Function at 0x4124bb
Capabilities:
Check if file exists
Check os version
Encode data using xor
Execute anti-debugging instructions
Get keyboard layout
Get number of processors
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd54
mov eax, dword [0x424210]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
push 0x402550
mov dword [ebp - 0xc04], esi
mov dword [ebp - 0xbfc], ecx
mov dword [ebp - 0xc00], edi
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x424e38], eax
test eax, eax
je 0x412a68
push 0x402578
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x424e34], eax
test eax, eax
je 0x412a68
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0xc08], eax
test eax, eax
je 0x412a68
mov ecx, esi
call fcn.00411d53
test eax, eax
je 0x412a68
push 0x7f01
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f02
push ebx
mov dword [0x424f3c], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x402594
push esi
mov dword [0x424f38], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
push 0x4025a8
push esi
mov dword [0x424ec8], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [0x424ec4], eax
cmp dword [0x424f38], ebx
je 0x412a68
test eax, eax
je 0x412a68
cmp dword [0x424ec8], ebx
je 0x412a68
mov ecx, dword [ebp - 0xbfc]
mov edx, esi
call fcn.0041be8b
mov eax, dword [ebp - 0xbfc]
mov dword [0x424f34], eax
mov dword [0x424f30], esi
mov dword [0x424e40], 0x54
mov dword [0x424e48], ebx
mov dword [0x424e4c], ebx
mov dword [0x424e7c], esi
call fcn.0040ae88
call fcn.0040af06
call fcn.00411653
lea ecx, [ebp - 0xc84]
call fcn.0041e2c7
mov edx, eax
lea ecx, [ebp - 0xc70]
call fcn.0041c11a
mov ecx, dword [eax]
push ecx
mov ecx, 0x425974
mov dword [eax], ebx
call fcn.0040e208
push ebx
lea ecx, [ebp - 0xc70]
call fcn.0040e208
lea ecx, [ebp - 0xc84]
call fcn.0040fb90
mov ecx, dword [0x425974]
test ecx, ecx
je 0x41263d
mov ecx, dword [ecx + 8]
call fcn.0041e3e1
push ebx
push esi
push ebx
push ebx
push dword [0x425998]
push dword [0x425994]
push dword [0x42598c]
push dword [0x425990]
push 0xcf0000
push 0x401f94
push 0x4025b8
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x425e0c], eax
mov dword [0x424e44], eax
test eax, eax
je 0x412a68
xor ecx, ecx
call fcn.0040e167
mov edx, 0x4259c0
mov ecx, 0x412230
call fcn.00420034
test eax, eax
jns 0x4126a7
mov dword [0x4259c0], ebx
mov dword [0x4259c4], ebx
mov eax, 0x80000000
cmp dword [0x42598c], eax
je 0x412785
cmp dword [0x425990], eax
je 0x412785
push 0x2c
lea eax, [ebp - 0x5cc]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x5cc]
push 0x2c
pop esi
push eax
push dword [0x425e0c]
mov dword [ebp - 0x5cc], esi
call dword [sym.imp.USER32.dll_GetWindowPlacement]
test eax, eax
je 0x412756
mov eax, dword [0x425990]
mov dword [0x424f68], eax
sub eax, dword [ebp - 0x5b0]
add eax, dword [ebp - 0x5a8]
mov dword [0x424f70], eax
mov eax, dword [0x42598c]
mov dword [0x424f6c], eax
sub eax, dword [ebp - 0x5ac]
add eax, dword [ebp - 0x5a4]
mov dword [0x424f50], ebx
mov dword [0x424f54], ebx
mov dword [0x424f58], ebx
mov dword [0x424f5c], ebx
mov dword [0x424f60], ebx
mov dword [0x424f64], ebx
mov dword [0x424f4c], esi
mov dword [0x424f74], eax
mov edi, dword [0x425e0c]
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
push 0x424f4c
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_SetWindowPlacement]
push esi
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
mov edi, dword [ebp - 0xc00]
mov esi, dword [ebp - 0xc04]
xor eax, eax
inc eax
push eax
push dword [0x425e0c]
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
lea eax, [ebp - 0x808]
push eax
push dword [0x425e0c]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x425bf0]
push ebx
push esi
push 0xf
push dword [0x425e0c]
neg eax
mov esi, 0x401f94
push dword [ebp - 0x7fc]
sbb eax, eax
push dword [ebp - 0x800]
and eax, 0xfff00000
push ebx
push ebx
add eax, 0x50300104
push eax
push esi
push 0x402544
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x412a68
mov ecx, eax
call fcn.00412292
xor eax, eax
inc eax
push eax
push eax
push 0xda
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
xor eax, eax
inc eax
push eax
push 0x150e
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x4025c8
push ebx
push 0x1510
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x425bfc]
neg eax
push 0x401
push dword [0x425e0c]
sbb eax, eax
and eax, 0x10000000
push esi
add eax, 0x44800000
push eax
call dword [sym.imp.COMCTL32.dll_CreateStatusWindowW]
test eax, eax
je 0x412a68
mov ecx, eax
call fcn.00412369
xor eax, eax
lea ecx, [eax + 1]
call fcn.0040d3e0
lea eax, [ebp - 0x400]
push eax
push dword [0x425e08]
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebp - 0x3f8]
sub ecx, dword [ebp - 0x400]
call fcn.0041239d
push ebx
push dword [0x425bf0]
push 0xc8
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
push 3
mov ecx, 0x424db0
call fcn.0040e9ba
push dword [0x425e0c]
call dword [sym.imp.USER32.dll_GetDpiForWindow]
push 0x2d0
push eax
push dword [0x424318]
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
push 0x424ed0
mov dword [0x424ed0], eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
push dword [ebp - 0xc08]
mov dword [0x424f2c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, eax
lea eax, [ebp - 0x50]
push eax
push 0x20
pop eax
push eax
push dword [ebp - 0xc08]
call dword [sym.imp.GDI32.dll_GetTextFaceW]
push esi
mov esi, dword [ebp - 0xc08]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x424eec
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x41296c
push 0x424ed0
push 0x4121e0
push 0x424eec
push esi
call dword [sym.imp.GDI32.dll_EnumFontsW]
push dword [0x424f2c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0x424ed0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [0x424f2c], eax
jmp 0x412971
mov eax, dword [0x424f2c]
push ebx
push eax
push 0x30
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebx
push ebx
push 0xbd
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x424f40], eax
mov eax, dword [0x424ec0]
mov dword [0x424ebc], eax
xor eax, eax
lea ecx, [eax + 1]
call fcn.0040d7c7
xor eax, eax
lea ecx, [eax + 1]
call fcn.0040d3e0
push dword [ebp + 0xc]
push dword [0x425e0c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x424f3c]
call dword [sym.imp.USER32.dll_SetCursor]
push 9
pop esi
push 0x20
pop ecx
movzx eax, word [edi]
cmp ax, cx
je 0x4129ed
cmp ax, si
jne 0x4129f2
add edi, 2
jmp 0x4129e0
mov edx, edi
mov dword [0x425988], ebx
mov ecx, 0x4025d8
call fcn.00411a29
test eax, eax
jne 0x412a10
inc eax
mov dword [0x425988], eax
jmp 0x412a33
mov edx, edi
mov ecx, 0x4025e0
call fcn.00411a29
test eax, eax
jne 0x412a2a
push 2
pop eax
mov dword [0x425988], eax
jmp 0x412a2f
mov eax, dword [0x425988]
test eax, eax
je 0x412a4b
push 0x20
add edi, 4
pop ecx
movzx eax, word [edi]
cmp ax, cx
je 0x412a46
cmp ax, si
jne 0x412a4b
add edi, 2
jmp 0x412a39
call fcn.004121f7
test eax, eax
je 0x412ab9
mov ecx, edi
call fcn.00411e10
test eax, eax
je 0x412a7b
cmp eax, 2
jne 0x412bc2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00421870
leave
ret 8
mov edx, dword [ebp + 0xc]
mov ecx, edi
call fcn.00411f8b
test eax, eax
je 0x412a9e
push ebx
push ebx
push 0x10
push dword [0x425e0c]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
inc eax
jmp 0x412a6a
push 3
mov ecx, 0x424df0
call fcn.0040e86b
mov ecx, edi
call fcn.0041213b
test al, al
jne 0x412bc2
cmp word [edi], bx
je 0x412bc2
lea edx, [ebp - 0xc58]
mov dword [ebp - 0xc58], ebx
mov ecx, edi
call fcn.00411a6f
push ebx
mov esi, 0x80
push esi
push 3
push ebx
push 3
push 0x80000000
push dword [ebp - 0xc58]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x424e30], eax
cmp eax, 0xffffffff
jne 0x412b96
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x412b63
mov edx, dword [0x4242f0]
mov ecx, dword [0x425e0c]
push 0x33
push dword [ebp - 0xc58]
push dword [0x42430c]
call fcn.0040dc13
cmp eax, 2
jne 0x412b3f
lea ecx, [ebp - 0xc58]
call fcn.0040fb90
jmp 0x412a68
cmp eax, 6
jne 0x412b8d
push ebx
push esi
push 4
push ebx
push 3
push 0xc0000000
push dword [ebp - 0xc58]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x424e30], eax
jmp 0x412b8d
mov ecx, dword [ebp - 0xc58]
call fcn.00410e32
mov ecx, dword [0x425970]
test ecx, ecx
je 0x412b7d
call fcn.0040e264
xor eax, eax
mov dword [0x425970], ebx
lea ecx, [eax + 1]
call fcn.0040d7c7
cmp dword [0x424e30], 0xffffffff
je 0x412bb7
mov edx, dword [0x425988]
lea ecx, [ebp - 0xc58]
push ebx
call fcn.00410463
test al, al
jne 0x412bb7
mov ecx, dword [ebp - 0xc58]
call fcn.00410e32
lea ecx, [ebp - 0xc58]
call fcn.0040fb90
mov eax, dword [0x425e0c]
mov dword [0x424e98], eax
lea eax, [ebp - 0xc54]
push eax
lea eax, [ebp - 0xc48]
mov dword [0x424e9c], ebx
push eax
push 0xb0
push dword [0x425e04]
mov dword [0x424ea0], ebx
mov dword [0x424ea4], ebx
mov dword [0x424ea8], ebx
mov dword [0x424eac], ebx
mov dword [0x424eb0], ebx
mov dword [0x424eb4], ebx
mov dword [0x424eb8], ebx
mov dword [0x424e94], 0x28
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0xc54]
push dword [ebp - 0xc48]
push 0xb1
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0xb7
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
and eax, 0x3ff
cmp ax, 0x11
jne 0x412c7d
xor eax, eax
inc eax
push eax
push eax
push 0xd8
push dword [0x425e04]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0xcd4], ebx
mov edx, 0x425e28
mov dword [ebp - 0xc08], ebx
mov dword [ebp - 0xcbc], ebx
mov dword [ebp - 0xc00], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x412c9c
mov eax, dword [0x425e24]
mov esi, 0xab69605e
mov dword [ebp - 0xbfc], 0x402c4a
mov dword [ebp - 0xc04], 0x67
mov dword [ebp - 0xccc], 0x337
mov dword [ebp - 0xcd0], 0x10b
mov dword [ebp - 0xcc4], 0x20b
push 0
pop ebx
test eax, eax
jne 0x41331c
push 0x338
mov edi, ebx
mov dword [ebp - 0xbec], ebx
push ebx
mov dword [ebp - 0xbf0], edi
mov dword [ebp - 0xbf4], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xbe4], eax
test eax, eax
je 0x4132b5
or dword [ebp - 0xbf8], 0xffffffff
mov edx, 0x7f1137f
add eax, 7
mov dword [ebp - 0x3a8], esi
mov edi, 0x402c4a
mov dword [ebp - 0x3a4], edx
mov cl, bl
mov dword [ebp - 0xbe0], ebx
mov esi, ebx
mov dword [ebp - 0xbcc], eax
mov edx, ebx
mov dword [ebp - 0xbd0], edi
mov dword [ebp - 0xbbc], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xbd0]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xbd0]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xbd0]
shl edi, 8
add dword [ebp - 0xbd0], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0xbdc], esi
add eax, 0x54969fa2
rol dword [ebp - 0xbdc], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0xbdc]
xor edx, eax
mov dword [ebp - 0xb98], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb98]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xb98]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xb98], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb98]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xb98]
xor edx, eax
mov dword [ebp - 0xb98], edx
mov eax, dword [ebp - 0xb98]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xb98]
xor eax, edx
mov dword [ebp - 0xb98], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb98]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xb98]
xor eax, edx
mov dword [ebp - 0xb98], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb98]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xb98]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0xb98], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0xb98]
xor eax, 0xab69605e
mov dword [ebp - 0xbdc], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xbdc]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xbdc]
xor eax, edx
mov dword [ebp - 0xbdc], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xbdc], edx
mov edx, dword [ebp - 0xbdc]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xbdc], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xbdc]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xbdc]
xor eax, edx
mov dword [ebp - 0xbdc], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xbdc]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xbdc]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xbdc], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xbdc]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xbdc]
xor edx, dword [ebp - 0xbe0]
xor eax, dword [ebp - 0xbf8]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xb98], esi
mov esi, dword [ebp - 0xbcc]
mov dword [ebp - 0xbf8], edi
mov edi, dword [ebp - 0xbd0]
mov dword [ebp - 0xbe0], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xbbc], 1
mov dword [ebp - 0xbcc], esi
mov esi, eax
mov dword [ebp - 0xbdc], eax
jne 0x412d67
mov esi, dword [ebp - 0xbe4]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x4130ee
movzx eax, cl
cdq
cmp eax, dword [0x402f80]
jne 0x413123
cmp edx, dword [0x402f84]
jne 0x413123
mov edi, esi
mov dword [ebp - 0xbf0], esi
mov esi, ebx
mov dword [ebp - 0xb98], 0x337
jmp 0x413136
or dword [ebp - 0xb98], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xbf4], 0xc004d501
test esi, esi
je 0x413149
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xbf4], ebx
jl 0x4132af
mov eax, dword [ebp - 0xb98]
mov esi, edi
push 0x40
push ebx
push 0x425930
mov byte [eax + edi], bl
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
cmp byte [edi], bl
je 0x4132bc
mov edi, 0x425930
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb98], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41318a
sub ecx, dword [ebp - 0xb98]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x4132a8
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb98], ecx
cmp word [eax], dx
je 0x4131d2
mov ecx, 0xc000007b
mov dword [ebp - 0xb98], ecx
jmp 0x41321a
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x4131c5
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x4131c5
cmp dword [edx], 0x4550
jne 0x4131c5
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xcd0]
je 0x413208
cmp ax, word [ebp - 0xcc4]
je 0x413208
mov ecx, 0xc000000d
jmp 0x4131ca
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xbdc], eax
mov dword [ebp - 0xbbc], ebx
test eax, eax
je 0x413295
mov edx, esi
mov dword [ebp - 0xbd0], esi
lea eax, [edx + 1]
mov dword [ebp - 0xbcc], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x413241
sub edx, dword [ebp - 0xbcc]
inc esi
add esi, edx
test ecx, ecx
js 0x41327a
push dword [ebp - 0xbd0]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4132a0
mov ecx, dword [ebp - 0xbec]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xb98]
mov eax, dword [ebp - 0xbbc]
inc dword [ebp - 0xbec]
inc eax
mov dword [ebp - 0xbbc], eax
cmp eax, dword [ebp - 0xbdc]
jb 0x413230
add edi, 0x10
cmp byte [esi], bl
jne 0x41317d
mov esi, dword [ebp - 0xb98]
jmp 0x4132be
mov esi, 0xc000007a
jmp 0x4132be
mov edi, dword [ebp - 0xbf0]
mov esi, 0xc000007a
jmp 0x4132c4
mov esi, ebx
mov edi, dword [ebp - 0xbf0]
test edi, edi
je 0x4132d7
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x413317
mov esi, ebx
mov eax, dword [esi + 0x425930]
test eax, eax
je 0x4132ee
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x4132dd
push 0x40
push ebx
push 0x425930
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x401090
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x413322
mov eax, dword [0x425e24]
inc eax
mov dword [0x425e24], eax
xor eax, eax
mov ecx, 0x425e28
xchg dword [ecx], eax
mov eax, dword fs:[0x30]
mov edi, ebx
mov dword [ebp - 0xca8], ebx
mov dword [ebp - 0xca4], ebx
cmp dword [eax + 0x1d4], ebx
je 0x413603
mov esi, dword [0x424088]
mov ecx, esi
call dword [0x426478]
call esi
mov edx, eax
mov dword [ebp - 0xb98], edx
test edx, edx
jne 0x41338e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x41337e
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x41360b
mov edi, 0x80004005
jmp 0x41360b
mov dword [ebp - 0xca0], ebx
mov edi, ebx
mov ecx, ebx
mov eax, ebx
mov esi, dword [0x424098]
lea edx, [ebp - 0xc88]
push edx
mov edx, dword [ebp - 0xb98]
push ecx
push eax
push 2
push edx
mov ecx, esi
call dword [0x426478]
call esi
test eax, eax
jne 0x413434
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x41341f
cmp dword [ebp - 0xca0], 0
jne 0x413418
push dword [ebp - 0xc88]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xca0]
mov dword [ebp - 0xbdc], eax
call fcn.0041ef64
mov eax, dword [ebp - 0xbdc]
test eax, eax
je 0x413411
mov ecx, dword [ebp - 0xc88]
mov dword [ebp - 0xca0], eax
jmp 0x41339a
mov edi, 0x8007000e
jmp 0x413440
mov edi, 0x80004005
jmp 0x413446
test eax, eax
je 0x413418
jg 0x413429
mov edi, eax
jmp 0x413446
movzx edi, ax
or edi, 0x80070000
jmp 0x413446
mov eax, dword [ebp - 0xca0]
mov dword [ebp - 0xca8], eax
mov dword [ebp - 0xca0], ebx
lea ecx, [ebp - 0xca0]
call fcn.0041ef64
test edi, edi
js 0x41360b
mov esi, dword [0x424094]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov ecx, esi
call dword [0x426478]
call esi
mov edx, eax
mov dword [ebp - 0xb98], edx
test edx, edx
je 0x413367
mov dword [ebp - 0xc9c], ebx
mov edi, ebx
mov ecx, ebx
mov eax, ebx
mov esi, dword [0x424098]
lea edx, [ebp - 0xc98]
push edx
mov edx, dword [ebp - 0xb98]
push ecx
push eax
push 2
push edx
mov ecx, esi
call dword [0x426478]
call esi
test eax, eax
jne 0x413526
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x413511
cmp dword [ebp - 0xc9c], 0
jne 0x41350a
push dword [ebp - 0xc98]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xc9c]
mov dword [ebp - 0xbdc], eax
call fcn.0041ef64
mov eax, dword [ebp - 0xbdc]
test eax, eax
je 0x413503
mov ecx, dword [ebp - 0xc98]
mov dword [ebp - 0xc9c], eax
jmp 0x41348c
mov edi, 0x8007000e
jmp 0x413532
mov edi, 0x80004005
jmp 0x413538
test eax, eax
je 0x41350a
jg 0x41351b
mov edi, eax
jmp 0x413538
movzx edi, ax
or edi, 0x80070000
jmp 0x413538
mov eax, dword [ebp - 0xc9c]
mov dword [ebp - 0xca4], eax
mov dword [ebp - 0xc9c], ebx
lea ecx, [ebp - 0xc9c]
call fcn.0041ef64
test edi, edi
js 0x41360b
mov eax, dword [ebp - 0xca8]
test eax, eax
je 0x413603
mov ecx, 0x402830
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x413587
test dx, dx
je 0x413580
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x413587
add eax, 4
add ecx, 4
test dx, dx
jne 0x41355e
xor esi, esi
mov eax, ebx
inc esi
jmp 0x41358e
sbb eax, eax
xor esi, esi
inc esi
or eax, esi
test eax, eax
jne 0x413603
mov eax, dword [ebp - 0xca4]
test eax, eax
je 0x413603
mov ecx, 0x402840
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4135c7
test dx, dx
je 0x4135c3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4135c7
add eax, 4
add ecx, 4
test dx, dx
jne 0x4135a1
mov eax, ebx
jmp 0x4135cb
sbb eax, eax
or eax, esi
test eax, eax
jne 0x413603
push 4
lea eax, [ebp - 0xc0c]
mov dword [ebp - 0xc0c], ebx
push eax
push 0xb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
je 0x413367
test byte [ebp - 0xc0c], 0xf
jne 0x413603
xor eax, eax
inc eax
jmp 0x413605
mov eax, ebx
mov dword [ebp - 0xc00], eax
lea ecx, [ebp - 0xca4]
call fcn.0041ef64
lea ecx, [ebp - 0xca8]
call fcn.0041ef64
test edi, edi
jns 0x41362b
mov dword [ebp - 0xc00], ebx
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea ecx, [ebp - 0xcbc]
mov dword [ebp - 0xb98], esi
call fcn.0041ef4d
test esi, esi
jne 0x41370d
mov eax, 0x8007000e
mov dword [ebp - 0xcbc], ebx
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xc0c]
mov dword [ebp - 0xc08], eax
xor ebx, ebx
mov edx, 0x425e28
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x413674
mov eax, dword [0x425e24]
push 0
pop ebx
test eax, eax
jle 0x4136d1
sub eax, 1
mov dword [0x425e24], eax
jne 0x4136d1
mov edi, ebx
mov eax, dword [edi + 0x425930]
test eax, eax
je 0x4136aa
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0x413699
push 0x40
push ebx
push 0x425930
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x401090
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0x425e28
xchg dword [ecx], eax
lea ecx, [ebp - 0xcbc]
call fcn.0041ef4d
mov eax, dword [ebp - 0xbdc]
mov esi, 0xc004f012
lea edi, [esi + 0x15]
test eax, eax
jns 0x41be2e
cmp eax, 0xd0000034
jne 0x41be01
mov eax, esi
jmp 0x41be2a
xor eax, eax
mov dword [ebp - 0xcbc], esi
lea edi, [ebp - 0xd14]
mov dword [ebp - 0xbbc], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xcf4], ebx
mov dword [ebp - 0xbd0], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xbf8], 0x38
test eax, eax
jne 0x41376a
mov esi, 0xc0000017
mov edi, ebx
mov dword [ebp - 0xbdc], esi
jmp 0x413803
push 0x28
pop ecx
mov esi, 0x4247e0
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, eax
mov dword [ebp - 0xbe0], edi
push 8
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xbe4], ecx
test ecx, ecx
jne 0x4137a8
mov esi, 0xc0000017
mov dword [ebp - 0xbdc], esi
jmp 0x413803
mov eax, dword [0x4247d8]
mov dword [ecx], eax
mov eax, dword [0x4247dc]
mov dword [ecx + 4], eax
mov dword [ebp - 0xbbc], ecx
rdtsc
mov dword [ebp - 0xbf4], eax
mov dword [ebp - 0xbf0], edx
push 0xc
pop edi
lea eax, [ebp - 0xc90]
mov edx, 0x7fffffff
push eax
mov ecx, 0x4027f0
call fcn.0041ef9b
test eax, eax
jns 0x41390d
mov dword [ebp - 0xc90], ebx
mov esi, 0xc000003e
mov dword [ebp - 0xbdc], esi
mov edi, dword [ebp - 0xbe0]
cmp dword [ebp - 0xcf4], 0
mov dword [ebp - 0xcf8], ebx
mov dword [ebp - 0xcfc], ebx
je 0x413832
push dword [ebp - 0xcf4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xcf4], ebx
mov eax, dword [ebp - 0xd0c]
mov dword [ebp - 0xd10], ebx
mov dword [ebp - 0xd14], ebx
test eax, eax
je 0x41385d
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xd0c], ebx
test edi, edi
je 0x413870
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xbbc]
test eax, eax
