Function at 0xc64676
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1bd4
call fcn.00af9320
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0xc963a0
call fcn.00af8a75
and dword [ebp - 0x1740], 0
xor ebx, ebx
inc ebx
push 4
pop edi
test al, al
je 0xc6e950
xor eax, eax
mov edx, 0xc96238
mov dword [ebp - 0x1744], eax
mov dword [ebp - 0x1748], eax
mov dword [ebp - 0x1714], eax
mov dword [ebp - 0x1690], eax
mov ecx, ebx
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc646d0
mov eax, dword [0xc95890]
or ebx, 0xffffffff
mov dword [ebp - 0x174c], ebx
mov edi, 0x9fbcf2
mov dword [ebp - 0x1750], edi
mov dword [ebp - 0x1754], 0x67
mov dword [ebp - 0x1760], 0x337
test eax, eax
jne 0xc64d2c
push 0x338
mov esi, eax
mov dword [ebp - 0x1620], eax
push eax
mov dword [ebp - 0x1604], eax
mov dword [ebp - 0x15cc], esi
mov dword [ebp - 0x15bc], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x16ec], eax
test eax, eax
je 0xc64d20
xor edx, edx
mov dword [ebp - 0x6b8], 0xab69605e
add eax, 7
mov dword [ebp - 0x6b4], 0x7f1137f
mov cl, dl
mov dword [ebp - 0x15c4], edx
mov dword [ebp - 0x15ac], ebx
mov dword [ebp - 0x15b8], eax
mov dword [ebp - 0x159c], edi
mov dword [ebp - 0x158c], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0x159c]
xor edx, ebx
mov dword [ebp - 0x157c], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0x159c]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0x159c]
shl edi, 8
add dword [ebp - 0x159c], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
mov dword [ebp - 0x1594], esi
mov esi, edx
xor esi, dword [ebp - 0x1594]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x157c]
xor eax, edx
mov dword [ebp - 0x157c], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x157c]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x157c]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x157c], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x157c]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x157c]
xor edx, eax
mov dword [ebp - 0x157c], edx
mov eax, dword [ebp - 0x157c]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x157c]
xor eax, edx
mov dword [ebp - 0x157c], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x157c]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x157c]
xor eax, edx
mov dword [ebp - 0x157c], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x157c]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0x157c]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0x1594], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1594]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x1594]
xor eax, edx
mov dword [ebp - 0x1594], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x1594], edx
mov edx, dword [ebp - 0x1594]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x1594], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1594]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x1594]
xor eax, edx
mov dword [ebp - 0x1594], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1594]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x1594]
xor eax, edx
mov dword [ebp - 0x1594], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1594]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x1594]
xor edx, dword [ebp - 0x15c4]
xor eax, dword [ebp - 0x15ac]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x157c], esi
mov esi, dword [ebp - 0x15b8]
mov dword [ebp - 0x15ac], edi
mov edi, dword [ebp - 0x159c]
mov dword [ebp - 0x15c4], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x158c], 1
mov dword [ebp - 0x15b8], esi
mov esi, eax
mov dword [ebp - 0x1594], eax
jne 0xc64789
mov esi, dword [ebp - 0x16ec]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc64b0a
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc64b3c
cmp edx, dword [0x9fc02c]
jne 0xc64b3c
mov edi, esi
xor eax, eax
mov dword [ebp - 0x15cc], edi
mov esi, eax
mov ebx, 0x337
jmp 0xc64b51
mov edi, dword [ebp - 0x15cc]
or ebx, 0xffffffff
mov dword [ebp - 0x15bc], 0xc004d501
xor eax, eax
test esi, esi
je 0xc64b64
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x15bc], 0
jl 0xc64d1a
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xc960a0
push eax
push ebx
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xc64cae
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1740]
jne 0xc64b9b
sub ecx, ebx
xor eax, eax
sar ecx, 1
push edi
push edx
push eax
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc64d13
xor eax, eax
mov edx, 0x5a4d
mov ecx, eax
mov eax, dword [edi]
mov dword [ebp - 0x1604], ecx
cmp word [eax], dx
je 0xc64bea
mov ecx, 0xc000007b
mov dword [ebp - 0x1604], ecx
jmp 0xc64c34
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc64bdd
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc64bdd
cmp dword [edx], 0x4550
jne 0xc64bdd
movzx eax, word [edx + 0x18]
mov ebx, 0x10b
cmp ax, bx
je 0xc64c22
mov ebx, 0x20b
cmp ax, bx
je 0xc64c22
mov ecx, 0xc000000d
jmp 0xc64be2
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0x1594], eax
xor edx, edx
mov ebx, edx
test eax, eax
je 0xc64ca2
mov edx, esi
mov dword [ebp - 0x157c], esi
lea eax, [edx + 1]
mov dword [ebp - 0x158c], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc64c5a
sub edx, dword [ebp - 0x158c]
inc esi
add esi, edx
test ecx, ecx
js 0xc64c93
push dword [ebp - 0x157c]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc64cae
mov ecx, dword [ebp - 0x1620]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x1604]
inc dword [ebp - 0x1620]
inc ebx
cmp ebx, dword [ebp - 0x1594]
jb 0xc64c49
add edi, 0x10
cmp byte [esi], 0
jne 0xc64b94
mov ebx, dword [ebp - 0x1604]
mov esi, dword [ebp - 0x15cc]
test esi, esi
je 0xc64ccf
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc64d27
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc64ce8
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc64cd7
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc64d32
mov ebx, 0xc000007a
jmp 0xc64cb4
mov esi, dword [ebp - 0x15cc]
mov ebx, 0xc000007a
jmp 0xc64cba
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x1594], eax
mov edi, eax
mov dword [ebp - 0x157c], eax
mov dword [ebp - 0x158c], eax
mov eax, dword fs:[0x30]
cmp dword [eax + 0x1d4], ecx
je 0xc6502b
mov esi, dword [0xc93088]
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x159c], ecx
test ecx, ecx
jne 0xc64d8c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc65075
xor eax, eax
xor edx, edx
mov esi, eax
mov dword [ebp - 0x158c], eax
mov ebx, dword [0xc93098]
lea edx, [ebp - 0x1770]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xc64e1d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc64dff
xor eax, eax
test esi, esi
jne 0xc64df8
push dword [ebp - 0x1770]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc64df1
mov eax, dword [ebp - 0x1770]
mov ecx, dword [ebp - 0x159c]
jmp 0xc64d98
mov ebx, 0x8007000e
jmp 0xc64e19
mov ebx, 0x80004005
jmp 0xc64e2d
test eax, eax
jne 0xc64e0a
mov ebx, 0x80004005
jmp 0xc64e19
jg 0xc64e10
mov ebx, eax
jmp 0xc64e19
movzx ebx, ax
or ebx, 0x80070000
xor eax, eax
jmp 0xc64e2d
mov ebx, dword [ebp - 0x158c]
xor eax, eax
mov dword [ebp - 0x1594], esi
mov esi, eax
test esi, esi
je 0xc64e40
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc65056
mov esi, dword [0xc93094]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x159c], ecx
test ecx, ecx
jne 0xc64e92
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc64e82
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc65056
mov ebx, 0x80004005
jmp 0xc65056
xor eax, eax
xor edx, edx
mov esi, eax
mov dword [ebp - 0x158c], eax
mov ebx, dword [0xc93098]
lea edx, [ebp - 0x177c]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xc64f2f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc64f0b
xor eax, eax
test esi, esi
jne 0xc64efe
push dword [ebp - 0x177c]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc64ef7
mov eax, dword [ebp - 0x177c]
mov ecx, dword [ebp - 0x159c]
jmp 0xc64e9e
mov ebx, 0x8007000e
jmp 0xc64f25
mov ebx, 0x80004005
mov dword [ebp - 0x158c], ebx
jmp 0xc64f3b
test eax, eax
jne 0xc64f16
mov ebx, 0x80004005
jmp 0xc64f25
jg 0xc64f1c
mov ebx, eax
jmp 0xc64f25
movzx ebx, ax
or ebx, 0x80070000
mov dword [ebp - 0x158c], ebx
xor eax, eax
jmp 0xc64f3b
mov ebx, dword [ebp - 0x158c]
xor eax, eax
mov edi, esi
mov esi, eax
test esi, esi
je 0xc64f4e
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc6503b
mov eax, dword [ebp - 0x1594]
test eax, eax
je 0xc6502f
push 4
mov ecx, 0x9fb9c0
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xc64f93
test dx, dx
je 0xc64f8c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xc64f93
add eax, esi
add ecx, esi
test dx, dx
jne 0xc64f6c
xor ebx, ebx
xor eax, eax
inc ebx
jmp 0xc64f9a
sbb eax, eax
xor ebx, ebx
inc ebx
or eax, ebx
test eax, eax
jne 0xc6502f
test edi, edi
je 0xc6502f
mov ecx, 0x9f98b0
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xc64fd5
test dx, dx
je 0xc64fd1
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xc64fd5
add eax, esi
add ecx, esi
test dx, dx
jne 0xc64fb1
xor eax, eax
jmp 0xc64fd9
sbb eax, eax
or eax, ebx
test eax, eax
jne 0xc6502f
mov dword [ebp - 0x16d4], eax
lea eax, [ebp - 0x16d4]
push esi
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
jne 0xc6501e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc65015
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc65041
mov ebx, 0x80004005
jmp 0xc65041
test byte [ebp - 0x16d4], 0xf
jne 0xc6502f
mov eax, ebx
jmp 0xc65035
mov eax, ecx
jmp 0xc65035
mov eax, dword [ebp - 0x157c]
mov dword [ebp - 0x1690], eax
mov ebx, dword [ebp - 0x158c]
test edi, edi
je 0xc65056
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1594]
test eax, eax
je 0xc65071
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc6507d
xor eax, eax
mov dword [ebp - 0x1690], eax
push 4
pop eax
push eax
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x1594], esi
test esi, esi
jne 0xc65188
mov ebx, 0x8007000e
mov eax, dword [ebp - 0x16d4]
mov dword [ebp - 0x1714], eax
mov edx, 0xc96238
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc650af
mov eax, dword [0xc95890]
mov esi, dword [ebp - 0x1594]
test eax, eax
jle 0xc65119
sub eax, 1
mov dword [0xc95890], eax
jne 0xc65119
xor eax, eax
mov edi, eax
mov eax, dword [edi + 0xc960a0]
test eax, eax
je 0xc650ea
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xc650d9
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1594]
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
test esi, esi
je 0xc6512d
push esi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, dword [ebp - 0x1748]
test ebx, ebx
jns 0xc6e934
cmp ebx, 0xd0000034
je 0xc65167
cmp ebx, 0xd00000e5
je 0xc6e927
cmp ebx, 0xc004d501
je 0xc6e927
cmp ebx, 0xd000003e
jne 0xc6e92c
push 4
pop edi
test eax, eax
je 0xc6517d
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x1748], eax
mov esi, dword [ebp - 0x1744]
jmp 0xc6f42f
xor eax, eax
lea edi, [ebp - 0x1aa0]
mov dword [ebp - 0x157c], eax
mov dword [ebp - 0x158c], eax
mov dword [ebp - 0x159c], eax
mov dword [ebp - 0x1a8c], eax
mov dword [ebp - 0x15b8], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x15ac], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x15c4], eax
mov ebx, 0xc0000017
mov dword [ebp - 0x16ec], 0x38
test eax, eax
je 0xc67eaa
push 0x28
pop ecx
mov esi, 0xc94ea0
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, eax
mov dword [ebp - 0x157c], edi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x15cc], ecx
test ecx, ecx
jne 0xc65226
mov dword [ebp - 0x15bc], ebx
jmp 0xc67eb6
mov eax, dword [0xc94e98]
mov dword [ecx], eax
mov eax, dword [0xc94e9c]
mov dword [ecx + 4], eax
mov dword [ebp - 0x158c], ecx
rdtsc
mov dword [ebp - 0x1604], eax
mov dword [ebp - 0x1620], edx
xor eax, eax
mov dword [ebp - 0x1788], eax
lea eax, [ebp - 0x1798]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov esi, dword [ebp - 0x1798]
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
jns 0xc65281
mov esi, dword [ebp - 0x17ac]
jmp 0xc67eb6
lea eax, [ebp - 0x1788]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x15bc], ebx
jl 0xc67eb6
lea eax, [ebp - 0x17c4]
mov edx, 0xa0
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67eb6
mov esi, dword [ebp - 0x17c4]
mov ecx, dword [ebp - 0x1788]
lea eax, [ebp - 0x1788]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x15bc], ebx
jl 0xc67eb6
lea eax, [ebp - 0x17c8]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67eb6
mov esi, dword [ebp - 0x17c8]
mov ecx, dword [ebp - 0x1788]
lea eax, [ebp - 0x1788]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x15bc], ebx
jl 0xc67eb6
lea eax, [ebp - 0x17cc]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67eb6
mov esi, dword [ebp - 0x17cc]
mov ecx, dword [ebp - 0x1788]
lea eax, [ebp - 0x1788]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x15bc], ebx
jl 0xc67eb6
lea eax, [ebp - 0x17d0]
mov edx, SysReAllocString
push eax
mov ecx, 0x9fe768
call fcn.00a41606
test eax, eax
jns 0xc653c1
mov ebx, 0xc000003e
jmp 0xc6521b
mov edx, dword [ebp - 0x17d0]
lea eax, [ebp - 0x17d4]
push eax
inc edx
push 4
pop eax
mov dword [ebp - 0x17d0], edx
mov ecx, eax
add edx, edx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67eb6
mov esi, dword [ebp - 0x17d4]
mov ecx, dword [ebp - 0x1788]
lea eax, [ebp - 0x1788]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x15bc], ebx
jl 0xc67eb6
lea eax, [ebp - 0x17d8]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67eb6
mov esi, dword [ebp - 0x17d8]
mov ecx, dword [ebp - 0x1788]
lea eax, [ebp - 0x1788]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x15bc], ebx
jl 0xc67eb6
lea eax, [ebp - 0x17dc]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67eb6
mov esi, dword [ebp - 0x17dc]
mov ecx, dword [ebp - 0x1788]
lea eax, [ebp - 0x1788]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x15bc], ebx
jl 0xc67eb6
mov eax, dword [ebp - 0x1788]
push eax
push 8
mov dword [ebp - 0x1a90], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x1580], edi
test edi, edi
jne 0xc654f3
mov ebx, 0xc0000017
jmp 0xc67eaa
mov eax, edi
mov dword [ebp - 0x159c], eax
mov dword [ebp - 0x1a8c], eax
xor eax, eax
mov esi, eax
mov dword [ebp - 0x1588], esi
mov dword [ebp - 0x17e0], eax
mov dword [ebp - 0x17e4], edi
push 4
pop ecx
lea eax, [ebp - 0x1a3c]
mov dword [ebp - 0x1a40], ecx
mov edx, ecx
mov ecx, edi
push eax
call fcn.00a32533
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x15bc], ebx
mov ecx, eax
test ebx, ebx
js 0xc65578
mov ecx, dword [ebp - 0x1788]
lea eax, [edi + 8]
add ecx, edi
cmp eax, ecx
jbe 0xc65559
mov ebx, 0xc0000023
jmp 0xc67eaa
push 4
pop eax
mov dword [edi], eax
xor edx, edx
mov eax, dword [ebp - 0x1a3c]
mov dword [eax], edx
xor eax, eax
lea esi, [eax + 1]
mov dword [ebp - 0x1588], esi
lea ecx, [eax + 1]
jmp 0xc6557a
xor edx, edx
test ebx, ebx
js 0xc67eb0
mov dword [ebp - 0x155c], edx
mov eax, edi
mov dword [ebp - 0x17e8], eax
test ecx, ecx
je 0xc6560a
mov edx, dword [eax]
lea ecx, [ebp - 0x17ec]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc655c1
mov eax, dword [ebp - 0x17ec]
mov dword [ebp - 0x17f0], eax
jmp 0xc655c7
mov eax, dword [ebp - 0x17f0]
test ebx, ebx
js 0xc67eb0
lea ecx, [ebp - 0x17e8]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0x17e8]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67eb0
mov eax, dword [ebp - 0x155c]
inc eax
mov dword [ebp - 0x155c], eax
cmp eax, esi
mov eax, dword [ebp - 0x17e8]
jb 0xc65594
lea ecx, [ebp - 0x1a5c]
mov dword [ebp - 0x1a60], 0xa0
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67eb0
mov edx, dword [ebp - 0x17e8]
mov ecx, dword [ebp - 0x1788]
add ecx, edi
lea eax, [edx + 0xa4]
cmp eax, ecx
ja 0xc6554f
mov esi, dword [ebp - 0x15c4]
mov edi, dword [ebp - 0x1a5c]
push 0x28
pop ecx
mov dword [edx], 0xa0
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1588]
mov edi, dword [ebp - 0x1580]
inc esi
mov dword [ebp - 0x1588], esi
test ebx, ebx
js 0xc67eb0
xor ecx, ecx
mov eax, edi
mov dword [ebp - 0x155c], eax
mov dword [ebp - 0x1580], ecx
test esi, esi
je 0xc656fd
mov edx, dword [eax]
lea ecx, [ebp - 0x17f4]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc656c6
mov eax, dword [ebp - 0x17f4]
mov dword [ebp - 0x17f8], eax
jmp 0xc656cc
mov eax, dword [ebp - 0x17f8]
test ebx, ebx
js 0xc67eb0
add eax, dword [ebp - 0x155c]
cmp eax, dword [ebp - 0x155c]
jb 0xc657c7
mov ecx, dword [ebp - 0x1580]
inc ecx
mov dword [ebp - 0x155c], eax
mov dword [ebp - 0x1580], ecx
cmp ecx, esi
jb 0xc65699
lea ecx, [ebp - 0x19c4]
mov dword [ebp - 0x19c8], 8
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67eb0
mov edx, dword [ebp - 0x155c]
mov ecx, dword [ebp - 0x1788]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xc6554f
mov ecx, dword [ebp - 0x19c4]
inc esi
mov dword [edx], 8
mov edx, dword [ebp - 0x15cc]
mov dword [ebp - 0x1588], esi
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
test ebx, ebx
js 0xc67eb0
mov eax, dword [ebp - 0x1604]
xor ecx, ecx
mov dword [ebp - 0x19d0], eax
mov eax, dword [ebp - 0x1620]
mov dword [ebp - 0x19cc], eax
mov eax, edi
mov dword [ebp - 0x155c], eax
mov dword [ebp - 0x1580], ecx
test esi, esi
je 0xc65804
mov edx, dword [eax]
lea ecx, [ebp - 0x1800]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc657d1
mov eax, dword [ebp - 0x1800]
mov dword [ebp - 0x1804], eax
jmp 0xc657d7
mov ebx, 0xc0000095
jmp 0xc67eaa
mov eax, dword [ebp - 0x1804]
test ebx, ebx
js 0xc67eb0
add eax, dword [ebp - 0x155c]
cmp eax, dword [ebp - 0x155c]
jb 0xc657c7
mov ecx, dword [ebp - 0x1580]
inc ecx
mov dword [ebp - 0x155c], eax
mov dword [ebp - 0x1580], ecx
cmp ecx, esi
jb 0xc6579a
lea ecx, [ebp - 0x19f4]
mov dword [ebp - 0x19f8], 8
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67eb0
mov edx, dword [ebp - 0x155c]
mov ecx, dword [ebp - 0x1788]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xc6554f
mov eax, dword [ebp - 0x19f4]
inc esi
mov ecx, dword [ebp - 0x1604]
mov dword [edx], 8
mov dword [ebp - 0x1588], esi
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1620]
mov dword [eax + 4], ecx
test ebx, ebx
js 0xc67eb0
lea eax, [ebp - 0x180c]
mov edx, SysReAllocString
push eax
mov ecx, 0x9fe768
call fcn.00a41606
test eax, eax
jns 0xc6589a
mov ebx, 0xc000003e
jmp 0xc67eaa
mov ecx, dword [ebp - 0x180c]
lea eax, [ebp - 0x180c]
xor edx, edx
push eax
inc edx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67eb0
mov eax, dword [ebp - 0x180c]
lea edx, [eax + eax]
mov dword [ebp - 0x155c], edx
test edx, edx
je 0xc6597a
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x1580], ecx
mov ebx, eax
test esi, esi
je 0xc65903
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0xc6594e
add eax, ecx
cmp eax, ecx
jb 0xc6594e
inc ebx
mov ecx, eax
mov dword [ebp - 0x1580], ecx
cmp ebx, esi
jb 0xc658e6
lea eax, [ebp - 0x1a7c]
mov dword [ebp - 0x1a80], edx
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67eb0
mov eax, dword [ebp - 0x155c]
mov ecx, dword [ebp - 0x1788]
add eax, 4
mov edx, dword [ebp - 0x1580]
add ecx, edi
add eax, edx
cmp eax, ecx
jbe 0xc65955
mov ebx, 0xc0000023
jmp 0xc6597f
mov ebx, 0xc0000095
jmp 0xc6597f
mov eax, dword [ebp - 0x155c]
push eax
push 0x9fe768
push dword [ebp - 0x1a7c]
mov dword [edx], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
inc esi
mov dword [ebp - 0x1588], esi
jmp 0xc65985
mov ebx, 0xc000000d
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67eb0
mov eax, dword [ebp - 0x1690]
mov ecx, edi
mov dword [ebp - 0x181c], eax
xor eax, eax
mov dword [ebp - 0x155c], ecx
mov edx, eax
test esi, esi
je 0xc659d0
push 4
pop ebx
mov eax, dword [ecx]
add eax, 4
cmp eax, ebx
jb 0xc65ab8
add eax, ecx
cmp eax, ecx
jb 0xc657c7
inc edx
mov ecx, eax
mov dword [ebp - 0x155c], ecx
cmp edx, esi
jb 0xc659ac
push 4
pop edx
lea eax, [ebp - 0x1a84]
mov dword [ebp - 0x1a88], edx
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67eb0
mov edx, dword [ebp - 0x155c]
mov ecx, dword [ebp - 0x1788]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xc6554f
mov ecx, dword [ebp - 0x1690]
inc esi
push 4
pop eax
mov dword [edx], eax
mov eax, dword [ebp - 0x1a84]
mov dword [ebp - 0x1588], esi
mov dword [eax], ecx
test ebx, ebx
js 0xc67eb0
push 4
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x155c], ecx
mov edx, eax
pop ebx
mov dword [ebp - 0x1820], ebx
test esi, esi
je 0xc65a69
mov eax, dword [ecx]
add eax, 4
cmp eax, ebx
jb 0xc65ac8
add eax, ecx
cmp eax, ecx
jb 0xc657c7
inc edx
mov ecx, eax
mov dword [ebp - 0x155c], ecx
cmp edx, esi
jb 0xc65a49
lea eax, [ebp - 0x1a04]
mov dword [ebp - 0x1a08], ebx
push eax
mov edx, ebx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc65ad3
mov edx, dword [ebp - 0x155c]
mov ecx, dword [ebp - 0x1788]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xc6554f
mov eax, dword [ebp - 0x1a04]
inc esi
push 4
pop ecx
mov dword [edx], ecx
mov dword [eax], ecx
mov dword [ebp - 0x1588], esi
jmp 0xc65ad6
mov ebx, 0xc0000095
mov dword [ebp - 0x15bc], ebx
jmp 0xc65a28
mov ebx, 0xc0000095
mov dword [ebp - 0x15bc], ebx
push 4
pop ecx
test ebx, ebx
js 0xc67eb0
lea eax, [ebp - 0x1824]
mov edx, ecx
push eax
call fcn.00a32533
mov esi, dword [ebp - 0x1824]
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
jns 0xc65b09
mov esi, dword [ebp - 0x1830]
jmp 0xc65c87
lea eax, [ebp - 0x1834]
mov dword [ebp - 0x173c], esi
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc65c87
mov esi, dword [ebp - 0x1834]
mov ecx, dword [ebp - 0x173c]
lea eax, [ebp - 0x173c]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc65c87
lea eax, [ebp - 0x1838]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc65c87
mov esi, dword [ebp - 0x1838]
mov ecx, dword [ebp - 0x173c]
lea eax, [ebp - 0x173c]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc65c87
lea eax, [ebp - 0x185c]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc65c87
mov esi, dword [ebp - 0x185c]
mov ecx, dword [ebp - 0x173c]
lea eax, [ebp - 0x173c]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc65c87
lea eax, [ebp - 0x1860]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc65c87
mov esi, dword [ebp - 0x1860]
mov ecx, dword [ebp - 0x173c]
lea eax, [ebp - 0x173c]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc65c87
lea eax, [ebp - 0x16a8]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc65c87
mov esi, dword [ebp - 0x16a8]
mov ecx, dword [ebp - 0x173c]
lea eax, [ebp - 0x173c]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0x173c]
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
jns 0xc65c8d
mov eax, dword [ebp - 0x16a8]
mov dword [ebp - 0x155c], eax
test ebx, ebx
js 0xc67eb0
xor eax, eax
xor ecx, ecx
mov esi, eax
mov dword [ebp - 0x1580], eax
mov dword [ebp - 0x15cc], eax
mov dword [ebp - 0x1564], eax
mov dword [ebp - 0x1584], eax
mov dword [ebp - 0x1568], eax
mov dword [ebp - 0x156c], eax
mov dword [ebp - 0x1554], eax
mov dword [ebp - 0x15c8], eax
rdtsc
mov dword [ebp - 0x15c4], esi
mov dword [ebp - 0x1570], ecx
mov dword [ebp - 0x15bc], eax
mov dword [ebp - 0x1578], edx
push 8
pop eax
mov dword [ebp - 0x1864], eax
mov edx, dword [ebp - 0x1788]
lea ecx, [ebp - 0x1864]
push ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc65e04
mov eax, dword [ebp - 0x1864]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0x1574], ecx
cmp ecx, eax
jae 0xc65d32
mov ebx, 0xc0000095
jmp 0xc65e04
mov dword [ebp - 0x1864], ecx
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xc65d58
mov ebx, 0xc0000017
jmp 0xc65dfe
mov eax, dword [ebp - 0x1588]
mov ecx, esi
mov dword [esi], eax
lea eax, [ebp - 0x1868]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0x1868], esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc65de9
mov ecx, dword [ebp - 0x1868]
mov eax, dword [ebp - 0x1788]
mov dword [ecx], eax
lea eax, [ebp - 0x1868]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc65de9
mov eax, dword [ebp - 0x1574]
push dword [ebp - 0x1788]
mov ecx, dword [ebp - 0x15bc]
push edi
push dword [ebp - 0x1868]
mov dword [esi + eax - 8], ecx
mov ecx, dword [ebp - 0x1578]
mov dword [esi + eax - 4], ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov dword [ebp - 0x1580], esi
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x1574]
mov dword [ebp - 0x15c4], eax
test esi, esi
je 0xc65dfe
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0x15c4]
or ebx, 0x10000000
mov dword [ebp - 0x15bc], ebx
jl 0xc677bf
xor eax, eax
mov dword [ebp - 0x1574], eax
cmp dword [ebp - 0x1580], eax
jne 0xc65e30
mov ebx, 0xc000000d
jmp 0xc66481
test esi, esi
je 0xc6647c
lea ebx, [esi + 8]
push ebx
push eax
mov dword [ebp - 0x1578], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x15bc], edi
test edi, edi
je 0xc6647c
xor eax, eax
mov cl, al
mov edx, eax
test esi, esi
je 0xc65e78
mov eax, dword [ebp - 0x1580]
xor cl, byte [edx + eax]
inc edx
cmp edx, esi
jb 0xc65e70
mov eax, esi
mov dword [ebp - 0x6c0], 0xb1b54a58
shr eax, 3
mov dword [ebp - 0x6bc], 0xc81ecb17
mov dword [ebp - 0x1590], eax
test eax, eax
je 0xc66290
movzx edx, word [ebp - 0x6be]
mov eax, 0xc81ecb17
movzx esi, ax
add edi, 7
movzx eax, word [ebp - 0x6ba]
mov dword [ebp - 0x1560], eax
mov eax, 0xb1b54a58
movzx eax, ax
mov dword [ebp - 0x1558], esi
mov esi, dword [ebp - 0x1580]
mov dword [ebp - 0x15a4], eax
add esi, 2
xor eax, eax
mov dword [ebp - 0x15a8], edx
mov dword [ebp - 0x15b4], edi
mov edx, eax
mov dword [ebp - 0x1598], esi
or ebx, 0xffffffff
mov dword [ebp - 0x15b0], eax
mov dword [ebp - 0x15a0], eax
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0x1598]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0x1598]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0x1598]
shl esi, 8
add dword [ebp - 0x1598], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov eax, ebx
sub eax, dword [ebp - 0x15a4]
xor eax, edi
xor eax, edx
xor eax, 0xc81ecb17
mov edx, eax
mov dword [ebp - 0x15c0], eax
xor edx, 0xc81ecb17
ror eax, 7
ror edx, 0xf
imul edx, dword [ebp - 0x15a8]
add edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
mov eax, ebx
ror eax, 0xa
lea edx, [ebx + edx]
ror edx, 9
imul edx, dword [ebp - 0x1558]
sub edx, eax
mov eax, dword [ebp - 0x15c0]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x15c0], eax
xor edx, dword [ebp - 0x1558]
rol edx, 4
imul edx, dword [ebp - 0x1560]
rol eax, 5
add edx, eax
mov eax, 0xc81ecb17
xor ebx, edx
mov edx, ebx
xor edx, 0xb1b54a58
sub eax, edx
mov edx, dword [ebp - 0x15c0]
xor edx, eax
mov dword [ebp - 0x15c0], edx
sub edx, dword [ebp - 0x15a4]
imul edx, dword [ebp - 0x15a8]
mov eax, dword [ebp - 0x15c0]
shr eax, 6
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0x15c0]
mov eax, ebx
ror eax, 0xf
xor eax, dword [ebp - 0x1558]
imul eax, dword [ebp - 0x15a4]
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [ebp - 0x1560]
imul eax, dword [ebp - 0x1558]
xor ebx, eax
mov eax, ebx
sub eax, dword [ebp - 0x15a4]
sub eax, 0xc81ecb17
xor edx, eax
mov dword [ebp - 0x15c0], edx
mov eax, dword [ebp - 0x15c0]
xor eax, dword [ebp - 0x1560]
imul eax, dword [ebp - 0x15a8]
ror edx, 0xa
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0x15a4]
rol edx, 6
imul edx, dword [ebp - 0x1558]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0x15c0]
xor eax, edx
mov dword [ebp - 0x15c0], eax
ror eax, 0xf
sub eax, dword [ebp - 0x1560]
imul eax, dword [ebp - 0x15a4]
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0x1560]
imul edx, dword [ebp - 0x15a4]
shr eax, 1
xor edx, eax
mov eax, ebx
xor dword [ebp - 0x15c0], edx
mov edx, ebx
sub edx, dword [ebp - 0x1558]
rol edx, 3
imul edx, dword [ebp - 0x15a4]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0x15c0]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x15c0], eax
sub edx, dword [ebp - 0x1558]
imul edx, dword [ebp - 0x15a8]
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 9
imul edx, dword [ebp - 0x1558]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0x15c0]
xor eax, edx
mov dword [ebp - 0x15c0], eax
sub eax, dword [ebp - 0x1560]
sub eax, 0xb1b54a58
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0x15a8]
imul eax, dword [ebp - 0x15a4]
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0x15c0]
xor edx, eax
mov dword [ebp - 0x15c0], edx
xor edx, dword [ebp - 0x1560]
mov eax, dword [ebp - 0x15c0]
rol edx, 4
imul edx, dword [ebp - 0x15a8]
ror eax, 0x10
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 0xa
imul edx, dword [ebp - 0x1558]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0x15c0]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x15c0], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, dword [ebp - 0x1560]
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, 0xc81ecb17
rol eax, 2
rol edx, 8
imul edx, dword [ebp - 0x15a4]
sub edx, eax
mov eax, dword [ebp - 0x15c0]
xor eax, edx
mov edx, 0xc81ecb17
sub edx, eax
mov dword [ebp - 0x15c0], eax
ror edx, 0xb
imul edx, dword [ebp - 0x15a8]
ror eax, 0xc
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0x15a8]
imul edx, dword [ebp - 0x1558]
shr eax, 8
xor edx, eax
mov eax, dword [ebp - 0x15c0]
xor eax, edx
mov edx, dword [ebp - 0x15b4]
xor ebx, eax
xor eax, dword [ebp - 0x15b0]
xor ebx, 0xc81ecb17
mov dword [ebp - 0x15b0], edi
xor ebx, 0xb1b54a58
xor ebx, dword [ebp - 0x15a0]
mov byte [edx - 4], al
mov byte [edx], bl
ror eax, 8
mov byte [edx - 5], al
ror ebx, 8
mov byte [edx - 1], bl
ror eax, 8
mov byte [edx - 6], al
ror ebx, 8
mov byte [edx - 2], bl
ror eax, 8
ror ebx, 8
mov byte [edx - 7], al
mov byte [edx - 3], bl
add edx, 8
ror eax, 8
ror ebx, 8
sub dword [ebp - 0x1590], 1
mov dword [ebp - 0x15a0], esi
mov esi, dword [ebp - 0x1598]
mov dword [ebp - 0x15b4], edx
mov edx, eax
mov dword [ebp - 0x15c0], eax
jne 0xc65f00
mov esi, dword [ebp - 0x15c4]
mov edi, dword [ebp - 0x15bc]
mov ebx, dword [ebp - 0x1578]
movzx eax, cl
cdq
mov dword [edi + esi], eax
mov dword [edi + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x15c0], esi
test esi, esi
jne 0xc662c2
mov ebx, 0xc0000017
jmp 0xc663dd
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc662e4
mov ebx, 0xc0000017
xor eax, eax
jmp 0xc6636a
mov dword [esi + 4], eax
push ebx
push edi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [esi + 8], eax
push eax
push 8
pop ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc662d8
mov dword [esi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x15c0]
push ebx
push ebx
mov dword [esi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, dword [ebp - 0x15bc]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0xc6634c
mov ebx, 0xc0000017
jmp 0xc6636a
mov dword [esi + 0x14], ecx
mov ebx, eax
mov eax, dword [0xc94e90]
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ecx + 4], eax
xor eax, eax
mov dword [ebp - 0x1574], esi
mov esi, eax
test esi, esi
je 0xc663dd
cmp dword [esi + 4], 0
je 0xc6638c
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
jmp 0xc6638e
xor eax, eax
cmp dword [esi + 0xc], 0
je 0xc663ac
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0xc663ae
xor eax, eax
cmp dword [esi + 0x14], 0
je 0xc663cc
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
jmp 0xc663ce
xor eax, eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc663f3
mov eax, dword [ebp - 0x1574]
mov dword [ebp - 0x15cc], eax
xor eax, eax
mov esi, eax
jmp 0xc663fb
mov esi, dword [ebp - 0x1574]
xor eax, eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
je 0xc66481
xor eax, eax
cmp dword [esi + 4], eax
je 0xc6642b
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xc66449
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0xc6644b
xor eax, eax
cmp dword [esi + 0x14], 0
je 0xc66469
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
jmp 0xc6646b
xor eax, eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc66481
mov ebx, 0xc0000001
or ebx, 0x10000000
mov dword [ebp - 0x15bc], ebx
jl 0xc677bf
mov esi, dword [ebp - 0x15cc]
lea eax, [ebp - 0x186c]
push 4
pop edi
push eax
mov edx, dword [esi]
mov ecx, edi
mov dword [ebp - 0x186c], edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc66528
mov ecx, dword [ebp - 0x186c]
lea eax, [ebp - 0x186c]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc66528
mov edx, dword [esi + 8]
lea eax, [ebp - 0x186c]
mov ecx, dword [ebp - 0x186c]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc66528
mov ecx, dword [ebp - 0x186c]
lea eax, [ebp - 0x186c]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc66528
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0x186c]
mov ecx, dword [ebp - 0x186c]
push eax
call fcn.00a32533
mov edi, dword [ebp - 0x186c]
mov ebx, eax
test ebx, ebx
jns 0xc66536
mov edi, dword [ebp - 0x1870]
test ebx, ebx
js 0xc6669f
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xc66556
mov ebx, 0xc0000017
jmp 0xc6669f
mov eax, dword [ebp - 0x15cc]
mov ecx, esi
mov dword [ebp - 0x1874], esi
mov eax, dword [eax]
mov dword [esi], eax
lea eax, [ebp - 0x1874]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc6668a
mov ebx, dword [ebp - 0x15cc]
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0x1874]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx]
lea eax, [ebp - 0x1874]
mov ecx, dword [ebp - 0x1874]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc6668a
mov eax, dword [ebp - 0x15cc]
mov ecx, dword [ebp - 0x1874]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0x1874]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc6668a
mov ebx, dword [ebp - 0x15cc]
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0x1874]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 8]
lea eax, [ebp - 0x1874]
mov ecx, dword [ebp - 0x1874]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc6668a
mov eax, dword [ebp - 0x15cc]
mov ecx, dword [ebp - 0x1874]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0x1874]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc6668a
mov ebx, dword [ebp - 0x15cc]
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0x1874]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0x1874]
mov ecx, dword [ebp - 0x1874]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
xor eax, eax
test ebx, ebx
js 0xc6668c
mov dword [ebp - 0x1570], esi
mov esi, eax
mov dword [ebp - 0x1564], edi
jmp 0xc6668c
xor eax, eax
test esi, esi
je 0xc6669f
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or ebx, 0x10000000
mov dword [ebp - 0x15bc], ebx
jl 0xc677bf
xor eax, eax
mov dword [ebp - 0x1878], 8
mov dword [ebp - 0x15c0], eax
mov dword [ebp - 0x15a0], eax
mov edx, dword [ebp - 0x155c]
lea eax, [ebp - 0x1878]
push eax
push 8
pop ecx
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x15bc], ebx
jl 0xc66757
mov eax, dword [ebp - 0x1878]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xc6670b
mov ebx, 0xc0000095
mov dword [ebp - 0x15bc], ebx
jmp 0xc66732
mov dword [ebp - 0x1880], ecx
lea eax, [ebp - 0x1880]
push eax
push 8
pop edx
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0x1880]
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
jns 0xc66738
mov eax, dword [ebp - 0x187c]
mov dword [ebp - 0x15b0], eax
test ebx, ebx
js 0xc66757
mov eax, dword [ebp - 0x159c]
test eax, eax
jne 0xc6678d
mov ebx, 0xc000000d
mov dword [ebp - 0x15bc], ebx
mov esi, dword [ebp - 0x1568]
test ebx, ebx
js 0xc677bf
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc669ba
mov ecx, dword [ebp - 0x1584]
mov ebx, 0xd0000017
jmp 0xc669c7
mov esi, dword [ebp - 0x1588]
cmp esi, 1
jbe 0xc6674c
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x1884], ecx
mov edi, eax
mov eax, dword [ecx]
mov dword [ebp - 0x1598], eax
lea eax, [ebp - 0x1884]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc66757
mov edx, dword [ebp - 0x1598]
lea eax, [ebp - 0x1884]
mov ecx, dword [ebp - 0x1884]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc66757
mov ecx, dword [ebp - 0x1884]
inc edi
cmp edi, 1
jb 0xc667a4
mov edi, dword [ecx]
lea eax, [ebp - 0x1884]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc66757
mov dword [ebp - 0x15c0], edi
neg edi
sbb edi, edi
and dword [ebp - 0x1884], edi
test ebx, ebx
js 0xc66757
cmp esi, 2
jbe 0xc6674c
mov ecx, dword [ebp - 0x159c]
xor eax, eax
mov dword [ebp - 0x1888], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0x1888]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc668c9
mov ecx, dword [ebp - 0x1888]
lea eax, [ebp - 0x1888]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc668c9
mov ecx, dword [ebp - 0x1888]
inc esi
cmp esi, 2
jb 0xc66851
mov esi, dword [ecx]
lea eax, [ebp - 0x1888]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc668c9
mov edi, esi
neg esi
sbb esi, esi
and dword [ebp - 0x1888], esi
jmp 0xc668cf
mov edi, dword [ebp - 0x15a0]
test ebx, ebx
js 0xc66757
mov edx, dword [ebp - 0x15b0]
lea eax, [ebp - 0x171c]
push 4
pop esi
push eax
mov ecx, esi
mov dword [ebp - 0x171c], esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc6698e
mov ecx, dword [ebp - 0x171c]
lea eax, [ebp - 0x171c]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc6698e
mov edx, dword [ebp - 0x15c0]
lea eax, [ebp - 0x171c]
mov ecx, dword [ebp - 0x171c]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc6698e
mov ecx, dword [ebp - 0x171c]
lea eax, [ebp - 0x171c]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc6698e
mov ecx, dword [ebp - 0x171c]
lea eax, [ebp - 0x171c]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0x171c]
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
jns 0xc6699c
mov eax, dword [ebp - 0x188c]
test ebx, ebx
js 0xc66757
cmp eax, 0x400000
jbe 0xc669ad
mov ebx, 0x8000ffff
jmp 0xc677b9
mov esi, eax
mov dword [ebp - 0x1568], esi
jmp 0xc6675d
mov ecx, eax
mov dword [ebp - 0x1584], ecx
mov ebx, 0x10000000
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc677bf
mov eax, dword [ebp - 0x1570]
test eax, eax
jne 0xc669e9
mov ebx, 0x80070057
jmp 0xc677b9
test ecx, ecx
je 0xc669df
mov dword [ebp - 0x1b94], eax
mov eax, dword [ebp - 0x1564]
mov dword [ebp - 0x1b8c], eax
xor eax, eax
mov dword [ebp - 0x1b84], eax
lea eax, [ebp - 0x1890]
push eax
push 0x9f29b8
push 1
mov dword [ebp - 0x1b90], ecx
mov dword [ebp - 0x1b88], esi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xc66a64
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
jle 0xc66a4e
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc66ae5
mov ebx, 0x80004005
mov dword [ebp - 0x15bc], ebx
jmp 0xc66ae5
push 0x9fc030
push dword [ebp - 0x1890]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0xc66aa6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
jle 0xc66a9e
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
mov esi, dword [ebp - 0x1568]
jmp 0xc66a4e
xor eax, eax
mov ecx, esi
push eax
push 0x14
lea eax, [ebp - 0x1b94]
push eax
push 0x86
call dword [0xc99200]
call esi
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x15bc], ebx
jl 0xc66adf
mov esi, dword [ebp - 0x1b88]
mov dword [ebp - 0x1568], esi
jmp 0xc66ae5
mov esi, dword [ebp - 0x1568]
cmp ebx, 0xd0000023
jne 0xc66af7
mov ebx, 0x8007007a
jmp 0xc677b9
test ebx, ebx
js 0xc677bf
xor eax, eax
push 4
pop edx
mov dword [ebp - 0x1708], eax
mov edi, eax
mov eax, dword [ebp - 0x1584]
mov dword [ebp - 0x1704], eax
cmp esi, edx
jae 0xc66b26
mov ebx, 0xc000003e
jmp 0xc66f1a
mov esi, dword [eax]
lea ecx, [ebp - 0x1704]
push ecx
mov ecx, eax
mov dword [ebp - 0x15c0], esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc66f1a
lea eax, [ebp - 0x1708]
xor ecx, ecx
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc66f1a
mov eax, dword [ebp - 0x1568]
sub eax, dword [ebp - 0x1708]
cmp eax, esi
jb 0xc66b1c
mov eax, dword [ebp - 0x1704]
lea ecx, [ebp - 0x1704]
push ecx
mov edx, esi
mov dword [ebp - 0x15a0], eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc66f1a
mov ecx, dword [ebp - 0x1708]
lea eax, [ebp - 0x1708]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc66f1a
mov eax, dword [ebp - 0x1568]
sub eax, dword [ebp - 0x1708]
push 4
pop edx
cmp eax, edx
jb 0xc66b1c
mov ecx, dword [ebp - 0x1704]
lea eax, [ebp - 0x1704]
push eax
mov esi, dword [ecx]
mov dword [ebp - 0x15b0], esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc66f1a
mov ecx, dword [ebp - 0x1708]
lea eax, [ebp - 0x1708]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc66f1a
mov eax, dword [ebp - 0x1568]
sub eax, dword [ebp - 0x1708]
cmp eax, esi
jb 0xc66b1c
mov eax, dword [ebp - 0x1704]
lea ecx, [ebp - 0x1704]
push ecx
mov edx, esi
mov dword [ebp - 0x1598], eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc66f1a
mov ecx, dword [ebp - 0x1708]
lea eax, [ebp - 0x1708]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc66f1a
mov eax, dword [ebp - 0x1568]
sub eax, dword [ebp - 0x1708]
push 4
pop edx
cmp eax, edx
jb 0xc66b1c
mov ecx, dword [ebp - 0x1704]
mov eax, dword [ecx]
mov dword [ebp - 0x15b4], eax
lea eax, [ebp - 0x1704]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc66f1a
mov ecx, dword [ebp - 0x1708]
lea eax, [ebp - 0x1708]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc66f1a
mov eax, dword [ebp - 0x1568]
sub eax, dword [ebp - 0x1708]
mov ecx, dword [ebp - 0x15b4]
cmp eax, ecx
jb 0xc66b1c
lea eax, [ebp - 0x1708]
mov edx, ecx
mov ecx, dword [ebp - 0x1708]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc66f1a
mov edx, dword [ebp - 0x1568]
mov eax, edx
sub eax, dword [ebp - 0x1708]
jne 0xc66b1c
mov ebx, dword [ebp - 0x15c0]
mov ecx, dword [ebp - 0x15b4]
add ecx, 0xc
lea eax, [esi + ebx]
add eax, ecx
cmp eax, edx
jne 0xc66b1c
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xc66d50
mov ebx, 0xc0000017
jmp 0xc66e99
cmp dword [ebp - 0x15a0], edi
je 0xc66d91
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc66d7a
mov ebx, 0xc0000017
xor eax, eax
jmp 0xc66e26
mov dword [esi + 4], eax
push ebx
push dword [ebp - 0x15a0]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc66d98
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
cmp dword [ebp - 0x1598], edi
je 0xc66dd4
mov ebx, dword [ebp - 0x15b0]
push ebx
push 8
mov dword [esi + 8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc66d6e
mov dword [esi + 0xc], eax
push ebx
push dword [ebp - 0x1598]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc66dda
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
cmp dword [ebp - 0x1704], edi
je 0xc66e1a
mov ebx, dword [ebp - 0x15b4]
push ebx
push 8
mov dword [esi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc66d6e
mov dword [esi + 0x14], eax
push ebx
push dword [ebp - 0x1704]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc66e20
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov edi, esi
mov ebx, eax
mov esi, eax
test esi, esi
je 0xc66e99
cmp dword [esi + 4], 0
je 0xc66e48
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
jmp 0xc66e4a
xor eax, eax
cmp dword [esi + 0xc], 0
je 0xc66e68
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0xc66e6a
xor eax, eax
cmp dword [esi + 0x14], 0
je 0xc66e88
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
jmp 0xc66e8a
xor eax, eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
test ebx, ebx
js 0xc66ea7
mov dword [ebp - 0x156c], edi
mov edi, eax
test edi, edi
je 0xc66f1a
cmp dword [edi + 4], 0
je 0xc66ec9
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
jmp 0xc66ecb
xor eax, eax
cmp dword [edi + 0xc], 0
je 0xc66ee9
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
jmp 0xc66eeb
xor eax, eax
cmp dword [edi + 0x14], 0
je 0xc66f09
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
jmp 0xc66f0b
xor eax, eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0x156c]
or ebx, 0x10000000
mov dword [ebp - 0x15bc], ebx
jl 0xc677c5
xor eax, eax
mov esi, eax
mov dword [ebp - 0x15c0], esi
test edi, edi
jne 0xc66f50
mov ebx, 0xd000000d
mov dword [ebp - 0x15bc], ebx
jmp 0xc677c5
mov ebx, dword [edi + 4]
mov dword [ebp - 0x15b0], ebx
test ebx, ebx
je 0xc66f40
mov edi, dword [edi]
test edi, edi
jne 0xc66f6d
mov ebx, 0xd000000d
jmp 0xc677b9
add edi, 0xfffffff8
push edi
push eax
mov dword [ebp - 0x15b4], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1558], eax
test eax, eax
je 0xc67583
xor ecx, ecx
mov dword [ebp - 0x6c8], 0xab69605e
mov esi, edi
mov dword [ebp - 0x6c4], 0x7f1137f
mov dword [ebp - 0x15a8], ebx
mov dl, cl
mov dword [ebp - 0x15a4], eax
and esi, 7
je 0xc67526
xor eax, eax
mov dword [ebp - 0x1574], ecx
mov dword [ebp - 0x1560], eax
mov dword [ebp - 0x1590], eax
test esi, esi
je 0xc67031
mov edi, dword [ebp - 0x15a8]
push 0x38
pop ebx
movzx eax, byte [edi]
inc edi
cmp ecx, 4
jge 0xc66ff9
lea ecx, [ebx - 0x20]
shl eax, cl
or dword [ebp - 0x1590], eax
jmp 0xc67003
mov ecx, ebx
shl eax, cl
or dword [ebp - 0x1560], eax
mov ecx, dword [ebp - 0x1574]
sub ebx, 8
inc ecx
mov dword [ebp - 0x1574], ecx
cmp ecx, esi
jl 0xc66fe3
mov eax, edi
mov dword [ebp - 0x15a8], edi
mov edi, dword [ebp - 0x15b4]
mov dword [ebp - 0x15a8], eax
mov eax, dword [ebp - 0x1590]
mov ebx, dword [ebp - 0x1560]
xor eax, 0x92f65a5
xor ebx, 0x699a899c
mov dword [ebp - 0x1574], eax
xor ecx, ecx
mov dword [ebp - 0x1578], ebx
mov dword [ebp - 0x1568], eax
mov dword [ebp - 0x1564], ebx
test esi, esi
je 0xc670b9
mov edi, dword [ebp - 0x15a4]
push 4
pop ebx
lea eax, [edi + 1]
mov dword [ebp - 0x15a4], eax
cmp ecx, ebx
jge 0xc67085
rol dword [ebp - 0x1568], 8
mov eax, dword [ebp - 0x1568]
jmp 0xc67092
rol dword [ebp - 0x1564], 8
mov eax, dword [ebp - 0x1564]
mov byte [edi], al
inc ecx
mov eax, dword [ebp - 0x15a4]
mov edi, eax
cmp ecx, esi
jl 0xc67069
mov ebx, dword [ebp - 0x1578]
mov edi, dword [ebp - 0x15b4]
mov dword [ebp - 0x15a4], eax
mov eax, dword [ebp - 0x1574]
push 4
pop ecx
cmp esi, ecx
jbe 0xc674ff
push 8
pop ecx
sub ecx, esi
shl ecx, 3
shr ebx, cl
shl ebx, cl
mov dword [ebp - 0x1578], ebx
mov ebx, dword [ebp - 0x15a8]
mov eax, edi
shr eax, 3
mov dword [ebp - 0x15a8], eax
test eax, eax
je 0xc674cc
movzx ecx, word [ebp - 0x6c2]
mov eax, 0x7f1137f
movzx esi, word [ebp - 0x6c6]
movzx eax, ax
mov dword [ebp - 0x1564], ecx
mov ecx, 0xab69605e
mov dword [ebp - 0x1568], eax
movzx eax, cx
mov ecx, dword [ebp - 0x1574]
mov dword [ebp - 0x1588], eax
mov eax, dword [ebp - 0x15a4]
add eax, 7
mov dword [ebp - 0x155c], esi
mov dword [ebp - 0x15a4], eax
lea esi, [ebx + 2]
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor ecx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
shl edi, 8
add esi, 8
or edi, eax
mov dword [ebp - 0x15c4], esi
mov eax, dword [ebp - 0x1578]
xor eax, edi
xor eax, ecx
xor eax, 0x7f1137f
xor eax, 0xab69605e
mov dword [ebp - 0x1578], eax
mov esi, eax
rol dword [ebp - 0x1578], 0xa
sub eax, 0xab69605e
rol eax, 5
imul eax, dword [ebp - 0x1568]
add eax, dword [ebp - 0x1578]
xor ecx, eax
mov eax, 0x7f1137f
mov dword [ebp - 0x1574], ecx
add ecx, eax
mov eax, dword [ebp - 0x1574]
ror ecx, 9
imul ecx, dword [ebp - 0x155c]
rol eax, 2
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
sub ecx, dword [ebp - 0x1568]
imul ecx, dword [ebp - 0x1588]
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0x1574]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x1574], eax
xor ecx, dword [ebp - 0x155c]
rol ecx, 6
imul ecx, dword [ebp - 0x1564]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, 0xab69605e
xor ecx, esi
sub eax, ecx
mov ecx, dword [ebp - 0x1574]
xor ecx, eax
mov dword [ebp - 0x1574], ecx
mov eax, dword [ebp - 0x1574]
xor eax, dword [ebp - 0x1568]
imul eax, dword [ebp - 0x155c]
ror ecx, 6
xor ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov eax, esi
rol eax, 2
lea ecx, [esi + ecx]
ror ecx, 0xf
imul ecx, dword [ebp - 0x1588]
add ecx, eax
mov eax, dword [ebp - 0x1574]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x1574], eax
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0x1564]
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, 0xab69605e
ror eax, 0xa
ror ecx, 0xc
imul ecx, dword [ebp - 0x1568]
xor ecx, eax
mov eax, dword [ebp - 0x1574]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x1574], eax
xor ecx, dword [ebp - 0x1564]
imul ecx, dword [ebp - 0x155c]
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov ecx, dword [ebp - 0x1574]
mov eax, esi
not eax
ror eax, 5
add eax, dword [ebp - 0x1588]
imul eax, dword [ebp - 0x1564]
xor ecx, eax
mov eax, ecx
mov dword [ebp - 0x1574], ecx
sub eax, dword [ebp - 0x1564]
xor eax, esi
mov esi, dword [ebp - 0x1574]
xor eax, 0xab69605e
mov ecx, eax
mov dword [ebp - 0x1578], eax
xor ecx, dword [ebp - 0x1564]
rol ecx, 2
imul ecx, dword [ebp - 0x1568]
shr eax, 2
add ecx, eax
xor esi, ecx
mov eax, esi
rol eax, 7
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul ecx, dword [ebp - 0x155c]
add ecx, eax
mov eax, dword [ebp - 0x1578]
xor eax, ecx
mov dword [ebp - 0x1578], eax
mov ecx, eax
xor eax, dword [ebp - 0x1568]
imul eax, dword [ebp - 0x1588]
ror ecx, 9
add ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0x155c]
rol ecx, 5
imul ecx, dword [ebp - 0x1564]
rol eax, 7
add ecx, eax
xor dword [ebp - 0x1578], ecx
mov ecx, dword [ebp - 0x1578]
xor esi, ecx
xor esi, 0xab69605e
xor esi, 0x7f1137f
mov eax, esi
ror eax, 3
sub eax, dword [ebp - 0x155c]
imul eax, dword [ebp - 0x1568]
xor ecx, eax
mov dword [ebp - 0x1578], ecx
sub ecx, 0x7f1137f
mov eax, dword [ebp - 0x1578]
ror ecx, 1
imul ecx, dword [ebp - 0x1588]
ror eax, 6
sub ecx, eax
xor esi, ecx
mov ecx, 0xab69605e
mov eax, esi
rol eax, 0xe
lea ecx, [esi + ecx]
rol ecx, 3
imul ecx, dword [ebp - 0x1564]
add ecx, eax
mov eax, dword [ebp - 0x1578]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0x1578], eax
rol ecx, 0xf
imul ecx, dword [ebp - 0x1568]
ror eax, 0xe
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0x1588]
imul ecx, dword [ebp - 0x155c]
shr eax, 3
xor ecx, eax
mov eax, dword [ebp - 0x1578]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x1578], eax
xor ecx, 0x7f1137f
rol eax, 2
rol ecx, 4
imul ecx, dword [ebp - 0x1588]
xor ecx, eax
mov eax, dword [ebp - 0x1578]
xor ecx, dword [ebp - 0x1590]
xor eax, dword [ebp - 0x1560]
xor esi, ecx
mov ecx, esi
mov dword [ebp - 0x1574], esi
mov esi, dword [ebp - 0x15a4]
mov dword [ebp - 0x1590], ebx
mov dword [ebp - 0x1560], edi
mov byte [esi - 4], cl
mov byte [esi], al
ror ecx, 8
mov byte [esi - 5], cl
ror eax, 8
mov byte [esi - 1], al
ror ecx, 8
mov byte [esi - 6], cl
ror eax, 8
mov byte [esi - 2], al
ror ecx, 8
ror eax, 8
mov byte [esi - 7], cl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror ecx, 8
sub dword [ebp - 0x15a8], 1
mov dword [ebp - 0x15a4], esi
mov esi, dword [ebp - 0x15c4]
mov dword [ebp - 0x1578], eax
jne 0xc6713d
mov edi, dword [ebp - 0x15b4]
mov ecx, dword [ebp - 0x1558]
xor eax, eax
test edi, edi
je 0xc674e0
xor dl, byte [eax + ecx]
inc eax
cmp eax, edi
jb 0xc674d8
mov esi, dword [ebp - 0x15b0]
movzx eax, dl
cdq
cmp eax, dword [edi + esi]
jne 0xc67546
cmp edx, dword [edi + esi + 4]
jne 0xc67546
xor eax, eax
mov esi, ecx
mov ecx, eax
mov ebx, eax
jmp 0xc67555
xor ecx, ecx
push 4
mov dword [ebp - 0x1578], ecx
pop ecx
cmp esi, ecx
jae 0xc670d6
sub ecx, esi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0x1574], eax
jmp 0xc670d6
xor eax, eax
or dword [ebp - 0x1560], 0xffffffff
mov dword [ebp - 0x1590], eax
mov dword [ebp - 0x1578], eax
mov dword [ebp - 0x1574], eax
jmp 0xc670dc
mov esi, dword [ebp - 0x15c0]
mov ebx, 0xc004d501
mov edi, esi
xor eax, eax
test ecx, ecx
je 0xc67568
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc67583
xor eax, eax
mov dword [ebp - 0x1554], esi
mov esi, eax
mov dword [ebp - 0x15c8], edi
mov ebx, 0x10000000
jmp 0xc67590
mov edi, dword [ebp - 0x15c8]
mov ebx, 0xd0000001
xor eax, eax
mov dword [ebp - 0x15bc], ebx
test esi, esi
je 0xc675a9
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc677bf
mov ecx, dword [ebp - 0x1554]
xor eax, eax
push 4
pop esi
mov dword [ebp - 0x1700], eax
mov dword [ebp - 0x16dc], ecx
cmp edi, esi
jb 0xc677ae
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x15c0], eax
lea eax, [ebp - 0x16dc]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc677b3
lea eax, [ebp - 0x1700]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc677b3
mov eax, edi
sub eax, dword [ebp - 0x1700]
cmp eax, esi
jb 0xc677ae
mov ecx, dword [ebp - 0x16dc]
lea eax, [ebp - 0x16dc]
push eax
mov edx, esi
mov edi, dword [ecx]
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc677b3
mov ecx, dword [ebp - 0x1700]
lea eax, [ebp - 0x1700]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc677b3
mov eax, dword [ebp - 0x15c8]
mov ecx, dword [ebp - 0x1700]
sub eax, ecx
cmp eax, edi
jb 0xc677ae
lea eax, [ebp - 0x1700]
mov edx, edi
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc677b3
mov esi, dword [ebp - 0x16dc]
mov edx, dword [ebp - 0x15c8]
mov ebx, dword [ebp - 0x1554]
lea ecx, [edi + esi]
lea eax, [edx + ebx]
cmp eax, ecx
jb 0xc677ae
sub edx, edi
sub edx, esi
add edx, ebx
cmp edx, 8
jae 0xc677ae
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x15a0], eax
mov ebx, ecx
mov dword [ebp - 0x15b0], ecx
test esi, esi
je 0xc67737
lea eax, [ebp - 0x168c]
mov edx, edi
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc677b3
mov ecx, dword [ebp - 0x168c]
cmp esi, ecx
jae 0xc67729
mov edx, dword [ebp - 0x15b0]
lea eax, [esi + 4]
cmp eax, esi
jb 0xc6776a
cmp eax, ecx
ja 0xc67763
mov eax, dword [esi]
push 4
add eax, 4
pop ebx
cmp eax, ebx
jb 0xc6775c
add eax, esi
cmp eax, esi
jb 0xc6776a
mov esi, eax
xor eax, eax
mov ebx, eax
cmp esi, ecx
ja 0xc67763
inc edx
mov dword [ebp - 0x15b0], edx
cmp esi, ecx
jb 0xc676f5
cmp esi, ecx
jne 0xc67763
mov esi, dword [ebp - 0x16dc]
mov eax, dword [ebp - 0x15a0]
test edi, edi
je 0xc67775
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x15a0], eax
test eax, eax
jne 0xc67771
mov ebx, 0xc0000017
jmp 0xc6779c
mov ebx, 0xc0000095
jmp 0xc6779c
mov ebx, 0xc000000d
jmp 0xc677b3
mov ebx, 0xc0000095
jmp 0xc677b3
xor ecx, ecx
mov ebx, ecx
test esi, esi
je 0xc6778a
push edi
push esi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0x15a0]
add esp, 0xc
mov dword [ebp - 0x1a98], eax
mov eax, dword [ebp - 0x15b0]
mov dword [ebp - 0x1aa0], eax
test ebx, ebx
js 0xc677b3
mov eax, dword [ebp - 0x15c0]
cmp eax, dword [ebp - 0x1aa0]
je 0xc677b3
mov ebx, 0xc000003e
or ebx, 0x10000000
mov dword [ebp - 0x15bc], ebx
mov edi, dword [ebp - 0x156c]
mov eax, dword [ebp - 0x1580]
test eax, eax
je 0xc677e0
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0x15cc]
test esi, esi
je 0xc67856
xor eax, eax
cmp dword [esi + 4], eax
je 0xc67807
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xc67825
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0xc67827
xor eax, eax
cmp dword [esi + 0x14], 0
je 0xc67845
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
jmp 0xc67847
xor eax, eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1570]
test eax, eax
je 0xc67871
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1584]
test eax, eax
je 0xc6788c
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xc678fc
xor eax, eax
cmp dword [edi + 4], eax
je 0xc678ad
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc678cb
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
jmp 0xc678cd
xor eax, eax
cmp dword [edi + 0x14], 0
je 0xc678eb
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
jmp 0xc678ed
xor eax, eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1554]
test eax, eax
je 0xc67917
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc67eb0
cmp dword [ebp - 0x1aa0], 1
jb 0xc67ea5
cmp dword [ebp - 0x1a98], 0
jne 0xc679c0
mov ebx, 0xc000000d
mov dword [ebp - 0x15bc], ebx
mov eax, dword [ebp - 0x15ac]
push 4
pop edx
test ebx, ebx
js 0xc67eb0
cmp eax, 0xd0000023
jne 0xc67967
mov eax, 0x8007007a
mov dword [ebp - 0x15ac], eax
cmp eax, 0x8007007a
je 0xc6797e
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test eax, eax
js 0xc67eb0
cmp dword [ebp - 0x1aa0], 6
jne 0xc67ea5
cmp dword [ebp - 0x1a98], 0
jne 0xc67a3a
mov edx, dword [ebp - 0x1a64]
mov ebx, 0xc000000d
mov ecx, dword [ebp - 0x1a68]
mov dword [ebp - 0x15bc], ebx
mov dword [ebp - 0x15c0], edx
mov dword [ebp - 0x15a0], ecx
jmp 0xc67b0c
cmp dword [ebp - 0x1aa0], 0
jbe 0xc67939
mov eax, dword [ebp - 0x1a98]
lea ecx, [ebp - 0x1688]
push ecx
push 4
pop ecx
mov esi, dword [eax]
mov edx, ecx
mov ecx, eax
mov dword [ebp - 0x1688], eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67a0e
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1688]
mov dword [ebp - 0x1688], eax
jmp 0xc67a1a
mov esi, dword [ebp - 0x1894]
mov eax, dword [ebp - 0x1898]
test ebx, ebx
js 0xc67944
push 4
pop edx
cmp esi, edx
jne 0xc6554f
mov eax, dword [eax]
mov dword [ebp - 0x15ac], eax
jmp 0xc6794d
mov ecx, dword [ebp - 0x1a98]
xor eax, eax
mov dword [ebp - 0x1624], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0x1624]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67ac8
mov ecx, dword [ebp - 0x1624]
lea eax, [ebp - 0x1624]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67ac8
mov ecx, dword [ebp - 0x1624]
inc esi
cmp esi, 1
jae 0xc67a95
push 4
pop edx
jmp 0xc67a4a
mov esi, dword [ecx]
lea eax, [ebp - 0x1624]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67ac8
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1624]
mov dword [ebp - 0x1624], eax
jmp 0xc67ad4
mov esi, dword [ebp - 0x189c]
mov eax, dword [ebp - 0x18a0]
test ebx, ebx
js 0xc67af4
cmp esi, 8
jne 0xc6554f
mov ecx, dword [eax]
mov dword [ebp - 0x15a0], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x15c0], ecx
jmp 0xc67b0c
mov eax, dword [ebp - 0x1a64]
mov dword [ebp - 0x15c0], eax
mov eax, dword [ebp - 0x1a68]
mov dword [ebp - 0x15a0], eax
test ebx, ebx
js 0xc67eb0
cmp dword [ebp - 0x1a98], 0
jne 0xc67b56
mov ebx, 0xc000000d
mov dword [ebp - 0x15bc], ebx
mov eax, dword [ebp - 0x18a4]
push 4
pop edx
mov dword [ebp - 0x15b0], eax
test ebx, ebx
js 0xc67eb0
cmp dword [ebp - 0x1a98], 0
jne 0xc67c0a
mov ebx, 0xc000000d
jmp 0xc67eaa
mov ecx, dword [ebp - 0x1a98]
xor eax, eax
mov dword [ebp - 0x15ec], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0x15ec]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67be4
mov ecx, dword [ebp - 0x15ec]
lea eax, [ebp - 0x15ec]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67be4
mov ecx, dword [ebp - 0x15ec]
inc esi
cmp esi, 2
jb 0xc67b66
mov esi, dword [ecx]
lea eax, [ebp - 0x15ec]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67be4
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x15ec]
mov dword [ebp - 0x15ec], eax
jmp 0xc67bf0
mov esi, dword [ebp - 0x18a8]
mov eax, dword [ebp - 0x18ac]
test ebx, ebx
js 0xc67b28
push 4
pop edx
cmp esi, edx
jne 0xc6554f
mov eax, dword [eax]
jmp 0xc67b31
mov ecx, dword [ebp - 0x1a98]
xor eax, eax
mov dword [ebp - 0x15d0], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0x15d0]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67c9e
mov ecx, dword [ebp - 0x15d0]
lea eax, [ebp - 0x15d0]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67c9e
mov ecx, dword [ebp - 0x15d0]
inc esi
cmp esi, 3
jae 0xc67c65
push 4
pop edx
jmp 0xc67c1a
mov edi, dword [ecx]
lea eax, [ebp - 0x15d0]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0x1598], edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67c9e
mov esi, edi
neg esi
sbb esi, esi
and esi, dword [ebp - 0x15d0]
mov dword [ebp - 0x15d0], esi
jmp 0xc67cb0
mov eax, dword [ebp - 0x18b0]
mov esi, dword [ebp - 0x18b4]
mov dword [ebp - 0x1598], eax
test ebx, ebx
js 0xc67eb0
mov ecx, dword [ebp - 0x1a98]
xor eax, eax
mov edx, eax
mov edi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0xc67cd1
xor ecx, ecx
mov ebx, ecx
jmp 0xc67cd9
mov ebx, 0xc0000095
or eax, 0xffffffff
mov dword [ebp - 0x15bc], ebx
mov dword [ebp - 0x163c], eax
test ebx, ebx
js 0xc67d47
lea ecx, [edi + eax]
mov edi, ecx
cmp ecx, eax
jae 0xc67cf5
or ecx, 0xffffffff
cmp edi, eax
mov dword [ebp - 0x163c], ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0x15bc], ebx
cmp edi, eax
jb 0xc67d47
push 4
inc edx
pop ebx
cmp edx, ebx
jb 0xc67cc2
mov edi, dword [ecx]
lea eax, [ebp - 0x163c]
push eax
mov edx, ebx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67d47
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x163c]
mov dword [ebp - 0x163c], eax
jmp 0xc67d53
mov edi, dword [ebp - 0x18b8]
mov eax, dword [ebp - 0x18bc]
test ebx, ebx
js 0xc67d66
push 4
pop ecx
cmp edi, ecx
jne 0xc6554f
mov eax, dword [eax]
jmp 0xc67d6c
mov eax, dword [ebp - 0x18c0]
mov dword [ebp - 0x15b4], eax
test ebx, ebx
js 0xc67eb0
mov ecx, dword [ebp - 0x1a98]
xor eax, eax
mov edx, eax
mov edi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0xc67d93
xor ecx, ecx
mov ebx, ecx
jmp 0xc67d9b
mov ebx, 0xc0000095
or eax, 0xffffffff
mov dword [ebp - 0x15bc], ebx
mov dword [ebp - 0x1614], eax
test ebx, ebx
js 0xc67e0a
lea ecx, [edi + eax]
mov edi, ecx
cmp ecx, eax
jae 0xc67db7
or ecx, 0xffffffff
cmp edi, eax
mov dword [ebp - 0x1614], ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0x15bc], ebx
cmp edi, eax
jb 0xc67e0a
inc edx
cmp edx, 5
jb 0xc67d84
mov edi, dword [ecx]
lea eax, [ebp - 0x1614]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x15bc], ebx
test ebx, ebx
js 0xc67e0a
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1614]
mov dword [ebp - 0x1614], eax
jmp 0xc67e16
mov edi, dword [ebp - 0x18c4]
mov eax, dword [ebp - 0x18c8]
push 4
pop edx
test ebx, ebx
js 0xc67e29
cmp edi, edx
jne 0xc6554f
mov ecx, dword [eax]
jmp 0xc67e2f
mov ecx, dword [ebp - 0x15b8]
test ebx, ebx
js 0xc67eb0
mov eax, dword [ebp - 0x1604]
cmp eax, dword [ebp - 0x15a0]
jne 0xc67ea5
mov eax, dword [ebp - 0x1620]
cmp eax, dword [ebp - 0x15c0]
jne 0xc67ea5
mov dword [ebp - 0x1690], ecx
cmp dword [ebp - 0x15b4], edx
jbe 0xc67e70
mov ecx, dword [ebp - 0x15b0]
mov ebx, 0x8007007a
mov dword [ebp - 0x1714], ecx
jmp 0xc67eaa
mov eax, dword [ebp - 0x1598]
cmp eax, edx
ja 0xc67e5d
push eax
push esi
mov esi, dword [ebp - 0x1594]
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0x15b0]
add esp, 0xc
mov dword [ebp - 0x1714], eax
mov eax, dword [ebp - 0x15ac]
test eax, eax
je 0xc67eb0
mov ebx, eax
jmp 0xc67eaa
mov ebx, 0xc004d501
mov dword [ebp - 0x15bc], ebx
mov edi, dword [ebp - 0x157c]
xor eax, eax
mov dword [ebp - 0x1a90], eax
mov dword [ebp - 0x1a94], eax
mov eax, dword [ebp - 0x159c]
test eax, eax
je 0xc67ee9
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebp - 0x1a8c], eax
jmp 0xc67eeb
xor eax, eax
mov dword [ebp - 0x1a9c], eax
mov dword [ebp - 0x1aa0], eax
mov eax, dword [ebp - 0x1a98]
test eax, eax
je 0xc67f1c
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebp - 0x1a98], eax
jmp 0xc67f1e
xor eax, eax
test edi, edi
je 0xc67f31
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x158c]
test eax, eax
je 0xc67f4c
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc6509e
mov eax, dword [ebp - 0x1690]
test eax, eax
je 0xc6e90e
mov dword [0xc95878], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x588]
push eax
push 0x9d0000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0xc6c846
cmp eax, esi
jne 0xc67f9a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0xc6c846
mov esi, dword [0xc9307c]
xor eax, eax
push 0x403
push eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x15c0], eax
test eax, eax
jne 0xc67fc8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc6c846
mov esi, dword [0xc9304c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [0xc95870], eax
lea edi, [ebp - 0x754]
mov eax, dword [0xc95878]
mov dword [ebp - 0x15a0], eax
xor eax, eax
stosd dword es:[edi], eax
push 0x2c
mov dword [0xc95874], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push eax
mov dword [ebp - 0x19c0], eax
mov dword [ebp - 0x19bc], eax
mov dword [ebp - 0x15b0], eax
mov dword [ebp - 0x1598], eax
lea eax, [ebp - 0x8e4]
push eax
call fcn.00ab4bf6
add esp, 0xc
mov edx, 0xc96238
xor eax, eax
mov dword [ebp - 0x15b4], eax
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc68032
mov eax, dword [0xc95890]
test eax, eax
jne 0xc68663
push 0x338
mov esi, eax
mov dword [ebp - 0x1558], eax
push eax
mov dword [ebp - 0x15a8], eax
mov dword [ebp - 0x15a4], esi
mov dword [ebp - 0x1560], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1590], eax
test eax, eax
je 0xc68657
xor edx, edx
mov dword [ebp - 0x6d0], 0xab69605e
or ebx, 0xffffffff
mov dword [ebp - 0x6cc], 0x7f1137f
add eax, 7
mov dword [ebp - 0x1574], edx
mov cl, dl
mov dword [ebp - 0x1578], ebx
mov dword [ebp - 0x15c8], edx
mov esi, 0x9fbcf2
mov dword [ebp - 0x1554], eax
mov dword [ebp - 0x156c], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [ebp - 0x1568], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [ebp - 0x1584], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [ebp - 0x15c8]
xor esi, edx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x1568]
xor eax, edx
mov dword [ebp - 0x1568], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x1568]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x1568]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x1568], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x1568]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x1568]
xor edx, eax
mov dword [ebp - 0x1568], edx
mov eax, dword [ebp - 0x1568]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x1568]
xor eax, edx
mov dword [ebp - 0x1568], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x1568]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x1568]
xor eax, edx
mov dword [ebp - 0x1568], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x1568]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0x1568]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0x1568], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0x1568]
xor eax, 0xab69605e
mov dword [ebp - 0x15c8], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x15c8]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x15c8]
xor eax, edx
mov dword [ebp - 0x15c8], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x15c8], edx
mov edx, dword [ebp - 0x15c8]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x15c8], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x15c8]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x15c8]
xor eax, edx
mov dword [ebp - 0x15c8], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x15c8]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x15c8]
xor eax, edx
mov dword [ebp - 0x15c8], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x15c8]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x15c8]
xor edx, dword [ebp - 0x1574]
xor eax, dword [ebp - 0x1578]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x1568], esi
mov esi, dword [ebp - 0x1554]
mov dword [ebp - 0x1574], ebx
mov dword [ebp - 0x1578], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x156c], 1
mov dword [ebp - 0x1554], esi
mov esi, dword [ebp - 0x1584]
mov dword [ebp - 0x15c8], eax
jne 0xc680cc
mov esi, dword [ebp - 0x1590]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc68441
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc68473
cmp edx, dword [0x9fc02c]
jne 0xc68473
mov edi, esi
xor eax, eax
mov dword [ebp - 0x15a4], edi
mov esi, eax
mov ebx, 0x337
jmp 0xc68488
mov edi, dword [ebp - 0x15a4]
or ebx, 0xffffffff
mov dword [ebp - 0x1560], 0xc004d501
xor eax, eax
test esi, esi
je 0xc6849b
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x1560], 0
jl 0xc68651
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xc960a0
push eax
push ebx
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xc685e5
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1740]
jne 0xc684d2
sub ecx, ebx
xor eax, eax
sar ecx, 1
push edi
push edx
push eax
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc6864a
xor eax, eax
mov edx, 0x5a4d
mov ecx, eax
mov eax, dword [edi]
mov dword [ebp - 0x15a8], ecx
cmp word [eax], dx
je 0xc68521
mov ecx, 0xc000007b
mov dword [ebp - 0x15a8], ecx
jmp 0xc6856b
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc68514
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc68514
cmp dword [edx], 0x4550
jne 0xc68514
movzx eax, word [edx + 0x18]
mov ebx, 0x10b
cmp ax, bx
je 0xc68559
mov ebx, 0x20b
cmp ax, bx
je 0xc68559
mov ecx, 0xc000000d
jmp 0xc68519
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0x1560], eax
xor edx, edx
mov ebx, edx
test eax, eax
je 0xc685d9
mov edx, esi
mov dword [ebp - 0x1590], esi
lea eax, [edx + 1]
mov dword [ebp - 0x1574], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc68591
sub edx, dword [ebp - 0x1574]
inc esi
add esi, edx
test ecx, ecx
js 0xc685ca
push dword [ebp - 0x1590]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc685e5
mov ecx, dword [ebp - 0x1558]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x15a8]
inc dword [ebp - 0x1558]
inc ebx
cmp ebx, dword [ebp - 0x1560]
jb 0xc68580
add edi, 0x10
cmp byte [esi], 0
jne 0xc684cb
mov ebx, dword [ebp - 0x15a8]
mov esi, dword [ebp - 0x15a4]
test esi, esi
je 0xc68606
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc6865e
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc6861f
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc6860e
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc68669
mov ebx, 0xc000007a
jmp 0xc685eb
mov esi, dword [ebp - 0x15a4]
mov ebx, 0xc000007a
jmp 0xc685f1
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edx, 0xc96238
xchg dword [edx], eax
xor eax, eax
lea edi, [ebp - 0x1b10]
mov dword [ebp - 0x1558], eax
mov dword [ebp - 0x15a8], eax
mov dword [ebp - 0x15a4], eax
mov dword [ebp - 0x1560], eax
mov dword [ebp - 0x1590], eax
mov dword [ebp - 0x1574], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc686a2
mov eax, dword [0xc95890]
test eax, eax
jne 0xc68ce1
push 0x338
mov esi, eax
mov dword [ebp - 0x1578], eax
push eax
mov dword [ebp - 0x15c8], eax
mov dword [ebp - 0x1554], esi
mov dword [ebp - 0x156c], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1568], eax
test eax, eax
je 0xc68cd5
or dword [ebp - 0x1564], 0xffffffff
xor edx, edx
add eax, 7
mov dword [ebp - 0x6a0], 0xab69605e
mov edi, 0x9fbcf2
mov dword [ebp - 0x69c], 0x7f1137f
mov cl, dl
mov dword [ebp - 0x1584], edx
mov dword [ebp - 0x1570], eax
mov dword [ebp - 0x155c], edi
mov dword [ebp - 0x1588], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0x155c]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0x155c]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0x155c]
shl edi, 8
add dword [ebp - 0x155c], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0x1580], esi
add eax, 0x54969fa2
rol dword [ebp - 0x1580], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0x1580]
xor edx, eax
mov dword [ebp - 0x157c], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x157c]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x157c]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x157c], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x157c]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x157c]
xor edx, eax
mov dword [ebp - 0x157c], edx
mov eax, dword [ebp - 0x157c]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x157c]
xor eax, edx
mov dword [ebp - 0x157c], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x157c]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x157c]
xor eax, edx
mov dword [ebp - 0x157c], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x157c]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0x157c]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0x157c], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0x157c]
xor eax, 0xab69605e
mov dword [ebp - 0x1580], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1580]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x1580]
xor eax, edx
mov dword [ebp - 0x1580], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x1580], edx
mov edx, dword [ebp - 0x1580]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x1580], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1580]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x1580]
xor eax, edx
mov dword [ebp - 0x1580], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1580]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x1580]
xor eax, edx
mov dword [ebp - 0x1580], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1580]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x1580]
xor edx, dword [ebp - 0x1584]
xor eax, dword [ebp - 0x1564]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x157c], esi
mov esi, dword [ebp - 0x1570]
mov dword [ebp - 0x1564], edi
mov edi, dword [ebp - 0x155c]
mov dword [ebp - 0x1584], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x1588], 1
mov dword [ebp - 0x1570], esi
mov esi, eax
mov dword [ebp - 0x1580], eax
jne 0xc6873a
mov esi, dword [ebp - 0x1568]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc68abd
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc68aef
cmp edx, dword [0x9fc02c]
jne 0xc68aef
mov ebx, esi
xor eax, eax
mov dword [ebp - 0x1554], ebx
mov esi, eax
mov edi, 0x337
jmp 0xc68b04
mov ebx, dword [ebp - 0x1554]
or edi, 0xffffffff
mov dword [ebp - 0x156c], 0xc004d501
xor eax, eax
test esi, esi
je 0xc68b17
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x156c], 0
jl 0xc68ccf
xor eax, eax
mov esi, ebx
push 0x40
push eax
push 0xc960a0
mov byte [edi + ebx], al
call fcn.00ab4bf6
add esp, 0xc
cmp byte [ebx], 0
je 0xc68c63
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1740]
jne 0xc68b50
sub ecx, ebx
xor eax, eax
sar ecx, 1
push edi
push edx
push eax
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc68cc8
xor eax, eax
mov edx, 0x5a4d
mov ecx, eax
mov eax, dword [edi]
mov dword [ebp - 0x15c8], ecx
cmp word [eax], dx
je 0xc68b9f
mov ecx, 0xc000007b
mov dword [ebp - 0x15c8], ecx
jmp 0xc68be9
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc68b92
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc68b92
cmp dword [edx], 0x4550
jne 0xc68b92
movzx eax, word [edx + 0x18]
mov ebx, 0x10b
cmp ax, bx
je 0xc68bd7
mov ebx, 0x20b
cmp ax, bx
je 0xc68bd7
mov ecx, 0xc000000d
jmp 0xc68b97
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0x156c], eax
xor edx, edx
mov ebx, edx
test eax, eax
je 0xc68c57
mov edx, esi
mov dword [ebp - 0x1568], esi
lea eax, [edx + 1]
mov dword [ebp - 0x1584], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc68c0f
sub edx, dword [ebp - 0x1584]
inc esi
add esi, edx
test ecx, ecx
js 0xc68c48
push dword [ebp - 0x1568]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc68c63
mov ecx, dword [ebp - 0x1578]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x15c8]
inc dword [ebp - 0x1578]
inc ebx
cmp ebx, dword [ebp - 0x156c]
jb 0xc68bfe
add edi, 0x10
cmp byte [esi], 0
jne 0xc68b49
mov ebx, dword [ebp - 0x15c8]
mov esi, dword [ebp - 0x1554]
test esi, esi
je 0xc68c84
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc68cdc
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc68c9d
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc68c8c
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc68ce7
mov ebx, 0xc000007a
jmp 0xc68c69
mov esi, dword [ebp - 0x1554]
mov ebx, 0xc000007a
jmp 0xc68c6f
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x14f8]
push eax
call fcn.00ab4bf6
xor eax, eax
mov esi, dword [0xc9307c]
lea edi, [ebp - 0x758]
add esp, 0xc
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
pop edx
push 0x403
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x15a0]
mov ecx, eax
and ecx, edx
mov dword [ebp - 0x15a0], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0x14], cx
mov ecx, eax
shr eax, 0xc
and eax, edx
shr ecx, 8
mov word [ebp - 0x10], ax
and ecx, edx
xor eax, eax
mov word [ebp - 0x12], cx
push eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x1578], eax
mov dword [ebp - 0x15c8], 0xffffff
test eax, eax
jne 0xc68d96
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc68d86
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc69a45
mov ebx, 0x80004005
jmp 0xc69a45
mov edi, dword [0xc93050]
xor eax, eax
mov esi, eax
mov dword [ebp - 0x18cc], eax
mov dword [ebp - 0x156c], eax
mov ecx, edi
mov dword [ebp - 0x1568], eax
mov dword [ebp - 0x1584], eax
mov dword [ebp - 0x18d0], eax
lea eax, [ebp - 0x18d0]
push eax
xor eax, eax
mov dword [ebp - 0x1554], esi
push eax
lea eax, [ebp - 0x15fc]
push eax
push 8
call dword [0xc99200]
call edi
test eax, eax
jne 0xc68e0e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc68dfc
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc68f95
mov ebx, 0x80004005
mov edi, esi
jmp 0xc69599
mov eax, dword [ebp - 0x18d0]
add eax, eax
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x1564], edi
test edi, edi
jne 0xc68e3d
mov ebx, 0x8007000e
jmp 0xc68f80
mov eax, dword [ebp - 0x15fc]
lea eax, [eax*4 + 4]
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x1570], esi
test esi, esi
jne 0xc68e71
mov ebx, 0x8007000e
jmp 0xc68f65
mov ebx, dword [0xc93050]
lea eax, [ebp - 0x18d0]
push eax
push edi
lea eax, [ebp - 0x15fc]
mov ecx, ebx
push eax
push 8
call dword [0xc99200]
call ebx
test eax, eax
jne 0xc68ebd
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc68ead
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc68f65
mov ebx, 0x80004005
jmp 0xc68f65
xor eax, eax
cmp dword [ebp - 0x15fc], 0
mov dword [ebp - 0x1554], eax
mov eax, esi
jbe 0xc68f42
mov dword [ebp - 0x155c], edi
mov edi, esi
mov esi, dword [ebp - 0x155c]
mov ebx, dword [0xc93058]
xor eax, eax
push eax
push esi
mov ecx, ebx
call dword [0xc99200]
call ebx
mov ecx, esi
mov dword [edi], eax
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc68efb
sub ecx, edx
sar ecx, 1
push 4
pop eax
add edi, eax
mov eax, dword [ebp - 0x1554]
lea esi, [esi + ecx*2]
add esi, 2
inc eax
mov dword [ebp - 0x1554], eax
cmp eax, dword [ebp - 0x15fc]
jb 0xc68ede
mov esi, dword [ebp - 0x1570]
mov dword [ebp - 0x1554], edi
mov edi, dword [ebp - 0x1564]
mov eax, dword [ebp - 0x1554]
mov ebx, dword [ebp - 0x1584]
mov dword [eax], 0x409
xor eax, eax
mov dword [ebp - 0x1554], esi
mov esi, eax
mov eax, dword [ebp - 0x15fc]
inc eax
mov dword [ebp - 0x1564], eax
test esi, esi
je 0xc68f7a
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0x1554]
test edi, edi
je 0xc68f95
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc690e2
xor eax, eax
mov ebx, eax
mov ecx, eax
mov dword [ebp - 0x1570], ebx
cmp dword [ebp - 0x1564], eax
jbe 0xc68fda
mov edx, dword [esi + ecx*4]
cmp edx, dword [eax*4 + 0xa192e8]
je 0xc68fd0
inc eax
cmp eax, 0x26
jb 0xc68fb4
inc ecx
xor eax, eax
cmp ecx, dword [ebp - 0x1564]
jae 0xc68fda
jmp 0xc68fb1
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x1570], ebx
mov esi, dword [0xc93054]
mov ecx, esi
push eax
mov dword [ebp - 0x1564], eax
lea eax, [ebp - 0x178]
push 0x55
push eax
push dword [ebx*4 + 0xa192e8]
call dword [0xc99200]
call esi
test eax, eax
je 0xc69043
mov esi, dword [0xc93048]
lea eax, [ebp - 0x818]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0x178]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
test eax, eax
jle 0xc69043
mov ebx, dword [ebp - 0x80c]
shr ebx, 0x1b
and ebx, 1
mov dword [ebp - 0x1564], ebx
mov ebx, dword [ebp - 0x1570]
xor eax, eax
mov edx, 0x9fba10
mov esi, eax
mov ecx, edx
mov dword [ebp + esi*4 - 0x648], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1740]
jne 0xc69058
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0xc6904c
imul ecx, ebx, 3
movzx eax, byte [ecx + 0xa00b58]
mov eax, dword [ebp + eax*4 - 0x648]
mov dword [ebp - 0x1560], eax
movzx eax, byte [ecx + 0xa00b59]
mov eax, dword [ebp + eax*4 - 0x648]
mov dword [ebp - 0x1590], eax
movzx eax, byte [ecx + 0xa00b5a]
mov eax, dword [ebp + eax*4 - 0x648]
mov dword [ebp - 0x1574], eax
xor eax, eax
push 0x1c90
push eax
mov dword [ebp - 0x1584], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x155c], ecx
test ecx, ecx
jne 0xc690ed
mov ebx, 0x8007000e
mov esi, dword [ebp - 0x1568]
jmp 0xc68e07
or dword [ebp - 0x1580], 0xffffffff
xor edx, edx
xor eax, eax
mov dword [ebp - 0x6d8], 0xab69605e
add ecx, 7
mov dword [ebp - 0x6d4], 0x7f1137f
mov edi, 0xa19392
mov dword [ebp - 0x1588], edx
mov esi, edx
mov dword [ebp - 0x157c], ecx
mov dword [ebp - 0x158c], edi
mov dword [ebp - 0x159c], 0x392
movzx ebx, byte [edi - 2]
movzx ecx, byte [edi - 1]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edi]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, ecx
shl edi, 8
mov ecx, dword [ebp - 0x158c]
xor edx, ebx
movzx ecx, byte [ecx + 3]
or edi, ecx
mov ecx, dword [ebp - 0x158c]
shl edi, 8
movzx ecx, byte [ecx + 4]
or edi, ecx
mov ecx, dword [ebp - 0x158c]
shl edi, 8
add dword [ebp - 0x158c], 8
movzx ecx, byte [ecx + 5]
or edi, ecx
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov ecx, esi
mov dword [ebp - 0x15b8], esi
add ecx, 0x54969fa2
rol dword [ebp - 0x15b8], 0xa
rol ecx, 5
imul ecx, ecx, 0x137f
add ecx, dword [ebp - 0x15b8]
xor edx, ecx
mov dword [ebp - 0x15ac], edx
lea ecx, [edx + 0x7f1137f]
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0x15ac]
rol ecx, 2
sub edx, ecx
xor esi, edx
imul edx, esi, 0x605e
mov ecx, esi
shr ecx, 0xd
sub edx, ecx
mov ecx, dword [ebp - 0x15ac]
sub edx, 0x756c8a2
xor ecx, edx
mov dword [ebp - 0x15ac], ecx
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0x15ac]
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub ecx, edx
mov edx, dword [ebp - 0x15ac]
xor edx, ecx
mov dword [ebp - 0x15ac], edx
mov ecx, dword [ebp - 0x15ac]
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor esi, edx
lea ecx, [esi + 0x7f1137f]
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, esi
rol ecx, 2
add edx, ecx
mov ecx, dword [ebp - 0x15ac]
xor ecx, edx
mov dword [ebp - 0x15ac], ecx
add ecx, 0x54969fa2
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0x15ac]
rol ecx, 8
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69605e
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, esi
ror ecx, 0xa
xor edx, ecx
mov ecx, dword [ebp - 0x15ac]
xor ecx, edx
mov dword [ebp - 0x15ac], ecx
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0x15ac]
shr ecx, 0xa
xor edx, ecx
xor esi, edx
mov edx, dword [ebp - 0x15ac]
mov ecx, esi
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor edx, ecx
mov dword [ebp - 0x15ac], edx
lea ecx, [edx - 0x7f1]
xor ecx, esi
mov esi, dword [ebp - 0x15ac]
xor ecx, 0xab69605e
mov dword [ebp - 0x15b8], ecx
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0x15b8]
shr ecx, 2
add edx, ecx
xor esi, edx
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, esi
rol ecx, 7
add edx, ecx
mov ecx, dword [ebp - 0x15b8]
xor ecx, edx
mov dword [ebp - 0x15b8], ecx
mov edx, ecx
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69
rol ecx, 5
imul edx, ecx, 0x7f1
mov ecx, esi
rol ecx, 7
add edx, ecx
xor dword [ebp - 0x15b8], edx
mov edx, dword [ebp - 0x15b8]
xor esi, edx
xor esi, 0xac987321
mov ecx, esi
ror ecx, 3
imul ecx, ecx, 0x137f
sub ecx, 0xd0dd417
xor edx, ecx
mov dword [ebp - 0x15b8], edx
lea ecx, [edx - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0x15b8]
ror ecx, 6
sub edx, ecx
xor esi, edx
lea ecx, [esi - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, esi
rol ecx, 0xe
add edx, ecx
mov ecx, dword [ebp - 0x15b8]
xor ecx, edx
mov dword [ebp - 0x15b8], ecx
add ecx, 0xab69605e
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0x15b8]
ror ecx, 0xe
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, esi
shr ecx, 3
xor edx, ecx
mov ecx, dword [ebp - 0x15b8]
xor ecx, edx
mov dword [ebp - 0x15b8], ecx
xor ecx, 0x7f1137f
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0x15b8]
rol ecx, 2
xor edx, ecx
mov ecx, dword [ebp - 0x15b8]
xor edx, dword [ebp - 0x1588]
xor ecx, dword [ebp - 0x1580]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x15ac], esi
mov esi, dword [ebp - 0x157c]
mov dword [ebp - 0x1580], edi
mov edi, dword [ebp - 0x158c]
mov dword [ebp - 0x1588], ebx
mov byte [esi - 4], dl
mov byte [esi], cl
ror edx, 8
mov byte [esi - 5], dl
ror ecx, 8
mov byte [esi - 1], cl
ror edx, 8
mov byte [esi - 6], dl
ror ecx, 8
mov byte [esi - 2], cl
ror edx, 8
ror ecx, 8
mov byte [esi - 7], dl
mov byte [esi - 3], cl
add esi, 8
ror ecx, 8
ror edx, 8
sub dword [ebp - 0x159c], 1
mov dword [ebp - 0x157c], esi
mov esi, ecx
mov dword [ebp - 0x15b8], ecx
jne 0xc69132
xor ecx, ecx
mov esi, 0x1c90
mov edx, ecx
mov ecx, dword [ebp - 0x155c]
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0xc694cb
movzx eax, al
cdq
cmp eax, dword [0xa1b020]
jne 0xc694ff
cmp edx, dword [0xa1b024]
jne 0xc694ff
mov ebx, dword [ebp - 0x1584]
xor eax, eax
mov dword [ebp - 0x18cc], ecx
mov ecx, eax
mov dword [ebp - 0x156c], esi
jmp 0xc6950a
mov ebx, 0xc004d501
mov dword [ebp - 0x1584], ebx
test ecx, ecx
je 0xc6951f
push ecx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc690e2
mov edi, dword [ebp - 0x18cc]
xor eax, eax
mov ebx, dword [ebp - 0x1570]
mov esi, eax
mov edx, eax
cmp ebx, edx
jne 0xc69544
mov dword [ebp + esi*4 - 0x5b8], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0x1568], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc6954f
sub ecx, dword [ebp - 0x1568]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0xc69539
inc esi
push 0
pop eax
cmp esi, 6
jb 0xc69537
push 0xc
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, dword [ebp - 0x1584]
mov esi, eax
test esi, esi
jne 0xc69708
mov ebx, 0x8007000e
mov edi, dword [ebp - 0x15a4]
test esi, esi
je 0xc6960d
xor eax, eax
mov dword [ebp - 0x1568], eax
mov edx, dword [esi + eax*4]
test edx, edx
je 0xc69601
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x1584], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1740]
jne 0xc695b7
sub ecx, dword [ebp - 0x1584]
xor eax, eax
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc695ec
mov byte [edx], al
inc edx
sub ecx, 1
jne 0xc695db
mov edx, dword [ebp - 0x1568]
mov edx, dword [esi + edx*4]
push edx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1568]
inc eax
mov dword [ebp - 0x1568], eax
cmp eax, 3
jb 0xc695a5
mov eax, dword [ebp - 0x18cc]
test eax, eax
je 0xc6962b
mov ecx, dword [ebp - 0x156c]
test ecx, ecx
je 0xc6962b
xor edx, edx
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0xc69623
test esi, esi
je 0xc69640
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x18cc]
test eax, eax
je 0xc69663
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebp - 0x18cc], eax
mov eax, dword [ebp - 0x1554]
test eax, eax
je 0xc6967e
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc69a2c
mov eax, dword [edi]
mov esi, dword [0xc930b4]
mov ecx, esi
mov dword [ebp - 0x14f0], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x14ec], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x14e8], eax
xor eax, eax
push eax
mov dword [ebp - 0x1aa8], eax
mov edi, eax
mov dword [ebp - 0x1aa4], eax
mov ebx, eax
lea eax, [ebp - 0x1aac]
mov dword [ebp - 0x1aac], 0xc
push eax
xor eax, eax
push eax
push 0x42
call dword [0xc99200]
call esi
test eax, eax
jne 0xc698b9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc696f8
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc698c2
mov ebx, 0x80004005
jmp 0xc698c2
xor eax, eax
mov edi, esi
mov edx, esi
mov dword [ebp - 0x1584], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov ecx, eax
mov eax, esi
sub eax, esi
mov dword [ebp - 0x1568], ecx
mov dword [ebp - 0x1570], eax
movzx edi, word [ebp + ecx*2 - 0x14]
xor eax, eax
cmp di, word [eax*2 + 0xa19380]
je 0xc69747
inc eax
cmp eax, 6
jb 0xc69732
jmp 0xc6982d
mov edi, dword [ebp + eax*4 - 0x5b8]
mov ecx, edi
mov edx, dword [0xc93060]
mov dword [ebp - 0x155c], edx
lea eax, [ecx + 1]
mov dword [ebp - 0x1588], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc69765
sub ecx, dword [ebp - 0x1588]
xor eax, eax
push eax
push eax
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
xor eax, eax
push eax
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0x155c]
mov dword [ebp - 0x155c], eax
test eax, eax
je 0xc6988c
lea ecx, [eax + eax]
xor eax, eax
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0x1584]
mov edx, dword [ebp - 0x1570]
mov dword [edx + ecx], eax
mov eax, dword [ecx]
mov dword [ebp - 0x1588], eax
test eax, eax
je 0xc6958e
mov edx, dword [0xc93060]
mov ecx, edi
mov dword [ebp - 0x1580], edx
lea eax, [ecx + 1]
mov dword [ebp - 0x157c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc697e9
push dword [ebp - 0x155c]
sub ecx, dword [ebp - 0x157c]
push dword [ebp - 0x1588]
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
xor eax, eax
push eax
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0x1580]
test eax, eax
je 0xc69865
mov ecx, dword [ebp - 0x1568]
mov edx, dword [ebp - 0x1584]
push 4
inc ecx
pop eax
add edx, eax
mov dword [ebp - 0x1568], ecx
mov dword [ebp - 0x1584], edx
cmp ecx, 3
jb 0xc6972b
xor eax, eax
mov edi, esi
mov esi, eax
mov dword [ebp - 0x15a4], edi
mov eax, dword [ebp - 0x1564]
mov dword [ebp - 0x14f8], eax
jmp 0xc69599
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc6987c
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc69593
mov ebx, 0x80004005
jmp 0xc69593
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc698a3
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
mov edi, dword [ebp - 0x15a4]
js 0xc69599
mov ebx, 0x80004005
jmp 0xc69599
mov edi, dword [ebp - 0x1aa8]
and edi, 1
mov dword [ebp - 0x14f4], edi
test ebx, ebx
js 0xc69a2c
mov eax, dword [ebp - 0x15a0]
push 0x2a
pop ecx
mov dword [ebp - 0x1554], ecx
sub eax, 1
je 0xc6990d
sub eax, 1
je 0xc69901
sub eax, 1
jne 0xc6991d
mov ebx, 0xe1
mov dword [ebp - 0x1558], ebx
mov dword [ebp - 0x15a8], ebx
jmp 0xc6991d
mov dword [ebp - 0x1558], 0xf
jmp 0xc69913
mov dword [ebp - 0x1558], ecx
mov dword [ebp - 0x15a8], 0xb
push 0x60
pop edi
xor eax, eax
mov dword [ebp - 0x156c], edi
lea esi, [edi + 0x7c]
push esi
push eax
lea eax, [ebp - 0xe70]
push eax
call fcn.00ab4bf6
add esp, 0xc
mov word [ebp - 0xe2c], si
mov esi, dword [0xc93070]
lea eax, [ebp - 0xe70]
mov ecx, esi
push eax
push 0xffffffffffffffff
xor eax, eax
push eax
call dword [0xc99200]
call esi
test eax, eax
je 0xc699a0
movzx ebx, word [ebp - 0xdca]
mov eax, dword [ebp - 0xdc4]
mov ecx, dword [ebp - 0xdc0]
mov dword [ebp - 0x156c], ebx
mov dword [ebp - 0x1568], eax
mov dword [ebp - 0x1b08], eax
mov dword [ebp - 0x1584], ecx
mov dword [ebp - 0x1b04], ecx
cmp ebx, edi
jae 0xc699b8
mov dword [ebp - 0x156c], edi
jmp 0xc699b8
mov eax, dword [ebp - 0x1b04]
mov dword [ebp - 0x1584], eax
mov eax, dword [ebp - 0x1b08]
mov dword [ebp - 0x1568], eax
cmp dword [ebp - 0x15a0], 1
mov edi, dword [ebp - 0x1560]
je 0xc699cd
mov edi, dword [ebp - 0x1574]
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0xc50]
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0x1564], eax
test eax, eax
jne 0xc69bf1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc69a21
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc69c91
mov ebx, 0x80004005
xor eax, eax
push dword [ebp - 0x1578]
mov esi, dword [0xc930b0]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov edi, 0xc96238
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc69a4a
mov eax, dword [0xc95890]
test eax, eax
jle 0xc69aad
sub eax, 1
mov dword [0xc95890], eax
jne 0xc69aad
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc69a7f
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc69a6e
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
mov eax, dword [ebp - 0x15a4]
test eax, eax
je 0xc69acc
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc6bf4c
mov edi, dword [ebp - 0x758]
xor eax, eax
mov ebx, dword [ebp - 0x754]
push 0x54
push eax
lea eax, [ebp - 0x1550]
mov dword [ebp - 0x19c0], edi
push eax
mov dword [ebp - 0x19bc], ebx
call fcn.00ab4bf6
mov esi, dword [0xc93028]
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x1558], 1
push 7
push dword [ebp - 0x15c0]
call dword [0xc99200]
call esi
test eax, eax
je 0xc69b6b
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x1550]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc69b6b
push 0x20
pop eax
cmp word [ebp - 0x153e], ax
jne 0xc69b6b
cmp dword [ebp - 0x153c], 0
je 0xc69b6b
cmp dword [ebp - 0x154c], 0
jle 0xc69b6b
cmp dword [ebp - 0x1548], 0
jg 0xc69b80
xor eax, eax
cmp dword [ebp - 0x15a0], 1
mov dword [ebp - 0x1558], eax
jne 0xc6a4dd
mov esi, dword [0xc930a8]
lea eax, [ebp - 0x14d4]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc930a8]
lea eax, [ebp - 0x14c4]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov ebx, dword [ebp - 0x15a0]
cmp ebx, 1
jne 0xc6a4e3
mov eax, dword [ebp - 0x14f4]
mov esi, dword [0xc93014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0x15b4], eax
jmp 0xc6a4e3
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0x156c]
push dword [ebp - 0x1558]
call dword [0xc99200]
call esi
push edi
push 0x20
neg eax
mov dword [ebp - 0xc40], 0x190
pop edx
lea ecx, [ebp - 0xc34]
mov dword [ebp - 0xc50], eax
mov byte [ebp - 0xc36], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0xc50]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc69c72
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc69c69
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc69c78
mov ebx, 0x80004005
jmp 0xc69c78
mov dword [ebp - 0x14e4], eax
push dword [ebp - 0x1564]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xc69a2c
cmp dword [ebp - 0x15a0], 1
je 0xc69cae
mov eax, dword [ebp - 0x1574]
mov dword [ebp - 0x1560], eax
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0xbf0]
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov edi, eax
test edi, edi
jne 0xc69d05
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc69cfa
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc69da5
jmp 0xc69a27
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0x156c]
push dword [ebp - 0x15a8]
call dword [0xc99200]
call esi
push dword [ebp - 0x1560]
neg eax
mov dword [ebp - 0xbe0], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0xbd4]
mov dword [ebp - 0xbf0], eax
mov byte [ebp - 0xbd6], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0xbf0]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc69d8b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc69d82
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc69d91
mov ebx, 0x80004005
jmp 0xc69d91
mov dword [ebp - 0x14e0], eax
mov esi, dword [0xc930b0]
xor eax, eax
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
xor eax, eax
test ebx, ebx
js 0xc69a2e
mov ebx, dword [ebp - 0x15a0]
mov ecx, eax
mov edx, eax
mov eax, ebx
sub eax, 1
je 0xc69dca
sub eax, 1
je 0xc69e06
sub eax, 1
jne 0xc69dd6
mov ecx, dword [ebp - 0x1568]
mov edx, dword [ebp - 0x1584]
xor eax, eax
mov dword [ebp - 0x750], ecx
mov dword [ebp - 0x74c], edx
xor edx, edx
inc edx
cmp ebx, edx
je 0xc69e42
lea eax, [ebx - 2]
cmp eax, edx
ja 0xc69e1c
xor eax, eax
xor ebx, ebx
mov edx, eax
mov dword [ebp - 0x1554], ebx
mov dword [ebp - 0x1560], ebx
jmp 0xc69e50
mov eax, dword [ebp - 0x1568]
cdq
and edx, 3
lea ecx, [edx + eax]
sar ecx, 2
xor eax, eax
mov edx, eax
jmp 0xc69dd8
mov eax, dword [ebp - 0x15fc]
mov edx, dword [ebp - 0x15fc]
mov dword [ebp - 0x1560], eax
mov eax, dword [ebp - 0x15fc]
mov dword [ebp - 0x1554], eax
mov eax, dword [ebp - 0x15fc]
jmp 0xc69e50
push 0x20
pop esi
mov edx, 0x96
mov dword [ebp - 0x1560], esi
mov dword [ebp - 0x1558], edx
mov dword [ebp - 0x15a8], eax
push dword [ebp - 0x14e4]
mov esi, dword [0xc9303c]
sub ecx, edx
push dword [ebp - 0x1578]
mov edi, dword [ebp - 0x14f0]
sub ecx, eax
mov dword [ebp - 0x1574], ecx
xor eax, eax
mov dword [ebp - 0x14bc], ecx
mov ebx, eax
mov dword [ebp - 0x14cc], ecx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0x1568], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x14d4]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0x1578]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc69ed0
mov ebx, 0x80004005
mov eax, dword [ebp - 0x1568]
test eax, eax
je 0xc69eec
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
xor eax, eax
test ebx, ebx
js 0xc69a2e
push dword [ebp - 0x14e0]
mov esi, dword [0xc9303c]
mov ebx, eax
push dword [ebp - 0x1578]
mov edi, dword [ebp - 0x14ec]
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0x1568], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x14c4]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0x1578]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc69f52
mov ebx, 0x80004005
mov eax, dword [ebp - 0x1568]
test eax, eax
je 0xc69f6e
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xc69a2c
mov eax, dword [ebp - 0x15a0]
cmp eax, 2
je 0xc69f86
cmp eax, 3
jne 0xc69f9c
mov edi, dword [ebp - 0x14bc]
cmp dword [ebp - 0x14cc], edi
jle 0xc69fa2
mov edi, dword [ebp - 0x14cc]
jmp 0xc69fa2
mov edi, dword [ebp - 0x1574]
cmp dword [ebp - 0x14f8], 0
mov esi, dword [0xc930a8]
mov ecx, esi
push dword [ebp - 0x1554]
je 0xc69fe3
mov ebx, dword [ebp - 0x15a8]
mov eax, ebx
sub eax, dword [ebp - 0x14cc]
add eax, edi
push eax
lea eax, [ebp - 0x14d4]
push eax
call dword [0xc99200]
call esi
sub ebx, dword [ebp - 0x14bc]
add ebx, edi
jmp 0xc69ff9
mov ebx, dword [ebp - 0x1558]
lea eax, [ebp - 0x14d4]
push ebx
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x14c8]
add eax, dword [ebp - 0x1560]
mov esi, dword [0xc930a8]
mov ecx, esi
push eax
push ebx
lea eax, [ebp - 0x14c4]
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x15a0]
cmp eax, 2
je 0xc6a2df
cmp eax, 3
je 0xc6a2df
cmp eax, 1
jne 0xc6a2fb
xor eax, eax
mov dword [ebp - 0x14d8], 0xffffff
push 0x5c
push eax
lea eax, [ebp - 0xb90]
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0x1558], eax
test eax, eax
jne 0xc6a0a4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc6a099
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc6a145
jmp 0xc69a27
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0x156c]
push 0xb
call dword [0xc99200]
call esi
push dword [ebp - 0x1590]
neg eax
mov dword [ebp - 0xb80], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0xb74]
mov dword [ebp - 0xb90], eax
mov byte [ebp - 0xb76], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0xb90]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc6a126
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc6a11d
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc6a12c
mov ebx, 0x80004005
jmp 0xc6a12c
mov dword [ebp - 0x14dc], eax
push dword [ebp - 0x1558]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
xor eax, eax
test ebx, ebx
js 0xc69a2e
push dword [ebp - 0x14dc]
mov esi, dword [0xc9303c]
mov ebx, eax
push dword [ebp - 0x1578]
mov dword [ebp - 0x14ac], edi
mov ecx, esi
mov edi, dword [ebp - 0x14e8]
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0x1558], eax
xor eax, eax
push eax
push 0x460
lea eax, [ebp - 0x14b4]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0x1578]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc6a1b1
mov ebx, 0x80004005
mov eax, dword [ebp - 0x1558]
test eax, eax
je 0xc6a1cd
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xc69a2c
mov eax, dword [ebp - 0x14ac]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x14ac], eax
cmp eax, ecx
jge 0xc6a1f1
mov dword [ebp - 0x14ac], ecx
mov ebx, dword [ebp - 0x156c]
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
pop edi
push edi
push ebx
push dword [ebp - 0x14b4]
mov dword [ebp - 0x14a8], 0x20
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x14b0]
mov dword [ebp - 0x14b4], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x14ac]
mov dword [ebp - 0x14b0], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x14a8]
mov dword [ebp - 0x14ac], eax
call dword [0xc99200]
call esi
mov ecx, dword [ebp - 0x14b8]
mov esi, dword [0xc930a8]
add ecx, 0x24
cmp dword [ebp - 0x14f8], 0
mov dword [ebp - 0x14a8], eax
je 0xc6a2bd
mov eax, dword [ebp - 0x14d4]
cmp eax, dword [ebp - 0x14c4]
jl 0xc6a2a8
mov eax, dword [ebp - 0x14c4]
push ecx
push eax
lea eax, [ebp - 0x14b4]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
jmp 0xc6a2fb
mov eax, dword [ebp - 0x14cc]
cmp eax, dword [ebp - 0x14bc]
jg 0xc6a2d1
mov eax, dword [ebp - 0x14bc]
sub eax, dword [ebp - 0x14ac]
add eax, dword [ebp - 0x14b4]
jmp 0xc6a2a8
mov eax, dword [ebp - 0x14b8]
mov dword [ebp - 0x750], edi
mov dword [ebp - 0x74c], eax
mov dword [ebp - 0x14d8], 0xffa8a8a8
mov eax, dword [ebp - 0x14f8]
mov ebx, dword [ebp - 0x750]
mov dword [ebp - 0x1558], eax
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x15a8], eax
mov eax, dword [ebp - 0x15a0]
sub eax, 1
je 0xc6a4ca
sub eax, 1
je 0xc6a3fa
sub eax, 1
jne 0xc6a3f1
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x868]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push 1
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x868]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x868], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xc6a3f1
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x854]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x84c]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x84c]
lea esi, [ebp - 0x854]
sub eax, ebx
lea edi, [ebp - 0x1b20]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x758], eax
mov eax, dword [ebp - 0x848]
sub eax, dword [ebp - 0x15a8]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
mov dword [ebp - 0x754], eax
xor eax, eax
mov ebx, eax
jmp 0xc69a2e
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x890]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push 1
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x890]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x890], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xc6a3f1
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x87c]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x874]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1558], 0
lea esi, [ebp - 0x87c]
lea edi, [ebp - 0x1b20]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xc6a4a2
imul eax, dword [ebp - 0x874], 5
cdq
idiv ecx
add eax, dword [ebp - 0x87c]
jmp 0xc6a4b0
mov eax, dword [ebp - 0x874]
sub eax, ebx
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x758], eax
mov eax, dword [ebp - 0x870]
sub eax, dword [ebp - 0x15a8]
imul eax, eax, 0x5f
jmp 0xc6a3e8
xor eax, eax
mov dword [ebp - 0x758], eax
mov dword [ebp - 0x754], eax
jmp 0xc6a3f3
mov ebx, dword [ebp - 0x15a0]
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push dword [ebp - 0x15c0]
call dword [0xc99200]
call esi
cmp dword [ebp - 0x14f8], 0
mov dword [ebp - 0x15a8], eax
mov dword [ebp - 0x15a4], 0x810
je 0xc6a51e
mov dword [ebp - 0x15a4], 0x20812
cmp dword [ebp - 0x1558], 0
je 0xc6b02f
mov eax, dword [ebp - 0x14f4]
mov ebx, dword [ebp - 0x14f0]
mov dword [ebp - 0x1558], eax
mov eax, dword [ebp - 0x14e4]
mov dword [ebp - 0x1560], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x1080]
mov dword [ebp - 0x1590], ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x10d8]
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x1574], eax
mov dword [ebp - 0x1578], eax
mov dword [ebp - 0x1554], eax
push 0x2c
push eax
mov dword [ebp - 0x156c], eax
lea eax, [ebp - 0x93c]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x788]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xc6bf2c
mov esi, dword [0xc93028]
mov ecx, esi
mov ebx, dword [ebp - 0x15c0]
push 7
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xc6b0c4
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x1080]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc6a61a
mov eax, dword [ebp - 0x106c]
mov dword [ebp - 0x1574], eax
mov eax, dword [ebp - 0x107c]
mov dword [ebp - 0x1554], eax
mov eax, dword [ebp - 0x1078]
mov dword [ebp - 0x156c], eax
mov esi, dword [0xc93008]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov ebx, eax
mov dword [ebp - 0x1568], ebx
test ebx, ebx
je 0xc6b0c4
mov eax, dword [ebp - 0x14cc]
xor ecx, ecx
sub eax, dword [ebp - 0x14d4]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x938], eax
mov eax, dword [ebp - 0x14d0]
sub eax, dword [ebp - 0x14c8]
mov dword [ebp - 0x934], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x18d4], ecx
mov word [ebp - 0x930], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x92e], ax
lea eax, [ebp - 0x18d4]
push eax
push ecx
lea eax, [ebp - 0x93c]
mov dword [ebp - 0x1584], ecx
push eax
mov dword [ebp - 0x92c], ecx
mov dword [ebp - 0x928], ecx
mov dword [ebp - 0x924], ecx
mov dword [ebp - 0x920], ecx
mov dword [ebp - 0x91c], ecx
mov dword [ebp - 0x918], ecx
mov dword [ebp - 0x914], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x93c], 0x28
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0x1564], edi
test edi, edi
jne 0xc6a718
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x1584], eax
test eax, eax
jle 0xc6a703
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1584], eax
test eax, eax
js 0xc6aa8c
mov dword [ebp - 0x1584], 0x80004005
jmp 0xc6aa8c
mov esi, dword [0xc93034]
lea eax, [ebp - 0x10d8]
push eax
push 0x54
push edi
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc6a742
mov eax, dword [ebp - 0x10c4]
mov dword [ebp - 0x1578], eax
mov eax, dword [ebp - 0x14cc]
sub eax, dword [ebp - 0x14d4]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x780], eax
mov eax, dword [ebp - 0x14c8]
sub eax, dword [ebp - 0x14d0]
push edi
push ebx
mov dword [ebp - 0x77c], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push ebx
call dword [0xc99200]
call esi
push dword [ebp - 0x1560]
mov esi, dword [0xc9303c]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0x1560], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x788]
mov ecx, edi
push eax
push ebx
call dword [0xc99200]
call edi
mov esi, dword [0xc9306c]
xor eax, eax
push eax
push dword [ebp - 0x15a4]
lea eax, [ebp - 0x788]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0x1590]
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0x15a0], 1
jne 0xc6a835
cmp dword [ebp - 0x1558], 0
je 0xc6a829
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0x1558], eax
jmp 0xc6a83f
mov dword [ebp - 0x1558], 0xffffff
jmp 0xc6a83f
mov dword [ebp - 0x1558], 0xffa8a8a8
mov edx, dword [ebp - 0x14d4]
xor ecx, ecx
mov eax, dword [ebp - 0x14d0]
mov edi, ecx
mov dword [ebp - 0x1590], edx
test edx, edx
jns 0xc6a867
mov edi, edx
neg edi
xor edx, edx
mov dword [ebp - 0x1590], edx
jmp 0xc6a869
xor edx, edx
test eax, eax
jns 0xc6a873
mov ecx, eax
mov eax, edx
neg ecx
mov esi, dword [ebp - 0x780]
mov edx, dword [ebp - 0x1554]
sub esi, edi
sub edx, dword [ebp - 0x1590]
mov dword [ebp - 0x1570], esi
cmp esi, edx
jl 0xc6a899
mov esi, edx
mov dword [ebp - 0x1570], edx
mov edx, dword [ebp - 0x77c]
sub dword [ebp - 0x156c], eax
sub edx, ecx
mov dword [ebp - 0x155c], edx
cmp edx, dword [ebp - 0x156c]
jl 0xc6a8c1
mov edx, dword [ebp - 0x156c]
mov dword [ebp - 0x155c], edx
test esi, esi
jle 0xc6aa5a
test edx, edx
jle 0xc6aa5a
mov edx, dword [ebp - 0x780]
imul eax, dword [ebp - 0x1554]
imul ecx, edx
shl edx, 2
add eax, dword [ebp - 0x1590]
add ecx, edi
mov edi, dword [ebp - 0x1578]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0x1574]
mov dword [ebp - 0x1574], edx
mov edx, dword [ebp - 0x1554]
shl edx, 2
lea eax, [edi + eax*4]
mov dword [ebp - 0x1578], ecx
mov dword [ebp - 0x1590], eax
mov dword [ebp - 0x1554], edx
mov ebx, eax
mov dword [ebp - 0x1580], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0x156c], edx
lea edi, [ecx + 2]
mov dword [ebp - 0x1588], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc6aa01
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x1558]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x1588]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x156c]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x1558]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x156c]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x1556]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x156c]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x1580]
cdq
idiv ecx
mov edx, dword [ebp - 0x156c]
add al, bl
mov ebx, dword [ebp - 0x1588]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x156c], edx
mov dword [ebp - 0x1580], esi
jne 0xc6a93b
mov ecx, dword [ebp - 0x1578]
mov eax, dword [ebp - 0x1590]
add ecx, dword [ebp - 0x1574]
add eax, dword [ebp - 0x1554]
sub dword [ebp - 0x155c], 1
mov esi, dword [ebp - 0x1570]
mov dword [ebp - 0x1578], ecx
mov dword [ebp - 0x1590], eax
jne 0xc6a91f
mov ebx, dword [ebp - 0x1568]
push dword [ebp - 0x1564]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1560]
test eax, eax
je 0xc6aa8c
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1584], 0
jl 0xc6bf2c
mov eax, dword [ebp - 0x14f4]
mov ebx, dword [ebp - 0x14ec]
mov dword [ebp - 0x1558], eax
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x1560], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x1130]
mov dword [ebp - 0x1590], ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x1398]
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x1574], eax
mov dword [ebp - 0x1578], eax
mov dword [ebp - 0x1554], eax
push 0x2c
push eax
mov dword [ebp - 0x156c], eax
lea eax, [ebp - 0x9c0]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x798]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xc6bf2c
mov esi, dword [0xc93028]
mov ecx, esi
mov ebx, dword [ebp - 0x15c0]
push 7
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xc6b0c4
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x1130]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc6ab99
mov eax, dword [ebp - 0x111c]
mov dword [ebp - 0x1574], eax
mov eax, dword [ebp - 0x112c]
mov dword [ebp - 0x1554], eax
mov eax, dword [ebp - 0x1128]
mov dword [ebp - 0x156c], eax
mov esi, dword [0xc93008]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov ebx, eax
mov dword [ebp - 0x1568], ebx
test ebx, ebx
je 0xc6b0c4
mov eax, dword [ebp - 0x14bc]
xor ecx, ecx
sub eax, dword [ebp - 0x14c4]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x9bc], eax
mov eax, dword [ebp - 0x14c0]
sub eax, dword [ebp - 0x14b8]
mov dword [ebp - 0x9b8], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x18d8], ecx
mov word [ebp - 0x9b4], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x9b2], ax
lea eax, [ebp - 0x18d8]
push eax
push ecx
lea eax, [ebp - 0x9c0]
mov dword [ebp - 0x1584], ecx
push eax
mov dword [ebp - 0x9b0], ecx
mov dword [ebp - 0x9ac], ecx
mov dword [ebp - 0x9a8], ecx
mov dword [ebp - 0x9a4], ecx
mov dword [ebp - 0x9a0], ecx
mov dword [ebp - 0x99c], ecx
mov dword [ebp - 0x998], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x9c0], 0x28
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0x1564], edi
test edi, edi
jne 0xc6ac97
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x1584], eax
test eax, eax
jle 0xc6ac82
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1584], eax
test eax, eax
js 0xc6b00c
mov dword [ebp - 0x1584], 0x80004005
jmp 0xc6b00c
mov esi, dword [0xc93034]
lea eax, [ebp - 0x1398]
push eax
push 0x54
push edi
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc6acc1
mov eax, dword [ebp - 0x1384]
mov dword [ebp - 0x1578], eax
mov eax, dword [ebp - 0x14bc]
sub eax, dword [ebp - 0x14c4]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x790], eax
mov eax, dword [ebp - 0x14b8]
sub eax, dword [ebp - 0x14c0]
push edi
push ebx
mov dword [ebp - 0x78c], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push ebx
call dword [0xc99200]
call esi
push dword [ebp - 0x1560]
mov esi, dword [0xc9303c]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0x1560], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x798]
mov ecx, edi
push eax
push ebx
call dword [0xc99200]
call edi
mov esi, dword [0xc9306c]
xor eax, eax
push eax
push dword [ebp - 0x15a4]
lea eax, [ebp - 0x798]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0x1590]
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0x15a0], 1
jne 0xc6adae
cmp dword [ebp - 0x1558], 0
je 0xc6ada2
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
jmp 0xc6adb3
mov dword [ebp - 0x15a0], 0xffffff
jmp 0xc6adbf
mov eax, 0xffa8a8a8
mov dword [ebp - 0x15a0], eax
mov dword [ebp - 0x15c8], eax
mov edx, dword [ebp - 0x14c4]
xor ecx, ecx
mov eax, dword [ebp - 0x14c0]
mov edi, ecx
mov dword [ebp - 0x1558], edx
test edx, edx
jns 0xc6ade7
mov edi, edx
neg edi
xor edx, edx
mov dword [ebp - 0x1558], edx
jmp 0xc6ade9
xor edx, edx
test eax, eax
jns 0xc6adf3
mov ecx, eax
mov eax, edx
neg ecx
mov esi, dword [ebp - 0x790]
mov edx, dword [ebp - 0x1554]
sub esi, edi
sub edx, dword [ebp - 0x1558]
mov dword [ebp - 0x15a4], esi
cmp esi, edx
jl 0xc6ae19
mov esi, edx
mov dword [ebp - 0x15a4], edx
mov edx, dword [ebp - 0x78c]
sub dword [ebp - 0x156c], eax
sub edx, ecx
mov dword [ebp - 0x1590], edx
cmp edx, dword [ebp - 0x156c]
jl 0xc6ae41
mov edx, dword [ebp - 0x156c]
mov dword [ebp - 0x1590], edx
test esi, esi
jle 0xc6afda
test edx, edx
jle 0xc6afda
mov edx, dword [ebp - 0x790]
imul eax, dword [ebp - 0x1554]
imul ecx, edx
shl edx, 2
add eax, dword [ebp - 0x1558]
add ecx, edi
mov edi, dword [ebp - 0x1578]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0x1574]
mov dword [ebp - 0x1574], edx
mov edx, dword [ebp - 0x1554]
shl edx, 2
lea eax, [edi + eax*4]
mov dword [ebp - 0x1578], ecx
mov dword [ebp - 0x1558], eax
mov dword [ebp - 0x1554], edx
mov ebx, eax
mov dword [ebp - 0x155c], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0x156c], edx
lea edi, [ecx + 2]
mov dword [ebp - 0x1570], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc6af81
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x15c8]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x1570]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x156c]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x15c8]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x156c]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x159e]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x156c]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x155c]
cdq
idiv ecx
mov edx, dword [ebp - 0x156c]
add al, bl
mov ebx, dword [ebp - 0x1570]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x156c], edx
mov dword [ebp - 0x155c], esi
jne 0xc6aebb
mov ecx, dword [ebp - 0x1578]
mov eax, dword [ebp - 0x1558]
add ecx, dword [ebp - 0x1574]
add eax, dword [ebp - 0x1554]
sub dword [ebp - 0x1590], 1
mov esi, dword [ebp - 0x15a4]
mov dword [ebp - 0x1578], ecx
mov dword [ebp - 0x1558], eax
jne 0xc6ae9f
mov ebx, dword [ebp - 0x1568]
push dword [ebp - 0x1564]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1560]
test eax, eax
je 0xc6b00c
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0x1584], 0
jl 0xc6bf2c
jmp 0xc6beda
cmp dword [ebp - 0x14f4], 0
jne 0xc6b041
cmp ebx, 1
je 0xc6b041
mov al, 0xc0
jmp 0xc6b043
or al, 0xff
mov esi, dword [0xc93008]
xor ecx, ecx
push dword [ebp - 0x15c0]
mov edi, ecx
mov byte [ebp - 0x1556], al
mov eax, ecx
mov byte [ebp - 0x1558], cl
mov byte [ebp - 0x1557], cl
mov dword [ebp - 0x1b58], ecx
mov dword [ebp - 0x1b54], ecx
mov dword [ebp - 0x1574], ecx
mov dword [ebp - 0x1b3c], ecx
mov dword [ebp - 0x1b38], ecx
mov dword [ebp - 0x1b34], ecx
mov ecx, esi
mov byte [ebp - 0x1555], 1
mov dword [ebp - 0x1560], eax
mov dword [ebp - 0x1b60], eax
mov dword [ebp - 0x1590], edi
mov dword [ebp - 0x1b5c], edi
mov dword [ebp - 0x1b40], eax
call dword [0xc99200]
call esi
mov dword [ebp - 0x15b0], eax
test eax, eax
jne 0xc6b0cf
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc6bf2c
cmp ebx, 1
jne 0xc6b1cb
mov eax, dword [ebp - 0x14cc]
mov edx, dword [ebp - 0x14bc]
sub edx, dword [ebp - 0x14c4]
sub eax, dword [ebp - 0x14d4]
mov dword [ebp - 0x1578], edx
cmp edx, eax
jg 0xc6b102
mov edx, eax
mov dword [ebp - 0x1578], eax
mov ecx, dword [ebp - 0x14b8]
mov eax, ecx
sub eax, dword [ebp - 0x14d0]
mov dword [ebp - 0x1554], eax
xor eax, eax
mov ebx, eax
cmp dword [ebp - 0x14f8], eax
je 0xc6b158
mov edi, dword [ebp - 0x14d4]
sub edi, dword [ebp - 0x14cc]
mov eax, dword [ebp - 0x14c4]
add edi, edx
sub eax, dword [ebp - 0x14bc]
mov ebx, edi
add eax, edx
mov dword [ebp - 0x1560], edi
mov dword [ebp - 0x1b60], edi
mov dword [ebp - 0x1574], eax
mov dword [ebp - 0x1b40], eax
sub eax, dword [ebp - 0x14c4]
add eax, dword [ebp - 0x14bc]
sub ebx, dword [ebp - 0x14d4]
mov edi, dword [ebp - 0x14c8]
sub edi, dword [ebp - 0x14d0]
add ebx, dword [ebp - 0x14cc]
sub ecx, dword [ebp - 0x14c0]
mov dword [ebp - 0x1568], eax
mov dword [ebp - 0x1b38], eax
mov eax, dword [ebp - 0x14c0]
sub eax, dword [ebp - 0x14d0]
add ecx, eax
mov dword [ebp - 0x1b58], ebx
mov dword [ebp - 0x156c], edi
mov dword [ebp - 0x1b54], edi
mov dword [ebp - 0x1584], eax
mov dword [ebp - 0x1b3c], eax
mov dword [ebp - 0x1564], ecx
mov dword [ebp - 0x1b34], ecx
jmp 0xc6b25d
mov eax, dword [ebp - 0x74c]
lea esi, [ebp - 0x14d4]
lea edi, [ebp - 0x1b60]
mov edx, dword [ebp - 0x750]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1554], eax
mov dword [ebp - 0x1578], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1b54]
lea esi, [ebp - 0x14c4]
mov ebx, dword [ebp - 0x1b58]
lea edi, [ebp - 0x1b40]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x156c], eax
mov eax, dword [ebp - 0x1b5c]
mov dword [ebp - 0x1590], eax
mov eax, dword [ebp - 0x1b60]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1560], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1b34]
mov dword [ebp - 0x1564], eax
mov eax, dword [ebp - 0x1b38]
mov dword [ebp - 0x1568], eax
mov eax, dword [ebp - 0x1b3c]
mov dword [ebp - 0x1584], eax
mov eax, dword [ebp - 0x1b40]
mov dword [ebp - 0x1574], eax
mov edi, dword [ebp - 0x1554]
xor ecx, ecx
mov esi, dword [0xc9300c]
mov eax, edi
neg eax
mov dword [ebp - 0x18dc], ecx
mov dword [ebp - 0x8dc], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x8d4], ecx
mov word [ebp - 0x8d8], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x8d6], ax
lea eax, [ebp - 0x18dc]
push eax
push ecx
lea eax, [ebp - 0x8e4]
mov dword [ebp - 0x8d0], ecx
push eax
push dword [ebp - 0x15b0]
mov dword [ebp - 0x8cc], ecx
mov dword [ebp - 0x8c8], ecx
mov dword [ebp - 0x8c4], ecx
mov dword [ebp - 0x8c0], ecx
mov dword [ebp - 0x8bc], ecx
mov ecx, esi
mov dword [ebp - 0x8e4], 0x28
mov dword [ebp - 0x8e0], edx
call dword [0xc99200]
call esi
mov dword [ebp - 0x1598], eax
test eax, eax
jne 0xc6b2ff
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc6bf11
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push dword [ebp - 0x15b0]
call dword [0xc99200]
call esi
cmp dword [ebp - 0x15a0], 1
jne 0xc6b367
mov ecx, dword [ebp - 0x15b4]
test ecx, ecx
je 0xc6b367
mov esi, dword [0xc93074]
xor eax, eax
mov dword [ebp - 0x7a8], eax
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp - 0x1578]
push ecx
mov dword [ebp - 0x7a0], eax
mov ecx, esi
lea eax, [ebp - 0x7a8]
mov dword [ebp - 0x79c], edi
push eax
push dword [ebp - 0x15b0]
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x14f4]
mov esi, dword [ebp - 0x14f0]
mov dword [ebp - 0x1570], eax
mov eax, dword [ebp - 0x14e4]
mov dword [ebp - 0x155c], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x1188]
mov dword [ebp - 0x1588], esi
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x11e0]
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x1580], eax
