Function at 0xc31fdf
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1b4c
call fcn.00af9320
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0xc963a0
call fcn.00af8a75
xor ebx, ebx
mov dword [ebp - 0x16bc], ebx
test al, al
je 0xc3c41f
xor eax, eax
mov edx, 0xc96238
mov dword [ebp - 0x16c0], eax
mov dword [ebp - 0x16c4], eax
mov dword [ebp - 0x1648], eax
mov dword [ebp - 0x15f8], eax
inc eax
mov ecx, eax
xor eax, eax
lock cmpxchg dword [edx], ecx
push 1
test eax, eax
pop eax
jne 0xc32035
mov eax, dword [0xc95890]
or ebx, 0xffffffff
mov dword [ebp - 0x16c8], ebx
mov edi, 0x9fbcf2
mov dword [ebp - 0x16cc], edi
mov dword [ebp - 0x16d0], 0x67
mov dword [ebp - 0x16dc], 0x337
mov dword [ebp - 0x1584], 0x10b
mov dword [ebp - 0x1560], 0x20b
test eax, eax
jne 0xc326c3
push 0x338
mov esi, eax
mov dword [ebp - 0x155c], eax
push eax
mov dword [ebp - 0x1550], eax
mov dword [ebp - 0x153c], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x166c], eax
test eax, eax
je 0xc326b7
xor edx, edx
mov dword [ebp - 0x6d4], 0xab69605e
add eax, 7
mov dword [ebp - 0x6d0], 0x7f1137f
mov cl, dl
mov dword [ebp - 0x1520], edx
mov dword [ebp - 0x151c], ebx
mov dword [ebp - 0x150c], eax
mov dword [ebp - 0x1508], edi
mov dword [ebp - 0x14f0], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0x1508]
xor edx, ebx
mov dword [ebp - 0x14fc], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0x1508]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0x1508]
shl edi, 8
add dword [ebp - 0x1508], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
mov dword [ebp - 0x1514], esi
mov esi, edx
xor esi, dword [ebp - 0x1514]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x14fc]
xor eax, edx
mov dword [ebp - 0x14fc], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x14fc]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x14fc]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x14fc], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x14fc]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x14fc]
xor edx, eax
mov dword [ebp - 0x14fc], edx
mov eax, dword [ebp - 0x14fc]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x14fc]
xor eax, edx
mov dword [ebp - 0x14fc], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x14fc]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x14fc]
xor eax, edx
mov dword [ebp - 0x14fc], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x14fc]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0x14fc]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0x1514], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1514]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x1514]
xor eax, edx
mov dword [ebp - 0x1514], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x1514], edx
mov edx, dword [ebp - 0x1514]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x1514], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1514]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x1514]
xor eax, edx
mov dword [ebp - 0x1514], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1514]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x1514]
xor eax, edx
mov dword [ebp - 0x1514], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1514]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x1514]
xor edx, dword [ebp - 0x1520]
xor eax, dword [ebp - 0x151c]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x14fc], esi
mov esi, dword [ebp - 0x150c]
mov dword [ebp - 0x151c], edi
mov edi, dword [ebp - 0x1508]
mov dword [ebp - 0x1520], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x14f0], 1
mov dword [ebp - 0x150c], esi
mov esi, eax
mov dword [ebp - 0x1514], eax
jne 0xc320ff
mov esi, dword [ebp - 0x166c]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc32480
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc324b9
cmp edx, dword [0x9fc02c]
jne 0xc324b9
mov ebx, esi
mov dword [ebp - 0x1514], 0x337
xor eax, eax
mov dword [ebp - 0x153c], ebx
mov esi, eax
mov edi, eax
jmp 0xc324cd
or dword [ebp - 0x1514], 0xffffffff
mov edi, 0xc004d501
mov ebx, dword [ebp - 0x153c]
xor eax, eax
test esi, esi
je 0xc324e0
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0xc326b1
mov eax, dword [ebp - 0x1514]
xor ecx, ecx
push 0x40
mov esi, 0xc960a0
mov edi, ebx
mov byte [eax + ebx], cl
xor eax, eax
push eax
push esi
call fcn.00ab4bf6
add esp, 0xc
cmp byte [ebx], 0
je 0xc32645
push 4
mov ebx, esi
pop esi
mov ecx, edi
mov edx, edi
lea eax, [ecx + 2]
mov dword [ebp - 0x1514], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x16bc]
jne 0xc32523
sub ecx, dword [ebp - 0x1514]
xor eax, eax
sar ecx, 1
push ebx
push edx
push eax
lea edi, [edi + ecx*2]
add edi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc326aa
xor eax, eax
mov edx, 0x5a4d
mov ecx, eax
mov eax, dword [ebx]
mov dword [ebp - 0x1550], ecx
cmp word [eax], dx
je 0xc32576
mov ecx, 0xc000007b
mov dword [ebp - 0x1550], ecx
jmp 0xc325be
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc32569
add edx, dword [ebx]
cmp edx, dword [ebx]
jb 0xc32569
cmp dword [edx], 0x4550
jne 0xc32569
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0x1584]
je 0xc325ac
cmp ax, word [ebp - 0x1560]
je 0xc325ac
mov ecx, 0xc000000d
jmp 0xc3256e
mov eax, dword [edx + 0x78]
mov dword [ebx + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [ebx + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [ebx + 4], eax
mov eax, dword [edi]
xor edx, edx
add edi, esi
mov dword [ebp - 0x1514], eax
mov dword [ebp - 0x14fc], edx
test eax, eax
je 0xc32639
mov edx, edi
mov dword [ebp - 0x14f0], edi
lea eax, [edx + 1]
mov dword [ebp - 0x1508], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc325e5
sub edx, dword [ebp - 0x1508]
inc edi
add edi, edx
test ecx, ecx
js 0xc3261e
push dword [ebp - 0x14f0]
push dword [ebx]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc32645
mov ecx, dword [ebp - 0x155c]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x1550]
mov eax, dword [ebp - 0x14fc]
inc dword [ebp - 0x155c]
inc eax
mov dword [ebp - 0x14fc], eax
cmp eax, dword [ebp - 0x1514]
jb 0xc325d4
add ebx, 0x10
cmp byte [edi], 0
jne 0xc32516
mov ebx, dword [ebp - 0x1550]
mov esi, dword [ebp - 0x153c]
test esi, esi
je 0xc32666
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc326be
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc3267f
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc3266e
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc326c9
mov ebx, 0xc000007a
jmp 0xc3264b
mov esi, dword [ebp - 0x153c]
mov ebx, 0xc000007a
jmp 0xc32651
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
xor eax, eax
xor edx, edx
mov dword [ebp - 0x1514], eax
mov edi, eax
mov dword [ebp - 0x14fc], eax
mov dword [ebp - 0x14f0], eax
mov eax, dword fs:[0x30]
cmp dword [eax + 0x1d4], edx
je 0xc329c8
mov esi, dword [0xc93088]
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x1508], ecx
test ecx, ecx
jne 0xc32723
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc32a12
xor eax, eax
xor edx, edx
mov esi, eax
mov dword [ebp - 0x14f0], eax
mov ebx, dword [0xc93098]
lea edx, [ebp - 0x16ec]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xc327b4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc32796
xor eax, eax
test esi, esi
jne 0xc3278f
push dword [ebp - 0x16ec]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc32788
mov eax, dword [ebp - 0x16ec]
mov ecx, dword [ebp - 0x1508]
jmp 0xc3272f
mov ebx, 0x8007000e
jmp 0xc327b0
mov ebx, 0x80004005
jmp 0xc327c4
test eax, eax
jne 0xc327a1
mov ebx, 0x80004005
jmp 0xc327b0
jg 0xc327a7
mov ebx, eax
jmp 0xc327b0
movzx ebx, ax
or ebx, 0x80070000
xor eax, eax
jmp 0xc327c4
mov ebx, dword [ebp - 0x14f0]
xor eax, eax
mov dword [ebp - 0x1514], esi
mov esi, eax
test esi, esi
je 0xc327d7
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc329f3
mov esi, dword [0xc93094]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x1508], ecx
test ecx, ecx
jne 0xc32829
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc32819
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc329f3
mov ebx, 0x80004005
jmp 0xc329f3
xor eax, eax
xor edx, edx
mov esi, eax
mov dword [ebp - 0x14f0], eax
mov ebx, dword [0xc93098]
lea edx, [ebp - 0x16f8]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xc328c6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc328a2
xor eax, eax
test esi, esi
jne 0xc32895
push dword [ebp - 0x16f8]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc3288e
mov eax, dword [ebp - 0x16f8]
mov ecx, dword [ebp - 0x1508]
jmp 0xc32835
mov ebx, 0x8007000e
jmp 0xc328bc
mov ebx, 0x80004005
mov dword [ebp - 0x14f0], ebx
jmp 0xc328d2
test eax, eax
jne 0xc328ad
mov ebx, 0x80004005
jmp 0xc328bc
jg 0xc328b3
mov ebx, eax
jmp 0xc328bc
movzx ebx, ax
or ebx, 0x80070000
mov dword [ebp - 0x14f0], ebx
xor eax, eax
jmp 0xc328d2
mov ebx, dword [ebp - 0x14f0]
xor eax, eax
mov edi, esi
mov esi, eax
test esi, esi
je 0xc328e5
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc329d8
mov eax, dword [ebp - 0x1514]
test eax, eax
je 0xc329cc
push 4
mov ecx, eax
mov edx, 0x9fb9c0
pop eax
mov si, word [ecx]
cmp si, word [edx]
jne 0xc3292c
test si, si
je 0xc32925
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0xc3292c
add ecx, eax
add edx, eax
test si, si
jne 0xc32905
xor ebx, ebx
xor ecx, ecx
inc ebx
jmp 0xc32933
sbb ecx, ecx
xor ebx, ebx
inc ebx
or ecx, ebx
test ecx, ecx
jne 0xc329cc
test edi, edi
je 0xc329cc
mov edx, 0x9f98b0
mov ecx, edi
mov si, word [ecx]
cmp si, word [edx]
jne 0xc32970
test si, si
je 0xc3296a
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0xc32970
add ecx, eax
add edx, eax
test si, si
jne 0xc3294a
xor edx, edx
mov ecx, edx
jmp 0xc32976
sbb ecx, ecx
or ecx, ebx
xor edx, edx
test ecx, ecx
jne 0xc329cc
push eax
lea eax, [ebp - 0x1654]
mov dword [ebp - 0x1654], edx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
jne 0xc329bb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc329b2
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc329de
mov ebx, 0x80004005
jmp 0xc329de
test byte [ebp - 0x1654], 0xf
jne 0xc329cc
mov eax, ebx
jmp 0xc329d2
mov eax, edx
jmp 0xc329d2
mov eax, dword [ebp - 0x14fc]
mov dword [ebp - 0x15f8], eax
mov ebx, dword [ebp - 0x14f0]
test edi, edi
je 0xc329f3
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1514]
test eax, eax
je 0xc32a0e
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc32a1a
xor eax, eax
mov dword [ebp - 0x15f8], eax
push 4
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x1514], esi
test esi, esi
jne 0xc32b31
mov ebx, 0x8007000e
mov eax, dword [ebp - 0x1654]
mov dword [ebp - 0x1648], eax
mov edx, 0xc96238
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc32a4a
mov eax, dword [0xc95890]
mov esi, dword [ebp - 0x1514]
test eax, eax
jle 0xc32ab4
sub eax, 1
mov dword [0xc95890], eax
jne 0xc32ab4
xor eax, eax
mov edi, eax
mov eax, dword [edi + 0xc960a0]
test eax, eax
je 0xc32a85
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xc32a74
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1514]
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
test esi, esi
je 0xc32ac8
push esi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, dword [ebp - 0x16c4]
test ebx, ebx
jns 0xc3c409
cmp ebx, 0xd0000034
je 0xc32b02
cmp ebx, 0xd00000e5
je 0xc3c3fc
cmp ebx, 0xc004d501
je 0xc3c3fc
cmp ebx, 0xd000003e
jne 0xc3c401
mov esi, dword [ebp - 0x16c0]
test eax, eax
je 0xc32b13
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
xor eax, eax
inc eax
test esi, esi
je 0xc32b22
cmp esi, eax
je 0xc32b22
xor ebx, ebx
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret
xor eax, eax
lea edi, [ebp - 0x1a1c]
mov dword [ebp - 0x14fc], eax
mov dword [ebp - 0x14f0], eax
mov dword [ebp - 0x1508], eax
mov dword [ebp - 0x1a08], eax
mov dword [ebp - 0x150c], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x151c], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1520], eax
mov ebx, 0xc0000017
mov dword [ebp - 0x166c], 0x38
test eax, eax
je 0xc358c2
push 0x28
pop ecx
mov esi, 0xc94ea0
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, eax
mov dword [ebp - 0x14fc], edi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x153c], ecx
test ecx, ecx
jne 0xc32bcf
mov dword [ebp - 0x152c], ebx
jmp 0xc358ce
mov eax, dword [0xc94e98]
mov dword [ecx], eax
mov eax, dword [0xc94e9c]
mov dword [ecx + 4], eax
mov dword [ebp - 0x14f0], ecx
rdtsc
mov dword [ebp - 0x1550], eax
mov dword [ebp - 0x155c], edx
xor eax, eax
mov dword [ebp - 0x1704], eax
lea eax, [ebp - 0x1714]
push eax
push 4
pop esi
mov edx, esi
mov ecx, esi
call fcn.00a32533
mov edi, dword [ebp - 0x1714]
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
jns 0xc32c2a
mov edi, dword [ebp - 0x1728]
jmp 0xc358c8
lea eax, [ebp - 0x1704]
mov edx, edi
push eax
xor ecx, ecx
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x152c], ebx
jl 0xc358c8
lea eax, [ebp - 0x1740]
mov edx, 0xa0
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc358c8
mov edi, dword [ebp - 0x1740]
mov ecx, dword [ebp - 0x1704]
lea eax, [ebp - 0x1704]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x152c], ebx
jl 0xc358c8
lea eax, [ebp - 0x1744]
mov ecx, esi
push eax
push 8
pop edx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc358c8
mov edi, dword [ebp - 0x1744]
mov ecx, dword [ebp - 0x1704]
lea eax, [ebp - 0x1704]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x152c], ebx
jl 0xc358c8
lea eax, [ebp - 0x1748]
mov ecx, esi
push eax
push 8
pop edx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc358c8
mov edi, dword [ebp - 0x1748]
mov ecx, dword [ebp - 0x1704]
lea eax, [ebp - 0x1704]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x152c], ebx
jl 0xc358c8
lea eax, [ebp - 0x174c]
mov edx, SysReAllocString
push eax
mov ecx, 0x9fe768
call fcn.00a41606
test eax, eax
jns 0xc32d61
mov ebx, 0xc000003e
jmp 0xc358c2
mov edx, dword [ebp - 0x174c]
lea eax, [ebp - 0x1750]
inc edx
mov ecx, esi
mov dword [ebp - 0x174c], edx
add edx, edx
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc358c8
mov edi, dword [ebp - 0x1750]
mov ecx, dword [ebp - 0x1704]
lea eax, [ebp - 0x1704]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x152c], ebx
jl 0xc358c8
lea eax, [ebp - 0x1754]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc358c8
mov edi, dword [ebp - 0x1754]
mov ecx, dword [ebp - 0x1704]
lea eax, [ebp - 0x1704]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x152c], ebx
jl 0xc358c8
lea eax, [ebp - 0x1758]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc358c8
mov edi, dword [ebp - 0x1758]
mov ecx, dword [ebp - 0x1704]
lea eax, [ebp - 0x1704]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x152c], ebx
jl 0xc358c8
mov eax, dword [ebp - 0x1704]
push eax
push 8
mov dword [ebp - 0x1a0c], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x1560], edi
test edi, edi
jne 0xc32e8a
mov ebx, 0xc0000017
jmp 0xc358c2
mov eax, edi
mov dword [ebp - 0x1508], eax
mov dword [ebp - 0x1a08], eax
xor eax, eax
mov dword [ebp - 0x1584], eax
mov dword [ebp - 0x175c], eax
mov dword [ebp - 0x1760], edi
lea eax, [ebp - 0x19b8]
mov dword [ebp - 0x19bc], esi
push eax
mov edx, esi
mov ecx, edi
call fcn.00a32533
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x152c], ebx
mov ecx, eax
test ebx, ebx
js 0xc32f04
mov ecx, dword [ebp - 0x1704]
lea eax, [edi + 8]
add ecx, edi
cmp eax, ecx
jbe 0xc32eeb
mov ebx, 0xc0000023
jmp 0xc358c2
mov eax, dword [ebp - 0x19b8]
xor edx, edx
mov dword [edi], esi
mov dword [eax], edx
xor eax, eax
inc eax
mov dword [ebp - 0x1584], eax
mov ecx, eax
jmp 0xc32f06
xor edx, edx
test ebx, ebx
js 0xc358c8
mov dword [ebp - 0x14e4], edx
mov eax, edi
mov dword [ebp - 0x1764], eax
test ecx, ecx
je 0xc32f97
mov edx, dword [eax]
lea ecx, [ebp - 0x1768]
push ecx
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc32f4a
mov eax, dword [ebp - 0x1768]
mov dword [ebp - 0x176c], eax
jmp 0xc32f50
mov eax, dword [ebp - 0x176c]
test ebx, ebx
js 0xc33008
lea ecx, [ebp - 0x1764]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0x1764]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc33008
mov eax, dword [ebp - 0x14e4]
inc eax
cmp eax, dword [ebp - 0x1584]
mov dword [ebp - 0x14e4], eax
mov eax, dword [ebp - 0x1764]
jb 0xc32f20
lea ecx, [ebp - 0x19d8]
mov dword [ebp - 0x19dc], 0xa0
push ecx
mov edx, esi
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc33008
mov edx, dword [ebp - 0x1764]
mov ecx, dword [ebp - 0x1704]
add ecx, edi
lea eax, [edx + 0xa4]
cmp eax, ecx
ja 0xc32ee1
mov eax, dword [ebp - 0x1584]
mov esi, dword [ebp - 0x1520]
inc eax
mov edi, dword [ebp - 0x19d8]
push 0x28
pop ecx
mov dword [edx], 0xa0
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x1560]
push 4
mov dword [ebp - 0x1584], eax
pop esi
jmp 0xc3300e
mov eax, dword [ebp - 0x1584]
test ebx, ebx
js 0xc358c8
xor edx, edx
mov ecx, edi
mov dword [ebp - 0x14e4], ecx
mov dword [ebp - 0x1520], edx
test eax, eax
je 0xc3308e
mov edx, dword [ecx]
lea eax, [ebp - 0x1770]
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc33054
mov eax, dword [ebp - 0x1770]
mov dword [ebp - 0x1774], eax
jmp 0xc3305a
mov eax, dword [ebp - 0x1774]
test ebx, ebx
js 0xc33100
mov edx, dword [ebp - 0x14e4]
lea ecx, [edx + eax]
cmp ecx, edx
jb 0xc330f6
mov eax, dword [ebp - 0x1520]
inc eax
mov dword [ebp - 0x14e4], ecx
mov dword [ebp - 0x1520], eax
cmp eax, dword [ebp - 0x1584]
jb 0xc3302a
lea eax, [ebp - 0x1940]
mov dword [ebp - 0x1944], 8
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc33100
mov edx, dword [ebp - 0x14e4]
mov ecx, dword [ebp - 0x1704]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xc32ee1
mov ecx, dword [ebp - 0x1940]
mov dword [edx], 8
mov edx, dword [ebp - 0x153c]
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x1584]
inc eax
mov dword [ebp - 0x1584], eax
jmp 0xc33106
mov ebx, 0xc0000095
jmp 0xc358c2
mov eax, dword [ebp - 0x1584]
test ebx, ebx
js 0xc358c8
mov ecx, dword [ebp - 0x1550]
xor edx, edx
mov dword [ebp - 0x194c], ecx
mov ecx, dword [ebp - 0x155c]
mov dword [ebp - 0x1948], ecx
mov ecx, edi
mov dword [ebp - 0x14e4], ecx
mov dword [ebp - 0x1520], edx
test eax, eax
je 0xc3319e
mov edx, dword [ecx]
lea eax, [ebp - 0x177c]
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc33164
mov eax, dword [ebp - 0x177c]
mov dword [ebp - 0x1780], eax
jmp 0xc3316a
mov eax, dword [ebp - 0x1780]
test ebx, ebx
js 0xc358c8
mov edx, dword [ebp - 0x14e4]
lea ecx, [edx + eax]
cmp ecx, edx
jb 0xc330f6
mov eax, dword [ebp - 0x1520]
inc eax
mov dword [ebp - 0x14e4], ecx
mov dword [ebp - 0x1520], eax
cmp eax, dword [ebp - 0x1584]
jb 0xc3313a
lea eax, [ebp - 0x1970]
mov dword [ebp - 0x1974], 8
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc358c8
mov edx, dword [ebp - 0x14e4]
mov ecx, dword [ebp - 0x1704]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xc32ee1
mov eax, dword [ebp - 0x1970]
mov ecx, dword [ebp - 0x1550]
inc dword [ebp - 0x1584]
mov dword [edx], 8
mov dword [eax], ecx
mov ecx, dword [ebp - 0x155c]
mov dword [eax + 4], ecx
test ebx, ebx
js 0xc358c8
lea eax, [ebp - 0x1788]
mov edx, SysReAllocString
push eax
mov ecx, 0x9fe768
call fcn.00a41606
test eax, eax
js 0xc32d57
mov ecx, dword [ebp - 0x1788]
lea eax, [ebp - 0x1788]
xor edx, edx
push eax
inc edx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc358c8
mov eax, dword [ebp - 0x1788]
lea edx, [eax + eax]
mov dword [ebp - 0x14e4], edx
test edx, edx
je 0xc3331b
mov ecx, dword [ebp - 0x1584]
xor eax, eax
mov dword [ebp - 0x152c], eax
mov ebx, edi
mov dword [ebp - 0x1520], ebx
test ecx, ecx
je 0xc332a6
mov eax, dword [ebx]
add eax, 4
cmp eax, esi
jb 0xc332f0
add eax, ebx
cmp eax, ebx
jb 0xc332f0
mov ebx, eax
mov eax, dword [ebp - 0x152c]
inc eax
mov dword [ebp - 0x1520], ebx
mov dword [ebp - 0x152c], eax
cmp eax, ecx
jb 0xc3327e
lea eax, [ebp - 0x19f8]
mov dword [ebp - 0x19fc], edx
push eax
mov edx, esi
mov ecx, ebx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc358c8
mov eax, dword [ebp - 0x14e4]
mov ecx, dword [ebp - 0x1704]
add eax, 4
mov edx, dword [ebp - 0x1520]
add ecx, edi
add eax, edx
cmp eax, ecx
jbe 0xc332f7
mov ebx, 0xc0000023
jmp 0xc33320
mov ebx, 0xc0000095
jmp 0xc33320
mov eax, dword [ebp - 0x14e4]
push eax
push 0x9fe768
push dword [ebp - 0x19f8]
mov dword [edx], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
inc dword [ebp - 0x1584]
jmp 0xc33326
mov ebx, 0xc000000d
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc358c8
mov eax, dword [ebp - 0x15f8]
mov ebx, edi
mov ecx, dword [ebp - 0x1584]
mov dword [ebp - 0x1798], eax
xor eax, eax
mov dword [ebp - 0x14e4], ebx
mov edx, eax
test ecx, ecx
je 0xc33370
mov eax, dword [ebx]
add eax, 4
cmp eax, esi
jb 0xc333ca
add eax, ebx
cmp eax, ebx
jb 0xc330f6
inc edx
mov ebx, eax
mov dword [ebp - 0x14e4], ebx
cmp edx, ecx
jb 0xc33350
lea eax, [ebp - 0x1a00]
mov dword [ebp - 0x1a04], esi
push eax
mov edx, esi
mov ecx, ebx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc333d7
mov edx, dword [ebp - 0x14e4]
mov ecx, dword [ebp - 0x1704]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xc32ee1
mov eax, dword [ebp - 0x1a00]
mov ecx, dword [ebp - 0x15f8]
mov dword [edx], esi
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1584]
inc ecx
mov dword [ebp - 0x1584], ecx
jmp 0xc333dd
mov ebx, 0xc0000095
mov dword [ebp - 0x152c], ebx
jmp 0xc333dd
mov ecx, dword [ebp - 0x1584]
test ebx, ebx
js 0xc358c8
xor eax, eax
mov dword [ebp - 0x179c], esi
mov ebx, edi
mov edx, eax
mov dword [ebp - 0x14e4], ebx
test ecx, ecx
je 0xc3341f
mov eax, dword [ebx]
add eax, 4
cmp eax, esi
jb 0xc334a3
add eax, ebx
cmp eax, ebx
jb 0xc330f6
inc edx
mov ebx, eax
mov dword [ebp - 0x14e4], ebx
cmp edx, ecx
jb 0xc333fb
lea eax, [ebp - 0x1980]
mov dword [ebp - 0x1984], esi
push eax
mov edx, esi
mov ecx, ebx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc358c8
mov edx, dword [ebp - 0x14e4]
mov ecx, dword [ebp - 0x1704]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xc32ee1
mov eax, dword [ebp - 0x1980]
inc dword [ebp - 0x1584]
mov dword [edx], esi
mov dword [eax], esi
test ebx, ebx
js 0xc358c8
lea eax, [ebp - 0x17a0]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov edi, dword [ebp - 0x17a0]
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
jns 0xc334b0
mov edi, dword [ebp - 0x17ac]
jmp 0xc3361f
mov ebx, 0xc0000095
mov dword [ebp - 0x152c], ebx
jmp 0xc3346e
lea eax, [ebp - 0x17b0]
mov dword [ebp - 0x1924], edi
push eax
push 8
pop edx
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc3361f
mov edi, dword [ebp - 0x17b0]
mov ecx, dword [ebp - 0x1924]
lea eax, [ebp - 0x1924]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc3361f
lea eax, [ebp - 0x17b4]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc3361f
mov edi, dword [ebp - 0x17b4]
mov ecx, dword [ebp - 0x1924]
lea eax, [ebp - 0x1924]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc3361f
lea eax, [ebp - 0x17d8]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc3361f
mov edi, dword [ebp - 0x17d8]
mov ecx, dword [ebp - 0x1924]
lea eax, [ebp - 0x1924]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc3361f
lea eax, [ebp - 0x17dc]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc3361f
mov edi, dword [ebp - 0x17dc]
mov ecx, dword [ebp - 0x1924]
lea eax, [ebp - 0x1924]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc3361f
lea eax, [ebp - 0x1628]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc3361f
mov edi, dword [ebp - 0x1628]
mov ecx, dword [ebp - 0x1924]
lea eax, [ebp - 0x1924]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0x1924]
mov dword [ebp - 0x152c], ebx
test ebx, ebx
jns 0xc33625
mov eax, dword [ebp - 0x1628]
mov dword [ebp - 0x14e4], eax
test ebx, ebx
js 0xc358c8
xor eax, eax
xor ecx, ecx
mov edi, eax
mov dword [ebp - 0x1520], eax
mov dword [ebp - 0x14e8], eax
mov dword [ebp - 0x14ec], eax
mov dword [ebp - 0x14d8], eax
mov dword [ebp - 0x14dc], eax
mov dword [ebp - 0x14d4], eax
mov dword [ebp - 0x1548], eax
mov dword [ebp - 0x1504], eax
rdtsc
mov dword [ebp - 0x153c], edi
mov dword [ebp - 0x14f8], ecx
mov dword [ebp - 0x152c], eax
mov dword [ebp - 0x14f4], edx
push 8
pop eax
mov dword [ebp - 0x17e0], eax
mov edx, dword [ebp - 0x1704]
lea ecx, [ebp - 0x17e0]
push ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3379b
mov eax, dword [ebp - 0x17e0]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0x1500], ecx
cmp ecx, eax
jae 0xc336ca
mov ebx, 0xc0000095
jmp 0xc3379b
mov dword [ebp - 0x17e0], ecx
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc336f0
mov ebx, 0xc0000017
jmp 0xc33795
mov eax, dword [ebp - 0x1584]
mov edx, esi
mov dword [edi], eax
mov ecx, edi
lea eax, [ebp - 0x17e4]
mov dword [ebp - 0x17e4], edi
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc33780
mov ecx, dword [ebp - 0x17e4]
mov edx, esi
mov eax, dword [ebp - 0x1704]
mov dword [ecx], eax
lea eax, [ebp - 0x17e4]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc33780
mov eax, dword [ebp - 0x1500]
push dword [ebp - 0x1704]
mov ecx, dword [ebp - 0x152c]
push dword [ebp - 0x1560]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0x14f4]
push dword [ebp - 0x17e4]
mov dword [edi + eax - 4], ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov dword [ebp - 0x1520], edi
xor eax, eax
mov edi, eax
mov eax, dword [ebp - 0x1500]
mov dword [ebp - 0x153c], eax
test edi, edi
je 0xc33795
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0x153c]
or ebx, 0x10000000
mov dword [ebp - 0x152c], ebx
jl 0xc351a6
xor eax, eax
mov dword [ebp - 0x1500], eax
cmp dword [ebp - 0x1520], eax
jne 0xc337c7
mov ebx, 0xc000000d
jmp 0xc33e11
test edi, edi
je 0xc33ee9
lea eax, [edi + 8]
push eax
mov dword [ebp - 0x14f4], eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
je 0xc33ee9
xor eax, eax
mov cl, al
mov edx, eax
test edi, edi
je 0xc33811
mov eax, dword [ebp - 0x1520]
xor cl, byte [edx + eax]
inc edx
cmp edx, edi
jb 0xc33809
mov eax, edi
mov dword [ebp - 0x6dc], 0xb1b54a58
shr eax, 3
mov esi, 0xc81ecb17
mov dword [ebp - 0x6d8], esi
mov dword [ebp - 0x1560], eax
test eax, eax
je 0xc33c1f
movzx eax, word [ebp - 0x6d6]
add ebx, 7
movzx edx, word [ebp - 0x6da]
mov dword [ebp - 0x14e0], eax
mov eax, 0xb1b54a58
movzx esi, si
movzx eax, ax
mov dword [ebp - 0x14d0], esi
mov esi, dword [ebp - 0x1520]
mov dword [ebp - 0x1524], eax
add esi, 2
xor eax, eax
mov dword [ebp - 0x1530], edx
mov dword [ebp - 0x1518], ebx
mov edx, eax
mov dword [ebp - 0x1510], esi
or ebx, 0xffffffff
mov dword [ebp - 0x1534], eax
mov dword [ebp - 0x1528], eax
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0x1510]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0x1510]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0x1510]
shl esi, 8
add dword [ebp - 0x1510], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov eax, ebx
sub eax, dword [ebp - 0x1524]
xor eax, edi
xor eax, edx
xor eax, 0xc81ecb17
mov edx, eax
mov dword [ebp - 0x1538], eax
xor edx, 0xc81ecb17
ror eax, 7
ror edx, 0xf
imul edx, dword [ebp - 0x1530]
add edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
mov eax, ebx
ror eax, 0xa
lea edx, [ebx + edx]
ror edx, 9
imul edx, dword [ebp - 0x14d0]
sub edx, eax
mov eax, dword [ebp - 0x1538]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x1538], eax
xor edx, dword [ebp - 0x14d0]
rol edx, 4
imul edx, dword [ebp - 0x14e0]
rol eax, 5
add edx, eax
mov eax, 0xc81ecb17
xor ebx, edx
mov edx, ebx
xor edx, 0xb1b54a58
sub eax, edx
mov edx, dword [ebp - 0x1538]
xor edx, eax
mov dword [ebp - 0x1538], edx
sub edx, dword [ebp - 0x1524]
imul edx, dword [ebp - 0x1530]
mov eax, dword [ebp - 0x1538]
shr eax, 6
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0x1538]
mov eax, ebx
ror eax, 0xf
xor eax, dword [ebp - 0x14d0]
imul eax, dword [ebp - 0x1524]
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [ebp - 0x14e0]
imul eax, dword [ebp - 0x14d0]
xor ebx, eax
mov eax, ebx
sub eax, dword [ebp - 0x1524]
sub eax, 0xc81ecb17
xor edx, eax
mov dword [ebp - 0x1538], edx
mov eax, dword [ebp - 0x1538]
xor eax, dword [ebp - 0x14e0]
imul eax, dword [ebp - 0x1530]
ror edx, 0xa
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0x1524]
rol edx, 6
imul edx, dword [ebp - 0x14d0]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0x1538]
xor eax, edx
mov dword [ebp - 0x1538], eax
ror eax, 0xf
sub eax, dword [ebp - 0x14e0]
imul eax, dword [ebp - 0x1524]
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0x14e0]
imul edx, dword [ebp - 0x1524]
shr eax, 1
xor edx, eax
mov eax, ebx
xor dword [ebp - 0x1538], edx
mov edx, ebx
sub edx, dword [ebp - 0x14d0]
rol edx, 3
imul edx, dword [ebp - 0x1524]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0x1538]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x1538], eax
sub edx, dword [ebp - 0x14d0]
imul edx, dword [ebp - 0x1530]
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 9
imul edx, dword [ebp - 0x14d0]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0x1538]
xor eax, edx
mov dword [ebp - 0x1538], eax
sub eax, dword [ebp - 0x14e0]
sub eax, 0xb1b54a58
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0x1530]
imul eax, dword [ebp - 0x1524]
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0x1538]
xor edx, eax
mov dword [ebp - 0x1538], edx
xor edx, dword [ebp - 0x14e0]
mov eax, dword [ebp - 0x1538]
rol edx, 4
imul edx, dword [ebp - 0x1530]
ror eax, 0x10
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 0xa
imul edx, dword [ebp - 0x14d0]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0x1538]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x1538], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, dword [ebp - 0x14e0]
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, 0xc81ecb17
rol eax, 2
rol edx, 8
imul edx, dword [ebp - 0x1524]
sub edx, eax
mov eax, dword [ebp - 0x1538]
xor eax, edx
mov edx, 0xc81ecb17
sub edx, eax
mov dword [ebp - 0x1538], eax
ror edx, 0xb
imul edx, dword [ebp - 0x1530]
ror eax, 0xc
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0x1530]
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0x14d0]
shr eax, 8
xor edx, eax
mov eax, dword [ebp - 0x1538]
xor eax, edx
mov edx, dword [ebp - 0x1518]
xor ebx, eax
xor eax, dword [ebp - 0x1534]
xor ebx, 0xc81ecb17
mov dword [ebp - 0x1534], edi
xor ebx, 0xb1b54a58
xor ebx, dword [ebp - 0x1528]
mov byte [edx - 4], al
mov byte [edx], bl
ror eax, 8
mov byte [edx - 5], al
ror ebx, 8
mov byte [edx - 1], bl
ror eax, 8
mov byte [edx - 6], al
ror ebx, 8
mov byte [edx - 2], bl
ror eax, 8
ror ebx, 8
mov byte [edx - 7], al
mov byte [edx - 3], bl
add edx, 8
ror eax, 8
ror ebx, 8
sub dword [ebp - 0x1560], 1
mov dword [ebp - 0x1528], esi
mov esi, dword [ebp - 0x1510]
mov dword [ebp - 0x1518], edx
mov edx, eax
mov dword [ebp - 0x1538], eax
jne 0xc33895
mov edi, dword [ebp - 0x153c]
mov ebx, dword [ebp - 0x152c]
movzx eax, cl
cdq
mov dword [ebx + edi], eax
mov dword [ebx + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x1538], esi
test esi, esi
jne 0xc33c51
mov ebx, 0xc0000017
jmp 0xc33d6c
mov edi, dword [ebp - 0x14f4]
push edi
push 8
mov dword [esi], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc33c79
mov ebx, 0xc0000017
xor eax, eax
jmp 0xc33cf9
mov dword [esi + 4], eax
push edi
push ebx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [esi + 8], eax
push eax
push 8
pop ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc33c6d
mov dword [esi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1538]
push ebx
push ebx
mov dword [esi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0xc33cdb
mov ebx, 0xc0000017
jmp 0xc33cf9
mov dword [esi + 0x14], ecx
mov ebx, eax
mov eax, dword [0xc94e90]
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ecx + 4], eax
xor eax, eax
mov dword [ebp - 0x1500], esi
mov esi, eax
test esi, esi
je 0xc33d6c
cmp dword [esi + 4], 0
je 0xc33d1b
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
jmp 0xc33d1d
xor eax, eax
cmp dword [esi + 0xc], 0
je 0xc33d3b
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0xc33d3d
xor eax, eax
cmp dword [esi + 0x14], 0
je 0xc33d5b
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
jmp 0xc33d5d
xor eax, eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc33d82
mov eax, dword [ebp - 0x1500]
mov dword [ebp - 0x14e8], eax
xor eax, eax
mov esi, eax
jmp 0xc33d8a
mov esi, dword [ebp - 0x1500]
xor eax, eax
push dword [ebp - 0x152c]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
je 0xc33e0e
xor eax, eax
cmp dword [esi + 4], eax
je 0xc33dbf
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xc33ddd
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0xc33ddf
xor eax, eax
cmp dword [esi + 0x14], 0
je 0xc33dfd
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
jmp 0xc33dff
xor eax, eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
push 4
pop esi
or ebx, 0x10000000
mov dword [ebp - 0x152c], ebx
jl 0xc351a6
mov edi, dword [ebp - 0x14e8]
lea eax, [ebp - 0x17e8]
push eax
mov ecx, esi
mov dword [ebp - 0x17e8], esi
mov edx, dword [edi]
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc33eb5
mov ecx, dword [ebp - 0x17e8]
lea eax, [ebp - 0x17e8]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc33eb5
mov edx, dword [edi + 8]
lea eax, [ebp - 0x17e8]
mov ecx, dword [ebp - 0x17e8]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc33eb5
mov ecx, dword [ebp - 0x17e8]
lea eax, [ebp - 0x17e8]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc33eb5
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0x17e8]
mov ecx, dword [ebp - 0x17e8]
push eax
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0x17e8]
test ebx, ebx
jns 0xc33ebb
mov eax, dword [ebp - 0x17ec]
mov dword [ebp - 0x1538], eax
test ebx, ebx
js 0xc34037
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc33ef3
mov ebx, 0xc0000017
jmp 0xc34037
mov ebx, 0xc0000001
jmp 0xc33e11
mov eax, dword [ebp - 0x14e8]
mov edx, esi
mov ecx, edi
mov dword [ebp - 0x17f0], edi
mov eax, dword [eax]
mov dword [edi], eax
lea eax, [ebp - 0x17f0]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc34022
mov ebx, dword [ebp - 0x14e8]
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0x17f0]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx]
lea eax, [ebp - 0x17f0]
mov ecx, dword [ebp - 0x17f0]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc34022
mov eax, dword [ebp - 0x14e8]
mov edx, esi
mov ecx, dword [ebp - 0x17f0]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0x17f0]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc34022
mov ebx, dword [ebp - 0x14e8]
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0x17f0]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 8]
lea eax, [ebp - 0x17f0]
mov ecx, dword [ebp - 0x17f0]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc34022
mov eax, dword [ebp - 0x14e8]
mov edx, esi
mov ecx, dword [ebp - 0x17f0]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0x17f0]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc34022
mov ebx, dword [ebp - 0x14e8]
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0x17f0]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0x17f0]
mov ecx, dword [ebp - 0x17f0]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc34022
xor eax, eax
mov dword [ebp - 0x14f8], edi
mov edi, eax
mov eax, dword [ebp - 0x1538]
mov dword [ebp - 0x14ec], eax
test edi, edi
je 0xc34037
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or ebx, 0x10000000
mov dword [ebp - 0x152c], ebx
jl 0xc351a6
push 8
xor eax, eax
pop edi
mov dword [ebp - 0x1538], eax
mov dword [ebp - 0x1528], eax
mov dword [ebp - 0x17f4], edi
mov edx, dword [ebp - 0x14e4]
lea eax, [ebp - 0x17f4]
push eax
mov ecx, edi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x152c], ebx
jl 0xc340ec
mov eax, dword [ebp - 0x17f4]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xc340a1
mov ebx, 0xc0000095
mov dword [ebp - 0x152c], ebx
jmp 0xc340c7
mov dword [ebp - 0x17fc], ecx
lea eax, [ebp - 0x17fc]
mov edx, edi
push eax
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0x17fc]
mov dword [ebp - 0x152c], ebx
test ebx, ebx
jns 0xc340cd
mov eax, dword [ebp - 0x17f8]
mov dword [ebp - 0x1534], eax
test ebx, ebx
js 0xc340ec
mov eax, dword [ebp - 0x1508]
test eax, eax
jne 0xc34122
mov ebx, 0xc000000d
mov dword [ebp - 0x152c], ebx
mov edi, dword [ebp - 0x14dc]
test ebx, ebx
js 0xc351a6
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc34372
mov ecx, dword [ebp - 0x14d8]
mov ebx, 0xd0000017
jmp 0xc3437f
mov edi, dword [ebp - 0x1584]
cmp edi, 1
jbe 0xc340e1
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x1694], ecx
mov dword [ebp - 0x1510], eax
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1518], eax
lea eax, [ebp - 0x1694]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc340ec
mov edx, dword [ebp - 0x1518]
lea eax, [ebp - 0x1694]
mov ecx, dword [ebp - 0x1694]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc340ec
mov eax, dword [ebp - 0x1510]
mov ecx, dword [ebp - 0x1694]
inc eax
mov dword [ebp - 0x1510], eax
cmp eax, 1
jb 0xc3413d
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1510], eax
lea eax, [ebp - 0x1694]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc340ec
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1538], eax
neg eax
sbb eax, eax
and dword [ebp - 0x1694], eax
test ebx, ebx
js 0xc340ec
cmp edi, 2
jbe 0xc340e1
mov ecx, dword [ebp - 0x1508]
xor eax, eax
mov dword [ebp - 0x16b8], ecx
mov edi, eax
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1510], eax
lea eax, [ebp - 0x16b8]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc340ec
mov edx, dword [ebp - 0x1510]
lea eax, [ebp - 0x16b8]
mov ecx, dword [ebp - 0x16b8]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc340ec
mov ecx, dword [ebp - 0x16b8]
inc edi
cmp edi, 2
jb 0xc341fc
mov edi, dword [ecx]
lea eax, [ebp - 0x16b8]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc340ec
mov dword [ebp - 0x1528], edi
neg edi
sbb edi, edi
and dword [ebp - 0x16b8], edi
test ebx, ebx
js 0xc340ec
mov edx, dword [ebp - 0x1534]
lea eax, [ebp - 0x16b4]
push eax
mov ecx, esi
mov dword [ebp - 0x16b4], esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc34346
mov ecx, dword [ebp - 0x16b4]
lea eax, [ebp - 0x16b4]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc34346
mov edx, dword [ebp - 0x1538]
lea eax, [ebp - 0x16b4]
mov ecx, dword [ebp - 0x16b4]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc34346
mov ecx, dword [ebp - 0x16b4]
lea eax, [ebp - 0x16b4]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc34346
mov edx, dword [ebp - 0x1528]
lea eax, [ebp - 0x16b4]
mov ecx, dword [ebp - 0x16b4]
push eax
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0x16b4]
mov dword [ebp - 0x152c], ebx
test ebx, ebx
jns 0xc34354
mov eax, dword [ebp - 0x1800]
test ebx, ebx
js 0xc340ec
cmp eax, 0x400000
jbe 0xc34365
mov ebx, 0x8000ffff
jmp 0xc351a0
mov edi, eax
mov dword [ebp - 0x14dc], edi
jmp 0xc340f2
mov ecx, eax
mov dword [ebp - 0x14d8], ecx
mov ebx, 0x10000000
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc351a6
mov eax, dword [ebp - 0x14f8]
test eax, eax
jne 0xc343a1
mov ebx, 0x80070057
jmp 0xc351a0
test ecx, ecx
je 0xc34397
mov dword [ebp - 0x1b10], eax
mov eax, dword [ebp - 0x14ec]
mov dword [ebp - 0x1b08], eax
xor eax, eax
mov dword [ebp - 0x1b00], eax
lea eax, [ebp - 0x1804]
push eax
push 0x9f29b8
push 1
mov dword [ebp - 0x1b0c], ecx
mov dword [ebp - 0x1b04], edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xc3441c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
jle 0xc34406
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc3449d
mov ebx, 0x80004005
mov dword [ebp - 0x152c], ebx
jmp 0xc3449d
push 0x9fc030
push dword [ebp - 0x1804]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0xc3445e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
jle 0xc34456
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0x152c], ebx
test ebx, ebx
mov edi, dword [ebp - 0x14dc]
jmp 0xc34406
xor eax, eax
mov ecx, edi
push eax
push 0x14
lea eax, [ebp - 0x1b10]
push eax
push 0x86
call dword [0xc99200]
call edi
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x152c], ebx
jl 0xc34497
mov edi, dword [ebp - 0x1b04]
mov dword [ebp - 0x14dc], edi
jmp 0xc3449d
mov edi, dword [ebp - 0x14dc]
cmp ebx, 0xd0000023
jne 0xc344af
mov ebx, 0x8007007a
jmp 0xc351a0
test ebx, ebx
js 0xc351a6
xor eax, eax
mov dword [ebp - 0x1538], eax
mov dword [ebp - 0x1688], eax
mov eax, dword [ebp - 0x14d8]
mov dword [ebp - 0x1684], eax
cmp edi, esi
jae 0xc344df
mov ebx, 0xc000003e
jmp 0xc348e1
mov edi, dword [eax]
lea ecx, [ebp - 0x1684]
push ecx
mov edx, esi
mov dword [ebp - 0x1528], edi
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc348e1
lea eax, [ebp - 0x1688]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc348e1
mov eax, dword [ebp - 0x14dc]
sub eax, dword [ebp - 0x1688]
cmp eax, edi
jb 0xc344d5
mov eax, dword [ebp - 0x1684]
lea ecx, [ebp - 0x1684]
push ecx
mov edx, edi
mov dword [ebp - 0x1534], eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc348e1
mov ecx, dword [ebp - 0x1688]
lea eax, [ebp - 0x1688]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc348e1
mov eax, dword [ebp - 0x14dc]
sub eax, dword [ebp - 0x1688]
cmp eax, esi
jb 0xc344d5
mov ecx, dword [ebp - 0x1684]
lea eax, [ebp - 0x1684]
push eax
mov edx, esi
mov edi, dword [ecx]
mov dword [ebp - 0x1510], edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc348e1
mov ecx, dword [ebp - 0x1688]
lea eax, [ebp - 0x1688]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc348e1
mov eax, dword [ebp - 0x14dc]
sub eax, dword [ebp - 0x1688]
cmp eax, edi
jb 0xc344d5
mov eax, dword [ebp - 0x1684]
lea ecx, [ebp - 0x1684]
push ecx
mov edx, edi
mov dword [ebp - 0x1518], eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc348e1
mov ecx, dword [ebp - 0x1688]
lea eax, [ebp - 0x1688]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc348e1
mov eax, dword [ebp - 0x14dc]
sub eax, dword [ebp - 0x1688]
cmp eax, esi
jb 0xc344d5
mov ecx, dword [ebp - 0x1684]
mov edx, esi
mov eax, dword [ecx]
mov dword [ebp - 0x14d0], eax
lea eax, [ebp - 0x1684]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc348e1
mov ecx, dword [ebp - 0x1688]
lea eax, [ebp - 0x1688]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc348e1
mov eax, dword [ebp - 0x14dc]
sub eax, dword [ebp - 0x1688]
mov ecx, dword [ebp - 0x14d0]
cmp eax, ecx
jb 0xc344d5
lea eax, [ebp - 0x1688]
mov edx, ecx
mov ecx, dword [ebp - 0x1688]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc348e1
mov edx, dword [ebp - 0x14dc]
mov eax, edx
sub eax, dword [ebp - 0x1688]
jne 0xc344d5
mov ebx, dword [ebp - 0x1528]
mov ecx, dword [ebp - 0x14d0]
add ecx, 0xc
lea eax, [edi + ebx]
add eax, ecx
cmp eax, edx
jne 0xc344d5
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc34700
mov ebx, 0xc0000017
jmp 0xc34850
cmp dword [ebp - 0x1534], 0
je 0xc34742
push ebx
push 8
mov dword [edi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc3472b
mov ebx, 0xc0000017
xor eax, eax
jmp 0xc347dd
mov dword [edi + 4], eax
push ebx
push dword [ebp - 0x1534]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc34749
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
cmp dword [ebp - 0x1518], 0
je 0xc34786
mov ebx, dword [ebp - 0x1510]
push ebx
push 8
mov dword [edi + 8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc3471f
mov dword [edi + 0xc], eax
push ebx
push dword [ebp - 0x1518]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc3478c
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
cmp dword [ebp - 0x1684], 0
je 0xc347cd
mov ebx, dword [ebp - 0x14d0]
push ebx
push 8
mov dword [edi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc3471f
mov dword [edi + 0x14], eax
push ebx
push dword [ebp - 0x1684]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc347d3
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [ebp - 0x1538], edi
mov ebx, eax
mov edi, eax
test edi, edi
je 0xc34850
cmp dword [edi + 4], 0
je 0xc347ff
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
jmp 0xc34801
xor eax, eax
cmp dword [edi + 0xc], 0
je 0xc3481f
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
jmp 0xc34821
xor eax, eax
cmp dword [edi + 0x14], 0
je 0xc3483f
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
jmp 0xc34841
xor eax, eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc34866
mov eax, dword [ebp - 0x1538]
mov dword [ebp - 0x14d4], eax
xor eax, eax
mov edi, eax
jmp 0xc3486e
mov edi, dword [ebp - 0x1538]
xor eax, eax
test edi, edi
je 0xc348e1
cmp dword [edi + 4], 0
je 0xc34890
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
jmp 0xc34892
xor eax, eax
cmp dword [edi + 0xc], 0
je 0xc348b0
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
jmp 0xc348b2
xor eax, eax
cmp dword [edi + 0x14], 0
je 0xc348d0
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
jmp 0xc348d2
xor eax, eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or ebx, 0x10000000
mov dword [ebp - 0x152c], ebx
jl 0xc351a6
mov ecx, dword [ebp - 0x14d4]
xor eax, eax
mov dword [ebp - 0x1528], eax
mov edi, eax
mov dword [ebp - 0x1538], edi
test ecx, ecx
jne 0xc34917
mov ebx, 0xd000000d
jmp 0xc351a0
mov eax, dword [ecx + 4]
mov dword [ebp - 0x1534], eax
test eax, eax
je 0xc3490d
mov ebx, dword [ecx]
test ebx, ebx
je 0xc3490d
add ebx, 0xfffffff8
xor eax, eax
push ebx
push eax
mov dword [ebp - 0x1518], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x14d0], eax
test eax, eax
je 0xc34f57
xor ecx, ecx
mov dword [ebp - 0x6ac], 0xab69605e
mov edi, ebx
mov dword [ebp - 0x6a8], 0x7f1137f
mov dword [ebp - 0x1524], eax
mov dl, cl
mov ecx, dword [ebp - 0x1534]
mov dword [ebp - 0x1530], ecx
and edi, 7
je 0xc34ef6
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x14e0], eax
mov dword [ebp - 0x1500], eax
mov dword [ebp - 0x14f4], ecx
test edi, edi
je 0xc349f8
push 0x38
pop ebx
mov eax, dword [ebp - 0x1530]
inc dword [ebp - 0x1530]
movzx eax, byte [eax]
cmp dword [ebp - 0x14f4], esi
jge 0xc349c8
lea ecx, [ebx - 0x20]
shl eax, cl
or dword [ebp - 0x1500], eax
jmp 0xc349d2
mov ecx, ebx
shl eax, cl
or dword [ebp - 0x14e0], eax
mov ecx, dword [ebp - 0x14f4]
sub ebx, 8
inc ecx
mov dword [ebp - 0x14f4], ecx
cmp ecx, edi
jl 0xc349a4
mov eax, dword [ebp - 0x1530]
mov dword [ebp - 0x1530], eax
mov eax, dword [ebp - 0x1500]
mov ebx, dword [ebp - 0x14e0]
xor eax, 0x92f65a5
xor ebx, 0x699a899c
mov dword [ebp - 0x14f4], eax
xor ecx, ecx
mov dword [ebp - 0x14dc], ebx
mov dword [ebp - 0x14ec], eax
mov dword [ebp - 0x14e4], ebx
test edi, edi
je 0xc34a77
mov eax, dword [ebp - 0x1524]
lea ebx, [eax + 1]
mov dword [ebp - 0x1524], ebx
cmp ecx, esi
jge 0xc34a49
rol dword [ebp - 0x14ec], 8
mov ebx, dword [ebp - 0x14ec]
jmp 0xc34a56
rol dword [ebp - 0x14e4], 8
mov ebx, dword [ebp - 0x14e4]
mov byte [eax], bl
inc ecx
mov ebx, dword [ebp - 0x1524]
mov eax, ebx
cmp ecx, edi
jl 0xc34a2d
mov eax, dword [ebp - 0x14f4]
mov dword [ebp - 0x1524], ebx
mov ebx, dword [ebp - 0x14dc]
cmp edi, esi
jbe 0xc34ed0
push 8
pop ecx
sub ecx, edi
shl ecx, 3
shr ebx, cl
shl ebx, cl
mov dword [ebp - 0x14dc], ebx
mov ebx, dword [ebp - 0x1518]
mov eax, ebx
shr eax, 3
mov dword [ebp - 0x14ec], eax
test eax, eax
je 0xc34e97
movzx esi, word [ebp - 0x6aa]
mov ebx, 0x7f1137f
movzx ecx, word [ebp - 0x6a6]
mov edi, 0xab69605e
movzx eax, bx
xor ebx, edi
mov dword [ebp - 0x152c], eax
movzx eax, di
mov dword [ebp - 0x1584], eax
mov eax, dword [ebp - 0x1524]
mov dword [ebp - 0x1560], esi
add eax, 7
mov esi, dword [ebp - 0x1530]
mov dword [ebp - 0x153c], ecx
add esi, 2
mov ecx, dword [ebp - 0x14f4]
mov dword [ebp - 0x14e4], ebx
mov dword [ebp - 0x1524], eax
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor ecx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
shl edi, 8
add esi, 8
or edi, eax
mov dword [ebp - 0x1530], esi
mov eax, dword [ebp - 0x14dc]
xor eax, edi
xor eax, ecx
xor eax, 0x7f1137f
xor eax, 0xab69605e
mov dword [ebp - 0x14dc], eax
mov esi, eax
rol dword [ebp - 0x14dc], 0xa
sub eax, 0xab69605e
rol eax, 5
imul eax, dword [ebp - 0x152c]
add eax, dword [ebp - 0x14dc]
xor ecx, eax
mov eax, 0x7f1137f
mov dword [ebp - 0x14f4], ecx
add ecx, eax
mov eax, dword [ebp - 0x14f4]
ror ecx, 9
imul ecx, dword [ebp - 0x1560]
rol eax, 2
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
sub ecx, dword [ebp - 0x152c]
imul ecx, dword [ebp - 0x1584]
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0x14f4]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x14f4], eax
xor ecx, dword [ebp - 0x1560]
rol ecx, 6
imul ecx, dword [ebp - 0x153c]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, 0xab69605e
xor ecx, esi
sub eax, ecx
mov ecx, dword [ebp - 0x14f4]
xor ecx, eax
mov eax, dword [ebp - 0x152c]
mov dword [ebp - 0x14f4], ecx
xor eax, dword [ebp - 0x14f4]
imul eax, dword [ebp - 0x1560]
ror ecx, 6
xor ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov eax, esi
rol eax, 2
lea ecx, [ecx + esi]
ror ecx, 0xf
imul ecx, dword [ebp - 0x1584]
add ecx, eax
mov eax, dword [ebp - 0x14f4]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x14f4], eax
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0x153c]
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, 0xab69605e
ror eax, 0xa
ror ecx, 0xc
imul ecx, dword [ebp - 0x152c]
xor ecx, eax
mov eax, dword [ebp - 0x14f4]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x14f4], eax
xor ecx, dword [ebp - 0x153c]
imul ecx, dword [ebp - 0x1560]
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov ecx, dword [ebp - 0x14f4]
mov eax, esi
not eax
ror eax, 5
add eax, dword [ebp - 0x1584]
imul eax, dword [ebp - 0x153c]
xor ecx, eax
mov eax, ecx
mov dword [ebp - 0x14f4], ecx
sub eax, dword [ebp - 0x153c]
xor eax, esi
mov esi, dword [ebp - 0x14f4]
xor eax, 0xab69605e
mov ecx, eax
mov dword [ebp - 0x14dc], eax
xor ecx, dword [ebp - 0x153c]
rol ecx, 2
imul ecx, dword [ebp - 0x152c]
shr eax, 2
add ecx, eax
xor esi, ecx
mov eax, esi
rol eax, 7
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul ecx, dword [ebp - 0x1560]
add ecx, eax
mov eax, dword [ebp - 0x14dc]
xor eax, ecx
mov dword [ebp - 0x14dc], eax
mov ecx, eax
mov eax, dword [ebp - 0x152c]
xor eax, dword [ebp - 0x14dc]
imul eax, dword [ebp - 0x1584]
ror ecx, 9
add ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0x1560]
rol ecx, 5
imul ecx, dword [ebp - 0x153c]
rol eax, 7
add ecx, eax
xor dword [ebp - 0x14dc], ecx
mov ecx, dword [ebp - 0x14dc]
xor esi, ecx
xor esi, dword [ebp - 0x14e4]
mov eax, esi
ror eax, 3
sub eax, dword [ebp - 0x1560]
imul eax, dword [ebp - 0x152c]
xor ecx, eax
mov dword [ebp - 0x14dc], ecx
sub ecx, 0x7f1137f
mov eax, dword [ebp - 0x14dc]
ror ecx, 1
imul ecx, dword [ebp - 0x1584]
ror eax, 6
sub ecx, eax
xor esi, ecx
mov ecx, 0xab69605e
mov eax, esi
rol eax, 0xe
lea ecx, [esi + ecx]
rol ecx, 3
imul ecx, dword [ebp - 0x153c]
add ecx, eax
mov eax, dword [ebp - 0x14dc]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0x14dc], eax
rol ecx, 0xf
imul ecx, dword [ebp - 0x152c]
ror eax, 0xe
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0x1584]
imul ecx, dword [ebp - 0x1560]
shr eax, 3
xor ecx, eax
mov eax, dword [ebp - 0x14dc]
xor eax, ecx
mov ecx, 0x7f1137f
xor ecx, eax
mov dword [ebp - 0x14dc], eax
rol ecx, 4
imul ecx, dword [ebp - 0x1584]
rol eax, 2
xor ecx, eax
mov eax, dword [ebp - 0x14dc]
xor ecx, dword [ebp - 0x1500]
xor eax, dword [ebp - 0x14e0]
xor esi, ecx
mov ecx, esi
mov dword [ebp - 0x14f4], esi
mov esi, dword [ebp - 0x1524]
mov dword [ebp - 0x1500], ebx
mov dword [ebp - 0x14e0], edi
mov byte [esi - 4], cl
mov byte [esi], al
ror ecx, 8
mov byte [esi - 5], cl
ror eax, 8
mov byte [esi - 1], al
ror ecx, 8
mov byte [esi - 6], cl
ror eax, 8
mov byte [esi - 2], al
ror ecx, 8
ror eax, 8
mov byte [esi - 7], cl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror ecx, 8
sub dword [ebp - 0x14ec], 1
mov dword [ebp - 0x1524], esi
mov esi, dword [ebp - 0x1530]
mov dword [ebp - 0x14dc], eax
jne 0xc34b06
mov ebx, dword [ebp - 0x1518]
push 4
pop esi
mov ecx, dword [ebp - 0x14d0]
xor eax, eax
test ebx, ebx
je 0xc34eab
xor dl, byte [eax + ecx]
inc eax
cmp eax, ebx
jb 0xc34ea3
mov edi, dword [ebp - 0x1534]
movzx eax, dl
cdq
cmp eax, dword [ebx + edi]
jne 0xc34f16
cmp edx, dword [ebx + edi + 4]
jne 0xc34f16
xor eax, eax
mov dword [ebp - 0x1528], ebx
mov edi, ecx
mov ebx, eax
mov ecx, eax
jmp 0xc34f23
xor ecx, ecx
mov dword [ebp - 0x14dc], ecx
cmp edi, esi
jae 0xc34a91
mov ecx, esi
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0x14f4], eax
jmp 0xc34a91
xor eax, eax
or dword [ebp - 0x14e0], 0xffffffff
mov dword [ebp - 0x1500], eax
mov dword [ebp - 0x14dc], eax
mov dword [ebp - 0x14f4], eax
jmp 0xc34a97
mov edi, dword [ebp - 0x1538]
mov ebx, 0xc004d501
xor eax, eax
test ecx, ecx
je 0xc34f36
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc34f57
xor eax, eax
mov dword [ebp - 0x1548], edi
mov edi, eax
mov ebx, 0x10000000
mov eax, dword [ebp - 0x1528]
mov dword [ebp - 0x1504], eax
jmp 0xc34f5c
mov ebx, 0xd0000001
mov dword [ebp - 0x152c], ebx
test edi, edi
je 0xc34f77
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc351a6
mov edi, dword [ebp - 0x1504]
xor eax, eax
mov ecx, dword [ebp - 0x1548]
mov dword [ebp - 0x167c], eax
mov dword [ebp - 0x1660], ecx
cmp edi, esi
jb 0xc35195
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1538], eax
lea eax, [ebp - 0x1660]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3519a
lea eax, [ebp - 0x167c]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3519a
mov eax, edi
sub eax, dword [ebp - 0x167c]
cmp eax, esi
jb 0xc35195
mov ecx, dword [ebp - 0x1660]
lea eax, [ebp - 0x1660]
push eax
mov edx, esi
mov edi, dword [ecx]
mov dword [ebp - 0x1528], edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3519a
mov ecx, dword [ebp - 0x167c]
lea eax, [ebp - 0x167c]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3519a
mov eax, dword [ebp - 0x1504]
mov ecx, dword [ebp - 0x167c]
sub eax, ecx
cmp eax, edi
jb 0xc35195
lea eax, [ebp - 0x167c]
mov edx, edi
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3519a
mov edx, dword [ebp - 0x1504]
mov ebx, dword [ebp - 0x1548]
mov ecx, dword [ebp - 0x1660]
add ecx, edi
lea eax, [edx + ebx]
cmp eax, ecx
jb 0xc35195
mov eax, dword [ebp - 0x1660]
sub edx, edi
sub edx, eax
add edx, ebx
cmp edx, 8
jae 0xc35195
xor edx, edx
mov dword [ebp - 0x1510], edx
mov ecx, edx
mov dword [ebp - 0x1534], ecx
mov ebx, edx
test eax, eax
je 0xc35116
mov edx, dword [ebp - 0x1528]
lea ecx, [ebp - 0x15fc]
push ecx
mov ecx, eax
mov edi, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3519a
mov ecx, dword [ebp - 0x15fc]
cmp edi, ecx
jae 0xc35108
mov edx, dword [ebp - 0x1510]
lea eax, [edi + 4]
cmp eax, edi
jb 0xc3514b
cmp eax, ecx
ja 0xc35144
mov eax, dword [edi]
add eax, 4
cmp eax, esi
jb 0xc3513d
add eax, edi
cmp eax, edi
jb 0xc3514b
mov edi, eax
xor eax, eax
mov ebx, eax
cmp edi, ecx
ja 0xc35144
inc edx
mov dword [ebp - 0x1510], edx
cmp edi, ecx
jb 0xc350d7
cmp edi, ecx
jne 0xc35144
mov edi, dword [ebp - 0x1528]
mov ecx, dword [ebp - 0x1534]
test edi, edi
je 0xc35156
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x1534], ecx
test ecx, ecx
jne 0xc35152
mov ebx, 0xc0000017
jmp 0xc35183
mov ebx, 0xc0000095
jmp 0xc35183
mov ebx, 0xc000000d
jmp 0xc3519a
mov ebx, 0xc0000095
jmp 0xc3519a
xor eax, eax
mov ebx, eax
mov eax, dword [ebp - 0x1660]
test eax, eax
je 0xc35171
push edi
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [ebp - 0x1534]
add esp, 0xc
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1a14], ecx
mov dword [ebp - 0x1a1c], eax
test ebx, ebx
js 0xc3519a
mov eax, dword [ebp - 0x1538]
cmp eax, dword [ebp - 0x1a1c]
je 0xc3519a
mov ebx, 0xc000003e
or ebx, 0x10000000
mov dword [ebp - 0x152c], ebx
mov eax, dword [ebp - 0x1520]
test eax, eax
je 0xc351c1
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0x14e8]
test edi, edi
je 0xc35237
xor eax, eax
cmp dword [edi + 4], eax
je 0xc351e8
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc35206
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
jmp 0xc35208
xor eax, eax
cmp dword [edi + 0x14], 0
je 0xc35226
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
jmp 0xc35228
xor eax, eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x14f8]
test eax, eax
je 0xc35252
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x14d8]
test eax, eax
je 0xc3526d
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0x14d4]
test edi, edi
je 0xc352e3
xor eax, eax
cmp dword [edi + 4], eax
je 0xc35294
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc352b2
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
jmp 0xc352b4
xor eax, eax
cmp dword [edi + 0x14], 0
je 0xc352d2
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
jmp 0xc352d4
xor eax, eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1548]
test eax, eax
je 0xc352fe
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc358c8
cmp dword [ebp - 0x1a1c], 1
jb 0xc358bd
cmp dword [ebp - 0x1a14], 0
jne 0xc353a4
mov ebx, 0xc000000d
mov dword [ebp - 0x152c], ebx
mov eax, dword [ebp - 0x151c]
test ebx, ebx
js 0xc358c8
cmp eax, 0xd0000023
jne 0xc3534b
mov eax, 0x8007007a
mov dword [ebp - 0x151c], eax
cmp eax, 0x8007007a
je 0xc35362
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test eax, eax
js 0xc358c8
cmp dword [ebp - 0x1a1c], 6
jne 0xc358bd
cmp dword [ebp - 0x1a14], 0
jne 0xc35418
mov edx, dword [ebp - 0x19e0]
mov ebx, 0xc000000d
mov ecx, dword [ebp - 0x19e4]
mov dword [ebp - 0x152c], ebx
mov dword [ebp - 0x1538], edx
mov dword [ebp - 0x1528], ecx
jmp 0xc354ee
cmp dword [ebp - 0x1a1c], 0
jbe 0xc35320
mov eax, dword [ebp - 0x1a14]
lea ecx, [ebp - 0x15b4]
push ecx
mov edx, esi
mov dword [ebp - 0x15b4], eax
mov ecx, eax
mov edi, dword [eax]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc353ef
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x15b4]
mov dword [ebp - 0x15b4], eax
jmp 0xc353fb
mov edi, dword [ebp - 0x1808]
mov eax, dword [ebp - 0x180c]
test ebx, ebx
js 0xc3532b
cmp edi, esi
jne 0xc32ee1
mov eax, dword [eax]
mov dword [ebp - 0x151c], eax
jmp 0xc35331
mov ecx, dword [ebp - 0x1a14]
xor eax, eax
mov dword [ebp - 0x1570], ecx
mov edi, eax
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1538], eax
lea eax, [ebp - 0x1570]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc354aa
mov edx, dword [ebp - 0x1538]
lea eax, [ebp - 0x1570]
mov ecx, dword [ebp - 0x1570]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc354aa
mov ecx, dword [ebp - 0x1570]
inc edi
cmp edi, 1
jb 0xc35428
mov edi, dword [ecx]
lea eax, [ebp - 0x1570]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc354aa
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1570]
mov dword [ebp - 0x1570], eax
jmp 0xc354b6
mov edi, dword [ebp - 0x1810]
mov eax, dword [ebp - 0x1814]
test ebx, ebx
js 0xc354d6
cmp edi, 8
jne 0xc32ee1
mov ecx, dword [eax]
mov dword [ebp - 0x1528], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1538], ecx
jmp 0xc354ee
mov eax, dword [ebp - 0x19e0]
mov dword [ebp - 0x1538], eax
mov eax, dword [ebp - 0x19e4]
mov dword [ebp - 0x1528], eax
test ebx, ebx
js 0xc358c8
cmp dword [ebp - 0x1a14], 0
jne 0xc35535
mov ebx, 0xc000000d
mov dword [ebp - 0x152c], ebx
mov eax, dword [ebp - 0x1818]
mov dword [ebp - 0x1534], eax
test ebx, ebx
js 0xc358c8
cmp dword [ebp - 0x1a14], 0
jne 0xc355ea
mov ebx, 0xc000000d
jmp 0xc358c2
mov ecx, dword [ebp - 0x1a14]
xor eax, eax
mov dword [ebp - 0x1558], ecx
mov edi, eax
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1534], eax
lea eax, [ebp - 0x1558]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc355c7
mov edx, dword [ebp - 0x1534]
lea eax, [ebp - 0x1558]
mov ecx, dword [ebp - 0x1558]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc355c7
mov ecx, dword [ebp - 0x1558]
inc edi
cmp edi, 2
jb 0xc35545
mov edi, dword [ecx]
lea eax, [ebp - 0x1558]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc355c7
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1558]
mov dword [ebp - 0x1558], eax
jmp 0xc355d3
mov edi, dword [ebp - 0x181c]
mov eax, dword [ebp - 0x1820]
test ebx, ebx
js 0xc3550a
cmp edi, esi
jne 0xc32ee1
mov eax, dword [eax]
jmp 0xc35510
mov ecx, dword [ebp - 0x1a14]
xor eax, eax
mov dword [ebp - 0x1544], ecx
mov edi, eax
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1510], eax
lea eax, [ebp - 0x1544]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc35680
mov edx, dword [ebp - 0x1510]
lea eax, [ebp - 0x1544]
mov ecx, dword [ebp - 0x1544]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc35680
mov ecx, dword [ebp - 0x1544]
inc edi
cmp edi, 3
jb 0xc355fa
mov edi, dword [ecx]
lea eax, [ebp - 0x1544]
push eax
mov edx, esi
mov dword [ebp - 0x1510], edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc35680
neg edi
sbb edi, edi
and edi, dword [ebp - 0x1544]
mov dword [ebp - 0x1544], edi
jmp 0xc35692
mov eax, dword [ebp - 0x1824]
mov edi, dword [ebp - 0x1828]
mov dword [ebp - 0x1510], eax
test ebx, ebx
js 0xc358c8
mov ecx, dword [ebp - 0x1a14]
xor eax, eax
mov edx, eax
mov eax, dword [ecx]
mov dword [ebp - 0x1518], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0xc356b9
xor ecx, ecx
mov ebx, ecx
jmp 0xc356c1
mov ebx, 0xc0000095
or eax, 0xffffffff
mov dword [ebp - 0x152c], ebx
mov dword [ebp - 0x15b8], eax
test ebx, ebx
js 0xc35747
mov ecx, dword [ebp - 0x1518]
add ecx, eax
mov ebx, ecx
mov dword [ebp - 0x1518], ebx
cmp ecx, eax
jae 0xc356e8
or ecx, 0xffffffff
cmp ebx, eax
mov dword [ebp - 0x15b8], ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0x152c], ebx
cmp dword [ebp - 0x1518], eax
jb 0xc35747
inc edx
cmp edx, esi
jb 0xc356a4
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1518], eax
lea eax, [ebp - 0x15b8]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc35747
mov ecx, dword [ebp - 0x1518]
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0x15b8]
mov dword [ebp - 0x15b8], eax
jmp 0xc35753
mov ecx, dword [ebp - 0x182c]
mov eax, dword [ebp - 0x1830]
test ebx, ebx
js 0xc35763
cmp ecx, esi
jne 0xc32ee1
mov eax, dword [eax]
jmp 0xc35769
mov eax, dword [ebp - 0x1834]
mov dword [ebp - 0x1518], eax
test ebx, ebx
js 0xc358c8
mov ecx, dword [ebp - 0x1a14]
xor eax, eax
mov edx, eax
mov eax, dword [ecx]
mov dword [ebp - 0x14d0], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0xc35796
xor ecx, ecx
mov ebx, ecx
jmp 0xc3579e
mov ebx, 0xc0000095
or eax, 0xffffffff
mov dword [ebp - 0x152c], ebx
mov dword [ebp - 0x15a8], eax
test ebx, ebx
js 0xc35825
mov ecx, dword [ebp - 0x14d0]
add ecx, eax
mov ebx, ecx
mov dword [ebp - 0x14d0], ebx
cmp ecx, eax
jae 0xc357c5
or ecx, 0xffffffff
cmp ebx, eax
mov dword [ebp - 0x15a8], ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0x152c], ebx
cmp dword [ebp - 0x14d0], eax
jb 0xc35825
inc edx
cmp edx, 5
jb 0xc35781
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x14d0], eax
lea eax, [ebp - 0x15a8]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x152c], ebx
test ebx, ebx
js 0xc35825
mov ecx, dword [ebp - 0x14d0]
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0x15a8]
mov dword [ebp - 0x15a8], eax
jmp 0xc35831
mov ecx, dword [ebp - 0x1838]
mov eax, dword [ebp - 0x183c]
test ebx, ebx
js 0xc35841
cmp ecx, esi
jne 0xc32ee1
mov ecx, dword [eax]
jmp 0xc35847
mov ecx, dword [ebp - 0x150c]
test ebx, ebx
js 0xc358c8
mov eax, dword [ebp - 0x1550]
cmp eax, dword [ebp - 0x1528]
jne 0xc358bd
mov eax, dword [ebp - 0x155c]
cmp eax, dword [ebp - 0x1538]
jne 0xc358bd
mov dword [ebp - 0x15f8], ecx
cmp dword [ebp - 0x1518], esi
jbe 0xc35888
mov ecx, dword [ebp - 0x1534]
mov ebx, 0x8007007a
mov dword [ebp - 0x1648], ecx
jmp 0xc358c2
mov eax, dword [ebp - 0x1510]
cmp eax, esi
ja 0xc35875
mov esi, dword [ebp - 0x1514]
push eax
push edi
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0x1534]
add esp, 0xc
mov dword [ebp - 0x1648], eax
mov eax, dword [ebp - 0x151c]
test eax, eax
je 0xc358c8
mov ebx, eax
jmp 0xc358c2
mov ebx, 0xc004d501
mov dword [ebp - 0x152c], ebx
mov edi, dword [ebp - 0x14fc]
xor eax, eax
mov dword [ebp - 0x1a0c], eax
mov dword [ebp - 0x1a10], eax
mov eax, dword [ebp - 0x1508]
test eax, eax
je 0xc35901
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebp - 0x1a08], eax
jmp 0xc35903
xor eax, eax
mov dword [ebp - 0x1a18], eax
mov dword [ebp - 0x1a1c], eax
mov eax, dword [ebp - 0x1a14]
test eax, eax
je 0xc35934
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebp - 0x1a14], eax
jmp 0xc35936
xor eax, eax
test edi, edi
je 0xc35949
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x14f0]
test eax, eax
je 0xc35964
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc32a39
mov eax, dword [ebp - 0x15f8]
test eax, eax
je 0xc3c3e3
mov dword [0xc95878], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x57c]
push eax
push 0x9d0000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0xc359d7
cmp eax, esi
jne 0xc359aa
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0xc359d7
mov esi, dword [0xc9307c]
xor eax, eax
push 0x403
push eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x1538], eax
test eax, eax
jne 0xc35e78
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push 4
pop ebx
xor eax, eax
lea edi, [ebp - 0x1a34]
mov dword [ebp - 0x15a8], eax
mov dword [ebp - 0x15b8], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x1a40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1544], eax
test eax, eax
je 0xc3c36f
push 0x28
pop ecx
mov esi, 0xc94ea0
mov dword [ebp - 0x15a8], eax
mov edi, eax
rep movsd dword es:[edi], dword [esi]
push 8
pop esi
push esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1558], eax
test eax, eax
je 0xc3c36f
mov ecx, dword [0xc94e98]
mov edi, eax
mov dword [eax], ecx
mov ecx, dword [0xc94e9c]
mov dword [eax + 4], ecx
mov dword [ebp - 0x15b8], edi
rdtsc
mov dword [ebp - 0x1570], eax
mov dword [ebp - 0x15b4], edx
xor eax, eax
mov edx, ebx
mov dword [ebp - 0x15c4], eax
mov ecx, ebx
lea eax, [ebp - 0x158c]
push eax
call fcn.00a32533
test eax, eax
js 0xc3c367
mov edx, dword [ebp - 0x158c]
lea eax, [ebp - 0x15c4]
push eax
xor ecx, ecx
call fcn.00a32533
or eax, 0x10000000
jl 0xc3c367
lea eax, [ebp - 0x16b0]
mov edx, 0xa0
push eax
mov ecx, ebx
call fcn.00a32533
test eax, eax
js 0xc3c367
mov edx, dword [ebp - 0x16b0]
lea eax, [ebp - 0x15c4]
mov ecx, dword [ebp - 0x15c4]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xc3c367
lea eax, [ebp - 0x1600]
mov edx, esi
push eax
mov ecx, ebx
call fcn.00a32533
test eax, eax
js 0xc3c367
mov edx, dword [ebp - 0x1600]
lea eax, [ebp - 0x15c4]
mov ecx, dword [ebp - 0x15c4]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xc3c367
lea eax, [ebp - 0x1624]
mov edx, esi
push eax
mov ecx, ebx
call fcn.00a32533
test eax, eax
js 0xc3c367
mov edx, dword [ebp - 0x1624]
lea eax, [ebp - 0x15c4]
mov ecx, dword [ebp - 0x15c4]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xc3c367
mov esi, dword [ebp - 0x15c4]
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x1624], edi
test edi, edi
je 0xc3c36f
lea eax, [ebp - 0x1978]
mov edx, ebx
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc3c377
lea ecx, [edi + esi]
lea eax, [edi + 8]
mov dword [ebp - 0x1600], ecx
cmp eax, ecx
ja 0xc3c377
mov eax, dword [ebp - 0x1978]
mov dword [edi], ebx
mov dword [eax], ebx
mov esi, edi
xor eax, eax
mov dword [ebp - 0x1620], esi
mov edi, eax
mov edx, dword [esi]
lea eax, [ebp - 0x157c]
push eax
mov ecx, ebx
call fcn.00a32533
test eax, eax
js 0xc3c377
mov edx, dword [ebp - 0x157c]
lea eax, [ebp - 0x1620]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc3c377
mov esi, dword [ebp - 0x1620]
inc edi
cmp edi, 1
jb 0xc35bd2
lea eax, [ebp - 0x19d0]
mov edx, ebx
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc3c377
lea eax, [esi + 0xa4]
cmp eax, dword [ebp - 0x1600]
ja 0xc3c377
mov edi, dword [ebp - 0x19d0]
mov dword [esi], 0xa0
mov esi, dword [ebp - 0x1544]
push 0x28
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x1624]
xor eax, eax
mov esi, edi
mov dword [ebp - 0x157c], eax
mov dword [ebp - 0x161c], esi
mov edx, dword [esi]
lea eax, [ebp - 0x15ec]
push eax
mov ecx, ebx
call fcn.00a32533
test eax, eax
js 0xc3c377
mov edx, dword [ebp - 0x15ec]
lea eax, [ebp - 0x161c]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc3c377
mov eax, dword [ebp - 0x157c]
mov esi, dword [ebp - 0x161c]
inc eax
mov dword [ebp - 0x157c], eax
cmp eax, 2
jb 0xc35c69
lea eax, [ebp - 0x19e8]
mov edx, ebx
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc3c377
lea eax, [esi + 0xc]
cmp eax, dword [ebp - 0x1600]
ja 0xc3c377
mov edx, dword [ebp - 0x1558]
mov ecx, dword [ebp - 0x19e8]
mov dword [esi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov esi, edi
xor eax, eax
mov dword [ebp - 0x1618], esi
mov edi, eax
mov edx, dword [esi]
lea eax, [ebp - 0x1614]
push eax
mov ecx, ebx
call fcn.00a32533
test eax, eax
js 0xc3c377
mov edx, dword [ebp - 0x1614]
lea eax, [ebp - 0x1618]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc3c377
mov esi, dword [ebp - 0x1618]
inc edi
cmp edi, 3
jb 0xc35d04
lea eax, [ebp - 0x19c0]
mov edx, ebx
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc3c377
lea eax, [esi + 0xc]
cmp eax, dword [ebp - 0x1600]
ja 0xc3c377
mov eax, dword [ebp - 0x19c0]
mov ecx, dword [ebp - 0x1570]
push 8
pop edi
mov dword [esi], edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0x15b4]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x1578]
mov edx, ebx
push eax
mov ecx, ebx
call fcn.00a32533
test eax, eax
js 0xc3c377
mov esi, dword [ebp - 0x1578]
lea eax, [ebp - 0x16ac]
push eax
mov edx, edi
mov dword [ebp - 0x15a0], esi
mov ecx, ebx
call fcn.00a32533
test eax, eax
js 0xc3c377
mov edx, dword [ebp - 0x16ac]
lea eax, [ebp - 0x15a0]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc3c377
xor edx, edx
mov edi, edx
mov dword [ebp - 0x16ac], edx
mov dword [ebp - 0x1578], edx
mov dword [ebp - 0x1618], edx
mov dword [ebp - 0x15ec], edx
mov dword [ebp - 0x161c], edx
mov dword [ebp - 0x157c], edx
mov dword [ebp - 0x1620], edx
mov dword [ebp - 0x1600], edx
mov dword [ebp - 0x16b0], edx
rdtsc
mov dword [ebp - 0x1614], edi
mov dword [ebp - 0x158c], eax
mov dword [ebp - 0x1544], edx
push 8
pop eax
mov dword [ebp - 0x1860], eax
mov edx, dword [ebp - 0x15c4]
lea ecx, [ebp - 0x1860]
push ecx
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3a7a6
mov eax, dword [ebp - 0x1860]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0x1558], ecx
cmp ecx, eax
jae 0xc3a6cf
mov esi, 0xc0000095
jmp 0xc3a7a6
mov esi, dword [0xc9304c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [0xc95870], eax
lea edi, [ebp - 0x740]
mov eax, dword [0xc95878]
mov dword [ebp - 0x1528], eax
xor eax, eax
stosd dword es:[edi], eax
push 0x2c
mov dword [0xc95874], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push eax
mov dword [ebp - 0x193c], eax
mov dword [ebp - 0x1938], eax
mov dword [ebp - 0x1534], eax
mov dword [ebp - 0x1510], eax
lea eax, [ebp - 0xa5c]
push eax
call fcn.00ab4bf6
add esp, 0xc
mov edx, 0xc96238
xor eax, eax
mov dword [ebp - 0x1518], eax
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc35ee2
mov eax, dword [0xc95890]
test eax, eax
jne 0xc3650d
push 0x338
mov esi, eax
mov dword [ebp - 0x14d0], eax
push eax
mov dword [ebp - 0x1530], eax
mov dword [ebp - 0x1524], esi
mov dword [ebp - 0x14e0], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1500], eax
test eax, eax
je 0xc36501
or dword [ebp - 0x1504], 0xffffffff
xor edx, edx
add eax, 7
mov dword [ebp - 0x6e4], 0xab69605e
mov cl, dl
mov dword [ebp - 0x6e0], 0x7f1137f
mov dword [ebp - 0x14f4], edx
mov esi, 0x9fbcf2
mov dword [ebp - 0x1548], edx
mov dword [ebp - 0x14d4], eax
mov dword [ebp - 0x14dc], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [ebp - 0x14d8], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [ebp - 0x14ec], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [ebp - 0x1548]
xor esi, edx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x14d8]
xor eax, edx
mov dword [ebp - 0x14d8], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x14d8]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x14d8]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x14d8], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x14d8]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x14d8]
xor edx, eax
mov dword [ebp - 0x14d8], edx
mov eax, dword [ebp - 0x14d8]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x14d8]
xor eax, edx
mov dword [ebp - 0x14d8], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x14d8]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x14d8]
xor eax, edx
mov dword [ebp - 0x14d8], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x14d8]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0x14d8]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0x14d8], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0x14d8]
xor eax, 0xab69605e
mov dword [ebp - 0x1548], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1548]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x1548]
xor eax, edx
mov dword [ebp - 0x1548], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x1548], edx
mov edx, dword [ebp - 0x1548]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x1548], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1548]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x1548]
xor eax, edx
mov dword [ebp - 0x1548], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1548]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x1548]
xor eax, edx
mov dword [ebp - 0x1548], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1548]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x1548]
xor edx, dword [ebp - 0x14f4]
xor eax, dword [ebp - 0x1504]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x14d8], esi
mov esi, dword [ebp - 0x14d4]
mov dword [ebp - 0x14f4], ebx
mov dword [ebp - 0x1504], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x14dc], 1
mov dword [ebp - 0x14d4], esi
mov esi, dword [ebp - 0x14ec]
mov dword [ebp - 0x1548], eax
jne 0xc35f7a
mov esi, dword [ebp - 0x1500]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc362ef
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc36321
cmp edx, dword [0x9fc02c]
jne 0xc36321
mov edi, esi
xor eax, eax
mov dword [ebp - 0x1524], edi
mov esi, eax
mov ebx, 0x337
jmp 0xc36336
mov edi, dword [ebp - 0x1524]
or ebx, 0xffffffff
mov dword [ebp - 0x14e0], 0xc004d501
xor eax, eax
test esi, esi
je 0xc36349
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x14e0], 0
jl 0xc364fb
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xc960a0
push eax
push ebx
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xc3648f
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x16bc]
jne 0xc36380
sub ecx, ebx
xor eax, eax
push edi
sar ecx, 1
push edx
push eax
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc364f4
xor eax, eax
mov edx, 0x5a4d
mov ecx, eax
mov eax, dword [edi]
mov dword [ebp - 0x1530], ecx
cmp word [eax], dx
je 0xc363cc
mov ecx, 0xc000007b
mov dword [ebp - 0x1530], ecx
jmp 0xc36416
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc363bf
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc363bf
cmp dword [edx], 0x4550
jne 0xc363bf
movzx eax, word [edx + 0x18]
mov ebx, 0x10b
cmp ax, bx
je 0xc36404
mov ebx, 0x20b
cmp ax, bx
je 0xc36404
mov ecx, 0xc000000d
jmp 0xc363c4
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
xor edx, edx
add esi, 6
mov dword [ebp - 0x14e0], eax
mov ebx, edx
test eax, eax
je 0xc36483
mov edx, esi
mov dword [ebp - 0x1500], esi
lea eax, [edx + 1]
mov dword [ebp - 0x14f4], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc3643b
sub edx, dword [ebp - 0x14f4]
inc esi
add esi, edx
test ecx, ecx
js 0xc36474
push dword [ebp - 0x1500]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc3648f
mov ecx, dword [ebp - 0x14d0]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x1530]
inc dword [ebp - 0x14d0]
inc ebx
cmp ebx, dword [ebp - 0x14e0]
jb 0xc3642a
add edi, 0x10
cmp byte [esi], 0
jne 0xc36379
mov ebx, dword [ebp - 0x1530]
mov esi, dword [ebp - 0x1524]
test esi, esi
je 0xc364b0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc36508
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc364c9
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc364b8
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc36513
mov ebx, 0xc000007a
jmp 0xc36495
mov esi, dword [ebp - 0x1524]
mov ebx, 0xc000007a
jmp 0xc3649b
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edx, 0xc96238
xchg dword [edx], eax
xor eax, eax
lea edi, [ebp - 0x1a8c]
mov dword [ebp - 0x14d0], eax
mov dword [ebp - 0x1530], eax
mov dword [ebp - 0x1524], eax
mov dword [ebp - 0x14e0], eax
mov dword [ebp - 0x1500], eax
mov dword [ebp - 0x14f4], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc3654c
mov eax, dword [0xc95890]
test eax, eax
jne 0xc36b91
push 0x338
mov esi, eax
mov dword [ebp - 0x1504], eax
push eax
mov dword [ebp - 0x1548], eax
mov dword [ebp - 0x14d4], esi
mov dword [ebp - 0x14dc], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x14d8], eax
test eax, eax
je 0xc36b85
or dword [ebp - 0x14f8], 0xffffffff
xor edx, edx
add eax, 7
mov dword [ebp - 0x6ec], 0xab69605e
mov edi, 0x9fbcf2
mov dword [ebp - 0x6e8], 0x7f1137f
mov cl, dl
mov dword [ebp - 0x14ec], edx
mov dword [ebp - 0x14e8], eax
mov dword [ebp - 0x14e4], edi
mov dword [ebp - 0x14fc], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0x14e4]
xor edx, ebx
mov dword [ebp - 0x14f0], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0x14e4]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0x14e4]
shl edi, 8
add dword [ebp - 0x14e4], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
mov dword [ebp - 0x1508], esi
mov esi, edx
xor esi, dword [ebp - 0x1508]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x14f0]
xor eax, edx
mov dword [ebp - 0x14f0], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x14f0]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x14f0]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x14f0], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x14f0]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x14f0]
xor edx, eax
mov dword [ebp - 0x14f0], edx
mov eax, dword [ebp - 0x14f0]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x14f0]
xor eax, edx
mov dword [ebp - 0x14f0], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x14f0]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x14f0]
xor eax, edx
mov dword [ebp - 0x14f0], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x14f0]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0x14f0]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0x14f0], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0x14f0]
xor eax, 0xab69605e
mov dword [ebp - 0x1508], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1508]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x1508]
xor eax, edx
mov dword [ebp - 0x1508], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x1508], edx
mov edx, dword [ebp - 0x1508]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x1508], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1508]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x1508]
xor eax, edx
mov dword [ebp - 0x1508], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1508]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x1508]
xor eax, edx
mov dword [ebp - 0x1508], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1508]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x1508]
xor edx, dword [ebp - 0x14ec]
xor eax, dword [ebp - 0x14f8]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x14f0], esi
mov esi, dword [ebp - 0x14e8]
mov dword [ebp - 0x14f8], edi
mov edi, dword [ebp - 0x14e4]
mov dword [ebp - 0x14ec], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x14fc], 1
mov dword [ebp - 0x14e8], esi
mov esi, eax
mov dword [ebp - 0x1508], eax
jne 0xc365e4
mov esi, dword [ebp - 0x14d8]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc36971
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc369a3
cmp edx, dword [0x9fc02c]
jne 0xc369a3
mov ebx, esi
xor eax, eax
mov dword [ebp - 0x14d4], ebx
mov esi, eax
mov edi, 0x337
jmp 0xc369b8
mov ebx, dword [ebp - 0x14d4]
or edi, 0xffffffff
mov dword [ebp - 0x14dc], 0xc004d501
xor eax, eax
test esi, esi
je 0xc369cb
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x14dc], 0
jl 0xc36b7f
xor eax, eax
mov esi, ebx
push 0x40
push eax
push 0xc960a0
mov byte [edi + ebx], al
call fcn.00ab4bf6
add esp, 0xc
cmp byte [ebx], 0
je 0xc36b13
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x16bc]
jne 0xc36a04
sub ecx, ebx
xor eax, eax
push edi
sar ecx, 1
push edx
push eax
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc36b78
xor eax, eax
mov edx, 0x5a4d
mov ecx, eax
mov eax, dword [edi]
mov dword [ebp - 0x1548], ecx
cmp word [eax], dx
je 0xc36a50
mov ecx, 0xc000007b
mov dword [ebp - 0x1548], ecx
jmp 0xc36a9a
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc36a43
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc36a43
cmp dword [edx], 0x4550
jne 0xc36a43
movzx eax, word [edx + 0x18]
mov ebx, 0x10b
cmp ax, bx
je 0xc36a88
mov ebx, 0x20b
cmp ax, bx
je 0xc36a88
mov ecx, 0xc000000d
jmp 0xc36a48
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
xor edx, edx
add esi, 6
mov dword [ebp - 0x14dc], eax
mov ebx, edx
test eax, eax
je 0xc36b07
mov edx, esi
mov dword [ebp - 0x14d8], esi
lea eax, [edx + 1]
mov dword [ebp - 0x14ec], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc36abf
sub edx, dword [ebp - 0x14ec]
inc esi
add esi, edx
test ecx, ecx
js 0xc36af8
push dword [ebp - 0x14d8]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc36b13
mov ecx, dword [ebp - 0x1504]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x1548]
inc dword [ebp - 0x1504]
inc ebx
cmp ebx, dword [ebp - 0x14dc]
jb 0xc36aae
add edi, 0x10
cmp byte [esi], 0
jne 0xc369fd
mov ebx, dword [ebp - 0x1548]
mov esi, dword [ebp - 0x14d4]
test esi, esi
je 0xc36b34
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc36b8c
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc36b4d
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc36b3c
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc36b97
mov ebx, 0xc000007a
jmp 0xc36b19
mov esi, dword [ebp - 0x14d4]
mov ebx, 0xc000007a
jmp 0xc36b1f
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x1424]
push eax
call fcn.00ab4bf6
xor eax, eax
mov esi, dword [0xc9307c]
lea edi, [ebp - 0x744]
add esp, 0xc
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
pop edx
push 0x403
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x1528]
mov ecx, eax
and ecx, edx
mov dword [ebp - 0x1528], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0x14], cx
mov ecx, eax
shr eax, 0xc
and eax, edx
shr ecx, 8
mov word [ebp - 0x10], ax
and ecx, edx
xor eax, eax
mov word [ebp - 0x12], cx
push eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x1504], eax
mov dword [ebp - 0x1548], 0xffffff
test eax, eax
jne 0xc36c46
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc36c36
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc378f1
mov ebx, 0x80004005
jmp 0xc378f1
mov edi, dword [0xc93050]
xor eax, eax
mov esi, eax
mov dword [ebp - 0x1840], eax
mov dword [ebp - 0x14dc], eax
mov ecx, edi
mov dword [ebp - 0x14d8], eax
mov dword [ebp - 0x14ec], eax
mov dword [ebp - 0x1844], eax
lea eax, [ebp - 0x1844]
push eax
xor eax, eax
mov dword [ebp - 0x14d4], esi
push eax
lea eax, [ebp - 0x1588]
push eax
push 8
call dword [0xc99200]
call edi
test eax, eax
jne 0xc36cbe
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc36cac
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc36e43
mov ebx, 0x80004005
mov edi, esi
jmp 0xc37447
mov eax, dword [ebp - 0x1844]
add eax, eax
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x14f8], edi
test edi, edi
jne 0xc36ced
mov ebx, 0x8007000e
jmp 0xc36e2e
mov eax, dword [ebp - 0x1588]
lea eax, [eax*4 + 4]
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x14e8], esi
test esi, esi
jne 0xc36d21
mov ebx, 0x8007000e
jmp 0xc36e13
mov ebx, dword [0xc93050]
lea eax, [ebp - 0x1844]
push eax
push edi
lea eax, [ebp - 0x1588]
mov ecx, ebx
push eax
push 8
call dword [0xc99200]
call ebx
test eax, eax
jne 0xc36d6d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc36d5d
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc36e13
mov ebx, 0x80004005
jmp 0xc36e13
xor eax, eax
cmp dword [ebp - 0x1588], 0
mov dword [ebp - 0x14d4], eax
mov eax, esi
jbe 0xc36df0
mov dword [ebp - 0x14e4], edi
mov edi, esi
mov esi, dword [ebp - 0x14e4]
mov ebx, dword [0xc93058]
xor eax, eax
push eax
push esi
mov ecx, ebx
call dword [0xc99200]
call ebx
mov ecx, esi
mov dword [edi], eax
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc36dab
mov eax, dword [ebp - 0x14d4]
sub ecx, edx
sar ecx, 1
add edi, 4
lea esi, [esi + ecx*2]
add esi, 2
inc eax
mov dword [ebp - 0x14d4], eax
cmp eax, dword [ebp - 0x1588]
jb 0xc36d8e
mov esi, dword [ebp - 0x14e8]
mov dword [ebp - 0x14d4], edi
mov edi, dword [ebp - 0x14f8]
mov eax, dword [ebp - 0x14d4]
mov ebx, dword [ebp - 0x14ec]
mov dword [eax], 0x409
xor eax, eax
mov dword [ebp - 0x14d4], esi
mov esi, eax
mov eax, dword [ebp - 0x1588]
inc eax
mov dword [ebp - 0x14f8], eax
test esi, esi
je 0xc36e28
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0x14d4]
test edi, edi
je 0xc36e43
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc36f90
xor eax, eax
mov ebx, eax
mov ecx, eax
mov dword [ebp - 0x14e8], ebx
cmp dword [ebp - 0x14f8], eax
jbe 0xc36e88
mov edx, dword [esi + ecx*4]
cmp edx, dword [eax*4 + 0xa192e8]
je 0xc36e7e
inc eax
cmp eax, 0x26
jb 0xc36e62
inc ecx
xor eax, eax
cmp ecx, dword [ebp - 0x14f8]
jae 0xc36e88
jmp 0xc36e5f
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x14e8], ebx
mov esi, dword [0xc93054]
mov ecx, esi
push eax
mov dword [ebp - 0x14f8], eax
lea eax, [ebp - 0xc0]
push 0x55
push eax
push dword [ebx*4 + 0xa192e8]
call dword [0xc99200]
call esi
test eax, eax
je 0xc36ef1
mov esi, dword [0xc93048]
lea eax, [ebp - 0x7e4]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xc0]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
test eax, eax
jle 0xc36ef1
mov ebx, dword [ebp - 0x7d8]
shr ebx, 0x1b
and ebx, 1
mov dword [ebp - 0x14f8], ebx
mov ebx, dword [ebp - 0x14e8]
xor eax, eax
mov edx, 0x9fba10
mov esi, eax
mov ecx, edx
mov dword [ebp + esi*4 - 0x684], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x16bc]
jne 0xc36f06
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0xc36efa
imul ecx, ebx, 3
movzx eax, byte [ecx + 0xa00b58]
mov eax, dword [ebp + eax*4 - 0x684]
mov dword [ebp - 0x14e0], eax
movzx eax, byte [ecx + 0xa00b59]
mov eax, dword [ebp + eax*4 - 0x684]
mov dword [ebp - 0x1500], eax
movzx eax, byte [ecx + 0xa00b5a]
mov eax, dword [ebp + eax*4 - 0x684]
mov dword [ebp - 0x14f4], eax
xor eax, eax
push 0x1c90
push eax
mov dword [ebp - 0x14ec], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x14e4], ecx
test ecx, ecx
jne 0xc36f9b
mov ebx, 0x8007000e
mov esi, dword [ebp - 0x14d8]
jmp 0xc36cb7
or dword [ebp - 0x14f0], 0xffffffff
xor edx, edx
xor eax, eax
mov dword [ebp - 0x6f4], 0xab69605e
add ecx, 7
mov dword [ebp - 0x6f0], 0x7f1137f
mov edi, 0xa19392
mov dword [ebp - 0x14fc], edx
mov esi, edx
mov dword [ebp - 0x1508], ecx
mov dword [ebp - 0x150c], edi
mov dword [ebp - 0x151c], 0x392
movzx ebx, byte [edi - 2]
movzx ecx, byte [edi - 1]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edi]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, ecx
shl edi, 8
mov ecx, dword [ebp - 0x150c]
xor edx, ebx
movzx ecx, byte [ecx + 3]
or edi, ecx
mov ecx, dword [ebp - 0x150c]
shl edi, 8
movzx ecx, byte [ecx + 4]
or edi, ecx
mov ecx, dword [ebp - 0x150c]
shl edi, 8
add dword [ebp - 0x150c], 8
movzx ecx, byte [ecx + 5]
or edi, ecx
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov ecx, esi
mov dword [ebp - 0x1520], esi
add ecx, 0x54969fa2
rol dword [ebp - 0x1520], 0xa
rol ecx, 5
imul ecx, ecx, 0x137f
add ecx, dword [ebp - 0x1520]
xor edx, ecx
mov dword [ebp - 0x153c], edx
lea ecx, [edx + 0x7f1137f]
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0x153c]
rol ecx, 2
sub edx, ecx
xor esi, edx
imul edx, esi, 0x605e
mov ecx, esi
shr ecx, 0xd
sub edx, ecx
mov ecx, dword [ebp - 0x153c]
sub edx, 0x756c8a2
xor ecx, edx
mov dword [ebp - 0x153c], ecx
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0x153c]
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub ecx, edx
mov edx, dword [ebp - 0x153c]
xor edx, ecx
mov dword [ebp - 0x153c], edx
mov ecx, dword [ebp - 0x153c]
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor esi, edx
lea ecx, [esi + 0x7f1137f]
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, esi
rol ecx, 2
add edx, ecx
mov ecx, dword [ebp - 0x153c]
xor ecx, edx
mov dword [ebp - 0x153c], ecx
add ecx, 0x54969fa2
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0x153c]
rol ecx, 8
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69605e
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, esi
ror ecx, 0xa
xor edx, ecx
mov ecx, dword [ebp - 0x153c]
xor ecx, edx
mov dword [ebp - 0x153c], ecx
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0x153c]
shr ecx, 0xa
xor edx, ecx
xor esi, edx
mov edx, dword [ebp - 0x153c]
mov ecx, esi
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor edx, ecx
mov dword [ebp - 0x153c], edx
lea ecx, [edx - 0x7f1]
xor ecx, esi
mov esi, dword [ebp - 0x153c]
xor ecx, 0xab69605e
mov dword [ebp - 0x1520], ecx
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0x1520]
shr ecx, 2
add edx, ecx
xor esi, edx
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, esi
rol ecx, 7
add edx, ecx
mov ecx, dword [ebp - 0x1520]
xor ecx, edx
mov dword [ebp - 0x1520], ecx
mov edx, ecx
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69
rol ecx, 5
imul edx, ecx, 0x7f1
mov ecx, esi
rol ecx, 7
add edx, ecx
xor dword [ebp - 0x1520], edx
mov edx, dword [ebp - 0x1520]
xor esi, edx
xor esi, 0xac987321
mov ecx, esi
ror ecx, 3
imul ecx, ecx, 0x137f
sub ecx, 0xd0dd417
xor edx, ecx
mov dword [ebp - 0x1520], edx
lea ecx, [edx - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0x1520]
ror ecx, 6
sub edx, ecx
xor esi, edx
lea ecx, [esi - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, esi
rol ecx, 0xe
add edx, ecx
mov ecx, dword [ebp - 0x1520]
xor ecx, edx
mov dword [ebp - 0x1520], ecx
add ecx, 0xab69605e
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0x1520]
ror ecx, 0xe
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, esi
shr ecx, 3
xor edx, ecx
mov ecx, dword [ebp - 0x1520]
xor ecx, edx
mov dword [ebp - 0x1520], ecx
xor ecx, 0x7f1137f
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0x1520]
rol ecx, 2
xor edx, ecx
mov ecx, dword [ebp - 0x1520]
xor edx, dword [ebp - 0x14fc]
xor ecx, dword [ebp - 0x14f0]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x153c], esi
mov esi, dword [ebp - 0x1508]
mov dword [ebp - 0x14f0], edi
mov edi, dword [ebp - 0x150c]
mov dword [ebp - 0x14fc], ebx
mov byte [esi - 4], dl
mov byte [esi], cl
ror edx, 8
mov byte [esi - 5], dl
ror ecx, 8
mov byte [esi - 1], cl
ror edx, 8
mov byte [esi - 6], dl
ror ecx, 8
mov byte [esi - 2], cl
ror edx, 8
ror ecx, 8
mov byte [esi - 7], dl
mov byte [esi - 3], cl
add esi, 8
ror ecx, 8
ror edx, 8
sub dword [ebp - 0x151c], 1
mov dword [ebp - 0x1508], esi
mov esi, ecx
mov dword [ebp - 0x1520], ecx
jne 0xc36fe0
xor ecx, ecx
mov esi, 0x1c90
mov edx, ecx
mov ecx, dword [ebp - 0x14e4]
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0xc37379
movzx eax, al
cdq
cmp eax, dword [0xa1b020]
jne 0xc373ad
cmp edx, dword [0xa1b024]
jne 0xc373ad
mov ebx, dword [ebp - 0x14ec]
xor eax, eax
mov dword [ebp - 0x1840], ecx
mov ecx, eax
mov dword [ebp - 0x14dc], esi
jmp 0xc373b8
mov ebx, 0xc004d501
mov dword [ebp - 0x14ec], ebx
test ecx, ecx
je 0xc373cd
push ecx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc36f90
mov edi, dword [ebp - 0x1840]
xor eax, eax
mov ebx, dword [ebp - 0x14e8]
mov esi, eax
mov edx, eax
cmp ebx, edx
jne 0xc373f2
mov dword [ebp + esi*4 - 0x594], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0x14d8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc373fd
sub ecx, dword [ebp - 0x14d8]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0xc373e7
inc esi
push 0
pop eax
cmp esi, 6
jb 0xc373e5
push 0xc
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, dword [ebp - 0x14ec]
mov esi, eax
test esi, esi
jne 0xc375b6
mov ebx, 0x8007000e
mov edi, dword [ebp - 0x1524]
test esi, esi
je 0xc374bb
xor eax, eax
mov dword [ebp - 0x14d8], eax
mov edx, dword [esi + eax*4]
test edx, edx
je 0xc374af
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x14ec], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x16bc]
jne 0xc37465
sub ecx, dword [ebp - 0x14ec]
xor eax, eax
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc3749a
mov byte [edx], al
inc edx
sub ecx, 1
jne 0xc37489
mov edx, dword [ebp - 0x14d8]
mov edx, dword [esi + edx*4]
push edx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x14d8]
inc eax
mov dword [ebp - 0x14d8], eax
cmp eax, 3
jb 0xc37453
mov eax, dword [ebp - 0x1840]
test eax, eax
je 0xc374d9
mov ecx, dword [ebp - 0x14dc]
test ecx, ecx
je 0xc374d9
xor edx, edx
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0xc374d1
test esi, esi
je 0xc374ee
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1840]
test eax, eax
je 0xc37511
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebp - 0x1840], eax
mov eax, dword [ebp - 0x14d4]
test eax, eax
je 0xc3752c
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc378d8
mov eax, dword [edi]
mov esi, dword [0xc930b4]
mov ecx, esi
mov dword [ebp - 0x141c], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x1418], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x1414], eax
xor eax, eax
push eax
mov dword [ebp - 0x1a24], eax
mov edi, eax
mov dword [ebp - 0x1a20], eax
mov ebx, eax
lea eax, [ebp - 0x1a28]
mov dword [ebp - 0x1a28], 0xc
push eax
xor eax, eax
push eax
push 0x42
call dword [0xc99200]
call esi
test eax, eax
jne 0xc37765
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc375a6
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc3776e
mov ebx, 0x80004005
jmp 0xc3776e
xor eax, eax
mov edi, esi
mov edx, esi
mov dword [ebp - 0x14ec], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov ecx, eax
mov eax, esi
sub eax, esi
mov dword [ebp - 0x14d8], ecx
mov dword [ebp - 0x14e8], eax
movzx edi, word [ebp + ecx*2 - 0x14]
xor eax, eax
cmp di, word [eax*2 + 0xa19380]
je 0xc375f5
inc eax
cmp eax, 6
jb 0xc375e0
jmp 0xc376db
mov edi, dword [ebp + eax*4 - 0x594]
mov ecx, edi
mov edx, dword [0xc93060]
mov dword [ebp - 0x14e4], edx
lea eax, [ecx + 1]
mov dword [ebp - 0x14fc], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc37613
sub ecx, dword [ebp - 0x14fc]
xor eax, eax
push eax
push eax
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
xor eax, eax
push eax
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0x14e4]
mov dword [ebp - 0x14e4], eax
test eax, eax
je 0xc37738
lea ecx, [eax + eax]
xor eax, eax
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0x14ec]
mov edx, dword [ebp - 0x14e8]
mov dword [edx + ecx], eax
mov eax, dword [ecx]
mov dword [ebp - 0x14fc], eax
test eax, eax
je 0xc3743c
mov edx, dword [0xc93060]
mov ecx, edi
mov dword [ebp - 0x14f0], edx
lea eax, [ecx + 1]
mov dword [ebp - 0x1508], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc37697
push dword [ebp - 0x14e4]
sub ecx, dword [ebp - 0x1508]
push dword [ebp - 0x14fc]
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
xor eax, eax
push eax
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0x14f0]
test eax, eax
je 0xc37711
mov ecx, dword [ebp - 0x14d8]
mov edx, dword [ebp - 0x14ec]
inc ecx
add edx, 4
mov dword [ebp - 0x14d8], ecx
mov dword [ebp - 0x14ec], edx
cmp ecx, 3
jb 0xc375d9
xor eax, eax
mov edi, esi
mov esi, eax
mov dword [ebp - 0x1524], edi
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x1424], eax
jmp 0xc37447
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc37728
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc37441
mov ebx, 0x80004005
jmp 0xc37441
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc3774f
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
mov edi, dword [ebp - 0x1524]
js 0xc37447
mov ebx, 0x80004005
jmp 0xc37447
mov edi, dword [ebp - 0x1a24]
and edi, 1
mov dword [ebp - 0x1420], edi
test ebx, ebx
js 0xc378d8
mov eax, dword [ebp - 0x1528]
push 0x2a
pop ecx
mov dword [ebp - 0x14d4], ecx
sub eax, 1
je 0xc377b9
sub eax, 1
je 0xc377ad
sub eax, 1
jne 0xc377c9
mov ebx, 0xe1
mov dword [ebp - 0x14d0], ebx
mov dword [ebp - 0x1530], ebx
jmp 0xc377c9
mov dword [ebp - 0x14d0], 0xf
jmp 0xc377bf
mov dword [ebp - 0x14d0], ecx
mov dword [ebp - 0x1530], 0xb
push 0x60
pop edi
xor eax, eax
mov dword [ebp - 0x14dc], edi
lea esi, [edi + 0x7c]
push esi
push eax
lea eax, [ebp - 0xe3c]
push eax
call fcn.00ab4bf6
add esp, 0xc
mov word [ebp - 0xdf8], si
mov esi, dword [0xc93070]
lea eax, [ebp - 0xe3c]
mov ecx, esi
push eax
push 0xffffffffffffffff
xor eax, eax
push eax
call dword [0xc99200]
call esi
test eax, eax
je 0xc3784c
movzx ebx, word [ebp - 0xd96]
mov eax, dword [ebp - 0xd90]
mov ecx, dword [ebp - 0xd8c]
mov dword [ebp - 0x14dc], ebx
mov dword [ebp - 0x14d8], eax
mov dword [ebp - 0x1a84], eax
mov dword [ebp - 0x14ec], ecx
mov dword [ebp - 0x1a80], ecx
cmp ebx, edi
jae 0xc37864
mov dword [ebp - 0x14dc], edi
jmp 0xc37864
mov eax, dword [ebp - 0x1a80]
mov dword [ebp - 0x14ec], eax
mov eax, dword [ebp - 0x1a84]
mov dword [ebp - 0x14d8], eax
cmp dword [ebp - 0x1528], 1
mov edi, dword [ebp - 0x14e0]
je 0xc37879
mov edi, dword [ebp - 0x14f4]
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0x14f8], eax
test eax, eax
jne 0xc37a9d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc378cd
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc37b3d
mov ebx, 0x80004005
xor eax, eax
push dword [ebp - 0x1504]
mov esi, dword [0xc930b0]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov edi, 0xc96238
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc378f6
mov eax, dword [0xc95890]
test eax, eax
jle 0xc37959
sub eax, 1
mov dword [0xc95890], eax
jne 0xc37959
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc3792b
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc3791a
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
mov eax, dword [ebp - 0x1524]
test eax, eax
je 0xc37978
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc39dd1
mov edi, dword [ebp - 0x744]
xor eax, eax
mov ebx, dword [ebp - 0x740]
push 0x54
push eax
lea eax, [ebp - 0x13d0]
mov dword [ebp - 0x193c], edi
push eax
mov dword [ebp - 0x1938], ebx
call fcn.00ab4bf6
mov esi, dword [0xc93028]
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x14d0], 1
push 7
push dword [ebp - 0x1538]
call dword [0xc99200]
call esi
test eax, eax
je 0xc37a17
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x13d0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc37a17
push 0x20
pop eax
cmp word [ebp - 0x13be], ax
jne 0xc37a17
cmp dword [ebp - 0x13bc], 0
je 0xc37a17
cmp dword [ebp - 0x13cc], 0
jle 0xc37a17
cmp dword [ebp - 0x13c8], 0
jg 0xc37a2c
xor eax, eax
cmp dword [ebp - 0x1528], 1
mov dword [ebp - 0x14d0], eax
jne 0xc38389
mov esi, dword [0xc930a8]
lea eax, [ebp - 0x1400]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc930a8]
lea eax, [ebp - 0x13f0]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov ebx, dword [ebp - 0x1528]
cmp ebx, 1
jne 0xc3838f
mov eax, dword [ebp - 0x1420]
mov esi, dword [0xc93014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0x1518], eax
jmp 0xc3838f
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0x14dc]
push dword [ebp - 0x14d0]
call dword [0xc99200]
call esi
push edi
push 0x20
neg eax
mov dword [ebp - 0xc74], 0x190
pop edx
lea ecx, [ebp - 0xc68]
mov dword [ebp - 0xc84], eax
mov byte [ebp - 0xc6a], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0xc84]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc37b1e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc37b15
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc37b24
mov ebx, 0x80004005
jmp 0xc37b24
mov dword [ebp - 0x1410], eax
push dword [ebp - 0x14f8]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xc378d8
cmp dword [ebp - 0x1528], 1
je 0xc37b5a
mov eax, dword [ebp - 0x14f4]
mov dword [ebp - 0x14e0], eax
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0xc28]
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov edi, eax
test edi, edi
jne 0xc37bb1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc37ba6
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc37c51
jmp 0xc378d3
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0x14dc]
push dword [ebp - 0x1530]
call dword [0xc99200]
call esi
push dword [ebp - 0x14e0]
neg eax
mov dword [ebp - 0xc18], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0xc0c]
mov dword [ebp - 0xc28], eax
mov byte [ebp - 0xc0e], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0xc28]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc37c37
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc37c2e
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc37c3d
mov ebx, 0x80004005
jmp 0xc37c3d
mov dword [ebp - 0x140c], eax
mov esi, dword [0xc930b0]
xor eax, eax
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
xor eax, eax
test ebx, ebx
js 0xc378da
mov ebx, dword [ebp - 0x1528]
mov ecx, eax
mov edx, eax
mov eax, ebx
sub eax, 1
je 0xc37c76
sub eax, 1
je 0xc37cb2
sub eax, 1
jne 0xc37c82
mov ecx, dword [ebp - 0x14d8]
mov edx, dword [ebp - 0x14ec]
xor eax, eax
mov dword [ebp - 0x73c], ecx
mov dword [ebp - 0x738], edx
xor edx, edx
inc edx
cmp ebx, edx
je 0xc37cee
lea eax, [ebx - 2]
cmp eax, edx
ja 0xc37cc8
xor eax, eax
xor ebx, ebx
mov edx, eax
mov dword [ebp - 0x14d4], ebx
mov dword [ebp - 0x14e0], ebx
jmp 0xc37cfc
mov eax, dword [ebp - 0x14d8]
cdq
and edx, 3
lea ecx, [edx + eax]
sar ecx, 2
xor eax, eax
mov edx, eax
jmp 0xc37c84
mov eax, dword [ebp - 0x1588]
mov edx, dword [ebp - 0x1588]
mov dword [ebp - 0x14e0], eax
mov eax, dword [ebp - 0x1588]
mov dword [ebp - 0x14d4], eax
mov eax, dword [ebp - 0x1588]
jmp 0xc37cfc
push 0x20
pop esi
mov edx, 0x96
mov dword [ebp - 0x14e0], esi
mov dword [ebp - 0x14d0], edx
mov dword [ebp - 0x1530], eax
push dword [ebp - 0x1410]
mov esi, dword [0xc9303c]
sub ecx, edx
push dword [ebp - 0x1504]
mov edi, dword [ebp - 0x141c]
sub ecx, eax
mov dword [ebp - 0x14f4], ecx
xor eax, eax
mov dword [ebp - 0x13e8], ecx
mov ebx, eax
mov dword [ebp - 0x13f8], ecx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0x14d8], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x1400]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0x1504]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc37d7c
mov ebx, 0x80004005
mov eax, dword [ebp - 0x14d8]
test eax, eax
je 0xc37d98
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
xor eax, eax
test ebx, ebx
js 0xc378da
push dword [ebp - 0x140c]
mov esi, dword [0xc9303c]
mov ebx, eax
push dword [ebp - 0x1504]
mov edi, dword [ebp - 0x1418]
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0x14d8], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x13f0]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0x1504]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc37dfe
mov ebx, 0x80004005
mov eax, dword [ebp - 0x14d8]
test eax, eax
je 0xc37e1a
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xc378d8
mov eax, dword [ebp - 0x1528]
cmp eax, 2
je 0xc37e32
cmp eax, 3
jne 0xc37e48
mov edi, dword [ebp - 0x13e8]
cmp dword [ebp - 0x13f8], edi
jle 0xc37e4e
mov edi, dword [ebp - 0x13f8]
jmp 0xc37e4e
mov edi, dword [ebp - 0x14f4]
cmp dword [ebp - 0x1424], 0
mov esi, dword [0xc930a8]
mov ecx, esi
push dword [ebp - 0x14d4]
je 0xc37e8f
mov ebx, dword [ebp - 0x1530]
mov eax, ebx
sub eax, dword [ebp - 0x13f8]
add eax, edi
push eax
lea eax, [ebp - 0x1400]
push eax
call dword [0xc99200]
call esi
sub ebx, dword [ebp - 0x13e8]
add ebx, edi
jmp 0xc37ea5
mov ebx, dword [ebp - 0x14d0]
lea eax, [ebp - 0x1400]
push ebx
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x13f4]
add eax, dword [ebp - 0x14e0]
mov esi, dword [0xc930a8]
mov ecx, esi
push eax
push ebx
lea eax, [ebp - 0x13f0]
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1528]
cmp eax, 2
je 0xc3818b
cmp eax, 3
je 0xc3818b
cmp eax, 1
jne 0xc381a7
xor eax, eax
mov dword [ebp - 0x1404], 0xffffff
push 0x5c
push eax
lea eax, [ebp - 0xbcc]
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0x14d0], eax
test eax, eax
jne 0xc37f50
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc37f45
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc37ff1
jmp 0xc378d3
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0x14dc]
push 0xb
call dword [0xc99200]
call esi
push dword [ebp - 0x1500]
neg eax
mov dword [ebp - 0xbbc], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0xbb0]
mov dword [ebp - 0xbcc], eax
mov byte [ebp - 0xbb2], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0xbcc]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc37fd2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc37fc9
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc37fd8
mov ebx, 0x80004005
jmp 0xc37fd8
mov dword [ebp - 0x1408], eax
push dword [ebp - 0x14d0]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
xor eax, eax
test ebx, ebx
js 0xc378da
push dword [ebp - 0x1408]
mov esi, dword [0xc9303c]
mov ebx, eax
push dword [ebp - 0x1504]
mov dword [ebp - 0x13d8], edi
mov ecx, esi
mov edi, dword [ebp - 0x1414]
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0x14d0], eax
xor eax, eax
push eax
push 0x460
lea eax, [ebp - 0x13e0]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0x1504]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc3805d
mov ebx, 0x80004005
mov eax, dword [ebp - 0x14d0]
test eax, eax
je 0xc38079
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xc378d8
mov eax, dword [ebp - 0x13d8]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x13d8], eax
cmp eax, ecx
jge 0xc3809d
mov dword [ebp - 0x13d8], ecx
mov ebx, dword [ebp - 0x14dc]
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
pop edi
push edi
push ebx
push dword [ebp - 0x13e0]
mov dword [ebp - 0x13d4], 0x20
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x13dc]
mov dword [ebp - 0x13e0], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x13d8]
mov dword [ebp - 0x13dc], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x13d4]
mov dword [ebp - 0x13d8], eax
call dword [0xc99200]
call esi
mov ecx, dword [ebp - 0x13e4]
mov esi, dword [0xc930a8]
add ecx, 0x24
cmp dword [ebp - 0x1424], 0
mov dword [ebp - 0x13d4], eax
je 0xc38169
mov eax, dword [ebp - 0x1400]
cmp eax, dword [ebp - 0x13f0]
jl 0xc38154
mov eax, dword [ebp - 0x13f0]
push ecx
push eax
lea eax, [ebp - 0x13e0]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
jmp 0xc381a7
mov eax, dword [ebp - 0x13f8]
cmp eax, dword [ebp - 0x13e8]
jg 0xc3817d
mov eax, dword [ebp - 0x13e8]
sub eax, dword [ebp - 0x13d8]
add eax, dword [ebp - 0x13e0]
jmp 0xc38154
mov eax, dword [ebp - 0x13e4]
mov dword [ebp - 0x73c], edi
mov dword [ebp - 0x738], eax
mov dword [ebp - 0x1404], 0xffa8a8a8
mov eax, dword [ebp - 0x1424]
mov ebx, dword [ebp - 0x73c]
mov dword [ebp - 0x14d0], eax
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0x1530], eax
mov eax, dword [ebp - 0x1528]
sub eax, 1
je 0xc38376
sub eax, 1
je 0xc382a6
sub eax, 1
jne 0xc3829d
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x82c]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push 1
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x82c]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x82c], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xc3829d
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x818]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x810]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x810]
lea esi, [ebp - 0x818]
sub eax, ebx
lea edi, [ebp - 0x1a9c]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x744], eax
mov eax, dword [ebp - 0x80c]
sub eax, dword [ebp - 0x1530]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
mov dword [ebp - 0x740], eax
xor eax, eax
mov ebx, eax
jmp 0xc378da
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x8a4]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push 1
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x8a4]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x8a4], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xc3829d
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x890]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x888]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
cmp dword [ebp - 0x14d0], 0
lea esi, [ebp - 0x890]
lea edi, [ebp - 0x1a9c]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xc3834e
imul eax, dword [ebp - 0x888], 5
cdq
idiv ecx
add eax, dword [ebp - 0x890]
jmp 0xc3835c
mov eax, dword [ebp - 0x888]
sub eax, ebx
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x744], eax
mov eax, dword [ebp - 0x884]
sub eax, dword [ebp - 0x1530]
imul eax, eax, 0x5f
jmp 0xc38294
xor eax, eax
mov dword [ebp - 0x744], eax
mov dword [ebp - 0x740], eax
jmp 0xc3829f
mov ebx, dword [ebp - 0x1528]
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push dword [ebp - 0x1538]
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1424], 0
mov dword [ebp - 0x1530], eax
mov dword [ebp - 0x1524], 0x810
je 0xc383ca
mov dword [ebp - 0x1524], 0x20812
cmp dword [ebp - 0x14d0], 0
je 0xc38ecf
mov eax, dword [ebp - 0x1420]
mov ebx, dword [ebp - 0x141c]
mov dword [ebp - 0x14d0], eax
mov eax, dword [ebp - 0x1410]
mov dword [ebp - 0x14e0], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x137c]
mov dword [ebp - 0x1500], ebx
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x1328]
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0x14f4], eax
mov dword [ebp - 0x1504], eax
mov dword [ebp - 0x14d4], eax
mov dword [ebp - 0x14dc], eax
lea eax, [ebp - 0xa30]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x764]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xc39db1
mov esi, dword [0xc93028]
mov ecx, esi
mov ebx, dword [ebp - 0x1538]
push 7
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xc38f64
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x137c]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc384c0
mov eax, dword [ebp - 0x1368]
mov dword [ebp - 0x14f4], eax
mov eax, dword [ebp - 0x1378]
mov dword [ebp - 0x14d4], eax
mov eax, dword [ebp - 0x1374]
mov dword [ebp - 0x14dc], eax
mov esi, dword [0xc93008]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov ebx, eax
mov dword [ebp - 0x14d8], ebx
test ebx, ebx
je 0xc38f64
mov eax, dword [ebp - 0x13f8]
xor ecx, ecx
sub eax, dword [ebp - 0x1400]
mov esi, dword [0xc9300c]
mov dword [ebp - 0xa2c], eax
mov eax, dword [ebp - 0x13fc]
sub eax, dword [ebp - 0x13f4]
mov dword [ebp - 0xa28], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x1848], ecx
mov word [ebp - 0xa24], ax
pop eax
push ecx
push ecx
mov word [ebp - 0xa22], ax
lea eax, [ebp - 0x1848]
push eax
push ecx
lea eax, [ebp - 0xa30]
mov dword [ebp - 0x14ec], ecx
push eax
mov dword [ebp - 0xa20], ecx
mov dword [ebp - 0xa1c], ecx
mov dword [ebp - 0xa18], ecx
mov dword [ebp - 0xa14], ecx
mov dword [ebp - 0xa10], ecx
mov dword [ebp - 0xa0c], ecx
mov dword [ebp - 0xa08], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0xa30], 0x28
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0x14f8], edi
test edi, edi
jne 0xc385be
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x14ec], eax
test eax, eax
jle 0xc385a9
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x14ec], eax
test eax, eax
js 0xc38932
mov dword [ebp - 0x14ec], 0x80004005
jmp 0xc38932
mov esi, dword [0xc93034]
lea eax, [ebp - 0x1328]
push eax
push 0x54
push edi
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc385e8
mov eax, dword [ebp - 0x1314]
mov dword [ebp - 0x1504], eax
mov eax, dword [ebp - 0x13f8]
sub eax, dword [ebp - 0x1400]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x75c], eax
mov eax, dword [ebp - 0x13f4]
sub eax, dword [ebp - 0x13fc]
push edi
push ebx
mov dword [ebp - 0x758], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push ebx
call dword [0xc99200]
call esi
push dword [ebp - 0x14e0]
mov esi, dword [0xc9303c]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0x14e0], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x764]
mov ecx, edi
push eax
push ebx
call dword [0xc99200]
call edi
mov esi, dword [0xc9306c]
xor eax, eax
push eax
push dword [ebp - 0x1524]
lea eax, [ebp - 0x764]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0x1500]
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1528], 1
jne 0xc386db
cmp dword [ebp - 0x14d0], 0
je 0xc386cf
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0x14d0], eax
jmp 0xc386e5
mov dword [ebp - 0x14d0], 0xffffff
jmp 0xc386e5
mov dword [ebp - 0x14d0], 0xffa8a8a8
mov edx, dword [ebp - 0x1400]
xor ecx, ecx
mov eax, dword [ebp - 0x13fc]
mov edi, ecx
mov dword [ebp - 0x1500], edx
test edx, edx
jns 0xc3870d
mov edi, edx
neg edi
xor edx, edx
mov dword [ebp - 0x1500], edx
jmp 0xc3870f
xor edx, edx
test eax, eax
jns 0xc38719
mov ecx, eax
mov eax, edx
neg ecx
mov esi, dword [ebp - 0x75c]
mov edx, dword [ebp - 0x14d4]
sub esi, edi
sub edx, dword [ebp - 0x1500]
mov dword [ebp - 0x14e8], esi
cmp esi, edx
jl 0xc3873f
mov esi, edx
mov dword [ebp - 0x14e8], edx
mov edx, dword [ebp - 0x758]
sub dword [ebp - 0x14dc], eax
sub edx, ecx
mov dword [ebp - 0x14e4], edx
cmp edx, dword [ebp - 0x14dc]
jl 0xc38767
mov edx, dword [ebp - 0x14dc]
mov dword [ebp - 0x14e4], edx
test esi, esi
jle 0xc38900
test edx, edx
jle 0xc38900
mov edx, dword [ebp - 0x75c]
imul eax, dword [ebp - 0x14d4]
imul ecx, edx
shl edx, 2
add eax, dword [ebp - 0x1500]
add ecx, edi
mov edi, dword [ebp - 0x1504]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0x14f4]
mov dword [ebp - 0x14f4], edx
mov edx, dword [ebp - 0x14d4]
shl edx, 2
lea eax, [edi + eax*4]
mov dword [ebp - 0x1504], ecx
mov dword [ebp - 0x1500], eax
mov dword [ebp - 0x14d4], edx
mov ebx, eax
mov dword [ebp - 0x14f0], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0x14dc], edx
lea edi, [ecx + 2]
mov dword [ebp - 0x14fc], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc388a7
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x14d0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x14fc]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x14dc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x14d0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x14dc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x14ce]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x14dc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x14f0]
cdq
idiv ecx
mov edx, dword [ebp - 0x14dc]
add al, bl
mov ebx, dword [ebp - 0x14fc]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x14dc], edx
mov dword [ebp - 0x14f0], esi
jne 0xc387e1
mov ecx, dword [ebp - 0x1504]
mov eax, dword [ebp - 0x1500]
add ecx, dword [ebp - 0x14f4]
add eax, dword [ebp - 0x14d4]
sub dword [ebp - 0x14e4], 1
mov esi, dword [ebp - 0x14e8]
mov dword [ebp - 0x1504], ecx
mov dword [ebp - 0x1500], eax
jne 0xc387c5
mov ebx, dword [ebp - 0x14d8]
push dword [ebp - 0x14f8]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x14e0]
test eax, eax
je 0xc38932
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0x14ec], 0
jl 0xc39db1
mov eax, dword [ebp - 0x1420]
mov ebx, dword [ebp - 0x1418]
mov dword [ebp - 0x14d0], eax
mov eax, dword [ebp - 0x140c]
mov dword [ebp - 0x14e0], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x12d4]
mov dword [ebp - 0x1500], ebx
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x1478]
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0x14f4], eax
mov dword [ebp - 0x1504], eax
mov dword [ebp - 0x14d4], eax
mov dword [ebp - 0x14dc], eax
lea eax, [ebp - 0xa04]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x774]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xc39db1
mov esi, dword [0xc93028]
mov ecx, esi
mov ebx, dword [ebp - 0x1538]
push 7
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xc38f64
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x12d4]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc38a39
mov eax, dword [ebp - 0x12c0]
mov dword [ebp - 0x14f4], eax
mov eax, dword [ebp - 0x12d0]
mov dword [ebp - 0x14d4], eax
mov eax, dword [ebp - 0x12cc]
mov dword [ebp - 0x14dc], eax
mov esi, dword [0xc93008]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov ebx, eax
mov dword [ebp - 0x14d8], ebx
test ebx, ebx
je 0xc38f64
mov eax, dword [ebp - 0x13e8]
xor ecx, ecx
sub eax, dword [ebp - 0x13f0]
mov esi, dword [0xc9300c]
mov dword [ebp - 0xa00], eax
mov eax, dword [ebp - 0x13ec]
sub eax, dword [ebp - 0x13e4]
mov dword [ebp - 0x9fc], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x184c], ecx
mov word [ebp - 0x9f8], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x9f6], ax
lea eax, [ebp - 0x184c]
push eax
push ecx
lea eax, [ebp - 0xa04]
mov dword [ebp - 0x14ec], ecx
push eax
mov dword [ebp - 0x9f4], ecx
mov dword [ebp - 0x9f0], ecx
mov dword [ebp - 0x9ec], ecx
mov dword [ebp - 0x9e8], ecx
mov dword [ebp - 0x9e4], ecx
mov dword [ebp - 0x9e0], ecx
mov dword [ebp - 0x9dc], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0xa04], 0x28
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0x14f8], edi
test edi, edi
jne 0xc38b37
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x14ec], eax
test eax, eax
jle 0xc38b22
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x14ec], eax
test eax, eax
js 0xc38eac
mov dword [ebp - 0x14ec], 0x80004005
jmp 0xc38eac
mov esi, dword [0xc93034]
lea eax, [ebp - 0x1478]
push eax
push 0x54
push edi
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc38b61
mov eax, dword [ebp - 0x1464]
mov dword [ebp - 0x1504], eax
mov eax, dword [ebp - 0x13e8]
sub eax, dword [ebp - 0x13f0]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x76c], eax
mov eax, dword [ebp - 0x13e4]
sub eax, dword [ebp - 0x13ec]
push edi
push ebx
mov dword [ebp - 0x768], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push ebx
call dword [0xc99200]
call esi
push dword [ebp - 0x14e0]
mov esi, dword [0xc9303c]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0x14e0], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x774]
mov ecx, edi
push eax
push ebx
call dword [0xc99200]
call edi
mov esi, dword [0xc9306c]
xor eax, eax
push eax
push dword [ebp - 0x1524]
lea eax, [ebp - 0x774]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0x1500]
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1528], 1
jne 0xc38c4e
cmp dword [ebp - 0x14d0], 0
je 0xc38c42
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
jmp 0xc38c53
mov dword [ebp - 0x1528], 0xffffff
jmp 0xc38c5f
mov eax, 0xffa8a8a8
mov dword [ebp - 0x1528], eax
mov dword [ebp - 0x1548], eax
mov edx, dword [ebp - 0x13f0]
xor ecx, ecx
mov eax, dword [ebp - 0x13ec]
mov edi, ecx
mov dword [ebp - 0x14d0], edx
test edx, edx
jns 0xc38c87
mov edi, edx
neg edi
xor edx, edx
mov dword [ebp - 0x14d0], edx
jmp 0xc38c89
xor edx, edx
test eax, eax
jns 0xc38c93
mov ecx, eax
mov eax, edx
neg ecx
mov esi, dword [ebp - 0x76c]
mov edx, dword [ebp - 0x14d4]
sub esi, edi
sub edx, dword [ebp - 0x14d0]
mov dword [ebp - 0x1524], esi
cmp esi, edx
jl 0xc38cb9
mov esi, edx
mov dword [ebp - 0x1524], edx
mov edx, dword [ebp - 0x768]
sub dword [ebp - 0x14dc], eax
sub edx, ecx
mov dword [ebp - 0x1500], edx
cmp edx, dword [ebp - 0x14dc]
jl 0xc38ce1
mov edx, dword [ebp - 0x14dc]
mov dword [ebp - 0x1500], edx
test esi, esi
jle 0xc38e7a
test edx, edx
jle 0xc38e7a
mov edx, dword [ebp - 0x76c]
imul eax, dword [ebp - 0x14d4]
imul ecx, edx
shl edx, 2
add eax, dword [ebp - 0x14d0]
add ecx, edi
mov edi, dword [ebp - 0x1504]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0x14f4]
mov dword [ebp - 0x14f4], edx
mov edx, dword [ebp - 0x14d4]
shl edx, 2
lea eax, [edi + eax*4]
mov dword [ebp - 0x1504], ecx
mov dword [ebp - 0x14d0], eax
mov dword [ebp - 0x14d4], edx
mov ebx, eax
mov dword [ebp - 0x14e4], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0x14dc], edx
lea edi, [ecx + 2]
mov dword [ebp - 0x14e8], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc38e21
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x1548]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x14e8]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x14dc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x1548]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x14dc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x1526]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x14dc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x14e4]
cdq
idiv ecx
mov edx, dword [ebp - 0x14dc]
add al, bl
mov ebx, dword [ebp - 0x14e8]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x14dc], edx
mov dword [ebp - 0x14e4], esi
jne 0xc38d5b
mov ecx, dword [ebp - 0x1504]
mov eax, dword [ebp - 0x14d0]
add ecx, dword [ebp - 0x14f4]
add eax, dword [ebp - 0x14d4]
sub dword [ebp - 0x1500], 1
mov esi, dword [ebp - 0x1524]
mov dword [ebp - 0x1504], ecx
mov dword [ebp - 0x14d0], eax
jne 0xc38d3f
mov ebx, dword [ebp - 0x14d8]
push dword [ebp - 0x14f8]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x14e0]
test eax, eax
je 0xc38eac
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0x14ec], 0
jl 0xc39db1
jmp 0xc39d5f
cmp dword [ebp - 0x1420], 0
jne 0xc38ee1
cmp ebx, 1
je 0xc38ee1
mov al, 0xc0
jmp 0xc38ee3
or al, 0xff
mov esi, dword [0xc93008]
xor ecx, ecx
push dword [ebp - 0x1538]
mov edi, ecx
mov byte [ebp - 0x14ce], al
mov eax, ecx
mov byte [ebp - 0x14d0], cl
mov byte [ebp - 0x14cf], cl
mov dword [ebp - 0x1ad4], ecx
mov dword [ebp - 0x1ad0], ecx
mov dword [ebp - 0x14f4], ecx
mov dword [ebp - 0x1ab8], ecx
mov dword [ebp - 0x1ab4], ecx
mov dword [ebp - 0x1ab0], ecx
mov ecx, esi
mov byte [ebp - 0x14cd], 1
mov dword [ebp - 0x14e0], eax
mov dword [ebp - 0x1adc], eax
mov dword [ebp - 0x1500], edi
mov dword [ebp - 0x1ad8], edi
mov dword [ebp - 0x1abc], eax
call dword [0xc99200]
call esi
mov dword [ebp - 0x1534], eax
test eax, eax
jne 0xc38f6f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc39db1
cmp ebx, 1
jne 0xc3905b
mov ebx, dword [ebp - 0x13f8]
mov eax, ebx
mov ecx, dword [ebp - 0x13e8]
mov esi, ecx
sub esi, dword [ebp - 0x13f0]
sub eax, dword [ebp - 0x1400]
mov dword [ebp - 0x1504], esi
cmp esi, eax
jg 0xc38fa6
mov esi, eax
mov dword [ebp - 0x1504], eax
mov edx, dword [ebp - 0x13e4]
mov eax, edx
sub eax, dword [ebp - 0x13fc]
mov dword [ebp - 0x14d4], eax
xor eax, eax
cmp dword [ebp - 0x1424], eax
je 0xc38ff0
mov edi, dword [ebp - 0x1400]
mov eax, dword [ebp - 0x13f0]
sub edi, ebx
add edi, esi
sub eax, ecx
add eax, esi
mov dword [ebp - 0x14e0], edi
mov dword [ebp - 0x1adc], edi
mov dword [ebp - 0x14f4], eax
mov dword [ebp - 0x1abc], eax
sub ecx, dword [ebp - 0x13f0]
sub ebx, dword [ebp - 0x1400]
add ecx, eax
mov eax, dword [ebp - 0x13ec]
add ebx, edi
sub eax, dword [ebp - 0x13fc]
mov edi, dword [ebp - 0x13f4]
sub edi, dword [ebp - 0x13fc]
sub edx, dword [ebp - 0x13ec]
add edx, eax
mov dword [ebp - 0x1ad4], ebx
mov dword [ebp - 0x14dc], edi
mov dword [ebp - 0x1ad0], edi
mov dword [ebp - 0x14d8], ecx
mov dword [ebp - 0x1ab4], ecx
mov dword [ebp - 0x14ec], eax
mov dword [ebp - 0x1ab8], eax
mov dword [ebp - 0x14f8], edx
mov dword [ebp - 0x1ab0], edx
jmp 0xc390ed
mov eax, dword [ebp - 0x73c]
lea esi, [ebp - 0x1400]
lea edi, [ebp - 0x1adc]
mov dword [ebp - 0x1504], eax
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0x14d4], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1ad0]
lea esi, [ebp - 0x13f0]
mov ebx, dword [ebp - 0x1ad4]
lea edi, [ebp - 0x1abc]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14dc], eax
mov eax, dword [ebp - 0x1ad8]
mov dword [ebp - 0x1500], eax
mov eax, dword [ebp - 0x1adc]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14e0], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1ab0]
mov dword [ebp - 0x14f8], eax
mov eax, dword [ebp - 0x1ab4]
mov dword [ebp - 0x14d8], eax
mov eax, dword [ebp - 0x1ab8]
mov dword [ebp - 0x14ec], eax
mov eax, dword [ebp - 0x1abc]
mov dword [ebp - 0x14f4], eax
mov eax, dword [ebp - 0x14d4]
xor ecx, ecx
mov esi, dword [0xc9300c]
neg eax
mov edi, dword [ebp - 0x1504]
mov dword [ebp - 0xa54], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x1850], ecx
mov word [ebp - 0xa50], ax
pop eax
push ecx
push ecx
mov word [ebp - 0xa4e], ax
lea eax, [ebp - 0x1850]
push eax
push ecx
lea eax, [ebp - 0xa5c]
mov dword [ebp - 0xa4c], ecx
push eax
push dword [ebp - 0x1534]
mov dword [ebp - 0xa48], ecx
mov dword [ebp - 0xa44], ecx
mov dword [ebp - 0xa40], ecx
mov dword [ebp - 0xa3c], ecx
mov dword [ebp - 0xa38], ecx
mov dword [ebp - 0xa34], ecx
mov ecx, esi
mov dword [ebp - 0xa5c], 0x28
mov dword [ebp - 0xa58], edi
call dword [0xc99200]
call esi
mov dword [ebp - 0x1510], eax
test eax, eax
jne 0xc39193
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc39d96
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push dword [ebp - 0x1534]
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1528], 1
jne 0xc391fb
mov ecx, dword [ebp - 0x1518]
test ecx, ecx
je 0xc391fb
mov esi, dword [0xc93074]
xor eax, eax
mov dword [ebp - 0x784], eax
mov dword [ebp - 0x780], eax
mov eax, dword [ebp - 0x14d4]
push ecx
mov dword [ebp - 0x778], eax
mov ecx, esi
lea eax, [ebp - 0x784]
mov dword [ebp - 0x77c], edi
push eax
push dword [ebp - 0x1534]
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1420]
mov esi, dword [ebp - 0x141c]
mov dword [ebp - 0x14e8], eax
mov eax, dword [ebp - 0x1410]
mov dword [ebp - 0x14e4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x1280]
mov dword [ebp - 0x14fc], esi
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x11d8]
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0x14f0], eax
mov dword [ebp - 0x1508], eax
mov dword [ebp - 0x150c], eax
mov dword [ebp - 0x151c], eax
lea eax, [ebp - 0x9d8]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x7a4]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0xc39d7b
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [ebp - 0x1534]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc392a9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc39d7b
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x1280]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc392eb
mov eax, dword [ebp - 0x126c]
mov dword [ebp - 0x14f0], eax
mov eax, dword [ebp - 0x127c]
mov dword [ebp - 0x150c], eax
mov eax, dword [ebp - 0x1278]
mov dword [ebp - 0x151c], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x1520], ecx
test ecx, ecx
je 0xc3929e
mov eax, dword [ebp - 0x1500]
xor edx, edx
mov edi, dword [ebp - 0x14dc]
sub eax, edi
sub ebx, dword [ebp - 0x14e0]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x9d0], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x1854], edx
mov word [ebp - 0x9cc], ax
pop eax
push edx
push edx
mov word [ebp - 0x9ca], ax
lea eax, [ebp - 0x1854]
push eax
push edx
lea eax, [ebp - 0x9d8]
mov dword [ebp - 0x153c], edx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x9c8], edx
mov dword [ebp - 0x9c4], edx
mov dword [ebp - 0x9c0], edx
mov dword [ebp - 0x9bc], edx
mov dword [ebp - 0x9b8], edx
mov dword [ebp - 0x9b4], edx
mov dword [ebp - 0x9b0], edx
mov dword [ebp - 0x9d8], 0x28
mov dword [ebp - 0x9d4], ebx
call dword [0xc99200]
call esi
mov dword [ebp - 0x14dc], eax
test eax, eax
jne 0xc393e5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x153c], eax
test eax, eax
jle 0xc393ca
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x153c], eax
test eax, eax
mov edi, dword [ebp - 0x1520]
js 0xc3973e
mov dword [ebp - 0x153c], 0x80004005
jmp 0xc3973e
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x11d8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc3940f
mov eax, dword [ebp - 0x11c4]
mov dword [ebp - 0x1508], eax
push dword [ebp - 0x14dc]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x79c], ebx
mov ebx, dword [ebp - 0x1500]
sub edi, ebx
mov dword [ebp - 0x798], edi
mov edi, dword [ebp - 0x1520]
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0x14e4]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0x1500], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
mov esi, dword [ebp - 0x1520]
mov ecx, edi
push eax
lea eax, [ebp - 0x7a4]
push eax
push esi
call dword [0xc99200]
call edi
xor eax, eax
push eax
push dword [ebp - 0x1524]
lea eax, [ebp - 0x7a4]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x14fc]
push esi
mov esi, dword [0xc9306c]
mov ecx, esi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1528], 1
jne 0xc39503
cmp dword [ebp - 0x14e8], 0
je 0xc394f7
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0x14e8], eax
jmp 0xc3950d
mov dword [ebp - 0x14e8], 0xffffff
jmp 0xc3950d
mov dword [ebp - 0x14e8], 0xffa8a8a8
mov ecx, dword [ebp - 0x14e0]
xor edx, edx
mov edi, edx
mov eax, edx
test ecx, ecx
jns 0xc39523
mov edi, ecx
mov ecx, edx
neg edi
test ebx, ebx
jns 0xc3952d
mov eax, ebx
mov ebx, edx
neg eax
mov esi, dword [ebp - 0x79c]
mov edx, dword [ebp - 0x150c]
sub esi, edi
sub edx, ecx
mov dword [ebp - 0x14e0], esi
cmp esi, edx
jl 0xc3954f
mov esi, edx
mov dword [ebp - 0x14e0], edx
mov edx, dword [ebp - 0x798]
sub dword [ebp - 0x151c], ebx
sub edx, eax
mov dword [ebp - 0x14e4], edx
cmp edx, dword [ebp - 0x151c]
jl 0xc39577
mov edx, dword [ebp - 0x151c]
mov dword [ebp - 0x14e4], edx
test esi, esi
jle 0xc39706
test edx, edx
jle 0xc39706
mov edx, dword [ebp - 0x79c]
imul ebx, dword [ebp - 0x150c]
imul eax, edx
shl edx, 2
add ebx, ecx
mov ecx, dword [ebp - 0x14f0]
add eax, edi
mov edi, dword [ebp - 0x1508]
mov dword [ebp - 0x1508], edx
mov edx, dword [ebp - 0x150c]
lea ecx, [ecx + ebx*4]
shl edx, 2
lea eax, [edi + eax*4]
mov dword [ebp - 0x14f0], ecx
mov dword [ebp - 0x14fc], eax
mov dword [ebp - 0x150c], edx
mov ebx, ecx
mov dword [ebp - 0x155c], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [ebp - 0x151c], edx
lea edi, [eax + 2]
mov dword [ebp - 0x1550], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc396b3
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x14e8]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x1550]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x151c]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x14e8]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x151c]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x14e6]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x151c]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x155c]
cdq
idiv ecx
mov edx, dword [ebp - 0x151c]
add al, bl
mov ebx, dword [ebp - 0x1550]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x151c], edx
mov dword [ebp - 0x155c], esi
jne 0xc395ed
mov eax, dword [ebp - 0x14fc]
mov ecx, dword [ebp - 0x14f0]
add eax, dword [ebp - 0x1508]
add ecx, dword [ebp - 0x150c]
sub dword [ebp - 0x14e4], 1
mov esi, dword [ebp - 0x14e0]
mov dword [ebp - 0x14fc], eax
mov dword [ebp - 0x14f0], ecx
jne 0xc395d1
push dword [ebp - 0x14dc]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1500]
mov edi, dword [ebp - 0x1520]
test eax, eax
je 0xc3973e
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x153c], 0
jl 0xc39d7b
mov eax, dword [ebp - 0x1420]
mov ebx, dword [ebp - 0x1418]
mov dword [ebp - 0x14e0], eax
mov eax, dword [ebp - 0x140c]
mov dword [ebp - 0x1500], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x1184]
mov dword [ebp - 0x14dc], ebx
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x1130]
push eax
call fcn.00ab4bf6
xor ecx, ecx
lea eax, [ebp - 0x9ac]
push 0x2c
push ecx
push eax
mov dword [ebp - 0x14e8], ecx
mov dword [ebp - 0x14e4], ecx
mov dword [ebp - 0x14fc], ecx
mov dword [ebp - 0x14f0], ecx
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x754]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xc39d7b
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [ebp - 0x1534]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xc3929e
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x1184]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc39845
mov eax, dword [ebp - 0x1170]
mov dword [ebp - 0x14e8], eax
mov eax, dword [ebp - 0x1180]
mov dword [ebp - 0x14fc], eax
mov eax, dword [ebp - 0x117c]
mov dword [ebp - 0x14f0], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x1508], ecx
test ecx, ecx
je 0xc3929e
mov ebx, dword [ebp - 0x14ec]
xor eax, eax
mov edi, dword [ebp - 0x14d8]
xor edx, edx
sub edi, dword [ebp - 0x14f4]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x1858], eax
mov dword [ebp - 0x150c], eax
mov dword [ebp - 0x99c], eax
mov dword [ebp - 0x998], eax
mov dword [ebp - 0x994], eax
mov dword [ebp - 0x990], eax
mov dword [ebp - 0x98c], eax
mov dword [ebp - 0x988], eax
mov dword [ebp - 0x984], eax
mov eax, ebx
sub eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x9a4], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x9ac], 0x28
mov word [ebp - 0x9a0], ax
pop eax
push edx
push edx
mov word [ebp - 0x99e], ax
lea eax, [ebp - 0x1858]
push eax
push edx
lea eax, [ebp - 0x9ac]
mov dword [ebp - 0x9a8], edi
push eax
push ecx
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x14d8], eax
test eax, eax
jne 0xc3994b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x150c], eax
test eax, eax
jle 0xc39930
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x150c], eax
test eax, eax
mov edi, dword [ebp - 0x1508]
js 0xc39cb7
mov dword [ebp - 0x150c], 0x80004005
jmp 0xc39cb7
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x1130]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc39975
mov eax, dword [ebp - 0x111c]
mov dword [ebp - 0x14e4], eax
push dword [ebp - 0x14d8]
mov eax, dword [ebp - 0x14f8]
mov esi, dword [0xc9303c]
sub eax, ebx
mov dword [ebp - 0x74c], edi
mov ecx, esi
mov edi, dword [ebp - 0x1508]
push edi
mov dword [ebp - 0x748], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0x1500]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0x1500], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
mov esi, dword [ebp - 0x1508]
mov ecx, edi
push eax
lea eax, [ebp - 0x754]
push eax
push esi
call dword [0xc99200]
call edi
xor eax, eax
push eax
push dword [ebp - 0x1524]
lea eax, [ebp - 0x754]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x14dc]
push esi
mov esi, dword [0xc9306c]
mov ecx, esi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1528], 1
jne 0xc39a71
cmp dword [ebp - 0x14e0], 0
je 0xc39a65
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x1548], ecx
mov dword [ebp - 0x1524], ecx
jmp 0xc39a82
mov dword [ebp - 0x1524], 0xffffff
jmp 0xc39a82
mov eax, 0xffa8a8a8
mov dword [ebp - 0x1548], eax
mov dword [ebp - 0x1524], eax
mov edi, dword [ebp - 0x14f4]
xor ecx, ecx
mov edx, ecx
mov eax, ecx
test edi, edi
jns 0xc39a9e
mov edx, edi
mov edi, ecx
neg edx
mov dword [ebp - 0x14f4], edi
test ebx, ebx
jns 0xc39aa8
mov eax, ebx
mov ebx, ecx
neg eax
mov esi, dword [ebp - 0x74c]
mov ecx, dword [ebp - 0x14fc]
sub esi, edx
sub ecx, edi
mov dword [ebp - 0x14e0], esi
cmp esi, ecx
jl 0xc39aca
mov esi, ecx
mov dword [ebp - 0x14e0], ecx
mov ecx, dword [ebp - 0x748]
mov edi, dword [ebp - 0x14f0]
sub ecx, eax
sub edi, ebx
mov dword [ebp - 0x14dc], ecx
cmp ecx, edi
jl 0xc39aec
mov ecx, edi
mov dword [ebp - 0x14dc], edi
test esi, esi
jle 0xc39c7f
test ecx, ecx
jle 0xc39c7f
imul eax, dword [ebp - 0x74c]
mov ecx, dword [ebp - 0x14e4]
add eax, edx
mov edx, dword [ebp - 0x14fc]
imul ebx, edx
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x14e8]
mov dword [ebp - 0x14ec], eax
add ebx, dword [ebp - 0x14f4]
lea ecx, [ecx + ebx*4]
mov ebx, dword [ebp - 0x74c]
shl ebx, 2
shl edx, 2
mov dword [ebp - 0x14f4], ecx
mov dword [ebp - 0x14f8], ebx
mov dword [ebp - 0x14e8], edx
mov ebx, ecx
mov dword [ebp - 0x14f0], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [ebp - 0x14e4], edx
lea edi, [eax + 2]
mov dword [ebp - 0x14fc], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc39c2c
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x1548]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x14fc]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x14e4]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x1548]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x14e4]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x1522]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x14e4]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x14f0]
cdq
idiv ecx
mov edx, dword [ebp - 0x14e4]
add al, bl
mov ebx, dword [ebp - 0x14fc]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x14e4], edx
mov dword [ebp - 0x14f0], esi
jne 0xc39b66
mov eax, dword [ebp - 0x14ec]
mov ecx, dword [ebp - 0x14f4]
add eax, dword [ebp - 0x14f8]
add ecx, dword [ebp - 0x14e8]
sub dword [ebp - 0x14dc], 1
mov esi, dword [ebp - 0x14e0]
mov dword [ebp - 0x14ec], eax
mov dword [ebp - 0x14f4], ecx
jne 0xc39b4a
push dword [ebp - 0x14d8]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1500]
mov edi, dword [ebp - 0x1508]
test eax, eax
je 0xc39cb7
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x150c], 0
jl 0xc39d7b
cmp dword [ebp - 0x1528], 1
jne 0xc39d1d
mov esi, dword [section..data]
xor eax, eax
push 0xcc0020
push eax
push eax
push dword [ebp - 0x1534]
mov ecx, esi
push dword [ebp - 0x14d4]
push dword [ebp - 0x1504]
push dword [ebp - 0x13fc]
push dword [ebp - 0x1400]
push dword [ebp - 0x1538]
call dword [0xc99200]
call esi
jmp 0xc39d5f
push dword [ebp - 0x14d0]
mov ecx, dword [ebp - 0x14d4]
xor edx, edx
mov eax, dword [ebp - 0x1504]
mov esi, dword [0xc93020]
push ecx
push eax
push edx
push edx
push dword [ebp - 0x1534]
push ecx
push eax
push dword [ebp - 0x740]
mov ecx, esi
push dword [ebp - 0x744]
push dword [ebp - 0x1538]
call dword [0xc99200]
call esi
push dword [ebp - 0x1530]
mov esi, dword [0xc93040]
mov ecx, esi
push dword [ebp - 0x1538]
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1510]
test eax, eax
je 0xc39d96
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1534]
test eax, eax
je 0xc39db1
mov esi, dword [0xc93018]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1518]
test eax, eax
je 0xc39dcc
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov edi, 0xc96238
mov ecx, dword [ebp - 0x141c]
xor ebx, ebx
test ecx, ecx
je 0xc39e22
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc39de0
mov eax, dword [ebp - 0x141c]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc39e08
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xc39e00
push dword [ebp - 0x141c]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x141c], ebx
mov ecx, dword [ebp - 0x1418]
test ecx, ecx
je 0xc39e71
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc39e2f
mov eax, dword [ebp - 0x1418]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc39e57
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xc39e4f
push dword [ebp - 0x1418]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x1418], ebx
mov edx, dword [ebp - 0x1414]
test edx, edx
je 0xc39ebd
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc39e80
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc39ea8
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xc39e9a
mov edx, dword [ebp - 0x1414]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x1414], ebx
cmp dword [ebp - 0x1410], 0
je 0xc39ee2
push dword [ebp - 0x1410]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x1410], ebx
cmp dword [ebp - 0x140c], 0
je 0xc39f07
push dword [ebp - 0x140c]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x140c], ebx
cmp dword [ebp - 0x1408], 0
je 0xc39f2c
push dword [ebp - 0x1408]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x1408], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc39f2e
mov eax, dword [0xc95890]
test eax, eax
jle 0xc39f91
sub eax, 1
mov dword [0xc95890], eax
jne 0xc39f91
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc39f63
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc39f52
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0xc95878]
mov esi, dword [0xc9304c]
mov ecx, esi
mov dword [ebp - 0x1528], eax
call dword [0xc99200]
call esi
sub eax, dword [0xc95870]
lea edi, [ebp - 0x5c8]
push 7
mov dword [ebp - 0x1534], eax
mov edx, 0xc96238
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc39fce
mov eax, dword [0xc95890]
test eax, eax
jne 0xc3a5d5
xor ebx, ebx
push 0x338
mov esi, ebx
mov dword [ebp - 0x1510], ebx
push ebx
mov dword [ebp - 0x1518], ebx
mov dword [ebp - 0x14d0], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x15b8], eax
test eax, eax
je 0xc3a5c9
or dword [ebp - 0x1558], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0x1544], ebx
mov edx, ebx
mov dword [ebp - 0x1570], eax
mov edi, dword [ebp - 0x16cc]
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0x16cc]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0x16cc]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0x16cc]
shl edi, 8
add dword [ebp - 0x16cc], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0x15b4], esi
add eax, 0x54969fa2
rol dword [ebp - 0x15b4], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0x15b4]
xor edx, eax
mov dword [ebp - 0x15fc], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x15fc]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x15fc]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x15fc], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x15fc]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x15fc]
xor edx, eax
mov dword [ebp - 0x15fc], edx
mov eax, dword [ebp - 0x15fc]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x15fc]
xor eax, edx
mov dword [ebp - 0x15fc], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x15fc]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x15fc]
xor eax, edx
mov dword [ebp - 0x15fc], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x15fc]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0x15fc]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0x15fc], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0x15fc]
xor eax, 0xab69605e
mov dword [ebp - 0x15b4], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x15b4]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x15b4]
xor eax, edx
mov dword [ebp - 0x15b4], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x15b4], edx
mov edx, dword [ebp - 0x15b4]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x15b4], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x15b4]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x15b4]
xor eax, edx
mov dword [ebp - 0x15b4], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x15b4]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x15b4]
xor eax, edx
mov dword [ebp - 0x15b4], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x15b4]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x15b4]
xor edx, dword [ebp - 0x1544]
xor eax, dword [ebp - 0x1558]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x15fc], esi
mov esi, dword [ebp - 0x1570]
mov dword [ebp - 0x1544], ebx
mov dword [ebp - 0x1558], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x16d0], 1
mov dword [ebp - 0x1570], esi
mov esi, eax
mov dword [ebp - 0x15b4], eax
jne 0xc3a039
mov esi, dword [ebp - 0x15b8]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc3a3bc
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc3a3eb
cmp edx, dword [0x9fc02c]
jne 0xc3a3eb
mov edi, esi
xor eax, eax
mov dword [ebp - 0x14d0], edi
mov esi, eax
mov ebx, eax
jmp 0xc3a3ff
or dword [ebp - 0x16dc], 0xffffffff
mov ebx, 0xc004d501
mov edi, dword [ebp - 0x14d0]
xor eax, eax
test esi, esi
je 0xc3a412
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc3a5c3
mov eax, dword [ebp - 0x16dc]
xor ecx, ecx
push 0x40
push ecx
mov ebx, 0xc960a0
mov esi, edi
push ebx
mov byte [eax + edi], cl
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xc3a559
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x16bc]
jne 0xc3a44a
sub ecx, ebx
xor eax, eax
push edi
sar ecx, 1
push edx
push eax
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc3a5bc
xor eax, eax
mov edx, 0x5a4d
mov ecx, eax
mov eax, dword [edi]
mov dword [ebp - 0x1518], ecx
cmp word [eax], dx
je 0xc3a496
mov ecx, 0xc000007b
mov dword [ebp - 0x1518], ecx
jmp 0xc3a4e0
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc3a489
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc3a489
cmp dword [edx], 0x4550
jne 0xc3a489
movzx eax, word [edx + 0x18]
mov ebx, 0x10b
cmp ax, bx
je 0xc3a4ce
mov ebx, 0x20b
cmp ax, bx
je 0xc3a4ce
mov ecx, 0xc000000d
jmp 0xc3a48e
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
xor edx, edx
add esi, 6
mov dword [ebp - 0x15a8], eax
mov ebx, edx
test eax, eax
je 0xc3a54d
mov edx, esi
mov dword [ebp - 0x15b8], esi
lea eax, [edx + 1]
mov dword [ebp - 0x1544], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc3a505
sub edx, dword [ebp - 0x1544]
inc esi
add esi, edx
test ecx, ecx
js 0xc3a53e
push dword [ebp - 0x15b8]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc3a559
mov ecx, dword [ebp - 0x1510]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x1518]
inc dword [ebp - 0x1510]
inc ebx
cmp ebx, dword [ebp - 0x15a8]
jb 0xc3a4f4
add edi, 0x10
cmp byte [esi], 0
jne 0xc3a443
mov ebx, dword [ebp - 0x1518]
mov esi, dword [ebp - 0x14d0]
test esi, esi
je 0xc3a57a
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc3a5d0
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc3a593
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc3a582
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc3a5db
mov ebx, 0xc000007a
jmp 0xc3a55f
mov esi, dword [ebp - 0x14d0]
mov ebx, 0xc000007a
jmp 0xc3a565
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edi, 0xc96238
xchg dword [edi], eax
mov eax, dword [ebp - 0x1534]
xor ecx, ecx
mov esi, dword [0xc93068]
inc ecx
mov dword [ebp - 0x5c8], eax
mov eax, dword [ebp - 0x1528]
mov dword [ebp - 0x5b0], eax
lea eax, [ebp - 0x5cc]
push eax
push 4
pop ebx
push ebx
push 0x2021
xor eax, eax
mov dword [ebp - 0x5cc], ecx
mov dword [ebp - 0x5c4], ecx
mov dword [ebp - 0x5b8], ecx
mov dword [ebp - 0x5bc], ecx
mov dword [ebp - 0x5b4], ecx
mov ecx, esi
push eax
mov dword [ebp - 0x5c0], 0x9966f291
call dword [0xc99200]
call esi
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc3a64a
mov eax, dword [0xc95890]
test eax, eax
jle 0xc3a6ad
sub eax, 1
mov dword [0xc95890], eax
jne 0xc3a6ad
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc3a67f
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc3a66e
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0x1538]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
jmp 0xc359da
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1570], eax
test eax, eax
jne 0xc3a6f3
mov esi, 0xc0000017
jmp 0xc3a7a6
lea ecx, [ebp - 0x154c]
mov dword [ebp - 0x154c], eax
push ecx
mov edx, ebx
mov dword [eax], ebx
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3a78b
mov ecx, dword [ebp - 0x154c]
mov edx, ebx
mov eax, dword [ebp - 0x15c4]
mov dword [ecx], eax
lea eax, [ebp - 0x154c]
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0x1570]
test esi, esi
js 0xc3a791
mov ecx, dword [ebp - 0x1558]
push dword [ebp - 0x15c4]
mov edx, dword [ebp - 0x158c]
push dword [ebp - 0x1624]
mov dword [eax + ecx - 8], edx
mov edx, dword [ebp - 0x1544]
push dword [ebp - 0x154c]
mov dword [eax + ecx - 4], edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0x1570]
add esp, 0xc
mov ecx, dword [ebp - 0x1558]
xor edx, edx
mov dword [ebp - 0x16ac], eax
mov eax, edx
mov dword [ebp - 0x1578], ecx
jmp 0xc3a793
mov eax, dword [ebp - 0x1570]
xor edx, edx
test eax, eax
je 0xc3a7a6
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xc3c17a
xor ecx, ecx
mov dword [ebp - 0x154c], ecx
cmp dword [ebp - 0x16ac], ecx
jne 0xc3a7cc
mov esi, 0xc000000d
jmp 0xc3aea0
mov esi, dword [ebp - 0x1578]
test esi, esi
je 0xc3ae9b
lea eax, [esi + 8]
push eax
push ecx
mov dword [ebp - 0x158c], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x15c4], eax
test eax, eax
je 0xc3ae9b
mov edi, dword [ebp - 0x16ac]
xor eax, eax
mov cl, al
test esi, esi
je 0xc3a816
xor cl, byte [eax + edi]
inc eax
cmp eax, esi
jb 0xc3a80e
mov eax, esi
mov dword [ebp - 0x704], 0xb1b54a58
shr eax, 3
mov dword [ebp - 0x700], 0xc81ecb17
mov dword [ebp - 0x1544], eax
test eax, eax
je 0xc3ac95
movzx edx, word [ebp - 0x702]
mov eax, 0xc81ecb17
movzx esi, ax
movzx eax, word [ebp - 0x6fe]
mov dword [ebp - 0x1558], eax
mov eax, 0xb1b54a58
movzx eax, ax
mov dword [ebp - 0x1570], eax
mov eax, dword [ebp - 0x15c4]
add eax, 7
mov dword [ebp - 0x15fc], esi
mov dword [ebp - 0x1660], eax
lea esi, [edi + 2]
xor eax, eax
mov dword [ebp - 0x15b4], edx
mov dword [ebp - 0x167c], esi
or edx, 0xffffffff
mov dword [ebp - 0x1684], eax
mov dword [ebp - 0x1688], eax
mov dword [ebp - 0x16b4], eax
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0x167c]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0x167c]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0x167c]
shl esi, 8
add dword [ebp - 0x167c], 8
movzx eax, byte [eax + 5]
or esi, eax
xor edx, esi
mov dword [ebp - 0x16b8], esi
mov eax, edx
mov dword [ebp - 0x1694], edx
sub eax, dword [ebp - 0x1570]
mov esi, 0xc81ecb17
xor eax, dword [ebp - 0x1684]
xor eax, esi
xor eax, edi
mov edx, eax
mov dword [ebp - 0x1684], eax
xor edx, esi
ror eax, 7
ror edx, 0xf
imul edx, dword [ebp - 0x15b4]
mov esi, dword [ebp - 0x1558]
add edx, eax
mov eax, dword [ebp - 0x1694]
xor eax, edx
mov edx, 0xb1b54a58
add edx, eax
mov dword [ebp - 0x1694], eax
ror edx, 9
imul edx, dword [ebp - 0x15fc]
ror eax, 0xa
sub edx, eax
mov eax, dword [ebp - 0x1684]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x1684], eax
xor edx, dword [ebp - 0x15fc]
rol edx, 4
imul edx, esi
rol eax, 5
add edx, eax
mov eax, dword [ebp - 0x1694]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x1694], eax
xor edx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, edx
mov edx, dword [ebp - 0x1684]
xor edx, eax
mov dword [ebp - 0x1684], edx
sub edx, dword [ebp - 0x1570]
imul edx, dword [ebp - 0x15b4]
mov eax, dword [ebp - 0x1684]
shr eax, 6
sub edx, eax
xor dword [ebp - 0x1694], edx
mov edx, dword [ebp - 0x1694]
mov eax, edx
ror eax, 0xf
xor eax, dword [ebp - 0x15fc]
imul eax, dword [ebp - 0x1570]
xor dword [ebp - 0x1684], eax
mov eax, dword [ebp - 0x1684]
not eax
ror eax, 3
add eax, esi
imul eax, dword [ebp - 0x15fc]
xor edx, eax
mov eax, edx
mov dword [ebp - 0x1694], edx
mov edx, dword [ebp - 0x1684]
sub eax, 0xc81ecb17
sub eax, dword [ebp - 0x1570]
xor edx, eax
mov dword [ebp - 0x1684], edx
mov eax, dword [ebp - 0x1684]
xor eax, esi
ror edx, 0xa
imul eax, dword [ebp - 0x15b4]
xor edx, eax
mov eax, dword [ebp - 0x1694]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x1694], eax
xor edx, dword [ebp - 0x1570]
rol edx, 6
imul edx, dword [ebp - 0x15fc]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0x1684]
xor eax, edx
mov edx, dword [ebp - 0x1694]
mov dword [ebp - 0x1684], eax
ror eax, 0xf
sub eax, esi
imul eax, dword [ebp - 0x1570]
xor edx, eax
mov dword [ebp - 0x1694], edx
xor edx, esi
imul edx, dword [ebp - 0x1570]
mov eax, dword [ebp - 0x1694]
shr eax, 1
xor edx, eax
mov eax, dword [ebp - 0x1694]
xor dword [ebp - 0x1684], edx
mov edx, eax
sub edx, dword [ebp - 0x15fc]
rol edx, 3
imul edx, dword [ebp - 0x1570]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0x1684]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x1684], eax
sub edx, dword [ebp - 0x15fc]
imul edx, dword [ebp - 0x15b4]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x1694]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0x1694], eax
ror edx, 9
imul edx, dword [ebp - 0x15fc]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0x1684]
xor eax, edx
mov edx, dword [ebp - 0x1694]
mov dword [ebp - 0x1684], eax
sub eax, 0xb1b54a58
sub eax, esi
xor edx, eax
mov eax, dword [ebp - 0x15b4]
mov dword [ebp - 0x1694], edx
xor eax, dword [ebp - 0x1694]
imul eax, dword [ebp - 0x1570]
ror edx, 7
sub eax, edx
mov edx, esi
xor dword [ebp - 0x1684], eax
mov eax, dword [ebp - 0x1684]
xor edx, eax
rol edx, 4
imul edx, dword [ebp - 0x15b4]
ror eax, 0x10
sub edx, eax
mov eax, dword [ebp - 0x1694]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0x1694], eax
ror edx, 0xa
imul edx, dword [ebp - 0x15fc]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0x1684]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x1684], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, esi
mov esi, 0xc81ecb17
xor edx, eax
mov eax, dword [ebp - 0x1694]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x1694], eax
xor edx, esi
rol eax, 2
rol edx, 8
imul edx, dword [ebp - 0x1570]
sub edx, eax
mov eax, dword [ebp - 0x1684]
xor eax, edx
mov edx, esi
sub edx, eax
mov dword [ebp - 0x1684], eax
ror edx, 0xb
imul edx, dword [ebp - 0x15b4]
ror eax, 0xc
sub edx, eax
mov eax, dword [ebp - 0x1694]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x1694], eax
xor edx, dword [ebp - 0x15b4]
imul edx, dword [ebp - 0x15fc]
shr eax, 8
xor edx, eax
mov eax, dword [ebp - 0x1684]
xor eax, edx
mov edx, dword [ebp - 0x1694]
xor edx, eax
xor eax, dword [ebp - 0x1688]
xor edx, esi
mov dword [ebp - 0x1688], edi
mov esi, dword [ebp - 0x1660]
xor edx, 0xb1b54a58
xor edx, dword [ebp - 0x16b4]
mov byte [esi - 4], al
mov byte [esi], dl
ror eax, 8
mov byte [esi - 5], al
ror edx, 8
mov byte [esi - 1], dl
ror eax, 8
mov byte [esi - 6], al
ror edx, 8
mov byte [esi - 2], dl
ror eax, 8
ror edx, 8
mov byte [esi - 7], al
mov byte [esi - 3], dl
mov esi, dword [ebp - 0x16b8]
ror eax, 8
ror edx, 8
add dword [ebp - 0x1660], 8
mov dword [ebp - 0x1684], eax
mov dword [ebp - 0x16b4], esi
sub dword [ebp - 0x1544], 1
mov esi, dword [ebp - 0x167c]
jne 0xc3a8a2
mov esi, dword [ebp - 0x1578]
movzx eax, cl
mov ecx, dword [ebp - 0x15c4]
cdq
mov dword [ecx + esi], eax
mov dword [ecx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x1578], edi
test edi, edi
jne 0xc3accd
mov esi, 0xc0000017
jmp 0xc3ade3
mov esi, dword [ebp - 0x158c]
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0xc3acf7
mov esi, 0xc0000017
xor edx, edx
jmp 0xc3ad7c
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0x15c4]
push esi
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc3aceb
mov dword [edi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
push 8
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x1578]
pop eax
push eax
push eax
mov dword [edi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xc3ad60
mov esi, 0xc0000017
jmp 0xc3ad7c
mov dword [edi + 0x14], ecx
mov esi, edx
mov eax, dword [0xc94e90]
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ebp - 0x154c], edi
mov edi, edx
mov dword [ecx + 4], eax
test edi, edi
je 0xc3ade3
cmp dword [edi + 4], 0
je 0xc3ad9c
push dword [edi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 4], edx
cmp dword [edi + 0xc], 0
je 0xc3adb8
push dword [edi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0xc], edx
cmp dword [edi + 0x14], 0
je 0xc3add4
push dword [edi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0x14], edx
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
test esi, esi
js 0xc3adfd
mov edi, dword [ebp - 0x154c]
mov dword [ebp - 0x1614], edi
mov dword [ebp - 0x154c], eax
jmp 0xc3ae03
mov edi, dword [ebp - 0x1614]
push dword [ebp - 0x15c4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x154c]
test eax, eax
je 0xc3aea0
mov ecx, dword [eax + 4]
test ecx, ecx
je 0xc3ae46
push ecx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x154c]
xor edx, edx
mov dword [eax + 4], edx
jmp 0xc3ae48
xor edx, edx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0xc3ae69
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x154c]
xor edx, edx
mov dword [eax + 0xc], edx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0xc3ae8a
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x154c]
xor edx, edx
mov dword [eax + 0x14], edx
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc3aea0
mov esi, 0xc0000001
or esi, 0x10000000
jl 0xc3c17a
mov edx, dword [edi]
lea eax, [ebp - 0x1574]
push eax
mov ecx, ebx
mov dword [ebp - 0x1574], ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3af38
mov ecx, dword [ebp - 0x1574]
lea eax, [ebp - 0x1574]
push eax
mov edx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3af38
mov edx, dword [edi + 8]
lea eax, [ebp - 0x1574]
mov ecx, dword [ebp - 0x1574]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3af38
mov ecx, dword [ebp - 0x1574]
lea eax, [ebp - 0x1574]
push eax
mov edx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3af38
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0x1574]
mov ecx, dword [ebp - 0x1574]
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0x1574]
test esi, esi
jns 0xc3af3e
mov eax, dword [ebp - 0x1864]
mov dword [ebp - 0x1574], eax
test esi, esi
js 0xc3b09e
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x154c], ecx
test ecx, ecx
jne 0xc3af72
mov esi, 0xc0000017
jmp 0xc3b09e
mov eax, dword [edi]
mov edx, ebx
mov dword [ecx], eax
lea eax, [ebp - 0x15d0]
push eax
mov dword [ebp - 0x15d0], ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b083
push dword [edi]
push dword [edi + 4]
push dword [ebp - 0x15d0]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi]
lea eax, [ebp - 0x15d0]
mov ecx, dword [ebp - 0x15d0]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b083
mov ecx, dword [ebp - 0x15d0]
mov edx, ebx
mov eax, dword [edi + 8]
mov dword [ecx], eax
lea eax, [ebp - 0x15d0]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b083
push dword [edi + 8]
push dword [edi + 0xc]
push dword [ebp - 0x15d0]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi + 8]
lea eax, [ebp - 0x15d0]
mov ecx, dword [ebp - 0x15d0]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b083
mov ecx, dword [ebp - 0x15d0]
mov edx, ebx
mov eax, dword [edi + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0x15d0]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b083
push dword [edi + 0x10]
push dword [edi + 0x14]
push dword [ebp - 0x15d0]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0x15d0]
mov ecx, dword [ebp - 0x15d0]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
xor edx, edx
mov eax, dword [ebp - 0x154c]
test esi, esi
js 0xc3b08b
mov ecx, dword [ebp - 0x1574]
mov dword [ebp - 0x1618], eax
mov eax, edx
mov dword [ebp - 0x15ec], ecx
jmp 0xc3b08b
mov eax, dword [ebp - 0x154c]
xor edx, edx
test eax, eax
je 0xc3b09e
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xc3c17a
push 8
xor eax, eax
pop edi
mov dword [ebp - 0x15d0], eax
mov dword [ebp - 0x1574], eax
mov dword [ebp - 0x1868], edi
mov edx, dword [ebp - 0x15a0]
lea eax, [ebp - 0x1868]
push eax
mov ecx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
jl 0xc3b135
mov eax, dword [ebp - 0x1868]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xc3b0f6
mov esi, 0xc0000095
jmp 0xc3b116
mov dword [ebp - 0x1870], ecx
lea eax, [ebp - 0x1870]
mov edx, edi
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0x1870]
test esi, esi
jns 0xc3b11c
mov eax, dword [ebp - 0x186c]
mov dword [ebp - 0x154c], eax
test esi, esi
js 0xc3b135
mov edi, dword [ebp - 0x1624]
test edi, edi
jne 0xc3b16b
mov esi, 0xc000000d
mov edi, dword [ebp - 0x157c]
test esi, esi
js 0xc3c17a
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc3b33e
mov eax, dword [ebp - 0x161c]
mov esi, 0xd0000017
jmp 0xc3b349
cmp ebx, 1
jbe 0xc3b130
mov ecx, edi
xor eax, eax
mov dword [ebp - 0x15bc], ecx
mov dword [ebp - 0x15a0], eax
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0x1578], eax
lea eax, [ebp - 0x15bc]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b135
mov edx, dword [ebp - 0x1578]
lea eax, [ebp - 0x15bc]
mov ecx, dword [ebp - 0x15bc]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b135
mov eax, dword [ebp - 0x15a0]
mov ecx, dword [ebp - 0x15bc]
inc eax
mov dword [ebp - 0x15a0], eax
cmp eax, 1
jb 0xc3b180
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0x15a0], eax
lea eax, [ebp - 0x15bc]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b135
mov eax, dword [ebp - 0x15a0]
mov dword [ebp - 0x15d0], eax
cmp ebx, 2
jbe 0xc3b130
mov ecx, edi
xor eax, eax
mov dword [ebp - 0x15f4], ecx
mov edi, eax
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0x15bc], eax
lea eax, [ebp - 0x15f4]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b273
mov edx, dword [ebp - 0x15bc]
lea eax, [ebp - 0x15f4]
mov ecx, dword [ebp - 0x15f4]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b273
mov ecx, dword [ebp - 0x15f4]
inc edi
cmp edi, 2
jb 0xc3b217
mov edi, dword [ecx]
lea eax, [ebp - 0x15f4]
push eax
mov edx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
jns 0xc3b281
mov edi, dword [ebp - 0x1574]
test esi, esi
js 0xc3b135
mov edx, dword [ebp - 0x154c]
lea eax, [ebp - 0x15b0]
push eax
mov ecx, ebx
mov dword [ebp - 0x15b0], ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b313
mov ecx, dword [ebp - 0x15b0]
lea eax, [ebp - 0x15b0]
push eax
mov edx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b313
mov edx, dword [ebp - 0x15d0]
lea eax, [ebp - 0x15b0]
mov ecx, dword [ebp - 0x15b0]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b313
mov ecx, dword [ebp - 0x15b0]
lea eax, [ebp - 0x15b0]
push eax
mov edx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b313
mov ecx, dword [ebp - 0x15b0]
lea eax, [ebp - 0x15b0]
push eax
mov edx, edi
call fcn.00a32533
mov edi, dword [ebp - 0x15b0]
mov esi, eax
test esi, esi
jns 0xc3b321
mov edi, dword [ebp - 0x1874]
test esi, esi
js 0xc3b135
cmp edi, 0x400000
jbe 0xc3b333
mov esi, 0x8000ffff
jmp 0xc3c17a
mov dword [ebp - 0x157c], edi
jmp 0xc3b13b
mov dword [ebp - 0x161c], eax
mov esi, 0x10000000
test esi, esi
js 0xc3c17a
mov ecx, dword [ebp - 0x1618]
test ecx, ecx
jne 0xc3b365
mov esi, 0x80070057
jmp 0xc3c17a
test eax, eax
je 0xc3b35b
mov dword [ebp - 0x1b20], eax
xor eax, eax
mov dword [ebp - 0x1b14], eax
lea eax, [ebp - 0x1878]
push eax
push 0x9f29b8
mov dword [ebp - 0x1b24], ecx
mov ecx, dword [ebp - 0x15ec]
push 1
mov dword [ebp - 0x1b1c], ecx
mov dword [ebp - 0x1b18], edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xc3b3c7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc3b3be
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc3b40f
mov esi, 0x80004005
jmp 0xc3b40f
push 0x9fc030
push dword [ebp - 0x1878]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xc3b3a7
xor eax, eax
mov ecx, esi
push eax
push 0x14
lea eax, [ebp - 0x1b24]
push eax
push 0x86
call dword [0xc99200]
call esi
mov esi, eax
or esi, 0x10000000
jl 0xc3b40f
mov edi, dword [ebp - 0x1b18]
mov dword [ebp - 0x157c], edi
cmp esi, 0xd0000023
jne 0xc3b421
mov esi, 0x8007007a
jmp 0xc3c17a
test esi, esi
js 0xc3c17a
mov eax, dword [ebp - 0x161c]
xor edx, edx
mov dword [ebp - 0x15b0], edx
mov dword [ebp - 0x15e0], edx
mov dword [ebp - 0x159c], eax
cmp edi, ebx
jae 0xc3b451
mov esi, 0xc000003e
jmp 0xc3b841
mov edi, dword [eax]
lea ecx, [ebp - 0x159c]
push ecx
mov edx, ebx
mov dword [ebp - 0x15f4], edi
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b83f
lea eax, [ebp - 0x15e0]
mov edx, ebx
push eax
xor ecx, ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b83f
mov eax, dword [ebp - 0x157c]
sub eax, dword [ebp - 0x15e0]
cmp eax, edi
jae 0xc3b4a7
mov esi, 0xc000003e
jmp 0xc3b83f
mov eax, dword [ebp - 0x159c]
lea ecx, [ebp - 0x159c]
push ecx
mov edx, edi
mov dword [ebp - 0x15bc], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b83f
mov ecx, dword [ebp - 0x15e0]
lea eax, [ebp - 0x15e0]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b83f
mov eax, dword [ebp - 0x157c]
sub eax, dword [ebp - 0x15e0]
cmp eax, ebx
jb 0xc3b49d
mov ecx, dword [ebp - 0x159c]
lea eax, [ebp - 0x159c]
push eax
mov edx, ebx
mov edi, dword [ecx]
mov dword [ebp - 0x15d0], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b83f
mov ecx, dword [ebp - 0x15e0]
lea eax, [ebp - 0x15e0]
push eax
mov edx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b83f
mov eax, dword [ebp - 0x157c]
sub eax, dword [ebp - 0x15e0]
cmp eax, edi
jb 0xc3b49d
mov eax, dword [ebp - 0x159c]
lea ecx, [ebp - 0x159c]
push ecx
mov edx, edi
mov dword [ebp - 0x1574], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b83f
mov ecx, dword [ebp - 0x15e0]
lea eax, [ebp - 0x15e0]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b83f
mov eax, dword [ebp - 0x157c]
sub eax, dword [ebp - 0x15e0]
cmp eax, ebx
jb 0xc3b49d
mov ecx, dword [ebp - 0x159c]
mov edx, ebx
mov eax, dword [ecx]
mov dword [ebp - 0x154c], eax
lea eax, [ebp - 0x159c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b83f
mov ecx, dword [ebp - 0x15e0]
lea eax, [ebp - 0x15e0]
push eax
mov edx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b83f
mov eax, dword [ebp - 0x157c]
sub eax, dword [ebp - 0x15e0]
mov ecx, dword [ebp - 0x154c]
cmp eax, ecx
jb 0xc3b49d
lea eax, [ebp - 0x15e0]
mov edx, ecx
mov ecx, dword [ebp - 0x15e0]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3b83f
mov edx, dword [ebp - 0x157c]
mov eax, edx
sub eax, dword [ebp - 0x15e0]
jne 0xc3b49d
mov esi, dword [ebp - 0x15f4]
mov ecx, dword [ebp - 0x154c]
add ecx, 0xc
lea eax, [edi + esi]
add eax, ecx
cmp eax, edx
jne 0xc3b49d
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc3b678
mov esi, 0xc0000017
jmp 0xc3b7bc
cmp dword [ebp - 0x15bc], 0
je 0xc3b6ba
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc3b6a3
mov esi, 0xc0000017
xor eax, eax
jmp 0xc3b755
mov dword [edi + 4], eax
push esi
push dword [ebp - 0x15bc]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc3b6c1
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
cmp dword [ebp - 0x1574], 0
je 0xc3b6fe
mov esi, dword [ebp - 0x15d0]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc3b697
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0x1574]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc3b704
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
cmp dword [ebp - 0x159c], 0
je 0xc3b745
mov esi, dword [ebp - 0x154c]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc3b697
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0x159c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc3b74b
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [ebp - 0x15b0], edi
mov esi, eax
mov edi, eax
test edi, edi
je 0xc3b7bc
cmp dword [edi + 4], 0
je 0xc3b775
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc3b791
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc3b7ad
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
test esi, esi
js 0xc3b7d2
mov eax, dword [ebp - 0x15b0]
mov edi, edx
mov dword [ebp - 0x1620], eax
jmp 0xc3b7d8
mov edi, dword [ebp - 0x15b0]
test edi, edi
je 0xc3b841
cmp dword [edi + 4], 0
je 0xc3b7f8
push dword [edi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 4], edx
cmp dword [edi + 0xc], 0
je 0xc3b814
push dword [edi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0xc], edx
cmp dword [edi + 0x14], 0
je 0xc3b830
push dword [edi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0x14], edx
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
or esi, 0x10000000
jl 0xc3c17a
mov ecx, dword [ebp - 0x1620]
mov edi, edx
mov dword [ebp - 0x159c], edi
mov dword [ebp - 0x15e0], edx
test ecx, ecx
jne 0xc3b86f
mov esi, 0xd000000d
jmp 0xc3c17a
mov eax, dword [ecx + 4]
mov dword [ebp - 0x15b0], eax
test eax, eax
je 0xc3b865
mov esi, dword [ecx]
test esi, esi
je 0xc3b865
add esi, 0xfffffff8
mov dword [ebp - 0x15f4], edx
push esi
push edx
mov dword [ebp - 0x15bc], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x15d0], eax
test eax, eax
je 0xc3bedf
xor ecx, ecx
mov dword [ebp - 0x69c], 0xab69605e
mov edi, esi
mov dword [ebp - 0x698], 0x7f1137f
mov dword [ebp - 0x154c], eax
mov dl, cl
mov ecx, dword [ebp - 0x15b0]
mov dword [ebp - 0x1574], ecx
and edi, 7
je 0xc3be85
xor eax, eax
mov dword [ebp - 0x16c8], eax
mov esi, eax
mov dword [ebp - 0x15a0], eax
mov dword [ebp - 0x1578], eax
test edi, edi
je 0xc3b95a
movzx eax, byte [ecx]
inc ecx
mov dword [ebp - 0x1574], ecx
mov ecx, dword [ebp - 0x166c]
cmp dword [ebp - 0x1578], ebx
jge 0xc3b924
add ecx, 0xffffffe0
shl eax, cl
mov ecx, dword [ebp - 0x166c]
or esi, eax
jmp 0xc3b92c
shl eax, cl
or dword [ebp - 0x16c8], eax
mov eax, dword [ebp - 0x1578]
sub ecx, 8
inc eax
mov dword [ebp - 0x166c], ecx
mov ecx, dword [ebp - 0x1574]
mov dword [ebp - 0x1578], eax
cmp eax, edi
jl 0xc3b8fd
mov eax, ecx
mov dword [ebp - 0x15a0], esi
mov dword [ebp - 0x1574], eax
mov eax, esi
xor ecx, ecx
mov esi, dword [ebp - 0x16c8]
xor eax, 0x92f65a5
xor esi, 0x699a899c
mov dword [ebp - 0x1578], eax
mov dword [ebp - 0x15ec], esi
mov dword [ebp - 0x157c], eax
mov dword [ebp - 0x158c], esi
mov dword [ebp - 0x15c4], ecx
test edi, edi
je 0xc3ba0d
mov ecx, dword [ebp - 0x154c]
mov eax, dword [ebp - 0x15c4]
lea esi, [ecx + 1]
mov dword [ebp - 0x1544], esi
cmp eax, ebx
jge 0xc3b9b9
rol dword [ebp - 0x157c], 8
mov ecx, dword [ebp - 0x157c]
jmp 0xc3b9c6
rol dword [ebp - 0x158c], 8
mov ecx, dword [ebp - 0x158c]
mov dword [ebp - 0x1558], ecx
mov ecx, dword [ebp - 0x154c]
mov eax, dword [ebp - 0x1558]
mov byte [ecx], al
mov eax, dword [ebp - 0x15c4]
mov ecx, dword [ebp - 0x1544]
inc eax
mov dword [ebp - 0x15c4], eax
mov dword [ebp - 0x154c], ecx
cmp eax, edi
jl 0xc3b99d
mov esi, dword [ebp - 0x15ec]
mov eax, ecx
mov dword [ebp - 0x154c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x1578]
cmp edi, ebx
jbe 0xc3be63
push 8
pop ecx
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0x15ec], esi
mov esi, dword [ebp - 0x15bc]
mov eax, esi
shr eax, 3
mov dword [ebp - 0x157c], eax
test eax, eax
je 0xc3be24
movzx esi, word [ebp - 0x69a]
mov ebx, 0x7f1137f
movzx ecx, word [ebp - 0x696]
mov edi, 0xab69605e
movzx eax, bx
xor ebx, edi
mov dword [ebp - 0x15c4], eax
movzx eax, di
mov dword [ebp - 0x1570], eax
mov eax, dword [ebp - 0x154c]
mov dword [ebp - 0x1558], esi
add eax, 7
mov esi, dword [ebp - 0x1574]
mov dword [ebp - 0x1544], ecx
add esi, 2
mov ecx, dword [ebp - 0x15ec]
mov dword [ebp - 0x158c], ebx
mov dword [ebp - 0x154c], eax
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
add esi, 8
shl edi, 8
or edi, eax
mov dword [ebp - 0x1574], esi
mov eax, dword [ebp - 0x1578]
xor ecx, edi
mov esi, dword [ebp - 0x158c]
xor eax, ebx
xor esi, ecx
mov dword [ebp - 0x1578], eax
xor esi, eax
mov ecx, esi
mov eax, esi
sub ecx, 0xab69605e
rol eax, 0xa
rol ecx, 5
imul ecx, dword [ebp - 0x15c4]
add ecx, eax
mov eax, dword [ebp - 0x1578]
xor eax, ecx
mov ecx, 0x7f1137f
add ecx, eax
mov dword [ebp - 0x1578], eax
ror ecx, 9
imul ecx, dword [ebp - 0x1558]
rol eax, 2
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
sub ecx, dword [ebp - 0x15c4]
imul ecx, dword [ebp - 0x1570]
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0x1578]
xor eax, ecx
mov ecx, dword [ebp - 0x1558]
xor ecx, eax
mov dword [ebp - 0x1578], eax
rol ecx, 6
imul ecx, dword [ebp - 0x1544]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, 0xab69605e
sub eax, ecx
mov ecx, dword [ebp - 0x1578]
xor ecx, eax
mov eax, dword [ebp - 0x15c4]
mov dword [ebp - 0x1578], ecx
xor eax, dword [ebp - 0x1578]
imul eax, dword [ebp - 0x1558]
ror ecx, 6
xor ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov eax, esi
lea ecx, [ecx + esi]
ror ecx, 0xf
imul ecx, dword [ebp - 0x1570]
rol eax, 2
add ecx, eax
mov eax, dword [ebp - 0x1578]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x1578], eax
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0x1544]
sub ecx, eax
xor esi, ecx
mov ecx, 0xab69605e
xor ecx, esi
mov eax, esi
ror ecx, 0xc
imul ecx, dword [ebp - 0x15c4]
ror eax, 0xa
xor ecx, eax
mov eax, dword [ebp - 0x1578]
xor eax, ecx
mov ecx, dword [ebp - 0x1544]
xor ecx, eax
mov dword [ebp - 0x1578], eax
imul ecx, dword [ebp - 0x1558]
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov ecx, dword [ebp - 0x1578]
mov eax, esi
not eax
ror eax, 5
add eax, dword [ebp - 0x1570]
imul eax, dword [ebp - 0x1544]
xor ecx, eax
mov dword [ebp - 0x1578], ecx
mov eax, ecx
mov ecx, dword [ebp - 0x1544]
sub eax, ecx
xor eax, esi
mov esi, dword [ebp - 0x1578]
xor eax, 0xab69605e
xor ecx, eax
mov dword [ebp - 0x15ec], eax
rol ecx, 2
imul ecx, dword [ebp - 0x15c4]
shr eax, 2
add ecx, eax
xor esi, ecx
mov eax, esi
rol eax, 7
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul ecx, dword [ebp - 0x1558]
add ecx, eax
mov eax, dword [ebp - 0x15ec]
xor eax, ecx
mov dword [ebp - 0x15ec], eax
mov ecx, eax
mov eax, dword [ebp - 0x15c4]
xor eax, dword [ebp - 0x15ec]
imul eax, dword [ebp - 0x1570]
ror ecx, 9
add ecx, eax
xor esi, ecx
mov ecx, dword [ebp - 0x1558]
xor ecx, esi
mov eax, esi
rol ecx, 5
imul ecx, dword [ebp - 0x1544]
rol eax, 7
add ecx, eax
mov eax, dword [ebp - 0x158c]
xor dword [ebp - 0x15ec], ecx
mov ecx, dword [ebp - 0x15ec]
xor eax, ecx
xor esi, eax
mov eax, esi
ror eax, 3
sub eax, dword [ebp - 0x1558]
imul eax, dword [ebp - 0x15c4]
xor ecx, eax
mov dword [ebp - 0x15ec], ecx
sub ecx, 0x7f1137f
mov eax, dword [ebp - 0x15ec]
ror ecx, 1
imul ecx, dword [ebp - 0x1570]
ror eax, 6
sub ecx, eax
xor esi, ecx
mov ecx, 0xab69605e
mov eax, esi
rol eax, 0xe
lea ecx, [esi + ecx]
rol ecx, 3
imul ecx, dword [ebp - 0x1544]
add ecx, eax
mov eax, dword [ebp - 0x15ec]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0x15ec], eax
rol ecx, 0xf
imul ecx, dword [ebp - 0x15c4]
ror eax, 0xe
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov dword [ebp - 0x1578], esi
xor ecx, dword [ebp - 0x1570]
mov eax, esi
imul ecx, dword [ebp - 0x1558]
shr eax, 3
xor ecx, eax
mov eax, dword [ebp - 0x15ec]
xor eax, ecx
mov ecx, 0x7f1137f
xor ecx, eax
mov dword [ebp - 0x15ec], eax
rol ecx, 4
imul ecx, dword [ebp - 0x1570]
rol eax, 2
xor ecx, eax
mov eax, esi
xor ecx, dword [ebp - 0x15a0]
mov esi, dword [ebp - 0x154c]
xor eax, ecx
mov ecx, dword [ebp - 0x15ec]
xor ecx, dword [ebp - 0x16c8]
mov dword [ebp - 0x15a0], ebx
mov byte [esi - 4], al
mov byte [esi], cl
ror eax, 8
mov byte [esi - 5], al
ror ecx, 8
mov byte [esi - 1], cl
ror eax, 8
mov byte [esi - 6], al
ror ecx, 8
mov byte [esi - 2], cl
ror eax, 8
ror ecx, 8
mov byte [esi - 7], al
mov byte [esi - 3], cl
add esi, 8
ror eax, 8
ror ecx, 8
sub dword [ebp - 0x157c], 1
mov dword [ebp - 0x154c], esi
mov esi, dword [ebp - 0x1574]
mov dword [ebp - 0x1578], eax
mov dword [ebp - 0x16c8], edi
jne 0xc3ba9c
mov esi, dword [ebp - 0x15bc]
push 4
pop ebx
mov ecx, dword [ebp - 0x15d0]
xor eax, eax
test esi, esi
je 0xc3be38
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0xc3be30
movzx eax, dl
cdq
mov edi, edx
mov edx, dword [ebp - 0x15b0]
cmp eax, dword [esi + edx]
jne 0xc3be9e
cmp edi, dword [esi + edx + 4]
jne 0xc3be9e
xor eax, eax
mov dword [ebp - 0x15e0], esi
mov esi, dword [ebp - 0x15f4]
mov edi, ecx
mov ecx, eax
jmp 0xc3beab
mov dword [ebp - 0x15ec], ecx
jae 0xc3ba27
mov ecx, ebx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0x1578], eax
jmp 0xc3ba27
xor ecx, ecx
mov dword [ebp - 0x15a0], ecx
mov dword [ebp - 0x15ec], ecx
mov dword [ebp - 0x1578], ecx
jmp 0xc3ba2d
mov edi, dword [ebp - 0x159c]
mov esi, 0xc004d501
xor eax, eax
test ecx, ecx
je 0xc3bebe
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc3bedf
mov eax, dword [ebp - 0x15e0]
xor ecx, ecx
mov dword [ebp - 0x1600], edi
mov esi, 0x10000000
mov edi, ecx
mov dword [ebp - 0x16b0], eax
jmp 0xc3bee6
mov esi, 0xd0000001
xor ecx, ecx
test edi, edi
je 0xc3bef9
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc3c17a
mov edi, dword [ebp - 0x16b0]
xor eax, eax
mov ecx, dword [ebp - 0x1600]
mov dword [ebp - 0x15f0], eax
mov dword [ebp - 0x163c], ecx
cmp edi, ebx
jb 0xc3c16f
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0x159c], eax
lea eax, [ebp - 0x163c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3c174
lea eax, [ebp - 0x15f0]
mov edx, ebx
push eax
xor ecx, ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3c174
mov eax, edi
sub eax, dword [ebp - 0x15f0]
cmp eax, ebx
jb 0xc3c16f
mov ecx, dword [ebp - 0x163c]
lea eax, [ebp - 0x163c]
push eax
mov edx, ebx
mov edi, dword [ecx]
mov dword [ebp - 0x15e0], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3c174
mov ecx, dword [ebp - 0x15f0]
lea eax, [ebp - 0x15f0]
push eax
mov edx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3c174
mov eax, dword [ebp - 0x16b0]
mov ecx, dword [ebp - 0x15f0]
sub eax, ecx
cmp eax, edi
jb 0xc3c16f
lea eax, [ebp - 0x15f0]
mov edx, edi
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3c174
mov edx, dword [ebp - 0x16b0]
mov esi, dword [ebp - 0x1600]
mov ecx, dword [ebp - 0x163c]
add ecx, edi
lea eax, [edx + esi]
cmp eax, ecx
jb 0xc3c16f
mov eax, dword [ebp - 0x163c]
sub edx, eax
sub edx, edi
add edx, esi
cmp edx, 8
jae 0xc3c16f
xor edx, edx
mov dword [ebp - 0x15b0], edx
mov ecx, edx
mov dword [ebp - 0x15f0], ecx
mov esi, edx
test eax, eax
je 0xc3c0fe
mov edx, dword [ebp - 0x15e0]
lea ecx, [ebp - 0x1638]
push ecx
mov ecx, eax
mov edi, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3c174
mov eax, dword [ebp - 0x1638]
jmp 0xc3c0e6
lea eax, [ebp - 0x1634]
mov edx, ebx
push eax
mov ecx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3c174
mov eax, dword [ebp - 0x1638]
cmp dword [ebp - 0x1634], eax
ja 0xc3c125
mov edx, dword [edi]
lea eax, [ebp - 0x1630]
push eax
mov ecx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3c0a8
mov eax, dword [ebp - 0x1630]
mov dword [ebp - 0x187c], eax
jmp 0xc3c0ae
mov eax, dword [ebp - 0x187c]
test esi, esi
js 0xc3c174
lea ecx, [ebp - 0x1664]
mov edx, eax
push ecx
mov ecx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc3c174
mov edi, dword [ebp - 0x1664]
mov eax, dword [ebp - 0x1638]
cmp edi, eax
ja 0xc3c125
inc dword [ebp - 0x15b0]
cmp edi, eax
jb 0xc3c058
cmp edi, eax
jne 0xc3c125
mov edi, dword [ebp - 0x15e0]
mov ecx, dword [ebp - 0x15f0]
test edi, edi
je 0xc3c130
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x15f0], ecx
test ecx, ecx
jne 0xc3c12c
mov esi, 0xc0000017
jmp 0xc3c15d
mov esi, 0xc000000d
jmp 0xc3c174
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x163c]
test eax, eax
je 0xc3c14b
push edi
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [ebp - 0x15f0]
add esp, 0xc
mov eax, dword [ebp - 0x15b0]
mov dword [ebp - 0x1a38], ecx
mov dword [ebp - 0x1a40], eax
test esi, esi
js 0xc3c174
mov eax, dword [ebp - 0x159c]
cmp eax, dword [ebp - 0x1a40]
je 0xc3c174
mov esi, 0xc000003e
or esi, 0x10000000
mov eax, dword [ebp - 0x16ac]
test eax, eax
je 0xc3c195
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0x1614]
test edi, edi
je 0xc3c203
xor eax, eax
cmp dword [edi + 4], eax
je 0xc3c1bc
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc3c1d8
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc3c1f4
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1618]
test eax, eax
je 0xc3c21e
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x161c]
test eax, eax
je 0xc3c239
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0x1620]
test edi, edi
je 0xc3c2a7
xor eax, eax
cmp dword [edi + 4], eax
je 0xc3c260
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc3c27c
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc3c298
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1600]
test eax, eax
je 0xc3c2c2
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc3c377
mov edi, dword [ebp - 0x1a40]
cmp edi, 1
jb 0xc3c377
mov esi, dword [ebp - 0x1a38]
test esi, esi
je 0xc3c377
test edi, edi
je 0xc3c377
lea eax, [ebp - 0x1670]
mov dword [ebp - 0x1670], esi
push eax
mov edx, ebx
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc3c377
mov eax, dword [esi]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1670]
cmp dword [esi], ebx
jne 0xc3c377
cmp dword [eax], 0
jl 0xc3c377
cmp edi, 1
jbe 0xc3c377
xor eax, eax
mov dword [ebp - 0x1674], esi
mov edi, eax
lea eax, [ebp - 0x1674]
mov edx, ebx
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc3c377
mov edx, dword [esi]
lea eax, [ebp - 0x1674]
mov ecx, dword [ebp - 0x1674]
push eax
call fcn.00a32533
test eax, eax
js 0xc3c377
inc edi
cmp edi, 1
jae 0xc3c377
mov esi, dword [ebp - 0x1674]
jmp 0xc3c32d
mov eax, dword [ebp - 0x1a2c]
jmp 0xc3c383
mov eax, dword [ebp - 0x1a2c]
jmp 0xc3c37d
mov eax, dword [ebp - 0x1624]
mov edi, dword [ebp - 0x15b8]
xor ebx, ebx
test eax, eax
je 0xc3c398
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0x1a38]
test esi, esi
je 0xc3c3b1
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x15a8]
test eax, eax
je 0xc3c3ca
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xc3c3dd
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ebx, dword [ebp - 0x152c]
mov eax, dword [ebp - 0x1514]
xor ecx, ecx
mov dword [ebp - 0x1514], ecx
mov dword [ebp - 0x16c4], eax
jmp 0xc32a45
mov ebx, 0xc004f027
test ebx, ebx
js 0xc32b02
push 4
pop esi
cmp dword [ebp - 0x1648], esi
jne 0xc32b02
mov esi, dword [eax]
jmp 0xc32b08
call fcn.00aeda94
test al, al
je 0xc32b20
xor eax, eax
mov dword [ebp - 0x16c0], ebx
mov dword [ebp - 0x1880], ebx
inc eax
mov dword [ebp - 0x1538], ebx
mov edx, 0xc96238
mov dword [ebp - 0x1528], ebx
mov ecx, eax
xor eax, eax
lock cmpxchg dword [edx], ecx
push 1
test eax, eax
pop eax
jne 0xc3c44c
mov eax, dword [0xc95890]
or ebx, 0xffffffff
mov dword [ebp - 0x16c8], ebx
mov edi, 0x9fbcf2
mov dword [ebp - 0x16cc], edi
mov dword [ebp - 0x16d0], 0x67
mov dword [ebp - 0x16dc], 0x337
test eax, eax
jne 0xc3caaf
push 0x338
mov esi, eax
mov dword [ebp - 0x1534], eax
push eax
mov dword [ebp - 0x1510], eax
mov dword [ebp - 0x1518], esi
mov dword [ebp - 0x1674], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1670], eax
test eax, eax
je 0xc3caa3
xor edx, edx
mov dword [ebp - 0x6a4], 0xab69605e
add eax, 7
mov dword [ebp - 0x6a0], 0x7f1137f
mov cl, dl
mov dword [ebp - 0x1664], edx
mov dword [ebp - 0x1630], ebx
mov dword [ebp - 0x1634], eax
mov dword [ebp - 0x1638], edi
mov dword [ebp - 0x163c], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0x1638]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0x1638]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0x1638]
shl edi, 8
add dword [ebp - 0x1638], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0x15f0], esi
add eax, 0x54969fa2
rol dword [ebp - 0x15f0], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0x15f0]
xor edx, eax
mov dword [ebp - 0x159c], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x159c]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x159c]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x159c], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x159c]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x159c]
xor edx, eax
mov dword [ebp - 0x159c], edx
mov eax, dword [ebp - 0x159c]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x159c]
xor eax, edx
mov dword [ebp - 0x159c], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x159c]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x159c]
xor eax, edx
mov dword [ebp - 0x159c], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x159c]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0x159c]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0x159c], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0x159c]
xor eax, 0xab69605e
mov dword [ebp - 0x15f0], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x15f0]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x15f0]
xor eax, edx
mov dword [ebp - 0x15f0], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0xab69
rol esi, 7
rol eax, 5
imul eax, eax, 0x7f1
add eax, esi
mov esi, dword [ebp - 0x15f0]
xor esi, eax
mov dword [ebp - 0x15f0], esi
xor esi, edx
mov edx, dword [ebp - 0x15f0]
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x15f0], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x15f0]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x15f0]
xor eax, edx
mov dword [ebp - 0x15f0], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x15f0]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x15f0]
xor eax, edx
mov dword [ebp - 0x15f0], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x15f0]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x15f0]
xor edx, dword [ebp - 0x1664]
xor eax, dword [ebp - 0x1630]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x159c], esi
mov esi, dword [ebp - 0x1634]
mov dword [ebp - 0x1630], edi
mov edi, dword [ebp - 0x1638]
mov dword [ebp - 0x1664], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x163c], 1
mov dword [ebp - 0x1634], esi
mov esi, eax
mov dword [ebp - 0x15f0], eax
jne 0xc3c508
mov esi, dword [ebp - 0x1670]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc3c893
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc3c8c5
cmp edx, dword [0x9fc02c]
jne 0xc3c8c5
mov edi, esi
xor eax, eax
mov dword [ebp - 0x1518], edi
mov esi, eax
mov ebx, 0x337
jmp 0xc3c8da
mov edi, dword [ebp - 0x1518]
or ebx, 0xffffffff
mov dword [ebp - 0x1674], 0xc004d501
xor eax, eax
test esi, esi
je 0xc3c8ed
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x1674], 0
jl 0xc3ca9d
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xc960a0
push eax
push ebx
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xc3ca33
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x16bc]
jne 0xc3c924
sub ecx, ebx
xor eax, eax
push edi
sar ecx, 1
push edx
push eax
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc3ca96
xor eax, eax
mov edx, 0x5a4d
mov ecx, eax
mov eax, dword [edi]
mov dword [ebp - 0x1510], ecx
cmp word [eax], dx
je 0xc3c970
mov ecx, 0xc000007b
mov dword [ebp - 0x1510], ecx
jmp 0xc3c9ba
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc3c963
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc3c963
cmp dword [edx], 0x4550
jne 0xc3c963
movzx eax, word [edx + 0x18]
mov ebx, 0x10b
cmp ax, bx
je 0xc3c9a8
mov ebx, 0x20b
cmp ax, bx
je 0xc3c9a8
mov ecx, 0xc000000d
jmp 0xc3c968
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
xor edx, edx
add esi, 6
mov dword [ebp - 0x14d0], eax
mov ebx, edx
test eax, eax
je 0xc3ca27
mov edx, esi
mov dword [ebp - 0x1530], esi
lea eax, [edx + 1]
mov dword [ebp - 0x1524], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc3c9df
sub edx, dword [ebp - 0x1524]
inc esi
add esi, edx
test ecx, ecx
js 0xc3ca18
push dword [ebp - 0x1530]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc3ca33
mov ecx, dword [ebp - 0x1534]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x1510]
inc dword [ebp - 0x1534]
inc ebx
cmp ebx, dword [ebp - 0x14d0]
jb 0xc3c9ce
add edi, 0x10
cmp byte [esi], 0
jne 0xc3c91d
mov ebx, dword [ebp - 0x1510]
mov esi, dword [ebp - 0x1518]
test esi, esi
je 0xc3ca54
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc3caaa
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc3ca6d
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc3ca5c
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc3cab7
mov ebx, 0xc000007a
jmp 0xc3ca39
mov esi, dword [ebp - 0x1518]
mov ebx, 0xc000007a
jmp 0xc3ca3f
mov eax, dword [0xc95890]
inc eax
xor ebx, ebx
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
mov eax, ebx
mov dword [ebp - 0x1534], ebx
mov dword [ebp - 0x1518], eax
mov edi, ebx
mov eax, dword fs:[0x30]
mov dword [ebp - 0x1510], ebx
cmp dword [eax + 0x1d4], ebx
je 0xc3cdb0
mov esi, dword [0xc93088]
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x14d0], ecx
test ecx, ecx
jne 0xc3cb0f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc3cdf8
mov eax, ebx
mov esi, ebx
mov dword [ebp - 0x1518], eax
mov ebx, dword [0xc93098]
lea edx, [ebp - 0x1884]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xc3cb9e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc3cb80
xor eax, eax
test esi, esi
jne 0xc3cb79
push dword [ebp - 0x1884]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc3cb72
mov eax, dword [ebp - 0x1884]
mov ecx, dword [ebp - 0x14d0]
jmp 0xc3cb19
mov ebx, 0x8007000e
jmp 0xc3cb9a
mov ebx, 0x80004005
jmp 0xc3cbae
test eax, eax
jne 0xc3cb8b
mov ebx, 0x80004005
jmp 0xc3cb9a
jg 0xc3cb91
mov ebx, eax
jmp 0xc3cb9a
movzx ebx, ax
or ebx, 0x80070000
xor eax, eax
jmp 0xc3cbae
mov ebx, dword [ebp - 0x1518]
xor eax, eax
mov dword [ebp - 0x1534], esi
mov esi, eax
test esi, esi
je 0xc3cbc1
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc3cdd7
mov esi, dword [0xc93094]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x14d0], ecx
test ecx, ecx
jne 0xc3cc13
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc3cc03
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc3cdd7
mov ebx, 0x80004005
jmp 0xc3cdd7
xor edx, edx
mov eax, edx
mov esi, edx
mov dword [ebp - 0x1518], eax
mov ebx, dword [0xc93098]
lea edx, [ebp - 0x1888]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xc3ccb0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc3cc8c
xor eax, eax
test esi, esi
jne 0xc3cc7f
push dword [ebp - 0x1888]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc3cc78
mov eax, dword [ebp - 0x1888]
mov ecx, dword [ebp - 0x14d0]
jmp 0xc3cc1f
mov ebx, 0x8007000e
jmp 0xc3cca6
mov ebx, 0x80004005
mov dword [ebp - 0x1518], ebx
jmp 0xc3ccbc
test eax, eax
jne 0xc3cc97
mov ebx, 0x80004005
jmp 0xc3cca6
jg 0xc3cc9d
mov ebx, eax
jmp 0xc3cca6
movzx ebx, ax
or ebx, 0x80070000
mov dword [ebp - 0x1518], ebx
xor eax, eax
jmp 0xc3ccbc
mov ebx, dword [ebp - 0x1518]
xor eax, eax
mov edi, esi
mov esi, eax
test esi, esi
je 0xc3cccf
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc3cdbc
mov eax, dword [ebp - 0x1534]
test eax, eax
je 0xc3cdb0
push 4
mov ecx, eax
mov edx, 0x9fb9c0
pop eax
mov si, word [ecx]
cmp si, word [edx]
jne 0xc3cd16
test si, si
je 0xc3cd0f
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0xc3cd16
add ecx, eax
add edx, eax
test si, si
jne 0xc3ccef
xor ebx, ebx
xor ecx, ecx
inc ebx
jmp 0xc3cd1d
sbb ecx, ecx
xor ebx, ebx
inc ebx
or ecx, ebx
test ecx, ecx
jne 0xc3cdb0
test edi, edi
je 0xc3cdb0
mov edx, 0x9f98b0
mov ecx, edi
mov si, word [ecx]
cmp si, word [edx]
jne 0xc3cd5a
test si, si
je 0xc3cd54
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0xc3cd5a
add ecx, eax
add edx, eax
test si, si
jne 0xc3cd34
xor edx, edx
mov ecx, edx
jmp 0xc3cd60
sbb ecx, ecx
or ecx, ebx
xor edx, edx
test ecx, ecx
jne 0xc3cdb0
push eax
lea eax, [ebp - 0x1690]
mov dword [ebp - 0x1690], edx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
jne 0xc3cda5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc3cd9c
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc3cdc2
mov ebx, 0x80004005
jmp 0xc3cdc2
test byte [ebp - 0x1690], 0xf
mov eax, ebx
je 0xc3cdb6
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1528], eax
mov ebx, dword [ebp - 0x1518]
test edi, edi
je 0xc3cdd7
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1534]
test eax, eax
je 0xc3cdf2
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc3ce00
xor ebx, ebx
mov dword [ebp - 0x1528], ebx
jmp 0xc3ce02
xor ebx, ebx
push 4
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x1534], esi
test esi, esi
jne 0xc3cef3
mov ebx, 0x8007000e
mov eax, dword [ebp - 0x1690]
mov dword [ebp - 0x1538], eax
mov edx, 0xc96238
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc3ce32
mov eax, dword [0xc95890]
mov esi, dword [ebp - 0x1534]
test eax, eax
jle 0xc3ce9c
sub eax, 1
mov dword [0xc95890], eax
jne 0xc3ce9c
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc3ce6d
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc3ce5c
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1534]
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
test esi, esi
je 0xc3ceb0
push esi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, dword [ebp - 0x1880]
test ebx, ebx
jns 0xc46702
cmp ebx, 0xd0000034
je 0xc32b02
cmp ebx, 0xd00000e5
je 0xc466f5
cmp ebx, 0xc004d501
je 0xc466f5
cmp ebx, 0xd000003e
je 0xc32b02
jmp 0xc466fa
mov eax, ebx
mov dword [ebp - 0x1510], ebx
mov dword [ebp - 0x14d0], eax
lea edi, [ebp - 0x1a58]
mov dword [ebp - 0x1a44], eax
xor eax, eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1518], ebx
mov dword [ebp - 0x1530], ebx
mov dword [ebp - 0x1524], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x14e0], eax
mov ebx, 0xc0000017
mov dword [ebp - 0x166c], 0x38
test eax, eax
je 0xc3fc02
push 0x28
pop ecx
mov esi, 0xc94ea0
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, eax
mov dword [ebp - 0x1510], edi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x14f4], ecx
test ecx, ecx
jne 0xc3cf91
mov dword [ebp - 0x1500], ebx
jmp 0xc3fc0e
mov eax, dword [0xc94e98]
mov dword [ecx], eax
mov eax, dword [0xc94e9c]
mov dword [ecx + 4], eax
mov dword [ebp - 0x1518], ecx
rdtsc
mov dword [ebp - 0x1504], eax
mov dword [ebp - 0x1548], edx
xor eax, eax
mov dword [ebp - 0x188c], eax
lea eax, [ebp - 0x1890]
push eax
push 4
pop esi
mov edx, esi
mov ecx, esi
call fcn.00a32533
mov edi, dword [ebp - 0x1890]
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
jns 0xc3cfec
mov edi, dword [ebp - 0x1894]
jmp 0xc3fc08
lea eax, [ebp - 0x188c]
mov edx, edi
push eax
xor ecx, ecx
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x1500], ebx
jl 0xc3fc08
lea eax, [ebp - 0x1898]
mov edx, 0xa0
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3fc08
mov edi, dword [ebp - 0x1898]
mov ecx, dword [ebp - 0x188c]
lea eax, [ebp - 0x188c]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x1500], ebx
jl 0xc3fc08
lea eax, [ebp - 0x189c]
mov ecx, esi
push eax
push 8
pop edx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3fc08
mov edi, dword [ebp - 0x189c]
mov ecx, dword [ebp - 0x188c]
lea eax, [ebp - 0x188c]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x1500], ebx
jl 0xc3fc08
lea eax, [ebp - 0x18a0]
mov ecx, esi
push eax
push 8
pop edx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3fc08
mov edi, dword [ebp - 0x18a0]
mov ecx, dword [ebp - 0x188c]
lea eax, [ebp - 0x188c]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x1500], ebx
jl 0xc3fc08
lea eax, [ebp - 0x18a4]
mov edx, SysReAllocString
push eax
mov ecx, 0x9fe768
call fcn.00a41606
test eax, eax
jns 0xc3d123
mov ebx, 0xc000003e
jmp 0xc3fc02
mov edx, dword [ebp - 0x18a4]
lea eax, [ebp - 0x18a8]
inc edx
mov ecx, esi
mov dword [ebp - 0x18a4], edx
add edx, edx
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3fc08
mov edi, dword [ebp - 0x18a8]
mov ecx, dword [ebp - 0x188c]
lea eax, [ebp - 0x188c]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x1500], ebx
jl 0xc3fc08
lea eax, [ebp - 0x18ac]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3fc08
mov edi, dword [ebp - 0x18ac]
mov ecx, dword [ebp - 0x188c]
lea eax, [ebp - 0x188c]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x1500], ebx
jl 0xc3fc08
lea eax, [ebp - 0x18b0]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3fc08
mov edi, dword [ebp - 0x18b0]
mov ecx, dword [ebp - 0x188c]
lea eax, [ebp - 0x188c]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x1500], ebx
jl 0xc3fc08
mov eax, dword [ebp - 0x188c]
push eax
push 8
mov dword [ebp - 0x1a48], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x14d4], edi
test edi, edi
jne 0xc3d24c
mov ebx, 0xc0000017
jmp 0xc3fc02
mov eax, edi
mov dword [ebp - 0x14d0], eax
mov dword [ebp - 0x1a44], eax
xor eax, eax
mov dword [ebp - 0x14dc], eax
mov dword [ebp - 0x18b4], eax
mov dword [ebp - 0x18b8], edi
lea eax, [ebp - 0x19f0]
mov dword [ebp - 0x19f4], esi
push eax
mov edx, esi
mov ecx, edi
call fcn.00a32533
mov ebx, eax
xor edx, edx
mov dword [ebp - 0x1500], ebx
mov ecx, edx
test ebx, ebx
js 0xc3fc08
mov ecx, dword [ebp - 0x188c]
lea eax, [edi + 8]
add ecx, edi
cmp eax, ecx
jbe 0xc3d2b1
mov ebx, 0xc0000023
jmp 0xc3fc02
mov eax, dword [ebp - 0x19f0]
mov dword [edi], esi
mov dword [eax], edx
xor eax, eax
inc eax
mov dword [ebp - 0x14dc], eax
mov ecx, eax
test ebx, ebx
js 0xc3fc08
mov dword [ebp - 0x14d8], edx
mov eax, edi
mov dword [ebp - 0x18bc], eax
test ecx, ecx
je 0xc3d357
mov edx, dword [eax]
lea ecx, [ebp - 0x18c0]
push ecx
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3d30a
mov eax, dword [ebp - 0x18c0]
mov dword [ebp - 0x18c4], eax
jmp 0xc3d310
mov eax, dword [ebp - 0x18c4]
test ebx, ebx
js 0xc3d3c8
lea ecx, [ebp - 0x18bc]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0x18bc]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3d3c8
mov eax, dword [ebp - 0x14d8]
inc eax
cmp eax, dword [ebp - 0x14dc]
mov dword [ebp - 0x14d8], eax
mov eax, dword [ebp - 0x18bc]
jb 0xc3d2e0
lea ecx, [ebp - 0x1988]
mov dword [ebp - 0x198c], 0xa0
push ecx
mov edx, esi
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3d3c8
mov edx, dword [ebp - 0x18bc]
mov ecx, dword [ebp - 0x188c]
add ecx, edi
lea eax, [edx + 0xa4]
cmp eax, ecx
ja 0xc3d2a7
mov eax, dword [ebp - 0x14dc]
mov esi, dword [ebp - 0x14e0]
inc eax
mov edi, dword [ebp - 0x1988]
push 0x28
pop ecx
mov dword [edx], 0xa0
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x14d4]
push 4
mov dword [ebp - 0x14dc], eax
pop esi
jmp 0xc3d3ce
mov eax, dword [ebp - 0x14dc]
test ebx, ebx
js 0xc3fc08
xor edx, edx
mov ecx, edi
mov dword [ebp - 0x14e0], ecx
mov dword [ebp - 0x14d8], edx
test eax, eax
je 0xc3d44e
mov edx, dword [ecx]
lea eax, [ebp - 0x18c8]
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3d414
mov eax, dword [ebp - 0x18c8]
mov dword [ebp - 0x18cc], eax
jmp 0xc3d41a
mov eax, dword [ebp - 0x18cc]
test ebx, ebx
js 0xc3d4c0
mov edx, dword [ebp - 0x14e0]
lea ecx, [eax + edx]
cmp ecx, edx
jb 0xc3d4b6
mov eax, dword [ebp - 0x14d8]
inc eax
mov dword [ebp - 0x14e0], ecx
mov dword [ebp - 0x14d8], eax
cmp eax, dword [ebp - 0x14dc]
jb 0xc3d3ea
lea eax, [ebp - 0x1990]
mov dword [ebp - 0x1994], 8
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3d4c0
mov edx, dword [ebp - 0x14e0]
mov ecx, dword [ebp - 0x188c]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xc3d2a7
mov ecx, dword [ebp - 0x1990]
mov dword [edx], 8
mov edx, dword [ebp - 0x14f4]
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x14dc]
inc eax
mov dword [ebp - 0x14dc], eax
jmp 0xc3d4c6
mov ebx, 0xc0000095
jmp 0xc3fc02
mov eax, dword [ebp - 0x14dc]
test ebx, ebx
js 0xc3fc08
mov ecx, dword [ebp - 0x1504]
xor edx, edx
mov dword [ebp - 0x19a4], ecx
mov ecx, dword [ebp - 0x1548]
mov dword [ebp - 0x19a0], ecx
mov ecx, edi
mov dword [ebp - 0x14e0], ecx
mov dword [ebp - 0x14f4], edx
test eax, eax
je 0xc3d55e
mov edx, dword [ecx]
lea eax, [ebp - 0x18d0]
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3d524
mov eax, dword [ebp - 0x18d0]
mov dword [ebp - 0x18d4], eax
jmp 0xc3d52a
mov eax, dword [ebp - 0x18d4]
test ebx, ebx
js 0xc3fc08
mov edx, dword [ebp - 0x14e0]
lea ecx, [edx + eax]
cmp ecx, edx
jb 0xc3d4b6
mov eax, dword [ebp - 0x14f4]
inc eax
mov dword [ebp - 0x14e0], ecx
mov dword [ebp - 0x14f4], eax
cmp eax, dword [ebp - 0x14dc]
jb 0xc3d4fa
lea eax, [ebp - 0x19a8]
mov dword [ebp - 0x19ac], 8
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3fc08
mov edx, dword [ebp - 0x14e0]
mov ecx, dword [ebp - 0x188c]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xc3d2a7
mov eax, dword [ebp - 0x19a8]
mov ecx, dword [ebp - 0x1504]
inc dword [ebp - 0x14dc]
mov dword [edx], 8
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1548]
mov dword [eax + 4], ecx
test ebx, ebx
js 0xc3fc08
lea eax, [ebp - 0x18d8]
mov edx, SysReAllocString
push eax
mov ecx, 0x9fe768
call fcn.00a41606
test eax, eax
js 0xc3d119
mov ecx, dword [ebp - 0x18d8]
lea eax, [ebp - 0x18d8]
xor edx, edx
push eax
inc edx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3fc08
mov eax, dword [ebp - 0x18d8]
lea edx, [eax + eax]
mov dword [ebp - 0x14e0], edx
test edx, edx
je 0xc3d6db
mov ecx, dword [ebp - 0x14dc]
xor eax, eax
mov dword [ebp - 0x1500], eax
mov ebx, edi
mov dword [ebp - 0x14f4], ebx
test ecx, ecx
je 0xc3d666
mov eax, dword [ebx]
add eax, 4
cmp eax, esi
jb 0xc3d6b0
add eax, ebx
cmp eax, ebx
jb 0xc3d6b0
mov ebx, eax
mov eax, dword [ebp - 0x1500]
inc eax
mov dword [ebp - 0x14f4], ebx
mov dword [ebp - 0x1500], eax
cmp eax, ecx
jb 0xc3d63e
lea eax, [ebp - 0x19b0]
mov dword [ebp - 0x19b4], edx
push eax
mov edx, esi
mov ecx, ebx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3fc08
mov eax, dword [ebp - 0x14e0]
mov ecx, dword [ebp - 0x188c]
add eax, 4
mov edx, dword [ebp - 0x14f4]
add ecx, edi
add eax, edx
cmp eax, ecx
jbe 0xc3d6b7
mov ebx, 0xc0000023
jmp 0xc3d6e0
mov ebx, 0xc0000095
jmp 0xc3d6e0
mov eax, dword [ebp - 0x14e0]
push eax
push 0x9fe768
push dword [ebp - 0x19b0]
mov dword [edx], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
inc dword [ebp - 0x14dc]
jmp 0xc3d6e6
mov ebx, 0xc000000d
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3fc08
mov eax, dword [ebp - 0x1528]
mov ebx, edi
mov ecx, dword [ebp - 0x14dc]
mov dword [ebp - 0x18dc], eax
xor eax, eax
mov dword [ebp - 0x14e0], ebx
mov edx, eax
test ecx, ecx
je 0xc3d730
mov eax, dword [ebx]
add eax, 4
cmp eax, esi
jb 0xc3d78a
add eax, ebx
cmp eax, ebx
jb 0xc3d4b6
inc edx
mov ebx, eax
mov dword [ebp - 0x14e0], ebx
cmp edx, ecx
jb 0xc3d710
lea eax, [ebp - 0x1998]
mov dword [ebp - 0x199c], esi
push eax
mov edx, esi
mov ecx, ebx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3d797
mov edx, dword [ebp - 0x14e0]
mov ecx, dword [ebp - 0x188c]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xc3d2a7
mov eax, dword [ebp - 0x1998]
mov ecx, dword [ebp - 0x1528]
mov dword [edx], esi
mov dword [eax], ecx
mov ecx, dword [ebp - 0x14dc]
inc ecx
mov dword [ebp - 0x14dc], ecx
jmp 0xc3d79d
mov ebx, 0xc0000095
mov dword [ebp - 0x1500], ebx
jmp 0xc3d79d
mov ecx, dword [ebp - 0x14dc]
test ebx, ebx
js 0xc3fc08
xor eax, eax
mov dword [ebp - 0x18e0], esi
mov ebx, edi
mov edx, eax
mov dword [ebp - 0x14e0], ebx
test ecx, ecx
je 0xc3d7df
mov eax, dword [ebx]
add eax, 4
cmp eax, esi
jb 0xc3d863
add eax, ebx
cmp eax, ebx
jb 0xc3d4b6
inc edx
mov ebx, eax
mov dword [ebp - 0x14e0], ebx
cmp edx, ecx
jb 0xc3d7bb
lea eax, [ebp - 0x19c8]
mov dword [ebp - 0x19cc], esi
push eax
mov edx, esi
mov ecx, ebx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3fc08
mov edx, dword [ebp - 0x14e0]
mov ecx, dword [ebp - 0x188c]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xc3d2a7
mov eax, dword [ebp - 0x19c8]
inc dword [ebp - 0x14dc]
mov dword [edx], esi
mov dword [eax], esi
test ebx, ebx
js 0xc3fc08
lea eax, [ebp - 0x18e4]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov edi, dword [ebp - 0x18e4]
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
jns 0xc3d870
mov edi, dword [ebp - 0x18e8]
jmp 0xc3d9df
mov ebx, 0xc0000095
mov dword [ebp - 0x1500], ebx
jmp 0xc3d82e
lea eax, [ebp - 0x18f0]
mov dword [ebp - 0x18ec], edi
push eax
push 8
pop edx
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3d9df
mov edi, dword [ebp - 0x18f0]
mov ecx, dword [ebp - 0x18ec]
lea eax, [ebp - 0x18ec]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3d9df
lea eax, [ebp - 0x18f4]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3d9df
mov edi, dword [ebp - 0x18f4]
mov ecx, dword [ebp - 0x18ec]
lea eax, [ebp - 0x18ec]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3d9df
lea eax, [ebp - 0x18f8]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3d9df
mov edi, dword [ebp - 0x18f8]
mov ecx, dword [ebp - 0x18ec]
lea eax, [ebp - 0x18ec]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3d9df
lea eax, [ebp - 0x18fc]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3d9df
mov edi, dword [ebp - 0x18fc]
mov ecx, dword [ebp - 0x18ec]
lea eax, [ebp - 0x18ec]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3d9df
lea eax, [ebp - 0x1650]
mov edx, esi
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3d9df
mov edi, dword [ebp - 0x1650]
mov ecx, dword [ebp - 0x18ec]
lea eax, [ebp - 0x18ec]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0x18ec]
mov dword [ebp - 0x1500], ebx
test ebx, ebx
jns 0xc3d9e5
mov eax, dword [ebp - 0x1650]
mov dword [ebp - 0x14e0], eax
test ebx, ebx
js 0xc3fc08
xor ecx, ecx
rdtsc
mov edi, ecx
mov dword [ebp - 0x14f4], ecx
mov dword [ebp - 0x14d8], edi
mov dword [ebp - 0x14ec], ecx
mov dword [ebp - 0x14f8], ecx
mov dword [ebp - 0x14e8], ecx
mov dword [ebp - 0x14e4], ecx
mov dword [ebp - 0x1514], ecx
mov dword [ebp - 0x14fc], ecx
mov dword [ebp - 0x14f0], ecx
mov dword [ebp - 0x1508], ecx
mov dword [ebp - 0x1500], eax
mov dword [ebp - 0x150c], edx
push 8
pop eax
mov dword [ebp - 0x1900], eax
mov edx, dword [ebp - 0x188c]
lea ecx, [ebp - 0x1900]
push ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3db5b
mov eax, dword [ebp - 0x1900]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0x151c], ecx
cmp ecx, eax
jae 0xc3da88
mov ebx, 0xc0000095
jmp 0xc3db5b
mov dword [ebp - 0x1900], ecx
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc3daae
mov ebx, 0xc0000017
jmp 0xc3db55
mov eax, dword [ebp - 0x14dc]
mov edx, esi
mov dword [edi], eax
mov ecx, edi
lea eax, [ebp - 0x1904]
mov dword [ebp - 0x1904], edi
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3db40
mov ecx, dword [ebp - 0x1904]
mov edx, esi
mov eax, dword [ebp - 0x188c]
mov dword [ecx], eax
lea eax, [ebp - 0x1904]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3db40
mov eax, dword [ebp - 0x151c]
push dword [ebp - 0x188c]
mov ecx, dword [ebp - 0x1500]
push dword [ebp - 0x14d4]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0x150c]
push dword [ebp - 0x1904]
mov dword [edi + eax - 4], ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0x151c]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x14f4], edi
mov edi, ecx
mov dword [ebp - 0x14d8], eax
jmp 0xc3db42
xor ecx, ecx
test edi, edi
je 0xc3db55
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0x14d8]
or ebx, 0x10000000
mov dword [ebp - 0x1500], ebx
jl 0xc3f4fc
xor ecx, ecx
mov dword [ebp - 0x1500], ecx
cmp dword [ebp - 0x14f4], ecx
jne 0xc3db87
mov ebx, 0xc000000d
jmp 0xc3e1ab
test edi, edi
je 0xc3e283
lea eax, [edi + 8]
push eax
push ecx
mov dword [ebp - 0x14d4], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0x150c], ebx
test ebx, ebx
je 0xc3e283
xor eax, eax
mov cl, al
mov edx, eax
test edi, edi
je 0xc3dbcf
mov eax, dword [ebp - 0x14f4]
xor cl, byte [edx + eax]
inc edx
cmp edx, edi
jb 0xc3dbc7
mov eax, edi
mov dword [ebp - 0x6bc], 0xb1b54a58
shr eax, 3
mov esi, 0xc81ecb17
mov dword [ebp - 0x6b8], esi
mov dword [ebp - 0x151c], eax
test eax, eax
je 0xc3dfd2
movzx eax, word [ebp - 0x6b6]
add ebx, 7
movzx edx, word [ebp - 0x6ba]
mov dword [ebp - 0x1520], eax
mov eax, 0xb1b54a58
movzx esi, si
movzx eax, ax
mov dword [ebp - 0x1550], esi
mov esi, dword [ebp - 0x14f4]
mov dword [ebp - 0x152c], eax
add esi, 2
xor eax, eax
mov dword [ebp - 0x153c], edx
mov dword [ebp - 0x155c], ebx
mov edx, eax
mov dword [ebp - 0x1560], esi
or ebx, 0xffffffff
mov dword [ebp - 0x1584], eax
mov dword [ebp - 0x15f8], eax
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0x1560]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0x1560]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0x1560]
shl esi, 8
add dword [ebp - 0x1560], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov eax, ebx
sub eax, dword [ebp - 0x152c]
xor eax, 0xc81ecb17
xor eax, edi
xor edx, eax
mov dword [ebp - 0x1648], edx
mov edx, 0xc81ecb17
mov eax, dword [ebp - 0x1648]
xor edx, eax
ror edx, 0xf
imul edx, dword [ebp - 0x153c]
ror eax, 7
add edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
mov eax, ebx
ror eax, 0xa
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [ebp - 0x1550]
sub edx, eax
mov eax, dword [ebp - 0x1648]
xor eax, edx
mov edx, dword [ebp - 0x1550]
xor edx, eax
mov dword [ebp - 0x1648], eax
rol edx, 4
imul edx, dword [ebp - 0x1520]
rol eax, 5
add edx, eax
mov eax, 0xc81ecb17
xor ebx, edx
mov edx, 0xb1b54a58
xor edx, ebx
sub eax, edx
mov edx, dword [ebp - 0x1648]
xor edx, eax
mov dword [ebp - 0x1648], edx
sub edx, dword [ebp - 0x152c]
imul edx, dword [ebp - 0x153c]
mov eax, dword [ebp - 0x1648]
shr eax, 6
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0x1648]
mov eax, ebx
ror eax, 0xf
xor eax, dword [ebp - 0x1550]
imul eax, dword [ebp - 0x152c]
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [ebp - 0x1520]
imul eax, dword [ebp - 0x1550]
xor ebx, eax
mov eax, ebx
sub eax, 0xc81ecb17
sub eax, dword [ebp - 0x152c]
xor edx, eax
mov eax, dword [ebp - 0x1520]
mov dword [ebp - 0x1648], edx
xor eax, dword [ebp - 0x1648]
imul eax, dword [ebp - 0x153c]
ror edx, 0xa
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0x152c]
xor edx, ebx
mov eax, ebx
rol edx, 6
imul edx, dword [ebp - 0x1550]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0x1648]
xor eax, edx
mov edx, dword [ebp - 0x1520]
mov dword [ebp - 0x1648], eax
ror eax, 0xf
sub eax, edx
imul eax, dword [ebp - 0x152c]
xor ebx, eax
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0x152c]
shr eax, 1
xor edx, eax
mov eax, ebx
xor dword [ebp - 0x1648], edx
mov edx, ebx
sub edx, dword [ebp - 0x1550]
rol edx, 3
imul edx, dword [ebp - 0x152c]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0x1648]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x1648], eax
sub edx, dword [ebp - 0x1550]
imul edx, dword [ebp - 0x153c]
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 9
imul edx, dword [ebp - 0x1550]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0x1648]
xor eax, edx
mov dword [ebp - 0x1648], eax
sub eax, dword [ebp - 0x1520]
sub eax, 0xb1b54a58
xor ebx, eax
mov eax, dword [ebp - 0x153c]
xor eax, ebx
mov edx, ebx
imul eax, dword [ebp - 0x152c]
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0x1520]
xor dword [ebp - 0x1648], eax
mov eax, dword [ebp - 0x1648]
xor edx, eax
rol edx, 4
imul edx, dword [ebp - 0x153c]
ror eax, 0x10
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 0xa
imul edx, dword [ebp - 0x1550]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0x1648]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x1648], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, dword [ebp - 0x1520]
xor edx, eax
xor ebx, edx
mov edx, 0xc81ecb17
xor edx, ebx
mov eax, ebx
rol edx, 8
imul edx, dword [ebp - 0x152c]
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0x1648]
xor eax, edx
mov edx, 0xc81ecb17
sub edx, eax
mov dword [ebp - 0x1648], eax
ror edx, 0xb
imul edx, dword [ebp - 0x153c]
ror eax, 0xc
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0x153c]
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0x1550]
shr eax, 8
xor edx, eax
mov eax, 0xc81ecb17
xor dword [ebp - 0x1648], edx
xor eax, 0xb1b54a58
mov edx, dword [ebp - 0x1648]
xor ebx, eax
mov eax, dword [ebp - 0x155c]
xor ebx, edx
xor edx, dword [ebp - 0x1584]
xor ebx, dword [ebp - 0x15f8]
mov dword [ebp - 0x15f8], esi
mov esi, dword [ebp - 0x1560]
mov byte [eax - 4], dl
mov byte [eax], bl
ror edx, 8
mov byte [eax - 5], dl
ror ebx, 8
mov byte [eax - 1], bl
ror edx, 8
mov byte [eax - 6], dl
ror ebx, 8
mov byte [eax - 2], bl
ror edx, 8
ror ebx, 8
mov byte [eax - 7], dl
mov byte [eax - 3], bl
add eax, 8
ror edx, 8
ror ebx, 8
sub dword [ebp - 0x151c], 1
mov dword [ebp - 0x1584], edi
mov dword [ebp - 0x155c], eax
jne 0xc3dc53
mov edi, dword [ebp - 0x14d8]
mov ebx, dword [ebp - 0x150c]
movzx eax, cl
cdq
mov dword [ebx + edi], eax
mov dword [ebx + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x14d8], esi
test esi, esi
jne 0xc3e004
mov ebx, 0xc0000017
jmp 0xc3e10e
mov edi, dword [ebp - 0x14d4]
push edi
push 8
mov dword [esi], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc3e029
mov ebx, 0xc0000017
xor edx, edx
jmp 0xc3e0a7
mov dword [esi + 4], eax
push edi
push ebx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [esi + 8], eax
push eax
push 8
pop ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc3e020
mov dword [esi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x14d8]
push ebx
push ebx
mov dword [esi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xc3e08b
mov ebx, 0xc0000017
jmp 0xc3e0a7
mov dword [esi + 0x14], ecx
mov ebx, edx
mov eax, dword [0xc94e90]
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ebp - 0x1500], esi
mov esi, edx
mov dword [ecx + 4], eax
test esi, esi
je 0xc3e10e
cmp dword [esi + 4], 0
je 0xc3e0c7
push dword [esi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 4], edx
cmp dword [esi + 0xc], 0
je 0xc3e0e3
push dword [esi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0xc], edx
cmp dword [esi + 0x14], 0
je 0xc3e0ff
push dword [esi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0x14], edx
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc3e124
mov eax, dword [ebp - 0x1500]
mov dword [ebp - 0x14ec], eax
xor eax, eax
mov esi, eax
jmp 0xc3e12c
mov esi, dword [ebp - 0x1500]
xor eax, eax
push dword [ebp - 0x150c]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
je 0xc3e1a8
xor eax, eax
cmp dword [esi + 4], eax
je 0xc3e161
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xc3e17d
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xc3e199
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
push 4
pop esi
or ebx, 0x10000000
mov dword [ebp - 0x1500], ebx
jl 0xc3f4fc
mov edi, dword [ebp - 0x14ec]
lea eax, [ebp - 0x1908]
push eax
mov ecx, esi
mov dword [ebp - 0x1908], esi
mov edx, dword [edi]
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3e24f
mov ecx, dword [ebp - 0x1908]
lea eax, [ebp - 0x1908]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3e24f
mov edx, dword [edi + 8]
lea eax, [ebp - 0x1908]
mov ecx, dword [ebp - 0x1908]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3e24f
mov ecx, dword [ebp - 0x1908]
lea eax, [ebp - 0x1908]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3e24f
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0x1908]
mov ecx, dword [ebp - 0x1908]
push eax
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0x1908]
test ebx, ebx
jns 0xc3e255
mov eax, dword [ebp - 0x190c]
mov dword [ebp - 0x1500], eax
test ebx, ebx
js 0xc3e3d3
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc3e28d
mov ebx, 0xc0000017
jmp 0xc3e3d3
mov ebx, 0xc0000001
jmp 0xc3e1ab
mov eax, dword [ebp - 0x14ec]
mov edx, esi
mov ecx, edi
mov dword [ebp - 0x1910], edi
mov eax, dword [eax]
mov dword [edi], eax
lea eax, [ebp - 0x1910]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3e3be
mov ebx, dword [ebp - 0x14ec]
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0x1910]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx]
lea eax, [ebp - 0x1910]
mov ecx, dword [ebp - 0x1910]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3e3be
mov eax, dword [ebp - 0x14ec]
mov edx, esi
mov ecx, dword [ebp - 0x1910]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0x1910]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3e3be
mov ebx, dword [ebp - 0x14ec]
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0x1910]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 8]
lea eax, [ebp - 0x1910]
mov ecx, dword [ebp - 0x1910]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3e3be
mov eax, dword [ebp - 0x14ec]
mov edx, esi
mov ecx, dword [ebp - 0x1910]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0x1910]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3e3be
mov ebx, dword [ebp - 0x14ec]
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0x1910]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0x1910]
mov ecx, dword [ebp - 0x1910]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
xor ecx, ecx
test ebx, ebx
js 0xc3e3c0
mov eax, dword [ebp - 0x1500]
mov dword [ebp - 0x14f8], edi
mov edi, ecx
mov dword [ebp - 0x14e8], eax
jmp 0xc3e3c0
xor ecx, ecx
test edi, edi
je 0xc3e3d3
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or ebx, 0x10000000
mov dword [ebp - 0x1500], ebx
jl 0xc3f4fc
push 8
xor eax, eax
pop edi
mov dword [ebp - 0x14d4], eax
mov dword [ebp - 0x14d8], eax
mov dword [ebp - 0x1914], edi
mov edx, dword [ebp - 0x14e0]
lea eax, [ebp - 0x1914]
push eax
mov ecx, edi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x1500], ebx
jl 0xc3e488
mov eax, dword [ebp - 0x1914]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xc3e43d
mov ebx, 0xc0000095
mov dword [ebp - 0x1500], ebx
jmp 0xc3e463
mov dword [ebp - 0x191c], ecx
lea eax, [ebp - 0x191c]
mov edx, edi
push eax
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0x191c]
mov dword [ebp - 0x1500], ebx
test ebx, ebx
jns 0xc3e469
mov eax, dword [ebp - 0x1918]
mov dword [ebp - 0x14e0], eax
test ebx, ebx
js 0xc3e488
mov eax, dword [ebp - 0x14d0]
test eax, eax
jne 0xc3e4be
mov ebx, 0xc000000d
mov dword [ebp - 0x1500], ebx
mov edi, dword [ebp - 0x1514]
test ebx, ebx
js 0xc3f4fc
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc3e70e
mov ecx, dword [ebp - 0x14e4]
mov ebx, 0xd0000017
jmp 0xc3e71b
mov edi, dword [ebp - 0x14dc]
cmp edi, 1
jbe 0xc3e47d
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x162c], ecx
mov dword [ebp - 0x14dc], eax
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x150c], eax
lea eax, [ebp - 0x162c]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3e488
mov edx, dword [ebp - 0x150c]
lea eax, [ebp - 0x162c]
mov ecx, dword [ebp - 0x162c]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3e488
mov eax, dword [ebp - 0x14dc]
mov ecx, dword [ebp - 0x162c]
inc eax
mov dword [ebp - 0x14dc], eax
cmp eax, 1
jb 0xc3e4d9
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x14dc], eax
lea eax, [ebp - 0x162c]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3e488
mov eax, dword [ebp - 0x14dc]
mov dword [ebp - 0x14d4], eax
neg eax
sbb eax, eax
and dword [ebp - 0x162c], eax
test ebx, ebx
js 0xc3e488
cmp edi, 2
jbe 0xc3e47d
mov ecx, dword [ebp - 0x14d0]
xor eax, eax
mov dword [ebp - 0x1678], ecx
mov edi, eax
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x14dc], eax
lea eax, [ebp - 0x1678]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3e488
mov edx, dword [ebp - 0x14dc]
lea eax, [ebp - 0x1678]
mov ecx, dword [ebp - 0x1678]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3e488
mov ecx, dword [ebp - 0x1678]
inc edi
cmp edi, 2
jb 0xc3e598
mov edi, dword [ecx]
lea eax, [ebp - 0x1678]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3e488
mov dword [ebp - 0x14d8], edi
neg edi
sbb edi, edi
and dword [ebp - 0x1678], edi
test ebx, ebx
js 0xc3e488
mov edx, dword [ebp - 0x14e0]
lea eax, [ebp - 0x1680]
push eax
mov ecx, esi
mov dword [ebp - 0x1680], esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3e6e2
mov ecx, dword [ebp - 0x1680]
lea eax, [ebp - 0x1680]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3e6e2
mov edx, dword [ebp - 0x14d4]
lea eax, [ebp - 0x1680]
mov ecx, dword [ebp - 0x1680]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3e6e2
mov ecx, dword [ebp - 0x1680]
lea eax, [ebp - 0x1680]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3e6e2
mov edx, dword [ebp - 0x14d8]
lea eax, [ebp - 0x1680]
mov ecx, dword [ebp - 0x1680]
push eax
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0x1680]
mov dword [ebp - 0x1500], ebx
test ebx, ebx
jns 0xc3e6f0
mov eax, dword [ebp - 0x1920]
test ebx, ebx
js 0xc3e488
cmp eax, 0x400000
jbe 0xc3e701
mov ebx, 0x8000ffff
jmp 0xc3f4f6
mov edi, eax
mov dword [ebp - 0x1514], edi
jmp 0xc3e48e
mov ecx, eax
mov dword [ebp - 0x14e4], eax
mov ebx, 0x10000000
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3f4fc
mov eax, dword [ebp - 0x14f8]
test eax, eax
jne 0xc3e73d
mov ebx, 0x80070057
jmp 0xc3f4f6
test ecx, ecx
je 0xc3e733
mov dword [ebp - 0x1b4c], eax
xor ebx, ebx
mov eax, dword [ebp - 0x14e8]
mov dword [ebp - 0x1b44], eax
lea eax, [ebp - 0x185c]
push eax
push 0x9f29b8
push 1
mov dword [ebp - 0x1b48], ecx
mov dword [ebp - 0x1b40], edi
mov dword [ebp - 0x1b3c], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xc3e7b5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
jle 0xc3e7a2
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3e834
mov ebx, 0x80004005
mov dword [ebp - 0x1500], ebx
jmp 0xc3e834
push 0x9fc030
push dword [ebp - 0x185c]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0xc3e7f7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
jle 0xc3e7ef
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0x1500], ebx
test ebx, ebx
mov edi, dword [ebp - 0x1514]
jmp 0xc3e7a2
push ebx
push 0x14
lea eax, [ebp - 0x1b4c]
mov ecx, edi
push eax
push 0x86
call dword [0xc99200]
call edi
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x1500], ebx
jl 0xc3e82e
mov edi, dword [ebp - 0x1b40]
mov dword [ebp - 0x1514], edi
jmp 0xc3e834
mov edi, dword [ebp - 0x1514]
cmp ebx, 0xd0000023
jne 0xc3e846
mov ebx, 0x8007007a
jmp 0xc3f4f6
test ebx, ebx
js 0xc3f4fc
mov eax, dword [ebp - 0x14e4]
xor ecx, ecx
mov dword [ebp - 0x14e0], ecx
mov dword [ebp - 0x16a8], ecx
mov dword [ebp - 0x16a4], eax
cmp edi, esi
jae 0xc3e876
mov ebx, 0xc000003e
jmp 0xc3ec66
mov edi, dword [eax]
lea ecx, [ebp - 0x16a4]
push ecx
mov edx, esi
mov dword [ebp - 0x1500], edi
mov ecx, eax
call fcn.00a32533
mov ebx, eax
xor ecx, ecx
test ebx, ebx
js 0xc3ec66
lea eax, [ebp - 0x16a8]
mov edx, esi
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3ec64
mov eax, dword [ebp - 0x1514]
sub eax, dword [ebp - 0x16a8]
cmp eax, edi
jae 0xc3e8cc
mov ebx, 0xc000003e
jmp 0xc3ec64
mov eax, dword [ebp - 0x16a4]
lea ecx, [ebp - 0x16a4]
push ecx
mov edx, edi
mov dword [ebp - 0x14d4], eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3ec64
mov ecx, dword [ebp - 0x16a8]
lea eax, [ebp - 0x16a8]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3ec64
mov eax, dword [ebp - 0x1514]
sub eax, dword [ebp - 0x16a8]
cmp eax, esi
jb 0xc3e8c2
mov ecx, dword [ebp - 0x16a4]
lea eax, [ebp - 0x16a4]
push eax
mov edx, esi
mov edi, dword [ecx]
mov dword [ebp - 0x14dc], edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3ec64
mov ecx, dword [ebp - 0x16a8]
lea eax, [ebp - 0x16a8]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3ec64
mov eax, dword [ebp - 0x1514]
sub eax, dword [ebp - 0x16a8]
cmp eax, edi
jb 0xc3e8c2
mov eax, dword [ebp - 0x16a4]
lea ecx, [ebp - 0x16a4]
push ecx
mov edx, edi
mov dword [ebp - 0x14d8], eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3ec64
mov ecx, dword [ebp - 0x16a8]
lea eax, [ebp - 0x16a8]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3ec64
mov eax, dword [ebp - 0x1514]
sub eax, dword [ebp - 0x16a8]
cmp eax, esi
jb 0xc3e8c2
mov ecx, dword [ebp - 0x16a4]
mov edx, esi
mov eax, dword [ecx]
mov dword [ebp - 0x14e8], eax
lea eax, [ebp - 0x16a4]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3ec64
mov ecx, dword [ebp - 0x16a8]
lea eax, [ebp - 0x16a8]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3ec64
mov eax, dword [ebp - 0x1514]
sub eax, dword [ebp - 0x16a8]
mov ecx, dword [ebp - 0x14e8]
cmp eax, ecx
jb 0xc3e8c2
lea eax, [ebp - 0x16a8]
mov edx, ecx
mov ecx, dword [ebp - 0x16a8]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3ec64
mov edx, dword [ebp - 0x1514]
mov eax, edx
sub eax, dword [ebp - 0x16a8]
jne 0xc3e8c2
mov ebx, dword [ebp - 0x1500]
mov ecx, dword [ebp - 0x14e8]
add ecx, 0xc
lea eax, [edi + ebx]
add eax, ecx
cmp eax, edx
jne 0xc3e8c2
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc3ea9d
mov ebx, 0xc0000017
jmp 0xc3ebe1
cmp dword [ebp - 0x14d4], 0
je 0xc3eadf
push ebx
push 8
mov dword [edi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc3eac8
mov ebx, 0xc0000017
xor eax, eax
jmp 0xc3eb7a
mov dword [edi + 4], eax
push ebx
push dword [ebp - 0x14d4]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc3eae6
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
cmp dword [ebp - 0x14d8], 0
je 0xc3eb23
mov ebx, dword [ebp - 0x14dc]
push ebx
push 8
mov dword [edi + 8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc3eabc
mov dword [edi + 0xc], eax
push ebx
push dword [ebp - 0x14d8]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc3eb29
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
cmp dword [ebp - 0x16a4], 0
je 0xc3eb6a
mov ebx, dword [ebp - 0x14e8]
push ebx
push 8
mov dword [edi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc3eabc
mov dword [edi + 0x14], eax
push ebx
push dword [ebp - 0x16a4]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc3eb70
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [ebp - 0x14e0], edi
mov ebx, eax
mov edi, eax
test edi, edi
je 0xc3ebe1
cmp dword [edi + 4], 0
je 0xc3eb9a
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc3ebb6
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc3ebd2
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test ebx, ebx
js 0xc3ebf7
mov eax, dword [ebp - 0x14e0]
mov edi, ecx
mov dword [ebp - 0x14fc], eax
jmp 0xc3ebfd
mov edi, dword [ebp - 0x14e0]
test edi, edi
je 0xc3ec66
cmp dword [edi + 4], 0
je 0xc3ec1d
push dword [edi + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 4], ecx
cmp dword [edi + 0xc], 0
je 0xc3ec39
push dword [edi + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0xc], ecx
cmp dword [edi + 0x14], 0
je 0xc3ec55
push dword [edi + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0x14], ecx
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
or ebx, 0x10000000
mov dword [ebp - 0x1500], ebx
jl 0xc3f4fc
mov eax, dword [ebp - 0x14fc]
mov dword [ebp - 0x14e0], ecx
mov dword [ebp - 0x1500], ecx
test eax, eax
jne 0xc3ec98
mov ebx, 0xd000000d
jmp 0xc3f4f6
mov ebx, dword [eax + 4]
mov dword [ebp - 0x14d4], ebx
test ebx, ebx
je 0xc3ec8e
mov edi, dword [eax]
test edi, edi
je 0xc3ec8e
add edi, 0xfffffff8
mov dword [ebp - 0x14dc], ecx
push edi
push ecx
mov dword [ebp - 0x14d8], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x14e8], eax
test eax, eax
je 0xc3f2b0
xor ecx, ecx
mov dword [ebp - 0x6c4], 0xab69605e
mov dword [ebp - 0x6c0], 0x7f1137f
mov dl, cl
mov dword [ebp - 0x1514], ebx
mov dword [ebp - 0x150c], eax
mov dword [ebp - 0x1520], ecx
and edi, 7
je 0xc3ee23
mov dword [ebp - 0x152c], ecx
mov eax, ecx
mov dword [ebp - 0x151c], eax
test edi, edi
je 0xc3ed73
push 0x38
pop ebx
mov eax, dword [ebp - 0x1514]
inc dword [ebp - 0x1514]
movzx eax, byte [eax]
cmp dword [ebp - 0x152c], esi
jge 0xc3ed43
lea ecx, [ebx - 0x20]
shl eax, cl
or dword [ebp - 0x1520], eax
jmp 0xc3ed4d
mov ecx, ebx
shl eax, cl
or dword [ebp - 0x151c], eax
mov ecx, dword [ebp - 0x152c]
sub ebx, 8
inc ecx
mov dword [ebp - 0x152c], ecx
cmp ecx, edi
jl 0xc3ed1f
mov eax, dword [ebp - 0x1514]
mov dword [ebp - 0x1514], eax
mov eax, dword [ebp - 0x151c]
mov ebx, dword [ebp - 0x1520]
xor eax, 0x699a899c
xor ebx, 0x92f65a5
mov dword [ebp - 0x153c], eax
xor ecx, ecx
mov dword [ebp - 0x152c], ebx
mov dword [ebp - 0x1550], ebx
mov dword [ebp - 0x155c], eax
test edi, edi
je 0xc3edf2
mov ebx, dword [ebp - 0x150c]
lea eax, [ebx + 1]
mov dword [ebp - 0x150c], eax
cmp ecx, esi
jge 0xc3edc4
rol dword [ebp - 0x1550], 8
mov eax, dword [ebp - 0x1550]
jmp 0xc3edd1
rol dword [ebp - 0x155c], 8
mov eax, dword [ebp - 0x155c]
mov byte [ebx], al
inc ecx
mov eax, dword [ebp - 0x150c]
mov ebx, eax
cmp ecx, edi
jl 0xc3eda8
mov ebx, dword [ebp - 0x152c]
mov dword [ebp - 0x150c], eax
mov eax, dword [ebp - 0x153c]
cmp edi, esi
jbe 0xc3ee0a
push 8
pop ecx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0x153c], eax
jmp 0xc3ee32
xor eax, eax
mov dword [ebp - 0x153c], eax
cmp edi, esi
jae 0xc3ee32
mov ecx, esi
sub ecx, edi
shl ecx, 3
shr ebx, cl
shl ebx, cl
jmp 0xc3ee32
or dword [ebp - 0x151c], 0xffffffff
mov ebx, ecx
mov dword [ebp - 0x153c], ecx
mov ecx, dword [ebp - 0x14d8]
mov eax, ecx
shr eax, 3
mov dword [ebp - 0x152c], eax
test eax, eax
je 0xc3f228
movzx ecx, word [ebp - 0x6be]
mov eax, 0x7f1137f
movzx esi, word [ebp - 0x6c2]
mov edi, 0xab69605e
movzx eax, ax
xor edi, 0x7f1137f
mov dword [ebp - 0x1560], ecx
mov ecx, 0xab69605e
mov dword [ebp - 0x155c], eax
movzx eax, cx
mov ecx, dword [ebp - 0x153c]
mov dword [ebp - 0x15f8], eax
mov eax, dword [ebp - 0x150c]
mov dword [ebp - 0x1584], esi
add eax, 7
mov esi, dword [ebp - 0x1514]
add esi, 2
mov dword [ebp - 0x1550], edi
mov dword [ebp - 0x150c], eax
mov dword [ebp - 0x1514], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0x1514]
xor ebx, edi
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0x1514]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0x1514]
shl esi, 8
add dword [ebp - 0x1514], 8
movzx eax, byte [eax + 5]
or esi, eax
mov eax, 0x7f1137f
xor ecx, esi
xor eax, 0xab69605e
xor eax, ecx
xor eax, ebx
mov ecx, eax
mov dword [ebp - 0x153c], eax
sub ecx, 0xab69605e
rol eax, 0xa
rol ecx, 5
imul ecx, dword [ebp - 0x155c]
add ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ebx + ecx]
ror ecx, 9
imul ecx, dword [ebp - 0x1584]
sub ecx, eax
mov eax, dword [ebp - 0x153c]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x153c], eax
sub ecx, dword [ebp - 0x155c]
imul ecx, dword [ebp - 0x15f8]
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0x1584]
xor ecx, ebx
mov eax, ebx
rol ecx, 6
imul ecx, dword [ebp - 0x1560]
rol eax, 2
sub ecx, eax
mov eax, dword [ebp - 0x153c]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x153c], eax
xor ecx, 0xab69605e
mov eax, 0x7f1137f
sub eax, ecx
xor ebx, eax
mov eax, dword [ebp - 0x155c]
xor eax, ebx
mov ecx, ebx
imul eax, dword [ebp - 0x1584]
ror ecx, 6
xor ecx, eax
mov eax, dword [ebp - 0x153c]
xor eax, ecx
mov ecx, 0x7f1137f
add ecx, eax
mov dword [ebp - 0x153c], eax
ror ecx, 0xf
imul ecx, dword [ebp - 0x15f8]
rol eax, 2
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0x1560]
sub ecx, eax
mov eax, dword [ebp - 0x153c]
xor eax, ecx
mov ecx, 0xab69605e
xor ecx, eax
mov dword [ebp - 0x153c], eax
ror ecx, 0xc
imul ecx, dword [ebp - 0x155c]
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0x1560]
xor ecx, ebx
mov eax, ebx
imul ecx, dword [ebp - 0x1584]
shr eax, 0xa
xor ecx, eax
mov eax, dword [ebp - 0x153c]
xor eax, ecx
mov ecx, dword [ebp - 0x1560]
mov dword [ebp - 0x153c], eax
not eax
ror eax, 5
add eax, dword [ebp - 0x15f8]
imul eax, ecx
xor ebx, eax
mov eax, ebx
sub eax, ecx
xor eax, 0xab69605e
xor dword [ebp - 0x153c], eax
mov eax, dword [ebp - 0x153c]
xor ecx, eax
rol ecx, 2
imul ecx, dword [ebp - 0x155c]
shr eax, 2
add ecx, eax
xor ebx, ecx
mov eax, ebx
rol eax, 7
lea ecx, [ebx - 0x7f1137f]
ror ecx, 6
imul ecx, dword [ebp - 0x1584]
add ecx, eax
mov eax, dword [ebp - 0x153c]
xor eax, ecx
mov dword [ebp - 0x153c], eax
mov ecx, eax
mov eax, dword [ebp - 0x155c]
xor eax, dword [ebp - 0x153c]
imul eax, dword [ebp - 0x15f8]
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0x1584]
xor ecx, ebx
mov eax, ebx
rol ecx, 5
imul ecx, dword [ebp - 0x1560]
rol eax, 7
add ecx, eax
mov eax, dword [ebp - 0x1550]
xor dword [ebp - 0x153c], ecx
mov ecx, dword [ebp - 0x153c]
xor eax, ecx
xor ebx, eax
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0x1584]
imul eax, dword [ebp - 0x155c]
xor ecx, eax
mov dword [ebp - 0x153c], ecx
sub ecx, 0x7f1137f
mov eax, dword [ebp - 0x153c]
ror ecx, 1
imul ecx, dword [ebp - 0x15f8]
ror eax, 6
sub ecx, eax
xor ebx, ecx
mov ecx, 0xab69605e
mov eax, ebx
rol eax, 0xe
lea ecx, [ecx + ebx]
rol ecx, 3
imul ecx, dword [ebp - 0x1560]
add ecx, eax
mov eax, dword [ebp - 0x153c]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0x153c], eax
rol ecx, 0xf
imul ecx, dword [ebp - 0x155c]
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0x15f8]
xor ecx, ebx
mov eax, ebx
imul ecx, dword [ebp - 0x1584]
shr eax, 3
xor ecx, eax
mov eax, dword [ebp - 0x153c]
xor eax, ecx
mov ecx, 0x7f1137f
xor ecx, eax
mov dword [ebp - 0x153c], eax
rol ecx, 4
imul ecx, dword [ebp - 0x15f8]
rol eax, 2
xor ecx, eax
mov eax, dword [ebp - 0x150c]
xor ecx, dword [ebp - 0x1520]
xor ebx, ecx
mov dword [ebp - 0x1520], edi
mov ecx, dword [ebp - 0x153c]
xor ecx, dword [ebp - 0x151c]
mov byte [eax - 4], bl
mov byte [eax], cl
ror ebx, 8
mov byte [eax - 5], bl
ror ecx, 8
mov byte [eax - 1], cl
ror ebx, 8
mov byte [eax - 6], bl
ror ecx, 8
mov byte [eax - 2], cl
ror ebx, 8
ror ecx, 8
mov byte [eax - 7], bl
mov byte [eax - 3], cl
add eax, 8
ror ebx, 8
ror ecx, 8
sub dword [ebp - 0x152c], 1
mov dword [ebp - 0x151c], esi
mov esi, dword [ebp - 0x1514]
mov dword [ebp - 0x150c], eax
jne 0xc3eeb6
mov ecx, dword [ebp - 0x14d8]
push 4
pop esi
mov ebx, dword [ebp - 0x14e8]
xor eax, eax
test ecx, ecx
je 0xc3f23c
xor dl, byte [eax + ebx]
inc eax
cmp eax, ecx
jb 0xc3f234
mov edi, dword [ebp - 0x14d4]
movzx eax, dl
cdq
cmp eax, dword [ecx + edi]
jne 0xc3f265
cmp edx, dword [ecx + edi + 4]
jne 0xc3f265
mov edi, ebx
mov dword [ebp - 0x1500], ecx
xor eax, eax
mov dword [ebp - 0x14e0], edi
mov ebx, eax
jmp 0xc3f277
mov edi, dword [ebp - 0x14e0]
xor eax, eax
mov dword [ebp - 0x14dc], 0xc004d501
test ebx, ebx
je 0xc3f28a
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x14dc], 0
jl 0xc3f2b0
mov dword [ebp - 0x14f0], edi
xor ecx, ecx
mov edi, dword [ebp - 0x1500]
mov eax, ecx
mov dword [ebp - 0x1508], edi
mov ebx, 0x10000000
jmp 0xc3f2c3
mov eax, dword [ebp - 0x14e0]
mov ebx, 0xd0000001
mov edi, dword [ebp - 0x1508]
xor ecx, ecx
mov dword [ebp - 0x1500], ebx
test eax, eax
je 0xc3f2dc
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc3f4fc
mov ecx, dword [ebp - 0x14f0]
xor eax, eax
mov dword [ebp - 0x169c], eax
mov dword [ebp - 0x1698], ecx
cmp edi, esi
jb 0xc3f4eb
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x14e0], eax
lea eax, [ebp - 0x1698]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3f4f0
lea eax, [ebp - 0x169c]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3f4f0
mov eax, edi
sub eax, dword [ebp - 0x169c]
cmp eax, esi
jb 0xc3f4eb
mov ecx, dword [ebp - 0x1698]
lea eax, [ebp - 0x1698]
push eax
mov edx, esi
mov edi, dword [ecx]
mov dword [ebp - 0x1500], edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3f4f0
mov ecx, dword [ebp - 0x169c]
lea eax, [ebp - 0x169c]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3f4f0
mov eax, dword [ebp - 0x1508]
mov ecx, dword [ebp - 0x169c]
sub eax, ecx
cmp eax, edi
jb 0xc3f4eb
lea eax, [ebp - 0x169c]
mov edx, edi
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3f4f0
mov edx, dword [ebp - 0x1508]
mov ebx, dword [ebp - 0x14f0]
mov ecx, dword [ebp - 0x1698]
add ecx, edi
lea eax, [ebx + edx]
cmp eax, ecx
jb 0xc3f4eb
mov ecx, dword [ebp - 0x1698]
mov eax, ebx
sub eax, edi
sub eax, ecx
add eax, edx
cmp eax, 8
jae 0xc3f4eb
xor eax, eax
mov dword [ebp - 0x14dc], eax
mov edx, eax
mov dword [ebp - 0x14d4], edx
mov ebx, eax
test ecx, ecx
je 0xc3f46c
mov edx, dword [ebp - 0x1500]
lea eax, [ebp - 0x1608]
push eax
mov edi, ecx
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc3f4f0
mov ecx, dword [ebp - 0x1608]
jmp 0xc3f458
lea eax, [edi + 4]
cmp eax, edi
jb 0xc3f4a1
cmp eax, ecx
ja 0xc3f49a
mov eax, dword [edi]
add eax, 4
cmp eax, esi
jb 0xc3f493
add eax, edi
cmp eax, edi
jb 0xc3f4a1
mov edi, eax
xor eax, eax
mov ebx, eax
cmp edi, ecx
ja 0xc3f49a
inc dword [ebp - 0x14dc]
cmp edi, ecx
jb 0xc3f42e
cmp edi, ecx
jne 0xc3f49a
mov edi, dword [ebp - 0x1500]
mov edx, dword [ebp - 0x14d4]
test edi, edi
je 0xc3f4ac
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edx, eax
mov dword [ebp - 0x14d4], edx
test edx, edx
jne 0xc3f4a8
mov ebx, 0xc0000017
jmp 0xc3f4d9
mov ebx, 0xc0000095
jmp 0xc3f4d9
mov ebx, 0xc000000d
jmp 0xc3f4f0
mov ebx, 0xc0000095
jmp 0xc3f4f0
xor eax, eax
mov ebx, eax
mov eax, dword [ebp - 0x1698]
test eax, eax
je 0xc3f4c7
push edi
push eax
push edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebp - 0x14d4]
add esp, 0xc
mov eax, dword [ebp - 0x14dc]
mov dword [ebp - 0x1a50], edx
mov dword [ebp - 0x1a58], eax
test ebx, ebx
js 0xc3f4f0
mov eax, dword [ebp - 0x14e0]
cmp eax, dword [ebp - 0x1a58]
je 0xc3f4f0
mov ebx, 0xc000003e
or ebx, 0x10000000
mov dword [ebp - 0x1500], ebx
mov eax, dword [ebp - 0x14f4]
test eax, eax
je 0xc3f517
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0x14ec]
test edi, edi
je 0xc3f585
xor eax, eax
cmp dword [edi + 4], eax
je 0xc3f53e
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc3f55a
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc3f576
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x14f8]
test eax, eax
je 0xc3f5a0
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x14e4]
test eax, eax
je 0xc3f5bb
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0x14fc]
test edi, edi
je 0xc3f629
xor eax, eax
cmp dword [edi + 4], eax
je 0xc3f5e2
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc3f5fe
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc3f61a
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x14f0]
test eax, eax
je 0xc3f644
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc3fc08
cmp dword [ebp - 0x1a58], 1
jb 0xc3fbfd
cmp dword [ebp - 0x1a50], 0
jne 0xc3f6ea
mov ebx, 0xc000000d
mov dword [ebp - 0x1500], ebx
mov eax, dword [ebp - 0x1524]
test ebx, ebx
js 0xc3fc08
cmp eax, 0xd0000023
jne 0xc3f691
mov eax, 0x8007007a
mov dword [ebp - 0x1524], eax
cmp eax, 0x8007007a
je 0xc3f6a8
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test eax, eax
js 0xc3fc08
cmp dword [ebp - 0x1a58], 6
jne 0xc3fbfd
cmp dword [ebp - 0x1a50], 0
jne 0xc3f75e
mov edx, dword [ebp - 0x1928]
mov ebx, 0xc000000d
mov ecx, dword [ebp - 0x192c]
mov dword [ebp - 0x1500], ebx
mov dword [ebp - 0x14e0], edx
mov dword [ebp - 0x14f4], ecx
jmp 0xc3f834
cmp dword [ebp - 0x1a58], 0
jbe 0xc3f666
mov eax, dword [ebp - 0x1a50]
lea ecx, [ebp - 0x15a4]
push ecx
mov edx, esi
mov dword [ebp - 0x15a4], eax
mov ecx, eax
mov edi, dword [eax]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3f735
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x15a4]
mov dword [ebp - 0x15a4], eax
jmp 0xc3f741
mov edi, dword [ebp - 0x16d4]
mov eax, dword [ebp - 0x16d8]
test ebx, ebx
js 0xc3f671
cmp edi, esi
jne 0xc3d2a7
mov eax, dword [eax]
mov dword [ebp - 0x1524], eax
jmp 0xc3f677
mov ecx, dword [ebp - 0x1a50]
xor eax, eax
mov dword [ebp - 0x1590], ecx
mov edi, eax
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x14e0], eax
lea eax, [ebp - 0x1590]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3f7f0
mov edx, dword [ebp - 0x14e0]
lea eax, [ebp - 0x1590]
mov ecx, dword [ebp - 0x1590]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3f7f0
mov ecx, dword [ebp - 0x1590]
inc edi
cmp edi, 1
jb 0xc3f76e
mov edi, dword [ecx]
lea eax, [ebp - 0x1590]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3f7f0
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1590]
mov dword [ebp - 0x1590], eax
jmp 0xc3f7fc
mov edi, dword [ebp - 0x16e0]
mov eax, dword [ebp - 0x16e4]
test ebx, ebx
js 0xc3f81c
cmp edi, 8
jne 0xc3d2a7
mov ecx, dword [eax]
mov dword [ebp - 0x14f4], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14e0], ecx
jmp 0xc3f834
mov eax, dword [ebp - 0x1928]
mov dword [ebp - 0x14e0], eax
mov eax, dword [ebp - 0x192c]
mov dword [ebp - 0x14f4], eax
test ebx, ebx
js 0xc3fc08
cmp dword [ebp - 0x1a50], 0
jne 0xc3f87b
mov ebx, 0xc000000d
mov dword [ebp - 0x1500], ebx
mov eax, dword [ebp - 0x16e8]
mov dword [ebp - 0x14d4], eax
test ebx, ebx
js 0xc3fc08
cmp dword [ebp - 0x1a50], 0
jne 0xc3f930
mov ebx, 0xc000000d
jmp 0xc3fc02
mov ecx, dword [ebp - 0x1a50]
xor eax, eax
mov dword [ebp - 0x1564], ecx
mov edi, eax
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x14d4], eax
lea eax, [ebp - 0x1564]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3f90d
mov edx, dword [ebp - 0x14d4]
lea eax, [ebp - 0x1564]
mov ecx, dword [ebp - 0x1564]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3f90d
mov ecx, dword [ebp - 0x1564]
inc edi
cmp edi, 2
jb 0xc3f88b
mov edi, dword [ecx]
lea eax, [ebp - 0x1564]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3f90d
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1564]
mov dword [ebp - 0x1564], eax
jmp 0xc3f919
mov edi, dword [ebp - 0x16f0]
mov eax, dword [ebp - 0x16f4]
test ebx, ebx
js 0xc3f850
cmp edi, esi
jne 0xc3d2a7
mov eax, dword [eax]
jmp 0xc3f856
mov ecx, dword [ebp - 0x1a50]
xor eax, eax
mov dword [ebp - 0x1540], ecx
mov edi, eax
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x14dc], eax
lea eax, [ebp - 0x1540]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3f9c6
mov edx, dword [ebp - 0x14dc]
lea eax, [ebp - 0x1540]
mov ecx, dword [ebp - 0x1540]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3f9c6
mov ecx, dword [ebp - 0x1540]
inc edi
cmp edi, 3
jb 0xc3f940
mov edi, dword [ecx]
lea eax, [ebp - 0x1540]
push eax
mov edx, esi
mov dword [ebp - 0x14dc], edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3f9c6
neg edi
sbb edi, edi
and edi, dword [ebp - 0x1540]
mov dword [ebp - 0x1540], edi
jmp 0xc3f9d8
mov eax, dword [ebp - 0x16fc]
mov edi, dword [ebp - 0x1700]
mov dword [ebp - 0x14dc], eax
test ebx, ebx
js 0xc3fc08
mov ecx, dword [ebp - 0x1a50]
xor ebx, ebx
mov edx, ebx
mov eax, dword [ecx]
mov dword [ebp - 0x14d8], eax
lea eax, [ecx + 4]
cmp eax, ecx
jae 0xc3fa01
mov ebx, 0xc0000095
or eax, 0xffffffff
mov dword [ebp - 0x1500], ebx
mov dword [ebp - 0x15d4], eax
test ebx, ebx
js 0xc3fa8a
mov ecx, dword [ebp - 0x14d8]
add ecx, eax
mov ebx, ecx
mov dword [ebp - 0x14d8], ebx
cmp ecx, eax
jae 0xc3fa28
or ecx, 0xffffffff
cmp ebx, eax
mov dword [ebp - 0x15d4], ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0x1500], ebx
cmp dword [ebp - 0x14d8], eax
jb 0xc3fa8a
inc edx
push 0
pop ebx
cmp edx, esi
jb 0xc3f9ea
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x14d8], eax
lea eax, [ebp - 0x15d4]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3fa8a
mov ecx, dword [ebp - 0x14d8]
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0x15d4]
mov dword [ebp - 0x15d4], eax
jmp 0xc3fa96
mov ecx, dword [ebp - 0x1708]
mov eax, dword [ebp - 0x170c]
test ebx, ebx
js 0xc3faa6
cmp ecx, esi
jne 0xc3d2a7
mov eax, dword [eax]
jmp 0xc3faac
mov eax, dword [ebp - 0x1710]
mov dword [ebp - 0x14d8], eax
test ebx, ebx
js 0xc3fc08
mov ecx, dword [ebp - 0x1a50]
xor ebx, ebx
mov edx, ebx
mov eax, dword [ecx]
mov dword [ebp - 0x14ec], eax
lea eax, [ecx + 4]
cmp eax, ecx
jae 0xc3fadb
mov ebx, 0xc0000095
or eax, 0xffffffff
mov dword [ebp - 0x1500], ebx
mov dword [ebp - 0x15d8], eax
test ebx, ebx
js 0xc3fb65
mov ecx, dword [ebp - 0x14ec]
add ecx, eax
mov ebx, ecx
mov dword [ebp - 0x14ec], ebx
cmp ecx, eax
jae 0xc3fb02
or ecx, 0xffffffff
cmp ebx, eax
mov dword [ebp - 0x15d8], ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0x1500], ebx
cmp dword [ebp - 0x14ec], eax
jb 0xc3fb65
inc edx
push 0
pop ebx
cmp edx, 5
jb 0xc3fac4
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x14ec], eax
lea eax, [ebp - 0x15d8]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1500], ebx
test ebx, ebx
js 0xc3fb65
mov ecx, dword [ebp - 0x14ec]
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0x15d8]
mov dword [ebp - 0x15d8], eax
jmp 0xc3fb71
mov ecx, dword [ebp - 0x1718]
mov eax, dword [ebp - 0x171c]
test ebx, ebx
js 0xc3fb81
cmp ecx, esi
jne 0xc3d2a7
mov ecx, dword [eax]
jmp 0xc3fb87
mov ecx, dword [ebp - 0x1530]
test ebx, ebx
js 0xc3fc08
mov eax, dword [ebp - 0x1504]
cmp eax, dword [ebp - 0x14f4]
jne 0xc3fbfd
mov eax, dword [ebp - 0x1548]
cmp eax, dword [ebp - 0x14e0]
jne 0xc3fbfd
mov dword [ebp - 0x1528], ecx
cmp dword [ebp - 0x14d8], esi
jbe 0xc3fbc8
mov ecx, dword [ebp - 0x14d4]
mov ebx, 0x8007007a
mov dword [ebp - 0x1538], ecx
jmp 0xc3fc02
mov eax, dword [ebp - 0x14dc]
cmp eax, esi
ja 0xc3fbb5
mov esi, dword [ebp - 0x1534]
push eax
push edi
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0x14d4]
add esp, 0xc
mov dword [ebp - 0x1538], eax
mov eax, dword [ebp - 0x1524]
test eax, eax
je 0xc3fc08
mov ebx, eax
jmp 0xc3fc02
mov ebx, 0xc004d501
mov dword [ebp - 0x1500], ebx
mov edi, dword [ebp - 0x1510]
mov eax, dword [ebp - 0x14d0]
xor ecx, ecx
mov dword [ebp - 0x1a48], ecx
mov dword [ebp - 0x1a4c], ecx
test eax, eax
je 0xc3fc3d
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0x1a44], ecx
mov eax, dword [ebp - 0x1a50]
mov dword [ebp - 0x1a54], ecx
mov dword [ebp - 0x1a58], ecx
test eax, eax
je 0xc3fc6a
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0x1a50], ecx
test edi, edi
je 0xc3fc7d
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1518]
test eax, eax
je 0xc3fc98
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc3ce21
mov eax, dword [ebp - 0x1528]
test eax, eax
je 0xc466dc
mov dword [0xc95878], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x374]
push eax
push 0x9d0000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0xc3fd0b
cmp eax, esi
jne 0xc3fcde
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0xc3fd0b
mov esi, dword [0xc9307c]
xor ebx, ebx
push 0x403
push ebx
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x1528], eax
test eax, eax
jne 0xc3ff4c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push 4
pop ebx
xor eax, eax
lea edi, [ebp - 0x1a7c]
mov dword [ebp - 0x15d8], eax
mov dword [ebp - 0x15d4], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x1a70]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1540], eax
test eax, eax
je 0xc46668
push 0x28
pop ecx
mov esi, 0xc94ea0
mov dword [ebp - 0x15d8], eax
mov edi, eax
rep movsd dword es:[edi], dword [esi]
push 8
pop esi
push esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1564], eax
test eax, eax
je 0xc46668
mov ecx, dword [0xc94e98]
mov edi, eax
mov dword [eax], ecx
mov ecx, dword [0xc94e9c]
mov dword [eax + 4], ecx
mov dword [ebp - 0x15d4], edi
rdtsc
mov dword [ebp - 0x1590], eax
mov dword [ebp - 0x15a4], edx
xor eax, eax
mov edx, ebx
mov dword [ebp - 0x15c8], eax
mov ecx, ebx
lea eax, [ebp - 0x1598]
push eax
call fcn.00a32533
test eax, eax
js 0xc46660
mov edx, dword [ebp - 0x1598]
lea eax, [ebp - 0x15c8]
push eax
xor ecx, ecx
call fcn.00a32533
or eax, 0x10000000
jl 0xc46660
lea eax, [ebp - 0x16a0]
mov edx, 0xa0
push eax
mov ecx, ebx
call fcn.00a32533
test eax, eax
js 0xc46660
mov edx, dword [ebp - 0x16a0]
lea eax, [ebp - 0x15c8]
mov ecx, dword [ebp - 0x15c8]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xc46660
lea eax, [ebp - 0x160c]
mov edx, esi
push eax
mov ecx, ebx
call fcn.00a32533
test eax, eax
js 0xc46660
mov edx, dword [ebp - 0x160c]
lea eax, [ebp - 0x15c8]
mov ecx, dword [ebp - 0x15c8]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xc46660
lea eax, [ebp - 0x1640]
mov edx, esi
push eax
mov ecx, ebx
call fcn.00a32533
test eax, eax
js 0xc46660
mov edx, dword [ebp - 0x1640]
lea eax, [ebp - 0x15c8]
mov ecx, dword [ebp - 0x15c8]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xc46660
mov esi, dword [ebp - 0x15c8]
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x1640], edi
test edi, edi
je 0xc46668
lea eax, [ebp - 0x1950]
mov edx, ebx
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc46670
lea ecx, [edi + esi]
lea eax, [edi + 8]
mov dword [ebp - 0x160c], ecx
cmp eax, ecx
ja 0xc46670
mov eax, dword [ebp - 0x1950]
mov dword [edi], ebx
mov dword [eax], ebx
mov esi, edi
xor eax, eax
mov dword [ebp - 0x1644], esi
mov edi, eax
mov edx, dword [esi]
lea eax, [ebp - 0x1580]
push eax
mov ecx, ebx
call fcn.00a32533
test eax, eax
js 0xc46670
mov edx, dword [ebp - 0x1580]
lea eax, [ebp - 0x1644]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc46670
inc edi
cmp edi, 1
jae 0xc44755
mov esi, dword [ebp - 0x1644]
jmp 0xc3ff06
mov esi, dword [0xc9304c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [0xc95870], eax
lea edi, [ebp - 0x7b0]
mov eax, dword [0xc95878]
mov dword [ebp - 0x1510], eax
xor eax, eax
stosd dword es:[edi], eax
push 0x2c
push ebx
mov dword [0xc95874], edx
stosd dword es:[edi], eax
mov dword [ebp - 0x1934], ebx
mov dword [ebp - 0x1930], ebx
mov dword [ebp - 0x1518], ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x980]
push eax
mov dword [ebp - 0x1530], ebx
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x1524], ebx
mov edx, 0xc96238
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc3ffb2
mov eax, dword [0xc95890]
test eax, eax
jne 0xc405e9
push 0x338
mov esi, ebx
mov dword [ebp - 0x14d0], ebx
push ebx
mov dword [ebp - 0x14e0], ebx
mov dword [ebp - 0x14f4], esi
mov dword [ebp - 0x1504], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1548], eax
test eax, eax
je 0xc405db
or dword [ebp - 0x14dc], 0xffffffff
mov edi, 0x9fbcf2
add eax, 7
mov dword [ebp - 0x6cc], 0xab69605e
mov cl, bl
mov dword [ebp - 0x6c8], 0x7f1137f
mov dword [ebp - 0x14d4], ebx
mov edx, ebx
mov dword [ebp - 0x14d8], eax
mov dword [ebp - 0x14ec], edi
mov dword [ebp - 0x14f8], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0x14ec]
xor edx, ebx
mov dword [ebp - 0x14e8], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0x14ec]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0x14ec]
shl edi, 8
add dword [ebp - 0x14ec], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
mov dword [ebp - 0x14e4], esi
mov esi, edx
xor esi, dword [ebp - 0x14e4]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x14e8]
xor eax, edx
mov dword [ebp - 0x14e8], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x14e8]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x14e8]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x14e8], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x14e8]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x14e8]
xor edx, eax
mov dword [ebp - 0x14e8], edx
mov eax, dword [ebp - 0x14e8]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x14e8]
xor eax, edx
mov dword [ebp - 0x14e8], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x14e8]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x14e8]
xor eax, edx
mov dword [ebp - 0x14e8], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x14e8]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0x14e8]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0x14e4], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x14e4]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x14e4]
xor eax, edx
mov dword [ebp - 0x14e4], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x14e4], edx
mov edx, dword [ebp - 0x14e4]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x14e4], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x14e4]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x14e4]
xor eax, edx
mov dword [ebp - 0x14e4], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x14e4]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x14e4]
xor eax, edx
mov dword [ebp - 0x14e4], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x14e4]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x14e4]
xor edx, dword [ebp - 0x14d4]
xor eax, dword [ebp - 0x14dc]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x14e8], esi
mov esi, dword [ebp - 0x14d8]
mov dword [ebp - 0x14dc], edi
mov edi, dword [ebp - 0x14ec]
mov dword [ebp - 0x14d4], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x14f8], 1
mov dword [ebp - 0x14d8], esi
mov esi, eax
mov dword [ebp - 0x14e4], eax
jne 0xc4004a
mov esi, dword [ebp - 0x1548]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc403cb
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc403fd
cmp edx, dword [0x9fc02c]
jne 0xc403fd
mov edi, esi
xor eax, eax
mov dword [ebp - 0x14f4], edi
mov esi, eax
mov ebx, 0x337
jmp 0xc40412
mov edi, dword [ebp - 0x14f4]
or ebx, 0xffffffff
mov dword [ebp - 0x1504], 0xc004d501
xor eax, eax
test esi, esi
je 0xc40425
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x1504], 0
jl 0xc405d5
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xc960a0
push eax
push ebx
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xc4056b
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x16bc]
jne 0xc4045c
sub ecx, ebx
xor eax, eax
push edi
sar ecx, 1
push edx
push eax
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc405ce
xor eax, eax
mov edx, 0x5a4d
mov ecx, eax
mov eax, dword [edi]
mov dword [ebp - 0x14e0], ecx
cmp word [eax], dx
je 0xc404a8
mov ecx, 0xc000007b
mov dword [ebp - 0x14e0], ecx
jmp 0xc404f2
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc4049b
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc4049b
cmp dword [edx], 0x4550
jne 0xc4049b
movzx eax, word [edx + 0x18]
mov ebx, 0x10b
cmp ax, bx
je 0xc404e0
mov ebx, 0x20b
cmp ax, bx
je 0xc404e0
mov ecx, 0xc000000d
jmp 0xc404a0
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
xor edx, edx
add esi, 6
mov dword [ebp - 0x1504], eax
mov ebx, edx
test eax, eax
je 0xc4055f
mov edx, esi
mov dword [ebp - 0x1548], esi
lea eax, [edx + 1]
mov dword [ebp - 0x14d4], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc40517
sub edx, dword [ebp - 0x14d4]
inc esi
add esi, edx
test ecx, ecx
js 0xc40550
push dword [ebp - 0x1548]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc4056b
mov ecx, dword [ebp - 0x14d0]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x14e0]
inc dword [ebp - 0x14d0]
inc ebx
cmp ebx, dword [ebp - 0x1504]
jb 0xc40506
add edi, 0x10
cmp byte [esi], 0
jne 0xc40455
mov ebx, dword [ebp - 0x14e0]
mov esi, dword [ebp - 0x14f4]
test esi, esi
je 0xc4058c
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc405e2
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc405a5
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc40594
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc405ef
mov ebx, 0xc000007a
jmp 0xc40571
mov esi, dword [ebp - 0x14f4]
mov ebx, 0xc000007a
jmp 0xc40577
mov eax, dword [0xc95890]
xor ebx, ebx
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edx, 0xc96238
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0x14d0], ebx
lea edi, [ebp - 0x1afc]
mov dword [ebp - 0x14e0], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x14f4], ebx
mov dword [ebp - 0x1504], ebx
mov dword [ebp - 0x14dc], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x14d8], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc40628
mov eax, dword [0xc95890]
test eax, eax
jne 0xc40c49
push 0x338
mov esi, ebx
mov dword [ebp - 0x1548], ebx
push ebx
mov dword [ebp - 0x14d4], ebx
mov dword [ebp - 0x14ec], esi
mov dword [ebp - 0x14f8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x14e8], eax
test eax, eax
je 0xc40c3b
or dword [ebp - 0x1514], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0x6fc], 0xab69605e
mov dword [ebp - 0x6f8], 0x7f1137f
mov edx, ebx
mov dword [ebp - 0x14e4], ebx
mov esi, 0x9fbcf2
mov dword [ebp - 0x14fc], ebx
mov dword [ebp - 0x14f0], eax
mov dword [ebp - 0x1508], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [ebp - 0x150c], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [ebp - 0x151c], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [ebp - 0x14fc]
xor esi, edx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x150c]
xor eax, edx
mov dword [ebp - 0x150c], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x150c]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x150c]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x150c], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x150c]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x150c]
xor edx, eax
mov dword [ebp - 0x150c], edx
mov eax, dword [ebp - 0x150c]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x150c]
xor eax, edx
mov dword [ebp - 0x150c], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x150c]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x150c]
xor eax, edx
mov dword [ebp - 0x150c], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x150c]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0x150c]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0x14fc], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x14fc]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x14fc]
xor eax, edx
mov dword [ebp - 0x14fc], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x14fc], edx
mov edx, dword [ebp - 0x14fc]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x14fc], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x14fc]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x14fc]
xor eax, edx
mov dword [ebp - 0x14fc], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x14fc]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x14fc]
xor eax, edx
mov dword [ebp - 0x14fc], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x14fc]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x14fc]
xor edx, dword [ebp - 0x14e4]
xor eax, dword [ebp - 0x1514]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x150c], esi
mov esi, dword [ebp - 0x14f0]
mov dword [ebp - 0x14e4], ebx
mov dword [ebp - 0x1514], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x1508], 1
mov dword [ebp - 0x14f0], esi
mov esi, dword [ebp - 0x151c]
mov dword [ebp - 0x14fc], eax
jne 0xc406c0
mov esi, dword [ebp - 0x14e8]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc40a29
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc40a5b
cmp edx, dword [0x9fc02c]
jne 0xc40a5b
mov ebx, esi
xor eax, eax
mov dword [ebp - 0x14ec], ebx
mov esi, eax
mov edi, 0x337
jmp 0xc40a70
mov ebx, dword [ebp - 0x14ec]
or edi, 0xffffffff
mov dword [ebp - 0x14f8], 0xc004d501
xor eax, eax
test esi, esi
je 0xc40a83
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x14f8], 0
jl 0xc40c35
xor eax, eax
mov esi, ebx
push 0x40
push eax
push 0xc960a0
mov byte [edi + ebx], al
call fcn.00ab4bf6
add esp, 0xc
cmp byte [ebx], 0
je 0xc40bcb
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x16bc]
jne 0xc40abc
sub ecx, ebx
xor eax, eax
push edi
sar ecx, 1
push edx
push eax
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc40c2e
xor eax, eax
mov edx, 0x5a4d
mov ecx, eax
mov eax, dword [edi]
mov dword [ebp - 0x14d4], ecx
cmp word [eax], dx
je 0xc40b08
mov ecx, 0xc000007b
mov dword [ebp - 0x14d4], ecx
jmp 0xc40b52
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc40afb
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc40afb
cmp dword [edx], 0x4550
jne 0xc40afb
movzx eax, word [edx + 0x18]
mov ebx, 0x10b
cmp ax, bx
je 0xc40b40
mov ebx, 0x20b
cmp ax, bx
je 0xc40b40
mov ecx, 0xc000000d
jmp 0xc40b00
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
xor edx, edx
add esi, 6
mov dword [ebp - 0x14f8], eax
mov ebx, edx
test eax, eax
je 0xc40bbf
mov edx, esi
mov dword [ebp - 0x14e8], esi
lea eax, [edx + 1]
mov dword [ebp - 0x14e4], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc40b77
sub edx, dword [ebp - 0x14e4]
inc esi
add esi, edx
test ecx, ecx
js 0xc40bb0
push dword [ebp - 0x14e8]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc40bcb
mov ecx, dword [ebp - 0x1548]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x14d4]
inc dword [ebp - 0x1548]
inc ebx
cmp ebx, dword [ebp - 0x14f8]
jb 0xc40b66
add edi, 0x10
cmp byte [esi], 0
jne 0xc40ab5
mov ebx, dword [ebp - 0x14d4]
mov esi, dword [ebp - 0x14ec]
test esi, esi
je 0xc40bec
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc40c42
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc40c05
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc40bf4
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc40c4f
mov ebx, 0xc000007a
jmp 0xc40bd1
mov esi, dword [ebp - 0x14ec]
mov ebx, 0xc000007a
jmp 0xc40bd7
mov eax, dword [0xc95890]
xor ebx, ebx
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
push 0x54
lea eax, [ebp - 0xe90]
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
mov esi, dword [0xc9307c]
lea edi, [ebp - 0x7b4]
add esp, 0xc
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
pop edx
push 0x403
push ebx
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x1510]
mov ecx, eax
and ecx, edx
mov dword [ebp - 0x1510], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
and ecx, edx
shr eax, 0xc
mov word [ebp - 0xa], cx
and eax, edx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0xc99200]
call esi
mov dword [ebp - 0x14ec], eax
mov dword [ebp - 0x1548], 0xffffff
test eax, eax
jne 0xc40cfa
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc40cea
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc42160
mov ebx, 0x80004005
jmp 0xc42160
mov edi, dword [0xc93050]
lea eax, [ebp - 0x1724]
push eax
push ebx
lea eax, [ebp - 0x1594]
mov dword [ebp - 0x1720], ebx
push eax
mov esi, ebx
mov dword [ebp - 0x14f8], ebx
push 8
mov ecx, edi
mov dword [ebp - 0x14d4], esi
mov dword [ebp - 0x14e8], ebx
mov dword [ebp - 0x14e4], ebx
mov dword [ebp - 0x1724], ebx
call dword [0xc99200]
call edi
test eax, eax
jne 0xc40e4a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc40d60
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc40fc2
mov ebx, 0x80004005
mov esi, dword [ebp - 0x14e8]
mov edi, dword [ebp - 0x14f4]
xor ecx, ecx
test esi, esi
je 0xc40ded
mov eax, ecx
mov dword [ebp - 0x14e8], ecx
mov edx, dword [esi + eax*4]
test edx, edx
je 0xc40de1
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x14e4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x16bc]
jne 0xc40d97
sub ecx, dword [ebp - 0x14e4]
xor eax, eax
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc40dcc
mov byte [edx], al
inc edx
sub ecx, 1
jne 0xc40dbb
mov edx, dword [ebp - 0x14e8]
mov edx, dword [esi + edx*4]
push edx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x14e8]
inc eax
mov dword [ebp - 0x14e8], eax
cmp eax, 3
jb 0xc40d85
mov eax, dword [ebp - 0x1720]
xor edx, edx
test eax, eax
je 0xc40e0b
mov ecx, dword [ebp - 0x14f8]
test ecx, ecx
je 0xc40e0b
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0xc40e03
test esi, esi
je 0xc40e1e
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1720]
test eax, eax
je 0xc4173a
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0x1720], ecx
jmp 0xc4173c
mov eax, dword [ebp - 0x1724]
add eax, eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x1514], edi
test edi, edi
jne 0xc40e77
mov ebx, 0x8007000e
jmp 0xc40fad
mov eax, dword [ebp - 0x1594]
lea eax, [eax*4 + 4]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x14fc], esi
test esi, esi
jne 0xc40eab
mov ebx, 0x8007000e
xor ecx, ecx
jmp 0xc40f94
mov ebx, dword [0xc93050]
lea eax, [ebp - 0x1724]
push eax
push edi
lea eax, [ebp - 0x1594]
mov ecx, ebx
push eax
push 8
call dword [0xc99200]
call ebx
test eax, eax
jne 0xc40ef0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc40ee7
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc40ea4
mov ebx, 0x80004005
jmp 0xc40ea4
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x14d4], ecx
cmp dword [ebp - 0x1594], ecx
jbe 0xc40f73
mov dword [ebp - 0x14f0], edi
mov edi, esi
mov esi, dword [ebp - 0x14f0]
mov ebx, dword [0xc93058]
push ecx
push esi
mov ecx, ebx
call dword [0xc99200]
call ebx
mov ecx, esi
mov dword [edi], eax
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc40f2b
mov eax, dword [ebp - 0x14d4]
sub ecx, edx
sar ecx, 1
add edi, 4
push 0
lea esi, [esi + ecx*2]
add esi, 2
inc eax
mov dword [ebp - 0x14d4], eax
pop ecx
cmp eax, dword [ebp - 0x1594]
jb 0xc40f10
mov esi, dword [ebp - 0x14fc]
mov dword [ebp - 0x14d4], edi
mov edi, dword [ebp - 0x1514]
mov eax, dword [ebp - 0x14d4]
mov ebx, dword [ebp - 0x14e4]
mov dword [eax], 0x409
mov eax, dword [ebp - 0x1594]
inc eax
mov dword [ebp - 0x14d4], esi
mov esi, ecx
mov dword [ebp - 0x1514], eax
test esi, esi
je 0xc40fa7
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0x14d4]
test edi, edi
je 0xc40fc2
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc40d6b
xor eax, eax
mov ebx, eax
mov ecx, eax
mov dword [ebp - 0x14fc], ebx
cmp dword [ebp - 0x1514], eax
jbe 0xc41007
mov edx, dword [esi + ecx*4]
cmp edx, dword [eax*4 + 0xa192e8]
je 0xc40ffd
inc eax
cmp eax, 0x26
jb 0xc40fe1
inc ecx
xor eax, eax
cmp ecx, dword [ebp - 0x1514]
jae 0xc41007
jmp 0xc40fde
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x14fc], ebx
mov esi, dword [0xc93054]
mov ecx, esi
push eax
mov dword [ebp - 0x1514], eax
lea eax, [ebp - 0x16c]
push 0x55
push eax
push dword [ebx*4 + 0xa192e8]
call dword [0xc99200]
call esi
test eax, eax
je 0xc41070
mov esi, dword [0xc93048]
lea eax, [ebp - 0x804]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0x16c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
test eax, eax
jle 0xc41070
mov ebx, dword [ebp - 0x7f8]
shr ebx, 0x1b
and ebx, 1
mov dword [ebp - 0x1514], ebx
mov ebx, dword [ebp - 0x14fc]
xor eax, eax
mov edx, 0x9fba10
mov esi, eax
mov ecx, edx
mov dword [ebp + esi*4 - 0x638], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x16bc]
jne 0xc41085
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0xc41079
imul ecx, ebx, 3
movzx eax, byte [ecx + 0xa00b58]
mov eax, dword [ebp + eax*4 - 0x638]
mov dword [ebp - 0x1504], eax
movzx eax, byte [ecx + 0xa00b59]
mov eax, dword [ebp + eax*4 - 0x638]
mov dword [ebp - 0x14dc], eax
movzx eax, byte [ecx + 0xa00b5a]
mov eax, dword [ebp + eax*4 - 0x638]
mov dword [ebp - 0x14d8], eax
xor eax, eax
push 0x1c90
mov ebx, eax
push eax
mov dword [ebp - 0x14e4], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x14f0], ecx
test ecx, ecx
jne 0xc41116
mov ebx, 0x8007000e
jmp 0xc40d6b
or dword [ebp - 0x150c], 0xffffffff
xor ebx, ebx
add ecx, 7
mov dword [ebp - 0x68c], 0xab69605e
mov esi, 0xa19392
mov dword [ebp - 0x688], 0x7f1137f
mov al, bl
mov dword [ebp - 0x1508], ebx
mov edx, ebx
mov dword [ebp - 0x151c], ecx
mov dword [ebp - 0x1520], esi
mov dword [ebp - 0x152c], 0x392
movzx edi, byte [esi - 2]
movzx ecx, byte [esi - 1]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, ecx
shl esi, 8
mov ecx, dword [ebp - 0x1520]
xor ebx, edi
movzx ecx, byte [ecx + 3]
or esi, ecx
mov ecx, dword [ebp - 0x1520]
shl esi, 8
movzx ecx, byte [ecx + 4]
or esi, ecx
mov ecx, dword [ebp - 0x1520]
shl esi, 8
add dword [ebp - 0x1520], 8
movzx ecx, byte [ecx + 5]
or esi, ecx
xor edx, esi
xor edx, ebx
xor edx, 0xac987321
mov dword [ebp - 0x153c], edx
lea ecx, [edx + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0x153c]
rol ecx, 0xa
add edx, ecx
xor ebx, edx
lea ecx, [ebx + 0x7f1137f]
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, ebx
rol ecx, 2
sub edx, ecx
mov ecx, dword [ebp - 0x153c]
xor ecx, edx
imul edx, ecx, 0x605e
mov dword [ebp - 0x153c], ecx
shr ecx, 0xd
sub edx, ecx
sub edx, 0x756c8a2
xor ebx, edx
mov ecx, ebx
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 2
sub edx, ecx
mov ecx, dword [ebp - 0x153c]
xor ecx, edx
mov edx, ecx
mov dword [ebp - 0x153c], ecx
xor edx, 0xab69605e
mov ecx, 0x7f1137f
sub ecx, edx
xor ebx, ecx
mov ecx, ebx
mov edx, ebx
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
mov ecx, dword [ebp - 0x153c]
xor ecx, edx
mov dword [ebp - 0x153c], ecx
add ecx, 0x7f1137f
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0x153c]
rol ecx, 2
add edx, ecx
xor ebx, edx
lea ecx, [ebx + 0x54969fa2]
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 8
sub edx, ecx
mov ecx, dword [ebp - 0x153c]
xor ecx, edx
mov dword [ebp - 0x153c], ecx
xor ecx, 0xab69605e
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0x153c]
ror ecx, 0xa
xor edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, ebx
shr ecx, 0xa
xor edx, ecx
xor edx, dword [ebp - 0x153c]
mov ecx, edx
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor ebx, ecx
lea ecx, [ebx - 0x7f1]
xor ecx, edx
xor ecx, 0xab69605e
mov dword [ebp - 0x153c], ecx
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0x153c]
shr ecx, 2
add edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, ebx
rol ecx, 7
add edx, ecx
mov ecx, dword [ebp - 0x153c]
xor ecx, edx
mov dword [ebp - 0x153c], ecx
mov edx, ecx
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0xab69
rol ecx, 5
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 7
add edx, ecx
xor dword [ebp - 0x153c], edx
mov edx, dword [ebp - 0x153c]
xor ebx, edx
xor ebx, 0xac987321
mov ecx, ebx
ror ecx, 3
imul ecx, ecx, 0x137f
sub ecx, 0xd0dd417
xor edx, ecx
mov dword [ebp - 0x153c], edx
lea ecx, [edx - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0x153c]
ror ecx, 6
sub edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 0xe
add edx, ecx
mov ecx, dword [ebp - 0x153c]
xor ecx, edx
mov dword [ebp - 0x153c], ecx
add ecx, 0xab69605e
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0x153c]
ror ecx, 0xe
sub edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, ebx
shr ecx, 3
xor edx, ecx
mov ecx, dword [ebp - 0x153c]
xor ecx, edx
mov dword [ebp - 0x153c], ecx
xor ecx, 0x7f1137f
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0x153c]
rol ecx, 2
xor edx, ecx
mov ecx, dword [ebp - 0x151c]
xor edx, dword [ebp - 0x1508]
xor ebx, edx
mov dword [ebp - 0x1508], edi
mov edx, dword [ebp - 0x153c]
xor edx, dword [ebp - 0x150c]
mov byte [ecx - 4], bl
mov byte [ecx], dl
ror ebx, 8
mov byte [ecx - 5], bl
ror edx, 8
mov byte [ecx - 1], dl
ror ebx, 8
mov byte [ecx - 6], bl
ror edx, 8
mov byte [ecx - 2], dl
ror ebx, 8
ror edx, 8
mov byte [ecx - 7], bl
mov byte [ecx - 3], dl
add ecx, 8
ror ebx, 8
ror edx, 8
sub dword [ebp - 0x152c], 1
mov dword [ebp - 0x150c], esi
mov esi, dword [ebp - 0x1520]
mov dword [ebp - 0x151c], ecx
jne 0xc4115b
mov ebx, dword [ebp - 0x14e4]
xor ecx, ecx
mov edx, ecx
mov esi, 0x1c90
mov ecx, dword [ebp - 0x14f0]
xor al, byte [ecx + edx]
inc edx
cmp edx, esi
jb 0xc414c8
movzx eax, al
cdq
cmp eax, dword [0xa1b020]
jne 0xc414f6
cmp edx, dword [0xa1b024]
jne 0xc414f6
xor edx, edx
mov dword [ebp - 0x1720], ecx
mov ecx, edx
mov dword [ebp - 0x14f8], esi
jmp 0xc41503
mov ebx, 0xc004d501
xor edx, edx
mov dword [ebp - 0x14e4], ebx
test ecx, ecx
je 0xc41516
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc40d6b
mov edi, dword [ebp - 0x1720]
xor eax, eax
mov ebx, dword [ebp - 0x14fc]
mov esi, eax
mov edx, eax
cmp ebx, edx
jne 0xc4153b
mov dword [ebp + esi*4 - 0x5ac], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0x14e8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc41546
sub ecx, dword [ebp - 0x14e8]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0xc41530
inc esi
push 0
pop eax
cmp esi, 6
jb 0xc4152e
push 0xc
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, dword [ebp - 0x14e4]
mov esi, eax
test esi, esi
jne 0xc4158b
mov ebx, 0x8007000e
jmp 0xc40d71
xor eax, eax
mov edi, esi
mov edx, esi
mov dword [ebp - 0x14e4], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov ecx, eax
mov eax, esi
sub eax, esi
mov dword [ebp - 0x14e8], ecx
mov dword [ebp - 0x14fc], eax
movzx edi, word [ebp + ecx*2 - 0xc]
xor eax, eax
cmp di, word [eax*2 + 0xa19380]
je 0xc415ca
inc eax
cmp eax, 6
jb 0xc415b5
jmp 0xc416b0
mov edi, dword [ebp + eax*4 - 0x5ac]
mov ecx, edi
mov edx, dword [0xc93060]
mov dword [ebp - 0x14f0], edx
lea eax, [ecx + 1]
mov dword [ebp - 0x1508], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc415e8
sub ecx, dword [ebp - 0x1508]
xor eax, eax
push eax
push eax
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
xor eax, eax
push eax
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0x14f0]
mov dword [ebp - 0x14f0], eax
test eax, eax
je 0xc4170d
lea ecx, [eax + eax]
xor eax, eax
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0x14e4]
mov edx, dword [ebp - 0x14fc]
mov dword [edx + ecx], eax
mov eax, dword [ecx]
mov dword [ebp - 0x1508], eax
test eax, eax
je 0xc41581
mov edx, dword [0xc93060]
mov ecx, edi
mov dword [ebp - 0x150c], edx
lea eax, [ecx + 1]
mov dword [ebp - 0x151c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc4166c
push dword [ebp - 0x14f0]
sub ecx, dword [ebp - 0x151c]
push dword [ebp - 0x1508]
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
xor eax, eax
push eax
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0x150c]
test eax, eax
je 0xc416e6
mov ecx, dword [ebp - 0x14e8]
mov edx, dword [ebp - 0x14e4]
inc ecx
add edx, 4
mov dword [ebp - 0x14e8], ecx
mov dword [ebp - 0x14e4], edx
cmp ecx, 3
jb 0xc415ae
mov eax, dword [ebp - 0x1514]
mov edi, esi
xor ecx, ecx
mov dword [ebp - 0x14f4], edi
mov esi, ecx
mov dword [ebp - 0xe90], eax
jmp 0xc40d79
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc416fd
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc40d71
mov ebx, 0x80004005
jmp 0xc40d71
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc41724
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
mov edi, dword [ebp - 0x14f4]
js 0xc40d77
mov ebx, 0x80004005
jmp 0xc40d77
xor ecx, ecx
mov eax, dword [ebp - 0x14d4]
test eax, eax
je 0xc41755
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc42147
mov eax, dword [edi]
xor ecx, ecx
mov esi, dword [0xc930b4]
mov ebx, ecx
mov dword [ebp - 0xe88], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0xe84], eax
mov eax, dword [edi + 8]
mov edi, ecx
push ecx
mov dword [ebp - 0xe80], eax
lea eax, [ebp - 0x1a64]
push eax
push ecx
mov dword [ebp - 0x1a60], ecx
mov dword [ebp - 0x1a5c], ecx
mov ecx, esi
push 0x42
mov dword [ebp - 0x1a64], 0xc
call dword [0xc99200]
call esi
test eax, eax
jne 0xc417d2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc417c9
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc417db
mov ebx, 0x80004005
jmp 0xc417db
mov edi, dword [ebp - 0x1a60]
and edi, 1
mov dword [ebp - 0xe8c], edi
test ebx, ebx
js 0xc42147
mov eax, dword [ebp - 0x1510]
push 0x2a
pop ecx
mov dword [ebp - 0x14d4], ecx
sub eax, 1
je 0xc41826
sub eax, 1
je 0xc4181a
sub eax, 1
jne 0xc41836
mov ebx, 0xe1
mov dword [ebp - 0x14d0], ebx
mov dword [ebp - 0x14e0], ebx
jmp 0xc41836
mov dword [ebp - 0x14d0], 0xf
jmp 0xc4182c
mov dword [ebp - 0x14d0], ecx
mov dword [ebp - 0x14e0], 0xb
push 0x60
pop edi
xor ebx, ebx
mov dword [ebp - 0x14f8], edi
lea eax, [ebp - 0xd60]
lea esi, [edi + 0x7c]
push esi
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov word [ebp - 0xd1c], si
mov esi, dword [0xc93070]
lea eax, [ebp - 0xd60]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xc4192c
movzx ebx, word [ebp - 0xcba]
mov eax, dword [ebp - 0xcb4]
mov ecx, dword [ebp - 0xcb0]
mov dword [ebp - 0x14f8], ebx
mov dword [ebp - 0x14e8], eax
mov dword [ebp - 0x1af4], eax
mov dword [ebp - 0x14e4], ecx
mov dword [ebp - 0x1af0], ecx
cmp ebx, edi
jae 0xc418b9
mov dword [ebp - 0x14f8], edi
xor ebx, ebx
cmp dword [ebp - 0x1510], 1
mov edi, dword [ebp - 0x1504]
je 0xc418d0
mov edi, dword [ebp - 0x14d8]
push 0x5c
lea eax, [ebp - 0xb70]
push ebx
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0x1514], eax
test eax, eax
jne 0xc41949
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc4191c
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc419e9
mov ebx, 0x80004005
jmp 0xc42147
mov eax, dword [ebp - 0x1af0]
mov dword [ebp - 0x14e4], eax
mov eax, dword [ebp - 0x1af4]
mov dword [ebp - 0x14e8], eax
jmp 0xc418bb
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0x14f8]
push dword [ebp - 0x14d0]
call dword [0xc99200]
call esi
push edi
push 0x20
neg eax
mov dword [ebp - 0xb60], 0x190
pop edx
lea ecx, [ebp - 0xb54]
mov dword [ebp - 0xb70], eax
mov byte [ebp - 0xb56], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0xb70]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc419ca
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc419c1
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc419d0
mov ebx, 0x80004005
jmp 0xc419d0
mov dword [ebp - 0xe7c], eax
push dword [ebp - 0x1514]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xc42147
cmp dword [ebp - 0x1510], 1
je 0xc41a06
mov eax, dword [ebp - 0x14d8]
mov dword [ebp - 0x1504], eax
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0xb14]
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov edi, eax
test edi, edi
jne 0xc41a5d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc41a52
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc41afd
jmp 0xc41922
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0x14f8]
push dword [ebp - 0x14e0]
call dword [0xc99200]
call esi
push dword [ebp - 0x1504]
neg eax
mov dword [ebp - 0xb04], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0xaf8]
mov dword [ebp - 0xb14], eax
mov byte [ebp - 0xafa], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0xb14]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc41ae3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc41ada
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc41ae9
mov ebx, 0x80004005
jmp 0xc41ae9
mov dword [ebp - 0xe78], eax
mov esi, dword [0xc930b0]
xor eax, eax
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xc42147
mov ebx, dword [ebp - 0x1510]
xor eax, eax
mov ecx, eax
mov edx, eax
mov eax, ebx
sub eax, 1
je 0xc41b22
sub eax, 1
je 0xc41b5a
sub eax, 1
jne 0xc41b2e
mov ecx, dword [ebp - 0x14e8]
mov edx, dword [ebp - 0x14e4]
mov dword [ebp - 0x7ac], ecx
mov dword [ebp - 0x7a8], edx
xor edx, edx
inc edx
cmp ebx, edx
je 0xc41b96
lea eax, [ebx - 2]
xor ebx, ebx
cmp eax, edx
ja 0xc41b70
mov edx, ebx
mov dword [ebp - 0x14d4], ebx
mov dword [ebp - 0x1504], ebx
jmp 0xc41ba6
mov eax, dword [ebp - 0x14e8]
cdq
and edx, 3
lea ecx, [edx + eax]
sar ecx, 2
xor eax, eax
mov edx, eax
jmp 0xc41b2e
mov eax, dword [ebp - 0x1594]
mov edx, dword [ebp - 0x1594]
mov dword [ebp - 0x1504], eax
mov eax, dword [ebp - 0x1594]
mov dword [ebp - 0x14d4], eax
mov eax, dword [ebp - 0x1594]
jmp 0xc41ba8
push 0x20
pop esi
mov edx, 0x96
mov dword [ebp - 0x1504], esi
xor ebx, ebx
mov eax, ebx
mov dword [ebp - 0x14d0], edx
mov dword [ebp - 0x14e0], eax
push dword [ebp - 0xe7c]
mov esi, dword [0xc9303c]
sub ecx, edx
push dword [ebp - 0x14ec]
mov edi, dword [ebp - 0xe88]
sub ecx, eax
mov dword [ebp - 0x14d8], ecx
mov dword [ebp - 0xe54], ecx
mov dword [ebp - 0xe64], ecx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0x14e8], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0xe6c]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0x14ec]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc41c24
mov ebx, 0x80004005
mov eax, dword [ebp - 0x14e8]
test eax, eax
je 0xc41c40
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xc42147
push dword [ebp - 0xe78]
mov esi, dword [0xc9303c]
xor eax, eax
push dword [ebp - 0x14ec]
mov edi, dword [ebp - 0xe84]
mov ecx, esi
mov ebx, eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0x14e8], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0xe5c]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0x14ec]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc41ca6
mov ebx, 0x80004005
mov eax, dword [ebp - 0x14e8]
test eax, eax
je 0xc41cc2
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xc42147
mov eax, dword [ebp - 0x1510]
cmp eax, 2
je 0xc41cda
cmp eax, 3
jne 0xc41cf0
mov edi, dword [ebp - 0xe54]
cmp dword [ebp - 0xe64], edi
jle 0xc41cf6
mov edi, dword [ebp - 0xe64]
jmp 0xc41cf6
mov edi, dword [ebp - 0x14d8]
cmp dword [ebp - 0xe90], 0
mov esi, dword [0xc930a8]
mov ecx, esi
push dword [ebp - 0x14d4]
je 0xc41d37
mov ebx, dword [ebp - 0x14e0]
mov eax, ebx
sub eax, dword [ebp - 0xe64]
add eax, edi
push eax
lea eax, [ebp - 0xe6c]
push eax
call dword [0xc99200]
call esi
sub ebx, dword [ebp - 0xe54]
add ebx, edi
jmp 0xc41d4d
mov ebx, dword [ebp - 0x14d0]
lea eax, [ebp - 0xe6c]
push ebx
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xe60]
add eax, dword [ebp - 0x1504]
mov esi, dword [0xc930a8]
mov ecx, esi
push eax
push ebx
lea eax, [ebp - 0xe5c]
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1510]
cmp eax, 2
je 0xc42033
cmp eax, 3
je 0xc42033
cmp eax, 1
jne 0xc4204f
xor eax, eax
mov dword [ebp - 0xe70], 0xffffff
push 0x5c
push eax
lea eax, [ebp - 0xab8]
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0x14d0], eax
test eax, eax
jne 0xc41df8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc41ded
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc41e99
jmp 0xc41922
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0x14f8]
push 0xb
call dword [0xc99200]
call esi
push dword [ebp - 0x14dc]
neg eax
mov dword [ebp - 0xaa8], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0xa9c]
mov dword [ebp - 0xab8], eax
mov byte [ebp - 0xa9e], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0xab8]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc41e7a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc41e71
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc41e80
mov ebx, 0x80004005
jmp 0xc41e80
mov dword [ebp - 0xe74], eax
push dword [ebp - 0x14d0]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xc42147
push dword [ebp - 0xe74]
mov esi, dword [0xc9303c]
xor eax, eax
push dword [ebp - 0x14ec]
mov dword [ebp - 0xe44], edi
mov ecx, esi
mov edi, dword [ebp - 0xe80]
mov ebx, eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0x14d0], eax
xor eax, eax
push eax
push 0x460
lea eax, [ebp - 0xe4c]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0x14ec]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc41f05
mov ebx, 0x80004005
mov eax, dword [ebp - 0x14d0]
test eax, eax
je 0xc41f21
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xc42147
mov eax, dword [ebp - 0xe44]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0xe44], eax
cmp eax, ecx
jge 0xc41f45
mov dword [ebp - 0xe44], ecx
mov ebx, dword [ebp - 0x14f8]
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
pop edi
push edi
push ebx
push dword [ebp - 0xe4c]
mov dword [ebp - 0xe40], 0x20
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0xe48]
mov dword [ebp - 0xe4c], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0xe44]
mov dword [ebp - 0xe48], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0xe40]
mov dword [ebp - 0xe44], eax
call dword [0xc99200]
call esi
mov ecx, dword [ebp - 0xe50]
mov esi, dword [0xc930a8]
add ecx, 0x24
cmp dword [ebp - 0xe90], 0
mov dword [ebp - 0xe40], eax
je 0xc42011
mov eax, dword [ebp - 0xe6c]
cmp eax, dword [ebp - 0xe5c]
jl 0xc41ffc
mov eax, dword [ebp - 0xe5c]
push ecx
push eax
lea eax, [ebp - 0xe4c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
jmp 0xc4204f
mov eax, dword [ebp - 0xe64]
cmp eax, dword [ebp - 0xe54]
jg 0xc42025
mov eax, dword [ebp - 0xe54]
sub eax, dword [ebp - 0xe44]
add eax, dword [ebp - 0xe4c]
jmp 0xc41ffc
mov eax, dword [ebp - 0xe50]
mov dword [ebp - 0x7ac], edi
mov dword [ebp - 0x7a8], eax
mov dword [ebp - 0xe70], 0xffa8a8a8
mov eax, dword [ebp - 0xe90]
mov ebx, dword [ebp - 0x7ac]
mov dword [ebp - 0x14d0], eax
mov eax, dword [ebp - 0x7a8]
mov dword [ebp - 0x14e0], eax
mov eax, dword [ebp - 0x1510]
sub eax, 1
je 0xc423e0
sub eax, 1
je 0xc4230c
sub eax, 1
jne 0xc42145
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x87c]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push 1
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x87c]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x87c], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xc42145
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x868]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x860]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x860]
lea esi, [ebp - 0x868]
sub eax, ebx
lea edi, [ebp - 0x1aac]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebp - 0x85c]
sub eax, dword [ebp - 0x14e0]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
mov dword [ebp - 0x7b0], eax
xor ebx, ebx
push dword [ebp - 0x14ec]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov edi, 0xc96238
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc42165
mov eax, dword [0xc95890]
test eax, eax
jle 0xc421c8
sub eax, 1
mov dword [0xc95890], eax
jne 0xc421c8
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc4219a
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc42189
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
mov eax, dword [ebp - 0x14f4]
test eax, eax
je 0xc421e7
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc4393d
mov edi, dword [ebp - 0x7b4]
xor eax, eax
mov ebx, dword [ebp - 0x7b0]
push 0x54
push eax
lea eax, [ebp - 0x10dc]
mov dword [ebp - 0x1934], edi
push eax
mov dword [ebp - 0x1930], ebx
call fcn.00ab4bf6
mov esi, dword [0xc93028]
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x14d0], 1
push 7
push dword [ebp - 0x1528]
call dword [0xc99200]
call esi
test eax, eax
je 0xc42286
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x10dc]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc42286
push 0x20
pop eax
cmp word [ebp - 0x10ca], ax
jne 0xc42286
cmp dword [ebp - 0x10c8], 0
je 0xc42286
cmp dword [ebp - 0x10d8], 0
jle 0xc42286
cmp dword [ebp - 0x10d4], 0
jg 0xc4229b
xor eax, eax
cmp dword [ebp - 0x1510], 1
mov dword [ebp - 0x14d0], eax
jne 0xc423f3
mov esi, dword [0xc930a8]
lea eax, [ebp - 0xe6c]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc930a8]
lea eax, [ebp - 0xe5c]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov ebx, dword [ebp - 0x1510]
cmp ebx, 1
jne 0xc423f9
mov eax, dword [ebp - 0xe8c]
mov esi, dword [0xc93014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0x1524], eax
jmp 0xc423f9
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x854]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push 1
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x854]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x854], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xc42145
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x840]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x838]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
cmp dword [ebp - 0x14d0], 0
lea esi, [ebp - 0x840]
lea edi, [ebp - 0x1aac]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xc423b8
imul eax, dword [ebp - 0x838], 5
cdq
idiv ecx
add eax, dword [ebp - 0x840]
jmp 0xc423c6
mov eax, dword [ebp - 0x838]
sub eax, ebx
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebp - 0x834]
sub eax, dword [ebp - 0x14e0]
imul eax, eax, 0x5f
jmp 0xc4213c
xor ebx, ebx
mov dword [ebp - 0x7b4], ebx
mov dword [ebp - 0x7b0], ebx
jmp 0xc42147
mov ebx, dword [ebp - 0x1510]
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push dword [ebp - 0x1528]
call dword [0xc99200]
call esi
cmp dword [ebp - 0xe90], 0
mov dword [ebp - 0x14e0], eax
mov dword [ebp - 0x14f4], 0x810
je 0xc42434
mov dword [ebp - 0x14f4], 0x20812
cmp dword [ebp - 0x14d0], 0
je 0xc42f45
mov eax, dword [ebp - 0xe8c]
mov ebx, dword [ebp - 0xe88]
mov dword [ebp - 0x14d0], eax
mov eax, dword [ebp - 0xe7c]
mov dword [ebp - 0x1504], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x1088]
mov dword [ebp - 0x14d4], ebx
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x1034]
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0x14dc], eax
mov dword [ebp - 0x14d8], eax
mov dword [ebp - 0x14ec], eax
mov dword [ebp - 0x14f8], eax
lea eax, [ebp - 0x954]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x7c4]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xc4391d
mov esi, dword [0xc93028]
mov ecx, esi
mov ebx, dword [ebp - 0x1528]
push 7
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xc42fda
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x1088]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc4252a
mov eax, dword [ebp - 0x1074]
mov dword [ebp - 0x14dc], eax
mov eax, dword [ebp - 0x1084]
mov dword [ebp - 0x14ec], eax
mov eax, dword [ebp - 0x1080]
mov dword [ebp - 0x14f8], eax
mov esi, dword [0xc93008]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov ebx, eax
mov dword [ebp - 0x14e8], ebx
test ebx, ebx
je 0xc42fda
mov eax, dword [ebp - 0xe64]
xor ecx, ecx
sub eax, dword [ebp - 0xe6c]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0xe68]
sub eax, dword [ebp - 0xe60]
mov dword [ebp - 0x94c], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x172c], ecx
mov word [ebp - 0x948], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x946], ax
lea eax, [ebp - 0x172c]
push eax
push ecx
lea eax, [ebp - 0x954]
mov dword [ebp - 0x14e4], ecx
push eax
mov dword [ebp - 0x944], ecx
mov dword [ebp - 0x940], ecx
mov dword [ebp - 0x93c], ecx
mov dword [ebp - 0x938], ecx
mov dword [ebp - 0x934], ecx
mov dword [ebp - 0x930], ecx
mov dword [ebp - 0x92c], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x954], 0x28
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0x1514], edi
test edi, edi
jne 0xc42628
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x14e4], eax
test eax, eax
jle 0xc42613
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x14e4], eax
test eax, eax
js 0xc429a2
mov dword [ebp - 0x14e4], 0x80004005
jmp 0xc429a2
mov esi, dword [0xc93034]
lea eax, [ebp - 0x1034]
push eax
push 0x54
push edi
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc42652
mov eax, dword [ebp - 0x1020]
mov dword [ebp - 0x14d8], eax
mov eax, dword [ebp - 0xe64]
sub eax, dword [ebp - 0xe6c]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x7bc], eax
mov eax, dword [ebp - 0xe60]
sub eax, dword [ebp - 0xe68]
push edi
push ebx
mov dword [ebp - 0x7b8], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push ebx
call dword [0xc99200]
call esi
push dword [ebp - 0x1504]
mov esi, dword [0xc9303c]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0x1504], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x7c4]
mov ecx, edi
push eax
push ebx
call dword [0xc99200]
call edi
mov esi, dword [0xc9306c]
xor eax, eax
push eax
push dword [ebp - 0x14f4]
lea eax, [ebp - 0x7c4]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0x14d4]
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1510], 1
jne 0xc42745
cmp dword [ebp - 0x14d0], 0
je 0xc42739
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0x14d0], eax
jmp 0xc4274f
mov dword [ebp - 0x14d0], 0xffffff
jmp 0xc4274f
mov dword [ebp - 0x14d0], 0xffa8a8a8
mov ecx, dword [ebp - 0xe6c]
xor eax, eax
mov edx, dword [ebp - 0xe68]
mov edi, eax
mov dword [ebp - 0x14d4], ecx
test ecx, ecx
jns 0xc42777
mov edi, ecx
neg edi
xor ecx, ecx
mov dword [ebp - 0x14d4], ecx
jmp 0xc42779
xor ecx, ecx
test edx, edx
jns 0xc42783
mov eax, edx
mov edx, ecx
neg eax
mov esi, dword [ebp - 0x7bc]
mov ecx, dword [ebp - 0x14ec]
sub esi, edi
sub ecx, dword [ebp - 0x14d4]
mov dword [ebp - 0x14fc], esi
cmp esi, ecx
jl 0xc427a9
mov esi, ecx
mov dword [ebp - 0x14fc], ecx
mov ecx, dword [ebp - 0x7b8]
sub dword [ebp - 0x14f8], edx
sub ecx, eax
mov dword [ebp - 0x14f0], ecx
cmp ecx, dword [ebp - 0x14f8]
jl 0xc427d1
mov ecx, dword [ebp - 0x14f8]
mov dword [ebp - 0x14f0], ecx
test esi, esi
jle 0xc42970
test ecx, ecx
jle 0xc42970
imul eax, dword [ebp - 0x7bc]
mov ecx, dword [ebp - 0x14d8]
add eax, edi
lea ecx, [ecx + eax*4]
mov eax, dword [ebp - 0x14ec]
imul eax, edx
mov edx, dword [ebp - 0x14dc]
mov dword [ebp - 0x14d8], ecx
add eax, dword [ebp - 0x14d4]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0x7bc]
shl edx, 2
mov dword [ebp - 0x14dc], edx
mov edx, dword [ebp - 0x14ec]
shl edx, 2
mov dword [ebp - 0x14d4], eax
mov dword [ebp - 0x14ec], edx
mov ebx, eax
mov dword [ebp - 0x150c], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0x14f8], edx
lea edi, [ecx + 2]
mov dword [ebp - 0x1508], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc42917
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x14d0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x1508]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x14f8]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x14d0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x14f8]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x14ce]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x14f8]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x150c]
cdq
idiv ecx
mov edx, dword [ebp - 0x14f8]
add al, bl
mov ebx, dword [ebp - 0x1508]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x14f8], edx
mov dword [ebp - 0x150c], esi
jne 0xc42851
mov ecx, dword [ebp - 0x14d8]
mov eax, dword [ebp - 0x14d4]
add ecx, dword [ebp - 0x14dc]
add eax, dword [ebp - 0x14ec]
sub dword [ebp - 0x14f0], 1
mov esi, dword [ebp - 0x14fc]
mov dword [ebp - 0x14d8], ecx
mov dword [ebp - 0x14d4], eax
jne 0xc42835
mov ebx, dword [ebp - 0x14e8]
push dword [ebp - 0x1514]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1504]
test eax, eax
je 0xc429a2
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0x14e4], 0
jl 0xc4391d
mov eax, dword [ebp - 0xe8c]
mov ebx, dword [ebp - 0xe84]
mov dword [ebp - 0x14d0], eax
mov eax, dword [ebp - 0xe78]
mov dword [ebp - 0x1504], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xfe0]
mov dword [ebp - 0x14d4], ebx
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x122c]
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0x14dc], eax
mov dword [ebp - 0x14d8], eax
mov dword [ebp - 0x14ec], eax
mov dword [ebp - 0x14f8], eax
lea eax, [ebp - 0x928]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x734]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xc4391d
mov esi, dword [0xc93028]
mov ecx, esi
mov ebx, dword [ebp - 0x1528]
push 7
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xc42fda
mov esi, dword [0xc93034]
lea ecx, [ebp - 0xfe0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc42aa9
mov eax, dword [ebp - 0xfcc]
mov dword [ebp - 0x14dc], eax
mov eax, dword [ebp - 0xfdc]
mov dword [ebp - 0x14ec], eax
mov eax, dword [ebp - 0xfd8]
mov dword [ebp - 0x14f8], eax
mov esi, dword [0xc93008]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov ebx, eax
mov dword [ebp - 0x14e8], ebx
test ebx, ebx
je 0xc42fda
mov eax, dword [ebp - 0xe54]
xor ecx, ecx
sub eax, dword [ebp - 0xe5c]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x924], eax
mov eax, dword [ebp - 0xe58]
sub eax, dword [ebp - 0xe50]
mov dword [ebp - 0x920], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x1730], ecx
mov word [ebp - 0x91c], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x91a], ax
lea eax, [ebp - 0x1730]
push eax
push ecx
lea eax, [ebp - 0x928]
mov dword [ebp - 0x14e4], ecx
push eax
mov dword [ebp - 0x918], ecx
mov dword [ebp - 0x914], ecx
mov dword [ebp - 0x910], ecx
mov dword [ebp - 0x90c], ecx
mov dword [ebp - 0x908], ecx
mov dword [ebp - 0x904], ecx
mov dword [ebp - 0x900], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x928], 0x28
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0x1514], edi
test edi, edi
jne 0xc42ba7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x14e4], eax
test eax, eax
jle 0xc42b92
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x14e4], eax
test eax, eax
js 0xc42f1c
mov dword [ebp - 0x14e4], 0x80004005
jmp 0xc42f1c
mov esi, dword [0xc93034]
lea eax, [ebp - 0x122c]
push eax
push 0x54
push edi
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc42bd1
mov eax, dword [ebp - 0x1218]
mov dword [ebp - 0x14d8], eax
mov eax, dword [ebp - 0xe54]
sub eax, dword [ebp - 0xe5c]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x72c], eax
mov eax, dword [ebp - 0xe50]
sub eax, dword [ebp - 0xe58]
push edi
push ebx
mov dword [ebp - 0x728], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push ebx
call dword [0xc99200]
call esi
push dword [ebp - 0x1504]
mov esi, dword [0xc9303c]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0x1504], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x734]
mov ecx, edi
push eax
push ebx
call dword [0xc99200]
call edi
mov esi, dword [0xc9306c]
xor eax, eax
push eax
push dword [ebp - 0x14f4]
lea eax, [ebp - 0x734]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0x14d4]
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1510], 1
jne 0xc42cbe
cmp dword [ebp - 0x14d0], 0
je 0xc42cb2
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
jmp 0xc42cc3
mov dword [ebp - 0x1510], 0xffffff
jmp 0xc42ccf
mov eax, 0xffa8a8a8
mov dword [ebp - 0x1510], eax
mov dword [ebp - 0x1548], eax
mov edx, dword [ebp - 0xe5c]
xor ecx, ecx
mov eax, dword [ebp - 0xe58]
mov edi, ecx
mov dword [ebp - 0x14d0], edx
test edx, edx
jns 0xc42cf7
mov edi, edx
neg edi
xor edx, edx
mov dword [ebp - 0x14d0], edx
jmp 0xc42cf9
xor edx, edx
test eax, eax
jns 0xc42d03
mov ecx, eax
mov eax, edx
neg ecx
mov esi, dword [ebp - 0x72c]
mov edx, dword [ebp - 0x14ec]
sub esi, edi
sub edx, dword [ebp - 0x14d0]
mov dword [ebp - 0x14f4], esi
cmp esi, edx
jl 0xc42d29
mov esi, edx
mov dword [ebp - 0x14f4], edx
mov edx, dword [ebp - 0x728]
sub dword [ebp - 0x14f8], eax
sub edx, ecx
mov dword [ebp - 0x14d4], edx
cmp edx, dword [ebp - 0x14f8]
jl 0xc42d51
mov edx, dword [ebp - 0x14f8]
mov dword [ebp - 0x14d4], edx
test esi, esi
jle 0xc42eea
test edx, edx
jle 0xc42eea
mov edx, dword [ebp - 0x72c]
imul eax, dword [ebp - 0x14ec]
imul ecx, edx
shl edx, 2
add eax, dword [ebp - 0x14d0]
add ecx, edi
mov edi, dword [ebp - 0x14d8]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0x14dc]
mov dword [ebp - 0x14dc], edx
mov edx, dword [ebp - 0x14ec]
shl edx, 2
lea eax, [edi + eax*4]
mov dword [ebp - 0x14d8], ecx
mov dword [ebp - 0x14d0], eax
mov dword [ebp - 0x14ec], edx
mov ebx, eax
mov dword [ebp - 0x14f0], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0x14f8], edx
lea edi, [ecx + 2]
mov dword [ebp - 0x14fc], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc42e91
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x1548]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x14fc]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x14f8]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x1548]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x14f8]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x150e]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x14f8]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x14f0]
cdq
idiv ecx
mov edx, dword [ebp - 0x14f8]
add al, bl
mov ebx, dword [ebp - 0x14fc]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x14f8], edx
mov dword [ebp - 0x14f0], esi
jne 0xc42dcb
mov ecx, dword [ebp - 0x14d8]
mov eax, dword [ebp - 0x14d0]
add ecx, dword [ebp - 0x14dc]
add eax, dword [ebp - 0x14ec]
sub dword [ebp - 0x14d4], 1
mov esi, dword [ebp - 0x14f4]
mov dword [ebp - 0x14d8], ecx
mov dword [ebp - 0x14d0], eax
jne 0xc42daf
mov ebx, dword [ebp - 0x14e8]
push dword [ebp - 0x1514]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1504]
test eax, eax
je 0xc42f1c
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0x14e4], 0
jl 0xc4391d
mov edi, dword [ebp - 0x1518]
jmp 0xc44450
cmp dword [ebp - 0xe8c], 0
jne 0xc42f57
cmp ebx, 1
je 0xc42f57
mov al, 0xc0
jmp 0xc42f59
or al, 0xff
mov esi, dword [0xc93008]
xor ecx, ecx
push dword [ebp - 0x1528]
mov edi, ecx
mov byte [ebp - 0x14ce], al
mov eax, ecx
mov byte [ebp - 0x14d0], cl
mov byte [ebp - 0x14cf], cl
mov dword [ebp - 0x1ae4], ecx
mov dword [ebp - 0x1ae0], ecx
mov dword [ebp - 0x14dc], ecx
mov dword [ebp - 0x1ac8], ecx
mov dword [ebp - 0x1ac4], ecx
mov dword [ebp - 0x1ac0], ecx
mov ecx, esi
mov byte [ebp - 0x14cd], 1
mov dword [ebp - 0x1504], eax
mov dword [ebp - 0x1aec], eax
mov dword [ebp - 0x14d4], edi
mov dword [ebp - 0x1ae8], edi
mov dword [ebp - 0x1acc], eax
call dword [0xc99200]
call esi
mov dword [ebp - 0x1518], eax
test eax, eax
jne 0xc42fe5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc4391d
cmp ebx, 1
jne 0xc430e5
mov eax, dword [ebp - 0xe64]
mov ecx, dword [ebp - 0xe54]
sub ecx, dword [ebp - 0xe5c]
sub eax, dword [ebp - 0xe6c]
mov dword [ebp - 0x14d8], ecx
cmp ecx, eax
jg 0xc43018
mov ecx, eax
mov dword [ebp - 0x14d8], eax
mov edx, dword [ebp - 0xe50]
xor eax, eax
sub edx, dword [ebp - 0xe68]
mov ebx, eax
mov dword [ebp - 0x14ec], edx
cmp dword [ebp - 0xe90], eax
je 0xc4306c
mov edi, dword [ebp - 0xe6c]
sub edi, dword [ebp - 0xe64]
mov eax, dword [ebp - 0xe5c]
add edi, ecx
sub eax, dword [ebp - 0xe54]
mov ebx, edi
add eax, ecx
mov dword [ebp - 0x1504], edi
mov dword [ebp - 0x1aec], edi
mov dword [ebp - 0x14dc], eax
mov dword [ebp - 0x1acc], eax
sub eax, dword [ebp - 0xe5c]
add eax, dword [ebp - 0xe54]
mov edi, dword [ebp - 0xe60]
sub edi, dword [ebp - 0xe68]
sub ebx, dword [ebp - 0xe6c]
add ebx, dword [ebp - 0xe64]
mov dword [ebp - 0x14e8], eax
mov dword [ebp - 0x1ac4], eax
mov eax, dword [ebp - 0xe58]
sub eax, dword [ebp - 0xe68]
mov dword [ebp - 0x14f8], edi
mov dword [ebp - 0x1ae0], edi
mov edi, eax
sub edi, dword [ebp - 0xe58]
add edi, dword [ebp - 0xe50]
mov dword [ebp - 0x1ae4], ebx
mov dword [ebp - 0x14e4], eax
mov dword [ebp - 0x1ac8], eax
mov dword [ebp - 0x1514], edi
mov dword [ebp - 0x1ac0], edi
jmp 0xc43177
lea esi, [ebp - 0xe6c]
mov ecx, dword [ebp - 0x7ac]
lea edi, [ebp - 0x1aec]
mov edx, dword [ebp - 0x7a8]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14d8], ecx
mov dword [ebp - 0x14ec], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1ae0]
lea esi, [ebp - 0xe5c]
mov ebx, dword [ebp - 0x1ae4]
lea edi, [ebp - 0x1acc]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14f8], eax
mov eax, dword [ebp - 0x1ae8]
mov dword [ebp - 0x14d4], eax
mov eax, dword [ebp - 0x1aec]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1504], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1ac0]
mov dword [ebp - 0x1514], eax
mov eax, dword [ebp - 0x1ac4]
mov dword [ebp - 0x14e8], eax
mov eax, dword [ebp - 0x1ac8]
mov dword [ebp - 0x14e4], eax
mov eax, dword [ebp - 0x1acc]
mov dword [ebp - 0x14dc], eax
mov esi, dword [0xc9300c]
xor eax, eax
mov edi, dword [ebp - 0x1518]
neg edx
push 0x20
mov dword [ebp - 0x1734], eax
mov dword [ebp - 0x970], eax
mov dword [ebp - 0x96c], eax
mov dword [ebp - 0x968], eax
mov dword [ebp - 0x964], eax
mov dword [ebp - 0x960], eax
mov dword [ebp - 0x95c], eax
mov dword [ebp - 0x958], eax
inc eax
mov word [ebp - 0x974], ax
pop eax
mov dword [ebp - 0x97c], ecx
xor ecx, ecx
push ecx
push ecx
mov word [ebp - 0x972], ax
lea eax, [ebp - 0x1734]
push eax
push ecx
lea eax, [ebp - 0x980]
mov dword [ebp - 0x980], 0x28
push eax
push edi
mov ecx, esi
mov dword [ebp - 0x978], edx
call dword [0xc99200]
call esi
mov dword [ebp - 0x1530], eax
test eax, eax
jne 0xc43212
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc43908
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1510], 1
jne 0xc43276
mov ecx, dword [ebp - 0x1524]
test ecx, ecx
je 0xc43276
mov esi, dword [0xc93074]
xor eax, eax
mov dword [ebp - 0x724], eax
mov dword [ebp - 0x720], eax
mov eax, dword [ebp - 0x14d8]
mov dword [ebp - 0x71c], eax
mov eax, dword [ebp - 0x14ec]
push ecx
mov dword [ebp - 0x718], eax
mov ecx, esi
lea eax, [ebp - 0x724]
push eax
push edi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xe8c]
mov esi, dword [ebp - 0xe88]
mov dword [ebp - 0x14fc], eax
mov eax, dword [ebp - 0xe7c]
mov dword [ebp - 0x14f0], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x14cc]
mov dword [ebp - 0x1508], esi
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xf8c]
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0x150c], eax
mov dword [ebp - 0x151c], eax
mov dword [ebp - 0x1520], eax
mov dword [ebp - 0x152c], eax
lea eax, [ebp - 0x8fc]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x714]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x1518]
test esi, esi
je 0xc438ed
mov esi, dword [0xc93028]
mov ecx, esi
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc43324
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc438ed
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x14cc]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc43366
mov eax, dword [ebp - 0x14b8]
mov dword [ebp - 0x150c], eax
mov eax, dword [ebp - 0x14c8]
mov dword [ebp - 0x1520], eax
mov eax, dword [ebp - 0x14c4]
mov dword [ebp - 0x152c], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x153c], ecx
test ecx, ecx
je 0xc43319
mov eax, dword [ebp - 0x14d4]
xor edx, edx
mov edi, dword [ebp - 0x14f8]
sub eax, edi
sub ebx, dword [ebp - 0x1504]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x8f4], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x1738], edx
mov word [ebp - 0x8f0], ax
pop eax
push edx
push edx
mov word [ebp - 0x8ee], ax
lea eax, [ebp - 0x1738]
push eax
push edx
lea eax, [ebp - 0x8fc]
mov dword [ebp - 0x1550], edx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x8ec], edx
mov dword [ebp - 0x8e8], edx
mov dword [ebp - 0x8e4], edx
mov dword [ebp - 0x8e0], edx
mov dword [ebp - 0x8dc], edx
mov dword [ebp - 0x8d8], edx
mov dword [ebp - 0x8d4], edx
mov dword [ebp - 0x8fc], 0x28
mov dword [ebp - 0x8f8], ebx
call dword [0xc99200]
call esi
mov dword [ebp - 0x14f8], eax
test eax, eax
jne 0xc43460
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x1550], eax
test eax, eax
jle 0xc43445
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1550], eax
test eax, eax
mov edi, dword [ebp - 0x153c]
js 0xc437b9
mov dword [ebp - 0x1550], 0x80004005
jmp 0xc437b9
mov esi, dword [0xc93034]
lea ecx, [ebp - 0xf8c]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc4348a
mov eax, dword [ebp - 0xf78]
mov dword [ebp - 0x151c], eax
push dword [ebp - 0x14f8]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x70c], ebx
mov ebx, dword [ebp - 0x14d4]
sub edi, ebx
mov dword [ebp - 0x708], edi
mov edi, dword [ebp - 0x153c]
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0x14f0]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0x14d4], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
mov esi, dword [ebp - 0x153c]
mov ecx, edi
push eax
lea eax, [ebp - 0x714]
push eax
push esi
call dword [0xc99200]
call edi
xor eax, eax
push eax
push dword [ebp - 0x14f4]
lea eax, [ebp - 0x714]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x1508]
push esi
mov esi, dword [0xc9306c]
mov ecx, esi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1510], 1
jne 0xc4357e
cmp dword [ebp - 0x14fc], 0
je 0xc43572
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0x14fc], eax
jmp 0xc43588
mov dword [ebp - 0x14fc], 0xffffff
jmp 0xc43588
mov dword [ebp - 0x14fc], 0xffa8a8a8
mov ecx, dword [ebp - 0x1504]
xor edx, edx
mov edi, edx
mov eax, edx
test ecx, ecx
jns 0xc4359e
mov edi, ecx
mov ecx, edx
neg edi
test ebx, ebx
jns 0xc435a8
mov eax, ebx
mov ebx, edx
neg eax
mov esi, dword [ebp - 0x70c]
mov edx, dword [ebp - 0x1520]
sub esi, edi
sub edx, ecx
mov dword [ebp - 0x1504], esi
cmp esi, edx
jl 0xc435ca
mov esi, edx
mov dword [ebp - 0x1504], edx
mov edx, dword [ebp - 0x708]
sub dword [ebp - 0x152c], ebx
sub edx, eax
mov dword [ebp - 0x14f0], edx
cmp edx, dword [ebp - 0x152c]
jl 0xc435f2
mov edx, dword [ebp - 0x152c]
mov dword [ebp - 0x14f0], edx
test esi, esi
jle 0xc43781
test edx, edx
jle 0xc43781
mov edx, dword [ebp - 0x70c]
imul ebx, dword [ebp - 0x1520]
imul eax, edx
shl edx, 2
add ebx, ecx
mov ecx, dword [ebp - 0x150c]
add eax, edi
mov edi, dword [ebp - 0x151c]
mov dword [ebp - 0x151c], edx
mov edx, dword [ebp - 0x1520]
lea ecx, [ecx + ebx*4]
shl edx, 2
lea eax, [edi + eax*4]
mov dword [ebp - 0x150c], ecx
mov dword [ebp - 0x1508], eax
mov dword [ebp - 0x1520], edx
mov ebx, ecx
mov dword [ebp - 0x1560], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [ebp - 0x152c], edx
lea edi, [eax + 2]
mov dword [ebp - 0x155c], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc4372e
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x14fc]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x155c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x152c]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x14fc]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x152c]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x14fa]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x152c]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x1560]
cdq
idiv ecx
mov edx, dword [ebp - 0x152c]
add al, bl
mov ebx, dword [ebp - 0x155c]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x152c], edx
mov dword [ebp - 0x1560], esi
jne 0xc43668
mov eax, dword [ebp - 0x1508]
mov ecx, dword [ebp - 0x150c]
add eax, dword [ebp - 0x151c]
add ecx, dword [ebp - 0x1520]
sub dword [ebp - 0x14f0], 1
mov esi, dword [ebp - 0x1504]
mov dword [ebp - 0x1508], eax
mov dword [ebp - 0x150c], ecx
jne 0xc4364c
push dword [ebp - 0x14f8]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x14d4]
mov edi, dword [ebp - 0x153c]
test eax, eax
je 0xc437b9
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1550], 0
jl 0xc438e7
mov eax, dword [ebp - 0xe8c]
mov ebx, dword [ebp - 0xe84]
mov dword [ebp - 0x1504], eax
mov eax, dword [ebp - 0xe78]
mov dword [ebp - 0x14d4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xf38]
mov dword [ebp - 0x14f8], ebx
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xee4]
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0x14fc], eax
mov dword [ebp - 0x14f0], eax
mov dword [ebp - 0x1508], eax
mov dword [ebp - 0x150c], eax
lea eax, [ebp - 0x8d0]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x794]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x1518]
test ebx, ebx
je 0xc438ed
mov esi, dword [0xc93028]
mov ecx, esi
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xc43319
mov esi, dword [0xc93034]
lea ecx, [ebp - 0xf38]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc438c0
mov eax, dword [ebp - 0xf24]
mov dword [ebp - 0x14fc], eax
mov eax, dword [ebp - 0xf34]
mov dword [ebp - 0x1508], eax
mov eax, dword [ebp - 0xf30]
mov dword [ebp - 0x150c], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0x151c], edi
test edi, edi
jne 0xc43f5a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, dword [ebp - 0x1518]
mov eax, dword [ebp - 0x1530]
test eax, eax
je 0xc43908
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
test edi, edi
je 0xc4391d
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1524]
test eax, eax
je 0xc43938
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov edi, 0xc96238
mov ecx, dword [ebp - 0xe88]
xor ebx, ebx
test ecx, ecx
je 0xc4398e
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc4394c
mov eax, dword [ebp - 0xe88]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc43974
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xc4396c
push dword [ebp - 0xe88]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xe88], ebx
mov ecx, dword [ebp - 0xe84]
test ecx, ecx
je 0xc439dd
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc4399b
mov eax, dword [ebp - 0xe84]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc439c3
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xc439bb
push dword [ebp - 0xe84]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xe84], ebx
mov edx, dword [ebp - 0xe80]
test edx, edx
je 0xc43a29
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc439ec
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc43a14
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xc43a06
mov edx, dword [ebp - 0xe80]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xe80], ebx
cmp dword [ebp - 0xe7c], 0
je 0xc43a4e
push dword [ebp - 0xe7c]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0xe7c], ebx
cmp dword [ebp - 0xe78], 0
je 0xc43a73
push dword [ebp - 0xe78]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0xe78], ebx
cmp dword [ebp - 0xe74], 0
je 0xc43a98
push dword [ebp - 0xe74]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0xe74], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc43a9a
mov eax, dword [0xc95890]
test eax, eax
jle 0xc43afd
sub eax, 1
mov dword [0xc95890], eax
jne 0xc43afd
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc43acf
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc43abe
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0xc95878]
mov esi, dword [0xc9304c]
mov ecx, esi
mov dword [ebp - 0x1510], eax
call dword [0xc99200]
call esi
sub eax, dword [0xc95870]
lea edi, [ebp - 0x5e8]
push 7
mov dword [ebp - 0x1518], eax
mov edx, 0xc96238
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc43b3a
mov eax, dword [0xc95890]
test eax, eax
jne 0xc4465b
xor ebx, ebx
push 0x338
mov esi, ebx
mov dword [ebp - 0x14d0], ebx
push ebx
mov dword [ebp - 0x1530], ebx
mov dword [ebp - 0x1524], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x15d4], eax
test eax, eax
je 0xc4464f
or dword [ebp - 0x1564], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0x1540], ebx
mov dword [ebp - 0x1590], ebx
mov edx, ebx
mov dword [ebp - 0x15a4], eax
mov esi, dword [ebp - 0x16cc]
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [ebp - 0x1608], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [ebp - 0x16cc], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [ebp - 0x1590]
xor esi, edx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x1608]
xor eax, edx
mov dword [ebp - 0x1608], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x1608]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x1608]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x1608], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x1608]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x1608]
xor edx, eax
mov dword [ebp - 0x1608], edx
mov eax, dword [ebp - 0x1608]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x1608]
xor eax, edx
mov dword [ebp - 0x1608], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x1608]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x1608]
xor eax, edx
mov dword [ebp - 0x1608], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x1608]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0x1608]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0x1608], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0x1608]
xor eax, 0xab69605e
mov dword [ebp - 0x1590], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1590]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x1590]
xor eax, edx
mov dword [ebp - 0x1590], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x1590], edx
mov edx, dword [ebp - 0x1590]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x1590], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1590]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x1590]
xor eax, edx
mov dword [ebp - 0x1590], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1590]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x1590]
xor eax, edx
mov dword [ebp - 0x1590], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1590]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x1590]
xor edx, dword [ebp - 0x1540]
xor eax, dword [ebp - 0x1564]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x1608], esi
mov esi, dword [ebp - 0x15a4]
mov dword [ebp - 0x1540], ebx
mov dword [ebp - 0x1564], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x16d0], 1
mov dword [ebp - 0x1590], eax
mov dword [ebp - 0x15a4], esi
jne 0xc43bab
mov esi, dword [ebp - 0x15d4]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc43f20
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc44471
cmp edx, dword [0x9fc02c]
jne 0xc44471
mov edi, esi
xor eax, eax
mov dword [ebp - 0x1524], edi
mov esi, eax
mov ebx, eax
jmp 0xc44485
mov eax, dword [ebp - 0x14e8]
xor ecx, ecx
sub eax, dword [ebp - 0x14dc]
mov ebx, dword [ebp - 0x14e4]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x14e8], eax
mov dword [ebp - 0x8cc], eax
mov eax, ebx
sub eax, dword [ebp - 0x1514]
mov dword [ebp - 0x8c8], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x173c], ecx
mov word [ebp - 0x8c4], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x8c2], ax
lea eax, [ebp - 0x173c]
push eax
push ecx
lea eax, [ebp - 0x8d0]
mov dword [ebp - 0x1520], ecx
push eax
mov dword [ebp - 0x8c0], ecx
mov dword [ebp - 0x8bc], ecx
mov dword [ebp - 0x8b8], ecx
mov dword [ebp - 0x8b4], ecx
mov dword [ebp - 0x8b0], ecx
mov dword [ebp - 0x8ac], ecx
mov dword [ebp - 0x8a8], ecx
mov ecx, esi
push edi
mov dword [ebp - 0x8d0], 0x28
call dword [0xc99200]
call esi
mov dword [ebp - 0x14e4], eax
test eax, eax
jne 0xc4403d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x1520], eax
test eax, eax
jle 0xc44028
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1520], eax
test eax, eax
js 0xc443ac
mov dword [ebp - 0x1520], 0x80004005
jmp 0xc443ac
mov esi, dword [0xc93034]
lea ecx, [ebp - 0xee4]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc44067
mov eax, dword [ebp - 0xed0]
mov dword [ebp - 0x14f0], eax
mov eax, dword [ebp - 0x14e8]
push dword [ebp - 0x14e4]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x78c], eax
mov eax, dword [ebp - 0x1514]
sub eax, ebx
push edi
mov dword [ebp - 0x788], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0x14d4]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0x14d4], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x794]
mov ecx, edi
push eax
push dword [ebp - 0x151c]
call dword [0xc99200]
call edi
mov edi, dword [ebp - 0x151c]
xor eax, eax
mov esi, dword [0xc9306c]
mov ecx, esi
push eax
push dword [ebp - 0x14f4]
lea eax, [ebp - 0x794]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x14f8]
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1510], 1
jne 0xc4415a
cmp dword [ebp - 0x1504], 0
je 0xc4414e
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
jmp 0xc4415f
mov dword [ebp - 0x14f4], 0xffffff
jmp 0xc4416b
mov eax, 0xffa8a8a8
mov dword [ebp - 0x14f4], eax
mov dword [ebp - 0x1548], eax
mov ecx, dword [ebp - 0x14dc]
xor eax, eax
mov edx, eax
test ecx, ecx
jns 0xc44187
mov edx, ecx
neg edx
xor ecx, ecx
mov dword [ebp - 0x14dc], ecx
jmp 0xc44189
xor ecx, ecx
test ebx, ebx
jns 0xc44193
mov eax, ebx
mov ebx, ecx
neg eax
mov esi, dword [ebp - 0x78c]
mov ecx, dword [ebp - 0x1508]
sub esi, edx
sub ecx, dword [ebp - 0x14dc]
mov dword [ebp - 0x1504], esi
cmp esi, ecx
jl 0xc441b9
mov esi, ecx
mov dword [ebp - 0x1504], ecx
mov ecx, dword [ebp - 0x788]
sub dword [ebp - 0x150c], ebx
sub ecx, eax
mov dword [ebp - 0x14f8], ecx
cmp ecx, dword [ebp - 0x150c]
jl 0xc441e1
mov ecx, dword [ebp - 0x150c]
mov dword [ebp - 0x14f8], ecx
test esi, esi
jle 0xc4437a
test ecx, ecx
jle 0xc4437a
imul eax, dword [ebp - 0x78c]
mov ecx, dword [ebp - 0x14f0]
add eax, edx
mov edx, dword [ebp - 0x1508]
imul ebx, edx
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x14fc]
mov dword [ebp - 0x14e8], eax
add ebx, dword [ebp - 0x14dc]
lea ecx, [ecx + ebx*4]
mov ebx, dword [ebp - 0x78c]
shl ebx, 2
shl edx, 2
mov dword [ebp - 0x14dc], ecx
mov dword [ebp - 0x1514], ebx
mov dword [ebp - 0x14fc], edx
mov ebx, ecx
mov dword [ebp - 0x150c], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [ebp - 0x14f0], edx
lea edi, [eax + 2]
mov dword [ebp - 0x1508], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc44321
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x1548]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x1508]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x14f0]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x1548]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x14f0]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x14f2]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x14f0]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x150c]
cdq
idiv ecx
mov edx, dword [ebp - 0x14f0]
add al, bl
mov ebx, dword [ebp - 0x1508]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x14f0], edx
mov dword [ebp - 0x150c], esi
jne 0xc4425b
mov eax, dword [ebp - 0x14e8]
mov ecx, dword [ebp - 0x14dc]
add eax, dword [ebp - 0x1514]
add ecx, dword [ebp - 0x14fc]
sub dword [ebp - 0x14f8], 1
mov esi, dword [ebp - 0x1504]
mov dword [ebp - 0x14e8], eax
mov dword [ebp - 0x14dc], ecx
jne 0xc4423f
mov edi, dword [ebp - 0x151c]
push dword [ebp - 0x14e4]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x14d4]
test eax, eax
je 0xc443ac
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1520], 0
jl 0xc438e7
cmp dword [ebp - 0x1510], 1
mov edi, dword [ebp - 0x1518]
jne 0xc44413
mov esi, dword [section..data]
xor eax, eax
push 0xcc0020
push eax
push eax
push edi
push dword [ebp - 0x14ec]
mov ecx, esi
push dword [ebp - 0x14d8]
push dword [ebp - 0xe68]
push dword [ebp - 0xe6c]
push dword [ebp - 0x1528]
call dword [0xc99200]
call esi
jmp 0xc44450
push dword [ebp - 0x14d0]
mov ecx, dword [ebp - 0x14ec]
xor edx, edx
mov eax, dword [ebp - 0x14d8]
mov esi, dword [0xc93020]
push ecx
push eax
push edx
push edx
push edi
push ecx
push eax
push dword [ebp - 0x7b0]
mov ecx, esi
push dword [ebp - 0x7b4]
push dword [ebp - 0x1528]
call dword [0xc99200]
call esi
push dword [ebp - 0x14e0]
mov esi, dword [0xc93040]
mov ecx, esi
push dword [ebp - 0x1528]
call dword [0xc99200]
call esi
jmp 0xc438ed
or dword [ebp - 0x16dc], 0xffffffff
mov ebx, 0xc004d501
mov edi, dword [ebp - 0x1524]
xor eax, eax
test esi, esi
je 0xc44498
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc44649
mov eax, dword [ebp - 0x16dc]
xor ecx, ecx
push 0x40
push ecx
mov ebx, 0xc960a0
mov esi, edi
push ebx
mov byte [eax + edi], cl
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xc445df
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x16bc]
jne 0xc444d0
sub ecx, ebx
xor eax, eax
push edi
sar ecx, 1
push edx
push eax
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc44642
xor eax, eax
mov edx, 0x5a4d
mov ecx, eax
mov eax, dword [edi]
mov dword [ebp - 0x1530], ecx
cmp word [eax], dx
je 0xc4451c
mov ecx, 0xc000007b
mov dword [ebp - 0x1530], ecx
jmp 0xc44566
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc4450f
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc4450f
cmp dword [edx], 0x4550
jne 0xc4450f
movzx eax, word [edx + 0x18]
mov ebx, 0x10b
cmp ax, bx
je 0xc44554
mov ebx, 0x20b
cmp ax, bx
je 0xc44554
mov ecx, 0xc000000d
jmp 0xc44514
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
xor edx, edx
add esi, 6
mov dword [ebp - 0x15d8], eax
mov ebx, edx
test eax, eax
je 0xc445d3
mov edx, esi
mov dword [ebp - 0x15d4], esi
lea eax, [edx + 1]
mov dword [ebp - 0x1540], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc4458b
sub edx, dword [ebp - 0x1540]
inc esi
add esi, edx
test ecx, ecx
js 0xc445c4
push dword [ebp - 0x15d4]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc445df
mov ecx, dword [ebp - 0x14d0]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x1530]
inc dword [ebp - 0x14d0]
inc ebx
cmp ebx, dword [ebp - 0x15d8]
jb 0xc4457a
add edi, 0x10
cmp byte [esi], 0
jne 0xc444c9
mov ebx, dword [ebp - 0x1530]
mov esi, dword [ebp - 0x1524]
test esi, esi
je 0xc44600
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc44656
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc44619
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc44608
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc44661
mov ebx, 0xc000007a
jmp 0xc445e5
mov esi, dword [ebp - 0x1524]
mov ebx, 0xc000007a
jmp 0xc445eb
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edi, 0xc96238
xchg dword [edi], eax
mov eax, dword [ebp - 0x1518]
xor ecx, ecx
mov esi, dword [0xc93068]
inc ecx
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x5d0], eax
lea eax, [ebp - 0x5ec]
push eax
push 4
pop ebx
push ebx
push 0x2021
xor eax, eax
mov dword [ebp - 0x5ec], ecx
mov dword [ebp - 0x5e4], ecx
mov dword [ebp - 0x5d8], ecx
mov dword [ebp - 0x5dc], ecx
mov dword [ebp - 0x5d4], ecx
mov ecx, esi
push eax
mov dword [ebp - 0x5e0], 0x9966f291
call dword [0xc99200]
call esi
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc446d0
mov eax, dword [0xc95890]
test eax, eax
jle 0xc44733
sub eax, 1
mov dword [0xc95890], eax
jne 0xc44733
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc44705
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc446f4
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0x1528]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
jmp 0xc3fd0e
mov edi, dword [ebp - 0x1644]
lea eax, [ebp - 0x1958]
push eax
mov edx, ebx
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc46670
lea eax, [edi + 0xa4]
cmp eax, dword [ebp - 0x160c]
ja 0xc46670
mov esi, dword [ebp - 0x1540]
mov dword [edi], 0xa0
mov edi, dword [ebp - 0x1958]
push 0x28
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x1640]
xor eax, eax
mov esi, edi
mov dword [ebp - 0x1580], eax
mov dword [ebp - 0x164c], esi
mov edx, dword [esi]
lea eax, [ebp - 0x1604]
push eax
mov ecx, ebx
call fcn.00a32533
test eax, eax
js 0xc46670
mov edx, dword [ebp - 0x1604]
lea eax, [ebp - 0x164c]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc46670
mov eax, dword [ebp - 0x1580]
mov esi, dword [ebp - 0x164c]
inc eax
mov dword [ebp - 0x1580], eax
cmp eax, 2
jb 0xc447b2
lea eax, [ebp - 0x1960]
mov edx, ebx
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc46670
lea eax, [esi + 0xc]
cmp eax, dword [ebp - 0x160c]
ja 0xc46670
mov edx, dword [ebp - 0x1564]
mov ecx, dword [ebp - 0x1960]
mov dword [esi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov esi, edi
xor eax, eax
mov dword [ebp - 0x1658], esi
mov edi, eax
mov edx, dword [esi]
lea eax, [ebp - 0x165c]
push eax
mov ecx, ebx
call fcn.00a32533
test eax, eax
js 0xc46670
mov edx, dword [ebp - 0x165c]
lea eax, [ebp - 0x1658]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc46670
mov esi, dword [ebp - 0x1658]
inc edi
cmp edi, 3
jb 0xc4484d
lea eax, [ebp - 0x1968]
mov edx, ebx
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc46670
lea eax, [esi + 0xc]
cmp eax, dword [ebp - 0x160c]
ja 0xc46670
mov eax, dword [ebp - 0x1968]
mov ecx, dword [ebp - 0x1590]
push 8
pop edi
mov dword [esi], edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0x15a4]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x156c]
mov edx, ebx
push eax
mov ecx, ebx
call fcn.00a32533
test eax, eax
js 0xc46670
mov esi, dword [ebp - 0x156c]
lea eax, [ebp - 0x1668]
push eax
mov edx, edi
mov dword [ebp - 0x15dc], esi
mov ecx, ebx
call fcn.00a32533
test eax, eax
js 0xc46670
mov edx, dword [ebp - 0x1668]
lea eax, [ebp - 0x15dc]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc46670
xor edx, edx
mov edi, edx
mov dword [ebp - 0x1668], edx
mov dword [ebp - 0x156c], edx
mov dword [ebp - 0x1658], edx
mov dword [ebp - 0x1604], edx
mov dword [ebp - 0x164c], edx
mov dword [ebp - 0x1580], edx
mov dword [ebp - 0x1644], edx
mov dword [ebp - 0x160c], edx
mov dword [ebp - 0x16a0], edx
rdtsc
mov dword [ebp - 0x165c], edi
mov dword [ebp - 0x1598], eax
mov dword [ebp - 0x1540], edx
push 8
pop eax
mov dword [ebp - 0x1778], eax
mov edx, dword [ebp - 0x15c8]
lea ecx, [ebp - 0x1778]
push ecx
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc44a94
mov eax, dword [ebp - 0x1778]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0x1564], ecx
cmp ecx, eax
jae 0xc449bd
mov esi, 0xc0000095
jmp 0xc44a94
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1590], eax
test eax, eax
jne 0xc449e1
mov esi, 0xc0000017
jmp 0xc44a94
lea ecx, [ebp - 0x1554]
mov dword [ebp - 0x1554], eax
push ecx
mov edx, ebx
mov dword [eax], ebx
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc44a79
mov ecx, dword [ebp - 0x1554]
mov edx, ebx
mov eax, dword [ebp - 0x15c8]
mov dword [ecx], eax
lea eax, [ebp - 0x1554]
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0x1590]
test esi, esi
js 0xc44a7f
mov ecx, dword [ebp - 0x1564]
push dword [ebp - 0x15c8]
mov edx, dword [ebp - 0x1598]
push dword [ebp - 0x1640]
mov dword [ecx + eax - 8], edx
mov edx, dword [ebp - 0x1540]
push dword [ebp - 0x1554]
mov dword [ecx + eax - 4], edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0x1590]
add esp, 0xc
mov ecx, dword [ebp - 0x1564]
xor edx, edx
mov dword [ebp - 0x1668], eax
mov eax, edx
mov dword [ebp - 0x156c], ecx
jmp 0xc44a81
mov eax, dword [ebp - 0x1590]
xor edx, edx
test eax, eax
je 0xc44a94
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xc46473
xor ecx, ecx
mov dword [ebp - 0x1554], ecx
cmp dword [ebp - 0x1668], ecx
jne 0xc44aba
mov esi, 0xc000000d
jmp 0xc45194
mov esi, dword [ebp - 0x156c]
test esi, esi
je 0xc4518f
lea eax, [esi + 8]
push eax
push ecx
mov dword [ebp - 0x1598], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x15c8], eax
test eax, eax
je 0xc4518f
mov edi, dword [ebp - 0x1668]
xor eax, eax
mov cl, al
test esi, esi
je 0xc44b04
xor cl, byte [eax + edi]
inc eax
cmp eax, esi
jb 0xc44afc
mov eax, esi
mov dword [ebp - 0x694], 0xb1b54a58
shr eax, 3
mov dword [ebp - 0x690], 0xc81ecb17
mov dword [ebp - 0x1540], eax
test eax, eax
je 0xc44f89
movzx edx, word [ebp - 0x692]
mov eax, 0xc81ecb17
movzx esi, ax
movzx eax, word [ebp - 0x68e]
mov dword [ebp - 0x1564], eax
mov eax, 0xb1b54a58
movzx eax, ax
mov dword [ebp - 0x1590], eax
mov eax, dword [ebp - 0x15c8]
add eax, 7
mov dword [ebp - 0x1608], esi
mov dword [ebp - 0x1698], eax
lea esi, [edi + 2]
xor eax, eax
mov dword [ebp - 0x15a4], edx
mov dword [ebp - 0x169c], esi
or edx, 0xffffffff
mov dword [ebp - 0x16a4], eax
mov dword [ebp - 0x16a8], eax
mov dword [ebp - 0x1680], eax
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0x169c]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0x169c]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0x169c]
shl esi, 8
add dword [ebp - 0x169c], 8
movzx eax, byte [eax + 5]
or esi, eax
xor edx, esi
mov dword [ebp - 0x1678], esi
mov eax, edx
mov dword [ebp - 0x162c], edx
sub eax, dword [ebp - 0x1590]
mov esi, 0xc81ecb17
xor eax, edi
xor eax, dword [ebp - 0x16a4]
xor eax, esi
mov edx, eax
mov dword [ebp - 0x16a4], eax
xor edx, esi
ror eax, 7
ror edx, 0xf
imul edx, dword [ebp - 0x15a4]
mov esi, dword [ebp - 0x1564]
add edx, eax
mov eax, dword [ebp - 0x162c]
xor eax, edx
mov edx, 0xb1b54a58
add edx, eax
mov dword [ebp - 0x162c], eax
ror edx, 9
imul edx, dword [ebp - 0x1608]
ror eax, 0xa
sub edx, eax
mov eax, dword [ebp - 0x16a4]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x16a4], eax
xor edx, dword [ebp - 0x1608]
rol edx, 4
imul edx, esi
rol eax, 5
add edx, eax
mov eax, dword [ebp - 0x162c]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x162c], eax
xor edx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, edx
mov edx, dword [ebp - 0x16a4]
xor edx, eax
mov dword [ebp - 0x16a4], edx
sub edx, dword [ebp - 0x1590]
imul edx, dword [ebp - 0x15a4]
mov eax, dword [ebp - 0x16a4]
shr eax, 6
sub edx, eax
xor dword [ebp - 0x162c], edx
mov edx, dword [ebp - 0x162c]
mov eax, edx
ror eax, 0xf
xor eax, dword [ebp - 0x1608]
imul eax, dword [ebp - 0x1590]
xor dword [ebp - 0x16a4], eax
mov eax, dword [ebp - 0x16a4]
not eax
ror eax, 3
add eax, esi
imul eax, dword [ebp - 0x1608]
xor edx, eax
mov eax, edx
mov dword [ebp - 0x162c], edx
sub eax, dword [ebp - 0x1590]
mov edx, dword [ebp - 0x16a4]
sub eax, 0xc81ecb17
xor edx, eax
mov dword [ebp - 0x16a4], edx
mov eax, dword [ebp - 0x16a4]
xor eax, esi
ror edx, 0xa
imul eax, dword [ebp - 0x15a4]
xor edx, eax
mov eax, dword [ebp - 0x162c]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x162c], eax
xor edx, dword [ebp - 0x1590]
rol edx, 6
imul edx, dword [ebp - 0x1608]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0x16a4]
xor eax, edx
mov edx, dword [ebp - 0x162c]
mov dword [ebp - 0x16a4], eax
ror eax, 0xf
sub eax, esi
imul eax, dword [ebp - 0x1590]
xor edx, eax
mov dword [ebp - 0x162c], edx
xor edx, esi
imul edx, dword [ebp - 0x1590]
mov eax, dword [ebp - 0x162c]
shr eax, 1
xor edx, eax
mov eax, dword [ebp - 0x162c]
xor dword [ebp - 0x16a4], edx
mov edx, eax
sub edx, dword [ebp - 0x1608]
rol edx, 3
imul edx, dword [ebp - 0x1590]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0x16a4]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x16a4], eax
sub edx, dword [ebp - 0x1608]
imul edx, dword [ebp - 0x15a4]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x162c]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0x162c], eax
ror edx, 9
imul edx, dword [ebp - 0x1608]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0x16a4]
xor eax, edx
mov edx, dword [ebp - 0x162c]
mov dword [ebp - 0x16a4], eax
sub eax, 0xb1b54a58
sub eax, esi
xor edx, eax
mov dword [ebp - 0x162c], edx
mov eax, dword [ebp - 0x162c]
xor eax, dword [ebp - 0x15a4]
imul eax, dword [ebp - 0x1590]
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0x16a4]
xor edx, eax
mov dword [ebp - 0x16a4], edx
xor edx, esi
rol edx, 4
imul edx, dword [ebp - 0x15a4]
mov eax, dword [ebp - 0x16a4]
ror eax, 0x10
sub edx, eax
mov eax, dword [ebp - 0x162c]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0x162c], eax
ror edx, 0xa
imul edx, dword [ebp - 0x1608]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0x16a4]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x16a4], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, esi
mov esi, 0xc81ecb17
xor edx, eax
mov eax, dword [ebp - 0x162c]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x162c], eax
xor edx, esi
rol eax, 2
rol edx, 8
imul edx, dword [ebp - 0x1590]
sub edx, eax
mov eax, dword [ebp - 0x16a4]
xor eax, edx
mov edx, esi
sub edx, eax
mov dword [ebp - 0x16a4], eax
ror edx, 0xb
imul edx, dword [ebp - 0x15a4]
ror eax, 0xc
sub edx, eax
mov eax, dword [ebp - 0x162c]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x162c], eax
xor edx, dword [ebp - 0x15a4]
imul edx, dword [ebp - 0x1608]
shr eax, 8
xor edx, eax
mov eax, dword [ebp - 0x16a4]
xor eax, edx
mov edx, dword [ebp - 0x162c]
xor edx, eax
xor eax, dword [ebp - 0x16a8]
xor edx, 0xb1b54a58
mov dword [ebp - 0x16a8], edi
xor edx, esi
mov esi, dword [ebp - 0x1698]
xor edx, dword [ebp - 0x1680]
mov byte [esi - 4], al
mov byte [esi], dl
ror eax, 8
mov byte [esi - 5], al
ror edx, 8
mov byte [esi - 1], dl
ror eax, 8
mov byte [esi - 6], al
ror edx, 8
mov byte [esi - 2], dl
ror eax, 8
ror edx, 8
mov byte [esi - 7], al
mov byte [esi - 3], dl
mov esi, dword [ebp - 0x1678]
ror eax, 8
mov dword [ebp - 0x16a4], eax
ror edx, 8
mov dword [ebp - 0x1680], esi
add dword [ebp - 0x1698], 8
sub dword [ebp - 0x1540], 1
mov esi, dword [ebp - 0x169c]
jne 0xc44b90
mov esi, dword [ebp - 0x156c]
movzx eax, cl
mov ecx, dword [ebp - 0x15c8]
cdq
mov dword [ecx + esi], eax
mov dword [ecx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x156c], edi
test edi, edi
jne 0xc44fc1
mov esi, 0xc0000017
jmp 0xc450d7
mov esi, dword [ebp - 0x1598]
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0xc44feb
mov esi, 0xc0000017
xor edx, edx
jmp 0xc45070
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0x15c8]
push esi
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc44fdf
mov dword [edi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
push 8
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x156c]
pop eax
push eax
push eax
mov dword [edi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xc45054
mov esi, 0xc0000017
jmp 0xc45070
mov dword [edi + 0x14], ecx
mov esi, edx
mov eax, dword [0xc94e90]
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ebp - 0x1554], edi
mov edi, edx
mov dword [ecx + 4], eax
test edi, edi
je 0xc450d7
cmp dword [edi + 4], 0
je 0xc45090
push dword [edi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 4], edx
cmp dword [edi + 0xc], 0
je 0xc450ac
push dword [edi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0xc], edx
cmp dword [edi + 0x14], 0
je 0xc450c8
push dword [edi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0x14], edx
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
test esi, esi
js 0xc450f1
mov edi, dword [ebp - 0x1554]
mov dword [ebp - 0x165c], edi
mov dword [ebp - 0x1554], eax
jmp 0xc450f7
mov edi, dword [ebp - 0x165c]
push dword [ebp - 0x15c8]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1554]
test eax, eax
je 0xc45194
mov ecx, dword [eax + 4]
test ecx, ecx
je 0xc4513a
push ecx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1554]
xor edx, edx
mov dword [eax + 4], edx
jmp 0xc4513c
xor edx, edx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0xc4515d
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1554]
xor edx, edx
mov dword [eax + 0xc], edx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0xc4517e
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1554]
xor edx, edx
mov dword [eax + 0x14], edx
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc45194
mov esi, 0xc0000001
or esi, 0x10000000
jl 0xc46473
mov edx, dword [edi]
lea eax, [ebp - 0x1568]
push eax
mov ecx, ebx
mov dword [ebp - 0x1568], ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc4522c
mov ecx, dword [ebp - 0x1568]
lea eax, [ebp - 0x1568]
push eax
mov edx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc4522c
mov edx, dword [edi + 8]
lea eax, [ebp - 0x1568]
mov ecx, dword [ebp - 0x1568]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc4522c
mov ecx, dword [ebp - 0x1568]
lea eax, [ebp - 0x1568]
push eax
mov edx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc4522c
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0x1568]
mov ecx, dword [ebp - 0x1568]
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0x1568]
test esi, esi
jns 0xc45232
mov eax, dword [ebp - 0x1784]
mov dword [ebp - 0x1568], eax
test esi, esi
js 0xc45392
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x1554], ecx
test ecx, ecx
jne 0xc45266
mov esi, 0xc0000017
jmp 0xc45392
mov eax, dword [edi]
mov edx, ebx
mov dword [ecx], eax
lea eax, [ebp - 0x15cc]
push eax
mov dword [ebp - 0x15cc], ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45377
push dword [edi]
push dword [edi + 4]
push dword [ebp - 0x15cc]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi]
lea eax, [ebp - 0x15cc]
mov ecx, dword [ebp - 0x15cc]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45377
mov ecx, dword [ebp - 0x15cc]
mov edx, ebx
mov eax, dword [edi + 8]
mov dword [ecx], eax
lea eax, [ebp - 0x15cc]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45377
push dword [edi + 8]
push dword [edi + 0xc]
push dword [ebp - 0x15cc]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi + 8]
lea eax, [ebp - 0x15cc]
mov ecx, dword [ebp - 0x15cc]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45377
mov ecx, dword [ebp - 0x15cc]
mov edx, ebx
mov eax, dword [edi + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0x15cc]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45377
push dword [edi + 0x10]
push dword [edi + 0x14]
push dword [ebp - 0x15cc]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0x15cc]
mov ecx, dword [ebp - 0x15cc]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
xor edx, edx
mov eax, dword [ebp - 0x1554]
test esi, esi
js 0xc4537f
mov ecx, dword [ebp - 0x1568]
mov dword [ebp - 0x1658], eax
mov eax, edx
mov dword [ebp - 0x1604], ecx
jmp 0xc4537f
mov eax, dword [ebp - 0x1554]
xor edx, edx
test eax, eax
je 0xc45392
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xc46473
push 8
xor eax, eax
pop edi
mov dword [ebp - 0x15cc], eax
mov dword [ebp - 0x1568], eax
mov dword [ebp - 0x178c], edi
mov edx, dword [ebp - 0x15dc]
lea eax, [ebp - 0x178c]
push eax
mov ecx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
jl 0xc45429
mov eax, dword [ebp - 0x178c]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xc453ea
mov esi, 0xc0000095
jmp 0xc4540a
mov dword [ebp - 0x1794], ecx
lea eax, [ebp - 0x1794]
mov edx, edi
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0x1794]
test esi, esi
jns 0xc45410
mov eax, dword [ebp - 0x1790]
mov dword [ebp - 0x1554], eax
test esi, esi
js 0xc45429
mov edi, dword [ebp - 0x1640]
test edi, edi
jne 0xc4545f
mov esi, 0xc000000d
mov edi, dword [ebp - 0x1580]
test esi, esi
js 0xc46473
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc45632
mov eax, dword [ebp - 0x164c]
mov esi, 0xd0000017
jmp 0xc4563d
cmp ebx, 1
jbe 0xc45424
mov ecx, edi
xor eax, eax
mov dword [ebp - 0x15c0], ecx
mov dword [ebp - 0x15dc], eax
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0x156c], eax
lea eax, [ebp - 0x15c0]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45429
mov edx, dword [ebp - 0x156c]
lea eax, [ebp - 0x15c0]
mov ecx, dword [ebp - 0x15c0]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45429
mov eax, dword [ebp - 0x15dc]
mov ecx, dword [ebp - 0x15c0]
inc eax
mov dword [ebp - 0x15dc], eax
cmp eax, 1
jb 0xc45474
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0x15dc], eax
lea eax, [ebp - 0x15c0]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45429
mov eax, dword [ebp - 0x15dc]
mov dword [ebp - 0x15cc], eax
cmp ebx, 2
jbe 0xc45424
mov ecx, edi
xor eax, eax
mov dword [ebp - 0x1610], ecx
mov edi, eax
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0x15c0], eax
lea eax, [ebp - 0x1610]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45567
mov edx, dword [ebp - 0x15c0]
lea eax, [ebp - 0x1610]
mov ecx, dword [ebp - 0x1610]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45567
mov ecx, dword [ebp - 0x1610]
inc edi
cmp edi, 2
jb 0xc4550b
mov edi, dword [ecx]
lea eax, [ebp - 0x1610]
push eax
mov edx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
jns 0xc45575
mov edi, dword [ebp - 0x1568]
test esi, esi
js 0xc45429
mov edx, dword [ebp - 0x1554]
lea eax, [ebp - 0x15ac]
push eax
mov ecx, ebx
mov dword [ebp - 0x15ac], ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45607
mov ecx, dword [ebp - 0x15ac]
lea eax, [ebp - 0x15ac]
push eax
mov edx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45607
mov edx, dword [ebp - 0x15cc]
lea eax, [ebp - 0x15ac]
mov ecx, dword [ebp - 0x15ac]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45607
mov ecx, dword [ebp - 0x15ac]
lea eax, [ebp - 0x15ac]
push eax
mov edx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45607
mov ecx, dword [ebp - 0x15ac]
lea eax, [ebp - 0x15ac]
push eax
mov edx, edi
call fcn.00a32533
mov edi, dword [ebp - 0x15ac]
mov esi, eax
test esi, esi
jns 0xc45615
mov edi, dword [ebp - 0x17a4]
test esi, esi
js 0xc45429
cmp edi, 0x400000
jbe 0xc45627
mov esi, 0x8000ffff
jmp 0xc46473
mov dword [ebp - 0x1580], edi
jmp 0xc4542f
mov dword [ebp - 0x164c], eax
mov esi, 0x10000000
test esi, esi
js 0xc46473
mov ecx, dword [ebp - 0x1658]
test ecx, ecx
jne 0xc45659
mov esi, 0x80070057
jmp 0xc46473
test eax, eax
je 0xc4564f
mov dword [ebp - 0x1b34], eax
xor eax, eax
mov dword [ebp - 0x1b28], eax
lea eax, [ebp - 0x17a8]
push eax
push 0x9f29b8
mov dword [ebp - 0x1b38], ecx
mov ecx, dword [ebp - 0x1604]
push 1
mov dword [ebp - 0x1b30], ecx
mov dword [ebp - 0x1b2c], edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xc456bb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc456b2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc45703
mov esi, 0x80004005
jmp 0xc45703
push 0x9fc030
push dword [ebp - 0x17a8]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xc4569b
xor eax, eax
mov ecx, esi
push eax
push 0x14
lea eax, [ebp - 0x1b38]
push eax
push 0x86
call dword [0xc99200]
call esi
mov esi, eax
or esi, 0x10000000
jl 0xc45703
mov edi, dword [ebp - 0x1b2c]
mov dword [ebp - 0x1580], edi
cmp esi, 0xd0000023
jne 0xc45715
mov esi, 0x8007007a
jmp 0xc46473
test esi, esi
js 0xc46473
mov eax, dword [ebp - 0x164c]
xor edx, edx
mov dword [ebp - 0x15ac], edx
mov dword [ebp - 0x15e4], edx
mov dword [ebp - 0x15e8], eax
cmp edi, ebx
jae 0xc45745
mov esi, 0xc000003e
jmp 0xc45b35
mov edi, dword [eax]
lea ecx, [ebp - 0x15e8]
push ecx
mov edx, ebx
mov dword [ebp - 0x1610], edi
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45b33
lea eax, [ebp - 0x15e4]
mov edx, ebx
push eax
xor ecx, ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45b33
mov eax, dword [ebp - 0x1580]
sub eax, dword [ebp - 0x15e4]
cmp eax, edi
jae 0xc4579b
mov esi, 0xc000003e
jmp 0xc45b33
mov eax, dword [ebp - 0x15e8]
lea ecx, [ebp - 0x15e8]
push ecx
mov edx, edi
mov dword [ebp - 0x15c0], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45b33
mov ecx, dword [ebp - 0x15e4]
lea eax, [ebp - 0x15e4]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45b33
mov eax, dword [ebp - 0x1580]
sub eax, dword [ebp - 0x15e4]
cmp eax, ebx
jb 0xc45791
mov ecx, dword [ebp - 0x15e8]
lea eax, [ebp - 0x15e8]
push eax
mov edx, ebx
mov edi, dword [ecx]
mov dword [ebp - 0x15cc], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45b33
mov ecx, dword [ebp - 0x15e4]
lea eax, [ebp - 0x15e4]
push eax
mov edx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45b33
mov eax, dword [ebp - 0x1580]
sub eax, dword [ebp - 0x15e4]
cmp eax, edi
jb 0xc45791
mov eax, dword [ebp - 0x15e8]
lea ecx, [ebp - 0x15e8]
push ecx
mov edx, edi
mov dword [ebp - 0x1568], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45b33
mov ecx, dword [ebp - 0x15e4]
lea eax, [ebp - 0x15e4]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45b33
mov eax, dword [ebp - 0x1580]
sub eax, dword [ebp - 0x15e4]
cmp eax, ebx
jb 0xc45791
mov ecx, dword [ebp - 0x15e8]
mov edx, ebx
mov eax, dword [ecx]
mov dword [ebp - 0x1554], eax
lea eax, [ebp - 0x15e8]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45b33
mov ecx, dword [ebp - 0x15e4]
lea eax, [ebp - 0x15e4]
push eax
mov edx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45b33
mov eax, dword [ebp - 0x1580]
sub eax, dword [ebp - 0x15e4]
mov ecx, dword [ebp - 0x1554]
cmp eax, ecx
jb 0xc45791
lea eax, [ebp - 0x15e4]
mov edx, ecx
mov ecx, dword [ebp - 0x15e4]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc45b33
mov edx, dword [ebp - 0x1580]
mov eax, edx
sub eax, dword [ebp - 0x15e4]
jne 0xc45791
mov esi, dword [ebp - 0x1610]
mov ecx, dword [ebp - 0x1554]
add ecx, 0xc
lea eax, [edi + esi]
add eax, ecx
cmp eax, edx
jne 0xc45791
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc4596c
mov esi, 0xc0000017
jmp 0xc45ab0
cmp dword [ebp - 0x15c0], 0
je 0xc459ae
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc45997
mov esi, 0xc0000017
xor eax, eax
jmp 0xc45a49
mov dword [edi + 4], eax
push esi
push dword [ebp - 0x15c0]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc459b5
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
cmp dword [ebp - 0x1568], 0
je 0xc459f2
mov esi, dword [ebp - 0x15cc]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc4598b
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0x1568]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc459f8
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
cmp dword [ebp - 0x15e8], 0
je 0xc45a39
mov esi, dword [ebp - 0x1554]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc4598b
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0x15e8]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc45a3f
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [ebp - 0x15ac], edi
mov esi, eax
mov edi, eax
test edi, edi
je 0xc45ab0
cmp dword [edi + 4], 0
je 0xc45a69
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc45a85
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc45aa1
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
test esi, esi
js 0xc45ac6
mov eax, dword [ebp - 0x15ac]
mov edi, edx
mov dword [ebp - 0x1644], eax
jmp 0xc45acc
mov edi, dword [ebp - 0x15ac]
test edi, edi
je 0xc45b35
cmp dword [edi + 4], 0
je 0xc45aec
push dword [edi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 4], edx
cmp dword [edi + 0xc], 0
je 0xc45b08
push dword [edi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0xc], edx
cmp dword [edi + 0x14], 0
je 0xc45b24
push dword [edi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0x14], edx
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
or esi, 0x10000000
jl 0xc46473
mov ecx, dword [ebp - 0x1644]
mov edi, edx
mov dword [ebp - 0x15e8], edi
mov dword [ebp - 0x15e4], edx
test ecx, ecx
jne 0xc45b63
mov esi, 0xd000000d
jmp 0xc46473
mov eax, dword [ecx + 4]
mov dword [ebp - 0x15ac], eax
test eax, eax
je 0xc45b59
mov esi, dword [ecx]
test esi, esi
je 0xc45b59
add esi, 0xfffffff8
mov dword [ebp - 0x1610], edx
push esi
push edx
mov dword [ebp - 0x15c0], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x15cc], eax
test eax, eax
je 0xc461d8
xor ecx, ecx
mov dword [ebp - 0x6b4], 0xab69605e
mov edi, esi
mov dword [ebp - 0x6b0], 0x7f1137f
mov dword [ebp - 0x1554], eax
mov dl, cl
mov ecx, dword [ebp - 0x15ac]
mov dword [ebp - 0x1568], ecx
and edi, 7
je 0xc4617c
xor eax, eax
mov dword [ebp - 0x16c8], eax
mov esi, eax
mov dword [ebp - 0x15dc], eax
mov dword [ebp - 0x156c], eax
test edi, edi
je 0xc45c4e
movzx eax, byte [ecx]
inc ecx
mov dword [ebp - 0x1568], ecx
mov ecx, dword [ebp - 0x166c]
cmp dword [ebp - 0x156c], ebx
jge 0xc45c18
add ecx, 0xffffffe0
shl eax, cl
mov ecx, dword [ebp - 0x166c]
or esi, eax
jmp 0xc45c20
shl eax, cl
or dword [ebp - 0x16c8], eax
mov eax, dword [ebp - 0x156c]
sub ecx, 8
inc eax
mov dword [ebp - 0x166c], ecx
mov ecx, dword [ebp - 0x1568]
mov dword [ebp - 0x156c], eax
cmp eax, edi
jl 0xc45bf1
mov eax, ecx
mov dword [ebp - 0x15dc], esi
mov dword [ebp - 0x1568], eax
mov eax, esi
xor ecx, ecx
mov esi, dword [ebp - 0x16c8]
xor eax, 0x92f65a5
xor esi, 0x699a899c
mov dword [ebp - 0x156c], eax
mov dword [ebp - 0x1604], esi
mov dword [ebp - 0x1580], eax
mov dword [ebp - 0x1598], esi
mov dword [ebp - 0x15c8], ecx
test edi, edi
je 0xc45d01
mov ecx, dword [ebp - 0x1554]
mov eax, dword [ebp - 0x15c8]
lea esi, [ecx + 1]
mov dword [ebp - 0x1540], esi
cmp eax, ebx
jge 0xc45cad
rol dword [ebp - 0x1580], 8
mov ecx, dword [ebp - 0x1580]
jmp 0xc45cba
rol dword [ebp - 0x1598], 8
mov ecx, dword [ebp - 0x1598]
mov dword [ebp - 0x1564], ecx
mov ecx, dword [ebp - 0x1554]
mov eax, dword [ebp - 0x1564]
mov byte [ecx], al
mov eax, dword [ebp - 0x15c8]
mov ecx, dword [ebp - 0x1540]
inc eax
mov dword [ebp - 0x15c8], eax
mov dword [ebp - 0x1554], ecx
cmp eax, edi
jl 0xc45c91
mov esi, dword [ebp - 0x1604]
mov eax, ecx
mov dword [ebp - 0x1554], eax
xor ecx, ecx
mov eax, dword [ebp - 0x156c]
cmp edi, ebx
jbe 0xc4615a
push 8
pop ecx
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0x1604], esi
mov esi, dword [ebp - 0x15c0]
mov eax, esi
shr eax, 3
mov dword [ebp - 0x1580], eax
test eax, eax
je 0xc4611b
movzx ecx, word [ebp - 0x6ae]
mov eax, 0x7f1137f
movzx esi, word [ebp - 0x6b2]
movzx eax, ax
mov dword [ebp - 0x15c8], ecx
mov ecx, 0xab69605e
mov dword [ebp - 0x1598], eax
movzx eax, cx
mov ecx, dword [ebp - 0x156c]
mov dword [ebp - 0x1564], eax
mov eax, dword [ebp - 0x1554]
mov dword [ebp - 0x1540], esi
add eax, 7
mov esi, dword [ebp - 0x1568]
mov dword [ebp - 0x1554], eax
add esi, 2
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor ecx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
shl edi, 8
add esi, 8
or edi, eax
mov dword [ebp - 0x1568], esi
mov eax, dword [ebp - 0x1604]
xor eax, edi
xor eax, ecx
xor eax, 0xab69605e
xor eax, 0x7f1137f
mov dword [ebp - 0x1604], eax
mov esi, eax
rol dword [ebp - 0x1604], 0xa
sub eax, 0xab69605e
rol eax, 5
imul eax, dword [ebp - 0x1598]
add eax, dword [ebp - 0x1604]
xor ecx, eax
mov eax, 0x7f1137f
mov dword [ebp - 0x156c], ecx
add ecx, eax
mov eax, dword [ebp - 0x156c]
ror ecx, 9
imul ecx, dword [ebp - 0x1540]
rol eax, 2
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
sub ecx, dword [ebp - 0x1598]
imul ecx, dword [ebp - 0x1564]
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0x156c]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x156c], eax
xor ecx, dword [ebp - 0x1540]
rol ecx, 6
imul ecx, dword [ebp - 0x15c8]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, 0xab69605e
sub eax, ecx
mov ecx, dword [ebp - 0x156c]
xor ecx, eax
mov dword [ebp - 0x156c], ecx
mov eax, dword [ebp - 0x156c]
xor eax, dword [ebp - 0x1598]
imul eax, dword [ebp - 0x1540]
ror ecx, 6
xor ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov eax, esi
rol eax, 2
lea ecx, [esi + ecx]
ror ecx, 0xf
imul ecx, dword [ebp - 0x1564]
add ecx, eax
mov eax, dword [ebp - 0x156c]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x156c], eax
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0x15c8]
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, 0xab69605e
ror eax, 0xa
ror ecx, 0xc
imul ecx, dword [ebp - 0x1598]
xor ecx, eax
mov eax, dword [ebp - 0x156c]
xor eax, ecx
mov ecx, dword [ebp - 0x15c8]
xor ecx, eax
mov dword [ebp - 0x156c], eax
imul ecx, dword [ebp - 0x1540]
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov ecx, dword [ebp - 0x156c]
mov eax, esi
not eax
ror eax, 5
add eax, dword [ebp - 0x1564]
imul eax, dword [ebp - 0x15c8]
xor ecx, eax
mov eax, ecx
mov dword [ebp - 0x156c], ecx
sub eax, dword [ebp - 0x15c8]
xor eax, esi
mov esi, dword [ebp - 0x156c]
xor eax, 0xab69605e
mov ecx, eax
mov dword [ebp - 0x1604], eax
xor ecx, dword [ebp - 0x15c8]
rol ecx, 2
imul ecx, dword [ebp - 0x1598]
shr eax, 2
add ecx, eax
xor esi, ecx
mov eax, esi
rol eax, 7
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul ecx, dword [ebp - 0x1540]
add ecx, eax
mov eax, dword [ebp - 0x1604]
xor eax, ecx
mov dword [ebp - 0x1604], eax
mov ecx, eax
xor eax, dword [ebp - 0x1598]
imul eax, dword [ebp - 0x1564]
ror ecx, 9
add ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0x1540]
rol ecx, 5
imul ecx, dword [ebp - 0x15c8]
rol eax, 7
add ecx, eax
xor dword [ebp - 0x1604], ecx
mov ecx, dword [ebp - 0x1604]
xor esi, ecx
xor esi, 0xab69605e
xor esi, 0x7f1137f
mov eax, esi
ror eax, 3
sub eax, dword [ebp - 0x1540]
imul eax, dword [ebp - 0x1598]
xor ecx, eax
mov dword [ebp - 0x1604], ecx
sub ecx, 0x7f1137f
mov eax, dword [ebp - 0x1604]
ror ecx, 1
imul ecx, dword [ebp - 0x1564]
ror eax, 6
sub ecx, eax
xor esi, ecx
mov ecx, 0xab69605e
mov eax, esi
rol eax, 0xe
lea ecx, [esi + ecx]
rol ecx, 3
imul ecx, dword [ebp - 0x15c8]
add ecx, eax
mov eax, dword [ebp - 0x1604]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0x1604], eax
rol ecx, 0xf
imul ecx, dword [ebp - 0x1598]
ror eax, 0xe
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0x1564]
imul ecx, dword [ebp - 0x1540]
shr eax, 3
xor ecx, eax
mov eax, dword [ebp - 0x1604]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x1604], eax
xor ecx, 0x7f1137f
rol eax, 2
rol ecx, 4
imul ecx, dword [ebp - 0x1564]
xor ecx, eax
mov eax, dword [ebp - 0x1604]
xor ecx, dword [ebp - 0x15dc]
xor eax, dword [ebp - 0x16c8]
xor esi, ecx
mov ecx, esi
mov dword [ebp - 0x156c], esi
mov esi, dword [ebp - 0x1554]
mov dword [ebp - 0x15dc], ebx
mov dword [ebp - 0x16c8], edi
mov byte [esi - 4], cl
mov byte [esi], al
ror ecx, 8
mov byte [esi - 5], cl
ror eax, 8
mov byte [esi - 1], al
ror ecx, 8
mov byte [esi - 6], cl
ror eax, 8
mov byte [esi - 2], al
ror ecx, 8
ror eax, 8
mov byte [esi - 7], cl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror ecx, 8
sub dword [ebp - 0x1580], 1
mov dword [ebp - 0x1554], esi
mov esi, dword [ebp - 0x1568]
mov dword [ebp - 0x1604], eax
jne 0xc45d88
mov esi, dword [ebp - 0x15c0]
push 4
pop ebx
mov ecx, dword [ebp - 0x15cc]
xor eax, eax
test esi, esi
je 0xc4612f
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0xc46127
movzx eax, dl
cdq
mov edi, edx
mov edx, dword [ebp - 0x15ac]
cmp eax, dword [esi + edx]
jne 0xc46197
cmp edi, dword [esi + edx + 4]
jne 0xc46197
xor eax, eax
mov dword [ebp - 0x15e4], esi
mov esi, dword [ebp - 0x1610]
mov edi, ecx
mov ecx, eax
jmp 0xc461a4
mov dword [ebp - 0x1604], ecx
jae 0xc45d1b
mov ecx, ebx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0x156c], eax
jmp 0xc45d1b
xor ecx, ecx
mov eax, ecx
mov dword [ebp - 0x15dc], ecx
mov dword [ebp - 0x1604], ecx
mov dword [ebp - 0x156c], eax
jmp 0xc45d21
mov edi, dword [ebp - 0x15e8]
mov esi, 0xc004d501
xor eax, eax
test ecx, ecx
je 0xc461b7
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc461d8
mov eax, dword [ebp - 0x15e4]
xor ecx, ecx
mov dword [ebp - 0x160c], edi
mov esi, 0x10000000
mov edi, ecx
mov dword [ebp - 0x16a0], eax
jmp 0xc461df
mov esi, 0xd0000001
xor ecx, ecx
test edi, edi
je 0xc461f2
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc46473
mov edi, dword [ebp - 0x16a0]
xor eax, eax
mov ecx, dword [ebp - 0x160c]
mov dword [ebp - 0x168c], eax
mov dword [ebp - 0x17b8], ecx
cmp edi, ebx
jb 0xc46468
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0x15e8], eax
lea eax, [ebp - 0x17b8]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc4646d
lea eax, [ebp - 0x168c]
mov edx, ebx
push eax
xor ecx, ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc4646d
mov eax, edi
sub eax, dword [ebp - 0x168c]
cmp eax, ebx
jb 0xc46468
mov ecx, dword [ebp - 0x17b8]
lea eax, [ebp - 0x17b8]
push eax
mov edx, ebx
mov edi, dword [ecx]
mov dword [ebp - 0x15e4], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc4646d
mov ecx, dword [ebp - 0x168c]
lea eax, [ebp - 0x168c]
push eax
mov edx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc4646d
mov eax, dword [ebp - 0x16a0]
mov ecx, dword [ebp - 0x168c]
sub eax, ecx
cmp eax, edi
jb 0xc46468
lea eax, [ebp - 0x168c]
mov edx, edi
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc4646d
mov edx, dword [ebp - 0x16a0]
mov esi, dword [ebp - 0x160c]
mov eax, dword [ebp - 0x17b8]
add eax, edi
lea ecx, [edx + esi]
cmp ecx, eax
jb 0xc46468
mov eax, dword [ebp - 0x17b8]
sub edx, eax
sub edx, edi
add edx, esi
cmp edx, 8
jae 0xc46468
xor edx, edx
mov dword [ebp - 0x15ac], edx
mov ecx, edx
mov dword [ebp - 0x168c], ecx
mov esi, edx
test eax, eax
je 0xc463f7
mov edx, dword [ebp - 0x15e4]
lea ecx, [ebp - 0x17bc]
push ecx
mov ecx, eax
mov edi, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc4646d
mov eax, dword [ebp - 0x17bc]
jmp 0xc463df
lea eax, [ebp - 0x17c0]
mov edx, ebx
push eax
mov ecx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc4646d
mov eax, dword [ebp - 0x17bc]
cmp dword [ebp - 0x17c0], eax
ja 0xc4641e
mov edx, dword [edi]
lea eax, [ebp - 0x17c4]
push eax
mov ecx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc463a1
mov eax, dword [ebp - 0x17c4]
mov dword [ebp - 0x17c8], eax
jmp 0xc463a7
mov eax, dword [ebp - 0x17c8]
test esi, esi
js 0xc4646d
lea ecx, [ebp - 0x17cc]
mov edx, eax
push ecx
mov ecx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc4646d
mov edi, dword [ebp - 0x17cc]
mov eax, dword [ebp - 0x17bc]
cmp edi, eax
ja 0xc4641e
inc dword [ebp - 0x15ac]
cmp edi, eax
jb 0xc46351
cmp edi, eax
jne 0xc4641e
mov edi, dword [ebp - 0x15e4]
mov ecx, dword [ebp - 0x168c]
test edi, edi
je 0xc46429
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x168c], ecx
test ecx, ecx
jne 0xc46425
mov esi, 0xc0000017
jmp 0xc46456
mov esi, 0xc000000d
jmp 0xc4646d
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x17b8]
test eax, eax
je 0xc46444
push edi
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [ebp - 0x168c]
add esp, 0xc
mov eax, dword [ebp - 0x15ac]
mov dword [ebp - 0x1a68], ecx
mov dword [ebp - 0x1a70], eax
test esi, esi
js 0xc4646d
mov eax, dword [ebp - 0x15e8]
cmp eax, dword [ebp - 0x1a70]
je 0xc4646d
mov esi, 0xc000003e
or esi, 0x10000000
mov eax, dword [ebp - 0x1668]
test eax, eax
je 0xc4648e
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0x165c]
test edi, edi
je 0xc464fc
xor eax, eax
cmp dword [edi + 4], eax
je 0xc464b5
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc464d1
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc464ed
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1658]
test eax, eax
je 0xc46517
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x164c]
test eax, eax
je 0xc46532
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0x1644]
test edi, edi
je 0xc465a0
xor eax, eax
cmp dword [edi + 4], eax
je 0xc46559
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc46575
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc46591
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x160c]
test eax, eax
je 0xc465bb
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc46670
mov edi, dword [ebp - 0x1a70]
cmp edi, 1
jb 0xc46670
mov esi, dword [ebp - 0x1a68]
test esi, esi
je 0xc46670
test edi, edi
je 0xc46670
lea eax, [ebp - 0x17d0]
mov dword [ebp - 0x17d0], esi
push eax
mov edx, ebx
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc46670
mov eax, dword [esi]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x17d0]
cmp dword [esi], ebx
jne 0xc46670
cmp dword [eax], 0
jl 0xc46670
cmp edi, 1
jbe 0xc46670
xor eax, eax
mov dword [ebp - 0x17d4], esi
mov edi, eax
lea eax, [ebp - 0x17d4]
mov edx, ebx
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc46670
mov edx, dword [esi]
lea eax, [ebp - 0x17d4]
mov ecx, dword [ebp - 0x17d4]
push eax
call fcn.00a32533
test eax, eax
js 0xc46670
inc edi
cmp edi, 1
jae 0xc46670
mov esi, dword [ebp - 0x17d4]
jmp 0xc46626
mov eax, dword [ebp - 0x1a74]
jmp 0xc4667c
mov eax, dword [ebp - 0x1a74]
jmp 0xc46676
mov eax, dword [ebp - 0x1640]
mov edi, dword [ebp - 0x15d4]
xor ebx, ebx
test eax, eax
je 0xc46691
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0x1a68]
test esi, esi
je 0xc466aa
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x15d8]
test eax, eax
je 0xc466c3
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xc466d6
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ebx, dword [ebp - 0x1500]
mov eax, dword [ebp - 0x1534]
xor ecx, ecx
mov dword [ebp - 0x1534], ecx
mov dword [ebp - 0x1880], eax
jmp 0xc3ce2d
mov ebx, 0xc004f027
test ebx, ebx
js 0xc32b02
push 4
pop esi
cmp dword [ebp - 0x1538], esi
jmp 0xc3c412