Function at 0xbad4e5
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xebc
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xc9c]
xor ebx, ebx
push eax
push 0xb2ae20
inc ebx
push 0xb2afd4
mov dword [ebp - 0xc9c], ebx
call dword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_0.dll_PolicyManager_GetPolicyInt]
test eax, eax
js 0xc01e60
cmp dword [ebp - 0xc9c], 0
je 0xc01e78
xor edx, edx
mov esi, 0xd0aed4
mov dword [ebp - 0xc00], edx
mov dword [ebp - 0xc64], edx
mov dword [ebp - 0xd70], edx
mov dword [ebp - 0xc38], edx
mov dword [ebp - 0xac0], edx
mov ecx, ebx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xbad557
mov eax, dword [0xd0a150]
or ebx, 0xffffffff
mov dword [ebp - 0xc04], ebx
mov dword [ebp - 0xb6c], 0xb2bef2
mov dword [ebp - 0xbd8], 0x67
mov dword [ebp - 0xbd4], 0x337
mov dword [ebp - 0xbc4], 0x10b
mov dword [ebp - 0xbc8], 0x20b
test eax, eax
jne 0xbadb4d
push 0x338
mov esi, edx
mov dword [ebp - 0xaec], edx
push edx
mov dword [ebp - 0xa9c], edx
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0xae4], edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xac4], eax
test eax, eax
je 0xc01eee
xor edx, edx
mov dword [ebp - 0x3f8], 0xab69605e
mov edi, edx
mov dword [ebp - 0x3f4], 0x7f1137f
add eax, 7
mov dword [ebp - 0xb00], edx
mov cl, dl
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xb50], edx
mov esi, 0xb2bef2
mov dword [ebp - 0xb78], edi
mov dword [ebp - 0xaa4], eax
mov dword [ebp - 0xad4], 0x67
movzx edx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx ebx, byte [esi + 2]
shl edx, 8
or edx, eax
shl ebx, 8
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
or ebx, eax
mov dword [ebp - 0xb80], edx
movzx eax, byte [esi + 4]
xor edi, edx
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 5]
add esi, 8
shl ebx, 8
or ebx, eax
mov dword [ebp - 0xad8], esi
mov esi, ebx
xor esi, dword [ebp - 0xb50]
xor esi, edi
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor edi, edx
lea eax, [edi + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, edi
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor edi, edx
mov eax, edi
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor edi, edx
lea eax, [edi + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, edi
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edi, eax
mov dword [ebp - 0xab8], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xab8]
xor edi, 0xab69605e
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, edi
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xab8], esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
mov eax, esi
xor edi, edx
xor eax, edi
xor eax, 0xac987321
mov dword [ebp - 0xab8], eax
ror eax, 3
sub eax, 0xab69
mov esi, dword [ebp - 0xab8]
imul eax, eax, 0x137f
xor edi, eax
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, edi
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
xor edi, edx
lea eax, [edi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, edi
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xab8], esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, edi
xor edi, dword [ebp - 0xba4]
rol eax, 2
mov dword [ebp - 0xb50], edi
mov dword [ebp - 0xba4], ebx
xor edx, eax
mov eax, esi
xor edx, dword [ebp - 0xb00]
xor eax, edx
mov esi, dword [ebp - 0xad8]
mov edx, dword [ebp - 0xaa4]
mov dword [ebp - 0xb78], eax
mov byte [edx - 4], al
mov al, byte [ebp - 0xb50]
ror dword [ebp - 0xb78], 8
mov byte [edx], al
mov al, byte [ebp - 0xb78]
ror dword [ebp - 0xb50], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb50]
ror dword [ebp - 0xb78], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb78]
ror dword [ebp - 0xb50], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb50]
ror dword [ebp - 0xb78], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xb78]
ror dword [ebp - 0xb50], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb50]
mov byte [edx - 3], al
add edx, 8
mov eax, dword [ebp - 0xb78]
ror dword [ebp - 0xb50], 8
ror eax, 8
sub dword [ebp - 0xad4], 1
mov dword [ebp - 0xab8], eax
mov edi, dword [ebp - 0xab8]
mov dword [ebp - 0xb78], eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xb00], eax
mov dword [ebp - 0xaa4], edx
jne 0xbad630
mov esi, dword [ebp - 0xac4]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xbad98a
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xc01e7f
cmp edx, dword [0xb2c22c]
jne 0xc01e7f
mov edi, esi
xor eax, eax
mov dword [ebp - 0xab0], edi
mov esi, eax
mov ebx, 0x337
test esi, esi
jne 0xc01e99
cmp dword [ebp - 0xae4], 0
jl 0xc01ee8
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xd0ae80
push eax
push ebx
call fcn.00bc259b
add esp, 0xc
cmp byte [edi], 0
je 0xbadb1f
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xc00]
jne 0xbada01
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc01ede
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa9c], edx
cmp word [eax], cx
jne 0xc01ead
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xc01ead
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xc01ead
cmp dword [ecx], 0x4550
jne 0xc01ead
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xbc4]
jne 0xc01ec4
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xac4], eax
test eax, eax
je 0xbadb13
mov ecx, esi
mov dword [ebp - 0xad8], esi
xor eax, eax
mov dword [ebp - 0xc98], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xb80], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xbadab7
sub ecx, dword [ebp - 0xb80]
inc esi
add esi, ecx
test edx, edx
js 0xc01ed3
mov ecx, dword [ebp - 0xad8]
lea eax, [ebp - 0xc98]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa9c], edx
test edx, edx
js 0xbadb1f
mov eax, dword [ebp - 0xaec]
mov ecx, dword [ebp - 0xc98]
mov dword [eax*4 + section..data], ecx
inc eax
inc ebx
mov dword [ebp - 0xaec], eax
cmp ebx, dword [ebp - 0xac4]
jb 0xbada9e
add edi, 0x10
cmp byte [esi], 0
jne 0xbad9fa
mov ebx, dword [ebp - 0xa9c]
mov esi, dword [ebp - 0xab0]
test esi, esi
je 0xbadb40
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc01ef8
mov eax, dword [0xd0a150]
inc eax
xor ebx, ebx
mov dword [0xd0a150], eax
xor eax, eax
mov ecx, 0xd0aed4
xchg dword [ecx], eax
mov eax, ebx
mov dword [ebp - 0xaec], ebx
mov dword [ebp - 0xa9c], eax
mov edi, ebx
mov eax, dword fs:[0x30]
mov dword [ebp - 0xab0], ebx
cmp dword [eax + 0x1d4], ebx
je 0xc02030
mov esi, dword [0xd08088]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, eax
mov dword [ebp - 0xb80], ecx
test ecx, ecx
je 0xc01f39
mov eax, ebx
mov esi, ebx
mov dword [ebp - 0xa9c], eax
mov ebx, dword [0xd08098]
lea edx, [ebp - 0xc94]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xd0cffc]
call ebx
test eax, eax
je 0xbb07f4
mov ebx, dword [ebp - 0xa9c]
xor eax, eax
mov dword [ebp - 0xaec], esi
mov esi, eax
test esi, esi
jne 0xc01f79
test ebx, ebx
js 0xbadd4a
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov esi, dword [0xd08094]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov ecx, eax
mov dword [ebp - 0xb80], ecx
test ecx, ecx
je 0xc01f8d
xor edx, edx
mov eax, edx
mov esi, edx
mov dword [ebp - 0xa9c], eax
mov ebx, dword [0xd08098]
lea edx, [ebp - 0xc90]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xd0cffc]
call ebx
test eax, eax
je 0xbb083c
mov ebx, dword [ebp - 0xa9c]
xor eax, eax
mov edi, esi
mov esi, eax
test esi, esi
jne 0xc01ff5
test ebx, ebx
js 0xbadd2f
mov eax, dword [ebp - 0xaec]
test eax, eax
je 0xc02030
push 4
mov ecx, 0xb2be5c
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xbb0410
test dx, dx
je 0xbadca5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xbb0410
add eax, esi
add ecx, esi
test dx, dx
jne 0xbadc7d
xor ebx, ebx
xor eax, eax
inc ebx
test eax, eax
jne 0xc02030
test edi, edi
je 0xc02030
mov ecx, 0xb2be6c
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xbb041c
test dx, dx
je 0xbadce9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xbb041c
add eax, esi
add ecx, esi
test dx, dx
jne 0xbadcc1
xor ecx, ecx
mov eax, ecx
test eax, eax
jne 0xc02030
push esi
lea eax, [ebp - 0xc8c]
mov dword [ebp - 0xc8c], ecx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
je 0xc02009
test byte [ebp - 0xc8c], 0xf
mov eax, ebx
jne 0xc02030
mov dword [ebp - 0xac0], eax
mov ebx, dword [ebp - 0xa9c]
test edi, edi
je 0xbadd4a
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xaec]
test eax, eax
je 0xbadd65
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc0203b
xor ebx, ebx
push 4
pop eax
push eax
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov dword [ebp - 0xb80], eax
test eax, eax
je 0xc02048
mov dword [ebp - 0xb00], eax
lea edi, [ebp - 0xc10]
xor eax, eax
mov dword [ebp - 0xaa0], ebx
stosd dword es:[edi], eax
mov esi, ebx
mov dword [ebp - 0xce0], ebx
mov dword [ebp - 0xcdc], ebx
mov dword [ebp - 0xab4], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xad0], ebx
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xba4], 0x38
mov dword [ebp - 0xad8], ebx
test ebx, ebx
je 0xc0206c
push edi
push 0xd08d58
push ebx
call fcn.00bc13d0
mov esi, ebx
add esp, 0xc
mov dword [ebp - 0xa98], esi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xac4], ecx
test ecx, ecx
je 0xc0206c
mov eax, dword [0xd08d50]
mov edi, ecx
mov dword [ecx], eax
mov eax, dword [0xd08d54]
mov dword [ecx + 4], eax
mov dword [ebp - 0xaa0], edi
rdtsc
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xaa4], edx
xor eax, eax
mov dword [ebp - 0xb0c], eax
lea eax, [ebp - 0xd20]
push eax
push 4
pop ecx
mov edx, ecx
call fcn.00b84e9a
mov esi, dword [ebp - 0xd20]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02082
lea eax, [ebp - 0xb0c]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xc020af
lea eax, [ebp - 0xd1c]
mov edx, 0xa0
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc020af
mov esi, dword [ebp - 0xd1c]
mov ecx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xb0c]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xc020af
lea eax, [ebp - 0xd18]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc020af
mov esi, dword [ebp - 0xd18]
mov ecx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xb0c]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xc020af
lea eax, [ebp - 0xcf4]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc020af
mov esi, dword [ebp - 0xcf4]
mov ecx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xb0c]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xc020af
lea eax, [ebp - 0xc88]
mov edx, SysReAllocString
push eax
mov ecx, 0xb2c230
call fcn.00b84ebc
test eax, eax
js 0xc0208a
mov edx, dword [ebp - 0xc88]
lea eax, [ebp - 0xd98]
push eax
inc edx
push 4
pop eax
mov dword [ebp - 0xc88], edx
mov ecx, eax
add edx, edx
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc020af
mov esi, dword [ebp - 0xd98]
mov ecx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xb0c]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xc020af
lea eax, [ebp - 0xd94]
push eax
push 4
pop ecx
mov edx, ecx
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc020af
mov esi, dword [ebp - 0xd94]
mov ecx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xb0c]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xc020af
lea eax, [ebp - 0xd90]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc020af
mov esi, dword [ebp - 0xd90]
mov ecx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xb0c]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xc020af
mov esi, dword [ebp - 0xb0c]
push esi
push 8
mov dword [ebp - 0xce0], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xae0], edi
test edi, edi
je 0xc02097
mov dword [ebp - 0xcdc], edi
xor eax, eax
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0xe34], eax
mov dword [ebp - 0xc20], edi
push 4
pop ecx
lea eax, [ebp - 0xdc0]
mov dword [ebp - 0xdc4], ecx
mov edx, ecx
mov ecx, edi
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc020c1
lea ecx, [edi + esi]
lea eax, [edi + 8]
cmp eax, ecx
ja 0xc020ba
push 4
pop eax
mov dword [edi], eax
xor ecx, ecx
mov eax, dword [ebp - 0xdc0]
mov dword [eax], ecx
xor eax, eax
inc eax
mov dword [ebp - 0xaa8], eax
test ebx, ebx
js 0xc020a9
mov esi, edi
mov edi, ecx
mov dword [ebp - 0xc54], esi
test eax, eax
je 0xbae1be
mov edx, dword [esi]
lea eax, [ebp - 0xd8c]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc020ce
mov eax, dword [ebp - 0xd8c]
mov dword [ebp - 0xd88], eax
test ebx, ebx
js 0xc020d9
lea ecx, [ebp - 0xc54]
mov edx, eax
push ecx
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc020d9
mov esi, dword [ebp - 0xc54]
inc edi
cmp edi, dword [ebp - 0xaa8]
jb 0xbae158
lea eax, [ebp - 0xdd0]
mov dword [ebp - 0xdd4], 0xa0
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov edi, dword [ebp - 0xae0]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc020df
mov ecx, dword [ebp - 0xb0c]
lea eax, [esi + 0xa4]
add ecx, edi
cmp eax, ecx
ja 0xc020ba
mov eax, 0xa0
push eax
push dword [ebp - 0xad8]
mov dword [esi], eax
push dword [ebp - 0xdd0]
call fcn.00bc13d0
mov eax, dword [ebp - 0xaa8]
add esp, 0xc
inc eax
mov dword [ebp - 0xaa8], eax
test ebx, ebx
js 0xc020a9
mov esi, edi
xor ecx, ecx
mov dword [ebp - 0xc58], esi
mov edi, ecx
test eax, eax
je 0xbae2ae
mov edx, dword [esi]
lea eax, [ebp - 0xd7c]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc020ea
mov eax, dword [ebp - 0xd7c]
mov dword [ebp - 0xd78], eax
test ebx, ebx
js 0xc020f5
lea ecx, [ebp - 0xc58]
mov edx, eax
push ecx
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc020f5
mov esi, dword [ebp - 0xc58]
inc edi
cmp edi, dword [ebp - 0xaa8]
jb 0xbae248
lea eax, [ebp - 0xdd8]
mov dword [ebp - 0xddc], 8
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov edi, dword [ebp - 0xae0]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc020fb
mov ecx, dword [ebp - 0xb0c]
lea eax, [esi + 0xc]
add ecx, edi
cmp eax, ecx
ja 0xc020ba
mov edx, dword [ebp - 0xac4]
mov ecx, dword [ebp - 0xdd8]
mov dword [esi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xaa8]
inc eax
mov dword [ebp - 0xaa8], eax
test ebx, ebx
js 0xc020a9
mov ecx, dword [ebp - 0xad4]
mov esi, edi
mov dword [ebp - 0xe58], ecx
mov ecx, dword [ebp - 0xaa4]
mov dword [ebp - 0xe54], ecx
xor ecx, ecx
mov edi, ecx
test eax, eax
je 0xbae3b3
mov edx, dword [esi]
lea eax, [ebp - 0xd2c]
push eax
push 4
pop eax
mov ecx, eax
mov dword [ebp - 0xad8], esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02106
mov eax, dword [ebp - 0xd2c]
mov dword [ebp - 0xd24], eax
test ebx, ebx
js 0xc020a9
add eax, esi
mov ecx, esi
cmp eax, esi
jb 0xc02111
mov esi, eax
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, dword [ebp - 0xad8]
jb 0xbae415
inc edi
cmp edi, dword [ebp - 0xaa8]
jb 0xbae347
push 8
pop edi
lea eax, [ebp - 0xdb8]
mov dword [ebp - 0xdbc], edi
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc020a9
mov ecx, dword [ebp - 0xae0]
lea eax, [esi + 0xc]
add ecx, dword [ebp - 0xb0c]
cmp eax, ecx
ja 0xc020ba
mov eax, dword [ebp - 0xdb8]
mov ecx, dword [ebp - 0xad4]
inc dword [ebp - 0xaa8]
mov dword [esi], edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xaa4]
mov dword [eax + 4], ecx
test ebx, ebx
js 0xc020a9
lea eax, [ebp - 0xc5c]
mov edx, SysReAllocString
push eax
mov ecx, 0xb2c230
call fcn.00b84ebc
test eax, eax
js 0xc02119
mov ecx, dword [ebp - 0xc5c]
lea eax, [ebp - 0xc5c]
xor edx, edx
push eax
inc edx
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc020a9
mov eax, dword [ebp - 0xc5c]
lea edi, [eax + eax]
test edi, edi
je 0xc0213a
mov esi, dword [ebp - 0xae0]
xor eax, eax
mov dword [ebp - 0xae4], eax
cmp dword [ebp - 0xaa8], eax
jbe 0xbae4ff
mov edx, dword [esi]
lea eax, [ebp - 0xd6c]
push eax
push 4
pop eax
mov ecx, eax
mov dword [ebp - 0xad8], esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02120
mov eax, dword [ebp - 0xd6c]
mov dword [ebp - 0xd74], eax
test ebx, ebx
js 0xc020a9
add eax, esi
mov ecx, esi
cmp eax, esi
jb 0xc0212b
mov esi, eax
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, dword [ebp - 0xad8]
jb 0xbae55d
mov eax, dword [ebp - 0xae4]
inc eax
mov dword [ebp - 0xae4], eax
cmp eax, dword [ebp - 0xaa8]
jb 0xbae487
lea eax, [ebp - 0xde0]
mov dword [ebp - 0xde4], edi
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc020a9
mov ecx, dword [ebp - 0xae0]
lea eax, [edi + 4]
add ecx, dword [ebp - 0xb0c]
add eax, esi
cmp eax, ecx
ja 0xc02133
push edi
push 0xb2c230
push dword [ebp - 0xde0]
mov dword [esi], edi
call fcn.00bc13d0
add esp, 0xc
inc dword [ebp - 0xaa8]
test ebx, ebx
js 0xc020a9
mov edi, dword [ebp - 0xac0]
xor eax, eax
mov edx, eax
mov esi, dword [ebp - 0xae0]
mov dword [ebp - 0xe3c], edi
cmp dword [ebp - 0xaa8], eax
jbe 0xbae5fd
mov edi, dword [ebp - 0xe50]
mov eax, dword [esi]
push 4
add eax, 4
mov dword [ebp - 0xad8], esi
pop ebx
cmp eax, ebx
jb 0xc0214a
mov ecx, eax
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, 4
jb 0xbae5b8
mov edi, ecx
push 4
pop ecx
cmp eax, ecx
jb 0xc0216e
lea eax, [esi + edi]
mov ecx, esi
cmp eax, esi
jb 0xc02152
mov esi, eax
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, dword [ebp - 0xad8]
jb 0xc0215a
inc edx
cmp edx, dword [ebp - 0xaa8]
jb 0xbae589
mov edi, dword [ebp - 0xac0]
push 4
pop ecx
lea eax, [ebp - 0xde8]
mov dword [ebp - 0xdec], ecx
mov edx, ecx
mov ecx, esi
push eax
call fcn.00b84e9a
mov edx, dword [ebp - 0xae0]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02160
mov ecx, dword [ebp - 0xb0c]
lea eax, [esi + 8]
add ecx, edx
cmp eax, ecx
ja 0xc020ba
mov eax, dword [ebp - 0xde8]
push 4
pop ecx
mov dword [esi], ecx
mov dword [eax], edi
mov eax, dword [ebp - 0xaa8]
inc eax
mov dword [ebp - 0xaa8], eax
test ebx, ebx
js 0xc020a9
mov dword [ebp - 0xe5c], ecx
mov esi, edx
xor ecx, ecx
mov edx, ecx
test eax, eax
je 0xbae6e5
mov edi, dword [ebp - 0xe60]
mov eax, dword [esi]
push 4
add eax, 4
mov dword [ebp - 0xad8], esi
pop ebx
cmp eax, ebx
jb 0xc02176
mov ecx, eax
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, 4
jb 0xbae6a6
mov edi, ecx
push 4
pop ecx
cmp eax, ecx
jb 0xbae738
lea eax, [esi + edi]
mov ecx, esi
cmp eax, esi
jb 0xc0217e
mov esi, eax
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, dword [ebp - 0xad8]
jb 0xc02186
inc edx
cmp edx, dword [ebp - 0xaa8]
jb 0xbae677
push 4
pop ecx
lea eax, [ebp - 0xdc8]
mov dword [ebp - 0xdcc], ecx
mov edx, ecx
mov ecx, esi
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02186
mov ecx, dword [ebp - 0xae0]
lea eax, [esi + 8]
add ecx, dword [ebp - 0xb0c]
cmp eax, ecx
ja 0xc020ba
mov eax, dword [ebp - 0xdc8]
inc dword [ebp - 0xaa8]
push 4
pop ecx
mov dword [esi], ecx
mov dword [eax], ecx
test ebx, ebx
js 0xc020a9
lea eax, [ebp - 0xcf8]
mov edx, ecx
push eax
call fcn.00b84e9a
mov esi, dword [ebp - 0xcf8]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0218e
lea eax, [ebp - 0xcfc]
mov edi, esi
push eax
push 8
pop edx
mov dword [ebp - 0xbb0], edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02194
mov esi, dword [ebp - 0xcfc]
lea eax, [ebp - 0xbb0]
mov edx, esi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02194
lea eax, [ebp - 0xd00]
push eax
push 4
pop edi
mov edx, edi
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02194
mov esi, dword [ebp - 0xd00]
mov ecx, dword [ebp - 0xbb0]
lea eax, [ebp - 0xbb0]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02194
lea eax, [ebp - 0xd04]
mov edx, edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02194
mov esi, dword [ebp - 0xd04]
mov ecx, dword [ebp - 0xbb0]
lea eax, [ebp - 0xbb0]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02194
lea eax, [ebp - 0xd08]
mov edx, edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02194
mov esi, dword [ebp - 0xd08]
mov ecx, dword [ebp - 0xbb0]
lea eax, [ebp - 0xbb0]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02194
lea eax, [ebp - 0xc48]
mov edx, edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02194
mov esi, dword [ebp - 0xc48]
mov ecx, dword [ebp - 0xbb0]
lea eax, [ebp - 0xbb0]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02194
mov dword [ebp - 0xabc], eax
test ebx, ebx
js 0xc020a9
xor ecx, ecx
rdtsc
mov esi, ecx
mov dword [ebp - 0xb08], ecx
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0xac8], ecx
mov dword [ebp - 0xa9c], ecx
mov dword [ebp - 0xaac], ecx
mov dword [ebp - 0xb10], ecx
mov dword [ebp - 0xab8], ecx
mov dword [ebp - 0xae4], ecx
mov dword [ebp - 0xae8], ecx
mov dword [ebp - 0xb4c], ecx
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xac4], edx
push 8
pop ecx
mov dword [ebp - 0xc60], ecx
mov edx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xc60]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbaea36
mov eax, dword [ebp - 0xc60]
lea edi, [eax + 7]
and edi, 0xfffffff8
cmp edi, eax
jb 0xc0219f
mov dword [ebp - 0xc60], edi
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc021a9
mov eax, dword [ebp - 0xaa8]
mov ecx, esi
mov dword [esi], eax
lea eax, [ebp - 0xc40]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xc40], esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc021b3
mov ecx, dword [ebp - 0xc40]
mov eax, dword [ebp - 0xb0c]
mov dword [ecx], eax
lea eax, [ebp - 0xc40]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc021b3
push dword [ebp - 0xb0c]
mov eax, dword [ebp - 0xad8]
push dword [ebp - 0xae0]
mov dword [esi + edi - 8], eax
mov eax, dword [ebp - 0xac4]
push dword [ebp - 0xc40]
mov dword [esi + edi - 4], eax
call fcn.00bc13d0
add esp, 0xc
mov dword [ebp - 0xb08], esi
xor eax, eax
mov dword [ebp - 0xab0], edi
mov esi, eax
test esi, esi
jne 0xc021ba
mov esi, dword [ebp - 0xab0]
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xbb0000
mov ebx, dword [ebp - 0xb08]
xor ecx, ecx
mov edi, ecx
mov dword [ebp - 0xacc], edi
test ebx, ebx
je 0xc021ce
test esi, esi
je 0xc02392
lea eax, [esi + 8]
push eax
push ecx
mov dword [ebp - 0xad8], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xadc], eax
test eax, eax
je 0xc02392
xor ecx, ecx
mov dl, cl
test esi, esi
je 0xbaea9e
xor dl, byte [ecx + ebx]
inc ecx
cmp ecx, esi
jb 0xbaea96
mov dword [ebp - 0xaec], eax
xor eax, eax
mov dword [ebp - 0xaf0], ebx
mov ecx, eax
or ebx, 0xffffffff
mov dword [ebp - 0x3f0], 0xb1b54a58
mov dword [ebp - 0x3ec], 0xc81ecb17
mov dword [ebp - 0xb44], ecx
mov dword [ebp - 0xb38], ebx
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0xb14], eax
test eax, eax
jne 0xc021d8
mov eax, esi
shr eax, 3
mov dword [ebp - 0xafc], eax
test eax, eax
je 0xbaeee5
mov eax, dword [ebp - 0xaec]
mov esi, dword [ebp - 0xaf0]
add eax, 7
add esi, 2
mov dword [ebp - 0xaec], eax
mov dword [ebp - 0xaf0], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xaf0]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xaf0]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xaf0]
shl esi, 8
add dword [ebp - 0xaf0], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov dword [ebp - 0xa94], ebx
add ebx, 0xffffb5a8
xor ebx, edi
xor ebx, ecx
mov ecx, 0xc81ecb17
xor ebx, ecx
mov eax, ebx
xor eax, ecx
ror eax, 0xf
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 7
add ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov dword [ebp - 0xa94], eax
add eax, 0xb1b54a58
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
ror eax, 0xa
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0xcb17
rol eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
rol eax, 5
add ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xa94], eax
xor ecx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, ecx
xor ebx, eax
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 6
sub ecx, eax
sub ecx, 0x339b6838
xor dword [ebp - 0xa94], ecx
mov ecx, dword [ebp - 0xa94]
mov eax, ecx
ror eax, 0xf
xor eax, 0xcb17
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, 0xc81e
imul eax, eax, 0xcb17
xor ecx, eax
lea eax, [ecx + 0x37e0ea91]
mov dword [ebp - 0xa94], ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0xc81e
ror ecx, 0xa
imul eax, eax, 0xb1b5
xor ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov dword [ebp - 0xa94], eax
xor eax, 0x4a58
rol eax, 6
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
ror eax, 3
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa94]
mov eax, ebx
ror eax, 0xf
sub eax, 0xc81e
imul eax, eax, 0x4a58
xor ecx, eax
mov dword [ebp - 0xa94], ecx
xor ecx, 0xc81e
mov eax, dword [ebp - 0xa94]
shr eax, 1
imul ecx, ecx, 0x4a58
xor ecx, eax
mov eax, dword [ebp - 0xa94]
add eax, 0xffff34e9
xor ebx, ecx
rol eax, 3
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa94]
shr eax, 0xf
xor ecx, eax
xor ebx, ecx
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 0xd
sub ecx, eax
mov eax, 0xb1b54a58
add ecx, 0x730581bd
xor dword [ebp - 0xa94], ecx
sub eax, dword [ebp - 0xa94]
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
ror eax, 0xb
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa94]
lea eax, [ebx + 0x4e49ed8a]
xor ecx, eax
mov dword [ebp - 0xa94], ecx
mov eax, dword [ebp - 0xa94]
xor eax, 0xb1b5
ror ecx, 7
imul eax, eax, 0x4a58
sub eax, ecx
xor ebx, eax
mov eax, ebx
xor eax, 0xc81e
rol eax, 4
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0x10
sub ecx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xa94], ecx
sub eax, dword [ebp - 0xa94]
ror eax, 0xa
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
ror eax, 4
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x4e4ab5a8]
ror eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
ror eax, 9
xor ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov dword [ebp - 0xa94], eax
xor eax, 0xc81ecb17
rol eax, 8
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa94]
rol eax, 2
sub ecx, eax
mov eax, 0xc81ecb17
xor ebx, ecx
sub eax, ebx
ror eax, 0xb
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0xc
sub ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov dword [ebp - 0xa94], eax
xor eax, 0xb1b5
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
shr eax, 8
xor ecx, eax
mov eax, dword [ebp - 0xa94]
xor ebx, ecx
mov ecx, dword [ebp - 0xaec]
xor eax, ebx
add dword [ebp - 0xaec], 8
xor eax, dword [ebp - 0xb18]
xor ebx, dword [ebp - 0xb14]
xor eax, 0x79ab814f
mov dword [ebp - 0xb38], eax
mov dword [ebp - 0xb44], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb38]
ror dword [ebp - 0xb44], 8
mov byte [ecx], al
ror dword [ebp - 0xb38], 8
mov al, byte [ebp - 0xb44]
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb38]
ror dword [ebp - 0xb44], 8
mov byte [ecx - 1], al
ror dword [ebp - 0xb38], 8
mov al, byte [ebp - 0xb44]
mov byte [ecx - 6], al
ror dword [ebp - 0xb44], 8
mov al, byte [ebp - 0xb38]
mov byte [ecx - 2], al
ror dword [ebp - 0xb38], 8
mov al, byte [ebp - 0xb44]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb38]
mov byte [ecx - 3], al
mov ecx, dword [ebp - 0xb44]
mov ebx, dword [ebp - 0xb38]
ror ecx, 8
ror ebx, 8
sub dword [ebp - 0xafc], 1
mov dword [ebp - 0xb18], esi
mov esi, dword [ebp - 0xaf0]
mov dword [ebp - 0xb44], ecx
mov dword [ebp - 0xb38], ebx
mov dword [ebp - 0xb14], edi
jne 0xbaeb16
mov edi, dword [ebp - 0xacc]
mov esi, dword [ebp - 0xab0]
mov ecx, dword [ebp - 0xadc]
movzx eax, dl
cdq
mov dword [ecx + esi], eax
mov dword [ecx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc022a1
mov ebx, dword [ebp - 0xad8]
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc022ab
mov dword [esi + 4], eax
push ebx
push dword [ebp - 0xadc]
push eax
call fcn.00bc13d0
add esp, 0xc
mov eax, 0xa0
mov dword [esi + 8], eax
push eax
push 8
pop ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc022ab
mov dword [esi + 0xc], eax
push 0xa0
push 0xd08ca8
push eax
call fcn.00bc13d0
add esp, 0xc
mov dword [esi + 0x10], ebx
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
je 0xc022b7
mov dword [esi + 0x14], ecx
mov edi, esi
mov eax, dword [0xd08d48]
mov ebx, edx
mov dword [ecx], eax
mov esi, edx
mov eax, dword [0xd08d4c]
mov dword [ecx + 4], eax
test esi, esi
jne 0xc022c1
xor eax, eax
test ebx, ebx
js 0xbaefc8
mov dword [ebp - 0xac8], edi
mov edi, eax
push dword [ebp - 0xadc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
jne 0xc02329
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xbb0000
mov esi, dword [ebp - 0xac8]
lea eax, [ebp - 0xbb8]
push 4
pop edi
push eax
mov edx, dword [esi]
mov ecx, edi
mov dword [ebp - 0xbb8], edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc0239c
mov ecx, dword [ebp - 0xbb8]
lea eax, [ebp - 0xbb8]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc0239c
mov edx, dword [esi + 8]
lea eax, [ebp - 0xbb8]
mov ecx, dword [ebp - 0xbb8]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc0239c
mov ecx, dword [ebp - 0xbb8]
lea eax, [ebp - 0xbb8]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc0239c
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0xbb8]
mov ecx, dword [ebp - 0xbb8]
push eax
call fcn.00b84e9a
mov edi, dword [ebp - 0xbb8]
mov ebx, eax
test ebx, ebx
js 0xc0239c
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc023af
mov eax, dword [ebp - 0xac8]
mov ecx, esi
mov dword [ebp - 0xaf8], esi
mov eax, dword [eax]
mov dword [esi], eax
lea eax, [ebp - 0xaf8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc023b9
mov ebx, dword [ebp - 0xac8]
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0xaf8]
call fcn.00bc13d0
mov edx, dword [ebx]
lea eax, [ebp - 0xaf8]
mov ecx, dword [ebp - 0xaf8]
add esp, 0xc
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc023b9
mov eax, dword [ebp - 0xac8]
mov ecx, dword [ebp - 0xaf8]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xaf8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc023b9
mov ebx, dword [ebp - 0xac8]
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0xaf8]
call fcn.00bc13d0
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xaf8]
mov ecx, dword [ebp - 0xaf8]
add esp, 0xc
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc023b9
mov eax, dword [ebp - 0xac8]
mov ecx, dword [ebp - 0xaf8]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xaf8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc023b9
mov ebx, dword [ebp - 0xac8]
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0xaf8]
call fcn.00bc13d0
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xaf8]
mov ecx, dword [ebp - 0xaf8]
add esp, 0xc
push eax
call fcn.00b84e9a
mov ebx, eax
xor eax, eax
test ebx, ebx
js 0xbaf1f3
mov dword [ebp - 0xa9c], esi
mov esi, eax
mov dword [ebp - 0xaac], edi
test esi, esi
jne 0xc023c0
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xbb0000
xor eax, eax
mov dword [ebp - 0xcc8], 8
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xacc], eax
mov edx, dword [ebp - 0xabc]
lea eax, [ebp - 0xcc8]
push eax
push 8
pop ecx
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xc023f5
mov eax, dword [ebp - 0xcc8]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jb 0xc023d4
mov dword [ebp - 0xc80], ecx
lea eax, [ebp - 0xc80]
push eax
push 8
pop edx
call fcn.00b84e9a
mov ebx, eax
mov eax, dword [ebp - 0xc80]
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc023df
mov dword [ebp - 0xaec], eax
test ebx, ebx
js 0xc023f5
cmp dword [ebp - 0xaa8], 1
jbe 0xc023ea
mov ecx, dword [ebp - 0xae0]
xor eax, eax
mov dword [ebp - 0xbcc], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xbcc]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02400
mov ecx, dword [ebp - 0xbcc]
lea eax, [ebp - 0xbcc]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02400
mov ecx, dword [ebp - 0xbcc]
inc esi
cmp esi, 1
jb 0xbaf2b8
mov esi, dword [ecx]
lea eax, [ebp - 0xbcc]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02400
mov edi, esi
neg esi
sbb esi, esi
and dword [ebp - 0xbcc], esi
test ebx, ebx
js 0xc023f5
cmp dword [ebp - 0xaa8], 2
jbe 0xc023ea
mov ecx, dword [ebp - 0xae0]
xor eax, eax
mov dword [ebp - 0xbd0], ecx
mov esi, eax
lea eax, [ebp - 0xbd0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc023f5
mov edx, dword [ecx]
lea eax, [ebp - 0xbd0]
mov ecx, dword [ebp - 0xbd0]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc023f5
mov ecx, dword [ebp - 0xbd0]
inc esi
cmp esi, 2
jb 0xbaf35f
mov esi, dword [ecx]
lea eax, [ebp - 0xbd0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc023f5
mov dword [ebp - 0xacc], esi
neg esi
sbb esi, esi
and dword [ebp - 0xbd0], esi
test ebx, ebx
js 0xc023f5
mov edx, dword [ebp - 0xaec]
lea eax, [ebp - 0xbac]
push 4
pop esi
push eax
mov ecx, esi
mov dword [ebp - 0xbac], esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0240b
mov ecx, dword [ebp - 0xbac]
lea eax, [ebp - 0xbac]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0240b
mov ecx, dword [ebp - 0xbac]
lea eax, [ebp - 0xbac]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0240b
mov ecx, dword [ebp - 0xbac]
lea eax, [ebp - 0xbac]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0240b
mov edx, dword [ebp - 0xacc]
lea eax, [ebp - 0xbac]
mov ecx, dword [ebp - 0xbac]
push eax
call fcn.00b84e9a
mov ebx, eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0240b
cmp eax, 0x400000
ja 0xc0241a
mov esi, eax
mov dword [ebp - 0xab8], esi
test ebx, ebx
js 0xbb0000
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc02424
mov ecx, eax
mov dword [ebp - 0xb10], eax
mov ebx, 0x10000000
mov edi, dword [ebp - 0xa9c]
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbb0006
test edi, edi
je 0xc02434
test ecx, ecx
je 0xc02434
mov eax, dword [ebp - 0xaac]
xor ebx, ebx
mov dword [ebp - 0xe0c], eax
lea eax, [ebp - 0xd10]
push eax
push 0xb2be98
push 1
mov dword [ebp - 0xe14], edi
mov dword [ebp - 0xe10], ecx
mov dword [ebp - 0xe08], esi
mov dword [ebp - 0xe04], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc0243b
push 0xb2be7c
push dword [ebp - 0xd10]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xc0248d
push ebx
push 0x14
lea eax, [ebp - 0xe14]
mov ecx, esi
push eax
push 0x86
call dword [0xd0cffc]
call esi
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xc024a1
mov esi, dword [ebp - 0xe08]
mov dword [ebp - 0xab8], esi
cmp ebx, 0xd0000023
je 0xc024ac
test ebx, ebx
js 0xbb0006
mov eax, dword [ebp - 0xb10]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xb28], ecx
mov edi, ecx
mov dword [ebp - 0xb90], eax
cmp esi, edx
jb 0xc024bc
mov esi, dword [eax]
lea ecx, [ebp - 0xb90]
push ecx
mov ecx, eax
mov dword [ebp - 0xad8], esi
call fcn.00b84e9a
mov ebx, eax
xor ecx, ecx
test ebx, ebx
js 0xbaf8eb
lea eax, [ebp - 0xb28]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc025d3
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0xb28]
cmp eax, esi
jb 0xc024c6
mov eax, dword [ebp - 0xb90]
lea ecx, [ebp - 0xb90]
push ecx
mov edx, esi
mov dword [ebp - 0xaac], eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc025d3
mov ecx, dword [ebp - 0xb28]
lea eax, [ebp - 0xb28]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc025d3
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0xb28]
push 4
pop edx
cmp eax, edx
jb 0xc024c6
mov ecx, dword [ebp - 0xb90]
lea eax, [ebp - 0xb90]
push eax
mov esi, dword [ecx]
mov dword [ebp - 0xac4], esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc025d3
mov ecx, dword [ebp - 0xb28]
lea eax, [ebp - 0xb28]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc025d3
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0xb28]
cmp eax, esi
jb 0xc024c6
mov eax, dword [ebp - 0xb90]
lea ecx, [ebp - 0xb90]
push ecx
mov edx, esi
mov dword [ebp - 0xabc], eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc025d3
mov ecx, dword [ebp - 0xb28]
lea eax, [ebp - 0xb28]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc025d3
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0xb28]
push 4
pop edx
cmp eax, edx
jb 0xc024c6
mov ecx, dword [ebp - 0xb90]
mov eax, dword [ecx]
mov dword [ebp - 0xadc], eax
lea eax, [ebp - 0xb90]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc025d3
mov ecx, dword [ebp - 0xb28]
lea eax, [ebp - 0xb28]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc025d3
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0xb28]
mov ecx, dword [ebp - 0xadc]
cmp eax, ecx
jb 0xc024c6
lea eax, [ebp - 0xb28]
mov edx, ecx
mov ecx, dword [ebp - 0xb28]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc025d3
mov ecx, dword [ebp - 0xab8]
mov eax, ecx
sub eax, dword [ebp - 0xb28]
jne 0xc024c6
mov eax, dword [ebp - 0xadc]
mov ebx, dword [ebp - 0xad8]
add eax, 0xc
add eax, esi
add eax, ebx
cmp eax, ecx
jne 0xc024c6
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc024d0
cmp dword [ebp - 0xaac], edi
je 0xc024e6
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc024da
mov dword [esi + 4], eax
push ebx
push dword [ebp - 0xaac]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
cmp dword [ebp - 0xabc], edi
je 0xc024f2
mov ebx, dword [ebp - 0xac4]
push ebx
push 8
mov dword [esi + 8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc024da
mov dword [esi + 0xc], eax
push ebx
push dword [ebp - 0xabc]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
cmp dword [ebp - 0xb90], edi
je 0xc024fd
mov ebx, dword [ebp - 0xadc]
push ebx
push 8
mov dword [esi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc024da
mov dword [esi + 0x14], eax
push ebx
push dword [ebp - 0xb90]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
mov edi, esi
mov ebx, eax
mov esi, eax
test esi, esi
jne 0xc02508
xor ecx, ecx
test ebx, ebx
js 0xbaf8e3
mov dword [ebp - 0xae4], edi
mov edi, ecx
test edi, edi
jne 0xc02570
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xbb0000
mov eax, dword [ebp - 0xae4]
mov esi, ecx
mov dword [ebp - 0xae0], esi
mov dword [ebp - 0xaa8], ecx
test eax, eax
je 0xc025da
mov edi, dword [eax + 4]
mov dword [ebp - 0xafc], edi
test edi, edi
je 0xc025da
mov ebx, dword [eax]
test ebx, ebx
je 0xc025da
add ebx, 0xfffffff8
mov dword [ebp - 0xaec], ecx
push ebx
push ecx
mov dword [ebp - 0xab0], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xacc], eax
test eax, eax
je 0xc0273e
xor ecx, ecx
mov dword [ebp - 0x3e8], 0xab69605e
mov dl, cl
mov dword [ebp - 0x3e4], 0x7f1137f
mov ecx, edi
mov esi, ebx
mov dword [ebp - 0xaf0], ecx
mov edi, eax
mov dword [ebp - 0xadc], edi
and esi, 7
jne 0xc025ea
xor eax, eax
or dword [ebp - 0xb14], 0xffffffff
mov edi, eax
mov dword [ebp - 0xb18], eax
mov esi, eax
mov dword [ebp - 0xb20], edi
mov dword [ebp - 0xb30], esi
mov eax, ebx
shr eax, 3
mov dword [ebp - 0xabc], eax
test eax, eax
je 0xbafd3a
mov eax, dword [ebp - 0xadc]
add eax, 7
add ecx, 2
mov dword [ebp - 0xaac], eax
mov dword [ebp - 0xaf0], ecx
movzx ebx, byte [ecx - 2]
movzx eax, byte [ecx - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 1]
movzx ecx, byte [ecx + 2]
shl ecx, 8
shl ebx, 8
or ebx, eax
mov eax, dword [ebp - 0xaf0]
xor esi, ebx
mov dword [ebp - 0xad8], ebx
mov dword [ebp - 0xab8], esi
mov ebx, dword [ebp - 0xab8]
movzx eax, byte [eax + 3]
or ecx, eax
mov eax, dword [ebp - 0xaf0]
shl ecx, 8
movzx eax, byte [eax + 4]
or ecx, eax
mov eax, dword [ebp - 0xaf0]
shl ecx, 8
add dword [ebp - 0xaf0], 8
movzx eax, byte [eax + 5]
or ecx, eax
mov esi, ecx
mov dword [ebp - 0xac4], ecx
xor esi, edi
mov edi, 0xab69605e
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul ecx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub ecx, eax
xor esi, ecx
imul ecx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub ecx, eax
sub ecx, 0x756c8a2
xor ebx, ecx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, edi
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0x137f
ror ecx, 6
imul eax, eax, 0xab69
xor ecx, eax
xor esi, ecx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, esi
rol eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub ecx, eax
xor esi, ecx
mov eax, esi
xor eax, edi
ror eax, 0xc
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x7f1
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea edi, [ebx - 0x7f1]
xor edi, esi
xor edi, 0xab69605e
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul ecx, eax, 0x137f
mov eax, edi
shr eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 7
add ecx, eax
xor edi, ecx
mov eax, edi
mov ecx, edi
xor eax, 0x137f
ror ecx, 9
imul eax, eax, 0x605e
add ecx, eax
xor ebx, ecx
mov eax, ebx
mov dword [ebp - 0xab8], ebx
xor eax, 0xab69
rol eax, 5
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add ecx, eax
xor edi, ecx
mov ebx, edi
xor ebx, dword [ebp - 0xab8]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor edi, eax
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul ecx, eax, 0x605e
mov eax, edi
ror eax, 6
sub ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add ecx, eax
xor edi, ecx
lea eax, [edi - 0x54969fa2]
rol eax, 0xf
imul ecx, eax, 0x137f
mov eax, edi
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x605e
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor ecx, eax
xor edi, ecx
mov eax, edi
xor eax, 0x7f1137f
rol eax, 4
imul ecx, eax, 0x605e
mov eax, edi
xor edi, dword [ebp - 0xb14]
rol eax, 2
mov dword [ebp - 0xb20], edi
xor ecx, eax
xor ecx, dword [ebp - 0xb18]
xor ebx, ecx
mov ecx, dword [ebp - 0xaac]
mov dword [ebp - 0xb30], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb20]
ror dword [ebp - 0xb30], 8
mov byte [ecx], al
mov al, byte [ebp - 0xb30]
ror dword [ebp - 0xb20], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb20]
ror dword [ebp - 0xb30], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xb30]
ror dword [ebp - 0xb20], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xb20]
ror dword [ebp - 0xb30], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xb20], 8
mov al, byte [ebp - 0xb30]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb20]
mov byte [ecx - 3], al
add ecx, 8
mov esi, dword [ebp - 0xb30]
mov edi, dword [ebp - 0xb20]
mov eax, dword [ebp - 0xad8]
ror esi, 8
ror edi, 8
sub dword [ebp - 0xabc], 1
mov dword [ebp - 0xb18], eax
mov eax, dword [ebp - 0xac4]
mov dword [ebp - 0xaac], ecx
mov ecx, dword [ebp - 0xaf0]
mov dword [ebp - 0xb30], esi
mov dword [ebp - 0xb20], edi
mov dword [ebp - 0xb14], eax
jne 0xbaf9dd
mov ebx, dword [ebp - 0xab0]
mov ecx, dword [ebp - 0xacc]
xor eax, eax
test ebx, ebx
je 0xbafd4e
xor dl, byte [eax + ecx]
inc eax
cmp eax, ebx
jb 0xbafd46
mov esi, dword [ebp - 0xafc]
movzx eax, dl
cdq
cmp eax, dword [ebx + esi]
jne 0xc02712
cmp edx, dword [ebx + esi + 4]
jne 0xc02712
xor eax, eax
mov esi, ecx
mov edi, ebx
mov ecx, eax
mov ebx, dword [ebp - 0xaec]
test ecx, ecx
jne 0xc0272a
test ebx, ebx
js 0xc0273e
xor ecx, ecx
mov dword [ebp - 0xae8], esi
mov esi, ecx
mov dword [ebp - 0xb4c], edi
mov ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
test esi, esi
jne 0xc0274a
test ebx, ebx
js 0xbb0000
mov edi, dword [ebp - 0xb4c]
push 4
pop esi
mov dword [ebp - 0xc14], ecx
mov ecx, dword [ebp - 0xae8]
mov dword [ebp - 0xc3c], ecx
cmp edi, esi
jb 0xc02799
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0xc3c]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbafff4
lea eax, [ebp - 0xc14]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbafff4
mov eax, edi
sub eax, dword [ebp - 0xc14]
cmp eax, esi
jb 0xc02799
mov ecx, dword [ebp - 0xc3c]
lea eax, [ebp - 0xc3c]
push eax
push 4
pop eax
mov esi, dword [ecx]
mov edx, eax
mov dword [ebp - 0xaac], esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbafff4
mov ecx, dword [ebp - 0xc14]
lea eax, [ebp - 0xc14]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbafff4
mov ecx, dword [ebp - 0xc14]
mov eax, edi
sub eax, ecx
cmp eax, esi
jb 0xc02799
lea eax, [ebp - 0xc14]
mov edx, esi
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbafff4
mov edi, dword [ebp - 0xc3c]
mov edx, dword [ebp - 0xb4c]
mov ebx, dword [ebp - 0xae8]
lea ecx, [esi + edi]
lea eax, [edx + ebx]
cmp eax, ecx
jb 0xc02799
sub edx, esi
sub edx, edi
add edx, ebx
cmp edx, 8
jae 0xc02799
xor ecx, ecx
mov dword [ebp - 0xadc], ecx
mov eax, ecx
mov dword [ebp - 0xb4c], eax
mov ebx, ecx
test edi, edi
je 0xbaff91
mov edx, dword [ebp - 0xaac]
lea eax, [ebp - 0xbf8]
push eax
mov ecx, edi
mov esi, edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbafff4
mov edx, dword [ebp - 0xbf8]
cmp edi, edx
jae 0xbaff7d
lea eax, [esi + 4]
cmp eax, esi
jb 0xc02785
cmp eax, edx
ja 0xc0277b
mov eax, dword [esi]
push 4
add eax, 4
pop ebx
cmp eax, ebx
jb 0xc02760
mov ecx, eax
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, 4
jb 0xc02768
mov dword [ebp - 0xd14], ecx
cmp eax, 4
jb 0xbaffde
add ecx, esi
cmp ecx, esi
jb 0xc02773
mov eax, ecx
cmp ecx, esi
sbb ebx, ebx
and ebx, 0xc0000095
cmp ecx, esi
jb 0xbaffde
cmp eax, edx
ja 0xc0277b
inc dword [ebp - 0xadc]
mov esi, eax
cmp eax, edx
jb 0xbaff08
cmp esi, edx
jne 0xc0277b
mov esi, dword [ebp - 0xaac]
mov eax, dword [ebp - 0xb4c]
test esi, esi
je 0xbaffb7
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb4c], eax
test eax, eax
je 0xc0278f
xor ecx, ecx
mov ebx, ecx
test edi, edi
je 0xbaffcc
push esi
push edi
push eax
call fcn.00bc13d0
mov eax, dword [ebp - 0xb4c]
add esp, 0xc
mov dword [ebp - 0xc08], eax
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0xc10], eax
test ebx, ebx
js 0xbafff4
mov eax, dword [ebp - 0xad8]
cmp eax, dword [ebp - 0xc10]
jne 0xc02799
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
mov edi, dword [ebp - 0xa9c]
mov eax, dword [ebp - 0xb08]
test eax, eax
je 0xbb0021
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xac8]
test esi, esi
je 0xbb008f
xor eax, eax
cmp dword [esi + 4], eax
je 0xbb0048
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xbb0064
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xbb0080
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xbb00a4
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb10]
test eax, eax
je 0xbb00bf
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xae4]
test esi, esi
je 0xbb012d
xor eax, eax
cmp dword [esi + 4], eax
je 0xbb00e6
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xbb0102
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xbb011e
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xae8]
test eax, eax
je 0xbb0148
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc020a9
cmp dword [ebp - 0xc10], 1
jb 0xc027a3
cmp dword [ebp - 0xc08], 0
je 0xc027ad
cmp dword [ebp - 0xc10], 0
jbe 0xc027ad
mov ecx, dword [ebp - 0xc08]
lea eax, [ebp - 0xbf4]
push eax
push 4
pop eax
mov esi, dword [ecx]
mov edx, eax
mov dword [ebp - 0xbf4], ecx
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc027c6
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbf4]
mov dword [ebp - 0xbf4], eax
test ebx, ebx
js 0xc027b8
push 4
pop edx
cmp esi, edx
jne 0xc020ba
mov eax, dword [eax]
mov dword [ebp - 0xad0], eax
test ebx, ebx
js 0xc020a9
cmp eax, 0xd0000023
je 0xc027d7
cmp eax, 0x8007007a
je 0xbb01fd
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test eax, eax
js 0xc020a9
cmp dword [ebp - 0xc10], 6
jne 0xc027a3
cmp dword [ebp - 0xc08], 0
je 0xc027e7
mov ecx, dword [ebp - 0xc08]
xor eax, eax
mov dword [ebp - 0xbec], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xbec]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02817
mov ecx, dword [ebp - 0xbec]
lea eax, [ebp - 0xbec]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02817
mov ecx, dword [ebp - 0xbec]
inc esi
cmp esi, 1
jb 0xc0280f
mov esi, dword [ecx]
lea eax, [ebp - 0xbec]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02817
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbec]
mov dword [ebp - 0xbec], eax
test ebx, ebx
js 0xc02828
cmp esi, 8
jne 0xc020ba
mov ecx, dword [eax]
mov dword [ebp - 0xae4], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xb08], ecx
test ebx, ebx
js 0xc020a9
cmp dword [ebp - 0xc08], 0
je 0xc02845
mov ecx, dword [ebp - 0xc08]
xor eax, eax
mov dword [ebp - 0xbe8], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xbe8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0285e
mov ecx, dword [ebp - 0xbe8]
lea eax, [ebp - 0xbe8]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0285e
mov ecx, dword [ebp - 0xbe8]
inc esi
cmp esi, 2
jb 0xbb02f5
mov esi, dword [ecx]
lea eax, [ebp - 0xbe8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0285e
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbe8]
mov dword [ebp - 0xbe8], eax
test ebx, ebx
js 0xc02850
push 4
pop edx
cmp esi, edx
jne 0xc020ba
mov eax, dword [eax]
mov dword [ebp - 0xb4c], eax
test ebx, ebx
js 0xc020a9
cmp dword [ebp - 0xc08], 0
je 0xc0286f
mov ecx, dword [ebp - 0xc08]
xor eax, eax
mov dword [ebp - 0xbe4], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xbe4]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02879
mov ecx, dword [ebp - 0xbe4]
lea eax, [ebp - 0xbe4]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02879
mov ecx, dword [ebp - 0xbe4]
inc esi
cmp esi, 3
jae 0xbb0427
push 4
pop edx
jmp 0xbb03bd
sbb eax, eax
xor ebx, ebx
inc ebx
or eax, ebx
jmp 0xbadcaa
sbb eax, eax
or eax, ebx
xor ecx, ecx
jmp 0xbadced
mov edi, dword [ecx]
lea eax, [ebp - 0xbe4]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xabc], edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02879
mov esi, edi
neg esi
sbb esi, esi
and esi, dword [ebp - 0xbe4]
mov dword [ebp - 0xbe4], esi
test ebx, ebx
js 0xc020a9
mov ecx, dword [ebp - 0xc08]
xor eax, eax
push 4
mov dword [ebp - 0xbe0], ecx
mov edi, eax
pop edx
mov eax, dword [ecx]
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0xbe0]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02890
mov edx, dword [ebp - 0xad8]
lea eax, [ebp - 0xbe0]
mov ecx, dword [ebp - 0xbe0]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02890
mov ecx, dword [ebp - 0xbe0]
inc edi
push 4
pop edx
cmp edi, edx
jb 0xbb047d
mov edi, dword [ecx]
lea eax, [ebp - 0xbe0]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc02890
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xbe0], eax
test ebx, ebx
js 0xc028a1
push 4
pop ecx
cmp edi, ecx
jne 0xc020ba
mov eax, dword [eax]
mov dword [ebp - 0xaac], eax
test ebx, ebx
js 0xc020a9
mov ecx, dword [ebp - 0xc08]
xor eax, eax
mov edi, eax
mov eax, dword [ecx]
lea edx, [ecx + 4]
mov dword [ebp - 0xad8], eax
cmp edx, ecx
jb 0xc028ac
mov eax, edx
cmp edx, ecx
mov dword [ebp - 0xb74], eax
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp edx, ecx
jb 0xc028bc
mov ecx, dword [ebp - 0xad8]
add ecx, eax
mov edx, ecx
mov ebx, ecx
cmp ecx, eax
jb 0xc028b4
cmp ebx, eax
mov dword [ebp - 0xb74], ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp edx, eax
jb 0xc028bc
inc edi
cmp edi, 5
jb 0xbb0534
mov edi, dword [ecx]
lea eax, [ebp - 0xb74]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc028bc
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb74]
mov dword [ebp - 0xb74], eax
test ebx, ebx
js 0xc028cd
push 4
pop ecx
cmp edi, ecx
jne 0xc020ba
mov ecx, dword [eax]
test ebx, ebx
js 0xc020a9
mov eax, dword [ebp - 0xad4]
cmp eax, dword [ebp - 0xae4]
jne 0xc027a3
mov eax, dword [ebp - 0xaa4]
cmp eax, dword [ebp - 0xb08]
jne 0xc027a3
mov eax, dword [ebp - 0xb4c]
push 4
mov dword [ebp - 0xac0], ecx
pop ecx
mov dword [ebp - 0xc38], eax
cmp dword [ebp - 0xaac], ecx
ja 0xc0209e
mov eax, dword [ebp - 0xabc]
cmp eax, ecx
ja 0xc0209e
push eax
push esi
push dword [ebp - 0xb80]
call fcn.00bc13d0
add esp, 0xc
mov eax, dword [ebp - 0xad0]
mov esi, dword [ebp - 0xa98]
mov edi, dword [ebp - 0xaa0]
test eax, eax
je 0xbb0672
mov ebx, eax
mov dword [ebp - 0xa94], ebx
mov eax, dword [ebp - 0xcdc]
xor edx, edx
mov dword [ebp - 0xce0], edx
mov dword [ebp - 0xce4], edx
test eax, eax
je 0xbb06a1
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0xcdc], edx
mov ecx, dword [ebp - 0xc08]
mov dword [ebp - 0xc0c], edx
mov dword [ebp - 0xc10], edx
test ecx, ecx
je 0xbb06ce
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0xc08], edx
test esi, esi
je 0xbb06e1
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xbb06f6
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc02059
mov eax, dword [ebp - 0xac0]
test eax, eax
jne 0xc028d8
mov eax, dword [ebp - 0xb80]
xor edx, edx
mov dword [ebp - 0xb00], edx
mov dword [ebp - 0xc64], eax
mov esi, 0xd0aed4
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xbb0725
mov eax, dword [0xd0a150]
mov ebx, dword [ebp - 0xa94]
test eax, eax
jle 0xbb0787
sub eax, 1
mov dword [0xd0a150], eax
jne 0xbb0787
mov edi, edx
mov eax, dword [edi + 0xd0ae80]
test eax, eax
je 0xbb075e
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xbb074d
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0xd0aed4
xchg dword [ecx], eax
mov eax, dword [ebp - 0xb00]
test eax, eax
jne 0xc09281
mov eax, dword [ebp - 0xc64]
test ebx, ebx
js 0xc0928d
push 4
pop ecx
cmp dword [ebp - 0xc38], ecx
jne 0xc092d8
mov ebx, dword [eax]
mov esi, dword [ebp - 0xd70]
test eax, eax
je 0xbb07d6
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0xc64], eax
test esi, esi
js 0xc092df
test ebx, ebx
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc01f58
xor eax, eax
test esi, esi
jne 0xc01f4e
push dword [ebp - 0xc94]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc01f44
mov eax, dword [ebp - 0xc94]
mov ecx, dword [ebp - 0xb80]
jmp 0xbadbb0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc01fce
xor eax, eax
test esi, esi
jne 0xc01fbe
push dword [ebp - 0xc90]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc01fb4
mov eax, dword [ebp - 0xc90]
mov ecx, dword [ebp - 0xb80]
jmp 0xbadc27
mov ecx, dword [ebp + 4]
mov edx, 0x93
push eax
push 0xb2f560
call fcn.00b913f8
jmp 0xbad525
xor al, al
jmp 0xbb07e3
mov edi, dword [ebp - 0xab0]
or ebx, 0xffffffff
mov dword [ebp - 0xae4], 0xc004d501
xor eax, eax
jmp 0xbad9c2
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbad9ca
mov edx, 0xc000007b
jmp 0xc01eb9
mov edx, 0xc000000d
mov dword [ebp - 0xa9c], edx
jmp 0xbada8d
cmp ax, word [ebp - 0xbc8]
je 0xbada7b
jmp 0xc01eb4
mov eax, dword [ebp - 0xaec]
jmp 0xbadb03
mov ebx, 0xc000007a
jmp 0xbadb25
mov esi, dword [ebp - 0xab0]
mov ebx, 0xc000007a
jmp 0xbadb2b
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc01f0d
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc01efc
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xbadb55
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc0203d
mov ebx, 0x8007000e
jmp 0xbadd65
mov ebx, 0x80004005
jmp 0xbadbe4
test eax, eax
jne 0xc01f63
mov ebx, 0x80004005
jmp 0xc01f72
jg 0xc01f69
mov ebx, eax
jmp 0xc01f72
movzx ebx, ax
or ebx, 0x80070000
xor eax, eax
jmp 0xbadbe4
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbadbec
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc01fa4
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xbadd4a
mov ebx, 0x80004005
jmp 0xbadd4a
mov ebx, 0x8007000e
jmp 0xbadd4a
mov ebx, 0x80004005
mov dword [ebp - 0xa9c], ebx
jmp 0xbadc57
test eax, eax
jne 0xc01fd9
mov ebx, 0x80004005
jmp 0xc01fe8
jg 0xc01fdf
mov ebx, eax
jmp 0xc01fe8
movzx ebx, ax
or ebx, 0x80070000
mov dword [ebp - 0xa9c], ebx
xor eax, eax
jmp 0xbadc57
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbadc5f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc02020
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xbadd35
mov ebx, 0x80004005
jmp 0xbadd35
mov eax, dword [ebp - 0xab0]
jmp 0xbadd29
xor ebx, ebx
mov dword [ebp - 0xac0], ebx
jmp 0xbadd6f
mov dword [ebp - 0xb00], ebx
mov ebx, 0x8007000e
mov dword [ebp - 0xa94], ebx
mov eax, dword [ebp - 0xc50]
xor edx, edx
mov dword [ebp - 0xc38], eax
jmp 0xbb0720
mov edi, dword [ebp - 0xaa0]
mov ebx, 0xc0000017
mov dword [ebp - 0xa94], ebx
jmp 0xbb0672
mov esi, dword [ebp - 0xe38]
jmp 0xc020af
mov ebx, 0xc000003e
mov dword [ebp - 0xa94], ebx
jmp 0xc020af
mov ebx, 0xc0000017
jmp 0xc020a3
mov ebx, 0x8007007a
mov dword [ebp - 0xa94], ebx
mov edi, dword [ebp - 0xaa0]
mov esi, dword [ebp - 0xa98]
jmp 0xbb0672
mov ebx, 0xc0000023
jmp 0xc020a3
mov eax, dword [ebp - 0xaa8]
xor ecx, ecx
jmp 0xbae142
mov eax, dword [ebp - 0xd88]
jmp 0xbae187
mov edi, dword [ebp - 0xae0]
mov eax, dword [ebp - 0xaa8]
jmp 0xbae230
mov eax, dword [ebp - 0xd78]
jmp 0xbae277
mov edi, dword [ebp - 0xae0]
mov eax, dword [ebp - 0xaa8]
jmp 0xbae31d
mov eax, dword [ebp - 0xd24]
jmp 0xbae37c
or esi, 0xffffffff
jmp 0xbae392
mov ebx, 0xc000003e
jmp 0xc020a3
mov eax, dword [ebp - 0xd74]
jmp 0xbae4bc
or esi, 0xffffffff
jmp 0xbae4d2
mov ebx, 0xc0000023
jmp 0xc0213f
mov ebx, 0xc000000d
mov dword [ebp - 0xa94], ebx
jmp 0xbae55d
or ecx, 0xffffffff
jmp 0xbae5a1
or esi, 0xffffffff
jmp 0xbae5d2
mov edx, dword [ebp - 0xae0]
push 4
pop ecx
mov eax, dword [ebp - 0xaa8]
jmp 0xbae659
mov edx, dword [ebp - 0xae0]
jmp 0xc02163
or ecx, 0xffffffff
jmp 0xbae68f
or esi, 0xffffffff
jmp 0xbae6c0
push 4
pop ecx
jmp 0xbae738
mov esi, dword [ebp - 0xe64]
mov eax, dword [ebp - 0xc20]
jmp 0xbae8e2
mov ebx, 0xc0000095
jmp 0xbaea36
mov ebx, 0xc0000017
jmp 0xbaea30
xor eax, eax
jmp 0xbaea28
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbaea30
mov ebx, 0xc000000d
jmp 0xbaefe4
xor ebx, ebx
mov dword [ebp - 0xb18], eax
xor esi, esi
mov dword [ebp - 0xb14], ecx
jbe 0xc0223b
mov edi, dword [ebp - 0xaf0]
push 0x38
pop esi
push 4
pop eax
cmp ebx, eax
movzx eax, byte [edi]
jge 0xc02212
lea ecx, [esi - 0x20]
shl eax, cl
mov ecx, dword [ebp - 0xb14]
or ecx, eax
mov dword [ebp - 0xb14], ecx
jmp 0xc02222
mov ecx, esi
shl eax, cl
or dword [ebp - 0xb18], eax
mov ecx, dword [ebp - 0xb14]
inc ebx
sub esi, 8
xor eax, eax
inc edi
cmp ebx, eax
jl 0xc021f3
mov dword [ebp - 0xaf0], edi
mov edi, eax
mov eax, dword [ebp - 0xb18]
xor ecx, 0xb17a307a
xor eax, 0x42f6b18d
xor ebx, ebx
mov dword [ebp - 0xb44], ecx
mov esi, ebx
jbe 0xc0227d
mov ebx, dword [ebp - 0xaec]
cmp esi, 4
jge 0xc02264
rol ecx, 8
mov byte [ebx], cl
jmp 0xc02269
rol eax, 8
mov byte [ebx], al
inc ebx
add esi, 1
js 0xc02258
mov ecx, dword [ebp - 0xb44]
mov dword [ebp - 0xaec], ebx
xor ebx, ebx
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0xb38], ebx
test eax, eax
jg 0xc02296
jns 0xc02296
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xb44], ecx
mov esi, dword [ebp - 0xab0]
jmp 0xbaeae5
mov ebx, 0xc0000017
jmp 0xbaefba
mov ebx, 0xc0000017
xor edx, edx
jmp 0xbaefb2
mov ebx, 0xc0000017
jmp 0xbaefb2
cmp dword [esi + 4], 0
je 0xc022dd
push dword [esi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 4], edx
cmp dword [esi + 0xc], 0
je 0xc022f9
push dword [esi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0xc], edx
cmp dword [esi + 0x14], 0
je 0xc02315
push dword [esi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0x14], edx
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbaefba
xor eax, eax
cmp dword [edi + 4], eax
je 0xc02346
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc02362
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc0237e
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbaefe4
mov ebx, 0xc0000001
jmp 0xbaefe4
mov edi, dword [ebp - 0xe68]
test ebx, ebx
js 0xbaf1fb
jmp 0xbaf09f
mov ebx, 0xc0000017
jmp 0xbaf1fb
xor eax, eax
jmp 0xbaf1f3
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbaf1fb
mov ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
mov eax, dword [ebp - 0xd0c]
jmp 0xbaf28d
mov ebx, 0xc000000d
mov dword [ebp - 0xa94], ebx
mov esi, dword [ebp - 0xab8]
jmp 0xbaf4c5
mov edi, dword [ebp - 0xadc]
jmp 0xbaf33a
mov eax, dword [ebp - 0xe6c]
test ebx, ebx
js 0xc023f5
jmp 0xbaf4b2
mov ebx, 0x8000ffff
jmp 0xbafffa
mov ecx, dword [ebp - 0xb10]
mov ebx, 0xd0000017
jmp 0xbaf4f2
mov ebx, 0x80070057
jmp 0xc024b1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
jle 0xc02477
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xa94], ebx
test ebx, ebx
jmp 0xc02477
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xa94], ebx
test ebx, ebx
mov esi, dword [ebp - 0xab8]
js 0xbaf5ac
mov ebx, 0x80004005
mov dword [ebp - 0xa94], ebx
jmp 0xbaf5ac
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
jle 0xc02471
jmp 0xc02460
mov esi, dword [ebp - 0xab8]
jmp 0xbaf5ac
mov ebx, 0x8007007a
mov dword [ebp - 0xa94], ebx
jmp 0xbb0006
mov ebx, 0xc000003e
jmp 0xbaf8eb
mov ebx, 0xc000003e
jmp 0xc025d3
mov ebx, 0xc0000017
jmp 0xbaf8d5
mov ebx, 0xc0000017
xor eax, eax
jmp 0xbaf8cd
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
jmp 0xbaf843
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
jmp 0xbaf885
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
jmp 0xbaf8c7
cmp dword [esi + 4], 0
je 0xc02524
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xc02540
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xc0255c
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbaf8d5
cmp dword [edi + 4], 0
je 0xc0258c
push dword [edi + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 4], ecx
cmp dword [edi + 0xc], 0
je 0xc025a8
push dword [edi + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0xc], ecx
cmp dword [edi + 0x14], 0
je 0xc025c4
push dword [edi + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0x14], ecx
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
jmp 0xbaf8eb
mov ebx, 0xd000000d
mov dword [ebp - 0xa94], ebx
jmp 0xbafdac
or dword [ebp - 0xb20], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0xb30], ebx
mov eax, ebx
mov dword [ebp - 0xb14], ebx
mov dword [ebp - 0xb18], eax
test esi, esi
je 0xc02659
push 0x38
pop edi
push 4
pop eax
cmp ebx, eax
jge 0xc0262b
mov eax, dword [ebp - 0xaf0]
lea ecx, [edi - 0x20]
movzx eax, byte [eax]
shl eax, cl
or dword [ebp - 0xb18], eax
jmp 0xc02638
movzx eax, byte [ecx]
mov ecx, edi
shl eax, cl
or dword [ebp - 0xb14], eax
mov ecx, dword [ebp - 0xaf0]
inc ebx
sub edi, 8
inc ecx
mov dword [ebp - 0xaf0], ecx
cmp ebx, esi
jl 0xc0260e
mov edi, dword [ebp - 0xadc]
mov eax, dword [ebp - 0xb18]
mov ebx, dword [ebp - 0xb14]
xor eax, 0x92f65a5
xor ebx, 0x699a899c
mov dword [ebp - 0xab8], eax
xor ecx, ecx
mov dword [ebp - 0xb30], eax
mov dword [ebp - 0xb20], ebx
test esi, esi
je 0xc026b1
cmp ecx, 4
jge 0xc0268e
rol eax, 8
mov byte [edi], al
jmp 0xc02693
rol ebx, 8
mov byte [edi], bl
inc ecx
inc edi
cmp ecx, esi
jl 0xc02682
mov eax, dword [ebp - 0xb30]
mov ebx, dword [ebp - 0xb20]
mov dword [ebp - 0xadc], edi
mov dword [ebp - 0xab8], eax
add esi, 0xfffffffc
test esi, esi
jle 0xc026d6
push 4
pop eax
mov ecx, eax
sub ecx, esi
shl ecx, 3
shr ebx, cl
shl ebx, cl
mov dword [ebp - 0xad8], ebx
mov edi, ebx
mov dword [ebp - 0xb20], ebx
jmp 0xc026fb
xor ecx, ecx
mov edi, ecx
mov dword [ebp - 0xb20], edi
test esi, esi
jns 0xc026fb
neg esi
shl esi, 3
mov ecx, esi
shr eax, cl
shl eax, cl
mov dword [ebp - 0xab8], eax
mov dword [ebp - 0xb30], eax
mov esi, dword [ebp - 0xab8]
mov ebx, dword [ebp - 0xab0]
mov ecx, dword [ebp - 0xaf0]
jmp 0xbaf9b2
mov esi, dword [ebp - 0xae0]
mov ebx, 0xc004d501
mov edi, dword [ebp - 0xaa8]
xor eax, eax
jmp 0xbafd79
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbafd81
mov ebx, 0xd0000001
xor ecx, ecx
jmp 0xbafd9e
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
jmp 0xbafdac
or ecx, 0xffffffff
jmp 0xbaff2d
mov ecx, dword [ebp - 0xd14]
jmp 0xbaff46
or eax, 0xffffffff
jmp 0xbaff5b
mov ebx, 0xc000000d
jmp 0xbafff4
mov ebx, 0xc0000095
jmp 0xbafff4
mov ebx, 0xc0000017
jmp 0xbaffde
mov ebx, 0xc000003e
jmp 0xbafff4
mov ebx, 0xc004d501
jmp 0xc020a3
mov ebx, 0xc000000d
mov dword [ebp - 0xa94], ebx
mov eax, dword [ebp - 0xad0]
push 4
pop edx
jmp 0xbb01d3
mov esi, dword [ebp - 0xe70]
mov eax, dword [ebp - 0xe8c]
jmp 0xbb01b8
mov eax, 0x8007007a
mov dword [ebp - 0xad0], eax
jmp 0xbb01e6
mov edx, dword [ebp - 0xd34]
mov ebx, 0xc000000d
mov ecx, dword [ebp - 0xd38]
mov dword [ebp - 0xa94], ebx
mov dword [ebp - 0xb08], edx
mov dword [ebp - 0xae4], ecx
jmp 0xbb02d0
push 4
pop edx
jmp 0xbb0227
mov esi, dword [ebp - 0xe90]
mov eax, dword [ebp - 0xe94]
jmp 0xbb02ae
mov eax, dword [ebp - 0xd34]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0xd38]
mov dword [ebp - 0xae4], eax
jmp 0xbb02d0
mov ebx, 0xc000000d
mov dword [ebp - 0xa94], ebx
mov eax, dword [ebp - 0xd28]
push 4
pop edx
jmp 0xbb0392
mov esi, dword [ebp - 0xe40]
mov eax, dword [ebp - 0xe44]
jmp 0xbb037d
mov ebx, 0xc000000d
jmp 0xc020a3
mov eax, dword [ebp - 0xe48]
mov esi, dword [ebp - 0xe28]
mov dword [ebp - 0xabc], eax
jmp 0xbb0462
mov edi, dword [ebp - 0xe18]
mov eax, dword [ebp - 0xe1c]
jmp 0xbb0507
mov eax, dword [ebp - 0xe20]
jmp 0xbb051c
or eax, 0xffffffff
jmp 0xbb0549
or ecx, 0xffffffff
jmp 0xbb057b
mov edi, dword [ebp - 0xe24]
mov eax, dword [ebp - 0xe2c]
jmp 0xbb05d4
mov ecx, dword [ebp - 0xab4]
jmp 0xbb05e9
mov dword [0xd09360], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x2c8]
push eax
push 0xb10000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0xc07112
cmp eax, esi
jne 0xc02910
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0xc07112
mov esi, dword [0xd0807c]
xor ebx, ebx
push 0x403
push ebx
push ebx
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xaa8], eax
test eax, eax
jne 0xc0293e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc07114
mov esi, dword [0xd0804c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [0xd09358], eax
mov eax, dword [0xd09360]
push 0x54
mov dword [ebp - 0xadc], eax
lea eax, [ebp - 0x778]
push ebx
push eax
mov dword [0xd0935c], edx
call fcn.00bc259b
xor eax, eax
mov dword [ebp - 0xd84], ebx
lea edi, [ebp - 0xc30]
mov dword [ebp - 0xd80], ebx
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0xae0], ebx
mov dword [ebp - 0xad8], ebx
stosd dword es:[edi], eax
push 0x2c
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0xb4c], ebx
mov esi, 0xd0aed4
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xc029b7
mov eax, dword [0xd0a150]
test eax, eax
jne 0xc02fce
push 0x338
mov esi, ebx
mov dword [ebp - 0xaa4], ebx
push ebx
mov dword [ebp - 0xa9c], ebx
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0xb00], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb08], eax
test eax, eax
je 0xc02fc0
or dword [ebp - 0xabc], 0xffffffff
mov edi, ebx
add eax, 7
mov dword [ebp - 0x3e0], 0xab69605e
mov cl, bl
mov dword [ebp - 0x3dc], 0x7f1137f
mov dword [ebp - 0xaac], ebx
mov esi, 0xb2bef2
mov dword [ebp - 0xb54], ebx
mov dword [ebp - 0xb88], edi
mov dword [ebp - 0xacc], eax
mov dword [ebp - 0xafc], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edx, eax
mov dword [ebp - 0xac4], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl edx, 8
mov ebx, 0xab69605e
or edx, eax
movzx eax, byte [esi + 5]
shl edx, 8
add esi, 8
or edx, eax
mov dword [ebp - 0xae4], esi
mov esi, edx
mov dword [ebp - 0xad4], edx
xor esi, dword [ebp - 0xb54]
xor esi, edi
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor edi, edx
lea eax, [edi + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, edi
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor edi, edx
mov eax, edi
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, ebx
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor edi, edx
lea eax, [edi + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, ebx
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, edi
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edi, eax
mov dword [ebp - 0xab4], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xab4]
xor edi, ebx
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, edi
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov ebx, edi
xor ebx, esi
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor edi, eax
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, edi
ror eax, 6
sub edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add edx, eax
xor edi, edx
lea eax, [edi - 0x54969fa2]
mov esi, dword [ebp - 0xae4]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, edi
ror eax, 0xe
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, edi
xor edi, dword [ebp - 0xabc]
rol eax, 2
mov dword [ebp - 0xb54], edi
xor edx, eax
xor edx, dword [ebp - 0xaac]
xor ebx, edx
mov edx, dword [ebp - 0xacc]
mov dword [ebp - 0xb88], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb54]
ror dword [ebp - 0xb88], 8
mov byte [edx], al
mov al, byte [ebp - 0xb88]
ror dword [ebp - 0xb54], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb54]
ror dword [ebp - 0xb88], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb88]
ror dword [ebp - 0xb54], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb54]
ror dword [ebp - 0xb88], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xb88]
ror dword [ebp - 0xb54], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb54]
mov byte [edx - 3], al
add edx, 8
mov edi, dword [ebp - 0xb88]
mov eax, dword [ebp - 0xac4]
ror dword [ebp - 0xb54], 8
ror edi, 8
sub dword [ebp - 0xafc], 1
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0xad4]
mov dword [ebp - 0xb88], edi
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xacc], edx
jne 0xc02a55
mov esi, dword [ebp - 0xb08]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc02d92
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xc02dc4
cmp edx, dword [0xb2c22c]
jne 0xc02dc4
mov ebx, esi
xor eax, eax
mov dword [ebp - 0xab0], ebx
mov esi, eax
mov edi, 0x337
jmp 0xc02dd9
mov ebx, dword [ebp - 0xab0]
or edi, 0xffffffff
mov dword [ebp - 0xb00], 0xc004d501
xor eax, eax
test esi, esi
je 0xc02dec
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb00], 0
jl 0xc02fba
xor eax, eax
mov esi, ebx
push 0x40
push eax
push 0xd0ae80
mov byte [edi + ebx], al
call fcn.00bc259b
add esp, 0xc
cmp byte [ebx], 0
je 0xc02f50
mov edi, 0xd0ae80
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xc00]
jne 0xc02e25
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc02fb3
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa9c], edx
cmp word [eax], cx
jne 0xc02e9b
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xc02e9b
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xc02e9b
cmp dword [ecx], 0x4550
jne 0xc02e9b
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xbc4]
je 0xc02ea8
cmp ax, word [ebp - 0xbc8]
je 0xc02ea8
mov edx, 0xc000000d
jmp 0xc02ea0
mov edx, 0xc000007b
mov dword [ebp - 0xa9c], edx
jmp 0xc02eba
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xaac], eax
test eax, eax
je 0xc02f44
mov ecx, esi
mov dword [ebp - 0xac4], esi
xor eax, eax
mov dword [ebp - 0xc7c], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xab4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc02ee4
sub ecx, dword [ebp - 0xab4]
inc esi
add esi, ecx
test edx, edx
js 0xc02f2e
mov ecx, dword [ebp - 0xac4]
lea eax, [ebp - 0xc7c]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa9c], edx
test edx, edx
js 0xc02f50
mov eax, dword [ebp - 0xaa4]
mov ecx, dword [ebp - 0xc7c]
mov dword [eax*4 + section..data], ecx
jmp 0xc02f34
mov eax, dword [ebp - 0xaa4]
inc eax
inc ebx
mov dword [ebp - 0xaa4], eax
cmp ebx, dword [ebp - 0xaac]
jb 0xc02ecb
add edi, 0x10
cmp byte [esi], 0
jne 0xc02e1e
mov ebx, dword [ebp - 0xa9c]
mov esi, dword [ebp - 0xab0]
test esi, esi
je 0xc02f71
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc02fc7
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc02f8a
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc02f79
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc02fd4
mov ebx, 0xc000007a
jmp 0xc02f56
mov esi, dword [ebp - 0xab0]
mov ebx, 0xc000007a
jmp 0xc02f5c
mov eax, dword [0xd0a150]
xor ebx, ebx
inc eax
mov dword [0xd0a150], eax
xor eax, eax
mov edx, 0xd0aed4
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0xa], ebx
lea edi, [ebp - 0xcb0]
mov dword [ebp - 0xae8], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xb10], ebx
mov dword [ebp - 0xae4], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xda8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc03009
mov eax, dword [0xd0a150]
test eax, eax
jne 0xc0363d
push 0x338
mov esi, ebx
mov dword [ebp - 0xaa4], ebx
push ebx
mov dword [ebp - 0xa9c], ebx
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0xb00], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xad4], eax
test eax, eax
je 0xc0362f
or dword [ebp - 0xabc], 0xffffffff
mov edi, ebx
add eax, 7
mov dword [ebp - 0x3d8], 0xab69605e
mov cl, bl
mov dword [ebp - 0x3d4], 0x7f1137f
mov dword [ebp - 0xaac], ebx
mov esi, 0xb2bef2
mov dword [ebp - 0xb58], ebx
mov dword [ebp - 0xb70], edi
mov dword [ebp - 0xacc], eax
mov dword [ebp - 0xafc], 0x67
movzx edx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx ebx, byte [esi + 2]
shl edx, 8
or edx, eax
shl ebx, 8
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
or ebx, eax
mov dword [ebp - 0xab4], edx
movzx eax, byte [esi + 4]
xor edi, edx
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 5]
add esi, 8
shl ebx, 8
or ebx, eax
mov dword [ebp - 0xac4], esi
mov esi, edi
xor esi, ebx
xor esi, dword [ebp - 0xb58]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor edi, edx
lea eax, [edi + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, edi
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor edi, edx
mov eax, edi
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor edi, edx
lea eax, [edi + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, edi
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edi, eax
mov dword [ebp - 0xac8], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xac8]
xor edi, 0xab69605e
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, edi
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xac8], esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
mov eax, esi
xor edi, edx
xor eax, edi
xor eax, 0xac987321
mov dword [ebp - 0xac8], eax
ror eax, 3
sub eax, 0xab69
mov esi, dword [ebp - 0xac8]
imul eax, eax, 0x137f
xor edi, eax
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, edi
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
xor edi, edx
lea eax, [edi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, edi
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xac8], esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, edi
xor edi, dword [ebp - 0xabc]
rol eax, 2
mov dword [ebp - 0xb58], edi
mov dword [ebp - 0xabc], ebx
xor edx, eax
mov eax, esi
xor edx, dword [ebp - 0xaac]
xor eax, edx
mov esi, dword [ebp - 0xac4]
mov edx, dword [ebp - 0xacc]
mov dword [ebp - 0xb70], eax
mov byte [edx - 4], al
mov al, byte [ebp - 0xb58]
ror dword [ebp - 0xb70], 8
mov byte [edx], al
mov al, byte [ebp - 0xb70]
ror dword [ebp - 0xb58], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb58]
ror dword [ebp - 0xb70], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb70]
ror dword [ebp - 0xb58], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb58]
ror dword [ebp - 0xb70], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xb70]
ror dword [ebp - 0xb58], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb58]
mov byte [edx - 3], al
add edx, 8
mov eax, dword [ebp - 0xb70]
ror dword [ebp - 0xb58], 8
ror eax, 8
sub dword [ebp - 0xafc], 1
mov dword [ebp - 0xac8], eax
mov edi, dword [ebp - 0xac8]
mov dword [ebp - 0xb70], eax
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0xaac], eax
mov dword [ebp - 0xacc], edx
jne 0xc030a7
mov esi, dword [ebp - 0xad4]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc03401
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xc03433
cmp edx, dword [0xb2c22c]
jne 0xc03433
mov ebx, esi
xor eax, eax
mov dword [ebp - 0xab0], ebx
mov esi, eax
mov edi, 0x337
jmp 0xc03448
mov ebx, dword [ebp - 0xab0]
or edi, 0xffffffff
mov dword [ebp - 0xb00], 0xc004d501
xor eax, eax
test esi, esi
je 0xc0345b
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb00], 0
jl 0xc03629
xor eax, eax
mov esi, ebx
push 0x40
push eax
push 0xd0ae80
mov byte [edi + ebx], al
call fcn.00bc259b
add esp, 0xc
cmp byte [ebx], 0
je 0xc035bf
mov edi, 0xd0ae80
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xc00]
jne 0xc03494
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc03622
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa9c], edx
cmp word [eax], cx
jne 0xc0350a
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xc0350a
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xc0350a
cmp dword [ecx], 0x4550
jne 0xc0350a
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xbc4]
je 0xc03517
cmp ax, word [ebp - 0xbc8]
je 0xc03517
mov edx, 0xc000000d
jmp 0xc0350f
mov edx, 0xc000007b
mov dword [ebp - 0xa9c], edx
jmp 0xc03529
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xaac], eax
test eax, eax
je 0xc035b3
mov ecx, esi
mov dword [ebp - 0xac4], esi
xor eax, eax
mov dword [ebp - 0xbdc], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xab4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc03553
sub ecx, dword [ebp - 0xab4]
inc esi
add esi, ecx
test edx, edx
js 0xc0359d
mov ecx, dword [ebp - 0xac4]
lea eax, [ebp - 0xbdc]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa9c], edx
test edx, edx
js 0xc035bf
mov eax, dword [ebp - 0xaa4]
mov ecx, dword [ebp - 0xbdc]
mov dword [eax*4 + section..data], ecx
jmp 0xc035a3
mov eax, dword [ebp - 0xaa4]
inc eax
inc ebx
mov dword [ebp - 0xaa4], eax
cmp ebx, dword [ebp - 0xaac]
jb 0xc0353a
add edi, 0x10
cmp byte [esi], 0
jne 0xc0348d
mov ebx, dword [ebp - 0xa9c]
mov esi, dword [ebp - 0xab0]
test esi, esi
je 0xc035e0
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc03636
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc035f9
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc035e8
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc03643
mov ebx, 0xc000007a
jmp 0xc035c5
mov esi, dword [ebp - 0xab0]
mov ebx, 0xc000007a
jmp 0xc035cb
mov eax, dword [0xd0a150]
xor ebx, ebx
inc eax
mov dword [0xd0a150], eax
xor eax, eax
mov edi, 0xd0aed4
xchg dword [edi], eax
push 0x54
lea eax, [ebp - 0x778]
push ebx
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0xadc]
add esp, 0xc
mov esi, dword [0xd0807c]
mov ecx, eax
mov dword [ebp - 0xc30], ebx
push 0xf
pop edx
and ecx, edx
mov dword [ebp - 0xab8], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
push 0x403
and ecx, edx
shr eax, 0xc
push ebx
mov word [ebp - 0xa], cx
and eax, edx
push ebx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xab0], 0xffffff
test eax, eax
jne 0xc036e8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc036d8
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc04b2e
mov ebx, 0x80004005
jmp 0xc04b2e
mov esi, dword [0xd08050]
mov eax, ebx
mov dword [ebp - 0xac0], eax
mov edi, ebx
lea eax, [ebp - 0xc68]
mov dword [ebp - 0xadc], edi
push eax
push ebx
lea eax, [ebp - 0xc1c]
mov dword [ebp - 0xc18], ebx
push eax
push 8
mov ecx, esi
mov dword [ebp - 0xb08], ebx
mov dword [ebp - 0xad0], ebx
mov dword [ebp - 0xc68], ebx
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc037be
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc03750
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc03927
mov ebx, 0x80004005
mov esi, dword [ebp - 0xad0]
xor edx, edx
mov eax, dword [ebp - 0xc18]
test eax, eax
je 0xc0377f
mov ecx, dword [ebp - 0xb08]
test ecx, ecx
je 0xc0377f
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0xc03777
test esi, esi
je 0xc03792
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xc18]
test eax, eax
je 0xc04083
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0xc18], ecx
jmp 0xc04085
mov eax, dword [ebp - 0xc68]
add eax, eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xacc], ebx
test ebx, ebx
je 0xc03859
mov eax, dword [ebp - 0xc1c]
lea eax, [eax*4 + 4]
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xabc], eax
test eax, eax
je 0xc0390c
mov esi, eax
lea eax, [ebp - 0xc68]
push eax
push ebx
mov ebx, dword [0xd08050]
lea eax, [ebp - 0xc1c]
push eax
push 8
mov ecx, ebx
call dword [0xd0cffc]
call ebx
test eax, eax
jne 0xc03863
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc0384b
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc03852
mov ebx, 0x80004005
xor ecx, ecx
jmp 0xc038f7
mov ebx, 0x8007000e
jmp 0xc0375b
mov eax, dword [ebp - 0xabc]
xor ecx, ecx
mov ebx, eax
mov edi, dword [ebp - 0xacc]
mov dword [ebp - 0xaac], ecx
cmp dword [ebp - 0xc1c], ecx
jbe 0xc038d4
mov esi, dword [0xd08058]
push ecx
push edi
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, edi
mov dword [ebx], eax
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0xc0389c
sub ecx, edx
sar ecx, 1
push 4
pop eax
add ebx, eax
mov eax, dword [ebp - 0xaac]
lea edi, [edi + ecx*2]
add edi, 2
inc eax
push 0
mov dword [ebp - 0xaac], eax
pop ecx
cmp eax, dword [ebp - 0xc1c]
jb 0xc03881
mov eax, dword [ebp - 0xabc]
mov dword [ebx], 0x409
mov edi, eax
mov ebx, dword [ebp - 0xac0]
mov esi, ecx
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0xc1c]
inc eax
mov dword [ebp - 0xaac], eax
test esi, esi
je 0xc03911
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc03911
mov ebx, 0x8007000e
push dword [ebp - 0xacc]
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc0375b
xor eax, eax
mov ebx, eax
mov edx, eax
mov dword [ebp - 0xb00], ebx
cmp dword [ebp - 0xaac], eax
jbe 0xc0396e
mov ecx, eax
mov eax, dword [edi + edx*4]
cmp eax, dword [ecx*4 + 0xb40a18]
je 0xc03964
inc ecx
cmp ecx, 0x26
jb 0xc03945
inc edx
xor eax, eax
cmp edx, dword [ebp - 0xaac]
jae 0xc0396e
jmp 0xc03943
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0xb00], ebx
mov esi, dword [0xd08054]
mov ecx, esi
push eax
mov dword [ebp - 0xad4], eax
lea eax, [ebp - 0xc0]
push 0x55
push eax
push dword [ebx*4 + 0xb40a18]
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc039d1
mov esi, dword [0xd08048]
lea eax, [ebp - 0x640]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xc0]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
test eax, eax
jle 0xc039d1
mov edi, dword [ebp - 0x634]
shr edi, 0x1b
and edi, 1
mov dword [ebp - 0xad4], edi
xor eax, eax
mov edx, 0xb2fcd8
mov esi, eax
mov ecx, edx
mov dword [ebp + esi*4 - 0x350], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xc00]
jne 0xc039e6
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0xc039da
imul ecx, ebx, 3
movzx eax, byte [ecx + 0xb320b0]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xcb0], eax
movzx eax, byte [ecx + 0xb320b1]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xcac], eax
movzx eax, byte [ecx + 0xb320b2]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xca8], eax
xor ebx, ebx
push 0x1c90
mov eax, ebx
push ebx
mov dword [ebp - 0xac0], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xaf0], ecx
test ecx, ecx
je 0xc03859
or dword [ebp - 0xabc], 0xffffffff
mov edi, ebx
add ecx, 7
mov dword [ebp - 0x3d0], 0xab69605e
mov al, bl
mov dword [ebp - 0x3cc], 0x7f1137f
mov dword [ebp - 0xaac], ebx
mov esi, 0xb40ac2
mov dword [ebp - 0xb5c], ebx
mov dword [ebp - 0xb8c], edi
mov dword [ebp - 0xacc], ecx
mov dword [ebp - 0xafc], 0x392
movzx ebx, byte [esi - 2]
movzx ecx, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 3]
or edx, ecx
mov dword [ebp - 0xac4], ebx
movzx ecx, byte [esi + 4]
xor edi, ebx
shl edx, 8
mov ebx, 0xab69605e
or edx, ecx
movzx ecx, byte [esi + 5]
shl edx, 8
add esi, 8
or edx, ecx
mov dword [ebp - 0xaec], esi
mov esi, edx
mov dword [ebp - 0xaa4], edx
xor esi, dword [ebp - 0xb5c]
xor esi, edi
xor esi, 0xac987321
lea ecx, [esi + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, esi
rol ecx, 0xa
add edx, ecx
xor edi, edx
lea ecx, [edi + 0x7f1137f]
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, edi
rol ecx, 2
sub edx, ecx
xor esi, edx
imul edx, esi, 0x605e
mov ecx, esi
shr ecx, 0xd
sub edx, ecx
sub edx, 0x756c8a2
xor edi, edx
mov ecx, edi
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, edi
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, ebx
sub ecx, edx
xor edi, ecx
mov ecx, edi
mov edx, edi
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor esi, edx
lea ecx, [esi + 0x7f1137f]
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, esi
rol ecx, 2
add edx, ecx
xor edi, edx
lea ecx, [edi + 0x54969fa2]
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, edi
rol ecx, 8
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, ebx
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, esi
ror ecx, 0xa
xor edx, ecx
xor edi, edx
mov ecx, edi
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, edi
shr ecx, 0xa
xor edx, ecx
xor esi, edx
mov ecx, esi
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor edi, ecx
mov dword [ebp - 0xab4], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xab4]
xor edi, ebx
mov ecx, edi
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, edi
shr ecx, 2
add edx, ecx
xor esi, edx
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, esi
rol ecx, 7
add edx, ecx
xor edi, edx
mov ecx, edi
mov edx, edi
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69
rol ecx, 5
imul edx, ecx, 0x7f1
mov ecx, esi
rol ecx, 7
add edx, ecx
xor edi, edx
mov ebx, edi
xor ebx, esi
xor ebx, 0xac987321
mov ecx, ebx
ror ecx, 3
sub ecx, 0xab69
imul ecx, ecx, 0x137f
xor edi, ecx
lea ecx, [edi - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, edi
ror ecx, 6
sub edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 0xe
add edx, ecx
xor edi, edx
lea ecx, [edi - 0x54969fa2]
mov esi, dword [ebp - 0xaec]
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, edi
ror ecx, 0xe
sub edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, ebx
shr ecx, 3
xor edx, ecx
xor edi, edx
mov ecx, edi
xor ecx, 0x7f1137f
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, edi
xor edi, dword [ebp - 0xabc]
rol ecx, 2
mov dword [ebp - 0xb5c], edi
xor edx, ecx
xor edx, dword [ebp - 0xaac]
xor ebx, edx
mov edx, dword [ebp - 0xacc]
mov dword [ebp - 0xb8c], ebx
mov byte [edx - 4], bl
mov cl, byte [ebp - 0xb5c]
ror dword [ebp - 0xb8c], 8
mov byte [edx], cl
mov cl, byte [ebp - 0xb8c]
ror dword [ebp - 0xb5c], 8
mov byte [edx - 5], cl
mov cl, byte [ebp - 0xb5c]
ror dword [ebp - 0xb8c], 8
mov byte [edx - 1], cl
mov cl, byte [ebp - 0xb8c]
ror dword [ebp - 0xb5c], 8
mov byte [edx - 6], cl
mov cl, byte [ebp - 0xb5c]
ror dword [ebp - 0xb8c], 8
mov byte [edx - 2], cl
mov cl, byte [ebp - 0xb8c]
ror dword [ebp - 0xb5c], 8
mov byte [edx - 7], cl
mov cl, byte [ebp - 0xb5c]
mov byte [edx - 3], cl
add edx, 8
mov edi, dword [ebp - 0xb8c]
mov ecx, dword [ebp - 0xac4]
ror dword [ebp - 0xb5c], 8
ror edi, 8
sub dword [ebp - 0xafc], 1
mov dword [ebp - 0xaac], ecx
mov ecx, dword [ebp - 0xaa4]
mov dword [ebp - 0xb8c], edi
mov dword [ebp - 0xabc], ecx
mov dword [ebp - 0xacc], edx
jne 0xc03aba
xor ecx, ecx
mov esi, 0x1c90
mov edx, ecx
mov ecx, dword [ebp - 0xaf0]
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0xc03e08
movzx eax, al
cdq
cmp eax, dword [0xb42750]
jne 0xc03e3c
cmp edx, dword [0xb42754]
jne 0xc03e3c
mov ebx, dword [ebp - 0xac0]
xor edx, edx
mov dword [ebp - 0xc18], ecx
mov ecx, edx
mov dword [ebp - 0xb08], esi
jmp 0xc03e49
mov ebx, 0xc004d501
xor edx, edx
mov dword [ebp - 0xac0], ebx
test ecx, ecx
je 0xc03e5c
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc0375b
mov esi, dword [ebp - 0xc18]
xor eax, eax
mov ebx, dword [ebp - 0xb00]
mov edi, eax
mov edx, eax
cmp ebx, edx
jne 0xc03e81
mov dword [ebp + edi*4 - 0x300], esi
mov ecx, esi
lea eax, [ecx + 1]
mov dword [ebp - 0xab4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc03e8c
sub ecx, dword [ebp - 0xab4]
inc esi
add esi, ecx
inc edx
cmp edx, 0x26
jb 0xc03e76
inc edi
push 0
pop eax
cmp edi, 6
jb 0xc03e74
push 0xc
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, dword [ebp - 0xac0]
mov edx, eax
mov dword [ebp - 0xaac], edx
test edx, edx
jne 0xc03edb
xor edx, edx
mov ebx, 0x8007000e
mov esi, edx
jmp 0xc03763
mov edi, edx
xor eax, eax
mov esi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xaa4], eax
movzx edx, word [ebp + ecx*2 - 0xc]
cmp dx, word [eax*2 + 0xb40ab0]
je 0xc03f08
inc eax
cmp eax, 6
jb 0xc03ef3
jmp 0xc03fc7
mov edx, dword [ebp + eax*4 - 0x300]
mov ecx, edx
mov dword [ebp - 0xab4], edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc03f1a
xor eax, eax
sub ecx, edi
mov edi, dword [0xd08060]
push eax
push eax
lea eax, [ecx + 1]
mov ecx, edi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0xd0cffc]
call edi
mov dword [ebp - 0xac4], eax
test eax, eax
je 0xc03fff
lea ecx, [eax + eax]
xor eax, eax
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0xaa4]
mov edi, eax
mov eax, dword [ebp - 0xaac]
mov dword [eax + ecx*4], edi
test edi, edi
je 0xc03ff8
mov edx, dword [ebp - 0xab4]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xab4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc03f8c
push dword [ebp - 0xac4]
sub ecx, dword [ebp - 0xab4]
push edi
mov edi, dword [0xd08060]
lea eax, [ecx + 1]
mov ecx, edi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0xd0cffc]
call edi
test eax, eax
je 0xc03fff
mov ecx, dword [ebp - 0xaa4]
inc ecx
mov dword [ebp - 0xaa4], ecx
push 0
pop eax
cmp ecx, 3
jb 0xc03eee
mov eax, dword [ebp - 0xaac]
xor edx, edx
mov dword [ebp - 0xae4], eax
mov esi, edx
mov eax, dword [ebp - 0xad4]
mov dword [ebp - 0x778], eax
jmp 0xc0401f
mov ebx, 0x8007000e
jmp 0xc0401d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc04016
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc0401d
mov ebx, 0x80004005
xor edx, edx
test esi, esi
je 0xc03763
mov edi, edx
mov edx, dword [esi + edi*4]
test edx, edx
je 0xc04078
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0xab4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xc00]
jne 0xc0403b
sub ecx, dword [ebp - 0xab4]
xor eax, eax
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc04067
mov byte [edx], al
inc edx
sub ecx, 1
jne 0xc0405f
push dword [esi + edi*4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
inc edi
cmp edi, 3
jb 0xc04029
jmp 0xc03761
xor ecx, ecx
mov eax, dword [ebp - 0xadc]
test eax, eax
je 0xc0409e
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc04b10
mov eax, dword [ebp - 0xae4]
mov esi, dword [0xd080b4]
mov ecx, dword [eax]
mov dword [ebp - 0x770], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x76c], ecx
xor ecx, ecx
mov eax, dword [eax + 8]
mov edi, ecx
push ecx
mov dword [ebp - 0x768], eax
mov ebx, ecx
lea eax, [ebp - 0xdb4]
mov dword [ebp - 0xdb0], ecx
push eax
push ecx
mov dword [ebp - 0xdac], ecx
mov ecx, esi
push 0x42
mov dword [ebp - 0xdb4], 0xc
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc04121
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc04118
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc0412a
mov ebx, 0x80004005
jmp 0xc0412a
mov edi, dword [ebp - 0xdb0]
and edi, 1
mov dword [ebp - 0x774], edi
test ebx, ebx
js 0xc04b10
mov edi, dword [ebp - 0xab8]
mov eax, edi
push 0x2a
pop ecx
mov dword [ebp - 0xad0], ecx
sub eax, 1
je 0xc04177
sub eax, 1
je 0xc0416b
sub eax, 1
jne 0xc04187
mov ebx, 0xe1
mov dword [ebp - 0xae8], ebx
mov dword [ebp - 0xb10], ebx
jmp 0xc04187
mov dword [ebp - 0xae8], 0xf
jmp 0xc0417d
mov dword [ebp - 0xae8], ecx
mov dword [ebp - 0xb10], 0xb
mov esi, 0xdc
mov dword [ebp - 0xac0], 0x60
push esi
xor ebx, ebx
lea eax, [ebp - 0x720]
push ebx
push eax
call fcn.00bc259b
add esp, 0xc
mov word [ebp - 0x6dc], si
mov esi, dword [0xd08070]
lea eax, [ebp - 0x720]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0428d
movzx ebx, word [ebp - 0x67a]
xor eax, eax
mov ecx, dword [ebp - 0x670]
mov dword [ebp - 0xda4], eax
mov dword [ebp - 0xda8], eax
mov eax, dword [ebp - 0x674]
push 0x60
mov dword [ebp - 0xaa4], eax
mov dword [ebp - 0xda0], eax
pop eax
mov dword [ebp - 0xac0], ebx
mov dword [ebp - 0xaac], ecx
mov dword [ebp - 0xd9c], ecx
cmp ebx, eax
jae 0xc0421e
mov dword [ebp - 0xac0], eax
xor ebx, ebx
cmp edi, 1
mov edi, dword [ebp - 0xcb0]
je 0xc04231
mov edi, dword [ebp - 0xca8]
push 0x5c
lea eax, [ebp - 0x560]
push ebx
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xab4], eax
test eax, eax
jne 0xc042aa
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc0427d
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc0434a
mov ebx, 0x80004005
jmp 0xc04b10
mov eax, dword [ebp - 0xd9c]
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0xda0]
mov dword [ebp - 0xaa4], eax
jmp 0xc04220
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0xac0]
push dword [ebp - 0xae8]
call dword [0xd0cffc]
call esi
push edi
push 0x20
neg eax
mov dword [ebp - 0x550], 0x190
pop edx
lea ecx, [ebp - 0x544]
mov dword [ebp - 0x560], eax
mov byte [ebp - 0x546], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x560]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc0432b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc04322
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc04331
mov ebx, 0x80004005
jmp 0xc04331
mov dword [ebp - 0x764], eax
push dword [ebp - 0xab4]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xc04b10
cmp dword [ebp - 0xab8], 1
mov edi, dword [ebp - 0xcb0]
je 0xc04367
mov edi, dword [ebp - 0xca8]
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0x5c0]
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xab4], eax
test eax, eax
jne 0xc043c5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc043b7
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0xc04283
push 0x20
pop edi
jmp 0xc04467
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0xac0]
push dword [ebp - 0xb10]
call dword [0xd0cffc]
call esi
push edi
push 0x20
pop edi
neg eax
mov dword [ebp - 0x5b0], 0x190
mov edx, edi
mov dword [ebp - 0x5c0], eax
lea ecx, [ebp - 0x5a4]
mov byte [ebp - 0x5a6], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x5c0]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc04448
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc0443f
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc0444e
mov ebx, 0x80004005
jmp 0xc0444e
mov dword [ebp - 0x760], eax
push dword [ebp - 0xab4]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xc04b10
mov ebx, dword [ebp - 0xab8]
xor ecx, ecx
mov eax, ecx
mov edx, ecx
mov ecx, ebx
sub ecx, 1
je 0xc0448c
sub ecx, 1
je 0xc044cc
sub ecx, 1
jne 0xc04498
mov eax, dword [ebp - 0xaa4]
mov edx, dword [ebp - 0xaac]
mov dword [ebp - 0xc28], eax
mov dword [ebp - 0xc24], edx
xor ecx, ecx
inc ecx
cmp ebx, ecx
je 0xc0450c
jbe 0xc044de
cmp ebx, 3
ja 0xc044de
xor ebx, ebx
mov edx, ebx
mov dword [ebp - 0xad0], ebx
mov ecx, ebx
mov dword [ebp - 0xaa4], edx
mov dword [ebp - 0xae8], ebx
jmp 0xc04521
mov eax, dword [ebp - 0xaa4]
push 4
pop ecx
cdq
idiv ecx
xor ecx, ecx
mov edx, ecx
jmp 0xc04498
mov ecx, dword [ebp - 0xc20]
xor ebx, ebx
mov edx, dword [ebp - 0xc20]
mov dword [ebp - 0xae8], ecx
mov ecx, dword [ebp - 0xc20]
mov dword [ebp - 0xad0], ecx
mov ecx, dword [ebp - 0xc20]
mov dword [ebp - 0xaa4], edx
jmp 0xc04521
xor ebx, ebx
mov dword [ebp - 0xae8], edi
mov ecx, 0x96
mov dword [ebp - 0xaa4], ebx
mov edx, ebx
mov dword [ebp - 0xad4], ecx
push dword [ebp - 0x764]
mov esi, dword [0xd0803c]
sub eax, ecx
push dword [ebp - 0xac8]
mov edi, dword [ebp - 0x770]
sub eax, edx
mov ecx, esi
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0x73c], eax
mov dword [ebp - 0x74c], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x754]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xac8]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc04597
mov ebx, 0x80004005
mov eax, dword [ebp - 0xab4]
test eax, eax
je 0xc045b3
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xc04b10
push dword [ebp - 0x760]
mov esi, dword [0xd0803c]
xor eax, eax
push dword [ebp - 0xac8]
mov edi, dword [ebp - 0x76c]
mov ecx, esi
mov ebx, eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x744]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xac8]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc04619
mov ebx, 0x80004005
mov eax, dword [ebp - 0xab4]
test eax, eax
je 0xc04635
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xc04b10
mov eax, dword [ebp - 0xab8]
cmp eax, 2
je 0xc04655
cmp eax, 3
je 0xc04655
mov edi, dword [ebp - 0xac4]
jmp 0xc04669
mov edi, dword [ebp - 0x73c]
cmp dword [ebp - 0x74c], edi
jle 0xc04669
mov edi, dword [ebp - 0x74c]
cmp dword [ebp - 0x778], 0
mov esi, dword [0xd080a8]
mov ecx, esi
push dword [ebp - 0xad0]
je 0xc046bc
mov eax, edi
sub eax, dword [ebp - 0x74c]
add eax, dword [ebp - 0xaa4]
push eax
lea eax, [ebp - 0x754]
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x748]
add eax, dword [ebp - 0xae8]
push eax
mov eax, edi
sub eax, dword [ebp - 0x73c]
add eax, dword [ebp - 0xaa4]
push eax
jmp 0xc046e0
mov ebx, dword [ebp - 0xad4]
lea eax, [ebp - 0x754]
push ebx
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x748]
add eax, dword [ebp - 0xae8]
push eax
push ebx
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x744]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xab8]
cmp eax, 2
je 0xc049c7
cmp eax, 3
je 0xc049c7
cmp eax, 1
jne 0xc049e3
xor eax, eax
mov dword [ebp - 0x758], 0xffffff
push 0x5c
push eax
lea eax, [ebp - 0x620]
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xab4], eax
test eax, eax
jne 0xc0477d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc04772
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc0481e
jmp 0xc04283
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0xac0]
push 0xb
call dword [0xd0cffc]
call esi
push dword [ebp - 0xcac]
neg eax
mov dword [ebp - 0x610], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x604]
mov dword [ebp - 0x620], eax
mov byte [ebp - 0x606], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x620]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc047ff
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc047f6
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc04805
mov ebx, 0x80004005
jmp 0xc04805
mov dword [ebp - 0x75c], eax
push dword [ebp - 0xab4]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xc04b10
push dword [ebp - 0x75c]
mov esi, dword [0xd0803c]
xor eax, eax
push dword [ebp - 0xac8]
mov dword [ebp - 0x72c], edi
mov ecx, esi
mov edi, dword [ebp - 0x768]
mov ebx, eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
push 0x460
lea eax, [ebp - 0x734]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xac8]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc0488a
mov ebx, 0x80004005
mov eax, dword [ebp - 0xab4]
test eax, eax
je 0xc048a6
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xc04b10
mov eax, dword [ebp - 0x72c]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x72c], eax
cmp eax, ecx
jge 0xc048ca
mov dword [ebp - 0x72c], ecx
mov ebx, dword [ebp - 0xac0]
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x60
pop edi
push edi
push ebx
push dword [ebp - 0x734]
mov dword [ebp - 0x728], 0x20
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x730]
mov dword [ebp - 0x734], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x72c]
mov dword [ebp - 0x730], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x728]
mov dword [ebp - 0x72c], eax
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0x778], 0
mov dword [ebp - 0x728], eax
je 0xc049b7
mov ecx, dword [ebp - 0x754]
cmp ecx, dword [ebp - 0x744]
jl 0xc04972
mov ecx, dword [ebp - 0x744]
mov eax, dword [ebp - 0x738]
add eax, 0x24
push eax
push ecx
jmp 0xc0499e
mov ecx, dword [ebp - 0x73c]
mov eax, dword [ebp - 0x738]
add eax, 0x24
push eax
mov eax, dword [ebp - 0x734]
sub eax, dword [ebp - 0x72c]
add eax, ecx
push eax
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x734]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xc049e3
mov ecx, dword [ebp - 0x74c]
cmp ecx, dword [ebp - 0x73c]
jg 0xc04985
jmp 0xc0497f
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0xc28], edi
mov dword [ebp - 0xc24], eax
mov dword [ebp - 0x758], 0xffa8a8a8
mov eax, dword [ebp - 0x778]
lea edi, [ebp - 0xeac]
mov ebx, dword [ebp - 0xc28]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xc24]
mov dword [ebp - 0xaac], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xab8]
sub eax, 1
je 0xc04d26
sub eax, 1
je 0xc04c73
sub eax, 1
jne 0xc04b0e
mov esi, dword [0xd080a4]
lea edi, [ebp - 0x420]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push 1
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08084]
lea ecx, [ebp - 0x420]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x420], 0x28
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc04b0e
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x40c]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x404]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x404]
lea esi, [ebp - 0x40c]
sub eax, ebx
lea edi, [ebp - 0xeac]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc30], eax
mov eax, dword [ebp - 0x400]
sub eax, dword [ebp - 0xaac]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
jmp 0xc04b05
mov eax, dword [ebp - 0x3ac]
sub eax, ebx
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0xc30], eax
mov eax, dword [ebp - 0x3a8]
sub eax, dword [ebp - 0xaac]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0xc2c], eax
xor ebx, ebx
push dword [ebp - 0xac8]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov edi, 0xd0aed4
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc04b2e
mov eax, dword [0xd0a150]
test eax, eax
jle 0xc04b91
sub eax, 1
mov dword [0xd0a150], eax
jne 0xc04b91
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc04b63
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc04b52
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xd0aed4
xor eax, eax
xchg dword [edi], eax
mov eax, dword [ebp - 0xae4]
test eax, eax
je 0xc04bb0
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc0681c
mov edi, dword [ebp - 0xc30]
xor eax, eax
mov ebx, dword [ebp - 0xc2c]
push 0x54
push eax
lea eax, [ebp - 0x7d0]
mov dword [ebp - 0xd84], edi
push eax
mov dword [ebp - 0xd80], ebx
call fcn.00bc259b
mov esi, dword [0xd08028]
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0xaac], 1
push 7
push dword [ebp - 0xaa8]
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc04c53
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x7d0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc04c53
push 0x20
pop eax
cmp word [ebp - 0x7be], ax
jne 0xc04c53
cmp dword [ebp - 0x7bc], 0
je 0xc04c53
cmp dword [ebp - 0x7cc], 0
jle 0xc04c53
cmp dword [ebp - 0x7c8], 0
jg 0xc04d39
xor eax, eax
cmp dword [ebp - 0xab8], 1
mov dword [ebp - 0xaac], eax
je 0xc04d39
mov ebx, dword [ebp - 0xab8]
jmp 0xc04da1
mov esi, dword [0xd080a4]
lea edi, [ebp - 0x3c8]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push 1
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08084]
lea ecx, [ebp - 0x3c8]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x3c8], 0x28
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc04b0e
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x3b4]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x3ac]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xab4], 0
lea esi, [ebp - 0x3b4]
lea edi, [ebp - 0xeac]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xc04ae2
imul eax, dword [ebp - 0x3ac], 5
cdq
idiv ecx
add eax, dword [ebp - 0x3b4]
jmp 0xc04af0
xor ebx, ebx
mov dword [ebp - 0xc30], ebx
mov dword [ebp - 0xc2c], ebx
jmp 0xc04b10
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x754]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x744]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ebx, dword [ebp - 0xab8]
cmp ebx, 1
jne 0xc04da1
mov eax, dword [ebp - 0x774]
mov esi, dword [0xd08014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xb4c], eax
mov esi, dword [0xd08040]
mov ecx, esi
push 1
push dword [ebp - 0xaa8]
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0x778], 0
mov dword [ebp - 0xbc0], eax
mov dword [ebp - 0xaf0], 0x810
je 0xc04ddc
mov dword [ebp - 0xaf0], 0x20812
cmp dword [ebp - 0xaac], 0
je 0xc058f4
mov eax, dword [ebp - 0x774]
mov ebx, dword [ebp - 0x770]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0xab4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x8d8]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa38]
push eax
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x4d0]
xor ecx, ecx
mov dword [ebp - 0xafc], ecx
mov dword [ebp - 0xabc], ecx
push 0x2c
push ecx
push eax
mov dword [ebp - 0xaa4], ecx
mov dword [ebp - 0xaac], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x380]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xc067fc
mov edi, dword [ebp - 0xaa8]
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc04fb8
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x8d8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc04ed2
mov eax, dword [ebp - 0x8c4]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0xaac], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov edi, eax
mov dword [ebp - 0xadc], edi
test edi, edi
je 0xc04fb8
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0xae8], eax
lea eax, [ebp - 0x4d0]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0x74c]
add esp, 0xc
sub eax, dword [ebp - 0x754]
xor ecx, ecx
mov esi, dword [0xd0800c]
mov dword [ebp - 0x4cc], eax
mov eax, dword [ebp - 0x750]
sub eax, dword [ebp - 0x748]
mov dword [ebp - 0x4c8], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x4d0], 0x28
mov word [ebp - 0x4c4], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x4c2], ax
lea eax, [ebp - 0xd30]
push eax
push ecx
lea eax, [ebp - 0x4d0]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xb08], eax
test eax, eax
jne 0xc04fc3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xae8], eax
test eax, eax
jle 0xc04fa3
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xae8], eax
test eax, eax
js 0xc05349
mov dword [ebp - 0xae8], 0x80004005
jmp 0xc05349
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc067fc
mov esi, dword [0xd08034]
lea ecx, [ebp - 0xa38]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc04fed
mov eax, dword [ebp - 0xa24]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0x74c]
sub eax, dword [ebp - 0x754]
push dword [ebp - 0xb08]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x748]
sub eax, dword [ebp - 0x750]
push edi
mov dword [ebp - 0x374], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
mov ecx, esi
push 1
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0xab4]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xaec], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x380]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xaf0]
lea eax, [ebp - 0x380]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xab8], 1
jne 0xc050e0
cmp dword [ebp - 0xac4], 0
je 0xc050d4
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xac0], eax
jmp 0xc050ea
mov dword [ebp - 0xac0], 0xffffff
jmp 0xc050ea
mov dword [ebp - 0xac0], 0xffa8a8a8
mov edi, dword [ebp - 0x754]
xor edx, edx
mov eax, dword [ebp - 0x750]
mov esi, edx
mov dword [ebp - 0xacc], edi
mov ecx, edx
test edi, edi
jns 0xc05112
mov esi, edi
mov dword [ebp - 0xacc], edx
neg esi
mov edi, edx
test eax, eax
jns 0xc0511c
mov ecx, eax
mov eax, edx
neg ecx
mov ebx, dword [ebp - 0x378]
mov edx, dword [ebp - 0xaa4]
sub ebx, esi
sub edx, edi
mov dword [ebp - 0xad4], ebx
cmp ebx, edx
jl 0xc0513e
mov ebx, edx
mov dword [ebp - 0xad4], edx
mov edi, dword [ebp - 0x374]
mov edx, dword [ebp - 0xaac]
sub edi, ecx
sub edx, eax
mov dword [ebp - 0xae4], edi
cmp edi, edx
jl 0xc05160
mov edi, edx
mov dword [ebp - 0xae4], edx
test ebx, ebx
jle 0xc05311
test edi, edi
jle 0xc05311
mov edx, dword [ebp - 0x378]
mov ebx, dword [ebp - 0xafc]
imul ecx, edx
add ecx, esi
mov esi, dword [ebp - 0xabc]
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xaa4]
imul eax, esi
mov dword [ebp - 0xb00], ecx
add eax, dword [ebp - 0xacc]
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xad4]
mov dword [ebp - 0xacc], eax
test edi, edi
jle 0xc05311
shl edx, 2
shl esi, 2
mov dword [ebp - 0xab4], edx
mov dword [ebp - 0xac4], esi
test ebx, ebx
jle 0xc052f2
mov esi, eax
mov dword [ebp - 0xabc], ebx
lea edx, [eax + 3]
sub esi, ecx
mov dword [ebp - 0xad0], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xaac], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc052b2
mov bl, byte [edi + esi]
mov eax, dword [ebp - 0xac0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaac]
add al, bl
mov byte [edi + ecx], al
mov eax, dword [ebp - 0xad0]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xac0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xad0]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xabe]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xad0]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xaac]
cdq
idiv ecx
mov edx, dword [ebp - 0xad0]
add al, bl
mov ebx, dword [ebp - 0xabc]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xad0], edx
mov dword [ebp - 0xabc], ebx
jne 0xc051ec
mov edi, dword [ebp - 0xae4]
mov ebx, dword [ebp - 0xad4]
mov ecx, dword [ebp - 0xb00]
mov eax, dword [ebp - 0xacc]
mov edx, dword [ebp - 0xab4]
mov esi, dword [ebp - 0xac4]
add ecx, edx
add eax, esi
sub edi, 1
mov dword [ebp - 0xb00], ecx
mov dword [ebp - 0xacc], eax
mov dword [ebp - 0xae4], edi
jne 0xc051c8
push dword [ebp - 0xb08]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xaec]
mov edi, dword [ebp - 0xadc]
test eax, eax
je 0xc05349
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xae8], 0
jl 0xc067fc
mov eax, dword [ebp - 0x774]
mov ebx, dword [ebp - 0x76c]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0xab4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x930]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x9e0]
push eax
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x478]
xor ecx, ecx
mov dword [ebp - 0xafc], ecx
mov dword [ebp - 0xabc], ecx
push 0x2c
push ecx
push eax
mov dword [ebp - 0xaa4], ecx
mov dword [ebp - 0xaac], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x370]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xc067fc
mov edi, dword [ebp - 0xaa8]
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc04fb8
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x930]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc05450
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0xaac], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov edi, eax
mov dword [ebp - 0xaec], edi
test edi, edi
je 0xc04fb8
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd3c], eax
mov dword [ebp - 0xae8], eax
lea eax, [ebp - 0x478]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0x73c]
add esp, 0xc
sub eax, dword [ebp - 0x744]
xor ecx, ecx
mov esi, dword [0xd0800c]
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x740]
sub eax, dword [ebp - 0x738]
mov dword [ebp - 0x470], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x478], 0x28
mov word [ebp - 0x46c], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x46a], ax
lea eax, [ebp - 0xd3c]
push eax
push ecx
lea eax, [ebp - 0x478]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xadc], eax
test eax, eax
jne 0xc05536
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xae8], eax
test eax, eax
jle 0xc05521
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xae8], eax
test eax, eax
js 0xc058cb
mov dword [ebp - 0xae8], 0x80004005
jmp 0xc058cb
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x9e0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc05560
mov eax, dword [ebp - 0x9cc]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0x73c]
sub eax, dword [ebp - 0x744]
push dword [ebp - 0xadc]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x738]
sub eax, dword [ebp - 0x740]
push edi
mov dword [ebp - 0x364], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
mov ecx, esi
push 1
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0xab4]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xb10], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x370]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xaf0]
lea eax, [ebp - 0x370]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xab8], 1
jne 0xc0565b
cmp dword [ebp - 0xac4], 0
je 0xc0564f
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov edx, eax
mov dword [ebp - 0xab0], edx
mov dword [ebp - 0xad4], edx
jmp 0xc0566c
mov dword [ebp - 0xad4], 0xffffff
jmp 0xc0566c
mov eax, 0xffa8a8a8
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xad4], eax
mov edi, dword [ebp - 0x744]
xor edx, edx
mov eax, dword [ebp - 0x740]
mov esi, edx
mov dword [ebp - 0xacc], edi
mov ecx, edx
test edi, edi
jns 0xc05694
mov esi, edi
mov dword [ebp - 0xacc], edx
neg esi
mov edi, edx
test eax, eax
jns 0xc0569e
mov ecx, eax
mov eax, edx
neg ecx
mov ebx, dword [ebp - 0x368]
mov edx, dword [ebp - 0xaa4]
sub ebx, esi
sub edx, edi
mov dword [ebp - 0xae4], ebx
cmp ebx, edx
jl 0xc056c0
mov ebx, edx
mov dword [ebp - 0xae4], edx
mov edi, dword [ebp - 0x364]
mov edx, dword [ebp - 0xaac]
sub edi, ecx
sub edx, eax
mov dword [ebp - 0xb08], edi
cmp edi, edx
jl 0xc056e2
mov edi, edx
mov dword [ebp - 0xb08], edx
test ebx, ebx
jle 0xc05893
test edi, edi
jle 0xc05893
mov edx, dword [ebp - 0x368]
mov ebx, dword [ebp - 0xafc]
imul ecx, edx
add ecx, esi
mov esi, dword [ebp - 0xabc]
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xaa4]
imul eax, esi
mov dword [ebp - 0xb00], ecx
add eax, dword [ebp - 0xacc]
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xae4]
mov dword [ebp - 0xacc], eax
test edi, edi
jle 0xc05893
shl edx, 2
shl esi, 2
mov dword [ebp - 0xab4], edx
mov dword [ebp - 0xac4], esi
test ebx, ebx
jle 0xc05874
mov esi, eax
mov dword [ebp - 0xabc], ebx
lea edx, [eax + 3]
sub esi, ecx
mov dword [ebp - 0xac0], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xaac], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc05834
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xab0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaac]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xac0]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xab0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac0]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xad2]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac0]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xaac]
cdq
idiv ecx
mov edx, dword [ebp - 0xac0]
add al, bl
mov ebx, dword [ebp - 0xabc]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xac0], edx
mov dword [ebp - 0xabc], ebx
jne 0xc0576e
mov edi, dword [ebp - 0xb08]
mov ebx, dword [ebp - 0xae4]
mov ecx, dword [ebp - 0xb00]
mov eax, dword [ebp - 0xacc]
mov edx, dword [ebp - 0xab4]
mov esi, dword [ebp - 0xac4]
add ecx, edx
add eax, esi
sub edi, 1
mov dword [ebp - 0xb00], ecx
mov dword [ebp - 0xacc], eax
mov dword [ebp - 0xb08], edi
jne 0xc0574a
push dword [ebp - 0xadc]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xb10]
mov edi, dword [ebp - 0xaec]
test eax, eax
je 0xc058cb
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xae8], 0
jl 0xc067fc
mov edi, dword [ebp - 0xae0]
jmp 0xc067a8
cmp dword [ebp - 0x774], 0
jne 0xc05906
cmp ebx, 1
je 0xc05906
mov al, 0xc0
jmp 0xc05908
or al, 0xff
mov byte [ebp - 0xaea], al
lea edi, [ebp - 0xcc4]
xor eax, eax
mov esi, dword [0xd08008]
stosd dword es:[edi], eax
xor ecx, ecx
push dword [ebp - 0xaa8]
mov byte [ebp - 0xaec], cl
mov byte [ebp - 0xaeb], cl
mov ecx, esi
stosd dword es:[edi], eax
mov byte [ebp - 0xae9], 1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xcd8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xae0], eax
test eax, eax
jne 0xc05966
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc067fc
cmp ebx, 1
jne 0xc05a56
mov ecx, dword [ebp - 0x74c]
mov edx, dword [ebp - 0x73c]
mov ebx, dword [ebp - 0x754]
sub ecx, ebx
mov eax, dword [ebp - 0x744]
sub edx, eax
cmp edx, ecx
jle 0xc05999
mov esi, edx
mov dword [ebp - 0xb14], esi
jmp 0xc059a1
mov esi, ecx
mov dword [ebp - 0xb14], ecx
mov edi, dword [ebp - 0x738]
sub edi, dword [ebp - 0x750]
cmp dword [ebp - 0x778], 0
mov dword [ebp - 0xb18], edi
je 0xc059da
sub ebx, dword [ebp - 0x74c]
sub eax, dword [ebp - 0x73c]
add ebx, esi
add eax, esi
mov dword [ebp - 0xcc4], ebx
mov dword [ebp - 0xcd8], eax
jmp 0xc059e6
mov ebx, dword [ebp - 0xcc4]
mov eax, dword [ebp - 0xcd8]
mov edi, dword [ebp - 0x748]
add ecx, ebx
sub edi, dword [ebp - 0x750]
mov dword [ebp - 0xaa4], ebx
mov ebx, dword [ebp - 0x740]
sub ebx, dword [ebp - 0x750]
mov dword [ebp - 0xb08], ebx
mov dword [ebp - 0xcd4], ebx
sub ebx, dword [ebp - 0x740]
add ebx, dword [ebp - 0x738]
mov dword [ebp - 0xad4], edi
mov dword [ebp - 0xcb8], edi
lea edi, [edx + eax]
mov dword [ebp - 0xae4], ebx
mov dword [ebp - 0xccc], ebx
mov ebx, dword [ebp - 0xb14]
mov dword [ebp - 0xcbc], ecx
mov dword [ebp - 0xaa0], edi
mov dword [ebp - 0xcd0], edi
jmp 0xc05ad6
mov eax, dword [ebp - 0xc24]
lea esi, [ebp - 0x754]
lea edi, [ebp - 0xcc4]
mov ebx, dword [ebp - 0xc28]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0xb14], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xcb8]
lea esi, [ebp - 0x744]
mov ecx, dword [ebp - 0xcbc]
lea edi, [ebp - 0xcd8]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0xcc4]
mov dword [ebp - 0xaa4], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xccc]
mov dword [ebp - 0xae4], eax
mov eax, dword [ebp - 0xcd0]
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0xcd4]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0xcd8]
mov dword [ebp - 0xa98], eax
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd40], eax
lea eax, [ebp - 0x4a4]
push eax
mov dword [ebp - 0xae8], ecx
call fcn.00bc259b
mov eax, dword [ebp - 0xb18]
add esp, 0xc
mov edi, dword [ebp - 0xae0]
neg eax
mov esi, dword [0xd0800c]
xor ecx, ecx
mov dword [ebp - 0x49c], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x4a4], 0x28
mov word [ebp - 0x498], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x496], ax
lea eax, [ebp - 0xd40]
push eax
push ecx
lea eax, [ebp - 0x4a4]
mov dword [ebp - 0x4a0], ebx
push eax
push edi
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xad8], eax
test eax, eax
jne 0xc05b6d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc067e7
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xab8], 1
jne 0xc05bdc
mov ecx, dword [ebp - 0xb4c]
test ecx, ecx
je 0xc05bdc
mov esi, dword [0xd08074]
lea edi, [ebp - 0x39c]
xor eax, eax
stosd dword es:[edi], eax
push ecx
mov ecx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0x394], eax
lea eax, [ebp - 0x3a0]
push eax
mov eax, dword [ebp - 0xae0]
push eax
mov dword [ebp - 0x398], ebx
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x774]
mov ebx, dword [ebp - 0x770]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0xab4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x880]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x988]
push eax
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x4fc]
xor ecx, ecx
mov dword [ebp - 0xafc], ecx
mov dword [ebp - 0xacc], ecx
push 0x2c
push ecx
push eax
mov dword [ebp - 0xb10], ecx
mov dword [ebp - 0xaac], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x360]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xae0]
test ebx, ebx
je 0xc067cc
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc05db3
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x880]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc05cc5
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0xb10], eax
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0xaac], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, eax
mov dword [ebp - 0xac8], esi
test esi, esi
je 0xc05db3
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd44], eax
mov dword [ebp - 0xa9c], eax
lea eax, [ebp - 0x4fc]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0xae8]
add esp, 0xc
mov edi, dword [ebp - 0xaa4]
xor ecx, ecx
sub eax, edi
mov dword [ebp - 0x4fc], 0x28
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0x4f8], eax
mov eax, dword [ebp - 0xcc0]
sub eax, dword [ebp - 0xad4]
mov dword [ebp - 0x4f4], eax
xor eax, eax
push 0x20
inc eax
mov word [ebp - 0x4f0], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x4ee], ax
lea eax, [ebp - 0xd44]
push eax
push ecx
lea eax, [ebp - 0x4fc]
push eax
push esi
mov esi, dword [0xd0800c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xac4], eax
test eax, eax
jne 0xc05dbe
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xa9c], eax
test eax, eax
jle 0xc05d9e
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xa9c], eax
test eax, eax
js 0xc06160
mov dword [ebp - 0xa9c], 0x80004005
jmp 0xc06160
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc067cc
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x988]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc05de8
mov eax, dword [ebp - 0x974]
mov dword [ebp - 0xacc], eax
push dword [ebp - 0xac4]
mov ecx, dword [ebp - 0xae8]
mov eax, dword [ebp - 0xad4]
sub eax, dword [ebp - 0xcc0]
push dword [ebp - 0xac8]
mov esi, dword [0xd0803c]
mov dword [ebp - 0x358], ecx
mov ecx, esi
mov dword [ebp - 0x354], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
mov ecx, esi
push 1
push dword [ebp - 0xac8]
call dword [0xd0cffc]
call esi
push dword [ebp - 0xab4]
mov esi, dword [0xd0803c]
mov ecx, esi
push dword [ebp - 0xac8]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x360]
push eax
push dword [ebp - 0xac8]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xaf0]
lea eax, [ebp - 0x360]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push dword [ebp - 0xac8]
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xab8], 1
jne 0xc05eee
cmp dword [ebp - 0xabc], 0
je 0xc05ee2
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xac0], eax
jmp 0xc05ef8
mov dword [ebp - 0xac0], 0xffffff
jmp 0xc05ef8
mov dword [ebp - 0xac0], 0xffa8a8a8
xor eax, eax
mov dword [ebp - 0xabc], eax
mov edx, eax
mov esi, eax
test edi, edi
jns 0xc05f14
mov edx, edi
mov edi, eax
neg edx
mov dword [ebp - 0xabc], edx
mov ecx, dword [ebp - 0xcc0]
test ecx, ecx
jns 0xc05f24
mov esi, ecx
mov ecx, eax
neg esi
mov eax, dword [ebp - 0xb10]
mov ebx, dword [ebp - 0x358]
sub eax, edi
sub ebx, edx
mov dword [ebp - 0xb00], ebx
cmp ebx, eax
jl 0xc05f46
mov ebx, eax
mov dword [ebp - 0xb00], eax
mov eax, dword [ebp - 0xaac]
mov edx, dword [ebp - 0x354]
sub eax, ecx
sub edx, esi
mov dword [ebp - 0xaa4], edx
cmp edx, eax
jl 0xc05f68
mov edx, eax
mov dword [ebp - 0xaa4], eax
test ebx, ebx
jle 0xc06129
test edx, edx
jle 0xc06129
mov eax, dword [ebp - 0x358]
imul ecx, dword [ebp - 0xb10]
imul eax, esi
mov esi, dword [ebp - 0xacc]
add ecx, edi
add eax, dword [ebp - 0xabc]
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xafc]
mov dword [ebp - 0xad4], eax
lea ecx, [esi + ecx*4]
mov dword [ebp - 0xadc], ecx
test edx, edx
jle 0xc06129
mov esi, dword [ebp - 0x358]
shl esi, 2
mov dword [ebp - 0xacc], esi
mov esi, dword [ebp - 0xb10]
shl esi, 2
mov dword [ebp - 0xafc], esi
mov esi, dword [ebp - 0xacc]
mov edi, dword [ebp - 0xafc]
test ebx, ebx
jle 0xc0610a
mov esi, ecx
mov dword [ebp - 0xabc], ebx
lea edx, [ecx + 3]
sub esi, eax
mov dword [ebp - 0xad0], edx
lea edi, [eax + 2]
mov dword [ebp - 0xaac], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc060ca
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xac0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaac]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xad0]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xac0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xad0]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xabe]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xad0]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xaac]
cdq
idiv ecx
mov edx, dword [ebp - 0xad0]
add al, bl
mov ebx, dword [ebp - 0xabc]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xad0], edx
mov dword [ebp - 0xabc], ebx
jne 0xc06004
mov edx, dword [ebp - 0xaa4]
mov ebx, dword [ebp - 0xb00]
mov eax, dword [ebp - 0xad4]
mov ecx, dword [ebp - 0xadc]
mov esi, dword [ebp - 0xacc]
mov edi, dword [ebp - 0xafc]
add eax, esi
add ecx, edi
sub edx, 1
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xadc], ecx
mov dword [ebp - 0xaa4], edx
jne 0xc05fe0
push dword [ebp - 0xac4]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xab4]
test eax, eax
je 0xc06160
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push dword [ebp - 0xac8]
call dword [0xd0cffc]
call esi
push dword [ebp - 0xac8]
mov esi, dword [0xd08018]
mov ecx, esi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xa9c], 0
jl 0xc067c6
mov eax, dword [ebp - 0x774]
mov ebx, dword [ebp - 0x76c]
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0xab4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x828]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa90]
push eax
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x44c]
xor ecx, ecx
mov dword [ebp - 0xacc], ecx
mov dword [ebp - 0xabc], ecx
push 0x2c
push ecx
push eax
mov dword [ebp - 0xae8], ecx
mov dword [ebp - 0xac4], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x390]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xae0]
test ebx, ebx
je 0xc067cc
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc05db3
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x828]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0626c
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0xac4], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, eax
mov dword [ebp - 0xad0], esi
test esi, esi
je 0xc05db3
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd48], eax
mov dword [ebp - 0xb10], eax
lea eax, [ebp - 0x44c]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0xaa0]
add esp, 0xc
sub eax, dword [ebp - 0xa98]
xor ecx, ecx
mov edi, dword [ebp - 0xb08]
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0x448], eax
mov eax, edi
sub eax, dword [ebp - 0xae4]
mov dword [ebp - 0x444], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x44c], 0x28
mov word [ebp - 0x440], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x43e], ax
lea eax, [ebp - 0xd48]
push eax
push ecx
lea eax, [ebp - 0x44c]
push eax
push esi
mov esi, dword [0xd0800c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xadc], eax
test eax, eax
jne 0xc06360
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xb10], eax
test eax, eax
jle 0xc06345
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb10], eax
test eax, eax
mov edi, dword [ebp - 0xad0]
js 0xc06703
mov dword [ebp - 0xb10], 0x80004005
jmp 0xc06703
mov esi, dword [0xd08034]
lea ecx, [ebp - 0xa90]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0638a
mov eax, dword [ebp - 0xa7c]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0xaa0]
push dword [ebp - 0xadc]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0xae4]
sub eax, edi
mov edi, dword [ebp - 0xad0]
push edi
mov dword [ebp - 0x384], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
mov ecx, esi
push 1
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0xab4]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x390]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xaf0]
lea eax, [ebp - 0x390]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xab8], 1
jne 0xc06481
cmp dword [ebp - 0xaac], 0
je 0xc06475
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov ecx, eax
mov dword [ebp - 0xab0], ecx
mov dword [ebp - 0xaa4], ecx
jmp 0xc06492
mov dword [ebp - 0xaa4], 0xffffff
jmp 0xc06492
mov eax, 0xffa8a8a8
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xaa4], eax
mov edx, dword [ebp - 0xa98]
xor ebx, ebx
mov dword [ebp - 0xaac], ebx
mov esi, ebx
mov eax, ebx
test edx, edx
jns 0xc064b4
mov esi, edx
mov edx, ebx
neg esi
mov dword [ebp - 0xaac], esi
mov ecx, dword [ebp - 0xb08]
test ecx, ecx
jns 0xc064c4
mov eax, ecx
mov ecx, ebx
neg eax
mov ebx, dword [ebp - 0x388]
sub ebx, esi
mov esi, dword [ebp - 0xae8]
sub esi, edx
mov dword [ebp - 0xad4], ebx
cmp ebx, esi
jl 0xc064e6
mov ebx, esi
mov dword [ebp - 0xad4], esi
mov edi, dword [ebp - 0x384]
mov esi, dword [ebp - 0xac4]
sub edi, eax
sub esi, ecx
mov dword [ebp - 0xae4], edi
cmp edi, esi
jl 0xc06508
mov edi, esi
mov dword [ebp - 0xae4], esi
test ebx, ebx
jle 0xc066cb
test edi, edi
jle 0xc066cb
imul ecx, dword [ebp - 0xae8]
mov esi, dword [ebp - 0x388]
mov ebx, dword [ebp - 0xabc]
imul eax, esi
add ecx, edx
mov edx, dword [ebp - 0xacc]
add eax, dword [ebp - 0xaac]
lea ecx, [edx + ecx*4]
mov dword [ebp - 0xb00], ecx
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xad4]
mov dword [ebp - 0xafc], eax
test edi, edi
jle 0xc066cb
mov edx, esi
shl edx, 2
mov dword [ebp - 0xabc], edx
mov edx, dword [ebp - 0xae8]
shl edx, 2
mov dword [ebp - 0xacc], edx
mov edx, dword [ebp - 0xabc]
mov esi, dword [ebp - 0xacc]
test ebx, ebx
jle 0xc066ac
mov esi, ecx
mov dword [ebp - 0xaac], ebx
lea edx, [ecx + 3]
sub esi, eax
mov dword [ebp - 0xac0], edx
lea edi, [eax + 2]
mov dword [ebp - 0xac4], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc0666c
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xab0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac4]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xac0]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xab0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac0]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xaa2]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac0]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xac4]
cdq
idiv ecx
mov edx, dword [ebp - 0xac0]
add al, bl
mov ebx, dword [ebp - 0xaac]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xac0], edx
mov dword [ebp - 0xaac], ebx
jne 0xc065a6
mov edi, dword [ebp - 0xae4]
mov ebx, dword [ebp - 0xad4]
mov eax, dword [ebp - 0xafc]
mov ecx, dword [ebp - 0xb00]
mov edx, dword [ebp - 0xabc]
mov esi, dword [ebp - 0xacc]
add eax, edx
add ecx, esi
sub edi, 1
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0xb00], ecx
mov dword [ebp - 0xae4], edi
jne 0xc06582
push dword [ebp - 0xadc]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xab4]
mov edi, dword [ebp - 0xad0]
test eax, eax
je 0xc06703
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xb10], 0
mov edi, dword [ebp - 0xae0]
jl 0xc067cc
cmp dword [ebp - 0xab8], 1
jne 0xc0676b
mov esi, dword [section..data]
xor eax, eax
push 0xcc0020
push eax
push eax
mov eax, dword [ebp - 0xb14]
mov ecx, esi
push edi
push dword [ebp - 0xb18]
push eax
push dword [ebp - 0x750]
push dword [ebp - 0x754]
push dword [ebp - 0xaa8]
call dword [0xd0cffc]
call esi
jmp 0xc067a8
push dword [ebp - 0xaec]
mov ecx, dword [ebp - 0xb18]
xor edx, edx
mov eax, dword [ebp - 0xb14]
mov esi, dword [0xd08020]
push ecx
push eax
push edx
push edx
push edi
push ecx
push eax
push dword [ebp - 0xc2c]
mov ecx, esi
push dword [ebp - 0xc30]
push dword [ebp - 0xaa8]
call dword [0xd0cffc]
call esi
push dword [ebp - 0xbc0]
mov esi, dword [0xd08040]
mov ecx, esi
push dword [ebp - 0xaa8]
call dword [0xd0cffc]
call esi
jmp 0xc067cc
mov edi, dword [ebp - 0xae0]
mov eax, dword [ebp - 0xad8]
test eax, eax
je 0xc067e7
mov esi, dword [0xd0801c]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
test edi, edi
je 0xc067fc
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xb4c]
test eax, eax
je 0xc06817
mov esi, dword [0xd0801c]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov edi, 0xd0aed4
mov ebx, dword [ebp - 0x770]
xor edx, edx
test ebx, ebx
je 0xc0686f
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0xc0682b
mov eax, dword [ebp - 0x770]
sub ebx, ecx
sar ebx, 1
lea ebx, [ebx*2 + 2]
test ebx, ebx
je 0xc06853
mov byte [eax], dl
inc eax
sub ebx, 1
jne 0xc0684b
push dword [ebp - 0x770]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0x770], edx
mov ebx, dword [ebp - 0x76c]
test ebx, ebx
je 0xc068c2
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0xc0687c
mov eax, dword [ebp - 0x76c]
sub ebx, ecx
sar ebx, 1
lea ebx, [ebx*2 + 2]
test ebx, ebx
je 0xc068a4
mov byte [eax], dl
inc eax
sub ebx, 1
jne 0xc0689c
push dword [ebp - 0x76c]
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x76c], ebx
jmp 0xc068c4
xor ebx, ebx
mov edx, dword [ebp - 0x768]
test edx, edx
je 0xc06910
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc068d3
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc068fb
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xc068ed
mov edx, dword [ebp - 0x768]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x768], ebx
cmp dword [ebp - 0x764], 0
je 0xc06935
push dword [ebp - 0x764]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x764], ebx
cmp dword [ebp - 0x760], 0
je 0xc0695a
push dword [ebp - 0x760]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x760], ebx
cmp dword [ebp - 0x75c], 0
je 0xc0697f
push dword [ebp - 0x75c]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x75c], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc06981
mov eax, dword [0xd0a150]
test eax, eax
jle 0xc069e4
sub eax, 1
mov dword [0xd0a150], eax
jne 0xc069e4
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc069b6
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc069a5
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xd0aed4
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0xd09360]
mov esi, dword [0xd0804c]
mov ecx, esi
mov dword [ebp - 0xabc], eax
call dword [0xd0cffc]
call esi
sub eax, dword [0xd09358]
lea edi, [ebp - 0x2e8]
push 8
mov dword [ebp - 0xaac], eax
mov esi, 0xd0aed4
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xc06a21
mov eax, dword [0xd0a150]
test eax, eax
jne 0xc0701c
xor ebx, ebx
push 0x338
mov esi, ebx
mov dword [ebp - 0xaa4], ebx
push ebx
mov dword [ebp - 0xa9c], ebx
mov dword [ebp - 0xab0], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xbf8], eax
test eax, eax
je 0xc07010
or dword [ebp - 0xac4], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0xad8], ebx
mov dword [ebp - 0xb64], esi
mov dword [ebp - 0xb84], ebx
mov dword [ebp - 0xbdc], eax
mov edi, dword [ebp - 0xb6c]
movzx edx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl edx, 8
or edx, eax
movzx eax, byte [edi]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl edx, 8
or edx, eax
shl edi, 8
mov eax, dword [ebp - 0xb6c]
xor ebx, edx
mov dword [ebp - 0xab4], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb6c]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb6c]
shl edi, 8
add dword [ebp - 0xb6c], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor ebx, edx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xbc0], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea esi, [ebx - 0x7f1]
xor esi, dword [ebp - 0xbc0]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, esi
shr eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor ebx, edx
mov eax, ebx
mov dword [ebp - 0xbc0], ebx
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add edx, eax
xor esi, edx
mov ebx, esi
xor ebx, dword [ebp - 0xbc0]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xac4]
rol eax, 2
mov dword [ebp - 0xb64], esi
mov dword [ebp - 0xac4], edi
xor edx, eax
xor edx, dword [ebp - 0xad8]
xor ebx, edx
mov edx, dword [ebp - 0xbdc]
mov dword [ebp - 0xb84], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb64]
ror dword [ebp - 0xb84], 8
mov byte [edx], al
mov al, byte [ebp - 0xb84]
ror dword [ebp - 0xb64], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb64]
ror dword [ebp - 0xb84], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb84]
ror dword [ebp - 0xb64], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb64]
ror dword [ebp - 0xb84], 8
mov byte [edx - 2], al
ror dword [ebp - 0xb64], 8
mov al, byte [ebp - 0xb84]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb64]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [ebp - 0xb84]
mov esi, dword [ebp - 0xb64]
mov eax, dword [ebp - 0xab4]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xbd8], 1
mov dword [ebp - 0xb84], ebx
mov dword [ebp - 0xb64], esi
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xbdc], edx
jne 0xc06a96
mov esi, dword [ebp - 0xbf8]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc06de7
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xc06e16
cmp edx, dword [0xb2c22c]
jne 0xc06e16
mov edi, esi
xor eax, eax
mov dword [ebp - 0xab0], edi
mov esi, eax
mov ebx, eax
jmp 0xc06e2a
or dword [ebp - 0xbd4], 0xffffffff
mov ebx, 0xc004d501
mov edi, dword [ebp - 0xab0]
xor eax, eax
test esi, esi
je 0xc06e3d
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc0700a
mov eax, dword [ebp - 0xbd4]
xor ecx, ecx
push 0x40
push ecx
mov ebx, 0xd0ae80
mov esi, edi
push ebx
mov byte [eax + edi], cl
call fcn.00bc259b
add esp, 0xc
cmp byte [edi], 0
je 0xc06fa0
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xc00]
jne 0xc06e75
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc07003
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa9c], edx
cmp word [eax], cx
jne 0xc06eeb
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xc06eeb
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xc06eeb
cmp dword [ecx], 0x4550
jne 0xc06eeb
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xbc4]
je 0xc06ef8
cmp ax, word [ebp - 0xbc8]
je 0xc06ef8
mov edx, 0xc000000d
jmp 0xc06ef0
mov edx, 0xc000007b
mov dword [ebp - 0xa9c], edx
jmp 0xc06f0a
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xbf8], eax
test eax, eax
je 0xc06f94
mov ecx, esi
mov dword [ebp - 0xab4], esi
xor eax, eax
mov dword [ebp - 0xaf4], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xbc0], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc06f34
sub ecx, dword [ebp - 0xbc0]
inc esi
add esi, ecx
test edx, edx
js 0xc06f7e
mov ecx, dword [ebp - 0xab4]
lea eax, [ebp - 0xaf4]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa9c], edx
test edx, edx
js 0xc06fa0
mov eax, dword [ebp - 0xaa4]
mov ecx, dword [ebp - 0xaf4]
mov dword [eax*4 + section..data], ecx
jmp 0xc06f84
mov eax, dword [ebp - 0xaa4]
inc eax
inc ebx
mov dword [ebp - 0xaa4], eax
cmp ebx, dword [ebp - 0xbf8]
jb 0xc06f1b
add edi, 0x10
cmp byte [esi], 0
jne 0xc06e6e
mov ebx, dword [ebp - 0xa9c]
mov esi, dword [ebp - 0xab0]
test esi, esi
je 0xc06fc1
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc07017
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc06fda
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc06fc9
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc07022
mov ebx, 0xc000007a
jmp 0xc06fa6
mov esi, dword [ebp - 0xab0]
mov ebx, 0xc000007a
jmp 0xc06fac
mov eax, dword [0xd0a150]
inc eax
mov dword [0xd0a150], eax
xor eax, eax
mov edi, 0xd0aed4
xchg dword [edi], eax
mov eax, dword [ebp - 0xaac]
xor ebx, ebx
mov esi, dword [0xd08068]
inc ebx
mov dword [ebp - 0x2e4], eax
mov ecx, esi
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0x2cc], eax
lea eax, [ebp - 0x2e8]
push eax
push 4
pop eax
push eax
push 0x2021
xor eax, eax
mov dword [ebp - 0x2e8], ebx
push eax
mov dword [ebp - 0x2dc], 0x9966f291
mov dword [ebp - 0x2e0], ebx
mov dword [ebp - 0x2d4], ebx
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2d0], ebx
call dword [0xd0cffc]
call esi
mov ecx, ebx
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc07091
mov eax, dword [0xd0a150]
test eax, eax
jle 0xc070f3
sub eax, 1
mov dword [0xd0a150], eax
jne 0xc070f3
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc070c5
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc070b4
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xd0aed4
jmp 0xc070f5
xor ebx, ebx
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xaa8]
mov esi, dword [0xd080b0]
mov ecx, esi
push ebx
call dword [0xd0cffc]
call esi
jmp 0xc07114
xor ebx, ebx
mov eax, ebx
mov dword [ebp - 0xaa8], ebx
mov dword [ebp - 0xbdc], eax
lea edi, [ebp - 0xcf0]
xor eax, eax
mov dword [ebp - 0xeb4], ebx
stosd dword es:[edi], eax
mov esi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xbc0], ebx
test ebx, ebx
je 0xc09212
push edi
push 0xd08d58
push ebx
call fcn.00bc13d0
mov esi, ebx
add esp, 0xc
mov dword [ebp - 0xa98], esi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0xc09212
mov ecx, dword [0xd08d50]
mov ebx, edi
mov dword [edi], ecx
mov ecx, dword [0xd08d54]
mov dword [edi + 4], ecx
mov dword [ebp - 0xaa8], ebx
rdtsc
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xbf8], edx
xor eax, eax
mov dword [ebp - 0xb9c], eax
lea eax, [ebp - 0xd4c]
push eax
push 4
pop ecx
mov edx, ecx
call fcn.00b84e9a
test eax, eax
js 0xc09218
mov edx, dword [ebp - 0xd4c]
lea eax, [ebp - 0xb9c]
push eax
xor ecx, ecx
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc09218
lea eax, [ebp - 0xd50]
mov edx, 0xa0
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
test eax, eax
js 0xc09218
mov edx, dword [ebp - 0xd50]
lea eax, [ebp - 0xb9c]
mov ecx, dword [ebp - 0xb9c]
push eax
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc09218
lea eax, [ebp - 0xd54]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
test eax, eax
js 0xc09218
mov edx, dword [ebp - 0xd54]
lea eax, [ebp - 0xb9c]
mov ecx, dword [ebp - 0xb9c]
push eax
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc09218
lea eax, [ebp - 0xc4c]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
test eax, eax
js 0xc09218
mov edx, dword [ebp - 0xc4c]
lea eax, [ebp - 0xb9c]
mov ecx, dword [ebp - 0xb9c]
push eax
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc09218
mov esi, dword [ebp - 0xb9c]
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xad8], ebx
test ebx, ebx
je 0xc0920c
mov dword [ebp - 0xbdc], eax
lea eax, [ebp - 0xe98]
mov ecx, ebx
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc0920c
lea ecx, [ebx + esi]
lea eax, [ebx + 8]
mov dword [ebp - 0xaa4], ecx
cmp eax, ecx
ja 0xc0920c
mov eax, dword [ebp - 0xe98]
push 4
pop ecx
mov dword [ebx], ecx
mov dword [eax], ecx
mov esi, ebx
xor eax, eax
mov dword [ebp - 0xbf0], esi
mov dword [ebp - 0xaf4], eax
mov edx, dword [esi]
lea eax, [ebp - 0xc70]
push eax
call fcn.00b84e9a
test eax, eax
js 0xc0920c
mov edx, dword [ebp - 0xc70]
lea eax, [ebp - 0xbf0]
push eax
mov ecx, esi
call fcn.00b84e9a
test eax, eax
js 0xc0920c
mov eax, dword [ebp - 0xaf4]
inc eax
mov dword [ebp - 0xaf4], eax
cmp eax, 1
jae 0xc07379
mov esi, dword [ebp - 0xbf0]
push 4
pop ecx
jmp 0xc0732a
mov ecx, dword [ebp - 0xbf0]
lea eax, [ebp - 0xe74]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc0920c
lea eax, [ecx + 0xa4]
cmp eax, dword [ebp - 0xaa4]
ja 0xc0920c
mov eax, 0xa0
push eax
push dword [ebp - 0xbc0]
mov dword [ecx], eax
push dword [ebp - 0xe74]
call fcn.00bc13d0
add esp, 0xc
mov esi, ebx
xor eax, eax
mov dword [ebp - 0xb94], esi
mov dword [ebp - 0xaf4], eax
mov edx, dword [esi]
lea eax, [ebp - 0xc74]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
test eax, eax
js 0xc0920c
mov edx, dword [ebp - 0xc74]
lea eax, [ebp - 0xb94]
push eax
mov ecx, esi
call fcn.00b84e9a
test eax, eax
js 0xc0920c
mov eax, dword [ebp - 0xaf4]
inc eax
mov dword [ebp - 0xaf4], eax
cmp eax, 2
jae 0xc07427
mov esi, dword [ebp - 0xb94]
jmp 0xc073d6
mov ecx, dword [ebp - 0xb94]
lea eax, [ebp - 0xe7c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc0920c
lea eax, [ecx + 0xc]
cmp eax, dword [ebp - 0xaa4]
ja 0xc0920c
mov dword [ecx], 8
mov ecx, dword [ebp - 0xe7c]
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
xor eax, eax
mov dword [ebp - 0xb04], ebx
push 4
mov esi, eax
pop edi
mov edx, dword [ebx]
lea eax, [ebp - 0xc78]
push eax
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xc0920c
mov edx, dword [ebp - 0xc78]
lea eax, [ebp - 0xb04]
push eax
mov ecx, ebx
call fcn.00b84e9a
test eax, eax
js 0xc0920c
inc esi
cmp esi, 3
jae 0xc074ba
mov ebx, dword [ebp - 0xb04]
jmp 0xc07478
mov ecx, dword [ebp - 0xb04]
lea eax, [ebp - 0xe84]
push eax
mov edx, edi
call fcn.00b84e9a
test eax, eax
js 0xc0920c
lea eax, [ecx + 0xc]
cmp eax, dword [ebp - 0xaa4]
ja 0xc0920c
mov eax, dword [ebp - 0xe84]
push 8
pop ebx
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xab4]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xbf8]
mov dword [eax + 4], ecx
lea eax, [ebp - 0xbfc]
push eax
push 4
pop ecx
mov edx, ecx
call fcn.00b84e9a
test eax, eax
js 0xc0920c
mov esi, dword [ebp - 0xbfc]
lea eax, [ebp - 0xb48]
push eax
mov edx, ebx
mov dword [ebp - 0xba0], esi
call fcn.00b84e9a
test eax, eax
js 0xc0920c
mov edx, dword [ebp - 0xb48]
lea eax, [ebp - 0xba0]
push eax
mov ecx, esi
call fcn.00b84e9a
test eax, eax
js 0xc0920c
xor ecx, ecx
rdtsc
mov edi, ecx
mov dword [ebp - 0xad4], ecx
mov ebx, ecx
mov dword [ebp - 0xad0], edi
mov dword [ebp - 0xb74], ebx
mov dword [ebp - 0xa9c], ecx
mov dword [ebp - 0xac4], ecx
mov dword [ebp - 0xbc8], ecx
mov dword [ebp - 0xaf8], ecx
mov dword [ebp - 0xbf4], ecx
mov dword [ebp - 0xbc4], ecx
mov dword [ebp - 0xaa4], ecx
mov dword [ebp - 0xb48], eax
mov dword [ebp - 0xbfc], edx
push 8
pop ecx
mov dword [ebp - 0xca4], ecx
mov edx, dword [ebp - 0xb9c]
lea eax, [ebp - 0xca4]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc076bc
mov eax, dword [ebp - 0xca4]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0xaf4], ecx
cmp ecx, eax
jae 0xc075ed
mov esi, 0xc0000095
jmp 0xc076bc
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc0760f
mov esi, 0xc0000017
mov edi, ebx
jmp 0xc076bc
push 4
pop ecx
lea eax, [ebp - 0xbbc]
mov dword [edi], ecx
mov edx, ecx
mov dword [ebp - 0xbbc], edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc076a1
mov ecx, dword [ebp - 0xbbc]
mov eax, dword [ebp - 0xb9c]
mov dword [ecx], eax
lea eax, [ebp - 0xbbc]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc076a1
mov eax, dword [ebp - 0xaf4]
push dword [ebp - 0xb9c]
mov ecx, dword [ebp - 0xb48]
push dword [ebp - 0xad8]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xbfc]
push dword [ebp - 0xbbc]
mov dword [edi + eax - 4], ecx
call fcn.00bc13d0
mov eax, dword [ebp - 0xaf4]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xad4], edi
mov edi, ecx
mov dword [ebp - 0xad0], eax
jmp 0xc076a3
xor ecx, ecx
test edi, edi
je 0xc076b6
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xad0]
or esi, 0x10000000
jl 0xc09027
mov esi, dword [ebp - 0xad4]
xor ecx, ecx
mov dword [ebp - 0xbf0], ecx
test esi, esi
jne 0xc076e4
mov esi, 0xc000000d
jmp 0xc07e31
test edi, edi
je 0xc07e2c
lea eax, [edi + 8]
push eax
push ecx
mov dword [ebp - 0xbd4], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xbd8], eax
test eax, eax
je 0xc07e2c
xor ecx, ecx
mov dl, cl
test edi, edi
je 0xc07722
xor dl, byte [ecx + esi]
inc ecx
cmp ecx, edi
jb 0xc0771a
mov dword [ebp - 0xb04], esi
or ecx, 0xffffffff
mov esi, eax
mov dword [ebp - 0xb40], ecx
xor eax, eax
mov dword [ebp - 0xb7c], esi
mov dword [ebp - 0xb1c], eax
mov dword [ebp - 0xb3c], eax
xor eax, eax
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xb6c], eax
je 0xc0785a
xor esi, esi
mov dword [ebp - 0xb6c], eax
mov ecx, eax
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0xac0], ecx
jbe 0xc077da
mov ebx, dword [ebp - 0xb04]
mov edi, eax
push 0x38
pop ecx
mov esi, ecx
push 4
pop ecx
cmp eax, ecx
movzx eax, byte [ebx]
jge 0xc07799
lea ecx, [esi - 0x20]
shl eax, cl
mov ecx, dword [ebp - 0xac0]
or edi, eax
jmp 0xc077ab
mov ecx, esi
shl eax, cl
mov ecx, dword [ebp - 0xac0]
or ecx, eax
mov dword [ebp - 0xac0], ecx
mov eax, dword [ebp - 0xaf4]
sub esi, 8
inc eax
inc ebx
mov dword [ebp - 0xaf4], eax
test eax, eax
js 0xc07780
mov dword [ebp - 0xb6c], edi
xor esi, esi
mov edi, dword [ebp - 0xad0]
mov dword [ebp - 0xb04], ebx
mov ebx, dword [ebp - 0xb74]
mov eax, dword [ebp - 0xb6c]
xor ecx, 0x42f6b18d
xor eax, 0xb17a307a
cmp dword [ebp - 0xc00], 0
mov dword [ebp - 0xb1c], eax
mov dword [ebp - 0xb3c], eax
jbe 0xc07835
mov ebx, dword [ebp - 0xb7c]
cmp esi, 4
jge 0xc07812
rol eax, 8
mov byte [ebx], al
jmp 0xc07817
rol ecx, 8
mov byte [ebx], cl
inc ebx
add esi, 1
js 0xc07806
mov eax, dword [ebp - 0xb3c]
mov dword [ebp - 0xb7c], ebx
mov ebx, dword [ebp - 0xb74]
mov dword [ebp - 0xb1c], eax
push 0xfffffffffffffffc
xor eax, eax
pop esi
mov ecx, eax
mov dword [ebp - 0xb40], ecx
test esi, esi
jg 0xc07854
jns 0xc07854
mov dword [ebp - 0xb1c], eax
mov dword [ebp - 0xb3c], eax
mov esi, dword [ebp - 0xb7c]
mov eax, edi
shr eax, 3
mov dword [ebp - 0xaf4], eax
test eax, eax
je 0xc07c50
mov ebx, dword [ebp - 0xb04]
lea eax, [esi + 7]
mov dword [ebp - 0xb94], eax
add ebx, 2
movzx edi, byte [ebx - 2]
movzx eax, byte [ebx - 1]
movzx esi, byte [ebx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ebx]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 3]
or esi, eax
movzx eax, byte [ebx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ebx + 5]
add ebx, 8
shl esi, 8
or esi, eax
mov dword [ebp - 0xb48], ebx
xor ecx, esi
mov dword [ebp - 0xaa0], ecx
lea ebx, [ecx - 0x4a58]
mov ecx, 0xc81ecb17
xor ebx, edi
xor ebx, dword [ebp - 0xb1c]
xor ebx, ecx
mov eax, ebx
xor eax, ecx
ror eax, 0xf
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 7
add ecx, eax
mov eax, dword [ebp - 0xaa0]
xor eax, ecx
mov dword [ebp - 0xaa0], eax
add eax, 0xb1b54a58
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xaa0]
ror eax, 0xa
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0xcb17
rol eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
rol eax, 5
add ecx, eax
mov eax, dword [ebp - 0xaa0]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xaa0], eax
xor ecx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, ecx
xor ebx, eax
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 6
sub ecx, eax
sub ecx, 0x339b6838
xor dword [ebp - 0xaa0], ecx
mov ecx, dword [ebp - 0xaa0]
mov eax, ecx
ror eax, 0xf
xor eax, 0xcb17
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, 0xc81e
imul eax, eax, 0xcb17
xor ecx, eax
mov dword [ebp - 0xaa0], ecx
lea eax, [ecx + 0x37e0ea91]
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0xc81e
ror ecx, 0xa
imul eax, eax, 0xb1b5
xor ecx, eax
mov eax, dword [ebp - 0xaa0]
xor eax, ecx
mov dword [ebp - 0xaa0], eax
xor eax, 0x4a58
rol eax, 6
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xaa0]
ror eax, 3
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xaa0]
mov eax, ebx
ror eax, 0xf
sub eax, 0xc81e
imul eax, eax, 0x4a58
xor ecx, eax
mov dword [ebp - 0xaa0], ecx
xor ecx, 0xc81e
mov eax, dword [ebp - 0xaa0]
shr eax, 1
imul ecx, ecx, 0x4a58
xor ecx, eax
mov eax, dword [ebp - 0xaa0]
add eax, 0xffff34e9
xor ebx, ecx
rol eax, 3
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xaa0]
shr eax, 0xf
xor ecx, eax
xor ebx, ecx
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 0xd
sub ecx, eax
mov eax, 0xb1b54a58
add ecx, 0x730581bd
xor dword [ebp - 0xaa0], ecx
sub eax, dword [ebp - 0xaa0]
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xaa0]
ror eax, 0xb
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xaa0]
lea eax, [ebx + 0x4e49ed8a]
xor ecx, eax
mov dword [ebp - 0xaa0], ecx
mov eax, dword [ebp - 0xaa0]
xor eax, 0xb1b5
ror ecx, 7
imul eax, eax, 0x4a58
sub eax, ecx
xor ebx, eax
mov eax, ebx
xor eax, 0xc81e
rol eax, 4
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0x10
sub ecx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xaa0], ecx
sub eax, dword [ebp - 0xaa0]
ror eax, 0xa
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xaa0]
ror eax, 4
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x4e4ab5a8]
ror eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
ror eax, 9
xor ecx, eax
mov eax, dword [ebp - 0xaa0]
xor eax, ecx
mov dword [ebp - 0xaa0], eax
xor eax, 0xc81ecb17
rol eax, 8
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xaa0]
rol eax, 2
sub ecx, eax
mov eax, 0xc81ecb17
xor ebx, ecx
sub eax, ebx
ror eax, 0xb
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0xc
sub ecx, eax
mov eax, dword [ebp - 0xaa0]
xor eax, ecx
mov dword [ebp - 0xaa0], eax
xor eax, 0xb1b5
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xaa0]
shr eax, 8
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor ebx, dword [ebp - 0xb6c]
xor eax, dword [ebp - 0xaa0]
xor eax, dword [ebp - 0xac0]
xor eax, 0x79ab814f
mov dword [ebp - 0xb3c], ebx
mov dword [ebp - 0xb40], eax
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0xb6c], edi
mov dword [ebp - 0xac0], esi
mov byte [eax - 4], bl
mov al, byte [ebp - 0xb40]
mov ebx, dword [ebp - 0xb94]
ror dword [ebp - 0xb3c], 8
mov byte [ebx], al
mov al, byte [ebp - 0xb3c]
ror dword [ebp - 0xb40], 8
mov byte [ebx - 5], al
mov al, byte [ebp - 0xb40]
ror dword [ebp - 0xb3c], 8
mov byte [ebx - 1], al
mov al, byte [ebp - 0xb3c]
ror dword [ebp - 0xb40], 8
mov byte [ebx - 6], al
mov al, byte [ebp - 0xb40]
ror dword [ebp - 0xb3c], 8
mov byte [ebx - 2], al
ror dword [ebp - 0xb40], 8
mov al, byte [ebp - 0xb3c]
mov byte [ebx - 7], al
mov al, byte [ebp - 0xb40]
mov byte [ebx - 3], al
add ebx, 8
mov eax, dword [ebp - 0xb3c]
mov ecx, dword [ebp - 0xb40]
ror eax, 8
ror ecx, 8
sub dword [ebp - 0xaf4], 1
mov dword [ebp - 0xb94], ebx
mov ebx, dword [ebp - 0xb48]
mov dword [ebp - 0xb1c], eax
mov dword [ebp - 0xb3c], eax
mov dword [ebp - 0xb40], ecx
jne 0xc0787f
mov ebx, dword [ebp - 0xb74]
mov edi, dword [ebp - 0xad0]
mov esi, dword [ebp - 0xbd8]
movzx eax, dl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc07c82
mov esi, 0xc0000017
jmp 0xc07d92
mov eax, dword [ebp - 0xbd4]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc07d06
mov dword [edi + 4], eax
push dword [ebp - 0xbd4]
push esi
push eax
call fcn.00bc13d0
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc07d06
mov dword [edi + 0xc], eax
push 0xa0
push 0xd08ca8
push eax
call fcn.00bc13d0
add esp, 0xc
mov dword [edi + 0x10], esi
push esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xc07d0f
mov esi, 0xc0000017
jmp 0xc07d2b
mov esi, 0xc0000017
xor edx, edx
jmp 0xc07d2b
mov dword [edi + 0x14], ecx
mov esi, edx
mov eax, dword [0xd08d48]
mov dword [ecx], eax
mov eax, dword [0xd08d4c]
mov dword [ebp - 0xbf0], edi
mov edi, edx
mov dword [ecx + 4], eax
test edi, edi
je 0xc07d92
cmp dword [edi + 4], 0
je 0xc07d4b
push dword [edi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 4], edx
cmp dword [edi + 0xc], 0
je 0xc07d67
push dword [edi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0xc], edx
cmp dword [edi + 0x14], 0
je 0xc07d83
push dword [edi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0x14], edx
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
test esi, esi
js 0xc07da8
mov ebx, dword [ebp - 0xbf0]
mov edi, eax
mov dword [ebp - 0xb74], ebx
jmp 0xc07dae
mov edi, dword [ebp - 0xbf0]
push dword [ebp - 0xbd8]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xc07e31
xor eax, eax
cmp dword [edi + 4], eax
je 0xc07de3
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc07dff
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc07e1b
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc07e31
mov esi, 0xc0000001
or esi, 0x10000000
jl 0xc09021
mov edx, dword [ebx]
lea eax, [ebp - 0xba8]
push 4
pop edi
push eax
mov ecx, edi
mov dword [ebp - 0xba8], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc07ecc
mov ecx, dword [ebp - 0xba8]
lea eax, [ebp - 0xba8]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc07ecc
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xba8]
mov ecx, dword [ebp - 0xba8]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc07ecc
mov ecx, dword [ebp - 0xba8]
lea eax, [ebp - 0xba8]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc07ecc
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xba8]
mov ecx, dword [ebp - 0xba8]
push eax
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xba8]
test esi, esi
jns 0xc07ed2
mov eax, dword [ebp - 0xe30]
mov dword [ebp - 0xaf4], eax
test esi, esi
js 0xc0802b
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc07f00
mov esi, 0xc0000017
jmp 0xc0802b
mov eax, dword [ebx]
mov ecx, edi
