Function at 0xaa5db5
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe8c
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor edx, edx
mov ebx, 0xc96238
push esi
push edi
mov dword [ebp - 0xbfc], edx
mov dword [ebp - 0xc0c], edx
mov dword [ebp - 0xc20], edx
mov dword [ebp - 0xc38], edx
mov dword [ebp - 0xc3c], edx
jmp 0xb447df
test ebx, ebx
js 0xb4ec74
push 4
pop ecx
cmp dword [ebp - 0xc38], ecx
jne 0xb4ec7c
mov esi, dword [eax]
mov ebx, dword [ebp - 0xc20]
jmp 0xb4ec87
test ebx, ebx
js 0xaa5e35
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.00ab3c50
leave
ret
xor eax, eax
mov esi, eax
jmp 0xaa5e1f
lea ecx, [edx + 1]
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
jne 0xb447df
mov eax, dword [0xc95890]
or ebx, 0xffffffff
mov dword [ebp - 0xc40], ebx
mov edi, 0x9fbcf2
mov dword [ebp - 0xc44], edi
mov dword [ebp - 0xc48], 0x67
mov dword [ebp - 0xc4c], 0x337
mov dword [ebp - 0xc50], 0x10b
mov dword [ebp - 0xc54], 0x20b
push 0
pop edx
test eax, eax
jne 0xb44e40
push 0x338
mov esi, edx
mov dword [ebp - 0xbd4], edx
push edx
mov dword [ebp - 0xb80], edx
mov dword [ebp - 0xb54], esi
mov dword [ebp - 0xb9c], edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb34], eax
test eax, eax
je 0xb44e34
mov esi, 0xab69605e
mov dword [ebp - 0xb88], ebx
mov dword [ebp - 0x390], esi
xor edx, edx
mov esi, 0x7f1137f
mov dword [ebp - 0xb84], edx
mov dword [ebp - 0x38c], esi
add eax, 7
mov esi, edi
mov dword [ebp - 0xb24], eax
mov cl, dl
mov dword [ebp - 0xb0c], esi
mov ebx, edx
mov dword [ebp - 0xb04], 0x67
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xb0c]
xor edx, edi
mov dword [ebp - 0xb48], edx
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xb0c]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xb0c]
shl esi, 8
add dword [ebp - 0xb0c], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
xor ebx, edx
xor ebx, 0xac987321
lea eax, [ebx + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, ebx
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0xb48]
xor eax, edx
mov dword [ebp - 0xb48], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb48]
rol eax, 2
sub edx, eax
xor ebx, edx
imul edx, ebx, 0x605e
mov eax, ebx
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xb48]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xb48], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb48]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xb48]
xor edx, eax
mov dword [ebp - 0xb48], edx
mov eax, dword [ebp - 0xb48]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor ebx, edx
lea eax, [ebx + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, ebx
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xb48]
xor eax, edx
mov dword [ebp - 0xb48], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb48]
rol eax, 8
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, ebx
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xb48]
xor eax, edx
mov dword [ebp - 0xb48], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb48]
shr eax, 0xa
xor edx, eax
xor edx, ebx
mov ebx, dword [ebp - 0xb48]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
mov dword [ebp - 0xb48], ebx
add ebx, 0xfffff80f
xor ebx, edx
xor ebx, 0xab69605e
mov eax, ebx
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, ebx
shr eax, 2
add edx, eax
mov eax, dword [ebp - 0xb48]
xor eax, edx
mov dword [ebp - 0xb48], eax
add eax, 0xf80eec81
ror eax, 6
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb48]
rol eax, 7
add edx, eax
xor ebx, edx
mov eax, ebx
mov edx, ebx
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
mov eax, dword [ebp - 0xb48]
xor eax, edx
mov dword [ebp - 0xb48], eax
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb48]
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xb48]
xor ebx, edx
xor eax, ebx
xor eax, 0xac987321
mov dword [ebp - 0xb48], eax
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor ebx, eax
lea eax, [ebx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, ebx
ror eax, 6
sub edx, eax
mov eax, dword [ebp - 0xb48]
xor eax, edx
mov dword [ebp - 0xb48], eax
add eax, 0xab69605e
rol eax, 3
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb48]
rol eax, 0xe
add edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, ebx
ror eax, 0xe
sub edx, eax
mov eax, dword [ebp - 0xb48]
xor eax, edx
mov dword [ebp - 0xb48], eax
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb48]
shr eax, 3
xor edx, eax
xor ebx, edx
mov edx, 0x7f1137f
mov eax, ebx
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, ebx
xor ebx, dword [ebp - 0xb88]
rol eax, 2
mov dword [ebp - 0xb88], esi
mov esi, dword [ebp - 0xb0c]
xor edx, eax
mov eax, dword [ebp - 0xb24]
xor edx, dword [ebp - 0xb84]
xor dword [ebp - 0xb48], edx
mov edx, dword [ebp - 0xb48]
mov byte [eax - 4], dl
mov byte [eax], bl
ror edx, 8
mov byte [eax - 5], dl
ror ebx, 8
mov byte [eax - 1], bl
ror edx, 8
mov byte [eax - 6], dl
ror ebx, 8
mov byte [eax - 2], bl
ror edx, 8
ror ebx, 8
mov byte [eax - 7], dl
mov byte [eax - 3], bl
add eax, 8
ror edx, 8
ror ebx, 8
sub dword [ebp - 0xb04], 1
mov dword [ebp - 0xb84], edi
mov dword [ebp - 0xb24], eax
jne 0xb448b6
mov esi, dword [ebp - 0xb34]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xb44c28
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xb44c5a
cmp edx, dword [0x9fc02c]
jne 0xb44c5a
mov edi, esi
xor eax, eax
mov dword [ebp - 0xb54], edi
mov esi, eax
mov ebx, 0x337
jmp 0xb44c6f
mov edi, dword [ebp - 0xb54]
or ebx, 0xffffffff
mov dword [ebp - 0xb9c], 0xc004d501
xor eax, eax
test esi, esi
je 0xb44c82
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb9c], 0
jl 0xb44e2e
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xc960a0
push eax
push ebx
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xb44dc4
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbfc]
jne 0xb44cb9
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xb44e27
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb80], ecx
cmp word [eax], dx
jne 0xb44d2f
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xb44d2f
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xb44d2f
cmp dword [edx], 0x4550
jne 0xb44d2f
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc50]
je 0xb44d3c
cmp ax, word [ebp - 0xc54]
je 0xb44d3c
mov ecx, 0xc000000d
jmp 0xb44d34
mov ecx, 0xc000007b
mov dword [ebp - 0xb80], ecx
jmp 0xb44d4e
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xb48], eax
test eax, eax
je 0xb44db8
mov edx, esi
mov dword [ebp - 0xb04], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb0c], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xb44d70
sub edx, dword [ebp - 0xb0c]
inc esi
add esi, edx
test ecx, ecx
js 0xb44da9
push dword [ebp - 0xb04]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xb44dc4
mov ecx, dword [ebp - 0xbd4]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xb80]
inc dword [ebp - 0xbd4]
inc ebx
cmp ebx, dword [ebp - 0xb48]
jb 0xb44d5f
add edi, 0x10
cmp byte [esi], 0
jne 0xb44cb2
mov ebx, dword [ebp - 0xb80]
mov esi, dword [ebp - 0xb54]
test esi, esi
je 0xb44de5
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb44e3b
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb44dfe
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb44ded
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xb44e48
mov ebx, 0xc000007a
jmp 0xb44dca
mov esi, dword [ebp - 0xb54]
mov ebx, 0xc000007a
jmp 0xb44dd0
mov eax, dword [0xc95890]
inc eax
xor ebx, ebx
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
mov eax, ebx
mov dword [ebp - 0xb48], ebx
mov dword [ebp - 0xb0c], eax
mov edi, ebx
mov eax, dword fs:[0x30]
mov dword [ebp - 0xb04], ebx
cmp dword [eax + 0x1d4], ebx
je 0xb4513e
mov esi, dword [0xc93088]
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0xb24], ecx
test ecx, ecx
jne 0xb44ea0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb45186
mov eax, ebx
mov esi, ebx
mov dword [ebp - 0xb0c], eax
mov ebx, dword [0xc93098]
lea edx, [ebp - 0xc58]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xb44f2f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xb44f11
xor eax, eax
test esi, esi
jne 0xb44f0a
push dword [ebp - 0xc58]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xb44f03
mov eax, dword [ebp - 0xc58]
mov ecx, dword [ebp - 0xb24]
jmp 0xb44eaa
mov ebx, 0x8007000e
jmp 0xb44f2b
mov ebx, 0x80004005
jmp 0xb44f3f
test eax, eax
jne 0xb44f1c
mov ebx, 0x80004005
jmp 0xb44f2b
jg 0xb44f22
mov ebx, eax
jmp 0xb44f2b
movzx ebx, ax
or ebx, 0x80070000
xor eax, eax
jmp 0xb44f3f
mov ebx, dword [ebp - 0xb0c]
xor eax, eax
mov dword [ebp - 0xb48], esi
mov esi, eax
test esi, esi
je 0xb44f52
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb45165
mov esi, dword [0xc93094]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0xb24], ecx
test ecx, ecx
jne 0xb44fa4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb44f94
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb45165
mov ebx, 0x80004005
jmp 0xb45165
xor edx, edx
mov eax, edx
mov esi, edx
mov dword [ebp - 0xb0c], eax
mov ebx, dword [0xc93098]
lea edx, [ebp - 0xc5c]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xb45041
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xb4501d
xor eax, eax
test esi, esi
jne 0xb45010
push dword [ebp - 0xc5c]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xb45009
mov eax, dword [ebp - 0xc5c]
mov ecx, dword [ebp - 0xb24]
jmp 0xb44fb0
mov ebx, 0x8007000e
jmp 0xb45037
mov ebx, 0x80004005
mov dword [ebp - 0xb0c], ebx
jmp 0xb4504d
test eax, eax
jne 0xb45028
mov ebx, 0x80004005
jmp 0xb45037
jg 0xb4502e
mov ebx, eax
jmp 0xb45037
movzx ebx, ax
or ebx, 0x80070000
mov dword [ebp - 0xb0c], ebx
xor eax, eax
jmp 0xb4504d
mov ebx, dword [ebp - 0xb0c]
xor eax, eax
mov edi, esi
mov esi, eax
test esi, esi
je 0xb45060
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb4514a
mov eax, dword [ebp - 0xb48]
test eax, eax
je 0xb4513e
push 4
mov ecx, 0x9fb9c0
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xb450a4
test dx, dx
je 0xb4509e
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xb450a4
add eax, esi
add ecx, esi
test dx, dx
jne 0xb4507e
xor ebx, ebx
mov eax, ebx
jmp 0xb450ab
sbb eax, eax
or eax, 1
xor ebx, ebx
test eax, eax
jne 0xb4513e
test edi, edi
je 0xb4513e
mov ecx, 0x9f98b0
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xb450e6
test dx, dx
je 0xb450e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xb450e6
add eax, esi
add ecx, esi
test dx, dx
jne 0xb450c2
mov eax, ebx
jmp 0xb450eb
sbb eax, eax
or eax, 1
test eax, eax
jne 0xb4513e
push esi
lea eax, [ebp - 0xbc8]
mov dword [ebp - 0xbc8], ebx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
jne 0xb45130
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb45127
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb45150
mov ebx, 0x80004005
jmp 0xb45150
test byte [ebp - 0xbc8], 0xf
jne 0xb4513e
xor eax, eax
inc eax
jmp 0xb45144
mov eax, dword [ebp - 0xb04]
mov dword [ebp - 0xc3c], eax
mov ebx, dword [ebp - 0xb0c]
test edi, edi
je 0xb45165
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb48]
test eax, eax
je 0xb45180
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb4518e
xor ebx, ebx
mov dword [ebp - 0xc3c], ebx
jmp 0xb45190
xor ebx, ebx
push 4
pop eax
push eax
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0xb48], esi
test esi, esi
jne 0xb45261
mov ebx, 0x8007000e
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0xc38], eax
xor edx, edx
mov edi, 0xc96238
lea ecx, [edx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xb451c4
mov eax, dword [0xc95890]
push 0
pop edx
test eax, eax
jle 0xb45229
sub eax, 1
mov dword [0xc95890], eax
jne 0xb45229
mov edi, edx
mov eax, dword [edi + 0xc960a0]
test eax, eax
je 0xb451fa
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xb451e9
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xb48]
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
test esi, esi
je 0xb4523d
push esi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, dword [ebp - 0xc0c]
test ebx, ebx
jns 0xaa5dff
cmp ebx, 0xd0000034
jne 0xb4ec47
mov ebx, 0xc004f012
jmp 0xb4ec81
mov eax, ebx
mov dword [ebp - 0xb04], ebx
mov dword [ebp - 0xb24], eax
lea edi, [ebp - 0xe00]
mov dword [ebp - 0xdec], eax
xor eax, eax
stosd dword es:[edi], eax
mov dword [ebp - 0xb0c], ebx
mov dword [ebp - 0xb88], ebx
mov dword [ebp - 0xb84], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb34], eax
mov dword [ebp - 0xb9c], 0x38
test eax, eax
jne 0xb452ce
mov ebx, 0xc0000017
jmp 0xb452c3
mov ebx, eax
mov dword [ebp - 0xb54], ebx
jmp 0xb480ce
push 0x28
pop ecx
mov esi, 0xc94ea0
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, eax
mov dword [ebp - 0xb04], edi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb80], ecx
test ecx, ecx
jne 0xb45324
mov ebx, 0xc0000017
jmp 0xb4530b
mov ebx, 0xc000003e
mov dword [ebp - 0xb54], ebx
jmp 0xb45319
mov esi, dword [ebp - 0xc68]
mov esi, dword [ebp - 0xb48]
jmp 0xb480d4
mov eax, dword [0xc94e98]
mov dword [ecx], eax
mov eax, dword [0xc94e9c]
mov dword [ecx + 4], eax
mov dword [ebp - 0xb0c], ecx
rdtsc
mov dword [ebp - 0xbd4], eax
mov dword [ebp - 0xb18], edx
lea eax, [ebp - 0xc64]
mov dword [ebp - 0xc60], ebx
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov esi, dword [ebp - 0xc64]
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45313
lea eax, [ebp - 0xc60]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb54], ebx
jl 0xb45319
lea eax, [ebp - 0xc74]
mov edx, 0xa0
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45319
mov esi, dword [ebp - 0xc74]
mov ecx, dword [ebp - 0xc60]
lea eax, [ebp - 0xc60]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb54], ebx
jl 0xb45319
lea eax, [ebp - 0xbf4]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45319
mov esi, dword [ebp - 0xbf4]
mov ecx, dword [ebp - 0xc60]
lea eax, [ebp - 0xc60]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb54], ebx
jl 0xb45319
lea eax, [ebp - 0xc78]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45319
mov esi, dword [ebp - 0xc78]
mov ecx, dword [ebp - 0xc60]
lea eax, [ebp - 0xc60]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb54], ebx
jl 0xb45319
lea eax, [ebp - 0xc80]
mov edx, SysReAllocString
push eax
mov ecx, 0x9fcddc
call fcn.00a41606
test eax, eax
js 0xb45306
mov edx, dword [ebp - 0xc80]
lea eax, [ebp - 0xc90]
push eax
inc edx
push 4
pop eax
mov dword [ebp - 0xc80], edx
mov ecx, eax
add edx, edx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45319
mov esi, dword [ebp - 0xc90]
mov ecx, dword [ebp - 0xc60]
lea eax, [ebp - 0xc60]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb54], ebx
jl 0xb45319
lea eax, [ebp - 0xc94]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45319
mov esi, dword [ebp - 0xc94]
mov ecx, dword [ebp - 0xc60]
lea eax, [ebp - 0xc60]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb54], ebx
jl 0xb45319
lea eax, [ebp - 0xc98]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45319
mov esi, dword [ebp - 0xc98]
mov ecx, dword [ebp - 0xc60]
lea eax, [ebp - 0xc60]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb54], ebx
jl 0xb45319
push dword [ebp - 0xc60]
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xae8], edi
test edi, edi
jne 0xb455f2
mov ebx, 0xc0000017
jmp 0xb455e1
mov ecx, dword [ebp - 0xaf8]
mov ebx, 0x8007007a
mov dword [ebp - 0xc38], ecx
mov dword [ebp - 0xb54], ebx
mov esi, dword [ebp - 0xb48]
jmp 0xb480ce
mov eax, edi
mov dword [ebp - 0xb24], eax
mov dword [ebp - 0xdec], eax
xor eax, eax
mov esi, eax
mov dword [ebp - 0xae4], esi
mov dword [ebp - 0xca4], eax
mov dword [ebp - 0xca8], edi
push 4
pop ecx
lea eax, [ebp - 0xdcc]
mov dword [ebp - 0xdd0], ecx
mov edx, ecx
mov ecx, edi
push eax
call fcn.00a32533
mov ebx, eax
xor edx, edx
mov dword [ebp - 0xb54], ebx
mov ecx, edx
test ebx, ebx
js 0xb455e7
mov ecx, dword [ebp - 0xc60]
lea eax, [edi + 8]
add ecx, edi
cmp eax, ecx
ja 0xb456b4
push 4
pop eax
mov dword [edi], eax
mov eax, dword [ebp - 0xdcc]
mov dword [eax], edx
xor eax, eax
lea esi, [eax + 1]
mov dword [ebp - 0xae4], esi
lea ecx, [eax + 1]
test ebx, ebx
js 0xb455e7
mov dword [ebp - 0xab4], edx
mov eax, edi
mov dword [ebp - 0xcac], eax
test ecx, ecx
je 0xb45707
mov edx, dword [eax]
lea ecx, [ebp - 0xcd4]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb456be
mov eax, dword [ebp - 0xcd4]
mov dword [ebp - 0xcd8], eax
jmp 0xb456c4
mov ebx, 0xc0000023
jmp 0xb455e1
mov eax, dword [ebp - 0xcd8]
test ebx, ebx
js 0xb455e7
lea ecx, [ebp - 0xcac]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xcac]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb455e7
mov eax, dword [ebp - 0xab4]
inc eax
mov dword [ebp - 0xab4], eax
cmp eax, esi
mov eax, dword [ebp - 0xcac]
jb 0xb45687
lea ecx, [ebp - 0xda4]
mov dword [ebp - 0xda8], 0xa0
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb455e7
mov edx, dword [ebp - 0xcac]
mov ecx, dword [ebp - 0xc60]
add ecx, edi
lea eax, [edx + 0xa4]
cmp eax, ecx
ja 0xb456b4
mov esi, dword [ebp - 0xb34]
mov edi, dword [ebp - 0xda4]
push 0x28
pop ecx
mov dword [edx], 0xa0
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xae4]
mov edi, dword [ebp - 0xae8]
inc esi
mov dword [ebp - 0xae4], esi
test ebx, ebx
js 0xb455e7
xor ecx, ecx
mov eax, edi
mov dword [ebp - 0xcdc], eax
mov dword [ebp - 0xab4], ecx
test esi, esi
je 0xb4580c
mov edx, dword [eax]
lea ecx, [ebp - 0xce0]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb457c3
mov eax, dword [ebp - 0xce0]
mov dword [ebp - 0xce4], eax
jmp 0xb457c9
mov eax, dword [ebp - 0xce4]
test ebx, ebx
js 0xb455e7
lea ecx, [ebp - 0xcdc]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xcdc]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb455e7
mov eax, dword [ebp - 0xab4]
inc eax
mov dword [ebp - 0xab4], eax
cmp eax, esi
mov eax, dword [ebp - 0xcdc]
jb 0xb45796
lea ecx, [ebp - 0xdac]
mov dword [ebp - 0xdb0], 8
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb455e7
mov edx, dword [ebp - 0xcdc]
mov ecx, dword [ebp - 0xc60]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xb456b4
mov ecx, dword [ebp - 0xdac]
inc esi
mov dword [edx], 8
mov edx, dword [ebp - 0xb80]
mov dword [ebp - 0xae4], esi
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
test ebx, ebx
js 0xb455e7
mov eax, dword [ebp - 0xbd4]
xor ecx, ecx
mov dword [ebp - 0xdc8], eax
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0xdc4], eax
mov eax, edi
mov dword [ebp - 0xce8], eax
mov dword [ebp - 0xab4], ecx
test esi, esi
je 0xb4591f
mov edx, dword [eax]
lea ecx, [ebp - 0xcec]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb458d6
mov eax, dword [ebp - 0xcec]
mov dword [ebp - 0xcf0], eax
jmp 0xb458dc
mov eax, dword [ebp - 0xcf0]
test ebx, ebx
js 0xb455e7
lea ecx, [ebp - 0xce8]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xce8]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb455e7
mov eax, dword [ebp - 0xab4]
inc eax
mov dword [ebp - 0xab4], eax
cmp eax, esi
mov eax, dword [ebp - 0xce8]
jb 0xb458a9
lea ecx, [ebp - 0xde4]
mov dword [ebp - 0xde8], 8
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb455e7
mov edx, dword [ebp - 0xce8]
mov ecx, dword [ebp - 0xc60]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xb456b4
mov eax, dword [ebp - 0xde4]
inc esi
mov ecx, dword [ebp - 0xbd4]
mov dword [edx], 8
mov dword [ebp - 0xae4], esi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xb18]
mov dword [eax + 4], ecx
test ebx, ebx
js 0xb455e7
lea eax, [ebp - 0xcf4]
mov edx, SysReAllocString
push eax
mov ecx, 0x9fcddc
call fcn.00a41606
test eax, eax
jns 0xb459b5
mov ebx, 0xc000003e
jmp 0xb455e1
mov ecx, dword [ebp - 0xcf4]
lea eax, [ebp - 0xcf4]
push eax
xor eax, eax
lea edx, [eax + 1]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb455e7
mov eax, dword [ebp - 0xcf4]
add eax, eax
mov dword [ebp - 0xab4], eax
je 0xb45af2
xor ecx, ecx
mov eax, edi
mov dword [ebp - 0xcf8], eax
mov dword [ebp - 0xae8], ecx
test esi, esi
je 0xb45a7a
mov edx, dword [eax]
lea ecx, [ebp - 0xcfc]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45a31
mov eax, dword [ebp - 0xcfc]
mov dword [ebp - 0xd00], eax
jmp 0xb45a37
mov eax, dword [ebp - 0xd00]
test ebx, ebx
js 0xb455e7
lea ecx, [ebp - 0xcf8]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xcf8]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb455e7
mov eax, dword [ebp - 0xae8]
inc eax
mov dword [ebp - 0xae8], eax
cmp eax, esi
mov eax, dword [ebp - 0xcf8]
jb 0xb45a04
mov ecx, dword [ebp - 0xab4]
mov dword [ebp - 0xdd8], ecx
lea ecx, [ebp - 0xdd4]
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb455e7
mov eax, dword [ebp - 0xab4]
mov ecx, dword [ebp - 0xc60]
add eax, 4
mov edx, dword [ebp - 0xcf8]
add ecx, edi
add eax, edx
cmp eax, ecx
jbe 0xb45acd
mov ebx, 0xc0000023
jmp 0xb45af7
mov eax, dword [ebp - 0xab4]
push eax
push 0x9fcddc
push dword [ebp - 0xdd4]
mov dword [edx], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
inc esi
mov dword [ebp - 0xae4], esi
jmp 0xb45afd
mov ebx, 0xc000000d
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb455e7
mov eax, dword [ebp - 0xc3c]
xor ecx, ecx
mov dword [ebp - 0xd04], eax
mov eax, edi
mov dword [ebp - 0xd08], eax
mov dword [ebp - 0xab4], ecx
test esi, esi
je 0xb45b9b
mov edx, dword [eax]
lea ecx, [ebp - 0xd10]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45b52
mov eax, dword [ebp - 0xd10]
mov dword [ebp - 0xd14], eax
jmp 0xb45b58
mov eax, dword [ebp - 0xd14]
test ebx, ebx
js 0xb455e7
lea ecx, [ebp - 0xd08]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xd08]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb455e7
mov eax, dword [ebp - 0xab4]
inc eax
mov dword [ebp - 0xab4], eax
cmp eax, esi
mov eax, dword [ebp - 0xd08]
jb 0xb45b25
push 4
pop edx
lea ecx, [ebp - 0xd94]
mov dword [ebp - 0xd98], edx
push ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb455e7
mov edx, dword [ebp - 0xd08]
mov ecx, dword [ebp - 0xc60]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xb456b4
mov ecx, dword [ebp - 0xc3c]
inc esi
push 4
pop eax
mov dword [edx], eax
mov eax, dword [ebp - 0xd94]
mov dword [ebp - 0xae4], esi
mov dword [eax], ecx
test ebx, ebx
js 0xb455e7
push 4
xor ecx, ecx
mov eax, edi
mov dword [ebp - 0xd1c], eax
mov dword [ebp - 0xab4], ecx
pop ebx
mov dword [ebp - 0xd18], ebx
test esi, esi
je 0xb45c8c
mov edx, dword [eax]
lea ecx, [ebp - 0xd20]
push ecx
mov ecx, ebx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45c44
mov eax, dword [ebp - 0xd20]
mov dword [ebp - 0xd24], eax
jmp 0xb45c4a
mov eax, dword [ebp - 0xd24]
test ebx, ebx
js 0xb45cdd
lea ecx, [ebp - 0xd1c]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xd1c]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
push 4
test ebx, ebx
js 0xb45cdf
mov eax, dword [ebp - 0xab4]
inc eax
mov dword [ebp - 0xab4], eax
cmp eax, esi
mov eax, dword [ebp - 0xd1c]
pop ebx
jb 0xb45c1a
lea ecx, [ebp - 0xd9c]
mov dword [ebp - 0xda0], ebx
push ecx
mov edx, ebx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45cdd
mov edx, dword [ebp - 0xd1c]
mov ecx, dword [ebp - 0xc60]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xb456b4
mov eax, dword [ebp - 0xd9c]
inc esi
push 4
pop ecx
mov dword [edx], ecx
mov dword [eax], ecx
mov dword [ebp - 0xae4], esi
jmp 0xb45ce0
push 4
pop ecx
test ebx, ebx
js 0xb455e7
lea eax, [ebp - 0xd28]
mov edx, ecx
push eax
call fcn.00a32533
mov esi, dword [ebp - 0xd28]
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
jns 0xb45d13
mov esi, dword [ebp - 0xd2c]
jmp 0xb45e91
lea eax, [ebp - 0xd34]
mov dword [ebp - 0xd30], esi
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45e91
mov esi, dword [ebp - 0xd34]
mov ecx, dword [ebp - 0xd30]
lea eax, [ebp - 0xd30]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45e91
lea eax, [ebp - 0xd38]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45e91
mov esi, dword [ebp - 0xd38]
mov ecx, dword [ebp - 0xd30]
lea eax, [ebp - 0xd30]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45e91
lea eax, [ebp - 0xd3c]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45e91
mov esi, dword [ebp - 0xd3c]
mov ecx, dword [ebp - 0xd30]
lea eax, [ebp - 0xd30]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45e91
lea eax, [ebp - 0xd40]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45e91
mov esi, dword [ebp - 0xd40]
mov ecx, dword [ebp - 0xd30]
lea eax, [ebp - 0xd30]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45e91
lea eax, [ebp - 0xba0]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb45e91
mov esi, dword [ebp - 0xba0]
mov ecx, dword [ebp - 0xd30]
lea eax, [ebp - 0xd30]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0xd30]
mov dword [ebp - 0xb54], ebx
test ebx, ebx
jns 0xb45e97
mov eax, dword [ebp - 0xba0]
mov dword [ebp - 0xab4], eax
test ebx, ebx
js 0xb455e7
xor ecx, ecx
rdtsc
mov esi, ecx
mov dword [ebp - 0xae8], ecx
mov dword [ebp - 0xb34], esi
mov dword [ebp - 0xb80], ecx
mov dword [ebp - 0xaec], ecx
mov dword [ebp - 0xadc], ecx
mov dword [ebp - 0xad8], ecx
mov dword [ebp - 0xabc], ecx
mov dword [ebp - 0xacc], ecx
mov dword [ebp - 0xad0], ecx
mov dword [ebp - 0xb4c], ecx
mov dword [ebp - 0xb54], eax
mov dword [ebp - 0xad4], edx
push 8
pop ecx
mov dword [ebp - 0xd44], ecx
mov edx, dword [ebp - 0xc60]
lea eax, [ebp - 0xd44]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb4600c
mov eax, dword [ebp - 0xd44]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0xac8], ecx
cmp ecx, eax
jae 0xb45f38
mov ebx, 0xc0000095
jmp 0xb4600c
mov dword [ebp - 0xd44], ecx
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xb45f5e
mov ebx, 0xc0000017
jmp 0xb46006
mov eax, dword [ebp - 0xae4]
mov ecx, esi
mov dword [esi], eax
lea eax, [ebp - 0xd48]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xd48], esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb45ff1
mov ecx, dword [ebp - 0xd48]
mov eax, dword [ebp - 0xc60]
mov dword [ecx], eax
lea eax, [ebp - 0xd48]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb45ff1
mov eax, dword [ebp - 0xac8]
push dword [ebp - 0xc60]
mov ecx, dword [ebp - 0xb54]
push edi
push dword [ebp - 0xd48]
mov dword [esi + eax - 8], ecx
mov ecx, dword [ebp - 0xad4]
mov dword [esi + eax - 4], ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xac8]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xae8], esi
mov esi, ecx
mov dword [ebp - 0xb34], eax
jmp 0xb45ff3
xor ecx, ecx
test esi, esi
je 0xb46006
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xb34]
or ebx, 0x10000000
mov dword [ebp - 0xb54], ebx
jl 0xb479ea
xor eax, eax
mov dword [ebp - 0xac8], eax
cmp dword [ebp - 0xae8], eax
jne 0xb46038
mov ebx, 0xc000000d
jmp 0xb4666f
test esi, esi
je 0xb4666a
lea ebx, [esi + 8]
push ebx
push eax
mov dword [ebp - 0xad4], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xb54], edi
test edi, edi
je 0xb4666a
xor eax, eax
mov cl, al
mov edx, eax
test esi, esi
je 0xb46080
mov eax, dword [ebp - 0xae8]
xor cl, byte [edx + eax]
inc edx
cmp edx, esi
jb 0xb46078
mov eax, 0xb1b54a58
mov dword [ebp - 0x370], eax
mov eax, 0xc81ecb17
mov dword [ebp - 0x36c], eax
mov eax, esi
shr eax, 3
mov dword [ebp - 0xac0], eax
test eax, eax
je 0xb46497
movzx edx, word [ebp - 0x36e]
mov eax, 0xc81ecb17
movzx esi, ax
add edi, 7
movzx eax, word [ebp - 0x36a]
mov dword [ebp - 0xac4], eax
mov eax, 0xb1b54a58
movzx eax, ax
mov dword [ebp - 0xab8], esi
mov esi, dword [ebp - 0xae8]
mov dword [ebp - 0xaf0], eax
add esi, 2
xor eax, eax
mov dword [ebp - 0xaf4], edx
mov dword [ebp - 0xb08], edi
mov edx, eax
mov dword [ebp - 0xb10], esi
or ebx, 0xffffffff
mov dword [ebp - 0xaf8], eax
mov dword [ebp - 0xae0], eax
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xb10]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xb10]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xb10]
shl esi, 8
add dword [ebp - 0xb10], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov eax, ebx
sub eax, dword [ebp - 0xaf0]
xor eax, edi
xor eax, edx
xor eax, 0xc81ecb17
mov edx, eax
mov dword [ebp - 0xafc], eax
xor edx, 0xc81ecb17
ror eax, 7
ror edx, 0xf
imul edx, dword [ebp - 0xaf4]
add edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
mov eax, ebx
ror eax, 0xa
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [ebp - 0xab8]
sub edx, eax
mov eax, dword [ebp - 0xafc]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xafc], eax
xor edx, dword [ebp - 0xab8]
rol edx, 4
imul edx, dword [ebp - 0xac4]
rol eax, 5
add edx, eax
mov eax, 0xc81ecb17
xor ebx, edx
mov edx, 0xb1b54a58
xor edx, ebx
sub eax, edx
mov edx, dword [ebp - 0xafc]
xor edx, eax
mov dword [ebp - 0xafc], edx
sub edx, dword [ebp - 0xaf0]
imul edx, dword [ebp - 0xaf4]
mov eax, dword [ebp - 0xafc]
shr eax, 6
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xafc]
mov eax, ebx
ror eax, 0xf
xor eax, dword [ebp - 0xab8]
imul eax, dword [ebp - 0xaf0]
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [ebp - 0xac4]
imul eax, dword [ebp - 0xab8]
xor ebx, eax
mov eax, ebx
sub eax, 0xc81ecb17
sub eax, dword [ebp - 0xaf0]
xor edx, eax
mov dword [ebp - 0xafc], edx
mov eax, dword [ebp - 0xafc]
xor eax, dword [ebp - 0xac4]
imul eax, dword [ebp - 0xaf4]
ror edx, 0xa
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xaf0]
rol edx, 6
imul edx, dword [ebp - 0xab8]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0xafc]
xor eax, edx
mov dword [ebp - 0xafc], eax
ror eax, 0xf
sub eax, dword [ebp - 0xac4]
imul eax, dword [ebp - 0xaf0]
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xac4]
imul edx, dword [ebp - 0xaf0]
shr eax, 1
xor edx, eax
mov eax, ebx
xor dword [ebp - 0xafc], edx
mov edx, ebx
sub edx, dword [ebp - 0xab8]
rol edx, 3
imul edx, dword [ebp - 0xaf0]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0xafc]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xafc], eax
sub edx, dword [ebp - 0xab8]
imul edx, dword [ebp - 0xaf4]
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 9
imul edx, dword [ebp - 0xab8]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0xafc]
xor eax, edx
mov dword [ebp - 0xafc], eax
sub eax, 0xb1b54a58
sub eax, dword [ebp - 0xac4]
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xaf4]
imul eax, dword [ebp - 0xaf0]
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0xafc]
xor edx, eax
mov dword [ebp - 0xafc], edx
xor edx, dword [ebp - 0xac4]
mov eax, dword [ebp - 0xafc]
rol edx, 4
imul edx, dword [ebp - 0xaf4]
ror eax, 0x10
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 0xa
imul edx, dword [ebp - 0xab8]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0xafc]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xafc], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, dword [ebp - 0xac4]
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, 0xc81ecb17
rol eax, 2
rol edx, 8
imul edx, dword [ebp - 0xaf0]
sub edx, eax
mov eax, dword [ebp - 0xafc]
xor eax, edx
mov edx, 0xc81ecb17
sub edx, eax
mov dword [ebp - 0xafc], eax
ror edx, 0xb
imul edx, dword [ebp - 0xaf4]
ror eax, 0xc
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xaf4]
imul edx, dword [ebp - 0xab8]
shr eax, 8
xor edx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xafc], edx
xor eax, ebx
mov edx, dword [ebp - 0xafc]
mov ebx, 0xc81ecb17
xor eax, edx
xor edx, dword [ebp - 0xaf8]
xor ebx, eax
mov dword [ebp - 0xaf8], edi
mov eax, dword [ebp - 0xb08]
xor ebx, dword [ebp - 0xae0]
mov dword [ebp - 0xae0], esi
mov esi, dword [ebp - 0xb10]
mov byte [eax - 4], dl
mov byte [eax], bl
ror edx, 8
mov byte [eax - 5], dl
ror ebx, 8
mov byte [eax - 1], bl
ror edx, 8
mov byte [eax - 6], dl
ror ebx, 8
mov byte [eax - 2], bl
ror edx, 8
ror ebx, 8
mov byte [eax - 7], dl
mov byte [eax - 3], bl
add eax, 8
ror edx, 8
ror ebx, 8
sub dword [ebp - 0xac0], 1
mov dword [ebp - 0xb08], eax
jne 0xb4610a
mov esi, dword [ebp - 0xb34]
mov edi, dword [ebp - 0xb54]
mov ebx, dword [ebp - 0xad4]
movzx eax, cl
cdq
mov dword [edi + esi], eax
mov dword [edi + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xafc], esi
test esi, esi
jne 0xb464c9
mov ebx, 0xc0000017
jmp 0xb465d3
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb46547
mov dword [esi + 4], eax
push ebx
push edi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [esi + 8], eax
push eax
push 8
pop ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb46547
mov dword [esi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xafc]
push ebx
push ebx
mov dword [esi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, dword [ebp - 0xb54]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xb46550
mov ebx, 0xc0000017
jmp 0xb4656c
mov ebx, 0xc0000017
xor edx, edx
jmp 0xb4656c
mov dword [esi + 0x14], ecx
mov ebx, edx
mov eax, dword [0xc94e90]
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ebp - 0xac8], esi
mov esi, edx
mov dword [ecx + 4], eax
test esi, esi
je 0xb465d3
cmp dword [esi + 4], 0
je 0xb4658c
push dword [esi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 4], edx
cmp dword [esi + 0xc], 0
je 0xb465a8
push dword [esi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0xc], edx
cmp dword [esi + 0x14], 0
je 0xb465c4
push dword [esi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0x14], edx
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb465e9
mov eax, dword [ebp - 0xac8]
mov dword [ebp - 0xb80], eax
xor eax, eax
mov esi, eax
jmp 0xb465f1
mov esi, dword [ebp - 0xac8]
xor eax, eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
je 0xb4666f
xor eax, eax
cmp dword [esi + 4], eax
je 0xb46621
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xb4663d
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xb46659
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb4666f
mov ebx, 0xc0000001
mov esi, 0x10000000
or ebx, esi
mov dword [ebp - 0xb54], ebx
jl 0xb479ea
mov esi, dword [ebp - 0xb80]
lea eax, [ebp - 0xd4c]
push 4
pop edi
push eax
mov edx, dword [esi]
mov ecx, edi
mov dword [ebp - 0xd4c], edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb46717
mov ecx, dword [ebp - 0xd4c]
lea eax, [ebp - 0xd4c]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb46717
mov edx, dword [esi + 8]
lea eax, [ebp - 0xd4c]
mov ecx, dword [ebp - 0xd4c]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb46717
mov ecx, dword [ebp - 0xd4c]
lea eax, [ebp - 0xd4c]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb46717
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0xd4c]
mov ecx, dword [ebp - 0xd4c]
push eax
call fcn.00a32533
mov edi, dword [ebp - 0xd4c]
mov ebx, eax
test ebx, ebx
jns 0xb46725
mov edi, dword [ebp - 0xd0c]
test ebx, ebx
js 0xb4688e
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xb46745
mov ebx, 0xc0000017
jmp 0xb4688e
mov eax, dword [ebp - 0xb80]
mov ecx, esi
mov dword [ebp - 0xd50], esi
mov eax, dword [eax]
mov dword [esi], eax
lea eax, [ebp - 0xd50]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb46879
mov ebx, dword [ebp - 0xb80]
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0xd50]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx]
lea eax, [ebp - 0xd50]
mov ecx, dword [ebp - 0xd50]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb46879
mov eax, dword [ebp - 0xb80]
mov ecx, dword [ebp - 0xd50]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xd50]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb46879
mov ebx, dword [ebp - 0xb80]
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0xd50]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xd50]
mov ecx, dword [ebp - 0xd50]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb46879
mov eax, dword [ebp - 0xb80]
mov ecx, dword [ebp - 0xd50]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xd50]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb46879
mov ebx, dword [ebp - 0xb80]
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0xd50]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xd50]
mov ecx, dword [ebp - 0xd50]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
xor eax, eax
test ebx, ebx
js 0xb4687b
mov dword [ebp - 0xaec], esi
mov esi, eax
mov dword [ebp - 0xadc], edi
jmp 0xb4687b
xor eax, eax
test esi, esi
je 0xb4688e
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, 0x10000000
or ebx, esi
mov dword [ebp - 0xb54], ebx
jl 0xb479ea
xor eax, eax
mov dword [ebp - 0xd54], 8
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0xae0], eax
mov edx, dword [ebp - 0xab4]
lea eax, [ebp - 0xd54]
push eax
push 8
pop ecx
call fcn.00a32533
mov ebx, eax
or ebx, esi
mov dword [ebp - 0xb54], ebx
jl 0xb469fb
mov eax, dword [ebp - 0xd54]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xb468fb
mov ebx, 0xc0000095
mov dword [ebp - 0xb54], ebx
jmp 0xb46922
mov dword [ebp - 0xd5c], ecx
lea eax, [ebp - 0xd5c]
push eax
push 8
pop edx
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0xd5c]
mov dword [ebp - 0xb54], ebx
test ebx, ebx
jns 0xb46928
mov eax, dword [ebp - 0xd58]
mov dword [ebp - 0xaf8], eax
test ebx, ebx
js 0xb46bb7
mov eax, dword [ebp - 0xb24]
xor edi, edi
inc edi
test eax, eax
je 0xb46a34
mov esi, dword [ebp - 0xae4]
cmp esi, edi
jbe 0xb46a34
mov ecx, eax
xor eax, eax
mov dword [ebp - 0xd60], ecx
mov edi, eax
mov eax, dword [ecx]
mov dword [ebp - 0xb10], eax
lea eax, [ebp - 0xd60]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb469fb
mov edx, dword [ebp - 0xb10]
lea eax, [ebp - 0xd60]
mov ecx, dword [ebp - 0xd60]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb469fb
mov ecx, dword [ebp - 0xd60]
xor eax, eax
inc edi
inc eax
cmp edi, eax
jb 0xb46961
mov edi, dword [ecx]
lea eax, [ebp - 0xd60]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb469fb
mov dword [ebp - 0xafc], edi
neg edi
sbb edi, edi
and dword [ebp - 0xd60], edi
test ebx, ebx
js 0xb469fb
cmp esi, 2
ja 0xb46a41
mov ebx, 0xc000000d
mov dword [ebp - 0xb54], ebx
xor edi, edi
inc edi
mov esi, dword [ebp - 0xabc]
test ebx, ebx
js 0xb479ea
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xb46bc5
mov ecx, dword [ebp - 0xad8]
mov ebx, 0xd0000017
jmp 0xb46bd2
mov ebx, 0xc000000d
mov dword [ebp - 0xb54], ebx
jmp 0xb469fe
mov ecx, dword [ebp - 0xb24]
xor eax, eax
mov dword [ebp - 0xd64], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xd64]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb46ac9
mov ecx, dword [ebp - 0xd64]
lea eax, [ebp - 0xd64]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb46ac9
mov ecx, dword [ebp - 0xd64]
inc esi
cmp esi, 2
jb 0xb46a51
mov esi, dword [ecx]
lea eax, [ebp - 0xd64]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb46ac9
mov edi, esi
neg esi
sbb esi, esi
and dword [ebp - 0xd64], esi
jmp 0xb46acf
mov edi, dword [ebp - 0xae0]
test ebx, ebx
js 0xb469fb
mov edx, dword [ebp - 0xaf8]
lea eax, [ebp - 0xd68]
push 4
pop esi
push eax
mov ecx, esi
mov dword [ebp - 0xd68], esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb46b8e
mov ecx, dword [ebp - 0xd68]
lea eax, [ebp - 0xd68]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb46b8e
mov edx, dword [ebp - 0xafc]
lea eax, [ebp - 0xd68]
mov ecx, dword [ebp - 0xd68]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb46b8e
mov ecx, dword [ebp - 0xd68]
lea eax, [ebp - 0xd68]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb46b8e
mov ecx, dword [ebp - 0xd68]
lea eax, [ebp - 0xd68]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0xd68]
mov dword [ebp - 0xb54], ebx
test ebx, ebx
jns 0xb46b9c
mov eax, dword [ebp - 0xd6c]
test ebx, ebx
js 0xb469fb
cmp eax, 0x400000
jbe 0xb46bad
mov ebx, 0x8000ffff
jmp 0xb479e4
mov esi, eax
mov dword [ebp - 0xabc], esi
jmp 0xb46bbd
mov esi, dword [ebp - 0xabc]
xor edi, edi
inc edi
jmp 0xb46a04
mov ecx, eax
mov dword [ebp - 0xad8], eax
mov ebx, 0x10000000
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb479ea
mov eax, dword [ebp - 0xaec]
test eax, eax
je 0xb46c50
test ecx, ecx
je 0xb46c50
mov dword [ebp - 0xe78], eax
xor ebx, ebx
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0xe70], eax
lea eax, [ebp - 0xd70]
push eax
push 0x9f29b8
push edi
mov dword [ebp - 0xe74], ecx
mov dword [ebp - 0xe6c], esi
mov dword [ebp - 0xe68], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xb46c80
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
jle 0xb46c71
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xb54], ebx
test ebx, ebx
jmp 0xb46c71
mov ebx, 0x80070057
jmp 0xb479e4
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xb54], ebx
test ebx, ebx
mov esi, dword [ebp - 0xabc]
js 0xb46ce8
mov ebx, 0x80004005
mov dword [ebp - 0xb54], ebx
jmp 0xb46ce8
push 0x9fc030
push dword [ebp - 0xd70]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0xb46cab
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
jle 0xb46c6b
jmp 0xb46c5a
push ebx
push 0x14
lea eax, [ebp - 0xe78]
mov ecx, esi
push eax
push 0x86
call dword [0xc99200]
call esi
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb54], ebx
jl 0xb46ce2
mov esi, dword [ebp - 0xe6c]
mov dword [ebp - 0xabc], esi
jmp 0xb46ce8
mov esi, dword [ebp - 0xabc]
cmp ebx, 0xd0000023
jne 0xb46cfa
mov ebx, 0x8007007a
jmp 0xb479e4
test ebx, ebx
js 0xb479ea
mov eax, dword [ebp - 0xad8]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xd74], ecx
mov edi, ecx
mov dword [ebp - 0xb8c], eax
cmp esi, edx
jae 0xb46d29
mov ebx, 0xc000003e
jmp 0xb47105
mov esi, dword [eax]
lea ecx, [ebp - 0xb8c]
push ecx
mov ecx, eax
mov dword [ebp - 0xafc], esi
call fcn.00a32533
mov ebx, eax
xor ecx, ecx
test ebx, ebx
js 0xb47105
lea eax, [ebp - 0xd74]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb47103
mov eax, dword [ebp - 0xabc]
sub eax, dword [ebp - 0xd74]
cmp eax, esi
jb 0xb46f4b
mov eax, dword [ebp - 0xb8c]
lea ecx, [ebp - 0xb8c]
push ecx
mov edx, esi
mov dword [ebp - 0xae0], eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb47103
mov ecx, dword [ebp - 0xd74]
lea eax, [ebp - 0xd74]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb47103
mov eax, dword [ebp - 0xabc]
sub eax, dword [ebp - 0xd74]
push 4
pop edx
cmp eax, edx
jb 0xb46f4b
mov ecx, dword [ebp - 0xb8c]
lea eax, [ebp - 0xb8c]
push eax
mov esi, dword [ecx]
mov dword [ebp - 0xaf8], esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb47103
mov ecx, dword [ebp - 0xd74]
lea eax, [ebp - 0xd74]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb47103
mov eax, dword [ebp - 0xabc]
sub eax, dword [ebp - 0xd74]
cmp eax, esi
jb 0xb46f4b
mov eax, dword [ebp - 0xb8c]
lea ecx, [ebp - 0xb8c]
push ecx
mov edx, esi
mov dword [ebp - 0xb10], eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb47103
mov ecx, dword [ebp - 0xd74]
lea eax, [ebp - 0xd74]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb47103
mov eax, dword [ebp - 0xabc]
sub eax, dword [ebp - 0xd74]
push 4
pop edx
cmp eax, edx
jb 0xb46f4b
mov ecx, dword [ebp - 0xb8c]
mov eax, dword [ecx]
mov dword [ebp - 0xb08], eax
lea eax, [ebp - 0xb8c]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb47103
mov ecx, dword [ebp - 0xd74]
lea eax, [ebp - 0xd74]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb47103
mov eax, dword [ebp - 0xabc]
sub eax, dword [ebp - 0xd74]
mov ecx, dword [ebp - 0xb08]
cmp eax, ecx
jb 0xb46f4b
lea eax, [ebp - 0xd74]
mov edx, ecx
mov ecx, dword [ebp - 0xd74]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb47103
mov edx, dword [ebp - 0xabc]
mov eax, edx
sub eax, dword [ebp - 0xd74]
jne 0xb46f4b
mov ebx, dword [ebp - 0xafc]
mov ecx, dword [ebp - 0xb08]
add ecx, 0xc
lea eax, [esi + ebx]
add eax, ecx
cmp eax, edx
jne 0xb46f4b
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xb46f55
mov ebx, 0xc0000017
jmp 0xb4708e
mov ebx, 0xc000003e
jmp 0xb47103
cmp dword [ebp - 0xae0], edi
je 0xb46f96
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb46f8a
mov dword [esi + 4], eax
push ebx
push dword [ebp - 0xae0]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb46f9d
mov ebx, 0xc0000017
xor eax, eax
jmp 0xb47027
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
cmp dword [ebp - 0xb10], edi
je 0xb46fd9
mov ebx, dword [ebp - 0xaf8]
push ebx
push 8
mov dword [esi + 8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb46f8a
mov dword [esi + 0xc], eax
push ebx
push dword [ebp - 0xb10]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb46fdf
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
cmp dword [ebp - 0xb8c], edi
je 0xb4701b
mov ebx, dword [ebp - 0xb08]
push ebx
push 8
mov dword [esi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb46f8a
mov dword [esi + 0x14], eax
push ebx
push dword [ebp - 0xb8c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb47021
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov edi, esi
mov ebx, eax
mov esi, eax
test esi, esi
je 0xb4708e
cmp dword [esi + 4], 0
je 0xb47047
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xb47063
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xb4707f
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test ebx, ebx
js 0xb4709c
mov dword [ebp - 0xacc], edi
mov edi, ecx
test edi, edi
je 0xb47105
cmp dword [edi + 4], 0
je 0xb470bc
push dword [edi + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 4], ecx
cmp dword [edi + 0xc], 0
je 0xb470d8
push dword [edi + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0xc], ecx
cmp dword [edi + 0x14], 0
je 0xb470f4
push dword [edi + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0x14], ecx
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov edi, dword [ebp - 0xacc]
or ebx, 0x10000000
mov dword [ebp - 0xb54], ebx
jl 0xb479f0
mov dword [ebp - 0xae0], ecx
mov esi, ecx
mov dword [ebp - 0xafc], esi
test edi, edi
je 0xb4714c
mov ebx, dword [edi + 4]
mov dword [ebp - 0xaf8], ebx
test ebx, ebx
je 0xb4714c
mov edi, dword [edi]
test edi, edi
jne 0xb4715c
mov ebx, 0xd000000d
jmp 0xb479e4
mov ebx, 0xd000000d
mov dword [ebp - 0xb54], ebx
jmp 0xb479f0
add edi, 0xfffffff8
mov dword [ebp - 0xb10], ecx
push edi
push ecx
mov dword [ebp - 0xb08], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xab8], eax
test eax, eax
je 0xb47753
mov esi, 0xab69605e
mov dword [ebp - 0xaf4], ebx
mov dword [ebp - 0x368], esi
xor ecx, ecx
mov esi, 0x7f1137f
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0x364], esi
mov dl, cl
mov esi, edi
mov dword [ebp - 0xac8], ecx
and esi, 7
je 0xb472e1
mov dword [ebp - 0xac4], ecx
mov eax, ecx
mov dword [ebp - 0xac0], eax
test esi, esi
je 0xb47228
mov edi, dword [ebp - 0xaf4]
push 0x38
pop ebx
movzx eax, byte [edi]
inc edi
cmp ecx, 4
jge 0xb471f0
lea ecx, [ebx - 0x20]
shl eax, cl
or dword [ebp - 0xac0], eax
jmp 0xb471fa
mov ecx, ebx
shl eax, cl
or dword [ebp - 0xac4], eax
mov ecx, dword [ebp - 0xac8]
sub ebx, 8
inc ecx
mov dword [ebp - 0xac8], ecx
cmp ecx, esi
jl 0xb471da
mov eax, edi
mov dword [ebp - 0xaf4], edi
mov edi, dword [ebp - 0xb08]
mov dword [ebp - 0xaf4], eax
mov eax, dword [ebp - 0xac0]
mov ebx, dword [ebp - 0xac4]
xor eax, 0x92f65a5
xor ebx, 0x699a899c
mov dword [ebp - 0xac8], eax
xor ecx, ecx
mov dword [ebp - 0xad4], ebx
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xadc], ebx
test esi, esi
je 0xb472b0
mov edi, dword [ebp - 0xaf0]
push 4
pop ebx
lea eax, [edi + 1]
mov dword [ebp - 0xaf0], eax
cmp ecx, ebx
jge 0xb4727c
rol dword [ebp - 0xabc], 8
mov eax, dword [ebp - 0xabc]
jmp 0xb47289
rol dword [ebp - 0xadc], 8
mov eax, dword [ebp - 0xadc]
mov byte [edi], al
inc ecx
mov eax, dword [ebp - 0xaf0]
mov edi, eax
cmp ecx, esi
jl 0xb47260
mov ebx, dword [ebp - 0xad4]
mov edi, dword [ebp - 0xb08]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0xac8]
push 4
pop ecx
cmp esi, ecx
jbe 0xb472c5
push 8
pop ecx
sub ecx, esi
shl ecx, 3
shr ebx, cl
shl ebx, cl
jmp 0xb472f0
xor ecx, ecx
push 4
mov ebx, ecx
pop ecx
cmp esi, ecx
jae 0xb472f0
sub ecx, esi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xac8], eax
jmp 0xb472f0
or dword [ebp - 0xac4], 0xffffffff
mov ebx, ecx
mov dword [ebp - 0xac0], ecx
mov eax, edi
shr eax, 3
mov dword [ebp - 0xad4], eax
test eax, eax
je 0xb476db
movzx ecx, word [ebp - 0x362]
mov eax, 0x7f1137f
movzx esi, word [ebp - 0x366]
mov edi, 0xab69605e
movzx eax, ax
xor edi, 0x7f1137f
mov dword [ebp - 0xab4], ecx
mov ecx, 0xab69605e
mov dword [ebp - 0xadc], eax
movzx eax, cx
mov ecx, dword [ebp - 0xaf4]
mov dword [ebp - 0xb34], eax
mov eax, dword [ebp - 0xaf0]
add eax, 7
mov dword [ebp - 0xabc], edi
add ecx, 2
mov dword [ebp - 0xae4], esi
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xaf4], ecx
movzx edi, byte [ecx - 2]
movzx eax, byte [ecx - 1]
movzx esi, byte [ecx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ecx]
shl edi, 8
or edi, eax
add dword [ebp - 0xaf4], 8
movzx eax, byte [ecx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 3]
or esi, eax
movzx eax, byte [ecx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 5]
mov ecx, dword [ebp - 0xac8]
xor ecx, edi
shl esi, 8
mov dword [ebp - 0xac8], ecx
or esi, eax
xor ebx, esi
xor ebx, dword [ebp - 0xabc]
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, 0xab69605e
rol eax, 0xa
rol ecx, 5
imul ecx, dword [ebp - 0xadc]
add ecx, eax
mov eax, dword [ebp - 0xac8]
xor eax, ecx
mov ecx, 0x7f1137f
add ecx, eax
mov dword [ebp - 0xac8], eax
ror ecx, 9
imul ecx, dword [ebp - 0xae4]
rol eax, 2
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, dword [ebp - 0xadc]
imul ecx, dword [ebp - 0xb34]
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0xac8]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xac8], eax
xor ecx, dword [ebp - 0xae4]
rol ecx, 6
imul ecx, dword [ebp - 0xab4]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
xor ecx, 0xab69605e
sub eax, ecx
mov ecx, dword [ebp - 0xac8]
xor ecx, eax
mov dword [ebp - 0xac8], ecx
mov eax, dword [ebp - 0xac8]
xor eax, dword [ebp - 0xadc]
imul eax, dword [ebp - 0xae4]
ror ecx, 6
xor ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ebx + ecx]
ror ecx, 0xf
imul ecx, dword [ebp - 0xb34]
add ecx, eax
mov eax, dword [ebp - 0xac8]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xac8], eax
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0xab4]
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, 0xab69605e
ror eax, 0xa
ror ecx, 0xc
imul ecx, dword [ebp - 0xadc]
xor ecx, eax
mov eax, dword [ebp - 0xac8]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xac8], eax
xor ecx, dword [ebp - 0xab4]
imul ecx, dword [ebp - 0xae4]
shr eax, 0xa
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xac8]
mov eax, ebx
not eax
ror eax, 5
add eax, dword [ebp - 0xb34]
imul eax, dword [ebp - 0xab4]
xor ecx, eax
mov dword [ebp - 0xac8], ecx
mov eax, ecx
mov ecx, dword [ebp - 0xab4]
sub eax, ecx
xor eax, 0xab69605e
xor ebx, eax
xor ecx, ebx
mov eax, ebx
rol ecx, 2
imul ecx, dword [ebp - 0xadc]
shr eax, 2
add ecx, eax
mov eax, dword [ebp - 0xac8]
xor eax, ecx
mov dword [ebp - 0xac8], eax
lea ecx, [eax - 0x7f1137f]
rol eax, 7
ror ecx, 6
imul ecx, dword [ebp - 0xae4]
add ecx, eax
xor ebx, ecx
mov eax, ebx
mov ecx, ebx
xor eax, dword [ebp - 0xadc]
imul eax, dword [ebp - 0xb34]
ror ecx, 9
add ecx, eax
mov eax, dword [ebp - 0xac8]
xor eax, ecx
mov ecx, dword [ebp - 0xae4]
xor ecx, eax
mov dword [ebp - 0xac8], eax
rol ecx, 5
imul ecx, dword [ebp - 0xab4]
rol eax, 7
add ecx, eax
mov eax, 0xab69605e
xor ebx, ecx
mov ecx, 0x7f1137f
xor eax, ebx
xor eax, dword [ebp - 0xac8]
xor eax, ecx
mov dword [ebp - 0xac8], eax
ror eax, 3
sub eax, dword [ebp - 0xae4]
imul eax, dword [ebp - 0xadc]
xor ebx, eax
mov eax, 0x7f1137f
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 1
imul ecx, dword [ebp - 0xb34]
ror eax, 6
sub ecx, eax
mov eax, dword [ebp - 0xac8]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0xac8], eax
rol ecx, 3
imul ecx, dword [ebp - 0xab4]
rol eax, 0xe
add ecx, eax
xor ebx, ecx
mov ecx, 0xab69605e
mov eax, ebx
ror eax, 0xe
lea ecx, [ecx + ebx]
rol ecx, 0xf
imul ecx, dword [ebp - 0xadc]
sub ecx, eax
mov eax, dword [ebp - 0xac8]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xac8], eax
xor ecx, dword [ebp - 0xb34]
imul ecx, dword [ebp - 0xae4]
shr eax, 3
xor ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
xor ecx, eax
mov eax, ebx
xor ebx, dword [ebp - 0xac4]
rol ecx, 4
imul ecx, dword [ebp - 0xb34]
rol eax, 2
mov dword [ebp - 0xac4], esi
xor ecx, eax
mov eax, dword [ebp - 0xac8]
xor ecx, dword [ebp - 0xac0]
xor eax, ecx
mov dword [ebp - 0xac0], edi
mov ecx, dword [ebp - 0xaf0]
mov byte [ecx - 4], al
mov byte [ecx], bl
ror eax, 8
mov byte [ecx - 5], al
ror ebx, 8
mov byte [ecx - 1], bl
ror eax, 8
mov byte [ecx - 6], al
ror ebx, 8
mov byte [ecx - 2], bl
ror eax, 8
ror ebx, 8
mov byte [ecx - 7], al
mov byte [ecx - 3], bl
add ecx, 8
ror eax, 8
ror ebx, 8
sub dword [ebp - 0xad4], 1
mov dword [ebp - 0xaf0], ecx
mov ecx, dword [ebp - 0xaf4]
mov dword [ebp - 0xac8], eax
jne 0xb47368
mov edi, dword [ebp - 0xb08]
mov ecx, dword [ebp - 0xab8]
xor eax, eax
test edi, edi
je 0xb476ef
xor dl, byte [eax + ecx]
inc eax
cmp eax, edi
jb 0xb476e7
mov esi, dword [ebp - 0xaf8]
movzx eax, dl
cdq
cmp eax, dword [edi + esi]
jne 0xb47712
cmp edx, dword [edi + esi + 4]
jne 0xb47712
mov ebx, dword [ebp - 0xb10]
xor eax, eax
mov esi, ecx
mov ecx, eax
jmp 0xb47725
mov esi, dword [ebp - 0xafc]
mov ebx, 0xc004d501
mov edi, dword [ebp - 0xae0]
xor eax, eax
test ecx, ecx
je 0xb47738
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb47753
xor eax, eax
mov dword [ebp - 0xad0], esi
mov esi, eax
mov dword [ebp - 0xb4c], edi
mov ebx, 0x10000000
jmp 0xb47760
mov edi, dword [ebp - 0xb4c]
mov ebx, 0xd0000001
xor eax, eax
mov dword [ebp - 0xb54], ebx
test esi, esi
je 0xb47779
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb479ea
mov ecx, dword [ebp - 0xad0]
xor eax, eax
push 4
pop esi
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xbb8], ecx
cmp edi, esi
jb 0xb479d9
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0xafc], eax
lea eax, [ebp - 0xbb8]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb479de
lea eax, [ebp - 0xbcc]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb479de
mov eax, edi
sub eax, dword [ebp - 0xbcc]
cmp eax, esi
jb 0xb479d9
mov ecx, dword [ebp - 0xbb8]
lea eax, [ebp - 0xbb8]
push eax
mov edx, esi
mov edi, dword [ecx]
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb479de
mov ecx, dword [ebp - 0xbcc]
lea eax, [ebp - 0xbcc]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb479de
mov eax, dword [ebp - 0xb4c]
mov ecx, dword [ebp - 0xbcc]
sub eax, ecx
cmp eax, edi
jb 0xb479d9
lea eax, [ebp - 0xbcc]
mov edx, edi
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb479de
mov esi, dword [ebp - 0xbb8]
mov edx, dword [ebp - 0xb4c]
mov ebx, dword [ebp - 0xad0]
lea ecx, [edi + esi]
lea eax, [edx + ebx]
cmp eax, ecx
jb 0xb479d9
sub edx, edi
sub edx, esi
add edx, ebx
cmp edx, 8
jae 0xb479d9
xor ecx, ecx
mov dword [ebp - 0xaf8], ecx
mov eax, ecx
mov dword [ebp - 0xae0], eax
mov ebx, ecx
test esi, esi
je 0xb47970
lea eax, [ebp - 0xbb0]
mov edx, edi
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb479de
mov eax, dword [ebp - 0xbb0]
jmp 0xb47958
lea eax, [ebp - 0xbac]
mov ecx, esi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb479de
mov eax, dword [ebp - 0xbb0]
cmp dword [ebp - 0xbac], eax
ja 0xb47995
mov edx, dword [esi]
lea eax, [ebp - 0xba8]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb4791a
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xd78], eax
jmp 0xb47920
mov eax, dword [ebp - 0xd78]
test ebx, ebx
js 0xb479de
lea ecx, [ebp - 0xba4]
mov edx, eax
push ecx
mov ecx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb479de
mov esi, dword [ebp - 0xba4]
mov eax, dword [ebp - 0xbb0]
cmp esi, eax
ja 0xb47995
inc dword [ebp - 0xaf8]
cmp esi, eax
jb 0xb478c4
cmp esi, eax
jne 0xb47995
mov esi, dword [ebp - 0xbb8]
mov eax, dword [ebp - 0xae0]
test edi, edi
je 0xb479a0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xae0], eax
test eax, eax
jne 0xb4799c
mov ebx, 0xc0000017
jmp 0xb479c7
mov ebx, 0xc000000d
jmp 0xb479de
xor ecx, ecx
mov ebx, ecx
test esi, esi
je 0xb479b5
push edi
push esi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xae0]
add esp, 0xc
mov dword [ebp - 0xdf8], eax
mov eax, dword [ebp - 0xaf8]
mov dword [ebp - 0xe00], eax
test ebx, ebx
js 0xb479de
mov eax, dword [ebp - 0xafc]
cmp eax, dword [ebp - 0xe00]
je 0xb479de
mov ebx, 0xc000003e
or ebx, 0x10000000
mov dword [ebp - 0xb54], ebx
mov edi, dword [ebp - 0xacc]
mov eax, dword [ebp - 0xae8]
test eax, eax
je 0xb47a0b
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xb80]
test esi, esi
je 0xb47a79
xor eax, eax
cmp dword [esi + 4], eax
je 0xb47a32
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xb47a4e
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xb47a6a
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xaec]
test eax, eax
je 0xb47a94
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xad8]
test eax, eax
je 0xb47aaf
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xb47b17
xor eax, eax
cmp dword [edi + 4], eax
je 0xb47ad0
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xb47aec
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xb47b08
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xad0]
test eax, eax
je 0xb47b32
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb455e7
xor eax, eax
inc eax
cmp dword [ebp - 0xe00], eax
jb 0xb47b9f
cmp dword [ebp - 0xdf8], 0
je 0xb47ba9
cmp dword [ebp - 0xe00], 0
jbe 0xb47ba9
mov eax, dword [ebp - 0xdf8]
lea ecx, [ebp - 0xb50]
push ecx
push 4
pop ecx
mov esi, dword [eax]
mov edx, ecx
mov ecx, eax
mov dword [ebp - 0xb50], eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb47c28
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb50]
mov dword [ebp - 0xb50], eax
jmp 0xb47c34
mov ebx, 0xc004d501
jmp 0xb455e1
mov ebx, 0xc000000d
mov dword [ebp - 0xb54], ebx
mov eax, dword [ebp - 0xb84]
push 4
pop edx
test ebx, ebx
js 0xb455e7
cmp eax, 0xd0000023
jne 0xb47bd7
mov eax, 0x8007007a
mov dword [ebp - 0xb84], eax
cmp eax, 0x8007007a
je 0xb47bee
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test eax, eax
js 0xb455e7
cmp dword [ebp - 0xe00], 6
jne 0xb47b9f
cmp dword [ebp - 0xdf8], 0
jne 0xb47c54
mov edx, dword [ebp - 0xdb4]
mov ebx, 0xc000000d
mov ecx, dword [ebp - 0xdb8]
mov dword [ebp - 0xb54], ebx
mov dword [ebp - 0xafc], edx
mov dword [ebp - 0xae0], ecx
jmp 0xb47d28
mov esi, dword [ebp - 0xbd8]
mov eax, dword [ebp - 0xbdc]
test ebx, ebx
js 0xb47bb4
push 4
pop edx
cmp esi, edx
jne 0xb456b4
mov eax, dword [eax]
mov dword [ebp - 0xb84], eax
jmp 0xb47bbd
mov ecx, dword [ebp - 0xdf8]
xor eax, eax
mov dword [ebp - 0xb30], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xb30]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb47ce4
mov ecx, dword [ebp - 0xb30]
lea eax, [ebp - 0xb30]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb47ce4
mov ecx, dword [ebp - 0xb30]
xor eax, eax
inc esi
inc eax
cmp esi, eax
jae 0xb47cb1
push 4
pop edx
jmp 0xb47c64
mov esi, dword [ecx]
lea eax, [ebp - 0xb30]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb47ce4
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb30]
mov dword [ebp - 0xb30], eax
jmp 0xb47cf0
mov esi, dword [ebp - 0xbe0]
mov eax, dword [ebp - 0xbe4]
test ebx, ebx
js 0xb47d10
cmp esi, 8
jne 0xb456b4
mov ecx, dword [eax]
mov dword [ebp - 0xae0], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xafc], ecx
jmp 0xb47d28
mov eax, dword [ebp - 0xdb4]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0xdb8]
mov dword [ebp - 0xae0], eax
test ebx, ebx
js 0xb455e7
cmp dword [ebp - 0xdf8], 0
jne 0xb47d72
mov ebx, 0xc000000d
mov dword [ebp - 0xb54], ebx
mov eax, dword [ebp - 0xbe8]
push 4
pop edx
mov dword [ebp - 0xaf8], eax
test ebx, ebx
js 0xb455e7
cmp dword [ebp - 0xdf8], 0
jne 0xb47e26
mov ebx, 0xc000000d
jmp 0xb455e1
mov ecx, dword [ebp - 0xdf8]
xor eax, eax
mov dword [ebp - 0xb20], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xb20]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb47e00
mov ecx, dword [ebp - 0xb20]
lea eax, [ebp - 0xb20]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb47e00
mov ecx, dword [ebp - 0xb20]
inc esi
cmp esi, 2
jb 0xb47d82
mov esi, dword [ecx]
lea eax, [ebp - 0xb20]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb47e00
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb20]
mov dword [ebp - 0xb20], eax
jmp 0xb47e0c
mov esi, dword [ebp - 0xbec]
mov eax, dword [ebp - 0xbf0]
test ebx, ebx
js 0xb47d44
push 4
pop edx
cmp esi, edx
jne 0xb456b4
mov eax, dword [eax]
jmp 0xb47d4d
mov ecx, dword [ebp - 0xdf8]
xor eax, eax
mov dword [ebp - 0xb14], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xb14]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb47eba
mov ecx, dword [ebp - 0xb14]
lea eax, [ebp - 0xb14]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb47eba
mov ecx, dword [ebp - 0xb14]
inc esi
cmp esi, 3
jae 0xb47e81
push 4
pop edx
jmp 0xb47e36
mov edi, dword [ecx]
lea eax, [ebp - 0xb14]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xb10], edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb47eba
mov esi, edi
neg esi
sbb esi, esi
and esi, dword [ebp - 0xb14]
mov dword [ebp - 0xb14], esi
jmp 0xb47ecc
mov eax, dword [ebp - 0xc6c]
mov esi, dword [ebp - 0xbf8]
mov dword [ebp - 0xb10], eax
test ebx, ebx
js 0xb455e7
mov ecx, dword [ebp - 0xdf8]
xor eax, eax
push 4
mov dword [ebp - 0xb58], ecx
mov edi, eax
pop edx
mov eax, dword [ecx]
mov dword [ebp - 0xb08], eax
lea eax, [ebp - 0xb58]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb47f67
mov edx, dword [ebp - 0xb08]
lea eax, [ebp - 0xb58]
mov ecx, dword [ebp - 0xb58]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb47f67
mov ecx, dword [ebp - 0xb58]
inc edi
push 4
pop edx
cmp edi, edx
jb 0xb47ee7
mov edi, dword [ecx]
lea eax, [ebp - 0xb58]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb47f67
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb58]
mov dword [ebp - 0xb58], eax
jmp 0xb47f73
mov edi, dword [ebp - 0xc00]
mov eax, dword [ebp - 0xc04]
push 4
pop edx
test ebx, ebx
js 0xb47f86
cmp edi, edx
jne 0xb456b4
mov eax, dword [eax]
jmp 0xb47f8c
mov eax, dword [ebp - 0xc08]
mov dword [ebp - 0xb08], eax
test ebx, ebx
js 0xb455e7
mov ecx, dword [ebp - 0xdf8]
xor eax, eax
mov dword [ebp - 0xb5c], ecx
mov edi, eax
mov eax, dword [ecx]
mov dword [ebp - 0xab8], eax
lea eax, [ebp - 0xb5c]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb48032
mov edx, dword [ebp - 0xab8]
lea eax, [ebp - 0xb5c]
mov ecx, dword [ebp - 0xb5c]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb48032
mov ecx, dword [ebp - 0xb5c]
inc edi
cmp edi, 5
jae 0xb47fff
push 4
pop edx
jmp 0xb47faa
mov edi, dword [ecx]
lea eax, [ebp - 0xb5c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb54], ebx
test ebx, ebx
js 0xb48032
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb5c]
mov dword [ebp - 0xb5c], eax
jmp 0xb4803e
mov edi, dword [ebp - 0xc10]
mov eax, dword [ebp - 0xc14]
push 4
pop edx
test ebx, ebx
js 0xb48051
cmp edi, edx
jne 0xb456b4
mov ecx, dword [eax]
jmp 0xb48057
mov ecx, dword [ebp - 0xb88]
test ebx, ebx
js 0xb455e7
mov eax, dword [ebp - 0xbd4]
cmp eax, dword [ebp - 0xae0]
jne 0xb47b9f
mov eax, dword [ebp - 0xb18]
cmp eax, dword [ebp - 0xafc]
jne 0xb47b9f
mov dword [ebp - 0xc3c], ecx
cmp dword [ebp - 0xb08], edx
ja 0xb455d0
mov eax, dword [ebp - 0xb10]
cmp eax, edx
ja 0xb455d0
push eax
push esi
mov esi, dword [ebp - 0xb48]
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xaf8]
add esp, 0xc
mov dword [ebp - 0xc38], eax
mov eax, dword [ebp - 0xb84]
test eax, eax
jne 0xb452c1
mov edi, dword [ebp - 0xb04]
mov eax, dword [ebp - 0xb24]
xor ecx, ecx
mov dword [ebp - 0xdf0], ecx
mov dword [ebp - 0xdf4], ecx
test eax, eax
je 0xb48103
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0xdec], ecx
mov eax, dword [ebp - 0xdf8]
mov dword [ebp - 0xdfc], ecx
mov dword [ebp - 0xe00], ecx
test eax, eax
je 0xb48130
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0xdf8], ecx
test edi, edi
je 0xb48143
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb0c]
test eax, eax
je 0xb4815e
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb451b1
mov eax, dword [ebp - 0xc3c]
test eax, eax
je 0xb4ec16
mov dword [0xc95878], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x2c8]
push eax
push 0x9d0000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0xb4ca8a
cmp eax, esi
jne 0xb481ac
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0xb4ca8a
mov esi, dword [0xc9307c]
xor eax, eax
push 0x403
push eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0xafc], eax
test eax, eax
jne 0xb481da
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb4ca8a
mov esi, dword [0xc9304c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [0xc95870], eax
lea edi, [ebp - 0x3dc]
mov eax, dword [0xc95878]
xor ebx, ebx
mov dword [ebp - 0xae0], eax
xor eax, eax
stosd dword es:[edi], eax
push 0x2c
push ebx
mov dword [0xc95874], edx
stosd dword es:[edi], eax
mov dword [ebp - 0xdc0], ebx
mov dword [ebp - 0xdbc], ebx
mov dword [ebp - 0xaf8], ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x53c]
push eax
mov dword [ebp - 0xb10], ebx
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0xb08], ebx
mov edi, 0xc96238
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xb48242
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jne 0xb48870
push 0x338
mov esi, ebx
mov dword [ebp - 0xab8], ebx
push ebx
mov dword [ebp - 0xaf4], ebx
mov dword [ebp - 0xaf0], esi
mov dword [ebp - 0xac4], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xac0], eax
test eax, eax
je 0xb48862
or dword [ebp - 0xad4], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x388], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xac8], ebx
mov dword [ebp - 0x384], edx
mov cl, bl
mov dword [ebp - 0xb4c], ebx
mov edx, ebx
mov dword [ebp - 0xad0], eax
mov esi, 0x9fbcf2
mov dword [ebp - 0xacc], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [ebp - 0xabc], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [ebp - 0xad8], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [ebp - 0xb4c]
xor esi, edx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0xabc]
xor eax, edx
mov dword [ebp - 0xabc], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xabc]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xabc]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xabc], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xabc]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xabc]
xor edx, eax
mov dword [ebp - 0xabc], edx
mov eax, dword [ebp - 0xabc]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xabc]
xor eax, edx
mov dword [ebp - 0xabc], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xabc]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xabc]
xor eax, edx
mov dword [ebp - 0xabc], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xabc]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xabc]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0xabc], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0xabc]
xor eax, 0xab69605e
mov dword [ebp - 0xb4c], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb4c]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xb4c]
xor eax, edx
mov dword [ebp - 0xb4c], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xb4c], edx
mov edx, dword [ebp - 0xb4c]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xb4c], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb4c]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xb4c]
xor eax, edx
mov dword [ebp - 0xb4c], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb4c]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xb4c]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xb4c], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb4c]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xb4c]
xor edx, dword [ebp - 0xac8]
xor eax, dword [ebp - 0xad4]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xabc], esi
mov esi, dword [ebp - 0xad0]
mov dword [ebp - 0xac8], ebx
mov dword [ebp - 0xad4], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xacc], 1
mov dword [ebp - 0xad0], esi
mov esi, dword [ebp - 0xad8]
mov dword [ebp - 0xb4c], eax
jne 0xb482df
mov esi, dword [ebp - 0xac0]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xb48656
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xb48688
cmp edx, dword [0x9fc02c]
jne 0xb48688
mov edi, esi
xor eax, eax
mov dword [ebp - 0xaf0], edi
mov esi, eax
mov ebx, 0x337
jmp 0xb4869d
mov edi, dword [ebp - 0xaf0]
or ebx, 0xffffffff
mov dword [ebp - 0xac4], 0xc004d501
xor eax, eax
test esi, esi
je 0xb486b0
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xac4], 0
jl 0xb4885c
xor eax, eax
mov esi, edi
push 0x40
mov byte [edi + ebx], al
mov ebx, 0xc960a0
push eax
push ebx
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xb487f2
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbfc]
jne 0xb486e7
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xb48855
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xaf4], ecx
cmp word [eax], dx
jne 0xb4875d
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xb4875d
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xb4875d
cmp dword [edx], 0x4550
jne 0xb4875d
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc50]
je 0xb4876a
cmp ax, word [ebp - 0xc54]
je 0xb4876a
mov ecx, 0xc000000d
jmp 0xb48762
mov ecx, 0xc000007b
mov dword [ebp - 0xaf4], ecx
jmp 0xb4877c
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xac4], eax
test eax, eax
je 0xb487e6
mov edx, esi
mov dword [ebp - 0xac0], esi
lea eax, [edx + 1]
mov dword [ebp - 0xac8], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xb4879e
sub edx, dword [ebp - 0xac8]
inc esi
add esi, edx
test ecx, ecx
js 0xb487d7
push dword [ebp - 0xac0]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xb487f2
mov ecx, dword [ebp - 0xab8]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xaf4]
inc dword [ebp - 0xab8]
inc ebx
cmp ebx, dword [ebp - 0xac4]
jb 0xb4878d
add edi, 0x10
cmp byte [esi], 0
jne 0xb486e0
mov ebx, dword [ebp - 0xaf4]
mov esi, dword [ebp - 0xaf0]
test esi, esi
je 0xb48813
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb48869
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb4882c
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb4881b
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xb48876
mov ebx, 0xc000007a
jmp 0xb487f8
mov esi, dword [ebp - 0xaf0]
mov ebx, 0xc000007a
jmp 0xb487fe
mov eax, dword [0xc95890]
xor ebx, ebx
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edx, 0xc96238
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0xab8], ebx
lea edi, [ebp - 0xe34]
mov dword [ebp - 0xaf4], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xaf0], ebx
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xac0], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xac8], ebx
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xb488b1
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jne 0xb48eef
push 0x338
mov esi, ebx
mov dword [ebp - 0xad4], ebx
push ebx
mov dword [ebp - 0xb4c], ebx
mov dword [ebp - 0xad0], esi
mov dword [ebp - 0xacc], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xabc], eax
test eax, eax
je 0xb48ee1
or dword [ebp - 0xadc], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x380], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xad8], ebx
mov edi, 0x9fbcf2
mov dword [ebp - 0x37c], edx
mov cl, bl
mov dword [ebp - 0xaec], eax
mov edx, ebx
mov dword [ebp - 0xab4], edi
mov dword [ebp - 0xae4], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xab4]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xab4]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xab4]
shl edi, 8
add dword [ebp - 0xab4], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0xae8], esi
add eax, 0x54969fa2
rol dword [ebp - 0xae8], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0xae8]
xor edx, eax
mov dword [ebp - 0xb18], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb18]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xb18]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xb18], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb18]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xb18]
xor edx, eax
mov dword [ebp - 0xb18], edx
mov eax, dword [ebp - 0xb18]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xb18]
xor eax, edx
mov dword [ebp - 0xb18], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb18]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xb18]
xor eax, edx
mov dword [ebp - 0xb18], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb18]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xb18]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0xb18], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0xb18]
xor eax, 0xab69605e
mov dword [ebp - 0xae8], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xae8]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xae8]
xor eax, edx
mov dword [ebp - 0xae8], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xae8], edx
mov edx, dword [ebp - 0xae8]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xae8], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xae8]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xae8]
xor eax, edx
mov dword [ebp - 0xae8], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xae8]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xae8]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xae8], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xae8]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xae8]
xor edx, dword [ebp - 0xad8]
xor eax, dword [ebp - 0xadc]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xb18], esi
mov esi, dword [ebp - 0xaec]
mov dword [ebp - 0xadc], edi
mov edi, dword [ebp - 0xab4]
mov dword [ebp - 0xad8], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xae4], 1
mov dword [ebp - 0xaec], esi
mov esi, eax
mov dword [ebp - 0xae8], eax
jne 0xb4894e
mov esi, dword [ebp - 0xabc]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xb48cd3
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xb48d05
cmp edx, dword [0x9fc02c]
jne 0xb48d05
mov ebx, esi
xor eax, eax
mov dword [ebp - 0xad0], ebx
mov esi, eax
mov edi, 0x337
jmp 0xb48d1a
mov ebx, dword [ebp - 0xad0]
or edi, 0xffffffff
mov dword [ebp - 0xacc], 0xc004d501
xor eax, eax
test esi, esi
je 0xb48d2d
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xacc], 0
jl 0xb48edb
xor eax, eax
mov esi, ebx
push 0x40
push eax
push 0xc960a0
mov byte [ebx + edi], al
call fcn.00ab4bf6
add esp, 0xc
cmp byte [ebx], 0
je 0xb48e71
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbfc]
jne 0xb48d66
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xb48ed4
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb4c], ecx
cmp word [eax], dx
jne 0xb48ddc
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xb48ddc
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xb48ddc
cmp dword [edx], 0x4550
jne 0xb48ddc
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc50]
je 0xb48de9
cmp ax, word [ebp - 0xc54]
je 0xb48de9
mov ecx, 0xc000000d
jmp 0xb48de1
mov ecx, 0xc000007b
mov dword [ebp - 0xb4c], ecx
jmp 0xb48dfb
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xacc], eax
test eax, eax
je 0xb48e65
mov edx, esi
mov dword [ebp - 0xabc], esi
lea eax, [edx + 1]
mov dword [ebp - 0xad8], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xb48e1d
sub edx, dword [ebp - 0xad8]
inc esi
add esi, edx
test ecx, ecx
js 0xb48e56
push dword [ebp - 0xabc]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xb48e71
mov ecx, dword [ebp - 0xad4]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xb4c]
inc dword [ebp - 0xad4]
inc ebx
cmp ebx, dword [ebp - 0xacc]
jb 0xb48e0c
add edi, 0x10
cmp byte [esi], 0
jne 0xb48d5f
mov ebx, dword [ebp - 0xb4c]
mov esi, dword [ebp - 0xad0]
test esi, esi
je 0xb48e92
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb48ee8
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb48eab
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb48e9a
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xb48ef5
mov ebx, 0xc000007a
jmp 0xb48e77
mov esi, dword [ebp - 0xad0]
mov ebx, 0xc000007a
jmp 0xb48e7d
mov eax, dword [0xc95890]
xor ebx, ebx
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
push 0x54
lea eax, [ebp - 0x7f0]
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
mov esi, dword [0xc9307c]
lea edi, [ebp - 0x3e0]
add esp, 0xc
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
pop edx
push 0x403
push ebx
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xae0]
mov ecx, eax
and ecx, edx
mov dword [ebp - 0xae0], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
and ecx, edx
shr eax, 0xc
mov word [ebp - 0xa], cx
and eax, edx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0xc99200]
call esi
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xb4c], 0xffffff
test eax, eax
jne 0xb48fa0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb48f90
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb4a481
mov ebx, 0x80004005
jmp 0xb4a481
mov edi, dword [0xc93050]
lea eax, [ebp - 0xc1c]
push eax
push ebx
lea eax, [ebp - 0xb38]
mov dword [ebp - 0xc18], ebx
push eax
mov esi, ebx
mov dword [ebp - 0xacc], ebx
push 8
mov ecx, edi
mov dword [ebp - 0xad0], esi
mov dword [ebp - 0xabc], ebx
mov dword [ebp - 0xad8], ebx
mov dword [ebp - 0xc1c], ebx
call dword [0xc99200]
call edi
test eax, eax
jne 0xb490f0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb49006
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb4926c
mov ebx, 0x80004005
mov esi, dword [ebp - 0xabc]
mov edi, dword [ebp - 0xaf0]
xor ecx, ecx
test esi, esi
je 0xb49093
mov eax, ecx
mov dword [ebp - 0xabc], ecx
mov edx, dword [esi + eax*4]
test edx, edx
je 0xb49087
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0xad8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbfc]
jne 0xb4903d
sub ecx, dword [ebp - 0xad8]
xor eax, eax
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xb49072
mov byte [edx], al
inc edx
sub ecx, 1
jne 0xb49061
mov edx, dword [ebp - 0xabc]
mov edx, dword [esi + edx*4]
push edx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xabc]
inc eax
mov dword [ebp - 0xabc], eax
cmp eax, 3
jb 0xb4902b
mov eax, dword [ebp - 0xc18]
xor edx, edx
test eax, eax
je 0xb490b1
mov ecx, dword [ebp - 0xacc]
test ecx, ecx
je 0xb490b1
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0xb490a9
test esi, esi
je 0xb490c4
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xc18]
test eax, eax
je 0xb499f7
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0xc18], ecx
jmp 0xb499f9
mov eax, dword [ebp - 0xc1c]
add eax, eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xadc], edi
test edi, edi
jne 0xb4911d
mov ebx, 0x8007000e
jmp 0xb49257
mov eax, dword [ebp - 0xb38]
lea eax, [eax*4 + 4]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xaec], esi
test esi, esi
jne 0xb49158
mov ebx, 0x8007000e
jmp 0xb49151
mov ebx, 0x80004005
xor ecx, ecx
jmp 0xb4923e
mov ebx, dword [0xc93050]
lea eax, [ebp - 0xc1c]
push eax
push edi
lea eax, [ebp - 0xb38]
mov ecx, ebx
push eax
push 8
call dword [0xc99200]
call ebx
test eax, eax
jne 0xb49198
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb49194
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb49151
jmp 0xb4914c
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0xad0], ecx
cmp dword [ebp - 0xb38], ecx
jbe 0xb4921d
mov dword [ebp - 0xab4], edi
mov edi, esi
mov esi, dword [ebp - 0xab4]
mov ebx, dword [0xc93058]
push ecx
push esi
mov ecx, ebx
call dword [0xc99200]
call ebx
mov ecx, esi
mov dword [edi], eax
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb491d3
sub ecx, edx
sar ecx, 1
push 4
pop eax
add edi, eax
mov eax, dword [ebp - 0xad0]
lea esi, [esi + ecx*2]
add esi, 2
inc eax
push 0
mov dword [ebp - 0xad0], eax
pop ecx
cmp eax, dword [ebp - 0xb38]
jb 0xb491b8
mov esi, dword [ebp - 0xaec]
mov dword [ebp - 0xad0], edi
mov edi, dword [ebp - 0xadc]
mov eax, dword [ebp - 0xad0]
mov ebx, dword [ebp - 0xad8]
mov dword [eax], 0x409
mov eax, dword [ebp - 0xb38]
inc eax
mov dword [ebp - 0xad0], esi
mov esi, ecx
mov dword [ebp - 0xadc], eax
test esi, esi
je 0xb49251
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xad0]
test edi, edi
je 0xb4926c
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb49011
xor eax, eax
mov ebx, eax
mov ecx, eax
mov dword [ebp - 0xaec], ebx
cmp dword [ebp - 0xadc], eax
jbe 0xb492b1
mov edx, dword [esi + ecx*4]
cmp edx, dword [eax*4 + 0xa192e8]
je 0xb492a7
inc eax
cmp eax, 0x26
jb 0xb4928b
inc ecx
xor eax, eax
cmp ecx, dword [ebp - 0xadc]
jae 0xb492b1
jmp 0xb49288
mov ebx, eax
xor eax, eax
mov dword [ebp - 0xaec], ebx
mov esi, dword [0xc93054]
mov ecx, esi
push eax
mov dword [ebp - 0xadc], eax
lea eax, [ebp - 0xc0]
push 0x55
push eax
push dword [ebx*4 + 0xa192e8]
call dword [0xc99200]
call esi
test eax, eax
je 0xb4931c
mov esi, dword [0xc93048]
lea eax, [ebp - 0x410]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xc0]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
test eax, eax
jle 0xb4931c
mov ebx, dword [ebp - 0x404]
xor eax, eax
shr ebx, 0x1b
inc eax
and ebx, eax
mov dword [ebp - 0xadc], ebx
mov ebx, dword [ebp - 0xaec]
xor eax, eax
mov edx, 0x9fba10
mov esi, eax
mov ecx, edx
mov dword [ebp + esi*4 - 0x350], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbfc]
jne 0xb49331
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0xb49325
imul ecx, ebx, 3
movzx eax, byte [ecx + 0xa00b58]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xac4], eax
movzx eax, byte [ecx + 0xa00b59]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xac0], eax
movzx eax, byte [ecx + 0xa00b5a]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xac8], eax
xor eax, eax
push 0x1c90
mov ebx, eax
push eax
mov dword [ebp - 0xad8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xab4], ecx
test ecx, ecx
jne 0xb493c2
mov ebx, 0x8007000e
jmp 0xb49011
or dword [ebp - 0xae8], 0xffffffff
mov edx, 0xab69605e
xor ebx, ebx
mov dword [ebp - 0x358], edx
mov edx, 0x7f1137f
mov dword [ebp - 0xae4], ebx
add ecx, 7
mov dword [ebp - 0x354], edx
mov esi, 0xa19392
mov dword [ebp - 0xb18], ecx
mov al, bl
mov dword [ebp - 0xb04], esi
mov edx, ebx
mov dword [ebp - 0xb0c], 0x392
movzx edi, byte [esi - 2]
movzx ecx, byte [esi - 1]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, ecx
shl esi, 8
mov ecx, dword [ebp - 0xb04]
xor ebx, edi
movzx ecx, byte [ecx + 3]
or esi, ecx
mov ecx, dword [ebp - 0xb04]
shl esi, 8
movzx ecx, byte [ecx + 4]
or esi, ecx
mov ecx, dword [ebp - 0xb04]
shl esi, 8
add dword [ebp - 0xb04], 8
movzx ecx, byte [ecx + 5]
or esi, ecx
xor edx, esi
xor edx, ebx
xor edx, 0xac987321
mov dword [ebp - 0xb24], edx
lea ecx, [edx + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0xb24]
rol ecx, 0xa
add edx, ecx
xor ebx, edx
lea ecx, [ebx + 0x7f1137f]
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, ebx
rol ecx, 2
sub edx, ecx
mov ecx, dword [ebp - 0xb24]
xor ecx, edx
mov dword [ebp - 0xb24], ecx
imul edx, dword [ebp - 0xb24], 0x605e
shr ecx, 0xd
sub edx, ecx
sub edx, 0x756c8a2
xor ebx, edx
mov ecx, ebx
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 2
sub edx, ecx
mov ecx, dword [ebp - 0xb24]
xor ecx, edx
mov edx, ecx
mov dword [ebp - 0xb24], ecx
xor edx, 0xab69605e
mov ecx, 0x7f1137f
sub ecx, edx
xor ebx, ecx
mov ecx, ebx
mov edx, ebx
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
mov ecx, dword [ebp - 0xb24]
xor ecx, edx
mov dword [ebp - 0xb24], ecx
add ecx, 0x7f1137f
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0xb24]
rol ecx, 2
add edx, ecx
xor ebx, edx
lea ecx, [ebx + 0x54969fa2]
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 8
sub edx, ecx
mov ecx, dword [ebp - 0xb24]
xor ecx, edx
mov dword [ebp - 0xb24], ecx
xor ecx, 0xab69605e
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0xb24]
ror ecx, 0xa
xor edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, ebx
shr ecx, 0xa
xor edx, ecx
xor edx, dword [ebp - 0xb24]
mov ecx, edx
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor ebx, ecx
lea ecx, [ebx - 0x7f1]
xor ecx, edx
xor ecx, 0xab69605e
mov dword [ebp - 0xb24], ecx
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0xb24]
shr ecx, 2
add edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, ebx
rol ecx, 7
add edx, ecx
mov ecx, dword [ebp - 0xb24]
xor ecx, edx
mov dword [ebp - 0xb24], ecx
mov edx, ecx
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor ebx, edx
mov ecx, ebx
mov edx, ebx
xor ecx, 0xab69
rol ebx, 7
rol ecx, 5
imul ecx, ecx, 0x7f1
add ecx, ebx
mov ebx, dword [ebp - 0xb24]
xor ebx, ecx
mov dword [ebp - 0xb24], ebx
xor ebx, edx
mov edx, dword [ebp - 0xb24]
xor ebx, 0xac987321
mov ecx, ebx
ror ecx, 3
imul ecx, ecx, 0x137f
sub ecx, 0xd0dd417
xor edx, ecx
mov dword [ebp - 0xb24], edx
lea ecx, [edx - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0xb24]
ror ecx, 6
sub edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 0xe
add edx, ecx
mov ecx, dword [ebp - 0xb24]
xor ecx, edx
mov dword [ebp - 0xb24], ecx
add ecx, 0xab69605e
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0xb24]
ror ecx, 0xe
sub edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, ebx
shr ecx, 3
xor edx, ecx
mov ecx, dword [ebp - 0xb24]
xor ecx, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xb24], ecx
xor ecx, edx
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0xb24]
rol ecx, 2
xor edx, ecx
mov ecx, dword [ebp - 0xb18]
xor edx, dword [ebp - 0xae4]
xor ebx, edx
mov dword [ebp - 0xae4], edi
mov edx, dword [ebp - 0xb24]
xor edx, dword [ebp - 0xae8]
mov byte [ecx - 4], bl
mov byte [ecx], dl
ror ebx, 8
mov byte [ecx - 5], bl
ror edx, 8
mov byte [ecx - 1], dl
ror ebx, 8
mov byte [ecx - 6], bl
ror edx, 8
mov byte [ecx - 2], dl
ror ebx, 8
ror edx, 8
mov byte [ecx - 7], bl
mov byte [ecx - 3], dl
add ecx, 8
ror ebx, 8
ror edx, 8
sub dword [ebp - 0xb0c], 1
mov dword [ebp - 0xae8], esi
mov esi, dword [ebp - 0xb04]
mov dword [ebp - 0xb18], ecx
jne 0xb49409
mov ebx, dword [ebp - 0xad8]
xor ecx, ecx
mov edx, ecx
mov esi, 0x1c90
mov ecx, dword [ebp - 0xab4]
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0xb49783
movzx eax, al
cdq
cmp eax, dword [0xa1b020]
jne 0xb497b1
cmp edx, dword [0xa1b024]
jne 0xb497b1
xor edx, edx
mov dword [ebp - 0xc18], ecx
mov ecx, edx
mov dword [ebp - 0xacc], esi
jmp 0xb497be
mov ebx, 0xc004d501
xor edx, edx
mov dword [ebp - 0xad8], ebx
test ecx, ecx
je 0xb497d1
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb49011
mov edi, dword [ebp - 0xc18]
xor eax, eax
mov ebx, dword [ebp - 0xaec]
mov esi, eax
mov edx, eax
cmp ebx, edx
jne 0xb497f6
mov dword [ebp + esi*4 - 0x2e0], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0xabc], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xb49801
sub ecx, dword [ebp - 0xabc]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0xb497eb
inc esi
push 0
pop eax
cmp esi, 6
jb 0xb497e9
push 0xc
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, dword [ebp - 0xad8]
mov esi, eax
test esi, esi
je 0xb4987b
xor eax, eax
mov edi, esi
mov edx, esi
mov dword [ebp - 0xad8], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov ecx, eax
mov eax, esi
sub eax, esi
mov dword [ebp - 0xabc], ecx
mov dword [ebp - 0xaec], eax
movzx edi, word [ebp + ecx*2 - 0xc]
xor eax, eax
cmp di, word [eax*2 + 0xa19380]
je 0xb49885
inc eax
cmp eax, 6
jb 0xb49866
jmp 0xb4996b
mov ebx, 0x8007000e
jmp 0xb49017
mov edi, dword [ebp + eax*4 - 0x2e0]
mov ecx, edi
mov edx, dword [0xc93060]
mov dword [ebp - 0xab4], edx
lea eax, [ecx + 1]
mov dword [ebp - 0xae4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xb498a3
sub ecx, dword [ebp - 0xae4]
xor eax, eax
push eax
push eax
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
xor eax, eax
push eax
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0xab4]
mov dword [ebp - 0xab4], eax
test eax, eax
je 0xb499ca
lea ecx, [eax + eax]
xor eax, eax
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0xad8]
mov edx, dword [ebp - 0xaec]
mov dword [edx + ecx], eax
mov eax, dword [ecx]
mov dword [ebp - 0xae4], eax
test eax, eax
je 0xb4987b
mov edx, dword [0xc93060]
mov ecx, edi
mov dword [ebp - 0xae8], edx
lea eax, [ecx + 1]
mov dword [ebp - 0xb18], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xb49927
push dword [ebp - 0xab4]
sub ecx, dword [ebp - 0xb18]
push dword [ebp - 0xae4]
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
xor eax, eax
push eax
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0xae8]
test eax, eax
je 0xb499a3
mov ecx, dword [ebp - 0xabc]
mov edx, dword [ebp - 0xad8]
push 4
inc ecx
pop eax
add edx, eax
mov dword [ebp - 0xabc], ecx
mov dword [ebp - 0xad8], edx
cmp ecx, 3
jb 0xb4985f
mov eax, dword [ebp - 0xadc]
mov edi, esi
xor ecx, ecx
mov dword [ebp - 0xaf0], edi
mov esi, ecx
mov dword [ebp - 0x7f0], eax
jmp 0xb4901f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb499ba
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb49017
mov ebx, 0x80004005
jmp 0xb49017
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb499e1
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
mov edi, dword [ebp - 0xaf0]
js 0xb4901d
mov ebx, 0x80004005
jmp 0xb4901d
xor ecx, ecx
mov eax, dword [ebp - 0xad0]
test eax, eax
je 0xb49a12
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb4a468
mov eax, dword [edi]
xor ecx, ecx
mov esi, dword [0xc930b4]
mov ebx, ecx
mov dword [ebp - 0x7e8], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x7e4], eax
mov eax, dword [edi + 8]
mov edi, ecx
push ecx
mov dword [ebp - 0x7e0], eax
lea eax, [ebp - 0xe0c]
push eax
push ecx
mov dword [ebp - 0xe08], ecx
mov dword [ebp - 0xe04], ecx
mov ecx, esi
push 0x42
mov dword [ebp - 0xe0c], 0xc
call dword [0xc99200]
call esi
test eax, eax
jne 0xb49a8f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb49a86
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb49a9a
mov ebx, 0x80004005
jmp 0xb49a9a
mov edi, dword [ebp - 0xe08]
xor eax, eax
inc eax
and edi, eax
mov dword [ebp - 0x7ec], edi
test ebx, ebx
js 0xb4a468
mov edi, dword [ebp - 0xae0]
mov eax, edi
push 0x2a
pop ecx
mov dword [ebp - 0xad0], ecx
sub eax, 1
je 0xb49ae7
sub eax, 1
je 0xb49adb
sub eax, 1
jne 0xb49af7
mov ebx, 0xe1
mov dword [ebp - 0xab8], ebx
mov dword [ebp - 0xaf4], ebx
jmp 0xb49af7
mov dword [ebp - 0xab8], 0xf
jmp 0xb49aed
mov dword [ebp - 0xab8], ecx
mov dword [ebp - 0xaf4], 0xb
mov esi, 0xdc
mov dword [ebp - 0xacc], 0x60
push esi
xor ebx, ebx
lea eax, [ebp - 0x740]
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov word [ebp - 0x6fc], si
mov esi, dword [0xc93070]
lea eax, [ebp - 0x740]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xb49bf1
mov eax, dword [ebp - 0x694]
movzx ebx, word [ebp - 0x69a]
mov ecx, dword [ebp - 0x690]
push 0x60
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xe2c], eax
pop eax
mov dword [ebp - 0xacc], ebx
mov dword [ebp - 0xad8], ecx
mov dword [ebp - 0xe28], ecx
cmp ebx, eax
jae 0xb49b80
mov dword [ebp - 0xacc], eax
xor ebx, ebx
xor eax, eax
inc eax
cmp edi, eax
mov edi, dword [ebp - 0xac4]
je 0xb49b95
mov edi, dword [ebp - 0xac8]
push 0x5c
lea eax, [ebp - 0x660]
push ebx
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0xadc], eax
test eax, eax
jne 0xb49c0e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb49be1
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb49cae
mov ebx, 0x80004005
jmp 0xb4a468
mov eax, dword [ebp - 0xe28]
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0xe2c]
mov dword [ebp - 0xabc], eax
jmp 0xb49b82
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0xacc]
push dword [ebp - 0xab8]
call dword [0xc99200]
call esi
push edi
push 0x20
neg eax
mov dword [ebp - 0x650], 0x190
pop edx
lea ecx, [ebp - 0x644]
mov dword [ebp - 0x660], eax
mov byte [ebp - 0x646], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0x660]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb49c8f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb49c86
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb49c95
mov ebx, 0x80004005
jmp 0xb49c95
mov dword [ebp - 0x7dc], eax
push dword [ebp - 0xadc]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb4a468
xor eax, eax
inc eax
cmp dword [ebp - 0xae0], eax
je 0xb49ccd
mov eax, dword [ebp - 0xac8]
mov dword [ebp - 0xac4], eax
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0x600]
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov edi, eax
test edi, edi
jne 0xb49d24
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb49d19
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb49dc4
jmp 0xb49be7
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0xacc]
push dword [ebp - 0xaf4]
call dword [0xc99200]
call esi
push dword [ebp - 0xac4]
neg eax
mov dword [ebp - 0x5f0], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x5e4]
mov dword [ebp - 0x600], eax
mov byte [ebp - 0x5e6], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0x600]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb49daa
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb49da1
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb49db0
mov ebx, 0x80004005
jmp 0xb49db0
mov dword [ebp - 0x7d8], eax
mov esi, dword [0xc930b0]
xor eax, eax
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb4a468
mov ebx, dword [ebp - 0xae0]
xor eax, eax
mov ecx, eax
mov edx, eax
mov eax, ebx
sub eax, 1
je 0xb49de9
sub eax, 1
je 0xb49e29
sub eax, 1
jne 0xb49df5
mov ecx, dword [ebp - 0xabc]
mov edx, dword [ebp - 0xad8]
mov dword [ebp - 0x3d8], ecx
mov dword [ebp - 0x3d4], edx
xor edx, edx
inc edx
cmp ebx, edx
je 0xb49e69
lea eax, [ebx - 2]
xor ebx, ebx
cmp eax, edx
ja 0xb49e3d
mov edx, ebx
mov dword [ebp - 0xad0], ebx
mov eax, ebx
mov dword [ebp - 0xaf4], edx
mov dword [ebp - 0xac4], ebx
jmp 0xb49e82
mov eax, dword [ebp - 0xabc]
push 4
cdq
pop ecx
idiv ecx
mov ecx, eax
xor eax, eax
mov edx, eax
jmp 0xb49df5
mov eax, dword [ebp - 0xb38]
mov edx, dword [ebp - 0xb38]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0xb38]
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0xb38]
mov dword [ebp - 0xaf4], edx
jmp 0xb49e82
xor ebx, ebx
mov dword [ebp - 0xac4], 0x20
mov eax, 0x96
mov dword [ebp - 0xaf4], ebx
mov edx, ebx
mov dword [ebp - 0xab8], eax
push dword [ebp - 0x7dc]
mov esi, dword [0xc9303c]
sub ecx, eax
push dword [ebp - 0xad4]
mov edi, dword [ebp - 0x7e8]
sub ecx, edx
mov dword [ebp - 0xac8], ecx
mov dword [ebp - 0x7b4], ecx
mov dword [ebp - 0x7c4], ecx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0xabc], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x7cc]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xad4]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb49ef8
mov ebx, 0x80004005
mov eax, dword [ebp - 0xabc]
test eax, eax
je 0xb49f14
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb4a468
push dword [ebp - 0x7d8]
mov esi, dword [0xc9303c]
xor eax, eax
push dword [ebp - 0xad4]
mov edi, dword [ebp - 0x7e4]
mov ecx, esi
mov ebx, eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0xabc], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x7bc]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xad4]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb49f7a
mov ebx, 0x80004005
mov eax, dword [ebp - 0xabc]
test eax, eax
je 0xb49f96
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb4a468
mov eax, dword [ebp - 0xae0]
cmp eax, 2
je 0xb49fb6
cmp eax, 3
je 0xb49fb6
mov edi, dword [ebp - 0xac8]
jmp 0xb49fca
mov edi, dword [ebp - 0x7b4]
cmp dword [ebp - 0x7c4], edi
jle 0xb49fca
mov edi, dword [ebp - 0x7c4]
cmp dword [ebp - 0x7f0], 0
mov esi, dword [0xc930a8]
mov ecx, esi
push dword [ebp - 0xad0]
je 0xb4a01d
mov eax, edi
sub eax, dword [ebp - 0x7c4]
add eax, dword [ebp - 0xaf4]
push eax
lea eax, [ebp - 0x7cc]
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x7c0]
add eax, dword [ebp - 0xac4]
push eax
mov eax, edi
sub eax, dword [ebp - 0x7b4]
add eax, dword [ebp - 0xaf4]
push eax
jmp 0xb4a041
mov ebx, dword [ebp - 0xab8]
lea eax, [ebp - 0x7cc]
push ebx
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x7c0]
add eax, dword [ebp - 0xac4]
push eax
push ebx
mov esi, dword [0xc930a8]
lea eax, [ebp - 0x7bc]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xae0]
cmp eax, 2
je 0xb4a329
cmp eax, 3
je 0xb4a329
xor edx, edx
inc edx
cmp eax, edx
jne 0xb4a348
xor eax, eax
mov dword [ebp - 0x7d0], 0xffffff
push 0x5c
push eax
lea eax, [ebp - 0x5a0]
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0xab8], eax
test eax, eax
jne 0xb4a0e0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb4a0d5
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb4a181
jmp 0xb49be7
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0xacc]
push 0xb
call dword [0xc99200]
call esi
push dword [ebp - 0xac0]
neg eax
mov dword [ebp - 0x590], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x584]
mov dword [ebp - 0x5a0], eax
mov byte [ebp - 0x586], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0x5a0]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb4a162
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb4a159
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb4a168
mov ebx, 0x80004005
jmp 0xb4a168
mov dword [ebp - 0x7d4], eax
push dword [ebp - 0xab8]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb4a468
push dword [ebp - 0x7d4]
mov esi, dword [0xc9303c]
xor eax, eax
push dword [ebp - 0xad4]
mov dword [ebp - 0x7a4], edi
mov ecx, esi
mov edi, dword [ebp - 0x7e0]
mov ebx, eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0xab8], eax
xor eax, eax
push eax
push 0x460
lea eax, [ebp - 0x7ac]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xad4]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb4a1ed
mov ebx, 0x80004005
mov eax, dword [ebp - 0xab8]
test eax, eax
je 0xb4a209
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb4a468
mov eax, dword [ebp - 0x7a4]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x7a4], eax
cmp eax, ecx
jge 0xb4a22d
mov dword [ebp - 0x7a4], ecx
mov ebx, dword [ebp - 0xacc]
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
pop edi
push edi
push ebx
push dword [ebp - 0x7ac]
mov dword [ebp - 0x7a0], 0x20
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x7a8]
mov dword [ebp - 0x7ac], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x7a4]
mov dword [ebp - 0x7a8], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x7a0]
mov dword [ebp - 0x7a4], eax
call dword [0xc99200]
call esi
cmp dword [ebp - 0x7f0], 0
mov esi, dword [0xc930a8]
mov dword [ebp - 0x7a0], eax
je 0xb4a310
mov ecx, dword [ebp - 0x7b0]
mov eax, dword [ebp - 0x7cc]
add ecx, 0x24
cmp eax, dword [ebp - 0x7bc]
jl 0xb4a2e4
mov eax, dword [ebp - 0x7bc]
push ecx
jmp 0xb4a2fc
mov ecx, dword [ebp - 0x7b4]
push eax
mov eax, dword [ebp - 0x7ac]
sub eax, dword [ebp - 0x7a4]
add eax, ecx
push eax
lea eax, [ebp - 0x7ac]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
jmp 0xb4a345
mov eax, dword [ebp - 0x7b0]
mov ecx, dword [ebp - 0x7c4]
add eax, 0x24
cmp ecx, dword [ebp - 0x7b4]
jg 0xb4a2ed
jmp 0xb4a2e7
mov eax, dword [ebp - 0x7b0]
mov dword [ebp - 0x3d8], edi
mov dword [ebp - 0x3d4], eax
mov dword [ebp - 0x7d0], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x7f0]
mov ebx, dword [ebp - 0x3d8]
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0xaf4], eax
mov eax, dword [ebp - 0xae0]
sub eax, 1
je 0xb4a67e
sub eax, 1
je 0xb4a5cc
sub eax, 1
jne 0xb4a466
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x460]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x460]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x460], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xb4a466
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x44c]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x444]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x444]
lea esi, [ebp - 0x44c]
sub eax, ebx
lea edi, [ebp - 0xe44]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x440]
sub eax, dword [ebp - 0xaf4]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
jmp 0xb4a45d
mov eax, dword [ebp - 0x41c]
sub eax, ebx
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x418]
sub eax, dword [ebp - 0xaf4]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x3dc], eax
xor ebx, ebx
push dword [ebp - 0xad4]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
xor esi, esi
mov edi, 0xc96238
inc esi
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xb4a489
mov eax, dword [0xc95890]
test eax, eax
jle 0xb4a4ee
sub eax, 1
mov dword [0xc95890], eax
jne 0xb4a4ee
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb4a4bd
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb4a4ac
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0xc96238
inc esi
xor eax, eax
xchg dword [edi], eax
mov eax, dword [ebp - 0xaf0]
test eax, eax
je 0xb4a50d
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb4bc7f
mov edi, dword [ebp - 0x3e0]
xor eax, eax
mov ebx, dword [ebp - 0x3dc]
push 0x54
push eax
lea eax, [ebp - 0x8a0]
mov dword [ebp - 0xdc0], edi
push eax
mov dword [ebp - 0xdbc], ebx
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0xab8], esi
mov esi, dword [0xc93028]
mov ecx, esi
push 7
push dword [ebp - 0xafc]
call dword [0xc99200]
call esi
test eax, eax
je 0xb4a5ac
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x8a0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb4a5ac
push 0x20
pop eax
cmp word [ebp - 0x88e], ax
jne 0xb4a5ac
cmp dword [ebp - 0x88c], 0
je 0xb4a5ac
cmp dword [ebp - 0x89c], 0
jle 0xb4a5ac
cmp dword [ebp - 0x898], 0
jg 0xb4a691
xor eax, eax
cmp dword [ebp - 0xae0], 1
mov dword [ebp - 0xab8], eax
je 0xb4a691
mov ebx, dword [ebp - 0xae0]
jmp 0xb4a6f9
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x438]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x438]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x438], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xb4a466
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x424]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x41c]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
cmp dword [ebp - 0xab8], 0
lea esi, [ebp - 0x424]
lea edi, [ebp - 0xe44]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xb4a43a
imul eax, dword [ebp - 0x41c], 5
cdq
idiv ecx
add eax, dword [ebp - 0x424]
jmp 0xb4a448
xor ebx, ebx
mov dword [ebp - 0x3e0], ebx
mov dword [ebp - 0x3dc], ebx
jmp 0xb4a468
mov esi, dword [0xc930a8]
lea eax, [ebp - 0x7cc]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc930a8]
lea eax, [ebp - 0x7bc]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov ebx, dword [ebp - 0xae0]
cmp ebx, 1
jne 0xb4a6f9
mov eax, dword [ebp - 0x7ec]
mov esi, dword [0xc93014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0xb08], eax
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push dword [ebp - 0xafc]
call dword [0xc99200]
call esi
cmp dword [ebp - 0x7f0], 0
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0xaf0], 0x810
je 0xb4a734
mov dword [ebp - 0xaf0], 0x20812
cmp dword [ebp - 0xab8], 0
je 0xb4b261
mov eax, dword [ebp - 0x7ec]
mov ebx, dword [ebp - 0x7e8]
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0xac4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x8f8]
mov dword [ebp - 0xac0], ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x848]
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xad0], eax
push 0x2c
push eax
mov dword [ebp - 0xacc], eax
lea eax, [ebp - 0x510]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x3d0]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xb4bc5f
mov esi, dword [0xc93028]
mov ecx, esi
mov ebx, dword [ebp - 0xafc]
push 7
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xb4b3f8
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x8f8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb4a830
mov eax, dword [ebp - 0x8e4]
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0xacc], eax
mov esi, dword [0xc93008]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov ebx, eax
mov dword [ebp - 0xabc], ebx
test ebx, ebx
je 0xb4b3f8
mov eax, dword [ebp - 0x7c4]
xor ecx, ecx
sub eax, dword [ebp - 0x7cc]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x7c8]
sub eax, dword [ebp - 0x7c0]
mov dword [ebp - 0x508], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc24], ecx
mov word [ebp - 0x504], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x502], ax
lea eax, [ebp - 0xc24]
push eax
push ecx
lea eax, [ebp - 0x510]
mov dword [ebp - 0xad8], ecx
push eax
mov dword [ebp - 0x500], ecx
mov dword [ebp - 0x4fc], ecx
mov dword [ebp - 0x4f8], ecx
mov dword [ebp - 0x4f4], ecx
mov dword [ebp - 0x4f0], ecx
mov dword [ebp - 0x4ec], ecx
mov dword [ebp - 0x4e8], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x510], 0x28
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0xadc], edi
test edi, edi
jne 0xb4a92e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xad8], eax
test eax, eax
jle 0xb4a919
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xad8], eax
test eax, eax
js 0xb4aca6
mov dword [ebp - 0xad8], 0x80004005
jmp 0xb4aca6
mov esi, dword [0xc93034]
lea eax, [ebp - 0x848]
push eax
push 0x54
push edi
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb4a958
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0x7c4]
sub eax, dword [ebp - 0x7cc]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x7c0]
sub eax, dword [ebp - 0x7c8]
push edi
push ebx
mov dword [ebp - 0x3c4], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
push dword [ebp - 0xac4]
mov esi, dword [0xc9303c]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0xac4], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x3d0]
mov ecx, edi
push eax
push ebx
call dword [0xc99200]
call edi
mov esi, dword [0xc9306c]
xor eax, eax
push eax
push dword [ebp - 0xaf0]
lea eax, [ebp - 0x3d0]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xac0]
push ebx
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xae0], eax
jne 0xb4aa4f
cmp dword [ebp - 0xab8], 0
je 0xb4aa43
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0xab8], eax
jmp 0xb4aa59
mov dword [ebp - 0xab8], 0xffffff
jmp 0xb4aa59
mov dword [ebp - 0xab8], 0xffa8a8a8
mov edx, dword [ebp - 0x7cc]
xor ecx, ecx
mov eax, dword [ebp - 0x7c8]
mov edi, ecx
mov dword [ebp - 0xac0], edx
test edx, edx
jns 0xb4aa81
mov edi, edx
neg edi
xor edx, edx
mov dword [ebp - 0xac0], edx
jmp 0xb4aa83
xor edx, edx
test eax, eax
jns 0xb4aa8d
mov ecx, eax
mov eax, edx
neg ecx
mov esi, dword [ebp - 0x3c8]
mov edx, dword [ebp - 0xad0]
sub esi, edi
sub edx, dword [ebp - 0xac0]
mov dword [ebp - 0xaec], esi
cmp esi, edx
jl 0xb4aab3
mov esi, edx
mov dword [ebp - 0xaec], edx
mov edx, dword [ebp - 0x3c4]
sub dword [ebp - 0xacc], eax
sub edx, ecx
mov dword [ebp - 0xab4], edx
cmp edx, dword [ebp - 0xacc]
jl 0xb4aadb
mov edx, dword [ebp - 0xacc]
mov dword [ebp - 0xab4], edx
test esi, esi
jle 0xb4ac74
test edx, edx
jle 0xb4ac74
mov edx, dword [ebp - 0x3c8]
imul eax, dword [ebp - 0xad0]
imul ecx, edx
shl edx, 2
add eax, dword [ebp - 0xac0]
add ecx, edi
mov edi, dword [ebp - 0xad4]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0xac8]
mov dword [ebp - 0xac8], edx
mov edx, dword [ebp - 0xad0]
shl edx, 2
lea eax, [edi + eax*4]
mov dword [ebp - 0xad4], ecx
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xad0], edx
mov ebx, eax
mov dword [ebp - 0xae8], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xacc], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xae4], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xb4ac1b
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xab8]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xae4]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xacc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xab8]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xab6]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xae8]
cdq
idiv ecx
mov edx, dword [ebp - 0xacc]
add al, bl
mov ebx, dword [ebp - 0xae4]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xae8], esi
jne 0xb4ab55
mov ecx, dword [ebp - 0xad4]
mov eax, dword [ebp - 0xac0]
add ecx, dword [ebp - 0xac8]
add eax, dword [ebp - 0xad0]
sub dword [ebp - 0xab4], 1
mov esi, dword [ebp - 0xaec]
mov dword [ebp - 0xad4], ecx
mov dword [ebp - 0xac0], eax
jne 0xb4ab39
mov ebx, dword [ebp - 0xabc]
push dword [ebp - 0xadc]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xac4]
test eax, eax
je 0xb4aca6
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0xad8], 0
jl 0xb4bc5f
mov eax, dword [ebp - 0x7ec]
mov ebx, dword [ebp - 0x7e4]
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0xac4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x950]
mov dword [ebp - 0xac0], ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x9a8]
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xad0], eax
push 0x2c
push eax
mov dword [ebp - 0xacc], eax
lea eax, [ebp - 0x4e4]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x3c0]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xb4bc5f
mov esi, dword [0xc93028]
mov ecx, esi
mov ebx, dword [ebp - 0xafc]
push 7
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xb4b3f8
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x950]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb4adb3
mov eax, dword [ebp - 0x93c]
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0x94c]
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0x948]
mov dword [ebp - 0xacc], eax
mov esi, dword [0xc93008]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov ebx, eax
mov dword [ebp - 0xabc], ebx
test ebx, ebx
je 0xb4b3f8
mov eax, dword [ebp - 0x7b4]
xor ecx, ecx
sub eax, dword [ebp - 0x7bc]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x7b8]
sub eax, dword [ebp - 0x7b0]
mov dword [ebp - 0x4dc], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc28], ecx
mov word [ebp - 0x4d8], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x4d6], ax
lea eax, [ebp - 0xc28]
push eax
push ecx
lea eax, [ebp - 0x4e4]
mov dword [ebp - 0xad8], ecx
push eax
mov dword [ebp - 0x4d4], ecx
mov dword [ebp - 0x4d0], ecx
mov dword [ebp - 0x4cc], ecx
mov dword [ebp - 0x4c8], ecx
mov dword [ebp - 0x4c4], ecx
mov dword [ebp - 0x4c0], ecx
mov dword [ebp - 0x4bc], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x4e4], 0x28
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0xadc], edi
test edi, edi
jne 0xb4aeb1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xad8], eax
test eax, eax
jle 0xb4ae9c
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xad8], eax
test eax, eax
js 0xb4b238
mov dword [ebp - 0xad8], 0x80004005
jmp 0xb4b238
mov esi, dword [0xc93034]
lea eax, [ebp - 0x9a8]
push eax
push 0x54
push edi
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb4aedb
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0x7b4]
sub eax, dword [ebp - 0x7bc]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x7b0]
sub eax, dword [ebp - 0x7b8]
push edi
push ebx
mov dword [ebp - 0x3b4], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
push dword [ebp - 0xac4]
mov esi, dword [0xc9303c]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0xac4], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x3c0]
mov ecx, edi
push eax
push ebx
call dword [0xc99200]
call edi
mov esi, dword [0xc9306c]
xor eax, eax
push eax
push dword [ebp - 0xaf0]
lea eax, [ebp - 0x3c0]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xac0]
push ebx
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xae0], eax
jne 0xb4afcc
cmp dword [ebp - 0xab8], 0
je 0xb4afc0
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
jmp 0xb4afd1
mov dword [ebp - 0xae0], 0xffffff
jmp 0xb4afdd
mov eax, 0xffa8a8a8
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xb4c], eax
mov edx, dword [ebp - 0x7bc]
xor ecx, ecx
mov eax, dword [ebp - 0x7b8]
mov edi, ecx
mov dword [ebp - 0xab8], edx
test edx, edx
jns 0xb4b003
mov edi, edx
neg edi
xor edx, edx
mov dword [ebp - 0xab8], edx
test eax, eax
jns 0xb4b00d
mov ecx, eax
neg ecx
xor eax, eax
mov ebx, dword [ebp - 0xad0]
mov esi, dword [ebp - 0x3b8]
mov dword [ebp - 0xac0], ebx
sub esi, edi
sub dword [ebp - 0xac0], edx
mov edx, dword [ebp - 0xac0]
mov dword [ebp - 0xaf0], esi
cmp esi, edx
jl 0xb4b03f
mov esi, edx
mov dword [ebp - 0xaf0], edx
mov edx, dword [ebp - 0x3b4]
sub dword [ebp - 0xacc], eax
sub edx, ecx
mov dword [ebp - 0xac0], edx
cmp edx, dword [ebp - 0xacc]
jl 0xb4b067
mov edx, dword [ebp - 0xacc]
mov dword [ebp - 0xac0], edx
mov ebx, dword [ebp - 0xabc]
test esi, esi
jle 0xb4b206
test edx, edx
jle 0xb4b206
mov edx, dword [ebp - 0x3b8]
imul eax, dword [ebp - 0xad0]
imul ecx, edx
shl edx, 2
add eax, dword [ebp - 0xab8]
add ecx, edi
mov edi, dword [ebp - 0xad4]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0xac8]
mov dword [ebp - 0xac8], edx
mov edx, dword [ebp - 0xad0]
shl edx, 2
lea eax, [edi + eax*4]
mov dword [ebp - 0xad4], ecx
mov dword [ebp - 0xab8], eax
mov dword [ebp - 0xad0], edx
mov ebx, eax
mov dword [ebp - 0xab4], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xacc], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xaec], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xb4b1ad
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xb4c]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaec]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xacc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xb4c]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xade]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xab4]
cdq
idiv ecx
mov edx, dword [ebp - 0xacc]
add al, bl
mov ebx, dword [ebp - 0xaec]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xab4], esi
jne 0xb4b0e7
mov ecx, dword [ebp - 0xad4]
mov eax, dword [ebp - 0xab8]
add ecx, dword [ebp - 0xac8]
add eax, dword [ebp - 0xad0]
sub dword [ebp - 0xac0], 1
mov esi, dword [ebp - 0xaf0]
mov dword [ebp - 0xad4], ecx
mov dword [ebp - 0xab8], eax
jne 0xb4b0cb
mov ebx, dword [ebp - 0xabc]
push dword [ebp - 0xadc]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xac4]
test eax, eax
je 0xb4b238
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0xad8], 0
jl 0xb4bc5f
mov edi, dword [ebp - 0xaf8]
jmp 0xb4c789
xor edx, edx
inc edx
cmp dword [ebp - 0x7ec], 0
jne 0xb4b275
cmp ebx, edx
je 0xb4b275
mov al, 0xc0
jmp 0xb4b277
or al, 0xff
mov esi, dword [0xc93008]
xor ecx, ecx
push dword [ebp - 0xafc]
mov byte [ebp - 0xab6], al
mov edi, ecx
mov eax, ecx
mov word [ebp - 0xab8], cx
mov dword [ebp - 0xac4], ecx
mov dword [ebp - 0xac0], ecx
mov dword [ebp - 0xe4c], ecx
mov dword [ebp - 0xe48], ecx
mov dword [ebp - 0xac8], ecx
mov dword [ebp - 0xe60], ecx
mov dword [ebp - 0xe5c], ecx
mov dword [ebp - 0xe58], ecx
mov ecx, esi
mov byte [ebp - 0xab5], dl
mov dword [ebp - 0xe54], edi
mov dword [ebp - 0xe50], eax
mov dword [ebp - 0xe64], eax
call dword [0xc99200]
call esi
mov dword [ebp - 0xaf8], eax
test eax, eax
je 0xb4b3f8
xor eax, eax
inc eax
cmp ebx, eax
jne 0xb4b403
mov eax, dword [ebp - 0x7c4]
mov ecx, dword [ebp - 0x7b4]
sub ecx, dword [ebp - 0x7bc]
sub eax, dword [ebp - 0x7cc]
mov dword [ebp - 0xad4], ecx
cmp ecx, eax
jg 0xb4b32b
mov ecx, eax
mov dword [ebp - 0xad4], eax
mov edx, dword [ebp - 0x7b0]
xor eax, eax
sub edx, dword [ebp - 0x7c8]
mov ebx, eax
mov dword [ebp - 0xad0], edx
cmp dword [ebp - 0x7f0], eax
je 0xb4b37f
mov edi, dword [ebp - 0x7cc]
sub edi, dword [ebp - 0x7c4]
mov eax, dword [ebp - 0x7bc]
add edi, ecx
sub eax, dword [ebp - 0x7b4]
mov ebx, edi
add eax, ecx
mov dword [ebp - 0xac4], edi
mov dword [ebp - 0xe54], edi
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xe64], eax
sub eax, dword [ebp - 0x7bc]
add eax, dword [ebp - 0x7b4]
mov edi, dword [ebp - 0x7c0]
sub edi, dword [ebp - 0x7c8]
sub ebx, dword [ebp - 0x7cc]
add ebx, dword [ebp - 0x7c4]
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xe5c], eax
mov eax, dword [ebp - 0x7b8]
sub eax, dword [ebp - 0x7c8]
mov dword [ebp - 0xacc], edi
mov dword [ebp - 0xe48], edi
mov edi, eax
sub edi, dword [ebp - 0x7b8]
add edi, dword [ebp - 0x7b0]
mov dword [ebp - 0xe4c], ebx
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xe60], eax
mov dword [ebp - 0xadc], edi
mov dword [ebp - 0xe58], edi
jmp 0xb4b495
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb4bc5f
lea esi, [ebp - 0x7cc]
mov ecx, dword [ebp - 0x3d8]
lea edi, [ebp - 0xe54]
mov edx, dword [ebp - 0x3d4]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xad4], ecx
mov dword [ebp - 0xad0], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xe48]
lea esi, [ebp - 0x7bc]
mov ebx, dword [ebp - 0xe4c]
lea edi, [ebp - 0xe64]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp - 0xe50]
mov dword [ebp - 0xac0], eax
mov eax, dword [ebp - 0xe54]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xac4], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xe58]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0xe5c]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0xe60]
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0xe64]
mov dword [ebp - 0xac8], eax
mov esi, dword [0xc9300c]
xor eax, eax
mov edi, dword [ebp - 0xaf8]
neg edx
push 0x20
mov dword [ebp - 0xc2c], eax
mov dword [ebp - 0x52c], eax
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x524], eax
mov dword [ebp - 0x520], eax
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x514], eax
inc eax
mov word [ebp - 0x530], ax
pop eax
mov dword [ebp - 0x538], ecx
xor ecx, ecx
push ecx
push ecx
mov word [ebp - 0x52e], ax
lea eax, [ebp - 0xc2c]
push eax
push ecx
lea eax, [ebp - 0x53c]
mov dword [ebp - 0x53c], 0x28
push eax
push edi
mov ecx, esi
mov dword [ebp - 0x534], edx
call dword [0xc99200]
call esi
mov dword [ebp - 0xb10], eax
test eax, eax
jne 0xb4b530
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb4bc4a
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xae0], eax
jne 0xb4b596
mov ecx, dword [ebp - 0xb08]
test ecx, ecx
je 0xb4b596
mov esi, dword [0xc93074]
xor eax, eax
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0xad4]
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp - 0xad0]
push ecx
mov dword [ebp - 0x3a4], eax
mov ecx, esi
lea eax, [ebp - 0x3b0]
push eax
push edi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x7ec]
mov esi, dword [ebp - 0x7e8]
mov dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0xab4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa00]
mov dword [ebp - 0xae4], esi
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa58]
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0xb04], eax
push 0x2c
push eax
mov dword [ebp - 0xb0c], eax
lea eax, [ebp - 0x4b8]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x3f0]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xaf8]
test esi, esi
je 0xb4bc2f
mov esi, dword [0xc93028]
mov ecx, esi
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xb4b783
mov esi, dword [0xc93034]
lea ecx, [ebp - 0xa00]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb4b685
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0x9fc]
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp - 0x9f8]
mov dword [ebp - 0xb0c], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0xb24], ecx
test ecx, ecx
je 0xb4b783
mov eax, dword [ebp - 0xac0]
xor edx, edx
mov edi, dword [ebp - 0xacc]
sub eax, edi
sub ebx, dword [ebp - 0xac4]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x4b0], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc30], edx
mov word [ebp - 0x4ac], ax
pop eax
push edx
push edx
mov word [ebp - 0x4aa], ax
lea eax, [ebp - 0xc30]
push eax
push edx
lea eax, [ebp - 0x4b8]
mov dword [ebp - 0xb88], edx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x4a8], edx
mov dword [ebp - 0x4a4], edx
mov dword [ebp - 0x4a0], edx
mov dword [ebp - 0x49c], edx
mov dword [ebp - 0x498], edx
mov dword [ebp - 0x494], edx
mov dword [ebp - 0x490], edx
mov dword [ebp - 0x4b8], 0x28
mov dword [ebp - 0x4b4], ebx
call dword [0xc99200]
call esi
mov dword [ebp - 0xacc], eax
test eax, eax
jne 0xb4b78e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xb88], eax
test eax, eax
jle 0xb4b768
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb88], eax
test eax, eax
mov edi, dword [ebp - 0xb24]
js 0xb4baf5
mov dword [ebp - 0xb88], 0x80004005
jmp 0xb4baf5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb4bc2f
mov esi, dword [0xc93034]
lea ecx, [ebp - 0xa58]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb4b7b8
mov eax, dword [ebp - 0xa44]
mov dword [ebp - 0xb18], eax
push dword [ebp - 0xacc]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x3e8], ebx
mov ebx, dword [ebp - 0xac0]
sub edi, ebx
mov dword [ebp - 0x3e4], edi
mov edi, dword [ebp - 0xb24]
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0xab4]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0xac0], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
mov esi, dword [ebp - 0xb24]
mov ecx, edi
push eax
lea eax, [ebp - 0x3f0]
push eax
push esi
call dword [0xc99200]
call edi
xor eax, eax
push eax
push dword [ebp - 0xaf0]
lea eax, [ebp - 0x3f0]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xae4]
push esi
mov esi, dword [0xc9306c]
mov ecx, esi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xae0], eax
jne 0xb4b8b0
cmp dword [ebp - 0xaec], 0
je 0xb4b8a4
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0xaec], eax
jmp 0xb4b8ba
mov dword [ebp - 0xaec], 0xffffff
jmp 0xb4b8ba
mov dword [ebp - 0xaec], 0xffa8a8a8
mov ecx, dword [ebp - 0xac4]
xor edx, edx
mov edi, edx
mov eax, edx
test ecx, ecx
jns 0xb4b8d0
mov edi, ecx
mov ecx, edx
neg edi
test ebx, ebx
jns 0xb4b8da
mov eax, ebx
mov ebx, edx
neg eax
mov esi, dword [ebp - 0x3e8]
mov edx, dword [ebp - 0xb04]
sub esi, edi
sub edx, ecx
mov dword [ebp - 0xac4], esi
cmp esi, edx
jl 0xb4b8fc
mov esi, edx
mov dword [ebp - 0xac4], edx
mov edx, dword [ebp - 0x3e4]
sub dword [ebp - 0xb0c], ebx
sub edx, eax
mov dword [ebp - 0xab4], edx
cmp edx, dword [ebp - 0xb0c]
jl 0xb4b924
mov edx, dword [ebp - 0xb0c]
mov dword [ebp - 0xab4], edx
test esi, esi
jle 0xb4babd
test edx, edx
jle 0xb4babd
imul eax, dword [ebp - 0x3e8]
add eax, edi
mov edi, dword [ebp - 0xb18]
lea edi, [edi + eax*4]
mov eax, dword [ebp - 0xb04]
imul eax, ebx
mov dword [ebp - 0xae4], edi
add eax, ecx
mov ecx, dword [ebp - 0xae8]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x3e8]
shl ecx, 2
mov dword [ebp - 0xb18], ecx
mov ecx, dword [ebp - 0xb04]
shl ecx, 2
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xb04], ecx
mov ebx, eax
mov dword [ebp - 0xb34], esi
add edi, 2
lea edx, [eax + 3]
sub ebx, dword [ebp - 0xae4]
mov dword [ebp - 0xb0c], edx
mov dword [ebp - 0xb84], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xb4ba6a
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xaec]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb84]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xb0c]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xaec]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb0c]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xaea]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb0c]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xb34]
cdq
idiv ecx
mov edx, dword [ebp - 0xb0c]
add al, bl
mov ebx, dword [ebp - 0xb84]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0xb0c], edx
mov dword [ebp - 0xb34], esi
jne 0xb4b9a4
mov edi, dword [ebp - 0xae4]
mov eax, dword [ebp - 0xae8]
add edi, dword [ebp - 0xb18]
add eax, dword [ebp - 0xb04]
sub dword [ebp - 0xab4], 1
mov esi, dword [ebp - 0xac4]
mov dword [ebp - 0xae4], edi
mov dword [ebp - 0xae8], eax
jne 0xb4b984
push dword [ebp - 0xacc]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xac0]
mov edi, dword [ebp - 0xb24]
test eax, eax
je 0xb4baf5
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0xb88], 0
jl 0xb4bc29
mov eax, dword [ebp - 0x7ec]
mov ebx, dword [ebp - 0x7e4]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0xac0], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xab0]
mov dword [ebp - 0xacc], ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x798]
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xaec], eax
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xae4], eax
push 0x2c
push eax
mov dword [ebp - 0xae8], eax
lea eax, [ebp - 0x48c]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x3a0]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xaf8]
test ebx, ebx
je 0xb4bc2f
mov esi, dword [0xc93028]
mov ecx, esi
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xb4b783
mov esi, dword [0xc93034]
lea ecx, [ebp - 0xab0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb4bc02
mov eax, dword [ebp - 0xa9c]
mov dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0xaac]
mov dword [ebp - 0xae4], eax
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0xae8], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0xb18], edi
test edi, edi
jne 0xb4c28d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, dword [ebp - 0xaf8]
mov eax, dword [ebp - 0xb10]
test eax, eax
je 0xb4bc4a
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
test edi, edi
je 0xb4bc5f
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xb08]
test eax, eax
je 0xb4bc7a
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov edi, 0xc96238
mov ecx, dword [ebp - 0x7e8]
xor ebx, ebx
test ecx, ecx
je 0xb4bcd0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb4bc8e
mov eax, dword [ebp - 0x7e8]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xb4bcb6
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xb4bcae
push dword [ebp - 0x7e8]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x7e8], ebx
mov ecx, dword [ebp - 0x7e4]
test ecx, ecx
je 0xb4bd1f
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb4bcdd
mov eax, dword [ebp - 0x7e4]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xb4bd05
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xb4bcfd
push dword [ebp - 0x7e4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x7e4], ebx
mov edx, dword [ebp - 0x7e0]
test edx, edx
je 0xb4bd6b
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb4bd2e
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xb4bd56
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xb4bd48
mov edx, dword [ebp - 0x7e0]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x7e0], ebx
cmp dword [ebp - 0x7dc], 0
je 0xb4bd90
push dword [ebp - 0x7dc]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x7dc], ebx
cmp dword [ebp - 0x7d8], 0
je 0xb4bdb5
push dword [ebp - 0x7d8]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x7d8], ebx
cmp dword [ebp - 0x7d4], 0
je 0xb4bdda
push dword [ebp - 0x7d4]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x7d4], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xb4bddc
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jle 0xb4be3e
sub eax, 1
mov dword [0xc95890], eax
jne 0xb4be3e
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb4be12
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb4be01
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0xc95878]
mov esi, dword [0xc9304c]
mov ecx, esi
mov dword [ebp - 0xae0], eax
call dword [0xc99200]
call esi
sub eax, dword [0xc95870]
lea edi, [ebp - 0x2fc]
push 7
mov dword [ebp - 0xaf8], eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
xor ebx, ebx
mov edi, 0xc96238
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xb4be7d
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jne 0xb4c990
push 0x338
mov esi, ebx
mov dword [ebp - 0xb10], ebx
push ebx
mov dword [ebp - 0xb08], ebx
mov dword [ebp - 0xab8], esi
mov dword [ebp - 0xb5c], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb58], eax
test eax, eax
je 0xb4c984
or dword [ebp - 0xb20], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0xb14], ebx
mov edx, ebx
mov dword [ebp - 0xb30], eax
mov esi, dword [ebp - 0xc44]
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xc44]
xor ebx, edi
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xc44]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xc44]
shl esi, 8
add dword [ebp - 0xc44], 8
movzx eax, byte [eax + 5]
or esi, eax
xor edx, esi
xor edx, ebx
xor edx, 0xac987321
mov dword [ebp - 0xb50], edx
lea eax, [edx + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb50]
rol eax, 0xa
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xb50]
xor eax, edx
mov dword [ebp - 0xb50], eax
imul edx, dword [ebp - 0xb50], 0x605e
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor ebx, edx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xb50]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb50], eax
xor edx, 0xab69605e
mov eax, 0x7f1137f
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
mov eax, dword [ebp - 0xb50]
xor eax, edx
mov dword [ebp - 0xb50], eax
add eax, 0x7f1137f
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb50]
rol eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub edx, eax
mov eax, dword [ebp - 0xb50]
xor eax, edx
mov dword [ebp - 0xb50], eax
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb50]
ror eax, 0xa
xor edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor edx, eax
xor edx, dword [ebp - 0xb50]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea eax, [ebx - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0xb50], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb50]
shr eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xb50]
xor eax, edx
mov dword [ebp - 0xb50], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor ebx, edx
mov eax, ebx
mov edx, ebx
xor eax, 0xab69
rol ebx, 7
rol eax, 5
imul eax, eax, 0x7f1
add eax, ebx
mov ebx, dword [ebp - 0xb50]
xor ebx, eax
mov dword [ebp - 0xb50], ebx
xor ebx, edx
mov edx, dword [ebp - 0xb50]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xb50], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb50]
ror eax, 6
sub edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xb50]
xor eax, edx
mov dword [ebp - 0xb50], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb50]
ror eax, 0xe
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xb50]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xb50], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb50]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xb30]
xor edx, dword [ebp - 0xb14]
xor ebx, edx
mov dword [ebp - 0xb14], edi
mov edx, dword [ebp - 0xb50]
xor edx, dword [ebp - 0xb20]
mov byte [eax - 4], bl
mov byte [eax], dl
ror ebx, 8
mov byte [eax - 5], bl
ror edx, 8
mov byte [eax - 1], dl
ror ebx, 8
mov byte [eax - 6], bl
ror edx, 8
mov byte [eax - 2], dl
ror ebx, 8
ror edx, 8
mov byte [eax - 7], bl
mov byte [eax - 3], dl
add eax, 8
ror ebx, 8
ror edx, 8
sub dword [ebp - 0xc48], 1
mov dword [ebp - 0xb20], esi
mov dword [ebp - 0xb30], eax
jne 0xb4beef
mov esi, dword [ebp - 0xb58]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xb4c24f
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xb4c7aa
cmp edx, dword [0x9fc02c]
jne 0xb4c7aa
mov ebx, dword [ebp - 0xb5c]
mov edi, esi
xor eax, eax
mov dword [ebp - 0xab8], edi
mov esi, eax
jmp 0xb4c7be
mov eax, dword [ebp - 0xabc]
xor ecx, ecx
sub eax, dword [ebp - 0xac8]
mov ebx, dword [ebp - 0xad8]
mov esi, dword [0xc9300c]
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0x488], eax
mov eax, ebx
sub eax, dword [ebp - 0xadc]
mov dword [ebp - 0x484], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc34], ecx
mov word [ebp - 0x480], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x47e], ax
lea eax, [ebp - 0xc34]
push eax
push ecx
lea eax, [ebp - 0x48c]
mov dword [ebp - 0xb04], ecx
push eax
mov dword [ebp - 0x47c], ecx
mov dword [ebp - 0x478], ecx
mov dword [ebp - 0x474], ecx
mov dword [ebp - 0x470], ecx
mov dword [ebp - 0x46c], ecx
mov dword [ebp - 0x468], ecx
mov dword [ebp - 0x464], ecx
mov ecx, esi
push edi
mov dword [ebp - 0x48c], 0x28
call dword [0xc99200]
call esi
mov dword [ebp - 0xad8], eax
test eax, eax
jne 0xb4c370
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xb04], eax
test eax, eax
jle 0xb4c35b
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb04], eax
test eax, eax
js 0xb4c6e3
mov dword [ebp - 0xb04], 0x80004005
jmp 0xb4c6e3
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x798]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb4c39a
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xabc]
push dword [ebp - 0xad8]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0xadc]
sub eax, ebx
push edi
mov dword [ebp - 0x394], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0xac0]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0xac0], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x3a0]
mov ecx, edi
push eax
push dword [ebp - 0xb18]
call dword [0xc99200]
call edi
mov edi, dword [ebp - 0xb18]
xor eax, eax
mov esi, dword [0xc9306c]
mov ecx, esi
push eax
push dword [ebp - 0xaf0]
lea eax, [ebp - 0x3a0]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xacc]
push edi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xae0], eax
jne 0xb4c491
cmp dword [ebp - 0xac4], 0
je 0xb4c485
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
jmp 0xb4c496
mov dword [ebp - 0xaf0], 0xffffff
jmp 0xb4c4a2
mov eax, 0xffa8a8a8
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xb4c], eax
mov ecx, dword [ebp - 0xac8]
xor eax, eax
mov edx, eax
test ecx, ecx
jns 0xb4c4be
mov edx, ecx
neg edx
xor ecx, ecx
mov dword [ebp - 0xac8], ecx
jmp 0xb4c4c0
xor ecx, ecx
test ebx, ebx
jns 0xb4c4ca
mov eax, ebx
mov ebx, ecx
neg eax
mov esi, dword [ebp - 0x398]
mov ecx, dword [ebp - 0xae4]
sub esi, edx
sub ecx, dword [ebp - 0xac8]
mov dword [ebp - 0xac4], esi
cmp esi, ecx
jl 0xb4c4f0
mov esi, ecx
mov dword [ebp - 0xac4], ecx
mov ecx, dword [ebp - 0x394]
sub dword [ebp - 0xae8], ebx
sub ecx, eax
mov dword [ebp - 0xacc], ecx
cmp ecx, dword [ebp - 0xae8]
jl 0xb4c518
mov ecx, dword [ebp - 0xae8]
mov dword [ebp - 0xacc], ecx
test esi, esi
jle 0xb4c6b1
test ecx, ecx
jle 0xb4c6b1
imul eax, dword [ebp - 0x398]
mov ecx, dword [ebp - 0xab4]
add eax, edx
mov edx, dword [ebp - 0xae4]
imul ebx, edx
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0xaec]
mov dword [ebp - 0xabc], eax
add ebx, dword [ebp - 0xac8]
lea ecx, [ecx + ebx*4]
mov ebx, dword [ebp - 0x398]
shl ebx, 2
shl edx, 2
mov dword [ebp - 0xac8], ecx
mov dword [ebp - 0xadc], ebx
mov dword [ebp - 0xaec], edx
mov ebx, ecx
mov dword [ebp - 0xae8], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [ebp - 0xab4], edx
lea edi, [eax + 2]
mov dword [ebp - 0xae4], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xb4c658
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xb4c]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xae4]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xab4]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xb4c]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xab4]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xaee]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xab4]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xae8]
cdq
idiv ecx
mov edx, dword [ebp - 0xab4]
add al, bl
mov ebx, dword [ebp - 0xae4]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0xab4], edx
mov dword [ebp - 0xae8], esi
jne 0xb4c592
mov eax, dword [ebp - 0xabc]
mov ecx, dword [ebp - 0xac8]
add eax, dword [ebp - 0xadc]
add ecx, dword [ebp - 0xaec]
sub dword [ebp - 0xacc], 1
mov esi, dword [ebp - 0xac4]
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xac8], ecx
jne 0xb4c576
mov edi, dword [ebp - 0xb18]
push dword [ebp - 0xad8]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xac0]
test eax, eax
je 0xb4c6e3
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0xb04], 0
jl 0xb4bc29
mov edi, dword [ebp - 0xaf8]
xor eax, eax
inc eax
cmp dword [ebp - 0xae0], eax
jne 0xb4c74c
mov esi, dword [section..data]
xor eax, eax
push 0xcc0020
push eax
push eax
push edi
push dword [ebp - 0xad0]
mov ecx, esi
push dword [ebp - 0xad4]
push dword [ebp - 0x7c8]
push dword [ebp - 0x7cc]
push dword [ebp - 0xafc]
call dword [0xc99200]
call esi
jmp 0xb4c789
push dword [ebp - 0xab8]
mov ecx, dword [ebp - 0xad0]
xor edx, edx
mov eax, dword [ebp - 0xad4]
mov esi, dword [0xc93020]
push ecx
push eax
push edx
push edx
push edi
push ecx
push eax
push dword [ebp - 0x3dc]
mov ecx, esi
push dword [ebp - 0x3e0]
push dword [ebp - 0xafc]
call dword [0xc99200]
call esi
push dword [ebp - 0xaf4]
mov esi, dword [0xc93040]
mov ecx, esi
push dword [ebp - 0xafc]
call dword [0xc99200]
call esi
jmp 0xb4bc2f
or dword [ebp - 0xc4c], 0xffffffff
mov ebx, 0xc004d501
mov edi, dword [ebp - 0xab8]
xor eax, eax
test esi, esi
je 0xb4c7d1
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb4c97e
mov eax, dword [ebp - 0xc4c]
xor ecx, ecx
push 0x40
push ecx
mov ebx, 0xc960a0
mov esi, edi
push ebx
mov byte [eax + edi], cl
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xb4c914
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbfc]
jne 0xb4c809
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xb4c977
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb08], ecx
cmp word [eax], dx
jne 0xb4c87f
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xb4c87f
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xb4c87f
cmp dword [edx], 0x4550
jne 0xb4c87f
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc50]
je 0xb4c88c
cmp ax, word [ebp - 0xc54]
je 0xb4c88c
mov ecx, 0xc000000d
jmp 0xb4c884
mov ecx, 0xc000007b
mov dword [ebp - 0xb08], ecx
jmp 0xb4c89e
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xb5c], eax
test eax, eax
je 0xb4c908
mov edx, esi
mov dword [ebp - 0xb58], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb14], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xb4c8c0
sub edx, dword [ebp - 0xb14]
inc esi
add esi, edx
test ecx, ecx
js 0xb4c8f9
push dword [ebp - 0xb58]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xb4c914
mov ecx, dword [ebp - 0xb10]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xb08]
inc dword [ebp - 0xb10]
inc ebx
cmp ebx, dword [ebp - 0xb5c]
jb 0xb4c8af
add edi, 0x10
cmp byte [esi], 0
jne 0xb4c802
mov ebx, dword [ebp - 0xb08]
mov esi, dword [ebp - 0xab8]
test esi, esi
je 0xb4c935
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb4c98b
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb4c94e
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb4c93d
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xb4c998
mov ebx, 0xc000007a
jmp 0xb4c91a
mov esi, dword [ebp - 0xab8]
mov ebx, 0xc000007a
jmp 0xb4c920
mov eax, dword [0xc95890]
inc eax
xor ebx, ebx
mov dword [0xc95890], eax
xor eax, eax
mov edi, 0xc96238
xchg dword [edi], eax
mov eax, dword [ebp - 0xaf8]
xor ecx, ecx
mov esi, dword [0xc93068]
inc ecx
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0xae0]
mov dword [ebp - 0x2e4], eax
lea eax, [ebp - 0x300]
push eax
push 4
pop eax
push eax
push 0x2021
mov dword [ebp - 0x300], ecx
mov dword [ebp - 0x2f8], ecx
mov dword [ebp - 0x2ec], ecx
mov dword [ebp - 0x2f0], ecx
mov dword [ebp - 0x2e8], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x2f4], 0x9966f291
call dword [0xc99200]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xb4ca07
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jle 0xb4ca69
sub eax, 1
mov dword [0xc95890], eax
jne 0xb4ca69
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb4ca3d
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb4ca2c
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xafc]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov ebx, dword [ebp - 0xb54]
xor eax, eax
lea edi, [ebp - 0xe18]
mov dword [ebp - 0xb5c], eax
mov dword [ebp - 0xb58], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xe24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb14], eax
test eax, eax
je 0xb4ec3c
push 0x28
pop ecx
mov esi, 0xc94ea0
mov dword [ebp - 0xb5c], eax
mov edi, eax
rep movsd dword es:[edi], dword [esi]
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb20], eax
test eax, eax
je 0xb4ec3c
mov ecx, dword [0xc94e98]
mov edi, eax
mov dword [eax], ecx
mov ecx, dword [0xc94e9c]
mov dword [eax + 4], ecx
mov dword [ebp - 0xb58], edi
rdtsc
mov dword [ebp - 0xb30], eax
mov dword [ebp - 0xb50], edx
xor eax, eax
mov dword [ebp - 0xb68], eax
lea eax, [ebp - 0xb2c]
push eax
push 4
pop esi
mov edx, esi
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb4ec31
mov edx, dword [ebp - 0xb2c]
lea eax, [ebp - 0xb68]
push eax
xor ecx, ecx
call fcn.00a32533
or eax, 0x10000000
jl 0xb4ec31
lea eax, [ebp - 0xb98]
mov edx, 0xa0
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb4ec31
mov edx, dword [ebp - 0xb98]
lea eax, [ebp - 0xb68]
mov ecx, dword [ebp - 0xb68]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xb4ec31
lea eax, [ebp - 0xb6c]
mov ecx, esi
push eax
push 8
pop edx
call fcn.00a32533
test eax, eax
js 0xb4ec31
mov edx, dword [ebp - 0xb6c]
lea eax, [ebp - 0xb68]
mov ecx, dword [ebp - 0xb68]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xb4ec31
lea eax, [ebp - 0xbc0]
mov ecx, esi
push eax
push 8
pop edx
call fcn.00a32533
test eax, eax
js 0xb4ec31
mov edx, dword [ebp - 0xbc0]
lea eax, [ebp - 0xb68]
mov ecx, dword [ebp - 0xb68]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xb4ec31
mov esi, dword [ebp - 0xb68]
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xbc0], edi
test edi, edi
je 0xb4ec3c
lea eax, [ebp - 0xddc]
mov ecx, edi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xb4ebaa
lea ecx, [edi + esi]
lea eax, [edi + 8]
mov dword [ebp - 0xb6c], ecx
cmp eax, ecx
ja 0xb4ebaa
mov eax, dword [ebp - 0xddc]
push 4
pop ecx
mov dword [edi], ecx
mov dword [eax], ecx
mov esi, edi
xor eax, eax
mov dword [ebp - 0xbbc], esi
mov edi, eax
mov edx, dword [esi]
lea eax, [ebp - 0xb3c]
push eax
call fcn.00a32533
test eax, eax
js 0xb4ebaa
mov edx, dword [ebp - 0xb3c]
lea eax, [ebp - 0xbbc]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb4ebaa
mov esi, dword [ebp - 0xbbc]
xor eax, eax
inc edi
inc eax
cmp edi, eax
jae 0xb4ccd1
push 4
pop ecx
jmp 0xb4cc8c
lea eax, [ebp - 0xd7c]
mov ecx, esi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xb4ebaa
lea eax, [esi + 0xa4]
cmp eax, dword [ebp - 0xb6c]
ja 0xb4ebaa
mov edi, dword [ebp - 0xd7c]
mov dword [esi], 0xa0
mov esi, dword [ebp - 0xb14]
push 0x28
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xbc0]
xor eax, eax
mov esi, edi
mov dword [ebp - 0xb3c], eax
mov dword [ebp - 0xbb4], esi
mov edx, dword [esi]
lea eax, [ebp - 0xb74]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
test eax, eax
js 0xb4ebaa
mov edx, dword [ebp - 0xb74]
lea eax, [ebp - 0xbb4]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb4ebaa
mov eax, dword [ebp - 0xb3c]
mov esi, dword [ebp - 0xbb4]
inc eax
mov dword [ebp - 0xb3c], eax
cmp eax, 2
jb 0xb4cd2b
lea eax, [ebp - 0xd84]
mov ecx, esi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xb4ebaa
lea eax, [esi + 0xc]
cmp eax, dword [ebp - 0xb6c]
ja 0xb4ebaa
mov edx, dword [ebp - 0xb20]
mov ecx, dword [ebp - 0xd84]
mov dword [esi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov esi, edi
xor eax, eax
mov dword [ebp - 0xb90], esi
mov edi, eax
mov edx, dword [esi]
lea eax, [ebp - 0xb94]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
test eax, eax
js 0xb4ebaa
mov edx, dword [ebp - 0xb94]
lea eax, [ebp - 0xb90]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb4ebaa
mov esi, dword [ebp - 0xb90]
inc edi
cmp edi, 3
jb 0xb4cdcc
lea eax, [ebp - 0xd8c]
mov ecx, esi
push eax
push 4
pop edi
mov edx, edi
call fcn.00a32533
test eax, eax
js 0xb4ebaa
lea eax, [esi + 0xc]
cmp eax, dword [ebp - 0xb6c]
ja 0xb4ebaa
mov eax, dword [ebp - 0xd8c]
mov ecx, dword [ebp - 0xb30]
mov dword [esi], 8
mov dword [eax], ecx
mov ecx, dword [ebp - 0xb50]
mov dword [eax + 4], ecx
lea eax, [ebp - 0xb28]
mov edx, edi
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xb4ebaa
mov esi, dword [ebp - 0xb28]
lea eax, [ebp - 0xbd0]
push eax
push 8
pop edx
mov ecx, edi
mov dword [ebp - 0xb44], esi
call fcn.00a32533
test eax, eax
js 0xb4ebaa
mov edx, dword [ebp - 0xbd0]
lea eax, [ebp - 0xb44]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb4ebaa
xor edx, edx
mov edi, edx
mov dword [ebp - 0xbd0], edx
mov dword [ebp - 0xb28], edx
mov dword [ebp - 0xb90], edx
mov dword [ebp - 0xb74], edx
mov dword [ebp - 0xbb4], edx
mov dword [ebp - 0xb3c], edx
mov dword [ebp - 0xbbc], edx
mov dword [ebp - 0xb6c], edx
mov dword [ebp - 0xb98], edx
rdtsc
mov dword [ebp - 0xb94], edi
mov dword [ebp - 0xb2c], eax
mov dword [ebp - 0xb14], edx
push 8
pop ecx
mov dword [ebp - 0xc70], ecx
mov edx, dword [ebp - 0xb68]
lea eax, [ebp - 0xc70]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4d01d
mov eax, dword [ebp - 0xc70]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0xb20], ecx
cmp ecx, eax
jae 0xb4cf42
mov esi, 0xc0000095
jmp 0xb4d01d
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb30], eax
test eax, eax
jne 0xb4cf66
mov esi, 0xc0000017
jmp 0xb4d01d
push 4
pop edx
lea ecx, [ebp - 0xb00]
mov dword [ebp - 0xb00], eax
push ecx
mov ecx, eax
mov dword [eax], edx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4d002
mov ecx, dword [ebp - 0xb00]
mov eax, dword [ebp - 0xb68]
mov dword [ecx], eax
lea eax, [ebp - 0xb00]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0xb30]
test esi, esi
js 0xb4d008
mov ecx, dword [ebp - 0xb20]
push dword [ebp - 0xb68]
mov edx, dword [ebp - 0xb2c]
push dword [ebp - 0xbc0]
mov dword [eax + ecx - 8], edx
mov edx, dword [ebp - 0xb14]
push dword [ebp - 0xb00]
mov dword [eax + ecx - 4], edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xb30]
add esp, 0xc
mov ecx, dword [ebp - 0xb20]
xor edx, edx
mov dword [ebp - 0xbd0], eax
mov eax, edx
mov dword [ebp - 0xb28], ecx
jmp 0xb4d00a
mov eax, dword [ebp - 0xb30]
xor edx, edx
test eax, eax
je 0xb4d01d
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xb4e9a9
xor ecx, ecx
mov dword [ebp - 0xb00], ecx
cmp dword [ebp - 0xbd0], ecx
jne 0xb4d043
mov esi, 0xc000000d
jmp 0xb4d6a4
mov esi, dword [ebp - 0xb28]
test esi, esi
je 0xb4d69f
lea eax, [esi + 8]
push eax
push ecx
mov dword [ebp - 0xb2c], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb68], eax
test eax, eax
je 0xb4d69f
mov edi, dword [ebp - 0xbd0]
xor eax, eax
mov cl, al
test esi, esi
je 0xb4d08d
xor cl, byte [eax + edi]
inc eax
cmp eax, esi
jb 0xb4d085
mov eax, 0xb1b54a58
mov dword [ebp - 0x378], eax
mov eax, 0xc81ecb17
mov dword [ebp - 0x374], eax
mov eax, esi
shr eax, 3
mov dword [ebp - 0xb14], eax
test eax, eax
je 0xb4d49c
movzx edx, word [ebp - 0x376]
mov eax, 0xc81ecb17
movzx esi, ax
mov ebx, 0xb1b54a58
movzx eax, word [ebp - 0x372]
mov dword [ebp - 0xb20], eax
movzx eax, bx
xor ebx, 0xc81ecb17
mov dword [ebp - 0xb30], eax
mov eax, dword [ebp - 0xb68]
add eax, 7
mov dword [ebp - 0xba4], esi
mov dword [ebp - 0xbac], eax
lea esi, [edi + 2]
xor eax, eax
mov dword [ebp - 0xb50], edx
mov dword [ebp - 0xba8], ebx
mov edx, eax
mov dword [ebp - 0xbb0], esi
or ebx, 0xffffffff
mov dword [ebp - 0xbb8], eax
mov dword [ebp - 0xbcc], eax
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xbb0]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xbb0]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xbb0]
shl esi, 8
add dword [ebp - 0xbb0], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov eax, ebx
sub eax, dword [ebp - 0xb30]
xor eax, 0xc81ecb17
xor eax, edi
xor edx, eax
mov dword [ebp - 0xb8c], edx
mov edx, 0xc81ecb17
mov eax, dword [ebp - 0xb8c]
xor edx, eax
ror edx, 0xf
imul edx, dword [ebp - 0xb50]
ror eax, 7
add edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
mov eax, ebx
ror eax, 0xa
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [ebp - 0xba4]
sub edx, eax
mov eax, dword [ebp - 0xb8c]
xor eax, edx
mov edx, dword [ebp - 0xba4]
xor edx, eax
mov dword [ebp - 0xb8c], eax
rol edx, 4
imul edx, dword [ebp - 0xb20]
rol eax, 5
add edx, eax
mov eax, 0xc81ecb17
xor ebx, edx
mov edx, 0xb1b54a58
xor edx, ebx
sub eax, edx
mov edx, dword [ebp - 0xb8c]
xor edx, eax
mov dword [ebp - 0xb8c], edx
sub edx, dword [ebp - 0xb30]
imul edx, dword [ebp - 0xb50]
mov eax, dword [ebp - 0xb8c]
shr eax, 6
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb8c]
mov eax, ebx
ror eax, 0xf
xor eax, dword [ebp - 0xba4]
imul eax, dword [ebp - 0xb30]
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [ebp - 0xb20]
imul eax, dword [ebp - 0xba4]
xor ebx, eax
mov eax, ebx
sub eax, dword [ebp - 0xb30]
sub eax, 0xc81ecb17
xor edx, eax
mov eax, dword [ebp - 0xb20]
mov dword [ebp - 0xb8c], edx
xor eax, dword [ebp - 0xb8c]
imul eax, dword [ebp - 0xb50]
ror edx, 0xa
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb30]
xor edx, ebx
mov eax, ebx
rol edx, 6
imul edx, dword [ebp - 0xba4]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0xb8c]
xor eax, edx
mov edx, dword [ebp - 0xb20]
mov dword [ebp - 0xb8c], eax
ror eax, 0xf
sub eax, edx
imul eax, dword [ebp - 0xb30]
xor ebx, eax
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0xb30]
shr eax, 1
xor edx, eax
mov eax, ebx
xor dword [ebp - 0xb8c], edx
mov edx, ebx
sub edx, dword [ebp - 0xba4]
rol edx, 3
imul edx, dword [ebp - 0xb30]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0xb8c]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb8c], eax
sub edx, dword [ebp - 0xba4]
imul edx, dword [ebp - 0xb50]
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 9
imul edx, dword [ebp - 0xba4]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0xb8c]
xor eax, edx
mov dword [ebp - 0xb8c], eax
sub eax, 0xb1b54a58
sub eax, dword [ebp - 0xb20]
xor ebx, eax
mov eax, dword [ebp - 0xb50]
xor eax, ebx
mov edx, ebx
imul eax, dword [ebp - 0xb30]
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0xb20]
xor dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0xb8c]
xor edx, eax
rol edx, 4
imul edx, dword [ebp - 0xb50]
ror eax, 0x10
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 0xa
imul edx, dword [ebp - 0xba4]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0xb8c]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb8c], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, dword [ebp - 0xb20]
xor edx, eax
xor ebx, edx
mov edx, 0xc81ecb17
xor edx, ebx
mov eax, ebx
rol edx, 8
imul edx, dword [ebp - 0xb30]
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xb8c]
xor eax, edx
mov edx, 0xc81ecb17
sub edx, eax
mov dword [ebp - 0xb8c], eax
ror edx, 0xb
imul edx, dword [ebp - 0xb50]
ror eax, 0xc
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb50]
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0xba4]
xor ebx, dword [ebp - 0xba8]
shr eax, 8
xor edx, eax
mov eax, dword [ebp - 0xbac]
xor dword [ebp - 0xb8c], edx
mov edx, dword [ebp - 0xb8c]
xor ebx, edx
xor edx, dword [ebp - 0xbb8]
xor ebx, dword [ebp - 0xbcc]
mov byte [eax - 4], dl
mov byte [eax], bl
ror edx, 8
mov byte [eax - 5], dl
ror ebx, 8
mov byte [eax - 1], bl
ror edx, 8
mov byte [eax - 6], dl
ror ebx, 8
mov byte [eax - 2], bl
ror edx, 8
ror ebx, 8
mov byte [eax - 7], dl
mov byte [eax - 3], bl
add eax, 8
ror edx, 8
ror ebx, 8
sub dword [ebp - 0xb14], 1
mov dword [ebp - 0xbcc], esi
mov esi, dword [ebp - 0xbb0]
mov dword [ebp - 0xbb8], edi
mov dword [ebp - 0xbac], eax
jne 0xb4d123
mov ebx, dword [ebp - 0xb54]
mov esi, dword [ebp - 0xb28]
movzx eax, cl
mov ecx, dword [ebp - 0xb68]
cdq
mov dword [ecx + esi], eax
mov dword [ecx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xb28], edi
test edi, edi
jne 0xb4d4d4
mov esi, 0xc0000017
jmp 0xb4d5e7
mov esi, dword [ebp - 0xb2c]
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0xb4d55b
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0xb68]
push esi
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb4d55b
mov dword [edi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
push 8
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xb28]
pop eax
push eax
push eax
mov dword [edi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xb4d564
mov esi, 0xc0000017
jmp 0xb4d580
mov esi, 0xc0000017
xor edx, edx
jmp 0xb4d580
mov dword [edi + 0x14], ecx
mov esi, edx
mov eax, dword [0xc94e90]
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ebp - 0xb00], edi
mov edi, edx
mov dword [ecx + 4], eax
test edi, edi
je 0xb4d5e7
cmp dword [edi + 4], 0
je 0xb4d5a0
push dword [edi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 4], edx
cmp dword [edi + 0xc], 0
je 0xb4d5bc
push dword [edi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0xc], edx
cmp dword [edi + 0x14], 0
je 0xb4d5d8
push dword [edi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0x14], edx
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
test esi, esi
js 0xb4d601
mov edi, dword [ebp - 0xb00]
mov dword [ebp - 0xb94], edi
mov dword [ebp - 0xb00], eax
jmp 0xb4d607
mov edi, dword [ebp - 0xb94]
push dword [ebp - 0xb68]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb00]
test eax, eax
je 0xb4d6a4
mov ecx, dword [eax + 4]
test ecx, ecx
je 0xb4d64a
push ecx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb00]
xor edx, edx
mov dword [eax + 4], edx
jmp 0xb4d64c
xor edx, edx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0xb4d66d
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb00]
xor edx, edx
mov dword [eax + 0xc], edx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0xb4d68e
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb00]
xor edx, edx
mov dword [eax + 0x14], edx
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb4d6a4
mov esi, 0xc0000001
or esi, 0x10000000
jl 0xb4e9a9
mov edx, dword [edi]
lea eax, [ebp - 0xb1c]
push 4
pop ecx
push eax
mov dword [ebp - 0xb1c], ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4d743
mov ecx, dword [ebp - 0xb1c]
lea eax, [ebp - 0xb1c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4d743
mov edx, dword [edi + 8]
lea eax, [ebp - 0xb1c]
mov ecx, dword [ebp - 0xb1c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4d743
mov ecx, dword [ebp - 0xb1c]
lea eax, [ebp - 0xb1c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4d743
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0xb1c]
mov ecx, dword [ebp - 0xb1c]
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0xb1c]
test esi, esi
jns 0xb4d749
mov eax, dword [ebp - 0xc7c]
mov dword [ebp - 0xb1c], eax
test esi, esi
js 0xb4d8b2
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb00], ecx
test ecx, ecx
jne 0xb4d77d
mov esi, 0xc0000017
jmp 0xb4d8b2
mov eax, dword [edi]
mov dword [ecx], eax
lea eax, [ebp - 0xb60]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xb60], ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4d897
push dword [edi]
push dword [edi + 4]
push dword [ebp - 0xb60]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi]
lea eax, [ebp - 0xb60]
mov ecx, dword [ebp - 0xb60]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4d897
mov ecx, dword [ebp - 0xb60]
mov eax, dword [edi + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xb60]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4d897
push dword [edi + 8]
push dword [edi + 0xc]
push dword [ebp - 0xb60]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi + 8]
lea eax, [ebp - 0xb60]
mov ecx, dword [ebp - 0xb60]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4d897
mov ecx, dword [ebp - 0xb60]
mov eax, dword [edi + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xb60]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4d897
push dword [edi + 0x10]
push dword [edi + 0x14]
push dword [ebp - 0xb60]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0xb60]
mov ecx, dword [ebp - 0xb60]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
xor edx, edx
mov eax, dword [ebp - 0xb00]
test esi, esi
js 0xb4d89f
mov ecx, dword [ebp - 0xb1c]
mov dword [ebp - 0xb90], eax
mov eax, edx
mov dword [ebp - 0xb74], ecx
jmp 0xb4d89f
mov eax, dword [ebp - 0xb00]
xor edx, edx
test eax, eax
je 0xb4d8b2
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xb4e9a9
push 8
xor eax, eax
pop edi
mov dword [ebp - 0xb60], eax
mov dword [ebp - 0xb1c], eax
mov dword [ebp - 0xc84], edi
mov edx, dword [ebp - 0xb44]
lea eax, [ebp - 0xc84]
push eax
mov ecx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
jl 0xb4d9c2
mov eax, dword [ebp - 0xc84]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xb4d90e
mov esi, 0xc0000095
jmp 0xb4d92e
mov dword [ebp - 0xc8c], ecx
lea eax, [ebp - 0xc8c]
mov edx, edi
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0xc8c]
test esi, esi
jns 0xb4d934
mov eax, dword [ebp - 0xc88]
mov dword [ebp - 0xb00], eax
test esi, esi
js 0xb4d9c2
mov edi, dword [ebp - 0xbc0]
test edi, edi
je 0xb4d9bd
xor eax, eax
push 4
pop edx
inc eax
cmp edx, eax
jbe 0xb4d9bd
mov ecx, edi
xor eax, eax
mov dword [ebp - 0xb64], ecx
mov dword [ebp - 0xb44], eax
mov eax, dword [ecx]
mov dword [ebp - 0xb28], eax
lea eax, [ebp - 0xb64]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4d9c2
mov edx, dword [ebp - 0xb28]
lea eax, [ebp - 0xb64]
mov ecx, dword [ebp - 0xb64]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4d9c2
mov eax, dword [ebp - 0xb44]
xor ecx, ecx
inc eax
inc ecx
cmp eax, ecx
mov dword [ebp - 0xb44], eax
mov ecx, dword [ebp - 0xb64]
jae 0xb4d9f8
push 4
pop edx
jmp 0xb4d966
mov esi, 0xc000000d
mov edi, dword [ebp - 0xb3c]
test esi, esi
js 0xb4e9a9
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xb4db6b
mov eax, dword [ebp - 0xbb4]
mov esi, 0xd0000017
jmp 0xb4db76
mov eax, dword [ecx]
mov dword [ebp - 0xb44], eax
lea eax, [ebp - 0xb64]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4d9c2
mov eax, dword [ebp - 0xb44]
mov dword [ebp - 0xb60], eax
push 4
pop edx
cmp edx, 2
jbe 0xb4d9bd
mov ecx, edi
xor eax, eax
mov dword [ebp - 0xb78], ecx
mov edi, eax
mov eax, dword [ecx]
mov dword [ebp - 0xb64], eax
lea eax, [ebp - 0xb78]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4da99
mov edx, dword [ebp - 0xb64]
lea eax, [ebp - 0xb78]
mov ecx, dword [ebp - 0xb78]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4da99
mov ecx, dword [ebp - 0xb78]
inc edi
cmp edi, 2
jae 0xb4da80
push 4
pop edx
jmp 0xb4da37
mov edi, dword [ecx]
lea eax, [ebp - 0xb78]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
jns 0xb4daa7
mov edi, dword [ebp - 0xb1c]
test esi, esi
js 0xb4d9c2
mov edx, dword [ebp - 0xb00]
lea eax, [ebp - 0xb40]
push 4
pop ecx
push eax
mov dword [ebp - 0xb40], ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4db40
mov ecx, dword [ebp - 0xb40]
lea eax, [ebp - 0xb40]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4db40
mov edx, dword [ebp - 0xb60]
lea eax, [ebp - 0xb40]
mov ecx, dword [ebp - 0xb40]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4db40
mov ecx, dword [ebp - 0xb40]
lea eax, [ebp - 0xb40]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4db40
mov ecx, dword [ebp - 0xb40]
lea eax, [ebp - 0xb40]
push eax
mov edx, edi
call fcn.00a32533
mov edi, dword [ebp - 0xb40]
mov esi, eax
test esi, esi
jns 0xb4db4e
mov edi, dword [ebp - 0xc9c]
test esi, esi
js 0xb4d9c2
cmp edi, 0x400000
jbe 0xb4db60
mov esi, 0x8000ffff
jmp 0xb4e9a9
mov dword [ebp - 0xb3c], edi
jmp 0xb4d9c8
mov dword [ebp - 0xbb4], eax
mov esi, 0x10000000
test esi, esi
js 0xb4e9a9
mov ecx, dword [ebp - 0xb90]
test ecx, ecx
je 0xb4dc1e
test eax, eax
je 0xb4dc1e
mov dword [ebp - 0xe88], eax
xor eax, eax
mov dword [ebp - 0xe7c], eax
lea eax, [ebp - 0xca0]
push eax
xor eax, eax
mov dword [ebp - 0xe8c], ecx
mov ecx, dword [ebp - 0xb74]
inc eax
push 0x9f29b8
push eax
mov dword [ebp - 0xe84], ecx
mov dword [ebp - 0xe80], edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xb4dc28
push 0x9fc030
push dword [ebp - 0xca0]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xb4dc28
xor eax, eax
mov ecx, esi
push eax
push 0x14
lea eax, [ebp - 0xe8c]
push eax
push 0x86
call dword [0xc99200]
call esi
mov esi, eax
or esi, 0x10000000
jl 0xb4dc46
mov edi, dword [ebp - 0xe80]
mov dword [ebp - 0xb3c], edi
jmp 0xb4dc46
mov esi, 0x80070057
jmp 0xb4e9a9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xb4dc3f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xb4dc46
mov esi, 0x80004005
cmp esi, 0xd0000023
jne 0xb4dc58
mov esi, 0x8007007a
jmp 0xb4e9a9
test esi, esi
js 0xb4e9a9
mov eax, dword [ebp - 0xbb4]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xb40], ecx
mov dword [ebp - 0xb70], ecx
mov dword [ebp - 0xb7c], eax
cmp edi, edx
jae 0xb4dc8b
mov esi, 0xc000003e
jmp 0xb4e07c
mov edi, dword [eax]
lea ecx, [ebp - 0xb7c]
push ecx
mov ecx, eax
mov dword [ebp - 0xb78], edi
call fcn.00a32533
mov esi, eax
xor ecx, ecx
test esi, esi
js 0xb4e07c
lea eax, [ebp - 0xb70]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4e07a
mov eax, dword [ebp - 0xb3c]
sub eax, dword [ebp - 0xb70]
cmp eax, edi
jb 0xb4dead
mov eax, dword [ebp - 0xb7c]
lea ecx, [ebp - 0xb7c]
push ecx
mov edx, edi
mov dword [ebp - 0xb64], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4e07a
mov ecx, dword [ebp - 0xb70]
lea eax, [ebp - 0xb70]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4e07a
mov eax, dword [ebp - 0xb3c]
sub eax, dword [ebp - 0xb70]
push 4
pop edx
cmp eax, edx
jb 0xb4dead
mov ecx, dword [ebp - 0xb7c]
lea eax, [ebp - 0xb7c]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0xb60], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4e07a
mov ecx, dword [ebp - 0xb70]
lea eax, [ebp - 0xb70]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4e07a
mov eax, dword [ebp - 0xb3c]
sub eax, dword [ebp - 0xb70]
cmp eax, edi
jb 0xb4dead
mov eax, dword [ebp - 0xb7c]
lea ecx, [ebp - 0xb7c]
push ecx
mov edx, edi
mov dword [ebp - 0xb1c], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4e07a
mov ecx, dword [ebp - 0xb70]
lea eax, [ebp - 0xb70]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4e07a
mov eax, dword [ebp - 0xb3c]
sub eax, dword [ebp - 0xb70]
push 4
pop edx
cmp eax, edx
jb 0xb4dead
mov ecx, dword [ebp - 0xb7c]
mov eax, dword [ecx]
mov dword [ebp - 0xb00], eax
lea eax, [ebp - 0xb7c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4e07a
mov ecx, dword [ebp - 0xb70]
lea eax, [ebp - 0xb70]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4e07a
mov eax, dword [ebp - 0xb3c]
sub eax, dword [ebp - 0xb70]
mov ecx, dword [ebp - 0xb00]
cmp eax, ecx
jb 0xb4dead
lea eax, [ebp - 0xb70]
mov edx, ecx
mov ecx, dword [ebp - 0xb70]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4e07a
mov edx, dword [ebp - 0xb3c]
mov eax, edx
sub eax, dword [ebp - 0xb70]
jne 0xb4dead
mov esi, dword [ebp - 0xb78]
mov ecx, dword [ebp - 0xb00]
add ecx, 0xc
lea eax, [edi + esi]
add eax, ecx
cmp eax, edx
jne 0xb4dead
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xb4deb7
mov esi, 0xc0000017
jmp 0xb4dff7
mov esi, 0xc000003e
jmp 0xb4e07a
cmp dword [ebp - 0xb64], 0
je 0xb4def9
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb4deed
mov dword [edi + 4], eax
push esi
push dword [ebp - 0xb64]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb4df00
mov esi, 0xc0000017
xor eax, eax
jmp 0xb4df90
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
cmp dword [ebp - 0xb1c], 0
je 0xb4df3d
mov esi, dword [ebp - 0xb60]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb4deed
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xb1c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb4df43
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
cmp dword [ebp - 0xb7c], 0
je 0xb4df80
mov esi, dword [ebp - 0xb00]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb4deed
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xb7c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb4df86
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [ebp - 0xb40], edi
mov esi, eax
mov edi, eax
test edi, edi
je 0xb4dff7
cmp dword [edi + 4], 0
je 0xb4dfb0
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xb4dfcc
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xb4dfe8
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test esi, esi
js 0xb4e00d
mov eax, dword [ebp - 0xb40]
mov edi, ecx
mov dword [ebp - 0xbbc], eax
jmp 0xb4e013
mov edi, dword [ebp - 0xb40]
test edi, edi
je 0xb4e07c
cmp dword [edi + 4], 0
je 0xb4e033
push dword [edi + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 4], ecx
cmp dword [edi + 0xc], 0
je 0xb4e04f
push dword [edi + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0xc], ecx
cmp dword [edi + 0x14], 0
je 0xb4e06b
push dword [edi + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0x14], ecx
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
or esi, 0x10000000
jl 0xb4e9a9
mov eax, dword [ebp - 0xbbc]
mov dword [ebp - 0xb7c], ecx
mov dword [ebp - 0xb70], ecx
test eax, eax
je 0xb4e153
mov esi, dword [eax + 4]
mov dword [ebp - 0xb40], esi
test esi, esi
je 0xb4e153
mov edi, dword [eax]
test edi, edi
je 0xb4e153
add edi, 0xfffffff8
mov dword [ebp - 0xb78], ecx
push edi
push ecx
mov dword [ebp - 0xb64], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb60], eax
test eax, eax
je 0xb4e6fa
xor ecx, ecx
mov dword [ebp - 0xb1c], esi
mov dl, cl
mov ecx, 0xab69605e
mov dword [ebp - 0x360], ecx
mov ecx, 0x7f1137f
mov dword [ebp - 0x35c], ecx
mov ecx, eax
mov dword [ebp - 0xb00], ecx
and edi, 7
je 0xb4e25e
xor eax, eax
and dword [ebp - 0xb28], eax
mov dword [ebp - 0xc40], eax
mov dword [ebp - 0xb44], eax
test edi, edi
je 0xb4e19d
push 0x38
mov ebx, eax
pop ecx
movzx eax, byte [esi]
inc esi
cmp dword [ebp - 0xb28], 4
jge 0xb4e15d
add ecx, 0xffffffe0
shl eax, cl
mov ecx, dword [ebp - 0xb9c]
or ebx, eax
jmp 0xb4e165
mov esi, 0xd000000d
jmp 0xb4e9a9
shl eax, cl
or dword [ebp - 0xc40], eax
mov eax, dword [ebp - 0xb28]
sub ecx, 8
inc eax
mov dword [ebp - 0xb9c], ecx
mov dword [ebp - 0xb28], eax
cmp eax, edi
jl 0xb4e137
mov ecx, dword [ebp - 0xb00]
mov dword [ebp - 0xb44], ebx
mov ebx, dword [ebp - 0xb54]
mov eax, dword [ebp - 0xb44]
mov dword [ebp - 0xb1c], esi
and dword [ebp - 0xb68], 0
mov esi, eax
mov eax, dword [ebp - 0xc40]
xor esi, 0x92f65a5
xor eax, 0x699a899c
mov dword [ebp - 0xb28], esi
mov dword [ebp - 0xb74], eax
mov dword [ebp - 0xb3c], esi
mov dword [ebp - 0xb2c], eax
test edi, edi
je 0xb4e22c
mov ebx, dword [ebp - 0xb68]
push 4
pop esi
lea eax, [ecx + 1]
mov dword [ebp - 0xb00], eax
cmp ebx, esi
jge 0xb4e1f8
rol dword [ebp - 0xb3c], 8
mov eax, dword [ebp - 0xb3c]
jmp 0xb4e205
rol dword [ebp - 0xb2c], 8
mov eax, dword [ebp - 0xb2c]
mov byte [ecx], al
inc ebx
mov eax, dword [ebp - 0xb00]
mov ecx, eax
cmp ebx, edi
jl 0xb4e1dc
mov ebx, dword [ebp - 0xb54]
mov esi, dword [ebp - 0xb28]
mov dword [ebp - 0xb00], eax
mov eax, dword [ebp - 0xb74]
push 4
pop ecx
cmp edi, ecx
jbe 0xb4e241
push 8
pop ecx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
jmp 0xb4e270
xor eax, eax
mov dword [ebp - 0xb74], eax
cmp edi, ecx
jae 0xb4e276
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xb28], esi
jmp 0xb4e276
xor ecx, ecx
mov esi, ecx
mov dword [ebp - 0xb44], ecx
mov eax, ecx
mov dword [ebp - 0xb28], esi
mov dword [ebp - 0xb74], eax
mov ecx, dword [ebp - 0xb64]
mov eax, ecx
shr eax, 3
mov dword [ebp - 0xb3c], eax
test eax, eax
je 0xb4e672
movzx ecx, word [ebp - 0x35a]
mov eax, 0x7f1137f
movzx esi, word [ebp - 0x35e]
mov ebx, dword [ebp - 0xb28]
movzx eax, ax
mov dword [ebp - 0xb68], ecx
mov ecx, 0xab69605e
mov dword [ebp - 0xb2c], eax
movzx eax, cx
mov ecx, dword [ebp - 0xb74]
mov dword [ebp - 0xb20], eax
mov eax, dword [ebp - 0xb00]
mov dword [ebp - 0xb14], esi
add eax, 7
mov esi, dword [ebp - 0xb1c]
add esi, 2
mov dword [ebp - 0xb00], eax
mov dword [ebp - 0xb1c], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xb1c]
xor ebx, edi
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xb1c]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xb1c]
shl esi, 8
add dword [ebp - 0xb1c], 8
movzx eax, byte [eax + 5]
or esi, eax
mov eax, 0xab69605e
xor ecx, esi
xor eax, ecx
mov ecx, 0x7f1137f
xor eax, ebx
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xb74], eax
sub ecx, 0xab69605e
rol eax, 0xa
rol ecx, 5
imul ecx, dword [ebp - 0xb2c]
add ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ebx + ecx]
ror ecx, 9
imul ecx, dword [ebp - 0xb14]
sub ecx, eax
mov eax, dword [ebp - 0xb74]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xb74], eax
sub ecx, dword [ebp - 0xb2c]
imul ecx, dword [ebp - 0xb20]
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xb14]
rol ecx, 6
imul ecx, dword [ebp - 0xb68]
rol eax, 2
sub ecx, eax
mov eax, dword [ebp - 0xb74]
xor eax, ecx
mov ecx, 0xab69605e
xor ecx, eax
mov dword [ebp - 0xb74], eax
mov eax, 0x7f1137f
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, dword [ebp - 0xb2c]
imul eax, dword [ebp - 0xb14]
ror ecx, 6
xor ecx, eax
mov eax, dword [ebp - 0xb74]
xor eax, ecx
mov ecx, 0x7f1137f
mov dword [ebp - 0xb74], eax
add ecx, eax
ror ecx, 0xf
imul ecx, dword [ebp - 0xb20]
rol eax, 2
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0xb68]
sub ecx, eax
mov eax, dword [ebp - 0xb74]
xor eax, ecx
mov ecx, 0xab69605e
xor ecx, eax
mov dword [ebp - 0xb74], eax
ror ecx, 0xc
imul ecx, dword [ebp - 0xb2c]
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xb68]
imul ecx, dword [ebp - 0xb14]
shr eax, 0xa
xor ecx, eax
xor dword [ebp - 0xb74], ecx
mov ecx, dword [ebp - 0xb74]
mov eax, ecx
not eax
ror eax, 5
add eax, dword [ebp - 0xb20]
imul eax, dword [ebp - 0xb68]
xor ebx, eax
mov eax, ebx
sub eax, dword [ebp - 0xb68]
xor eax, 0xab69605e
xor ecx, eax
mov dword [ebp - 0xb74], ecx
xor ecx, dword [ebp - 0xb68]
mov eax, dword [ebp - 0xb74]
rol ecx, 2
imul ecx, dword [ebp - 0xb2c]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 6
imul ecx, dword [ebp - 0xb14]
rol eax, 7
add ecx, eax
mov eax, dword [ebp - 0xb74]
xor eax, ecx
mov dword [ebp - 0xb74], eax
mov ecx, eax
xor eax, dword [ebp - 0xb2c]
imul eax, dword [ebp - 0xb20]
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xb14]
rol ecx, 5
imul ecx, dword [ebp - 0xb68]
rol eax, 7
add ecx, eax
mov eax, 0xab69605e
xor dword [ebp - 0xb74], ecx
mov ecx, dword [ebp - 0xb74]
xor eax, ecx
xor eax, ebx
mov ebx, 0x7f1137f
xor ebx, eax
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xb14]
imul eax, dword [ebp - 0xb2c]
xor ecx, eax
mov eax, 0x7f1137f
mov dword [ebp - 0xb74], ecx
sub ecx, eax
mov eax, dword [ebp - 0xb74]
ror ecx, 1
imul ecx, dword [ebp - 0xb20]
ror eax, 6
sub ecx, eax
xor ebx, ecx
mov ecx, 0xab69605e
mov eax, ebx
rol eax, 0xe
lea ecx, [ecx + ebx]
rol ecx, 3
imul ecx, dword [ebp - 0xb68]
add ecx, eax
mov eax, dword [ebp - 0xb74]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0xb74], eax
rol ecx, 0xf
imul ecx, dword [ebp - 0xb2c]
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xb20]
imul ecx, dword [ebp - 0xb14]
shr eax, 3
xor ecx, eax
mov eax, dword [ebp - 0xb74]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xb74], eax
xor ecx, 0x7f1137f
rol eax, 2
rol ecx, 4
imul ecx, dword [ebp - 0xb20]
xor ecx, eax
mov eax, dword [ebp - 0xb00]
xor ecx, dword [ebp - 0xb44]
xor ebx, ecx
mov dword [ebp - 0xb44], edi
mov ecx, dword [ebp - 0xb74]
xor ecx, dword [ebp - 0xc40]
mov byte [eax - 4], bl
mov byte [eax], cl
ror ebx, 8
mov byte [eax - 5], bl
ror ecx, 8
mov byte [eax - 1], cl
ror ebx, 8
mov byte [eax - 6], bl
ror ecx, 8
mov byte [eax - 2], cl
ror ebx, 8
ror ecx, 8
mov byte [eax - 7], bl
mov byte [eax - 3], cl
add eax, 8
ror ebx, 8
ror ecx, 8
sub dword [ebp - 0xb3c], 1
mov dword [ebp - 0xc40], esi
mov esi, dword [ebp - 0xb1c]
mov dword [ebp - 0xb00], eax
jne 0xb4e2ef
mov ebx, dword [ebp - 0xb54]
mov ecx, dword [ebp - 0xb64]
mov esi, dword [ebp - 0xb60]
xor eax, eax
test ecx, ecx
je 0xb4e686
xor dl, byte [eax + esi]
inc eax
cmp eax, ecx
jb 0xb4e67e
mov edi, dword [ebp - 0xb40]
movzx eax, dl
cdq
cmp eax, dword [ecx + edi]
jne 0xb4e6af
cmp edx, dword [ecx + edi + 4]
jne 0xb4e6af
mov edi, esi
mov dword [ebp - 0xb70], ecx
xor eax, eax
mov dword [ebp - 0xb7c], edi
mov esi, eax
jmp 0xb4e6c1
mov edi, dword [ebp - 0xb7c]
xor eax, eax
mov dword [ebp - 0xb78], 0xc004d501
test esi, esi
je 0xb4e6d4
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb78], 0
jl 0xb4e6fa
mov dword [ebp - 0xb6c], edi
xor ecx, ecx
mov edi, dword [ebp - 0xb70]
mov eax, ecx
mov dword [ebp - 0xb98], edi
mov esi, 0x10000000
jmp 0xb4e70d
mov eax, dword [ebp - 0xb7c]
mov esi, 0xd0000001
mov edi, dword [ebp - 0xb98]
xor ecx, ecx
test eax, eax
je 0xb4e720
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xb4e9a9
mov ecx, dword [ebp - 0xb6c]
xor eax, eax
push 4
pop edx
mov dword [ebp - 0xbc4], eax
mov dword [ebp - 0xcb0], ecx
cmp edi, edx
jb 0xb4e99e
mov eax, dword [ecx]
mov dword [ebp - 0xb7c], eax
lea eax, [ebp - 0xcb0]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4e9a3
lea eax, [ebp - 0xbc4]
xor ecx, ecx
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4e9a3
mov eax, edi
sub eax, dword [ebp - 0xbc4]
push 4
pop edx
cmp eax, edx
jb 0xb4e99e
mov ecx, dword [ebp - 0xcb0]
lea eax, [ebp - 0xcb0]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0xb70], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4e9a3
mov ecx, dword [ebp - 0xbc4]
lea eax, [ebp - 0xbc4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4e9a3
mov eax, dword [ebp - 0xb98]
mov ecx, dword [ebp - 0xbc4]
sub eax, ecx
cmp eax, edi
jb 0xb4e99e
lea eax, [ebp - 0xbc4]
mov edx, edi
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4e9a3
mov edx, dword [ebp - 0xb98]
mov esi, dword [ebp - 0xb6c]
mov eax, dword [ebp - 0xcb0]
add eax, edi
lea ecx, [edx + esi]
cmp ecx, eax
jb 0xb4e99e
mov eax, dword [ebp - 0xcb0]
sub edx, edi
sub edx, eax
add edx, esi
cmp edx, 8
jae 0xb4e99e
xor edx, edx
mov dword [ebp - 0xb40], edx
mov ecx, edx
mov dword [ebp - 0xbc4], ecx
mov esi, edx
test eax, eax
je 0xb4e92d
mov edx, dword [ebp - 0xb70]
lea ecx, [ebp - 0xcb4]
push ecx
mov ecx, eax
mov edi, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4e9a3
mov eax, dword [ebp - 0xcb4]
jmp 0xb4e915
lea eax, [ebp - 0xcb8]
mov ecx, edi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4e9a3
mov eax, dword [ebp - 0xcb4]
cmp dword [ebp - 0xcb8], eax
ja 0xb4e954
mov edx, dword [edi]
lea eax, [ebp - 0xcbc]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4e8d7
mov eax, dword [ebp - 0xcbc]
mov dword [ebp - 0xcc0], eax
jmp 0xb4e8dd
mov eax, dword [ebp - 0xcc0]
test esi, esi
js 0xb4e9a3
lea ecx, [ebp - 0xcc4]
mov edx, eax
push ecx
mov ecx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb4e9a3
mov edi, dword [ebp - 0xcc4]
mov eax, dword [ebp - 0xcb4]
cmp edi, eax
ja 0xb4e954
inc dword [ebp - 0xb40]
cmp edi, eax
jb 0xb4e881
cmp edi, eax
jne 0xb4e954
mov edi, dword [ebp - 0xb70]
mov ecx, dword [ebp - 0xbc4]
test edi, edi
je 0xb4e95f
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xbc4], ecx
test ecx, ecx
jne 0xb4e95b
mov esi, 0xc0000017
jmp 0xb4e98c
mov esi, 0xc000000d
jmp 0xb4e9a3
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0xcb0]
test eax, eax
je 0xb4e97a
push edi
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [ebp - 0xbc4]
add esp, 0xc
mov eax, dword [ebp - 0xb40]
mov dword [ebp - 0xe1c], ecx
mov dword [ebp - 0xe24], eax
test esi, esi
js 0xb4e9a3
mov eax, dword [ebp - 0xb7c]
cmp eax, dword [ebp - 0xe24]
je 0xb4e9a3
mov esi, 0xc000003e
or esi, 0x10000000
mov eax, dword [ebp - 0xbd0]
test eax, eax
je 0xb4e9c4
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xb94]
test edi, edi
je 0xb4ea32
xor eax, eax
cmp dword [edi + 4], eax
je 0xb4e9eb
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xb4ea07
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xb4ea23
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb90]
test eax, eax
je 0xb4ea4d
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbb4]
test eax, eax
je 0xb4ea68
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xbbc]
test edi, edi
je 0xb4ead6
xor eax, eax
cmp dword [edi + 4], eax
je 0xb4ea8f
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xb4eaab
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xb4eac7
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb6c]
test eax, eax
je 0xb4eaf1
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xb4ebaa
mov edi, dword [ebp - 0xe24]
xor eax, eax
inc eax
cmp edi, eax
jb 0xb4ebaa
mov esi, dword [ebp - 0xe1c]
test esi, esi
je 0xb4ebaa
test edi, edi
je 0xb4ebaa
lea eax, [ebp - 0xcc8]
mov dword [ebp - 0xcc8], esi
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb4ebaa
mov eax, dword [esi]
neg eax
sbb eax, eax
and eax, dword [ebp - 0xcc8]
push 4
pop ecx
cmp dword [esi], ecx
jne 0xb4ebaa
cmp dword [eax], 0
jl 0xb4ebaa
xor eax, eax
inc eax
cmp edi, eax
jbe 0xb4ebaa
xor eax, eax
mov dword [ebp - 0xccc], esi
push ecx
mov edi, eax
pop ebx
lea eax, [ebp - 0xccc]
mov edx, ebx
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb4eba4
mov edx, dword [esi]
lea eax, [ebp - 0xccc]
mov ecx, dword [ebp - 0xccc]
push eax
call fcn.00a32533
test eax, eax
js 0xb4eba4
xor eax, eax
inc edi
inc eax
cmp edi, eax
jae 0xb4eba4
mov esi, dword [ebp - 0xccc]
jmp 0xb4eb68
mov ebx, dword [ebp - 0xb54]
mov eax, dword [ebp - 0xbc0]
mov edi, dword [ebp - 0xb58]
test eax, eax
je 0xb4ebcb
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xe1c]
test esi, esi
je 0xb4ebe6
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb5c]
test eax, eax
je 0xb4ec01
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xb4ec16
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb48]
xor edx, edx
mov esi, edx
mov dword [ebp - 0xc0c], eax
mov dword [ebp - 0xb48], esi
jmp 0xb451bd
mov eax, dword [ebp - 0xe10]
jmp 0xb4ebb6
mov eax, dword [ebp - 0xe10]
jmp 0xb4ebb0
cmp ebx, 0xd00000e5
je 0xb4ec6a
cmp ebx, 0xc004d501
je 0xb4ec6a
cmp ebx, 0xd000003e
jne 0xaa5df7
mov ebx, 0xc004f028
jmp 0xb4ec81
mov ebx, 0xc004f027
jmp 0xaa5df7
cmp ebx, 0x8007007a
jne 0xb4ec81
mov ebx, 0xc004f01e
mov esi, dword [ebp - 0xcd0]
test eax, eax
je 0xaa5e1b
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
jmp 0xaa5e1b