Function at 0xcea30e
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xebc
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
xor edx, edx
xor eax, eax
push ebx
push esi
push edi
mov dword [ebp - 0xbfc], edx
inc eax
mov dword [ebp - 0xc40], edx
mov ebx, 0xd0aed4
mov dword [ebp - 0xc60], edx
mov dword [ebp - 0xc44], edx
mov dword [ebp - 0xac0], edx
mov ecx, eax
xor eax, eax
lock cmpxchg dword [ebx], ecx
push 1
test eax, eax
pop eax
jne 0xcea34e
mov eax, dword [0xd0a150]
or ebx, 0xffffffff
mov dword [ebp - 0xc14], ebx
mov edi, 0xb2bef2
mov dword [ebp - 0xb70], edi
mov dword [ebp - 0xc20], 0x67
mov dword [ebp - 0xbd4], 0x337
mov dword [ebp - 0xbbc], 0x10b
mov dword [ebp - 0xbc0], 0x20b
test eax, eax
jne 0xceaa31
push 0x338
mov esi, edx
mov dword [ebp - 0xad0], edx
push edx
mov dword [ebp - 0xa9c], edx
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0xb18], edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb8c], eax
test eax, eax
je 0xceaa25
xor edx, edx
mov dword [ebp - 0x3d8], 0xab69605e
add eax, 7
mov dword [ebp - 0x3d4], 0x7f1137f
mov cl, dl
mov dword [ebp - 0xb00], edx
mov dword [ebp - 0xc0c], ebx
mov dword [ebp - 0xb68], esi
mov dword [ebp - 0xb88], edx
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xb50], edi
mov dword [ebp - 0xb04], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xb50]
xor edx, ebx
mov dword [ebp - 0xab8], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb50]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb50]
shl edi, 8
add dword [ebp - 0xb50], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov dword [ebp - 0xafc], esi
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
mov esi, dword [ebp - 0xab8]
rol eax, 0xa
add edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, esi
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xafc]
xor eax, edx
imul edx, eax, 0x605e
mov dword [ebp - 0xafc], eax
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xafc]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xafc], eax
xor edx, 0xab69605e
mov eax, 0x7f1137f
sub eax, edx
xor esi, eax
mov eax, esi
mov edx, esi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
mov eax, dword [ebp - 0xafc]
xor eax, edx
mov dword [ebp - 0xafc], eax
add eax, 0x7f1137f
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xafc]
rol eax, 2
add edx, eax
xor esi, edx
lea eax, [esi + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 8
sub edx, eax
mov eax, dword [ebp - 0xafc]
xor eax, edx
mov dword [ebp - 0xafc], eax
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xafc]
ror eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, esi
shr eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xafc]
xor eax, edx
mov dword [ebp - 0xafc], eax
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
mov dword [ebp - 0xab8], esi
add esi, 0xfffff80f
xor esi, dword [ebp - 0xafc]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, esi
shr eax, 2
add edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov dword [ebp - 0xab8], eax
add eax, 0xf80eec81
ror eax, 6
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xab8]
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov dword [ebp - 0xab8], eax
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xab8]
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xab8]
xor esi, edx
xor eax, esi
xor eax, 0xac987321
mov dword [ebp - 0xab8], eax
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov dword [ebp - 0xab8], eax
add eax, 0xab69605e
rol eax, 3
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xab8]
rol eax, 0xe
add edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov dword [ebp - 0xab8], eax
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xab8]
shr eax, 3
xor edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xc0c]
rol eax, 2
mov dword [ebp - 0xb68], esi
mov dword [ebp - 0xc0c], edi
xor edx, eax
mov edi, dword [ebp - 0xb50]
xor edx, dword [ebp - 0xb00]
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov dword [ebp - 0xb00], ebx
mov edx, dword [ebp - 0xbcc]
mov dword [ebp - 0xb88], eax
add dword [ebp - 0xbcc], 8
mov byte [edx - 4], al
mov al, byte [ebp - 0xb68]
ror dword [ebp - 0xb88], 8
mov byte [edx], al
ror dword [ebp - 0xb68], 8
mov al, byte [ebp - 0xb88]
mov byte [edx - 5], al
mov al, byte [ebp - 0xb68]
ror dword [ebp - 0xb88], 8
mov byte [edx - 1], al
ror dword [ebp - 0xb68], 8
mov al, byte [ebp - 0xb88]
mov byte [edx - 6], al
ror dword [ebp - 0xb88], 8
mov al, byte [ebp - 0xb68]
mov byte [edx - 2], al
ror dword [ebp - 0xb68], 8
mov al, byte [ebp - 0xb88]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb68]
mov byte [edx - 3], al
mov edx, dword [ebp - 0xb88]
mov esi, dword [ebp - 0xb68]
ror edx, 8
ror esi, 8
sub dword [ebp - 0xb04], 1
mov dword [ebp - 0xb88], edx
mov dword [ebp - 0xb68], esi
jne 0xcea42a
mov esi, dword [ebp - 0xb8c]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xcea7f9
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xcea82b
cmp edx, dword [0xb2c22c]
jne 0xcea82b
mov edi, esi
xor eax, eax
mov dword [ebp - 0xab0], edi
mov esi, eax
mov ebx, 0x337
jmp 0xcea840
mov edi, dword [ebp - 0xab0]
or ebx, 0xffffffff
mov dword [ebp - 0xb18], 0xc004d501
xor eax, eax
test esi, esi
je 0xcea853
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb18], 0
jl 0xceaa1f
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xd0ae80
push eax
push ebx
call fcn.00bc259b
add esp, 0xc
cmp byte [edi], 0
je 0xcea9b5
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbfc]
jne 0xcea88a
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xceaa18
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa9c], edx
cmp word [eax], cx
je 0xcea8d7
mov edx, 0xc000007b
mov dword [ebp - 0xa9c], edx
jmp 0xcea91f
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xcea8ca
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xcea8ca
cmp dword [ecx], 0x4550
jne 0xcea8ca
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xbbc]
je 0xcea90d
cmp ax, word [ebp - 0xbc0]
je 0xcea90d
mov edx, 0xc000000d
jmp 0xcea8cf
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xad8], eax
test eax, eax
je 0xcea9a9
mov ecx, esi
mov dword [ebp - 0xbac], esi
xor eax, eax
mov dword [ebp - 0xc80], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xb8c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xcea949
sub ecx, dword [ebp - 0xb8c]
inc esi
add esi, ecx
test edx, edx
js 0xcea993
mov ecx, dword [ebp - 0xbac]
lea eax, [ebp - 0xc80]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa9c], edx
test edx, edx
js 0xcea9b5
mov eax, dword [ebp - 0xad0]
mov ecx, dword [ebp - 0xc80]
mov dword [eax*4 + section..data], ecx
jmp 0xcea999
mov eax, dword [ebp - 0xad0]
inc eax
inc ebx
mov dword [ebp - 0xad0], eax
cmp ebx, dword [ebp - 0xad8]
jb 0xcea930
add edi, 0x10
cmp byte [esi], 0
jne 0xcea883
mov ebx, dword [ebp - 0xa9c]
mov esi, dword [ebp - 0xab0]
test esi, esi
je 0xcea9d6
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xceaa2c
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xcea9ef
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xcea9de
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xceaa39
mov ebx, 0xc000007a
jmp 0xcea9bb
mov esi, dword [ebp - 0xab0]
mov ebx, 0xc000007a
jmp 0xcea9c1
mov eax, dword [0xd0a150]
inc eax
xor ebx, ebx
mov dword [0xd0a150], eax
xor eax, eax
mov ecx, 0xd0aed4
xchg dword [ecx], eax
mov eax, ebx
mov dword [ebp - 0xad0], ebx
mov dword [ebp - 0xa9c], eax
mov edi, ebx
mov eax, dword fs:[0x30]
mov dword [ebp - 0xab0], ebx
cmp dword [eax + 0x1d4], ebx
je 0xcead36
mov esi, dword [0xd08088]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, eax
mov dword [ebp - 0xb8c], ecx
test ecx, ecx
jne 0xceaa91
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xcead7e
mov eax, ebx
mov esi, ebx
mov dword [ebp - 0xa9c], eax
mov ebx, dword [0xd08098]
lea edx, [ebp - 0xc84]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xd0cffc]
call ebx
test eax, eax
jne 0xceab23
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xceab05
xor eax, eax
test esi, esi
jne 0xceaafe
push dword [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xceaaf4
mov eax, dword [ebp - 0xc84]
mov ecx, dword [ebp - 0xb8c]
jmp 0xceaa9b
mov ebx, 0x8007000e
jmp 0xcead78
mov ebx, 0x80004005
jmp 0xceab33
test eax, eax
jne 0xceab10
mov ebx, 0x80004005
jmp 0xceab1f
jg 0xceab16
mov ebx, eax
jmp 0xceab1f
movzx ebx, ax
or ebx, 0x80070000
xor eax, eax
jmp 0xceab33
mov ebx, dword [ebp - 0xa9c]
xor eax, eax
mov dword [ebp - 0xad0], esi
mov esi, eax
test esi, esi
je 0xceab46
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xcead5d
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov esi, dword [0xd08094]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov ecx, eax
mov dword [ebp - 0xb8c], ecx
test ecx, ecx
jne 0xceab98
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xceab88
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcead5d
mov ebx, 0x80004005
jmp 0xcead5d
xor edx, edx
mov eax, edx
mov esi, edx
mov dword [ebp - 0xa9c], eax
mov ebx, dword [0xd08098]
lea edx, [ebp - 0xc88]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xd0cffc]
call ebx
test eax, eax
jne 0xceac38
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xceac14
xor eax, eax
test esi, esi
jne 0xceac07
push dword [ebp - 0xc88]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xceabfd
mov eax, dword [ebp - 0xc88]
mov ecx, dword [ebp - 0xb8c]
jmp 0xceaba4
mov ebx, 0x8007000e
jmp 0xcead5d
mov ebx, 0x80004005
mov dword [ebp - 0xa9c], ebx
jmp 0xceac44
test eax, eax
jne 0xceac1f
mov ebx, 0x80004005
jmp 0xceac2e
jg 0xceac25
mov ebx, eax
jmp 0xceac2e
movzx ebx, ax
or ebx, 0x80070000
mov dword [ebp - 0xa9c], ebx
xor eax, eax
jmp 0xceac44
mov ebx, dword [ebp - 0xa9c]
xor eax, eax
mov edi, esi
mov esi, eax
test esi, esi
je 0xceac57
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xcead42
mov eax, dword [ebp - 0xad0]
test eax, eax
je 0xcead36
push 4
mov ecx, 0xb2be5c
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xceac9c
test dx, dx
je 0xceac95
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xceac9c
add eax, esi
add ecx, esi
test dx, dx
jne 0xceac75
xor ebx, ebx
xor eax, eax
inc ebx
jmp 0xceaca3
sbb eax, eax
xor ebx, ebx
inc ebx
or eax, ebx
test eax, eax
jne 0xcead36
test edi, edi
je 0xcead36
mov ecx, 0xb2be6c
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xceace0
test dx, dx
je 0xceacda
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xceace0
add eax, esi
add ecx, esi
test dx, dx
jne 0xceacba
xor ecx, ecx
mov eax, ecx
jmp 0xceace6
sbb eax, eax
or eax, ebx
xor ecx, ecx
test eax, eax
jne 0xcead36
push esi
lea eax, [ebp - 0xc8c]
mov dword [ebp - 0xc8c], ecx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
jne 0xcead2b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcead22
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcead48
mov ebx, 0x80004005
jmp 0xcead48
test byte [ebp - 0xc8c], 0xf
mov eax, ebx
je 0xcead3c
mov eax, dword [ebp - 0xab0]
mov dword [ebp - 0xac0], eax
mov ebx, dword [ebp - 0xa9c]
test edi, edi
je 0xcead5d
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xad0]
test eax, eax
je 0xcead78
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xcead86
xor ebx, ebx
mov dword [ebp - 0xac0], ebx
jmp 0xcead88
xor ebx, ebx
push 4
pop eax
push eax
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov dword [ebp - 0xb8c], eax
test eax, eax
jne 0xceaeb7
mov dword [ebp - 0xb00], ebx
mov ebx, 0x8007000e
mov dword [ebp - 0xa94], ebx
mov eax, dword [ebp - 0xc5c]
xor edx, edx
mov dword [ebp - 0xc44], eax
mov esi, 0xd0aed4
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xceadc6
mov eax, dword [0xd0a150]
mov ebx, dword [ebp - 0xa94]
test eax, eax
jle 0xceae28
sub eax, 1
mov dword [0xd0a150], eax
jne 0xceae28
mov edi, edx
mov eax, dword [edi + 0xd0ae80]
test eax, eax
je 0xceadff
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xceadee
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0xd0aed4
xchg dword [ecx], eax
mov eax, dword [ebp - 0xb00]
test eax, eax
je 0xceae42
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, dword [ebp - 0xc60]
test ebx, ebx
jns 0xcf4762
cmp ebx, 0xd0000034
je 0xceae7c
cmp ebx, 0xd00000e5
je 0xcf4755
cmp ebx, 0xc004d501
je 0xcf4755
cmp ebx, 0xd000003e
jne 0xcf475a
push 4
pop esi
mov ebx, dword [ebp - 0xc40]
test eax, eax
je 0xceae98
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0xc60], eax
push ecx
call fcn.00cf4baa
cmp ebx, 3
je 0xcf4778
cmp ebx, esi
je 0xcf4778
xor eax, eax
inc eax
jmp 0xcf477a
mov dword [ebp - 0xb00], eax
lea edi, [ebp - 0xc08]
xor eax, eax
mov dword [ebp - 0xaa0], ebx
stosd dword es:[edi], eax
mov esi, ebx
mov dword [ebp - 0xce0], ebx
mov dword [ebp - 0xcdc], ebx
mov dword [ebp - 0xab4], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xacc], ebx
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xbac], 0x38
mov dword [ebp - 0xad8], ebx
test ebx, ebx
jne 0xceaf29
mov edi, dword [ebp - 0xaa0]
mov ebx, 0xc0000017
mov dword [ebp - 0xa94], ebx
jmp 0xceb237
push edi
push 0xd08d58
push ebx
call fcn.00bc13d0
mov esi, ebx
add esp, 0xc
mov dword [ebp - 0xa98], esi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xac8], ecx
test ecx, ecx
je 0xceaf13
mov eax, dword [0xd08d50]
mov edi, ecx
mov dword [ecx], eax
mov eax, dword [0xd08d54]
mov dword [ecx + 4], eax
mov dword [ebp - 0xaa0], edi
rdtsc
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xaa8], edx
xor eax, eax
mov dword [ebp - 0xb10], eax
lea eax, [ebp - 0xd5c]
push eax
push 4
pop ecx
mov edx, ecx
call fcn.00b84e9a
mov esi, dword [ebp - 0xd5c]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
jns 0xceafb8
mov esi, dword [ebp - 0xe44]
jmp 0xceb231
lea eax, [ebp - 0xb10]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xceb231
lea eax, [ebp - 0xd58]
mov edx, 0xa0
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb231
mov esi, dword [ebp - 0xd58]
mov ecx, dword [ebp - 0xb10]
lea eax, [ebp - 0xb10]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xceb231
lea eax, [ebp - 0xd54]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb231
mov esi, dword [ebp - 0xd54]
mov ecx, dword [ebp - 0xb10]
lea eax, [ebp - 0xb10]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xceb231
lea eax, [ebp - 0xd50]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb231
mov esi, dword [ebp - 0xd50]
mov ecx, dword [ebp - 0xb10]
lea eax, [ebp - 0xb10]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xceb231
lea eax, [ebp - 0xc90]
mov edx, SysReAllocString
push eax
mov ecx, 0xb30ba8
call fcn.00b84ebc
test eax, eax
jns 0xceb0fe
mov ebx, 0xc000003e
mov dword [ebp - 0xa94], ebx
jmp 0xceb231
mov edx, dword [ebp - 0xc90]
lea eax, [ebp - 0xd4c]
push eax
inc edx
push 4
pop eax
mov dword [ebp - 0xc90], edx
mov ecx, eax
add edx, edx
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb231
mov esi, dword [ebp - 0xd4c]
mov ecx, dword [ebp - 0xb10]
lea eax, [ebp - 0xb10]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xceb231
lea eax, [ebp - 0xd48]
push eax
push 4
pop ecx
mov edx, ecx
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb231
mov esi, dword [ebp - 0xd48]
mov ecx, dword [ebp - 0xb10]
lea eax, [ebp - 0xb10]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xceb231
lea eax, [ebp - 0xd2c]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb231
mov esi, dword [ebp - 0xd2c]
mov ecx, dword [ebp - 0xb10]
lea eax, [ebp - 0xb10]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xceb231
mov esi, dword [ebp - 0xb10]
push esi
push 8
mov dword [ebp - 0xce0], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xae0], edi
test edi, edi
jne 0xceb33b
mov ebx, 0xc0000017
mov dword [ebp - 0xa94], ebx
mov edi, dword [ebp - 0xaa0]
mov esi, dword [ebp - 0xa98]
mov eax, dword [ebp - 0xcdc]
xor edx, edx
mov dword [ebp - 0xce0], edx
mov dword [ebp - 0xce4], edx
test eax, eax
je 0xceb266
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0xcdc], edx
mov ecx, dword [ebp - 0xc00]
mov dword [ebp - 0xc04], edx
mov dword [ebp - 0xc08], edx
test ecx, ecx
je 0xceb293
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0xc00], edx
test esi, esi
je 0xceb2a6
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xceb2bb
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xceadb3
mov eax, dword [ebp - 0xac0]
test eax, eax
je 0xcf473c
mov dword [0xd09360], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x2c8]
push eax
push 0xb10000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0xcf25f4
cmp eax, esi
jne 0xceb309
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0xcf25f4
mov esi, dword [0xd0807c]
xor ebx, ebx
push 0x403
push ebx
push ebx
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xaac], eax
test eax, eax
jne 0xcede0f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xcf25f6
mov dword [ebp - 0xcdc], edi
xor eax, eax
mov dword [ebp - 0xaac], eax
mov dword [ebp - 0xe40], eax
mov dword [ebp - 0xc1c], edi
push 4
pop ecx
lea eax, [ebp - 0xdbc]
mov dword [ebp - 0xdc0], ecx
mov edx, ecx
mov ecx, edi
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb3a8
lea ecx, [edi + esi]
lea eax, [edi + 8]
cmp eax, ecx
jbe 0xceb38e
mov ebx, 0xc0000023
jmp 0xceb225
push 4
pop eax
mov dword [edi], eax
xor ecx, ecx
mov eax, dword [ebp - 0xdbc]
mov dword [eax], ecx
xor eax, eax
inc eax
mov dword [ebp - 0xaac], eax
jmp 0xceb3b0
mov eax, dword [ebp - 0xaac]
xor ecx, ecx
test ebx, ebx
js 0xceb22b
mov esi, edi
mov edi, ecx
mov dword [ebp - 0xc7c], esi
test eax, eax
je 0xceb42c
mov edx, dword [esi]
lea eax, [ebp - 0xd30]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb3f3
mov eax, dword [ebp - 0xd30]
mov dword [ebp - 0xd14], eax
jmp 0xceb3f9
mov eax, dword [ebp - 0xd14]
test ebx, ebx
js 0xceb49c
lea ecx, [ebp - 0xc7c]
mov edx, eax
push ecx
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb49c
mov esi, dword [ebp - 0xc7c]
inc edi
cmp edi, dword [ebp - 0xaac]
jb 0xceb3c6
lea eax, [ebp - 0xdc4]
mov dword [ebp - 0xdc8], 0xa0
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov edi, dword [ebp - 0xae0]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb4a2
mov ecx, dword [ebp - 0xb10]
lea eax, [esi + 0xa4]
add ecx, edi
cmp eax, ecx
ja 0xceb384
mov eax, 0xa0
push eax
push dword [ebp - 0xad8]
mov dword [esi], eax
push dword [ebp - 0xdc4]
call fcn.00bc13d0
mov eax, dword [ebp - 0xaac]
add esp, 0xc
inc eax
mov dword [ebp - 0xaac], eax
jmp 0xceb4a8
mov edi, dword [ebp - 0xae0]
mov eax, dword [ebp - 0xaac]
test ebx, ebx
js 0xceb22b
mov esi, edi
xor ecx, ecx
mov dword [ebp - 0xc78], esi
mov edi, ecx
test eax, eax
je 0xceb526
mov edx, dword [esi]
lea eax, [ebp - 0xd00]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb4ed
mov eax, dword [ebp - 0xd00]
mov dword [ebp - 0xd94], eax
jmp 0xceb4f3
mov eax, dword [ebp - 0xd94]
test ebx, ebx
js 0xceb593
lea ecx, [ebp - 0xc78]
mov edx, eax
push ecx
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb593
mov esi, dword [ebp - 0xc78]
inc edi
cmp edi, dword [ebp - 0xaac]
jb 0xceb4c0
lea eax, [ebp - 0xdcc]
mov dword [ebp - 0xdd0], 8
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov edi, dword [ebp - 0xae0]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb599
mov ecx, dword [ebp - 0xb10]
lea eax, [esi + 0xc]
add ecx, edi
cmp eax, ecx
ja 0xceb384
mov edx, dword [ebp - 0xac8]
mov ecx, dword [ebp - 0xdcc]
mov dword [esi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xaac]
inc eax
mov dword [ebp - 0xaac], eax
jmp 0xceb59f
mov edi, dword [ebp - 0xae0]
mov eax, dword [ebp - 0xaac]
test ebx, ebx
js 0xceb22b
mov ecx, dword [ebp - 0xad4]
mov esi, edi
mov dword [ebp - 0xe50], ecx
mov ecx, dword [ebp - 0xaa8]
mov dword [ebp - 0xe4c], ecx
xor ecx, ecx
mov edi, ecx
test eax, eax
je 0xceb63a
mov edx, dword [esi]
lea eax, [ebp - 0xd10]
push eax
push 4
pop eax
mov ecx, eax
mov dword [ebp - 0xad8], esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb5fc
mov eax, dword [ebp - 0xd10]
mov dword [ebp - 0xd88], eax
jmp 0xceb602
mov eax, dword [ebp - 0xd88]
test ebx, ebx
js 0xceb22b
add eax, esi
mov ecx, esi
cmp eax, esi
jb 0xceb616
mov esi, eax
jmp 0xceb619
or esi, 0xffffffff
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, dword [ebp - 0xad8]
jb 0xceb69c
inc edi
cmp edi, dword [ebp - 0xaac]
jb 0xceb5c9
push 8
pop edi
lea eax, [ebp - 0xdd4]
mov dword [ebp - 0xdd8], edi
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb22b
mov ecx, dword [ebp - 0xae0]
lea eax, [esi + 0xc]
add ecx, dword [ebp - 0xb10]
cmp eax, ecx
ja 0xceb384
mov eax, dword [ebp - 0xdd4]
mov ecx, dword [ebp - 0xad4]
inc dword [ebp - 0xaac]
mov dword [esi], edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xaa8]
mov dword [eax + 4], ecx
test ebx, ebx
js 0xceb22b
lea eax, [ebp - 0xc74]
mov edx, SysReAllocString
push eax
mov ecx, 0xb30ba8
call fcn.00b84ebc
test eax, eax
jns 0xceb6c8
mov ebx, 0xc000003e
jmp 0xceb225
mov ecx, dword [ebp - 0xc74]
lea eax, [ebp - 0xc74]
xor edx, edx
push eax
inc edx
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb22b
mov eax, dword [ebp - 0xc74]
lea edi, [eax + eax]
test edi, edi
je 0xceb800
mov esi, dword [ebp - 0xae0]
xor eax, eax
mov dword [ebp - 0xaec], eax
cmp dword [ebp - 0xaac], eax
jbe 0xceb79d
mov edx, dword [esi]
lea eax, [ebp - 0xd9c]
push eax
push 4
pop eax
mov ecx, eax
mov dword [ebp - 0xad8], esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb74b
mov eax, dword [ebp - 0xd9c]
mov dword [ebp - 0xd60], eax
jmp 0xceb751
mov eax, dword [ebp - 0xd60]
test ebx, ebx
js 0xceb22b
add eax, esi
mov ecx, esi
cmp eax, esi
jb 0xceb765
mov esi, eax
jmp 0xceb768
or esi, 0xffffffff
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, dword [ebp - 0xad8]
jb 0xceb80b
mov eax, dword [ebp - 0xaec]
inc eax
mov dword [ebp - 0xaec], eax
cmp eax, dword [ebp - 0xaac]
jb 0xceb718
lea eax, [ebp - 0xddc]
mov dword [ebp - 0xde0], edi
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb22b
mov ecx, dword [ebp - 0xae0]
lea eax, [edi + 4]