mov dword [edi], eax
lea eax, [ebp - 0xb60]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xb60], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc08016
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0xb60]
call fcn.00bc13d0
mov edx, dword [ebx]
lea eax, [ebp - 0xb60]
mov ecx, dword [ebp - 0xb60]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc08016
mov ecx, dword [ebp - 0xb60]
mov eax, dword [ebx + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xb60]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc08016
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0xb60]
call fcn.00bc13d0
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xb60]
mov ecx, dword [ebp - 0xb60]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc08016
mov ecx, dword [ebp - 0xb60]
mov eax, dword [ebx + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xb60]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc08016
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0xb60]
call fcn.00bc13d0
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xb60]
mov ecx, dword [ebp - 0xb60]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
xor ecx, ecx
test esi, esi
js 0xc08018
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0xa9c], edi
mov edi, ecx
mov dword [ebp - 0xac4], eax
jmp 0xc08018
xor ecx, ecx
test edi, edi
je 0xc0802b
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xc09021
xor eax, eax
mov dword [ebp - 0xcb4], 8
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0xb04], eax
mov edx, dword [ebp - 0xba0]
lea eax, [ebp - 0xcb4]
push eax
push 8
pop ecx
call fcn.00b84e9a
mov esi, eax
or esi, 0x10000000
jl 0xc08278
mov eax, dword [ebp - 0xcb4]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xc08089
mov esi, 0xc0000095
jmp 0xc080aa
mov dword [ebp - 0xca0], ecx
lea eax, [ebp - 0xca0]
push eax
push 8
pop edx
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xca0]
test esi, esi
jns 0xc080b0
mov eax, dword [ebp - 0xd58]
mov dword [ebp - 0xb94], eax
test esi, esi
js 0xc08278
mov ebx, dword [ebp - 0xad8]
xor eax, eax
mov ecx, ebx
mov edi, eax
mov dword [ebp - 0xb68], ecx
mov eax, dword [ecx]
mov dword [ebp - 0xb48], eax
lea eax, [ebp - 0xb68]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc08278
mov edx, dword [ebp - 0xb48]
lea eax, [ebp - 0xb68]
mov ecx, dword [ebp - 0xb68]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc08278
mov ecx, dword [ebp - 0xb68]
inc edi
cmp edi, 1
jb 0xc080d0
mov edi, dword [ecx]
lea eax, [ebp - 0xb68]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc08278
mov dword [ebp - 0xaf4], edi
xor eax, eax
mov dword [ebp - 0xb1c], ebx
mov edi, eax
lea eax, [ebp - 0xb1c]
mov ecx, ebx
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc081b0
mov edx, dword [ebx]
lea eax, [ebp - 0xb1c]
mov ecx, dword [ebp - 0xb1c]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc081b0
inc edi
cmp edi, 2
jae 0xc0818f
mov ebx, dword [ebp - 0xb1c]
jmp 0xc0814e
mov ecx, dword [ebp - 0xb1c]
lea eax, [ebp - 0xb1c]
push eax
push 4
pop eax
mov edi, dword [ecx]
mov edx, eax
call fcn.00b84e9a
mov esi, eax
mov ebx, edi
test esi, esi
jns 0xc081be
mov ebx, dword [ebp - 0xb04]
test esi, esi
js 0xc08278
mov edx, dword [ebp - 0xb94]
lea eax, [ebp - 0xbb4]
push 4
pop edi
push eax
mov ecx, edi
mov dword [ebp - 0xbb4], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc08253
mov ecx, dword [ebp - 0xbb4]
lea eax, [ebp - 0xbb4]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc08253
mov edx, dword [ebp - 0xaf4]
lea eax, [ebp - 0xbb4]
mov ecx, dword [ebp - 0xbb4]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc08253
mov ecx, dword [ebp - 0xbb4]
lea eax, [ebp - 0xbb4]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc08253
mov ecx, dword [ebp - 0xbb4]
lea eax, [ebp - 0xbb4]
push eax
mov edx, ebx
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xbb4]
test esi, esi
jns 0xc0825d
mov eax, dword [ebp - 0xe4c]
test esi, esi
js 0xc08278
cmp eax, 0x400000
jbe 0xc0826e
mov esi, 0x8000ffff
jmp 0xc09021
mov edi, eax
mov dword [ebp - 0xaf8], edi
jmp 0xc0827e
mov edi, dword [ebp - 0xaf8]
test esi, esi
js 0xc09021
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc082a7
mov ecx, dword [ebp - 0xbc8]
mov esi, 0xd0000017
jmp 0xc082b4
mov ecx, eax
mov dword [ebp - 0xbc8], eax
mov esi, 0x10000000
mov ebx, dword [ebp - 0xa9c]
test esi, esi
js 0xc09027
test ebx, ebx
je 0xc0835a
test ecx, ecx
je 0xc0835a
mov eax, dword [ebp - 0xac4]
mov dword [ebp - 0xdf8], eax
xor eax, eax
mov dword [ebp - 0xdf0], eax
lea eax, [ebp - 0xd5c]
push eax
push 0xb2be98
push 1
mov dword [ebp - 0xe00], ebx
mov dword [ebp - 0xdfc], ecx
mov dword [ebp - 0xdf4], edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc08364
push 0xb2be7c
push dword [ebp - 0xd5c]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xc08364
xor eax, eax
mov ecx, esi
push eax
push 0x14
lea eax, [ebp - 0xe00]
push eax
push 0x86
call dword [0xd0cffc]
call esi
mov esi, eax
or esi, 0x10000000
jl 0xc08382
mov edi, dword [ebp - 0xdf4]
mov dword [ebp - 0xaf8], edi
jmp 0xc08382
mov esi, 0x80070057
jmp 0xc09027
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc0837b
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc08382
mov esi, 0x80004005
cmp esi, 0xd0000023
jne 0xc08394
mov esi, 0x8007007a
jmp 0xc09027
test esi, esi
js 0xc09027
mov eax, dword [ebp - 0xbc8]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xb2c], ecx
mov ebx, ecx
mov dword [ebp - 0xb98], eax
cmp edi, edx
jae 0xc083c3
mov esi, 0xc000003e
jmp 0xc0879e
mov edi, dword [eax]
lea ecx, [ebp - 0xb98]
push ecx
mov ecx, eax
mov dword [ebp - 0xb48], edi
call fcn.00b84e9a
mov esi, eax
xor ecx, ecx
test esi, esi
js 0xc0879e
lea eax, [ebp - 0xb2c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0879c
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb2c]
cmp eax, edi
jb 0xc085e4
mov eax, dword [ebp - 0xb98]
lea ecx, [ebp - 0xb98]
push ecx
mov edx, edi
mov dword [ebp - 0xba0], eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0879c
mov ecx, dword [ebp - 0xb2c]
lea eax, [ebp - 0xb2c]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0879c
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb2c]
push 4
pop edx
cmp eax, edx
jb 0xc085e4
mov ecx, dword [ebp - 0xb98]
lea eax, [ebp - 0xb98]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0xbfc], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0879c
mov ecx, dword [ebp - 0xb2c]
lea eax, [ebp - 0xb2c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0879c
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb2c]
cmp eax, edi
jb 0xc085e4
mov eax, dword [ebp - 0xb98]
lea ecx, [ebp - 0xb98]
push ecx
mov edx, edi
mov dword [ebp - 0xaf4], eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0879c
mov ecx, dword [ebp - 0xb2c]
lea eax, [ebp - 0xb2c]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0879c
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb2c]
push 4
pop edx
cmp eax, edx
jb 0xc085e4
mov ecx, dword [ebp - 0xb98]
mov eax, dword [ecx]
mov dword [ebp - 0xb04], eax
lea eax, [ebp - 0xb98]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0879c
mov ecx, dword [ebp - 0xb2c]
lea eax, [ebp - 0xb2c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0879c
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb2c]
mov ecx, dword [ebp - 0xb04]
cmp eax, ecx
jb 0xc085e4
lea eax, [ebp - 0xb2c]
mov edx, ecx
mov ecx, dword [ebp - 0xb2c]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0879c
mov ecx, dword [ebp - 0xaf8]
mov eax, ecx
sub eax, dword [ebp - 0xb2c]
jne 0xc085e4
mov eax, dword [ebp - 0xb04]
mov esi, dword [ebp - 0xb48]
add eax, 0xc
add eax, edi
add eax, esi
cmp eax, ecx
jne 0xc085e4
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc085ee
mov esi, 0xc0000017
jmp 0xc08727
mov esi, 0xc000003e
jmp 0xc0879c
cmp dword [ebp - 0xba0], ebx
je 0xc0862f
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc08623
mov dword [edi + 4], eax
push esi
push dword [ebp - 0xba0]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc08636
mov esi, 0xc0000017
xor eax, eax
jmp 0xc086c0
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
cmp dword [ebp - 0xaf4], ebx
je 0xc08672
mov esi, dword [ebp - 0xbfc]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc08623
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xaf4]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc08678
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
cmp dword [ebp - 0xb98], ebx
je 0xc086b4
mov esi, dword [ebp - 0xb04]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc08623
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xb98]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc086ba
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov ebx, edi
mov esi, eax
mov edi, eax
test edi, edi
je 0xc08727
cmp dword [edi + 4], 0
je 0xc086e0
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc086fc
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc08718
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test esi, esi
js 0xc08735
mov dword [ebp - 0xbf4], ebx
mov ebx, ecx
test ebx, ebx
je 0xc0879e
cmp dword [ebx + 4], 0
je 0xc08755
push dword [ebx + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 4], ecx
cmp dword [ebx + 0xc], 0
je 0xc08771
push dword [ebx + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 0xc], ecx
cmp dword [ebx + 0x14], 0
je 0xc0878d
push dword [ebx + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 0x14], ecx
push ebx
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
or esi, 0x10000000
jl 0xc09021
mov eax, dword [ebp - 0xbf4]
mov edi, ecx
mov dword [ebp - 0xc70], edi
mov dword [ebp - 0xc4c], ecx
test eax, eax
je 0xc08869
mov esi, dword [eax + 4]
mov dword [ebp - 0xc78], esi
test esi, esi
je 0xc08869
mov ebx, dword [eax]
test ebx, ebx
je 0xc08869
add ebx, 0xfffffff8
mov dword [ebp - 0xc74], ecx
push ebx
push ecx
mov dword [ebp - 0xbbc], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xbd8], eax
test eax, eax
je 0xc08d89
xor ecx, ecx
mov edi, esi
mov dl, cl
mov dword [ebp - 0xba0], edi
mov esi, ebx
mov ecx, eax
mov dword [ebp - 0xb04], ecx
and esi, 7
je 0xc08d2b
xor ebx, ebx
or eax, 0xffffffff
mov dword [ebp - 0xb24], eax
mov eax, ebx
mov dword [ebp - 0xb34], ebx
mov dword [ebp - 0xc04], ebx
mov dword [ebp - 0xb1c], eax
test esi, esi
je 0xc088ab
push 0x38
pop eax
push 4
pop ecx
cmp ebx, ecx
jge 0xc08873
lea ecx, [eax - 0x20]
movzx eax, byte [edi]
shl eax, cl
or dword [ebp - 0xb1c], eax
jmp 0xc08884
mov esi, 0xd000000d
jmp 0xc08da5
movzx eax, byte [edi]
mov ecx, dword [ebp - 0xba4]
shl eax, cl
or dword [ebp - 0xc04], eax
mov eax, dword [ebp - 0xba4]
inc ebx
sub eax, 8
inc edi
mov dword [ebp - 0xba4], eax
cmp ebx, esi
jl 0xc08852
mov ecx, dword [ebp - 0xb04]
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0xba0], edi
mov ebx, dword [ebp - 0xc04]
xor eax, 0x92f65a5
xor ebx, 0x699a899c
mov dword [ebp - 0xac8], eax
xor edi, edi
mov dword [ebp - 0xb34], eax
mov dword [ebp - 0xb24], ebx
test esi, esi
je 0xc08903
cmp edi, 4
jge 0xc088e0
rol eax, 8
mov byte [ecx], al
jmp 0xc088e5
rol ebx, 8
mov byte [ecx], bl
inc edi
inc ecx
cmp edi, esi
jl 0xc088d4
mov eax, dword [ebp - 0xb34]
mov ebx, dword [ebp - 0xb24]
mov dword [ebp - 0xb04], ecx
mov dword [ebp - 0xac8], eax
add esi, 0xfffffffc
test esi, esi
jle 0xc08cfd
push 4
pop eax
mov ecx, eax
sub ecx, esi
shl ecx, 3
shr ebx, cl
shl ebx, cl
mov dword [ebp - 0xb48], ebx
mov edi, ebx
mov dword [ebp - 0xb24], ebx
mov esi, dword [ebp - 0xac8]
mov ebx, dword [ebp - 0xbbc]
mov eax, ebx
shr eax, 3
mov dword [ebp - 0xbd4], eax
test eax, eax
je 0xc08cc4
mov eax, dword [ebp - 0xb04]
mov ecx, dword [ebp - 0xba0]
add eax, 7
add ecx, 2
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0xb68], ecx
movzx ebx, byte [ecx - 2]
movzx eax, byte [ecx - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 1]
movzx ecx, byte [ecx + 2]
shl ecx, 8
shl ebx, 8
or ebx, eax
mov eax, dword [ebp - 0xb68]
xor esi, ebx
mov dword [ebp - 0xb48], ebx
mov dword [ebp - 0xac8], esi
mov ebx, dword [ebp - 0xac8]
movzx eax, byte [eax + 3]
or ecx, eax
mov eax, dword [ebp - 0xb68]
shl ecx, 8
movzx eax, byte [eax + 4]
or ecx, eax
mov eax, dword [ebp - 0xb68]
shl ecx, 8
add dword [ebp - 0xb68], 8
movzx eax, byte [eax + 5]
or ecx, eax
mov esi, ecx
mov dword [ebp - 0xbfc], ecx
xor esi, edi
mov edi, 0xab69605e
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul ecx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub ecx, eax
xor esi, ecx
imul ecx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub ecx, eax
sub ecx, 0x756c8a2
xor ebx, ecx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, edi
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0x137f
ror ecx, 6
imul eax, eax, 0xab69
xor ecx, eax
xor esi, ecx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, esi
rol eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub ecx, eax
xor esi, ecx
mov eax, esi
xor eax, edi
ror eax, 0xc
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x7f1
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea edi, [ebx - 0x7f1]
xor edi, esi
xor edi, 0xab69605e
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul ecx, eax, 0x137f
mov eax, edi
shr eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 7
add ecx, eax
xor edi, ecx
mov eax, edi
mov ecx, edi
xor eax, 0x137f
ror ecx, 9
imul eax, eax, 0x605e
add ecx, eax
xor ebx, ecx
mov eax, ebx
mov dword [ebp - 0xac8], ebx
xor eax, 0xab69
rol eax, 5
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add ecx, eax
xor edi, ecx
mov ebx, edi
xor ebx, dword [ebp - 0xac8]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor edi, eax
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul ecx, eax, 0x605e
mov eax, edi
ror eax, 6
sub ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add ecx, eax
xor edi, ecx
lea eax, [edi - 0x54969fa2]
rol eax, 0xf
imul ecx, eax, 0x137f
mov eax, edi
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x605e
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor ecx, eax
xor edi, ecx
mov eax, edi
xor eax, 0x7f1137f
rol eax, 4
imul ecx, eax, 0x605e
mov eax, edi
xor edi, dword [ebp - 0xc04]
rol eax, 2
mov dword [ebp - 0xb24], edi
xor ecx, eax
xor ecx, dword [ebp - 0xb1c]
xor ebx, ecx
mov ecx, dword [ebp - 0xaf4]
mov dword [ebp - 0xb34], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb24]
ror dword [ebp - 0xb34], 8
mov byte [ecx], al
mov al, byte [ebp - 0xb34]
ror dword [ebp - 0xb24], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb24]
ror dword [ebp - 0xb34], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xb34]
ror dword [ebp - 0xb24], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xb24]
ror dword [ebp - 0xb34], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xb24], 8
mov al, byte [ebp - 0xb34]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb24]
mov byte [ecx - 3], al
add ecx, 8
mov esi, dword [ebp - 0xb34]
mov edi, dword [ebp - 0xb24]
mov eax, dword [ebp - 0xb48]
ror esi, 8
ror edi, 8
sub dword [ebp - 0xbd4], 1
mov dword [ebp - 0xb1c], eax
mov eax, dword [ebp - 0xbfc]
mov dword [ebp - 0xaf4], ecx
mov ecx, dword [ebp - 0xb68]
mov dword [ebp - 0xb34], esi
mov dword [ebp - 0xb24], edi
mov dword [ebp - 0xc04], eax
jne 0xc08967
mov ebx, dword [ebp - 0xbbc]
mov ecx, dword [ebp - 0xbd8]
xor eax, eax
test ebx, ebx
je 0xc08cd8
xor dl, byte [eax + ecx]
inc eax
cmp eax, ebx
jb 0xc08cd0
mov esi, dword [ebp - 0xc78]
movzx eax, dl
cdq
cmp eax, dword [ebx + esi]
jne 0xc08d48
cmp edx, dword [ebx + esi + 4]
jne 0xc08d48
xor eax, eax
mov edi, ecx
mov esi, ebx
mov ecx, eax
mov ebx, dword [ebp - 0xc74]
jmp 0xc08d5b
xor ecx, ecx
mov edi, ecx
mov dword [ebp - 0xb24], edi
test esi, esi
jns 0xc0892a
neg esi
shl esi, 3
mov ecx, esi
shr eax, cl
shl eax, cl
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xb34], eax
jmp 0xc0892a
xor eax, eax
mov edi, eax
mov dword [ebp - 0xb1c], eax
mov esi, eax
mov dword [ebp - 0xb24], edi
mov dword [ebp - 0xb34], esi
jmp 0xc08936
mov edi, dword [ebp - 0xc70]
mov ebx, 0xc004d501
mov esi, dword [ebp - 0xc4c]
xor eax, eax
test ecx, ecx
je 0xc08d6e
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc08d89
xor ecx, ecx
mov dword [ebp - 0xbc4], edi
mov dword [ebp - 0xaa4], esi
mov edi, ecx
mov esi, 0x10000000
jmp 0xc08d90
mov esi, 0xd0000001
xor ecx, ecx
test edi, edi
je 0xc08da5
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test esi, esi
js 0xc09021
mov edi, dword [ebp - 0xaa4]
push 4
pop ebx
mov dword [ebp - 0xb7c], ecx
mov ecx, dword [ebp - 0xbc4]
mov dword [ebp - 0xc44], ecx
cmp edi, ebx
jb 0xc09016
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0xb48], eax
lea eax, [ebp - 0xc44]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0901b
lea eax, [ebp - 0xb7c]
mov edx, ebx
push eax
xor ecx, ecx
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0901b
mov eax, edi
sub eax, dword [ebp - 0xb7c]
cmp eax, ebx
jb 0xc09016
mov ecx, dword [ebp - 0xc44]
lea eax, [ebp - 0xc44]
push eax
push 4
pop eax
mov ebx, dword [ecx]
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0901b
mov ecx, dword [ebp - 0xb7c]
lea eax, [ebp - 0xb7c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0901b
mov ecx, dword [ebp - 0xb7c]
mov eax, edi
sub eax, ecx
cmp eax, ebx
jb 0xc09016
lea eax, [ebp - 0xb7c]
mov edx, ebx
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0901b
mov edi, dword [ebp - 0xc44]
mov edx, dword [ebp - 0xaa4]
mov esi, dword [ebp - 0xbc4]
lea ecx, [ebx + edi]
lea eax, [edx + esi]
cmp eax, ecx
jb 0xc09016
sub edx, ebx
sub edx, edi
add edx, esi
cmp edx, 8
jae 0xc09016
xor ecx, ecx
mov dword [ebp - 0xb04], ecx
mov eax, ecx
mov dword [ebp - 0xba4], eax
mov esi, ecx
test edi, edi
je 0xc08fad
lea eax, [ebp - 0xc6c]
mov dword [ebp - 0xba0], edi
push eax
mov edx, ebx
mov ecx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0901b
mov eax, dword [ebp - 0xc6c]
cmp edi, eax
jae 0xc08fa3
lea eax, [ebp - 0xd60]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0901b
mov eax, dword [ebp - 0xc6c]
cmp dword [ebp - 0xd60], eax
ja 0xc08fd2
mov edx, dword [ecx]
lea eax, [ebp - 0xd64]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc08f53
mov eax, dword [ebp - 0xd64]
mov dword [ebp - 0xd68], eax
jmp 0xc08f59
mov eax, dword [ebp - 0xd68]
test esi, esi
js 0xc0901b
lea ecx, [ebp - 0xc50]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xba0]
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0901b
mov ecx, dword [ebp - 0xc50]
mov eax, dword [ebp - 0xc6c]
mov dword [ebp - 0xba0], ecx
cmp ecx, eax
ja 0xc08fd2
inc dword [ebp - 0xb04]
cmp ecx, eax
jb 0xc08eff
cmp ecx, eax
jne 0xc08fd2
mov eax, dword [ebp - 0xba4]
test ebx, ebx
je 0xc08fdd
push ebx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xba4], eax
test eax, eax
jne 0xc08fd9
mov esi, 0xc0000017
jmp 0xc09004
mov esi, 0xc000000d
jmp 0xc0901b
xor ecx, ecx
mov esi, ecx
test edi, edi
je 0xc08ff2
push ebx
push edi
push eax
call fcn.00bc13d0
mov eax, dword [ebp - 0xba4]
add esp, 0xc
mov dword [ebp - 0xce8], eax
mov eax, dword [ebp - 0xb04]
mov dword [ebp - 0xcf0], eax
test esi, esi
js 0xc0901b
mov eax, dword [ebp - 0xb48]
cmp eax, dword [ebp - 0xcf0]
je 0xc0901b
mov esi, 0xc000003e
or esi, 0x10000000
mov ebx, dword [ebp - 0xa9c]
mov eax, dword [ebp - 0xad4]
test eax, eax
je 0xc09042
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xb74]
test edi, edi
je 0xc090b0
xor eax, eax
cmp dword [edi + 4], eax
je 0xc09069
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc09085
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc090a1
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
je 0xc090c7
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc090c9
xor ebx, ebx
mov eax, dword [ebp - 0xbc8]
test eax, eax
je 0xc090e2
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ebx, dword [ebp - 0xbf4]
test ebx, ebx
je 0xc09150
xor eax, eax
cmp dword [ebx + 4], eax
je 0xc09109
push dword [ebx + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 4], eax
cmp dword [ebx + 0xc], 0
je 0xc09125
push dword [ebx + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0xc], eax
cmp dword [ebx + 0x14], 0
je 0xc09141
push dword [ebx + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0x14], eax
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbc4]
test eax, eax
je 0xc0916b
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc0920c
mov esi, dword [ebp - 0xcf0]
xor ebx, ebx
inc ebx
cmp esi, ebx
jb 0xc0920c
mov ecx, dword [ebp - 0xce8]
test ecx, ecx
je 0xc0920c
test esi, esi
je 0xc0920c
lea eax, [ebp - 0xc84]
mov dword [ebp - 0xc84], ecx
push eax
push 4
pop edi
mov edx, edi
call fcn.00b84e9a
test eax, eax
js 0xc0920c
mov eax, dword [ecx]
neg eax
sbb eax, eax
and eax, dword [ebp - 0xc84]
cmp dword [ecx], edi
jne 0xc0920c
cmp dword [eax], 0
jl 0xc0920c
cmp esi, ebx
jbe 0xc0920c
xor eax, eax
mov dword [ebp - 0xc34], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xc34]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc0920c
mov ecx, dword [ebp - 0xc34]
lea eax, [ebp - 0xc34]
push eax
mov edx, edi
call fcn.00b84e9a
test eax, eax
js 0xc0920c
inc esi
cmp esi, ebx
jae 0xc0920c
mov ecx, dword [ebp - 0xc34]
jmp 0xc091d0
mov esi, dword [ebp - 0xa98]
mov ebx, dword [ebp - 0xaa8]
mov eax, dword [ebp - 0xbdc]
test eax, eax
je 0xc09233
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ecx, dword [ebp - 0xce8]
test ecx, ecx
je 0xc0924e
push ecx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
je 0xc09263
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
je 0xbb070c
push ebx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbb070c
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
jmp 0xbb079e
cmp ebx, 0xd0000034
jne 0xc092a4
mov ebx, 0xc004f012
mov esi, ebx
xor ebx, ebx
inc ebx
jmp 0xbb07c3
cmp ebx, 0xd00000e5
je 0xc092c3
cmp ebx, 0xc004d501
je 0xc092c3
cmp ebx, 0xd000003e
jne 0xc092c8
mov ebx, 0xc004f028
jmp 0xc0929a
mov ebx, 0xc004f027
test ebx, ebx
jns 0xbb07ac
cmp ebx, 0x8007007a
jne 0xc0929a
mov esi, 0xc004f01e
jmp 0xc0929c
mov ecx, dword [ebp + 4]
mov edx, 0x9b
push esi
push 0xb2f560
call fcn.00b913f8
jmp 0xbb07de