Function at 0x100449f0
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Get process image filename
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d27a8
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb70
mov eax, dword [0x101140c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0xb4c], esi
mov eax, dword [ebx + 8]
mov dword [ebp - 0xa5c], eax
call fcn.1004c4d0
mov dword [ebp - 0xb48], eax
lea eax, [esi + 0x30]
mov dword [ebp - 0xb74], eax
add eax, 4
push eax
mov dword [ebp - method.AutoLock.virtual_0], vtable.AutoLock.0
mov dword [ebp - 0xb50], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0xa5c]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, dh
xor ecx, eax
movzx eax, byte [ebp - 0xa5a]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp - 0xa59]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x4c]
push eax
lea eax, [ebp - 0xa5c]
push eax
lea eax, [ebp - 0xb60]
push eax
call fcn.1004ade0
mov eax, dword [eax + 4]
test eax, eax
je 0x10044adb
cmp eax, dword [esi + 0x50]
jne 0x10045cb6
push 6
xorps xmm0, xmm0
mov dword [ebp - 0xa64], 0
push str.COMMON
lea ecx, [ebp - 0xa74]
mov dword [ebp - 0xa60], 0
movups xmmword [ebp - 0xa74], xmm0
call fcn.10032800
mov byte [ebp - 4], 1
push dword [ebp - 0xa5c]
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0xb54], edi
test edi, edi
je 0x10044c88
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
push eax
call fcn.10073590
add esp, 0xc
lea eax, [ebp - 0x428]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x10044c88
xor eax, eax
push 0x206
push eax
mov word [ebp - 0xa40], ax
lea eax, [ebp - 0xa3e]
push eax
call fcn.10073590
add esp, 0xc
xor eax, eax
mov word [ebp - 0x838], ax
push 0x206
push eax
lea eax, [ebp - 0x836]
push eax
call fcn.10073590
add esp, 0xc
xor eax, eax
mov word [ebp - 0x220], ax
push 0x206
push eax
lea eax, [ebp - 0x21e]
push eax
call fcn.10073590
add esp, 0xc
xor eax, eax
mov word [ebp - 0x630], ax
push 0x206
push eax
lea eax, [ebp - 0x62e]
push eax
call fcn.10073590
add esp, 0xc
lea eax, [ebp - 0x630]
push 0x104
push eax
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0x104
lea eax, [ebp - 0x838]
push eax
push 0x104
lea eax, [ebp - 0xa40]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.100a4751
lea ecx, [ebp - 0x220]
add esp, 0x24
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10044c30
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xa74]
call fcn.10039ad0
cmp dword [ebp - 0xa60], 7
lea eax, [ebp - 0xa74]
mov byte [ebp - 0xb24], 0
push dword [ebp - 0xb24]
cmova eax, dword [ebp - 0xa74]
push ecx
push eax
lea eax, [ebp - 0xa74]
push eax
lea eax, [ebp - 0xb60]
push eax
call fcn.10048a60
xorps xmm0, xmm0
movups xmmword [ebp - 0xa98], xmm0
movq qword [ebp - 0xa88], xmm0
call fcn.1004c4d0
cmp dword [ebp - 0xa60], 7
lea ecx, [ebp - 0xa74]
cmova ecx, dword [ebp - 0xa74]
push ecx
