Function at 0x10006f42
Capabilities:
Check for time delay via gettickcount
Copy file
Delete file
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa54
push ebx
mov ebx, dword [ebp + 0x18]
and dword [ebp - 0xa8], 0
push esi
lea eax, [ebx + 0x59a]
push edi
mov dword [0x1003d288], eax
lea eax, [ebp - 0xc0]
mov dword [0x1003d284], eax
call fcn.10009a9a
mov ecx, dword [ebp - 0xc0]
test eax, eax
mov dword [0x1003d394], ecx
mov dword [ebp - 0x14], ecx
jne 0x10009a95
cmp dword [0x1003d474], eax
jne 0x10006f9a
mov eax, dword [ebx + 0x2e]
mov dword [0x1003d474], eax
mov eax, dword [ebx + 0x2e]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp eax, 0x100
jne 0x10006fed
lea eax, [edi + esi]
push eax
call fcn.10004726
test eax, eax
pop ecx
jne 0x10006fca
lea eax, [edi + esi]
push eax
call fcn.1000480c
test eax, eax
pop ecx
je 0x100070d0
push dword [ebx + 0x26]
push dword [ebx + 0x22]
push dword [ebx + 0x1e]
push dword [ebx]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.1000493c
add esp, 0x18
cmp eax, 0xea98
jmp 0x100070bb
cmp eax, 0x600
jne 0x10007037
lea eax, [edi + esi]
push eax
call fcn.10004726
test eax, eax
pop ecx
jne 0x10007014
lea eax, [edi + esi]
push eax
call fcn.1000480c
test eax, eax
pop ecx
je 0x100070d0
push dword [ebx + 0x26]
push dword [ebx + 0x22]
push dword [ebx + 0x1e]
push dword [ebx]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.10004b7d
add esp, 0x18
cmp eax, 0xeaa0
jmp 0x100070bb
cmp eax, 0x700
jne 0x1000707a
lea eax, [edi + esi]
push eax
call fcn.10004726
test eax, eax
pop ecx
jne 0x1000705a
lea eax, [edi + esi]
push eax
call fcn.1000480c
test eax, eax
pop ecx
je 0x100070d0
push dword [ebx + 0x26]
push dword [ebx + 0x22]
push dword [ebx + 0x1e]
push dword [ebx]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.10004dbe
add esp, 0x18
cmp eax, 0xeaa2
jmp 0x100070bb
cmp eax, 0xb00
jne 0x100070d0
lea eax, [edi + esi]
push eax
call fcn.10004726
test eax, eax
pop ecx
jne 0x1000709d
lea eax, [edi + esi]
push eax
call fcn.1000480c
test eax, eax
pop ecx
je 0x100070d0
push dword [ebx + 0x26]
push dword [ebx + 0x22]
push dword [ebx + 0x1e]
push dword [ebx]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.10004fff
add esp, 0x18
cmp eax, 0xeaa3
jne 0x10009a95
push 0
push 0
push dword [ebp + 0x10]
call fcn.1000f261
add esp, 0xc
lea edx, [edi + esi]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [ebp - 0x654]
sub edi, ecx
mov eax, ecx
mov dword [ebp + 0xc], esi
mov esi, edi
mov edi, dword [ebp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push dword [ebx + 0x2e]
mov ecx, eax
and ecx, 3
mov dword [ebp - 0xac], edx
rep movsb byte es:[edi], byte [esi]
push edx
call fcn.10004769
cmp dword [ebx + 0xc], 0
mov dword [ebp - 0x1c], eax
setne al
mov byte [ebp + 0xc], al
lea eax, [ebp - 0x1dc]
push eax
lea eax, [ebp - 0x314]
push eax
push dword [ebp + 0x10]
call fcn.10002d38
add esp, 0x14
test eax, eax
jne 0x10009a95
mov eax, dword [ebp - 0x168]
push 0x3e
pop ecx
lea esi, [ebp - 0x1dc]
lea eax, [eax*8 - 0x80]
push 1
push eax
lea edi, [ebp - 0x2d4]
push dword [ebp + 0x10]
rep movsd dword es:[edi], dword [esi]
call fcn.1000f261
movzx eax, word [ebp - 0x1d6]
inc eax
lea eax, [eax + eax*4]
shl eax, 3
push eax
call fcn.1000f1d5
mov esi, eax
add esp, 0x10
test esi, esi
mov dword [ebp - 0x20], esi
jne 0x1000718c
mov eax, 0xeab0
jmp 0x10009a95
push dword [ebp + 0x10]
call fcn.1000f31a
movzx eax, word [ebp - 0x1d6]
push dword [ebp + 0x10]
movzx edi, word [ebp - 0x1d6]
push eax
push 0x28
push esi
call fcn.1000461a
add esp, 0x14
cmp eax, edi
je 0x100071bf
mov eax, 0xea70
jmp 0x10009a95
xor edx, edx
xor ecx, ecx
cmp edi, edx
jle 0x100071ea
lea eax, [esi + 0x10]
cmp dword [eax + 4], edx
jne 0x100071d1
mov dword [eax], edx
cmp dword [eax - 8], edx
jne 0x100071db
mov edi, dword [eax]
mov dword [eax - 8], edi
movzx edi, word [ebp - 0x1d6]
inc ecx
add eax, 0x28
cmp ecx, edi
jl 0x100071ca
movzx eax, word [ebp - 0x1d6]
mov edi, dword [ebp - 0x1a4]
xor edx, edx
lea eax, [eax + eax*4]
lea ecx, [esi + eax*8]
mov eax, dword [esi + eax*8 - 0x20]
add eax, dword [ecx - 0x1c]
lea eax, [eax + edi - 1]
div edi
xor edx, edx
imul eax, edi
mov dword [ecx + 0xc], eax
mov edi, dword [ebp - 0x1a0]
movzx eax, word [ebp - 0x1d6]
lea eax, [eax + eax*4]
lea ecx, [esi + eax*8]
mov eax, dword [esi + eax*8 - 0x18]
add eax, dword [ecx - 0x14]
lea eax, [eax + edi - 1]
div edi
imul eax, edi
mov dword [ecx + 0x14], eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x1dc]
push esi
push eax
push dword [ebp + 0x10]
call fcn.10002bbf
add esp, 0x14
test eax, eax
jne 0x10009a95
push 0x14
call fcn.1000f1d5
test eax, eax
pop ecx
mov dword [ebp - 0x74], eax
jne 0x10007279
mov eax, 0xeab1
jmp 0x10009a95
and dword [eax + 0x10], 0
push 0x14
call fcn.1000f1d5
test eax, eax
pop ecx
mov dword [ebp - 0x40], eax
jne 0x10007296
mov eax, 0xeab2
jmp 0x10009a95
mov edi, dword [ebp - 0x40]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push dword [ebx + 0x2e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x1dc]
push esi
push eax
push dword [ebp + 0x10]
call fcn.100037c7
push dword [ebx + 0x2e]
lea eax, [ebp - 0x24]
push dword [ebp + 0xc]
push dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push dword [ebp - 0x74]
push eax
lea eax, [ebp - 0x1dc]
push dword [ebp - 0xb0]
push dword [ebp - 0x6c]
push esi
push eax
push dword [ebp + 0x10]
call fcn.100027f9
add esp, 0x44
cmp eax, 0xea6c
jne 0x10007323
push dword [ebp - 0x40]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push dword [ebp - 0x74]
push eax
lea eax, [ebp - 0x1dc]
push dword [ebp - 0xb0]
push dword [ebp - 0x6c]
push esi
push eax
push dword [ebp + 0x10]
call fcn.10006cd1
add esp, 0x28
test eax, eax
jne 0x10009a95
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x10007350
shl eax, 2
push eax
call fcn.1000f1d5
test eax, eax
pop ecx
mov dword [ebp - 0xa8], eax
jne 0x10007350
mov eax, 0xeab3
jmp 0x10009a95
push dword [0x1001c170]
call fcn.1000f1d5
test eax, eax
pop ecx
mov dword [ebp - 0xb4], eax
jne 0x10007370
mov eax, 0xeab4
jmp 0x10009a95
mov ecx, dword [0x1001c170]
mov esi, 0x1001c174
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x1001c16c]
lea ebx, [eax + ecx]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], ebx
mov eax, dword [eax + 0x1a]
mov dword [ebx + 0x2ce], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, 0xba53427c
mov dword [ebx + 0x7c], eax
xor eax, dword [ebp - 0x14]
mov dword [ebx + 0xa2e], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, 0x1a6b7cdf
mov dword [ebx + 0xae2], eax
call sym.WIN32SHL.dll_RightNow
xor eax, dword [ebx + 0xae2]
and dword [ebx + 0x74], 0
mov dword [ebx + 0xae6], eax
mov eax, dword [ebp + 0x18]
mov eax, dword [eax + 0x158]
test eax, eax
mov dword [ebx + 0x5d2], eax
je 0x10007489
mov eax, dword [ebp + 0x18]
or ecx, 0xffffffff
lea edx, [ebx + 0x5d6]
mov dword [ebp - 0xa0], 9
lea edi, [eax + 0x15c]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebx + 0x678]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
and byte [ebx + 0x612], 0
and byte [ebx + 0x613], 0
add eax, 0x19a
mov dword [ebp + 0xc], eax
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
lea esi, [edx - 0x64]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
add dword [ebp + 0xc], 0x66
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
and byte [edx], 0
and byte [edx + 1], 0
add edx, 0x66
dec dword [ebp - 0xa0]
jne 0x1000744c
mov esi, dword [ebp + 0x18]
push 0x14
lea eax, [esi + 0x59a]
push eax
lea eax, [ebp - 0x398]
push eax
call fcn.100027d0
add esp, 0xc
lea eax, [ebp - 0x398]
push 5
pop ecx
mov edx, dword [ebx + 0x7c]
add edx, dword [ebx + 0xae2]
xor dword [eax], edx
add eax, 4
dec ecx
jne 0x100074ad
lea eax, [ebp - 0x398]
push 0x14
push eax
lea eax, [ebx + 0xa36]
push eax
call fcn.100027d0
mov edi, 0x84
lea eax, [esi + 0x5aa]
push edi
push eax
lea eax, [ebp - 0x398]
push eax
call fcn.100027d0
add esp, 0x18
lea eax, [ebp - 0x398]
push 0x21
pop ecx
mov edx, dword [ebx + 0x7c]
sub edx, dword [ebx + 0xae2]
xor dword [eax], edx
add eax, 4
dec ecx
jne 0x100074f8
lea eax, [ebp - 0x398]
push edi
push eax
lea eax, [ebx + 0xa4a]
push eax
call fcn.100027d0
mov eax, dword [esi + 0x596]
xor ecx, ecx
xor eax, dword [ebx + 0x7c]
add esp, 0xc
cmp dword [esi + 0x63c], ecx
mov dword [ebx + 0xa32], eax
movzx eax, word [esi + 0x18]
mov dword [ebx + 0x2be], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0xa10], eax
je 0x10007589
cmp dword [esi + 0x62c], ecx
je 0x10007589
mov edx, dword [ebx + 0xae2]
xor edx, 1
mov dword [ebx + 0xace], edx
mov edx, dword [esi + 0x630]
mov dword [ebx + 0xad2], edx
mov edx, dword [esi + 0x634]
mov dword [ebx + 0xad6], edx
mov edx, dword [esi + 0x638]
mov dword [ebx + 0xada], edx
jmp 0x10007595
mov edx, dword [ebx + 0xae2]
mov dword [ebx + 0xace], edx
mov edx, dword [esi + 0x1e]
shl edx, 8
or edx, dword [esi + 0x22]
shl edx, 8
or edx, dword [esi + 0x26]
cmp eax, ecx
mov dword [ebx + 0x26], edx
je 0x100076e7
cmp dword [esi + 0x148], ecx
je 0x100076e7
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
movzx eax, al
cdq
mov ecx, 0xff
idiv ecx
mov byte [ebp + 0xf], dl
mov byte [ebp - 0x28], dl
call edi
add al, 0x3c
mov ecx, 0xff
movzx eax, al
cdq
idiv ecx
lea eax, [ebp - 0x84]
push eax
mov byte [ebp - 0x6d], dl
mov byte [ebp - 0x27], dl
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x84]
movzx ecx, word [ebp - 0x82]
shl eax, 8
or eax, ecx
movzx ecx, word [ebp - 0x7e]
shl eax, 8
or eax, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x148]
dec eax
je 0x10007657
dec eax
je 0x10007644
dec eax
je 0x10007639
dec eax
jne 0x1000765d
mov ax, word [esi + 0x14c]
and word [ebp - 0x2e], 0
mov word [ebp - 0x30], ax
jmp 0x1000765d
mov eax, dword [esi + 0x154]
imul eax, eax, 0x3c
jmp 0x1000765a
mov ax, word [esi + 0x150]
mov word [ebp - 0x30], 0x1234
mov word [ebp - 0x2e], ax
jmp 0x1000765d
mov eax, dword [ebx + 0x26]
mov dword [ebp - 0x30], eax
mov al, byte [ebp - 0x30]
mov cl, byte [ebp - 0x2b]
mov byte [ebp - 0x2b], al
mov al, byte [ebp - 0x2a]
mov byte [ebp - 0x30], cl
mov cl, byte [ebp - 0x2e]
mov byte [ebp - 0x2e], al
mov al, byte [ebp - 0x2f]
mov byte [ebp - 0x2a], cl
mov cl, byte [ebp - 0x2c]
mov byte [ebp - 0x2c], al
mov byte [ebp - 0x2f], cl
xor eax, eax
mov cl, byte [ebp + 0xf]
xor byte [ebp + eax - 0x30], cl
inc eax
cmp eax, 4
jl 0x10007683
push 4
pop eax
mov cl, byte [ebp - 0x6d]
xor byte [ebp + eax - 0x30], cl
inc eax
cmp eax, 8
jl 0x10007693
movsx eax, word [esi + 0x146]
mov dword [0x1003d3a4], eax
lea eax, [ebp - 0x30]
mov dword [0x1003d290], 0xa
mov dword [0x1003d284], eax
call fcn.10009ab0
test eax, eax
jne 0x10009a95
mov ax, word [esi + 0x146]
mov word [ebx + 0xa14], ax
mov eax, dword [esi + 0x148]
mov dword [ebx + 0xa16], eax
jmp 0x100076ed
mov dword [ebx + 0xa16], ecx
mov eax, dword [0x1003d394]
push 1
mov dword [0x1003d39c], eax
call fcn.10005240
mov edx, dword [esi + 0x14]
pop ecx
mov ecx, dword [esi + 4]
mov byte [ebp + 0xf], al
mov eax, dword [0x1003d394]
push 0x10
mov dword [ebx + 0x29e], ecx
mov dword [0x1003d39c], eax
xor ecx, ecx
pop edi
shl ecx, 2
test dh, 0x80
jne 0x10007728
or ecx, 2
shl edx, 1
dec edi
jne 0x1000771d
cmp dword [esi], 0
je 0x10007736
xor ecx, eax
jmp 0x1000773c
xor ecx, 0xed8375b6
push dword [0x1001e5a0]
mov dword [ebx + 0x2ba], ecx
call fcn.1000f1d5
test eax, eax
pop ecx
mov dword [ebp - 0xa4], eax
jne 0x10007762
mov eax, 0xeab5
jmp 0x10009a95
mov ecx, dword [0x1001e5a0]
mov edi, eax
mov eax, ecx
mov esi, 0x1001e5a4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push dword [0x1001ef08]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.1000f1d5
xor ebx, ebx
pop ecx
cmp eax, ebx
mov dword [ebp - 0xa0], eax
jne 0x1000779f
mov eax, 0xeab6
jmp 0x10009a95
mov edx, dword [0x1001ef08]
mov edi, eax
mov ecx, edx
mov esi, 0x1001ef0c
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp edx, ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x64], ebx
je 0x100077ce
push 1
pop eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], eax
jmp 0x100077d4
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x4c], ebx
mov eax, dword [0x1001c170]
xor ecx, ecx
cmp eax, ebx
setne cl
cmp edx, ebx
mov dword [ebp - 0x48], ecx
jne 0x100077f1
cmp eax, ebx
jne 0x100077f1
mov dword [0x1001e5a0], ebx
lea ecx, [ebp - 0x6c]
mov esi, dword [ebp - 0x20]
push ecx
mov ecx, dword [0x1001e5a0]
add ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x38]
push dword [ebp - 0xe0]
lea eax, [eax + ecx*4]
push eax
mov eax, dword [ebp - 0x3c]
lea ecx, [edx + eax*8]
add eax, ecx
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2d4]
push esi
push eax
lea eax, [ebp - 0x1dc]
push eax
lea eax, [ebp - 0x314]
push eax
push dword [ebp + 0x10]
call fcn.10002ddc
add esp, 0x2c
cmp eax, ebx
jne 0x10009a95
mov ebx, dword [ebp - 4]
lea eax, [esi + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
cmp eax, dword [ebx + 0x14]
je 0x10007887
mov esi, dword [ebp - 0x74]
xor edi, edi
cmp dword [ebp - 0x3c], edi
jle 0x10007887
lea eax, [ebp - 0x6c]
push eax
push ebx
movzx eax, word [ebp - 0x1d6]
push dword [ebp - 0x20]
push eax
push dword [esi]
call fcn.10003436
add esp, 0x14
inc edi
mov dword [esi], eax
cmp edi, dword [ebp - 0x3c]
mov esi, dword [esi + 0x10]
mov ebx, dword [ebp - 4]
jl 0x1000785f
movzx ecx, word [ebp - 0x2ce]
xor eax, eax
mov esi, dword [ebp - 0x1a4]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x204], eax
mov dword [ebp - 0x200], eax
lea eax, [ecx + ecx*4]
mov edx, dword [ebx + eax*8 - 0x1c]
lea eax, [ebx + eax*8]
add edx, dword [eax - 0x18]
lea eax, [edx + esi - 1]
xor edx, edx
div esi
mov edx, dword [ebp - 0x168]
imul eax, esi
movzx esi, word [ebp - 0x1d6]
mov dword [ebp - 0x284], eax
lea eax, [esi + 3]
lea edi, [edx + eax*4]
add eax, edi
mov edi, dword [ebp - 0x2d8]
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
lea eax, [ecx + 3]
lea ecx, [edx + eax*4]
add eax, ecx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea eax, [edi + eax*8]
xor edi, edi
cmp dword [ebp - 0x260], edi
mov dword [ebp - 0x1c], eax
jle 0x100079b8
mov eax, dword [ebp + ecx*8 - 0x164]
cmp eax, edi
je 0x100079a8
cmp eax, dword [ebp - 0xc]
jb 0x10007936
cmp eax, dword [ebx + 0xc]
jae 0x10007936
sub eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x1c]
mov dword [ebp + ecx*8 - 0x25c], eax
jmp 0x100079a8
xor edx, edx
cmp esi, edi
mov dword [ebp - 8], edx
jle 0x100079a8
mov edi, dword [ebp - 0x20]
add edi, 0x34
cmp eax, dword [edi - 0x28]
jb 0x1000794e
cmp eax, dword [edi]
jb 0x1000795b
inc edx
add edi, 0x28
cmp edx, esi
mov dword [ebp - 8], edx
jl 0x10007945
jmp 0x100079a6
cmp dword [ebp - 0x4c], 0
mov ecx, edx
je 0x10007971
mov edx, dword [ebp - 0x60]
cmp dword [ebp - 8], edx
mov edx, dword [ebp - 8]
jl 0x10007971
lea ecx, [edx + 1]
cmp dword [ebp - 0x48], 0
je 0x1000797d
cmp ecx, dword [ebp - 0x5c]
jl 0x1000797d
inc ecx
cmp dword [ebp - 0x44], 0
je 0x10007989
cmp ecx, dword [ebp - 0x58]
jl 0x10007989
inc ecx
lea ecx, [ecx + ecx*4]
lea edx, [edx + edx*4]
mov edi, dword [ebx + ecx*8 + 0xc]
mov ecx, dword [ebp - 0x20]
sub edi, dword [ecx + edx*8 + 0xc]
mov ecx, dword [ebp - 0x10]
add edi, eax
mov dword [ebp + ecx*8 - 0x25c], edi
xor edi, edi
inc ecx
cmp ecx, dword [ebp - 0x260]
mov dword [ebp - 0x10], ecx
jl 0x1000790e
cmp dword [ebp - 0x44], edi
je 0x100079fd
mov eax, dword [ebp - 0x58]
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0xc]
lea eax, [ebx + eax*8 + 0xc]
mov dword [ebp - 0x254], ecx
mov ecx, dword [ebp - 0xdc]
lea ecx, [ecx + ecx*4]
shl ecx, 2
mov dword [ebp - 0x250], ecx
mov ecx, dword [ebp - 0xd8]
add ecx, dword [eax]
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x1fc], ecx
mov eax, dword [ebp - 0x54]
cmp eax, 0xffffffff
je 0x10007a1e
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0xc]
lea eax, [ebx + eax*8]
mov dword [ebp - 0x234], ecx
mov eax, dword [eax + 8]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x4c], edi
je 0x10007a79
cmp dword [ebp - 0x48], edi
je 0x10007a79
mov eax, dword [ebp - 0x60]
mov ecx, dword [0x1001c160]
mov edx, dword [0x1001c15c]
mov esi, dword [ebp - 0x34]
lea eax, [eax + eax*4]
mov eax, dword [ebx + eax*8 + 0xc]
sub eax, ecx
sub eax, edx
add eax, dword [ebp - 0x1a8]
add dword [esi + 0xc], eax
mov eax, dword [ebp - 0x60]
mov ebx, dword [ebp - 4]
lea eax, [eax + eax*4]
mov eax, dword [ebx + eax*8 + 0xc]
sub eax, ecx
mov ecx, dword [ebp - 0x1a8]
sub eax, edx
mov edx, dword [ebp - 0x2ac]
add eax, dword [esi + 0x10]
add edx, ecx
mov dword [esi + 0x10], edx
mov dword [ebp - 0x2ac], eax
mov ebx, dword [ebp + 0x14]
push edi
push ebx
push dword [ebp - 0x2d8]
push edi
push dword [ebp + 0x10]
call fcn.100032b7
add esp, 0x14
cmp eax, edi
jne 0x10009a95
mov eax, dword [ebp - 0x168]
push edi
push dword [ebp - 0x2d8]
lea esi, [eax*8 + 0x78]
push ebx
call fcn.1000f261
push ebx
push esi
lea eax, [ebp - 0x2d4]
push 1
push eax
call fcn.100046a0
add esp, 0x1c
cmp eax, esi
jne 0x10008bc0
cmp dword [ebp - 0x54], 0xffffffff
jne 0x10007b31
mov esi, dword [ebp - 0x15c]
cmp esi, edi
je 0x10007b31
movzx edx, word [ebp - 0x1d6]
xor eax, eax
cmp edx, edi
jle 0x10007b01
mov ecx, dword [ebp - 0x20]
add ecx, 0x34
cmp esi, dword [ecx - 0x28]
jb 0x10007af9
cmp esi, dword [ecx]
jb 0x10007b01
inc eax
add ecx, 0x28
cmp eax, edx
jl 0x10007af0
cmp dword [ebp - 0x4c], edi
je 0x10007b0c
cmp eax, dword [ebp - 0x60]
jl 0x10007b0c
inc eax
cmp dword [ebp - 0x48], edi
je 0x10007b17
cmp eax, dword [ebp - 0x5c]
jl 0x10007b17
inc eax
cmp dword [ebp - 0x44], edi
je 0x10007b22
cmp eax, dword [ebp - 0x58]
jl 0x10007b22
inc eax
mov ecx, dword [ebp - 4]
lea eax, [eax + eax*4]
or byte [ecx + eax*8 + 0x27], 0x80
lea eax, [ecx + eax*8 + 0x24]
movzx eax, word [ebp - 0x2ce]
push ebx
push eax
push 0x28
push dword [ebp - 4]
call fcn.100046a0
movzx ecx, word [ebp - 0x2ce]
add esp, 0x10
cmp eax, ecx
jne 0x10008bc0
mov esi, dword [ebp - 0x14]
push dword [ebp - 0x1c]
mov eax, dword [esi]
push ebx
sub eax, dword [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push dword [ebp + 0x10]
call fcn.100032b7
add esp, 0x14
cmp eax, edi
jne 0x10009a95
xor ebx, ebx
xor edi, edi
cmp word [ebp - 0x1d6], bx
mov dword [ebp - 0x10], ebx
jbe 0x10007bf2
xor ecx, ecx
cmp dword [ebp - 0x4c], ecx
je 0x10007b99
cmp edi, dword [ebp - 0x60]
jne 0x10007b99
inc edi
add ebx, 0x28
cmp dword [ebp - 0x48], ecx
je 0x10007ba7
cmp edi, dword [ebp - 0x5c]
jne 0x10007ba7
inc edi
add ebx, 0x28
cmp dword [ebp - 0x44], ecx
je 0x10007bb5
cmp edi, dword [ebp - 0x58]
jne 0x10007bb5
inc edi
add ebx, 0x28
mov eax, dword [esi]
cmp eax, ecx
je 0x10007bdc
mov ecx, dword [ebp - 4]
push dword [ebx + ecx + 0x14]
push dword [ebp + 0x14]
push dword [esi - 4]
push eax
push dword [ebp + 0x10]
call fcn.100032b7
add esp, 0x14
test eax, eax
jne 0x10009a95
movzx eax, word [ebp - 0x1d6]
inc dword [ebp - 0x10]
add esi, 0x28
inc edi
add ebx, 0x28
cmp dword [ebp - 0x10], eax
jl 0x10007b89
xor esi, esi
cmp dword [ebp - 0x160], esi
je 0x10007e05
movzx eax, word [ebp - 0x1d6]
mov edx, dword [ebp - 0x164]
cmp eax, esi
jle 0x10007c28
mov ecx, dword [ebp - 0x20]
add ecx, 0x34
cmp edx, dword [ecx - 0x28]
jb 0x10007c20
cmp edx, dword [ecx]
jb 0x10007c28
inc esi
add ecx, 0x28
cmp esi, eax
jl 0x10007c17
cmp esi, eax
jne 0x10007c36
mov eax, 0xea86
jmp 0x10009a95
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x6c]
push ecx
push dword [ebp - 4]
push esi
push eax
push edx
call fcn.100033cd
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0xc], eax
push ecx
movzx ecx, word [ebp - 0x2ce]
push ecx
push dword [ebp - 4]
push eax
call fcn.1000349f
add esp, 0x24
test eax, eax
jne 0x10009a95
mov edi, dword [ebp + 0x14]
push eax
push dword [ebp - 0x1c]
push edi
call fcn.1000f261
push edi
push 1
pop ebx
lea eax, [ebp - 0x9c]
push ebx
push 0x28
push eax
call fcn.1000461a
add esp, 0x1c
cmp eax, ebx
je 0x10007c9c
mov eax, 0xea87
jmp 0x10009a95
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
movzx eax, word [ebp - 0x1d6]
push esi
push eax
push dword [ebp - 0x90]
call fcn.100033cd
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
movzx eax, word [ebp - 0x1d6]
push esi
push eax
push dword [ebp - 0x80]
call fcn.100033cd
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
movzx eax, word [ebp - 0x1d6]
push esi
push eax
push dword [ebp - 0x7c]
call fcn.100033cd
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
movzx eax, word [ebp - 0x1d6]
push esi
push eax
push dword [ebp - 0x78]
call fcn.100033cd
add esp, 0x50
mov dword [ebp - 0x78], eax
push 0
push dword [ebp - 0x1c]
push edi
call fcn.1000f261
push edi
push ebx
lea eax, [ebp - 0x9c]
push 0x28
push eax
call fcn.100046a0
add esp, 0x1c
cmp eax, ebx
jne 0x10008bc0
lea eax, [ebp - 8]
push eax
movzx eax, word [ebp - 0x2ce]
push eax
push dword [ebp - 4]
push dword [ebp - 0x7c]
call fcn.1000349f
add esp, 0x10
test eax, eax
jne 0x10009a95
xor ebx, ebx
push ebx
push dword [ebp - 8]
push edi
call fcn.1000f261
add esp, 0xc
cmp dword [ebp - 0x84], ebx
jle 0x10007e05
push 4
pop esi
push edi
push 1
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.1000461a
add esp, 0x10
cmp eax, 1
jne 0x10007ee4
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
movzx eax, word [ebp - 0x1d6]
push dword [ebp - 0x20]
push eax
push dword [ebp - 0xc]
call fcn.100033cd
push 0
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push edi
call fcn.1000f261
push edi
push 1
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.100046a0
add esp, 0x30
cmp eax, 1
jne 0x10008bc0
push 0
push dword [ebp - 8]
push edi
call fcn.1000f261
push edi
push 1
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.1000461a
add esp, 0x1c
cmp eax, 1
jne 0x10007ee4
add dword [ebp - 8], esi
inc ebx
cmp ebx, dword [ebp - 0x84]
jl 0x10007d77
cmp dword [ebp - 0x150], 0
je 0x10007e6a
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
movzx eax, word [ebp - 0x1d6]
push dword [ebp - 0x20]
push eax
push dword [ebp - 0x154]
call fcn.100033cd
lea ecx, [ebp - 0x14]
push ecx
movzx ecx, word [ebp - 0x2ce]
push ecx
push dword [ebp - 4]
push eax
call fcn.1000349f
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
movzx eax, word [ebp - 0x1d6]
push dword [ebp - 0x20]
push eax
push 0
push dword [ebp - 0x14]
push dword [ebp + 0x14]
call fcn.10003605
add esp, 0x40
test eax, eax
jne 0x10009a95
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x3c], 0
mov esi, dword [ebp - 0x74]
jle 0x10007fc5
push 0xfffffffffffffffc
xor edi, edi
pop ebx
mov eax, dword [esi + 0xc]
cmp eax, 0x25ff
jne 0x10007eee
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 4]
and byte [ebp - 0x2a], 0
and byte [ebp - 0x29], 0
and byte [ebp - 0x28], 0
and byte [ebp - 0x27], 0
lea eax, [eax + eax*4]
mov byte [ebp - 0x2c], 0x90
mov byte [ebp - 0x2b], 0xe9
push 0
mov eax, dword [ecx + eax*8 + 0xc]
sub eax, dword [esi + 4]
add eax, ebx
add eax, dword [0x1001ef08]
mov dword [ebp - 0x2a], eax
mov eax, dword [esi]
dec eax
dec eax
push eax
push dword [ebp + 0x14]
call fcn.1000f261
push dword [ebp + 0x14]
lea eax, [ebp - 0x2c]
push 6
push 1
push eax
call fcn.100046a0
add esp, 0x1c
jmp 0x10007fb0
mov eax, 0xea7b
jmp 0x10009a95
cmp eax, 0x15ff
jne 0x10007f43
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 4]
and byte [ebp - 0x1a], 0
and byte [ebp - 0x19], 0
and byte [ebp - 0x18], 0
and byte [ebp - 0x17], 0
lea eax, [eax + eax*4]
mov byte [ebp - 0x1c], 0x90
mov byte [ebp - 0x1b], pe_nt_image_headers32
push 0
mov eax, dword [ecx + eax*8 + 0xc]
sub eax, dword [esi + 4]
add eax, ebx
add eax, dword [0x1001ef08]
mov dword [ebp - 0x1a], eax
mov eax, dword [esi]
dec eax
dec eax
push eax
push dword [ebp + 0x14]
call fcn.1000f261
push dword [ebp + 0x14]
lea eax, [ebp - 0x1c]
push 6
push 1
jmp 0x10007ed6
mov ecx, dword [esi]
test ecx, ecx
je 0x10007fb0
mov eax, dword [ebp - 0x60]
mov edx, dword [ebp - 4]
push 0
push ecx
lea eax, [eax + eax*4]
push dword [ebp + 0x14]
mov eax, dword [edx + eax*8 + 0xc]
mov edx, dword [0x1001ef08]
add eax, ebx
add eax, dword [ebp - 0x1a8]
lea eax, [eax + edx + 4]
mov edx, dword [ebp - 0xa8]
mov dword [edi + edx], eax
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 4]
lea eax, [eax + eax*4]
mov eax, dword [edx + eax*8 + 0xc]
add eax, edi
add eax, dword [ebp - 0x1a8]
add eax, dword [0x1001c170]
mov dword [ebp - 0x14], eax
call fcn.1000f261
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push 4
push 1
push eax
call fcn.100046a0
add esp, 0x1c
add edi, 4
inc dword [ebp - 0x10]
mov esi, dword [esi + 0x10]
mov eax, dword [ebp - 0x10]
add ebx, 9
cmp eax, dword [ebp - 0x3c]
jl 0x10007e80
xor esi, esi
cmp dword [ebp - 0x15c], esi
je 0x100082f8
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
movzx eax, word [ebp - 0x1d6]
push dword [ebp - 0x20]
push eax
push dword [ebp - 0x15c]
call fcn.100033cd
lea ecx, [ebp - 0x14]
mov dword [ebp - 8], eax
push ecx
movzx ecx, word [ebp - 0x2ce]
push ecx
push dword [ebp - 4]
push eax
call fcn.1000349f
add esp, 0x24
cmp eax, esi
jne 0x10009a95
cmp dword [ebp - 0x6c], esi
mov dword [ebp - 0x10], esi
jle 0x100082f8
mov edi, dword [ebp + 0x14]
push 1
mov dword [ebp - 0x1c], esi
pop ebx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
add ecx, eax
push esi
push ecx
push edi
call fcn.1000f261
push edi
push ebx
lea eax, [ebp - 0x88]
push 0x14
push eax
call fcn.1000461a
add esp, 0x1c
cmp eax, ebx
jne 0x100082c6
cmp dword [ebp - 0x88], esi
je 0x10008081
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
movzx eax, word [ebp - 0x1d6]
push dword [ebp - 0x20]
push eax
push dword [ebp - 0x88]
call fcn.100033cd
add esp, 0x14
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
movzx eax, word [ebp - 0x1d6]
push dword [ebp - 0x20]
push eax
push dword [ebp - 0x7c]
call fcn.100033cd
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
movzx eax, word [ebp - 0x1d6]
push dword [ebp - 0x20]
push eax
push dword [ebp - 0x78]
call fcn.100033cd
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x14]
push esi
add ecx, eax
push ecx
push edi
call fcn.1000f261
push edi
push ebx
lea eax, [ebp - 0x88]
push 0x14
push eax
call fcn.100046a0
add esp, 0x44
cmp eax, ebx
jne 0x10008bc0
cmp dword [ebp - 0x88], esi
je 0x100081d1
lea eax, [ebp - 0xc]
push eax
movzx eax, word [ebp - 0x2ce]
push eax
push dword [ebp - 4]
push dword [ebp - 0x88]
call fcn.1000349f
add esp, 0x10
cmp eax, esi
jne 0x10009a95
push esi
push dword [ebp - 0xc]
push edi
call fcn.1000f261
push edi
push ebx
lea eax, [ebp - 8]
push 4
push eax
call fcn.1000461a
add esp, 0x1c
cmp eax, ebx
jne 0x100082d0
cmp dword [ebp - 8], esi
je 0x100081d1
push ebx
push 0xfffffffffffffffc
push edi
call fcn.1000f261
push edi
call fcn.1000f31a
add esp, 0x10
mov dword [ebp - 0xc], eax
test byte [ebp - 5], 0x80
jne 0x10008192
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
movzx eax, word [ebp - 0x1d6]
push dword [ebp - 0x20]
push eax
push dword [ebp - 8]
call fcn.100033cd
mov dword [ebp - 8], eax
push edi
push ebx
lea eax, [ebp - 8]
push 4
push eax
call fcn.100046a0
add esp, 0x24
cmp eax, ebx
jne 0x10008bc0
push esi
push dword [ebp - 0xc]
push edi
call fcn.1000f261
push edi
push ebx
lea eax, [ebp - 8]
push 4
push eax
call fcn.1000461a
add esp, 0x1c
cmp eax, ebx
jne 0x100082e4
push edi
push ebx
lea eax, [ebp - 8]
push 4
push eax
call fcn.1000461a
add esp, 0x10
cmp eax, ebx
jne 0x100082ee
jmp 0x10008139
cmp dword [ebp - 0x84], esi
jne 0x100082b1
lea eax, [ebp - 0xc]
push eax
movzx eax, word [ebp - 0x2ce]
push eax
push dword [ebp - 4]
push dword [ebp - 0x78]
call fcn.1000349f
add esp, 0x10
cmp eax, esi
jne 0x10009a95
push esi
push dword [ebp - 0xc]
push edi
call fcn.1000f261
push edi
push ebx
lea eax, [ebp - 8]
push 4
push eax
call fcn.1000461a
add esp, 0x1c
cmp eax, ebx
jne 0x100082da
cmp dword [ebp - 8], esi
je 0x100082b1
push ebx
push 0xfffffffffffffffc
push edi
call fcn.1000f261
push edi
call fcn.1000f31a
add esp, 0x10
mov dword [ebp - 0xc], eax
test byte [ebp - 5], 0x80
jne 0x1000827a
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
movzx eax, word [ebp - 0x1d6]
push dword [ebp - 0x20]
push eax
push dword [ebp - 8]
call fcn.100033cd
mov dword [ebp - 8], eax
push edi
push ebx
lea eax, [ebp - 8]
push 4
push eax
call fcn.100046a0
add esp, 0x24
cmp eax, ebx
jne 0x10008bc0
push esi
push dword [ebp - 0xc]
push edi
call fcn.1000f261
push edi
push ebx
lea eax, [ebp - 8]
push 4
push eax
call fcn.1000461a
add esp, 0x1c
cmp eax, ebx
jne 0x100082e4
push edi
push ebx
lea eax, [ebp - 8]
push 4
push eax
call fcn.1000461a
add esp, 0x10
cmp eax, ebx
jne 0x100082ee
jmp 0x10008221
inc dword [ebp - 0x10]
add dword [ebp - 0x1c], 0x14
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x6c]
jl 0x10008028
jmp 0x100082fb
mov eax, 0xea75
jmp 0x10009a95
mov eax, 0xea76
jmp 0x10009a95
mov eax, 0xea78
jmp 0x10009a95
mov eax, 0xea77
jmp 0x10009a95
mov eax, 0xea79
jmp 0x10009a95
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 4]
push edi
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x14]
lea eax, [ecx + eax*8]
push dword [eax + 0xc]
lea eax, [ebp - 0xe4]
push eax
call fcn.10004345
add esp, 0x10
cmp dword [ebp - 0x64], esi
je 0x1000834a
push edi
call fcn.1000f31a
push eax
push edi
push dword [ebp - 0x108]
push dword [ebp - 0x10c]
push dword [ebp + 0x10]
call fcn.100032b7
add esp, 0x18
cmp eax, esi
jne 0x10009a95
cmp dword [0x1001e5a0], esi
mov ebx, dword [ebp - 0x34]
jle 0x100084e0
mov eax, dword [ebp - 0xa4]
mov ecx, dword [esi + eax]
mov eax, dword [esi + eax + 4]
add esi, 4
cmp eax, 8
mov dword [ebp - 0x14], ecx
jl 0x1000837b
add eax, 0xfffffff8
cdq
sub eax, edx
sar eax, 1
jmp 0x1000837d
xor eax, eax
add esi, 4
mov ecx, eax
dec eax
test ecx, ecx
mov dword [ebp - 0x1c], eax
je 0x100084d4
mov eax, dword [ebp - 0xa4]
mov ax, word [esi + eax]
inc esi
inc esi
test ax, ax
je 0x100084c6
and eax, 0xfff
add eax, dword [ebp - 0x14]
cmp eax, dword [0x1001c160]
jb 0x100084c6
mov ecx, dword [0x1001ef08]
mov edx, dword [0x1001c160]
add ecx, edx
cmp eax, ecx
mov dword [ebp - 0xc], ecx
jae 0x100083d8
sub eax, edx
add eax, dword [ebp - 0xa0]
mov ecx, eax
jmp 0x10008412
sub eax, dword [0x1001c164]
add eax, dword [ebp - 0xb4]
mov ecx, eax
lea eax, [ebx + 0xc]
cmp ecx, eax
je 0x100084c6
lea eax, [ebx + 0x10]
cmp ecx, eax
je 0x100084c6
lea eax, [ebx + 0x64]
cmp ecx, eax
je 0x100084c6
lea eax, [ebx + 0x68]
cmp ecx, eax
je 0x100084c6
mov eax, dword [ecx]
mov edx, dword [0x1001c168]
sub eax, dword [0x1001c15c]
cmp eax, edx
jb 0x10008462
mov edi, dword [0x1001e1d8]
add edi, edx
cmp eax, edi
ja 0x10008462
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 4]
push 0
push dword [ebp - 0x1a8]
lea eax, [eax + eax*4]
push dword [0x1001c15c]
push dword [edx + eax*8 + 0xc]
push dword [ebp - 0xc8]
push dword [ebp - 0xc4]
push ecx
call fcn.10004284
add esp, 0x1c
jmp 0x100084c3
mov edx, dword [0x1001c164]
cmp eax, edx
jb 0x10008491
mov edi, dword [ebp - 0x38]
lea edx, [edx + edi*4]
add edx, dword [0x1001c170]
cmp eax, edx
ja 0x10008491
mov edx, dword [ebp - 0x5c]
mov edi, dword [ebp - 4]
lea edx, [edx + edx*4]
mov edx, dword [edi + edx*8 + 0xc]
sub edx, dword [0x1001c164]
jmp 0x100084b9
cmp eax, dword [0x1001c160]
jb 0x100085fe
cmp eax, dword [ebp - 0xc]
ja 0x100085fe
mov edx, dword [ebp - 0x60]
mov edi, dword [ebp - 4]
lea edx, [edx + edx*4]
mov edx, dword [edi + edx*8 + 0xc]
sub edx, dword [0x1001c160]
add edx, eax
add edx, dword [ebp - 0x1a8]
mov dword [ecx], edx
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
test eax, eax
jne 0x1000838e
cmp esi, dword [0x1001e5a0]
jl 0x10008359
cmp dword [ebp - 0x54], 0xffffffff
je 0x10008d33
mov ebx, dword [ebp - 0x40]
xor esi, esi
cmp dword [ebp - 0x24], esi
mov dword [ebp - 0x10], esi
jle 0x10008680
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
movzx eax, word [ebp - 0x1d6]
push dword [ebp - 0x20]
push eax
push dword [ebx]
call fcn.100033cd
add esp, 0x14
cmp dword [ebx + 8], esi
mov dword [ebx], eax
mov dword [ebp - 8], esi
jle 0x1000866e
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 8]
mov ax, word [eax + ecx*2]
mov ecx, eax
and cx, 0x3000
cmp cx, 0x3000
jne 0x1000865a
lea ecx, [ebp - 0x14]
and eax, 0xfff
add eax, dword [ebx]
push ecx
movzx ecx, word [ebp - 0x2ce]
push ecx
push dword [ebp - 4]
push eax
call fcn.1000349f
add esp, 0x10
cmp eax, esi
jne 0x10009a95
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x14]
cmp dword [eax + 0x10], esi
je 0x1000857f
cmp ecx, dword [eax]
je 0x1000857f
mov eax, dword [eax + 0x10]
cmp dword [eax + 0x10], esi
jne 0x10008573
cmp dword [eax + 0x10], esi
jne 0x1000865f
push esi
push ecx
push edi
call fcn.1000f261
push edi
push 1
lea eax, [ebp - 0x1c]
push 4
push eax
call fcn.1000461a
add esp, 0x1c
cmp eax, 1
jne 0x100086c6
push dword [ebp - 0xb0]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1a8]
push dword [ebp - 0x6c]
push eax
call fcn.100034f2
add esp, 0xc
test eax, eax
je 0x10008608
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 4]
push 1
push dword [ebp - 0x1a8]
lea eax, [eax + eax*4]
push dword [ebp - 0x1a8]
push dword [ecx + eax*8 + 0xc]
lea eax, [ebp - 0x1c]
push dword [ebp - 0xd0]
push dword [ebp - 0xcc]
push eax
call fcn.10004284
add esp, 0x1c
jmp 0x10008634
mov eax, 0xea91
jmp 0x10009a95
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x1a8]
movzx eax, word [ebp - 0x1d6]
push dword [ebp - 4]
push dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10003536
add esp, 0x18
cmp eax, esi
jne 0x10009a95
push esi
push dword [ebp - 0x14]
push edi
call fcn.1000f261
push edi
push 1
lea eax, [ebp - 0x1c]
push 4
push eax
call fcn.100046a0
add esp, 0x1c
cmp eax, 1
jne 0x10008bc0
jmp 0x1000865f
cmp ax, si
jne 0x100086d0
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebx + 8]
jl 0x10008525
inc dword [ebp - 0x10]
mov ebx, dword [ebx + 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x24]
jl 0x100084fb
cmp dword [0x1001e5a0], esi
mov dword [ebp - 0xc], esi
jle 0x1000877e
mov eax, esi
mov ecx, dword [ebp - 0xa4]
add ecx, eax
mov eax, dword [ecx]
test eax, eax
je 0x1000877e
mov esi, dword [0x1001c160]
cmp eax, esi
jl 0x100086da
cmp eax, dword [0x1001c164]
jge 0x100086da
mov edx, dword [ebp - 0x60]
mov edi, dword [ebp - 4]
lea edx, [edx + edx*4]
mov edx, dword [edi + edx*8 + 0xc]
sub edx, esi
jmp 0x100086ed
mov eax, 0xea74
jmp 0x10009a95
mov eax, 0xea6f
jmp 0x10009a95
mov edx, dword [ebp - 0x5c]
mov esi, dword [ebp - 4]
lea edx, [edx + edx*4]
mov edx, dword [esi + edx*8 + 0xc]
sub edx, dword [0x1001c164]
add eax, edx
mov dword [ecx], eax
mov ecx, dword [ebp - 0xa4]
mov dword [ebx], eax
mov eax, dword [ebp - 0xc]
lea eax, [eax + ecx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov dword [ebx + 4], eax
add eax, 0xfffffff8
shr eax, 1
mov dword [ebx + 8], eax
add eax, eax
push eax
call fcn.1000f1d5
test eax, eax
pop ecx
mov dword [ebx + 0xc], eax
je 0x100088fa
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp - 0xa4]
mov edi, eax
shl ecx, 1
mov eax, ecx
lea esi, [edx + esi + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x14
and ecx, 3
rep movsb byte es:[edi], byte [esi]
inc dword [ebp - 0x24]
call fcn.1000f1d5
test eax, eax
pop ecx
mov dword [ebx + 0x10], eax
je 0x10008904
mov ebx, eax
xor eax, eax
mov edi, ebx
mov ecx, dword [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xc]
add eax, dword [ecx]
cmp eax, dword [0x1001e5a0]
mov dword [ebp - 0xc], eax
jl 0x10008691
cmp dword [ebp - 0x4c], 0
je 0x10008afd
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 4]
mov edi, dword [0x1001ef08]
xor edx, edx
lea eax, [eax + eax*4]
push 9
and dword [ebp - 0xc], 0
mov esi, dword [ecx + eax*8 + 0xc]
mov ecx, dword [ebp - 0x1a4]
add esi, edi
mov eax, esi
and ax, 0xf000
mov dword [ebp - 0x10], eax
lea eax, [edi + ecx - 1]
div ecx
xor edx, edx
mov ecx, eax
imul ecx, dword [ebp - 0x1a4]
mov eax, ecx
sub eax, edi
pop edi
div edi
mov edi, eax
mov eax, dword [0x1001ef08]
lea eax, [eax + edi*8]
lea eax, [edi + eax + 5]
cmp eax, ecx
jae 0x100087df
inc edi
mov eax, dword [ebp - 0x3c]
cmp edi, eax
jle 0x100087e8
mov edi, eax
sub eax, edi
test edi, edi
mov dword [ebp - 8], eax
je 0x10008855
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x24]
add dword [ebp - 0x10], 0x1000
mov dword [ebx], eax
lea eax, [edi + edi + 8]
mov dword [ebx + 8], edi
mov dword [ebx + 4], eax
lea eax, [edi + edi]
push eax
call fcn.1000f1d5
test edi, edi
pop ecx
mov dword [ebx + 0xc], eax
jle 0x1000883f
mov ecx, eax
mov eax, dword [ebp - 0xc]
lea edx, [esi + eax*8]
lea edx, [eax + edx + 5]
and dx, 0xfff
add edx, 0x3000
inc eax
mov word [ecx], dx
inc ecx
inc ecx
cmp eax, edi
jl 0x10008820
mov dword [ebp - 0xc], eax
push 0x14
call fcn.1000f1d5
mov dword [ebx + 0x10], eax
mov ebx, eax
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
stosd dword es:[edi], eax
cmp dword [ebp - 8], 0
je 0x1000890e
mov eax, dword [ebp - 0xc]
push 9
inc eax
xor edx, edx
pop edi
lea ecx, [esi + eax*8]
add eax, ecx
and eax, 0xfff
movzx ecx, ax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1a4]
sub eax, ecx
div edi
mov edi, eax
lea eax, [ecx + edi*8]
lea eax, [edi + eax + 5]
cmp eax, 0x1000
jae 0x10008893
inc edi
cmp word [ebp - 0x14], 4
jb 0x1000889b
inc edi
cmp edi, dword [ebp - 8]
jle 0x100088a3
mov edi, dword [ebp - 8]
sub dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x24]
add dword [ebp - 0x10], 0x1000
mov dword [ebx], eax
lea eax, [edi + edi + 8]
mov dword [ebx + 4], eax
lea eax, [edi + edi]
push eax
mov dword [ebx + 8], edi
call fcn.1000f1d5
test edi, edi
pop ecx
mov dword [ebx + 0xc], eax
jle 0x1000883f
mov ecx, dword [ebp - 0xc]
lea edx, [esi + ecx*8]
lea edx, [ecx + edx + 5]
and dx, 0xfff
add edx, 0x3000
inc ecx
mov word [eax], dx
inc eax
inc eax
dec edi
jne 0x100088d7
mov dword [ebp - 0xc], ecx
jmp 0x1000883f
mov eax, 0xeab7
jmp 0x10009a95
mov eax, 0xeab8
jmp 0x10009a95
mov eax, dword [ebp - 0x38]
mov ecx, dword [0x1001c170]
mov edi, dword [ebp - 0x1a4]
mov dword [ebp - 8], eax
xor edx, edx
lea eax, [ecx + edi - 1]
div edi
mov esi, eax
imul esi, edi
sub esi, ecx
shr esi, 2
cmp esi, dword [ebp - 0x38]
jle 0x1000893a
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 4]
lea eax, [eax + eax*4]
mov eax, dword [edx + eax*8 + 0xc]
add eax, ecx
and ax, 0xf000
cmp dword [ebp - 0x38], 0
mov dword [ebp - 0x10], eax
je 0x100089fd
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x24]
mov dword [ebx], eax
lea eax, [esi + esi + 8]
mov dword [ebx + 4], eax
lea eax, [esi + esi]
push eax
mov dword [ebx + 8], esi
call fcn.1000f1d5
test eax, eax
pop ecx
mov dword [ebx + 0xc], eax
je 0x10008ad7
xor ecx, ecx
test esi, esi
jle 0x100089be
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x5c]
mov edi, dword [ebp - 4]
mov edx, ecx
lea eax, [eax + eax*4]
shl edx, 2
mov ax, word [edi + eax*8 + 0xc]
add ax, dx
mov edx, dword [ebp - 0x1c]
add eax, dword [0x1001c170]
add dword [ebp - 0x1c], 2
and ax, 0xfff
add eax, 0x3000
inc ecx
cmp ecx, esi
mov word [edx], ax
jl 0x1000898a
push 0x14
call fcn.1000f1d5
test eax, eax
pop ecx
mov dword [ebx + 0x10], eax
je 0x10008ae1
mov ebx, eax
xor eax, eax
mov edi, ebx
sub dword [ebp - 8], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add dword [ebp - 0x10], 0x1000
mov esi, 0x400
cmp dword [ebp - 8], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jge 0x100089f3
mov esi, dword [ebp - 8]
cmp dword [ebp - 8], 0
jne 0x1000895a
mov ebx, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x24], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x10], eax
jle 0x10008afd
mov eax, dword [ebx + 0x10]
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x10008aeb
mov ecx, dword [ebx]
cmp ecx, dword [eax]
jne 0x10008acf
mov edx, dword [ebx + 0xc]
test edx, edx
je 0x10008acf
mov ecx, dword [ebx + 8]
cmp word [edx + ecx*2 - 2], 0
jne 0x10008a47
dec ecx
add dword [ebx + 4], 0xfffffffe
mov dword [ebx + 8], ecx
mov ecx, dword [ebx + 8]
add ecx, dword [eax + 8]
shl ecx, 1
push ecx
call fcn.1000f1d5
test eax, eax
pop ecx
mov dword [ebp - 0xc], eax
je 0x10008bb6
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
mov edi, dword [ebp - 0xc]
push dword [ebx + 0xc]
shl eax, 1
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [ebp - 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [edx + 8]
mov esi, dword [edx + 0xc]
mov edx, dword [ebp - 0xc]
shl ecx, 1
lea edi, [edx + eax]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.1000f501
mov esi, dword [ebp - 0x1c]
push dword [esi + 0xc]
call fcn.1000f501
mov eax, dword [ebp - 0xc]
and dword [esi + 0xc], 0
and dword [esi + 4], 0
pop ecx
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 8]
add dword [ebx + 8], eax
pop ecx
lea ecx, [eax + eax]
mov eax, esi
add dword [ebx + 4], ecx
inc dword [ebp - 0x50]
mov eax, dword [eax + 0x10]
jmp 0x10008a14
mov eax, 0xeab9
jmp 0x10009a95
mov eax, 0xeaba
jmp 0x10009a95
inc dword [ebp - 0x10]
mov ebx, dword [ebx + 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x24]
jl 0x10008a11
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 4]
xor esi, esi
lea eax, [eax + eax*4]
push esi
push dword [ecx + eax*8 + 0x14]
push dword [ebp + 0x14]
call fcn.1000f261
mov edi, dword [ebp - 0x24]
add esp, 0xc
mov eax, edi
mov dword [ebp - 0x14], esi
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x10], esi
test eax, eax
jle 0x10008bca
mov eax, dword [ebp - 0x40]
or edx, 0xffffffff
xor ebx, ebx
test edi, edi
jle 0x10008b55
mov ecx, dword [eax]
cmp ecx, dword [ebp - 0x14]
jbe 0x10008b4f
cmp dword [eax + 4], 0
jbe 0x10008b4f
cmp ecx, edx
jae 0x10008b4f
mov edx, ecx
mov ebx, eax
mov eax, dword [eax + 0x10]
dec edi
jne 0x10008b3a
push dword [ebp + 0x14]
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
push 1
push 4
push ebx
call fcn.100046a0
add esp, 0x10
cmp eax, 1
jne 0x10008bc0
push dword [ebp + 0x14]
lea edi, [ebx + 4]
push eax
push 4
push edi
call fcn.100046a0
add esp, 0x10
cmp eax, 1
jne 0x10008bc0
push dword [ebp + 0x14]
push dword [ebx + 8]
push 2
push dword [ebx + 0xc]
call fcn.100046a0
add esp, 0x10
cmp eax, dword [ebx + 8]
jne 0x10008bc0
add esi, dword [edi]
mov edi, dword [ebp - 0x24]
inc dword [ebp - 0x10]
mov eax, edi
sub eax, dword [ebp - 0x50]
cmp dword [ebp - 0x10], eax
jl 0x10008b2e
jmp 0x10008bca
mov eax, 0xeabb
jmp 0x10009a95
mov eax, 0xea6a
jmp 0x10009a95
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 4]
xor edx, edx
lea eax, [eax + eax*4]
mov dword [ecx + eax*8 + 8], esi
mov ecx, dword [ebp - 0x1a0]
lea eax, [esi + ecx - 1]
div ecx
mov edx, eax
mov eax, dword [ebp - 0x54]
imul edx, ecx
mov ecx, dword [ebp - 4]
lea eax, [eax + eax*4]
mov dword [ecx + eax*8 + 0x10], edx
mov ebx, dword [ebp - 0x54]
mov dword [ebp - 0x230], esi
mov esi, dword [ebp - 4]
lea eax, [ebx + ebx*4]
lea edi, [ebx + 1]
mov ecx, dword [esi + eax*8 + 0x14]
lea edx, [esi + eax*8]
mov eax, dword [esi + eax*8 + 0xc]
add ecx, dword [edx + 0x10]
add eax, dword [edx + 8]
movzx edx, word [ebp - 0x2ce]
cmp edi, edx
jg 0x10008ca1
lea ebx, [edi + edi*4]
shl ebx, 3
jmp 0x10008c30
mov edi, dword [ebp - 0x10]
cmp dword [ebx + esi + 0xc], eax
lea edx, [ebx + esi + 0xc]
mov dword [ebp - 0x14], edx
jae 0x10008c56
mov esi, dword [ebp - 0x29c]
xor edx, edx
lea eax, [esi + eax - 1]
div esi
mov edx, dword [ebp - 0x14]
imul eax, esi
mov dword [edx], eax
mov esi, dword [ebp - 4]
cmp dword [ebx + esi + 0x14], ecx
lea eax, [ebx + esi + 0x14]
mov dword [ebp - 0x14], eax
jae 0x10008c7c
mov esi, dword [ebp - 0x298]
xor edx, edx
lea eax, [esi + ecx - 1]
mov ecx, dword [ebp - 0x14]
div esi
imul eax, esi
mov dword [ecx], eax
mov esi, dword [ebp - 4]
mov eax, dword [ebx + esi + 0xc]
mov ecx, dword [ebx + esi + 0x14]
add eax, dword [ebx + esi + 8]
add ecx, dword [ebx + esi + 0x10]
lea edx, [ebx + esi]
inc edi
movzx edx, word [ebp - 0x2ce]
add ebx, 0x28
cmp edi, edx
mov dword [ebp - 0x10], edi
jle 0x10008c2d
movzx eax, word [ebp - 0x2ce]
mov ecx, dword [ebp - 0x1a4]
push 0
lea eax, [eax + eax*4]
push dword [ebp - 0x2d8]
mov edx, dword [esi + eax*8 - 0x1c]
lea eax, [esi + eax*8]
push dword [ebp + 0x14]
add edx, dword [eax - 0x18]
lea eax, [edx + ecx - 1]
xor edx, edx
div ecx
imul eax, ecx
mov dword [ebp - 0x284], eax
call fcn.1000f261
mov eax, dword [ebp - 0x168]
push dword [ebp + 0x14]
lea esi, [eax*8 + 0x78]
lea eax, [ebp - 0x2d4]
push esi
push 1
push eax
call fcn.100046a0
add esp, 0x1c
cmp eax, esi
jne 0x10008bc0
movzx eax, word [ebp - 0x2ce]
push dword [ebp + 0x14]
push eax
push 0x28
push dword [ebp - 4]
call fcn.100046a0
movzx ecx, word [ebp - 0x2ce]
add esp, 0x10
cmp eax, ecx
jne 0x10008bc0
mov ebx, dword [ebp - 0x34]
mov edi, dword [ebp + 0x14]
cmp dword [ebp - 0x4c], 0
je 0x10008d71
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 4]
push 0
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x14]
push edi
call fcn.1000f261
push edi
push dword [0x1001ef08]
push 1
push dword [ebp - 0xa0]
call fcn.100046a0
add esp, 0x1c
cmp eax, dword [0x1001ef08]
jne 0x10008bc0
mov esi, dword [ebp - 0x74]
xor edi, edi
cmp dword [ebp - 0x3c], edi
mov byte [ebp - 0x30], pe_nt_image_headers32
mov dword [ebp - 0x10], edi
jle 0x10008e3d
xor ebx, ebx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x60]
push 1
lea edi, [esi + 8]
mov edx, dword [ecx + 0xc]
mov ecx, dword [ebp - 4]
lea eax, [eax + eax*4]
push dword [ebp - 0x1a8]
sub edx, dword [ecx + eax*8 + 0xc]
mov eax, dword [ebp - 0x58]
push dword [ebp - 0x1a8]
sub edx, ebx
lea eax, [eax + eax*4]
sub edx, dword [ebp - 0x1a8]
sub edx, dword [0x1001ef08]
sub edx, 5
mov dword [ebp - 0x2f], edx
push dword [ecx + eax*8 + 0xc]
push dword [ebp - 0xd0]
push dword [ebp - 0xcc]
push edi
call fcn.10004284
add esp, 0x1c
test eax, eax
jne 0x10009a95
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 4]
push dword [ebp + 0x14]
lea eax, [eax + eax*4]
push 1
push 9
mov eax, dword [ecx + eax*8 + 0xc]
mov ecx, dword [0x1001ef08]
add eax, dword [ebp - 0x2a0]
add eax, ebx
lea eax, [eax + ecx + 5]
and eax, 0xffff
add eax, dword [edi]
mov dword [ebp - 0x2b], eax
lea eax, [ebp - 0x30]
push eax
call fcn.100046a0
mov esi, dword [esi + 0x10]
add esp, 0x10
inc dword [ebp - 0x10]
add ebx, 9
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x3c]
jl 0x10008d88
mov ebx, dword [ebp - 0x34]
xor edi, edi
cmp dword [ebp - 0x48], edi
je 0x10009320
cmp dword [ebp - 0x54], 0xffffffff
jne 0x10008e7c
cmp dword [ebp - 0x15c], edi
je 0x10008e7c
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
movzx eax, word [ebp - 0x1d6]
push dword [ebp - 0x20]
push eax
push dword [ebp - 0x15c]
call fcn.100033cd
add esp, 0x14
mov dword [ebx + 0x292], eax
jmp 0x10008e82
mov dword [ebx + 0x292], edi
push edi
call fcn.1000fb5e
push eax
call fcn.1000fb2f
pop ecx
pop ecx
call fcn.1000fb3c
test ax, 0xffff
jne 0x10008ea8
call fcn.1000fb3c
test eax, eax
jne 0x10008ea8
xor ecx, ecx
jmp 0x10008eab
push 1
pop ecx
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x22], ecx
push 0xffffffffffffffd2
lea esi, [ebx + 0x2e]
mov edx, dword [eax + 0x2a]
pop edi
xor edx, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [ebx + 0x1e], edx
mov dword [ebx + 0x29a], ecx
mov dword [ebx + 0x78], eax
sub edi, ebx
call fcn.1000fb3c
mov byte [esi - 0x1a], al
call fcn.1000fb3c
mov byte [esi], al
inc esi
lea eax, [edi + esi]
cmp eax, 0xa
jl 0x10008ed0
mov eax, dword [ebx + 0x14]
mov ecx, dword [0x1003d474]
xor dword [ebx + 0x26], eax
and dword [ebx + 0x296], 0
mov edi, dword [ebp - 0xac]
mov eax, 0x400
and ecx, eax
cmp ecx, eax
jne 0x10008f2c
push edi
call fcn.10004726
test eax, eax
pop ecx
je 0x10008f2c
push 1
mov dword [ebx + 0x2c6], 0x4d354256
pop esi
mov dword [ebx + 0x2a6], esi
jmp 0x10008f87
mov ecx, dword [0x1003d474]
mov eax, 0xa00
and ecx, eax
cmp ecx, eax
jne 0x10008f5d
push edi
call fcn.10004726
test eax, eax
pop ecx
je 0x10008f5d
push 1
mov dword [ebx + 0x2c6], 0x4d364256
pop esi
mov dword [ebx + 0x2a6], esi
jmp 0x10008f87
mov ecx, dword [0x1003d474]
mov eax, 0x800
and ecx, eax
cmp ecx, eax
jne 0x10008f84
push edi
call fcn.10004726
test eax, eax
pop ecx
je 0x10008f84
push 1
pop esi
mov dword [ebx + 0x2ae], esi
jmp 0x10008f87
push 1
pop esi
push str.VFP300.ESL
push edi
call fcn.10015070
pop ecx
test eax, eax
pop ecx
je 0x1000925f
push str.VFP500.DLL
push edi
call fcn.10015070
pop ecx
test eax, eax
pop ecx
je 0x1000925f
push str.VFP6R.DLL
push edi
call fcn.10015070
pop ecx
test eax, eax
pop ecx
je 0x1000925f
push str.VFP7R.DLL
push edi
call fcn.10015070
pop ecx
test eax, eax
pop ecx
je 0x1000925f
push str.VFP8R.DLL
push edi
call fcn.10015070
pop ecx
test eax, eax
pop ecx
je 0x1000925f
push str.VFP.EXE
push edi
call fcn.10015070
pop ecx
test eax, eax
pop ecx
je 0x1000925f
push str.OLE32.DLL
push edi
call fcn.10015070
pop ecx
test eax, eax
pop ecx
je 0x1000925f
push str.DAO350.DLL
push edi
call fcn.10015070
pop ecx
test eax, eax
pop ecx
je 0x1000925f
push str.MSXBSE35.DLL
push edi
call fcn.10015070
pop ecx
test eax, eax
pop ecx
jne 0x1000904e
mov dword [ebx + 0x6c], esi
mov dword [ebx + 0x2a2], esi
jmp 0x10009262
push str.MSJET35.DLL
push edi
call fcn.10015070
pop ecx
test eax, eax
pop ecx
jne 0x10009082
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp - 0x34]
push 0x40
lea esi, [ecx + 0x46]
lea edi, [eax + 0x4d2]
pop ecx
mov dword [eax + 0x6c], 1
rep movsd dword es:[edi], dword [esi]
mov ebx, dword [ebp - 0x34]
jmp 0x10009262
push str.MSJET40.DLL
push edi
call fcn.10015070
pop ecx
test eax, eax
pop ecx
je 0x1000905f
xor esi, esi
xor edi, edi
mov dword [ebx + 0x6c], esi
cmp word [ebp - 0x2ce], si
jbe 0x10009262
mov eax, dword [ebp - 4]
push str..data
add eax, esi
push eax
call fcn.10015070
pop ecx
test eax, eax
pop ecx
je 0x100090e9
mov eax, dword [ebp - 4]
push str.DATA
add eax, esi
push eax
call fcn.10015070
pop ecx
test eax, eax
pop ecx
je 0x100090e9
mov eax, dword [ebp - 4]
push str.DGROUP
add eax, esi
push eax
call fcn.10015070
pop ecx
test eax, eax
pop ecx
jne 0x100090fb
mov ecx, dword [ebp - 4]
mov eax, dword [esi + ecx + 0x24]
test al, 0x40
je 0x100090fb
test eax, 0x80000000
jne 0x1000910f
movzx eax, word [ebp - 0x2ce]
inc edi
add esi, 0x28
cmp edi, eax
jl 0x100090a7
jmp 0x10009262
lea esi, [edi + edi*4]
mov eax, 0x400
shl esi, 3
mov dword [ebp - 0xc], eax
mov ecx, dword [esi + ecx + 0x10]
cmp ecx, eax
jae 0x10009128
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp - 0xc]
push 1
pop ebx
mov dword [eax + 0x2b2], edi
mov dword [eax + 0x296], ebx
mov ecx, dword [ebp - 4]
push 0
mov ecx, dword [esi + ecx + 0xc]
add ecx, dword [ebp - 0x1a8]
mov dword [eax + 0x64], ecx
mov eax, dword [ebp - 4]
push dword [esi + eax + 0x14]
push dword [ebp + 0x14]
call fcn.1000f261
push dword [ebp + 0x14]
lea eax, [ebp - 0xa54]
push edi
push ebx
push eax
call fcn.1000461a
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0x40]
add esp, 0x1c
mov eax, dword [esi + ecx + 0xc]
cmp dword [edi], eax
jne 0x10009186
cmp dword [edi + 0xc], 0
jne 0x1000918d
mov edi, dword [edi + 0x10]
test edi, edi
jne 0x1000917c
cmp dword [ebp - 0x210], 0
je 0x100091eb
lea eax, [ebp - 0x14]
push eax
movzx eax, word [ebp - 0x2ce]
push eax
push ecx
push dword [ebp - 0x214]
call fcn.1000349f
add esp, 0x10
test eax, eax
jne 0x10009a95
push eax
push dword [ebp - 0x14]
push dword [ebp + 0x14]
call fcn.1000f261
push dword [ebp + 0x14]
lea eax, [ebp - 0x8c]
push 0x18
push 1
push eax
call fcn.1000461a
mov ebx, dword [ebp - 0x84]
add esp, 0x1c
sub ebx, dword [ebp - 0x2a0]
sub ebx, dword [edi]
jmp 0x100091f0
mov ebx, 0x1000
and dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
jle 0x10009232
call fcn.10003746
push dword [ebp - 8]
push edi
call fcn.10005ac5
pop ecx
test eax, eax
mov eax, dword [ebp - 8]
pop ecx
jne 0x10009229
cmp eax, ebx
jl 0x1000921c
lea ecx, [ebx + 4]
cmp eax, ecx
jl 0x10009229
mov cl, byte [0x1003d39c]
add byte [ebp + eax - 0xa54], cl
inc eax
cmp eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jl 0x100091fa
mov eax, dword [ebp - 4]
push 0
push dword [esi + eax + 0x14]
push dword [ebp + 0x14]
call fcn.1000f261
push dword [ebp + 0x14]
lea eax, [ebp - 0xa54]
push dword [ebp - 0xc]
push 1
push eax
call fcn.100046a0
add esp, 0x1c
jmp 0x1000907a
mov dword [ebx + 0x6c], esi
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [0x1001703c]
mov dword [ebx + 0x68], eax
mov eax, dword [ebp - 0x284]
add eax, ecx
mov dword [ebx + 0xa1a], eax
call sym.WIN32SHL.dll_RightNow
add eax, 0x90abcdef
mov dword [ebx + 0xa26], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc0]
mov dword [0x1003d284], eax
call fcn.10009a9a
test eax, eax
jne 0x10009a95
mov eax, dword [ebp - 0xbf]
mov ecx, dword [ebp - 4]
xor eax, dword [ebp - 0x14]
push 0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x5c]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x14]
push dword [ebp + 0x14]
call fcn.1000f261
push dword [ebp + 0x14]
push dword [0x1001c170]
push 1
push dword [ebp - 0xb4]
call fcn.100046a0
add esp, 0x1c
cmp eax, dword [0x1001c170]
jne 0x10008bc0
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x1000931e
push dword [ebp + 0x14]
shl eax, 2
push eax
push 1
push dword [ebp - 0xa8]
call fcn.100046a0
mov ecx, dword [ebp - 0x38]
add esp, 0x10
shl ecx, 2
cmp eax, ecx
jne 0x10008bc0
xor edi, edi
cmp dword [ebp - 0x130], edi
je 0x10009644
movzx ecx, word [ebp - 0x1d6]
xor esi, esi
cmp ecx, edi
jle 0x10009356
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x134]
add eax, 0x34
cmp edx, dword [eax - 0x28]
jb 0x1000934e
cmp edx, dword [eax]
jb 0x10009356
inc esi
add eax, 0x28
cmp esi, ecx
jl 0x10009345
cmp esi, ecx
jne 0x10009364
mov eax, 0xea7e
jmp 0x10009a95
mov eax, dword [ebp - 0x130]
push 0x1c
xor edx, edx
pop ecx
div ecx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
movzx eax, word [ebp - 0x2ce]
push eax
push dword [ebp - 4]
push dword [ebp - 0x22c]
call fcn.1000349f
add esp, 0x10
cmp eax, edi
jne 0x10009a95
mov eax, dword [ebp - 0xc]
dec dword [ebp - 0xc]
test eax, eax
je 0x10009511
mov edi, dword [ebp + 0x14]
push 0
push dword [ebp - 0x1c]
push edi
call fcn.1000f261
push edi
push 1
lea eax, [ebp - 0x90]
push 0x1c
push eax
call fcn.1000461a
add esp, 0x1c
cmp eax, 1
jne 0x100094fd
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
movzx eax, word [ebp - 0x1d6]
push dword [ebp - 0x20]
push eax
push dword [ebp - 0x78]
call fcn.10003436
mov ecx, dword [ebp - 4]
mov esi, eax
movzx eax, word [ebp - 0x2ce]
add esp, 0x14
lea eax, [eax + eax*4]
cmp esi, dword [ecx + eax*8 + 0x14]
jb 0x1000941f
push esi
push edi
push dword [ebp - 0x80]
push dword [ebp - 0x78]
push dword [ebp + 0x10]
call fcn.100032b7
add esp, 0x14
test eax, eax
jne 0x10009a95
push 0
mov dword [ebp - 0x78], esi
push dword [ebp - 0x1c]
push edi
call fcn.1000f261
push edi
push 1
lea eax, [ebp - 0x90]
push 0x1c
push eax
call fcn.100046a0
add esp, 0x1c
cmp eax, 1
jne 0x10008bc0
push edi
call fcn.1000f31a
push 0
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x78]
push edi
call fcn.1000f261
add esp, 0x10
cmp dword [ebp - 0x84], 3
jne 0x10009399
xor edi, edi
cmp dword [ebp - 0x80], edi
jle 0x10009399
push dword [ebp + 0x14]
call fcn.1000f31a
push dword [ebp + 0x14]
mov esi, eax
lea eax, [ebp - 8]
push 1
push 4
push eax
call fcn.1000461a
add esp, 0x14
cmp eax, 1
jne 0x10009507
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
movzx eax, word [ebp - 0x1d6]
push dword [ebp - 0x20]
push eax
push dword [ebp - 8]
call fcn.100033cd
push 0
push esi
push dword [ebp + 0x14]
mov dword [ebp - 8], eax
call fcn.1000f261
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push 1
push 4
push eax
call fcn.100046a0
add esp, 0x30
cmp eax, 1
jne 0x10008bc0
add esi, 0x10
push 0
push esi
push dword [ebp + 0x14]
call fcn.1000f261
add edi, 0x10
add esp, 0xc
cmp edi, dword [ebp - 0x80]
jl 0x10009479
jmp 0x10009399
mov eax, 0xea7d
jmp 0x10009a95
mov eax, 0xea7a
jmp 0x10009a95
mov eax, dword [ebp + 0x18]
mov eax, dword [eax + 0x2e]
cmp eax, 0x200
je 0x10009529
cmp eax, 0x201
jne 0x10009644
xor edi, edi
push 2
push edi
push dword [ebp + 0x10]
call fcn.1000f261
push dword [ebp + 0x10]
call fcn.1000f31a
push 2
push edi
push dword [ebp + 0x14]
mov esi, eax
call fcn.1000f261
push dword [ebp + 0x14]
call fcn.1000f31a
push edi
push 0x1e
push dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
call fcn.1000f261
add esp, 0x2c
push dword [ebp + 0x14]
lea eax, [ebp - 0x80]
push 0xa
push 1
push eax
call fcn.1000461a
add esp, 0x10
cmp word [ebp - 0x80], 0
jne 0x1000958a
cmp dword [ebp - 0x7e], 0
jne 0x1000959c
cmp dword [ebp - 0x7a], 0
je 0x100095a7
cmp byte [ebp - 0x80], 0x54
jne 0x1000959c
cmp byte [ebp - 0x7f], 0x44
je 0x100095a7
cmp byte [ebp - 0x7f], 0x64
je 0x100095a7
inc edi
cmp edi, 3
jl 0x10009564
jmp 0x1000963b
mov eax, esi
mov byte [ebp - 0x80], 0x54
xor eax, 0x19611225
mov byte [ebp - 0x7f], 0x44
mov dword [ebp - 0x7e], eax
mov eax, dword [ebp - 0xc]
sub eax, esi
cmp eax, 0xffffff
ja 0x10009709
xor eax, 0x198931
cmp dword [ebx + 0x6c], 0
mov dword [ebp - 0x7a], eax
mov al, byte [ebp + 0xf]
mov byte [ebp - 0x77], al
je 0x100095e3
mov byte [ebp - 0x7f], 0x53
jmp 0x10009617
mov eax, dword [ebp + 0x18]
mov eax, dword [eax + 0x2e]
cmp eax, 0x301
je 0x100095f7
cmp eax, 0x201
jne 0x10009617
push dword [ebp + 0x10]
call fcn.100053eb
test eax, eax
pop ecx
je 0x10009617
mov byte [ebp - 0x7f], 0x64
xor eax, eax
mov cl, byte [ebp - 0x77]
xor byte [ebp + eax - 0x7e], cl
inc eax
cmp eax, 7
jl 0x1000960a
lea eax, [edi + edi*4 + 0xf]
push 0
shl eax, 1
push eax
push dword [ebp + 0x14]
call fcn.1000f261
push dword [ebp + 0x14]
lea eax, [ebp - 0x80]
push 0xa
push 1
push eax
call fcn.100046a0
add esp, 0x1c
cmp edi, 4
je 0x1000979f
push 2
push 0
push dword [ebp + 0x10]
call fcn.1000f261
push dword [ebp + 0x10]
call fcn.1000f31a
mov ecx, dword [ebp - 0x20]
mov ebx, eax
movzx eax, word [ebp - 0x1d6]
add esp, 0x10
lea eax, [eax + eax*4]
mov esi, dword [ecx + eax*8 - 0x18]
lea eax, [ecx + eax*8]
add esi, dword [eax - 0x14]
cmp ebx, esi
jbe 0x100097e8
movzx eax, word [ebp - 0x2ce]
mov ecx, dword [ebp - 4]
push 0
lea eax, [eax + eax*4]
push 0x1e
push dword [ebp + 0x14]
mov edi, dword [ecx + eax*8 - 0x18]
lea eax, [ecx + eax*8]
add edi, dword [eax - 0x14]
call fcn.1000f261
add esp, 0xc
and dword [ebp - 0x10], 0
push dword [ebp + 0x14]
lea eax, [ebp - 0x80]
push 0xa
push 1
push eax
call fcn.1000461a
add esp, 0x10
cmp word [ebp - 0x80], 0
jne 0x100096cc
cmp dword [ebp - 0x7e], 0
jne 0x100096de
cmp dword [ebp - 0x7a], 0
je 0x100096ec
cmp byte [ebp - 0x80], 0x54
jne 0x100096de
cmp byte [ebp - 0x7f], 0x44
je 0x100096ec
cmp byte [ebp - 0x7f], 0x64
je 0x100096ec
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100096a6
jmp 0x10009799
mov eax, esi
mov byte [ebp - 0x80], 0x54
xor eax, 0x19611225
mov byte [ebp - 0x7f], 0x44
mov dword [ebp - 0x7e], eax
mov eax, edi
sub eax, esi
cmp eax, 0xffffff
jbe 0x10009713
mov eax, 0xea99
jmp 0x10009a95
xor eax, 0x198931
mov dword [ebp - 0x7a], eax
mov al, byte [ebp + 0xf]
mov byte [ebp - 0x77], al
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x6c], 0
je 0x10009730
mov byte [ebp - 0x7f], 0x53
jmp 0x10009772
mov eax, dword [ebp + 0x18]
mov eax, dword [eax + 0x2e]
cmp eax, 0x301
je 0x10009752
cmp eax, 0x201
je 0x10009752
cmp eax, 0x501
je 0x10009752
cmp eax, 0x901
jne 0x10009772
push dword [ebp + 0x10]
call fcn.100053eb
test eax, eax
pop ecx
je 0x10009772
mov byte [ebp - 0x7f], 0x64
xor eax, eax
mov cl, byte [ebp - 0x77]
xor byte [ebp + eax - 0x7e], cl
inc eax
cmp eax, 7
jl 0x10009765
mov eax, dword [ebp - 0x10]
push 0
lea eax, [eax + eax*4 + 0xf]
shl eax, 1
push eax
push dword [ebp + 0x14]
call fcn.1000f261
push dword [ebp + 0x14]
lea eax, [ebp - 0x80]
push 0xa
push 1
push eax
call fcn.100046a0
add esp, 0x1c
cmp dword [ebp - 0x10], 4
jne 0x100097a9
mov eax, 0xea94
jmp 0x10009a95
push str.VFP300.ESL
push dword [ebp - 0xac]
call fcn.10015070
pop ecx
pop ecx
push edi
push dword [ebp + 0x14]
test eax, eax
jne 0x100097d1
sub ebx, esi
push ebx
push esi
push dword [ebp + 0x10]
call fcn.100032b7
jmp 0x100097dd
sub ebx, esi
push ebx
push esi
push dword [ebp + 0x10]
call fcn.100044de
add esp, 0x14
test eax, eax
jne 0x10009a95
mov edi, dword [ebp + 0x14]
push 2
push 0
push edi
call fcn.1000f261
push edi
call fcn.1000f31a
movzx ecx, word [ebp - 0x2ce]
mov edx, dword [ebp - 4]
add esp, 0x10
lea ecx, [ecx + ecx*4]
lea edx, [edx + ecx*8]
mov ecx, dword [edx - 0x18]
add ecx, dword [edx - 0x14]
cmp eax, ecx
jae 0x10009834
sub ecx, eax
mov esi, ecx
and byte [ebp + 0x1b], 0
push edi
push 1
lea eax, [ebp + 0x1b]
push 1
push eax
call fcn.100046a0
add esp, 0x10
dec esi
jne 0x1000981c
push dword [ebp - 0xd0]
call fcn.1000f501
xor ebx, ebx
pop ecx
cmp dword [ebp - 0xc4], ebx
jle 0x10009868
xor esi, esi
mov eax, dword [ebp - 0xc8]
push dword [eax + esi + 8]
call fcn.1000f501
inc ebx
add esi, 0xc
cmp ebx, dword [ebp - 0xc4]
pop ecx
jl 0x1000984c
push dword [ebp - 0xc8]
call fcn.1000f501
push dword [ebp - 0xe4]
call fcn.1000f501
cmp dword [ebp - 0xa8], 0
pop ecx
pop ecx
je 0x10009895
push dword [ebp - 0xa8]
call fcn.1000f501
pop ecx
push dword [ebp - 0xb4]
call fcn.1000f501
push dword [ebp - 0xa4]
call fcn.1000f501
push dword [ebp - 0xa0]
call fcn.1000f501
push dword [ebp - 0xb0]
call fcn.1000f501
push dword [ebp - 0x20]
call fcn.1000f501
mov eax, dword [ebp - 0x74]
add esp, 0x14
mov esi, dword [eax + 0x10]
push eax
call fcn.1000f501
test esi, esi
pop ecx
mov eax, esi
jne 0x100098cf
mov esi, dword [ebp - 0x40]
mov eax, dword [esi + 0xc]
mov ebx, dword [esi + 0x10]
test eax, eax
je 0x100098f3
push eax
call fcn.1000f501
pop ecx
test esi, esi
je 0x100098fe
push esi
call fcn.1000f501
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x100098e2
push dword [ebp - 0x2c]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x2d4]
push dword [ebp - 4]
push eax
lea eax, [ebp - 0x1dc]
push eax
push edi
call fcn.1000696e
mov ecx, dword [ebp - 4]
add esp, 0x18
test eax, eax
mov eax, dword [ebp - 0x5c]
push ebx
lea eax, [eax + eax*4]
mov eax, dword [ecx + eax*8 + 0x14]
mov ecx, dword [0x1001c16c]
lea eax, [eax + ecx + 0xa1e]
push eax
push edi
je 0x1000995a
call fcn.1000f261
push 1
pop eax
push edi
push 4
mov dword [ebp - 0xb8], eax
push eax
jmp 0x1000996b
call fcn.1000f261
and dword [ebp - 0xb8], 0
push edi
push 4
push 1
lea eax, [ebp - 0xb8]
push eax
call fcn.1000f5ab
add esp, 0x1c
push dword [ebp + 0x10]
call fcn.1000f825
push dword [ebp + 0x14]
call fcn.1000f825
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x2d4]
push ebx
push dword [ebp - 0x2d8]
push dword [ebp - 4]
push eax
call fcn.10006aa4
push dword [ebp - 4]
call fcn.1000f501
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x58c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call section..text
add esp, 0x20
test eax, eax
jne 0x10009a00
push str.VFP300.ESL
push dword [ebp - 0xac]
call fcn.10015070
pop ecx
test eax, eax
pop ecx
je 0x10009a00
lea edx, [ebp - 0x58c]
mov edi, str.tmp.dll
jmp 0x10009a0b
lea edx, [ebp - 0x58c]
mov edi, str.tmp.exe
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sym.WIN32SHL.dll_RightNow
mov edi, dword [ebp - 0x14]
mov esi, eax
xor esi, 0xa45b17e8
lea eax, [ebp - 0xc0]
mov dword [0x1003d284], eax
lea eax, [esi + edi]
push eax
push ebx
call fcn.10006c50
pop ecx
lea eax, [ebp - 0x58c]
pop ecx
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x10009a90
push edi
push esi
lea eax, [ebp - 0x58c]
push ebx
push eax
call fcn.10001050
add esp, 0x10
mov esi, eax
lea eax, [ebp - 0x58c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, esi
jmp 0x10009a95
mov eax, 0xea97
pop edi
pop esi
pop ebx
leave
ret