mov dword [ebp - 0x157c], eax
mov dword [ebp - 0x158c], eax
push 0x2c
push eax
mov dword [ebp - 0x159c], eax
lea eax, [ebp - 0xa18]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x748]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0xc6bef6
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [ebp - 0x15b0]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc6b41b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc6bef6
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x1188]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc6b45d
mov eax, dword [ebp - 0x1174]
mov dword [ebp - 0x1580], eax
mov eax, dword [ebp - 0x1184]
mov dword [ebp - 0x158c], eax
mov eax, dword [ebp - 0x1180]
mov dword [ebp - 0x159c], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x15b8], ecx
test ecx, ecx
je 0xc6b410
mov eax, dword [ebp - 0x1590]
xor edx, edx
mov edi, dword [ebp - 0x156c]
sub eax, edi
sub ebx, dword [ebp - 0x1560]
mov esi, dword [0xc9300c]
mov dword [ebp - 0xa10], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x18e4], edx
mov word [ebp - 0xa0c], ax
pop eax
push edx
push edx
mov word [ebp - 0xa0a], ax
lea eax, [ebp - 0x18e4]
push eax
push edx
lea eax, [ebp - 0xa18]
mov dword [ebp - 0x15ac], edx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0xa08], edx
mov dword [ebp - 0xa04], edx
mov dword [ebp - 0xa00], edx
mov dword [ebp - 0x9fc], edx
mov dword [ebp - 0x9f8], edx
mov dword [ebp - 0x9f4], edx
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xa18], 0x28
mov dword [ebp - 0xa14], ebx
call dword [0xc99200]
call esi
mov dword [ebp - 0x156c], eax
test eax, eax
jne 0xc6b557
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x15ac], eax
test eax, eax
jle 0xc6b53c
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x15ac], eax
test eax, eax
mov edi, dword [ebp - 0x15b8]
js 0xc6b8b0
mov dword [ebp - 0x15ac], 0x80004005
jmp 0xc6b8b0
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x11e0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc6b581
mov eax, dword [ebp - 0x11cc]
mov dword [ebp - 0x157c], eax
push dword [ebp - 0x156c]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x740], ebx
mov ebx, dword [ebp - 0x1590]
sub edi, ebx
mov dword [ebp - 0x73c], edi
mov edi, dword [ebp - 0x15b8]
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0x155c]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0x1590], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
mov esi, dword [ebp - 0x15b8]
mov ecx, edi
push eax
lea eax, [ebp - 0x748]
push eax
push esi
call dword [0xc99200]
call edi
xor eax, eax
push eax
push dword [ebp - 0x15a4]
lea eax, [ebp - 0x748]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x1588]
push esi
mov esi, dword [0xc9306c]
mov ecx, esi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x15a0], 1
jne 0xc6b675
cmp dword [ebp - 0x1570], 0
je 0xc6b669
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0x1570], eax
jmp 0xc6b67f
mov dword [ebp - 0x1570], 0xffffff
jmp 0xc6b67f
mov dword [ebp - 0x1570], 0xffa8a8a8
mov ecx, dword [ebp - 0x1560]
xor edx, edx
mov edi, edx
mov eax, edx
test ecx, ecx
jns 0xc6b695
mov edi, ecx
mov ecx, edx
neg edi
test ebx, ebx
jns 0xc6b69f
mov eax, ebx
mov ebx, edx
neg eax
mov esi, dword [ebp - 0x740]
mov edx, dword [ebp - 0x158c]
sub esi, edi
sub edx, ecx
mov dword [ebp - 0x1560], esi
cmp esi, edx
jl 0xc6b6c1
mov esi, edx
mov dword [ebp - 0x1560], edx
mov edx, dword [ebp - 0x73c]
sub dword [ebp - 0x159c], ebx
sub edx, eax
mov dword [ebp - 0x155c], edx
cmp edx, dword [ebp - 0x159c]
jl 0xc6b6e9
mov edx, dword [ebp - 0x159c]
mov dword [ebp - 0x155c], edx
test esi, esi
jle 0xc6b878
test edx, edx
jle 0xc6b878
mov edx, dword [ebp - 0x740]
imul ebx, dword [ebp - 0x158c]
imul eax, edx
shl edx, 2
add ebx, ecx
mov ecx, dword [ebp - 0x1580]
add eax, edi
mov edi, dword [ebp - 0x157c]
mov dword [ebp - 0x157c], edx
mov edx, dword [ebp - 0x158c]
lea ecx, [ecx + ebx*4]
shl edx, 2
lea eax, [edi + eax*4]
mov dword [ebp - 0x1580], ecx
mov dword [ebp - 0x1588], eax
mov dword [ebp - 0x158c], edx
mov ebx, ecx
mov dword [ebp - 0x15cc], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [ebp - 0x159c], edx
lea edi, [eax + 2]
mov dword [ebp - 0x15c4], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc6b825
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x1570]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x15c4]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x159c]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x1570]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x159c]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x156e]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x159c]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x15cc]
cdq
idiv ecx
mov edx, dword [ebp - 0x159c]
add al, bl
mov ebx, dword [ebp - 0x15c4]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x159c], edx
mov dword [ebp - 0x15cc], esi
jne 0xc6b75f
mov eax, dword [ebp - 0x1588]
mov ecx, dword [ebp - 0x1580]
add eax, dword [ebp - 0x157c]
add ecx, dword [ebp - 0x158c]
sub dword [ebp - 0x155c], 1
mov esi, dword [ebp - 0x1560]
mov dword [ebp - 0x1588], eax
mov dword [ebp - 0x1580], ecx
jne 0xc6b743
push dword [ebp - 0x156c]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1590]
mov edi, dword [ebp - 0x15b8]
test eax, eax
je 0xc6b8b0
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x15ac], 0
jl 0xc6bef6
mov eax, dword [ebp - 0x14f4]
mov ebx, dword [ebp - 0x14ec]
mov dword [ebp - 0x1560], eax
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x1590], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x1238]
mov dword [ebp - 0x156c], ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x12e8]
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x1570], eax
mov dword [ebp - 0x155c], eax
mov dword [ebp - 0x1588], eax
push 0x2c
push eax
mov dword [ebp - 0x1580], eax
lea eax, [ebp - 0x994]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x7c8]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xc6bef6
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [ebp - 0x15b0]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xc6b410
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x1238]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc6b9bd
mov eax, dword [ebp - 0x1224]
mov dword [ebp - 0x1570], eax
mov eax, dword [ebp - 0x1234]
mov dword [ebp - 0x1588], eax
mov eax, dword [ebp - 0x1230]
mov dword [ebp - 0x1580], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0x157c], edi
test edi, edi
je 0xc6b410
mov ebx, dword [ebp - 0x1584]
xor eax, eax
mov dword [ebp - 0x18e8], eax
xor ecx, ecx
mov dword [ebp - 0x158c], eax
mov dword [ebp - 0x984], eax
mov dword [ebp - 0x980], eax
mov dword [ebp - 0x97c], eax
mov dword [ebp - 0x978], eax
mov dword [ebp - 0x974], eax
mov dword [ebp - 0x970], eax
mov dword [ebp - 0x96c], eax
mov eax, dword [ebp - 0x1568]
sub eax, dword [ebp - 0x1574]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x1568], eax
mov dword [ebp - 0x990], eax
mov eax, ebx
sub eax, dword [ebp - 0x1564]
mov dword [ebp - 0x98c], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x994], 0x28
mov word [ebp - 0x988], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x986], ax
lea eax, [ebp - 0x18e8]
push eax
push ecx
lea eax, [ebp - 0x994]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov dword [ebp - 0x1584], eax
test eax, eax
jne 0xc6bac3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x158c], eax
test eax, eax
jle 0xc6baae
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x158c], eax
test eax, eax
js 0xc6be32
mov dword [ebp - 0x158c], 0x80004005
jmp 0xc6be32
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x12e8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xc6baed
mov eax, dword [ebp - 0x12d4]
mov dword [ebp - 0x155c], eax
mov eax, dword [ebp - 0x1568]
push dword [ebp - 0x1584]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x7c0], eax
mov eax, dword [ebp - 0x1564]
sub eax, ebx
push edi
mov dword [ebp - 0x7bc], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0x1590]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0x1590], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x7c8]
mov ecx, edi
push eax
push dword [ebp - 0x157c]
call dword [0xc99200]
call edi
mov edi, dword [ebp - 0x157c]
xor eax, eax
mov esi, dword [0xc9306c]
mov ecx, esi
push eax
push dword [ebp - 0x15a4]
lea eax, [ebp - 0x7c8]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x156c]
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x15a0], 1
jne 0xc6bbe0
cmp dword [ebp - 0x1560], 0
je 0xc6bbd4
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
jmp 0xc6bbe5
mov dword [ebp - 0x15a4], 0xffffff
jmp 0xc6bbf1
mov eax, 0xffa8a8a8
mov dword [ebp - 0x15a4], eax
mov dword [ebp - 0x15c8], eax
mov ecx, dword [ebp - 0x1574]
xor eax, eax
mov edx, eax
test ecx, ecx
jns 0xc6bc0d
mov edx, ecx
neg edx
xor ecx, ecx
mov dword [ebp - 0x1574], ecx
jmp 0xc6bc0f
xor ecx, ecx
test ebx, ebx
jns 0xc6bc19
mov eax, ebx
mov ebx, ecx
neg eax
mov esi, dword [ebp - 0x7c0]
mov ecx, dword [ebp - 0x1588]
sub esi, edx
sub ecx, dword [ebp - 0x1574]
mov dword [ebp - 0x1560], esi
cmp esi, ecx
jl 0xc6bc3f
mov esi, ecx
mov dword [ebp - 0x1560], ecx
mov ecx, dword [ebp - 0x7bc]
sub dword [ebp - 0x1580], ebx
sub ecx, eax
mov dword [ebp - 0x156c], ecx
cmp ecx, dword [ebp - 0x1580]
jl 0xc6bc67
mov ecx, dword [ebp - 0x1580]
mov dword [ebp - 0x156c], ecx
test esi, esi
jle 0xc6be00
test ecx, ecx
jle 0xc6be00
imul eax, dword [ebp - 0x7c0]
mov ecx, dword [ebp - 0x155c]
add eax, edx
mov edx, dword [ebp - 0x1588]
imul ebx, edx
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x1570]
mov dword [ebp - 0x1568], eax
add ebx, dword [ebp - 0x1574]
lea ecx, [ecx + ebx*4]
mov ebx, dword [ebp - 0x7c0]
shl ebx, 2
shl edx, 2
mov dword [ebp - 0x1574], ecx
mov dword [ebp - 0x1564], ebx
mov dword [ebp - 0x1570], edx
mov ebx, ecx
mov dword [ebp - 0x1580], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [ebp - 0x155c], edx
lea edi, [eax + 2]
mov dword [ebp - 0x1588], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc6bda7
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x15c8]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x1588]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x155c]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x15c8]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x155c]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x15a2]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x155c]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x1580]
cdq
idiv ecx
mov edx, dword [ebp - 0x155c]
add al, bl
mov ebx, dword [ebp - 0x1588]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x155c], edx
mov dword [ebp - 0x1580], esi
jne 0xc6bce1
mov eax, dword [ebp - 0x1568]
mov ecx, dword [ebp - 0x1574]
add eax, dword [ebp - 0x1564]
add ecx, dword [ebp - 0x1570]
sub dword [ebp - 0x156c], 1
mov esi, dword [ebp - 0x1560]
mov dword [ebp - 0x1568], eax
mov dword [ebp - 0x1574], ecx
jne 0xc6bcc5
mov edi, dword [ebp - 0x157c]
push dword [ebp - 0x1584]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1590]
test eax, eax
je 0xc6be32
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0x158c], 0
jl 0xc6bef6
cmp dword [ebp - 0x15a0], 1
jne 0xc6be98
mov esi, dword [section..data]
xor eax, eax
push 0xcc0020
push eax
push eax
push dword [ebp - 0x15b0]
mov ecx, esi
push dword [ebp - 0x1554]
push dword [ebp - 0x1578]
push dword [ebp - 0x14d0]
push dword [ebp - 0x14d4]
push dword [ebp - 0x15c0]
call dword [0xc99200]
call esi
jmp 0xc6beda
push dword [ebp - 0x1558]
mov ecx, dword [ebp - 0x1554]
xor edx, edx
mov eax, dword [ebp - 0x1578]
mov esi, dword [0xc93020]
push ecx
push eax
push edx
push edx
push dword [ebp - 0x15b0]
push ecx
push eax
push dword [ebp - 0x754]
mov ecx, esi
push dword [ebp - 0x758]
push dword [ebp - 0x15c0]
call dword [0xc99200]
call esi
push dword [ebp - 0x15a8]
mov esi, dword [0xc93040]
mov ecx, esi
push dword [ebp - 0x15c0]
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x1598]
test eax, eax
je 0xc6bf11
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x15b0]
test eax, eax
je 0xc6bf2c
mov esi, dword [0xc93018]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x15b4]
test eax, eax
je 0xc6bf47
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov edi, 0xc96238
mov ecx, dword [ebp - 0x14f0]
xor ebx, ebx
test ecx, ecx
je 0xc6bf9d
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc6bf5b
mov eax, dword [ebp - 0x14f0]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc6bf83
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xc6bf7b
push dword [ebp - 0x14f0]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x14f0], ebx
mov ecx, dword [ebp - 0x14ec]
test ecx, ecx
je 0xc6bfec
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc6bfaa
mov eax, dword [ebp - 0x14ec]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc6bfd2
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xc6bfca
push dword [ebp - 0x14ec]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x14ec], ebx
mov edx, dword [ebp - 0x14e8]
test edx, edx
je 0xc6c038
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc6bffb
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc6c023
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xc6c015
mov edx, dword [ebp - 0x14e8]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x14e8], ebx
cmp dword [ebp - 0x14e4], 0
je 0xc6c05d
push dword [ebp - 0x14e4]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x14e4], ebx
cmp dword [ebp - 0x14e0], 0
je 0xc6c082
push dword [ebp - 0x14e0]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x14e0], ebx
cmp dword [ebp - 0x14dc], 0
je 0xc6c0a7
push dword [ebp - 0x14dc]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x14dc], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc6c0a9
mov eax, dword [0xc95890]
test eax, eax
jle 0xc6c10c
sub eax, 1
mov dword [0xc95890], eax
jne 0xc6c10c
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc6c0de
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc6c0cd
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0xc95878]
mov esi, dword [0xc9304c]
mov ecx, esi
mov dword [ebp - 0x15a0], eax
call dword [0xc99200]
call esi
sub eax, dword [0xc95870]
lea edi, [ebp - 0x5f4]
push 7
mov dword [ebp - 0x15b0], eax
mov edx, 0xc96238
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc6c149
mov eax, dword [0xc95890]
test eax, eax
jne 0xc6c754
xor ebx, ebx
push 0x338
mov esi, ebx
mov dword [ebp - 0x1598], ebx
push ebx
mov dword [ebp - 0x15b4], ebx
mov dword [ebp - 0x1558], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x163c], eax
test eax, eax
je 0xc6c748
or dword [ebp - 0x15ec], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0x15d0], ebx
mov edx, ebx
mov dword [ebp - 0x1624], eax
mov edi, dword [ebp - 0x1750]
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0x1750]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0x1750]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0x1750]
shl edi, 8
add dword [ebp - 0x1750], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0x1688], esi
add eax, 0x54969fa2
rol dword [ebp - 0x1688], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0x1688]
xor edx, eax
mov dword [ebp - 0x168c], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x168c]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x168c]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x168c], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x168c]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x168c]
xor edx, eax
mov dword [ebp - 0x168c], edx
mov eax, dword [ebp - 0x168c]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x168c]
xor eax, edx
mov dword [ebp - 0x168c], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x168c]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x168c]
xor eax, edx
mov dword [ebp - 0x168c], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x168c]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0x168c]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0x168c], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0x168c]
xor eax, 0xab69605e
mov dword [ebp - 0x1688], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1688]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x1688]
xor eax, edx
mov dword [ebp - 0x1688], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x1688], edx
mov edx, dword [ebp - 0x1688]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x1688], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1688]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x1688]
xor eax, edx
mov dword [ebp - 0x1688], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x1688]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x1688]
xor eax, edx
mov dword [ebp - 0x1688], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x1688]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x1688]
xor edx, dword [ebp - 0x15d0]
xor eax, dword [ebp - 0x15ec]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x168c], esi
mov esi, dword [ebp - 0x1624]
mov dword [ebp - 0x15d0], ebx
mov dword [ebp - 0x15ec], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x1754], 1
mov dword [ebp - 0x1624], esi
mov esi, eax
mov dword [ebp - 0x1688], eax
jne 0xc6c1b4
mov esi, dword [ebp - 0x163c]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc6c537
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc6c566
cmp edx, dword [0x9fc02c]
jne 0xc6c566
mov edi, esi
xor eax, eax
mov dword [ebp - 0x1558], edi
mov esi, eax
mov ebx, eax
jmp 0xc6c57a
or dword [ebp - 0x1760], 0xffffffff
mov ebx, 0xc004d501
mov edi, dword [ebp - 0x1558]
xor eax, eax
test esi, esi
je 0xc6c58d
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc6c742
mov eax, dword [ebp - 0x1760]
xor ecx, ecx
push 0x40
push ecx
mov ebx, 0xc960a0
mov esi, edi
push ebx
mov byte [eax + edi], cl
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xc6c6d8
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1740]
jne 0xc6c5c5
sub ecx, ebx
xor eax, eax
sar ecx, 1
push edi
push edx
push eax
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc6c73b
xor eax, eax
mov edx, 0x5a4d
mov ecx, eax
mov eax, dword [edi]
mov dword [ebp - 0x15b4], ecx
cmp word [eax], dx
je 0xc6c614
mov ecx, 0xc000007b
mov dword [ebp - 0x15b4], ecx
jmp 0xc6c65e
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc6c607
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc6c607
cmp dword [edx], 0x4550
jne 0xc6c607
movzx eax, word [edx + 0x18]
mov ebx, 0x10b
cmp ax, bx
je 0xc6c64c
mov ebx, 0x20b
cmp ax, bx
je 0xc6c64c
mov ecx, 0xc000000d
jmp 0xc6c60c
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0x1614], eax
xor edx, edx
mov ebx, edx
test eax, eax
je 0xc6c6cc
mov edx, esi
mov dword [ebp - 0x163c], esi
lea eax, [edx + 1]
mov dword [ebp - 0x15d0], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc6c684
sub edx, dword [ebp - 0x15d0]
inc esi
add esi, edx
test ecx, ecx
js 0xc6c6bd
push dword [ebp - 0x163c]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc6c6d8
mov ecx, dword [ebp - 0x1598]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x15b4]
inc dword [ebp - 0x1598]
inc ebx
cmp ebx, dword [ebp - 0x1614]
jb 0xc6c673
add edi, 0x10
cmp byte [esi], 0
jne 0xc6c5be
mov ebx, dword [ebp - 0x15b4]
mov esi, dword [ebp - 0x1558]
test esi, esi
je 0xc6c6f9
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc6c74f
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc6c712
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc6c701
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc6c75a
mov ebx, 0xc000007a
jmp 0xc6c6de
mov esi, dword [ebp - 0x1558]
mov ebx, 0xc000007a
jmp 0xc6c6e4
