Function at 0x464e3a
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Link many functions at runtime
Parse pe header
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push 0xd3c
mov eax, 0x4adadd
call fcn.004a95a1
xor ebx, ebx
mov dword [ebp - 0xcd8], ebx
mov dword [ebp - 0xcd4], ebx
mov dword [ebp - 0xcd0], ebx
lea eax, [ebp - 0xc74]
mov dword [ebp - 4], ebx
push eax
push 0x20219
push ebx
push 0x40ebc0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc74], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x464ee6
lea ecx, [ebp - 0xcd8]
call fcn.0041a5f7
mov ecx, dword [ebp - 0xc74]
mov dword [ebp - 0xcd8], ecx
test eax, eax
jne 0x464ee6
lea eax, [ebp - 0xcb4]
mov dword [ebp - 0xc7c], ebx
push eax
lea eax, [ebp - 0xc7c]
mov dword [ebp - 0xcb4], 4
push eax
lea eax, [ebp - 0xc2c]
push eax
push ebx
push 0x40ec50
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor eax, eax
inc eax
cmp dword [ebp - 0xc7c], eax
jne 0x464ee6
mov bl, al
jmp 0x46e5c3
mov dword [ebp - 0xc48], ebx
mov edx, 0x4ba824
mov dword [ebp - 0xc38], ebx
mov dword [ebp - 0xc18], ebx
mov dword [ebp - 0xc14], ebx
mov dword [ebp - 0xb3c], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x464f0b
mov eax, dword [0x4ba820]
mov esi, 0x7f1137f
mov dword [ebp - 0xbf8], 0x41167a
mov dword [ebp - 0xb98], 0x67
mov dword [ebp - 0xb8c], 0x337
mov dword [ebp - 0xc00], 0x10b
mov dword [ebp - 0xb9c], 0x20b
push 0
pop ebx
test eax, eax
jne 0x4655ce
push 0x338
mov edi, ebx
mov dword [ebp - 0xb80], ebx
push ebx
mov dword [ebp - 0xb40], edi
mov dword [ebp - 0xb4c], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb60], eax
test eax, eax
je 0x465567
or dword [ebp - 0xb48], 0xffffffff
mov eax, ebx
mov cl, bl
mov dword [ebp - 0xb2c], ebx
mov dword [ebp - 0xb54], ebx
mov ebx, 0x7f1137f
mov dword [ebp - 0xbc4], eax
movzx eax, bx
xor ebx, 0xab69605e
mov dword [ebp - 0x3b4], esi
movzx edx, word [ebp - 0x3b2]
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0xb60]
mov dword [ebp - 0x3b8], 0xab69605e
add eax, 7
movzx esi, word [ebp - 0x3b6]
mov dword [ebp - 0xb28], esi
mov esi, 0x41167a
mov dword [ebp - 0xbfc], edi
mov dword [ebp - 0xbb8], ebx
mov dword [ebp - 0xb1c], edx
mov dword [ebp - 0xb68], eax
mov dword [ebp - 0xb64], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edx, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edx, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edx, eax
mov dword [ebp - 0xb50], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
mov ebx, dword [ebp - 0xb54]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 5]
shl edx, 8
add esi, 8
or edx, eax
mov dword [ebp - 0xb10], esi
xor ebx, edx
mov eax, dword [ebp - 0xb0c]
xor ebx, edi
mov dword [ebp - 0xb24], edx
xor ebx, dword [ebp - 0xbb8]
mov edx, ebx
rol edx, 0xa
lea esi, [ebx + 0x54969fa2]
rol esi, 5
imul eax, esi
mov esi, 0x7f1137f
add edx, eax
mov eax, dword [ebp - 0xb28]
xor edi, edx
mov edx, edi
rol edx, 2
lea esi, [esi + edi]
ror esi, 9
imul eax, esi
mov esi, dword [ebp - 0xb28]
sub eax, edx
xor ebx, eax
mov eax, ebx
sub eax, dword [ebp - 0xb0c]
imul edx, eax, 0x605e
mov eax, ebx
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xb1c]
xor edi, edx
xor esi, edi
mov edx, edi
rol esi, 6
imul eax, esi
mov esi, 0x7f1137f
rol edx, 2
sub eax, edx
xor ebx, eax
mov eax, esi
mov edx, ebx
xor edx, 0xab69605e
sub eax, edx
xor edi, eax
mov eax, dword [ebp - 0xb0c]
xor eax, edi
mov edx, edi
imul eax, dword [ebp - 0xb28]
ror edx, 6
xor edx, eax
xor ebx, edx
mov edx, ebx
rol edx, 2
lea eax, [esi + ebx]
ror eax, 0xf
imul eax, eax, 0x605e
add edx, eax
xor edi, edx
mov eax, dword [ebp - 0xb1c]
mov edx, edi
rol edx, 8
lea esi, [edi + 0x54969fa2]
ror esi, 0xe
imul eax, esi
sub eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, dword [ebp - 0xb0c]
xor eax, edx
mov edx, dword [ebp - 0xb1c]
xor edi, eax
xor edx, edi
mov eax, edi
imul edx, dword [ebp - 0xb28]
shr eax, 0xa
xor edx, eax
xor edx, ebx
mov ebx, dword [ebp - 0xb1c]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, ebx
xor edi, eax
mov dword [ebp - 0xb6c], edi
sub edi, ebx
xor edi, edx
mov edx, ebx
mov ebx, dword [ebp - 0xb6c]
xor edi, 0xab69605e
xor edx, edi
mov eax, edi
rol edx, 2
imul edx, dword [ebp - 0xb0c]
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov esi, ebx
mov edx, ebx
sub esi, eax
rol edx, 7
mov eax, dword [ebp - 0xb28]
ror esi, 6
imul eax, esi
mov esi, dword [ebp - 0xb28]
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, dword [ebp - 0xb0c]
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
mov eax, dword [ebp - 0xb1c]
xor ebx, edx
xor esi, ebx
mov dword [ebp - 0xb6c], ebx
rol esi, 5
mov edx, ebx
imul eax, esi
rol edx, 7
add edx, eax
xor edi, edx
mov edx, 0x7f1137f
mov ebx, edi
xor ebx, dword [ebp - 0xb6c]
xor ebx, dword [ebp - 0xbb8]
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xb28]
imul eax, dword [ebp - 0xb0c]
xor edi, eax
mov eax, edi
sub eax, edx
mov edx, edi
ror eax, 1
imul eax, eax, 0x605e
ror edx, 6
sub eax, edx
xor ebx, eax
mov eax, dword [ebp - 0xb1c]
mov edx, ebx
rol edx, 0xe
lea esi, [ebx - 0x54969fa2]
rol esi, 3
imul eax, esi
mov esi, dword [ebp - 0xb10]
add edx, eax
xor edi, edx
mov eax, edi
ror eax, 0xe
lea edx, [edi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xb0c]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
shr eax, 3
xor edx, 0x605e
imul edx, dword [ebp - 0xb28]
xor edx, eax
mov eax, 0x7f1137f
xor edi, edx
xor eax, edi
mov edx, edi
xor edi, dword [ebp - 0xb48]
rol eax, 4
imul eax, eax, 0x605e
rol edx, 2
mov dword [ebp - 0xbc4], edi
xor edx, eax
xor edx, dword [ebp - 0xb2c]
xor ebx, edx
mov edx, dword [ebp - 0xb68]
mov dword [ebp - 0xbfc], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xbc4]
ror dword [ebp - 0xbfc], 8
mov byte [edx], al
mov al, byte [ebp - 0xbfc]
ror dword [ebp - 0xbc4], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xbc4]
ror dword [ebp - 0xbfc], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xbfc]
ror dword [ebp - 0xbc4], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xbc4]
ror dword [ebp - 0xbfc], 8
mov byte [edx - 2], al
ror dword [ebp - 0xbc4], 8
mov al, byte [ebp - 0xbfc]
mov byte [edx - 7], al
mov al, byte [ebp - 0xbc4]
mov byte [edx - 3], al
add edx, 8
mov eax, dword [ebp - 0xbc4]
mov edi, dword [ebp - 0xbfc]
ror eax, 8
mov dword [ebp - 0xb54], eax
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0xb50]
ror edi, 8
sub dword [ebp - 0xb64], 1
mov dword [ebp - 0xb2c], eax
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0xbfc], edi
mov dword [ebp - 0xb48], eax
mov dword [ebp - 0xb68], edx
jne 0x465019
mov esi, dword [ebp - 0xb60]
xor ebx, ebx
mov edx, ebx
xor cl, byte [edx + esi]
inc edx
cmp edx, 0x338
jb 0x46539f
movzx eax, cl
cdq
cmp eax, dword [0x4119b0]
jne 0x4653d5
cmp edx, dword [0x4119b4]
jne 0x4653d5
mov edi, esi
mov dword [ebp - 0xb40], esi
mov esi, ebx
mov dword [ebp - 0xbb8], 0x337
jmp 0x4653e8
or dword [ebp - 0xbb8], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xb4c], 0xc004d501
test esi, esi
je 0x4653fb
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xb4c], ebx
jl 0x465561
mov eax, dword [ebp - 0xbb8]
mov esi, edi
push 0x40
push ebx
push 0x4b9980
mov byte [eax + edi], bl
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], bl
je 0x46556e
mov edi, 0x4b9980
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb50], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x46543c
sub ecx, dword [ebp - 0xb50]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x46555a
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb28], ecx
cmp word [eax], dx
je 0x465484
mov ecx, 0xc000007b
mov dword [ebp - 0xb28], ecx
jmp 0x4654cc
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x465477
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x465477
cmp dword [edx], 0x4550
jne 0x465477
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc00]
je 0x4654ba
cmp ax, word [ebp - 0xb9c]
je 0x4654ba
mov ecx, 0xc000000d
jmp 0x46547c
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb10], eax
mov dword [ebp - 0xbb8], ebx
test eax, eax
je 0x465547
mov edx, esi
mov dword [ebp - 0xb24], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb50], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x4654f3
sub edx, dword [ebp - 0xb50]
inc esi
add esi, edx
test ecx, ecx
js 0x46552c
push dword [ebp - 0xb24]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x465552
mov ecx, dword [ebp - 0xb80]
mov dword [ecx*4 + 0x4b7010], eax
mov ecx, dword [ebp - 0xb28]
mov eax, dword [ebp - 0xbb8]
inc dword [ebp - 0xb80]
inc eax
mov dword [ebp - 0xbb8], eax
cmp eax, dword [ebp - 0xb10]
jb 0x4654e2
add edi, 0x10
cmp byte [esi], bl
jne 0x46542f
mov esi, dword [ebp - 0xb28]
jmp 0x465570
mov esi, 0xc000007a
jmp 0x465570
mov edi, dword [ebp - 0xb40]
mov esi, 0xc000007a
jmp 0x465576
mov esi, ebx
mov edi, dword [ebp - 0xb40]
test edi, edi
je 0x465589
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x4655c9
mov esi, ebx
mov eax, dword [esi + 0x4b9980]
test eax, eax
je 0x4655a0
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x46558f
push 0x40
push ebx
push 0x4b9980
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x402210
mov edi, 0x4b7010
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x4655d4
mov eax, dword [0x4ba820]
inc eax
mov dword [0x4ba820], eax
xor eax, eax
mov ecx, 0x4ba824
xchg dword [ecx], eax
mov eax, dword fs:[0x30]
mov edi, ebx
mov dword [ebp - 0xc40], ebx
mov dword [ebp - 0xc4c], ebx
cmp dword [eax + 0x1d4], 0
je 0x46589f
mov esi, dword [0x4b7098]
mov ecx, esi
call dword [0x4bb544]
call esi
mov ecx, eax
mov dword [ebp - 0xb50], ecx
test ecx, ecx
jne 0x465641
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x465631
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x4658a7
mov edi, 0x80004005
jmp 0x4658a7
mov dword [ebp - 0xc04], ebx
mov edi, ebx
mov eax, ebx
mov esi, ebx
lea edx, [ebp - 0xc6c]
push edx
push eax
push esi
mov esi, dword [0x4b70a8]
push 2
push ecx
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
jne 0x4656dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4656c8
cmp dword [ebp - 0xc04], 0
jne 0x4656c1
push dword [ebp - 0xc6c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xc04]
mov esi, eax
call fcn.004a83ac
test esi, esi
je 0x4656ba
mov eax, dword [ebp - 0xc6c]
mov ecx, dword [ebp - 0xb50]
mov dword [ebp - 0xc04], esi
jmp 0x46564d
mov edi, 0x8007000e
jmp 0x4656e9
mov edi, 0x80004005
jmp 0x4656ef
test eax, eax
je 0x4656c1
jg 0x4656d2
mov edi, eax
jmp 0x4656ef
movzx edi, ax
or edi, 0x80070000
jmp 0x4656ef
mov eax, dword [ebp - 0xc04]
mov dword [ebp - 0xc40], eax
mov dword [ebp - 0xc04], ebx
lea ecx, [ebp - 0xc04]
call fcn.004a83ac
test edi, edi
js 0x4658a7
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [0x4b70a4]
mov ecx, esi
push eax
call dword [0x4bb544]
call esi
mov ecx, eax
mov dword [ebp - 0xb50], ecx
test ecx, ecx
je 0x46561a
mov dword [ebp - 0xc08], ebx
mov edi, ebx
mov eax, ebx
mov esi, ebx
lea edx, [ebp - 0xc78]
push edx
push eax
push esi
mov esi, dword [0x4b70a8]
push 2
push ecx
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
jne 0x4657c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4657b0
cmp dword [ebp - 0xc08], 0
jne 0x4657a9
push dword [ebp - 0xc78]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xc08]
mov esi, eax
call fcn.004a83ac
test esi, esi
je 0x4657a2
mov eax, dword [ebp - 0xc78]
mov ecx, dword [ebp - 0xb50]
mov dword [ebp - 0xc08], esi
jmp 0x465735
mov edi, 0x8007000e
jmp 0x4657d1
mov edi, 0x80004005
jmp 0x4657d7
test eax, eax
je 0x4657a9
jg 0x4657ba
mov edi, eax
jmp 0x4657d7
movzx edi, ax
or edi, 0x80070000
jmp 0x4657d7
mov eax, dword [ebp - 0xc08]
mov dword [ebp - 0xc4c], eax
mov dword [ebp - 0xc08], ebx
lea ecx, [ebp - 0xc08]
call fcn.004a83ac
test edi, edi
js 0x4658a7
mov eax, dword [ebp - 0xc40]
test eax, eax
je 0x46589f
mov ecx, 0x41125c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x465826
test dx, dx
je 0x46581f
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x465826
add eax, 4
add ecx, 4
test dx, dx
jne 0x4657fd
xor esi, esi
mov eax, ebx
inc esi
jmp 0x46582d
sbb eax, eax
xor esi, esi
inc esi
or eax, esi
test eax, eax
jne 0x46589f
mov eax, dword [ebp - 0xc4c]
test eax, eax
je 0x46589f
mov ecx, 0x41126c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x465866
test dx, dx
je 0x465862
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x465866
add eax, 4
add ecx, 4
test dx, dx
jne 0x465840
mov eax, ebx
jmp 0x46586a
sbb eax, eax
or eax, esi
test eax, eax
jne 0x46589f
push 4
lea eax, [ebp - 0xc70]
mov dword [ebp - 0xc70], ebx
push eax
push 0xb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
test eax, eax
je 0x46561a
test byte [ebp - 0xc70], 0xf
mov eax, esi
je 0x4658a1
mov eax, ebx
mov dword [ebp - 0xb3c], eax
lea ecx, [ebp - 0xc4c]
call fcn.004a83ac
lea ecx, [ebp - 0xc40]
call fcn.004a83ac
test edi, edi
jns 0x4658c7
mov dword [ebp - 0xb3c], ebx
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea ecx, [ebp - 0xc14]
mov dword [ebp - 0xb58], esi
call fcn.004a8395
test esi, esi
jne 0x4658f8
mov esi, ebx
mov dword [ebp - 0xc14], ebx
mov dword [ebp - 0xb58], esi
jmp 0x4658fe
mov dword [ebp - 0xc14], esi
test esi, esi
jne 0x4659bd
mov dword [ebp - 0xb04], 0x8007000e
mov eax, dword [ebp - 0xc44]
mov dword [ebp - 0xc18], eax
xor ebx, ebx
mov edx, 0x4ba824
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x465923
mov eax, dword [0x4ba820]
push 0
pop ebx
test eax, eax
jle 0x465980
sub eax, 1
mov dword [0x4ba820], eax
jne 0x465980
mov edi, ebx
mov eax, dword [edi + 0x4b9980]
test eax, eax
je 0x465959
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0x465948
push 0x40
push ebx
push 0x4b9980
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x402210
mov edi, 0x4b7010
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0x4ba824
xchg dword [ecx], eax
lea ecx, [ebp - 0xc14]
call fcn.004a8395
mov eax, dword [ebp - 0xb04]
test eax, eax
jns 0x46e595
cmp eax, 0xd0000034
jne 0x46e554
mov eax, 0xc004f012
mov dword [ebp - 0xc38], eax
jmp 0x46e591
xor eax, eax
mov dword [ebp - 0xb34], ebx
lea edi, [ebp - 0xb7c]
mov dword [ebp - 0xb10], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xb2c], ebx
mov dword [ebp - 0xbb8], 0x38
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xc24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xc0000095
test esi, esi
jne 0x465a02
mov esi, 0x80070057
jmp 0x467d81
push 0xa0
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xb24], esi
test esi, esi
jne 0x465a2c
mov esi, 0xc0000017
jmp 0x467d81
push 0xa0
push 0x4b8ca0
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [ebp - 0xb34], esi
push 8
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb30], ecx
test ecx, ecx
je 0x465a22
mov eax, dword [0x4b8c98]
mov dword [ecx], eax
mov eax, dword [0x4b8c9c]
mov dword [ecx + 4], eax
mov dword [ebp - 0xb10], ecx
rdtsc
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0xb60], edx
mov dword [ebp - 0xb50], 0xc
lea eax, [ebp - 0xc3c]
mov edx, SysReAllocString
push eax
mov ecx, 0x40ecd0
call fcn.004a83cc
test eax, eax
jns 0x465ab9
mov dword [ebp - 0xc3c], ebx
mov esi, 0xc000003e
jmp 0x467d81
mov eax, dword [ebp - 0xc3c]
inc eax
mov dword [ebp - 0xc3c], eax
lea eax, [eax*2 + 4]
cmp eax, 4
jb 0x465ad6
mov esi, ebx
jmp 0x465ade
mov eax, dword [ebp - 0xb50]
mov esi, edi
mov dword [ebp - 0xb04], esi
test esi, esi
js 0x467d87
lea ecx, [eax + 0xc4]
mov edx, 0xc4
cmp ecx, edx
jb 0x465aff
mov eax, ecx
jmp 0x465b02
or eax, 0xffffffff
cmp ecx, edx
sbb esi, esi
and esi, edi
add esi, 0x10000000
mov dword [ebp - 0xb04], esi
cmp ecx, edx
jb 0x467d71
lea edx, [eax + 8]
cmp edx, eax
jb 0x465b27
mov ecx, edx
jmp 0x465b2a
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, edi
add esi, 0x10000000
mov dword [ebp - 0xb04], esi
cmp edx, eax
jb 0x467d71
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x465b4f
mov edx, eax
jmp 0x465b52
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, edi
add esi, 0x10000000
mov dword [ebp - 0xb04], esi
cmp eax, ecx
jb 0x467d71
push edx
push 8
mov dword [ebp - 0xb78], edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x465a22
mov dword [ebp - 0xb74], edx
mov dword [ebp - 0xb7c], ebx
mov dword [ebp - 0xd34], ebx
lea esi, [edx + 4]
cmp esi, edx
jb 0x467e9a
mov ecx, dword [ebp - 0xb78]
lea eax, [edx + 8]
add ecx, edx
cmp eax, ecx
jbe 0x465bc2
mov esi, 0xc0000023
jmp 0x467d81
mov dword [edx], 4
mov dword [esi], ebx
mov ecx, dword [ebp - 0xb7c]
inc ecx
mov dword [ebp - 0xb7c], ecx
cmp dword [ebp - 0xb74], 0
jne 0x465c06
mov eax, dword [ebp - 0xb78]
lea edx, [eax + 0xa4]
cmp edx, eax
jb 0x467e9a
inc ecx
mov dword [ebp - 0xb78], edx
mov dword [ebp - 0xb7c], ecx
jmp 0x465c93
mov edx, dword [ebp - 0xb74]
mov esi, ebx
test ecx, ecx
je 0x465c31
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x465cc7
add eax, edx
cmp eax, edx
jb 0x467e9a
inc esi
mov edx, eax
cmp esi, ecx
jb 0x465c12
lea eax, [edx + 4]
cmp eax, edx
jb 0x467e9a
mov ecx, dword [ebp - 0xb78]
lea eax, [edx + 0xa4]
add ecx, dword [ebp - 0xb74]
mov esi, ebx
mov dword [ebp - 0xb04], esi
cmp eax, ecx
ja 0x465bb8
mov eax, 0xa0
push eax
push dword [ebp - 0xb24]
mov dword [edx], eax
lea eax, [edx + 4]
push eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xb7c]
add esp, 0xc
inc ecx
mov dword [ebp - 0xb7c], ecx
test esi, esi
js 0x467d87
mov edx, dword [ebp - 0xb78]
cmp dword [ebp - 0xb74], 0
jne 0x465cd1
lea eax, [edx + 0xc]
cmp eax, edx
jb 0x467e9a
mov edx, eax
inc ecx
mov eax, dword [ebp - 0xb90]
mov dword [ebp - 0xcc0], eax
mov eax, dword [ebp - 0xb60]
mov dword [ebp - 0xcbc], eax
jmp 0x465d97
mov esi, edi
mov dword [ebp - 0xb04], esi
jmp 0x465c85
mov esi, dword [ebp - 0xb74]
mov dword [ebp - 0xb48], esi
mov dword [ebp - 0xb54], ebx
test ecx, ecx
je 0x465d18
mov eax, dword [esi]
add eax, 4
cmp eax, 4
jb 0x465db4
add eax, esi
cmp eax, esi
jb 0x467e9a
mov esi, eax
mov dword [ebp - 0xb48], eax
mov eax, dword [ebp - 0xb54]
inc eax
mov dword [ebp - 0xb54], eax
cmp eax, ecx
jb 0x465ce7
lea eax, [esi + 4]
cmp eax, esi
jb 0x467e9a
mov ecx, dword [ebp - 0xb74]
mov esi, ebx
add ecx, edx
mov dword [ebp - 0xb04], esi
mov edx, dword [ebp - 0xb48]
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0x465bb8
mov ecx, dword [ebp - 0xb30]
mov dword [edx], 8
mov eax, dword [ecx]
mov dword [edx + 4], eax
mov eax, dword [ecx + 4]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0xb7c]
mov edx, dword [ebp - 0xb78]
inc ecx
mov dword [ebp - 0xb7c], ecx
test esi, esi
js 0x467d87
cmp dword [ebp - 0xb74], 0
mov eax, dword [ebp - 0xb90]
mov dword [ebp - 0xcc0], eax
mov eax, dword [ebp - 0xb60]
mov dword [ebp - 0xcbc], eax
jne 0x465dbe
lea eax, [edx + 0xc]
cmp eax, edx
jb 0x467e9a
inc ecx
mov dword [ebp - 0xb78], eax
mov dword [ebp - 0xb7c], ecx
jmp 0x465e57
mov esi, edi
mov dword [ebp - 0xb04], esi
jmp 0x465d6e
mov esi, dword [ebp - 0xb74]
mov dword [ebp - 0xb48], esi
mov dword [ebp - 0xb54], ebx
test ecx, ecx
je 0x465e05
mov eax, dword [esi]
add eax, 4
cmp eax, 4
jb 0x465e7c
add eax, esi
cmp eax, esi
jb 0x467e9a
mov esi, eax
mov dword [ebp - 0xb48], eax
mov eax, dword [ebp - 0xb54]
inc eax
mov dword [ebp - 0xb54], eax
cmp eax, ecx
jb 0x465dd4
lea eax, [esi + 4]
cmp eax, esi
jb 0x467e9a
mov ecx, dword [ebp - 0xb74]
mov esi, ebx
add ecx, edx
mov dword [ebp - 0xb04], esi
mov edx, dword [ebp - 0xb48]
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0x465bb8
mov eax, dword [ebp - 0xb90]
mov dword [edx], 8
mov dword [edx + 4], eax
mov eax, dword [ebp - 0xb60]
mov dword [edx + 8], eax
inc dword [ebp - 0xb7c]
test esi, esi
js 0x467d87
lea eax, [ebp - 0xc30]
mov edx, SysReAllocString
push eax
mov ecx, 0x40ecd0
call fcn.004a83cc
test eax, eax
jns 0x465e86
mov dword [ebp - 0xc30], ebx
jmp 0x465aaf
mov esi, edi
mov dword [ebp - 0xb04], esi
jmp 0x465e4f
mov eax, dword [ebp - 0xc30]
lea ecx, [eax + 1]
mov dword [ebp - 0xb54], ecx
cmp ecx, eax
jb 0x467e93
lea eax, [ecx + ecx]
mov dword [ebp - 0xc30], ecx
test eax, eax
je 0x465f8c
cmp dword [ebp - 0xb74], 0
jne 0x465ef7
lea ecx, [eax + 4]
cmp ecx, 4
jb 0x465ef0
add ecx, dword [ebp - 0xb78]
cmp ecx, dword [ebp - 0xb78]
jb 0x465ee0
inc dword [ebp - 0xb7c]
mov esi, ebx
mov dword [ebp - 0xb78], ecx
jmp 0x465f97
or ecx, 0xffffffff
mov dword [ebp - 0xb78], ecx
mov esi, edi
jmp 0x465f97
mov esi, edi
jmp 0x465f91
cmp dword [ebp - 0xb7c], 0
mov ecx, ebx
mov edx, dword [ebp - 0xb74]
jbe 0x465f23
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x465ef0
add eax, edx
cmp eax, edx
jb 0x465ef0
inc ecx
mov edx, eax
cmp ecx, dword [ebp - 0xb7c]
jb 0x465f08
mov ecx, dword [ebp - 0xb78]
lea eax, [edx + 4]
cmp eax, edx
jb 0x465ee9
mov eax, dword [ebp - 0xb54]
mov esi, ebx
add eax, 2
mov dword [ebp - 0xb50], ecx
add ecx, dword [ebp - 0xb74]
mov dword [ebp - 0xb04], esi
lea eax, [edx + eax*2]
cmp eax, ecx
jbe 0x465f61
mov ecx, dword [ebp - 0xb50]
mov esi, 0xc0000023
jmp 0x465f97
mov ecx, dword [ebp - 0xb54]
lea eax, [ecx + ecx]
push eax
mov dword [edx], eax
lea eax, [edx + 4]
push 0x40ecd0
push eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xb78]
add esp, 0xc
inc dword [ebp - 0xb7c]
jmp 0x465f9d
mov esi, 0xc000000d
mov ecx, dword [ebp - 0xb78]
mov dword [ebp - 0xb04], esi
test esi, esi
js 0x467d87
cmp dword [ebp - 0xb74], 0
mov eax, dword [ebp - 0xb3c]
mov dword [ebp - 0xd30], eax
jne 0x465fdc
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x467e9a
inc dword [ebp - 0xb7c]
mov ecx, eax
mov dword [ebp - 0xcc4], 4
jmp 0x46606a
cmp dword [ebp - 0xb7c], 0
mov esi, ebx
mov edx, dword [ebp - 0xb74]
jbe 0x466010
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x466085
add eax, edx
cmp eax, edx
jb 0x467e9a
inc esi
mov edx, eax
cmp esi, dword [ebp - 0xb7c]
jb 0x465fed
lea eax, [edx + 4]
cmp eax, edx
jb 0x467e9a
add ecx, dword [ebp - 0xb74]
lea eax, [edx + 8]
mov esi, ebx
mov dword [ebp - 0xb04], esi
cmp eax, ecx
ja 0x465bb8
mov eax, dword [ebp - 0xb3c]
mov dword [edx], 4
mov dword [edx + 4], eax
inc dword [ebp - 0xb7c]
mov ecx, dword [ebp - 0xb78]
test esi, esi
js 0x467d87
cmp dword [ebp - 0xb74], 0
mov dword [ebp - 0xcc4], 4
jne 0x46608f
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x467e9a
inc dword [ebp - 0xb7c]
mov ecx, eax
mov dword [ebp - 0xb78], ecx
jmp 0x466103
mov esi, edi
mov dword [ebp - 0xb04], esi
jmp 0x46604f
cmp dword [ebp - 0xb7c], 0
mov esi, ebx
mov edx, dword [ebp - 0xb74]
jbe 0x4660c3
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x466193
add eax, edx
cmp eax, edx
jb 0x467e9a
inc esi
mov edx, eax
cmp esi, dword [ebp - 0xb7c]
jb 0x4660a0
lea eax, [edx + 4]
cmp eax, edx
jb 0x467e9a
add ecx, dword [ebp - 0xb74]
lea eax, [edx + 8]
mov esi, ebx
mov dword [ebp - 0xb04], esi
cmp eax, ecx
ja 0x465bb8
push 4
pop eax
mov dword [edx], eax
mov dword [edx + 4], eax
inc dword [ebp - 0xb7c]
mov ecx, dword [ebp - 0xb78]
test esi, esi
js 0x467d87
rdtsc
mov dword [ebp - 0xb84], ebx
mov dword [ebp - 0xb80], ebx
mov dword [ebp - 0xb20], ebx
mov dword [ebp - 0xb68], ebx
mov dword [ebp - 0xb44], ebx
mov dword [ebp - 0xb88], ebx
mov dword [ebp - 0xb18], ebx
mov dword [ebp - 0xb48], ebx
mov dword [ebp - 0xb14], ebx
mov dword [ebp - 0xb64], ebx
mov dword [ebp - 0xb50], eax
mov dword [ebp - 0xb24], edx
add ecx, 8
cmp ecx, 8
jb 0x466228
lea eax, [ecx + 7]
and eax, 0xfffffff8
mov dword [ebp - 0xb54], eax
cmp eax, ecx
jb 0x466228
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb30], ecx
test ecx, ecx
jne 0x4661a0
mov esi, 0xc0000017
jmp 0x46622a
mov esi, edi
mov dword [ebp - 0xb04], esi
jmp 0x4660fb
mov eax, dword [ebp - 0xb7c]
lea edx, [ecx + 4]
mov dword [ecx], eax
cmp edx, ecx
jb 0x466211
mov eax, dword [ebp - 0xb78]
mov dword [edx], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x466211
mov eax, dword [ebp - 0xb54]
mov esi, ebx
mov edx, dword [ebp - 0xb50]
mov dword [ecx + eax - 8], edx
mov edx, dword [ebp - 0xb24]
mov dword [ecx + eax - 4], edx
lea edx, [ecx + 4]
push dword [ebp - 0xb78]
lea eax, [edx + 4]
push dword [ebp - 0xb74]
push eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xb30]
add esp, 0xc
mov eax, dword [ebp - 0xb54]
mov dword [ebp - 0xb84], ecx
mov ecx, ebx
mov dword [ebp - 0xb80], eax
jmp 0x466213
mov esi, edi
test ecx, ecx
je 0x46622a
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x46622a
mov esi, edi
or esi, 0x10000000
mov dword [ebp - 0xb04], esi
jl 0x4677b4
cmp dword [ebp - 0xb84], 0
mov dword [ebp - 0xb0c], ebx
jne 0x466255
mov esi, 0xc000000d
jmp 0x46691c
mov esi, dword [ebp - 0xb80]
test esi, esi
je 0x466917
lea eax, [esi + 8]
push eax
push ebx
mov dword [ebp - 0xb04], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb4c], eax
test eax, eax
je 0x466917
mov cl, bl
mov edx, ebx
test esi, esi
je 0x4662a1
mov ebx, dword [ebp - 0xb84]
xor cl, byte [edx + ebx]
inc edx
cmp edx, esi
jb 0x466297
xor ebx, ebx
mov eax, 0xc81ecb17
mov dword [ebp - 0x3b0], 0xb1b54a58
mov dword [ebp - 0x3ac], eax
or eax, 0xffffffff
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xbd0], eax
mov eax, esi
shr eax, 3
mov dword [ebp - 0xbc8], ebx
mov dword [ebp - 0xb40], eax
test eax, eax
je 0x466711
movzx edx, word [ebp - 0x3ae]
mov eax, 0xc81ecb17
movzx esi, ax
movzx eax, word [ebp - 0x3aa]
mov dword [ebp - 0xb28], eax
mov eax, dword [ebp - 0xb4c]
add eax, 7
mov dword [ebp - 0xb5c], edx
mov edx, dword [ebp - 0xb08]
mov dword [ebp - 0xb6c], eax
mov eax, dword [ebp - 0xb84]
add eax, 2
mov dword [ebp - 0xb38], esi
mov dword [ebp - 0xb54], eax
mov dword [ebp - 0xb70], ebx
mov dword [ebp - 0xb1c], ebx
mov ebx, dword [ebp - 0xb54]
movzx edi, byte [ebx - 2]
movzx eax, byte [ebx - 1]
movzx esi, byte [ebx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ebx]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 3]
or esi, eax
movzx eax, byte [ebx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ebx + 5]
add ebx, 8
shl esi, 8
or esi, eax
mov dword [ebp - 0xb54], ebx
xor edx, esi
mov eax, 0xc81ecb17
mov dword [ebp - 0xb08], edx
lea ebx, [edx - 0x4a58]
xor ebx, edi
xor ebx, dword [ebp - 0xbc8]
xor ebx, eax
mov edx, ebx
xor edx, eax
mov eax, ebx
ror edx, 0xf
imul edx, dword [ebp - 0xb5c]
ror eax, 7
add eax, edx
mov edx, dword [ebp - 0xb08]
xor edx, eax
mov dword [ebp - 0xb08], edx
add edx, 0xb1b54a58
mov eax, dword [ebp - 0xb08]
ror edx, 9
imul edx, dword [ebp - 0xb38]
ror eax, 0xa
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xb38]
rol edx, 4
imul edx, dword [ebp - 0xb28]
rol eax, 5
add eax, edx
mov edx, dword [ebp - 0xb08]
xor edx, eax
mov eax, 0xc81ecb17
mov dword [ebp - 0xb08], edx
xor edx, 0xb1b54a58
sub eax, edx
xor ebx, eax
mov eax, ebx
shr eax, 6
lea edx, [ebx - 0x4a58]
imul edx, dword [ebp - 0xb5c]
sub edx, eax
xor dword [ebp - 0xb08], edx
mov edx, dword [ebp - 0xb08]
mov eax, edx
ror eax, 0xf
xor eax, dword [ebp - 0xb38]
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, dword [ebp - 0xb28]
imul eax, dword [ebp - 0xb38]
xor edx, eax
mov dword [ebp - 0xb08], edx
sub edx, 0xc81ecb17
sub edx, 0x4a58
xor ebx, edx
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xb28]
imul eax, dword [ebp - 0xb5c]
ror edx, 0xa
xor edx, eax
mov eax, dword [ebp - 0xb08]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb08], eax
xor edx, 0x4a58
ror eax, 3
rol edx, 6
imul edx, dword [ebp - 0xb38]
xor eax, edx
mov edx, dword [ebp - 0xb08]
xor ebx, eax
mov eax, ebx
ror eax, 0xf
sub eax, dword [ebp - 0xb28]
imul eax, eax, 0x4a58
xor edx, eax
mov dword [ebp - 0xb08], edx
xor edx, dword [ebp - 0xb28]
mov eax, dword [ebp - 0xb08]
imul edx, edx, 0x4a58
shr eax, 1
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb08]
mov eax, edx
shr edx, 0xf
sub eax, dword [ebp - 0xb38]
rol eax, 3
imul eax, eax, 0x4a58
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
sub edx, dword [ebp - 0xb38]
imul edx, dword [ebp - 0xb5c]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xb08]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xb08], eax
ror edx, 9
imul edx, dword [ebp - 0xb38]
ror eax, 0xb
xor eax, edx
mov edx, dword [ebp - 0xb08]
xor ebx, eax
mov eax, ebx
sub eax, dword [ebp - 0xb28]
add eax, 0x4e4ab5a8
xor edx, eax
mov dword [ebp - 0xb08], edx
mov eax, dword [ebp - 0xb08]
xor eax, dword [ebp - 0xb5c]
ror edx, 7
imul eax, eax, 0x4a58
sub eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xb28]
rol edx, 4
imul edx, dword [ebp - 0xb5c]
ror eax, 0x10
sub edx, eax
mov eax, dword [ebp - 0xb08]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xb08], eax
ror edx, 0xa
ror eax, 4
imul edx, dword [ebp - 0xb38]
add eax, edx
xor ebx, eax
mov eax, ebx
ror eax, 9
lea edx, [ebx + 0x4e4ab5a8]
ror edx, 4
imul edx, dword [ebp - 0xb28]
xor eax, edx
mov edx, dword [ebp - 0xb08]
xor edx, eax
mov eax, edx
mov dword [ebp - 0xb08], edx
xor eax, 0xc81ecb17
rol edx, 2
rol eax, 8
imul eax, eax, 0x4a58
sub eax, edx
mov edx, 0xc81ecb17
xor ebx, eax
sub edx, ebx
mov eax, ebx
ror eax, 0xc
ror edx, 0xb
imul edx, dword [ebp - 0xb5c]
sub edx, eax
mov eax, dword [ebp - 0xb08]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb08], eax
xor edx, dword [ebp - 0xb5c]
imul edx, dword [ebp - 0xb38]
shr eax, 8
xor edx, eax
xor ebx, edx
mov eax, ebx
xor ebx, dword [ebp - 0xb70]
xor eax, dword [ebp - 0xb1c]
xor eax, dword [ebp - 0xb08]
xor eax, 0xc81ecb17
mov dword [ebp - 0xbc8], ebx
xor eax, 0xb1b54a58
mov dword [ebp - 0xb70], edi
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xb6c]
mov dword [ebp - 0xb1c], esi
mov byte [eax - 4], bl
mov al, byte [ebp - 0xbd0]
mov ebx, dword [ebp - 0xb6c]
ror dword [ebp - 0xbc8], 8
mov byte [ebx], al
ror dword [ebp - 0xbd0], 8
mov al, byte [ebp - 0xbc8]
mov byte [ebx - 5], al
mov al, byte [ebp - 0xbd0]
ror dword [ebp - 0xbc8], 8
mov byte [ebx - 1], al
ror dword [ebp - 0xbd0], 8
mov al, byte [ebp - 0xbc8]
mov byte [ebx - 6], al
mov al, byte [ebp - 0xbd0]
ror dword [ebp - 0xbc8], 8
mov byte [ebx - 2], al
ror dword [ebp - 0xbd0], 8
mov al, byte [ebp - 0xbc8]
mov byte [ebx - 7], al
mov al, byte [ebp - 0xbd0]
mov byte [ebx - 3], al
add ebx, 8
mov edx, dword [ebp - 0xbd0]
ror dword [ebp - 0xbc8], 8
ror edx, 8
sub dword [ebp - 0xb40], 1
mov dword [ebp - 0xbd0], edx
mov dword [ebp - 0xb6c], ebx
jne 0x466336
mov esi, dword [ebp - 0xb80]
xor ebx, ebx
mov edi, 0xc0000095
movzx eax, cl
mov ecx, dword [ebp - 0xb4c]
cdq
mov dword [ecx + esi], eax
mov dword [ecx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xb28], esi
test esi, esi
jne 0x466749
mov esi, 0xc0000017
jmp 0x466875
mov eax, dword [ebp - 0xb04]
push eax
push 8
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x466777
mov eax, dword [ebp - 0xb28]
mov esi, 0xc0000017
jmp 0x466805
mov dword [esi + 4], ecx
push dword [ebp - 0xb04]
mov eax, dword [ebp - 0xb4c]
push eax
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [esi + 8], eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x466767
mov dword [esi + 0xc], eax
push 0xa0
push 0x4b8bf0
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push 8
pop eax
push eax
push eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x466767
mov dword [esi + 0x14], ecx
mov eax, dword [0x4b8c90]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0x4b8c94]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xb28]
mov dword [ebp - 0xb0c], eax
mov eax, ebx
mov dword [ebp - 0xb28], eax
test eax, eax
je 0x466875
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x466828
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb28]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x466847
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb28]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x466866
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb28]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x46688b
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb0c], ebx
push dword [ebp - 0xb4c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb0c]
test eax, eax
je 0x46691c
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x4668c8
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb0c]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x4668e7
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb0c]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x466906
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb0c]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x46691c
mov esi, 0xc0000001
or esi, 0x10000000
mov dword [ebp - 0xb04], esi
jl 0x4677b4
mov eax, dword [ebp - 0xb20]
mov esi, dword [eax + 0x10]
mov ecx, dword [eax + 8]
mov eax, dword [eax]
add eax, 4
cmp eax, 4
jb 0x466a66
lea edx, [eax + 4]
cmp edx, eax
jb 0x466a66
add ecx, edx
cmp ecx, edx
jb 0x466a66
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x466a66
lea ecx, [eax + esi]
mov dword [ebp - 0xb50], ecx
cmp ecx, eax
jb 0x466a66
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xb0c], esi
test esi, esi
jne 0x46699f
mov esi, 0xc0000017
jmp 0x466a68
mov ecx, dword [ebp - 0xb20]
mov eax, dword [ecx]
mov dword [esi], eax
lea eax, [esi + 4]
cmp eax, esi
jb 0x466a49
push dword [ecx]
push dword [ecx + 4]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xb20]
lea ecx, [esi + 4]
add esp, 0xc
mov edx, dword [eax]
add edx, ecx
cmp edx, ecx
jb 0x466a49
mov ecx, eax
lea esi, [edx + 4]
mov eax, dword [ecx + 8]
mov dword [edx], eax
cmp esi, edx
jb 0x466a49
push dword [ecx + 8]
push dword [ecx + 0xc]
push esi
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0xb20]
add esp, 0xc
mov ecx, dword [edx + 8]
add ecx, esi
cmp ecx, esi
jb 0x466a49
mov eax, dword [edx + 0x10]
lea esi, [ecx + 4]
mov dword [ecx], eax
cmp esi, ecx
jb 0x466a49
push dword [edx + 0x10]
push dword [edx + 0x14]
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xb20]
add esp, 0xc
mov eax, dword [eax + 0x10]
add eax, esi
cmp eax, esi
mov eax, dword [ebp - 0xb0c]
jb 0x466a4f
mov ecx, dword [ebp - 0xb50]
mov edx, eax
mov dword [ebp - 0xb68], eax
mov esi, ebx
mov eax, ebx
mov dword [ebp - 0xb44], ecx
jmp 0x466a51
mov eax, dword [ebp - 0xb0c]
mov esi, edi
test eax, eax
je 0x466a68
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x466a68
mov esi, edi
or esi, 0x10000000
mov dword [ebp - 0xb04], esi
jl 0x4677b4
cmp dword [ebp - 0xb74], 0
jne 0x466a8d
mov esi, 0xc000000d
jmp 0x466b38
cmp dword [ebp - 0xb7c], 1
jbe 0x466a83
mov ecx, dword [ebp - 0xb74]
mov edx, ebx
mov esi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x466b36
lea ecx, [esi + eax]
cmp ecx, eax
jb 0x466b36
inc edx
cmp edx, 1
jb 0x466a9e
mov eax, dword [ecx]
mov dword [ebp - 0xb50], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x466b36
cmp dword [ebp - 0xb7c], 2
jbe 0x466a83
mov ecx, dword [ebp - 0xb74]
mov edx, ebx
mov esi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x466b36
lea ecx, [esi + eax]
cmp ecx, eax
jb 0x466b36
inc edx
cmp edx, 2
jb 0x466adc
mov edx, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x466b36
mov eax, dword [ebp - 0xb50]
add eax, 0x50
cmp eax, 0x50
jb 0x466b36
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x466b36
lea eax, [ecx + edx]
cmp eax, ecx
jb 0x466b36
mov dword [ebp - 0xb18], eax
mov esi, ebx
mov dword [ebp - 0xb04], esi
cmp eax, 0x400000
jbe 0x466b40
mov esi, 0x8000ffff
jmp 0x4677ae
mov esi, edi
mov eax, ebx
mov dword [ebp - 0xb04], esi
test esi, esi
js 0x4677b4
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x466b65
mov esi, 0xd0000017
mov ecx, ebx
jmp 0x466b72
mov ecx, eax
mov dword [ebp - 0xb88], ecx
mov esi, 0x10000000
mov dword [ebp - 0xb04], esi
test esi, esi
js 0x4677b4
mov eax, dword [ebp - 0xb68]
test eax, eax
jne 0x466b94
mov esi, 0x80070057
jmp 0x4677ae
test ecx, ecx
je 0x466b8a
mov dword [ebp - 0xcfc], eax
mov eax, dword [ebp - 0xb44]
mov dword [ebp - 0xcf4], eax
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0xcf0], eax
lea eax, [ebp - 0xcc8]
push eax
push 0x411248
push 1
mov dword [ebp - 0xcf8], ecx
mov dword [ebp - 0xcec], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x466c12
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0xb04], esi
test esi, esi
jle 0x466bfd
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0xb04], esi
test esi, esi
mov eax, dword [ebp - 0xb18]
js 0x466c66
mov esi, 0x80004005
mov dword [ebp - 0xb04], esi
jmp 0x466c66
push 0x413650
push dword [ebp - 0xcc8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x466bda
push ebx
push 0x14
lea eax, [ebp - 0xcfc]
mov ecx, esi
push eax
push 0x86
call dword [0x4bb544]
call esi
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xb04], esi
jl 0x466c60
mov eax, dword [ebp - 0xcf0]
mov dword [ebp - 0xb18], eax
jmp 0x466c66
mov eax, dword [ebp - 0xb18]
cmp esi, 0xd0000023
jne 0x466c78
mov esi, 0x8007007a
jmp 0x4677ae
test esi, esi
js 0x4677b4
mov dword [ebp - 0xb80], ebx
cmp eax, 4
jae 0x466c95
mov esi, 0xc000003e
jmp 0x466fcf
mov esi, dword [ebp - 0xb88]
mov ecx, dword [esi]
lea edx, [esi + 4]
mov dword [ebp - 0xb4c], ecx
cmp edx, esi
jb 0x466fcd
add eax, 0xfffffffc
cmp eax, ecx
jb 0x466c8b
lea esi, [ecx + edx]
cmp esi, edx
jb 0x466fcd
lea edx, [ecx + 4]
cmp edx, 4
jb 0x466fcd
mov eax, dword [ebp - 0xb18]
sub eax, edx
cmp eax, 4
jb 0x466c8b
mov eax, dword [ebp - 0xb88]
mov esi, dword [esi]
add eax, 4
add eax, ecx
push 0
pop ebx
lea edx, [eax + 4]
mov dword [ebp - 0xb1c], edx
cmp edx, eax
lea edx, [ecx + 4]
jb 0x466fcd
lea eax, [edx + 4]
mov dword [ebp - 0xb50], eax
cmp eax, edx
jb 0x466fcd
mov eax, dword [ebp - 0xb18]
mov edx, dword [ebp - 0xb50]
sub eax, edx
cmp eax, esi
jb 0x466c8b
mov eax, dword [ebp - 0xb1c]
add eax, esi
cmp eax, dword [ebp - 0xb1c]
jb 0x466fcd
lea eax, [esi + edx]
mov dword [ebp - 0xb6c], eax
cmp eax, edx
jb 0x466fcd
mov eax, dword [ebp - 0xb18]
sub eax, dword [ebp - 0xb6c]
cmp eax, 4
jb 0x466c8b
mov eax, dword [ebp - 0xb1c]
add eax, esi
mov edx, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xb24], edx
mov dword [ebp - 0xb54], ecx
cmp ecx, eax
jb 0x466fcd
mov eax, dword [ebp - 0xb6c]
add eax, 4
mov dword [ebp - 0xb44], eax
cmp eax, dword [ebp - 0xb6c]
jb 0x466fcd
mov eax, dword [ebp - 0xb18]
sub eax, dword [ebp - 0xb44]
cmp eax, edx
jb 0x466c8b
mov eax, dword [ebp - 0xb44]
lea ecx, [edx + eax]
mov dword [ebp - 0xb50], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0xb4c]
jb 0x466fcd
mov edi, dword [ebp - 0xb18]
mov eax, edi
sub eax, dword [ebp - 0xb50]
jne 0x466c8b
lea eax, [esi + 0xc]
add eax, edx
add eax, ecx
cmp eax, edi
jne 0x466c8b
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x466e0f
mov esi, 0xc0000017
jmp 0x466f50
mov eax, dword [ebp - 0xb88]
add eax, 4
je 0x466e60
mov eax, dword [ebp - 0xb4c]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x466e42
mov esi, 0xc0000017
jmp 0x466eef
mov dword [edi + 4], ecx
mov edx, dword [ebp - 0xb88]
push dword [ebp - 0xb4c]
lea eax, [edx + 4]
push eax
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x466e65
mov dword [edi], ebx
mov dword [edi + 4], ebx
cmp dword [ebp - 0xb1c], 0
je 0x466e9a
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x466e38
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xb1c]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x466ea0
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [ebp - 0xb54], 0
je 0x466edf
mov esi, dword [ebp - 0xb24]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x466e38
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xb54]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x466ee5
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 0xb80], edi
mov esi, ebx
mov edi, ebx
test edi, edi
je 0x466f50
cmp dword [edi + 4], 0
je 0x466f0d
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x466f27
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x466f41
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x466f64
mov eax, dword [ebp - 0xb80]
mov edi, ebx
mov dword [ebp - 0xb48], eax
jmp 0x466f6a
mov edi, dword [ebp - 0xb80]
test edi, edi
je 0x466fcf
cmp dword [edi + 4], 0
je 0x466f88
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x466fa2
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x466fbc
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x466fcf
mov esi, edi
or esi, 0x10000000
mov dword [ebp - 0xb04], esi
jl 0x4677b4
mov ecx, dword [ebp - 0xb48]
mov edi, ebx
mov dword [ebp - 0xb38], ebx
mov dword [ebp - 0xb30], ebx
test ecx, ecx
jne 0x467003
mov esi, 0xd000000d
jmp 0x4677ae
mov eax, dword [ecx + 4]
mov dword [ebp - 0xb04], eax
test eax, eax
je 0x466ff9
mov esi, dword [ecx]
test esi, esi
je 0x466ff9
add esi, 0xfffffff8
push esi
push ebx
mov dword [ebp - 0xb70], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb08], eax
test eax, eax
je 0x467639
mov ecx, 0x7f1137f
mov dword [ebp - 0xb6c], eax
mov edi, esi
mov dword [ebp - 0x3c4], ecx
mov ecx, dword [ebp - 0xb04]
mov dl, bl
mov dword [ebp - 0x3c8], 0xab69605e
mov eax, ebx
mov dword [ebp - 0xb80], ecx
mov dword [ebp - 0xb0c], ebx
and edi, 7
je 0x4675d6
or dword [ebp - 0xba0], 0xffffffff
mov ecx, ebx
mov dword [ebp - 0xbb4], ebx
mov dword [ebp - 0xb18], ecx
mov dword [ebp - 0xb44], eax
test edi, edi
je 0x4670ec
mov ebx, dword [ebp - 0xb80]
push 0x38
pop ecx
mov esi, ecx
cmp eax, 4
movzx eax, byte [ebx]
jge 0x4670bd
lea ecx, [esi - 0x20]
shl eax, cl
or dword [ebp - 0xb0c], eax
mov ecx, dword [ebp - 0xb18]
jmp 0x4670cf
mov ecx, esi
shl eax, cl
mov ecx, dword [ebp - 0xb18]
or ecx, eax
mov dword [ebp - 0xb18], ecx
mov eax, dword [ebp - 0xb44]
inc ebx
inc eax
sub esi, 8
mov dword [ebp - 0xb44], eax
cmp eax, edi
jl 0x4670a2
mov dword [ebp - 0xb80], ebx
xor ebx, ebx
mov eax, dword [ebp - 0xb0c]
xor ecx, 0x699a899c
xor eax, 0x92f65a5
mov dword [ebp - 0xb40], ecx
mov dword [ebp - 0xb5c], eax
mov dword [ebp - 0xbb4], eax
mov dword [ebp - 0xba0], ecx
mov dword [ebp - 0xb4c], ebx
test edi, edi
je 0x467163
mov esi, dword [ebp - 0xb6c]
cmp dword [ebp - 0xb4c], 4
jge 0x467135
rol eax, 8
mov byte [esi], al
jmp 0x46713a
rol ecx, 8
mov byte [esi], cl
inc esi
inc dword [ebp - 0xb4c]
cmp dword [ebp - 0xb4c], edi
jl 0x467125
mov eax, dword [ebp - 0xbb4]
mov dword [ebp - 0xb6c], esi
mov esi, dword [ebp - 0xba0]
mov dword [ebp - 0xb5c], eax
jmp 0x467169
mov esi, dword [ebp - 0xb40]
cmp edi, 4
jbe 0x4675a5
push 8
pop ecx
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xb40], esi
mov dword [ebp - 0xba0], esi
mov edi, dword [ebp - 0xb5c]
mov esi, dword [ebp - 0xb70]
mov eax, esi
shr eax, 3
mov dword [ebp - 0xb54], eax
test eax, eax
je 0x46756a
movzx esi, word [ebp - 0x3c6]
mov eax, 0x7f1137f
movzx ecx, word [ebp - 0x3c2]
movzx eax, ax
mov dword [ebp - 0xb4c], eax
mov eax, dword [ebp - 0xb6c]
mov dword [ebp - 0xb28], esi
add eax, 7
mov esi, dword [ebp - 0xb80]
mov dword [ebp - 0xb1c], ecx
add esi, 2
mov dword [ebp - 0xb44], eax
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx ecx, byte [esi + 2]
shl ecx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or ecx, eax
mov dword [ebp - 0xb50], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl ecx, 8
or ecx, eax
mov dword [ebp - 0xb5c], edi
movzx eax, byte [esi + 5]
add esi, 8
mov ebx, dword [ebp - 0xb5c]
shl ecx, 8
or ecx, eax
mov dword [ebp - 0xb6c], esi
mov edi, ecx
mov esi, dword [ebp - 0xb4c]
xor edi, dword [ebp - 0xb40]
mov eax, 0x7f1137f
mov dword [ebp - 0xb24], ecx
xor edi, ebx
xor edi, eax
xor edi, 0xab69605e
mov eax, edi
rol eax, 0xa
lea ecx, [edi + 0x54969fa2]
rol ecx, 5
imul ecx, esi
add eax, ecx
mov ecx, 0x7f1137f
xor ebx, eax
mov eax, ebx
rol eax, 2
lea ecx, [ebx + ecx]
ror ecx, 9
imul ecx, dword [ebp - 0xb28]
sub ecx, eax
xor edi, ecx
mov eax, edi
sub eax, esi
imul ecx, eax, 0x605e
mov eax, edi
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xb28]
rol ecx, 6
imul ecx, dword [ebp - 0xb1c]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor edi, ecx
mov ecx, edi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, esi
ror ecx, 6
imul eax, dword [ebp - 0xb28]
xor ecx, eax
mov eax, 0x7f1137f
xor edi, ecx
add eax, edi
mov ecx, edi
ror eax, 0xf
rol ecx, 2
imul eax, eax, 0x605e
add ecx, eax
xor ebx, ecx
mov eax, ebx
rol eax, 8
lea ecx, [ebx + 0x54969fa2]
ror ecx, 0xe
imul ecx, dword [ebp - 0xb1c]
sub ecx, eax
xor edi, ecx
mov ecx, edi
mov eax, edi
xor ecx, 0xab69605e
ror eax, 0xa
ror ecx, 0xc
imul ecx, esi
xor eax, ecx
xor ebx, eax
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xb1c]
imul ecx, dword [ebp - 0xb28]
shr eax, 0xa
xor ecx, eax
xor edi, ecx
mov eax, edi
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xb1c]
xor ebx, eax
mov esi, ebx
sub esi, dword [ebp - 0xb1c]
xor esi, edi
xor esi, 0xab69605e
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0xb1c]
rol ecx, 2
imul ecx, dword [ebp - 0xb4c]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 6
imul ecx, dword [ebp - 0xb28]
rol eax, 7
add eax, ecx
xor esi, eax
mov eax, esi
mov ecx, esi
xor eax, dword [ebp - 0xb4c]
imul eax, eax, 0x605e
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov dword [ebp - 0xb5c], ebx
xor ecx, dword [ebp - 0xb28]
mov eax, ebx
rol ecx, 5
imul ecx, dword [ebp - 0xb1c]
rol eax, 7
add eax, ecx
mov ecx, 0x7f1137f
xor esi, eax
mov ebx, esi
xor ebx, dword [ebp - 0xb5c]
xor ebx, ecx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xb28]
imul eax, dword [ebp - 0xb4c]
xor esi, eax
mov eax, esi
sub eax, ecx
ror eax, 1
imul eax, eax, 0x605e
mov ecx, esi
ror ecx, 6
sub eax, ecx
xor ebx, eax
mov eax, ebx
rol eax, 0xe
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul ecx, dword [ebp - 0xb1c]
add eax, ecx
xor esi, eax
mov eax, esi
ror eax, 0xe
lea ecx, [esi - 0x54969fa2]
rol ecx, 0xf
imul ecx, dword [ebp - 0xb4c]
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
shr eax, 3
xor ecx, 0x605e
imul ecx, dword [ebp - 0xb28]
xor ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov eax, esi
xor eax, ecx
mov ecx, esi
xor esi, dword [ebp - 0xb18]
rol eax, 4
imul eax, eax, 0x605e
rol ecx, 2
mov dword [ebp - 0xba0], esi
mov esi, dword [ebp - 0xb6c]
xor ecx, eax
xor ecx, dword [ebp - 0xb0c]
xor ebx, ecx
mov ecx, dword [ebp - 0xb44]
mov dword [ebp - 0xbb4], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xba0]
ror dword [ebp - 0xbb4], 8
mov byte [ecx], al
mov al, byte [ebp - 0xbb4]
ror dword [ebp - 0xba0], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xba0]
ror dword [ebp - 0xbb4], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xbb4]
ror dword [ebp - 0xba0], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xba0]
ror dword [ebp - 0xbb4], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xba0], 8
mov al, byte [ebp - 0xbb4]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xba0]
mov byte [ecx - 3], al
add ecx, 8
mov eax, dword [ebp - 0xba0]
mov edi, dword [ebp - 0xbb4]
ror eax, 8
mov dword [ebp - 0xb40], eax
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0xb50]
ror edi, 8
sub dword [ebp - 0xb54], 1
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0xbb4], edi
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0xb44], ecx
jne 0x4671e9
mov esi, dword [ebp - 0xb70]
xor ebx, ebx
mov edi, dword [ebp - 0xb08]
mov ecx, ebx
test esi, esi
je 0x46757e
xor dl, byte [ecx + edi]
inc ecx
cmp ecx, esi
jb 0x467576
mov ecx, dword [ebp - 0xb04]
movzx eax, dl
cdq
cmp eax, dword [esi + ecx]
jne 0x4675f6
cmp edx, dword [esi + ecx + 4]
jne 0x4675f6
mov dword [ebp - 0xb38], edi
mov edi, ebx
mov dword [ebp - 0xb30], esi
mov esi, ebx
jmp 0x4675fb
mov ecx, ebx
mov dword [ebp - 0xb40], ecx
mov dword [ebp - 0xba0], ecx
jae 0x46718a
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xb5c], eax
mov dword [ebp - 0xbb4], eax
jmp 0x46718a
or dword [ebp - 0xb18], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xb40], eax
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0xbb4], edi
jmp 0x467196
mov esi, 0xc004d501
test edi, edi
je 0x46760e
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x467633
mov eax, dword [ebp - 0xb38]
mov edi, ebx
mov dword [ebp - 0xb14], eax
mov esi, 0x10000000
mov eax, dword [ebp - 0xb30]
mov dword [ebp - 0xb64], eax
jmp 0x46763e
mov edi, dword [ebp - 0xb38]
mov esi, 0xd0000001
mov dword [ebp - 0xb04], esi
test edi, edi
je 0x467657
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x4677b4
mov edx, dword [ebp - 0xb64]
cmp edx, 4
jae 0x467674
mov esi, 0xc000003e
jmp 0x4677a8
mov esi, dword [ebp - 0xb14]
mov eax, dword [esi]
lea ecx, [esi + 4]
mov dword [ebp - 0xb50], eax
cmp ecx, esi
jb 0x4677a3
lea eax, [edx - 4]
cmp eax, 4
jb 0x46766a
mov edi, dword [ecx]
lea esi, [ecx + 4]
cmp esi, ecx
jb 0x4677a3
mov ecx, dword [ebp - 0xb64]
lea eax, [ecx - 8]
cmp eax, edi
jb 0x46766a
lea eax, [edi + 8]
cmp eax, 8
jb 0x4677a3
mov eax, dword [ebp - 0xb14]
lea edx, [edi + esi]
add eax, ecx
cmp eax, edx
jb 0x46766a
sub ecx, edi
sub ecx, esi
add ecx, dword [ebp - 0xb14]
cmp ecx, 8
jae 0x46766a
mov dword [ebp - 0xb64], ebx
mov eax, ebx
mov dword [ebp - 0xb30], eax
test esi, esi
je 0x467730
mov ecx, esi
cmp edx, esi
jb 0x4677a3
jbe 0x46772c
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x4677a3
cmp eax, edx
ja 0x467755
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0x46775c
add eax, ecx
cmp eax, ecx
jb 0x4677a3
mov ecx, eax
cmp ecx, edx
ja 0x467755
inc dword [ebp - 0xb64]
cmp ecx, edx
jb 0x4676f7
mov eax, ebx
cmp ecx, edx
jne 0x467755
test edi, edi
je 0x467763
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb30], eax
test eax, eax
jne 0x467763
mov esi, 0xc0000017
jmp 0x46778c
mov esi, 0xc000000d
jmp 0x4677a8
mov esi, 0xc0000095
jmp 0x46778c
test esi, esi
je 0x467778
push edi
push esi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xb30]
add esp, 0xc
mov dword [ebp - 0xc1c], eax
mov eax, dword [ebp - 0xb64]
mov dword [ebp - 0xc24], eax
mov esi, ebx
test esi, esi
js 0x4677a8
mov eax, dword [ebp - 0xb50]
cmp eax, dword [ebp - 0xc24]
je 0x4677a8
jmp 0x46766a
mov esi, 0xc0000095
or esi, 0x10000000
mov dword [ebp - 0xb04], esi
mov eax, dword [ebp - 0xb84]
test eax, eax
je 0x4677cd
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xb20]
test edi, edi
je 0x467834
cmp dword [edi + 4], 0
je 0x4677f1
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x46780b
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x467825
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb68]
test eax, eax
je 0x46784d
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb88]
test eax, eax
je 0x467866
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xb48]
test edi, edi
je 0x4678cd
cmp dword [edi + 4], 0
je 0x46788a
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x4678a4
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x4678be
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb14]
test eax, eax
je 0x4678e6
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x467d87
xor edi, edi
inc edi
cmp dword [ebp - 0xc24], edi
jae 0x467903
mov esi, 0xc004d501
jmp 0x467d81
cmp dword [ebp - 0xc1c], 0
jne 0x46796b
mov esi, 0xc000000d
mov dword [ebp - 0xb04], esi
mov eax, ebx
test esi, esi
js 0x467d87
cmp eax, 0xd0000023
jne 0x467933
mov eax, 0x8007007a
mov dword [ebp - 0xb2c], eax
cmp eax, 0x8007007a
je 0x46794a
mov esi, eax
mov dword [ebp - 0xb04], esi
test eax, eax
js 0x467d87
cmp dword [ebp - 0xc24], 6
jne 0x4678f9
cmp dword [ebp - 0xc1c], 0
jne 0x4679cd
mov esi, 0xc000000d
mov edi, 0xc0000095
jmp 0x467a6a
cmp dword [ebp - 0xc24], 0
jbe 0x46790c
mov eax, dword [ebp - 0xc1c]
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x467987
mov esi, ebx
jmp 0x46798f
or ecx, 0xffffffff
mov esi, 0xc0000095
mov dword [ebp - 0xb04], esi
test esi, esi
js 0x4679a3
mov eax, edx
neg eax
sbb eax, eax
and eax, ecx
jmp 0x4679af
mov edx, dword [ebp - 0xd2c]
mov eax, dword [ebp - 0xd28]
test esi, esi
js 0x467917
cmp edx, 4
jne 0x465bb8
mov eax, dword [eax]
mov dword [ebp - 0xb2c], eax
jmp 0x467919
mov eax, dword [ebp - 0xc1c]
mov edx, ebx
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x467a63
lea eax, [esi + ecx]
cmp eax, ecx
jb 0x467a63
inc edx
cmp edx, edi
jb 0x4679d5
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xb44], ecx
cmp edx, eax
jb 0x467a05
mov dword [ebp - 0xb30], edx
jmp 0x467a0c
or dword [ebp - 0xb30], 0xffffffff
cmp edx, eax
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
mov dword [ebp - 0xb04], esi
cmp edx, eax
jb 0x467a2d
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xb30]
jmp 0x467a3f
mov ecx, dword [ebp - 0xd24]
mov dword [ebp - 0xb44], ecx
mov ecx, dword [ebp - 0xd1c]
cmp edx, eax
jb 0x467a70
cmp dword [ebp - 0xb44], 8
jne 0x465bb8
mov eax, dword [ecx]
mov dword [ebp - 0xcb0], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0xcac], eax
jmp 0x467a70
mov edi, 0xc0000095
mov esi, edi
mov dword [ebp - 0xb04], esi
test esi, esi
js 0x467d87
cmp dword [ebp - 0xc1c], 0
jne 0x467a8b
mov esi, 0xc000000d
jmp 0x467b0c
mov eax, dword [ebp - 0xc1c]
mov edx, ebx
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x467b0a
lea eax, [esi + ecx]
cmp eax, ecx
jb 0x467b0a
inc edx
cmp edx, 2
jb 0x467a93
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xb44], ecx
cmp edx, eax
jb 0x467ac0
mov dword [ebp - 0xb30], edx
jmp 0x467ac7
or dword [ebp - 0xb30], 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, edi
mov dword [ebp - 0xb04], esi
cmp edx, eax
jb 0x467ae3
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xb30]
jmp 0x467af5
mov ecx, dword [ebp - 0xd18]
mov dword [ebp - 0xb44], ecx
mov ecx, dword [ebp - 0xd44]
cmp edx, eax
jb 0x467b12
cmp dword [ebp - 0xb44], 4
jne 0x465bb8
mov eax, dword [ecx]
jmp 0x467b18
mov esi, edi
mov dword [ebp - 0xb04], esi
mov eax, dword [ebp - 0xc5c]
mov dword [ebp - 0xb0c], eax
test esi, esi
js 0x467d87
cmp dword [ebp - 0xc1c], 0
jne 0x467b39
mov esi, 0xc000000d
jmp 0x467d81
mov eax, dword [ebp - 0xc1c]
mov edx, ebx
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x467e9a
lea eax, [esi + ecx]
cmp eax, ecx
jb 0x467e9a
inc edx
cmp edx, 3
jb 0x467b41
mov edx, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xb54], edx
cmp ecx, eax
jb 0x467b76
mov dword [ebp - 0xb30], ecx
jmp 0x467b7d
or dword [ebp - 0xb30], 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, edi
mov dword [ebp - 0xb04], esi
cmp ecx, eax
jb 0x467b99
neg edx
sbb edx, edx
and edx, dword [ebp - 0xb30]
jmp 0x467bab
mov edx, dword [ebp - 0xd40]
mov dword [ebp - 0xb54], edx
mov edx, dword [ebp - 0xd3c]
cmp ecx, eax
jb 0x467d87
mov eax, dword [ebp - 0xc1c]
mov esi, ebx
mov ecx, dword [eax]
mov dword [ebp - 0xb50], ecx
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x467c53
mov eax, dword [ebp - 0xb50]
add eax, ecx
cmp eax, ecx
jb 0x467c53
inc esi
cmp esi, 4
jb 0x467bbb
mov ecx, dword [eax]
mov dword [ebp - 0xb44], ecx
lea ecx, [eax + 4]
mov dword [ebp - 0xb50], ecx
cmp ecx, eax
jb 0x467bfd
mov dword [ebp - 0xb30], ecx
jmp 0x467c04
or dword [ebp - 0xb30], 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, edi
mov dword [ebp - 0xb04], esi
cmp ecx, eax
jb 0x467c22
mov ecx, dword [eax]
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xb30]
jmp 0x467c34
mov ecx, dword [ebp - 0xd38]
mov dword [ebp - 0xb44], ecx
mov ecx, dword [ebp - 0xd20]
cmp dword [ebp - 0xb50], eax
jb 0x467c5b
cmp dword [ebp - 0xb44], 4
jne 0x465bb8
mov eax, dword [ecx]
mov dword [ebp - 0xcdc], eax
jmp 0x467c5b
mov esi, edi
mov dword [ebp - 0xb04], esi
test esi, esi
js 0x467d87
mov eax, dword [ebp - 0xc1c]
mov esi, ebx
mov ecx, dword [eax]
mov dword [ebp - 0xb50], ecx
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x467cf2
mov eax, dword [ebp - 0xb50]
add eax, ecx
cmp eax, ecx
jb 0x467cf2
inc esi
cmp esi, 5
jb 0x467c6b
mov ecx, dword [eax]
mov dword [ebp - 0xb44], ecx
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x467ca3
mov dword [ebp - 0xb30], ecx
jmp 0x467caa
or dword [ebp - 0xb30], 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, edi
mov dword [ebp - 0xb04], esi
cmp ecx, eax
jb 0x467cc8
mov ecx, dword [eax]
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xb30]
jmp 0x467cda
mov ecx, dword [ebp - 0xd48]
mov dword [ebp - 0xb44], ecx
mov ecx, dword [ebp - 0xd14]
lea edi, [eax + 4]
cmp edi, eax
jb 0x467cfa
cmp dword [ebp - 0xb44], 4
jne 0x465bb8
mov ecx, dword [ecx]
jmp 0x467cfc
mov esi, edi
mov dword [ebp - 0xb04], esi
mov ecx, ebx
test esi, esi
js 0x467d87
mov eax, dword [ebp - 0xb90]
cmp eax, dword [ebp - 0xcb0]
jne 0x4678f9
mov eax, dword [ebp - 0xb60]
cmp eax, dword [ebp - 0xcac]
jne 0x4678f9
cmp dword [ebp - 0xcdc], 4
mov dword [ebp - 0xb3c], ecx
jbe 0x467d4a
mov eax, dword [ebp - 0xb0c]
mov esi, 0x8007007a
mov dword [ebp - 0xc18], eax
jmp 0x467d81
mov eax, dword [ebp - 0xb54]
cmp eax, 4
ja 0x467d37
push eax
push edx
push dword [ebp - 0xb58]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xb0c]
add esp, 0xc
mov dword [ebp - 0xc18], eax
test esi, esi
js 0x467d87
mov eax, dword [ebp - 0xb2c]
test eax, eax
je 0x467d87
mov esi, eax
mov dword [ebp - 0xb04], esi
cmp dword [ebp - 0xb74], 0
mov dword [ebp - 0xb78], ebx
mov dword [ebp - 0xb7c], ebx
je 0x467db6
push dword [ebp - 0xb74]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xb74], ebx
mov eax, dword [ebp - 0xc1c]
mov dword [ebp - 0xc20], ebx
mov dword [ebp - 0xc24], ebx
test eax, eax
je 0x467de1
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xc1c], ebx
mov eax, dword [ebp - 0xb34]
test eax, eax
je 0x467dfa
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb10]
test eax, eax
je 0x467e13
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x465910
mov eax, dword [ebp - 0xb3c]
test eax, eax
je 0x46e536
mov dword [0x4b93f4], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0xc94], ebx
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x46c9b0
cmp eax, esi
jne 0x467e67
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x46c9b0
mov esi, dword [0x4b708c]
mov ecx, esi
push 0x403
push ebx
push ebx
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb28], eax
test eax, eax
jne 0x467ea1
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x46c9b0
or dword [ebp - 0xc30], 0xffffffff
mov esi, edi
jmp 0x467d81
mov esi, dword [0x4b705c]
mov ecx, esi
call dword [0x4bb544]
call esi
mov dword [0x4ba818], eax
mov eax, dword [0x4b93f4]
push 0x54
mov dword [ebp - 0xb6c], eax
lea eax, [ebp - 0x7e8]
push ebx
push eax
mov dword [0x4ba81c], edx
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0xc9c], ebx
lea edi, [ebp - 0x368]
mov dword [ebp - 0xc98], ebx
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0xb5c], ebx
mov dword [ebp - 0xb50], ebx
stosd dword es:[edi], eax
push 0x2c
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x478]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xb54], ebx
mov edx, 0x4ba824
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x467f1a
mov eax, dword [0x4ba820]
test eax, eax
jne 0x468559
push 0x338
push ebx
mov dword [ebp - 0xb2c], ebx
mov dword [ebp - 0xb14], ebx
mov dword [ebp - 0xb44], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xb64], edi
test edi, edi
je 0x4684f8
or dword [ebp - 0xb34], 0xffffffff
mov eax, 0x7f1137f
mov dword [ebp - 0x3d0], 0xab69605e
add edi, 7
movzx esi, word [ebp - 0x3ce]
mov cl, bl
mov dword [ebp - 0x3cc], eax
movzx edx, word [ebp - 0x3ca]
movzx eax, ax
mov dword [ebp - 0xb18], esi
mov esi, 0x41167a
mov dword [ebp - 0xb10], ebx
mov dword [ebp - 0xbc0], ebx
mov dword [ebp - 0xbe4], ebx
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb0c], edx
mov dword [ebp - 0xb58], edi
mov dword [ebp - 0xb30], 0x67
movzx edx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl edx, 8
or edx, eax
shl edi, 8
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
or edi, eax
mov dword [ebp - 0xb48], edx
movzx eax, byte [esi + 4]
xor ebx, edx
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
add esi, 8
shl edi, 8
or edi, eax
mov dword [ebp - 0xb68], esi
mov esi, 0x7f1137f
xor esi, edi
xor esi, dword [ebp - 0xbc0]
xor esi, ebx
xor esi, 0xab69605e
mov eax, esi
rol eax, 0xa
lea edx, [esi + 0x54969fa2]
rol edx, 5
imul edx, dword [ebp - 0xb20]
add eax, edx
mov edx, 0x7f1137f
xor ebx, eax
mov eax, ebx
rol eax, 2
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [ebp - 0xb18]
sub edx, eax
xor esi, edx
mov eax, esi
sub eax, dword [ebp - 0xb20]
imul edx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb18]
xor edx, ebx
mov eax, ebx
rol edx, 6
imul edx, dword [ebp - 0xb0c]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xb20]
imul eax, dword [ebp - 0xb18]
ror edx, 6
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
add eax, esi
mov edx, esi
ror eax, 0xf
imul eax, eax, 0x605e
rol edx, 2
add edx, eax
xor ebx, edx
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
imul edx, dword [ebp - 0xb0c]
mov eax, ebx
rol eax, 8
sub edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, dword [ebp - 0xb20]
xor eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xb0c]
imul edx, dword [ebp - 0xb18]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xb0c]
xor ebx, eax
mov esi, ebx
sub esi, dword [ebp - 0xb0c]
xor esi, edx
mov edx, dword [ebp - 0xb0c]
xor esi, 0xab69605e
xor edx, esi
mov eax, esi
rol edx, 2
imul edx, dword [ebp - 0xb20]
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [ebp - 0xb18]
rol eax, 7
add eax, edx
xor esi, eax
mov eax, esi
mov edx, esi
xor eax, dword [ebp - 0xb20]
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb18]
xor edx, ebx
mov dword [ebp - 0xb24], ebx
rol edx, 5
mov eax, ebx
imul edx, dword [ebp - 0xb0c]
rol eax, 7
add eax, edx
mov edx, 0x7f1137f
xor esi, eax
mov ebx, esi
xor ebx, dword [ebp - 0xb24]
xor ebx, edx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xb18]
imul eax, dword [ebp - 0xb20]
xor esi, eax
mov eax, esi
sub eax, edx
mov edx, esi
ror eax, 1
imul eax, eax, 0x605e
ror edx, 6
sub eax, edx
xor ebx, eax
lea edx, [ebx - 0x54969fa2]
mov eax, ebx
rol edx, 3
imul edx, dword [ebp - 0xb0c]
rol eax, 0xe
add eax, edx
xor esi, eax
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xb20]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, 0x605e
shr eax, 3
imul edx, dword [ebp - 0xb18]
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
xor eax, esi
mov edx, esi
xor esi, dword [ebp - 0xb34]
rol eax, 4
imul eax, eax, 0x605e
rol edx, 2
mov dword [ebp - 0xbc0], esi
mov esi, dword [ebp - 0xb68]
mov dword [ebp - 0xb34], edi
xor edx, eax
xor edx, dword [ebp - 0xb10]
xor ebx, edx
mov edx, dword [ebp - 0xb58]
mov dword [ebp - 0xbe4], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xbc0]
ror dword [ebp - 0xbe4], 8
mov byte [edx], al
mov al, byte [ebp - 0xbe4]
ror dword [ebp - 0xbc0], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xbc0]
ror dword [ebp - 0xbe4], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xbe4]
ror dword [ebp - 0xbc0], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xbc0]
ror dword [ebp - 0xbe4], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xbe4]
ror dword [ebp - 0xbc0], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xbc0]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [ebp - 0xbe4]
ror dword [ebp - 0xbc0], 8
mov eax, dword [ebp - 0xb48]
ror ebx, 8
sub dword [ebp - 0xb30], 1
mov dword [ebp - 0xbe4], ebx
mov dword [ebp - 0xb10], eax
mov dword [ebp - 0xb58], edx
jne 0x467fd4
mov esi, dword [ebp - 0xb64]
xor ebx, ebx
mov edx, ebx
xor cl, byte [edx + esi]
inc edx
cmp edx, 0x338
jb 0x468337
movzx eax, cl
cdq
cmp eax, dword [0x4119b0]
jne 0x46836d
cmp edx, dword [0x4119b4]
jne 0x46836d
mov edi, esi
mov dword [ebp - 0xb10], 0x337
mov dword [ebp - 0xb14], edi
mov esi, ebx
jmp 0x468380
or dword [ebp - 0xb10], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xb44], 0xc004d501
test esi, esi
je 0x468393
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xb44], ebx
jl 0x4684f8
mov eax, dword [ebp - 0xb10]
mov esi, edi
push 0x40
push ebx
push 0x4b9980
mov byte [edi + eax], bl
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], bl
je 0x4684ff
mov edi, 0x4b9980
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb24], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4683d4
sub ecx, dword [ebp - 0xb24]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x4684f8
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb20], ecx
cmp word [eax], dx
je 0x46841c
mov ecx, 0xc000007b
mov dword [ebp - 0xb20], ecx
jmp 0x468464
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x46840f
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x46840f
cmp dword [edx], 0x4550
jne 0x46840f
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc00]
je 0x468452
cmp ax, word [ebp - 0xb9c]
je 0x468452
mov ecx, 0xc000000d
jmp 0x468414
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb58], eax
mov dword [ebp - 0xb10], ebx
test eax, eax
je 0x4684df
mov edx, esi
mov dword [ebp - 0xb34], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb24], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x46848b
sub edx, dword [ebp - 0xb24]
inc esi
add esi, edx
test ecx, ecx
js 0x4684c4
push dword [ebp - 0xb34]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4684ea
mov ecx, dword [ebp - 0xb2c]
mov dword [ecx*4 + 0x4b7010], eax
mov ecx, dword [ebp - 0xb20]
mov eax, dword [ebp - 0xb10]
inc dword [ebp - 0xb2c]
inc eax
mov dword [ebp - 0xb10], eax
cmp eax, dword [ebp - 0xb58]
jb 0x46847a
add edi, 0x10
cmp byte [esi], bl
jne 0x4683c7
mov esi, dword [ebp - 0xb20]
mov edi, dword [ebp - 0xb14]
jmp 0x468501
mov esi, 0xc000007a
jmp 0x4684f0
mov esi, ebx
test edi, edi
je 0x468514
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x468554
mov esi, ebx
mov eax, dword [esi + 0x4b9980]
test eax, eax
je 0x46852b
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x46851a
push 0x40
push ebx
push 0x4b9980
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x402210
mov edi, 0x4b7010
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x46855f
mov eax, dword [0x4ba820]
inc eax
mov dword [0x4ba820], eax
xor eax, eax
mov edx, 0x4ba824
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0xc88]
mov word [ebp - 0x14], bx
stosd dword es:[edi], eax
mov dword [ebp - 0xb4c], ebx
mov dword [ebp - 0xb70], ebx
mov dword [ebp - 0xc50], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x420]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x468598
mov eax, dword [0x4ba820]
test eax, eax
jne 0x468c17
push 0x338
push ebx
mov dword [ebp - 0xb48], ebx
mov dword [ebp - 0xb14], ebx
mov dword [ebp - 0xb44], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xb64], edi
test edi, edi
je 0x468bb6
or dword [ebp - 0xb34], 0xffffffff
mov eax, 0x7f1137f
mov dword [ebp - 0x3bc], eax
mov cl, bl
movzx edx, word [ebp - 0x3ba]
mov eax, ebx
mov dword [ebp - 0xb60], 0x7f1137f
xor dword [ebp - 0xb60], 0xab69605e
add edi, 7
mov dword [ebp - 0xb2c], eax
mov dword [ebp - 0xbd4], eax
mov eax, 0x7f1137f
mov dword [ebp - 0x3c0], 0xab69605e
movzx esi, word [ebp - 0x3be]
mov dword [ebp - 0xb58], edi
mov edi, 0x41167a
movzx eax, ax
mov dword [ebp - 0xb18], esi
mov esi, ebx
mov dword [ebp - 0xb10], ebx
mov dword [ebp - 0xbe8], ebx
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb0c], edx
mov dword [ebp - 0xb3c], edi
mov dword [ebp - 0xb30], 0x67
movzx edx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl edx, 8
or edx, eax
movzx eax, byte [edi]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl edx, 8
or edx, eax
shl edi, 8
mov eax, dword [ebp - 0xb3c]
xor ebx, edx
mov dword [ebp - 0xb68], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb3c]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb3c]
shl edi, 8
add dword [ebp - 0xb3c], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
mov dword [ebp - 0xb2c], esi
mov esi, dword [ebp - 0xb60]
xor esi, dword [ebp - 0xb2c]
xor esi, ebx
mov eax, esi
rol eax, 0xa
lea edx, [esi + 0x54969fa2]
rol edx, 5
imul edx, dword [ebp - 0xb20]
add eax, edx
mov edx, 0x7f1137f
xor ebx, eax
mov eax, ebx
rol eax, 2
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [ebp - 0xb18]
sub edx, eax
xor esi, edx
mov eax, esi
sub eax, dword [ebp - 0xb20]
imul edx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xb18]
rol edx, 6
imul edx, dword [ebp - 0xb0c]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xb20]
imul eax, dword [ebp - 0xb18]
ror edx, 6
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
add eax, esi
mov edx, esi
ror eax, 0xf
imul eax, eax, 0x605e
rol edx, 2
add edx, eax
xor ebx, edx
lea edx, [ebx + 0x54969fa2]
mov eax, ebx
ror edx, 0xe
imul edx, dword [ebp - 0xb0c]
rol eax, 8
sub edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, dword [ebp - 0xb20]
xor eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xb0c]
imul edx, dword [ebp - 0xb18]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xb0c]
xor ebx, eax
mov esi, ebx
sub esi, dword [ebp - 0xb0c]
xor esi, edx
xor esi, 0xab69605e
mov edx, esi
mov eax, esi
xor edx, dword [ebp - 0xb0c]
rol edx, 2
imul edx, dword [ebp - 0xb20]
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [ebp - 0xb18]
rol eax, 7
add eax, edx
xor esi, eax
mov eax, esi
mov edx, esi
xor eax, dword [ebp - 0xb20]
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
xor ebx, edx
mov edx, ebx
mov dword [ebp - 0xb24], ebx
xor edx, dword [ebp - 0xb18]
mov eax, ebx
rol edx, 5
imul edx, dword [ebp - 0xb0c]
rol eax, 7
add eax, edx
mov edx, 0x7f1137f
xor esi, eax
mov ebx, esi
xor ebx, dword [ebp - 0xb24]
xor ebx, dword [ebp - 0xb60]
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xb18]
imul eax, dword [ebp - 0xb20]
xor esi, eax
mov eax, esi
sub eax, edx
mov edx, esi
ror eax, 1
imul eax, eax, 0x605e
ror edx, 6
sub eax, edx
xor ebx, eax
mov eax, ebx
rol eax, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [ebp - 0xb0c]
add eax, edx
xor esi, eax
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xb20]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, 0x605e
shr eax, 3
imul edx, dword [ebp - 0xb18]
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
xor eax, esi
mov edx, esi
xor esi, dword [ebp - 0xb34]
rol eax, 4
imul eax, eax, 0x605e
rol edx, 2
mov dword [ebp - 0xbd4], esi
mov dword [ebp - 0xb34], edi
mov edi, dword [ebp - 0xb3c]
xor edx, eax
xor edx, dword [ebp - 0xb10]
xor ebx, edx
mov edx, dword [ebp - 0xb58]
mov dword [ebp - 0xbe8], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xbd4]
ror dword [ebp - 0xbe8], 8
mov byte [edx], al
mov al, byte [ebp - 0xbe8]
ror dword [ebp - 0xbd4], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xbd4]
ror dword [ebp - 0xbe8], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xbe8]
ror dword [ebp - 0xbd4], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xbd4]
ror dword [ebp - 0xbe8], 8
mov byte [edx - 2], al
ror dword [ebp - 0xbd4], 8
mov al, byte [ebp - 0xbe8]
mov byte [edx - 7], al
mov al, byte [ebp - 0xbd4]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [ebp - 0xbe8]
mov esi, dword [ebp - 0xbd4]
mov eax, dword [ebp - 0xb68]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xb30], 1
mov dword [ebp - 0xbe8], ebx
mov dword [ebp - 0xbd4], esi
mov dword [ebp - 0xb10], eax
mov dword [ebp - 0xb58], edx
jne 0x46867b
mov esi, dword [ebp - 0xb64]
xor ebx, ebx
mov edx, ebx
xor cl, byte [edx + esi]
inc edx
cmp edx, 0x338
jb 0x4689f5
movzx eax, cl
cdq
cmp eax, dword [0x4119b0]
jne 0x468a2b
cmp edx, dword [0x4119b4]
jne 0x468a2b
mov edi, esi
mov dword [ebp - 0xb10], 0x337
mov dword [ebp - 0xb14], edi
mov esi, ebx
jmp 0x468a3e
or dword [ebp - 0xb10], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xb44], 0xc004d501
test esi, esi
je 0x468a51
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xb44], ebx
jl 0x468bb6
mov eax, dword [ebp - 0xb10]
mov esi, edi
push 0x40
push ebx
push 0x4b9980
mov byte [eax + edi], bl
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], bl
je 0x468bbd
mov edi, 0x4b9980
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb24], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x468a92
sub ecx, dword [ebp - 0xb24]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x468bb6
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb20], ecx
cmp word [eax], dx
je 0x468ada
mov ecx, 0xc000007b
mov dword [ebp - 0xb20], ecx
jmp 0x468b22
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x468acd
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x468acd
cmp dword [edx], 0x4550
jne 0x468acd
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc00]
je 0x468b10
cmp ax, word [ebp - 0xb9c]
je 0x468b10
mov ecx, 0xc000000d
jmp 0x468ad2
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb58], eax
mov dword [ebp - 0xb10], ebx
test eax, eax
je 0x468b9d
mov edx, esi
mov dword [ebp - 0xb34], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb24], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x468b49
sub edx, dword [ebp - 0xb24]
inc esi
add esi, edx
test ecx, ecx
js 0x468b82
push dword [ebp - 0xb34]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x468ba8
mov ecx, dword [ebp - 0xb48]
mov dword [ecx*4 + 0x4b7010], eax
mov ecx, dword [ebp - 0xb20]
mov eax, dword [ebp - 0xb10]
inc dword [ebp - 0xb48]
inc eax
mov dword [ebp - 0xb10], eax
cmp eax, dword [ebp - 0xb58]
jb 0x468b38
add edi, 0x10
cmp byte [esi], bl
jne 0x468a85
mov esi, dword [ebp - 0xb20]
mov edi, dword [ebp - 0xb14]
jmp 0x468bbf
mov esi, 0xc000007a
jmp 0x468bae
mov esi, ebx
test edi, edi
je 0x468bd2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x468c12
mov esi, ebx
mov eax, dword [esi + 0x4b9980]
test eax, eax
je 0x468be9
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x468bd8
push 0x40
push ebx
push 0x4b9980
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x402210
mov edi, 0x4b7010
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x468c1d
mov eax, dword [0x4ba820]
inc eax
mov dword [0x4ba820], eax
xor eax, eax
mov ecx, 0x4ba824
xchg dword [ecx], eax
push 0x54
lea eax, [ebp - 0x7e8]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xb6c]
add esp, 0xc
mov esi, dword [0x4b708c]
mov ecx, eax
mov dword [ebp - 0x368], ebx
push 0xf
pop edx
and ecx, edx
mov dword [ebp - 0xb18], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0x18], cx
mov ecx, eax
shr ecx, 8
push 0x403
and ecx, edx
shr eax, 0xc
push ebx
mov word [ebp - 0x16], cx
and eax, edx
push ebx
mov ecx, esi
mov word [ebp - 0x14], ax
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb38], eax
mov dword [ebp - 0xb0c], 0xffffff
test eax, eax
jne 0x468cd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb08], edi
test edi, edi
jle 0x468cbe
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb08], edi
test edi, edi
js 0x46a363
mov dword [ebp - 0xb08], 0x80004005
jmp 0x46a363
mov esi, dword [0x4b7060]
lea eax, [ebp - 0xc58]
push eax
push ebx
lea eax, [ebp - 0xc28]
mov dword [ebp - 0xc54], ebx
push eax
mov edi, ebx
mov dword [ebp - 0xc34], ebx
push 8
mov ecx, esi
mov dword [ebp - 0xb6c], ebx
mov dword [ebp - 0xbdc], ebx
mov dword [ebp - 0xc10], ebx
mov dword [ebp - 0xc0c], ebx
mov dword [ebp - 0xb08], edi
mov dword [ebp - 0xc58], ebx
call dword [0x4bb544]
call esi
test eax, eax
jne 0x468d63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb08], edi
test edi, edi
jle 0x468d4d
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb08], edi
test edi, edi
js 0x468eb5
mov edi, 0x80004005
mov dword [ebp - 0xb08], edi
jmp 0x468eb5
mov eax, dword [ebp - 0xc58]
add eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xc10]
mov esi, eax
call fcn.004a83ac
test esi, esi
jne 0x468d95
mov dword [ebp - 0xc10], ebx
mov esi, ebx
jmp 0x468d9b
mov dword [ebp - 0xc10], esi
test esi, esi
jne 0x468da6
mov edi, 0x8007000e
jmp 0x468d58
mov eax, dword [ebp - 0xc28]
lea eax, [eax*4 + 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xc0c]
mov esi, eax
call fcn.004a83ac
test esi, esi
jne 0x468ddd
mov dword [ebp - 0xc0c], ebx
mov esi, ebx
jmp 0x468de3
mov dword [ebp - 0xc0c], esi
test esi, esi
je 0x468d9f
mov esi, dword [0x4b7060]
lea eax, [ebp - 0xc58]
push eax
push dword [ebp - 0xc10]
lea eax, [ebp - 0xc28]
mov ecx, esi
push eax
push 8
call dword [0x4bb544]
call esi
test eax, eax
je 0x468d2a
cmp dword [ebp - 0xc28], 0
mov edx, dword [ebp - 0xc0c]
mov eax, dword [ebp - 0xc10]
mov dword [ebp - 0xb10], edx
mov dword [ebp - 0xb34], ebx
jbe 0x468e90
mov edi, eax
mov esi, dword [0x4b7068]
mov ecx, esi
push ebx
push edi
call dword [0x4bb544]
call esi
mov edx, dword [ebp - 0xb10]
mov ecx, edi
mov dword [edx], eax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x468e57
mov eax, dword [ebp - 0xb34]
sub ecx, esi
sar ecx, 1
add edx, 4
mov dword [ebp - 0xb10], edx
lea edi, [edi + ecx*2]
add edi, 2
inc eax
mov dword [ebp - 0xb34], eax
cmp eax, dword [ebp - 0xc28]
jb 0x468e38
mov edi, dword [ebp - 0xb08]
mov dword [edx], 0x409
mov eax, dword [ebp - 0xc0c]
mov dword [ebp - 0xc54], eax
mov eax, dword [ebp - 0xc28]
inc eax
mov dword [ebp - 0xc0c], ebx
mov dword [ebp - 0xb10], eax
lea ecx, [ebp - 0xc0c]
call fcn.004a83ac
lea ecx, [ebp - 0xc10]
call fcn.004a83ac
test edi, edi
js 0x46968d
cmp dword [ebp - 0xb10], 0
mov edi, ebx
mov dword [ebp - 0xb48], edi
mov esi, ebx
jbe 0x468f13
mov eax, dword [ebp - 0xc54]
mov edx, ebx
mov ecx, dword [eax + esi*4]
cmp ecx, dword [edx*4 + 0x411280]
je 0x468f0b
inc edx
cmp edx, 0x26
jb 0x468eee
inc esi
cmp esi, dword [ebp - 0xb10]
jb 0x468eec
jmp 0x468f13
mov edi, edx
mov dword [ebp - 0xb48], edx
mov esi, dword [0x4b7064]
lea eax, [ebp - 0xc8]
push ebx
push 0x55
push eax
push dword [edi*4 + 0x411280]
mov ecx, esi
mov dword [ebp - 0xb64], ebx
call dword [0x4bb544]
call esi
test eax, eax
je 0x468f76
mov esi, dword [0x4b7058]
lea eax, [ebp - 0x6b0]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xc8]
mov ecx, esi
push eax
call dword [0x4bb544]
call esi
test eax, eax
jle 0x468f76
mov edi, dword [ebp - 0x6a4]
shr edi, 0x1b
and edi, 1
mov dword [ebp - 0xb64], edi
mov edx, 0x411398
mov esi, ebx
mov ecx, edx
mov dword [ebp + esi*4 - 0x358], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x468f89
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0x468f7d
imul ecx, dword [ebp - 0xb48], 3
movzx eax, byte [ecx + 0x411318]
mov esi, dword [ebp + eax*4 - 0x358]
movzx eax, byte [ecx + 0x411319]
mov dword [ebp - 0xb60], esi
mov dword [ebp - 0xc88], esi
mov eax, dword [ebp + eax*4 - 0x358]
mov dword [ebp - 0xb80], eax
mov dword [ebp - 0xc84], eax
movzx eax, byte [ecx + 0x41131a]
mov esi, dword [ebp + eax*4 - 0x358]
mov dword [ebp - 0xb68], esi
mov dword [ebp - 0xc80], esi
push 0x1c90
mov eax, ebx
push ebx
mov dword [ebp - 0xb08], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xb84], edi
test edi, edi
je 0x469530
or dword [ebp - 0xb58], 0xffffffff
mov ecx, 0x7f1137f
mov dword [ebp - 0x3d4], ecx
mov al, bl
movzx edx, word [ebp - 0x3d2]
mov ecx, ebx
mov dword [ebp - 0xb34], ebx
mov ebx, 0x7f1137f
mov dword [ebp - 0xb2c], ecx
mov dword [ebp - 0xb14], ecx
mov dword [ebp - 0xbd8], ecx
mov dword [ebp - 0xbf4], ecx
movzx ecx, bx
xor ebx, 0xab69605e
mov dword [ebp - 0x3d8], 0xab69605e
add edi, 7
movzx esi, word [ebp - 0x3d6]
mov dword [ebp - 0xb40], edx
mov edx, 0x4119ba
mov dword [ebp - 0xb20], esi
mov esi, dword [ebp - 0xb14]
mov dword [ebp - 0xb30], edi
mov edi, dword [ebp - 0xb2c]
mov dword [ebp - 0xb10], ebx
mov dword [ebp - 0xb1c], ecx
mov dword [ebp - 0xb3c], edx
mov dword [ebp - 0xb44], 0x392
movzx ebx, byte [edx - 2]
movzx ecx, byte [edx - 1]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edx]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edx + 1]
movzx edx, byte [edx + 2]
shl edx, 8
shl ebx, 8
or ebx, ecx
mov ecx, dword [ebp - 0xb3c]
xor esi, ebx
mov dword [ebp - 0xb24], ebx
mov ebx, esi
mov dword [ebp - 0xb14], esi
mov esi, 0x7f1137f
movzx ecx, byte [ecx + 3]
or edx, ecx
mov ecx, dword [ebp - 0xb3c]
shl edx, 8
movzx ecx, byte [ecx + 4]
or edx, ecx
mov ecx, dword [ebp - 0xb3c]
shl edx, 8
add dword [ebp - 0xb3c], 8
movzx ecx, byte [ecx + 5]
or edx, ecx
xor edi, edx
mov dword [ebp - 0xb90], edx
mov dword [ebp - 0xb2c], edi
mov edi, dword [ebp - 0xb10]
xor edi, dword [ebp - 0xb2c]
xor edi, ebx
mov ecx, edi
rol ecx, 0xa
lea edx, [edi + 0x54969fa2]
rol edx, 5
imul edx, dword [ebp - 0xb1c]
add ecx, edx
xor ebx, ecx
mov ecx, dword [ebp - 0xb20]
mov edx, ebx
rol edx, 2
lea esi, [esi + ebx]
ror esi, 9
imul ecx, esi
mov esi, dword [ebp - 0xb20]
sub ecx, edx
xor edi, ecx
mov ecx, edi
sub ecx, dword [ebp - 0xb1c]
imul edx, ecx, 0x605e
mov ecx, edi
shr ecx, 0xd
sub edx, ecx
mov ecx, dword [ebp - 0xb40]
xor ebx, edx
xor esi, ebx
mov edx, ebx
rol esi, 6
imul ecx, esi
mov esi, 0x7f1137f
rol edx, 2
sub ecx, edx
xor edi, ecx
mov ecx, esi
mov edx, edi
xor edx, 0xab69605e
sub ecx, edx
xor ebx, ecx
mov ecx, ebx
mov edx, ebx
xor ecx, dword [ebp - 0xb1c]
imul ecx, dword [ebp - 0xb20]
ror edx, 6
xor edx, ecx
xor edi, edx
lea ecx, [esi + edi]
ror ecx, 0xf
imul ecx, ecx, 0x605e
mov edx, edi
rol edx, 2
add edx, ecx
mov ecx, dword [ebp - 0xb40]
xor ebx, edx
mov edx, ebx
rol edx, 8
lea esi, [ebx + 0x54969fa2]
ror esi, 0xe
imul ecx, esi
sub ecx, edx
xor edi, ecx
mov edx, edi
mov ecx, edi
xor edx, 0xab69605e
ror ecx, 0xa
ror edx, 0xc
imul edx, dword [ebp - 0xb1c]
xor ecx, edx
mov edx, dword [ebp - 0xb40]
xor ebx, ecx
xor edx, ebx
mov ecx, ebx
imul edx, dword [ebp - 0xb20]
shr ecx, 0xa
xor edx, ecx
xor edx, edi
mov ecx, edx
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, dword [ebp - 0xb40]
xor ebx, ecx
mov edi, ebx
sub edi, dword [ebp - 0xb40]
xor edi, edx
mov edx, dword [ebp - 0xb40]
xor edi, 0xab69605e
xor edx, edi
mov ecx, edi
rol edx, 2
imul edx, dword [ebp - 0xb1c]
shr ecx, 2
add edx, ecx
mov ecx, 0x7f1137f
xor ebx, edx
mov esi, ebx
mov edx, ebx
sub esi, ecx
rol edx, 7
mov ecx, dword [ebp - 0xb20]
ror esi, 6
imul ecx, esi
mov esi, dword [ebp - 0xb20]
add edx, ecx
xor edi, edx
mov ecx, edi
mov edx, edi
xor ecx, dword [ebp - 0xb1c]
imul ecx, ecx, 0x605e
ror edx, 9
add edx, ecx
mov ecx, dword [ebp - 0xb40]
xor ebx, edx
xor esi, ebx
mov dword [ebp - 0xb14], ebx
rol esi, 5
mov edx, ebx
imul ecx, esi
rol edx, 7
add edx, ecx
xor edi, edx
mov ebx, edi
xor ebx, dword [ebp - 0xb14]
xor ebx, dword [ebp - 0xb10]
mov ecx, ebx
ror ecx, 3
sub ecx, dword [ebp - 0xb20]
imul ecx, dword [ebp - 0xb1c]
xor edi, ecx
mov ecx, edi
mov edx, 0x7f1137f
sub ecx, edx
mov edx, edi
ror ecx, 1
imul ecx, ecx, 0x605e
ror edx, 6
sub ecx, edx
xor ebx, ecx
mov ecx, dword [ebp - 0xb40]
mov edx, ebx
rol edx, 0xe
lea esi, [ebx - 0x54969fa2]
rol esi, 3
imul ecx, esi
add edx, ecx
xor edi, edx
mov ecx, edi
ror ecx, 0xe
lea edx, [edi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xb1c]
sub edx, ecx
xor ebx, edx
mov edx, ebx
mov ecx, ebx
xor edx, 0x605e
shr ecx, 3
imul edx, dword [ebp - 0xb20]
xor edx, ecx
mov ecx, 0x7f1137f
xor edi, edx
xor ecx, edi
mov edx, edi
xor edi, dword [ebp - 0xb58]
rol ecx, 4
imul ecx, ecx, 0x605e
rol edx, 2
mov dword [ebp - 0xbd8], edi
xor edx, ecx
xor edx, dword [ebp - 0xb34]
xor ebx, edx
mov edx, dword [ebp - 0xb30]
mov dword [ebp - 0xbf4], ebx
mov byte [edx - 4], bl
mov cl, byte [ebp - 0xbd8]
ror dword [ebp - 0xbf4], 8
mov byte [edx], cl
mov cl, byte [ebp - 0xbf4]
ror dword [ebp - 0xbd8], 8
mov byte [edx - 5], cl
mov cl, byte [ebp - 0xbd8]
ror dword [ebp - 0xbf4], 8
mov byte [edx - 1], cl
mov cl, byte [ebp - 0xbf4]
ror dword [ebp - 0xbd8], 8
mov byte [edx - 6], cl
mov cl, byte [ebp - 0xbd8]
ror dword [ebp - 0xbf4], 8
mov byte [edx - 2], cl
ror dword [ebp - 0xbd8], 8
mov cl, byte [ebp - 0xbf4]
mov byte [edx - 7], cl
mov cl, byte [ebp - 0xbd8]
mov byte [edx - 3], cl
add edx, 8
mov esi, dword [ebp - 0xbf4]
mov edi, dword [ebp - 0xbd8]
mov ecx, dword [ebp - 0xb24]
ror esi, 8
ror edi, 8
sub dword [ebp - 0xb44], 1
mov dword [ebp - 0xb34], ecx
mov ecx, dword [ebp - 0xb90]
mov dword [ebp - 0xb30], edx
mov edx, dword [ebp - 0xb3c]
mov dword [ebp - 0xbf4], esi
mov dword [ebp - 0xbd8], edi
mov dword [ebp - 0xb58], ecx
jne 0x4690c0
mov esi, dword [ebp - 0xb84]
xor ebx, ebx
mov edx, ebx
mov edi, 0x1c90
xor al, byte [edx + esi]
inc edx
cmp edx, edi
jb 0x46945e
movzx eax, al
cdq
cmp eax, dword [0x413648]
jne 0x469490
cmp edx, dword [0x41364c]
jne 0x469490
mov dword [ebp - 0xc34], esi
mov esi, ebx
mov dword [ebp - 0xb6c], edi
mov edi, dword [ebp - 0xb08]
jmp 0x46949b
mov edi, 0xc004d501
mov dword [ebp - 0xb08], edi
test esi, esi
je 0x4694ae
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
js 0x4696b1
mov edi, dword [ebp - 0xc34]
mov esi, ebx
mov edx, ebx
mov ebx, dword [ebp - 0xb48]
cmp ebx, edx
jne 0x4694d1
mov dword [ebp + esi*4 - 0x308], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0xb24], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4694dc
sub ecx, dword [ebp - 0xb24]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0x4694c6
inc esi
push 0
pop ebx
cmp esi, 6
jb 0x4694be
push 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xbdc]
mov edi, eax
call fcn.004a83ac
test edi, edi
jne 0x469526
mov dword [ebp - 0xbdc], ebx
mov edi, ebx
jmp 0x46952c
mov dword [ebp - 0xbdc], edi
test edi, edi
jne 0x469540
mov edi, 0x8007000e
mov dword [ebp - 0xb08], edi
jmp 0x4696b1
xor eax, eax
lea ecx, [ebp - 0x18]
stosd dword es:[edi], eax
mov dword [ebp - 0xb10], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, ebx
movzx edx, word [ecx]
mov eax, ebx
cmp dx, word [eax*2 + 0x41138c]
je 0x46956a
inc eax
cmp eax, 6
jb 0x469555
jmp 0x469623
mov edx, dword [ebp + eax*4 - 0x308]
mov ecx, edx
mov dword [ebp - 0xb24], edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46957c
sub ecx, esi
mov esi, dword [0x4b7070]
push ebx
push ebx
lea eax, [ecx + 1]
mov ecx, esi
push eax
push edx
push ebx
push 0xfde9
call dword [0x4bb544]
call esi
mov esi, eax
test esi, esi
je 0x46965e
lea ecx, [esi + esi]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0xbdc]
mov dword [ecx + edi], eax
mov eax, dword [ebp - 0xbdc]
cmp dword [eax + edi], ebx
je 0x469530
mov edx, dword [ebp - 0xb24]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xb24], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4695e7
sub ecx, dword [ebp - 0xb24]
mov eax, dword [ebp - 0xbdc]
push esi
mov esi, dword [0x4b7070]
push dword [eax + edi]
lea eax, [ecx + 1]
mov ecx, esi
push eax
push edx
push ebx
push 0xfde9
call dword [0x4bb544]
call esi
test eax, eax
je 0x46965e
mov ecx, dword [ebp - 0xb10]
add ecx, 2
add edi, 4
mov dword [ebp - 0xb10], ecx
cmp edi, 0xc
jb 0x469550
mov eax, dword [ebp - 0xbdc]
mov edi, dword [ebp - 0xb08]
mov dword [ebp - 0xc50], eax
mov eax, dword [ebp - 0xb64]
mov dword [ebp - 0xbdc], ebx
mov dword [ebp - 0x7e8], eax
jmp 0x4696b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb08], edi
test edi, edi
jle 0x469681
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb08], edi
test edi, edi
js 0x4696b1
mov edi, 0x80004005
jmp 0x469535
mov eax, dword [ebp - 0xc80]
mov dword [ebp - 0xb68], eax
mov eax, dword [ebp - 0xc84]
mov dword [ebp - 0xb80], eax
mov eax, dword [ebp - 0xc88]
mov dword [ebp - 0xb60], eax
cmp dword [ebp - 0xbdc], 0
je 0x469717
mov esi, ebx
mov eax, dword [ebp - 0xbdc]
cmp dword [eax + esi], ebx
je 0x46970f
mov ecx, dword [eax + esi]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4696cd
mov eax, dword [ebp - 0xbdc]
sub ecx, edx
sar ecx, 1
mov eax, dword [eax + esi]
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x4696f8
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x4696f0
mov eax, dword [ebp - 0xbdc]
push dword [eax + esi]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esi, 4
cmp esi, 0xc
jb 0x4696bc
mov eax, dword [ebp - 0xc34]
test eax, eax
je 0x469733
mov ecx, dword [ebp - 0xb6c]
test ecx, ecx
je 0x469733
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x46972b
lea ecx, [ebp - 0xbdc]
call fcn.004a83ac
lea ecx, [ebp - 0xc34]
call fcn.004a83ac
lea ecx, [ebp - 0xc54]
call fcn.004a83ac
test edi, edi
js 0x46a34c
mov eax, dword [ebp - 0xc50]
mov edi, ebx
mov esi, dword [0x4b70c4]
push ebx
mov dword [ebp - 0xb08], edi
mov ecx, dword [eax]
mov dword [ebp - 0x7e0], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x7dc], ecx
mov ecx, esi
mov eax, dword [eax + 8]
mov dword [ebp - 0x7d8], eax
lea eax, [ebp - 0xce8]
push eax
push ebx
push 0x42
mov dword [ebp - 0xce4], ebx
mov dword [ebp - 0xce0], ebx
mov dword [ebp - 0xce8], 0xc
call dword [0x4bb544]
call esi
test eax, eax
jne 0x4697ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb08], edi
test edi, edi
jle 0x4697dc
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb08], edi
test edi, edi
mov eax, ebx
js 0x4697f6
mov edi, 0x80004005
mov dword [ebp - 0xb08], edi
jmp 0x4697f6
mov eax, dword [ebp - 0xce4]
and eax, 1
mov dword [ebp - 0x7e4], eax
test edi, edi
js 0x46a34c
mov eax, dword [ebp - 0xb18]
push 0x2a
pop ecx
mov dword [ebp - 0xb90], ecx
sub eax, 1
je 0x469841
sub eax, 1
je 0x469835
sub eax, 1
jne 0x469851
mov edi, 0xe1
mov dword [ebp - 0xb4c], edi
mov dword [ebp - 0xb70], edi
jmp 0x469851
mov dword [ebp - 0xb4c], 0xf
jmp 0x469847
mov dword [ebp - 0xb4c], ecx
mov dword [ebp - 0xb70], 0xb
mov esi, 0xdc
mov dword [ebp - 0xb3c], 0x60
push esi
lea eax, [ebp - 0x790]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov word [ebp - 0x74c], si
mov esi, dword [0x4b7080]
lea eax, [ebp - 0x790]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0x4bb544]
call esi
test eax, eax
je 0x4698e2
mov eax, dword [ebp - 0x6e4]
movzx edi, word [ebp - 0x6ea]
mov ecx, dword [ebp - 0x6e0]
push 0x60
mov dword [ebp - 0xb2c], eax
mov dword [ebp - 0x418], eax
pop eax
mov dword [ebp - 0xb3c], edi
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0xb34], ecx
mov dword [ebp - 0x414], ecx
cmp edi, eax
jae 0x4698fa
mov dword [ebp - 0xb3c], eax
jmp 0x4698fa
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0xb34], eax
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0xb2c], eax
cmp dword [ebp - 0xb18], 1
mov eax, dword [ebp - 0xb60]
je 0x46990f
mov eax, dword [ebp - 0xb68]
push 0x5c
mov dword [ebp - 0xb10], eax
lea eax, [ebp - 0x690]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x4b708c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xb08], edi
push 0x403
push ebx
push ebx
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb24], eax
test eax, eax
jne 0x469988
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb08], edi
test edi, edi
jle 0x469973
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb08], edi
test edi, edi
js 0x469a3d
mov dword [ebp - 0xb08], 0x80004005
jmp 0x46a34c
mov esi, dword [0x4b706c]
mov ecx, esi
push 0x48
push dword [ebp - 0xb3c]
push dword [ebp - 0xb4c]
call dword [0x4bb544]
call esi
push dword [ebp - 0xb10]
neg eax
mov dword [ebp - 0x680], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x674]
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x676], 5
call fcn.00436775
mov esi, dword [0x4b7020]
lea eax, [ebp - 0x690]
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
jne 0x469a20
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb08], edi
test edi, edi
jle 0x469a11
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb08], edi
test edi, edi
js 0x469a26
mov edi, 0x80004005
mov dword [ebp - 0xb08], edi
jmp 0x469a26
mov dword [ebp - 0x7d4], eax
push dword [ebp - 0xb24]
mov esi, dword [0x4b70c0]
mov ecx, esi
push ebx
call dword [0x4bb544]
call esi
test edi, edi
js 0x46a34c
cmp dword [ebp - 0xb18], 1
je 0x469a5a
mov eax, dword [ebp - 0xb68]
mov dword [ebp - 0xb60], eax
push 0x5c
lea eax, [ebp - 0x5d0]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x4b708c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xb08], edi
push 0x403
push ebx
push ebx
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb24], eax
test eax, eax
jne 0x469ac3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb08], edi
test edi, edi
jle 0x469ab8
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb08], edi
test edi, edi
js 0x469b78
jmp 0x469979
mov esi, dword [0x4b706c]
mov ecx, esi
push 0x48
push dword [ebp - 0xb3c]
push dword [ebp - 0xb70]
call dword [0x4bb544]
call esi
push dword [ebp - 0xb60]
neg eax
mov dword [ebp - 0x5c0], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0x5d0], eax
mov byte [ebp - 0x5b6], 5
call fcn.00436775
mov esi, dword [0x4b7020]
lea eax, [ebp - 0x5d0]
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
jne 0x469b5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb08], edi
test edi, edi
jle 0x469b4c
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb08], edi
test edi, edi
js 0x469b61
mov edi, 0x80004005
mov dword [ebp - 0xb08], edi
jmp 0x469b61
mov dword [ebp - 0x7d0], eax
push dword [ebp - 0xb24]
mov esi, dword [0x4b70c0]
mov ecx, esi
push ebx
call dword [0x4bb544]
call esi
test edi, edi
js 0x46a34c
mov esi, dword [ebp - 0xb18]
mov ecx, ebx
mov eax, esi
mov edx, ebx
sub eax, 1
je 0x469b9b
sub eax, 1
je 0x469bd9
sub eax, 1
jne 0x469ba7
mov ecx, dword [ebp - 0xb2c]
mov edx, dword [ebp - 0xb34]
mov dword [ebp - 0x360], ecx
mov dword [ebp - 0x35c], edx
xor edx, edx
inc edx
cmp esi, edx
je 0x469c19
lea eax, [esi - 2]
cmp eax, edx
ja 0x469bed
mov edx, ebx
mov dword [ebp - 0xb90], ebx
mov eax, ebx
mov dword [ebp - 0xb60], edx
mov dword [ebp - 0xb4c], ebx
jmp 0x469c30
mov eax, dword [ebp - 0xb2c]
cdq
and edx, 3
lea ecx, [edx + eax]
mov edx, ebx
sar ecx, 2
jmp 0x469ba7
mov eax, dword [ebp - 0xc2c]
mov edx, dword [ebp - 0xc2c]
mov dword [ebp - 0xb4c], eax
mov eax, dword [ebp - 0xc2c]
mov dword [ebp - 0xb90], eax
mov eax, dword [ebp - 0xc2c]
mov dword [ebp - 0xb60], edx
jmp 0x469c30
mov eax, 0x96
mov dword [ebp - 0xb60], ebx
mov edx, ebx
mov dword [ebp - 0xb4c], 0x20
mov dword [ebp - 0xb70], eax
push dword [ebp - 0x7d4]
mov esi, dword [0x4b704c]
sub ecx, eax
push dword [ebp - 0xb38]
mov edi, dword [ebp - 0x7e0]
sub ecx, edx
mov dword [ebp - 0xb14], ecx
mov eax, ebx
mov dword [ebp - 0x7ac], ecx
mov dword [ebp - 0x7bc], ecx
mov ecx, esi
mov dword [ebp - 0xb08], eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b707c]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0xb24], eax
lea eax, [ebp - 0x7c4]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xb38]
call dword [0x4bb544]
call esi
test eax, eax
jne 0x469cb3
mov edi, 0x80004005
mov dword [ebp - 0xb08], edi
jmp 0x469cb5
mov edi, ebx
mov eax, dword [ebp - 0xb24]
test eax, eax
je 0x469cd6
mov esi, dword [0x4b704c]
mov ecx, esi
push eax
push dword [ebp - 0xb38]
call dword [0x4bb544]
call esi
test edi, edi
js 0x46a34c
push dword [ebp - 0x7d0]
mov esi, dword [0x4b704c]
mov eax, ebx
push dword [ebp - 0xb38]
mov edi, dword [ebp - 0x7dc]
mov ecx, esi
mov dword [ebp - 0xb08], eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b707c]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0xb24], eax
lea eax, [ebp - 0x7b4]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xb38]
call dword [0x4bb544]
call esi
test eax, eax
jne 0x469d45
mov edi, 0x80004005
mov dword [ebp - 0xb08], edi
jmp 0x469d47
mov edi, ebx
mov eax, dword [ebp - 0xb24]
test eax, eax
je 0x469d68
mov esi, dword [0x4b704c]
mov ecx, esi
push eax
push dword [ebp - 0xb38]
call dword [0x4bb544]
call esi
test edi, edi
js 0x46a34c
mov eax, dword [ebp - 0xb18]
cmp eax, 2
je 0x469d80
cmp eax, 3
jne 0x469da2
mov edi, dword [ebp - 0x7ac]
mov dword [ebp - 0xb14], edi
cmp dword [ebp - 0x7bc], edi
jle 0x469da8
mov edi, dword [ebp - 0x7bc]
mov dword [ebp - 0xb14], edi
jmp 0x469da8
mov edi, dword [ebp - 0xb14]
cmp dword [ebp - 0x7e8], 0
mov esi, dword [0x4b70b8]
mov ecx, esi
push dword [ebp - 0xb90]
je 0x469dfb
mov eax, edi
sub eax, dword [ebp - 0x7bc]
add eax, dword [ebp - 0xb60]
push eax
lea eax, [ebp - 0x7c4]
push eax
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0x7b8]
add eax, dword [ebp - 0xb4c]
push eax
mov eax, edi
sub eax, dword [ebp - 0x7ac]
add eax, dword [ebp - 0xb60]
push eax
jmp 0x469e23
push dword [ebp - 0xb70]
lea eax, [ebp - 0x7c4]
push eax
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0x7b8]
add eax, dword [ebp - 0xb4c]
push eax
push dword [ebp - 0xb70]
mov esi, dword [0x4b70b8]
lea eax, [ebp - 0x7b4]
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0xb18]
cmp eax, 2
je 0x46a13b
cmp eax, 3
je 0x46a13b
xor edx, edx
inc edx
cmp eax, edx
jne 0x46a15a
push 0x5c
lea eax, [ebp - 0x630]
mov dword [ebp - 0x7c8], 0xffffff
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x4b708c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xb08], edi
push 0x403
push ebx
push ebx
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb24], eax
test eax, eax
jne 0x469ed0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb08], edi
test edi, edi
jle 0x469ec5
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb08], edi
test edi, edi
js 0x469f81
jmp 0x469979
mov esi, dword [0x4b706c]
mov ecx, esi
push 0x48
push dword [ebp - 0xb3c]
push 0xb
call dword [0x4bb544]
call esi
push dword [ebp - 0xb80]
neg eax
mov dword [ebp - 0x620], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x614]
mov dword [ebp - 0x630], eax
mov byte [ebp - 0x616], 5
call fcn.00436775
mov esi, dword [0x4b7020]
lea eax, [ebp - 0x630]
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
jne 0x469f64
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb08], edi
test edi, edi
jle 0x469f55
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb08], edi
test edi, edi
js 0x469f6a
mov edi, 0x80004005
mov dword [ebp - 0xb08], edi
jmp 0x469f6a
mov dword [ebp - 0x7cc], eax
push dword [ebp - 0xb24]
mov esi, dword [0x4b70c0]
mov ecx, esi
push ebx
call dword [0x4bb544]
call esi
test edi, edi
js 0x46a34c
push dword [ebp - 0x7cc]
mov eax, dword [ebp - 0xb14]
push dword [ebp - 0xb38]
mov esi, dword [0x4b704c]
mov ecx, esi
mov edi, dword [ebp - 0x7d8]
mov dword [ebp - 0x79c], eax
mov eax, ebx
mov dword [ebp - 0xb08], eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b707c]
mov ecx, esi
push ebx
push 0x460
mov dword [ebp - 0xb24], eax
lea eax, [ebp - 0x7a4]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xb38]
call dword [0x4bb544]
call esi
test eax, eax
jne 0x469ffc
mov edi, 0x80004005
mov dword [ebp - 0xb08], edi
jmp 0x469ffe
mov edi, ebx
mov eax, dword [ebp - 0xb24]
test eax, eax
je 0x46a01f
mov esi, dword [0x4b704c]
mov ecx, esi
push eax
push dword [ebp - 0xb38]
call dword [0x4bb544]
call esi
test edi, edi
js 0x46a34c
mov eax, dword [ebp - 0x79c]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x79c], eax
cmp eax, ecx
jge 0x46a043
mov dword [ebp - 0x79c], ecx
mov edi, dword [ebp - 0xb3c]
mov esi, dword [0x4b706c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x7a4]
mov dword [ebp - 0x798], 0x20
call dword [0x4bb544]
call esi
mov esi, dword [0x4b706c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x7a0]
mov dword [ebp - 0x7a4], eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b706c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x79c]
mov dword [ebp - 0x7a0], eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b706c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x798]
mov dword [ebp - 0x79c], eax
call dword [0x4bb544]
call esi
cmp dword [ebp - 0x7e8], 0
mov dword [ebp - 0x798], eax
je 0x46a110
mov ecx, dword [ebp - 0x7c4]
cmp ecx, dword [ebp - 0x7b4]
jl 0x46a0ec
mov ecx, dword [ebp - 0x7b4]
mov eax, dword [ebp - 0x7a8]
add eax, 0x24
mov esi, dword [0x4b70b8]
push eax
push ecx
lea eax, [ebp - 0x7a4]
mov ecx, esi
push eax
call dword [0x4bb544]
call esi
jmp 0x46a157
mov ecx, dword [ebp - 0x7bc]
cmp ecx, dword [ebp - 0x7ac]
jg 0x46a124
mov ecx, dword [ebp - 0x7ac]
mov eax, dword [ebp - 0x7a8]
sub ecx, dword [ebp - 0x79c]
add eax, 0x24
add ecx, dword [ebp - 0x7a4]
jmp 0x46a0f5
mov eax, dword [ebp - 0x7a8]
mov dword [ebp - 0x360], edi
mov dword [ebp - 0x35c], eax
mov dword [ebp - 0x7c8], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x7e8]
lea edi, [ebp - 0x56c]
mov dword [ebp - 0xb24], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0xb34], eax
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0xb10], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xb18]
sub eax, 1
je 0x46a33a
sub eax, 1
je 0x46a261
sub eax, 1
jne 0x46a346
mov esi, dword [0x4b70b4]
lea edi, [ebp - 0x55c]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7094]
lea ecx, [ebp - 0x55c]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x55c], 0x28
call dword [0x4bb544]
call esi
test eax, eax
je 0x46a346
mov esi, dword [0x4b70b0]
lea eax, [ebp - 0x548]
push eax
push ebx
mov ecx, esi
call dword [0x4bb544]
call esi
mov esi, dword [0x4b70b0]
lea eax, [ebp - 0x540]
push eax
push ebx
mov ecx, esi
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0x540]
lea esi, [ebp - 0x548]
sub eax, dword [ebp - 0xb10]
lea edi, [ebp - 0x56c]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x53c]
sub eax, dword [ebp - 0xb34]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
jmp 0x46a32f
mov esi, dword [0x4b70b4]
lea edi, [ebp - 0x534]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7094]
lea ecx, [ebp - 0x534]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x534], 0x28
call dword [0x4bb544]
call esi
test eax, eax
je 0x46a346
mov esi, dword [0x4b70b0]
lea eax, [ebp - 0x520]
push eax
push ebx
mov ecx, esi
call dword [0x4bb544]
call esi
mov esi, dword [0x4b70b0]
lea eax, [ebp - 0x518]
push eax
push ebx
mov ecx, esi
call dword [0x4bb544]
call esi
cmp dword [ebp - 0xb24], 0
lea esi, [ebp - 0x520]
lea edi, [ebp - 0x56c]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x46a308
imul eax, dword [ebp - 0x518], 5
cdq
idiv ecx
add eax, dword [ebp - 0x520]
jmp 0x46a31a
mov eax, dword [ebp - 0x518]
sub eax, dword [ebp - 0xb10]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x514]
sub eax, dword [ebp - 0xb34]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x364], eax
jmp 0x46a346
mov dword [ebp - 0x368], ebx
mov dword [ebp - 0x364], ebx
mov dword [ebp - 0xb08], ebx
push dword [ebp - 0xb38]
mov esi, dword [0x4b70c0]
mov ecx, esi
push ebx
call dword [0x4bb544]
call esi
xor esi, esi
mov edi, 0x4ba824
inc esi
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x46a36b
mov eax, dword [0x4ba820]
test eax, eax
jle 0x46a3cc
sub eax, 1
mov dword [0x4ba820], eax
jne 0x46a3cc
mov esi, ebx
mov eax, dword [esi + 0x4b9980]
test eax, eax
je 0x46a39d
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x46a38c
push 0x40
push ebx
push 0x4b9980
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x402210
mov edi, 0x4b7010
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0x4ba824
inc esi
xor eax, eax
xchg dword [edi], eax
lea ecx, [ebp - 0xc50]
call fcn.004a83ac
mov eax, dword [ebp - 0xb08]
test eax, eax
js 0x46c055
mov eax, dword [ebp - 0x364]
mov edi, dword [ebp - 0x368]
push 0x54
mov dword [ebp - 0xb10], eax
mov dword [ebp - 0xc98], eax
lea eax, [ebp - 0x840]
push ebx
push eax
mov dword [ebp - 0xc9c], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xb34], esi
mov esi, dword [0x4b7038]
mov ecx, esi
push 7
push dword [ebp - 0xb28]
call dword [0x4bb544]
call esi
test eax, eax
je 0x46a480
mov esi, dword [0x4b7044]
lea ecx, [ebp - 0x840]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
je 0x46a480
push 0x20
pop eax
cmp word [ebp - 0x82e], ax
jne 0x46a480
cmp dword [ebp - 0x82c], 0
je 0x46a480
cmp dword [ebp - 0x83c], 0
jle 0x46a480
cmp dword [ebp - 0x838], 0
jg 0x46a48f
cmp dword [ebp - 0xb18], 1
mov dword [ebp - 0xb34], ebx
jne 0x46a503
push dword [ebp - 0xb10]
mov esi, dword [0x4b70b8]
lea eax, [ebp - 0x7c4]
push edi
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
push dword [ebp - 0xb10]
mov esi, dword [0x4b70b8]
lea eax, [ebp - 0x7b4]
push edi
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
mov edi, dword [ebp - 0xb18]
cmp edi, 1
jne 0x46a509
mov eax, dword [ebp - 0x7e4]
mov esi, dword [0x4b7024]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb54], eax
jmp 0x46a509
mov edi, dword [ebp - 0xb18]
mov esi, dword [0x4b7050]
mov ecx, esi
push 1
push dword [ebp - 0xb28]
call dword [0x4bb544]
call esi
cmp dword [ebp - 0x7e8], 0
mov dword [ebp - 0xb94], eax
mov dword [ebp - 0xb3c], 0x810
je 0x46a544
mov dword [ebp - 0xb3c], 0x20812
cmp dword [ebp - 0xb34], 0
je 0x46b0b5
mov eax, dword [ebp - 0x7e4]
mov esi, dword [ebp - 0x7e0]
mov dword [ebp - 0xb30], eax
mov eax, dword [ebp - 0x7d4]
push 0x54
mov dword [ebp - 0xb24], eax
lea eax, [ebp - 0x948]
push ebx
push eax
mov dword [ebp - 0xb10], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xb00]
push 0x54
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xb58], ebx
lea eax, [ebp - 0x4a4]
mov dword [ebp - 0xb34], ebx
mov dword [ebp - 0xb2c], ebx
mov dword [ebp - 0xb14], ebx
push 0x2c
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x400]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x46c035
mov edi, dword [ebp - 0xb28]
mov esi, dword [0x4b7038]
mov ecx, esi
push 7
push edi
call dword [0x4bb544]
call esi
test eax, eax
je 0x46b11b
mov esi, dword [0x4b7044]
lea ecx, [ebp - 0x948]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
je 0x46a63a
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0xb58], eax
mov eax, dword [ebp - 0x944]
mov dword [ebp - 0xb2c], eax
mov eax, dword [ebp - 0x940]
mov dword [ebp - 0xb14], eax
mov esi, dword [0x4b7018]
mov ecx, esi
push edi
call dword [0x4bb544]
call esi
mov edx, eax
mov dword [ebp - 0xb1c], edx
test edx, edx
je 0x46b11b
mov eax, dword [ebp - 0x7bc]
mov edi, ebx
sub eax, dword [ebp - 0x7c4]
mov ecx, dword [ebp - 0x7b8]
sub ecx, dword [ebp - 0x7c0]
mov esi, dword [0x4b701c]
neg ecx
mov dword [ebp - 0x4a0], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x49c], ecx
mov word [ebp - 0x498], ax
mov ecx, esi
pop eax
push ebx
push ebx
mov word [ebp - 0x496], ax
lea eax, [ebp - 0xc8c]
push eax
push ebx
lea eax, [ebp - 0x4a4]
mov dword [ebp - 0xc8c], ebx
push eax
push edx
mov dword [ebp - 0xb6c], edi
mov dword [ebp - 0x494], ebx
mov dword [ebp - 0x490], ebx
mov dword [ebp - 0x48c], ebx
mov dword [ebp - 0x488], ebx
mov dword [ebp - 0x484], ebx
mov dword [ebp - 0x480], ebx
mov dword [ebp - 0x47c], ebx
mov dword [ebp - 0x4a4], 0x28
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb44], eax
test eax, eax
jne 0x46a72a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x46a71a
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x46aae2
mov edi, 0x80004005
jmp 0x46aae2
mov esi, dword [0x4b7044]
lea ecx, [ebp - 0xb00]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
je 0x46a754
mov eax, dword [ebp - 0xaec]
mov dword [ebp - 0xb34], eax
mov eax, dword [ebp - 0x7bc]
sub eax, dword [ebp - 0x7c4]
push dword [ebp - 0xb44]
mov esi, dword [0x4b704c]
mov ecx, esi
push dword [ebp - 0xb1c]
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x7b8]
sub eax, dword [ebp - 0x7c0]
mov dword [ebp - 0x3f4], eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7050]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xb1c]
call dword [0x4bb544]
call esi
push dword [ebp - 0xb24]
mov esi, dword [0x4b704c]
mov ecx, esi
push dword [ebp - 0xb1c]
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7048]
mov ecx, esi
push ebx
mov dword [ebp - 0xb80], eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7084]
mov ecx, esi
push eax
lea eax, [ebp - 0x400]
push eax
push dword [ebp - 0xb1c]
call dword [0x4bb544]
call esi
mov esi, dword [0x4b707c]
lea eax, [ebp - 0x400]
push ebx
push dword [ebp - 0xb3c]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb10]
push dword [ebp - 0xb1c]
call dword [0x4bb544]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb18], eax
jne 0x46a865
cmp dword [ebp - 0xb30], 0
je 0x46a859
mov esi, dword [0x4b709c]
mov ecx, esi
push 8
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb84], eax
jmp 0x46a86f
mov dword [ebp - 0xb84], 0xffffff
jmp 0x46a86f
mov dword [ebp - 0xb84], 0xffa8a8a8
mov esi, dword [ebp - 0x7c4]
mov edx, ebx
mov eax, dword [ebp - 0x7c0]
mov ecx, ebx
mov dword [ebp - 0xb48], esi
mov dword [ebp - 0xb10], ebx
test esi, esi
jns 0x46a89f
mov edx, esi
mov dword [ebp - 0xb48], ebx
neg edx
mov dword [ebp - 0xb10], edx
test eax, eax
jns 0x46a8a9
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x3f8]
sub esi, edx
mov edx, dword [ebp - 0xb2c]
sub edx, dword [ebp - 0xb48]
mov dword [ebp - 0xb68], esi
cmp esi, edx
jl 0x46a8cf
mov esi, edx
mov dword [ebp - 0xb68], edx
mov edx, dword [ebp - 0x3f4]
sub dword [ebp - 0xb14], eax
sub edx, ecx
mov dword [ebp - 0xb64], edx
cmp edx, dword [ebp - 0xb14]
jl 0x46a8f7
mov edx, dword [ebp - 0xb14]
mov dword [ebp - 0xb64], edx
test esi, esi
jle 0x46aaab
test edx, edx
jle 0x46aaab
mov ebx, dword [ebp - 0x3f8]
mov edi, dword [ebp - 0xb2c]
mov esi, dword [ebp - 0xb34]
imul ecx, ebx
imul eax, edi
shl ebx, 2
mov dword [ebp - 0xb24], ebx
add ecx, dword [ebp - 0xb10]
add eax, dword [ebp - 0xb48]
shl edi, 2
mov dword [ebp - 0xb2c], edi
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xb58]
mov dword [ebp - 0xb30], ecx
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xb68]
mov dword [ebp - 0xb58], eax
test esi, esi
jle 0x46aa84
mov ebx, eax
mov dword [ebp - 0xb34], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xb14], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xb10], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x46aa45
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xb84]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb10]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xb14]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xb84]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb14]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xb82]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb14]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xb34]
cdq
idiv ecx
mov edx, dword [ebp - 0xb14]
add al, bl
mov ebx, dword [ebp - 0xb10]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xb14], edx
mov dword [ebp - 0xb34], esi
jne 0x46a97f
mov edx, dword [ebp - 0xb64]
mov esi, dword [ebp - 0xb68]
mov ecx, dword [ebp - 0xb30]
mov eax, dword [ebp - 0xb58]
mov ebx, dword [ebp - 0xb24]
mov edi, dword [ebp - 0xb2c]
add ecx, ebx
add eax, edi
sub edx, 1
mov dword [ebp - 0xb30], ecx
mov dword [ebp - 0xb58], eax
mov dword [ebp - 0xb64], edx
jne 0x46a95b
mov edi, dword [ebp - 0xb6c]
xor ebx, ebx
push dword [ebp - 0xb44]
mov esi, dword [0x4b702c]
mov ecx, esi
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0xb80]
test eax, eax
je 0x46aae2
mov esi, dword [0x4b704c]
mov ecx, esi
push eax
push dword [ebp - 0xb1c]
call dword [0x4bb544]
call esi
push dword [ebp - 0xb1c]
mov esi, dword [0x4b7028]
mov ecx, esi
call dword [0x4bb544]
call esi
test edi, edi
js 0x46c035
mov eax, dword [ebp - 0x7e4]
mov esi, dword [ebp - 0x7dc]
mov dword [ebp - 0xb30], eax
mov eax, dword [ebp - 0x7d0]
push 0x54
mov dword [ebp - 0xb24], eax
lea eax, [ebp - 0x8f0]
push ebx
push eax
mov dword [ebp - 0xb10], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xaa8]
push 0x54
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xb58], ebx
lea eax, [ebp - 0x44c]
mov dword [ebp - 0xb34], ebx
mov dword [ebp - 0xb2c], ebx
mov dword [ebp - 0xb14], ebx
push 0x2c
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x410]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x46c035
mov edi, dword [ebp - 0xb28]
mov esi, dword [0x4b7038]
mov ecx, esi
push 7
push edi
call dword [0x4bb544]
call esi
test eax, eax
je 0x46b11b
mov esi, dword [0x4b7044]
lea ecx, [ebp - 0x8f0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
je 0x46abe9
mov eax, dword [ebp - 0x8dc]
mov dword [ebp - 0xb58], eax
mov eax, dword [ebp - 0x8ec]
mov dword [ebp - 0xb2c], eax
mov eax, dword [ebp - 0x8e8]
mov dword [ebp - 0xb14], eax
mov esi, dword [0x4b7018]
mov ecx, esi
push edi
call dword [0x4bb544]
call esi
mov edx, eax
mov dword [ebp - 0xb1c], edx
test edx, edx
je 0x46b11b
mov eax, dword [ebp - 0x7ac]
mov edi, ebx
sub eax, dword [ebp - 0x7b4]
mov ecx, dword [ebp - 0x7a8]
sub ecx, dword [ebp - 0x7b0]
mov esi, dword [0x4b701c]
neg ecx
mov dword [ebp - 0x448], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x444], ecx
mov word [ebp - 0x440], ax
mov ecx, esi
pop eax
push ebx
push ebx
mov word [ebp - 0x43e], ax
lea eax, [ebp - 0xc90]
push eax
push ebx
lea eax, [ebp - 0x44c]
mov dword [ebp - 0xc90], ebx
push eax
push edx
mov dword [ebp - 0xb80], edi
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x44c], 0x28
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb44], eax
test eax, eax
jne 0x46acd9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x46acc9
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x46b092
mov edi, 0x80004005
jmp 0x46b092
mov esi, dword [0x4b7044]
lea ecx, [ebp - 0xaa8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
je 0x46ad03
mov eax, dword [ebp - 0xa94]
mov dword [ebp - 0xb34], eax
mov eax, dword [ebp - 0x7ac]
sub eax, dword [ebp - 0x7b4]
push dword [ebp - 0xb44]
mov esi, dword [0x4b704c]
mov ecx, esi
push dword [ebp - 0xb1c]
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x7a8]
sub eax, dword [ebp - 0x7b0]
mov dword [ebp - 0x404], eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7050]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xb1c]
call dword [0x4bb544]
call esi
push dword [ebp - 0xb24]
mov esi, dword [0x4b704c]
mov ecx, esi
push dword [ebp - 0xb1c]
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7048]
mov ecx, esi
push ebx
mov dword [ebp - 0xb60], eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7084]
mov ecx, esi
push eax
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0xb1c]
call dword [0x4bb544]
call esi
mov esi, dword [0x4b707c]
lea eax, [ebp - 0x410]
push ebx
push dword [ebp - 0xb3c]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb10]
push dword [ebp - 0xb1c]
call dword [0x4bb544]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb18], eax
jne 0x46ae0e
cmp dword [ebp - 0xb30], 0
je 0x46ae02
mov esi, dword [0x4b709c]
mov ecx, esi
push 8
call dword [0x4bb544]
call esi
jmp 0x46ae13
mov dword [ebp - 0xb68], 0xffffff
jmp 0x46ae1f
mov eax, 0xffa8a8a8
mov dword [ebp - 0xb68], eax
mov dword [ebp - 0xb0c], eax
mov esi, dword [ebp - 0x7b4]
mov edx, ebx
mov eax, dword [ebp - 0x7b0]
mov ecx, ebx
mov dword [ebp - 0xb48], esi
mov dword [ebp - 0xb10], ebx
test esi, esi
jns 0x46ae4f
mov edx, esi
mov dword [ebp - 0xb48], ebx
neg edx
mov dword [ebp - 0xb10], edx
test eax, eax
jns 0x46ae59
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x408]
sub esi, edx
mov edx, dword [ebp - 0xb2c]
sub edx, dword [ebp - 0xb48]
mov dword [ebp - 0xb64], esi
cmp esi, edx
jl 0x46ae7f
mov esi, edx
mov dword [ebp - 0xb64], edx
mov edx, dword [ebp - 0x404]
sub dword [ebp - 0xb14], eax
sub edx, ecx
mov dword [ebp - 0xb6c], edx
cmp edx, dword [ebp - 0xb14]
jl 0x46aea7
mov edx, dword [ebp - 0xb14]
mov dword [ebp - 0xb6c], edx
test esi, esi
jle 0x46b05b
test edx, edx
jle 0x46b05b
mov ebx, dword [ebp - 0x408]
mov edi, dword [ebp - 0xb2c]
mov esi, dword [ebp - 0xb34]
imul ecx, ebx
imul eax, edi
shl ebx, 2
mov dword [ebp - 0xb24], ebx
add ecx, dword [ebp - 0xb10]
add eax, dword [ebp - 0xb48]
shl edi, 2
mov dword [ebp - 0xb2c], edi
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xb58]
mov dword [ebp - 0xb30], ecx
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xb64]
mov dword [ebp - 0xb58], eax
test esi, esi
jle 0x46b034
mov ebx, eax
mov dword [ebp - 0xb34], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xb14], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xb10], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x46aff5
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xb0c]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb10]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xb14]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xb0c]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb14]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xb66]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb14]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xb34]
cdq
idiv ecx
mov edx, dword [ebp - 0xb14]
add al, bl
mov ebx, dword [ebp - 0xb10]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xb14], edx
mov dword [ebp - 0xb34], esi
jne 0x46af2f
mov edx, dword [ebp - 0xb6c]
mov esi, dword [ebp - 0xb64]
mov ecx, dword [ebp - 0xb30]
mov eax, dword [ebp - 0xb58]
mov ebx, dword [ebp - 0xb24]
mov edi, dword [ebp - 0xb2c]
add ecx, ebx
add eax, edi
sub edx, 1
mov dword [ebp - 0xb30], ecx
mov dword [ebp - 0xb58], eax
mov dword [ebp - 0xb6c], edx
jne 0x46af0b
mov edi, dword [ebp - 0xb80]
xor ebx, ebx
push dword [ebp - 0xb44]
mov esi, dword [0x4b702c]
mov ecx, esi
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0xb60]
test eax, eax
je 0x46b092
mov esi, dword [0x4b704c]
mov ecx, esi
push eax
push dword [ebp - 0xb1c]
call dword [0x4bb544]
call esi
push dword [ebp - 0xb1c]
mov esi, dword [0x4b7028]
mov ecx, esi
call dword [0x4bb544]
call esi
test edi, edi
js 0x46c035
jmp 0x46bfe3
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x7e4], 0
jne 0x46b0c9
cmp edi, ecx
je 0x46b0c9
mov al, 0xc0
jmp 0x46b0cb
or al, 0xff
mov byte [ebp - 0xb7e], al
lea edi, [ebp - 0x388]
xor eax, eax
mov esi, dword [0x4b7018]
stosd dword es:[edi], eax
push dword [ebp - 0xb28]
mov byte [ebp - 0xb7d], cl
mov ecx, esi
mov byte [ebp - 0xb80], bl
stosd dword es:[edi], eax
mov byte [ebp - 0xb7f], bl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x378]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb5c], eax
test eax, eax
jne 0x46b126
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x46c035
xor eax, eax
inc eax
cmp dword [ebp - 0xb18], eax
jne 0x46b257
mov edi, dword [ebp - 0x7bc]
mov eax, edi
mov ecx, dword [ebp - 0x7ac]
mov edx, ecx
sub edx, dword [ebp - 0x7b4]
sub eax, dword [ebp - 0x7c4]
mov dword [ebp - 0xb20], edx
cmp edx, eax
jg 0x46b163
mov edx, eax
mov dword [ebp - 0xb20], eax
mov esi, dword [ebp - 0x7a8]
mov eax, esi
sub eax, dword [ebp - 0x7c0]
cmp dword [ebp - 0x7e8], 0
mov dword [ebp - 0xb6c], eax
mov dword [ebp - 0xb10], ebx
je 0x46b1c8
mov eax, dword [ebp - 0x7c4]
sub eax, edi
add eax, edx
mov edx, eax
mov dword [ebp - 0xb10], eax
mov eax, dword [ebp - 0x7b4]
sub eax, ecx
mov dword [ebp - 0xb4c], edx
add eax, dword [ebp - 0xb20]
mov dword [ebp - 0x388], edx
mov edx, eax
mov dword [ebp - 0xb1c], edx
mov dword [ebp - 0x378], edx
mov edx, dword [ebp - 0xb20]
jmp 0x46b1e2
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0xb4c], eax
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0xb1c], eax
mov eax, ebx
sub edi, dword [ebp - 0x7c4]
add edi, dword [ebp - 0xb10]
sub ecx, dword [ebp - 0x7b4]
sub esi, dword [ebp - 0x7b0]
add ecx, eax
mov eax, dword [ebp - 0x7b0]
sub eax, dword [ebp - 0x7c0]
mov dword [ebp - 0xb10], edi
mov dword [ebp - 0x380], edi
mov edi, dword [ebp - 0x7b8]
sub edi, dword [ebp - 0x7c0]
add esi, eax
mov dword [ebp - 0xb60], edi
mov dword [ebp - 0x37c], edi
mov dword [ebp - 0xb38], ecx
mov dword [ebp - 0x370], ecx
mov dword [ebp - 0xb24], eax
mov dword [ebp - 0x374], eax
mov dword [ebp - 0xb08], esi
mov dword [ebp - 0x36c], esi
jmp 0x46b2e3
mov eax, dword [ebp - 0x35c]
lea esi, [ebp - 0x7c4]
lea edi, [ebp - 0x388]
mov edx, dword [ebp - 0x360]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb6c], eax
mov dword [ebp - 0xb20], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x37c]
lea esi, [ebp - 0x7b4]
lea edi, [ebp - 0x378]
mov dword [ebp - 0xb60], eax
mov eax, dword [ebp - 0x380]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb10], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0xb4c], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0xb38], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0xb24], eax
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0xb1c], eax
mov edi, dword [ebp - 0xb6c]
mov eax, edi
mov esi, dword [0x4b701c]
neg eax
mov dword [ebp - 0x470], eax
mov ecx, esi
xor eax, eax
mov dword [ebp - 0xccc], ebx
push 0x20
inc eax
mov dword [ebp - 0x468], ebx
mov word [ebp - 0x46c], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x46a], ax
lea eax, [ebp - 0xccc]
push eax
push ebx
lea eax, [ebp - 0x478]
mov dword [ebp - 0x464], ebx
push eax
push dword [ebp - 0xb5c]
mov dword [ebp - 0x460], ebx
mov dword [ebp - 0x45c], ebx
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x450], ebx
mov dword [ebp - 0x478], 0x28
mov dword [ebp - 0x474], edx
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb50], eax
test eax, eax
jne 0x46b383
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x46c01a
mov esi, dword [0x4b704c]
mov ecx, esi
push eax
push dword [ebp - 0xb5c]
call dword [0x4bb544]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb18], eax
jne 0x46b3eb
mov ecx, dword [ebp - 0xb54]
test ecx, ecx
je 0x46b3eb
mov eax, dword [ebp - 0xb20]
mov esi, dword [0x4b7084]
push ecx
mov dword [ebp - 0x504], eax
mov ecx, esi
lea eax, [ebp - 0x50c]
mov dword [ebp - 0x50c], ebx
push eax
push dword [ebp - 0xb5c]
mov dword [ebp - 0x508], ebx
mov dword [ebp - 0x500], edi
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0x7e4]
mov esi, dword [ebp - 0x7e0]
mov dword [ebp - 0xb48], eax
mov eax, dword [ebp - 0x7d4]
push 0x54
mov dword [ebp - 0xb44], eax
lea eax, [ebp - 0x898]
push ebx
push eax
mov dword [ebp - 0xb2c], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x9f8]
push 0x54
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xb30], ebx
lea eax, [ebp - 0x4fc]
mov dword [ebp - 0xb34], ebx
mov dword [ebp - 0xb90], ebx
mov dword [ebp - 0xb70], ebx
push 0x2c
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x398]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x46bfff
mov edi, dword [ebp - 0xb5c]
mov esi, dword [0x4b7038]
mov ecx, esi
push 7
push edi
call dword [0x4bb544]
call esi
test eax, eax
jne 0x46b499
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x46bfff
mov esi, dword [0x4b7044]
lea ecx, [ebp - 0x898]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
je 0x46b4db
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0xb30], eax
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0xb90], eax
mov eax, dword [ebp - 0x890]
mov dword [ebp - 0xb70], eax
mov esi, dword [0x4b7018]
mov ecx, esi
push edi
call dword [0x4bb544]
call esi
mov ecx, eax
mov dword [ebp - 0xb64], ecx
test ecx, ecx
je 0x46b48e
mov edi, dword [ebp - 0x384]
mov eax, dword [ebp - 0xb60]
sub eax, edi
mov esi, dword [0x4b701c]
mov dword [ebp - 0xb60], eax
neg eax
mov dword [ebp - 0x4f4], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xb58], edi
mov edi, dword [ebp - 0xb10]
sub edi, dword [ebp - 0xb4c]
mov word [ebp - 0x4f0], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x4ee], ax
lea eax, [ebp - 0xca4]
push eax
push ebx
lea eax, [ebp - 0x4fc]
mov dword [ebp - 0xca4], ebx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0xb88], ebx
mov dword [ebp - 0x4ec], ebx
mov dword [ebp - 0x4e8], ebx
mov dword [ebp - 0x4e4], ebx
mov dword [ebp - 0x4e0], ebx
mov dword [ebp - 0x4dc], ebx
mov dword [ebp - 0x4d8], ebx
mov dword [ebp - 0x4d4], ebx
mov dword [ebp - 0x4fc], 0x28
mov dword [ebp - 0x4f8], edi
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb40], eax
test eax, eax
jne 0x46b5e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb88], eax
test eax, eax
jle 0x46b5cc
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb88], eax
test eax, eax
js 0x46b98b
mov dword [ebp - 0xb88], 0x80004005
jmp 0x46b98b
mov esi, dword [0x4b7044]
lea ecx, [ebp - 0x9f8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
je 0x46b60b
mov eax, dword [ebp - 0x9e4]
mov dword [ebp - 0xb34], eax
push dword [ebp - 0xb40]
mov eax, dword [ebp - 0xb60]
mov esi, dword [0x4b704c]
mov ecx, esi
mov dword [ebp - 0x390], edi
mov edi, dword [ebp - 0xb64]
push edi
mov dword [ebp - 0x38c], eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7050]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0x4bb544]
call esi
push dword [ebp - 0xb44]
mov esi, dword [0x4b704c]
mov ecx, esi
push edi
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7048]
mov ecx, esi
push ebx
mov dword [ebp - 0xb60], eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7084]
mov ecx, esi
push eax
lea eax, [ebp - 0x398]
push eax
push edi
call dword [0x4bb544]
call esi
mov esi, dword [0x4b707c]
lea eax, [ebp - 0x398]
push ebx
push dword [ebp - 0xb3c]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb2c]
push edi
call dword [0x4bb544]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb18], eax
jne 0x46b6f7
cmp dword [ebp - 0xb48], 0
je 0x46b6eb
mov esi, dword [0x4b709c]
mov ecx, esi
push 8
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb14], eax
jmp 0x46b701
mov dword [ebp - 0xb14], 0xffffff
jmp 0x46b701
mov dword [ebp - 0xb14], 0xffa8a8a8
mov ecx, dword [ebp - 0xb4c]
mov dword [ebp - 0xb48], ebx
mov dword [ebp - 0xb2c], ebx
test ecx, ecx
jns 0x46b723
mov edx, ecx
mov ecx, ebx
neg edx
mov dword [ebp - 0xb48], edx
mov eax, dword [ebp - 0x384]
test eax, eax
jns 0x46b73f
mov edx, eax
mov eax, ebx
neg edx
mov dword [ebp - 0xb58], eax
mov dword [ebp - 0xb2c], edx
mov esi, dword [ebp - 0x390]
mov edx, dword [ebp - 0xb90]
sub esi, dword [ebp - 0xb48]
sub edx, ecx
mov dword [ebp - 0xb44], esi
cmp esi, edx
jl 0x46b765
mov esi, edx
mov dword [ebp - 0xb44], edx
mov edx, dword [ebp - 0x38c]
sub dword [ebp - 0xb70], eax
sub edx, dword [ebp - 0xb2c]
mov eax, dword [ebp - 0xb70]
mov dword [ebp - 0xb68], edx
cmp edx, eax
jl 0x46b78f
mov edx, eax
mov dword [ebp - 0xb68], eax
test esi, esi
jle 0x46b959
test edx, edx
jle 0x46b959
mov eax, dword [ebp - 0x390]
imul eax, dword [ebp - 0xb2c]
mov edi, dword [ebp - 0xb34]
add eax, dword [ebp - 0xb48]
lea ebx, [edi + eax*4]
mov eax, dword [ebp - 0xb90]
imul eax, dword [ebp - 0xb58]
mov dword [ebp - 0xb2c], ebx
add eax, ecx
mov ecx, dword [ebp - 0xb30]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x390]
shl ecx, 2
mov dword [ebp - 0xb58], ecx
mov ecx, dword [ebp - 0xb90]
shl ecx, 2
mov dword [ebp - 0xb30], ecx
mov ecx, dword [ebp - 0xb58]
mov edi, dword [ebp - 0xb30]
mov dword [ebp - 0xb48], eax
test esi, esi
jle 0x46b932
lea edx, [eax + 3]
mov dword [ebp - 0xb34], esi
sub eax, ebx
mov dword [ebp - 0xb84], edx
lea edi, [ebx + 2]
mov dword [ebp - 0xb10], eax
mov ebx, esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x46b8f3
mov eax, dword [ebp - 0xb10]
movzx esi, cl
mov bl, byte [eax + edi]
mov eax, dword [ebp - 0xb14]
movzx eax, al
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb10]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xb84]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xb14]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb84]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xb12]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb84]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov edx, dword [ebp - 0xb84]
add al, bl
mov ebx, dword [ebp - 0xb34]
mov byte [edx], al
add edx, 4
add edi, 4
sub ebx, 1
mov dword [ebp - 0xb84], edx
mov dword [ebp - 0xb34], ebx
jne 0x46b82d
mov edx, dword [ebp - 0xb68]
mov esi, dword [ebp - 0xb44]
mov ebx, dword [ebp - 0xb2c]
mov eax, dword [ebp - 0xb48]
mov ecx, dword [ebp - 0xb58]
mov edi, dword [ebp - 0xb30]
add ebx, ecx
add eax, edi
sub edx, 1
mov dword [ebp - 0xb2c], ebx
mov dword [ebp - 0xb48], eax
mov dword [ebp - 0xb68], edx
jne 0x46b809
mov edi, dword [ebp - 0xb64]
xor ebx, ebx
push dword [ebp - 0xb40]
mov esi, dword [0x4b702c]
mov ecx, esi
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0xb60]
test eax, eax
je 0x46b98b
mov esi, dword [0x4b704c]
mov ecx, esi
push eax
push edi
call dword [0x4bb544]
call esi
push dword [ebp - 0xb64]
mov esi, dword [0x4b7028]
mov ecx, esi
call dword [0x4bb544]
call esi
cmp dword [ebp - 0xb88], 0
jl 0x46bfff
mov eax, dword [ebp - 0x7e4]
mov esi, dword [ebp - 0x7dc]
mov dword [ebp - 0xb44], eax
mov eax, dword [ebp - 0x7d0]
push 0x54
mov dword [ebp - 0xb58], eax
lea eax, [ebp - 0x9a0]
push ebx
push eax
mov dword [ebp - 0xb30], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa50]
push 0x54
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xb34], ebx
lea eax, [ebp - 0x4d0]
mov dword [ebp - 0xb10], ebx
mov dword [ebp - 0xb60], ebx
mov dword [ebp - 0xb14], ebx
push 0x2c
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x3a8]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x46bfff
mov edi, dword [ebp - 0xb5c]
mov esi, dword [0x4b7038]
mov ecx, esi
push 7
push edi
call dword [0x4bb544]
call esi
test eax, eax
je 0x46b48e
mov esi, dword [0x4b7044]
lea ecx, [ebp - 0x9a0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
je 0x46ba97
mov eax, dword [ebp - 0x98c]
mov dword [ebp - 0xb34], eax
mov eax, dword [ebp - 0x99c]
mov dword [ebp - 0xb60], eax
mov eax, dword [ebp - 0x998]
mov dword [ebp - 0xb14], eax
mov esi, dword [0x4b7018]
mov ecx, esi
push edi
call dword [0x4bb544]
call esi
mov ecx, eax
mov dword [ebp - 0xb40], ecx
test ecx, ecx
je 0x46b48e
mov eax, dword [ebp - 0xb38]
sub eax, dword [ebp - 0xb1c]
mov edx, dword [ebp - 0xb08]
mov edi, dword [ebp - 0xb24]
sub edx, edi
mov esi, dword [0x4b701c]
mov dword [ebp - 0xb38], eax
mov dword [ebp - 0x4cc], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xb08], edx
mov word [ebp - 0x4c4], ax
neg edx
pop eax
push ebx
push ebx
mov word [ebp - 0x4c2], ax
lea eax, [ebp - 0xca0]
push eax
push ebx
lea eax, [ebp - 0x4d0]
mov dword [ebp - 0xca0], ebx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0xb4c], ebx
mov dword [ebp - 0x4c0], ebx
mov dword [ebp - 0x4bc], ebx
mov dword [ebp - 0x4b8], ebx
mov dword [ebp - 0x4b4], ebx
mov dword [ebp - 0x4b0], ebx
mov dword [ebp - 0x4ac], ebx
mov dword [ebp - 0x4a8], ebx
mov dword [ebp - 0x4d0], 0x28
mov dword [ebp - 0x4c8], edx
call dword [0x4bb544]
call esi
mov dword [ebp - 0xb64], eax
test eax, eax
jne 0x46bba1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb4c], eax
test eax, eax
jle 0x46bb8c
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb4c], eax
test eax, eax
js 0x46bf38
mov dword [ebp - 0xb4c], 0x80004005
jmp 0x46bf38
mov esi, dword [0x4b7044]
lea ecx, [ebp - 0xa50]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4bb544]
call esi
test eax, eax
je 0x46bbcb
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0xb10], eax
push dword [ebp - 0xb64]
mov eax, dword [ebp - 0xb38]
push dword [ebp - 0xb40]
mov esi, dword [0x4b704c]
mov ecx, esi
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0x39c], eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7050]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xb40]
call dword [0x4bb544]
call esi
push dword [ebp - 0xb58]
mov esi, dword [0x4b704c]
mov ecx, esi
push dword [ebp - 0xb40]
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7048]
mov ecx, esi
push ebx
mov dword [ebp - 0xb70], eax
call dword [0x4bb544]
call esi
mov esi, dword [0x4b7084]
mov ecx, esi
push eax
lea eax, [ebp - 0x3a8]
push eax
push dword [ebp - 0xb40]
call dword [0x4bb544]
call esi
mov esi, dword [0x4b707c]
lea eax, [ebp - 0x3a8]
push ebx
push dword [ebp - 0xb3c]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb30]
push dword [ebp - 0xb40]
call dword [0x4bb544]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb18], eax
jne 0x46bcca
cmp dword [ebp - 0xb44], 0
je 0x46bcbe
mov esi, dword [0x4b709c]
mov ecx, esi
push 8
call dword [0x4bb544]
call esi
jmp 0x46bccf
mov dword [ebp - 0xb2c], 0xffffff
jmp 0x46bcdb
mov eax, 0xffa8a8a8
mov dword [ebp - 0xb2c], eax
mov dword [ebp - 0xb0c], eax
mov ecx, dword [ebp - 0xb1c]
mov edx, ebx
mov eax, ebx
test ecx, ecx
jns 0x46bcf3
mov edx, ecx
mov dword [ebp - 0xb1c], ebx
neg edx
test edi, edi
jns 0x46bcfd
mov eax, edi
mov edi, ebx
neg eax
mov esi, dword [ebp - 0x3a0]
mov ecx, dword [ebp - 0xb60]
sub esi, edx
sub ecx, dword [ebp - 0xb1c]
mov dword [ebp - 0xb58], esi
cmp esi, ecx
jl 0x46bd23
mov esi, ecx
mov dword [ebp - 0xb58], ecx
mov ecx, dword [ebp - 0x39c]
sub dword [ebp - 0xb14], edi
sub ecx, eax
mov dword [ebp - 0xb48], ecx
cmp ecx, dword [ebp - 0xb14]
jl 0x46bd4b
mov ecx, dword [ebp - 0xb14]
mov dword [ebp - 0xb48], ecx
test esi, esi
jle 0x46bf01
test ecx, ecx
jle 0x46bf01
imul eax, dword [ebp - 0x3a0]
imul edi, dword [ebp - 0xb60]
add eax, edx
mov edx, dword [ebp - 0xb10]
add edi, dword [ebp - 0xb1c]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0xb34]
mov dword [ebp - 0xb44], eax
lea ebx, [edx + edi*4]
mov edx, dword [ebp - 0x3a0]
shl edx, 2
mov dword [ebp - 0xb34], edx
mov edx, dword [ebp - 0xb60]
shl edx, 2
mov dword [ebp - 0xb30], edx
mov edx, dword [ebp - 0xb34]
mov edi, dword [ebp - 0xb30]
mov dword [ebp - 0xb68], ebx
test esi, esi
jle 0x46bee0
lea edx, [ebx + 3]
mov dword [ebp - 0xb10], esi
sub ebx, eax
mov dword [ebp - 0xb14], edx
lea edi, [eax + 2]
mov dword [ebp - 0xb24], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x46bea1
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xb0c]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb24]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xb14]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xb0c]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb14]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xb2a]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb14]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xb10]
cdq
idiv ecx
mov edx, dword [ebp - 0xb14]
add al, bl
mov ebx, dword [ebp - 0xb24]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xb14], edx
mov dword [ebp - 0xb10], esi
jne 0x46bddb
mov ecx, dword [ebp - 0xb48]
mov esi, dword [ebp - 0xb58]
mov eax, dword [ebp - 0xb44]
mov ebx, dword [ebp - 0xb68]
mov edx, dword [ebp - 0xb34]
mov edi, dword [ebp - 0xb30]
add eax, edx
add ebx, edi
sub ecx, 1
mov dword [ebp - 0xb44], eax
mov dword [ebp - 0xb68], ebx
mov dword [ebp - 0xb48], ecx
jne 0x46bdb9
xor ebx, ebx
push dword [ebp - 0xb64]
mov esi, dword [0x4b702c]
mov ecx, esi
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0xb70]
test eax, eax
je 0x46bf38
mov esi, dword [0x4b704c]
mov ecx, esi
push eax
push dword [ebp - 0xb40]
call dword [0x4bb544]
call esi
push dword [ebp - 0xb40]
mov esi, dword [0x4b7028]
mov ecx, esi
call dword [0x4bb544]
call esi
cmp dword [ebp - 0xb4c], 0
jl 0x46bfff
xor eax, eax
inc eax
cmp dword [ebp - 0xb18], eax
jne 0x46bfa3
mov esi, dword [0x4b7010]
mov ecx, esi
push 0xcc0020
push ebx
push ebx
push dword [ebp - 0xb5c]
push dword [ebp - 0xb6c]
push dword [ebp - 0xb20]
push dword [ebp - 0x7c0]
push dword [ebp - 0x7c4]
push dword [ebp - 0xb28]
call dword [0x4bb544]
call esi
jmp 0x46bfe3
push dword [ebp - 0xb80]
mov ecx, dword [ebp - 0xb6c]
mov eax, dword [ebp - 0xb20]
mov esi, dword [0x4b7030]
push ecx
push eax
push ebx
push ebx
push dword [ebp - 0xb5c]
push ecx
push eax
push dword [ebp - 0x364]
mov ecx, esi
push dword [ebp - 0x368]
push dword [ebp - 0xb28]
call dword [0x4bb544]
call esi
push dword [ebp - 0xb94]
mov esi, dword [0x4b7050]
mov ecx, esi
push dword [ebp - 0xb28]
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0xb50]
test eax, eax
je 0x46c01a
mov esi, dword [0x4b702c]
mov ecx, esi
push eax
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0xb5c]
test eax, eax
je 0x46c035
mov esi, dword [0x4b7028]
mov ecx, esi
push eax
call dword [0x4bb544]
call esi
mov eax, dword [ebp - 0xb54]
test eax, eax
je 0x46c050
mov esi, dword [0x4b702c]
mov ecx, esi
push eax
call dword [0x4bb544]
call esi
mov edi, 0x4ba824
mov ecx, dword [ebp - 0x7e0]
test ecx, ecx
je 0x46c0a4
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x46c062
mov eax, dword [ebp - 0x7e0]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x46c08a
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x46c082
push dword [ebp - 0x7e0]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x7e0], ebx
mov ecx, dword [ebp - 0x7dc]
test ecx, ecx
je 0x46c0f3
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x46c0b1
mov eax, dword [ebp - 0x7dc]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x46c0d9
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x46c0d1
push dword [ebp - 0x7dc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x7dc], ebx
mov edx, dword [ebp - 0x7d8]
test edx, edx
je 0x46c13f
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x46c102
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x46c12a
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0x46c11c
mov edx, dword [ebp - 0x7d8]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x7d8], ebx
cmp dword [ebp - 0x7d4], 0
je 0x46c164
push dword [ebp - 0x7d4]
mov esi, dword [0x4b702c]
mov ecx, esi
call dword [0x4bb544]
call esi
mov dword [ebp - 0x7d4], ebx
cmp dword [ebp - 0x7d0], 0
je 0x46c189
push dword [ebp - 0x7d0]
mov esi, dword [0x4b702c]
mov ecx, esi
call dword [0x4bb544]
call esi
mov dword [ebp - 0x7d0], ebx
cmp dword [ebp - 0x7cc], 0
je 0x46c1ae
push dword [ebp - 0x7cc]
mov esi, dword [0x4b702c]
mov ecx, esi
call dword [0x4bb544]
call esi
mov dword [ebp - 0x7cc], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x46c1b0
mov eax, dword [0x4ba820]
push 0
pop ebx
test eax, eax
jle 0x46c212
sub eax, 1
mov dword [0x4ba820], eax
jne 0x46c212
mov esi, ebx
mov eax, dword [esi + 0x4b9980]
test eax, eax
je 0x46c1e6
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x46c1d5
push 0x40
push ebx
push 0x4b9980
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x402210
mov edi, 0x4b7010
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x4ba824
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0x4b93f4]
mov esi, dword [0x4b705c]
mov ecx, esi
mov dword [ebp - 0xb68], eax
call dword [0x4bb544]
call esi
sub eax, dword [0x4ba818]
lea edi, [ebp - 0x2f0]
push 8
mov dword [ebp - 0xb48], eax
mov edx, 0x4ba824
xor eax, eax
xor ebx, ebx
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x46c251
mov eax, dword [0x4ba820]
push 0
pop ebx
test eax, eax
jne 0x46c8c0
push 0x338
mov edi, ebx
mov dword [ebp - 0xb2c], ebx
push ebx
mov dword [ebp - 0xb88], edi
mov dword [ebp - 0xb30], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb58], eax
test eax, eax
je 0x46c859
or dword [ebp - 0xb10], 0xffffffff
mov eax, 0x7f1137f
mov dword [ebp - 0x3dc], eax
mov cl, bl
movzx edx, word [ebp - 0x3da]
mov eax, ebx
mov dword [ebp - 0xbe0], eax
mov eax, 0x7f1137f
movzx eax, ax
mov dword [ebp - 0xb3c], eax
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0x3e0], 0xab69605e
add eax, 7
movzx esi, word [ebp - 0x3de]
mov dword [ebp - 0xb24], ebx
mov dword [ebp - 0xb50], ebx
mov dword [ebp - 0xbec], edi
mov dword [ebp - 0xb14], edx
mov dword [ebp - 0xb0c], esi
mov dword [ebp - 0xb34], eax
mov esi, dword [ebp - 0xbf8]
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edx, eax
mov dword [ebp - 0xb94], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
mov ebx, dword [ebp - 0xb50]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 5]
shl edx, 8
add esi, 8
or edx, eax
mov dword [ebp - 0xbf8], esi
xor ebx, edx
mov esi, dword [ebp - 0xb3c]
mov dword [ebp - 0xb44], edx
xor ebx, edi
mov eax, 0x7f1137f
xor ebx, eax
xor ebx, 0xab69605e
mov eax, ebx
rol eax, 0xa
lea edx, [ebx + 0x54969fa2]
rol edx, 5
imul edx, esi
add eax, edx
mov edx, 0x7f1137f
xor edi, eax
mov eax, edi
rol eax, 2
lea edx, [edi + edx]
ror edx, 9
imul edx, dword [ebp - 0xb0c]
sub edx, eax
xor ebx, edx
mov eax, ebx
sub eax, esi
imul edx, eax, 0x605e
mov eax, ebx
shr eax, 0xd
sub edx, eax
xor edi, edx
mov edx, edi
mov eax, edi
xor edx, dword [ebp - 0xb0c]
rol edx, 6
imul edx, dword [ebp - 0xb14]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
xor edx, 0xab69605e
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, esi
ror edx, 6
imul eax, dword [ebp - 0xb0c]
xor edx, eax
mov eax, 0x7f1137f
xor ebx, edx
add eax, ebx
mov edx, ebx
ror eax, 0xf
rol edx, 2
imul eax, eax, 0x605e
add edx, eax
mov eax, dword [ebp - 0xb14]
xor edi, edx
mov edx, edi
rol edx, 8
lea esi, [edi + 0x54969fa2]
ror esi, 0xe
imul eax, esi
sub eax, edx
xor ebx, eax
mov eax, dword [ebp - 0xb3c]
mov esi, ebx
mov edx, ebx
ror edx, 0xa
xor esi, 0xab69605e
ror esi, 0xc
imul eax, esi
mov esi, dword [ebp - 0xb14]
xor edx, eax
xor edi, edx
mov edx, edi
mov eax, edi
xor edx, esi
shr eax, 0xa
imul edx, dword [ebp - 0xb0c]
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb3c]
mov eax, ebx
not eax
ror eax, 5
add eax, 0x605e
imul eax, esi
xor edi, eax
mov eax, esi
mov dword [ebp - 0xb54], edi
sub edi, esi
xor edi, ebx
mov ebx, dword [ebp - 0xb54]
xor edi, 0xab69605e
xor eax, edi
rol eax, 2
imul edx, eax
mov eax, edi
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov esi, ebx
mov edx, ebx
sub esi, eax
rol edx, 7
mov eax, dword [ebp - 0xb0c]
ror esi, 6
imul eax, esi
mov esi, dword [ebp - 0xb0c]
add edx, eax
mov eax, dword [ebp - 0xb3c]
xor edi, edx
xor eax, edi
mov edx, edi
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
mov eax, dword [ebp - 0xb14]
xor ebx, edx
xor esi, ebx
mov dword [ebp - 0xb54], ebx
rol esi, 5
mov edx, ebx
imul eax, esi
rol edx, 7
add edx, eax
xor edi, edx
mov edx, 0x7f1137f
mov ebx, edi
xor ebx, dword [ebp - 0xb54]
xor ebx, edx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xb0c]
imul eax, dword [ebp - 0xb3c]
xor edi, eax
mov eax, edi
sub eax, edx
mov edx, edi
ror eax, 1
imul eax, eax, 0x605e
ror edx, 6
sub eax, edx
xor ebx, eax
mov eax, dword [ebp - 0xb14]
mov edx, ebx
rol edx, 0xe
lea esi, [ebx - 0x54969fa2]
rol esi, 3
imul eax, esi
add edx, eax
mov eax, dword [ebp - 0xb3c]
xor edi, edx
mov edx, edi
ror edx, 0xe
lea esi, [edi - 0x54969fa2]
rol esi, 0xf
imul eax, esi
sub eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
shr eax, 3
xor edx, 0x605e
imul edx, dword [ebp - 0xb0c]
xor edx, eax
xor edi, edx
mov edx, 0x7f1137f
mov eax, edi
xor eax, edx
mov edx, edi
xor edi, dword [ebp - 0xb10]
rol eax, 4
imul eax, eax, 0x605e
rol edx, 2
mov dword [ebp - 0xbe0], edi
xor edx, eax
xor edx, dword [ebp - 0xb24]
xor ebx, edx
mov edx, dword [ebp - 0xb34]
mov dword [ebp - 0xbec], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xbe0]
ror dword [ebp - 0xbec], 8
mov byte [edx], al
mov al, byte [ebp - 0xbec]
ror dword [ebp - 0xbe0], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xbe0]
ror dword [ebp - 0xbec], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xbec]
ror dword [ebp - 0xbe0], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xbe0]
ror dword [ebp - 0xbec], 8
mov byte [edx - 2], al
ror dword [ebp - 0xbe0], 8
mov al, byte [ebp - 0xbec]
mov byte [edx - 7], al
mov al, byte [ebp - 0xbe0]
mov byte [edx - 3], al
mov eax, dword [ebp - 0xbe0]
mov edi, dword [ebp - 0xbec]
ror eax, 8
mov dword [ebp - 0xb50], eax
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xb94]
ror edi, 8
add edx, 8
mov dword [ebp - 0xb24], eax
mov eax, dword [ebp - 0xb44]
mov dword [ebp - 0xbec], edi
mov dword [ebp - 0xb10], eax
sub dword [ebp - 0xb98], 1
mov dword [ebp - 0xb34], edx
jne 0x46c312
mov esi, dword [ebp - 0xb58]
xor ebx, ebx
mov edx, ebx
xor cl, byte [edx + esi]
inc edx
cmp edx, 0x338
jb 0x46c69b
movzx eax, cl
cdq
cmp eax, dword [0x4119b0]
jne 0x46c6c7
cmp edx, dword [0x4119b4]
jne 0x46c6c7
mov edi, esi
mov dword [ebp - 0xb88], esi
mov esi, ebx
jmp 0x46c6da
or dword [ebp - 0xb8c], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xb30], 0xc004d501
test esi, esi
je 0x46c6ed
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xb30], ebx
jl 0x46c853
mov eax, dword [ebp - 0xb8c]
mov esi, edi
push 0x40
push ebx
push 0x4b9980
mov byte [eax + edi], bl
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], bl
je 0x46c860
mov edi, 0x4b9980
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb94], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x46c72e
sub ecx, dword [ebp - 0xb94]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x46c84c
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb0c], ecx
cmp word [eax], dx
je 0x46c776
mov ecx, 0xc000007b
mov dword [ebp - 0xb0c], ecx
jmp 0x46c7be
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x46c769
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x46c769
cmp dword [edx], 0x4550
jne 0x46c769
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc00]
je 0x46c7ac
cmp ax, word [ebp - 0xb9c]
je 0x46c7ac
mov ecx, 0xc000000d
jmp 0x46c76e
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xbf8], eax
mov dword [ebp - 0xb8c], ebx
test eax, eax
je 0x46c839
mov edx, esi
mov dword [ebp - 0xb98], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb94], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x46c7e5
sub edx, dword [ebp - 0xb94]
inc esi
add esi, edx
test ecx, ecx
js 0x46c81e
push dword [ebp - 0xb98]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46c844
mov ecx, dword [ebp - 0xb2c]
mov dword [ecx*4 + 0x4b7010], eax
mov ecx, dword [ebp - 0xb0c]
mov eax, dword [ebp - 0xb8c]
inc dword [ebp - 0xb2c]
inc eax
mov dword [ebp - 0xb8c], eax
cmp eax, dword [ebp - 0xbf8]
jb 0x46c7d4
add edi, 0x10
cmp byte [esi], bl
jne 0x46c721
mov esi, dword [ebp - 0xb0c]
jmp 0x46c862
mov esi, 0xc000007a
jmp 0x46c862
mov edi, dword [ebp - 0xb88]
mov esi, 0xc000007a
jmp 0x46c868
mov esi, ebx
mov edi, dword [ebp - 0xb88]
test edi, edi
je 0x46c87b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x46c8bb
mov esi, ebx
mov eax, dword [esi + 0x4b9980]
test eax, eax
je 0x46c892
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x46c881
push 0x40
push ebx
push 0x4b9980
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x402210
mov edi, 0x4b7010
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x46c8c6
mov eax, dword [0x4ba820]
inc eax
mov dword [0x4ba820], eax
xor eax, eax
mov edi, 0x4ba824
xchg dword [edi], eax
mov eax, dword [ebp - 0xb48]
xor ecx, ecx
mov esi, dword [0x4b7078]
inc ecx
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp - 0xb68]
mov dword [ebp - 0x2d4], eax
lea eax, [ebp - 0x2f0]
push eax
push 4
push 0x2021
mov dword [ebp - 0x2f0], ecx
mov dword [ebp - 0x2e8], ecx
mov dword [ebp - 0x2dc], ecx
mov dword [ebp - 0x2e0], ecx
mov dword [ebp - 0x2d8], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x2e4], 0x9966f291
call dword [0x4bb544]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x46c933
mov eax, dword [0x4ba820]
push 0
pop ebx
test eax, eax
jle 0x46c995
sub eax, 1
mov dword [0x4ba820], eax
jne 0x46c995
mov esi, ebx
mov eax, dword [esi + 0x4b9980]
test eax, eax
je 0x46c969
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x46c958
push 0x40
push ebx
push 0x4b9980
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x402210
mov edi, 0x4b7010
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x4ba824
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xb28]
mov esi, dword [0x4b70c0]
mov ecx, esi
push ebx
call dword [0x4bb544]
call esi
lea ecx, [ebp - 0xc94]
call fcn.00416ea5
xor eax, eax
mov dword [ebp - 0xb34], ebx
lea edi, [ebp - 0xbb0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xc68]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xb94], esi
test esi, esi
je 0x46e54d
push edi
push 0x4b8ca0
push esi
call sub.msvcrt.dll_memcpy
mov edi, esi
add esp, 0xc
mov dword [ebp - 0xb08], edi
push 8
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x46e4c2
mov ecx, dword [0x4b8c98]
mov dword [esi], ecx
mov ecx, dword [0x4b8c9c]
mov dword [esi + 4], ecx
mov dword [ebp - 0xb34], esi
rdtsc
mov dword [ebp - 0xb8c], eax
mov dword [ebp - 0xb98], edx
mov eax, 0xc4
push eax
push 8
mov dword [ebp - 0xbac], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x46e4c2
mov dword [ebp - 0xba8], edx
mov dword [ebp - 0xbb0], ebx
lea edi, [edx + 4]
cmp edi, edx
jb 0x46e4bc
mov ecx, dword [ebp - 0xbac]
lea eax, [edx + 8]
add ecx, edx
cmp eax, ecx
ja 0x46e4bc
push 4
pop eax
mov dword [edx], eax
mov dword [edi], eax
mov edi, dword [ebp - 0xbb0]
inc edi
mov dword [ebp - 0xbb0], edi
cmp dword [ebp - 0xba8], 0
jne 0x46cae4
mov eax, dword [ebp - 0xbac]
lea ecx, [eax + 0xa4]
cmp ecx, eax
jb 0x46e4bc
lea eax, [edi + 1]
mov dword [ebp - 0xbac], ecx
mov dword [ebp - 0xbb0], eax
jmp 0x46cb57
mov edx, dword [ebp - 0xba8]
mov ecx, ebx
test edi, edi
je 0x46cb0f
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x46e4bc
add eax, edx
cmp eax, edx
jb 0x46e4bc
inc ecx
mov edx, eax
cmp ecx, edi
jb 0x46caf0
lea edi, [edx + 4]
cmp edi, edx
jb 0x46e4bc
mov ecx, dword [ebp - 0xbac]
lea eax, [edx + 0xa4]
add ecx, dword [ebp - 0xba8]
cmp eax, ecx
ja 0x46e4bc
mov eax, 0xa0
push eax
push dword [ebp - 0xb94]
mov dword [edx], eax
push edi
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xbac]
add esp, 0xc
inc dword [ebp - 0xbb0]
cmp dword [ebp - 0xba8], 0
jne 0x46cb73
lea eax, [ecx + 0xc]
cmp eax, ecx
jb 0x46e4bc
inc dword [ebp - 0xbb0]
jmp 0x46cbef
cmp dword [ebp - 0xbb0], 0
mov edi, ebx
mov edx, dword [ebp - 0xba8]
jbe 0x46cba7
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x46e4bc
add eax, edx
cmp eax, edx
jb 0x46e4bc
inc edi
mov edx, eax
cmp edi, dword [ebp - 0xbb0]
jb 0x46cb84
lea edi, [edx + 4]
cmp edi, edx
jb 0x46e4bc
add ecx, dword [ebp - 0xba8]
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0x46e4bc
mov dword [edx], 8
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0xbb0]
inc eax
mov dword [ebp - 0xbb0], eax
cmp dword [ebp - 0xba8], 0
jne 0x46cc02
mov eax, dword [ebp - 0xbac]
lea ecx, [eax + 0xc]
cmp ecx, eax
jb 0x46e4bc
mov dword [ebp - 0xbac], ecx
jmp 0x46cc70
mov edx, dword [ebp - 0xba8]
mov ecx, ebx
test eax, eax
je 0x46cc31
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x46e4bc
add eax, edx
cmp eax, edx
jb 0x46e4bc
inc ecx
mov edx, eax
cmp ecx, dword [ebp - 0xbb0]
jb 0x46cc0e
lea esi, [edx + 4]
cmp esi, edx
jb 0x46e4bc
mov ecx, dword [ebp - 0xbac]
lea eax, [edx + 0xc]
add ecx, dword [ebp - 0xba8]
cmp eax, ecx
ja 0x46e4bc
mov eax, dword [ebp - 0xb8c]
mov dword [edx], 8
mov dword [esi], eax
mov eax, dword [ebp - 0xb98]
mov dword [esi + 4], eax
mov ecx, dword [ebp - 0xbac]
inc dword [ebp - 0xbb0]
rdtsc
mov edi, ebx
mov dword [ebp - 0xb90], ebx
mov dword [ebp - 0xb2c], ebx
mov dword [ebp - 0xb10], edi
mov dword [ebp - 0xb68], ebx
mov dword [ebp - 0xb50], ebx
mov dword [ebp - 0xb70], ebx
mov dword [ebp - 0xb40], ebx
mov dword [ebp - 0xb64], ebx
mov dword [ebp - 0xb4c], ebx
mov dword [ebp - 0xb48], ebx
mov dword [ebp - 0xb94], eax
mov dword [ebp - 0xb98], edx
add ecx, 8
cmp ecx, 8
jb 0x46cd92
lea eax, [ecx + 7]
and eax, 0xfffffff8
mov dword [ebp - 0xb8c], eax
cmp eax, ecx
jb 0x46cd92
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xbf8], ecx
test ecx, ecx
jne 0x46cd08
mov esi, 0xc0000017
jmp 0x46cd97
mov eax, dword [ebp - 0xbb0]
lea edx, [ecx + 4]
mov dword [ecx], eax
cmp edx, ecx
jb 0x46cd78
mov eax, dword [ebp - 0xbac]
mov dword [edx], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x46cd78
mov eax, dword [ebp - 0xb8c]
mov esi, ebx
mov edi, dword [ebp - 0xb94]
mov dword [ecx + eax - 8], edi
mov edi, dword [ebp - 0xb98]
mov dword [ecx + eax - 4], edi
lea eax, [edx + 4]
push dword [ebp - 0xbac]
push dword [ebp - 0xba8]
push eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xbf8]
add esp, 0xc
mov eax, dword [ebp - 0xb8c]
mov edi, ebx
mov dword [ebp - 0xb90], ecx
mov ecx, ebx
mov dword [ebp - 0xb2c], eax
jmp 0x46cd7d
mov esi, 0xc0000095
test ecx, ecx
je 0x46cd97
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x46cd97
mov esi, 0xc0000095
or esi, 0x10000000
jl 0x46e318
cmp dword [ebp - 0xb90], 0
mov dword [ebp - 0xb1c], ebx
jne 0x46cdbc
mov esi, 0xc000000d
jmp 0x46d4be
mov esi, dword [ebp - 0xb2c]
test esi, esi
je 0x46d4b9
lea eax, [esi + 8]
push eax
push ebx
mov dword [ebp - 0xb94], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb9c], eax
test eax, eax
je 0x46d4b9
mov edi, dword [ebp - 0xb90]
mov cl, bl
mov edx, ebx
test esi, esi
je 0x46ce06
xor cl, byte [edx + edi]
inc edx
cmp edx, esi
jb 0x46cdfe
mov eax, 0xc81ecb17
mov dword [ebp - 0x3e8], 0xb1b54a58
mov dword [ebp - 0x3e4], eax
mov eax, ebx
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0xbf0], eax
or eax, 0xffffffff
mov dword [ebp - 0xb38], eax
mov dword [ebp - 0xbcc], eax
mov eax, esi
shr eax, 3
mov dword [ebp - 0xbf8], eax
test eax, eax
je 0x46d2df
movzx edx, word [ebp - 0x3e6]
mov eax, 0xc81ecb17
movzx esi, ax
movzx eax, word [ebp - 0x3e2]
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0xb9c]
add eax, 7
mov dword [ebp - 0xb20], edx
add edi, 2
mov dword [ebp - 0xb5c], esi
mov esi, dword [ebp - 0xb38]
mov edx, ebx
mov dword [ebp - 0xb54], eax
mov dword [ebp - 0xb3c], edi
mov dword [ebp - 0xb8c], ebx
mov dword [ebp - 0xb98], ebx
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xb3c]
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb3c]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb3c]
shl edi, 8
add dword [ebp - 0xb3c], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
mov dword [ebp - 0xb38], esi
lea eax, [esi - 0x4a58]
mov esi, 0xc81ecb17
xor eax, esi
xor eax, ebx
xor edx, eax
mov eax, dword [ebp - 0xb20]
xor esi, edx
mov dword [ebp - 0xb18], edx
ror esi, 0xf
imul eax, esi
ror edx, 7
add edx, eax
mov eax, dword [ebp - 0xb38]
xor eax, edx
mov dword [ebp - 0xb38], eax
mov edx, eax
ror edx, 0xa
lea esi, [eax - 0x4e4ab5a8]
mov eax, dword [ebp - 0xb5c]
ror esi, 9
imul eax, esi
sub eax, edx
mov edx, dword [ebp - 0xb18]
xor edx, eax
mov eax, dword [ebp - 0xb0c]
mov esi, edx
mov dword [ebp - 0xb18], edx
xor esi, dword [ebp - 0xb5c]
rol esi, 4
imul eax, esi
mov esi, dword [ebp - 0xb18]
rol edx, 5
add edx, eax
mov eax, dword [ebp - 0xb38]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb38], eax
xor edx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, edx
xor esi, eax
mov eax, esi
mov dword [ebp - 0xb18], esi
shr eax, 6
lea edx, [esi - 0x4a58]
mov esi, dword [ebp - 0xb38]
imul edx, dword [ebp - 0xb20]
sub edx, eax
xor esi, edx
mov edx, dword [ebp - 0xb18]
mov eax, esi
ror eax, 0xf
xor eax, dword [ebp - 0xb5c]
imul eax, eax, 0x4a58
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [ebp - 0xb0c]
imul eax, dword [ebp - 0xb5c]
xor esi, eax
lea eax, [esi + 0x37e0ea91]
xor edx, eax
mov dword [ebp - 0xb18], edx
mov eax, dword [ebp - 0xb18]
xor eax, dword [ebp - 0xb0c]
imul eax, dword [ebp - 0xb20]
ror edx, 0xa
xor edx, eax
mov eax, dword [ebp - 0xb5c]
xor esi, edx
mov dword [ebp - 0xb38], esi
xor esi, 0x4a58
mov edx, dword [ebp - 0xb38]
rol esi, 6
imul eax, esi
mov esi, dword [ebp - 0xb18]
ror edx, 3
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xb38]
mov eax, esi
ror eax, 0xf
sub eax, dword [ebp - 0xb0c]
imul eax, eax, 0x4a58
xor edx, eax
mov dword [ebp - 0xb38], edx
xor edx, dword [ebp - 0xb0c]
mov eax, dword [ebp - 0xb38]
shr eax, 1
imul edx, edx, 0x4a58
xor edx, eax
mov eax, dword [ebp - 0xb38]
sub eax, dword [ebp - 0xb5c]
xor esi, edx
rol eax, 3
imul edx, eax, 0x4a58
mov eax, dword [ebp - 0xb38]
shr eax, 0xf
xor edx, eax
xor esi, edx
mov edx, esi
mov dword [ebp - 0xb18], esi
sub edx, dword [ebp - 0xb5c]
mov eax, esi
imul edx, dword [ebp - 0xb20]
mov esi, 0xb1b54a58
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xb38]
xor eax, edx
sub esi, eax
mov dword [ebp - 0xb38], eax
mov edx, eax
ror esi, 9
mov eax, dword [ebp - 0xb5c]
imul eax, esi
mov esi, dword [ebp - 0xb18]
ror edx, 0xb
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xb38]
mov eax, esi
sub eax, dword [ebp - 0xb0c]
add eax, 0x4e4ab5a8
xor edx, eax
mov dword [ebp - 0xb38], edx
mov eax, dword [ebp - 0xb38]
xor eax, dword [ebp - 0xb20]
imul eax, eax, 0x4a58
ror edx, 7
sub eax, edx
xor esi, eax
mov dword [ebp - 0xb18], esi
xor esi, dword [ebp - 0xb0c]
rol esi, 4
mov eax, dword [ebp - 0xb20]
imul eax, esi
mov esi, 0xb1b54a58
mov edx, dword [ebp - 0xb18]
ror edx, 0x10
sub eax, edx
mov edx, dword [ebp - 0xb38]
xor edx, eax
mov eax, dword [ebp - 0xb5c]
sub esi, edx
mov dword [ebp - 0xb38], edx
ror esi, 0xa
imul eax, esi
ror edx, 4
add edx, eax
mov eax, dword [ebp - 0xb18]
xor eax, edx
mov dword [ebp - 0xb18], eax
mov edx, eax
ror edx, 9
lea esi, [eax + 0x4e4ab5a8]
mov eax, dword [ebp - 0xb0c]
ror esi, 4
imul eax, esi
mov esi, dword [ebp - 0xb38]
xor edx, eax
mov eax, 0xc81ecb17
xor esi, edx
xor eax, esi
mov dword [ebp - 0xb38], esi
rol eax, 8
mov edx, esi
imul eax, eax, 0x4a58
mov esi, 0xc81ecb17
rol edx, 2
sub eax, edx
mov edx, dword [ebp - 0xb18]
xor edx, eax
mov eax, dword [ebp - 0xb20]
sub esi, edx
mov dword [ebp - 0xb18], edx
ror esi, 0xb
imul eax, esi
mov esi, dword [ebp - 0xb38]
ror edx, 0xc
sub eax, edx
mov edx, dword [ebp - 0xb20]
xor esi, eax
xor edx, esi
mov eax, esi
imul edx, dword [ebp - 0xb5c]
shr eax, 8
xor edx, eax
xor dword [ebp - 0xb18], edx
mov edx, dword [ebp - 0xb18]
mov eax, edx
xor edx, dword [ebp - 0xb8c]
xor eax, esi
xor eax, dword [ebp - 0xb98]
mov esi, dword [ebp - 0xb54]
xor eax, 0xc81ecb17
xor eax, 0xb1b54a58
mov dword [ebp - 0xbf0], edx
mov dword [ebp - 0xbcc], eax
mov byte [esi - 4], dl
mov al, byte [ebp - 0xbcc]
ror dword [ebp - 0xbf0], 8
mov byte [esi], al
mov al, byte [ebp - 0xbf0]
ror dword [ebp - 0xbcc], 8
mov byte [esi - 5], al
mov al, byte [ebp - 0xbcc]
ror dword [ebp - 0xbf0], 8
mov byte [esi - 1], al
mov al, byte [ebp - 0xbf0]
ror dword [ebp - 0xbcc], 8
mov byte [esi - 6], al
mov al, byte [ebp - 0xbcc]
ror dword [ebp - 0xbf0], 8
mov byte [esi - 2], al
ror dword [ebp - 0xbcc], 8
mov al, byte [ebp - 0xbf0]
add dword [ebp - 0xb54], 8
mov byte [esi - 7], al
mov al, byte [ebp - 0xbcc]
mov byte [esi - 3], al
mov edx, dword [ebp - 0xbf0]
mov esi, dword [ebp - 0xbcc]
ror edx, 8
ror esi, 8
sub dword [ebp - 0xbf8], 1
mov dword [ebp - 0xb98], edi
mov edi, dword [ebp - 0xb3c]
mov dword [ebp - 0xbf0], edx
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xb8c], ebx
jne 0x46ce9f
mov esi, dword [ebp - 0xb2c]
xor ebx, ebx
movzx eax, cl
mov ecx, dword [ebp - 0xb9c]
cdq
mov dword [ecx + esi], eax
mov dword [ecx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x46d311
mov esi, 0xc0000017
jmp 0x46d413
mov esi, dword [ebp - 0xb94]
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x46d336
mov esi, 0xc0000017
jmp 0x46d3b2
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0xb9c]
push esi
push eax
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x46d32f
mov dword [edi + 0xc], eax
push 0xa0
push 0x4b8bf0
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [edi + 0x10], esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x46d32f
mov dword [edi + 0x14], ecx
mov eax, dword [0x4b8c90]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0x4b8c94]
mov dword [ebp - 0xb1c], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0x46d413
cmp dword [edi + 4], 0
je 0x46d3d0
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x46d3ea
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x46d404
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x46d42b
mov edi, dword [ebp - 0xb1c]
mov dword [ebp - 0xb10], edi
mov dword [ebp - 0xb1c], ebx
jmp 0x46d42d
mov edi, ebx
push dword [ebp - 0xb9c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb1c]
test eax, eax
je 0x46d4be
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x46d46a
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb1c]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x46d489
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb1c]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x46d4a8
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb1c]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x46d4be
mov esi, 0xc0000001
or esi, 0x10000000
jl 0x46e318
mov eax, dword [edi]
mov esi, dword [edi + 0x10]
add eax, 4
mov ecx, dword [edi + 8]
cmp eax, 4
jb 0x46d5eb
lea edx, [eax + 4]
cmp edx, eax
jb 0x46d5eb
add ecx, edx
cmp ecx, edx
jb 0x46d5eb
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x46d5eb
lea ecx, [eax + esi]
mov dword [ebp - 0xb94], ecx
cmp ecx, eax
jb 0x46d5eb
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xb1c], esi
test esi, esi
jne 0x46d53a
mov esi, 0xc0000017
mov edi, 0xc0000095
jmp 0x46d5f2
mov eax, dword [edi]
mov dword [esi], eax
lea eax, [esi + 4]
cmp eax, esi
jb 0x46d5c4
push dword [edi]
push dword [edi + 4]
push eax
call sub.msvcrt.dll_memcpy
mov edx, dword [edi]
lea ecx, [esi + 4]
add edx, ecx
add esp, 0xc
cmp edx, ecx
jb 0x46d5c4
mov eax, dword [edi + 8]
lea esi, [edx + 4]
mov dword [edx], eax
cmp esi, edx
jb 0x46d5c4
push dword [edi + 8]
push dword [edi + 0xc]
push esi
call sub.msvcrt.dll_memcpy
mov ecx, dword [edi + 8]
add esp, 0xc
add ecx, esi
cmp ecx, esi
jb 0x46d5c4
mov eax, dword [edi + 0x10]
lea esi, [ecx + 4]
mov dword [ecx], eax
cmp esi, ecx
jb 0x46d5c4
push dword [edi + 0x10]
push dword [edi + 0x14]
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [edi + 0x10]
add esp, 0xc
add eax, esi
cmp eax, esi
mov eax, dword [ebp - 0xb1c]
jb 0x46d5ca
mov ecx, dword [ebp - 0xb94]
mov esi, ebx
mov dword [ebp - 0xb68], eax
mov eax, ebx
mov dword [ebp - 0xb50], ecx
jmp 0x46d5cf
mov eax, dword [ebp - 0xb1c]
mov esi, 0xc0000095
test eax, eax
je 0x46d530
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x46d530
mov edi, 0xc0000095
mov esi, edi
or esi, 0x10000000
jl 0x46e318
cmp dword [ebp - 0xba8], 0
jne 0x46d611
mov esi, 0xc000000d
jmp 0x46d6b6
xor eax, eax
inc eax
cmp dword [ebp - 0xbb0], eax
jbe 0x46d607
mov ecx, dword [ebp - 0xba8]
mov edx, ebx
mov esi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x46d6b4
lea ecx, [esi + eax]
cmp ecx, eax
jb 0x46d6b4
xor eax, eax
inc edx
inc eax
cmp edx, eax
jb 0x46d624
mov eax, dword [ecx]
mov dword [ebp - 0xb94], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x46d6b4
cmp dword [ebp - 0xbb0], 2
jbe 0x46d607
mov ecx, dword [ebp - 0xba8]
mov edx, ebx
mov esi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x46d6b4
lea ecx, [esi + eax]
cmp ecx, eax
jb 0x46d6b4
inc edx
cmp edx, 2
jb 0x46d660
mov edx, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x46d6b4
mov eax, dword [ebp - 0xb94]
add eax, 0x30
cmp eax, 0x30
jb 0x46d6b4
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x46d6b4
lea eax, [ecx + edx]
cmp eax, ecx
jb 0x46d6b4
mov dword [ebp - 0xb40], eax
mov esi, ebx
cmp eax, 0x400000
jbe 0x46d6b8
mov esi, 0x8000ffff
jmp 0x46e318
mov esi, edi
mov eax, ebx
test esi, esi
js 0x46e318
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x46d6dd
mov esi, 0xd0000017
mov eax, ebx
jmp 0x46d6e8
mov dword [ebp - 0xb70], eax
mov esi, 0x10000000
test esi, esi
js 0x46e318
mov ecx, dword [ebp - 0xb68]
test ecx, ecx
jne 0x46d704
mov esi, 0x80070057
jmp 0x46e318
test eax, eax
je 0x46d6fa
mov dword [ebp - 0xd0c], eax
mov eax, dword [ebp - 0xb40]
mov dword [ebp - 0xd04], eax
lea eax, [ebp - 0xc44]
push eax
xor eax, eax
mov dword [ebp - 0xd10], ecx
mov ecx, dword [ebp - 0xb50]
inc eax
push 0x411248
push eax
mov dword [ebp - 0xd08], ecx
mov dword [ebp - 0xd00], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x46d772
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x46d763
movzx esi, si
or esi, 0x80070000
test esi, esi
mov ecx, dword [ebp - 0xb40]
js 0x46d7b8
mov esi, 0x80004005
jmp 0x46d7b8
push 0x413650
push dword [ebp - 0xc44]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x46d74c
push ebx
push 0x14
lea eax, [ebp - 0xd10]
mov ecx, esi
push eax
push 0x86
call dword [0x4bb544]
call esi
mov ecx, dword [ebp - 0xd04]
mov esi, eax
or esi, 0x10000000
jge 0x46d7b8
mov ecx, dword [ebp - 0xb40]
cmp esi, 0xd0000023
jne 0x46d7ca
mov esi, 0x8007007a
jmp 0x46e318
test esi, esi
js 0x46e318
mov dword [ebp - 0xb54], ebx
cmp ecx, 4
jae 0x46d7e7
mov esi, 0xc000003e
jmp 0x46db48
mov eax, dword [ebp - 0xb70]
mov esi, dword [eax]
lea edx, [eax + 4]
cmp edx, eax
jb 0x46db46
lea eax, [ecx - 4]
cmp eax, esi
jb 0x46d7dd
lea eax, [edx + esi]
mov dword [ebp - 0xb84], eax
cmp eax, edx
jb 0x46db46
lea edx, [esi + 4]
cmp edx, 4
jb 0x46db46
mov eax, ecx
sub eax, edx
cmp eax, 4
jb 0x46d7dd
mov eax, dword [ebp - 0xb84]
mov edx, dword [eax]
add eax, 4
mov dword [ebp - 0xb0c], edx
cmp eax, dword [ebp - 0xb84]
jb 0x46db46
lea eax, [esi + 4]
lea edx, [eax + 4]
mov dword [ebp - 0xb8c], edx
cmp edx, eax
mov edx, dword [ebp - 0xb0c]
jb 0x46db46
mov eax, ecx
sub eax, dword [ebp - 0xb8c]
cmp eax, edx
jb 0x46d7dd
mov eax, dword [ebp - 0xb84]
add eax, 4
push 0
lea ebx, [edx + eax]
mov dword [ebp - 0xb98], ebx
cmp ebx, eax
pop ebx
jb 0x46db46
mov eax, dword [ebp - 0xb8c]
push 0
lea ebx, [edx + eax]
mov dword [ebp - 0xb14], ebx
cmp ebx, eax
pop ebx
jb 0x46db46
mov eax, ecx
sub eax, dword [ebp - 0xb14]
cmp eax, 4
jb 0x46d7dd
mov eax, dword [ebp - 0xb98]
mov eax, dword [eax]
mov dword [ebp - 0xb9c], eax
mov eax, dword [ebp - 0xb98]
lea edx, [eax + 4]
mov dword [ebp - 0xb98], edx
cmp edx, eax
mov edx, dword [ebp - 0xb0c]
jb 0x46db46
mov eax, dword [ebp - 0xb14]
add eax, 4
cmp eax, dword [ebp - 0xb14]
jb 0x46db46
mov edx, dword [ebp - 0xb14]
mov eax, ecx
add edx, 4
sub eax, edx
mov edx, dword [ebp - 0xb0c]
cmp eax, dword [ebp - 0xb9c]
jb 0x46d7dd
mov eax, dword [ebp - 0xb9c]
mov edx, dword [ebp - 0xb14]
add eax, 4
add eax, edx
mov dword [ebp - 0xb8c], eax
lea eax, [edx + 4]
mov edx, dword [ebp - 0xb0c]
cmp dword [ebp - 0xb8c], eax
jb 0x46db46
mov eax, ecx
sub eax, dword [ebp - 0xb8c]
jne 0x46d7dd
mov eax, dword [ebp - 0xb9c]
add eax, 0xc
add eax, edx
add eax, esi
cmp eax, ecx
jne 0x46d7dd
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x46d985
mov esi, 0xc0000017
jmp 0x46dac9
mov eax, dword [ebp - 0xb70]
add eax, 4
je 0x46d9cb
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x46d9b2
mov esi, 0xc0000017
jmp 0x46da68
mov dword [edi + 4], ecx
mov edx, dword [ebp - 0xb70]
push esi
lea eax, [edx + 4]
push eax
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x46d9d0
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov eax, dword [ebp - 0xb84]
add eax, 4
je 0x46da13
mov esi, dword [ebp - 0xb0c]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x46d9a8
mov dword [edi + 0xc], edx
mov eax, dword [ebp - 0xb84]
push esi
add eax, 4
push eax
push edx
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x46da19
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [ebp - 0xb98], 0
je 0x46da58
mov esi, dword [ebp - 0xb9c]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x46d9a8
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xb98]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x46da5e
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 0xb54], edi
mov esi, ebx
mov edi, ebx
test edi, edi
je 0x46dac9
cmp dword [edi + 4], 0
je 0x46da86
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x46daa0
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x46daba
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x46dadd
mov eax, dword [ebp - 0xb54]
mov edi, ebx
mov dword [ebp - 0xb64], eax
jmp 0x46dae3
mov edi, dword [ebp - 0xb54]
test edi, edi
je 0x46db48
cmp dword [edi + 4], 0
je 0x46db01
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x46db1b
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x46db35
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x46db48
mov esi, edi
or esi, 0x10000000
jl 0x46e318
mov ecx, dword [ebp - 0xb64]
mov edi, ebx
mov dword [ebp - 0xb24], ebx
test ecx, ecx
jne 0x46db70
mov esi, 0xd000000d
jmp 0x46e318
mov eax, dword [ecx + 4]
mov dword [ebp - 0xb50], eax
test eax, eax
je 0x46db66
mov esi, dword [ecx]
test esi, esi
je 0x46db66
add esi, 0xfffffff8
push esi
push ebx
mov dword [ebp - 0xc00], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xbf8], eax
test eax, eax
je 0x46e1a9
mov ecx, 0x7f1137f
mov dword [ebp - 0xb54], eax
mov edi, esi
mov dword [ebp - 0x3ec], ecx
mov ecx, dword [ebp - 0xb50]
mov dl, bl
mov dword [ebp - 0x3f0], 0xab69605e
mov eax, ebx
mov dword [ebp - 0xb2c], ecx
and edi, 7
je 0x46e14a
or dword [ebp - 0xba4], 0xffffffff
mov ecx, ebx
mov dword [ebp - 0xbbc], ebx
mov esi, ebx
mov dword [ebp - 0xb20], ecx
mov dword [ebp - 0xb0c], eax
test edi, edi
je 0x46dc60
mov ebx, dword [ebp - 0xb2c]
push 0x38
pop eax
cmp esi, 4
jge 0x46dc24
lea ecx, [eax - 0x20]
movzx eax, byte [ebx]
shl eax, cl
or dword [ebp - 0xb0c], eax
mov ecx, dword [ebp - 0xb20]
jmp 0x46dc3d
movzx eax, byte [ebx]
mov ecx, dword [ebp - 0xbb8]
shl eax, cl
mov ecx, dword [ebp - 0xb20]
or ecx, eax
mov dword [ebp - 0xb20], ecx
mov eax, dword [ebp - 0xbb8]
inc ebx
inc esi
sub eax, 8
mov dword [ebp - 0xbb8], eax
cmp esi, edi
jl 0x46dc09
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0xb2c], ebx
xor ebx, ebx
xor eax, 0x92f65a5
mov dword [ebp - 0xb9c], ebx
xor ecx, 0x699a899c
mov dword [ebp - 0xb28], eax
mov dword [ebp - 0xbbc], eax
mov dword [ebp - 0xb40], ecx
mov dword [ebp - 0xba4], ecx
test edi, edi
je 0x46dcd1
mov esi, dword [ebp - 0xb54]
cmp dword [ebp - 0xb9c], 4
jge 0x46dca3
rol eax, 8
mov byte [esi], al
jmp 0x46dca8
rol ecx, 8
mov byte [esi], cl
inc esi
inc dword [ebp - 0xb9c]
cmp dword [ebp - 0xb9c], edi
jl 0x46dc93
mov eax, dword [ebp - 0xbbc]
mov dword [ebp - 0xb54], esi
mov esi, dword [ebp - 0xba4]
mov dword [ebp - 0xb28], eax
jmp 0x46dcd7
mov esi, dword [ebp - 0xb40]
cmp edi, 4
jbe 0x46e119
push 8
pop ecx
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xb40], esi
mov dword [ebp - 0xba4], esi
mov edi, dword [ebp - 0xb28]
mov esi, dword [ebp - 0xc00]
mov eax, esi
shr eax, 3
mov dword [ebp - 0xb98], eax
test eax, eax
je 0x46e0e2
movzx esi, word [ebp - 0x3ee]
mov eax, 0x7f1137f
movzx ecx, word [ebp - 0x3ea]
movzx eax, ax
mov dword [ebp - 0xb3c], eax
mov eax, dword [ebp - 0xb54]
mov dword [ebp - 0xb1c], esi
add eax, 7
mov esi, dword [ebp - 0xb2c]
mov dword [ebp - 0xb88], ecx
add esi, 2
mov dword [ebp - 0xb8c], eax
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx ecx, byte [esi + 2]
shl ecx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or ecx, eax
mov dword [ebp - 0xb94], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl ecx, 8
or ecx, eax
mov dword [ebp - 0xb28], edi
movzx eax, byte [esi + 5]
add esi, 8
mov ebx, dword [ebp - 0xb28]
shl ecx, 8
or ecx, eax
mov dword [ebp - 0xb30], esi
mov edi, ecx
mov dword [ebp - 0xb58], ecx
xor edi, dword [ebp - 0xb40]
mov eax, 0x7f1137f
xor edi, ebx
xor edi, eax
mov eax, dword [ebp - 0xb3c]
xor edi, 0xab69605e
mov ecx, edi
rol ecx, 0xa
lea esi, [edi + 0x54969fa2]
rol esi, 5
imul eax, esi
mov esi, dword [ebp - 0xb1c]
add ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ebx + ecx]
ror ecx, 9
imul ecx, esi
sub ecx, eax
xor edi, ecx
mov eax, edi
sub eax, dword [ebp - 0xb3c]
imul ecx, eax, 0x605e
mov eax, edi
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0xb88]
xor ebx, ecx
xor esi, ebx
mov ecx, ebx
rol esi, 6
imul eax, esi
mov esi, 0x7f1137f
rol ecx, 2
sub eax, ecx
xor edi, eax
mov eax, esi
mov ecx, edi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, dword [ebp - 0xb3c]
xor eax, ebx
mov ecx, ebx
imul eax, dword [ebp - 0xb1c]
ror ecx, 6
xor ecx, eax
xor edi, ecx
mov ecx, edi
lea eax, [edi + esi]
ror eax, 0xf
imul eax, eax, 0x605e
rol ecx, 2
add ecx, eax
mov eax, dword [ebp - 0xb88]
xor ebx, ecx
mov ecx, ebx
rol ecx, 8
lea esi, [ebx + 0x54969fa2]
ror esi, 0xe
imul eax, esi
sub eax, ecx
xor edi, eax
mov ecx, edi
mov eax, edi
xor ecx, 0xab69605e
ror eax, 0xa
ror ecx, 0xc
imul ecx, dword [ebp - 0xb3c]
xor eax, ecx
mov ecx, dword [ebp - 0xb88]
xor ebx, eax
xor ecx, ebx
mov eax, ebx
imul ecx, dword [ebp - 0xb1c]
shr eax, 0xa
xor ecx, eax
xor edi, ecx
mov eax, edi
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xb88]
xor ebx, eax
mov esi, ebx
sub esi, dword [ebp - 0xb88]
xor esi, edi
xor esi, 0xab69605e
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0xb88]
rol ecx, 2
imul ecx, dword [ebp - 0xb3c]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 6
imul ecx, dword [ebp - 0xb1c]
rol eax, 7
add eax, ecx
xor esi, eax
mov eax, esi
mov ecx, esi
xor eax, dword [ebp - 0xb3c]
imul eax, eax, 0x605e
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov dword [ebp - 0xb28], ebx
xor ecx, dword [ebp - 0xb1c]
mov eax, ebx
rol ecx, 5
imul ecx, dword [ebp - 0xb88]
rol eax, 7
add eax, ecx
mov ecx, 0x7f1137f
xor esi, eax
mov ebx, esi
xor ebx, dword [ebp - 0xb28]
xor ebx, ecx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xb1c]
imul eax, dword [ebp - 0xb3c]
xor esi, eax
mov eax, esi
sub eax, ecx
mov ecx, esi
ror eax, 1
imul eax, eax, 0x605e
ror ecx, 6
sub eax, ecx
xor ebx, eax
mov eax, ebx
rol eax, 0xe
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul ecx, dword [ebp - 0xb88]
add eax, ecx
xor esi, eax
mov eax, esi
ror eax, 0xe
lea ecx, [esi - 0x54969fa2]
rol ecx, 0xf
imul ecx, dword [ebp - 0xb3c]
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
shr eax, 3
xor ecx, 0x605e
imul ecx, dword [ebp - 0xb1c]
xor ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov eax, esi
xor eax, ecx
mov ecx, esi
xor esi, dword [ebp - 0xb20]
rol eax, 4
imul eax, eax, 0x605e
rol ecx, 2
mov dword [ebp - 0xba4], esi
mov esi, dword [ebp - 0xb30]
xor ecx, eax
xor ecx, dword [ebp - 0xb0c]
xor ebx, ecx
mov ecx, dword [ebp - 0xb8c]
mov dword [ebp - 0xbbc], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xba4]
ror dword [ebp - 0xbbc], 8
mov byte [ecx], al
mov al, byte [ebp - 0xbbc]
ror dword [ebp - 0xba4], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xba4]
ror dword [ebp - 0xbbc], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xbbc]
ror dword [ebp - 0xba4], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xba4]
ror dword [ebp - 0xbbc], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xba4], 8
mov al, byte [ebp - 0xbbc]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xba4]
mov byte [ecx - 3], al
add ecx, 8
mov eax, dword [ebp - 0xba4]
mov edi, dword [ebp - 0xbbc]
ror eax, 8
mov dword [ebp - 0xb40], eax
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0xb94]
ror edi, 8
sub dword [ebp - 0xb98], 1
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0xbbc], edi
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb8c], ecx
jne 0x46dd57
mov esi, dword [ebp - 0xc00]
xor ebx, ebx
mov ecx, dword [ebp - 0xbf8]
mov edi, ebx
test esi, esi
je 0x46e0f6
xor dl, byte [edi + ecx]
inc edi
cmp edi, esi
jb 0x46e0ee
mov edi, dword [ebp - 0xb50]
movzx eax, dl
cdq
cmp eax, dword [esi + edi]
jne 0x46e170
cmp edx, dword [esi + edi + 4]
jne 0x46e170
mov edi, ecx
mov dword [ebp - 0xb24], esi
mov ecx, ebx
mov esi, ebx
jmp 0x46e177
mov ecx, ebx
mov dword [ebp - 0xb40], ecx
mov dword [ebp - 0xba4], ecx
jae 0x46dcf8
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xb28], eax
mov dword [ebp - 0xbbc], eax
jmp 0x46dcf8
or dword [ebp - 0xb20], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xb0c], ebx
mov dword [ebp - 0xb40], eax
mov dword [ebp - 0xba4], eax
mov dword [ebp - 0xbbc], edi
jmp 0x46dd04
mov esi, 0xc004d501
mov edi, ebx
test ecx, ecx
je 0x46e18a
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x46e1a9
mov eax, dword [ebp - 0xb24]
mov esi, 0x10000000
mov dword [ebp - 0xb4c], edi
mov edi, ebx
mov dword [ebp - 0xb48], eax
jmp 0x46e1ae
mov esi, 0xd0000001
test edi, edi
je 0x46e1c1
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x46e318
mov eax, dword [ebp - 0xb48]
cmp eax, 4
jae 0x46e1de
mov esi, 0xc000003e
jmp 0x46e312
mov edx, dword [ebp - 0xb4c]
mov ecx, dword [edx]
mov dword [ebp - 0xb94], ecx
lea ecx, [edx + 4]
cmp ecx, edx
jb 0x46e30d
add eax, 0xfffffffc
cmp eax, 4
jb 0x46e1d4
mov edi, dword [ecx]
lea esi, [ecx + 4]
cmp esi, ecx
jb 0x46e30d
mov ecx, dword [ebp - 0xb48]
lea eax, [ecx - 8]
cmp eax, edi
jb 0x46e1d4
lea eax, [edi + 8]
cmp eax, 8
jb 0x46e30d
mov eax, dword [ebp - 0xb4c]
lea edx, [esi + edi]
add eax, ecx
cmp eax, edx
jb 0x46e1d4
sub ecx, esi
sub ecx, edi
add ecx, dword [ebp - 0xb4c]
cmp ecx, 8
jae 0x46e1d4
mov dword [ebp - 0xbb8], ebx
mov eax, ebx
mov dword [ebp - 0xb8c], eax
test esi, esi
je 0x46e29a
mov ecx, esi
cmp edx, esi
jb 0x46e30d
jbe 0x46e296
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x46e30d
cmp eax, edx
ja 0x46e2bf
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0x46e2c6
add eax, ecx
cmp eax, ecx
jb 0x46e30d
mov ecx, eax
cmp ecx, edx
ja 0x46e2bf
inc dword [ebp - 0xbb8]
cmp ecx, edx
jb 0x46e261
mov eax, ebx
cmp ecx, edx
jne 0x46e2bf
test edi, edi
je 0x46e2cd
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb8c], eax
test eax, eax
jne 0x46e2cd
mov esi, 0xc0000017
jmp 0x46e2f6
mov esi, 0xc000000d
jmp 0x46e312
mov esi, 0xc0000095
jmp 0x46e2f6
test esi, esi
je 0x46e2e2
push edi
push esi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xb8c]
add esp, 0xc
mov dword [ebp - 0xc60], eax
mov eax, dword [ebp - 0xbb8]
mov dword [ebp - 0xc68], eax
mov esi, ebx
test esi, esi
js 0x46e312
mov eax, dword [ebp - 0xb94]
cmp eax, dword [ebp - 0xc68]
je 0x46e312
jmp 0x46e1d4
mov esi, 0xc0000095
or esi, 0x10000000
mov eax, dword [ebp - 0xb90]
test eax, eax
je 0x46e331
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xb10]
test edi, edi
je 0x46e398
cmp dword [edi + 4], 0
je 0x46e355
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x46e36f
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x46e389
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb68]
test eax, eax
je 0x46e3b1
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb70]
test eax, eax
je 0x46e3ca
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xb64]
test edi, edi
je 0x46e431
cmp dword [edi + 4], 0
je 0x46e3ee
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x46e408
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x46e422
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb4c]
test eax, eax
je 0x46e44a
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x46e4bc
xor edi, edi
inc edi
cmp dword [ebp - 0xc68], edi
jb 0x46e4bc
mov eax, dword [ebp - 0xc60]
test eax, eax
je 0x46e4bc
cmp dword [ebp - 0xc68], 0
jbe 0x46e4bc
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x46e479
mov eax, ebx
jmp 0x46e481
or ecx, 0xffffffff
mov eax, 0xc0000095
test eax, eax
js 0x46e4bc
mov eax, edx
neg eax
sbb eax, eax
and eax, ecx
cmp edx, 4
jne 0x46e4bc
cmp dword [eax], 0
jl 0x46e4bc
cmp dword [ebp - 0xc68], edi
jbe 0x46e4bc
mov eax, dword [ebp - 0xc60]
mov edx, ebx
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x46e4bc
lea eax, [esi + ecx]
cmp eax, ecx
jb 0x46e4bc
inc edx
cmp edx, edi
jb 0x46e4a7
mov edi, dword [ebp - 0xb08]
cmp dword [ebp - 0xba8], 0
mov dword [ebp - 0xbac], ebx
mov dword [ebp - 0xbb0], ebx
je 0x46e4f1
push dword [ebp - 0xba8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xba8], ebx
mov eax, dword [ebp - 0xc60]
test eax, eax
je 0x46e50a
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x46e51d
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb34]
test eax, eax
je 0x46e536
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xc14]
mov dword [ebp - 0xc14], ebx
mov dword [ebp - 0xc48], eax
jmp 0x46591c
mov edi, ebx
jmp 0x46e4c2
cmp eax, 0xd00000e5
je 0x46e573
cmp eax, 0xc004d501
je 0x46e573
cmp eax, 0xd000003e
jne 0x46e578
mov eax, 0xc004f028
jmp 0x4659b2
mov eax, 0xc004f027
test eax, eax
jns 0x46e595
cmp eax, 0x8007007a
jne 0x4659b2
mov dword [ebp - 0xc38], 0xc004f01e
mov esi, ebx
jmp 0x46e5a6
cmp dword [ebp - 0xc18], 4
jne 0x46e587
mov eax, dword [ebp - 0xc48]
mov esi, dword [eax]
lea ecx, [ebp - 0xc48]
call fcn.004a8395
cmp dword [ebp - 0xc38], 0
jl 0x46e5be
test esi, esi
jne 0x46e5c3
xor eax, eax
lea ebx, [eax + 1]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcd8]
call fcn.0041a5f7
mov al, bl
call fcn.004a9550
ret