add ecx, dword [ebp - 0xb10]
add eax, esi
cmp eax, ecx
jbe 0xceb7e2
mov ebx, 0xc0000023
jmp 0xceb805
push edi
push 0xb30ba8
push dword [ebp - 0xddc]
mov dword [esi], edi
call fcn.00bc13d0
add esp, 0xc
inc dword [ebp - 0xaac]
jmp 0xceb80b
mov ebx, 0xc000000d
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb22b
mov eax, dword [ebp - 0xac0]
mov edi, dword [ebp - 0xaac]
mov esi, dword [ebp - 0xae0]
mov dword [ebp - 0xe3c], eax
xor eax, eax
mov edx, eax
test edi, edi
je 0xceb8a5
mov eax, dword [esi]
push 4
add eax, 4
mov dword [ebp - 0xad8], esi
pop ebx
cmp eax, ebx
jb 0xceb849
mov ecx, eax
jmp 0xceb84c
or ecx, 0xffffffff
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, 4
jb 0xceb869
mov dword [ebp - 0xd64], ecx
jmp 0xceb86f
mov ecx, dword [ebp - 0xd64]
cmp eax, 4
jb 0xceb903
lea eax, [esi + ecx]
mov ebx, esi
cmp eax, esi
jb 0xceb885
mov esi, eax
jmp 0xceb888
or esi, 0xffffffff
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, dword [ebp - 0xad8]
jb 0xceb903
inc edx
cmp edx, edi
jb 0xceb833
push 4
pop ecx
lea eax, [ebp - 0xde4]
mov dword [ebp - 0xde8], ecx
mov edx, ecx
mov ecx, esi
push eax
call fcn.00b84e9a
mov edx, dword [ebp - 0xae0]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb22b
mov ecx, dword [ebp - 0xb10]
lea eax, [esi + 8]
add ecx, edx
cmp eax, ecx
ja 0xceb384
mov ecx, dword [ebp - 0xac0]
inc edi
push 4
pop eax
mov dword [esi], eax
mov eax, dword [ebp - 0xde4]
mov dword [ebp - 0xaac], edi
mov dword [eax], ecx
jmp 0xceb909
mov edx, dword [ebp - 0xae0]
test ebx, ebx
js 0xceb22b
push 4
xor eax, eax
mov esi, edx
mov edx, eax
pop ebx
mov dword [ebp - 0xe38], ebx
test edi, edi
je 0xceb992
mov eax, dword [esi]
add eax, 4
mov dword [ebp - 0xad8], esi
cmp eax, ebx
jb 0xceb937
mov ecx, eax
jmp 0xceb93a
or ecx, 0xffffffff
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, 4
jb 0xceb957
mov dword [ebp - 0xd68], ecx
jmp 0xceb95d
mov ecx, dword [ebp - 0xd68]
cmp eax, 4
jb 0xceb9e1
lea eax, [ecx + esi]
mov ebx, esi
cmp eax, esi
jb 0xceb96f
mov esi, eax
jmp 0xceb972
or esi, 0xffffffff
cmp eax, ebx
push 4
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, dword [ebp - 0xad8]
jb 0xceb9e3
inc edx
pop ebx
cmp edx, edi
jb 0xceb924
lea eax, [ebp - 0xdec]
mov dword [ebp - 0xdf0], ebx
push eax
mov edx, ebx
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceb9e1
mov ecx, dword [ebp - 0xae0]
lea eax, [esi + 8]
add ecx, dword [ebp - 0xb10]
cmp eax, ecx
ja 0xceb384
mov eax, dword [ebp - 0xdec]
inc edi
push 4
pop ecx
mov dword [esi], ecx
mov dword [eax], ecx
mov dword [ebp - 0xaac], edi
jmp 0xceb9e4
push 4
pop ecx
test ebx, ebx
js 0xceb22b
lea eax, [ebp - 0xd6c]
mov edx, ecx
push eax
call fcn.00b84e9a
mov esi, dword [ebp - 0xd6c]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
jns 0xceba17
mov esi, dword [ebp - 0xe34]
jmp 0xcebb85
lea eax, [ebp - 0xd70]
mov edi, esi
push eax
push 8
pop edx
mov dword [ebp - 0xbb4], edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcebb85
mov esi, dword [ebp - 0xd70]
lea eax, [ebp - 0xbb4]
mov edx, esi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcebb85
lea eax, [ebp - 0xd74]
push eax
push 4
pop edi
mov edx, edi
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcebb85
mov esi, dword [ebp - 0xd74]
mov ecx, dword [ebp - 0xbb4]
lea eax, [ebp - 0xbb4]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcebb85
lea eax, [ebp - 0xd78]
mov edx, edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcebb85
mov esi, dword [ebp - 0xd78]
mov ecx, dword [ebp - 0xbb4]
lea eax, [ebp - 0xbb4]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcebb85
lea eax, [ebp - 0xd7c]
mov edx, edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcebb85
mov esi, dword [ebp - 0xd7c]
mov ecx, dword [ebp - 0xbb4]
lea eax, [ebp - 0xbb4]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcebb85
lea eax, [ebp - 0xc64]
mov edx, edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcebb85
mov esi, dword [ebp - 0xc64]
mov ecx, dword [ebp - 0xbb4]
lea eax, [ebp - 0xbb4]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov eax, dword [ebp - 0xbb4]
mov dword [ebp - 0xa94], ebx
test ebx, ebx
jns 0xcebb8b
mov eax, dword [ebp - 0xc1c]
mov dword [ebp - 0xabc], eax
test ebx, ebx
js 0xceb22b
xor ecx, ecx
rdtsc
mov esi, ecx
mov dword [ebp - 0xb14], ecx
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0xae4], ecx
mov dword [ebp - 0xa9c], ecx
mov dword [ebp - 0xaa4], ecx
mov dword [ebp - 0xb1c], ecx
mov dword [ebp - 0xab8], ecx
mov dword [ebp - 0xaec], ecx
mov dword [ebp - 0xae8], ecx
mov dword [ebp - 0xb48], ecx
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xac8], edx
push 8
pop ecx
mov dword [ebp - 0xc6c], ecx
mov edx, dword [ebp - 0xb10]
lea eax, [ebp - 0xc6c]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xcebcf2
mov eax, dword [ebp - 0xc6c]
lea edi, [eax + 7]
and edi, 0xfffffff8
cmp edi, eax
jae 0xcebc26
mov ebx, 0xc0000095
jmp 0xcebcf2
mov dword [ebp - 0xc6c], edi
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xcebc4b
mov ebx, 0xc0000017
jmp 0xcebcec
mov eax, dword [ebp - 0xaac]
mov ecx, esi
mov dword [esi], eax
lea eax, [ebp - 0xc3c]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xc3c], esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xcebcd7
mov ecx, dword [ebp - 0xc3c]
mov eax, dword [ebp - 0xb10]
mov dword [ecx], eax
lea eax, [ebp - 0xc3c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xcebcd7
push dword [ebp - 0xb10]
mov eax, dword [ebp - 0xad8]
push dword [ebp - 0xae0]
mov dword [esi + edi - 8], eax
mov eax, dword [ebp - 0xac8]
push dword [ebp - 0xc3c]
mov dword [esi + edi - 4], eax
call fcn.00bc13d0
add esp, 0xc
mov dword [ebp - 0xb14], esi
xor eax, eax
mov dword [ebp - 0xab0], edi
mov esi, eax
jmp 0xcebcd9
xor eax, eax
test esi, esi
je 0xcebcec
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xab0]
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xced707
mov ebx, dword [ebp - 0xb14]
xor ecx, ecx
mov edi, ecx
mov dword [ebp - 0xac4], edi
test ebx, ebx
jne 0xcebd22
mov ebx, 0xc000000d
jmp 0xcec43d
test esi, esi
je 0xcec438
lea eax, [esi + 8]
push eax
push ecx
mov dword [ebp - 0xad8], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xadc], eax
test eax, eax
je 0xcec438
xor ecx, ecx
mov dl, cl
test esi, esi
je 0xcebd60
xor dl, byte [ecx + ebx]
inc ecx
cmp ecx, esi
jb 0xcebd58
mov dword [ebp - 0xad0], eax
xor eax, eax
mov dword [ebp - 0xb08], ebx
mov ecx, eax
or ebx, 0xffffffff
mov dword [ebp - 0x3e0], 0xb1b54a58
mov dword [ebp - 0x3dc], 0xc81ecb17
mov dword [ebp - 0xb4c], ecx
mov dword [ebp - 0xb44], ebx
mov dword [ebp - 0xb24], eax
mov dword [ebp - 0xb0c], eax
test eax, eax
je 0xcebe6b
xor ebx, ebx
mov dword [ebp - 0xb24], eax
xor esi, esi
mov dword [ebp - 0xb0c], ecx
jbe 0xcebe0a
mov edi, dword [ebp - 0xb08]
push 0x38
pop esi
push 4
pop eax
cmp ebx, eax
movzx eax, byte [edi]
jge 0xcebde1
lea ecx, [esi - 0x20]
shl eax, cl
mov ecx, dword [ebp - 0xb0c]
or ecx, eax
mov dword [ebp - 0xb0c], ecx
jmp 0xcebdf1
mov ecx, esi
shl eax, cl
or dword [ebp - 0xb24], eax
mov ecx, dword [ebp - 0xb0c]
inc ebx
sub esi, 8
xor eax, eax
inc edi
cmp ebx, eax
jl 0xcebdc2
mov dword [ebp - 0xb08], edi
mov edi, eax
mov eax, dword [ebp - 0xb24]
xor ecx, 0xb17a307a
xor eax, 0x42f6b18d
xor ebx, ebx
mov dword [ebp - 0xb4c], ecx
mov esi, ebx
jbe 0xcebe4c
mov ebx, dword [ebp - 0xad0]
cmp esi, 4
jge 0xcebe33
rol ecx, 8
mov byte [ebx], cl
jmp 0xcebe38
rol eax, 8
mov byte [ebx], al
inc ebx
add esi, 1
js 0xcebe27
mov ecx, dword [ebp - 0xb4c]
mov dword [ebp - 0xad0], ebx
xor ebx, ebx
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0xb44], ebx
test eax, eax
jg 0xcebe65
jns 0xcebe65
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xb4c], ecx
mov esi, dword [ebp - 0xab0]
mov eax, esi
shr eax, 3
mov dword [ebp - 0xaf4], eax
test eax, eax
je 0xcec26b
mov eax, dword [ebp - 0xad0]
mov esi, dword [ebp - 0xb08]
add eax, 7
add esi, 2
mov dword [ebp - 0xad0], eax
mov dword [ebp - 0xb08], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xb08]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xb08]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xb08]
shl esi, 8
add dword [ebp - 0xb08], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov dword [ebp - 0xa94], ebx
add ebx, 0xffffb5a8
xor ebx, edi
xor ebx, ecx
mov ecx, 0xc81ecb17
xor ebx, ecx
mov eax, ebx
xor eax, ecx
ror eax, 0xf
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 7
add ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov dword [ebp - 0xa94], eax
add eax, 0xb1b54a58
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
ror eax, 0xa
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0xcb17
rol eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
rol eax, 5
add ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xa94], eax
xor ecx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, ecx
xor ebx, eax
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 6
sub ecx, eax
sub ecx, 0x339b6838
xor dword [ebp - 0xa94], ecx
mov ecx, dword [ebp - 0xa94]
mov eax, ecx
ror eax, 0xf
xor eax, 0xcb17
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, 0xc81e
imul eax, eax, 0xcb17
xor ecx, eax
lea eax, [ecx + 0x37e0ea91]
mov dword [ebp - 0xa94], ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0xc81e
ror ecx, 0xa
imul eax, eax, 0xb1b5
xor ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov dword [ebp - 0xa94], eax
xor eax, 0x4a58
rol eax, 6
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
ror eax, 3
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa94]
mov eax, ebx
ror eax, 0xf
sub eax, 0xc81e
imul eax, eax, 0x4a58
xor ecx, eax
mov dword [ebp - 0xa94], ecx
xor ecx, 0xc81e
mov eax, dword [ebp - 0xa94]
shr eax, 1
imul ecx, ecx, 0x4a58
xor ecx, eax
mov eax, dword [ebp - 0xa94]
add eax, 0xffff34e9
xor ebx, ecx
rol eax, 3
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa94]
shr eax, 0xf
xor ecx, eax
xor ebx, ecx
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 0xd
sub ecx, eax
mov eax, 0xb1b54a58
add ecx, 0x730581bd
xor dword [ebp - 0xa94], ecx
sub eax, dword [ebp - 0xa94]
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
ror eax, 0xb
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa94]
lea eax, [ebx + 0x4e49ed8a]
xor ecx, eax
mov dword [ebp - 0xa94], ecx
mov eax, dword [ebp - 0xa94]
xor eax, 0xb1b5
ror ecx, 7
imul eax, eax, 0x4a58
sub eax, ecx
xor ebx, eax
mov eax, ebx
xor eax, 0xc81e
rol eax, 4
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0x10
sub ecx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xa94], ecx
sub eax, dword [ebp - 0xa94]
ror eax, 0xa
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
ror eax, 4
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x4e4ab5a8]
ror eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
ror eax, 9
xor ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov dword [ebp - 0xa94], eax
xor eax, 0xc81ecb17
rol eax, 8
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa94]
rol eax, 2
sub ecx, eax
mov eax, 0xc81ecb17
xor ebx, ecx
sub eax, ebx
ror eax, 0xb
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0xc
sub ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov dword [ebp - 0xa94], eax
xor eax, 0xb1b5
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
shr eax, 8
xor ecx, eax
mov eax, dword [ebp - 0xa94]
xor ebx, ecx
mov ecx, dword [ebp - 0xad0]
xor eax, ebx
add dword [ebp - 0xad0], 8
xor eax, dword [ebp - 0xb24]
xor ebx, dword [ebp - 0xb0c]
xor eax, 0x79ab814f
mov dword [ebp - 0xb44], eax
mov dword [ebp - 0xb4c], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb44]
ror dword [ebp - 0xb4c], 8
mov byte [ecx], al
ror dword [ebp - 0xb44], 8
mov al, byte [ebp - 0xb4c]
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb44]
ror dword [ebp - 0xb4c], 8
mov byte [ecx - 1], al
ror dword [ebp - 0xb44], 8
mov al, byte [ebp - 0xb4c]
mov byte [ecx - 6], al
ror dword [ebp - 0xb4c], 8
mov al, byte [ebp - 0xb44]
mov byte [ecx - 2], al
ror dword [ebp - 0xb44], 8
mov al, byte [ebp - 0xb4c]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb44]
mov byte [ecx - 3], al
mov ecx, dword [ebp - 0xb4c]
mov ebx, dword [ebp - 0xb44]
ror ecx, 8
ror ebx, 8
sub dword [ebp - 0xaf4], 1
mov dword [ebp - 0xb24], esi
mov esi, dword [ebp - 0xb08]
mov dword [ebp - 0xb4c], ecx
mov dword [ebp - 0xb44], ebx
mov dword [ebp - 0xb0c], edi
jne 0xcebe9c
mov edi, dword [ebp - 0xac4]
mov esi, dword [ebp - 0xab0]
mov ecx, dword [ebp - 0xadc]
movzx eax, dl
cdq
mov dword [ecx + esi], eax
mov dword [ecx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xcec29d
mov ebx, 0xc0000017
jmp 0xcec3ac
mov ebx, dword [ebp - 0xad8]
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xcec2c5
mov ebx, 0xc0000017
xor edx, edx
jmp 0xcec345
mov dword [esi + 4], eax
push ebx
push dword [ebp - 0xadc]
push eax
call fcn.00bc13d0
add esp, 0xc
mov eax, 0xa0
mov dword [esi + 8], eax
push eax
push 8
pop ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xcec2b9
mov dword [esi + 0xc], eax
push 0xa0
push 0xd08ca8
push eax
call fcn.00bc13d0
add esp, 0xc
mov dword [esi + 0x10], ebx
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xcec32d
mov ebx, 0xc0000017
jmp 0xcec345
mov dword [esi + 0x14], ecx
mov edi, esi
mov eax, dword [0xd08d48]
mov ebx, edx
mov dword [ecx], eax
mov esi, edx
mov eax, dword [0xd08d4c]
mov dword [ecx + 4], eax
test esi, esi
je 0xcec3ac
cmp dword [esi + 4], 0
je 0xcec365
push dword [esi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 4], edx
cmp dword [esi + 0xc], 0
je 0xcec381
push dword [esi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0xc], edx
cmp dword [esi + 0x14], 0
je 0xcec39d
push dword [esi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0x14], edx
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
test ebx, ebx
js 0xcec3ba
mov dword [ebp - 0xae4], edi
mov edi, eax
push dword [ebp - 0xadc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xcec43d
xor eax, eax
cmp dword [edi + 4], eax
je 0xcec3ef
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xcec40b
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xcec427
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xcec43d
mov ebx, 0xc0000001
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xced707
mov esi, dword [ebp - 0xae4]
lea eax, [ebp - 0xba8]
push 4
pop edi
push eax
mov edx, dword [esi]
mov ecx, edi
mov dword [ebp - 0xba8], edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xcec4e4
mov ecx, dword [ebp - 0xba8]
lea eax, [ebp - 0xba8]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xcec4e4
mov edx, dword [esi + 8]
lea eax, [ebp - 0xba8]
mov ecx, dword [ebp - 0xba8]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xcec4e4
mov ecx, dword [ebp - 0xba8]
lea eax, [ebp - 0xba8]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xcec4e4
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0xba8]
mov ecx, dword [ebp - 0xba8]
push eax
call fcn.00b84e9a
mov edi, dword [ebp - 0xba8]
mov ebx, eax
test ebx, ebx
jns 0xcec4f2
mov edi, dword [ebp - 0xe30]
test ebx, ebx
js 0xcec65b
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xcec512
mov ebx, 0xc0000017
jmp 0xcec65b
mov eax, dword [ebp - 0xae4]
mov ecx, esi
mov dword [ebp - 0xaf8], esi
mov eax, dword [eax]
mov dword [esi], eax
lea eax, [ebp - 0xaf8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xcec646
mov ebx, dword [ebp - 0xae4]
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0xaf8]
call fcn.00bc13d0
mov edx, dword [ebx]
lea eax, [ebp - 0xaf8]
mov ecx, dword [ebp - 0xaf8]
add esp, 0xc
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xcec646
mov eax, dword [ebp - 0xae4]
mov ecx, dword [ebp - 0xaf8]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xaf8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xcec646
mov ebx, dword [ebp - 0xae4]
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0xaf8]
call fcn.00bc13d0
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xaf8]
mov ecx, dword [ebp - 0xaf8]
add esp, 0xc
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xcec646
mov eax, dword [ebp - 0xae4]
mov ecx, dword [ebp - 0xaf8]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xaf8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xcec646
mov ebx, dword [ebp - 0xae4]
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0xaf8]
call fcn.00bc13d0
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xaf8]
mov ecx, dword [ebp - 0xaf8]
add esp, 0xc
push eax
call fcn.00b84e9a
mov ebx, eax
xor eax, eax
test ebx, ebx
js 0xcec648
mov dword [ebp - 0xa9c], esi
mov esi, eax
mov dword [ebp - 0xaa4], edi
jmp 0xcec648
xor eax, eax
test esi, esi
je 0xcec65b
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xced707
xor eax, eax
mov dword [ebp - 0xc94], 8
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xadc], eax
mov edx, dword [ebp - 0xabc]
lea eax, [ebp - 0xc94]
push eax
push 8
pop ecx
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xcec714
mov eax, dword [ebp - 0xc94]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xcec6c7
mov ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
jmp 0xcec6ee
mov dword [ebp - 0xca0], ecx
lea eax, [ebp - 0xca0]
push eax
push 8
pop edx
call fcn.00b84e9a
mov ebx, eax
mov eax, dword [ebp - 0xca0]
mov dword [ebp - 0xa94], ebx
test ebx, ebx
jns 0xcec6f4
mov eax, dword [ebp - 0xd80]
mov dword [ebp - 0xad0], eax
test ebx, ebx
js 0xcec714
mov edi, dword [ebp - 0xaac]
cmp edi, 1
ja 0xcec74a
mov ebx, 0xc000000d
mov dword [ebp - 0xa94], ebx
mov esi, dword [ebp - 0xab8]
test ebx, ebx
js 0xced707
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xcec96b
mov ecx, dword [ebp - 0xb1c]
mov ebx, 0xd0000017
jmp 0xcec978
mov ecx, dword [ebp - 0xae0]
xor eax, eax
mov dword [ebp - 0xbd8], ecx
mov esi, eax
mov eax, dword [ecx]
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0xbd8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcec714
mov edx, dword [ebp - 0xad8]
lea eax, [ebp - 0xbd8]
mov ecx, dword [ebp - 0xbd8]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcec714
mov ecx, dword [ebp - 0xbd8]
inc esi
cmp esi, 1
jb 0xcec75a
mov esi, dword [ecx]
lea eax, [ebp - 0xbd8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcec714
mov dword [ebp - 0xac4], esi
neg esi
sbb esi, esi
and dword [ebp - 0xbd8], esi
test ebx, ebx
js 0xcec714
cmp edi, 2
jbe 0xcec709
mov ecx, dword [ebp - 0xae0]
xor eax, eax
push 4
mov dword [ebp - 0xbe0], ecx
mov esi, eax
pop edi
lea eax, [ebp - 0xbe0]
mov edx, edi
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcec87a
mov edx, dword [ecx]
lea eax, [ebp - 0xbe0]
mov ecx, dword [ebp - 0xbe0]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcec87a
mov ecx, dword [ebp - 0xbe0]
inc esi
cmp esi, 2
jb 0xcec80a
mov esi, dword [ecx]
lea eax, [ebp - 0xbe0]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcec87a
mov edi, esi
neg esi
sbb esi, esi
and dword [ebp - 0xbe0], esi
jmp 0xcec880
mov edi, dword [ebp - 0xadc]
test ebx, ebx
js 0xcec714
mov edx, dword [ebp - 0xad0]
lea eax, [ebp - 0xbb0]
push 4
pop esi
push eax
mov ecx, esi
mov dword [ebp - 0xbb0], esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcec93f
mov ecx, dword [ebp - 0xbb0]
lea eax, [ebp - 0xbb0]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcec93f
mov edx, dword [ebp - 0xac4]
lea eax, [ebp - 0xbb0]
mov ecx, dword [ebp - 0xbb0]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcec93f
mov ecx, dword [ebp - 0xbb0]
lea eax, [ebp - 0xbb0]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcec93f
mov ecx, dword [ebp - 0xbb0]
lea eax, [ebp - 0xbb0]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xa94], ebx
test ebx, ebx
jns 0xcec94d
mov eax, dword [ebp - 0xe2c]
test ebx, ebx
js 0xcec714
cmp eax, 0x400000
jbe 0xcec95e
mov ebx, 0x8000ffff
jmp 0xced701
mov esi, eax
mov dword [ebp - 0xab8], esi
jmp 0xcec71a
mov ecx, eax
mov dword [ebp - 0xb1c], eax
mov ebx, 0x10000000
mov edi, dword [ebp - 0xa9c]
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xced70d
test edi, edi
jne 0xcec99a
mov ebx, 0x80070057
jmp 0xceca9e
test ecx, ecx
je 0xcec990
mov eax, dword [ebp - 0xaa4]
xor ebx, ebx
mov dword [ebp - 0xe10], eax
lea eax, [ebp - 0xd84]
push eax
push 0xb2be98
push 1
mov dword [ebp - 0xe18], edi
mov dword [ebp - 0xe14], ecx
mov dword [ebp - 0xe0c], esi
mov dword [ebp - 0xe08], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xceca12
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
jle 0xcec9ff
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceca91
mov ebx, 0x80004005
mov dword [ebp - 0xa94], ebx
jmp 0xceca91
push 0xb2be7c
push dword [ebp - 0xd84]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0xceca54
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
jle 0xceca4c
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xa94], ebx
test ebx, ebx
mov esi, dword [ebp - 0xab8]
jmp 0xcec9ff
push ebx
push 0x14
lea eax, [ebp - 0xe18]
mov ecx, esi
push eax
push 0x86
call dword [0xd0cffc]
call esi
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xceca8b
mov esi, dword [ebp - 0xe0c]
mov dword [ebp - 0xab8], esi
jmp 0xceca91
mov esi, dword [ebp - 0xab8]
cmp ebx, 0xd0000023
jne 0xcecaa9
mov ebx, 0x8007007a
mov dword [ebp - 0xa94], ebx
jmp 0xced70d
test ebx, ebx
js 0xced70d
mov eax, dword [ebp - 0xb1c]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xb34], ecx
mov edi, ecx
mov dword [ebp - 0xb98], eax
cmp esi, edx
jae 0xcecad8
mov ebx, 0xc000003e
jmp 0xcecebb
mov esi, dword [eax]
lea ecx, [ebp - 0xb98]
push ecx
mov ecx, eax
mov dword [ebp - 0xad8], esi
call fcn.00b84e9a
mov ebx, eax
xor ecx, ecx
test ebx, ebx
js 0xcecebb
lea eax, [ebp - 0xb34]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xceceb9
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0xb34]
cmp eax, esi
jae 0xcecb2f
mov ebx, 0xc000003e
jmp 0xceceb9
mov eax, dword [ebp - 0xb98]
lea ecx, [ebp - 0xb98]
push ecx
mov edx, esi
mov dword [ebp - 0xaa4], eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xceceb9
mov ecx, dword [ebp - 0xb34]
lea eax, [ebp - 0xb34]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xceceb9
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0xb34]
push 4
pop edx
cmp eax, edx
jb 0xcecb25
mov ecx, dword [ebp - 0xb98]
lea eax, [ebp - 0xb98]
push eax
mov esi, dword [ecx]
mov dword [ebp - 0xac8], esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xceceb9
mov ecx, dword [ebp - 0xb34]
lea eax, [ebp - 0xb34]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xceceb9
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0xb34]
cmp eax, esi
jb 0xcecb25
mov eax, dword [ebp - 0xb98]
lea ecx, [ebp - 0xb98]
push ecx
mov edx, esi
mov dword [ebp - 0xabc], eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xceceb9
mov ecx, dword [ebp - 0xb34]
lea eax, [ebp - 0xb34]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xceceb9
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0xb34]
push 4
pop edx
cmp eax, edx
jb 0xcecb25
mov ecx, dword [ebp - 0xb98]
mov eax, dword [ecx]
mov dword [ebp - 0xadc], eax
lea eax, [ebp - 0xb98]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xceceb9
mov ecx, dword [ebp - 0xb34]
lea eax, [ebp - 0xb34]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xceceb9
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0xb34]
mov ecx, dword [ebp - 0xadc]
cmp eax, ecx
jb 0xcecb25
lea eax, [ebp - 0xb34]
mov edx, ecx
mov ecx, dword [ebp - 0xb34]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xceceb9
mov ecx, dword [ebp - 0xab8]
mov eax, ecx
sub eax, dword [ebp - 0xb34]
jne 0xcecb25
mov eax, dword [ebp - 0xadc]
mov ebx, dword [ebp - 0xad8]
add eax, 0xc
add eax, esi
add eax, ebx
cmp eax, ecx
jne 0xcecb25
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xcecd07
mov ebx, 0xc0000017
jmp 0xcece44
cmp dword [ebp - 0xaa4], edi
je 0xcecd48
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xcecd31
mov ebx, 0xc0000017
xor eax, eax
jmp 0xcecddd
mov dword [esi + 4], eax
push ebx
push dword [ebp - 0xaa4]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xcecd4f
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
cmp dword [ebp - 0xabc], edi
je 0xcecd8b
mov ebx, dword [ebp - 0xac8]
push ebx
push 8
mov dword [esi + 8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xcecd25
mov dword [esi + 0xc], eax
push ebx
push dword [ebp - 0xabc]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xcecd91
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
cmp dword [ebp - 0xb98], edi
je 0xcecdd1
mov ebx, dword [ebp - 0xadc]
push ebx
push 8
mov dword [esi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xcecd25
mov dword [esi + 0x14], eax
push ebx
push dword [ebp - 0xb98]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xcecdd7
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov edi, esi
mov ebx, eax
mov esi, eax
test esi, esi
je 0xcece44
cmp dword [esi + 4], 0
je 0xcecdfd
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xcece19
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xcece35
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test ebx, ebx
js 0xcece52
mov dword [ebp - 0xaec], edi
mov edi, ecx
test edi, edi
je 0xcecebb
cmp dword [edi + 4], 0
je 0xcece72
push dword [edi + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 4], ecx
cmp dword [edi + 0xc], 0
je 0xcece8e
push dword [edi + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0xc], ecx
cmp dword [edi + 0x14], 0
je 0xceceaa
push dword [edi + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0x14], ecx
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xced707
mov eax, dword [ebp - 0xaec]
mov esi, ecx
mov dword [ebp - 0xaac], esi
mov dword [ebp - 0xab0], ecx
test eax, eax
jne 0xcecef5
mov ebx, 0xd000000d
mov dword [ebp - 0xa94], ebx
jmp 0xced4a3
mov ebx, dword [eax + 4]
mov dword [ebp - 0xab8], ebx
test ebx, ebx
je 0xcecee5
mov edi, dword [eax]
test edi, edi
je 0xcecee5
add edi, 0xfffffff8
mov dword [ebp - 0xae0], ecx
push edi
push ecx
mov dword [ebp - 0xac4], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xaf4], eax
test eax, eax
je 0xced481
xor ecx, ecx
mov dword [ebp - 0x3a8], 0xab69605e
mov dword [ebp - 0x3a4], 0x7f1137f
mov dl, cl
mov ecx, ebx
mov esi, eax
mov dword [ebp - 0xb0c], ecx
mov dword [ebp - 0xadc], esi
and edi, 7
je 0xced05e
or dword [ebp - 0xb28], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0xb38], ebx
mov eax, ebx
mov dword [ebp - 0xb24], eax
mov dword [ebp - 0xb08], ebx
test edi, edi
je 0xcecfd4
push 0x38
pop esi
push 4
pop eax
cmp ebx, eax
jge 0xcecfa6
mov eax, dword [ebp - 0xb0c]
lea ecx, [esi - 0x20]
movzx eax, byte [eax]
shl eax, cl
or dword [ebp - 0xb08], eax
jmp 0xcecfb3
movzx eax, byte [ecx]
mov ecx, esi
shl eax, cl
or dword [ebp - 0xb24], eax
mov ecx, dword [ebp - 0xb0c]
inc ebx
sub esi, 8
inc ecx
mov dword [ebp - 0xb0c], ecx
cmp ebx, edi
jl 0xcecf89
mov esi, dword [ebp - 0xadc]
mov eax, dword [ebp - 0xb24]
mov ebx, dword [ebp - 0xb08]
xor eax, 0x699a899c
xor ebx, 0x92f65a5
mov dword [ebp - 0xb28], eax
xor ecx, ecx
mov dword [ebp - 0xb38], ebx
test edi, edi
je 0xced020
cmp ecx, 4
jge 0xced003
rol ebx, 8
mov byte [esi], bl
jmp 0xced008
rol eax, 8
mov byte [esi], al
inc ecx
inc esi
cmp ecx, edi
jl 0xcecff7
mov ebx, dword [ebp - 0xb38]
mov eax, dword [ebp - 0xb28]
mov dword [ebp - 0xadc], esi
add edi, 0xfffffffc
test edi, edi
jle 0xced043
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xad0], eax
mov esi, eax
mov dword [ebp - 0xb28], eax
jmp 0xced07d
xor eax, eax
mov esi, eax
mov dword [ebp - 0xb28], esi
test edi, edi
jns 0xced07d
neg edi
shl edi, 3
mov ecx, edi
shr ebx, cl
shl ebx, cl
jmp 0xced077
xor eax, eax
or dword [ebp - 0xb24], 0xffffffff
mov esi, eax
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xb28], esi
mov ebx, eax
mov dword [ebp - 0xb38], ebx
mov ecx, dword [ebp - 0xac4]
mov eax, ecx
shr eax, 3
mov dword [ebp - 0xabc], eax
test eax, eax
je 0xced403
mov eax, dword [ebp - 0xadc]
mov edi, dword [ebp - 0xb0c]
add eax, 7
add edi, 2
mov dword [ebp - 0xaa4], eax
mov dword [ebp - 0xb0c], edi
movzx ecx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ecx, 8
or ecx, eax
shl edi, 8
mov eax, dword [ebp - 0xb0c]
xor ebx, ecx
mov dword [ebp - 0xac8], ecx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb0c]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb0c]
shl edi, 8
add dword [ebp - 0xb0c], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul ecx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub ecx, eax
xor esi, ecx
imul ecx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub ecx, eax
sub ecx, 0x756c8a2
xor ebx, ecx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0x137f
ror ecx, 6
imul eax, eax, 0xab69
xor ecx, eax
xor esi, ecx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, esi
rol eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub ecx, eax
xor esi, ecx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x7f1
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov eax, esi
mov dword [ebp - 0xad0], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea esi, [ebx - 0x7f1]
xor esi, dword [ebp - 0xad0]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul ecx, eax, 0x137f
mov eax, esi
shr eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 7
add ecx, eax
xor esi, ecx
mov eax, esi
mov ecx, esi
xor eax, 0x137f
ror ecx, 9
imul eax, eax, 0x605e
add ecx, eax
xor ebx, ecx
mov eax, ebx
mov dword [ebp - 0xad8], ebx
xor eax, 0xab69
rol eax, 5
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add ecx, eax
xor esi, ecx
mov ebx, esi
xor ebx, dword [ebp - 0xad8]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul ecx, eax, 0x605e
mov eax, esi
ror eax, 6
sub ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add ecx, eax
xor esi, ecx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x605e
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor ecx, eax
xor esi, ecx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul ecx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xb24]
rol eax, 2
mov dword [ebp - 0xb28], esi
mov dword [ebp - 0xb24], edi
xor ecx, eax
mov edi, dword [ebp - 0xb0c]
xor ecx, dword [ebp - 0xb08]
xor ebx, ecx
mov ecx, dword [ebp - 0xaa4]
mov dword [ebp - 0xb38], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb28]
ror dword [ebp - 0xb38], 8
mov byte [ecx], al
mov al, byte [ebp - 0xb38]
ror dword [ebp - 0xb28], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb28]
ror dword [ebp - 0xb38], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xb38]
ror dword [ebp - 0xb28], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xb28]
ror dword [ebp - 0xb38], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xb28], 8
mov al, byte [ebp - 0xb38]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb28]
mov byte [ecx - 3], al
add ecx, 8
mov ebx, dword [ebp - 0xb38]
mov esi, dword [ebp - 0xb28]
mov eax, dword [ebp - 0xac8]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xabc], 1
mov dword [ebp - 0xb38], ebx
mov dword [ebp - 0xb28], esi
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xaa4], ecx
jne 0xced0b4
mov ecx, dword [ebp - 0xac4]
mov ebx, dword [ebp - 0xaf4]
xor eax, eax
test ecx, ecx
je 0xced417
xor dl, byte [eax + ebx]
inc eax
cmp eax, ecx
jb 0xced40f
mov esi, dword [ebp - 0xab8]
movzx eax, dl
cdq
cmp eax, dword [ecx + esi]
jne 0xced440
cmp edx, dword [ecx + esi + 4]
jne 0xced440
mov edi, dword [ebp - 0xae0]
xor eax, eax
mov esi, ebx
mov dword [ebp - 0xab0], ecx
mov ebx, eax
jmp 0xced44d
mov esi, dword [ebp - 0xaac]
mov edi, 0xc004d501
xor eax, eax
test ebx, ebx
je 0xced460
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0xced481
mov eax, dword [ebp - 0xab0]
xor ecx, ecx
mov dword [ebp - 0xae8], esi
mov ebx, 0x10000000
mov esi, ecx
mov dword [ebp - 0xb48], eax
jmp 0xced488
mov ebx, 0xd0000001
xor ecx, ecx
mov dword [ebp - 0xa94], ebx
test esi, esi
je 0xced4a3
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test ebx, ebx
js 0xced707
mov edi, dword [ebp - 0xb48]
push 4
pop esi
mov dword [ebp - 0xc10], ecx
mov ecx, dword [ebp - 0xae8]
mov dword [ebp - 0xc4c], ecx
cmp edi, esi
jb 0xced6f6
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0xc4c]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xced6fb
lea eax, [ebp - 0xc10]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xced6fb
mov eax, edi
sub eax, dword [ebp - 0xc10]
cmp eax, esi
jb 0xced6f6
mov ecx, dword [ebp - 0xc4c]
lea eax, [ebp - 0xc4c]
push eax
push 4
pop eax
mov esi, dword [ecx]
mov edx, eax
mov dword [ebp - 0xaa4], esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xced6fb
mov ecx, dword [ebp - 0xc10]
lea eax, [ebp - 0xc10]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xced6fb
mov ecx, dword [ebp - 0xc10]
mov eax, edi
sub eax, ecx
cmp eax, esi
jb 0xced6f6
lea eax, [ebp - 0xc10]
mov edx, esi
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xced6fb
mov edi, dword [ebp - 0xc4c]
mov edx, dword [ebp - 0xb48]
mov ebx, dword [ebp - 0xae8]
lea ecx, [esi + edi]
lea eax, [edx + ebx]
cmp eax, ecx
jb 0xced6f6
sub edx, esi
sub edx, edi
add edx, ebx
cmp edx, 8
jae 0xced6f6
xor ecx, ecx
mov dword [ebp - 0xadc], ecx
mov eax, ecx
mov dword [ebp - 0xb48], eax
mov ebx, ecx
test edi, edi
je 0xced686
mov edx, dword [ebp - 0xaa4]
lea eax, [ebp - 0xbf8]
push eax
mov ecx, edi
mov esi, edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xced6fb
mov edx, dword [ebp - 0xbf8]
cmp edi, edx
jae 0xced676
lea eax, [esi + 4]
cmp eax, esi
jb 0xced6b2
cmp eax, edx
ja 0xced6ab
mov eax, dword [esi]
push 4
add eax, 4
pop ebx
cmp eax, ebx
jb 0xced622
mov ecx, eax
jmp 0xced625
or ecx, 0xffffffff
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, 4
jb 0xced63c
mov dword [ebp - 0xd8c], ecx
jmp 0xced642
mov ecx, dword [ebp - 0xd8c]
cmp eax, 4
jb 0xced6e4
add ecx, esi
cmp ecx, esi
jb 0xced655
mov eax, ecx
jmp 0xced658
or eax, 0xffffffff
cmp ecx, esi
sbb ebx, ebx
and ebx, 0xc0000095
cmp ecx, esi
jb 0xced6e4
cmp eax, edx
ja 0xced6ab
inc dword [ebp - 0xadc]
mov esi, eax
cmp eax, edx
jb 0xced5ff
cmp esi, edx
jne 0xced6ab
mov esi, dword [ebp - 0xaa4]
mov eax, dword [ebp - 0xb48]
test esi, esi
je 0xced6bd
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb48], eax
test eax, eax
jne 0xced6b9
mov ebx, 0xc0000017
jmp 0xced6e4
mov ebx, 0xc000000d
jmp 0xced6fb
mov ebx, 0xc0000095
jmp 0xced6fb
xor ecx, ecx
mov ebx, ecx
test edi, edi
je 0xced6d2
push esi
push edi
push eax
call fcn.00bc13d0
mov eax, dword [ebp - 0xb48]
add esp, 0xc
mov dword [ebp - 0xc00], eax
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0xc08], eax
test ebx, ebx
js 0xced6fb
mov eax, dword [ebp - 0xad8]
cmp eax, dword [ebp - 0xc08]
je 0xced6fb
mov ebx, 0xc000003e
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
mov edi, dword [ebp - 0xa9c]
mov eax, dword [ebp - 0xb14]
test eax, eax
je 0xced728
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xae4]
test esi, esi
je 0xced796
xor eax, eax
cmp dword [esi + 4], eax
je 0xced74f
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xced76b
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xced787
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xced7ab
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb1c]
test eax, eax
je 0xced7c6
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xaec]
test esi, esi
je 0xced834
xor eax, eax
cmp dword [esi + 4], eax
je 0xced7ed
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xced809
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xced825
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xae8]
test eax, eax
je 0xced84f
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xceb22b
cmp dword [ebp - 0xc08], 1
jae 0xced86a
mov ebx, 0xc004d501
jmp 0xceb225
cmp dword [ebp - 0xc00], 0
jne 0xced8fa
mov ebx, 0xc000000d
mov dword [ebp - 0xa94], ebx
mov eax, dword [ebp - 0xacc]
push 4
pop edx
test ebx, ebx
js 0xceb22b
cmp eax, 0xd0000023
jne 0xced8a5
mov eax, 0x8007007a
mov dword [ebp - 0xacc], eax
cmp eax, 0x8007007a
je 0xced8bc
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test eax, eax
js 0xceb22b
cmp dword [ebp - 0xc08], 6
jne 0xced860
cmp dword [ebp - 0xc00], 0
jne 0xced972
mov edx, dword [ebp - 0xd34]
mov ebx, 0xc000000d
mov ecx, dword [ebp - 0xd38]
mov dword [ebp - 0xa94], ebx
mov dword [ebp - 0xb14], edx
mov dword [ebp - 0xaec], ecx
jmp 0xceda44
cmp dword [ebp - 0xc08], 0
jbe 0xced877
mov ecx, dword [ebp - 0xc00]
lea eax, [ebp - 0xbec]
push eax
push 4
pop eax
mov esi, dword [ecx]
mov edx, eax
mov dword [ebp - 0xbec], ecx
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xced946
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbec]
mov dword [ebp - 0xbec], eax
jmp 0xced952
mov esi, dword [ebp - 0xe28]
mov eax, dword [ebp - 0xe24]
test ebx, ebx
js 0xced882
push 4
pop edx
cmp esi, edx
jne 0xceb384
mov eax, dword [eax]
mov dword [ebp - 0xacc], eax
jmp 0xced88b
mov ecx, dword [ebp - 0xc00]
xor eax, eax
mov dword [ebp - 0xbd0], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xbd0]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceda00
mov ecx, dword [ebp - 0xbd0]
lea eax, [ebp - 0xbd0]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceda00
mov ecx, dword [ebp - 0xbd0]
inc esi
cmp esi, 1
jae 0xced9cd
push 4
pop edx
jmp 0xced982
mov esi, dword [ecx]
lea eax, [ebp - 0xbd0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xceda00
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbd0]
mov dword [ebp - 0xbd0], eax
jmp 0xceda0c
mov esi, dword [ebp - 0xe20]
mov eax, dword [ebp - 0xe54]
test ebx, ebx
js 0xceda2c
cmp esi, 8
jne 0xceb384
mov ecx, dword [eax]
mov dword [ebp - 0xaec], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xb14], ecx
jmp 0xceda44
mov eax, dword [ebp - 0xd34]
mov dword [ebp - 0xb14], eax
mov eax, dword [ebp - 0xd38]
mov dword [ebp - 0xaec], eax
test ebx, ebx
js 0xceb22b
cmp dword [ebp - 0xc00], 0
jne 0xceda8e
mov ebx, 0xc000000d
mov dword [ebp - 0xa94], ebx
mov eax, dword [ebp - 0xd90]
push 4
pop edx
mov dword [ebp - 0xb48], eax
test ebx, ebx
js 0xceb22b
cmp dword [ebp - 0xc00], 0
jne 0xcedb42
mov ebx, 0xc000000d
jmp 0xceb225
mov ecx, dword [ebp - 0xc00]
xor eax, eax
mov dword [ebp - 0xbe4], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xbe4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcedb1c
mov ecx, dword [ebp - 0xbe4]
lea eax, [ebp - 0xbe4]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcedb1c
mov ecx, dword [ebp - 0xbe4]
inc esi
cmp esi, 2
jb 0xceda9e
mov esi, dword [ecx]
lea eax, [ebp - 0xbe4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcedb1c
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbe4]
mov dword [ebp - 0xbe4], eax
jmp 0xcedb28
mov esi, dword [ebp - 0xe1c]
mov eax, dword [ebp - 0xe9c]
test ebx, ebx
js 0xceda60
push 4
pop edx
cmp esi, edx
jne 0xceb384
mov eax, dword [eax]
jmp 0xceda69
mov ecx, dword [ebp - 0xc00]
xor eax, eax
mov dword [ebp - 0xbe8], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xbe8]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcedbd6
mov ecx, dword [ebp - 0xbe8]
lea eax, [ebp - 0xbe8]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcedbd6
mov ecx, dword [ebp - 0xbe8]
inc esi
cmp esi, 3
jae 0xcedb9d
push 4
pop edx
jmp 0xcedb52
mov edi, dword [ecx]
lea eax, [ebp - 0xbe8]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xabc], edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcedbd6
mov esi, edi
neg esi
sbb esi, esi
and esi, dword [ebp - 0xbe8]
mov dword [ebp - 0xbe8], esi
jmp 0xcedbe8
mov eax, dword [ebp - 0xe68]
mov esi, dword [ebp - 0xe64]
mov dword [ebp - 0xabc], eax
test ebx, ebx
js 0xceb22b
mov ecx, dword [ebp - 0xc00]
xor eax, eax
push 4
mov dword [ebp - 0xb50], ecx
mov edi, eax
pop edx
mov eax, dword [ecx]
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0xb50]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcedc83
mov edx, dword [ebp - 0xad8]
lea eax, [ebp - 0xb50]
mov ecx, dword [ebp - 0xb50]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcedc83
mov ecx, dword [ebp - 0xb50]
inc edi
push 4
pop edx
cmp edi, edx
jb 0xcedc03
mov edi, dword [ecx]
lea eax, [ebp - 0xb50]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcedc83
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb50]
mov dword [ebp - 0xb50], eax
jmp 0xcedc8f
mov edi, dword [ebp - 0xe60]
mov eax, dword [ebp - 0xe5c]
test ebx, ebx
js 0xcedca2
push 4
pop ecx
cmp edi, ecx
jne 0xceb384
mov eax, dword [eax]
jmp 0xcedca8
mov eax, dword [ebp - 0xe58]
mov dword [ebp - 0xaa4], eax
test ebx, ebx
js 0xceb22b
mov ecx, dword [ebp - 0xc00]
xor eax, eax
mov edi, eax
mov eax, dword [ecx]
lea edx, [ecx + 4]
mov dword [ebp - 0xad8], eax
cmp edx, ecx
jb 0xcedcd3
mov eax, edx
jmp 0xcedcd6
or eax, 0xffffffff
cmp edx, ecx
mov dword [ebp - 0xb78], eax
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp edx, ecx
jb 0xcedd56
mov ecx, dword [ebp - 0xad8]
add ecx, eax
mov edx, ecx
mov ebx, ecx
cmp ecx, eax
jae 0xcedd03
or ecx, 0xffffffff
cmp ebx, eax
mov dword [ebp - 0xb78], ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp edx, eax
jb 0xcedd56
inc edi
cmp edi, 5
jb 0xcedcc0
mov edi, dword [ecx]
lea eax, [ebp - 0xb78]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xcedd56
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb78]
mov dword [ebp - 0xb78], eax
jmp 0xcedd62
mov edi, dword [ebp - 0xe98]
mov eax, dword [ebp - 0xe94]
test ebx, ebx
js 0xcedd75
push 4
pop ecx
cmp edi, ecx
jne 0xceb384
mov ecx, dword [eax]
jmp 0xcedd7b
mov ecx, dword [ebp - 0xab4]
test ebx, ebx
js 0xceb22b
mov eax, dword [ebp - 0xad4]
cmp eax, dword [ebp - 0xaec]
jne 0xced860
mov eax, dword [ebp - 0xaa8]
cmp eax, dword [ebp - 0xb14]
jne 0xced860
mov eax, dword [ebp - 0xb48]
push 4
mov dword [ebp - 0xac0], ecx
pop ecx
mov dword [ebp - 0xc44], eax
cmp dword [ebp - 0xaa4], ecx
jbe 0xceddce
mov ebx, 0x8007007a
jmp 0xceb225
mov eax, dword [ebp - 0xabc]
cmp eax, ecx
ja 0xceddc4
push eax
push esi
push dword [ebp - 0xb8c]
call fcn.00bc13d0
add esp, 0xc
mov eax, dword [ebp - 0xacc]
mov esi, dword [ebp - 0xa98]
mov edi, dword [ebp - 0xaa0]
test eax, eax
je 0xceb237
mov ebx, eax
mov dword [ebp - 0xa94], ebx
jmp 0xceb237
mov esi, dword [0xd0804c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [0xd09358], eax
mov eax, dword [0xd09360]
push 0x54
mov dword [ebp - 0xadc], eax
lea eax, [ebp - 0x778]
push ebx
push eax
mov dword [0xd0935c], edx
call fcn.00bc259b
xor eax, eax
mov dword [ebp - 0xd40], ebx
lea edi, [ebp - 0xc38]
mov dword [ebp - 0xd3c], ebx
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0xae0], ebx
mov dword [ebp - 0xad8], ebx
stosd dword es:[edi], eax
push 0x2c
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x4d0]
push eax
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0xb48], ebx
mov esi, 0xd0aed4
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xcede88
mov eax, dword [0xd0a150]
test eax, eax
jne 0xcee49f
push 0x338
mov esi, ebx
mov dword [ebp - 0xaa8], ebx
push ebx
mov dword [ebp - 0xa9c], ebx
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0xb00], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb14], eax
test eax, eax
je 0xcee491
or dword [ebp - 0xabc], 0xffffffff
mov edi, ebx
add eax, 7
mov dword [ebp - 0x3e8], 0xab69605e
mov cl, bl
mov dword [ebp - 0x3e4], 0x7f1137f
mov dword [ebp - 0xaa4], ebx
mov esi, 0xb2bef2
mov dword [ebp - 0xb58], ebx
mov dword [ebp - 0xb84], edi
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xaf4], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edx, eax
mov dword [ebp - 0xac8], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl edx, 8
mov ebx, 0xab69605e
or edx, eax
movzx eax, byte [esi + 5]
shl edx, 8
add esi, 8
or edx, eax
mov dword [ebp - 0xaec], esi
mov esi, edx
mov dword [ebp - 0xad4], edx
xor esi, dword [ebp - 0xb58]
xor esi, edi
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor edi, edx
lea eax, [edi + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, edi
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor edi, edx
mov eax, edi
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, ebx
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor edi, edx
lea eax, [edi + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, ebx
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, edi
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edi, eax
mov dword [ebp - 0xab4], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xab4]
xor edi, ebx
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, edi
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov ebx, edi
xor ebx, esi
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor edi, eax
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, edi
ror eax, 6
sub edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add edx, eax
xor edi, edx
lea eax, [edi - 0x54969fa2]
mov esi, dword [ebp - 0xaec]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, edi
ror eax, 0xe
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, edi
xor edi, dword [ebp - 0xabc]
rol eax, 2
mov dword [ebp - 0xb58], edi
xor edx, eax
xor edx, dword [ebp - 0xaa4]
xor ebx, edx
mov edx, dword [ebp - 0xac4]
mov dword [ebp - 0xb84], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb58]
ror dword [ebp - 0xb84], 8
mov byte [edx], al
mov al, byte [ebp - 0xb84]
ror dword [ebp - 0xb58], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb58]
ror dword [ebp - 0xb84], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb84]
ror dword [ebp - 0xb58], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb58]
ror dword [ebp - 0xb84], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xb84]
ror dword [ebp - 0xb58], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb58]
mov byte [edx - 3], al
add edx, 8
mov edi, dword [ebp - 0xb84]
mov eax, dword [ebp - 0xac8]
ror dword [ebp - 0xb58], 8
ror edi, 8
sub dword [ebp - 0xaf4], 1
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0xad4]
mov dword [ebp - 0xb84], edi
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xac4], edx
jne 0xcedf26
mov esi, dword [ebp - 0xb14]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xcee263
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xcee295
cmp edx, dword [0xb2c22c]
jne 0xcee295
mov ebx, esi
xor eax, eax
mov dword [ebp - 0xab0], ebx
mov esi, eax
mov edi, 0x337
jmp 0xcee2aa
mov ebx, dword [ebp - 0xab0]
or edi, 0xffffffff
mov dword [ebp - 0xb00], 0xc004d501
xor eax, eax
test esi, esi
je 0xcee2bd
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb00], 0
jl 0xcee48b
xor eax, eax
mov esi, ebx
push 0x40
push eax
push 0xd0ae80
mov byte [edi + ebx], al
call fcn.00bc259b
add esp, 0xc
cmp byte [ebx], 0
je 0xcee421
mov edi, 0xd0ae80
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbfc]
jne 0xcee2f6
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xcee484
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa9c], edx
cmp word [eax], cx
je 0xcee343
mov edx, 0xc000007b
mov dword [ebp - 0xa9c], edx
jmp 0xcee38b
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xcee336
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xcee336
cmp dword [ecx], 0x4550
jne 0xcee336
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xbbc]
je 0xcee379
cmp ax, word [ebp - 0xbc0]
je 0xcee379
mov edx, 0xc000000d
jmp 0xcee33b
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xaa4], eax
test eax, eax
je 0xcee415
mov ecx, esi
mov dword [ebp - 0xac8], esi
xor eax, eax
mov dword [ebp - 0xc98], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xab4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xcee3b5
sub ecx, dword [ebp - 0xab4]
inc esi
add esi, ecx
test edx, edx
js 0xcee3ff
mov ecx, dword [ebp - 0xac8]
lea eax, [ebp - 0xc98]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa9c], edx
test edx, edx
js 0xcee421
mov eax, dword [ebp - 0xaa8]
mov ecx, dword [ebp - 0xc98]
mov dword [eax*4 + section..data], ecx
jmp 0xcee405
mov eax, dword [ebp - 0xaa8]
inc eax
inc ebx
mov dword [ebp - 0xaa8], eax
cmp ebx, dword [ebp - 0xaa4]
jb 0xcee39c
add edi, 0x10
cmp byte [esi], 0
jne 0xcee2ef
mov ebx, dword [ebp - 0xa9c]
mov esi, dword [ebp - 0xab0]
test esi, esi
je 0xcee442
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xcee498
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xcee45b
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xcee44a
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xcee4a5
mov ebx, 0xc000007a
jmp 0xcee427
mov esi, dword [ebp - 0xab0]
mov ebx, 0xc000007a
jmp 0xcee42d
mov eax, dword [0xd0a150]
xor ebx, ebx
inc eax
mov dword [0xd0a150], eax
xor eax, eax
mov edx, 0xd0aed4
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0xa], ebx
lea edi, [ebp - 0xcac]
mov dword [ebp - 0xae8], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xb1c], ebx
mov dword [ebp - 0xaec], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xdac]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xcee4da
mov eax, dword [0xd0a150]
test eax, eax
jne 0xceeb0e
push 0x338
mov esi, ebx
mov dword [ebp - 0xaa8], ebx
push ebx
mov dword [ebp - 0xa9c], ebx
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0xb00], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xad4], eax
test eax, eax
je 0xceeb00
or dword [ebp - 0xabc], 0xffffffff
mov edi, ebx
add eax, 7
mov dword [ebp - 0x3f0], 0xab69605e
mov cl, bl
mov dword [ebp - 0x3ec], 0x7f1137f
mov dword [ebp - 0xaa4], ebx
mov esi, 0xb2bef2
mov dword [ebp - 0xb60], ebx
mov dword [ebp - 0xb90], edi
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xaf4], 0x67
movzx edx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx ebx, byte [esi + 2]
shl edx, 8
or edx, eax
shl ebx, 8
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
or ebx, eax
mov dword [ebp - 0xab4], edx
movzx eax, byte [esi + 4]
xor edi, edx
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 5]
add esi, 8
shl ebx, 8
or ebx, eax
mov dword [ebp - 0xac8], esi
mov esi, ebx
xor esi, dword [ebp - 0xb60]
xor esi, edi
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor edi, edx
lea eax, [edi + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, edi
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor edi, edx
mov eax, edi
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor edi, edx
lea eax, [edi + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, edi
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edi, eax
mov dword [ebp - 0xae4], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xae4]
xor edi, 0xab69605e
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, edi
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xae4], esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
mov eax, esi
xor edi, edx
xor eax, edi
xor eax, 0xac987321
mov dword [ebp - 0xae4], eax
ror eax, 3
sub eax, 0xab69
mov esi, dword [ebp - 0xae4]
imul eax, eax, 0x137f
xor edi, eax
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, edi
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
xor edi, edx
lea eax, [edi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, edi
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xae4], esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, edi
xor edi, dword [ebp - 0xabc]
rol eax, 2
mov dword [ebp - 0xb60], edi
mov dword [ebp - 0xabc], ebx
xor edx, eax
mov eax, esi
xor edx, dword [ebp - 0xaa4]
xor eax, edx
mov esi, dword [ebp - 0xac8]
mov edx, dword [ebp - 0xac4]
mov dword [ebp - 0xb90], eax
mov byte [edx - 4], al
mov al, byte [ebp - 0xb60]
ror dword [ebp - 0xb90], 8
mov byte [edx], al
mov al, byte [ebp - 0xb90]
ror dword [ebp - 0xb60], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb60]
ror dword [ebp - 0xb90], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb90]
ror dword [ebp - 0xb60], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb60]
ror dword [ebp - 0xb90], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xb90]
ror dword [ebp - 0xb60], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb60]
mov byte [edx - 3], al
add edx, 8
mov eax, dword [ebp - 0xb90]
ror dword [ebp - 0xb60], 8
ror eax, 8
sub dword [ebp - 0xaf4], 1
mov dword [ebp - 0xae4], eax
mov edi, dword [ebp - 0xae4]
mov dword [ebp - 0xb90], eax
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0xaa4], eax
mov dword [ebp - 0xac4], edx
jne 0xcee578
mov esi, dword [ebp - 0xad4]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xcee8d2
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xcee904
cmp edx, dword [0xb2c22c]
jne 0xcee904
mov ebx, esi
xor eax, eax
mov dword [ebp - 0xab0], ebx
mov esi, eax
mov edi, 0x337
jmp 0xcee919
mov ebx, dword [ebp - 0xab0]
or edi, 0xffffffff
mov dword [ebp - 0xb00], 0xc004d501
xor eax, eax
test esi, esi
je 0xcee92c
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb00], 0
jl 0xceeafa
xor eax, eax
mov esi, ebx
push 0x40
push eax
push 0xd0ae80
mov byte [edi + ebx], al
call fcn.00bc259b
add esp, 0xc
cmp byte [ebx], 0
je 0xceea90
mov edi, 0xd0ae80
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbfc]
jne 0xcee965
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xceeaf3
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa9c], edx
cmp word [eax], cx
je 0xcee9b2
mov edx, 0xc000007b
mov dword [ebp - 0xa9c], edx
jmp 0xcee9fa
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xcee9a5
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xcee9a5
cmp dword [ecx], 0x4550
jne 0xcee9a5
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xbbc]
je 0xcee9e8
cmp ax, word [ebp - 0xbc0]
je 0xcee9e8
mov edx, 0xc000000d
jmp 0xcee9aa
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xaa4], eax
test eax, eax
je 0xceea84
mov ecx, esi
mov dword [ebp - 0xac8], esi
xor eax, eax
mov dword [ebp - 0xbdc], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xab4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xceea24
sub ecx, dword [ebp - 0xab4]
inc esi
add esi, ecx
test edx, edx
js 0xceea6e
mov ecx, dword [ebp - 0xac8]
lea eax, [ebp - 0xbdc]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa9c], edx
test edx, edx
js 0xceea90
mov eax, dword [ebp - 0xaa8]
mov ecx, dword [ebp - 0xbdc]
mov dword [eax*4 + section..data], ecx
jmp 0xceea74
mov eax, dword [ebp - 0xaa8]
inc eax
inc ebx
mov dword [ebp - 0xaa8], eax
cmp ebx, dword [ebp - 0xaa4]
jb 0xceea0b
add edi, 0x10
cmp byte [esi], 0
jne 0xcee95e
mov ebx, dword [ebp - 0xa9c]
mov esi, dword [ebp - 0xab0]
test esi, esi
je 0xceeab1
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xceeb07
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xceeaca
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xceeab9
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xceeb14
mov ebx, 0xc000007a
jmp 0xceea96
mov esi, dword [ebp - 0xab0]
mov ebx, 0xc000007a
jmp 0xceea9c
mov eax, dword [0xd0a150]
xor ebx, ebx
inc eax
mov dword [0xd0a150], eax
xor eax, eax
mov edi, 0xd0aed4
xchg dword [edi], eax
push 0x54
lea eax, [ebp - 0x778]
push ebx
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0xadc]
add esp, 0xc
mov esi, dword [0xd0807c]
mov ecx, eax
mov dword [ebp - 0xc38], ebx
push 0xf
pop edx
and ecx, edx
mov dword [ebp - 0xab8], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
push 0x403
and ecx, edx
shr eax, 0xc
push ebx
mov word [ebp - 0xa], cx
and eax, edx
push ebx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xab0], 0xffffff
test eax, eax
jne 0xceebb9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xceeba9
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcefff4
mov ebx, 0x80004005
jmp 0xcefff4
mov esi, dword [0xd08050]
mov eax, ebx
mov dword [ebp - 0xac0], eax
mov edi, ebx
lea eax, [ebp - 0xc70]
mov dword [ebp - 0xb14], edi
push eax
push ebx
lea eax, [ebp - 0xc28]
mov dword [ebp - 0xc24], ebx
push eax
push 8
mov ecx, esi
mov dword [ebp - 0xad4], ebx
mov dword [ebp - 0xacc], ebx
mov dword [ebp - 0xc70], ebx
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xceec8f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xceec21
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xceedf8
mov ebx, 0x80004005
mov esi, dword [ebp - 0xacc]
xor edx, edx
mov eax, dword [ebp - 0xc24]
test eax, eax
je 0xceec50
mov ecx, dword [ebp - 0xad4]
test ecx, ecx
je 0xceec50
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0xceec48
test esi, esi
je 0xceec63
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xc24]
test eax, eax
je 0xcef55a
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0xc24], ecx
jmp 0xcef55c
mov eax, dword [ebp - 0xc70]
add eax, eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xac4], ebx
test ebx, ebx
jne 0xceecbc
mov ebx, 0x8007000e
jmp 0xceec2c
mov eax, dword [ebp - 0xc28]
lea eax, [eax*4 + 4]
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xabc], eax
test eax, eax
je 0xceeddd
mov esi, eax
lea eax, [ebp - 0xc70]
push eax
push ebx
mov ebx, dword [0xd08050]
lea eax, [ebp - 0xc28]
push eax
push 8
mov ecx, ebx
call dword [0xd0cffc]
call ebx
test eax, eax
jne 0xceed34
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xceed26
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xceed2d
mov ebx, 0x80004005
xor ecx, ecx
jmp 0xceedc8
mov eax, dword [ebp - 0xabc]
xor ecx, ecx
mov ebx, eax
mov edi, dword [ebp - 0xac4]
mov dword [ebp - 0xaa4], ecx
cmp dword [ebp - 0xc28], ecx
jbe 0xceeda5
mov esi, dword [0xd08058]
push ecx
push edi
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, edi
mov dword [ebx], eax
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0xceed6d
sub ecx, edx
sar ecx, 1
push 4
pop eax
add ebx, eax
mov eax, dword [ebp - 0xaa4]
lea edi, [edi + ecx*2]
add edi, 2
inc eax
push 0
mov dword [ebp - 0xaa4], eax
pop ecx
cmp eax, dword [ebp - 0xc28]
jb 0xceed52
mov eax, dword [ebp - 0xabc]
mov dword [ebx], 0x409
mov edi, eax
mov ebx, dword [ebp - 0xac0]
mov esi, ecx
mov dword [ebp - 0xb14], eax
mov eax, dword [ebp - 0xc28]
inc eax
mov dword [ebp - 0xaa4], eax
test esi, esi
je 0xceede2
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xceede2
mov ebx, 0x8007000e
push dword [ebp - 0xac4]
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xceec2c
xor eax, eax
mov ebx, eax
mov edx, eax
mov dword [ebp - 0xaa8], ebx
cmp dword [ebp - 0xaa4], eax
jbe 0xceee3f
mov ecx, eax
mov eax, dword [edi + edx*4]
cmp eax, dword [ecx*4 + 0xb40a18]
je 0xceee35
inc ecx
cmp ecx, 0x26
jb 0xceee16
inc edx
xor eax, eax
cmp edx, dword [ebp - 0xaa4]
jae 0xceee3f
jmp 0xceee14
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0xaa8], ebx
mov esi, dword [0xd08054]
mov ecx, esi
push eax
mov dword [ebp - 0xb00], eax
lea eax, [ebp - 0xc0]
push 0x55
push eax
push dword [ebx*4 + 0xb40a18]
call dword [0xd0cffc]
call esi
test eax, eax
je 0xceeea8
mov esi, dword [0xd08048]
lea eax, [ebp - 0x640]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xc0]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
test eax, eax
jle 0xceeea8
mov ebx, dword [ebp - 0x634]
shr ebx, 0x1b
and ebx, 1
mov dword [ebp - 0xb00], ebx
mov ebx, dword [ebp - 0xaa8]
xor eax, eax
mov edx, 0xb2fcd8
mov esi, eax
mov ecx, edx
mov dword [ebp + esi*4 - 0x350], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbfc]
jne 0xceeebd
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0xceeeb1
imul ecx, ebx, 3
movzx eax, byte [ecx + 0xb320b0]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xcac], eax
movzx eax, byte [ecx + 0xb320b1]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xca8], eax
movzx eax, byte [ecx + 0xb320b2]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xca4], eax
xor ebx, ebx
push 0x1c90
mov eax, ebx
push ebx
mov dword [ebp - 0xac0], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb08], ecx
test ecx, ecx
je 0xceecb2
or dword [ebp - 0xabc], 0xffffffff
mov edi, ebx
add ecx, 7
mov dword [ebp - 0x3f8], 0xab69605e
mov al, bl
mov dword [ebp - 0x3f4], 0x7f1137f
mov dword [ebp - 0xaa4], ebx
mov esi, 0xb40ac2
mov dword [ebp - 0xb5c], ebx
mov dword [ebp - 0xb80], edi
mov dword [ebp - 0xac4], ecx
mov dword [ebp - 0xaf4], 0x392
movzx ebx, byte [esi - 2]
movzx ecx, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 3]
or edx, ecx
mov dword [ebp - 0xac8], ebx
movzx ecx, byte [esi + 4]
xor edi, ebx
shl edx, 8
mov ebx, 0xab69605e
or edx, ecx
movzx ecx, byte [esi + 5]
shl edx, 8
add esi, 8
or edx, ecx
mov dword [ebp - 0xad0], esi
mov esi, edx
mov dword [ebp - 0xadc], edx
xor esi, dword [ebp - 0xb5c]
xor esi, edi
xor esi, 0xac987321
lea ecx, [esi + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, esi
rol ecx, 0xa
add edx, ecx
xor edi, edx
lea ecx, [edi + 0x7f1137f]
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, edi
rol ecx, 2
sub edx, ecx
xor esi, edx
imul edx, esi, 0x605e
mov ecx, esi
shr ecx, 0xd
sub edx, ecx
sub edx, 0x756c8a2
xor edi, edx
mov ecx, edi
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, edi
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, ebx
sub ecx, edx
xor edi, ecx
mov ecx, edi
mov edx, edi
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor esi, edx
lea ecx, [esi + 0x7f1137f]
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, esi
rol ecx, 2
add edx, ecx
xor edi, edx
lea ecx, [edi + 0x54969fa2]
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, edi
rol ecx, 8
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, ebx
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, esi
ror ecx, 0xa
xor edx, ecx
xor edi, edx
mov ecx, edi
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, edi
shr ecx, 0xa
xor edx, ecx
xor esi, edx
mov ecx, esi
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor edi, ecx
mov dword [ebp - 0xab4], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xab4]
xor edi, ebx
mov ecx, edi
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, edi
shr ecx, 2
add edx, ecx
xor esi, edx
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, esi
rol ecx, 7
add edx, ecx
xor edi, edx
mov ecx, edi
mov edx, edi
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69
rol ecx, 5
imul edx, ecx, 0x7f1
mov ecx, esi
rol ecx, 7
add edx, ecx
xor edi, edx
mov ebx, edi
xor ebx, esi
xor ebx, 0xac987321
mov ecx, ebx
ror ecx, 3
sub ecx, 0xab69
imul ecx, ecx, 0x137f
xor edi, ecx
lea ecx, [edi - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, edi
ror ecx, 6
sub edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 0xe
add edx, ecx
xor edi, edx
lea ecx, [edi - 0x54969fa2]
mov esi, dword [ebp - 0xad0]
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, edi
ror ecx, 0xe
sub edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, ebx
shr ecx, 3
xor edx, ecx
xor edi, edx
mov ecx, edi
xor ecx, 0x7f1137f
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, edi
xor edi, dword [ebp - 0xabc]
rol ecx, 2
mov dword [ebp - 0xb5c], edi
xor edx, ecx
xor edx, dword [ebp - 0xaa4]
xor ebx, edx
mov edx, dword [ebp - 0xac4]
mov dword [ebp - 0xb80], ebx
mov byte [edx - 4], bl
mov cl, byte [ebp - 0xb5c]
ror dword [ebp - 0xb80], 8
mov byte [edx], cl
mov cl, byte [ebp - 0xb80]
ror dword [ebp - 0xb5c], 8
mov byte [edx - 5], cl
mov cl, byte [ebp - 0xb5c]
ror dword [ebp - 0xb80], 8
mov byte [edx - 1], cl
mov cl, byte [ebp - 0xb80]
ror dword [ebp - 0xb5c], 8
mov byte [edx - 6], cl
mov cl, byte [ebp - 0xb5c]
ror dword [ebp - 0xb80], 8
mov byte [edx - 2], cl
mov cl, byte [ebp - 0xb80]
ror dword [ebp - 0xb5c], 8
mov byte [edx - 7], cl
mov cl, byte [ebp - 0xb5c]
mov byte [edx - 3], cl
add edx, 8
mov edi, dword [ebp - 0xb80]
mov ecx, dword [ebp - 0xac8]
ror dword [ebp - 0xb5c], 8
ror edi, 8
sub dword [ebp - 0xaf4], 1
mov dword [ebp - 0xaa4], ecx
mov ecx, dword [ebp - 0xadc]
mov dword [ebp - 0xb80], edi
mov dword [ebp - 0xabc], ecx
mov dword [ebp - 0xac4], edx
jne 0xceef91
xor ecx, ecx
mov esi, 0x1c90
mov edx, ecx
mov ecx, dword [ebp - 0xb08]
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0xcef2df
movzx eax, al
cdq
cmp eax, dword [0xb42750]
jne 0xcef313
cmp edx, dword [0xb42754]
jne 0xcef313
mov ebx, dword [ebp - 0xac0]
xor edx, edx
mov dword [ebp - 0xc24], ecx
mov ecx, edx
mov dword [ebp - 0xad4], esi
jmp 0xcef320
mov ebx, 0xc004d501
xor edx, edx
mov dword [ebp - 0xac0], ebx
test ecx, ecx
je 0xcef333
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xceec2c
mov edi, dword [ebp - 0xc24]
xor eax, eax
mov ebx, dword [ebp - 0xaa8]
mov esi, eax
mov edx, eax
cmp ebx, edx
jne 0xcef358
mov dword [ebp + esi*4 - 0x300], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0xab4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xcef363
sub ecx, dword [ebp - 0xab4]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0xcef34d
inc esi
push 0
pop eax
cmp esi, 6
jb 0xcef34b
push 0xc
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, dword [ebp - 0xac0]
mov edx, eax
mov dword [ebp - 0xaa4], edx
test edx, edx
jne 0xcef3b2
xor edx, edx
mov ebx, 0x8007000e
mov esi, edx
jmp 0xceec34
mov edi, edx
xor eax, eax
mov esi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xaa8], eax
movzx edx, word [ebp + ecx*2 - 0xc]
cmp dx, word [eax*2 + 0xb40ab0]
je 0xcef3df
inc eax
cmp eax, 6
jb 0xcef3ca
jmp 0xcef49e
mov edx, dword [ebp + eax*4 - 0x300]
mov ecx, edx
mov dword [ebp - 0xab4], edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xcef3f1
xor eax, eax
sub ecx, edi
mov edi, dword [0xd08060]
push eax
push eax
lea eax, [ecx + 1]
mov ecx, edi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0xd0cffc]
call edi
mov dword [ebp - 0xac8], eax
test eax, eax
je 0xcef4d6
lea ecx, [eax + eax]
xor eax, eax
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0xaa8]
mov edi, eax
mov eax, dword [ebp - 0xaa4]
mov dword [eax + ecx*4], edi
test edi, edi
je 0xcef4cf
mov edx, dword [ebp - 0xab4]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xab4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xcef463
push dword [ebp - 0xac8]
sub ecx, dword [ebp - 0xab4]
push edi
mov edi, dword [0xd08060]
lea eax, [ecx + 1]
mov ecx, edi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0xd0cffc]
call edi
test eax, eax
je 0xcef4d6
mov ecx, dword [ebp - 0xaa8]
inc ecx
mov dword [ebp - 0xaa8], ecx
push 0
pop eax
cmp ecx, 3
jb 0xcef3c5
mov eax, dword [ebp - 0xaa4]
xor edx, edx
mov dword [ebp - 0xaec], eax
mov esi, edx
mov eax, dword [ebp - 0xb00]
mov dword [ebp - 0x778], eax
jmp 0xcef4f6
mov ebx, 0x8007000e
jmp 0xcef4f4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcef4ed
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcef4f4
mov ebx, 0x80004005
xor edx, edx
test esi, esi
je 0xceec34
mov edi, edx
mov edx, dword [esi + edi*4]
test edx, edx
je 0xcef54f
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0xab4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbfc]
jne 0xcef512
sub ecx, dword [ebp - 0xab4]
xor eax, eax
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xcef53e
mov byte [edx], al
inc edx
sub ecx, 1
jne 0xcef536
push dword [esi + edi*4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
inc edi
cmp edi, 3
jb 0xcef500
jmp 0xceec32
xor ecx, ecx
mov eax, dword [ebp - 0xb14]
test eax, eax
je 0xcef575
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xceffd6
mov eax, dword [ebp - 0xaec]
mov esi, dword [0xd080b4]
mov ecx, dword [eax]
mov dword [ebp - 0x770], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x76c], ecx
xor ecx, ecx
mov eax, dword [eax + 8]
mov edi, ecx
push ecx
mov dword [ebp - 0x768], eax
mov ebx, ecx
lea eax, [ebp - 0xdb8]
mov dword [ebp - 0xdb4], ecx
push eax
push ecx
mov dword [ebp - 0xdb0], ecx
mov ecx, esi
push 0x42
mov dword [ebp - 0xdb8], 0xc
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcef5f8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcef5ef
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcef601
mov ebx, 0x80004005
jmp 0xcef601
mov edi, dword [ebp - 0xdb4]
and edi, 1
mov dword [ebp - 0x774], edi
test ebx, ebx
js 0xceffd6
mov edi, dword [ebp - 0xab8]
mov eax, edi
push 0x2a
pop ecx
mov dword [ebp - 0xacc], ecx
sub eax, 1
je 0xcef64e
sub eax, 1
je 0xcef642
sub eax, 1
jne 0xcef65e
mov ebx, 0xe1
mov dword [ebp - 0xae8], ebx
mov dword [ebp - 0xb1c], ebx
jmp 0xcef65e
mov dword [ebp - 0xae8], 0xf
jmp 0xcef654
mov dword [ebp - 0xae8], ecx
mov dword [ebp - 0xb1c], 0xb
mov esi, 0xdc
mov dword [ebp - 0xac0], 0x60
push esi
xor ebx, ebx
lea eax, [ebp - 0x720]
push ebx
push eax
call fcn.00bc259b
add esp, 0xc
mov word [ebp - 0x6dc], si
mov esi, dword [0xd08070]
lea eax, [ebp - 0x720]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcef764
movzx ebx, word [ebp - 0x67a]
xor eax, eax
mov ecx, dword [ebp - 0x670]
mov dword [ebp - 0xda8], eax
mov dword [ebp - 0xdac], eax
mov eax, dword [ebp - 0x674]
push 0x60
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0xda4], eax
pop eax
mov dword [ebp - 0xac0], ebx
mov dword [ebp - 0xaa4], ecx
mov dword [ebp - 0xda0], ecx
cmp ebx, eax
jae 0xcef6f5
mov dword [ebp - 0xac0], eax
xor ebx, ebx
cmp edi, 1
mov edi, dword [ebp - 0xcac]
je 0xcef708
mov edi, dword [ebp - 0xca4]
push 0x5c
lea eax, [ebp - 0x5c0]
push ebx
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xab4], eax
test eax, eax
jne 0xcef781
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcef754
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcef821
mov ebx, 0x80004005
jmp 0xceffd6
mov eax, dword [ebp - 0xda0]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0xda4]
mov dword [ebp - 0xaa8], eax
jmp 0xcef6f7
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0xac0]
push dword [ebp - 0xae8]
call dword [0xd0cffc]
call esi
push edi
push 0x20
neg eax
mov dword [ebp - 0x5b0], 0x190
pop edx
lea ecx, [ebp - 0x5a4]
mov dword [ebp - 0x5c0], eax
mov byte [ebp - 0x5a6], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x5c0]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcef802
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcef7f9
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcef808
mov ebx, 0x80004005
jmp 0xcef808
mov dword [ebp - 0x764], eax
push dword [ebp - 0xab4]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xceffd6
cmp dword [ebp - 0xab8], 1
mov edi, dword [ebp - 0xcac]
je 0xcef83e
mov edi, dword [ebp - 0xca4]
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0x560]
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xab4], eax
test eax, eax
jne 0xcef913
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcef892
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0xcef75a
push 0x20
pop edi
test ebx, ebx
js 0xceffd6
mov ebx, dword [ebp - 0xab8]
xor ecx, ecx
mov eax, ecx
mov edx, ecx
mov ecx, ebx
sub ecx, 1
je 0xcef8c4
sub ecx, 1
je 0xcef9ba
sub ecx, 1
jne 0xcef8d0
mov eax, dword [ebp - 0xaa8]
mov edx, dword [ebp - 0xaa4]
mov dword [ebp - 0xc30], eax
mov dword [ebp - 0xc2c], edx
xor ecx, ecx
inc ecx
cmp ebx, ecx
je 0xcef9fd
jbe 0xcef9cf
cmp ebx, 3
ja 0xcef9cf
xor ebx, ebx
mov edx, ebx
mov dword [ebp - 0xacc], ebx
mov ecx, ebx
mov dword [ebp - 0xaa8], edx
mov dword [ebp - 0xae8], ebx
jmp 0xcefa12
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0xac0]
push dword [ebp - 0xb1c]
call dword [0xd0cffc]
call esi
push edi
push 0x20
pop edi
neg eax
mov dword [ebp - 0x550], 0x190
mov edx, edi
mov dword [ebp - 0x560], eax
lea ecx, [ebp - 0x544]
mov byte [ebp - 0x546], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x560]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcef996
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcef98d
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcef99c
mov ebx, 0x80004005
jmp 0xcef99c
mov dword [ebp - 0x760], eax
push dword [ebp - 0xab4]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xcef89b
mov eax, dword [ebp - 0xaa8]
push 4
pop ecx
cdq
idiv ecx
xor ecx, ecx
mov edx, ecx
jmp 0xcef8d0
mov ecx, dword [ebp - 0xc1c]
xor ebx, ebx
mov edx, dword [ebp - 0xc1c]
mov dword [ebp - 0xae8], ecx
mov ecx, dword [ebp - 0xc1c]
mov dword [ebp - 0xacc], ecx
mov ecx, dword [ebp - 0xc1c]
mov dword [ebp - 0xaa8], edx
jmp 0xcefa12
xor ebx, ebx
mov dword [ebp - 0xae8], edi
mov ecx, 0x96
mov dword [ebp - 0xaa8], ebx
mov edx, ebx
mov dword [ebp - 0xad4], ecx
push dword [ebp - 0x764]
mov esi, dword [0xd0803c]
sub eax, ecx
push dword [ebp - 0xae4]
mov edi, dword [ebp - 0x770]
sub eax, edx
mov ecx, esi
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0x73c], eax
mov dword [ebp - 0x74c], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x754]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xae4]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcefa88
mov ebx, 0x80004005
mov eax, dword [ebp - 0xab4]
test eax, eax
je 0xcefaa4
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xceffd6
push dword [ebp - 0x760]
mov esi, dword [0xd0803c]
xor eax, eax
push dword [ebp - 0xae4]
mov edi, dword [ebp - 0x76c]
mov ecx, esi
mov ebx, eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x744]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xae4]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcefb0a
mov ebx, 0x80004005
mov eax, dword [ebp - 0xab4]
test eax, eax
je 0xcefb26
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xceffd6
mov eax, dword [ebp - 0xab8]
cmp eax, 2
je 0xcefb3e
cmp eax, 3
jne 0xcefb54
mov edi, dword [ebp - 0x73c]
cmp dword [ebp - 0x74c], edi
jle 0xcefb5a
mov edi, dword [ebp - 0x74c]
jmp 0xcefb5a
mov edi, dword [ebp - 0xac8]
cmp dword [ebp - 0x778], 0
mov esi, dword [0xd080a8]
mov ecx, esi
push dword [ebp - 0xacc]
je 0xcefbad
mov eax, edi
sub eax, dword [ebp - 0x74c]
add eax, dword [ebp - 0xaa8]
push eax
lea eax, [ebp - 0x754]
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x748]
add eax, dword [ebp - 0xae8]
push eax
mov eax, edi
sub eax, dword [ebp - 0x73c]
add eax, dword [ebp - 0xaa8]
push eax
jmp 0xcefbd1
mov ebx, dword [ebp - 0xad4]
lea eax, [ebp - 0x754]
push ebx
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x748]
add eax, dword [ebp - 0xae8]
push eax
push ebx
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x744]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xab8]
cmp eax, 2
je 0xcefeb6
cmp eax, 3
je 0xcefeb6
cmp eax, 1
jne 0xcefed2
xor eax, eax
mov dword [ebp - 0x758], 0xffffff
push 0x5c
push eax
lea eax, [ebp - 0x620]
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xab4], eax
test eax, eax
jne 0xcefc6e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcefc63
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcefd0f
jmp 0xcef75a
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0xac0]
push 0xb
call dword [0xd0cffc]
call esi
push dword [ebp - 0xca8]
neg eax
mov dword [ebp - 0x610], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x604]
mov dword [ebp - 0x620], eax
mov byte [ebp - 0x606], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x620]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcefcf0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcefce7
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcefcf6
mov ebx, 0x80004005
jmp 0xcefcf6
mov dword [ebp - 0x75c], eax
push dword [ebp - 0xab4]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xceffd6
push dword [ebp - 0x75c]
mov esi, dword [0xd0803c]
xor eax, eax
push dword [ebp - 0xae4]
mov dword [ebp - 0x72c], edi
mov ecx, esi
mov edi, dword [ebp - 0x768]
mov ebx, eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
push 0x460
lea eax, [ebp - 0x734]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xae4]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcefd7b
mov ebx, 0x80004005
mov eax, dword [ebp - 0xab4]
test eax, eax
je 0xcefd97
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xceffd6
mov eax, dword [ebp - 0x72c]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x72c], eax
cmp eax, ecx
jge 0xcefdbb
mov dword [ebp - 0x72c], ecx
mov ebx, dword [ebp - 0xac0]
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x60
pop edi
push edi
push ebx
push dword [ebp - 0x734]
mov dword [ebp - 0x728], 0x20
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x730]
mov dword [ebp - 0x734], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x72c]
mov dword [ebp - 0x730], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x728]
mov dword [ebp - 0x72c], eax
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0x778], 0
mov dword [ebp - 0x728], eax
je 0xcefe87
mov ecx, dword [ebp - 0x754]
cmp ecx, dword [ebp - 0x744]
jl 0xcefe63
mov ecx, dword [ebp - 0x744]
mov eax, dword [ebp - 0x738]
add eax, 0x24
push eax
push ecx
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x734]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xcefed2
mov ecx, dword [ebp - 0x74c]
cmp ecx, dword [ebp - 0x73c]
jg 0xcefe9b
mov ecx, dword [ebp - 0x73c]
mov eax, dword [ebp - 0x738]
add eax, 0x24
push eax
mov eax, dword [ebp - 0x734]
sub eax, dword [ebp - 0x72c]
add eax, ecx
push eax
jmp 0xcefe6e
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0xc30], edi
mov dword [ebp - 0xc2c], eax
mov dword [ebp - 0x758], 0xffa8a8a8
mov eax, dword [ebp - 0x778]
lea edi, [ebp - 0xeac]
mov ebx, dword [ebp - 0xc30]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xc2c]
mov dword [ebp - 0xaa4], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xab8]
sub eax, 1
je 0xcf026f
sub eax, 1
je 0xcf019b
sub eax, 1
jne 0xceffd4
mov esi, dword [0xd080a4]
lea edi, [ebp - 0x420]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push 1
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08084]
lea ecx, [ebp - 0x420]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x420], 0x28
call dword [0xd0cffc]
call esi
test eax, eax
je 0xceffd4
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x40c]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x404]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x404]
lea esi, [ebp - 0x40c]
sub eax, ebx
lea edi, [ebp - 0xeac]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc38], eax
mov eax, dword [ebp - 0x400]
sub eax, dword [ebp - 0xaa4]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
mov dword [ebp - 0xc34], eax
xor ebx, ebx
push dword [ebp - 0xae4]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov edi, 0xd0aed4
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xcefff4
mov eax, dword [0xd0a150]
test eax, eax
jle 0xcf0057
sub eax, 1
mov dword [0xd0a150], eax
jne 0xcf0057
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xcf0029
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xcf0018
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xd0aed4
xor eax, eax
xchg dword [edi], eax
mov eax, dword [ebp - 0xaec]
test eax, eax
je 0xcf0076
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xcf1cfe
mov edi, dword [ebp - 0xc38]
xor eax, eax
mov ebx, dword [ebp - 0xc34]
push 0x54
push eax
lea eax, [ebp - 0x7d0]
mov dword [ebp - 0xd40], edi
push eax
mov dword [ebp - 0xd3c], ebx
call fcn.00bc259b
mov esi, dword [0xd08028]
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0xaa4], 1
push 7
push dword [ebp - 0xaac]
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcf0115
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x7d0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcf0115
push 0x20
pop eax
cmp word [ebp - 0x7be], ax
jne 0xcf0115
cmp dword [ebp - 0x7bc], 0
je 0xcf0115
cmp dword [ebp - 0x7cc], 0
jle 0xcf0115
cmp dword [ebp - 0x7c8], 0
jg 0xcf012a
xor eax, eax
cmp dword [ebp - 0xab8], 1
mov dword [ebp - 0xaa4], eax
jne 0xcf0282
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x754]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x744]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ebx, dword [ebp - 0xab8]
cmp ebx, 1
jne 0xcf0288
mov eax, dword [ebp - 0x774]
mov esi, dword [0xd08014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xb48], eax
jmp 0xcf0288
mov esi, dword [0xd080a4]
lea edi, [ebp - 0x3d0]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push 1
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08084]
lea ecx, [ebp - 0x3d0]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x3d0], 0x28
call dword [0xd0cffc]
call esi
test eax, eax
je 0xceffd4
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x3bc]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x3b4]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xab4], 0
lea esi, [ebp - 0x3bc]
lea edi, [ebp - 0xeac]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xcf0247
imul eax, dword [ebp - 0x3b4], 5
cdq
idiv ecx
add eax, dword [ebp - 0x3bc]
jmp 0xcf0255
mov eax, dword [ebp - 0x3b4]
sub eax, ebx
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0xc38], eax
mov eax, dword [ebp - 0x3b0]
sub eax, dword [ebp - 0xaa4]
imul eax, eax, 0x5f
jmp 0xceffcb
xor ebx, ebx
mov dword [ebp - 0xc38], ebx
mov dword [ebp - 0xc34], ebx
jmp 0xceffd6
mov ebx, dword [ebp - 0xab8]
mov esi, dword [0xd08040]
mov ecx, esi
push 1
push dword [ebp - 0xaac]
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0x778], 0
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xb08], 0x810
je 0xcf02c3
mov dword [ebp - 0xb08], 0x20812
cmp dword [ebp - 0xaa4], 0
je 0xcf0dd3
mov eax, dword [ebp - 0x774]
mov ebx, dword [ebp - 0x770]
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0xab4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x828]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa90]
push eax
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x4fc]
xor ecx, ecx
mov dword [ebp - 0xaf4], ecx
mov dword [ebp - 0xabc], ecx
push 0x2c
push ecx
push eax
mov dword [ebp - 0xaa8], ecx
mov dword [ebp - 0xaa4], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x380]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xcf1cde
mov edi, dword [ebp - 0xaac]
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcf037e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xcf1cde
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x828]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcf03c0
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0xaf4], eax
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0xaa4], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov edi, eax
mov dword [ebp - 0xadc], edi
test edi, edi
je 0xcf0373
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd44], eax
mov dword [ebp - 0xae8], eax
lea eax, [ebp - 0x4fc]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0x74c]
add esp, 0xc
sub eax, dword [ebp - 0x754]
xor ecx, ecx
mov esi, dword [0xd0800c]
mov dword [ebp - 0x4f8], eax
mov eax, dword [ebp - 0x750]
sub eax, dword [ebp - 0x748]
mov dword [ebp - 0x4f4], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x4fc], 0x28
mov word [ebp - 0x4f0], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x4ee], ax
lea eax, [ebp - 0xd44]
push eax
push ecx
lea eax, [ebp - 0x4fc]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xb14], eax
test eax, eax
jne 0xcf04a2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xae8], eax
test eax, eax
jle 0xcf048d
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xae8], eax
test eax, eax
js 0xcf0828
mov dword [ebp - 0xae8], 0x80004005
jmp 0xcf0828
mov esi, dword [0xd08034]
lea ecx, [ebp - 0xa90]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcf04cc
mov eax, dword [ebp - 0xa7c]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0x74c]
sub eax, dword [ebp - 0x754]
push dword [ebp - 0xb14]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x748]
sub eax, dword [ebp - 0x750]
push edi
mov dword [ebp - 0x374], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
mov ecx, esi
push 1
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0xab4]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xad0], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x380]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xb08]
lea eax, [ebp - 0x380]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xab8], 1
jne 0xcf05bf
cmp dword [ebp - 0xac8], 0
je 0xcf05b3
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xac0], eax
jmp 0xcf05c9
mov dword [ebp - 0xac0], 0xffffff
jmp 0xcf05c9
mov dword [ebp - 0xac0], 0xffa8a8a8
mov edi, dword [ebp - 0x754]
xor edx, edx
mov eax, dword [ebp - 0x750]
mov esi, edx
mov dword [ebp - 0xac4], edi
mov ecx, edx
test edi, edi
jns 0xcf05f1
mov esi, edi
mov dword [ebp - 0xac4], edx
neg esi
mov edi, edx
test eax, eax
jns 0xcf05fb
mov ecx, eax
mov eax, edx
neg ecx
mov ebx, dword [ebp - 0x378]
mov edx, dword [ebp - 0xaa8]
sub ebx, esi
sub edx, edi
mov dword [ebp - 0xad4], ebx
cmp ebx, edx
jl 0xcf061d
mov ebx, edx
mov dword [ebp - 0xad4], edx
mov edi, dword [ebp - 0x374]
mov edx, dword [ebp - 0xaa4]
sub edi, ecx
sub edx, eax
mov dword [ebp - 0xaec], edi
cmp edi, edx
jl 0xcf063f
mov edi, edx
mov dword [ebp - 0xaec], edx
test ebx, ebx
jle 0xcf07f0
test edi, edi
jle 0xcf07f0
mov edx, dword [ebp - 0x378]
mov ebx, dword [ebp - 0xaf4]
imul ecx, edx
add ecx, esi
mov esi, dword [ebp - 0xabc]
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xaa8]
imul eax, esi
mov dword [ebp - 0xb00], ecx
add eax, dword [ebp - 0xac4]
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xad4]
mov dword [ebp - 0xac4], eax
test edi, edi
jle 0xcf07f0
shl edx, 2
shl esi, 2
mov dword [ebp - 0xab4], edx
mov dword [ebp - 0xac8], esi
test ebx, ebx
jle 0xcf07d1
mov esi, eax
mov dword [ebp - 0xabc], ebx
lea edx, [eax + 3]
sub esi, ecx
mov dword [ebp - 0xacc], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xaa4], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xcf0791
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xac0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaa4]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xacc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xac0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xabe]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xaa4]
cdq
idiv ecx
mov edx, dword [ebp - 0xacc]
add al, bl
mov ebx, dword [ebp - 0xabc]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xabc], ebx
jne 0xcf06cb
mov edi, dword [ebp - 0xaec]
mov ebx, dword [ebp - 0xad4]
mov ecx, dword [ebp - 0xb00]
mov eax, dword [ebp - 0xac4]
mov edx, dword [ebp - 0xab4]
mov esi, dword [ebp - 0xac8]
add ecx, edx
add eax, esi
sub edi, 1
mov dword [ebp - 0xb00], ecx
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xaec], edi
jne 0xcf06a7
push dword [ebp - 0xb14]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xad0]
mov edi, dword [ebp - 0xadc]
test eax, eax
je 0xcf0828
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xae8], 0
jl 0xcf1cde
mov eax, dword [ebp - 0x774]
mov ebx, dword [ebp - 0x76c]
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0xab4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x880]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa38]
push eax
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x44c]
xor ecx, ecx
mov dword [ebp - 0xaf4], ecx
mov dword [ebp - 0xabc], ecx
push 0x2c
push ecx
push eax
mov dword [ebp - 0xaa8], ecx
mov dword [ebp - 0xaa4], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x390]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xcf1cde
mov edi, dword [ebp - 0xaac]
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcf0373
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x880]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcf092f
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0xaf4], eax
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0xaa4], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov edi, eax
mov dword [ebp - 0xad0], edi
test edi, edi
je 0xcf0373
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd98], eax
mov dword [ebp - 0xae8], eax
lea eax, [ebp - 0x44c]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0x73c]
add esp, 0xc
sub eax, dword [ebp - 0x744]
xor ecx, ecx
mov esi, dword [0xd0800c]
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x740]
sub eax, dword [ebp - 0x738]
mov dword [ebp - 0x444], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x44c], 0x28
mov word [ebp - 0x440], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x43e], ax
lea eax, [ebp - 0xd98]
push eax
push ecx
lea eax, [ebp - 0x44c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xadc], eax
test eax, eax
jne 0xcf0a15
