Function at 0x1cfb040
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Get number of processors
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500850
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5bc
push esi
mov dword [ebp - 0x20], 0
mov ecx, 0x538bbc
cmp dword [0x538bd0], 0x10
push edi
jb 0x1cfb08b
mov edx, dword [0x538bbc]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1cfb080
sub ecx, esi
jmp 0x1cfb09e
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1cfb090
sub ecx, edx
mov edx, 0x538bbc
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x12c], 0
push edx
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x128], 0
movups xmmword [ebp - 0x13c], xmm0
call fcn.01ca52a0
mov dword [ebp - 4], 0
mov ecx, 0x538bbc
call fcn.01ca5090
movups xmm0, xmmword [ebp - 0x13c]
mov byte [ebp - 0x13c], 0
movups xmmword [0x538bbc], xmm0
movq xmm0, qword [ebp - 0x12c]
movq qword [0x538bcc], xmm0
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x128], 0xf
mov dword [ebp - 4], 0xffffffff
mov eax, dword fs:[0x30]
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x128], 0xf
mov byte [ebp - 0x13c], 0
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x14], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
mov ecx, dword [ecx + esi + 0x7c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
lea ecx, [esi + edx]
mov dword [ebp - 0x38], ecx
cmp ecx, esi
je 0x1cfb1b7
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1cfb1b7
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x24], ecx
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1cfb1ad
nop dword [eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x1cfb190
cmp esi, 0x6dd8a845
je 0x1cfb1bb
mov ecx, dword [ebp - 0x24]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x1cfb171
mov eax, dword [eax]
jmp 0x1cfb141
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
mov ecx, dword fs:[0x30]
mov dword [ebp - 0x10], eax
mov ecx, dword [ecx + 0xc]
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + 0x18]
mov dword [ebp - 0x38], edi
mov edx, dword [edi + 0x3c]
mov esi, dword [edx + edi + 0x78]
mov eax, dword [edx + edi + 0x7c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esi
lea eax, [edi + esi]
mov dword [ebp - 0x24], eax
cmp eax, edi
je 0x1cfb25f
mov edi, dword [eax + 0x18]
test edi, edi
je 0x1cfb25f
mov eax, dword [eax + 0x20]
mov esi, dword [ecx + 0x18]
lea eax, [eax + edi*4]
add eax, esi
nop dword [eax]
mov edx, dword [eax - 4]
sub eax, 4
add edx, esi
mov dword [ebp - 0x14], eax
dec edi
mov esi, 0x811c9dc5
mov al, byte [edx]
inc edx
test al, al
je 0x1cfb255
movsx eax, al
lea edx, [edx + 1]
xor eax, esi
imul esi, eax, 0x1000193
mov al, byte [edx - 1]
test al, al
jne 0x1cfb238
cmp esi, 0x60993b9d
je 0x1cfb263
mov eax, dword [ebp - 0x14]
mov esi, dword [ecx + 0x18]
test edi, edi
jne 0x1cfb220
mov ecx, dword [ecx]
jmp 0x1cfb1e6
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x38]
push 0x8000
push dword [ebp - 0x10]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
push 0x403930
call dword [0x505124]
mov edi, dword [0x538b44]
mov esi, dword [0x538b40]
push 0
push 2
push edi
push esi
call fcn.01d97ca0
mov ecx, dword [0x538b48]
sub ecx, eax
mov eax, dword [0x538b4c]
mov dword [ebp - 0x24], ecx
sbb eax, edx
xor ecx, esi
mov dword [ebp - 0x38], eax
mov eax, edi
mov edx, dword [ebp - 0x38]
xor eax, edx
or ecx, eax
je 0x1cfb2db
add esi, dword [ebp - 0x24]
mov dword [0x538b40], esi
adc edi, edx
mov dword [0x538b44], edi
test edi, edi
jl 0x1cfb300
jg 0x1cfb2e9
cmp esi, 0x186a0
jbe 0x1cfb300
xorps xmm0, xmm0
movlpd qword [0x538b40], xmm0
mov edi, dword [0x538b44]
mov esi, dword [0x538b40]
push 0
push 2
push edi
push esi
call fcn.01d97ca0
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
sbb eax, edx
mov dword [0x538b48], ecx
mov dword [ebp - 0x38], eax
xor ecx, esi
mov edx, dword [ebp - 0x38]
mov dword [0x538b4c], eax
mov eax, edi
xor eax, edx
or ecx, eax
je 0x1cfb344
add esi, dword [ebp - 0x24]
mov dword [0x538b40], esi
adc edi, edx
mov dword [0x538b44], edi
test edi, edi
jl 0x1cfb35d
jg 0x1cfb352
cmp esi, 0x186a0
jbe 0x1cfb35d
xorps xmm0, xmm0
movlpd qword [0x538b40], xmm0
push 0
call fcn.01d8069b
push eax
call fcn.01d782cc
add esp, 8
call fcn.01cab480
mov eax, dword [0x538b40]
xor dword [0x538b48], eax
mov eax, dword [0x538b44]
xor dword [0x538b4c], eax
xor ecx, ecx
mov dword [ebp - 0x76], 0x2f3f383e
mov byte [ebp - 0x72], 0
movzx eax, byte [ebp + ecx - 0x76]
push eax
call fcn.01d02ea0
mov byte [ebp + ecx - 0x76], al
inc ecx
cmp ecx, 4
jb 0x1cfb395
lea edx, [ebp - 0x76]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1cfb3b0
sub edx, ecx
lea eax, [ebp - 0x76]
cmp dword [0x538c18], 0x10
mov ecx, 0x538c04
push edx
cmovae ecx, dword [0x538c04]
mov edx, dword [0x538c14]
push eax
push 0
call fcn.01d07590
add esp, 0xc
test eax, eax
jne 0x1cfb49f
call fcn.01cb7090
test al, al
je 0x1cfb49a
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x24], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
mov ecx, dword [ecx + esi + 0x7c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
lea ecx, [esi + edx]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
je 0x1cfb477
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1cfb477
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x10], ecx
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1cfb46d
nop word [eax + eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x1cfb450
cmp esi, 0xe80fd3a
je 0x1cfb47b
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x1cfb432
mov eax, dword [eax]
jmp 0x1cfb402
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
push 0
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
jmp 0x1cfb49f
call fcn.01cb71d0
call fcn.01cab480
mov esi, dword [0x538b40]
mov edi, dword [0x538b44]
xor dword [0x538b48], esi
xor dword [0x538b4c], edi
xor ecx, ecx
mov dword [ebp - 0x7b], 0x2f3f383e
mov byte [ebp - 0x77], 0
nop dword [eax]
movzx eax, byte [ebp + ecx - 0x7b]
push eax
call fcn.01d02ea0
mov byte [ebp + ecx - 0x7b], al
inc ecx
cmp ecx, 4
jb 0x1cfb4d0
lea edx, [ebp - 0x7b]
lea ecx, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x1cfb4f0
sub edx, ecx
lea eax, [ebp - 0x7b]
cmp dword [0x538bb8], 0x10
mov ecx, 0x538ba4
push edx
cmovae ecx, dword [0x538ba4]
mov edx, dword [0x538bb4]
push eax
push 0
call fcn.01d07590
add esp, 0xc
test eax, eax
jne 0x1cfb604
call fcn.01cb7210
mov byte [ebp - 0x29], al
call fcn.01cb72a0
mov byte [ebp - 0x55], al
call fcn.01cb7520
cmp byte [ebp - 0x29], 0
jne 0x1cfb55b
cmp byte [ebp - 0x55], 0
jne 0x1cfb55b
test al, al
jne 0x1cfb55b
call fcn.01cb70d0
test al, al
je 0x1cfb5f8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x24], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
mov ecx, dword [ecx + esi + 0x7c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
lea ecx, [esi + edx]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
je 0x1cfb5d7
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1cfb5d7
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x10], ecx
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1cfb5cd
nop
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x1cfb5b0
cmp esi, 0xe80fd3a
je 0x1cfb5db
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x1cfb597
mov eax, dword [eax]
jmp 0x1cfb567
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
push 0
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
mov esi, dword [0x538b40]
mov edi, dword [0x538b44]
mov dword [ebp - 0x71], 0x2f3f383e
xor ecx, ecx
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp + ecx - 0x71]
push eax
call fcn.01d02ea0
mov byte [ebp + ecx - 0x71], al
inc ecx
cmp ecx, 4
jb 0x1cfb611
lea edx, [ebp - 0x71]
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x1cfb630
sub edx, ecx
lea eax, [ebp - 0x71]
cmp dword [0x538ca8], 0x10
mov ecx, 0x538c94
push edx
cmovae ecx, dword [0x538c94]
mov edx, dword [0x538ca4]
push eax
push 0
call fcn.01d07590
add esp, 0xc
test eax, eax
jne 0x1cfb679
lea ecx, [eax + 1]
call fcn.01cb76d0
mov edi, dword [0x538b44]
mov esi, dword [0x538b40]
mov dword [ebp - 0x80], 0x2f3f383e
xor ecx, ecx
mov byte [ebp - 0x7c], 0
nop word [eax + eax]
movzx eax, byte [ebp + ecx - 0x80]
push eax
call fcn.01d02ea0
mov byte [ebp + ecx - 0x80], al
inc ecx
cmp ecx, 4
jb 0x1cfb690
lea edx, [ebp - 0x80]
lea ecx, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x1cfb6b0
sub edx, ecx
lea eax, [ebp - 0x80]
cmp dword [0x538c90], 0x10
mov ecx, 0x538c7c
push edx
cmovae ecx, dword [0x538c7c]
mov edx, dword [0x538c8c]
push eax
push 0
call fcn.01d07590
add esp, 0xc
test eax, eax
jne 0x1cfb6f6
call fcn.01cba220
mov edi, dword [0x538b44]
mov esi, dword [0x538b40]
push 0
push 2
push edi
push esi
call fcn.01d97ca0
mov ecx, dword [0x538b48]
sub ecx, eax
mov eax, dword [0x538b4c]
mov dword [ebp - 0x14], ecx
sbb eax, edx
mov dword [0x538b48], ecx
mov dword [ebp - 0x10], eax
xor ecx, esi
mov edx, dword [ebp - 0x10]
mov dword [0x538b4c], eax
mov eax, edi
xor eax, edx
or ecx, eax
je 0x1cfb73f
add esi, dword [ebp - 0x14]
mov dword [0x538b40], esi
adc edi, edx
mov dword [0x538b44], edi
test edi, edi
jl 0x1cfb758
jg 0x1cfb74d
cmp esi, 0x186a0
jbe 0x1cfb758
xorps xmm0, xmm0
movlpd qword [0x538b40], xmm0
mov dword [ebp - 0xbc], 0x2224233d
xor ecx, ecx
mov dword [ebp - 0xb8], 0x643a3e3e
mov dword [ebp - 0xb4], 0x26262e
nop dword [eax + eax]
movzx eax, byte [ebp + ecx - 0xbc]
push eax
call fcn.01d02ea0
mov byte [ebp + ecx - 0xbc], al
inc ecx
cmp ecx, 0xb
jb 0x1cfb780
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x24], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
mov ecx, dword [ecx + esi + 0x7c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
lea ecx, [edx + esi]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
je 0x1cfb817
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1cfb817
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x10], ecx
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1cfb80d
nop
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x1cfb7f0
cmp esi, 0x53b2070f
je 0x1cfb81b
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x1cfb7d7
mov eax, dword [eax]
jmp 0x1cfb7a7
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
lea ecx, [ebp - 0xbc]
add eax, edx
push ecx
call eax
test eax, eax
je 0x1cfc112
mov dword [ebp - 0xc8], 0x304031d
xor ecx, ecx
mov dword [ebp - 0xc4], 0x641e0f04
mov dword [ebp - 0xc0], 0x6060e
nop word [eax + eax]
movzx eax, byte [ebp + ecx - 0xc8]
push eax
call fcn.01d02ea0
mov byte [ebp + ecx - 0xc8], al
inc ecx
cmp ecx, 0xb
jb 0x1cfb870
lea eax, [ebp - 0xc8]
push eax
call dword [0x50509c]
mov ecx, eax
call fcn.01d1e4d0
call fcn.01d5d310
push 0
push 0
push 0
push 0x41c4f0
push 0
push 0
call dword [0x5050b4]
push eax
call dword [0x5050ac]
cmp dword [0x538b3c], 0xffffffff
jne 0x1cfb97c
nop dword [eax]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x24], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
mov ecx, dword [ecx + esi + 0x7c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
lea ecx, [esi + edx]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
je 0x1cfb94e
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1cfb94e
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
sub ecx, 4
dec edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
add ecx, esi
mov esi, 0x811c9dc5
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x1cfb944
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x1cfb927
cmp esi, 0x2fa62ca8
je 0x1cfb952
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x1cfb910
mov eax, dword [eax]
jmp 0x1cfb8e0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
push 1
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
cmp dword [0x538b3c], 0xffffffff
je 0x1cfb8d0
mov ecx, 0x104
lea eax, [ebp - 0x5c8]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x1cfb987
lea eax, [ebp - 0x5c8]
push eax
push 0xfa
call dword [0x505070]
call fcn.01cab480
mov eax, dword [0x538b40]
lea ecx, [ebp - 0x1f8]
xor dword [0x538b48], eax
mov edx, 0xc
mov eax, dword [0x538b44]
xor dword [0x538b4c], eax
call fcn.01cae7d0
mov dword [ebp - 4], 1
xor ecx, ecx
mov dword [ebp - 0x6c], 0x3a272f3e
mov dword [ebp - 0x68], 0x190709
nop word [eax + eax]
movzx eax, byte [ebp + ecx - 0x6c]
push eax
call fcn.01d02ea0
mov byte [ebp + ecx - 0x6c], al
inc ecx
cmp ecx, 7
jb 0x1cfb9f0
xorps xmm0, xmm0
mov dword [ebp - 0x194], 0
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x190], 0
movups xmmword [ebp - 0x1a4], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1cfba30
sub ecx, edx
lea eax, [ebp - 0x6c]
push ecx
push eax
lea ecx, [ebp - 0x1a4]
call fcn.01ca52a0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1cfba56
sub ecx, edx
lea eax, [ebp - 0x5c8]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x1a4]
call fcn.01d0ac90
mov dword [ebp - 0x14c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x15c], xmm0
mov dword [ebp - 0x148], 0
movups xmm0, xmmword [eax]
mov dword [ebp - 0x20], 0x400
movups xmmword [ebp - 0x15c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x14c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1f8]
cmp dword [ebp - 0x1e4], 0x10
lea ecx, [ebp - 0x15c]
push dword [ebp - 0x1e8]
cmovae eax, dword [ebp - 0x1f8]
push eax
call fcn.01d04160
mov dword [ebp - 0x17c], 0
mov ecx, 0x538b8c
mov dword [ebp - 0x178], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x18c], xmm0
movups xmmword [ebp - 0xd8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x17c], xmm0
movq qword [ebp - 0x1c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov dword [ebp - 0x20], 0xc00
call fcn.01ca5090
movups xmm0, xmmword [ebp - 0xd8]
mov esi, 0xc00
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x178], 0xf
movups xmmword [0x538b8c], xmm0
mov byte [ebp - 0x18c], 0
movq xmm0, qword [ebp - 0x1c]
mov dword [ebp - 0x20], esi
and esi, 0xfffff7ff
movq qword [0x538b9c], xmm0
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 3
and esi, 0xfffffbff
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x178], 0xf
mov byte [ebp - 0x18c], 0
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x148]
cmp ecx, 0x10
jb 0x1cfbbf0
mov edx, dword [ebp - 0x15c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1cfbbe6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1cfe565
push ecx
push edx
call fcn.01d5c4b1
add esp, 8
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0xf
mov byte [ebp - 0x15c], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x190]
cmp ecx, 0x10
jb 0x1cfbc49
mov edx, dword [ebp - 0x1a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1cfbc3f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1cfe565
push ecx
push edx
call fcn.01d5c4b1
add esp, 8
mov dword [ebp - 0x194], 0
xor ecx, ecx
mov dword [ebp - 0x190], 0xf
mov byte [ebp - 0x1a4], 0
mov dword [ebp - 0x64], 0x3a272f3e
mov dword [ebp - 0x60], 0x191c0b
movzx eax, byte [ebp + ecx - 0x64]
push eax
call fcn.01d02ea0
mov byte [ebp + ecx - 0x64], al
inc ecx
cmp ecx, 7
jb 0x1cfbc74
xorps xmm0, xmm0
mov dword [ebp - 0x1ac], 0
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x1a8], 0
movups xmmword [ebp - 0x1bc], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1cfbcb0
sub ecx, edx
lea eax, [ebp - 0x64]
push ecx
push eax
lea ecx, [ebp - 0x1bc]
call fcn.01ca52a0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x5c8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1cfbcd6
sub ecx, edx
lea eax, [ebp - 0x5c8]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x1bc]
call fcn.01d0ac90
mov dword [ebp - 0x164], 0
lea edx, [ebp - 0x174]
mov dword [ebp - 0x160], 0
lea ecx, [ebp - 0xf4]
xorps xmm0, xmm0
or esi, 0x1000
movups xmmword [ebp - 0x174], xmm0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x174], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x164], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x1f8]
push eax
mov dword [ebp - 0x20], esi
call fcn.01d06040
add esp, 4
mov byte [ebp - 4], 7
and esi, 0xffffefff
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x160]
cmp ecx, 0x10
jb 0x1cfbda8
mov edx, dword [ebp - 0x174]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1cfbd9e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1cfe56a
push ecx
push edx
call fcn.01d5c4b1
add esp, 8
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 0xf
mov byte [ebp - 0x174], 0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x1a8]
cmp ecx, 0x10
jb 0x1cfbe01
mov edx, dword [ebp - 0x1bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1cfbdf7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1cfe56a
push ecx
push edx
call fcn.01d5c4b1
add esp, 8
cmp dword [0x538ba0], 0x10
mov ecx, 0x538b8c
mov dword [ebp - 0x1ac], 0
cmovae ecx, dword [0x538b8c]
mov dword [ebp - 0x1a8], 0xf
mov byte [ebp - 0x1bc], 0
call fcn.01cae130
test al, al
je 0x1cfbe46
push ecx
mov ecx, 0x538b8c
call fcn.01cae180
add esp, 4
cmp dword [ebp - 0xe0], 0x10
lea ecx, [ebp - 0xf4]
cmovae ecx, dword [ebp - 0xf4]
call fcn.01cae130
test al, al
je 0x1cfbe72
push ecx
lea ecx, [ebp - 0xf4]
call fcn.01cae180
add esp, 4
cmp dword [0x538ba0], 0x10
mov eax, 0x538b8c
mov esi, dword [0x505104]
cmovae eax, dword [0x538b8c]
push 0
push eax
call esi
test eax, eax
jne 0x1cfbea6
mov ecx, 0x538b8c
call fcn.01cb8800
test al, al
je 0x1cfe532
cmp dword [ebp - 0xe0], 0x10
lea eax, [ebp - 0xf4]
push 0
cmovae eax, dword [ebp - 0xf4]
push eax
call esi
test eax, eax
jne 0x1cfbf3b
mov esi, dword [0x538b44]
mov edi, dword [0x538b40]
push eax
push 2
push esi
push edi
call fcn.01d97ca0
mov ecx, dword [0x538b48]
sub ecx, eax
mov eax, dword [0x538b4c]
mov dword [ebp - 0x14], ecx
sbb eax, edx
mov dword [0x538b48], ecx
mov dword [ebp - 0x10], eax
xor ecx, edi
mov edx, dword [ebp - 0x10]
mov dword [0x538b4c], eax
mov eax, esi
xor eax, edx
or ecx, eax
je 0x1cfbf17
add edi, dword [ebp - 0x14]
mov dword [0x538b40], edi
adc esi, edx
mov dword [0x538b44], esi
test esi, esi
jl 0x1cfbf30
jg 0x1cfbf25
cmp edi, 0x186a0
jbe 0x1cfbf30
xorps xmm0, xmm0
movlpd qword [0x538b40], xmm0
lea ecx, [ebp - 0xf4]
call fcn.01cb8800
cmp dword [ebp - 0xe0], 0x10
lea eax, [ebp - 0xf4]
cmovae eax, dword [ebp - 0xf4]
mov dword [ebp - 0x38], eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x24], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
mov ecx, dword [ecx + esi + 0x7c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
lea ecx, [esi + edx]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
je 0x1cfbfcf
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1cfbfcf
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x10], ecx
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1cfbfc5
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x1cfbfa8
cmp esi, 0x7a5b9fa2
je 0x1cfbfd3
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x1cfbf90
mov eax, dword [eax]
jmp 0x1cfbf60
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
push dword [ebp - 0x38]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
cmp dword [ebp - 0xe0], 0x10
lea eax, [ebp - 0xf4]
push dword [ebp - 0xe4]
cmovae eax, dword [ebp - 0xf4]
mov ecx, 0x538c1c
push eax
call fcn.01d01910
call fcn.01cb8ac0
test al, al
je 0x1cfc239
mov dword [ebp - 0x9f], 0x292b2625
xor ecx, ecx
mov word [ebp - 0x9b], 0x7823
mov byte [ebp - 0x99], 0
nop
movzx eax, byte [ebp + ecx - 0x9f]
push eax
call fcn.01d02ea0
mov byte [ebp + ecx - 0x9f], al
inc ecx
cmp ecx, 6
jb 0x1cfc040
push 0x538bbc
lea edx, [ebp - 0x9f]
lea ecx, [ebp - 0x228]
call fcn.01d05f10
add esp, 4
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], 0x10
jb 0x1cfc080
mov eax, dword [eax]
push eax
push 1
push 0
call dword [0x5051c0]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x228]
call fcn.01ca5090
call dword [0x505084]
cmp eax, 0xb7
jne 0x1cfc126
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xe0]
cmp ecx, 0x10
jb 0x1cfc0e5
mov edx, dword [ebp - 0xf4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1cfc0db
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1cfe56f
push ecx
push edx
call fcn.01d5c4b1
add esp, 8
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe0], 0xf
mov byte [ebp - 0xf4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f8]
call fcn.01ca5090
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebp - 0xa8], 0x9041c02
xor ecx, ecx
mov dword [ebp - 0xa4], 0x26262e64
mov byte [ebp - 0xa0], 0
nop dword [eax]
nop word [eax + eax]
movzx eax, byte [ebp + ecx - 0xa8]
push eax
call fcn.01d02ea0
mov byte [ebp + ecx - 0xa8], al
inc ecx
cmp ecx, 8
jb 0x1cfc150
sub esp, 0x18
lea ecx, [ebp - 0xa8]
mov edx, esp
mov dword [ebp - 0x10], esp
xorps xmm0, xmm0
lea esi, [ecx + 1]
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1cfc190
sub ecx, esi
lea eax, [ebp - 0xa8]
push ecx
push eax
mov ecx, edx
call fcn.01ca52a0
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 9
call fcn.01cbf620
mov ecx, dword [0x53b124]
mov eax, 0x2aaaaaab
sub ecx, dword [0x53b120]
add esp, 0x18
mov esi, dword [0x50506c]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x1cfc203
nop dword [eax]
push 0x64
call esi
mov ecx, dword [0x53b124]
mov eax, 0x2aaaaaab
sub ecx, dword [0x53b120]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x1cfc1e0
push 2
push dword [0x538b3c]
mov byte [0x53af29], 1
call dword [0x505328]
push dword [0x538b3c]
call dword [0x505324]
call dword [0x505320]
nop word [eax + eax]
push 0x3e8
call esi
jmp 0x1cfc230
mov esi, dword [0x538b44]
mov edi, dword [0x538b40]
push 0
push 2
push esi
push edi
call fcn.01d97ca0
mov ecx, dword [0x538b48]
sub ecx, eax
mov eax, dword [0x538b4c]
mov dword [ebp - 0x14], ecx
sbb eax, edx
mov dword [0x538b48], ecx
mov dword [ebp - 0x10], eax
xor ecx, edi
mov edx, dword [ebp - 0x10]
mov dword [0x538b4c], eax
mov eax, esi
xor eax, edx
or ecx, eax
je 0x1cfc28e
add edi, dword [ebp - 0x14]
mov dword [0x538b40], edi
adc esi, edx
mov dword [0x538b44], esi
test esi, esi
jl 0x1cfc2a7
jg 0x1cfc29c
cmp edi, 0x186a0
jbe 0x1cfc2a7
xorps xmm0, xmm0
movlpd qword [0x538b40], xmm0
push 5
push 0x9cdf3536
mov byte [0x53af4c], 0
call fcn.01cab4a0
xorps xmm0, xmm0
mov dword [ebp - 0x10], eax
mov eax, dword [0x538b3c]
add esp, 8
movups xmmword [ebp - 0x10c], xmm0
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xf8], 0xf
mov byte [ebp - 0x10c], 0
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x54]
call fcn.01d01bc0
mov byte [ebp - 4], 0xe
xor esi, esi
cmp dword [ebp - 0x44], esi
jbe 0x1cfc453
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x54]
nop dword [eax]
cmp ecx, 0x10
lea eax, [ebp - 0x54]
cmovae eax, edx
xor byte [eax + esi], 0x36
lea eax, [ebp - 0x54]
mov ecx, dword [ebp - 0x40]
cmp ecx, 0x10
mov edx, dword [ebp - 0x54]
cmovae eax, edx
cmp byte [eax + esi], 0
lea eax, [ebp - 0x54]
jne 0x1cfc364
cmp ecx, 0x10
cmovae eax, edx
mov byte [eax + esi], 0x55
jmp 0x1cfc443
cmp ecx, 0x10
cmovae eax, edx
cmp byte [eax + esi], 0x55
lea eax, [ebp - 0x54]
jne 0x1cfc382
cmp ecx, 0x10
cmovae eax, edx
mov byte [eax + esi], 0xff
jmp 0x1cfc443
cmp ecx, 0x10
cmovae eax, edx
cmp byte [eax + esi], 0xff
lea eax, [ebp - 0x54]
jne 0x1cfc3a0
cmp ecx, 0x10
cmovae eax, edx
mov byte [eax + esi], 0xfd
jmp 0x1cfc443
cmp ecx, 0x10
cmovae eax, edx
cmp byte [eax + esi], 0xfd
lea eax, [ebp - 0x54]
jne 0x1cfc3be
cmp ecx, 0x10
cmovae eax, edx
mov byte [eax + esi], 0xde
jmp 0x1cfc443
cmp ecx, 0x10
cmovae eax, edx
cmp byte [eax + esi], 0xde
lea eax, [ebp - 0x54]
jne 0x1cfc3d9
cmp ecx, 0x10
cmovae eax, edx
mov byte [eax + esi], 5
jmp 0x1cfc443
cmp ecx, 0x10
cmovae eax, edx
cmp byte [eax + esi], 5
lea eax, [ebp - 0x54]
jne 0x1cfc3f4
cmp ecx, 0x10
cmovae eax, edx
mov byte [eax + esi], 1
jmp 0x1cfc443
cmp ecx, 0x10
cmovae eax, edx
cmp byte [eax + esi], 1
lea eax, [ebp - 0x54]
jne 0x1cfc40f
cmp ecx, 0x10
cmovae eax, edx
mov byte [eax + esi], 0xa
jmp 0x1cfc443
cmp ecx, 0x10
cmovae eax, edx
cmp byte [eax + esi], 0xa
lea eax, [ebp - 0x54]
jne 0x1cfc42a
cmp ecx, 0x10
cmovae eax, edx
mov byte [eax + esi], pe_nt_image_headers32
jmp 0x1cfc443
cmp ecx, 0x10
cmovae eax, edx
cmp byte [eax + esi], 0x80
jne 0x1cfc449
cmp ecx, 0x10
lea eax, [ebp - 0x54]
cmovae eax, edx
mov byte [eax + esi], 0
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x54]
inc esi
cmp esi, dword [ebp - 0x44]
jb 0x1cfc330
movups xmm0, xmmword [ebp - 0x54]
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x1c0], 0
movups xmmword [ebp - 0x1d4], xmm0
movups xmmword [ebp - 0xd8], xmm0
movq xmm0, qword [ebp - 0x44]
movq qword [ebp - 0x1c4], xmm0
mov esi, dword [ebp - 0x20]
or esi, 0x4000
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0xf
mov byte [ebp - 0x54], 0
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0xf
mov byte [ebp - 0x54], 0
call fcn.01ca5090
movups xmm0, xmmword [ebp - 0xd8]
and esi, 0xffffbfff
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x1c0], 0xf
movups xmmword [ebp - 0x10c], xmm0
mov byte [ebp - 0x1d4], 0
movq xmm0, qword [ebp - 0x1c]
movq qword [ebp - 0xfc], xmm0
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 0xc
xorps xmm0, xmm0
movups xmmword [ebp - 0x98], xmm0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x1c0], 0xf
mov byte [ebp - 0x1d4], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0xf
mov byte [ebp - 0x98], 0
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x28], 0xd8bf1
mov eax, dword [ebp - 0x28]
xor eax, 0x17
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
xor ecx, 0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x3c], 0x17
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x28], 0x12056
mov dword [ebp - 0x24], 0
mov dword [ebp - 0xd0], 0x6be
mov dword [ebp - 0xcc], 0
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
add edx, eax
mov ecx, dword [ebp - 0x38]
adc esi, ecx
add edx, 1
mov dword [ebp - 0x28], edx
adc esi, 0
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0xcc]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
sub edx, eax
mov dword [ebp - 0x1c], edx
sbb esi, ecx
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
push eax
push ecx
push edx
push esi
call fcn.01d5cb00
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0xfc]
add ecx, edi
mov eax, dword [ebp - 0x88]
cmp ecx, eax
ja 0x1cfc640
cmp dword [ebp - 0x84], 0x10
lea eax, [ebp - 0x98]
mov dword [ebp - 0x88], ecx
cmovae eax, dword [ebp - 0x98]
mov byte [eax + ecx], 0
jmp 0x1cfc650
sub ecx, eax
push 0
push ecx
lea ecx, [ebp - 0x98]
call fcn.01d04100
cmp dword [ebp - 0x84], 0x10
lea eax, [ebp - 0x98]
push 5
cmovae eax, dword [ebp - 0x98]
lea esi, [ebp - 0x98]
push 0x9cc64e62
mov dword [eax], 0xabbadaad
cmp dword [ebp - 0x84], 0x10
cmovae esi, dword [ebp - 0x98]
call fcn.01cab4a0
push 0
push 0x32c6d558
mov dword [eax + esi], edi
lea esi, [ebp - 0x98]
cmp dword [ebp - 0x84], 0x10
cmovae esi, dword [ebp - 0x98]
call fcn.01cab5d0
mov ecx, dword [ebp - 0x10]
add esp, 0x10
mov dword [eax + esi], ecx
test edi, edi
je 0x1cfc7b2
cmp dword [ebp - 0xf8], 0x10
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x1c], 0xd8bf1
lea edi, [ebp - 0x98]
cmovae eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x84], 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
cmovae edi, dword [ebp - 0x98]
xor eax, 0x17
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x6c], eax
xor ecx, 0
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0xd0], 0x17
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0x1c], 0x12056
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x64], 0x6be
mov dword [ebp - 0x60], 0
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0xd0]
add edx, eax
mov ecx, dword [ebp - 0xcc]
adc esi, ecx
add edx, 1
mov dword [ebp - 0xd0], edx
adc esi, 0
mov dword [ebp - 0xcc], esi
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x60]
mov edx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x68]
sub edx, eax
mov dword [ebp - 0x1c], edx
sbb esi, ecx
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xd0]
mov eax, dword [ebp - 0xcc]
push eax
push ecx
push edx
push esi
call fcn.01d5cb00
push dword [ebp - 0xfc]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
add ecx, edi
push ecx
call fcn.01d73fa0
add esp, 0xc
push 5
push 0x9cc64bd6
call fcn.01cab4a0
mov ecx, dword [ebp - 0x88]
mov esi, eax
add esp, 8
cmp esi, ecx
jae 0x1cfc812
mov edi, dword [0x50534c]
nop dword [eax]
nop word [eax + eax]
sub ecx, esi
lea eax, [ebp - 0x98]
cmp dword [ebp - 0x84], 0x10
push 0
cmovae eax, dword [ebp - 0x98]
push ecx
add eax, esi
push eax
push dword [ebp - 0x14]
call edi
cmp eax, 0xffffffff
je 0x1cfc850
mov ecx, dword [ebp - 0x88]
add esi, eax
cmp esi, ecx
jb 0x1cfc7e0
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x84]
cmp ecx, 0x10
jb 0x1cfc8c7
mov edx, dword [ebp - 0x98]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1cfc8bd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1cfe574
jmp 0x1cfc8bd
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x84]
cmp ecx, 0x10
jb 0x1cfc88e
mov edx, dword [ebp - 0x98]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1cfc884
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1cfe574
push ecx
push edx
call fcn.01d5c4b1
add esp, 8
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0xf
mov byte [ebp - 0x98], 0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x10c]
call fcn.01ca5090
jmp 0x1cfc9a5
push ecx
push edx
call fcn.01d5c4b1
add esp, 8
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0xf
mov byte [ebp - 0x98], 0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x10c]
call fcn.01ca5090
cmp byte [0x53af4c], 0
jne 0x1cfc9a5
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x24], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
lea ecx, [edx + esi]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
je 0x1cfc977
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1cfc977
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x10], ecx
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1cfc96d
nop
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x1cfc950
cmp esi, 0x2fa62ca8
je 0x1cfc97b
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x1cfc936
mov eax, dword [eax]
jmp 0x1cfc910
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
push 0x64
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
cmp byte [0x53af4c], 0
je 0x1cfc900
call fcn.01cab480
mov eax, dword [0x538b40]
lea ecx, [ebp - 0x260]
xor dword [0x538b48], eax
mov edx, 0x538b74
mov eax, dword [0x538b44]
xor dword [0x538b4c], eax
call fcn.01cbbd90
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x124]
call fcn.01d01bc0
mov byte [ebp - 4], 0x11
mov ecx, 0x538b74
call fcn.01ca4f70
test eax, eax
jne 0x1cfca70
mov esi, dword [0x50506c]
nop
lea ecx, [ebp - 0x124]
call fcn.01ca4f70
test eax, eax
jne 0x1cfca70
mov edx, 0x538b74
lea ecx, [ebp - 0x4c4]
call fcn.01cbbd90
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x260]
push eax
call fcn.01d06ad0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x4c4]
call fcn.01cbdbf0
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x124]
call fcn.01d01a70
push 1
push 0x4663810e
call fcn.01cab5d0
add esp, 8
push eax
call esi
mov ecx, 0x538b74
call fcn.01ca4f70
test eax, eax
je 0x1cfca00
push 0x52098c
mov ecx, 0x538b74
call fcn.01d018a0
push eax
call fcn.01d73b90
add esp, 8
test eax, eax
je 0x1cfcb0c
push 0x52067c
lea ecx, [ebp - 0x228]
call fcn.01ca4f90
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x290]
push 0x52098c
call fcn.01ca4f90
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x228]
push eax
lea edx, [ebp - 0x290]
mov ecx, 0x538b74
call fcn.01caabc0
add esp, 4
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x290]
call fcn.01ca4f80
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x228]
call fcn.01ca4f80
push 0x52098c
mov ecx, 0x538b74
call fcn.01d018a0
push eax
call fcn.01d73b90
add esp, 8
test eax, eax
jne 0x1cfca90
lea eax, [ebp - 0x1d7]
push eax
call fcn.01cfe580
mov esi, eax
xor edx, edx
nop dword [eax]
movzx ecx, byte [edx + esi]
push ecx
call fcn.01d02ea0
mov byte [edx + esi], al
inc edx
cmp edx, 2
jb 0x1cfcb20
push esi
lea ecx, [ebp - 0x3f4]
call fcn.01ca4f90
mov byte [ebp - 4], 0x15
mov edx, eax
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x124]
or esi, 1
mov dword [ebp - 0x20], esi
call fcn.01d06140
test al, al
jne 0x1cfce36
lea eax, [ebp - 0x1dd]
push eax
call fcn.01cfe5a0
mov edi, eax
xor edx, edx
movzx ecx, byte [edx + edi]
push ecx
call fcn.01d02ea0
mov byte [edx + edi], al
inc edx
cmp edx, 2
jb 0x1cfcb71
push edi
lea ecx, [ebp - 0x3dc]
call fcn.01ca4f90
mov dword [ebp - 4], 0x16
or esi, 2
mov edx, eax
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x124]
call fcn.01d06140
test al, al
jne 0x1cfce36
lea eax, [ebp - 0x1da]
push eax
call fcn.01cfe5c0
mov edi, eax
xor edx, edx
movzx ecx, byte [edx + edi]
push ecx
call fcn.01d02ea0
mov byte [edx + edi], al
inc edx
cmp edx, 2
jb 0x1cfcbc2
push edi
lea ecx, [ebp - 0x3c4]
call fcn.01ca4f90
mov dword [ebp - 4], 0x17
or esi, 4
mov edx, eax
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x124]
call fcn.01d06140
test al, al
jne 0x1cfce36
lea eax, [ebp - 0x143]
push eax
call fcn.01cfe5e0
mov edi, eax
xor edx, edx
movzx ecx, byte [edx + edi]
push ecx
call fcn.01d02ea0
mov byte [edx + edi], al
inc edx
cmp edx, 2
jb 0x1cfcc13
push edi
lea ecx, [ebp - 0x3ac]
call fcn.01ca4f90
mov dword [ebp - 4], 0x18
or esi, 8
mov edx, eax
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x124]
call fcn.01d06140
test al, al
jne 0x1cfce36
lea eax, [ebp - 0x2f]
push eax
call fcn.01cfe600
mov edi, eax
xor edx, edx
movzx ecx, byte [edx + edi]
push ecx
call fcn.01d02ea0
mov byte [edx + edi], al
inc edx
cmp edx, 2
jb 0x1cfcc61
push edi
lea ecx, [ebp - 0x394]
call fcn.01ca4f90
mov dword [ebp - 4], 0x19
or esi, 0x10
mov edx, eax
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x124]
call fcn.01d06140
test al, al
jne 0x1cfce36
lea eax, [ebp - 0xdb]
push eax
call fcn.01cfe620
mov edi, eax
xor edx, edx
movzx ecx, byte [edx + edi]
push ecx
call fcn.01d02ea0
mov byte [edx + edi], al
inc edx
cmp edx, 2
jb 0x1cfccb2
push edi
lea ecx, [ebp - 0x37c]
call fcn.01ca4f90
mov dword [ebp - 4], 0x1a
or esi, 0x20
mov edx, eax
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x124]
call fcn.01d06140
test al, al
jne 0x1cfce36
lea eax, [ebp - 0xab]
push eax
call fcn.01cfe640
mov edi, eax
xor edx, edx
movzx ecx, byte [edx + edi]
push ecx
call fcn.01d02ea0
mov byte [edx + edi], al
inc edx
cmp edx, 2
jb 0x1cfcd03
push edi
lea ecx, [ebp - 0x364]
call fcn.01ca4f90
mov dword [ebp - 4], 0x1b
or esi, 0x40
mov edx, eax
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x124]
call fcn.01d06140
test al, al
jne 0x1cfce36
lea eax, [ebp - 0xaf]
push eax
call fcn.01cfe660
mov edi, eax
xor edx, edx
movzx ecx, byte [edx + edi]
push ecx
call fcn.01d02ea0
mov byte [edx + edi], al
inc edx
cmp edx, 2
jb 0x1cfcd54
push edi
lea ecx, [ebp - 0x34c]
call fcn.01ca4f90
mov dword [ebp - 4], 0x1c
or esi, 0x80
mov edx, eax
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x124]
call fcn.01d06140
test al, al
jne 0x1cfce36
lea eax, [ebp - 0x33]
push eax
call fcn.01cfe680
mov edi, eax
xor edx, edx
movzx ecx, byte [edx + edi]
push ecx
call fcn.01d02ea0
mov byte [edx + edi], al
inc edx
cmp edx, 2
jb 0x1cfcda5
push edi
lea ecx, [ebp - 0x334]
call fcn.01ca4f90
mov dword [ebp - 4], 0x1d
or esi, 0x100
mov edx, eax
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x124]
call fcn.01d06140
test al, al
jne 0x1cfce36
lea eax, [ebp - 0x5b]
push eax
call fcn.01cfe6a0
mov edi, eax
xor edx, edx
movzx ecx, byte [edx + edi]
push ecx
call fcn.01d02ea0
mov byte [edx + edi], al
inc edx
cmp edx, 2
jb 0x1cfcdf2
push edi
lea ecx, [ebp - 0x31c]
call fcn.01ca4f90
mov dword [ebp - 4], 0x1e
or esi, 0x200
mov edx, eax
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x124]
call fcn.01d06140
mov byte [ebp - 0x29], 0
test al, al
je 0x1cfce3a
mov byte [ebp - 0x29], 1
mov dword [ebp - 4], 0x1d
mov eax, dword [ebp - 0x20]
test eax, 0x200
je 0x1cfce61
and eax, 0xfffffdff
lea ecx, [ebp - 0x31c]
mov dword [ebp - 0x20], eax
call fcn.01ca4f80
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], 0x1c
test eax, 0x100
je 0x1cfce85
and eax, 0xfffffeff
lea ecx, [ebp - 0x334]
mov dword [ebp - 0x20], eax
call fcn.01ca4f80
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], 0x1b
test al, al
jns 0x1cfcea6
and eax, 0xffffff7f
lea ecx, [ebp - 0x34c]
mov dword [ebp - 0x20], eax
call fcn.01ca4f80
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], 0x1a
test al, 0x40
je 0x1cfcec5
and eax, 0xffffffbf
lea ecx, [ebp - 0x364]
mov dword [ebp - 0x20], eax
call fcn.01ca4f80
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], 0x19
test al, 0x20
je 0x1cfcee4
and eax, 0xffffffdf
lea ecx, [ebp - 0x37c]
mov dword [ebp - 0x20], eax
call fcn.01ca4f80
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], 0x18
test al, 0x10
je 0x1cfcf03
and eax, 0xffffffef
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x20], eax
call fcn.01ca4f80
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], 0x17
test al, 8
je 0x1cfcf22
and eax, 0xfffffff7
lea ecx, [ebp - 0x3ac]
mov dword [ebp - 0x20], eax
call fcn.01ca4f80
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], 0x16
test al, 4
je 0x1cfcf41
and eax, 0xfffffffb
lea ecx, [ebp - 0x3c4]
mov dword [ebp - 0x20], eax
call fcn.01ca4f80
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], 0x15
test al, 2
je 0x1cfcf60
and eax, 0xfffffffd
lea ecx, [ebp - 0x3dc]
mov dword [ebp - 0x20], eax
call fcn.01ca4f80
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], 0x11
test al, 1
je 0x1cfcf7c
and eax, 0xfffffffe
lea ecx, [ebp - 0x3f4]
mov dword [ebp - 0x20], eax
call fcn.01ca4f80
cmp byte [ebp - 0x29], 0
je 0x1cfd018
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x24], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
lea ecx, [edx + esi]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
je 0x1cfcff7
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1cfcff7
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x10], ecx
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1cfcfed
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x1cfcfd0
cmp esi, 0xe80fd3a
je 0x1cfcffb
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x1cfcfb8
mov eax, dword [eax]
jmp 0x1cfcf92
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
push 0
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
call fcn.01cbfca0
call fcn.01cc0290
call fcn.01cc0880
call fcn.01cc0e70
mov ecx, 0x53b050
call fcn.01cff3e0
test al, al
je 0x1cfd2ca
call fcn.01cff3f0
test al, al
jne 0x1cfd2ca
lea eax, [ebp - 0x303]
push eax
call fcn.01cfe6c0
mov esi, eax
xor edx, edx
nop dword [eax + eax]
movzx ecx, byte [edx + esi]
push ecx
call fcn.01d02ea0
mov byte [edx + esi], al
inc edx
cmp edx, 0xb
jb 0x1cfd060
push esi
mov ecx, 0x53b050
call fcn.01d061b0
mov ecx, eax
call fcn.01d069e0
mov byte [0x538b3b], al
lea eax, [ebp - 0x276]
push eax
call fcn.01cfe6e0
mov esi, eax
xor edx, edx
nop word [eax + eax]
movzx ecx, byte [edx + esi]
push ecx
call fcn.01d02ea0
mov byte [edx + esi], al
inc edx
cmp edx, 7
jb 0x1cfd0a0
push esi
mov ecx, 0x53b050
call fcn.01d061b0
mov ecx, eax
call fcn.01d069e0
mov byte [0x538b55], al
lea eax, [ebp - 0xa7]
push eax
call fcn.01cfe700
mov esi, eax
xor edx, edx
nop word [eax + eax]
movzx ecx, byte [edx + esi]
push ecx
call fcn.01d02ea0
mov byte [edx + esi], al
inc edx
cmp edx, 7
jb 0x1cfd0e0
push esi
mov ecx, 0x53b050
call fcn.01d061b0
mov ecx, eax
call fcn.01d069e0
mov byte [0x538b3a], al
lea eax, [ebp - 0x461]
push eax
call fcn.01cfe720
mov esi, eax
xor edx, edx
nop word [eax + eax]
movzx ecx, byte [edx + esi]
push ecx
call fcn.01d02ea0
mov byte [edx + esi], al
inc edx
cmp edx, 0xc
jb 0x1cfd120
push esi
mov ecx, 0x53b050
call fcn.01d061b0
mov ecx, eax
call fcn.01d069e0
mov byte [0x538b39], al
lea eax, [ebp - 0x46f]
push eax
call fcn.01cfe750
mov esi, eax
xor edx, edx
nop word [eax + eax]
movzx ecx, byte [esi + edx]
push ecx
call fcn.01d02ea0
mov byte [esi + edx], al
inc edx
cmp edx, 0xd
jb 0x1cfd160
push esi
mov ecx, 0x53b050
call fcn.01d061b0
mov ecx, eax
call fcn.01d069e0
mov byte [0x538b54], al
lea eax, [ebp - 0x2ec]
push eax
call fcn.01cfe780
mov esi, eax
xor edx, edx
nop word [eax + eax]
movzx ecx, byte [edx + esi]
push ecx
call fcn.01d02ea0
mov byte [edx + esi], al
inc edx
cmp edx, 8
jb 0x1cfd1a0
push esi
mov ecx, 0x53b050
call fcn.01d061b0
mov ecx, eax
call fcn.01d069e0
mov byte [0x538b56], al
lea eax, [ebp - 0x2f7]
push eax
call fcn.01cfe7a0
mov esi, eax
xor edx, edx
nop word [eax + eax]
movzx ecx, byte [edx + esi]
push ecx
call fcn.01d02ea0
mov byte [edx + esi], al
inc edx
cmp edx, 0xa
jb 0x1cfd1e0
push esi
mov ecx, 0x53b050
call fcn.01d061b0
mov ecx, eax
call fcn.01d069e0
mov byte [0x538b38], al
lea eax, [ebp - 0x47f]
push eax
call fcn.01cfe7d0
mov esi, eax
xor edx, edx
nop word [eax + eax]
movzx ecx, byte [edx + esi]
push ecx
call fcn.01d02ea0
mov byte [edx + esi], al
inc edx
cmp edx, 0xf
jb 0x1cfd220
push esi
mov ecx, 0x53b050
call fcn.01d061b0
mov ecx, eax
call fcn.01d069e0
mov byte [0x538b58], al
lea eax, [ebp - 0x2e3]
push eax
call fcn.01cfe800
mov esi, eax
xor edx, edx
nop word [eax + eax]
movzx ecx, byte [edx + esi]
push ecx
call fcn.01d02ea0
mov byte [edx + esi], al
inc edx
cmp edx, 8
jb 0x1cfd260
push esi
mov ecx, 0x53b050
call fcn.01d061b0
mov ecx, eax
call fcn.01d069e0
mov byte [0x538b57], al
lea eax, [ebp - 0x2da]
push eax
call fcn.01cfe820
mov edi, eax
xor esi, esi
nop word [eax + eax]
movzx edx, byte [esi + edi]
push edx
call fcn.01d02ea0
mov byte [esi + edi], al
inc esi
cmp esi, 8
jb 0x1cfd2a0
push edi
mov ecx, 0x53b050
call fcn.01d061b0
mov ecx, eax
call fcn.01d069e0
mov byte [0x53af46], al
call fcn.01ce9290
call fcn.01cebd30
mov ecx, 0x53b008
call fcn.01cfec00
mov ecx, 0x53b09c
call fcn.01cfec00
mov esi, dword [0x5050b4]
push 0
push 0
push 0
push 0x449d90
push 0
push 0
call esi
push 0
push 0
push 0
push 0x44b170
push 0
push 0
mov dword [ebp - 0x24], eax
call esi
push 0
push 0
push 0
push 0x452680
push 0
push 0
mov dword [ebp - 0x38], eax
call esi
mov dword [ebp - 0x5c], eax
call fcn.01cd9db0
test al, al
je 0x1cfd3dd
lea ecx, [ebp - 0x2a0]
call fcn.01cda060
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x1f
lea eax, [ebp - 0x267]
push eax
call fcn.01cd5560
mov edi, eax
xor edx, edx
nop dword [eax]
movzx ecx, byte [edx + edi]
push ecx
call fcn.01d02ea0
mov byte [edx + edi], al
inc edx
cmp edx, 6
jb 0x1cfd360
mov ecx, dword [ebp - 0x10]
sub esp, 0x10
mov esi, esp
mov dword [ebp - 0x14], esp
push edi
call fcn.01d061b0
push eax
mov ecx, esi
call fcn.01cff750
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x2d1]
push eax
call fcn.01cfe840
mov esi, eax
xor edx, edx
movzx ecx, byte [edx + esi]
push ecx
call fcn.01d02ea0
mov byte [edx + esi], al
inc edx
cmp edx, 8
jb 0x1cfd3a0
push esi
mov ecx, 0x53b0b8
call fcn.01d061b0
mov byte [ebp - 4], 0x1f
mov ecx, eax
call fcn.01cff6e0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x2a0]
call fcn.01cff6d0
call fcn.01cda030
lea ecx, [ebp - 0x2c8]
call fcn.01cdb330
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x26e]
push eax
call fcn.01cd5560
mov edi, eax
xor edx, edx
nop
movzx ecx, byte [edx + edi]
push ecx
call fcn.01d02ea0
mov byte [edx + edi], al
inc edx
cmp edx, 6
jb 0x1cfd400
mov ecx, dword [ebp - 0x10]
sub esp, 0x10
mov esi, esp
mov dword [ebp - 0x14], esp
push edi
call fcn.01d061b0
push eax
mov ecx, esi
call fcn.01cff750
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x492]
push eax
call fcn.01cfe860
mov esi, eax
xor edx, edx
movzx ecx, byte [edx + esi]
push ecx
call fcn.01d02ea0
mov byte [edx + esi], al
inc edx
cmp edx, 0x12
jb 0x1cfd440
push esi
mov ecx, 0x53b0b8
call fcn.01d061b0
mov byte [ebp - 4], 0x21
mov ecx, eax
call fcn.01cff6e0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x2c8]
call fcn.01cff6d0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x34], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
lea ecx, [esi + edx]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
je 0x1cfd4ef
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1cfd4ef
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
nop word [eax + eax]
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x10], ecx
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1cfd4e5
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x1cfd4c8
cmp esi, 0x71948ca4
je 0x1cfd4f3
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x1cfd4b0
mov eax, dword [eax]
jmp 0x1cfd484
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x34]
push 0x493e0
push dword [ebp - 0x24]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x34], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
lea ecx, [esi + edx]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
je 0x1cfd587
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1cfd587
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x10], ecx
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1cfd57d
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x1cfd560
cmp esi, 0x71948ca4
je 0x1cfd58b
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x1cfd548
mov eax, dword [eax]
jmp 0x1cfd522
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x34]
push 0x493e0
push dword [ebp - 0x38]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop word [eax + eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x34], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
lea ecx, [edx + esi]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
je 0x1cfd627
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1cfd627
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x10], ecx
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1cfd61d
nop
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x1cfd600
cmp esi, 0x71948ca4
je 0x1cfd62b
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x1cfd5e6
mov eax, dword [eax]
jmp 0x1cfd5c0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x34]
push 0x493e0
push dword [ebp - 0x5c]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop word [eax + eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x34], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
lea ecx, [edx + esi]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
je 0x1cfd6c7
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1cfd6c7
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x10], ecx
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1cfd6bd
nop
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x1cfd6a0
cmp esi, 0xfaba0065
je 0x1cfd6cb
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x1cfd686
mov eax, dword [eax]
jmp 0x1cfd660
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x34]
push dword [ebp - 0x24]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x24], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
lea ecx, [edx + esi]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
je 0x1cfd75f
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1cfd75f
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
nop dword [eax + eax]
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x10], ecx
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1cfd755
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x1cfd738
cmp esi, 0xfaba0065
je 0x1cfd763
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x1cfd720
mov eax, dword [eax]
jmp 0x1cfd6f5
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
push dword [ebp - 0x38]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x24], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
lea ecx, [edx + esi]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
je 0x1cfd7f7
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1cfd7f7
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x10], ecx
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1cfd7ed
nop
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x1cfd7d0
cmp esi, 0xfaba0065
je 0x1cfd7fb
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x1cfd7b6
mov eax, dword [eax]
jmp 0x1cfd790
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
push dword [ebp - 0x5c]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
mov esi, dword [0x5050b4]
push 0
push 0
push 0
push 0x452c10
push 0
push 0
call esi
push 0
push 0
push 0
push 0x453c30
push 0
push 0
mov dword [ebp - 0x24], eax
call esi
push 0
push 0
push 0
push 0x455450
push 0
push 0
mov dword [ebp - 0x38], eax
call esi
push 0
push 0
push 0
push 0x456160
push 0
push 0
mov dword [ebp - 0x5c], eax
call esi
push 0
push 0
push 0
push 0x457830
push 0
push 0
mov dword [ebp - 0x34], eax
call esi
push 0
push 0
push 0
push 0x457940
push 0
push 0
mov dword [ebp - 0xb0], eax
call esi
push 0
push 0
push 0
push 0x458640
push 0
push 0
mov dword [ebp - 0xac], eax
call esi
sub esp, 0x18
mov dword [ebp - 0xdc], eax
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x538b74
call fcn.01d01bc0
mov byte [ebp - 4], 0x23
sub esp, 0x18
lea eax, [ebp - 0x248]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.01d01bc0
mov byte [ebp - 4], 0x24
sub esp, 0x18
lea eax, [ebp - 0x260]
mov dword [ebp - 0x30], esp
mov ecx, esp
push eax
call fcn.01d01bc0
mov byte [ebp - 4], 0x25
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x144], esp
push 0x538b8c
call fcn.01d01bc0
mov byte [ebp - 4], 0x26
mov byte [ebp - 4], 0x11
call fcn.01caf330
mov eax, dword fs:[0x30]
add esp, 0x60
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax + eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x30], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
lea ecx, [edx + esi]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
je 0x1cfd997
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1cfd997
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x10], ecx
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1cfd98d
nop
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x1cfd970
cmp esi, 0x71948ca4
je 0x1cfd99b
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x1cfd956
mov eax, dword [eax]
jmp 0x1cfd930
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
push 0x493e0
push dword [ebp - 0x24]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop word [eax + eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x30], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
lea ecx, [edx + esi]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
je 0x1cfda37
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1cfda37
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x10], ecx
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1cfda2d
nop
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x1cfda10
cmp esi, 0x71948ca4
je 0x1cfda3b
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x1cfd9f6
mov eax, dword [eax]
jmp 0x1cfd9d0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
push 0x493e0
push dword [ebp - 0x38]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop word [eax + eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x30], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
lea ecx, [edx + esi]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
je 0x1cfdad7
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1cfdad7
mov eax, dword [eax]
jmp 0x1cfda70
push 0xbb8
call dword [0x50506c]
push 2
push dword [0x538b3c]
call dword [0x505328]
push dword [0x538b3c]
call dword [0x505324]
call dword [0x505320]
push 0
call dword [0x5050e4]
call fcn.01d779a0
call fcn.01d779a0
call fcn.01d779a0
call fcn.01d779a0
int3