Function at 0x10010ef0
Capabilities:
Create thread
Encode data using xor
Get graphical window text
Set file attributes
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x104]
sub esp, 0x104
push 0xffffffffffffffff
push 0x1002991b
mov eax, dword fs:[0]
push eax
sub esp, 0x178
mov eax, dword [0x10040bd0]
xor eax, ebp
mov dword [ebp + 0x100], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.ucrtbased.dll_malloc]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0x1002e8ec
nop
xor eax, eax
lea ecx, [ecx + ecx*4]
shl ecx, 2
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], ecx
nop
lea eax, [eax + eax*4]
shl eax, 2
push ecx
push eax
call dword [sym.imp.USER32.dll_WindowFromPoint]
push 0xe1
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
call fcn.10026c30
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
add esi, 0x14
cmp byte [edi + 0x13], 0
je 0x10010fc5
mov eax, dword [edi + 0xf]
inc eax
push eax
call ebx
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10010fb9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10010fa0
mov byte [ecx + ebx], 0
mov esi, ebx
mov ebx, dword [sym.imp.ucrtbased.dll_malloc]
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002e908
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011025
mov eax, dword [edi + 0xf]
inc eax
push eax
call ebx
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001101f
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011006
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002e924
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001108f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011089
sub esi, ebx
nop word [eax + eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011070
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002e944
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100110f3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100110ed
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100110d4
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002e964
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011157
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011151
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011138
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002e988
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100111bf
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100111b9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100111a0
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002e9a8
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011223
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001121d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011204
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002e9c4
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011287
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011281
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011268
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002e9e0
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100112ef
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100112e9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100112d0
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002e9fc
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011353
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001134d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011334
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ea18
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100113b7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100113b1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011398
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ea34
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001141f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011419
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011400
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ea50
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011483
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001147d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011464
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ea6c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100114e7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100114e1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100114c8
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ea8c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001154f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011549
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011530
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002eaac
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100115b3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100115ad
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011594
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002eacc
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011617
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011611
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100115f8
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002eae8
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001167f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011679
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011660
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002eb04
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100116e3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100116dd
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100116c4
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002eb20
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011747
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011741
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011728
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002eb3c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100117af
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100117a9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011790
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002eb58
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011813
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001180d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100117f4
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002eb74
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011877
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011871
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011858
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002eb90
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100118df
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100118d9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100118c0
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ebac
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011943
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001193d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011924
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ebc8
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100119a7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100119a1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011988
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ebe4
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011a0f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011a09
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100119f0
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ec00
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011a73
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011a6d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011a54
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ec1c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011ad7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011ad1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011ab8
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ec38
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011b3f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011b39
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011b20
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ec54
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011ba3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011b9d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011b84
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ec70
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011c07
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011c01
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011be8
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ec8c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011c6f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011c69
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011c50
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002eca8
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011cd3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011ccd
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011cb4
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ecc4
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011d37
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011d31
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011d18
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ece4
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011d9f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011d99
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011d80
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ed04
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011e03
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011dfd
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011de4
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ed24
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011e67
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011e61
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011e48
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ed40
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011ecf
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011ec9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011eb0
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ed5c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011f33
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011f2d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011f14
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ed78
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011f97
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011f91
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011f78
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ed94
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011fff
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011ff9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011fe0
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002edb0
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012063
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001205d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012044
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002edcc
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100120c7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100120c1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100120a8
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ede8
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001212f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012129
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012110
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ee04
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012193
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001218d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012174
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ee20
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100121f7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100121f1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100121d8
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ee3c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001225f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012259
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012240
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ee58
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100122c3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100122bd
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100122a4
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ee74
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012327
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012321
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012308
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ee90
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001238f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012389
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012370
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002eeac
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100123f3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100123ed
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100123d4
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002eec8
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012457
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012451
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012438
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002eee4
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100124bf
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100124b9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100124a0
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ef00
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012523
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001251d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012504
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ef1c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012587
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012581
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012568
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ef38
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100125ef
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100125e9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100125d0
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ef54
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012653
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001264d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012634
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ef70
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100126b7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100126b1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012698
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002ef8c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001271f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012719
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012700
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002efa8
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012783
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001277d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012764
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002efc4
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100127e7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100127e1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100127c8
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002efe4
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001284f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012849
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012830
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002f004
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100128b3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100128ad
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012894
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001518c
mov dword [ebp - 0x10], 0x1002f024
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012917
push 0x1002fbf0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [eax + 6], 0xea
jne 0x100151b7
push 1
call edi
cmp dword [0x1004106c], 1
jne 0x10015244
push 1
push 0x40
push 8
push 0x1002fc0c
lea ecx, [ebp - 0x184]
call fcn.10004a10
lea eax, [ebp - 0x184]
mov dword [ebp - 4], 0
push str._nH_Scan:
push eax
call fcn.100045b0
lea eax, [ebp]
push eax
lea eax, [ebp - 0x184]
push eax
call fcn.100045b0
add esp, 0x10
lea ecx, [ebp - 0x180]
call fcn.100054f0
test eax, eax
jne 0x10015232
push eax
mov eax, dword [ebp - 0x184]
lea ecx, [ebp - 0x184]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x184]
mov dword [ebp - 4], 0xffffffff
call fcn.10005000
cmp dword [0x1004107c], 1
jne 0x10015326
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xd4]
mov esi, eax
push 1
push 0x40
push 8
push 0x1002fc30
call fcn.10004a10
lea eax, [ebp - 0xd4]
mov dword [ebp - 4], 1
push 0x1002fc34
push eax
call fcn.100045b0
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.100045b0
lea eax, [ebp - 0xd4]
push str.H_Scan:
push eax
call fcn.100045b0
lea eax, [ebp]
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.100045b0
lea eax, [ebp - 0xd4]
push 0x1002fc54
push eax
call fcn.100045b0
add esp, 0x2c
lea ecx, [ebp - 0xd0]
call fcn.100054f0
test eax, eax
jne 0x1001530e
push eax
mov eax, dword [ebp - 0xd4]
lea ecx, [ebp - 0xd4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x1002fc7c
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xd4]
call fcn.10005000
mov eax, dword [0x10041070]
push 0
cmp eax, 1
jne 0x10015354
push 0
push 0
push 0x10010e30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1001537b
push 0
push 0
push 0x10010db0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x1001538f
push 0
push 0
push 0x10010eb0
jmp 0x1001533b
cmp eax, 4
jne 0x1001534e
push 0
push 0
push 0x10026da0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push 0x1002fc80
lea eax, [ebp]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1001534c