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xae8], eax
test eax, eax
jle 0xcf0a00
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xae8], eax
test eax, eax
js 0xcf0daa
mov dword [ebp - 0xae8], 0x80004005
jmp 0xcf0daa
mov esi, dword [0xd08034]
lea ecx, [ebp - 0xa38]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcf0a3f
mov eax, dword [ebp - 0xa24]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0x73c]
sub eax, dword [ebp - 0x744]
push dword [ebp - 0xadc]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x738]
sub eax, dword [ebp - 0x740]
push edi
mov dword [ebp - 0x384], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
mov ecx, esi
push 1
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0xab4]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xb1c], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x390]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xb08]
lea eax, [ebp - 0x390]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xab8], 1
jne 0xcf0b3a
cmp dword [ebp - 0xac8], 0
je 0xcf0b2e
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov edx, eax
mov dword [ebp - 0xab0], edx
mov dword [ebp - 0xad4], edx
jmp 0xcf0b4b
mov dword [ebp - 0xad4], 0xffffff
jmp 0xcf0b4b
mov eax, 0xffa8a8a8
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xad4], eax
mov edi, dword [ebp - 0x744]
xor edx, edx
mov eax, dword [ebp - 0x740]
mov esi, edx
mov dword [ebp - 0xac4], edi
mov ecx, edx
test edi, edi
jns 0xcf0b73
mov esi, edi
mov dword [ebp - 0xac4], edx
neg esi
mov edi, edx
test eax, eax
jns 0xcf0b7d
mov ecx, eax
mov eax, edx
neg ecx
mov ebx, dword [ebp - 0x388]
mov edx, dword [ebp - 0xaa8]
sub ebx, esi
sub edx, edi
mov dword [ebp - 0xaec], ebx
cmp ebx, edx
jl 0xcf0b9f
mov ebx, edx
mov dword [ebp - 0xaec], edx
mov edi, dword [ebp - 0x384]
mov edx, dword [ebp - 0xaa4]
sub edi, ecx
sub edx, eax
mov dword [ebp - 0xb14], edi
cmp edi, edx
jl 0xcf0bc1
mov edi, edx
mov dword [ebp - 0xb14], edx
test ebx, ebx
jle 0xcf0d72
test edi, edi
jle 0xcf0d72
mov edx, dword [ebp - 0x388]
mov ebx, dword [ebp - 0xaf4]
imul ecx, edx
add ecx, esi
mov esi, dword [ebp - 0xabc]
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xaa8]
imul eax, esi
mov dword [ebp - 0xb00], ecx
add eax, dword [ebp - 0xac4]
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xaec]
mov dword [ebp - 0xac4], eax
test edi, edi
jle 0xcf0d72
shl edx, 2
shl esi, 2
mov dword [ebp - 0xab4], edx
mov dword [ebp - 0xac8], esi
test ebx, ebx
jle 0xcf0d53
mov esi, eax
mov dword [ebp - 0xabc], ebx
lea edx, [eax + 3]
sub esi, ecx
mov dword [ebp - 0xac0], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xaa4], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xcf0d13
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xab0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaa4]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xac0]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xab0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac0]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xad2]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac0]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xaa4]
cdq
idiv ecx
mov edx, dword [ebp - 0xac0]
add al, bl
mov ebx, dword [ebp - 0xabc]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xac0], edx
mov dword [ebp - 0xabc], ebx
jne 0xcf0c4d
mov edi, dword [ebp - 0xb14]
mov ebx, dword [ebp - 0xaec]
mov ecx, dword [ebp - 0xb00]
mov eax, dword [ebp - 0xac4]
mov edx, dword [ebp - 0xab4]
mov esi, dword [ebp - 0xac8]
add ecx, edx
add eax, esi
sub edi, 1
mov dword [ebp - 0xb00], ecx
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xb14], edi
jne 0xcf0c29
push dword [ebp - 0xadc]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xb1c]
mov edi, dword [ebp - 0xad0]
test eax, eax
je 0xcf0daa
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xae8], 0
jl 0xcf1cde
mov edi, dword [ebp - 0xae0]
jmp 0xcf1c8a
cmp dword [ebp - 0x774], 0
jne 0xcf0de5
cmp ebx, 1
je 0xcf0de5
mov al, 0xc0
jmp 0xcf0de7
or al, 0xff
mov byte [ebp - 0xace], al
lea edi, [ebp - 0xcc8]
xor eax, eax
mov esi, dword [0xd08008]
stosd dword es:[edi], eax
xor ecx, ecx
push dword [ebp - 0xaac]
mov byte [ebp - 0xad0], cl
mov byte [ebp - 0xacf], cl
mov ecx, esi
stosd dword es:[edi], eax
mov byte [ebp - 0xacd], 1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xcd8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xae0], eax
test eax, eax
jne 0xcf0e45
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xcf1cde
cmp ebx, 1
jne 0xcf0f40
mov eax, dword [ebp - 0x74c]
mov ecx, dword [ebp - 0x73c]
mov ebx, dword [ebp - 0x754]
sub eax, ebx
mov edi, dword [ebp - 0x744]
sub ecx, edi
cmp ecx, eax
jle 0xcf0e78
mov edx, ecx
mov dword [ebp - 0xb0c], edx
jmp 0xcf0e80
mov edx, eax
mov dword [ebp - 0xb0c], eax
mov esi, dword [ebp - 0x738]
sub esi, dword [ebp - 0x750]
cmp dword [ebp - 0x778], 0
mov dword [ebp - 0xb24], esi
je 0xcf0eb9
sub ebx, dword [ebp - 0x74c]
sub edi, dword [ebp - 0x73c]
add ebx, edx
add edi, edx
mov dword [ebp - 0xcc8], ebx
mov dword [ebp - 0xcd8], edi
jmp 0xcf0ec5
mov ebx, dword [ebp - 0xcc8]
mov edi, dword [ebp - 0xcd8]
add eax, ebx
mov dword [ebp - 0xaa8], ebx
mov ebx, dword [ebp - 0x740]
sub ebx, dword [ebp - 0x750]
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xcc0], eax
mov eax, dword [ebp - 0x748]
sub eax, dword [ebp - 0x750]
mov dword [ebp - 0xb14], ebx
mov dword [ebp - 0xcd4], ebx
sub ebx, dword [ebp - 0x740]
mov dword [ebp - 0xa98], edi
add edi, ecx
add ebx, dword [ebp - 0x738]
mov dword [ebp - 0xaec], ebx
mov dword [ebp - 0xccc], ebx
mov ebx, dword [ebp - 0xb0c]
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xcbc], eax
mov dword [ebp - 0xaa0], edi
mov dword [ebp - 0xcd0], edi
jmp 0xcf0fd2
mov eax, dword [ebp - 0xc2c]
lea esi, [ebp - 0x754]
lea edi, [ebp - 0xcc8]
mov ebx, dword [ebp - 0xc30]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb24], eax
mov dword [ebp - 0xb0c], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xcbc]
lea esi, [ebp - 0x744]
lea edi, [ebp - 0xcd8]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0xcc0]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0xcc8]
mov dword [ebp - 0xaa8], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xccc]
mov esi, dword [ebp - 0xb24]
mov dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0xcd0]
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0xcd4]
mov dword [ebp - 0xb14], eax
mov eax, dword [ebp - 0xcd8]
mov dword [ebp - 0xa98], eax
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xcf4], eax
lea eax, [ebp - 0x4d0]
push eax
call fcn.00bc259b
mov edi, dword [ebp - 0xae0]
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x4d0], 0x28
inc eax
mov dword [ebp - 0x4cc], ebx
mov word [ebp - 0x4c4], ax
xor ecx, ecx
push 0x20
pop eax
push ecx
push ecx
mov word [ebp - 0x4c2], ax
neg esi
lea eax, [ebp - 0xcf4]
mov dword [ebp - 0x4c8], esi
mov esi, dword [0xd0800c]
push eax
push ecx
lea eax, [ebp - 0x4d0]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xad8], eax
test eax, eax
jne 0xcf1057
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xcf1cc9
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xab8], 1
jne 0xcf10c6
mov ecx, dword [ebp - 0xb48]
test ecx, ecx
je 0xcf10c6
mov esi, dword [0xd08074]
lea edi, [ebp - 0x39c]
xor eax, eax
stosd dword es:[edi], eax
push ecx
mov ecx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0x394], eax
lea eax, [ebp - 0x3a0]
push eax
mov eax, dword [ebp - 0xae0]
push eax
mov dword [ebp - 0x398], ebx
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x774]
mov ebx, dword [ebp - 0x770]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0xab4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x8d8]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x988]
push eax
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x4a4]
xor ecx, ecx
mov dword [ebp - 0xaf4], ecx
mov dword [ebp - 0xac4], ecx
push 0x2c
push ecx
push eax
mov dword [ebp - 0xb1c], ecx
mov dword [ebp - 0xaa4], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x360]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xae0]
test ebx, ebx
je 0xcf1cae
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcf1174
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xcf1cae
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x8d8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcf11b6
mov eax, dword [ebp - 0x8c4]
mov dword [ebp - 0xaf4], eax
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0xb1c], eax
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0xaa4], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, eax
mov dword [ebp - 0xae4], esi
test esi, esi
je 0xcf1169
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xcf8], eax
mov dword [ebp - 0xa9c], eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0xae8]
add esp, 0xc
mov edi, dword [ebp - 0xaa8]
xor ecx, ecx
sub eax, edi
mov dword [ebp - 0x4a4], 0x28
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0xcc4]
sub eax, dword [ebp - 0xad4]
mov dword [ebp - 0x49c], eax
xor eax, eax
push 0x20
inc eax
mov word [ebp - 0x498], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x496], ax
lea eax, [ebp - 0xcf8]
push eax
push ecx
lea eax, [ebp - 0x4a4]
push eax
push esi
mov esi, dword [0xd0800c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xac8], eax
test eax, eax
jne 0xcf12a0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xa9c], eax
test eax, eax
jle 0xcf128b
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xa9c], eax
test eax, eax
js 0xcf1642
mov dword [ebp - 0xa9c], 0x80004005
jmp 0xcf1642
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x988]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcf12ca
mov eax, dword [ebp - 0x974]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0xae8]
push dword [ebp - 0xac8]
mov esi, dword [0xd0803c]
mov ecx, esi
push dword [ebp - 0xae4]
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0xad4]
sub eax, dword [ebp - 0xcc4]
mov dword [ebp - 0x354], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
mov ecx, esi
push 1
push dword [ebp - 0xae4]
call dword [0xd0cffc]
call esi
push dword [ebp - 0xab4]
mov esi, dword [0xd0803c]
mov ecx, esi
push dword [ebp - 0xae4]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x360]
push eax
push dword [ebp - 0xae4]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xb08]
lea eax, [ebp - 0x360]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push dword [ebp - 0xae4]
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xab8], 1
jne 0xcf13d0
cmp dword [ebp - 0xabc], 0
je 0xcf13c4
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xac0], eax
jmp 0xcf13da
mov dword [ebp - 0xac0], 0xffffff
jmp 0xcf13da
mov dword [ebp - 0xac0], 0xffa8a8a8
xor edx, edx
mov dword [ebp - 0xabc], edx
mov eax, edx
mov esi, edx
test edi, edi
jns 0xcf13f6
mov eax, edi
mov edi, edx
neg eax
mov dword [ebp - 0xabc], eax
mov ecx, dword [ebp - 0xcc4]
test ecx, ecx
jns 0xcf1406
mov esi, ecx
mov ecx, edx
neg esi
mov ebx, dword [ebp - 0x358]
sub ebx, eax
mov eax, dword [ebp - 0xb1c]
sub eax, edi
mov dword [ebp - 0xb00], ebx
cmp ebx, eax
jl 0xcf1428
mov ebx, eax
mov dword [ebp - 0xb00], eax
mov eax, dword [ebp - 0xaa4]
mov edx, dword [ebp - 0x354]
sub eax, ecx
sub edx, esi
mov dword [ebp - 0xaa8], edx
cmp edx, eax
jl 0xcf144a
mov edx, eax
mov dword [ebp - 0xaa8], eax
test ebx, ebx
jle 0xcf160b
test edx, edx
jle 0xcf160b
mov eax, dword [ebp - 0x358]
imul ecx, dword [ebp - 0xb1c]
imul eax, esi
mov esi, dword [ebp - 0xac4]
add ecx, edi
add eax, dword [ebp - 0xabc]
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xaf4]
mov dword [ebp - 0xad4], eax
lea ecx, [esi + ecx*4]
mov dword [ebp - 0xadc], ecx
test edx, edx
jle 0xcf160b
mov esi, dword [ebp - 0x358]
shl esi, 2
mov dword [ebp - 0xac4], esi
mov esi, dword [ebp - 0xb1c]
shl esi, 2
mov dword [ebp - 0xaf4], esi
mov esi, dword [ebp - 0xac4]
mov edi, dword [ebp - 0xaf4]
test ebx, ebx
jle 0xcf15ec
mov esi, ecx
mov dword [ebp - 0xabc], ebx
lea edx, [ecx + 3]
sub esi, eax
mov dword [ebp - 0xacc], edx
lea edi, [eax + 2]
mov dword [ebp - 0xaa4], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xcf15ac
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xac0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaa4]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xacc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xac0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xabe]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xaa4]
cdq
idiv ecx
mov edx, dword [ebp - 0xacc]
add al, bl
mov ebx, dword [ebp - 0xabc]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xabc], ebx
jne 0xcf14e6
mov edx, dword [ebp - 0xaa8]
mov ebx, dword [ebp - 0xb00]
mov eax, dword [ebp - 0xad4]
mov ecx, dword [ebp - 0xadc]
mov esi, dword [ebp - 0xac4]
mov edi, dword [ebp - 0xaf4]
add eax, esi
add ecx, edi
sub edx, 1
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xadc], ecx
mov dword [ebp - 0xaa8], edx
jne 0xcf14c2
push dword [ebp - 0xac8]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xab4]
test eax, eax
je 0xcf1642
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push dword [ebp - 0xae4]
call dword [0xd0cffc]
call esi
push dword [ebp - 0xae4]
mov esi, dword [0xd08018]
mov ecx, esi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xa9c], 0
jl 0xcf1ca8
mov eax, dword [ebp - 0x774]
mov ebx, dword [ebp - 0x76c]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0xab4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x930]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x9e0]
push eax
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x478]
xor ecx, ecx
mov dword [ebp - 0xac4], ecx
mov dword [ebp - 0xabc], ecx
push 0x2c
push ecx
push eax
mov dword [ebp - 0xae8], ecx
mov dword [ebp - 0xac8], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x370]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xae0]
test ebx, ebx
je 0xcf1cae
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcf1169
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x930]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcf174e
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0xac8], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, eax
mov dword [ebp - 0xacc], esi
test esi, esi
je 0xcf1169
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xcfc], eax
mov dword [ebp - 0xb1c], eax
lea eax, [ebp - 0x478]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0xaa0]
add esp, 0xc
sub eax, dword [ebp - 0xa98]
xor ecx, ecx
mov edi, dword [ebp - 0xb14]
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0x474], eax
mov eax, edi
sub eax, dword [ebp - 0xaec]
mov dword [ebp - 0x470], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x478], 0x28
mov word [ebp - 0x46c], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x46a], ax
lea eax, [ebp - 0xcfc]
push eax
push ecx
lea eax, [ebp - 0x478]
push eax
push esi
mov esi, dword [0xd0800c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xadc], eax
test eax, eax
jne 0xcf1842
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xb1c], eax
test eax, eax
jle 0xcf1827
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb1c], eax
test eax, eax
mov edi, dword [ebp - 0xacc]
js 0xcf1be5
mov dword [ebp - 0xb1c], 0x80004005
jmp 0xcf1be5
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x9e0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcf186c
mov eax, dword [ebp - 0x9cc]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0xaa0]
push dword [ebp - 0xadc]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0xaec]
sub eax, edi
mov edi, dword [ebp - 0xacc]
push edi
mov dword [ebp - 0x364], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
mov ecx, esi
push 1
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0xab4]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x370]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xb08]
lea eax, [ebp - 0x370]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xab8], 1
jne 0xcf1963
cmp dword [ebp - 0xaa4], 0
je 0xcf1957
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov ecx, eax
mov dword [ebp - 0xab0], ecx
mov dword [ebp - 0xaa8], ecx
jmp 0xcf1974
mov dword [ebp - 0xaa8], 0xffffff
jmp 0xcf1974
mov eax, 0xffa8a8a8
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xaa8], eax
mov edx, dword [ebp - 0xa98]
xor ebx, ebx
mov dword [ebp - 0xaa4], ebx
mov esi, ebx
mov eax, ebx
test edx, edx
jns 0xcf1996
mov esi, edx
mov edx, ebx
neg esi
mov dword [ebp - 0xaa4], esi
mov ecx, dword [ebp - 0xb14]
test ecx, ecx
jns 0xcf19a6
mov eax, ecx
mov ecx, ebx
neg eax
mov ebx, dword [ebp - 0x368]
sub ebx, esi
mov esi, dword [ebp - 0xae8]
sub esi, edx
mov dword [ebp - 0xad4], ebx
cmp ebx, esi
jl 0xcf19c8
mov ebx, esi
mov dword [ebp - 0xad4], esi
mov edi, dword [ebp - 0x364]
mov esi, dword [ebp - 0xac8]
sub edi, eax
sub esi, ecx
mov dword [ebp - 0xaec], edi
cmp edi, esi
jl 0xcf19ea
mov edi, esi
mov dword [ebp - 0xaec], esi
test ebx, ebx
jle 0xcf1bad
test edi, edi
jle 0xcf1bad
imul ecx, dword [ebp - 0xae8]
mov esi, dword [ebp - 0x368]
mov ebx, dword [ebp - 0xabc]
imul eax, esi
add ecx, edx
mov edx, dword [ebp - 0xac4]
add eax, dword [ebp - 0xaa4]
lea ecx, [edx + ecx*4]
mov dword [ebp - 0xb00], ecx
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xad4]
mov dword [ebp - 0xaf4], eax
test edi, edi
jle 0xcf1bad
mov edx, esi
shl edx, 2
mov dword [ebp - 0xabc], edx
mov edx, dword [ebp - 0xae8]
shl edx, 2
mov dword [ebp - 0xac4], edx
mov edx, dword [ebp - 0xabc]
mov esi, dword [ebp - 0xac4]
test ebx, ebx
jle 0xcf1b8e
mov esi, ecx
mov dword [ebp - 0xaa4], ebx
lea edx, [ecx + 3]
sub esi, eax
mov dword [ebp - 0xac0], edx
lea edi, [eax + 2]
mov dword [ebp - 0xac8], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xcf1b4e
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xab0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac8]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xac0]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xab0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac0]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xaa6]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac0]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xac8]
cdq
idiv ecx
mov edx, dword [ebp - 0xac0]
add al, bl
mov ebx, dword [ebp - 0xaa4]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xac0], edx
mov dword [ebp - 0xaa4], ebx
jne 0xcf1a88
mov edi, dword [ebp - 0xaec]
mov ebx, dword [ebp - 0xad4]
mov eax, dword [ebp - 0xaf4]
mov ecx, dword [ebp - 0xb00]
mov edx, dword [ebp - 0xabc]
mov esi, dword [ebp - 0xac4]
add eax, edx
add ecx, esi
sub edi, 1
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0xb00], ecx
mov dword [ebp - 0xaec], edi
jne 0xcf1a64
push dword [ebp - 0xadc]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xab4]
mov edi, dword [ebp - 0xacc]
test eax, eax
je 0xcf1be5
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xb1c], 0
mov edi, dword [ebp - 0xae0]
jl 0xcf1cae
cmp dword [ebp - 0xab8], 1
jne 0xcf1c4d
mov esi, dword [section..data]
xor eax, eax
push 0xcc0020
push eax
push eax
mov eax, dword [ebp - 0xb0c]
mov ecx, esi
push edi
push dword [ebp - 0xb24]
push eax
push dword [ebp - 0x750]
push dword [ebp - 0x754]
push dword [ebp - 0xaac]
call dword [0xd0cffc]
call esi
jmp 0xcf1c8a
push dword [ebp - 0xad0]
mov ecx, dword [ebp - 0xb24]
xor edx, edx
mov eax, dword [ebp - 0xb0c]
mov esi, dword [0xd08020]
push ecx
push eax
push edx
push edx
push edi
push ecx
push eax
push dword [ebp - 0xc34]
mov ecx, esi
push dword [ebp - 0xc38]
push dword [ebp - 0xaac]
call dword [0xd0cffc]
call esi
push dword [ebp - 0xbc8]
mov esi, dword [0xd08040]
mov ecx, esi
push dword [ebp - 0xaac]
call dword [0xd0cffc]
call esi
jmp 0xcf1cae
mov edi, dword [ebp - 0xae0]
mov eax, dword [ebp - 0xad8]
test eax, eax
je 0xcf1cc9
mov esi, dword [0xd0801c]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
test edi, edi
je 0xcf1cde
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xb48]
test eax, eax
je 0xcf1cf9
mov esi, dword [0xd0801c]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov edi, 0xd0aed4
mov ebx, dword [ebp - 0x770]
xor edx, edx
test ebx, ebx
je 0xcf1d51
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0xcf1d0d
mov eax, dword [ebp - 0x770]
sub ebx, ecx
sar ebx, 1
lea ebx, [ebx*2 + 2]
test ebx, ebx
je 0xcf1d35
mov byte [eax], dl
inc eax
sub ebx, 1
jne 0xcf1d2d
push dword [ebp - 0x770]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0x770], edx
mov ebx, dword [ebp - 0x76c]
test ebx, ebx
je 0xcf1da4
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0xcf1d5e
mov eax, dword [ebp - 0x76c]
sub ebx, ecx
sar ebx, 1
lea ebx, [ebx*2 + 2]
test ebx, ebx
je 0xcf1d86
mov byte [eax], dl
inc eax
sub ebx, 1
jne 0xcf1d7e
push dword [ebp - 0x76c]
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x76c], ebx
jmp 0xcf1da6
xor ebx, ebx
mov edx, dword [ebp - 0x768]
test edx, edx
je 0xcf1df2
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xcf1db5
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xcf1ddd
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xcf1dcf
mov edx, dword [ebp - 0x768]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x768], ebx
cmp dword [ebp - 0x764], 0
je 0xcf1e17
push dword [ebp - 0x764]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x764], ebx
cmp dword [ebp - 0x760], 0
je 0xcf1e3c
push dword [ebp - 0x760]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x760], ebx
cmp dword [ebp - 0x75c], 0
je 0xcf1e61
push dword [ebp - 0x75c]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x75c], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xcf1e63
mov eax, dword [0xd0a150]
test eax, eax
jle 0xcf1ec6
sub eax, 1
mov dword [0xd0a150], eax
jne 0xcf1ec6
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xcf1e98
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xcf1e87
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xd0aed4
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0xd09360]
mov esi, dword [0xd0804c]
mov ecx, esi
mov dword [ebp - 0xabc], eax
call dword [0xd0cffc]
call esi
sub eax, dword [0xd09358]
lea edi, [ebp - 0x2e8]
push 8
mov dword [ebp - 0xaa4], eax
mov esi, 0xd0aed4
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xcf1f03
mov eax, dword [0xd0a150]
test eax, eax
jne 0xcf24fe
xor ebx, ebx
push 0x338
mov esi, ebx
mov dword [ebp - 0xaa8], ebx
push ebx
mov dword [ebp - 0xa9c], ebx
mov dword [ebp - 0xab0], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xbf8], eax
test eax, eax
je 0xcf24f2
or dword [ebp - 0xac8], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0xad8], ebx
mov dword [ebp - 0xb74], esi
mov dword [ebp - 0xb7c], ebx
mov dword [ebp - 0xbdc], eax
mov edi, dword [ebp - 0xb70]
movzx edx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl edx, 8
or edx, eax
movzx eax, byte [edi]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl edx, 8
or edx, eax
shl edi, 8
mov eax, dword [ebp - 0xb70]
xor ebx, edx
mov dword [ebp - 0xab4], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb70]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb70]
shl edi, 8
add dword [ebp - 0xb70], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor ebx, edx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xbc8], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea esi, [ebx - 0x7f1]
xor esi, dword [ebp - 0xbc8]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, esi
shr eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor ebx, edx
mov eax, ebx
mov dword [ebp - 0xbc8], ebx
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add edx, eax
xor esi, edx
mov ebx, esi
xor ebx, dword [ebp - 0xbc8]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xac8]
rol eax, 2
mov dword [ebp - 0xb74], esi
mov dword [ebp - 0xac8], edi
xor edx, eax
xor edx, dword [ebp - 0xad8]
xor ebx, edx
mov edx, dword [ebp - 0xbdc]
mov dword [ebp - 0xb7c], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb74]
ror dword [ebp - 0xb7c], 8
mov byte [edx], al
mov al, byte [ebp - 0xb7c]
ror dword [ebp - 0xb74], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb74]
ror dword [ebp - 0xb7c], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb7c]
ror dword [ebp - 0xb74], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb74]
ror dword [ebp - 0xb7c], 8
mov byte [edx - 2], al
ror dword [ebp - 0xb74], 8
mov al, byte [ebp - 0xb7c]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb74]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [ebp - 0xb7c]
mov esi, dword [ebp - 0xb74]
mov eax, dword [ebp - 0xab4]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xc20], 1
mov dword [ebp - 0xb7c], ebx
mov dword [ebp - 0xb74], esi
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xbdc], edx
jne 0xcf1f78
mov esi, dword [ebp - 0xbf8]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xcf22c9
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xcf22f8
cmp edx, dword [0xb2c22c]
jne 0xcf22f8
mov edi, esi
xor eax, eax
mov dword [ebp - 0xab0], edi
mov esi, eax
mov ebx, eax
jmp 0xcf230c
or dword [ebp - 0xbd4], 0xffffffff
mov ebx, 0xc004d501
mov edi, dword [ebp - 0xab0]
xor eax, eax
test esi, esi
je 0xcf231f
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xcf24ec
mov eax, dword [ebp - 0xbd4]
xor ecx, ecx
push 0x40
push ecx
mov ebx, 0xd0ae80
mov esi, edi
push ebx
mov byte [eax + edi], cl
call fcn.00bc259b
add esp, 0xc
cmp byte [edi], 0
je 0xcf2482
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbfc]
jne 0xcf2357
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xcf24e5
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa9c], edx
cmp word [eax], cx
je 0xcf23a4
mov edx, 0xc000007b
mov dword [ebp - 0xa9c], edx
jmp 0xcf23ec
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xcf2397
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xcf2397
cmp dword [ecx], 0x4550
jne 0xcf2397
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xbbc]
je 0xcf23da
cmp ax, word [ebp - 0xbc0]
je 0xcf23da
mov edx, 0xc000000d
jmp 0xcf239c
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xbf8], eax
test eax, eax
je 0xcf2476
mov ecx, esi
mov dword [ebp - 0xab4], esi
xor eax, eax
mov dword [ebp - 0xaf0], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xbc8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xcf2416
sub ecx, dword [ebp - 0xbc8]
inc esi
add esi, ecx
test edx, edx
js 0xcf2460
mov ecx, dword [ebp - 0xab4]
lea eax, [ebp - 0xaf0]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa9c], edx
test edx, edx
js 0xcf2482
mov eax, dword [ebp - 0xaa8]
mov ecx, dword [ebp - 0xaf0]
mov dword [eax*4 + section..data], ecx
jmp 0xcf2466
mov eax, dword [ebp - 0xaa8]
inc eax
inc ebx
mov dword [ebp - 0xaa8], eax
cmp ebx, dword [ebp - 0xbf8]
jb 0xcf23fd
add edi, 0x10
cmp byte [esi], 0
jne 0xcf2350
mov ebx, dword [ebp - 0xa9c]
mov esi, dword [ebp - 0xab0]
test esi, esi
je 0xcf24a3
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xcf24f9
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xcf24bc
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xcf24ab
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xcf2504
mov ebx, 0xc000007a
jmp 0xcf2488
mov esi, dword [ebp - 0xab0]
mov ebx, 0xc000007a
jmp 0xcf248e
mov eax, dword [0xd0a150]
inc eax
mov dword [0xd0a150], eax
xor eax, eax
mov edi, 0xd0aed4
xchg dword [edi], eax
mov eax, dword [ebp - 0xaa4]
xor ebx, ebx
mov esi, dword [0xd08068]
inc ebx
mov dword [ebp - 0x2e4], eax
mov ecx, esi
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0x2cc], eax
lea eax, [ebp - 0x2e8]
push eax
push 4
pop eax
push eax
push 0x2021
xor eax, eax
mov dword [ebp - 0x2e8], ebx
push eax
mov dword [ebp - 0x2dc], 0x9966f291
mov dword [ebp - 0x2e0], ebx
mov dword [ebp - 0x2d4], ebx
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2d0], ebx
call dword [0xd0cffc]
call esi
mov ecx, ebx
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xcf2573
mov eax, dword [0xd0a150]
test eax, eax
jle 0xcf25d5
sub eax, 1
mov dword [0xd0a150], eax
jne 0xcf25d5
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xcf25a7
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xcf2596
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xd0aed4
jmp 0xcf25d7
xor ebx, ebx
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xaac]
mov esi, dword [0xd080b0]
mov ecx, esi
push ebx
call dword [0xd0cffc]
call esi
jmp 0xcf25f6
xor ebx, ebx
mov eax, ebx
mov dword [ebp - 0xaac], ebx
mov dword [ebp - 0xbdc], eax
lea edi, [ebp - 0xcf0]
xor eax, eax
mov dword [ebp - 0xeb4], ebx
stosd dword es:[edi], eax
mov esi, ebx
mov dword [ebp - 0xaa0], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xbc8], ebx
test ebx, ebx
je 0xcf46c6
push edi
push 0xd08d58
push ebx
call fcn.00bc13d0
add esp, 0xc
mov dword [ebp - 0xaac], ebx
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xcf46d4
mov ecx, dword [0xd08d50]
mov dword [esi], ecx
mov ecx, dword [0xd08d54]
mov dword [esi + 4], ecx
mov dword [ebp - 0xaa0], esi
rdtsc
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xbf8], edx
xor eax, eax
mov dword [ebp - 0xb6c], eax
lea eax, [ebp - 0xd04]
push eax
push 4
pop edi
mov edx, edi
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xcf46d4
mov edx, dword [ebp - 0xd04]
lea eax, [ebp - 0xb6c]
push eax
xor ecx, ecx
call fcn.00b84e9a
or eax, 0x10000000
jl 0xcf46d4
lea eax, [ebp - 0xd08]
mov edx, 0xa0
push eax
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xcf46d4
mov edx, dword [ebp - 0xd08]
lea eax, [ebp - 0xb6c]
mov ecx, dword [ebp - 0xb6c]
push eax
call fcn.00b84e9a
or eax, 0x10000000
jl 0xcf46d4
lea eax, [ebp - 0xd0c]
mov ecx, edi
push eax
push 8
pop edx
call fcn.00b84e9a
test eax, eax
js 0xcf46d4
mov edx, dword [ebp - 0xd0c]
lea eax, [ebp - 0xb6c]
mov ecx, dword [ebp - 0xb6c]
push eax
call fcn.00b84e9a
or eax, 0x10000000
jl 0xcf46d4
lea eax, [ebp - 0xc68]
mov ecx, edi
push eax
push 8
pop edx
call fcn.00b84e9a
test eax, eax
js 0xcf46d4
mov edx, dword [ebp - 0xc68]
lea eax, [ebp - 0xb6c]
mov ecx, dword [ebp - 0xb6c]
push eax
call fcn.00b84e9a
or eax, 0x10000000
jl 0xcf46d4
mov edi, dword [ebp - 0xb6c]
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xad8], ebx
test ebx, ebx
je 0xcf46ce
mov dword [ebp - 0xbdc], eax
lea eax, [ebp - 0xe6c]
mov ecx, ebx
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xcf46ce
lea ecx, [ebx + edi]
lea eax, [ebx + 8]
cmp eax, ecx
ja 0xcf46ce
mov eax, dword [ebp - 0xe6c]
push 4
pop ecx
mov dword [ebx], ecx
mov dword [eax], ecx
mov edi, ebx
xor eax, eax
mov dword [ebp - 0xbf0], edi
mov dword [ebp - 0xaf0], eax
mov edx, dword [edi]
lea eax, [ebp - 0xc58]
push eax
call fcn.00b84e9a
test eax, eax
js 0xcf46ce
mov edx, dword [ebp - 0xc58]
lea eax, [ebp - 0xbf0]
push eax
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xcf46ce
mov eax, dword [ebp - 0xaf0]
inc eax
mov dword [ebp - 0xaf0], eax
cmp eax, 1
jae 0xcf2850
mov edi, dword [ebp - 0xbf0]
push 4
pop ecx
jmp 0xcf2801
mov ecx, dword [ebp - 0xbf0]
lea eax, [ebp - 0xe74]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xcf46ce
mov edx, dword [ebp - 0xb6c]
lea eax, [ecx + 0xa4]
add edx, ebx
cmp eax, edx
ja 0xcf46ce
mov eax, 0xa0
push eax
push dword [ebp - 0xbc8]
mov dword [ecx], eax
push dword [ebp - 0xe74]
call fcn.00bc13d0
add esp, 0xc
mov edi, ebx
xor eax, eax
mov dword [ebp - 0xb18], edi
mov dword [ebp - 0xaf0], eax
mov edx, dword [edi]
lea eax, [ebp - 0xc54]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
test eax, eax
js 0xcf46ce
mov edx, dword [ebp - 0xc54]
lea eax, [ebp - 0xb18]
push eax
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xcf46ce
mov eax, dword [ebp - 0xaf0]
inc eax
mov dword [ebp - 0xaf0], eax
cmp eax, 2
jae 0xcf2902
mov edi, dword [ebp - 0xb18]
jmp 0xcf28b1
mov ecx, dword [ebp - 0xb18]
lea eax, [ebp - 0xe7c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xcf46ce
mov edi, dword [ebp - 0xb6c]
lea eax, [ecx + 0xc]
add edi, ebx
cmp eax, edi
ja 0xcf46ce
mov dword [ecx], 8
mov ecx, dword [ebp - 0xe7c]
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
xor eax, eax
mov dword [ebp - 0xb04], ebx
mov esi, eax
mov edx, dword [ebx]
lea eax, [ebp - 0xc50]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
test eax, eax
js 0xcf46ce
mov edx, dword [ebp - 0xc50]
lea eax, [ebp - 0xb04]
push eax
mov ecx, ebx
call fcn.00b84e9a
test eax, eax
js 0xcf46ce
inc esi
cmp esi, 3
jae 0xcf2999
mov ebx, dword [ebp - 0xb04]
jmp 0xcf2954
mov ecx, dword [ebp - 0xb04]
lea eax, [ebp - 0xe84]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xcf46ce
lea eax, [ecx + 0xc]
cmp eax, edi
ja 0xcf46ce
mov eax, dword [ebp - 0xe84]
push 8
pop ebx
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xab4]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xbf8]
mov dword [eax + 4], ecx
lea eax, [ebp - 0xbf4]
push eax
push 4
pop edi
mov edx, edi
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xcf46ce
mov esi, dword [ebp - 0xbf4]
lea eax, [ebp - 0xb64]
push eax
mov edx, ebx
mov dword [ebp - 0xb9c], esi
call fcn.00b84e9a
test eax, eax
js 0xcf46ce
mov edx, dword [ebp - 0xb64]
lea eax, [ebp - 0xb9c]
push eax
mov ecx, esi
call fcn.00b84e9a
test eax, eax
js 0xcf46ce
xor ecx, ecx
rdtsc
mov edi, ecx
mov dword [ebp - 0xad4], ecx
mov ebx, ecx
mov dword [ebp - 0xacc], edi
mov dword [ebp - 0xb78], ebx
mov dword [ebp - 0xa9c], ecx
mov dword [ebp - 0xac8], ecx
mov dword [ebp - 0xbbc], ecx
mov dword [ebp - 0xaf8], ecx
mov dword [ebp - 0xbec], ecx
mov dword [ebp - 0xad0], ecx
mov dword [ebp - 0xaa8], ecx
mov dword [ebp - 0xb64], eax
mov dword [ebp - 0xbf4], edx
push 8
pop ecx
mov dword [ebp - 0xc9c], ecx
mov edx, dword [ebp - 0xb6c]
lea eax, [ebp - 0xc9c]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf2b9c
mov eax, dword [ebp - 0xc9c]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0xaf0], ecx
cmp ecx, eax
jae 0xcf2acd
mov esi, 0xc0000095
jmp 0xcf2b9c
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xcf2aef
mov esi, 0xc0000017
mov edi, ebx
jmp 0xcf2b9c
push 4
pop ecx
lea eax, [ebp - 0xbc4]
mov dword [edi], ecx
mov edx, ecx
mov dword [ebp - 0xbc4], edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf2b81
mov ecx, dword [ebp - 0xbc4]
mov eax, dword [ebp - 0xb6c]
mov dword [ecx], eax
lea eax, [ebp - 0xbc4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf2b81
mov eax, dword [ebp - 0xaf0]
push dword [ebp - 0xb6c]
mov ecx, dword [ebp - 0xb64]
push dword [ebp - 0xad8]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xbf4]
push dword [ebp - 0xbc4]
mov dword [edi + eax - 4], ecx
call fcn.00bc13d0
mov eax, dword [ebp - 0xaf0]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xad4], edi
mov edi, ecx
mov dword [ebp - 0xacc], eax
jmp 0xcf2b83
xor ecx, ecx
test edi, edi
je 0xcf2b96
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xacc]
or esi, 0x10000000
jl 0xcf44d9
mov esi, dword [ebp - 0xad4]
xor ecx, ecx
mov dword [ebp - 0xbf0], ecx
test esi, esi
jne 0xcf2bc4
mov esi, 0xc000000d
jmp 0xcf3312
test edi, edi
je 0xcf330d
lea eax, [edi + 8]
push eax
push ecx
mov dword [ebp - 0xbd4], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xc20], eax
test eax, eax
je 0xcf330d
xor ecx, ecx
mov dl, cl
test edi, edi
je 0xcf2c02
xor dl, byte [ecx + esi]
inc ecx
cmp ecx, edi
jb 0xcf2bfa
mov dword [ebp - 0xb04], esi
or ecx, 0xffffffff
mov esi, eax
mov dword [ebp - 0xb40], ecx
xor eax, eax
mov dword [ebp - 0xb94], esi
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb54], eax
xor eax, eax
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xb70], eax
je 0xcf2d38
xor esi, esi
mov dword [ebp - 0xb70], eax
mov ecx, eax
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xac0], ecx
jbe 0xcf2cb8
mov ebx, dword [ebp - 0xb04]
mov edi, eax
push 0x38
pop esi
push 4
pop ecx
cmp eax, ecx
movzx eax, byte [ebx]
jge 0xcf2c77
lea ecx, [esi - 0x20]
shl eax, cl
mov ecx, dword [ebp - 0xac0]
or edi, eax
jmp 0xcf2c89
mov ecx, esi
shl eax, cl
mov ecx, dword [ebp - 0xac0]
or ecx, eax
mov dword [ebp - 0xac0], ecx
mov eax, dword [ebp - 0xaf0]
sub esi, 8
inc eax
inc ebx
mov dword [ebp - 0xaf0], eax
test eax, eax
js 0xcf2c5e
mov dword [ebp - 0xb70], edi
xor esi, esi
mov edi, dword [ebp - 0xacc]
mov dword [ebp - 0xb04], ebx
mov ebx, dword [ebp - 0xb78]
mov eax, dword [ebp - 0xb70]
xor ecx, 0x42f6b18d
xor eax, 0xb17a307a
cmp dword [ebp - 0xbfc], 0
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb54], eax
jbe 0xcf2d13
mov ebx, dword [ebp - 0xb94]
cmp esi, 4
jge 0xcf2cf0
rol eax, 8
mov byte [ebx], al
jmp 0xcf2cf5
rol ecx, 8
mov byte [ebx], cl
inc ebx
add esi, 1
js 0xcf2ce4
mov eax, dword [ebp - 0xb54]
mov dword [ebp - 0xb94], ebx
mov ebx, dword [ebp - 0xb78]
mov dword [ebp - 0xb20], eax
push 0xfffffffffffffffc
xor eax, eax
pop esi
mov ecx, eax
mov dword [ebp - 0xb40], ecx
test esi, esi
jg 0xcf2d32
jns 0xcf2d32
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb54], eax
mov esi, dword [ebp - 0xb94]
mov eax, edi
shr eax, 3
mov dword [ebp - 0xaf0], eax
test eax, eax
je 0xcf312e
mov ebx, dword [ebp - 0xb04]
lea eax, [esi + 7]
mov dword [ebp - 0xb18], eax
add ebx, 2
movzx edi, byte [ebx - 2]
movzx eax, byte [ebx - 1]
movzx esi, byte [ebx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ebx]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 3]
or esi, eax
movzx eax, byte [ebx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ebx + 5]
add ebx, 8
shl esi, 8
or esi, eax
mov dword [ebp - 0xb64], ebx
xor ecx, esi
mov dword [ebp - 0xa98], ecx
lea ebx, [ecx - 0x4a58]
mov ecx, 0xc81ecb17
xor ebx, edi
xor ebx, dword [ebp - 0xb20]
xor ebx, ecx
mov eax, ebx
xor eax, ecx
ror eax, 0xf
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 7
add ecx, eax
mov eax, dword [ebp - 0xa98]
xor eax, ecx
mov dword [ebp - 0xa98], eax
add eax, 0xb1b54a58
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa98]
ror eax, 0xa
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0xcb17
rol eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
rol eax, 5
add ecx, eax
mov eax, dword [ebp - 0xa98]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xa98], eax
xor ecx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, ecx
xor ebx, eax
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 6
sub ecx, eax
sub ecx, 0x339b6838
xor dword [ebp - 0xa98], ecx
mov ecx, dword [ebp - 0xa98]
mov eax, ecx
ror eax, 0xf
xor eax, 0xcb17
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, 0xc81e
imul eax, eax, 0xcb17
xor ecx, eax
mov dword [ebp - 0xa98], ecx
lea eax, [ecx + 0x37e0ea91]
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0xc81e
ror ecx, 0xa
imul eax, eax, 0xb1b5
xor ecx, eax
mov eax, dword [ebp - 0xa98]
xor eax, ecx
mov dword [ebp - 0xa98], eax
xor eax, 0x4a58
rol eax, 6
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa98]
ror eax, 3
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa98]
mov eax, ebx
ror eax, 0xf
sub eax, 0xc81e
imul eax, eax, 0x4a58
xor ecx, eax
mov dword [ebp - 0xa98], ecx
xor ecx, 0xc81e
mov eax, dword [ebp - 0xa98]
shr eax, 1
imul ecx, ecx, 0x4a58
xor ecx, eax
mov eax, dword [ebp - 0xa98]
add eax, 0xffff34e9
xor ebx, ecx
rol eax, 3
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa98]
shr eax, 0xf
xor ecx, eax
xor ebx, ecx
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 0xd
sub ecx, eax
mov eax, 0xb1b54a58
add ecx, 0x730581bd
xor dword [ebp - 0xa98], ecx
sub eax, dword [ebp - 0xa98]
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa98]
ror eax, 0xb
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa98]
lea eax, [ebx + 0x4e49ed8a]
xor ecx, eax
mov dword [ebp - 0xa98], ecx
mov eax, dword [ebp - 0xa98]
xor eax, 0xb1b5
ror ecx, 7
imul eax, eax, 0x4a58
sub eax, ecx
xor ebx, eax
mov eax, ebx
xor eax, 0xc81e
rol eax, 4
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0x10
sub ecx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xa98], ecx
sub eax, dword [ebp - 0xa98]
ror eax, 0xa
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa98]
ror eax, 4
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x4e4ab5a8]
ror eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
ror eax, 9
xor ecx, eax
mov eax, dword [ebp - 0xa98]
xor eax, ecx
mov dword [ebp - 0xa98], eax
xor eax, 0xc81ecb17
rol eax, 8
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa98]
rol eax, 2
sub ecx, eax
mov eax, 0xc81ecb17
xor ebx, ecx
sub eax, ebx
ror eax, 0xb
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0xc
sub ecx, eax
mov eax, dword [ebp - 0xa98]
xor eax, ecx
mov dword [ebp - 0xa98], eax
xor eax, 0xb1b5
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa98]
shr eax, 8
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor ebx, dword [ebp - 0xb70]
xor eax, dword [ebp - 0xa98]
xor eax, dword [ebp - 0xac0]
xor eax, 0x79ab814f
mov dword [ebp - 0xb54], ebx
mov dword [ebp - 0xb40], eax
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0xb70], edi
mov dword [ebp - 0xac0], esi
mov byte [eax - 4], bl
mov al, byte [ebp - 0xb40]
mov ebx, dword [ebp - 0xb18]
ror dword [ebp - 0xb54], 8
mov byte [ebx], al
mov al, byte [ebp - 0xb54]
ror dword [ebp - 0xb40], 8
mov byte [ebx - 5], al
mov al, byte [ebp - 0xb40]
ror dword [ebp - 0xb54], 8
mov byte [ebx - 1], al
mov al, byte [ebp - 0xb54]
ror dword [ebp - 0xb40], 8
mov byte [ebx - 6], al
mov al, byte [ebp - 0xb40]
ror dword [ebp - 0xb54], 8
mov byte [ebx - 2], al
ror dword [ebp - 0xb40], 8
mov al, byte [ebp - 0xb54]
mov byte [ebx - 7], al
mov al, byte [ebp - 0xb40]
mov byte [ebx - 3], al
add ebx, 8
mov eax, dword [ebp - 0xb54]
mov ecx, dword [ebp - 0xb40]
ror eax, 8
ror ecx, 8
sub dword [ebp - 0xaf0], 1
mov dword [ebp - 0xb18], ebx
mov ebx, dword [ebp - 0xb64]
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb54], eax
mov dword [ebp - 0xb40], ecx
jne 0xcf2d5d
mov ebx, dword [ebp - 0xb78]
mov edi, dword [ebp - 0xacc]
mov esi, dword [ebp - 0xc20]
movzx eax, dl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xcf3160
mov esi, 0xc0000017
jmp 0xcf3273
mov eax, dword [ebp - 0xbd4]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xcf3188
mov esi, 0xc0000017
xor edx, edx
jmp 0xcf320c
mov dword [edi + 4], eax
push dword [ebp - 0xbd4]
push esi
push eax
call fcn.00bc13d0
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xcf317c
mov dword [edi + 0xc], eax
push 0xa0
push 0xd08ca8
push eax
call fcn.00bc13d0
add esp, 0xc
mov dword [edi + 0x10], esi
push esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xcf31f0
mov esi, 0xc0000017
jmp 0xcf320c
mov dword [edi + 0x14], ecx
mov esi, edx
mov eax, dword [0xd08d48]
mov dword [ecx], eax
mov eax, dword [0xd08d4c]
mov dword [ebp - 0xbf0], edi
mov edi, edx
mov dword [ecx + 4], eax
test edi, edi
je 0xcf3273
cmp dword [edi + 4], 0
je 0xcf322c
push dword [edi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 4], edx
cmp dword [edi + 0xc], 0
je 0xcf3248
push dword [edi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0xc], edx
cmp dword [edi + 0x14], 0
je 0xcf3264
push dword [edi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0x14], edx
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
test esi, esi
js 0xcf3289
mov ebx, dword [ebp - 0xbf0]
mov edi, eax
mov dword [ebp - 0xb78], ebx
jmp 0xcf328f
mov edi, dword [ebp - 0xbf0]
push dword [ebp - 0xc20]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xcf3312
xor eax, eax
cmp dword [edi + 4], eax
je 0xcf32c4
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xcf32e0
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xcf32fc
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xcf3312
mov esi, 0xc0000001
or esi, 0x10000000
jl 0xcf44d3
mov edx, dword [ebx]
lea eax, [ebp - 0xbb8]
push 4
pop edi
push eax
mov ecx, edi
mov dword [ebp - 0xbb8], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf33ad
mov ecx, dword [ebp - 0xbb8]
lea eax, [ebp - 0xbb8]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf33ad
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xbb8]
mov ecx, dword [ebp - 0xbb8]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf33ad
mov ecx, dword [ebp - 0xbb8]
lea eax, [ebp - 0xbb8]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf33ad
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xbb8]
mov ecx, dword [ebp - 0xbb8]
push eax
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xbb8]
test esi, esi
jns 0xcf33b3
mov eax, dword [ebp - 0xe90]
mov dword [ebp - 0xaf0], eax
test esi, esi
js 0xcf350c
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xcf33e1
mov esi, 0xc0000017
jmp 0xcf350c
mov eax, dword [ebx]
mov ecx, edi
mov dword [edi], eax
lea eax, [ebp - 0xafc]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xafc], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf34f7
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0xafc]
call fcn.00bc13d0
mov edx, dword [ebx]
lea eax, [ebp - 0xafc]
mov ecx, dword [ebp - 0xafc]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf34f7
mov ecx, dword [ebp - 0xafc]
mov eax, dword [ebx + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xafc]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf34f7
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0xafc]
call fcn.00bc13d0
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xafc]
mov ecx, dword [ebp - 0xafc]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf34f7
mov ecx, dword [ebp - 0xafc]
mov eax, dword [ebx + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xafc]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf34f7
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0xafc]
call fcn.00bc13d0
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xafc]
mov ecx, dword [ebp - 0xafc]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
xor ecx, ecx
test esi, esi
js 0xcf34f9
mov eax, dword [ebp - 0xaf0]
mov dword [ebp - 0xa9c], edi
mov edi, ecx
mov dword [ebp - 0xac8], eax
jmp 0xcf34f9
xor ecx, ecx
test edi, edi
je 0xcf350c
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xcf44d3
xor eax, eax
mov dword [ebp - 0xcb4], 8
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xb04], eax
mov edx, dword [ebp - 0xb9c]
lea eax, [ebp - 0xcb4]
push eax
push 8
pop ecx
call fcn.00b84e9a
mov esi, eax
or esi, 0x10000000
jl 0xcf3759
mov eax, dword [ebp - 0xcb4]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xcf356a
mov esi, 0xc0000095
jmp 0xcf358b
mov dword [ebp - 0xcb0], ecx
lea eax, [ebp - 0xcb0]
push eax
push 8
pop edx
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xcb0]
test esi, esi
jns 0xcf3591
mov eax, dword [ebp - 0xd18]
mov dword [ebp - 0xb18], eax
test esi, esi
js 0xcf3759
mov ebx, dword [ebp - 0xad8]
xor eax, eax
mov ecx, ebx
mov edi, eax
mov dword [ebp - 0xc18], ecx
mov eax, dword [ecx]
mov dword [ebp - 0xb64], eax
lea eax, [ebp - 0xc18]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf3759
mov edx, dword [ebp - 0xb64]
lea eax, [ebp - 0xc18]
mov ecx, dword [ebp - 0xc18]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf3759
mov ecx, dword [ebp - 0xc18]
inc edi
cmp edi, 1
jb 0xcf35b1
mov edi, dword [ecx]
lea eax, [ebp - 0xc18]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf3759
mov dword [ebp - 0xaf0], edi
xor eax, eax
mov dword [ebp - 0xb20], ebx
mov edi, eax
lea eax, [ebp - 0xb20]
mov ecx, ebx
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf3691
mov edx, dword [ebx]
lea eax, [ebp - 0xb20]
mov ecx, dword [ebp - 0xb20]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf3691
inc edi
cmp edi, 2
jae 0xcf3670
mov ebx, dword [ebp - 0xb20]
jmp 0xcf362f
mov ecx, dword [ebp - 0xb20]
lea eax, [ebp - 0xb20]
push eax
push 4
pop eax
mov edi, dword [ecx]
mov edx, eax
call fcn.00b84e9a
mov esi, eax
mov ebx, edi
test esi, esi
jns 0xcf369f
mov ebx, dword [ebp - 0xb04]
test esi, esi
js 0xcf3759
mov edx, dword [ebp - 0xb18]
lea eax, [ebp - 0xba4]
push 4
pop edi
push eax
mov ecx, edi
mov dword [ebp - 0xba4], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf3734
mov ecx, dword [ebp - 0xba4]
lea eax, [ebp - 0xba4]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf3734
mov edx, dword [ebp - 0xaf0]
lea eax, [ebp - 0xba4]
mov ecx, dword [ebp - 0xba4]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf3734
mov ecx, dword [ebp - 0xba4]
lea eax, [ebp - 0xba4]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf3734
mov ecx, dword [ebp - 0xba4]
lea eax, [ebp - 0xba4]
push eax
mov edx, ebx
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xba4]
test esi, esi
jns 0xcf373e
mov eax, dword [ebp - 0xe8c]
test esi, esi
js 0xcf3759
cmp eax, 0x400000
jbe 0xcf374f
mov esi, 0x8000ffff
jmp 0xcf44d3
mov edi, eax
mov dword [ebp - 0xaf8], edi
jmp 0xcf375f
mov edi, dword [ebp - 0xaf8]
test esi, esi
js 0xcf44d3
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xcf3788
mov ecx, dword [ebp - 0xbbc]
mov esi, 0xd0000017
jmp 0xcf3795
mov ecx, eax
mov dword [ebp - 0xbbc], eax
mov esi, 0x10000000
mov ebx, dword [ebp - 0xa9c]
test esi, esi
js 0xcf44d9
test ebx, ebx
jne 0xcf37b1
mov esi, 0x80070057
jmp 0xcf44d9
test ecx, ecx
je 0xcf37a7
mov eax, dword [ebp - 0xac8]
mov dword [ebp - 0xdfc], eax
xor eax, eax
mov dword [ebp - 0xdf4], eax
lea eax, [ebp - 0xd1c]
push eax
push 0xb2be98
push 1
mov dword [ebp - 0xe04], ebx
mov dword [ebp - 0xe00], ecx
mov dword [ebp - 0xdf8], edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xcf3813
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xcf380a
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xcf385b
mov esi, 0x80004005
jmp 0xcf385b
push 0xb2be7c
push dword [ebp - 0xd1c]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xcf37f3
xor eax, eax
mov ecx, esi
push eax
push 0x14
lea eax, [ebp - 0xe04]
push eax
push 0x86
call dword [0xd0cffc]
call esi
mov esi, eax
or esi, 0x10000000
jl 0xcf385b
mov edi, dword [ebp - 0xdf8]
mov dword [ebp - 0xaf8], edi
cmp esi, 0xd0000023
jne 0xcf386d
mov esi, 0x8007007a
jmp 0xcf44d9
test esi, esi
js 0xcf44d9
mov eax, dword [ebp - 0xbbc]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xb30], ecx
mov ebx, ecx
mov dword [ebp - 0xba0], eax
cmp edi, edx
jae 0xcf389c
mov esi, 0xc000003e
jmp 0xcf3c7f
mov edi, dword [eax]
lea ecx, [ebp - 0xba0]
push ecx
mov ecx, eax
mov dword [ebp - 0xb64], edi
call fcn.00b84e9a
mov esi, eax
xor ecx, ecx
test esi, esi
js 0xcf3c7f
lea eax, [ebp - 0xb30]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf3c7d
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb30]
cmp eax, edi
jae 0xcf38f3
mov esi, 0xc000003e
jmp 0xcf3c7d
mov eax, dword [ebp - 0xba0]
lea ecx, [ebp - 0xba0]
push ecx
mov edx, edi
mov dword [ebp - 0xb9c], eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf3c7d
mov ecx, dword [ebp - 0xb30]
lea eax, [ebp - 0xb30]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf3c7d
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb30]
push 4
pop edx
cmp eax, edx
jb 0xcf38e9
mov ecx, dword [ebp - 0xba0]
lea eax, [ebp - 0xba0]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0xbf4], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf3c7d
mov ecx, dword [ebp - 0xb30]
lea eax, [ebp - 0xb30]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf3c7d
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb30]
cmp eax, edi
jb 0xcf38e9
mov eax, dword [ebp - 0xba0]
lea ecx, [ebp - 0xba0]
push ecx
mov edx, edi
mov dword [ebp - 0xaf0], eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf3c7d
mov ecx, dword [ebp - 0xb30]
lea eax, [ebp - 0xb30]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf3c7d
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb30]
push 4
pop edx
cmp eax, edx
jb 0xcf38e9
mov ecx, dword [ebp - 0xba0]
mov eax, dword [ecx]
mov dword [ebp - 0xb04], eax
lea eax, [ebp - 0xba0]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf3c7d
mov ecx, dword [ebp - 0xb30]
lea eax, [ebp - 0xb30]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf3c7d
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb30]
mov ecx, dword [ebp - 0xb04]
cmp eax, ecx
jb 0xcf38e9
lea eax, [ebp - 0xb30]
mov edx, ecx
mov ecx, dword [ebp - 0xb30]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf3c7d
mov ecx, dword [ebp - 0xaf8]
mov eax, ecx
sub eax, dword [ebp - 0xb30]
jne 0xcf38e9
mov eax, dword [ebp - 0xb04]
mov esi, dword [ebp - 0xb64]
add eax, 0xc
add eax, edi
add eax, esi
cmp eax, ecx
jne 0xcf38e9
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xcf3acb
mov esi, 0xc0000017
jmp 0xcf3c08
cmp dword [ebp - 0xb9c], ebx
je 0xcf3b0c
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xcf3af5
mov esi, 0xc0000017
xor eax, eax
jmp 0xcf3ba1
mov dword [edi + 4], eax
push esi
push dword [ebp - 0xb9c]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xcf3b13
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
cmp dword [ebp - 0xaf0], ebx
je 0xcf3b4f
mov esi, dword [ebp - 0xbf4]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xcf3ae9
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xaf0]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xcf3b55
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
cmp dword [ebp - 0xba0], ebx
je 0xcf3b95
mov esi, dword [ebp - 0xb04]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xcf3ae9
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xba0]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xcf3b9b
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov ebx, edi
mov esi, eax
mov edi, eax
test edi, edi
je 0xcf3c08
cmp dword [edi + 4], 0
je 0xcf3bc1
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xcf3bdd
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xcf3bf9
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test esi, esi
js 0xcf3c16
mov dword [ebp - 0xbec], ebx
mov ebx, ecx
test ebx, ebx
je 0xcf3c7f
cmp dword [ebx + 4], 0
je 0xcf3c36
push dword [ebx + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 4], ecx
cmp dword [ebx + 0xc], 0
je 0xcf3c52
push dword [ebx + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 0xc], ecx
cmp dword [ebx + 0x14], 0
je 0xcf3c6e
push dword [ebx + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 0x14], ecx
push ebx
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
or esi, 0x10000000
jl 0xcf44d3
mov eax, dword [ebp - 0xbec]
mov ebx, ecx
mov dword [ebp - 0xc58], ebx
mov dword [ebp - 0xc68], ecx
test eax, eax
jne 0xcf3cad
mov esi, 0xd000000d
jmp 0xcf4257
mov esi, dword [eax + 4]
mov dword [ebp - 0xc50], esi
test esi, esi
je 0xcf3ca3
mov edi, dword [eax]
test edi, edi
je 0xcf3ca3
add edi, 0xfffffff8
mov dword [ebp - 0xc54], ecx
push edi
push ecx
mov dword [ebp - 0xbc0], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xbd4], eax
test eax, eax
je 0xcf423b
xor ecx, ecx
mov ebx, esi
mov dl, cl
mov dword [ebp - 0xaf0], ebx
mov esi, edi
mov ecx, eax
mov dword [ebp - 0xb04], ecx
and esi, 7
je 0xcf41dd
xor eax, eax
xor edi, edi
mov dword [ebp - 0xb3c], eax
or eax, 0xffffffff
mov dword [ebp - 0xb2c], eax
xor eax, eax
mov dword [ebp - 0xc14], edi
mov dword [ebp - 0xbc4], eax
mov dword [ebp - 0xb9c], eax
test esi, esi
je 0xcf3d85
push 0x38
pop ecx
cmp eax, 4
movzx eax, byte [ebx]
jge 0xcf3d50
add ecx, 0xffffffe0
shl eax, cl
mov ecx, dword [ebp - 0xbac]
or edi, eax
jmp 0xcf3d58
shl eax, cl
or dword [ebp - 0xc14], eax
mov eax, dword [ebp - 0xb9c]
sub ecx, 8
inc eax
mov dword [ebp - 0xbac], ecx
inc ebx
mov dword [ebp - 0xb9c], eax
cmp eax, esi
jl 0xcf3d39
mov ecx, dword [ebp - 0xb04]
mov dword [ebp - 0xbc4], edi
mov dword [ebp - 0xaf0], ebx
mov eax, dword [ebp - 0xc14]
mov ebx, edi
xor ebx, 0x92f65a5
xor eax, 0x699a899c
xor edi, edi
mov dword [ebp - 0xb3c], ebx
mov dword [ebp - 0xb2c], eax
test esi, esi
je 0xcf3dd3
cmp edi, 4
jge 0xcf3db6
rol ebx, 8
mov byte [ecx], bl
jmp 0xcf3dbb
rol eax, 8
mov byte [ecx], al
inc edi
inc ecx
cmp edi, esi
jl 0xcf3daa
mov ebx, dword [ebp - 0xb3c]
mov eax, dword [ebp - 0xb2c]
mov dword [ebp - 0xb04], ecx
lea edi, [esi - 4]
test edi, edi
jle 0xcf41b5
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xb18], eax
mov esi, eax
mov dword [ebp - 0xb2c], eax
mov edi, dword [ebp - 0xbc0]
mov eax, edi
shr eax, 3
mov dword [ebp - 0xb9c], eax
test eax, eax
je 0xcf417e
mov eax, dword [ebp - 0xb04]
mov edi, dword [ebp - 0xaf0]
add eax, 7
add edi, 2
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xb20], edi
movzx ecx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ecx, 8
or ecx, eax
shl edi, 8
mov eax, dword [ebp - 0xb20]
xor ebx, ecx
mov dword [ebp - 0xbf4], ecx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb20]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb20]
shl edi, 8
add dword [ebp - 0xb20], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul ecx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub ecx, eax
xor esi, ecx
imul ecx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub ecx, eax
sub ecx, 0x756c8a2
xor ebx, ecx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0x137f
ror ecx, 6
imul eax, eax, 0xab69
xor ecx, eax
xor esi, ecx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, esi
rol eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub ecx, eax
xor esi, ecx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x7f1
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov eax, esi
mov dword [ebp - 0xb18], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea esi, [ebx - 0x7f1]
xor esi, dword [ebp - 0xb18]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul ecx, eax, 0x137f
mov eax, esi
shr eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 7
add ecx, eax
xor esi, ecx
mov eax, esi
mov ecx, esi
xor eax, 0x137f
ror ecx, 9
imul eax, eax, 0x605e
add ecx, eax
xor ebx, ecx
mov eax, ebx
mov dword [ebp - 0xb64], ebx
xor eax, 0xab69
rol eax, 5
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add ecx, eax
xor esi, ecx
mov ebx, esi
xor ebx, dword [ebp - 0xb64]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul ecx, eax, 0x605e
mov eax, esi
ror eax, 6
sub ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add ecx, eax
xor esi, ecx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x605e
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor ecx, eax
xor esi, ecx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul ecx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xc14]
rol eax, 2
mov dword [ebp - 0xb2c], esi
mov dword [ebp - 0xc14], edi
xor ecx, eax
mov edi, dword [ebp - 0xb20]
xor ecx, dword [ebp - 0xbc4]
xor ebx, ecx
mov ecx, dword [ebp - 0xbac]
mov dword [ebp - 0xb3c], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb2c]
ror dword [ebp - 0xb3c], 8
mov byte [ecx], al
mov al, byte [ebp - 0xb3c]
ror dword [ebp - 0xb2c], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb2c]
ror dword [ebp - 0xb3c], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xb3c]
ror dword [ebp - 0xb2c], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xb2c]
ror dword [ebp - 0xb3c], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xb2c], 8
mov al, byte [ebp - 0xb3c]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb2c]
mov byte [ecx - 3], al
add ecx, 8
mov ebx, dword [ebp - 0xb3c]
mov esi, dword [ebp - 0xb2c]
mov eax, dword [ebp - 0xbf4]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xb9c], 1
mov dword [ebp - 0xb3c], ebx
mov dword [ebp - 0xb2c], esi
mov dword [ebp - 0xbc4], eax
mov dword [ebp - 0xbac], ecx
jne 0xcf3e2f
mov edi, dword [ebp - 0xbc0]
mov ecx, dword [ebp - 0xbd4]
xor eax, eax
test edi, edi
je 0xcf4192
xor dl, byte [eax + ecx]
inc eax
cmp eax, edi
jb 0xcf418a
mov esi, dword [ebp - 0xc50]
movzx eax, dl
cdq
cmp eax, dword [edi + esi]
jne 0xcf41fa
cmp edx, dword [edi + esi + 4]
jne 0xcf41fa
mov esi, dword [ebp - 0xc54]
xor eax, eax
mov ebx, ecx
mov ecx, eax
jmp 0xcf420d
xor eax, eax
mov esi, eax
mov dword [ebp - 0xb2c], esi
test edi, edi
jns 0xcf3df8
neg edi
shl edi, 3
mov ecx, edi
shr ebx, cl
shl ebx, cl
mov dword [ebp - 0xb3c], ebx
jmp 0xcf3df8
xor eax, eax
mov esi, eax
mov dword [ebp - 0xbc4], eax
mov ebx, eax
mov dword [ebp - 0xb2c], esi
mov dword [ebp - 0xb3c], ebx
jmp 0xcf3dfe
mov ebx, dword [ebp - 0xc58]
mov esi, 0xc004d501
mov edi, dword [ebp - 0xc68]
xor eax, eax
test ecx, ecx
je 0xcf4220
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xcf423b
xor ecx, ecx
mov dword [ebp - 0xad0], ebx
mov ebx, ecx
mov dword [ebp - 0xaa8], edi
mov esi, 0x10000000
jmp 0xcf4242
mov esi, 0xd0000001
xor ecx, ecx
test ebx, ebx
je 0xcf4257
push ebx
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test esi, esi
js 0xcf44d3
mov edi, dword [ebp - 0xaa8]
push 4
pop ebx
mov dword [ebp - 0xb94], ecx
mov ecx, dword [ebp - 0xad0]
mov dword [ebp - 0xc48], ecx
cmp edi, ebx
jb 0xcf44c8
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0xb64], eax
lea eax, [ebp - 0xc48]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf44cd
lea eax, [ebp - 0xb94]
mov edx, ebx
push eax
xor ecx, ecx
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf44cd
mov eax, edi
sub eax, dword [ebp - 0xb94]
cmp eax, ebx
jb 0xcf44c8
mov ecx, dword [ebp - 0xc48]
lea eax, [ebp - 0xc48]
push eax
push 4
pop eax
mov ebx, dword [ecx]
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf44cd
mov ecx, dword [ebp - 0xb94]
lea eax, [ebp - 0xb94]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf44cd
mov ecx, dword [ebp - 0xb94]
mov eax, edi
sub eax, ecx
cmp eax, ebx
jb 0xcf44c8
lea eax, [ebp - 0xb94]
mov edx, ebx
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf44cd
mov edi, dword [ebp - 0xc48]
mov edx, dword [ebp - 0xaa8]
mov esi, dword [ebp - 0xad0]
lea ecx, [ebx + edi]
lea eax, [edx + esi]
cmp eax, ecx
jb 0xcf44c8
sub edx, ebx
sub edx, edi
add edx, esi
cmp edx, 8
jae 0xcf44c8
xor ecx, ecx
mov dword [ebp - 0xb18], ecx
mov eax, ecx
mov dword [ebp - 0xb04], eax
mov esi, ecx
test edi, edi
je 0xcf445f
lea eax, [ebp - 0xc0c]
mov dword [ebp - 0xbac], edi
push eax
mov edx, ebx
mov ecx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf44cd
mov eax, dword [ebp - 0xc0c]
cmp edi, eax
jae 0xcf4455
lea eax, [ebp - 0xd20]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf44cd
mov eax, dword [ebp - 0xc0c]
cmp dword [ebp - 0xd20], eax
ja 0xcf4484
mov edx, dword [ecx]
lea eax, [ebp - 0xd24]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf4405
mov eax, dword [ebp - 0xd24]
mov dword [ebp - 0xd28], eax
jmp 0xcf440b
mov eax, dword [ebp - 0xd28]
test esi, esi
js 0xcf44cd
lea ecx, [ebp - 0xc5c]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xbac]
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xcf44cd
mov ecx, dword [ebp - 0xc5c]
mov eax, dword [ebp - 0xc0c]
mov dword [ebp - 0xbac], ecx
cmp ecx, eax
ja 0xcf4484
inc dword [ebp - 0xb18]
cmp ecx, eax
jb 0xcf43b1
cmp ecx, eax
jne 0xcf4484
mov eax, dword [ebp - 0xb04]
test ebx, ebx
je 0xcf448f
push ebx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb04], eax
test eax, eax
jne 0xcf448b
mov esi, 0xc0000017
jmp 0xcf44b6
mov esi, 0xc000000d
jmp 0xcf44cd
xor ecx, ecx
mov esi, ecx
test edi, edi
je 0xcf44a4
push ebx
push edi
push eax
call fcn.00bc13d0
mov eax, dword [ebp - 0xb04]
add esp, 0xc
mov dword [ebp - 0xce8], eax
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0xcf0], eax
test esi, esi
js 0xcf44cd
mov eax, dword [ebp - 0xb64]
cmp eax, dword [ebp - 0xcf0]
je 0xcf44cd
mov esi, 0xc000003e
or esi, 0x10000000
mov ebx, dword [ebp - 0xa9c]
mov eax, dword [ebp - 0xad4]
test eax, eax
je 0xcf44f4
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xb78]
test edi, edi
je 0xcf4562
xor eax, eax
cmp dword [edi + 4], eax
je 0xcf451b
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xcf4537
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xcf4553
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
je 0xcf4579
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xcf457b
xor ebx, ebx
mov eax, dword [ebp - 0xbbc]
test eax, eax
je 0xcf4594
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ebx, dword [ebp - 0xbec]
test ebx, ebx
je 0xcf4602
xor eax, eax
cmp dword [ebx + 4], eax
je 0xcf45bb
push dword [ebx + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 4], eax
cmp dword [ebx + 0xc], 0
je 0xcf45d7
push dword [ebx + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0xc], eax
cmp dword [ebx + 0x14], 0
je 0xcf45f3
push dword [ebx + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0x14], eax
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xad0]
test eax, eax
je 0xcf461d
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xcf46ce
mov esi, dword [ebp - 0xcf0]
xor ebx, ebx
inc ebx
cmp esi, ebx
jb 0xcf46ce
mov ecx, dword [ebp - 0xce8]
test ecx, ecx
je 0xcf46ce
test esi, esi
je 0xcf46ce
lea eax, [ebp - 0xcb8]
mov dword [ebp - 0xcb8], ecx
push eax
push 4
pop edi
mov edx, edi
call fcn.00b84e9a
test eax, eax
js 0xcf46ce
mov eax, dword [ecx]
neg eax
sbb eax, eax
and eax, dword [ebp - 0xcb8]
cmp dword [ecx], edi
jne 0xcf46ce
cmp dword [eax], 0
jl 0xcf46ce
cmp esi, ebx
jbe 0xcf46ce
xor eax, eax
mov dword [ebp - 0xbcc], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xbcc]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xcf46ce
mov ecx, dword [ebp - 0xbcc]
lea eax, [ebp - 0xbcc]
push eax
mov edx, edi
call fcn.00b84e9a
test eax, eax
js 0xcf46ce
inc esi
cmp esi, ebx
jae 0xcf46ce
mov ecx, dword [ebp - 0xbcc]
jmp 0xcf468a
mov ebx, dword [ebp - 0xaac]
jmp 0xcf46da
mov ebx, dword [ebp - 0xaac]
mov esi, dword [ebp - 0xaa0]
mov eax, dword [ebp - 0xbdc]
test eax, eax
je 0xcf46f5
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ecx, dword [ebp - 0xce8]
test ecx, ecx
je 0xcf4710
push ecx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
je 0xcf4727
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xcf4729
xor ebx, ebx
test esi, esi
je 0xcf473c
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb8c]
xor edx, edx
mov dword [ebp - 0xb00], edx
mov dword [ebp - 0xc60], eax
jmp 0xceadc1
mov ebx, 0xc004f027
test ebx, ebx
js 0xceae7c
push 4
pop esi
cmp dword [ebp - 0xc44], esi
jne 0xceae7f
mov ebx, dword [eax]
jmp 0xceae85
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret