Function at 0xb8e920
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Link many functions at runtime
Parse pe header
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push 0xe7c
mov eax, 0xb01377
call fcn.00af8e2b
mov esi, ecx
mov dword [ebp - 0xbdc], esi
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0xbec], eax
push ebx
push eax
call fcn.00b8e72e
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0xb8e9ac
lea eax, [ebp - 0x3a0]
push eax
push dword [esi + 0x14]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetWindowRect]
mov eax, dword [ebp - 0x398]
sub eax, dword [ebp - 0x3a0]
cdq
sub eax, edx
mov ebx, eax
mov eax, dword [ebp - 0x394]
sub eax, dword [ebp - 0x39c]
cdq
sub eax, edx
sar ebx, 1
add ebx, dword [ebp - 0x3a0]
mov esi, eax
sar esi, 1
add esi, dword [ebp - 0x39c]
push esi
push ebx
mov dword [ebp - 0xc00], ebx
mov dword [ebp - 0xc18], esi
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetCursorPos]
xor ebx, ebx
inc ebx
jmp 0xb8e9bf
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [ebp - 0xc00], ecx
mov dword [ebp - 0xc18], eax
xor edx, edx
mov esi, 0xc96238
mov dword [ebp - 0xc1c], edx
mov dword [ebp - 0xc20], edx
mov dword [ebp - 0xc24], edx
mov dword [ebp - 0xc28], edx
mov ecx, ebx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xb8e9de
mov eax, dword [0xc95890]
mov ebx, 0x9fbcf2
mov dword [ebp - 0xc2c], ebx
mov dword [ebp - 0xc34], 0x337
mov dword [ebp - 0xc38], 0x10b
mov dword [ebp - 0xc3c], 0x20b
push 0x67
pop edi
mov dword [ebp - 0xc30], edi
test eax, eax
jne 0xb8f011
push 0x338
mov esi, edx
mov dword [ebp - 0xbb0], edx
push edx
mov dword [ebp - 0xb7c], edx
mov dword [ebp - 0xb5c], esi
mov dword [ebp - 0xb24], edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xbac], eax
test eax, eax
je 0xb8f005
or dword [ebp - 0xb64], 0xffffffff
mov esi, 0xab69605e
xor edx, edx
mov dword [ebp - 0x390], esi
mov esi, 0x7f1137f
mov dword [ebp - 0xb60], edx
add eax, 7
mov dword [ebp - 0x38c], esi
mov cl, dl
mov dword [ebp - 0xb68], edx
mov dword [ebp - 0xb04], eax
mov esi, ebx
mov dword [ebp - 0xb00], edi
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [ebp - 0xadc], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [ebp - 0xb2c], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [ebp - 0xb68]
xor esi, edx
xor esi, 0xac987321
mov edx, esi
rol edx, 0xa
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul eax, eax, 0x137f
add edx, eax
mov eax, dword [ebp - 0xadc]
xor eax, edx
mov dword [ebp - 0xadc], eax
lea edx, [eax + 0x7f1137f]
rol eax, 2
ror edx, 9
imul edx, edx, 0xab69
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xadc]
sub edx, 0x756c8a2
xor eax, edx
mov edx, eax
mov dword [ebp - 0xadc], eax
xor edx, 0xab69
rol eax, 2
rol edx, 6
imul edx, edx, 0x7f1
sub edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
xor eax, 0xab69605e
sub edx, eax
mov eax, dword [ebp - 0xadc]
xor eax, edx
mov dword [ebp - 0xadc], eax
mov edx, eax
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
mov edx, esi
rol edx, 2
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul eax, eax, 0x605e
add edx, eax
mov eax, dword [ebp - 0xadc]
xor eax, edx
mov dword [ebp - 0xadc], eax
lea edx, [eax + 0x54969fa2]
rol eax, 8
ror edx, 0xe
imul edx, edx, 0x7f1
sub edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0xab69605e
ror edx, 0xa
ror eax, 0xc
imul eax, eax, 0x137f
xor edx, eax
mov eax, dword [ebp - 0xadc]
xor eax, edx
mov dword [ebp - 0xadc], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xadc]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0xadc]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0xb68], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb68]
shr eax, 2
add edx, eax
xor esi, edx
mov edx, esi
rol edx, 7
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul eax, eax, 0xab69
add edx, eax
mov eax, dword [ebp - 0xb68]
xor eax, edx
mov dword [ebp - 0xb68], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0xab69
rol edx, 7
rol eax, 5
imul eax, eax, 0x7f1
add edx, eax
xor dword [ebp - 0xb68], edx
mov edx, dword [ebp - 0xb68]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xb68], edx
add edx, 0xf80eec81
mov eax, dword [ebp - 0xb68]
ror edx, 1
imul edx, edx, 0x605e
ror eax, 6
sub edx, eax
xor esi, edx
mov edx, esi
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul eax, eax, 0x7f1
rol edx, 0xe
add edx, eax
mov eax, dword [ebp - 0xb68]
xor eax, edx
mov dword [ebp - 0xb68], eax
lea edx, [eax - 0x54969fa2]
ror eax, 0xe
rol edx, 0xf
imul edx, edx, 0x137f
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xb68]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xb68], eax
xor eax, edx
mov edx, dword [ebp - 0xb68]
rol eax, 4
imul eax, eax, 0x605e
rol edx, 2
xor edx, eax
mov eax, dword [ebp - 0xb68]
xor edx, dword [ebp - 0xb60]
xor eax, dword [ebp - 0xb64]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xadc], esi
mov esi, dword [ebp - 0xb04]
mov dword [ebp - 0xb60], ebx
mov dword [ebp - 0xb64], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xb00], 1
mov dword [ebp - 0xb04], esi
mov esi, dword [ebp - 0xb2c]
mov dword [ebp - 0xb68], eax
jne 0xb8eaa2
mov esi, dword [ebp - 0xbac]
xor eax, eax
mov edx, eax
xor cl, byte [edx + esi]
inc edx
cmp edx, 0x338
jb 0xb8edf8
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xb8ee2b
cmp edx, dword [0x9fc02c]
jne 0xb8ee2b
mov edi, esi
xor eax, eax
mov dword [ebp - 0xb5c], edi
mov esi, eax
mov ebx, 0x337
jmp 0xb8ee40
mov edi, dword [ebp - 0xb5c]
or ebx, 0xffffffff
mov dword [ebp - 0xb24], 0xc004d501
xor eax, eax
test esi, esi
je 0xb8ee53
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb24], 0
jl 0xb8efff
xor eax, eax
mov esi, edi
push 0x40
mov byte [edi + ebx], al
mov ebx, 0xc960a0
push eax
push ebx
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xb8ef95
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbec]
jne 0xb8ee8a
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xb8eff8
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb7c], ecx
cmp word [eax], dx
je 0xb8eed7
mov ecx, 0xc000007b
mov dword [ebp - 0xb7c], ecx
jmp 0xb8ef1f
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xb8eeca
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xb8eeca
cmp dword [edx], 0x4550
jne 0xb8eeca
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc38]
je 0xb8ef0d
cmp ax, word [ebp - 0xc3c]
je 0xb8ef0d
mov ecx, 0xc000000d
jmp 0xb8eecf
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xb2c], eax
test eax, eax
je 0xb8ef89
mov edx, esi
mov dword [ebp - 0xadc], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb00], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xb8ef41
sub edx, dword [ebp - 0xb00]
inc esi
add esi, edx
test ecx, ecx
js 0xb8ef7a
push dword [ebp - 0xadc]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xb8ef95
mov ecx, dword [ebp - 0xbb0]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xb7c]
inc dword [ebp - 0xbb0]
inc ebx
cmp ebx, dword [ebp - 0xb2c]
jb 0xb8ef30
add edi, 0x10
cmp byte [esi], 0
jne 0xb8ee83
mov ebx, dword [ebp - 0xb7c]
mov esi, dword [ebp - 0xb5c]
test esi, esi
je 0xb8efb6
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb8f00c
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb8efcf
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb8efbe
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xb8f019
mov ebx, 0xc000007a
jmp 0xb8ef9b
mov esi, dword [ebp - 0xb5c]
mov ebx, 0xc000007a
jmp 0xb8efa1
mov eax, dword [0xc95890]
inc eax
xor ebx, ebx
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
mov eax, ebx
mov dword [ebp - 0xb2c], ebx
mov dword [ebp - 0xb00], eax
mov edi, ebx
mov eax, dword fs:[0x30]
mov dword [ebp - 0xadc], ebx
cmp dword [eax + 0x1d4], 0
je 0xb8f333
mov esi, dword [0xc93088]
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0xb04], ecx
test ecx, ecx
jne 0xb8f072
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb8f18e
mov eax, ebx
mov esi, ebx
mov dword [ebp - 0xb00], eax
mov ebx, dword [0xc93098]
lea edx, [ebp - 0xc40]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xb8f101
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xb8f0e3
xor eax, eax
test esi, esi
jne 0xb8f0dc
push dword [ebp - 0xc40]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xb8f0d5
mov eax, dword [ebp - 0xc40]
mov ecx, dword [ebp - 0xb04]
jmp 0xb8f07c
mov ebx, 0x8007000e
jmp 0xb8f0fd
mov ebx, 0x80004005
jmp 0xb8f111
test eax, eax
jne 0xb8f0ee
mov ebx, 0x80004005
jmp 0xb8f0fd
jg 0xb8f0f4
mov ebx, eax
jmp 0xb8f0fd
movzx ebx, ax
or ebx, 0x80070000
xor eax, eax
jmp 0xb8f111
mov ebx, dword [ebp - 0xb00]
xor eax, eax
mov dword [ebp - 0xb2c], esi
mov esi, eax
test esi, esi
je 0xb8f124
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb8f169
mov esi, dword [0xc93094]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0xb04], ecx
test ecx, ecx
jne 0xb8f199
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb8f162
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb8f169
mov ebx, 0x80004005
xor esi, esi
mov eax, dword [ebp - 0xb2c]
test eax, eax
je 0xb8f184
push eax
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb8f363
xor ebx, ebx
mov dword [ebp - 0xc28], ebx
jmp 0xb8f365
xor edx, edx
mov eax, edx
mov esi, edx
mov dword [ebp - 0xb00], eax
mov ebx, dword [0xc93098]
lea edx, [ebp - 0xc44]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xb8f236
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xb8f212
xor eax, eax
test esi, esi
jne 0xb8f205
push dword [ebp - 0xc44]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xb8f1fe
mov eax, dword [ebp - 0xc44]
mov ecx, dword [ebp - 0xb04]
jmp 0xb8f1a5
mov ebx, 0x8007000e
jmp 0xb8f22c
mov ebx, 0x80004005
mov dword [ebp - 0xb00], ebx
jmp 0xb8f242
test eax, eax
jne 0xb8f21d
mov ebx, 0x80004005
jmp 0xb8f22c
jg 0xb8f223
mov ebx, eax
jmp 0xb8f22c
movzx ebx, ax
or ebx, 0x80070000
mov dword [ebp - 0xb00], ebx
xor eax, eax
jmp 0xb8f242
mov ebx, dword [ebp - 0xb00]
xor eax, eax
mov edi, esi
mov esi, eax
test esi, esi
je 0xb8f255
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb8f33f
mov eax, dword [ebp - 0xb2c]
test eax, eax
je 0xb8f333
push 4
mov ecx, 0x9fb9c0
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xb8f299
test dx, dx
je 0xb8f293
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xb8f299
add eax, esi
add ecx, esi
test dx, dx
jne 0xb8f273
xor ebx, ebx
mov eax, ebx
jmp 0xb8f2a0
sbb eax, eax
or eax, 1
xor ebx, ebx
test eax, eax
jne 0xb8f333
test edi, edi
je 0xb8f333
mov ecx, 0x9f98b0
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xb8f2db
test dx, dx
je 0xb8f2d7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xb8f2db
add eax, esi
add ecx, esi
test dx, dx
jne 0xb8f2b7
mov eax, ebx
jmp 0xb8f2e0
sbb eax, eax
or eax, 1
test eax, eax
jne 0xb8f333
push esi
lea eax, [ebp - 0xb88]
mov dword [ebp - 0xb88], ebx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
jne 0xb8f325
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb8f31c
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb8f345
mov ebx, 0x80004005
jmp 0xb8f345
test byte [ebp - 0xb88], 0xf
jne 0xb8f333
xor eax, eax
inc eax
jmp 0xb8f339
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0xc28], eax
mov ebx, dword [ebp - 0xb00]
test edi, edi
je 0xb8f169
push edi
xor esi, esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb8f16b
xor ebx, ebx
push 4
pop eax
push eax
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0xb2c], esi
test esi, esi
jne 0xb8f439
mov ebx, 0x8007000e
mov eax, dword [ebp - 0xb88]
mov dword [ebp - 0xc24], eax
xor edi, edi
mov edx, 0xc96238
inc edi
mov ecx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xb8f39a
mov eax, dword [0xc95890]
push 0
pop edx
test eax, eax
jle 0xb8f401
sub eax, 1
mov dword [0xc95890], eax
jne 0xb8f401
mov edi, edx
mov eax, dword [edi + 0xc960a0]
test eax, eax
je 0xb8f3cf
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xb8f3be
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xb2c]
xor edi, edi
inc edi
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
test esi, esi
je 0xb8f415
push esi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, dword [ebp - 0xc1c]
test ebx, ebx
jns 0xb98f01
cmp ebx, 0xd0000034
jne 0xb98eca
mov ebx, 0xc004f012
jmp 0xb98f1a
mov eax, ebx
mov dword [ebp - 0xadc], ebx
mov dword [ebp - 0xb04], eax
lea edi, [ebp - 0xdec]
mov dword [ebp - 0xdd8], eax
xor eax, eax
stosd dword es:[edi], eax
mov dword [ebp - 0xb00], ebx
mov dword [ebp - 0xb68], ebx
mov dword [ebp - 0xb64], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb60], eax
mov dword [ebp - 0xbac], 0x38
test eax, eax
jne 0xb8f5b1
mov ebx, 0xc0000017
mov dword [ebp - 0xb24], ebx
mov edi, dword [ebp - 0xadc]
mov eax, dword [ebp - 0xb04]
xor ecx, ecx
mov dword [ebp - 0xddc], ecx
mov dword [ebp - 0xde0], ecx
test eax, eax
je 0xb8f4d6
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0xdd8], ecx
mov eax, dword [ebp - 0xde4]
mov dword [ebp - 0xde8], ecx
mov dword [ebp - 0xdec], ecx
test eax, eax
je 0xb8f503
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0xde4], ecx
test edi, edi
je 0xb8f516
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb00]
test eax, eax
je 0xb8f531
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb8f386
mov eax, dword [ebp - 0xc28]
test eax, eax
je 0xb98eaf
mov dword [0xc95878], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x2cc]
push eax
push 0x9d0000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0xb96d34
cmp eax, esi
jne 0xb8f57f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0xb96d34
mov esi, dword [0xc9307c]
xor ebx, ebx
push 0x403
push ebx
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0xac0], eax
test eax, eax
jne 0xb92525
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb96d36
push 0x28
pop ecx
mov esi, 0xc94ea0
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, eax
mov dword [ebp - 0xadc], edi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb5c], ecx
test ecx, ecx
jne 0xb8f5f8
mov ebx, 0xc0000017
mov dword [ebp - 0xb24], ebx
mov esi, dword [ebp - 0xb2c]
jmp 0xb8f4a7
mov eax, dword [0xc94e98]
mov dword [ecx], eax
mov eax, dword [0xc94e9c]
mov dword [ecx + 4], eax
mov dword [ebp - 0xb00], ecx
rdtsc
mov dword [ebp - 0xb7c], eax
mov dword [ebp - 0xbb0], edx
lea eax, [ebp - 0xc4c]
mov dword [ebp - 0xc48], ebx
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov esi, dword [ebp - 0xc4c]
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
jns 0xb8f64e
mov esi, dword [ebp - 0xc54]
jmp 0xb8f5ed
lea eax, [ebp - 0xc48]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb24], ebx
jl 0xb8f5ed
lea eax, [ebp - 0xbd4]
mov edx, 0xa0
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8f5ed
mov esi, dword [ebp - 0xbd4]
mov ecx, dword [ebp - 0xc48]
lea eax, [ebp - 0xc48]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb24], ebx
jl 0xb8f5ed
lea eax, [ebp - 0xc58]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8f5ed
mov esi, dword [ebp - 0xc58]
mov ecx, dword [ebp - 0xc48]
lea eax, [ebp - 0xc48]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb24], ebx
jl 0xb8f5ed
lea eax, [ebp - 0xc60]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8f5ed
mov esi, dword [ebp - 0xc60]
mov ecx, dword [ebp - 0xc48]
lea eax, [ebp - 0xc48]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb24], ebx
jl 0xb8f5ed
lea eax, [ebp - 0xc70]
mov edx, SysReAllocString
push eax
mov ecx, 0xa177a8
call fcn.00a41606
test eax, eax
jns 0xb8f78e
mov ebx, 0xc000003e
jmp 0xb8f5e7
mov eax, dword [ebp - 0xc70]
inc eax
mov dword [ebp - 0xc70], eax
lea edx, [eax + eax]
lea eax, [ebp - 0xc74]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8f5ed
mov esi, dword [ebp - 0xc74]
mov ecx, dword [ebp - 0xc48]
lea eax, [ebp - 0xc48]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb24], ebx
jl 0xb8f5ed
lea eax, [ebp - 0xc78]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8f5ed
mov esi, dword [ebp - 0xc78]
mov ecx, dword [ebp - 0xc48]
lea eax, [ebp - 0xc48]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb24], ebx
jl 0xb8f5ed
lea eax, [ebp - 0xc84]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8f5ed
mov esi, dword [ebp - 0xc84]
mov ecx, dword [ebp - 0xc48]
lea eax, [ebp - 0xc48]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb24], ebx
jl 0xb8f5ed
push dword [ebp - 0xc48]
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xae0], edi
test edi, edi
jne 0xb8f8c6
mov ebx, 0xc0000017
mov dword [ebp - 0xb24], ebx
mov esi, dword [ebp - 0xb2c]
jmp 0xb8f4a1
mov eax, edi
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xdd8], eax
xor eax, eax
mov esi, eax
mov dword [ebp - 0xaec], esi
mov dword [ebp - 0xc88], eax
mov dword [ebp - 0xc8c], edi
push 4
pop ecx
lea eax, [ebp - 0xdc8]
mov dword [ebp - 0xdcc], ecx
mov edx, ecx
mov ecx, edi
push eax
call fcn.00a32533
mov ebx, eax
xor edx, edx
mov dword [ebp - 0xb24], ebx
mov ecx, edx
test ebx, ebx
js 0xb8f8bb
mov ecx, dword [ebp - 0xc48]
lea eax, [edi + 8]
add ecx, edi
cmp eax, ecx
jbe 0xb8f929
mov ebx, 0xc0000023
jmp 0xb8f8b5
push 4
pop eax
mov dword [edi], eax
mov eax, dword [ebp - 0xdc8]
mov dword [eax], edx
xor eax, eax
lea esi, [eax + 1]
mov dword [ebp - 0xaec], esi
lea ecx, [eax + 1]
test ebx, ebx
js 0xb8f8bb
mov dword [ebp - 0xa90], edx
mov eax, edi
mov dword [ebp - 0xcb4], eax
test ecx, ecx
je 0xb8f9d4
mov edx, dword [eax]
lea ecx, [ebp - 0xcb8]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8f98b
mov eax, dword [ebp - 0xcb8]
mov dword [ebp - 0xcbc], eax
jmp 0xb8f991
mov eax, dword [ebp - 0xcbc]
test ebx, ebx
js 0xb8f8bb
lea ecx, [ebp - 0xcb4]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xcb4]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8f8bb
mov eax, dword [ebp - 0xa90]
inc eax
mov dword [ebp - 0xa90], eax
cmp eax, esi
mov eax, dword [ebp - 0xcb4]
jb 0xb8f95e
lea ecx, [ebp - 0xd98]
mov dword [ebp - 0xd9c], 0xa0
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8f8bb
mov edx, dword [ebp - 0xcb4]
mov ecx, dword [ebp - 0xc48]
add ecx, edi
lea eax, [edx + 0xa4]
cmp eax, ecx
ja 0xb8f922
mov esi, dword [ebp - 0xb60]
mov edi, dword [ebp - 0xd98]
push 0x28
pop ecx
mov dword [edx], 0xa0
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xaec]
mov edi, dword [ebp - 0xae0]
inc esi
mov dword [ebp - 0xaec], esi
test ebx, ebx
js 0xb8f8bb
xor ecx, ecx
mov eax, edi
mov dword [ebp - 0xcc0], eax
mov dword [ebp - 0xa90], ecx
test esi, esi
je 0xb8fad9
mov edx, dword [eax]
lea ecx, [ebp - 0xcc4]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8fa90
mov eax, dword [ebp - 0xcc4]
mov dword [ebp - 0xcc8], eax
jmp 0xb8fa96
mov eax, dword [ebp - 0xcc8]
test ebx, ebx
js 0xb8f8bb
lea ecx, [ebp - 0xcc0]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xcc0]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8f8bb
mov eax, dword [ebp - 0xa90]
inc eax
mov dword [ebp - 0xa90], eax
cmp eax, esi
mov eax, dword [ebp - 0xcc0]
jb 0xb8fa63
lea ecx, [ebp - 0xda0]
mov dword [ebp - 0xda4], 8
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8f8bb
mov edx, dword [ebp - 0xcc0]
mov ecx, dword [ebp - 0xc48]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xb8f922
mov ecx, dword [ebp - 0xda0]
inc esi
mov dword [edx], 8
mov edx, dword [ebp - 0xb5c]
mov dword [ebp - 0xaec], esi
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
test ebx, ebx
js 0xb8f8bb
mov eax, dword [ebp - 0xb7c]
xor ecx, ecx
mov dword [ebp - 0xdbc], eax
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xdb8], eax
mov eax, edi
mov dword [ebp - 0xccc], eax
mov dword [ebp - 0xa90], ecx
test esi, esi
je 0xb8fbec
mov edx, dword [eax]
lea ecx, [ebp - 0xcd0]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8fba3
mov eax, dword [ebp - 0xcd0]
mov dword [ebp - 0xcd4], eax
jmp 0xb8fba9
mov eax, dword [ebp - 0xcd4]
test ebx, ebx
js 0xb8f8bb
lea ecx, [ebp - 0xccc]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xccc]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8f8bb
mov eax, dword [ebp - 0xa90]
inc eax
mov dword [ebp - 0xa90], eax
cmp eax, esi
mov eax, dword [ebp - 0xccc]
jb 0xb8fb76
lea ecx, [ebp - 0xdc0]
mov dword [ebp - 0xdc4], 8
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8f8bb
mov edx, dword [ebp - 0xccc]
mov ecx, dword [ebp - 0xc48]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xb8f922
mov eax, dword [ebp - 0xdc0]
inc esi
mov ecx, dword [ebp - 0xb7c]
mov dword [edx], 8
mov dword [ebp - 0xaec], esi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xbb0]
mov dword [eax + 4], ecx
test ebx, ebx
js 0xb8f8bb
lea eax, [ebp - 0xcd8]
mov edx, SysReAllocString
push eax
mov ecx, 0xa177a8
call fcn.00a41606
test eax, eax
jns 0xb8fc82
mov ebx, 0xc000003e
jmp 0xb8f8b5
mov ecx, dword [ebp - 0xcd8]
lea eax, [ebp - 0xcd8]
push eax
xor eax, eax
lea edx, [eax + 1]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8f8bb
mov eax, dword [ebp - 0xcd8]
add eax, eax
mov dword [ebp - 0xa90], eax
je 0xb8fdbf
xor ecx, ecx
mov eax, edi
mov dword [ebp - 0xcdc], eax
mov dword [ebp - 0xae0], ecx
test esi, esi
je 0xb8fd47
mov edx, dword [eax]
lea ecx, [ebp - 0xce0]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8fcfe
mov eax, dword [ebp - 0xce0]
mov dword [ebp - 0xce4], eax
jmp 0xb8fd04
mov eax, dword [ebp - 0xce4]
test ebx, ebx
js 0xb8f8bb
lea ecx, [ebp - 0xcdc]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xcdc]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8f8bb
mov eax, dword [ebp - 0xae0]
inc eax
mov dword [ebp - 0xae0], eax
cmp eax, esi
mov eax, dword [ebp - 0xcdc]
jb 0xb8fcd1
mov ecx, dword [ebp - 0xa90]
mov dword [ebp - 0xdd4], ecx
lea ecx, [ebp - 0xdd0]
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8f8bb
mov eax, dword [ebp - 0xa90]
mov ecx, dword [ebp - 0xc48]
add eax, 4
mov edx, dword [ebp - 0xcdc]
add ecx, edi
add eax, edx
cmp eax, ecx
jbe 0xb8fd9a
mov ebx, 0xc0000023
jmp 0xb8fdc4
mov eax, dword [ebp - 0xa90]
push eax
push 0xa177a8
push dword [ebp - 0xdd0]
mov dword [edx], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
inc esi
mov dword [ebp - 0xaec], esi
jmp 0xb8fdca
mov ebx, 0xc000000d
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8f8bb
mov eax, dword [ebp - 0xc28]
xor ecx, ecx
mov dword [ebp - 0xce8], eax
mov eax, edi
mov dword [ebp - 0xcec], eax
mov dword [ebp - 0xa90], ecx
test esi, esi
je 0xb8fe68
mov edx, dword [eax]
lea ecx, [ebp - 0xcf4]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8fe1f
mov eax, dword [ebp - 0xcf4]
mov dword [ebp - 0xcf8], eax
jmp 0xb8fe25
mov eax, dword [ebp - 0xcf8]
test ebx, ebx
js 0xb8f8bb
lea ecx, [ebp - 0xcec]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xcec]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8f8bb
mov eax, dword [ebp - 0xa90]
inc eax
mov dword [ebp - 0xa90], eax
cmp eax, esi
mov eax, dword [ebp - 0xcec]
jb 0xb8fdf2
push 4
pop edx
lea ecx, [ebp - 0xd80]
mov dword [ebp - 0xd84], edx
push ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8f8bb
mov edx, dword [ebp - 0xcec]
mov ecx, dword [ebp - 0xc48]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xb8f922
mov ecx, dword [ebp - 0xc28]
inc esi
push 4
pop eax
mov dword [edx], eax
mov eax, dword [ebp - 0xd80]
mov dword [ebp - 0xaec], esi
mov dword [eax], ecx
test ebx, ebx
js 0xb8f8bb
push 4
xor ecx, ecx
mov eax, edi
mov dword [ebp - 0xd00], eax
mov dword [ebp - 0xa90], ecx
pop ebx
mov dword [ebp - 0xcfc], ebx
test esi, esi
je 0xb8ff59
mov edx, dword [eax]
lea ecx, [ebp - 0xd04]
push ecx
mov ecx, ebx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8ff11
mov eax, dword [ebp - 0xd04]
mov dword [ebp - 0xd08], eax
jmp 0xb8ff17
mov eax, dword [ebp - 0xd08]
test ebx, ebx
js 0xb8ffaa
lea ecx, [ebp - 0xd00]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xd00]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
push 4
test ebx, ebx
js 0xb8ffac
mov eax, dword [ebp - 0xa90]
inc eax
mov dword [ebp - 0xa90], eax
cmp eax, esi
mov eax, dword [ebp - 0xd00]
pop ebx
jb 0xb8fee7
lea ecx, [ebp - 0xd88]
mov dword [ebp - 0xd8c], ebx
push ecx
mov edx, ebx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb8ffaa
mov edx, dword [ebp - 0xd00]
mov ecx, dword [ebp - 0xc48]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xb8f922
mov eax, dword [ebp - 0xd88]
inc esi
push 4
pop ecx
mov dword [edx], ecx
mov dword [eax], ecx
mov dword [ebp - 0xaec], esi
jmp 0xb8ffad
push 4
pop ecx
test ebx, ebx
js 0xb8f8bb
lea eax, [ebp - 0xd0c]
mov edx, ecx
push eax
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0xd0c]
mov dword [ebp - 0xb24], ebx
test ebx, ebx
jns 0xb8ffdb
mov eax, dword [ebp - 0xd10]
mov dword [ebp - 0xa90], eax
test ebx, ebx
js 0xb901b5
mov dword [ebp - 0xd14], eax
lea eax, [ebp - 0xd18]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb9001d
mov edx, dword [ebp - 0xd18]
mov dword [ebp - 0xa90], edx
jmp 0xb90023
mov edx, dword [ebp - 0xa90]
test ebx, ebx
js 0xb901b5
mov ecx, dword [ebp - 0xd14]
lea eax, [ebp - 0xd14]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb901b5
lea eax, [ebp - 0xd1c]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb9007a
mov eax, dword [ebp - 0xd1c]
mov dword [ebp - 0xa90], eax
jmp 0xb90080
mov eax, dword [ebp - 0xa90]
test ebx, ebx
js 0xb901b5
lea ecx, [ebp - 0xd14]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xd14]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb901b5
lea eax, [ebp - 0xd20]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb900d9
mov eax, dword [ebp - 0xd20]
mov dword [ebp - 0xa90], eax
jmp 0xb900df
mov eax, dword [ebp - 0xa90]
test ebx, ebx
js 0xb901b5
lea ecx, [ebp - 0xd14]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xd14]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb901b5
lea eax, [ebp - 0xd24]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb90138
mov eax, dword [ebp - 0xd24]
mov dword [ebp - 0xa90], eax
jmp 0xb9013e
mov eax, dword [ebp - 0xa90]
test ebx, ebx
js 0xb901b5
lea ecx, [ebp - 0xd14]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xd14]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb901b5
lea eax, [ebp - 0xb80]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xb24], ebx
test ebx, ebx
jns 0xb9018f
mov eax, dword [ebp - 0xa90]
jmp 0xb901b5
lea ecx, [ebp - 0xd14]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xd14]
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0xd14]
mov dword [ebp - 0xb24], ebx
test ebx, ebx
jns 0xb901bb
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xa90], eax
test ebx, ebx
js 0xb8f8bb
xor edx, edx
mov dword [ebp - 0xae0], edx
mov dword [ebp - 0xb60], edx
mov dword [ebp - 0xb5c], edx
mov dword [ebp - 0xac8], edx
mov dword [ebp - 0xab0], edx
mov dword [ebp - 0xaa8], edx
mov dword [ebp - 0xabc], edx
mov dword [ebp - 0xaa4], edx
mov dword [ebp - 0xa8c], edx
mov dword [ebp - 0xa9c], edx
rdtsc
mov dword [ebp - 0xb24], eax
mov dword [ebp - 0xa94], edx
push 8
pop ecx
mov dword [ebp - 0xd28], ecx
mov edx, dword [ebp - 0xc48]
lea eax, [ebp - 0xd28]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb90338
mov eax, dword [ebp - 0xd28]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0xad8], ecx
cmp ecx, eax
jae 0xb9025a
mov ebx, 0xc0000095
jmp 0xb90338
mov dword [ebp - 0xd28], ecx
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xab4], eax
test eax, eax
jne 0xb90284
mov ebx, 0xc0000017
jmp 0xb90338
lea ecx, [ebp - 0xd2c]
mov dword [ebp - 0xd2c], eax
push ecx
push 4
pop ecx
mov edx, ecx
mov dword [eax], esi
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb9031d
mov ecx, dword [ebp - 0xd2c]
mov eax, dword [ebp - 0xc48]
mov dword [ecx], eax
lea eax, [ebp - 0xd2c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0xab4]
test ebx, ebx
js 0xb90323
mov ecx, dword [ebp - 0xad8]
push dword [ebp - 0xc48]
mov edx, dword [ebp - 0xb24]
push edi
push dword [ebp - 0xd2c]
mov dword [eax + ecx - 8], edx
mov edx, dword [ebp - 0xa94]
mov dword [eax + ecx - 4], edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xab4]
add esp, 0xc
mov ecx, dword [ebp - 0xad8]
xor edx, edx
mov dword [ebp - 0xae0], eax
mov eax, edx
mov dword [ebp - 0xb60], ecx
jmp 0xb90325
mov eax, dword [ebp - 0xab4]
xor edx, edx
test eax, eax
je 0xb90338
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or ebx, 0x10000000
mov dword [ebp - 0xb24], ebx
jl 0xb91e28
xor ecx, ecx
mov dword [ebp - 0xab4], ecx
cmp dword [ebp - 0xae0], ecx
jne 0xb90364
mov ebx, 0xc000000d
jmp 0xb90a22
mov ebx, dword [ebp - 0xb60]
test ebx, ebx
je 0xb90b01
lea eax, [ebx + 8]
push eax
push ecx
mov dword [ebp - 0xad8], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xa94], edi
test edi, edi
je 0xb90b01
xor eax, eax
mov cl, al
mov edx, eax
test ebx, ebx
je 0xb903b8
mov edi, dword [ebp - 0xae0]
xor cl, byte [edx + edi]
inc edx
cmp edx, ebx
jb 0xb903aa
mov edi, dword [ebp - 0xa94]
mov eax, 0xb1b54a58
mov esi, 0xc81ecb17
mov dword [ebp - 0x380], eax
mov eax, ebx
shr eax, 3
mov dword [ebp - 0x37c], esi
mov dword [ebp - 0xb24], eax
test eax, eax
je 0xb90842
movzx eax, word [ebp - 0x37a]
mov ebx, 0xb1b54a58
movzx edx, word [ebp - 0x37e]
add edi, 7
mov dword [ebp - 0xaa0], eax
movzx eax, bx
mov dword [ebp - 0xaac], eax
mov eax, 0xc81ecb17
xor eax, ebx
mov dword [ebp - 0xa88], edi
mov edi, dword [ebp - 0xae0]
movzx esi, si
add edi, 2
mov dword [ebp - 0xad4], eax
xor eax, eax
mov dword [ebp - 0xa98], edx
or edx, 0xffffffff
mov dword [ebp - 0xac4], esi
mov esi, eax
mov dword [ebp - 0xae8], edi
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xad0], eax
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xae8]
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xae8]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xae8]
shl edi, 8
add dword [ebp - 0xae8], 8
movzx eax, byte [eax + 5]
or edi, eax
mov eax, ebx
xor edx, edi
xor eax, esi
mov dword [ebp - 0xab8], edx
mov esi, 0xb1b54a58
sub edx, dword [ebp - 0xaac]
xor edx, 0xc81ecb17
xor eax, edx
mov edx, eax
mov dword [ebp - 0xac0], eax
xor edx, 0xc81ecb17
ror eax, 7
ror edx, 0xf
imul edx, dword [ebp - 0xa98]
add eax, edx
mov edx, dword [ebp - 0xab8]
xor edx, eax
mov dword [ebp - 0xab8], edx
mov eax, edx
ror eax, 0xa
lea esi, [edx + esi]
mov edx, dword [ebp - 0xac4]
ror esi, 9
imul edx, esi
sub edx, eax
mov eax, dword [ebp - 0xac0]
xor eax, edx
mov esi, eax
mov dword [ebp - 0xac0], eax
xor esi, dword [ebp - 0xac4]
mov edx, eax
mov eax, dword [ebp - 0xaa0]
rol esi, 4
imul eax, esi
mov esi, dword [ebp - 0xab8]
rol edx, 5
add edx, eax
xor esi, edx
mov edx, 0xc81ecb17
mov eax, esi
xor eax, 0xb1b54a58
sub edx, eax
mov eax, dword [ebp - 0xac0]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xac0], eax
sub edx, dword [ebp - 0xaac]
imul edx, dword [ebp - 0xa98]
shr eax, 6
sub edx, eax
xor esi, edx
mov edx, dword [ebp - 0xac0]
mov eax, esi
ror eax, 0xf
xor eax, dword [ebp - 0xac4]
imul eax, dword [ebp - 0xaac]
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [ebp - 0xaa0]
imul eax, dword [ebp - 0xac4]
xor esi, eax
mov eax, esi
sub eax, 0xc81ecb17
sub eax, dword [ebp - 0xaac]
xor edx, eax
mov dword [ebp - 0xac0], edx
mov eax, dword [ebp - 0xac0]
xor eax, dword [ebp - 0xaa0]
imul eax, dword [ebp - 0xa98]
ror edx, 0xa
xor edx, eax
mov eax, dword [ebp - 0xac4]
xor esi, edx
mov dword [ebp - 0xab8], esi
xor esi, dword [ebp - 0xaac]
mov edx, dword [ebp - 0xab8]
ror edx, 3
rol esi, 6
imul eax, esi
mov esi, dword [ebp - 0xab8]
xor edx, eax
mov eax, dword [ebp - 0xac0]
xor eax, edx
mov dword [ebp - 0xac0], eax
ror eax, 0xf
sub eax, dword [ebp - 0xaa0]
imul eax, dword [ebp - 0xaac]
xor esi, eax
mov edx, esi
mov eax, esi
xor edx, dword [ebp - 0xaa0]
imul edx, dword [ebp - 0xaac]
shr eax, 1
xor edx, eax
mov eax, esi
xor dword [ebp - 0xac0], edx
sub eax, dword [ebp - 0xac4]
mov edx, dword [ebp - 0xaac]
rol eax, 3
imul edx, eax
mov eax, esi
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0xac0]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xac0], eax
sub edx, dword [ebp - 0xac4]
imul edx, dword [ebp - 0xa98]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xac4]
xor esi, edx
mov dword [ebp - 0xab8], esi
mov esi, 0xb1b54a58
mov edx, dword [ebp - 0xab8]
sub esi, edx
ror esi, 9
imul eax, esi
mov esi, dword [ebp - 0xac0]
ror edx, 0xb
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xab8]
mov eax, esi
sub eax, dword [ebp - 0xaa0]
sub eax, 0xb1b54a58
xor edx, eax
mov eax, edx
mov dword [ebp - 0xab8], edx
xor edx, dword [ebp - 0xa98]
imul edx, dword [ebp - 0xaac]
ror eax, 7
sub edx, eax
xor esi, edx
mov dword [ebp - 0xac0], esi
xor esi, dword [ebp - 0xaa0]
mov edx, dword [ebp - 0xa98]
mov eax, dword [ebp - 0xac0]
ror eax, 0x10
rol esi, 4
imul edx, esi
mov esi, 0xb1b54a58
sub edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
sub esi, eax
mov dword [ebp - 0xab8], eax
mov edx, eax
ror esi, 0xa
mov eax, dword [ebp - 0xac4]
imul eax, esi
ror edx, 4
add edx, eax
mov eax, dword [ebp - 0xac0]
xor eax, edx
mov esi, eax
mov dword [ebp - 0xac0], eax
mov edx, eax
sub esi, 0xb1b54a58
mov eax, dword [ebp - 0xaa0]
ror esi, 4
imul eax, esi
ror edx, 9
xor edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov edx, dword [ebp - 0xaac]
mov esi, eax
mov dword [ebp - 0xab8], eax
xor esi, 0xc81ecb17
rol eax, 2
rol esi, 8
imul edx, esi
mov esi, 0xc81ecb17
sub edx, eax
mov eax, dword [ebp - 0xac0]
xor eax, edx
mov edx, dword [ebp - 0xa98]
sub esi, eax
mov dword [ebp - 0xac0], eax
ror eax, 0xc
ror esi, 0xb
imul edx, esi
mov esi, dword [ebp - 0xac0]
sub edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xab8], eax
xor edx, dword [ebp - 0xa98]
imul edx, dword [ebp - 0xac4]
shr eax, 8
xor edx, eax
mov eax, dword [ebp - 0xad4]
xor esi, edx
mov edx, dword [ebp - 0xab8]
xor eax, esi
mov dword [ebp - 0xac0], esi
xor edx, eax
mov eax, esi
mov esi, dword [ebp - 0xa88]
xor eax, dword [ebp - 0xae4]
xor edx, dword [ebp - 0xad0]
mov byte [esi - 4], al
mov byte [esi], dl
ror eax, 8
mov byte [esi - 5], al
ror edx, 8
mov byte [esi - 1], dl
ror eax, 8
mov byte [esi - 6], al
ror edx, 8
ror eax, 8
mov byte [esi - 2], dl
ror edx, 8
mov byte [esi - 7], al
mov byte [esi - 3], dl
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xb24], 1
mov dword [ebp - 0xad0], edi
mov edi, dword [ebp - 0xae8]
mov dword [ebp - 0xa88], esi
mov esi, eax
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xae4], ebx
jne 0xb9044a
mov ebx, dword [ebp - 0xb60]
mov edi, dword [ebp - 0xa94]
movzx eax, cl
cdq
mov dword [edi + ebx], eax
mov dword [edi + ebx + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xac0], esi
test esi, esi
jne 0xb90874
mov ebx, 0xc0000017
jmp 0xb90987
mov ebx, dword [ebp - 0xad8]
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xb9089c
mov ebx, 0xc0000017
xor edx, edx
jmp 0xb90920
mov dword [esi + 4], eax
push ebx
push edi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [esi + 8], eax
push eax
push 8
pop ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb90890
mov dword [esi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xac0]
push ebx
push ebx
mov dword [esi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, dword [ebp - 0xa94]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xb90904
mov ebx, 0xc0000017
jmp 0xb90920
mov dword [esi + 0x14], ecx
mov ebx, edx
mov eax, dword [0xc94e90]
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ebp - 0xab4], esi
mov esi, edx
mov dword [ecx + 4], eax
test esi, esi
je 0xb90987
cmp dword [esi + 4], 0
je 0xb90940
push dword [esi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 4], edx
cmp dword [esi + 0xc], 0
je 0xb9095c
push dword [esi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0xc], edx
cmp dword [esi + 0x14], 0
je 0xb90978
push dword [esi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0x14], edx
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb9099d
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0xb5c], eax
xor eax, eax
mov esi, eax
jmp 0xb909a3
mov esi, dword [ebp - 0xab4]
push edi
xor edi, edi
push edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
je 0xb90a1c
cmp dword [esi + 4], edi
je 0xb909d5
push dword [esi + 4]
push edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
jmp 0xb909d7
xor eax, eax
cmp dword [esi + 0xc], edi
je 0xb909f2
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], edi
je 0xb90a0d
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xaec]
or ebx, 0x10000000
mov dword [ebp - 0xb24], ebx
jl 0xb91e28
mov edi, dword [ebp - 0xb5c]
lea eax, [ebp - 0xd30]
push 4
pop ecx
push eax
mov edx, dword [edi]
mov dword [ebp - 0xd30], ecx
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb90acd
mov ecx, dword [ebp - 0xd30]
lea eax, [ebp - 0xd30]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb90acd
mov edx, dword [edi + 8]
lea eax, [ebp - 0xd30]
mov ecx, dword [ebp - 0xd30]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb90acd
mov ecx, dword [ebp - 0xd30]
lea eax, [ebp - 0xd30]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb90acd
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0xd30]
mov ecx, dword [ebp - 0xd30]
push eax
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0xd30]
test ebx, ebx
jns 0xb90ad3
mov eax, dword [ebp - 0xd34]
mov dword [ebp - 0xac0], eax
test ebx, ebx
js 0xb90c5a
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xb90b0b
mov ebx, 0xc0000017
jmp 0xb90c5a
mov ebx, 0xc0000001
jmp 0xb90a22
mov eax, dword [ebp - 0xb5c]
mov ecx, edi
mov dword [ebp - 0xd38], edi
mov eax, dword [eax]
mov dword [edi], eax
lea eax, [ebp - 0xd38]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb90c45
mov ebx, dword [ebp - 0xb5c]
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0xd38]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx]
lea eax, [ebp - 0xd38]
mov ecx, dword [ebp - 0xd38]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb90c45
mov eax, dword [ebp - 0xb5c]
mov ecx, dword [ebp - 0xd38]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xd38]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb90c45
mov ebx, dword [ebp - 0xb5c]
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0xd38]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xd38]
mov ecx, dword [ebp - 0xd38]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb90c45
mov eax, dword [ebp - 0xb5c]
mov ecx, dword [ebp - 0xd38]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xd38]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb90c45
mov ebx, dword [ebp - 0xb5c]
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0xd38]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xd38]
mov ecx, dword [ebp - 0xd38]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
xor ecx, ecx
test ebx, ebx
js 0xb90c47
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0xac8], edi
mov edi, ecx
mov dword [ebp - 0xab0], eax
jmp 0xb90c47
xor ecx, ecx
test edi, edi
je 0xb90c5a
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, 0x10000000
or ebx, edi
mov dword [ebp - 0xb24], ebx
jl 0xb91e28
xor eax, eax
mov dword [ebp - 0xd3c], 8
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xab8], eax
mov edx, dword [ebp - 0xa90]
lea eax, [ebp - 0xd3c]
push eax
push 8
pop ecx
call fcn.00a32533
mov ebx, eax
or ebx, edi
mov dword [ebp - 0xb24], ebx
jl 0xb90dc9
mov eax, dword [ebp - 0xd3c]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xb90cc7
mov ebx, 0xc0000095
mov dword [ebp - 0xb24], ebx
jmp 0xb90cee
mov dword [ebp - 0xd44], ecx
lea eax, [ebp - 0xd44]
push eax
push 8
pop edx
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0xd44]
mov dword [ebp - 0xb24], ebx
test ebx, ebx
jns 0xb90cf4
mov eax, dword [ebp - 0xd40]
mov dword [ebp - 0xad0], eax
test ebx, ebx
js 0xb90f78
mov eax, dword [ebp - 0xb04]
xor edi, edi
inc edi
test eax, eax
jne 0xb90d1f
mov ebx, 0xc000000d
mov dword [ebp - 0xb24], ebx
jmp 0xb90dcc
cmp esi, edi
jbe 0xb90d0f
mov ecx, eax
xor eax, eax
mov dword [ebp - 0xd48], ecx
mov edi, eax
mov eax, dword [ecx]
mov dword [ebp - 0xae4], eax
lea eax, [ebp - 0xd48]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb90dc9
mov edx, dword [ebp - 0xae4]
lea eax, [ebp - 0xd48]
mov ecx, dword [ebp - 0xd48]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb90dc9
mov ecx, dword [ebp - 0xd48]
xor eax, eax
inc edi
inc eax
cmp edi, eax
jb 0xb90d2f
mov edi, dword [ecx]
lea eax, [ebp - 0xd48]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb90dc9
mov dword [ebp - 0xac0], edi
neg edi
sbb edi, edi
and dword [ebp - 0xd48], edi
test ebx, ebx
js 0xb90dc9
cmp esi, 2
ja 0xb90e02
mov ebx, 0xc000000d
mov dword [ebp - 0xb24], ebx
xor edi, edi
inc edi
mov esi, dword [ebp - 0xabc]
test ebx, ebx
js 0xb91e28
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xb90f86
mov ecx, dword [ebp - 0xaa8]
mov ebx, 0xd0000017
jmp 0xb90f93
mov ecx, dword [ebp - 0xb04]
xor eax, eax
mov dword [ebp - 0xd4c], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xd4c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb90e8a
mov ecx, dword [ebp - 0xd4c]
lea eax, [ebp - 0xd4c]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb90e8a
mov ecx, dword [ebp - 0xd4c]
inc esi
cmp esi, 2
jb 0xb90e12
mov esi, dword [ecx]
lea eax, [ebp - 0xd4c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb90e8a
mov edi, esi
neg esi
sbb esi, esi
and dword [ebp - 0xd4c], esi
jmp 0xb90e90
mov edi, dword [ebp - 0xab8]
test ebx, ebx
js 0xb90dc9
mov edx, dword [ebp - 0xad0]
lea eax, [ebp - 0xd50]
push 4
pop esi
push eax
mov ecx, esi
mov dword [ebp - 0xd50], esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb90f4f
mov ecx, dword [ebp - 0xd50]
lea eax, [ebp - 0xd50]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb90f4f
mov edx, dword [ebp - 0xac0]
lea eax, [ebp - 0xd50]
mov ecx, dword [ebp - 0xd50]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb90f4f
mov ecx, dword [ebp - 0xd50]
lea eax, [ebp - 0xd50]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb90f4f
mov ecx, dword [ebp - 0xd50]
lea eax, [ebp - 0xd50]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0xd50]
mov dword [ebp - 0xb24], ebx
test ebx, ebx
jns 0xb90f5d
mov eax, dword [ebp - 0xd54]
test ebx, ebx
js 0xb90dc9
cmp eax, 0x400000
jbe 0xb90f6e
mov ebx, 0x8000ffff
jmp 0xb91e22
mov esi, eax
mov dword [ebp - 0xabc], esi
jmp 0xb90f7e
mov esi, dword [ebp - 0xabc]
xor edi, edi
inc edi
jmp 0xb90dd2
mov ecx, eax
mov dword [ebp - 0xaa8], ecx
mov ebx, 0x10000000
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb91e28
mov eax, dword [ebp - 0xac8]
test eax, eax
jne 0xb90fb5
mov ebx, 0x80070057
jmp 0xb91e22
test ecx, ecx
je 0xb90fab
mov dword [ebp - 0xe74], eax
xor ebx, ebx
mov eax, dword [ebp - 0xab0]
mov dword [ebp - 0xe6c], eax
lea eax, [ebp - 0xd58]
push eax
push 0x9f29b8
push edi
mov dword [ebp - 0xe70], ecx
mov dword [ebp - 0xe68], esi
mov dword [ebp - 0xe64], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xb9102c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
jle 0xb91019
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb910ab
mov ebx, 0x80004005
mov dword [ebp - 0xb24], ebx
jmp 0xb910ab
push 0x9fc030
push dword [ebp - 0xd58]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0xb9106e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
jle 0xb91066
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xb24], ebx
test ebx, ebx
mov esi, dword [ebp - 0xabc]
jmp 0xb91019
push ebx
push 0x14
lea eax, [ebp - 0xe74]
mov ecx, esi
push eax
push 0x86
call dword [0xc99200]
call esi
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb24], ebx
jl 0xb910a5
mov esi, dword [ebp - 0xe68]
mov dword [ebp - 0xabc], esi
jmp 0xb910ab
mov esi, dword [ebp - 0xabc]
cmp ebx, 0xd0000023
jne 0xb910bd
mov ebx, 0x8007007a
jmp 0xb91e22
test ebx, ebx
js 0xb91e28
mov eax, dword [ebp - 0xaa8]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xb8c], ecx
mov edi, ecx
mov dword [ebp - 0xb70], eax
cmp esi, edx
jae 0xb910ec
mov ebx, 0xc000003e
jmp 0xb914cf
mov esi, dword [eax]
lea ecx, [ebp - 0xb70]
push ecx
mov ecx, eax
mov dword [ebp - 0xac0], esi
call fcn.00a32533
mov ebx, eax
xor ecx, ecx
test ebx, ebx
js 0xb914cf
lea eax, [ebp - 0xb8c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb914cd
mov eax, dword [ebp - 0xabc]
sub eax, dword [ebp - 0xb8c]
cmp eax, esi
jae 0xb91143
mov ebx, 0xc000003e
jmp 0xb914cd
mov eax, dword [ebp - 0xb70]
lea ecx, [ebp - 0xb70]
push ecx
mov edx, esi
mov dword [ebp - 0xab8], eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb914cd
mov ecx, dword [ebp - 0xb8c]
lea eax, [ebp - 0xb8c]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb914cd
mov eax, dword [ebp - 0xabc]
sub eax, dword [ebp - 0xb8c]
push 4
pop edx
cmp eax, edx
jb 0xb91139
mov ecx, dword [ebp - 0xb70]
lea eax, [ebp - 0xb70]
push eax
mov esi, dword [ecx]
mov dword [ebp - 0xad0], esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb914cd
mov ecx, dword [ebp - 0xb8c]
lea eax, [ebp - 0xb8c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb914cd
mov eax, dword [ebp - 0xabc]
sub eax, dword [ebp - 0xb8c]
cmp eax, esi
jb 0xb91139
mov eax, dword [ebp - 0xb70]
lea ecx, [ebp - 0xb70]
push ecx
mov edx, esi
mov dword [ebp - 0xae4], eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb914cd
mov ecx, dword [ebp - 0xb8c]
lea eax, [ebp - 0xb8c]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb914cd
mov eax, dword [ebp - 0xabc]
sub eax, dword [ebp - 0xb8c]
push 4
pop edx
cmp eax, edx
jb 0xb91139
mov ecx, dword [ebp - 0xb70]
mov eax, dword [ecx]
mov dword [ebp - 0xae8], eax
lea eax, [ebp - 0xb70]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb914cd
mov ecx, dword [ebp - 0xb8c]
lea eax, [ebp - 0xb8c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb914cd
mov eax, dword [ebp - 0xabc]
sub eax, dword [ebp - 0xb8c]
mov ecx, dword [ebp - 0xae8]
cmp eax, ecx
jb 0xb91139
lea eax, [ebp - 0xb8c]
mov edx, ecx
mov ecx, dword [ebp - 0xb8c]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb914cd
mov ecx, dword [ebp - 0xabc]
mov eax, ecx
sub eax, dword [ebp - 0xb8c]
jne 0xb91139
mov eax, dword [ebp - 0xae8]
mov ebx, dword [ebp - 0xac0]
add eax, 0xc
add eax, esi
add eax, ebx
cmp eax, ecx
jne 0xb91139
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xb9131b
mov ebx, 0xc0000017
jmp 0xb91458
cmp dword [ebp - 0xab8], edi
je 0xb9135c
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xb91345
mov ebx, 0xc0000017
xor eax, eax
jmp 0xb913f1
mov dword [esi + 4], eax
push ebx
push dword [ebp - 0xab8]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb91363
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
cmp dword [ebp - 0xae4], edi
je 0xb9139f
mov ebx, dword [ebp - 0xad0]
push ebx
push 8
mov dword [esi + 8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb91339
mov dword [esi + 0xc], eax
push ebx
push dword [ebp - 0xae4]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb913a5
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
cmp dword [ebp - 0xb70], edi
je 0xb913e5
mov ebx, dword [ebp - 0xae8]
push ebx
push 8
mov dword [esi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb91339
mov dword [esi + 0x14], eax
push ebx
push dword [ebp - 0xb70]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb913eb
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov edi, esi
mov ebx, eax
mov esi, eax
test esi, esi
je 0xb91458
cmp dword [esi + 4], 0
je 0xb91411
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xb9142d
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xb91449
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test ebx, ebx
js 0xb91466
mov dword [ebp - 0xaa4], edi
mov edi, ecx
test edi, edi
je 0xb914cf
cmp dword [edi + 4], 0
je 0xb91486
push dword [edi + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 4], ecx
cmp dword [edi + 0xc], 0
je 0xb914a2
push dword [edi + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0xc], ecx
cmp dword [edi + 0x14], 0
je 0xb914be
push dword [edi + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0x14], ecx
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov edi, dword [ebp - 0xaa4]
or ebx, 0x10000000
mov dword [ebp - 0xb24], ebx
jl 0xb91e2e
mov dword [ebp - 0xab8], ecx
mov esi, ecx
mov dword [ebp - 0xac0], esi
test edi, edi
jne 0xb91509
mov ebx, 0xd000000d
mov dword [ebp - 0xb24], ebx
jmp 0xb91e2e
mov ebx, dword [edi + 4]
mov dword [ebp - 0xad0], ebx
test ebx, ebx
je 0xb914f9
mov edi, dword [edi]
test edi, edi
jne 0xb91526
mov ebx, 0xd000000d
jmp 0xb91e22
add edi, 0xfffffff8
mov dword [ebp - 0xae4], ecx
push edi
push ecx
mov dword [ebp - 0xae8], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xa88], eax
test eax, eax
je 0xb91b91
mov esi, 0xab69605e
mov dword [ebp - 0xad4], ebx
mov dword [ebp - 0x378], esi
xor ecx, ecx
mov esi, 0x7f1137f
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0x374], esi
mov dl, cl
mov esi, edi
mov dword [ebp - 0xaa0], ecx
and esi, 7
je 0xb91b38
mov dword [ebp - 0xa98], ecx
mov eax, ecx
mov dword [ebp - 0xaac], eax
test esi, esi
je 0xb915e4
push 0x38
pop edi
movzx eax, byte [ebx]
inc ebx
cmp ecx, 4
jge 0xb915b4
lea ecx, [edi - 0x20]
shl eax, cl
or dword [ebp - 0xaac], eax
jmp 0xb915be
mov ecx, edi
shl eax, cl
or dword [ebp - 0xa98], eax
mov ecx, dword [ebp - 0xaa0]
sub edi, 8
inc ecx
mov dword [ebp - 0xaa0], ecx
cmp ecx, esi
jl 0xb9159e
mov edi, dword [ebp - 0xae8]
mov eax, dword [ebp - 0xaac]
mov dword [ebp - 0xad4], ebx
mov ebx, dword [ebp - 0xa98]
xor eax, 0x92f65a5
xor ebx, 0x699a899c
mov dword [ebp - 0xaa0], eax
xor ecx, ecx
mov dword [ebp - 0xab4], ebx
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xa94], ebx
test esi, esi
je 0xb9166c
mov edi, dword [ebp - 0xac4]
push 4
pop ebx
lea eax, [edi + 1]
mov dword [ebp - 0xac4], eax
cmp ecx, ebx
jge 0xb91638
rol dword [ebp - 0xad8], 8
mov eax, dword [ebp - 0xad8]
jmp 0xb91645
rol dword [ebp - 0xa94], 8
mov eax, dword [ebp - 0xa94]
mov byte [edi], al
inc ecx
mov eax, dword [ebp - 0xac4]
mov edi, eax
cmp ecx, esi
jl 0xb9161c
mov ebx, dword [ebp - 0xab4]
mov edi, dword [ebp - 0xae8]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0xaa0]
push 4
pop ecx
cmp esi, ecx
jbe 0xb91b11
push 8
pop ecx
sub ecx, esi
shl ecx, 3
shr ebx, cl
shl ebx, cl
mov dword [ebp - 0xab4], ebx
mov ebx, dword [ebp - 0xad4]
mov eax, edi
shr eax, 3
mov dword [ebp - 0xad4], eax
test eax, eax
je 0xb91ad2
movzx ecx, word [ebp - 0x376]
mov eax, 0x7f1137f
movzx esi, word [ebp - 0x372]
movzx eax, ax
mov dword [ebp - 0xa94], ecx
mov ecx, 0xab69605e
mov dword [ebp - 0xad8], eax
movzx eax, cx
mov ecx, dword [ebp - 0xab4]
mov dword [ebp - 0xab0], eax
mov eax, dword [ebp - 0xac4]
add eax, 7
mov dword [ebp - 0xabc], esi
mov dword [ebp - 0xac4], eax
lea esi, [ebx + 2]
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
add esi, 8
shl edi, 8
or edi, eax
mov dword [ebp - 0xa90], esi
mov eax, dword [ebp - 0xaa0]
xor ecx, edi
xor eax, ebx
mov esi, 0x7f1137f
mov dword [ebp - 0xaa0], eax
xor eax, esi
xor eax, 0xab69605e
xor ecx, eax
mov eax, dword [ebp - 0xad8]
mov esi, ecx
mov dword [ebp - 0xab4], ecx
sub esi, 0xab69605e
rol ecx, 0xa
rol esi, 5
imul eax, esi
mov esi, 0x7f1137f
add ecx, eax
mov eax, dword [ebp - 0xaa0]
xor eax, ecx
mov ecx, dword [ebp - 0xa94]
mov dword [ebp - 0xaa0], eax
lea esi, [eax + esi]
rol eax, 2
ror esi, 9
imul ecx, esi
sub ecx, eax
mov eax, dword [ebp - 0xab4]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xab4], eax
sub ecx, dword [ebp - 0xad8]
imul ecx, dword [ebp - 0xab0]
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0xaa0]
xor eax, ecx
mov ecx, dword [ebp - 0xabc]
mov esi, eax
mov dword [ebp - 0xaa0], eax
xor esi, dword [ebp - 0xa94]
rol esi, 6
imul ecx, esi
mov esi, dword [ebp - 0xaa0]
rol eax, 2
sub ecx, eax
mov eax, dword [ebp - 0xab4]
xor eax, ecx
mov ecx, 0x7f1137f
mov dword [ebp - 0xab4], eax
xor eax, 0xab69605e
sub ecx, eax
xor esi, ecx
mov eax, esi
mov ecx, esi
xor eax, dword [ebp - 0xad8]
imul eax, dword [ebp - 0xa94]
ror ecx, 6
xor ecx, eax
mov eax, dword [ebp - 0xab4]
xor eax, ecx
mov ecx, 0x7f1137f
add ecx, eax
mov dword [ebp - 0xab4], eax
rol eax, 2
ror ecx, 0xf
imul ecx, dword [ebp - 0xab0]
add eax, ecx
mov ecx, dword [ebp - 0xabc]
xor esi, eax
mov dword [ebp - 0xaa0], esi
sub esi, 0xab69605e
mov eax, dword [ebp - 0xaa0]
rol eax, 8
ror esi, 0xe
imul ecx, esi
sub ecx, eax
mov eax, dword [ebp - 0xab4]
xor eax, ecx
mov esi, eax
mov dword [ebp - 0xab4], eax
mov ecx, eax
xor esi, 0xab69605e
mov eax, dword [ebp - 0xad8]
ror ecx, 0xa
ror esi, 0xc
imul eax, esi
mov esi, dword [ebp - 0xaa0]
xor ecx, eax
xor esi, ecx
mov ecx, dword [ebp - 0xabc]
xor ecx, esi
mov eax, esi
imul ecx, dword [ebp - 0xa94]
shr eax, 0xa
xor ecx, eax
xor dword [ebp - 0xab4], ecx
mov ecx, dword [ebp - 0xab4]
mov eax, ecx
not eax
ror eax, 5
add eax, dword [ebp - 0xab0]
imul eax, dword [ebp - 0xabc]
xor esi, eax
mov eax, esi
sub eax, dword [ebp - 0xabc]
xor eax, 0xab69605e
xor ecx, eax
mov eax, ecx
mov dword [ebp - 0xab4], ecx
xor eax, dword [ebp - 0xabc]
mov ecx, dword [ebp - 0xad8]
rol eax, 2
imul ecx, eax
mov eax, dword [ebp - 0xab4]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov dword [ebp - 0xaa0], esi
sub esi, eax
mov eax, dword [ebp - 0xa94]
mov ecx, dword [ebp - 0xaa0]
ror esi, 6
imul eax, esi
rol ecx, 7
add ecx, eax
mov eax, dword [ebp - 0xab4]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xab4], eax
xor eax, dword [ebp - 0xad8]
imul eax, dword [ebp - 0xab0]
ror ecx, 9
add ecx, eax
mov eax, dword [ebp - 0xaa0]
xor eax, ecx
mov esi, eax
mov dword [ebp - 0xaa0], eax
xor esi, dword [ebp - 0xa94]
rol esi, 5
mov ecx, eax
mov eax, dword [ebp - 0xabc]
imul eax, esi
mov esi, 0x7f1137f
rol ecx, 7
add ecx, eax
xor dword [ebp - 0xab4], ecx
mov ecx, dword [ebp - 0xab4]
mov eax, ecx
xor eax, esi
mov esi, dword [ebp - 0xaa0]
xor eax, 0xab69605e
xor esi, eax
mov eax, esi
ror eax, 3
sub eax, dword [ebp - 0xa94]
imul eax, dword [ebp - 0xad8]
xor ecx, eax
mov eax, 0x7f1137f
mov dword [ebp - 0xab4], ecx
sub ecx, eax
mov eax, dword [ebp - 0xab4]
ror ecx, 1
imul ecx, dword [ebp - 0xab0]
ror eax, 6
sub ecx, eax
mov eax, dword [ebp - 0xabc]
xor esi, ecx
mov ecx, 0xab69605e
mov dword [ebp - 0xaa0], esi
lea ecx, [esi + ecx]
rol esi, 0xe
rol ecx, 3
imul eax, ecx
mov ecx, 0xab69605e
add esi, eax
xor dword [ebp - 0xab4], esi
mov esi, dword [ebp - 0xab4]
mov eax, esi
ror eax, 0xe
lea ecx, [esi + ecx]
rol ecx, 0xf
imul ecx, dword [ebp - 0xad8]
sub ecx, eax
mov eax, dword [ebp - 0xaa0]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xaa0], eax
xor ecx, dword [ebp - 0xab0]
imul ecx, dword [ebp - 0xa94]
shr eax, 3
xor ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov eax, esi
mov dword [ebp - 0xab4], esi
xor eax, ecx
mov ecx, esi
rol eax, 4
imul eax, dword [ebp - 0xab0]
rol ecx, 2
xor ecx, eax
mov eax, dword [ebp - 0xaa0]
xor ecx, dword [ebp - 0xaac]
xor eax, ecx
mov ecx, esi
mov esi, dword [ebp - 0xac4]
xor ecx, dword [ebp - 0xa98]
mov byte [esi - 4], al
mov byte [esi], cl
ror eax, 8
mov byte [esi - 5], al
ror ecx, 8
mov byte [esi - 1], cl
ror eax, 8
mov byte [esi - 6], al
ror ecx, 8
ror eax, 8
mov byte [esi - 2], cl
ror ecx, 8
mov byte [esi - 7], al
mov byte [esi - 3], cl
add esi, 8
ror eax, 8
ror ecx, 8
sub dword [ebp - 0xad4], 1
mov dword [ebp - 0xac4], esi
mov esi, dword [ebp - 0xa90]
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0xaac], ebx
mov dword [ebp - 0xa98], edi
jne 0xb916f0
mov edi, dword [ebp - 0xae8]
mov ebx, dword [ebp - 0xa88]
xor eax, eax
mov ecx, eax
test edi, edi
je 0xb91ae8
xor dl, byte [ecx + ebx]
inc ecx
cmp ecx, edi
jb 0xb91ae0
mov ecx, dword [ebp - 0xad0]
movzx eax, dl
cdq
cmp eax, dword [edi + ecx]
jne 0xb91b50
cmp edx, dword [edi + ecx + 4]
jne 0xb91b50
xor eax, eax
mov dword [ebp - 0xab8], edi
mov edi, dword [ebp - 0xae4]
mov esi, ebx
mov ebx, eax
jmp 0xb91b5d
xor ecx, ecx
push 4
mov dword [ebp - 0xab4], ecx
pop ecx
cmp esi, ecx
jae 0xb91689
sub ecx, esi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xaa0], eax
jmp 0xb91689
or dword [ebp - 0xa98], 0xffffffff
mov dword [ebp - 0xaac], ecx
mov dword [ebp - 0xab4], ecx
jmp 0xb9168f
mov esi, dword [ebp - 0xac0]
mov edi, 0xc004d501
xor eax, eax
test ebx, ebx
je 0xb91b70
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0xb91b91
mov edi, dword [ebp - 0xab8]
xor eax, eax
mov dword [ebp - 0xa8c], esi
mov ebx, 0x10000000
mov esi, eax
mov dword [ebp - 0xa9c], edi
jmp 0xb91b9e
mov edi, dword [ebp - 0xa9c]
mov ebx, 0xd0000001
xor eax, eax
mov dword [ebp - 0xb24], ebx
test esi, esi
je 0xb91bb7
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb91e28
mov ecx, dword [ebp - 0xa8c]
xor eax, eax
push 4
pop esi
mov dword [ebp - 0xb6c], eax
mov dword [ebp - 0xbb4], ecx
cmp edi, esi
jb 0xb91e17
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0xac0], eax
lea eax, [ebp - 0xbb4]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb91e1c
lea eax, [ebp - 0xb6c]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb91e1c
mov eax, edi
sub eax, dword [ebp - 0xb6c]
cmp eax, esi
jb 0xb91e17
mov ecx, dword [ebp - 0xbb4]
lea eax, [ebp - 0xbb4]
push eax
mov edx, esi
mov edi, dword [ecx]
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb91e1c
mov ecx, dword [ebp - 0xb6c]
lea eax, [ebp - 0xb6c]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb91e1c
mov eax, dword [ebp - 0xa9c]
mov ecx, dword [ebp - 0xb6c]
sub eax, ecx
cmp eax, edi
jb 0xb91e17
lea eax, [ebp - 0xb6c]
mov edx, edi
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb91e1c
mov esi, dword [ebp - 0xbb4]
mov edx, dword [ebp - 0xa9c]
mov ebx, dword [ebp - 0xa8c]
lea ecx, [esi + edi]
lea eax, [edx + ebx]
cmp eax, ecx
jb 0xb91e17
sub edx, esi
sub edx, edi
add edx, ebx
cmp edx, 8
jae 0xb91e17
xor ecx, ecx
mov dword [ebp - 0xad0], ecx
mov eax, ecx
mov dword [ebp - 0xab8], eax
mov ebx, ecx
test esi, esi
je 0xb91dae
lea eax, [ebp - 0xba8]
mov edx, edi
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb91e1c
mov eax, dword [ebp - 0xba8]
jmp 0xb91d96
lea eax, [ebp - 0xba4]
mov ecx, esi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb91e1c
mov eax, dword [ebp - 0xba8]
cmp dword [ebp - 0xba4], eax
ja 0xb91dd3
mov edx, dword [esi]
lea eax, [ebp - 0xb84]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb91d58
mov eax, dword [ebp - 0xb84]
mov dword [ebp - 0xd5c], eax
jmp 0xb91d5e
mov eax, dword [ebp - 0xd5c]
test ebx, ebx
js 0xb91e1c
lea ecx, [ebp - 0xb30]
mov edx, eax
push ecx
mov ecx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb91e1c
mov esi, dword [ebp - 0xb30]
mov eax, dword [ebp - 0xba8]
cmp esi, eax
ja 0xb91dd3
inc dword [ebp - 0xad0]
cmp esi, eax
jb 0xb91d02
cmp esi, eax
jne 0xb91dd3
mov esi, dword [ebp - 0xbb4]
mov eax, dword [ebp - 0xab8]
test edi, edi
je 0xb91dde
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xab8], eax
test eax, eax
jne 0xb91dda
mov ebx, 0xc0000017
jmp 0xb91e05
mov ebx, 0xc000000d
jmp 0xb91e1c
xor ecx, ecx
mov ebx, ecx
test esi, esi
je 0xb91df3
push edi
push esi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xab8]
add esp, 0xc
mov dword [ebp - 0xde4], eax
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0xdec], eax
test ebx, ebx
js 0xb91e1c
mov eax, dword [ebp - 0xac0]
cmp eax, dword [ebp - 0xdec]
je 0xb91e1c
mov ebx, 0xc000003e
or ebx, 0x10000000
mov dword [ebp - 0xb24], ebx
mov edi, dword [ebp - 0xaa4]
mov eax, dword [ebp - 0xae0]
test eax, eax
je 0xb91e49
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xb5c]
test esi, esi
je 0xb91eb7
xor eax, eax
cmp dword [esi + 4], eax
je 0xb91e70
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xb91e8c
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xb91ea8
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xac8]
xor esi, esi
test eax, eax
je 0xb91ed2
push eax
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xaa8]
test eax, eax
je 0xb91eeb
push eax
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xb91f56
cmp dword [edi + 4], 0
je 0xb91f0d
push dword [edi + 4]
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
jmp 0xb91f0f
xor eax, eax
cmp dword [edi + 0xc], 0
je 0xb91f2b
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xb91f47
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xa8c]
xor edi, edi
test eax, eax
je 0xb91f71
push eax
push edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb8f8bb
xor eax, eax
inc eax
cmp dword [ebp - 0xdec], eax
jae 0xb91f8e
mov ebx, 0xc004d501
jmp 0xb8f8b5
cmp dword [ebp - 0xde4], 0
jne 0xb9201e
mov ebx, 0xc000000d
mov dword [ebp - 0xb24], ebx
mov eax, dword [ebp - 0xb64]
push 4
pop edx
test ebx, ebx
js 0xb8f8bb
cmp eax, 0xd0000023
jne 0xb91fc9
mov eax, 0x8007007a
mov dword [ebp - 0xb64], eax
cmp eax, 0x8007007a
je 0xb91fe0
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test eax, eax
js 0xb8f8bb
cmp dword [ebp - 0xdec], 6
jne 0xb91f84
cmp dword [ebp - 0xde4], 0
jne 0xb92098
mov edx, dword [ebp - 0xda8]
mov ebx, 0xc000000d
mov ecx, dword [ebp - 0xdac]
mov dword [ebp - 0xb24], ebx
mov dword [ebp - 0xac0], edx
mov dword [ebp - 0xab8], ecx
jmp 0xb9216a
cmp dword [ebp - 0xdec], 0
jbe 0xb91f9b
mov eax, dword [ebp - 0xde4]
lea ecx, [ebp - 0xb34]
push ecx
push 4
pop ecx
mov esi, dword [eax]
mov edx, ecx
mov ecx, eax
mov dword [ebp - 0xb34], eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb9206c
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb34]
mov dword [ebp - 0xb34], eax
jmp 0xb92078
mov esi, dword [ebp - 0xbb8]
mov eax, dword [ebp - 0xbbc]
test ebx, ebx
js 0xb91fa6
push 4
pop edx
cmp esi, edx
jne 0xb8f922
mov eax, dword [eax]
mov dword [ebp - 0xb64], eax
jmp 0xb91faf
mov ecx, dword [ebp - 0xde4]
mov esi, edi
mov dword [ebp - 0xb0c], ecx
mov edi, dword [ecx]
lea eax, [ebp - 0xb0c]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb92126
mov ecx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xb0c]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb92126
mov ecx, dword [ebp - 0xb0c]
xor eax, eax
inc esi
inc eax
cmp esi, eax
jae 0xb920f3
push 4
pop edx
jmp 0xb920a6
mov esi, dword [ecx]
lea eax, [ebp - 0xb0c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb92126
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb0c]
mov dword [ebp - 0xb0c], eax
jmp 0xb92132
mov esi, dword [ebp - 0xbc0]
mov eax, dword [ebp - 0xbc4]
test ebx, ebx
js 0xb92152
cmp esi, 8
jne 0xb8f922
mov ecx, dword [eax]
mov dword [ebp - 0xab8], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xac0], ecx
jmp 0xb9216a
mov eax, dword [ebp - 0xda8]
mov dword [ebp - 0xac0], eax
mov eax, dword [ebp - 0xdac]
mov dword [ebp - 0xab8], eax
test ebx, ebx
js 0xb8f8bb
cmp dword [ebp - 0xde4], 0
jne 0xb921b4
mov ebx, 0xc000000d
mov dword [ebp - 0xb24], ebx
mov eax, dword [ebp - 0xbc8]
push 4
pop edx
mov dword [ebp - 0xad0], eax
test ebx, ebx
js 0xb8f8bb
cmp dword [ebp - 0xde4], 0
jne 0xb92268
mov ebx, 0xc000000d
jmp 0xb8f8b5
mov ecx, dword [ebp - 0xde4]
xor eax, eax
mov dword [ebp - 0xafc], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xafc]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb92242
mov ecx, dword [ebp - 0xafc]
lea eax, [ebp - 0xafc]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb92242
mov ecx, dword [ebp - 0xafc]
inc esi
cmp esi, 2
jb 0xb921c4
mov esi, dword [ecx]
lea eax, [ebp - 0xafc]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb92242
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xafc]
mov dword [ebp - 0xafc], eax
jmp 0xb9224e
mov esi, dword [ebp - 0xbcc]
mov eax, dword [ebp - 0xbd0]
test ebx, ebx
js 0xb92186
push 4
pop edx
cmp esi, edx
jne 0xb8f922
mov eax, dword [eax]
jmp 0xb9218f
mov ecx, dword [ebp - 0xde4]
xor eax, eax
mov dword [ebp - 0xacc], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xacc]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb922fc
mov ecx, dword [ebp - 0xacc]
lea eax, [ebp - 0xacc]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb922fc
mov ecx, dword [ebp - 0xacc]
inc esi
cmp esi, 3
jae 0xb922c3
push 4
pop edx
jmp 0xb92278
mov edi, dword [ecx]
lea eax, [ebp - 0xacc]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xae4], edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb922fc
mov esi, edi
neg esi
sbb esi, esi
and esi, dword [ebp - 0xacc]
mov dword [ebp - 0xacc], esi
jmp 0xb9230e
mov eax, dword [ebp - 0xcf0]
mov esi, dword [ebp - 0xbd8]
mov dword [ebp - 0xae4], eax
test ebx, ebx
js 0xb8f8bb
mov ecx, dword [ebp - 0xde4]
xor eax, eax
push 4
mov dword [ebp - 0xb28], ecx
mov edi, eax
pop edx
mov eax, dword [ecx]
mov dword [ebp - 0xae8], eax
lea eax, [ebp - 0xb28]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb923a9
mov edx, dword [ebp - 0xae8]
lea eax, [ebp - 0xb28]
mov ecx, dword [ebp - 0xb28]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb923a9
mov ecx, dword [ebp - 0xb28]
inc edi
push 4
pop edx
cmp edi, edx
jb 0xb92329
mov edi, dword [ecx]
lea eax, [ebp - 0xb28]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb923a9
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb28]
mov dword [ebp - 0xb28], eax
jmp 0xb923b5
mov edi, dword [ebp - 0xbe0]
mov eax, dword [ebp - 0xbe4]
push 4
pop edx
test ebx, ebx
js 0xb923c8
cmp edi, edx
jne 0xb8f922
mov eax, dword [eax]
jmp 0xb923ce
mov eax, dword [ebp - 0xbe8]
mov dword [ebp - 0xae8], eax
test ebx, ebx
js 0xb8f8bb
mov ecx, dword [ebp - 0xde4]
xor eax, eax
mov dword [ebp - 0xb20], ecx
mov edi, eax
mov eax, dword [ecx]
mov dword [ebp - 0xa88], eax
lea eax, [ebp - 0xb20]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb92474
mov edx, dword [ebp - 0xa88]
lea eax, [ebp - 0xb20]
mov ecx, dword [ebp - 0xb20]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb92474
mov ecx, dword [ebp - 0xb20]
inc edi
cmp edi, 5
jae 0xb92441
push 4
pop edx
jmp 0xb923ec
mov edi, dword [ecx]
lea eax, [ebp - 0xb20]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb24], ebx
test ebx, ebx
js 0xb92474
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb20]
mov dword [ebp - 0xb20], eax
jmp 0xb92480
mov edi, dword [ebp - 0xbf0]
mov eax, dword [ebp - 0xbf4]
push 4
pop edx
test ebx, ebx
js 0xb92493
cmp edi, edx
jne 0xb8f922
mov ecx, dword [eax]
jmp 0xb92499
mov ecx, dword [ebp - 0xb68]
test ebx, ebx
js 0xb8f8bb
mov eax, dword [ebp - 0xb7c]
cmp eax, dword [ebp - 0xab8]
jne 0xb91f84
mov eax, dword [ebp - 0xbb0]
cmp eax, dword [ebp - 0xac0]
jne 0xb91f84
mov dword [ebp - 0xc28], ecx
cmp dword [ebp - 0xae8], edx
jbe 0xb924e9
mov ecx, dword [ebp - 0xad0]
mov ebx, 0x8007007a
mov dword [ebp - 0xc24], ecx
jmp 0xb8f8b5
mov eax, dword [ebp - 0xae4]
cmp eax, edx
ja 0xb924d3
push eax
push esi
mov esi, dword [ebp - 0xb2c]
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xad0]
add esp, 0xc
mov dword [ebp - 0xc24], eax
mov eax, dword [ebp - 0xb64]
test eax, eax
je 0xb8f4a1
mov ebx, eax
jmp 0xb8f49b
mov esi, dword [0xc9304c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [0xc95870], eax
lea edi, [ebp - 0x3ac]
mov eax, dword [0xc95878]
mov dword [ebp - 0xab8], eax
xor eax, eax
stosd dword es:[edi], eax
push 0x2c
push ebx
mov dword [0xc95874], edx
stosd dword es:[edi], eax
mov dword [ebp - 0xdb4], ebx
mov dword [ebp - 0xdb0], ebx
mov dword [ebp - 0xad0], ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x49c]
push eax
mov dword [ebp - 0xae4], ebx
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0xae8], ebx
xor ebx, ebx
mov edx, 0xc96238
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xb9258d
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jne 0xb92bae
push 0x338
mov esi, ebx
mov dword [ebp - 0xa88], ebx
push ebx
mov dword [ebp - 0xad4], ebx
mov dword [ebp - 0xac4], esi
mov dword [ebp - 0xa98], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xaac], eax
test eax, eax
je 0xb92ba0
or dword [ebp - 0xab4], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x370], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xaa0], ebx
mov dword [ebp - 0x36c], edx
mov cl, bl
mov dword [ebp - 0xad8], ebx
mov edx, ebx
mov dword [ebp - 0xa94], eax
mov esi, 0x9fbcf2
mov dword [ebp - 0xa9c], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [ebp - 0xa8c], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [ebp - 0xaa4], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [ebp - 0xad8]
xor esi, edx
xor esi, 0xac987321
mov edx, esi
rol edx, 0xa
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul eax, eax, 0x137f
add edx, eax
mov eax, dword [ebp - 0xa8c]
xor eax, edx
mov dword [ebp - 0xa8c], eax
lea edx, [eax + 0x7f1137f]
rol eax, 2
ror edx, 9
imul edx, edx, 0xab69
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xa8c]
sub edx, 0x756c8a2
xor eax, edx
mov edx, eax
mov dword [ebp - 0xa8c], eax
xor edx, 0xab69
rol eax, 2
rol edx, 6
imul edx, edx, 0x7f1
sub edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
xor eax, 0xab69605e
sub edx, eax
mov eax, dword [ebp - 0xa8c]
xor eax, edx
mov dword [ebp - 0xa8c], eax
mov edx, eax
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
mov edx, esi
rol edx, 2
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul eax, eax, 0x605e
add edx, eax
mov eax, dword [ebp - 0xa8c]
xor eax, edx
mov dword [ebp - 0xa8c], eax
lea edx, [eax + 0x54969fa2]
rol eax, 8
ror edx, 0xe
imul edx, edx, 0x7f1
sub edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0xab69605e
ror edx, 0xa
ror eax, 0xc
imul eax, eax, 0x137f
xor edx, eax
mov eax, dword [ebp - 0xa8c]
xor eax, edx
mov dword [ebp - 0xa8c], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xa8c]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xa8c]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0xa8c], edx
add edx, 0xfffff80f
xor edx, esi
mov esi, dword [ebp - 0xa8c]
xor edx, 0xab69605e
mov eax, edx
mov dword [ebp - 0xad8], edx
xor eax, 0x7f1
shr edx, 2
rol eax, 2
imul eax, eax, 0x137f
add edx, eax
xor esi, edx
mov edx, esi
rol edx, 7
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul eax, eax, 0xab69
add edx, eax
mov eax, dword [ebp - 0xad8]
xor eax, edx
mov dword [ebp - 0xad8], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0xab69
rol esi, 7
rol eax, 5
imul eax, eax, 0x7f1
add esi, eax
mov eax, dword [ebp - 0xad8]
xor eax, esi
mov esi, eax
mov dword [ebp - 0xad8], eax
xor esi, edx
mov edx, dword [ebp - 0xad8]
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xad8], edx
add edx, 0xf80eec81
mov eax, dword [ebp - 0xad8]
ror edx, 1
ror eax, 6
imul edx, edx, 0x605e
sub edx, eax
xor esi, edx
mov edx, esi
rol edx, 0xe
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul eax, eax, 0x7f1
add edx, eax
mov eax, dword [ebp - 0xad8]
xor eax, edx
mov dword [ebp - 0xad8], eax
lea edx, [eax - 0x54969fa2]
ror eax, 0xe
rol edx, 0xf
imul edx, edx, 0x137f
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xad8]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xad8], eax
xor eax, edx
mov edx, dword [ebp - 0xad8]
rol eax, 4
imul eax, eax, 0x605e
rol edx, 2
xor edx, eax
mov eax, dword [ebp - 0xad8]
xor edx, dword [ebp - 0xaa0]
xor eax, dword [ebp - 0xab4]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xa8c], esi
mov esi, dword [ebp - 0xa94]
mov dword [ebp - 0xaa0], ebx
mov dword [ebp - 0xab4], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xa9c], 1
mov dword [ebp - 0xa94], esi
mov esi, dword [ebp - 0xaa4]
mov dword [ebp - 0xad8], eax
jne 0xb9262a
mov esi, dword [ebp - 0xaac]
xor eax, eax
mov edx, eax
xor cl, byte [edx + esi]
inc edx
cmp edx, 0x338
jb 0xb92993
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xb929c6
cmp edx, dword [0x9fc02c]
jne 0xb929c6
mov edi, esi
xor eax, eax
mov dword [ebp - 0xac4], edi
mov esi, eax
mov ebx, 0x337
jmp 0xb929db
mov edi, dword [ebp - 0xac4]
or ebx, 0xffffffff
mov dword [ebp - 0xa98], 0xc004d501
xor eax, eax
test esi, esi
je 0xb929ee
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xa98], 0
jl 0xb92b9a
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xc960a0
push eax
push ebx
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xb92b30
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbec]
jne 0xb92a25
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xb92b93
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xad4], ecx
cmp word [eax], dx
je 0xb92a72
mov ecx, 0xc000007b
mov dword [ebp - 0xad4], ecx
jmp 0xb92aba
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xb92a65
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xb92a65
cmp dword [edx], 0x4550
jne 0xb92a65
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc38]
je 0xb92aa8
cmp ax, word [ebp - 0xc3c]
je 0xb92aa8
mov ecx, 0xc000000d
jmp 0xb92a6a
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xa98], eax
test eax, eax
je 0xb92b24
mov edx, esi
mov dword [ebp - 0xaac], esi
lea eax, [edx + 1]
mov dword [ebp - 0xaa0], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xb92adc
sub edx, dword [ebp - 0xaa0]
inc esi
add esi, edx
test ecx, ecx
js 0xb92b15
push dword [ebp - 0xaac]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xb92b30
mov ecx, dword [ebp - 0xa88]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xad4]
inc dword [ebp - 0xa88]
inc ebx
cmp ebx, dword [ebp - 0xa98]
jb 0xb92acb
add edi, 0x10
cmp byte [esi], 0
jne 0xb92a1e
mov ebx, dword [ebp - 0xad4]
mov esi, dword [ebp - 0xac4]
test esi, esi
je 0xb92b51
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb92ba7
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb92b6a
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb92b59
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xb92bb4
mov ebx, 0xc000007a
jmp 0xb92b36
mov esi, dword [ebp - 0xac4]
mov ebx, 0xc000007a
jmp 0xb92b3c
mov eax, dword [0xc95890]
xor ebx, ebx
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edx, 0xc96238
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0xa88], ebx
lea edi, [ebp - 0xe20]
mov dword [ebp - 0xad4], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xa98], ebx
mov dword [ebp - 0xaac], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xaa0], ebx
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xb92bef
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jne 0xb9320b
push 0x338
mov esi, ebx
mov dword [ebp - 0xab4], ebx
push ebx
mov dword [ebp - 0xad8], ebx
mov dword [ebp - 0xa94], esi
mov dword [ebp - 0xa9c], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xa8c], eax
test eax, eax
je 0xb931fd
or dword [ebp - 0xabc], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x358], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xaa4], ebx
mov dword [ebp - 0x354], edx
mov cl, bl
mov dword [ebp - 0xaa8], ebx
mov edx, ebx
mov dword [ebp - 0xab0], eax
mov esi, 0x9fbcf2
mov dword [ebp - 0xac8], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [ebp - 0xa90], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [ebp - 0xaec], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [ebp - 0xaa8]
xor esi, edx
xor esi, 0xac987321
mov edx, esi
rol edx, 0xa
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul eax, eax, 0x137f
add edx, eax
mov eax, dword [ebp - 0xa90]
xor eax, edx
mov dword [ebp - 0xa90], eax
lea edx, [eax + 0x7f1137f]
rol eax, 2
ror edx, 9
imul edx, edx, 0xab69
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xa90]
sub edx, 0x756c8a2
xor eax, edx
mov edx, eax
mov dword [ebp - 0xa90], eax
xor edx, 0xab69
rol eax, 2
rol edx, 6
imul edx, edx, 0x7f1
sub edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
xor eax, 0xab69605e
sub edx, eax
mov eax, dword [ebp - 0xa90]
xor eax, edx
mov dword [ebp - 0xa90], eax
mov edx, eax
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
mov edx, esi
rol edx, 2
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul eax, eax, 0x605e
add edx, eax
mov eax, dword [ebp - 0xa90]
xor eax, edx
mov dword [ebp - 0xa90], eax
lea edx, [eax + 0x54969fa2]
rol eax, 8
ror edx, 0xe
imul edx, edx, 0x7f1
sub edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0xab69605e
ror edx, 0xa
ror eax, 0xc
imul eax, eax, 0x137f
xor edx, eax
mov eax, dword [ebp - 0xa90]
xor eax, edx
mov dword [ebp - 0xa90], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xa90]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0xa90]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0xaa8], eax
xor eax, 0x7f1
mov edx, dword [ebp - 0xaa8]
rol eax, 2
imul eax, eax, 0x137f
shr edx, 2
add edx, eax
xor esi, edx
mov edx, esi
rol edx, 7
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul eax, eax, 0xab69
add edx, eax
mov eax, dword [ebp - 0xaa8]
xor eax, edx
mov dword [ebp - 0xaa8], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xa90], esi
xor eax, 0xab69
mov edx, esi
rol eax, 5
imul eax, eax, 0x7f1
rol edx, 7
add edx, eax
xor dword [ebp - 0xaa8], edx
mov edx, dword [ebp - 0xaa8]
mov esi, edx
xor esi, dword [ebp - 0xa90]
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xaa8], edx
add edx, 0xf80eec81
mov eax, dword [ebp - 0xaa8]
ror edx, 1
imul edx, edx, 0x605e
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
mov edx, esi
imul eax, eax, 0x7f1
rol edx, 0xe
add edx, eax
mov eax, dword [ebp - 0xaa8]
xor eax, edx
mov dword [ebp - 0xaa8], eax
lea edx, [eax - 0x54969fa2]
ror eax, 0xe
rol edx, 0xf
imul edx, edx, 0x137f
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xaa8]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xaa8], eax
xor eax, edx
mov edx, dword [ebp - 0xaa8]
rol eax, 4
imul eax, eax, 0x605e
rol edx, 2
xor edx, eax
mov eax, dword [ebp - 0xaa4]
xor eax, esi
mov dword [ebp - 0xaa4], ebx
mov esi, dword [ebp - 0xab0]
xor eax, edx
mov edx, dword [ebp - 0xaa8]
xor edx, dword [ebp - 0xabc]
mov dword [ebp - 0xabc], edi
mov byte [esi - 4], al
mov byte [esi], dl
ror eax, 8
mov byte [esi - 5], al
ror edx, 8
mov byte [esi - 1], dl
ror eax, 8
mov byte [esi - 6], al
ror edx, 8
mov byte [esi - 2], dl
ror eax, 8
ror edx, 8
mov byte [esi - 7], al
mov byte [esi - 3], dl
add esi, 8
ror edx, 8
ror eax, 8
sub dword [ebp - 0xac8], 1
mov dword [ebp - 0xaa8], edx
mov edx, eax
mov dword [ebp - 0xab0], esi
mov esi, dword [ebp - 0xaec]
mov dword [ebp - 0xa90], eax
jne 0xb92c8c
mov esi, dword [ebp - 0xa8c]
xor eax, eax
mov edx, eax
xor cl, byte [edx + esi]
inc edx
cmp edx, 0x338
jb 0xb92ff0
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xb93023
cmp edx, dword [0x9fc02c]
jne 0xb93023
mov edi, esi
xor eax, eax
mov dword [ebp - 0xa94], edi
mov esi, eax
mov ebx, 0x337
jmp 0xb93038
mov edi, dword [ebp - 0xa94]
or ebx, 0xffffffff
mov dword [ebp - 0xa9c], 0xc004d501
xor eax, eax
test esi, esi
je 0xb9304b
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xa9c], 0
jl 0xb931f7
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xc960a0
push eax
push ebx
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xb9318d
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbec]
jne 0xb93082
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xb931f0
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xad8], ecx
cmp word [eax], dx
je 0xb930cf
mov ecx, 0xc000007b
mov dword [ebp - 0xad8], ecx
jmp 0xb93117
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xb930c2
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xb930c2
cmp dword [edx], 0x4550
jne 0xb930c2
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc38]
je 0xb93105
cmp ax, word [ebp - 0xc3c]
je 0xb93105
mov ecx, 0xc000000d
jmp 0xb930c7
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xa9c], eax
test eax, eax
je 0xb93181
mov edx, esi
mov dword [ebp - 0xa8c], esi
lea eax, [edx + 1]
mov dword [ebp - 0xaa4], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xb93139
sub edx, dword [ebp - 0xaa4]
inc esi
add esi, edx
test ecx, ecx
js 0xb93172
push dword [ebp - 0xa8c]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xb9318d
mov ecx, dword [ebp - 0xab4]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xad8]
inc dword [ebp - 0xab4]
inc ebx
cmp ebx, dword [ebp - 0xa9c]
jb 0xb93128
add edi, 0x10
cmp byte [esi], 0
jne 0xb9307b
mov ebx, dword [ebp - 0xad8]
mov esi, dword [ebp - 0xa94]
test esi, esi
je 0xb931ae
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb93204
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb931c7
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb931b6
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xb93211
mov ebx, 0xc000007a
jmp 0xb93193
mov esi, dword [ebp - 0xa94]
mov ebx, 0xc000007a
jmp 0xb93199
mov eax, dword [0xc95890]
xor ebx, ebx
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
push 0x54
lea eax, [ebp - 0xa84]
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
mov esi, dword [0xc9307c]
lea edi, [ebp - 0x3b0]
add esp, 0xc
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
pop edx
push 0x403
push ebx
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xab8]
mov ecx, eax
and ecx, edx
mov dword [ebp - 0xab8], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0x18], cx
mov ecx, eax
shr ecx, 8
and ecx, edx
shr eax, 0xc
mov word [ebp - 0x16], cx
and eax, edx
mov ecx, esi
mov word [ebp - 0x14], ax
call dword [0xc99200]
call esi
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xad8], 0xffffff
test eax, eax
jne 0xb932bc
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb932ac
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb94769
mov ebx, 0x80004005
jmp 0xb94769
mov eax, ebx
mov dword [ebp - 0xbf8], ebx
mov dword [ebp - 0xaa4], eax
mov edi, ebx
lea eax, [ebp - 0xbfc]
mov dword [ebp - 0xa9c], ebx
push eax
xor eax, eax
mov dword [ebp - 0xbfc], ebx
push eax
lea eax, [ebp - 0xb08]
mov dword [ebp - 0xa94], edi
mov esi, ebx
mov ebx, dword [0xc93050]
push eax
push 8
mov ecx, ebx
mov dword [ebp - 0xa8c], esi
call dword [0xc99200]
call ebx
test eax, eax
jne 0xb9340c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb93328
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb9358e
mov ebx, 0x80004005
mov edi, dword [ebp - 0xac4]
xor edx, edx
test esi, esi
je 0xb933af
mov eax, edx
mov dword [ebp - 0xa8c], edx
mov edx, dword [esi + eax*4]
test edx, edx
je 0xb933a3
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0xaa4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbec]
jne 0xb93359
sub ecx, dword [ebp - 0xaa4]
xor eax, eax
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xb9338e
mov byte [edx], al
inc edx
sub ecx, 1
jne 0xb9337d
mov edx, dword [ebp - 0xa8c]
mov edx, dword [esi + edx*4]
push edx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xa8c]
inc eax
mov dword [ebp - 0xa8c], eax
cmp eax, 3
jb 0xb93347
mov eax, dword [ebp - 0xbf8]
xor edx, edx
test eax, eax
je 0xb933cd
mov ecx, dword [ebp - 0xa9c]
test ecx, ecx
je 0xb933cd
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0xb933c5
test esi, esi
je 0xb933e0
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbf8]
test eax, eax
je 0xb93d00
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0xbf8], ecx
jmp 0xb93d02
mov eax, dword [ebp - 0xbfc]
xor ebx, ebx
add eax, eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xabc], edi
test edi, edi
jne 0xb9343b
mov ebx, 0x8007000e
jmp 0xb93573
mov eax, dword [ebp - 0xb08]
lea eax, [eax*4 + 4]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xaa8], esi
test esi, esi
jne 0xb9346f
mov ebx, 0x8007000e
xor ecx, ecx
jmp 0xb9355a
mov ebx, dword [0xc93050]
lea eax, [ebp - 0xbfc]
push eax
push edi
lea eax, [ebp - 0xb08]
mov ecx, ebx
push eax
push 8
call dword [0xc99200]
call ebx
test eax, eax
jne 0xb934b4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb934ab
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb93468
mov ebx, 0x80004005
jmp 0xb93468
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0xa94], ecx
cmp dword [ebp - 0xb08], ecx
jbe 0xb93539
mov dword [ebp - 0xab0], edi
mov edi, esi
mov esi, dword [ebp - 0xab0]
mov ebx, dword [0xc93058]
push ecx
push esi
mov ecx, ebx
call dword [0xc99200]
call ebx
mov ecx, esi
mov dword [edi], eax
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb934ef
sub ecx, edx
sar ecx, 1
push 4
pop eax
add edi, eax
mov eax, dword [ebp - 0xa94]
lea esi, [esi + ecx*2]
add esi, 2
inc eax
push 0
mov dword [ebp - 0xa94], eax
pop ecx
cmp eax, dword [ebp - 0xb08]
jb 0xb934d4
mov esi, dword [ebp - 0xaa8]
mov dword [ebp - 0xa94], edi
mov edi, dword [ebp - 0xabc]
mov eax, dword [ebp - 0xa94]
mov ebx, dword [ebp - 0xaa4]
mov dword [eax], 0x409
mov eax, dword [ebp - 0xb08]
inc eax
mov dword [ebp - 0xa94], esi
mov esi, ecx
mov dword [ebp - 0xabc], eax
test esi, esi
je 0xb9356d
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xa8c]
test edi, edi
je 0xb93588
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xa94]
test ebx, ebx
js 0xb93333
xor eax, eax
mov ebx, eax
mov ecx, eax
mov dword [ebp - 0xaa8], ebx
cmp dword [ebp - 0xabc], eax
jbe 0xb935d3
mov edx, dword [edi + ecx*4]
cmp edx, dword [eax*4 + 0xa192e8]
je 0xb935c9
inc eax
cmp eax, 0x26
jb 0xb935ad
inc ecx
xor eax, eax
cmp ecx, dword [ebp - 0xabc]
jae 0xb935d3
jmp 0xb935aa
mov ebx, eax
xor eax, eax
mov dword [ebp - 0xaa8], ebx
mov edi, dword [0xc93054]
mov ecx, edi
push eax
mov dword [ebp - 0xabc], eax
lea eax, [ebp - 0xc4]
push 0x55
push eax
push dword [ebx*4 + 0xa192e8]
call dword [0xc99200]
call edi
test eax, eax
je 0xb93638
mov edi, dword [0xc93048]
lea eax, [ebp - 0x420]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xc4]
mov ecx, edi
push eax
call dword [0xc99200]
call edi
test eax, eax
jle 0xb93638
mov ebx, dword [ebp - 0x414]
xor eax, eax
shr ebx, 0x1b
inc eax
and ebx, eax
mov dword [ebp - 0xabc], ebx
xor eax, eax
mov edx, 0x9fba10
mov edi, eax
mov ecx, edx
mov dword [ebp + edi*4 - 0x350], edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbec]
jne 0xb9364d
sub ecx, ebx
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc edi
cmp edi, 0x13
jb 0xb93641
imul ecx, dword [ebp - 0xaa8], 3
movzx eax, byte [ecx + 0xa00b58]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xa98], eax
movzx eax, byte [ecx + 0xa00b59]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xaac], eax
movzx eax, byte [ecx + 0xa00b5a]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xaa0], eax
xor ebx, ebx
push 0x1c90
mov eax, ebx
push ebx
mov dword [ebp - 0xaa4], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xab0], ecx
test ecx, ecx
jne 0xb936e2
mov ebx, 0x8007000e
jmp 0xb93333
or dword [ebp - 0xa90], 0xffffffff
lea esi, [ecx + 7]
mov edx, 0xab69605e
mov dword [ebp - 0xac8], ebx
mov al, bl
mov dword [ebp - 0x360], edx
mov dword [ebp - 0xaec], ebx
mov edi, ebx
mov edx, 0x7f1137f
mov dword [ebp - 0xadc], 0x392
mov ebx, 0xa19392
mov dword [ebp - 0x35c], edx
mov dword [ebp - 0xae0], ebx
movzx edx, byte [ebx - 2]
movzx ecx, byte [ebx - 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [ebx]
shl edx, 8
or edx, ecx
movzx ecx, byte [ebx + 1]
movzx ebx, byte [ebx + 2]
shl edx, 8
or edx, ecx
shl ebx, 8
mov ecx, dword [ebp - 0xae0]
xor edi, edx
mov dword [ebp - 0xb04], edi
mov dword [ebp - 0xb00], edx
movzx ecx, byte [ecx + 3]
or ebx, ecx
mov ecx, dword [ebp - 0xae0]
shl ebx, 8
movzx ecx, byte [ecx + 4]
or ebx, ecx
mov ecx, dword [ebp - 0xae0]
shl ebx, 8
add dword [ebp - 0xae0], 8
movzx ecx, byte [ecx + 5]
or ebx, ecx
mov edi, ebx
xor edi, dword [ebp - 0xaec]
xor edi, dword [ebp - 0xb04]
xor edi, 0xac987321
mov edx, edi
rol edx, 0xa
lea ecx, [edi + 0x54969fa2]
rol ecx, 5
imul ecx, ecx, 0x137f
add edx, ecx
mov ecx, dword [ebp - 0xb04]
xor ecx, edx
mov dword [ebp - 0xb04], ecx
lea edx, [ecx + 0x7f1137f]
rol ecx, 2
ror edx, 9
imul edx, edx, 0xab69
sub edx, ecx
xor edi, edx
imul edx, edi, 0x605e
mov ecx, edi
shr ecx, 0xd
sub edx, ecx
mov ecx, dword [ebp - 0xb04]
sub edx, 0x756c8a2
xor ecx, edx
mov edx, ecx
mov dword [ebp - 0xb04], ecx
xor edx, 0xab69
rol ecx, 2
rol edx, 6
imul edx, edx, 0x7f1
sub edx, ecx
xor edi, edx
mov edx, 0x7f1137f
mov ecx, edi
xor ecx, 0xab69605e
sub edx, ecx
mov ecx, dword [ebp - 0xb04]
xor ecx, edx
mov edx, ecx
mov dword [ebp - 0xb04], ecx
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor edi, edx
mov edx, edi
rol edx, 2
lea ecx, [edi + 0x7f1137f]
ror ecx, 0xf
imul ecx, ecx, 0x605e
add edx, ecx
mov ecx, dword [ebp - 0xb04]
xor ecx, edx
mov dword [ebp - 0xb04], ecx
lea edx, [ecx + 0x54969fa2]
rol ecx, 8
ror edx, 0xe
imul edx, edx, 0x7f1
sub edx, ecx
xor edi, edx
mov ecx, edi
mov edx, edi
xor ecx, 0xab69605e
ror edx, 0xa
ror ecx, 0xc
imul ecx, ecx, 0x137f
xor edx, ecx
mov ecx, dword [ebp - 0xb04]
xor ecx, edx
mov dword [ebp - 0xb04], ecx
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0xb04]
shr ecx, 0xa
xor edx, ecx
xor edi, edx
mov edx, dword [ebp - 0xb04]
mov ecx, edi
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor edx, ecx
mov dword [ebp - 0xb04], edx
add edx, 0xfffff80f
xor edx, edi
mov edi, dword [ebp - 0xb04]
xor edx, 0xab69605e
mov ecx, edx
mov dword [ebp - 0xaec], edx
xor ecx, 0x7f1
shr edx, 2
rol ecx, 2
imul ecx, ecx, 0x137f
add edx, ecx
xor edi, edx
mov edx, edi
rol edx, 7
lea ecx, [edi - 0x7f1137f]
ror ecx, 6
imul ecx, ecx, 0xab69
add edx, ecx
mov ecx, dword [ebp - 0xaec]
xor ecx, edx
mov dword [ebp - 0xaec], ecx
mov edx, ecx
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor edi, edx
mov ecx, edi
mov dword [ebp - 0xb04], edi
xor ecx, 0xab69
mov edx, edi
rol ecx, 5
imul ecx, ecx, 0x7f1
rol edx, 7
add edx, ecx
xor dword [ebp - 0xaec], edx
mov edx, dword [ebp - 0xaec]
mov edi, edx
xor edi, dword [ebp - 0xb04]
xor edi, 0xac987321
mov ecx, edi
ror ecx, 3
imul ecx, ecx, 0x137f
sub ecx, 0xd0dd417
xor edx, ecx
mov dword [ebp - 0xaec], edx
add edx, 0xf80eec81
mov ecx, dword [ebp - 0xaec]
ror edx, 1
ror ecx, 6
imul edx, edx, 0x605e
sub edx, ecx
xor edi, edx
mov edx, edi
rol edx, 0xe
lea ecx, [edi - 0x54969fa2]
rol ecx, 3
imul ecx, ecx, 0x7f1
add edx, ecx
mov ecx, dword [ebp - 0xaec]
xor ecx, edx
mov dword [ebp - 0xaec], ecx
lea edx, [ecx - 0x54969fa2]
ror ecx, 0xe
rol edx, 0xf
imul edx, edx, 0x137f
sub edx, ecx
xor edi, edx
mov ecx, edi
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, edi
shr ecx, 3
xor edx, ecx
mov ecx, dword [ebp - 0xaec]
xor ecx, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xaec], ecx
xor ecx, edx
mov edx, dword [ebp - 0xaec]
rol ecx, 4
imul ecx, ecx, 0x605e
rol edx, 2
xor edx, ecx
mov ecx, dword [ebp - 0xac8]
xor ecx, edi
xor ecx, edx
mov edx, dword [ebp - 0xaec]
xor edx, dword [ebp - 0xa90]
mov byte [esi - 4], cl
mov byte [esi], dl
lea esi, [esi + 8]
ror ecx, 8
mov byte [esi - 0xd], cl
ror edx, 8
mov byte [esi - 9], dl
ror ecx, 8
mov byte [esi - 0xe], cl
ror edx, 8
ror ecx, 8
mov byte [esi - 0xa], dl
mov byte [esi - 0xf], cl
ror edx, 8
ror ecx, 8
mov byte [esi - 0xb], dl
mov dword [ebp - 0xb04], ecx
mov ecx, dword [ebp - 0xb00]
mov edi, dword [ebp - 0xb04]
ror edx, 8
sub dword [ebp - 0xadc], 1
mov dword [ebp - 0xa90], ebx
mov ebx, dword [ebp - 0xae0]
mov dword [ebp - 0xaec], edx
mov dword [ebp - 0xac8], ecx
jne 0xb93727
mov esi, dword [ebp - 0xa8c]
xor ecx, ecx
mov edi, dword [ebp - 0xab0]
mov edx, ecx
mov ebx, 0x1c90
xor al, byte [edx + edi]
inc edx
cmp edx, ebx
jb 0xb93ac1
movzx eax, al
cdq
cmp eax, dword [0xa1b020]
jne 0xb93af5
cmp edx, dword [0xa1b024]
jne 0xb93af5
xor ecx, ecx
mov dword [ebp - 0xbf8], edi
mov dword [ebp - 0xa9c], ebx
mov edi, ecx
mov ebx, dword [ebp - 0xaa4]
jmp 0xb93b02
mov ebx, 0xc004d501
xor ecx, ecx
mov dword [ebp - 0xaa4], ebx
test edi, edi
je 0xb93b15
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb93333
mov edi, dword [ebp - 0xbf8]
xor eax, eax
mov ebx, dword [ebp - 0xaa8]
mov esi, eax
mov edx, eax
cmp ebx, edx
jne 0xb93b3a
mov dword [ebp + esi*4 - 0x2e4], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0xa8c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xb93b45
sub ecx, dword [ebp - 0xa8c]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0xb93b2f
inc esi
push 0
pop eax
cmp esi, 6
jb 0xb93b2d
push 0xc
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, dword [ebp - 0xaa4]
mov esi, eax
test esi, esi
je 0xb936d8
mov edi, esi
xor eax, eax
xor edx, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, edx
movzx ecx, word [ebp + edi*2 - 0x18]
mov eax, edx
cmp cx, word [eax*2 + 0xa19380]
je 0xb93bab
inc eax
cmp eax, 6
jb 0xb93b96
jmp 0xb93c8c
mov ecx, dword [0xc93060]
mov edx, dword [ebp + eax*4 - 0x2e4]
mov dword [ebp - 0xa8c], ecx
mov ecx, edx
mov dword [ebp - 0xaa4], edx
lea eax, [ecx + 1]
mov dword [ebp - 0xaa8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xb93bcf
sub ecx, dword [ebp - 0xaa8]
xor eax, eax
push eax
push eax
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0xa8c]
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0xa8c]
mov dword [ebp - 0xa8c], eax
test eax, eax
je 0xb93cd3
lea ecx, [eax + eax]
xor eax, eax
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xaa8], eax
mov dword [esi + edi*4], eax
test eax, eax
je 0xb936d8
mov edx, dword [ebp - 0xaa4]
mov ecx, edx
mov eax, dword [0xc93060]
mov dword [ebp - 0xab0], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xaa4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xb93c4e
push dword [ebp - 0xa8c]
sub ecx, dword [ebp - 0xaa4]
push dword [ebp - 0xaa8]
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0xab0]
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0xab0]
test eax, eax
je 0xb93cb1
xor edx, edx
inc edi
cmp edi, 3
jb 0xb93b8f
mov eax, dword [ebp - 0xabc]
mov edi, esi
mov dword [ebp - 0xac4], edi
mov esi, edx
mov dword [ebp - 0xa84], eax
jmp 0xb9333b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb93cc8
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb93333
jmp 0xb9332e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb93cea
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
mov edi, dword [ebp - 0xac4]
js 0xb93339
mov ebx, 0x80004005
jmp 0xb93339
xor ecx, ecx
mov eax, dword [ebp - 0xa94]
test eax, eax
je 0xb93d1b
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb94750
mov eax, dword [edi]
xor ecx, ecx
mov esi, dword [0xc930b4]
mov ebx, ecx
mov dword [ebp - 0xa7c], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0xa78], eax
mov eax, dword [edi + 8]
mov edi, ecx
push ecx
mov dword [ebp - 0xa74], eax
lea eax, [ebp - 0xdf8]
push eax
push ecx
mov dword [ebp - 0xdf4], ecx
mov dword [ebp - 0xdf0], ecx
mov ecx, esi
push 0x42
mov dword [ebp - 0xdf8], 0xc
call dword [0xc99200]
call esi
test eax, eax
jne 0xb93d98
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb93d8f
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb93da3
mov ebx, 0x80004005
jmp 0xb93da3
mov edi, dword [ebp - 0xdf4]
xor eax, eax
inc eax
and edi, eax
mov dword [ebp - 0xa80], edi
test ebx, ebx
js 0xb94750
mov ebx, dword [ebp - 0xab8]
mov eax, ebx
push 0x2a
pop ecx
mov dword [ebp - 0xa94], ecx
sub eax, 1
je 0xb93df0
sub eax, 1
je 0xb93de4
sub eax, 1
jne 0xb93e00
mov eax, 0xe1
mov dword [ebp - 0xa88], eax
mov dword [ebp - 0xad4], eax
jmp 0xb93e00
mov dword [ebp - 0xa88], 0xf
jmp 0xb93df6
mov dword [ebp - 0xa88], ecx
mov dword [ebp - 0xad4], 0xb
push 0x60
pop edi
xor eax, eax
mov dword [ebp - 0xa9c], edi
lea esi, [edi + 0x7c]
push esi
push eax
lea eax, [ebp - 0x73c]
push eax
call fcn.00ab4bf6
add esp, 0xc
mov word [ebp - 0x6f8], si
mov esi, dword [0xc93070]
lea eax, [ebp - 0x73c]
mov ecx, esi
push eax
push 0xffffffffffffffff
xor eax, eax
push eax
call dword [0xc99200]
call esi
test eax, eax
je 0xb93e87
movzx edi, word [ebp - 0x696]
mov eax, dword [ebp - 0x690]
mov ecx, dword [ebp - 0x68c]
mov dword [ebp - 0xa9c], edi
mov dword [ebp - 0xa8c], eax
mov dword [ebp - 0xe18], eax
mov dword [ebp - 0xaa4], ecx
mov dword [ebp - 0xe14], ecx
cmp edi, 0x60
jae 0xb93e9f
push 0x60
pop edi
mov dword [ebp - 0xa9c], edi
jmp 0xb93e9f
mov eax, dword [ebp - 0xe14]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0xe18]
mov dword [ebp - 0xa8c], eax
xor eax, eax
inc eax
cmp ebx, eax
mov eax, dword [ebp - 0xa98]
je 0xb93eb2
mov eax, dword [ebp - 0xaa0]
mov dword [ebp - 0xabc], eax
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0x5a8]
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0xaa8], eax
test eax, eax
jne 0xb93f18
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb93f08
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb93fb8
mov ebx, 0x80004005
jmp 0xb94750
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push edi
push dword [ebp - 0xa88]
call dword [0xc99200]
call esi
push dword [ebp - 0xabc]
neg eax
mov dword [ebp - 0x598], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x58c]
mov dword [ebp - 0x5a8], eax
mov byte [ebp - 0x58e], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0x5a8]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb93f99
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb93f90
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb93f9f
mov ebx, 0x80004005
jmp 0xb93f9f
mov dword [ebp - 0xa70], eax
push dword [ebp - 0xaa8]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb94750
xor eax, eax
inc eax
cmp dword [ebp - 0xab8], eax
je 0xb93fd7
mov eax, dword [ebp - 0xaa0]
mov dword [ebp - 0xa98], eax
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0x604]
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0xa88], eax
test eax, eax
jne 0xb940a8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb9402b
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0xb93f0e
push 0x20
pop edi
test ebx, ebx
js 0xb94750
mov ebx, dword [ebp - 0xab8]
xor eax, eax
mov ecx, eax
mov edx, eax
mov eax, ebx
sub eax, 1
je 0xb9405d
sub eax, 1
je 0xb9414f
sub eax, 1
jne 0xb94069
mov ecx, dword [ebp - 0xa8c]
mov edx, dword [ebp - 0xaa4]
mov dword [ebp - 0x3a8], ecx
mov dword [ebp - 0x3a4], edx
xor edx, edx
inc edx
cmp ebx, edx
je 0xb94192
lea eax, [ebx - 2]
xor ebx, ebx
cmp eax, edx
ja 0xb94166
mov eax, ebx
mov dword [ebp - 0xa94], ebx
mov edx, ebx
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xa98], ebx
jmp 0xb941a7
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push edi
push dword [ebp - 0xad4]
call dword [0xc99200]
call esi
push dword [ebp - 0xa98]
neg eax
mov dword [ebp - 0x5f4], 0x190
push 0x20
pop edi
mov edx, edi
mov dword [ebp - 0x604], eax
lea ecx, [ebp - 0x5e8]
mov byte [ebp - 0x5ea], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0x604]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb9412b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb94122
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb94131
mov ebx, 0x80004005
jmp 0xb94131
mov dword [ebp - 0xa6c], eax
push dword [ebp - 0xa88]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
jmp 0xb94034
mov eax, dword [ebp - 0xa8c]
push 4
cdq
pop ecx
idiv ecx
mov ecx, eax
xor eax, eax
mov edx, eax
jmp 0xb94069
mov eax, dword [ebp - 0xb08]
mov edx, dword [ebp - 0xb08]
mov dword [ebp - 0xa98], eax
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0xa94], eax
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0xad4], eax
jmp 0xb941a7
xor ebx, ebx
mov dword [ebp - 0xa98], edi
mov edx, 0x96
mov dword [ebp - 0xad4], ebx
mov eax, ebx
mov dword [ebp - 0xa88], edx
push dword [ebp - 0xa70]
mov esi, dword [0xc9303c]
sub ecx, edx
push dword [ebp - 0xab4]
mov edi, dword [ebp - 0xa7c]
sub ecx, eax
mov dword [ebp - 0xaa0], ecx
mov dword [ebp - 0xa48], ecx
mov dword [ebp - 0xa58], ecx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0xa8c], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0xa60]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xab4]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb9421d
mov ebx, 0x80004005
mov eax, dword [ebp - 0xa8c]
test eax, eax
je 0xb94239
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb94750
push dword [ebp - 0xa6c]
mov esi, dword [0xc9303c]
xor eax, eax
push dword [ebp - 0xab4]
mov edi, dword [ebp - 0xa78]
mov ecx, esi
mov ebx, eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0xa8c], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0xa50]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xab4]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb9429f
mov ebx, 0x80004005
mov eax, dword [ebp - 0xa8c]
test eax, eax
je 0xb942bb
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb94750
mov eax, dword [ebp - 0xab8]
cmp eax, 2
je 0xb942d3
cmp eax, 3
jne 0xb942e9
mov edi, dword [ebp - 0xa48]
cmp dword [ebp - 0xa58], edi
jle 0xb942ef
mov edi, dword [ebp - 0xa58]
jmp 0xb942ef
mov edi, dword [ebp - 0xaa0]
cmp dword [ebp - 0xa84], 0
mov esi, dword [0xc930a8]
mov ecx, esi
push dword [ebp - 0xa94]
je 0xb94330
mov ebx, dword [ebp - 0xad4]
mov eax, ebx
sub eax, dword [ebp - 0xa58]
add eax, edi
push eax
lea eax, [ebp - 0xa60]
push eax
call dword [0xc99200]
call esi
sub ebx, dword [ebp - 0xa48]
add ebx, edi
jmp 0xb94346
mov ebx, dword [ebp - 0xa88]
lea eax, [ebp - 0xa60]
push ebx
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xa54]
add eax, dword [ebp - 0xa98]
mov esi, dword [0xc930a8]
mov ecx, esi
push eax
push ebx
lea eax, [ebp - 0xa50]
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xab8]
cmp eax, 2
je 0xb9463a
cmp eax, 3
je 0xb9463a
xor edx, edx
inc edx
cmp eax, edx
jne 0xb94659
xor eax, eax
mov dword [ebp - 0xa64], 0xffffff
push 0x5c
push eax
lea eax, [ebp - 0x660]
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0xa88], eax
test eax, eax
jne 0xb943f3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb943e8
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb94494
jmp 0xb93f0e
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0xa9c]
push 0xb
call dword [0xc99200]
call esi
push dword [ebp - 0xaac]
neg eax
mov dword [ebp - 0x650], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x644]
mov dword [ebp - 0x660], eax
mov byte [ebp - 0x646], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0x660]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb94475
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb9446c
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb9447b
mov ebx, 0x80004005
jmp 0xb9447b
mov dword [ebp - 0xa68], eax
push dword [ebp - 0xa88]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb94750
push dword [ebp - 0xa68]
mov esi, dword [0xc9303c]
xor eax, eax
push dword [ebp - 0xab4]
mov dword [ebp - 0xa38], edi
mov ecx, esi
mov edi, dword [ebp - 0xa74]
mov ebx, eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0xa88], eax
xor eax, eax
push eax
push 0x460
lea eax, [ebp - 0xa40]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xab4]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb94500
mov ebx, 0x80004005
mov eax, dword [ebp - 0xa88]
test eax, eax
je 0xb9451c
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb94750
mov eax, dword [ebp - 0xa38]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0xa38], eax
cmp eax, ecx
jge 0xb94540
mov dword [ebp - 0xa38], ecx
mov ebx, dword [ebp - 0xa9c]
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
pop edi
push edi
push ebx
push dword [ebp - 0xa40]
mov dword [ebp - 0xa34], 0x20
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0xa3c]
mov dword [ebp - 0xa40], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0xa38]
mov dword [ebp - 0xa3c], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0xa34]
mov dword [ebp - 0xa38], eax
call dword [0xc99200]
call esi
cmp dword [ebp - 0xa84], 0
mov esi, dword [0xc930a8]
mov dword [ebp - 0xa34], eax
je 0xb9460c
mov ecx, dword [ebp - 0xa44]
mov eax, dword [ebp - 0xa60]
add ecx, 0x24
cmp eax, dword [ebp - 0xa50]
jl 0xb945f7
mov eax, dword [ebp - 0xa50]
push ecx
push eax
lea eax, [ebp - 0xa40]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
jmp 0xb94656
mov eax, dword [ebp - 0xa44]
mov ecx, dword [ebp - 0xa58]
add eax, 0x24
cmp ecx, dword [ebp - 0xa48]
jg 0xb94629
mov ecx, dword [ebp - 0xa48]
push eax
mov eax, dword [ebp - 0xa40]
sub eax, dword [ebp - 0xa38]
add eax, ecx
jmp 0xb945f8
mov eax, dword [ebp - 0xa44]
mov dword [ebp - 0x3a8], edi
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0xa64], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0xa84]
mov ebx, dword [ebp - 0x3a8]
mov dword [ebp - 0xa88], eax
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0xab8]
sub eax, 1
je 0xb949e9
sub eax, 1
je 0xb94916
sub eax, 1
jne 0xb9474e
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x470]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x470]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x470], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xb9474e
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x45c]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x454]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x454]
lea esi, [ebp - 0x45c]
sub eax, ebx
lea edi, [ebp - 0xe30]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x450]
sub eax, dword [ebp - 0xad4]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
mov dword [ebp - 0x3ac], eax
xor ebx, ebx
push dword [ebp - 0xab4]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
xor esi, esi
mov edi, 0xc96238
inc esi
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xb94771
mov eax, dword [0xc95890]
test eax, eax
jle 0xb947d6
sub eax, 1
mov dword [0xc95890], eax
jne 0xb947d6
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb947a5
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb94794
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0xc96238
inc esi
xor eax, eax
xchg dword [edi], eax
mov eax, dword [ebp - 0xac4]
test eax, eax
je 0xb947f5
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb9644d
mov edi, dword [ebp - 0x3b0]
xor eax, eax
mov ebx, dword [ebp - 0x3ac]
push 0x54
push eax
lea eax, [ebp - 0x790]
mov dword [ebp - 0xdb4], edi
push eax
mov dword [ebp - 0xdb0], ebx
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0xa88], esi
mov esi, dword [0xc93028]
mov ecx, esi
push 7
push dword [ebp - 0xac0]
call dword [0xc99200]
call esi
test eax, eax
je 0xb94890
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x790]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb94890
push 0x20
pop eax
cmp word [ebp - 0x77e], ax
jne 0xb94890
cmp dword [ebp - 0x77c], 0
je 0xb94890
cmp dword [ebp - 0x78c], 0
jle 0xb94890
cmp dword [ebp - 0x788], 0
jg 0xb948a5
xor eax, eax
cmp dword [ebp - 0xab8], 1
mov dword [ebp - 0xa88], eax
jne 0xb949fc
mov esi, dword [0xc930a8]
lea eax, [ebp - 0xa60]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc930a8]
lea eax, [ebp - 0xa50]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov ebx, dword [ebp - 0xab8]
cmp ebx, 1
jne 0xb94a02
mov eax, dword [ebp - 0xa80]
mov esi, dword [0xc93014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0xae8], eax
jmp 0xb94a02
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x448]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x448]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x448], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xb9474e
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x434]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x42c]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
cmp dword [ebp - 0xa88], 0
lea esi, [ebp - 0x434]
lea edi, [ebp - 0xe30]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xb949c1
imul eax, dword [ebp - 0x42c], 5
cdq
idiv ecx
add eax, dword [ebp - 0x434]
jmp 0xb949cf
mov eax, dword [ebp - 0x42c]
sub eax, ebx
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x428]
sub eax, dword [ebp - 0xad4]
imul eax, eax, 0x5f
jmp 0xb94745
xor ebx, ebx
mov dword [ebp - 0x3b0], ebx
mov dword [ebp - 0x3ac], ebx
jmp 0xb94750
mov ebx, dword [ebp - 0xab8]
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push dword [ebp - 0xac0]
call dword [0xc99200]
call esi
cmp dword [ebp - 0xa84], 0
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xac4], 0x810
je 0xb94a3d
mov dword [ebp - 0xac4], 0x20812
cmp dword [ebp - 0xa88], 0
je 0xb95528
mov eax, dword [ebp - 0xa80]
mov ebx, dword [ebp - 0xa7c]
mov dword [ebp - 0xa88], eax
mov eax, dword [ebp - 0xa70]
mov dword [ebp - 0xa98], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x7e4]
mov dword [ebp - 0xaac], ebx
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x838]
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xa94], eax
mov dword [ebp - 0xa9c], eax
lea eax, [ebp - 0x54c]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x3c0]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xb9642d
mov esi, dword [0xc93028]
mov ecx, esi
mov ebx, dword [ebp - 0xac0]
push 7
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xb955b9
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x7e4]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb94b33
mov eax, dword [ebp - 0x7d0]
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0x7e0]
mov dword [ebp - 0xa94], eax
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0xa9c], eax
mov esi, dword [0xc93008]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov ebx, eax
mov dword [ebp - 0xa8c], ebx
test ebx, ebx
je 0xb955b9
mov eax, dword [ebp - 0xa58]
xor edx, edx
sub eax, dword [ebp - 0xa60]
mov ecx, dword [ebp - 0xa54]
sub ecx, dword [ebp - 0xa5c]
mov esi, dword [0xc9300c]
neg ecx
mov dword [ebp - 0x548], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x544], ecx
mov word [ebp - 0x540], ax
mov ecx, esi
pop eax
push edx
push edx
mov word [ebp - 0x53e], ax
lea eax, [ebp - 0xc04]
push eax
push edx
lea eax, [ebp - 0x54c]
mov dword [ebp - 0xc04], edx
push eax
push ebx
mov dword [ebp - 0xaa4], edx
mov dword [ebp - 0x53c], edx
mov dword [ebp - 0x538], edx
mov dword [ebp - 0x534], edx
mov dword [ebp - 0x530], edx
mov dword [ebp - 0x52c], edx
mov dword [ebp - 0x528], edx
mov dword [ebp - 0x524], edx
mov dword [ebp - 0x54c], 0x28
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0xabc], edi
test edi, edi
jne 0xb94c33
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xaa4], eax
test eax, eax
jle 0xb94c1e
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xaa4], eax
test eax, eax
js 0xb94f91
mov dword [ebp - 0xaa4], 0x80004005
jmp 0xb94f91
mov esi, dword [0xc93034]
lea eax, [ebp - 0x838]
push eax
push 0x54
push edi
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb94c5d
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xa58]
sub eax, dword [ebp - 0xa60]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0xa54]
sub eax, dword [ebp - 0xa5c]
push edi
push ebx
mov dword [ebp - 0x3b4], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
push dword [ebp - 0xa98]
mov esi, dword [0xc9303c]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0xa98], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x3c0]
mov ecx, edi
push eax
push ebx
call dword [0xc99200]
call edi
mov esi, dword [0xc9306c]
xor eax, eax
push eax
push dword [ebp - 0xac4]
lea eax, [ebp - 0x3c0]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xaac]
push ebx
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xab8], eax
jne 0xb94d54
cmp dword [ebp - 0xa88], 0
je 0xb94d48
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0xa88], eax
jmp 0xb94d5e
mov dword [ebp - 0xa88], 0xffffff
jmp 0xb94d5e
mov dword [ebp - 0xa88], 0xffa8a8a8
mov edi, dword [ebp - 0xa60]
xor ebx, ebx
mov eax, dword [ebp - 0xa5c]
mov edx, ebx
mov ecx, ebx
test edi, edi
jns 0xb94d7a
mov edx, edi
mov edi, ebx
neg edx
test eax, eax
jns 0xb94d84
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x3b8]
mov ebx, dword [ebp - 0xa94]
sub esi, edx
sub ebx, edi
mov dword [ebp - 0xaac], esi
cmp esi, ebx
jl 0xb94da6
mov esi, ebx
mov dword [ebp - 0xaac], ebx
mov ebx, dword [ebp - 0x3b4]
sub dword [ebp - 0xa9c], eax
sub ebx, ecx
mov dword [ebp - 0xaa8], ebx
cmp ebx, dword [ebp - 0xa9c]
jl 0xb94dce
mov ebx, dword [ebp - 0xa9c]
mov dword [ebp - 0xaa8], ebx
test esi, esi
jle 0xb94f59
test ebx, ebx
jle 0xb94f59
mov ebx, dword [ebp - 0x3b8]
imul ecx, ebx
shl ebx, 2
add ecx, edx
mov edx, dword [ebp - 0xab4]
lea ecx, [edx + ecx*4]
mov edx, dword [ebp - 0xa94]
imul eax, edx
mov dword [ebp - 0xab4], ecx
mov dword [ebp - 0xa94], ebx
add eax, edi
mov edi, dword [ebp - 0xaa0]
shl edx, 2
mov dword [ebp - 0xa9c], edx
lea eax, [edi + eax*4]
mov dword [ebp - 0xaa0], eax
mov ebx, eax
mov dword [ebp - 0xa90], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xab0], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xac8], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xb94f06
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xa88]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac8]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xab0]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xa88]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xab0]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xa86]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xab0]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xa90]
cdq
idiv ecx
mov edx, dword [ebp - 0xab0]
add al, bl
mov ebx, dword [ebp - 0xac8]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0xab0], edx
mov dword [ebp - 0xa90], esi
jne 0xb94e40
mov ecx, dword [ebp - 0xab4]
mov eax, dword [ebp - 0xaa0]
add ecx, dword [ebp - 0xa94]
add eax, dword [ebp - 0xa9c]
sub dword [ebp - 0xaa8], 1
mov esi, dword [ebp - 0xaac]
mov dword [ebp - 0xab4], ecx
mov dword [ebp - 0xaa0], eax
jne 0xb94e24
push dword [ebp - 0xabc]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xa98]
mov ebx, dword [ebp - 0xa8c]
test eax, eax
je 0xb94f91
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0xaa4], 0
jl 0xb9642d
mov eax, dword [ebp - 0xa80]
mov ebx, dword [ebp - 0xa78]
mov dword [ebp - 0xa88], eax
mov eax, dword [ebp - 0xa6c]
mov dword [ebp - 0xa98], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x88c]
mov dword [ebp - 0xaac], ebx
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x8e0]
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xa94], eax
mov dword [ebp - 0xa9c], eax
lea eax, [ebp - 0x520]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x3d0]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xb9642d
mov esi, dword [0xc93028]
mov ecx, esi
mov ebx, dword [ebp - 0xac0]
push 7
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xb955b9
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x88c]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb95098
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0x888]
mov dword [ebp - 0xa94], eax
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0xa9c], eax
mov esi, dword [0xc93008]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov ebx, eax
mov dword [ebp - 0xa8c], ebx
test ebx, ebx
je 0xb955b9
mov eax, dword [ebp - 0xa48]
xor edx, edx
sub eax, dword [ebp - 0xa50]
mov ecx, dword [ebp - 0xa44]
sub ecx, dword [ebp - 0xa4c]
mov esi, dword [0xc9300c]
neg ecx
mov dword [ebp - 0x51c], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x518], ecx
mov word [ebp - 0x514], ax
mov ecx, esi
pop eax
push edx
push edx
mov word [ebp - 0x512], ax
lea eax, [ebp - 0xc08]
push eax
push edx
lea eax, [ebp - 0x520]
mov dword [ebp - 0xc08], edx
push eax
push ebx
mov dword [ebp - 0xaa4], edx
mov dword [ebp - 0x510], edx
mov dword [ebp - 0x50c], edx
mov dword [ebp - 0x508], edx
mov dword [ebp - 0x504], edx
mov dword [ebp - 0x500], edx
mov dword [ebp - 0x4fc], edx
mov dword [ebp - 0x4f8], edx
mov dword [ebp - 0x520], 0x28
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0xabc], edi
test edi, edi
jne 0xb95198
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xaa4], eax
test eax, eax
jle 0xb95183
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xaa4], eax
test eax, eax
js 0xb95505
mov dword [ebp - 0xaa4], 0x80004005
jmp 0xb95505
mov esi, dword [0xc93034]
lea eax, [ebp - 0x8e0]
push eax
push 0x54
push edi
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb951c2
mov eax, dword [ebp - 0x8cc]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xa48]
sub eax, dword [ebp - 0xa50]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0xa44]
sub eax, dword [ebp - 0xa4c]
push edi
push ebx
mov dword [ebp - 0x3c4], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
push dword [ebp - 0xa98]
mov esi, dword [0xc9303c]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0xa98], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x3d0]
mov ecx, edi
push eax
push ebx
call dword [0xc99200]
call edi
mov esi, dword [0xc9306c]
xor eax, eax
push eax
push dword [ebp - 0xac4]
lea eax, [ebp - 0x3d0]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xaac]
push ebx
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xab8], eax
jne 0xb952c1
cmp dword [ebp - 0xa88], 0
je 0xb952b5
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov ebx, eax
mov dword [ebp - 0xad8], ebx
mov dword [ebp - 0xab8], ebx
jmp 0xb952d2
mov dword [ebp - 0xab8], 0xffffff
jmp 0xb952d2
mov eax, 0xffa8a8a8
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xab8], eax
mov edi, dword [ebp - 0xa50]
xor ebx, ebx
mov eax, dword [ebp - 0xa4c]
mov edx, ebx
mov ecx, ebx
test edi, edi
jns 0xb952ee
mov edx, edi
mov edi, ebx
neg edx
test eax, eax
jns 0xb952f8
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x3c8]
mov ebx, dword [ebp - 0xa94]
sub esi, edx
sub ebx, edi
mov dword [ebp - 0xa88], esi
cmp esi, ebx
jl 0xb9531a
mov esi, ebx
mov dword [ebp - 0xa88], ebx
mov ebx, dword [ebp - 0x3c4]
sub dword [ebp - 0xa9c], eax
sub ebx, ecx
mov dword [ebp - 0xac4], ebx
cmp ebx, dword [ebp - 0xa9c]
jl 0xb95342
mov ebx, dword [ebp - 0xa9c]
mov dword [ebp - 0xac4], ebx
test esi, esi
jle 0xb954cd
test ebx, ebx
jle 0xb954cd
mov ebx, dword [ebp - 0x3c8]
imul ecx, ebx
shl ebx, 2
add ecx, edx
mov edx, dword [ebp - 0xab4]
mov dword [ebp - 0xab4], ebx
lea ecx, [edx + ecx*4]
mov edx, dword [ebp - 0xa94]
imul eax, edx
mov dword [ebp - 0xaac], ecx
add eax, edi
mov edi, dword [ebp - 0xaa0]
shl edx, 2
mov dword [ebp - 0xa94], edx
lea eax, [edi + eax*4]
mov dword [ebp - 0xaa0], eax
mov ebx, eax
mov dword [ebp - 0xab0], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xa9c], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xaa8], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xb9547a
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xad8]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaa8]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xa9c]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xad8]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa9c]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xab6]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa9c]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xab0]
cdq
idiv ecx
mov edx, dword [ebp - 0xa9c]
add al, bl
mov ebx, dword [ebp - 0xaa8]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0xa9c], edx
mov dword [ebp - 0xab0], esi
jne 0xb953b4
mov ecx, dword [ebp - 0xaac]
mov eax, dword [ebp - 0xaa0]
add ecx, dword [ebp - 0xab4]
add eax, dword [ebp - 0xa94]
sub dword [ebp - 0xac4], 1
mov esi, dword [ebp - 0xa88]
mov dword [ebp - 0xaac], ecx
mov dword [ebp - 0xaa0], eax
jne 0xb95398
push dword [ebp - 0xabc]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xa98]
mov ebx, dword [ebp - 0xa8c]
test eax, eax
je 0xb95505
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0xaa4], 0
jl 0xb9642d
jmp 0xb963db
xor edx, edx
inc edx
cmp dword [ebp - 0xa80], 0
jne 0xb9553c
cmp ebx, edx
je 0xb9553c
mov al, 0xc0
jmp 0xb9553e
or al, 0xff
mov esi, dword [0xc93008]
xor ecx, ecx
push dword [ebp - 0xac0]
mov edi, ecx
mov byte [ebp - 0xa86], al
mov eax, ecx
mov word [ebp - 0xa88], cx
mov dword [ebp - 0xe38], ecx
mov dword [ebp - 0xe34], ecx
mov dword [ebp - 0xaa0], ecx
mov dword [ebp - 0xe4c], ecx
mov dword [ebp - 0xe48], ecx
mov dword [ebp - 0xe44], ecx
mov ecx, esi
mov byte [ebp - 0xa85], dl
mov dword [ebp - 0xa98], eax
mov dword [ebp - 0xe40], eax
mov dword [ebp - 0xaac], edi
mov dword [ebp - 0xe3c], edi
mov dword [ebp - 0xe50], eax
call dword [0xc99200]
call esi
mov dword [ebp - 0xad0], eax
test eax, eax
jne 0xb955c4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb9642d
xor eax, eax
inc eax
cmp ebx, eax
jne 0xb956c2
mov eax, dword [ebp - 0xa58]
mov edx, dword [ebp - 0xa48]
sub edx, dword [ebp - 0xa50]
sub eax, dword [ebp - 0xa60]
mov dword [ebp - 0xab4], edx
cmp edx, eax
jg 0xb955f9
mov edx, eax
mov dword [ebp - 0xab4], eax
mov ecx, dword [ebp - 0xa44]
mov eax, ecx
sub eax, dword [ebp - 0xa5c]
mov dword [ebp - 0xa94], eax
xor eax, eax
mov ebx, eax
cmp dword [ebp - 0xa84], eax
je 0xb9564f
mov edi, dword [ebp - 0xa60]
sub edi, dword [ebp - 0xa58]
mov eax, dword [ebp - 0xa50]
add edi, edx
sub eax, dword [ebp - 0xa48]
mov ebx, edi
add eax, edx
mov dword [ebp - 0xa98], edi
mov dword [ebp - 0xe40], edi
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0xe50], eax
sub eax, dword [ebp - 0xa50]
add eax, dword [ebp - 0xa48]
sub ebx, dword [ebp - 0xa60]
mov edi, dword [ebp - 0xa54]
sub edi, dword [ebp - 0xa5c]
add ebx, dword [ebp - 0xa58]
sub ecx, dword [ebp - 0xa4c]
mov dword [ebp - 0xa8c], eax
mov dword [ebp - 0xe48], eax
mov eax, dword [ebp - 0xa4c]
sub eax, dword [ebp - 0xa5c]
add ecx, eax
mov dword [ebp - 0xe38], ebx
mov dword [ebp - 0xa9c], edi
mov dword [ebp - 0xe34], edi
mov dword [ebp - 0xaa4], eax
mov dword [ebp - 0xe4c], eax
mov dword [ebp - 0xabc], ecx
mov dword [ebp - 0xe44], ecx
jmp 0xb95754
mov eax, dword [ebp - 0x3a4]
lea esi, [ebp - 0xa60]
lea edi, [ebp - 0xe40]
mov edx, dword [ebp - 0x3a8]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xa94], eax
mov dword [ebp - 0xab4], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xe34]
lea esi, [ebp - 0xa50]
mov ebx, dword [ebp - 0xe38]
lea edi, [ebp - 0xe50]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xa9c], eax
mov eax, dword [ebp - 0xe3c]
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0xe40]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xa98], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xe44]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0xe48]
mov dword [ebp - 0xa8c], eax
mov eax, dword [ebp - 0xe4c]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0xe50]
mov dword [ebp - 0xaa0], eax
mov edi, dword [ebp - 0xa94]
xor ecx, ecx
mov esi, dword [0xc9300c]
mov eax, edi
neg eax
mov dword [ebp - 0xc0c], ecx
mov dword [ebp - 0x494], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x48c], ecx
mov word [ebp - 0x490], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x48e], ax
lea eax, [ebp - 0xc0c]
push eax
push ecx
lea eax, [ebp - 0x49c]
mov dword [ebp - 0x488], ecx
push eax
push dword [ebp - 0xad0]
mov dword [ebp - 0x484], ecx
mov dword [ebp - 0x480], ecx
mov dword [ebp - 0x47c], ecx
mov dword [ebp - 0x478], ecx
mov dword [ebp - 0x474], ecx
mov ecx, esi
mov dword [ebp - 0x49c], 0x28
mov dword [ebp - 0x498], edx
call dword [0xc99200]
call esi
mov dword [ebp - 0xae4], eax
test eax, eax
jne 0xb957f6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb96412
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push dword [ebp - 0xad0]
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xab8], eax
jne 0xb95860
mov ecx, dword [ebp - 0xae8]
test ecx, ecx
je 0xb95860
mov esi, dword [0xc93074]
xor eax, eax
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0xab4]
push ecx
mov dword [ebp - 0x3d8], eax
mov ecx, esi
lea eax, [ebp - 0x3e0]
mov dword [ebp - 0x3d4], edi
push eax
push dword [ebp - 0xad0]
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xa80]
mov esi, dword [ebp - 0xa7c]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0xa70]
mov dword [ebp - 0xab0], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x934]
mov dword [ebp - 0xac8], esi
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x988]
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xa90], eax
mov dword [ebp - 0xaec], eax
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xadc], eax
lea eax, [ebp - 0x4c8]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x400]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0xb963f7
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [ebp - 0xad0]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb9590e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb963f7
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x934]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb95950
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0x930]
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0xadc], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0xb00], ecx
test ecx, ecx
je 0xb95903
mov edi, dword [ebp - 0xa9c]
xor edx, edx
sub edi, dword [ebp - 0xaac]
sub ebx, dword [ebp - 0xa98]
mov eax, edi
mov esi, dword [0xc9300c]
neg eax
mov dword [ebp - 0x4c0], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc10], edx
mov word [ebp - 0x4bc], ax
pop eax
push edx
push edx
mov word [ebp - 0x4ba], ax
lea eax, [ebp - 0xc10]
push eax
push edx
lea eax, [ebp - 0x4c8]
mov dword [ebp - 0xa9c], edx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x4b8], edx
mov dword [ebp - 0x4b4], edx
mov dword [ebp - 0x4b0], edx
mov dword [ebp - 0x4ac], edx
mov dword [ebp - 0x4a8], edx
mov dword [ebp - 0x4a4], edx
mov dword [ebp - 0x4a0], edx
mov dword [ebp - 0x4c8], 0x28
mov dword [ebp - 0x4c4], ebx
call dword [0xc99200]
call esi
mov dword [ebp - 0xb04], eax
test eax, eax
jne 0xb95a4c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xa9c], eax
test eax, eax
jle 0xb95a31
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xa9c], eax
test eax, eax
mov edi, dword [ebp - 0xb00]
js 0xb95da5
mov dword [ebp - 0xa9c], 0x80004005
jmp 0xb95da5
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x988]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb95a76
mov eax, dword [ebp - 0x974]
mov dword [ebp - 0xaec], eax
push dword [ebp - 0xb04]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x3f8], ebx
mov ebx, dword [ebp - 0xb00]
push ebx
mov dword [ebp - 0x3f4], edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
push dword [ebp - 0xab0]
mov esi, dword [0xc9303c]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0xab0], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x400]
mov ecx, edi
push eax
push ebx
call dword [0xc99200]
call edi
mov esi, dword [0xc9306c]
xor eax, eax
push eax
push dword [ebp - 0xac4]
lea eax, [ebp - 0x400]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xac8]
push ebx
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xab8], eax
jne 0xb95b60
cmp dword [ebp - 0xaa8], 0
je 0xb95b54
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0xaa8], eax
jmp 0xb95b6a
mov dword [ebp - 0xaa8], 0xffffff
jmp 0xb95b6a
mov dword [ebp - 0xaa8], 0xffa8a8a8
mov ecx, dword [ebp - 0xa98]
xor ebx, ebx
mov edi, ebx
mov edx, ebx
test ecx, ecx
jns 0xb95b80
mov edi, ecx
mov ecx, ebx
neg edi
mov eax, dword [ebp - 0xaac]
test eax, eax
jns 0xb95b90
mov edx, eax
mov eax, ebx
neg edx
mov esi, dword [ebp - 0x3f8]
mov ebx, dword [ebp - 0xae0]
sub esi, edi
sub ebx, ecx
mov dword [ebp - 0xa98], esi
cmp esi, ebx
jl 0xb95bb2
mov esi, ebx
mov dword [ebp - 0xa98], ebx
mov ebx, dword [ebp - 0x3f4]
sub dword [ebp - 0xadc], eax
sub ebx, edx
mov dword [ebp - 0xaac], ebx
cmp ebx, dword [ebp - 0xadc]
jl 0xb95bda
mov ebx, dword [ebp - 0xadc]
mov dword [ebp - 0xaac], ebx
test esi, esi
jle 0xb95d6d
test ebx, ebx
jle 0xb95d6d
imul eax, dword [ebp - 0xae0]
imul edx, dword [ebp - 0x3f8]
add eax, ecx
mov ecx, dword [ebp - 0xa90]
add edx, edi
mov edi, dword [ebp - 0xaec]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x3f8]
shl ecx, 2
lea ebx, [edi + edx*4]
mov dword [ebp - 0xaec], ecx
mov ecx, dword [ebp - 0xae0]
shl ecx, 2
mov dword [ebp - 0xac8], ebx
mov dword [ebp - 0xa90], eax
mov dword [ebp - 0xae0], ecx
lea edx, [eax + 3]
mov dword [ebp - 0xb64], esi
sub eax, ebx
mov dword [ebp - 0xadc], edx
lea edi, [ebx + 2]
mov dword [ebp - 0xb68], eax
mov ebx, esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xb95d1a
mov eax, dword [ebp - 0xb68]
movzx esi, cl
mov bl, byte [eax + edi]
mov eax, dword [ebp - 0xaa8]
movzx eax, al
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb68]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xadc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xaa8]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xadc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xaa6]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xadc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov edx, dword [ebp - 0xadc]
add al, bl
mov ebx, dword [ebp - 0xb64]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xadc], edx
mov dword [ebp - 0xb64], ebx
jne 0xb95c54
mov ebx, dword [ebp - 0xac8]
mov eax, dword [ebp - 0xa90]
add ebx, dword [ebp - 0xaec]
add eax, dword [ebp - 0xae0]
sub dword [ebp - 0xaac], 1
mov esi, dword [ebp - 0xa98]
mov dword [ebp - 0xac8], ebx
mov dword [ebp - 0xa90], eax
jne 0xb95c38
push dword [ebp - 0xb04]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xab0]
mov edi, dword [ebp - 0xb00]
test eax, eax
je 0xb95da5
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0xa9c], 0
jl 0xb963f7
mov eax, dword [ebp - 0xa80]
mov ebx, dword [ebp - 0xa78]
mov dword [ebp - 0xa98], eax
mov eax, dword [ebp - 0xa6c]
mov dword [ebp - 0xaac], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x9dc]
mov dword [ebp - 0xa9c], ebx
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa30]
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xa90], eax
lea eax, [ebp - 0x4f4]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x3f0]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xb963f7
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [ebp - 0xad0]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xb95903
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x9dc]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb95eac
mov eax, dword [ebp - 0x9c8]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0x9d8]
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0x9d4]
mov dword [ebp - 0xa90], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0xaec], edi
test edi, edi
je 0xb95903
mov eax, dword [ebp - 0xa8c]
xor edx, edx
sub eax, dword [ebp - 0xaa0]
mov ecx, dword [ebp - 0xabc]
mov ebx, dword [ebp - 0xaa4]
sub ecx, ebx
mov esi, dword [0xc9300c]
mov dword [ebp - 0xa8c], eax
mov dword [ebp - 0x4f0], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xabc], ecx
mov word [ebp - 0x4e8], ax
neg ecx
pop eax
push edx
push edx
mov word [ebp - 0x4e6], ax
lea eax, [ebp - 0xc14]
push eax
push edx
lea eax, [ebp - 0x4f4]
mov dword [ebp - 0x4ec], ecx
push eax
push edi
mov ecx, esi
mov dword [ebp - 0xc14], edx
mov dword [ebp - 0xaa4], edx
mov dword [ebp - 0x4e4], edx
mov dword [ebp - 0x4e0], edx
mov dword [ebp - 0x4dc], edx
mov dword [ebp - 0x4d8], edx
mov dword [ebp - 0x4d4], edx
mov dword [ebp - 0x4d0], edx
mov dword [ebp - 0x4cc], edx
mov dword [ebp - 0x4f4], 0x28
call dword [0xc99200]
call esi
mov dword [ebp - 0xae0], eax
test eax, eax
jne 0xb95fb8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xaa4], eax
test eax, eax
jle 0xb95fa3
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xaa4], eax
test eax, eax
js 0xb96331
mov dword [ebp - 0xaa4], 0x80004005
jmp 0xb96331
mov esi, dword [0xc93034]
lea ecx, [ebp - 0xa30]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb95fe2
mov eax, dword [ebp - 0xa1c]
mov dword [ebp - 0xab0], eax
push dword [ebp - 0xae0]
mov eax, dword [ebp - 0xa8c]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0xabc]
push edi
mov dword [ebp - 0x3e4], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0xaac]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0xaac], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x3f0]
mov ecx, edi
push eax
push dword [ebp - 0xaec]
call dword [0xc99200]
call edi
mov edi, dword [ebp - 0xaec]
xor eax, eax
mov esi, dword [0xc9306c]
mov ecx, esi
push eax
push dword [ebp - 0xac4]
lea eax, [ebp - 0x3f0]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xa9c]
push edi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xab8], eax
jne 0xb960d7
cmp dword [ebp - 0xa98], 0
je 0xb960cb
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
jmp 0xb960dc
mov dword [ebp - 0xac4], 0xffffff
jmp 0xb960e8
mov eax, 0xffa8a8a8
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xad8], eax
mov edx, dword [ebp - 0xaa0]
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xa98], ecx
test edx, edx
jns 0xb9610c
mov ecx, edx
neg ecx
xor esi, esi
mov dword [ebp - 0xa98], ecx
mov edx, esi
jmp 0xb9610e
xor esi, esi
test ebx, ebx
jns 0xb96118
mov eax, ebx
mov ebx, esi
neg eax
mov esi, dword [ebp - 0x3e8]
sub esi, ecx
mov ecx, dword [ebp - 0xac8]
sub ecx, edx
mov dword [ebp - 0xaa0], esi
cmp esi, ecx
jl 0xb9613a
mov esi, ecx
mov dword [ebp - 0xaa0], ecx
mov ecx, dword [ebp - 0x3e4]
sub dword [ebp - 0xa90], ebx
sub ecx, eax
mov dword [ebp - 0xa9c], ecx
cmp ecx, dword [ebp - 0xa90]
jl 0xb96162
mov ecx, dword [ebp - 0xa90]
mov dword [ebp - 0xa9c], ecx
test esi, esi
jle 0xb962ff
test ecx, ecx
jle 0xb962ff
imul eax, dword [ebp - 0x3e8]
imul ebx, dword [ebp - 0xac8]
mov ecx, dword [ebp - 0xab0]
add eax, dword [ebp - 0xa98]
add ebx, edx
mov edx, dword [ebp - 0x3e8]
shl edx, 2
mov dword [ebp - 0xabc], edx
mov edx, dword [ebp - 0xac8]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0xaa8]
shl edx, 2
mov dword [ebp - 0xa98], eax
mov dword [ebp - 0xaa8], edx
lea ecx, [ecx + ebx*4]
mov dword [ebp - 0xa8c], ecx
mov ebx, ecx
mov dword [ebp - 0xa90], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [ebp - 0xab0], edx
lea edi, [eax + 2]
mov dword [ebp - 0xac8], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xb962a6
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xad8]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac8]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xab0]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xad8]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xab0]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xac2]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xab0]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xa90]
cdq
idiv ecx
mov edx, dword [ebp - 0xab0]
add al, bl
mov ebx, dword [ebp - 0xac8]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0xab0], edx
mov dword [ebp - 0xa90], esi
jne 0xb961e0
mov eax, dword [ebp - 0xa98]
mov ecx, dword [ebp - 0xa8c]
add eax, dword [ebp - 0xabc]
add ecx, dword [ebp - 0xaa8]
sub dword [ebp - 0xa9c], 1
mov esi, dword [ebp - 0xaa0]
mov dword [ebp - 0xa98], eax
mov dword [ebp - 0xa8c], ecx
jne 0xb961c4
mov edi, dword [ebp - 0xaec]
push dword [ebp - 0xae0]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xaac]
test eax, eax
je 0xb96331
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0xaa4], 0
jl 0xb963f7
xor eax, eax
inc eax
cmp dword [ebp - 0xab8], eax
jne 0xb96399
mov esi, dword [section..data]
xor eax, eax
push 0xcc0020
push eax
push eax
push dword [ebp - 0xad0]
mov ecx, esi
push dword [ebp - 0xa94]
push dword [ebp - 0xab4]
push dword [ebp - 0xa5c]
push dword [ebp - 0xa60]
push dword [ebp - 0xac0]
call dword [0xc99200]
call esi
jmp 0xb963db
push dword [ebp - 0xa88]
mov ecx, dword [ebp - 0xa94]
xor edx, edx
mov eax, dword [ebp - 0xab4]
mov esi, dword [0xc93020]
push ecx
push eax
push edx
push edx
push dword [ebp - 0xad0]
push ecx
push eax
push dword [ebp - 0x3ac]
mov ecx, esi
push dword [ebp - 0x3b0]
push dword [ebp - 0xac0]
call dword [0xc99200]
call esi
push dword [ebp - 0xad4]
mov esi, dword [0xc93040]
mov ecx, esi
push dword [ebp - 0xac0]
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xae4]
test eax, eax
je 0xb96412
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xad0]
test eax, eax
je 0xb9642d
mov esi, dword [0xc93018]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xae8]
test eax, eax
je 0xb96448
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov edi, 0xc96238
mov ecx, dword [ebp - 0xa7c]
xor ebx, ebx
test ecx, ecx
je 0xb9649e
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb9645c
mov eax, dword [ebp - 0xa7c]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xb96484
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xb9647c
push dword [ebp - 0xa7c]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xa7c], ebx
mov ecx, dword [ebp - 0xa78]
test ecx, ecx
je 0xb964ed
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb964ab
mov eax, dword [ebp - 0xa78]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xb964d3
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xb964cb
push dword [ebp - 0xa78]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xa78], ebx
mov edx, dword [ebp - 0xa74]
test edx, edx
je 0xb96539
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb964fc
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xb96524
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xb96516
mov edx, dword [ebp - 0xa74]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xa74], ebx
cmp dword [ebp - 0xa70], 0
je 0xb9655e
push dword [ebp - 0xa70]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0xa70], ebx
cmp dword [ebp - 0xa6c], 0
je 0xb96583
push dword [ebp - 0xa6c]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0xa6c], ebx
cmp dword [ebp - 0xa68], 0
je 0xb965a8
push dword [ebp - 0xa68]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0xa68], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xb965aa
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jle 0xb9660c
sub eax, 1
mov dword [0xc95890], eax
jne 0xb9660c
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb965e0
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb965cf
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0xc95878]
mov esi, dword [0xc9304c]
mov ecx, esi
mov dword [ebp - 0xab8], eax
call dword [0xc99200]
call esi
sub eax, dword [0xc95870]
lea edi, [ebp - 0x300]
push 7
mov dword [ebp - 0xad0], eax
mov edx, 0xc96238
xor eax, eax
xor ebx, ebx
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xb9664b
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jne 0xb96c3e
push 0x338
mov esi, ebx
mov dword [ebp - 0xae4], ebx
push ebx
mov dword [ebp - 0xae8], ebx
mov dword [ebp - 0xa88], esi
mov dword [ebp - 0xb20], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb28], eax
test eax, eax
je 0xb96c32
or dword [ebp - 0xafc], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0xacc], ebx
mov dword [ebp - 0xb0c], ebx
mov edx, ebx
mov dword [ebp - 0xb34], eax
mov esi, dword [ebp - 0xc2c]
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [ebp - 0xb30], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [ebp - 0xc2c], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [ebp - 0xb0c]
xor esi, edx
xor esi, 0xac987321
mov edx, esi
rol edx, 0xa
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul eax, eax, 0x137f
add edx, eax
mov eax, dword [ebp - 0xb30]
xor eax, edx
mov dword [ebp - 0xb30], eax
lea edx, [eax + 0x7f1137f]
rol eax, 2
ror edx, 9
imul edx, edx, 0xab69
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xb30]
sub edx, 0x756c8a2
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb30], eax
xor edx, 0xab69
rol eax, 2
rol edx, 6
imul edx, edx, 0x7f1
sub edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
xor eax, 0xab69605e
sub edx, eax
mov eax, dword [ebp - 0xb30]
xor eax, edx
mov dword [ebp - 0xb30], eax
mov edx, eax
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
mov edx, esi
rol edx, 2
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul eax, eax, 0x605e
add edx, eax
mov eax, dword [ebp - 0xb30]
xor eax, edx
mov dword [ebp - 0xb30], eax
lea edx, [eax + 0x54969fa2]
rol eax, 8
ror edx, 0xe
imul edx, edx, 0x7f1
sub edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0xab69605e
ror edx, 0xa
ror eax, 0xc
imul eax, eax, 0x137f
xor edx, eax
mov eax, dword [ebp - 0xb30]
xor eax, edx
mov dword [ebp - 0xb30], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb30]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xb30]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0xb30], edx
add edx, 0xfffff80f
xor edx, esi
mov esi, dword [ebp - 0xb30]
xor edx, 0xab69605e
mov eax, edx
mov dword [ebp - 0xb0c], edx
xor eax, 0x7f1
shr edx, 2
rol eax, 2
imul eax, eax, 0x137f
add edx, eax
xor esi, edx
mov edx, esi
rol edx, 7
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul eax, eax, 0xab69
add edx, eax
mov eax, dword [ebp - 0xb0c]
xor eax, edx
mov dword [ebp - 0xb0c], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0xab69
rol edx, 7
rol eax, 5
imul eax, eax, 0x7f1
add edx, eax
xor dword [ebp - 0xb0c], edx
mov edx, dword [ebp - 0xb0c]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xb0c], edx
add edx, 0xf80eec81
mov eax, dword [ebp - 0xb0c]
ror edx, 1
imul edx, edx, 0x605e
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
mov edx, esi
rol eax, 3
imul eax, eax, 0x7f1
rol edx, 0xe
add edx, eax
mov eax, dword [ebp - 0xb0c]
xor eax, edx
mov dword [ebp - 0xb0c], eax
lea edx, [eax - 0x54969fa2]
ror eax, 0xe
rol edx, 0xf
imul edx, edx, 0x137f
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xb0c]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xb0c], eax
xor eax, edx
mov edx, dword [ebp - 0xb0c]
rol eax, 4
imul eax, eax, 0x605e
rol edx, 2
xor edx, eax
mov eax, dword [ebp - 0xacc]
xor eax, esi
mov dword [ebp - 0xacc], ebx
mov esi, dword [ebp - 0xb34]
xor eax, edx
mov edx, dword [ebp - 0xb0c]
xor edx, dword [ebp - 0xafc]
mov dword [ebp - 0xafc], edi
mov byte [esi - 4], al
mov byte [esi], dl
ror eax, 8
mov byte [esi - 5], al
ror edx, 8
mov byte [esi - 1], dl
ror eax, 8
ror edx, 8
mov byte [esi - 6], al
mov byte [esi - 2], dl
ror eax, 8
ror edx, 8
mov byte [esi - 7], al
mov byte [esi - 3], dl
add esi, 8
ror edx, 8
ror eax, 8
sub dword [ebp - 0xc30], 1
mov dword [ebp - 0xb0c], edx
mov edx, eax
mov dword [ebp - 0xb30], eax
mov dword [ebp - 0xb34], esi
jne 0xb966c3
mov esi, dword [ebp - 0xb28]
xor eax, eax
mov edx, eax
xor cl, byte [edx + esi]
inc edx
cmp edx, 0x338
jb 0xb96a24
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xb96a58
cmp edx, dword [0x9fc02c]
jne 0xb96a58
mov ebx, dword [ebp - 0xb20]
mov edi, esi
xor eax, eax
mov dword [ebp - 0xa88], edi
mov esi, eax
jmp 0xb96a6c
or dword [ebp - 0xc34], 0xffffffff
mov ebx, 0xc004d501
mov edi, dword [ebp - 0xa88]
xor eax, eax
test esi, esi
je 0xb96a7f
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb96c2c
mov eax, dword [ebp - 0xc34]
xor ecx, ecx
push 0x40
push ecx
mov ebx, 0xc960a0
mov esi, edi
push ebx
mov byte [eax + edi], cl
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xb96bc2
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbec]
jne 0xb96ab7
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xb96c25
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xae8], ecx
cmp word [eax], dx
je 0xb96b04
mov ecx, 0xc000007b
mov dword [ebp - 0xae8], ecx
jmp 0xb96b4c
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xb96af7
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xb96af7
cmp dword [edx], 0x4550
jne 0xb96af7
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc38]
je 0xb96b3a
cmp ax, word [ebp - 0xc3c]
je 0xb96b3a
mov ecx, 0xc000000d
jmp 0xb96afc
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xb20], eax
test eax, eax
je 0xb96bb6
mov edx, esi
mov dword [ebp - 0xb28], esi
lea eax, [edx + 1]
mov dword [ebp - 0xacc], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xb96b6e
sub edx, dword [ebp - 0xacc]
inc esi
add esi, edx
test ecx, ecx
js 0xb96ba7
push dword [ebp - 0xb28]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xb96bc2
mov ecx, dword [ebp - 0xae4]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xae8]
inc dword [ebp - 0xae4]
inc ebx
cmp ebx, dword [ebp - 0xb20]
jb 0xb96b5d
add edi, 0x10
cmp byte [esi], 0
jne 0xb96ab0
mov ebx, dword [ebp - 0xae8]
mov esi, dword [ebp - 0xa88]
test esi, esi
je 0xb96be3
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb96c39
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb96bfc
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb96beb
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xb96c46
mov ebx, 0xc000007a
jmp 0xb96bc8
mov esi, dword [ebp - 0xa88]
mov ebx, 0xc000007a
jmp 0xb96bce
mov eax, dword [0xc95890]
inc eax
xor ebx, ebx
mov dword [0xc95890], eax
xor eax, eax
mov edi, 0xc96238
xchg dword [edi], eax
mov eax, dword [ebp - 0xad0]
xor ecx, ecx
mov esi, dword [0xc93068]
inc ecx
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0xab8]
mov dword [ebp - 0x2e8], eax
lea eax, [ebp - 0x304]
push eax
push 4
pop eax
push eax
push 0x2021
mov dword [ebp - 0x304], ecx
mov dword [ebp - 0x2fc], ecx
mov dword [ebp - 0x2f0], ecx
mov dword [ebp - 0x2f4], ecx
mov dword [ebp - 0x2ec], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x2f8], 0x9966f291
call dword [0xc99200]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xb96cb5
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jle 0xb96d17
sub eax, 1
mov dword [0xc95890], eax
jne 0xb96d17
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb96ceb
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb96cda
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xac0]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
jmp 0xb96d36
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xb20], ebx
lea edi, [ebp - 0xe04]
mov dword [ebp - 0xb28], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xe10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xacc], eax
test eax, eax
je 0xb98e3b
push 0x28
pop ecx
mov esi, 0xc94ea0
mov dword [ebp - 0xb20], eax
mov edi, eax
rep movsd dword es:[edi], dword [esi]
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0xb98e3b
mov ecx, dword [0xc94e98]
mov edi, ebx
mov dword [ebx], ecx
mov ecx, dword [0xc94e9c]
mov dword [ebx + 4], ecx
mov dword [ebp - 0xb28], edi
rdtsc
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0xb0c], edx
xor eax, eax
mov dword [ebp - 0xb1c], eax
lea eax, [ebp - 0xaf4]
push eax
push 4
pop esi
mov edx, esi
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb98e33
mov edx, dword [ebp - 0xaf4]
lea eax, [ebp - 0xb1c]
push eax
xor ecx, ecx
call fcn.00a32533
or eax, 0x10000000
jl 0xb98e33
lea eax, [ebp - 0xb38]
mov edx, 0xa0
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb98e33
mov edx, dword [ebp - 0xb38]
lea eax, [ebp - 0xb1c]
mov ecx, dword [ebp - 0xb1c]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xb98e33
lea eax, [ebp - 0xb3c]
mov ecx, esi
push eax
push 8
pop edx
call fcn.00a32533
test eax, eax
js 0xb98e33
mov edx, dword [ebp - 0xb3c]
lea eax, [ebp - 0xb1c]
mov ecx, dword [ebp - 0xb1c]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xb98e33
lea eax, [ebp - 0xb9c]
mov ecx, esi
push eax
push 8
pop edx
call fcn.00a32533
test eax, eax
js 0xb98e33
mov edx, dword [ebp - 0xb9c]
lea eax, [ebp - 0xb1c]
mov ecx, dword [ebp - 0xb1c]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xb98e33
mov edi, dword [ebp - 0xb1c]
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xb9c], esi
test esi, esi
je 0xb98e3b
lea eax, [ebp - 0xd60]
mov ecx, esi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xb98e43
add edi, esi
lea eax, [esi + 8]
mov dword [ebp - 0xb3c], edi
cmp eax, edi
ja 0xb98e43
mov eax, dword [ebp - 0xd60]
push 4
pop ecx
mov dword [esi], ecx
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0xb94], esi
mov dword [ebp - 0xb38], eax
mov edx, dword [esi]
lea eax, [ebp - 0xb10]
push eax
call fcn.00a32533
test eax, eax
js 0xb98e43
mov edx, dword [ebp - 0xb10]
lea eax, [ebp - 0xb94]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb98e43
mov eax, dword [ebp - 0xb38]
xor ecx, ecx
mov esi, dword [ebp - 0xb94]
inc eax
inc ecx
mov dword [ebp - 0xb38], eax
cmp eax, ecx
jae 0xb96f86
push 4
pop ecx
jmp 0xb96f35
lea eax, [ebp - 0xd68]
mov ecx, esi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xb98e43
lea eax, [esi + 0xa4]
cmp eax, edi
ja 0xb98e43
mov edi, dword [ebp - 0xd68]
mov dword [esi], 0xa0
mov esi, dword [ebp - 0xacc]
push 0x28
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xb9c]
xor eax, eax
mov edi, esi
mov dword [ebp - 0xb10], eax
mov dword [ebp - 0xb74], edi
mov edx, dword [edi]
lea eax, [ebp - 0xb14]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
test eax, eax
js 0xb98e43
mov edx, dword [ebp - 0xb14]
lea eax, [ebp - 0xb74]
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xb98e43
mov eax, dword [ebp - 0xb10]
inc eax
mov dword [ebp - 0xb10], eax
cmp eax, 2
jae 0xb9702d
mov edi, dword [ebp - 0xb74]
jmp 0xb96fdc
mov ecx, dword [ebp - 0xb74]
lea eax, [ebp - 0xd70]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xb98e43
mov ecx, dword [ebp - 0xb74]
mov edi, dword [ebp - 0xb3c]
lea eax, [ecx + 0xc]
cmp eax, edi
ja 0xb98e43
mov dword [ecx], 8
mov ecx, dword [ebp - 0xd70]
mov eax, dword [ebx]
mov dword [ecx], eax
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
xor eax, eax
mov dword [ebp - 0xb90], esi
mov ebx, eax
mov edx, dword [esi]
lea eax, [ebp - 0xb98]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
test eax, eax
js 0xb98e43
mov edx, dword [ebp - 0xb98]
lea eax, [ebp - 0xb90]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb98e43
mov esi, dword [ebp - 0xb90]
inc ebx
cmp ebx, 3
jb 0xb97083
lea eax, [ebp - 0xd78]
mov ecx, esi
push eax
push 4
pop ebx
mov edx, ebx
call fcn.00a32533
test eax, eax
js 0xb98e43
lea eax, [esi + 0xc]
cmp eax, edi
ja 0xb98e43
mov eax, dword [ebp - 0xd78]
mov ecx, dword [ebp - 0xafc]
push 8
pop edi
mov dword [esi], edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xb0c]
mov dword [eax + 4], ecx
lea eax, [ebp - 0xb44]
mov edx, ebx
push eax
mov ecx, ebx
call fcn.00a32533
test eax, eax
js 0xb98e43
mov esi, dword [ebp - 0xb44]
lea eax, [ebp - 0xb78]
push eax
mov edx, edi
mov dword [ebp - 0xb48], esi
mov ecx, ebx
call fcn.00a32533
test eax, eax
js 0xb98e43
mov edx, dword [ebp - 0xb78]
lea eax, [ebp - 0xb48]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb98e43
xor ecx, ecx
rdtsc
mov edi, ecx
mov dword [ebp - 0xb78], ecx
mov ebx, ecx
mov dword [ebp - 0xb44], edi
mov dword [ebp - 0xb98], ebx
mov dword [ebp - 0xb90], ecx
mov dword [ebp - 0xb14], ecx
mov dword [ebp - 0xb74], ecx
mov dword [ebp - 0xb10], ecx
mov dword [ebp - 0xb94], ecx
mov dword [ebp - 0xb3c], ecx
mov dword [ebp - 0xb38], ecx
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0xacc], edx
push 8
pop ecx
mov dword [ebp - 0xc50], ecx
mov edx, dword [ebp - 0xb1c]
lea eax, [ebp - 0xc50]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb972c4
mov eax, dword [ebp - 0xc50]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0xafc], ecx
cmp ecx, eax
jae 0xb971f5
mov esi, 0xc0000095
jmp 0xb972c4
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xb97217
mov esi, 0xc0000017
mov edi, ebx
jmp 0xb972c4
push 4
pop ecx
lea eax, [ebp - 0xaf0]
mov dword [edi], ecx
mov edx, ecx
mov dword [ebp - 0xaf0], edi
push eax
mov ecx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb972a9
mov ecx, dword [ebp - 0xaf0]
mov eax, dword [ebp - 0xb1c]
mov dword [ecx], eax
lea eax, [ebp - 0xaf0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb972a9
mov eax, dword [ebp - 0xafc]
push dword [ebp - 0xb1c]
mov ecx, dword [ebp - 0xaf4]
push dword [ebp - 0xb9c]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xacc]
push dword [ebp - 0xaf0]
mov dword [edi + eax - 4], ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xafc]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xb78], edi
mov edi, ecx
mov dword [ebp - 0xb44], eax
jmp 0xb972ab
xor ecx, ecx
test edi, edi
je 0xb972be
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xb44]
or esi, 0x10000000
jl 0xb98c3d
xor ecx, ecx
mov dword [ebp - 0xaf0], ecx
cmp dword [ebp - 0xb78], ecx
jne 0xb972ea
mov esi, 0xc000000d
jmp 0xb9794f
test edi, edi
je 0xb9794a
lea eax, [edi + 8]
push eax
push ecx
mov dword [ebp - 0xaf4], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xb1c], esi
test esi, esi
je 0xb9794a
mov ebx, dword [ebp - 0xb78]
xor eax, eax
mov cl, al
mov edx, eax
test edi, edi
je 0xb97332
xor cl, byte [edx + ebx]
inc edx
cmp edx, edi
jb 0xb9732a
mov eax, 0xb1b54a58
mov dword [ebp - 0x388], eax
mov eax, 0xc81ecb17
mov dword [ebp - 0x384], eax
mov eax, edi
shr eax, 3
mov dword [ebp - 0xacc], eax
test eax, eax
je 0xb97776
movzx edx, word [ebp - 0x386]
mov eax, 0xc81ecb17
movzx esi, ax
mov edi, 0xb1b54a58
movzx eax, word [ebp - 0x382]
mov dword [ebp - 0xafc], eax
movzx eax, di
mov dword [ebp - 0xb0c], eax
mov eax, 0xc81ecb17
xor eax, edi
mov dword [ebp - 0xb34], edx
mov dword [ebp - 0xb84], eax
lea edi, [ebx + 2]
mov eax, dword [ebp - 0xb1c]
add eax, 7
mov dword [ebp - 0xb30], esi
mov dword [ebp - 0xba4], eax
xor eax, eax
mov dword [ebp - 0xba8], edi
mov esi, eax
or edx, 0xffffffff
mov dword [ebp - 0xbb4], eax
mov dword [ebp - 0xb6c], eax
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xba8]
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xba8]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xba8]
shl edi, 8
add dword [ebp - 0xba8], 8
movzx eax, byte [eax + 5]
or edi, eax
mov eax, ebx
xor edx, edi
xor eax, esi
mov dword [ebp - 0xb70], edx
sub edx, dword [ebp - 0xb0c]
xor edx, 0xc81ecb17
mov esi, dword [ebp - 0xb70]
xor eax, edx
mov edx, 0xc81ecb17
xor edx, eax
mov dword [ebp - 0xb8c], eax
ror edx, 0xf
imul edx, dword [ebp - 0xb34]
ror eax, 7
add eax, edx
mov edx, 0xb1b54a58
xor esi, eax
mov eax, esi
ror eax, 0xa
lea edx, [esi + edx]
ror edx, 9
imul edx, dword [ebp - 0xb30]
sub edx, eax
mov eax, dword [ebp - 0xb8c]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb8c], eax
xor edx, dword [ebp - 0xb30]
rol edx, 4
imul edx, dword [ebp - 0xafc]
rol eax, 5
add eax, edx
mov edx, 0xc81ecb17
xor esi, eax
mov eax, esi
xor eax, 0xb1b54a58
sub edx, eax
mov eax, dword [ebp - 0xb8c]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb8c], eax
sub edx, dword [ebp - 0xb0c]
imul edx, dword [ebp - 0xb34]
shr eax, 6
sub edx, eax
xor esi, edx
mov edx, dword [ebp - 0xb8c]
mov eax, esi
ror eax, 0xf
xor eax, dword [ebp - 0xb30]
imul eax, dword [ebp - 0xb0c]
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [ebp - 0xafc]
imul eax, dword [ebp - 0xb30]
xor esi, eax
mov eax, esi
sub eax, dword [ebp - 0xb0c]
sub eax, 0xc81ecb17
xor edx, eax
mov dword [ebp - 0xb8c], edx
mov eax, dword [ebp - 0xb8c]
xor eax, dword [ebp - 0xafc]
imul eax, dword [ebp - 0xb34]
ror edx, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xb0c]
xor edx, esi
mov eax, esi
rol edx, 6
imul edx, dword [ebp - 0xb30]
ror eax, 3
xor eax, edx
mov edx, dword [ebp - 0xb8c]
xor edx, eax
mov eax, edx
mov dword [ebp - 0xb8c], edx
ror eax, 0xf
sub eax, dword [ebp - 0xafc]
imul eax, dword [ebp - 0xb0c]
xor esi, eax
mov edx, esi
mov eax, esi
xor edx, dword [ebp - 0xafc]
imul edx, dword [ebp - 0xb0c]
shr eax, 1
xor edx, eax
mov eax, esi
xor dword [ebp - 0xb8c], edx
sub eax, dword [ebp - 0xb30]
mov edx, dword [ebp - 0xb0c]
rol eax, 3
imul edx, eax
mov eax, esi
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0xb8c]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb8c], eax
sub edx, dword [ebp - 0xb30]
imul edx, dword [ebp - 0xb34]
shr eax, 0xd
sub edx, eax
xor esi, edx
mov edx, 0xb1b54a58
sub edx, esi
mov eax, esi
ror edx, 9
imul edx, dword [ebp - 0xb30]
ror eax, 0xb
xor eax, edx
mov edx, dword [ebp - 0xb8c]
xor edx, eax
mov dword [ebp - 0xb8c], edx
sub edx, dword [ebp - 0xafc]
sub edx, 0xb1b54a58
xor esi, edx
mov edx, esi
mov eax, esi
xor edx, dword [ebp - 0xb34]
imul edx, dword [ebp - 0xb0c]
ror eax, 7
sub edx, eax
mov eax, dword [ebp - 0xb8c]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb8c], eax
xor edx, dword [ebp - 0xafc]
rol edx, 4
imul edx, dword [ebp - 0xb34]
ror eax, 0x10
sub edx, eax
xor esi, edx
mov edx, 0xb1b54a58
sub edx, esi
mov eax, esi
ror edx, 0xa
imul edx, dword [ebp - 0xb30]
ror eax, 4
add eax, edx
mov edx, dword [ebp - 0xb8c]
xor edx, eax
mov dword [ebp - 0xb8c], edx
sub edx, 0xb1b54a58
mov eax, dword [ebp - 0xb8c]
ror edx, 4
imul edx, dword [ebp - 0xafc]
ror eax, 9
xor eax, edx
mov edx, dword [ebp - 0xb0c]
xor esi, eax
mov dword [ebp - 0xb70], esi
mov esi, 0xc81ecb17
mov eax, dword [ebp - 0xb70]
xor esi, eax
rol esi, 8
imul edx, esi
mov esi, dword [ebp - 0xb8c]
rol eax, 2
sub edx, eax
xor esi, edx
mov edx, 0xc81ecb17
sub edx, esi
mov eax, esi
ror edx, 0xb
imul edx, dword [ebp - 0xb34]
ror eax, 0xc
sub edx, eax
mov eax, dword [ebp - 0xb70]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb70], eax
xor edx, dword [ebp - 0xb34]
imul edx, dword [ebp - 0xb30]
shr eax, 8
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xb70]
mov dword [ebp - 0xb8c], esi
xor esi, dword [ebp - 0xb84]
mov eax, dword [ebp - 0xb8c]
xor edx, esi
mov esi, dword [ebp - 0xba4]
xor eax, dword [ebp - 0xbb4]
xor edx, dword [ebp - 0xb6c]
mov dword [ebp - 0xb6c], edi
mov edi, dword [ebp - 0xba8]
mov byte [esi - 4], al
mov byte [esi], dl
ror eax, 8
mov byte [esi - 5], al
ror edx, 8
mov byte [esi - 1], dl
ror eax, 8
mov byte [esi - 6], al
ror edx, 8
mov byte [esi - 2], dl
ror eax, 8
ror edx, 8
mov byte [esi - 7], al
mov byte [esi - 3], dl
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xacc], 1
mov dword [ebp - 0xba4], esi
mov esi, eax
mov dword [ebp - 0xb8c], eax
mov dword [ebp - 0xbb4], ebx
jne 0xb973c9
mov edi, dword [ebp - 0xb44]
mov esi, dword [ebp - 0xb1c]
movzx eax, cl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0xb977a2
mov esi, 0xc0000017
jmp 0xb978a7
mov edi, dword [ebp - 0xaf4]
push edi
push 8
mov dword [ebx], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xb977c7
mov esi, 0xc0000017
xor edx, edx
jmp 0xb97840
mov dword [ebx + 4], eax
push edi
push esi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [ebx + 8], eax
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb977be
mov dword [ebx + 0xc], eax
push 0x28
pop ecx
push 8
mov edi, eax
mov esi, 0xc94df0
pop eax
push eax
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [ebx + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xb97824
mov esi, 0xc0000017
jmp 0xb97840
mov dword [ebx + 0x14], ecx
mov esi, edx
mov eax, dword [0xc94e90]
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ebp - 0xaf0], ebx
mov ebx, edx
mov dword [ecx + 4], eax
test ebx, ebx
je 0xb978a7
cmp dword [ebx + 4], 0
je 0xb97860
push dword [ebx + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebx + 4], edx
cmp dword [ebx + 0xc], 0
je 0xb9787c
push dword [ebx + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebx + 0xc], edx
cmp dword [ebx + 0x14], 0
je 0xb97898
push dword [ebx + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebx + 0x14], edx
push ebx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xb978bd
mov ebx, dword [ebp - 0xaf0]
xor eax, eax
mov dword [ebp - 0xb98], ebx
mov edi, eax
jmp 0xb978c9
mov ebx, dword [ebp - 0xb98]
mov edi, dword [ebp - 0xaf0]
mov eax, dword [ebp - 0xb1c]
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xb9794f
xor eax, eax
cmp dword [edi + 4], eax
je 0xb97901
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xb9791d
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xb97939
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb9794f
mov esi, 0xc0000001
or esi, 0x10000000
jl 0xb98c37
mov edx, dword [ebx]
lea eax, [ebp - 0xaf8]
push 4
pop edi
push eax
mov ecx, edi
mov dword [ebp - 0xaf8], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb979ea
mov ecx, dword [ebp - 0xaf8]
lea eax, [ebp - 0xaf8]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb979ea
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xaf8]
mov ecx, dword [ebp - 0xaf8]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb979ea
mov ecx, dword [ebp - 0xaf8]
lea eax, [ebp - 0xaf8]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb979ea
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xaf8]
mov ecx, dword [ebp - 0xaf8]
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0xaf8]
test esi, esi
jns 0xb979f0
mov eax, dword [ebp - 0xc5c]
mov dword [ebp - 0xaf8], eax
test esi, esi
js 0xb97b4c
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xb97a1e
mov esi, 0xc0000017
jmp 0xb97b49
mov eax, dword [ebx]
mov ecx, edi
mov dword [edi], eax
lea eax, [ebp - 0xb18]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xb18], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb97b34
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0xb18]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx]
lea eax, [ebp - 0xb18]
mov ecx, dword [ebp - 0xb18]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb97b34
mov ecx, dword [ebp - 0xb18]
mov eax, dword [ebx + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xb18]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb97b34
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0xb18]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xb18]
mov ecx, dword [ebp - 0xb18]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb97b34
mov ecx, dword [ebp - 0xb18]
mov eax, dword [ebx + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xb18]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb97b34
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0xb18]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xb18]
mov ecx, dword [ebp - 0xb18]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
xor ecx, ecx
test esi, esi
js 0xb97b36
mov eax, dword [ebp - 0xaf8]
mov dword [ebp - 0xb90], edi
mov edi, ecx
mov dword [ebp - 0xb14], eax
jmp 0xb97b36
xor ecx, ecx
test edi, edi
je 0xb97b49
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
push 4
pop edi
or esi, 0x10000000
jl 0xb98c37
xor eax, eax
mov dword [ebp - 0xc64], 8
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0xaf8], eax
mov edx, dword [ebp - 0xb48]
lea eax, [ebp - 0xc64]
push eax
push 8
pop ecx
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
jl 0xb97be6
mov eax, dword [ebp - 0xc64]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xb97ba6
mov esi, 0xc0000095
jmp 0xb97bc7
mov dword [ebp - 0xc6c], ecx
lea eax, [ebp - 0xc6c]
push eax
push 8
pop edx
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0xc6c]
test esi, esi
jns 0xb97bcd
mov eax, dword [ebp - 0xc68]
mov dword [ebp - 0xaf0], eax
test esi, esi
js 0xb97be6
mov ebx, dword [ebp - 0xb9c]
test ebx, ebx
jne 0xb97c1c
mov esi, 0xc000000d
mov edi, dword [ebp - 0xb10]
test esi, esi
js 0xb98c37
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xb97de7
mov eax, dword [ebp - 0xb74]
mov esi, 0xd0000017
jmp 0xb97df2
xor eax, eax
inc eax
cmp edi, eax
jbe 0xb97be1
mov ecx, ebx
xor eax, eax
mov dword [ebp - 0xb4c], ecx
mov edi, eax
mov eax, dword [ecx]
mov dword [ebp - 0xb48], eax
lea eax, [ebp - 0xb4c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb97be6
mov edx, dword [ebp - 0xb48]
lea eax, [ebp - 0xb4c]
mov ecx, dword [ebp - 0xb4c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb97be6
mov ecx, dword [ebp - 0xb4c]
xor eax, eax
inc edi
inc eax
cmp edi, eax
jb 0xb97c2f
mov edi, dword [ecx]
lea eax, [ebp - 0xb4c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb97be6
mov dword [ebp - 0xb18], edi
push 4
pop ecx
cmp ecx, 2
jbe 0xb97be1
xor eax, eax
mov dword [ebp - 0xb50], ebx
mov edi, eax
lea eax, [ebp - 0xb50]
mov edx, ecx
push eax
mov ecx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb97d19
mov edx, dword [ebx]
lea eax, [ebp - 0xb50]
mov ecx, dword [ebp - 0xb50]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb97d19
inc edi
cmp edi, 2
jae 0xb97cf8
mov ebx, dword [ebp - 0xb50]
push 4
pop ecx
jmp 0xb97cb7
mov ecx, dword [ebp - 0xb50]
lea eax, [ebp - 0xb50]
push eax
push 4
pop eax
mov edi, dword [ecx]
mov edx, eax
call fcn.00a32533
mov esi, eax
mov ebx, edi
test esi, esi
jns 0xb97d27
mov ebx, dword [ebp - 0xaf8]
test esi, esi
js 0xb97be6
mov edx, dword [ebp - 0xaf0]
lea eax, [ebp - 0xb40]
push 4
pop edi
push eax
mov ecx, edi
mov dword [ebp - 0xb40], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb97dbc
mov ecx, dword [ebp - 0xb40]
lea eax, [ebp - 0xb40]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb97dbc
mov edx, dword [ebp - 0xb18]
lea eax, [ebp - 0xb40]
mov ecx, dword [ebp - 0xb40]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb97dbc
mov ecx, dword [ebp - 0xb40]
lea eax, [ebp - 0xb40]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb97dbc
mov ecx, dword [ebp - 0xb40]
lea eax, [ebp - 0xb40]
push eax
mov edx, ebx
call fcn.00a32533
mov edi, dword [ebp - 0xb40]
mov esi, eax
test esi, esi
jns 0xb97dca
mov edi, dword [ebp - 0xc7c]
test esi, esi
js 0xb97be6
cmp edi, 0x400000
jbe 0xb97ddc
mov esi, 0x8000ffff
jmp 0xb98c37
mov dword [ebp - 0xb10], edi
jmp 0xb97bec
mov dword [ebp - 0xb74], eax
mov esi, 0x10000000
mov ebx, dword [ebp - 0xb90]
test esi, esi
js 0xb98c3d
test ebx, ebx
jne 0xb97e0e
mov esi, 0x80070057
jmp 0xb98c3d
test eax, eax
je 0xb97e04
mov ecx, dword [ebp - 0xb14]
mov dword [ebp - 0xe84], eax
xor eax, eax
mov dword [ebp - 0xe78], eax
lea eax, [ebp - 0xc80]
push eax
xor eax, eax
mov dword [ebp - 0xe88], ebx
push 0x9f29b8
inc eax
mov dword [ebp - 0xe80], ecx
push eax
mov dword [ebp - 0xe7c], edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xb97e72
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xb97e69
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xb97eba
mov esi, 0x80004005
jmp 0xb97eba
push 0x9fc030
push dword [ebp - 0xc80]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xb97e52
xor eax, eax
mov ecx, esi
push eax
push 0x14
lea eax, [ebp - 0xe88]
push eax
push 0x86
call dword [0xc99200]
call esi
mov esi, eax
or esi, 0x10000000
jl 0xb97eba
mov edi, dword [ebp - 0xe7c]
mov dword [ebp - 0xb10], edi
cmp esi, 0xd0000023
jne 0xb97ecc
mov esi, 0x8007007a
jmp 0xb98c3d
test esi, esi
js 0xb98c3d
mov eax, dword [ebp - 0xb74]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xb54], ecx
mov ebx, ecx
mov dword [ebp - 0xb58], eax
cmp edi, edx
jae 0xb97efb
mov esi, 0xc000003e
jmp 0xb982df
mov edi, dword [eax]
lea ecx, [ebp - 0xb58]
push ecx
mov ecx, eax
mov dword [ebp - 0xb40], edi
call fcn.00a32533
mov esi, eax
xor ecx, ecx
test esi, esi
js 0xb982df
lea eax, [ebp - 0xb54]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb982dd
mov eax, dword [ebp - 0xb10]
sub eax, dword [ebp - 0xb54]
cmp eax, edi
jae 0xb97f52
mov esi, 0xc000003e
jmp 0xb982dd
mov eax, dword [ebp - 0xb58]
lea ecx, [ebp - 0xb58]
push ecx
mov edx, edi
mov dword [ebp - 0xb50], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb982dd
mov ecx, dword [ebp - 0xb54]
lea eax, [ebp - 0xb54]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb982dd
mov eax, dword [ebp - 0xb10]
sub eax, dword [ebp - 0xb54]
push 4
pop edx
cmp eax, edx
jb 0xb97f48
mov ecx, dword [ebp - 0xb58]
lea eax, [ebp - 0xb58]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0xb4c], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb982dd
mov ecx, dword [ebp - 0xb54]
lea eax, [ebp - 0xb54]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb982dd
mov eax, dword [ebp - 0xb10]
sub eax, dword [ebp - 0xb54]
cmp eax, edi
jb 0xb97f48
mov eax, dword [ebp - 0xb58]
lea ecx, [ebp - 0xb58]
push ecx
mov edx, edi
mov dword [ebp - 0xb18], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb982dd
mov ecx, dword [ebp - 0xb54]
lea eax, [ebp - 0xb54]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb982dd
mov eax, dword [ebp - 0xb10]
sub eax, dword [ebp - 0xb54]
push 4
pop edx
cmp eax, edx
jb 0xb97f48
mov ecx, dword [ebp - 0xb58]
mov eax, dword [ecx]
mov dword [ebp - 0xaf8], eax
lea eax, [ebp - 0xb58]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb982dd
mov ecx, dword [ebp - 0xb54]
lea eax, [ebp - 0xb54]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb982dd
mov eax, dword [ebp - 0xb10]
sub eax, dword [ebp - 0xb54]
mov ecx, dword [ebp - 0xaf8]
cmp eax, ecx
jb 0xb97f48
lea eax, [ebp - 0xb54]
mov edx, ecx
mov ecx, dword [ebp - 0xb54]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb982dd
mov ecx, dword [ebp - 0xb10]
mov eax, ecx
sub eax, dword [ebp - 0xb54]
jne 0xb97f48
mov esi, dword [ebp - 0xb40]
mov edx, dword [ebp - 0xaf8]
add edx, 0xc
lea eax, [edi + esi]
add eax, edx
cmp eax, ecx
jne 0xb97f48
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xb9812b
mov esi, 0xc0000017
jmp 0xb98268
cmp dword [ebp - 0xb50], ebx
je 0xb9816c
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xb98155
mov esi, 0xc0000017
xor eax, eax
jmp 0xb98201
mov dword [edi + 4], eax
push esi
push dword [ebp - 0xb50]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb98173
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
cmp dword [ebp - 0xb18], ebx
je 0xb981af
mov esi, dword [ebp - 0xb4c]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb98149
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xb18]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb981b5
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
cmp dword [ebp - 0xb58], ebx
je 0xb981f5
mov esi, dword [ebp - 0xaf8]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb98149
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xb58]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb981fb
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov ebx, edi
mov esi, eax
mov edi, eax
test edi, edi
je 0xb98268
cmp dword [edi + 4], 0
je 0xb98221
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xb9823d
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xb98259
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test esi, esi
js 0xb98276
mov dword [ebp - 0xb94], ebx
mov ebx, ecx
test ebx, ebx
je 0xb982df
cmp dword [ebx + 4], 0
je 0xb98296
push dword [ebx + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 4], ecx
cmp dword [ebx + 0xc], 0
je 0xb982b2
push dword [ebx + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 0xc], ecx
cmp dword [ebx + 0x14], 0
je 0xb982ce
push dword [ebx + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 0x14], ecx
push ebx
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
or esi, 0x10000000
jl 0xb98c37
mov eax, dword [ebp - 0xb94]
mov ebx, ecx
mov dword [ebp - 0xb58], ebx
mov dword [ebp - 0xb54], ecx
test eax, eax
jne 0xb9830d
mov esi, 0xd000000d
jmp 0xb98c37
mov esi, dword [eax + 4]
mov dword [ebp - 0xb40], esi
test esi, esi
je 0xb98303
mov edi, dword [eax]
test edi, edi
je 0xb98303
add edi, 0xfffffff8
mov dword [ebp - 0xb50], ecx
push edi
push ecx
mov dword [ebp - 0xb4c], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb18], eax
test eax, eax
je 0xb989a5
mov ebx, 0xab69605e
mov dword [ebp - 0xaf8], esi
mov dword [ebp - 0x368], ebx
xor ecx, ecx
mov ebx, 0x7f1137f
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0x364], ebx
mov dl, cl
mov ebx, esi
mov dword [ebp - 0xb44], ecx
mov esi, edi
and esi, 7
je 0xb9894c
xor eax, eax
mov dword [ebp - 0xb48], ecx
test esi, esi
je 0xb983df
mov edi, eax
movzx eax, byte [ebx]
inc ebx
push 4
pop ecx
cmp edi, ecx
mov ecx, dword [ebp - 0xbac]
jge 0xb983b9
add ecx, 0xffffffe0
shl eax, cl
mov ecx, dword [ebp - 0xb44]
or ecx, eax
mov dword [ebp - 0xb44], ecx
jmp 0xb983c7
shl eax, cl
or dword [ebp - 0xb48], eax
mov ecx, dword [ebp - 0xb44]
sub dword [ebp - 0xbac], 8
inc edi
cmp edi, esi
jl 0xb98393
mov edi, dword [ebp - 0xb4c]
mov dword [ebp - 0xaf8], ebx
mov ebx, dword [ebp - 0xb48]
mov eax, ecx
xor eax, 0x92f65a5
xor ebx, 0x699a899c
xor ecx, ecx
mov dword [ebp - 0xb14], eax
mov dword [ebp - 0xb10], ebx
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0xb1c], ebx
mov dword [ebp - 0xacc], ecx
test esi, esi
je 0xb98477
mov ecx, dword [ebp - 0xaf0]
mov edi, dword [ebp - 0xacc]
push 4
pop ebx
lea eax, [ecx + 1]
mov dword [ebp - 0xaf0], eax
cmp edi, ebx
jge 0xb98441
rol dword [ebp - 0xaf4], 8
mov eax, dword [ebp - 0xaf4]
jmp 0xb9844e
rol dword [ebp - 0xb1c], 8
mov eax, dword [ebp - 0xb1c]
mov byte [ecx], al
inc edi
mov eax, dword [ebp - 0xaf0]
mov ecx, eax
cmp edi, esi
jl 0xb98425
mov ebx, dword [ebp - 0xb10]
xor ecx, ecx
mov edi, dword [ebp - 0xb4c]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0xb14]
cmp esi, 4
jbe 0xb98927
push 8
pop ecx
sub ecx, esi
shl ecx, 3
shr ebx, cl
shl ebx, cl
mov dword [ebp - 0xb10], ebx
mov ebx, dword [ebp - 0xaf8]
mov eax, edi
shr eax, 3
mov dword [ebp - 0xaf8], eax
test eax, eax
je 0xb988ee
movzx ecx, word [ebp - 0x366]
mov eax, 0x7f1137f
movzx esi, word [ebp - 0x362]
movzx eax, ax
mov dword [ebp - 0xb1c], ecx
mov ecx, 0xab69605e
mov dword [ebp - 0xaf4], eax
movzx eax, cx
mov ecx, dword [ebp - 0xb14]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0xaf0]
mov dword [ebp - 0xacc], esi
add eax, 7
lea esi, [ebx + 2]
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xb0c], esi
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
add dword [ebp - 0xb0c], 8
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor ecx, ebx
movzx eax, byte [esi + 4]
mov dword [ebp - 0xb14], ecx
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
mov esi, dword [ebp - 0xb10]
shl edi, 8
or edi, eax
mov eax, ecx
xor esi, edi
mov ecx, 0x7f1137f
xor eax, ecx
mov ecx, 0xab69605e
xor eax, ecx
xor esi, eax
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0xb10], esi
sub esi, ecx
mov ecx, dword [ebp - 0xb10]
rol ecx, 0xa
rol esi, 5
imul eax, esi
mov esi, 0x7f1137f
add ecx, eax
mov eax, dword [ebp - 0xb14]
xor eax, ecx
mov ecx, dword [ebp - 0xb1c]
mov dword [ebp - 0xb14], eax
lea esi, [eax + esi]
rol eax, 2
ror esi, 9
imul ecx, esi
mov esi, dword [ebp - 0xb14]
sub ecx, eax
mov eax, dword [ebp - 0xb10]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xb10], eax
sub ecx, dword [ebp - 0xaf4]
imul ecx, dword [ebp - 0xafc]
shr eax, 0xd
sub ecx, eax
xor esi, ecx
mov ecx, dword [ebp - 0xb1c]
xor ecx, esi
mov eax, esi
rol ecx, 6
imul ecx, dword [ebp - 0xacc]
rol eax, 2
sub ecx, eax
mov eax, dword [ebp - 0xb10]
xor eax, ecx
mov ecx, 0x7f1137f
mov dword [ebp - 0xb10], eax
xor eax, 0xab69605e
sub ecx, eax
mov eax, dword [ebp - 0xaf4]
xor esi, ecx
xor eax, esi
mov ecx, esi
imul eax, dword [ebp - 0xb1c]
ror ecx, 6
xor ecx, eax
mov eax, dword [ebp - 0xb10]
xor eax, ecx
mov dword [ebp - 0xb10], eax
mov ecx, 0x7f1137f
add ecx, eax
rol eax, 2
ror ecx, 0xf
imul ecx, dword [ebp - 0xafc]
add eax, ecx
xor esi, eax
mov ecx, esi
mov dword [ebp - 0xb14], esi
sub ecx, 0xab69605e
mov eax, esi
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0xacc]
sub ecx, eax
mov eax, dword [ebp - 0xb10]
xor eax, ecx
mov esi, eax
mov dword [ebp - 0xb10], eax
mov ecx, eax
xor esi, 0xab69605e
mov eax, dword [ebp - 0xaf4]
ror esi, 0xc
imul eax, esi
mov esi, dword [ebp - 0xb14]
ror ecx, 0xa
xor ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0xacc]
imul ecx, dword [ebp - 0xb1c]
shr eax, 0xa
xor ecx, eax
xor dword [ebp - 0xb10], ecx
mov ecx, dword [ebp - 0xb10]
mov eax, ecx
not eax
ror eax, 5
add eax, dword [ebp - 0xafc]
imul eax, dword [ebp - 0xacc]
xor esi, eax
mov eax, esi
sub eax, dword [ebp - 0xacc]
xor eax, 0xab69605e
xor ecx, eax
mov eax, dword [ebp - 0xacc]
xor eax, ecx
mov dword [ebp - 0xb10], ecx
mov ecx, dword [ebp - 0xaf4]
rol eax, 2
imul ecx, eax
mov eax, dword [ebp - 0xb10]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov dword [ebp - 0xb14], esi
sub esi, eax
mov eax, dword [ebp - 0xb1c]
mov ecx, dword [ebp - 0xb14]
ror esi, 6
imul eax, esi
mov esi, dword [ebp - 0xb10]
rol ecx, 7
add ecx, eax
mov eax, dword [ebp - 0xaf4]
xor esi, ecx
xor eax, esi
mov dword [ebp - 0xb10], esi
imul eax, dword [ebp - 0xafc]
mov ecx, esi
mov esi, dword [ebp - 0xb1c]
ror ecx, 9
add ecx, eax
mov eax, dword [ebp - 0xb14]
xor eax, ecx
xor esi, eax
mov dword [ebp - 0xb14], eax
rol esi, 5
mov ecx, eax
mov eax, dword [ebp - 0xacc]
imul eax, esi
mov esi, dword [ebp - 0xb10]
rol ecx, 7
add ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov eax, esi
xor eax, ecx
mov ecx, dword [ebp - 0xb14]
xor eax, 0xab69605e
xor ecx, eax
mov eax, ecx
mov dword [ebp - 0xb14], ecx
ror eax, 3
sub eax, dword [ebp - 0xb1c]
imul eax, dword [ebp - 0xaf4]
mov ecx, dword [ebp - 0xafc]
xor esi, eax
mov eax, 0x7f1137f
mov dword [ebp - 0xb10], esi
sub esi, eax
mov eax, dword [ebp - 0xb10]
ror esi, 1
imul ecx, esi
ror eax, 6
sub ecx, eax
mov eax, dword [ebp - 0xb14]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0xb14], eax
mov esi, eax
rol ecx, 3
mov eax, dword [ebp - 0xacc]
imul eax, ecx
mov ecx, dword [ebp - 0xaf4]
rol esi, 0xe
add esi, eax
mov eax, dword [ebp - 0xb10]
xor eax, esi
mov esi, 0xab69605e
mov dword [ebp - 0xb10], eax
lea esi, [eax + esi]
ror eax, 0xe
rol esi, 0xf
imul ecx, esi
mov esi, 0x7f1137f
sub ecx, eax
mov eax, dword [ebp - 0xb14]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xb14], eax
xor ecx, dword [ebp - 0xafc]
imul ecx, dword [ebp - 0xb1c]
shr eax, 3
xor ecx, eax
mov eax, dword [ebp - 0xb10]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xb10], eax
xor ecx, esi
mov esi, eax
mov eax, dword [ebp - 0xafc]
rol ecx, 4
imul eax, ecx
mov ecx, dword [ebp - 0xb14]
xor ecx, dword [ebp - 0xb44]
rol esi, 2
xor esi, eax
mov eax, dword [ebp - 0xb10]
xor eax, dword [ebp - 0xb48]
xor ecx, esi
mov esi, dword [ebp - 0xaf0]
mov byte [esi - 4], cl
ror ecx, 8
mov byte [esi], al
ror eax, 8
mov byte [esi - 5], cl
ror ecx, 8
mov byte [esi - 1], al
mov byte [esi - 6], cl
ror eax, 8
mov byte [esi - 2], al
ror ecx, 8
ror eax, 8
mov byte [esi - 7], cl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror ecx, 8
sub dword [ebp - 0xaf8], 1
mov dword [ebp - 0xaf0], esi
mov esi, dword [ebp - 0xb0c]
mov dword [ebp - 0xb10], eax
mov dword [ebp - 0xb44], ebx
mov dword [ebp - 0xb48], edi
jne 0xb984ff
mov edi, dword [ebp - 0xb4c]
mov ecx, dword [ebp - 0xb18]
xor eax, eax
mov esi, eax
test edi, edi
je 0xb98904
xor dl, byte [esi + ecx]
inc esi
cmp esi, edi
jb 0xb988fc
mov esi, dword [ebp - 0xb40]
movzx eax, dl
cdq
cmp eax, dword [edi + esi]
jne 0xb98964
cmp edx, dword [edi + esi + 4]
jne 0xb98964
mov esi, dword [ebp - 0xb50]
xor eax, eax
mov ebx, ecx
mov ecx, eax
jmp 0xb98977
push 4
mov dword [ebp - 0xb10], ecx
pop ecx
cmp esi, ecx
jae 0xb98492
sub ecx, esi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xb14], eax
jmp 0xb98492
or dword [ebp - 0xb48], 0xffffffff
mov dword [ebp - 0xb10], ecx
mov dword [ebp - 0xb14], ecx
jmp 0xb98498
mov ebx, dword [ebp - 0xb58]
mov esi, 0xc004d501
mov edi, dword [ebp - 0xb54]
xor eax, eax
test ecx, ecx
je 0xb9898a
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xb989a5
xor eax, eax
mov dword [ebp - 0xb3c], ebx
mov ebx, eax
mov dword [ebp - 0xb38], edi
mov esi, 0x10000000
jmp 0xb989ac
mov esi, 0xd0000001
xor eax, eax
test ebx, ebx
je 0xb989bf
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xb98c37
mov ebx, dword [ebp - 0xb38]
xor eax, eax
mov edi, dword [ebp - 0xb3c]
push 4
pop edx
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0xc90], edi
cmp ebx, edx
jb 0xb98c2c
mov eax, dword [edi]
mov ecx, edi
mov dword [ebp - 0xb58], eax
lea eax, [ebp - 0xc90]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb98c31
lea eax, [ebp - 0xba0]
xor ecx, ecx
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb98c31
mov eax, ebx
sub eax, dword [ebp - 0xba0]
push 4
pop edx
cmp eax, edx
jb 0xb98c2c
mov ecx, dword [ebp - 0xc90]
lea eax, [ebp - 0xc90]
push eax
mov ebx, dword [ecx]
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb98c31
mov ecx, dword [ebp - 0xba0]
lea eax, [ebp - 0xba0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb98c31
mov eax, dword [ebp - 0xb38]
mov ecx, dword [ebp - 0xba0]
sub eax, ecx
cmp eax, ebx
jb 0xb98c2c
lea eax, [ebp - 0xba0]
mov edx, ebx
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb98c31
mov edx, dword [ebp - 0xb38]
lea ecx, [edi + edx]
mov edi, dword [ebp - 0xc90]
lea eax, [ebx + edi]
cmp ecx, eax
jb 0xb98c2c
mov eax, dword [ebp - 0xb3c]
sub eax, ebx
sub eax, edi
add eax, edx
cmp eax, 8
jae 0xb98c2c
xor ecx, ecx
mov dword [ebp - 0xb54], ecx
mov eax, ecx
mov dword [ebp - 0xba0], eax
mov esi, ecx
test edi, edi
je 0xb98bc3
lea eax, [ebp - 0xc94]
mov edx, ebx
push eax
mov ecx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb98c31
mov eax, dword [ebp - 0xc94]
jmp 0xb98bab
lea eax, [ebp - 0xc98]
mov ecx, edi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb98c31
mov eax, dword [ebp - 0xc94]
cmp dword [ebp - 0xc98], eax
ja 0xb98be8
mov edx, dword [edi]
lea eax, [ebp - 0xc9c]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb98b6d
mov eax, dword [ebp - 0xc9c]
mov dword [ebp - 0xca0], eax
jmp 0xb98b73
mov eax, dword [ebp - 0xca0]
test esi, esi
js 0xb98c31
lea ecx, [ebp - 0xca4]
mov edx, eax
push ecx
mov ecx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb98c31
mov edi, dword [ebp - 0xca4]
mov eax, dword [ebp - 0xc94]
cmp edi, eax
ja 0xb98be8
inc dword [ebp - 0xb54]
cmp edi, eax
jb 0xb98b17
cmp edi, eax
jne 0xb98be8
mov edi, dword [ebp - 0xc90]
mov eax, dword [ebp - 0xba0]
test ebx, ebx
je 0xb98bf3
push ebx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xba0], eax
test eax, eax
jne 0xb98bef
mov esi, 0xc0000017
jmp 0xb98c1a
mov esi, 0xc000000d
jmp 0xb98c31
xor ecx, ecx
mov esi, ecx
test edi, edi
je 0xb98c08
push ebx
push edi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xba0]
add esp, 0xc
mov dword [ebp - 0xe08], eax
mov eax, dword [ebp - 0xb54]
mov dword [ebp - 0xe10], eax
test esi, esi
js 0xb98c31
mov eax, dword [ebp - 0xb58]
cmp eax, dword [ebp - 0xe10]
je 0xb98c31
mov esi, 0xc000003e
or esi, 0x10000000
mov ebx, dword [ebp - 0xb90]
mov eax, dword [ebp - 0xb78]
test eax, eax
je 0xb98c58
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xb98]
test edi, edi
je 0xb98cc6
xor eax, eax
cmp dword [edi + 4], eax
je 0xb98c7f
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xb98c9b
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xb98cb7
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
je 0xb98cdd
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb98cdf
xor ebx, ebx
mov eax, dword [ebp - 0xb74]
test eax, eax
je 0xb98cf8
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ebx, dword [ebp - 0xb94]
test ebx, ebx
je 0xb98d66
xor eax, eax
cmp dword [ebx + 4], eax
je 0xb98d1f
push dword [ebx + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 4], eax
cmp dword [ebx + 0xc], 0
je 0xb98d3b
push dword [ebx + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0xc], eax
cmp dword [ebx + 0x14], 0
je 0xb98d57
push dword [ebx + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0x14], eax
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb3c]
xor ebx, ebx
test eax, eax
je 0xb98d81
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xb98e43
mov edi, dword [ebp - 0xe10]
xor eax, eax
inc eax
cmp edi, eax
jb 0xb98e43
mov esi, dword [ebp - 0xe08]
test esi, esi
je 0xb98e43
test edi, edi
je 0xb98e43
lea eax, [ebp - 0xca8]
mov dword [ebp - 0xca8], esi
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb98e43
mov eax, dword [esi]
neg eax
sbb eax, eax
and eax, dword [ebp - 0xca8]
push 4
pop ecx
cmp dword [esi], ecx
jne 0xb98e43
cmp dword [eax], 0
jl 0xb98e43
xor eax, eax
inc eax
cmp edi, eax
jbe 0xb98e43
mov dword [ebp - 0xcac], esi
mov edi, ebx
lea eax, [ebp - 0xcac]
mov edx, ecx
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb98e43
mov edx, dword [esi]
lea eax, [ebp - 0xcac]
mov ecx, dword [ebp - 0xcac]
push eax
call fcn.00a32533
test eax, eax
js 0xb98e43
xor eax, eax
inc edi
inc eax
cmp edi, eax
jae 0xb98e43
mov esi, dword [ebp - 0xcac]
push 4
pop ecx
jmp 0xb98df4
mov eax, dword [ebp - 0xdfc]
jmp 0xb98e4f
mov eax, dword [ebp - 0xdfc]
jmp 0xb98e49
mov eax, dword [ebp - 0xb9c]
mov edi, dword [ebp - 0xb28]
xor ebx, ebx
test eax, eax
je 0xb98e64
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xe08]
test esi, esi
je 0xb98e7d
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb20]
test eax, eax
je 0xb98e96
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xb98ea9
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ebx, dword [ebp - 0xb24]
mov eax, dword [ebp - 0xb2c]
xor edx, edx
mov esi, edx
mov dword [ebp - 0xc1c], eax
mov dword [ebp - 0xb2c], esi
jmp 0xb8f392
cmp ebx, 0xd00000e5
je 0xb98ee9
cmp ebx, 0xc004d501
je 0xb98ee9
cmp ebx, 0xd000003e
jne 0xb98eee
mov ebx, 0xc004f028
jmp 0xb98f1a
mov ebx, 0xc004f027
test ebx, ebx
jns 0xb98f01
cmp ebx, 0x8007007a
jne 0xb98f1a
mov ebx, 0xc004f01e
jmp 0xb98f1a
push 4
pop ecx
cmp dword [ebp - 0xc24], ecx
jne 0xb98efa
mov ecx, dword [eax]
mov ebx, dword [ebp - 0xc20]
mov dword [ebp - 0xcb0], ecx
test eax, eax
je 0xb98f2f
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0xc1c], eax
jmp 0xb98f31
xor eax, eax
test ebx, ebx
js 0xb98f85
cmp dword [ebp - 0xcb0], 0
je 0xb98f85
mov ebx, dword [ebp - 0xbdc]
mov esi, 0x1a2e
movzx eax, byte [ebx + 0x53]
neg eax
sbb eax, eax
and eax, 8
push eax
push esi
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_CheckMenuItem]
push edi
xor eax, eax
push eax
push 0x9fce18
push 0x9fce38
call dword [sym.imp.api_ms_win_core_registryuserspecific_l1_1_0.dll_SHRegGetBoolUSValueW]
neg eax
sbb eax, eax
inc eax
push eax
push esi
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_EnableMenuItem]
jmp 0xb98f9a
mov ebx, dword [ebp - 0xbdc]
push eax
push 0x1a2e
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_RemoveMenu]
xor eax, eax
push eax
push 0x1a2d
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
xor eax, eax
mov dword [ebp - 0xe60], eax
mov dword [ebp - 0xe5c], eax
mov dword [ebp - 0xe58], eax
mov dword [ebp - 0xe54], eax
mov esi, dword [ebp - 0xc00]
mov edi, dword [ebp - 0xc18]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xe60]
push eax
mov dword [ebp - 0xd94], esi
lea eax, [ebp - 0xd94]
mov dword [ebp - 0xd90], edi
mov edx, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x34]
push 8
push eax
call fcn.00c13eee
xor eax, eax
push eax
push dword [ebx + 0x14]
push edi
push esi
push pe_nt_image_headers32
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
push eax
mov ecx, ebx
call fcn.00b8e767
mov edx, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x34]
call fcn.00c145db
lea ecx, [ebp - 0xe60]
mov dword [ebp - 4], 2
call fcn.00b8e4c7
lea ecx, [ebp - 0xe60]
mov byte [ebp - 4], 3
call fcn.00a457ba
or dword [ebp - 4], 0xffffffff
call fcn.00af8dd5
ret 4