je 0x413889
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x413661
mov eax, dword [ebp - 0xc00]
test eax, eax
je 0x41bddf
mov dword [0x425920], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x308]
mov dword [ebp - 0xc40], ebx
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x41a3b5
cmp eax, esi
jne 0x4138dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x41a3b5
mov esi, dword [0x42407c]
mov ecx, esi
push 0x403
push ebx
push ebx
call dword [0x426478]
call esi
mov dword [ebp - 0xbc4], eax
test eax, eax
jne 0x415a76
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41a3b5
mov eax, dword [ebp - 0xc90]
inc eax
mov dword [ebp - 0xc90], eax
lea eax, [eax*2 + 4]
cmp eax, 4
jb 0x41392c
mov edi, eax
mov esi, ebx
jmp 0x413931
mov esi, 0xc0000095
mov dword [ebp - 0xbdc], esi
test esi, esi
js 0x4137fd
lea ecx, [edi + 0xc4]
mov edx, 0xc4
cmp ecx, edx
jb 0x413952
mov eax, ecx
jmp 0x413955
or eax, 0xffffffff
cmp ecx, edx
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
add esi, 0x10000000
mov dword [ebp - 0xbdc], esi
cmp ecx, edx
jb 0x415a53
lea edx, [eax + 8]
cmp edx, eax
jb 0x41397f
mov ecx, edx
jmp 0x413982
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, edi
add esi, 0x10000000
mov dword [ebp - 0xbdc], esi
cmp edx, eax
jb 0x415a53
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x4139a7
mov edx, eax
jmp 0x4139aa
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, edi
add esi, 0x10000000
mov dword [ebp - 0xbdc], esi
cmp eax, ecx
jb 0x415a53
push edx
push 8
mov dword [ebp - 0xcf8], edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x4139ea
mov esi, 0xc0000017
jmp 0x4137f7
mov dword [ebp - 0xcf4], edx
mov dword [ebp - 0xcfc], ebx
mov dword [ebp - 0xc8c], ebx
lea esi, [edx + 4]
cmp esi, edx
jb 0x413a5c
mov ecx, dword [ebp - 0xcf8]
lea eax, [edx + 8]
add ecx, edx
cmp eax, ecx
jbe 0x413a1c
mov esi, 0xc0000023
jmp 0x4137f7
mov dword [edx], 4
mov dword [esi], ebx
mov ecx, dword [ebp - 0xcfc]
inc ecx
mov dword [ebp - 0xcfc], ecx
cmp dword [ebp - 0xcf4], 0
jne 0x413a63
mov eax, dword [ebp - 0xcf8]
lea edx, [eax + 0xa4]
cmp edx, eax
jb 0x413a5c
inc ecx
mov dword [ebp - 0xcf8], edx
mov dword [ebp - 0xcfc], ecx
jmp 0x413aea
mov esi, edi
jmp 0x4137f7
mov edx, dword [ebp - 0xcf4]
mov esi, ebx
test ecx, ecx
je 0x413a8a
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x413b1e
add eax, edx
cmp eax, edx
jb 0x413a5c
inc esi
mov edx, eax
cmp esi, ecx
jb 0x413a6f
lea edi, [edx + 4]
cmp edi, edx
jb 0x413be5
mov ecx, dword [ebp - 0xcf8]
mov eax, ebx
add ecx, dword [ebp - 0xcf4]
mov dword [ebp - 0xbdc], eax
lea eax, [edx + 0xa4]
cmp eax, ecx
ja 0x413a12
mov esi, dword [ebp - 0xbcc]
push 0x28
mov dword [edx], 0xa0
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xcfc]
mov esi, ebx
inc ecx
mov edi, 0xc0000095
mov dword [ebp - 0xcfc], ecx
test esi, esi
js 0x4137fd
mov edx, dword [ebp - 0xcf8]
cmp dword [ebp - 0xcf4], 0
jne 0x413b28
lea eax, [edx + 0xc]
cmp eax, edx
jb 0x413a5c
mov edx, eax
inc ecx
mov eax, dword [ebp - 0xbf4]
mov dword [ebp - 0xce0], eax
mov eax, dword [ebp - 0xbf0]
mov dword [ebp - 0xcdc], eax
jmp 0x413bcc
mov esi, edi
mov dword [ebp - 0xbdc], esi
jmp 0x413adc
mov edi, dword [ebp - 0xcf4]
mov esi, ebx
test ecx, ecx
je 0x413b53
mov eax, dword [edi]
add eax, 4
cmp eax, 4
jb 0x413bef
add eax, edi
cmp eax, edi
jb 0x413be5
inc esi
mov edi, eax
cmp esi, ecx
jb 0x413b34
lea eax, [edi + 4]
cmp eax, edi
jb 0x413be5
mov ecx, dword [ebp - 0xcf4]
lea eax, [edi + 0xc]
add ecx, edx
mov esi, ebx
mov dword [ebp - 0xbdc], esi
cmp eax, ecx
ja 0x413a12
mov ecx, dword [ebp - 0xbe4]
mov dword [edi], 8
mov eax, dword [ecx]
mov dword [edi + 4], eax
mov eax, dword [ecx + 4]
mov dword [edi + 8], eax
mov ecx, dword [ebp - 0xcfc]
mov edx, dword [ebp - 0xcf8]
inc ecx
mov dword [ebp - 0xcfc], ecx
test esi, esi
js 0x4137fd
cmp dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0xbf4]
mov dword [ebp - 0xce0], eax
mov eax, dword [ebp - 0xbf0]
mov dword [ebp - 0xcdc], eax
jne 0x413bfc
lea eax, [edx + 0xc]
cmp eax, edx
jb 0x413be5
inc ecx
mov dword [ebp - 0xcf8], eax
mov dword [ebp - 0xcfc], ecx
jmp 0x413c67
mov esi, 0xc0000095
jmp 0x4137f7
mov esi, 0xc0000095
mov dword [ebp - 0xbdc], esi
jmp 0x413ba3
mov edi, dword [ebp - 0xcf4]
mov esi, ebx
test ecx, ecx
je 0x413c1f
mov eax, dword [edi]
add eax, 4
cmp eax, 4
jb 0x413c8c
add eax, edi
cmp eax, edi
jb 0x413be5
inc esi
mov edi, eax
cmp esi, ecx
jb 0x413c08
lea eax, [edi + 4]
cmp eax, edi
jb 0x413be5
mov ecx, dword [ebp - 0xcf4]
lea eax, [edi + 0xc]
add ecx, edx
mov esi, ebx
mov dword [ebp - 0xbdc], esi
cmp eax, ecx
ja 0x413a12
mov eax, dword [ebp - 0xbf4]
mov dword [edi], 8
mov dword [edi + 4], eax
mov eax, dword [ebp - 0xbf0]
mov dword [edi + 8], eax
inc dword [ebp - 0xcfc]
test esi, esi
js 0x4137fd
lea eax, [ebp - 0xcc8]
mov edx, 0x7fffffff
push eax
mov ecx, 0x4027f0
call fcn.0041ef9b
test eax, eax
jns 0x413c99
mov dword [ebp - 0xcc8], ebx
jmp 0x4137f2
mov esi, 0xc0000095
mov dword [ebp - 0xbdc], esi
jmp 0x413c5f
mov eax, dword [ebp - 0xcc8]
mov edx, 0xc0000095
lea ecx, [eax + 1]
cmp ecx, eax
jb 0x413caf
mov esi, ebx
jmp 0x413cb4
mov esi, edx
or ecx, 0xffffffff
mov dword [ebp - 0xbdc], esi
mov dword [ebp - 0xcc8], ecx
test esi, esi
js 0x4137fd
lea eax, [ecx + ecx]
mov dword [ebp - 0xbcc], eax
test eax, eax
je 0x413d98
cmp dword [ebp - 0xcf4], 0
jne 0x413d19
lea ecx, [eax + 4]
cmp ecx, 4
jb 0x413d12
add ecx, dword [ebp - 0xcf8]
cmp ecx, dword [ebp - 0xcf8]
jb 0x413d0b
inc dword [ebp - 0xcfc]
mov esi, ebx
mov dword [ebp - 0xcf8], ecx
jmp 0x413d9d
or dword [ebp - 0xcf8], 0xffffffff
mov esi, edx
jmp 0x413d9d
cmp dword [ebp - 0xcfc], 0
mov ecx, ebx
mov edi, dword [ebp - 0xcf4]
jbe 0x413d4b
mov eax, dword [edi]
add eax, 4
cmp eax, 4
jb 0x413d12
add eax, edi
cmp eax, edi
jb 0x413d12
inc ecx
mov edi, eax
cmp ecx, dword [ebp - 0xcfc]
jb 0x413d2a
mov eax, dword [ebp - 0xbcc]
lea ecx, [edi + 4]
cmp ecx, edi
jb 0x413d12
lea edx, [eax + 4]
mov esi, ebx
mov eax, dword [ebp - 0xcf4]
add edx, edi
add eax, dword [ebp - 0xcf8]
mov dword [ebp - 0xbdc], esi
cmp edx, eax
jbe 0x413d76
mov esi, 0xc0000023
jmp 0x413d9d
mov eax, dword [ebp - 0xbcc]
push eax
mov dword [edi], eax
lea eax, [edi + 4]
push 0x4027f0
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
inc dword [ebp - 0xcfc]
jmp 0x413da3
mov esi, 0xc000000d
mov dword [ebp - 0xbdc], esi
test esi, esi
js 0x4137fd
cmp dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0xc00]
mov dword [ebp - 0xc80], eax
jne 0x413dec
mov eax, dword [ebp - 0xcf8]
lea ecx, [eax + 8]
cmp ecx, eax
jb 0x413be5
inc dword [ebp - 0xcfc]
mov dword [ebp - 0xcf8], ecx
mov dword [ebp - 0xc7c], 4
jmp 0x413e7e
cmp dword [ebp - 0xcfc], 0
mov ecx, ebx
mov edx, dword [ebp - 0xcf4]
jbe 0x413e20
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x413ea0
add eax, edx
cmp eax, edx
jb 0x413be5
inc ecx
mov edx, eax
cmp ecx, dword [ebp - 0xcfc]
jb 0x413dfd
lea edi, [edx + 4]
cmp edi, edx
jb 0x413be5
mov ecx, dword [ebp - 0xcf8]
lea eax, [edx + 8]
add ecx, dword [ebp - 0xcf4]
mov esi, ebx
mov dword [ebp - 0xbdc], esi
cmp eax, ecx
ja 0x413a12
mov eax, dword [ebp - 0xc00]
mov dword [edx], 4
mov dword [edi], eax
mov edi, 0xc0000095
inc dword [ebp - 0xcfc]
test esi, esi
js 0x4137fd
cmp dword [ebp - 0xcf4], 0
mov dword [ebp - 0xc7c], 4
jne 0x413eaf
mov eax, dword [ebp - 0xcf8]
lea ecx, [eax + 8]
cmp ecx, eax
jb 0x413be5
inc dword [ebp - 0xcfc]
mov dword [ebp - 0xcf8], ecx
jmp 0x413f22
mov edi, 0xc0000095
mov esi, edi
mov dword [ebp - 0xbdc], esi
jmp 0x413e63
cmp dword [ebp - 0xcfc], 0
mov ecx, ebx
mov edx, dword [ebp - 0xcf4]
jbe 0x413ee3
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x413fb6
add eax, edx
cmp eax, edx
jb 0x413a5c
inc ecx
mov edx, eax
cmp ecx, dword [ebp - 0xcfc]
jb 0x413ec0
lea edi, [edx + 4]
cmp edi, edx
jb 0x413be5
mov ecx, dword [ebp - 0xcf8]
lea eax, [edx + 8]
add ecx, dword [ebp - 0xcf4]
mov esi, ebx
mov dword [ebp - 0xbdc], esi
cmp eax, ecx
ja 0x413a12
push 4
pop eax
mov dword [edx], eax
mov dword [edi], eax
inc dword [ebp - 0xcfc]
test esi, esi
js 0x4137fd
rdtsc
mov edi, ebx
mov dword [ebp - 0xbcc], ebx
mov dword [ebp - 0xbe4], edi
mov dword [ebp - 0xbec], ebx
mov dword [ebp - 0xbb4], ebx
mov dword [ebp - 0xbb8], ebx
mov dword [ebp - 0xbc0], ebx
mov dword [ebp - 0xb90], ebx
mov dword [ebp - 0xb80], ebx
mov dword [ebp - 0xb7c], ebx
mov dword [ebp - 0xba0], ebx
mov dword [ebp - 0xbdc], eax
mov dword [ebp - 0xb84], edx
mov ecx, dword [ebp - 0xcf8]
add ecx, 8
cmp ecx, 8
jb 0x414048
lea eax, [ecx + 7]
and eax, 0xfffffff8
mov dword [ebp - 0xbb0], eax
cmp eax, ecx
jb 0x414048
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x413fc3
mov esi, 0xc0000017
mov edi, ebx
jmp 0x41404d
mov esi, edi
mov dword [ebp - 0xbdc], esi
jmp 0x413f1a
mov eax, dword [ebp - 0xcfc]
lea ecx, [edi + 4]
mov dword [edi], eax
cmp ecx, edi
jb 0x414028
mov eax, dword [ebp - 0xcf8]
lea edx, [ecx + 4]
mov dword [ecx], eax
cmp edx, ecx
jb 0x414028
mov eax, dword [ebp - 0xbb0]
mov esi, ebx
mov ecx, dword [ebp - 0xbdc]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xb84]
mov dword [edi + eax - 4], ecx
push dword [ebp - 0xcf8]
push dword [ebp - 0xcf4]
push edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xbb0]
add esp, 0xc
mov dword [ebp - 0xbcc], edi
mov edi, ebx
mov dword [ebp - 0xbe4], eax
jmp 0x41402d
mov esi, 0xc0000095
test edi, edi
je 0x414040
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xbe4]
jmp 0x41404d
mov esi, 0xc0000095
or esi, 0x10000000
mov dword [ebp - 0xbdc], esi
jl 0x4154cc
cmp dword [ebp - 0xbcc], 0
mov dword [ebp - 0xbb0], ebx
jne 0x414078
mov esi, 0xc000000d
jmp 0x4146af
test edi, edi
je 0x4146aa
lea esi, [edi + 8]
push esi
push ebx
mov dword [ebp - 0xb84], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xbdc], eax
test eax, eax
je 0x4146aa
mov cl, bl
mov edx, ebx
test edi, edi
je 0x4140bc
mov eax, dword [ebp - 0xbcc]
xor cl, byte [edx + eax]
inc edx
cmp edx, edi
jb 0x4140b4
mov eax, 0xb1b54a58
mov dword [ebp - 0x3a0], eax
mov eax, 0xc81ecb17
mov dword [ebp - 0x39c], eax
mov eax, edi
shr eax, 3
mov dword [ebp - 0xba4], eax
test eax, eax
je 0x4144e7
movzx edx, word [ebp - 0x39e]
mov eax, 0xc81ecb17
movzx esi, ax
mov edi, 0xb1b54a58
movzx eax, word [ebp - 0x39a]
mov dword [ebp - 0xb88], eax
movzx eax, di
mov dword [ebp - 0xbac], edx
mov edx, dword [ebp - 0xbdc]
mov dword [ebp - 0xb9c], eax
add edx, 7
mov dword [ebp - 0xb8c], esi
mov eax, 0xc81ecb17
mov esi, dword [ebp - 0xbcc]
xor eax, edi
add esi, 2
mov dword [ebp - 0xbd8], edx
or dword [ebp - 0xba8], 0xffffffff
mov edx, ebx
mov dword [ebp - 0xbc8], ebx
mov dword [ebp - 0xbc4], ebx
mov ebx, dword [ebp - 0xba8]
mov dword [ebp - 0xb94], eax
mov dword [ebp - 0xbd4], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xbd4]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xbd4]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xbd4]
shl esi, 8
add dword [ebp - 0xbd4], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov eax, ebx
sub eax, dword [ebp - 0xb9c]
xor eax, edi
xor eax, edx
xor eax, 0xc81ecb17
mov edx, eax
mov dword [ebp - 0xba8], eax
xor edx, 0xc81ecb17
ror eax, 7
ror edx, 0xf
imul edx, dword [ebp - 0xbac]
add edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
mov eax, ebx
ror eax, 0xa
lea edx, [ebx + edx]
ror edx, 9
imul edx, dword [ebp - 0xb8c]
sub edx, eax
mov eax, dword [ebp - 0xba8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xba8], eax
xor edx, dword [ebp - 0xb8c]
rol edx, 4
imul edx, dword [ebp - 0xb88]
rol eax, 5
add edx, eax
mov eax, 0xc81ecb17
xor ebx, edx
mov edx, ebx
xor edx, 0xb1b54a58
sub eax, edx
mov edx, dword [ebp - 0xba8]
xor edx, eax
mov dword [ebp - 0xba8], edx
sub edx, dword [ebp - 0xb9c]
imul edx, dword [ebp - 0xbac]
mov eax, dword [ebp - 0xba8]
shr eax, 6
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xba8]
mov eax, ebx
ror eax, 0xf
xor eax, dword [ebp - 0xb8c]
imul eax, dword [ebp - 0xb9c]
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [ebp - 0xb88]
imul eax, dword [ebp - 0xb8c]
xor ebx, eax
mov eax, ebx
sub eax, dword [ebp - 0xb9c]
sub eax, 0xc81ecb17
xor edx, eax
mov dword [ebp - 0xba8], edx
mov eax, dword [ebp - 0xba8]
xor eax, dword [ebp - 0xb88]
imul eax, dword [ebp - 0xbac]
ror edx, 0xa
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xb9c]
rol edx, 6
imul edx, dword [ebp - 0xb8c]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0xba8]
xor eax, edx
mov dword [ebp - 0xba8], eax
ror eax, 0xf
sub eax, dword [ebp - 0xb88]
imul eax, dword [ebp - 0xb9c]
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xb88]
imul edx, dword [ebp - 0xb9c]
shr eax, 1
xor edx, eax
mov eax, ebx
xor dword [ebp - 0xba8], edx
mov edx, ebx
sub edx, dword [ebp - 0xb8c]
rol edx, 3
imul edx, dword [ebp - 0xb9c]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0xba8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xba8], eax
sub edx, dword [ebp - 0xb8c]
imul edx, dword [ebp - 0xbac]
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 9
imul edx, dword [ebp - 0xb8c]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0xba8]
xor eax, edx
mov dword [ebp - 0xba8], eax
sub eax, 0xb1b54a58
sub eax, dword [ebp - 0xb88]
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xbac]
imul eax, dword [ebp - 0xb9c]
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0xba8]
xor edx, eax
mov dword [ebp - 0xba8], edx
xor edx, dword [ebp - 0xb88]
mov eax, dword [ebp - 0xba8]
rol edx, 4
imul edx, dword [ebp - 0xbac]
ror eax, 0x10
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 0xa
imul edx, dword [ebp - 0xb8c]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0xba8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xba8], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, dword [ebp - 0xb88]
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, 0xc81ecb17
rol eax, 2
rol edx, 8
imul edx, dword [ebp - 0xb9c]
sub edx, eax
mov eax, dword [ebp - 0xba8]
xor eax, edx
mov edx, 0xc81ecb17
sub edx, eax
mov dword [ebp - 0xba8], eax
ror edx, 0xb
imul edx, dword [ebp - 0xbac]
ror eax, 0xc
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xbac]
imul edx, dword [ebp - 0xb8c]
shr eax, 8
xor edx, eax
mov eax, dword [ebp - 0xba8]
xor eax, edx
mov edx, dword [ebp - 0xbd8]
xor ebx, eax
xor eax, dword [ebp - 0xbc8]
xor ebx, dword [ebp - 0xb94]
xor ebx, dword [ebp - 0xbc4]
mov byte [edx - 4], al
mov byte [edx], bl
ror eax, 8
mov byte [edx - 5], al
ror ebx, 8
mov byte [edx - 1], bl
ror eax, 8
mov byte [edx - 6], al
ror ebx, 8
mov byte [edx - 2], bl
ror eax, 8
ror ebx, 8
mov byte [edx - 7], al
mov byte [edx - 3], bl
add edx, 8
ror eax, 8
ror ebx, 8
sub dword [ebp - 0xba4], 1
mov dword [ebp - 0xbc4], esi
mov esi, dword [ebp - 0xbd4]
mov dword [ebp - 0xbd8], edx
mov edx, eax
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xbc8], edi
jne 0x414161
mov edi, dword [ebp - 0xbe4]
xor ebx, ebx
mov esi, dword [ebp - 0xb84]
movzx eax, cl
mov ecx, dword [ebp - 0xbdc]
cdq
mov dword [ecx + edi], eax
mov dword [ecx + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xbc4], edi
test edi, edi
jne 0x41451f
mov esi, 0xc0000017
jmp 0x414619
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x41453c
mov esi, 0xc0000017
jmp 0x4145b8
mov dword [edi + 4], eax
mov edx, dword [ebp - 0xbdc]
push esi
push edx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x414535
mov dword [edi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0x424730
push 8
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xbc4]
pop eax
push eax
push eax
mov dword [edi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x414535
mov dword [edi + 0x14], ecx
mov eax, dword [0x4247d0]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0x4247d4]
mov dword [ebp - 0xbb0], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0x414619
cmp dword [edi + 4], 0
je 0x4145d6
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x4145f0
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x41460a
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x41462d
mov eax, dword [ebp - 0xbb0]
mov edi, ebx
mov dword [ebp - 0xbec], eax
jmp 0x414633
mov edi, dword [ebp - 0xbb0]
push dword [ebp - 0xbdc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x4146af
cmp dword [edi + 4], 0
je 0x414665
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x41467f
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x414699
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4146af
mov esi, 0xc0000001
or esi, 0x10000000
mov dword [ebp - 0xbdc], esi
jl 0x4154cc
mov edx, dword [ebp - 0xbec]
mov eax, dword [edx]
mov esi, dword [edx + 0x10]
add eax, 4
mov ecx, dword [edx + 8]
cmp eax, 4
jb 0x4147e3
lea edx, [eax + 4]
cmp edx, eax
jb 0x4147e3
add ecx, edx
cmp ecx, edx
jb 0x4147e3
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x4147e3
lea ecx, [eax + esi]
mov dword [ebp - 0xbc4], ecx
cmp ecx, eax
jb 0x4147e3
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x41472c
mov esi, 0xc0000017
jmp 0x4147e8
mov edx, dword [ebp - 0xbec]
lea esi, [edi + 4]
mov eax, dword [edx]
mov dword [edi], eax
cmp esi, edi
jb 0x4147c9
push dword [edx]
push dword [edx + 4]
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebp - 0xbec]
add esp, 0xc
mov ecx, dword [edx]
add ecx, esi
cmp ecx, esi
jb 0x4147c9
mov eax, dword [edx + 8]
lea esi, [ecx + 4]
mov dword [ecx], eax
cmp esi, ecx
jb 0x4147c9
push dword [edx + 8]
push dword [edx + 0xc]
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebp - 0xbec]
add esp, 0xc
mov ecx, dword [edx + 8]
add ecx, esi
cmp ecx, esi
jb 0x4147c9
mov eax, dword [edx + 0x10]
lea esi, [ecx + 4]
mov dword [ecx], eax
cmp esi, ecx
jb 0x4147c9
push dword [edx + 0x10]
push dword [edx + 0x14]
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xbec]
add esp, 0xc
mov eax, dword [eax + 0x10]
add eax, esi
cmp eax, esi
jb 0x4147c9
mov eax, dword [ebp - 0xbc4]
mov esi, ebx
mov dword [ebp - 0xbb4], edi
mov edi, ebx
mov dword [ebp - 0xbb8], eax
jmp 0x4147ce
mov esi, 0xc0000095
test edi, edi
je 0x4147e8
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4147e8
mov esi, 0xc0000095
or esi, 0x10000000
mov dword [ebp - 0xbdc], esi
jl 0x4154cc
cmp dword [ebp - 0xcf4], 0
jne 0x41480d
mov esi, 0xc000000d
jmp 0x4148b2
xor eax, eax
inc eax
cmp dword [ebp - 0xcfc], eax
jbe 0x414803
mov ecx, dword [ebp - 0xcf4]
mov edx, ebx
mov esi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x4148ad
lea ecx, [esi + eax]
cmp ecx, eax
jb 0x4148ad
xor eax, eax
inc edx
inc eax
cmp edx, eax
jb 0x414820
mov edi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x4148ad
cmp dword [ebp - 0xcfc], 2
jbe 0x414803
mov ecx, dword [ebp - 0xcf4]
mov edx, ebx
mov esi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x4148ad
lea ecx, [esi + eax]
cmp ecx, eax
jb 0x4148ad
inc edx
cmp edx, 2
jb 0x414856
mov edx, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x4148ad
lea eax, [edi + 0x50]
cmp eax, 0x50
jb 0x4148ad
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x4148ad
lea eax, [ecx + edx]
cmp eax, ecx
jb 0x4148ad
mov edi, eax
mov dword [ebp - 0xb90], edi
mov esi, ebx
mov dword [ebp - 0xbdc], esi
cmp edi, 0x400000
jbe 0x4148ba
mov esi, 0x8000ffff
jmp 0x4154c6
mov esi, 0xc0000095
mov edi, ebx
mov dword [ebp - 0xbdc], esi
test esi, esi
js 0x4154cc
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x4148df
mov esi, 0xd0000017
mov ecx, ebx
jmp 0x4148ec
mov ecx, eax
mov dword [ebp - 0xbc0], ecx
mov esi, 0x10000000
mov dword [ebp - 0xbdc], esi
test esi, esi
js 0x4154cc
mov eax, dword [ebp - 0xbb4]
test eax, eax
jne 0x41490e
mov esi, 0x80070057
jmp 0x4154c6
test ecx, ecx
je 0x414904
mov dword [ebp - 0xd40], eax
mov eax, dword [ebp - 0xbb8]
mov dword [ebp - 0xd38], eax
lea eax, [ebp - 0xcac]
push eax
xor eax, eax
mov dword [ebp - 0xd3c], ecx
push 0x401af0
inc eax
mov dword [ebp - 0xd34], edi
push eax
mov dword [ebp - 0xd30], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x414982
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0xbdc], esi
test esi, esi
jle 0x414973
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0xbdc], esi
test esi, esi
js 0x4149ce
mov esi, 0x80004005
mov dword [ebp - 0xbdc], esi
jmp 0x4149ce
push 0x404c20
push dword [ebp - 0xcac]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x414950
push ebx
push 0x14
lea eax, [ebp - 0xd40]
mov ecx, esi
push eax
push 0x86
call dword [0x426478]
call esi
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xbdc], esi
jl 0x4149ce
mov edi, dword [ebp - 0xd34]
mov dword [ebp - 0xb90], edi
cmp esi, 0xd0000023
jne 0x4149e0
mov esi, 0x8007007a
jmp 0x4154c6
test esi, esi
js 0x4154cc
mov dword [ebp - 0xbc4], ebx
cmp edi, 4
jae 0x4149fd
mov esi, 0xc000003e
jmp 0x414cf5
mov eax, dword [ebp - 0xbc0]
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xbc8], ecx
cmp edx, eax
jb 0x414cf0
lea eax, [edi - 4]
cmp eax, ecx
jb 0x4149f3
lea edi, [edx + ecx]
cmp edi, edx
jb 0x414cf0
lea edx, [ecx + 4]
cmp edx, 4
jb 0x414cf0
mov eax, dword [ebp - 0xb90]
sub eax, edx
cmp eax, 4
jb 0x4149f3
mov esi, dword [edi]
lea eax, [edi + 4]
mov dword [ebp - 0xba8], eax
cmp eax, edi
jb 0x414cf0
lea edi, [edx + 4]
cmp edi, edx
jb 0x414cf0
mov eax, dword [ebp - 0xb90]
sub eax, edi
cmp eax, esi
jb 0x4149f3
mov edx, dword [ebp - 0xba8]
lea eax, [edx + esi]
cmp eax, edx
jb 0x414cf0
lea edx, [edi + esi]
cmp edx, edi
jb 0x414cf0
mov eax, dword [ebp - 0xb90]
sub eax, edx
cmp eax, 4
jb 0x4149f3
mov eax, dword [ebp - 0xba8]
add eax, esi
mov edx, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xbd8], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0xbc8]
mov dword [ebp - 0xbd4], edx
jb 0x414cf0
lea eax, [edi + esi]
lea edi, [eax + 4]
cmp edi, eax
jb 0x414cf0
mov eax, dword [ebp - 0xb90]
