Function at 0x100634f0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push 0x3d
mov eax, dword [ebp + 8]
push eax
call fcn.1024d740
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10063518
mov ecx, dword [ebp - 0xc]
mov byte [ecx], 0
jmp 0x1006351d
jmp 0x1006737c
mov dword [ebp - 0x168], 0
mov edx, dword [ebp + 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 4], eax
push str.pipe
mov ecx, dword [ebp - 8]
push ecx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063566
push 0x104
mov edx, dword [ebp - 4]
push edx
push 0x104f1fb8
call fcn.1025d2b0
add esp, 0xc
jmp 0x1006737c
push str.logpipe
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063596
push 0x104
mov ecx, dword [ebp - 4]
push ecx
push 0x104f20bc
call fcn.1025d2b0
add esp, 0xc
jmp 0x1006737c
push str.shutdown_mutex
mov edx, dword [ebp - 8]
push edx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x100635c6
push 0x104
mov eax, dword [ebp - 4]
push eax
push 0x104f21c0
call fcn.1025d2b0
add esp, 0xc
jmp 0x1006737c
push str.first_process
mov ecx, dword [ebp - 8]
push ecx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063615
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax]
cmp edx, 0x31
jne 0x100635fb
mov dword [ebp - 0xa0], 1
jmp 0x10063605
mov dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0xa0]
mov dword [0x104f22c4], eax
jmp 0x1006737c
push str.startup_time
mov ecx, dword [ebp - 8]
push ecx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063644
push 0xa
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f22c8], eax
jmp 0x1006737c
push str.force_sleepskip
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063694
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x10063679
mov dword [ebp - 0xa4], 1
jmp 0x10063683
mov dword [ebp - 0xa4], 0
mov edx, dword [ebp - 0xa4]
mov dword [0x104f22cc], edx
jmp 0x1006737c
push str.hashes_path
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x100636c4
push 0x104
mov ecx, dword [ebp - 4]
push ecx
push 0x104f22d0
call fcn.1025d2b0
add esp, 0xc
jmp 0x1006737c
push str.diffing_enable
mov edx, dword [ebp - 8]
push edx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063714
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 4]
movsx eax, byte [edx + ecx]
cmp eax, 0x31
jne 0x100636f9
mov dword [ebp - 0xa8], 1
jmp 0x10063703
mov dword [ebp - 0xa8], 0
mov ecx, dword [ebp - 0xa8]
mov dword [0x104f23d4], ecx
jmp 0x1006737c
push str.track
mov edx, dword [ebp - 8]
push edx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063764
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 4]
movsx eax, byte [edx + ecx]
cmp eax, 0x31
jne 0x10063749
mov dword [ebp - 0xac], 1
jmp 0x10063753
mov dword [ebp - 0xac], 0
mov ecx, dword [ebp - 0xac]
mov dword [0x104f23d8], ecx
jmp 0x1006737c
push str.mode
mov edx, dword [ebp - 8]
push edx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x1006378f
mov eax, dword [ebp - 4]
push eax
call fcn.10063380
add esp, 4
mov dword [0x104f23dc], eax
jmp 0x1006737c
push str.disguise_memory
mov ecx, dword [ebp - 8]
push ecx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x100637de
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax]
cmp edx, 0x31
jne 0x100637c4
mov dword [ebp - 0xb0], 1
jmp 0x100637ce
mov dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0xb0]
mov dword [0x104f23e0], eax
jmp 0x1006737c
push str.disguise_cpu
mov ecx, dword [ebp - 8]
push ecx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x1006382d
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax]
cmp edx, 0x31
jne 0x10063813
mov dword [ebp - 0xb4], 1
jmp 0x1006381d
mov dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0xb4]
mov dword [0x104f23e4], eax
jmp 0x1006737c
push str.disguise_sid
mov ecx, dword [ebp - 8]
push ecx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x1006387c
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax]
cmp edx, 0x31
jne 0x10063862
mov dword [ebp - 0xb8], 1
jmp 0x1006386c
mov dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0xb8]
mov dword [0x104f23e8], eax
jmp 0x1006737c
push str.disguise_drivername
mov ecx, dword [ebp - 8]
push ecx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x100638cb
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax]
cmp edx, 0x31
jne 0x100638b1
mov dword [ebp - 0xbc], 1
jmp 0x100638bb
mov dword [ebp - 0xbc], 0
mov eax, dword [ebp - 0xbc]
mov dword [0x104f23ec], eax
jmp 0x1006737c
push str.disguise_hostname
mov ecx, dword [ebp - 8]
push ecx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063907
push 0xf
mov edx, dword [ebp - 4]
push edx
push 0x104f23f0
call fcn.1025d2b0
add esp, 0xc
mov eax, 1
imul ecx, eax, 0xf
mov byte [ecx + 0x104f23f0], 0
jmp 0x1006737c
push str.disguise_username
mov edx, dword [ebp - 8]
push edx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063943
push 0x14
mov eax, dword [ebp - 4]
push eax
push 0x104f2400
call fcn.1025d2b0
add esp, 0xc
mov ecx, 1
imul edx, ecx, 0x14
mov byte [edx + 0x104f2400], 0
jmp 0x1006737c
push str.pipe_pid
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063993
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x10063978
mov dword [ebp - 0xc0], 1
jmp 0x10063982
mov dword [ebp - 0xc0], 0
mov edx, dword [ebp - 0xc0]
mov dword [0x104f2418], edx
jmp 0x1006737c
push str.trigger
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x100639c3
push 0x114
push 0x104f2524
mov ecx, dword [ebp - 4]
push ecx
call fcn.1007de70
add esp, 0xc
jmp 0x1006737c
push str.set_language
mov edx, dword [ebp - 8]
push edx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x100639f0
push 0x20
push 0x104f274c
mov eax, dword [ebp - 4]
push eax
call fcn.1007de70
add esp, 0xc
jmp 0x1006737c
push str.hide_keyboard
mov ecx, dword [ebp - 8]
push ecx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063a20
push 0x104
mov edx, dword [ebp - 4]
push edx
push 0x104f241c
call fcn.1025d2b0
add esp, 0xc
jmp 0x1006737c
push str.hide_python
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063a70
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x10063a55
mov dword [ebp - 0xc4], 1
jmp 0x10063a5f
mov dword [ebp - 0xc4], 0
mov edx, dword [ebp - 0xc4]
mov dword [0x104f2520], edx
jmp 0x1006737c
push str.trap_dirname_count
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063aad
mov ecx, 1
imul edx, ecx, 0
add edx, dword [ebp - 4]
push edx
call fcn.1025c76f
add esp, 4
mov dword [0x104f278c], eax
mov dword [0x104f2794], 0
jmp 0x1006737c
cmp dword [0x104f278c], 0
jle 0x10063b02
push str.ransomware_trap_dirname
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063b02
cmp dword [0x104f2794], 0x32
jge 0x10063afd
push 0x104
imul ecx, dword [0x104f2794], 0x208
add ecx, dword [0x104f2790]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.1007de70
add esp, 0xc
lock inc dword [0x104f2794]
jmp 0x1006737c
push str.results
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063b65
push 0x103
mov ecx, dword [ebp - 4]
push ecx
push 0x104f3ac8
call fcn.1025d2b0
add esp, 0xc
mov dword [ebp - 0x10], 0
jmp 0x10063b3f
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x104
jae 0x10063b60
mov eax, dword [ebp - 0x10]
movsx cx, byte [eax + 0x104f3ac8]
mov edx, dword [ebp - 0x10]
mov word [edx*2 + 0x104f3bcc], cx
jmp 0x10063b36
jmp 0x1006737c
push str.pythonpath
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063bda
push 0x103
mov ecx, dword [ebp - 4]
push ecx
push 0x104f40e0
call fcn.1025d2b0
add esp, 0xc
mov dword [ebp - 0x10], 0
jmp 0x10063ba2
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x104
jae 0x10063bc3
mov eax, dword [ebp - 0x10]
movsx cx, byte [eax + 0x104f40e0]
mov edx, dword [ebp - 0x10]
mov word [edx*2 + 0x104f41e4], cx
jmp 0x10063b99
push 0x104f41e4
push str.Python_path_set_to__ws._n
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.referrer
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063c16
mov ecx, dword [ebp - 4]
push ecx
call fcn.10074f20
add esp, 4
mov dword [0x104f43f4], eax
mov edx, dword [ebp - 4]
push edx
call fcn.10063330
add esp, 4
mov dword [0x104f43f8], eax
jmp 0x1006737c
push str.analyzer
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063cb5
push 0x103
mov ecx, dword [ebp - 4]
push ecx
push 0x104f3dd4
call fcn.1025d2b0
add esp, 0xc
mov dword [ebp - 0x10], 0
jmp 0x10063c57
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x104
jae 0x10063c78
mov eax, dword [ebp - 0x10]
movsx cx, byte [eax + 0x104f3dd4]
mov edx, dword [ebp - 0x10]
mov word [edx*2 + 0x104f3ed8], cx
jmp 0x10063c4e
push 0x104f3ed8
push 0x104f43fc
call fcn.1025a9a0
add esp, 8
push 0x104f43fc
call fcn.1025326f
add esp, 4
cmp eax, 0xff
jae 0x10063cb0
push str.dll_
push 0x104f43fc
call fcn.1025d4a2
add esp, 8
jmp 0x1006737c
push str.debug
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063ce0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025c76f
add esp, 4
mov dword [0x104f4604], eax
jmp 0x1006737c
push str.disable_hook_content
mov edx, dword [ebp - 8]
push edx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063d0b
mov eax, dword [ebp - 4]
push eax
call fcn.1025c76f
add esp, 4
mov dword [0x104f4608], eax
jmp 0x1006737c
push str.serial
mov ecx, dword [ebp - 8]
push ecx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063d3a
push 0x10
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f460c], eax
jmp 0x1006737c
push str.sysvol_ctimelow
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063d69
push 0x10
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f4618], eax
jmp 0x1006737c
push str.sysvol_ctimehigh
mov edx, dword [ebp - 8]
push edx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063d98
push 0x10
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f461c], eax
jmp 0x1006737c
push str.sys32_ctimelow
mov ecx, dword [ebp - 8]
push ecx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063dc7
push 0x10
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f4610], eax
jmp 0x1006737c
push str.sys32_ctimehigh
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063df6
push 0x10
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f4614], eax
jmp 0x1006737c
push str.full_logs
mov edx, dword [ebp - 8]
push edx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063e46
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 4]
movsx eax, byte [edx + ecx]
cmp eax, 0x31
jne 0x10063e2b
mov dword [ebp - 0xc8], 1
jmp 0x10063e35
mov dword [ebp - 0xc8], 0
mov ecx, dword [ebp - 0xc8]
mov dword [0x104f4620], ecx
jmp 0x1006737c
push str.force_flush
mov edx, dword [ebp - 8]
push edx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063e71
mov eax, dword [ebp - 4]
push eax
call fcn.1025c76f
add esp, 4
mov dword [0x104f4624], eax
jmp 0x1006737c
push str.terminate_event
mov ecx, dword [ebp - 8]
push ecx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063ea1
push 0x104
mov edx, dword [ebp - 4]
push edx
push 0x104f4628
call fcn.1025d2b0
add esp, 0xc
jmp 0x1006737c
push str.no_stealth
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063ef1
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x10063ed6
mov dword [ebp - 0xcc], 1
jmp 0x10063ee0
mov dword [ebp - 0xcc], 0
mov edx, dword [ebp - 0xcc]
mov dword [0x104f472c], edx
jmp 0x1006737c
push str.csharp
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10063f41
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x10063f26
mov dword [ebp - 0xd0], 1
jmp 0x10063f30
mov dword [ebp - 0xd0], 0
mov edx, dword [ebp - 0xd0]
mov dword [0x104f4734], edx
jmp 0x1006737c
push str.log_exceptions
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10063f91
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025c76f
add esp, 4
mov dword [0x104f31ac], eax
cmp dword [0x104f31ac], 0
je 0x10063f7f
push str.Exception_logging_enabled._n
call fcn.1003def0
add esp, 4
jmp 0x10063f8c
push str.Exception_logging_disabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.log_breakpoints
mov edx, dword [ebp - 8]
push edx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10064006
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 4]
movsx eax, byte [edx + ecx]
cmp eax, 0x31
jne 0x10063fc6
mov dword [ebp - 0xd4], 1
jmp 0x10063fd0
mov dword [ebp - 0xd4], 0
mov ecx, dword [ebp - 0xd4]
mov dword [0x104f31dc], ecx
cmp dword [0x104f31dc], 0
je 0x10063ff4
push str.Breakpoint_logging_to_behavior_log_enabled._n
call fcn.1003def0
add esp, 4
jmp 0x10064001
push str.Breakpoint_logging_to_behavior_log_disabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.dropped_limit
mov edx, dword [ebp - 8]
push edx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10064049
push 0xa
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f27a0], eax
mov ecx, dword [0x104f27a0]
push ecx
push str.Dropped_file_limit_set_to__d._n
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.ntdll_protect
mov edx, dword [ebp - 8]
push edx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x1006409d
push 0xa
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f279c], eax
cmp dword [0x104f279c], 0
je 0x1006408b
push str.Config:_ntdll_write_protection_enabled.
call fcn.1003def0
add esp, 4
jmp 0x10064098
push str.Config:_ntdll_write_protection_disabled.
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.standalone
mov ecx, dword [ebp - 8]
push ecx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x100640ec
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax]
cmp edx, 0x31
jne 0x100640d2
mov dword [ebp - 0xd8], 1
jmp 0x100640dc
mov dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0xd8]
mov dword [0x104f31e4], eax
jmp 0x1006737c
push str.exclude_apis
mov ecx, dword [ebp - 8]
push ecx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10064171
mov dword [ebp - 0x58], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
je 0x1006416c
cmp dword [ebp - 0x58], 0x80
jae 0x1006416c
push 0x3a
mov eax, dword [ebp - 0xc]
push eax
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x1006413a
mov ecx, dword [ebp - 0x5c]
mov byte [ecx], 0
mov edx, dword [ebp - 0xc]
push edx
call fcn.10063330
add esp, 4
mov ecx, dword [ebp - 0x58]
mov dword [ecx*4 + 0x104f27a8], eax
mov edx, dword [ebp - 0x58]
add edx, 1
mov dword [ebp - 0x58], edx
cmp dword [ebp - 0x5c], 0
jne 0x10064161
jmp 0x1006416c
mov eax, dword [ebp - 0x5c]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x1006410e
jmp 0x1006737c
push str.exclude_dlls
mov ecx, dword [ebp - 8]
push ecx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x100641ed
mov dword [ebp - 0x60], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
je 0x100641e8
cmp dword [ebp - 0x60], 0x80
jae 0x100641e8
push 0x3a
mov eax, dword [ebp - 0xc]
push eax
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x100641bf
mov ecx, dword [ebp - 0x64]
mov byte [ecx], 0
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0xc]
mov dword [edx*4 + 0x104f29a8], eax
mov ecx, dword [ebp - 0x60]
add ecx, 1
mov dword [ebp - 0x60], ecx
cmp dword [ebp - 0x64], 0
jne 0x100641dd
jmp 0x100641e8
mov edx, dword [ebp - 0x64]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x10064193
jmp 0x1006737c
push str.base_on_api
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10064287
mov dword [ebp - 0x68], 0
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
je 0x10064282
cmp dword [ebp - 0x68], 0x80
jae 0x10064282
push 0x3a
mov edx, dword [ebp - 0xc]
push edx
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x1006423f
mov eax, dword [ebp - 0x6c]
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10063330
add esp, 4
mov edx, dword [ebp - 0x68]
mov dword [edx*4 + 0x104f2ba8], eax
mov eax, dword [ebp - 0x68]
add eax, 1
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0xc]
push ecx
push str.Added__s_to_base_on_API_list._n
call fcn.1003def0
add esp, 8
cmp dword [ebp - 0x6c], 0
jne 0x10064277
jmp 0x10064282
mov edx, dword [ebp - 0x6c]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x10064213
jmp 0x1006737c
push str.dump_on_api
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10064321
mov dword [ebp - 0x70], 0
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
je 0x1006431c
cmp dword [ebp - 0x70], 0x80
jae 0x1006431c
push 0x3a
mov edx, dword [ebp - 0xc]
push edx
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
je 0x100642d9
mov eax, dword [ebp - 0x74]
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10063330
add esp, 4
mov edx, dword [ebp - 0x70]
mov dword [edx*4 + 0x104f2da8], eax
mov eax, dword [ebp - 0x70]
add eax, 1
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0xc]
push ecx
push str.Added__s_to_dump_on_API_list._n
call fcn.1003def0
add esp, 8
cmp dword [ebp - 0x74], 0
jne 0x10064311
jmp 0x1006431c
mov edx, dword [ebp - 0x74]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x100642ad
jmp 0x1006737c
push str.coverage_modules
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x100643bb
mov dword [ebp - 0x78], 0
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
je 0x100643b6
cmp dword [ebp - 0x78], 0x80
jae 0x100643b6
push 0x3a
mov edx, dword [ebp - 0xc]
push edx
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
je 0x10064373
mov eax, dword [ebp - 0x7c]
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10074f20
add esp, 4
mov edx, dword [ebp - 0x78]
mov dword [edx*4 + 0x104f2fa8], eax
mov eax, dword [ebp - 0x78]
add eax, 1
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0xc]
push ecx
push str.Added__s_to_coverage_modules_list._n
call fcn.1003def0
add esp, 8
cmp dword [ebp - 0x7c], 0
jne 0x100643ab
jmp 0x100643b6
mov edx, dword [ebp - 0x7c]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x10064347
jmp 0x1006737c
push str.dump_on_api_type
mov eax, dword [ebp - 8]
push eax
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x100643ea
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f31a8], eax
jmp 0x1006737c
push str.file_offsets
mov edx, dword [ebp - 8]
push edx
call fcn.1025a9d0
add esp, 8
test eax, eax
jne 0x10064450
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 4]
movsx eax, byte [edx + ecx]
cmp eax, 0x31
jne 0x1006441f
mov dword [ebp - 0xdc], 1
jmp 0x10064429
mov dword [ebp - 0xdc], 0
mov ecx, dword [ebp - 0xdc]
mov dword [0x104f38b4], ecx
cmp dword [0x104f38b4], 0
je 0x1006444b
push str.Breakpoints_interpreted_as_file_offsets._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push 0x103e8f98
mov edx, dword [ebp - 8]
push edx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100647a5
push 0x3a
mov eax, dword [ebp - 4]
push eax
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100645cf
mov ecx, dword [ebp - 0x14]
movsx edx, byte [ecx + 1]
cmp edx, 0x3a
jne 0x100645cf
mov dword [0x104f3340], 0
mov eax, dword [ebp - 0x14]
mov byte [eax], 0
mov ecx, dword [ebp - 0x14]
mov byte [ecx + 1], 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x14]
add eax, 2
push eax
call fcn.10063330
add esp, 4
mov dword [0x104f3230], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.10063330
add esp, 4
mov dword [0x104f3234], eax
cmp dword [ebp - 0x80], 0
je 0x100644fb
mov edx, dword [ebp - 0x14]
add edx, 2
push edx
mov eax, dword [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f3340], eax
jmp 0x1006450f
mov ecx, dword [0x104f3234]
push ecx
push str.Config:_Failed_to_get_base_for_module___s_._n
call fcn.1003def0
add esp, 8
cmp dword [0x104f3340], 0
je 0x1006454c
mov byte [0x104f333d], 1
mov dword [0x104f31f8], 1
mov edx, dword [0x104f3230]
push edx
mov eax, dword [0x104f3234]
push eax
mov ecx, dword [0x104f3340]
push ecx
push str.Config:_bp0_set_to_0x_p___s::_s_._n
call fcn.1003def0
add esp, 0x10
jmp 0x100645ca
cmp dword [ebp - 0x80], 0
je 0x100645ca
push 0
push 0
mov edx, dword [ebp - 0x14]
add edx, 2
push edx
call fcn.1025ceca
add esp, 0xc
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
je 0x100645af
mov eax, dword [ebp - 0x80]
add eax, dword [ebp - 0xe0]
mov dword [0x104f3340], eax
mov dword [0x104f31f8], 1
mov ecx, dword [0x104f3230]
push ecx
mov edx, dword [0x104f3234]
push edx
mov eax, dword [0x104f3340]
push eax
push 0x103e8f20
call fcn.1003def0
add esp, 0x10
jmp 0x100645ca
mov ecx, dword [ebp - 0x14]
add ecx, 2
push ecx
mov edx, dword [0x104f3234]
push edx
push str.Config:_Failed_to_get_address_for_function__s::_s_n
call fcn.1003def0
add esp, 0xc
jmp 0x100647a0
push 4
push 0x103e8ee4
mov eax, dword [ebp - 4]
push eax
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x100645ff
push str.Config:_bp0_set_to_zero._n
call fcn.1003def0
add esp, 4
mov byte [0x104f3350], 1
jmp 0x100647a0
push 2
push 0x103e8ec4
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025b023
add esp, 0xc
test eax, eax
je 0x1006462d
push 0xa
push str.entrypoint
mov edx, dword [ebp - 4]
push edx
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x10064659
mov eax, dword [0x104f3340]
push eax
push str.Config:_bp0_set_to_entry_point._n
call fcn.1003def0
add esp, 8
mov dword [0x10661844], 1
mov dword [0x104f31f8], 1
jmp 0x100647a0
mov dword [ebp - 0x30], 0
push 0x2b
mov ecx, dword [ebp - 4]
push ecx
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100646a6
push 0
push 0
mov edx, dword [ebp - 0x14]
add edx, 1
push edx
call fcn.1025ceca
add esp, 0xc
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
push eax
push str.Config:_Delta_0x_x._n
call fcn.1003def0
add esp, 8
mov ecx, dword [ebp - 0x14]
mov byte [ecx], 0
jmp 0x100646ec
push 0x2d
mov edx, dword [ebp - 4]
push edx
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100646ec
push 0
push 0
mov eax, dword [ebp - 0x14]
add eax, 1
push eax
call fcn.1025ceca
add esp, 0xc
neg eax
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
push ecx
push 0x103e8e64
call fcn.1003def0
add esp, 8
mov edx, dword [ebp - 0x14]
mov byte [edx], 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.1025ceca
add esp, 0xc
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
cmp ecx, dword [0x104f3340]
je 0x100647a0
mov edx, dword [ebp - 0x44]
cmp edx, dword [0x104f3344]
je 0x100647a0
mov eax, dword [ebp - 0x44]
cmp eax, dword [0x104f3348]
je 0x100647a0
mov ecx, dword [ebp - 0x44]
cmp ecx, dword [0x104f334c]
je 0x100647a0
mov edx, dword [ebp - 0x44]
mov dword [0x104f3340], edx
mov dword [0x104f31f8], 1
cmp dword [0x104f3340], 0xffffffff
jne 0x10064764
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.1025ce76
add esp, 0xc
mov dword [0x104f3340], eax
cmp dword [ebp - 0x30], 0
je 0x1006478d
mov ecx, dword [0x104f3340]
push ecx
push str.Config:_bp0_was_0x_p._n
call fcn.1003def0
add esp, 8
mov edx, dword [0x104f3340]
add edx, dword [ebp - 0x30]
mov dword [0x104f3340], edx
mov eax, dword [0x104f3340]
push eax
push str.Config:_bp0_set_to_0x_p._n
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push 0x103e8e2c
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10064af2
push 0x3a
mov edx, dword [ebp - 4]
push edx
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1006491d
mov eax, dword [ebp - 0x18]
movsx ecx, byte [eax + 1]
cmp ecx, 0x3a
jne 0x1006491d
mov dword [0x104f3344], 0
mov edx, dword [ebp - 0x18]
mov byte [edx], 0
mov eax, dword [ebp - 0x18]
mov byte [eax + 1], 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xe4], eax
mov edx, dword [ebp - 0x18]
add edx, 2
push edx
call fcn.10063330
add esp, 4
mov dword [0x104f3230], eax
mov eax, dword [ebp - 4]
push eax
call fcn.10063330
add esp, 4
mov dword [0x104f3234], eax
cmp dword [ebp - 0xe4], 0
je 0x10064859
mov ecx, dword [ebp - 0x18]
add ecx, 2
push ecx
mov edx, dword [ebp - 0xe4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f3344], eax
jmp 0x1006486c
mov eax, dword [0x104f3234]
push eax
push 0x103e8dfc
call fcn.1003def0
add esp, 8
cmp dword [0x104f3344], 0
je 0x100648a9
mov byte [0x104f333d], 1
mov dword [0x104f31f8], 1
mov ecx, dword [0x104f3230]
push ecx
mov edx, dword [0x104f3234]
push edx
mov eax, dword [0x104f3344]
push eax
push str.Config:_bp1_set_to_0x_p___s::_s_._n
call fcn.1003def0
add esp, 0x10
jmp 0x10064918
push 0
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 2
push ecx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f3344], eax
cmp dword [0x104f3344], 0
je 0x100648fe
mov byte [0x104f333d], 1
mov dword [0x104f31f8], 1
mov edx, dword [0x104f3230]
push edx
mov eax, dword [0x104f3234]
push eax
mov ecx, dword [0x104f3344]
push ecx
push 0x103e8db4
call fcn.1003def0
add esp, 0x10
jmp 0x10064918
mov edx, dword [0x104f3230]
push edx
mov eax, dword [0x104f3234]
push eax
push str.Config:_Failed_to_get_address_for_function__s::_s._n
call fcn.1003def0
add esp, 0xc
jmp 0x10064aed
push 4
push 0x103e8d78
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x1006494d
push str.Config:_bp1_set_to_zero._n
call fcn.1003def0
add esp, 4
mov byte [0x104f3351], 1
jmp 0x10064aed
push 2
push 0x103e8d58
mov edx, dword [ebp - 4]
push edx
call fcn.1025b023
add esp, 0xc
test eax, eax
je 0x1006497b
push 0xa
push 0x103e8d4c
mov eax, dword [ebp - 4]
push eax
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x100649a8
mov ecx, dword [0x104f3344]
push ecx
push str.Config:_bp1_set_to_entry_point._n
call fcn.1003def0
add esp, 8
mov dword [0x10661844], 1
mov dword [0x104f31f8], 1
jmp 0x10064aed
mov dword [ebp - 0x34], 0
push 0x2b
mov edx, dword [ebp - 4]
push edx
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x100649f5
push 0
push 0
mov eax, dword [ebp - 0x18]
add eax, 1
push eax
call fcn.1025ceca
add esp, 0xc
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
push ecx
push 0x103e8d10
call fcn.1003def0
add esp, 8
mov edx, dword [ebp - 0x18]
mov byte [edx], 0
jmp 0x10064a3b
push 0x2d
mov eax, dword [ebp - 4]
push eax
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10064a3b
push 0
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 1
push ecx
call fcn.1025ceca
add esp, 0xc
neg eax
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
push edx
push 0x103e8cf8
call fcn.1003def0
add esp, 8
mov eax, dword [ebp - 0x18]
mov byte [eax], 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025ceca
add esp, 0xc
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
cmp edx, dword [0x104f3340]
je 0x10064aed
mov eax, dword [ebp - 0x48]
cmp eax, dword [0x104f3344]
je 0x10064aed
mov ecx, dword [ebp - 0x48]
cmp ecx, dword [0x104f3348]
je 0x10064aed
mov edx, dword [ebp - 0x48]
cmp edx, dword [0x104f334c]
je 0x10064aed
mov eax, dword [ebp - 0x48]
mov dword [0x104f3344], eax
mov dword [0x104f31f8], 1
cmp dword [0x104f3344], 0xffffffff
jne 0x10064ab2
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025ce76
add esp, 0xc
mov dword [0x104f3344], eax
cmp dword [ebp - 0x34], 0
je 0x10064ad9
mov edx, dword [0x104f3344]
push edx
push str.Config:_bp1_was_0x_p._n
call fcn.1003def0
add esp, 8
mov eax, dword [0x104f3344]
add eax, dword [ebp - 0x34]
mov dword [0x104f3344], eax
mov ecx, dword [0x104f3344]
push ecx
push str.Config:_bp1_set_to_0x_p._n
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push 0x103e8cc0
mov edx, dword [ebp - 8]
push edx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10064e42
push 0x3a
mov eax, dword [ebp - 4]
push eax
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10064c6b
mov ecx, dword [ebp - 0x1c]
movsx edx, byte [ecx + 1]
cmp edx, 0x3a
jne 0x10064c6b
mov dword [0x104f3348], 0
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + 1], 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x1c]
add eax, 2
push eax
call fcn.10063330
add esp, 4
mov dword [0x104f3230], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.10063330
add esp, 4
mov dword [0x104f3234], eax
cmp dword [ebp - 0xe8], 0
je 0x10064ba6
mov edx, dword [ebp - 0x1c]
add edx, 2
push edx
mov eax, dword [ebp - 0xe8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f3348], eax
jmp 0x10064bba
mov ecx, dword [0x104f3234]
push ecx
push 0x103e8c90
call fcn.1003def0
add esp, 8
cmp dword [0x104f3348], 0
je 0x10064bf7
mov byte [0x104f333d], 1
mov dword [0x104f31f8], 1
mov edx, dword [0x104f3230]
push edx
mov eax, dword [0x104f3234]
push eax
mov ecx, dword [0x104f3348]
push ecx
push str.Config:_bp2_set_to_0x_p___s::_s_._n
call fcn.1003def0
add esp, 0x10
jmp 0x10064c66
push 0
push 0
mov edx, dword [ebp - 0x1c]
add edx, 2
push edx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f3348], eax
cmp dword [0x104f3348], 0
je 0x10064c4c
mov byte [0x104f333d], 1
mov dword [0x104f31f8], 1
mov eax, dword [0x104f3230]
push eax
mov ecx, dword [0x104f3234]
push ecx
mov edx, dword [0x104f3348]
push edx
push 0x103e8c48
call fcn.1003def0
add esp, 0x10
jmp 0x10064c66
mov eax, dword [0x104f3230]
push eax
mov ecx, dword [0x104f3234]
push ecx
push 0x103e8c14
call fcn.1003def0
add esp, 0xc
jmp 0x10064e3d
push 4
push 0x103e8c0c
mov edx, dword [ebp - 4]
push edx
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x10064c9b
push str.Config:_bp2_set_to_zero._n
call fcn.1003def0
add esp, 4
mov byte [0x104f3352], 1
jmp 0x10064e3d
push 2
push 0x103e8bec
mov eax, dword [ebp - 4]
push eax
call fcn.1025b023
add esp, 0xc
test eax, eax
je 0x10064cc9
push 0xa
push 0x103e8be0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x10064cf6
mov edx, dword [0x104f3348]
push edx
push str.Config:_bp2_set_to_entry_point._n
call fcn.1003def0
add esp, 8
mov dword [0x10661844], 1
mov dword [0x104f31f8], 1
jmp 0x10064e3d
mov dword [ebp - 0x38], 0
push 0x2b
mov eax, dword [ebp - 4]
push eax
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10064d43
push 0
push 0
mov ecx, dword [ebp - 0x1c]
add ecx, 1
push ecx
call fcn.1025ceca
add esp, 0xc
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
push edx
push 0x103e8ba4
call fcn.1003def0
add esp, 8
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0
jmp 0x10064d89
push 0x2d
mov ecx, dword [ebp - 4]
push ecx
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10064d89
push 0
push 0
mov edx, dword [ebp - 0x1c]
add edx, 1
push edx
call fcn.1025ceca
add esp, 0xc
neg eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
push eax
push 0x103e8b8c
call fcn.1003def0
add esp, 8
mov ecx, dword [ebp - 0x1c]
mov byte [ecx], 0
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.1025ceca
add esp, 0xc
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp eax, dword [0x104f3340]
je 0x10064e3d
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [0x104f3344]
je 0x10064e3d
mov edx, dword [ebp - 0x4c]
cmp edx, dword [0x104f3348]
je 0x10064e3d
mov eax, dword [ebp - 0x4c]
cmp eax, dword [0x104f334c]
je 0x10064e3d
mov ecx, dword [ebp - 0x4c]
mov dword [0x104f3348], ecx
mov dword [0x104f31f8], 1
cmp dword [0x104f3348], 0xffffffff
jne 0x10064e01
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.1025ce76
add esp, 0xc
mov dword [0x104f3348], eax
cmp dword [ebp - 0x38], 0
je 0x10064e29
mov eax, dword [0x104f3348]
push eax
push str.Config:_bp2_was_0x_p._n
call fcn.1003def0
add esp, 8
mov ecx, dword [0x104f3348]
add ecx, dword [ebp - 0x38]
mov dword [0x104f3348], ecx
mov edx, dword [0x104f3348]
push edx
push str.Config:_bp2_set_to_0x_p._n
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push 0x103e8b54
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10065192
push 0x3a
mov ecx, dword [ebp - 4]
push ecx
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x10064fbc
mov edx, dword [ebp - 0x20]
movsx eax, byte [edx + 1]
cmp eax, 0x3a
jne 0x10064fbc
mov dword [0x104f334c], 0
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xec], eax
mov ecx, dword [ebp - 0x20]
add ecx, 2
push ecx
call fcn.10063330
add esp, 4
mov dword [0x104f3230], eax
mov edx, dword [ebp - 4]
push edx
call fcn.10063330
add esp, 4
mov dword [0x104f3234], eax
cmp dword [ebp - 0xec], 0
je 0x10064ef6
mov eax, dword [ebp - 0x20]
add eax, 2
push eax
mov ecx, dword [ebp - 0xec]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f334c], eax
jmp 0x10064f0a
mov edx, dword [0x104f3234]
push edx
push 0x103e8b24
call fcn.1003def0
add esp, 8
cmp dword [0x104f334c], 0
je 0x10064f47
mov byte [0x104f333d], 1
mov dword [0x104f31f8], 1
mov eax, dword [0x104f3230]
push eax
mov ecx, dword [0x104f3234]
push ecx
mov edx, dword [0x104f334c]
push edx
push str.Config:_bp3_set_to_0x_p___s::_s_._n
call fcn.1003def0
add esp, 0x10
jmp 0x10064fb7
push 0
push 0
mov eax, dword [ebp - 0x20]
add eax, 2
push eax
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f334c], eax
cmp dword [0x104f334c], 0
je 0x10064f9c
mov byte [0x104f333d], 1
mov dword [0x104f31f8], 1
mov ecx, dword [0x104f3230]
push ecx
mov edx, dword [0x104f3234]
push edx
mov eax, dword [0x104f334c]
push eax
push 0x103e8adc
call fcn.1003def0
add esp, 0x10
jmp 0x10064fb7
mov ecx, dword [0x104f3230]
push ecx
mov edx, dword [0x104f3234]
push edx
push 0x103e8aa8
call fcn.1003def0
add esp, 0xc
jmp 0x1006518d
push 4
push 0x103e8aa0
mov eax, dword [ebp - 4]
push eax
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x10064fec
push str.Config:_bp3_set_to_zero._n
call fcn.1003def0
add esp, 4
mov byte [0x104f3353], 1
jmp 0x1006518d
push 2
push 0x103e8a80
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025b023
add esp, 0xc
test eax, eax
je 0x1006501a
push 0xa
push 0x103e8a74
mov edx, dword [ebp - 4]
push edx
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x10065046
mov eax, dword [0x104f334c]
push eax
push str.Config:_bp3_set_to_entry_point._n
call fcn.1003def0
add esp, 8
mov dword [0x10661844], 1
mov dword [0x104f31f8], 1
jmp 0x1006518d
mov dword [ebp - 0x3c], 0
push 0x2b
mov ecx, dword [ebp - 4]
push ecx
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x10065093
push 0
push 0
mov edx, dword [ebp - 0x20]
add edx, 1
push edx
call fcn.1025ceca
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
push 0x103e8a38
call fcn.1003def0
add esp, 8
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0
jmp 0x100650d9
push 0x2d
mov edx, dword [ebp - 4]
push edx
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x100650d9
push 0
push 0
mov eax, dword [ebp - 0x20]
add eax, 1
push eax
call fcn.1025ceca
add esp, 0xc
neg eax
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
push ecx
push 0x103e8a20
call fcn.1003def0
add esp, 8
mov edx, dword [ebp - 0x20]
mov byte [edx], 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.1025ceca
add esp, 0xc
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
cmp ecx, dword [0x104f3340]
je 0x1006518d
mov edx, dword [ebp - 0x50]
cmp edx, dword [0x104f3344]
je 0x1006518d
mov eax, dword [ebp - 0x50]
cmp eax, dword [0x104f3348]
je 0x1006518d
mov ecx, dword [ebp - 0x50]
cmp ecx, dword [0x104f334c]
je 0x1006518d
mov edx, dword [ebp - 0x50]
mov dword [0x104f334c], edx
mov dword [0x104f31f8], 1
cmp dword [0x104f334c], 0xffffffff
jne 0x10065151
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.1025ce76
add esp, 0xc
mov dword [0x104f334c], eax
cmp dword [ebp - 0x3c], 0
je 0x1006517a
mov ecx, dword [0x104f334c]
push ecx
push str.Config:_bp3_was_0x_p._n
call fcn.1003def0
add esp, 8
mov edx, dword [0x104f334c]
add edx, dword [ebp - 0x3c]
mov dword [0x104f334c], edx
mov eax, dword [0x104f334c]
push eax
push str.Config:_bp3_set_to_0x_p._n
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push 0x103e89e8
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100654df
push 0x3a
mov edx, dword [ebp - 4]
push edx
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1006530a
mov eax, dword [ebp - 0x24]
movsx ecx, byte [eax + 1]
cmp ecx, 0x3a
jne 0x1006530a
mov dword [0x104f3354], 0
mov edx, dword [ebp - 0x24]
mov byte [edx], 0
mov eax, dword [ebp - 0x24]
mov byte [eax + 1], 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xf0], eax
mov edx, dword [ebp - 0x24]
add edx, 2
push edx
call fcn.10063330
add esp, 4
mov dword [0x104f3230], eax
mov eax, dword [ebp - 4]
push eax
call fcn.10063330
add esp, 4
mov dword [0x104f3234], eax
cmp dword [ebp - 0xf0], 0
je 0x10065246
mov ecx, dword [ebp - 0x24]
add ecx, 2
push ecx
mov edx, dword [ebp - 0xf0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f3354], eax
jmp 0x10065259
mov eax, dword [0x104f3234]
push eax
push 0x103e89b8
call fcn.1003def0
add esp, 8
cmp dword [0x104f3354], 0
je 0x10065296
mov byte [0x104f333d], 1
mov dword [0x104f31f8], 1
mov ecx, dword [0x104f3230]
push ecx
mov edx, dword [0x104f3234]
push edx
mov eax, dword [0x104f3354]
push eax
push str.Config:_bp4_set_to_0x_p___s::_s_._n
call fcn.1003def0
add esp, 0x10
jmp 0x10065305
push 0
push 0
mov ecx, dword [ebp - 0x24]
add ecx, 2
push ecx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f3354], eax
cmp dword [0x104f3354], 0
je 0x100652eb
mov byte [0x104f333d], 1
mov dword [0x104f31f8], 1
mov edx, dword [0x104f3230]
push edx
mov eax, dword [0x104f3234]
push eax
mov ecx, dword [0x104f3354]
push ecx
push 0x103e8970
call fcn.1003def0
add esp, 0x10
jmp 0x10065305
mov edx, dword [0x104f3230]
push edx
mov eax, dword [0x104f3234]
push eax
push 0x103e893c
call fcn.1003def0
add esp, 0xc
jmp 0x100654da
push 4
push 0x103e8934
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x1006533a
push str.Config:_bp4_set_to_zero._n
call fcn.1003def0
add esp, 4
mov byte [0x104f3364], 1
jmp 0x100654da
push 2
push 0x103e8914
mov edx, dword [ebp - 4]
push edx
call fcn.1025b023
add esp, 0xc
test eax, eax
je 0x10065368
push 0xa
push 0x103e8908
mov eax, dword [ebp - 4]
push eax
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x10065395
mov ecx, dword [0x104f3354]
push ecx
push str.Config:_bp4_set_to_entry_point._n
call fcn.1003def0
add esp, 8
mov dword [0x10661844], 1
mov dword [0x104f31f8], 1
jmp 0x100654da
mov dword [ebp - 0x40], 0
push 0x2b
mov edx, dword [ebp - 4]
push edx
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x100653e2
push 0
push 0
mov eax, dword [ebp - 0x24]
add eax, 1
push eax
call fcn.1025ceca
add esp, 0xc
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
push ecx
push 0x103e88cc
call fcn.1003def0
add esp, 8
mov edx, dword [ebp - 0x24]
mov byte [edx], 0
jmp 0x10065428
push 0x2d
mov eax, dword [ebp - 4]
push eax
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10065428
push 0
push 0
mov ecx, dword [ebp - 0x24]
add ecx, 1
push ecx
call fcn.1025ceca
add esp, 0xc
neg eax
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
push edx
push 0x103e88b4
call fcn.1003def0
add esp, 8
mov eax, dword [ebp - 0x24]
mov byte [eax], 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025ceca
add esp, 0xc
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x54]
cmp edx, dword [0x104f3340]
je 0x100654da
mov eax, dword [ebp - 0x54]
cmp eax, dword [0x104f3344]
je 0x100654da
mov ecx, dword [ebp - 0x54]
cmp ecx, dword [0x104f3348]
je 0x100654da
mov edx, dword [ebp - 0x54]
cmp edx, dword [0x104f334c]
je 0x100654da
mov eax, dword [ebp - 0x54]
mov dword [0x104f3354], eax
mov dword [0x104f31f8], 1
cmp dword [0x104f3354], 0xffffffff
jne 0x1006549f
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025ce76
add esp, 0xc
mov dword [0x104f3354], eax
cmp dword [ebp - 0x40], 0
je 0x100654c6
mov edx, dword [0x104f3354]
push edx
push str.Config:_bp4_was_0x_p._n
call fcn.1003def0
add esp, 8
mov eax, dword [0x104f3354]
add eax, dword [ebp - 0x40]
mov dword [0x104f3354], eax
mov ecx, dword [0x104f3354]
push ecx
push str.Config:_bp4_set_to_0x_p._n
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push 0x103e887c
mov edx, dword [ebp - 8]
push edx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100655f8
mov dword [ebp - 0x28], 0
push 0x2b
mov eax, dword [ebp - 4]
push eax
call fcn.1024d740
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10065545
push 0
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 1
push ecx
call fcn.1025ceca
add esp, 0xc
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
push edx
push 0x103e8864
call fcn.1003def0
add esp, 8
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
jmp 0x1006558b
push 0x2d
mov ecx, dword [ebp - 4]
push ecx
call fcn.1024d740
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1006558b
push 0
push 0
mov edx, dword [ebp - 0xc]
add edx, 1
push edx
call fcn.1025ceca
add esp, 0xc
neg eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
push 0x103e884c
call fcn.1003def0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov byte [ecx], 0
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f3368], eax
cmp dword [0x104f3368], 0
je 0x100655f3
mov dword [0x104f31f8], 1
cmp dword [ebp - 0x28], 0
je 0x100655e0
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [0x104f3368]
push ecx
push str.Config:_br0_was_0x_x__delta_0x_x_._n
call fcn.1003def0
add esp, 0xc
mov edx, dword [0x104f3368]
add edx, dword [ebp - 0x28]
mov dword [0x104f3368], edx
mov eax, dword [0x104f3368]
push eax
push str.Config:_br0_set_to_0x_x__break_on_return__n
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push 0x103e87f8
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10065711
mov dword [ebp - 0x2c], 0
push 0x2b
mov edx, dword [ebp - 4]
push edx
call fcn.1024d740
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1006565e
push 0
push 0
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
call fcn.1025ceca
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
push ecx
push 0x103e87e0
call fcn.1003def0
add esp, 8
mov edx, dword [ebp - 0xc]
mov byte [edx], 0
jmp 0x100656a4
push 0x2d
mov eax, dword [ebp - 4]
push eax
call fcn.1024d740
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100656a4
push 0
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 1
push ecx
call fcn.1025ceca
add esp, 0xc
neg eax
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
push edx
push 0x103e87c8
call fcn.1003def0
add esp, 8
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f336c], eax
cmp dword [0x104f336c], 0
je 0x1006570c
mov dword [0x104f31f8], 1
cmp dword [ebp - 0x2c], 0
je 0x100656f8
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [0x104f336c]
push eax
push str.Config:_br1_was_0x_x__delta_0x_x_._n
call fcn.1003def0
add esp, 0xc
mov ecx, dword [0x104f336c]
add ecx, dword [ebp - 0x2c]
mov dword [0x104f336c], ecx
mov edx, dword [0x104f336c]
push edx
push str.Config:_br1_set_to_0x_x__break_on_return__n
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push 0x103e8774
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10065767
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f3370], eax
cmp dword [0x104f3370], 0
je 0x10065762
mov dword [0x104f31f8], 1
mov edx, dword [0x104f3370]
push edx
push str.Config:_br2_set_to_0x_x__break_on_return__n
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push 0x103e8744
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100657bd
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f3374], eax
cmp dword [0x104f3374], 0
je 0x100657b8
mov dword [0x104f31f8], 1
mov edx, dword [0x104f3374]
push edx
push str.Config:_br3_set_to_0x_x__break_on_return__n
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push 0x103e8714
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10065800
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f3378], eax
mov edx, dword [0x104f3378]
push edx
push str.Config:_Hit_count_for_breakpoint_0_set_to__d_n
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push 0x103e86e0
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10065843
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f337c], eax
mov edx, dword [0x104f337c]
push edx
push str.Config:_Hit_count_for_breakpoint_1_set_to__d_n
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push 0x103e86ac
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10065886
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f3380], eax
mov edx, dword [0x104f3380]
push edx
push str.Config:_Hit_count_for_breakpoint_2_set_to__d_n
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push 0x103e8678
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100658c9
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f3384], eax
mov edx, dword [0x104f3384]
push edx
push str.Config:_Hit_count_for_breakpoint_3_set_to__d_n
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.depth
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x1006593b
push 3
push 0x103e863c
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x1006590e
mov dword [0x106614f0], 0x7fffffff
push str.Config:_Trace_depth_set_to_all
call fcn.1003def0
add esp, 4
jmp 0x10065936
push 0xa
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.1025ceca
add esp, 0xc
mov dword [0x106614f0], eax
mov eax, dword [0x106614f0]
push eax
push str.Config:_Trace_depth_set_to_0x_x
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.count
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100659ae
push 3
push 0x103e85f0
mov edx, dword [ebp - 4]
push edx
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x10065980
mov dword [0x10661174], 0x7fffffff
push str.Config:_Trace_instruction_count_set_to_all
call fcn.1003def0
add esp, 4
jmp 0x100659a9
push 0xa
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.1025ceca
add esp, 0xc
mov dword [0x10661174], eax
mov ecx, dword [0x10661174]
push ecx
push str.Config:_Trace_instruction_count_set_to_0x_x
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.step_out
mov edx, dword [ebp - 8]
push edx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10065a0e
mov dword [0x104f31f8], 1
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f3340], eax
cmp dword [0x104f3340], 0
je 0x10065a09
mov dword [0x104f38b0], 0x31
mov ecx, dword [0x104f3340]
push ecx
push str.Config:_Step_out_breakpoint_set_to_0x_x._n
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.dumpsize
mov edx, dword [ebp - 8]
push edx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10065a8c
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.1025ceca
add esp, 0xc
mov dword [0x1066160c], eax
cmp dword [0x1066160c], 0
je 0x10065a57
mov ecx, dword [0x1066160c]
push ecx
push str.Config:_DumpSize_set_to_0x_x
call fcn.1003def0
add esp, 8
jmp 0x10065a87
mov edx, dword [ebp - 4]
push edx
call fcn.1024f510
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
push 0x106611a0
call fcn.1025d2b0
add esp, 0xc
push 0x106611a0
push str.Config:_DumpSize_set_to_string___s_.
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.action0
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10065aea
push 0x104
push 0
push 0x10661500
call fcn.1024b810
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.1024f510
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
push 0x10661500
call fcn.1025d2b0
add esp, 0xc
push 0x10661500
push str.Config:_Action0_set_to__s.
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.action1
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10065b48
push 0x104
push 0
push 0x10661740
call fcn.1024b810
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.1024f510
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
push 0x10661740
call fcn.1025d2b0
add esp, 0xc
push 0x10661740
push str.Config:_Action1_set_to__s.
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.action2
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10065ba6
push 0x104
push 0
push 0x106612c0
call fcn.1024b810
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.1024f510
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
push 0x106612c0
call fcn.1025d2b0
add esp, 0xc
push 0x106612c0
push str.Config:_Action2_set_to__s.
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.action3
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10065c04
push 0x104
push 0
push 0x10661620
call fcn.1024b810
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.1024f510
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
push 0x10661620
call fcn.1025d2b0
add esp, 0xc
push 0x10661620
push str.Config:_Action3_set_to__s.
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.instruction0
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
je 0x10065c32
push str.instr0
mov edx, dword [ebp - 8]
push edx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10065cb4
mov eax, 1
imul ecx, eax, 0x104
push ecx
call fcn.10074450
add esp, 4
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
je 0x10065c72
mov edx, 1
imul eax, edx, 0x104
push eax
push 0
mov ecx, dword [ebp - 0x8c]
push ecx
call fcn.1024b810
add esp, 0xc
mov edx, dword [ebp - 0x8c]
mov dword [0x1066184c], edx
mov eax, dword [ebp - 4]
push eax
call fcn.1024f510
add esp, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [0x1066184c]
push edx
call fcn.1025d2b0
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push str.Config:_Instruction0_set_to__s.
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.instruction1
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
je 0x10065ce2
push str.instr1
mov edx, dword [ebp - 8]
push edx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10065d64
mov eax, 1
imul ecx, eax, 0x104
push ecx
call fcn.10074450
add esp, 4
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x10065d22
mov edx, 1
imul eax, edx, 0x104
push eax
push 0
mov ecx, dword [ebp - 0x90]
push ecx
call fcn.1024b810
add esp, 0xc
mov edx, dword [ebp - 0x90]
mov dword [0x10661850], edx
mov eax, dword [ebp - 4]
push eax
call fcn.1024f510
add esp, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [0x10661850]
push edx
call fcn.1025d2b0
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push str.Config:_Instruction1_set_to__s.
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.instruction2
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
je 0x10065d92
push str.instr2
mov edx, dword [ebp - 8]
push edx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10065e14
mov eax, 1
imul ecx, eax, 0x104
push ecx
call fcn.10074450
add esp, 4
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
je 0x10065dd2
mov edx, 1
imul eax, edx, 0x104
push eax
push 0
mov ecx, dword [ebp - 0x94]
push ecx
call fcn.1024b810
add esp, 0xc
mov edx, dword [ebp - 0x94]
mov dword [0x10661850], edx
mov eax, dword [ebp - 4]
push eax
call fcn.1024f510
add esp, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [0x10661858]
push edx
call fcn.1025d2b0
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push str.Config:_Instruction2_set_to__s.
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.instruction3
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
je 0x10065e42
push str.instr3
mov edx, dword [ebp - 8]
push edx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10065ec4
mov eax, 1
imul ecx, eax, 0x104
push ecx
call fcn.10074450
add esp, 4
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x10065e82
mov edx, 1
imul eax, edx, 0x104
push eax
push 0
mov ecx, dword [ebp - 0x98]
push ecx
call fcn.1024b810
add esp, 0xc
mov edx, dword [ebp - 0x98]
mov dword [0x10661850], edx
mov eax, dword [ebp - 4]
push eax
call fcn.1024f510
add esp, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [0x10661604]
push edx
call fcn.1025d2b0
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push str.Config:_Instruction3_set_to__s.
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.procname0
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10065f5f
mov edx, 1
imul eax, edx, 0x104
push eax
call fcn.10074450
add esp, 4
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
je 0x10065f1d
mov ecx, 1
imul edx, ecx, 0x104
push edx
push 0
mov eax, dword [ebp - 0x9c]
push eax
call fcn.1024b810
add esp, 0xc
mov ecx, dword [ebp - 0x9c]
mov dword [0x10661170], ecx
mov edx, dword [ebp - 4]
push edx
call fcn.1024f510
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x10661170]
push ecx
call fcn.1025d2b0
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push str.Config:_procname0_set_to__s.
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.break_on_return
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10065fb2
mov dword [0x104f31f8], 1
push 0x104
mov ecx, dword [ebp - 4]
push ecx
push 0x104f3238
call fcn.1025d2b0
add esp, 0xc
push 0x104f3238
push str.Config:_Break_on_return_set_to__s.
call fcn.1003def0
add esp, 8
mov byte [0x104f333c], 1
jmp 0x1006737c
push str.trace_all
mov edx, dword [ebp - 8]
push edx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066001
mov dword [0x104f31f8], 1
push 0xa
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f38ac], eax
cmp dword [0x104f38ac], 0
je 0x10065ffc
push str.Config:_Trace_all_enabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.trace_into_api
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100660ca
mov dword [ebp - 0x84], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
je 0x100660bb
cmp dword [ebp - 0x84], 0x80
jae 0x100660bb
push 0x3a
mov eax, dword [ebp - 0xc]
push eax
call fcn.1024d740
add esp, 8
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x10066066
mov ecx, dword [ebp - 0x88]
mov byte [ecx], 0
mov edx, dword [ebp - 0xc]
push edx
call fcn.10063330
add esp, 4
mov ecx, dword [ebp - 0x84]
mov dword [ecx*4 + 0x104f38c8], eax
mov edx, dword [ebp - 0x84]
add edx, 1
mov dword [ebp - 0x84], edx
mov eax, dword [ebp - 0xc]
push eax
push str.Config:_Added__s_to_trace_into_API_list._n
call fcn.1003def0
add esp, 8
cmp dword [ebp - 0x88], 0
jne 0x100660aa
jmp 0x100660bb
mov ecx, dword [ebp - 0x88]
add ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x1006602a
mov dword [0x104f31f8], 1
jmp 0x1006737c
push str.dumptype0
mov edx, dword [ebp - 8]
push edx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100660f9
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f3388], eax
jmp 0x1006737c
push str.dumptype1
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066128
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f338c], eax
jmp 0x1006737c
push str.dumptype2
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066157
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f3390], eax
jmp 0x1006737c
push str.dumptype3
mov edx, dword [ebp - 8]
push edx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066186
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f3394], eax
jmp 0x1006737c
push str.typestring
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100661e4
push 0x104
push 0
push 0x104f3398
call fcn.1024b810
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.1024f510
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
push 0x104f3398
call fcn.1025d2b0
add esp, 0xc
push 0x104f3398
push str.Config:_typestring_set_to__s
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.typestring0
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066242
push 0x104
push 0
push 0x104f349c
call fcn.1024b810
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.1024f510
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
push 0x104f349c
call fcn.1025d2b0
add esp, 0xc
push 0x104f349c
push str.Config:_typestring0_set_to__s
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.typestring1
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100662a0
push 0x104
push 0
push 0x104f35a0
call fcn.1024b810
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.1024f510
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
push 0x104f35a0
call fcn.1025d2b0
add esp, 0xc
push 0x104f35a0
push str.Config:_typestring1_set_to__s
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.typestring2
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100662fe
push 0x104
push 0
push 0x104f36a4
call fcn.1024b810
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.1024f510
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
push 0x104f36a4
call fcn.1025d2b0
add esp, 0xc
push 0x104f36a4
push str.Config:_typestring2_set_to__s
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.typestring3
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x1006635c
push 0x104
push 0
push 0x104f37a8
call fcn.1024b810
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.1024f510
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
push 0x104f37a8
call fcn.1025d2b0
add esp, 0xc
push 0x104f37a8
push str.Config:_typestring3_set_to__s
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.type0
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x1006641f
push 1
push 0x103e81c0
mov edx, dword [ebp - 4]
push edx
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x100663a5
push str.Config:_Breakpoint_0_type_set_to_write__Type0__BP_WRITE_._n
call fcn.1003def0
add esp, 4
mov dword [0x106614e4], 1
jmp 0x1006641a
push 1
push 0x103e8180
mov eax, dword [ebp - 4]
push eax
call fcn.1025b023
add esp, 0xc
test eax, eax
je 0x100663d3
push 2
push 0x103e8134
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x100663ec
push str.Config:_Breakpoint_0_type_set_to_read_write__Type0__BP_READWRITE_._n
call fcn.1003def0
add esp, 4
mov dword [0x106614e4], 3
jmp 0x1006641a
push 1
push 0x103e8130
mov edx, dword [ebp - 4]
push edx
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x1006641a
push str.Config:_Breakpoint_0_type_set_to_execute__Type0__BP_EXEC_._n
call fcn.1003def0
add esp, 4
mov dword [0x106614e4], 0
jmp 0x1006737c
push str.type1
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100664e2
push 1
push 0x103e80e4
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x10066468
push str.Config:_Breakpoint_1_type_set_to_write__Type1__BP_WRITE_._n
call fcn.1003def0
add esp, 4
mov dword [0x1066116c], 1
jmp 0x100664dd
push 1
push 0x103e80a4
mov edx, dword [ebp - 4]
push edx
call fcn.1025b023
add esp, 0xc
test eax, eax
je 0x10066496
push 2
push 0x103e80a0
mov eax, dword [ebp - 4]
push eax
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x100664af
push str.Config:_Breakpoint_1_type_set_to_read_write__Type1__BP_READWRITE_._n
call fcn.1003def0
add esp, 4
mov dword [0x1066116c], 3
jmp 0x100664dd
push 1
push 0x103e8054
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x100664dd
push str.Config:_Breakpoint_1_type_set_to_execute__Type1__BP_EXEC_._n
call fcn.1003def0
add esp, 4
mov dword [0x1066116c], 0
jmp 0x1006737c
push str.type2
mov edx, dword [ebp - 8]
push edx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100665a5
push 1
push 0x103e8008
mov eax, dword [ebp - 4]
push eax
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x1006652b
push str.Config:_Breakpoint_2_type_set_to_write__Type2__BP_WRITE_._n
call fcn.1003def0
add esp, 4
mov dword [0x106614e8], 1
jmp 0x100665a0
push 1
push 0x103e7fc8
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025b023
add esp, 0xc
test eax, eax
je 0x10066559
push 2
push 0x103e7f7c
mov edx, dword [ebp - 4]
push edx
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x10066572
push str.Config:_Breakpoint_2_type_set_to_read_write__Type2__BP_READWRITE_._n
call fcn.1003def0
add esp, 4
mov dword [0x106614e8], 3
jmp 0x100665a0
push 1
push 0x103e7f78
mov eax, dword [ebp - 4]
push eax
call fcn.1025b023
add esp, 0xc
test eax, eax
jne 0x100665a0
push str.Config:_Breakpoint_2_type_set_to_execute__Type2__BP_EXEC_._n
call fcn.1003def0
add esp, 4
mov dword [0x106614e8], 0
jmp 0x1006737c
push str.no_logs
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100665ea
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax]
mov dword [0x104f38b8], edx
cmp dword [0x104f38b8], 0
je 0x100665e5
push str.Config:_Debugger_log_diverted._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.disable_logging
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066650
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x1006661f
mov dword [ebp - 0xf4], 1
jmp 0x10066629
mov dword [ebp - 0xf4], 0
mov edx, dword [ebp - 0xf4]
mov dword [0x104f38bc], edx
cmp dword [0x104f38bc], 0
je 0x1006664b
push str.Config:_Logging_disabled__analysis_log_._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.base_on_alloc
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100666b6
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x10066685
mov dword [ebp - 0xf8], 1
jmp 0x1006668f
mov dword [ebp - 0xf8], 0
mov edx, dword [ebp - 0xf8]
mov dword [0x104f38c0], edx
cmp dword [0x104f38c0], 0
je 0x100666b1
push str.Config:_Base_breakpoints_on_executable_memory_allocations._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.base_on_caller
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x1006671c
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x100666eb
mov dword [ebp - 0xfc], 1
jmp 0x100666f5
mov dword [ebp - 0xfc], 0
mov edx, dword [ebp - 0xfc]
mov dword [0x104f38c4], edx
cmp dword [0x104f38c4], 0
je 0x10066717
push str.Config:_Base_breakpoints_on_new_calling_regions._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.fake_rdtsc
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066782
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x10066751
mov dword [ebp - 0x100], 1
jmp 0x1006675b
mov dword [ebp - 0x100], 0
mov edx, dword [ebp - 0x100]
mov dword [0x104f31fc], edx
cmp dword [0x104f31fc], 0
je 0x1006677d
push str.Config:_Fake_RDTSC_enabled__Trace__n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.nop_rdtscp
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100667e8
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x100667b7
mov dword [ebp - 0x104], 1
jmp 0x100667c1
mov dword [ebp - 0x104], 0
mov edx, dword [ebp - 0x104]
mov dword [0x104f3200], edx
cmp dword [0x104f3200], 0
je 0x100667e3
push str.Config:_RDTSCP_nop_enabled_n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.procdump
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x1006685d
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x1006681d
mov dword [ebp - 0x108], 1
jmp 0x10066827
mov dword [ebp - 0x108], 0
mov edx, dword [ebp - 0x108]
mov dword [0x104f31c4], edx
cmp dword [0x104f31c4], 0
je 0x1006684b
push str.Process_dumps_enabled._n
call fcn.1003def0
add esp, 4
jmp 0x10066858
push str.Process_dumps_disabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.procmemdump
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100668f6
push 0x103e7d9c
mov ecx, dword [ebp - 4]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066897
mov dword [0x104f31c8], 1
jmp 0x100668cc
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax]
cmp edx, 0x31
jne 0x100668b7
mov dword [ebp - 0x10c], 1
jmp 0x100668c1
mov dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x10c]
mov dword [0x104f31c8], eax
cmp dword [0x104f31c8], 0
je 0x100668e4
push str.Full_process_memory_dumps_enabled._n
call fcn.1003def0
add esp, 4
jmp 0x100668f1
push str.Full_process_memory_dumps_disabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.import_reconstruction
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x1006696a
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax]
cmp edx, 0x31
jne 0x1006692b
mov dword [ebp - 0x110], 1
jmp 0x10066935
mov dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x110]
mov dword [0x104f31cc], eax
cmp dword [0x104f31cc], 0
je 0x10066958
push str.Import_reconstruction_of_process_dumps_enabled._n
call fcn.1003def0
add esp, 4
jmp 0x10066965
push str.Import_reconstruction_of_process_dumps_disabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.terminate_processes
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100669de
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax]
cmp edx, 0x31
jne 0x1006699f
mov dword [ebp - 0x114], 1
jmp 0x100669a9
mov dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x114]
mov dword [0x104f31d0], eax
cmp dword [0x104f31d0], 0
je 0x100669cc
push str.Terminate_processes_on_terminate_event_enabled._n
call fcn.1003def0
add esp, 4
jmp 0x100669d9
push str.Terminate_processes_on_terminate_event_disabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.branch_trace
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066a43
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax]
cmp edx, 0x31
jne 0x10066a13
mov dword [ebp - 0x118], 1
jmp 0x10066a1d
mov dword [ebp - 0x118], 0
mov eax, dword [ebp - 0x118]
mov dword [0x104f31e0], eax
cmp dword [0x104f31e0], 0
je 0x10066a3e
push str.Branch_tracing_enabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.compression
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066aa8
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax]
cmp edx, 0x31
jne 0x10066a78
mov dword [ebp - 0x11c], 1
jmp 0x10066a82
mov dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x11c]
mov dword [0x104f31b0], eax
cmp dword [0x104f31b0], 0
je 0x10066aa3
push str.Capture_of_compressed_payloads_enabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.unpacker
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066b0d
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax]
cmp edx, 0x31
jne 0x10066add
mov dword [ebp - 0x120], 1
jmp 0x10066ae7
mov dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x120]
mov dword [0x104f31b4], eax
cmp dword [0x104f31b4], 0
je 0x10066b08
push str.Auto_unpacking_of_payloads_enabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.unpacker_bp_on_allocate
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066b72
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax]
cmp edx, 0x31
jne 0x10066b42
mov dword [ebp - 0x124], 1
jmp 0x10066b4c
mov dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x124]
mov dword [0x104f31b8], eax
cmp dword [0x104f31b8], 0
je 0x10066b6d
push str.Auto_unpacking_of_payloads_and_set_breakpoints_on_allocate_enabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.injection
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066bd7
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax]
cmp edx, 0x31
jne 0x10066ba7
mov dword [ebp - 0x128], 1
jmp 0x10066bb1
mov dword [ebp - 0x128], 0
mov eax, dword [ebp - 0x128]
mov dword [0x104f31bc], eax
cmp dword [0x104f31bc], 0
je 0x10066bd2
push str.Capture_of_injected_payloads_enabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.combo
mov ecx, dword [ebp - 8]
push ecx
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066c30
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax]
cmp edx, 0x31
jne 0x10066c2b
push str.Combined_payload_extractions_enabled._n
call fcn.1003def0
add esp, 4
mov dword [0x104f31b0], 1
mov dword [0x104f31b4], 1
mov dword [0x104f31bc], 1
jmp 0x1006737c
push str.dump_config_region
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066c96
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x10066c65
mov dword [ebp - 0x12c], 1
jmp 0x10066c6f
mov dword [ebp - 0x12c], 0
mov edx, dword [ebp - 0x12c]
mov dword [0x104f31d4], edx
cmp dword [0x104f31d4], 0
je 0x10066c91
push str.Dump_config_region_enabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.single_process
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066cfc
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x10066ccb
mov dword [ebp - 0x130], 1
jmp 0x10066cd5
mov dword [ebp - 0x130], 0
mov edx, dword [ebp - 0x130]
mov dword [0x104f31d8], edx
cmp dword [0x104f31d8], 0
je 0x10066cf7
push str.Monitoring_child_processes_disabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push 0x103e7a88
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066d75
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x10066d31
mov dword [ebp - 0x134], 1
jmp 0x10066d3b
mov dword [ebp - 0x134], 0
mov edx, dword [ebp - 0x134]
mov dword [0x104f3204], edx
cmp dword [0x104f3204], 0
je 0x10066d70
cmp dword [0x104f22c4], 0
je 0x10066d70
push str.PDF__Adobe__settings_enabled._n
call fcn.1003def0
add esp, 4
mov dword [0x104f2798], 2
jmp 0x1006737c
push str.api_rate_cap
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066dc1
push 0xa
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025ceca
add esp, 0xc
mov dword [0x104f2798], eax
cmp dword [0x104f2798], 0
je 0x10066dbc
mov edx, dword [0x104f2798]
push edx
push str.API_spam_prevention_enabled___d_._n
call fcn.1003def0
add esp, 8
jmp 0x1006737c
push str.dump_crypto
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066e27
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x10066df6
mov dword [ebp - 0x138], 1
jmp 0x10066e00
mov dword [ebp - 0x138], 0
mov edx, dword [ebp - 0x138]
mov dword [0x104f31e8], edx
cmp dword [0x104f31e8], 0
je 0x10066e22
push str.Dumping_of_crypto_API_buffers_enabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.caller_dump
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066e8d
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x10066e5c
mov dword [ebp - 0x13c], 1
jmp 0x10066e66
mov dword [ebp - 0x13c], 0
mov edx, dword [ebp - 0x13c]
mov dword [0x104f31c0], edx
cmp dword [0x104f31c0], 0
jne 0x10066e88
push str.Dumping_of_caller_regions_disabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push 0x103e79c8
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066ef3
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x10066ec2
mov dword [ebp - 0x140], 1
jmp 0x10066ecc
mov dword [ebp - 0x140], 0
mov edx, dword [ebp - 0x140]
mov dword [0x104f31f4], edx
cmp dword [0x104f31f4], 0
je 0x10066eee
push str.UPX_unpacker_enabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.yarascan
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066f68
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x10066f28
mov dword [ebp - 0x144], 1
jmp 0x10066f32
mov dword [ebp - 0x144], 0
mov edx, dword [ebp - 0x144]
mov dword [0x104f3210], edx
cmp dword [0x104f3210], 0
je 0x10066f56
push str.In_monitor_YARA_scans_enabled._n
call fcn.1003def0
add esp, 4
jmp 0x10066f63
push str.In_monitor_YARA_scans_disabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.amsidump
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10066fdd
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x10066f9d
mov dword [ebp - 0x148], 1
jmp 0x10066fa7
mov dword [ebp - 0x148], 0
mov edx, dword [ebp - 0x148]
mov dword [0x104f3214], edx
cmp dword [0x104f3214], 0
je 0x10066fcb
push str.AMSI_dumping_enabled._n
call fcn.1003def0
add esp, 4
jmp 0x10066fd8
push str.AMSI_dumping_disabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.minihook
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10067043
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x10067012
mov dword [ebp - 0x14c], 1
jmp 0x1006701c
mov dword [ebp - 0x14c], 0
mov edx, dword [ebp - 0x14c]
mov dword [0x104f3218], edx
cmp dword [0x104f3218], 0
je 0x1006703e
push str.Minimal_hook_set_enabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.zerohook
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100670a9
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x10067078
mov dword [ebp - 0x150], 1
jmp 0x10067082
mov dword [ebp - 0x150], 0
mov edx, dword [ebp - 0x150]
mov dword [0x104f321c], edx
cmp dword [0x104f321c], 0
je 0x100670a4
push str.All_hooks_disabled__except_essential__n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.tlsdump
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x1006710f
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x100670de
mov dword [ebp - 0x154], 1
jmp 0x100670e8
mov dword [ebp - 0x154], 0
mov edx, dword [ebp - 0x154]
mov dword [0x104f3208], edx
cmp dword [0x104f3208], 0
je 0x1006710a
push str.TLS_secret_dump_mode_enabled._n
call fcn.1003def0
add esp, 4
jmp 0x1006737c
push str.regdump
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10067175
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x10067144
mov dword [ebp - 0x158], 1
jmp 0x1006714e
mov dword [ebp - 0x158], 0
mov edx, dword [ebp - 0x158]
mov dword [0x104f320c], edx
cmp dword [0x104f320c], 0
je 0x10067170
push str.loaderlock
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x100671ea
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + edx]
cmp ecx, 0x31
jne 0x100671aa
push str.plugx
mov eax, dword [ebp - 8]
push eax
call fcn.10253076
add esp, 8
test eax, eax
jne 0x10067250
mov esp, ebp
pop ebp
ret