0xacc]
mov dword [ebp - 0xb00], eax
push 0x5c
lea eax, [ebp - 0x5c8]
push ebx
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xa74], edi
push 0x403
push ebx
push ebx
call dword [0xc99200]
call esi
mov dword [ebp - 0xa98], eax
test eax, eax
jne 0xaf3111
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa74], edi
test edi, edi
jle 0xaf3106
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa74], edi
test edi, edi
js 0xaf31c6
jmp 0xaf2fc5
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0xa90]
push dword [ebp - 0xb04]
call dword [0xc99200]
call esi
push dword [ebp - 0xb00]
neg eax
mov dword [ebp - 0x5b8], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x5ac]
mov dword [ebp - 0x5c8], eax
mov byte [ebp - 0x5ae], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0x5c8]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xaf31a9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa74], edi
test edi, edi
jle 0xaf319a
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa74], edi
test edi, edi
js 0xaf31af
mov edi, 0x80004005
mov dword [ebp - 0xa74], edi
jmp 0xaf31af
mov dword [ebp - 0x75c], eax
push dword [ebp - 0xa98]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
test edi, edi
js 0xaf397f
mov esi, dword [ebp - 0xaa0]
mov ecx, ebx
mov eax, esi
mov edx, ebx
sub eax, 1
je 0xaf31e9
sub eax, 1
je 0xaf3227
sub eax, 1
jne 0xaf31f5
mov ecx, dword [ebp - 0xa94]
mov edx, dword [ebp - 0xa78]
mov dword [ebp - 0x34c], ecx
mov dword [ebp - 0x348], edx
xor edx, edx
inc edx
cmp esi, edx
je 0xaf3267
lea eax, [esi - 2]
cmp eax, edx
ja 0xaf323b
mov edx, ebx
mov dword [ebp - 0xae8], ebx
mov eax, ebx
mov dword [ebp - 0xac0], edx
mov dword [ebp - 0xb04], ebx
jmp 0xaf327e
mov eax, dword [ebp - 0xa94]
cdq
and edx, 3
lea ecx, [edx + eax]
mov edx, ebx
sar ecx, 2
jmp 0xaf31f5
mov eax, dword [ebp - 0xbc0]
mov edx, dword [ebp - 0xbc0]
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xac0], edx
jmp 0xaf327e
mov eax, 0x96
mov dword [ebp - 0xac0], ebx
mov edx, ebx
mov dword [ebp - 0xb04], 0x20
mov dword [ebp - 0xb00], eax
push dword [ebp - 0x760]
mov esi, dword [0xc9303c]
sub ecx, eax
push dword [ebp - 0xabc]
mov edi, dword [ebp - 0x76c]
sub ecx, edx
mov dword [ebp - 0xaf4], ecx
mov dword [ebp - 0x738], ecx
mov dword [ebp - 0x748], ecx
mov ecx, esi
mov dword [ebp - 0xa74], ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0xa98], eax
lea eax, [ebp - 0x750]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xabc]
call dword [0xc99200]
call esi
test eax, eax
jne 0xaf32ff
mov edi, 0x80004005
mov dword [ebp - 0xa74], edi
jmp 0xaf3301
mov edi, ebx
mov eax, dword [ebp - 0xa98]
test eax, eax
je 0xaf3322
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push dword [ebp - 0xabc]
call dword [0xc99200]
call esi
test edi, edi
js 0xaf397f
push dword [ebp - 0x75c]
mov esi, dword [0xc9303c]
mov ecx, esi
push dword [ebp - 0xabc]
mov edi, dword [ebp - 0x768]
mov dword [ebp - 0xa74], ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0xa98], eax
lea eax, [ebp - 0x740]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xabc]
call dword [0xc99200]
call esi
test eax, eax
jne 0xaf338f
mov edi, 0x80004005
mov dword [ebp - 0xa74], edi
jmp 0xaf3391
mov edi, ebx
mov eax, dword [ebp - 0xa98]
test eax, eax
je 0xaf33b2
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push dword [ebp - 0xabc]
call dword [0xc99200]
call esi
test edi, edi
js 0xaf397f
mov eax, dword [ebp - 0xaa0]
cmp eax, 2
je 0xaf33ca
cmp eax, 3
jne 0xaf33ec
mov edi, dword [ebp - 0x738]
mov dword [ebp - 0xaf4], edi
cmp dword [ebp - 0x748], edi
jle 0xaf33f2
mov edi, dword [ebp - 0x748]
mov dword [ebp - 0xaf4], edi
jmp 0xaf33f2
mov edi, dword [ebp - 0xaf4]
cmp dword [ebp - 0x774], 0
mov esi, dword [0xc930a8]
mov ecx, esi
push dword [ebp - 0xae8]
je 0xaf3445
mov eax, edi
sub eax, dword [ebp - 0x748]
add eax, dword [ebp - 0xac0]
push eax
lea eax, [ebp - 0x750]
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x744]
add eax, dword [ebp - 0xb04]
push eax
mov eax, edi
sub eax, dword [ebp - 0x738]
add eax, dword [ebp - 0xac0]
push eax
jmp 0xaf346d
push dword [ebp - 0xb00]
lea eax, [ebp - 0x750]
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x744]
add eax, dword [ebp - 0xb04]
push eax
push dword [ebp - 0xb00]
mov esi, dword [0xc930a8]
lea eax, [ebp - 0x740]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xaa0]
cmp eax, 2
je 0xaf377a
cmp eax, 3
je 0xaf377a
xor edx, edx
inc edx
cmp eax, edx
jne 0xaf3799
push 0x5c
lea eax, [ebp - 0x624]
mov dword [ebp - 0x754], 0xffffff
push ebx
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xa74], edi
push 0x403
push ebx
push ebx
call dword [0xc99200]
call esi
mov dword [ebp - 0xa98], eax
test eax, eax
jne 0xaf351a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa74], edi
test edi, edi
jle 0xaf350f
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa74], edi
test edi, edi
js 0xaf35cb
jmp 0xaf2fc5
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0xa90]
push 0xb
call dword [0xc99200]
call esi
push dword [ebp - 0xb20]
neg eax
mov dword [ebp - 0x614], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x608]
mov dword [ebp - 0x624], eax
mov byte [ebp - 0x60a], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0x624]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xaf35ae
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa74], edi
test edi, edi
jle 0xaf359f
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa74], edi
test edi, edi
js 0xaf35b4
mov edi, 0x80004005
mov dword [ebp - 0xa74], edi
jmp 0xaf35b4
mov dword [ebp - 0x758], eax
push dword [ebp - 0xa98]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
test edi, edi
js 0xaf397f
push dword [ebp - 0x758]
mov eax, dword [ebp - 0xaf4]
mov esi, dword [0xc9303c]
mov ecx, esi
push dword [ebp - 0xabc]
mov edi, dword [ebp - 0x764]
mov dword [ebp - 0x728], eax
mov dword [ebp - 0xa74], ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
push ebx
push 0x460
mov dword [ebp - 0xa98], eax
lea eax, [ebp - 0x730]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xabc]
call dword [0xc99200]
call esi
test eax, eax
jne 0xaf3644
mov edi, 0x80004005
mov dword [ebp - 0xa74], edi
jmp 0xaf3646
mov edi, ebx
mov eax, dword [ebp - 0xa98]
test eax, eax
je 0xaf3667
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push dword [ebp - 0xabc]
call dword [0xc99200]
call esi
test edi, edi
js 0xaf397f
mov eax, dword [ebp - 0x728]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x728], eax
cmp eax, ecx
jge 0xaf368b
mov dword [ebp - 0x728], ecx
mov edi, dword [ebp - 0xa90]
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x730]
mov dword [ebp - 0x724], 0x20
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x72c]
mov dword [ebp - 0x730], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x728]
mov dword [ebp - 0x72c], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x724]
mov dword [ebp - 0x728], eax
call dword [0xc99200]
call esi
mov ecx, dword [ebp - 0x734]
mov esi, dword [0xc930a8]
add ecx, 0x24
cmp dword [ebp - 0x774], 0
mov dword [ebp - 0x724], eax
je 0xaf3758
mov eax, dword [ebp - 0x750]
cmp eax, dword [ebp - 0x740]
jl 0xaf3743
mov eax, dword [ebp - 0x740]
push ecx
push eax
lea eax, [ebp - 0x730]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
jmp 0xaf3796
mov eax, dword [ebp - 0x748]
cmp eax, dword [ebp - 0x738]
jg 0xaf376c
mov eax, dword [ebp - 0x738]
sub eax, dword [ebp - 0x728]
add eax, dword [ebp - 0x730]
jmp 0xaf3743
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0x34c], edi
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x754], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0xa98], eax
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0xa78], eax
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebp - 0xaa0]
sub eax, 1
je 0xaf396d
sub eax, 1
je 0xaf3894
sub eax, 1
jne 0xaf3979
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x510]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x510]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x510], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xaf3979
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x4fc]
push eax
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x4f4]
push eax
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x4f4]
lea esi, [ebp - 0x4fc]
sub eax, dword [ebp - 0xa7c]
lea edi, [ebp - 0xe68]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x4f0]
sub eax, dword [ebp - 0xa78]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
jmp 0xaf3962
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x4c8]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x4c8]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x4c8], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xaf3979
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x4b4]
push eax
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x4ac]
push eax
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
cmp dword [ebp - 0xa98], 0
lea esi, [ebp - 0x4b4]
lea edi, [ebp - 0xe68]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xaf393b
imul eax, dword [ebp - 0x4ac], 5
cdq
idiv ecx
add eax, dword [ebp - 0x4b4]
jmp 0xaf394d
mov eax, dword [ebp - 0x4ac]
sub eax, dword [ebp - 0xa7c]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x4a8]
sub eax, dword [ebp - 0xa78]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x350], eax
jmp 0xaf3979
mov dword [ebp - 0x354], ebx
mov dword [ebp - 0x350], ebx
mov dword [ebp - 0xa74], ebx
push dword [ebp - 0xabc]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
xor esi, esi
mov edi, 0xc96238
inc esi
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xaf399e
mov eax, dword [0xc95890]
test eax, eax
jle 0xaf39ff
sub eax, 1
mov dword [0xc95890], eax
jne 0xaf39ff
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xaf39d0
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xaf39bf
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0xc96238
inc esi
xor eax, eax
xchg dword [edi], eax
lea ecx, [ebp - 0xafc]
call fcn.00ad18c0
cmp dword [ebp - 0xa74], 0
jl 0xaf55e3
mov eax, dword [ebp - 0x350]
mov edi, dword [ebp - 0x354]
push 0x54
mov dword [ebp - 0xa7c], eax
mov dword [ebp - 0xcd4], eax
lea eax, [ebp - 0x7c8]
push ebx
push eax
mov dword [ebp - 0xcd8], edi
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0xa78], esi
mov esi, dword [0xc93028]
mov ecx, esi
push 7
push dword [ebp - 0xab8]
call dword [0xc99200]
call esi
test eax, eax
je 0xaf3ab2
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x7c8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xaf3ab2
push 0x20
pop eax
cmp word [ebp - 0x7b6], ax
jne 0xaf3ab2
cmp dword [ebp - 0x7b4], 0
je 0xaf3ab2
cmp dword [ebp - 0x7c4], 0
jle 0xaf3ab2
cmp dword [ebp - 0x7c0], 0
jg 0xaf3ac1
cmp dword [ebp - 0xaa0], 1
mov dword [ebp - 0xa78], ebx
jne 0xaf3b35
push dword [ebp - 0xa7c]
mov esi, dword [0xc930a8]
lea eax, [ebp - 0x750]
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
push dword [ebp - 0xa7c]
mov esi, dword [0xc930a8]
lea eax, [ebp - 0x740]
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov edi, dword [ebp - 0xaa0]
cmp edi, 1
jne 0xaf3b3b
mov eax, dword [ebp - 0x770]
mov esi, dword [0xc93014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0xb88], eax
jmp 0xaf3b3b
mov edi, dword [ebp - 0xaa0]
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push dword [ebp - 0xab8]
call dword [0xc99200]
call esi
cmp dword [ebp - 0x774], 0
mov dword [ebp - 0xb64], eax
mov dword [ebp - 0xa6c], 0x810
je 0xaf3b76
mov dword [ebp - 0xa6c], 0x20812
cmp dword [ebp - 0xa78], 0
je 0xaf469f
mov eax, dword [ebp - 0x770]
mov esi, dword [ebp - 0x76c]
mov dword [ebp - 0xa9c], eax
mov eax, dword [ebp - 0x760]
push 0x54
mov dword [ebp - 0xa98], eax
lea eax, [ebp - 0x8c4]
push ebx
push eax
mov dword [ebp - 0xa7c], esi
call fcn.00ab4bf6
push 0x54
lea eax, [ebp - 0xa68]
push ebx
push eax
call fcn.00ab4bf6
push 0x2c
lea eax, [ebp - 0x438]
mov dword [ebp - 0xa80], ebx
push ebx
push eax
mov dword [ebp - 0xa78], ebx
mov dword [ebp - 0xa94], ebx
mov dword [ebp - 0xa84], ebx
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x394]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0xaf55c3
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [ebp - 0xab8]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xaf4731
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x8c4]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xaf3c66
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0xa94], eax
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0xa84], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0xab4], edi
test edi, edi
je 0xaf4731
mov eax, dword [ebp - 0x748]
sub eax, dword [ebp - 0x750]
mov esi, dword [0xc9300c]
mov ecx, esi
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x74c]
sub eax, dword [ebp - 0x744]
mov dword [ebp - 0x430], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xcf8], ebx
mov word [ebp - 0x42c], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x42a], ax
lea eax, [ebp - 0xcf8]
push eax
push ebx
lea eax, [ebp - 0x438]
mov dword [ebp - 0xac0], ebx
push eax
push edi
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x410], ebx
mov dword [ebp - 0x438], 0x28
call dword [0xc99200]
call esi
mov dword [ebp - 0xad4], eax
test eax, eax
jne 0xaf3d60
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xac0], eax
test eax, eax
jle 0xaf3d4b
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xac0], eax
test eax, eax
js 0xaf40f0
mov dword [ebp - 0xac0], 0x80004005
jmp 0xaf40f0
mov esi, dword [0xc93034]
lea ecx, [ebp - 0xa68]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xaf3d8a
mov eax, dword [ebp - 0xa54]
mov dword [ebp - 0xa78], eax
mov eax, dword [ebp - 0x748]
sub eax, dword [ebp - 0x750]
push dword [ebp - 0xad4]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x744]
sub eax, dword [ebp - 0x74c]
push edi
mov dword [ebp - 0x388], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0xa98]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
push ebx
mov dword [ebp - 0xb10], eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x394]
mov ecx, edi
push eax
push dword [ebp - 0xab4]
call dword [0xc99200]
call edi
mov edi, dword [ebp - 0xab4]
lea eax, [ebp - 0x394]
mov esi, dword [0xc9306c]
mov ecx, esi
push ebx
push dword [ebp - 0xa6c]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xa7c]
push edi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xaa0], eax
jne 0xaf3e8d
cmp dword [ebp - 0xa9c], 0
je 0xaf3e81
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0xa90], eax
jmp 0xaf3e97
mov dword [ebp - 0xa90], 0xffffff
jmp 0xaf3e97
mov dword [ebp - 0xa90], 0xffa8a8a8
mov esi, dword [ebp - 0x750]
mov edx, ebx
mov eax, dword [ebp - 0x74c]
mov ecx, ebx
mov dword [ebp - 0xacc], esi
mov dword [ebp - 0xa7c], ebx
test esi, esi
jns 0xaf3ec7
mov edx, esi
mov dword [ebp - 0xacc], ebx
neg edx
mov dword [ebp - 0xa7c], edx
test eax, eax
jns 0xaf3ed1
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x38c]
sub esi, edx
mov edx, dword [ebp - 0xa94]
sub edx, dword [ebp - 0xacc]
mov dword [ebp - 0xaa8], esi
cmp esi, edx
jl 0xaf3ef7
mov esi, edx
mov dword [ebp - 0xaa8], edx
mov edx, dword [ebp - 0x388]
sub dword [ebp - 0xa84], eax
sub edx, ecx
mov dword [ebp - 0xad0], edx
cmp edx, dword [ebp - 0xa84]
jl 0xaf3f1f
mov edx, dword [ebp - 0xa84]
mov dword [ebp - 0xad0], edx
test esi, esi
jle 0xaf40be
test edx, edx
jle 0xaf40be
mov edx, dword [ebp - 0x38c]
imul eax, dword [ebp - 0xa94]
mov edi, dword [ebp - 0xa78]
imul ecx, edx
shl edx, 2
mov dword [ebp - 0xa98], edx
add eax, dword [ebp - 0xacc]
mov edx, dword [ebp - 0xa94]
add ecx, dword [ebp - 0xa7c]
shl edx, 2
mov dword [ebp - 0xb20], edx
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0xa80]
mov dword [ebp - 0xa9c], ecx
lea eax, [edi + eax*4]
mov dword [ebp - 0xa80], eax
mov ebx, eax
mov dword [ebp - 0xa78], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xa84], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xa7c], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xaf4063
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xa90]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa7c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xa84]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xa90]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xa8e]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xa78]
cdq
idiv ecx
mov edx, dword [ebp - 0xa84]
add al, bl
mov ebx, dword [ebp - 0xa7c]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0xa84], edx
mov dword [ebp - 0xa78], esi
jne 0xaf3f9d
mov ecx, dword [ebp - 0xa9c]
mov eax, dword [ebp - 0xa80]
add ecx, dword [ebp - 0xa98]
add eax, dword [ebp - 0xb20]
sub dword [ebp - 0xad0], 1
mov esi, dword [ebp - 0xaa8]
mov dword [ebp - 0xa9c], ecx
mov dword [ebp - 0xa80], eax
jne 0xaf3f81
mov edi, dword [ebp - 0xab4]
xor ebx, ebx
push dword [ebp - 0xad4]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xb10]
test eax, eax
je 0xaf40f0
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0xac0], 0
jl 0xaf55c3
mov eax, dword [ebp - 0x770]
mov esi, dword [ebp - 0x768]
mov dword [ebp - 0xa9c], eax
mov eax, dword [ebp - 0x75c]
push 0x54
mov dword [ebp - 0xa98], eax
lea eax, [ebp - 0x870]
push ebx
push eax
mov dword [ebp - 0xa7c], esi
call fcn.00ab4bf6
push 0x54
lea eax, [ebp - 0xa14]
push ebx
push eax
call fcn.00ab4bf6
push 0x2c
lea eax, [ebp - 0x3e0]
mov dword [ebp - 0xa80], ebx
push ebx
push eax
mov dword [ebp - 0xa78], ebx
mov dword [ebp - 0xa94], ebx
mov dword [ebp - 0xa84], ebx
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x384]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0xaf55c3
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [ebp - 0xab8]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xaf4731
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x870]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xaf41f1
mov eax, dword [ebp - 0x85c]
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0xa94], eax
mov eax, dword [ebp - 0x868]
mov dword [ebp - 0xa84], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0xb10], edi
test edi, edi
je 0xaf4731
mov eax, dword [ebp - 0x738]
sub eax, dword [ebp - 0x740]
mov esi, dword [0xc9300c]
mov ecx, esi
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x73c]
sub eax, dword [ebp - 0x734]
mov dword [ebp - 0x3d8], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xcfc], ebx
mov word [ebp - 0x3d4], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x3d2], ax
lea eax, [ebp - 0xcfc]
push eax
push ebx
lea eax, [ebp - 0x3e0]
mov dword [ebp - 0xac0], ebx
push eax
push edi
mov dword [ebp - 0x3d0], ebx
mov dword [ebp - 0x3cc], ebx
mov dword [ebp - 0x3c8], ebx
mov dword [ebp - 0x3c4], ebx
mov dword [ebp - 0x3c0], ebx
mov dword [ebp - 0x3bc], ebx
mov dword [ebp - 0x3b8], ebx
mov dword [ebp - 0x3e0], 0x28
call dword [0xc99200]
call esi
mov dword [ebp - 0xad4], eax
test eax, eax
jne 0xaf42eb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xac0], eax
test eax, eax
jle 0xaf42d6
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xac0], eax
test eax, eax
js 0xaf467c
mov dword [ebp - 0xac0], 0x80004005
jmp 0xaf467c
mov esi, dword [0xc93034]
lea ecx, [ebp - 0xa14]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xaf4315
mov eax, dword [ebp - 0xa00]
mov dword [ebp - 0xa78], eax
mov eax, dword [ebp - 0x738]
sub eax, dword [ebp - 0x740]
push dword [ebp - 0xad4]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x734]
sub eax, dword [ebp - 0x73c]
push edi
mov dword [ebp - 0x378], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0xa98]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
push ebx
mov dword [ebp - 0xab0], eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x384]
mov ecx, edi
push eax
push dword [ebp - 0xb10]
call dword [0xc99200]
call edi
mov edi, dword [ebp - 0xb10]
lea eax, [ebp - 0x384]
mov esi, dword [0xc9306c]
mov ecx, esi
push ebx
push dword [ebp - 0xa6c]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xa7c]
push edi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xaa0], eax
jne 0xaf4412
cmp dword [ebp - 0xa9c], 0
je 0xaf4406
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
jmp 0xaf4417
mov dword [ebp - 0xad0], 0xffffff
jmp 0xaf4423
mov eax, 0xffa8a8a8
mov dword [ebp - 0xad0], eax
mov dword [ebp - 0xa88], eax
mov esi, dword [ebp - 0x740]
mov edx, ebx
mov eax, dword [ebp - 0x73c]
mov ecx, ebx
mov dword [ebp - 0xacc], esi
mov dword [ebp - 0xa7c], ebx
test esi, esi
jns 0xaf4453
mov edx, esi
mov dword [ebp - 0xacc], ebx
neg edx
mov dword [ebp - 0xa7c], edx
test eax, eax
jns 0xaf445d
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x37c]
sub esi, edx
mov edx, dword [ebp - 0xa94]
sub edx, dword [ebp - 0xacc]
mov dword [ebp - 0xaa8], esi
cmp esi, edx
jl 0xaf4483
mov esi, edx
mov dword [ebp - 0xaa8], edx
mov edx, dword [ebp - 0x378]
sub dword [ebp - 0xa84], eax
sub edx, ecx
mov dword [ebp - 0xab4], edx
cmp edx, dword [ebp - 0xa84]
jl 0xaf44ab
mov edx, dword [ebp - 0xa84]
mov dword [ebp - 0xab4], edx
test esi, esi
jle 0xaf464a
test edx, edx
jle 0xaf464a
mov edx, dword [ebp - 0x37c]
imul eax, dword [ebp - 0xa94]
mov edi, dword [ebp - 0xa78]
imul ecx, edx
shl edx, 2
mov dword [ebp - 0xa98], edx
add eax, dword [ebp - 0xacc]
mov edx, dword [ebp - 0xa94]
add ecx, dword [ebp - 0xa7c]
shl edx, 2
mov dword [ebp - 0xb20], edx
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0xa80]
mov dword [ebp - 0xa9c], ecx
lea eax, [edi + eax*4]
mov dword [ebp - 0xa80], eax
mov ebx, eax
mov dword [ebp - 0xa78], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xa84], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xa7c], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xaf45ef
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xa88]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa7c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xa84]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xa88]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xace]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xa78]
cdq
idiv ecx
mov edx, dword [ebp - 0xa84]
add al, bl
mov ebx, dword [ebp - 0xa7c]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0xa84], edx
mov dword [ebp - 0xa78], esi
jne 0xaf4529
mov ecx, dword [ebp - 0xa9c]
mov eax, dword [ebp - 0xa80]
add ecx, dword [ebp - 0xa98]
add eax, dword [ebp - 0xb20]
sub dword [ebp - 0xab4], 1
mov esi, dword [ebp - 0xaa8]
mov dword [ebp - 0xa9c], ecx
mov dword [ebp - 0xa80], eax
jne 0xaf450d
mov edi, dword [ebp - 0xb10]
xor ebx, ebx
push dword [ebp - 0xad4]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xab0]
test eax, eax
je 0xaf467c
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0xac0], 0
jl 0xaf55c3
jmp 0xaf5571
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x770], 0
jne 0xaf46b3
cmp edi, ecx
je 0xaf46b3
mov al, 0xc0
jmp 0xaf46b5
or al, 0xff
mov esi, dword [0xc93008]
push dword [ebp - 0xab8]
mov byte [ebp - 0xaf2], al
mov eax, ebx
mov byte [ebp - 0xaf1], cl
mov ecx, esi
mov byte [ebp - 0xaf4], bl
mov byte [ebp - 0xaf3], bl
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xc54], eax
mov dword [ebp - 0xb04], ebx
mov dword [ebp - 0xc50], eax
mov dword [ebp - 0xc4c], ebx
mov dword [ebp - 0xc48], ebx
mov dword [ebp - 0xaa4], ebx
mov dword [ebp - 0xc2c], eax
mov dword [ebp - 0xc28], ebx
mov dword [ebp - 0xc24], ebx
mov dword [ebp - 0xc20], ebx
call dword [0xc99200]
call esi
mov dword [ebp - 0xaf8], eax
test eax, eax
jne 0xaf473c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xaf55c3
xor eax, eax
inc eax
cmp edi, eax
jne 0xaf4845
mov eax, dword [ebp - 0x748]
mov edx, dword [ebp - 0x738]
sub edx, dword [ebp - 0x740]
sub eax, dword [ebp - 0x750]
mov dword [ebp - 0xa74], edx
cmp edx, eax
jg 0xaf4771
mov edx, eax
mov dword [ebp - 0xa74], eax
mov eax, dword [ebp - 0x734]
mov edi, ebx
sub eax, dword [ebp - 0x74c]
mov ecx, ebx
cmp dword [ebp - 0x774], 0
mov dword [ebp - 0xab0], eax
je 0xaf47c8
mov ecx, dword [ebp - 0x750]
sub ecx, dword [ebp - 0x748]
mov eax, dword [ebp - 0x740]
add ecx, edx
sub eax, dword [ebp - 0x738]
mov edi, ecx
add eax, edx
mov dword [ebp - 0xac0], ecx
mov dword [ebp - 0xc54], ecx
mov ecx, eax
mov dword [ebp - 0xaa4], eax
mov dword [ebp - 0xc2c], eax
sub edi, dword [ebp - 0x750]
add edi, dword [ebp - 0x748]
sub ecx, dword [ebp - 0x740]
mov eax, dword [ebp - 0x744]
sub eax, dword [ebp - 0x74c]
add ecx, dword [ebp - 0x738]
mov dword [ebp - 0xa7c], edi
mov dword [ebp - 0xc4c], edi
mov edi, dword [ebp - 0x73c]
sub edi, dword [ebp - 0x74c]
mov dword [ebp - 0xab4], edi
mov dword [ebp - 0xc28], edi
sub edi, dword [ebp - 0x73c]
add edi, dword [ebp - 0x734]
mov dword [ebp - 0xa94], eax
mov dword [ebp - 0xc48], eax
mov dword [ebp - 0xae8], ecx
mov dword [ebp - 0xc24], ecx
mov dword [ebp - 0xad0], edi
mov dword [ebp - 0xc20], edi
jmp 0xaf48dd
mov eax, dword [ebp - 0x348]
lea esi, [ebp - 0x750]
lea edi, [ebp - 0xc54]
mov edx, dword [ebp - 0x34c]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xa74], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xc48]
lea esi, [ebp - 0x740]
lea edi, [ebp - 0xc2c]
mov dword [ebp - 0xa94], eax
mov eax, dword [ebp - 0xc4c]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebp - 0xc50]
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp - 0xc54]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xac0], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0xc24]
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0xc28]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xc2c]
mov dword [ebp - 0xaa4], eax
mov edi, dword [ebp - 0xab0]
mov eax, edi
mov esi, dword [0xc9300c]
neg eax
mov dword [ebp - 0x404], eax
mov ecx, esi
xor eax, eax
mov dword [ebp - 0xd00], ebx
push 0x20
inc eax
mov dword [ebp - 0x3fc], ebx
mov word [ebp - 0x400], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x3fe], ax
lea eax, [ebp - 0xd00]
push eax
push ebx
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x3f8], ebx
push eax
push dword [ebp - 0xaf8]
mov dword [ebp - 0x3f4], ebx
mov dword [ebp - 0x3f0], ebx
mov dword [ebp - 0x3ec], ebx
mov dword [ebp - 0x3e8], ebx
mov dword [ebp - 0x3e4], ebx
mov dword [ebp - 0x40c], 0x28
mov dword [ebp - 0x408], edx
call dword [0xc99200]
call esi
mov dword [ebp - 0xb14], eax
test eax, eax
jne 0xaf497d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xaf55a8
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push dword [ebp - 0xaf8]
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xaa0], eax
jne 0xaf49e5
mov ecx, dword [ebp - 0xb88]
test ecx, ecx
je 0xaf49e5
mov eax, dword [ebp - 0xa74]
mov esi, dword [0xc93074]
push ecx
mov dword [ebp - 0x498], eax
mov ecx, esi
lea eax, [ebp - 0x4a0]
mov dword [ebp - 0x4a0], ebx
push eax
push dword [ebp - 0xaf8]
mov dword [ebp - 0x49c], ebx
mov dword [ebp - 0x494], edi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x770]
mov esi, dword [ebp - 0x76c]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0x760]
push 0x54
mov dword [ebp - 0xa98], eax
lea eax, [ebp - 0x81c]
push ebx
push eax
mov dword [ebp - 0xa9c], esi
call fcn.00ab4bf6
push 0x54
lea eax, [ebp - 0x9c0]
push ebx
push eax
call fcn.00ab4bf6
push 0x2c
lea eax, [ebp - 0x464]
mov dword [ebp - 0xa80], ebx
push ebx
push eax
mov dword [ebp - 0xa78], ebx
mov dword [ebp - 0xacc], ebx
mov dword [ebp - 0xa84], ebx
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x374]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0xaf558d
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [ebp - 0xaf8]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xaf4a8d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xaf558d
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x81c]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xaf4acf
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0xa84], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0xa90], ecx
test ecx, ecx
je 0xaf4a82
mov eax, dword [ebp - 0xb04]
sub eax, dword [ebp - 0xa94]
mov edi, dword [ebp - 0xa7c]
sub edi, dword [ebp - 0xac0]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x45c], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xd04], ebx
mov word [ebp - 0x458], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x456], ax
lea eax, [ebp - 0xd04]
push eax
push ebx
lea eax, [ebp - 0x464]
mov dword [ebp - 0xb00], ebx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x450], ebx
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x448], ebx
mov dword [ebp - 0x444], ebx
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x464], 0x28
mov dword [ebp - 0x460], edi
call dword [0xc99200]
call esi
mov dword [ebp - 0xad4], eax
test eax, eax
jne 0xaf4bcb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xb00], eax
test eax, eax
jle 0xaf4bb0
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb00], eax
test eax, eax
mov edi, dword [ebp - 0xa90]
js 0xaf4f42
mov dword [ebp - 0xb00], 0x80004005
jmp 0xaf4f42
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x9c0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xaf4bf5
mov eax, dword [ebp - 0x9ac]
mov dword [ebp - 0xa78], eax
push dword [ebp - 0xad4]
mov eax, dword [ebp - 0xa94]
sub eax, dword [ebp - 0xb04]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x36c], edi
mov edi, dword [ebp - 0xa90]
push edi
mov dword [ebp - 0x368], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0xa98]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
push ebx
mov dword [ebp - 0xb10], eax
call dword [0xc99200]
call esi
mov esi, dword [ebp - 0xa90]
mov ecx, edi
push eax
lea eax, [ebp - 0x374]
push eax
push esi
call dword [0xc99200]
call edi
push ebx
push dword [ebp - 0xa6c]
lea eax, [ebp - 0x374]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xa9c]
push esi
mov esi, dword [0xc9306c]
mov ecx, esi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xaa0], eax
jne 0xaf4ced
cmp dword [ebp - 0xaa8], 0
je 0xaf4ce1
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0xabc], eax
jmp 0xaf4cf7
mov dword [ebp - 0xabc], 0xffffff
jmp 0xaf4cf7
mov dword [ebp - 0xabc], 0xffa8a8a8
mov edx, dword [ebp - 0xac0]
mov esi, ebx
mov dword [ebp - 0xa7c], ebx
mov ecx, ebx
test edx, edx
jns 0xaf4d17
mov esi, edx
mov edx, ebx
neg esi
mov dword [ebp - 0xa7c], esi
mov eax, dword [ebp - 0xb04]
test eax, eax
jns 0xaf4d27
mov ecx, eax
mov eax, ebx
neg ecx
mov edi, dword [ebp - 0x36c]
sub edi, esi
mov esi, dword [ebp - 0xacc]
sub esi, edx
mov dword [ebp - 0xa9c], edi
cmp edi, esi
jl 0xaf4d49
mov edi, esi
mov dword [ebp - 0xa9c], esi
mov esi, dword [ebp - 0x368]
sub dword [ebp - 0xa84], eax
sub esi, ecx
mov dword [ebp - 0xa94], esi
cmp esi, dword [ebp - 0xa84]
jl 0xaf4d71
mov esi, dword [ebp - 0xa84]
mov dword [ebp - 0xa94], esi
test edi, edi
jle 0xaf4f0a
test esi, esi
jle 0xaf4f0a
imul eax, dword [ebp - 0xacc]
imul ecx, dword [ebp - 0x36c]
mov esi, dword [ebp - 0xa78]
add eax, edx
mov edx, dword [ebp - 0xa80]
add ecx, dword [ebp - 0xa7c]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0x36c]
shl edx, 2
lea ecx, [esi + ecx*4]
mov dword [ebp - 0xa98], edx
mov edx, dword [ebp - 0xacc]
shl edx, 2
mov dword [ebp - 0xaa8], ecx
mov dword [ebp - 0xa80], eax
mov dword [ebp - 0xb20], edx
mov esi, dword [ebp - 0xa9c]
lea edx, [eax + 3]
mov ebx, eax
mov dword [ebp - 0xa84], edx
sub ebx, ecx
mov dword [ebp - 0xa78], esi
lea edi, [ecx + 2]
mov dword [ebp - 0xa7c], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xaf4ebb
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xabc]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa7c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xa84]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xabc]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xaba]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xa78]
cdq
idiv ecx
mov edx, dword [ebp - 0xa84]
add al, bl
mov ebx, dword [ebp - 0xa7c]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0xa84], edx
mov dword [ebp - 0xa78], esi
jne 0xaf4df5
mov ecx, dword [ebp - 0xaa8]
mov eax, dword [ebp - 0xa80]
add ecx, dword [ebp - 0xa98]
add eax, dword [ebp - 0xb20]
sub dword [ebp - 0xa94], 1
mov dword [ebp - 0xaa8], ecx
mov dword [ebp - 0xa80], eax
jne 0xaf4dd3
xor ebx, ebx
push dword [ebp - 0xad4]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xb10]
mov edi, dword [ebp - 0xa90]
test eax, eax
je 0xaf4f42
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0xb00], 0
jl 0xaf558d
mov eax, dword [ebp - 0x770]
mov esi, dword [ebp - 0x768]
mov dword [ebp - 0xa9c], eax
mov eax, dword [ebp - 0x75c]
push 0x54
mov dword [ebp - 0xa98], eax
lea eax, [ebp - 0x918]
push ebx
push eax
mov dword [ebp - 0xa80], esi
call fcn.00ab4bf6
push 0x54
lea eax, [ebp - 0x96c]
push ebx
push eax
call fcn.00ab4bf6
push 0x2c
lea eax, [ebp - 0x490]
mov dword [ebp - 0xa78], ebx
push ebx
push eax
mov dword [ebp - 0xa7c], ebx
mov dword [ebp - 0xa94], ebx
mov dword [ebp - 0xa84], ebx
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x364]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0xaf558d
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [ebp - 0xaf8]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xaf4a82
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x918]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xaf5043
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0xa78], eax
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0xa94], eax
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0xa84], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0xa90], ecx
test ecx, ecx
je 0xaf4a82
mov eax, dword [ebp - 0xae8]
sub eax, dword [ebp - 0xaa4]
mov edi, dword [ebp - 0xab4]
mov esi, dword [0xc9300c]
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0x48c], eax
mov eax, edi
sub eax, dword [ebp - 0xad0]
mov dword [ebp - 0x488], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xd08], ebx
mov word [ebp - 0x484], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x482], ax
lea eax, [ebp - 0xd08]
push eax
push ebx
lea eax, [ebp - 0x490]
mov dword [ebp - 0xac0], ebx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x480], ebx
mov dword [ebp - 0x47c], ebx
mov dword [ebp - 0x478], ebx
mov dword [ebp - 0x474], ebx
mov dword [ebp - 0x470], ebx
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x468], ebx
mov dword [ebp - 0x490], 0x28
call dword [0xc99200]
call esi
mov dword [ebp - 0xad4], eax
test eax, eax
jne 0xaf514b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xac0], eax
test eax, eax
jle 0xaf5130
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xac0], eax
test eax, eax
mov edi, dword [ebp - 0xa90]
js 0xaf54cb
mov dword [ebp - 0xac0], 0x80004005
jmp 0xaf54cb
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x96c]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xaf5175
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebp - 0xae8]
push dword [ebp - 0xad4]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0xad0]
sub eax, edi
mov edi, dword [ebp - 0xa90]
push edi
mov dword [ebp - 0x358], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0xa98]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
push ebx
mov dword [ebp - 0xb10], eax
call dword [0xc99200]
call esi
mov esi, dword [ebp - 0xa90]
mov ecx, edi
push eax
lea eax, [ebp - 0x364]
push eax
push esi
call dword [0xc99200]
call edi
push ebx
push dword [ebp - 0xa6c]
lea eax, [ebp - 0x364]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xa80]
push esi
mov esi, dword [0xc9306c]
mov ecx, esi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xaa0], eax
jne 0xaf5277
cmp dword [ebp - 0xa9c], 0
je 0xaf526b
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0xa88], ecx
mov dword [ebp - 0xacc], ecx
jmp 0xaf5288
mov dword [ebp - 0xacc], 0xffffff
jmp 0xaf5288
mov eax, 0xffa8a8a8
mov dword [ebp - 0xa88], eax
mov dword [ebp - 0xacc], eax
mov edx, dword [ebp - 0xaa4]
mov edi, ebx
mov eax, ebx
test edx, edx
jns 0xaf52a0
mov edi, edx
mov dword [ebp - 0xaa4], ebx
neg edi
mov ecx, dword [ebp - 0xab4]
test ecx, ecx
jns 0xaf52b0
mov eax, ecx
mov ecx, ebx
neg eax
mov esi, dword [ebp - 0x35c]
mov edx, dword [ebp - 0xa94]
sub esi, edi
sub edx, dword [ebp - 0xaa4]
mov dword [ebp - 0xaa8], esi
cmp esi, edx
jl 0xaf52d6
mov esi, edx
mov dword [ebp - 0xaa8], edx
mov edx, dword [ebp - 0x358]
sub dword [ebp - 0xa84], ecx
sub edx, eax
mov dword [ebp - 0xad0], edx
cmp edx, dword [ebp - 0xa84]
jl 0xaf52fe
mov edx, dword [ebp - 0xa84]
mov dword [ebp - 0xad0], edx
test esi, esi
jle 0xaf5493
test edx, edx
jle 0xaf5493
mov edx, dword [ebp - 0x35c]
imul ecx, dword [ebp - 0xa94]
imul eax, edx
shl edx, 2
mov dword [ebp - 0xa98], edx
mov edx, dword [ebp - 0xa94]
add ecx, dword [ebp - 0xaa4]
add eax, edi
mov edi, dword [ebp - 0xa7c]
shl edx, 2
mov dword [ebp - 0xb20], edx
lea eax, [edi + eax*4]
mov edi, dword [ebp - 0xa78]
mov dword [ebp - 0xa80], eax
lea ecx, [edi + ecx*4]
mov dword [ebp - 0xa9c], ecx
mov ebx, ecx
mov dword [ebp - 0xa78], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [ebp - 0xa84], edx
lea edi, [eax + 2]
mov dword [ebp - 0xa7c], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xaf543e
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xa88]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa7c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xa84]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xa88]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xaca]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xa78]
cdq
idiv ecx
mov edx, dword [ebp - 0xa84]
add al, bl
mov ebx, dword [ebp - 0xa7c]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0xa84], edx
mov dword [ebp - 0xa78], esi
jne 0xaf5378
mov eax, dword [ebp - 0xa80]
mov ecx, dword [ebp - 0xa9c]
add eax, dword [ebp - 0xa98]
add ecx, dword [ebp - 0xb20]
sub dword [ebp - 0xad0], 1
mov esi, dword [ebp - 0xaa8]
mov dword [ebp - 0xa80], eax
mov dword [ebp - 0xa9c], ecx
jne 0xaf535c
xor ebx, ebx
push dword [ebp - 0xad4]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xb10]
mov edi, dword [ebp - 0xa90]
test eax, eax
je 0xaf54cb
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0xac0], 0
jl 0xaf558d
xor eax, eax
inc eax
cmp dword [ebp - 0xaa0], eax
jne 0xaf5531
mov esi, dword [section..data]
mov ecx, esi
push 0xcc0020
push ebx
push ebx
push dword [ebp - 0xaf8]
push dword [ebp - 0xab0]
push dword [ebp - 0xa74]
push dword [ebp - 0x74c]
push dword [ebp - 0x750]
push dword [ebp - 0xab8]
call dword [0xc99200]
call esi
jmp 0xaf5571
push dword [ebp - 0xaf4]
mov ecx, dword [ebp - 0xab0]
mov eax, dword [ebp - 0xa74]
mov esi, dword [0xc93020]
push ecx
push eax
push ebx
push ebx
push dword [ebp - 0xaf8]
push ecx
push eax
push dword [ebp - 0x350]
mov ecx, esi
push dword [ebp - 0x354]
push dword [ebp - 0xab8]
call dword [0xc99200]
call esi
push dword [ebp - 0xb64]
mov esi, dword [0xc93040]
mov ecx, esi
push dword [ebp - 0xab8]
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xb14]
test eax, eax
je 0xaf55a8
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xaf8]
test eax, eax
je 0xaf55c3
mov esi, dword [0xc93018]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xb88]
test eax, eax
je 0xaf55de
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov edi, 0xc96238
mov ecx, dword [ebp - 0x76c]
test ecx, ecx
je 0xaf5629
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xaf55f0
mov eax, dword [ebp - 0x76c]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xaf5618
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xaf5610
mov ecx, dword [ebp - 0x76c]
call fcn.00ad1951
mov dword [ebp - 0x76c], ebx
mov ecx, dword [ebp - 0x768]
test ecx, ecx
je 0xaf566f
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xaf5636
mov eax, dword [ebp - 0x768]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xaf565e
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xaf5656
mov ecx, dword [ebp - 0x768]
call fcn.00ad1951
mov dword [ebp - 0x768], ebx
mov edx, dword [ebp - 0x764]
test edx, edx
je 0xaf56b3
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xaf567e
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xaf56a6
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xaf5698
mov edx, dword [ebp - 0x764]
mov ecx, edx
call fcn.00ad1951
mov dword [ebp - 0x764], ebx
cmp dword [ebp - 0x760], 0
je 0xaf56d8
push dword [ebp - 0x760]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x760], ebx
cmp dword [ebp - 0x75c], 0
je 0xaf56fd
push dword [ebp - 0x75c]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x75c], ebx
cmp dword [ebp - 0x758], 0
je 0xaf5722
push dword [ebp - 0x758]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x758], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xaf5724
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jle 0xaf5786
sub eax, 1
mov dword [0xc95890], eax
jne 0xaf5786
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xaf575a
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xaf5749
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0xc95878]
mov esi, dword [0xc9304c]
mov ecx, esi
mov dword [ebp - 0xaa8], eax
call dword [0xc99200]
call esi
sub eax, dword [0xc95870]
lea edi, [ebp - 0x2dc]
push 7
mov dword [ebp - 0xa9c], eax
mov edx, 0xc96238
xor eax, eax
xor ebx, ebx
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xaf57c5
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jne 0xaf5dbb
mov edi, ebx
mov dword [ebp - 0xa94], ebx
mov ecx, 0x338
mov dword [ebp - 0xa90], edi
mov dword [ebp - 0xa80], ebx
call fcn.00ad193e
mov dword [ebp - 0xb64], eax
test eax, eax
je 0xaf5d54
or dword [ebp - 0xa7c], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0xb50], ebx
mov dword [ebp - 0xa6c], ebx
mov edx, ebx
mov dword [ebp - 0xa78], eax
mov esi, dword [ebp - 0xb84]
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [ebp - 0xa8c], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [ebp - 0xb84], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [ebp - 0xa6c]
xor esi, edx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0xa8c]
xor eax, edx
mov dword [ebp - 0xa8c], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xa8c]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xa8c]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xa8c], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xa8c]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xa8c]
xor edx, eax
mov dword [ebp - 0xa8c], edx
mov eax, dword [ebp - 0xa8c]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xa8c]
xor eax, edx
mov dword [ebp - 0xa8c], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xa8c]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xa8c]
xor eax, edx
mov dword [ebp - 0xa8c], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xa8c]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0xa8c]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0xa6c], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xa6c]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, edx
mov dword [ebp - 0xa6c], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xa6c], edx
mov edx, dword [ebp - 0xa6c]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xa6c], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xa6c]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, edx
mov dword [ebp - 0xa6c], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xa6c]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xa6c], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xa6c]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xa6c]
xor edx, dword [ebp - 0xb50]
xor eax, dword [ebp - 0xa7c]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xa8c], esi
mov esi, dword [ebp - 0xa78]
mov dword [ebp - 0xb50], ebx
mov dword [ebp - 0xa7c], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xb80], 1
mov dword [ebp - 0xa6c], eax
mov dword [ebp - 0xa78], esi
jne 0xaf582e
mov esi, dword [ebp - 0xb64]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xaf5b9b
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xaf5bc6
cmp edx, dword [0x9fc02c]
jne 0xaf5bc6
mov edi, esi
mov dword [ebp - 0xa90], esi
mov esi, ebx
jmp 0xaf5bd9
or dword [ebp - 0xad8], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xa80], 0xc004d501
test esi, esi
je 0xaf5be4
mov ecx, esi
call fcn.00ad1951
cmp dword [ebp - 0xa80], ebx
jl 0xaf5d4e
mov eax, dword [ebp - 0xad8]
mov esi, edi
push 0x40
push ebx
push 0xc960a0
mov byte [eax + edi], bl
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], bl
je 0xaf5d5b
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb64], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xaf5c25
sub ecx, dword [ebp - 0xb64]
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xaf5d47
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xa88], ecx
cmp word [eax], dx
je 0xaf5c70
mov ecx, 0xc000007b
mov dword [ebp - 0xa88], ecx
jmp 0xaf5cb8
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xaf5c63
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xaf5c63
cmp dword [edx], 0x4550
jne 0xaf5c63
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xb6c]
je 0xaf5ca6
cmp ax, word [ebp - 0xb60]
je 0xaf5ca6
mov ecx, 0xc000000d
jmp 0xaf5c68
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xbc4], eax
mov dword [ebp - 0xad8], ebx
test eax, eax
je 0xaf5d34
mov edx, esi
mov dword [ebp - 0xa98], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb64], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xaf5ce0
sub edx, dword [ebp - 0xb64]
inc esi
add esi, edx
test ecx, ecx
js 0xaf5d19
push dword [ebp - 0xa98]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xaf5d3f
mov ecx, dword [ebp - 0xa94]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xa88]
mov eax, dword [ebp - 0xad8]
inc dword [ebp - 0xa94]
inc eax
mov dword [ebp - 0xad8], eax
cmp eax, dword [ebp - 0xbc4]
jb 0xaf5ccf
add edi, 0x10
cmp byte [esi], bl
jne 0xaf5c18
mov esi, dword [ebp - 0xa88]
jmp 0xaf5d5d
mov esi, 0xc000007a
jmp 0xaf5d5d
mov edi, dword [ebp - 0xa90]
mov esi, 0xc000007a
jmp 0xaf5d63
mov esi, ebx
mov edi, dword [ebp - 0xa90]
test edi, edi
je 0xaf5d76
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push edi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0xaf5db6
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xaf5d8d
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xaf5d7c
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xaf5dc1
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edi, 0xc96238
xchg dword [edi], eax
mov eax, dword [ebp - 0xa9c]
xor ecx, ecx
mov esi, dword [0xc93068]
inc ecx
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0x2c4], eax
lea eax, [ebp - 0x2e0]
push eax
push 4
pop eax
push eax
push 0x2021
mov dword [ebp - 0x2e0], ecx
mov dword [ebp - 0x2d8], ecx
mov dword [ebp - 0x2cc], ecx
mov dword [ebp - 0x2d0], ecx
mov dword [ebp - 0x2c8], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x2d4], 0x9966f291
call dword [0xc99200]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xaf5e30
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jle 0xaf5e92
sub eax, 1
mov dword [0xc95890], eax
jne 0xaf5e92
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xaf5e66
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xaf5e55
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xab8]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
lea ecx, [ebp - 0xc18]
call fcn.00ad18e0
xor eax, eax
mov dword [ebp - 0xa9c], ebx
lea edi, [ebp - 0xdc8]
mov dword [ebp - 0xaa0], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xc6c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xc18], eax
test eax, eax
je 0xaf7f63
push 0x28
pop ecx
mov esi, 0xc94ea0
mov dword [ebp - 0xa9c], eax
mov edi, eax
rep movsd dword es:[edi], dword [esi]
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb64], eax
test eax, eax
je 0xaf7f63
mov ecx, dword [0xc94e98]
mov edi, eax
mov dword [eax], ecx
mov ecx, dword [0xc94e9c]
mov dword [eax + 4], ecx
mov dword [ebp - 0xaa0], edi
rdtsc
mov dword [ebp - 0xa98], eax
mov dword [ebp - 0xbc4], edx
lea eax, [ebp - 0xd14]
mov dword [ebp - 0xb44], ebx
push eax
push 4
pop esi
mov edx, esi
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xaf7f5b
mov edx, dword [ebp - 0xd14]
lea eax, [ebp - 0xb44]
push eax
xor ecx, ecx
call fcn.00a32533
or eax, 0x10000000
jl 0xaf7f5b
lea eax, [ebp - 0xd18]
mov edx, 0xa0
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xaf7f5b
mov edx, dword [ebp - 0xd18]
lea eax, [ebp - 0xb44]
mov ecx, dword [ebp - 0xb44]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xaf7f5b
lea eax, [ebp - 0xd1c]
mov ecx, esi
push eax
push 8
pop edx
call fcn.00a32533
test eax, eax
js 0xaf7f5b
mov edx, dword [ebp - 0xd1c]
lea eax, [ebp - 0xb44]
mov ecx, dword [ebp - 0xb44]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xaf7f5b
lea eax, [ebp - 0xd20]
mov ecx, esi
push eax
push 8
pop edx
call fcn.00a32533
test eax, eax
js 0xaf7f5b
mov edx, dword [ebp - 0xd20]
lea eax, [ebp - 0xb44]
mov ecx, dword [ebp - 0xb44]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xaf7f5b
mov esi, dword [ebp - 0xb44]
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xac8], edi
test edi, edi
je 0xaf7f63
lea eax, [ebp - 0xe2c]
mov ecx, edi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xaf7ee0
lea ecx, [edi + esi]
lea eax, [edi + 8]
mov dword [ebp - 0xa94], ecx
cmp eax, ecx
ja 0xaf7ee0
mov eax, dword [ebp - 0xe2c]
push 4
pop ecx
mov dword [edi], ecx
mov dword [eax], ecx
mov esi, edi
mov edi, ebx
mov dword [ebp - 0xb54], esi
mov edx, dword [esi]
lea eax, [ebp - 0xd24]
push eax
call fcn.00a32533
test eax, eax
js 0xaf7ee0
mov edx, dword [ebp - 0xd24]
lea eax, [ebp - 0xb54]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xaf7ee0
mov esi, dword [ebp - 0xb54]
xor eax, eax
inc edi
inc eax
cmp edi, eax
jae 0xaf60fb
push 4
pop ecx
jmp 0xaf60b6
lea eax, [ebp - 0xe34]
mov ecx, esi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xaf7ee0
lea eax, [esi + 0xa4]
cmp eax, dword [ebp - 0xa94]
ja 0xaf7ee0
mov edi, dword [ebp - 0xe34]
mov dword [esi], 0xa0
mov esi, dword [ebp - 0xc18]
push 0x28
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xac8]
mov esi, edi
mov dword [ebp - 0xb30], esi
mov dword [ebp - 0xad8], ebx
mov edx, dword [esi]
lea eax, [ebp - 0xd28]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
test eax, eax
js 0xaf7ee0
mov edx, dword [ebp - 0xd28]
lea eax, [ebp - 0xb30]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xaf7ee0
mov eax, dword [ebp - 0xad8]
mov esi, dword [ebp - 0xb30]
inc eax
mov dword [ebp - 0xad8], eax
cmp eax, 2
jb 0xaf6153
lea eax, [ebp - 0xe3c]
mov ecx, esi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xaf7ee0
lea eax, [esi + 0xc]
cmp eax, dword [ebp - 0xa94]
ja 0xaf7ee0
mov edx, dword [ebp - 0xb64]
mov ecx, dword [ebp - 0xe3c]
mov dword [esi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov esi, edi
mov edi, ebx
mov dword [ebp - 0xac4], esi
mov edx, dword [esi]
lea eax, [ebp - 0xd2c]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
test eax, eax
js 0xaf7ee0
mov edx, dword [ebp - 0xd2c]
lea eax, [ebp - 0xac4]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xaf7ee0
mov esi, dword [ebp - 0xac4]
inc edi
cmp edi, 3
jb 0xaf61f2
lea eax, [ebp - 0xe44]
mov ecx, esi
push eax
push 4
pop edi
mov edx, edi
call fcn.00a32533
test eax, eax
js 0xaf7ee0
lea eax, [esi + 0xc]
cmp eax, dword [ebp - 0xa94]
ja 0xaf7ee0
mov eax, dword [ebp - 0xe44]
mov ecx, dword [ebp - 0xa98]
mov dword [esi], 8
mov dword [eax], ecx
mov ecx, dword [ebp - 0xbc4]
mov dword [eax + 4], ecx
lea eax, [ebp - 0xb68]
mov edx, edi
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xaf7ee0
mov esi, dword [ebp - 0xb68]
lea eax, [ebp - 0xae4]
push eax
push 8
pop edx
mov ecx, edi
mov dword [ebp - 0xb2c], esi
call fcn.00a32533
test eax, eax
js 0xaf7ee0
mov edx, dword [ebp - 0xae4]
lea eax, [ebp - 0xb2c]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xaf7ee0
rdtsc
mov edi, ebx
mov dword [ebp - 0xb4c], ebx
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xa80], edi
mov dword [ebp - 0xacc], ebx
mov dword [ebp - 0xa7c], ebx
mov dword [ebp - 0xad0], ebx
mov dword [ebp - 0xadc], ebx
mov dword [ebp - 0xb8c], ebx
mov dword [ebp - 0xb6c], ebx
mov dword [ebp - 0xa94], ebx
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xb68], edx
push 8
pop ecx
mov dword [ebp - 0xc38], ecx
mov edx, dword [ebp - 0xb44]
lea eax, [ebp - 0xc38]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf643d
mov eax, dword [ebp - 0xc38]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0xad8], ecx
cmp ecx, eax
jae 0xaf6366
mov esi, 0xc0000095
jmp 0xaf643d
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb60], eax
test eax, eax
jne 0xaf638a
mov esi, 0xc0000017
jmp 0xaf643d
push 4
pop edx
lea ecx, [ebp - 0xb28]
mov dword [ebp - 0xb28], eax
push ecx
mov ecx, eax
mov dword [eax], edx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf6424
mov ecx, dword [ebp - 0xb28]
mov eax, dword [ebp - 0xb44]
mov dword [ecx], eax
lea eax, [ebp - 0xb28]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0xb60]
test esi, esi
js 0xaf642a
mov ecx, dword [ebp - 0xad8]
push dword [ebp - 0xb44]
mov edx, dword [ebp - 0xae4]
push dword [ebp - 0xac8]
mov dword [eax + ecx - 8], edx
mov edx, dword [ebp - 0xb68]
push dword [ebp - 0xb28]
mov dword [eax + ecx - 4], edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xb60]
add esp, 0xc
mov ecx, dword [ebp - 0xad8]
mov dword [ebp - 0xb4c], eax
mov eax, ebx
mov dword [ebp - 0xac4], ecx
jmp 0xaf642a
mov eax, dword [ebp - 0xb60]
test eax, eax
je 0xaf643d
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xaf7cfb
cmp dword [ebp - 0xb4c], 0
mov dword [ebp - 0xb1c], ebx
jne 0xaf6462
mov esi, 0xc000000d
jmp 0xaf6a96
mov esi, dword [ebp - 0xac4]
test esi, esi
je 0xaf6a91
lea eax, [esi + 8]
mov ecx, eax
mov dword [ebp - 0xb68], eax
call fcn.00ad193e
mov dword [ebp - 0xb28], eax
test eax, eax
je 0xaf6a91
mov edi, dword [ebp - 0xb4c]
mov cl, bl
mov eax, ebx
test esi, esi
je 0xaf64a4
xor cl, byte [eax + edi]
inc eax
cmp eax, esi
jb 0xaf649c
mov eax, 0xb1b54a58
mov dword [ebp - 0x3a4], eax
mov eax, 0xc81ecb17
mov dword [ebp - 0x3a0], eax
mov eax, esi
shr eax, 3
mov dword [ebp - 0xb50], eax
test eax, eax
je 0xaf68b1
movzx edx, word [ebp - 0x3a2]
mov eax, 0xc81ecb17
movzx esi, ax
movzx eax, word [ebp - 0x39e]
mov dword [ebp - 0xae0], eax
mov eax, 0xb1b54a58
movzx eax, ax
mov dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0xb28]
mov dword [ebp - 0xaf0], esi
add eax, 7
or dword [ebp - 0xae4], 0xffffffff
lea esi, [edi + 2]
mov dword [ebp - 0xaac], edx
mov edx, ebx
mov dword [ebp - 0xad8], ebx
mov dword [ebp - 0xb80], ebx
mov ebx, dword [ebp - 0xae4]
mov dword [ebp - 0xb84], eax
mov dword [ebp - 0xa90], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xa90]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xa90]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xa90]
shl esi, 8
add dword [ebp - 0xa90], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov eax, ebx
sub eax, dword [ebp - 0xaec]
xor eax, 0xc81ecb17
xor eax, edi
xor edx, eax
mov dword [ebp - 0xa6c], edx
mov edx, 0xc81ecb17
mov eax, dword [ebp - 0xa6c]
xor edx, eax
ror edx, 0xf
imul edx, dword [ebp - 0xaac]
ror eax, 7
add edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
mov eax, ebx
ror eax, 0xa
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [ebp - 0xaf0]
sub edx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, edx
mov edx, dword [ebp - 0xaf0]
xor edx, eax
mov dword [ebp - 0xa6c], eax
rol edx, 4
imul edx, dword [ebp - 0xae0]
rol eax, 5
add edx, eax
mov eax, 0xc81ecb17
xor ebx, edx
mov edx, 0xb1b54a58
xor edx, ebx
sub eax, edx
mov edx, dword [ebp - 0xa6c]
xor edx, eax
mov dword [ebp - 0xa6c], edx
sub edx, dword [ebp - 0xaec]
imul edx, dword [ebp - 0xaac]
mov eax, dword [ebp - 0xa6c]
shr eax, 6
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xa6c]
mov eax, ebx
ror eax, 0xf
xor eax, dword [ebp - 0xaf0]
imul eax, dword [ebp - 0xaec]
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [ebp - 0xae0]
imul eax, dword [ebp - 0xaf0]
xor ebx, eax
mov eax, ebx
sub eax, dword [ebp - 0xaec]
sub eax, 0xc81ecb17
xor edx, eax
mov eax, dword [ebp - 0xae0]
mov dword [ebp - 0xa6c], edx
xor eax, dword [ebp - 0xa6c]
imul eax, dword [ebp - 0xaac]
ror edx, 0xa
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xaec]
xor edx, ebx
mov eax, ebx
rol edx, 6
imul edx, dword [ebp - 0xaf0]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, edx
mov edx, dword [ebp - 0xae0]
mov dword [ebp - 0xa6c], eax
ror eax, 0xf
sub eax, edx
imul eax, dword [ebp - 0xaec]
xor ebx, eax
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0xaec]
shr eax, 1
xor edx, eax
mov eax, ebx
xor dword [ebp - 0xa6c], edx
mov edx, ebx
sub edx, dword [ebp - 0xaf0]
rol edx, 3
imul edx, dword [ebp - 0xaec]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xa6c], eax
sub edx, dword [ebp - 0xaf0]
imul edx, dword [ebp - 0xaac]
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 9
imul edx, dword [ebp - 0xaf0]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, edx
mov dword [ebp - 0xa6c], eax
sub eax, dword [ebp - 0xae0]
sub eax, 0xb1b54a58
xor ebx, eax
mov eax, dword [ebp - 0xaac]
xor eax, ebx
mov edx, ebx
imul eax, dword [ebp - 0xaec]
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0xae0]
xor dword [ebp - 0xa6c], eax
mov eax, dword [ebp - 0xa6c]
xor edx, eax
rol edx, 4
imul edx, dword [ebp - 0xaac]
ror eax, 0x10
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 0xa
imul edx, dword [ebp - 0xaf0]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xa6c], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, dword [ebp - 0xae0]
xor edx, eax
xor ebx, edx
mov edx, 0xc81ecb17
xor edx, ebx
mov eax, ebx
rol edx, 8
imul edx, dword [ebp - 0xaec]
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, edx
mov edx, 0xc81ecb17
sub edx, eax
mov dword [ebp - 0xa6c], eax
ror edx, 0xb
imul edx, dword [ebp - 0xaac]
ror eax, 0xc
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xaac]
imul edx, dword [ebp - 0xaf0]
shr eax, 8
xor edx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xa6c], edx
xor eax, 0xc81ecb17
mov edx, dword [ebp - 0xa6c]
xor ebx, eax
mov eax, dword [ebp - 0xb84]
xor ebx, edx
xor edx, dword [ebp - 0xad8]
xor ebx, dword [ebp - 0xb80]
mov dword [ebp - 0xb80], esi
mov esi, dword [ebp - 0xa90]
mov byte [eax - 4], dl
mov byte [eax], bl
ror edx, 8
mov byte [eax - 5], dl
ror ebx, 8
mov byte [eax - 1], bl
ror edx, 8
mov byte [eax - 6], dl
ror ebx, 8
mov byte [eax - 2], bl
ror edx, 8
ror ebx, 8
mov byte [eax - 7], dl
mov byte [eax - 3], bl
add eax, 8
ror edx, 8
ror ebx, 8
sub dword [ebp - 0xb50], 1
mov dword [ebp - 0xad8], edi
mov dword [ebp - 0xb84], eax
jne 0xaf6536
mov esi, dword [ebp - 0xac4]
xor ebx, ebx
movzx eax, cl
mov ecx, dword [ebp - 0xb28]
cdq
mov dword [ecx + esi], eax
mov dword [ecx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xae4], edi
test edi, edi
jne 0xaf68e9
mov esi, 0xc0000017
jmp 0xaf69eb
mov esi, dword [ebp - 0xb68]
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0xaf690e
mov esi, 0xc0000017
jmp 0xaf698a
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0xb28]
push esi
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xaf6907
mov dword [edi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
push 8
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xae4]
pop eax
push eax
push eax
mov dword [edi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0xaf6907
mov dword [edi + 0x14], ecx
mov eax, dword [0xc94e90]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ebp - 0xb1c], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0xaf69eb
cmp dword [edi + 4], 0
je 0xaf69a8
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xaf69c2
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xaf69dc
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xaf6a03
mov edi, dword [ebp - 0xb1c]
mov dword [ebp - 0xa80], edi
mov dword [ebp - 0xb1c], ebx
jmp 0xaf6a05
mov edi, ebx
push dword [ebp - 0xb28]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb1c]
test eax, eax
je 0xaf6a96
mov ecx, dword [eax + 4]
test ecx, ecx
je 0xaf6a42
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb1c]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0xaf6a61
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb1c]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0xaf6a80
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb1c]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xaf6a96
mov esi, 0xc0000001
or esi, 0x10000000
jl 0xaf7cfb
mov edx, dword [edi]
lea eax, [ebp - 0xb5c]
push 4
pop ecx
push eax
mov dword [ebp - 0xb5c], ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf6b35
mov ecx, dword [ebp - 0xb5c]
lea eax, [ebp - 0xb5c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf6b35
mov edx, dword [edi + 8]
lea eax, [ebp - 0xb5c]
mov ecx, dword [ebp - 0xb5c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf6b35
mov ecx, dword [ebp - 0xb5c]
lea eax, [ebp - 0xb5c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf6b35
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0xb5c]
mov ecx, dword [ebp - 0xb5c]
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0xb5c]
test esi, esi
jns 0xaf6b3b
mov eax, dword [ebp - 0xdf8]
mov dword [ebp - 0xad8], eax
test esi, esi
js 0xaf6ca0
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xaac], ecx
test ecx, ecx
jne 0xaf6b6f
mov esi, 0xc0000017
jmp 0xaf6ca0
mov eax, dword [edi]
mov dword [ecx], eax
lea eax, [ebp - 0xb24]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xb24], ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf6c87
push dword [edi]
push dword [edi + 4]
push dword [ebp - 0xb24]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi]
lea eax, [ebp - 0xb24]
mov ecx, dword [ebp - 0xb24]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf6c87
mov ecx, dword [ebp - 0xb24]
mov eax, dword [edi + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xb24]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf6c87
push dword [edi + 8]
push dword [edi + 0xc]
push dword [ebp - 0xb24]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi + 8]
lea eax, [ebp - 0xb24]
mov ecx, dword [ebp - 0xb24]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf6c87
mov ecx, dword [ebp - 0xb24]
mov eax, dword [edi + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xb24]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf6c87
push dword [edi + 0x10]
push dword [edi + 0x14]
push dword [ebp - 0xb24]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0xb24]
mov ecx, dword [ebp - 0xb24]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0xaac]
test esi, esi
js 0xaf6c8d
mov ecx, dword [ebp - 0xad8]
mov dword [ebp - 0xacc], eax
mov eax, ebx
mov dword [ebp - 0xa7c], ecx
jmp 0xaf6c8d
mov eax, dword [ebp - 0xaac]
test eax, eax
je 0xaf6ca0
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xaf7cfb
push 8
pop edi
mov dword [ebp - 0xad8], ebx
mov dword [ebp - 0xc58], edi
mov edx, dword [ebp - 0xb2c]
lea eax, [ebp - 0xc58]
push eax
mov ecx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
jl 0xaf6d2f
mov eax, dword [ebp - 0xc58]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xaf6cf0
mov esi, 0xc0000095
jmp 0xaf6d10
mov dword [ebp - 0xc30], ecx
lea eax, [ebp - 0xc30]
mov edx, edi
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0xc30]
test esi, esi
jns 0xaf6d16
mov eax, dword [ebp - 0xd38]
mov dword [ebp - 0xac4], eax
test esi, esi
js 0xaf6d2f
mov edi, dword [ebp - 0xac8]
test edi, edi
jne 0xaf6d5d
mov esi, 0xc000000d
mov edi, ebx
test esi, esi
js 0xaf7cfb
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xaf6f41
mov esi, 0xd0000017
mov eax, ebx
jmp 0xaf6f4c
xor eax, eax
push 4
pop edx
inc eax
cmp edx, eax
jbe 0xaf6d2a
mov ecx, edi
mov dword [ebp - 0xb2c], ebx
mov dword [ebp - 0xb34], ecx
mov eax, dword [ecx]
mov dword [ebp - 0xae4], eax
lea eax, [ebp - 0xb34]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf6d2f
mov edx, dword [ebp - 0xae4]
lea eax, [ebp - 0xb34]
mov ecx, dword [ebp - 0xb34]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf6d2f
mov eax, dword [ebp - 0xb2c]
xor ecx, ecx
inc eax
inc ecx
cmp eax, ecx
mov dword [ebp - 0xb2c], eax
mov ecx, dword [ebp - 0xb34]
jae 0xaf6dcc
push 4
pop edx
jmp 0xaf6d75
mov eax, dword [ecx]
mov dword [ebp - 0xae4], eax
lea eax, [ebp - 0xb34]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf6d2f
mov eax, dword [ebp - 0xae4]
mov dword [ebp - 0xad8], eax
push 4
pop edx
cmp edx, 2
jbe 0xaf6d2a
mov ecx, edi
mov edi, ebx
mov dword [ebp - 0xb38], ecx
mov eax, dword [ecx]
mov dword [ebp - 0xae4], eax
lea eax, [ebp - 0xb38]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf6e73
mov edx, dword [ebp - 0xae4]
lea eax, [ebp - 0xb38]
mov ecx, dword [ebp - 0xb38]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf6e73
mov ecx, dword [ebp - 0xb38]
inc edi
cmp edi, 2
jae 0xaf6e5a
push 4
pop edx
jmp 0xaf6e11
mov edi, dword [ecx]
lea eax, [ebp - 0xb38]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
jns 0xaf6e7d
mov edi, ebx
test esi, esi
js 0xaf6d2f
mov edx, dword [ebp - 0xac4]
lea eax, [ebp - 0xb58]
push 4
pop ecx
push eax
mov dword [ebp - 0xb58], ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf6f16
mov ecx, dword [ebp - 0xb58]
lea eax, [ebp - 0xb58]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf6f16
mov edx, dword [ebp - 0xad8]
lea eax, [ebp - 0xb58]
mov ecx, dword [ebp - 0xb58]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf6f16
mov ecx, dword [ebp - 0xb58]
lea eax, [ebp - 0xb58]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf6f16
mov ecx, dword [ebp - 0xb58]
lea eax, [ebp - 0xb58]
push eax
mov edx, edi
call fcn.00a32533
mov edi, dword [ebp - 0xb58]
mov esi, eax
test esi, esi
jns 0xaf6f24
mov edi, dword [ebp - 0xe54]
test esi, esi
js 0xaf6d2f
cmp edi, 0x400000
jbe 0xaf6f36
mov esi, 0x8000ffff
jmp 0xaf7cfb
mov dword [ebp - 0xadc], edi
jmp 0xaf6d31
mov dword [ebp - 0xad0], eax
mov esi, 0x10000000
test esi, esi
js 0xaf7cfb
mov ecx, dword [ebp - 0xacc]
test ecx, ecx
jne 0xaf6f68
mov esi, 0x80070057
jmp 0xaf7cfb
test eax, eax
je 0xaf6f5e
mov dword [ebp - 0xdb8], eax
lea eax, [ebp - 0xd3c]
push eax
xor eax, eax
mov dword [ebp - 0xdbc], ecx
mov ecx, dword [ebp - 0xa7c]
inc eax
push 0x9f29b8
push eax
mov dword [ebp - 0xdb4], ecx
mov dword [ebp - 0xdb0], edi
mov dword [ebp - 0xdac], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xaf6fca
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xaf6fc1
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xaf7010
mov esi, 0x80004005
jmp 0xaf7010
push 0x9fc030
push dword [ebp - 0xd3c]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xaf6faa
push ebx
push 0x14
lea eax, [ebp - 0xdbc]
mov ecx, esi
push eax
push 0x86
call dword [0xc99200]
call esi
mov esi, eax
or esi, 0x10000000
jl 0xaf7010
mov edi, dword [ebp - 0xdb0]
mov dword [ebp - 0xadc], edi
cmp esi, 0xd0000023
jne 0xaf7022
mov esi, 0x8007007a
jmp 0xaf7cfb
test esi, esi
js 0xaf7cfb
mov eax, dword [ebp - 0xad0]
push 4
pop edx
mov dword [ebp - 0xb30], ebx
mov dword [ebp - 0xb08], ebx
mov dword [ebp - 0xb40], eax
cmp edi, edx
jae 0xaf7053
mov esi, 0xc000003e
jmp 0xaf742b
mov edi, dword [eax]
lea ecx, [ebp - 0xb40]
push ecx
mov ecx, eax
mov dword [ebp - 0xae4], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf742b
lea eax, [ebp - 0xb08]
xor ecx, ecx
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf742b
mov eax, dword [ebp - 0xadc]
sub eax, dword [ebp - 0xb08]
cmp eax, edi
jb 0xaf7049
mov eax, dword [ebp - 0xb40]
lea ecx, [ebp - 0xb40]
push ecx
mov edx, edi
mov dword [ebp - 0xb2c], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf742b
mov ecx, dword [ebp - 0xb08]
lea eax, [ebp - 0xb08]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf742b
mov eax, dword [ebp - 0xadc]
sub eax, dword [ebp - 0xb08]
push 4
pop edx
cmp eax, edx
jb 0xaf7049
mov ecx, dword [ebp - 0xb40]
lea eax, [ebp - 0xb40]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0xb68], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf742b
mov ecx, dword [ebp - 0xb08]
lea eax, [ebp - 0xb08]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf742b
mov eax, dword [ebp - 0xadc]
sub eax, dword [ebp - 0xb08]
cmp eax, edi
jb 0xaf7049
mov eax, dword [ebp - 0xb40]
lea ecx, [ebp - 0xb40]
push ecx
mov edx, edi
mov dword [ebp - 0xad8], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf742b
mov ecx, dword [ebp - 0xb08]
lea eax, [ebp - 0xb08]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf742b
mov eax, dword [ebp - 0xadc]
sub eax, dword [ebp - 0xb08]
push 4
pop edx
cmp eax, edx
jb 0xaf7049
mov ecx, dword [ebp - 0xb40]
mov eax, dword [ecx]
mov dword [ebp - 0xac4], eax
lea eax, [ebp - 0xb40]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf742b
mov ecx, dword [ebp - 0xb08]
lea eax, [ebp - 0xb08]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf742b
mov eax, dword [ebp - 0xadc]
sub eax, dword [ebp - 0xb08]
mov ecx, dword [ebp - 0xac4]
cmp eax, ecx
jb 0xaf7049
lea eax, [ebp - 0xb08]
mov edx, ecx
mov ecx, dword [ebp - 0xb08]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf742b
mov ecx, dword [ebp - 0xadc]
mov eax, ecx
sub eax, dword [ebp - 0xb08]
jne 0xaf7049
mov eax, dword [ebp - 0xac4]
mov esi, dword [ebp - 0xae4]
add eax, 0xc
add eax, edi
add eax, esi
cmp eax, ecx
jne 0xaf7049
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xaf727c
mov esi, 0xc0000017
jmp 0xaf73b0
cmp dword [ebp - 0xb2c], 0
je 0xaf72ba
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xaf72a5
mov esi, 0xc0000017
jmp 0xaf734f
mov dword [edi + 4], eax
push esi
push dword [ebp - 0xb2c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xaf72bf
mov dword [edi], ebx
mov dword [edi + 4], ebx
cmp dword [ebp - 0xad8], 0
je 0xaf72fa
mov esi, dword [ebp - 0xb68]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xaf729b
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xad8]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xaf7300
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [ebp - 0xb40], 0
je 0xaf733f
mov esi, dword [ebp - 0xac4]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xaf729b
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xb40]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xaf7345
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 0xb30], edi
mov esi, ebx
mov edi, ebx
test edi, edi
je 0xaf73b0
cmp dword [edi + 4], 0
je 0xaf736d
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xaf7387
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xaf73a1
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xaf73c4
mov eax, dword [ebp - 0xb30]
mov edi, ebx
mov dword [ebp - 0xb8c], eax
jmp 0xaf73ca
mov edi, dword [ebp - 0xb30]
test edi, edi
je 0xaf742b
cmp dword [edi + 4], 0
je 0xaf73e8
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xaf7402
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xaf741c
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xaf7cfb
mov eax, dword [ebp - 0xb8c]
mov dword [ebp - 0xa78], ebx
mov dword [ebp - 0xa7c], ebx
test eax, eax
jne 0xaf7457
mov esi, 0xd000000d
jmp 0xaf7cfb
mov esi, dword [eax + 4]
mov dword [ebp - 0xb68], esi
test esi, esi
je 0xaf744d
mov edi, dword [eax]
test edi, edi
je 0xaf744d
add edi, 0xfffffff8
mov dword [ebp - 0xb50], ebx
mov ecx, edi
mov dword [ebp - 0xb80], edi
call fcn.00ad193e
mov dword [ebp - 0xb84], eax
test eax, eax
je 0xaf7a5c
mov dword [ebp - 0xb2c], esi
mov ecx, 0xab69605e
mov dword [ebp - 0x39c], ecx
mov ecx, 0x7f1137f
mov dword [ebp - 0x398], ecx
mov ecx, eax
mov dword [ebp - 0xb54], ecx
mov dl, bl
and edi, 7
je 0xaf75e4
mov dword [ebp - 0xb94], ebx
mov eax, ebx
mov dword [ebp - 0xb34], eax
mov dword [ebp - 0xac4], ebx
test edi, edi
je 0xaf7530
push 0x38
pop ecx
movzx eax, byte [esi]
inc esi
cmp dword [ebp - 0xac4], 4
jge 0xaf74f4
add ecx, 0xffffffe0
shl eax, cl
mov ecx, dword [ebp - 0xb18]
or ebx, eax
jmp 0xaf74fc
shl eax, cl
or dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0xac4]
sub ecx, 8
inc eax
mov dword [ebp - 0xb18], ecx
mov dword [ebp - 0xac4], eax
cmp eax, edi
jl 0xaf74d8
mov ecx, dword [ebp - 0xb54]
mov dword [ebp - 0xb34], ebx
xor ebx, ebx
mov eax, dword [ebp - 0xb34]
mov dword [ebp - 0xb2c], esi
mov esi, eax
mov dword [ebp - 0xae4], ebx
mov eax, dword [ebp - 0xb94]
xor esi, 0x92f65a5
xor eax, 0x699a899c
mov dword [ebp - 0xb28], esi
mov dword [ebp - 0xa6c], eax
mov dword [ebp - 0xac4], esi
mov dword [ebp - 0xb30], eax
test edi, edi
je 0xaf75b6
push 4
mov esi, ebx
pop eax
lea ebx, [ecx + 1]
mov dword [ebp - 0xae4], ebx
cmp esi, eax
jge 0xaf7586
rol dword [ebp - 0xac4], 8
mov ebx, dword [ebp - 0xac4]
jmp 0xaf7593
rol dword [ebp - 0xb30], 8
mov ebx, dword [ebp - 0xb30]
mov byte [ecx], bl
inc esi
mov ebx, dword [ebp - 0xae4]
mov ecx, ebx
cmp esi, edi
jl 0xaf756a
mov eax, dword [ebp - 0xa6c]
mov esi, dword [ebp - 0xb28]
mov dword [ebp - 0xb54], ebx
xor ebx, ebx
push 4
pop ecx
cmp edi, ecx
jbe 0xaf75d1
push 8
pop ecx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xa6c], eax
jmp 0xaf75f8
mov dword [ebp - 0xa6c], ebx
jae 0xaf75f8
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
jmp 0xaf75f2
mov dword [ebp - 0xb34], ebx
mov esi, ebx
mov dword [ebp - 0xa6c], ebx
mov dword [ebp - 0xb28], esi
mov ecx, dword [ebp - 0xb80]
mov eax, ecx
shr eax, 3
mov dword [ebp - 0xad8], eax
test eax, eax
je 0xaf79e6
movzx esi, word [ebp - 0x39a]
mov ebx, 0x7f1137f
movzx ecx, word [ebp - 0x396]
mov edi, 0xab69605e
movzx eax, bx
xor ebx, edi
mov dword [ebp - 0xaac], eax
movzx eax, di
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0xb54]
mov dword [ebp - 0xadc], esi
add eax, 7
mov esi, dword [ebp - 0xb2c]
add esi, 2
mov dword [ebp - 0xae4], ebx
mov ebx, dword [ebp - 0xb28]
mov dword [ebp - 0xb38], ecx
mov ecx, dword [ebp - 0xa6c]
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0xa90], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xa90]
xor ebx, edi
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xa90]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xa90]
shl esi, 8
add dword [ebp - 0xa90], 8
movzx eax, byte [eax + 5]
or esi, eax
mov eax, 0xab69605e
xor ecx, esi
xor eax, 0x7f1137f
xor eax, ecx
xor eax, ebx
mov ecx, eax
mov dword [ebp - 0xa6c], eax
sub ecx, 0xab69605e
rol eax, 0xa
rol ecx, 5
imul ecx, dword [ebp - 0xaac]
add ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ebx + ecx]
ror ecx, 9
imul ecx, dword [ebp - 0xadc]
sub ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xa6c], eax
sub ecx, dword [ebp - 0xaac]
imul ecx, dword [ebp - 0xae0]
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xadc]
xor ecx, ebx
mov eax, ebx
rol ecx, 6
imul ecx, dword [ebp - 0xb38]
rol eax, 2
sub ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xa6c], eax
xor ecx, 0xab69605e
mov eax, 0x7f1137f
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, dword [ebp - 0xaac]
imul eax, dword [ebp - 0xadc]
ror ecx, 6
xor ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov ecx, 0x7f1137f
add ecx, eax
mov dword [ebp - 0xa6c], eax
ror ecx, 0xf
imul ecx, dword [ebp - 0xae0]
rol eax, 2
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0xb38]
sub ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov ecx, 0xab69605e
xor ecx, eax
mov dword [ebp - 0xa6c], eax
ror ecx, 0xc
imul ecx, dword [ebp - 0xaac]
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xb38]
xor ecx, ebx
mov eax, ebx
imul ecx, dword [ebp - 0xadc]
shr eax, 0xa
xor ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov ecx, dword [ebp - 0xb38]
mov dword [ebp - 0xa6c], eax
not eax
ror eax, 5
add eax, dword [ebp - 0xae0]
imul eax, ecx
xor ebx, eax
mov eax, ebx
sub eax, ecx
xor eax, 0xab69605e
xor dword [ebp - 0xa6c], eax
mov eax, dword [ebp - 0xa6c]
xor ecx, eax
rol ecx, 2
imul ecx, dword [ebp - 0xaac]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 6
imul ecx, dword [ebp - 0xadc]
rol eax, 7
add ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov dword [ebp - 0xa6c], eax
mov ecx, eax
xor eax, dword [ebp - 0xaac]
imul eax, dword [ebp - 0xae0]
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xadc]
xor ecx, ebx
mov eax, ebx
rol ecx, 5
imul ecx, dword [ebp - 0xb38]
rol eax, 7
add ecx, eax
xor dword [ebp - 0xa6c], ecx
mov ecx, dword [ebp - 0xa6c]
xor ebx, ecx
xor ebx, dword [ebp - 0xae4]
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xadc]
imul eax, dword [ebp - 0xaac]
xor ecx, eax
mov dword [ebp - 0xa6c], ecx
mov eax, 0x7f1137f
sub ecx, eax
mov eax, dword [ebp - 0xa6c]
ror ecx, 1
imul ecx, dword [ebp - 0xae0]
ror eax, 6
sub ecx, eax
xor ebx, ecx
mov ecx, 0xab69605e
mov eax, ebx
rol eax, 0xe
lea ecx, [ecx + ebx]
rol ecx, 3
imul ecx, dword [ebp - 0xb38]
add ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0xa6c], eax
rol ecx, 0xf
imul ecx, dword [ebp - 0xaac]
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xae0]
xor ecx, ebx
mov eax, ebx
imul ecx, dword [ebp - 0xadc]
shr eax, 3
xor ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov ecx, 0x7f1137f
xor ecx, eax
mov dword [ebp - 0xa6c], eax
rol ecx, 4
imul ecx, dword [ebp - 0xae0]
rol eax, 2
xor ecx, eax
mov eax, dword [ebp - 0xb18]
xor ecx, dword [ebp - 0xb34]
xor ebx, ecx
mov dword [ebp - 0xb34], edi
mov ecx, dword [ebp - 0xa6c]
xor ecx, dword [ebp - 0xb94]
mov byte [eax - 4], bl
mov byte [eax], cl
ror ebx, 8
mov byte [eax - 5], bl
ror ecx, 8
mov byte [eax - 1], cl
ror ebx, 8
mov byte [eax - 6], bl
ror ecx, 8
mov byte [eax - 2], cl
ror ebx, 8
ror ecx, 8
mov byte [eax - 7], bl
mov byte [eax - 3], cl
add eax, 8
ror ebx, 8
ror ecx, 8
sub dword [ebp - 0xad8], 1
mov dword [ebp - 0xb94], esi
mov esi, dword [ebp - 0xa90]
mov dword [ebp - 0xb18], eax
jne 0xaf7679
mov ecx, dword [ebp - 0xb80]
xor ebx, ebx
mov esi, dword [ebp - 0xb84]
mov eax, ebx
test ecx, ecx
je 0xaf79fa
xor dl, byte [eax + esi]
inc eax
cmp eax, ecx
jb 0xaf79f2
mov edi, dword [ebp - 0xb68]
movzx eax, dl
cdq
cmp eax, dword [ecx + edi]
jne 0xaf7a21
cmp edx, dword [ecx + edi + 4]
jne 0xaf7a21
mov edi, esi
mov dword [ebp - 0xa7c], ecx
mov dword [ebp - 0xa78], edi
mov esi, ebx
jmp 0xaf7a2d
mov dword [ebp - 0xb50], 0xc004d501
mov edi, ebx
test esi, esi
je 0xaf7a38
mov ecx, esi
call fcn.00ad1951
cmp dword [ebp - 0xb50], 0
jl 0xaf7a5c
mov dword [ebp - 0xb6c], edi
mov eax, ebx
mov edi, dword [ebp - 0xa7c]
mov esi, 0x10000000
mov dword [ebp - 0xa94], edi
jmp 0xaf7a69
mov eax, dword [ebp - 0xa78]
mov esi, 0xd0000001
mov edi, ebx
test eax, eax
je 0xaf7a7c
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xaf7cfb
mov ecx, dword [ebp - 0xb6c]
push 4
pop edx
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xba8], ecx
cmp edi, edx
jb 0xaf7cf0
mov eax, dword [ecx]
mov dword [ebp - 0xae4], eax
lea eax, [ebp - 0xba8]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf7cf5
lea eax, [ebp - 0xba4]
xor ecx, ecx
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf7cf5
mov eax, edi
sub eax, dword [ebp - 0xba4]
push 4
pop edx
cmp eax, edx
jb 0xaf7cf0
mov ecx, dword [ebp - 0xba8]
lea eax, [ebp - 0xba8]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0xb18], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf7cf5
mov ecx, dword [ebp - 0xba4]
lea eax, [ebp - 0xba4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf7cf5
mov eax, dword [ebp - 0xa94]
mov ecx, dword [ebp - 0xba4]
sub eax, ecx
cmp eax, edi
jb 0xaf7cf0
lea eax, [ebp - 0xba4]
mov edx, edi
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf7cf5
mov edx, dword [ebp - 0xa94]
mov esi, dword [ebp - 0xb6c]
mov ecx, dword [ebp - 0xba8]
add ecx, edi
lea eax, [edx + esi]
cmp eax, ecx
jb 0xaf7cf0
mov eax, dword [ebp - 0xba8]
sub edx, edi
sub edx, eax
add edx, esi
cmp edx, 8
jae 0xaf7cf0
mov dword [ebp - 0xac4], ebx
mov ecx, ebx
mov dword [ebp - 0xb2c], ecx
mov esi, ebx
test eax, eax
je 0xaf7c81
mov edx, dword [ebp - 0xb18]
lea ecx, [ebp - 0xb70]
push ecx
mov ecx, eax
mov edi, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf7cf5
mov eax, dword [ebp - 0xb70]
jmp 0xaf7c6d
lea eax, [ebp - 0xd40]
mov ecx, edi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf7cf5
mov eax, dword [ebp - 0xb70]
cmp dword [ebp - 0xd40], eax
ja 0xaf7ca8
mov edx, dword [edi]
lea eax, [ebp - 0xd44]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf7c2f
mov eax, dword [ebp - 0xd44]
mov dword [ebp - 0xc70], eax
jmp 0xaf7c35
mov eax, dword [ebp - 0xc70]
test esi, esi
js 0xaf7cf5
lea ecx, [ebp - 0xc00]
mov edx, eax
push ecx
mov ecx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xaf7cf5
mov edi, dword [ebp - 0xc00]
mov eax, dword [ebp - 0xb70]
cmp edi, eax
ja 0xaf7ca8
inc dword [ebp - 0xac4]
cmp edi, eax
jb 0xaf7bd9
cmp edi, eax
jne 0xaf7ca8
mov edi, dword [ebp - 0xb18]
mov ecx, ebx
test edi, edi
je 0xaf7cb1
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb2c], ecx
test ecx, ecx
jne 0xaf7caf
mov esi, 0xc0000017
jmp 0xaf7cde
mov esi, 0xc000000d
jmp 0xaf7cf5
mov esi, ebx
mov eax, dword [ebp - 0xba8]
test eax, eax
je 0xaf7ccc
push edi
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [ebp - 0xb2c]
add esp, 0xc
mov eax, dword [ebp - 0xac4]
mov dword [ebp - 0xc64], ecx
mov dword [ebp - 0xc6c], eax
test esi, esi
js 0xaf7cf5
mov eax, dword [ebp - 0xae4]
cmp eax, dword [ebp - 0xc6c]
je 0xaf7cf5
mov esi, 0xc000003e
or esi, 0x10000000
mov eax, dword [ebp - 0xb4c]
test eax, eax
je 0xaf7d14
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xa80]
test edi, edi
je 0xaf7d7b
cmp dword [edi + 4], 0
je 0xaf7d38
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xaf7d52
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xaf7d6c
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xacc]
test eax, eax
je 0xaf7d94
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xad0]
test eax, eax
je 0xaf7dad
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xb8c]
test edi, edi
je 0xaf7e14
cmp dword [edi + 4], 0
je 0xaf7dd1
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xaf7deb
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xaf7e05
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb6c]
test eax, eax
je 0xaf7e2d
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xaf7ee0
mov edi, dword [ebp - 0xc6c]
xor eax, eax
inc eax
cmp edi, eax
jb 0xaf7ee0
mov esi, dword [ebp - 0xc64]
test esi, esi
je 0xaf7ee0
test edi, edi
je 0xaf7ee0
lea eax, [ebp - 0xbe0]
mov dword [ebp - 0xbe0], esi
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xaf7ee0
mov eax, dword [esi]
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbe0]
push 4
pop ecx
cmp dword [esi], ecx
jne 0xaf7ee0
cmp dword [eax], 0
jl 0xaf7ee0
xor eax, eax
inc eax
cmp edi, eax
jbe 0xaf7ee0
push ecx
mov edi, ebx
mov dword [ebp - 0xbf4], esi
pop ebx
lea eax, [ebp - 0xbf4]
mov edx, ebx
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xaf7ede
mov edx, dword [esi]
lea eax, [ebp - 0xbf4]
mov ecx, dword [ebp - 0xbf4]
push eax
call fcn.00a32533
test eax, eax
js 0xaf7ede
xor eax, eax
inc edi
inc eax
cmp edi, eax
jae 0xaf7ede
mov esi, dword [ebp - 0xbf4]
jmp 0xaf7ea2
xor ebx, ebx
mov eax, dword [ebp - 0xac8]
mov edi, dword [ebp - 0xaa0]
test eax, eax
je 0xaf7eff
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xc64]
test esi, esi
je 0xaf7f18
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xa9c]
test eax, eax
je 0xaf7f31
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xaf7f44
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbb4]
mov dword [ebp - 0xbb4], ebx
mov dword [ebp - 0xbfc], eax
jmp 0xaee5ef
mov eax, dword [ebp - 0xdc0]
jmp 0xaf7eec
mov eax, dword [ebp - 0xdc0]
jmp 0xaf7ee6
cmp eax, 0xd00000e5
je 0xaf7f8d
cmp eax, 0xc004d501
je 0xaf7f8d
cmp eax, 0xd000003e
jne 0xaf7f92
mov eax, 0xc004f028
jmp 0xaee686
mov eax, 0xc004f027
test eax, eax
jns 0xaf7fa8
cmp eax, 0x8007007a
jne 0xaee686
mov esi, 0xc004f01e
jmp 0xaf7fc1
push 4
pop eax
cmp dword [ebp - 0xbac], eax
jne 0xaf7fa1
mov eax, dword [ebp - 0xbfc]
mov esi, dword [ebp - 0xc78]
mov ebx, dword [eax]
lea ecx, [ebp - 0xbfc]
call fcn.00ad18a9
test esi, esi
jns 0xaf7fe3
mov ecx, dword [ebp + 4]
mov edx, 0x1fc
push esi
push 0x9feb70
call fcn.00ab606d
test ebx, ebx
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00ab3c50
leave
ret