Function at 0x40b520
Capabilities:
Check for debugger via api
Check for process debug object
Check for time delay via queryperformancecounter
Check processdebugflags
Check processdebugport
Contain obfuscated stackstrings
Encrypt data using salsa20 or chacha
Inspect section memory permissions
Parse pe header

Disassembly:
pop edi
mov ecx, esi
call fcn.004346f0
mov ecx, esi
call fcn.004348e0
lea eax, [esp + 0x68]
mov dword [esp + 0x68], 0
push eax
push 0
push 5
call sub.kernel32.dll_GetComputerNameExW
test eax, eax
jne 0x408119
call sub.kernel32.dll_GetLastError
mov eax, dword [esp + 0x68]
test eax, eax
js 0x40abf1
lea ebx, [eax + eax]
cmp ebx, 0x7fffffff
jae 0x40abf1
test ebx, ebx
mov dword [esp + 8], edi
je 0x40815a
mov ecx, 8
mov edx, ebx
mov edi, eax
call fcn.0042bb70
test eax, eax
je 0x40abf1
mov esi, eax
mov eax, edi
mov ecx, edi
jmp 0x408161
mov esi, 2
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], eax
mov edi, eax
lea eax, [esp + 0x68]
mov dword [esp + 4], ecx
push eax
push esi
push 5
call sub.kernel32.dll_GetComputerNameExW
test eax, eax
je 0x40819f
mov ecx, dword [esp + 4]
test edi, edi
je 0x4081c3
mov eax, edi
xor edi, edi
cmp word [esi + edi*2], 0
je 0x4081c7
inc edi
add ebx, 0xfffffffe
jne 0x408190
jmp 0x40821c
call sub.kernel32.dll_GetLastError
cmp dword [esp + 4], 0
je 0x4081b9
push esi
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov edi, 0x80000000
jmp 0x408260
xor eax, eax
jmp 0x40821c
mov ebx, edi
sub ebx, eax
jbe 0x408216
sub ecx, eax
mov dword [esp + 4], eax
cmp ecx, ebx
mov ecx, eax
jb 0x40ab3a
lea eax, [esi + ecx*2]
cmp ebx, 2
jb 0x40820e
mov edx, dword [esp + 4]
mov dword [esp + 0xc], ecx
not edx
add edi, edx
add edi, edi
push edi
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov ecx, dword [esp + 0x18]
add esp, 0xc
lea eax, [ecx + ebx]
lea ecx, [ecx + ebx - 1]
lea eax, [esi + eax*2 - 2]
inc ecx
mov word [eax], 0
mov edi, ecx
mov eax, edi
mov dword [esp + 0x20], edi
lea ecx, [esp + 0xa0]
mov edx, esi
push eax
call fcn.0040e710
add esp, 4
mov eax, dword [esp + 0xa4]
mov ecx, dword [esp + 0xa8]
mov edi, dword [esp + 0xa0]
cmp dword [esp + 0x18], 0
mov dword [esp + 4], eax
mov dword [esp + 0xc], ecx
je 0x408260
push esi
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
lea eax, [0x496735]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], 0x7bf539de
mov edx, dword [esp + 0x18]
call fcn.00406920
mov ecx, 0x785bb61c
mov edx, 0xdd9e1b50
mov esi, 0xc076916a
xor ecx, dword [eax]
xor edx, dword [eax + 4]
xor esi, dword [eax + 8]
movzx ebx, byte [eax + 0xe]
movzx eax, word [eax + 0xc]
mov dword [esp + 0x154], edi
mov dword [esp + 0xa0], ecx
mov ecx, dword [esp + 4]
xor al, 0xa7
mov dword [esp + 0xa4], edx
mov dword [esp + 0xa8], esi
xor ah, 0xd0
xor bl, 0x20
neg edi
mov esi, 1
mov byte [esp + 0xac], al
mov byte [esp + 0xad], ah
mov byte [esp + 0xae], bl
cmovno esi, ecx
jo 0x408311
cmp dword [esp + 0xc], 0xf
jne 0x408311
lea eax, [esp + 0xa0]
push 0xf
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
add esp, 0xc
test eax, eax
je 0x4085ca
lea ecx, [esp + 0xa0]
mov dword [esp + 0x15c], esi
call fcn.004352b0
cmp dword [esp + 0xa0], 0x80000011
jne 0x40abf1
lea eax, [0x4a0cb8]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0x2d04f5f7
mov edx, dword [esp + 0xa0]
call fcn.00406880
mov ecx, 0xc8bc3ff7
mov edx, 0xa71df296
mov esi, 0x30a8f811
mov edi, 0xdaf33744
mov ebx, 0x3f66c069
xor ecx, dword [eax]
xor edx, dword [eax + 4]
xor esi, dword [eax + 8]
xor edi, dword [eax + 0xc]
xor ebx, dword [eax + 0x10]
mov dword [esp + 0xa0], ecx
lea ecx, [esp + 0x68]
mov dword [esp + 0xa4], edx
mov dword [esp + 0xa8], esi
mov dword [esp + 0xac], edi
mov dword [esp + 0xb0], ebx
lea edx, [esp + 0xa0]
push 0x14
call fcn.00435350
add esp, 4
mov ecx, dword [esp + 0x68]
cmp ecx, 0x80000011
jne 0x408579
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x4c], eax
lea eax, [0x4a0cde]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0xc22ebf29
mov edx, dword [esp + 0xa0]
call fcn.004068e0
mov ecx, 0xce04f072
mov ebx, 0x3b20b24c
mov edi, 0x804dbbf8
mov esi, 0xd166ac41
mov edx, 0x993f48f6
xor ecx, dword [eax]
mov dword [esp + 4], ecx
mov ecx, 0x51599697
xor ecx, dword [eax + 4]
mov dword [esp + 8], ecx
mov ecx, 0x12e3ad12
xor ecx, dword [eax + 8]
mov dword [esp + 0xc], ecx
mov ecx, 0x8f7a08f2
xor ecx, dword [eax + 0xc]
mov dword [esp + 0x80], ecx
mov ecx, 0x2e1d7c0
xor ecx, dword [eax + 0x10]
mov dword [esp + 0x10], ecx
mov ecx, 0x7417ac26
xor ebx, dword [eax + 0x14]
xor edi, dword [eax + 0x18]
xor esi, dword [eax + 0x1c]
xor edx, dword [eax + 0x20]
xor ecx, dword [eax + 0x24]
mov eax, dword [esp + 4]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 8]
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], edi
mov dword [esp + 0xbc], esi
mov dword [esp + 0xc0], edx
mov dword [esp + 0xc4], ecx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x4c]
push 0x28
lea eax, [esp + 0xa4]
push eax
call fcn.004029b0
add esp, 8
cmp dword [esp + 0x18], 0x80000011
jne 0x40abf1
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp + 0x7c], eax
call fcn.0042cfb0
test eax, eax
je 0x40abf1
movdqu xmm0, xmmword [eax]
movq xmm1, qword [0x4a8208]
movsd xmm2, qword [0x4a8200]
mov dword [esp + 0x5c], edi
movd ecx, xmm0
add ecx, 1
mov dword [eax], ecx
adc dword [eax + 4], 0
mov eax, esi
movq qword [esp + 0x20], xmm1
movsd qword [esp + 0x18], xmm2
movdqu xmmword [esp + 0x28], xmm0
shl eax, 5
add eax, edi
test esi, esi
mov esi, eax
mov eax, edi
je 0x4089ef
mov dword [esp + 0x60], esi
jmp 0x408794
lea esi, [ecx - 0x80000000]
mov edx, 0x11
lea eax, [esp + 0x6c]
cmp esi, 0x11
cmovb edx, esi
cmp edx, 0x10
ja 0x40ab2d
mov esi, dword [esp + 8]
lea ecx, [esp + 0x70]
add esi, dword [edx*4 + 0x40b4dc]
jmp esi
push dword [eax]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov byte [esp + 0x4b], 1
jmp 0x408af3
lea eax, [0x4a2f28]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0x1eb57030
mov edx, dword [esp + 0xa0]
call fcn.00406900
mov ecx, 0x35ffe92
mov esi, 0xf0e98d1b
mov edx, 0xe81b3a7e
xor ecx, dword [eax]
mov dword [esp + 8], ecx
mov ecx, 0x6d35da54
xor ecx, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov ecx, 0x19991c0b
xor ecx, dword [eax + 8]
mov dword [esp + 0x80], ecx
mov ecx, 0x791441e7
xor ecx, dword [eax + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, 0xd433f713
xor ecx, dword [eax + 0x10]
mov dword [esp + 0x14], ecx
mov ecx, 0x65c30754
xor esi, dword [eax + 0x14]
xor edx, dword [eax + 0x18]
xor ecx, dword [eax + 0x1c]
movzx ebx, byte [eax + 0x22]
movzx eax, word [eax + 0x20]
mov edi, dword [esp + 8]
mov dword [esp + 0x18], 0x457cc4
mov dword [esp + 0x1c], 2
mov dword [esp + 0x28], 0
mov dword [esp + 0xa0], edi
mov edi, dword [esp + 0xc]
xor al, 0xc0
xor ah, 0x3d
xor bl, 0x19
mov dword [esp + 0xa4], edi
mov edi, dword [esp + 0x80]
mov dword [esp + 0xa8], edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0xac], edi
mov edi, dword [esp + 0x14]
mov dword [esp + 0xb0], edi
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb8], edx
mov dword [esp + 0xbc], ecx
lea ecx, [esp + 0xa0]
lea edx, [esp + 0x68]
mov byte [esp + 0xc0], al
mov byte [esp + 0xc1], ah
mov byte [esp + 0xc2], bl
mov dword [esp + 0x68], ecx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x6c], 0x23
mov dword [esp + 0x50], 0x429d20
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 1
call fcn.0042b7f0
cmp dword [esp + 0x154], 0
je 0x40aa67
push dword [esp + 4]
jmp 0x40aa5a
and al, 1
movzx eax, al
sub dword [esp + 0x20], eax
lea eax, [esi - 0x10]
and eax, edx
mov edx, dword [esp + 0x98]
mov byte [edi + esi], dl
neg esi
mov byte [edi + eax + 0x10], dl
inc dword [esp + 0x24]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0xc]
mov dword [edi + eax*4 - 0xc], ecx
mov dword [edi + eax*4 - 8], esi
mov dword [edi + eax*4 - 4], ecx
mov esi, dword [esp + 0x60]
mov edi, dword [esp + 0x58]
nop word cs:[eax + eax]
nop
lea ecx, [esp + 0xa0]
call fcn.004049c0
cmp edi, esi
je 0x408a0d
mov eax, edi
add edi, 0x20
mov ecx, dword [eax]
test ecx, ecx
je 0x4089ed
mov dword [esp + 0xa0], ecx
lea edx, [esp + 0xa4]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x18], ecx
lea ecx, [esp + 0xa0]
movsd xmm0, qword [eax + 0x14]
movsd qword [edx + 0x10], xmm0
movq xmm0, qword [eax + 4]
movq xmm1, qword [eax + 0xc]
movq qword [edx + 8], xmm1
movq qword [edx], xmm0
mov edx, str.displayName
push 0xb
call fcn.00407010
add esp, 4
test eax, eax
je 0x408780
cmp dword [eax + 0x10], 0x80000002
jne 0x408780
mov ecx, dword [eax + 0x1c]
test ecx, ecx
js 0x40abf1
mov esi, dword [eax + 0x18]
mov dword [esp + 4], ecx
je 0x40882a
movzx eax, byte [0x4af0d4]
mov edx, dword [esp + 4]
xor ecx, ecx
call fcn.0042bb70
mov ecx, dword [esp + 4]
test eax, eax
jne 0x40882f
jmp 0x40abf1
mov eax, 1
mov dword [esp + 0x58], edi
push ecx
push esi
push eax
mov esi, ecx
mov edi, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
push esi
mov dword [esp + 0x10], edi
push edi
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call fcn.00405120
add esp, 0x10
cmp dword [esp + 0x20], 0
mov esi, eax
je 0x4089db
mov eax, esi
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 4]
xor ebx, ebx
mov dword [esp + 0x14], 0
shr eax, 0x19
movd xmm0, eax
mov dword [esp + 0x98], eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
movdqa xmmword [esp + 0x140], xmm0
and esi, edx
mov dword [esp + 0x10], ebx
movdqu xmm0, xmmword [edi + esi]
movdqa xmmword [esp + 0x80], xmm0
pcmpeqb xmm0, xmmword [esp + 0x140]
pmovmskb ebx, xmm0
test ebx, ebx
je 0x408930
mov dword [esp + 8], esi
jmp 0x4088ea
lea eax, [ebx - 1]
and ax, bx
mov ebx, eax
je 0x408930
tzcnt eax, ebx
add eax, esi
and eax, edx
neg eax
lea eax, [eax + eax*2]
cmp ecx, dword [edi + eax*4 - 4]
jne 0x4088e0
lea eax, [edi + eax*4]
push ecx
push dword [eax - 8]
push dword [esp + 0x14]
mov esi, edi
mov edi, edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
mov edx, edi
mov edi, esi
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
add esp, 0xc
test eax, eax
jne 0x4088e0
jmp 0x408990
cmp dword [esp + 0x14], 1
mov ebx, 1
je 0x40895c
movdqa xmm0, xmmword [esp + 0x80]
xor ebx, ebx
pmovmskb eax, xmm0
test eax, eax
setne bl
tzcnt eax, eax
add eax, esi
and eax, edx
mov dword [esp + 0x64], eax
movdqa xmm1, xmmword [esp + 0x80]
pcmpeqd xmm0, xmm0
pcmpeqb xmm1, xmm0
pmovmskb eax, xmm1
test eax, eax
mov eax, dword [esp + 0x10]
jne 0x4089b6
lea esi, [esi + eax + 0x10]
add eax, 0x10
mov dword [esp + 0x14], ebx
mov ebx, eax
jmp 0x4088aa
mov esi, dword [esp + 0x60]
mov edi, dword [esp + 0x58]
test ecx, ecx
je 0x408780
push dword [esp + 0xc]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
jmp 0x408780
mov esi, dword [esp + 0x64]
movzx eax, byte [edi + esi]
test al, al
js 0x408738
movdqa xmm0, xmmword [edi]
pmovmskb eax, xmm0
tzcnt esi, eax
movzx eax, byte [edi + esi]
jmp 0x408738
lea ecx, [esp + 0x18]
lea edx, [esp + 0x28]
call fcn.00407b70
jmp 0x40886d
mov eax, edi
sub esi, eax
je 0x408a0d
mov edi, eax
shr esi, 5
nop dword [eax + eax]
mov ecx, edi
call fcn.004049c0
add edi, 0x20
dec esi
jne 0x408a00
cmp dword [esp + 0x7c], 0
je 0x408a25
push dword [esp + 0x5c]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
test ecx, ecx
sete byte [esp + 0x4b]
test eax, eax
je 0x408ae9
test ecx, ecx
mov dword [esp + 8], eax
je 0x408ab8
mov ebx, dword [esp + 0x18]
movdqa xmm0, xmmword [ebx]
lea esi, [ebx + 0x10]
pmovmskb edi, xmm0
not edi
jmp 0x408a6a
lea eax, [edi - 1]
and eax, edi
dec ecx
mov edi, eax
je 0x408ab8
test di, di
jne 0x408a8b
nop
movdqa xmm0, xmmword [esi]
add ebx, 0xffffff40
add esi, 0x10
pmovmskb edi, xmm0
cmp edi, 0xffff
je 0x408a70
not edi
tzcnt eax, edi
neg eax
lea eax, [eax + eax*2]
cmp dword [ebx + eax*4 - 0xc], 0
je 0x408a60
lea eax, [ebx + eax*4]
push dword [eax - 8]
push 0
push dword [0x4af0c0]
mov dword [esp + 0x10], ecx
call sub.kernel32.dll_HeapFree
mov ecx, dword [esp + 4]
jmp 0x408a60
mov esi, dword [esp + 8]
mov ecx, 0xc
lea eax, [esi + 1]
mul ecx
add eax, 0xf
and eax, 0xfffffff0
add esi, eax
cmp esi, 0xffffffef
je 0x408ae9
mov ecx, dword [esp + 0x18]
sub ecx, eax
push dword [ecx - 4]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esp + 0xa0]
mov edx, 0x4a83f0
push 0xa
call fcn.00435350
add esp, 4
cmp dword [esp + 0xa0], 0x80000011
jne 0x40abf1
mov eax, dword [esp + 0xa4]
xor ecx, ecx
mov edx, 0x6c
mov dword [esp + 0x13c], eax
movzx eax, byte [0x4af0d4]
call fcn.0042bb70
test eax, eax
mov dword [esp + 0x5c], eax
je 0x40abf1
lea eax, [0x49a007]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0xc36de1e2
mov edx, dword [esp + 0xa0]
call fcn.00406770
mov edi, dword [eax]
mov ebx, dword [eax + 4]
mov esi, dword [eax + 8]
mov ecx, dword [eax + 0xc]
mov edx, 0x21
mov dword [esp + 0x14], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0x14]
mov dword [esp + 0x80], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 0x1c]
mov dword [esp + 4], ecx
xor ecx, ecx
movzx eax, byte [eax + 0x20]
mov byte [esp + 8], al
movzx eax, byte [0x4af0d4]
call fcn.0042bb70
test eax, eax
je 0x40abf1
mov ecx, dword [esp + 0x14]
xor edi, 0x324c9f07
xor ebx, 0x9429d5f1
xor esi, 0x7c63f5fa
movzx edx, byte [esp + 8]
mov dword [esp + 0x58], eax
mov dword [eax], edi
mov dword [eax + 4], ebx
mov dword [eax + 8], esi
xor ecx, 0x594a2614
xor dl, 0x69
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x10]
xor ecx, 0xac9db2d0
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x80]
xor ecx, 0x423049d3
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 0xc]
xor ecx, 0x2a4b8696
mov dword [eax + 0x18], ecx
mov ecx, dword [esp + 4]
xor ecx, 0x9b4109a
mov dword [eax + 0x1c], ecx
mov byte [eax + 0x20], dl
lea eax, [0x495708]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0x19fe318a
mov edx, dword [esp + 0xa0]
call fcn.00406580
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov esi, dword [eax + 8]
mov ecx, dword [eax + 0xc]
mov edx, 0x18
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 8], ecx
xor ecx, ecx
mov eax, dword [eax + 0x14]
mov dword [esp + 4], eax
movzx eax, byte [0x4af0d4]
call fcn.0042bb70
test eax, eax
je 0x40abf1
mov ecx, dword [esp + 0xc]
xor ebx, 0x67a33459
xor edi, 0x242a8d6d
xor esi, 0xc565e26e
mov edx, dword [esp + 8]
mov dword [esp + 0x64], eax
mov dword [eax], ebx
mov dword [eax + 4], edi
mov dword [eax + 8], esi
xor ecx, 0x5c2bc1ba
xor edx, 0xa78ee534
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 4]
mov dword [eax + 0x10], edx
xor ecx, 0x1e234ca0
mov dword [eax + 0x14], ecx
lea eax, [0x49e533]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0x5eacce8c
mov edx, dword [esp + 0xa0]
call fcn.00406860
mov edi, dword [eax]
mov ecx, dword [eax + 4]
mov edx, 0x23
mov dword [esp + 0x140], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x14], ecx
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x80], ecx
mov ecx, dword [eax + 0x14]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 8], ecx
mov ecx, dword [eax + 0x1c]
mov dword [esp + 4], ecx
xor ecx, ecx
movzx ebx, word [eax + 0x20]
movzx esi, byte [eax + 0x22]
movzx eax, byte [0x4af0d4]
call fcn.0042bb70
test eax, eax
je 0x40abf1
mov ecx, dword [esp + 0x140]
xor edi, 0x708f1db0
shl esi, 0x10
mov dword [esp + 0x140], eax
mov dword [eax], edi
or ebx, esi
xor ecx, 0xf413d1ac
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x14]
xor ecx, 0x4ae4c15f
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x10]
xor ecx, 0x8b264f38
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x80]
xor ecx, 0x1aeca558
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0xc]
xor ecx, 0x46bbad1b
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 8]
xor ecx, 0x50024677
mov dword [eax + 0x18], ecx
mov ecx, dword [esp + 4]
xor ecx, 0x159e831
mov dword [eax + 0x1c], ecx
mov ecx, ebx
xor bh, 0x15
xor bl, 0xde
shr ecx, 0x10
mov byte [eax + 0x20], bl
mov byte [eax + 0x21], bh
xor cl, 0xa5
mov byte [eax + 0x22], cl
lea eax, [0x4a39de]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0x3d78304a
mov edx, dword [esp + 0xa0]
call fcn.00406a90
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov edx, 0x16
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 0xc]
mov dword [esp + 8], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 4], ecx
xor ecx, ecx
movzx ebx, word [eax + 0x14]
movzx eax, byte [0x4af0d4]
call fcn.0042bb70
test eax, eax
je 0x40abf1
mov ecx, dword [esp + 0xc]
xor esi, 0xbef93eac
xor edi, 0xbcb2b57a
xor bh, 0x16
xor bl, 0x38
mov dword [esp + 0x60], eax
mov dword [eax], esi
mov dword [eax + 4], edi
xor ecx, 0xa9ad8ef4
mov dword [eax + 8], ecx
mov ecx, dword [esp + 8]
xor ecx, 0x16135b6d
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 4]
xor ecx, 0xd2a67f92
mov dword [eax + 0x10], ecx
mov byte [eax + 0x14], bl
mov byte [eax + 0x15], bh
lea eax, [0x498951]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0x6a4bb614
mov edx, dword [esp + 0xa0]
call fcn.004069d0
mov edi, dword [eax]
mov esi, dword [eax + 4]
mov ebx, dword [eax + 8]
mov ecx, dword [eax + 0xc]
mov edx, 0x20
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x80], ecx
mov ecx, dword [eax + 0x14]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 8], ecx
xor ecx, ecx
mov eax, dword [eax + 0x1c]
mov dword [esp + 4], eax
movzx eax, byte [0x4af0d4]
call fcn.0042bb70
test eax, eax
je 0x40abf1
mov ecx, dword [esp + 0x10]
xor edi, 0x87dc4f7e
xor esi, 0xc8428487
xor ebx, 0x8297352e
mov edx, dword [esp + 8]
mov dword [esp + 0x98], eax
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
xor ecx, 0xe26a21d7
xor edx, 0x60445bcc
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x80]
xor ecx, 0x6c42cd1f
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0xc]
xor ecx, 0x89c7ca0f
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 4]
mov dword [eax + 0x18], edx
xor ecx, 0x8c886412
mov dword [eax + 0x1c], ecx
lea eax, [0x497d86]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0x8de48850
mov edx, dword [esp + 0xa0]
call fcn.00406ac0
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov edx, 0x1f
mov dword [esp + 0x14], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x80], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 0x14]
mov dword [esp + 8], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 4], ecx
xor ecx, ecx
movzx ebx, word [eax + 0x1c]
movzx edi, byte [eax + 0x1e]
movzx eax, byte [0x4af0d4]
call fcn.0042bb70
test eax, eax
je 0x40abf1
mov ecx, dword [esp + 0x14]
xor esi, 0x2a42e58e
shl edi, 0x10
mov dword [esp + 0x14], eax
mov dword [eax], esi
or ebx, edi
xor ecx, 0xa890c017
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
xor ecx, 0xa2dd739e
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x80]
xor ecx, 0x99780ce9
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0xc]
xor ecx, 0x844973fb
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 8]
xor ecx, 0xecfe9ae0
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 4]
xor ecx, 0xcbf22311
mov dword [eax + 0x18], ecx
mov ecx, ebx
xor bh, 0xdf
xor bl, 0xf9
shr ecx, 0x10
mov byte [eax + 0x1c], bl
mov byte [eax + 0x1d], bh
xor cl, 0x98
mov byte [eax + 0x1e], cl
lea eax, [0x49c231]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0x7be3070f
mov edx, dword [esp + 0xa0]
call fcn.004065d0
mov edi, dword [eax]
mov esi, dword [eax + 4]
mov ebx, dword [eax + 8]
mov ecx, dword [eax + 0xc]
mov edx, 0x20
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x80], ecx
mov ecx, dword [eax + 0x14]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 8], ecx
xor ecx, ecx
mov eax, dword [eax + 0x1c]
mov dword [esp + 4], eax
movzx eax, byte [0x4af0d4]
call fcn.0042bb70
test eax, eax
je 0x40abf1
mov ecx, dword [esp + 0x10]
xor edi, 0x90fda7ef
xor esi, 0xa40ae80f
xor ebx, 0xd865e5ca
mov edx, dword [esp + 8]
mov dword [esp + 0x160], eax
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
xor ecx, 0xff4e6324
xor edx, 0x32b72c3c
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x80]
xor ecx, 0x5675ac91
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0xc]
xor ecx, 0x9f185122
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 4]
mov dword [eax + 0x18], edx
xor ecx, 0x31283324
mov dword [eax + 0x1c], ecx
lea eax, [0x49ef2e]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0xd2cb6412
mov edx, dword [esp + 0xa0]
call fcn.00406af0
mov edi, dword [eax]
mov ecx, dword [eax + 4]
mov edx, 0x22
mov dword [esp + 0x12c], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x7c], ecx
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x80], ecx
mov ecx, dword [eax + 0x14]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 8], ecx
mov ecx, dword [eax + 0x1c]
mov dword [esp + 4], ecx
xor ecx, ecx
movzx ebx, word [eax + 0x20]
movzx eax, byte [0x4af0d4]
call fcn.0042bb70
test eax, eax
je 0x40abf1
xor edi, 0x59713f4f
mov esi, eax
mov ecx, dword [esp + 8]
xor bh, 0xcf
xor bl, 0x9a
mov dword [eax], edi
mov eax, dword [esp + 0x12c]
xor ecx, 0x1f56cc35
xor eax, 0xad84e063
mov dword [esi + 4], eax
mov eax, dword [esp + 0x7c]
xor eax, 0x9b8c47
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
xor eax, 0x5379cd0e
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x80]
xor eax, 0x31df3422
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0xc]
xor eax, 0x3c38ee6f
mov dword [esi + 0x14], eax
mov eax, dword [esp + 4]
mov dword [esi + 0x18], ecx
xor eax, 0x1cd1e4fd
mov dword [esi + 0x1c], eax
lea eax, [0x496686]
mov byte [esi + 0x20], bl
mov byte [esi + 0x21], bh
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0xf05545d7
mov edx, dword [esp + 0xa0]
call fcn.004069b0
mov edi, dword [eax]
mov ebx, dword [eax + 4]
mov ecx, dword [eax + 8]
mov edx, 0x1d
mov dword [esp + 0x7c], ecx
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x80], ecx
mov ecx, dword [eax + 0x14]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 8], ecx
xor ecx, ecx
movzx eax, byte [eax + 0x1c]
mov byte [esp + 4], al
movzx eax, byte [0x4af0d4]
call fcn.0042bb70
test eax, eax
je 0x40abf1
mov ecx, dword [esp + 0x7c]
xor edi, 0x7c91440a
xor ebx, 0xd615ee42
mov edx, dword [esp + 0x58]
mov dword [esp + 0x158], 0x60
mov dword [eax], edi
mov dword [eax + 4], ebx
mov edi, dword [esp + 0x64]
mov ebx, dword [esp + 0x140]
xor ecx, 0x106eee2c
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x10]
xor ecx, 0x78ca17d9
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x80]
xor ecx, 0x7c1472e1
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0xc]
xor ecx, 0xbb4d5365
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 8]
xor ecx, 0x351e8555
mov dword [eax + 0x18], ecx
movzx ecx, byte [esp + 4]
xor cl, 0x6f
mov byte [eax + 0x1c], cl
mov ecx, dword [esp + 0x5c]
mov dword [ecx], 0x21
mov dword [ecx + 4], edx
mov dword [ecx + 8], 0x21
mov dword [ecx + 0xc], 0x18
mov dword [ecx + 0x10], edi
mov edi, dword [esp + 0x60]
mov dword [ecx + 0x14], 0x18
mov dword [ecx + 0x18], 0x23
mov dword [ecx + 0x1c], ebx
mov ebx, dword [esp + 0x98]
mov dword [ecx + 0x20], 0x23
mov dword [ecx + 0x24], 0x16
mov dword [ecx + 0x28], edi
lea edi, [ecx + 0x10]
mov dword [ecx + 0x2c], 0x16
mov dword [ecx + 0x30], 0x20
mov dword [ecx + 0x34], ebx
mov ebx, dword [esp + 0x14]
mov dword [ecx + 0x38], 0x20
mov dword [ecx + 0x3c], 0x1f
mov dword [esp + 0x60], edi
mov edi, dword [esp + 0x160]
mov dword [ecx + 0x40], ebx
mov dword [ecx + 0x44], 0x1f
mov dword [ecx + 0x48], 0x20
mov dword [ecx + 0x4c], edi
mov dword [ecx + 0x50], 0x20
mov dword [ecx + 0x54], 0x22
mov dword [ecx + 0x58], esi
mov dword [ecx + 0x5c], 0x22
mov dword [ecx + 0x60], 0x1d
mov dword [ecx + 0x64], eax
lea eax, [esp + 0x13c]
xor esi, esi
mov dword [ecx + 0x68], 0x1d
movd xmm0, eax
movdqa xmmword [esp + 0x160], xmm0
jmp 0x40949f
mov eax, dword [esp + 0x98]
add dword [esp + 0x158], 0xfffffff4
add dword [esp + 0x60], 0xc
cmp eax, 0x6c
mov esi, eax
je 0x409a5f
mov ecx, dword [esp + 0x5c]
lea eax, [esi + 0xc]
mov dword [esp + 0x98], eax
mov eax, dword [ecx + esi]
mov dword [esp + 0x7c], eax
neg eax
jo 0x409a51
mov edi, dword [ecx + esi + 8]
test edi, edi
js 0x40abf1
mov eax, dword [ecx + esi + 4]
mov dword [esp + 0xc], esi
mov dword [esp + 0x64], eax
je 0x4094f0
movzx eax, byte [0x4af0d4]
xor ecx, ecx
mov edx, edi
call fcn.0042bb70
test eax, eax
jne 0x4094f5
jmp 0x40abf1
mov eax, 1
push edi
push dword [esp + 0x68]
push eax
mov esi, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov ecx, 0x457c5c
mov edx, 3
call fcn.00434df0
mov ecx, esi
mov edx, edi
mov ebx, eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call fcn.00434df0
mov esi, eax
mov eax, dword [esp + 0x13c]
mov dword [esp + 0x18], 0
lea edx, [esp + 0x18]
mov ecx, dword [eax]
push edx
push 0
push 0x30
push esi
push ebx
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x40ab68
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40ab93
test esi, esi
je 0x409567
push esi
call sub.oleaut32.dll_SysFreeString
test ebx, ebx
je 0x409571
push ebx
call sub.oleaut32.dll_SysFreeString
cmp dword [esp + 4], 0
je 0x409589
push dword [esp + 8]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
movdqa xmm1, xmmword [esp + 0x160]
movd xmm0, edi
mov dword [esp + 0x9c], 0
mov dword [esp + 0x130], 0
punpcklqdq xmm0, xmm1
shufps xmm0, xmm1, 0xe2
pshufd xmm0, xmm0, 0x55
movd eax, xmm0
mov dword [esp + 8], eax
mov eax, dword [eax]
sub esp, 0x14
lea ecx, [esp + 0x144]
lea edx, [esp + 0xb0]
movd dword [esp], xmm0
mov dword [esp + 8], 1
mov dword [esp + 4], 0xffffffff
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
call dword [eax + 0x10]
test eax, eax
js 0x409a8a
cmp dword [esp + 0x130], 0
je 0x409af3
mov edx, dword [esp + 0x9c]
test edx, edx
je 0x409b0d
lea ecx, [esp + 0xa0]
mov dword [esp + 0x1c], edx
call fcn.004019e0
mov ebx, dword [esp + 0xa0]
test ebx, ebx
je 0x409b20
lea eax, [esp + 0xa4]
mov esi, dword [esp + 0xb8]
mov edi, dword [esp + 0xbc]
xor ecx, ecx
mov edx, pe_nt_image_headers32
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
mov eax, dword [eax + 0x10]
movsd qword [esp + 0x68], xmm0
movsd qword [esp + 0x70], xmm1
mov dword [esp + 0x78], eax
movzx eax, byte [0x4af0d4]
call fcn.0042bb70
test eax, eax
je 0x40abf1
mov dword [eax], ebx
mov ebx, 1
mov dword [esp + 0x14], eax
movq xmm0, qword [esp + 0x68]
movq xmm1, qword [esp + 0x70]
movq qword [eax + 4], xmm0
movq qword [eax + 0xc], xmm1
mov ecx, dword [esp + 0x78]
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], esi
mov esi, 0x20
mov dword [eax + 0x1c], edi
mov dword [esp + 0x4c], 4
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], 1
nop dword [eax + eax]
mov edx, dword [esp + 8]
mov dword [esp + 0x9c], 0
mov dword [esp + 0x130], 0
lea ecx, [esp + 0x130]
mov eax, dword [edx]
push ecx
lea ecx, [esp + 0xa0]
push ecx
push 1
push 0xffffffffffffffff
push edx
call dword [eax + 0x10]
mov edi, eax
test eax, eax
js 0x409800
cmp dword [esp + 0x130], 0
je 0x409850
mov eax, dword [esp + 0x9c]
mov edx, dword [esp + 0x58]
test eax, eax
cmovne edx, eax
mov dword [esp + 0x58], edx
je 0x409880
lea ecx, [esp + 0xa0]
call fcn.004019e0
mov edi, dword [esp + 0xa0]
test edi, edi
je 0x4098a0
mov eax, dword [esp + 0xbc]
mov edx, dword [esp + 0xb8]
cmp ebx, dword [esp + 0x4c]
mov dword [esp + 4], eax
lea eax, [esp + 0xa4]
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
mov eax, dword [eax + 0x10]
movsd qword [esp + 0x18], xmm0
movsd qword [esp + 0x20], xmm1
mov dword [esp + 0x28], eax
je 0x4097cc
mov ecx, dword [esp + 0x14]
inc ebx
mov dword [ecx + esi], edi
mov edi, dword [esp + 4]
movq xmm0, qword [esp + 0x18]
movq xmm1, qword [esp + 0x20]
movq qword [ecx + esi + 4], xmm0
movq qword [ecx + esi + 0xc], xmm1
mov eax, dword [esp + 0x28]
mov dword [ecx + esi + 0x14], eax
mov dword [ecx + esi + 0x1c], edi
mov dword [ecx + esi + 0x18], edx
mov dword [esp + 0x54], ebx
add esi, 0x20
jmp 0x4096d0
mov dword [esp + 0x80], edx
mov edx, ebx
lea ecx, [esp + 0x4c]
push 0x20
push 8
call fcn.004063a0
mov edx, dword [esp + 0x88]
add esp, 8
mov eax, dword [esp + 0x50]
mov dword [esp + 0x14], eax
jmp 0x40978c
lea eax, [esp + 0xa0]
mov dword [esp + 0xa0], 0
push eax
push 0
call sub.oleaut32.dll_GetErrorInfo
mov eax, dword [esp + 0xa0]
mov esi, 0x80000000
test eax, eax
je 0x409a39
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x58], edi
mov eax, dword [esp + 0x9c]
test eax, eax
jne 0x409860
jmp 0x409866
mov esi, 0x80000012
mov eax, dword [esp + 0x9c]
test eax, eax
je 0x409866
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test edi, edi
mov edi, 0x80000011
jns 0x4098a7
jmp 0x409885
mov esi, 0x8000000f
mov eax, dword [esp + 0x58]
mov dword [esp + 0xa8], esi
mov edi, esi
mov dword [esp + 0xac], eax
jmp 0x4098a7
mov edi, dword [esp + 0xa8]
mov ecx, dword [esp + 8]
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [esp + 0x4c]
cmp edi, 0x80000011
jne 0x40abce
mov esi, dword [esp + 0xc]
test ebx, ebx
je 0x409b29
mov esi, dword [esp + 0x14]
xor edi, edi
mov dword [esp + 0x12c], eax
mov dword [esp + 0x140], ebx
jmp 0x4098f9
inc edi
cmp edi, ebx
je 0x409a00
mov ecx, edi
shl ecx, 5
mov eax, dword [esi + ecx + 4]
test eax, eax
mov dword [esp + 0x80], eax
je 0x4098f0
add ecx, esi
mov dword [esp + 0x10], edi
mov eax, dword [ecx + 0xc]
test eax, eax
mov dword [esp + 4], eax
je 0x4099c0
mov edi, dword [ecx]
mov dword [esp + 0xc], ecx
movdqa xmm0, xmmword [edi]
lea esi, [edi + 0x10]
pmovmskb ebx, xmm0
not ebx
jmp 0x409966
lea eax, [ebx - 1]
add ecx, 0xfffffff0
and eax, ebx
mov ebx, dword [esp + 4]
mov dword [esp + 8], eax
dec ebx
call fcn.00404b80
mov ecx, dword [esp + 0xc]
test ebx, ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp + 8]
je 0x4099c0
test bx, bx
jne 0x40998b
nop dword [eax + eax]
movdqa xmm0, xmmword [esi]
add edi, 0xfffffe00
add esi, 0x10
pmovmskb ebx, xmm0
cmp ebx, 0xffff
je 0x409970
not ebx
tzcnt eax, ebx
mov ecx, edi
shl eax, 5
sub ecx, eax
cmp dword [ecx - 0x20], 0
je 0x409940
push dword [ecx - 0x1c]
push 0
push dword [0x4af0c0]
mov dword [esp + 0x14], ecx
call sub.kernel32.dll_HeapFree
mov ecx, dword [esp + 8]
jmp 0x409940
mov edx, dword [esp + 0x80]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x140]
mov edi, dword [esp + 0x10]
mov eax, edx
shl eax, 5
add edx, eax
cmp edx, 0xffffffcf
je 0x4098f0
mov ecx, dword [ecx]
neg eax
push dword [ecx + eax - 0x24]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
jmp 0x4098f0
cmp dword [esp + 0x12c], 0
je 0x409a18
push esi
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
cmp dword [esp + 0x7c], 0
je 0x409480
push dword [esp + 0x64]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
jmp 0x409480
mov dword [esp + 0x58], edi
mov eax, dword [esp + 0x9c]
test eax, eax
jne 0x409860
jmp 0x409866
cmp dword [esp + 0x98], 0x6c
jne 0x40aad1
push dword [esp + 0x5c]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov eax, dword [esp + 0x13c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x58], 0
jmp 0x409bdc
mov esi, eax
lea eax, [esp + 0xa0]
mov dword [esp + 0xa0], 0
push eax
push 0
call sub.oleaut32.dll_GetErrorInfo
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x409ab7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x18], 0x80000000
mov eax, esi
mov dword [esp + 0x1c], esi
mov esi, 0x80000000
mov ecx, dword [esp + 0x9c]
test ecx, ecx
je 0x409adf
mov edx, dword [ecx]
push ecx
mov edi, eax
call dword [edx + 8]
mov eax, edi
test eax, eax
js 0x409b40
lea ecx, [esp + 0x18]
call fcn.00404ab0
mov esi, 0x80000011
jmp 0x409b68
mov dword [esp + 0x18], 0x80000012
mov esi, 0x80000012
mov ecx, dword [esp + 0x9c]
test ecx, ecx
jne 0x409ad5
jmp 0x409adf
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov esi, 0x8000000f
jmp 0x409b4c
mov esi, dword [esp + 0xa8]
jmp 0x409b68
test eax, eax
je 0x409b82
push dword [esp + 0x14]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
jmp 0x409b82
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 0xa8], esi
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xb4], edx
mov ecx, dword [esp + 8]
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp esi, 0x80000011
mov esi, dword [esp + 0xc]
jne 0x40abf1
cmp dword [esp + 0x7c], 0
je 0x409b9a
push dword [esp + 0x64]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov eax, 0x60
mov ecx, 0xaaaaaaab
sub eax, esi
mul ecx
mov eax, dword [esp + 0x98]
cmp eax, 0x6c
jne 0x40aa90
push dword [esp + 0x5c]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov eax, dword [esp + 0x13c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, 1
mov dword [esp + 0x58], eax
lea ecx, [esp + 0xa0]
mov edx, 0x4a83f0
push 0xa
call fcn.00435350
add esp, 4
cmp dword [esp + 0xa0], 0x80000011
jne 0x40abf1
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x68], eax
lea eax, [0x4a3895]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0xc8046a5b
mov edx, dword [esp + 0xa0]
call fcn.004068b0
mov ecx, 0xf790b028
mov edi, 0xebcdbc93
mov esi, 0xd7a1a53c
mov edx, 0x83ccc35f
xor ecx, dword [eax]
mov dword [esp + 4], ecx
mov ecx, 0xd32ddca2
xor ecx, dword [eax + 4]
mov dword [esp + 8], ecx
mov ecx, 0x7f8cb73e
xor ecx, dword [eax + 8]
mov dword [esp + 0xc], ecx
mov ecx, 0xc40b72eb
xor ecx, dword [eax + 0xc]
mov dword [esp + 0x80], ecx
mov ecx, 0xe09ebfc0
xor ecx, dword [eax + 0x10]
mov dword [esp + 0x10], ecx
mov ecx, 0xdbb22a13
xor ecx, dword [eax + 0x14]
mov dword [esp + 0x14], ecx
mov ecx, 0x40f0a80b
xor ecx, dword [eax + 0x18]
mov dword [esp + 0x140], ecx
mov ecx, 0x6f42ff0c
xor edi, dword [eax + 0x1c]
xor esi, dword [eax + 0x20]
xor edx, dword [eax + 0x24]
xor ecx, dword [eax + 0x28]
movzx eax, byte [eax + 0x2c]
mov ebx, dword [esp + 4]
mov dword [esp + 0xa0], ebx
mov ebx, dword [esp + 8]
xor al, 0xfd
mov dword [esp + 0xa4], ebx
mov ebx, dword [esp + 0xc]
mov dword [esp + 0xa8], ebx
mov ebx, dword [esp + 0x80]
mov dword [esp + 0xac], ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0xb0], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0xb4], ebx
mov ebx, dword [esp + 0x140]
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], edi
mov dword [esp + 0xc0], esi
mov dword [esp + 0xc4], edx
mov dword [esp + 0xc8], ecx
mov byte [esp + 0xcc], al
lea ecx, [esp + 0x18]
lea edx, [esp + 0x68]
push 0x2d
lea eax, [esp + 0xa4]
push eax
call fcn.004029b0
add esp, 8
cmp dword [esp + 0x18], 0x80000011
jne 0x40abf1
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
test ecx, ecx
je 0x40aa7b
mov dword [esp + 0x140], ecx
shl ecx, 5
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x80], edi
add ecx, edi
mov dword [esp + 0x64], ecx
mov eax, dword [esp + 0x80]
mov esi, dword [eax]
mov ecx, dword [eax + 0xc]
add eax, 0x20
mov dword [esp + 0x80], eax
movdqa xmm0, xmmword [esi]
lea ebx, [esi + 0x10]
mov dword [esp + 4], ecx
pmovmskb eax, xmm0
not eax
nop
mov edx, dword [esp + 4]
add edx, 0xffffffff
setb cl
mov dword [esp + 0xc], ecx
jae 0x409e60
test ax, ax
mov dword [esp + 4], edx
je 0x409df0
lea ecx, [eax - 1]
and ecx, eax
mov dword [esp + 8], ecx
jmp 0x409e19
movdqa xmm0, xmmword [ebx]
add esi, 0xfffffe00
add ebx, 0x10
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x409df0
mov ecx, 0xfffffffe
sub ecx, eax
not eax
mov edx, eax
and edx, ecx
mov dword [esp + 8], edx
tzcnt eax, eax
mov edi, esi
mov edx, 0x457ce0
shl eax, 5
sub edi, eax
add edi, 0xfffffff0
mov ecx, edi
call fcn.00406430
test al, al
jne 0x409e71
mov ecx, edi
mov edx, 0x457cf0
call fcn.00406430
test al, al
mov eax, dword [esp + 8]
je 0x409dc0
jmp 0x409e71
mov eax, dword [esp + 0x80]
cmp eax, dword [esp + 0x64]
jne 0x409d97
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x140]
mov esi, edi
nop
mov ecx, esi
call fcn.004049c0
add esi, 0x20
dec ebx
jne 0x409e80
mov eax, dword [esp + 0x14]
test eax, eax
je 0x409ea3
push edi
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esp + 0xa0]
mov edx, 0x4a83f0
push 0xa
call fcn.00435350
add esp, 4
cmp dword [esp + 0xa0], 0x80000011
jne 0x40abf1
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x9c], eax
lea eax, [0x498986]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0x8f354e2a
mov edx, dword [esp + 0xa0]
call fcn.00406840
mov ecx, 0x2f8302bc
mov ebx, 0xcbde2c3d
mov esi, 0xc568e931
mov edx, 0xd19a07d6
xor ecx, dword [eax]
mov dword [esp + 4], ecx
mov ecx, 0xb5400f96
xor ecx, dword [eax + 4]
mov dword [esp + 8], ecx
mov ecx, 0x22e02c2f
xor ecx, dword [eax + 8]
mov dword [esp + 0x80], ecx
mov ecx, 0xbd7163a6
xor ebx, dword [eax + 0xc]
xor esi, dword [eax + 0x10]
xor edx, dword [eax + 0x14]
xor ecx, dword [eax + 0x18]
movzx eax, word [eax + 0x1c]
mov edi, dword [esp + 4]
mov dword [esp + 0xa0], edi
mov edi, dword [esp + 8]
xor al, 0xa4
xor ah, 0x8f
mov dword [esp + 0xa4], edi
mov edi, dword [esp + 0x80]
mov dword [esp + 0xa8], edi
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], esi
mov dword [esp + 0xb4], edx
mov dword [esp + 0xb8], ecx
mov byte [esp + 0xbc], al
mov byte [esp + 0xbd], ah
lea ecx, [esp + 0x18]
lea edx, [esp + 0x9c]
push 0x1e
lea eax, [esp + 0xa4]
push eax
call fcn.004029b0
add esp, 8
cmp dword [esp + 0x18], 0x80000011
jne 0x40abf1
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
mov ecx, ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x80], eax
shl ecx, 5
add ecx, esi
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x20], 0
mov dword [esp + 0x34], 0
call fcn.00401700
xor eax, eax
mov dword [esp + 8], esi
cmp eax, dword [esp + 0x4c]
jno 0x40a042
mov dword [esp + 0x10], 0
mov ecx, 4
xor esi, esi
jmp 0x40a177
movzx eax, byte [0x4af0d4]
xor ecx, ecx
mov edx, 0x30
call fcn.0042bb70
test eax, eax
je 0x40abf1
mov ecx, dword [esp + 0x54]
mov esi, 1
mov edi, 0xc
mov dword [esp + 4], eax
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x4c]
movsd qword [eax], xmm0
mov dword [esp + 0x130], 4
mov dword [esp + 0x134], eax
mov dword [esp + 0x138], 1
movsd xmm1, qword [esp + 0x38]
movsd xmm2, qword [esp + 0x30]
movq xmm0, qword [esp + 0x40]
movsd qword [esp + 0xc0], xmm1
movsd xmm1, qword [esp + 0x28]
movsd qword [esp + 0xb8], xmm2
movsd xmm2, qword [esp + 0x18]
movq qword [esp + 0xc8], xmm0
movsd qword [esp + 0xb0], xmm1
movq xmm1, qword [esp + 0x20]
movsd qword [esp + 0xa0], xmm2
movq qword [esp + 0xa8], xmm1
jmp 0x40a122
mov eax, dword [esp + 0x70]
inc esi
mov dword [esp + 4], ecx
mov dword [ecx + edi + 8], eax
movq xmm0, qword [esp + 0x68]
movq qword [ecx + edi], xmm0
mov dword [esp + 0x138], esi
add edi, 0xc
lea ecx, [esp + 0x68]
lea edx, [esp + 0xa0]
call fcn.00401700
xor eax, eax
cmp eax, dword [esp + 0x68]
jo 0x40a165
cmp esi, dword [esp + 0x130]
mov ecx, dword [esp + 4]
jne 0x40a100
lea ecx, [esp + 0x130]
mov edx, esi
push 0xc
push 4
call fcn.004063a0
add esp, 8
mov ecx, dword [esp + 0x134]
jmp 0x40a100
mov eax, dword [esp + 0x130]
mov ecx, dword [esp + 0x134]
mov dword [esp + 0x10], eax
lea eax, [esi + esi*2]
mov dword [esp + 4], ecx
lea edx, [ecx + eax*4]
mov eax, ecx
nop word cs:[eax + eax]
nop dword [eax]
mov edi, eax
cmp eax, edx
je 0x40a1a9
mov ecx, dword [edi + 8]
cmp ecx, 0x80
je 0x40a1a9
lea eax, [edi + 0xc]
cmp ecx, 0x40
jne 0x40a190
test esi, esi
mov dword [esp + 0x140], edi
mov dword [esp + 0x14], edx
je 0x40a1ed
mov eax, dword [esp + 4]
lea edi, [eax + 4]
jmp 0x40a1d6
add edi, 0xc
dec esi
je 0x40a1ed
cmp dword [edi - 4], 0
je 0x40a1d0
push dword [edi]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
jmp 0x40a1d0
cmp dword [esp + 0x10], 0
je 0x40a205
push dword [esp + 4]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov edi, dword [esp + 8]
test ebx, ebx
je 0x40a21d
mov esi, edi
nop
mov ecx, esi
call fcn.004049c0
add esi, 0x20
dec ebx
jne 0x40a210
cmp dword [esp + 0x80], 0
je 0x40a235
push edi
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov eax, dword [esp + 0x9c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esp + 0xa0]
mov edx, 0x4a83f0
push 0xa
call fcn.00435350
add esp, 4
cmp dword [esp + 0xa0], 0x80000011
jne 0x40abf1
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x68], eax
lea eax, [0x49a45f]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0xfff65247
mov edx, dword [esp + 0xa0]
call fcn.00406980
mov ecx, 0x1400f312
mov esi, 0x4336b421
mov edx, 0x23e901f8
xor ecx, dword [eax]
mov dword [esp + 4], ecx
mov ecx, 0x46347243
xor ecx, dword [eax + 4]
mov dword [esp + 8], ecx
mov ecx, 0xc7f2b9dd
xor ecx, dword [eax + 8]
mov dword [esp + 0x80], ecx
mov ecx, 0x89e36699
xor ecx, dword [eax + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, 0x79160273
xor esi, dword [eax + 0x10]
xor edx, dword [eax + 0x14]
xor ecx, dword [eax + 0x18]
movzx ebx, byte [eax + 0x1e]
movzx eax, word [eax + 0x1c]
mov edi, dword [esp + 4]
mov dword [esp + 0xa0], edi
mov edi, dword [esp + 8]
xor al, 0x3f
xor ah, 0xe5
xor bl, 0x5f
mov dword [esp + 0xa4], edi
mov edi, dword [esp + 0x80]
mov dword [esp + 0xa8], edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0xac], edi
mov dword [esp + 0xb0], esi
mov dword [esp + 0xb4], edx
mov dword [esp + 0xb8], ecx
mov byte [esp + 0xbc], al
mov byte [esp + 0xbd], ah
mov byte [esp + 0xbe], bl
lea ecx, [esp + 0x18]
lea edx, [esp + 0x68]
push 0x1f
lea eax, [esp + 0xa4]
push eax
call fcn.004029b0
add esp, 8
cmp dword [esp + 0x18], 0x80000011
jne 0x40abf1
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
test ecx, ecx
mov dword [esp + 4], eax
mov dword [esp + 0x10], ecx
je 0x40a3bd
mov ebx, dword [esp + 0x10]
mov esi, edi
nop word cs:[eax + eax]
mov ecx, esi
call fcn.004049c0
add esi, 0x20
dec ebx
jne 0x40a3b0
cmp dword [esp + 4], 0
je 0x40a3d2
push edi
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea esi, [esp + 0xa0]
mov ecx, esi
call fcn.004346f0
mov ecx, esi
call fcn.004348e0
mov ecx, dword [esp + 0xe4]
mov eax, dword [esp + 0xe0]
mov dword [esp + 0x64], ecx
mov ecx, esi
mov dword [esp + 0x60], eax
call fcn.00404c50
lea esi, [esp + 0xa0]
mov ecx, esi
call fcn.004346f0
mov ecx, esi
call fcn.004348e0
call sub.kernel32.dll_GetTickCount64
mov ecx, esi
mov dword [esp + 0x7c], eax
mov dword [esp + 0x98], edx
call fcn.00404c50
lea ecx, [esp + 0xa0]
mov edx, 0x4a83f0
push 0xa
call fcn.00435350
add esp, 4
cmp dword [esp + 0xa0], 0x80000011
jne 0x40abf1
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x130], eax
lea eax, [0x49e03c]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0xc4aad6e8
mov edx, dword [esp + 0xa0]
call fcn.00406710
mov ecx, 0xbe5a6af3
mov edi, 0x9357f828
mov esi, 0xe60b0e21
mov edx, 0x7e22d506
xor ecx, dword [eax]
mov dword [esp + 4], ecx
mov ecx, 0x938a1d51
xor ecx, dword [eax + 4]
mov dword [esp + 8], ecx
mov ecx, 0xd42afd61
xor ecx, dword [eax + 8]
mov dword [esp + 0x80], ecx
mov ecx, 0xfb558ce2
xor ecx, dword [eax + 0xc]
mov dword [esp + 0x5c], ecx
mov ecx, 0x13f4d946
xor ecx, dword [eax + 0x10]
mov dword [esp + 0x12c], ecx
mov ecx, 0xb4c2efa7
xor edi, dword [eax + 0x14]
xor esi, dword [eax + 0x18]
xor edx, dword [eax + 0x1c]
xor ecx, dword [eax + 0x20]
movzx eax, word [eax + 0x24]
mov ebx, dword [esp + 4]
mov dword [esp + 0xa0], ebx
mov ebx, dword [esp + 8]
xor al, 0xbc
xor ah, 0x1c
mov dword [esp + 0xa4], ebx
mov ebx, dword [esp + 0x80]
mov dword [esp + 0xa8], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 0xac], ebx
mov ebx, dword [esp + 0x12c]
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], edi
mov dword [esp + 0xb8], esi
mov dword [esp + 0xbc], edx
mov dword [esp + 0xc0], ecx
mov byte [esp + 0xc4], al
mov byte [esp + 0xc5], ah
lea ecx, [esp + 0x18]
lea edx, [esp + 0x130]
push 0x26
lea eax, [esp + 0xa4]
push eax
call fcn.004029b0
add esp, 8
cmp dword [esp + 0x18], 0x80000011
jne 0x40abf1
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov edx, esi
mov edi, ecx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x12c], ecx
shl edx, 5
test esi, esi
lea esi, [ecx + edx]
mov dword [esp + 0x80], edx
je 0x40a98a
neg dword [esp + 0x80]
lea edi, [ecx + 0x20]
lea ebx, [esp + 0x18]
jmp 0x40a60d
lea ecx, [esp + 0xa0]
call fcn.004049c0
add edi, 0x20
add dword [esp + 0x80], 0x20
je 0x40a9ad
mov eax, dword [edi - 0x20]
test eax, eax
je 0x40a98a
mov dword [esp + 0xa0], eax
lea ecx, [esp + 0xa4]
mov eax, dword [edi - 4]
mov dword [ecx + 0x18], eax
lea eax, [0x498818]
movsd xmm0, qword [edi - 0xc]
movsd qword [ecx + 0x10], xmm0
movq xmm0, qword [edi - 0x1c]
movq xmm1, qword [edi - 0x14]
mov dword [esp + 0x18], eax
movq qword [ecx + 8], xmm1
movq qword [ecx], xmm0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], 0x16d27b3e
mov edx, dword [esp + 0x18]
call fcn.00406a30
mov eax, dword [eax]
mov ecx, 0x4b812eef
lea edx, [esp + 0x68]
xor eax, ecx
lea ecx, [esp + 0xa0]
mov dword [esp + 0x68], eax
push 4
call fcn.00407010
add esp, 4
test eax, eax
je 0x40a5f0
cmp dword [eax + 0x10], 0x80000002
jne 0x40a5f0
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
mov dword [esp + 8], eax
lea eax, [0x494690]
mov dword [esp + 4], ecx
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], 0x7638615
mov edx, dword [esp + 0x18]
call fcn.00406a50
mov ecx, dword [eax]
mov edx, 0x94f6995
xor ecx, edx
movzx edx, byte [eax + 6]
movzx eax, word [eax + 4]
mov dword [esp + 0x18], ecx
mov ecx, ebx
xor al, 0xcb
xor ah, 0xce
xor dl, 0xca
mov byte [esp + 0x1c], al
mov byte [esp + 0x1d], ah
mov byte [esp + 0x1e], dl
mov edx, 7
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405630
add esp, 8
test al, al
jne 0x40a94e
lea eax, [0x494248]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], 0x878f66c8
mov edx, dword [esp + 0x18]
call fcn.004066e0
mov ecx, dword [eax]
movzx eax, word [eax + 4]
mov edx, 0x792d6d9b
xor al, 0x54
xor ecx, edx
xor ah, 0x9d
mov edx, 6
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], al
mov byte [esp + 0x1d], ah
mov ecx, ebx
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405630
add esp, 8
test al, al
jne 0x40a94e
lea eax, [0x4a0c69]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], 0xede85c53
mov edx, dword [esp + 0x18]
call fcn.00406740
mov ecx, dword [eax]
mov edx, 0x4e18e79e
mov ebx, 0xf8ad38b
xor ecx, edx
mov edx, dword [eax + 4]
movzx eax, word [eax + 8]
mov dword [esp + 0x18], ecx
xor al, 0xb6
xor edx, ebx
lea ebx, [esp + 0x18]
xor ah, 0xb7
mov dword [esp + 0x1c], edx
mov byte [esp + 0x20], al
mov byte [esp + 0x21], ah
mov ecx, ebx
mov edx, 0xa
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405630
add esp, 8
test al, al
jne 0x40a94e
lea eax, [0x4a1d54]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], 0xa155878d
mov edx, dword [esp + 0x18]
call fcn.004066b0
mov eax, dword [eax]
mov ecx, 0xbfda699
mov edx, 4
xor eax, ecx
mov ecx, ebx
mov dword [esp + 0x18], eax
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405630
add esp, 8
test al, al
jne 0x40a94e
lea eax, [0x494ea0]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], 0xcf828b63
mov edx, dword [esp + 0x18]
call fcn.004065b0
mov ecx, dword [eax]
mov edx, 0x964439bf
mov ebx, 0x3f09f1c6
xor ecx, edx
mov edx, dword [eax + 4]
movzx eax, byte [eax + 8]
mov dword [esp + 0x18], ecx
xor edx, ebx
lea ebx, [esp + 0x18]
xor al, 0x9e
mov dword [esp + 0x1c], edx
mov byte [esp + 0x20], al
mov ecx, ebx
mov edx, 9
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405630
add esp, 8
test al, al
jne 0x40a94e
lea eax, [0x4a333c]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], 0xdd413ced
mov edx, dword [esp + 0x18]
call fcn.00406950
movzx ecx, byte [eax + 2]
movzx eax, word [eax]
xor al, 0x53
xor cl, 0xd3
xor ah, 0xa5
movzx ebx, ah
movzx edx, cl
movzx eax, al
mov byte [esp + 0x1a], cl
shl edx, 0x10
shl ebx, 8
or ebx, edx
mov edx, 3
or eax, ebx
lea ebx, [esp + 0x18]
mov word [esp + 0x18], ax
mov ecx, ebx
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405630
add esp, 8
test al, al
jne 0x40a94e
lea eax, [0x497f23]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], 0xac216066
mov edx, dword [esp + 0x18]
call fcn.00406680
mov ecx, dword [eax]
movzx eax, byte [eax + 4]
mov edx, 0xc4e518e1
xor ecx, edx
xor al, 0xbd
mov edx, 5
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], al
mov ecx, ebx
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405630
add esp, 8
test al, al
je 0x40a5f0
lea ecx, [esp + 0xa0]
call fcn.004049c0
cmp esi, edi
je 0x40a97d
mov esi, 0xffffffe0
sub esi, dword [esp + 0x80]
shr esi, 5
nop dword [eax]
mov ecx, edi
call fcn.004049c0
add edi, 0x20
dec esi
jne 0x40a970
cmp dword [esp + 0x5c], 0
mov bl, 1
mov dl, 1
jne 0x40a9bb
jmp 0x40a9d1
sub esi, edi
je 0x40a9ad
shr esi, 5
nop word cs:[eax + eax]
nop dword [eax + eax]
mov ecx, edi
call fcn.004049c0
add edi, 0x20
dec esi
jne 0x40a9a0
xor ebx, ebx
cmp dword [esp + 0x5c], 0
mov edx, 0
je 0x40a9d1
push dword [esp + 0x12c]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov edx, ebx
movzx eax, byte [esp + 0x4b]
mov edi, dword [esp + 0x154]
mov ecx, 0x9a7ecbe7
lea esi, [ecx + 0x45813419]
or al, byte [esp + 0x58]
or al, byte [esp + 0xc]
jne 0x40ac06
mov eax, dword [esp + 0x140]
cmp eax, dword [esp + 0x14]
jne 0x40ac06
cmp dword [esp + 0x10], 2
jb 0x40ac06
cmp dword [esp + 0x60], esi
mov eax, dword [esp + 0x64]
sbb eax, 0
jb 0x40ac06
xor eax, eax
cmp ecx, dword [esp + 0x7c]
sbb eax, dword [esp + 0x98]
jb 0x40ac06
test dl, dl
jne 0x40ac06
mov eax, dword [esp + 0x130]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test edi, 0x7fffffff
je 0x40aa67
push dword [esp + 0x15c]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
lea ecx, [esp + 0x170]
call fcn.00404c50
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 0xc], 0
test eax, eax
jne 0x409e95
jmp 0x409ea3
mov ecx, eax
mov eax, dword [esp + 0x5c]
mov esi, edx
shr esi, 3
lea edi, [ecx + eax + 4]
jmp 0x40aaba
add edi, 0xc
dec esi
je 0x409bb8
cmp dword [edi - 4], 0
je 0x40aab0
push dword [edi]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
jmp 0x40aab0
mov eax, dword [esp + 0x158]
mov ecx, 0xaaaaaaab
mul ecx
mov esi, edx
shr esi, 3
jmp 0x40aafe
add eax, 0xc
dec esi
mov dword [esp + 0x60], eax
je 0x409a5f
mov eax, dword [esp + 0x60]
cmp dword [eax - 4], 0
je 0x40aaf0
push dword [eax]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov eax, dword [esp + 0x60]
jmp 0x40aaf0
test ecx, ecx
jne 0x4085b1
jmp 0x4085c0
mov edx, dword [esp + 4]
lea ecx, [esp + 0x18]
push 2
push 2
push ebx
call fcn.0042a6b0
add esp, 0xc
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
lea eax, [esi + ecx*2]
cmp ebx, 2
jae 0x4081e5
jmp 0x40820e
lea eax, [esp + 0xa0]
mov dword [esp + 0xa0], 0
push eax
push 0
call sub.oleaut32.dll_GetErrorInfo
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x40ab93
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
jne 0x40aba4
test ebx, ebx
jne 0x40abae
cmp dword [esp + 4], 0
jne 0x40abbb
jmp 0x40abf1
push esi
call sub.oleaut32.dll_SysFreeString
test ebx, ebx
je 0x40ab9b
push ebx
call sub.oleaut32.dll_SysFreeString
cmp dword [esp + 4], 0
je 0x40abf1
push dword [esp + 8]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
ud2
mov esi, eax
test ebx, ebx
je 0x40abed
mov edi, dword [esp + 0x14]
nop dword [eax + eax]
mov ecx, edi
call fcn.004049c0
add edi, 0x20
dec ebx
jne 0x40abe0
test esi, esi
jne 0x40abf3
ud2
push dword [esp + 0x14]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
ud2
lea eax, [0x49c0ff]
mov dword [esp + 4], edx
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0xd3dfaa44
mov edx, dword [esp + 0xa0]
call fcn.00406a00
mov ecx, 0xa915feab
mov edx, 0xced22cab
mov edi, 0xe3a62808
xor ecx, dword [eax]
xor edx, dword [eax + 4]
xor edi, dword [eax + 8]
movzx eax, word [eax + 0xc]
mov dword [esp + 0xa0], 0x457cc4
mov dword [esp + 0xa4], 2
mov dword [esp + 0xb0], 0
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
xor al, 0x3b
mov dword [esp + 0x1c], edx
lea edx, [esp + 0x68]
xor ah, 0x50
mov dword [esp + 0x20], edi
mov byte [esp + 0x24], al
mov dword [esp + 0x68], ecx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], edx
mov byte [esp + 0x25], ah
mov dword [esp + 0x6c], 0xe
mov dword [esp + 0x50], 0x429d20
mov dword [esp + 0xa8], ecx
lea ecx, [esp + 0xa0]
mov dword [esp + 0xac], 1
call fcn.0042b7f0
cmp byte [esp + 0x4b], 0
jne 0x40b012
cmp byte [esp + 0x58], 0
jne 0x40b0f9
cmp byte [esp + 0xc], 0
jne 0x40b1c3
mov eax, dword [esp + 0x140]
cmp eax, dword [esp + 0x14]
jne 0x40b2b0
cmp dword [esp + 0x10], 2
jb 0x40b3cc
cmp dword [esp + 0x60], esi
sbb dword [esp + 0x64], 0
jae 0x40ae14
lea eax, [0x49b1ab]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0x8c999256
mov edx, dword [esp + 0xa0]
call fcn.004065f0
mov ecx, 0xe4b9eb92
mov esi, 0xe0b32997
mov edi, 0x35b0e1b7
mov ebx, 0x1944bbf4
mov edx, 0x4975e1c9
xor ecx, dword [eax]
mov dword [esp + 8], ecx
mov ecx, 0x5cdbd68f
xor esi, dword [eax + 4]
xor edi, dword [eax + 8]
xor ebx, dword [eax + 0xc]
xor edx, dword [eax + 0x10]
xor ecx, dword [eax + 0x14]
mov eax, dword [esp + 8]
mov dword [esp + 0x18], 0x457cc4
mov dword [esp + 0x1c], 2
mov dword [esp + 0x28], 0
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa8], edi
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], edx
mov dword [esp + 0xb4], ecx
lea ecx, [esp + 0xa0]
lea edx, [esp + 0x68]
mov dword [esp + 0x68], ecx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x6c], 0x18
mov dword [esp + 0x50], 0x429d20
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 1
call fcn.0042b7f0
mov ecx, 0x9a7ecbe7
xor eax, eax
cmp ecx, dword [esp + 0x7c]
sbb eax, dword [esp + 0x98]
jae 0x40af14
lea eax, [0x4948c9]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0x93c121da
mov edx, dword [esp + 0xa0]
call fcn.004067d0
mov ecx, 0x22f7c4a9
mov edx, 0x9633ba98
mov esi, 0xcd798f28
mov edi, 0x6f02dda6
mov ebx, 0xa276f85d
xor ecx, dword [eax]
xor edx, dword [eax + 4]
xor esi, dword [eax + 8]
xor edi, dword [eax + 0xc]
xor ebx, dword [eax + 0x10]
movzx eax, word [eax + 0x14]
mov dword [esp + 0xa0], 0x457cc4
mov dword [esp + 0xa4], 2
mov dword [esp + 0xb0], 0
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
xor al, 0x83
mov dword [esp + 0x1c], edx
lea edx, [esp + 0x68]
xor ah, 0xba
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x2c], al
mov dword [esp + 0x68], ecx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], edx
mov byte [esp + 0x2d], ah
mov dword [esp + 0x6c], 0x16
mov dword [esp + 0x50], 0x429d20
mov dword [esp + 0xa8], ecx
lea ecx, [esp + 0xa0]
mov dword [esp + 0xac], 1
call fcn.0042b7f0
cmp byte [esp + 4], 0
je 0x40b4d7
lea eax, [0x498374]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0xc039632f
mov edx, dword [esp + 0xa0]
call fcn.00406a70
mov ecx, 0xdfc74e56
mov esi, 0xf7bf3f50
mov edi, 0x1af3d83a
mov ebx, 0x5f61b0c0
mov edx, 0x46490bfc
xor ecx, dword [eax]
mov dword [esp + 4], ecx
mov ecx, 0x81e1b487
xor esi, dword [eax + 4]
xor edi, dword [eax + 8]
xor ebx, dword [eax + 0xc]
xor edx, dword [eax + 0x10]
xor ecx, dword [eax + 0x14]
mov eax, dword [esp + 4]
mov dword [esp + 0x18], 0x457cc4
mov dword [esp + 0x1c], 2
mov dword [esp + 0x28], 0
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa8], edi
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], edx
mov dword [esp + 0xb4], ecx
lea ecx, [esp + 0xa0]
lea edx, [esp + 0x68]
mov dword [esp + 0x68], ecx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x6c], 0x18
mov dword [esp + 0x50], 0x429d20
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 1
call fcn.0042b7f0
call fcn.0042bb10
lea eax, [0x499f85]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0xd6b8865f
mov edx, dword [esp + 0xa0]
call fcn.00406650
mov ecx, 0x182200af
mov edx, 0x5ece5a34
mov edi, 0x249a8ef0
mov ebx, 0xddd23e12
xor ecx, dword [eax]
xor edx, dword [eax + 4]
xor edi, dword [eax + 8]
xor ebx, dword [eax + 0xc]
movzx eax, word [eax + 0x10]
mov dword [esp + 0xa0], 0x457cc4
mov dword [esp + 0xa4], 2
mov dword [esp + 0xb0], 0
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
xor al, 0x5a
mov dword [esp + 0x1c], edx
lea edx, [esp + 0x68]
xor ah, 0x50
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
mov byte [esp + 0x28], al
mov dword [esp + 0x68], ecx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], edx
mov byte [esp + 0x29], ah
mov dword [esp + 0x6c], 0x12
mov dword [esp + 0x50], 0x429d20
mov dword [esp + 0xa8], ecx
lea ecx, [esp + 0xa0]
mov dword [esp + 0xac], 1
call fcn.0042b7f0
cmp byte [esp + 0x58], 0
je 0x40acf0
lea eax, [0x49ced5]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0x293e4cfe
mov edx, dword [esp + 0xa0]
call fcn.00406820
mov ecx, 0xb1096b6b
mov edx, 0x10ecee79
mov edi, 0x295295e8
xor ecx, dword [eax]
xor edx, dword [eax + 4]
xor edi, dword [eax + 8]
lea eax, [esp + 0x18]
mov dword [esp + 0xa0], 0x457cc4
mov dword [esp + 0xa4], 2
mov dword [esp + 0xb0], 0
mov dword [esp + 0x68], eax
lea eax, [esp + 0x68]
mov dword [esp + 0x6c], 0xc
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x50], 0x429d20
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], 1
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0xa0]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edi
call fcn.0042b7f0
cmp byte [esp + 0xc], 0
je 0x40acfb
lea eax, [0x4a25f8]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0x30a2d0a5
mov edx, dword [esp + 0xa0]
call fcn.004067b0
mov ecx, 0x235430e8
mov edx, 0xc652bcc
mov edi, 0x8a831702
mov ebx, 0xe4074553
xor ecx, dword [eax]
xor edx, dword [eax + 4]
xor edi, dword [eax + 8]
xor ebx, dword [eax + 0xc]
movzx eax, word [eax + 0x10]
mov dword [esp + 0xa0], 0x457cc4
mov dword [esp + 0xa4], 2
mov dword [esp + 0xb0], 0
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
xor al, 0xa5
mov dword [esp + 0x1c], edx
lea edx, [esp + 0x68]
xor ah, 0x43
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
mov byte [esp + 0x28], al
mov dword [esp + 0x68], ecx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], edx
mov byte [esp + 0x29], ah
mov dword [esp + 0x6c], 0x12
mov dword [esp + 0x50], 0x429d20
mov dword [esp + 0xa8], ecx
lea ecx, [esp + 0xa0]
mov dword [esp + 0xac], 1
call fcn.0042b7f0
mov eax, dword [esp + 0x140]
cmp eax, dword [esp + 0x14]
je 0x40ad0c
lea eax, [0x49c341]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0x6ee4e6ea
mov edx, dword [esp + 0xa0]
call fcn.00406800
mov ecx, 0x2b3869f0
mov edx, 0x157d9706
xor ecx, dword [eax]
mov dword [esp + 8], ecx
mov ecx, 0xe6c92493
xor ecx, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov ecx, 0x893f927e
xor ecx, dword [eax + 8]
mov dword [esp + 0x80], ecx
mov ecx, 0x543d9dc8
xor edx, dword [eax + 0xc]
xor ecx, dword [eax + 0x10]
movzx ebx, byte [eax + 0x16]
movzx eax, word [eax + 0x14]
mov edi, dword [esp + 8]
mov dword [esp + 0xa0], 0x457cc4
mov dword [esp + 0xa4], 2
mov dword [esp + 0xb0], 0
mov dword [esp + 0x18], edi
mov edi, dword [esp + 0xc]
xor al, 0x4a
xor ah, 0x2f
xor bl, 0x19
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x80]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x68]
mov byte [esp + 0x2c], al
mov byte [esp + 0x2d], ah
mov byte [esp + 0x2e], bl
mov dword [esp + 0x68], ecx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x6c], 0x17
mov dword [esp + 0x50], 0x429d20
mov dword [esp + 0xa8], ecx
lea ecx, [esp + 0xa0]
mov dword [esp + 0xac], 1
call fcn.0042b7f0
cmp dword [esp + 0x10], 2
jae 0x40ad17
lea eax, [0x495478]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
lea eax, [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0xa0], 0x6fae368f
mov edx, dword [esp + 0xa0]
call fcn.00406620
mov ecx, 0xdb7ed370
mov edi, 0xa42761f2
xor ecx, dword [eax]
mov dword [esp + 8], ecx
mov ecx, 0x230aacf8
xor ecx, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov ecx, 0x4b39ba3e
xor edi, dword [eax + 8]
xor ecx, dword [eax + 0xc]
movzx ebx, byte [eax + 0x12]
movzx eax, word [eax + 0x10]
mov edx, dword [esp + 8]
mov dword [esp + 0xa0], 0x457cc4
mov dword [esp + 0xa4], 2
mov dword [esp + 0xb0], 0
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0xc]
xor al, 0x21
xor ah, 0xc4
xor bl, 0xb6
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x68]
mov byte [esp + 0x28], al
mov byte [esp + 0x29], ah
mov byte [esp + 0x2a], bl
mov dword [esp + 0x68], ecx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x6c], 0x13
mov dword [esp + 0x50], 0x429d20
mov dword [esp + 0xa8], ecx
lea ecx, [esp + 0xa0]
mov dword [esp + 0xac], 1
call fcn.0042b7f0
cmp dword [esp + 0x60], esi
sbb dword [esp + 0x64], 0
jb 0x40ad26
jmp 0x40ae14
call fcn.0042bb10
aad 4
add byte [eax], al
aad 4
add byte [eax], al
aad 4
add byte [eax], al
aad 4
add byte [eax], al
aad 4
add byte [eax], al
aad 4
add byte [eax], al
mov ebp, 0xd5000004
add al, 0
add ch, dl
add al, 0
add byte [ebp - 0x42fffffc], bh
add al, 0
add ch, dl
add al, 0
add byte [ebp + 0x32000004], bh
sub al, byte [eax]
add ch, dl
add al, 0
add ch, dl
add al, 0
add ch, dl
add al, 0
add byte [ebp - 0x77], dl
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xffffffe0
sub esp, 0xae0
lea eax, [esp + 0x360]
mov dword [esp + 0x364], 0
mov dword [esp + 0x360], 0
push eax
call sub.kernel32.dll_QueryPerformanceCounter
test eax, eax
je 0x40ddef
mov esi, dword [esp + 0x360]
mov edi, dword [esp + 0x364]
movq xmm0, qword [0x4af0b8]
movd edx, xmm0
pshufd xmm0, xmm0, 0x55
movd ecx, xmm0
mov eax, edx
or eax, ecx
jne 0x40b5d7
lea eax, [esp + 0x360]
mov dword [esp + 0x364], 0
mov dword [esp + 0x360], 0
push eax
call sub.kernel32.dll_QueryPerformanceFrequency
test eax, eax
je 0x40ddef
mov edx, dword [esp + 0x360]
mov ecx, dword [esp + 0x364]
movq xmm0, qword [esp + 0x360]
mov eax, edx
movq qword [0x4af0b8], xmm0
or eax, ecx
je 0x40dde8
mov dword [esp + 0x14], ecx
push ecx
push edx
push edi
push esi
mov ebx, edx
mov dword [esp + 0x28], edx
call fcn.004490c0
add esp, 0x10
mov dword [esp + 0x50], edi
mov edi, edx
mov ecx, eax
mov dword [esp + 0x90], esi
mul ebx
imul esi, edi, 0x3b9aca00
imul edi, ebx
mov ebx, dword [esp + 0x90]
add edi, edx
mov edx, ecx
mov dword [esp + 0xd0], esi
mov esi, dword [esp + 0x50]
imul edx, dword [esp + 0x14]
add edi, edx
sub ebx, eax
mov edx, 0x3b9aca00
mov eax, ecx
sbb esi, edi
mul edx
mov edi, edx
mov dword [esp + 0x50], eax
mov eax, ebx
mov edx, 0x3b9aca00
imul ecx, esi, 0x3b9aca00
add edi, dword [esp + 0xd0]
mul edx
add edx, ecx
push dword [esp + 0x14]
push dword [esp + 0x1c]
push edx
push eax
call fcn.004490c0
add esp, 0x10
add eax, dword [esp + 0x50]
adc edx, edi
push 0
push 0x3b9aca00
push edx
mov dword [esp + 0x24], eax
push eax
call fcn.004490c0
add esp, 0x10
mov ebx, eax
mov dword [esp + 0xd0], edx
push 0x1f0003
push 2
push 0
push 0
call sub.kernel32.dll_CreateWaitableTimerExW
test eax, eax
je 0x40b6e8
mov esi, eax
mov dword [esp + 0x364], 0xffffffff
mov dword [esp + 0x360], 0xeb236c80
push 0
push 0
push 0
push 0
lea eax, [esp + 0x370]
push eax
push esi
call sub.kernel32.dll_SetWaitableTimer
test eax, eax
je 0x40b6e2
push 0xffffffffffffffff
push esi
call sub.kernel32.dll_WaitForSingleObject
mov edi, eax
push esi
call sub.kernel32.dll_CloseHandle
cmp edi, 0xffffffff
jne 0x40b6f2
jmp 0x40b6e8
push esi
call sub.kernel32.dll_CloseHandle
push 0x88b8
call sub.kernel32.dll_Sleep
lea eax, [esp + 0x360]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x364], 0
mov dword [esp + 0x360], 0
push eax
call sub.kernel32.dll_QueryPerformanceCounter
test eax, eax
je 0x40ddef
mov esi, dword [esp + 0x360]
mov edi, dword [esp + 0x364]
movq xmm0, qword [0x4af0b8]
movd edx, xmm0
pshufd xmm0, xmm0, 0x55
movd ecx, xmm0
mov eax, edx
or eax, ecx
jne 0x40b79e
lea eax, [esp + 0x360]
mov dword [esp + 0x364], 0
mov dword [esp + 0x360], 0
push eax
call sub.kernel32.dll_QueryPerformanceFrequency
test eax, eax
je 0x40ddef
mov edx, dword [esp + 0x360]
mov ecx, dword [esp + 0x364]
movq xmm0, qword [esp + 0x360]
mov eax, edx
movq qword [0x4af0b8], xmm0
or eax, ecx
je 0x40dde8
mov dword [esp + 0x50], ecx
push ecx
push edx
push edi
push esi
mov ebx, edx
mov dword [esp + 0xa0], edx
call fcn.004490c0
add esp, 0x10
mov dword [esp + 0x60], edi
mov edi, edx
mov ecx, eax
mov dword [esp + 0xb0], esi
mul ebx
imul esi, edi, 0x3b9aca00
imul edi, ebx
mov ebx, dword [esp + 0xb0]
add edi, edx
mov edx, ecx
mov dword [esp + 0x80], esi
mov esi, dword [esp + 0x60]
imul edx, dword [esp + 0x50]
add edi, edx
sub ebx, eax
mov edx, 0x3b9aca00
mov eax, ecx
sbb esi, edi
mul edx
mov edi, edx
mov dword [esp + 0x60], eax
mov eax, ebx
mov edx, 0x3b9aca00
imul ecx, esi, 0x3b9aca00
add edi, dword [esp + 0x80]
mul edx
add edx, ecx
push dword [esp + 0x50]
push dword [esp + 0x94]
push edx
push eax
call fcn.004490c0
add esp, 0x10
mov ebx, eax
add ebx, dword [esp + 0x60]
adc edx, edi
push 0
push 0x3b9aca00
push edx
push ebx
call fcn.004490c0
add esp, 0x10
mov dword [esp + 0x50], edx
mov esi, eax
movq xmm0, qword [0x4af0b8]
movd ecx, xmm0
pshufd xmm0, xmm0, 0x55
movd edx, xmm0
mov eax, ecx
or eax, edx
mov eax, dword [esp + 0x14]
jne 0x40b8c4
lea eax, [esp + 0x360]
mov dword [esp + 0x364], 0
mov dword [esp + 0x360], 0
push eax
call sub.kernel32.dll_QueryPerformanceFrequency
test eax, eax
je 0x40ddef
mov ecx, dword [esp + 0x360]
movq xmm0, qword [esp + 0x360]
mov edx, dword [esp + 0x364]
mov eax, ecx
movq qword [0x4af0b8], xmm0
or eax, edx
mov eax, dword [esp + 0x14]
je 0x40dde8
imul eax, eax, 0x3b9aca00
mov dword [esp + 0x90], edx
sub dword [esp + 0x18], eax
imul eax, esi, 0x3b9aca00
sub ebx, eax
mov dword [esp + 0x60], ebx
push edx
push ecx
push 0
push 0x3b9aca00
mov ebx, ecx
call fcn.004490c0
add esp, 0x10
mov edx, 1
xor ecx, ecx
lea edi, [eax - 0x3b9aca00]
mov dword [esp + 0x80], ebx
cmp edx, ebx
mov ebx, dword [esp + 0xd0]
sbb ecx, dword [esp + 0x90]
cmovb edi, eax
mov eax, esi
xor ecx, ecx
mov dword [esp + 0xb0], edi
mov edi, dword [esp + 0x50]
xor eax, dword [esp + 0x14]
mov edx, edi
xor edx, ebx
or edx, eax
mov edx, ebx
mov ebx, esi
setne cl
cmp dword [esp + 0x14], esi
mov eax, edx
sbb eax, edi
mov eax, 0xff
cmovae eax, ecx
mov ecx, dword [esp + 0x18]
test al, al
jne 0x40b960
cmp dword [esp + 0x60], ecx
setne al
ja 0x40b9e1
cmp al, 1
jne 0x40b9e1
cmp dword [esp + 0x14], ebx
mov esi, dword [esp + 0x50]
mov dword [esp + 0xc0], ebx
mov ebx, dword [esp + 0x60]
mov eax, edx
sbb eax, esi
jb 0x40dde8
mov eax, dword [esp + 0x14]
mov edi, edx
sub eax, dword [esp + 0xc0]
sbb edi, esi
cmp ebx, ecx
jbe 0x40b9ac
mov edx, eax
or eax, edi
je 0x40dde8
add edx, 0xffffffff
lea ecx, [ecx + 0x3b9aca00]
adc edi, 0xffffffff
mov eax, edx
mov edx, ecx
mov dword [esp + 0xac], eax
mov dword [esp + 0x4c], edi
sub edx, ebx
cmp edx, 0x3b9aca00
mov dword [esp + 0x110], edx
jae 0x40ba00
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x90]
mov edi, dword [esp + 0xac]
jmp 0x40ba49
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x50]
mov ecx, ebx
cmp ebx, edi
mov ebx, dword [esp + 0x60]
mov eax, esi
sbb eax, edx
jae 0x40babf
jmp 0x40ddea
mov ecx, dword [esp + 0xac]
mov eax, edx
mov edx, 0x44b83
shr eax, 9
mul edx
shr edx, 7
mov eax, ecx
add eax, edx
mov eax, edi
adc eax, 0
jb 0x40dde8
imul eax, edx, 0x3b9aca00
sub dword [esp + 0x110], eax
add ecx, edx
mov eax, dword [esp + 0x80]
mov edi, ecx
mov ecx, dword [esp + 0x90]
adc dword [esp + 0x4c], 0
cmp eax, 2
mov edx, dword [esp + 0x4c]
sbb ecx, 0
mov ecx, edi
setb al
movzx eax, al
xor ecx, eax
mov dword [esp + 0x90], eax
xor eax, eax
or ecx, edx
setne al
cmp edi, dword [esp + 0x90]
mov edi, dword [esp + 0x110]
sbb edx, 0
mov edx, 0xff
cmovb eax, edx
xor ecx, ecx
cmp edi, dword [esp + 0xb0]
mov edi, dword [esp + 0x14]
setne cl
cmovb ecx, edx
test al, al
mov edx, dword [esp + 0xd0]
cmovne ecx, eax
cmp cl, 1
mov ecx, dword [esp + 0xc0]
jne 0x40ddea
cmp ecx, edi
mov eax, esi
sbb eax, edx
jb 0x40ddea
mov eax, dword [esp + 0x18]
sub ecx, edi
sbb esi, edx
cmp ebx, eax
jae 0x40bae5
mov eax, ecx
or eax, esi
je 0x40ddea
mov eax, dword [esp + 0x18]
add ecx, 0xffffffff
adc esi, 0xffffffff
add ebx, 0x3b9aca00
sub ebx, eax
cmp ebx, 0x3b9aca00
jb 0x40bb16
shr ebx, 9
mov edi, ecx
mov ecx, 0x44b83
mov eax, ebx
mul ecx
mov eax, edi
shr edx, 7
add eax, edx
mov eax, esi
adc eax, 0
jb 0x40dde8
mov ecx, edi
add ecx, edx
adc esi, 0
cmp ecx, 0x19
sbb esi, 0
jb 0x40ddea
lea esi, [esp + 0x360]
mov ecx, esi
call fcn.004352b0
cmp dword [esp + 0x360], 0x80000011
jne 0x40dde8
call fcn.004080d0
mov dword [esp + 0x17c], 0
mov dword [esp + 0x680], 0
mov dword [esp + 0x860], 0
mov dword [esp + 0x360], 0
call sub.kernel32.dll_GetCurrentProcess
push esi
push eax
call sub.kernel32.dll_CheckRemoteDebuggerPresent
call sub.kernel32.dll_GetCurrentProcess
lea ecx, [esp + 0x17c]
push 0
push 4
push ecx
push 7
push eax
call sub.ntdll.dll_NtQueryInformationProcess
call sub.kernel32.dll_GetCurrentProcess
lea ecx, [esp + 0x680]
push 0
push 4
push ecx
push 0x1f
push eax
call sub.ntdll.dll_NtQueryInformationProcess
call sub.kernel32.dll_GetCurrentProcess
lea ecx, [esp + 0x860]
push 0
push 4
push ecx
push 0x1e
push eax
call sub.ntdll.dll_NtQueryInformationProcess
cmp dword [esp + 0x360], 0
jne 0x40ddea
cmp dword [esp + 0x17c], 0
jne 0x40ddea
cmp dword [esp + 0x680], 0
je 0x40ddea
cmp dword [esp + 0x860], 0
jne 0x40ddea
movdqa xmm0, xmmword [0x4570d0]
movaps xmm1, xmmword [0x4570e0]
mov ecx, 0x4a3910
mov eax, 0x4a3910
lea edx, [esp + 0x360]
shr ecx, 8
mov byte [esp + 0x360], al
shr eax, 0x18
mov word [esp + 0x361], cx
lea ecx, [esp + 0x860]
mov byte [esp + 0x363], al
mov dword [esp + 0x364], 0x20
mov dword [esp + 0x368], 0x4a393c
movdqu xmmword [esp + 0x36c], xmm0
mov dword [esp + 0x37c], 1
mov dword [esp + 0x380], 0
mov dword [esp + 0x384], 1
movups xmmword [esp + 0x388], xmm1
mov dword [esp + 0x398], 2
mov word [esp + 0x39c], 0x213
call fcn.0040e940
mov ecx, dword [esp + 0x860]
mov eax, ecx
neg eax
jo 0x40dedc
movzx esi, byte [esp + 0x867]
mov dword [esp + 0x18], ecx
movzx ecx, word [esp + 0x865]
movzx eax, byte [esp + 0x864]
shl ecx, 8
shl esi, 0x18
or esi, ecx
or esi, eax
cmp dword [esp + 0x868], 0x20
jne 0x40ddf6
movzx eax, byte [esi]
movzx ecx, byte [esi + 1]
movzx edx, byte [esi + 2]
mov ah, byte [esi + 3]
mov ch, byte [esi + 4]
mov dh, byte [esi + 5]
movzx ebx, byte [esi + 6]
mov bh, byte [esi + 7]
mov byte [esp + 0x50], al
mov al, byte [esi + 8]
mov byte [esp + 0x14], al
mov al, byte [esi + 9]
mov byte [esp + 0xd0], al
mov al, byte [esi + 0xa]
mov byte [esp + 0x90], al
mov al, byte [esi + 0xb]
mov byte [esp + 0x60], al
mov al, byte [esi + 0xc]
mov byte [esp + 0x80], al
mov al, byte [esi + 0xd]
mov byte [esp + 0xb0], al
mov al, byte [esi + 0xe]
mov byte [esp + 0xc0], al
mov al, byte [esi + 0xf]
mov byte [esp + 0x110], al
mov al, byte [esi + 0x10]
mov byte [esp + 0x4c], al
mov al, byte [esi + 0x11]
mov byte [esp + 0xac], al
mov al, byte [esi + 0x12]
mov byte [esp + 0x2b], al
mov al, byte [esi + 0x13]
mov byte [esp + 0x2a], al
mov al, byte [esi + 0x14]
mov byte [esp + 0x29], al
mov al, byte [esi + 0x15]
mov byte [esp + 0x28], al
mov al, byte [esi + 0x16]
mov byte [esp + 0x27], al
mov al, byte [esi + 0x17]
mov byte [esp + 0x26], al
mov al, byte [esi + 0x18]
mov byte [esp + 0x25], al
mov al, byte [esi + 0x19]
mov byte [esp + 0x24], al
mov al, byte [esi + 0x1a]
mov byte [esp + 0x23], al
mov al, byte [esi + 0x1b]
mov byte [esp + 0x22], al
mov al, byte [esi + 0x1c]
mov byte [esp + 0x21], al
mov al, byte [esi + 0x1d]
mov byte [esp + 0x20], al
mov al, byte [esi + 0x1e]
mov byte [esp + 0x1f], al
mov al, byte [esi + 0x1f]
mov byte [esp + 0x4a], cl
mov byte [esp + 0x47], ch
mov byte [esp + 0x49], dl
mov byte [esp + 0x46], dh
mov byte [esp + 0x48], ah
mov byte [esp + 0x45], bl
mov byte [esp + 0x44], bh
xor ecx, ecx
mov edx, 0x4bc10
mov byte [esp + 0x1e], al
movzx eax, byte [esp + 0x50]
mov byte [esp + 0x4b], al
movzx eax, byte [esp + 0x14]
mov byte [esp + 0x43], al
movzx eax, byte [esp + 0xd0]
mov byte [esp + 0x42], al
movzx eax, byte [esp + 0x90]
mov byte [esp + 0x41], al
movzx eax, byte [esp + 0x60]
mov byte [esp + 0x40], al
movzx eax, byte [esp + 0x80]
mov byte [esp + 0x3f], al
movzx eax, byte [esp + 0xb0]
mov byte [esp + 0x3e], al
movzx eax, byte [esp + 0xc0]
mov byte [esp + 0x3d], al
movzx eax, byte [esp + 0x110]
mov byte [esp + 0x3c], al
movzx eax, byte [esp + 0x4c]
mov byte [esp + 0x3b], al
movzx eax, byte [esp + 0xac]
mov byte [esp + 0x3a], al
movzx eax, byte [esp + 0x2b]
mov byte [esp + 0x39], al
movzx eax, byte [esp + 0x2a]
mov byte [esp + 0x38], al
movzx eax, byte [esp + 0x29]
mov byte [esp + 0x37], al
movzx eax, byte [esp + 0x28]
mov byte [esp + 0x36], al
movzx eax, byte [esp + 0x27]
mov byte [esp + 0x35], al
movzx eax, byte [esp + 0x26]
mov byte [esp + 0x34], al
movzx eax, byte [esp + 0x25]
mov byte [esp + 0x33], al
movzx eax, byte [esp + 0x24]
mov byte [esp + 0x32], al
movzx eax, byte [esp + 0x23]
mov byte [esp + 0x31], al
movzx eax, byte [esp + 0x22]
mov byte [esp + 0x30], al
movzx eax, byte [esp + 0x21]
mov byte [esp + 0x2f], al
movzx eax, byte [esp + 0x20]
mov byte [esp + 0x2e], al
movzx eax, byte [esp + 0x1f]
mov byte [esp + 0x2d], al
movzx eax, byte [esp + 0x1e]
mov byte [esp + 0x2c], al
movzx eax, byte [0x4af0d4]
call fcn.0042bb70
test eax, eax
je 0x40dde8
push 0x4bc10
push 0x457d00
mov dword [esp + 0x1c], eax
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
movzx eax, byte [esp + 0x44]
movzx ebx, byte [esp + 0x4b]
mov bh, byte [esp + 0x4a]
movzx ecx, byte [esp + 0x49]
movzx edx, byte [esp + 0x48]
mov ah, byte [esp + 0x47]
mov ch, byte [esp + 0x46]
mov dh, byte [esp + 0x45]
mov byte [esp + 0x50], al
mov al, byte [esp + 0x43]
mov byte [esp + 0xd0], al
mov al, byte [esp + 0x42]
mov byte [esp + 0x90], al
mov al, byte [esp + 0x41]
mov byte [esp + 0x60], al
mov al, byte [esp + 0x40]
mov byte [esp + 0x80], al
mov al, byte [esp + 0x3f]
mov byte [esp + 0xb0], al
mov al, byte [esp + 0x3e]
mov byte [esp + 0xc0], al
mov al, byte [esp + 0x3d]
mov byte [esp + 0x110], al
mov al, byte [esp + 0x3c]
mov byte [esp + 0x4c], al
mov al, byte [esp + 0x3b]
mov byte [esp + 0xac], al
mov al, byte [esp + 0x3a]
mov byte [esp + 0x2b], al
mov al, byte [esp + 0x39]
mov byte [esp + 0x2a], al
mov al, byte [esp + 0x38]
mov byte [esp + 0x29], al
mov al, byte [esp + 0x37]
mov byte [esp + 0x28], al
mov al, byte [esp + 0x36]
mov byte [esp + 0x27], al
mov al, byte [esp + 0x35]
mov byte [esp + 0x26], al
mov al, byte [esp + 0x34]
mov byte [esp + 0x25], al
mov al, byte [esp + 0x33]
mov byte [esp + 0x24], al
mov al, byte [esp + 0x32]
mov byte [esp + 0x23], al
mov al, byte [esp + 0x31]
mov byte [esp + 0x22], al
mov al, byte [esp + 0x30]
mov byte [esp + 0x21], al
mov al, byte [esp + 0x2f]
mov byte [esp + 0x20], al
mov al, byte [esp + 0x2e]
mov byte [esp + 0x1f], al
mov al, byte [esp + 0x2d]
mov byte [esp + 0x1e], al
mov al, byte [esp + 0x2c]
mov byte [esp + 0x7f], al
mov al, byte [section..data]
cmp al, 0xff
je 0x40c32e
pxor xmm0, xmm0
mov al, byte [esp + 0x50]
mov dword [esp + 0x10c], esi
movq qword [esp + 0x1f4], xmm0
movq qword [esp + 0x1ec], xmm0
movq qword [esp + 0x1e4], xmm0
movq qword [esp + 0x1dc], xmm0
movq qword [esp + 0x1d4], xmm0
movq qword [esp + 0x1cc], xmm0
movq qword [esp + 0x1c4], xmm0
movq qword [esp + 0x1bc], xmm0
mov dword [esp + 0x17c], 0x61707865
mov dword [esp + 0x180], 0x3320646e
mov dword [esp + 0x184], 0x79622d32
mov dword [esp + 0x188], 0x6b206574
mov byte [esp + 0x18c], bl
mov byte [esp + 0x18d], bh
mov byte [esp + 0x18e], cl
mov byte [esp + 0x18f], dl
mov dl, byte [esp + 0xd0]
mov cl, byte [esp + 0x90]
mov byte [esp + 0x190], ah
mov byte [esp + 0x191], ch
mov byte [esp + 0x192], dh
pxor xmm0, xmm0
movdqa xmmword [esp + 0xf0], xmm0
movdqa xmmword [esp + 0xe0], xmm0
mov byte [esp + 0x193], al
mov byte [esp + 0x194], dl
mov byte [esp + 0x195], cl
movzx edx, byte [esp + 0x60]
movzx ecx, byte [esp + 0x80]
mov byte [esp + 0x196], dl
mov byte [esp + 0x197], cl
movzx edx, byte [esp + 0xb0]
movzx ecx, byte [esp + 0xc0]
mov byte [esp + 0x198], dl
mov byte [esp + 0x199], cl
movzx edx, byte [esp + 0x110]
movzx ecx, byte [esp + 0x4c]
mov byte [esp + 0x19a], dl
mov byte [esp + 0x19b], cl
movzx edx, byte [esp + 0xac]
movzx ecx, byte [esp + 0x2b]
mov byte [esp + 0x19c], dl
mov byte [esp + 0x19d], cl
movzx edx, byte [esp + 0x2a]
movzx ecx, byte [esp + 0x29]
mov byte [esp + 0x19e], dl
mov byte [esp + 0x19f], cl
movzx edx, byte [esp + 0x28]
movzx ecx, byte [esp + 0x27]
mov byte [esp + 0x1a0], dl
mov byte [esp + 0x1a1], cl
movzx edx, byte [esp + 0x26]
movzx ecx, byte [esp + 0x25]
mov byte [esp + 0x1a2], dl
mov byte [esp + 0x1a3], cl
movzx edx, byte [esp + 0x24]
movzx ecx, byte [esp + 0x23]
mov byte [esp + 0x1a4], dl
mov byte [esp + 0x1a5], cl
movzx edx, byte [esp + 0x22]
movzx ecx, byte [esp + 0x21]
mov byte [esp + 0x1a6], dl
mov byte [esp + 0x1a7], cl
movzx edx, byte [esp + 0x20]
movzx ecx, byte [esp + 0x1f]
mov byte [esp + 0x1a8], dl
mov byte [esp + 0x1a9], cl
movzx edx, byte [esp + 0x1e]
movzx ecx, byte [esp + 0x7f]
mov byte [esp + 0x1aa], dl
mov byte [esp + 0x1ab], cl
mov dword [esp + 0x1ac], 0
mov dword [esp + 0x1b8], 0x97911efb
mov dword [esp + 0x1b4], 0x4eb587ee
mov dword [esp + 0x1b0], 0x98fb28b8
mov byte [esp + 0x1fc], 0
lea ecx, [esp + 0x17c]
lea edx, [esp + 0xe0]
push 0x20
call fcn.00420c20
add esp, 4
movzx eax, byte [0x456001]
cmp al, 1
je 0x40c373
movzx eax, al
cmp eax, 0xff
je 0x40c366
mov esi, dword [esp + 0xe3]
mov ecx, dword [esp + 0xe6]
mov edx, dword [esp + 0xe9]
mov eax, 0x3ffffff
pxor xmm0, xmm0
mov ebx, dword [esp + 0xf0]
mov dword [esp + 0x230], 0
movdqa xmmword [esp + 0x220], xmm0
and eax, dword [esp + 0xe0]
movsd xmm0, qword [esp + 0xf4]
shr esi, 2
shr ecx, 4
shr edx, 6
mov dword [esp + 0x50], ebx
shr ebx, 8
and esi, 0x3ffff03
and ecx, 0x3ffc0ff
and edx, 0x3f03fff
movaps xmmword [esp + 0x110], xmm0
mov dword [esp + 0x60], eax
mov dword [esp + 0x80], esi
mov esi, dword [esp + 0xec]
mov dword [esp + 0xb0], ecx
mov ecx, dword [esp + 0xfc]
mov dword [esp + 0xc0], edx
shr esi, 8
mov dword [esp + 0x4c], ecx
and esi, 0xfffff
jmp 0x40cafb
mov byte [esp + 0x10c], cl
mov byte [esp + 0x7e], dl
mov byte [esp + 0x7d], ah
mov byte [esp + 0x7c], ch
mov byte [esp + 0x7b], dh
call fcn.00417590
mov dh, byte [esp + 0x7b]
mov ch, byte [esp + 0x7c]
mov ah, byte [esp + 0x7d]
mov dl, byte [esp + 0x7e]
mov cl, byte [esp + 0x10c]
jmp 0x40c015
call fcn.00424150
test al, al
je 0x40c282
lea ecx, [esp + 0x860]
lea edx, [esp + 0xe0]
call fcn.004241b0
movaps xmm1, xmmword [esp + 0x870]
movaps xmm2, xmmword [esp + 0x880]
movaps xmm0, xmmword [esp + 0x860]
lea edx, [esp + 0x7c0]
lea ecx, [esp + 0x860]
movaps xmmword [esp + 0x90], xmm1
movaps xmm1, xmmword [esp + 0x890]
movaps xmmword [esp + 0x7c0], xmm2
movaps xmm2, xmmword [esp + 0x8a0]
movaps xmmword [esp + 0xd0], xmm0
movaps xmmword [esp + 0x7d0], xmm1
movaps xmm1, xmmword [esp + 0x8b0]
movaps xmmword [esp + 0x7e0], xmm2
movaps xmmword [esp + 0x7f0], xmm1
push edx
call fcn.004221d0
add esp, 4
movaps xmm1, xmmword [esp + 0x890]
movaps xmm0, xmmword [esp + 0x880]
movaps xmm2, xmmword [esp + 0x860]
lea esi, [esp + 0x800]
mov edx, 0xffffffff
mov ecx, esi
movaps xmmword [esp + 0xb0], xmm1
movaps xmm1, xmmword [esp + 0x870]
movaps xmmword [esp + 0x80], xmm0
movaps xmmword [esp + 0x50], xmm2
movaps xmmword [esp + 0x60], xmm1
push 0
push 0x3ffffff
push 0
push 0x3ffffff
push 0
push 0x3ffffff
push 0xffffffffffffffff
call fcn.00422830
add esp, 0x1c
movaps xmm0, xmmword [esp + 0x60]
movaps xmm1, xmmword [esp + 0x50]
lea edi, [esp + 0x220]
lea edx, [esp + 0x7a0]
mov ecx, edi
movaps xmmword [esp + 0x7b0], xmm0
movaps xmmword [esp + 0x7a0], xmm1
push esi
call fcn.00422b80
add esp, 4
lea esi, [esp + 0x840]
mov edx, 0x40
mov ecx, esi
push 0
push 0x1a
push 0
push 0x1a
push 0
push 0x1a
push 0
call fcn.00422830
add esp, 0x1c
movaps xmm0, xmmword [esp + 0x60]
movaps xmm1, xmmword [esp + 0x50]
lea ebx, [esp + 0x2e0]
lea edx, [esp + 0x820]
mov ecx, ebx
movaps xmmword [esp + 0x830], xmm0
movaps xmmword [esp + 0x820], xmm1
push esi
call fcn.00424230
add esp, 4
lea esi, [esp + 0x200]
mov edx, ebx
mov ecx, esi
call fcn.00422ba0
lea ecx, [esp + 0x680]
mov edx, edi
push esi
mov ebx, esi
call fcn.004228d0
add esp, 4
movaps xmm0, xmmword [esp + 0x680]
movaps xmm1, xmmword [esp + 0x690]
lea esi, [esp + 0x260]
lea edx, [esp + 0x2a0]
mov ecx, esi
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0xc0], xmm1
movaps xmmword [esp + 0x2b0], xmm1
movaps xmmword [esp + 0x2a0], xmm0
call fcn.00424250
lea ecx, [esp + 0x300]
mov edx, esi
mov edi, ecx
call fcn.00422ba0
movaps xmm0, xmmword [esp + 0xb0]
movaps xmm1, xmmword [esp + 0x80]
lea esi, [esp + 0x680]
lea edx, [esp + 0x640]
mov ecx, esi
movaps xmmword [esp + 0x650], xmm0
movaps xmmword [esp + 0x640], xmm1
push edi
call fcn.004228d0
add esp, 4
movaps xmm0, xmmword [esp + 0x680]
movaps xmm1, xmmword [esp + 0x690]
mov ecx, esi
mov edx, 0x3ffffff
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x80], xmm1
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
call fcn.00422830
add esp, 0x1c
movaps xmm0, xmmword [esp + 0xc0]
movaps xmm1, xmmword [esp + 0x50]
lea edi, [esp + 0x240]
lea edx, [esp + 0x120]
mov ecx, edi
movaps xmmword [esp + 0x130], xmm0
movaps xmmword [esp + 0x120], xmm1
push esi
call fcn.00422b80
add esp, 4
mov ecx, ebx
mov edx, 0x40
push 0
push 0x1a
push 0
push 0x40
push 0
push 0x40
push 0
call fcn.00422830
add esp, 0x1c
movaps xmm0, xmmword [esp + 0x80]
movaps xmm1, xmmword [esp + 0x60]
lea ecx, [esp + 0x680]
lea edx, [esp + 0x220]
movaps xmmword [esp + 0x230], xmm0
movaps xmmword [esp + 0x220], xmm1
push ebx
call fcn.00424230
add esp, 4
movaps xmm0, xmmword [esp + 0x680]
movaps xmm1, xmmword [esp + 0x690]
lea ebx, [esp + 0x640]
lea eax, [esp + 0x2a0]
mov edx, edi
mov ecx, ebx
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0xb0], xmm1
movaps xmmword [esp + 0x2b0], xmm1
movaps xmmword [esp + 0x2a0], xmm0
push eax
call fcn.004228d0
add esp, 4
movaps xmm0, xmmword [esp + 0xb0]
movaps xmm1, xmmword [esp + 0x50]
lea edi, [esp + 0x300]
lea edx, [esp + 0x260]
mov ecx, edi
movaps xmmword [esp + 0x270], xmm0
movaps xmmword [esp + 0x260], xmm1
call fcn.00424270
lea esi, [esp + 0x680]
mov edx, ebx
mov ecx, esi
push edi
call fcn.004228d0
add esp, 4
movaps xmm0, xmmword [esp + 0x680]
movaps xmm1, xmmword [esp + 0x690]
mov dword [esp + 0x50], 0
mov ecx, esi
xor edx, edx
movaps xmmword [esp + 0xb0], xmm0
movaps xmmword [esp + 0xc0], xmm1
push 0
push 0x3ffffff
push 0
push 0
push 0
push 0
push 0
call fcn.00422830
add esp, 0x1c
movaps xmm0, xmmword [esp + 0x80]
movaps xmm1, xmmword [esp + 0x60]
lea ecx, [esp + 0x2e0]
lea edx, [esp + 0x120]
movaps xmmword [esp + 0x130], xmm0
movaps xmmword [esp + 0x120], xmm1
push esi
call fcn.00422b80
add esp, 4
lea edi, [esp + 0x820]
mov edx, 0xffffffff
mov ecx, edi
push 0
push 0x3ffffff
push 0
push 0x3ffffff
push 0
push 0x3ffffff
push 0xffffffffffffffff
call fcn.00422830
add esp, 0x1c
movaps xmm0, xmmword [esp + 0xc0]
movaps xmm1, xmmword [esp + 0xb0]
lea esi, [esp + 0x240]
lea edx, [esp + 0x800]
mov ecx, esi
movaps xmmword [esp + 0x810], xmm0
movaps xmmword [esp + 0x800], xmm1
push edi
call fcn.00422b80
add esp, 4
lea edi, [esp + 0x220]
mov edx, 0x40
mov ecx, edi
push 0
push 0x1a
push 0
push 0x1a
push 0
push 0x1a
push 0
call fcn.00422830
add esp, 0x1c
movaps xmm0, xmmword [esp + 0xc0]
movaps xmm1, xmmword [esp + 0xb0]
lea ebx, [esp + 0x200]
lea edx, [esp + 0x840]
mov ecx, ebx
movaps xmmword [esp + 0x850], xmm0
movaps xmmword [esp + 0x840], xmm1
push edi
call fcn.00424230
add esp, 4
lea edi, [esp + 0x2a0]
mov edx, ebx
mov ecx, edi
call fcn.00422ba0
lea ebx, [esp + 0x680]
mov edx, esi
mov ecx, ebx
push edi
call fcn.004228d0
add esp, 4
movaps xmm0, xmmword [esp + 0x680]
movaps xmm1, xmmword [esp + 0x690]
lea edi, [esp + 0x640]
lea edx, [esp + 0x260]
mov ecx, edi
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x80], xmm1
movaps xmmword [esp + 0x270], xmm1
movaps xmmword [esp + 0x260], xmm0
call fcn.00424250
lea esi, [esp + 0x300]
mov edx, edi
mov ecx, esi
call fcn.00422ba0
lea ecx, [esp + 0x7a0]
lea edx, [esp + 0x2e0]
push esi
call fcn.004228d0
add esp, 4
mov ecx, ebx
mov edx, 0x3ffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
call fcn.00422830
add esp, 0x1c
movaps xmm0, xmmword [esp + 0x80]
movaps xmm1, xmmword [esp + 0x60]
lea esi, [esp + 0xaa0]
lea edx, [esp + 0x120]
mov ecx, esi
movaps xmmword [esp + 0x130], xmm0
movaps xmmword [esp + 0x120], xmm1
push ebx
call fcn.00422b80
add esp, 4
lea edi, [esp + 0x260]
xor edx, edx
mov ecx, edi
push 0
push 2
push 4
push 6
push 0
push 4
push 6
call fcn.00422120
add esp, 0x1c
lea ecx, [esp + 0x120]
mov edx, esi
push edi
call fcn.00422170
add esp, 4
lea esi, [esp + 0x640]
xor edx, edx
mov ecx, esi
push 0
push 2
push 4
push 6
push 0
push 4
push 6
call fcn.00422120
add esp, 0x1c
mov ecx, ebx
lea edx, [esp + 0x7a0]
push esi
call fcn.00422170
add esp, 4
lea esi, [esp + 0x300]
lea edx, [esp + 0x120]
mov ecx, esi
push ebx
call fcn.00424290
add esp, 4
movaps xmm0, xmmword [esp + 0x300]
movaps xmm1, xmmword [esp + 0x310]
lea edi, [esp + 0x2a0]
lea edx, [esp + 0x200]
mov ecx, edi
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x80], xmm1
movaps xmmword [esp + 0x210], xmm1
movaps xmmword [esp + 0x200], xmm0
call fcn.00422100
movaps xmm0, xmmword [esp + 0x80]
movaps xmm1, xmmword [esp + 0x60]
lea ebx, [esp + 0x260]
lea edx, [esp + 0x240]
mov ecx, ebx
movaps xmmword [esp + 0x250], xmm0
movaps xmmword [esp + 0x240], xmm1
push edi
call fcn.004220e0
add esp, 4
mov ecx, esi
mov edx, 4
push 1
push 1
push 1
push 1
push 1
push 2
push 3
call fcn.00422120
add esp, 0x1c
lea ecx, [esp + 0x860]
mov edx, ebx
push esi
call fcn.00422170
add esp, 4
movaps xmm1, xmmword [esp + 0x860]
movaps xmm2, xmmword [esp + 0x870]
movaps xmm0, xmmword [esp + 0x80]
movaps xmm3, xmmword [esp + 0x60]
lea eax, [esp + 0x680]
lea ecx, [esp + 0x640]
lea edx, [esp + 0x120]
movaps xmmword [esp + 0xb0], xmm1
movaps xmmword [esp + 0xc0], xmm2
movaps xmmword [esp + 0x130], xmm0
movaps xmmword [esp + 0x120], xmm3
movaps xmmword [esp + 0x690], xmm2
movaps xmmword [esp + 0x680], xmm1
push eax
call fcn.00422190
add esp, 4
movaps xmm0, xmmword [esp + 0xc0]
movaps xmm1, xmmword [esp + 0xb0]
lea ecx, [esp + 0x660]
lea edx, [esp + 0x860]
movaps xmmword [esp + 0x870], xmm0
movaps xmmword [esp + 0x860], xmm1
call fcn.004221b0
xorps xmm0, xmm0
movaps xmmword [esp + 0x120], xmm0
movaps xmmword [esp + 0x130], xmm0
movaps xmmword [esp + 0x140], xmm0
movaps xmmword [esp + 0x150], xmm0
xorps xmm0, xmm0
movsd qword [esp + 0x15d], xmm0
mov eax, dword [esp + 0x230]
movaps xmm0, xmmword [esp + 0x220]
mov dword [esp + 0x2f0], eax
movaps xmmword [esp + 0x2e0], xmm0
push 0x108
lea eax, [esp + 0x864]
push eax
lea edi, [esp + 0x688]
push edi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
movaps xmm1, xmmword [esp + 0x7d0]
movaps xmm2, xmmword [esp + 0x7e0]
movaps xmm3, xmmword [esp + 0x640]
mov eax, dword [esp + 0x257]
movaps xmm0, xmmword [esp + 0x7c0]
lea ecx, [esp + 0x5a0]
movaps xmmword [esp + 0x270], xmm1
movaps xmm1, xmmword [esp + 0x7f0]
movaps xmmword [esp + 0x280], xmm2
movaps xmm2, xmmword [esp + 0x660]
movaps xmmword [esp + 0x2a0], xmm3
movaps xmm3, xmmword [esp + 0x120]
mov dword [esp + 0x217], eax
movaps xmmword [esp + 0x260], xmm0
movaps xmmword [esp + 0x290], xmm1
movaps xmm1, xmmword [esp + 0x650]
movaps xmmword [esp + 0x2c0], xmm2
movaps xmm2, xmmword [esp + 0x140]
movaps xmmword [esp + 0x300], xmm3
movaps xmmword [esp + 0x2b0], xmm1
movaps xmm1, xmmword [esp + 0x670]
movaps xmmword [esp + 0x320], xmm2
movsd xmm2, qword [esp + 0x15d]
movaps xmmword [esp + 0x2d0], xmm1
movaps xmm1, xmmword [esp + 0x130]
movaps xmmword [esp + 0x310], xmm1
movaps xmm1, xmmword [esp + 0x150]
movaps xmmword [esp + 0x330], xmm1
movsd xmm1, qword [esp + 0x250]
movsd qword [esp + 0x33d], xmm2
movsd xmm2, qword [esp + 0x240]
movsd qword [esp + 0x210], xmm1
movsd xmm1, qword [esp + 0x248]
movsd qword [esp + 0x200], xmm2
movsd qword [esp + 0x208], xmm1
mov byte [esp + 0xe0], 0
mov byte [esp + 0xe1], 0
mov byte [esp + 0xe2], 0
mov byte [esp + 0xe3], 0
mov byte [esp + 0xe4], 0
mov byte [esp + 0xe5], 0
mov byte [esp + 0xe6], 0
mov byte [esp + 0xe7], 0
mov byte [esp + 0xe8], 0
mov byte [esp + 0xe9], 0
mov byte [esp + 0xea], 0
mov byte [esp + 0xeb], 0
mov byte [esp + 0xec], 0
mov byte [esp + 0xed], 0
mov byte [esp + 0xee], 0
mov byte [esp + 0xef], 0
mov byte [esp + 0xf0], 0
mov byte [esp + 0xf1], 0
mov byte [esp + 0xf2], 0
mov byte [esp + 0xf3], 0
mov byte [esp + 0xf4], 0
mov byte [esp + 0xf5], 0
mov byte [esp + 0xf6], 0
mov byte [esp + 0xf7], 0
mov byte [esp + 0xf8], 0
mov byte [esp + 0xf9], 0
mov byte [esp + 0xfa], 0
mov byte [esp + 0xfb], 0
mov byte [esp + 0xfc], 0
mov byte [esp + 0xfd], 0
mov byte [esp + 0xfe], 0
mov byte [esp + 0xff], 0
mov dword [esp + 0x1ac], 1
mov byte [esp + 0x1fc], 0
push 0x84
lea eax, [esp + 0x180]
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x50]
movaps xmm0, xmmword [esp + 0x110]
movsd xmm1, qword [esp + 0x2e8]
mov byte [esp + 0x360], al
mov eax, ebx
mov word [esp + 0x361], bx
shr eax, 0x10
mov byte [esp + 0x363], al
mov eax, dword [esp + 0x4c]
movlps qword [esp + 0x364], xmm0
movsd xmm0, qword [esp + 0x2e0]
mov dword [esp + 0x36c], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x370], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x374], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x378], eax
mov eax, dword [esp + 0xc0]
mov dword [esp + 0x37c], eax
mov eax, dword [esp + 0x2f0]
mov dword [esp + 0x380], esi
movsd qword [esp + 0x384], xmm0
movsd qword [esp + 0x38c], xmm1
mov dword [esp + 0x394], eax
lea eax, [esp + 0x398]
push 0x108
push edi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
movaps xmm1, xmmword [esp + 0xd0]
movaps xmm0, xmmword [esp + 0x90]
movaps xmm3, xmmword [esp + 0x260]
movaps xmm2, xmmword [esp + 0x280]
mov eax, dword [esp + 0x217]
mov edi, 0x4bc00
movaps xmmword [esp + 0x4a0], xmm1
movaps xmm1, xmmword [esp + 0x270]
movaps xmmword [esp + 0x4b0], xmm0
movaps xmmword [esp + 0x4e0], xmm2
movaps xmmword [esp + 0x4c0], xmm3
movaps xmm2, xmmword [esp + 0x2a0]
movaps xmmword [esp + 0x4d0], xmm1
movaps xmm1, xmmword [esp + 0x290]
movaps xmmword [esp + 0x4f0], xmm1
movaps xmm1, xmmword [esp + 0x2b0]
movaps xmmword [esp + 0x500], xmm2
movaps xmm2, xmmword [esp + 0x2d0]
movaps xmmword [esp + 0x510], xmm1
movaps xmm1, xmmword [esp + 0x2c0]
movaps xmmword [esp + 0x530], xmm2
movaps xmm2, xmmword [esp + 0x330]
movaps xmmword [esp + 0x520], xmm1
movsd xmm1, qword [esp + 0x33d]
movsd qword [esp + 0x57d], xmm1
movaps xmm1, xmmword [esp + 0x320]
movaps xmmword [esp + 0x570], xmm2
movaps xmm2, xmmword [esp + 0x300]
movaps xmmword [esp + 0x560], xmm1
movaps xmm1, xmmword [esp + 0x310]
movaps xmmword [esp + 0x540], xmm2
movsd xmm2, qword [esp + 0x200]
movaps xmmword [esp + 0x550], xmm1
movsd xmm1, qword [esp + 0x210]
mov dword [esp + 0x59c], eax
movsd qword [esp + 0x585], xmm2
movsd qword [esp + 0x595], xmm1
movsd xmm1, qword [esp + 0x208]
movsd qword [esp + 0x58d], xmm1
movzx eax, byte [0x456001]
movzx eax, byte [0x456001]
cmp al, 1
jne 0x40cfec
mov esi, dword [esp + 0x14]
lea ebx, [esp + 0x360]
jmp 0x40cfb1
mov ecx, ebx
mov edx, esi
call fcn.00423e30
add esi, 0x40
add edi, 0xffffffc0
je 0x40d011
cmp dword [esp + 0x580], 0
je 0x40cfa0
mov ecx, ebx
mov edx, esi
call fcn.00423800
lea edx, [esi + 0x10]
mov ecx, ebx
call fcn.00423800
lea edx, [esi + 0x20]
mov ecx, ebx
call fcn.00423800
lea edx, [esi + 0x30]
mov ecx, ebx
call fcn.00423800
add esi, 0x40
add edi, 0xffffffc0
jne 0x40cfb1
jmp 0x40d011
mov ebx, dword [esp + 0x14]
lea esi, [esp + 0x360]
nop word [eax + eax]
mov ecx, esi
mov edx, ebx
call fcn.00423ee0
add ebx, 0x10
add edi, 0xfffffff0
jne 0x40d000
movdqa xmm0, xmmword [0x4570f0]
lea ecx, [esp + 0x360]
lea edx, [esp + 0x860]
movdqu xmmword [esp + 0x860], xmm0
movzx eax, byte [0x456001]
cmp al, 1
jne 0x40d042
call fcn.00423800
jmp 0x40d047
call fcn.00423ee0
lea eax, [esp + 0x360]
push 0x240
push eax
lea eax, [esp + 0x868]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
movzx eax, byte [0x456001]
cmp al, 1
jne 0x40d124
lea ecx, [esp + 0x680]
lea edx, [esp + 0x860]
call fcn.00422bc0
movzx eax, byte [esp + 0x682]
movzx ebx, byte [esp + 0x680]
mov bh, byte [esp + 0x681]
mov esi, eax
movzx eax, byte [esp + 0x684]
mov ah, byte [esp + 0x685]
mov dword [esp + 0xc0], eax
movzx eax, byte [esp + 0x688]
mov ah, byte [esp + 0x689]
mov dword [esp + 0x90], eax
movzx eax, byte [esp + 0x683]
mov dword [esp + 0x110], eax
movzx eax, byte [esp + 0x686]
mov dword [esp + 0xb0], eax
movzx eax, byte [esp + 0x687]
mov dword [esp + 0x80], eax
movzx eax, byte [esp + 0x68a]
mov dword [esp + 0x60], eax
movzx eax, byte [esp + 0x68b]
mov dword [esp + 0xd0], eax
movzx eax, byte [esp + 0x68c]
mov dword [esp + 0x50], eax
jmp 0x40d2ed
mov eax, dword [esp + 0x888]
mov ecx, eax
and eax, 0x3ffffff
shr ecx, 0x1a
add ecx, dword [esp + 0x88c]
mov edx, ecx
mov dword [esp + 0x50], ecx
shr edx, 0x1a
add edx, dword [esp + 0x890]
mov edi, edx
mov ebx, edx
shr edi, 0x1a
and ebx, 0x3ffffff
add edi, dword [esp + 0x894]
mov dword [esp + 0x90], ebx
mov ecx, edi
mov dword [esp + 0xb0], edi
shr ecx, 0x1a
lea edx, [ecx + ecx*4]
mov ecx, dword [esp + 0x50]
add edx, dword [esp + 0x884]
and ecx, 0x3ffffff
mov esi, edx
and edx, 0x3ffffff
mov dword [esp + 0x50], ecx
shr esi, 0x1a
mov dword [esp + 0xd0], edx
add esi, eax
mov eax, edi
lea edi, [edx + 5]
mov dword [esp + 0x80], edi
shr edi, 0x1a
and eax, 0x3ffffff
add edi, esi
mov ebx, edi
shr ebx, 0x1a
add ebx, ecx
mov dword [esp + 0x60], ebx
shr ebx, 0x1a
add ebx, dword [esp + 0x90]
mov ecx, ebx
shr ecx, 0x1a
lea edx, [ecx + eax]
mov dword [esp + 0xc0], edx
lea edx, [ecx + eax - 0x4000000]
mov ecx, edx
shr edx, 0x1f
dec edx
sar ecx, 0x1f
mov eax, edx
and esi, ecx
and edx, dword [esp + 0xc0]
and eax, 0x3ffffff
and edi, eax
and dword [esp + 0x80], eax
and dword [esp + 0x60], eax
and eax, ebx
mov ebx, dword [esp + 0xd0]
or esi, edi
mov edi, dword [esp + 0x50]
and ebx, ecx
or ebx, dword [esp + 0x80]
and edi, ecx
or edi, dword [esp + 0x60]
mov dword [esp + 0xd0], ebx
mov ebx, dword [esp + 0x90]
and ebx, ecx
and ecx, dword [esp + 0xb0]
or ebx, eax
mov eax, ebx
mov ebx, esi
shr esi, 6
shl ebx, 0x1a
or ecx, edx
mov edx, edi
add ebx, dword [esp + 0xd0]
shr edi, 0xc
shl edx, 0x14
shl ecx, 8
or edx, esi
mov esi, eax
shl eax, 0xe
shr esi, 0x12
or eax, edi
or ecx, esi
add ebx, dword [esp + 0x860]
adc edx, dword [esp + 0x864]
mov dword [esp + 0x680], ebx
mov esi, ebx
adc eax, dword [esp + 0x868]
mov dword [esp + 0x684], edx
mov edi, edx
mov dword [esp + 0xc0], edx
adc ecx, dword [esp + 0x86c]
shr edx, 0x18
mov dword [esp + 0x688], eax
shr esi, 0x10
shr edi, 0x10
mov dword [esp + 0x90], eax
mov dword [esp + 0x80], edx
mov edx, eax
shr eax, 0x18
mov dword [esp + 0xb0], edi
shr edx, 0x10
mov dword [esp + 0xd0], eax
mov dword [esp + 0x60], edx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x68c], ecx
mov ecx, ebx
shr ecx, 0x18
mov dword [esp + 0x110], ecx
mov edi, dword [esp + 0x14]
xor ecx, ecx
cmp bl, byte [edi + 0x4bc00]
sete cl
call fcn.00421fa0
mov edx, ebx
xor ecx, ecx
mov ebx, eax
cmp dh, byte [edi + 0x4bc01]
sete cl
call fcn.00421fa0
mov bh, al
mov eax, esi
xor ecx, ecx
and bh, bl
cmp al, byte [edi + 0x4bc02]
sete cl
call fcn.00421fa0
mov bl, al
mov eax, dword [esp + 0x110]
xor ecx, ecx
and bl, bh
cmp al, byte [edi + 0x4bc03]
sete cl
call fcn.00421fa0
mov bh, al
mov eax, dword [esp + 0xc0]
xor ecx, ecx
and bh, bl
cmp al, byte [edi + 0x4bc04]
mov esi, eax
sete cl
call fcn.00421fa0
mov bl, al
mov eax, esi
xor ecx, ecx
and bl, bh
cmp ah, byte [edi + 0x4bc05]
sete cl
call fcn.00421fa0
mov bh, al
mov eax, dword [esp + 0xb0]
xor ecx, ecx
and bh, bl
cmp al, byte [edi + 0x4bc06]
sete cl
call fcn.00421fa0
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x80]
xor ecx, ecx
cmp al, byte [edi + 0x4bc07]
sete cl
call fcn.00421fa0
mov bl, al
mov eax, dword [esp + 0x90]
xor ecx, ecx
and bl, byte [esp + 0x14]
mov esi, eax
and bl, bh
cmp al, byte [edi + 0x4bc08]
sete cl
call fcn.00421fa0
mov bh, al
mov eax, esi
xor ecx, ecx
and bh, bl
cmp ah, byte [edi + 0x4bc09]
sete cl
call fcn.00421fa0
mov bl, al
mov eax, dword [esp + 0x60]
xor ecx, ecx
and bl, bh
cmp al, byte [edi + 0x4bc0a]
sete cl
call fcn.00421fa0
mov byte [esp + 0x14], al
mov eax, dword [esp + 0xd0]
xor ecx, ecx
cmp al, byte [edi + 0x4bc0b]
sete cl
call fcn.00421fa0
mov bh, al
mov eax, dword [esp + 0x50]
xor ecx, ecx
and bh, byte [esp + 0x14]
and bh, bl
cmp al, byte [edi + 0x4bc0c]
sete cl
call fcn.00421fa0
mov byte [esp + 0x14], al
movzx eax, byte [esp + 0x68d]
xor ecx, ecx
cmp al, byte [edi + 0x4bc0d]
sete cl
call fcn.00421fa0
mov bl, al
movzx eax, byte [esp + 0x68e]
xor ecx, ecx
and bl, bh
and bl, byte [esp + 0x14]
cmp al, byte [edi + 0x4bc0e]
sete cl
call fcn.00421fa0
mov bh, al
movzx eax, byte [esp + 0x68f]
xor ecx, ecx
cmp al, byte [edi + 0x4bc0f]
sete cl
call fcn.00421fa0
and al, bh
and al, bl
and al, 1
movzx ecx, al
call fcn.00421fa0
test al, al
je 0x40de07
lea ecx, [esp + 0x5a0]
mov edx, edi
push 0x4bc00
call fcn.00420c20
add esp, 4
lea ecx, [esp + 0x360]
call fcn.00421350
mov byte [esp + 0x4b], 0
mov byte [esp + 0x4a], 0
mov byte [esp + 0x49], 0
mov byte [esp + 0x48], 0
mov byte [esp + 0x47], 0
mov byte [esp + 0x46], 0
mov byte [esp + 0x45], 0
mov byte [esp + 0x44], 0
mov byte [esp + 0x43], 0
mov byte [esp + 0x42], 0
mov byte [esp + 0x41], 0
mov byte [esp + 0x40], 0
mov byte [esp + 0x3f], 0
mov byte [esp + 0x3e], 0
mov byte [esp + 0x3d], 0
mov byte [esp + 0x3c], 0
mov byte [esp + 0x3b], 0
mov byte [esp + 0x3a], 0
mov byte [esp + 0x39], 0
mov byte [esp + 0x38], 0
mov byte [esp + 0x37], 0
mov byte [esp + 0x36], 0
mov byte [esp + 0x35], 0
mov byte [esp + 0x34], 0
mov byte [esp + 0x33], 0
mov byte [esp + 0x32], 0
mov byte [esp + 0x31], 0
mov byte [esp + 0x30], 0
mov byte [esp + 0x2f], 0
mov byte [esp + 0x2e], 0
mov byte [esp + 0x2d], 0
mov byte [esp + 0x2c], 0
cmp dword [esp + 0x18], 0
je 0x40d57e
push dword [esp + 0x10c]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
movzx eax, byte [0x4af0d4]
xor ecx, ecx
mov edx, 0x4bc00
call fcn.0042bb70
test eax, eax
je 0x40dde8
mov esi, eax
push 0x4bc00
push edi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
push edi
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
lea eax, [0x497078]
mov dword [esp + 0x360], eax
lea eax, [esp + 0x360]
lea eax, [esp + 0x360]
mov ecx, dword [esp + 0x360]
mov dword [esp + 0x360], 0x26bb071e
mov edx, dword [esp + 0x360]
call fcn.00406790
mov ecx, 0x295edbfe
mov ebx, 0x41c27f28
mov edx, 0x614cc48a
xor ecx, dword [eax]
mov dword [esp + 0x14], ecx
mov ecx, 0xb60d3f2e
xor ecx, dword [eax + 4]
mov dword [esp + 0x50], ecx
mov ecx, 0x2cf60c9a
xor ecx, dword [eax + 8]
mov dword [esp + 0x18], esi
mov esi, 0xcac87f5b
mov dword [esp + 0xd0], ecx
mov ecx, 0xc262f4e4
xor ebx, dword [eax + 0xc]
xor esi, dword [eax + 0x10]
xor edx, dword [eax + 0x14]
xor ecx, dword [eax + 0x18]
movzx eax, word [eax + 0x1c]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x860], 0x457cc4
mov dword [esp + 0x864], 2
mov dword [esp + 0x870], 0
mov dword [esp + 0x360], edi
mov edi, dword [esp + 0x50]
xor al, 0xfb
xor ah, 0x69
mov dword [esp + 0x364], edi
mov edi, dword [esp + 0xd0]
mov dword [esp + 0x368], edi
mov dword [esp + 0x36c], ebx
mov dword [esp + 0x370], esi
mov dword [esp + 0x374], edx
mov dword [esp + 0x378], ecx
mov byte [esp + 0x37c], al
mov byte [esp + 0x37d], ah
lea eax, [esp + 0x17c]
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 0x860]
mov dword [esp + 0x868], eax
lea eax, [esp + 0x360]
mov dword [esp + 0x86c], 1
mov dword [esp + 0x680], eax
mov edi, eax
lea eax, [esp + 0x680]
mov dword [esp + 0x684], 0x1e
mov dword [esp + 0x17c], eax
mov dword [esp + 0x180], 0x429d20
call fcn.0042b7f0
cmp word [ebx], 0x5a4d
mov eax, 2
jne 0x40d7a0
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x40d7a0
cmp ecx, 0x40
jb 0x40dde8
cmp ecx, 0x4bc00
ja 0x40dde8
movzx edx, word [ebx + ecx + 0x18]
lea esi, [ebx + ecx]
cmp edx, 0x10b
je 0x40d786
cmp edx, 0x20b
jne 0x40d7a0
cmp dword [esi], 0x4550
jne 0x40d7a0
cmp word [esi + 4], 0x8664
jne 0x40d7a0
test byte [esi + 0x16], 2
je 0x40d7a0
add ecx, 0x108
mov edi, 1
cmp ecx, 0x4bc01
jb 0x40d94c
jmp 0x40dde8
cmp dword [esi], 0x4550
jne 0x40d7a0
cmp word [esi + 4], 0x14c
jne 0x40d7a0
test byte [esi + 0x16], 2
jne 0x40d938
mov dword [edi], eax
mov eax, dword [esp + 0x360]
cmp eax, 2
je 0x40ddd2
test al, 1
jne 0x40ddd2
test byte [esi + 0x17], 0x20
jne 0x40ddd2
cmp dword [esi + 0xec], 0
je 0x40d7da
cmp dword [esi + 0xe8], 0
jne 0x40ddd2
mov eax, dword [esi + 0x28]
test eax, eax
je 0x40ddd2
mov dword [esp + 0x4c], eax
mov eax, dword [esi + 0x34]
lea ecx, [esp + 0x120]
lea edx, [esp + 0x17c]
mov dword [esp + 0x120], eax
mov eax, dword [esi + 0x50]
mov dword [esp + 0x17c], eax
call fcn.00421fc0
cmp eax, 0xb
je 0x40d83c
lea ecx, [esp + 0x120]
lea edx, [esp + 0x17c]
mov dword [esp + 0x120], 0
call fcn.00421fc0
cmp eax, 0xb
jne 0x40ddce
cmp dword [esp + 0xc0], 0
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x50], esi
je 0x40d893
mov eax, dword [esp + 0xd0]
lea esi, [eax + 0x14]
mov eax, dword [esp + 0xc0]
lea eax, [eax*8]
lea edi, [eax + eax*4]
nop dword [eax]
mov ecx, dword [esp + 0x120]
mov eax, dword [esi]
add ecx, dword [esi - 8]
add eax, ebx
push dword [esi - 4]
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
add esi, 0x28
add edi, 0xffffffd8
jne 0x40d870
mov eax, dword [esp + 0x120]
mov esi, dword [esp + 0x50]
mov dword [esp + 0x14], eax
sub eax, dword [esi + 0x34]
je 0x40d9b4
mov ecx, dword [esi + 0xa0]
test ecx, ecx
je 0x40d9b4
cmp dword [esi + 0xa4], 0
je 0x40d9b4
add ecx, dword [esp + 0x14]
jmp 0x40d8dd
xor edx, edx
cmp dword [ecx], 0
je 0x40d9a9
add ecx, edx
mov edx, dword [ecx + 4]
test edx, edx
je 0x40d8d0
lea edi, [edx - 8]
cmp edi, 2
jl 0x40d8db
shr edi, 0x1f
lea edx, [edx + edi - 8]
xor edi, edi
sar edx, 1
jmp 0x40d905
inc edi
cmp edx, edi
je 0x40d92b
movzx esi, word [ecx + edi*2 + 8]
mov ebx, esi
and ebx, 0xf000
cmp ebx, 0x3000
jne 0x40d900
mov ebx, dword [ecx]
and esi, 0xfff
add ebx, dword [esp + 0x14]
add dword [esi + ebx], eax
jmp 0x40d900
mov edx, dword [ecx + 4]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x50]
jmp 0x40d8db
add ecx, 0xf8
xor edi, edi
cmp ecx, 0x4bc00
ja 0x40dde8
mov edx, esi
movzx esi, word [esi + 6]
mov eax, 0x4bc00
sub eax, ecx
mov dword [esp + 0xc0], esi
lea esi, [esi*8]
lea esi, [esi + esi*4]
cmp esi, eax
mov eax, 0x4bc00
ja 0x40dde8
mov esi, ebx
mov dword [esp + 0x360], edi
lea edi, [esp + 0x860]
add esi, ecx
mov dword [esp + 0xd0], esi
mov esi, edx
mov dword [edi], eax
mov eax, dword [esp + 0x360]
cmp eax, 2
jne 0x40d7b2
jmp 0x40ddd2
mov eax, dword [esp + 0x120]
mov dword [esp + 0x14], eax
cmp dword [esi + 0x84], 0
je 0x40dbc6
mov ecx, dword [esi + 0x80]
test ecx, ecx
je 0x40dbc6
mov eax, dword [esp + 0x14]
lea esi, [esp + 0x360]
add ecx, eax
add eax, 2
mov dword [esp + 0x60], eax
jmp 0x40d9f3
mov ecx, dword [esp + 0x110]
mov ebx, dword [esp + 0x18]
add ecx, 0x14
mov edi, dword [ecx + 0xc]
test edi, edi
jne 0x40da15
cmp dword [ecx + 0x10], 0
jne 0x40da15
cmp dword [ecx], 0
jne 0x40da15
cmp dword [ecx + 4], 0
jne 0x40da15
cmp dword [ecx + 8], 0
je 0x40dbc6
add edi, dword [esp + 0x14]
mov dword [esp + 0x110], ecx
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ecx, esi
mov edx, edi
push eax
call fcn.0041c520
add esp, 4
test byte [esp + 0x360], 1
jne 0x40ddce
mov edx, dword [esp + 0x364]
mov ecx, esi
push dword [esp + 0x368]
call fcn.0040e1c0
add esp, 4
mov eax, dword [esp + 0x360]
neg eax
jno 0x40ddb8
mov edi, dword [esp + 0x364]
mov esi, dword [esp + 0x368]
push edi
call sub.kernel32.dll_LoadLibraryA
test esi, esi
mov dword [esp + 0x90], eax
mov byte [edi], 0
je 0x40da9b
push edi
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
cmp dword [esp + 0x90], 0
lea esi, [esp + 0x360]
je 0x40ddce
mov ecx, dword [esp + 0x110]
mov eax, dword [ecx]
mov edx, dword [ecx + 0x10]
mov ecx, dword [esp + 0x14]
add edx, ecx
add ecx, eax
test eax, eax
cmove ecx, edx
mov dword [esp + 0x80], edx
mov edi, dword [ecx]
mov dword [esp + 0xb0], ecx
test edi, edi
je 0x40d9e5
xor ebx, ebx
jmp 0x40db1d
movzx eax, di
push eax
push dword [esp + 0x94]
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x40ddce
mov ecx, dword [esp + 0x80]
mov dword [ecx + ebx], eax
mov ecx, dword [esp + 0xb0]
mov edi, dword [ecx + ebx + 4]
add ebx, 4
test edi, edi
je 0x40d9e5
test edi, edi
js 0x40dae5
mov eax, dword [esp + 0x60]
cmp byte [eax + edi], 0
je 0x40d9e5
add edi, dword [esp + 0x60]
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ecx, esi
mov edx, edi
push eax
call fcn.0041c520
add esp, 4
test byte [esp + 0x360], 1
jne 0x40ddce
mov edx, dword [esp + 0x364]
mov ecx, esi
push dword [esp + 0x368]
call fcn.0040e1c0
add esp, 4
mov eax, dword [esp + 0x360]
neg eax
jno 0x40ddb8
mov edi, dword [esp + 0x364]
mov esi, dword [esp + 0x368]
push edi
push dword [esp + 0x94]
call sub.kernel32.dll_GetProcAddress
test esi, esi
mov byte [edi], 0
je 0x40dbb2
push edi
push 0
push dword [0x4af0c0]
mov edi, eax
call sub.kernel32.dll_HeapFree
mov eax, edi
test eax, eax
lea esi, [esp + 0x360]
jne 0x40dafd
jmp 0x40ddce
mov eax, dword [esp + 0xc0]
mov ecx, dword [esp + 0xd0]
test eax, eax
je 0x40dd6e
shl eax, 3
add ecx, 0xc
lea esi, [eax + eax*4]
jmp 0x40dbf3
add ecx, 0x28
add esi, 0xffffffd8
je 0x40dd6e
mov eax, dword [ecx + 4]
test eax, eax
mov dword [esp + 0x680], eax
je 0x40dbe7
mov eax, dword [esp + 0x120]
mov dword [esp + 0xd0], ecx
add eax, dword [ecx]
mov dword [esp + 0x860], eax
mov eax, dword [ecx + 0x18]
test eax, 0x20000000
jne 0x40dc37
mov ebx, 1
test eax, 0x40000000
je 0x40dc4e
shr eax, 0x1f
lea ebx, [eax + eax + 2]
jmp 0x40dc4e
mov ebx, 0x10
test eax, 0x40000000
je 0x40dc4e
shr eax, 0x1a
and eax, 0xffffffe0
add eax, 0x20
mov ebx, eax
mov edi, dword [0x4af044]
test edi, edi
jne 0x40dd2e
lea ecx, [esp + 0x360]
mov edx, 0x4a7d18
push 9
call fcn.0040e1c0
add esp, 4
mov eax, dword [esp + 0x360]
neg eax
jno 0x40ddb8
mov dword [esp + 0x90], ebx
mov ebx, dword [esp + 0x364]
mov edi, dword [esp + 0x368]
push ebx
call sub.kernel32.dll_LoadLibraryA
test edi, edi
mov dword [esp + 0x14], eax
mov byte [ebx], 0
je 0x40dcb5
push ebx
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov edi, dword [esp + 0x14]
test edi, edi
je 0x40ddce
lea ecx, [esp + 0x360]
mov edx, 0x4a7d38
push 0x16
call fcn.0040e1c0
add esp, 4
mov eax, dword [esp + 0x360]
neg eax
jno 0x40ddb8
mov ebx, dword [esp + 0x364]
mov eax, dword [esp + 0x368]
mov dword [esp + 0x60], eax
push ebx
push edi
call sub.kernel32.dll_GetProcAddress
cmp dword [esp + 0x60], 0
mov edi, eax
mov byte [ebx], 0
je 0x40dd19
push ebx
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
test edi, edi
je 0x40ddce
mov ebx, dword [esp + 0x90]
mov dword [0x4af044], edi
mov dword [esp + 0x360], 0
call sub.kernel32.dll_GetCurrentProcess
lea ecx, [esp + 0x360]
push ecx
push ebx
lea ecx, [esp + 0x688]
push ecx
lea ecx, [esp + 0x86c]
push ecx
push eax
call edi
test eax, eax
jne 0x40ddce
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0xd0]
jmp 0x40dbe7
mov eax, dword [esp + 0x50]
mov esi, dword [esp + 0x120]
cmp dword [eax + 0xc4], 0
je 0x40ddb0
mov eax, dword [eax + 0xc0]
test eax, eax
je 0x40ddb0
mov edi, dword [esi + eax + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x40ddb0
add edi, 4
push 0
push 2
push esi
call eax
mov eax, dword [edi]
add edi, 4
test eax, eax
jne 0x40dd99
mov esi, dword [esp + 0x120]
add esi, dword [esp + 0x4c]
call esi
jmp 0x40ddd2
jae 0x40ddce
push dword [esp + 0x364]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov ebx, dword [esp + 0x18]
push ebx
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
call fcn.0042bb10
call sub.kernel32.dll_GetLastError
ud2
cmp dword [esp + 0x18], 0
je 0x40dedc
push esi
jmp 0x40decf
lea ecx, [esp + 0x360]
call fcn.00421350
push edi
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov byte [esp + 0x4b], 0
mov byte [esp + 0x4a], 0
mov byte [esp + 0x49], 0
mov byte [esp + 0x48], 0
mov byte [esp + 0x47], 0
mov byte [esp + 0x46], 0
mov byte [esp + 0x45], 0
mov byte [esp + 0x44], 0
mov byte [esp + 0x43], 0
mov byte [esp + 0x42], 0
mov byte [esp + 0x41], 0
mov byte [esp + 0x40], 0
mov byte [esp + 0x3f], 0
mov byte [esp + 0x3e], 0
mov byte [esp + 0x3d], 0
mov byte [esp + 0x3c], 0
mov byte [esp + 0x3b], 0
mov byte [esp + 0x3a], 0
mov byte [esp + 0x39], 0
mov byte [esp + 0x38], 0
mov byte [esp + 0x37], 0
mov byte [esp + 0x36], 0
mov byte [esp + 0x35], 0
mov byte [esp + 0x34], 0
mov byte [esp + 0x33], 0
mov byte [esp + 0x32], 0
mov byte [esp + 0x31], 0
mov byte [esp + 0x30], 0
mov byte [esp + 0x2f], 0
mov byte [esp + 0x2e], 0
mov byte [esp + 0x2d], 0
mov byte [esp + 0x2c], 0
cmp dword [esp + 0x18], 0
je 0x40dedc
push dword [esp + 0x10c]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
lea eax, [0x4965dd]
mov dword [esp + 0x360], eax
lea eax, [esp + 0x360]
lea eax, [esp + 0x360]
mov ecx, dword [esp + 0x360]
mov dword [esp + 0x360], 0xccb2c01d
mov edx, dword [esp + 0x360]
call fcn.00406b20
mov ecx, dword [eax]
mov ecx, dword [eax + 4]
mov ecx, dword [eax + 8]
mov ecx, dword [eax + 0xc]
mov ecx, dword [eax + 0x10]
mov ecx, dword [eax + 0x14]
mov ecx, dword [eax + 0x18]
mov ecx, dword [eax + 0x1c]
movzx ecx, byte [eax + 0x22]
movzx eax, word [eax + 0x20]
ud2