lea ecx, [ebp - 0xa98]
push ecx
mov ecx, eax
call fcn.1004eb00
mov byte [ebp - 4], 2
movzx eax, byte [ebp - 0xa90]
test eax, eax
je 0x10044cdb
cmp eax, 6
je 0x10044cdb
cmp eax, 7
jne 0x10044cf6
lea ecx, [ebp - 0xa98]
call fcn.1001ecc0
test eax, eax
jne 0x10044cf6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10045ca0
sub esp, 8
lea ecx, [ebp - 0xaf8]
mov eax, esp
mov dword [eax], str.DefaultSettings
mov dword [eax + 4], 0xf
call fcn.1003df80
add esp, 8
xorps xmm0, xmm0
mov byte [ebp - 4], 3
movups xmmword [ebp - 0xab0], xmm0
movq qword [ebp - 0xaa0], xmm0
call fcn.1004c4d0
cmp dword [ebp - 0xae4], 7
lea ecx, [ebp - 0xaf8]
cmova ecx, dword [ebp - 0xaf8]
push ecx
lea ecx, [ebp - 0xab0]
push ecx
mov ecx, eax
call fcn.1004eb00
movsd xmm0, qword [0x10104290]
mov byte [ebp - 0xb38], 3
and dword [ebp - 0xb38], 0xfffffeff
mov dword [ebp - 0xb34], 0
mov dword [ebp - 0xb30], 0
mov dword [ebp - 0xb2c], 0
movsd qword [ebp - 0xb40], xmm0
push 0x101033b1
push str.Threshold
lea ecx, [ebp - 0xab0]
mov byte [ebp - 4], 7
call fcn.1001fe20
test eax, eax
mov dword [ebp - 0xa4c], 0
lea esi, [ebp - 0xb40]
cmovne esi, eax
push esi
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 8
call fcn.1001f600
push esi
lea ecx, [ebp - 0xa58]
call fcn.1001f850
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 9
call fcn.1001e850
lea ecx, [ebp - 0xa58]
movsd qword [ebp - 0xb70], xmm0
call fcn.1001cf60
lea ecx, [ebp - 0xb40]
call fcn.1001cf60
movsd xmm0, qword [0x101042d0]
mov byte [ebp - 0xb38], 3
and dword [ebp - 0xb38], 0xfffffeff
mov dword [ebp - 0xb34], 0
mov dword [ebp - 0xb30], 0
mov dword [ebp - 0xb2c], 0
movsd qword [ebp - 0xb40], xmm0
push 0x1010398a
push str.FirstEvaluationTimeSec
lea ecx, [ebp - 0xab0]
mov byte [ebp - 4], 0xc
call fcn.1001fe20
test eax, eax
mov dword [ebp - 0xa4c], 0
lea esi, [ebp - 0xb40]
cmovne esi, eax
push esi
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0xd
call fcn.1001f600
push esi
lea ecx, [ebp - 0xa58]
call fcn.1001f850
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0xe
call fcn.1001e850
lea ecx, [ebp - 0xa58]
movsd qword [ebp - 0xb68], xmm0
call fcn.1001cf60
lea ecx, [ebp - 0xb40]
call fcn.1001cf60
movsd xmm0, qword [0x101042e0]
mov byte [ebp - 0xb38], 3
and dword [ebp - 0xb38], 0xfffffeff
mov dword [ebp - 0xb34], 0
mov dword [ebp - 0xb30], 0
mov dword [ebp - 0xb2c], 0
movsd qword [ebp - 0xb40], xmm0
push 0x101039a0
push str.EvaluationTimeoutSec
lea ecx, [ebp - 0xab0]
mov byte [ebp - 4], 0x11
call fcn.1001fe20
test eax, eax
mov dword [ebp - 0xa4c], 0
lea esi, [ebp - 0xb40]
cmovne esi, eax
push esi
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x12
call fcn.1001f600
push esi
lea ecx, [ebp - 0xa58]
call fcn.1001f850
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x13
call fcn.1001e850
lea ecx, [ebp - 0xa58]
movsd qword [ebp - 0xa80], xmm0
call fcn.1001cf60
lea ecx, [ebp - 0xb40]
call fcn.1001cf60
movsd xmm0, qword [0x10104280]
mov byte [ebp - 0xb38], 3
and dword [ebp - 0xb38], 0xfffffeff
mov dword [ebp - 0xb34], 0
mov dword [ebp - 0xb30], 0
mov dword [ebp - 0xb2c], 0
movsd qword [ebp - 0xb40], xmm0
push 0x101039ae
push str.DiscretSec
lea ecx, [ebp - 0xab0]
mov byte [ebp - 4], 0x16
call fcn.1001fe20
test eax, eax
mov dword [ebp - 0xa4c], 0
lea esi, [ebp - 0xb40]
cmovne esi, eax
push esi
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x17
call fcn.1001f600
push esi
lea ecx, [ebp - 0xa58]
call fcn.1001f850
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x18
call fcn.1001e850
lea ecx, [ebp - 0xa58]
movsd qword [ebp - 0xb28], xmm0
call fcn.1001cf60
lea ecx, [ebp - 0xb40]
call fcn.1001cf60
mov byte [ebp - 0xb38], 5
and dword [ebp - 0xb38], 0xfffffeff
mov dword [ebp - 0xb34], 0
mov dword [ebp - 0xb30], 0
mov dword [ebp - 0xb2c], 0
mov byte [ebp - 0xb40], 1
push 0x101039b5
push str.UseIO
lea ecx, [ebp - 0xab0]
mov byte [ebp - 4], 0x1b
call fcn.1001fe20
test eax, eax
mov dword [ebp - 0xa4c], 0
lea esi, [ebp - 0xb40]
cmovne esi, eax
push esi
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x1c
call fcn.1001f600
push esi
lea ecx, [ebp - 0xa58]
call fcn.1001f850
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x1d
call fcn.1001ea40
lea ecx, [ebp - 0xa58]
mov byte [ebp - 0xb41], al
call fcn.1001cf60
lea ecx, [ebp - 0xb40]
call fcn.1001cf60
mov byte [ebp - 0xb38], 5
and dword [ebp - 0xb38], 0xfffffeff
mov dword [ebp - 0xb34], 0
mov dword [ebp - 0xb30], 0
mov dword [ebp - 0xb2c], 0
mov byte [ebp - 0xb40], 0
push 0x101039be
push str.UseCPU
lea ecx, [ebp - 0xab0]
mov byte [ebp - 4], 0x20
call fcn.1001fe20
test eax, eax
mov dword [ebp - 0xa4c], 0
lea esi, [ebp - 0xb40]
cmovne esi, eax
push esi
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x21
call fcn.1001f600
push esi
lea ecx, [ebp - 0xa58]
call fcn.1001f850
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x22
call fcn.1001ea40
lea ecx, [ebp - 0xa58]
mov byte [ebp - 0xb42], al
call fcn.1001cf60
lea ecx, [ebp - 0xb40]
call fcn.1001cf60
mov byte [ebp - 0xb38], 5
and dword [ebp - 0xb38], 0xfffffeff
mov dword [ebp - 0xb34], 0
mov dword [ebp - 0xb30], 0
mov dword [ebp - 0xb2c], 0
mov byte [ebp - 0xb40], 0
push 0x101039c8
push str.WriteLog
lea ecx, [ebp - 0xab0]
mov byte [ebp - 4], 0x25
call fcn.1001fe20
test eax, eax
mov dword [ebp - 0xa4c], 0
lea esi, [ebp - 0xb40]
cmovne esi, eax
mov byte [ebp - 4], 0x26
push esi
lea ecx, [ebp - 0xa58]
call fcn.1001f600
push esi
lea ecx, [ebp - 0xa58]
call fcn.1001f850
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x27
call fcn.1001ea40
lea ecx, [ebp - 0xa58]
mov byte [ebp - 0xb43], al
call fcn.1001cf60
lea ecx, [ebp - 0xb40]
call fcn.1001cf60
mov byte [ebp - 0xb38], 5
and dword [ebp - 0xb38], 0xfffffeff
mov dword [ebp - 0xb34], 0
mov dword [ebp - 0xb30], 0
mov dword [ebp - 0xb2c], 0
mov byte [ebp - 0xb40], 0
push 0x101039db
push str.ReportLoadtime0
lea ecx, [ebp - 0xab0]
mov byte [ebp - 4], 0x2a
call fcn.1001fe20
test eax, eax
mov dword [ebp - 0xa4c], 0
lea esi, [ebp - 0xb40]
cmovne esi, eax
push esi
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x2b
call fcn.1001f600
push esi
lea ecx, [ebp - 0xa58]
call fcn.1001f850
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x2c
call fcn.1001ea40
lea ecx, [ebp - 0xa58]
mov byte [ebp - 0xb44], al
call fcn.1001cf60
lea ecx, [ebp - 0xb40]
call fcn.1001cf60
movsd xmm0, qword [ebp - 0xb70]
mov byte [ebp - 0xb38], 3
and dword [ebp - 0xb38], 0xfffffeff
mov dword [ebp - 0xb34], 0
mov dword [ebp - 0xb30], 0
mov dword [ebp - 0xb2c], 0
movsd qword [ebp - 0xb40], xmm0
push 0x101033b1
push str.Threshold
lea ecx, [ebp - 0xa98]
mov byte [ebp - 4], 0x2f
call fcn.1001fe20
test eax, eax
mov dword [ebp - 0xa4c], 0
lea esi, [ebp - 0xb40]
cmovne esi, eax
push esi
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x30
call fcn.1001f600
push esi
lea ecx, [ebp - 0xa58]
call fcn.1001f850
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x31
call fcn.1001e850
lea ecx, [ebp - 0xa58]
movsd qword [ebp - 0xb60], xmm0
call fcn.1001cf60
lea ecx, [ebp - 0xb40]
call fcn.1001cf60
movsd xmm0, qword [ebp - 0xb68]
mov byte [ebp - 0xb38], 3
and dword [ebp - 0xb38], 0xfffffeff
mov dword [ebp - 0xb34], 0
mov dword [ebp - 0xb30], 0
mov dword [ebp - 0xb2c], 0
movsd qword [ebp - 0xb40], xmm0
push 0x1010398a
push str.FirstEvaluationTimeSec
lea ecx, [ebp - 0xa98]
mov byte [ebp - 4], 0x34
call fcn.1001fe20
test eax, eax
mov dword [ebp - 0xa4c], 0
lea esi, [ebp - 0xb40]
cmovne esi, eax
push esi
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x35
call fcn.1001f600
push esi
lea ecx, [ebp - 0xa58]
call fcn.1001f850
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x36
call fcn.1001e850
lea ecx, [ebp - 0xa58]
movsd qword [ebp - 0xb68], xmm0
call fcn.1001cf60
lea ecx, [ebp - 0xb40]
call fcn.1001cf60
movsd xmm0, qword [ebp - 0xa80]
mov byte [ebp - 0xb38], 3
and dword [ebp - 0xb38], 0xfffffeff
mov dword [ebp - 0xb34], 0
mov dword [ebp - 0xb30], 0
mov dword [ebp - 0xb2c], 0
movsd qword [ebp - 0xb40], xmm0
push 0x101039a0
push str.EvaluationTimeoutSec
lea ecx, [ebp - 0xa98]
mov byte [ebp - 4], 0x39
call fcn.1001fe20
test eax, eax
mov dword [ebp - 0xa4c], 0
lea esi, [ebp - 0xb40]
cmovne esi, eax
push esi
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x3a
call fcn.1001f600
push esi
lea ecx, [ebp - 0xa58]
call fcn.1001f850
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x3b
call fcn.1001e850
lea ecx, [ebp - 0xa58]
movsd qword [ebp - 0xb70], xmm0
call fcn.1001cf60
lea ecx, [ebp - 0xb40]
call fcn.1001cf60
push 0
push 3
lea ecx, [ebp - 0xb40]
mov dword [ebp - 0xb34], 0
call fcn.1001f560
movsd xmm0, qword [ebp - 0xb28]
movsd qword [ebp - 0xb40], xmm0
push 0x101039ae
push str.DiscretSec
lea ecx, [ebp - 0xa98]
mov byte [ebp - 4], 0x3c
call fcn.1001fe20
test eax, eax
mov dword [ebp - 0xa4c], 0
lea esi, [ebp - 0xb40]
cmovne esi, eax
push esi
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x3d
call fcn.1001f600
push esi
lea ecx, [ebp - 0xa58]
call fcn.1001f850
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x3e
call fcn.1001e850
lea ecx, [ebp - 0xa58]
movsd qword [ebp - 0xb80], xmm0
call fcn.1001cf60
lea ecx, [ebp - 0xb40]
call fcn.1001cf60
push 0
push 5
lea ecx, [ebp - 0xb40]
mov dword [ebp - 0xb34], 0
call fcn.1001f560
mov al, byte [ebp - 0xb41]
mov byte [ebp - 0xb40], al
push 0x101039b5
push str.UseIO
lea ecx, [ebp - 0xa98]
mov byte [ebp - 4], 0x3f
call fcn.1001fe20
test eax, eax
mov dword [ebp - 0xa4c], 0
lea esi, [ebp - 0xb40]
cmovne esi, eax
push esi
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x40
call fcn.1001f600
push esi
lea ecx, [ebp - 0xa58]
call fcn.1001f850
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x41
call fcn.1001ea40
lea ecx, [ebp - 0xa58]
mov byte [ebp - 0xb41], al
call fcn.1001cf60
lea ecx, [ebp - 0xb40]
call fcn.1001cf60
push 0
push 5
lea ecx, [ebp - 0xb40]
mov dword [ebp - 0xb34], 0
call fcn.1001f560
mov al, byte [ebp - 0xb42]
mov byte [ebp - 0xb40], al
push 0x101039be
push str.UseCPU
lea ecx, [ebp - 0xa98]
mov byte [ebp - 4], 0x42
call fcn.1001fe20
test eax, eax
mov dword [ebp - 0xa4c], 0
lea esi, [ebp - 0xb40]
cmovne esi, eax
push esi
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x43
call fcn.1001f600
push esi
lea ecx, [ebp - 0xa58]
call fcn.1001f850
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x44
call fcn.1001ea40
lea ecx, [ebp - 0xa58]
mov byte [ebp - 0xb42], al
call fcn.1001cf60
lea ecx, [ebp - 0xb40]
call fcn.1001cf60
push 0
push 5
lea ecx, [ebp - 0xb40]
mov dword [ebp - 0xb34], 0
call fcn.1001f560
mov al, byte [ebp - 0xb43]
mov byte [ebp - 0xb40], al
push 0x101039c8
push str.WriteLog
lea ecx, [ebp - 0xa98]
mov byte [ebp - 4], 0x45
call fcn.1001fe20
test eax, eax
mov dword [ebp - 0xa4c], 0
lea esi, [ebp - 0xb40]
cmovne esi, eax
push esi
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x46
call fcn.1001f600
push esi
lea ecx, [ebp - 0xa58]
call fcn.1001f850
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x47
call fcn.1001ea40
lea ecx, [ebp - 0xa58]
mov byte [ebp - 0xb43], al
call fcn.1001cf60
lea ecx, [ebp - 0xb40]
call fcn.1001cf60
mov al, byte [ebp - 0xb44]
mov byte [ebp - 0xb38], 5
and dword [ebp - 0xb38], 0xfffffeff
mov dword [ebp - 0xb34], 0
mov dword [ebp - 0xb30], 0
mov dword [ebp - 0xb2c], 0
mov byte [ebp - 0xb40], al
push 0x101039db
push str.ReportLoadtime0
lea ecx, [ebp - 0xa98]
mov byte [ebp - 4], 0x4a
call fcn.1001fe20
test eax, eax
mov dword [ebp - 0xa4c], 0
lea esi, [ebp - 0xb40]
cmovne esi, eax
push esi
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x4b
call fcn.1001f600
push esi
lea ecx, [ebp - 0xa58]
call fcn.1001f850
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x4c
call fcn.1001ea40
lea ecx, [ebp - 0xa58]
mov byte [ebp - 0xb44], al
call fcn.1001cf60
lea ecx, [ebp - 0xb40]
mov byte [ebp - 4], 4
call fcn.1001cf60
movsd xmm2, qword [0x101042b0]
movsd xmm1, qword [ebp - 0xb68]
comisd xmm2, xmm1
ja 0x10045c49
movsd xmm0, qword [ebp - 0xb70]
comisd xmm2, xmm0
ja 0x10045c49
comisd xmm1, xmm0
jbe 0x1004587a
mov ecx, dword [ebp - 0xb4c]
lea eax, [ebp - 0xa5c]
push eax
lea ecx, [ecx + 0x4c]
call fcn.10047230
push edi
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, str.Attenuation_timeout_should_be_less_or_equal_to_final_timeout
jmp 0x10045c7a
push 0x190
call fcn.10070e01
mov esi, eax
add esp, 4
mov dword [ebp - 0xb24], esi
push 0x190
push 0
push esi
mov byte [ebp - 4], 0x4d
call fcn.10073590
add esp, 0xc
mov ecx, esi
call fcn.10034880
lea ecx, [ebp - 0xa58]
mov edi, eax
call fcn.1002fff0
cmp byte [ebp - 0xb43], 0
mov byte [ebp - 4], 0x4e
je 0x10045b53
lea ecx, [ebp - 0xac8]
call fcn.1002fff0
lea eax, [ebp - 0xb24]
mov byte [ebp - 4], 0x4f
push eax
push dword [ebp - 0xa5c]
mov dword [ebp - 0xb24], 0
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov ecx, dword [ebp - 0xb48]
lea eax, [ebp - 0xb40]
push eax
call fcn.1004ee40
push eax
lea ecx, [ebp - 0xa58]
call fcn.10031be0
lea ecx, [ebp - 0xb40]
call fcn.1002fe70
lea eax, [ebp - 0xa58]
push eax
lea ecx, [ebp - 0xac8]
call fcn.10047460
push 0x10103420
lea ecx, [ebp - 0xac8]
call fcn.10038aa0
lea ecx, [ebp - 0xa74]
push ecx
mov ecx, eax
call fcn.10038b20
push str._ALT__
mov ecx, eax
call fcn.10038aa0
mov edx, dword [ebp - 0xb24]
lea ecx, [ebp - 0xb40]
mov esi, eax
call fcn.10043bf0
push eax
mov ecx, esi
mov byte [ebp - 4], 0x50
call fcn.10038b20
push 0x10103abc
mov ecx, eax
call fcn.10038aa0
lea ecx, [ebp - 0xa74]
push ecx
mov ecx, eax
call fcn.10038b20
push 0x10103ac4
mov ecx, eax
call fcn.10038aa0
lea ecx, [ebp - 0xb40]
mov byte [ebp - 4], 0x4f
call fcn.1002fe70
mov edx, dword [ebp - 0xa5c]
lea ecx, [ebp - 0xb40]
call fcn.10043bf0
push eax
lea ecx, [ebp - 0xac8]
mov byte [ebp - 4], 0x51
call fcn.10038b20
lea ecx, [ebp - 0xb40]
mov byte [ebp - 4], 0x4f
call fcn.1002fe70
push 0x10103ac4
lea ecx, [ebp - 0xac8]
call fcn.10038aa0
call fcn.1005a8c7
push 0
push 0x989680
push edx
push eax
call fcn.100cb8c0
xorps xmm0, xmm0
mov dword [ebp - 0xa80], eax
mov dword [ebp - 0xa7c], edx
lea eax, [ebp - 0xa80]
movups xmmword [ebp - 0xb1c], xmm0
mov dword [ebp - 0xafc], 0
movups xmmword [ebp - 0xb0c], xmm0
push eax
lea eax, [ebp - 0xb1c]
push eax
call fcn.100a3aad
lea eax, [ebp - 0xb1c]
push eax
push 0x10103ac8
lea eax, [ebp - 0x218]
push 0x200
push eax
call fcn.100a643a
add esp, 0x18
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0xac8]
push eax
call fcn.10038aa0
push str..log
mov ecx, eax
call fcn.10038aa0
lea eax, [ebp - 0xa58]
push eax
lea ecx, [ebp - 0xae0]
call fcn.10038c10
push 0x10103420
lea ecx, [ebp - 0xae0]
mov byte [ebp - 4], 0x52
call fcn.10038aa0
lea ecx, [ebp - 0xa74]
push ecx
mov ecx, eax
call fcn.10038b20
push 0x10103420
mov ecx, eax
call fcn.10038aa0
cmp dword [ebp - 0xacc], 7
lea ecx, [ebp - 0xae0]
mov eax, dword [ebp - 0xad0]
jbe 0x10045ad8
mov ecx, dword [ebp - 0xae0]
lea eax, [ecx + eax*2]
jmp 0x10045ae1
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0xae0]
cmp ecx, eax
je 0x10045b00
mov edx, 0x5c
nop word [eax + eax]
cmp word [ecx], 0x2f
jne 0x10045af9
mov word [ecx], dx
add ecx, 2
cmp ecx, eax
jne 0x10045af0
lea eax, [ebp - 0xae0]
mov ecx, edi
push eax
call fcn.10036ed0
lea ecx, [ebp - 0xae0]
mov byte [ebp - 4], 0x4f
call fcn.1002fe70
lea ecx, [edi + 4]
lea eax, [ebp - 0xac8]
cmp ecx, eax
je 0x10045b44
cmp dword [ebp - 0xab4], 7
push dword [ebp - 0xab8]
cmova eax, dword [ebp - 0xac8]
push eax
call fcn.10039ad0
lea ecx, [ebp - 0xac8]
mov byte [ebp - 4], 0x4e
call fcn.1002fe70
mov al, byte [ebp - 0xb41]
movsd xmm0, qword [ebp - 0xb80]
mov esi, dword [ebp - 0xb4c]
mov byte [edi + 1], al
mov al, byte [ebp - 0xb42]
movsd qword [edi + 0x160], xmm0
movsd xmm0, qword [ebp - 0xb68]
lea ecx, [esi + 0x4c]
mov byte [edi + 2], al
mov al, byte [ebp - 0xb44]
movsd qword [edi + 0x150], xmm0
movsd xmm0, qword [ebp - 0xb70]
mov byte [edi + 0x1c], al
lea eax, [ebp - 0xa5c]
movsd qword [edi + 0x158], xmm0
movsd xmm0, qword [ebp - 0xb60]
push eax
movsd qword [edi + 0x168], xmm0
call fcn.10047230
lea ecx, [esi + 0x6c]
mov dword [eax], edi
lea eax, [ebp - 0xa5c]
push eax
lea eax, [ebp - 0xb60]
push eax
call fcn.10048da0
mov ecx, dword [ebp - 0xb54]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
lea ecx, [ebp - 0xa58]
call fcn.1002fe70
lea ecx, [ebp - 0xab0]
call fcn.1001cf60
lea ecx, [ebp - 0xaf8]
call fcn.1002fe70
lea ecx, [ebp - 0xa98]
call fcn.1001cf60
lea ecx, [ebp - 0xa74]
call fcn.1002fe70
push dword [ebp - 0xb50]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xb48]
push 0
push 1
push dword [ebp - 0xa5c]
call fcn.100347d0
mov al, 1
jmp 0x10045cc4
mov ecx, dword [ebp - 0xb4c]
lea eax, [ebp - 0xa5c]
push eax
lea eax, [ebp - 0xb60]
push eax
lea ecx, [ecx + 0x4c]
call fcn.10049020
push edi
mov eax, dword [eax]
mov dword [eax + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, str.Timeout_value_should_be_greater_than_0
mov eax, dword [ebp - 0xb48]
push ecx
push 0xfffffffffffffff0
mov ecx, eax
call fcn.10043fc0
lea ecx, [ebp - 0xab0]
call fcn.1001cf60
lea ecx, [ebp - 0xaf8]
call fcn.1002fe70
lea ecx, [ebp - 0xa98]
call fcn.1001cf60
lea ecx, [ebp - 0xa74]
call fcn.1002fe70
push dword [ebp - 0xb50]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10070cea
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4