Function at 0xc29fab
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe70
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
xor edx, edx
push ebx
push esi
mov dword [ebp - 0xbb0], edx
mov ebx, 0xd0aed4
mov dword [ebp - 0xc54], edx
mov dword [ebp - 0xd2c], edx
mov dword [ebp - 0xc00], edx
mov dword [ebp - 0xa78], edx
lea ecx, [edx + 1]
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
jne 0xc29fe7
mov eax, dword [0xd0a150]
or ebx, 0xffffffff
mov dword [ebp - 0xbb8], ebx
mov dword [ebp - 0xbe0], 0x67
mov dword [ebp - 0xb94], 0x337
mov dword [ebp - 0xb7c], 0x10b
mov dword [ebp - 0xb78], 0x20b
push edi
mov edi, 0xb2bef2
mov dword [ebp - 0xbcc], edi
push 0
pop edx
test eax, eax
jne 0xc2a6ce
push 0x338
mov esi, edx
mov dword [ebp - 0xa88], edx
push edx
mov dword [ebp - 0xa54], edx
mov dword [ebp - 0xa68], esi
mov dword [ebp - 0xad0], edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb48], eax
test eax, eax
je 0xc2a6c2
xor edx, edx
mov dword [ebp - 0x39c], 0xab69605e
mov esi, edx
mov dword [ebp - 0x398], 0x7f1137f
add eax, 7
mov dword [ebp - 0xab8], edx
mov cl, dl
mov dword [ebp - 0xbc8], ebx
mov dword [ebp - 0xb20], esi
mov dword [ebp - 0xb30], edx
mov dword [ebp - 0xb98], eax
mov dword [ebp - 0xb0c], edi
mov dword [ebp - 0xabc], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xb0c]
xor edx, ebx
mov dword [ebp - 0xa70], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb0c]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb0c]
shl edi, 8
add dword [ebp - 0xb0c], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov dword [ebp - 0xab4], esi
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
mov esi, dword [ebp - 0xa70]
rol eax, 0xa
add edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, esi
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
imul edx, eax, 0x605e
mov dword [ebp - 0xab4], eax
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xab4], eax
xor edx, 0xab69605e
mov eax, 0x7f1137f
sub eax, edx
xor esi, eax
mov eax, esi
mov edx, esi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov dword [ebp - 0xab4], eax
add eax, 0x7f1137f
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xab4]
rol eax, 2
add edx, eax
xor esi, edx
lea eax, [esi + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 8
sub edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov dword [ebp - 0xab4], eax
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xab4]
ror eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, esi
shr eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov dword [ebp - 0xab4], eax
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
mov dword [ebp - 0xa70], esi
add esi, 0xfffff80f
xor esi, dword [ebp - 0xab4]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, esi
shr eax, 2
add edx, eax
mov eax, dword [ebp - 0xa70]
xor eax, edx
mov dword [ebp - 0xa70], eax
add eax, 0xf80eec81
ror eax, 6
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xa70]
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
mov eax, dword [ebp - 0xa70]
xor eax, edx
mov dword [ebp - 0xa70], eax
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xa70]
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xa70]
xor esi, edx
xor eax, esi
xor eax, 0xac987321
mov dword [ebp - 0xa70], eax
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
mov eax, dword [ebp - 0xa70]
xor eax, edx
mov dword [ebp - 0xa70], eax
add eax, 0xab69605e
rol eax, 3
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xa70]
rol eax, 0xe
add edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub edx, eax
mov eax, dword [ebp - 0xa70]
xor eax, edx
mov dword [ebp - 0xa70], eax
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xa70]
shr eax, 3
xor edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xbc8]
rol eax, 2
mov dword [ebp - 0xb20], esi
mov dword [ebp - 0xbc8], edi
xor edx, eax
mov edi, dword [ebp - 0xb0c]
xor edx, dword [ebp - 0xab8]
mov eax, dword [ebp - 0xa70]
xor eax, edx
mov dword [ebp - 0xab8], ebx
mov edx, dword [ebp - 0xb98]
mov dword [ebp - 0xb30], eax
add dword [ebp - 0xb98], 8
mov byte [edx - 4], al
mov al, byte [ebp - 0xb20]
ror dword [ebp - 0xb30], 8
mov byte [edx], al
ror dword [ebp - 0xb20], 8
mov al, byte [ebp - 0xb30]
mov byte [edx - 5], al
mov al, byte [ebp - 0xb20]
ror dword [ebp - 0xb30], 8
mov byte [edx - 1], al
ror dword [ebp - 0xb20], 8
mov al, byte [ebp - 0xb30]
mov byte [edx - 6], al
ror dword [ebp - 0xb30], 8
mov al, byte [ebp - 0xb20]
mov byte [edx - 2], al
ror dword [ebp - 0xb20], 8
mov al, byte [ebp - 0xb30]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb20]
mov byte [edx - 3], al
mov edx, dword [ebp - 0xb30]
mov esi, dword [ebp - 0xb20]
ror edx, 8
ror esi, 8
sub dword [ebp - 0xabc], 1
mov dword [ebp - 0xb30], edx
mov dword [ebp - 0xb20], esi
jne 0xc2a0c7
mov esi, dword [ebp - 0xb48]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc2a496
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xc2a4c8
cmp edx, dword [0xb2c22c]
jne 0xc2a4c8
mov edi, esi
xor eax, eax
mov dword [ebp - 0xa68], edi
mov esi, eax
mov ebx, 0x337
jmp 0xc2a4dd
mov edi, dword [ebp - 0xa68]
or ebx, 0xffffffff
mov dword [ebp - 0xad0], 0xc004d501
xor eax, eax
test esi, esi
je 0xc2a4f0
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xad0], 0
jl 0xc2a6bc
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xd0ae80
push eax
push ebx
call fcn.00bc259b
add esp, 0xc
cmp byte [edi], 0
je 0xc2a652
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbb0]
jne 0xc2a527
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc2a6b5
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa54], edx
cmp word [eax], cx
je 0xc2a574
mov edx, 0xc000007b
mov dword [ebp - 0xa54], edx
jmp 0xc2a5bc
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xc2a567
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xc2a567
cmp dword [ecx], 0x4550
jne 0xc2a567
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xb7c]
je 0xc2a5aa
cmp ax, word [ebp - 0xb78]
je 0xc2a5aa
mov edx, 0xc000000d
jmp 0xc2a56c
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xa90], eax
test eax, eax
je 0xc2a646
mov ecx, esi
mov dword [ebp - 0xb6c], esi
xor eax, eax
mov dword [ebp - 0xc7c], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xb48], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc2a5e6
sub ecx, dword [ebp - 0xb48]
inc esi
add esi, ecx
test edx, edx
js 0xc2a630
mov ecx, dword [ebp - 0xb6c]
lea eax, [ebp - 0xc7c]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa54], edx
test edx, edx
js 0xc2a652
mov eax, dword [ebp - 0xa88]
mov ecx, dword [ebp - 0xc7c]
mov dword [eax*4 + section..data], ecx
jmp 0xc2a636
mov eax, dword [ebp - 0xa88]
inc eax
inc ebx
mov dword [ebp - 0xa88], eax
cmp ebx, dword [ebp - 0xa90]
jb 0xc2a5cd
add edi, 0x10
cmp byte [esi], 0
jne 0xc2a520
mov ebx, dword [ebp - 0xa54]
mov esi, dword [ebp - 0xa68]
test esi, esi
je 0xc2a673
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc2a6c9
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc2a68c
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc2a67b
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc2a6d6
mov ebx, 0xc000007a
jmp 0xc2a658
mov esi, dword [ebp - 0xa68]
mov ebx, 0xc000007a
jmp 0xc2a65e
mov eax, dword [0xd0a150]
inc eax
xor ebx, ebx
mov dword [0xd0a150], eax
xor eax, eax
mov ecx, 0xd0aed4
xchg dword [ecx], eax
mov eax, ebx
mov dword [ebp - 0xa88], ebx
mov dword [ebp - 0xa54], eax
mov edi, ebx
mov eax, dword fs:[0x30]
mov dword [ebp - 0xa68], ebx
cmp dword [eax + 0x1d4], ebx
je 0xc2a9d2
mov esi, dword [0xd08088]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, eax
mov dword [ebp - 0xb48], ecx
test ecx, ecx
jne 0xc2a72e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc2aa1a
mov eax, ebx
mov esi, ebx
mov dword [ebp - 0xa54], eax
mov ebx, dword [0xd08098]
lea edx, [ebp - 0xc78]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xd0cffc]
call ebx
test eax, eax
jne 0xc2a7c0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc2a7a2
xor eax, eax
test esi, esi
jne 0xc2a79b
push dword [ebp - 0xc78]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc2a791
mov eax, dword [ebp - 0xc78]
mov ecx, dword [ebp - 0xb48]
jmp 0xc2a738
mov ebx, 0x8007000e
jmp 0xc2aa14
mov ebx, 0x80004005
jmp 0xc2a7d0
test eax, eax
jne 0xc2a7ad
mov ebx, 0x80004005
jmp 0xc2a7bc
jg 0xc2a7b3
mov ebx, eax
jmp 0xc2a7bc
movzx ebx, ax
or ebx, 0x80070000
xor eax, eax
jmp 0xc2a7d0
mov ebx, dword [ebp - 0xa54]
xor eax, eax
mov dword [ebp - 0xa88], esi
mov esi, eax
test esi, esi
je 0xc2a7e3
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc2a9f9
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov esi, dword [0xd08094]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov ecx, eax
mov dword [ebp - 0xb48], ecx
test ecx, ecx
jne 0xc2a835
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc2a825
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc2a9f9
mov ebx, 0x80004005
jmp 0xc2a9f9
xor edx, edx
mov eax, edx
mov esi, edx
mov dword [ebp - 0xa54], eax
mov ebx, dword [0xd08098]
lea edx, [ebp - 0xc74]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xd0cffc]
call ebx
test eax, eax
jne 0xc2a8d5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc2a8b1
xor eax, eax
test esi, esi
jne 0xc2a8a4
push dword [ebp - 0xc74]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc2a89a
mov eax, dword [ebp - 0xc74]
mov ecx, dword [ebp - 0xb48]
jmp 0xc2a841
mov ebx, 0x8007000e
jmp 0xc2a9f9
mov ebx, 0x80004005
mov dword [ebp - 0xa54], ebx
jmp 0xc2a8e1
test eax, eax
jne 0xc2a8bc
mov ebx, 0x80004005
jmp 0xc2a8cb
jg 0xc2a8c2
mov ebx, eax
jmp 0xc2a8cb
movzx ebx, ax
or ebx, 0x80070000
mov dword [ebp - 0xa54], ebx
xor eax, eax
jmp 0xc2a8e1
mov ebx, dword [ebp - 0xa54]
xor eax, eax
mov edi, esi
mov esi, eax
test esi, esi
je 0xc2a8f4
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc2a9de
mov eax, dword [ebp - 0xa88]
test eax, eax
je 0xc2a9d2
push 4
mov ecx, 0xb2be5c
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xc2a938
test dx, dx
je 0xc2a932
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xc2a938
add eax, esi
add ecx, esi
test dx, dx
jne 0xc2a912
xor ebx, ebx
mov eax, ebx
jmp 0xc2a93f
sbb eax, eax
or eax, 1
xor ebx, ebx
test eax, eax
jne 0xc2a9d2
test edi, edi
je 0xc2a9d2
mov ecx, 0xb2be6c
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xc2a97a
test dx, dx
je 0xc2a976
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xc2a97a
add eax, esi
add ecx, esi
test dx, dx
jne 0xc2a956
mov eax, ebx
jmp 0xc2a97f
sbb eax, eax
or eax, 1
test eax, eax
jne 0xc2a9d2
push esi
lea eax, [ebp - 0xc70]
mov dword [ebp - 0xc70], ebx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
jne 0xc2a9c4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc2a9bb
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc2a9e4
mov ebx, 0x80004005
jmp 0xc2a9e4
test byte [ebp - 0xc70], 0xf
jne 0xc2a9d2
xor eax, eax
inc eax
jmp 0xc2a9d8
mov eax, dword [ebp - 0xa68]
mov dword [ebp - 0xa78], eax
mov ebx, dword [ebp - 0xa54]
test edi, edi
je 0xc2a9f9
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xa88]
test eax, eax
je 0xc2aa14
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc2aa22
xor ebx, ebx
mov dword [ebp - 0xa78], ebx
jmp 0xc2aa24
xor ebx, ebx
push 4
pop eax
push eax
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov dword [ebp - 0xb48], eax
test eax, eax
jne 0xc2aafa
mov dword [ebp - 0xab8], ebx
mov ebx, 0x8007000e
mov eax, dword [ebp - 0xc14]
mov dword [ebp - 0xc00], eax
xor edx, edx
mov esi, 0xd0aed4
lea ecx, [edx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xc2aa5c
mov eax, dword [0xd0a150]
push 0
pop edx
test eax, eax
jle 0xc2aabb
sub eax, 1
mov dword [0xd0a150], eax
jne 0xc2aabb
mov edi, edx
mov eax, dword [edi + 0xd0ae80]
test eax, eax
je 0xc2aa92
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xc2aa81
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0xd0aed4
xchg dword [ecx], eax
mov eax, dword [ebp - 0xab8]
pop edi
test eax, eax
je 0xc2aad6
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, dword [ebp - 0xc54]
test ebx, ebx
jns 0xc343fd
cmp ebx, 0xd0000034
jne 0xc343c0
mov ebx, 0xc004f012
jmp 0xc343f5
mov dword [ebp - 0xab8], eax
lea edi, [ebp - 0xbc4]
xor eax, eax
mov dword [ebp - 0xa58], ebx
stosd dword es:[edi], eax
mov esi, ebx
mov dword [ebp - 0xc9c], ebx
mov dword [ebp - 0xc98], ebx
mov dword [ebp - 0xa6c], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xa84], ebx
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xb6c], 0x38
mov dword [ebp - 0xa90], ebx
test ebx, ebx
jne 0xc2ab6c
mov edi, dword [ebp - 0xa58]
mov ebx, 0xc0000017
mov dword [ebp - 0xa4c], ebx
jmp 0xc2ae7a
push edi
push 0xd08d58
push ebx
call fcn.00bc13d0
mov esi, ebx
add esp, 0xc
mov dword [ebp - 0xa50], esi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xa80], ecx
test ecx, ecx
je 0xc2ab56
mov eax, dword [0xd08d50]
mov edi, ecx
mov dword [ecx], eax
mov eax, dword [0xd08d54]
mov dword [ecx + 4], eax
mov dword [ebp - 0xa58], edi
rdtsc
mov dword [ebp - 0xa8c], eax
mov dword [ebp - 0xa60], edx
xor eax, eax
mov dword [ebp - 0xac8], eax
lea eax, [ebp - 0xcdc]
push eax
push 4
pop ecx
mov edx, ecx
call fcn.00b84e9a
mov esi, dword [ebp - 0xcdc]
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
jns 0xc2abfb
mov esi, dword [ebp - 0xe00]
jmp 0xc2ae74
lea eax, [ebp - 0xac8]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa4c], ebx
jl 0xc2ae74
lea eax, [ebp - 0xcd8]
mov edx, 0xa0
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2ae74
mov esi, dword [ebp - 0xcd8]
mov ecx, dword [ebp - 0xac8]
lea eax, [ebp - 0xac8]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa4c], ebx
jl 0xc2ae74
lea eax, [ebp - 0xcd4]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2ae74
mov esi, dword [ebp - 0xcd4]
mov ecx, dword [ebp - 0xac8]
lea eax, [ebp - 0xac8]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa4c], ebx
jl 0xc2ae74
lea eax, [ebp - 0xcb4]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2ae74
mov esi, dword [ebp - 0xcb4]
mov ecx, dword [ebp - 0xac8]
lea eax, [ebp - 0xac8]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa4c], ebx
jl 0xc2ae74
lea eax, [ebp - 0xc6c]
mov edx, SysReAllocString
push eax
mov ecx, 0xb3eecc
call fcn.00b84ebc
test eax, eax
jns 0xc2ad41
mov ebx, 0xc000003e
mov dword [ebp - 0xa4c], ebx
jmp 0xc2ae74
mov edx, dword [ebp - 0xc6c]
lea eax, [ebp - 0xcec]
push eax
inc edx
push 4
pop eax
mov dword [ebp - 0xc6c], edx
mov ecx, eax
add edx, edx
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2ae74
mov esi, dword [ebp - 0xcec]
mov ecx, dword [ebp - 0xac8]
lea eax, [ebp - 0xac8]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa4c], ebx
jl 0xc2ae74
lea eax, [ebp - 0xd50]
push eax
push 4
pop ecx
mov edx, ecx
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2ae74
mov esi, dword [ebp - 0xd50]
mov ecx, dword [ebp - 0xac8]
lea eax, [ebp - 0xac8]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa4c], ebx
jl 0xc2ae74
lea eax, [ebp - 0xd4c]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2ae74
mov esi, dword [ebp - 0xd4c]
mov ecx, dword [ebp - 0xac8]
lea eax, [ebp - 0xac8]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa4c], ebx
jl 0xc2ae74
mov esi, dword [ebp - 0xac8]
push esi
push 8
mov dword [ebp - 0xc9c], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xa94], edi
test edi, edi
jne 0xc2af7e
mov ebx, 0xc0000017
mov dword [ebp - 0xa4c], ebx
mov edi, dword [ebp - 0xa58]
mov esi, dword [ebp - 0xa50]
mov eax, dword [ebp - 0xc98]
xor edx, edx
mov dword [ebp - 0xc9c], edx
mov dword [ebp - 0xca0], edx
test eax, eax
je 0xc2aea9
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0xc98], edx
mov ecx, dword [ebp - 0xbbc]
mov dword [ebp - 0xbc0], edx
mov dword [ebp - 0xbc4], edx
test ecx, ecx
je 0xc2aed6
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0xbbc], edx
test esi, esi
je 0xc2aee9
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xc2aefe
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc2aa49
mov eax, dword [ebp - 0xa78]
test eax, eax
je 0xc343a7
mov dword [0xd09360], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x2c0]
push eax
push 0xb10000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0xc3224f
cmp eax, esi
jne 0xc2af4c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0xc3224f
mov esi, dword [0xd0807c]
xor ebx, ebx
push 0x403
push ebx
push ebx
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa64], eax
test eax, eax
jne 0xc2da5e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc32251
mov dword [ebp - 0xc98], edi
xor eax, eax
mov dword [ebp - 0xa64], eax
mov dword [ebp - 0xdfc], eax
mov dword [ebp - 0xbd0], edi
push 4
pop ecx
lea eax, [ebp - 0xd80]
mov dword [ebp - 0xd84], ecx
mov edx, ecx
mov ecx, edi
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2afeb
lea ecx, [edi + esi]
lea eax, [edi + 8]
cmp eax, ecx
jbe 0xc2afd1
mov ebx, 0xc0000023
jmp 0xc2ae68
push 4
pop eax
mov dword [edi], eax
xor ecx, ecx
mov eax, dword [ebp - 0xd80]
mov dword [eax], ecx
xor eax, eax
inc eax
mov dword [ebp - 0xa64], eax
jmp 0xc2aff3
mov eax, dword [ebp - 0xa64]
xor ecx, ecx
test ebx, ebx
js 0xc2ae6e
mov esi, edi
mov edi, ecx
mov dword [ebp - 0xc28], esi
test eax, eax
je 0xc2b06f
mov edx, dword [esi]
lea eax, [ebp - 0xd48]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2b036
mov eax, dword [ebp - 0xd48]
mov dword [ebp - 0xd44], eax
jmp 0xc2b03c
mov eax, dword [ebp - 0xd44]
test ebx, ebx
js 0xc2b0df
lea ecx, [ebp - 0xc28]
mov edx, eax
push ecx
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2b0df
mov esi, dword [ebp - 0xc28]
inc edi
cmp edi, dword [ebp - 0xa64]
jb 0xc2b009
lea eax, [ebp - 0xd88]
mov dword [ebp - 0xd8c], 0xa0
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov edi, dword [ebp - 0xa94]
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2b0e5
mov ecx, dword [ebp - 0xac8]
lea eax, [esi + 0xa4]
add ecx, edi
cmp eax, ecx
ja 0xc2afc7
mov eax, 0xa0
push eax
push dword [ebp - 0xa90]
mov dword [esi], eax
push dword [ebp - 0xd88]
call fcn.00bc13d0
mov eax, dword [ebp - 0xa64]
add esp, 0xc
inc eax
mov dword [ebp - 0xa64], eax
jmp 0xc2b0eb
mov edi, dword [ebp - 0xa94]
mov eax, dword [ebp - 0xa64]
test ebx, ebx
js 0xc2ae6e
mov esi, edi
xor ecx, ecx
mov dword [ebp - 0xc30], esi
mov edi, ecx
test eax, eax
je 0xc2b169
mov edx, dword [esi]
lea eax, [ebp - 0xd38]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2b130
mov eax, dword [ebp - 0xd38]
mov dword [ebp - 0xd34], eax
jmp 0xc2b136
mov eax, dword [ebp - 0xd34]
test ebx, ebx
js 0xc2b1d6
lea ecx, [ebp - 0xc30]
mov edx, eax
push ecx
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2b1d6
mov esi, dword [ebp - 0xc30]
inc edi
cmp edi, dword [ebp - 0xa64]
jb 0xc2b103
lea eax, [ebp - 0xd90]
mov dword [ebp - 0xd94], 8
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov edi, dword [ebp - 0xa94]
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2b1dc
mov ecx, dword [ebp - 0xac8]
lea eax, [esi + 0xc]
add ecx, edi
cmp eax, ecx
ja 0xc2afc7
mov edx, dword [ebp - 0xa80]
mov ecx, dword [ebp - 0xd90]
mov dword [esi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xa64]
inc eax
mov dword [ebp - 0xa64], eax
jmp 0xc2b1e2
mov edi, dword [ebp - 0xa94]
mov eax, dword [ebp - 0xa64]
test ebx, ebx
js 0xc2ae6e
mov ecx, dword [ebp - 0xa8c]
mov esi, edi
mov dword [ebp - 0xe10], ecx
mov ecx, dword [ebp - 0xa60]
mov dword [ebp - 0xe0c], ecx
xor ecx, ecx
mov edi, ecx
test eax, eax
je 0xc2b27d
mov edx, dword [esi]
lea eax, [ebp - 0xcc8]
push eax
push 4
pop eax
mov ecx, eax
mov dword [ebp - 0xa90], esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2b23f
mov eax, dword [ebp - 0xcc8]
mov dword [ebp - 0xce0], eax
jmp 0xc2b245
mov eax, dword [ebp - 0xce0]
test ebx, ebx
js 0xc2ae6e
add eax, esi
mov ecx, esi
cmp eax, esi
jb 0xc2b259
mov esi, eax
jmp 0xc2b25c
or esi, 0xffffffff
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa4c], ebx
cmp eax, dword [ebp - 0xa90]
jb 0xc2b2df
inc edi
cmp edi, dword [ebp - 0xa64]
jb 0xc2b20c
push 8
pop edi
lea eax, [ebp - 0xd98]
mov dword [ebp - 0xd9c], edi
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2ae6e
mov ecx, dword [ebp - 0xa94]
lea eax, [esi + 0xc]
add ecx, dword [ebp - 0xac8]
cmp eax, ecx
ja 0xc2afc7
mov eax, dword [ebp - 0xd98]
mov ecx, dword [ebp - 0xa8c]
inc dword [ebp - 0xa64]
mov dword [esi], edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xa60]
mov dword [eax + 4], ecx
test ebx, ebx
js 0xc2ae6e
lea eax, [ebp - 0xc04]
mov edx, SysReAllocString
push eax
mov ecx, 0xb3eecc
call fcn.00b84ebc
test eax, eax
jns 0xc2b30b
mov ebx, 0xc000003e
jmp 0xc2ae68
mov ecx, dword [ebp - 0xc04]
lea eax, [ebp - 0xc04]
push eax
xor eax, eax
lea edx, [eax + 1]
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2ae6e
mov eax, dword [ebp - 0xc04]
lea edi, [eax + eax]
test edi, edi
je 0xc2b445
mov esi, dword [ebp - 0xa94]
xor eax, eax
mov dword [ebp - 0xaa4], eax
cmp dword [ebp - 0xa64], eax
jbe 0xc2b3e2
mov edx, dword [esi]
lea eax, [ebp - 0xd04]
push eax
push 4
pop eax
mov ecx, eax
mov dword [ebp - 0xa90], esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2b390
mov eax, dword [ebp - 0xd04]
mov dword [ebp - 0xd00], eax
jmp 0xc2b396
mov eax, dword [ebp - 0xd00]
test ebx, ebx
js 0xc2ae6e
add eax, esi
mov ecx, esi
cmp eax, esi
jb 0xc2b3aa
mov esi, eax
jmp 0xc2b3ad
or esi, 0xffffffff
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa4c], ebx
cmp eax, dword [ebp - 0xa90]
jb 0xc2b450
mov eax, dword [ebp - 0xaa4]
inc eax
mov dword [ebp - 0xaa4], eax
cmp eax, dword [ebp - 0xa64]
jb 0xc2b35d
lea eax, [ebp - 0xda0]
mov dword [ebp - 0xda4], edi
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2ae6e
mov ecx, dword [ebp - 0xa94]
lea eax, [edi + 4]
add ecx, dword [ebp - 0xac8]
add eax, esi
cmp eax, ecx
jbe 0xc2b427
mov ebx, 0xc0000023
jmp 0xc2b44a
push edi
push 0xb3eecc
push dword [ebp - 0xda0]
mov dword [esi], edi
call fcn.00bc13d0
add esp, 0xc
inc dword [ebp - 0xa64]
jmp 0xc2b450
mov ebx, 0xc000000d
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2ae6e
mov eax, dword [ebp - 0xa78]
mov edi, dword [ebp - 0xa64]
mov esi, dword [ebp - 0xa94]
mov dword [ebp - 0xe04], eax
xor eax, eax
mov edx, eax
test edi, edi
je 0xc2b4ea
mov eax, dword [esi]
push 4
add eax, 4
mov dword [ebp - 0xa90], esi
pop ebx
cmp eax, ebx
jb 0xc2b48e
mov ecx, eax
jmp 0xc2b491
or ecx, 0xffffffff
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa4c], ebx
cmp eax, 4
jb 0xc2b4ae
mov dword [ebp - 0xd08], ecx
jmp 0xc2b4b4
mov ecx, dword [ebp - 0xd08]
cmp eax, 4
jb 0xc2b548
lea eax, [esi + ecx]
mov ebx, esi
cmp eax, esi
jb 0xc2b4ca
mov esi, eax
jmp 0xc2b4cd
or esi, 0xffffffff
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa4c], ebx
cmp eax, dword [ebp - 0xa90]
jb 0xc2b548
inc edx
cmp edx, edi
jb 0xc2b478
push 4
pop ecx
lea eax, [ebp - 0xda8]
mov dword [ebp - 0xdac], ecx
mov edx, ecx
mov ecx, esi
push eax
call fcn.00b84e9a
mov edx, dword [ebp - 0xa94]
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2ae6e
mov ecx, dword [ebp - 0xac8]
lea eax, [esi + 8]
add ecx, edx
cmp eax, ecx
ja 0xc2afc7
mov ecx, dword [ebp - 0xa78]
inc edi
push 4
pop eax
mov dword [esi], eax
mov eax, dword [ebp - 0xda8]
mov dword [ebp - 0xa64], edi
mov dword [eax], ecx
jmp 0xc2b54e
mov edx, dword [ebp - 0xa94]
test ebx, ebx
js 0xc2ae6e
push 4
xor eax, eax
mov esi, edx
mov edx, eax
pop ebx
mov dword [ebp - 0xe08], ebx
test edi, edi
je 0xc2b5d7
mov eax, dword [esi]
add eax, 4
mov dword [ebp - 0xa90], esi
cmp eax, ebx
jb 0xc2b57c
mov ecx, eax
jmp 0xc2b57f
or ecx, 0xffffffff
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa4c], ebx
cmp eax, 4
jb 0xc2b59c
mov dword [ebp - 0xd0c], ecx
jmp 0xc2b5a2
mov ecx, dword [ebp - 0xd0c]
cmp eax, 4
jb 0xc2b626
lea eax, [ecx + esi]
mov ebx, esi
cmp eax, esi
jb 0xc2b5b4
mov esi, eax
jmp 0xc2b5b7
or esi, 0xffffffff
cmp eax, ebx
push 4
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa4c], ebx
cmp eax, dword [ebp - 0xa90]
jb 0xc2b628
inc edx
pop ebx
cmp edx, edi
jb 0xc2b569
lea eax, [ebp - 0xd78]
mov dword [ebp - 0xd7c], ebx
push eax
mov edx, ebx
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2b626
mov ecx, dword [ebp - 0xa94]
lea eax, [esi + 8]
add ecx, dword [ebp - 0xac8]
cmp eax, ecx
ja 0xc2afc7
mov eax, dword [ebp - 0xd78]
inc edi
push 4
pop ecx
mov dword [esi], ecx
mov dword [eax], ecx
mov dword [ebp - 0xa64], edi
jmp 0xc2b629
push 4
pop ecx
test ebx, ebx
js 0xc2ae6e
lea eax, [ebp - 0xd10]
mov edx, ecx
push eax
call fcn.00b84e9a
mov esi, dword [ebp - 0xd10]
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
jns 0xc2b65c
mov esi, dword [ebp - 0xe14]
jmp 0xc2b7ca
lea eax, [ebp - 0xd28]
mov edi, esi
push eax
push 8
pop edx
mov dword [ebp - 0xb68], edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2b7ca
mov esi, dword [ebp - 0xd28]
lea eax, [ebp - 0xb68]
mov edx, esi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2b7ca
lea eax, [ebp - 0xd30]
push eax
push 4
pop edi
mov edx, edi
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2b7ca
mov esi, dword [ebp - 0xd30]
mov ecx, dword [ebp - 0xb68]
lea eax, [ebp - 0xb68]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2b7ca
lea eax, [ebp - 0xcb0]
mov edx, edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2b7ca
mov esi, dword [ebp - 0xcb0]
mov ecx, dword [ebp - 0xb68]
lea eax, [ebp - 0xb68]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2b7ca
lea eax, [ebp - 0xc18]
mov edx, edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2b7ca
mov esi, dword [ebp - 0xc18]
mov ecx, dword [ebp - 0xb68]
lea eax, [ebp - 0xb68]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2b7ca
lea eax, [ebp - 0xc1c]
mov edx, edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2b7ca
mov esi, dword [ebp - 0xc1c]
mov ecx, dword [ebp - 0xb68]
lea eax, [ebp - 0xb68]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov eax, dword [ebp - 0xb68]
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
jns 0xc2b7d0
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0xa74], eax
test ebx, ebx
js 0xc2ae6e
xor ecx, ecx
rdtsc
mov esi, ecx
mov dword [ebp - 0xacc], ecx
mov dword [ebp - 0xa68], esi
mov dword [ebp - 0xa9c], ecx
mov dword [ebp - 0xa54], ecx
mov dword [ebp - 0xa5c], ecx
mov dword [ebp - 0xad4], ecx
mov dword [ebp - 0xa70], ecx
mov dword [ebp - 0xaa4], ecx
mov dword [ebp - 0xaa0], ecx
mov dword [ebp - 0xb08], ecx
mov dword [ebp - 0xa90], eax
mov dword [ebp - 0xa80], edx
push 8
pop ecx
mov dword [ebp - 0xc0c], ecx
mov edx, dword [ebp - 0xac8]
lea eax, [ebp - 0xc0c]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2b937
mov eax, dword [ebp - 0xc0c]
lea edi, [eax + 7]
and edi, 0xfffffff8
cmp edi, eax
jae 0xc2b86b
mov ebx, 0xc0000095
jmp 0xc2b937
mov dword [ebp - 0xc0c], edi
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xc2b890
mov ebx, 0xc0000017
jmp 0xc2b931
mov eax, dword [ebp - 0xa64]
mov ecx, esi
mov dword [esi], eax
lea eax, [ebp - 0xbfc]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xbfc], esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2b91c
mov ecx, dword [ebp - 0xbfc]
mov eax, dword [ebp - 0xac8]
mov dword [ecx], eax
lea eax, [ebp - 0xbfc]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2b91c
push dword [ebp - 0xac8]
mov eax, dword [ebp - 0xa90]
push dword [ebp - 0xa94]
mov dword [esi + edi - 8], eax
mov eax, dword [ebp - 0xa80]
push dword [ebp - 0xbfc]
mov dword [esi + edi - 4], eax
call fcn.00bc13d0
add esp, 0xc
mov dword [ebp - 0xacc], esi
xor eax, eax
mov dword [ebp - 0xa68], edi
mov esi, eax
jmp 0xc2b91e
xor eax, eax
test esi, esi
je 0xc2b931
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xa68]
or ebx, 0x10000000
mov dword [ebp - 0xa4c], ebx
jl 0xc2d352
mov ebx, dword [ebp - 0xacc]
xor ecx, ecx
mov edi, ecx
mov dword [ebp - 0xa7c], edi
test ebx, ebx
jne 0xc2b967
mov ebx, 0xc000000d
jmp 0xc2c082
test esi, esi
je 0xc2c07d
lea eax, [esi + 8]
push eax
push ecx
mov dword [ebp - 0xa90], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xa98], eax
test eax, eax
je 0xc2c07d
xor ecx, ecx
mov dl, cl
test esi, esi
je 0xc2b9a5
xor dl, byte [ecx + ebx]
inc ecx
cmp ecx, esi
jb 0xc2b99d
mov dword [ebp - 0xa88], eax
xor eax, eax
mov dword [ebp - 0xac0], ebx
mov ecx, eax
or ebx, 0xffffffff
mov dword [ebp - 0x3a4], 0xb1b54a58
mov dword [ebp - 0x3a0], 0xc81ecb17
mov dword [ebp - 0xaf8], ecx
mov dword [ebp - 0xb04], ebx
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xac4], eax
test eax, eax
je 0xc2bab0
xor ebx, ebx
mov dword [ebp - 0xadc], eax
xor esi, esi
mov dword [ebp - 0xac4], ecx
jbe 0xc2ba4f
mov edi, dword [ebp - 0xac0]
push 0x38
pop esi
push 4
pop eax
cmp ebx, eax
movzx eax, byte [edi]
jge 0xc2ba26
lea ecx, [esi - 0x20]
shl eax, cl
mov ecx, dword [ebp - 0xac4]
or ecx, eax
mov dword [ebp - 0xac4], ecx
jmp 0xc2ba36
mov ecx, esi
shl eax, cl
or dword [ebp - 0xadc], eax
mov ecx, dword [ebp - 0xac4]
inc ebx
sub esi, 8
xor eax, eax
inc edi
cmp ebx, eax
jl 0xc2ba07
mov dword [ebp - 0xac0], edi
mov edi, eax
mov eax, dword [ebp - 0xadc]
xor ecx, 0xb17a307a
xor eax, 0x42f6b18d
xor ebx, ebx
mov dword [ebp - 0xaf8], ecx
mov esi, ebx
jbe 0xc2ba91
mov ebx, dword [ebp - 0xa88]
cmp esi, 4
jge 0xc2ba78
rol ecx, 8
mov byte [ebx], cl
jmp 0xc2ba7d
rol eax, 8
mov byte [ebx], al
inc ebx
add esi, 1
js 0xc2ba6c
mov ecx, dword [ebp - 0xaf8]
mov dword [ebp - 0xa88], ebx
xor ebx, ebx
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0xb04], ebx
test eax, eax
jg 0xc2baaa
jns 0xc2baaa
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xaf8], ecx
mov esi, dword [ebp - 0xa68]
mov eax, esi
shr eax, 3
mov dword [ebp - 0xaa8], eax
test eax, eax
je 0xc2beb0
mov eax, dword [ebp - 0xa88]
mov esi, dword [ebp - 0xac0]
add eax, 7
add esi, 2
mov dword [ebp - 0xa88], eax
mov dword [ebp - 0xac0], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xac0]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xac0]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xac0]
shl esi, 8
add dword [ebp - 0xac0], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov dword [ebp - 0xa4c], ebx
add ebx, 0xffffb5a8
xor ebx, edi
xor ebx, ecx
mov ecx, 0xc81ecb17
xor ebx, ecx
mov eax, ebx
xor eax, ecx
ror eax, 0xf
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 7
add ecx, eax
mov eax, dword [ebp - 0xa4c]
xor eax, ecx
mov dword [ebp - 0xa4c], eax
add eax, 0xb1b54a58
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa4c]
ror eax, 0xa
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0xcb17
rol eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
rol eax, 5
add ecx, eax
mov eax, dword [ebp - 0xa4c]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xa4c], eax
xor ecx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, ecx
xor ebx, eax
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 6
sub ecx, eax
sub ecx, 0x339b6838
xor dword [ebp - 0xa4c], ecx
mov ecx, dword [ebp - 0xa4c]
mov eax, ecx
ror eax, 0xf
xor eax, 0xcb17
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, 0xc81e
imul eax, eax, 0xcb17
xor ecx, eax
lea eax, [ecx + 0x37e0ea91]
mov dword [ebp - 0xa4c], ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0xc81e
ror ecx, 0xa
imul eax, eax, 0xb1b5
xor ecx, eax
mov eax, dword [ebp - 0xa4c]
xor eax, ecx
mov dword [ebp - 0xa4c], eax
xor eax, 0x4a58
rol eax, 6
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa4c]
ror eax, 3
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa4c]
mov eax, ebx
ror eax, 0xf
sub eax, 0xc81e
imul eax, eax, 0x4a58
xor ecx, eax
mov dword [ebp - 0xa4c], ecx
xor ecx, 0xc81e
mov eax, dword [ebp - 0xa4c]
shr eax, 1
imul ecx, ecx, 0x4a58
xor ecx, eax
mov eax, dword [ebp - 0xa4c]
add eax, 0xffff34e9
xor ebx, ecx
rol eax, 3
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa4c]
shr eax, 0xf
xor ecx, eax
xor ebx, ecx
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 0xd
sub ecx, eax
mov eax, 0xb1b54a58
add ecx, 0x730581bd
xor dword [ebp - 0xa4c], ecx
sub eax, dword [ebp - 0xa4c]
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa4c]
ror eax, 0xb
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa4c]
lea eax, [ebx + 0x4e49ed8a]
xor ecx, eax
mov dword [ebp - 0xa4c], ecx
mov eax, dword [ebp - 0xa4c]
xor eax, 0xb1b5
ror ecx, 7
imul eax, eax, 0x4a58
sub eax, ecx
xor ebx, eax
mov eax, ebx
xor eax, 0xc81e
rol eax, 4
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0x10
sub ecx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xa4c], ecx
sub eax, dword [ebp - 0xa4c]
ror eax, 0xa
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa4c]
ror eax, 4
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x4e4ab5a8]
ror eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
ror eax, 9
xor ecx, eax
mov eax, dword [ebp - 0xa4c]
xor eax, ecx
mov dword [ebp - 0xa4c], eax
xor eax, 0xc81ecb17
rol eax, 8
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa4c]
rol eax, 2
sub ecx, eax
mov eax, 0xc81ecb17
xor ebx, ecx
sub eax, ebx
ror eax, 0xb
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0xc
sub ecx, eax
mov eax, dword [ebp - 0xa4c]
xor eax, ecx
mov dword [ebp - 0xa4c], eax
xor eax, 0xb1b5
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa4c]
shr eax, 8
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa88]
mov eax, ebx
add dword [ebp - 0xa88], 8
xor eax, dword [ebp - 0xadc]
xor eax, dword [ebp - 0xa4c]
xor ebx, dword [ebp - 0xac4]
xor eax, 0x79ab814f
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xaf8], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb04]
ror dword [ebp - 0xaf8], 8
mov byte [ecx], al
ror dword [ebp - 0xb04], 8
mov al, byte [ebp - 0xaf8]
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb04]
ror dword [ebp - 0xaf8], 8
mov byte [ecx - 1], al
ror dword [ebp - 0xb04], 8
mov al, byte [ebp - 0xaf8]
mov byte [ecx - 6], al
ror dword [ebp - 0xaf8], 8
mov al, byte [ebp - 0xb04]
mov byte [ecx - 2], al
ror dword [ebp - 0xb04], 8
mov al, byte [ebp - 0xaf8]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb04]
mov byte [ecx - 3], al
mov ecx, dword [ebp - 0xaf8]
mov ebx, dword [ebp - 0xb04]
ror ecx, 8
ror ebx, 8
sub dword [ebp - 0xaa8], 1
mov dword [ebp - 0xadc], esi
mov esi, dword [ebp - 0xac0]
mov dword [ebp - 0xaf8], ecx
mov dword [ebp - 0xb04], ebx
mov dword [ebp - 0xac4], edi
jne 0xc2bae1
mov edi, dword [ebp - 0xa7c]
mov esi, dword [ebp - 0xa68]
mov ecx, dword [ebp - 0xa98]
movzx eax, dl
cdq
mov dword [ecx + esi], eax
mov dword [ecx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xc2bee2
mov ebx, 0xc0000017
jmp 0xc2bff1
mov ebx, dword [ebp - 0xa90]
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc2bf0a
mov ebx, 0xc0000017
xor edx, edx
jmp 0xc2bf8a
mov dword [esi + 4], eax
push ebx
push dword [ebp - 0xa98]
push eax
call fcn.00bc13d0
add esp, 0xc
mov eax, 0xa0
mov dword [esi + 8], eax
push eax
push 8
pop ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc2befe
mov dword [esi + 0xc], eax
push 0xa0
push 0xd08ca8
push eax
call fcn.00bc13d0
add esp, 0xc
mov dword [esi + 0x10], ebx
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xc2bf72
mov ebx, 0xc0000017
jmp 0xc2bf8a
mov dword [esi + 0x14], ecx
mov edi, esi
mov eax, dword [0xd08d48]
mov ebx, edx
mov dword [ecx], eax
mov esi, edx
mov eax, dword [0xd08d4c]
mov dword [ecx + 4], eax
test esi, esi
je 0xc2bff1
cmp dword [esi + 4], 0
je 0xc2bfaa
push dword [esi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 4], edx
cmp dword [esi + 0xc], 0
je 0xc2bfc6
push dword [esi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0xc], edx
cmp dword [esi + 0x14], 0
je 0xc2bfe2
push dword [esi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0x14], edx
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
test ebx, ebx
js 0xc2bfff
mov dword [ebp - 0xa9c], edi
mov edi, eax
push dword [ebp - 0xa98]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xc2c082
xor eax, eax
cmp dword [edi + 4], eax
je 0xc2c034
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc2c050
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc2c06c
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc2c082
mov ebx, 0xc0000001
or ebx, 0x10000000
mov dword [ebp - 0xa4c], ebx
jl 0xc2d352
mov esi, dword [ebp - 0xa9c]
lea eax, [ebp - 0xb64]
push 4
pop edi
push eax
mov edx, dword [esi]
mov ecx, edi
mov dword [ebp - 0xb64], edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2c129
mov ecx, dword [ebp - 0xb64]
lea eax, [ebp - 0xb64]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2c129
mov edx, dword [esi + 8]
lea eax, [ebp - 0xb64]
mov ecx, dword [ebp - 0xb64]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2c129
mov ecx, dword [ebp - 0xb64]
lea eax, [ebp - 0xb64]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2c129
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0xb64]
mov ecx, dword [ebp - 0xb64]
push eax
call fcn.00b84e9a
mov edi, dword [ebp - 0xb64]
mov ebx, eax
test ebx, ebx
jns 0xc2c137
mov edi, dword [ebp - 0xe18]
test ebx, ebx
js 0xc2c2a0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xc2c157
mov ebx, 0xc0000017
jmp 0xc2c2a0
mov eax, dword [ebp - 0xa9c]
mov ecx, esi
mov dword [ebp - 0xab0], esi
mov eax, dword [eax]
mov dword [esi], eax
lea eax, [ebp - 0xab0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2c28b
mov ebx, dword [ebp - 0xa9c]
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0xab0]
call fcn.00bc13d0
mov edx, dword [ebx]
lea eax, [ebp - 0xab0]
mov ecx, dword [ebp - 0xab0]
add esp, 0xc
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2c28b
mov eax, dword [ebp - 0xa9c]
mov ecx, dword [ebp - 0xab0]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xab0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2c28b
mov ebx, dword [ebp - 0xa9c]
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0xab0]
call fcn.00bc13d0
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xab0]
mov ecx, dword [ebp - 0xab0]
add esp, 0xc
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2c28b
mov eax, dword [ebp - 0xa9c]
mov ecx, dword [ebp - 0xab0]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xab0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2c28b
mov ebx, dword [ebp - 0xa9c]
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0xab0]
call fcn.00bc13d0
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xab0]
mov ecx, dword [ebp - 0xab0]
add esp, 0xc
push eax
call fcn.00b84e9a
mov ebx, eax
xor eax, eax
test ebx, ebx
js 0xc2c28d
mov dword [ebp - 0xa54], esi
mov esi, eax
mov dword [ebp - 0xa5c], edi
jmp 0xc2c28d
xor eax, eax
test esi, esi
je 0xc2c2a0
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or ebx, 0x10000000
mov dword [ebp - 0xa4c], ebx
jl 0xc2d352
xor eax, eax
mov dword [ebp - 0xc64], 8
mov dword [ebp - 0xa7c], eax
mov dword [ebp - 0xa98], eax
mov edx, dword [ebp - 0xa74]
lea eax, [ebp - 0xc64]
push eax
push 8
pop ecx
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa4c], ebx
jl 0xc2c35b
mov eax, dword [ebp - 0xc64]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xc2c30c
mov ebx, 0xc0000095
mov dword [ebp - 0xa4c], ebx
jmp 0xc2c333
mov dword [ebp - 0xc60], ecx
lea eax, [ebp - 0xc60]
push eax
push 8
pop edx
call fcn.00b84e9a
mov ebx, eax
mov eax, dword [ebp - 0xc60]
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
jns 0xc2c339
mov eax, dword [ebp - 0xcb8]
mov dword [ebp - 0xa88], eax
test ebx, ebx
js 0xc2c35b
mov edi, dword [ebp - 0xa64]
xor eax, eax
inc eax
cmp edi, eax
ja 0xc2c391
mov ebx, 0xc000000d
mov dword [ebp - 0xa4c], ebx
mov esi, dword [ebp - 0xa70]
test ebx, ebx
js 0xc2d352
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc2c5b4
mov ecx, dword [ebp - 0xad4]
mov ebx, 0xd0000017
jmp 0xc2c5c1
mov ecx, dword [ebp - 0xa94]
xor eax, eax
mov dword [ebp - 0xb8c], ecx
mov esi, eax
mov eax, dword [ecx]
mov dword [ebp - 0xa90], eax
lea eax, [ebp - 0xb8c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2c35b
mov edx, dword [ebp - 0xa90]
lea eax, [ebp - 0xb8c]
mov ecx, dword [ebp - 0xb8c]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2c35b
mov ecx, dword [ebp - 0xb8c]
xor eax, eax
inc esi
inc eax
cmp esi, eax
jb 0xc2c3a1
mov esi, dword [ecx]
lea eax, [ebp - 0xb8c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2c35b
mov dword [ebp - 0xa7c], esi
neg esi
sbb esi, esi
and dword [ebp - 0xb8c], esi
test ebx, ebx
js 0xc2c35b
cmp edi, 2
jbe 0xc2c350
mov ecx, dword [ebp - 0xa94]
xor eax, eax
push 4
mov dword [ebp - 0xb90], ecx
mov esi, eax
pop edi
lea eax, [ebp - 0xb90]
mov edx, edi
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2c4c3
mov edx, dword [ecx]
lea eax, [ebp - 0xb90]
mov ecx, dword [ebp - 0xb90]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2c4c3
mov ecx, dword [ebp - 0xb90]
inc esi
cmp esi, 2
jb 0xc2c453
mov esi, dword [ecx]
lea eax, [ebp - 0xb90]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2c4c3
mov edi, esi
neg esi
sbb esi, esi
and dword [ebp - 0xb90], esi
jmp 0xc2c4c9
mov edi, dword [ebp - 0xa98]
test ebx, ebx
js 0xc2c35b
mov edx, dword [ebp - 0xa88]
lea eax, [ebp - 0xb70]
push 4
pop esi
push eax
mov ecx, esi
mov dword [ebp - 0xb70], esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2c588
mov ecx, dword [ebp - 0xb70]
lea eax, [ebp - 0xb70]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2c588
mov edx, dword [ebp - 0xa7c]
lea eax, [ebp - 0xb70]
mov ecx, dword [ebp - 0xb70]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2c588
mov ecx, dword [ebp - 0xb70]
lea eax, [ebp - 0xb70]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2c588
mov ecx, dword [ebp - 0xb70]
lea eax, [ebp - 0xb70]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov eax, dword [ebp - 0xb70]
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
jns 0xc2c596
mov eax, dword [ebp - 0xe1c]
test ebx, ebx
js 0xc2c35b
cmp eax, 0x400000
jbe 0xc2c5a7
mov ebx, 0x8000ffff
jmp 0xc2d34c
mov esi, eax
mov dword [ebp - 0xa70], esi
jmp 0xc2c361
mov ecx, eax
mov dword [ebp - 0xad4], eax
mov ebx, 0x10000000
mov edi, dword [ebp - 0xa54]
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2d358
test edi, edi
jne 0xc2c5e3
mov ebx, 0x80070057
jmp 0xc2c6e9
test ecx, ecx
je 0xc2c5d9
mov eax, dword [ebp - 0xa5c]
xor ebx, ebx
mov dword [ebp - 0xdb8], eax
lea eax, [ebp - 0xcbc]
push eax
xor eax, eax
mov dword [ebp - 0xdc0], edi
push 0xb2be98
inc eax
mov dword [ebp - 0xdbc], ecx
push eax
mov dword [ebp - 0xdb4], esi
mov dword [ebp - 0xdb0], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xc2c65d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
jle 0xc2c64a
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2c6dc
mov ebx, 0x80004005
mov dword [ebp - 0xa4c], ebx
jmp 0xc2c6dc
push 0xb2be7c
push dword [ebp - 0xcbc]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0xc2c69f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
jle 0xc2c697
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
mov esi, dword [ebp - 0xa70]
jmp 0xc2c64a
push ebx
push 0x14
lea eax, [ebp - 0xdc0]
mov ecx, esi
push eax
push 0x86
call dword [0xd0cffc]
call esi
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa4c], ebx
jl 0xc2c6d6
mov esi, dword [ebp - 0xdb4]
mov dword [ebp - 0xa70], esi
jmp 0xc2c6dc
mov esi, dword [ebp - 0xa70]
cmp ebx, 0xd0000023
jne 0xc2c6f4
mov ebx, 0x8007007a
mov dword [ebp - 0xa4c], ebx
jmp 0xc2d358
test ebx, ebx
js 0xc2d358
mov eax, dword [ebp - 0xad4]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xae8], ecx
mov edi, ecx
mov dword [ebp - 0xb50], eax
cmp esi, edx
jae 0xc2c723
mov ebx, 0xc000003e
jmp 0xc2cb06
mov esi, dword [eax]
lea ecx, [ebp - 0xb50]
push ecx
mov ecx, eax
mov dword [ebp - 0xa90], esi
call fcn.00b84e9a
mov ebx, eax
xor ecx, ecx
test ebx, ebx
js 0xc2cb06
lea eax, [ebp - 0xae8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2cb04
mov eax, dword [ebp - 0xa70]
sub eax, dword [ebp - 0xae8]
cmp eax, esi
jae 0xc2c77a
mov ebx, 0xc000003e
jmp 0xc2cb04
mov eax, dword [ebp - 0xb50]
lea ecx, [ebp - 0xb50]
push ecx
mov edx, esi
mov dword [ebp - 0xa5c], eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2cb04
mov ecx, dword [ebp - 0xae8]
lea eax, [ebp - 0xae8]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2cb04
mov eax, dword [ebp - 0xa70]
sub eax, dword [ebp - 0xae8]
push 4
pop edx
cmp eax, edx
jb 0xc2c770
mov ecx, dword [ebp - 0xb50]
lea eax, [ebp - 0xb50]
push eax
mov esi, dword [ecx]
mov dword [ebp - 0xa80], esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2cb04
mov ecx, dword [ebp - 0xae8]
lea eax, [ebp - 0xae8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2cb04
mov eax, dword [ebp - 0xa70]
sub eax, dword [ebp - 0xae8]
cmp eax, esi
jb 0xc2c770
mov eax, dword [ebp - 0xb50]
lea ecx, [ebp - 0xb50]
push ecx
mov edx, esi
mov dword [ebp - 0xa74], eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2cb04
mov ecx, dword [ebp - 0xae8]
lea eax, [ebp - 0xae8]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2cb04
mov eax, dword [ebp - 0xa70]
sub eax, dword [ebp - 0xae8]
push 4
pop edx
cmp eax, edx
jb 0xc2c770
mov ecx, dword [ebp - 0xb50]
mov eax, dword [ecx]
mov dword [ebp - 0xa98], eax
lea eax, [ebp - 0xb50]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2cb04
mov ecx, dword [ebp - 0xae8]
lea eax, [ebp - 0xae8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2cb04
mov eax, dword [ebp - 0xa70]
sub eax, dword [ebp - 0xae8]
mov ecx, dword [ebp - 0xa98]
cmp eax, ecx
jb 0xc2c770
lea eax, [ebp - 0xae8]
mov edx, ecx
mov ecx, dword [ebp - 0xae8]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2cb04
mov ecx, dword [ebp - 0xa70]
mov eax, ecx
sub eax, dword [ebp - 0xae8]
jne 0xc2c770
mov eax, dword [ebp - 0xa98]
mov ebx, dword [ebp - 0xa90]
add eax, 0xc
add eax, esi
add eax, ebx
cmp eax, ecx
jne 0xc2c770
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xc2c952
mov ebx, 0xc0000017
jmp 0xc2ca8f
cmp dword [ebp - 0xa5c], edi
je 0xc2c993
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc2c97c
mov ebx, 0xc0000017
xor eax, eax
jmp 0xc2ca28
mov dword [esi + 4], eax
push ebx
push dword [ebp - 0xa5c]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc2c99a
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
cmp dword [ebp - 0xa74], edi
je 0xc2c9d6
mov ebx, dword [ebp - 0xa80]
push ebx
push 8
mov dword [esi + 8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc2c970
mov dword [esi + 0xc], eax
push ebx
push dword [ebp - 0xa74]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc2c9dc
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
cmp dword [ebp - 0xb50], edi
je 0xc2ca1c
mov ebx, dword [ebp - 0xa98]
push ebx
push 8
mov dword [esi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc2c970
mov dword [esi + 0x14], eax
push ebx
push dword [ebp - 0xb50]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc2ca22
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov edi, esi
mov ebx, eax
mov esi, eax
test esi, esi
je 0xc2ca8f
cmp dword [esi + 4], 0
je 0xc2ca48
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xc2ca64
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xc2ca80
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test ebx, ebx
js 0xc2ca9d
mov dword [ebp - 0xaa4], edi
mov edi, ecx
test edi, edi
je 0xc2cb06
cmp dword [edi + 4], 0
je 0xc2cabd
push dword [edi + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 4], ecx
cmp dword [edi + 0xc], 0
je 0xc2cad9
push dword [edi + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0xc], ecx
cmp dword [edi + 0x14], 0
je 0xc2caf5
push dword [edi + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0x14], ecx
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
or ebx, 0x10000000
mov dword [ebp - 0xa4c], ebx
jl 0xc2d352
mov eax, dword [ebp - 0xaa4]
mov esi, ecx
mov dword [ebp - 0xa64], esi
mov dword [ebp - 0xa68], ecx
test eax, eax
jne 0xc2cb40
mov ebx, 0xd000000d
mov dword [ebp - 0xa4c], ebx
jmp 0xc2d0ee
mov ebx, dword [eax + 4]
mov dword [ebp - 0xa70], ebx
test ebx, ebx
je 0xc2cb30
mov edi, dword [eax]
test edi, edi
je 0xc2cb30
add edi, 0xfffffff8
mov dword [ebp - 0xa94], ecx
push edi
push ecx
mov dword [ebp - 0xa7c], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xaa8], eax
test eax, eax
je 0xc2d0cc
xor ecx, ecx
mov dword [ebp - 0x3b4], 0xab69605e
mov dword [ebp - 0x3b0], 0x7f1137f
mov dl, cl
mov ecx, ebx
mov esi, eax
mov dword [ebp - 0xac4], ecx
mov dword [ebp - 0xa98], esi
and edi, 7
je 0xc2cca9
or dword [ebp - 0xae0], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0xaf0], ebx
mov eax, ebx
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xac0], ebx
test edi, edi
je 0xc2cc1f
push 0x38
pop esi
push 4
pop eax
cmp ebx, eax
jge 0xc2cbf1
mov eax, dword [ebp - 0xac4]
lea ecx, [esi - 0x20]
movzx eax, byte [eax]
shl eax, cl
or dword [ebp - 0xac0], eax
jmp 0xc2cbfe
movzx eax, byte [ecx]
mov ecx, esi
shl eax, cl
or dword [ebp - 0xadc], eax
mov ecx, dword [ebp - 0xac4]
inc ebx
sub esi, 8
inc ecx
mov dword [ebp - 0xac4], ecx
cmp ebx, edi
jl 0xc2cbd4
mov esi, dword [ebp - 0xa98]
mov eax, dword [ebp - 0xadc]
mov ebx, dword [ebp - 0xac0]
xor eax, 0x699a899c
xor ebx, 0x92f65a5
mov dword [ebp - 0xae0], eax
xor ecx, ecx
mov dword [ebp - 0xaf0], ebx
test edi, edi
je 0xc2cc6b
cmp ecx, 4
jge 0xc2cc4e
rol ebx, 8
mov byte [esi], bl
jmp 0xc2cc53
rol eax, 8
mov byte [esi], al
inc ecx
inc esi
cmp ecx, edi
jl 0xc2cc42
mov ebx, dword [ebp - 0xaf0]
mov eax, dword [ebp - 0xae0]
mov dword [ebp - 0xa98], esi
add edi, 0xfffffffc
test edi, edi
jle 0xc2cc8e
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xa88], eax
mov esi, eax
mov dword [ebp - 0xae0], eax
jmp 0xc2ccc8
xor eax, eax
mov esi, eax
mov dword [ebp - 0xae0], esi
test edi, edi
jns 0xc2ccc8
neg edi
shl edi, 3
mov ecx, edi
shr ebx, cl
shl ebx, cl
jmp 0xc2ccc2
xor eax, eax
or dword [ebp - 0xadc], 0xffffffff
mov esi, eax
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xae0], esi
mov ebx, eax
mov dword [ebp - 0xaf0], ebx
mov ecx, dword [ebp - 0xa7c]
mov eax, ecx
shr eax, 3
mov dword [ebp - 0xa74], eax
test eax, eax
je 0xc2d04e
mov eax, dword [ebp - 0xa98]
mov edi, dword [ebp - 0xac4]
add eax, 7
add edi, 2
mov dword [ebp - 0xa5c], eax
mov dword [ebp - 0xac4], edi
movzx ecx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ecx, 8
or ecx, eax
shl edi, 8
mov eax, dword [ebp - 0xac4]
xor ebx, ecx
mov dword [ebp - 0xa80], ecx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xac4]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xac4]
shl edi, 8
add dword [ebp - 0xac4], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul ecx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub ecx, eax
xor esi, ecx
imul ecx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub ecx, eax
sub ecx, 0x756c8a2
xor ebx, ecx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0x137f
ror ecx, 6
imul eax, eax, 0xab69
xor ecx, eax
xor esi, ecx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, esi
rol eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub ecx, eax
xor esi, ecx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x7f1
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov eax, esi
mov dword [ebp - 0xa88], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea esi, [ebx - 0x7f1]
xor esi, dword [ebp - 0xa88]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul ecx, eax, 0x137f
mov eax, esi
shr eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 7
add ecx, eax
xor esi, ecx
mov eax, esi
mov ecx, esi
xor eax, 0x137f
ror ecx, 9
imul eax, eax, 0x605e
add ecx, eax
xor ebx, ecx
mov eax, ebx
mov dword [ebp - 0xa90], ebx
xor eax, 0xab69
rol eax, 5
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add ecx, eax
xor esi, ecx
mov ebx, esi
xor ebx, dword [ebp - 0xa90]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul ecx, eax, 0x605e
mov eax, esi
ror eax, 6
sub ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add ecx, eax
xor esi, ecx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x605e
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor ecx, eax
xor esi, ecx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul ecx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xadc]
rol eax, 2
mov dword [ebp - 0xae0], esi
mov dword [ebp - 0xadc], edi
xor ecx, eax
mov edi, dword [ebp - 0xac4]
xor ecx, dword [ebp - 0xac0]
xor ebx, ecx
mov ecx, dword [ebp - 0xa5c]
mov dword [ebp - 0xaf0], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xae0]
ror dword [ebp - 0xaf0], 8
mov byte [ecx], al
mov al, byte [ebp - 0xaf0]
ror dword [ebp - 0xae0], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xae0]
ror dword [ebp - 0xaf0], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xaf0]
ror dword [ebp - 0xae0], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xae0]
ror dword [ebp - 0xaf0], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xae0], 8
mov al, byte [ebp - 0xaf0]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xae0]
mov byte [ecx - 3], al
add ecx, 8
mov ebx, dword [ebp - 0xaf0]
mov esi, dword [ebp - 0xae0]
mov eax, dword [ebp - 0xa80]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xa74], 1
mov dword [ebp - 0xaf0], ebx
mov dword [ebp - 0xae0], esi
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xa5c], ecx
jne 0xc2ccff
mov ecx, dword [ebp - 0xa7c]
mov ebx, dword [ebp - 0xaa8]
xor eax, eax
test ecx, ecx
je 0xc2d062
xor dl, byte [eax + ebx]
inc eax
cmp eax, ecx
jb 0xc2d05a
mov esi, dword [ebp - 0xa70]
movzx eax, dl
cdq
cmp eax, dword [ecx + esi]
jne 0xc2d08b
cmp edx, dword [ecx + esi + 4]
jne 0xc2d08b
mov edi, dword [ebp - 0xa94]
xor eax, eax
mov esi, ebx
mov dword [ebp - 0xa68], ecx
mov ebx, eax
jmp 0xc2d098
mov esi, dword [ebp - 0xa64]
mov edi, 0xc004d501
xor eax, eax
test ebx, ebx
je 0xc2d0ab
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0xc2d0cc
mov eax, dword [ebp - 0xa68]
xor ecx, ecx
mov dword [ebp - 0xaa0], esi
mov ebx, 0x10000000
mov esi, ecx
mov dword [ebp - 0xb08], eax
jmp 0xc2d0d3
mov ebx, 0xd0000001
xor ecx, ecx
mov dword [ebp - 0xa4c], ebx
test esi, esi
je 0xc2d0ee
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test ebx, ebx
js 0xc2d352
mov edi, dword [ebp - 0xb08]
push 4
pop esi
mov dword [ebp - 0xb3c], ecx
mov ecx, dword [ebp - 0xaa0]
mov dword [ebp - 0xbf4], ecx
cmp edi, esi
jb 0xc2d341
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0xa90], eax
lea eax, [ebp - 0xbf4]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2d346
lea eax, [ebp - 0xb3c]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2d346
mov eax, edi
sub eax, dword [ebp - 0xb3c]
cmp eax, esi
jb 0xc2d341
mov ecx, dword [ebp - 0xbf4]
lea eax, [ebp - 0xbf4]
push eax
push 4
pop eax
mov esi, dword [ecx]
mov edx, eax
mov dword [ebp - 0xa5c], esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2d346
mov ecx, dword [ebp - 0xb3c]
lea eax, [ebp - 0xb3c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2d346
mov ecx, dword [ebp - 0xb3c]
mov eax, edi
sub eax, ecx
cmp eax, esi
jb 0xc2d341
lea eax, [ebp - 0xb3c]
mov edx, esi
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2d346
mov edi, dword [ebp - 0xbf4]
mov edx, dword [ebp - 0xb08]
mov ebx, dword [ebp - 0xaa0]
lea ecx, [esi + edi]
lea eax, [edx + ebx]
cmp eax, ecx
jb 0xc2d341
sub edx, esi
sub edx, edi
add edx, ebx
cmp edx, 8
jae 0xc2d341
xor ecx, ecx
mov dword [ebp - 0xa98], ecx
mov eax, ecx
mov dword [ebp - 0xb08], eax
mov ebx, ecx
test edi, edi
je 0xc2d2d1
mov edx, dword [ebp - 0xa5c]
lea eax, [ebp - 0xba4]
push eax
mov ecx, edi
mov esi, edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc2d346
mov edx, dword [ebp - 0xba4]
cmp edi, edx
jae 0xc2d2c1
lea eax, [esi + 4]
cmp eax, esi
jb 0xc2d2fd
cmp eax, edx
ja 0xc2d2f6
mov eax, dword [esi]
push 4
add eax, 4
pop ebx
cmp eax, ebx
jb 0xc2d26d
mov ecx, eax
jmp 0xc2d270
or ecx, 0xffffffff
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, 4
jb 0xc2d287
mov dword [ebp - 0xcc0], ecx
jmp 0xc2d28d
mov ecx, dword [ebp - 0xcc0]
cmp eax, 4
jb 0xc2d32f
add ecx, esi
cmp ecx, esi
jb 0xc2d2a0
mov eax, ecx
jmp 0xc2d2a3
or eax, 0xffffffff
cmp ecx, esi
sbb ebx, ebx
and ebx, 0xc0000095
cmp ecx, esi
jb 0xc2d32f
cmp eax, edx
ja 0xc2d2f6
inc dword [ebp - 0xa98]
mov esi, eax
cmp eax, edx
jb 0xc2d24a
cmp esi, edx
jne 0xc2d2f6
mov esi, dword [ebp - 0xa5c]
mov eax, dword [ebp - 0xb08]
test esi, esi
je 0xc2d308
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb08], eax
test eax, eax
jne 0xc2d304
mov ebx, 0xc0000017
jmp 0xc2d32f
mov ebx, 0xc000000d
jmp 0xc2d346
mov ebx, 0xc0000095
jmp 0xc2d346
xor ecx, ecx
mov ebx, ecx
test edi, edi
je 0xc2d31d
push esi
push edi
push eax
call fcn.00bc13d0
mov eax, dword [ebp - 0xb08]
add esp, 0xc
mov dword [ebp - 0xbbc], eax
mov eax, dword [ebp - 0xa98]
mov dword [ebp - 0xbc4], eax
test ebx, ebx
js 0xc2d346
mov eax, dword [ebp - 0xa90]
cmp eax, dword [ebp - 0xbc4]
je 0xc2d346
mov ebx, 0xc000003e
or ebx, 0x10000000
mov dword [ebp - 0xa4c], ebx
mov edi, dword [ebp - 0xa54]
mov eax, dword [ebp - 0xacc]
test eax, eax
je 0xc2d373
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xa9c]
test esi, esi
je 0xc2d3e1
xor eax, eax
cmp dword [esi + 4], eax
je 0xc2d39a
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xc2d3b6
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xc2d3d2
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xc2d3f6
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xad4]
test eax, eax
je 0xc2d411
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xaa4]
test esi, esi
je 0xc2d47f
xor eax, eax
cmp dword [esi + 4], eax
je 0xc2d438
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xc2d454
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xc2d470
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xaa0]
test eax, eax
je 0xc2d49a
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc2ae6e
xor eax, eax
inc eax
cmp dword [ebp - 0xbc4], eax
jae 0xc2d4b7
mov ebx, 0xc004d501
jmp 0xc2ae68
cmp dword [ebp - 0xbbc], 0
jne 0xc2d547
mov ebx, 0xc000000d
mov dword [ebp - 0xa4c], ebx
mov eax, dword [ebp - 0xa84]
push 4
pop edx
test ebx, ebx
js 0xc2ae6e
cmp eax, 0xd0000023
jne 0xc2d4f2
mov eax, 0x8007007a
mov dword [ebp - 0xa84], eax
cmp eax, 0x8007007a
je 0xc2d509
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test eax, eax
js 0xc2ae6e
cmp dword [ebp - 0xbc4], 6
jne 0xc2d4ad
cmp dword [ebp - 0xbbc], 0
jne 0xc2d5bf
mov edx, dword [ebp - 0xd54]
mov ebx, 0xc000000d
mov ecx, dword [ebp - 0xd58]
mov dword [ebp - 0xa4c], ebx
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xaa4], ecx
jmp 0xc2d693
cmp dword [ebp - 0xbc4], 0
jbe 0xc2d4c4
mov ecx, dword [ebp - 0xbbc]
lea eax, [ebp - 0xb9c]
push eax
push 4
pop eax
mov esi, dword [ecx]
mov edx, eax
mov dword [ebp - 0xb9c], ecx
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2d593
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb9c]
mov dword [ebp - 0xb9c], eax
jmp 0xc2d59f
mov esi, dword [ebp - 0xe20]
mov eax, dword [ebp - 0xe24]
test ebx, ebx
js 0xc2d4cf
push 4
pop edx
cmp esi, edx
jne 0xc2afc7
mov eax, dword [eax]
mov dword [ebp - 0xa84], eax
jmp 0xc2d4d8
mov ecx, dword [ebp - 0xbbc]
xor eax, eax
mov dword [ebp - 0xb88], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xb88]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2d64f
mov ecx, dword [ebp - 0xb88]
lea eax, [ebp - 0xb88]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2d64f
mov ecx, dword [ebp - 0xb88]
xor eax, eax
inc esi
inc eax
cmp esi, eax
jae 0xc2d61c
push 4
pop edx
jmp 0xc2d5cf
mov esi, dword [ecx]
lea eax, [ebp - 0xb88]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2d64f
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb88]
mov dword [ebp - 0xb88], eax
jmp 0xc2d65b
mov esi, dword [ebp - 0xe48]
mov eax, dword [ebp - 0xe4c]
test ebx, ebx
js 0xc2d67b
cmp esi, 8
jne 0xc2afc7
mov ecx, dword [eax]
mov dword [ebp - 0xaa4], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xacc], ecx
jmp 0xc2d693
mov eax, dword [ebp - 0xd54]
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp - 0xd58]
mov dword [ebp - 0xaa4], eax
test ebx, ebx
js 0xc2ae6e
cmp dword [ebp - 0xbbc], 0
jne 0xc2d6dd
mov ebx, 0xc000000d
mov dword [ebp - 0xa4c], ebx
mov eax, dword [ebp - 0xcc4]
push 4
pop edx
mov dword [ebp - 0xb08], eax
test ebx, ebx
js 0xc2ae6e
cmp dword [ebp - 0xbbc], 0
jne 0xc2d791
mov ebx, 0xc000000d
jmp 0xc2ae68
mov ecx, dword [ebp - 0xbbc]
xor eax, eax
mov dword [ebp - 0xb84], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xb84]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2d76b
mov ecx, dword [ebp - 0xb84]
lea eax, [ebp - 0xb84]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2d76b
mov ecx, dword [ebp - 0xb84]
inc esi
cmp esi, 2
jb 0xc2d6ed
mov esi, dword [ecx]
lea eax, [ebp - 0xb84]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2d76b
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb84]
mov dword [ebp - 0xb84], eax
jmp 0xc2d777
mov esi, dword [ebp - 0xe50]
mov eax, dword [ebp - 0xe54]
test ebx, ebx
js 0xc2d6af
push 4
pop edx
cmp esi, edx
jne 0xc2afc7
mov eax, dword [eax]
jmp 0xc2d6b8
mov ecx, dword [ebp - 0xbbc]
xor eax, eax
mov dword [ebp - 0xb80], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xb80]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2d825
mov ecx, dword [ebp - 0xb80]
lea eax, [ebp - 0xb80]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2d825
mov ecx, dword [ebp - 0xb80]
inc esi
cmp esi, 3
jae 0xc2d7ec
push 4
pop edx
jmp 0xc2d7a1
mov edi, dword [ecx]
lea eax, [ebp - 0xb80]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xa74], edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2d825
mov esi, edi
neg esi
sbb esi, esi
and esi, dword [ebp - 0xb80]
mov dword [ebp - 0xb80], esi
jmp 0xc2d837
mov eax, dword [ebp - 0xdd8]
mov esi, dword [ebp - 0xddc]
mov dword [ebp - 0xa74], eax
test ebx, ebx
js 0xc2ae6e
mov ecx, dword [ebp - 0xbbc]
xor eax, eax
push 4
mov dword [ebp - 0xb0c], ecx
mov edi, eax
pop edx
mov eax, dword [ecx]
mov dword [ebp - 0xa90], eax
lea eax, [ebp - 0xb0c]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2d8d2
mov edx, dword [ebp - 0xa90]
lea eax, [ebp - 0xb0c]
mov ecx, dword [ebp - 0xb0c]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2d8d2
mov ecx, dword [ebp - 0xb0c]
inc edi
push 4
pop edx
cmp edi, edx
jb 0xc2d852
mov edi, dword [ecx]
lea eax, [ebp - 0xb0c]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2d8d2
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb0c]
mov dword [ebp - 0xb0c], eax
jmp 0xc2d8de
mov edi, dword [ebp - 0xde0]
mov eax, dword [ebp - 0xde4]
test ebx, ebx
js 0xc2d8f1
push 4
pop ecx
cmp edi, ecx
jne 0xc2afc7
mov eax, dword [eax]
jmp 0xc2d8f7
mov eax, dword [ebp - 0xde8]
mov dword [ebp - 0xa5c], eax
test ebx, ebx
js 0xc2ae6e
mov ecx, dword [ebp - 0xbbc]
xor eax, eax
mov edi, eax
mov eax, dword [ecx]
lea edx, [ecx + 4]
mov dword [ebp - 0xa90], eax
cmp edx, ecx
jb 0xc2d922
mov eax, edx
jmp 0xc2d925
or eax, 0xffffffff
cmp edx, ecx
mov dword [ebp - 0xb28], eax
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa4c], ebx
cmp edx, ecx
jb 0xc2d9a5
mov ecx, dword [ebp - 0xa90]
add ecx, eax
mov edx, ecx
mov ebx, ecx
cmp ecx, eax
jae 0xc2d952
or ecx, 0xffffffff
cmp ebx, eax
mov dword [ebp - 0xb28], ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa4c], ebx
cmp edx, eax
jb 0xc2d9a5
inc edi
cmp edi, 5
jb 0xc2d90f
mov edi, dword [ecx]
lea eax, [ebp - 0xb28]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
js 0xc2d9a5
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb28]
mov dword [ebp - 0xb28], eax
jmp 0xc2d9b1
mov edi, dword [ebp - 0xdec]
mov eax, dword [ebp - 0xdf0]
test ebx, ebx
js 0xc2d9c4
push 4
pop ecx
cmp edi, ecx
jne 0xc2afc7
mov ecx, dword [eax]
jmp 0xc2d9ca
mov ecx, dword [ebp - 0xa6c]
test ebx, ebx
js 0xc2ae6e
mov eax, dword [ebp - 0xa8c]
cmp eax, dword [ebp - 0xaa4]
jne 0xc2d4ad
mov eax, dword [ebp - 0xa60]
cmp eax, dword [ebp - 0xacc]
jne 0xc2d4ad
mov eax, dword [ebp - 0xb08]
push 4
mov dword [ebp - 0xa78], ecx
pop ecx
mov dword [ebp - 0xc00], eax
cmp dword [ebp - 0xa5c], ecx
jbe 0xc2da1d
mov ebx, 0x8007007a
jmp 0xc2ae68
mov eax, dword [ebp - 0xa74]
cmp eax, ecx
ja 0xc2da13
push eax
push esi
push dword [ebp - 0xb48]
call fcn.00bc13d0
add esp, 0xc
mov eax, dword [ebp - 0xa84]
mov esi, dword [ebp - 0xa50]
mov edi, dword [ebp - 0xa58]
test eax, eax
je 0xc2ae7a
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
jmp 0xc2ae7a
mov esi, dword [0xd0804c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [0xd09358], eax
mov eax, dword [0xd09360]
push 0x54
mov dword [ebp - 0xa98], eax
lea eax, [ebp - 0x754]
push ebx
push eax
mov dword [0xd0935c], edx
call fcn.00bc259b
xor eax, eax
mov dword [ebp - 0xd40], ebx
lea edi, [ebp - 0xbf0]
mov dword [ebp - 0xd3c], ebx
stosd dword es:[edi], eax
push 0x2c
push ebx
mov dword [ebp - 0xa94], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xa90], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x440]
push eax
call fcn.00bc259b
add esp, 0x18
mov dword [ebp - 0xb08], ebx
xor ebx, ebx
mov esi, 0xd0aed4
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xc2dad6
mov eax, dword [0xd0a150]
push 0
pop ebx
test eax, eax
jne 0xc2e0f0
push 0x338
mov esi, ebx
mov dword [ebp - 0xa60], ebx
push ebx
mov dword [ebp - 0xa54], ebx
mov dword [ebp - 0xa68], esi
mov dword [ebp - 0xab8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xacc], eax
test eax, eax
je 0xc2e0e2
or dword [ebp - 0xa74], 0xffffffff
mov edi, ebx
add eax, 7
mov dword [ebp - 0x3e4], 0xab69605e
mov cl, bl
mov dword [ebp - 0x3e0], 0x7f1137f
mov dword [ebp - 0xa5c], ebx
mov esi, 0xb2bef2
mov dword [ebp - 0xb10], ebx
mov dword [ebp - 0xb34], edi
mov dword [ebp - 0xa7c], eax
mov dword [ebp - 0xaa8], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edx, eax
mov dword [ebp - 0xa80], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl edx, 8
mov ebx, 0xab69605e
or edx, eax
movzx eax, byte [esi + 5]
shl edx, 8
add esi, 8
or edx, eax
mov dword [ebp - 0xaa4], esi
mov esi, edx
mov dword [ebp - 0xa8c], edx
xor esi, dword [ebp - 0xb10]
xor esi, edi
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor edi, edx
lea eax, [edi + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, edi
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor edi, edx
mov eax, edi
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, ebx
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor edi, edx
lea eax, [edi + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, ebx
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, edi
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edi, eax
mov dword [ebp - 0xa6c], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xa6c]
xor edi, ebx
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, edi
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov ebx, edi
xor ebx, esi
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor edi, eax
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, edi
ror eax, 6
sub edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add edx, eax
xor edi, edx
lea eax, [edi - 0x54969fa2]
mov esi, dword [ebp - 0xaa4]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, edi
ror eax, 0xe
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, edi
xor edi, dword [ebp - 0xa74]
rol eax, 2
mov dword [ebp - 0xb10], edi
xor edx, eax
xor edx, dword [ebp - 0xa5c]
xor ebx, edx
mov edx, dword [ebp - 0xa7c]
mov dword [ebp - 0xb34], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb10]
ror dword [ebp - 0xb34], 8
mov byte [edx], al
mov al, byte [ebp - 0xb34]
ror dword [ebp - 0xb10], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb10]
ror dword [ebp - 0xb34], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb34]
ror dword [ebp - 0xb10], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb10]
ror dword [ebp - 0xb34], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xb34]
ror dword [ebp - 0xb10], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb10]
mov byte [edx - 3], al
add edx, 8
mov edi, dword [ebp - 0xb34]
mov eax, dword [ebp - 0xa80]
ror dword [ebp - 0xb10], 8
ror edi, 8
sub dword [ebp - 0xaa8], 1
mov dword [ebp - 0xa5c], eax
mov eax, dword [ebp - 0xa8c]
mov dword [ebp - 0xb34], edi
mov dword [ebp - 0xa74], eax
mov dword [ebp - 0xa7c], edx
jne 0xc2db77
mov esi, dword [ebp - 0xacc]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc2deb4
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xc2dee6
cmp edx, dword [0xb2c22c]
jne 0xc2dee6
mov ebx, esi
xor eax, eax
mov dword [ebp - 0xa68], ebx
mov esi, eax
mov edi, 0x337
jmp 0xc2defb
mov ebx, dword [ebp - 0xa68]
or edi, 0xffffffff
mov dword [ebp - 0xab8], 0xc004d501
xor eax, eax
test esi, esi
je 0xc2df0e
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xab8], 0
jl 0xc2e0dc
xor eax, eax
mov esi, ebx
push 0x40
push eax
push 0xd0ae80
mov byte [edi + ebx], al
call fcn.00bc259b
add esp, 0xc
cmp byte [ebx], 0
je 0xc2e072
mov edi, 0xd0ae80
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbb0]
jne 0xc2df47
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc2e0d5
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa54], edx
cmp word [eax], cx
je 0xc2df94
mov edx, 0xc000007b
mov dword [ebp - 0xa54], edx
jmp 0xc2dfdc
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xc2df87
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xc2df87
cmp dword [ecx], 0x4550
jne 0xc2df87
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xb7c]
je 0xc2dfca
cmp ax, word [ebp - 0xb78]
je 0xc2dfca
mov edx, 0xc000000d
jmp 0xc2df8c
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xa5c], eax
test eax, eax
je 0xc2e066
mov ecx, esi
mov dword [ebp - 0xa80], esi
xor eax, eax
mov dword [ebp - 0xc84], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xa6c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc2e006
sub ecx, dword [ebp - 0xa6c]
inc esi
add esi, ecx
test edx, edx
js 0xc2e050
mov ecx, dword [ebp - 0xa80]
lea eax, [ebp - 0xc84]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa54], edx
test edx, edx
js 0xc2e072
mov eax, dword [ebp - 0xa60]
mov ecx, dword [ebp - 0xc84]
mov dword [eax*4 + section..data], ecx
jmp 0xc2e056
mov eax, dword [ebp - 0xa60]
inc eax
inc ebx
mov dword [ebp - 0xa60], eax
cmp ebx, dword [ebp - 0xa5c]
jb 0xc2dfed
add edi, 0x10
cmp byte [esi], 0
jne 0xc2df40
mov ebx, dword [ebp - 0xa54]
mov esi, dword [ebp - 0xa68]
test esi, esi
je 0xc2e093
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc2e0e9
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc2e0ac
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc2e09b
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc2e0f6
mov ebx, 0xc000007a
jmp 0xc2e078
mov esi, dword [ebp - 0xa68]
mov ebx, 0xc000007a
jmp 0xc2e07e
mov eax, dword [0xd0a150]
xor ebx, ebx
inc eax
mov dword [0xd0a150], eax
xor eax, eax
mov edx, 0xd0aed4
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0xa], ebx
lea edi, [ebp - 0xc3c]
mov dword [ebp - 0xaa0], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xad4], ebx
mov dword [ebp - 0xaa4], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xd68]
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc2e12d
mov eax, dword [0xd0a150]
push 0
pop ebx
test eax, eax
jne 0xc2e764
push 0x338
mov esi, ebx
mov dword [ebp - 0xa60], ebx
push ebx
mov dword [ebp - 0xa54], ebx
mov dword [ebp - 0xa68], esi
mov dword [ebp - 0xab8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xa8c], eax
test eax, eax
je 0xc2e756
or dword [ebp - 0xa74], 0xffffffff
mov edi, ebx
add eax, 7
mov dword [ebp - 0x3ac], 0xab69605e
mov cl, bl
mov dword [ebp - 0x3a8], 0x7f1137f
mov dword [ebp - 0xa5c], ebx
mov esi, 0xb2bef2
mov dword [ebp - 0xb14], ebx
mov dword [ebp - 0xb38], edi
mov dword [ebp - 0xa7c], eax
mov dword [ebp - 0xaa8], 0x67
movzx edx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx ebx, byte [esi + 2]
shl edx, 8
or edx, eax
shl ebx, 8
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
or ebx, eax
mov dword [ebp - 0xa6c], edx
movzx eax, byte [esi + 4]
xor edi, edx
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 5]
add esi, 8
shl ebx, 8
or ebx, eax
mov dword [ebp - 0xa80], esi
mov esi, edi
xor esi, ebx
xor esi, dword [ebp - 0xb14]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor edi, edx
lea eax, [edi + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, edi
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor edi, edx
mov eax, edi
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor edi, edx
lea eax, [edi + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, edi
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edi, eax
mov dword [ebp - 0xa9c], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xa9c]
xor edi, 0xab69605e
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, edi
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xa9c], esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
mov eax, esi
xor edi, edx
xor eax, edi
xor eax, 0xac987321
mov dword [ebp - 0xa9c], eax
ror eax, 3
sub eax, 0xab69
mov esi, dword [ebp - 0xa9c]
imul eax, eax, 0x137f
xor edi, eax
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, edi
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
xor edi, edx
lea eax, [edi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, edi
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xa9c], esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, edi
xor edi, dword [ebp - 0xa74]
rol eax, 2
mov dword [ebp - 0xb14], edi
mov dword [ebp - 0xa74], ebx
xor edx, eax
mov eax, esi
xor edx, dword [ebp - 0xa5c]
xor eax, edx
mov esi, dword [ebp - 0xa80]
mov edx, dword [ebp - 0xa7c]
mov dword [ebp - 0xb38], eax
mov byte [edx - 4], al
mov al, byte [ebp - 0xb14]
ror dword [ebp - 0xb38], 8
mov byte [edx], al
mov al, byte [ebp - 0xb38]
ror dword [ebp - 0xb14], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb14]
ror dword [ebp - 0xb38], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb38]
ror dword [ebp - 0xb14], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb14]
ror dword [ebp - 0xb38], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xb38]
ror dword [ebp - 0xb14], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb14]
mov byte [edx - 3], al
add edx, 8
mov eax, dword [ebp - 0xb38]
ror dword [ebp - 0xb14], 8
ror eax, 8
sub dword [ebp - 0xaa8], 1
mov dword [ebp - 0xa9c], eax
mov edi, dword [ebp - 0xa9c]
mov dword [ebp - 0xb38], eax
mov eax, dword [ebp - 0xa6c]
mov dword [ebp - 0xa5c], eax
mov dword [ebp - 0xa7c], edx
jne 0xc2e1ce
mov esi, dword [ebp - 0xa8c]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc2e528
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xc2e55a
cmp edx, dword [0xb2c22c]
jne 0xc2e55a
mov ebx, esi
xor eax, eax
mov dword [ebp - 0xa68], ebx
mov esi, eax
mov edi, 0x337
jmp 0xc2e56f
mov ebx, dword [ebp - 0xa68]
or edi, 0xffffffff
mov dword [ebp - 0xab8], 0xc004d501
xor eax, eax
test esi, esi
je 0xc2e582
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xab8], 0
jl 0xc2e750
xor eax, eax
mov esi, ebx
push 0x40
push eax
push 0xd0ae80
mov byte [edi + ebx], al
call fcn.00bc259b
add esp, 0xc
cmp byte [ebx], 0
je 0xc2e6e6
mov edi, 0xd0ae80
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbb0]
jne 0xc2e5bb
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc2e749
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa54], edx
cmp word [eax], cx
je 0xc2e608
mov edx, 0xc000007b
mov dword [ebp - 0xa54], edx
jmp 0xc2e650
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xc2e5fb
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xc2e5fb
cmp dword [ecx], 0x4550
jne 0xc2e5fb
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xb7c]
je 0xc2e63e
cmp ax, word [ebp - 0xb78]
je 0xc2e63e
mov edx, 0xc000000d
jmp 0xc2e600
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xa5c], eax
test eax, eax
je 0xc2e6da
mov ecx, esi
mov dword [ebp - 0xa80], esi
xor eax, eax
mov dword [ebp - 0xbd4], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xa6c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc2e67a
sub ecx, dword [ebp - 0xa6c]
inc esi
add esi, ecx
test edx, edx
js 0xc2e6c4
mov ecx, dword [ebp - 0xa80]
lea eax, [ebp - 0xbd4]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa54], edx
test edx, edx
js 0xc2e6e6
mov eax, dword [ebp - 0xa60]
mov ecx, dword [ebp - 0xbd4]
mov dword [eax*4 + section..data], ecx
jmp 0xc2e6ca
mov eax, dword [ebp - 0xa60]
inc eax
inc ebx
mov dword [ebp - 0xa60], eax
cmp ebx, dword [ebp - 0xa5c]
jb 0xc2e661
add edi, 0x10
cmp byte [esi], 0
jne 0xc2e5b4
mov ebx, dword [ebp - 0xa54]
mov esi, dword [ebp - 0xa68]
test esi, esi
je 0xc2e707
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc2e75d
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc2e720
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc2e70f
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc2e76a
mov ebx, 0xc000007a
jmp 0xc2e6ec
mov esi, dword [ebp - 0xa68]
mov ebx, 0xc000007a
jmp 0xc2e6f2
mov eax, dword [0xd0a150]
xor ebx, ebx
inc eax
mov dword [0xd0a150], eax
xor eax, eax
mov edi, 0xd0aed4
xchg dword [edi], eax
push 0x54
lea eax, [ebp - 0x754]
push ebx
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0xa98]
add esp, 0xc
mov esi, dword [0xd0807c]
mov ecx, eax
mov dword [ebp - 0xbf0], ebx
push 0xf
pop edx
and ecx, edx
mov dword [ebp - 0xa70], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
push 0x403
and ecx, edx
shr eax, 0xc
push ebx
mov word [ebp - 0xa], cx
and eax, edx
push ebx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa9c], eax
mov dword [ebp - 0xa68], 0xffffff
test eax, eax
jne 0xc2e80f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc2e7ff
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc2fc56
mov ebx, 0x80004005
jmp 0xc2fc56
mov esi, dword [0xd08050]
mov eax, ebx
mov dword [ebp - 0xa78], eax
mov edi, ebx
lea eax, [ebp - 0xc08]
mov dword [ebp - 0xacc], edi
push eax
push ebx
lea eax, [ebp - 0xbd8]
mov dword [ebp - 0xbdc], ebx
push eax
push 8
mov ecx, esi
mov dword [ebp - 0xa8c], ebx
mov dword [ebp - 0xa84], ebx
mov dword [ebp - 0xc08], ebx
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc2e8e5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc2e877
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc2ea4e
mov ebx, 0x80004005
mov esi, dword [ebp - 0xa84]
xor edx, edx
mov eax, dword [ebp - 0xbdc]
test eax, eax
je 0xc2e8a6
mov ecx, dword [ebp - 0xa8c]
test ecx, ecx
je 0xc2e8a6
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0xc2e89e
test esi, esi
je 0xc2e8b9
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbdc]
test eax, eax
je 0xc2f1b2
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0xbdc], ecx
jmp 0xc2f1b4
mov eax, dword [ebp - 0xc08]
add eax, eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xa7c], ebx
test ebx, ebx
jne 0xc2e912
mov ebx, 0x8007000e
jmp 0xc2e882
mov eax, dword [ebp - 0xbd8]
lea eax, [eax*4 + 4]
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xa74], eax
test eax, eax
je 0xc2ea33
mov esi, eax
lea eax, [ebp - 0xc08]
push eax
push ebx
mov ebx, dword [0xd08050]
lea eax, [ebp - 0xbd8]
push eax
push 8
mov ecx, ebx
call dword [0xd0cffc]
call ebx
test eax, eax
jne 0xc2e98a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc2e97c
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc2e983
mov ebx, 0x80004005
xor ecx, ecx
jmp 0xc2ea1e
mov eax, dword [ebp - 0xa74]
xor ecx, ecx
mov ebx, eax
mov edi, dword [ebp - 0xa7c]
mov dword [ebp - 0xa5c], ecx
cmp dword [ebp - 0xbd8], ecx
jbe 0xc2e9fb
mov esi, dword [0xd08058]
push ecx
push edi
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, edi
mov dword [ebx], eax
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0xc2e9c3
sub ecx, edx
sar ecx, 1
push 4
pop eax
add ebx, eax
mov eax, dword [ebp - 0xa5c]
lea edi, [edi + ecx*2]
add edi, 2
inc eax
push 0
mov dword [ebp - 0xa5c], eax
pop ecx
cmp eax, dword [ebp - 0xbd8]
jb 0xc2e9a8
mov eax, dword [ebp - 0xa74]
mov dword [ebx], 0x409
mov edi, eax
mov ebx, dword [ebp - 0xa78]
mov esi, ecx
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp - 0xbd8]
inc eax
mov dword [ebp - 0xa5c], eax
test esi, esi
je 0xc2ea38
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc2ea38
mov ebx, 0x8007000e
push dword [ebp - 0xa7c]
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc2e882
xor eax, eax
mov ebx, eax
mov edx, eax
mov dword [ebp - 0xa60], ebx
cmp dword [ebp - 0xa5c], eax
jbe 0xc2ea95
mov ecx, eax
mov eax, dword [edi + edx*4]
cmp eax, dword [ecx*4 + 0xb40a18]
je 0xc2ea8b
inc ecx
cmp ecx, 0x26
jb 0xc2ea6c
inc edx
xor eax, eax
cmp edx, dword [ebp - 0xa5c]
jae 0xc2ea95
jmp 0xc2ea6a
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0xa60], ebx
mov esi, dword [0xd08054]
mov ecx, esi
push eax
mov dword [ebp - 0xab8], eax
lea eax, [ebp - 0xb8]
push 0x55
push eax
push dword [ebx*4 + 0xb40a18]
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc2eb00
mov esi, dword [0xd08048]
lea eax, [ebp - 0x624]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xb8]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
test eax, eax
jle 0xc2eb00
mov ebx, dword [ebp - 0x618]
xor eax, eax
shr ebx, 0x1b
inc eax
and ebx, eax
mov dword [ebp - 0xab8], ebx
mov ebx, dword [ebp - 0xa60]
xor eax, eax
mov edx, 0xb2fcd8
mov esi, eax
mov ecx, edx
mov dword [ebp + esi*4 - 0x344], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbb0]
jne 0xc2eb15
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0xc2eb09
imul ecx, ebx, 3
movzx eax, byte [ecx + 0xb320b0]
mov eax, dword [ebp + eax*4 - 0x344]
mov dword [ebp - 0xc3c], eax
movzx eax, byte [ecx + 0xb320b1]
mov eax, dword [ebp + eax*4 - 0x344]
mov dword [ebp - 0xc38], eax
movzx eax, byte [ecx + 0xb320b2]
mov eax, dword [ebp + eax*4 - 0x344]
mov dword [ebp - 0xc34], eax
xor ebx, ebx
push 0x1c90
mov eax, ebx
push ebx
mov dword [ebp - 0xa78], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xac0], ecx
test ecx, ecx
je 0xc2e908
or dword [ebp - 0xa74], 0xffffffff
mov edi, ebx
add ecx, 7
mov dword [ebp - 0x3ec], 0xab69605e
mov al, bl
mov dword [ebp - 0x3e8], 0x7f1137f
mov dword [ebp - 0xa5c], ebx
mov esi, 0xb40ac2
mov dword [ebp - 0xb18], ebx
mov dword [ebp - 0xb40], edi
mov dword [ebp - 0xa7c], ecx
mov dword [ebp - 0xaa8], 0x392
movzx ebx, byte [esi - 2]
movzx ecx, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 3]
or edx, ecx
mov dword [ebp - 0xa80], ebx
movzx ecx, byte [esi + 4]
xor edi, ebx
shl edx, 8
mov ebx, 0xab69605e
or edx, ecx
movzx ecx, byte [esi + 5]
shl edx, 8
add esi, 8
or edx, ecx
mov dword [ebp - 0xa88], esi
mov esi, edx
mov dword [ebp - 0xa98], edx
xor esi, dword [ebp - 0xb18]
xor esi, edi
xor esi, 0xac987321
lea ecx, [esi + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, esi
rol ecx, 0xa
add edx, ecx
xor edi, edx
lea ecx, [edi + 0x7f1137f]
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, edi
rol ecx, 2
sub edx, ecx
xor esi, edx
imul edx, esi, 0x605e
mov ecx, esi
shr ecx, 0xd
sub edx, ecx
sub edx, 0x756c8a2
xor edi, edx
mov ecx, edi
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, edi
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, ebx
sub ecx, edx
xor edi, ecx
mov ecx, edi
mov edx, edi
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor esi, edx
lea ecx, [esi + 0x7f1137f]
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, esi
rol ecx, 2
add edx, ecx
xor edi, edx
lea ecx, [edi + 0x54969fa2]
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, edi
rol ecx, 8
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, ebx
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, esi
ror ecx, 0xa
xor edx, ecx
xor edi, edx
mov ecx, edi
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, edi
shr ecx, 0xa
xor edx, ecx
xor esi, edx
mov ecx, esi
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor edi, ecx
mov dword [ebp - 0xa6c], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xa6c]
xor edi, ebx
mov ecx, edi
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, edi
shr ecx, 2
add edx, ecx
xor esi, edx
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, esi
rol ecx, 7
add edx, ecx
xor edi, edx
mov ecx, edi
mov edx, edi
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69
rol ecx, 5
imul edx, ecx, 0x7f1
mov ecx, esi
rol ecx, 7
add edx, ecx
xor edi, edx
mov ebx, edi
xor ebx, esi
xor ebx, 0xac987321
mov ecx, ebx
ror ecx, 3
sub ecx, 0xab69
imul ecx, ecx, 0x137f
xor edi, ecx
lea ecx, [edi - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, edi
ror ecx, 6
sub edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 0xe
add edx, ecx
xor edi, edx
lea ecx, [edi - 0x54969fa2]
mov esi, dword [ebp - 0xa88]
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, edi
ror ecx, 0xe
sub edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, ebx
shr ecx, 3
xor edx, ecx
xor edi, edx
mov ecx, edi
xor ecx, 0x7f1137f
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, edi
xor edi, dword [ebp - 0xa74]
rol ecx, 2
mov dword [ebp - 0xb18], edi
xor edx, ecx
xor edx, dword [ebp - 0xa5c]
xor ebx, edx
mov edx, dword [ebp - 0xa7c]
mov dword [ebp - 0xb40], ebx
mov byte [edx - 4], bl
mov cl, byte [ebp - 0xb18]
ror dword [ebp - 0xb40], 8
mov byte [edx], cl
mov cl, byte [ebp - 0xb40]
ror dword [ebp - 0xb18], 8
mov byte [edx - 5], cl
mov cl, byte [ebp - 0xb18]
ror dword [ebp - 0xb40], 8
mov byte [edx - 1], cl
mov cl, byte [ebp - 0xb40]
ror dword [ebp - 0xb18], 8
mov byte [edx - 6], cl
mov cl, byte [ebp - 0xb18]
ror dword [ebp - 0xb40], 8
mov byte [edx - 2], cl
mov cl, byte [ebp - 0xb40]
ror dword [ebp - 0xb18], 8
mov byte [edx - 7], cl
mov cl, byte [ebp - 0xb18]
mov byte [edx - 3], cl
add edx, 8
mov edi, dword [ebp - 0xb40]
mov ecx, dword [ebp - 0xa80]
ror dword [ebp - 0xb18], 8
ror edi, 8
sub dword [ebp - 0xaa8], 1
mov dword [ebp - 0xa5c], ecx
mov ecx, dword [ebp - 0xa98]
mov dword [ebp - 0xb40], edi
mov dword [ebp - 0xa74], ecx
mov dword [ebp - 0xa7c], edx
jne 0xc2ebe9
xor ecx, ecx
mov esi, 0x1c90
mov edx, ecx
mov ecx, dword [ebp - 0xac0]
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0xc2ef37
movzx eax, al
cdq
cmp eax, dword [0xb42750]
jne 0xc2ef6b
cmp edx, dword [0xb42754]
jne 0xc2ef6b
mov ebx, dword [ebp - 0xa78]
xor edx, edx
mov dword [ebp - 0xbdc], ecx
mov ecx, edx
mov dword [ebp - 0xa8c], esi
jmp 0xc2ef78
mov ebx, 0xc004d501
xor edx, edx
mov dword [ebp - 0xa78], ebx
test ecx, ecx
je 0xc2ef8b
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc2e882
mov edi, dword [ebp - 0xbdc]
xor eax, eax
mov ebx, dword [ebp - 0xa60]
mov esi, eax
mov edx, eax
cmp ebx, edx
jne 0xc2efb0
mov dword [ebp + esi*4 - 0x2f8], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0xa6c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc2efbb
sub ecx, dword [ebp - 0xa6c]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0xc2efa5
inc esi
push 0
pop eax
cmp esi, 6
jb 0xc2efa3
push 0xc
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, dword [ebp - 0xa78]
mov edx, eax
mov dword [ebp - 0xa5c], edx
test edx, edx
jne 0xc2f00a
xor edx, edx
mov ebx, 0x8007000e
mov esi, edx
jmp 0xc2e88a
mov edi, edx
xor eax, eax
mov esi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xa60], eax
movzx edx, word [ebp + ecx*2 - 0xc]
cmp dx, word [eax*2 + 0xb40ab0]
je 0xc2f037
inc eax
cmp eax, 6
jb 0xc2f022
jmp 0xc2f0f6
mov edx, dword [ebp + eax*4 - 0x2f8]
mov ecx, edx
mov dword [ebp - 0xa6c], edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc2f049
xor eax, eax
sub ecx, edi
mov edi, dword [0xd08060]
push eax
push eax
lea eax, [ecx + 1]
mov ecx, edi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0xd0cffc]
call edi
mov dword [ebp - 0xa80], eax
test eax, eax
je 0xc2f12e
lea ecx, [eax + eax]
xor eax, eax
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0xa60]
mov edi, eax
mov eax, dword [ebp - 0xa5c]
mov dword [eax + ecx*4], edi
test edi, edi
je 0xc2f127
mov edx, dword [ebp - 0xa6c]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xa6c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc2f0bb
push dword [ebp - 0xa80]
sub ecx, dword [ebp - 0xa6c]
push edi
mov edi, dword [0xd08060]
lea eax, [ecx + 1]
mov ecx, edi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0xd0cffc]
call edi
test eax, eax
je 0xc2f12e
mov ecx, dword [ebp - 0xa60]
inc ecx
mov dword [ebp - 0xa60], ecx
push 0
pop eax
cmp ecx, 3
jb 0xc2f01d
mov eax, dword [ebp - 0xa5c]
xor edx, edx
mov dword [ebp - 0xaa4], eax
mov esi, edx
mov eax, dword [ebp - 0xab8]
mov dword [ebp - 0x754], eax
jmp 0xc2f14e
mov ebx, 0x8007000e
jmp 0xc2f14c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc2f145
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc2f14c
mov ebx, 0x80004005
xor edx, edx
test esi, esi
je 0xc2e88a
mov edi, edx
mov edx, dword [esi + edi*4]
test edx, edx
je 0xc2f1a7
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0xa6c], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbb0]
jne 0xc2f16a
sub ecx, dword [ebp - 0xa6c]
xor eax, eax
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc2f196
mov byte [edx], al
inc edx
sub ecx, 1
jne 0xc2f18e
push dword [esi + edi*4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
inc edi
cmp edi, 3
jb 0xc2f158
jmp 0xc2e888
xor ecx, ecx
mov eax, dword [ebp - 0xacc]
test eax, eax
je 0xc2f1cd
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc2fc38
mov eax, dword [ebp - 0xaa4]
mov esi, dword [0xd080b4]
mov ecx, dword [eax]
mov dword [ebp - 0x74c], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x748], ecx
xor ecx, ecx
mov eax, dword [eax + 8]
mov edi, ecx
push ecx
mov dword [ebp - 0x744], eax
mov ebx, ecx
lea eax, [ebp - 0xd74]
mov dword [ebp - 0xd70], ecx
push eax
push ecx
mov dword [ebp - 0xd6c], ecx
mov ecx, esi
push 0x42
mov dword [ebp - 0xd74], 0xc
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc2f250
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc2f247
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc2f25b
mov ebx, 0x80004005
jmp 0xc2f25b
mov edi, dword [ebp - 0xd70]
xor eax, eax
inc eax
and edi, eax
mov dword [ebp - 0x750], edi
test ebx, ebx
js 0xc2fc38
mov edi, dword [ebp - 0xa70]
mov eax, edi
push 0x2a
pop ecx
mov dword [ebp - 0xa84], ecx
sub eax, 1
je 0xc2f2a8
sub eax, 1
je 0xc2f29c
sub eax, 1
jne 0xc2f2b8
mov ebx, 0xe1
mov dword [ebp - 0xaa0], ebx
mov dword [ebp - 0xad4], ebx
jmp 0xc2f2b8
mov dword [ebp - 0xaa0], 0xf
jmp 0xc2f2ae
mov dword [ebp - 0xaa0], ecx
mov dword [ebp - 0xad4], 0xb
mov esi, 0xdc
mov dword [ebp - 0xa78], 0x60
push esi
xor ebx, ebx
lea eax, [ebp - 0x700]
push ebx
push eax
call fcn.00bc259b
add esp, 0xc
mov word [ebp - 0x6bc], si
mov esi, dword [0xd08070]
lea eax, [ebp - 0x700]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc2f3c0
movzx ebx, word [ebp - 0x65a]
xor eax, eax
mov ecx, dword [ebp - 0x650]
mov dword [ebp - 0xd64], eax
mov dword [ebp - 0xd68], eax
mov eax, dword [ebp - 0x654]
push 0x60
mov dword [ebp - 0xa60], eax
mov dword [ebp - 0xd60], eax
pop eax
mov dword [ebp - 0xa78], ebx
mov dword [ebp - 0xa5c], ecx
mov dword [ebp - 0xd5c], ecx
cmp ebx, eax
jae 0xc2f34f
mov dword [ebp - 0xa78], eax
xor ebx, ebx
xor eax, eax
inc eax
cmp edi, eax
mov edi, dword [ebp - 0xc3c]
je 0xc2f364
mov edi, dword [ebp - 0xc34]
push 0x5c
lea eax, [ebp - 0x604]
push ebx
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa6c], eax
test eax, eax
jne 0xc2f3dd
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc2f3b0
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc2f47d
mov ebx, 0x80004005
jmp 0xc2fc38
mov eax, dword [ebp - 0xd5c]
mov dword [ebp - 0xa5c], eax
mov eax, dword [ebp - 0xd60]
mov dword [ebp - 0xa60], eax
jmp 0xc2f351
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0xa78]
push dword [ebp - 0xaa0]
call dword [0xd0cffc]
call esi
push edi
push 0x20
neg eax
mov dword [ebp - 0x5f4], 0x190
pop edx
lea ecx, [ebp - 0x5e8]
mov dword [ebp - 0x604], eax
mov byte [ebp - 0x5ea], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x604]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc2f45e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc2f455
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc2f464
mov ebx, 0x80004005
jmp 0xc2f464
mov dword [ebp - 0x740], eax
push dword [ebp - 0xa6c]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xc2fc38
mov edi, dword [ebp - 0xc3c]
xor eax, eax
inc eax
cmp dword [ebp - 0xa70], eax
je 0xc2f49c
mov edi, dword [ebp - 0xc34]
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0x5a8]
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa6c], eax
test eax, eax
jne 0xc2f571
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc2f4f0
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0xc2f3b6
push 0x20
pop edi
test ebx, ebx
js 0xc2fc38
mov ebx, dword [ebp - 0xa70]
xor ecx, ecx
mov eax, ecx
mov edx, ecx
mov ecx, ebx
sub ecx, 1
je 0xc2f522
sub ecx, 1
je 0xc2f618
sub ecx, 1
jne 0xc2f52e
mov eax, dword [ebp - 0xa60]
mov edx, dword [ebp - 0xa5c]
mov dword [ebp - 0xbe8], eax
mov dword [ebp - 0xbe4], edx
xor ecx, ecx
inc ecx
cmp ebx, ecx
je 0xc2f65b
jbe 0xc2f62d
cmp ebx, 3
ja 0xc2f62d
xor ebx, ebx
mov edx, ebx
mov dword [ebp - 0xa84], ebx
mov ecx, ebx
mov dword [ebp - 0xa60], edx
mov dword [ebp - 0xaa0], ebx
jmp 0xc2f670
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0xa78]
push dword [ebp - 0xad4]
call dword [0xd0cffc]
call esi
push edi
push 0x20
pop edi
neg eax
mov dword [ebp - 0x598], 0x190
mov edx, edi
mov dword [ebp - 0x5a8], eax
lea ecx, [ebp - 0x58c]
mov byte [ebp - 0x58e], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x5a8]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc2f5f4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc2f5eb
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc2f5fa
mov ebx, 0x80004005
jmp 0xc2f5fa
mov dword [ebp - 0x73c], eax
push dword [ebp - 0xa6c]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xc2f4f9
mov eax, dword [ebp - 0xa60]
push 4
pop ecx
cdq
idiv ecx
xor ecx, ecx
mov edx, ecx
jmp 0xc2f52e
mov ecx, dword [ebp - 0xbd0]
xor ebx, ebx
mov edx, dword [ebp - 0xbd0]
mov dword [ebp - 0xaa0], ecx
mov ecx, dword [ebp - 0xbd0]
mov dword [ebp - 0xa84], ecx
mov ecx, dword [ebp - 0xbd0]
mov dword [ebp - 0xa60], edx
jmp 0xc2f670
xor ebx, ebx
mov dword [ebp - 0xaa0], edi
mov ecx, 0x96
mov dword [ebp - 0xa60], ebx
mov edx, ebx
mov dword [ebp - 0xa8c], ecx
push dword [ebp - 0x740]
mov esi, dword [0xd0803c]
sub eax, ecx
push dword [ebp - 0xa9c]
mov edi, dword [ebp - 0x74c]
sub eax, edx
mov ecx, esi
mov dword [ebp - 0xa80], eax
mov dword [ebp - 0x718], eax
mov dword [ebp - 0x728], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0xa6c], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x730]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xa9c]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc2f6e6
mov ebx, 0x80004005
mov eax, dword [ebp - 0xa6c]
test eax, eax
je 0xc2f702
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xc2fc38
push dword [ebp - 0x73c]
mov esi, dword [0xd0803c]
xor eax, eax
push dword [ebp - 0xa9c]
mov edi, dword [ebp - 0x748]
mov ecx, esi
mov ebx, eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0xa6c], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x720]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xa9c]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc2f768
mov ebx, 0x80004005
mov eax, dword [ebp - 0xa6c]
test eax, eax
je 0xc2f784
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xc2fc38
mov eax, dword [ebp - 0xa70]
cmp eax, 2
je 0xc2f79c
cmp eax, 3
jne 0xc2f7b2
mov edi, dword [ebp - 0x718]
cmp dword [ebp - 0x728], edi
jle 0xc2f7b8
mov edi, dword [ebp - 0x728]
jmp 0xc2f7b8
mov edi, dword [ebp - 0xa80]
cmp dword [ebp - 0x754], 0
mov esi, dword [0xd080a8]
mov ecx, esi
push dword [ebp - 0xa84]
je 0xc2f80b
mov eax, edi
sub eax, dword [ebp - 0x728]
add eax, dword [ebp - 0xa60]
push eax
lea eax, [ebp - 0x730]
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x724]
add eax, dword [ebp - 0xaa0]
push eax
mov eax, edi
sub eax, dword [ebp - 0x718]
add eax, dword [ebp - 0xa60]
push eax
jmp 0xc2f82f
mov ebx, dword [ebp - 0xa8c]
lea eax, [ebp - 0x730]
push ebx
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x724]
add eax, dword [ebp - 0xaa0]
push eax
push ebx
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x720]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xa70]
cmp eax, 2
je 0xc2fb16
cmp eax, 3
je 0xc2fb16
xor edx, edx
inc edx
cmp eax, edx
jne 0xc2fb35
xor eax, eax
mov dword [ebp - 0x734], 0xffffff
push 0x5c
push eax
lea eax, [ebp - 0x54c]
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa6c], eax
test eax, eax
jne 0xc2f8ce
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc2f8c3
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc2f96f
jmp 0xc2f3b6
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0xa78]
push 0xb
call dword [0xd0cffc]
call esi
push dword [ebp - 0xc38]
neg eax
mov dword [ebp - 0x53c], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x530]
mov dword [ebp - 0x54c], eax
mov byte [ebp - 0x532], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x54c]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc2f950
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc2f947
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc2f956
mov ebx, 0x80004005
jmp 0xc2f956
mov dword [ebp - 0x738], eax
push dword [ebp - 0xa6c]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xc2fc38
push dword [ebp - 0x738]
mov esi, dword [0xd0803c]
xor eax, eax
push dword [ebp - 0xa9c]
mov dword [ebp - 0x708], edi
mov ecx, esi
mov edi, dword [ebp - 0x744]
mov ebx, eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0xa6c], eax
xor eax, eax
push eax
push 0x460
lea eax, [ebp - 0x710]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xa9c]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc2f9db
mov ebx, 0x80004005
mov eax, dword [ebp - 0xa6c]
test eax, eax
je 0xc2f9f7
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xc2fc38
mov eax, dword [ebp - 0x708]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x708], eax
cmp eax, ecx
jge 0xc2fa1b
mov dword [ebp - 0x708], ecx
mov ebx, dword [ebp - 0xa78]
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x60
pop edi
push edi
push ebx
push dword [ebp - 0x710]
mov dword [ebp - 0x704], 0x20
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x70c]
mov dword [ebp - 0x710], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x708]
mov dword [ebp - 0x70c], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x704]
mov dword [ebp - 0x708], eax
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0x754], 0
mov dword [ebp - 0x704], eax
je 0xc2fae7
mov ecx, dword [ebp - 0x730]
cmp ecx, dword [ebp - 0x720]
jl 0xc2fac3
mov ecx, dword [ebp - 0x720]
mov eax, dword [ebp - 0x714]
add eax, 0x24
push eax
push ecx
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x710]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xc2fb32
mov ecx, dword [ebp - 0x728]
cmp ecx, dword [ebp - 0x718]
jg 0xc2fafb
mov ecx, dword [ebp - 0x718]
mov eax, dword [ebp - 0x714]
add eax, 0x24
push eax
mov eax, dword [ebp - 0x710]
sub eax, dword [ebp - 0x708]
add eax, ecx
push eax
jmp 0xc2face
mov eax, dword [ebp - 0x714]
mov dword [ebp - 0xbe8], edi
mov dword [ebp - 0xbe4], eax
mov dword [ebp - 0x734], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x754]
lea edi, [ebp - 0xe64]
mov ebx, dword [ebp - 0xbe8]
mov dword [ebp - 0xa6c], eax
mov eax, dword [ebp - 0xbe4]
mov dword [ebp - 0xa5c], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xa70]
sub eax, 1
je 0xc2fed1
sub eax, 1
je 0xc2fdfe
sub eax, 1
jne 0xc2fc36
mov esi, dword [0xd080a4]
lea edi, [ebp - 0x414]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08084]
lea ecx, [ebp - 0x414]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x414], 0x28
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc2fc36
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x400]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x3f8]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x3f8]
lea esi, [ebp - 0x400]
sub eax, ebx
lea edi, [ebp - 0xe64]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xbf0], eax
mov eax, dword [ebp - 0x3f4]
sub eax, dword [ebp - 0xa5c]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
mov dword [ebp - 0xbec], eax
xor ebx, ebx
push dword [ebp - 0xa9c]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov edi, 0xd0aed4
xor esi, esi
inc esi
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc2fc59
mov eax, dword [0xd0a150]
test eax, eax
jle 0xc2fcbe
sub eax, 1
mov dword [0xd0a150], eax
jne 0xc2fcbe
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc2fc8d
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc2fc7c
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0xd0aed4
inc esi
xor eax, eax
xchg dword [edi], eax
mov eax, dword [ebp - 0xaa4]
test eax, eax
je 0xc2fcdd
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc3195f
mov edi, dword [ebp - 0xbf0]
xor eax, eax
mov ebx, dword [ebp - 0xbec]
push 0x54
push eax
lea eax, [ebp - 0x7a8]
mov dword [ebp - 0xd40], edi
push eax
mov dword [ebp - 0xd3c], ebx
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0xa5c], esi
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push dword [ebp - 0xa64]
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc2fd78
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x7a8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc2fd78
push 0x20
pop eax
cmp word [ebp - 0x796], ax
jne 0xc2fd78
cmp dword [ebp - 0x794], 0
je 0xc2fd78
cmp dword [ebp - 0x7a4], 0
jle 0xc2fd78
cmp dword [ebp - 0x7a0], 0
jg 0xc2fd8d
xor eax, eax
cmp dword [ebp - 0xa70], 1
mov dword [ebp - 0xa5c], eax
jne 0xc2fee4
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x730]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x720]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ebx, dword [ebp - 0xa70]
cmp ebx, 1
jne 0xc2feea
mov eax, dword [ebp - 0x750]
mov esi, dword [0xd08014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xb08], eax
jmp 0xc2feea
mov esi, dword [0xd080a4]
lea edi, [ebp - 0x3dc]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08084]
lea ecx, [ebp - 0x3dc]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x3dc], 0x28
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc2fc36
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x3c8]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x3c0]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xa6c], 0
lea esi, [ebp - 0x3c8]
lea edi, [ebp - 0xe64]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xc2fea9
imul eax, dword [ebp - 0x3c0], 5
cdq
idiv ecx
add eax, dword [ebp - 0x3c8]
jmp 0xc2feb7
mov eax, dword [ebp - 0x3c0]
sub eax, ebx
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0xbf0], eax
mov eax, dword [ebp - 0x3bc]
sub eax, dword [ebp - 0xa5c]
imul eax, eax, 0x5f
jmp 0xc2fc2d
xor ebx, ebx
mov dword [ebp - 0xbf0], ebx
mov dword [ebp - 0xbec], ebx
jmp 0xc2fc38
mov ebx, dword [ebp - 0xa70]
mov esi, dword [0xd08040]
mov ecx, esi
push 1
push dword [ebp - 0xa64]
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0x754], 0
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xac0], 0x810
je 0xc2ff25
mov dword [ebp - 0xac0], 0x20812
cmp dword [ebp - 0xa5c], 0
je 0xc30a31
mov eax, dword [ebp - 0x750]
mov ebx, dword [ebp - 0x74c]
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0xa6c], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x7fc]
push eax
call fcn.00bc259b
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x9f4]
push eax
call fcn.00bc259b
xor ecx, ecx
lea eax, [ebp - 0x498]
push 0x2c
push ecx
push eax
mov dword [ebp - 0xaa8], ecx
mov dword [ebp - 0xa74], ecx
mov dword [ebp - 0xa60], ecx
mov dword [ebp - 0xa5c], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x384]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xc3193f
mov edi, dword [ebp - 0xa64]
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc2ffda
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc3193f
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x7fc]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc3001c
mov eax, dword [ebp - 0x7e8]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0x7f8]
mov dword [ebp - 0xa60], eax
mov eax, dword [ebp - 0x7f4]
mov dword [ebp - 0xa5c], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov edi, eax
mov dword [ebp - 0xa98], edi
test edi, edi
je 0xc2ffcf
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xccc], eax
mov dword [ebp - 0xaa0], eax
lea eax, [ebp - 0x498]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0x728]
add esp, 0xc
sub eax, dword [ebp - 0x730]
xor ecx, ecx
mov esi, dword [0xd0800c]
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x72c]
sub eax, dword [ebp - 0x724]
mov dword [ebp - 0x490], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x498], 0x28
mov word [ebp - 0x48c], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x48a], ax
lea eax, [ebp - 0xccc]
push eax
push ecx
lea eax, [ebp - 0x498]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xacc], eax
test eax, eax
jne 0xc300fe
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xaa0], eax
test eax, eax
jle 0xc300e9
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xaa0], eax
test eax, eax
js 0xc30488
mov dword [ebp - 0xaa0], 0x80004005
jmp 0xc30488
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x9f4]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc30128
mov eax, dword [ebp - 0x9e0]
mov dword [ebp - 0xa74], eax
mov eax, dword [ebp - 0x728]
sub eax, dword [ebp - 0x730]
push dword [ebp - 0xacc]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x724]
sub eax, dword [ebp - 0x72c]
push edi
mov dword [ebp - 0x378], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0xa6c]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xa88], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x384]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xac0]
lea eax, [ebp - 0x384]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa70], eax
jne 0xc3021f
cmp dword [ebp - 0xa80], 0
je 0xc30213
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa78], eax
jmp 0xc30229
mov dword [ebp - 0xa78], 0xffffff
jmp 0xc30229
mov dword [ebp - 0xa78], 0xffa8a8a8
mov edi, dword [ebp - 0x730]
xor edx, edx
mov eax, dword [ebp - 0x72c]
mov esi, edx
mov dword [ebp - 0xa7c], edi
mov ecx, edx
test edi, edi
jns 0xc30251
mov esi, edi
mov dword [ebp - 0xa7c], edx
neg esi
mov edi, edx
test eax, eax
jns 0xc3025b
mov ecx, eax
mov eax, edx
neg ecx
mov ebx, dword [ebp - 0x37c]
mov edx, dword [ebp - 0xa60]
sub ebx, esi
sub edx, edi
mov dword [ebp - 0xa8c], ebx
cmp ebx, edx
jl 0xc3027d
mov ebx, edx
mov dword [ebp - 0xa8c], edx
mov edi, dword [ebp - 0x378]
mov edx, dword [ebp - 0xa5c]
sub edi, ecx
sub edx, eax
mov dword [ebp - 0xaa4], edi
cmp edi, edx
jl 0xc3029f
mov edi, edx
mov dword [ebp - 0xaa4], edx
test ebx, ebx
jle 0xc30450
test edi, edi
jle 0xc30450
mov edx, dword [ebp - 0x37c]
mov ebx, dword [ebp - 0xaa8]
imul ecx, edx
add ecx, esi
mov esi, dword [ebp - 0xa74]
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xa60]
imul eax, esi
mov dword [ebp - 0xab8], ecx
add eax, dword [ebp - 0xa7c]
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xa8c]
mov dword [ebp - 0xa7c], eax
test edi, edi
jle 0xc30450
shl edx, 2
shl esi, 2
mov dword [ebp - 0xa6c], edx
mov dword [ebp - 0xa80], esi
test ebx, ebx
jle 0xc30431
mov esi, eax
mov dword [ebp - 0xa74], ebx
lea edx, [eax + 3]
sub esi, ecx
mov dword [ebp - 0xa84], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xa5c], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc303f1
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xa78]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa5c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xa84]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xa78]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xa76]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xa5c]
cdq
idiv ecx
mov edx, dword [ebp - 0xa84]
add al, bl
mov ebx, dword [ebp - 0xa74]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xa84], edx
mov dword [ebp - 0xa74], ebx
jne 0xc3032b
mov edi, dword [ebp - 0xaa4]
mov ebx, dword [ebp - 0xa8c]
mov ecx, dword [ebp - 0xab8]
mov eax, dword [ebp - 0xa7c]
mov edx, dword [ebp - 0xa6c]
mov esi, dword [ebp - 0xa80]
add ecx, edx
add eax, esi
sub edi, 1
mov dword [ebp - 0xab8], ecx
mov dword [ebp - 0xa7c], eax
mov dword [ebp - 0xaa4], edi
jne 0xc30307
push dword [ebp - 0xacc]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xa88]
mov edi, dword [ebp - 0xa98]
test eax, eax
je 0xc30488
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xaa0], 0
jl 0xc3193f
mov eax, dword [ebp - 0x750]
mov ebx, dword [ebp - 0x748]
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0xa6c], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x850]
push eax
call fcn.00bc259b
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x9a0]
push eax
call fcn.00bc259b
xor ecx, ecx
lea eax, [ebp - 0x46c]
push 0x2c
push ecx
push eax
mov dword [ebp - 0xaa8], ecx
mov dword [ebp - 0xa74], ecx
mov dword [ebp - 0xa60], ecx
mov dword [ebp - 0xa5c], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x374]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xc3193f
mov edi, dword [ebp - 0xa64]
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc2ffcf
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x850]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc30589
mov eax, dword [ebp - 0x83c]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0x84c]
mov dword [ebp - 0xa60], eax
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0xa5c], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov edi, eax
mov dword [ebp - 0xa88], edi
test edi, edi
je 0xc2ffcf
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xcd0], eax
mov dword [ebp - 0xaa0], eax
lea eax, [ebp - 0x46c]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0x718]
add esp, 0xc
sub eax, dword [ebp - 0x720]
xor ecx, ecx
mov esi, dword [0xd0800c]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x71c]
sub eax, dword [ebp - 0x714]
mov dword [ebp - 0x464], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x46c], 0x28
mov word [ebp - 0x460], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x45e], ax
lea eax, [ebp - 0xcd0]
push eax
push ecx
lea eax, [ebp - 0x46c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa98], eax
test eax, eax
jne 0xc3066f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xaa0], eax
test eax, eax
jle 0xc3065a
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xaa0], eax
test eax, eax
js 0xc30a08
mov dword [ebp - 0xaa0], 0x80004005
jmp 0xc30a08
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x9a0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc30699
mov eax, dword [ebp - 0x98c]
mov dword [ebp - 0xa74], eax
mov eax, dword [ebp - 0x718]
sub eax, dword [ebp - 0x720]
push dword [ebp - 0xa98]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x714]
sub eax, dword [ebp - 0x71c]
push edi
mov dword [ebp - 0x368], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0xa6c]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xad4], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x374]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xac0]
lea eax, [ebp - 0x374]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa70], eax
jne 0xc30798
cmp dword [ebp - 0xa80], 0
je 0xc3078c
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov edx, eax
mov dword [ebp - 0xa68], edx
mov dword [ebp - 0xa8c], edx
jmp 0xc307a9
mov dword [ebp - 0xa8c], 0xffffff
jmp 0xc307a9
mov eax, 0xffa8a8a8
mov dword [ebp - 0xa68], eax
mov dword [ebp - 0xa8c], eax
mov edi, dword [ebp - 0x720]
xor edx, edx
mov eax, dword [ebp - 0x71c]
mov esi, edx
mov dword [ebp - 0xa7c], edi
mov ecx, edx
test edi, edi
jns 0xc307d1
mov esi, edi
mov dword [ebp - 0xa7c], edx
neg esi
mov edi, edx
test eax, eax
jns 0xc307db
mov ecx, eax
mov eax, edx
neg ecx
mov ebx, dword [ebp - 0x36c]
mov edx, dword [ebp - 0xa60]
sub ebx, esi
sub edx, edi
mov dword [ebp - 0xaa4], ebx
cmp ebx, edx
jl 0xc307fd
mov ebx, edx
mov dword [ebp - 0xaa4], edx
mov edi, dword [ebp - 0x368]
mov edx, dword [ebp - 0xa5c]
sub edi, ecx
sub edx, eax
mov dword [ebp - 0xacc], edi
cmp edi, edx
jl 0xc3081f
mov edi, edx
mov dword [ebp - 0xacc], edx
test ebx, ebx
jle 0xc309d0
test edi, edi
jle 0xc309d0
mov edx, dword [ebp - 0x36c]
mov ebx, dword [ebp - 0xaa8]
imul ecx, edx
add ecx, esi
mov esi, dword [ebp - 0xa74]
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xa60]
imul eax, esi
mov dword [ebp - 0xab8], ecx
add eax, dword [ebp - 0xa7c]
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xaa4]
mov dword [ebp - 0xa7c], eax
test edi, edi
jle 0xc309d0
shl edx, 2
shl esi, 2
mov dword [ebp - 0xa6c], edx
mov dword [ebp - 0xa80], esi
test ebx, ebx
jle 0xc309b1
mov esi, eax
mov dword [ebp - 0xa74], ebx
lea edx, [eax + 3]
sub esi, ecx
mov dword [ebp - 0xa78], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xa5c], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc30971
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xa68]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa5c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xa78]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xa68]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa78]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xa8a]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa78]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xa5c]
cdq
idiv ecx
mov edx, dword [ebp - 0xa78]
add al, bl
mov ebx, dword [ebp - 0xa74]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xa78], edx
mov dword [ebp - 0xa74], ebx
jne 0xc308ab
mov edi, dword [ebp - 0xacc]
mov ebx, dword [ebp - 0xaa4]
mov ecx, dword [ebp - 0xab8]
mov eax, dword [ebp - 0xa7c]
mov edx, dword [ebp - 0xa6c]
mov esi, dword [ebp - 0xa80]
add ecx, edx
add eax, esi
sub edi, 1
mov dword [ebp - 0xab8], ecx
mov dword [ebp - 0xa7c], eax
mov dword [ebp - 0xacc], edi
jne 0xc30887
push dword [ebp - 0xa98]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xad4]
mov edi, dword [ebp - 0xa88]
test eax, eax
je 0xc30a08
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xaa0], 0
jl 0xc3193f
mov edi, dword [ebp - 0xa94]
jmp 0xc318eb
xor edx, edx
inc edx
cmp dword [ebp - 0x750], 0
jne 0xc30a45
cmp ebx, edx
je 0xc30a45
mov al, 0xc0
jmp 0xc30a47
or al, 0xff
mov byte [ebp - 0xa86], al
lea edi, [ebp - 0xc4c]
xor eax, eax
mov esi, dword [0xd08008]
stosd dword es:[edi], eax
xor ecx, ecx
push dword [ebp - 0xa64]
mov byte [ebp - 0xa88], cl
mov byte [ebp - 0xa87], cl
mov ecx, esi
stosd dword es:[edi], eax
mov byte [ebp - 0xa85], dl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xc94]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa94], eax
test eax, eax
jne 0xc30aa4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc3193f
xor eax, eax
inc eax
cmp ebx, eax
jne 0xc30ba1
mov eax, dword [ebp - 0x728]
mov ecx, dword [ebp - 0x718]
mov ebx, dword [ebp - 0x730]
sub eax, ebx
mov edi, dword [ebp - 0x720]
sub ecx, edi
cmp ecx, eax
jle 0xc30ad9
mov edx, ecx
mov dword [ebp - 0xac4], edx
jmp 0xc30ae1
mov edx, eax
mov dword [ebp - 0xac4], eax
mov esi, dword [ebp - 0x714]
sub esi, dword [ebp - 0x72c]
cmp dword [ebp - 0x754], 0
mov dword [ebp - 0xadc], esi
je 0xc30b1a
sub ebx, dword [ebp - 0x728]
sub edi, dword [ebp - 0x718]
add ebx, edx
add edi, edx
mov dword [ebp - 0xc4c], ebx
mov dword [ebp - 0xc94], edi
jmp 0xc30b26
mov ebx, dword [ebp - 0xc4c]
mov edi, dword [ebp - 0xc94]
add eax, ebx
mov dword [ebp - 0xa60], ebx
mov ebx, dword [ebp - 0x71c]
sub ebx, dword [ebp - 0x72c]
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0xc44], eax
mov eax, dword [ebp - 0x724]
sub eax, dword [ebp - 0x72c]
mov dword [ebp - 0xacc], ebx
mov dword [ebp - 0xc90], ebx
sub ebx, dword [ebp - 0x71c]
mov dword [ebp - 0xa50], edi
add edi, ecx
add ebx, dword [ebp - 0x714]
mov dword [ebp - 0xaa4], ebx
mov dword [ebp - 0xc88], ebx
mov ebx, dword [ebp - 0xac4]
mov dword [ebp - 0xa8c], eax
mov dword [ebp - 0xc40], eax
mov dword [ebp - 0xa58], edi
mov dword [ebp - 0xc8c], edi
jmp 0xc30c33
mov eax, dword [ebp - 0xbe4]
lea esi, [ebp - 0x730]
lea edi, [ebp - 0xc4c]
mov ebx, dword [ebp - 0xbe8]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xac4], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xc40]
lea esi, [ebp - 0x720]
lea edi, [ebp - 0xc94]
mov dword [ebp - 0xa8c], eax
mov eax, dword [ebp - 0xc44]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0xc4c]
mov dword [ebp - 0xa60], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xc88]
mov esi, dword [ebp - 0xadc]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0xc8c]
mov dword [ebp - 0xa58], eax
mov eax, dword [ebp - 0xc90]
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp - 0xc94]
mov dword [ebp - 0xa50], eax
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xce4], eax
lea eax, [ebp - 0x440]
push eax
call fcn.00bc259b
mov edi, dword [ebp - 0xa94]
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x440], 0x28
inc eax
mov dword [ebp - 0x43c], ebx
mov word [ebp - 0x434], ax
xor ecx, ecx
push 0x20
pop eax
push ecx
push ecx
mov word [ebp - 0x432], ax
neg esi
lea eax, [ebp - 0xce4]
mov dword [ebp - 0x438], esi
mov esi, dword [0xd0800c]
push eax
push ecx
lea eax, [ebp - 0x440]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa90], eax
test eax, eax
jne 0xc30cb8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc3192a
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa70], eax
jne 0xc30d29
mov ecx, dword [ebp - 0xb08]
test ecx, ecx
je 0xc30d29
mov esi, dword [0xd08074]
lea edi, [ebp - 0x390]
xor eax, eax
stosd dword es:[edi], eax
push ecx
mov ecx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x394], eax
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0x388], eax
lea eax, [ebp - 0x394]
push eax
mov eax, dword [ebp - 0xa94]
push eax
mov dword [ebp - 0x38c], ebx
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x750]
mov ebx, dword [ebp - 0x74c]
mov dword [ebp - 0xa74], eax
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0xa6c], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x8f8]
push eax
call fcn.00bc259b
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x94c]
push eax
call fcn.00bc259b
xor ecx, ecx
lea eax, [ebp - 0x4f0]
push 0x2c
push ecx
push eax
mov dword [ebp - 0xaa8], ecx
mov dword [ebp - 0xa7c], ecx
mov dword [ebp - 0xad4], ecx
mov dword [ebp - 0xa5c], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x354]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xa94]
test ebx, ebx
je 0xc3190f
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc30dd1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc3190f
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x8f8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc30e13
mov eax, dword [ebp - 0x8e4]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0xa5c], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, eax
mov dword [ebp - 0xa9c], esi
test esi, esi
je 0xc30dc6
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xce8], eax
mov dword [ebp - 0xa54], eax
lea eax, [ebp - 0x4f0]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0xaa0]
add esp, 0xc
mov edi, dword [ebp - 0xa60]
xor ecx, ecx
sub eax, edi
mov dword [ebp - 0x4f0], 0x28
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0x4ec], eax
mov eax, dword [ebp - 0xc48]
sub eax, dword [ebp - 0xa8c]
mov dword [ebp - 0x4e8], eax
xor eax, eax
push 0x20
inc eax
mov word [ebp - 0x4e4], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x4e2], ax
lea eax, [ebp - 0xce8]
push eax
push ecx
lea eax, [ebp - 0x4f0]
push eax
push esi
mov esi, dword [0xd0800c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa80], eax
test eax, eax
jne 0xc30efd
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xa54], eax
test eax, eax
jle 0xc30ee8
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xa54], eax
test eax, eax
js 0xc312a3
mov dword [ebp - 0xa54], 0x80004005
jmp 0xc312a3
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x94c]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc30f27
mov eax, dword [ebp - 0x938]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebp - 0xaa0]
push dword [ebp - 0xa80]
mov esi, dword [0xd0803c]
mov ecx, esi
push dword [ebp - 0xa9c]
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0xa8c]
sub eax, dword [ebp - 0xc48]
mov dword [ebp - 0x348], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xa9c]
call dword [0xd0cffc]
call esi
push dword [ebp - 0xa6c]
mov esi, dword [0xd0803c]
mov ecx, esi
push dword [ebp - 0xa9c]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xa6c], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x354]
push eax
push dword [ebp - 0xa9c]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xac0]
lea eax, [ebp - 0x354]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push dword [ebp - 0xa9c]
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa70], eax
jne 0xc31031
cmp dword [ebp - 0xa74], 0
je 0xc31025
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa78], eax
jmp 0xc3103b
mov dword [ebp - 0xa78], 0xffffff
jmp 0xc3103b
mov dword [ebp - 0xa78], 0xffa8a8a8
xor edx, edx
mov dword [ebp - 0xa74], edx
mov eax, edx
mov esi, edx
test edi, edi
jns 0xc31057
mov eax, edi
mov edi, edx
neg eax
mov dword [ebp - 0xa74], eax
mov ecx, dword [ebp - 0xc48]
test ecx, ecx
jns 0xc31067
mov esi, ecx
mov ecx, edx
neg esi
mov ebx, dword [ebp - 0x34c]
sub ebx, eax
mov eax, dword [ebp - 0xad4]
sub eax, edi
mov dword [ebp - 0xab8], ebx
cmp ebx, eax
jl 0xc31089
mov ebx, eax
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0xa5c]
mov edx, dword [ebp - 0x348]
sub eax, ecx
sub edx, esi
mov dword [ebp - 0xa60], edx
cmp edx, eax
jl 0xc310ab
mov edx, eax
mov dword [ebp - 0xa60], eax
test ebx, ebx
jle 0xc3126c
test edx, edx
jle 0xc3126c
mov eax, dword [ebp - 0x34c]
imul ecx, dword [ebp - 0xad4]
imul eax, esi
mov esi, dword [ebp - 0xa7c]
add ecx, edi
add eax, dword [ebp - 0xa74]
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xaa8]
mov dword [ebp - 0xa8c], eax
lea ecx, [esi + ecx*4]
mov dword [ebp - 0xa98], ecx
test edx, edx
jle 0xc3126c
mov esi, dword [ebp - 0x34c]
shl esi, 2
mov dword [ebp - 0xa7c], esi
mov esi, dword [ebp - 0xad4]
shl esi, 2
mov dword [ebp - 0xaa8], esi
mov esi, dword [ebp - 0xa7c]
mov edi, dword [ebp - 0xaa8]
test ebx, ebx
jle 0xc3124d
mov esi, ecx
mov dword [ebp - 0xa74], ebx
lea edx, [ecx + 3]
sub esi, eax
mov dword [ebp - 0xa84], edx
lea edi, [eax + 2]
mov dword [ebp - 0xa5c], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc3120d
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xa78]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa5c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xa84]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xa78]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xa76]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xa5c]
cdq
idiv ecx
mov edx, dword [ebp - 0xa84]
add al, bl
mov ebx, dword [ebp - 0xa74]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xa84], edx
mov dword [ebp - 0xa74], ebx
jne 0xc31147
mov edx, dword [ebp - 0xa60]
mov ebx, dword [ebp - 0xab8]
mov eax, dword [ebp - 0xa8c]
mov ecx, dword [ebp - 0xa98]
mov esi, dword [ebp - 0xa7c]
mov edi, dword [ebp - 0xaa8]
add eax, esi
add ecx, edi
sub edx, 1
mov dword [ebp - 0xa8c], eax
mov dword [ebp - 0xa98], ecx
mov dword [ebp - 0xa60], edx
jne 0xc31123
push dword [ebp - 0xa80]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xa6c]
test eax, eax
je 0xc312a3
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push dword [ebp - 0xa9c]
call dword [0xd0cffc]
call esi
push dword [ebp - 0xa9c]
mov esi, dword [0xd08018]
mov ecx, esi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xa54], 0
jl 0xc31909
mov eax, dword [ebp - 0x750]
mov ebx, dword [ebp - 0x748]
mov dword [ebp - 0xa5c], eax
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0xa6c], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x8a4]
push eax
call fcn.00bc259b
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa48]
push eax
call fcn.00bc259b
xor ecx, ecx
lea eax, [ebp - 0x4c4]
push 0x2c
push ecx
push eax
mov dword [ebp - 0xa7c], ecx
mov dword [ebp - 0xa74], ecx
mov dword [ebp - 0xaa0], ecx
mov dword [ebp - 0xa80], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x364]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xa94]
test ebx, ebx
je 0xc3190f
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc30dc6
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x8a4]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc313a9
mov eax, dword [ebp - 0x890]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0xa80], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, eax
mov dword [ebp - 0xa84], esi
test esi, esi
je 0xc30dc6
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xcf0], eax
mov dword [ebp - 0xad4], eax
lea eax, [ebp - 0x4c4]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0xa58]
add esp, 0xc
sub eax, dword [ebp - 0xa50]
xor ecx, ecx
mov edi, dword [ebp - 0xacc]
mov dword [ebp - 0xa58], eax
mov dword [ebp - 0x4c0], eax
mov eax, edi
sub eax, dword [ebp - 0xaa4]
mov dword [ebp - 0x4bc], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x4c4], 0x28
mov word [ebp - 0x4b8], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x4b6], ax
lea eax, [ebp - 0xcf0]
push eax
push ecx
lea eax, [ebp - 0x4c4]
push eax
push esi
mov esi, dword [0xd0800c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa98], eax
test eax, eax
jne 0xc3149d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xad4], eax
test eax, eax
jle 0xc31482
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xad4], eax
test eax, eax
mov edi, dword [ebp - 0xa84]
js 0xc31844
mov dword [ebp - 0xad4], 0x80004005
jmp 0xc31844
mov esi, dword [0xd08034]
lea ecx, [ebp - 0xa48]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc314c7
mov eax, dword [ebp - 0xa34]
mov dword [ebp - 0xa74], eax
mov eax, dword [ebp - 0xa58]
push dword [ebp - 0xa98]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0xaa4]
sub eax, edi
mov edi, dword [ebp - 0xa84]
push edi
mov dword [ebp - 0x358], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0xa6c]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xa6c], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x364]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xac0]
lea eax, [ebp - 0x364]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa70], eax
jne 0xc315c2
cmp dword [ebp - 0xa5c], 0
je 0xc315b6
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov ecx, eax
mov dword [ebp - 0xa68], ecx
mov dword [ebp - 0xa60], ecx
jmp 0xc315d3
mov dword [ebp - 0xa60], 0xffffff
jmp 0xc315d3
mov eax, 0xffa8a8a8
mov dword [ebp - 0xa68], eax
mov dword [ebp - 0xa60], eax
mov edx, dword [ebp - 0xa50]
xor ebx, ebx
mov dword [ebp - 0xa5c], ebx
mov esi, ebx
mov eax, ebx
test edx, edx
jns 0xc315f5
mov esi, edx
mov edx, ebx
neg esi
mov dword [ebp - 0xa5c], esi
mov ecx, dword [ebp - 0xacc]
test ecx, ecx
jns 0xc31605
mov eax, ecx
mov ecx, ebx
neg eax
mov ebx, dword [ebp - 0x35c]
sub ebx, esi
mov esi, dword [ebp - 0xaa0]
sub esi, edx
mov dword [ebp - 0xa8c], ebx
cmp ebx, esi
jl 0xc31627
mov ebx, esi
mov dword [ebp - 0xa8c], esi
mov edi, dword [ebp - 0x358]
mov esi, dword [ebp - 0xa80]
sub edi, eax
sub esi, ecx
mov dword [ebp - 0xaa4], edi
cmp edi, esi
jl 0xc31649
mov edi, esi
mov dword [ebp - 0xaa4], esi
test ebx, ebx
jle 0xc3180c
test edi, edi
jle 0xc3180c
imul ecx, dword [ebp - 0xaa0]
mov esi, dword [ebp - 0x35c]
mov ebx, dword [ebp - 0xa74]
imul eax, esi
add ecx, edx
mov edx, dword [ebp - 0xa7c]
add eax, dword [ebp - 0xa5c]
lea ecx, [edx + ecx*4]
mov dword [ebp - 0xab8], ecx
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xa8c]
mov dword [ebp - 0xaa8], eax
test edi, edi
jle 0xc3180c
mov edx, esi
shl edx, 2
mov dword [ebp - 0xa74], edx
mov edx, dword [ebp - 0xaa0]
shl edx, 2
mov dword [ebp - 0xa7c], edx
mov edx, dword [ebp - 0xa74]
mov esi, dword [ebp - 0xa7c]
test ebx, ebx
jle 0xc317ed
mov esi, ecx
mov dword [ebp - 0xa5c], ebx
lea edx, [ecx + 3]
sub esi, eax
mov dword [ebp - 0xa78], edx
lea edi, [eax + 2]
mov dword [ebp - 0xa80], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc317ad
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xa68]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa80]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xa78]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xa68]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa78]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xa5e]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa78]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xa80]
cdq
idiv ecx
mov edx, dword [ebp - 0xa78]
add al, bl
mov ebx, dword [ebp - 0xa5c]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xa78], edx
mov dword [ebp - 0xa5c], ebx
jne 0xc316e7
mov edi, dword [ebp - 0xaa4]
mov ebx, dword [ebp - 0xa8c]
mov eax, dword [ebp - 0xaa8]
mov ecx, dword [ebp - 0xab8]
mov edx, dword [ebp - 0xa74]
mov esi, dword [ebp - 0xa7c]
add eax, edx
add ecx, esi
sub edi, 1
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0xab8], ecx
mov dword [ebp - 0xaa4], edi
jne 0xc316c3
push dword [ebp - 0xa98]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xa6c]
mov edi, dword [ebp - 0xa84]
test eax, eax
je 0xc31844
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xad4], 0
mov edi, dword [ebp - 0xa94]
jl 0xc3190f
xor eax, eax
inc eax
cmp dword [ebp - 0xa70], eax
jne 0xc318ae
mov esi, dword [section..data]
xor eax, eax
push 0xcc0020
push eax
push eax
mov eax, dword [ebp - 0xac4]
mov ecx, esi
push edi
push dword [ebp - 0xadc]
push eax
push dword [ebp - 0x72c]
push dword [ebp - 0x730]
push dword [ebp - 0xa64]
call dword [0xd0cffc]
call esi
jmp 0xc318eb
push dword [ebp - 0xa88]
mov ecx, dword [ebp - 0xadc]
xor edx, edx
mov eax, dword [ebp - 0xac4]
mov esi, dword [0xd08020]
push ecx
push eax
push edx
push edx
push edi
push ecx
push eax
push dword [ebp - 0xbec]
mov ecx, esi
push dword [ebp - 0xbf0]
push dword [ebp - 0xa64]
call dword [0xd0cffc]
call esi
push dword [ebp - 0xba8]
mov esi, dword [0xd08040]
mov ecx, esi
push dword [ebp - 0xa64]
call dword [0xd0cffc]
call esi
jmp 0xc3190f
mov edi, dword [ebp - 0xa94]
mov eax, dword [ebp - 0xa90]
test eax, eax
je 0xc3192a
mov esi, dword [0xd0801c]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
test edi, edi
je 0xc3193f
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xb08]
test eax, eax
je 0xc3195a
mov esi, dword [0xd0801c]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov edi, 0xd0aed4
mov ebx, dword [ebp - 0x74c]
xor edx, edx
test ebx, ebx
je 0xc319b2
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0xc3196e
mov eax, dword [ebp - 0x74c]
sub ebx, ecx
sar ebx, 1
lea ebx, [ebx*2 + 2]
test ebx, ebx
je 0xc31996
mov byte [eax], dl
inc eax
sub ebx, 1
jne 0xc3198e
push dword [ebp - 0x74c]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0x74c], edx
mov ebx, dword [ebp - 0x748]
test ebx, ebx
je 0xc31a05
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0xc319bf
mov eax, dword [ebp - 0x748]
sub ebx, ecx
sar ebx, 1
lea ebx, [ebx*2 + 2]
test ebx, ebx
je 0xc319e7
mov byte [eax], dl
inc eax
sub ebx, 1
jne 0xc319df
push dword [ebp - 0x748]
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x748], ebx
jmp 0xc31a07
xor ebx, ebx
mov edx, dword [ebp - 0x744]
test edx, edx
je 0xc31a53
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc31a16
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc31a3e
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xc31a30
mov edx, dword [ebp - 0x744]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x744], ebx
cmp dword [ebp - 0x740], 0
je 0xc31a78
push dword [ebp - 0x740]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x740], ebx
cmp dword [ebp - 0x73c], 0
je 0xc31a9d
push dword [ebp - 0x73c]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x73c], ebx
cmp dword [ebp - 0x738], 0
je 0xc31ac2
push dword [ebp - 0x738]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x738], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc31ac4
mov eax, dword [0xd0a150]
push 0
pop ebx
test eax, eax
jle 0xc31b26
sub eax, 1
mov dword [0xd0a150], eax
jne 0xc31b26
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc31afa
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc31ae9
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xd0aed4
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0xd09360]
mov esi, dword [0xd0804c]
mov ecx, esi
mov dword [ebp - 0xa74], eax
call dword [0xd0cffc]
call esi
sub eax, dword [0xd09358]
lea edi, [ebp - 0x2e0]
push 8
mov dword [ebp - 0xa5c], eax
mov esi, 0xd0aed4
xor eax, eax
xor ebx, ebx
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xc31b65
mov eax, dword [0xd0a150]
push 0
pop ebx
test eax, eax
jne 0xc32159
push 0x338
mov esi, ebx
mov dword [ebp - 0xa60], ebx
push ebx
mov dword [ebp - 0xa54], ebx
mov dword [ebp - 0xa68], esi
mov dword [ebp - 0xc18], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xc1c], eax
test eax, eax
je 0xc3214d
or dword [ebp - 0xa80], 0xffffffff
mov edi, ebx
add eax, 7
mov dword [ebp - 0xa90], ebx
mov cl, bl
mov dword [ebp - 0xb1c], ebx
mov dword [ebp - 0xb44], edi
mov dword [ebp - 0xbd4], eax
mov esi, dword [ebp - 0xbcc]
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edx, eax
mov dword [ebp - 0xa6c], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl edx, 8
mov ebx, 0xab69605e
or edx, eax
movzx eax, byte [esi + 5]
shl edx, 8
add esi, 8
or edx, eax
mov dword [ebp - 0xbcc], esi
mov esi, edi
mov dword [ebp - 0xba4], edx
xor esi, edx
xor esi, dword [ebp - 0xb1c]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor edi, edx
lea eax, [edi + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, edi
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor edi, edx
mov eax, edi
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, ebx
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor edi, edx
lea eax, [edi + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, ebx
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, edi
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edi, eax
mov dword [ebp - 0xba8], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xba8]
xor edi, ebx
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, edi
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov ebx, edi
xor ebx, esi
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor edi, eax
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, edi
ror eax, 6
sub edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add edx, eax
xor edi, edx
lea eax, [edi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, edi
ror eax, 0xe
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, edi
xor edi, dword [ebp - 0xa80]
rol eax, 2
mov dword [ebp - 0xb1c], edi
xor edx, eax
xor edx, dword [ebp - 0xa90]
xor ebx, edx
mov edx, dword [ebp - 0xbd4]
mov dword [ebp - 0xb44], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb1c]
ror dword [ebp - 0xb44], 8
mov byte [edx], al
mov al, byte [ebp - 0xb44]
ror dword [ebp - 0xb1c], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb1c]
ror dword [ebp - 0xb44], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb44]
ror dword [ebp - 0xb1c], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb1c]
ror dword [ebp - 0xb44], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xb44]
ror dword [ebp - 0xb1c], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb1c]
mov byte [edx - 3], al
add edx, 8
mov edi, dword [ebp - 0xb44]
mov eax, dword [ebp - 0xa6c]
ror dword [ebp - 0xb1c], 8
ror edi, 8
sub dword [ebp - 0xbe0], 1
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0xba4]
mov dword [ebp - 0xb44], edi
mov dword [ebp - 0xa80], eax
mov dword [ebp - 0xbd4], edx
jne 0xc31be3
mov esi, dword [ebp - 0xc1c]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc31f20
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xc31f53
cmp edx, dword [0xb2c22c]
jne 0xc31f53
mov ebx, dword [ebp - 0xc18]
mov edi, esi
xor eax, eax
mov dword [ebp - 0xa68], edi
mov esi, eax
jmp 0xc31f67
or dword [ebp - 0xb94], 0xffffffff
mov ebx, 0xc004d501
mov edi, dword [ebp - 0xa68]
xor eax, eax
test esi, esi
je 0xc31f7a
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc32147
mov eax, dword [ebp - 0xb94]
xor ecx, ecx
push 0x40
push ecx
mov ebx, 0xd0ae80
mov esi, edi
push ebx
mov byte [eax + edi], cl
call fcn.00bc259b
add esp, 0xc
cmp byte [edi], 0
je 0xc320dd
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbb0]
jne 0xc31fb2
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc32140
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa54], edx
cmp word [eax], cx
je 0xc31fff
mov edx, 0xc000007b
mov dword [ebp - 0xa54], edx
jmp 0xc32047
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xc31ff2
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xc31ff2
cmp dword [ecx], 0x4550
jne 0xc31ff2
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xb7c]
je 0xc32035
cmp ax, word [ebp - 0xb78]
je 0xc32035
mov edx, 0xc000000d
jmp 0xc31ff7
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xba4], eax
test eax, eax
je 0xc320d1
mov ecx, esi
mov dword [ebp - 0xa6c], esi
xor eax, eax
mov dword [ebp - 0xaac], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xba8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc32071
sub ecx, dword [ebp - 0xba8]
inc esi
add esi, ecx
test edx, edx
js 0xc320bb
mov ecx, dword [ebp - 0xa6c]
lea eax, [ebp - 0xaac]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa54], edx
test edx, edx
js 0xc320dd
mov eax, dword [ebp - 0xa60]
mov ecx, dword [ebp - 0xaac]
mov dword [eax*4 + section..data], ecx
jmp 0xc320c1
mov eax, dword [ebp - 0xa60]
inc eax
inc ebx
mov dword [ebp - 0xa60], eax
cmp ebx, dword [ebp - 0xba4]
jb 0xc32058
add edi, 0x10
cmp byte [esi], 0
jne 0xc31fab
mov ebx, dword [ebp - 0xa54]
mov esi, dword [ebp - 0xa68]
test esi, esi
je 0xc320fe
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc32154
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc32117
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc32106
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc32161
mov ebx, 0xc000007a
jmp 0xc320e3
mov esi, dword [ebp - 0xa68]
mov ebx, 0xc000007a
jmp 0xc320e9
mov eax, dword [0xd0a150]
inc eax
xor ebx, ebx
mov dword [0xd0a150], eax
xor eax, eax
mov edi, 0xd0aed4
xchg dword [edi], eax
mov eax, dword [ebp - 0xa5c]
xor ecx, ecx
mov esi, dword [0xd08068]
inc ecx
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0xa74]
mov dword [ebp - 0x2c4], eax
lea eax, [ebp - 0x2e0]
push eax
push 4
pop eax
push eax
push 0x2021
mov dword [ebp - 0x2e0], ecx
mov dword [ebp - 0x2d8], ecx
mov dword [ebp - 0x2cc], ecx
mov dword [ebp - 0x2d0], ecx
mov dword [ebp - 0x2c8], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x2d4], 0x9966f291
call dword [0xd0cffc]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc321d0
mov eax, dword [0xd0a150]
push 0
pop ebx
test eax, eax
jle 0xc32232
sub eax, 1
mov dword [0xd0a150], eax
jne 0xc32232
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc32206
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc321f5
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xd0aed4
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xa64]
mov esi, dword [0xd080b0]
mov ecx, esi
push ebx
call dword [0xd0cffc]
call esi
jmp 0xc32251
xor ebx, ebx
mov eax, ebx
mov dword [ebp - 0xa64], ebx
mov dword [ebp - 0xa80], eax
lea edi, [ebp - 0xcac]
xor eax, eax
mov dword [ebp - 0xe6c], ebx
stosd dword es:[edi], eax
mov esi, ebx
mov dword [ebp - 0xa58], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xba8], ebx
test ebx, ebx
je 0xc3432b
push edi
push 0xd08d58
push ebx
call fcn.00bc13d0
add esp, 0xc
mov dword [ebp - 0xa64], ebx
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc34339
mov ecx, dword [0xd08d50]
mov dword [esi], ecx
mov ecx, dword [0xd08d54]
mov dword [esi + 4], ecx
mov dword [ebp - 0xa58], esi
rdtsc
mov dword [ebp - 0xa6c], eax
mov dword [ebp - 0xba4], edx
xor eax, eax
mov dword [ebp - 0xb24], eax
lea eax, [ebp - 0xcf4]
push eax
push 4
pop edi
mov edx, edi
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xc34339
mov edx, dword [ebp - 0xcf4]
lea eax, [ebp - 0xb24]
push eax
xor ecx, ecx
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc34339
lea eax, [ebp - 0xcf8]
mov edx, 0xa0
push eax
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xc34339
mov edx, dword [ebp - 0xcf8]
lea eax, [ebp - 0xb24]
mov ecx, dword [ebp - 0xb24]
push eax
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc34339
lea eax, [ebp - 0xcfc]
mov ecx, edi
push eax
push 8
pop edx
call fcn.00b84e9a
test eax, eax
js 0xc34339
mov edx, dword [ebp - 0xcfc]
lea eax, [ebp - 0xb24]
mov ecx, dword [ebp - 0xb24]
push eax
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc34339
lea eax, [ebp - 0xc2c]
mov ecx, edi
push eax
push 8
pop edx
call fcn.00b84e9a
test eax, eax
js 0xc34339
mov edx, dword [ebp - 0xc2c]
lea eax, [ebp - 0xb24]
mov ecx, dword [ebp - 0xb24]
push eax
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc34339
mov edi, dword [ebp - 0xb24]
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xbcc], ebx
test ebx, ebx
je 0xc34333
mov dword [ebp - 0xa80], eax
lea eax, [ebp - 0xe28]
mov ecx, ebx
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc34333
lea ecx, [ebx + edi]
lea eax, [ebx + 8]
cmp eax, ecx
ja 0xc34333
mov eax, dword [ebp - 0xe28]
push 4
pop ecx
mov dword [ebx], ecx
mov dword [eax], ecx
mov edi, ebx
xor eax, eax
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xaac], eax
mov edx, dword [edi]
lea eax, [ebp - 0xc10]
push eax
call fcn.00b84e9a
test eax, eax
js 0xc34333
mov edx, dword [ebp - 0xc10]
lea eax, [ebp - 0xba0]
push eax
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xc34333
mov eax, dword [ebp - 0xaac]
xor ecx, ecx
inc eax
inc ecx
mov dword [ebp - 0xaac], eax
cmp eax, ecx
jae 0xc324ad
mov edi, dword [ebp - 0xba0]
push 4
pop ecx
jmp 0xc3245c
mov ecx, dword [ebp - 0xba0]
lea eax, [ebp - 0xe30]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc34333
mov edx, dword [ebp - 0xb24]
lea eax, [ecx + 0xa4]
add edx, ebx
cmp eax, edx
ja 0xc34333
mov eax, 0xa0
push eax
push dword [ebp - 0xba8]
mov dword [ecx], eax
push dword [ebp - 0xe30]
call fcn.00bc13d0
add esp, 0xc
mov edi, ebx
xor eax, eax
mov dword [ebp - 0xad0], edi
mov dword [ebp - 0xaac], eax
mov edx, dword [edi]
lea eax, [ebp - 0xc20]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
test eax, eax
js 0xc34333
mov edx, dword [ebp - 0xc20]
lea eax, [ebp - 0xad0]
push eax
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xc34333
mov eax, dword [ebp - 0xaac]
inc eax
mov dword [ebp - 0xaac], eax
cmp eax, 2
jae 0xc3255f
mov edi, dword [ebp - 0xad0]
jmp 0xc3250e
mov ecx, dword [ebp - 0xad0]
lea eax, [ebp - 0xe38]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc34333
mov edi, dword [ebp - 0xb24]
lea eax, [ecx + 0xc]
add edi, ebx
cmp eax, edi
ja 0xc34333
mov dword [ecx], 8
mov ecx, dword [ebp - 0xe38]
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
xor eax, eax
mov dword [ebp - 0xabc], ebx
mov esi, eax
mov edx, dword [ebx]
lea eax, [ebp - 0xc24]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
test eax, eax
js 0xc34333
mov edx, dword [ebp - 0xc24]
lea eax, [ebp - 0xabc]
push eax
mov ecx, ebx
call fcn.00b84e9a
test eax, eax
js 0xc34333
inc esi
cmp esi, 3
jae 0xc325f6
mov ebx, dword [ebp - 0xabc]
jmp 0xc325b1
mov ecx, dword [ebp - 0xabc]
lea eax, [ebp - 0xe40]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc34333
lea eax, [ecx + 0xc]
cmp eax, edi
ja 0xc34333
mov eax, dword [ebp - 0xe40]
push 8
pop ebx
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xa6c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xba4]
mov dword [eax + 4], ecx
lea eax, [ebp - 0xbac]
push eax
push 4
pop edi
mov edx, edi
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xc34333
mov esi, dword [ebp - 0xbac]
lea eax, [ebp - 0xb2c]
push eax
mov edx, ebx
mov dword [ebp - 0xb54], esi
call fcn.00b84e9a
test eax, eax
js 0xc34333
mov edx, dword [ebp - 0xb2c]
lea eax, [ebp - 0xb54]
push eax
mov ecx, esi
call fcn.00b84e9a
test eax, eax
js 0xc34333
xor ecx, ecx
rdtsc
mov edi, ecx
mov dword [ebp - 0xa8c], ecx
mov ebx, ecx
mov dword [ebp - 0xb28], edi
mov dword [ebp - 0xb3c], ebx
mov dword [ebp - 0xa54], ecx
mov dword [ebp - 0xa90], ecx
mov dword [ebp - 0xb7c], ecx
mov dword [ebp - 0xab0], ecx
mov dword [ebp - 0xb9c], ecx
mov dword [ebp - 0xa88], ecx
mov dword [ebp - 0xa60], ecx
mov dword [ebp - 0xb2c], eax
mov dword [ebp - 0xbac], edx
push 8
pop ecx
mov dword [ebp - 0xc80], ecx
mov edx, dword [ebp - 0xb24]
lea eax, [ebp - 0xc80]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc327f9
mov eax, dword [ebp - 0xc80]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0xaac], ecx
cmp ecx, eax
jae 0xc3272a
mov esi, 0xc0000095
jmp 0xc327f9
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc3274c
mov esi, 0xc0000017
mov edi, ebx
jmp 0xc327f9
push 4
pop ecx
lea eax, [ebp - 0xb74]
mov dword [edi], ecx
mov edx, ecx
mov dword [ebp - 0xb74], edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc327de
mov ecx, dword [ebp - 0xb74]
mov eax, dword [ebp - 0xb24]
mov dword [ecx], eax
lea eax, [ebp - 0xb74]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc327de
mov eax, dword [ebp - 0xaac]
push dword [ebp - 0xb24]
mov ecx, dword [ebp - 0xb2c]
push dword [ebp - 0xbcc]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xbac]
push dword [ebp - 0xb74]
mov dword [edi + eax - 4], ecx
call fcn.00bc13d0
mov eax, dword [ebp - 0xaac]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xa8c], edi
mov edi, ecx
mov dword [ebp - 0xb28], eax
jmp 0xc327e0
xor ecx, ecx
test edi, edi
je 0xc327f3
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xb28]
or esi, 0x10000000
jl 0xc3413a
mov esi, dword [ebp - 0xa8c]
xor ecx, ecx
mov dword [ebp - 0xba0], ecx
test esi, esi
jne 0xc32821
mov esi, 0xc000000d
jmp 0xc32f6f
test edi, edi
je 0xc32f6a
lea eax, [edi + 8]
push eax
push ecx
mov dword [ebp - 0xb94], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xbe0], eax
test eax, eax
je 0xc32f6a
xor ecx, ecx
mov dl, cl
test edi, edi
je 0xc3285f
xor dl, byte [ecx + esi]
inc ecx
cmp ecx, edi
jb 0xc32857
mov dword [ebp - 0xabc], esi
or ecx, 0xffffffff
mov esi, eax
mov dword [ebp - 0xb00], ecx
xor eax, eax
mov dword [ebp - 0xb4c], esi
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xafc], eax
xor eax, eax
mov dword [ebp - 0xa84], eax
mov dword [ebp - 0xa78], eax
je 0xc32995
xor esi, esi
mov dword [ebp - 0xa78], eax
mov ecx, eax
mov dword [ebp - 0xaac], eax
mov dword [ebp - 0xa84], ecx
jbe 0xc32915
mov ebx, dword [ebp - 0xabc]
mov edi, eax
push 0x38
pop esi
push 4
pop ecx
cmp eax, ecx
movzx eax, byte [ebx]
jge 0xc328d4
lea ecx, [esi - 0x20]
shl eax, cl
mov ecx, dword [ebp - 0xa84]
or edi, eax
jmp 0xc328e6
mov ecx, esi
shl eax, cl
mov ecx, dword [ebp - 0xa84]
or ecx, eax
mov dword [ebp - 0xa84], ecx
mov eax, dword [ebp - 0xaac]
sub esi, 8
inc eax
inc ebx
mov dword [ebp - 0xaac], eax
test eax, eax
js 0xc328bb
mov dword [ebp - 0xa78], edi
xor esi, esi
mov edi, dword [ebp - 0xb28]
mov dword [ebp - 0xabc], ebx
mov ebx, dword [ebp - 0xb3c]
mov eax, dword [ebp - 0xa78]
xor ecx, 0x42f6b18d
xor eax, 0xb17a307a
cmp dword [ebp - 0xbb0], 0
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xafc], eax
jbe 0xc32970
mov ebx, dword [ebp - 0xb4c]
cmp esi, 4
jge 0xc3294d
rol eax, 8
mov byte [ebx], al
jmp 0xc32952
rol ecx, 8
mov byte [ebx], cl
inc ebx
add esi, 1
js 0xc32941
mov eax, dword [ebp - 0xafc]
mov dword [ebp - 0xb4c], ebx
mov ebx, dword [ebp - 0xb3c]
mov dword [ebp - 0xad8], eax
push 0xfffffffffffffffc
xor eax, eax
pop esi
mov ecx, eax
mov dword [ebp - 0xb00], ecx
test esi, esi
jg 0xc3298f
jns 0xc3298f
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xafc], eax
mov esi, dword [ebp - 0xb4c]
mov eax, edi
shr eax, 3
mov dword [ebp - 0xaac], eax
test eax, eax
je 0xc32d8b
mov ebx, dword [ebp - 0xabc]
lea eax, [esi + 7]
mov dword [ebp - 0xad0], eax
add ebx, 2
movzx edi, byte [ebx - 2]
movzx eax, byte [ebx - 1]
movzx esi, byte [ebx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ebx]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 3]
or esi, eax
movzx eax, byte [ebx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ebx + 5]
add ebx, 8
shl esi, 8
or esi, eax
mov dword [ebp - 0xb2c], ebx
xor ecx, esi
mov dword [ebp - 0xa50], ecx
lea ebx, [ecx - 0x4a58]
mov ecx, 0xc81ecb17
xor ebx, edi
xor ebx, dword [ebp - 0xad8]
xor ebx, ecx
mov eax, ebx
xor eax, ecx
ror eax, 0xf
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 7
add ecx, eax
mov eax, dword [ebp - 0xa50]
xor eax, ecx
mov dword [ebp - 0xa50], eax
add eax, 0xb1b54a58
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa50]
ror eax, 0xa
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0xcb17
rol eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
rol eax, 5
add ecx, eax
mov eax, dword [ebp - 0xa50]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xa50], eax
xor ecx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, ecx
xor ebx, eax
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 6
sub ecx, eax
sub ecx, 0x339b6838
xor dword [ebp - 0xa50], ecx
mov ecx, dword [ebp - 0xa50]
mov eax, ecx
ror eax, 0xf
xor eax, 0xcb17
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, 0xc81e
imul eax, eax, 0xcb17
xor ecx, eax
mov dword [ebp - 0xa50], ecx
lea eax, [ecx + 0x37e0ea91]
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0xc81e
ror ecx, 0xa
imul eax, eax, 0xb1b5
xor ecx, eax
mov eax, dword [ebp - 0xa50]
xor eax, ecx
mov dword [ebp - 0xa50], eax
xor eax, 0x4a58
rol eax, 6
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa50]
ror eax, 3
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa50]
mov eax, ebx
ror eax, 0xf
sub eax, 0xc81e
imul eax, eax, 0x4a58
xor ecx, eax
mov dword [ebp - 0xa50], ecx
xor ecx, 0xc81e
mov eax, dword [ebp - 0xa50]
shr eax, 1
imul ecx, ecx, 0x4a58
xor ecx, eax
mov eax, dword [ebp - 0xa50]
add eax, 0xffff34e9
xor ebx, ecx
rol eax, 3
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa50]
shr eax, 0xf
xor ecx, eax
xor ebx, ecx
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 0xd
sub ecx, eax
mov eax, 0xb1b54a58
add ecx, 0x730581bd
xor dword [ebp - 0xa50], ecx
sub eax, dword [ebp - 0xa50]
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa50]
ror eax, 0xb
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa50]
lea eax, [ebx + 0x4e49ed8a]
xor ecx, eax
mov dword [ebp - 0xa50], ecx
mov eax, dword [ebp - 0xa50]
xor eax, 0xb1b5
ror ecx, 7
imul eax, eax, 0x4a58
sub eax, ecx
xor ebx, eax
mov eax, ebx
xor eax, 0xc81e
rol eax, 4
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0x10
sub ecx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xa50], ecx
sub eax, dword [ebp - 0xa50]
ror eax, 0xa
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa50]
ror eax, 4
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x4e4ab5a8]
ror eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
ror eax, 9
xor ecx, eax
mov eax, dword [ebp - 0xa50]
xor eax, ecx
mov dword [ebp - 0xa50], eax
xor eax, 0xc81ecb17
rol eax, 8
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa50]
rol eax, 2
sub ecx, eax
mov eax, 0xc81ecb17
xor ebx, ecx
sub eax, ebx
ror eax, 0xb
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0xc
sub ecx, eax
mov eax, dword [ebp - 0xa50]
xor eax, ecx
mov dword [ebp - 0xa50], eax
xor eax, 0xb1b5
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa50]
shr eax, 8
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor ebx, dword [ebp - 0xa78]
xor eax, dword [ebp - 0xa84]
xor eax, dword [ebp - 0xa50]
xor eax, 0x79ab814f
mov dword [ebp - 0xafc], ebx
mov dword [ebp - 0xb00], eax
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0xa78], edi
mov dword [ebp - 0xa84], esi
mov byte [eax - 4], bl
mov al, byte [ebp - 0xb00]
mov ebx, dword [ebp - 0xad0]
ror dword [ebp - 0xafc], 8
mov byte [ebx], al
mov al, byte [ebp - 0xafc]
ror dword [ebp - 0xb00], 8
mov byte [ebx - 5], al
mov al, byte [ebp - 0xb00]
ror dword [ebp - 0xafc], 8
mov byte [ebx - 1], al
mov al, byte [ebp - 0xafc]
ror dword [ebp - 0xb00], 8
mov byte [ebx - 6], al
mov al, byte [ebp - 0xb00]
ror dword [ebp - 0xafc], 8
mov byte [ebx - 2], al
ror dword [ebp - 0xb00], 8
mov al, byte [ebp - 0xafc]
mov byte [ebx - 7], al
mov al, byte [ebp - 0xb00]
mov byte [ebx - 3], al
add ebx, 8
mov eax, dword [ebp - 0xafc]
mov ecx, dword [ebp - 0xb00]
ror eax, 8
ror ecx, 8
sub dword [ebp - 0xaac], 1
mov dword [ebp - 0xad0], ebx
mov ebx, dword [ebp - 0xb2c]
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0xb00], ecx
jne 0xc329ba
mov ebx, dword [ebp - 0xb3c]
mov edi, dword [ebp - 0xb28]
mov esi, dword [ebp - 0xbe0]
movzx eax, dl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc32dbd
mov esi, 0xc0000017
jmp 0xc32ed0
mov eax, dword [ebp - 0xb94]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc32de5
mov esi, 0xc0000017
xor edx, edx
jmp 0xc32e69
mov dword [edi + 4], eax
push dword [ebp - 0xb94]
push esi
push eax
call fcn.00bc13d0
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc32dd9
mov dword [edi + 0xc], eax
push 0xa0
push 0xd08ca8
push eax
call fcn.00bc13d0
add esp, 0xc
mov dword [edi + 0x10], esi
push esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xc32e4d
mov esi, 0xc0000017
jmp 0xc32e69
mov dword [edi + 0x14], ecx
mov esi, edx
mov eax, dword [0xd08d48]
mov dword [ecx], eax
mov eax, dword [0xd08d4c]
mov dword [ebp - 0xba0], edi
mov edi, edx
mov dword [ecx + 4], eax
test edi, edi
je 0xc32ed0
cmp dword [edi + 4], 0
je 0xc32e89
push dword [edi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 4], edx
cmp dword [edi + 0xc], 0
je 0xc32ea5
push dword [edi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0xc], edx
cmp dword [edi + 0x14], 0
je 0xc32ec1
push dword [edi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0x14], edx
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
test esi, esi
js 0xc32ee6
mov ebx, dword [ebp - 0xba0]
mov edi, eax
mov dword [ebp - 0xb3c], ebx
jmp 0xc32eec
mov edi, dword [ebp - 0xba0]
push dword [ebp - 0xbe0]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xc32f6f
xor eax, eax
cmp dword [edi + 4], eax
je 0xc32f21
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc32f3d
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc32f59
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc32f6f
mov esi, 0xc0000001
or esi, 0x10000000
jl 0xc34134
mov edx, dword [ebx]
lea eax, [ebp - 0xb60]
push 4
pop edi
push eax
mov ecx, edi
mov dword [ebp - 0xb60], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc3300a
mov ecx, dword [ebp - 0xb60]
lea eax, [ebp - 0xb60]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc3300a
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xb60]
mov ecx, dword [ebp - 0xb60]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc3300a
mov ecx, dword [ebp - 0xb60]
lea eax, [ebp - 0xb60]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc3300a
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xb60]
mov ecx, dword [ebp - 0xb60]
push eax
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xb60]
test esi, esi
jns 0xc33010
mov eax, dword [ebp - 0xdf4]
mov dword [ebp - 0xaac], eax
test esi, esi
js 0xc33169
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc3303e
mov esi, 0xc0000017
jmp 0xc33169
mov eax, dword [ebx]
mov ecx, edi
mov dword [edi], eax
lea eax, [ebp - 0xab4]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xab4], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc33154
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0xab4]
call fcn.00bc13d0
mov edx, dword [ebx]
lea eax, [ebp - 0xab4]
mov ecx, dword [ebp - 0xab4]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc33154
mov ecx, dword [ebp - 0xab4]
mov eax, dword [ebx + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xab4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc33154
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0xab4]
call fcn.00bc13d0
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xab4]
mov ecx, dword [ebp - 0xab4]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc33154
mov ecx, dword [ebp - 0xab4]
mov eax, dword [ebx + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xab4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc33154
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0xab4]
call fcn.00bc13d0
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xab4]
mov ecx, dword [ebp - 0xab4]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
xor ecx, ecx
test esi, esi
js 0xc33156
mov eax, dword [ebp - 0xaac]
mov dword [ebp - 0xa54], edi
mov edi, ecx
mov dword [ebp - 0xa90], eax
jmp 0xc33156
xor ecx, ecx
test edi, edi
je 0xc33169
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xc34134
xor eax, eax
mov dword [ebp - 0xc68], 8
mov dword [ebp - 0xaac], eax
mov dword [ebp - 0xabc], eax
mov edx, dword [ebp - 0xb54]
lea eax, [ebp - 0xc68]
push eax
push 8
pop ecx
call fcn.00b84e9a
mov esi, eax
or esi, 0x10000000
jl 0xc333b8
mov eax, dword [ebp - 0xc68]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xc331c7
mov esi, 0xc0000095
jmp 0xc331e8
mov dword [ebp - 0xc5c], ecx
lea eax, [ebp - 0xc5c]
push eax
push 8
pop edx
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xc5c]
test esi, esi
jns 0xc331ee
mov eax, dword [ebp - 0xd14]
mov dword [ebp - 0xad0], eax
test esi, esi
js 0xc333b8
mov ebx, dword [ebp - 0xbcc]
xor eax, eax
mov ecx, ebx
mov edi, eax
mov dword [ebp - 0xbb4], ecx
mov eax, dword [ecx]
mov dword [ebp - 0xb2c], eax
lea eax, [ebp - 0xbb4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc333b8
mov edx, dword [ebp - 0xb2c]
lea eax, [ebp - 0xbb4]
mov ecx, dword [ebp - 0xbb4]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc333b8
mov ecx, dword [ebp - 0xbb4]
xor eax, eax
inc edi
inc eax
cmp edi, eax
jb 0xc3320e
mov edi, dword [ecx]
lea eax, [ebp - 0xbb4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc333b8
mov dword [ebp - 0xaac], edi
xor eax, eax
mov dword [ebp - 0xad8], ebx
mov edi, eax
lea eax, [ebp - 0xad8]
mov ecx, ebx
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc332f0
mov edx, dword [ebx]
lea eax, [ebp - 0xad8]
mov ecx, dword [ebp - 0xad8]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc332f0
inc edi
cmp edi, 2
jae 0xc332cf
mov ebx, dword [ebp - 0xad8]
jmp 0xc3328e
mov ecx, dword [ebp - 0xad8]
lea eax, [ebp - 0xad8]
push eax
push 4
pop eax
mov edi, dword [ecx]
mov edx, eax
call fcn.00b84e9a
mov esi, eax
mov ebx, edi
test esi, esi
jns 0xc332fe
mov ebx, dword [ebp - 0xabc]
test esi, esi
js 0xc333b8
mov edx, dword [ebp - 0xad0]
lea eax, [ebp - 0xb5c]
push 4
pop edi
push eax
mov ecx, edi
mov dword [ebp - 0xb5c], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc33393
mov ecx, dword [ebp - 0xb5c]
lea eax, [ebp - 0xb5c]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc33393
mov edx, dword [ebp - 0xaac]
lea eax, [ebp - 0xb5c]
mov ecx, dword [ebp - 0xb5c]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc33393
mov ecx, dword [ebp - 0xb5c]
lea eax, [ebp - 0xb5c]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc33393
mov ecx, dword [ebp - 0xb5c]
lea eax, [ebp - 0xb5c]
push eax
mov edx, ebx
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xb5c]
test esi, esi
jns 0xc3339d
mov eax, dword [ebp - 0xdf8]
test esi, esi
js 0xc333b8
cmp eax, 0x400000
jbe 0xc333ae
mov esi, 0x8000ffff
jmp 0xc34134
mov edi, eax
mov dword [ebp - 0xab0], edi
jmp 0xc333be
mov edi, dword [ebp - 0xab0]
test esi, esi
js 0xc34134
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc333e7
mov ecx, dword [ebp - 0xb7c]
mov esi, 0xd0000017
jmp 0xc333f4
mov ecx, eax
mov dword [ebp - 0xb7c], eax
mov esi, 0x10000000
mov ebx, dword [ebp - 0xa54]
test esi, esi
js 0xc3413a
test ebx, ebx
jne 0xc33410
mov esi, 0x80070057
jmp 0xc3413a
test ecx, ecx
je 0xc33406
mov eax, dword [ebp - 0xa90]
mov dword [ebp - 0xdcc], eax
xor eax, eax
mov dword [ebp - 0xdc4], eax
lea eax, [ebp - 0xd18]
push eax
xor eax, eax
mov dword [ebp - 0xdd4], ebx
push 0xb2be98
inc eax
mov dword [ebp - 0xdd0], ecx
push eax
mov dword [ebp - 0xdc8], edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xc33474
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc3346b
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc334bc
mov esi, 0x80004005
jmp 0xc334bc
push 0xb2be7c
push dword [ebp - 0xd18]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xc33454
xor eax, eax
mov ecx, esi
push eax
push 0x14
lea eax, [ebp - 0xdd4]
push eax
push 0x86
call dword [0xd0cffc]
call esi
mov esi, eax
or esi, 0x10000000
jl 0xc334bc
mov edi, dword [ebp - 0xdc8]
mov dword [ebp - 0xab0], edi
cmp esi, 0xd0000023
jne 0xc334ce
mov esi, 0x8007007a
jmp 0xc3413a
test esi, esi
js 0xc3413a
mov eax, dword [ebp - 0xb7c]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xaec], ecx
mov ebx, ecx
mov dword [ebp - 0xb58], eax
cmp edi, edx
jae 0xc334fd
mov esi, 0xc000003e
jmp 0xc338e0
mov edi, dword [eax]
lea ecx, [ebp - 0xb58]
push ecx
mov ecx, eax
mov dword [ebp - 0xb2c], edi
call fcn.00b84e9a
mov esi, eax
xor ecx, ecx
test esi, esi
js 0xc338e0
lea eax, [ebp - 0xaec]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc338de
mov eax, dword [ebp - 0xab0]
sub eax, dword [ebp - 0xaec]
cmp eax, edi
jae 0xc33554
mov esi, 0xc000003e
jmp 0xc338de
mov eax, dword [ebp - 0xb58]
lea ecx, [ebp - 0xb58]
push ecx
mov edx, edi
mov dword [ebp - 0xb54], eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc338de
mov ecx, dword [ebp - 0xaec]
lea eax, [ebp - 0xaec]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc338de
mov eax, dword [ebp - 0xab0]
sub eax, dword [ebp - 0xaec]
push 4
pop edx
cmp eax, edx
jb 0xc3354a
mov ecx, dword [ebp - 0xb58]
lea eax, [ebp - 0xb58]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0xbac], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc338de
mov ecx, dword [ebp - 0xaec]
lea eax, [ebp - 0xaec]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc338de
mov eax, dword [ebp - 0xab0]
sub eax, dword [ebp - 0xaec]
cmp eax, edi
jb 0xc3354a
mov eax, dword [ebp - 0xb58]
lea ecx, [ebp - 0xb58]
push ecx
mov edx, edi
mov dword [ebp - 0xaac], eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc338de
mov ecx, dword [ebp - 0xaec]
lea eax, [ebp - 0xaec]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc338de
mov eax, dword [ebp - 0xab0]
sub eax, dword [ebp - 0xaec]
push 4
pop edx
cmp eax, edx
jb 0xc3354a
mov ecx, dword [ebp - 0xb58]
mov eax, dword [ecx]
mov dword [ebp - 0xabc], eax
lea eax, [ebp - 0xb58]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc338de
mov ecx, dword [ebp - 0xaec]
lea eax, [ebp - 0xaec]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc338de
mov eax, dword [ebp - 0xab0]
sub eax, dword [ebp - 0xaec]
mov ecx, dword [ebp - 0xabc]
cmp eax, ecx
jb 0xc3354a
lea eax, [ebp - 0xaec]
mov edx, ecx
mov ecx, dword [ebp - 0xaec]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc338de
mov ecx, dword [ebp - 0xab0]
mov eax, ecx
sub eax, dword [ebp - 0xaec]
jne 0xc3354a
mov eax, dword [ebp - 0xabc]
mov esi, dword [ebp - 0xb2c]
add eax, 0xc
add eax, edi
add eax, esi
cmp eax, ecx
jne 0xc3354a
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc3372c
mov esi, 0xc0000017
jmp 0xc33869
cmp dword [ebp - 0xb54], ebx
je 0xc3376d
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc33756
mov esi, 0xc0000017
xor eax, eax
jmp 0xc33802
mov dword [edi + 4], eax
push esi
push dword [ebp - 0xb54]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc33774
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
cmp dword [ebp - 0xaac], ebx
je 0xc337b0
mov esi, dword [ebp - 0xbac]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc3374a
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xaac]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc337b6
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
cmp dword [ebp - 0xb58], ebx
je 0xc337f6
mov esi, dword [ebp - 0xabc]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc3374a
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xb58]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc337fc
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov ebx, edi
mov esi, eax
mov edi, eax
test edi, edi
je 0xc33869
cmp dword [edi + 4], 0
je 0xc33822
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc3383e
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc3385a
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test esi, esi
js 0xc33877
mov dword [ebp - 0xb9c], ebx
mov ebx, ecx
test ebx, ebx
je 0xc338e0
cmp dword [ebx + 4], 0
je 0xc33897
push dword [ebx + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 4], ecx
cmp dword [ebx + 0xc], 0
je 0xc338b3
push dword [ebx + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 0xc], ecx
cmp dword [ebx + 0x14], 0
je 0xc338cf
push dword [ebx + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 0x14], ecx
push ebx
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
or esi, 0x10000000
jl 0xc34134
mov eax, dword [ebp - 0xb9c]
mov ebx, ecx
mov dword [ebp - 0xc10], ebx
mov dword [ebp - 0xc2c], ecx
test eax, eax
jne 0xc3390e
mov esi, 0xd000000d
jmp 0xc33eb8
mov esi, dword [eax + 4]
mov dword [ebp - 0xc24], esi
test esi, esi
je 0xc33904
mov edi, dword [eax]
test edi, edi
je 0xc33904
add edi, 0xfffffff8
mov dword [ebp - 0xc20], ecx
push edi
push ecx
mov dword [ebp - 0xb78], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb94], eax
test eax, eax
je 0xc33e9c
xor ecx, ecx
mov ebx, esi
mov dl, cl
mov dword [ebp - 0xaac], ebx
mov esi, edi
mov ecx, eax
mov dword [ebp - 0xabc], ecx
and esi, 7
je 0xc33e3e
xor eax, eax
xor edi, edi
mov dword [ebp - 0xaf4], eax
or eax, 0xffffffff
mov dword [ebp - 0xae4], eax
xor eax, eax
mov dword [ebp - 0xbb8], edi
mov dword [ebp - 0xb74], eax
mov dword [ebp - 0xb54], eax
test esi, esi
je 0xc339e6
push 0x38
pop ecx
cmp eax, 4
movzx eax, byte [ebx]
jge 0xc339b1
add ecx, 0xffffffe0
shl eax, cl
mov ecx, dword [ebp - 0xb6c]
or edi, eax
jmp 0xc339b9
shl eax, cl
or dword [ebp - 0xbb8], eax
mov eax, dword [ebp - 0xb54]
sub ecx, 8
inc eax
mov dword [ebp - 0xb6c], ecx
inc ebx
mov dword [ebp - 0xb54], eax
cmp eax, esi
jl 0xc3399a
mov ecx, dword [ebp - 0xabc]
mov dword [ebp - 0xb74], edi
mov dword [ebp - 0xaac], ebx
mov eax, dword [ebp - 0xbb8]
mov ebx, edi
xor ebx, 0x92f65a5
xor eax, 0x699a899c
xor edi, edi
mov dword [ebp - 0xaf4], ebx
mov dword [ebp - 0xae4], eax
test esi, esi
je 0xc33a34
cmp edi, 4
jge 0xc33a17
rol ebx, 8
mov byte [ecx], bl
jmp 0xc33a1c
rol eax, 8
mov byte [ecx], al
inc edi
inc ecx
cmp edi, esi
jl 0xc33a0b
mov ebx, dword [ebp - 0xaf4]
mov eax, dword [ebp - 0xae4]
mov dword [ebp - 0xabc], ecx
lea edi, [esi - 4]
test edi, edi
jle 0xc33e16
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xad0], eax
mov esi, eax
mov dword [ebp - 0xae4], eax
mov edi, dword [ebp - 0xb78]
mov eax, edi
shr eax, 3
mov dword [ebp - 0xb54], eax
test eax, eax
je 0xc33ddf
mov eax, dword [ebp - 0xabc]
mov edi, dword [ebp - 0xaac]
add eax, 7
add edi, 2
mov dword [ebp - 0xb6c], eax
mov dword [ebp - 0xad8], edi
movzx ecx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ecx, 8
or ecx, eax
shl edi, 8
mov eax, dword [ebp - 0xad8]
xor ebx, ecx
mov dword [ebp - 0xbac], ecx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xad8]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xad8]
shl edi, 8
add dword [ebp - 0xad8], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul ecx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub ecx, eax
xor esi, ecx
imul ecx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub ecx, eax
sub ecx, 0x756c8a2
xor ebx, ecx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0x137f
ror ecx, 6
imul eax, eax, 0xab69
xor ecx, eax
xor esi, ecx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, esi
rol eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub ecx, eax
xor esi, ecx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x7f1
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov eax, esi
mov dword [ebp - 0xad0], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea esi, [ebx - 0x7f1]
xor esi, dword [ebp - 0xad0]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul ecx, eax, 0x137f
mov eax, esi
shr eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 7
add ecx, eax
xor esi, ecx
mov eax, esi
mov ecx, esi
xor eax, 0x137f
ror ecx, 9
imul eax, eax, 0x605e
add ecx, eax
xor ebx, ecx
mov eax, ebx
mov dword [ebp - 0xb2c], ebx
xor eax, 0xab69
rol eax, 5
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add ecx, eax
xor esi, ecx
mov ebx, esi
xor ebx, dword [ebp - 0xb2c]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul ecx, eax, 0x605e
mov eax, esi
ror eax, 6
sub ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add ecx, eax
xor esi, ecx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x605e
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor ecx, eax
xor esi, ecx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul ecx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xbb8]
rol eax, 2
mov dword [ebp - 0xae4], esi
mov dword [ebp - 0xbb8], edi
xor ecx, eax
mov edi, dword [ebp - 0xad8]
xor ecx, dword [ebp - 0xb74]
xor ebx, ecx
mov ecx, dword [ebp - 0xb6c]
mov dword [ebp - 0xaf4], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xae4]
ror dword [ebp - 0xaf4], 8
mov byte [ecx], al
mov al, byte [ebp - 0xaf4]
ror dword [ebp - 0xae4], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xae4]
ror dword [ebp - 0xaf4], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xaf4]
ror dword [ebp - 0xae4], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xae4]
ror dword [ebp - 0xaf4], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xae4], 8
mov al, byte [ebp - 0xaf4]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xae4]
mov byte [ecx - 3], al
add ecx, 8
mov ebx, dword [ebp - 0xaf4]
mov esi, dword [ebp - 0xae4]
mov eax, dword [ebp - 0xbac]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xb54], 1
mov dword [ebp - 0xaf4], ebx
mov dword [ebp - 0xae4], esi
mov dword [ebp - 0xb74], eax
mov dword [ebp - 0xb6c], ecx
jne 0xc33a90
mov edi, dword [ebp - 0xb78]
mov ecx, dword [ebp - 0xb94]
xor eax, eax
test edi, edi
je 0xc33df3
xor dl, byte [eax + ecx]
inc eax
cmp eax, edi
jb 0xc33deb
mov esi, dword [ebp - 0xc24]
movzx eax, dl
cdq
cmp eax, dword [edi + esi]
jne 0xc33e5b
cmp edx, dword [edi + esi + 4]
jne 0xc33e5b
mov esi, dword [ebp - 0xc20]
xor eax, eax
mov ebx, ecx
mov ecx, eax
jmp 0xc33e6e
xor eax, eax
mov esi, eax
mov dword [ebp - 0xae4], esi
test edi, edi
jns 0xc33a59
neg edi
shl edi, 3
mov ecx, edi
shr ebx, cl
shl ebx, cl
mov dword [ebp - 0xaf4], ebx
jmp 0xc33a59
xor eax, eax
mov esi, eax
mov dword [ebp - 0xb74], eax
mov ebx, eax
mov dword [ebp - 0xae4], esi
mov dword [ebp - 0xaf4], ebx
jmp 0xc33a5f
mov ebx, dword [ebp - 0xc10]
mov esi, 0xc004d501
mov edi, dword [ebp - 0xc2c]
xor eax, eax
test ecx, ecx
je 0xc33e81
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc33e9c
xor ecx, ecx
mov dword [ebp - 0xa88], ebx
mov ebx, ecx
mov dword [ebp - 0xa60], edi
mov esi, 0x10000000
jmp 0xc33ea3
mov esi, 0xd0000001
xor ecx, ecx
test ebx, ebx
je 0xc33eb8
push ebx
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test esi, esi
js 0xc34134
mov edi, dword [ebp - 0xa60]
push 4
pop ebx
mov dword [ebp - 0xb4c], ecx
mov ecx, dword [ebp - 0xa88]
mov dword [ebp - 0xbf8], ecx
cmp edi, ebx
jb 0xc34129
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0xb2c], eax
lea eax, [ebp - 0xbf8]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc3412e
lea eax, [ebp - 0xb4c]
mov edx, ebx
push eax
xor ecx, ecx
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc3412e
mov eax, edi
sub eax, dword [ebp - 0xb4c]
cmp eax, ebx
jb 0xc34129
mov ecx, dword [ebp - 0xbf8]
lea eax, [ebp - 0xbf8]
push eax
push 4
pop eax
mov ebx, dword [ecx]
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc3412e
mov ecx, dword [ebp - 0xb4c]
lea eax, [ebp - 0xb4c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc3412e
mov ecx, dword [ebp - 0xb4c]
mov eax, edi
sub eax, ecx
cmp eax, ebx
jb 0xc34129
lea eax, [ebp - 0xb4c]
mov edx, ebx
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc3412e
mov edi, dword [ebp - 0xbf8]
mov edx, dword [ebp - 0xa60]
mov esi, dword [ebp - 0xa88]
lea ecx, [ebx + edi]
lea eax, [edx + esi]
cmp eax, ecx
jb 0xc34129
sub edx, ebx
sub edx, edi
add edx, esi
cmp edx, 8
jae 0xc34129
xor ecx, ecx
mov dword [ebp - 0xad0], ecx
mov eax, ecx
mov dword [ebp - 0xabc], eax
mov esi, ecx
test edi, edi
je 0xc340c0
lea eax, [ebp - 0xbc8]
mov dword [ebp - 0xb6c], edi
push eax
mov edx, ebx
mov ecx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc3412e
mov eax, dword [ebp - 0xbc8]
cmp edi, eax
jae 0xc340b6
lea eax, [ebp - 0xd1c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc3412e
mov eax, dword [ebp - 0xbc8]
cmp dword [ebp - 0xd1c], eax
ja 0xc340e5
mov edx, dword [ecx]
lea eax, [ebp - 0xd20]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc34066
mov eax, dword [ebp - 0xd20]
mov dword [ebp - 0xd24], eax
jmp 0xc3406c
mov eax, dword [ebp - 0xd24]
test esi, esi
js 0xc3412e
lea ecx, [ebp - 0xc14]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xb6c]
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc3412e
mov ecx, dword [ebp - 0xc14]
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0xb6c], ecx
cmp ecx, eax
ja 0xc340e5
inc dword [ebp - 0xad0]
cmp ecx, eax
jb 0xc34012
cmp ecx, eax
jne 0xc340e5
mov eax, dword [ebp - 0xabc]
test ebx, ebx
je 0xc340f0
push ebx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xabc], eax
test eax, eax
jne 0xc340ec
mov esi, 0xc0000017
jmp 0xc34117
mov esi, 0xc000000d
jmp 0xc3412e
xor ecx, ecx
mov esi, ecx
test edi, edi
je 0xc34105
push ebx
push edi
push eax
call fcn.00bc13d0
mov eax, dword [ebp - 0xabc]
add esp, 0xc
mov dword [ebp - 0xca4], eax
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0xcac], eax
test esi, esi
js 0xc3412e
mov eax, dword [ebp - 0xb2c]
cmp eax, dword [ebp - 0xcac]
je 0xc3412e
mov esi, 0xc000003e
or esi, 0x10000000
mov ebx, dword [ebp - 0xa54]
mov eax, dword [ebp - 0xa8c]
test eax, eax
je 0xc34155
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xb3c]
test edi, edi
je 0xc341c3
xor eax, eax
cmp dword [edi + 4], eax
je 0xc3417c
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc34198
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc341b4
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
je 0xc341da
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc341dc
xor ebx, ebx
mov eax, dword [ebp - 0xb7c]
test eax, eax
je 0xc341f5
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ebx, dword [ebp - 0xb9c]
test ebx, ebx
je 0xc34263
xor eax, eax
cmp dword [ebx + 4], eax
je 0xc3421c
push dword [ebx + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 4], eax
cmp dword [ebx + 0xc], 0
je 0xc34238
push dword [ebx + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0xc], eax
cmp dword [ebx + 0x14], 0
je 0xc34254
push dword [ebx + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0x14], eax
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xa88]
xor ebx, ebx
test eax, eax
je 0xc3427e
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc34333
mov esi, dword [ebp - 0xcac]
xor eax, eax
inc eax
cmp esi, eax
jb 0xc34333
mov ecx, dword [ebp - 0xca4]
test ecx, ecx
je 0xc34333
test esi, esi
je 0xc34333
lea eax, [ebp - 0xc58]
mov dword [ebp - 0xc58], ecx
push eax
push 4
pop edi
mov edx, edi
call fcn.00b84e9a
test eax, eax
js 0xc34333
mov eax, dword [ecx]
neg eax
sbb eax, eax
and eax, dword [ebp - 0xc58]
cmp dword [ecx], edi
jne 0xc34333
cmp dword [eax], 0
jl 0xc34333
xor eax, eax
inc eax
cmp esi, eax
jbe 0xc34333
mov dword [ebp - 0xb98], ecx
mov esi, ebx
mov edi, dword [ecx]
lea eax, [ebp - 0xb98]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc34333
mov ecx, dword [ebp - 0xb98]
lea eax, [ebp - 0xb98]
push eax
mov edx, edi
call fcn.00b84e9a
test eax, eax
js 0xc34333
xor eax, eax
inc esi
inc eax
cmp esi, eax
jae 0xc34333
mov ecx, dword [ebp - 0xb98]
jmp 0xc342ec
mov ebx, dword [ebp - 0xa64]
jmp 0xc3433f
mov ebx, dword [ebp - 0xa64]
mov esi, dword [ebp - 0xa58]
mov eax, dword [ebp - 0xa80]
test eax, eax
je 0xc3435a
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ecx, dword [ebp - 0xca4]
test ecx, ecx
je 0xc34375
push ecx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
je 0xc3438c
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc3438e
xor ebx, ebx
test esi, esi
je 0xc343a1
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ebx, dword [ebp - 0xa4c]
mov eax, dword [ebp - 0xb48]
xor edx, edx
mov dword [ebp - 0xab8], edx
mov dword [ebp - 0xc54], eax
jmp 0xc2aa55
cmp ebx, 0xd00000e5
je 0xc343df
cmp ebx, 0xc004d501
je 0xc343df
cmp ebx, 0xd000003e
jne 0xc343e4
mov ebx, 0xc004f028
jmp 0xc343f5
mov ebx, 0xc004f027
test ebx, ebx
jns 0xc343fd
cmp ebx, 0x8007007a
jne 0xc343f5
mov ebx, 0xc004f01e
mov esi, dword [ebp - 0xc50]
jmp 0xc34410
push 4
pop ecx
cmp dword [ebp - 0xc00], ecx
jne 0xc343f0
mov esi, dword [eax]
mov ebx, dword [ebp - 0xd2c]
test eax, eax
je 0xc3441b
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
test ebx, ebx
jns 0xc34423
xor eax, eax
mov esi, eax
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop esi
setne al
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret