Function at 0xc1ce62
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1be4
call fcn.00af9320
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0xc963a0
call fcn.00af8a75
xor ecx, ecx
inc ecx
test al, al
je 0xc27524
xor eax, eax
mov edx, 0xc96238
mov dword [ebp - 0x1748], eax
mov dword [ebp - 0x174c], eax
mov dword [ebp - 0x1750], eax
mov dword [ebp - 0x16b4], eax
xor eax, eax
lock cmpxchg dword [edx], ecx
push 1
pop ecx
test eax, eax
jne 0xc1ceb2
mov eax, dword [0xc95890]
or ebx, 0xffffffff
mov dword [ebp - 0x1754], ebx
mov dword [ebp - 0x1758], 0x9fbcf2
mov dword [ebp - 0x175c], 0x67
mov dword [ebp - 0x1760], 0x337
mov dword [ebp - 0x1764], 0x10b
mov dword [ebp - 0x1768], 0x20b
test eax, eax
jne 0xc1d541
push 0x338
mov edi, eax
mov dword [ebp - 0x1698], eax
push eax
mov dword [ebp - 0x167c], eax
mov dword [ebp - 0x1648], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x15c8], esi
test esi, esi
je 0xc1d535
xor eax, eax
mov dword [ebp - 0x6e0], 0xab69605e
add esi, 7
mov dword [ebp - 0x6dc], 0x7f1137f
mov dword [ebp - 0x15b0], esi
mov cl, al
mov dword [ebp - 0x15f0], eax
mov edx, eax
mov dword [ebp - 0x15cc], ebx
mov esi, 0x9fbcf2
mov dword [ebp - 0x15c0], eax
mov dword [ebp - 0x15a8], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [ebp - 0x15ac], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [ebp - 0x15a4], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [ebp - 0x15c0]
xor esi, edx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x15ac]
xor eax, edx
mov dword [ebp - 0x15ac], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x15ac]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x15ac]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x15ac], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x15ac]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x15ac]
xor edx, eax
mov dword [ebp - 0x15ac], edx
mov eax, dword [ebp - 0x15ac]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x15ac]
xor eax, edx
mov dword [ebp - 0x15ac], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x15ac]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x15ac]
xor eax, edx
mov dword [ebp - 0x15ac], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x15ac]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0x15ac]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0x15c0], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x15c0]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x15c0]
xor eax, edx
mov dword [ebp - 0x15c0], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x15c0], edx
mov edx, dword [ebp - 0x15c0]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x15c0], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x15c0]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x15c0]
xor eax, edx
mov dword [ebp - 0x15c0], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x15c0]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x15c0]
xor eax, edx
mov dword [ebp - 0x15c0], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x15c0]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x15c0]
xor edx, dword [ebp - 0x15f0]
xor eax, dword [ebp - 0x15cc]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x15ac], esi
mov esi, dword [ebp - 0x15b0]
mov dword [ebp - 0x15f0], ebx
mov dword [ebp - 0x15cc], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x15a8], 1
mov dword [ebp - 0x15b0], esi
mov esi, dword [ebp - 0x15a4]
mov dword [ebp - 0x15c0], eax
jne 0xc1cf82
mov ebx, dword [ebp - 0x15c8]
xor eax, eax
xor cl, byte [eax + ebx]
inc eax
cmp eax, 0x338
jb 0xc1d2eb
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc1d322
cmp edx, dword [0x9fc02c]
jne 0xc1d322
mov esi, ebx
mov dword [ebp - 0x15a4], 0x337
xor ebx, ebx
mov dword [ebp - 0x1648], esi
mov edi, ebx
jmp 0xc1d334
or dword [ebp - 0x15a4], 0xffffffff
mov edi, 0xc004d501
mov esi, dword [ebp - 0x1648]
test ebx, ebx
je 0xc1d348
push ebx
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0xc1d52f
mov ecx, dword [ebp - 0x15a4]
xor eax, eax
push 0x40
push eax
mov ebx, 0xc960a0
mov edi, esi
push ebx
mov byte [ecx + esi], al
call fcn.00ab4bf6
add esp, 0xc
cmp byte [esi], 0
je 0xc1d4c6
mov edx, ebx
push 4
mov dword [ebp - 0x15a4], edx
pop esi
mov ecx, edi
mov dword [ebp - 0x15ac], edi
xor ebx, ebx
lea eax, [ecx + 2]
mov dword [ebp - 0x15a8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc1d395
sub ecx, dword [ebp - 0x15a8]
sar ecx, 1
push edx
push dword [ebp - 0x15ac]
lea edi, [edi + ecx*2]
push 0
add edi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc1d528
mov edx, dword [ebp - 0x15a4]
xor ecx, ecx
mov ebx, 0x5a4d
mov dword [ebp - 0x167c], ecx
mov eax, dword [edx]
cmp word [eax], bx
je 0xc1d3ec
mov ecx, 0xc000007b
mov dword [ebp - 0x167c], ecx
jmp 0xc1d434
mov ebx, dword [eax + 0x3c]
cmp ebx, 0x10000000
jae 0xc1d3df
add ebx, dword [edx]
cmp ebx, dword [edx]
jb 0xc1d3df
cmp dword [ebx], 0x4550
jne 0xc1d3df
movzx eax, word [ebx + 0x18]
cmp ax, word [ebp - 0x1764]
je 0xc1d422
cmp ax, word [ebp - 0x1768]
je 0xc1d422
mov ecx, 0xc000000d
jmp 0xc1d3e4
mov eax, dword [ebx + 0x78]
mov dword [edx + 8], eax
mov eax, dword [ebx + 0x7c]
mov dword [edx + 0xc], eax
mov eax, dword [ebx + 0x50]
mov dword [edx + 4], eax
mov eax, dword [edi]
add edi, esi
and dword [ebp - 0x15a8], 0
mov dword [ebp - 0x15ac], eax
test eax, eax
je 0xc1d4b4
mov ebx, edi
mov dword [ebp - 0x15b0], edi
lea eax, [ebx + 1]
mov dword [ebp - 0x15c0], eax
mov al, byte [ebx]
inc ebx
test al, al
jne 0xc1d45a
sub ebx, dword [ebp - 0x15c0]
inc edi
add edi, ebx
test ecx, ecx
js 0xc1d499
push dword [ebp - 0x15b0]
push dword [edx]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc1d4c6
mov ecx, dword [ebp - 0x1698]
mov edx, dword [ebp - 0x15a4]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x167c]
mov eax, dword [ebp - 0x15a8]
inc dword [ebp - 0x1698]
inc eax
mov dword [ebp - 0x15a8], eax
cmp eax, dword [ebp - 0x15ac]
jb 0xc1d449
add edx, 0x10
cmp byte [edi], 0
mov dword [ebp - 0x15a4], edx
jne 0xc1d382
mov esi, dword [ebp - 0x167c]
mov edi, dword [ebp - 0x1648]
test edi, edi
je 0xc1d4e7
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push edi
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0xc1d53c
xor esi, esi
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc1d4fe
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc1d4ed
push 0x40
push 0
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc1d547
mov esi, 0xc000007a
jmp 0xc1d4cc
mov edi, dword [ebp - 0x1648]
mov esi, 0xc000007a
jmp 0xc1d4d2
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
xor eax, eax
xor ebx, ebx
mov ecx, eax
mov dword [ebp - 0x15a4], eax
mov edi, eax
mov dword [ebp - 0x15ac], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 0x15a8], ecx
cmp dword [eax + 0x1d4], ebx
je 0xc1d82b
mov esi, dword [0xc93088]
mov ecx, esi
call dword [0xc99200]
call esi
mov edx, eax
mov dword [ebp - 0x15b0], edx
test edx, edx
jne 0xc1d5a3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc1d873
xor eax, eax
mov ecx, eax
mov esi, eax
mov dword [ebp - 0x15a8], ecx
mov ebx, dword [0xc93098]
lea ecx, [ebp - 0x176c]
push ecx
push eax
push esi
push 2
push edx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xc1d629
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc1d614
test esi, esi
jne 0xc1d60d
push dword [ebp - 0x176c]
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc1d606
mov eax, dword [ebp - 0x176c]
mov edx, dword [ebp - 0x15b0]
jmp 0xc1d5af
mov ebx, 0x8007000e
jmp 0xc1d637
mov ebx, 0x80004005
jmp 0xc1d637
test eax, eax
je 0xc1d60d
jg 0xc1d61e
mov ebx, eax
jmp 0xc1d637
movzx ebx, ax
or ebx, 0x80070000
jmp 0xc1d637
mov ebx, dword [ebp - 0x15a8]
mov dword [ebp - 0x15a4], esi
xor esi, esi
test esi, esi
je 0xc1d64b
push esi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc1d855
mov esi, dword [0xc93094]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov edx, eax
mov dword [ebp - 0x15b0], edx
test edx, edx
jne 0xc1d69d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc1d68d
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc1d855
mov ebx, 0x80004005
jmp 0xc1d855
xor eax, eax
mov ecx, eax
mov esi, eax
mov dword [ebp - 0x15a8], ecx
mov ebx, dword [0xc93098]
lea ecx, [ebp - 0x1770]
push ecx
push eax
push esi
push 2
push edx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xc1d729
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc1d70e
test esi, esi
jne 0xc1d707
push dword [ebp - 0x1770]
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc1d700
mov eax, dword [ebp - 0x1770]
mov edx, dword [ebp - 0x15b0]
jmp 0xc1d6a9
mov ebx, 0x8007000e
jmp 0xc1d721
mov ebx, 0x80004005
jmp 0xc1d721
test eax, eax
je 0xc1d707
jg 0xc1d718
mov ebx, eax
jmp 0xc1d721
movzx ebx, ax
or ebx, 0x80070000
mov dword [ebp - 0x15a8], ebx
jmp 0xc1d733
mov ebx, dword [ebp - 0x15a8]
mov edi, esi
xor esi, esi
test esi, esi
je 0xc1d747
push esi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc1d83b
mov eax, dword [ebp - 0x15a4]
test eax, eax
je 0xc1d82f
push 4
mov edx, 0x9fb9c0
pop ecx
mov si, word [eax]
cmp si, word [edx]
jne 0xc1d78b
test si, si
je 0xc1d785
mov si, word [eax + 2]
cmp si, word [edx + 2]
jne 0xc1d78b
add eax, ecx
add edx, ecx
test si, si
jne 0xc1d765
xor eax, eax
mov edx, eax
jmp 0xc1d794
sbb edx, edx
xor eax, eax
inc eax
or edx, eax
xor eax, eax
test edx, edx
jne 0xc1d82f
test edi, edi
je 0xc1d82f
mov esi, 0x9f98b0
mov edx, edi
mov bx, word [edx]
cmp bx, word [esi]
jne 0xc1d7d2
test bx, bx
je 0xc1d7cb
mov bx, word [edx + 2]
cmp bx, word [esi + 2]
jne 0xc1d7d2
add edx, ecx
add esi, ecx
test bx, bx
jne 0xc1d7ab
xor ebx, ebx
mov edx, eax
inc ebx
jmp 0xc1d7d9
sbb edx, edx
xor ebx, ebx
inc ebx
or edx, ebx
test edx, edx
jne 0xc1d82f
mov dword [ebp - 0x16dc], eax
lea eax, [ebp - 0x16dc]
push ecx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
jne 0xc1d81e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc1d815
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc1d841
mov ebx, 0x80004005
jmp 0xc1d841
test byte [ebp - 0x16dc], 0xf
jne 0xc1d82f
mov eax, ebx
jmp 0xc1d835
mov eax, ecx
jmp 0xc1d835
mov eax, dword [ebp - 0x15ac]
mov dword [ebp - 0x16b4], eax
mov ebx, dword [ebp - 0x15a8]
test edi, edi
je 0xc1d855
push edi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x15a4]
test eax, eax
je 0xc1d86f
push eax
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc1d87a
and dword [ebp - 0x16b4], 0
push 4
pop ebx
push ebx
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x15a4], esi
test esi, esi
jne 0xc1d978
mov dword [ebp - 0x15ac], 0x8007000e
mov eax, dword [ebp - 0x16dc]
xor ebx, ebx
mov dword [ebp - 0x1750], eax
mov edx, 0xc96238
xor esi, esi
lea ecx, [esi + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc1d8b5
mov eax, dword [0xc95890]
mov esi, dword [ebp - 0x15a4]
test eax, eax
jle 0xc1d91b
sub eax, 1
mov dword [0xc95890], eax
jne 0xc1d91b
mov edi, ebx
mov eax, dword [edi + 0xc960a0]
test eax, eax
je 0xc1d8ee
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xc1d8dd
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x15a4]
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
test esi, esi
je 0xc1d92f
push esi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov ecx, dword [ebp - 0x15ac]
mov eax, dword [ebp - 0x174c]
test ecx, ecx
jns 0xc274f7
cmp ecx, 0xd0000034
je 0xc2750a
cmp ecx, 0xd00000e5
je 0xc274ee
cmp ecx, 0xc004d501
je 0xc274ee
cmp ecx, 0xd000003e
je 0xc2750a
jmp 0xc274f3
xor eax, eax
lea edi, [ebp - 0x1ac8]
mov ecx, eax
mov dword [ebp - 0x15a8], eax
mov dword [ebp - 0x15b0], eax
mov dword [ebp - 0x15cc], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x15c0], ecx
mov dword [ebp - 0x1b08], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x15f0], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x15c8], eax
mov dword [ebp - 0x16d0], 0x38
test eax, eax
jne 0xc1d9dd
mov edi, 0xc0000017
jmp 0xc2073e
push 0x28
pop ecx
mov esi, 0xc94ea0
mov dword [ebp - 0x15a8], eax
mov edi, eax
rep movsd dword es:[edi], dword [esi]
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x1648], ecx
test ecx, ecx
je 0xc1d9d3
mov eax, dword [0xc94e98]
mov dword [ecx], eax
mov eax, dword [0xc94e9c]
mov dword [ecx + 4], eax
mov dword [ebp - 0x15b0], ecx
rdtsc
mov dword [ebp - 0x167c], eax
mov dword [ebp - 0x1698], edx
and dword [ebp - 0x1774], 0
lea eax, [ebp - 0x18e0]
push eax
mov edx, ebx
mov ecx, ebx
call fcn.00a32533
mov esi, dword [ebp - 0x18e0]
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
jns 0xc1da63
mov esi, dword [ebp - 0x18dc]
jmp 0xc20744
lea eax, [ebp - 0x1774]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00a32533
mov edi, eax
or edi, 0x10000000
mov dword [ebp - 0x15ac], edi
jl 0xc20744
lea eax, [ebp - 0x18d8]
mov edx, 0xa0
push eax
mov ecx, ebx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc20744
mov esi, dword [ebp - 0x18d8]
mov ecx, dword [ebp - 0x1774]
lea eax, [ebp - 0x1774]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
or edi, 0x10000000
mov dword [ebp - 0x15ac], edi
jl 0xc20744
lea eax, [ebp - 0x18d4]
mov ecx, ebx
push eax
push 8
pop edx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc20744
mov esi, dword [ebp - 0x18d4]
mov ecx, dword [ebp - 0x1774]
lea eax, [ebp - 0x1774]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
or edi, 0x10000000
mov dword [ebp - 0x15ac], edi
jl 0xc20744
lea eax, [ebp - 0x18d0]
mov ecx, ebx
push eax
push 8
pop edx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc20744
mov esi, dword [ebp - 0x18d0]
mov ecx, dword [ebp - 0x1774]
lea eax, [ebp - 0x1774]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
or edi, 0x10000000
mov dword [ebp - 0x15ac], edi
jl 0xc20744
lea eax, [ebp - 0x18cc]
mov edx, SysReAllocString
push eax
mov ecx, 0x9fe768
call fcn.00a41606
test eax, eax
jns 0xc1db9a
mov edi, 0xc000003e
jmp 0xc2073e
mov edx, dword [ebp - 0x18cc]
lea eax, [ebp - 0x18bc]
inc edx
mov ecx, ebx
mov dword [ebp - 0x18cc], edx
add edx, edx
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc20744
mov esi, dword [ebp - 0x18bc]
mov ecx, dword [ebp - 0x1774]
lea eax, [ebp - 0x1774]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
or edi, 0x10000000
mov dword [ebp - 0x15ac], edi
jl 0xc20744
lea eax, [ebp - 0x18b8]
mov edx, ebx
push eax
mov ecx, ebx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc20744
mov esi, dword [ebp - 0x18b8]
mov ecx, dword [ebp - 0x1774]
lea eax, [ebp - 0x1774]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
or edi, 0x10000000
mov dword [ebp - 0x15ac], edi
jl 0xc20744
lea eax, [ebp - 0x18b4]
mov edx, ebx
push eax
mov ecx, ebx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc20744
mov esi, dword [ebp - 0x18b4]
mov ecx, dword [ebp - 0x1774]
lea eax, [ebp - 0x1774]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
or edi, 0x10000000
mov dword [ebp - 0x15ac], edi
jl 0xc20744
mov eax, dword [ebp - 0x1774]
push eax
push 8
mov dword [ebp - 0x1b0c], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x1584], esi
test esi, esi
je 0xc1d9d3
mov dword [ebp - 0x15c0], eax
mov dword [ebp - 0x1b08], eax
xor eax, eax
mov dword [ebp - 0x159c], eax
mov dword [ebp - 0x18b0], eax
mov dword [ebp - 0x18a0], esi
lea eax, [ebp - 0x19b8]
mov dword [ebp - 0x19bc], ebx
push eax
mov edx, ebx
mov ecx, esi
call fcn.00a32533
mov edi, eax
xor ecx, ecx
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc20744
mov ecx, dword [ebp - 0x1774]
lea eax, [esi + 8]
add ecx, esi
cmp eax, ecx
jbe 0xc1dd1e
mov edi, 0xc0000023
jmp 0xc2073e
mov eax, dword [ebp - 0x19b8]
mov dword [esi], ebx
xor ebx, ebx
push 4
mov dword [eax], ebx
xor eax, eax
inc eax
mov dword [ebp - 0x159c], eax
mov ecx, eax
pop ebx
test edi, edi
js 0xc20744
and dword [ebp - 0x156c], 0
mov eax, esi
mov dword [ebp - 0x189c], eax
test ecx, ecx
je 0xc1ddca
mov edx, dword [eax]
lea ecx, [ebp - 0x1890]
push ecx
mov ecx, ebx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1dd7d
mov eax, dword [ebp - 0x1890]
mov dword [ebp - 0x188c], eax
jmp 0xc1dd83
mov eax, dword [ebp - 0x188c]
test edi, edi
js 0xc1de3e
lea ecx, [ebp - 0x189c]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0x189c]
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1de3e
mov eax, dword [ebp - 0x156c]
inc eax
cmp eax, dword [ebp - 0x159c]
mov dword [ebp - 0x156c], eax
mov eax, dword [ebp - 0x189c]
jb 0xc1dd53
lea ecx, [ebp - 0x19c0]
mov dword [ebp - 0x19c4], 0xa0
push ecx
mov edx, ebx
mov ecx, eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1de3e
mov edi, dword [ebp - 0x189c]
mov ecx, dword [ebp - 0x1774]
add ecx, esi
lea eax, [edi + 0xa4]
cmp eax, ecx
ja 0xc1dd14
mov eax, dword [ebp - 0x159c]
mov esi, dword [ebp - 0x15c8]
inc eax
mov dword [edi], 0xa0
mov edi, dword [ebp - 0x19c0]
push 0x28
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x15ac]
mov esi, dword [ebp - 0x1584]
mov dword [ebp - 0x159c], eax
jmp 0xc1de44
mov eax, dword [ebp - 0x159c]
test edi, edi
js 0xc20744
and dword [ebp - 0x15c8], 0
mov ecx, esi
mov dword [ebp - 0x156c], ecx
test eax, eax
je 0xc1dec3
mov edx, dword [ecx]
lea eax, [ebp - 0x1888]
push eax
mov ecx, ebx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1de89
mov eax, dword [ebp - 0x1888]
mov dword [ebp - 0x1884], eax
jmp 0xc1de8f
mov eax, dword [ebp - 0x1884]
test edi, edi
js 0xc1df35
mov edx, dword [ebp - 0x156c]
lea ecx, [edx + eax]
cmp ecx, edx
jb 0xc1df2b
mov eax, dword [ebp - 0x15c8]
inc eax
mov dword [ebp - 0x156c], ecx
mov dword [ebp - 0x15c8], eax
cmp eax, dword [ebp - 0x159c]
jb 0xc1de5f
lea eax, [ebp - 0x19c8]
mov dword [ebp - 0x19cc], 8
push eax
mov edx, ebx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1df35
mov edx, dword [ebp - 0x156c]
mov ecx, dword [ebp - 0x1774]
add ecx, esi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xc1dd14
mov ecx, dword [ebp - 0x19c8]
mov dword [edx], 8
mov edx, dword [ebp - 0x1648]
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x159c]
inc eax
mov dword [ebp - 0x159c], eax
jmp 0xc1df3b
mov edi, 0xc0000095
jmp 0xc2073e
mov eax, dword [ebp - 0x159c]
test edi, edi
js 0xc20744
mov ecx, dword [ebp - 0x167c]
and dword [ebp - 0x15c8], 0
mov dword [ebp - 0x1a68], ecx
mov ecx, dword [ebp - 0x1698]
mov dword [ebp - 0x1a64], ecx
mov ecx, esi
mov dword [ebp - 0x156c], ecx
test eax, eax
je 0xc1dfd2
mov edx, dword [ecx]
lea eax, [ebp - 0x187c]
push eax
mov ecx, ebx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1df98
mov eax, dword [ebp - 0x187c]
mov dword [ebp - 0x1878], eax
jmp 0xc1df9e
mov eax, dword [ebp - 0x1878]
test edi, edi
js 0xc20744
mov edx, dword [ebp - 0x156c]
lea ecx, [edx + eax]
cmp ecx, edx
jb 0xc1df2b
mov eax, dword [ebp - 0x15c8]
inc eax
mov dword [ebp - 0x156c], ecx
mov dword [ebp - 0x15c8], eax
cmp eax, dword [ebp - 0x159c]
jb 0xc1df6e
lea eax, [ebp - 0x19d0]
mov dword [ebp - 0x19d4], 8
push eax
mov edx, ebx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc20744
mov edx, dword [ebp - 0x156c]
mov ecx, dword [ebp - 0x1774]
add ecx, esi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xc1dd14
mov eax, dword [ebp - 0x19d0]
mov ecx, dword [ebp - 0x167c]
inc dword [ebp - 0x159c]
mov dword [edx], 8
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1698]
mov dword [eax + 4], ecx
test edi, edi
js 0xc20744
lea eax, [ebp - 0x1874]
mov edx, SysReAllocString
push eax
mov ecx, 0x9fe768
call fcn.00a41606
test eax, eax
js 0xc1db90
mov ecx, dword [ebp - 0x1874]
lea eax, [ebp - 0x1874]
push eax
xor eax, eax
lea edx, [eax + 1]
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc20744
mov eax, dword [ebp - 0x1874]
lea edx, [eax + eax]
mov dword [ebp - 0x156c], edx
test edx, edx
je 0xc1e150
and dword [ebp - 0x15ac], 0
mov edi, esi
mov ecx, dword [ebp - 0x159c]
mov dword [ebp - 0x15c8], edi
test ecx, ecx
je 0xc1e0db
mov eax, dword [edi]
add eax, 4
cmp eax, ebx
jb 0xc1e125
add eax, edi
cmp eax, edi
jb 0xc1e125
mov edi, eax
mov eax, dword [ebp - 0x15ac]
inc eax
mov dword [ebp - 0x15c8], edi
mov dword [ebp - 0x15ac], eax
cmp eax, ecx
jb 0xc1e0b3
lea eax, [ebp - 0x19d8]
mov dword [ebp - 0x19dc], edx
push eax
mov edx, ebx
mov ecx, edi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc20744
mov eax, dword [ebp - 0x156c]
mov ecx, dword [ebp - 0x1774]
add eax, 4
mov edx, dword [ebp - 0x15c8]
add ecx, esi
add eax, edx
cmp eax, ecx
jbe 0xc1e12c
mov edi, 0xc0000023
jmp 0xc1e155
mov edi, 0xc0000095
jmp 0xc1e155
mov eax, dword [ebp - 0x156c]
push eax
push 0x9fe768
push dword [ebp - 0x19d8]
mov dword [edx], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
inc dword [ebp - 0x159c]
jmp 0xc1e15b
mov edi, 0xc000000d
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc20744
mov ecx, dword [ebp - 0x159c]
mov edi, esi
mov eax, dword [ebp - 0x16b4]
xor edx, edx
mov dword [ebp - 0x19b4], eax
mov dword [ebp - 0x156c], edi
test ecx, ecx
je 0xc1e1a3
mov eax, dword [edi]
add eax, 4
cmp eax, ebx
jb 0xc1e1fd
add eax, edi
cmp eax, edi
jb 0xc1df2b
inc edx
mov edi, eax
mov dword [ebp - 0x156c], edi
cmp edx, ecx
jb 0xc1e183
lea eax, [ebp - 0x19e0]
mov dword [ebp - 0x19e4], ebx
push eax
mov edx, ebx
mov ecx, edi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1e20a
mov edx, dword [ebp - 0x156c]
mov ecx, dword [ebp - 0x1774]
add ecx, esi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xc1dd14
mov eax, dword [ebp - 0x19e0]
mov ecx, dword [ebp - 0x16b4]
mov dword [edx], ebx
mov dword [eax], ecx
mov ecx, dword [ebp - 0x159c]
inc ecx
mov dword [ebp - 0x159c], ecx
jmp 0xc1e210
mov edi, 0xc0000095
mov dword [ebp - 0x15ac], edi
jmp 0xc1e210
mov ecx, dword [ebp - 0x159c]
test edi, edi
js 0xc20744
mov edi, esi
mov dword [ebp - 0x19b0], ebx
xor edx, edx
mov dword [ebp - 0x156c], edi
test ecx, ecx
je 0xc1e250
mov eax, dword [edi]
add eax, 4
cmp eax, ebx
jb 0xc1e2d4
add eax, edi
cmp eax, edi
jb 0xc1df2b
inc edx
mov edi, eax
mov dword [ebp - 0x156c], edi
cmp edx, ecx
jb 0xc1e22c
lea eax, [ebp - 0x19e8]
mov dword [ebp - 0x19ec], ebx
push eax
mov edx, ebx
mov ecx, edi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc20744
mov edx, dword [ebp - 0x156c]
mov ecx, dword [ebp - 0x1774]
add ecx, esi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xc1dd14
mov eax, dword [ebp - 0x19e8]
inc dword [ebp - 0x159c]
mov dword [edx], ebx
mov dword [eax], ebx
test edi, edi
js 0xc20744
lea eax, [ebp - 0x19ac]
mov edx, ebx
push eax
mov ecx, ebx
call fcn.00a32533
mov esi, dword [ebp - 0x19ac]
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
jns 0xc1e2e1
mov esi, dword [ebp - 0x1938]
jmp 0xc1e450
mov edi, 0xc0000095
mov dword [ebp - 0x15ac], edi
jmp 0xc1e29f
lea eax, [ebp - 0x19a4]
mov dword [ebp - 0x19a8], esi
push eax
push 8
pop edx
mov ecx, ebx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1e450
mov esi, dword [ebp - 0x19a4]
mov ecx, dword [ebp - 0x19a8]
lea eax, [ebp - 0x19a8]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1e450
lea eax, [ebp - 0x19a0]
mov edx, ebx
push eax
mov ecx, ebx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1e450
mov esi, dword [ebp - 0x19a0]
mov ecx, dword [ebp - 0x19a8]
lea eax, [ebp - 0x19a8]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1e450
lea eax, [ebp - 0x199c]
mov edx, ebx
push eax
mov ecx, ebx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1e450
mov esi, dword [ebp - 0x199c]
mov ecx, dword [ebp - 0x19a8]
lea eax, [ebp - 0x19a8]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1e450
lea eax, [ebp - 0x1998]
mov edx, ebx
push eax
mov ecx, ebx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1e450
mov esi, dword [ebp - 0x1998]
mov ecx, dword [ebp - 0x19a8]
lea eax, [ebp - 0x19a8]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1e450
lea eax, [ebp - 0x16e4]
mov edx, ebx
push eax
mov ecx, ebx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1e450
mov esi, dword [ebp - 0x16e4]
mov ecx, dword [ebp - 0x19a8]
lea eax, [ebp - 0x19a8]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
mov eax, dword [ebp - 0x19a8]
mov dword [ebp - 0x15ac], edi
test edi, edi
jns 0xc1e456
mov eax, dword [ebp - 0x16e4]
mov dword [ebp - 0x156c], eax
test edi, edi
js 0xc20744
xor eax, eax
mov esi, eax
mov dword [ebp - 0x15c8], eax
mov dword [ebp - 0x1590], eax
mov dword [ebp - 0x1568], eax
mov dword [ebp - 0x157c], eax
mov dword [ebp - 0x1574], eax
mov dword [ebp - 0x1564], eax
mov dword [ebp - 0x1580], eax
mov dword [ebp - 0x1554], eax
mov dword [ebp - 0x1560], eax
rdtsc
mov dword [ebp - 0x1648], esi
mov dword [ebp - 0x15ac], eax
mov dword [ebp - 0x158c], edx
push 8
pop eax
mov dword [ebp - 0x1994], eax
mov edx, dword [ebp - 0x1774]
lea ecx, [ebp - 0x1994]
push ecx
mov ecx, eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1e5c7
mov eax, dword [ebp - 0x1994]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0x1570], ecx
cmp ecx, eax
jae 0xc1e4f9
mov edi, 0xc0000095
jmp 0xc1e5c7
mov dword [ebp - 0x1994], ecx
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xc1e51f
mov edi, 0xc0000017
jmp 0xc1e5c1
mov eax, dword [ebp - 0x159c]
mov edx, ebx
mov dword [esi], eax
mov ecx, esi
lea eax, [ebp - 0x1990]
mov dword [ebp - 0x1990], esi
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1e5ad
mov ecx, dword [ebp - 0x1990]
mov edx, ebx
mov eax, dword [ebp - 0x1774]
mov dword [ecx], eax
lea eax, [ebp - 0x1990]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1e5ad
mov eax, dword [ebp - 0x1570]
push dword [ebp - 0x1774]
mov ecx, dword [ebp - 0x15ac]
push dword [ebp - 0x1584]
mov dword [esi + eax - 8], ecx
mov ecx, dword [ebp - 0x158c]
push dword [ebp - 0x1990]
mov dword [esi + eax - 4], ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0x1570]
add esp, 0xc
mov dword [ebp - 0x15c8], esi
xor esi, esi
mov dword [ebp - 0x1648], eax
test esi, esi
je 0xc1e5c1
push esi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0x1648]
or edi, 0x10000000
mov dword [ebp - 0x15ac], edi
jl 0xc2001a
xor eax, eax
mov dword [ebp - 0x1570], eax
cmp dword [ebp - 0x15c8], eax
jne 0xc1e5f3
mov edi, 0xc000000d
jmp 0xc1ec9a
test esi, esi
je 0xc1ec95
lea ecx, [esi + 8]
push ecx
push eax
mov dword [ebp - 0x158c], ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x1584], edi
test edi, edi
je 0xc1ec95
xor eax, eax
mov cl, al
test esi, esi
je 0xc1e639
mov edx, dword [ebp - 0x15c8]
xor cl, byte [eax + edx]
inc eax
cmp eax, esi
jb 0xc1e631
mov eax, esi
mov dword [ebp - 0x6d8], 0xb1b54a58
shr eax, 3
mov dword [ebp - 0x6d4], 0xc81ecb17
mov dword [ebp - 0x15ac], eax
test eax, eax
je 0xc1eac4
movzx edx, word [ebp - 0x6d6]
mov eax, 0xc81ecb17
movzx esi, ax
movzx eax, word [ebp - 0x6d2]
mov dword [ebp - 0x1594], eax
mov eax, 0xb1b54a58
movzx eax, ax
mov dword [ebp - 0x155c], eax
lea eax, [edi + 7]
mov dword [ebp - 0x15b8], esi
mov esi, dword [ebp - 0x15c8]
mov dword [ebp - 0x1598], eax
add esi, 2
xor eax, eax
mov dword [ebp - 0x1558], edx
mov dword [ebp - 0x1578], esi
or edx, 0xffffffff
mov dword [ebp - 0x15a0], eax
mov dword [ebp - 0x1588], eax
mov dword [ebp - 0x15bc], eax
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0x1578]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0x1578]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0x1578]
shl esi, 8
add dword [ebp - 0x1578], 8
movzx eax, byte [eax + 5]
or esi, eax
xor edx, esi
mov dword [ebp - 0x15b4], esi
mov eax, edx
mov dword [ebp - 0x15c4], edx
sub eax, dword [ebp - 0x155c]
mov esi, 0xc81ecb17
xor eax, edi
xor eax, dword [ebp - 0x15a0]
xor eax, esi
mov edx, eax
mov dword [ebp - 0x15a0], eax
xor edx, esi
ror eax, 7
ror edx, 0xf
imul edx, dword [ebp - 0x1558]
mov esi, dword [ebp - 0x1594]
add edx, eax
mov eax, dword [ebp - 0x15c4]
xor eax, edx
mov edx, 0xb1b54a58
add edx, eax
mov dword [ebp - 0x15c4], eax
ror edx, 9
imul edx, dword [ebp - 0x15b8]
ror eax, 0xa
sub edx, eax
mov eax, dword [ebp - 0x15a0]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x15a0], eax
xor edx, dword [ebp - 0x15b8]
rol edx, 4
imul edx, esi
rol eax, 5
add edx, eax
mov eax, dword [ebp - 0x15c4]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x15c4], eax
xor edx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, edx
mov edx, dword [ebp - 0x15a0]
xor edx, eax
mov dword [ebp - 0x15a0], edx
sub edx, dword [ebp - 0x155c]
imul edx, dword [ebp - 0x1558]
mov eax, dword [ebp - 0x15a0]
shr eax, 6
sub edx, eax
xor dword [ebp - 0x15c4], edx
mov edx, dword [ebp - 0x15c4]
mov eax, edx
ror eax, 0xf
xor eax, dword [ebp - 0x15b8]
imul eax, dword [ebp - 0x155c]
xor dword [ebp - 0x15a0], eax
mov eax, dword [ebp - 0x15a0]
not eax
ror eax, 3
add eax, esi
imul eax, dword [ebp - 0x15b8]
xor edx, eax
mov eax, edx
mov dword [ebp - 0x15c4], edx
sub eax, dword [ebp - 0x155c]
mov edx, dword [ebp - 0x15a0]
sub eax, 0xc81ecb17
xor edx, eax
mov dword [ebp - 0x15a0], edx
mov eax, dword [ebp - 0x15a0]
xor eax, esi
ror edx, 0xa
imul eax, dword [ebp - 0x1558]
xor edx, eax
mov eax, dword [ebp - 0x15c4]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x15c4], eax
xor edx, dword [ebp - 0x155c]
rol edx, 6
imul edx, dword [ebp - 0x15b8]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0x15a0]
xor eax, edx
mov edx, dword [ebp - 0x15c4]
mov dword [ebp - 0x15a0], eax
ror eax, 0xf
sub eax, esi
imul eax, dword [ebp - 0x155c]
xor edx, eax
mov dword [ebp - 0x15c4], edx
xor edx, esi
imul edx, dword [ebp - 0x155c]
mov eax, dword [ebp - 0x15c4]
shr eax, 1
xor edx, eax
mov eax, dword [ebp - 0x15c4]
xor dword [ebp - 0x15a0], edx
mov edx, eax
sub edx, dword [ebp - 0x15b8]
rol edx, 3
imul edx, dword [ebp - 0x155c]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0x15a0]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x15a0], eax
sub edx, dword [ebp - 0x15b8]
imul edx, dword [ebp - 0x1558]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x15c4]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0x15c4], eax
ror edx, 9
imul edx, dword [ebp - 0x15b8]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0x15a0]
xor eax, edx
mov edx, dword [ebp - 0x15c4]
mov dword [ebp - 0x15a0], eax
sub eax, esi
sub eax, 0xb1b54a58
xor edx, eax
mov dword [ebp - 0x15c4], edx
mov eax, dword [ebp - 0x15c4]
xor eax, dword [ebp - 0x1558]
imul eax, dword [ebp - 0x155c]
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0x15a0]
xor edx, eax
mov dword [ebp - 0x15a0], edx
xor edx, esi
rol edx, 4
imul edx, dword [ebp - 0x1558]
mov eax, dword [ebp - 0x15a0]
ror eax, 0x10
sub edx, eax
mov eax, dword [ebp - 0x15c4]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0x15c4], eax
ror edx, 0xa
imul edx, dword [ebp - 0x15b8]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0x15a0]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x15a0], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, esi
mov esi, 0xc81ecb17
xor edx, eax
mov eax, dword [ebp - 0x15c4]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x15c4], eax
xor edx, esi
rol eax, 2
rol edx, 8
imul edx, dword [ebp - 0x155c]
sub edx, eax
mov eax, dword [ebp - 0x15a0]
xor eax, edx
mov edx, esi
sub edx, eax
mov dword [ebp - 0x15a0], eax
ror edx, 0xb
imul edx, dword [ebp - 0x1558]
ror eax, 0xc
sub edx, eax
mov eax, dword [ebp - 0x15c4]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x15c4], eax
xor edx, dword [ebp - 0x1558]
imul edx, dword [ebp - 0x15b8]
shr eax, 8
xor edx, eax
mov eax, dword [ebp - 0x15a0]
xor eax, edx
mov edx, dword [ebp - 0x15c4]
xor edx, eax
xor eax, dword [ebp - 0x1588]
xor edx, esi
mov dword [ebp - 0x1588], edi
mov esi, dword [ebp - 0x1598]
xor edx, 0xb1b54a58
xor edx, dword [ebp - 0x15bc]
mov byte [esi - 4], al
mov byte [esi], dl
ror eax, 8
mov byte [esi - 5], al
ror edx, 8
mov byte [esi - 1], dl
ror eax, 8
mov byte [esi - 6], al
ror edx, 8
mov byte [esi - 2], dl
ror eax, 8
ror edx, 8
mov byte [esi - 7], al
mov byte [esi - 3], dl
mov esi, dword [ebp - 0x15b4]
ror eax, 8
mov dword [ebp - 0x15a0], eax
ror edx, 8
mov dword [ebp - 0x15bc], esi
add dword [ebp - 0x1598], 8
sub dword [ebp - 0x15ac], 1
mov esi, dword [ebp - 0x1578]
jne 0xc1e6c5
mov esi, dword [ebp - 0x1648]
mov edi, dword [ebp - 0x1584]
movzx eax, cl
cdq
mov dword [edi + esi], eax
mov dword [edi + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x15c4], esi
test esi, esi
jne 0xc1eaf6
mov edi, 0xc0000017
jmp 0xc1ebfc
mov eax, dword [ebp - 0x158c]
push eax
push 8
mov dword [esi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc1eb19
mov edi, 0xc0000017
jmp 0xc1eb94
mov dword [esi + 4], eax
push dword [ebp - 0x158c]
push edi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [esi + 8], eax
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc1eb12
mov dword [esi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
push 8
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x15c4]
pop eax
push eax
push eax
mov dword [esi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0xc1eb12
mov dword [esi + 0x14], ecx
mov eax, dword [0xc94e90]
xor edi, edi
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ebp - 0x1570], esi
xor esi, esi
mov dword [ecx + 4], eax
test esi, esi
je 0xc1ebfc
cmp dword [esi + 4], 0
je 0xc1ebb4
push dword [esi + 4]
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [esi + 4], 0
cmp dword [esi + 0xc], 0
je 0xc1ebd0
push dword [esi + 0xc]
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [esi + 0xc], 0
cmp dword [esi + 0x14], 0
je 0xc1ebec
push dword [esi + 0x14]
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [esi + 0x14], 0
push esi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0xc1ec10
mov ecx, dword [ebp - 0x1570]
xor esi, esi
mov dword [ebp - 0x1590], ecx
jmp 0xc1ec16
mov esi, dword [ebp - 0x1570]
push dword [ebp - 0x1584]
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
je 0xc1ec9a
cmp dword [esi + 4], 0
je 0xc1ec4b
push dword [esi + 4]
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [esi + 4], 0
cmp dword [esi + 0xc], 0
je 0xc1ec67
push dword [esi + 0xc]
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [esi + 0xc], 0
cmp dword [esi + 0x14], 0
je 0xc1ec83
push dword [esi + 0x14]
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [esi + 0x14], 0
push esi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc1ec9a
mov edi, 0xc0000001
or edi, 0x10000000
mov dword [ebp - 0x15ac], edi
jl 0xc2001a
mov esi, dword [ebp - 0x1590]
lea eax, [ebp - 0x198c]
push eax
mov ecx, ebx
mov dword [ebp - 0x198c], ebx
mov edx, dword [esi]
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1ed3e
mov ecx, dword [ebp - 0x198c]
lea eax, [ebp - 0x198c]
push eax
mov edx, ebx
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1ed3e
mov edx, dword [esi + 8]
lea eax, [ebp - 0x198c]
mov ecx, dword [ebp - 0x198c]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1ed3e
mov ecx, dword [ebp - 0x198c]
lea eax, [ebp - 0x198c]
push eax
mov edx, ebx
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1ed3e
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0x198c]
mov ecx, dword [ebp - 0x198c]
push eax
call fcn.00a32533
mov edi, eax
mov eax, dword [ebp - 0x198c]
test edi, edi
jns 0xc1ed44
mov eax, dword [ebp - 0x1988]
mov dword [ebp - 0x15c4], eax
test edi, edi
js 0xc1eeb3
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xc1ed72
mov edi, 0xc0000017
jmp 0xc1eeb3
mov ecx, dword [ebp - 0x1590]
mov edx, ebx
mov dword [ebp - 0x1984], esi
mov eax, dword [ecx]
mov ecx, esi
mov dword [esi], eax
lea eax, [ebp - 0x1984]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1ee9f
mov edi, dword [ebp - 0x1590]
push dword [edi]
push dword [edi + 4]
push dword [ebp - 0x1984]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi]
lea eax, [ebp - 0x1984]
mov ecx, dword [ebp - 0x1984]
add esp, 0xc
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1ee9f
mov ecx, dword [ebp - 0x1590]
mov edx, ebx
mov eax, dword [ecx + 8]
mov ecx, dword [ebp - 0x1984]
mov dword [ecx], eax
lea eax, [ebp - 0x1984]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1ee9f
mov edi, dword [ebp - 0x1590]
push dword [edi + 8]
push dword [edi + 0xc]
push dword [ebp - 0x1984]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi + 8]
lea eax, [ebp - 0x1984]
mov ecx, dword [ebp - 0x1984]
add esp, 0xc
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1ee9f
mov ecx, dword [ebp - 0x1590]
mov edx, ebx
mov eax, dword [ecx + 0x10]
mov ecx, dword [ebp - 0x1984]
mov dword [ecx], eax
lea eax, [ebp - 0x1984]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1ee9f
mov edi, dword [ebp - 0x1590]
push dword [edi + 0x10]
push dword [edi + 0x14]
push dword [ebp - 0x1984]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0x1984]
mov ecx, dword [ebp - 0x1984]
add esp, 0xc
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1ee9f
mov eax, dword [ebp - 0x15c4]
mov dword [ebp - 0x1568], esi
xor esi, esi
mov dword [ebp - 0x157c], eax
test esi, esi
je 0xc1eeb3
push esi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or edi, 0x10000000
mov dword [ebp - 0x15ac], edi
jl 0xc2001a
push 8
xor eax, eax
pop esi
mov dword [ebp - 0x15c4], eax
mov dword [ebp - 0x15b4], eax
mov dword [ebp - 0x1980], esi
mov edx, dword [ebp - 0x156c]
lea eax, [ebp - 0x1980]
push eax
mov ecx, esi
call fcn.00a32533
mov edi, eax
or edi, 0x10000000
mov dword [ebp - 0x15ac], edi
jl 0xc1ef68
mov eax, dword [ebp - 0x1980]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xc1ef1d
mov edi, 0xc0000095
mov dword [ebp - 0x15ac], edi
jmp 0xc1ef43
mov dword [ebp - 0x1978], ecx
lea eax, [ebp - 0x1978]
mov edx, esi
push eax
call fcn.00a32533
mov edi, eax
mov eax, dword [ebp - 0x1978]
mov dword [ebp - 0x15ac], edi
test edi, edi
jns 0xc1ef49
mov eax, dword [ebp - 0x197c]
mov dword [ebp - 0x15bc], eax
test edi, edi
js 0xc1ef68
mov eax, dword [ebp - 0x15c0]
test eax, eax
jne 0xc1ef9e
mov edi, 0xc000000d
mov dword [ebp - 0x15ac], edi
mov esi, dword [ebp - 0x1564]
test edi, edi
js 0xc2001a
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc1f1ef
mov ecx, dword [ebp - 0x1574]
mov edi, 0xd0000017
jmp 0xc1f1fc
mov esi, dword [ebp - 0x159c]
xor ecx, ecx
inc ecx
cmp esi, ecx
jbe 0xc1ef5d
and dword [ebp - 0x1588], 0
mov ecx, eax
mov dword [ebp - 0x16e8], ecx
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0x15a0], eax
lea eax, [ebp - 0x16e8]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1ef68
mov edx, dword [ebp - 0x15a0]
lea eax, [ebp - 0x16e8]
mov ecx, dword [ebp - 0x16e8]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1ef68
mov eax, dword [ebp - 0x1588]
xor ecx, ecx
inc eax
inc ecx
cmp eax, ecx
mov dword [ebp - 0x1588], eax
mov ecx, dword [ebp - 0x16e8]
jb 0xc1efba
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0x1588], eax
lea eax, [ebp - 0x16e8]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1ef68
mov eax, dword [ebp - 0x1588]
mov dword [ebp - 0x15c4], eax
neg eax
sbb eax, eax
and dword [ebp - 0x16e8], eax
test edi, edi
js 0xc1ef68
cmp esi, 2
jbe 0xc1ef5d
mov ecx, dword [ebp - 0x15c0]
xor esi, esi
mov dword [ebp - 0x16ec], ecx
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0x1588], eax
lea eax, [ebp - 0x16ec]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1ef68
mov edx, dword [ebp - 0x1588]
lea eax, [ebp - 0x16ec]
mov ecx, dword [ebp - 0x16ec]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1ef68
mov ecx, dword [ebp - 0x16ec]
inc esi
cmp esi, 2
jb 0xc1f079
mov esi, dword [ecx]
lea eax, [ebp - 0x16ec]
push eax
mov edx, ebx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1ef68
mov dword [ebp - 0x15b4], esi
neg esi
sbb esi, esi
and dword [ebp - 0x16ec], esi
test edi, edi
js 0xc1ef68
mov edx, dword [ebp - 0x15bc]
lea eax, [ebp - 0x16f0]
push eax
mov ecx, ebx
mov dword [ebp - 0x16f0], ebx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1f1c3
mov ecx, dword [ebp - 0x16f0]
lea eax, [ebp - 0x16f0]
push eax
mov edx, ebx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1f1c3
mov edx, dword [ebp - 0x15c4]
lea eax, [ebp - 0x16f0]
mov ecx, dword [ebp - 0x16f0]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1f1c3
mov ecx, dword [ebp - 0x16f0]
lea eax, [ebp - 0x16f0]
push eax
mov edx, ebx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1f1c3
mov edx, dword [ebp - 0x15b4]
lea eax, [ebp - 0x16f0]
mov ecx, dword [ebp - 0x16f0]
push eax
call fcn.00a32533
mov edi, eax
mov eax, dword [ebp - 0x16f0]
mov dword [ebp - 0x15ac], edi
test edi, edi
jns 0xc1f1d1
mov eax, dword [ebp - 0x1974]
test edi, edi
js 0xc1ef68
cmp eax, 0x400000
jbe 0xc1f1e2
mov edi, 0x8000ffff
jmp 0xc20014
mov esi, eax
mov dword [ebp - 0x1564], esi
jmp 0xc1ef6e
mov ecx, eax
mov dword [ebp - 0x1574], ecx
mov edi, 0x10000000
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc2001a
mov eax, dword [ebp - 0x1568]
test eax, eax
jne 0xc1f21e
mov edi, 0x80070057
jmp 0xc20014
test ecx, ecx
je 0xc1f214
and dword [ebp - 0x1bbc], 0
mov dword [ebp - 0x1bcc], eax
mov eax, dword [ebp - 0x157c]
mov dword [ebp - 0x1bc4], eax
lea eax, [ebp - 0x1970]
push eax
xor eax, eax
mov dword [ebp - 0x1bc8], ecx
push 0x9f29b8
inc eax
mov dword [ebp - 0x1bc0], esi
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xc1f29a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
jle 0xc1f284
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc1f31a
mov edi, 0x80004005
mov dword [ebp - 0x15ac], edi
jmp 0xc1f31a
push 0x9fc030
push dword [ebp - 0x1970]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0xc1f2dc
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
jle 0xc1f2d4
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x15ac], edi
test edi, edi
mov esi, dword [ebp - 0x1564]
jmp 0xc1f284
push 0
push 0x14
lea eax, [ebp - 0x1bcc]
mov ecx, esi
push eax
push 0x86
call dword [0xc99200]
call esi
mov edi, eax
or edi, 0x10000000
mov dword [ebp - 0x15ac], edi
jl 0xc1f314
mov esi, dword [ebp - 0x1bc0]
mov dword [ebp - 0x1564], esi
jmp 0xc1f31a
mov esi, dword [ebp - 0x1564]
cmp edi, 0xd0000023
jne 0xc1f32c
mov edi, 0x8007007a
jmp 0xc20014
test edi, edi
js 0xc2001a
and dword [ebp - 0x15c4], 0
and dword [ebp - 0x16f4], 0
mov eax, dword [ebp - 0x1574]
mov dword [ebp - 0x16f8], eax
cmp esi, ebx
jae 0xc1f35c
mov edi, 0xc000003e
jmp 0xc1f743
mov esi, dword [eax]
lea ecx, [ebp - 0x16f8]
push ecx
mov edx, ebx
mov dword [ebp - 0x15b4], esi
mov ecx, eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1f743
lea eax, [ebp - 0x16f4]
mov edx, ebx
push eax
xor ecx, ecx
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1f743
mov eax, dword [ebp - 0x1564]
sub eax, dword [ebp - 0x16f4]
cmp eax, esi
jb 0xc1f352
mov eax, dword [ebp - 0x16f8]
lea ecx, [ebp - 0x16f8]
push ecx
mov edx, esi
mov dword [ebp - 0x15bc], eax
mov ecx, eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1f743
mov ecx, dword [ebp - 0x16f4]
lea eax, [ebp - 0x16f4]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1f743
mov eax, dword [ebp - 0x1564]
sub eax, dword [ebp - 0x16f4]
cmp eax, ebx
jb 0xc1f352
mov ecx, dword [ebp - 0x16f8]
lea eax, [ebp - 0x16f8]
push eax
mov edx, ebx
mov esi, dword [ecx]
mov dword [ebp - 0x1588], esi
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1f743
mov ecx, dword [ebp - 0x16f4]
lea eax, [ebp - 0x16f4]
push eax
mov edx, ebx
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1f743
mov eax, dword [ebp - 0x1564]
sub eax, dword [ebp - 0x16f4]
cmp eax, esi
jb 0xc1f352
mov eax, dword [ebp - 0x16f8]
lea ecx, [ebp - 0x16f8]
push ecx
mov edx, esi
mov dword [ebp - 0x15a0], eax
mov ecx, eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1f743
mov ecx, dword [ebp - 0x16f4]
lea eax, [ebp - 0x16f4]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1f743
mov eax, dword [ebp - 0x1564]
sub eax, dword [ebp - 0x16f4]
cmp eax, ebx
jb 0xc1f352
mov ecx, dword [ebp - 0x16f8]
mov edx, ebx
mov eax, dword [ecx]
mov dword [ebp - 0x1578], eax
lea eax, [ebp - 0x16f8]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1f743
mov ecx, dword [ebp - 0x16f4]
lea eax, [ebp - 0x16f4]
push eax
mov edx, ebx
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1f743
mov eax, dword [ebp - 0x1564]
sub eax, dword [ebp - 0x16f4]
mov ecx, dword [ebp - 0x1578]
cmp eax, ecx
jb 0xc1f352
lea eax, [ebp - 0x16f4]
mov edx, ecx
mov ecx, dword [ebp - 0x16f4]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc1f743
mov edx, dword [ebp - 0x1564]
mov eax, edx
sub eax, dword [ebp - 0x16f4]
jne 0xc1f352
mov edi, dword [ebp - 0x15b4]
mov ecx, dword [ebp - 0x1578]
add ecx, 0xc
lea eax, [esi + edi]
add eax, ecx
cmp eax, edx
jne 0xc1f352
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xc1f57d
mov edi, 0xc0000017
jmp 0xc1f6c1
cmp dword [ebp - 0x15bc], 0
je 0xc1f5bf
push edi
push 8
mov dword [esi], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc1f5a8
mov edi, 0xc0000017
xor eax, eax
jmp 0xc1f65a
mov dword [esi + 4], eax
push edi
push dword [ebp - 0x15bc]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc1f5c6
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
cmp dword [ebp - 0x15a0], 0
je 0xc1f603
mov edi, dword [ebp - 0x1588]
push edi
push 8
mov dword [esi + 8], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc1f59c
mov dword [esi + 0xc], eax
push edi
push dword [ebp - 0x15a0]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc1f609
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
cmp dword [ebp - 0x16f8], 0
je 0xc1f64a
mov edi, dword [ebp - 0x1578]
push edi
push 8
mov dword [esi + 0x10], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc1f59c
mov dword [esi + 0x14], eax
push edi
push dword [ebp - 0x16f8]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc1f650
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [ebp - 0x15c4], esi
mov edi, eax
mov esi, eax
test esi, esi
je 0xc1f6c1
cmp dword [esi + 4], 0
je 0xc1f679
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [esi + 4], 0
cmp dword [esi + 0xc], 0
je 0xc1f695
push dword [esi + 0xc]
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [esi + 0xc], 0
cmp dword [esi + 0x14], 0
je 0xc1f6b1
push dword [esi + 0x14]
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [esi + 0x14], 0
push esi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0xc1f6d5
mov ecx, dword [ebp - 0x15c4]
xor esi, esi
mov dword [ebp - 0x1580], ecx
jmp 0xc1f6db
mov esi, dword [ebp - 0x15c4]
test esi, esi
je 0xc1f743
cmp dword [esi + 4], 0
je 0xc1f6fb
push dword [esi + 4]
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [esi + 4], 0
cmp dword [esi + 0xc], 0
je 0xc1f717
push dword [esi + 0xc]
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [esi + 0xc], 0
cmp dword [esi + 0x14], 0
je 0xc1f733
push dword [esi + 0x14]
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [esi + 0x14], 0
push esi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or edi, 0x10000000
mov dword [ebp - 0x15ac], edi
jl 0xc2001a
and dword [ebp - 0x15c4], 0
and dword [ebp - 0x15b4], 0
mov eax, dword [ebp - 0x1580]
test eax, eax
jne 0xc1f777
mov edi, 0xd000000d
jmp 0xc20014
mov edi, dword [eax + 4]
mov dword [ebp - 0x15bc], edi
test edi, edi
je 0xc1f76d
mov esi, dword [eax]
test esi, esi
je 0xc1f76d
add esi, 0xfffffff8
push esi
push 0
mov dword [ebp - 0x1588], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x15a0], ecx
test ecx, ecx
je 0xc1fdd6
mov dword [ebp - 0x1598], ecx
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x6d0], 0xab69605e
and ecx, 7
mov dword [ebp - 0x6cc], 0x7f1137f
mov dl, al
mov dword [ebp - 0x1578], edi
mov dword [ebp - 0x15b8], ecx
mov dword [ebp - 0x1594], eax
je 0xc1fd84
mov dword [ebp - 0x1558], eax
mov esi, eax
mov dword [ebp - 0x155c], esi
test ecx, ecx
je 0xc1f85e
push 0x38
pop edi
mov ecx, dword [ebp - 0x1578]
movzx esi, byte [ecx]
inc ecx
mov dword [ebp - 0x1578], ecx
cmp dword [ebp - 0x1594], ebx
jge 0xc1f828
lea ecx, [edi - 0x20]
shl esi, cl
or dword [ebp - 0x155c], esi
jmp 0xc1f832
mov ecx, edi
shl esi, cl
or dword [ebp - 0x1558], esi
mov esi, dword [ebp - 0x1594]
sub edi, 8
mov ecx, dword [ebp - 0x15b8]
inc esi
mov dword [ebp - 0x1594], esi
cmp esi, ecx
jl 0xc1f803
mov esi, dword [ebp - 0x1578]
mov dword [ebp - 0x1578], esi
mov esi, dword [ebp - 0x155c]
mov edi, dword [ebp - 0x1558]
xor esi, 0x92f65a5
xor edi, 0x699a899c
mov dword [ebp - 0x1594], esi
mov dword [ebp - 0x1570], edi
mov dword [ebp - 0x158c], esi
mov dword [ebp - 0x1564], edi
mov dword [ebp - 0x157c], eax
test ecx, ecx
je 0xc1f8f9
mov esi, dword [ebp - 0x1598]
lea edi, [esi + 1]
mov dword [ebp - 0x1598], edi
cmp dword [ebp - 0x157c], ebx
jge 0xc1f8b8
rol dword [ebp - 0x158c], 8
mov ecx, dword [ebp - 0x158c]
jmp 0xc1f8c5
rol dword [ebp - 0x1564], 8
mov ecx, dword [ebp - 0x1564]
mov dword [ebp - 0x156c], ecx
mov byte [esi], cl
inc dword [ebp - 0x157c]
mov ecx, dword [ebp - 0x15b8]
mov esi, dword [ebp - 0x1598]
cmp dword [ebp - 0x157c], ecx
jl 0xc1f898
mov edi, dword [ebp - 0x1570]
mov dword [ebp - 0x1598], esi
mov esi, dword [ebp - 0x1594]
cmp ecx, ebx
jbe 0xc1fd5e
push 8
pop ecx
sub ecx, dword [ebp - 0x15b8]
shl ecx, 3
shr edi, cl
shl edi, cl
mov dword [ebp - 0x1570], edi
mov esi, dword [ebp - 0x1588]
mov edi, dword [ebp - 0x1578]
mov ecx, esi
shr ecx, 3
mov dword [ebp - 0x1578], ecx
test ecx, ecx
je 0xc1fd23
movzx ecx, word [ebp - 0x6ca]
mov ebx, 0x7f1137f
movzx esi, word [ebp - 0x6ce]
movzx eax, bx
xor ebx, 0xab69605e
mov dword [ebp - 0x1564], ecx
mov ecx, 0xab69605e
mov dword [ebp - 0x158c], eax
movzx eax, cx
mov ecx, dword [ebp - 0x1594]
mov dword [ebp - 0x156c], eax
mov eax, dword [ebp - 0x1598]
add eax, 7
mov dword [ebp - 0x157c], esi
mov dword [ebp - 0x15b8], ebx
lea esi, [edi + 2]
mov dword [ebp - 0x1598], eax
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor ecx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
shl edi, 8
add esi, 8
or edi, eax
mov dword [ebp - 0x159c], esi
mov eax, dword [ebp - 0x1570]
xor eax, edi
xor eax, ecx
xor eax, 0x7f1137f
xor eax, 0xab69605e
mov dword [ebp - 0x1570], eax
mov esi, eax
rol dword [ebp - 0x1570], 0xa
sub eax, 0xab69605e
rol eax, 5
imul eax, dword [ebp - 0x158c]
add eax, dword [ebp - 0x1570]
xor ecx, eax
mov eax, 0x7f1137f
mov dword [ebp - 0x1594], ecx
add ecx, eax
mov eax, dword [ebp - 0x1594]
ror ecx, 9
imul ecx, dword [ebp - 0x157c]
rol eax, 2
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
sub ecx, dword [ebp - 0x158c]
imul ecx, dword [ebp - 0x156c]
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0x1594]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x1594], eax
xor ecx, dword [ebp - 0x157c]
rol ecx, 6
imul ecx, dword [ebp - 0x1564]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, 0xab69605e
xor ecx, esi
sub eax, ecx
mov ecx, dword [ebp - 0x1594]
xor ecx, eax
mov eax, dword [ebp - 0x158c]
mov dword [ebp - 0x1594], ecx
xor eax, dword [ebp - 0x1594]
imul eax, dword [ebp - 0x157c]
ror ecx, 6
xor ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov eax, esi
rol eax, 2
lea ecx, [ecx + esi]
ror ecx, 0xf
imul ecx, dword [ebp - 0x156c]
add ecx, eax
mov eax, dword [ebp - 0x1594]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x1594], eax
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0x1564]
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, 0xab69605e
ror eax, 0xa
ror ecx, 0xc
imul ecx, dword [ebp - 0x158c]
xor ecx, eax
mov eax, dword [ebp - 0x1594]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x1594], eax
xor ecx, dword [ebp - 0x1564]
imul ecx, dword [ebp - 0x157c]
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov ecx, dword [ebp - 0x1594]
mov eax, esi
not eax
ror eax, 5
add eax, dword [ebp - 0x156c]
imul eax, dword [ebp - 0x1564]
xor ecx, eax
mov eax, ecx
mov dword [ebp - 0x1594], ecx
sub eax, dword [ebp - 0x1564]
xor eax, esi
mov esi, dword [ebp - 0x1594]
xor eax, 0xab69605e
mov ecx, eax
mov dword [ebp - 0x1570], eax
xor ecx, dword [ebp - 0x1564]
rol ecx, 2
imul ecx, dword [ebp - 0x158c]
shr eax, 2
add ecx, eax
xor esi, ecx
mov eax, esi
rol eax, 7
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul ecx, dword [ebp - 0x157c]
add ecx, eax
mov eax, dword [ebp - 0x1570]
xor eax, ecx
mov dword [ebp - 0x1570], eax
mov ecx, eax
mov eax, dword [ebp - 0x158c]
xor eax, dword [ebp - 0x1570]
imul eax, dword [ebp - 0x156c]
ror ecx, 9
add ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0x157c]
rol ecx, 5
imul ecx, dword [ebp - 0x1564]
rol eax, 7
add ecx, eax
xor dword [ebp - 0x1570], ecx
mov ecx, dword [ebp - 0x1570]
xor esi, ecx
xor esi, dword [ebp - 0x15b8]
mov eax, esi
ror eax, 3
sub eax, dword [ebp - 0x157c]
imul eax, dword [ebp - 0x158c]
xor ecx, eax
mov dword [ebp - 0x1570], ecx
sub ecx, 0x7f1137f
mov eax, dword [ebp - 0x1570]
ror ecx, 1
imul ecx, dword [ebp - 0x156c]
ror eax, 6
sub ecx, eax
xor esi, ecx
mov ecx, 0xab69605e
mov eax, esi
rol eax, 0xe
lea ecx, [esi + ecx]
rol ecx, 3
imul ecx, dword [ebp - 0x1564]
add ecx, eax
mov eax, dword [ebp - 0x1570]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0x1570], eax
rol ecx, 0xf
imul ecx, dword [ebp - 0x158c]
ror eax, 0xe
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0x156c]
imul ecx, dword [ebp - 0x157c]
shr eax, 3
xor ecx, eax
mov eax, dword [ebp - 0x1570]
xor eax, ecx
mov ecx, 0x7f1137f
xor ecx, eax
mov dword [ebp - 0x1570], eax
rol ecx, 4
imul ecx, dword [ebp - 0x156c]
rol eax, 2
xor ecx, eax
mov eax, dword [ebp - 0x1570]
xor ecx, dword [ebp - 0x155c]
xor eax, dword [ebp - 0x1558]
xor esi, ecx
mov ecx, esi
mov dword [ebp - 0x1594], esi
mov esi, dword [ebp - 0x1598]
mov dword [ebp - 0x155c], ebx
mov dword [ebp - 0x1558], edi
mov byte [esi - 4], cl
mov byte [esi], al
ror ecx, 8
mov byte [esi - 5], cl
ror eax, 8
mov byte [esi - 1], al
ror ecx, 8
mov byte [esi - 6], cl
ror eax, 8
mov byte [esi - 2], al
ror ecx, 8
ror eax, 8
mov byte [esi - 7], cl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror ecx, 8
sub dword [ebp - 0x1578], 1
mov dword [ebp - 0x1598], esi
mov esi, dword [ebp - 0x159c]
mov dword [ebp - 0x1570], eax
jne 0xc1f990
mov esi, dword [ebp - 0x1588]
xor eax, eax
push 4
pop ebx
mov ecx, dword [ebp - 0x15a0]
test esi, esi
je 0xc1fd35
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0xc1fd2d
mov edi, dword [ebp - 0x15bc]
movzx eax, dl
cdq
cmp eax, dword [esi + edi]
jne 0xc1fd9c
cmp edx, dword [esi + edi + 4]
jne 0xc1fd9c
mov edi, ecx
mov dword [ebp - 0x15b4], esi
xor ecx, ecx
mov dword [ebp - 0x15c4], edi
xor esi, esi
jmp 0xc1fda3
mov dword [ebp - 0x1570], eax
jae 0xc1f917
mov ecx, ebx
sub ecx, dword [ebp - 0x15b8]
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0x1594], esi
jmp 0xc1f917
or dword [ebp - 0x1558], 0xffffffff
mov dword [ebp - 0x155c], eax
mov dword [ebp - 0x1570], eax
jmp 0xc1f923
mov esi, 0xc004d501
xor edi, edi
test ecx, ecx
je 0xc1fdb7
push ecx
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc1fdd6
mov esi, dword [ebp - 0x15b4]
xor eax, eax
mov dword [ebp - 0x1554], edi
mov edi, 0x10000000
mov dword [ebp - 0x1560], esi
jmp 0xc1fde7
mov eax, dword [ebp - 0x15c4]
mov edi, 0xd0000001
mov esi, dword [ebp - 0x1560]
mov dword [ebp - 0x15ac], edi
test eax, eax
je 0xc1fe01
push eax
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0xc2001a
and dword [ebp - 0x16fc], 0
mov ecx, dword [ebp - 0x1554]
mov dword [ebp - 0x1700], ecx
cmp esi, ebx
jb 0xc20009
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0x15c4], eax
lea eax, [ebp - 0x1700]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc2000e
lea eax, [ebp - 0x16fc]
mov edx, ebx
push eax
xor ecx, ecx
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc2000e
mov eax, esi
sub eax, dword [ebp - 0x16fc]
cmp eax, ebx
jb 0xc20009
mov ecx, dword [ebp - 0x1700]
lea eax, [ebp - 0x1700]
push eax
mov edx, ebx
mov esi, dword [ecx]
mov dword [ebp - 0x15b4], esi
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc2000e
mov ecx, dword [ebp - 0x16fc]
lea eax, [ebp - 0x16fc]
push eax
mov edx, ebx
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc2000e
mov eax, dword [ebp - 0x1560]
mov ecx, dword [ebp - 0x16fc]
sub eax, ecx
cmp eax, esi
jb 0xc20009
lea eax, [ebp - 0x16fc]
mov edx, esi
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc2000e
mov edx, dword [ebp - 0x1560]
mov edi, dword [ebp - 0x1554]
mov ecx, dword [ebp - 0x1700]
add ecx, esi
lea eax, [edx + edi]
cmp eax, ecx
jb 0xc20009
mov ecx, dword [ebp - 0x1700]
sub edx, esi
sub edx, ecx
add edx, edi
cmp edx, 8
jae 0xc20009
xor eax, eax
mov dword [ebp - 0x1588], eax
mov edx, eax
mov dword [ebp - 0x15bc], edx
mov edi, eax
test ecx, ecx
je 0xc1ff8c
mov edx, dword [ebp - 0x15b4]
lea eax, [ebp - 0x16a4]
push eax
mov esi, ecx
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc2000e
mov ecx, dword [ebp - 0x16a4]
jmp 0xc1ff78
lea eax, [esi + 4]
cmp eax, esi
jb 0xc1ffc1
cmp eax, ecx
ja 0xc1ffba
mov eax, dword [esi]
add eax, 4
cmp eax, ebx
jb 0xc1ffb3
add eax, esi
cmp eax, esi
jb 0xc1ffc1
mov esi, eax
xor edi, edi
cmp esi, ecx
ja 0xc1ffba
inc dword [ebp - 0x1588]
cmp esi, ecx
jb 0xc1ff50
cmp esi, ecx
jne 0xc1ffba
mov esi, dword [ebp - 0x15b4]
mov edx, dword [ebp - 0x15bc]
test esi, esi
je 0xc1ffca
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edx, eax
mov dword [ebp - 0x15bc], edx
test edx, edx
jne 0xc1ffc8
mov edi, 0xc0000017
jmp 0xc1fff7
mov edi, 0xc0000095
jmp 0xc1fff7
mov edi, 0xc000000d
jmp 0xc2000e
mov edi, 0xc0000095
jmp 0xc2000e
xor edi, edi
mov eax, dword [ebp - 0x1700]
test eax, eax
je 0xc1ffe5
push esi
push eax
push edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebp - 0x15bc]
add esp, 0xc
mov eax, dword [ebp - 0x1588]
mov dword [ebp - 0x1ac0], edx
mov dword [ebp - 0x1ac8], eax
test edi, edi
js 0xc2000e
mov eax, dword [ebp - 0x15c4]
cmp eax, dword [ebp - 0x1ac8]
je 0xc2000e
mov edi, 0xc000003e
or edi, 0x10000000
mov dword [ebp - 0x15ac], edi
mov eax, dword [ebp - 0x15c8]
test eax, eax
je 0xc20034
push eax
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0x1590]
test esi, esi
je 0xc200a2
cmp dword [esi + 4], 0
je 0xc2005a
push dword [esi + 4]
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [esi + 4], 0
cmp dword [esi + 0xc], 0
je 0xc20076
push dword [esi + 0xc]
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [esi + 0xc], 0
cmp dword [esi + 0x14], 0
je 0xc20092
push dword [esi + 0x14]
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [esi + 0x14], 0
push esi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1568]
test eax, eax
je 0xc200bc
push eax
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1574]
test eax, eax
je 0xc200d6
push eax
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0x1580]
test esi, esi
je 0xc20144
cmp dword [esi + 4], 0
je 0xc200fc
push dword [esi + 4]
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [esi + 4], 0
cmp dword [esi + 0xc], 0
je 0xc20118
push dword [esi + 0xc]
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [esi + 0xc], 0
cmp dword [esi + 0x14], 0
je 0xc20134
push dword [esi + 0x14]
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [esi + 0x14], 0
push esi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1554]
test eax, eax
je 0xc2015e
push eax
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0xc20744
xor eax, eax
inc eax
cmp dword [ebp - 0x1ac8], eax
jb 0xc20739
cmp dword [ebp - 0x1ac0], 0
jne 0xc20202
mov edi, 0xc000000d
mov dword [ebp - 0x15ac], edi
xor eax, eax
test edi, edi
js 0xc20744
cmp eax, 0xd0000023
jne 0xc201a9
mov eax, 0x8007007a
mov dword [ebp - 0x15f0], eax
cmp eax, 0x8007007a
je 0xc201c0
mov edi, eax
mov dword [ebp - 0x15ac], edi
test eax, eax
js 0xc20744
cmp dword [ebp - 0x1ac8], 6
jne 0xc20739
cmp dword [ebp - 0x1ac0], 0
jne 0xc20274
mov edx, dword [ebp - 0x19f4]
mov edi, 0xc000000d
mov ecx, dword [ebp - 0x19f8]
mov dword [ebp - 0x15ac], edi
mov dword [ebp - 0x15c4], edx
mov dword [ebp - 0x15b4], ecx
jmp 0xc2034a
cmp dword [ebp - 0x1ac8], 0
jbe 0xc20182
mov ecx, dword [ebp - 0x1ac0]
lea eax, [ebp - 0x166c]
push eax
mov edx, ebx
mov dword [ebp - 0x166c], ecx
mov esi, dword [ecx]
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc2024b
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x166c]
mov dword [ebp - 0x166c], eax
jmp 0xc20257
mov esi, dword [ebp - 0x196c]
mov eax, dword [ebp - 0x1968]
test edi, edi
js 0xc2018d
cmp esi, ebx
jne 0xc1dd14
mov eax, dword [eax]
mov dword [ebp - 0x15f0], eax
jmp 0xc2018f
mov ecx, dword [ebp - 0x1ac0]
xor esi, esi
mov dword [ebp - 0x1630], ecx
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0x15c4], eax
lea eax, [ebp - 0x1630]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc20306
mov edx, dword [ebp - 0x15c4]
lea eax, [ebp - 0x1630]
mov ecx, dword [ebp - 0x1630]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc20306
mov ecx, dword [ebp - 0x1630]
xor eax, eax
inc esi
inc eax
cmp esi, eax
jb 0xc20282
mov esi, dword [ecx]
lea eax, [ebp - 0x1630]
push eax
mov edx, ebx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc20306
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1630]
mov dword [ebp - 0x1630], eax
jmp 0xc20312
mov esi, dword [ebp - 0x1964]
mov eax, dword [ebp - 0x1960]
test edi, edi
js 0xc20332
cmp esi, 8
jne 0xc1dd14
mov ecx, dword [eax]
mov dword [ebp - 0x15b4], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x15c4], ecx
jmp 0xc2034a
mov eax, dword [ebp - 0x19f4]
mov dword [ebp - 0x15c4], eax
mov eax, dword [ebp - 0x19f8]
mov dword [ebp - 0x15b4], eax
test edi, edi
js 0xc20744
cmp dword [ebp - 0x1ac0], 0
jne 0xc20391
mov edi, 0xc000000d
mov dword [ebp - 0x15ac], edi
mov eax, dword [ebp - 0x195c]
mov dword [ebp - 0x15bc], eax
test edi, edi
js 0xc20744
cmp dword [ebp - 0x1ac0], 0
jne 0xc20444
mov edi, 0xc000000d
jmp 0xc2073e
mov ecx, dword [ebp - 0x1ac0]
xor esi, esi
mov dword [ebp - 0x15e4], ecx
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0x15bc], eax
lea eax, [ebp - 0x15e4]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc20421
mov edx, dword [ebp - 0x15bc]
lea eax, [ebp - 0x15e4]
mov ecx, dword [ebp - 0x15e4]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc20421
mov ecx, dword [ebp - 0x15e4]
inc esi
cmp esi, 2
jb 0xc2039f
mov esi, dword [ecx]
lea eax, [ebp - 0x15e4]
push eax
mov edx, ebx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc20421
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x15e4]
mov dword [ebp - 0x15e4], eax
jmp 0xc2042d
mov esi, dword [ebp - 0x1958]
mov eax, dword [ebp - 0x1954]
test edi, edi
js 0xc20366
cmp esi, ebx
jne 0xc1dd14
mov eax, dword [eax]
jmp 0xc2036c
mov ecx, dword [ebp - 0x1ac0]
xor esi, esi
mov dword [ebp - 0x15d0], ecx
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0x1588], eax
lea eax, [ebp - 0x15d0]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc204d8
mov edx, dword [ebp - 0x1588]
lea eax, [ebp - 0x15d0]
mov ecx, dword [ebp - 0x15d0]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc204d8
mov ecx, dword [ebp - 0x15d0]
inc esi
cmp esi, 3
jb 0xc20452
mov esi, dword [ecx]
lea eax, [ebp - 0x15d0]
push eax
mov edx, ebx
mov dword [ebp - 0x1588], esi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc204d8
neg esi
sbb esi, esi
and esi, dword [ebp - 0x15d0]
mov dword [ebp - 0x15d0], esi
jmp 0xc204ea
mov eax, dword [ebp - 0x1950]
mov esi, dword [ebp - 0x194c]
mov dword [ebp - 0x1588], eax
test edi, edi
js 0xc20744
mov ecx, dword [ebp - 0x1ac0]
xor eax, eax
mov dword [ebp - 0x15a0], eax
mov edx, dword [ecx]
mov dword [ebp - 0x1578], edx
lea edx, [ecx + 4]
cmp edx, ecx
jb 0xc20513
mov edi, eax
jmp 0xc2051b
mov edi, 0xc0000095
or edx, 0xffffffff
mov dword [ebp - 0x15ac], edi
mov dword [ebp - 0x1654], edx
test edi, edi
js 0xc205b1
mov ecx, dword [ebp - 0x1578]
add ecx, edx
mov edi, ecx
mov dword [ebp - 0x1578], edi
cmp ecx, edx
jae 0xc20546
or ecx, 0xffffffff
cmp edi, edx
mov dword [ebp - 0x1654], ecx
sbb edi, edi
and edi, 0xc0000095
mov dword [ebp - 0x15ac], edi
cmp dword [ebp - 0x1578], edx
jb 0xc205b1
mov edi, dword [ebp - 0x15a0]
inc edi
mov dword [ebp - 0x15a0], edi
cmp edi, ebx
jb 0xc20500
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0x15a0], eax
lea eax, [ebp - 0x1654]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc205b1
mov ecx, dword [ebp - 0x15a0]
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1654]
mov dword [ebp - 0x1654], eax
jmp 0xc205bd
mov ecx, dword [ebp - 0x1948]
mov eax, dword [ebp - 0x1944]
test edi, edi
js 0xc205cd
cmp ecx, ebx
jne 0xc1dd14
mov eax, dword [eax]
jmp 0xc205d3
mov eax, dword [ebp - 0x1940]
mov dword [ebp - 0x15a0], eax
test edi, edi
js 0xc20744
mov ecx, dword [ebp - 0x1ac0]
xor eax, eax
mov dword [ebp - 0x1578], eax
mov edx, dword [ecx]
mov dword [ebp - 0x1598], edx
lea edx, [ecx + 4]
cmp edx, ecx
jb 0xc20602
mov edi, eax
jmp 0xc2060a
mov edi, 0xc0000095
or edx, 0xffffffff
mov dword [ebp - 0x15ac], edi
mov dword [ebp - 0x1634], edx
test edi, edi
js 0xc206a1
mov ecx, dword [ebp - 0x1598]
add ecx, edx
mov edi, ecx
mov dword [ebp - 0x1598], edi
cmp ecx, edx
jae 0xc20635
or ecx, 0xffffffff
cmp edi, edx
mov dword [ebp - 0x1634], ecx
sbb edi, edi
and edi, 0xc0000095
mov dword [ebp - 0x15ac], edi
cmp dword [ebp - 0x1598], edx
jb 0xc206a1
mov edi, dword [ebp - 0x1578]
inc edi
mov dword [ebp - 0x1578], edi
cmp edi, 5
jb 0xc205ef
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0x1578], eax
lea eax, [ebp - 0x1634]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x15ac], edi
test edi, edi
js 0xc206a1
mov ecx, dword [ebp - 0x1578]
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1634]
mov dword [ebp - 0x1634], eax
jmp 0xc206ad
mov ecx, dword [ebp - 0x193c]
mov eax, dword [ebp - 0x1934]
test edi, edi
js 0xc206bd
cmp ecx, ebx
jne 0xc1dd14
mov ecx, dword [eax]
jmp 0xc206c3
mov ecx, dword [ebp - 0x15cc]
test edi, edi
js 0xc20744
mov eax, dword [ebp - 0x167c]
cmp eax, dword [ebp - 0x15b4]
jne 0xc20739
mov eax, dword [ebp - 0x1698]
cmp eax, dword [ebp - 0x15c4]
jne 0xc20739
mov dword [ebp - 0x16b4], ecx
cmp dword [ebp - 0x15a0], ebx
jbe 0xc20704
mov edx, dword [ebp - 0x15bc]
mov edi, 0x8007007a
mov dword [ebp - 0x1750], edx
jmp 0xc2073e
mov eax, dword [ebp - 0x1588]
cmp eax, ebx
ja 0xc206f1
push eax
push esi
mov esi, dword [ebp - 0x15a4]
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0x15bc]
add esp, 0xc
mov dword [ebp - 0x1750], eax
mov eax, dword [ebp - 0x15f0]
test eax, eax
je 0xc20744
mov edi, eax
jmp 0xc2073e
mov edi, 0xc004d501
mov dword [ebp - 0x15ac], edi
mov ecx, dword [ebp - 0x15c0]
xor eax, eax
mov dword [ebp - 0x1b0c], eax
mov dword [ebp - 0x1b10], eax
test ecx, ecx
je 0xc20774
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [ebp - 0x1b08], 0
xor eax, eax
mov ecx, dword [ebp - 0x1ac0]
mov dword [ebp - 0x1ac4], eax
mov dword [ebp - 0x1ac8], eax
test ecx, ecx
je 0xc207a2
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [ebp - 0x1ac0], 0
xor eax, eax
mov ecx, dword [ebp - 0x15a8]
test ecx, ecx
je 0xc207bb
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x15b0]
test eax, eax
je 0xc207d5
push eax
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0xc1d8a0
mov eax, dword [ebp - 0x16b4]
test eax, eax
je 0xc274d5
mov dword [0xc95878], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x588]
push eax
push 0x9d0000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0xc20848
cmp eax, esi
jne 0xc2081b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0xc20848
mov esi, dword [0xc9307c]
xor eax, eax
push 0x403
push eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x15c4], eax
test eax, eax
jne 0xc20d07
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1634], ebx
lea edi, [ebp - 0x1ae0]
mov dword [ebp - 0x1654], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x1af8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x15d0], eax
test eax, eax
je 0xc27467
push 0x28
pop ecx
mov esi, 0xc94ea0
mov dword [ebp - 0x1634], eax
mov edi, eax
rep movsd dword es:[edi], dword [esi]
push 8
pop esi
push esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x15e4], eax
test eax, eax
je 0xc27467
mov ecx, dword [0xc94e98]
mov dword [eax], ecx
mov ecx, dword [0xc94e9c]
mov dword [eax + 4], ecx
mov dword [ebp - 0x1654], eax
rdtsc
mov dword [ebp - 0x1630], eax
mov dword [ebp - 0x166c], edx
lea eax, [ebp - 0x161c]
mov dword [ebp - 0x1644], ebx
push eax
push 4
pop edi
mov edx, edi
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc27467
mov edx, dword [ebp - 0x161c]
lea eax, [ebp - 0x1644]
push eax
xor ecx, ecx
call fcn.00a32533
or eax, 0x10000000
jl 0xc27467
lea eax, [ebp - 0x1694]
mov edx, 0xa0
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc27467
mov edx, dword [ebp - 0x1694]
lea eax, [ebp - 0x1644]
mov ecx, dword [ebp - 0x1644]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xc27467
lea eax, [ebp - 0x169c]
mov edx, esi
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc27467
mov edx, dword [ebp - 0x169c]
lea eax, [ebp - 0x1644]
mov ecx, dword [ebp - 0x1644]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xc27467
lea eax, [ebp - 0x1704]
mov edx, esi
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc27467
mov edx, dword [ebp - 0x1704]
lea eax, [ebp - 0x1644]
mov ecx, dword [ebp - 0x1644]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xc27467
push dword [ebp - 0x1644]
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x1704], esi
test esi, esi
je 0xc27467
lea eax, [ebp - 0x1a04]
mov edx, edi
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc2746f
mov ecx, dword [ebp - 0x1644]
lea eax, [esi + 8]
add ecx, esi
mov dword [ebp - 0x169c], ecx
cmp eax, ecx
ja 0xc2746f
mov eax, dword [ebp - 0x1a04]
mov dword [esi], edi
mov dword [eax], edi
mov dword [ebp - 0x1708], esi
mov dword [ebp - 0x1694], ebx
mov edx, dword [esi]
lea eax, [ebp - 0x1600]
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc2746f
mov edx, dword [ebp - 0x1600]
lea eax, [ebp - 0x1708]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc2746f
mov eax, dword [ebp - 0x1694]
xor ecx, ecx
mov esi, dword [ebp - 0x1708]
inc eax
inc ecx
mov dword [ebp - 0x1694], eax
cmp eax, ecx
jb 0xc20a44
lea eax, [ebp - 0x1a0c]
mov edx, edi
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc2746f
lea eax, [esi + 0xa4]
cmp eax, dword [ebp - 0x169c]
ja 0xc2746f
mov edi, dword [ebp - 0x1a0c]
mov dword [esi], 0xa0
mov esi, dword [ebp - 0x15d0]
push 0x28
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1704]
push 4
mov dword [ebp - 0x170c], esi
mov dword [ebp - 0x1600], ebx
pop edi
mov edx, dword [esi]
lea eax, [ebp - 0x1680]
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc2746f
mov edx, dword [ebp - 0x1680]
lea eax, [ebp - 0x170c]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc2746f
mov eax, dword [ebp - 0x1600]
mov esi, dword [ebp - 0x170c]
inc eax
mov dword [ebp - 0x1600], eax
cmp eax, 2
jb 0xc20ae8
lea eax, [ebp - 0x1a14]
mov edx, edi
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc2746f
lea eax, [esi + 0xc]
cmp eax, dword [ebp - 0x169c]
ja 0xc2746f
mov edx, dword [ebp - 0x15e4]
mov ecx, dword [ebp - 0x1a14]
mov dword [esi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov esi, dword [ebp - 0x1704]
mov dword [ebp - 0x1710], esi
mov dword [ebp - 0x1680], ebx
mov edx, dword [esi]
lea eax, [ebp - 0x1714]
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc2746f
mov edx, dword [ebp - 0x1714]
lea eax, [ebp - 0x1710]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc2746f
mov eax, dword [ebp - 0x1680]
mov esi, dword [ebp - 0x1710]
inc eax
mov dword [ebp - 0x1680], eax
cmp eax, 3
jb 0xc20b89
lea eax, [ebp - 0x1a1c]
mov edx, edi
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc2746f
lea eax, [esi + 0xc]
cmp eax, dword [ebp - 0x169c]
ja 0xc2746f
mov eax, dword [ebp - 0x1a1c]
mov ecx, dword [ebp - 0x1630]
mov dword [esi], 8
mov dword [eax], ecx
mov ecx, dword [ebp - 0x166c]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x15f4]
mov edx, edi
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc2746f
mov esi, dword [ebp - 0x15f4]
lea eax, [ebp - 0x1718]
push eax
push 8
pop edx
mov ecx, edi
mov dword [ebp - 0x160c], esi
call fcn.00a32533
test eax, eax
js 0xc2746f
mov edx, dword [ebp - 0x1718]
lea eax, [ebp - 0x160c]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc2746f
rdtsc
mov dword [ebp - 0x1718], ebx
mov dword [ebp - 0x15f4], ebx
mov dword [ebp - 0x1714], ebx
mov dword [ebp - 0x1710], ebx
mov dword [ebp - 0x1680], ebx
mov dword [ebp - 0x170c], ebx
mov dword [ebp - 0x1600], ebx
mov dword [ebp - 0x1708], ebx
mov dword [ebp - 0x169c], ebx
mov dword [ebp - 0x1694], ebx
mov dword [ebp - 0x161c], eax
mov dword [ebp - 0x15d0], edx
push 8
pop eax
mov dword [ebp - 0x1914], eax
mov edx, dword [ebp - 0x1644]
lea ecx, [ebp - 0x1914]
push ecx
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc2581d
mov eax, dword [ebp - 0x1914]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0x15e4], ecx
cmp ecx, eax
jae 0xc2574a
mov esi, 0xc0000095
jmp 0xc2581d
mov esi, dword [0xc9304c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [0xc95870], eax
lea edi, [ebp - 0x7c4]
mov eax, dword [0xc95878]
mov dword [ebp - 0x15b4], eax
xor eax, eax
stosd dword es:[edi], eax
push 0x2c
mov dword [0xc95874], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push eax
mov dword [ebp - 0x1a00], eax
mov dword [ebp - 0x19fc], eax
mov dword [ebp - 0x15bc], eax
mov dword [ebp - 0x1588], eax
lea eax, [ebp - 0x910]
push eax
call fcn.00ab4bf6
add esp, 0xc
mov edx, 0xc96238
and dword [ebp - 0x15a0], 0
xor eax, eax
lea ecx, [eax + 1]
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc20d70
mov eax, dword [0xc95890]
test eax, eax
jne 0xc213e1
push 0x338
mov ebx, eax
mov dword [ebp - 0x1578], eax
push eax
mov dword [ebp - 0x1598], eax
mov dword [ebp - 0x15b8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x155c], edi
test edi, edi
je 0xc213d5
or dword [ebp - 0x1570], 0xffffffff
xor eax, eax
add edi, 7
mov dword [ebp - 0x6c8], 0xab69605e
mov dword [ebp - 0x158c], edi
mov cl, al
mov edi, 0x9fbcf2
mov dword [ebp - 0x6c4], 0x7f1137f
mov dword [ebp - 0x1594], eax
mov esi, eax
mov edx, eax
mov dword [ebp - 0x1560], edi
mov dword [ebp - 0x1554], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0x1560]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0x1560]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0x1560]
shl edi, 8
add dword [ebp - 0x1560], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0x1580], esi
add eax, 0x54969fa2
rol dword [ebp - 0x1580], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0x1580]
xor edx, eax
mov dword [ebp - 0x1564], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x1564]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x1564]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x1564], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x1564]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x1564]
xor edx, eax
mov dword [ebp - 0x1564], edx
mov eax, dword [ebp - 0x1564]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x1564]
xor eax, edx
mov dword [ebp - 0x1564], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x1564]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x1564]
xor eax, edx
mov dword [ebp - 0x1564], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x1564]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0x1564]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0x1564], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0x1564]
xor eax, 0xab69605e
mov dword [ebp - 0x1580], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1580]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x1580]
xor eax, edx
mov dword [ebp - 0x1580], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x1580], edx
mov edx, dword [ebp - 0x1580]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x1580], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1580]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x1580]
xor eax, edx
mov dword [ebp - 0x1580], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1580]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x1580]
xor eax, edx
mov dword [ebp - 0x1580], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1580]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x1580]
xor edx, dword [ebp - 0x1594]
xor eax, dword [ebp - 0x1570]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x1564], esi
mov esi, dword [ebp - 0x158c]
mov dword [ebp - 0x1570], edi
mov edi, dword [ebp - 0x1560]
mov dword [ebp - 0x1594], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x1554], 1
mov dword [ebp - 0x158c], esi
mov esi, eax
mov dword [ebp - 0x1580], eax
jne 0xc20e08
mov ebx, dword [ebp - 0x155c]
xor eax, eax
xor cl, byte [eax + ebx]
inc eax
cmp eax, 0x338
jb 0xc2118b
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc211c2
cmp edx, dword [0x9fc02c]
jne 0xc211c2
mov esi, ebx
mov dword [ebp - 0x155c], 0x337
xor ebx, ebx
mov dword [ebp - 0x15b8], esi
mov edi, ebx
jmp 0xc211d4
or dword [ebp - 0x155c], 0xffffffff
mov edi, 0xc004d501
mov esi, dword [ebp - 0x15b8]
test ebx, ebx
je 0xc211e8
push ebx
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0xc213cf
mov ecx, dword [ebp - 0x155c]
xor eax, eax
push 0x40
push eax
mov ebx, 0xc960a0
mov edi, esi
push ebx
mov byte [ecx + esi], al
call fcn.00ab4bf6
add esp, 0xc
cmp byte [esi], 0
je 0xc21366
mov edx, ebx
push 4
mov dword [ebp - 0x1558], edx
pop esi
mov ecx, edi
mov dword [ebp - 0x1598], edi
xor ebx, ebx
lea eax, [ecx + 2]
mov dword [ebp - 0x155c], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc21235
sub ecx, dword [ebp - 0x155c]
sar ecx, 1
push edx
push dword [ebp - 0x1598]
lea edi, [edi + ecx*2]
push 0
add edi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc213c8
mov edx, dword [ebp - 0x1558]
xor ecx, ecx
mov ebx, 0x5a4d
mov dword [ebp - 0x1598], ecx
mov eax, dword [edx]
cmp word [eax], bx
je 0xc2128c
mov ecx, 0xc000007b
mov dword [ebp - 0x1598], ecx
jmp 0xc212d4
mov ebx, dword [eax + 0x3c]
cmp ebx, 0x10000000
jae 0xc2127f
add ebx, dword [edx]
cmp ebx, dword [edx]
jb 0xc2127f
cmp dword [ebx], 0x4550
jne 0xc2127f
movzx eax, word [ebx + 0x18]
cmp ax, word [ebp - 0x1764]
je 0xc212c2
cmp ax, word [ebp - 0x1768]
je 0xc212c2
mov ecx, 0xc000000d
jmp 0xc21284
mov eax, dword [ebx + 0x78]
mov dword [edx + 8], eax
mov eax, dword [ebx + 0x7c]
mov dword [edx + 0xc], eax
mov eax, dword [ebx + 0x50]
mov dword [edx + 4], eax
mov eax, dword [edi]
add edi, esi
and dword [ebp - 0x1594], 0
mov dword [ebp - 0x155c], eax
test eax, eax
je 0xc21354
mov ebx, edi
mov dword [ebp - 0x1570], edi
lea eax, [ebx + 1]
mov dword [ebp - 0x158c], eax
mov al, byte [ebx]
inc ebx
test al, al
jne 0xc212fa
sub ebx, dword [ebp - 0x158c]
inc edi
add edi, ebx
test ecx, ecx
js 0xc21339
push dword [ebp - 0x1570]
push dword [edx]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc21366
mov ecx, dword [ebp - 0x1578]
mov edx, dword [ebp - 0x1558]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x1598]
mov eax, dword [ebp - 0x1594]
inc dword [ebp - 0x1578]
inc eax
mov dword [ebp - 0x1594], eax
cmp eax, dword [ebp - 0x155c]
jb 0xc212e9
add edx, 0x10
cmp byte [edi], 0
mov dword [ebp - 0x1558], edx
jne 0xc21222
mov esi, dword [ebp - 0x1598]
mov ebx, dword [ebp - 0x15b8]
test ebx, ebx
je 0xc21387
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push ebx
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0xc213dc
xor esi, esi
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc2139e
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc2138d
push 0x40
push 0
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc213e7
mov esi, 0xc000007a
jmp 0xc2136c
mov ebx, dword [ebp - 0x15b8]
mov esi, 0xc000007a
jmp 0xc21372
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edx, 0xc96238
xchg dword [edx], eax
xor eax, eax
lea edi, [ebp - 0x1b30]
mov dword [ebp - 0x1578], eax
mov dword [ebp - 0x1598], eax
mov dword [ebp - 0x15b8], eax
mov dword [ebp - 0x1558], eax
mov dword [ebp - 0x155c], eax
mov dword [ebp - 0x1594], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea ecx, [eax + 1]
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc21420
mov eax, dword [0xc95890]
test eax, eax
jne 0xc21a6b
push 0x338
push eax
mov dword [ebp - 0x1570], eax
mov dword [ebp - 0x158c], eax
mov dword [ebp - 0x1560], eax
mov dword [ebp - 0x1554], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x1580], edi
test edi, edi
je 0xc21a13
or dword [ebp - 0x1574], 0xffffffff
xor eax, eax
add edi, 7
mov dword [ebp - 0x6c0], 0xab69605e
mov dword [ebp - 0x157c], edi
mov cl, al
mov edi, 0x9fbcf2
mov dword [ebp - 0x6bc], 0x7f1137f
mov dword [ebp - 0x1564], eax
mov esi, eax
mov edx, eax
mov dword [ebp - 0x1568], edi
mov dword [ebp - 0x1590], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0x1568]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0x1568]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0x1568]
shl edi, 8
add dword [ebp - 0x1568], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0x156c], esi
add eax, 0x54969fa2
rol dword [ebp - 0x156c], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0x156c]
xor edx, eax
mov dword [ebp - 0x159c], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x159c]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x159c]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x159c], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x159c]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x159c]
xor edx, eax
mov dword [ebp - 0x159c], edx
mov eax, dword [ebp - 0x159c]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x159c]
xor eax, edx
mov dword [ebp - 0x159c], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x159c]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x159c]
xor eax, edx
mov dword [ebp - 0x159c], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x159c]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0x159c]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0x159c], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0x159c]
xor eax, 0xab69605e
mov dword [ebp - 0x156c], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x156c]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x156c]
xor eax, edx
mov dword [ebp - 0x156c], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x156c], edx
mov edx, dword [ebp - 0x156c]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x156c], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x156c]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x156c]
xor eax, edx
mov dword [ebp - 0x156c], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x156c]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x156c]
xor eax, edx
mov dword [ebp - 0x156c], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x156c]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x156c]
xor edx, dword [ebp - 0x1564]
xor eax, dword [ebp - 0x1574]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x159c], esi
mov esi, dword [ebp - 0x157c]
mov dword [ebp - 0x1574], edi
mov edi, dword [ebp - 0x1568]
mov dword [ebp - 0x1564], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x1590], 1
mov dword [ebp - 0x157c], esi
mov esi, eax
mov dword [ebp - 0x156c], eax
jne 0xc214bc
mov ebx, dword [ebp - 0x1580]
xor eax, eax
xor cl, byte [eax + ebx]
inc eax
cmp eax, 0x338
jb 0xc2183f
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc2186f
cmp edx, dword [0x9fc02c]
jne 0xc2186f
mov esi, ebx
mov edi, 0x337
mov dword [ebp - 0x1560], esi
xor ebx, ebx
jmp 0xc21882
mov esi, dword [ebp - 0x1560]
or edi, 0xffffffff
mov dword [ebp - 0x1554], 0xc004d501
test ebx, ebx
je 0xc21896
push ebx
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x1554], 0
jl 0xc21a13
mov ecx, dword [ebp - 0x1560]
xor eax, eax
push 0x40
push eax
push 0xc960a0
mov byte [edi + ecx], al
call fcn.00ab4bf6
mov eax, dword [ebp - 0x1560]
add esp, 0xc
cmp byte [eax], 0
je 0xc219f1
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
xor ebx, ebx
lea eax, [ecx + 2]
mov dword [ebp - 0x158c], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc218e1
sub ecx, dword [ebp - 0x158c]
push edi
sar ecx, 1
push edx
push 0
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc21a13
mov eax, dword [edi]
xor ecx, ecx
mov edx, 0x5a4d
mov dword [ebp - 0x158c], ecx
cmp word [eax], dx
je 0xc2192a
mov ecx, 0xc000007b
mov dword [ebp - 0x158c], ecx
jmp 0xc21974
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc2191d
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc2191d
cmp dword [edx], 0x4550
jne 0xc2191d
movzx eax, word [edx + 0x18]
mov ebx, 0x10b
cmp ax, bx
je 0xc21962
mov ebx, 0x20b
cmp ax, bx
je 0xc21962
mov ecx, 0xc000000d
jmp 0xc21922
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
xor ebx, ebx
add esi, 6
mov dword [ebp - 0x1554], eax
test eax, eax
je 0xc219df
mov edx, esi
mov dword [ebp - 0x1580], esi
lea eax, [edx + 1]
mov dword [ebp - 0x1564], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc21997
sub edx, dword [ebp - 0x1564]
inc esi
add esi, edx
test ecx, ecx
js 0xc219d0
push dword [ebp - 0x1580]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc219eb
mov ecx, dword [ebp - 0x1570]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x158c]
inc dword [ebp - 0x1570]
inc ebx
cmp ebx, dword [ebp - 0x1554]
jb 0xc21986
add edi, 0x10
cmp byte [esi], 0
jne 0xc218d2
mov eax, dword [ebp - 0x1560]
mov esi, dword [ebp - 0x158c]
test eax, eax
je 0xc21a20
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push dword [ebp - 0x1560]
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc21a22
mov eax, dword [ebp - 0x1560]
mov esi, 0xc000007a
jmp 0xc219f7
xor ebx, ebx
test esi, esi
jns 0xc21a64
xor esi, esi
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc21a39
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc21a28
push 0x40
xor ebx, ebx
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc21a73
mov eax, dword [0xc95890]
jmp 0xc21a6d
xor ebx, ebx
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
push 0x54
lea eax, [ebp - 0x1550]
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
mov esi, dword [0xc9307c]
lea edi, [ebp - 0x7c8]
add esp, 0xc
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
pop edx
push 0x403
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x15b4]
mov ecx, eax
and ecx, edx
mov dword [ebp - 0x15b4], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0x14], cx
mov ecx, eax
shr eax, 0xc
and eax, edx
shr ecx, 8
mov word [ebp - 0x10], ax
and ecx, edx
xor eax, eax
mov word [ebp - 0x12], cx
push eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x1570], eax
mov dword [ebp - 0x158c], 0xffffff
test eax, eax
jne 0xc21ce6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x1560], edi
test edi, edi
jle 0xc21b20
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x1560], edi
test edi, edi
js 0xc21b2c
mov dword [ebp - 0x1560], 0x80004005
xor ebx, ebx
xor esi, esi
mov edi, 0xc96238
inc esi
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc21b36
mov eax, dword [0xc95890]
test eax, eax
jle 0xc21b97
sub eax, 1
mov dword [0xc95890], eax
jne 0xc21b97
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc21b68
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc21b57
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0xc96238
inc esi
xor eax, eax
xchg dword [edi], eax
mov eax, dword [ebp - 0x15b8]
test eax, eax
je 0xc21bb4
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x1560], 0
jl 0xc24e5b
mov eax, dword [ebp - 0x7c4]
mov edi, dword [ebp - 0x7c8]
push 0x54
mov dword [ebp - 0x1578], eax
mov dword [ebp - 0x19fc], eax
lea eax, [ebp - 0x14f8]
push ebx
push eax
mov dword [ebp - 0x1a00], edi
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x1598], esi
mov esi, dword [0xc93028]
mov ecx, esi
push 7
push dword [ebp - 0x15c4]
call dword [0xc99200]
call esi
test eax, eax
je 0xc21c58
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x14f8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc21c58
push 0x20
pop eax
cmp word [ebp - 0x14e6], ax
jne 0xc21c58
cmp dword [ebp - 0x14e4], 0
je 0xc21c58
cmp dword [ebp - 0x14f4], 0
jle 0xc21c58
cmp dword [ebp - 0x14f0], 0
jg 0xc21c6b
cmp dword [ebp - 0x15b4], 1
mov dword [ebp - 0x1598], ebx
jne 0xc23389
push dword [ebp - 0x1578]
mov esi, dword [0xc930a8]
lea eax, [ebp - 0x152c]
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
push dword [ebp - 0x1578]
mov esi, dword [0xc930a8]
lea eax, [ebp - 0x151c]
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov edi, dword [ebp - 0x15b4]
cmp edi, 1
jne 0xc2338f
mov eax, dword [ebp - 0x154c]
mov esi, dword [0xc93014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0x15a0], eax
jmp 0xc2338f
mov edi, dword [0xc93050]
lea ecx, [ebp - 0x192c]
xor eax, eax
push ecx
push eax
mov esi, eax
mov dword [ebp - 0x1930], eax
mov dword [ebp - 0x1580], eax
mov ecx, edi
mov dword [ebp - 0x1564], eax
mov dword [ebp - 0x1560], eax
mov dword [ebp - 0x192c], eax
lea eax, [ebp - 0x1638]
push eax
push 8
mov dword [ebp - 0x1554], esi
call dword [0xc99200]
call edi
test eax, eax
jne 0xc21d6b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x1560], eax
test eax, eax
jle 0xc21d53
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1560], eax
test eax, eax
js 0xc21f0b
mov ebx, 0x80004005
mov dword [ebp - 0x1560], ebx
mov edi, esi
jmp 0xc2205f
mov eax, dword [ebp - 0x192c]
xor ebx, ebx
add eax, eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x1574], edi
test edi, edi
jne 0xc21da0
mov eax, 0x8007000e
mov dword [ebp - 0x1560], eax
jmp 0xc21ef2
mov eax, dword [ebp - 0x1638]
lea eax, [eax*4 + 4]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x157c], esi
test esi, esi
jne 0xc21dd8
mov eax, 0x8007000e
mov dword [ebp - 0x1560], eax
jmp 0xc21ed3
mov ebx, dword [0xc93050]
lea eax, [ebp - 0x192c]
push eax
push edi
lea eax, [ebp - 0x1638]
mov ecx, ebx
push eax
push 8
call dword [0xc99200]
call ebx
test eax, eax
jne 0xc21e31
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x1560], eax
test eax, eax
jle 0xc21e1d
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1560], eax
test eax, eax
js 0xc21e2a
mov eax, 0x80004005
mov dword [ebp - 0x1560], eax
xor ebx, ebx
jmp 0xc21ed3
and dword [ebp - 0x1554], 0
mov eax, esi
cmp dword [ebp - 0x1638], 0
jbe 0xc21eb4
mov dword [ebp - 0x1568], edi
mov edi, esi
mov esi, dword [ebp - 0x1568]
mov ebx, dword [0xc93058]
mov ecx, ebx
push 0
push esi
call dword [0xc99200]
call ebx
mov ecx, esi
mov dword [edi], eax
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc21e6d
mov eax, dword [ebp - 0x1554]
sub ecx, edx
sar ecx, 1
add edi, 4
lea esi, [esi + ecx*2]
add esi, 2
inc eax
mov dword [ebp - 0x1554], eax
cmp eax, dword [ebp - 0x1638]
jb 0xc21e51
mov esi, dword [ebp - 0x157c]
mov dword [ebp - 0x1554], edi
mov edi, dword [ebp - 0x1574]
mov eax, dword [ebp - 0x1554]
jmp 0xc21eb6
xor ebx, ebx
mov dword [eax], 0x409
mov eax, dword [ebp - 0x1638]
inc eax
mov dword [ebp - 0x1554], esi
mov dword [ebp - 0x1574], eax
mov esi, ebx
mov eax, ebx
test esi, esi
je 0xc21eec
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1560]
mov esi, dword [ebp - 0x1554]
test edi, edi
je 0xc21f0b
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1560]
test eax, eax
js 0xc22835
xor eax, eax
mov ebx, eax
mov edx, eax
mov dword [ebp - 0x157c], ebx
cmp dword [ebp - 0x1574], eax
jbe 0xc21f4e
mov edi, dword [esi + edx*4]
mov ecx, eax
cmp edi, dword [ecx*4 + 0xa192e8]
je 0xc21f46
inc ecx
cmp ecx, 0x26
jb 0xc21f2c
inc edx
cmp edx, dword [ebp - 0x1574]
jb 0xc21f27
jmp 0xc21f4e
mov ebx, ecx
mov dword [ebp - 0x157c], ecx
mov esi, dword [0xc93054]
mov ecx, esi
push eax
mov dword [ebp - 0x1574], eax
lea eax, [ebp - 0x178]
push 0x55
push eax
push dword [ebx*4 + 0xa192e8]
call dword [0xc99200]
call esi
test eax, eax
je 0xc21fb3
mov esi, dword [0xc93048]
lea eax, [ebp - 0x7f8]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0x178]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
test eax, eax
jle 0xc21fb3
mov ebx, dword [ebp - 0x7ec]
xor eax, eax
shr ebx, 0x1b
inc eax
and ebx, eax
mov dword [ebp - 0x1574], ebx
xor esi, esi
mov edx, 0x9fba10
xor ebx, ebx
mov ecx, edx
mov dword [ebp + esi*4 - 0x698], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc21fc8
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0xc21fbc
imul ecx, dword [ebp - 0x157c], 3
movzx eax, byte [ecx + 0xa00b58]
mov eax, dword [ebp + eax*4 - 0x698]
mov dword [ebp - 0x1558], eax
movzx eax, byte [ecx + 0xa00b59]
mov eax, dword [ebp + eax*4 - 0x698]
mov dword [ebp - 0x155c], eax
movzx eax, byte [ecx + 0xa00b5a]
mov eax, dword [ebp + eax*4 - 0x698]
mov dword [ebp - 0x1594], eax
xor eax, eax
push 0x1c90
push eax
mov dword [ebp - 0x1560], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edx, eax
mov dword [ebp - 0x1568], edx
test edx, edx
jne 0xc221e2
mov dword [ebp - 0x1560], 0x8007000e
mov esi, ebx
mov edi, ebx
test esi, esi
je 0xc220d0
xor eax, eax
mov dword [ebp - 0x1564], eax
mov edx, dword [esi + eax*4]
test edx, edx
je 0xc220c4
mov ecx, edx
xor ebx, ebx
lea eax, [ecx + 2]
mov dword [ebp - 0x1574], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc2207f
sub ecx, dword [ebp - 0x1574]
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc220ae
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xc2209d
mov edx, dword [ebp - 0x1564]
mov edx, dword [esi + edx*4]
push edx
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1564]
inc eax
mov dword [ebp - 0x1564], eax
cmp eax, 3
jb 0xc2206b
mov eax, dword [ebp - 0x1930]
test eax, eax
je 0xc220ed
mov ecx, dword [ebp - 0x1580]
test ecx, ecx
je 0xc220ed
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0xc220e4
test esi, esi
je 0xc22101
push esi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1930]
test eax, eax
je 0xc22122
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and dword [ebp - 0x1930], ebx
mov eax, dword [ebp - 0x1554]
test eax, eax
je 0xc2213d
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x1560], 0
jl 0xc229ce
mov eax, dword [edi]
lea ecx, [ebp - 0x1ad4]
mov esi, dword [0xc930b4]
mov dword [ebp - 0x1548], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x1544], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x1540], eax
xor eax, eax
push eax
push ecx
push eax
mov edi, eax
mov dword [ebp - 0x1ad0], eax
push 0x42
mov ecx, esi
mov dword [ebp - 0x1acc], eax
mov ebx, eax
mov dword [ebp - 0x1560], edi
mov dword [ebp - 0x1ad4], 0xc
call dword [0xc99200]
call esi
test eax, eax
jne 0xc22840
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x1560], edi
test edi, edi
jle 0xc221cc
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x1560], edi
test edi, edi
js 0xc2284b
mov edi, 0x80004005
mov dword [ebp - 0x1560], edi
jmp 0xc2284b
xor ecx, ecx
mov dword [ebp - 0x6b8], 0xab69605e
or esi, 0xffffffff
mov dword [ebp - 0x6b4], 0x7f1137f
add edx, 7
mov dword [ebp - 0x156c], esi
mov edi, 0xa19392
mov dword [ebp - 0x1584], edx
mov al, cl
mov dword [ebp - 0x1590], ecx
mov dword [ebp - 0x159c], ecx
mov esi, ecx
mov dword [ebp - 0x15a8], edi
mov edx, ecx
mov dword [ebp - 0x15b0], 0x392
movzx ebx, byte [edi - 2]
movzx ecx, byte [edi - 1]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edi]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, ecx
shl edi, 8
mov ecx, dword [ebp - 0x15a8]
xor esi, ebx
mov dword [ebp - 0x15c0], esi
movzx ecx, byte [ecx + 3]
or edi, ecx
mov ecx, dword [ebp - 0x15a8]
shl edi, 8
movzx ecx, byte [ecx + 4]
or edi, ecx
mov ecx, dword [ebp - 0x15a8]
shl edi, 8
add dword [ebp - 0x15a8], 8
movzx ecx, byte [ecx + 5]
or edi, ecx
mov esi, edi
xor esi, edx
xor esi, dword [ebp - 0x15c0]
xor esi, 0xac987321
lea ecx, [esi + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, esi
rol ecx, 0xa
add edx, ecx
mov ecx, dword [ebp - 0x15c0]
xor ecx, edx
mov dword [ebp - 0x15c0], ecx
add ecx, 0x7f1137f
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0x15c0]
rol ecx, 2
sub edx, ecx
xor esi, edx
imul edx, esi, 0x605e
mov ecx, esi
shr ecx, 0xd
sub edx, ecx
mov ecx, dword [ebp - 0x15c0]
sub edx, 0x756c8a2
xor ecx, edx
mov dword [ebp - 0x15c0], ecx
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0x15c0]
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub ecx, edx
mov edx, dword [ebp - 0x15c0]
xor edx, ecx
mov dword [ebp - 0x15c0], edx
mov ecx, dword [ebp - 0x15c0]
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor esi, edx
lea ecx, [esi + 0x7f1137f]
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, esi
rol ecx, 2
add edx, ecx
mov ecx, dword [ebp - 0x15c0]
xor ecx, edx
mov dword [ebp - 0x15c0], ecx
add ecx, 0x54969fa2
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0x15c0]
rol ecx, 8
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69605e
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, esi
ror ecx, 0xa
xor edx, ecx
mov ecx, dword [ebp - 0x15c0]
xor ecx, edx
mov dword [ebp - 0x15c0], ecx
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0x15c0]
shr ecx, 0xa
xor edx, ecx
xor esi, edx
mov edx, dword [ebp - 0x15c0]
mov ecx, esi
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor edx, ecx
mov dword [ebp - 0x15c0], edx
lea ecx, [edx - 0x7f1]
xor ecx, esi
mov esi, dword [ebp - 0x15c0]
xor ecx, 0xab69605e
mov dword [ebp - 0x159c], ecx
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0x159c]
shr ecx, 2
add edx, ecx
xor esi, edx
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, esi
rol ecx, 7
add edx, ecx
mov ecx, dword [ebp - 0x159c]
xor ecx, edx
mov dword [ebp - 0x159c], ecx
mov edx, ecx
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69
rol ecx, 5
imul edx, ecx, 0x7f1
mov ecx, esi
rol ecx, 7
add edx, ecx
xor dword [ebp - 0x159c], edx
mov edx, dword [ebp - 0x159c]
xor esi, edx
xor esi, 0xac987321
mov ecx, esi
ror ecx, 3
imul ecx, ecx, 0x137f
sub ecx, 0xd0dd417
xor edx, ecx
mov dword [ebp - 0x159c], edx
lea ecx, [edx - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0x159c]
ror ecx, 6
sub edx, ecx
xor esi, edx
lea ecx, [esi - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, esi
rol ecx, 0xe
add edx, ecx
mov ecx, dword [ebp - 0x159c]
xor ecx, edx
mov dword [ebp - 0x159c], ecx
add ecx, 0xab69605e
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0x159c]
ror ecx, 0xe
sub edx, ecx
xor esi, edx
mov ecx, esi
mov dword [ebp - 0x15c0], esi
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, esi
mov esi, dword [ebp - 0x159c]
shr ecx, 3
xor edx, ecx
xor esi, edx
mov ecx, esi
mov dword [ebp - 0x159c], esi
xor ecx, 0x7f1137f
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, esi
rol ecx, 2
xor edx, ecx
mov ecx, dword [ebp - 0x15c0]
xor edx, dword [ebp - 0x1590]
xor ecx, edx
mov dword [ebp - 0x1590], ebx
mov edx, esi
mov esi, dword [ebp - 0x1584]
xor edx, dword [ebp - 0x156c]
mov dword [ebp - 0x156c], edi
mov edi, dword [ebp - 0x15a8]
mov byte [esi - 4], cl
mov byte [esi], dl
ror ecx, 8
mov byte [esi - 5], cl
ror edx, 8
mov byte [esi - 1], dl
ror ecx, 8
mov byte [esi - 6], cl
ror edx, 8
mov byte [esi - 2], dl
ror ecx, 8
ror edx, 8
mov byte [esi - 7], cl
mov byte [esi - 3], dl
add esi, 8
ror ecx, 8
ror edx, 8
sub dword [ebp - 0x15b0], 1
mov dword [ebp - 0x1584], esi
mov esi, ecx
mov dword [ebp - 0x15c0], ecx
jne 0xc22231
mov ecx, dword [ebp - 0x1568]
xor ebx, ebx
mov esi, 0x1c90
xor al, byte [ebx + ecx]
inc ebx
cmp ebx, esi
jb 0xc225ca
movzx eax, al
cdq
cmp eax, dword [0xa1b020]
jne 0xc225fc
cmp edx, dword [0xa1b024]
jne 0xc225fc
mov ebx, dword [ebp - 0x1560]
mov dword [ebp - 0x1930], ecx
xor ecx, ecx
mov dword [ebp - 0x1580], esi
jmp 0xc22607
mov ebx, 0xc004d501
mov dword [ebp - 0x1560], ebx
test ecx, ecx
je 0xc2261b
push ecx
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc22835
mov edi, dword [ebp - 0x1930]
xor esi, esi
xor edx, edx
cmp dword [ebp - 0x157c], edx
jne 0xc2263c
mov dword [ebp + esi*4 - 0x5a0], edi
mov ecx, edi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc22641
sub ecx, ebx
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0xc2262d
inc esi
cmp esi, 6
jb 0xc2262b
push 0xc
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xc22680
mov dword [ebp - 0x1560], 0x8007000e
jmp 0xc2205d
xor eax, eax
mov edi, esi
xor ecx, ecx
mov edx, esi
mov dword [ebp - 0x1564], ecx
mov dword [ebp - 0x157c], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, esi
sub eax, esi
mov dword [ebp - 0x1568], eax
movzx edi, word [ebp + ecx*2 - 0x14]
xor eax, eax
cmp di, word [eax*2 + 0xa19380]
je 0xc226bd
inc eax
cmp eax, 6
jb 0xc226a8
jmp 0xc22795
mov edi, dword [ebp + eax*4 - 0x5a0]
mov ecx, edi
mov edx, dword [0xc93060]
mov dword [ebp - 0x1590], edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc226d5
sub ecx, ebx
xor eax, eax
push eax
push eax
xor ebx, ebx
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
push ebx
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0x1590]
mov dword [ebp - 0x1590], eax
test eax, eax
je 0xc227fe
lea ecx, [eax + eax]
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0x157c]
mov edx, dword [ebp - 0x1568]
mov dword [edx + ecx], eax
mov eax, dword [ecx]
mov dword [ebp - 0x156c], eax
test eax, eax
je 0xc22671
mov edx, dword [0xc93060]
mov ecx, edi
mov dword [ebp - 0x159c], edx
lea eax, [ecx + 1]
mov dword [ebp - 0x1584], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc22753
push dword [ebp - 0x1590]
sub ecx, dword [ebp - 0x1584]
push dword [ebp - 0x156c]
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
push ebx
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0x159c]
test eax, eax
je 0xc227c9
mov ecx, dword [ebp - 0x1564]
mov edx, dword [ebp - 0x157c]
inc ecx
add edx, 4
mov dword [ebp - 0x1564], ecx
mov dword [ebp - 0x157c], edx
cmp ecx, 3
jb 0xc226a1
mov eax, dword [ebp - 0x1574]
mov edi, esi
mov dword [ebp - 0x15b8], edi
xor esi, esi
mov dword [ebp - 0x1550], eax
jmp 0xc2205f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x1560], eax
test eax, eax
jle 0xc227e9
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1560], eax
test eax, eax
js 0xc2205d
mov dword [ebp - 0x1560], 0x80004005
jmp 0xc2205d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x1560], eax
test eax, eax
jle 0xc2281e
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1560], eax
test eax, eax
mov edi, ebx
js 0xc2205f
mov dword [ebp - 0x1560], 0x80004005
jmp 0xc2205f
mov esi, dword [ebp - 0x1564]
jmp 0xc21d64
mov ebx, dword [ebp - 0x1ad0]
xor eax, eax
inc eax
and ebx, eax
mov dword [ebp - 0x154c], ebx
test edi, edi
js 0xc229ce
mov eax, dword [ebp - 0x15b4]
push 0x2a
pop ecx
mov dword [ebp - 0x1554], ecx
sub eax, 1
je 0xc22896
sub eax, 1
je 0xc2288a
sub eax, 1
jne 0xc228a6
mov edi, 0xe1
mov dword [ebp - 0x1578], edi
mov dword [ebp - 0x1598], edi
jmp 0xc228a6
mov dword [ebp - 0x1578], 0xf
jmp 0xc2289c
mov dword [ebp - 0x1578], ecx
mov dword [ebp - 0x1598], 0xb
mov esi, 0xdc
mov dword [ebp - 0x1580], 0x60
push esi
xor ebx, ebx
lea eax, [ebp - 0xe70]
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov word [ebp - 0xe2c], si
mov esi, dword [0xc93070]
lea eax, [ebp - 0xe70]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xc2292d
mov eax, dword [ebp - 0xdc4]
movzx edi, word [ebp - 0xdca]
mov ecx, dword [ebp - 0xdc0]
push 0x60
mov dword [ebp - 0x1564], eax
mov dword [ebp - 0x1b28], eax
pop eax
mov dword [ebp - 0x1580], edi
mov dword [ebp - 0x1574], ecx
mov dword [ebp - 0x1b24], ecx
cmp edi, eax
jae 0xc22945
mov dword [ebp - 0x1580], eax
jmp 0xc22945
mov eax, dword [ebp - 0x1b24]
mov dword [ebp - 0x1574], eax
mov eax, dword [ebp - 0x1b28]
mov dword [ebp - 0x1564], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x15b4], eax
mov eax, dword [ebp - 0x1558]
je 0xc2295c
mov eax, dword [ebp - 0x1594]
push 0x5c
mov dword [ebp - 0x157c], eax
lea eax, [ebp - 0xcb0]
push ebx
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov edi, eax
mov dword [ebp - 0x1560], edi
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov ebx, eax
test ebx, ebx
jne 0xc229ec
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x1560], edi
test edi, edi
jle 0xc229be
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x1560], edi
test edi, edi
js 0xc22a9f
mov dword [ebp - 0x1560], 0x80004005
xor ebx, ebx
push dword [ebp - 0x1570]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
jmp 0xc21b2e
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0x1580]
push dword [ebp - 0x1578]
call dword [0xc99200]
call esi
push dword [ebp - 0x157c]
neg eax
mov dword [ebp - 0xca0], 0x190
push 0x20
pop esi
mov edx, esi
mov dword [ebp - 0xcb0], eax
lea ecx, [ebp - 0xc94]
mov byte [ebp - 0xc96], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0xcb0]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc22a86
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x1560], edi
test edi, edi
jle 0xc22a77
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x1560], edi
test edi, edi
js 0xc22a8c
mov edi, 0x80004005
mov dword [ebp - 0x1560], edi
jmp 0xc22a8c
mov dword [ebp - 0x153c], eax
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
push 0
call dword [0xc99200]
call esi
test edi, edi
js 0xc229ce
xor eax, eax
inc eax
cmp dword [ebp - 0x15b4], eax
je 0xc22abe
mov eax, dword [ebp - 0x1594]
mov dword [ebp - 0x1558], eax
push 0x5c
lea eax, [ebp - 0xc50]
push 0
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov edi, eax
mov dword [ebp - 0x1560], edi
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov ebx, eax
test ebx, ebx
jne 0xc22b26
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x1560], edi
test edi, edi
jle 0xc22b1b
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x1560], edi
test edi, edi
js 0xc22bd8
jmp 0xc229c4
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0x1580]
push dword [ebp - 0x1598]
call dword [0xc99200]
call esi
push dword [ebp - 0x1558]
neg eax
mov dword [ebp - 0xc40], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0xc34]
mov dword [ebp - 0xc50], eax
mov byte [ebp - 0xc36], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0xc50]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc22bbe
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x1560], edi
test edi, edi
jle 0xc22baf
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x1560], edi
test edi, edi
js 0xc22bc4
mov edi, 0x80004005
mov dword [ebp - 0x1560], edi
jmp 0xc22bc4
mov dword [ebp - 0x1538], eax
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
xor ebx, ebx
push ebx
call dword [0xc99200]
call esi
xor ebx, ebx
test edi, edi
js 0xc229d0
mov esi, dword [ebp - 0x15b4]
xor ecx, ecx
mov eax, esi
sub eax, 1
je 0xc22bfb
sub eax, 1
je 0xc22c3b
sub eax, 1
jne 0xc22c07
mov ecx, dword [ebp - 0x1564]
mov ebx, dword [ebp - 0x1574]
mov dword [ebp - 0x7c0], ecx
mov dword [ebp - 0x7bc], ebx
xor edx, edx
inc edx
cmp esi, edx
je 0xc22c75
lea eax, [esi - 2]
cmp eax, edx
ja 0xc22c4f
xor eax, eax
mov ebx, eax
mov dword [ebp - 0x1598], eax
mov edx, eax
mov dword [ebp - 0x1554], eax
mov dword [ebp - 0x1558], eax
jmp 0xc22c8c
mov eax, dword [ebp - 0x1564]
cdq
and edx, 3
lea ecx, [edx + eax]
sar ecx, 2
xor ebx, ebx
jmp 0xc22c07
mov eax, dword [ebp - 0x1638]
mov edx, dword [ebp - 0x1638]
mov ebx, dword [ebp - 0x1638]
mov dword [ebp - 0x1558], eax
mov eax, dword [ebp - 0x1638]
mov dword [ebp - 0x1554], eax
jmp 0xc22c86
mov ebx, 0x96
mov dword [ebp - 0x1558], 0x20
xor edx, edx
mov dword [ebp - 0x1598], edx
mov dword [ebp - 0x1578], ebx
push dword [ebp - 0x153c]
mov esi, dword [0xc9303c]
sub ecx, ebx
push dword [ebp - 0x1570]
mov edi, dword [ebp - 0x1548]
sub ecx, edx
and dword [ebp - 0x1560], 0
mov dword [ebp - 0x1594], ecx
mov dword [ebp - 0x1514], ecx
mov dword [ebp - 0x1524], ecx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
xor ebx, ebx
push ebx
push 0xc50
mov dword [ebp - 0x1564], eax
mov ecx, esi
lea eax, [ebp - 0x152c]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0x1570]
call dword [0xc99200]
call esi
test eax, eax
jne 0xc22d10
mov edi, 0x80004005
mov dword [ebp - 0x1560], edi
jmp 0xc22d12
xor edi, edi
mov eax, dword [ebp - 0x1564]
test eax, eax
je 0xc22d33
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push dword [ebp - 0x1570]
call dword [0xc99200]
call esi
test edi, edi
js 0xc229d0
push dword [ebp - 0x1538]
mov esi, dword [0xc9303c]
mov ecx, esi
push dword [ebp - 0x1570]
mov edi, dword [ebp - 0x1544]
mov dword [ebp - 0x1560], ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0x1564], eax
lea eax, [ebp - 0x151c]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0x1570]
call dword [0xc99200]
call esi
test eax, eax
jne 0xc22da0
mov edi, 0x80004005
mov dword [ebp - 0x1560], edi
jmp 0xc22da2
mov edi, ebx
mov eax, dword [ebp - 0x1564]
test eax, eax
je 0xc22dc3
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push dword [ebp - 0x1570]
call dword [0xc99200]
call esi
test edi, edi
js 0xc229d0
mov eax, dword [ebp - 0x15b4]
cmp eax, 2
je 0xc22ddb
cmp eax, 3
jne 0xc22dfd
mov edi, dword [ebp - 0x1514]
mov dword [ebp - 0x1594], edi
cmp dword [ebp - 0x1524], edi
jle 0xc22e03
mov edi, dword [ebp - 0x1524]
mov dword [ebp - 0x1594], edi
jmp 0xc22e03
mov edi, dword [ebp - 0x1594]
mov esi, dword [0xc930a8]
mov ecx, esi
push dword [ebp - 0x1554]
cmp dword [ebp - 0x1550], ebx
je 0xc22e55
mov eax, dword [ebp - 0x1598]
sub eax, dword [ebp - 0x1524]
add eax, edi
push eax
lea eax, [ebp - 0x152c]
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1520]
add eax, dword [ebp - 0x1558]
push eax
mov eax, dword [ebp - 0x1598]
sub eax, dword [ebp - 0x1514]
add eax, edi
push eax
jmp 0xc22e7d
push dword [ebp - 0x1578]
lea eax, [ebp - 0x152c]
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1520]
add eax, dword [ebp - 0x1558]
push eax
push dword [ebp - 0x1578]
mov esi, dword [0xc930a8]
lea eax, [ebp - 0x151c]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x15b4]
cmp eax, 2
je 0xc2317e
cmp eax, 3
je 0xc2317e
xor edx, edx
inc edx
cmp eax, edx
jne 0xc2319d
push 0x5c
lea eax, [ebp - 0xb30]
mov dword [ebp - 0x1530], 0xffffff
push 0
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov edi, eax
mov dword [ebp - 0x1560], edi
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov ebx, eax
test ebx, ebx
jne 0xc22f29
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x1560], edi
test edi, edi
jle 0xc22f1e
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x1560], edi
test edi, edi
js 0xc22fd6
jmp 0xc229c4
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0x1580]
push 0xb
call dword [0xc99200]
call esi
push dword [ebp - 0x155c]
neg eax
mov dword [ebp - 0xb20], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0xb14]
mov dword [ebp - 0xb30], eax
mov byte [ebp - 0xb16], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0xb30]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc22fbd
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x1560], edi
test edi, edi
jle 0xc22fae
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x1560], edi
test edi, edi
js 0xc22fc3
mov edi, 0x80004005
mov dword [ebp - 0x1560], edi
jmp 0xc22fc3
mov dword [ebp - 0x1534], eax
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
push 0
call dword [0xc99200]
call esi
test edi, edi
js 0xc229ce
push dword [ebp - 0x1534]
mov eax, dword [ebp - 0x1594]
mov esi, dword [0xc9303c]
mov ecx, esi
push dword [ebp - 0x1570]
mov edi, dword [ebp - 0x1540]
and dword [ebp - 0x1560], 0
mov dword [ebp - 0x1504], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ebx, eax
push 0
push 0x460
lea eax, [ebp - 0x150c]
mov ecx, esi
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0x1570]
call dword [0xc99200]
call esi
test eax, eax
jne 0xc2304d
mov edi, 0x80004005
mov dword [ebp - 0x1560], edi
jmp 0xc2304f
xor edi, edi
test ebx, ebx
je 0xc2306a
mov esi, dword [0xc9303c]
mov ecx, esi
push ebx
push dword [ebp - 0x1570]
call dword [0xc99200]
call esi
test edi, edi
js 0xc229ce
mov eax, dword [ebp - 0x1504]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x1504], eax
cmp eax, ecx
jge 0xc2308e
mov dword [ebp - 0x1504], ecx
mov ebx, dword [ebp - 0x1580]
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
pop edi
push edi
push ebx
push dword [ebp - 0x150c]
mov dword [ebp - 0x1500], 0x20
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x1508]
mov dword [ebp - 0x150c], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x1504]
mov dword [ebp - 0x1508], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x1500]
mov dword [ebp - 0x1504], eax
call dword [0xc99200]
call esi
mov ecx, dword [ebp - 0x1510]
mov esi, dword [0xc930a8]
add ecx, 0x24
cmp dword [ebp - 0x1550], 0
mov dword [ebp - 0x1500], eax
je 0xc2315c
mov eax, dword [ebp - 0x152c]
cmp eax, dword [ebp - 0x151c]
jl 0xc23145
mov eax, dword [ebp - 0x151c]
push ecx
push eax
lea eax, [ebp - 0x150c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
xor ebx, ebx
jmp 0xc2319a
mov eax, dword [ebp - 0x1524]
cmp eax, dword [ebp - 0x1514]
jg 0xc23170
mov eax, dword [ebp - 0x1514]
sub eax, dword [ebp - 0x1504]
add eax, dword [ebp - 0x150c]
jmp 0xc23145
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x7c0], edi
mov dword [ebp - 0x7bc], eax
mov dword [ebp - 0x1530], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x1550]
mov dword [ebp - 0x1578], eax
mov eax, dword [ebp - 0x7bc]
mov dword [ebp - 0x1598], eax
mov eax, dword [ebp - 0x7c0]
mov dword [ebp - 0x1558], eax
mov eax, dword [ebp - 0x15b4]
sub eax, 1
je 0xc23378
sub eax, 1
je 0xc232a7
sub eax, 1
jne 0xc2329c
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x840]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x840]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x840], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xc2329a
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x82c]
push eax
push 0
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x824]
push eax
push 0
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x824]
lea esi, [ebp - 0x82c]
sub eax, dword [ebp - 0x1558]
lea edi, [ebp - 0x1b40]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x7c8], eax
mov eax, dword [ebp - 0x820]
sub eax, dword [ebp - 0x1598]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
mov dword [ebp - 0x7c4], eax
xor ebx, ebx
mov dword [ebp - 0x1560], ebx
jmp 0xc229d0
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x868]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x868]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x868], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xc2329a
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x854]
push eax
push 0
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x84c]
push eax
push 0
mov ecx, esi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1578], 0
lea esi, [ebp - 0x854]
lea edi, [ebp - 0x1b40]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xc2334c
imul eax, dword [ebp - 0x84c], 5
cdq
idiv ecx
add eax, dword [ebp - 0x854]
jmp 0xc2335e
mov eax, dword [ebp - 0x84c]
sub eax, dword [ebp - 0x1558]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x7c8], eax
mov eax, dword [ebp - 0x848]
sub eax, dword [ebp - 0x1598]
imul eax, eax, 0x5f
jmp 0xc23291
mov dword [ebp - 0x7c8], ebx
mov dword [ebp - 0x7c4], ebx
jmp 0xc2329c
mov edi, dword [ebp - 0x15b4]
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push dword [ebp - 0x15c4]
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1550], 0
mov dword [ebp - 0x1578], eax
mov dword [ebp - 0x15b8], 0x810
je 0xc233ca
mov dword [ebp - 0x15b8], 0x20812
cmp dword [ebp - 0x1598], 0
je 0xc23eff
mov eax, dword [ebp - 0x154c]
mov esi, dword [ebp - 0x1548]
mov dword [ebp - 0x1598], eax
mov eax, dword [ebp - 0x153c]
push 0x54
mov dword [ebp - 0x1558], eax
lea eax, [ebp - 0x14a0]
push ebx
push eax
mov dword [ebp - 0x155c], esi
call fcn.00ab4bf6
add esp, 0xc
lea eax, [ebp - 0x1448]
push 0x54
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x1594], ebx
lea eax, [ebp - 0x93c]
mov dword [ebp - 0x1570], ebx
mov dword [ebp - 0x1560], ebx
mov dword [ebp - 0x1554], ebx
push 0x2c
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x7d8]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0xc24e3b
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [ebp - 0x15c4]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xc23f91
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x14a0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc234c0
mov eax, dword [ebp - 0x148c]
mov dword [ebp - 0x1594], eax
mov eax, dword [ebp - 0x149c]
mov dword [ebp - 0x1560], eax
mov eax, dword [ebp - 0x1498]
mov dword [ebp - 0x1554], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0x1580], edi
test edi, edi
je 0xc23f91
mov eax, dword [ebp - 0x1524]
sub eax, dword [ebp - 0x152c]
mov esi, dword [0xc9300c]
mov ecx, esi
mov dword [ebp - 0x938], eax
mov eax, dword [ebp - 0x1528]
sub eax, dword [ebp - 0x1520]
mov dword [ebp - 0x934], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x1928], ebx
mov word [ebp - 0x930], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x92e], ax
lea eax, [ebp - 0x1928]
push eax
push ebx
lea eax, [ebp - 0x93c]
mov dword [ebp - 0x1564], ebx
push eax
push edi
mov dword [ebp - 0x92c], ebx
mov dword [ebp - 0x928], ebx
mov dword [ebp - 0x924], ebx
mov dword [ebp - 0x920], ebx
mov dword [ebp - 0x91c], ebx
mov dword [ebp - 0x918], ebx
mov dword [ebp - 0x914], ebx
mov dword [ebp - 0x93c], 0x28
call dword [0xc99200]
call esi
mov dword [ebp - 0x1574], eax
test eax, eax
jne 0xc235ba
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x1564], eax
test eax, eax
jle 0xc235a5
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1564], eax
test eax, eax
js 0xc2394a
mov dword [ebp - 0x1564], 0x80004005
jmp 0xc2394a
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x1448]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc235e4
mov eax, dword [ebp - 0x1434]
mov dword [ebp - 0x1570], eax
mov eax, dword [ebp - 0x1524]
sub eax, dword [ebp - 0x152c]
push dword [ebp - 0x1574]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x7d0], eax
mov eax, dword [ebp - 0x1520]
sub eax, dword [ebp - 0x1528]
push edi
mov dword [ebp - 0x7cc], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0x1558]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
push ebx
mov dword [ebp - 0x1558], eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x7d8]
mov ecx, edi
push eax
push dword [ebp - 0x1580]
call dword [0xc99200]
call edi
mov edi, dword [ebp - 0x1580]
lea eax, [ebp - 0x7d8]
mov esi, dword [0xc9306c]
mov ecx, esi
push ebx
push dword [ebp - 0x15b8]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x155c]
push edi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0x15b4], eax
jne 0xc236e7
cmp dword [ebp - 0x1598], 0
je 0xc236db
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0x1598], eax
jmp 0xc236f1
mov dword [ebp - 0x1598], 0xffffff
jmp 0xc236f1
mov dword [ebp - 0x1598], 0xffa8a8a8
mov esi, dword [ebp - 0x152c]
mov edx, ebx
mov eax, dword [ebp - 0x1528]
mov ecx, ebx
mov dword [ebp - 0x155c], esi
mov dword [ebp - 0x157c], ebx
test esi, esi
jns 0xc23721
mov edx, esi
mov dword [ebp - 0x155c], ebx
neg edx
mov dword [ebp - 0x157c], edx
test eax, eax
jns 0xc2372b
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x7d0]
sub esi, edx
mov edx, dword [ebp - 0x1560]
sub edx, dword [ebp - 0x155c]
mov dword [ebp - 0x1568], esi
cmp esi, edx
jl 0xc23751
mov esi, edx
mov dword [ebp - 0x1568], edx
mov edx, dword [ebp - 0x7cc]
sub dword [ebp - 0x1554], eax
sub edx, ecx
mov dword [ebp - 0x1590], edx
cmp edx, dword [ebp - 0x1554]
jl 0xc23779
mov edx, dword [ebp - 0x1554]
mov dword [ebp - 0x1590], edx
test esi, esi
jle 0xc23918
test edx, edx
jle 0xc23918
mov edx, dword [ebp - 0x7d0]
imul eax, dword [ebp - 0x1560]
mov edi, dword [ebp - 0x1570]
imul ecx, edx
shl edx, 2
add eax, dword [ebp - 0x155c]
add ecx, dword [ebp - 0x157c]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0x1594]
mov dword [ebp - 0x1594], edx
mov edx, dword [ebp - 0x1560]
shl edx, 2
lea eax, [edi + eax*4]
mov dword [ebp - 0x1570], ecx
mov dword [ebp - 0x155c], eax
mov dword [ebp - 0x1560], edx
mov ebx, eax
mov dword [ebp - 0x156c], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0x1554], edx
lea edi, [ecx + 2]
mov dword [ebp - 0x157c], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc238bd
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x1598]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x157c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x1554]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x1598]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x1554]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x1596]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x1554]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x156c]
cdq
idiv ecx
mov edx, dword [ebp - 0x1554]
add al, bl
mov ebx, dword [ebp - 0x157c]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x1554], edx
mov dword [ebp - 0x156c], esi
jne 0xc237f7
mov ecx, dword [ebp - 0x1570]
mov eax, dword [ebp - 0x155c]
add ecx, dword [ebp - 0x1594]
add eax, dword [ebp - 0x1560]
sub dword [ebp - 0x1590], 1
mov esi, dword [ebp - 0x1568]
mov dword [ebp - 0x1570], ecx
mov dword [ebp - 0x155c], eax
jne 0xc237db
mov edi, dword [ebp - 0x1580]
xor ebx, ebx
push dword [ebp - 0x1574]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1558]
test eax, eax
je 0xc2394a
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1564], 0
jl 0xc24e3b
mov eax, dword [ebp - 0x154c]
mov esi, dword [ebp - 0x1544]
mov dword [ebp - 0x1598], eax
mov eax, dword [ebp - 0x1538]
push 0x54
mov dword [ebp - 0x1558], eax
lea eax, [ebp - 0x13f0]
push ebx
push eax
mov dword [ebp - 0x155c], esi
call fcn.00ab4bf6
add esp, 0xc
lea eax, [ebp - 0x1398]
push 0x54
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x1594], ebx
lea eax, [ebp - 0x968]
mov dword [ebp - 0x1570], ebx
mov dword [ebp - 0x1560], ebx
mov dword [ebp - 0x1554], ebx
push 0x2c
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x728]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0xc24e3b
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [ebp - 0x15c4]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xc23f91
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x13f0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc23a51
mov eax, dword [ebp - 0x13dc]
mov dword [ebp - 0x1594], eax
mov eax, dword [ebp - 0x13ec]
mov dword [ebp - 0x1560], eax
mov eax, dword [ebp - 0x13e8]
mov dword [ebp - 0x1554], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0x1580], edi
test edi, edi
je 0xc23f91
mov eax, dword [ebp - 0x1514]
sub eax, dword [ebp - 0x151c]
mov esi, dword [0xc9300c]
mov ecx, esi
mov dword [ebp - 0x964], eax
mov eax, dword [ebp - 0x1518]
sub eax, dword [ebp - 0x1510]
mov dword [ebp - 0x960], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x1924], ebx
mov word [ebp - 0x95c], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x95a], ax
lea eax, [ebp - 0x1924]
push eax
push ebx
lea eax, [ebp - 0x968]
mov dword [ebp - 0x1564], ebx
push eax
push edi
mov dword [ebp - 0x958], ebx
mov dword [ebp - 0x954], ebx
mov dword [ebp - 0x950], ebx
mov dword [ebp - 0x94c], ebx
mov dword [ebp - 0x948], ebx
mov dword [ebp - 0x944], ebx
mov dword [ebp - 0x940], ebx
mov dword [ebp - 0x968], 0x28
call dword [0xc99200]
call esi
mov dword [ebp - 0x1574], eax
test eax, eax
jne 0xc23b4b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x1564], eax
test eax, eax
jle 0xc23b36
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1564], eax
test eax, eax
js 0xc23edc
mov dword [ebp - 0x1564], 0x80004005
jmp 0xc23edc
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x1398]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc23b75
mov eax, dword [ebp - 0x1384]
mov dword [ebp - 0x1570], eax
mov eax, dword [ebp - 0x1514]
sub eax, dword [ebp - 0x151c]
push dword [ebp - 0x1574]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x720], eax
mov eax, dword [ebp - 0x1510]
sub eax, dword [ebp - 0x1518]
push edi
mov dword [ebp - 0x71c], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0x1558]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
push ebx
mov dword [ebp - 0x1558], eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x728]
mov ecx, edi
push eax
push dword [ebp - 0x1580]
call dword [0xc99200]
call edi
mov edi, dword [ebp - 0x1580]
lea eax, [ebp - 0x728]
mov esi, dword [0xc9306c]
mov ecx, esi
push ebx
push dword [ebp - 0x15b8]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x155c]
push edi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0x15b4], eax
jne 0xc23c72
cmp dword [ebp - 0x1598], 0
je 0xc23c66
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
jmp 0xc23c77
mov dword [ebp - 0x15b4], 0xffffff
jmp 0xc23c83
mov eax, 0xffa8a8a8
mov dword [ebp - 0x15b4], eax
mov dword [ebp - 0x158c], eax
mov esi, dword [ebp - 0x151c]
mov edx, ebx
mov eax, dword [ebp - 0x1518]
mov ecx, ebx
mov dword [ebp - 0x1598], esi
mov dword [ebp - 0x15b8], ebx
test esi, esi
jns 0xc23cb3
mov edx, esi
mov dword [ebp - 0x1598], ebx
neg edx
mov dword [ebp - 0x15b8], edx
test eax, eax
jns 0xc23cbd
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x720]
sub esi, edx
mov edx, dword [ebp - 0x1560]
sub edx, dword [ebp - 0x1598]
mov dword [ebp - 0x155c], esi
cmp esi, edx
jl 0xc23ce3
mov esi, edx
mov dword [ebp - 0x155c], edx
mov edx, dword [ebp - 0x71c]
sub dword [ebp - 0x1554], eax
sub edx, ecx
mov dword [ebp - 0x157c], edx
cmp edx, dword [ebp - 0x1554]
jl 0xc23d0b
mov edx, dword [ebp - 0x1554]
mov dword [ebp - 0x157c], edx
test esi, esi
jle 0xc23eaa
test edx, edx
jle 0xc23eaa
mov edx, dword [ebp - 0x720]
mov edi, dword [ebp - 0x1570]
imul eax, dword [ebp - 0x1560]
imul ecx, edx
shl edx, 2
add eax, dword [ebp - 0x1598]
add ecx, dword [ebp - 0x15b8]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0x1594]
mov dword [ebp - 0x1594], edx
mov edx, dword [ebp - 0x1560]
shl edx, 2
lea eax, [edi + eax*4]
mov dword [ebp - 0x15b8], ecx
mov dword [ebp - 0x1598], eax
mov dword [ebp - 0x1570], edx
mov ebx, eax
mov dword [ebp - 0x1568], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0x1560], edx
lea edi, [ecx + 2]
mov dword [ebp - 0x1554], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc23e4f
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x158c]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x1554]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x1560]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x158c]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x1560]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x15b2]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x1560]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x1568]
cdq
idiv ecx
mov edx, dword [ebp - 0x1560]
add al, bl
mov ebx, dword [ebp - 0x1554]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x1560], edx
mov dword [ebp - 0x1568], esi
jne 0xc23d89
mov ecx, dword [ebp - 0x15b8]
mov eax, dword [ebp - 0x1598]
add ecx, dword [ebp - 0x1594]
add eax, dword [ebp - 0x1570]
sub dword [ebp - 0x157c], 1
mov esi, dword [ebp - 0x155c]
mov dword [ebp - 0x15b8], ecx
mov dword [ebp - 0x1598], eax
jne 0xc23d6d
mov edi, dword [ebp - 0x1580]
xor ebx, ebx
push dword [ebp - 0x1574]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1558]
test eax, eax
je 0xc23edc
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1564], 0
jl 0xc24e3b
jmp 0xc24de9
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x154c], 0
jne 0xc23f13
cmp edi, ecx
je 0xc23f13
mov al, 0xc0
jmp 0xc23f15
or al, 0xff
mov esi, dword [0xc93008]
push dword [ebp - 0x15c4]
mov byte [ebp - 0x1596], al
mov eax, ebx
mov byte [ebp - 0x1595], cl
mov ecx, esi
mov byte [ebp - 0x1598], bl
mov byte [ebp - 0x1597], bl
mov dword [ebp - 0x1558], eax
mov dword [ebp - 0x1b50], eax
mov dword [ebp - 0x155c], ebx
mov dword [ebp - 0x1b4c], eax
mov dword [ebp - 0x1b48], ebx
mov dword [ebp - 0x1b44], ebx
mov dword [ebp - 0x1594], ebx
mov dword [ebp - 0x1b20], eax
mov dword [ebp - 0x1b1c], ebx
mov dword [ebp - 0x1b18], ebx
mov dword [ebp - 0x1b14], ebx
call dword [0xc99200]
call esi
mov dword [ebp - 0x15bc], eax
test eax, eax
jne 0xc23f9c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc24e3b
xor eax, eax
inc eax
cmp edi, eax
jne 0xc240ad
mov edi, dword [ebp - 0x1524]
mov eax, edi
mov edx, dword [ebp - 0x1514]
mov ecx, edx
sub ecx, dword [ebp - 0x151c]
sub eax, dword [ebp - 0x152c]
mov dword [ebp - 0x1570], ecx
cmp ecx, eax
jg 0xc23fd5
mov ecx, eax
mov dword [ebp - 0x1570], eax
mov esi, dword [ebp - 0x1510]
mov eax, esi
sub eax, dword [ebp - 0x1528]
cmp dword [ebp - 0x1550], 0
mov dword [ebp - 0x1560], eax
mov eax, ebx
mov dword [ebp - 0x1588], ebx
je 0xc24038
mov eax, dword [ebp - 0x152c]
sub eax, edi
add ecx, eax
mov eax, dword [ebp - 0x151c]
sub eax, edx
mov dword [ebp - 0x1558], ecx
add eax, dword [ebp - 0x1570]
mov dword [ebp - 0x1594], eax
mov dword [ebp - 0x1b20], eax
mov dword [ebp - 0x1588], eax
mov eax, ecx
mov dword [ebp - 0x1b50], ecx
mov dword [ebp - 0x1554], ecx
sub edi, dword [ebp - 0x152c]
sub edx, dword [ebp - 0x151c]
add edi, eax
mov eax, dword [ebp - 0x1520]
sub eax, dword [ebp - 0x1528]
add edx, dword [ebp - 0x1588]
sub esi, dword [ebp - 0x1518]
mov dword [ebp - 0x1554], edi
mov dword [ebp - 0x1b48], edi
mov edi, dword [ebp - 0x1518]
sub edi, dword [ebp - 0x1528]
add esi, edi
mov dword [ebp - 0x1580], eax
mov dword [ebp - 0x1b44], eax
mov dword [ebp - 0x1564], edx
mov dword [ebp - 0x1b18], edx
mov dword [ebp - 0x1574], edi
mov dword [ebp - 0x1b1c], edi
mov dword [ebp - 0x157c], esi
mov dword [ebp - 0x1b14], esi
jmp 0xc24145
mov eax, dword [ebp - 0x7c0]
lea esi, [ebp - 0x152c]
lea edi, [ebp - 0x1b50]
mov dword [ebp - 0x1570], eax
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x7bc]
mov dword [ebp - 0x1560], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1b44]
lea esi, [ebp - 0x151c]
lea edi, [ebp - 0x1b20]
mov dword [ebp - 0x1580], eax
mov eax, dword [ebp - 0x1b48]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1554], eax
mov eax, dword [ebp - 0x1b4c]
mov dword [ebp - 0x155c], eax
mov eax, dword [ebp - 0x1b50]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1558], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1b14]
mov dword [ebp - 0x157c], eax
mov eax, dword [ebp - 0x1b18]
mov dword [ebp - 0x1564], eax
mov eax, dword [ebp - 0x1b1c]
mov dword [ebp - 0x1574], eax
mov eax, dword [ebp - 0x1b20]
mov dword [ebp - 0x1594], eax
mov eax, dword [ebp - 0x1560]
mov esi, dword [0xc9300c]
neg eax
mov edi, dword [ebp - 0x1570]
mov ecx, esi
mov dword [ebp - 0x908], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x1920], ebx
mov word [ebp - 0x904], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x902], ax
lea eax, [ebp - 0x1920]
push eax
push ebx
lea eax, [ebp - 0x910]
mov dword [ebp - 0x900], ebx
push eax
push dword [ebp - 0x15bc]
mov dword [ebp - 0x8fc], ebx
mov dword [ebp - 0x8f8], ebx
mov dword [ebp - 0x8f4], ebx
mov dword [ebp - 0x8f0], ebx
mov dword [ebp - 0x8ec], ebx
mov dword [ebp - 0x8e8], ebx
mov dword [ebp - 0x910], 0x28
mov dword [ebp - 0x90c], edi
call dword [0xc99200]
call esi
mov dword [ebp - 0x1588], eax
test eax, eax
jne 0xc241e9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc24e20
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push dword [ebp - 0x15bc]
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0x15b4], eax
jne 0xc24251
mov ecx, dword [ebp - 0x15a0]
test ecx, ecx
je 0xc24251
mov eax, dword [ebp - 0x1560]
mov esi, dword [0xc93074]
push ecx
mov dword [ebp - 0x72c], eax
mov ecx, esi
lea eax, [ebp - 0x738]
mov dword [ebp - 0x738], ebx
push eax
push dword [ebp - 0x15bc]
mov dword [ebp - 0x734], ebx
mov dword [ebp - 0x730], edi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x154c]
mov esi, dword [ebp - 0x1548]
mov dword [ebp - 0x1568], eax
mov eax, dword [ebp - 0x153c]
push 0x54
mov dword [ebp - 0x1590], eax
lea eax, [ebp - 0x1340]
push ebx
push eax
mov dword [ebp - 0x156c], esi
call fcn.00ab4bf6
add esp, 0xc
lea eax, [ebp - 0x12e8]
push 0x54
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x159c], ebx
lea eax, [ebp - 0x994]
mov dword [ebp - 0x1584], ebx
mov dword [ebp - 0x15a8], ebx
mov dword [ebp - 0x15b0], ebx
push 0x2c
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x748]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0xc24e05
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [ebp - 0x15bc]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc242ff
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc24e05
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x1340]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc24341
mov eax, dword [ebp - 0x132c]
mov dword [ebp - 0x159c], eax
mov eax, dword [ebp - 0x133c]
mov dword [ebp - 0x15a8], eax
mov eax, dword [ebp - 0x1338]
mov dword [ebp - 0x15b0], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x15c0], ecx
test ecx, ecx
je 0xc242f4
mov eax, dword [ebp - 0x155c]
sub eax, dword [ebp - 0x1580]
mov edi, dword [ebp - 0x1554]
sub edi, dword [ebp - 0x1558]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x98c], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x191c], ebx
mov word [ebp - 0x988], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x986], ax
lea eax, [ebp - 0x191c]
push eax
push ebx
lea eax, [ebp - 0x994]
mov dword [ebp - 0x15cc], ebx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x984], ebx
mov dword [ebp - 0x980], ebx
mov dword [ebp - 0x97c], ebx
mov dword [ebp - 0x978], ebx
mov dword [ebp - 0x974], ebx
mov dword [ebp - 0x970], ebx
mov dword [ebp - 0x96c], ebx
mov dword [ebp - 0x994], 0x28
mov dword [ebp - 0x990], edi
call dword [0xc99200]
call esi
mov dword [ebp - 0x1554], eax
test eax, eax
jne 0xc2443d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x15cc], eax
test eax, eax
jle 0xc24422
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x15cc], eax
test eax, eax
mov edi, dword [ebp - 0x15c0]
js 0xc247b4
mov dword [ebp - 0x15cc], 0x80004005
jmp 0xc247b4
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x12e8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc24467
mov eax, dword [ebp - 0x12d4]
mov dword [ebp - 0x1584], eax
push dword [ebp - 0x1554]
mov eax, dword [ebp - 0x1580]
sub eax, dword [ebp - 0x155c]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x740], edi
mov edi, dword [ebp - 0x15c0]
push edi
mov dword [ebp - 0x73c], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0x1590]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
push ebx
mov dword [ebp - 0x1580], eax
call dword [0xc99200]
call esi
mov esi, dword [ebp - 0x15c0]
mov ecx, edi
push eax
lea eax, [ebp - 0x748]
push eax
push esi
call dword [0xc99200]
call edi
push ebx
push dword [ebp - 0x15b8]
lea eax, [ebp - 0x748]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x156c]
push esi
mov esi, dword [0xc9306c]
mov ecx, esi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0x15b4], eax
jne 0xc2455f
cmp dword [ebp - 0x1568], 0
je 0xc24553
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0x1568], eax
jmp 0xc24569
mov dword [ebp - 0x1568], 0xffffff
jmp 0xc24569
mov dword [ebp - 0x1568], 0xffa8a8a8
mov ecx, dword [ebp - 0x1558]
mov esi, ebx
mov dword [ebp - 0x1590], ebx
mov edx, ebx
test ecx, ecx
jns 0xc24589
mov esi, ecx
mov ecx, ebx
neg esi
mov dword [ebp - 0x1590], esi
mov eax, dword [ebp - 0x155c]
test eax, eax
jns 0xc24599
mov edx, eax
mov eax, ebx
neg edx
mov edi, dword [ebp - 0x740]
sub edi, esi
mov esi, dword [ebp - 0x15a8]
sub esi, ecx
mov dword [ebp - 0x1558], edi
cmp edi, esi
jl 0xc245bb
mov edi, esi
mov dword [ebp - 0x1558], esi
mov esi, dword [ebp - 0x73c]
sub dword [ebp - 0x15b0], eax
sub esi, edx
mov dword [ebp - 0x155c], esi
cmp esi, dword [ebp - 0x15b0]
jl 0xc245e3
mov esi, dword [ebp - 0x15b0]
mov dword [ebp - 0x155c], esi
test edi, edi
jle 0xc2477c
test esi, esi
jle 0xc2477c
imul eax, dword [ebp - 0x15a8]
imul edx, dword [ebp - 0x740]
mov edi, dword [ebp - 0x1584]
add eax, ecx
mov ecx, dword [ebp - 0x159c]
add edx, dword [ebp - 0x1590]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x740]
shl ecx, 2
lea ebx, [edi + edx*4]
mov dword [ebp - 0x159c], ecx
mov ecx, dword [ebp - 0x15a8]
shl ecx, 2
mov dword [ebp - 0x1590], ebx
mov dword [ebp - 0x156c], eax
mov dword [ebp - 0x1584], ecx
mov esi, eax
lea edx, [eax + 3]
sub esi, ebx
mov dword [ebp - 0x15a8], edx
lea edi, [ebx + 2]
mov dword [ebp - 0x15b0], esi
mov ebx, dword [ebp - 0x1558]
mov dword [ebp - 0x15f0], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc2472d
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0x1568]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x15b0]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x15a8]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x1568]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x15a8]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x1566]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x15a8]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x15b0]
cdq
idiv ecx
mov edx, dword [ebp - 0x15a8]
add al, bl
mov ebx, dword [ebp - 0x15f0]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0x15a8], edx
mov dword [ebp - 0x15f0], ebx
jne 0xc24667
mov ebx, dword [ebp - 0x1590]
mov eax, dword [ebp - 0x156c]
add ebx, dword [ebp - 0x159c]
add eax, dword [ebp - 0x1584]
sub dword [ebp - 0x155c], 1
mov dword [ebp - 0x1590], ebx
mov dword [ebp - 0x156c], eax
jne 0xc24645
xor ebx, ebx
push dword [ebp - 0x1554]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1580]
mov edi, dword [ebp - 0x15c0]
test eax, eax
je 0xc247b4
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x15cc], 0
jl 0xc24e05
mov eax, dword [ebp - 0x154c]
mov esi, dword [ebp - 0x1544]
mov dword [ebp - 0x1558], eax
mov eax, dword [ebp - 0x1538]
push 0x54
mov dword [ebp - 0x155c], eax
lea eax, [ebp - 0x1290]
push ebx
push eax
mov dword [ebp - 0x1554], esi
call fcn.00ab4bf6
add esp, 0xc
lea eax, [ebp - 0x1238]
push 0x54
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x1580], ebx
lea eax, [ebp - 0x9c0]
mov dword [ebp - 0x1568], ebx
mov dword [ebp - 0x1590], ebx
mov dword [ebp - 0x156c], ebx
push 0x2c
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x758]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0xc24e05
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [ebp - 0x15bc]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xc242f4
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x1290]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc248bb
mov eax, dword [ebp - 0x127c]
mov dword [ebp - 0x1580], eax
mov eax, dword [ebp - 0x128c]
mov dword [ebp - 0x1590], eax
mov eax, dword [ebp - 0x1288]
mov dword [ebp - 0x156c], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x159c], ecx
test ecx, ecx
je 0xc242f4
mov eax, dword [ebp - 0x1564]
sub eax, dword [ebp - 0x1594]
mov edi, dword [ebp - 0x1574]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x1564], eax
mov dword [ebp - 0x9bc], eax
mov eax, edi
sub eax, dword [ebp - 0x157c]
mov dword [ebp - 0x9b8], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x1918], ebx
mov word [ebp - 0x9b4], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x9b2], ax
lea eax, [ebp - 0x1918]
push eax
push ebx
lea eax, [ebp - 0x9c0]
mov dword [ebp - 0x1584], ebx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x9b0], ebx
mov dword [ebp - 0x9ac], ebx
mov dword [ebp - 0x9a8], ebx
mov dword [ebp - 0x9a4], ebx
mov dword [ebp - 0x9a0], ebx
mov dword [ebp - 0x99c], ebx
mov dword [ebp - 0x998], ebx
mov dword [ebp - 0x9c0], 0x28
call dword [0xc99200]
call esi
mov dword [ebp - 0x15a8], eax
test eax, eax
jne 0xc249c3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x1584], eax
test eax, eax
jle 0xc249a8
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1584], eax
test eax, eax
mov edi, dword [ebp - 0x159c]
js 0xc24d43
mov dword [ebp - 0x1584], 0x80004005
jmp 0xc24d43
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x1238]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc249ed
mov eax, dword [ebp - 0x1224]
mov dword [ebp - 0x1568], eax
mov eax, dword [ebp - 0x1564]
push dword [ebp - 0x15a8]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x750], eax
mov eax, dword [ebp - 0x157c]
sub eax, edi
mov edi, dword [ebp - 0x159c]
push edi
mov dword [ebp - 0x74c], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0x155c]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
push ebx
mov dword [ebp - 0x155c], eax
call dword [0xc99200]
call esi
mov esi, dword [ebp - 0x159c]
mov ecx, edi
push eax
lea eax, [ebp - 0x758]
push eax
push esi
call dword [0xc99200]
call edi
push ebx
push dword [ebp - 0x15b8]
lea eax, [ebp - 0x758]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x1554]
push esi
mov esi, dword [0xc9306c]
mov ecx, esi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0x15b4], eax
jne 0xc24aef
cmp dword [ebp - 0x1558], 0
je 0xc24ae3
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x158c], ecx
mov dword [ebp - 0x15b8], ecx
jmp 0xc24b00
mov dword [ebp - 0x15b8], 0xffffff
jmp 0xc24b00
mov eax, 0xffa8a8a8
mov dword [ebp - 0x158c], eax
mov dword [ebp - 0x15b8], eax
mov edx, dword [ebp - 0x1594]
mov edi, ebx
mov eax, ebx
test edx, edx
jns 0xc24b18
mov edi, edx
mov dword [ebp - 0x1594], ebx
neg edi
mov ecx, dword [ebp - 0x1574]
test ecx, ecx
jns 0xc24b28
mov eax, ecx
mov ecx, ebx
neg eax
mov esi, dword [ebp - 0x750]
mov edx, dword [ebp - 0x1590]
sub esi, edi
sub edx, dword [ebp - 0x1594]
mov dword [ebp - 0x1558], esi
cmp esi, edx
jl 0xc24b4e
mov esi, edx
mov dword [ebp - 0x1558], edx
mov edx, dword [ebp - 0x74c]
sub dword [ebp - 0x156c], ecx
sub edx, eax
mov dword [ebp - 0x1554], edx
cmp edx, dword [ebp - 0x156c]
jl 0xc24b76
mov edx, dword [ebp - 0x156c]
mov dword [ebp - 0x1554], edx
test esi, esi
jle 0xc24d0b
test edx, edx
jle 0xc24d0b
mov edx, dword [ebp - 0x750]
imul ecx, dword [ebp - 0x1590]
imul eax, edx
shl edx, 2
add ecx, dword [ebp - 0x1594]
add eax, edi
mov edi, dword [ebp - 0x1568]
lea eax, [edi + eax*4]
mov edi, dword [ebp - 0x1580]
mov dword [ebp - 0x1580], edx
mov edx, dword [ebp - 0x1590]
shl edx, 2
lea ecx, [edi + ecx*4]
mov dword [ebp - 0x1564], eax
mov dword [ebp - 0x1594], ecx
mov dword [ebp - 0x1574], edx
mov ebx, ecx
mov dword [ebp - 0x1590], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [ebp - 0x157c], edx
lea edi, [eax + 2]
mov dword [ebp - 0x1568], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc24cb6
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x158c]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x1568]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x157c]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x158c]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x157c]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x15b6]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x157c]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x1590]
cdq
idiv ecx
mov edx, dword [ebp - 0x157c]
add al, bl
mov ebx, dword [ebp - 0x1568]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x157c], edx
mov dword [ebp - 0x1590], esi
jne 0xc24bf0
mov eax, dword [ebp - 0x1564]
mov ecx, dword [ebp - 0x1594]
add eax, dword [ebp - 0x1580]
add ecx, dword [ebp - 0x1574]
sub dword [ebp - 0x1554], 1
mov esi, dword [ebp - 0x1558]
mov dword [ebp - 0x1564], eax
mov dword [ebp - 0x1594], ecx
jne 0xc24bd4
xor ebx, ebx
push dword [ebp - 0x15a8]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x155c]
mov edi, dword [ebp - 0x159c]
test eax, eax
je 0xc24d43
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1584], 0
jl 0xc24e05
xor eax, eax
inc eax
cmp dword [ebp - 0x15b4], eax
jne 0xc24da9
mov esi, dword [section..data]
mov ecx, esi
push 0xcc0020
push ebx
push ebx
push dword [ebp - 0x15bc]
push dword [ebp - 0x1560]
push dword [ebp - 0x1570]
push dword [ebp - 0x1528]
push dword [ebp - 0x152c]
push dword [ebp - 0x15c4]
call dword [0xc99200]
call esi
jmp 0xc24de9
push dword [ebp - 0x1598]
mov ecx, dword [ebp - 0x1560]
mov eax, dword [ebp - 0x1570]
mov esi, dword [0xc93020]
push ecx
push eax
push ebx
push ebx
push dword [ebp - 0x15bc]
push ecx
push eax
push dword [ebp - 0x7c4]
mov ecx, esi
push dword [ebp - 0x7c8]
push dword [ebp - 0x15c4]
call dword [0xc99200]
call esi
push dword [ebp - 0x1578]
mov esi, dword [0xc93040]
mov ecx, esi
push dword [ebp - 0x15c4]
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1588]
test eax, eax
je 0xc24e20
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x15bc]
test eax, eax
je 0xc24e3b
mov esi, dword [0xc93018]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x15a0]
test eax, eax
je 0xc24e56
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov edi, 0xc96238
mov ecx, dword [ebp - 0x1548]
test ecx, ecx
je 0xc24eaa
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc24e68
mov eax, dword [ebp - 0x1548]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc24e90
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xc24e88
push dword [ebp - 0x1548]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x1548], ebx
mov ecx, dword [ebp - 0x1544]
test ecx, ecx
je 0xc24ef9
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc24eb7
mov eax, dword [ebp - 0x1544]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc24edf
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xc24ed7
push dword [ebp - 0x1544]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x1544], ebx
mov edx, dword [ebp - 0x1540]
test edx, edx
je 0xc24f45
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc24f08
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc24f30
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xc24f22
mov edx, dword [ebp - 0x1540]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x1540], ebx
cmp dword [ebp - 0x153c], 0
je 0xc24f6a
push dword [ebp - 0x153c]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x153c], ebx
cmp dword [ebp - 0x1538], 0
je 0xc24f8f
push dword [ebp - 0x1538]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x1538], ebx
cmp dword [ebp - 0x1534], 0
je 0xc24fb4
push dword [ebp - 0x1534]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x1534], ebx
xor eax, eax
lea ecx, [eax + 1]
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc24fb4
mov eax, dword [0xc95890]
test eax, eax
jle 0xc25013
sub eax, 1
mov dword [0xc95890], eax
jne 0xc25013
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc24fe7
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc24fd6
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0xc95878]
mov esi, dword [0xc9304c]
mov ecx, esi
mov dword [ebp - 0x15b4], eax
call dword [0xc99200]
call esi
sub eax, dword [0xc95870]
lea edi, [ebp - 0x5f4]
push 7
mov dword [ebp - 0x15bc], eax
mov edx, 0xc96238
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
xor eax, eax
lea ecx, [eax + 1]
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc25050
mov eax, dword [0xc95890]
test eax, eax
jne 0xc2565a
push 0x338
mov edi, ebx
mov dword [ebp - 0x1588], ebx
push ebx
mov dword [ebp - 0x15a0], edi
mov dword [ebp - 0x1634], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1654], eax
test eax, eax
je 0xc255f3
or dword [ebp - 0x15e4], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0x15d0], ebx
mov dword [ebp - 0x1630], ebx
mov edx, ebx
mov dword [ebp - 0x166c], eax
mov esi, dword [ebp - 0x1758]
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [ebp - 0x16a4], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [ebp - 0x1758], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [ebp - 0x1630]
xor esi, edx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x16a4]
xor eax, edx
mov dword [ebp - 0x16a4], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x16a4]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x16a4]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x16a4], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x16a4]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x16a4]
xor edx, eax
mov dword [ebp - 0x16a4], edx
mov eax, dword [ebp - 0x16a4]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x16a4]
xor eax, edx
mov dword [ebp - 0x16a4], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x16a4]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x16a4]
xor eax, edx
mov dword [ebp - 0x16a4], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x16a4]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0x16a4]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0x16a4], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0x16a4]
xor eax, 0xab69605e
mov dword [ebp - 0x1630], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1630]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x1630]
xor eax, edx
mov dword [ebp - 0x1630], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x1630], edx
mov edx, dword [ebp - 0x1630]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x1630], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1630]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x1630]
xor eax, edx
mov dword [ebp - 0x1630], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1630]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x1630]
xor eax, edx
mov dword [ebp - 0x1630], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1630]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x1630]
xor edx, dword [ebp - 0x15d0]
xor eax, dword [ebp - 0x15e4]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x16a4], esi
mov esi, dword [ebp - 0x166c]
mov dword [ebp - 0x15d0], ebx
mov dword [ebp - 0x15e4], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x175c], 1
mov dword [ebp - 0x1630], eax
mov dword [ebp - 0x166c], esi
jne 0xc250bf
mov esi, dword [ebp - 0x1654]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc25436
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc25461
cmp edx, dword [0x9fc02c]
jne 0xc25461
mov edi, esi
mov dword [ebp - 0x15a0], esi
mov esi, ebx
jmp 0xc25474
or dword [ebp - 0x1760], 0xffffffff
mov edi, ebx
mov dword [ebp - 0x1634], 0xc004d501
test esi, esi
je 0xc25487
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x1634], ebx
jl 0xc255ed
mov eax, dword [ebp - 0x1760]
mov esi, edi
push 0x40
push ebx
push 0xc960a0
mov byte [eax + edi], bl
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], bl
je 0xc255fa
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0x1634], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc254c8
sub ecx, dword [ebp - 0x1634]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc255e6
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0x1578], ecx
cmp word [eax], dx
je 0xc25510
mov ecx, 0xc000007b
mov dword [ebp - 0x1578], ecx
jmp 0xc25558
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc25503
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc25503
cmp dword [edx], 0x4550
jne 0xc25503
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0x1764]
je 0xc25546
cmp ax, word [ebp - 0x1768]
je 0xc25546
mov ecx, 0xc000000d
jmp 0xc25508
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0x1634], eax
mov dword [ebp - 0x1654], ebx
test eax, eax
je 0xc255d3
mov edx, esi
mov dword [ebp - 0x15d0], esi
lea eax, [edx + 1]
mov dword [ebp - 0x15e4], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc2557f
sub edx, dword [ebp - 0x15e4]
inc esi
add esi, edx
test ecx, ecx
js 0xc255b8
push dword [ebp - 0x15d0]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc255de
mov ecx, dword [ebp - 0x1588]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x1578]
mov eax, dword [ebp - 0x1654]
inc dword [ebp - 0x1588]
inc eax
mov dword [ebp - 0x1654], eax
cmp eax, dword [ebp - 0x1634]
jb 0xc2556e
add edi, 0x10
cmp byte [esi], bl
jne 0xc254bb
mov esi, dword [ebp - 0x1578]
jmp 0xc255fc
mov esi, 0xc000007a
jmp 0xc255fc
mov edi, dword [ebp - 0x15a0]
mov esi, 0xc000007a
jmp 0xc25602
mov esi, ebx
mov edi, dword [ebp - 0x15a0]
test edi, edi
je 0xc25615
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push edi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0xc25655
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc2562c
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc2561b
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc25660
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edi, 0xc96238
xchg dword [edi], eax
mov eax, dword [ebp - 0x15bc]
xor ecx, ecx
mov esi, dword [0xc93068]
inc ecx
mov dword [ebp - 0x5f4], eax
mov eax, dword [ebp - 0x15b4]
mov dword [ebp - 0x5dc], eax
lea eax, [ebp - 0x5f8]
push eax
push 4
push 0x2021
mov dword [ebp - 0x5f8], ecx
mov dword [ebp - 0x5f0], ecx
mov dword [ebp - 0x5e4], ecx
mov dword [ebp - 0x5e8], ecx
mov dword [ebp - 0x5e0], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x5ec], 0x9966f291
call dword [0xc99200]
call esi
xor eax, eax
lea ecx, [eax + 1]
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc256cb
mov eax, dword [0xc95890]
test eax, eax
jle 0xc2572a
sub eax, 1
mov dword [0xc95890], eax
jne 0xc2572a
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc256fe
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc256ed
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0x15c4]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
jmp 0xc2084a
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1630], eax
test eax, eax
jne 0xc2576e
mov esi, 0xc0000017
jmp 0xc2581d
lea ecx, [ebp - 0x15e0]
mov dword [ebp - 0x15e0], eax
push ecx
mov edx, edi
mov dword [eax], edi
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc25804
mov ecx, dword [ebp - 0x15e0]
mov edx, edi
mov eax, dword [ebp - 0x1644]
mov dword [ecx], eax
lea eax, [ebp - 0x15e0]
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0x1630]
test esi, esi
js 0xc2580a
mov ecx, dword [ebp - 0x15e4]
push dword [ebp - 0x1644]
mov edx, dword [ebp - 0x161c]
push dword [ebp - 0x1704]
mov dword [eax + ecx - 8], edx
mov edx, dword [ebp - 0x15d0]
push dword [ebp - 0x15e0]
mov dword [eax + ecx - 4], edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0x1630]
add esp, 0xc
mov ecx, dword [ebp - 0x15e4]
mov dword [ebp - 0x1718], eax
mov eax, ebx
mov dword [ebp - 0x15f4], ecx
jmp 0xc2580a
mov eax, dword [ebp - 0x1630]
test eax, eax
je 0xc2581d
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xc27254
cmp dword [ebp - 0x1718], 0
mov dword [ebp - 0x15e0], ebx
jne 0xc25842
mov esi, 0xc000000d
jmp 0xc25ed5
mov esi, dword [ebp - 0x15f4]
test esi, esi
je 0xc25fb9
lea eax, [esi + 8]
push eax
push ebx
mov dword [ebp - 0x161c], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1644], eax
test eax, eax
je 0xc25fb9
mov edi, dword [ebp - 0x1718]
mov cl, bl
mov eax, ebx
test esi, esi
je 0xc2588c
xor cl, byte [eax + edi]
inc eax
cmp eax, esi
jb 0xc25884
mov eax, esi
mov dword [ebp - 0x6b0], 0xb1b54a58
shr eax, 3
mov dword [ebp - 0x6ac], 0xc81ecb17
mov dword [ebp - 0x15d0], eax
test eax, eax
je 0xc25d09
movzx edx, word [ebp - 0x6ae]
mov eax, 0xc81ecb17
movzx esi, ax
movzx eax, word [ebp - 0x6aa]
mov dword [ebp - 0x15e4], eax
mov eax, 0xb1b54a58
movzx eax, ax
mov dword [ebp - 0x1630], eax
mov eax, dword [ebp - 0x1644]
mov dword [ebp - 0x16a4], esi
add eax, 7
lea esi, [edi + 2]
mov dword [ebp - 0x166c], edx
mov dword [ebp - 0x1700], eax
or edx, 0xffffffff
mov dword [ebp - 0x16fc], esi
mov dword [ebp - 0x16f8], ebx
mov dword [ebp - 0x16f4], ebx
mov dword [ebp - 0x16f0], ebx
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0x16fc]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0x16fc]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0x16fc]
shl esi, 8
add dword [ebp - 0x16fc], 8
movzx eax, byte [eax + 5]
or esi, eax
xor edx, esi
mov dword [ebp - 0x16ec], esi
mov eax, edx
mov dword [ebp - 0x16e8], edx
sub eax, dword [ebp - 0x1630]
mov esi, 0xc81ecb17
xor eax, dword [ebp - 0x16f8]
xor eax, esi
xor eax, edi
mov edx, eax
mov dword [ebp - 0x16f8], eax
xor edx, esi
ror eax, 7
ror edx, 0xf
imul edx, dword [ebp - 0x166c]
mov esi, dword [ebp - 0x15e4]
add edx, eax
mov eax, dword [ebp - 0x16e8]
xor eax, edx
mov edx, 0xb1b54a58
add edx, eax
mov dword [ebp - 0x16e8], eax
ror edx, 9
imul edx, dword [ebp - 0x16a4]
ror eax, 0xa
sub edx, eax
mov eax, dword [ebp - 0x16f8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x16f8], eax
xor edx, dword [ebp - 0x16a4]
rol edx, 4
imul edx, esi
rol eax, 5
add edx, eax
mov eax, dword [ebp - 0x16e8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x16e8], eax
xor edx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, edx
mov edx, dword [ebp - 0x16f8]
xor edx, eax
mov dword [ebp - 0x16f8], edx
sub edx, dword [ebp - 0x1630]
imul edx, dword [ebp - 0x166c]
mov eax, dword [ebp - 0x16f8]
shr eax, 6
sub edx, eax
xor dword [ebp - 0x16e8], edx
mov edx, dword [ebp - 0x16e8]
mov eax, edx
ror eax, 0xf
xor eax, dword [ebp - 0x16a4]
imul eax, dword [ebp - 0x1630]
xor dword [ebp - 0x16f8], eax
mov eax, dword [ebp - 0x16f8]
not eax
ror eax, 3
add eax, esi
imul eax, dword [ebp - 0x16a4]
xor edx, eax
mov eax, edx
mov dword [ebp - 0x16e8], edx
mov edx, dword [ebp - 0x16f8]
sub eax, 0xc81ecb17
sub eax, dword [ebp - 0x1630]
xor edx, eax
mov dword [ebp - 0x16f8], edx
mov eax, dword [ebp - 0x16f8]
xor eax, esi
ror edx, 0xa
imul eax, dword [ebp - 0x166c]
xor edx, eax
mov eax, dword [ebp - 0x16e8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x16e8], eax
xor edx, dword [ebp - 0x1630]
rol edx, 6
imul edx, dword [ebp - 0x16a4]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0x16f8]
xor eax, edx
mov edx, dword [ebp - 0x16e8]
mov dword [ebp - 0x16f8], eax
ror eax, 0xf
sub eax, esi
imul eax, dword [ebp - 0x1630]
xor edx, eax
mov dword [ebp - 0x16e8], edx
xor edx, esi
imul edx, dword [ebp - 0x1630]
mov eax, dword [ebp - 0x16e8]
shr eax, 1
xor edx, eax
mov eax, dword [ebp - 0x16e8]
xor dword [ebp - 0x16f8], edx
mov edx, eax
sub edx, dword [ebp - 0x16a4]
rol edx, 3
imul edx, dword [ebp - 0x1630]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0x16f8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x16f8], eax
sub edx, dword [ebp - 0x16a4]
imul edx, dword [ebp - 0x166c]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x16e8]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0x16e8], eax
ror edx, 9
imul edx, dword [ebp - 0x16a4]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0x16f8]
xor eax, edx
mov edx, dword [ebp - 0x16e8]
mov dword [ebp - 0x16f8], eax
sub eax, 0xb1b54a58
sub eax, esi
xor edx, eax
mov eax, dword [ebp - 0x166c]
mov dword [ebp - 0x16e8], edx
xor eax, dword [ebp - 0x16e8]
imul eax, dword [ebp - 0x1630]
ror edx, 7
sub eax, edx
mov edx, esi
xor dword [ebp - 0x16f8], eax
mov eax, dword [ebp - 0x16f8]
xor edx, eax
rol edx, 4
imul edx, dword [ebp - 0x166c]
ror eax, 0x10
sub edx, eax
mov eax, dword [ebp - 0x16e8]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0x16e8], eax
ror edx, 0xa
imul edx, dword [ebp - 0x16a4]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0x16f8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x16f8], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, esi
mov esi, 0xc81ecb17
xor edx, eax
mov eax, dword [ebp - 0x16e8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x16e8], eax
xor edx, esi
rol eax, 2
rol edx, 8
imul edx, dword [ebp - 0x1630]
sub edx, eax
mov eax, dword [ebp - 0x16f8]
xor eax, edx
mov edx, esi
sub edx, eax
mov dword [ebp - 0x16f8], eax
ror edx, 0xb
imul edx, dword [ebp - 0x166c]
ror eax, 0xc
sub edx, eax
mov eax, dword [ebp - 0x16e8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x16e8], eax
xor edx, dword [ebp - 0x166c]
imul edx, dword [ebp - 0x16a4]
shr eax, 8
xor edx, eax
mov eax, dword [ebp - 0x16f8]
xor eax, edx
mov edx, dword [ebp - 0x16e8]
xor edx, eax
xor eax, dword [ebp - 0x16f4]
xor edx, esi
mov dword [ebp - 0x16f4], edi
mov esi, dword [ebp - 0x1700]
xor edx, 0xb1b54a58
xor edx, dword [ebp - 0x16f0]
mov byte [esi - 4], al
mov byte [esi], dl
ror eax, 8
mov byte [esi - 5], al
ror edx, 8
mov byte [esi - 1], dl
ror eax, 8
mov byte [esi - 6], al
ror edx, 8
mov byte [esi - 2], dl
ror eax, 8
ror edx, 8
mov byte [esi - 7], al
mov byte [esi - 3], dl
mov esi, dword [ebp - 0x16ec]
ror eax, 8
ror edx, 8
add dword [ebp - 0x1700], 8
mov dword [ebp - 0x16f8], eax
mov dword [ebp - 0x16f0], esi
sub dword [ebp - 0x15d0], 1
mov esi, dword [ebp - 0x16fc]
jne 0xc25916
mov esi, dword [ebp - 0x15f4]
movzx eax, cl
mov ecx, dword [ebp - 0x1644]
cdq
mov dword [ecx + esi], eax
mov dword [ecx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x15f4], edi
test edi, edi
jne 0xc25d41
mov esi, 0xc0000017
jmp 0xc25e43
mov esi, dword [ebp - 0x161c]
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0xc25d66
mov esi, 0xc0000017
jmp 0xc25de2
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0x1644]
push esi
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc25d5f
mov dword [edi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
push 8
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x15f4]
pop eax
push eax
push eax
mov dword [edi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0xc25d5f
mov dword [edi + 0x14], ecx
mov eax, dword [0xc94e90]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ebp - 0x15e0], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0xc25e43
cmp dword [edi + 4], 0
je 0xc25e00
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xc25e1a
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xc25e34
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc25e57
mov eax, dword [ebp - 0x15e0]
mov edi, ebx
mov dword [ebp - 0x1714], eax
jmp 0xc25e5d
mov edi, dword [ebp - 0x15e0]
push dword [ebp - 0x1644]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xc25ed2
cmp dword [edi + 4], 0
je 0xc25e8f
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xc25ea9
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xc25ec3
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
push 4
pop edi
or esi, 0x10000000
jl 0xc27254
mov edx, dword [ebp - 0x1714]
lea eax, [ebp - 0x15d4]
push eax
mov ecx, edi
mov dword [ebp - 0x15d4], edi
mov edx, dword [edx]
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc25f7f
mov ecx, dword [ebp - 0x15d4]
lea eax, [ebp - 0x15d4]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc25f7f
mov ecx, dword [ebp - 0x15d4]
lea eax, [ebp - 0x15d4]
push eax
mov eax, dword [ebp - 0x1714]
mov edx, dword [eax + 8]
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc25f7f
mov ecx, dword [ebp - 0x15d4]
lea eax, [ebp - 0x15d4]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc25f7f
mov ecx, dword [ebp - 0x15d4]
lea eax, [ebp - 0x15d4]
push eax
mov eax, dword [ebp - 0x1714]
mov edx, dword [eax + 0x10]
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0x15d4]
test esi, esi
jns 0xc25f85
mov eax, dword [ebp - 0x1910]
mov dword [ebp - 0x15d4], eax
test esi, esi
js 0xc2610f
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x15e0], ecx
test ecx, ecx
jne 0xc25fc3
mov esi, 0xc0000017
jmp 0xc2610f
mov esi, 0xc0000001
jmp 0xc25ed5
mov eax, dword [ebp - 0x1714]
mov edx, edi
mov dword [ebp - 0x1614], ecx
mov eax, dword [eax]
mov dword [ecx], eax
lea eax, [ebp - 0x1614]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc260f6
mov esi, dword [ebp - 0x1714]
push dword [esi]
push dword [esi + 4]
push dword [ebp - 0x1614]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [esi]
lea eax, [ebp - 0x1614]
mov ecx, dword [ebp - 0x1614]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc260f6
mov eax, dword [ebp - 0x1714]
mov edx, edi
mov ecx, dword [ebp - 0x1614]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0x1614]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc260f6
mov esi, dword [ebp - 0x1714]
push dword [esi + 8]
push dword [esi + 0xc]
push dword [ebp - 0x1614]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [esi + 8]
lea eax, [ebp - 0x1614]
mov ecx, dword [ebp - 0x1614]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc260f6
mov eax, dword [ebp - 0x1714]
mov edx, edi
mov ecx, dword [ebp - 0x1614]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0x1614]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc260f6
mov esi, dword [ebp - 0x1714]
push dword [esi + 0x10]
push dword [esi + 0x14]
push dword [ebp - 0x1614]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0x1614]
mov ecx, dword [ebp - 0x1614]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0x15e0]
test esi, esi
js 0xc260fc
mov ecx, dword [ebp - 0x15d4]
mov dword [ebp - 0x1710], eax
mov eax, ebx
mov dword [ebp - 0x1680], ecx
jmp 0xc260fc
mov eax, dword [ebp - 0x15e0]
test eax, eax
je 0xc2610f
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xc27254
push 8
pop eax
mov dword [ebp - 0x1614], ebx
mov dword [ebp - 0x15d4], ebx
mov dword [ebp - 0x190c], eax
mov edx, dword [ebp - 0x160c]
lea ecx, [ebp - 0x190c]
push ecx
mov ecx, eax
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
jl 0xc261a5
mov eax, dword [ebp - 0x190c]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xc26165
mov esi, 0xc0000095
jmp 0xc26186
mov dword [ebp - 0x1904], ecx
lea eax, [ebp - 0x1904]
push eax
push 8
pop edx
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0x1904]
test esi, esi
jns 0xc2618c
mov eax, dword [ebp - 0x1908]
mov dword [ebp - 0x15e0], eax
test esi, esi
js 0xc261a5
mov eax, dword [ebp - 0x1704]
test eax, eax
jne 0xc261d3
mov esi, 0xc000000d
mov eax, ebx
test esi, esi
js 0xc27254
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc263c9
mov esi, 0xd0000017
mov eax, ebx
jmp 0xc263d4
xor ecx, ecx
inc ecx
cmp edi, ecx
jbe 0xc261a0
mov ecx, eax
mov dword [ebp - 0x160c], ebx
mov dword [ebp - 0x164c], ecx
mov eax, dword [ecx]
mov edx, edi
mov dword [ebp - 0x15f4], eax
lea eax, [ebp - 0x164c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc261a5
mov edx, dword [ebp - 0x15f4]
lea eax, [ebp - 0x164c]
mov ecx, dword [ebp - 0x164c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc261a5
mov eax, dword [ebp - 0x160c]
xor ecx, ecx
inc eax
inc ecx
cmp eax, ecx
mov dword [ebp - 0x160c], eax
mov ecx, dword [ebp - 0x164c]
jb 0xc261e8
mov eax, dword [ecx]
mov edx, edi
mov dword [ebp - 0x160c], eax
lea eax, [ebp - 0x164c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc261a5
mov eax, dword [ebp - 0x160c]
mov dword [ebp - 0x1614], eax
cmp edi, 2
jbe 0xc261a0
mov ecx, dword [ebp - 0x1704]
mov dword [ebp - 0x15fc], ecx
mov dword [ebp - 0x164c], ebx
mov eax, dword [ecx]
mov edx, edi
mov dword [ebp - 0x160c], eax
lea eax, [ebp - 0x15fc]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc261a5
mov edx, dword [ebp - 0x160c]
lea eax, [ebp - 0x15fc]
mov ecx, dword [ebp - 0x15fc]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc261a5
mov eax, dword [ebp - 0x164c]
mov ecx, dword [ebp - 0x15fc]
inc eax
mov dword [ebp - 0x164c], eax
cmp eax, 2
jb 0xc26283
mov eax, dword [ecx]
mov edx, edi
mov dword [ebp - 0x164c], eax
lea eax, [ebp - 0x15fc]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc261a5
mov eax, dword [ebp - 0x164c]
mov dword [ebp - 0x15d4], eax
mov edx, dword [ebp - 0x15e0]
lea eax, [ebp - 0x1650]
push eax
mov ecx, edi
mov dword [ebp - 0x1650], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc2639f
mov ecx, dword [ebp - 0x1650]
lea eax, [ebp - 0x1650]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc2639f
mov edx, dword [ebp - 0x1614]
lea eax, [ebp - 0x1650]
mov ecx, dword [ebp - 0x1650]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc2639f
mov ecx, dword [ebp - 0x1650]
lea eax, [ebp - 0x1650]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc2639f
mov edx, dword [ebp - 0x15d4]
lea eax, [ebp - 0x1650]
mov ecx, dword [ebp - 0x1650]
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0x1650]
test esi, esi
jns 0xc263ad
mov eax, dword [ebp - 0x18e4]
test esi, esi
js 0xc261a5
cmp eax, 0x400000
jbe 0xc263be
mov esi, 0x8000ffff
jmp 0xc27254
mov dword [ebp - 0x1600], eax
jmp 0xc261a7
mov dword [ebp - 0x170c], eax
mov esi, 0x10000000
test esi, esi
js 0xc27254
mov ecx, dword [ebp - 0x1710]
test ecx, ecx
jne 0xc263f0
mov esi, 0x80070057
jmp 0xc27254
test eax, eax
je 0xc263e6
mov dword [ebp - 0x1bb4], eax
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1bac], eax
lea eax, [ebp - 0x1900]
push eax
xor eax, eax
mov dword [ebp - 0x1bb8], ecx
mov ecx, dword [ebp - 0x1680]
inc eax
push 0x9f29b8
push eax
mov dword [ebp - 0x1bb0], ecx
mov dword [ebp - 0x1ba8], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xc2645e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc2644f
movzx esi, si
or esi, 0x80070000
test esi, esi
mov eax, dword [ebp - 0x1600]
js 0xc264ac
mov esi, 0x80004005
jmp 0xc264ac
push 0x9fc030
push dword [ebp - 0x1900]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xc26438
push ebx
push 0x14
lea eax, [ebp - 0x1bb8]
mov ecx, esi
push eax
push 0x86
call dword [0xc99200]
call esi
mov esi, eax
or esi, 0x10000000
jl 0xc264a6
mov eax, dword [ebp - 0x1bac]
mov dword [ebp - 0x1600], eax
jmp 0xc264ac
mov eax, dword [ebp - 0x1600]
cmp esi, 0xd0000023
jne 0xc264be
mov esi, 0x8007007a
jmp 0xc27254
test esi, esi
js 0xc27254
mov ecx, dword [ebp - 0x170c]
mov dword [ebp - 0x1650], ebx
mov dword [ebp - 0x1658], ebx
mov dword [ebp - 0x165c], ecx
cmp eax, edi
jae 0xc264ec
mov esi, 0xc000003e
jmp 0xc26913
mov eax, dword [ecx]
mov edx, edi
mov dword [ebp - 0x15fc], eax
lea eax, [ebp - 0x165c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc26913
lea eax, [ebp - 0x1658]
mov edx, edi
push eax
xor ecx, ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc26913
mov eax, dword [ebp - 0x1600]
sub eax, dword [ebp - 0x1658]
mov ecx, dword [ebp - 0x15fc]
cmp eax, ecx
jb 0xc264e2
mov eax, dword [ebp - 0x165c]
lea edx, [ebp - 0x165c]
push edx
mov edx, ecx
mov dword [ebp - 0x164c], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc26913
mov edx, dword [ebp - 0x15fc]
lea eax, [ebp - 0x1658]
mov ecx, dword [ebp - 0x1658]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc26913
mov eax, dword [ebp - 0x1600]
sub eax, dword [ebp - 0x1658]
cmp eax, edi
jb 0xc264e2
mov ecx, dword [ebp - 0x165c]
mov edx, edi
mov eax, dword [ecx]
mov dword [ebp - 0x1614], eax
lea eax, [ebp - 0x165c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc26913
mov ecx, dword [ebp - 0x1658]
lea eax, [ebp - 0x1658]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc26913
mov eax, dword [ebp - 0x1600]
sub eax, dword [ebp - 0x1658]
mov ecx, dword [ebp - 0x1614]
cmp eax, ecx
jb 0xc264e2
mov eax, dword [ebp - 0x165c]
lea edx, [ebp - 0x165c]
push edx
mov edx, ecx
mov dword [ebp - 0x15d4], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc26913
mov edx, dword [ebp - 0x1614]
lea eax, [ebp - 0x1658]
mov ecx, dword [ebp - 0x1658]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc26913
mov eax, dword [ebp - 0x1600]
sub eax, dword [ebp - 0x1658]
cmp eax, edi
jb 0xc264e2
mov ecx, dword [ebp - 0x165c]
mov edx, edi
mov eax, dword [ecx]
mov dword [ebp - 0x15e0], eax
lea eax, [ebp - 0x165c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc26913
mov ecx, dword [ebp - 0x1658]
lea eax, [ebp - 0x1658]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc26913
mov eax, dword [ebp - 0x1600]
sub eax, dword [ebp - 0x1658]
mov ecx, dword [ebp - 0x15e0]
cmp eax, ecx
jb 0xc264e2
lea eax, [ebp - 0x1658]
mov edx, ecx
mov ecx, dword [ebp - 0x1658]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc26913
mov edx, dword [ebp - 0x1600]
mov eax, edx
sub eax, dword [ebp - 0x1658]
jne 0xc264e2
mov eax, dword [ebp - 0x1614]
mov ecx, dword [ebp - 0x15e0]
add eax, dword [ebp - 0x15fc]
add ecx, 0xc
add eax, ecx
cmp eax, edx
jne 0xc264e2
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x1658], esi
test esi, esi
jne 0xc26728
mov esi, 0xc0000017
jmp 0xc2688b
cmp dword [ebp - 0x164c], 0
je 0xc26771
mov eax, dword [ebp - 0x15fc]
push eax
push 8
mov dword [esi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc26757
mov esi, 0xc0000017
jmp 0xc26815
mov dword [esi + 4], eax
push dword [ebp - 0x15fc]
push dword [ebp - 0x164c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xc26776
mov dword [esi], ebx
mov dword [esi + 4], ebx
cmp dword [ebp - 0x15d4], 0
je 0xc267b6
mov eax, dword [ebp - 0x1614]
push eax
push 8
mov dword [esi + 8], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc2674d
mov dword [esi + 0xc], eax
push dword [ebp - 0x1614]
push dword [ebp - 0x15d4]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xc267bc
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
cmp dword [ebp - 0x165c], 0
je 0xc26801
mov eax, dword [ebp - 0x15e0]
push eax
push 8
mov dword [esi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc2674d
mov dword [esi + 0x14], eax
mov ecx, dword [ebp - 0x15e0]
push ecx
push dword [ebp - 0x165c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xc26807
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [ebp - 0x1650], esi
mov esi, ebx
mov dword [ebp - 0x1658], ebx
mov eax, dword [ebp - 0x1658]
test eax, eax
je 0xc2688b
mov ecx, dword [eax + 4]
test ecx, ecx
je 0xc2683e
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1658]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0xc2685d
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1658]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0xc2687c
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1658]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1650]
test esi, esi
js 0xc268a3
mov dword [ebp - 0x1708], eax
mov eax, ebx
mov dword [ebp - 0x1650], eax
test eax, eax
je 0xc26913
mov ecx, dword [eax + 4]
test ecx, ecx
je 0xc268c6
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1650]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0xc268e5
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1650]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0xc26904
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1650]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xc27254
mov ecx, dword [ebp - 0x1708]
mov dword [ebp - 0x165c], ebx
mov dword [ebp - 0x1658], ebx
test ecx, ecx
jne 0xc2693f
mov esi, 0xd000000d
jmp 0xc27254
mov eax, dword [ecx + 4]
mov dword [ebp - 0x1650], eax
test eax, eax
je 0xc26935
mov esi, dword [ecx]
test esi, esi
je 0xc26935
add esi, 0xfffffff8
push esi
push ebx
mov dword [ebp - 0x15fc], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x164c], eax
test eax, eax
je 0xc26f96
mov ecx, dword [ebp - 0x1650]
mov dl, bl
mov dword [ebp - 0x1614], ecx
mov ecx, esi
and ecx, 7
mov dword [ebp - 0x6a8], 0xab69605e
mov dword [ebp - 0x6a4], 0x7f1137f
mov dword [ebp - 0x15d4], eax
mov dword [ebp - 0x15e0], ecx
mov dword [ebp - 0x15f4], ebx
je 0xc26f48
mov dword [ebp - 0x1754], ebx
mov eax, ebx
mov dword [ebp - 0x160c], eax
test ecx, ecx
je 0xc26a28
mov esi, dword [ebp - 0x1614]
movzx eax, byte [esi]
inc esi
mov ecx, dword [ebp - 0x16d0]
cmp dword [ebp - 0x15f4], edi
jge 0xc269f4
add ecx, 0xffffffe0
shl eax, cl
or dword [ebp - 0x160c], eax
mov ecx, dword [ebp - 0x16d0]
jmp 0xc269fc
shl eax, cl
or dword [ebp - 0x1754], eax
mov eax, dword [ebp - 0x15f4]
sub ecx, 8
inc eax
mov dword [ebp - 0x16d0], ecx
mov ecx, dword [ebp - 0x15e0]
mov dword [ebp - 0x15f4], eax
cmp eax, ecx
jl 0xc269cf
mov eax, dword [ebp - 0x160c]
mov dword [ebp - 0x1614], esi
mov esi, dword [ebp - 0x1754]
xor eax, 0x92f65a5
xor esi, 0x699a899c
mov dword [ebp - 0x15f4], eax
mov dword [ebp - 0x1680], esi
mov dword [ebp - 0x1600], eax
mov dword [ebp - 0x161c], esi
mov dword [ebp - 0x1644], ebx
test ecx, ecx
je 0xc26ab7
mov eax, dword [ebp - 0x15d4]
mov esi, ebx
lea ecx, [eax + 1]
mov dword [ebp - 0x15d4], ecx
cmp esi, edi
jge 0xc26a7f
rol dword [ebp - 0x1600], 8
mov ecx, dword [ebp - 0x1600]
jmp 0xc26a8c
rol dword [ebp - 0x161c], 8
mov ecx, dword [ebp - 0x161c]
mov dword [ebp - 0x1644], ecx
inc esi
mov byte [eax], cl
mov ecx, dword [ebp - 0x15e0]
mov eax, dword [ebp - 0x15d4]
cmp esi, ecx
jl 0xc26a63
mov esi, dword [ebp - 0x1680]
mov dword [ebp - 0x15d4], eax
mov eax, dword [ebp - 0x15f4]
cmp ecx, edi
jbe 0xc26f22
push 8
pop ecx
sub ecx, dword [ebp - 0x15e0]
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0x1680], esi
mov esi, dword [ebp - 0x15fc]
mov eax, esi
shr eax, 3
mov dword [ebp - 0x15e0], eax
test eax, eax
je 0xc26edb
movzx esi, word [ebp - 0x6a6]
mov ebx, 0x7f1137f
movzx ecx, word [ebp - 0x6a2]
mov edi, 0xab69605e
movzx eax, bx
xor ebx, edi
mov dword [ebp - 0x161c], eax
movzx eax, di
mov dword [ebp - 0x15e4], eax
mov eax, dword [ebp - 0x15d4]
mov dword [ebp - 0x15d0], esi
add eax, 7
mov esi, dword [ebp - 0x1614]
mov dword [ebp - 0x1644], ecx
add esi, 2
mov ecx, dword [ebp - 0x15f4]
mov dword [ebp - 0x1600], ebx
mov dword [ebp - 0x15d4], eax
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor ecx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
shl edi, 8
add esi, 8
or edi, eax
mov dword [ebp - 0x1614], esi
mov eax, dword [ebp - 0x1680]
xor eax, edi
xor eax, ecx
xor eax, 0x7f1137f
xor eax, 0xab69605e
mov dword [ebp - 0x1680], eax
mov esi, eax
rol dword [ebp - 0x1680], 0xa
sub eax, 0xab69605e
rol eax, 5
imul eax, dword [ebp - 0x161c]
add eax, dword [ebp - 0x1680]
xor ecx, eax
mov eax, 0x7f1137f
mov dword [ebp - 0x15f4], ecx
add ecx, eax
mov eax, dword [ebp - 0x15f4]
ror ecx, 9
imul ecx, dword [ebp - 0x15d0]
rol eax, 2
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
sub ecx, dword [ebp - 0x161c]
imul ecx, dword [ebp - 0x15e4]
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0x15f4]
xor eax, ecx
mov ecx, dword [ebp - 0x15d0]
xor ecx, eax
mov dword [ebp - 0x15f4], eax
rol ecx, 6
imul ecx, dword [ebp - 0x1644]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, 0xab69605e
sub eax, ecx
mov ecx, dword [ebp - 0x15f4]
xor ecx, eax
mov eax, dword [ebp - 0x161c]
mov dword [ebp - 0x15f4], ecx
xor eax, dword [ebp - 0x15f4]
imul eax, dword [ebp - 0x15d0]
ror ecx, 6
xor ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov eax, esi
rol eax, 2
lea ecx, [ecx + esi]
ror ecx, 0xf
imul ecx, dword [ebp - 0x15e4]
add ecx, eax
mov eax, dword [ebp - 0x15f4]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x15f4], eax
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0x1644]
sub ecx, eax
xor esi, ecx
mov ecx, 0xab69605e
xor ecx, esi
mov eax, esi
ror ecx, 0xc
imul ecx, dword [ebp - 0x161c]
ror eax, 0xa
xor ecx, eax
mov eax, dword [ebp - 0x15f4]
xor eax, ecx
mov ecx, dword [ebp - 0x1644]
xor ecx, eax
mov dword [ebp - 0x15f4], eax
imul ecx, dword [ebp - 0x15d0]
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov ecx, dword [ebp - 0x15f4]
mov eax, esi
not eax
ror eax, 5
add eax, dword [ebp - 0x15e4]
imul eax, dword [ebp - 0x1644]
xor ecx, eax
mov dword [ebp - 0x15f4], ecx
mov eax, ecx
mov ecx, dword [ebp - 0x1644]
sub eax, ecx
xor eax, esi
mov esi, dword [ebp - 0x15f4]
xor eax, 0xab69605e
xor ecx, eax
mov dword [ebp - 0x1680], eax
rol ecx, 2
imul ecx, dword [ebp - 0x161c]
shr eax, 2
add ecx, eax
xor esi, ecx
mov eax, esi
rol eax, 7
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul ecx, dword [ebp - 0x15d0]
add ecx, eax
mov eax, dword [ebp - 0x1680]
xor eax, ecx
mov dword [ebp - 0x1680], eax
mov ecx, eax
mov eax, dword [ebp - 0x161c]
xor eax, dword [ebp - 0x1680]
imul eax, dword [ebp - 0x15e4]
ror ecx, 9
add ecx, eax
xor esi, ecx
mov ecx, dword [ebp - 0x15d0]
xor ecx, esi
mov eax, esi
rol ecx, 5
imul ecx, dword [ebp - 0x1644]
rol eax, 7
add ecx, eax
mov eax, dword [ebp - 0x1600]
xor dword [ebp - 0x1680], ecx
mov ecx, dword [ebp - 0x1680]
xor eax, ecx
xor esi, eax
mov eax, esi
ror eax, 3
sub eax, dword [ebp - 0x15d0]
imul eax, dword [ebp - 0x161c]
xor ecx, eax
mov dword [ebp - 0x1680], ecx
mov eax, dword [ebp - 0x1680]
sub ecx, 0x7f1137f
ror ecx, 1
imul ecx, dword [ebp - 0x15e4]
ror eax, 6
sub ecx, eax
xor esi, ecx
mov ecx, 0xab69605e
mov eax, esi
rol eax, 0xe
lea ecx, [esi + ecx]
rol ecx, 3
imul ecx, dword [ebp - 0x1644]
add ecx, eax
mov eax, dword [ebp - 0x1680]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0x1680], eax
rol ecx, 0xf
imul ecx, dword [ebp - 0x161c]
ror eax, 0xe
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0x15e4]
imul ecx, dword [ebp - 0x15d0]
shr eax, 3
xor ecx, eax
mov eax, dword [ebp - 0x1680]
xor eax, ecx
mov ecx, 0x7f1137f
xor ecx, eax
mov dword [ebp - 0x1680], eax
rol ecx, 4
imul ecx, dword [ebp - 0x15e4]
rol eax, 2
xor ecx, eax
mov eax, dword [ebp - 0x1680]
xor ecx, dword [ebp - 0x160c]
xor eax, dword [ebp - 0x1754]
xor esi, ecx
mov ecx, esi
mov dword [ebp - 0x15f4], esi
mov esi, dword [ebp - 0x15d4]
mov dword [ebp - 0x160c], ebx
mov dword [ebp - 0x1754], edi
mov byte [esi - 4], cl
mov byte [esi], al
ror ecx, 8
mov byte [esi - 5], cl
ror eax, 8
mov byte [esi - 1], al
ror ecx, 8
mov byte [esi - 6], cl
ror eax, 8
mov byte [esi - 2], al
ror ecx, 8
ror eax, 8
mov byte [esi - 7], cl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror ecx, 8
sub dword [ebp - 0x15e0], 1
mov dword [ebp - 0x15d4], esi
mov esi, dword [ebp - 0x1614]
mov dword [ebp - 0x1680], eax
jne 0xc26b4a
mov esi, dword [ebp - 0x15fc]
xor ebx, ebx
push 4
pop edi
mov ecx, dword [ebp - 0x164c]
mov eax, ebx
test esi, esi
je 0xc26eef
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0xc26ee7
movzx eax, dl
cdq
mov dword [ebp - 0x15fc], edx
mov edx, dword [ebp - 0x1650]
cmp eax, dword [esi + edx]
jne 0xc26f59
mov eax, dword [ebp - 0x15fc]
cmp eax, dword [esi + edx + 4]
jne 0xc26f59
mov dword [ebp - 0x165c], ecx
mov ecx, ebx
mov dword [ebp - 0x1658], esi
mov esi, ebx
jmp 0xc26f5e
mov dword [ebp - 0x1680], ebx
jae 0xc26ad5
mov ecx, edi
sub ecx, dword [ebp - 0x15e0]
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0x15f4], eax
jmp 0xc26ad5
mov dword [ebp - 0x160c], ebx
mov dword [ebp - 0x1680], ebx
jmp 0xc26adb
mov esi, 0xc004d501
test ecx, ecx
je 0xc26f71
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc26f96
mov eax, dword [ebp - 0x165c]
mov esi, 0x10000000
mov ecx, dword [ebp - 0x1658]
mov dword [ebp - 0x169c], eax
mov eax, ebx
mov dword [ebp - 0x1694], ecx
jmp 0xc26fa1
mov eax, dword [ebp - 0x165c]
mov esi, 0xd0000001
test eax, eax
je 0xc26fb4
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc27254
mov ecx, dword [ebp - 0x169c]
mov dword [ebp - 0x1690], ebx
mov dword [ebp - 0x171c], ecx
cmp dword [ebp - 0x1694], edi
jb 0xc27249
mov eax, dword [ecx]
mov edx, edi
mov dword [ebp - 0x165c], eax
lea eax, [ebp - 0x171c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc2724e
lea eax, [ebp - 0x1690]
mov edx, edi
push eax
xor ecx, ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc2724e
mov eax, dword [ebp - 0x1694]
sub eax, dword [ebp - 0x1690]
cmp eax, edi
jb 0xc27249
mov ecx, dword [ebp - 0x171c]
mov edx, edi
mov eax, dword [ecx]
mov dword [ebp - 0x1658], eax
lea eax, [ebp - 0x171c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc2724e
mov ecx, dword [ebp - 0x1690]
lea eax, [ebp - 0x1690]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc2724e
mov eax, dword [ebp - 0x1694]
mov ecx, dword [ebp - 0x1690]
sub eax, ecx
mov edx, dword [ebp - 0x1658]
cmp eax, edx
jb 0xc27249
lea eax, [ebp - 0x1690]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc2724e
mov ecx, dword [ebp - 0x171c]
mov eax, dword [ebp - 0x169c]
mov edx, dword [ebp - 0x1658]
add ecx, edx
mov esi, dword [ebp - 0x1694]
add eax, esi
cmp eax, ecx
jb 0xc27249
mov eax, dword [ebp - 0x171c]
sub esi, eax
sub esi, edx
add esi, dword [ebp - 0x169c]
cmp esi, 8
jae 0xc27249
mov dword [ebp - 0x1650], ebx
mov ecx, ebx
mov dword [ebp - 0x1690], ecx
mov esi, ebx
test eax, eax
je 0xc271d4
lea ecx, [ebp - 0x1740]
mov dword [ebp - 0x15fc], eax
push ecx
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc2724e
mov eax, dword [ebp - 0x15fc]
mov ecx, dword [ebp - 0x1740]
jmp 0xc271c0
lea ecx, [ebp - 0x1720]
mov edx, edi
push ecx
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc2724e
mov eax, dword [ebp - 0x1740]
cmp dword [ebp - 0x1720], eax
ja 0xc271fb
mov edx, dword [ebp - 0x15fc]
lea eax, [ebp - 0x1724]
push eax
mov ecx, edi
mov edx, dword [edx]
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc27178
mov eax, dword [ebp - 0x1724]
mov dword [ebp - 0x18fc], eax
jmp 0xc2717e
mov eax, dword [ebp - 0x18fc]
test esi, esi
js 0xc2724e
lea ecx, [ebp - 0x1728]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0x15fc]
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc2724e
mov eax, dword [ebp - 0x1728]
mov ecx, dword [ebp - 0x1740]
mov dword [ebp - 0x15fc], eax
cmp eax, ecx
ja 0xc271fb
inc dword [ebp - 0x1650]
cmp eax, ecx
jb 0xc27122
cmp eax, ecx
jne 0xc271fb
mov edx, dword [ebp - 0x1658]
mov ecx, ebx
test edx, edx
je 0xc2720a
push edx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x1690], ecx
test ecx, ecx
jne 0xc27202
mov esi, 0xc0000017
jmp 0xc27237
mov esi, 0xc000000d
jmp 0xc2724e
mov edx, dword [ebp - 0x1658]
mov esi, ebx
mov eax, dword [ebp - 0x171c]
test eax, eax
je 0xc27225
push edx
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [ebp - 0x1690]
add esp, 0xc
mov eax, dword [ebp - 0x1650]
mov dword [ebp - 0x1af0], ecx
mov dword [ebp - 0x1af8], eax
test esi, esi
js 0xc2724e
mov eax, dword [ebp - 0x165c]
cmp eax, dword [ebp - 0x1af8]
je 0xc2724e
mov esi, 0xc000003e
or esi, 0x10000000
mov eax, dword [ebp - 0x1718]
test eax, eax
je 0xc2726d
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1714]
test eax, eax
je 0xc272e3
mov ecx, dword [eax + 4]
test ecx, ecx
je 0xc27296
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1714]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0xc272b5
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1714]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0xc272d4
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1714]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1710]
test eax, eax
je 0xc272fc
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x170c]
test eax, eax
je 0xc27315
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1708]
test eax, eax
je 0xc2738e
cmp dword [eax + 4], 0
je 0xc2733f
push dword [eax + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1708]
mov dword [eax + 4], ebx
cmp dword [eax + 0xc], 0
je 0xc2735f
push dword [eax + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1708]
mov dword [eax + 0xc], ebx
cmp dword [eax + 0x14], 0
je 0xc2737f
push dword [eax + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1708]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x169c]
test eax, eax
je 0xc273a7
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc2746f
xor eax, eax
inc eax
cmp dword [ebp - 0x1af8], eax
jb 0xc2746f
mov esi, dword [ebp - 0x1af0]
test esi, esi
je 0xc2746f
cmp dword [ebp - 0x1af8], 0
jbe 0xc2746f
lea eax, [ebp - 0x1670]
mov dword [ebp - 0x1670], esi
push eax
mov edx, edi
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc2746f
mov eax, dword [esi]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1670]
cmp dword [esi], edi
jne 0xc2746f
cmp dword [eax], 0
jl 0xc2746f
xor eax, eax
inc eax
cmp dword [ebp - 0x1af8], eax
jbe 0xc2746f
mov dword [ebp - 0x172c], esi
mov dword [ebp - 0x1670], ebx
lea eax, [ebp - 0x172c]
mov edx, edi
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc2746f
mov edx, dword [esi]
lea eax, [ebp - 0x172c]
mov ecx, dword [ebp - 0x172c]
push eax
call fcn.00a32533
test eax, eax
js 0xc2746f
mov eax, dword [ebp - 0x1670]
xor ecx, ecx
inc eax
inc ecx
mov dword [ebp - 0x1670], eax
cmp eax, ecx
jae 0xc2746f
mov esi, dword [ebp - 0x172c]
jmp 0xc2741f
mov eax, dword [ebp - 0x1ad8]
jmp 0xc27475
mov eax, dword [ebp - 0x1704]
test eax, eax
je 0xc27488
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0x1af0]
test esi, esi
je 0xc274a1
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1634]
test eax, eax
je 0xc274ba
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1654]
test eax, eax
je 0xc274d7
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc274d7
xor ebx, ebx
mov eax, dword [ebp - 0x15a4]
mov dword [ebp - 0x15a4], ebx
mov dword [ebp - 0x174c], eax
jmp 0xc1d8ae
mov ecx, 0xc004f027
test ecx, ecx
js 0xc2750a
push 4
pop esi
cmp dword [ebp - 0x1750], esi
jne 0xc2750a
mov ecx, dword [eax]
mov dword [ebp - 0x1748], ecx
test eax, eax
je 0xc31d67
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov dword [ebp - 0x174c], ebx
jmp 0xc31d67
call fcn.00aeda94
test al, al
je 0xc31d7d
xor ebx, ebx
mov edx, 0xc96238
mov dword [ebp - 0x1748], ebx
mov dword [ebp - 0x18f8], ebx
mov dword [ebp - 0x15c4], ebx
mov dword [ebp - 0x15b4], ebx
xor eax, eax
lea ecx, [eax + 1]
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc27550
mov eax, dword [0xc95890]
or esi, 0xffffffff
mov dword [ebp - 0x1754], esi
mov dword [ebp - 0x1758], 0x9fbcf2
mov dword [ebp - 0x175c], 0x67
mov dword [ebp - 0x1760], 0x337
mov dword [ebp - 0x1764], 0x10b
mov dword [ebp - 0x1768], 0x20b
test eax, eax
jne 0xc27bd9
push 0x338
mov edi, ebx
mov dword [ebp - 0x15bc], ebx
push ebx
mov dword [ebp - 0x1588], edi
mov dword [ebp - 0x172c], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1670], eax
test eax, eax
je 0xc27b72
add eax, 7
mov dword [ebp - 0x1724], esi
mov edi, 0x9fbcf2
mov dword [ebp - 0x6a0], 0xab69605e
mov cl, bl
mov dword [ebp - 0x69c], 0x7f1137f
mov dword [ebp - 0x1728], ebx
mov esi, ebx
mov edx, ebx
mov dword [ebp - 0x1720], eax
mov dword [ebp - 0x1740], edi
mov dword [ebp - 0x171c], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0x1740]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0x1740]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0x1740]
shl edi, 8
add dword [ebp - 0x1740], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0x1690], esi
add eax, 0x54969fa2
rol dword [ebp - 0x1690], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0x1690]
xor edx, eax
mov dword [ebp - 0x165c], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x165c]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x165c]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x165c], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x165c]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x165c]
xor edx, eax
mov dword [ebp - 0x165c], edx
mov eax, dword [ebp - 0x165c]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x165c]
xor eax, edx
mov dword [ebp - 0x165c], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x165c]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x165c]
xor eax, edx
mov dword [ebp - 0x165c], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x165c]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0x165c]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0x165c], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0x165c]
xor eax, 0xab69605e
mov dword [ebp - 0x1690], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1690]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x1690]
xor eax, edx
mov dword [ebp - 0x1690], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0xab69
rol esi, 7
rol eax, 5
imul eax, eax, 0x7f1
add eax, esi
mov esi, dword [ebp - 0x1690]
xor esi, eax
mov dword [ebp - 0x1690], esi
xor esi, edx
mov edx, dword [ebp - 0x1690]
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x1690], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1690]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x1690]
xor eax, edx
mov dword [ebp - 0x1690], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1690]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x1690]
xor eax, edx
mov dword [ebp - 0x1690], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1690]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x1690]
xor edx, dword [ebp - 0x1728]
xor eax, dword [ebp - 0x1724]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x165c], esi
mov esi, dword [ebp - 0x1720]
mov dword [ebp - 0x1724], edi
mov edi, dword [ebp - 0x1740]
mov dword [ebp - 0x1728], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x171c], 1
mov dword [ebp - 0x1720], esi
mov esi, eax
mov dword [ebp - 0x1690], eax
jne 0xc2761e
mov esi, dword [ebp - 0x1670]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc279ab
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc279e0
cmp edx, dword [0x9fc02c]
jne 0xc279e0
mov edi, esi
mov dword [ebp - 0x1588], esi
mov esi, ebx
mov dword [ebp - 0x1670], 0x337
jmp 0xc279f3
or dword [ebp - 0x1670], 0xffffffff
mov edi, ebx
mov dword [ebp - 0x172c], 0xc004d501
test esi, esi
je 0xc27a06
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x172c], ebx
jl 0xc27b6c
mov eax, dword [ebp - 0x1670]
mov esi, edi
push 0x40
push ebx
push 0xc960a0
mov byte [eax + edi], bl
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], bl
je 0xc27b79
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0x15a0], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc27a47
sub ecx, dword [ebp - 0x15a0]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc27b65
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0x15a0], ecx
cmp word [eax], dx
je 0xc27a8f
mov ecx, 0xc000007b
mov dword [ebp - 0x15a0], ecx
jmp 0xc27ad7
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc27a82
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc27a82
cmp dword [edx], 0x4550
jne 0xc27a82
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0x1764]
je 0xc27ac5
cmp ax, word [ebp - 0x1768]
je 0xc27ac5
mov ecx, 0xc000000d
jmp 0xc27a87
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0x1578], eax
mov dword [ebp - 0x1598], ebx
test eax, eax
je 0xc27b52
mov edx, esi
mov dword [ebp - 0x15b8], esi
lea eax, [edx + 1]
mov dword [ebp - 0x1558], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc27afe
sub edx, dword [ebp - 0x1558]
inc esi
add esi, edx
test ecx, ecx
js 0xc27b37
push dword [ebp - 0x15b8]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc27b5d
mov ecx, dword [ebp - 0x15bc]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x15a0]
mov eax, dword [ebp - 0x1598]
inc dword [ebp - 0x15bc]
inc eax
mov dword [ebp - 0x1598], eax
cmp eax, dword [ebp - 0x1578]
jb 0xc27aed
add edi, 0x10
cmp byte [esi], bl
jne 0xc27a3a
mov esi, dword [ebp - 0x15a0]
jmp 0xc27b7b
mov esi, 0xc000007a
jmp 0xc27b7b
mov edi, dword [ebp - 0x1588]
mov esi, 0xc000007a
jmp 0xc27b81
mov esi, ebx
mov edi, dword [ebp - 0x1588]
test edi, edi
je 0xc27b94
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push edi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0xc27bd4
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc27bab
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc27b9a
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc27bdf
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
mov eax, ebx
mov dword [ebp - 0x15bc], ebx
mov dword [ebp - 0x1588], eax
mov edi, ebx
mov eax, dword fs:[0x30]
cmp dword [eax + 0x1d4], ebx
je 0xc27ec8
mov esi, dword [0xc93088]
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x15a0], ecx
test ecx, ecx
jne 0xc27c31
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc27f08
mov eax, ebx
mov esi, ebx
mov dword [ebp - 0x1588], eax
mov ebx, dword [0xc93098]
lea edx, [ebp - 0x18f4]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xc27cb6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc27ca0
test esi, esi
jne 0xc27c99
push dword [ebp - 0x18f4]
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc27c92
mov eax, dword [ebp - 0x18f4]
mov ecx, dword [ebp - 0x15a0]
jmp 0xc27c3b
mov eax, 0x8007000e
jmp 0xc27cae
mov eax, 0x80004005
jmp 0xc27cae
test eax, eax
je 0xc27c99
jle 0xc27cae
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1588], eax
jmp 0xc27cbe
mov dword [ebp - 0x15bc], esi
xor esi, esi
test esi, esi
je 0xc27cd2
push esi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0x1588]
test esi, esi
js 0xc27ee9
mov esi, dword [0xc93094]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x15a0], ecx
test ecx, ecx
jne 0xc27d2a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc27d1a
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc27ee9
mov esi, 0x80004005
jmp 0xc27ee9
xor esi, esi
and dword [ebp - 0x1588], esi
xor eax, eax
mov ebx, dword [0xc93098]
lea edx, [ebp - 0x18f0]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xc27dc9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc27da5
xor ebx, ebx
test esi, esi
jne 0xc27d99
push dword [ebp - 0x18f0]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc27d8d
mov eax, dword [ebp - 0x18f0]
mov ecx, dword [ebp - 0x15a0]
jmp 0xc27d34
mov dword [ebp - 0x1588], 0x8007000e
jmp 0xc27dcf
mov dword [ebp - 0x1588], 0x80004005
jmp 0xc27dcf
test eax, eax
jne 0xc27db5
mov dword [ebp - 0x1588], 0x80004005
jmp 0xc27dc5
jle 0xc27dbf
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1588], eax
xor ebx, ebx
jmp 0xc27dcf
xor ebx, ebx
mov edi, esi
mov esi, ebx
test esi, esi
je 0xc27de2
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1588]
test eax, eax
js 0xc27ed0
mov eax, dword [ebp - 0x15bc]
test eax, eax
je 0xc27ec8
push 4
mov ecx, eax
mov edx, 0x9fb9c0
pop eax
mov si, word [ecx]
cmp si, word [edx]
jne 0xc27e2c
test si, si
je 0xc27e28
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0xc27e2c
add ecx, eax
add edx, eax
test si, si
jne 0xc27e08
mov ecx, ebx
jmp 0xc27e33
sbb ecx, ecx
xor edx, edx
inc edx
or ecx, edx
test ecx, ecx
jne 0xc27ec8
test edi, edi
je 0xc27ec8
mov edx, 0x9f98b0
mov ecx, edi
mov si, word [ecx]
cmp si, word [edx]
jne 0xc27e71
test si, si
je 0xc27e6a
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0xc27e71
add ecx, eax
add edx, eax
test si, si
jne 0xc27e4a
xor esi, esi
mov ecx, ebx
inc esi
jmp 0xc27e78
sbb ecx, ecx
xor esi, esi
inc esi
or ecx, esi
test ecx, ecx
jne 0xc27ec8
push eax
lea eax, [ebp - 0x1730]
mov dword [ebp - 0x1730], ebx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
jne 0xc27ebd
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc27eb4
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc27ed6
mov esi, 0x80004005
jmp 0xc27ed6
test byte [ebp - 0x1730], 0xf
mov eax, esi
je 0xc27eca
mov eax, ebx
mov dword [ebp - 0x15b4], eax
mov esi, dword [ebp - 0x1588]
test edi, edi
je 0xc27ee9
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x15bc]
xor ebx, ebx
test eax, eax
je 0xc27f04
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0xc27f0e
mov dword [ebp - 0x15b4], ebx
push 4
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x15bc], esi
test esi, esi
jne 0xc28008
mov dword [ebp - 0x1588], 0x8007000e
mov eax, dword [ebp - 0x1730]
mov dword [ebp - 0x15c4], eax
mov edx, 0xc96238
xor esi, esi
lea ecx, [esi + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc27f45
mov eax, dword [0xc95890]
mov esi, dword [ebp - 0x15bc]
test eax, eax
jle 0xc27fab
sub eax, 1
mov dword [0xc95890], eax
jne 0xc27fab
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc27f7e
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc27f6d
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x15bc]
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
test esi, esi
je 0xc27fbf
push esi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov ecx, dword [ebp - 0x1588]
mov eax, dword [ebp - 0x18f8]
test ecx, ecx
jns 0xc31d43
cmp ecx, 0xd0000034
je 0xc31d56
cmp ecx, 0xd00000e5
je 0xc31d3a
cmp ecx, 0xc004d501
je 0xc31d3a
cmp ecx, 0xd000003e
je 0xc31d56
jmp 0xc31d3f
mov eax, ebx
mov dword [ebp - 0x15a0], ebx
mov dword [ebp - 0x1598], eax
lea edi, [ebp - 0x1aa4]
mov dword [ebp - 0x1afc], eax
xor eax, eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1578], ebx
mov dword [ebp - 0x15b8], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1558], eax
mov dword [ebp - 0x16d0], 0x38
test eax, eax
jne 0xc28065
mov edi, 0xc0000017
jmp 0xc2afe2
push 0x28
pop ecx
mov esi, 0xc94ea0
mov dword [ebp - 0x15a0], eax
mov edi, eax
rep movsd dword es:[edi], dword [esi]
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x155c], ecx
test ecx, ecx
je 0xc2805b
mov eax, dword [0xc94e98]
mov dword [ecx], eax
mov eax, dword [0xc94e9c]
mov dword [ecx + 4], eax
mov dword [ebp - 0x1578], ecx
rdtsc
mov dword [ebp - 0x1594], eax
mov dword [ebp - 0x1570], edx
lea eax, [ebp - 0x18e8]
mov dword [ebp - 0x18ec], ebx
push eax
push 4
pop esi
mov edx, esi
mov ecx, esi
call fcn.00a32533
mov edi, eax
mov eax, dword [ebp - 0x18e8]
mov dword [ebp - 0x1588], edi
test edi, edi
jns 0xc280e8
mov eax, dword [ebp - 0x1880]
mov dword [ebp - 0x158c], eax
test edi, edi
js 0xc2afe8
lea ecx, [ebp - 0x18ec]
mov edx, eax
push ecx
xor ecx, ecx
call fcn.00a32533
mov edi, eax
or edi, 0x10000000
mov dword [ebp - 0x1588], edi
jl 0xc2afe8
lea eax, [ebp - 0x18c8]
mov edx, 0xa0
push eax
mov ecx, esi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc28147
mov edx, dword [ebp - 0x18c8]
mov dword [ebp - 0x158c], edx
jmp 0xc2814d
mov edx, dword [ebp - 0x158c]
test edi, edi
js 0xc2afe8
mov ecx, dword [ebp - 0x18ec]
lea eax, [ebp - 0x18ec]
push eax
call fcn.00a32533
mov edi, eax
or edi, 0x10000000
mov dword [ebp - 0x1588], edi
jl 0xc2afe8
lea eax, [ebp - 0x18c4]
mov ecx, esi
push eax
push 8
pop edx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc281a6
mov eax, dword [ebp - 0x18c4]
mov dword [ebp - 0x158c], eax
jmp 0xc281ac
mov eax, dword [ebp - 0x158c]
test edi, edi
js 0xc2afe8
lea ecx, [ebp - 0x18ec]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0x18ec]
call fcn.00a32533
mov edi, eax
or edi, 0x10000000
mov dword [ebp - 0x1588], edi
jl 0xc2afe8
lea eax, [ebp - 0x18c0]
mov ecx, esi
push eax
push 8
pop edx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc28207
mov eax, dword [ebp - 0x18c0]
mov dword [ebp - 0x158c], eax
jmp 0xc2820d
mov eax, dword [ebp - 0x158c]
test edi, edi
js 0xc2afe8
lea ecx, [ebp - 0x18ec]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0x18ec]
call fcn.00a32533
mov edi, eax
or edi, 0x10000000
mov dword [ebp - 0x1588], edi
jl 0xc2afe8
lea eax, [ebp - 0x18ac]
mov edx, SysReAllocString
push eax
mov ecx, 0x9fe768
call fcn.00a41606
test eax, eax
jns 0xc28261
mov edi, 0xc000003e
jmp 0xc2afe2
mov edx, dword [ebp - 0x18ac]
lea eax, [ebp - 0x18a8]
inc edx
mov ecx, esi
mov dword [ebp - 0x18ac], edx
add edx, edx
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc28298
mov eax, dword [ebp - 0x18a8]
mov dword [ebp - 0x158c], eax
jmp 0xc2829e
mov eax, dword [ebp - 0x158c]
test edi, edi
js 0xc2afe8
lea ecx, [ebp - 0x18ec]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0x18ec]
call fcn.00a32533
mov edi, eax
or edi, 0x10000000
mov dword [ebp - 0x1588], edi
jl 0xc2afe8
lea eax, [ebp - 0x18a4]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc282f8
mov eax, dword [ebp - 0x18a4]
mov dword [ebp - 0x158c], eax
jmp 0xc282fe
mov eax, dword [ebp - 0x158c]
test edi, edi
js 0xc2afe8
lea ecx, [ebp - 0x18ec]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0x18ec]
call fcn.00a32533
mov edi, eax
or edi, 0x10000000
mov dword [ebp - 0x1588], edi
jl 0xc2afe8
lea eax, [ebp - 0x1898]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov edi, eax
mov eax, dword [ebp - 0x1898]
mov dword [ebp - 0x1588], edi
test edi, edi
jns 0xc2835b
mov eax, dword [ebp - 0x158c]
jmp 0xc2afe8
lea ecx, [ebp - 0x18ec]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0x18ec]
call fcn.00a32533
mov edi, eax
or edi, 0x10000000
mov dword [ebp - 0x1588], edi
jl 0xc2afe8
mov eax, dword [ebp - 0x18ec]
push eax
push 8
mov dword [ebp - 0x1b00], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x158c], eax
test eax, eax
je 0xc2805b
mov ecx, eax
mov dword [ebp - 0x1598], ecx
mov dword [ebp - 0x1afc], ecx
mov dword [ebp - 0x1560], ebx
mov dword [ebp - 0x1894], ebx
mov dword [ebp - 0x1870], eax
lea ecx, [ebp - 0x1a24]
mov dword [ebp - 0x1a28], esi
push ecx
mov edx, esi
mov ecx, eax
call fcn.00a32533
mov edx, dword [ebp - 0x158c]
mov edi, eax
mov dword [ebp - 0x1588], edi
mov ecx, ebx
test edi, edi
js 0xc2afe8
mov ecx, dword [ebp - 0x18ec]
lea eax, [edx + 8]
add ecx, edx
cmp eax, ecx
jbe 0xc28414
mov edi, 0xc0000023
jmp 0xc2afe2
mov eax, dword [ebp - 0x1a24]
mov dword [edx], esi
mov dword [eax], ebx
xor eax, eax
inc eax
mov dword [ebp - 0x1560], eax
mov ecx, eax
test edi, edi
js 0xc2afe8
mov dword [ebp - 0x1554], ebx
mov eax, edx
mov dword [ebp - 0x186c], eax
test ecx, ecx
je 0xc284ba
mov edx, dword [eax]
lea ecx, [ebp - 0x1868]
push ecx
mov ecx, esi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2846d
mov eax, dword [ebp - 0x1868]
mov dword [ebp - 0x1840], eax
jmp 0xc28473
mov eax, dword [ebp - 0x1840]
test edi, edi
js 0xc28531
lea ecx, [ebp - 0x186c]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0x186c]
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc28531
mov eax, dword [ebp - 0x1554]
inc eax
cmp eax, dword [ebp - 0x1560]
mov dword [ebp - 0x1554], eax
mov eax, dword [ebp - 0x186c]
jb 0xc28443
lea ecx, [ebp - 0x1a2c]
mov dword [ebp - 0x1a30], 0xa0
push ecx
mov edx, esi
mov ecx, eax
call fcn.00a32533
mov edx, dword [ebp - 0x158c]
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc28537
mov edi, dword [ebp - 0x186c]
mov ecx, dword [ebp - 0x18ec]
add ecx, edx
lea eax, [edi + 0xa4]
cmp eax, ecx
ja 0xc2840a
mov eax, dword [ebp - 0x1560]
mov esi, dword [ebp - 0x1558]
inc eax
push 0x28
mov dword [edi], 0xa0
mov edi, dword [ebp - 0x1a2c]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x1588]
push 4
mov dword [ebp - 0x1560], eax
pop esi
jmp 0xc2853d
mov edx, dword [ebp - 0x158c]
mov eax, dword [ebp - 0x1560]
test edi, edi
js 0xc2afe8
mov dword [ebp - 0x1554], ebx
mov ecx, edx
mov dword [ebp - 0x1558], ecx
test eax, eax
je 0xc285bc
mov edx, dword [ecx]
lea eax, [ebp - 0x183c]
push eax
mov ecx, esi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc28581
mov ecx, dword [ebp - 0x183c]
mov dword [ebp - 0x1830], ecx
jmp 0xc28587
mov ecx, dword [ebp - 0x1830]
test edi, edi
js 0xc28640
add ecx, dword [ebp - 0x1558]
cmp ecx, dword [ebp - 0x1558]
jb 0xc28636
mov eax, dword [ebp - 0x1554]
inc eax
mov dword [ebp - 0x1558], ecx
mov dword [ebp - 0x1554], eax
cmp eax, dword [ebp - 0x1560]
jb 0xc28557
lea eax, [ebp - 0x1a34]
mov dword [ebp - 0x1a38], 8
push eax
mov edx, esi
call fcn.00a32533
mov edx, dword [ebp - 0x158c]
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc28646
mov ecx, dword [ebp - 0x18ec]
mov eax, dword [ebp - 0x1558]
add ecx, edx
add eax, 0xc
cmp eax, ecx
ja 0xc2840a
mov eax, dword [ebp - 0x1558]
mov ecx, dword [ebp - 0x1a34]
mov dword [eax], 8
mov eax, dword [ebp - 0x155c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x155c]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x1560]
inc eax
mov dword [ebp - 0x1560], eax
jmp 0xc2864c
mov edi, 0xc0000095
jmp 0xc2afe2
mov edx, dword [ebp - 0x158c]
mov eax, dword [ebp - 0x1560]
test edi, edi
js 0xc2afe8
mov ecx, dword [ebp - 0x1594]
mov dword [ebp - 0x1a40], ecx
mov ecx, dword [ebp - 0x1570]
mov dword [ebp - 0x1a3c], ecx
mov ecx, edx
mov dword [ebp - 0x1558], ecx
mov dword [ebp - 0x155c], ebx
test eax, eax
je 0xc286e2
mov edx, dword [ecx]
lea eax, [ebp - 0x182c]
push eax
mov ecx, esi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc286a8
mov eax, dword [ebp - 0x182c]
mov dword [ebp - 0x1828], eax
jmp 0xc286ae
mov eax, dword [ebp - 0x1828]
test edi, edi
js 0xc2afe8
mov edx, dword [ebp - 0x1558]
lea ecx, [edx + eax]
cmp ecx, edx
jb 0xc28636
mov eax, dword [ebp - 0x155c]
inc eax
mov dword [ebp - 0x1558], ecx
mov dword [ebp - 0x155c], eax
cmp eax, dword [ebp - 0x1560]
jb 0xc2867e
lea eax, [ebp - 0x1a44]
mov dword [ebp - 0x1a48], 8
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2afe8
mov edx, dword [ebp - 0x1558]
mov ecx, dword [ebp - 0x18ec]
add ecx, dword [ebp - 0x158c]
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xc2840a
mov eax, dword [ebp - 0x1a44]
mov ecx, dword [ebp - 0x1594]
inc dword [ebp - 0x1560]
mov dword [edx], 8
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1570]
mov dword [eax + 4], ecx
test edi, edi
js 0xc2afe8
lea eax, [ebp - 0x1818]
mov edx, SysReAllocString
push eax
mov ecx, 0x9fe768
call fcn.00a41606
test eax, eax
js 0xc28257
mov ecx, dword [ebp - 0x1818]
lea eax, [ebp - 0x1818]
push eax
xor eax, eax
lea edx, [eax + 1]
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2afe8
mov eax, dword [ebp - 0x1818]
lea edx, [eax + eax]
mov dword [ebp - 0x1558], edx
test edx, edx
je 0xc2886b
mov ecx, dword [ebp - 0x1560]
mov edi, dword [ebp - 0x158c]
mov dword [ebp - 0x155c], edi
mov dword [ebp - 0x1588], ebx
test ecx, ecx
je 0xc287f2
mov eax, dword [edi]
add eax, 4
cmp eax, esi
jb 0xc28840
add eax, edi
cmp eax, edi
jb 0xc28840
mov edi, eax
mov dword [ebp - 0x155c], eax
mov eax, dword [ebp - 0x1588]
inc eax
mov dword [ebp - 0x1588], eax
cmp eax, ecx
jb 0xc287ca
lea eax, [ebp - 0x1a4c]
mov dword [ebp - 0x1a50], edx
push eax
mov edx, esi
mov ecx, edi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2afe8
mov eax, dword [ebp - 0x1558]
mov ecx, dword [ebp - 0x18ec]
add eax, 4
mov edx, dword [ebp - 0x155c]
add eax, edx
add ecx, dword [ebp - 0x158c]
cmp eax, ecx
jbe 0xc28847
mov edi, 0xc0000023
jmp 0xc28870
mov edi, 0xc0000095
jmp 0xc28870
mov eax, dword [ebp - 0x1558]
push eax
push 0x9fe768
push dword [ebp - 0x1a4c]
mov dword [edx], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
inc dword [ebp - 0x1560]
jmp 0xc28876
mov edi, 0xc000000d
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2afe8
mov ecx, dword [ebp - 0x158c]
mov edi, ecx
mov edx, dword [ebp - 0x1560]
mov eax, dword [ebp - 0x15b4]
mov dword [ebp - 0x1810], eax
mov dword [ebp - 0x1558], edi
mov dword [ebp - 0x1588], ebx
test edx, edx
je 0xc288d8
mov eax, dword [edi]
add eax, 4
cmp eax, esi
jb 0xc28936
add eax, edi
cmp eax, edi
jb 0xc28636
mov edi, eax
mov dword [ebp - 0x1558], eax
mov eax, dword [ebp - 0x1588]
inc eax
mov dword [ebp - 0x1588], eax
cmp eax, edx
jb 0xc288a8
lea eax, [ebp - 0x1a6c]
mov dword [ebp - 0x1a70], esi
push eax
mov edx, esi
mov ecx, edi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc28943
mov edx, dword [ebp - 0x1558]
mov ecx, dword [ebp - 0x18ec]
add ecx, dword [ebp - 0x158c]
lea eax, [edx + 8]
cmp eax, ecx
ja 0xc2840a
mov eax, dword [ebp - 0x1a6c]
mov ecx, dword [ebp - 0x15b4]
mov dword [edx], esi
mov edx, dword [ebp - 0x1560]
inc edx
mov dword [eax], ecx
mov dword [ebp - 0x1560], edx
jmp 0xc28949
mov edi, 0xc0000095
mov dword [ebp - 0x1588], edi
jmp 0xc2894f
mov edx, dword [ebp - 0x1560]
mov ecx, dword [ebp - 0x158c]
test edi, edi
js 0xc2afe8
mov dword [ebp - 0x1800], esi
mov edi, ebx
mov dword [ebp - 0x1558], ecx
test edx, edx
je 0xc2898d
mov eax, dword [ecx]
add eax, 4
cmp eax, esi
jb 0xc28a4d
add eax, ecx
cmp eax, ecx
jb 0xc28636
inc edi
mov ecx, eax
mov dword [ebp - 0x1558], ecx
cmp edi, edx
jb 0xc28969
lea eax, [ebp - 0x1a8c]
mov dword [ebp - 0x1a90], esi
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2afe8
mov edx, dword [ebp - 0x1558]
mov ecx, dword [ebp - 0x18ec]
add ecx, dword [ebp - 0x158c]
lea eax, [edx + 8]
cmp eax, ecx
ja 0xc2840a
mov eax, dword [ebp - 0x1a8c]
inc dword [ebp - 0x1560]
mov dword [edx], esi
mov dword [eax], esi
test edi, edi
js 0xc2afe8
lea eax, [ebp - 0x17fc]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov edi, eax
mov eax, dword [ebp - 0x17fc]
mov dword [ebp - 0x1588], edi
test edi, edi
jns 0xc28a0e
mov eax, dword [ebp - 0x17f0]
mov dword [ebp - 0x1558], eax
test edi, edi
js 0xc28be6
mov dword [ebp - 0x17e8], eax
mov ecx, esi
lea eax, [ebp - 0x17dc]
push eax
push 8
pop edx
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc28a5a
mov edx, dword [ebp - 0x17dc]
mov dword [ebp - 0x1558], edx
jmp 0xc28a60
mov edi, 0xc0000095
mov dword [ebp - 0x1588], edi
jmp 0xc289de
mov edx, dword [ebp - 0x1558]
test edi, edi
js 0xc28be6
mov ecx, dword [ebp - 0x17e8]
lea eax, [ebp - 0x17e8]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc28be6
lea eax, [ebp - 0x17d8]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc28ab4
mov eax, dword [ebp - 0x17d8]
mov dword [ebp - 0x1558], eax
jmp 0xc28aba
mov eax, dword [ebp - 0x1558]
test edi, edi
js 0xc28be6
lea ecx, [ebp - 0x17e8]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0x17e8]
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc28be6
lea eax, [ebp - 0x17d4]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc28b10
mov eax, dword [ebp - 0x17d4]
mov dword [ebp - 0x1558], eax
jmp 0xc28b16
mov eax, dword [ebp - 0x1558]
test edi, edi
js 0xc28be6
lea ecx, [ebp - 0x17e8]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0x17e8]
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc28be6
lea eax, [ebp - 0x17d0]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc28b6c
mov eax, dword [ebp - 0x17d0]
mov dword [ebp - 0x1558], eax
jmp 0xc28b72
mov eax, dword [ebp - 0x1558]
test edi, edi
js 0xc28be6
lea ecx, [ebp - 0x17e8]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0x17e8]
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc28be6
lea eax, [ebp - 0x1734]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov edi, eax
mov eax, dword [ebp - 0x1734]
mov dword [ebp - 0x1588], edi
test edi, edi
jns 0xc28bc0
mov eax, dword [ebp - 0x1558]
jmp 0xc28be6
lea ecx, [ebp - 0x17e8]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0x17e8]
call fcn.00a32533
mov edi, eax
mov eax, dword [ebp - 0x17e8]
mov dword [ebp - 0x1588], edi
test edi, edi
jns 0xc28bec
mov eax, dword [ebp - 0x1734]
mov dword [ebp - 0x1558], eax
test edi, edi
js 0xc2afe8
rdtsc
mov dword [ebp - 0x155c], ebx
mov dword [ebp - 0x1554], ebx
mov dword [ebp - 0x1580], ebx
mov dword [ebp - 0x1564], ebx
mov dword [ebp - 0x1574], ebx
mov dword [ebp - 0x157c], ebx
mov dword [ebp - 0x1568], ebx
mov dword [ebp - 0x1590], ebx
mov dword [ebp - 0x156c], ebx
mov dword [ebp - 0x159c], ebx
mov dword [ebp - 0x1588], eax
mov dword [ebp - 0x1584], edx
push 8
pop eax
mov dword [ebp - 0x17b8], eax
mov edx, dword [ebp - 0x18ec]
lea ecx, [ebp - 0x17b8]
push ecx
mov ecx, eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc28d6a
mov eax, dword [ebp - 0x17b8]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0x15a4], ecx
cmp ecx, eax
jae 0xc28c8b
mov edi, 0xc0000095
jmp 0xc28d6a
mov dword [ebp - 0x17b8], ecx
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x15ac], ecx
test ecx, ecx
jne 0xc28cb7
mov edi, 0xc0000017
jmp 0xc28d6a
mov eax, dword [ebp - 0x1560]
mov edx, esi
mov dword [ecx], eax
lea eax, [ebp - 0x17a4]
push eax
mov dword [ebp - 0x17a4], ecx
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc28d51
mov ecx, dword [ebp - 0x17a4]
mov edx, esi
mov eax, dword [ebp - 0x18ec]
mov dword [ecx], eax
lea eax, [ebp - 0x17a4]
push eax
call fcn.00a32533
mov edi, eax
mov eax, dword [ebp - 0x15ac]
test edi, edi
js 0xc28d57
mov ecx, dword [ebp - 0x15a4]
push dword [ebp - 0x18ec]
mov edx, dword [ebp - 0x1588]
push dword [ebp - 0x158c]
mov dword [eax + ecx - 8], edx
mov edx, dword [ebp - 0x1584]
push dword [ebp - 0x17a4]
mov dword [eax + ecx - 4], edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0x15ac]
add esp, 0xc
mov ecx, dword [ebp - 0x15a4]
mov dword [ebp - 0x155c], eax
mov eax, ebx
mov dword [ebp - 0x1554], ecx
jmp 0xc28d57
mov eax, dword [ebp - 0x15ac]
test eax, eax
je 0xc28d6a
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or edi, 0x10000000
mov dword [ebp - 0x1588], edi
jl 0xc2a871
cmp dword [ebp - 0x155c], 0
mov dword [ebp - 0x1588], ebx
jne 0xc28d95
mov edi, 0xc000000d
jmp 0xc29426
mov edi, dword [ebp - 0x1554]
test edi, edi
je 0xc29510
lea eax, [edi + 8]
push eax
push ebx
mov dword [ebp - 0x158c], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1584], eax
test eax, eax
je 0xc29510
mov cl, bl
mov edx, ebx
test edi, edi
je 0xc28ddf
mov eax, dword [ebp - 0x155c]
xor cl, byte [edx + eax]
inc edx
cmp edx, edi
jb 0xc28dd7
mov eax, edi
mov dword [ebp - 0x718], 0xb1b54a58
shr eax, 3
mov esi, 0xc81ecb17
mov dword [ebp - 0x714], esi
mov dword [ebp - 0x15a4], eax
test eax, eax
je 0xc2925c
movzx eax, word [ebp - 0x712]
movzx edx, word [ebp - 0x716]
mov dword [ebp - 0x15ac], eax
mov eax, 0xb1b54a58
movzx esi, si
movzx eax, ax
mov dword [ebp - 0x15a8], eax
mov eax, dword [ebp - 0x1584]
mov dword [ebp - 0x15c0], esi
add eax, 7
mov esi, dword [ebp - 0x155c]
add esi, 2
mov dword [ebp - 0x15b0], edx
mov dword [ebp - 0x15cc], eax
or edx, 0xffffffff
mov dword [ebp - 0x15f0], esi
mov dword [ebp - 0x15c8], ebx
mov dword [ebp - 0x1648], ebx
mov dword [ebp - 0x167c], ebx
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0x15f0]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0x15f0]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0x15f0]
shl esi, 8
add dword [ebp - 0x15f0], 8
movzx eax, byte [eax + 5]
or esi, eax
xor edx, esi
mov dword [ebp - 0x1698], esi
mov dword [ebp - 0x16b4], edx
mov eax, edx
sub eax, dword [ebp - 0x15a8]
mov edx, 0xc81ecb17
xor eax, edx
mov esi, dword [ebp - 0x15ac]
xor eax, edi
xor dword [ebp - 0x15c8], eax
mov eax, dword [ebp - 0x15c8]
xor edx, eax
ror edx, 0xf
imul edx, dword [ebp - 0x15b0]
ror eax, 7
add edx, eax
mov eax, dword [ebp - 0x16b4]
xor eax, edx
mov edx, 0xb1b54a58
add edx, eax
mov dword [ebp - 0x16b4], eax
ror edx, 9
imul edx, dword [ebp - 0x15c0]
ror eax, 0xa
sub edx, eax
mov eax, dword [ebp - 0x15c8]
xor eax, edx
mov edx, dword [ebp - 0x15c0]
xor edx, eax
mov dword [ebp - 0x15c8], eax
rol edx, 4
imul edx, esi
rol eax, 5
add edx, eax
mov eax, dword [ebp - 0x16b4]
xor eax, edx
mov edx, 0xb1b54a58
xor edx, eax
mov dword [ebp - 0x16b4], eax
mov eax, 0xc81ecb17
sub eax, edx
mov edx, dword [ebp - 0x15c8]
xor edx, eax
mov dword [ebp - 0x15c8], edx
sub edx, dword [ebp - 0x15a8]
imul edx, dword [ebp - 0x15b0]
mov eax, dword [ebp - 0x15c8]
shr eax, 6
sub edx, eax
xor dword [ebp - 0x16b4], edx
mov edx, dword [ebp - 0x16b4]
mov eax, edx
ror eax, 0xf
xor eax, dword [ebp - 0x15c0]
imul eax, dword [ebp - 0x15a8]
xor dword [ebp - 0x15c8], eax
mov eax, dword [ebp - 0x15c8]
not eax
ror eax, 3
add eax, esi
imul eax, dword [ebp - 0x15c0]
xor edx, eax
mov eax, edx
mov dword [ebp - 0x16b4], edx
mov edx, dword [ebp - 0x15c8]
sub eax, 0xc81ecb17
sub eax, dword [ebp - 0x15a8]
xor edx, eax
mov eax, esi
mov dword [ebp - 0x15c8], edx
xor eax, dword [ebp - 0x15c8]
imul eax, dword [ebp - 0x15b0]
ror edx, 0xa
xor edx, eax
mov eax, dword [ebp - 0x16b4]
xor eax, edx
mov edx, dword [ebp - 0x15a8]
xor edx, eax
mov dword [ebp - 0x16b4], eax
rol edx, 6
imul edx, dword [ebp - 0x15c0]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0x15c8]
xor eax, edx
mov edx, esi
mov dword [ebp - 0x15c8], eax
ror eax, 0xf
sub eax, esi
imul eax, dword [ebp - 0x15a8]
xor dword [ebp - 0x16b4], eax
mov eax, dword [ebp - 0x16b4]
xor edx, eax
imul edx, dword [ebp - 0x15a8]
shr eax, 1
xor edx, eax
mov eax, dword [ebp - 0x16b4]
xor dword [ebp - 0x15c8], edx
mov edx, eax
sub edx, dword [ebp - 0x15c0]
rol edx, 3
imul edx, dword [ebp - 0x15a8]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0x15c8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x15c8], eax
sub edx, dword [ebp - 0x15c0]
imul edx, dword [ebp - 0x15b0]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x16b4]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0x16b4], eax
ror edx, 9
imul edx, dword [ebp - 0x15c0]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0x15c8]
xor eax, edx
mov edx, dword [ebp - 0x16b4]
mov dword [ebp - 0x15c8], eax
sub eax, esi
sub eax, 0xb1b54a58
xor edx, eax
mov eax, dword [ebp - 0x15b0]
mov dword [ebp - 0x16b4], edx
xor eax, dword [ebp - 0x16b4]
imul eax, dword [ebp - 0x15a8]
ror edx, 7
sub eax, edx
mov edx, esi
xor dword [ebp - 0x15c8], eax
mov eax, dword [ebp - 0x15c8]
xor edx, eax
rol edx, 4
imul edx, dword [ebp - 0x15b0]
ror eax, 0x10
sub edx, eax
mov eax, dword [ebp - 0x16b4]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0x16b4], eax
ror edx, 0xa
imul edx, dword [ebp - 0x15c0]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0x15c8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x15c8], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, esi
mov esi, 0xc81ecb17
xor edx, eax
mov eax, dword [ebp - 0x16b4]
xor eax, edx
mov edx, esi
xor edx, eax
mov dword [ebp - 0x16b4], eax
rol edx, 8
imul edx, dword [ebp - 0x15a8]
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0x15c8]
xor eax, edx
mov edx, esi
mov esi, dword [ebp - 0x15b0]
sub edx, eax
ror edx, 0xb
imul edx, esi
mov dword [ebp - 0x15c8], eax
ror eax, 0xc
sub edx, eax
mov eax, dword [ebp - 0x16b4]
xor eax, edx
mov edx, 0xc81ecb17
xor esi, eax
mov dword [ebp - 0x16b4], eax
imul esi, dword [ebp - 0x15c0]
xor edx, 0xb1b54a58
xor edx, dword [ebp - 0x16b4]
shr eax, 8
xor esi, eax
xor dword [ebp - 0x15c8], esi
mov esi, dword [ebp - 0x15cc]
xor edx, dword [ebp - 0x15c8]
xor edx, dword [ebp - 0x167c]
mov eax, dword [ebp - 0x15c8]
xor eax, dword [ebp - 0x1648]
add dword [ebp - 0x15cc], 8
mov byte [esi - 4], al
mov byte [esi], dl
ror eax, 8
mov byte [esi - 5], al
ror edx, 8
mov byte [esi - 1], dl
ror eax, 8
mov byte [esi - 6], al
ror edx, 8
mov byte [esi - 2], dl
ror eax, 8
ror edx, 8
mov byte [esi - 7], al
mov byte [esi - 3], dl
mov esi, dword [ebp - 0x1698]
ror eax, 8
ror edx, 8
sub dword [ebp - 0x15a4], 1
mov dword [ebp - 0x167c], esi
mov esi, dword [ebp - 0x15f0]
mov dword [ebp - 0x15c8], eax
mov dword [ebp - 0x1648], edi
jne 0xc28e6b
mov edi, dword [ebp - 0x1554]
movzx eax, cl
mov ecx, dword [ebp - 0x1584]
cdq
mov dword [ecx + edi], eax
mov dword [ecx + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x1554], esi
test esi, esi
jne 0xc29294
mov edi, 0xc0000017
jmp 0xc29394
mov edi, dword [ebp - 0x158c]
push edi
push 8
mov dword [esi], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc292b7
mov edi, 0xc0000017
jmp 0xc29333
mov dword [esi + 4], eax
mov edx, dword [ebp - 0x1584]
push edi
push edx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [esi + 8], eax
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc292b0
mov dword [esi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
push 8
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1554]
pop eax
push eax
push eax
mov dword [esi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0xc292b0
mov dword [esi + 0x14], ecx
mov eax, dword [0xc94e90]
mov edi, ebx
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ebp - 0x1588], esi
mov esi, ebx
mov dword [ecx + 4], eax
test esi, esi
je 0xc29394
cmp dword [esi + 4], 0
je 0xc29351
push dword [esi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 4], ebx
cmp dword [esi + 0xc], 0
je 0xc2936b
push dword [esi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0xc], ebx
cmp dword [esi + 0x14], 0
je 0xc29385
push dword [esi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0x14], ebx
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0xc293a8
mov eax, dword [ebp - 0x1588]
mov esi, ebx
mov dword [ebp - 0x1580], eax
jmp 0xc293ae
mov esi, dword [ebp - 0x1588]
push dword [ebp - 0x1584]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
je 0xc29423
cmp dword [esi + 4], 0
je 0xc293e0
push dword [esi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 4], ebx
cmp dword [esi + 0xc], 0
je 0xc293fa
push dword [esi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0xc], ebx
cmp dword [esi + 0x14], 0
je 0xc29414
push dword [esi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0x14], ebx
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
push 4
pop esi
or edi, 0x10000000
mov dword [ebp - 0x1588], edi
jl 0xc2a871
mov edx, dword [ebp - 0x1580]
lea eax, [ebp - 0x1794]
push eax
mov ecx, esi
mov dword [ebp - 0x1794], esi
mov edx, dword [edx]
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc294d6
mov ecx, dword [ebp - 0x1794]
lea eax, [ebp - 0x1794]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc294d6
mov ecx, dword [ebp - 0x1794]
lea eax, [ebp - 0x1794]
push eax
mov eax, dword [ebp - 0x1580]
mov edx, dword [eax + 8]
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc294d6
mov ecx, dword [ebp - 0x1794]
lea eax, [ebp - 0x1794]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc294d6
mov ecx, dword [ebp - 0x1794]
lea eax, [ebp - 0x1794]
push eax
mov eax, dword [ebp - 0x1580]
mov edx, dword [eax + 0x10]
call fcn.00a32533
mov edi, eax
mov eax, dword [ebp - 0x1794]
test edi, edi
jns 0xc294dc
mov eax, dword [ebp - 0x1788]
mov dword [ebp - 0x1588], eax
test edi, edi
js 0xc29666
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x158c], ecx
test ecx, ecx
jne 0xc2951a
mov edi, 0xc0000017
jmp 0xc29666
mov edi, 0xc0000001
jmp 0xc29426
mov eax, dword [ebp - 0x1580]
mov edx, esi
mov dword [ebp - 0x177c], ecx
mov eax, dword [eax]
mov dword [ecx], eax
lea eax, [ebp - 0x177c]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc2964d
mov edi, dword [ebp - 0x1580]
push dword [edi]
push dword [edi + 4]
push dword [ebp - 0x177c]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi]
lea eax, [ebp - 0x177c]
mov ecx, dword [ebp - 0x177c]
add esp, 0xc
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc2964d
mov eax, dword [ebp - 0x1580]
mov edx, esi
mov ecx, dword [ebp - 0x177c]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0x177c]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc2964d
mov edi, dword [ebp - 0x1580]
push dword [edi + 8]
push dword [edi + 0xc]
push dword [ebp - 0x177c]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi + 8]
lea eax, [ebp - 0x177c]
mov ecx, dword [ebp - 0x177c]
add esp, 0xc
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc2964d
mov eax, dword [ebp - 0x1580]
mov edx, esi
mov ecx, dword [ebp - 0x177c]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0x177c]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc2964d
mov edi, dword [ebp - 0x1580]
push dword [edi + 0x10]
push dword [edi + 0x14]
push dword [ebp - 0x177c]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0x177c]
mov ecx, dword [ebp - 0x177c]
add esp, 0xc
push eax
call fcn.00a32533
mov edi, eax
mov eax, dword [ebp - 0x158c]
test edi, edi
js 0xc29653
mov ecx, dword [ebp - 0x1588]
mov dword [ebp - 0x1564], eax
mov eax, ebx
mov dword [ebp - 0x1574], ecx
jmp 0xc29653
mov eax, dword [ebp - 0x158c]
test eax, eax
je 0xc29666
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or edi, 0x10000000
mov dword [ebp - 0x1588], edi
jl 0xc2a871
push 8
pop eax
mov dword [ebp - 0x158c], ebx
mov dword [ebp - 0x1554], ebx
mov dword [ebp - 0x180c], eax
mov edx, dword [ebp - 0x1558]
lea ecx, [ebp - 0x180c]
push ecx
mov ecx, eax
call fcn.00a32533
mov edi, eax
or edi, 0x10000000
mov dword [ebp - 0x1588], edi
jl 0xc2971a
mov eax, dword [ebp - 0x180c]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xc296ce
mov edi, 0xc0000095
mov dword [ebp - 0x1588], edi
jmp 0xc296f5
mov dword [ebp - 0x17ec], ecx
lea eax, [ebp - 0x17ec]
push eax
push 8
pop edx
call fcn.00a32533
mov edi, eax
mov eax, dword [ebp - 0x17ec]
mov dword [ebp - 0x1588], edi
test edi, edi
jns 0xc296fb
mov eax, dword [ebp - 0x17f4]
mov dword [ebp - 0x1558], eax
test edi, edi
js 0xc2971a
mov eax, dword [ebp - 0x1598]
test eax, eax
jne 0xc29748
mov edi, 0xc000000d
mov dword [ebp - 0x1588], edi
mov eax, ebx
test edi, edi
js 0xc2a871
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc299b4
mov edi, 0xd0000017
mov ecx, ebx
jmp 0xc299c1
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x1560], ecx
jbe 0xc2970f
mov ecx, eax
mov dword [ebp - 0x1584], ebx
mov dword [ebp - 0x1738], ecx
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x15a4], eax
lea eax, [ebp - 0x1738]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2971a
mov edx, dword [ebp - 0x15a4]
lea eax, [ebp - 0x1738]
mov ecx, dword [ebp - 0x1738]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2971a
mov eax, dword [ebp - 0x1584]
xor ecx, ecx
inc eax
inc ecx
cmp eax, ecx
mov dword [ebp - 0x1584], eax
mov ecx, dword [ebp - 0x1738]
jb 0xc29761
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1584], eax
lea eax, [ebp - 0x1738]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2971a
mov eax, dword [ebp - 0x1584]
mov dword [ebp - 0x158c], eax
neg eax
sbb eax, eax
and dword [ebp - 0x1738], eax
test edi, edi
js 0xc2971a
cmp dword [ebp - 0x1560], 2
jbe 0xc2970f
mov ecx, dword [ebp - 0x1598]
mov dword [ebp - 0x173c], ecx
mov dword [ebp - 0x1560], ebx
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1584], eax
lea eax, [ebp - 0x173c]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2971a
mov edx, dword [ebp - 0x1584]
lea eax, [ebp - 0x173c]
mov ecx, dword [ebp - 0x173c]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2971a
mov eax, dword [ebp - 0x1560]
mov ecx, dword [ebp - 0x173c]
inc eax
mov dword [ebp - 0x1560], eax
cmp eax, 2
jb 0xc29828
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1560], eax
lea eax, [ebp - 0x173c]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2971a
mov eax, dword [ebp - 0x1560]
mov dword [ebp - 0x1554], eax
neg eax
sbb eax, eax
and dword [ebp - 0x173c], eax
test edi, edi
js 0xc2971a
mov edx, dword [ebp - 0x1558]
lea eax, [ebp - 0x16d4]
push eax
mov ecx, esi
mov dword [ebp - 0x16d4], esi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2998a
mov ecx, dword [ebp - 0x16d4]
lea eax, [ebp - 0x16d4]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2998a
mov edx, dword [ebp - 0x158c]
lea eax, [ebp - 0x16d4]
mov ecx, dword [ebp - 0x16d4]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2998a
mov ecx, dword [ebp - 0x16d4]
lea eax, [ebp - 0x16d4]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2998a
mov edx, dword [ebp - 0x1554]
lea eax, [ebp - 0x16d4]
mov ecx, dword [ebp - 0x16d4]
push eax
call fcn.00a32533
mov edi, eax
mov eax, dword [ebp - 0x16d4]
mov dword [ebp - 0x1588], edi
test edi, edi
jns 0xc29998
mov eax, dword [ebp - 0x17e0]
test edi, edi
js 0xc2971a
cmp eax, 0x400000
jbe 0xc299a9
mov edi, 0x8000ffff
jmp 0xc2a86b
mov dword [ebp - 0x1568], eax
jmp 0xc2971c
mov ecx, eax
mov dword [ebp - 0x157c], ecx
mov edi, 0x10000000
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2a871
mov eax, dword [ebp - 0x1564]
test eax, eax
jne 0xc299e3
mov edi, 0x80070057
jmp 0xc2a86b
test ecx, ecx
je 0xc299d9
mov dword [ebp - 0x1ba4], eax
mov eax, dword [ebp - 0x1574]
mov dword [ebp - 0x1b9c], eax
mov eax, dword [ebp - 0x1568]
mov dword [ebp - 0x1b98], eax
lea eax, [ebp - 0x17e4]
push eax
xor eax, eax
mov dword [ebp - 0x1ba0], ecx
push 0x9f29b8
inc eax
mov dword [ebp - 0x1b94], ebx
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xc29a63
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
jle 0xc29a4e
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x1588], edi
test edi, edi
mov eax, dword [ebp - 0x1568]
js 0xc29ab7
mov edi, 0x80004005
mov dword [ebp - 0x1588], edi
jmp 0xc29ab7
push 0x9fc030
push dword [ebp - 0x17e4]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0xc29a2b
push ebx
push 0x14
lea eax, [ebp - 0x1ba4]
mov ecx, edi
push eax
push 0x86
call dword [0xc99200]
call edi
mov edi, eax
or edi, 0x10000000
mov dword [ebp - 0x1588], edi
jl 0xc29ab1
mov eax, dword [ebp - 0x1b98]
mov dword [ebp - 0x1568], eax
jmp 0xc29ab7
mov eax, dword [ebp - 0x1568]
cmp edi, 0xd0000023
jne 0xc29ac9
mov edi, 0x8007007a
jmp 0xc2a86b
test edi, edi
js 0xc2a871
mov ecx, dword [ebp - 0x157c]
mov dword [ebp - 0x1588], ebx
mov dword [ebp - 0x1744], ebx
mov dword [ebp - 0x16a8], ecx
cmp eax, esi
jae 0xc29af7
mov edi, 0xc000003e
jmp 0xc29f1e
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1558], eax
lea eax, [ebp - 0x16a8]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc29f1e
lea eax, [ebp - 0x1744]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc29f1e
mov eax, dword [ebp - 0x1568]
sub eax, dword [ebp - 0x1744]
mov ecx, dword [ebp - 0x1558]
cmp eax, ecx
jb 0xc29aed
mov eax, dword [ebp - 0x16a8]
lea edx, [ebp - 0x16a8]
push edx
mov edx, ecx
mov dword [ebp - 0x158c], eax
mov ecx, eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc29f1e
mov edx, dword [ebp - 0x1558]
lea eax, [ebp - 0x1744]
mov ecx, dword [ebp - 0x1744]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc29f1e
mov eax, dword [ebp - 0x1568]
sub eax, dword [ebp - 0x1744]
cmp eax, esi
jb 0xc29aed
mov ecx, dword [ebp - 0x16a8]
mov edx, esi
mov eax, dword [ecx]
mov dword [ebp - 0x1560], eax
lea eax, [ebp - 0x16a8]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc29f1e
mov ecx, dword [ebp - 0x1744]
lea eax, [ebp - 0x1744]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc29f1e
mov eax, dword [ebp - 0x1568]
sub eax, dword [ebp - 0x1744]
mov ecx, dword [ebp - 0x1560]
cmp eax, ecx
jb 0xc29aed
mov eax, dword [ebp - 0x16a8]
lea edx, [ebp - 0x16a8]
push edx
mov edx, ecx
mov dword [ebp - 0x1554], eax
mov ecx, eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc29f1e
mov edx, dword [ebp - 0x1560]
lea eax, [ebp - 0x1744]
mov ecx, dword [ebp - 0x1744]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc29f1e
mov eax, dword [ebp - 0x1568]
sub eax, dword [ebp - 0x1744]
cmp eax, esi
jb 0xc29aed
mov ecx, dword [ebp - 0x16a8]
mov edx, esi
mov eax, dword [ecx]
mov dword [ebp - 0x1574], eax
lea eax, [ebp - 0x16a8]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc29f1e
mov ecx, dword [ebp - 0x1744]
lea eax, [ebp - 0x1744]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc29f1e
mov eax, dword [ebp - 0x1568]
sub eax, dword [ebp - 0x1744]
mov ecx, dword [ebp - 0x1574]
cmp eax, ecx
jb 0xc29aed
lea eax, [ebp - 0x1744]
mov edx, ecx
mov ecx, dword [ebp - 0x1744]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc29f1e
mov edx, dword [ebp - 0x1568]
mov eax, edx
sub eax, dword [ebp - 0x1744]
jne 0xc29aed
mov eax, dword [ebp - 0x1560]
mov ecx, dword [ebp - 0x1574]
add eax, dword [ebp - 0x1558]
add ecx, 0xc
add eax, ecx
cmp eax, edx
jne 0xc29aed
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x1568], edi
test edi, edi
jne 0xc29d33
mov edi, 0xc0000017
jmp 0xc29e96
cmp dword [ebp - 0x158c], 0
je 0xc29d7c
mov eax, dword [ebp - 0x1558]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc29d62
mov edi, 0xc0000017
jmp 0xc29e20
mov dword [edi + 4], eax
push dword [ebp - 0x1558]
push dword [ebp - 0x158c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xc29d81
mov dword [edi], ebx
mov dword [edi + 4], ebx
cmp dword [ebp - 0x1554], 0
je 0xc29dc1
mov eax, dword [ebp - 0x1560]
push eax
push 8
mov dword [edi + 8], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc29d58
mov dword [edi + 0xc], eax
push dword [ebp - 0x1560]
push dword [ebp - 0x1554]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xc29dc7
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [ebp - 0x16a8], 0
je 0xc29e0c
mov eax, dword [ebp - 0x1574]
push eax
push 8
mov dword [edi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc29d58
mov dword [edi + 0x14], eax
mov ecx, dword [ebp - 0x1574]
push ecx
push dword [ebp - 0x16a8]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xc29e12
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 0x1588], edi
mov edi, ebx
mov dword [ebp - 0x1568], ebx
mov eax, dword [ebp - 0x1568]
test eax, eax
je 0xc29e96
mov ecx, dword [eax + 4]
test ecx, ecx
je 0xc29e49
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1568]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0xc29e68
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1568]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0xc29e87
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1568]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1588]
test edi, edi
js 0xc29eae
mov dword [ebp - 0x1590], eax
mov eax, ebx
mov dword [ebp - 0x1588], eax
test eax, eax
je 0xc29f1e
mov ecx, dword [eax + 4]
test ecx, ecx
je 0xc29ed1
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1588]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0xc29ef0
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1588]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0xc29f0f
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1588]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or edi, 0x10000000
mov dword [ebp - 0x1588], edi
jl 0xc2a871
mov ecx, dword [ebp - 0x1590]
mov dword [ebp - 0x1558], ebx
mov dword [ebp - 0x1588], ebx
test ecx, ecx
jne 0xc29f50
mov edi, 0xd000000d
jmp 0xc2a86b
mov eax, dword [ecx + 4]
mov dword [ebp - 0x158c], eax
test eax, eax
je 0xc29f46
mov edi, dword [ecx]
test edi, edi
je 0xc29f46
add edi, 0xfffffff8
push edi
push ebx
mov dword [ebp - 0x1560], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1554], eax
test eax, eax
je 0xc2a620
mov ecx, dword [ebp - 0x158c]
mov dl, bl
mov dword [ebp - 0x1574], ecx
mov ecx, edi
and ecx, 7
mov dword [ebp - 0x6e8], 0xab69605e
mov dword [ebp - 0x6e4], 0x7f1137f
mov dword [ebp - 0x1568], eax
mov dword [ebp - 0x1584], ecx
mov dword [ebp - 0x15a8], ebx
je 0xc2a5cb
mov dword [ebp - 0x15a4], ebx
mov eax, ebx
mov dword [ebp - 0x15ac], eax
test ecx, ecx
je 0xc2a038
push 0x38
pop edi
mov ecx, dword [ebp - 0x1574]
movzx eax, byte [ecx]
inc ecx
mov dword [ebp - 0x1574], ecx
cmp dword [ebp - 0x15a8], esi
jge 0xc2a002
lea ecx, [edi - 0x20]
shl eax, cl
or dword [ebp - 0x15ac], eax
jmp 0xc2a00c
mov ecx, edi
shl eax, cl
or dword [ebp - 0x15a4], eax
mov eax, dword [ebp - 0x15a8]
sub edi, 8
mov ecx, dword [ebp - 0x1584]
inc eax
mov dword [ebp - 0x15a8], eax
cmp eax, ecx
jl 0xc29fdd
mov eax, dword [ebp - 0x1574]
mov dword [ebp - 0x1574], eax
mov eax, dword [ebp - 0x15ac]
mov edi, dword [ebp - 0x15a4]
xor eax, 0x92f65a5
xor edi, 0x699a899c
mov dword [ebp - 0x15a8], eax
mov dword [ebp - 0x15b0], edi
mov dword [ebp - 0x15c0], eax
mov dword [ebp - 0x15cc], edi
mov dword [ebp - 0x15f0], ebx
test ecx, ecx
je 0xc2a0d2
mov eax, dword [ebp - 0x1568]
lea edi, [eax + 1]
mov dword [ebp - 0x1568], edi
cmp dword [ebp - 0x15f0], esi
jge 0xc2a091
rol dword [ebp - 0x15c0], 8
mov ecx, dword [ebp - 0x15c0]
jmp 0xc2a09e
rol dword [ebp - 0x15cc], 8
mov ecx, dword [ebp - 0x15cc]
inc dword [ebp - 0x15f0]
mov byte [eax], cl
mov eax, dword [ebp - 0x1568]
mov dword [ebp - 0x15c8], ecx
mov ecx, dword [ebp - 0x1584]
cmp dword [ebp - 0x15f0], ecx
jl 0xc2a071
mov edi, dword [ebp - 0x15b0]
mov dword [ebp - 0x1568], eax
mov eax, dword [ebp - 0x15a8]
cmp ecx, esi
jbe 0xc2a5a5
push 8
pop ecx
sub ecx, dword [ebp - 0x1584]
shl ecx, 3
shr edi, cl
shl edi, cl
mov dword [ebp - 0x15b0], edi
mov edi, dword [ebp - 0x1560]
mov eax, edi
shr eax, 3
mov dword [ebp - 0x1584], eax
test eax, eax
je 0xc2a55e
movzx ecx, word [ebp - 0x6e2]
mov eax, 0x7f1137f
movzx esi, word [ebp - 0x6e6]
mov edi, 0xab69605e
movzx eax, ax
xor edi, 0x7f1137f
mov dword [ebp - 0x15f0], ecx
mov ecx, 0xab69605e
mov dword [ebp - 0x15cc], eax
movzx eax, cx
mov ecx, dword [ebp - 0x1574]
mov dword [ebp - 0x1648], eax
mov eax, dword [ebp - 0x1568]
add eax, 7
mov dword [ebp - 0x15c0], edi
add ecx, 2
mov dword [ebp - 0x15c8], esi
mov dword [ebp - 0x1568], eax
mov dword [ebp - 0x1574], ecx
movzx edi, byte [ecx - 2]
movzx eax, byte [ecx - 1]
movzx esi, byte [ecx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ecx]
shl edi, 8
or edi, eax
add dword [ebp - 0x1574], 8
movzx eax, byte [ecx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 3]
or esi, eax
mov dword [ebp - 0x167c], edi
movzx eax, byte [ecx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 5]
mov ecx, dword [ebp - 0x15a8]
xor ecx, edi
shl esi, 8
or esi, eax
mov dword [ebp - 0x15a8], ecx
xor dword [ebp - 0x15b0], esi
mov edi, 0xab69605e
mov eax, 0x7f1137f
xor eax, edi
xor eax, dword [ebp - 0x15b0]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x15b0], eax
sub ecx, edi
rol eax, 0xa
mov edi, dword [ebp - 0x15cc]
rol ecx, 5
imul ecx, edi
add ecx, eax
mov eax, dword [ebp - 0x15a8]
xor eax, ecx
mov ecx, 0x7f1137f
add ecx, eax
mov dword [ebp - 0x15a8], eax
ror ecx, 9
imul ecx, dword [ebp - 0x15c8]
rol eax, 2
sub ecx, eax
mov eax, dword [ebp - 0x15b0]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x15b0], eax
sub ecx, edi
shr eax, 0xd
imul ecx, dword [ebp - 0x1648]
sub ecx, eax
mov eax, dword [ebp - 0x15a8]
xor eax, ecx
mov ecx, dword [ebp - 0x15c8]
xor ecx, eax
mov dword [ebp - 0x15a8], eax
rol ecx, 6
imul ecx, dword [ebp - 0x15f0]
rol eax, 2
sub ecx, eax
mov eax, dword [ebp - 0x15b0]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x15b0], eax
xor ecx, 0xab69605e
mov eax, 0x7f1137f
sub eax, ecx
mov ecx, dword [ebp - 0x15a8]
xor ecx, eax
mov eax, edi
mov dword [ebp - 0x15a8], ecx
xor eax, dword [ebp - 0x15a8]
imul eax, dword [ebp - 0x15c8]
ror ecx, 6
xor ecx, eax
mov eax, dword [ebp - 0x15b0]
xor eax, ecx
mov ecx, 0x7f1137f
add ecx, eax
mov dword [ebp - 0x15b0], eax
ror ecx, 0xf
imul ecx, dword [ebp - 0x1648]
rol eax, 2
add ecx, eax
mov eax, dword [ebp - 0x15a8]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x15a8], eax
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0x15f0]
sub ecx, eax
mov eax, dword [ebp - 0x15b0]
xor eax, ecx
mov ecx, 0xab69605e
xor ecx, eax
mov dword [ebp - 0x15b0], eax
ror ecx, 0xc
imul ecx, edi
ror eax, 0xa
xor ecx, eax
mov eax, dword [ebp - 0x15a8]
xor eax, ecx
mov ecx, dword [ebp - 0x15f0]
xor ecx, eax
mov dword [ebp - 0x15a8], eax
imul ecx, dword [ebp - 0x15c8]
shr eax, 0xa
xor ecx, eax
mov eax, dword [ebp - 0x15b0]
xor eax, ecx
mov ecx, dword [ebp - 0x15a8]
mov dword [ebp - 0x15b0], eax
not eax
ror eax, 5
add eax, dword [ebp - 0x1648]
imul eax, dword [ebp - 0x15f0]
xor ecx, eax
mov dword [ebp - 0x15a8], ecx
mov eax, ecx
mov ecx, dword [ebp - 0x15f0]
sub eax, ecx
xor eax, 0xab69605e
xor dword [ebp - 0x15b0], eax
mov eax, dword [ebp - 0x15b0]
xor ecx, eax
rol ecx, 2
imul ecx, edi
shr eax, 2
add ecx, eax
mov eax, dword [ebp - 0x15a8]
xor eax, ecx
mov dword [ebp - 0x15a8], eax
lea ecx, [eax - 0x7f1137f]
rol eax, 7
ror ecx, 6
imul ecx, dword [ebp - 0x15c8]
add ecx, eax
mov eax, dword [ebp - 0x15b0]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x15b0], eax
mov eax, edi
ror ecx, 9
xor eax, dword [ebp - 0x15b0]
imul eax, dword [ebp - 0x1648]
add ecx, eax
mov eax, dword [ebp - 0x15a8]
xor eax, ecx
mov ecx, dword [ebp - 0x15c8]
xor ecx, eax
mov dword [ebp - 0x15a8], eax
rol ecx, 5
imul ecx, dword [ebp - 0x15f0]
rol eax, 7
add ecx, eax
xor dword [ebp - 0x15b0], ecx
mov ecx, dword [ebp - 0x15a8]
mov eax, dword [ebp - 0x15c0]
xor eax, dword [ebp - 0x15b0]
xor ecx, eax
mov eax, ecx
mov dword [ebp - 0x15a8], ecx
mov ecx, dword [ebp - 0x15b0]
ror eax, 3
sub eax, dword [ebp - 0x15c8]
imul eax, edi
xor ecx, eax
mov dword [ebp - 0x15b0], ecx
sub ecx, 0x7f1137f
mov eax, dword [ebp - 0x15b0]
ror ecx, 1
imul ecx, dword [ebp - 0x1648]
ror eax, 6
sub ecx, eax
mov eax, dword [ebp - 0x15a8]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0x15a8], eax
rol ecx, 3
imul ecx, dword [ebp - 0x15f0]
rol eax, 0xe
add ecx, eax
mov eax, dword [ebp - 0x15b0]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0x15b0], eax
rol ecx, 0xf
imul ecx, edi
ror eax, 0xe
mov edi, dword [ebp - 0x1568]
sub ecx, eax
mov eax, dword [ebp - 0x15a8]
xor eax, ecx
mov ecx, dword [ebp - 0x1648]
xor ecx, eax
mov dword [ebp - 0x15a8], eax
imul ecx, dword [ebp - 0x15c8]
shr eax, 3
xor ecx, eax
mov eax, dword [ebp - 0x15b0]
xor eax, ecx
mov ecx, 0x7f1137f
xor ecx, eax
mov dword [ebp - 0x15b0], eax
rol ecx, 4
imul ecx, dword [ebp - 0x1648]
rol eax, 2
xor ecx, eax
mov eax, dword [ebp - 0x15a8]
xor ecx, dword [ebp - 0x15ac]
xor eax, ecx
mov ecx, dword [ebp - 0x15b0]
xor ecx, dword [ebp - 0x15a4]
mov byte [edi - 4], al
mov byte [edi], cl
ror eax, 8
mov byte [edi - 5], al
ror ecx, 8
mov byte [edi - 1], cl
ror eax, 8
mov byte [edi - 6], al
ror ecx, 8
mov byte [edi - 2], cl
ror eax, 8
ror ecx, 8
mov byte [edi - 7], al
mov byte [edi - 3], cl
mov edi, dword [ebp - 0x167c]
ror eax, 8
ror ecx, 8
mov dword [ebp - 0x15a8], eax
mov dword [ebp - 0x15b0], ecx
mov dword [ebp - 0x15ac], edi
mov dword [ebp - 0x15a4], esi
add dword [ebp - 0x1568], 8
sub dword [ebp - 0x1584], 1
mov ecx, dword [ebp - 0x1574]
jne 0xc2a16e
mov edi, dword [ebp - 0x1560]
push 4
pop esi
mov eax, ebx
test edi, edi
je 0xc2a572
mov ecx, dword [ebp - 0x1554]
xor dl, byte [eax + ecx]
inc eax
cmp eax, edi
jb 0xc2a56a
mov ecx, dword [ebp - 0x158c]
movzx eax, dl
cdq
cmp eax, dword [edi + ecx]
mov ecx, dword [ebp - 0x1554]
jne 0xc2a5e3
mov eax, dword [ebp - 0x158c]
cmp edx, dword [edi + eax + 4]
jne 0xc2a5e3
mov dword [ebp - 0x1558], ecx
mov ecx, ebx
mov dword [ebp - 0x1588], edi
mov edi, ebx
jmp 0xc2a5e8
mov dword [ebp - 0x15b0], ebx
jae 0xc2a0f0
mov ecx, esi
sub ecx, dword [ebp - 0x1584]
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0x15a8], eax
jmp 0xc2a0f0
or dword [ebp - 0x15a4], 0xffffffff
mov dword [ebp - 0x15ac], ebx
mov dword [ebp - 0x15b0], ebx
jmp 0xc2a0f6
mov edi, 0xc004d501
test ecx, ecx
je 0xc2a5fb
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0xc2a620
mov eax, dword [ebp - 0x1558]
mov edi, 0x10000000
mov ecx, dword [ebp - 0x1588]
mov dword [ebp - 0x156c], eax
mov eax, ebx
mov dword [ebp - 0x159c], ecx
jmp 0xc2a62b
mov eax, dword [ebp - 0x1558]
mov edi, 0xd0000001
mov dword [ebp - 0x1588], edi
test eax, eax
je 0xc2a644
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0xc2a871
mov ecx, dword [ebp - 0x156c]
mov dword [ebp - 0x16ac], ebx
mov dword [ebp - 0x16b0], ecx
cmp dword [ebp - 0x159c], esi
jb 0xc2a860
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1588], eax
lea eax, [ebp - 0x16b0]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc2a865
lea eax, [ebp - 0x16ac]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc2a865
mov eax, dword [ebp - 0x159c]
sub eax, dword [ebp - 0x16ac]
cmp eax, esi
jb 0xc2a860
mov ecx, dword [ebp - 0x16b0]
mov edx, esi
mov eax, dword [ecx]
mov dword [ebp - 0x1558], eax
lea eax, [ebp - 0x16b0]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc2a865
mov ecx, dword [ebp - 0x16ac]
lea eax, [ebp - 0x16ac]
push eax
mov edx, esi
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc2a865
mov eax, dword [ebp - 0x159c]
mov ecx, dword [ebp - 0x16ac]
sub eax, ecx
mov edx, dword [ebp - 0x1558]
cmp eax, edx
jb 0xc2a860
lea eax, [ebp - 0x16ac]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc2a865
mov ecx, dword [ebp - 0x16b0]
mov eax, dword [ebp - 0x156c]
mov edx, dword [ebp - 0x1558]
add ecx, edx
mov edi, dword [ebp - 0x159c]
add eax, edi
cmp eax, ecx
jb 0xc2a860
mov eax, dword [ebp - 0x156c]
mov ecx, dword [ebp - 0x16b0]
sub eax, edx
sub eax, ecx
add eax, edi
cmp eax, 8
jae 0xc2a860
mov dword [ebp - 0x158c], ebx
mov edi, ebx
mov dword [ebp - 0x1560], ebx
test ecx, ecx
je 0xc2a7d9
lea eax, [ebp - 0x1688]
push eax
call fcn.00a32533
mov edi, eax
test edi, edi
js 0xc2a865
mov edx, dword [ebp - 0x1688]
mov ecx, dword [ebp - 0x16b0]
jmp 0xc2a7cb
lea eax, [ecx + 4]
cmp eax, ecx
jb 0xc2a80e
cmp eax, edx
ja 0xc2a807
mov eax, dword [ecx]
add eax, 4
cmp eax, esi
jb 0xc2a800
add eax, ecx
cmp eax, ecx
jb 0xc2a80e
mov ecx, eax
mov edi, ebx
cmp ecx, edx
ja 0xc2a807
inc dword [ebp - 0x1560]
cmp ecx, edx
jb 0xc2a7a3
cmp ecx, edx
jne 0xc2a807
mov edx, dword [ebp - 0x1558]
test edx, edx
je 0xc2a81f
push edx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x158c], ecx
test ecx, ecx
jne 0xc2a815
mov edi, 0xc0000017
jmp 0xc2a84e
mov edi, 0xc0000095
jmp 0xc2a84e
mov edi, 0xc000000d
jmp 0xc2a865
mov edi, 0xc0000095
jmp 0xc2a865
mov edx, dword [ebp - 0x1558]
mov edi, ebx
jmp 0xc2a821
mov ecx, ebx
mov eax, dword [ebp - 0x16b0]
test eax, eax
je 0xc2a836
push edx
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x158c]
mov dword [ebp - 0x1a9c], eax
mov eax, dword [ebp - 0x1560]
mov dword [ebp - 0x1aa4], eax
test edi, edi
js 0xc2a865
mov eax, dword [ebp - 0x1588]
cmp eax, dword [ebp - 0x1aa4]
je 0xc2a865
mov edi, 0xc000003e
or edi, 0x10000000
mov dword [ebp - 0x1588], edi
mov eax, dword [ebp - 0x155c]
test eax, eax
je 0xc2a88a
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1580]
test eax, eax
je 0xc2a903
cmp dword [eax + 4], 0
je 0xc2a8b4
push dword [eax + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1580]
mov dword [eax + 4], ebx
cmp dword [eax + 0xc], 0
je 0xc2a8d4
push dword [eax + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1580]
mov dword [eax + 0xc], ebx
cmp dword [eax + 0x14], 0
je 0xc2a8f4
push dword [eax + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1580]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1564]
test eax, eax
je 0xc2a91c
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x157c]
test eax, eax
je 0xc2a935
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1590]
test eax, eax
je 0xc2a9ae
cmp dword [eax + 4], 0
je 0xc2a95f
push dword [eax + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1590]
mov dword [eax + 4], ebx
cmp dword [eax + 0xc], 0
je 0xc2a97f
push dword [eax + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1590]
mov dword [eax + 0xc], ebx
cmp dword [eax + 0x14], 0
je 0xc2a99f
push dword [eax + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1590]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x156c]
test eax, eax
je 0xc2a9c7
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0xc2afe8
xor eax, eax
inc eax
cmp dword [ebp - 0x1aa4], eax
jb 0xc2afdd
cmp dword [ebp - 0x1a9c], 0
jne 0xc2aa6b
mov edi, 0xc000000d
mov dword [ebp - 0x1588], edi
mov eax, ebx
test edi, edi
js 0xc2afe8
cmp eax, 0xd0000023
jne 0xc2aa12
mov eax, 0x8007007a
mov dword [ebp - 0x15b8], eax
cmp eax, 0x8007007a
je 0xc2aa29
mov edi, eax
mov dword [ebp - 0x1588], edi
test eax, eax
js 0xc2afe8
cmp dword [ebp - 0x1aa4], 6
jne 0xc2afdd
cmp dword [ebp - 0x1a9c], 0
jne 0xc2aaeb
mov edx, dword [ebp - 0x1a94]
mov edi, 0xc000000d
mov ecx, dword [ebp - 0x1a98]
mov dword [ebp - 0x1588], edi
mov dword [ebp - 0x1558], edx
mov dword [ebp - 0x155c], ecx
jmp 0xc2abdd
cmp dword [ebp - 0x1aa4], 0
jbe 0xc2a9eb
mov eax, dword [ebp - 0x1a9c]
mov edx, esi
mov dword [ebp - 0x1678], eax
mov ecx, dword [eax]
mov dword [ebp - 0x1558], ecx
lea ecx, [ebp - 0x1678]
push ecx
mov ecx, eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2aac2
mov ecx, dword [ebp - 0x1558]
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1678]
mov dword [ebp - 0x1678], eax
jmp 0xc2aace
mov ecx, dword [ebp - 0x17f8]
mov eax, dword [ebp - 0x1804]
test edi, edi
js 0xc2a9f6
cmp ecx, esi
jne 0xc2840a
mov eax, dword [eax]
mov dword [ebp - 0x15b8], eax
jmp 0xc2a9f8
mov ecx, dword [ebp - 0x1a9c]
mov dword [ebp - 0x163c], ecx
mov dword [ebp - 0x1558], ebx
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x155c], eax
lea eax, [ebp - 0x163c]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2ab99
mov edx, dword [ebp - 0x155c]
lea eax, [ebp - 0x163c]
mov ecx, dword [ebp - 0x163c]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2ab99
mov eax, dword [ebp - 0x1558]
xor ecx, ecx
inc eax
inc ecx
cmp eax, ecx
mov dword [ebp - 0x1558], eax
mov ecx, dword [ebp - 0x163c]
jb 0xc2aafd
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1558], eax
lea eax, [ebp - 0x163c]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2ab99
mov ecx, dword [ebp - 0x1558]
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0x163c]
mov dword [ebp - 0x163c], eax
jmp 0xc2aba5
mov ecx, dword [ebp - 0x1844]
mov eax, dword [ebp - 0x1860]
test edi, edi
js 0xc2abc5
cmp ecx, 8
jne 0xc2840a
mov ecx, dword [eax]
mov dword [ebp - 0x155c], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1558], ecx
jmp 0xc2abdd
mov eax, dword [ebp - 0x1a94]
mov dword [ebp - 0x1558], eax
mov eax, dword [ebp - 0x1a98]
mov dword [ebp - 0x155c], eax
test edi, edi
js 0xc2afe8
cmp dword [ebp - 0x1a9c], 0
jne 0xc2ac24
mov edi, 0xc000000d
mov dword [ebp - 0x1588], edi
mov eax, dword [ebp - 0x1778]
mov dword [ebp - 0x158c], eax
test edi, edi
js 0xc2afe8
cmp dword [ebp - 0x1a9c], 0
jne 0xc2acf3
mov edi, 0xc000000d
jmp 0xc2afe2
mov ecx, dword [ebp - 0x1a9c]
mov dword [ebp - 0x15ec], ecx
mov dword [ebp - 0x158c], ebx
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1560], eax
lea eax, [ebp - 0x15ec]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2acd0
mov edx, dword [ebp - 0x1560]
lea eax, [ebp - 0x15ec]
mov ecx, dword [ebp - 0x15ec]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2acd0
mov eax, dword [ebp - 0x158c]
mov ecx, dword [ebp - 0x15ec]
inc eax
mov dword [ebp - 0x158c], eax
cmp eax, 2
jb 0xc2ac36
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x158c], eax
lea eax, [ebp - 0x15ec]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2acd0
mov ecx, dword [ebp - 0x158c]
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0x15ec]
mov dword [ebp - 0x15ec], eax
jmp 0xc2acdc
mov ecx, dword [ebp - 0x1780]
mov eax, dword [ebp - 0x1784]
test edi, edi
js 0xc2abf9
cmp ecx, esi
jne 0xc2840a
mov eax, dword [eax]
jmp 0xc2abff
mov ecx, dword [ebp - 0x1a9c]
mov dword [ebp - 0x15dc], ecx
mov dword [ebp - 0x1560], ebx
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1554], eax
lea eax, [ebp - 0x15dc]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2ad9d
mov edx, dword [ebp - 0x1554]
lea eax, [ebp - 0x15dc]
mov ecx, dword [ebp - 0x15dc]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2ad9d
mov eax, dword [ebp - 0x1560]
mov ecx, dword [ebp - 0x15dc]
inc eax
mov dword [ebp - 0x1560], eax
cmp eax, 3
jb 0xc2ad05
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1560], eax
lea eax, [ebp - 0x15dc]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2ad9d
mov eax, dword [ebp - 0x1560]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x15dc]
mov dword [ebp - 0x15dc], eax
jmp 0xc2adaf
mov eax, dword [ebp - 0x178c]
mov dword [ebp - 0x1560], eax
mov eax, dword [ebp - 0x1790]
mov dword [ebp - 0x1554], eax
test edi, edi
js 0xc2afe8
mov ecx, dword [ebp - 0x1a9c]
mov edx, ebx
mov eax, dword [ecx]
mov dword [ebp - 0x1580], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0xc2add8
mov edi, ebx
jmp 0xc2ade0
mov edi, 0xc0000095
or eax, 0xffffffff
mov dword [ebp - 0x1588], edi
mov dword [ebp - 0x1664], eax
test edi, edi
js 0xc2ae66
mov ecx, dword [ebp - 0x1580]
add ecx, eax
mov edi, ecx
mov dword [ebp - 0x1580], edi
cmp ecx, eax
jae 0xc2ae07
or ecx, 0xffffffff
cmp edi, eax
mov dword [ebp - 0x1664], ecx
sbb edi, edi
and edi, 0xc0000095
mov dword [ebp - 0x1588], edi
cmp dword [ebp - 0x1580], eax
jb 0xc2ae66
inc edx
cmp edx, esi
jb 0xc2adc5
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1580], eax
lea eax, [ebp - 0x1664]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2ae66
mov ecx, dword [ebp - 0x1580]
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1664]
mov dword [ebp - 0x1664], eax
jmp 0xc2ae72
mov ecx, dword [ebp - 0x1798]
mov eax, dword [ebp - 0x179c]
test edi, edi
js 0xc2ae82
cmp ecx, esi
jne 0xc2840a
mov eax, dword [eax]
jmp 0xc2ae88
mov eax, dword [ebp - 0x17a0]
mov dword [ebp - 0x1580], eax
test edi, edi
js 0xc2afe8
mov ecx, dword [ebp - 0x1a9c]
mov edx, ebx
mov eax, dword [ecx]
mov dword [ebp - 0x1564], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0xc2aeb1
mov edi, ebx
jmp 0xc2aeb9
mov edi, 0xc0000095
or eax, 0xffffffff
mov dword [ebp - 0x1588], edi
mov dword [ebp - 0x162c], eax
test edi, edi
js 0xc2af40
mov ecx, dword [ebp - 0x1564]
add ecx, eax
mov edi, ecx
mov dword [ebp - 0x1564], edi
cmp ecx, eax
jae 0xc2aee0
or ecx, 0xffffffff
cmp edi, eax
mov dword [ebp - 0x162c], ecx
sbb edi, edi
and edi, 0xc0000095
mov dword [ebp - 0x1588], edi
cmp dword [ebp - 0x1564], eax
jb 0xc2af40
inc edx
cmp edx, 5
jb 0xc2ae9e
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1564], eax
lea eax, [ebp - 0x162c]
push eax
call fcn.00a32533
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
js 0xc2af40
mov ecx, dword [ebp - 0x1564]
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0x162c]
mov dword [ebp - 0x162c], eax
jmp 0xc2af4c
mov ecx, dword [ebp - 0x17a8]
mov eax, dword [ebp - 0x17ac]
test edi, edi
js 0xc2af5c
cmp ecx, esi
jne 0xc2840a
mov ecx, dword [eax]
jmp 0xc2af5e
mov ecx, ebx
test edi, edi
js 0xc2afe8
mov eax, dword [ebp - 0x1594]
cmp eax, dword [ebp - 0x155c]
jne 0xc2afdd
mov eax, dword [ebp - 0x1570]
cmp eax, dword [ebp - 0x1558]
jne 0xc2afdd
mov dword [ebp - 0x15b4], ecx
cmp dword [ebp - 0x1580], esi
jbe 0xc2afa3
mov ecx, dword [ebp - 0x158c]
mov edi, 0x8007007a
mov dword [ebp - 0x15c4], ecx
jmp 0xc2afe2
mov eax, dword [ebp - 0x1560]
cmp eax, esi
ja 0xc2af90
mov esi, dword [ebp - 0x15bc]
push eax
push dword [ebp - 0x1554]
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0x158c]
add esp, 0xc
mov dword [ebp - 0x15c4], eax
mov eax, dword [ebp - 0x15b8]
test eax, eax
je 0xc2afe8
mov edi, eax
jmp 0xc2afe2
mov edi, 0xc004d501
mov dword [ebp - 0x1588], edi
mov eax, dword [ebp - 0x1598]
mov dword [ebp - 0x1b00], ebx
mov dword [ebp - 0x1b04], ebx
test eax, eax
je 0xc2b013
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x1afc], ebx
mov eax, dword [ebp - 0x1a9c]
mov dword [ebp - 0x1aa0], ebx
mov dword [ebp - 0x1aa4], ebx
test eax, eax
je 0xc2b03e
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x1a9c], ebx
mov eax, dword [ebp - 0x15a0]
test eax, eax
je 0xc2b057
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1578]
test eax, eax
je 0xc2b070
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0xc27f32
mov eax, dword [ebp - 0x15b4]
test eax, eax
je 0xc31d23
mov dword [0xc95878], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x380]
push eax
push 0x9d0000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0xc2fac7
cmp eax, esi
jne 0xc2b0be
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0xc2fac7
mov esi, dword [0xc9307c]
mov ecx, esi
push 0x403
push ebx
push ebx
call dword [0xc99200]
call esi
mov dword [ebp - 0x15b4], eax
test eax, eax
jne 0xc2b0ea
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc2fac7
mov esi, dword [0xc9304c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [0xc95870], eax
lea edi, [ebp - 0x774]
mov eax, dword [0xc95878]
mov dword [ebp - 0x15a0], eax
xor eax, eax
stosd dword es:[edi], eax
push 0x2c
push ebx
mov dword [0xc95874], edx
stosd dword es:[edi], eax
mov dword [ebp - 0x1a60], ebx
mov dword [ebp - 0x1a5c], ebx
mov dword [ebp - 0x1598], ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x9ec]
push eax
mov dword [ebp - 0x15b8], ebx
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x1558], ebx
mov edx, 0xc96238
xor eax, eax
lea ecx, [eax + 1]
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc2b150
mov eax, dword [0xc95890]
test eax, eax
jne 0xc2b795
push 0x338
mov edi, ebx
mov dword [ebp - 0x1578], ebx
push ebx
mov dword [ebp - 0x155c], edi
mov dword [ebp - 0x1594], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1570], eax
test eax, eax
je 0xc2b72e
or dword [ebp - 0x1560], 0xffffffff
mov edi, 0x9fbcf2
add eax, 7
mov dword [ebp - 0x6f0], 0xab69605e
mov cl, bl
mov dword [ebp - 0x6ec], 0x7f1137f
mov dword [ebp - 0x158c], ebx
mov esi, ebx
mov edx, ebx
mov dword [ebp - 0x1554], eax
mov dword [ebp - 0x1580], edi
mov dword [ebp - 0x1564], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0x1580]
xor edx, ebx
mov dword [ebp - 0x1574], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0x1580]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0x1580]
shl edi, 8
add dword [ebp - 0x1580], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
mov dword [ebp - 0x157c], esi
mov esi, edx
xor esi, dword [ebp - 0x157c]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x1574]
xor eax, edx
mov dword [ebp - 0x1574], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x1574]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x1574]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x1574], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x1574]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x1574]
xor edx, eax
mov dword [ebp - 0x1574], edx
mov eax, dword [ebp - 0x1574]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x1574]
xor eax, edx
mov dword [ebp - 0x1574], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x1574]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x1574]
xor eax, edx
mov dword [ebp - 0x1574], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x1574]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0x1574]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0x157c], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x157c]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x157c]
xor eax, edx
mov dword [ebp - 0x157c], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x157c], edx
mov edx, dword [ebp - 0x157c]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x157c], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x157c]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x157c]
xor eax, edx
mov dword [ebp - 0x157c], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x157c]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x157c]
xor eax, edx
mov dword [ebp - 0x157c], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x157c]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x157c]
xor edx, dword [ebp - 0x158c]
xor eax, dword [ebp - 0x1560]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x1574], esi
mov esi, dword [ebp - 0x1554]
mov dword [ebp - 0x1560], edi
mov edi, dword [ebp - 0x1580]
mov dword [ebp - 0x158c], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x1564], 1
mov dword [ebp - 0x1554], esi
mov esi, eax
mov dword [ebp - 0x157c], eax
jne 0xc2b1e4
mov esi, dword [ebp - 0x1570]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc2b567
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc2b59c
cmp edx, dword [0x9fc02c]
jne 0xc2b59c
mov edi, esi
mov dword [ebp - 0x155c], esi
mov esi, ebx
mov dword [ebp - 0x1570], 0x337
jmp 0xc2b5af
or dword [ebp - 0x1570], 0xffffffff
mov edi, ebx
mov dword [ebp - 0x1594], 0xc004d501
test esi, esi
je 0xc2b5c2
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x1594], ebx
jl 0xc2b728
mov eax, dword [ebp - 0x1570]
mov esi, edi
push 0x40
push ebx
push 0xc960a0
mov byte [eax + edi], bl
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], bl
je 0xc2b735
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0x1594], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc2b603
sub ecx, dword [ebp - 0x1594]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc2b721
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0x1594], ecx
cmp word [eax], dx
je 0xc2b64b
mov ecx, 0xc000007b
mov dword [ebp - 0x1594], ecx
jmp 0xc2b693
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc2b63e
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc2b63e
cmp dword [edx], 0x4550
jne 0xc2b63e
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0x1764]
je 0xc2b681
cmp ax, word [ebp - 0x1768]
je 0xc2b681
mov ecx, 0xc000000d
jmp 0xc2b643
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0x1570], eax
mov dword [ebp - 0x158c], ebx
test eax, eax
je 0xc2b70e
mov edx, esi
mov dword [ebp - 0x1560], esi
lea eax, [edx + 1]
mov dword [ebp - 0x1554], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc2b6ba
sub edx, dword [ebp - 0x1554]
inc esi
add esi, edx
test ecx, ecx
js 0xc2b6f3
push dword [ebp - 0x1560]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc2b719
mov ecx, dword [ebp - 0x1578]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x1594]
mov eax, dword [ebp - 0x158c]
inc dword [ebp - 0x1578]
inc eax
mov dword [ebp - 0x158c], eax
cmp eax, dword [ebp - 0x1570]
jb 0xc2b6a9
add edi, 0x10
cmp byte [esi], bl
jne 0xc2b5f6
mov esi, dword [ebp - 0x1594]
jmp 0xc2b737
mov esi, 0xc000007a
jmp 0xc2b737
mov edi, dword [ebp - 0x155c]
mov esi, 0xc000007a
jmp 0xc2b73d
mov esi, ebx
mov edi, dword [ebp - 0x155c]
test edi, edi
je 0xc2b750
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push edi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0xc2b790
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc2b767
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc2b756
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc2b79b
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edx, 0xc96238
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0x1578], ebx
lea edi, [ebp - 0x1b90]
mov dword [ebp - 0x155c], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x1594], ebx
mov dword [ebp - 0x1570], ebx
mov dword [ebp - 0x1560], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x1580], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea ecx, [eax + 1]
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc2b7d4
mov eax, dword [0xc95890]
test eax, eax
jne 0xc2be04
push 0x338
push ebx
mov dword [ebp - 0x158c], ebx
mov dword [ebp - 0x1554], ebx
mov dword [ebp - 0x1564], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1574], eax
test eax, eax
je 0xc2bd9e
or dword [ebp - 0x1568], 0xffffffff
mov edi, 0x9fbcf2
add eax, 7
mov dword [ebp - 0x6f8], 0xab69605e
mov cl, bl
mov dword [ebp - 0x6f4], 0x7f1137f
mov dword [ebp - 0x157c], ebx
mov esi, ebx
mov edx, ebx
mov dword [ebp - 0x1590], eax
mov dword [ebp - 0x156c], edi
mov dword [ebp - 0x159c], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0x156c]
xor edx, ebx
mov dword [ebp - 0x1584], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0x156c]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0x156c]
shl edi, 8
add dword [ebp - 0x156c], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
mov dword [ebp - 0x15a4], esi
mov esi, edx
xor esi, dword [ebp - 0x15a4]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x1584]
xor eax, edx
mov dword [ebp - 0x1584], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x1584]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x1584]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x1584], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x1584]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x1584]
xor edx, eax
mov dword [ebp - 0x1584], edx
mov eax, dword [ebp - 0x1584]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x1584]
xor eax, edx
mov dword [ebp - 0x1584], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x1584]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x1584]
xor eax, edx
mov dword [ebp - 0x1584], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x1584]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0x1584]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0x15a4], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x15a4]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x15a4]
xor eax, edx
mov dword [ebp - 0x15a4], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x15a4], edx
mov edx, dword [ebp - 0x15a4]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x15a4], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x15a4]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x15a4]
xor eax, edx
mov dword [ebp - 0x15a4], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x15a4]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x15a4]
xor eax, edx
mov dword [ebp - 0x15a4], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x15a4]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x15a4]
xor edx, dword [ebp - 0x157c]
xor eax, dword [ebp - 0x1568]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x1584], esi
mov esi, dword [ebp - 0x1590]
mov dword [ebp - 0x1568], edi
mov edi, dword [ebp - 0x156c]
mov dword [ebp - 0x157c], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x159c], 1
mov dword [ebp - 0x1590], esi
mov esi, eax
mov dword [ebp - 0x15a4], eax
jne 0xc2b866
mov esi, dword [ebp - 0x1574]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc2bbe9
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc2bc17
cmp edx, dword [0x9fc02c]
jne 0xc2bc17
mov dword [ebp - 0x1554], esi
mov edi, 0x337
mov esi, ebx
jmp 0xc2bc24
mov dword [ebp - 0x1564], 0xc004d501
or edi, 0xffffffff
test esi, esi
je 0xc2bc37
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x1564], ebx
jl 0xc2bd9e
mov eax, dword [ebp - 0x1554]
mov esi, eax
push 0x40
push ebx
push 0xc960a0
mov byte [edi + eax], bl
call fcn.00ab4bf6
mov eax, esi
add esp, 0xc
cmp byte [eax], bl
je 0xc2bda5
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0x1564], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc2bc7a
sub ecx, dword [ebp - 0x1564]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc2bd9e
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0x1564], ecx
cmp word [eax], dx
je 0xc2bcc2
mov ecx, 0xc000007b
mov dword [ebp - 0x1564], ecx
jmp 0xc2bd0a
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc2bcb5
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc2bcb5
cmp dword [edx], 0x4550
jne 0xc2bcb5
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0x1764]
je 0xc2bcf8
cmp ax, word [ebp - 0x1768]
je 0xc2bcf8
mov ecx, 0xc000000d
jmp 0xc2bcba
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0x1574], eax
mov dword [ebp - 0x157c], ebx
test eax, eax
je 0xc2bd85
mov edx, esi
mov dword [ebp - 0x1568], esi
lea eax, [edx + 1]
mov dword [ebp - 0x1590], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc2bd31
sub edx, dword [ebp - 0x1590]
inc esi
add esi, edx
test ecx, ecx
js 0xc2bd6a
push dword [ebp - 0x1568]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc2bd90
mov ecx, dword [ebp - 0x158c]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x1564]
mov eax, dword [ebp - 0x157c]
inc dword [ebp - 0x158c]
inc eax
mov dword [ebp - 0x157c], eax
cmp eax, dword [ebp - 0x1574]
jb 0xc2bd20
add edi, 0x10
cmp byte [esi], bl
jne 0xc2bc6d
mov esi, dword [ebp - 0x1564]
mov eax, dword [ebp - 0x1554]
jmp 0xc2bda7
mov esi, 0xc000007a
jmp 0xc2bd96
mov esi, ebx
test eax, eax
je 0xc2bdbf
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push dword [ebp - 0x1554]
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0xc2bdff
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc2bdd6
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc2bdc5
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc2be0a
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
push 0x54
lea eax, [ebp - 0x11e0]
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
mov esi, dword [0xc9307c]
lea edi, [ebp - 0x778]
add esp, 0xc
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
pop edx
push 0x403
push ebx
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x15a0]
mov ecx, eax
and ecx, edx
mov dword [ebp - 0x15a0], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
and ecx, edx
shr eax, 0xc
mov word [ebp - 0xa], cx
and eax, edx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0xc99200]
call esi
mov dword [ebp - 0x1564], eax
mov dword [ebp - 0x158c], 0xffffff
test eax, eax
jne 0xc2bec6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x1574], edi
test edi, edi
jle 0xc2beb1
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x1574], edi
test edi, edi
js 0xc2d54a
mov dword [ebp - 0x1574], 0x80004005
jmp 0xc2d54a
mov edi, dword [0xc93050]
lea eax, [ebp - 0x17b4]
push eax
push ebx
lea eax, [ebp - 0x1610]
mov dword [ebp - 0x17b0], ebx
push eax
mov esi, ebx
mov dword [ebp - 0x157c], ebx
push 8
mov ecx, edi
mov dword [ebp - 0x1554], esi
mov dword [ebp - 0x1568], ebx
mov dword [ebp - 0x1574], ebx
mov dword [ebp - 0x17b4], ebx
call dword [0xc99200]
call edi
test eax, eax
jne 0xc2c0c9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x1574], eax
test eax, eax
jle 0xc2bf35
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1574], eax
test eax, eax
js 0xc2c263
mov dword [ebp - 0x1574], 0x80004005
mov esi, dword [ebp - 0x1568]
mov edi, dword [ebp - 0x1594]
test esi, esi
je 0xc2bfbf
mov eax, ebx
mov dword [ebp - 0x1568], ebx
mov edx, dword [esi + eax*4]
test edx, edx
je 0xc2bfb3
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x1590], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc2bf6f
sub ecx, dword [ebp - 0x1590]
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc2bf9e
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xc2bf8d
mov edx, dword [ebp - 0x1568]
mov edx, dword [esi + edx*4]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1568]
inc eax
mov dword [ebp - 0x1568], eax
cmp eax, 3
jb 0xc2bf5d
mov eax, dword [ebp - 0x17b0]
test eax, eax
je 0xc2bfdb
mov ecx, dword [ebp - 0x157c]
test ecx, ecx
je 0xc2bfdb
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xc2bfd3
test esi, esi
je 0xc2bfee
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x17b0]
test eax, eax
je 0xc2c00d
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x17b0], ebx
mov eax, dword [ebp - 0x1554]
test eax, eax
je 0xc2c026
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x1574], 0
jl 0xc2d533
mov eax, dword [edi]
mov esi, dword [0xc930b4]
mov ecx, esi
mov dword [ebp - 0x11d8], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x11d4], eax
mov eax, dword [edi + 8]
mov edi, ebx
push ebx
mov dword [ebp - 0x11d0], eax
lea eax, [ebp - 0x1ab0]
push eax
push ebx
push 0x42
mov dword [ebp - 0x1aac], ebx
mov dword [ebp - 0x1aa8], ebx
mov dword [ebp - 0x1574], edi
mov dword [ebp - 0x1ab0], 0xc
call dword [0xc99200]
call esi
test eax, eax
jne 0xc2ca04
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x1574], edi
test edi, edi
jle 0xc2c0b1
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x1574], edi
test edi, edi
mov eax, ebx
js 0xc2ca0f
mov edi, 0x80004005
mov dword [ebp - 0x1574], edi
jmp 0xc2ca0f
mov eax, dword [ebp - 0x17b4]
add eax, eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x1590], edi
test edi, edi
jne 0xc2c0fc
mov eax, 0x8007000e
mov dword [ebp - 0x1574], eax
jmp 0xc2c24a
mov eax, dword [ebp - 0x1610]
lea eax, [eax*4 + 4]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x156c], esi
test esi, esi
jne 0xc2c134
mov eax, 0x8007000e
mov dword [ebp - 0x1574], eax
jmp 0xc2c22b
mov ebx, dword [0xc93050]
lea eax, [ebp - 0x17b4]
push eax
push edi
lea eax, [ebp - 0x1610]
mov ecx, ebx
push eax
push 8
call dword [0xc99200]
call ebx
test eax, eax
jne 0xc2c18d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x1574], eax
test eax, eax
jle 0xc2c179
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1574], eax
test eax, eax
js 0xc2c186
mov eax, 0x80004005
mov dword [ebp - 0x1574], eax
xor ebx, ebx
jmp 0xc2c22b
xor ebx, ebx
mov eax, esi
mov dword [ebp - 0x1554], ebx
cmp dword [ebp - 0x1610], ebx
jbe 0xc2c20e
mov dword [ebp - 0x159c], edi
mov edi, esi
mov esi, dword [ebp - 0x159c]
mov ebx, dword [0xc93058]
mov ecx, ebx
push 0
push esi
call dword [0xc99200]
call ebx
mov ecx, esi
mov dword [edi], eax
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc2c1c9
mov eax, dword [ebp - 0x1554]
sub ecx, edx
sar ecx, 1
add edi, 4
lea esi, [esi + ecx*2]
add esi, 2
inc eax
mov dword [ebp - 0x1554], eax
cmp eax, dword [ebp - 0x1610]
jb 0xc2c1ad
mov esi, dword [ebp - 0x156c]
mov dword [ebp - 0x1554], edi
mov edi, dword [ebp - 0x1590]
mov eax, dword [ebp - 0x1554]
mov dword [eax], 0x409
mov eax, dword [ebp - 0x1610]
inc eax
mov dword [ebp - 0x1554], esi
mov dword [ebp - 0x1590], eax
mov esi, ebx
mov eax, ebx
test esi, esi
je 0xc2c244
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1574]
mov esi, dword [ebp - 0x1554]
test edi, edi
je 0xc2c263
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1574]
test eax, eax
js 0xc2bf45
cmp dword [ebp - 0x1590], 0
mov edi, ebx
mov dword [ebp - 0x156c], edi
mov ecx, ebx
jbe 0xc2c2a5
mov edx, dword [esi + ecx*4]
mov eax, ebx
cmp edx, dword [eax*4 + 0xa192e8]
je 0xc2c29d
inc eax
cmp eax, 0x26
jb 0xc2c283
inc ecx
cmp ecx, dword [ebp - 0x1590]
jb 0xc2c27e
jmp 0xc2c2a5
mov edi, eax
mov dword [ebp - 0x156c], eax
mov esi, dword [0xc93054]
lea eax, [ebp - 0xc8]
push ebx
push 0x55
push eax
push dword [edi*4 + 0xa192e8]
mov ecx, esi
mov dword [ebp - 0x1590], ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xc2c30a
mov esi, dword [0xc93048]
lea eax, [ebp - 0x818]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xc8]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
test eax, eax
jle 0xc2c30a
mov edi, dword [ebp - 0x80c]
xor eax, eax
shr edi, 0x1b
inc eax
and edi, eax
mov dword [ebp - 0x1590], edi
mov edx, 0x9fba10
mov esi, ebx
mov ecx, edx
mov dword [ebp + esi*4 - 0x648], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc2c31d
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0xc2c311
imul ecx, dword [ebp - 0x156c], 3
movzx eax, byte [ecx + 0xa00b58]
mov eax, dword [ebp + eax*4 - 0x648]
mov dword [ebp - 0x1570], eax
movzx eax, byte [ecx + 0xa00b59]
mov eax, dword [ebp + eax*4 - 0x648]
mov dword [ebp - 0x1560], eax
movzx eax, byte [ecx + 0xa00b5a]
mov eax, dword [ebp + eax*4 - 0x648]
mov dword [ebp - 0x1580], eax
push 0x1c90
push ebx
mov dword [ebp - 0x1574], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x159c], ecx
test ecx, ecx
jne 0xc2c3af
mov dword [ebp - 0x1574], 0x8007000e
jmp 0xc2bf45
or dword [ebp - 0x15a4], 0xffffffff
mov edi, 0xa19392
add ecx, 7
mov dword [ebp - 0x700], 0xab69605e
mov al, bl
mov dword [ebp - 0x6fc], 0x7f1137f
mov dword [ebp - 0x1584], ebx
mov esi, ebx
mov edx, ebx
mov dword [ebp - 0x15ac], ecx
mov dword [ebp - 0x15a8], edi
mov dword [ebp - 0x15b0], 0x392
movzx ebx, byte [edi - 2]
movzx ecx, byte [edi - 1]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edi]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, ecx
shl edi, 8
mov ecx, dword [ebp - 0x15a8]
xor edx, ebx
mov dword [ebp - 0x15c0], edx
movzx ecx, byte [ecx + 3]
or edi, ecx
mov ecx, dword [ebp - 0x15a8]
shl edi, 8
movzx ecx, byte [ecx + 4]
or edi, ecx
mov ecx, dword [ebp - 0x15a8]
shl edi, 8
add dword [ebp - 0x15a8], 8
movzx ecx, byte [ecx + 5]
or edi, ecx
xor esi, edi
mov dword [ebp - 0x15cc], esi
mov esi, edx
xor esi, dword [ebp - 0x15cc]
xor esi, 0xac987321
lea ecx, [esi + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, esi
rol ecx, 0xa
add edx, ecx
mov ecx, dword [ebp - 0x15c0]
xor ecx, edx
mov dword [ebp - 0x15c0], ecx
add ecx, 0x7f1137f
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0x15c0]
rol ecx, 2
sub edx, ecx
xor esi, edx
imul edx, esi, 0x605e
mov ecx, esi
shr ecx, 0xd
sub edx, ecx
mov ecx, dword [ebp - 0x15c0]
sub edx, 0x756c8a2
xor ecx, edx
mov dword [ebp - 0x15c0], ecx
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0x15c0]
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub ecx, edx
mov edx, dword [ebp - 0x15c0]
xor edx, ecx
mov dword [ebp - 0x15c0], edx
mov ecx, dword [ebp - 0x15c0]
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor esi, edx
lea ecx, [esi + 0x7f1137f]
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, esi
rol ecx, 2
add edx, ecx
mov ecx, dword [ebp - 0x15c0]
xor ecx, edx
mov dword [ebp - 0x15c0], ecx
add ecx, 0x54969fa2
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0x15c0]
rol ecx, 8
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69605e
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, esi
ror ecx, 0xa
xor edx, ecx
mov ecx, dword [ebp - 0x15c0]
xor ecx, edx
mov dword [ebp - 0x15c0], ecx
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0x15c0]
shr ecx, 0xa
xor edx, ecx
xor edx, esi
mov esi, dword [ebp - 0x15c0]
mov ecx, edx
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor esi, ecx
lea ecx, [esi - 0x7f1]
xor ecx, edx
xor ecx, 0xab69605e
mov dword [ebp - 0x15cc], ecx
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0x15cc]
shr ecx, 2
add edx, ecx
xor esi, edx
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, esi
rol ecx, 7
add edx, ecx
mov ecx, dword [ebp - 0x15cc]
xor ecx, edx
mov dword [ebp - 0x15cc], ecx
mov edx, ecx
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69
rol ecx, 5
imul edx, ecx, 0x7f1
mov ecx, esi
rol ecx, 7
add edx, ecx
xor dword [ebp - 0x15cc], edx
mov edx, dword [ebp - 0x15cc]
xor esi, edx
xor esi, 0xac987321
mov ecx, esi
ror ecx, 3
imul ecx, ecx, 0x137f
sub ecx, 0xd0dd417
xor edx, ecx
mov dword [ebp - 0x15cc], edx
lea ecx, [edx - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0x15cc]
ror ecx, 6
sub edx, ecx
xor esi, edx
lea ecx, [esi - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, esi
rol ecx, 0xe
add edx, ecx
mov ecx, dword [ebp - 0x15cc]
xor ecx, edx
mov dword [ebp - 0x15cc], ecx
add ecx, 0xab69605e
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0x15cc]
ror ecx, 0xe
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, esi
shr ecx, 3
xor edx, ecx
mov ecx, dword [ebp - 0x15cc]
xor ecx, edx
mov dword [ebp - 0x15cc], ecx
xor ecx, 0x7f1137f
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0x15cc]
rol ecx, 2
xor edx, ecx
mov ecx, dword [ebp - 0x15cc]
xor edx, dword [ebp - 0x1584]
xor ecx, dword [ebp - 0x15a4]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x15c0], esi
mov esi, dword [ebp - 0x15ac]
mov dword [ebp - 0x15a4], edi
mov edi, dword [ebp - 0x15a8]
mov dword [ebp - 0x1584], ebx
mov byte [esi - 4], dl
mov byte [esi], cl
ror edx, 8
mov byte [esi - 5], dl
ror ecx, 8
mov byte [esi - 1], cl
ror edx, 8
mov byte [esi - 6], dl
ror ecx, 8
mov byte [esi - 2], cl
ror edx, 8
ror ecx, 8
mov byte [esi - 7], dl
mov byte [esi - 3], cl
add esi, 8
ror ecx, 8
ror edx, 8
sub dword [ebp - 0x15b0], 1
mov dword [ebp - 0x15ac], esi
mov esi, ecx
mov dword [ebp - 0x15cc], ecx
jne 0xc2c3f4
mov ecx, dword [ebp - 0x159c]
xor ebx, ebx
mov edx, ebx
mov esi, 0x1c90
xor al, byte [ecx + edx]
inc edx
cmp edx, esi
jb 0xc2c78b
movzx eax, al
cdq
cmp eax, dword [0xa1b020]
jne 0xc2c7b7
cmp edx, dword [0xa1b024]
jne 0xc2c7b7
mov dword [ebp - 0x17b0], ecx
mov ecx, ebx
mov dword [ebp - 0x157c], esi
jmp 0xc2c7c1
mov dword [ebp - 0x1574], 0xc004d501
test ecx, ecx
je 0xc2c7d4
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x1574], ebx
jl 0xc2bf45
mov edi, dword [ebp - 0x17b0]
mov esi, ebx
mov edx, ebx
cmp dword [ebp - 0x156c], edx
jne 0xc2c7f9
mov dword [ebp + esi*4 - 0x5b8], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0x1568], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc2c804
sub ecx, dword [ebp - 0x1568]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0xc2c7ea
inc esi
cmp esi, 6
jb 0xc2c7e8
push 0xc
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xc2c845
mov dword [ebp - 0x1574], 0x8007000e
jmp 0xc2bf4b
xor eax, eax
mov edi, esi
mov ecx, ebx
mov edx, esi
mov dword [ebp - 0x1568], ecx
mov dword [ebp - 0x156c], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, esi
sub eax, esi
mov dword [ebp - 0x159c], eax
movzx edi, word [ebp + ecx*2 - 0xc]
mov eax, ebx
cmp di, word [eax*2 + 0xa19380]
je 0xc2c882
inc eax
cmp eax, 6
jb 0xc2c86d
jmp 0xc2c960
mov edi, dword [ebp + eax*4 - 0x5b8]
mov ecx, edi
mov edx, dword [0xc93060]
mov dword [ebp - 0x1584], edx
lea eax, [ecx + 1]
mov dword [ebp - 0x15a4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc2c8a0
sub ecx, dword [ebp - 0x15a4]
push ebx
push ebx
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
push ebx
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0x1584]
mov dword [ebp - 0x1584], eax
test eax, eax
je 0xc2c9c9
lea ecx, [eax + eax]
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0x156c]
mov edx, dword [ebp - 0x159c]
mov dword [edx + ecx], eax
mov eax, dword [ecx]
mov dword [ebp - 0x15a4], eax
test eax, eax
je 0xc2c836
mov edx, dword [0xc93060]
mov ecx, edi
mov dword [ebp - 0x15ac], edx
lea eax, [ecx + 1]
mov dword [ebp - 0x15a8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc2c91e
push dword [ebp - 0x1584]
sub ecx, dword [ebp - 0x15a8]
push dword [ebp - 0x15a4]
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
push ebx
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0x15ac]
test eax, eax
je 0xc2c994
mov ecx, dword [ebp - 0x1568]
mov edx, dword [ebp - 0x156c]
inc ecx
add edx, 4
mov dword [ebp - 0x1568], ecx
mov dword [ebp - 0x156c], edx
cmp ecx, 3
jb 0xc2c866
mov eax, dword [ebp - 0x1590]
mov edi, esi
mov dword [ebp - 0x1594], edi
mov esi, ebx
mov dword [ebp - 0x11e0], eax
jmp 0xc2bf51
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x1574], eax
test eax, eax
jle 0xc2c9b4
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1574], eax
test eax, eax
js 0xc2bf4b
mov dword [ebp - 0x1574], 0x80004005
jmp 0xc2bf4b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x1574], eax
test eax, eax
jle 0xc2c9e9
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1574], eax
test eax, eax
mov edi, dword [ebp - 0x1594]
js 0xc2bf51
mov dword [ebp - 0x1574], 0x80004005
jmp 0xc2bf51
mov eax, dword [ebp - 0x1aac]
xor ecx, ecx
inc ecx
and eax, ecx
mov dword [ebp - 0x11dc], eax
test edi, edi
js 0xc2d533
mov eax, dword [ebp - 0x15a0]
push 0x2a
pop ecx
mov dword [ebp - 0x1554], ecx
sub eax, 1
je 0xc2ca5a
sub eax, 1
je 0xc2ca4e
sub eax, 1
jne 0xc2ca6a
mov edi, 0xe1
mov dword [ebp - 0x1578], edi
mov dword [ebp - 0x155c], edi
jmp 0xc2ca6a
mov dword [ebp - 0x1578], 0xf
jmp 0xc2ca60
mov dword [ebp - 0x1578], ecx
mov dword [ebp - 0x155c], 0xb
mov esi, 0xdc
mov dword [ebp - 0x157c], 0x60
push esi
lea eax, [ebp - 0xd90]
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov word [ebp - 0xd4c], si
mov esi, dword [0xc93070]
lea eax, [ebp - 0xd90]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xc2caef
mov eax, dword [ebp - 0xce4]
movzx edi, word [ebp - 0xcea]
mov ecx, dword [ebp - 0xce0]
push 0x60
mov dword [ebp - 0x1568], eax
mov dword [ebp - 0x1b88], eax
pop eax
mov dword [ebp - 0x157c], edi
mov dword [ebp - 0x1590], ecx
mov dword [ebp - 0x1b84], ecx
cmp edi, eax
jae 0xc2cb07
mov dword [ebp - 0x157c], eax
jmp 0xc2cb07
mov eax, dword [ebp - 0x1b84]
mov dword [ebp - 0x1590], eax
mov eax, dword [ebp - 0x1b88]
mov dword [ebp - 0x1568], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x15a0], eax
mov eax, dword [ebp - 0x1570]
je 0xc2cb1e
mov eax, dword [ebp - 0x1580]
push 0x5c
mov dword [ebp - 0x156c], eax
lea eax, [ebp - 0xbf0]
push ebx
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0x1574], edi
push 0x403
push ebx
push ebx
call dword [0xc99200]
call esi
mov dword [ebp - 0x159c], eax
test eax, eax
jne 0xc2cb97
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x1574], edi
test edi, edi
jle 0xc2cb82
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x1574], edi
test edi, edi
js 0xc2cc4c
mov dword [ebp - 0x1574], 0x80004005
jmp 0xc2d533
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0x157c]
push dword [ebp - 0x1578]
call dword [0xc99200]
call esi
push dword [ebp - 0x156c]
neg eax
mov dword [ebp - 0xbe0], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0xbd4]
mov dword [ebp - 0xbf0], eax
mov byte [ebp - 0xbd6], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0xbf0]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc2cc2f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x1574], edi
test edi, edi
jle 0xc2cc20
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x1574], edi
test edi, edi
js 0xc2cc35
mov edi, 0x80004005
mov dword [ebp - 0x1574], edi
jmp 0xc2cc35
mov dword [ebp - 0x11cc], eax
push dword [ebp - 0x159c]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
test edi, edi
js 0xc2d533
xor eax, eax
inc eax
cmp dword [ebp - 0x15a0], eax
je 0xc2cc6b
mov eax, dword [ebp - 0x1580]
mov dword [ebp - 0x1570], eax
push 0x5c
lea eax, [ebp - 0xad0]
push ebx
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0x1574], edi
push 0x403
push ebx
push ebx
call dword [0xc99200]
call esi
mov dword [ebp - 0x1578], eax
test eax, eax
jne 0xc2ccd4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x1574], edi
test edi, edi
jle 0xc2ccc9
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x1574], edi
test edi, edi
js 0xc2cd89
jmp 0xc2cb88
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0x157c]
push dword [ebp - 0x155c]
call dword [0xc99200]
call esi
push dword [ebp - 0x1570]
neg eax
mov dword [ebp - 0xac0], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0xab4]
mov dword [ebp - 0xad0], eax
mov byte [ebp - 0xab6], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0xad0]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc2cd6c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x1574], edi
test edi, edi
jle 0xc2cd5d
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x1574], edi
test edi, edi
js 0xc2cd72
mov edi, 0x80004005
mov dword [ebp - 0x1574], edi
jmp 0xc2cd72
mov dword [ebp - 0x11c8], eax
push dword [ebp - 0x1578]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
test edi, edi
js 0xc2d533
mov esi, dword [ebp - 0x15a0]
mov ecx, ebx
mov eax, esi
mov edx, ebx
sub eax, 1
je 0xc2cdac
sub eax, 1
je 0xc2cde2
sub eax, 1
jne 0xc2cdb8
mov ecx, dword [ebp - 0x1568]
mov edx, dword [ebp - 0x1590]
mov dword [ebp - 0x770], ecx
mov dword [ebp - 0x76c], edx
xor edx, edx
inc edx
cmp esi, edx
je 0xc2ce1c
lea eax, [esi - 2]
cmp eax, edx
ja 0xc2cdf6
mov edx, ebx
mov dword [ebp - 0x1554], ebx
mov dword [ebp - 0x1570], ebx
jmp 0xc2ce2a
mov eax, dword [ebp - 0x1568]
cdq
and edx, 3
lea ecx, [edx + eax]
mov edx, ebx
sar ecx, 2
jmp 0xc2cdb8
mov eax, dword [ebp - 0x1610]
mov edx, dword [ebp - 0x1610]
mov dword [ebp - 0x1570], eax
mov eax, dword [ebp - 0x1610]
mov dword [ebp - 0x1554], eax
mov eax, dword [ebp - 0x1610]
jmp 0xc2ce2c
push 0x20
pop esi
mov edx, 0x96
mov dword [ebp - 0x1570], esi
mov eax, ebx
mov dword [ebp - 0x1578], edx
mov dword [ebp - 0x155c], eax
push dword [ebp - 0x11cc]
mov esi, dword [0xc9303c]
sub ecx, edx
push dword [ebp - 0x1564]
mov edi, dword [ebp - 0x11d8]
sub ecx, eax
mov dword [ebp - 0x1580], ecx
mov dword [ebp - 0x11a4], ecx
mov dword [ebp - 0x11b4], ecx
mov ecx, esi
mov dword [ebp - 0x1574], ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0x1568], eax
lea eax, [ebp - 0x11bc]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0x1564]
call dword [0xc99200]
call esi
test eax, eax
jne 0xc2ceb3
mov edi, 0x80004005
mov dword [ebp - 0x1574], edi
jmp 0xc2ceb5
mov edi, ebx
mov eax, dword [ebp - 0x1568]
test eax, eax
je 0xc2ced6
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push dword [ebp - 0x1564]
call dword [0xc99200]
call esi
test edi, edi
js 0xc2d533
push dword [ebp - 0x11c8]
mov esi, dword [0xc9303c]
mov ecx, esi
push dword [ebp - 0x1564]
mov edi, dword [ebp - 0x11d4]
mov dword [ebp - 0x1574], ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0x1568], eax
lea eax, [ebp - 0x11ac]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0x1564]
call dword [0xc99200]
call esi
test eax, eax
jne 0xc2cf43
mov edi, 0x80004005
mov dword [ebp - 0x1574], edi
jmp 0xc2cf45
mov edi, ebx
mov eax, dword [ebp - 0x1568]
test eax, eax
je 0xc2cf66
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push dword [ebp - 0x1564]
call dword [0xc99200]
call esi
test edi, edi
js 0xc2d533
mov eax, dword [ebp - 0x15a0]
cmp eax, 2
je 0xc2cf7e
cmp eax, 3
jne 0xc2cfa0
mov edi, dword [ebp - 0x11a4]
mov dword [ebp - 0x1580], edi
cmp dword [ebp - 0x11b4], edi
jle 0xc2cfa6
mov edi, dword [ebp - 0x11b4]
mov dword [ebp - 0x1580], edi
jmp 0xc2cfa6
mov edi, dword [ebp - 0x1580]
cmp dword [ebp - 0x11e0], 0
mov esi, dword [0xc930a8]
mov ecx, esi
push dword [ebp - 0x1554]
je 0xc2cff9
mov eax, dword [ebp - 0x155c]
sub eax, dword [ebp - 0x11b4]
add eax, edi
push eax
lea eax, [ebp - 0x11bc]
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x11b0]
add eax, dword [ebp - 0x1570]
push eax
mov eax, dword [ebp - 0x155c]
sub eax, dword [ebp - 0x11a4]
add eax, edi
push eax
jmp 0xc2d021
push dword [ebp - 0x1578]
lea eax, [ebp - 0x11bc]
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x11b0]
add eax, dword [ebp - 0x1570]
push eax
push dword [ebp - 0x1578]
mov esi, dword [0xc930a8]
lea eax, [ebp - 0x11ac]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x15a0]
cmp eax, 2
je 0xc2d32e
cmp eax, 3
je 0xc2d32e
xor edx, edx
inc edx
cmp eax, edx
jne 0xc2d34d
push 0x5c
lea eax, [ebp - 0xb90]
mov dword [ebp - 0x11c0], 0xffffff
push ebx
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0x1574], edi
push 0x403
push ebx
push ebx
call dword [0xc99200]
call esi
mov dword [ebp - 0x1578], eax
test eax, eax
jne 0xc2d0ce
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x1574], edi
test edi, edi
jle 0xc2d0c3
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x1574], edi
test edi, edi
js 0xc2d17f
jmp 0xc2cb88
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0x157c]
push 0xb
call dword [0xc99200]
call esi
push dword [ebp - 0x1560]
neg eax
mov dword [ebp - 0xb80], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0xb74]
mov dword [ebp - 0xb90], eax
mov byte [ebp - 0xb76], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0xb90]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc2d162
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x1574], edi
test edi, edi
jle 0xc2d153
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x1574], edi
test edi, edi
js 0xc2d168
mov edi, 0x80004005
mov dword [ebp - 0x1574], edi
jmp 0xc2d168
mov dword [ebp - 0x11c4], eax
push dword [ebp - 0x1578]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
test edi, edi
js 0xc2d533
push dword [ebp - 0x11c4]
mov eax, dword [ebp - 0x1580]
mov esi, dword [0xc9303c]
mov ecx, esi
push dword [ebp - 0x1564]
mov edi, dword [ebp - 0x11d0]
mov dword [ebp - 0x1194], eax
mov dword [ebp - 0x1574], ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
push ebx
push 0x460
mov dword [ebp - 0x1578], eax
lea eax, [ebp - 0x119c]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0x1564]
call dword [0xc99200]
call esi
test eax, eax
jne 0xc2d1f8
mov edi, 0x80004005
mov dword [ebp - 0x1574], edi
jmp 0xc2d1fa
mov edi, ebx
mov eax, dword [ebp - 0x1578]
test eax, eax
je 0xc2d21b
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push dword [ebp - 0x1564]
call dword [0xc99200]
call esi
test edi, edi
js 0xc2d533
mov eax, dword [ebp - 0x1194]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x1194], eax
cmp eax, ecx
jge 0xc2d23f
mov dword [ebp - 0x1194], ecx
mov edi, dword [ebp - 0x157c]
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x119c]
mov dword [ebp - 0x1190], 0x20
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x1198]
mov dword [ebp - 0x119c], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x1194]
mov dword [ebp - 0x1198], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x1190]
mov dword [ebp - 0x1194], eax
call dword [0xc99200]
call esi
mov ecx, dword [ebp - 0x11a0]
mov esi, dword [0xc930a8]
add ecx, 0x24
cmp dword [ebp - 0x11e0], 0
mov dword [ebp - 0x1190], eax
je 0xc2d30c
mov eax, dword [ebp - 0x11bc]
cmp eax, dword [ebp - 0x11ac]
jl 0xc2d2f7
mov eax, dword [ebp - 0x11ac]
push ecx
push eax
lea eax, [ebp - 0x119c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
jmp 0xc2d34a
mov eax, dword [ebp - 0x11b4]
cmp eax, dword [ebp - 0x11a4]
jg 0xc2d320
mov eax, dword [ebp - 0x11a4]
sub eax, dword [ebp - 0x1194]
add eax, dword [ebp - 0x119c]
jmp 0xc2d2f7
mov eax, dword [ebp - 0x11a0]
mov dword [ebp - 0x770], edi
mov dword [ebp - 0x76c], eax
mov dword [ebp - 0x11c0], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x11e0]
mov dword [ebp - 0x1578], eax
mov eax, dword [ebp - 0x76c]
mov dword [ebp - 0x155c], eax
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x1570], eax
mov eax, dword [ebp - 0x15a0]
sub eax, 1
je 0xc2d521
sub eax, 1
je 0xc2d448
sub eax, 1
jne 0xc2d52d
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x890]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x890]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x890], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xc2d52d
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x87c]
push eax
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x874]
push eax
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x874]
lea esi, [ebp - 0x87c]
sub eax, dword [ebp - 0x1570]
lea edi, [ebp - 0x1b60]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x778], eax
mov eax, dword [ebp - 0x870]
sub eax, dword [ebp - 0x155c]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
jmp 0xc2d516
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x8b8]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x8b8]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x8b8], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xc2d52d
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x8a4]
push eax
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x89c]
push eax
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1578], 0
lea esi, [ebp - 0x8a4]
lea edi, [ebp - 0x1b60]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xc2d4ef
imul eax, dword [ebp - 0x89c], 5
cdq
idiv ecx
add eax, dword [ebp - 0x8a4]
jmp 0xc2d501
mov eax, dword [ebp - 0x89c]
sub eax, dword [ebp - 0x1570]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x778], eax
mov eax, dword [ebp - 0x898]
sub eax, dword [ebp - 0x155c]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x774], eax
jmp 0xc2d52d
mov dword [ebp - 0x778], ebx
mov dword [ebp - 0x774], ebx
mov dword [ebp - 0x1574], ebx
push dword [ebp - 0x1564]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
xor esi, esi
mov edi, 0xc96238
inc esi
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc2d552
mov eax, dword [0xc95890]
test eax, eax
jle 0xc2d5b3
sub eax, 1
mov dword [0xc95890], eax
jne 0xc2d5b3
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc2d584
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc2d573
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0xc96238
inc esi
xor eax, eax
xchg dword [edi], eax
mov eax, dword [ebp - 0x1594]
test eax, eax
je 0xc2d5d0
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x1574], 0
jl 0xc2f1c9
mov eax, dword [ebp - 0x774]
mov edi, dword [ebp - 0x778]
push 0x54
mov dword [ebp - 0x1578], eax
mov dword [ebp - 0x1a5c], eax
lea eax, [ebp - 0x1188]
push ebx
push eax
mov dword [ebp - 0x1a60], edi
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x155c], esi
mov esi, dword [0xc93028]
mov ecx, esi
push 7
push dword [ebp - 0x15b4]
call dword [0xc99200]
call esi
test eax, eax
je 0xc2d674
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x1188]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc2d674
push 0x20
pop eax
cmp word [ebp - 0x1176], ax
jne 0xc2d674
cmp dword [ebp - 0x1174], 0
je 0xc2d674
cmp dword [ebp - 0x1184], 0
jle 0xc2d674
cmp dword [ebp - 0x1180], 0
jg 0xc2d685
xor esi, esi
mov dword [ebp - 0x155c], ebx
inc esi
cmp dword [ebp - 0x15a0], esi
jne 0xc2d6fb
push dword [ebp - 0x1578]
mov esi, dword [0xc930a8]
lea eax, [ebp - 0x11bc]
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
push dword [ebp - 0x1578]
mov esi, dword [0xc930a8]
lea eax, [ebp - 0x11ac]
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov edi, dword [ebp - 0x15a0]
xor esi, esi
inc esi
cmp edi, esi
jne 0xc2d701
mov eax, dword [ebp - 0x11dc]
mov esi, dword [0xc93014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0x1558], eax
jmp 0xc2d701
mov edi, dword [ebp - 0x15a0]
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0x15b4]
call dword [0xc99200]
call esi
cmp dword [ebp - 0x11e0], 0
mov dword [ebp - 0x1578], eax
mov dword [ebp - 0x1594], 0x810
je 0xc2d73e
mov dword [ebp - 0x1594], 0x20812
cmp dword [ebp - 0x155c], 0
je 0xc2e279
mov eax, dword [ebp - 0x11dc]
mov esi, dword [ebp - 0x11d8]
mov dword [ebp - 0x155c], eax
mov eax, dword [ebp - 0x11cc]
push 0x54
mov dword [ebp - 0x1570], eax
lea eax, [ebp - 0x1130]
push ebx
push eax
mov dword [ebp - 0x1560], esi
call fcn.00ab4bf6
add esp, 0xc
lea eax, [ebp - 0x10d8]
push 0x54
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x1554], ebx
lea eax, [ebp - 0xa18]
mov dword [ebp - 0x1580], ebx
mov dword [ebp - 0x1564], ebx
mov dword [ebp - 0x1574], ebx
push 0x2c
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x768]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0xc2f1a9
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [ebp - 0x15b4]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xc2e30b
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x1130]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc2d834
mov eax, dword [ebp - 0x111c]
mov dword [ebp - 0x1554], eax
mov eax, dword [ebp - 0x112c]
mov dword [ebp - 0x1564], eax
mov eax, dword [ebp - 0x1128]
mov dword [ebp - 0x1574], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0x157c], edi
test edi, edi
je 0xc2e30b
mov eax, dword [ebp - 0x11b4]
sub eax, dword [ebp - 0x11bc]
mov esi, dword [0xc9300c]
mov ecx, esi
mov dword [ebp - 0xa14], eax
mov eax, dword [ebp - 0x11b8]
sub eax, dword [ebp - 0x11b0]
mov dword [ebp - 0xa10], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x17bc], ebx
mov word [ebp - 0xa0c], ax
pop eax
push ebx
push ebx
mov word [ebp - 0xa0a], ax
lea eax, [ebp - 0x17bc]
push eax
push ebx
lea eax, [ebp - 0xa18]
mov dword [ebp - 0x1568], ebx
push eax
push edi
mov dword [ebp - 0xa08], ebx
mov dword [ebp - 0xa04], ebx
mov dword [ebp - 0xa00], ebx
mov dword [ebp - 0x9fc], ebx
mov dword [ebp - 0x9f8], ebx
mov dword [ebp - 0x9f4], ebx
mov dword [ebp - 0x9f0], ebx
mov dword [ebp - 0xa18], 0x28
call dword [0xc99200]
call esi
mov dword [ebp - 0x1590], eax
test eax, eax
jne 0xc2d92e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x1568], eax
test eax, eax
jle 0xc2d919
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1568], eax
test eax, eax
js 0xc2dcc4
mov dword [ebp - 0x1568], 0x80004005
jmp 0xc2dcc4
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x10d8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc2d958
mov eax, dword [ebp - 0x10c4]
mov dword [ebp - 0x1580], eax
mov eax, dword [ebp - 0x11b4]
sub eax, dword [ebp - 0x11bc]
push dword [ebp - 0x1590]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x760], eax
mov eax, dword [ebp - 0x11b0]
sub eax, dword [ebp - 0x11b8]
push edi
mov dword [ebp - 0x75c], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0x1570]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
push ebx
mov dword [ebp - 0x1570], eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x768]
mov ecx, edi
push eax
push dword [ebp - 0x157c]
call dword [0xc99200]
call edi
mov edi, dword [ebp - 0x157c]
lea eax, [ebp - 0x768]
mov esi, dword [0xc9306c]
mov ecx, esi
push ebx
push dword [ebp - 0x1594]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x1560]
push edi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0x15a0], eax
jne 0xc2da5b
cmp dword [ebp - 0x155c], 0
je 0xc2da4f
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0x155c], eax
jmp 0xc2da65
mov dword [ebp - 0x155c], 0xffffff
jmp 0xc2da65
mov dword [ebp - 0x155c], 0xffa8a8a8
mov esi, dword [ebp - 0x11bc]
mov ecx, ebx
mov edx, dword [ebp - 0x11b8]
mov eax, ebx
mov dword [ebp - 0x1560], esi
mov dword [ebp - 0x156c], ebx
test esi, esi
jns 0xc2da95
mov ecx, esi
mov dword [ebp - 0x1560], ebx
neg ecx
mov dword [ebp - 0x156c], ecx
test edx, edx
jns 0xc2da9f
mov eax, edx
mov edx, ebx
neg eax
mov esi, dword [ebp - 0x760]
sub esi, ecx
mov ecx, dword [ebp - 0x1564]
sub ecx, dword [ebp - 0x1560]
mov dword [ebp - 0x159c], esi
cmp esi, ecx
jl 0xc2dac5
mov esi, ecx
mov dword [ebp - 0x159c], ecx
mov ecx, dword [ebp - 0x75c]
sub dword [ebp - 0x1574], edx
sub ecx, eax
mov dword [ebp - 0x1584], ecx
cmp ecx, dword [ebp - 0x1574]
jl 0xc2daed
mov ecx, dword [ebp - 0x1574]
mov dword [ebp - 0x1584], ecx
test esi, esi
jle 0xc2dc92
test ecx, ecx
jle 0xc2dc92
imul eax, dword [ebp - 0x760]
mov ecx, dword [ebp - 0x1580]
add eax, dword [ebp - 0x156c]
lea ecx, [ecx + eax*4]
mov eax, dword [ebp - 0x1564]
imul eax, edx
mov edx, dword [ebp - 0x1554]
mov dword [ebp - 0x1580], ecx
add eax, dword [ebp - 0x1560]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0x760]
shl edx, 2
mov dword [ebp - 0x1554], edx
mov edx, dword [ebp - 0x1564]
shl edx, 2
mov dword [ebp - 0x1560], eax
mov dword [ebp - 0x1564], edx
mov ebx, eax
mov dword [ebp - 0x15a4], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0x1574], edx
lea edi, [ecx + 2]
mov dword [ebp - 0x156c], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc2dc37
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x155c]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x156c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x1574]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x155c]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x1574]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x155a]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x1574]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x15a4]
cdq
idiv ecx
mov edx, dword [ebp - 0x1574]
add al, bl
mov ebx, dword [ebp - 0x156c]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x1574], edx
mov dword [ebp - 0x15a4], esi
jne 0xc2db71
mov ecx, dword [ebp - 0x1580]
mov eax, dword [ebp - 0x1560]
add ecx, dword [ebp - 0x1554]
add eax, dword [ebp - 0x1564]
sub dword [ebp - 0x1584], 1
mov esi, dword [ebp - 0x159c]
mov dword [ebp - 0x1580], ecx
mov dword [ebp - 0x1560], eax
jne 0xc2db55
mov edi, dword [ebp - 0x157c]
xor ebx, ebx
push dword [ebp - 0x1590]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1570]
test eax, eax
je 0xc2dcc4
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1568], 0
jl 0xc2f1a9
mov eax, dword [ebp - 0x11dc]
mov esi, dword [ebp - 0x11d4]
mov dword [ebp - 0x155c], eax
mov eax, dword [ebp - 0x11c8]
push 0x54
mov dword [ebp - 0x1570], eax
lea eax, [ebp - 0x1080]
push ebx
push eax
mov dword [ebp - 0x1560], esi
call fcn.00ab4bf6
add esp, 0xc
lea eax, [ebp - 0x1028]
push 0x54
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x1554], ebx
lea eax, [ebp - 0xa70]
mov dword [ebp - 0x1580], ebx
mov dword [ebp - 0x1564], ebx
mov dword [ebp - 0x1574], ebx
push 0x2c
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x788]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0xc2f1a9
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [ebp - 0x15b4]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xc2e30b
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x1080]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc2ddcb
mov eax, dword [ebp - 0x106c]
mov dword [ebp - 0x1554], eax
mov eax, dword [ebp - 0x107c]
mov dword [ebp - 0x1564], eax
mov eax, dword [ebp - 0x1078]
mov dword [ebp - 0x1574], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0x157c], edi
test edi, edi
je 0xc2e30b
mov eax, dword [ebp - 0x11a4]
sub eax, dword [ebp - 0x11ac]
mov esi, dword [0xc9300c]
mov ecx, esi
mov dword [ebp - 0xa6c], eax
mov eax, dword [ebp - 0x11a8]
sub eax, dword [ebp - 0x11a0]
mov dword [ebp - 0xa68], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x17c0], ebx
mov word [ebp - 0xa64], ax
pop eax
push ebx
push ebx
mov word [ebp - 0xa62], ax
lea eax, [ebp - 0x17c0]
push eax
push ebx
lea eax, [ebp - 0xa70]
mov dword [ebp - 0x1568], ebx
push eax
push edi
mov dword [ebp - 0xa60], ebx
mov dword [ebp - 0xa5c], ebx
mov dword [ebp - 0xa58], ebx
mov dword [ebp - 0xa54], ebx
mov dword [ebp - 0xa50], ebx
mov dword [ebp - 0xa4c], ebx
mov dword [ebp - 0xa48], ebx
mov dword [ebp - 0xa70], 0x28
call dword [0xc99200]
call esi
mov dword [ebp - 0x1590], eax
test eax, eax
jne 0xc2dec5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x1568], eax
test eax, eax
jle 0xc2deb0
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1568], eax
test eax, eax
js 0xc2e256
mov dword [ebp - 0x1568], 0x80004005
jmp 0xc2e256
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x1028]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc2deef
mov eax, dword [ebp - 0x1014]
mov dword [ebp - 0x1580], eax
mov eax, dword [ebp - 0x11a4]
sub eax, dword [ebp - 0x11ac]
push dword [ebp - 0x1590]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x780], eax
mov eax, dword [ebp - 0x11a0]
sub eax, dword [ebp - 0x11a8]
push edi
mov dword [ebp - 0x77c], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0x1570]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
push ebx
mov dword [ebp - 0x1570], eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x788]
mov ecx, edi
push eax
push dword [ebp - 0x157c]
call dword [0xc99200]
call edi
mov edi, dword [ebp - 0x157c]
lea eax, [ebp - 0x788]
mov esi, dword [0xc9306c]
mov ecx, esi
push ebx
push dword [ebp - 0x1594]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x1560]
push edi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0x15a0], eax
jne 0xc2dfec
cmp dword [ebp - 0x155c], 0
je 0xc2dfe0
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
jmp 0xc2dff1
mov dword [ebp - 0x15a0], 0xffffff
jmp 0xc2dffd
mov eax, 0xffa8a8a8
mov dword [ebp - 0x15a0], eax
mov dword [ebp - 0x158c], eax
mov esi, dword [ebp - 0x11ac]
mov edx, ebx
mov eax, dword [ebp - 0x11a8]
mov ecx, ebx
mov dword [ebp - 0x155c], esi
mov dword [ebp - 0x1594], ebx
test esi, esi
jns 0xc2e02d
mov edx, esi
mov dword [ebp - 0x155c], ebx
neg edx
mov dword [ebp - 0x1594], edx
test eax, eax
jns 0xc2e037
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x780]
sub esi, edx
mov edx, dword [ebp - 0x1564]
sub edx, dword [ebp - 0x155c]
mov dword [ebp - 0x1560], esi
cmp esi, edx
jl 0xc2e05d
mov esi, edx
mov dword [ebp - 0x1560], edx
mov edx, dword [ebp - 0x77c]
sub dword [ebp - 0x1574], eax
sub edx, ecx
mov dword [ebp - 0x156c], edx
cmp edx, dword [ebp - 0x1574]
jl 0xc2e085
mov edx, dword [ebp - 0x1574]
mov dword [ebp - 0x156c], edx
test esi, esi
jle 0xc2e224
test edx, edx
jle 0xc2e224
mov edx, dword [ebp - 0x780]
mov edi, dword [ebp - 0x1580]
imul eax, dword [ebp - 0x1564]
imul ecx, edx
shl edx, 2
add eax, dword [ebp - 0x155c]
add ecx, dword [ebp - 0x1594]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0x1554]
mov dword [ebp - 0x1554], edx
mov edx, dword [ebp - 0x1564]
shl edx, 2
lea eax, [edi + eax*4]
mov dword [ebp - 0x1594], ecx
mov dword [ebp - 0x155c], eax
mov dword [ebp - 0x1580], edx
mov ebx, eax
mov dword [ebp - 0x159c], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0x1564], edx
lea edi, [ecx + 2]
mov dword [ebp - 0x1574], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc2e1c9
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x158c]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x1574]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x1564]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x158c]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x1564]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x159e]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x1564]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x159c]
cdq
idiv ecx
mov edx, dword [ebp - 0x1564]
add al, bl
mov ebx, dword [ebp - 0x1574]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x1564], edx
mov dword [ebp - 0x159c], esi
jne 0xc2e103
mov ecx, dword [ebp - 0x1594]
mov eax, dword [ebp - 0x155c]
add ecx, dword [ebp - 0x1554]
add eax, dword [ebp - 0x1580]
sub dword [ebp - 0x156c], 1
mov esi, dword [ebp - 0x1560]
mov dword [ebp - 0x1594], ecx
mov dword [ebp - 0x155c], eax
jne 0xc2e0e7
mov edi, dword [ebp - 0x157c]
xor ebx, ebx
push dword [ebp - 0x1590]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1570]
test eax, eax
je 0xc2e256
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1568], 0
jl 0xc2f1a9
jmp 0xc2f157
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x11dc], 0
jne 0xc2e28d
cmp edi, ecx
je 0xc2e28d
mov al, 0xc0
jmp 0xc2e28f
or al, 0xff
mov esi, dword [0xc93008]
push dword [ebp - 0x15b4]
mov byte [ebp - 0x155a], al
mov eax, ebx
mov byte [ebp - 0x1559], cl
mov ecx, esi
mov byte [ebp - 0x155c], bl
mov byte [ebp - 0x155b], bl
mov dword [ebp - 0x1570], eax
mov dword [ebp - 0x1b70], eax
mov dword [ebp - 0x1560], ebx
mov dword [ebp - 0x1b6c], eax
mov dword [ebp - 0x1b68], ebx
mov dword [ebp - 0x1b64], ebx
mov dword [ebp - 0x1554], ebx
mov dword [ebp - 0x1b80], eax
mov dword [ebp - 0x1b7c], ebx
mov dword [ebp - 0x1b78], ebx
mov dword [ebp - 0x1b74], ebx
call dword [0xc99200]
call esi
mov dword [ebp - 0x1598], eax
test eax, eax
jne 0xc2e316
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc2f1a9
xor eax, eax
inc eax
cmp edi, eax
jne 0xc2e41f
mov eax, dword [ebp - 0x11b4]
mov edx, dword [ebp - 0x11a4]
sub edx, dword [ebp - 0x11ac]
sub eax, dword [ebp - 0x11bc]
mov dword [ebp - 0x1580], edx
cmp edx, eax
jg 0xc2e34b
mov edx, eax
mov dword [ebp - 0x1580], eax
mov eax, dword [ebp - 0x11a0]
mov edi, ebx
sub eax, dword [ebp - 0x11b8]
mov ecx, ebx
cmp dword [ebp - 0x11e0], 0
mov dword [ebp - 0x1564], eax
je 0xc2e3a2
mov ecx, dword [ebp - 0x11bc]
sub ecx, dword [ebp - 0x11b4]
mov eax, dword [ebp - 0x11ac]
add ecx, edx
sub eax, dword [ebp - 0x11a4]
mov edi, ecx
add eax, edx
mov dword [ebp - 0x1570], ecx
mov dword [ebp - 0x1b70], ecx
mov ecx, eax
mov dword [ebp - 0x1554], eax
mov dword [ebp - 0x1b80], eax
sub edi, dword [ebp - 0x11bc]
add edi, dword [ebp - 0x11b4]
sub ecx, dword [ebp - 0x11ac]
mov eax, dword [ebp - 0x11b0]
sub eax, dword [ebp - 0x11b8]
add ecx, dword [ebp - 0x11a4]
mov dword [ebp - 0x1574], edi
mov dword [ebp - 0x1b68], edi
mov edi, dword [ebp - 0x11a8]
sub edi, dword [ebp - 0x11b8]
mov dword [ebp - 0x1590], edi
mov dword [ebp - 0x1b7c], edi
sub edi, dword [ebp - 0x11a8]
add edi, dword [ebp - 0x11a0]
mov dword [ebp - 0x157c], eax
mov dword [ebp - 0x1b64], eax
mov dword [ebp - 0x1568], ecx
mov dword [ebp - 0x1b78], ecx
mov dword [ebp - 0x156c], edi
mov dword [ebp - 0x1b74], edi
jmp 0xc2e4b7
mov eax, dword [ebp - 0x76c]
lea esi, [ebp - 0x11bc]
lea edi, [ebp - 0x1b70]
mov edx, dword [ebp - 0x770]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1564], eax
mov dword [ebp - 0x1580], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1b64]
lea esi, [ebp - 0x11ac]
lea edi, [ebp - 0x1b80]
mov dword [ebp - 0x157c], eax
mov eax, dword [ebp - 0x1b68]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1574], eax
mov eax, dword [ebp - 0x1b6c]
mov dword [ebp - 0x1560], eax
mov eax, dword [ebp - 0x1b70]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1570], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1b74]
mov dword [ebp - 0x156c], eax
mov eax, dword [ebp - 0x1b78]
mov dword [ebp - 0x1568], eax
mov eax, dword [ebp - 0x1b7c]
mov dword [ebp - 0x1590], eax
mov eax, dword [ebp - 0x1b80]
mov dword [ebp - 0x1554], eax
mov edi, dword [ebp - 0x1564]
mov eax, edi
mov esi, dword [0xc9300c]
neg eax
mov dword [ebp - 0x9e4], eax
mov ecx, esi
xor eax, eax
mov dword [ebp - 0x17c4], ebx
push 0x20
inc eax
mov dword [ebp - 0x9dc], ebx
mov word [ebp - 0x9e0], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x9de], ax
lea eax, [ebp - 0x17c4]
push eax
push ebx
lea eax, [ebp - 0x9ec]
mov dword [ebp - 0x9d8], ebx
push eax
push dword [ebp - 0x1598]
mov dword [ebp - 0x9d4], ebx
mov dword [ebp - 0x9d0], ebx
mov dword [ebp - 0x9cc], ebx
mov dword [ebp - 0x9c8], ebx
mov dword [ebp - 0x9c4], ebx
mov dword [ebp - 0x9ec], 0x28
mov dword [ebp - 0x9e8], edx
call dword [0xc99200]
call esi
mov dword [ebp - 0x15b8], eax
test eax, eax
jne 0xc2e557
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc2f18e
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push dword [ebp - 0x1598]
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0x15a0], eax
jne 0xc2e5bf
mov ecx, dword [ebp - 0x1558]
test ecx, ecx
je 0xc2e5bf
mov eax, dword [ebp - 0x1580]
mov esi, dword [0xc93074]
push ecx
mov dword [ebp - 0x790], eax
mov ecx, esi
lea eax, [ebp - 0x798]
mov dword [ebp - 0x798], ebx
push eax
push dword [ebp - 0x1598]
mov dword [ebp - 0x794], ebx
mov dword [ebp - 0x78c], edi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x11dc]
mov esi, dword [ebp - 0x11d8]
mov dword [ebp - 0x159c], eax
mov eax, dword [ebp - 0x11cc]
push 0x54
mov dword [ebp - 0x1584], eax
lea eax, [ebp - 0xfd0]
push ebx
push eax
mov dword [ebp - 0x15a4], esi
call fcn.00ab4bf6
add esp, 0xc
lea eax, [ebp - 0xec8]
push 0x54
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x15ac], ebx
lea eax, [ebp - 0xa44]
mov dword [ebp - 0x15a8], ebx
mov dword [ebp - 0x15b0], ebx
mov dword [ebp - 0x15c0], ebx
push 0x2c
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x7a8]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0xc2f173
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [ebp - 0x1598]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc2e66d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc2f173
mov esi, dword [0xc93034]
lea ecx, [ebp - 0xfd0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc2e6af
mov eax, dword [ebp - 0xfbc]
mov dword [ebp - 0x15ac], eax
mov eax, dword [ebp - 0xfcc]
mov dword [ebp - 0x15b0], eax
mov eax, dword [ebp - 0xfc8]
mov dword [ebp - 0x15c0], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x15cc], ecx
test ecx, ecx
je 0xc2e662
mov eax, dword [ebp - 0x1560]
sub eax, dword [ebp - 0x157c]
mov edi, dword [ebp - 0x1574]
sub edi, dword [ebp - 0x1570]
mov esi, dword [0xc9300c]
mov dword [ebp - 0xa3c], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x17c8], ebx
mov word [ebp - 0xa38], ax
pop eax
push ebx
push ebx
mov word [ebp - 0xa36], ax
lea eax, [ebp - 0x17c8]
push eax
push ebx
lea eax, [ebp - 0xa44]
mov dword [ebp - 0x15f0], ebx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0xa34], ebx
mov dword [ebp - 0xa30], ebx
mov dword [ebp - 0xa2c], ebx
mov dword [ebp - 0xa28], ebx
mov dword [ebp - 0xa24], ebx
mov dword [ebp - 0xa20], ebx
mov dword [ebp - 0xa1c], ebx
mov dword [ebp - 0xa44], 0x28
mov dword [ebp - 0xa40], edi
call dword [0xc99200]
call esi
mov dword [ebp - 0x1574], eax
test eax, eax
jne 0xc2e7ab
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x15f0], eax
test eax, eax
jle 0xc2e790
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x15f0], eax
test eax, eax
mov edi, dword [ebp - 0x15cc]
js 0xc2eb22
mov dword [ebp - 0x15f0], 0x80004005
jmp 0xc2eb22
mov esi, dword [0xc93034]
lea ecx, [ebp - 0xec8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc2e7d5
mov eax, dword [ebp - 0xeb4]
mov dword [ebp - 0x15a8], eax
push dword [ebp - 0x1574]
mov eax, dword [ebp - 0x157c]
sub eax, dword [ebp - 0x1560]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x7a0], edi
mov edi, dword [ebp - 0x15cc]
push edi
mov dword [ebp - 0x79c], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0x1584]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
push ebx
mov dword [ebp - 0x157c], eax
call dword [0xc99200]
call esi
mov esi, dword [ebp - 0x15cc]
mov ecx, edi
push eax
lea eax, [ebp - 0x7a8]
push eax
push esi
call dword [0xc99200]
call edi
push ebx
push dword [ebp - 0x1594]
lea eax, [ebp - 0x7a8]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x15a4]
push esi
mov esi, dword [0xc9306c]
mov ecx, esi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0x15a0], eax
jne 0xc2e8cd
cmp dword [ebp - 0x159c], 0
je 0xc2e8c1
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0x159c], eax
jmp 0xc2e8d7
mov dword [ebp - 0x159c], 0xffffff
jmp 0xc2e8d7
mov dword [ebp - 0x159c], 0xffa8a8a8
mov ecx, dword [ebp - 0x1570]
mov esi, ebx
mov dword [ebp - 0x1584], ebx
mov edx, ebx
test ecx, ecx
jns 0xc2e8f7
mov esi, ecx
mov ecx, ebx
neg esi
mov dword [ebp - 0x1584], esi
mov eax, dword [ebp - 0x1560]
test eax, eax
jns 0xc2e907
mov edx, eax
mov eax, ebx
neg edx
mov edi, dword [ebp - 0x7a0]
sub edi, esi
mov esi, dword [ebp - 0x15b0]
sub esi, ecx
mov dword [ebp - 0x1570], edi
cmp edi, esi
jl 0xc2e929
mov edi, esi
mov dword [ebp - 0x1570], esi
mov esi, dword [ebp - 0x79c]
sub dword [ebp - 0x15c0], eax
sub esi, edx
mov dword [ebp - 0x1560], esi
cmp esi, dword [ebp - 0x15c0]
jl 0xc2e951
mov esi, dword [ebp - 0x15c0]
mov dword [ebp - 0x1560], esi
test edi, edi
jle 0xc2eaea
test esi, esi
jle 0xc2eaea
imul eax, dword [ebp - 0x15b0]
imul edx, dword [ebp - 0x7a0]
mov edi, dword [ebp - 0x15a8]
add eax, ecx
mov ecx, dword [ebp - 0x15ac]
add edx, dword [ebp - 0x1584]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x7a0]
shl ecx, 2
lea ebx, [edi + edx*4]
mov dword [ebp - 0x15ac], ecx
mov ecx, dword [ebp - 0x15b0]
shl ecx, 2
mov dword [ebp - 0x1584], ebx
mov dword [ebp - 0x15a4], eax
mov dword [ebp - 0x15a8], ecx
mov esi, eax
lea edx, [eax + 3]
sub esi, ebx
mov dword [ebp - 0x15b0], edx
lea edi, [ebx + 2]
mov dword [ebp - 0x15c0], esi
mov ebx, dword [ebp - 0x1570]
mov dword [ebp - 0x15c8], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc2ea9b
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0x159c]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x15c0]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x15b0]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x159c]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x15b0]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x159a]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x15b0]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x15c0]
cdq
idiv ecx
mov edx, dword [ebp - 0x15b0]
add al, bl
mov ebx, dword [ebp - 0x15c8]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0x15b0], edx
mov dword [ebp - 0x15c8], ebx
jne 0xc2e9d5
mov ebx, dword [ebp - 0x1584]
mov eax, dword [ebp - 0x15a4]
add ebx, dword [ebp - 0x15ac]
add eax, dword [ebp - 0x15a8]
sub dword [ebp - 0x1560], 1
mov dword [ebp - 0x1584], ebx
mov dword [ebp - 0x15a4], eax
jne 0xc2e9b3
xor ebx, ebx
push dword [ebp - 0x1574]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x157c]
mov edi, dword [ebp - 0x15cc]
test eax, eax
je 0xc2eb22
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x15f0], 0
jl 0xc2f173
mov eax, dword [ebp - 0x11dc]
mov esi, dword [ebp - 0x11d4]
mov dword [ebp - 0x1570], eax
mov eax, dword [ebp - 0x11c8]
push 0x54
mov dword [ebp - 0x1560], eax
lea eax, [ebp - 0xf78]
push ebx
push eax
mov dword [ebp - 0x1574], esi
call fcn.00ab4bf6
add esp, 0xc
lea eax, [ebp - 0xf20]
push 0x54
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x157c], ebx
lea eax, [ebp - 0x8e4]
mov dword [ebp - 0x159c], ebx
mov dword [ebp - 0x1584], ebx
mov dword [ebp - 0x15a4], ebx
push 0x2c
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x7b8]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0xc2f173
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [ebp - 0x1598]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xc2e662
mov esi, dword [0xc93034]
lea ecx, [ebp - 0xf78]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc2ec29
mov eax, dword [ebp - 0xf64]
mov dword [ebp - 0x157c], eax
mov eax, dword [ebp - 0xf74]
mov dword [ebp - 0x1584], eax
mov eax, dword [ebp - 0xf70]
mov dword [ebp - 0x15a4], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x15ac], ecx
test ecx, ecx
je 0xc2e662
mov eax, dword [ebp - 0x1568]
sub eax, dword [ebp - 0x1554]
mov edi, dword [ebp - 0x1590]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x1568], eax
mov dword [ebp - 0x8e0], eax
mov eax, edi
sub eax, dword [ebp - 0x156c]
mov dword [ebp - 0x8dc], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x17cc], ebx
mov word [ebp - 0x8d8], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x8d6], ax
lea eax, [ebp - 0x17cc]
push eax
push ebx
lea eax, [ebp - 0x8e4]
mov dword [ebp - 0x15a8], ebx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x8d4], ebx
mov dword [ebp - 0x8d0], ebx
mov dword [ebp - 0x8cc], ebx
mov dword [ebp - 0x8c8], ebx
mov dword [ebp - 0x8c4], ebx
mov dword [ebp - 0x8c0], ebx
mov dword [ebp - 0x8bc], ebx
mov dword [ebp - 0x8e4], 0x28
call dword [0xc99200]
call esi
mov dword [ebp - 0x15b0], eax
test eax, eax
jne 0xc2ed31
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x15a8], eax
test eax, eax
jle 0xc2ed16
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x15a8], eax
test eax, eax
mov edi, dword [ebp - 0x15ac]
js 0xc2f0b1
mov dword [ebp - 0x15a8], 0x80004005
jmp 0xc2f0b1
mov esi, dword [0xc93034]
lea ecx, [ebp - 0xf20]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc2ed5b
mov eax, dword [ebp - 0xf0c]
mov dword [ebp - 0x159c], eax
mov eax, dword [ebp - 0x1568]
push dword [ebp - 0x15b0]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x7b0], eax
mov eax, dword [ebp - 0x156c]
sub eax, edi
mov edi, dword [ebp - 0x15ac]
push edi
mov dword [ebp - 0x7ac], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0x1560]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
push ebx
mov dword [ebp - 0x1560], eax
call dword [0xc99200]
call esi
mov esi, dword [ebp - 0x15ac]
mov ecx, edi
push eax
lea eax, [ebp - 0x7b8]
push eax
push esi
call dword [0xc99200]
call edi
push ebx
push dword [ebp - 0x1594]
lea eax, [ebp - 0x7b8]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x1574]
push esi
mov esi, dword [0xc9306c]
mov ecx, esi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0x15a0], eax
jne 0xc2ee5d
cmp dword [ebp - 0x1570], 0
je 0xc2ee51
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x158c], ecx
mov dword [ebp - 0x1594], ecx
jmp 0xc2ee6e
mov dword [ebp - 0x1594], 0xffffff
jmp 0xc2ee6e
mov eax, 0xffa8a8a8
mov dword [ebp - 0x158c], eax
mov dword [ebp - 0x1594], eax
mov edx, dword [ebp - 0x1554]
mov edi, ebx
mov eax, ebx
test edx, edx
jns 0xc2ee86
mov edi, edx
mov dword [ebp - 0x1554], ebx
neg edi
mov ecx, dword [ebp - 0x1590]
test ecx, ecx
jns 0xc2ee96
mov eax, ecx
mov ecx, ebx
neg eax
mov esi, dword [ebp - 0x7b0]
mov edx, dword [ebp - 0x1584]
sub esi, edi
sub edx, dword [ebp - 0x1554]
mov dword [ebp - 0x1570], esi
cmp esi, edx
jl 0xc2eebc
mov esi, edx
mov dword [ebp - 0x1570], edx
mov edx, dword [ebp - 0x7ac]
sub dword [ebp - 0x15a4], ecx
sub edx, eax
mov dword [ebp - 0x1574], edx
cmp edx, dword [ebp - 0x15a4]
jl 0xc2eee4
mov edx, dword [ebp - 0x15a4]
mov dword [ebp - 0x1574], edx
test esi, esi
jle 0xc2f079
test edx, edx
jle 0xc2f079
mov edx, dword [ebp - 0x7b0]
imul ecx, dword [ebp - 0x1584]
imul eax, edx
shl edx, 2
add ecx, dword [ebp - 0x1554]
add eax, edi
mov edi, dword [ebp - 0x159c]
lea eax, [edi + eax*4]
mov edi, dword [ebp - 0x157c]
mov dword [ebp - 0x157c], edx
mov edx, dword [ebp - 0x1584]
shl edx, 2
lea ecx, [edi + ecx*4]
mov dword [ebp - 0x1568], eax
mov dword [ebp - 0x1554], ecx
mov dword [ebp - 0x1590], edx
mov ebx, ecx
mov dword [ebp - 0x1584], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [ebp - 0x156c], edx
lea edi, [eax + 2]
mov dword [ebp - 0x159c], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc2f024
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x158c]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x159c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x156c]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x158c]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x156c]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x1592]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x156c]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x1584]
cdq
idiv ecx
mov edx, dword [ebp - 0x156c]
add al, bl
mov ebx, dword [ebp - 0x159c]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x156c], edx
mov dword [ebp - 0x1584], esi
jne 0xc2ef5e
mov eax, dword [ebp - 0x1568]
mov ecx, dword [ebp - 0x1554]
add eax, dword [ebp - 0x157c]
add ecx, dword [ebp - 0x1590]
sub dword [ebp - 0x1574], 1
mov esi, dword [ebp - 0x1570]
mov dword [ebp - 0x1568], eax
mov dword [ebp - 0x1554], ecx
jne 0xc2ef42
xor ebx, ebx
push dword [ebp - 0x15b0]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1560]
mov edi, dword [ebp - 0x15ac]
test eax, eax
je 0xc2f0b1
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x15a8], 0
jl 0xc2f173
xor eax, eax
inc eax
cmp dword [ebp - 0x15a0], eax
jne 0xc2f117
mov esi, dword [section..data]
mov ecx, esi
push 0xcc0020
push ebx
push ebx
push dword [ebp - 0x1598]
push dword [ebp - 0x1564]
push dword [ebp - 0x1580]
push dword [ebp - 0x11b8]
push dword [ebp - 0x11bc]
push dword [ebp - 0x15b4]
call dword [0xc99200]
call esi
jmp 0xc2f157
push dword [ebp - 0x155c]
mov ecx, dword [ebp - 0x1564]
mov eax, dword [ebp - 0x1580]
mov esi, dword [0xc93020]
push ecx
push eax
push ebx
push ebx
push dword [ebp - 0x1598]
push ecx
push eax
push dword [ebp - 0x774]
mov ecx, esi
push dword [ebp - 0x778]
push dword [ebp - 0x15b4]
call dword [0xc99200]
call esi
push dword [ebp - 0x1578]
mov esi, dword [0xc93040]
mov ecx, esi
push dword [ebp - 0x15b4]
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x15b8]
test eax, eax
je 0xc2f18e
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1598]
test eax, eax
je 0xc2f1a9
mov esi, dword [0xc93018]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1558]
test eax, eax
je 0xc2f1c4
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov edi, 0xc96238
mov ecx, dword [ebp - 0x11d8]
test ecx, ecx
je 0xc2f218
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc2f1d6
mov eax, dword [ebp - 0x11d8]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc2f1fe
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xc2f1f6
push dword [ebp - 0x11d8]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x11d8], ebx
mov ecx, dword [ebp - 0x11d4]
test ecx, ecx
je 0xc2f267
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc2f225
mov eax, dword [ebp - 0x11d4]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc2f24d
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xc2f245
push dword [ebp - 0x11d4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x11d4], ebx
mov edx, dword [ebp - 0x11d0]
test edx, edx
je 0xc2f2b3
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc2f276
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc2f29e
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xc2f290
mov edx, dword [ebp - 0x11d0]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x11d0], ebx
cmp dword [ebp - 0x11cc], 0
je 0xc2f2d8
push dword [ebp - 0x11cc]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x11cc], ebx
cmp dword [ebp - 0x11c8], 0
je 0xc2f2fd
push dword [ebp - 0x11c8]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x11c8], ebx
cmp dword [ebp - 0x11c4], 0
je 0xc2f322
push dword [ebp - 0x11c4]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x11c4], ebx
xor eax, eax
lea ecx, [eax + 1]
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc2f322
mov eax, dword [0xc95890]
test eax, eax
jle 0xc2f381
sub eax, 1
mov dword [0xc95890], eax
jne 0xc2f381
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc2f355
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc2f344
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0xc95878]
mov esi, dword [0xc9304c]
mov ecx, esi
mov dword [ebp - 0x15a0], eax
call dword [0xc99200]
call esi
sub eax, dword [0xc95870]
lea edi, [ebp - 0x5d4]
push 7
mov dword [ebp - 0x1578], eax
mov edx, 0xc96238
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
xor eax, eax
lea ecx, [eax + 1]
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc2f3be
mov eax, dword [0xc95890]
test eax, eax
jne 0xc2f9dc
push 0x338
mov edi, ebx
mov dword [ebp - 0x1598], ebx
push ebx
mov dword [ebp - 0x15b8], edi
mov dword [ebp - 0x162c], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1664], eax
test eax, eax
je 0xc2f975
or dword [ebp - 0x15ec], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0x15dc], ebx
mov esi, ebx
mov dword [ebp - 0x163c], eax
mov edx, ebx
mov edi, dword [ebp - 0x1758]
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0x1758]
xor edx, ebx
mov dword [ebp - 0x1678], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0x1758]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0x1758]
shl edi, 8
add dword [ebp - 0x1758], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
mov dword [ebp - 0x1688], esi
mov esi, edx
xor esi, dword [ebp - 0x1688]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x1678]
xor eax, edx
mov dword [ebp - 0x1678], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x1678]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x1678]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x1678], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x1678]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x1678]
xor edx, eax
mov dword [ebp - 0x1678], edx
mov eax, dword [ebp - 0x1678]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x1678]
xor eax, edx
mov dword [ebp - 0x1678], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x1678]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x1678]
xor eax, edx
mov dword [ebp - 0x1678], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x1678]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0x1678]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0x1678], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0x1678]
xor eax, 0xab69605e
mov dword [ebp - 0x1688], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1688]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x1688]
xor eax, edx
mov dword [ebp - 0x1688], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x1688], edx
mov edx, dword [ebp - 0x1688]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x1688], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1688]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x1688]
xor eax, edx
mov dword [ebp - 0x1688], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1688]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x1688]
xor eax, edx
mov dword [ebp - 0x1688], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1688]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x1688]
xor edx, dword [ebp - 0x15dc]
xor eax, dword [ebp - 0x15ec]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x1678], esi
mov esi, dword [ebp - 0x163c]
mov dword [ebp - 0x15dc], ebx
mov dword [ebp - 0x15ec], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x175c], 1
mov dword [ebp - 0x163c], esi
mov esi, eax
mov dword [ebp - 0x1688], eax
jne 0xc2f429
mov esi, dword [ebp - 0x1664]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc2f7b8
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc2f7e3
cmp edx, dword [0x9fc02c]
jne 0xc2f7e3
mov edi, esi
mov dword [ebp - 0x15b8], esi
mov esi, ebx
jmp 0xc2f7f6
or dword [ebp - 0x1760], 0xffffffff
mov edi, ebx
mov dword [ebp - 0x162c], 0xc004d501
test esi, esi
je 0xc2f809
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x162c], ebx
jl 0xc2f96f
mov eax, dword [ebp - 0x1760]
mov esi, edi
push 0x40
push ebx
push 0xc960a0
mov byte [eax + edi], bl
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], bl
je 0xc2f97c
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0x162c], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc2f84a
sub ecx, dword [ebp - 0x162c]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc2f968
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0x1558], ecx
cmp word [eax], dx
je 0xc2f892
mov ecx, 0xc000007b
mov dword [ebp - 0x1558], ecx
jmp 0xc2f8da
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc2f885
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc2f885
cmp dword [edx], 0x4550
jne 0xc2f885
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0x1764]
je 0xc2f8c8
cmp ax, word [ebp - 0x1768]
je 0xc2f8c8
mov ecx, 0xc000000d
jmp 0xc2f88a
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0x162c], eax
mov dword [ebp - 0x1664], ebx
test eax, eax
je 0xc2f955
mov edx, esi
mov dword [ebp - 0x15dc], esi
lea eax, [edx + 1]
mov dword [ebp - 0x15ec], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc2f901
sub edx, dword [ebp - 0x15ec]
inc esi
add esi, edx
test ecx, ecx
js 0xc2f93a
push dword [ebp - 0x15dc]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc2f960
mov ecx, dword [ebp - 0x1598]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x1558]
mov eax, dword [ebp - 0x1664]
inc dword [ebp - 0x1598]
inc eax
mov dword [ebp - 0x1664], eax
cmp eax, dword [ebp - 0x162c]
jb 0xc2f8f0
add edi, 0x10
cmp byte [esi], bl
jne 0xc2f83d
mov esi, dword [ebp - 0x1558]
jmp 0xc2f97e
mov esi, 0xc000007a
jmp 0xc2f97e
mov edi, dword [ebp - 0x15b8]
mov esi, 0xc000007a
jmp 0xc2f984
mov esi, ebx
mov edi, dword [ebp - 0x15b8]
test edi, edi
je 0xc2f997
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push edi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0xc2f9d7
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc2f9ae
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc2f99d
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc2f9e2
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edi, 0xc96238
xchg dword [edi], eax
mov eax, dword [ebp - 0x1578]
xor ecx, ecx
mov esi, dword [0xc93068]
inc ecx
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp - 0x15a0]
mov dword [ebp - 0x5bc], eax
lea eax, [ebp - 0x5d8]
push eax
push 4
push 0x2021
mov dword [ebp - 0x5d8], ecx
mov dword [ebp - 0x5d0], ecx
mov dword [ebp - 0x5c4], ecx
mov dword [ebp - 0x5c8], ecx
mov dword [ebp - 0x5c0], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x5cc], 0x9966f291
call dword [0xc99200]
call esi
xor eax, eax
lea ecx, [eax + 1]
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc2fa4d
mov eax, dword [0xc95890]
test eax, eax
jle 0xc2faac
sub eax, 1
mov dword [0xc95890], eax
jne 0xc2faac
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc2fa80
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc2fa6f
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0x15b4]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
xor eax, eax
mov dword [ebp - 0x162c], ebx
lea edi, [ebp - 0x1abc]
mov dword [ebp - 0x1664], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x1aec]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x15dc], eax
test eax, eax
je 0xc31cb7
push 0x28
pop ecx
mov esi, 0xc94ea0
mov dword [ebp - 0x162c], eax
mov edi, eax
rep movsd dword es:[edi], dword [esi]
push 8
pop esi
push esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x15ec], eax
test eax, eax
je 0xc31cb7
mov ecx, dword [0xc94e98]
mov dword [eax], ecx
mov ecx, dword [0xc94e9c]
mov dword [eax + 4], ecx
mov dword [ebp - 0x1664], eax
rdtsc
mov dword [ebp - 0x163c], eax
mov dword [ebp - 0x1678], edx
lea eax, [ebp - 0x1604]
mov dword [ebp - 0x1608], ebx
push eax
push 4
pop edi
mov edx, edi
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc31cb7
mov edx, dword [ebp - 0x1604]
lea eax, [ebp - 0x1608]
push eax
xor ecx, ecx
call fcn.00a32533
or eax, 0x10000000
jl 0xc31cb7
lea eax, [ebp - 0x168c]
mov edx, 0xa0
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc31cb7
mov edx, dword [ebp - 0x168c]
lea eax, [ebp - 0x1608]
mov ecx, dword [ebp - 0x1608]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xc31cb7
lea eax, [ebp - 0x1684]
mov edx, esi
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc31cb7
mov edx, dword [ebp - 0x1684]
lea eax, [ebp - 0x1608]
mov ecx, dword [ebp - 0x1608]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xc31cb7
lea eax, [ebp - 0x16b8]
mov edx, esi
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc31cb7
mov edx, dword [ebp - 0x16b8]
lea eax, [ebp - 0x1608]
mov ecx, dword [ebp - 0x1608]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xc31cb7
push dword [ebp - 0x1608]
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x16b8], esi
test esi, esi
je 0xc31cb7
lea eax, [ebp - 0x1a54]
mov edx, edi
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc31cbf
mov ecx, dword [ebp - 0x1608]
lea eax, [esi + 8]
add ecx, esi
mov dword [ebp - 0x1684], ecx
cmp eax, ecx
ja 0xc31cbf
mov eax, dword [ebp - 0x1a54]
mov dword [esi], edi
mov dword [eax], edi
mov dword [ebp - 0x16bc], esi
mov dword [ebp - 0x168c], ebx
mov edx, dword [esi]
lea eax, [ebp - 0x1628]
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc31cbf
mov edx, dword [ebp - 0x1628]
lea eax, [ebp - 0x16bc]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc31cbf
mov eax, dword [ebp - 0x168c]
xor ecx, ecx
inc eax
inc ecx
mov dword [ebp - 0x168c], eax
cmp eax, ecx
jae 0xc2fd11
mov esi, dword [ebp - 0x16bc]
jmp 0xc2fcc1
lea eax, [ebp - 0x1a74]
mov edx, edi
mov edi, dword [ebp - 0x16bc]
mov ecx, edi
push eax
call fcn.00a32533
test eax, eax
js 0xc31cbf
lea eax, [edi + 0xa4]
cmp eax, dword [ebp - 0x1684]
ja 0xc31cbf
mov esi, dword [ebp - 0x15dc]
mov dword [edi], 0xa0
mov edi, dword [ebp - 0x1a74]
push 0x28
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x16b8]
push 4
mov dword [ebp - 0x16c0], esi
mov dword [ebp - 0x1628], ebx
pop edi
mov edx, dword [esi]
lea eax, [ebp - 0x1668]
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc31cbf
mov edx, dword [ebp - 0x1668]
lea eax, [ebp - 0x16c0]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc31cbf
mov eax, dword [ebp - 0x1628]
mov esi, dword [ebp - 0x16c0]
inc eax
mov dword [ebp - 0x1628], eax
cmp eax, 2
jb 0xc2fd6d
lea eax, [ebp - 0x1a7c]
mov edx, edi
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc31cbf
lea eax, [esi + 0xc]
cmp eax, dword [ebp - 0x1684]
ja 0xc31cbf
mov edx, dword [ebp - 0x15ec]
mov ecx, dword [ebp - 0x1a7c]
mov dword [esi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov esi, dword [ebp - 0x16b8]
mov dword [ebp - 0x16c4], esi
mov dword [ebp - 0x1668], ebx
mov edx, dword [esi]
lea eax, [ebp - 0x16c8]
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc31cbf
mov edx, dword [ebp - 0x16c8]
lea eax, [ebp - 0x16c4]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc31cbf
mov eax, dword [ebp - 0x1668]
mov esi, dword [ebp - 0x16c4]
inc eax
mov dword [ebp - 0x1668], eax
cmp eax, 3
jb 0xc2fe0e
lea eax, [ebp - 0x1a84]
mov edx, edi
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc31cbf
lea eax, [esi + 0xc]
cmp eax, dword [ebp - 0x1684]
ja 0xc31cbf
mov eax, dword [ebp - 0x1a84]
mov ecx, dword [ebp - 0x163c]
mov dword [esi], 8
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1678]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x15f8]
mov edx, edi
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc31cbf
mov esi, dword [ebp - 0x15f8]
lea eax, [ebp - 0x16cc]
push eax
push 8
pop edx
mov ecx, edi
mov dword [ebp - 0x1624], esi
call fcn.00a32533
test eax, eax
js 0xc31cbf
mov edx, dword [ebp - 0x16cc]
lea eax, [ebp - 0x1624]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc31cbf
rdtsc
mov dword [ebp - 0x16cc], ebx
mov dword [ebp - 0x15f8], ebx
mov dword [ebp - 0x16c8], ebx
mov dword [ebp - 0x16c4], ebx
mov dword [ebp - 0x1668], ebx
mov dword [ebp - 0x16c0], ebx
mov dword [ebp - 0x1628], ebx
mov dword [ebp - 0x16bc], ebx
mov dword [ebp - 0x1684], ebx
mov dword [ebp - 0x168c], ebx
mov dword [ebp - 0x1604], eax
mov dword [ebp - 0x15dc], edx
push 8
pop eax
mov dword [ebp - 0x1808], eax
mov edx, dword [ebp - 0x1608]
lea ecx, [ebp - 0x1808]
push ecx
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3005b
mov eax, dword [ebp - 0x1808]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0x15ec], ecx
cmp ecx, eax
jae 0xc2ff88
mov esi, 0xc0000095
jmp 0xc3005b
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x163c], eax
test eax, eax
jne 0xc2ffac
mov esi, 0xc0000017
jmp 0xc3005b
lea ecx, [ebp - 0x15e8]
mov dword [ebp - 0x15e8], eax
push ecx
mov edx, edi
mov dword [eax], edi
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc30042
mov ecx, dword [ebp - 0x15e8]
mov edx, edi
mov eax, dword [ebp - 0x1608]
mov dword [ecx], eax
lea eax, [ebp - 0x15e8]
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0x163c]
test esi, esi
js 0xc30048
mov ecx, dword [ebp - 0x15ec]
push dword [ebp - 0x1608]
mov edx, dword [ebp - 0x1604]
push dword [ebp - 0x16b8]
mov dword [ecx + eax - 8], edx
mov edx, dword [ebp - 0x15dc]
push dword [ebp - 0x15e8]
mov dword [ecx + eax - 4], edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0x163c]
add esp, 0xc
mov ecx, dword [ebp - 0x15ec]
mov dword [ebp - 0x16cc], eax
mov eax, ebx
mov dword [ebp - 0x15f8], ecx
jmp 0xc30048
mov eax, dword [ebp - 0x163c]
test eax, eax
je 0xc3005b
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xc31aa4
cmp dword [ebp - 0x16cc], 0
mov dword [ebp - 0x15e8], ebx
jne 0xc30080
mov esi, 0xc000000d
jmp 0xc30719
mov esi, dword [ebp - 0x15f8]
test esi, esi
je 0xc307fd
lea eax, [esi + 8]
push eax
push ebx
mov dword [ebp - 0x1604], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1608], eax
test eax, eax
je 0xc307fd
mov edi, dword [ebp - 0x16cc]
mov cl, bl
mov eax, ebx
test esi, esi
je 0xc300ca
xor cl, byte [eax + edi]
inc eax
cmp eax, esi
jb 0xc300c2
mov eax, esi
mov dword [ebp - 0x708], 0xb1b54a58
shr eax, 3
mov dword [ebp - 0x704], 0xc81ecb17
mov dword [ebp - 0x15dc], eax
test eax, eax
je 0xc3054d
movzx edx, word [ebp - 0x706]
mov eax, 0xc81ecb17
movzx esi, ax
movzx eax, word [ebp - 0x702]
mov dword [ebp - 0x15ec], eax
mov eax, 0xb1b54a58
movzx eax, ax
mov dword [ebp - 0x163c], eax
mov eax, dword [ebp - 0x1608]
mov dword [ebp - 0x1688], esi
add eax, 7
lea esi, [edi + 2]
mov dword [ebp - 0x1678], edx
mov dword [ebp - 0x16b0], eax
or edx, 0xffffffff
mov dword [ebp - 0x16ac], esi
mov dword [ebp - 0x16a8], ebx
mov dword [ebp - 0x1744], ebx
mov dword [ebp - 0x16d4], ebx
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0x16ac]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0x16ac]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0x16ac]
shl esi, 8
add dword [ebp - 0x16ac], 8
movzx eax, byte [eax + 5]
or esi, eax
xor edx, esi
mov dword [ebp - 0x173c], esi
mov eax, edx
mov dword [ebp - 0x1738], edx
sub eax, dword [ebp - 0x163c]
mov esi, 0xc81ecb17
xor eax, edi
xor eax, dword [ebp - 0x16a8]
xor eax, esi
mov edx, eax
mov dword [ebp - 0x16a8], eax
xor edx, esi
ror eax, 7
ror edx, 0xf
imul edx, dword [ebp - 0x1678]
mov esi, dword [ebp - 0x15ec]
add edx, eax
mov eax, dword [ebp - 0x1738]
xor eax, edx
mov edx, 0xb1b54a58
add edx, eax
mov dword [ebp - 0x1738], eax
ror edx, 9
imul edx, dword [ebp - 0x1688]
ror eax, 0xa
sub edx, eax
mov eax, dword [ebp - 0x16a8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x16a8], eax
xor edx, dword [ebp - 0x1688]
rol edx, 4
imul edx, esi
rol eax, 5
add edx, eax
mov eax, dword [ebp - 0x1738]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x1738], eax
xor edx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, edx
mov edx, dword [ebp - 0x16a8]
xor edx, eax
mov dword [ebp - 0x16a8], edx
sub edx, dword [ebp - 0x163c]
imul edx, dword [ebp - 0x1678]
mov eax, dword [ebp - 0x16a8]
shr eax, 6
sub edx, eax
xor dword [ebp - 0x1738], edx
mov edx, dword [ebp - 0x1738]
mov eax, edx
ror eax, 0xf
xor eax, dword [ebp - 0x1688]
imul eax, dword [ebp - 0x163c]
xor dword [ebp - 0x16a8], eax
mov eax, dword [ebp - 0x16a8]
not eax
ror eax, 3
add eax, esi
imul eax, dword [ebp - 0x1688]
xor edx, eax
mov eax, edx
mov dword [ebp - 0x1738], edx
sub eax, dword [ebp - 0x163c]
mov edx, dword [ebp - 0x16a8]
sub eax, 0xc81ecb17
xor edx, eax
mov dword [ebp - 0x16a8], edx
mov eax, dword [ebp - 0x16a8]
xor eax, esi
ror edx, 0xa
imul eax, dword [ebp - 0x1678]
xor edx, eax
mov eax, dword [ebp - 0x1738]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x1738], eax
xor edx, dword [ebp - 0x163c]
rol edx, 6
imul edx, dword [ebp - 0x1688]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0x16a8]
xor eax, edx
mov edx, dword [ebp - 0x1738]
mov dword [ebp - 0x16a8], eax
ror eax, 0xf
sub eax, esi
imul eax, dword [ebp - 0x163c]
xor edx, eax
mov dword [ebp - 0x1738], edx
xor edx, esi
imul edx, dword [ebp - 0x163c]
mov eax, dword [ebp - 0x1738]
shr eax, 1
xor edx, eax
mov eax, dword [ebp - 0x1738]
xor dword [ebp - 0x16a8], edx
mov edx, eax
sub edx, dword [ebp - 0x1688]
rol edx, 3
imul edx, dword [ebp - 0x163c]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0x16a8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x16a8], eax
sub edx, dword [ebp - 0x1688]
imul edx, dword [ebp - 0x1678]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x1738]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0x1738], eax
ror edx, 9
imul edx, dword [ebp - 0x1688]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0x16a8]
xor eax, edx
mov edx, dword [ebp - 0x1738]
mov dword [ebp - 0x16a8], eax
sub eax, 0xb1b54a58
sub eax, esi
xor edx, eax
mov dword [ebp - 0x1738], edx
mov eax, dword [ebp - 0x1738]
xor eax, dword [ebp - 0x1678]
imul eax, dword [ebp - 0x163c]
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0x16a8]
xor edx, eax
mov dword [ebp - 0x16a8], edx
xor edx, esi
rol edx, 4
imul edx, dword [ebp - 0x1678]
mov eax, dword [ebp - 0x16a8]
ror eax, 0x10
sub edx, eax
mov eax, dword [ebp - 0x1738]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0x1738], eax
ror edx, 0xa
imul edx, dword [ebp - 0x1688]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0x16a8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x16a8], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, esi
mov esi, 0xc81ecb17
xor edx, eax
mov eax, dword [ebp - 0x1738]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x1738], eax
xor edx, esi
rol eax, 2
rol edx, 8
imul edx, dword [ebp - 0x163c]
sub edx, eax
mov eax, dword [ebp - 0x16a8]
xor eax, edx
mov edx, esi
sub edx, eax
mov dword [ebp - 0x16a8], eax
ror edx, 0xb
imul edx, dword [ebp - 0x1678]
ror eax, 0xc
sub edx, eax
mov eax, dword [ebp - 0x1738]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x1738], eax
xor edx, dword [ebp - 0x1678]
imul edx, dword [ebp - 0x1688]
shr eax, 8
xor edx, eax
mov eax, dword [ebp - 0x16a8]
xor eax, edx
mov edx, dword [ebp - 0x1738]
xor edx, eax
xor eax, dword [ebp - 0x1744]
xor edx, 0xb1b54a58
mov dword [ebp - 0x1744], edi
xor edx, esi
mov esi, dword [ebp - 0x16b0]
xor edx, dword [ebp - 0x16d4]
mov byte [esi - 4], al
mov byte [esi], dl
ror eax, 8
mov byte [esi - 5], al
ror edx, 8
mov byte [esi - 1], dl
ror eax, 8
mov byte [esi - 6], al
ror edx, 8
mov byte [esi - 2], dl
ror eax, 8
ror edx, 8
mov byte [esi - 7], al
mov byte [esi - 3], dl
mov esi, dword [ebp - 0x173c]
ror eax, 8
mov dword [ebp - 0x16a8], eax
ror edx, 8
mov dword [ebp - 0x16d4], esi
add dword [ebp - 0x16b0], 8
sub dword [ebp - 0x15dc], 1
mov esi, dword [ebp - 0x16ac]
jne 0xc30154
mov esi, dword [ebp - 0x15f8]
movzx eax, cl
mov ecx, dword [ebp - 0x1608]
cdq
mov dword [ecx + esi], eax
mov dword [ecx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x15f8], edi
test edi, edi
jne 0xc30585
mov esi, 0xc0000017
jmp 0xc30687
mov esi, dword [ebp - 0x1604]
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0xc305aa
mov esi, 0xc0000017
jmp 0xc30626
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0x1608]
push esi
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc305a3
mov dword [edi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
push 8
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x15f8]
pop eax
push eax
push eax
mov dword [edi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0xc305a3
mov dword [edi + 0x14], ecx
mov eax, dword [0xc94e90]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ebp - 0x15e8], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0xc30687
cmp dword [edi + 4], 0
je 0xc30644
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xc3065e
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xc30678
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc3069b
mov eax, dword [ebp - 0x15e8]
mov edi, ebx
mov dword [ebp - 0x16c8], eax
jmp 0xc306a1
mov edi, dword [ebp - 0x15e8]
push dword [ebp - 0x1608]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xc30716
cmp dword [edi + 4], 0
je 0xc306d3
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xc306ed
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xc30707
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
push 4
pop edi
or esi, 0x10000000
jl 0xc31aa4
mov edx, dword [ebp - 0x16c8]
lea eax, [ebp - 0x15d8]
push eax
mov ecx, edi
mov dword [ebp - 0x15d8], edi
mov edx, dword [edx]
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc307c3
mov ecx, dword [ebp - 0x15d8]
lea eax, [ebp - 0x15d8]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc307c3
mov ecx, dword [ebp - 0x15d8]
lea eax, [ebp - 0x15d8]
push eax
mov eax, dword [ebp - 0x16c8]
mov edx, dword [eax + 8]
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc307c3
mov ecx, dword [ebp - 0x15d8]
lea eax, [ebp - 0x15d8]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc307c3
mov ecx, dword [ebp - 0x15d8]
lea eax, [ebp - 0x15d8]
push eax
mov eax, dword [ebp - 0x16c8]
mov edx, dword [eax + 0x10]
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0x15d8]
test esi, esi
jns 0xc307c9
mov eax, dword [ebp - 0x1814]
mov dword [ebp - 0x15d8], eax
test esi, esi
js 0xc30953
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x15e8], ecx
test ecx, ecx
jne 0xc30807
mov esi, 0xc0000017
jmp 0xc30953
mov esi, 0xc0000001
jmp 0xc30719
mov eax, dword [ebp - 0x16c8]
mov edx, edi
mov dword [ebp - 0x1620], ecx
mov eax, dword [eax]
mov dword [ecx], eax
lea eax, [ebp - 0x1620]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3093a
mov esi, dword [ebp - 0x16c8]
push dword [esi]
push dword [esi + 4]
push dword [ebp - 0x1620]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [esi]
lea eax, [ebp - 0x1620]
mov ecx, dword [ebp - 0x1620]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3093a
mov eax, dword [ebp - 0x16c8]
mov edx, edi
mov ecx, dword [ebp - 0x1620]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0x1620]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3093a
mov esi, dword [ebp - 0x16c8]
push dword [esi + 8]
push dword [esi + 0xc]
push dword [ebp - 0x1620]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [esi + 8]
lea eax, [ebp - 0x1620]
mov ecx, dword [ebp - 0x1620]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3093a
mov eax, dword [ebp - 0x16c8]
mov edx, edi
mov ecx, dword [ebp - 0x1620]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0x1620]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3093a
mov esi, dword [ebp - 0x16c8]
push dword [esi + 0x10]
push dword [esi + 0x14]
push dword [ebp - 0x1620]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0x1620]
mov ecx, dword [ebp - 0x1620]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0x15e8]
test esi, esi
js 0xc30940
mov ecx, dword [ebp - 0x15d8]
mov dword [ebp - 0x16c4], eax
mov eax, ebx
mov dword [ebp - 0x1668], ecx
jmp 0xc30940
mov eax, dword [ebp - 0x15e8]
test eax, eax
je 0xc30953
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xc31aa4
push 8
pop eax
mov dword [ebp - 0x1620], ebx
mov dword [ebp - 0x15d8], ebx
mov dword [ebp - 0x181c], eax
mov edx, dword [ebp - 0x1624]
lea ecx, [ebp - 0x181c]
push ecx
mov ecx, eax
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
jl 0xc309e9
mov eax, dword [ebp - 0x181c]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xc309a9
mov esi, 0xc0000095
jmp 0xc309ca
mov dword [ebp - 0x1824], ecx
lea eax, [ebp - 0x1824]
push eax
push 8
pop edx
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0x1824]
test esi, esi
jns 0xc309d0
mov eax, dword [ebp - 0x1820]
mov dword [ebp - 0x15e8], eax
test esi, esi
js 0xc309e9
mov eax, dword [ebp - 0x16b8]
test eax, eax
jne 0xc30a17
mov esi, 0xc000000d
mov eax, ebx
test esi, esi
js 0xc31aa4
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc30c0d
mov esi, 0xd0000017
mov eax, ebx
jmp 0xc30c18
xor ecx, ecx
inc ecx
cmp edi, ecx
jbe 0xc309e4
mov ecx, eax
mov dword [ebp - 0x1624], ebx
mov dword [ebp - 0x1618], ecx
mov eax, dword [ecx]
mov edx, edi
mov dword [ebp - 0x15f8], eax
lea eax, [ebp - 0x1618]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc309e9
mov edx, dword [ebp - 0x15f8]
lea eax, [ebp - 0x1618]
mov ecx, dword [ebp - 0x1618]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc309e9
mov eax, dword [ebp - 0x1624]
xor ecx, ecx
inc eax
inc ecx
cmp eax, ecx
mov dword [ebp - 0x1624], eax
mov ecx, dword [ebp - 0x1618]
jb 0xc30a2c
mov eax, dword [ecx]
mov edx, edi
mov dword [ebp - 0x1624], eax
lea eax, [ebp - 0x1618]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc309e9
mov eax, dword [ebp - 0x1624]
mov dword [ebp - 0x1620], eax
cmp edi, 2
jbe 0xc309e4
mov ecx, dword [ebp - 0x16b8]
mov dword [ebp - 0x1640], ecx
mov dword [ebp - 0x1618], ebx
mov eax, dword [ecx]
mov edx, edi
mov dword [ebp - 0x1624], eax
lea eax, [ebp - 0x1640]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc309e9
mov edx, dword [ebp - 0x1624]
lea eax, [ebp - 0x1640]
mov ecx, dword [ebp - 0x1640]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc309e9
mov eax, dword [ebp - 0x1618]
mov ecx, dword [ebp - 0x1640]
inc eax
mov dword [ebp - 0x1618], eax
cmp eax, 2
jb 0xc30ac7
mov eax, dword [ecx]
mov edx, edi
mov dword [ebp - 0x1618], eax
lea eax, [ebp - 0x1640]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc309e9
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 0x15d8], eax
mov edx, dword [ebp - 0x15e8]
lea eax, [ebp - 0x1660]
push eax
mov ecx, edi
mov dword [ebp - 0x1660], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc30be3
mov ecx, dword [ebp - 0x1660]
lea eax, [ebp - 0x1660]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc30be3
mov edx, dword [ebp - 0x1620]
lea eax, [ebp - 0x1660]
mov ecx, dword [ebp - 0x1660]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc30be3
mov ecx, dword [ebp - 0x1660]
lea eax, [ebp - 0x1660]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc30be3
mov edx, dword [ebp - 0x15d8]
lea eax, [ebp - 0x1660]
mov ecx, dword [ebp - 0x1660]
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0x1660]
test esi, esi
jns 0xc30bf1
mov eax, dword [ebp - 0x1834]
test esi, esi
js 0xc309e9
cmp eax, 0x400000
jbe 0xc30c02
mov esi, 0x8000ffff
jmp 0xc31aa4
mov dword [ebp - 0x1628], eax
jmp 0xc309eb
mov dword [ebp - 0x16c0], eax
mov esi, 0x10000000
test esi, esi
js 0xc31aa4
mov ecx, dword [ebp - 0x16c4]
test ecx, ecx
jne 0xc30c34
mov esi, 0x80070057
jmp 0xc31aa4
test eax, eax
je 0xc30c2a
mov dword [ebp - 0x1bdc], eax
mov eax, dword [ebp - 0x1628]
mov dword [ebp - 0x1bd4], eax
lea eax, [ebp - 0x1838]
push eax
xor eax, eax
mov dword [ebp - 0x1be0], ecx
mov ecx, dword [ebp - 0x1668]
inc eax
push 0x9f29b8
push eax
mov dword [ebp - 0x1bd8], ecx
mov dword [ebp - 0x1bd0], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xc30ca2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc30c93
movzx esi, si
or esi, 0x80070000
test esi, esi
mov eax, dword [ebp - 0x1628]
js 0xc30cf0
mov esi, 0x80004005
jmp 0xc30cf0
push 0x9fc030
push dword [ebp - 0x1838]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xc30c7c
push ebx
push 0x14
lea eax, [ebp - 0x1be0]
mov ecx, esi
push eax
push 0x86
call dword [0xc99200]
call esi
mov esi, eax
or esi, 0x10000000
jl 0xc30cea
mov eax, dword [ebp - 0x1bd4]
mov dword [ebp - 0x1628], eax
jmp 0xc30cf0
mov eax, dword [ebp - 0x1628]
cmp esi, 0xd0000023
jne 0xc30d02
mov esi, 0x8007007a
jmp 0xc31aa4
test esi, esi
js 0xc31aa4
mov ecx, dword [ebp - 0x16c0]
mov dword [ebp - 0x1660], ebx
mov dword [ebp - 0x1674], ebx
mov dword [ebp - 0x16a0], ecx
cmp eax, edi
jae 0xc30d30
mov esi, 0xc000003e
jmp 0xc31157
mov eax, dword [ecx]
mov edx, edi
mov dword [ebp - 0x1640], eax
lea eax, [ebp - 0x16a0]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc31157
lea eax, [ebp - 0x1674]
mov edx, edi
push eax
xor ecx, ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc31157
mov eax, dword [ebp - 0x1628]
sub eax, dword [ebp - 0x1674]
mov ecx, dword [ebp - 0x1640]
cmp eax, ecx
jb 0xc30d26
mov eax, dword [ebp - 0x16a0]
lea edx, [ebp - 0x16a0]
push edx
mov edx, ecx
mov dword [ebp - 0x1618], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc31157
mov edx, dword [ebp - 0x1640]
lea eax, [ebp - 0x1674]
mov ecx, dword [ebp - 0x1674]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc31157
mov eax, dword [ebp - 0x1628]
sub eax, dword [ebp - 0x1674]
cmp eax, edi
jb 0xc30d26
mov ecx, dword [ebp - 0x16a0]
mov edx, edi
mov eax, dword [ecx]
mov dword [ebp - 0x1620], eax
lea eax, [ebp - 0x16a0]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc31157
mov ecx, dword [ebp - 0x1674]
lea eax, [ebp - 0x1674]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc31157
mov eax, dword [ebp - 0x1628]
sub eax, dword [ebp - 0x1674]
mov ecx, dword [ebp - 0x1620]
cmp eax, ecx
jb 0xc30d26
mov eax, dword [ebp - 0x16a0]
lea edx, [ebp - 0x16a0]
push edx
mov edx, ecx
mov dword [ebp - 0x15d8], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc31157
mov edx, dword [ebp - 0x1620]
lea eax, [ebp - 0x1674]
mov ecx, dword [ebp - 0x1674]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc31157
mov eax, dword [ebp - 0x1628]
sub eax, dword [ebp - 0x1674]
cmp eax, edi
jb 0xc30d26
mov ecx, dword [ebp - 0x16a0]
mov edx, edi
mov eax, dword [ecx]
mov dword [ebp - 0x15e8], eax
lea eax, [ebp - 0x16a0]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc31157
mov ecx, dword [ebp - 0x1674]
lea eax, [ebp - 0x1674]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc31157
mov eax, dword [ebp - 0x1628]
sub eax, dword [ebp - 0x1674]
mov ecx, dword [ebp - 0x15e8]
cmp eax, ecx
jb 0xc30d26
lea eax, [ebp - 0x1674]
mov edx, ecx
mov ecx, dword [ebp - 0x1674]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc31157
mov edx, dword [ebp - 0x1628]
mov eax, edx
sub eax, dword [ebp - 0x1674]
jne 0xc30d26
mov eax, dword [ebp - 0x1620]
mov ecx, dword [ebp - 0x15e8]
add eax, dword [ebp - 0x1640]
add ecx, 0xc
add eax, ecx
cmp eax, edx
jne 0xc30d26
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x1674], esi
test esi, esi
jne 0xc30f6c
mov esi, 0xc0000017
jmp 0xc310cf
cmp dword [ebp - 0x1618], 0
je 0xc30fb5
mov eax, dword [ebp - 0x1640]
push eax
push 8
mov dword [esi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc30f9b
mov esi, 0xc0000017
jmp 0xc31059
mov dword [esi + 4], eax
push dword [ebp - 0x1640]
push dword [ebp - 0x1618]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xc30fba
mov dword [esi], ebx
mov dword [esi + 4], ebx
cmp dword [ebp - 0x15d8], 0
je 0xc30ffa
mov eax, dword [ebp - 0x1620]
push eax
push 8
mov dword [esi + 8], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc30f91
mov dword [esi + 0xc], eax
push dword [ebp - 0x1620]
push dword [ebp - 0x15d8]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xc31000
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
cmp dword [ebp - 0x16a0], 0
je 0xc31045
mov eax, dword [ebp - 0x15e8]
push eax
push 8
mov dword [esi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc30f91
mov dword [esi + 0x14], eax
mov ecx, dword [ebp - 0x15e8]
push ecx
push dword [ebp - 0x16a0]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xc3104b
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [ebp - 0x1660], esi
mov esi, ebx
mov dword [ebp - 0x1674], ebx
mov eax, dword [ebp - 0x1674]
test eax, eax
je 0xc310cf
mov ecx, dword [eax + 4]
test ecx, ecx
je 0xc31082
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1674]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0xc310a1
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1674]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0xc310c0
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1674]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1660]
test esi, esi
js 0xc310e7
mov dword [ebp - 0x16bc], eax
mov eax, ebx
mov dword [ebp - 0x1660], eax
test eax, eax
je 0xc31157
mov ecx, dword [eax + 4]
test ecx, ecx
je 0xc3110a
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1660]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0xc31129
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1660]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0xc31148
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1660]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xc31aa4
mov ecx, dword [ebp - 0x16bc]
mov dword [ebp - 0x16a0], ebx
mov dword [ebp - 0x1674], ebx
test ecx, ecx
jne 0xc31183
mov esi, 0xd000000d
jmp 0xc31aa4
mov eax, dword [ecx + 4]
mov dword [ebp - 0x1660], eax
test eax, eax
je 0xc31179
mov esi, dword [ecx]
test esi, esi
je 0xc31179
add esi, 0xfffffff8
push esi
push ebx
mov dword [ebp - 0x1640], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1618], eax
test eax, eax
je 0xc317e6
mov ecx, dword [ebp - 0x1660]
mov dl, bl
mov dword [ebp - 0x1620], ecx
mov ecx, esi
and ecx, 7
mov dword [ebp - 0x15d8], eax
mov dword [ebp - 0x710], 0xab69605e
mov eax, ebx
mov dword [ebp - 0x70c], 0x7f1137f
mov dword [ebp - 0x15e8], ecx
je 0xc31792
mov dword [ebp - 0x1754], ebx
mov dword [ebp - 0x1624], eax
mov dword [ebp - 0x15f8], ebx
test ecx, ecx
je 0xc3126c
mov esi, dword [ebp - 0x1620]
movzx eax, byte [esi]
inc esi
mov ecx, dword [ebp - 0x16d0]
cmp dword [ebp - 0x15f8], edi
jge 0xc31238
add ecx, 0xffffffe0
shl eax, cl
or dword [ebp - 0x1624], eax
mov ecx, dword [ebp - 0x16d0]
jmp 0xc31240
shl eax, cl
or dword [ebp - 0x1754], eax
mov eax, dword [ebp - 0x15f8]
sub ecx, 8
inc eax
mov dword [ebp - 0x16d0], ecx
mov ecx, dword [ebp - 0x15e8]
mov dword [ebp - 0x15f8], eax
cmp eax, ecx
jl 0xc31213
mov eax, dword [ebp - 0x1624]
mov dword [ebp - 0x1620], esi
mov esi, dword [ebp - 0x1754]
xor eax, 0x92f65a5
xor esi, 0x699a899c
mov dword [ebp - 0x15f8], eax
mov dword [ebp - 0x1668], esi
mov dword [ebp - 0x1628], eax
mov dword [ebp - 0x1604], esi
mov dword [ebp - 0x1608], ebx
test ecx, ecx
je 0xc312fb
mov eax, dword [ebp - 0x15d8]
mov esi, ebx
lea ecx, [eax + 1]
mov dword [ebp - 0x15d8], ecx
cmp esi, edi
jge 0xc312c3
rol dword [ebp - 0x1628], 8
mov ecx, dword [ebp - 0x1628]
jmp 0xc312d0
rol dword [ebp - 0x1604], 8
mov ecx, dword [ebp - 0x1604]
mov dword [ebp - 0x1608], ecx
inc esi
mov byte [eax], cl
mov ecx, dword [ebp - 0x15e8]
mov eax, dword [ebp - 0x15d8]
cmp esi, ecx
jl 0xc312a7
mov esi, dword [ebp - 0x1668]
mov dword [ebp - 0x15d8], eax
mov eax, dword [ebp - 0x15f8]
cmp ecx, edi
jbe 0xc3176c
push 8
pop ecx
sub ecx, dword [ebp - 0x15e8]
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0x1668], esi
mov esi, dword [ebp - 0x1640]
mov eax, esi
shr eax, 3
mov dword [ebp - 0x15e8], eax
test eax, eax
je 0xc31725
movzx esi, word [ebp - 0x70e]
mov eax, 0x7f1137f
movzx ecx, word [ebp - 0x70a]
mov edi, 0xab69605e
movzx eax, ax
mov ebx, edi
mov dword [ebp - 0x1604], eax
xor ebx, 0x7f1137f
movzx eax, di
mov dword [ebp - 0x15ec], eax
mov eax, dword [ebp - 0x15d8]
mov dword [ebp - 0x15dc], esi
add eax, 7
mov esi, dword [ebp - 0x1620]
mov dword [ebp - 0x1608], ecx
add esi, 2
mov ecx, dword [ebp - 0x15f8]
mov dword [ebp - 0x1628], ebx
mov dword [ebp - 0x15d8], eax
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor ecx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
shl edi, 8
add esi, 8
or edi, eax
mov dword [ebp - 0x1620], esi
mov eax, dword [ebp - 0x1668]
xor eax, edi
xor eax, ecx
xor eax, dword [ebp - 0x1628]
mov dword [ebp - 0x1668], eax
mov esi, eax
rol dword [ebp - 0x1668], 0xa
sub eax, 0xab69605e
rol eax, 5
imul eax, dword [ebp - 0x1604]
add eax, dword [ebp - 0x1668]
xor ecx, eax
mov eax, 0x7f1137f
mov dword [ebp - 0x15f8], ecx
add ecx, eax
mov eax, dword [ebp - 0x15f8]
ror ecx, 9
imul ecx, dword [ebp - 0x15dc]
rol eax, 2
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
sub ecx, dword [ebp - 0x1604]
imul ecx, dword [ebp - 0x15ec]
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0x15f8]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x15f8], eax
xor ecx, dword [ebp - 0x15dc]
rol ecx, 6
imul ecx, dword [ebp - 0x1608]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, 0xab69605e
sub eax, ecx
mov ecx, dword [ebp - 0x15f8]
xor ecx, eax
mov dword [ebp - 0x15f8], ecx
mov eax, dword [ebp - 0x15f8]
xor eax, dword [ebp - 0x1604]
imul eax, dword [ebp - 0x15dc]
ror ecx, 6
xor ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov eax, esi
rol eax, 2
lea ecx, [esi + ecx]
ror ecx, 0xf
imul ecx, dword [ebp - 0x15ec]
add ecx, eax
mov eax, dword [ebp - 0x15f8]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x15f8], eax
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0x1608]
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, 0xab69605e
ror eax, 0xa
ror ecx, 0xc
imul ecx, dword [ebp - 0x1604]
xor ecx, eax
mov eax, dword [ebp - 0x15f8]
xor eax, ecx
mov ecx, dword [ebp - 0x1608]
xor ecx, eax
mov dword [ebp - 0x15f8], eax
imul ecx, dword [ebp - 0x15dc]
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov ecx, dword [ebp - 0x15f8]
mov eax, esi
not eax
ror eax, 5
add eax, dword [ebp - 0x15ec]
imul eax, dword [ebp - 0x1608]
xor ecx, eax
mov eax, ecx
mov dword [ebp - 0x15f8], ecx
sub eax, dword [ebp - 0x1608]
xor eax, esi
mov esi, dword [ebp - 0x15f8]
xor eax, 0xab69605e
mov ecx, eax
mov dword [ebp - 0x1668], eax
xor ecx, dword [ebp - 0x1608]
rol ecx, 2
imul ecx, dword [ebp - 0x1604]
shr eax, 2
add ecx, eax
xor esi, ecx
mov eax, esi
rol eax, 7
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul ecx, dword [ebp - 0x15dc]
add ecx, eax
mov eax, dword [ebp - 0x1668]
xor eax, ecx
mov dword [ebp - 0x1668], eax
mov ecx, eax
xor eax, dword [ebp - 0x1604]
imul eax, dword [ebp - 0x15ec]
ror ecx, 9
add ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0x15dc]
rol ecx, 5
imul ecx, dword [ebp - 0x1608]
rol eax, 7
add ecx, eax
xor dword [ebp - 0x1668], ecx
mov ecx, dword [ebp - 0x1668]
xor esi, ecx
xor esi, 0xab69605e
xor esi, 0x7f1137f
mov eax, esi
ror eax, 3
sub eax, dword [ebp - 0x15dc]
imul eax, dword [ebp - 0x1604]
xor ecx, eax
mov dword [ebp - 0x1668], ecx
sub ecx, 0x7f1137f
ror ecx, 1
imul ecx, dword [ebp - 0x15ec]
mov eax, dword [ebp - 0x1668]
ror eax, 6
sub ecx, eax
xor esi, ecx
mov ecx, 0xab69605e
mov eax, esi
rol eax, 0xe
lea ecx, [esi + ecx]
rol ecx, 3
imul ecx, dword [ebp - 0x1608]
add ecx, eax
mov eax, dword [ebp - 0x1668]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0x1668], eax
rol ecx, 0xf
imul ecx, dword [ebp - 0x1604]
ror eax, 0xe
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0x15ec]
imul ecx, dword [ebp - 0x15dc]
shr eax, 3
xor ecx, eax
mov eax, dword [ebp - 0x1668]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x1668], eax
xor ecx, 0x7f1137f
rol eax, 2
rol ecx, 4
imul ecx, dword [ebp - 0x15ec]
xor ecx, eax
mov eax, dword [ebp - 0x1668]
xor ecx, dword [ebp - 0x1624]
xor eax, dword [ebp - 0x1754]
xor esi, ecx
mov ecx, esi
mov dword [ebp - 0x15f8], esi
mov esi, dword [ebp - 0x15d8]
mov dword [ebp - 0x1624], ebx
mov dword [ebp - 0x1754], edi
mov byte [esi - 4], cl
mov byte [esi], al
ror ecx, 8
mov byte [esi - 5], cl
ror eax, 8
mov byte [esi - 1], al
ror ecx, 8
mov byte [esi - 6], cl
ror eax, 8
mov byte [esi - 2], al
ror ecx, 8
ror eax, 8
mov byte [esi - 7], cl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror ecx, 8
sub dword [ebp - 0x15e8], 1
mov dword [ebp - 0x15d8], esi
mov esi, dword [ebp - 0x1620]
mov dword [ebp - 0x1668], eax
jne 0xc31394
mov esi, dword [ebp - 0x1640]
xor ebx, ebx
push 4
pop edi
mov ecx, dword [ebp - 0x1618]
mov eax, ebx
test esi, esi
je 0xc31739
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0xc31731
movzx eax, dl
cdq
mov dword [ebp - 0x1640], edx
mov edx, dword [ebp - 0x1660]
cmp eax, dword [esi + edx]
jne 0xc317a9
mov eax, dword [ebp - 0x1640]
cmp eax, dword [esi + edx + 4]
jne 0xc317a9
mov dword [ebp - 0x16a0], ecx
mov ecx, ebx
mov dword [ebp - 0x1674], esi
mov esi, ebx
jmp 0xc317ae
mov dword [ebp - 0x1668], ebx
jae 0xc31319
mov ecx, edi
sub ecx, dword [ebp - 0x15e8]
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0x15f8], eax
jmp 0xc31319
mov dword [ebp - 0x1624], ebx
mov dword [ebp - 0x1668], ebx
mov dword [ebp - 0x15f8], eax
jmp 0xc3131f
mov esi, 0xc004d501
test ecx, ecx
je 0xc317c1
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc317e6
mov eax, dword [ebp - 0x16a0]
mov esi, 0x10000000
mov ecx, dword [ebp - 0x1674]
mov dword [ebp - 0x1684], eax
mov eax, ebx
mov dword [ebp - 0x168c], ecx
jmp 0xc317f1
mov eax, dword [ebp - 0x16a0]
mov esi, 0xd0000001
test eax, eax
je 0xc31804
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc31aa4
mov ecx, dword [ebp - 0x1684]
mov dword [ebp - 0x16d8], ebx
mov dword [ebp - 0x1848], ecx
cmp dword [ebp - 0x168c], edi
jb 0xc31a99
mov eax, dword [ecx]
mov edx, edi
mov dword [ebp - 0x16a0], eax
lea eax, [ebp - 0x1848]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc31a9e
lea eax, [ebp - 0x16d8]
mov edx, edi
push eax
xor ecx, ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc31a9e
mov eax, dword [ebp - 0x168c]
sub eax, dword [ebp - 0x16d8]
cmp eax, edi
jb 0xc31a99
mov ecx, dword [ebp - 0x1848]
mov edx, edi
mov eax, dword [ecx]
mov dword [ebp - 0x1674], eax
lea eax, [ebp - 0x1848]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc31a9e
mov ecx, dword [ebp - 0x16d8]
lea eax, [ebp - 0x16d8]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc31a9e
mov eax, dword [ebp - 0x168c]
mov ecx, dword [ebp - 0x16d8]
sub eax, ecx
mov edx, dword [ebp - 0x1674]
cmp eax, edx
jb 0xc31a99
lea eax, [ebp - 0x16d8]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc31a9e
mov ecx, dword [ebp - 0x1684]
mov eax, dword [ebp - 0x1848]
mov esi, dword [ebp - 0x168c]
add ecx, esi
mov edx, dword [ebp - 0x1674]
add eax, edx
cmp ecx, eax
jb 0xc31a99
mov eax, dword [ebp - 0x1848]
sub esi, eax
sub esi, edx
add esi, dword [ebp - 0x1684]
cmp esi, 8
jae 0xc31a99
mov dword [ebp - 0x1660], ebx
mov ecx, ebx
mov dword [ebp - 0x16d8], ecx
mov esi, ebx
test eax, eax
je 0xc31a24
lea ecx, [ebp - 0x184c]
mov dword [ebp - 0x1640], eax
push ecx
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc31a9e
mov eax, dword [ebp - 0x1640]
mov ecx, dword [ebp - 0x184c]
jmp 0xc31a10
lea ecx, [ebp - 0x1850]
mov edx, edi
push ecx
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc31a9e
mov eax, dword [ebp - 0x184c]
cmp dword [ebp - 0x1850], eax
ja 0xc31a4b
mov edx, dword [ebp - 0x1640]
lea eax, [ebp - 0x1854]
push eax
mov ecx, edi
mov edx, dword [edx]
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc319c8
mov eax, dword [ebp - 0x1854]
mov dword [ebp - 0x1858], eax
jmp 0xc319ce
mov eax, dword [ebp - 0x1858]
test esi, esi
js 0xc31a9e
lea ecx, [ebp - 0x185c]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0x1640]
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc31a9e
mov eax, dword [ebp - 0x185c]
mov ecx, dword [ebp - 0x184c]
mov dword [ebp - 0x1640], eax
cmp eax, ecx
ja 0xc31a4b
inc dword [ebp - 0x1660]
cmp eax, ecx
jb 0xc31972
cmp eax, ecx
jne 0xc31a4b
mov edx, dword [ebp - 0x1674]
mov ecx, ebx
test edx, edx
je 0xc31a5a
push edx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x16d8], ecx
test ecx, ecx
jne 0xc31a52
mov esi, 0xc0000017
jmp 0xc31a87
mov esi, 0xc000000d
jmp 0xc31a9e
mov edx, dword [ebp - 0x1674]
mov esi, ebx
mov eax, dword [ebp - 0x1848]
test eax, eax
je 0xc31a75
push edx
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [ebp - 0x16d8]
add esp, 0xc
mov eax, dword [ebp - 0x1660]
mov dword [ebp - 0x1ae4], ecx
mov dword [ebp - 0x1aec], eax
test esi, esi
js 0xc31a9e
mov eax, dword [ebp - 0x16a0]
cmp eax, dword [ebp - 0x1aec]
je 0xc31a9e
mov esi, 0xc000003e
or esi, 0x10000000
mov eax, dword [ebp - 0x16cc]
test eax, eax
je 0xc31abd
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x16c8]
test eax, eax
je 0xc31b33
mov ecx, dword [eax + 4]
test ecx, ecx
je 0xc31ae6
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x16c8]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0xc31b05
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x16c8]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0xc31b24
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x16c8]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x16c4]
test eax, eax
je 0xc31b4c
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x16c0]
test eax, eax
je 0xc31b65
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x16bc]
test eax, eax
je 0xc31bde
cmp dword [eax + 4], 0
je 0xc31b8f
push dword [eax + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x16bc]
mov dword [eax + 4], ebx
cmp dword [eax + 0xc], 0
je 0xc31baf
push dword [eax + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x16bc]
mov dword [eax + 0xc], ebx
cmp dword [eax + 0x14], 0
je 0xc31bcf
push dword [eax + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x16bc]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1684]
test eax, eax
je 0xc31bf7
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc31cbf
xor eax, eax
inc eax
cmp dword [ebp - 0x1aec], eax
jb 0xc31cbf
mov esi, dword [ebp - 0x1ae4]
test esi, esi
je 0xc31cbf
cmp dword [ebp - 0x1aec], 0
jbe 0xc31cbf
lea eax, [ebp - 0x16e0]
mov dword [ebp - 0x16e0], esi
push eax
mov edx, edi
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc31cbf
mov eax, dword [esi]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x16e0]
cmp dword [esi], edi
jne 0xc31cbf
cmp dword [eax], 0
jl 0xc31cbf
xor eax, eax
inc eax
cmp dword [ebp - 0x1aec], eax
jbe 0xc31cbf
mov dword [ebp - 0x1864], esi
mov dword [ebp - 0x16e0], ebx
lea eax, [ebp - 0x1864]
mov edx, edi
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc31cbf
mov edx, dword [esi]
lea eax, [ebp - 0x1864]
mov ecx, dword [ebp - 0x1864]
push eax
call fcn.00a32533
test eax, eax
js 0xc31cbf
mov eax, dword [ebp - 0x16e0]
xor ecx, ecx
inc eax
inc ecx
mov dword [ebp - 0x16e0], eax
cmp eax, ecx
jae 0xc31cbf
mov esi, dword [ebp - 0x1864]
jmp 0xc31c6f
mov eax, dword [ebp - 0x1ab4]
jmp 0xc31cc5
mov eax, dword [ebp - 0x16b8]
test eax, eax
je 0xc31cd8
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0x1ae4]
test esi, esi
je 0xc31cf1
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x162c]
test eax, eax
je 0xc31d0a
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1664]
test eax, eax
je 0xc31d23
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x15bc]
mov dword [ebp - 0x15bc], ebx
mov dword [ebp - 0x18f8], eax
jmp 0xc27f3e
mov ecx, 0xc004f027
test ecx, ecx
js 0xc31d56
push 4
pop esi
cmp dword [ebp - 0x15c4], esi
jne 0xc31d56
mov ecx, dword [eax]
mov dword [ebp - 0x1748], ecx
test eax, eax
je 0xc31d67
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov dword [ebp - 0x18f8], ebx
cmp dword [ebp - 0x1748], 0
jne 0xc31d7d
call fcn.00c1cd38
test al, al
jne 0xc31d7d
xor eax, eax
jmp 0xc31d80
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret