Function at 0xcb79ac
Capabilities:
Encode data using xor
Hide graphical window
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x90
xor ebx, ebx
mov esi, ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [esi + 0x18]
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x408], ebx
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetWindowPos]
mov ecx, esi
call fcn.00cacf52
cmp dword [esi + 0x40], 2
je 0xcb7a01
cmp dword [esi + 0x40], 3
je 0xcb7a01
push 0x40008
jmp 0xcb7a06
push 0x8080028
push 0xffffffffffffffec
push dword [esi + 0x18]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetWindowLongW]
xor eax, eax
mov dword [ebp - 0xc], ebx
lea edi, [ebp - 0x420]
mov word [ebp - 8], bx
stosd dword es:[edi], eax
lea ecx, [esi + 0x48]
lea edx, [esi + 0x9c]
mov dword [ebp - 0x3d8], ecx
mov esi, dword [esi + 0x44]
mov dword [ebp - 0x3f4], edx
stosd dword es:[edi], eax
mov dword [ebp - 0x3dc], esi
mov dword [ebp - 0x3ec], ebx
mov dword [ebp - 0x3e8], ebx
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x404], ebx
lea edi, [ebp - 0x450]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xd0aed4
test ecx, ecx
jne 0xcb7a72
mov ebx, 0x80070057
jmp 0xcb966c
test edx, edx
je 0xcb7a68
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xcb7a76
mov eax, dword [0xd0a150]
test eax, eax
jne 0xcb8141
push 0x338
mov edi, ebx
mov dword [ebp - 0x3bc], ebx
push ebx
mov dword [ebp - 0x3b4], ebx
mov dword [ebp - 0x3c0], edi
mov dword [ebp - 0x3f0], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x3e4], eax
test eax, eax
je 0xcb8133
or dword [ebp - 0x3f8], 0xffffffff
lea esi, [eax + 7]
mov cl, bl
mov dword [ebp - 0x3c4], ebx
mov dword [ebp - 0x3b0], ebx
mov ebx, 0xb2bef2
mov dword [ebp - 0x138], 0xab69605e
mov dword [ebp - 0x134], 0x7f1137f
mov dword [ebp - 0x3cc], ebx
mov dword [ebp - 0x3d0], 0x67
movzx edx, byte [ebx - 2]
movzx eax, byte [ebx - 1]
shl edx, 8
or edx, eax
movzx eax, byte [ebx]
shl edx, 8
or edx, eax
movzx eax, byte [ebx + 1]
movzx ebx, byte [ebx + 2]
shl edx, 8
or edx, eax
shl ebx, 8
mov eax, dword [ebp - 0x3cc]
xor edi, edx
mov dword [ebp - 0x3ac], edi
mov dword [ebp - 0x3b8], edx
movzx eax, byte [eax + 3]
or ebx, eax
mov eax, dword [ebp - 0x3cc]
shl ebx, 8
movzx eax, byte [eax + 4]
or ebx, eax
mov eax, dword [ebp - 0x3cc]
shl ebx, 8
add dword [ebp - 0x3cc], 8
movzx eax, byte [eax + 5]
or ebx, eax
xor edi, ebx
xor edi, dword [ebp - 0x3b0]
xor edi, 0xac987321
lea eax, [edi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, edi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x3ac]
xor eax, edx
mov dword [ebp - 0x3ac], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x3ac]
rol eax, 2
sub edx, eax
xor edi, edx
imul edx, edi, 0x605e
mov eax, edi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x3ac]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x3ac], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x3ac]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor edi, edx
mov edx, edi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x3ac]
xor edx, eax
mov dword [ebp - 0x3ac], edx
mov eax, dword [ebp - 0x3ac]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor edi, edx
lea eax, [edi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, edi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x3ac]
xor eax, edx
mov dword [ebp - 0x3ac], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x3ac]
rol eax, 8
sub edx, eax
xor edi, edx
mov eax, edi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, edi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x3ac]
xor eax, edx
mov dword [ebp - 0x3ac], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x3ac]
shr eax, 0xa
xor edx, eax
xor edi, edx
mov edx, dword [ebp - 0x3ac]
mov eax, edi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0x3ac], edx
lea eax, [edx - 0x7f1]
xor eax, edi
mov edi, dword [ebp - 0x3ac]
xor eax, 0xab69605e
mov dword [ebp - 0x3b0], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x3b0]
shr eax, 2
add edx, eax
xor edi, edx
lea eax, [edi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, edi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x3b0]
xor eax, edx
mov dword [ebp - 0x3b0], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0xab69
rol edi, 7
rol eax, 5
imul eax, eax, 0x7f1
add eax, edi
mov edi, dword [ebp - 0x3b0]
xor edi, eax
mov dword [ebp - 0x3b0], edi
xor edi, edx
mov edx, dword [ebp - 0x3b0]
xor edi, 0xac987321
mov eax, edi
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor edx, eax
mov dword [ebp - 0x3b0], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x3b0]
ror eax, 6
sub edx, eax
xor edi, edx
lea eax, [edi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x3b0]
xor eax, edx
mov dword [ebp - 0x3b0], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x3b0]
ror eax, 0xe
sub edx, eax
xor edi, edx
mov eax, edi
mov dword [ebp - 0x3ac], edi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, edi
mov edi, dword [ebp - 0x3b0]
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
mov dword [ebp - 0x3b0], edi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, edi
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x3ac]
xor edx, dword [ebp - 0x3c4]
xor eax, edx
mov edx, edi
xor edx, dword [ebp - 0x3f8]
mov byte [esi - 4], al
ror eax, 8
mov byte [esi], dl
lea esi, [esi + 8]
ror edx, 8
mov byte [esi - 0xd], al
ror eax, 8
mov byte [esi - 9], dl
ror edx, 8
mov byte [esi - 0xe], al
ror eax, 8
mov byte [esi - 0xa], dl
ror edx, 8
mov byte [esi - 0xf], al
ror eax, 8
mov byte [esi - 0xb], dl
ror edx, 8
sub dword [ebp - 0x3d0], 1
mov dword [ebp - 0x3ac], eax
mov edi, dword [ebp - 0x3ac]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x3f8], ebx
mov ebx, dword [ebp - 0x3cc]
mov dword [ebp - 0x3b0], edx
mov dword [ebp - 0x440], edx
mov dword [ebp - 0x3c4], eax
jne 0xcb7b0c
mov esi, dword [ebp - 0x3dc]
xor eax, eax
mov edi, dword [ebp - 0x3e4]
xor cl, byte [eax + edi]
inc eax
cmp eax, 0x338
jb 0xcb7eb3
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xcb7eea
cmp edx, dword [0xb2c22c]
jne 0xcb7eea
mov ebx, edi
mov dword [ebp - 0x3c4], 0x337
xor eax, eax
mov dword [ebp - 0x3c0], ebx
mov edi, eax
jmp 0xcb7f03
or dword [ebp - 0x3c4], 0xffffffff
xor eax, eax
mov ebx, dword [ebp - 0x3c0]
mov dword [ebp - 0x3f0], 0xc004d501
test edi, edi
je 0xcb7f16
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x3f0], 0
jl 0xcb812d
mov eax, dword [ebp - 0x3c4]
xor ecx, ecx
push 0x40
push ecx
push 0xd0ae80
mov edi, ebx
mov byte [eax + ebx], cl
call fcn.00bc259b
add esp, 0xc
cmp byte [ebx], 0
je 0xcb80bd
mov ebx, 0xd0ae80
mov ecx, edi
mov edx, edi
lea eax, [ecx + 2]
mov dword [ebp - 0x3b8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x408]
jne 0xcb7f5b
sub ecx, dword [ebp - 0x3b8]
xor eax, eax
sar ecx, 1
push ebx
push edx
push eax
lea edi, [edi + ecx*2]
add edi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xcb8126
xor eax, eax
mov ecx, 0x5a4d
mov edx, eax
mov eax, dword [ebx]
mov dword [ebp - 0x3b4], edx
cmp word [eax], cx
je 0xcb7fae
mov edx, 0xc000007b
mov dword [ebp - 0x3b4], edx
jmp 0xcb800a
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xcb7fa1
add ecx, dword [ebx]
cmp ecx, dword [ebx]
jb 0xcb7fa1
cmp dword [ecx], 0x4550
jne 0xcb7fa1
movzx eax, word [ecx + 0x18]
mov dword [ebp - 0x3b8], 0x10b
cmp ax, word [ebp - 0x3b8]
je 0xcb7ff8
mov dword [ebp - 0x3b8], 0x20b
cmp ax, word [ebp - 0x3b8]
je 0xcb7ff8
mov edx, 0xc000000d
jmp 0xcb7fa6
mov eax, dword [ecx + 0x78]
mov dword [ebx + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [ebx + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [ebx + 4], eax
mov eax, dword [edi]
push 4
pop ecx
add edi, ecx
mov dword [ebp - 0x3e0], eax
xor ecx, ecx
mov dword [ebp - 0x3c4], ecx
test eax, eax
je 0xcb80b1
mov dword [ebp - 0x40c], ecx
mov ecx, edi
mov dword [ebp - 0x3e4], edi
lea eax, [ecx + 1]
mov dword [ebp - 0x3b8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xcb803e
sub ecx, dword [ebp - 0x3b8]
inc edi
add edi, ecx
test edx, edx
js 0xcb8088
mov ecx, dword [ebp - 0x3e4]
lea eax, [ebp - 0x40c]
push eax
push ebx
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0x3b4], edx
test edx, edx
js 0xcb80bd
mov eax, dword [ebp - 0x3bc]
mov ecx, dword [ebp - 0x40c]
mov dword [eax*4 + section..data], ecx
jmp 0xcb808e
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp - 0x3c4]
inc eax
push 0
mov dword [ebp - 0x3c4], eax
pop ecx
cmp eax, dword [ebp - 0x3e0]
jb 0xcb8027
add ebx, 0x10
cmp byte [edi], 0
jne 0xcb7f4e
mov ebx, dword [ebp - 0x3b4]
mov edi, dword [ebp - 0x3c0]
test edi, edi
je 0xcb80de
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xcb813a
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xcb80f7
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xcb80e6
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x3dc]
jmp 0xcb8147
mov ebx, 0xc000007a
jmp 0xcb80c3
mov edi, dword [ebp - 0x3c0]
mov ebx, 0xc000007a
jmp 0xcb80c9
mov eax, dword [0xd0a150]
xor ebx, ebx
inc eax
mov dword [0xd0a150], eax
xor eax, eax
mov ecx, 0xd0aed4
xchg dword [ecx], eax
push 0x54
push ebx
push dword [ebp - 0x3d8]
call fcn.00bc259b
mov edi, dword [ebp - 0x3f4]
add esp, 0xc
mov eax, esi
push 0xf
pop ecx
and eax, ecx
mov dword [edi], ebx
mov dword [ebp - 0x3dc], eax
mov eax, esi
shr eax, 4
and eax, ecx
mov word [ebp - 0xc], ax
mov eax, esi
shr esi, 0xc
and esi, ecx
shr eax, 8
push 0x403
and eax, ecx
mov word [ebp - 8], si
mov esi, dword [0xd0807c]
mov ecx, esi
push ebx
push ebx
mov word [ebp - 0xa], ax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x3cc], eax
test eax, eax
jne 0xcb81e2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcb81cd
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
mov edi, 0xd0aed4
js 0xcb966c
mov ebx, 0x80004005
jmp 0xcb966c
mov eax, ebx
mov dword [ebp - 0x3c4], ebx
mov dword [ebp - 0x3d0], eax
mov esi, ebx
lea eax, [ebp - 0x3f8]
mov dword [ebp - 0x3b8], ebx
push eax
push ebx
lea eax, [ebp - 0x3f0]
mov dword [ebp - 0x3f8], ebx
mov edi, ebx
mov dword [ebp - 0x3c0], esi
mov ebx, dword [0xd08050]
mov ecx, ebx
push eax
push 8
mov dword [ebp - 0x3c8], esi
mov dword [ebp - 0x3b4], edi
call dword [0xd0cffc]
call ebx
test eax, eax
jne 0xcb825e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcb824e
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcb83de
mov ebx, 0x80004005
jmp 0xcb8bf3
mov eax, dword [ebp - 0x3f8]
add eax, eax
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0x3ac], ebx
test ebx, ebx
jne 0xcb828d
mov ebx, 0x8007000e
jmp 0xcb8bf3
mov eax, dword [ebp - 0x3f0]
lea eax, [eax*4 + 4]
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x3b0], eax
test eax, eax
je 0xcb895e
mov esi, eax
lea eax, [ebp - 0x3f8]
push eax
push ebx
mov ebx, dword [0xd08050]
lea eax, [ebp - 0x3f0]
push eax
push 8
mov ecx, ebx
call dword [0xd0cffc]
call ebx
test eax, eax
jne 0xcb8305
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcb82f7
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcb82fe
mov ebx, 0x80004005
xor ecx, ecx
jmp 0xcb83af
mov eax, dword [ebp - 0x3b0]
xor ecx, ecx
mov ebx, dword [ebp - 0x3ac]
mov dword [ebp - 0x3bc], eax
mov dword [ebp - 0x3c4], ecx
cmp dword [ebp - 0x3f0], ecx
jbe 0xcb8388
mov edi, eax
mov esi, dword [0xd08058]
push ecx
push ebx
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, ebx
mov dword [edi], eax
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0xcb8344
sub ecx, edx
sar ecx, 1
push 4
pop eax
add edi, eax
mov eax, dword [ebp - 0x3c4]
lea ebx, [ebx + ecx*2]
add ebx, 2
inc eax
push 0
mov dword [ebp - 0x3c4], eax
pop ecx
cmp eax, dword [ebp - 0x3f0]
jb 0xcb8329
mov dword [ebp - 0x3bc], edi
mov edi, dword [ebp - 0x3b4]
mov eax, dword [ebp - 0x3bc]
mov ebx, dword [ebp - 0x3d0]
mov esi, ecx
mov dword [eax], 0x409
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3b0], eax
test esi, esi
je 0xcb83c2
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0x3c0]
push dword [ebp - 0x3ac]
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xcb8bf3
xor ecx, ecx
mov eax, ecx
mov ebx, ecx
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3b0], eax
jbe 0xcb8429
mov eax, dword [ebp - 0x3c4]
mov edx, ecx
mov ecx, dword [eax + ebx*4]
cmp ecx, dword [edx*4 + 0xb40a18]
je 0xcb8968
inc edx
cmp edx, 0x26
jb 0xcb8402
inc ebx
xor ecx, ecx
cmp ebx, dword [ebp - 0x3b0]
jb 0xcb8400
mov eax, dword [ebp - 0x3bc]
mov ebx, dword [0xd08054]
push ecx
mov dword [ebp - 0x3e4], ecx
lea ecx, [ebp - 0xc0]
push 0x55
push ecx
push dword [eax*4 + 0xb40a18]
mov ecx, ebx
call dword [0xd0cffc]
call ebx
test eax, eax
je 0xcb848c
mov ebx, dword [0xd08048]
lea eax, [ebp - 0x2c8]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xc0]
mov ecx, ebx
push eax
call dword [0xd0cffc]
call ebx
test eax, eax
jle 0xcb848c
mov eax, dword [ebp - 0x2bc]
shr eax, 0x1b
and eax, 1
mov dword [ebp - 0x3e4], eax
xor eax, eax
mov edx, 0xb2fcd8
mov ebx, eax
mov ecx, edx
mov dword [ebp + ebx*4 - 0x128], edx
lea eax, [ecx + 2]
mov dword [ebp - 0x3e0], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x408]
jne 0xcb84a7
sub ecx, dword [ebp - 0x3e0]
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc ebx
cmp ebx, 0x13
jb 0xcb8495
imul ecx, dword [ebp - 0x3bc], 3
movzx eax, byte [ecx + 0xb320b0]
mov eax, dword [ebp + eax*4 - 0x128]
mov dword [ebp - 0x420], eax
movzx eax, byte [ecx + 0xb320b1]
mov eax, dword [ebp + eax*4 - 0x128]
mov dword [ebp - 0x41c], eax
movzx eax, byte [ecx + 0xb320b2]
mov eax, dword [ebp + eax*4 - 0x128]
mov dword [ebp - 0x418], eax
xor ebx, ebx
push 0x1c90
mov eax, ebx
push ebx
mov dword [ebp - 0x3d0], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x3d4], ecx
test ecx, ecx
je 0xcb8283
or dword [ebp - 0x414], 0xffffffff
lea edi, [ecx + 7]
mov al, bl
mov dword [ebp - 0x130], 0xab69605e
mov dword [ebp - 0x12c], 0x7f1137f
mov esi, 0xb40ac2
mov dword [ebp - 0x410], ebx
mov dword [ebp - 0x3b0], ebx
mov dword [ebp - 0x3ac], ebx
mov dword [ebp - 0x3e0], 0x392
movzx ebx, byte [esi - 2]
movzx ecx, byte [esi - 1]
movzx edx, byte [esi + 2]
shl ebx, 8
or ebx, ecx
shl edx, 8
movzx ecx, byte [esi]
lea esi, [esi + 8]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi - 7]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi - 5]
or edx, ecx
mov dword [ebp - 0x424], ebx
movzx ecx, byte [esi - 4]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi - 3]
shl edx, 8
or edx, ecx
mov ecx, dword [ebp - 0x3ac]
xor ecx, ebx
mov dword [ebp - 0x400], edx
mov dword [ebp - 0x3ac], ecx
mov ebx, edx
xor ebx, dword [ebp - 0x3b0]
xor ebx, ecx
xor ebx, 0xac987321
lea ecx, [ebx + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, ebx
rol ecx, 0xa
add edx, ecx
mov ecx, dword [ebp - 0x3ac]
xor ecx, edx
mov dword [ebp - 0x3ac], ecx
add ecx, 0x7f1137f
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0x3ac]
rol ecx, 2
sub edx, ecx
xor ebx, edx
imul edx, ebx, 0x605e
mov ecx, ebx
shr ecx, 0xd
sub edx, ecx
mov ecx, dword [ebp - 0x3ac]
sub edx, 0x756c8a2
xor ecx, edx
mov dword [ebp - 0x3ac], ecx
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0x3ac]
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor ebx, edx
mov edx, ebx
xor edx, 0xab69605e
sub ecx, edx
mov edx, dword [ebp - 0x3ac]
xor edx, ecx
mov dword [ebp - 0x3ac], edx
mov ecx, dword [ebp - 0x3ac]
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor ebx, edx
lea ecx, [ebx + 0x7f1137f]
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, ebx
rol ecx, 2
add edx, ecx
mov ecx, dword [ebp - 0x3ac]
xor ecx, edx
mov dword [ebp - 0x3ac], ecx
add ecx, 0x54969fa2
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0x3ac]
rol ecx, 8
sub edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0xab69605e
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, ebx
ror ecx, 0xa
xor edx, ecx
mov ecx, dword [ebp - 0x3ac]
xor ecx, edx
mov dword [ebp - 0x3ac], ecx
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0x3ac]
shr ecx, 0xa
xor edx, ecx
xor ebx, edx
mov edx, dword [ebp - 0x3ac]
mov ecx, ebx
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor edx, ecx
mov dword [ebp - 0x3ac], edx
lea ecx, [edx - 0x7f1]
xor ecx, ebx
mov ebx, dword [ebp - 0x3ac]
xor ecx, 0xab69605e
mov dword [ebp - 0x3b0], ecx
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0x3b0]
shr ecx, 2
add edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, ebx
rol ecx, 7
add edx, ecx
mov ecx, dword [ebp - 0x3b0]
xor ecx, edx
mov dword [ebp - 0x3b0], ecx
mov edx, ecx
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0xab69
rol ecx, 5
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 7
add edx, ecx
xor dword [ebp - 0x3b0], edx
mov edx, dword [ebp - 0x3b0]
xor ebx, edx
xor ebx, 0xac987321
mov ecx, ebx
ror ecx, 3
sub ecx, 0xab69
imul ecx, ecx, 0x137f
xor edx, ecx
mov dword [ebp - 0x3b0], edx
lea ecx, [edx - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0x3b0]
ror ecx, 6
sub edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 0xe
add edx, ecx
mov ecx, dword [ebp - 0x3b0]
xor ecx, edx
mov dword [ebp - 0x3b0], ecx
add ecx, 0xab69605e
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0x3b0]
ror ecx, 0xe
sub edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, ebx
shr ecx, 3
xor edx, ecx
mov ecx, dword [ebp - 0x3b0]
xor ecx, edx
mov dword [ebp - 0x3b0], ecx
xor ecx, 0x7f1137f
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0x3b0]
rol ecx, 2
xor edx, ecx
mov ecx, dword [ebp - 0x3b0]
xor ecx, dword [ebp - 0x414]
xor edx, dword [ebp - 0x410]
mov byte [edi], cl
xor ebx, edx
ror ecx, 8
lea edi, [edi + 8]
mov byte [edi - 9], cl
ror ecx, 8
mov byte [edi - 0xc], bl
ror ebx, 8
mov byte [edi - 0xa], cl
ror ecx, 8
mov byte [edi - 0xd], bl
ror ebx, 8
mov byte [edi - 0xb], cl
ror ecx, 8
mov byte [edi - 0xe], bl
ror ebx, 8
mov dword [ebp - 0x3b0], ecx
mov dword [ebp - 0x3fc], ecx
mov ecx, dword [ebp - 0x424]
mov byte [edi - 0xf], bl
ror ebx, 8
sub dword [ebp - 0x3e0], 1
mov dword [ebp - 0x410], ecx
mov ecx, dword [ebp - 0x400]
mov dword [ebp - 0x3ac], ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x414], ecx
jne 0xcb857b
mov edi, dword [ebp - 0x3b4]
xor ecx, ecx
mov esi, dword [ebp - 0x3c0]
mov edx, ecx
mov ecx, dword [ebp - 0x3d4]
mov ebx, 0x1c90
xor al, byte [edx + ecx]
inc edx
cmp edx, ebx
jb 0xcb8922
movzx eax, al
cdq
cmp eax, dword [0xb42750]
jne 0xcb8977
cmp edx, dword [0xb42754]
jne 0xcb8977
mov esi, ecx
mov dword [ebp - 0x3b8], ebx
mov ebx, dword [ebp - 0x3d0]
xor edx, edx
mov dword [ebp - 0x3c0], esi
mov ecx, edx
mov dword [ebp - 0x3c8], esi
jmp 0xcb8984
mov ebx, 0x8007000e
jmp 0xcb83c8
mov eax, edx
xor ecx, ecx
mov dword [ebp - 0x3bc], eax
jmp 0xcb8429
mov ebx, 0xc004d501
xor edx, edx
mov dword [ebp - 0x3d0], ebx
test ecx, ecx
je 0xcb8997
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xcb8bd9
mov ebx, dword [ebp - 0x3bc]
xor eax, eax
mov edi, esi
mov esi, eax
mov edx, eax
cmp ebx, edx
jne 0xcb89b8
mov dword [ebp + esi*4 - 0xd8], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0x3d4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xcb89c3
sub ecx, dword [ebp - 0x3d4]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0xcb89ad
inc esi
push 0
pop eax
cmp esi, 6
jb 0xcb89ab
push 0xc
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, dword [ebp - 0x3d0]
mov edx, eax
mov dword [ebp - 0x3e0], edx
test edx, edx
jne 0xcb8a18
xor edx, edx
mov ebx, 0x8007000e
mov edi, edx
mov esi, dword [ebp - 0x3c0]
jmp 0xcb8bdb
mov edi, edx
xor eax, eax
mov esi, edx
mov dword [ebp - 0x3b4], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x3bc], eax
movzx edx, word [ebp + ecx*2 - 0xc]
cmp dx, word [eax*2 + 0xb40ab0]
je 0xcb8a4b
inc eax
cmp eax, 6
jb 0xcb8a36
jmp 0xcb8b0e
mov edx, dword [ebp + eax*4 - 0xd8]
mov ecx, edx
mov dword [ebp - 0x3d4], edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xcb8a5d
xor eax, eax
sub ecx, edi
mov edi, dword [0xd08060]
push eax
push eax
lea eax, [ecx + 1]
mov ecx, edi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0xd0cffc]
call edi
mov dword [ebp - 0x400], eax
test eax, eax
je 0xcb8b4e
lea ecx, [eax + eax]
xor eax, eax
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0x3bc]
mov edi, eax
mov eax, dword [ebp - 0x3e0]
mov dword [eax + ecx*4], edi
test edi, edi
je 0xcb8b47
mov edx, dword [ebp - 0x3d4]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x3d4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xcb8ad3
push dword [ebp - 0x400]
sub ecx, dword [ebp - 0x3d4]
push edi
mov edi, dword [0xd08060]
lea eax, [ecx + 1]
mov ecx, edi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0xd0cffc]
call edi
test eax, eax
je 0xcb8b4e
mov ecx, dword [ebp - 0x3bc]
inc ecx
mov dword [ebp - 0x3bc], ecx
push 0
pop eax
cmp ecx, 3
jb 0xcb8a31
mov eax, dword [ebp - 0x3e0]
xor edx, edx
mov ecx, dword [ebp - 0x3e4]
mov esi, edx
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x3b4], esi
mov dword [eax], ecx
jmp 0xcb8b6e
mov ebx, 0x8007000e
jmp 0xcb8b6c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcb8b65
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcb8b6c
mov ebx, 0x80004005
xor edx, edx
test esi, esi
je 0xcb8cc2
mov edi, edx
mov edx, dword [esi + edi*4]
test edx, edx
je 0xcb8bc7
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x3d4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x408]
jne 0xcb8b8a
sub ecx, dword [ebp - 0x3d4]
xor eax, eax
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xcb8bb6
mov byte [edx], al
inc edx
sub ecx, 1
jne 0xcb8bae
push dword [esi + edi*4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
inc edi
cmp edi, 3
jb 0xcb8b78
mov edi, dword [ebp - 0x3b4]
mov esi, dword [ebp - 0x3c0]
xor edx, edx
test esi, esi
je 0xcb8bf3
mov ecx, dword [ebp - 0x3b8]
mov eax, esi
test ecx, ecx
je 0xcb8bf3
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0xcb8beb
test edi, edi
je 0xcb8c08
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
je 0xcb8c1d
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x3c4]
test eax, eax
je 0xcb8c38
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xcb964e
mov eax, dword [ebp - 0x404]
mov edi, dword [ebp - 0x3d8]
mov esi, dword [0xd080b4]
mov dword [ebp - 0x434], 0xc
mov ecx, dword [eax]
mov dword [edi + 8], ecx
mov ecx, dword [eax + 4]
mov dword [edi + 0xc], ecx
xor ecx, ecx
mov eax, dword [eax + 8]
mov ebx, ecx
push ecx
mov dword [edi + 0x10], eax
lea eax, [ebp - 0x434]
push eax
push ecx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x3b8], ecx
mov ecx, esi
push 0x42
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcb8ccd
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcb8cb3
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
mov eax, dword [ebp - 0x3b8]
js 0xcb8cd6
mov ebx, 0x80004005
jmp 0xcb8cd6
mov edi, dword [ebp - 0x3b4]
jmp 0xcb8a0d
mov eax, dword [ebp - 0x430]
and eax, 1
mov dword [edi + 4], eax
test ebx, ebx
js 0xcb964e
mov ebx, dword [ebp - 0x3dc]
mov eax, ebx
push 0xb
pop edx
push 0x2a
pop ecx
mov dword [ebp - 0x3bc], ecx
sub eax, 1
je 0xcb8d23
sub eax, 1
je 0xcb8d17
sub eax, 1
jne 0xcb8d2f
mov eax, 0xe1
mov dword [ebp - 0x3ec], eax
mov dword [ebp - 0x3e8], eax
jmp 0xcb8d2f
mov dword [ebp - 0x3ec], 0xf
jmp 0xcb8d29
mov dword [ebp - 0x3ec], ecx
mov dword [ebp - 0x3e8], edx
mov esi, 0xdc
mov dword [ebp - 0x3b4], 0x60
xor eax, eax
push esi
push eax
lea eax, [ebp - 0x3a8]
push eax
call fcn.00bc259b
add esp, 0xc
mov word [ebp - 0x364], si
mov esi, dword [0xd08070]
lea eax, [ebp - 0x3a8]
mov ecx, esi
push eax
push 0xffffffffffffffff
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcb8dac
mov ecx, dword [ebp - 0x2fc]
movzx eax, word [ebp - 0x302]
mov dword [ebp - 0x3c4], ecx
mov ecx, dword [ebp - 0x2f8]
push 0x60
mov dword [ebp - 0x3e4], ecx
pop ecx
mov dword [ebp - 0x3b4], eax
cmp eax, ecx
jae 0xcb8dc4
mov dword [ebp - 0x3b4], ecx
jmp 0xcb8dc4
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x3c4], eax
cmp ebx, 1
jne 0xcb8dd7
mov esi, dword [ebp - 0x420]
mov dword [ebp - 0x3b8], esi
jmp 0xcb8de3
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x3b8], eax
push 0x5c
xor ebx, ebx
lea eax, [ebp - 0x1e8]
push ebx
lea esi, [edi + 0x14]
push eax
mov dword [ebp - 0x3d4], esi
call fcn.00bc259b
add esp, 0xc
test esi, esi
jne 0xcb8e0e
mov ebx, 0x80070057
jmp 0xcb964e
mov esi, dword [0xd0807c]
xor eax, eax
push 0x403
push eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x3c8], eax
test eax, eax
jne 0xcb8e58
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcb8e48
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcb8efa
mov ebx, 0x80004005
jmp 0xcb964e
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0x3b4]
push dword [ebp - 0x3ec]
call dword [0xd0cffc]
call esi
push dword [ebp - 0x3b8]
neg eax
mov dword [ebp - 0x1d8], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x1cc]
mov dword [ebp - 0x1e8], eax
mov byte [ebp - 0x1ce], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x1e8]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcb8ede
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcb8ed5
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcb8ee1
mov ebx, 0x80004005
jmp 0xcb8ee1
mov dword [edi + 0x14], eax
push dword [ebp - 0x3c8]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xcb964e
cmp dword [ebp - 0x3dc], 1
jne 0xcb8f19
mov esi, dword [ebp - 0x420]
mov dword [ebp - 0x3b8], esi
jmp 0xcb8f25
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x3b8], eax
push 0x5c
xor ebx, ebx
lea eax, [ebp - 0x248]
push ebx
push eax
lea esi, [edi + 0x18]
call fcn.00bc259b
add esp, 0xc
test esi, esi
je 0xcb8e04
mov esi, dword [0xd0807c]
xor eax, eax
push 0x403
push eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x3c8], eax
test eax, eax
jne 0xcb8f89
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcb8f7e
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcb902b
jmp 0xcb8e4e
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0x3b4]
push dword [ebp - 0x3e8]
call dword [0xd0cffc]
call esi
push dword [ebp - 0x3b8]
neg eax
mov dword [ebp - 0x238], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x248], eax
mov byte [ebp - 0x22e], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x248]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcb900f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcb9006
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcb9012
mov ebx, 0x80004005
jmp 0xcb9012
mov dword [edi + 0x18], eax
push dword [ebp - 0x3c8]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xcb964e
mov ecx, dword [ebp - 0x3dc]
xor ebx, ebx
mov edx, ecx
mov eax, ebx
mov esi, ebx
sub edx, 1
je 0xcb9050
sub edx, 1
je 0xcb908c
sub edx, 1
jne 0xcb905c
mov eax, dword [ebp - 0x3c4]
mov esi, dword [ebp - 0x3e4]
mov edx, dword [ebp - 0x3f4]
mov dword [edx + 8], eax
mov dword [edx + 0xc], esi
cmp ecx, 1
je 0xcb90c8
jbe 0xcb909c
cmp ecx, 3
ja 0xcb909c
mov ecx, ebx
mov dword [ebp - 0x3bc], ebx
mov edx, ebx
mov dword [ebp - 0x3e8], ecx
mov dword [ebp - 0x3ec], ebx
jmp 0xcb90df
mov eax, dword [ebp - 0x3c4]
push 4
pop esi
cdq
idiv esi
mov esi, ebx
jmp 0xcb905c
mov ecx, dword [ebp - 0x3fc]
mov edx, dword [ebp - 0x3fc]
mov dword [ebp - 0x3ec], ecx
mov ecx, dword [ebp - 0x3fc]
mov dword [ebp - 0x3bc], ecx
mov ecx, dword [ebp - 0x3fc]
mov dword [ebp - 0x3e8], ecx
jmp 0xcb90df
mov edx, 0x96
mov dword [ebp - 0x3e8], ebx
mov ecx, ebx
mov dword [ebp - 0x3ec], 0x20
mov dword [ebp - 0x3d0], edx
mov esi, dword [0xd0803c]
sub eax, edx
sub eax, ecx
mov ecx, esi
mov dword [edi + 0x3c], eax
mov dword [edi + 0x2c], eax
mov edi, dword [edi + 8]
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp - 0x3d4]
push dword [eax]
push dword [ebp - 0x3cc]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor ecx, ecx
push ecx
mov dword [ebp - 0x3c8], eax
mov ecx, esi
mov eax, dword [ebp - 0x3d8]
push 0xc50
add eax, 0x24
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0x3cc]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcb9151
mov ebx, 0x80004005
mov eax, dword [ebp - 0x3c8]
test eax, eax
je 0xcb916d
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xcb964e
mov eax, dword [ebp - 0x3d8]
xor ecx, ecx
mov esi, dword [0xd0803c]
mov ebx, ecx
mov ecx, esi
push dword [eax + 0x18]
mov edi, dword [eax + 0xc]
push dword [ebp - 0x3cc]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor ecx, ecx
push ecx
mov dword [ebp - 0x3c8], eax
mov ecx, esi
mov eax, dword [ebp - 0x3d8]
push 0xc50
add eax, 0x34
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0x3cc]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcb91d6
mov ebx, 0x80004005
mov eax, dword [ebp - 0x3c8]
test eax, eax
je 0xcb91f2
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xcb964e
mov eax, dword [ebp - 0x3dc]
cmp eax, 2
je 0xcb920a
cmp eax, 3
jne 0xcb9229
mov edi, dword [ebp - 0x3d8]
mov ebx, dword [edi + 0x2c]
mov dword [ebp - 0x3c0], ebx
cmp ebx, dword [edi + 0x3c]
jg 0xcb9235
mov ebx, dword [edi + 0x3c]
mov dword [ebp - 0x3c0], ebx
jmp 0xcb9235
mov edi, dword [ebp - 0x3d8]
mov ebx, dword [ebp - 0x3c0]
mov esi, dword [0xd080a8]
xor eax, eax
mov ecx, esi
push dword [ebp - 0x3bc]
cmp dword [edi], eax
je 0xcb9279
mov eax, dword [ebp - 0x3e8]
sub eax, dword [edi + 0x2c]
add eax, ebx
push eax
lea eax, [edi + 0x24]
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [edi + 0x30]
add eax, dword [ebp - 0x3ec]
push eax
mov eax, dword [ebp - 0x3e8]
sub eax, dword [edi + 0x3c]
add eax, ebx
push eax
jmp 0xcb929b
push dword [ebp - 0x3d0]
lea eax, [edi + 0x24]
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [edi + 0x30]
add eax, dword [ebp - 0x3ec]
push eax
push dword [ebp - 0x3d0]
mov esi, dword [0xd080a8]
lea eax, [edi + 0x34]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, dword [ebp - 0x3dc]
cmp ecx, 2
je 0xcb9559
cmp ecx, 3
je 0xcb9559
cmp ecx, 1
jne 0xcb956f
push 0x5c
xor ebx, ebx
mov dword [edi + 0x20], 0xffffff
lea eax, [ebp - 0x2a8]
push ebx
lea esi, [edi + 0x1c]
push eax
mov dword [ebp - 0x3d4], esi
call fcn.00bc259b
add esp, 0xc
test esi, esi
je 0xcb8e04
mov esi, dword [0xd0807c]
xor eax, eax
push 0x403
push eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x3c8], eax
test eax, eax
jne 0xcb9341
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcb9336
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcb93df
jmp 0xcb8e4e
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0x3b4]
push 0xb
call dword [0xd0cffc]
call esi
push dword [ebp - 0x41c]
neg eax
mov dword [ebp - 0x298], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x28c]
mov dword [ebp - 0x2a8], eax
mov byte [ebp - 0x28e], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x2a8]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcb93c3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcb93ba
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcb93c6
mov ebx, 0x80004005
jmp 0xcb93c6
mov dword [edi + 0x1c], eax
push dword [ebp - 0x3c8]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xcb964e
mov eax, dword [ebp - 0x3c0]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [edi + 0x4c], eax
xor eax, eax
mov edi, dword [edi + 0x10]
mov ebx, eax
mov eax, dword [ebp - 0x3d4]
push dword [eax]
push dword [ebp - 0x3cc]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor ecx, ecx
push ecx
mov dword [ebp - 0x3c8], eax
mov ecx, esi
mov eax, dword [ebp - 0x3d8]
push 0x460
add eax, 0x44
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0x3cc]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcb9450
mov ebx, 0x80004005
mov eax, dword [ebp - 0x3c8]
test eax, eax
je 0xcb946c
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xcb964e
mov edi, dword [ebp - 0x3d8]
push 0x5a
pop ecx
mov eax, dword [edi + 0x4c]
add eax, 0x18
mov dword [edi + 0x4c], eax
cmp eax, ecx
jl 0xcb948c
mov ecx, eax
mov esi, dword [0xd0805c]
lea ebx, [edi + 0x44]
push 0x60
push dword [ebp - 0x3b4]
mov dword [edi + 0x4c], ecx
mov ecx, esi
mov dword [edi + 0x50], 0x20
push dword [ebx]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x60
push dword [ebp - 0x3b4]
mov dword [ebx], eax
push dword [ebx + 4]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x60
push dword [ebp - 0x3b4]
mov dword [ebx + 4], eax
push dword [ebx + 8]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x60
push dword [ebp - 0x3b4]
mov dword [ebx + 8], eax
push dword [ebx + 0xc]
call dword [0xd0cffc]
call esi
mov dword [ebx + 0xc], eax
xor eax, eax
cmp dword [edi], eax
je 0xcb9541
mov ecx, dword [edi + 0x24]
cmp ecx, dword [edi + 0x34]
jl 0xcb9520
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x40]
add eax, 0x24
mov esi, dword [0xd080a8]
push eax
push ecx
push ebx
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, dword [ebp - 0x3dc]
jmp 0xcb956f
mov ecx, dword [edi + 0x2c]
cmp ecx, dword [edi + 0x3c]
jg 0xcb954c
mov ecx, dword [edi + 0x3c]
mov eax, dword [edi + 0x40]
sub ecx, dword [edi + 0x4c]
add eax, 0x24
add ecx, dword [ebx]
jmp 0xcb9526
mov edx, dword [ebp - 0x3f4]
mov dword [edx + 8], ebx
mov eax, dword [edi + 0x40]
mov dword [edx + 0xc], eax
mov dword [edi + 0x20], 0xffa8a8a8
mov eax, dword [edi]
mov edi, dword [ebp - 0x3f4]
mov dword [ebp - 0x3c8], eax
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov dword [ebp - 0x3b8], eax
sub ecx, 1
je 0xcb97f3
sub ecx, 1
je 0xcb972d
sub ecx, 1
jne 0xcb964c
mov esi, dword [0xd080a4]
lea edi, [ebp - 0x188]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push 1
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08084]
lea ecx, [ebp - 0x188]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x188], 0x28
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcb964c
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x174]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x16c]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x16c]
sub eax, ebx
mov edi, dword [ebp - 0x3f4]
imul eax, eax, 0x32
push 0x64
pop ecx
cdq
idiv ecx
mov dword [edi], eax
mov eax, dword [ebp - 0x168]
sub eax, dword [ebp - 0x3b8]
imul eax, eax, 0x32
cdq
idiv ecx
mov dword [edi + 4], eax
xor ebx, ebx
push dword [ebp - 0x3cc]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov edi, 0xd0aed4
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xcb966c
mov eax, dword [0xd0a150]
test eax, eax
jle 0xcb96cf
sub eax, 1
mov dword [0xd0a150], eax
jne 0xcb96cf
xor eax, eax
mov edi, eax
mov eax, dword [edi + 0xd0ae80]
test eax, eax
je 0xcb96a1
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xcb9690
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xd0aed4
xor eax, eax
xchg dword [edi], eax
mov eax, dword [ebp - 0x404]
test eax, eax
je 0xcb96ee
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xcb9899
mov esi, dword [ebp - 0x428]
mov ecx, esi
call fcn.00cacca3
mov ebx, eax
test ebx, ebx
js 0xcb9899
cmp dword [esi + 0x40], 2
je 0xcb97ff
cmp dword [esi + 0x40], 3
je 0xcb97ff
mov ecx, esi
call fcn.00cb18df
jmp 0xcb9806
mov esi, dword [0xd080a4]
lea edi, [ebp - 0x160]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push 1
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08084]
lea ecx, [ebp - 0x160]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x160], 0x28
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcb964c
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x14c]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x144]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0x3c8], 0
mov edi, dword [ebp - 0x3f4]
push 0x64
pop ecx
je 0xcb97cf
imul eax, dword [ebp - 0x144], 5
cdq
idiv ecx
add eax, dword [ebp - 0x14c]
jmp 0xcb97dd
mov eax, dword [ebp - 0x144]
sub eax, ebx
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [edi], eax
mov eax, dword [ebp - 0x140]
sub eax, dword [ebp - 0x3b8]
imul eax, eax, 0x5f
jmp 0xcb9646
xor ebx, ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
jmp 0xcb964e
mov ecx, esi
call fcn.00cb195f
mov ebx, eax
test ebx, ebx
jns 0xcb982b
test byte [0xd0a5c4], 4
je 0xcb9899
push ebx
mov edx, 0xb3dd20
mov ecx, 0xd08200
call fcn.00b8eed4
jmp 0xcb9899
cmp byte [esi + 0xad], 0
mov byte [esi + 0xae], 1
je 0xcb9892
cmp dword [esi + 0x40], 2
je 0xcb987e
cmp dword [esi + 0x40], 3
je 0xcb987e
cmp dword [esi + 0x40], 1
jne 0xcb9892
push 5
push dword [esi + 0x18]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_ShowWindow]
push dword [esi + 0x18]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetFocus]
cmp byte [esi + 0xac], 0
je 0xcb9892
xor eax, eax
push eax
push eax
push 0x402
push dword [esi + 0x1c]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
jmp 0xcb9892
mov ecx, esi
call fcn.00cb65b1
mov ebx, eax
test ebx, ebx
setns al
mov byte [esi + 0xad], al
mov ecx, esi
call fcn.00cb64f1
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret