Function at 0x434df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe0
mov dword [esp + 0xd0], ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xb4], edx
lea edi, [esp + 0x98]
mov dword [esp + 0xa4], edx
mov dword [esp + 0xd4], ecx
mov dword [esp + 0xd8], eax
mov eax, dword [edx]
mov edx, edi
mov ecx, dword [eax + 0x114]
mov eax, dword [eax + 0x11c]
lea eax, [eax + eax*4]
mov dword [esp + 0x98], ecx
lea eax, [ecx + eax*4]
lea ecx, [esp + 0x30]
mov dword [esp + 0x9c], eax
call fcn.00417570
mov esi, dword [esp + 0x30]
test esi, esi
je 0x434f76
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov eax, dword [0x6f1130]
test eax, eax
jne 0x434e8b
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x436a70
mov dword [0x6f1130], eax
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x436a70
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
mov dword [esp + 0x70], eax
mov dword [esp], eax
mov esi, 0x10
mov dword [esp + 0x74], 1
mov dword [esp + 0x78], 1
mov dword [esp + 0x6c], 1
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x9c]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
jmp 0x434f0a
inc edx
mov dword [eax + esi - 4], edi
mov dword [eax + esi], ebx
mov dword [eax + esi + 4], ecx
mov dword [esp], eax
add esi, 0xc
mov dword [esp + 0x6c], edx
mov dword [esp + 0x78], edx
lea ecx, [esp + 0x30]
lea edx, [esp + 0x5c]
call fcn.00417570
mov edi, dword [esp + 0x30]
test edi, edi
je 0x434f53
mov edx, dword [esp + 0x6c]
mov ebx, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp]
cmp edx, dword [esp + 0x74]
jne 0x434ef0
mov dword [esp], ecx
lea ecx, [esp + 0x70]
push 1
call fcn.004161f0
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x70]
add esp, 4
mov eax, dword [esp + 0x70]
jmp 0x434ef0
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x6c]
lea edi, [esp + 0x98]
mov dword [esp + 0x94], eax
mov dword [esp + 0xac], ecx
jmp 0x434f8f
mov eax, dword [0x6d6b64]
xor edx, edx
mov dword [esp + 0xac], 0
mov dword [esp + 0x94], eax
mov ecx, dword [esp + 0xa4]
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x6c], edx
mov ecx, dword [ecx]
mov esi, dword [ecx + 0x120]
mov ecx, dword [ecx + 0x128]
mov dword [esp + 0xc0], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x5c], edi
mov dword [esp + 0xc4], eax
lea eax, [edx*4]
mov dword [esp + 0xcc], ecx
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x50], esi
lea ecx, [eax + eax*2]
mov eax, dword [ebp + 8]
test ecx, ecx
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xb8], eax
mov dword [esp + 0x98], eax
mov dword [esp + 0xbc], edx
mov dword [esp + 0x9c], edx
mov eax, ecx
je 0x4350f9
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0xb0]
add ecx, eax
add eax, 0xc
mov dword [esp + 4], ecx
mov ecx, dword [ebp + 8]
nop word cs:[eax + eax]
nop dword [eax]
mov esi, dword [eax - 0xc]
mov edi, dword [eax - 4]
lea ebx, [eax - 0xc]
mov dword [esp], eax
push edi
push esi
call fcn.005f0180
add esp, 8
test edi, edi
js 0x436a2c
movsd qword [esp + 0x10], xmm0
je 0x4350c0
mov dword [esp + 0xc], ebx
mov eax, dword [0x6f1130]
test eax, eax
jne 0x435075
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x436a33
mov dword [0x6f1130], eax
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x436a33
mov ebx, eax
push edi
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
movsd xmm0, qword [esp + 0x10]
ucomisd xmm0, qword [0x606310]
ja 0x435113
push ebx
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov ebx, dword [esp + 0xc]
jmp 0x4350dc
push edi
push esi
push 1
call sub.msvcrt.dll_memcpy
movsd xmm0, qword [esp + 0x1c]
add esp, 0xc
ucomisd xmm0, qword [0x606310]
ja 0x43510e
add ebx, 0xc
cmp ebx, dword [esp + 4]
je 0x4350f9
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [esp]
add eax, 0xc
jmp 0x435030
mov ebx, dword [0x6d3de0]
xor eax, eax
mov dword [esp + 0x58], 0
jmp 0x435c27
mov ebx, 1
mov eax, dword [0x6f1130]
test eax, eax
jne 0x43512e
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x436a81
mov dword [0x6f1130], eax
push 0x18
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x436a81
movsd xmm0, qword [esp + 0x10]
mov dword [esp + 8], 1
movsd qword [eax], xmm0
mov dword [eax + 8], ebx
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov ebx, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], 1
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x70], ecx
mov eax, dword [esp]
cmp eax, dword [esp + 4]
je 0x4352bb
add eax, 0xc
mov ebx, eax
jmp 0x4351c4
push edi
push esi
push 1
call sub.msvcrt.dll_memcpy
movsd xmm0, qword [esp + 0x1c]
add esp, 0xc
ucomisd xmm0, qword [0x606310]
ja 0x435256
mov eax, dword [esp + 0xc]
add ebx, 0xc
add eax, 0xc
cmp eax, dword [esp + 4]
je 0x4352af
mov edx, dword [esp + 0x70]
mov esi, dword [ebx - 0xc]
mov edi, dword [ebx - 4]
lea eax, [ebx - 0xc]
mov dword [esp + 0xc], eax
mov ecx, dword [edx]
mov edx, dword [edx + 4]
push edi
push esi
call fcn.005f0180
add esp, 8
test edi, edi
js 0x436a2c
movsd qword [esp + 0x10], xmm0
je 0x435190
mov dword [esp], ebx
mov eax, dword [0x6f1130]
test eax, eax
jne 0x435212
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x436a33
mov dword [0x6f1130], eax
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x436a33
mov ebx, eax
push edi
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
movsd xmm0, qword [esp + 0x10]
ucomisd xmm0, qword [0x606310]
ja 0x43525e
push ebx
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov ebx, dword [esp]
jmp 0x4351b0
mov dword [esp], ebx
mov ebx, 1
mov edx, dword [esp + 0x38]
cmp edx, dword [esp + 0x34]
je 0x43529a
mov ecx, dword [esp + 0x30]
lea eax, [edx + edx*2]
inc edx
mov dword [esp + 8], edx
movsd qword [ecx + eax*8], xmm0
mov dword [ecx + eax*8 + 8], ebx
mov dword [ecx + eax*8 + 0xc], edi
mov dword [ecx + eax*8 + 0x10], edi
mov ebx, ecx
mov dword [esp + 0x38], edx
mov eax, dword [esp]
cmp eax, dword [esp + 4]
jne 0x435186
jmp 0x4352bb
lea ecx, [esp + 0x30]
mov esi, edx
call fcn.004163b0
movsd xmm0, qword [esp + 0x10]
mov edx, esi
jmp 0x435268
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov esi, dword [esp + 0x34]
mov dword [esp + 0x18], ebx
cmp eax, 0x15
mov dword [esp + 0x58], esi
jae 0x435437
cmp eax, 2
jb 0x435c27
lea edi, [eax - 1]
lea eax, [eax + eax*2]
xor edx, edx
lea eax, [ebx + eax*8]
jmp 0x43531f
add esi, eax
nop dword [eax]
movsd qword [esi], xmm0
mov edx, dword [esp + 0x10]
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x38]
movsd qword [esi + 8], xmm0
movsd qword [esi + 0x10], xmm1
mov ebx, dword [esp + 0x18]
add edx, 0xffffffe8
test ecx, ecx
mov edi, ecx
je 0x435c23
cmp dword [esp + 8], 1
lea ecx, [edi - 1]
jbe 0x436a56
lea edi, [edi + edi*2]
lea esi, [ecx + ecx*2]
movsd xmm1, qword [ebx + edi*8]
movsd xmm0, qword [ebx + esi*8]
mov bl, 2
mov dword [esp], edi
ucomisd xmm1, xmm0
adc bl, 0xff
ucomisd xmm1, xmm0
sbb edi, edi
ucomisd xmm0, xmm1
movzx ebx, bl
cmovae ebx, edi
cmp bl, 0xff
jne 0x43530e
mov edi, dword [esp + 8]
mov dword [esp + 0x10], edx
sub edi, ecx
cmp edi, 3
mov edi, dword [esp + 0x18]
movsd xmm1, qword [edi + esi*8 + 8]
movsd xmm2, qword [edi + esi*8 + 0x10]
lea ebx, [edi + esi*8]
mov esi, dword [esp]
lea esi, [edi + esi*8]
movsd qword [esp + 0x38], xmm2
movsd qword [esp + 0x30], xmm1
movsd xmm1, qword [esi + 0x10]
movsd qword [ebx + 0x10], xmm1
movsd xmm1, qword [esi]
movsd xmm2, qword [esi + 8]
movsd qword [ebx + 8], xmm2
movsd qword [ebx], xmm1
jb 0x4352f0
movsd xmm1, qword [ebx + 0x30]
mov bl, 2
ucomisd xmm1, xmm0
adc bl, 0xff
ucomisd xmm1, xmm0
sbb edi, edi
ucomisd xmm0, xmm1
movzx ebx, bl
cmovae ebx, edi
mov edi, dword [esp + 0x10]
cmp bl, 0xff
jne 0x4352f0
nop dword [eax]
movsd xmm1, qword [eax + edi + 0x10]
mov esi, edi
movsd qword [eax + edi - 8], xmm1
movsd xmm1, qword [eax + edi]
movsd xmm2, qword [eax + edi + 8]
movsd qword [eax + edi - 0x10], xmm2
movsd qword [eax + edi - 0x18], xmm1
add edi, 0x18
je 0x4352ea
movsd xmm1, qword [eax + esi + 0x18]
mov bl, 2
ucomisd xmm1, xmm0
adc bl, 0xff
ucomisd xmm1, xmm0
sbb edx, edx
ucomisd xmm0, xmm1
movzx ebx, bl
cmovae ebx, edx
cmp bl, 0xff
je 0x4353e0
jmp 0x4352ea
shr eax, 1
mov ecx, 0x18
mul ecx
jo 0x436a2c
mov ecx, eax
test eax, eax
js 0x436a2c
mov eax, dword [0x6f1130]
mov dword [esp + 0xa0], ecx
test eax, eax
jne 0x435479
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x436add
mov dword [0x6f1130], eax
mov ecx, dword [esp + 0xa0]
push ecx
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
mov dword [esp + 0x10], eax
je 0x436add
lea eax, [ebx - 0x48]
mov edi, dword [0x6d6b64]
mov dword [esp + 0xa8], eax
lea eax, [ebx - 0x18]
mov dword [esp + 0x68], eax
lea eax, [ebx + 0x18]
xor ebx, ebx
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x70], edi
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
jmp 0x4354dc
mov eax, dword [esp + 0x24]
test eax, eax
je 0x435bd1
mov edx, eax
mov dword [esp], edi
dec edx
je 0x435590
mov ecx, dword [esp + 0x18]
mov edi, eax
lea esi, [eax + eax*2]
lea eax, [edx + edx*2]
mov dword [esp + 0xc], edi
movsd xmm1, qword [ecx + eax*8]
movsd xmm0, qword [ecx + esi*8 - 0x30]
mov al, 2
ucomisd xmm1, xmm0
adc al, 0xff
ucomisd xmm1, xmm0
sbb ecx, ecx
ucomisd xmm0, xmm1
movzx eax, al
cmovae eax, ecx
cmp al, 0xff
je 0x4355a0
mov eax, dword [esp + 0xa8]
lea ecx, [edi - 2]
xor edi, edi
mov dword [esp + 4], ecx
lea eax, [eax + esi*8]
nop word cs:[eax + eax]
cmp dword [esp + 4], edi
je 0x4355ec
movsd xmm1, qword [eax]
mov esi, edx
mov dl, 2
ucomisd xmm0, xmm1
adc dl, 0xff
ucomisd xmm0, xmm1
sbb ecx, ecx
ucomisd xmm1, xmm0
movzx edx, dl
movapd xmm0, xmm1
cmovae edx, ecx
inc edi
add eax, 0xffffffe8
cmp dl, 0xff
mov edx, esi
jne 0x435540
sub edx, edi
inc edi
mov esi, edx
mov edx, dword [esp + 8]
mov eax, esi
test esi, esi
jne 0x435a07
jmp 0x4355f2
mov edi, 1
jmp 0x4355f0
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x20], esi
lea eax, [eax + esi*8]
nop
cmp edx, 1
je 0x435933
movsd xmm1, qword [eax]
mov cl, 2
mov esi, edx
ucomisd xmm0, xmm1
adc cl, 0xff
ucomisd xmm0, xmm1
sbb edx, edx
ucomisd xmm1, xmm0
movzx ecx, cl
movapd xmm0, xmm1
cmovae ecx, edx
mov edx, esi
add eax, 0xffffffe8
dec edx
cmp cl, 0xff
je 0x4355b0
jmp 0x435935
mov edi, dword [esp + 0xc]
xor eax, eax
cmp ebx, dword [esp + 0x74]
jne 0x435620
lea ecx, [esp + 0x70]
mov edx, ebx
mov esi, eax
call fcn.00594830
mov eax, esi
mov esi, dword [esp + 0x70]
mov ebx, dword [esp + 0x78]
jmp 0x435623
mov esi, dword [esp]
mov dword [esi + ebx*8], eax
mov dword [esi + ebx*8 + 4], edi
mov dword [esp + 0x24], eax
mov ebx, dword [esp + 0x78]
mov edi, dword [esp + 0x70]
inc ebx
cmp ebx, 2
mov dword [esp + 0x78], ebx
jb 0x4354d0
nop word cs:[eax + eax]
nop
cmp dword [edi + ebx*8 - 8], 0
je 0x4356a0
mov edx, dword [edi + ebx*8 - 0xc]
mov eax, dword [edi + ebx*8 - 4]
cmp edx, eax
jbe 0x4356a0
cmp ebx, 3
jb 0x4354d0
mov esi, dword [edi + ebx*8 - 0x14]
mov dword [esp], edi
lea edi, [eax + edx]
lea ecx, [ebx - 3]
cmp esi, edi
jbe 0x435923
mov edi, dword [esp]
cmp ebx, 4
jb 0x4354d0
add edx, esi
cmp dword [edi + ebx*8 - 0x1c], edx
jbe 0x4356b0
jmp 0x4354d0
cmp ebx, 3
jb 0x4356b4
mov esi, dword [edi + ebx*8 - 0x14]
mov eax, dword [edi + ebx*8 - 4]
lea ecx, [ebx - 3]
cmp esi, eax
jb 0x4356b7
lea ecx, [ebx - 2]
lea eax, [ecx + 1]
cmp ebx, eax
jbe 0x4369b1
cmp ebx, ecx
jbe 0x4369c4
mov esi, dword [edi + ecx*8 + 4]
mov edx, dword [edi + ecx*8]
mov dword [esp + 0x2c], eax
mov eax, dword [edi + ecx*8 + 8]
add edx, esi
mov dword [esp + 0x1c], esi
mov ebx, edx
sub ebx, eax
jb 0x4369f5
cmp edx, dword [esp + 8]
mov esi, dword [esp + 0x18]
ja 0x436a06
mov dword [esp + 0x20], ecx
mov ecx, dword [edi + ecx*8 + 0xc]
mov dword [esp + 0x28], eax
lea eax, [eax + eax*2]
lea edi, [esi + eax*8]
lea eax, [ecx + ecx*2]
mov dword [esp + 0xc], ecx
lea esi, [edi + eax*8]
lea eax, [edx + edx*2]
mov dword [esp + 4], eax
mov eax, ebx
sub eax, ecx
cmp eax, ecx
jae 0x4357e0
mov dword [esp + 0x54], eax
lea eax, [eax*8]
lea eax, [eax + eax*2]
mov dword [esp], eax
push eax
push esi
mov ebx, dword [esp + 0x18]
push ebx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0xc]
add esp, 0xc
add edx, ebx
cmp dword [esp + 0xc], 0
jle 0x4357ce
cmp dword [esp + 0x54], 0
jle 0x4357ce
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 4]
lea eax, [eax + ecx*8]
nop word cs:[eax + eax]
nop
movsd xmm0, qword [edx - 0x18]
movsd xmm1, qword [esi - 0x18]
mov cl, 2
ucomisd xmm0, xmm1
adc cl, 0xff
ucomisd xmm0, xmm1
sbb ebx, ebx
ucomisd xmm1, xmm0
movzx ecx, cl
cmovae ecx, ebx
cmp cl, 0xff
je 0x4357a0
add edx, 0xffffffe8
mov ecx, edx
jmp 0x4357a5
add esi, 0xffffffe8
mov ecx, esi
movsd xmm0, qword [ecx + 0x10]
cmp edi, esi
movsd qword [eax + 0x10], xmm0
movsd xmm0, qword [ecx]
movsd xmm1, qword [ecx + 8]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
jae 0x4357ce
add eax, 0xffffffe8
cmp edx, dword [esp + 0x10]
ja 0x435770
mov ecx, dword [esp + 0x10]
mov edi, esi
jmp 0x4358a4
lea eax, [ecx*8]
lea eax, [eax + eax*2]
mov dword [esp], eax
push eax
push edi
push dword [esp + 0x18]
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
add esp, 0xc
add edx, dword [esp + 0x10]
test eax, eax
jle 0x4358a0
cmp ebx, eax
jle 0x4358a0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x18]
mov dword [esp], edx
lea eax, [ecx + eax*8]
mov ecx, dword [esp + 0x10]
mov dword [esp + 4], eax
nop dword [eax]
movsd xmm0, qword [esi]
movsd xmm1, qword [ecx]
mov eax, ecx
mov cl, 2
ucomisd xmm0, xmm1
adc cl, 0xff
ucomisd xmm0, xmm1
sbb edx, edx
ucomisd xmm1, xmm0
movzx ecx, cl
cmovae ecx, edx
xor ebx, ebx
xor edx, edx
cmp cl, 0xff
setne bl
lea ecx, [ebx + ebx*2]
lea ecx, [eax + ecx*8]
cmove eax, esi
movsd xmm0, qword [eax + 0x10]
movsd qword [edi + 0x10], xmm0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
sete al
cmp ecx, dword [esp]
movsd qword [edi + 8], xmm1
movsd qword [edi], xmm0
lea edi, [edi + 0x18]
jae 0x43589b
mov dl, al
lea eax, [edx + edx*2]
lea esi, [esi + eax*8]
cmp esi, dword [esp + 4]
jb 0x435830
mov edx, dword [esp]
jmp 0x4358a4
mov ecx, dword [esp + 0x10]
sub edx, ecx
mov eax, edx
mov edx, 0xaaaaaaab
mul edx
shr edx, 1
and edx, 0xfffffff8
lea eax, [edx + edx*2]
push eax
push ecx
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov ebx, dword [esp + 0x78]
mov ecx, dword [esp + 0x20]
mov eax, ebx
sub eax, ecx
jbe 0x4369d5
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x70]
mov edx, dword [esp + 0x28]
add esi, dword [esp + 0xc]
mov dword [edi + ecx*8], edx
mov dword [edi + ecx*8 + 4], esi
mov ecx, dword [esp + 0x2c]
cmp ebx, ecx
jbe 0x436a1b
lea eax, [eax*8 - 0x10]
lea esi, [edi + ecx*8]
lea edx, [edi + ecx*8 + 8]
push eax
push edx
push esi
call sub.msvcrt.dll_memmove
add esp, 0xc
dec ebx
cmp ebx, 2
mov dword [esp + 0x78], ebx
jae 0x435650
jmp 0x4354d0
mov edi, dword [esp]
cmp esi, eax
jae 0x4356b4
jmp 0x4356b7
xor edx, edx
mov eax, edi
sub edi, edx
mov dword [esp + 4], edx
jb 0x436a88
mov edx, dword [esp + 8]
cmp eax, edx
ja 0x436a9d
cmp edi, 2
jae 0x435967
mov esi, dword [esp + 4]
mov eax, esi
test esi, esi
jne 0x435a07
jmp 0x4355f2
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
mov ecx, edi
shr ecx, 1
lea eax, [eax + eax*2]
lea eax, [edx + eax*8]
mov edx, dword [esp + 0x68]
lea edx, [edx + esi*8]
nop word cs:[eax + eax]
nop
movsd xmm0, qword [eax + 0x10]
movsd qword [esp + 0x40], xmm0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
movsd qword [esp + 0x38], xmm1
movsd qword [esp + 0x30], xmm0
movsd xmm0, qword [edx + 0x10]
movsd qword [eax + 0x10], xmm0
movsd xmm0, qword [edx]
movsd xmm1, qword [edx + 8]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
add eax, 0x18
movsd xmm0, qword [esp + 0x40]
movsd qword [edx + 0x10], xmm0
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x38]
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm0
add edx, 0xffffffe8
dec ecx
jne 0x435990
mov edx, dword [esp + 8]
mov esi, dword [esp + 4]
mov eax, esi
test esi, esi
je 0x4355f2
cmp edi, 9
ja 0x4355f2
mov edi, dword [esp + 0xc]
cmp edi, edx
ja 0x436ab0
mov ecx, dword [esp + 0xc8]
mov edx, eax
lea eax, [eax + eax*2]
lea eax, [ecx + eax*8]
mov ecx, edx
not ecx
mov dword [esp + 0x20], eax
add ecx, edi
mov dword [esp + 0x2c], ecx
nop dword [eax]
mov edi, dword [esp + 0xc]
lea eax, [edx - 1]
sub edi, eax
jb 0x436a41
cmp edi, 1
jbe 0x435bb0
lea ecx, [eax + eax*2]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
lea edx, [edx + edx*2]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x28], edx
lea ecx, [eax + ecx*8]
movsd xmm1, qword [eax + edx*8]
mov dl, 2
movsd xmm0, qword [ecx]
mov dword [esp + 4], ecx
ucomisd xmm1, xmm0
adc dl, 0xff
ucomisd xmm1, xmm0
sbb eax, eax
ucomisd xmm0, xmm1
movzx edx, dl
cmovae edx, eax
mov eax, dword [esp + 0x24]
cmp dl, 0xff
jne 0x435bb0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
cmp edi, 3
lea edx, [eax + ecx*8]
mov ecx, dword [esp + 0x1c]
movsd xmm1, qword [eax + ecx*8 + 8]
movsd xmm2, qword [eax + ecx*8 + 0x10]
mov eax, dword [esp + 4]
movsd qword [esp + 0x38], xmm2
movsd qword [esp + 0x30], xmm1
movsd xmm1, qword [edx + 0x10]
movsd qword [eax + 0x10], xmm1
movsd xmm1, qword [edx]
movsd xmm2, qword [edx + 8]
movsd qword [eax + 8], xmm2
movsd qword [eax], xmm1
jb 0x435b88
movsd xmm1, qword [eax + 0x30]
mov al, 2
mov esi, dword [esp + 0x20]
ucomisd xmm1, xmm0
mov dword [esp + 4], esi
adc al, 0xff
ucomisd xmm1, xmm0
sbb ecx, ecx
ucomisd xmm0, xmm1
movzx eax, al
cmovae eax, ecx
mov ecx, dword [esp + 0x2c]
cmp al, 0xff
mov eax, dword [esp + 0x24]
jne 0x435b8c
nop word cs:[eax + eax]
nop
mov edx, dword [esp + 4]
dec ecx
movsd xmm1, qword [edx + 0x10]
movsd qword [edx - 8], xmm1
movsd xmm1, qword [edx]
movsd xmm2, qword [edx + 8]
movsd qword [edx - 0x10], xmm2
movsd qword [edx - 0x18], xmm1
je 0x435b8c
movsd xmm1, qword [edx + 0x18]
lea eax, [edx + 0x18]
mov dword [esp + 4], eax
mov al, 2
ucomisd xmm1, xmm0
adc al, 0xff
ucomisd xmm1, xmm0
sbb esi, esi
ucomisd xmm0, xmm1
movzx eax, al
mov dword [esp + 0x1c], esi
cmovae eax, dword [esp + 0x1c]
cmp al, 0xff
mov eax, dword [esp + 0x24]
je 0x435b30
jmp 0x435b8c
mov eax, dword [esp + 0x24]
movsd qword [edx], xmm0
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x38]
movsd qword [edx + 8], xmm0
movsd qword [edx + 0x10], xmm1
nop word cs:[eax + eax]
test eax, eax
je 0x4355f2
add dword [esp + 0x20], 0xffffffe8
inc dword [esp + 0x2c]
cmp edi, 0xa
mov edx, eax
jb 0x435a40
jmp 0x4355f2
test dword [esp + 0x74], 0x1fffffff
je 0x435be9
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esp + 0xa0]
mov ebx, dword [esp + 0x18]
mov ecx, 0xaaaaaaab
mov eax, esi
mul ecx
cmp esi, 0x18
jb 0x435c23
shr edx, 1
mov ecx, esi
and edx, 0xfffffff8
lea eax, [edx + edx*2]
sub ecx, eax
cmp esi, ecx
je 0x435c23
push dword [esp + 0x10]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 8]
shl eax, 3
mov ecx, 0xc
lea eax, [eax + eax*2]
mov dword [esp], eax
sar eax, 3
imul eax, eax, 0xaaaaaaab
mov esi, eax
mul ecx
jo 0x436a2c
mov edi, eax
test eax, eax
js 0x436a2c
test edi, edi
je 0x435c83
mov eax, dword [0x6f1130]
test eax, eax
jne 0x435c6d
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x435c7c
mov dword [0x6f1130], eax
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
mov ecx, eax
test eax, eax
jne 0x435c88
mov ecx, edi
jmp 0x436a75
mov ecx, 4
mov edx, 0xaaaaaaab
mov eax, edi
mov dword [esp + 0x5c], ecx
mul edx
shr edx, 3
mov dword [esp + 0x60], edx
cmp edx, esi
mov edx, dword [esp]
mov dword [esp + 0x64], 0
lea eax, [ebx + edx]
mov dword [esp + 4], eax
jb 0x435d6a
xor eax, eax
mov edi, dword [esp + 0x58]
cmp dword [esp + 4], ebx
mov dword [esp + 0x58], edi
je 0x435d97
lea esi, [eax + eax*2]
lea ecx, [ecx + esi*4]
xor esi, esi
mov dword [esp + 0x10], ecx
mov ecx, 0xffffffe8
nop dword [eax + eax]
cmp dword [ebx + esi*2 + 8], 0
je 0x435d4b
movsd xmm0, qword [ebx + esi*2 + 0x10]
lea edi, [esp + 0x38]
mov edx, ebx
inc eax
movsd qword [esp + 0x40], xmm0
movsd xmm0, qword [ebx + esi*2]
movsd xmm1, qword [ebx + esi*2 + 8]
movsd qword [esp + 0x38], xmm1
movsd qword [esp + 0x30], xmm0
movsd xmm0, qword [edi]
mov ebx, dword [edi + 8]
mov edi, dword [esp + 0x10]
movsd qword [esp + 0x70], xmm0
mov dword [esp + 0x78], ebx
mov dword [edi + esi + 8], ebx
mov ebx, dword [esp]
movsd qword [edi + esi], xmm0
add esi, 0xc
lea ebx, [ebx + ecx - 0x18]
add ecx, 0xffffffe8
cmp ebx, 0xffffffe8
mov ebx, edx
jne 0x435ce0
mov edx, dword [esp + 4]
mov edi, edx
jmp 0x435d53
mov edx, dword [esp + 4]
mov edi, ebx
sub edi, ecx
sub edx, edi
mov ecx, edx
sar ecx, 3
imul esi, ecx, 0xaaaaaaab
test edx, edx
mov dword [esp + 0x64], eax
jne 0x435da1
jmp 0x435dcf
lea ecx, [esp + 0x5c]
xor edx, edx
push esi
call fcn.004161f0
mov edx, dword [esp + 4]
add esp, 4
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x64]
mov edi, dword [esp + 0x58]
cmp dword [esp + 4], ebx
mov dword [esp + 0x58], edi
jne 0x435cca
mov edi, ebx
test edx, edx
mov dword [esp + 0x64], eax
je 0x435dcf
shl esi, 3
add edi, 0xc
lea esi, [esi + esi*2]
jmp 0x435db8
add edi, 0x18
add esi, 0xffffffe8
je 0x435dcf
cmp dword [edi], 0
je 0x435db0
push dword [edi - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x435db0
mov eax, dword [esp + 0x58]
test eax, eax
je 0x435def
shl eax, 3
lea eax, [eax + eax*2]
test eax, eax
je 0x435def
push ebx
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0x64]
mov edi, dword [esp + 0x50]
test eax, eax
je 0x435e37
dec eax
mov dword [esp + 0x64], eax
lea ecx, [eax + eax*2]
mov esi, dword [esp + 0x5c]
mov edx, dword [esi + ecx*4]
test edx, edx
mov dword [esp + 8], edx
je 0x435e37
mov edx, dword [esi + ecx*4 + 4]
mov ecx, dword [esi + ecx*4 + 8]
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x54], edx
test eax, eax
jne 0x43646f
jmp 0x43649f
mov eax, dword [esp + 0xcc]
mov dword [esp + 8], 0
test eax, eax
je 0x436040
imul eax, eax, 0x158
add eax, edi
mov dword [esp + 0xc], eax
jmp 0x435e6c
mov edi, ebx
cmp dword [esp + 0xc], edi
je 0x436040
mov ecx, edi
lea ebx, [edi + 0x158]
call fcn.0041b320
mov ecx, dword [edi + 0x11c]
mov eax, dword [edi + 0x114]
mov edx, dword [esp + 0xb8]
lea ecx, [ecx + ecx*4]
lea esi, [eax + ecx*4]
mov ecx, dword [edi + 0x38]
mov dword [esp], ecx
mov ecx, dword [edi + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x30]
push esi
push eax
push dword [esp + 0xc4]
call fcn.004234d0
add esp, 0xc
mov eax, dword [esp + 0x38]
test eax, eax
je 0x436010
lea ecx, [eax - 1]
mov dword [esp + 0x38], ecx
lea edx, [ecx + ecx*2]
mov edi, dword [esp + 0x30]
mov esi, dword [edi + edx*4]
test esi, esi
mov dword [esp + 0x1c], esi
je 0x435fd0
mov esi, dword [edi + edx*4 + 4]
mov edx, dword [edi + edx*4 + 8]
test ecx, ecx
mov dword [esp + 0x54], esi
mov dword [esp + 0x18], edx
je 0x435f20
lea eax, [eax + eax*2]
add edi, 4
lea esi, [eax*4 - 0xc]
jmp 0x435f08
add edi, 0xc
add esi, 0xfffffff4
je 0x435f20
cmp dword [edi], 0
je 0x435f00
push dword [edi - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x435f00
mov eax, dword [esp + 0x34]
test eax, eax
je 0x435f43
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x435f43
push dword [esp + 0x30]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esp + 0xc4]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x50], ebx
test esi, esi
je 0x435fa0
mov ebx, dword [esp + 0xc0]
shl esi, 3
xor ecx, ecx
jmp 0x435f76
inc ecx
add esi, 0xfffffff8
je 0x435fa0
cmp dword [ebx + ecx*8 + 4], eax
jne 0x435f70
push eax
push dword [esp + 4]
push dword [ebx + ecx*8]
mov edi, ecx
call sub.msvcrt.dll_memcmp
mov ecx, edi
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x28]
jne 0x435f70
jmp 0x436045
cmp dword [esp + 0x54], 0
mov edi, dword [esp + 0x50]
je 0x435e62
push dword [esp + 0x1c]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x435e62
test ecx, ecx
je 0x436010
lea eax, [eax + eax*2]
add edi, 4
lea esi, [eax*4 - 0xc]
jmp 0x435ff8
add edi, 0xc
add esi, 0xfffffff4
je 0x436010
cmp dword [edi], 0
je 0x435ff0
push dword [edi - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x435ff0
mov eax, dword [esp + 0x34]
test eax, eax
je 0x435e60
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x435e60
push dword [esp + 0x30]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x435e60
jmp 0x43645f
test eax, eax
js 0x436a2c
je 0x436086
mov eax, dword [0x6f1130]
test eax, eax
jne 0x436066
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x436076
mov dword [0x6f1130], eax
push dword [esp + 0x28]
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
jne 0x43608b
mov ecx, dword [esp + 0x28]
mov edx, 1
call fcn.0040a640
ud2
mov eax, 1
push dword [esp + 0x28]
push dword [esp + 4]
mov dword [esp + 0x2c], eax
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x50]
cmp eax, dword [esp + 0xc]
je 0x436445
mov edx, edi
mov dword [esp + 0x58], edi
mov edi, dword [esp + 0x50]
lea ebx, [esp + 0x30]
jmp 0x4360d8
mov edi, dword [esp + 0x50]
mov edx, dword [esp + 4]
add edi, 0x158
cmp edi, dword [esp + 0xc]
je 0x436445
mov ecx, edi
mov dword [esp + 4], edx
call fcn.0041b320
mov ecx, dword [edi + 0x11c]
mov eax, dword [edi + 0x114]
mov edx, dword [esp + 0xb8]
mov dword [esp + 0x50], edi
lea ecx, [ecx + ecx*4]
lea esi, [eax + ecx*4]
mov ecx, dword [edi + 0x38]
mov dword [esp + 0x10], ecx
mov ecx, dword [edi + 0x40]
mov dword [esp], ecx
mov ecx, ebx
push esi
push eax
push dword [esp + 0xc4]
call fcn.004234d0
add esp, 0xc
mov eax, dword [esp + 0x38]
test eax, eax
je 0x4362b0
lea ecx, [eax - 1]
mov dword [esp + 0x38], ecx
lea edx, [ecx + ecx*2]
mov esi, dword [esp + 0x30]
mov edi, dword [esi + edx*4]
test edi, edi
je 0x436270
mov ebx, dword [esi + edx*4 + 4]
mov edx, dword [esi + edx*4 + 8]
test ecx, ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], ebx
mov dword [esp + 8], edx
je 0x436190
lea eax, [eax + eax*2]
add esi, 4
lea edi, [eax*4 - 0xc]
jmp 0x436178
add esi, 0xc
add edi, 0xfffffff4
je 0x436190
cmp dword [esi], 0
je 0x436170
push dword [esi - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x436170
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4361b3
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x4361b3
push dword [esp + 0x30]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov ebx, dword [esp + 0xc4]
mov eax, dword [esp]
test ebx, ebx
je 0x436240
mov edi, dword [esp + 0xc0]
shl ebx, 3
xor esi, esi
jmp 0x4361d6
inc esi
add ebx, 0xfffffff8
je 0x436240
cmp dword [edi + esi*8 + 4], eax
jne 0x4361d0
push eax
push dword [esp + 0x14]
push dword [edi + esi*8]
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
mov eax, dword [esp]
jne 0x4361d0
test eax, eax
js 0x436a2c
mov edi, dword [esp + 0x50]
je 0x4362e0
mov eax, dword [0x6f1130]
test eax, eax
jne 0x436220
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x436ace
mov dword [0x6f1130], eax
push dword [esp]
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
jne 0x4362e5
jmp 0x436ace
cmp dword [esp + 0x20], 0
je 0x436258
push dword [esp + 0x2c]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov edi, dword [esp + 0x50]
mov edx, dword [esp + 4]
lea ebx, [esp + 0x30]
jmp 0x4360c8
test ecx, ecx
je 0x4362b0
lea eax, [eax + eax*2]
add esi, 4
lea edi, [eax*4 - 0xc]
jmp 0x436298
add esi, 0xc
add edi, 0xfffffff4
je 0x4362b0
cmp dword [esi], 0
je 0x436290
push dword [esi - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x436290
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4360c0
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x4360c0
push dword [esp + 0x30]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x4360c0
mov eax, 1
mov ebx, dword [esp]
mov dword [esp + 0x68], eax
push ebx
push dword [esp + 0x14]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x70], edx
cmp esi, edx
mov esi, dword [esp + 0x20]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
jae 0x4363e1
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
test ecx, ecx
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x24]
je 0x4363aa
push dword [esp + 0x1c]
push 0
push dword [0x6f1130]
mov esi, edx
call sub.KERNEL32.dll_HeapFree
mov edx, esi
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x84]
test eax, eax
mov eax, dword [esp + 0x2c]
lea ebx, [esp + 0x30]
mov dword [esp + 0x54], esi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x24], eax
mov eax, dword [esp]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x84]
jne 0x436423
jmp 0x4360c8
test esi, esi
je 0x43640f
push dword [esp + 0x2c]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov edx, dword [esp + 4]
mov eax, dword [esp + 0x44]
lea ebx, [esp + 0x30]
test eax, eax
lea eax, [esp + 0x44]
jne 0x436423
jmp 0x4360c8
mov eax, dword [esp + 0x68]
lea ebx, [esp + 0x30]
test eax, eax
lea eax, [esp + 0x44]
je 0x4360c8
cmp dword [eax + 4], 0
je 0x4360c8
push dword [eax]
push 0
push dword [0x6f1130]
mov esi, edx
call sub.KERNEL32.dll_HeapFree
mov edx, esi
jmp 0x4360c8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x54]
test ecx, ecx
je 0x436457
mov dword [esp + 8], ecx
jmp 0x43645f
mov dword [esp + 8], 0
mov dword [esp + 0x54], eax
mov esi, dword [esp + 0x5c]
mov eax, dword [esp + 0x64]
test eax, eax
je 0x43649f
shl eax, 2
add esi, 4
lea edi, [eax + eax*2]
jmp 0x436488
add esi, 0xc
add edi, 0xfffffff4
je 0x43649f
cmp dword [esi], 0
je 0x436480
push dword [esi - 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x436480
mov eax, dword [esp + 0x60]
test eax, eax
je 0x4364c2
shl eax, 2
lea eax, [eax + eax*2]
test eax, eax
je 0x4364c2
push dword [esp + 0x5c]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 8], 0
je 0x4365f6
mov eax, dword [esp + 0xa4]
mov edi, dword [eax]
mov eax, dword [edi + 0x11c]
test eax, eax
je 0x4365f6
mov esi, dword [edi + 0x114]
shl eax, 2
lea ebx, [eax + eax*4]
add esi, 0x10
jmp 0x43650c
add esi, 0x14
add ebx, 0xffffffec
je 0x4365f6
cmp dword [esi - 0x10], 1
jne 0x436500
lea eax, [esi - 0xc]
push eax
call fcn.005e0110
add esp, 4
cmp edx, dword [esp + 0x18]
jne 0x436500
push dword [esp + 0x18]
push dword [esp + 0xc]
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x436500
mov ecx, dword [esi]
mov edx, dword [edi + 0x110]
cmp edx, ecx
jbe 0x4369e6
mov esi, dword [edi + 0x108]
imul ebx, ecx, 0x148
mov ecx, dword [ebp + 0x10]
mov eax, dword [esi + ebx + 0x2c]
mov edx, dword [esi + ebx]
shr eax, 0x10
and eax, 1
push eax
push dword [esi + ebx + 4]
call fcn.00419600
add esp, 8
mov eax, dword [esp + 0xa4]
mov eax, dword [eax]
mov ecx, dword [eax + 0x134]
test ecx, ecx
je 0x4365f6
mov edx, dword [eax + 0x12c]
mov edi, dword [esi + ebx]
mov ebx, dword [esi + ebx + 4]
imul eax, ecx, 0x38
mov ecx, edx
add eax, edx
mov dword [esp + 4], eax
jmp 0x4365a9
mov ecx, dword [esp]
cmp dword [esp + 4], ecx
je 0x4365f6
lea eax, [ecx + 0x38]
mov edx, dword [ecx + 0x10]
mov dword [esp + 0x10], ecx
mov ecx, dword [ecx + 0x18]
mov dword [esp], eax
shl ecx, 3
nop dword [eax]
test ecx, ecx
je 0x4365a0
mov esi, dword [edx]
mov eax, dword [edx + 4]
add ecx, 0xfffffff8
add edx, 8
xor esi, edi
xor eax, ebx
or eax, esi
jne 0x4365c0
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
mov edx, dword [eax]
push 0
push dword [eax + 4]
call fcn.00419600
add esp, 8
mov ecx, dword [esp]
cmp ecx, dword [esp + 4]
jne 0x4365a9
mov eax, dword [ebp + 0x10]
mov edx, dword [esp + 0xb4]
mov ecx, dword [eax + 0x20]
imul eax, dword [eax + 0x28], 0x38
mov dword [esp + 0xc], edx
add eax, ecx
mov dword [esp + 0x2c], eax
cmp ecx, dword [esp + 0x2c]
je 0x43699d
lea eax, [ecx + 0x38]
mov dword [esp], ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], eax
mov ecx, dword [ecx]
mov edi, dword [ecx + 0x108]
imul edx, dword [ecx + 0x110], 0x148
nop dword [eax + eax]
test edx, edx
je 0x4366c3
mov eax, dword [esp]
mov esi, dword [edi]
mov ebx, dword [edi + 4]
add edx, 0xfffffeb8
mov ecx, dword [eax + 4]
mov eax, dword [eax]
xor ecx, ebx
xor eax, esi
or eax, ecx
lea ecx, [edi + 0x148]
mov edi, ecx
jne 0x436640
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], esi
mov eax, dword [edx + 4]
mov edx, dword [edx + 0xc]
shl edx, 3
lea edx, [edx + edx*2]
nop dword [eax + eax]
test edx, edx
je 0x4366b0
mov edi, dword [eax]
add edx, 0xffffffe8
xor edi, esi
mov esi, dword [eax + 4]
add eax, 0x18
xor esi, ebx
or esi, edi
mov esi, dword [esp + 0x10]
jne 0x436680
mov ecx, dword [esp + 4]
jmp 0x436611
test byte [ecx - 0x11c], 0x10
mov ecx, dword [esp + 4]
jne 0x436611
jmp 0x4366cb
mov eax, dword [esp]
mov esi, dword [eax]
mov ebx, dword [eax + 4]
mov eax, dword [0x6f1130]
test eax, eax
jne 0x4366e6
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x436a69
mov dword [0x6f1130], eax
push 8
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x436a69
mov dword [eax], esi
mov dword [eax + 4], ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], eax
mov esi, 1
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], 1
mov eax, dword [esp + 0xb4]
mov dword [esp + 0xc], eax
jmp 0x436756
mov eax, dword [esp]
mov esi, dword [esp + 0x20]
mov ebx, dword [eax]
mov edi, dword [eax + 4]
cmp esi, dword [esp + 0x34]
je 0x43682a
mov eax, dword [esp + 0x1c]
mov dword [eax + esi*8], ebx
mov dword [eax + esi*8 + 4], edi
inc esi
mov dword [esp + 0x38], esi
mov eax, dword [esp + 4]
mov dword [esp + 0x20], esi
cmp eax, dword [esp + 0x2c]
je 0x436847
mov ecx, dword [esp + 0xc]
mov dword [esp], eax
add eax, 0x38
mov dword [esp + 4], eax
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x108]
imul esi, dword [ecx + 0x110], 0x148
nop dword [eax + eax]
test esi, esi
je 0x436730
mov eax, dword [esp]
mov ebx, dword [edx]
mov edi, dword [edx + 4]
add esi, 0xfffffeb8
mov ecx, dword [eax + 4]
mov eax, dword [eax]
xor ecx, edi
xor eax, ebx
or eax, ecx
lea ecx, [edx + 0x148]
mov edx, ecx
jne 0x436790
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], ebx
mov eax, dword [edx + 4]
mov edx, dword [edx + 0xc]
shl edx, 3
lea edx, [edx + edx*2]
nop dword [eax + eax]
test edx, edx
je 0x436800
mov esi, dword [eax]
add edx, 0xffffffe8
xor esi, ebx
mov ebx, dword [eax + 4]
add eax, 0x18
xor ebx, edi
or ebx, esi
mov ebx, dword [esp + 0x10]
jne 0x4367d0
mov eax, dword [esp + 4]
mov esi, dword [esp + 0x20]
jmp 0x43675e
test byte [ecx - 0x11c], 0x10
mov eax, dword [esp + 4]
mov esi, dword [esp + 0x20]
jne 0x43675e
nop word cs:[eax + eax]
nop
cmp esi, dword [esp + 0x34]
jne 0x436746
lea ecx, [esp + 0x30]
mov edx, esi
push 1
call fcn.00416160
add esp, 4
mov eax, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
jmp 0x436746
mov eax, dword [esp + 0x30]
test dword [esp + 0x34], 0x1fffffff
mov ebx, esi
mov dword [esp], eax
sete byte [esp + 0x10]
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0xd4]
lea edi, [esp + 0x70]
lea edx, [esp + 0x30]
mov eax, dword [esi]
mov dword [esp + 0x70], ecx
lea ecx, [esp + 0x5c]
mov dword [esp + 0x30], 0x60b4a0
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], edi
mov dword [esp + 0x74], 0x5c1350
mov dword [esp + 0x44], 1
mov dword [esp + 4], eax
call fcn.0040a660
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x98], esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], edx
mov dword [esp + 0x34], ecx
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
lea edx, [esp + 0x98]
mov ecx, edi
push ebx
mov esi, dword [esp + 4]
push esi
call fcn.0041f610
add esp, 8
mov ecx, dword [esp + 0xd0]
mov edx, dword [esp + 4]
push edi
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x64]
push eax
call fcn.0044ce70
add esp, 0xc
cmp byte [esp + 0x10], 0
jne 0x43692c
push esi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0x6c], 0
mov edi, dword [esp + 0xac]
je 0x436973
mov eax, dword [esp + 0x94]
lea esi, [eax + 4]
mov eax, dword [esp + 0xb0]
jmp 0x436958
add esi, 0xc
add eax, 0xfffffff4
je 0x436973
cmp dword [esi], 0
je 0x436950
push dword [esi - 4]
push 0
push dword [0x6f1130]
mov ebx, eax
call sub.KERNEL32.dll_HeapFree
mov eax, ebx
jmp 0x436950
test edi, edi
je 0x436995
shl edi, 2
lea eax, [edi + edi*2]
test eax, eax
je 0x436995
push dword [esp + 0x94]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x6d3de0]
mov byte [esp + 0x10], 1
xor ebx, ebx
mov dword [esp], eax
jmp 0x43685d
mov ecx, eax
mov edx, ebx
push 0x6d3eb0
call fcn.0045a150
add esp, 4
ud2
mov edx, ebx
push 0x6d3ec0
call fcn.0045a150
add esp, 4
ud2
mov edx, ebx
push 0x6d0b78
call fcn.0045a150
add esp, 4
ud2
push 0x60a9b8
call fcn.0045a150
add esp, 4
ud2
mov ecx, eax
push 0x6d3ed0
call fcn.0045ce70
add esp, 4
ud2
mov ecx, edx
mov edx, dword [esp + 8]
push 0x6d3ed0
call fcn.0045ab50
add esp, 4
ud2
mov edx, ebx
push 0x6d3ee0
call fcn.0040b3d0
add esp, 4
ud2
call fcn.0040a620
ud2
mov ecx, edi
mov edx, 1
call fcn.0040a640
ud2
mov ecx, eax
mov edx, dword [esp + 0xc]
push 0x6d3ea0
call fcn.0045ce70
add esp, 4
ud2
mov edx, dword [esp + 8]
push 0x6d0b68
call fcn.0045a820
add esp, 4
ud2
mov ecx, 8
jmp 0x436ae4
mov ecx, 0xc
mov edx, 4
call fcn.0040a640
ud2
mov ecx, 0x18
jmp 0x436ae4
mov ecx, dword [esp + 4]
mov edx, eax
push 0x6d3e90
call fcn.0045ce70
add esp, 4
ud2
mov ecx, dword [esp + 0xc]
push 0x6d3e90
call fcn.0045ab50
add esp, 4
ud2
mov ecx, eax
dec ecx
cmp edi, ecx
jb 0x436a43
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0x6d3ea0
call fcn.0045ab50
add esp, 4
ud2
mov ecx, dword [esp]
mov edx, 1
call fcn.0040a640
ud2
mov ecx, dword [esp + 0xa0]
mov edx, 8
call fcn.0040a640
ud2