sub eax, edi
cmp eax, edx
jb 0x4149f3
lea eax, [edi + edx]
mov dword [ebp - 0xb94], eax
cmp eax, edi
jb 0x414cf0
mov edi, dword [ebp - 0xb90]
mov eax, edi
sub eax, dword [ebp - 0xb94]
jne 0x4149f3
lea eax, [ecx + 0xc]
add eax, esi
add eax, edx
cmp eax, edi
jne 0x4149f3
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x414b32
mov esi, 0xc0000017
jmp 0x414c73
mov eax, dword [ebp - 0xbc0]
add eax, 4
je 0x414b83
mov eax, dword [ebp - 0xbc8]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x414b65
mov esi, 0xc0000017
jmp 0x414c12
mov dword [edi + 4], ecx
push dword [ebp - 0xbc8]
mov eax, dword [ebp - 0xbc0]
add eax, 4
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0x414b88
mov dword [edi], ebx
mov dword [edi + 4], ebx
cmp dword [ebp - 0xba8], 0
je 0x414bbd
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x414b5b
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xba8]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0x414bc3
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [ebp - 0xbd8], 0
je 0x414c02
mov esi, dword [ebp - 0xbd4]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x414b5b
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xbd8]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0x414c08
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 0xbc4], edi
mov esi, ebx
mov edi, ebx
test edi, edi
je 0x414c73
cmp dword [edi + 4], 0
je 0x414c30
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x414c4a
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x414c64
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x414c87
mov eax, dword [ebp - 0xbc4]
mov edi, ebx
mov dword [ebp - 0xb80], eax
jmp 0x414c8d
mov edi, dword [ebp - 0xbc4]
test edi, edi
je 0x414cf5
cmp dword [edi + 4], 0
je 0x414cab
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x414cc5
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x414cdf
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x414cf5
mov esi, 0xc0000095
or esi, 0x10000000
mov dword [ebp - 0xbdc], esi
jl 0x4154cc
mov ecx, dword [ebp - 0xb80]
mov edi, ebx
mov dword [ebp - 0xbc4], ebx
test ecx, ecx
jne 0x414d23
mov esi, 0xd000000d
jmp 0x4154c6
mov eax, dword [ecx + 4]
mov dword [ebp - 0xbc8], eax
test eax, eax
je 0x414d19
mov esi, dword [ecx]
test esi, esi
je 0x414d19
add esi, 0xfffffff8
push esi
push ebx
mov dword [ebp - 0xba8], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xbd4], eax
test eax, eax
je 0x415351
mov ecx, 0xab69605e
mov dword [ebp - 0xb94], eax
mov dword [ebp - 0x3c8], ecx
mov edi, esi
mov ecx, 0x7f1137f
mov dl, bl
mov dword [ebp - 0x3c4], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xbc8]
mov dword [ebp - 0xbd8], ecx
and edi, 7
je 0x4152fa
mov dword [ebp - 0xb8c], ebx
mov ecx, ebx
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xb9c], ecx
test edi, edi
je 0x414dfe
mov ebx, dword [ebp - 0xbd8]
push 0x38
pop esi
movzx eax, byte [ebx]
inc ebx
cmp ecx, 4
jge 0x414dca
lea ecx, [esi - 0x20]
shl eax, cl
or dword [ebp - 0xbac], eax
jmp 0x414dd4
mov ecx, esi
shl eax, cl
or dword [ebp - 0xb8c], eax
mov ecx, dword [ebp - 0xb9c]
sub esi, 8
inc ecx
mov dword [ebp - 0xb9c], ecx
cmp ecx, edi
jl 0x414db4
mov eax, ebx
mov dword [ebp - 0xbd8], ebx
mov dword [ebp - 0xbd8], eax
xor ebx, ebx
mov eax, dword [ebp - 0xbac]
mov esi, dword [ebp - 0xb8c]
xor eax, 0x92f65a5
xor esi, 0x699a899c
mov dword [ebp - 0xb9c], eax
mov dword [ebp - 0xb88], eax
mov ecx, ebx
mov dword [ebp - 0xba4], esi
test edi, edi
je 0x414e7e
mov eax, dword [ebp - 0xb94]
inc eax
mov dword [ebp - 0xbb0], eax
cmp ecx, 4
jge 0x414e48
rol dword [ebp - 0xb88], 8
mov eax, dword [ebp - 0xb88]
jmp 0x414e55
rol dword [ebp - 0xba4], 8
mov eax, dword [ebp - 0xba4]
mov ebx, dword [ebp - 0xb94]
inc ecx
mov byte [ebx], al
mov ebx, dword [ebp - 0xbb0]
mov eax, ebx
mov dword [ebp - 0xb94], eax
cmp ecx, edi
jl 0x414e2d
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0xb94], ebx
xor ebx, ebx
cmp edi, 4
jbe 0x4152d7
push 8
pop ecx
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xb88], esi
mov esi, dword [ebp - 0xba8]
mov eax, esi
shr eax, 3
mov dword [ebp - 0xba4], eax
test eax, eax
je 0x4152a0
movzx ecx, word [ebp - 0x3c2]
mov eax, 0x7f1137f
movzx esi, word [ebp - 0x3c6]
movzx eax, ax
mov dword [ebp - 0xb84], ecx
mov ecx, 0xab69605e
mov dword [ebp - 0xbb0], eax
movzx eax, cx
mov ecx, dword [ebp - 0xb88]
mov dword [ebp - 0xbb8], eax
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0xb90], esi
add eax, 7
mov esi, dword [ebp - 0xbd8]
mov dword [ebp - 0xb94], eax
add esi, 2
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
add esi, 8
shl edi, 8
or edi, eax
mov dword [ebp - 0xbd8], esi
mov eax, dword [ebp - 0xb9c]
xor ecx, edi
xor eax, ebx
mov esi, 0x7f1137f
xor esi, ecx
mov dword [ebp - 0xb9c], eax
xor esi, eax
mov eax, 0xab69605e
xor esi, eax
mov ecx, esi
sub ecx, eax
mov eax, esi
rol ecx, 5
imul ecx, dword [ebp - 0xbb0]
rol eax, 0xa
add ecx, eax
mov eax, dword [ebp - 0xb9c]
xor eax, ecx
mov ecx, 0x7f1137f
add ecx, eax
mov dword [ebp - 0xb9c], eax
ror ecx, 9
imul ecx, dword [ebp - 0xb90]
rol eax, 2
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
sub ecx, dword [ebp - 0xbb0]
imul ecx, dword [ebp - 0xbb8]
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0xb9c]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xb9c], eax
xor ecx, dword [ebp - 0xb90]
rol ecx, 6
imul ecx, dword [ebp - 0xb84]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, 0xab69605e
sub eax, ecx
mov ecx, dword [ebp - 0xb9c]
xor ecx, eax
mov dword [ebp - 0xb9c], ecx
mov eax, dword [ebp - 0xb9c]
xor eax, dword [ebp - 0xbb0]
imul eax, dword [ebp - 0xb90]
ror ecx, 6
xor ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
lea ecx, [esi + ecx]
ror ecx, 0xf
imul ecx, dword [ebp - 0xbb8]
mov eax, esi
rol eax, 2
add ecx, eax
mov eax, dword [ebp - 0xb9c]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xb9c], eax
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0xb84]
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, 0xab69605e
ror eax, 0xa
ror ecx, 0xc
imul ecx, dword [ebp - 0xbb0]
xor ecx, eax
mov eax, dword [ebp - 0xb9c]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xb9c], eax
xor ecx, dword [ebp - 0xb84]
imul ecx, dword [ebp - 0xb90]
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov ecx, dword [ebp - 0xb9c]
mov eax, esi
not eax
ror eax, 5
add eax, dword [ebp - 0xbb8]
imul eax, dword [ebp - 0xb84]
xor ecx, eax
mov eax, ecx
mov dword [ebp - 0xb9c], ecx
sub eax, dword [ebp - 0xb84]
xor eax, esi
mov esi, dword [ebp - 0xb9c]
xor eax, 0xab69605e
mov ecx, eax
mov dword [ebp - 0xb88], eax
xor ecx, dword [ebp - 0xb84]
rol ecx, 2
imul ecx, dword [ebp - 0xbb0]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
sub ecx, eax
mov eax, esi
ror ecx, 6
imul ecx, dword [ebp - 0xb90]
rol eax, 7
add ecx, eax
mov eax, dword [ebp - 0xb88]
xor eax, ecx
mov dword [ebp - 0xb88], eax
mov ecx, eax
xor eax, dword [ebp - 0xbb0]
imul eax, dword [ebp - 0xbb8]
ror ecx, 9
add ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0xb90]
rol ecx, 5
imul ecx, dword [ebp - 0xb84]
rol eax, 7
add ecx, eax
xor dword [ebp - 0xb88], ecx
mov ecx, dword [ebp - 0xb88]
mov eax, ecx
xor eax, esi
mov esi, 0x7f1137f
xor eax, esi
mov esi, 0xab69605e
xor esi, eax
mov eax, esi
ror eax, 3
sub eax, dword [ebp - 0xb90]
imul eax, dword [ebp - 0xbb0]
xor ecx, eax
mov eax, 0x7f1137f
mov dword [ebp - 0xb88], ecx
sub ecx, eax
mov eax, dword [ebp - 0xb88]
ror ecx, 1
imul ecx, dword [ebp - 0xbb8]
ror eax, 6
sub ecx, eax
xor esi, ecx
mov ecx, 0xab69605e
mov eax, esi
rol eax, 0xe
lea ecx, [esi + ecx]
rol ecx, 3
imul ecx, dword [ebp - 0xb84]
add ecx, eax
mov eax, dword [ebp - 0xb88]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0xb88], eax
rol ecx, 0xf
imul ecx, dword [ebp - 0xbb0]
ror eax, 0xe
sub ecx, eax
xor esi, ecx
mov ecx, dword [ebp - 0xbb8]
xor ecx, esi
mov dword [ebp - 0xb9c], esi
imul ecx, dword [ebp - 0xb90]
mov eax, esi
shr eax, 3
mov esi, 0x7f1137f
xor ecx, eax
mov eax, dword [ebp - 0xb88]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xb88], eax
xor ecx, esi
rol eax, 2
mov esi, dword [ebp - 0xb94]
rol ecx, 4
imul ecx, dword [ebp - 0xbb8]
xor ecx, eax
mov eax, dword [ebp - 0xb9c]
xor ecx, dword [ebp - 0xbac]
xor eax, ecx
mov dword [ebp - 0xbac], ebx
mov ecx, dword [ebp - 0xb88]
xor ecx, dword [ebp - 0xb8c]
mov byte [esi - 4], al
mov byte [esi], cl
ror eax, 8
mov byte [esi - 5], al
ror ecx, 8
mov byte [esi - 1], cl
ror eax, 8
mov byte [esi - 6], al
ror ecx, 8
mov byte [esi - 2], cl
ror eax, 8
ror ecx, 8
mov byte [esi - 7], al
mov byte [esi - 3], cl
add esi, 8
ror eax, 8
ror ecx, 8
sub dword [ebp - 0xba4], 1
mov dword [ebp - 0xb94], esi
mov esi, dword [ebp - 0xbd8]
mov dword [ebp - 0xb9c], eax
mov dword [ebp - 0xb8c], edi
jne 0x414f06
mov esi, dword [ebp - 0xba8]
xor ebx, ebx
mov ecx, dword [ebp - 0xbd4]
mov eax, ebx
test esi, esi
je 0x4152b4
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0x4152ac
mov edi, dword [ebp - 0xbc8]
movzx eax, dl
cdq
cmp eax, dword [esi + edi]
jne 0x415318
cmp edx, dword [esi + edi + 4]
jne 0x415318
mov edi, ecx
mov dword [ebp - 0xbc4], esi
mov ecx, ebx
mov esi, ebx
jmp 0x41531f
mov dword [ebp - 0xb88], ebx
jae 0x414e99
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xb9c], eax
jmp 0x414e99
or dword [ebp - 0xb8c], 0xffffffff
mov dword [ebp - 0xbac], ebx
mov dword [ebp - 0xb88], ebx
mov dword [ebp - 0xb9c], eax
jmp 0x414e9f
mov esi, 0xc004d501
mov edi, ebx
test ecx, ecx
je 0x415332
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x415351
mov eax, dword [ebp - 0xbc4]
mov esi, 0x10000000
mov dword [ebp - 0xb7c], edi
mov edi, ebx
mov dword [ebp - 0xba0], eax
jmp 0x415356
mov esi, 0xd0000001
mov dword [ebp - 0xbdc], esi
test edi, edi
je 0x41536f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x4154cc
mov edx, dword [ebp - 0xba0]
cmp edx, 4
jae 0x41538c
mov esi, 0xc000003e
jmp 0x4154c0
mov esi, dword [ebp - 0xb7c]
mov eax, dword [esi]
lea ecx, [esi + 4]
mov dword [ebp - 0xbc4], eax
cmp ecx, esi
jb 0x4154bb
lea eax, [edx - 4]
cmp eax, 4
jb 0x415382
mov edi, dword [ecx]
lea esi, [ecx + 4]
cmp esi, ecx
jb 0x4154bb
mov ecx, dword [ebp - 0xba0]
lea eax, [ecx - 8]
cmp eax, edi
jb 0x415382
lea eax, [edi + 8]
cmp eax, 8
jb 0x4154bb
mov eax, dword [ebp - 0xb7c]
lea edx, [edi + esi]
add eax, ecx
cmp eax, edx
jb 0x415382
sub ecx, edi
sub ecx, esi
add ecx, dword [ebp - 0xb7c]
cmp ecx, 8
jae 0x415382
mov dword [ebp - 0xba8], ebx
mov eax, ebx
mov dword [ebp - 0xbc8], eax
test esi, esi
je 0x415448
mov ecx, esi
cmp edx, esi
jb 0x4154bb
jbe 0x415444
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x4154bb
cmp eax, edx
ja 0x41546d
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0x415474
add eax, ecx
cmp eax, ecx
jb 0x4154bb
mov ecx, eax
cmp ecx, edx
ja 0x41546d
inc dword [ebp - 0xba8]
cmp ecx, edx
jb 0x41540f
mov eax, ebx
cmp ecx, edx
jne 0x41546d
test edi, edi
je 0x41547b
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xbc8], eax
test eax, eax
jne 0x41547b
mov esi, 0xc0000017
jmp 0x4154a4
mov esi, 0xc000000d
jmp 0x4154c0
mov esi, 0xc0000095
jmp 0x4154a4
test esi, esi
je 0x415490
push edi
push esi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xbc8]
add esp, 0xc
mov dword [ebp - 0xd0c], eax
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xd14], eax
mov esi, ebx
test esi, esi
js 0x4154c0
mov eax, dword [ebp - 0xbc4]
cmp eax, dword [ebp - 0xd14]
je 0x4154c0
jmp 0x415382
mov esi, 0xc0000095
or esi, 0x10000000
mov dword [ebp - 0xbdc], esi
mov eax, dword [ebp - 0xbcc]
test eax, eax
je 0x4154e5
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xbec]
test edi, edi
je 0x41554c
cmp dword [edi + 4], 0
je 0x415509
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x415523
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x41553d
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xbb4]
test eax, eax
je 0x415565
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xbc0]
test eax, eax
je 0x41557e
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xb80]
test edi, edi
je 0x4155e5
cmp dword [edi + 4], 0
je 0x4155a2
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x4155bc
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x4155d6
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb7c]
test eax, eax
je 0x4155fe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x4137fd
xor eax, eax
inc eax
cmp dword [ebp - 0xd14], eax
jae 0x41561b
mov esi, 0xc004d501
jmp 0x4137f7
cmp dword [ebp - 0xd0c], 0
jne 0x415683
mov esi, 0xc000000d
mov dword [ebp - 0xbdc], esi
mov eax, ebx
test esi, esi
js 0x4137fd
cmp eax, 0xd0000023
jne 0x41564b
mov eax, 0x8007007a
mov dword [ebp - 0xbd0], eax
cmp eax, 0x8007007a
je 0x415662
mov esi, eax
mov dword [ebp - 0xbdc], esi
test eax, eax
js 0x4137fd
cmp dword [ebp - 0xd14], 6
jne 0x415611
cmp dword [ebp - 0xd0c], 0
jne 0x4156e5
mov esi, 0xc000000d
mov edi, 0xc0000095
jmp 0x415775
cmp dword [ebp - 0xd14], 0
jbe 0x415624
mov eax, dword [ebp - 0xd0c]
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x41569f
mov esi, ebx
jmp 0x4156a7
or ecx, 0xffffffff
mov esi, 0xc0000095
mov dword [ebp - 0xbdc], esi
test esi, esi
js 0x4156bb
mov eax, edx
neg eax
sbb eax, eax
and eax, ecx
jmp 0x4156c7
mov edx, dword [ebp - 0xc94]
mov eax, dword [ebp - 0xcc0]
test esi, esi
js 0x41562f
cmp edx, 4
jne 0x413a12
mov eax, dword [eax]
mov dword [ebp - 0xbd0], eax
jmp 0x415631
mov eax, dword [ebp - 0xd0c]
mov edx, ebx
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x41576e
lea eax, [esi + ecx]
cmp eax, ecx
jb 0x41576e
inc edx
cmp edx, 1
jb 0x4156ed
mov edi, dword [eax]
lea edx, [eax + 4]
cmp edx, eax
jb 0x415714
mov dword [ebp - 0xbc4], edx
jmp 0x41571b
or dword [ebp - 0xbc4], 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xbdc], esi
cmp edx, eax
jb 0x41573d
mov ecx, edi
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xbc4]
jmp 0x415749
mov edi, dword [ebp - 0xc74]
mov ecx, dword [ebp - 0xc78]
cmp edx, eax
jb 0x415767
cmp edi, 8
jne 0x413a12
mov eax, dword [ecx]
mov dword [ebp - 0xce8], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0xce4], eax
mov edi, 0xc0000095
jmp 0x41577b
mov edi, 0xc0000095
mov esi, edi
mov dword [ebp - 0xbdc], esi
test esi, esi
js 0x4137fd
cmp dword [ebp - 0xd0c], 0
jne 0x415793
mov esi, 0xc000000d
jmp 0x41580a
mov eax, dword [ebp - 0xd0c]
mov edx, ebx
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x415808
lea eax, [esi + ecx]
cmp eax, ecx
jb 0x415808
inc edx
cmp edx, 2
jb 0x41579b
mov edi, dword [eax]
lea edx, [eax + 4]
cmp edx, eax
jb 0x4157c2
mov dword [ebp - 0xbc4], edx
jmp 0x4157c9
or dword [ebp - 0xbc4], 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xbdc], esi
cmp edx, eax
jb 0x4157eb
mov ecx, edi
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xbc4]
jmp 0x4157f7
mov edi, dword [ebp - 0xcb4]
mov ecx, dword [ebp - 0xcb8]
cmp edx, eax
jb 0x415810
cmp edi, 4
jne 0x413a12
mov eax, dword [ecx]
jmp 0x415816
mov esi, edi
mov dword [ebp - 0xbdc], esi
mov eax, dword [ebp - 0xcb0]
mov dword [ebp - 0xbc4], eax
test esi, esi
js 0x4137fd
cmp dword [ebp - 0xd0c], 0
jne 0x415837
mov esi, 0xc000000d
jmp 0x4137f7
mov eax, dword [ebp - 0xd0c]
mov edx, ebx
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x413be5
lea eax, [esi + ecx]
cmp eax, ecx
jb 0x413be5
inc edx
cmp edx, 3
jb 0x41583f
mov edi, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xbc8], edi
cmp ecx, eax
jb 0x415870
mov edx, ecx
jmp 0x415873
or edx, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xbdc], esi
cmp ecx, eax
jb 0x41588f
neg edi
sbb edi, edi
and edi, edx
jmp 0x4158a1
mov edx, dword [ebp - 0xc6c]
mov edi, dword [ebp - 0xc68]
mov dword [ebp - 0xbc8], edx
cmp ecx, eax
jb 0x4137fd
mov eax, dword [ebp - 0xd0c]
mov edx, ebx
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x415932
lea eax, [esi + ecx]
cmp eax, ecx
jb 0x415932
inc edx
cmp edx, 4
jb 0x4158b1
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xba8], ecx
cmp edx, eax
jb 0x4158de
mov dword [ebp - 0xbd4], edx
jmp 0x4158e5
or dword [ebp - 0xbd4], 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xbdc], esi
cmp edx, eax
jb 0x415905
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xbd4]
jmp 0x415917
mov ecx, dword [ebp - 0xc64]
mov dword [ebp - 0xba8], ecx
mov ecx, dword [ebp - 0xc60]
cmp edx, eax
jb 0x41593d
cmp dword [ebp - 0xba8], 4
jne 0x413a12
mov eax, dword [ecx]
mov dword [ebp - 0xc5c], eax
jmp 0x41593d
mov esi, 0xc0000095
mov dword [ebp - 0xbdc], esi
test esi, esi
js 0x4137fd
mov eax, dword [ebp - 0xd0c]
mov edx, ebx
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x4159c8
lea eax, [esi + ecx]
cmp eax, ecx
jb 0x4159c8
inc edx
cmp edx, 5
jb 0x41594d
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xba8], ecx
cmp edx, eax
jb 0x41597a
mov dword [ebp - 0xbd4], edx
jmp 0x415981
or dword [ebp - 0xbd4], 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xbdc], esi
cmp edx, eax
jb 0x4159a1
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xbd4]
jmp 0x4159b3
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0xba8], ecx
mov ecx, dword [ebp - 0xc44]
cmp edx, eax
jb 0x4159d3
cmp dword [ebp - 0xba8], 4
jne 0x413a12
mov ecx, dword [ecx]
jmp 0x4159d5
mov esi, 0xc0000095
mov dword [ebp - 0xbdc], esi
mov ecx, ebx
test esi, esi
js 0x4137fd
mov eax, dword [ebp - 0xbf4]
cmp eax, dword [ebp - 0xce8]
jne 0x415611
mov eax, dword [ebp - 0xbf0]
cmp eax, dword [ebp - 0xce4]
jne 0x415611
cmp dword [ebp - 0xc5c], 4
mov dword [ebp - 0xc00], ecx
jbe 0x415a2c
mov eax, dword [ebp - 0xbc4]
mov esi, 0x8007007a
mov dword [ebp - 0xbdc], esi
mov dword [ebp - 0xc08], eax
jmp 0x4137fd
mov eax, dword [ebp - 0xbc8]
cmp eax, 4
ja 0x415a10
push eax
push edi
push dword [ebp - 0xb98]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xbc4]
add esp, 0xc
mov dword [ebp - 0xc08], eax
test esi, esi
js 0x4137fd
mov eax, dword [ebp - 0xbd0]
mov edi, dword [ebp - 0xbe0]
test eax, eax
je 0x413803
mov esi, eax
jmp 0x4137a0
mov esi, dword [0x42404c]
mov ecx, esi
call dword [0x426478]
call esi
mov dword [0x425e18], eax
lea edi, [ebp - 0x40c]
mov eax, dword [0x425920]
mov dword [ebp - 0xbc8], eax
xor eax, eax
stosd dword es:[edi], eax
push 0x2c
push ebx
mov dword [0x425e1c], edx
stosd dword es:[edi], eax
mov dword [ebp - 0xcf0], ebx
mov dword [ebp - 0xcec], ebx
mov dword [ebp - 0xba8], ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x5a0]
push eax
mov dword [ebp - 0xbd4], ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0xbd8], ebx
xor ebx, ebx
mov edx, 0x425e28
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x415ade
mov eax, dword [0x425e24]
push 0
pop ebx
test eax, eax
jne 0x416117
push 0x338
push ebx
mov dword [ebp - 0xb94], ebx
mov dword [ebp - 0xb8c], ebx
mov dword [ebp - 0xbac], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb9c], eax
test eax, eax
je 0x4160b1
or dword [ebp - 0xba4], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x398], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xb88], ebx
mov edi, 0x402c4a
mov dword [ebp - 0x394], edx
mov cl, bl
mov dword [ebp - 0xbb0], eax
mov esi, ebx
mov dword [ebp - 0xb84], edi
mov edx, ebx
mov dword [ebp - 0xba0], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xb84]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb84]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb84]
shl edi, 8
add dword [ebp - 0xb84], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0xb7c], esi
add eax, 0x54969fa2
rol dword [ebp - 0xb7c], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0xb7c]
xor edx, eax
mov dword [ebp - 0xb80], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb80]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xb80]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xb80], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb80]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xb80]
xor edx, eax
mov dword [ebp - 0xb80], edx
mov eax, dword [ebp - 0xb80]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xb80]
xor eax, edx
mov dword [ebp - 0xb80], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb80]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xb80]
xor eax, edx
mov dword [ebp - 0xb80], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb80]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xb80]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0xb80], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0xb80]
xor eax, 0xab69605e
mov dword [ebp - 0xb7c], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb7c]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xb7c]
xor eax, edx
mov dword [ebp - 0xb7c], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xb7c], edx
mov edx, dword [ebp - 0xb7c]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xb7c], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb7c]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xb7c]
xor eax, edx
mov dword [ebp - 0xb7c], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb7c]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xb7c]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xb7c], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb7c]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xb7c]
xor edx, dword [ebp - 0xb88]
xor eax, dword [ebp - 0xba4]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xb80], esi
mov esi, dword [ebp - 0xbb0]
mov dword [ebp - 0xba4], edi
mov edi, dword [ebp - 0xb84]
mov dword [ebp - 0xb88], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xba0], 1
mov dword [ebp - 0xbb0], esi
mov esi, eax
mov dword [ebp - 0xb7c], eax
jne 0x415b75
mov esi, dword [ebp - 0xb9c]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x415efc
movzx eax, cl
cdq
cmp eax, dword [0x402f80]
jne 0x415f2a
cmp edx, dword [0x402f84]
jne 0x415f2a
mov dword [ebp - 0xb8c], esi
mov edi, 0x337
mov esi, ebx
jmp 0x415f37
mov dword [ebp - 0xbac], 0xc004d501
or edi, 0xffffffff
test esi, esi
je 0x415f4a
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xbac], ebx
jl 0x4160b1
mov eax, dword [ebp - 0xb8c]
mov esi, eax
push 0x40
push ebx
push 0x425930
mov byte [edi + eax], bl
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov eax, esi
add esp, 0xc
cmp byte [eax], bl
je 0x4160b8
mov edi, 0x425930
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xbac], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x415f8d
sub ecx, dword [ebp - 0xbac]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x4160b1
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xbac], ecx
cmp word [eax], dx
je 0x415fd5
mov ecx, 0xc000007b
mov dword [ebp - 0xbac], ecx
jmp 0x41601d
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x415fc8
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x415fc8
cmp dword [edx], 0x4550
jne 0x415fc8
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xcd0]
je 0x41600b
cmp ax, word [ebp - 0xcc4]
je 0x41600b
mov ecx, 0xc000000d
jmp 0x415fcd
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb9c], eax
mov dword [ebp - 0xb88], ebx
test eax, eax
je 0x416098
mov edx, esi
mov dword [ebp - 0xba4], esi
lea eax, [edx + 1]
mov dword [ebp - 0xbb0], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x416044
sub edx, dword [ebp - 0xbb0]
inc esi
add esi, edx
test ecx, ecx
js 0x41607d
push dword [ebp - 0xba4]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4160a3
mov ecx, dword [ebp - 0xb94]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xbac]
mov eax, dword [ebp - 0xb88]
inc dword [ebp - 0xb94]
inc eax
mov dword [ebp - 0xb88], eax
cmp eax, dword [ebp - 0xb9c]
jb 0x416033
add edi, 0x10
cmp byte [esi], bl
jne 0x415f80
mov esi, dword [ebp - 0xbac]
mov eax, dword [ebp - 0xb8c]
jmp 0x4160ba
mov esi, 0xc000007a
jmp 0x4160a9
mov esi, ebx
test eax, eax
je 0x4160d2
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push dword [ebp - 0xb8c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x416112
mov esi, ebx
mov eax, dword [esi + 0x425930]
test eax, eax
je 0x4160e9
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x4160d8
push 0x40
push ebx
push 0x425930
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x401090
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x41611d
mov eax, dword [0x425e24]
inc eax
mov dword [0x425e24], eax
xor eax, eax
mov edx, 0x425e28
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0xb94], ebx
lea edi, [ebp - 0x420]
mov dword [ebp - 0xb8c], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xc50], ebx
mov dword [ebp - 0xbac], ebx
mov dword [ebp - 0xb9c], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xb88], ebx
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x416158
mov eax, dword [0x425e24]
push 0
pop ebx
test eax, eax
jne 0x416791
push 0x338
push ebx
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xbb0], ebx
mov dword [ebp - 0xb84], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xba0], eax
test eax, eax
je 0x41672b
or dword [ebp - 0xb80], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x3d0], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xb7c], ebx
mov edi, 0x402c4a
mov dword [ebp - 0x3cc], edx
mov cl, bl
mov dword [ebp - 0xb90], eax
mov esi, ebx
mov dword [ebp - 0xbc0], edi
mov edx, ebx
mov dword [ebp - 0xbb8], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xbc0]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xbc0]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xbc0]
shl edi, 8
add dword [ebp - 0xbc0], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0xbb4], esi
add eax, 0x54969fa2
rol dword [ebp - 0xbb4], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0xbb4]
xor edx, eax
mov dword [ebp - 0xb98], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb98]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xb98]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xb98], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb98]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xb98]
xor edx, eax
mov dword [ebp - 0xb98], edx
mov eax, dword [ebp - 0xb98]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xb98]
xor eax, edx
mov dword [ebp - 0xb98], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb98]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xb98]
xor eax, edx
mov dword [ebp - 0xb98], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb98]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xb98]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0xb98], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0xb98]
xor eax, 0xab69605e
mov dword [ebp - 0xbb4], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xbb4]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xbb4]
xor eax, edx
mov dword [ebp - 0xbb4], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xbb4], edx
mov edx, dword [ebp - 0xbb4]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xbb4], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xbb4]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xbb4]
xor eax, edx
mov dword [ebp - 0xbb4], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xbb4]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xbb4]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xbb4], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xbb4]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xbb4]
xor edx, dword [ebp - 0xb7c]
xor eax, dword [ebp - 0xb80]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xb98], esi
mov esi, dword [ebp - 0xb90]
mov dword [ebp - 0xb80], edi
mov edi, dword [ebp - 0xbc0]
mov dword [ebp - 0xb7c], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xbb8], 1
mov dword [ebp - 0xb90], esi
mov esi, eax
mov dword [ebp - 0xbb4], eax
jne 0x4161ef
mov esi, dword [ebp - 0xba0]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x416576
movzx eax, cl
cdq
cmp eax, dword [0x402f80]
jne 0x4165a4
cmp edx, dword [0x402f84]
jne 0x4165a4
mov dword [ebp - 0xbb0], esi
mov edi, 0x337
mov esi, ebx
jmp 0x4165b1
mov dword [ebp - 0xb84], 0xc004d501
or edi, 0xffffffff
test esi, esi
je 0x4165c4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xb84], ebx
jl 0x41672b
mov eax, dword [ebp - 0xbb0]
mov esi, eax
push 0x40
push ebx
push 0x425930
mov byte [edi + eax], bl
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov eax, esi
add esp, 0xc
cmp byte [eax], bl
je 0x416732
mov edi, 0x425930
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb84], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x416607
sub ecx, dword [ebp - 0xb84]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x41672b
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xb84], edx
cmp word [eax], cx
je 0x41664f
mov edx, 0xc000007b
mov dword [ebp - 0xb84], edx
jmp 0x416697
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0x416642
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0x416642
cmp dword [ecx], 0x4550
jne 0x416642
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xcd0]
je 0x416685
cmp ax, word [ebp - 0xcc4]
je 0x416685
mov edx, 0xc000000d
jmp 0x416647
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0xb7c], ebx
test eax, eax
je 0x416712
mov ecx, esi
mov dword [ebp - 0xb80], esi
lea eax, [ecx + 1]
mov dword [ebp - 0xb90], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4166be
sub ecx, dword [ebp - 0xb90]
inc esi
add esi, ecx
test edx, edx
js 0x4166f7
push dword [ebp - 0xb80]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41671d
mov ecx, dword [ebp - 0xba4]
mov edx, dword [ebp - 0xb84]
mov dword [ecx*4 + section..data], eax
mov eax, dword [ebp - 0xb7c]
inc dword [ebp - 0xba4]
inc eax
mov dword [ebp - 0xb7c], eax
cmp eax, dword [ebp - 0xba0]
jb 0x4166ad
add edi, 0x10
cmp byte [esi], bl
jne 0x4165fa
mov esi, dword [ebp - 0xb84]
mov eax, dword [ebp - 0xbb0]
jmp 0x416734
mov esi, 0xc000007a
jmp 0x416723
mov esi, ebx
test eax, eax
je 0x41674c
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push dword [ebp - 0xbb0]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x41678c
mov esi, ebx
mov eax, dword [esi + 0x425930]
test eax, eax
je 0x416763
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x416752
push 0x40
push ebx
push 0x425930
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x401090
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x416797
mov eax, dword [0x425e24]
inc eax
mov dword [0x425e24], eax
xor eax, eax
mov ecx, 0x425e28
xchg dword [ecx], eax
push 0x54
lea eax, [ebp - 0x910]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov esi, dword [0x42407c]
lea edi, [ebp - 0x410]
add esp, 0xc
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
pop edx
push 0x403
push ebx
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xbc8]
mov ecx, eax
and ecx, edx
mov dword [ebp - 0xbc8], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
and ecx, edx
shr eax, 0xc
mov word [ebp - 0xa], cx
and eax, edx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0x426478]
call esi
mov dword [ebp - 0xba4], eax
mov dword [ebp - 0xbb0], 0xffffff
test eax, eax
jne 0x416853
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb84], edi
test edi, edi
jle 0x41683e
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb84], edi
test edi, edi
js 0x417e39
mov dword [ebp - 0xb84], 0x80004005
jmp 0x417e39
mov esi, dword [0x424050]
lea eax, [ebp - 0xc24]
push eax
push ebx
lea eax, [ebp - 0xbe8]
mov dword [ebp - 0xc10], ebx
push eax
mov edi, ebx
mov dword [ebp - 0xc14], ebx
push 8
mov ecx, esi
mov dword [ebp - 0xba0], ebx
mov dword [ebp - 0xc18], ebx
mov dword [ebp - 0xc1c], ebx
mov dword [ebp - 0xc20], ebx
mov dword [ebp - 0xb84], edi
mov dword [ebp - 0xc24], ebx
call dword [0x426478]
call esi
test eax, eax
jne 0x4168e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb84], edi
test edi, edi
jle 0x4168cd
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb84], edi
test edi, edi
js 0x416a2f
mov edi, 0x80004005
mov dword [ebp - 0xb84], edi
jmp 0x416a2f
mov eax, dword [ebp - 0xc24]
add eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xc1c]
mov esi, eax
call fcn.0041ef64
test esi, esi
jne 0x416918
mov dword [ebp - 0xc1c], ebx
mov edi, 0x8007000e
jmp 0x4168d8
mov eax, dword [ebp - 0xbe8]
mov dword [ebp - 0xc1c], esi
lea eax, [eax*4 + 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xc20]
mov esi, eax
call fcn.0041ef64
test esi, esi
jne 0x41695b
mov edi, 0x8007000e
mov dword [ebp - 0xb84], edi
jmp 0x416a29
lea eax, [ebp - 0xc24]
mov dword [ebp - 0xc20], esi
mov esi, dword [0x424050]
mov ecx, esi
push eax
push dword [ebp - 0xc1c]
lea eax, [ebp - 0xbe8]
push eax
push 8
call dword [0x426478]
call esi
test eax, eax
je 0x4168aa
cmp dword [ebp - 0xbe8], 0
mov edx, dword [ebp - 0xc20]
mov eax, dword [ebp - 0xc1c]
mov dword [ebp - 0xb80], edx
mov dword [ebp - 0xb90], ebx
jbe 0x416a0a
mov edi, eax
mov esi, dword [0x424058]
mov ecx, esi
push ebx
push edi
call dword [0x426478]
call esi
mov edx, dword [ebp - 0xb80]
mov ecx, edi
mov dword [edx], eax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4169d1
mov eax, dword [ebp - 0xb90]
sub ecx, esi
sar ecx, 1
add edx, 4
mov dword [ebp - 0xb80], edx
lea edi, [edi + ecx*2]
add edi, 2
inc eax
mov dword [ebp - 0xb90], eax
cmp eax, dword [ebp - 0xbe8]
jb 0x4169b2
mov edi, dword [ebp - 0xb84]
mov dword [edx], 0x409
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0xc10], eax
mov eax, dword [ebp - 0xbe8]
inc eax
mov dword [ebp - 0xb7c], eax
mov dword [ebp - 0xc20], ebx
lea ecx, [ebp - 0xc20]
call fcn.0041ef64
lea ecx, [ebp - 0xc1c]
call fcn.0041ef64
test edi, edi
js 0x41719f
cmp dword [ebp - 0xb7c], 0
mov edi, ebx
mov dword [ebp - 0xb80], edi
mov esi, ebx
jbe 0x416a8d
mov eax, dword [ebp - 0xc10]
mov edx, ebx
mov ecx, dword [eax + esi*4]
cmp ecx, dword [edx*4 + 0x402850]
je 0x416a85
inc edx
cmp edx, 0x26
jb 0x416a68
inc esi
cmp esi, dword [ebp - 0xb7c]
jb 0x416a66
jmp 0x416a8d
mov edi, edx
mov dword [ebp - 0xb80], edx
mov esi, dword [0x424054]
lea eax, [ebp - 0x100]
push ebx
push 0x55
push eax
push dword [edi*4 + 0x402850]
mov ecx, esi
mov dword [ebp - 0xb7c], ebx
call dword [0x426478]
call esi
test eax, eax
je 0x416af2
mov esi, dword [0x424048]
lea eax, [ebp - 0x4a0]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0x100]
mov ecx, esi
push eax
call dword [0x426478]
call esi
test eax, eax
jle 0x416af2
mov edi, dword [ebp - 0x494]
xor eax, eax
shr edi, 0x1b
inc eax
and edi, eax
mov dword [ebp - 0xb7c], edi
mov edx, 0x402968
mov esi, ebx
mov ecx, edx
mov dword [ebp + esi*4 - 0x390], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x416b05
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0x416af9
imul ecx, dword [ebp - 0xb80], 3
movzx eax, byte [ecx + 0x4028e8]
mov eax, dword [ebp + eax*4 - 0x390]
mov dword [ebp - 0xbac], eax
movzx eax, byte [ecx + 0x4028e9]
mov eax, dword [ebp + eax*4 - 0x390]
mov dword [ebp - 0xb9c], eax
movzx eax, byte [ecx + 0x4028ea]
mov eax, dword [ebp + eax*4 - 0x390]
mov dword [ebp - 0xb88], eax
push 0x1c90
mov eax, ebx
push ebx
mov dword [ebp - 0xb84], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb90], ecx
test ecx, ecx
jne 0x416b94
mov edi, 0x8007000e
jmp 0x417199
or dword [ebp - 0xbb8], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x3b0], edx
add ecx, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xbc0], ebx
mov dword [ebp - 0x3ac], edx
mov al, bl
mov dword [ebp - 0xbb4], ebx
mov edx, ebx
mov dword [ebp - 0xb98], ecx
mov esi, 0x402f8a
mov dword [ebp - 0xbbc], 0x392
movzx ebx, byte [esi - 2]
movzx ecx, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, ecx
shl edi, 8
movzx ecx, byte [esi]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 3]
or edi, ecx
xor edx, ebx
movzx ecx, byte [esi + 4]
shl edi, 8
or edi, ecx
mov dword [ebp - 0xbd0], edx
movzx ecx, byte [esi + 5]
add esi, 8
mov dword [ebp - 0xbcc], esi
shl edi, 8
or edi, ecx
mov esi, edi
xor esi, dword [ebp - 0xbb4]
xor esi, edx
xor esi, 0xac987321
lea ecx, [esi + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, esi
rol ecx, 0xa
add edx, ecx
mov ecx, dword [ebp - 0xbd0]
xor ecx, edx
mov dword [ebp - 0xbd0], ecx
add ecx, 0x7f1137f
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0xbd0]
rol ecx, 2
sub edx, ecx
xor esi, edx
imul edx, esi, 0x605e
mov ecx, esi
shr ecx, 0xd
sub edx, ecx
mov ecx, dword [ebp - 0xbd0]
sub edx, 0x756c8a2
xor ecx, edx
mov dword [ebp - 0xbd0], ecx
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0xbd0]
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub ecx, edx
mov edx, dword [ebp - 0xbd0]
xor edx, ecx
mov dword [ebp - 0xbd0], edx
mov ecx, dword [ebp - 0xbd0]
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor esi, edx
lea ecx, [esi + 0x7f1137f]
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, esi
rol ecx, 2
add edx, ecx
mov ecx, dword [ebp - 0xbd0]
xor ecx, edx
mov dword [ebp - 0xbd0], ecx
add ecx, 0x54969fa2
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0xbd0]
rol ecx, 8
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69605e
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, esi
ror ecx, 0xa
xor edx, ecx
mov ecx, dword [ebp - 0xbd0]
xor ecx, edx
mov dword [ebp - 0xbd0], ecx
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0xbd0]
shr ecx, 0xa
xor edx, ecx
xor edx, esi
mov esi, dword [ebp - 0xbd0]
mov ecx, edx
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor esi, ecx
lea ecx, [esi - 0x7f1]
xor ecx, edx
xor ecx, 0xab69605e
mov dword [ebp - 0xbb4], ecx
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0xbb4]
shr ecx, 2
add edx, ecx
xor esi, edx
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, esi
rol ecx, 7
add edx, ecx
mov ecx, dword [ebp - 0xbb4]
xor ecx, edx
mov dword [ebp - 0xbb4], ecx
mov edx, ecx
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor esi, edx
mov ecx, esi
mov edx, esi
xor ecx, 0xab69
rol esi, 7
rol ecx, 5
imul ecx, ecx, 0x7f1
add ecx, esi
mov esi, dword [ebp - 0xbb4]
xor esi, ecx
mov dword [ebp - 0xbb4], esi
xor esi, edx
mov edx, dword [ebp - 0xbb4]
xor esi, 0xac987321
mov ecx, esi
ror ecx, 3
imul ecx, ecx, 0x137f
sub ecx, 0xd0dd417
xor edx, ecx
mov dword [ebp - 0xbb4], edx
lea ecx, [edx - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0xbb4]
ror ecx, 6
sub edx, ecx
xor esi, edx
lea ecx, [esi - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, esi
rol ecx, 0xe
add edx, ecx
mov ecx, dword [ebp - 0xbb4]
xor ecx, edx
mov dword [ebp - 0xbb4], ecx
add ecx, 0xab69605e
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0xbb4]
ror ecx, 0xe
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, esi
shr ecx, 3
xor edx, ecx
mov ecx, dword [ebp - 0xbb4]
xor ecx, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xbb4], ecx
xor ecx, edx
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0xbb4]
rol ecx, 2
xor edx, ecx
mov ecx, dword [ebp - 0xbb4]
xor edx, dword [ebp - 0xbc0]
xor ecx, dword [ebp - 0xbb8]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xbd0], esi
mov esi, dword [ebp - 0xb98]
mov dword [ebp - 0xbc0], ebx
mov dword [ebp - 0xbb8], edi
mov byte [esi - 4], dl
mov byte [esi], cl
ror edx, 8
mov byte [esi - 5], dl
ror ecx, 8
mov byte [esi - 1], cl
ror edx, 8
mov byte [esi - 6], dl
ror ecx, 8
mov byte [esi - 2], cl
ror edx, 8
ror ecx, 8
mov byte [esi - 7], dl
mov byte [esi - 3], cl
add esi, 8
ror ecx, 8
ror edx, 8
sub dword [ebp - 0xbbc], 1
mov dword [ebp - 0xb98], esi
mov esi, dword [ebp - 0xbcc]
mov dword [ebp - 0xbb4], ecx
jne 0x416bd9
mov ecx, dword [ebp - 0xb90]
xor ebx, ebx
mov edx, ebx
mov esi, 0x1c90
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0x416f61
movzx eax, al
cdq
cmp eax, dword [0x404c18]
jne 0x416f93
cmp edx, dword [0x404c1c]
jne 0x416f93
mov edi, dword [ebp - 0xb84]
mov dword [ebp - 0xc14], ecx
mov ecx, ebx
mov dword [ebp - 0xba0], esi
jmp 0x416f9e
mov edi, 0xc004d501
mov dword [ebp - 0xb84], edi
test ecx, ecx
je 0x416fb1
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
js 0x41719f
mov edi, dword [ebp - 0xc14]
mov esi, ebx
mov edx, ebx
mov ebx, dword [ebp - 0xb80]
cmp ebx, edx
jne 0x416fd4
mov dword [ebp + esi*4 - 0x320], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0xb90], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416fdf
sub ecx, dword [ebp - 0xb90]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0x416fc9
inc esi
push 0
pop ebx
cmp esi, 6
jb 0x416fc1
push 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xc18]
mov edi, eax
call fcn.0041ef64
test edi, edi
jne 0x41702a
mov dword [ebp - 0xc18], ebx
jmp 0x416b8a
mov dword [ebp - 0xc18], edi
lea ecx, [ebp - 0xc]
xor eax, eax
mov dword [ebp - 0xb80], ecx
stosd dword es:[edi], eax
mov esi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
movzx edx, word [ecx]
mov eax, ebx
cmp dx, word [eax*2 + 0x40295c]
je 0x41705a
inc eax
cmp eax, 6
jb 0x417045
jmp 0x417134
mov edi, dword [ebp + eax*4 - 0x320]
mov ecx, edi
mov edx, dword [0x424060]
mov dword [ebp - 0xb90], edx
lea eax, [ecx + 1]
mov dword [ebp - 0xbc0], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417078
sub ecx, dword [ebp - 0xbc0]
push ebx
push ebx
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
push ebx
push 0xfde9
call dword [0x426478]
call dword [ebp - 0xb90]
mov dword [ebp - 0xb90], eax
test eax, eax
je 0x41716f
lea ecx, [eax + eax]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0xc18]
mov dword [ecx + esi], eax
mov eax, dword [ebp - 0xc18]
cmp dword [eax + esi], ebx
je 0x416b8a
mov eax, dword [eax + esi]
mov ecx, edi
mov edx, dword [0x424060]
mov dword [ebp - 0xbb8], eax
mov dword [ebp - 0xbc0], edx
lea eax, [ecx + 1]
mov dword [ebp - 0xbb4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4170f8
push dword [ebp - 0xb90]
sub ecx, dword [ebp - 0xbb4]
push dword [ebp - 0xbb8]
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
push ebx
push 0xfde9
call dword [0x426478]
call dword [ebp - 0xbc0]
test eax, eax
je 0x41716f
mov ecx, dword [ebp - 0xb80]
add ecx, 2
add esi, 4
mov dword [ebp - 0xb80], ecx
cmp esi, 0xc
jb 0x417040
mov eax, dword [ebp - 0xc18]
mov edi, dword [ebp - 0xb84]
mov dword [ebp - 0xc50], eax
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xc18], ebx
mov dword [ebp - 0x910], eax
jmp 0x41719f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb84], edi
test edi, edi
jle 0x417192
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb84], edi
test edi, edi
js 0x41719f
mov edi, 0x80004005
mov dword [ebp - 0xb84], edi
cmp dword [ebp - 0xc18], 0
je 0x417205
mov esi, ebx
mov eax, dword [ebp - 0xc18]
cmp dword [eax + esi], ebx
je 0x4171fd
mov ecx, dword [eax + esi]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4171bb
mov eax, dword [ebp - 0xc18]
sub ecx, edx
sar ecx, 1
mov eax, dword [eax + esi]
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x4171e6
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x4171de
mov eax, dword [ebp - 0xc18]
push dword [eax + esi]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esi, 4
cmp esi, 0xc
jb 0x4171aa
mov eax, dword [ebp - 0xc14]
test eax, eax
je 0x417221
mov ecx, dword [ebp - 0xba0]
test ecx, ecx
je 0x417221
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x417219
lea ecx, [ebp - 0xc18]
call fcn.0041ef64
lea ecx, [ebp - 0xc14]
call fcn.0041ef64
lea ecx, [ebp - 0xc10]
call fcn.0041ef64
test edi, edi
js 0x417e22
mov eax, dword [ebp - 0xc50]
mov edi, ebx
mov esi, dword [0x4240b4]
push ebx
mov dword [ebp - 0xb84], edi
mov ecx, dword [eax]
mov dword [ebp - 0x908], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x904], ecx
mov ecx, esi
mov eax, dword [eax + 8]
mov dword [ebp - 0x900], eax
lea eax, [ebp - 0xd08]
push eax
push ebx
push 0x42
mov dword [ebp - 0xd04], ebx
mov dword [ebp - 0xd00], ebx
mov dword [ebp - 0xd08], 0xc
call dword [0x426478]
call esi
test eax, eax
jne 0x4172db
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb84], edi
test edi, edi
jle 0x4172ca
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb84], edi
test edi, edi
mov eax, ebx
js 0x4172e4
mov edi, 0x80004005
mov dword [ebp - 0xb84], edi
jmp 0x4172e4
mov eax, dword [ebp - 0xd04]
and eax, 1
mov dword [ebp - 0x90c], eax
test edi, edi
js 0x417e22
mov eax, dword [ebp - 0xbc8]
push 0x2a
pop ecx
mov dword [ebp - 0xba0], ecx
sub eax, 1
je 0x41732f
sub eax, 1
je 0x417323
sub eax, 1
jne 0x41733f
mov edi, 0xe1
mov dword [ebp - 0xb94], edi
mov dword [ebp - 0xb8c], edi
jmp 0x41733f
mov dword [ebp - 0xb94], 0xf
jmp 0x417335
mov dword [ebp - 0xb94], ecx
mov dword [ebp - 0xb8c], 0xb
mov esi, 0xdc
mov dword [ebp - 0xb7c], 0x60
push esi
lea eax, [ebp - 0x7f8]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov word [ebp - 0x7b4], si
mov esi, dword [0x424070]
lea eax, [ebp - 0x7f8]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0x426478]
call esi
test eax, eax
je 0x4173c4
mov eax, dword [ebp - 0x74c]
movzx edi, word [ebp - 0x752]
mov ecx, dword [ebp - 0x748]
push 0x60
mov dword [ebp - 0xb80], eax
mov dword [ebp - 0x418], eax
pop eax
mov dword [ebp - 0xb7c], edi
mov dword [ebp - 0xb90], ecx
mov dword [ebp - 0x414], ecx
cmp edi, eax
jae 0x4173dc
mov dword [ebp - 0xb7c], eax
jmp 0x4173dc
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0xb90], eax
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0xb80], eax
xor eax, eax
inc eax
cmp dword [ebp - 0xbc8], eax
mov eax, dword [ebp - 0xbac]
je 0x4173f3
mov eax, dword [ebp - 0xb88]
push 0x5c
mov dword [ebp - 0xbc0], eax
lea eax, [ebp - 0x718]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov esi, dword [0x42407c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xb84], edi
push 0x403
push ebx
push ebx
call dword [0x426478]
call esi
mov dword [ebp - 0xbb8], eax
test eax, eax
jne 0x41746c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb84], edi
test edi, edi
jle 0x417457
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb84], edi
test edi, edi
js 0x417523
mov dword [ebp - 0xb84], 0x80004005
jmp 0x417e22
mov esi, dword [0x42405c]
mov ecx, esi
push 0x48
push dword [ebp - 0xb7c]
push dword [ebp - 0xb94]
call dword [0x426478]
call esi
push dword [ebp - 0xbc0]
neg eax
mov dword [ebp - 0x708], 0x190
push 0x20
mov dword [ebp - 0x718], eax
lea ecx, [ebp - 0x6fc]
pop eax
mov edx, eax
mov byte [ebp - 0x6fe], 5
call fcn.00406454
mov esi, dword [0x424010]
lea eax, [ebp - 0x718]
push eax
mov ecx, esi
call dword [0x426478]
call esi
test eax, eax
jne 0x417506
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb84], edi
test edi, edi
jle 0x4174f7
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb84], edi
test edi, edi
js 0x41750c
mov edi, 0x80004005
mov dword [ebp - 0xb84], edi
jmp 0x41750c
mov dword [ebp - 0x8fc], eax
push dword [ebp - 0xbb8]
mov esi, dword [0x4240b0]
mov ecx, esi
push ebx
call dword [0x426478]
call esi
test edi, edi
js 0x417e22
xor eax, eax
inc eax
cmp dword [ebp - 0xbc8], eax
je 0x417542
mov eax, dword [ebp - 0xb88]
mov dword [ebp - 0xbac], eax
push 0x5c
lea eax, [ebp - 0x6b8]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov esi, dword [0x42407c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xb84], edi
push 0x403
push ebx
push ebx
call dword [0x426478]
call esi
mov dword [ebp - 0xb94], eax
test eax, eax
jne 0x4175ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb84], edi
test edi, edi
jle 0x4175a0
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb84], edi
test edi, edi
js 0x417662
jmp 0x41745d
mov esi, dword [0x42405c]
mov ecx, esi
push 0x48
push dword [ebp - 0xb7c]
push dword [ebp - 0xb8c]
call dword [0x426478]
call esi
push dword [ebp - 0xbac]
neg eax
mov dword [ebp - 0x6a8], 0x190
push 0x20
mov dword [ebp - 0x6b8], eax
lea ecx, [ebp - 0x69c]
pop eax
mov edx, eax
mov byte [ebp - 0x69e], 5
call fcn.00406454
mov esi, dword [0x424010]
lea eax, [ebp - 0x6b8]
push eax
mov ecx, esi
call dword [0x426478]
call esi
test eax, eax
jne 0x417645
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb84], edi
test edi, edi
jle 0x417636
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb84], edi
test edi, edi
js 0x41764b
mov edi, 0x80004005
mov dword [ebp - 0xb84], edi
jmp 0x41764b
mov dword [ebp - 0x8f8], eax
push dword [ebp - 0xb94]
mov esi, dword [0x4240b0]
mov ecx, esi
push ebx
call dword [0x426478]
call esi
test edi, edi
js 0x417e22
mov esi, dword [ebp - 0xbc8]
mov ecx, ebx
mov eax, esi
mov edx, ebx
sub eax, 1
je 0x417685
sub eax, 1
je 0x4176c3
sub eax, 1
jne 0x417691
mov ecx, dword [ebp - 0xb80]
mov edx, dword [ebp - 0xb90]
mov dword [ebp - 0x408], ecx
mov dword [ebp - 0x404], edx
xor edx, edx
inc edx
cmp esi, edx
je 0x417703
lea eax, [esi - 2]
cmp eax, edx
ja 0x4176d7
mov edx, ebx
mov dword [ebp - 0xba0], ebx
mov eax, ebx
mov dword [ebp - 0xb8c], edx
mov dword [ebp - 0xbac], ebx
jmp 0x41771a
mov eax, dword [ebp - 0xb80]
cdq
and edx, 3
lea ecx, [edx + eax]
mov edx, ebx
sar ecx, 2
jmp 0x417691
mov eax, dword [ebp - 0xbe8]
mov edx, dword [ebp - 0xbe8]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xbe8]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0xbe8]
mov dword [ebp - 0xb8c], edx
jmp 0x41771a
mov eax, 0x96
mov dword [ebp - 0xb8c], ebx
mov edx, ebx
mov dword [ebp - 0xbac], 0x20
mov dword [ebp - 0xb94], eax
push dword [ebp - 0x8fc]
mov esi, dword [0x42403c]
sub ecx, eax
push dword [ebp - 0xba4]
mov edi, dword [ebp - 0x908]
sub ecx, edx
mov dword [ebp - 0xb88], ecx
mov eax, ebx
mov dword [ebp - 0x8d4], ecx
mov dword [ebp - 0x8e4], ecx
mov ecx, esi
mov dword [ebp - 0xb84], eax
call dword [0x426478]
call esi
mov esi, dword [0x42406c]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0xb80], eax
lea eax, [ebp - 0x8ec]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xba4]
call dword [0x426478]
call esi
test eax, eax
jne 0x41779d
mov edi, 0x80004005
mov dword [ebp - 0xb84], edi
jmp 0x41779f
mov edi, ebx
mov eax, dword [ebp - 0xb80]
test eax, eax
je 0x4177c0
mov esi, dword [0x42403c]
mov ecx, esi
push eax
push dword [ebp - 0xba4]
call dword [0x426478]
call esi
test edi, edi
js 0x417e22
push dword [ebp - 0x8f8]
mov esi, dword [0x42403c]
mov eax, ebx
push dword [ebp - 0xba4]
mov edi, dword [ebp - 0x904]
mov ecx, esi
mov dword [ebp - 0xb84], eax
call dword [0x426478]
call esi
mov esi, dword [0x42406c]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0xb80], eax
lea eax, [ebp - 0x8dc]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xba4]
call dword [0x426478]
call esi
test eax, eax
jne 0x41782f
mov edi, 0x80004005
mov dword [ebp - 0xb84], edi
jmp 0x417831
mov edi, ebx
mov eax, dword [ebp - 0xb80]
test eax, eax
je 0x417852
mov esi, dword [0x42403c]
mov ecx, esi
push eax
push dword [ebp - 0xba4]
call dword [0x426478]
call esi
test edi, edi
js 0x417e22
mov eax, dword [ebp - 0xbc8]
cmp eax, 2
je 0x41786a
cmp eax, 3
jne 0x41788c
mov edi, dword [ebp - 0x8d4]
mov dword [ebp - 0xb88], edi
cmp dword [ebp - 0x8e4], edi
jle 0x417892
mov edi, dword [ebp - 0x8e4]
mov dword [ebp - 0xb88], edi
jmp 0x417892
mov edi, dword [ebp - 0xb88]
cmp dword [ebp - 0x910], 0
mov esi, dword [0x4240a8]
mov ecx, esi
push dword [ebp - 0xba0]
je 0x4178e5
mov eax, edi
sub eax, dword [ebp - 0x8e4]
add eax, dword [ebp - 0xb8c]
push eax
lea eax, [ebp - 0x8ec]
push eax
call dword [0x426478]
call esi
mov eax, dword [ebp - 0x8e0]
add eax, dword [ebp - 0xbac]
push eax
mov eax, edi
sub eax, dword [ebp - 0x8d4]
add eax, dword [ebp - 0xb8c]
push eax
jmp 0x41790d
push dword [ebp - 0xb94]
lea eax, [ebp - 0x8ec]
push eax
call dword [0x426478]
call esi
mov eax, dword [ebp - 0x8e0]
add eax, dword [ebp - 0xbac]
push eax
push dword [ebp - 0xb94]
mov esi, dword [0x4240a8]
lea eax, [ebp - 0x8dc]
push eax
mov ecx, esi
call dword [0x426478]
call esi
mov eax, dword [ebp - 0xbc8]
cmp eax, 2
je 0x417c1d
cmp eax, 3
je 0x417c1d
xor edx, edx
inc edx
cmp eax, edx
jne 0x417c3c
push 0x5c
lea eax, [ebp - 0x658]
mov dword [ebp - 0x8f0], 0xffffff
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov esi, dword [0x42407c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xb84], edi
push 0x403
push ebx
push ebx
call dword [0x426478]
call esi
mov dword [ebp - 0xb94], eax
test eax, eax
jne 0x4179ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb84], edi
test edi, edi
jle 0x4179af
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb84], edi
test edi, edi
js 0x417a6d
jmp 0x41745d
mov esi, dword [0x42405c]
mov ecx, esi
push 0x48
push dword [ebp - 0xb7c]
push 0xb
call dword [0x426478]
call esi
push dword [ebp - 0xb9c]
neg eax
mov dword [ebp - 0x648], 0x190
push 0x20
mov dword [ebp - 0x658], eax
lea ecx, [ebp - 0x63c]
pop eax
mov edx, eax
mov byte [ebp - 0x63e], 5
call fcn.00406454
mov esi, dword [0x424010]
lea eax, [ebp - 0x658]
push eax
mov ecx, esi
call dword [0x426478]
call esi
test eax, eax
jne 0x417a50
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb84], edi
test edi, edi
jle 0x417a41
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb84], edi
test edi, edi
js 0x417a56
mov edi, 0x80004005
mov dword [ebp - 0xb84], edi
jmp 0x417a56
mov dword [ebp - 0x8f4], eax
push dword [ebp - 0xb94]
mov esi, dword [0x4240b0]
mov ecx, esi
push ebx
call dword [0x426478]
call esi
test edi, edi
js 0x417e22
push dword [ebp - 0x8f4]
mov eax, dword [ebp - 0xb88]
mov esi, dword [0x42403c]
mov ecx, esi
push dword [ebp - 0xba4]
mov edi, dword [ebp - 0x900]
mov dword [ebp - 0x8c4], eax
mov eax, ebx
mov dword [ebp - 0xb84], eax
call dword [0x426478]
call esi
mov esi, dword [0x42406c]
mov ecx, esi
push ebx
push 0x460
mov dword [ebp - 0xb94], eax
lea eax, [ebp - 0x8cc]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xba4]
call dword [0x426478]
call esi
test eax, eax
jne 0x417ae8
mov edi, 0x80004005
mov dword [ebp - 0xb84], edi
jmp 0x417aea
mov edi, ebx
mov eax, dword [ebp - 0xb94]
test eax, eax
je 0x417b0b
mov esi, dword [0x42403c]
mov ecx, esi
push eax
push dword [ebp - 0xba4]
call dword [0x426478]
call esi
test edi, edi
js 0x417e22
mov eax, dword [ebp - 0x8c4]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x8c4], eax
cmp eax, ecx
jge 0x417b2f
mov dword [ebp - 0x8c4], ecx
mov edi, dword [ebp - 0xb7c]
mov esi, dword [0x42405c]
mov ecx, esi
push 0x20
pop eax
push 0x60
push edi
push dword [ebp - 0x8cc]
mov dword [ebp - 0x8c0], eax
call dword [0x426478]
call esi
mov esi, dword [0x42405c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x8c8]
mov dword [ebp - 0x8cc], eax
call dword [0x426478]
call esi
mov esi, dword [0x42405c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x8c4]
mov dword [ebp - 0x8c8], eax
call dword [0x426478]
call esi
mov esi, dword [0x42405c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x8c0]
mov dword [ebp - 0x8c4], eax
call dword [0x426478]
call esi
mov ecx, dword [ebp - 0x8d0]
mov esi, dword [0x4240a8]
add ecx, 0x24
cmp dword [ebp - 0x910], 0
mov dword [ebp - 0x8c0], eax
je 0x417bfb
mov eax, dword [ebp - 0x8ec]
cmp eax, dword [ebp - 0x8dc]
jl 0x417be6
mov eax, dword [ebp - 0x8dc]
push ecx
push eax
lea eax, [ebp - 0x8cc]
mov ecx, esi
push eax
call dword [0x426478]
call esi
jmp 0x417c39
mov eax, dword [ebp - 0x8e4]
cmp eax, dword [ebp - 0x8d4]
jg 0x417c0f
mov eax, dword [ebp - 0x8d4]
sub eax, dword [ebp - 0x8c4]
add eax, dword [ebp - 0x8cc]
jmp 0x417be6
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x408], edi
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x8f0], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xbc8]
sub eax, 1
je 0x417e10
sub eax, 1
je 0x417d37
sub eax, 1
jne 0x417e1c
mov esi, dword [0x4240a4]
lea edi, [ebp - 0x4f0]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0x426478]
call esi
mov esi, dword [0x424084]
lea ecx, [ebp - 0x4f0]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x4f0], 0x28
call dword [0x426478]
call esi
test eax, eax
je 0x417e1c
mov esi, dword [0x4240a0]
lea eax, [ebp - 0x4dc]
push eax
push ebx
mov ecx, esi
call dword [0x426478]
call esi
mov esi, dword [0x4240a0]
lea eax, [ebp - 0x4d4]
push eax
push ebx
mov ecx, esi
call dword [0x426478]
call esi
mov eax, dword [ebp - 0x4d4]
lea esi, [ebp - 0x4dc]
sub eax, dword [ebp - 0xbac]
lea edi, [ebp - 0x3e0]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0xb8c]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
jmp 0x417e05
mov esi, dword [0x4240a4]
lea edi, [ebp - 0x4c8]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0x426478]
call esi
mov esi, dword [0x424084]
lea ecx, [ebp - 0x4c8]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x4c8], 0x28
call dword [0x426478]
call esi
test eax, eax
je 0x417e1c
mov esi, dword [0x4240a0]
lea eax, [ebp - 0x4b4]
push eax
push ebx
mov ecx, esi
call dword [0x426478]
call esi
mov esi, dword [0x4240a0]
lea eax, [ebp - 0x4ac]
push eax
push ebx
mov ecx, esi
call dword [0x426478]
call esi
cmp dword [ebp - 0xb94], 0
lea esi, [ebp - 0x4b4]
lea edi, [ebp - 0x3e0]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x417dde
imul eax, dword [ebp - 0x4ac], 5
cdq
idiv ecx
add eax, dword [ebp - 0x4b4]
jmp 0x417df0
mov eax, dword [ebp - 0x4ac]
sub eax, dword [ebp - 0xbac]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x4a8]
sub eax, dword [ebp - 0xb8c]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x40c], eax
jmp 0x417e1c
mov dword [ebp - 0x410], ebx
mov dword [ebp - 0x40c], ebx
mov dword [ebp - 0xb84], ebx
push dword [ebp - 0xba4]
mov esi, dword [0x4240b0]
mov ecx, esi
push ebx
call dword [0x426478]
call esi
xor ebx, ebx
mov edi, 0x425e28
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x417e40
mov eax, dword [0x425e24]
push 0
pop ebx
test eax, eax
jle 0x417ea2
sub eax, 1
mov dword [0x425e24], eax
jne 0x417ea2
mov esi, ebx
mov eax, dword [esi + 0x425930]
test eax, eax
je 0x417e76
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x417e65
push 0x40
push ebx
push 0x425930
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x401090
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x425e28
xor eax, eax
xchg dword [edi], eax
lea ecx, [ebp - 0xc50]
call fcn.0041ef64
mov eax, dword [ebp - 0xb84]
test eax, eax
js 0x419aaa
mov eax, dword [ebp - 0x40c]
mov edi, dword [ebp - 0x410]
push 0x54
mov dword [ebp - 0xb94], eax
mov dword [ebp - 0xcec], eax
lea eax, [ebp - 0x968]
push ebx
push eax
mov dword [ebp - 0xcf0], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov esi, dword [0x424028]
add esp, 0xc
xor eax, eax
mov ecx, esi
inc eax
mov dword [ebp - 0xb8c], eax
push 7
push dword [ebp - 0xbc4]
call dword [0x426478]
call esi
test eax, eax
je 0x417f59
mov esi, dword [0x424034]
lea ecx, [ebp - 0x968]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x426478]
call esi
test eax, eax
je 0x417f59
push 0x20
pop eax
cmp word [ebp - 0x956], ax
jne 0x417f59
cmp dword [ebp - 0x954], 0
je 0x417f59
cmp dword [ebp - 0x964], 0
jle 0x417f59
cmp dword [ebp - 0x960], 0
jg 0x417f68
cmp dword [ebp - 0xbc8], 1
mov dword [ebp - 0xb8c], ebx
jne 0x417fdc
push dword [ebp - 0xb94]
mov esi, dword [0x4240a8]
lea eax, [ebp - 0x8ec]
push edi
push eax
mov ecx, esi
call dword [0x426478]
call esi
push dword [ebp - 0xb94]
mov esi, dword [0x4240a8]
lea eax, [ebp - 0x8dc]
push edi
push eax
mov ecx, esi
call dword [0x426478]
call esi
mov edi, dword [ebp - 0xbc8]
cmp edi, 1
jne 0x417fe2
mov eax, dword [ebp - 0x90c]
mov esi, dword [0x424014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0x426478]
call esi
mov dword [ebp - 0xbd8], eax
jmp 0x417fe2
mov edi, dword [ebp - 0xbc8]
mov esi, dword [0x424040]
mov ecx, esi
push 1
push dword [ebp - 0xbc4]
call dword [0x426478]
call esi
cmp dword [ebp - 0x910], 0
mov dword [ebp - 0xb94], eax
mov dword [ebp - 0xbac], 0x810
je 0x41801d
mov dword [ebp - 0xbac], 0x20812
cmp dword [ebp - 0xb8c], 0
je 0x418b50
mov eax, dword [ebp - 0x90c]
mov esi, dword [ebp - 0x908]
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0x8fc]
push 0x54
mov dword [ebp - 0xb9c], eax
lea eax, [ebp - 0x9c0]
push ebx
push eax
mov dword [ebp - 0xb88], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa18]
push 0x54
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0xba4], ebx
lea eax, [ebp - 0x574]
mov dword [ebp - 0xb84], ebx
mov dword [ebp - 0xba0], ebx
mov dword [ebp - 0xb7c], ebx
push 0x2c
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
lea edi, [ebp - 0x430]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x419a8a
mov esi, dword [0x424028]
mov ecx, esi
mov edi, dword [ebp - 0xbc4]
push 7
push edi
call dword [0x426478]
call esi
test eax, eax
je 0x418be2
mov esi, dword [0x424034]
lea ecx, [ebp - 0x9c0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x426478]
call esi
test eax, eax
je 0x418113
mov eax, dword [ebp - 0x9ac]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0x9bc]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0x9b8]
mov dword [ebp - 0xb7c], eax
mov esi, dword [0x424008]
mov ecx, esi
push edi
call dword [0x426478]
call esi
mov edi, eax
mov dword [ebp - 0xb80], edi
test edi, edi
je 0x418be2
mov eax, dword [ebp - 0x8e4]
sub eax, dword [ebp - 0x8ec]
mov esi, dword [0x42400c]
mov ecx, esi
mov dword [ebp - 0x570], eax
mov eax, dword [ebp - 0x8e8]
sub eax, dword [ebp - 0x8e0]
mov dword [ebp - 0x56c], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc28], ebx
mov word [ebp - 0x568], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x566], ax
lea eax, [ebp - 0xc28]
push eax
push ebx
lea eax, [ebp - 0x574]
mov dword [ebp - 0xb90], ebx
push eax
push edi
mov dword [ebp - 0x564], ebx
mov dword [ebp - 0x560], ebx
mov dword [ebp - 0x55c], ebx
mov dword [ebp - 0x558], ebx
mov dword [ebp - 0x554], ebx
mov dword [ebp - 0x550], ebx
mov dword [ebp - 0x54c], ebx
mov dword [ebp - 0x574], 0x28
call dword [0x426478]
call esi
mov dword [ebp - 0xbc0], eax
test eax, eax
jne 0x41820d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb90], eax
test eax, eax
jle 0x4181f8
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb90], eax
test eax, eax
js 0x41859c
mov dword [ebp - 0xb90], 0x80004005
jmp 0x41859c
mov esi, dword [0x424034]
lea ecx, [ebp - 0xa18]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x426478]
call esi
test eax, eax
je 0x418237
mov eax, dword [ebp - 0xa04]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0x8e4]
sub eax, dword [ebp - 0x8ec]
push dword [ebp - 0xbc0]
mov esi, dword [0x42403c]
mov ecx, esi
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x8e0]
sub eax, dword [ebp - 0x8e8]
push edi
mov dword [ebp - 0x424], eax
call dword [0x426478]
call esi
mov esi, dword [0x424040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0x426478]
call esi
push dword [ebp - 0xb9c]
mov esi, dword [0x42403c]
mov ecx, esi
push edi
call dword [0x426478]
call esi
mov esi, dword [0x424038]
mov ecx, esi
mov edi, dword [0x424074]
push ebx
mov dword [ebp - 0xb9c], eax
call dword [0x426478]
call esi
push eax
lea eax, [ebp - 0x430]
mov ecx, edi
push eax
push dword [ebp - 0xb80]
call dword [0x426478]
call edi
mov edi, dword [ebp - 0xb80]
lea eax, [ebp - 0x430]
mov esi, dword [0x42406c]
mov ecx, esi
push ebx
push dword [ebp - 0xbac]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb88]
push edi
call dword [0x426478]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xbc8], eax
jne 0x41833a
cmp dword [ebp - 0xb8c], 0
je 0x41832e
mov esi, dword [0x42408c]
mov ecx, esi
push 8
call dword [0x426478]
call esi
mov dword [ebp - 0xb8c], eax
jmp 0x418344
mov dword [ebp - 0xb8c], 0xffffff
jmp 0x418344
mov dword [ebp - 0xb8c], 0xffa8a8a8
mov esi, dword [ebp - 0x8ec]
mov ecx, ebx
mov eax, dword [ebp - 0x8e8]
mov dword [ebp - 0xb88], esi
mov dword [ebp - 0xbb8], ebx
test esi, esi
jns 0x418374
mov edx, esi
mov dword [ebp - 0xb88], ebx
neg edx
mov esi, ebx
mov dword [ebp - 0xbb8], edx
test eax, eax
jns 0x41837e
mov ecx, eax
mov eax, ebx
neg ecx
mov edx, dword [ebp - 0xba0]
sub edx, esi
mov esi, dword [ebp - 0x428]
sub esi, dword [ebp - 0xbb8]
mov dword [ebp - 0xbb4], esi
cmp esi, edx
jl 0x4183a4
mov esi, edx
mov dword [ebp - 0xbb4], edx
mov edx, dword [ebp - 0x424]
sub dword [ebp - 0xb7c], eax
sub edx, ecx
mov dword [ebp - 0xb98], edx
cmp edx, dword [ebp - 0xb7c]
jl 0x4183cc
mov edx, dword [ebp - 0xb7c]
mov dword [ebp - 0xb98], edx
test esi, esi
jle 0x41856a
test edx, edx
jle 0x41856a
mov edx, dword [ebp - 0x428]
imul eax, dword [ebp - 0xba0]
mov edi, dword [ebp - 0xb84]
imul ecx, edx
shl edx, 2
add eax, dword [ebp - 0xb88]
add ecx, dword [ebp - 0xbb8]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0xba4]
mov dword [ebp - 0xba4], edx
mov edx, dword [ebp - 0xba0]
shl edx, 2
lea eax, [edi + eax*4]
mov dword [ebp - 0xb84], ecx
mov dword [ebp - 0xb88], eax
mov dword [ebp - 0xba0], edx
mov ebx, eax
mov dword [ebp - 0xbbc], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xb7c], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xbb8], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x418510
mov bl, byte [edi + ebx]
mov eax, dword [ebp - 0xb8c]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbb8]
add al, bl
mov byte [edi + ecx], al
mov eax, dword [ebp - 0xb7c]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xb8c]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb7c]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xb8a]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb7c]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xbbc]
cdq
idiv ecx
mov edx, dword [ebp - 0xb7c]
add al, bl
mov ebx, dword [ebp - 0xbb8]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xb7c], edx
mov dword [ebp - 0xbbc], esi
jne 0x41844a
mov ecx, dword [ebp - 0xb84]
mov eax, dword [ebp - 0xb88]
add ecx, dword [ebp - 0xba4]
add eax, dword [ebp - 0xba0]
sub dword [ebp - 0xb98], 1
mov esi, dword [ebp - 0xbb4]
mov dword [ebp - 0xb84], ecx
mov dword [ebp - 0xb88], eax
jne 0x41842e
mov edi, dword [ebp - 0xb80]
xor ebx, ebx
push dword [ebp - 0xbc0]
mov esi, dword [0x42401c]
mov ecx, esi
call dword [0x426478]
call esi
mov eax, dword [ebp - 0xb9c]
test eax, eax
je 0x41859c
mov esi, dword [0x42403c]
mov ecx, esi
push eax
push edi
call dword [0x426478]
call esi
mov esi, dword [0x424018]
mov ecx, esi
push edi
call dword [0x426478]
call esi
cmp dword [ebp - 0xb90], 0
jl 0x419a8a
mov eax, dword [ebp - 0x90c]
mov esi, dword [ebp - 0x904]
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0x8f8]
push 0x54
mov dword [ebp - 0xb9c], eax
lea eax, [ebp - 0xa70]
push ebx
push eax
mov dword [ebp - 0xb88], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0xac8]
push 0x54
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0xba4], ebx
lea eax, [ebp - 0x5f8]
mov dword [ebp - 0xb84], ebx
mov dword [ebp - 0xba0], ebx
mov dword [ebp - 0xb7c], ebx
push 0x2c
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
lea edi, [ebp - 0x460]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x419a8a
mov esi, dword [0x424028]
mov ecx, esi
mov edi, dword [ebp - 0xbc4]
push 7
push edi
call dword [0x426478]
call esi
test eax, eax
je 0x418be2
mov esi, dword [0x424034]
lea ecx, [ebp - 0xa70]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x426478]
call esi
test eax, eax
je 0x4186a3
mov eax, dword [ebp - 0xa5c]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0xa6c]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0xa68]
mov dword [ebp - 0xb7c], eax
mov esi, dword [0x424008]
mov ecx, esi
push edi
call dword [0x426478]
call esi
mov edi, eax
mov dword [ebp - 0xb80], edi
test edi, edi
je 0x418be2
mov eax, dword [ebp - 0x8d4]
sub eax, dword [ebp - 0x8dc]
mov esi, dword [0x42400c]
mov ecx, esi
mov dword [ebp - 0x5f4], eax
mov eax, dword [ebp - 0x8d8]
sub eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x5f0], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc2c], ebx
mov word [ebp - 0x5ec], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x5ea], ax
lea eax, [ebp - 0xc2c]
push eax
push ebx
lea eax, [ebp - 0x5f8]
mov dword [ebp - 0xb90], ebx
push eax
push edi
mov dword [ebp - 0x5e8], ebx
mov dword [ebp - 0x5e4], ebx
mov dword [ebp - 0x5e0], ebx
mov dword [ebp - 0x5dc], ebx
mov dword [ebp - 0x5d8], ebx
mov dword [ebp - 0x5d4], ebx
mov dword [ebp - 0x5d0], ebx
mov dword [ebp - 0x5f8], 0x28
call dword [0x426478]
call esi
mov dword [ebp - 0xbc0], eax
test eax, eax
jne 0x41879d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb90], eax
test eax, eax
jle 0x418788
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb90], eax
test eax, eax
js 0x418b2d
mov dword [ebp - 0xb90], 0x80004005
jmp 0x418b2d
mov esi, dword [0x424034]
lea ecx, [ebp - 0xac8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x426478]
call esi
test eax, eax
je 0x4187c7
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0x8d4]
sub eax, dword [ebp - 0x8dc]
push dword [ebp - 0xbc0]
mov esi, dword [0x42403c]
mov ecx, esi
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x8d0]
sub eax, dword [ebp - 0x8d8]
push edi
mov dword [ebp - 0x454], eax
call dword [0x426478]
call esi
mov esi, dword [0x424040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0x426478]
call esi
push dword [ebp - 0xb9c]
mov esi, dword [0x42403c]
mov ecx, esi
push edi
call dword [0x426478]
call esi
mov esi, dword [0x424038]
mov ecx, esi
mov edi, dword [0x424074]
push ebx
mov dword [ebp - 0xb9c], eax
call dword [0x426478]
call esi
push eax
lea eax, [ebp - 0x460]
mov ecx, edi
push eax
push dword [ebp - 0xb80]
call dword [0x426478]
call edi
mov edi, dword [ebp - 0xb80]
lea eax, [ebp - 0x460]
mov esi, dword [0x42406c]
mov ecx, esi
push ebx
push dword [ebp - 0xbac]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb88]
push edi
call dword [0x426478]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xbc8], eax
jne 0x4188c4
cmp dword [ebp - 0xb8c], 0
je 0x4188b8
mov esi, dword [0x42408c]
mov ecx, esi
push 8
call dword [0x426478]
call esi
jmp 0x4188c9
mov dword [ebp - 0xbc8], 0xffffff
jmp 0x4188d5
mov eax, 0xffa8a8a8
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbb0], eax
mov esi, dword [ebp - 0x8dc]
mov edx, ebx
mov eax, dword [ebp - 0x8d8]
mov ecx, ebx
mov dword [ebp - 0xb8c], esi
mov dword [ebp - 0xbac], ebx
test esi, esi
jns 0x418905
mov edx, esi
mov dword [ebp - 0xb8c], ebx
neg edx
mov dword [ebp - 0xbac], edx
test eax, eax
jns 0x41890f
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x458]
sub esi, edx
mov edx, dword [ebp - 0xba0]
sub edx, dword [ebp - 0xb8c]
mov dword [ebp - 0xb88], esi
cmp esi, edx
jl 0x418935
mov esi, edx
mov dword [ebp - 0xb88], edx
mov edx, dword [ebp - 0x454]
sub dword [ebp - 0xb7c], eax
sub edx, ecx
mov dword [ebp - 0xbb8], edx
cmp edx, dword [ebp - 0xb7c]
jl 0x41895d
mov edx, dword [ebp - 0xb7c]
mov dword [ebp - 0xbb8], edx
test esi, esi
jle 0x418afb
test edx, edx
jle 0x418afb
mov edx, dword [ebp - 0x458]
mov edi, dword [ebp - 0xb84]
imul eax, dword [ebp - 0xba0]
imul ecx, edx
shl edx, 2
add eax, dword [ebp - 0xb8c]
add ecx, dword [ebp - 0xbac]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0xba4]
mov dword [ebp - 0xba4], edx
mov edx, dword [ebp - 0xba0]
shl edx, 2
lea eax, [edi + eax*4]
mov dword [ebp - 0xbac], ecx
mov dword [ebp - 0xb8c], eax
mov dword [ebp - 0xb84], edx
mov ebx, eax
mov dword [ebp - 0xbb4], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xba0], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xb7c], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x418aa1
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xbb0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb7c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xba0]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xbb0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xba0]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xbc6]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xba0]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xbb4]
cdq
idiv ecx
mov edx, dword [ebp - 0xba0]
add al, bl
mov ebx, dword [ebp - 0xb7c]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xba0], edx
mov dword [ebp - 0xbb4], esi
jne 0x4189db
mov ecx, dword [ebp - 0xbac]
mov eax, dword [ebp - 0xb8c]
add ecx, dword [ebp - 0xba4]
add eax, dword [ebp - 0xb84]
sub dword [ebp - 0xbb8], 1
mov esi, dword [ebp - 0xb88]
mov dword [ebp - 0xbac], ecx
mov dword [ebp - 0xb8c], eax
jne 0x4189bf
mov edi, dword [ebp - 0xb80]
xor ebx, ebx
push dword [ebp - 0xbc0]
mov esi, dword [0x42401c]
mov ecx, esi
call dword [0x426478]
call esi
mov eax, dword [ebp - 0xb9c]
test eax, eax
je 0x418b2d
mov esi, dword [0x42403c]
mov ecx, esi
push eax
push edi
call dword [0x426478]
call esi
mov esi, dword [0x424018]
mov ecx, esi
push edi
call dword [0x426478]
call esi
cmp dword [ebp - 0xb90], 0
jl 0x419a8a
jmp 0x419a38
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x90c], 0
jne 0x418b64
cmp edi, ecx
je 0x418b64
mov al, 0xc0
jmp 0x418b66
or al, 0xff
mov esi, dword [0x424008]
push dword [ebp - 0xbc4]
mov byte [ebp - 0xb8a], al
mov eax, ebx
mov byte [ebp - 0xb89], cl
mov ecx, esi
mov byte [ebp - 0xb8c], bl
mov byte [ebp - 0xb8b], bl
mov dword [ebp - 0xb9c], eax
mov dword [ebp - 0x440], eax
mov dword [ebp - 0xb88], ebx
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x448], ebx
mov dword [ebp - 0x444], ebx
call dword [0x426478]
call esi
mov dword [ebp - 0xba8], eax
test eax, eax
jne 0x418bed
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x419a8a
xor eax, eax
inc eax
cmp edi, eax
jne 0x418cfe
mov edi, dword [ebp - 0x8e4]
mov eax, edi
mov edx, dword [ebp - 0x8d4]
mov ecx, edx
sub ecx, dword [ebp - 0x8dc]
sub eax, dword [ebp - 0x8ec]
mov dword [ebp - 0xb84], ecx
cmp ecx, eax
jg 0x418c26
mov ecx, eax
mov dword [ebp - 0xb84], eax
mov esi, dword [ebp - 0x8d0]
mov eax, esi
sub eax, dword [ebp - 0x8e8]
cmp dword [ebp - 0x910], 0
mov dword [ebp - 0xba0], eax
mov eax, ebx
mov dword [ebp - 0xbd4], ebx
je 0x418c89
mov eax, dword [ebp - 0x8ec]
sub eax, edi
add ecx, eax
mov eax, dword [ebp - 0x8dc]
sub eax, edx
mov dword [ebp - 0xb9c], ecx
add eax, dword [ebp - 0xb84]
mov dword [ebp - 0xba4], eax
mov dword [ebp - 0x450], eax
mov dword [ebp - 0xbd4], eax
mov eax, ecx
mov dword [ebp - 0x440], ecx
mov dword [ebp - 0xb7c], ecx
sub edi, dword [ebp - 0x8ec]
sub edx, dword [ebp - 0x8dc]
add edi, eax
mov eax, dword [ebp - 0x8e0]
sub eax, dword [ebp - 0x8e8]
add edx, dword [ebp - 0xbd4]
sub esi, dword [ebp - 0x8d8]
mov dword [ebp - 0xb7c], edi
mov dword [ebp - 0x438], edi
mov edi, dword [ebp - 0x8d8]
sub edi, dword [ebp - 0x8e8]
add esi, edi
mov dword [ebp - 0xb80], eax
mov dword [ebp - 0x434], eax
mov dword [ebp - 0xb90], edx
mov dword [ebp - 0x448], edx
mov dword [ebp - 0xbc0], edi
mov dword [ebp - 0x44c], edi
mov dword [ebp - 0xbb8], esi
mov dword [ebp - 0x444], esi
jmp 0x418d96
mov eax, dword [ebp - 0x408]
lea esi, [ebp - 0x8ec]
lea edi, [ebp - 0x440]
mov dword [ebp - 0xb84], eax
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0xba0], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x434]
lea esi, [ebp - 0x8dc]
lea edi, [ebp - 0x450]
mov dword [ebp - 0xb80], eax
mov eax, dword [ebp - 0x438]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0x440]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb9c], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0xbb8], eax
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0xb90], eax
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0xba0]
mov esi, dword [0x42400c]
neg eax
mov edi, dword [ebp - 0xb84]
mov ecx, esi
mov dword [ebp - 0x598], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc30], ebx
mov word [ebp - 0x594], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x592], ax
lea eax, [ebp - 0xc30]
push eax
push ebx
lea eax, [ebp - 0x5a0]
mov dword [ebp - 0x590], ebx
push eax
push dword [ebp - 0xba8]
mov dword [ebp - 0x58c], ebx
mov dword [ebp - 0x588], ebx
mov dword [ebp - 0x584], ebx
mov dword [ebp - 0x580], ebx
mov dword [ebp - 0x57c], ebx
mov dword [ebp - 0x578], ebx
mov dword [ebp - 0x5a0], 0x28
mov dword [ebp - 0x59c], edi
call dword [0x426478]
call esi
mov dword [ebp - 0xbd4], eax
test eax, eax
jne 0x418e3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x419a6f
mov esi, dword [0x42403c]
mov ecx, esi
push eax
push dword [ebp - 0xba8]
call dword [0x426478]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xbc8], eax
jne 0x418ea2
mov ecx, dword [ebp - 0xbd8]
test ecx, ecx
je 0x418ea2
mov eax, dword [ebp - 0xba0]
mov esi, dword [0x424074]
push ecx
mov dword [ebp - 0x3e4], eax
mov ecx, esi
lea eax, [ebp - 0x3f0]
mov dword [ebp - 0x3f0], ebx
push eax
push dword [ebp - 0xba8]
mov dword [ebp - 0x3ec], ebx
mov dword [ebp - 0x3e8], edi
call dword [0x426478]
call esi
mov eax, dword [ebp - 0x90c]
mov esi, dword [ebp - 0x908]
mov dword [ebp - 0xbb4], eax
mov eax, dword [ebp - 0x8fc]
push 0x54
mov dword [ebp - 0xb98], eax
lea eax, [ebp - 0xb20]
push ebx
push eax
mov dword [ebp - 0xbbc], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0xb78]
push 0x54
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0xbd0], ebx
lea eax, [ebp - 0x548]
mov dword [ebp - 0xbcc], ebx
mov dword [ebp - 0xbe0], ebx
mov dword [ebp - 0xbe4], ebx
push 0x2c
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
lea edi, [ebp - 0x470]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x419a54
mov esi, dword [0x424028]
mov ecx, esi
mov edi, dword [ebp - 0xba8]
push 7
push edi
call dword [0x426478]
call esi
test eax, eax
jne 0x418f50
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x419a54
mov esi, dword [0x424034]
lea ecx, [ebp - 0xb20]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x426478]
call esi
test eax, eax
je 0x418f92
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0xbe4], eax
mov esi, dword [0x424008]
mov ecx, esi
push edi
call dword [0x426478]
call esi
mov ecx, eax
mov dword [ebp - 0xbf4], ecx
test ecx, ecx
je 0x418f45
mov eax, dword [ebp - 0xb88]
sub eax, dword [ebp - 0xb80]
mov edi, dword [ebp - 0xb7c]
sub edi, dword [ebp - 0xb9c]
mov esi, dword [0x42400c]
mov dword [ebp - 0x540], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc34], ebx
mov word [ebp - 0x53c], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x53a], ax
lea eax, [ebp - 0xc34]
push eax
push ebx
lea eax, [ebp - 0x548]
mov dword [ebp - 0xbf0], ebx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x538], ebx
mov dword [ebp - 0x534], ebx
mov dword [ebp - 0x530], ebx
mov dword [ebp - 0x52c], ebx
mov dword [ebp - 0x528], ebx
mov dword [ebp - 0x524], ebx
mov dword [ebp - 0x520], ebx
mov dword [ebp - 0x548], 0x28
mov dword [ebp - 0x544], edi
call dword [0x426478]
call esi
mov dword [ebp - 0xb7c], eax
test eax, eax
jne 0x41908e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xbf0], eax
test eax, eax
jle 0x419073
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xbf0], eax
test eax, eax
mov edi, dword [ebp - 0xbf4]
js 0x419404
mov dword [ebp - 0xbf0], 0x80004005
jmp 0x419404
mov esi, dword [0x424034]
lea ecx, [ebp - 0xb78]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x426478]
call esi
test eax, eax
je 0x4190b8
mov eax, dword [ebp - 0xb64]
mov dword [ebp - 0xbcc], eax
push dword [ebp - 0xb7c]
mov eax, dword [ebp - 0xb80]
sub eax, dword [ebp - 0xb88]
mov esi, dword [0x42403c]
mov ecx, esi
mov dword [ebp - 0x468], edi
mov edi, dword [ebp - 0xbf4]
push edi
mov dword [ebp - 0x464], eax
call dword [0x426478]
call esi
mov esi, dword [0x424040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0x426478]
call esi
push dword [ebp - 0xb98]
mov esi, dword [0x42403c]
mov ecx, esi
push edi
call dword [0x426478]
call esi
mov esi, dword [0x424038]
mov ecx, esi
mov edi, dword [0x424074]
push ebx
mov dword [ebp - 0xb80], eax
call dword [0x426478]
call esi
mov esi, dword [ebp - 0xbf4]
mov ecx, edi
push eax
lea eax, [ebp - 0x470]
push eax
push esi
call dword [0x426478]
call edi
push ebx
push dword [ebp - 0xbac]
lea eax, [ebp - 0x470]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xbbc]
push esi
mov esi, dword [0x42406c]
mov ecx, esi
call dword [0x426478]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xbc8], eax
jne 0x4191b0
cmp dword [ebp - 0xbb4], 0
je 0x4191a4
mov esi, dword [0x42408c]
mov ecx, esi
push 8
call dword [0x426478]
call esi
mov dword [ebp - 0xbb4], eax
jmp 0x4191ba
mov dword [ebp - 0xbb4], 0xffffff
jmp 0x4191ba
mov dword [ebp - 0xbb4], 0xffa8a8a8
mov edx, dword [ebp - 0xb9c]
mov esi, ebx
mov dword [ebp - 0xb98], ebx
mov ecx, ebx
test edx, edx
jns 0x4191da
mov esi, edx
mov edx, ebx
neg esi
mov dword [ebp - 0xb98], esi
mov eax, dword [ebp - 0xb88]
test eax, eax
jns 0x4191ea
mov ecx, eax
mov eax, ebx
neg ecx
mov edi, dword [ebp - 0x468]
sub edi, esi
mov esi, dword [ebp - 0xbe0]
sub esi, edx
mov dword [ebp - 0xb9c], edi
cmp edi, esi
jl 0x41920c
mov edi, esi
mov dword [ebp - 0xb9c], esi
mov esi, dword [ebp - 0x464]
sub dword [ebp - 0xbe4], eax
sub esi, ecx
mov dword [ebp - 0xb88], esi
cmp esi, dword [ebp - 0xbe4]
jl 0x419234
mov esi, dword [ebp - 0xbe4]
mov dword [ebp - 0xb88], esi
test edi, edi
jle 0x4193cc
test esi, esi
jle 0x4193cc
imul eax, dword [ebp - 0xbe0]
imul ecx, dword [ebp - 0x468]
mov esi, dword [ebp - 0xbcc]
add eax, edx
mov edx, dword [ebp - 0xbd0]
add ecx, dword [ebp - 0xb98]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0x468]
shl edx, 2
lea ecx, [esi + ecx*4]
mov dword [ebp - 0xbd0], edx
mov edx, dword [ebp - 0xbe0]
shl edx, 2
mov dword [ebp - 0xb98], ecx
mov dword [ebp - 0xbbc], eax
mov dword [ebp - 0xbcc], edx
mov esi, dword [ebp - 0xb9c]
lea edx, [eax + 3]
mov ebx, eax
mov dword [ebp - 0xbe0], edx
sub ebx, ecx
mov dword [ebp - 0xbec], esi
lea edi, [ecx + 2]
mov dword [ebp - 0xbe4], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x41937e
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xbb4]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbe4]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xbe0]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xbb4]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbe0]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xbb2]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbe0]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xbec]
cdq
idiv ecx
mov edx, dword [ebp - 0xbe0]
add al, bl
mov ebx, dword [ebp - 0xbe4]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xbe0], edx
mov dword [ebp - 0xbec], esi
jne 0x4192b8
mov ecx, dword [ebp - 0xb98]
mov eax, dword [ebp - 0xbbc]
add ecx, dword [ebp - 0xbd0]
add eax, dword [ebp - 0xbcc]
sub dword [ebp - 0xb88], 1
mov dword [ebp - 0xb98], ecx
mov dword [ebp - 0xbbc], eax
jne 0x419296
xor ebx, ebx
push dword [ebp - 0xb7c]
mov esi, dword [0x42401c]
mov ecx, esi
call dword [0x426478]
call esi
mov eax, dword [ebp - 0xb80]
mov edi, dword [ebp - 0xbf4]
test eax, eax
je 0x419404
mov esi, dword [0x42403c]
mov ecx, esi
push eax
push edi
call dword [0x426478]
call esi
mov esi, dword [0x424018]
mov ecx, esi
push edi
call dword [0x426478]
call esi
cmp dword [ebp - 0xbf0], 0
jl 0x419a54
mov eax, dword [ebp - 0x90c]
mov esi, dword [ebp - 0x904]
mov dword [ebp - 0xb9c], eax
mov eax, dword [ebp - 0x8f8]
push 0x54
mov dword [ebp - 0xb88], eax
lea eax, [ebp - 0x860]
push ebx
push eax
mov dword [ebp - 0xb7c], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x8b8]
push 0x54
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0xb80], ebx
lea eax, [ebp - 0x51c]
mov dword [ebp - 0xbb4], ebx
mov dword [ebp - 0xb98], ebx
mov dword [ebp - 0xbbc], ebx
push 0x2c
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
lea edi, [ebp - 0x480]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x419a54
mov esi, dword [0x424028]
mov ecx, esi
mov edi, dword [ebp - 0xba8]
push 7
push edi
call dword [0x426478]
call esi
test eax, eax
je 0x418f45
mov esi, dword [0x424034]
lea ecx, [ebp - 0x860]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x426478]
call esi
test eax, eax
je 0x41950b
mov eax, dword [ebp - 0x84c]
mov dword [ebp - 0xb80], eax
mov eax, dword [ebp - 0x85c]
mov dword [ebp - 0xb98], eax
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0xbbc], eax
mov esi, dword [0x424008]
mov ecx, esi
push edi
call dword [0x426478]
call esi
mov ecx, eax
mov dword [ebp - 0xbd0], ecx
test ecx, ecx
je 0x418f45
mov eax, dword [ebp - 0xb90]
sub eax, dword [ebp - 0xba4]
mov edi, dword [ebp - 0xbc0]
mov esi, dword [0x42400c]
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0x518], eax
mov eax, edi
sub eax, dword [ebp - 0xbb8]
mov dword [ebp - 0x514], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc38], ebx
mov word [ebp - 0x510], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x50e], ax
lea eax, [ebp - 0xc38]
push eax
push ebx
lea eax, [ebp - 0x51c]
mov dword [ebp - 0xbcc], ebx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x50c], ebx
mov dword [ebp - 0x508], ebx
mov dword [ebp - 0x504], ebx
mov dword [ebp - 0x500], ebx
mov dword [ebp - 0x4fc], ebx
mov dword [ebp - 0x4f8], ebx
mov dword [ebp - 0x4f4], ebx
mov dword [ebp - 0x51c], 0x28
call dword [0x426478]
call esi
mov dword [ebp - 0xbe0], eax
test eax, eax
jne 0x419613
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xbcc], eax
test eax, eax
jle 0x4195f8
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xbcc], eax
test eax, eax
mov edi, dword [ebp - 0xbd0]
js 0x419992
mov dword [ebp - 0xbcc], 0x80004005
jmp 0x419992
mov esi, dword [0x424034]
lea ecx, [ebp - 0x8b8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x426478]
call esi
test eax, eax
je 0x41963d
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0xbb4], eax
mov eax, dword [ebp - 0xb90]
push dword [ebp - 0xbe0]
mov esi, dword [0x42403c]
mov ecx, esi
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0xbb8]
sub eax, edi
mov edi, dword [ebp - 0xbd0]
push edi
mov dword [ebp - 0x474], eax
call dword [0x426478]
call esi
mov esi, dword [0x424040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0x426478]
call esi
push dword [ebp - 0xb88]
mov esi, dword [0x42403c]
mov ecx, esi
push edi
call dword [0x426478]
call esi
mov esi, dword [0x424038]
mov ecx, esi
mov edi, dword [0x424074]
push ebx
mov dword [ebp - 0xb88], eax
call dword [0x426478]
call esi
mov esi, dword [ebp - 0xbd0]
mov ecx, edi
push eax
lea eax, [ebp - 0x480]
push eax
push esi
call dword [0x426478]
call edi
push ebx
push dword [ebp - 0xbac]
lea eax, [ebp - 0x480]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb7c]
push esi
mov esi, dword [0x42406c]
mov ecx, esi
call dword [0x426478]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xbc8], eax
jne 0x41973f
cmp dword [ebp - 0xb9c], 0
je 0x419733
mov esi, dword [0x42408c]
mov ecx, esi
push 8
call dword [0x426478]
call esi
mov ecx, eax
mov dword [ebp - 0xbb0], ecx
mov dword [ebp - 0xbac], ecx
jmp 0x419750
mov dword [ebp - 0xbac], 0xffffff
jmp 0x419750
mov eax, 0xffa8a8a8
mov dword [ebp - 0xbb0], eax
mov dword [ebp - 0xbac], eax
mov edx, dword [ebp - 0xba4]
mov edi, ebx
mov eax, ebx
test edx, edx
jns 0x419768
mov edi, edx
mov dword [ebp - 0xba4], ebx
neg edi
mov ecx, dword [ebp - 0xbc0]
test ecx, ecx
jns 0x419778
mov eax, ecx
mov ecx, ebx
neg eax
mov esi, dword [ebp - 0x478]
mov edx, dword [ebp - 0xb98]
sub esi, edi
sub edx, dword [ebp - 0xba4]
mov dword [ebp - 0xb9c], esi
cmp esi, edx
jl 0x41979e
mov esi, edx
mov dword [ebp - 0xb9c], edx
mov edx, dword [ebp - 0x474]
sub dword [ebp - 0xbbc], ecx
sub edx, eax
mov dword [ebp - 0xb7c], edx
cmp edx, dword [ebp - 0xbbc]
jl 0x4197c6
mov edx, dword [ebp - 0xbbc]
mov dword [ebp - 0xb7c], edx
test esi, esi
jle 0x41995a
test edx, edx
jle 0x41995a
mov edx, dword [ebp - 0x478]
imul ecx, dword [ebp - 0xb98]
imul eax, edx
shl edx, 2
add ecx, dword [ebp - 0xba4]
add eax, edi
mov edi, dword [ebp - 0xbb4]
lea eax, [edi + eax*4]
mov edi, dword [ebp - 0xb80]
mov dword [ebp - 0xb80], edx
mov edx, dword [ebp - 0xb98]
shl edx, 2
lea ecx, [edi + ecx*4]
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0xba4], ecx
mov dword [ebp - 0xbc0], edx
mov ebx, ecx
mov dword [ebp - 0xb98], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [ebp - 0xbb8], edx
lea edi, [eax + 2]
mov dword [ebp - 0xbb4], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x419906
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xbb0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbb4]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xbb8]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xbb0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbb8]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xbaa]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbb8]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xb98]
cdq
idiv ecx
mov edx, dword [ebp - 0xbb8]
add al, bl
mov ebx, dword [ebp - 0xbb4]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xbb8], edx
mov dword [ebp - 0xb98], esi
jne 0x419840
mov eax, dword [ebp - 0xb90]
mov ecx, dword [ebp - 0xba4]
add eax, dword [ebp - 0xb80]
add ecx, dword [ebp - 0xbc0]
sub dword [ebp - 0xb7c], 1
mov esi, dword [ebp - 0xb9c]
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0xba4], ecx
jne 0x419824
xor ebx, ebx
push dword [ebp - 0xbe0]
mov esi, dword [0x42401c]
mov ecx, esi
call dword [0x426478]
call esi
mov eax, dword [ebp - 0xb88]
mov edi, dword [ebp - 0xbd0]
test eax, eax
je 0x419992
mov esi, dword [0x42403c]
mov ecx, esi
push eax
push edi
call dword [0x426478]
call esi
mov esi, dword [0x424018]
mov ecx, esi
push edi
call dword [0x426478]
call esi
cmp dword [ebp - 0xbcc], 0
jl 0x419a54
xor eax, eax
inc eax
cmp dword [ebp - 0xbc8], eax
jne 0x4199f8
mov esi, dword [section..data]
mov ecx, esi
push 0xcc0020
push ebx
push ebx
push dword [ebp - 0xba8]
push dword [ebp - 0xba0]
push dword [ebp - 0xb84]
push dword [ebp - 0x8e8]
push dword [ebp - 0x8ec]
push dword [ebp - 0xbc4]
call dword [0x426478]
call esi
jmp 0x419a38
push dword [ebp - 0xb8c]
mov ecx, dword [ebp - 0xba0]
mov eax, dword [ebp - 0xb84]
mov esi, dword [0x424020]
push ecx
push eax
push ebx
push ebx
push dword [ebp - 0xba8]
push ecx
push eax
push dword [ebp - 0x40c]
mov ecx, esi
push dword [ebp - 0x410]
push dword [ebp - 0xbc4]
call dword [0x426478]
call esi
push dword [ebp - 0xb94]
mov esi, dword [0x424040]
mov ecx, esi
push dword [ebp - 0xbc4]
call dword [0x426478]
call esi
mov eax, dword [ebp - 0xbd4]
test eax, eax
je 0x419a6f
mov esi, dword [0x42401c]
mov ecx, esi
push eax
call dword [0x426478]
call esi
mov eax, dword [ebp - 0xba8]
test eax, eax
je 0x419a8a
mov esi, dword [0x424018]
mov ecx, esi
push eax
call dword [0x426478]
call esi
mov eax, dword [ebp - 0xbd8]
test eax, eax
je 0x419aa5
mov esi, dword [0x42401c]
mov ecx, esi
push eax
call dword [0x426478]
call esi
mov edi, 0x425e28
mov ecx, dword [ebp - 0x908]
test ecx, ecx
je 0x419af9
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x419ab7
mov eax, dword [ebp - 0x908]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x419adf
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x419ad7
push dword [ebp - 0x908]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x908], ebx
mov ecx, dword [ebp - 0x904]
test ecx, ecx
je 0x419b48
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x419b06
mov eax, dword [ebp - 0x904]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x419b2e
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x419b26
push dword [ebp - 0x904]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x904], ebx
mov edx, dword [ebp - 0x900]
test edx, edx
je 0x419b94
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x419b57
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x419b7f
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0x419b71
mov edx, dword [ebp - 0x900]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x900], ebx
cmp dword [ebp - 0x8fc], 0
je 0x419bb9
push dword [ebp - 0x8fc]
mov esi, dword [0x42401c]
mov ecx, esi
call dword [0x426478]
call esi
mov dword [ebp - 0x8fc], ebx
cmp dword [ebp - 0x8f8], 0
je 0x419bde
push dword [ebp - 0x8f8]
mov esi, dword [0x42401c]
mov ecx, esi
call dword [0x426478]
call esi
mov dword [ebp - 0x8f8], ebx
cmp dword [ebp - 0x8f4], 0
je 0x419c03
push dword [ebp - 0x8f4]
mov esi, dword [0x42401c]
mov ecx, esi
call dword [0x426478]
call esi
mov dword [ebp - 0x8f4], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x419c05
mov eax, dword [0x425e24]
push 0
pop ebx
test eax, eax
jle 0x419c67
sub eax, 1
mov dword [0x425e24], eax
jne 0x419c67
mov esi, ebx
mov eax, dword [esi + 0x425930]
test eax, eax
je 0x419c3b
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x419c2a
push 0x40
push ebx
push 0x425930
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x401090
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x425e28
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0x425920]
mov esi, dword [0x42404c]
mov ecx, esi
mov dword [ebp - 0xbc8], eax
call dword [0x426478]
call esi
sub eax, dword [0x425e18]
lea edi, [ebp - 0x33c]
push 7
mov dword [ebp - 0xba8], eax
mov edx, 0x425e28
xor eax, eax
xor ebx, ebx
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x419ca6
mov eax, dword [0x425e24]
push 0
pop ebx
test eax, eax
jne 0x41a2c5
push 0x338
mov edi, ebx
mov dword [ebp - 0xbd4], ebx
push ebx
mov dword [ebp - 0xbd8], edi
mov dword [ebp - 0xb94], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb8c], eax
test eax, eax
je 0x41a25e
or dword [ebp - 0xb9c], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0xbac], ebx
mov esi, ebx
mov dword [ebp - 0xb88], eax
mov edx, ebx
mov edi, dword [ebp - 0xbfc]
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xbfc]
xor edx, ebx
mov dword [ebp - 0xba4], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xbfc]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xbfc]
shl edi, 8
add dword [ebp - 0xbfc], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
mov dword [ebp - 0xbb0], esi
mov esi, edx
xor esi, dword [ebp - 0xbb0]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0xba4]
xor eax, edx
mov dword [ebp - 0xba4], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xba4]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xba4]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xba4], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xba4]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xba4]
xor edx, eax
mov dword [ebp - 0xba4], edx
mov eax, dword [ebp - 0xba4]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xba4]
xor eax, edx
mov dword [ebp - 0xba4], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xba4]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xba4]
xor eax, edx
mov dword [ebp - 0xba4], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xba4]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0xba4]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0xbb0], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xbb0]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xbb0]
xor eax, edx
mov dword [ebp - 0xbb0], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0xab69
rol esi, 7
rol eax, 5
imul eax, eax, 0x7f1
add eax, esi
mov esi, dword [ebp - 0xbb0]
xor esi, eax
mov dword [ebp - 0xbb0], esi
xor esi, edx
mov edx, dword [ebp - 0xbb0]
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xbb0], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xbb0]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xbb0]
xor eax, edx
mov dword [ebp - 0xbb0], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xbb0]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xbb0]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xbb0], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xbb0]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xbb0]
xor edx, dword [ebp - 0xbac]
xor eax, dword [ebp - 0xb9c]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xba4], esi
mov esi, dword [ebp - 0xb88]
mov dword [ebp - 0xbac], ebx
mov dword [ebp - 0xb9c], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xc04], 1
mov dword [ebp - 0xb88], esi
mov esi, eax
mov dword [ebp - 0xbb0], eax
jne 0x419d14
mov esi, dword [ebp - 0xb8c]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x41a0a1
movzx eax, cl
cdq
cmp eax, dword [0x402f80]
jne 0x41a0cc
cmp edx, dword [0x402f84]
jne 0x41a0cc
mov edi, esi
mov dword [ebp - 0xbd8], esi
mov esi, ebx
jmp 0x41a0df
or dword [ebp - 0xccc], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xb94], 0xc004d501
test esi, esi
je 0x41a0f2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xb94], ebx
jl 0x41a258
mov eax, dword [ebp - 0xccc]
mov esi, edi
push 0x40
push ebx
push 0x425930
mov byte [eax + edi], bl
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
cmp byte [edi], bl
je 0x41a265
mov edi, 0x425930
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb94], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41a133
sub ecx, dword [ebp - 0xb94]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x41a251
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb94], ecx
cmp word [eax], dx
je 0x41a17b
mov ecx, 0xc000007b
mov dword [ebp - 0xb94], ecx
jmp 0x41a1c3
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x41a16e
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x41a16e
cmp dword [edx], 0x4550
jne 0x41a16e
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xcd0]
je 0x41a1b1
cmp ax, word [ebp - 0xcc4]
je 0x41a1b1
mov ecx, 0xc000000d
jmp 0x41a173
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb8c], eax
mov dword [ebp - 0xbac], ebx
test eax, eax
je 0x41a23e
mov edx, esi
mov dword [ebp - 0xb9c], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb88], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x41a1ea
sub edx, dword [ebp - 0xb88]
inc esi
add esi, edx
test ecx, ecx
js 0x41a223
push dword [ebp - 0xb9c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41a249
mov ecx, dword [ebp - 0xbd4]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xb94]
mov eax, dword [ebp - 0xbac]
inc dword [ebp - 0xbd4]
inc eax
mov dword [ebp - 0xbac], eax
cmp eax, dword [ebp - 0xb8c]
jb 0x41a1d9
add edi, 0x10
cmp byte [esi], bl
jne 0x41a126
mov esi, dword [ebp - 0xb94]
jmp 0x41a267
mov esi, 0xc000007a
jmp 0x41a267
mov edi, dword [ebp - 0xbd8]
mov esi, 0xc000007a
jmp 0x41a26d
mov esi, ebx
mov edi, dword [ebp - 0xbd8]
test edi, edi
je 0x41a280
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x41a2c0
mov esi, ebx
mov eax, dword [esi + 0x425930]
test eax, eax
je 0x41a297
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x41a286
push 0x40
push ebx
push 0x425930
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x401090
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x41a2cb
mov eax, dword [0x425e24]
inc eax
mov dword [0x425e24], eax
xor eax, eax
mov edi, 0x425e28
xchg dword [edi], eax
mov eax, dword [ebp - 0xba8]
xor ecx, ecx
mov esi, dword [0x424068]
inc ecx
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0x324], eax
lea eax, [ebp - 0x340]
push eax
push 4
push 0x2021
mov dword [ebp - 0x340], ecx
mov dword [ebp - 0x338], ecx
mov dword [ebp - 0x32c], ecx
mov dword [ebp - 0x330], ecx
mov dword [ebp - 0x328], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x334], 0x9966f291
call dword [0x426478]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x41a338
mov eax, dword [0x425e24]
push 0
pop ebx
test eax, eax
jle 0x41a39a
sub eax, 1
mov dword [0x425e24], eax
jne 0x41a39a
mov esi, ebx
mov eax, dword [esi + 0x425930]
test eax, eax
je 0x41a36e
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x41a35d
push 0x40
push ebx
push 0x425930
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x401090
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x425e28
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xbc4]
mov esi, dword [0x4240b0]
mov ecx, esi
push ebx
call dword [0x426478]
call esi
lea ecx, [ebp - 0xc40]
call fcn.0041ef84
xor eax, eax
mov dword [ebp - 0xd18], ebx
lea edi, [ebp - 0xd2c]
mov esi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xbc4], eax
test eax, eax
je 0x41bd6f
push 0x28
pop ecx
mov esi, 0x4247e0
mov dword [ebp - 0xbc8], eax
mov edi, eax
rep movsd dword es:[edi], dword [esi]
push 8
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xba8], esi
test esi, esi
je 0x41bd69
mov ecx, dword [0x4247d8]
mov edi, esi
mov dword [esi], ecx
mov ecx, dword [0x4247dc]
mov dword [esi + 4], ecx
mov dword [ebp - 0xbd4], edi
rdtsc
mov dword [ebp - 0xbd8], eax
mov dword [ebp - 0xb94], edx
mov eax, 0xc4
push eax
push 8
mov dword [ebp - 0xd1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x41bdf6
mov dword [ebp - 0xd18], edx
mov dword [ebp - 0xd20], ebx
lea edi, [edx + 4]
cmp edi, edx
jb 0x41bd5b
mov ecx, dword [ebp - 0xd1c]
lea eax, [edx + 8]
add ecx, edx
cmp eax, ecx
ja 0x41bd5b
push 4
pop eax
mov dword [edx], eax
mov dword [edi], eax
mov edi, dword [ebp - 0xd20]
inc edi
mov dword [ebp - 0xd20], edi
cmp dword [ebp - 0xd18], 0
jne 0x41a4e0
mov eax, dword [ebp - 0xd1c]
lea ecx, [eax + 0xa4]
cmp ecx, eax
jb 0x41bd5b
lea eax, [edi + 1]
mov dword [ebp - 0xd1c], ecx
mov dword [ebp - 0xd20], eax
jmp 0x41a553
mov edx, dword [ebp - 0xd18]
mov ecx, ebx
test edi, edi
je 0x41a50b
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x41bd5b
add eax, edx
cmp eax, edx
jb 0x41bd5b
inc ecx
mov edx, eax
cmp ecx, edi
jb 0x41a4ec
lea edi, [edx + 4]
cmp edi, edx
jb 0x41bd5b
mov ecx, dword [ebp - 0xd1c]
lea eax, [edx + 0xa4]
add ecx, dword [ebp - 0xd18]
cmp eax, ecx
ja 0x41bd5b
mov esi, dword [ebp - 0xbc4]
push 0x28
mov dword [edx], 0xa0
pop ecx
rep movsd dword es:[edi], dword [esi]
inc dword [ebp - 0xd20]
mov ecx, dword [ebp - 0xd1c]
mov esi, dword [ebp - 0xba8]
cmp dword [ebp - 0xd18], 0
jne 0x41a56f
lea eax, [ecx + 0xc]
cmp eax, ecx
jb 0x41bd5b
inc dword [ebp - 0xd20]
jmp 0x41a5eb
cmp dword [ebp - 0xd20], 0
mov edi, ebx
mov edx, dword [ebp - 0xd18]
jbe 0x41a5a3
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x41bd5b
add eax, edx
cmp eax, edx
jb 0x41bd5b
inc edi
mov edx, eax
cmp edi, dword [ebp - 0xd20]
jb 0x41a580
lea edi, [edx + 4]
cmp edi, edx
jb 0x41bd5b
add ecx, dword [ebp - 0xd18]
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0x41bd5b
mov dword [edx], 8
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0xd20]
inc eax
mov dword [ebp - 0xd20], eax
cmp dword [ebp - 0xd18], 0
jne 0x41a5fe
mov eax, dword [ebp - 0xd1c]
lea ecx, [eax + 0xc]
cmp ecx, eax
jb 0x41bd5b
mov dword [ebp - 0xd1c], ecx
jmp 0x41a66c
mov edx, dword [ebp - 0xd18]
mov ecx, ebx
test eax, eax
je 0x41a62d
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x41bd5b
add eax, edx
cmp eax, edx
jb 0x41bd5b
inc ecx
mov edx, eax
cmp ecx, dword [ebp - 0xd20]
jb 0x41a60a
lea esi, [edx + 4]
cmp esi, edx
jb 0x41bd5b
mov ecx, dword [ebp - 0xd1c]
lea eax, [edx + 0xc]
add ecx, dword [ebp - 0xd18]
cmp eax, ecx
ja 0x41bd5b
mov eax, dword [ebp - 0xbd8]
mov dword [edx], 8
mov dword [esi], eax
mov eax, dword [ebp - 0xb94]
mov dword [esi + 4], eax
mov ecx, dword [ebp - 0xd1c]
inc dword [ebp - 0xd20]
rdtsc
mov edi, ebx
mov dword [ebp - 0xbc4], ebx
mov dword [ebp - 0xba8], ebx
mov dword [ebp - 0xbd8], edi
mov dword [ebp - 0xb94], ebx
mov dword [ebp - 0xb8c], ebx
mov dword [ebp - 0xbac], ebx
mov dword [ebp - 0xb9c], ebx
mov dword [ebp - 0xb88], ebx
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xbb0], eax
mov dword [ebp - 0xb84], edx
add ecx, 8
cmp ecx, 8
jb 0x41a788
lea eax, [ecx + 7]
and eax, 0xfffffff8
mov dword [ebp - 0xba0], eax
cmp eax, ecx
jb 0x41a788
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb7c], ecx
test ecx, ecx
jne 0x41a6fe
mov esi, 0xc0000017
jmp 0x41a78d
mov eax, dword [ebp - 0xd20]
lea edx, [ecx + 4]
mov dword [ecx], eax
cmp edx, ecx
jb 0x41a76e
mov eax, dword [ebp - 0xd1c]
mov dword [edx], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x41a76e
mov eax, dword [ebp - 0xba0]
mov esi, ebx
mov edi, dword [ebp - 0xbb0]
mov dword [ecx + eax - 8], edi
mov edi, dword [ebp - 0xb84]
mov dword [ecx + eax - 4], edi
lea eax, [edx + 4]
push dword [ebp - 0xd1c]
push dword [ebp - 0xd18]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [ebp - 0xb7c]
add esp, 0xc
mov eax, dword [ebp - 0xba0]
mov edi, ebx
mov dword [ebp - 0xbc4], ecx
mov ecx, ebx
mov dword [ebp - 0xba8], eax
jmp 0x41a773
mov esi, 0xc0000095
test ecx, ecx
je 0x41a78d
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x41a78d
mov esi, 0xc0000095
or esi, 0x10000000
jl 0x41bbaf
cmp dword [ebp - 0xbc4], 0
mov dword [ebp - 0xbb0], ebx
jne 0x41a7b2
mov esi, 0xc000000d
jmp 0x41adf8
mov esi, dword [ebp - 0xba8]
test esi, esi
je 0x41adf3
lea eax, [esi + 8]
push eax
push ebx
mov dword [ebp - 0xb84], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xba0], eax
test eax, eax
je 0x41adf3
mov edi, dword [ebp - 0xbc4]
mov cl, bl
mov eax, ebx
test esi, esi
je 0x41a7fc
xor cl, byte [eax + edi]
inc eax
cmp eax, esi
jb 0x41a7f4
mov eax, 0xb1b54a58
mov dword [ebp - 0x3b8], eax
mov eax, 0xc81ecb17
mov dword [ebp - 0x3b4], eax
mov eax, esi
shr eax, 3
mov dword [ebp - 0xb7c], eax
test eax, eax
je 0x41ac13
movzx edx, word [ebp - 0x3b6]
mov eax, 0xc81ecb17
movzx esi, ax
movzx eax, word [ebp - 0x3b2]
mov dword [ebp - 0xb80], eax
mov eax, 0xb1b54a58
movzx eax, ax
mov dword [ebp - 0xb90], eax
mov eax, dword [ebp - 0xba0]
add eax, 7
mov dword [ebp - 0xbb8], esi
or dword [ebp - 0xbbc], 0xffffffff
lea esi, [edi + 2]
mov dword [ebp - 0xbc0], edx
mov edx, ebx
mov dword [ebp - 0xbd0], ebx
mov dword [ebp - 0xbcc], ebx
mov ebx, dword [ebp - 0xbbc]
mov dword [ebp - 0xbb4], eax
mov dword [ebp - 0xb98], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xb98]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xb98]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xb98]
shl esi, 8
add dword [ebp - 0xb98], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov eax, ebx
sub eax, dword [ebp - 0xb90]
xor eax, 0xc81ecb17
xor eax, edi
xor edx, eax
mov dword [ebp - 0xbbc], edx
mov edx, 0xc81ecb17
mov eax, dword [ebp - 0xbbc]
xor edx, eax
ror edx, 0xf
imul edx, dword [ebp - 0xbc0]
ror eax, 7
add edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
mov eax, ebx
ror eax, 0xa
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [ebp - 0xbb8]
sub edx, eax
mov eax, dword [ebp - 0xbbc]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xbbc], eax
xor edx, dword [ebp - 0xbb8]
rol edx, 4
imul edx, dword [ebp - 0xb80]
rol eax, 5
add edx, eax
mov eax, 0xc81ecb17
xor ebx, edx
mov edx, 0xb1b54a58
xor edx, ebx
sub eax, edx
mov edx, dword [ebp - 0xbbc]
xor edx, eax
mov dword [ebp - 0xbbc], edx
sub edx, dword [ebp - 0xb90]
imul edx, dword [ebp - 0xbc0]
mov eax, dword [ebp - 0xbbc]
shr eax, 6
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xbbc]
mov eax, ebx
ror eax, 0xf
xor eax, dword [ebp - 0xbb8]
imul eax, dword [ebp - 0xb90]
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [ebp - 0xb80]
imul eax, dword [ebp - 0xbb8]
xor ebx, eax
mov eax, ebx
sub eax, dword [ebp - 0xb90]
sub eax, 0xc81ecb17
xor edx, eax
mov dword [ebp - 0xbbc], edx
mov eax, dword [ebp - 0xbbc]
xor eax, dword [ebp - 0xb80]
imul eax, dword [ebp - 0xbc0]
ror edx, 0xa
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb90]
xor edx, ebx
mov eax, ebx
rol edx, 6
imul edx, dword [ebp - 0xbb8]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0xbbc]
xor eax, edx
mov dword [ebp - 0xbbc], eax
ror eax, 0xf
sub eax, dword [ebp - 0xb80]
imul eax, dword [ebp - 0xb90]
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xb80]
imul edx, dword [ebp - 0xb90]
shr eax, 1
xor edx, eax
mov eax, ebx
xor dword [ebp - 0xbbc], edx
mov edx, ebx
sub edx, dword [ebp - 0xbb8]
rol edx, 3
imul edx, dword [ebp - 0xb90]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0xbbc]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xbbc], eax
sub edx, dword [ebp - 0xbb8]
imul edx, dword [ebp - 0xbc0]
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 9
imul edx, dword [ebp - 0xbb8]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0xbbc]
xor eax, edx
mov dword [ebp - 0xbbc], eax
sub eax, 0xb1b54a58
sub eax, dword [ebp - 0xb80]
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xbc0]
imul eax, dword [ebp - 0xb90]
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0xbbc]
xor edx, eax
mov dword [ebp - 0xbbc], edx
xor edx, dword [ebp - 0xb80]
mov eax, dword [ebp - 0xbbc]
rol edx, 4
imul edx, dword [ebp - 0xbc0]
ror eax, 0x10
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
ror edx, 0xa
imul edx, dword [ebp - 0xbb8]
mov eax, ebx
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0xbbc]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xbbc], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, dword [ebp - 0xb80]
xor edx, eax
xor ebx, edx
mov edx, 0xc81ecb17
xor edx, ebx
mov eax, ebx
rol edx, 8
imul edx, dword [ebp - 0xb90]
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xbbc]
xor eax, edx
mov edx, 0xc81ecb17
sub edx, eax
mov dword [ebp - 0xbbc], eax
ror edx, 0xb
imul edx, dword [ebp - 0xbc0]
ror eax, 0xc
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xbc0]
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0xbb8]
shr eax, 8
xor edx, eax
mov eax, 0xc81ecb17
xor dword [ebp - 0xbbc], edx
xor eax, 0xb1b54a58
mov edx, dword [ebp - 0xbbc]
xor ebx, eax
mov eax, dword [ebp - 0xbb4]
xor ebx, edx
xor edx, dword [ebp - 0xbd0]
xor ebx, dword [ebp - 0xbcc]
mov dword [ebp - 0xbcc], esi
mov esi, dword [ebp - 0xb98]
mov byte [eax - 4], dl
mov byte [eax], bl
ror edx, 8
mov byte [eax - 5], dl
ror ebx, 8
mov byte [eax - 1], bl
ror edx, 8
mov byte [eax - 6], dl
ror ebx, 8
mov byte [eax - 2], bl
ror edx, 8
ror ebx, 8
mov byte [eax - 7], dl
mov byte [eax - 3], bl
add eax, 8
ror edx, 8
ror ebx, 8
sub dword [ebp - 0xb7c], 1
mov dword [ebp - 0xbd0], edi
mov dword [ebp - 0xbb4], eax
jne 0x41a88e
mov esi, dword [ebp - 0xba8]
xor ebx, ebx
movzx eax, cl
mov ecx, dword [ebp - 0xba0]
cdq
mov dword [ecx + esi], eax
mov dword [ecx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xba8], edi
test edi, edi
jne 0x41ac4b
mov esi, 0xc0000017
jmp 0x41ad4d
mov esi, dword [ebp - 0xb84]
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x41ac70
mov esi, 0xc0000017
jmp 0x41acec
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0xba0]
push esi
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41ac69
mov dword [edi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0x424730
push 8
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xba8]
pop eax
push eax
push eax
mov dword [edi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41ac69
mov dword [edi + 0x14], ecx
mov eax, dword [0x4247d0]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0x4247d4]
mov dword [ebp - 0xbb0], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0x41ad4d
cmp dword [edi + 4], 0
je 0x41ad0a
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x41ad24
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x41ad3e
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x41ad65
mov edi, dword [ebp - 0xbb0]
mov dword [ebp - 0xbd8], edi
mov dword [ebp - 0xbb0], ebx
jmp 0x41ad67
mov edi, ebx
push dword [ebp - 0xba0]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xbb0]
test eax, eax
je 0x41adf8
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41ada4
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xbb0]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x41adc3
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xbb0]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x41ade2
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xbb0]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x41adf8
mov esi, 0xc0000001
or esi, 0x10000000
jl 0x41bbaf
mov eax, dword [edi]
mov esi, dword [edi + 0x10]
add eax, 4
mov ecx, dword [edi + 8]
cmp eax, 4
jb 0x41af19
lea edx, [eax + 4]
cmp edx, eax
jb 0x41af19
add ecx, edx
cmp ecx, edx
jb 0x41af19
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x41af19
lea ecx, [eax + esi]
mov dword [ebp - 0xba8], ecx
cmp ecx, eax
jb 0x41af19
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xbb0], esi
test esi, esi
jne 0x41ae6f
mov esi, 0xc0000017
jmp 0x41af1e
mov eax, dword [edi]
mov dword [esi], eax
lea eax, [esi + 4]
cmp eax, esi
jb 0x41aef9
push dword [edi]
push dword [edi + 4]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi]
lea ecx, [esi + 4]
add edx, ecx
add esp, 0xc
cmp edx, ecx
jb 0x41aef9
mov eax, dword [edi + 8]
lea esi, [edx + 4]
mov dword [edx], eax
cmp esi, edx
jb 0x41aef9
push dword [edi + 8]
push dword [edi + 0xc]
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [edi + 8]
add esp, 0xc
add ecx, esi
cmp ecx, esi
jb 0x41aef9
mov eax, dword [edi + 0x10]
lea esi, [ecx + 4]
mov dword [ecx], eax
cmp esi, ecx
jb 0x41aef9
push dword [edi + 0x10]
push dword [edi + 0x14]
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [edi + 0x10]
add esp, 0xc
add eax, esi
cmp eax, esi
mov eax, dword [ebp - 0xbb0]
jb 0x41aeff
mov ecx, dword [ebp - 0xba8]
mov esi, ebx
mov dword [ebp - 0xb94], eax
mov eax, ebx
mov dword [ebp - 0xb8c], ecx
jmp 0x41af04
mov eax, dword [ebp - 0xbb0]
mov esi, 0xc0000095
test eax, eax
je 0x41af1e
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x41af1e
mov esi, 0xc0000095
or esi, 0x10000000
jl 0x41bbaf
cmp dword [ebp - 0xd18], 0
jne 0x41af3d
mov esi, 0xc000000d
jmp 0x41afd0
xor eax, eax
inc eax
cmp dword [ebp - 0xd20], eax
jbe 0x41af33
mov ecx, dword [ebp - 0xd18]
mov edx, ebx
mov esi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x41afcb
lea ecx, [esi + eax]
cmp ecx, eax
jb 0x41afcb
xor eax, eax
inc edx
inc eax
cmp edx, eax
jb 0x41af50
mov edi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x41afcb
cmp dword [ebp - 0xd20], 2
jbe 0x41af33
mov ecx, dword [ebp - 0xd18]
mov edx, ebx
mov esi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x41afcb
lea ecx, [esi + eax]
cmp ecx, eax
jb 0x41afcb
inc edx
cmp edx, 2
jb 0x41af82
mov edx, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x41afcb
lea eax, [edi + 0x30]
cmp eax, 0x30
jb 0x41afcb
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x41afcb
lea edi, [ecx + edx]
cmp edi, ecx
jb 0x41afcb
mov esi, ebx
cmp edi, 0x400000
jbe 0x41afd2
mov esi, 0x8000ffff
jmp 0x41bbaf
mov esi, 0xc0000095
mov edi, ebx
test esi, esi
js 0x41bbaf
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x41aff7
mov esi, 0xd0000017
mov eax, ebx
jmp 0x41b002
mov dword [ebp - 0xbac], eax
mov esi, 0x10000000
test esi, esi
js 0x41bbaf
mov ecx, dword [ebp - 0xb94]
test ecx, ecx
jne 0x41b01e
mov esi, 0x80070057
jmp 0x41bbaf
test eax, eax
je 0x41b014
mov dword [ebp - 0xd50], eax
lea eax, [ebp - 0xc3c]
push eax
xor eax, eax
mov dword [ebp - 0xd54], ecx
mov ecx, dword [ebp - 0xb8c]
inc eax
push 0x401af0
push eax
mov dword [ebp - 0xd4c], ecx
mov dword [ebp - 0xd48], edi
mov dword [ebp - 0xd44], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x41b080
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41b077
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x41b0c0
mov esi, 0x80004005
jmp 0x41b0c0
push 0x404c20
push dword [ebp - 0xc3c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x41b060
push ebx
push 0x14
lea eax, [ebp - 0xd54]
mov ecx, esi
push eax
push 0x86
call dword [0x426478]
call esi
mov esi, eax
or esi, 0x10000000
jl 0x41b0c0
mov edi, dword [ebp - 0xd48]
cmp esi, 0xd0000023
jne 0x41b0d2
mov esi, 0x8007007a
jmp 0x41bbaf
test esi, esi
js 0x41bbaf
mov dword [ebp - 0xba8], ebx
cmp edi, 4
jae 0x41b0ef
mov esi, 0xc000003e
jmp 0x41b410
mov eax, dword [ebp - 0xbac]
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x41b40b
lea eax, [edi - 4]
cmp eax, esi
jb 0x41b0e5
lea edx, [ecx + esi]
mov dword [ebp - 0xb8c], edx
cmp edx, ecx
jb 0x41b40b
lea ecx, [esi + 4]
cmp ecx, 4
jb 0x41b40b
mov eax, edi
sub eax, ecx
cmp eax, 4
jb 0x41b0e5
mov ecx, dword [edx]
add edx, 4
mov dword [ebp - 0xbb0], ecx
cmp edx, dword [ebp - 0xb8c]
jb 0x41b40b
lea eax, [esi + 4]
lea ecx, [eax + 4]
mov dword [ebp - 0xb84], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0xbb0]
jb 0x41b40b
mov eax, edi
sub eax, dword [ebp - 0xb84]
cmp eax, ecx
jb 0x41b0e5
lea eax, [edx + ecx]
mov dword [ebp - 0xba0], eax
cmp eax, edx
jb 0x41b40b
mov eax, dword [ebp - 0xb84]
lea edx, [eax + ecx]
mov dword [ebp - 0xb84], edx
cmp edx, eax
jb 0x41b40b
mov eax, edi
sub eax, edx
cmp eax, 4
jb 0x41b0e5
mov eax, dword [ebp - 0xba0]
mov edx, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xba0], edx
mov dword [ebp - 0xb7c], ecx
cmp ecx, eax
jb 0x41b40b
mov eax, dword [ebp - 0xb84]
add eax, 4
mov dword [ebp - 0xb80], eax
cmp eax, dword [ebp - 0xb84]
jb 0x41b40b
mov eax, edi
sub eax, dword [ebp - 0xb80]
cmp eax, edx
jb 0x41b0e5
mov eax, dword [ebp - 0xb80]
lea ecx, [eax + edx]
mov dword [ebp - 0xb84], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0xbb0]
jb 0x41b40b
mov eax, edi
sub eax, dword [ebp - 0xb84]
jne 0x41b0e5
lea eax, [ecx + 0xc]
add eax, esi
add eax, edx
cmp eax, edi
jne 0x41b0e5
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x41b24a
mov esi, 0xc0000017
jmp 0x41b38e
mov eax, dword [ebp - 0xbac]
add eax, 4
je 0x41b290
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x41b277
mov esi, 0xc0000017
jmp 0x41b32d
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0xbac]
push esi
add eax, 4
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0x41b295
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov eax, dword [ebp - 0xb8c]
add eax, 4
je 0x41b2d8
mov esi, dword [ebp - 0xbb0]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x41b26d
mov dword [edi + 0xc], edx
mov eax, dword [ebp - 0xb8c]
push esi
add eax, 4
push eax
push edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0x41b2de
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [ebp - 0xb7c], 0
je 0x41b31d
mov esi, dword [ebp - 0xba0]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41b26d
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xb7c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0x41b323
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 0xba8], edi
mov esi, ebx
mov edi, ebx
test edi, edi
je 0x41b38e
cmp dword [edi + 4], 0
je 0x41b34b
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x41b365
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x41b37f
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x41b3a2
mov eax, dword [ebp - 0xba8]
mov edi, ebx
mov dword [ebp - 0xb9c], eax
jmp 0x41b3a8
mov edi, dword [ebp - 0xba8]
test edi, edi
je 0x41b410
cmp dword [edi + 4], 0
je 0x41b3c6
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x41b3e0
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x41b3fa
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x41b410
mov esi, 0xc0000095
or esi, 0x10000000
jl 0x41bbaf
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0xba8], ebx
mov dword [ebp - 0xb8c], ebx
test eax, eax
jne 0x41b43c
mov esi, 0xd000000d
jmp 0x41bbaf
mov esi, dword [eax + 4]
mov dword [ebp - 0xbb0], esi
test esi, esi
je 0x41b432
mov edi, dword [eax]
test edi, edi
je 0x41b432
add edi, 0xfffffff8
mov dword [ebp - 0xb84], ebx
push edi
push ebx
mov dword [ebp - 0xba0], edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb7c], eax
test eax, eax
je 0x41ba3e
mov dword [ebp - 0xb80], esi
mov ecx, 0xab69605e
mov dword [ebp - 0x3c0], ecx
mov ecx, 0x7f1137f
mov dword [ebp - 0x3bc], ecx
mov ecx, eax
mov dword [ebp - 0xb90], ecx
mov dl, bl
mov dword [ebp - 0xbb8], ebx
and edi, 7
je 0x41b5c2
mov dword [ebp - 0xbb4], ebx
mov eax, ebx
mov dword [ebp - 0xbc0], eax
test edi, edi
je 0x41b51d
push 0x38
pop ecx
movzx eax, byte [esi]
inc esi
cmp dword [ebp - 0xbb4], 4
jge 0x41b4e5
add ecx, 0xffffffe0
shl eax, cl
or dword [ebp - 0xbb8], eax
mov ecx, dword [ebp - 0xbf8]
jmp 0x41b4e9
shl eax, cl
or ebx, eax
mov eax, dword [ebp - 0xbb4]
sub ecx, 8
inc eax
mov dword [ebp - 0xbf8], ecx
mov dword [ebp - 0xbb4], eax
cmp eax, edi
jl 0x41b4c5
mov ecx, dword [ebp - 0xb90]
mov dword [ebp - 0xbc0], ebx
xor ebx, ebx
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xb80], esi
mov esi, dword [ebp - 0xbb8]
xor eax, 0x699a899c
xor esi, 0x92f65a5
mov dword [ebp - 0xbbc], eax
mov dword [ebp - 0xbb4], esi
mov dword [ebp - 0xb98], esi
mov dword [ebp - 0xbd0], ebx
test edi, edi
je 0x41b593
mov esi, ebx
lea ebx, [ecx + 1]
mov dword [ebp - 0xb90], ebx
cmp esi, 4
jge 0x41b569
rol dword [ebp - 0xb98], 8
mov ebx, dword [ebp - 0xb98]
jmp 0x41b576
rol dword [ebp - 0xbbc], 8
mov ebx, dword [ebp - 0xbbc]
mov byte [ecx], bl
inc esi
mov ebx, dword [ebp - 0xb90]
mov ecx, ebx
cmp esi, edi
jl 0x41b54c
mov esi, dword [ebp - 0xbb4]
mov dword [ebp - 0xb90], ebx
xor ebx, ebx
cmp edi, 4
jbe 0x41b5ac
push 8
pop ecx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xb98], eax
jmp 0x41b5d7
mov dword [ebp - 0xb98], ebx
jae 0x41b5d7
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
jmp 0x41b5d1
or dword [ebp - 0xbc0], 0xffffffff
mov esi, ebx
mov dword [ebp - 0xb98], ebx
mov dword [ebp - 0xbb4], esi
mov ecx, dword [ebp - 0xba0]
mov eax, ecx
shr eax, 3
mov dword [ebp - 0xbbc], eax
test eax, eax
je 0x41b9c0
movzx esi, word [ebp - 0x3be]
mov ebx, 0x7f1137f
movzx ecx, word [ebp - 0x3ba]
mov edi, 0xab69605e
movzx eax, bx
xor ebx, edi
mov dword [ebp - 0xbcc], eax
movzx eax, di
mov dword [ebp - 0xbe4], eax
mov eax, dword [ebp - 0xb90]
mov dword [ebp - 0xbe0], esi
add eax, 7
mov esi, dword [ebp - 0xb80]
add esi, 2
mov dword [ebp - 0xbd0], ebx
mov ebx, dword [ebp - 0xbb4]
mov dword [ebp - 0xbf8], ecx
mov ecx, dword [ebp - 0xb98]
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0xb80], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xb80]
xor ebx, edi
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xb80]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xb80]
shl esi, 8
add dword [ebp - 0xb80], 8
movzx eax, byte [eax + 5]
or esi, eax
mov eax, dword [ebp - 0xbd0]
xor ecx, esi
xor eax, ecx
xor eax, ebx
mov ecx, eax
mov dword [ebp - 0xb98], eax
sub ecx, 0xab69605e
rol eax, 0xa
rol ecx, 5
imul ecx, dword [ebp - 0xbcc]
add ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ecx + ebx]
ror ecx, 9
imul ecx, dword [ebp - 0xbe0]
sub ecx, eax
mov eax, dword [ebp - 0xb98]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xb98], eax
sub ecx, dword [ebp - 0xbcc]
imul ecx, dword [ebp - 0xbe4]
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xbe0]
xor ecx, ebx
mov eax, ebx
rol ecx, 6
imul ecx, dword [ebp - 0xbf8]
rol eax, 2
sub ecx, eax
mov eax, dword [ebp - 0xb98]
xor eax, ecx
mov ecx, 0xab69605e
xor ecx, eax
mov dword [ebp - 0xb98], eax
mov eax, 0x7f1137f
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, dword [ebp - 0xbcc]
imul eax, dword [ebp - 0xbe0]
ror ecx, 6
xor ecx, eax
mov eax, dword [ebp - 0xb98]
xor eax, ecx
mov ecx, 0x7f1137f
add ecx, eax
mov dword [ebp - 0xb98], eax
ror ecx, 0xf
imul ecx, dword [ebp - 0xbe4]
rol eax, 2
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0xbf8]
sub ecx, eax
mov eax, dword [ebp - 0xb98]
xor eax, ecx
mov ecx, 0xab69605e
xor ecx, eax
mov dword [ebp - 0xb98], eax
ror ecx, 0xc
imul ecx, dword [ebp - 0xbcc]
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xbf8]
xor ecx, ebx
mov eax, ebx
imul ecx, dword [ebp - 0xbe0]
shr eax, 0xa
xor ecx, eax
mov eax, dword [ebp - 0xb98]
xor eax, ecx
mov ecx, dword [ebp - 0xbf8]
mov dword [ebp - 0xb98], eax
not eax
ror eax, 5
add eax, dword [ebp - 0xbe4]
imul eax, ecx
xor ebx, eax
mov eax, ebx
sub eax, ecx
xor eax, 0xab69605e
xor dword [ebp - 0xb98], eax
mov eax, dword [ebp - 0xb98]
xor ecx, eax
rol ecx, 2
imul ecx, dword [ebp - 0xbcc]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 6
imul ecx, dword [ebp - 0xbe0]
rol eax, 7
add ecx, eax
mov eax, dword [ebp - 0xb98]
xor eax, ecx
mov dword [ebp - 0xb98], eax
mov ecx, eax
xor eax, dword [ebp - 0xbcc]
imul eax, dword [ebp - 0xbe4]
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xbe0]
xor ecx, ebx
mov eax, ebx
rol ecx, 5
imul ecx, dword [ebp - 0xbf8]
rol eax, 7
add ecx, eax
xor dword [ebp - 0xb98], ecx
mov ecx, dword [ebp - 0xb98]
xor ebx, ecx
xor ebx, dword [ebp - 0xbd0]
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xbe0]
imul eax, dword [ebp - 0xbcc]
xor ecx, eax
mov eax, 0x7f1137f
mov dword [ebp - 0xb98], ecx
sub ecx, eax
mov eax, dword [ebp - 0xb98]
ror ecx, 1
imul ecx, dword [ebp - 0xbe4]
ror eax, 6
sub ecx, eax
xor ebx, ecx
mov ecx, 0xab69605e
mov eax, ebx
rol eax, 0xe
lea ecx, [ecx + ebx]
rol ecx, 3
imul ecx, dword [ebp - 0xbf8]
add ecx, eax
mov eax, dword [ebp - 0xb98]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0xb98], eax
rol ecx, 0xf
imul ecx, dword [ebp - 0xbcc]
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xbe4]
xor ecx, ebx
mov eax, ebx
imul ecx, dword [ebp - 0xbe0]
shr eax, 3
xor ecx, eax
mov eax, dword [ebp - 0xb98]
xor eax, ecx
mov ecx, 0x7f1137f
xor ecx, eax
mov dword [ebp - 0xb98], eax
rol ecx, 4
imul ecx, dword [ebp - 0xbe4]
rol eax, 2
xor ecx, eax
mov eax, dword [ebp - 0xb90]
xor ecx, dword [ebp - 0xbb8]
xor ebx, ecx
mov dword [ebp - 0xbb8], edi
mov ecx, dword [ebp - 0xb98]
xor ecx, dword [ebp - 0xbc0]
mov byte [eax - 4], bl
mov byte [eax], cl
ror ebx, 8
mov byte [eax - 5], bl
ror ecx, 8
mov byte [eax - 1], cl
ror ebx, 8
mov byte [eax - 6], bl
ror ecx, 8
mov byte [eax - 2], cl
ror ebx, 8
ror ecx, 8
mov byte [eax - 7], bl
mov byte [eax - 3], cl
add eax, 8
ror ebx, 8
ror ecx, 8
sub dword [ebp - 0xbbc], 1
mov dword [ebp - 0xbc0], esi
mov esi, dword [ebp - 0xb80]
mov dword [ebp - 0xb90], eax
jne 0x41b658
mov ecx, dword [ebp - 0xba0]
xor ebx, ebx
mov esi, dword [ebp - 0xb7c]
mov eax, ebx
test ecx, ecx
je 0x41b9d4
xor dl, byte [eax + esi]
inc eax
cmp eax, ecx
jb 0x41b9cc
mov edi, dword [ebp - 0xbb0]
movzx eax, dl
cdq
cmp eax, dword [ecx + edi]
jne 0x41b9fb
cmp edx, dword [ecx + edi + 4]
jne 0x41b9fb
mov edi, esi
mov dword [ebp - 0xb8c], ecx
mov dword [ebp - 0xba8], edi
mov esi, ebx
jmp 0x41ba07
mov dword [ebp - 0xb84], 0xc004d501
mov edi, ebx
test esi, esi
je 0x41ba1a
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xb84], 0
jl 0x41ba3e
mov dword [ebp - 0xb88], edi
mov eax, ebx
mov edi, dword [ebp - 0xb8c]
mov esi, 0x10000000
mov dword [ebp - 0xba4], edi
jmp 0x41ba4b
mov eax, dword [ebp - 0xba8]
mov esi, 0xd0000001
mov edi, ebx
test eax, eax
je 0x41ba5e
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x41bbaf
cmp edi, 4
jae 0x41ba75
mov esi, 0xc000003e
jmp 0x41bba9
mov edx, dword [ebp - 0xb88]
mov eax, dword [edx]
lea ecx, [edx + 4]
mov dword [ebp - 0xba8], eax
cmp ecx, edx
jb 0x41bba4
lea eax, [edi - 4]
cmp eax, 4
jb 0x41ba6b
mov edi, dword [ecx]
lea esi, [ecx + 4]
cmp esi, ecx
jb 0x41bba4
mov ecx, dword [ebp - 0xba4]
lea eax, [ecx - 8]
cmp eax, edi
jb 0x41ba6b
lea eax, [edi + 8]
cmp eax, 8
jb 0x41bba4
mov eax, dword [ebp - 0xb88]
lea edx, [edi + esi]
add eax, ecx
cmp eax, edx
jb 0x41ba6b
sub ecx, edi
sub ecx, esi
add ecx, dword [ebp - 0xb88]
cmp ecx, 8
jae 0x41ba6b
mov dword [ebp - 0xba4], ebx
mov eax, ebx
mov dword [ebp - 0xb8c], eax
test esi, esi
je 0x41bb31
mov ecx, esi
cmp edx, esi
jb 0x41bba4
jbe 0x41bb2d
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x41bba4
cmp eax, edx
ja 0x41bb56
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0x41bb5d
add eax, ecx
cmp eax, ecx
jb 0x41bba4
mov ecx, eax
cmp ecx, edx
ja 0x41bb56
inc dword [ebp - 0xba4]
cmp ecx, edx
jb 0x41baf8
mov eax, ebx
cmp ecx, edx
jne 0x41bb56
test edi, edi
je 0x41bb64
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb8c], eax
test eax, eax
jne 0x41bb64
mov esi, 0xc0000017
jmp 0x41bb8d
mov esi, 0xc000000d
jmp 0x41bba9
mov esi, 0xc0000095
jmp 0x41bb8d
test esi, esi
je 0x41bb79
push edi
push esi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xb8c]
add esp, 0xc
mov dword [ebp - 0xd24], eax
mov eax, dword [ebp - 0xba4]
mov dword [ebp - 0xd2c], eax
mov esi, ebx
test esi, esi
js 0x41bba9
mov eax, dword [ebp - 0xba8]
cmp eax, dword [ebp - 0xd2c]
je 0x41bba9
jmp 0x41ba6b
mov esi, 0xc0000095
or esi, 0x10000000
mov eax, dword [ebp - 0xbc4]
test eax, eax
je 0x41bbc8
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xbd8]
test edi, edi
je 0x41bc2f
cmp dword [edi + 4], 0
je 0x41bbec
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x41bc06
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x41bc20
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb94]
test eax, eax
je 0x41bc48
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xbac]
test eax, eax
je 0x41bc61
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xb9c]
test edi, edi
je 0x41bcc8
cmp dword [edi + 4], 0
je 0x41bc85
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x41bc9f
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x41bcb9
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb88]
test eax, eax
je 0x41bce1
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x41bd5b
xor eax, eax
inc eax
cmp dword [ebp - 0xd2c], eax
jb 0x41bd5b
mov eax, dword [ebp - 0xd24]
test eax, eax
je 0x41bd5b
cmp dword [ebp - 0xd2c], 0
jbe 0x41bd5b
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x41bd10
mov eax, ebx
jmp 0x41bd18
or ecx, 0xffffffff
mov eax, 0xc0000095
test eax, eax
js 0x41bd5b
mov eax, edx
neg eax
sbb eax, eax
and eax, ecx
cmp edx, 4
jne 0x41bd5b
cmp dword [eax], 0
jl 0x41bd5b
xor eax, eax
inc eax
cmp dword [ebp - 0xd2c], eax
jbe 0x41bd5b
mov eax, dword [ebp - 0xd24]
mov edx, ebx
xor ebx, ebx
inc ebx
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x41bd59
lea eax, [esi + ecx]
cmp eax, ecx
jb 0x41bd59
inc edx
cmp edx, ebx
jb 0x41bd44
xor ebx, ebx
mov esi, dword [ebp - 0xbc8]
mov edi, dword [ebp - 0xbd4]
jmp 0x41bd71
mov esi, dword [ebp - 0xbc8]
mov edi, ebx
cmp dword [ebp - 0xd18], 0
mov dword [ebp - 0xd1c], ebx
mov dword [ebp - 0xd20], ebx
je 0x41bda0
push dword [ebp - 0xd18]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xd18], ebx
mov eax, dword [ebp - 0xd24]
test eax, eax
je 0x41bdb9
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x41bdcc
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x41bddf
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xcbc]
mov dword [ebp - 0xcbc], ebx
mov dword [ebp - 0xcd4], eax
jmp 0x41366d
mov esi, dword [ebp - 0xbc8]
jmp 0x41bd71
cmp eax, 0xd00000e5
je 0x41be1d
cmp eax, 0xc004d501
je 0x41be1d
cmp eax, 0xd000003e
jne 0x41be1f
mov eax, 0xc004f028
jmp 0x41be2a
mov eax, edi
test eax, eax
jns 0x41be2e
cmp eax, 0x8007007a
je 0x41be37
mov ebx, eax
jmp 0x41be3c
cmp dword [ebp - 0xc08], 4
je 0x41be3c
mov ebx, 0xc004f01e
lea ecx, [ebp - 0xcd4]
call fcn.0041ef4d
cmp ebx, edi
je 0x412a99
cmp ebx, 0xc004d301
je 0x412a99
cmp ebx, 0xc004d500
jle 0x41be6f
cmp ebx, 0xc004d502
jle 0x412a99
test ebx, ebx
jns 0x412a99
cmp ebx, esi
je 0x412a99
mov ecx, ebx
call fcn.0041ef35
jmp 0x412a99