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edi, 0xc96238
xchg dword [edi], eax
mov eax, dword [ebp - 0x15b0]
xor ebx, ebx
mov esi, dword [0xc93068]
inc ebx
mov dword [ebp - 0x5f4], eax
mov ecx, esi
mov eax, dword [ebp - 0x15a0]
mov dword [ebp - 0x5dc], eax
lea eax, [ebp - 0x5f8]
push eax
push 4
pop eax
push eax
push 0x2021
xor eax, eax
mov dword [ebp - 0x5f8], ebx
push eax
mov dword [ebp - 0x5ec], 0x9966f291
mov dword [ebp - 0x5f0], ebx
mov dword [ebp - 0x5e4], ebx
mov dword [ebp - 0x5e8], ebx
mov dword [ebp - 0x5e0], ebx
call dword [0xc99200]
call esi
mov ecx, ebx
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc6c7c9
mov eax, dword [0xc95890]
test eax, eax
jle 0xc6c829
sub eax, 1
mov dword [0xc95890], eax
jne 0xc6c829
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc6c7fd
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc6c7ec
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0x15c0]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
xor eax, eax
lea edi, [ebp - 0x1ab8]
mov dword [ebp - 0x1614], eax
mov dword [ebp - 0x163c], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x1ac4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x15d0], eax
test eax, eax
je 0xc6e89a
push 0x28
pop ecx
mov esi, 0xc94ea0
mov dword [ebp - 0x1614], eax
mov edi, eax
rep movsd dword es:[edi], dword [esi]
push 8
pop esi
push esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0xc6e89a
mov ecx, dword [0xc94e98]
mov edi, ebx
mov dword [ebx], ecx
mov ecx, dword [0xc94e9c]
mov dword [ebx + 4], ecx
mov dword [ebp - 0x163c], edi
rdtsc
mov dword [ebp - 0x15ec], eax
mov dword [ebp - 0x1624], edx
xor eax, eax
mov dword [ebp - 0x1634], eax
lea eax, [ebp - 0x1608]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
test eax, eax
js 0xc6e892
mov edx, dword [ebp - 0x1608]
lea eax, [ebp - 0x1634]
push eax
xor ecx, ecx
call fcn.00a32533
or eax, 0x10000000
jl 0xc6e892
lea eax, [ebp - 0x16ac]
mov edx, 0xa0
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
test eax, eax
js 0xc6e892
mov edx, dword [ebp - 0x16ac]
lea eax, [ebp - 0x1634]
mov ecx, dword [ebp - 0x1634]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xc6e892
lea eax, [ebp - 0x166c]
mov edx, esi
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
test eax, eax
js 0xc6e892
mov edx, dword [ebp - 0x166c]
lea eax, [ebp - 0x1634]
mov ecx, dword [ebp - 0x1634]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xc6e892
lea eax, [ebp - 0x16b4]
mov edx, esi
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
test eax, eax
js 0xc6e892
mov edx, dword [ebp - 0x16b4]
lea eax, [ebp - 0x1634]
mov ecx, dword [ebp - 0x1634]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xc6e892
mov esi, dword [ebp - 0x1634]
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x16b4], edi
test edi, edi
je 0xc6e89a
lea eax, [ebp - 0x19fc]
mov ecx, edi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xc6e8a2
lea ecx, [edi + esi]
lea eax, [edi + 8]
mov dword [ebp - 0x166c], ecx
cmp eax, ecx
ja 0xc6e8a2
mov eax, dword [ebp - 0x19fc]
push 4
pop ecx
mov dword [edi], ecx
mov dword [eax], ecx
mov esi, edi
xor eax, eax
mov dword [ebp - 0x16b8], esi
mov edi, eax
mov edx, dword [esi]
lea eax, [ebp - 0x1600]
push eax
call fcn.00a32533
test eax, eax
js 0xc6e8a2
mov edx, dword [ebp - 0x1600]
lea eax, [ebp - 0x16b8]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc6e8a2
mov esi, dword [ebp - 0x16b8]
inc edi
cmp edi, 1
jae 0xc6ca8f
push 4
pop ecx
jmp 0xc6ca4c
lea eax, [ebp - 0x1a54]
mov ecx, esi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xc6e8a2
lea eax, [esi + 0xa4]
cmp eax, dword [ebp - 0x166c]
ja 0xc6e8a2
mov edi, dword [ebp - 0x1a54]
mov dword [esi], 0xa0
mov esi, dword [ebp - 0x15d0]
push 0x28
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x16b4]
xor eax, eax
mov esi, edi
mov dword [ebp - 0x1600], eax
mov dword [ebp - 0x16bc], esi
mov edx, dword [esi]
lea eax, [ebp - 0x1668]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
test eax, eax
js 0xc6e8a2
mov edx, dword [ebp - 0x1668]
lea eax, [ebp - 0x16bc]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc6e8a2
mov eax, dword [ebp - 0x1600]
mov esi, dword [ebp - 0x16bc]
inc eax
mov dword [ebp - 0x1600], eax
cmp eax, 2
jb 0xc6cae9
lea eax, [ebp - 0x1a6c]
mov ecx, esi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xc6e8a2
lea eax, [esi + 0xc]
cmp eax, dword [ebp - 0x166c]
ja 0xc6e8a2
mov ecx, dword [ebp - 0x1a6c]
mov dword [esi], 8
mov eax, dword [ebx]
mov dword [ecx], eax
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
mov esi, edi
xor eax, eax
mov dword [ebp - 0x1710], esi
mov edi, eax
mov edx, dword [esi]
lea eax, [ebp - 0x1718]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
test eax, eax
js 0xc6e8a2
mov edx, dword [ebp - 0x1718]
lea eax, [ebp - 0x1710]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc6e8a2
mov esi, dword [ebp - 0x1710]
inc edi
cmp edi, 3
jb 0xc6cb84
lea eax, [ebp - 0x1a44]
mov ecx, esi
push eax
push 4
pop edi
mov edx, edi
call fcn.00a32533
test eax, eax
js 0xc6e8a2
lea eax, [esi + 0xc]
cmp eax, dword [ebp - 0x166c]
ja 0xc6e8a2
mov eax, dword [ebp - 0x1a44]
mov ecx, dword [ebp - 0x15ec]
push 8
pop ebx
mov dword [esi], ebx
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1624]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x161c]
mov edx, edi
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc6e8a2
mov esi, dword [ebp - 0x161c]
lea eax, [ebp - 0x16fc]
push eax
mov edx, ebx
mov dword [ebp - 0x1684], esi
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xc6e8a2
mov edx, dword [ebp - 0x16fc]
lea eax, [ebp - 0x1684]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc6e8a2
xor ecx, ecx
rdtsc
mov edi, ecx
mov dword [ebp - 0x16fc], ecx
mov ebx, ecx
mov dword [ebp - 0x161c], edi
mov dword [ebp - 0x1718], ebx
mov dword [ebp - 0x1710], ecx
mov dword [ebp - 0x1668], ecx
mov dword [ebp - 0x16bc], ecx
mov dword [ebp - 0x1600], ecx
mov dword [ebp - 0x16b8], ecx
mov dword [ebp - 0x166c], ecx
mov dword [ebp - 0x16ac], ecx
mov dword [ebp - 0x1608], eax
mov dword [ebp - 0x15d0], edx
push 8
pop eax
mov dword [ebp - 0x18ec], eax
mov edx, dword [ebp - 0x1634]
lea ecx, [ebp - 0x18ec]
push ecx
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6cdcb
mov eax, dword [ebp - 0x18ec]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0x15ec], ecx
cmp ecx, eax
jae 0xc6ccfc
mov esi, 0xc0000095
jmp 0xc6cdcb
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc6cd1e
mov esi, 0xc0000017
mov edi, ebx
jmp 0xc6cdcb
push 4
pop ecx
lea eax, [ebp - 0x15dc]
mov dword [edi], ecx
mov edx, ecx
mov dword [ebp - 0x15dc], edi
push eax
mov ecx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6cdb0
mov ecx, dword [ebp - 0x15dc]
mov eax, dword [ebp - 0x1634]
mov dword [ecx], eax
lea eax, [ebp - 0x15dc]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6cdb0
mov eax, dword [ebp - 0x15ec]
push dword [ebp - 0x1634]
mov ecx, dword [ebp - 0x1608]
push dword [ebp - 0x16b4]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0x15d0]
push dword [ebp - 0x15dc]
mov dword [edi + eax - 4], ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0x15ec]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x16fc], edi
mov edi, ecx
mov dword [ebp - 0x161c], eax
jmp 0xc6cdb2
xor ecx, ecx
test edi, edi
je 0xc6cdc5
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0x161c]
or esi, 0x10000000
jl 0xc6e6a0
xor ecx, ecx
mov dword [ebp - 0x15dc], ecx
cmp dword [ebp - 0x16fc], ecx
jne 0xc6cdf1
mov esi, 0xc000000d
jmp 0xc6d41c
test edi, edi
je 0xc6d417
lea eax, [edi + 8]
push eax
push ecx
mov dword [ebp - 0x1608], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x1634], esi
test esi, esi
je 0xc6d417
mov ebx, dword [ebp - 0x16fc]
xor eax, eax
mov cl, al
test edi, edi
je 0xc6ce37
xor cl, byte [eax + ebx]
inc eax
cmp eax, edi
jb 0xc6ce2f
mov eax, edi
mov dword [ebp - 0x6e0], 0xb1b54a58
shr eax, 3
mov dword [ebp - 0x6dc], 0xc81ecb17
mov dword [ebp - 0x15d0], eax
test eax, eax
je 0xc6d243
movzx edx, word [ebp - 0x6de]
mov eax, 0xc81ecb17
movzx esi, ax
movzx eax, word [ebp - 0x6da]
mov dword [ebp - 0x15ec], eax
mov eax, 0xb1b54a58
movzx eax, ax
mov dword [ebp - 0x1624], eax
mov eax, dword [ebp - 0x1634]
add eax, 7
mov dword [ebp - 0x168c], esi
mov dword [ebp - 0x16dc], eax
lea esi, [ebx + 2]
xor eax, eax
mov dword [ebp - 0x1688], edx
mov dword [ebp - 0x1700], esi
mov edx, eax
or ebx, 0xffffffff
mov dword [ebp - 0x1704], eax
mov dword [ebp - 0x1708], eax
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0x1700]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0x1700]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0x1700]
shl esi, 8
add dword [ebp - 0x1700], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov eax, ebx
sub eax, dword [ebp - 0x1624]
xor eax, edx
xor eax, 0xc81ecb17
xor eax, edi
mov edx, eax
mov dword [ebp - 0x171c], eax
xor edx, 0xc81ecb17
ror eax, 7
ror edx, 0xf
imul edx, dword [ebp - 0x1688]
add edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
mov eax, ebx
ror eax, 0xa
lea edx, [ebx + edx]
ror edx, 9
imul edx, dword [ebp - 0x168c]
sub edx, eax
mov eax, dword [ebp - 0x171c]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x171c], eax
xor edx, dword [ebp - 0x168c]
rol edx, 4
imul edx, dword [ebp - 0x15ec]
rol eax, 5
add edx, eax
mov eax, 0xc81ecb17
xor ebx, edx
mov edx, ebx
xor edx, 0xb1b54a58
sub eax, edx
mov edx, dword [ebp - 0x171c]
xor edx, eax
mov dword [ebp - 0x171c], edx
sub edx, dword [ebp - 0x1624]
imul edx, dword [ebp - 0x1688]
mov eax, dword [ebp - 0x171c]
shr eax, 6
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0x171c]
mov eax, ebx
ror eax, 0xf
xor eax, dword [ebp - 0x168c]
imul eax, dword [ebp - 0x1624]
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [ebp - 0x15ec]
imul eax, dword [ebp - 0x168c]
xor ebx, eax
mov eax, ebx
sub eax, 0xc81ecb17
sub eax, dword [ebp - 0x1624]
xor edx, eax
mov dword [ebp - 0x171c], edx
mov eax, dword [ebp - 0x171c]
xor eax, dword [ebp - 0x15ec]
imul eax, dword [ebp - 0x1688]
ror edx, 0xa
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0x1624]
rol edx, 6
imul edx, dword [ebp - 0x168c]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0x171c]
xor eax, edx
mov dword [ebp - 0x171c], eax
ror eax, 0xf
sub eax, dword [ebp - 0x15ec]
imul eax, dword [ebp - 0x1624]
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0x15ec]
imul edx, dword [ebp - 0x1624]
shr eax, 1
xor edx, eax
mov eax, ebx
xor dword [ebp - 0x171c], edx
mov edx, ebx
sub edx, dword [ebp - 0x168c]
rol edx, 3
imul edx, dword [ebp - 0x1624]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0x171c]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x171c], eax
sub edx, dword [ebp - 0x168c]
imul edx, dword [ebp - 0x1688]
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 9
imul edx, dword [ebp - 0x168c]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0x171c]
xor eax, edx
mov dword [ebp - 0x171c], eax
sub eax, 0xb1b54a58
sub eax, dword [ebp - 0x15ec]
xor ebx, eax
mov eax, dword [ebp - 0x1688]
xor eax, ebx
mov edx, ebx
imul eax, dword [ebp - 0x1624]
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0x15ec]
xor dword [ebp - 0x171c], eax
mov eax, dword [ebp - 0x171c]
xor edx, eax
rol edx, 4
imul edx, dword [ebp - 0x1688]
ror eax, 0x10
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 0xa
imul edx, dword [ebp - 0x168c]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0x171c]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x171c], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, dword [ebp - 0x15ec]
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, 0xc81ecb17
rol eax, 2
rol edx, 8
imul edx, dword [ebp - 0x1624]
sub edx, eax
mov eax, dword [ebp - 0x171c]
xor eax, edx
mov edx, 0xc81ecb17
sub edx, eax
mov dword [ebp - 0x171c], eax
ror edx, 0xb
imul edx, dword [ebp - 0x1688]
ror eax, 0xc
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0x1688]
imul edx, dword [ebp - 0x168c]
shr eax, 8
xor edx, eax
mov eax, dword [ebp - 0x171c]
xor eax, edx
mov edx, dword [ebp - 0x16dc]
xor ebx, eax
xor eax, dword [ebp - 0x1704]
xor ebx, 0xc81ecb17
mov dword [ebp - 0x1704], edi
xor ebx, 0xb1b54a58
xor ebx, dword [ebp - 0x1708]
mov byte [edx - 4], al
mov byte [edx], bl
ror eax, 8
mov byte [edx - 5], al
ror ebx, 8
mov byte [edx - 1], bl
ror eax, 8
mov byte [edx - 6], al
ror ebx, 8
mov byte [edx - 2], bl
ror eax, 8
ror ebx, 8
mov byte [edx - 7], al
mov byte [edx - 3], bl
add edx, 8
ror eax, 8
ror ebx, 8
sub dword [ebp - 0x15d0], 1
mov dword [ebp - 0x1708], esi
mov esi, dword [ebp - 0x1700]
mov dword [ebp - 0x16dc], edx
mov edx, eax
mov dword [ebp - 0x171c], eax
jne 0xc6cebf
mov edi, dword [ebp - 0x161c]
mov esi, dword [ebp - 0x1634]
movzx eax, cl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0xc6d26f
mov esi, 0xc0000017
jmp 0xc6d374
mov edi, dword [ebp - 0x1608]
push edi
push 8
mov dword [ebx], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc6d294
mov esi, 0xc0000017
xor edx, edx
jmp 0xc6d30d
mov dword [ebx + 4], eax
push edi
push esi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [ebx + 8], eax
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc6d28b
mov dword [ebx + 0xc], eax
push 0x28
pop ecx
push 8
mov edi, eax
mov esi, 0xc94df0
pop eax
push eax
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [ebx + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xc6d2f1
mov esi, 0xc0000017
jmp 0xc6d30d
mov dword [ebx + 0x14], ecx
mov esi, edx
mov eax, dword [0xc94e90]
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ebp - 0x15dc], ebx
mov ebx, edx
mov dword [ecx + 4], eax
test ebx, ebx
je 0xc6d374
cmp dword [ebx + 4], 0
je 0xc6d32d
push dword [ebx + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebx + 4], edx
cmp dword [ebx + 0xc], 0
je 0xc6d349
push dword [ebx + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebx + 0xc], edx
cmp dword [ebx + 0x14], 0
je 0xc6d365
push dword [ebx + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebx + 0x14], edx
push ebx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc6d38a
mov ebx, dword [ebp - 0x15dc]
xor eax, eax
mov dword [ebp - 0x1718], ebx
mov edi, eax
jmp 0xc6d396
mov ebx, dword [ebp - 0x1718]
mov edi, dword [ebp - 0x15dc]
mov eax, dword [ebp - 0x1634]
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xc6d41c
xor eax, eax
cmp dword [edi + 4], eax
je 0xc6d3ce
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc6d3ea
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc6d406
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc6d41c
mov esi, 0xc0000001
or esi, 0x10000000
jl 0xc6e69a
mov edx, dword [ebx]
lea eax, [ebp - 0x15e8]
push 4
pop edi
push eax
mov ecx, edi
mov dword [ebp - 0x15e8], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6d4b7
mov ecx, dword [ebp - 0x15e8]
lea eax, [ebp - 0x15e8]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6d4b7
mov edx, dword [ebx + 8]
lea eax, [ebp - 0x15e8]
mov ecx, dword [ebp - 0x15e8]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6d4b7
mov ecx, dword [ebp - 0x15e8]
lea eax, [ebp - 0x15e8]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6d4b7
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0x15e8]
mov ecx, dword [ebp - 0x15e8]
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0x15e8]
test esi, esi
jns 0xc6d4bd
mov eax, dword [ebp - 0x18f0]
mov dword [ebp - 0x15e8], eax
test esi, esi
js 0xc6d619
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc6d4eb
mov esi, 0xc0000017
jmp 0xc6d616
mov eax, dword [ebx]
mov ecx, edi
mov dword [edi], eax
lea eax, [ebp - 0x1610]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0x1610], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6d601
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0x1610]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx]
lea eax, [ebp - 0x1610]
mov ecx, dword [ebp - 0x1610]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6d601
mov ecx, dword [ebp - 0x1610]
mov eax, dword [ebx + 8]
mov dword [ecx], eax
lea eax, [ebp - 0x1610]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6d601
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0x1610]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 8]
lea eax, [ebp - 0x1610]
mov ecx, dword [ebp - 0x1610]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6d601
mov ecx, dword [ebp - 0x1610]
mov eax, dword [ebx + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0x1610]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6d601
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0x1610]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0x1610]
mov ecx, dword [ebp - 0x1610]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
xor ecx, ecx
test esi, esi
js 0xc6d603
mov eax, dword [ebp - 0x15e8]
mov dword [ebp - 0x1710], edi
mov edi, ecx
mov dword [ebp - 0x1668], eax
jmp 0xc6d603
xor ecx, ecx
test edi, edi
je 0xc6d616
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
push 4
pop edi
or esi, 0x10000000
jl 0xc6e69a
xor eax, eax
mov dword [ebp - 0x18f4], 8
mov dword [ebp - 0x1610], eax
mov dword [ebp - 0x15e8], eax
mov edx, dword [ebp - 0x1684]
lea eax, [ebp - 0x18f4]
push eax
push 8
pop ecx
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
jl 0xc6d6b3
mov eax, dword [ebp - 0x18f4]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xc6d673
mov esi, 0xc0000095
jmp 0xc6d694
mov dword [ebp - 0x18fc], ecx
lea eax, [ebp - 0x18fc]
push eax
push 8
pop edx
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0x18fc]
test esi, esi
jns 0xc6d69a
mov eax, dword [ebp - 0x18f8]
mov dword [ebp - 0x15dc], eax
test esi, esi
js 0xc6d6b3
mov ebx, dword [ebp - 0x16b4]
test ebx, ebx
jne 0xc6d6e9
mov esi, 0xc000000d
mov edi, dword [ebp - 0x1600]
test esi, esi
js 0xc6e69a
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc6d8aa
mov eax, dword [ebp - 0x16bc]
mov esi, 0xd0000017
jmp 0xc6d8b5
cmp edi, 1
jbe 0xc6d6ae
mov ecx, ebx
xor eax, eax
mov dword [ebp - 0x1680], ecx
mov edi, eax
mov eax, dword [ecx]
mov dword [ebp - 0x1684], eax
lea eax, [ebp - 0x1680]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6d6b3
mov edx, dword [ebp - 0x1684]
lea eax, [ebp - 0x1680]
mov ecx, dword [ebp - 0x1680]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6d6b3
mov ecx, dword [ebp - 0x1680]
inc edi
cmp edi, 1
jb 0xc6d6fa
mov edi, dword [ecx]
lea eax, [ebp - 0x1680]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6d6b3
mov dword [ebp - 0x1610], edi
push 4
pop edx
cmp edx, 2
jbe 0xc6d6ae
mov ecx, ebx
xor eax, eax
mov dword [ebp - 0x167c], ecx
mov edi, eax
mov ebx, dword [ecx]
lea eax, [ebp - 0x167c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6d7dc
mov ecx, dword [ebp - 0x167c]
lea eax, [ebp - 0x167c]
push eax
mov edx, ebx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6d7dc
mov ecx, dword [ebp - 0x167c]
inc edi
cmp edi, 2
jae 0xc6d7c1
push 4
pop edx
jmp 0xc6d782
mov edi, dword [ecx]
lea eax, [ebp - 0x167c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov ebx, edi
test esi, esi
jns 0xc6d7ea
mov ebx, dword [ebp - 0x15e8]
test esi, esi
js 0xc6d6b3
mov edx, dword [ebp - 0x15dc]
lea eax, [ebp - 0x1678]
push 4
pop edi
push eax
mov ecx, edi
mov dword [ebp - 0x1678], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6d87f
mov ecx, dword [ebp - 0x1678]
lea eax, [ebp - 0x1678]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6d87f
mov edx, dword [ebp - 0x1610]
lea eax, [ebp - 0x1678]
mov ecx, dword [ebp - 0x1678]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6d87f
mov ecx, dword [ebp - 0x1678]
lea eax, [ebp - 0x1678]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6d87f
mov ecx, dword [ebp - 0x1678]
lea eax, [ebp - 0x1678]
push eax
mov edx, ebx
call fcn.00a32533
mov edi, dword [ebp - 0x1678]
mov esi, eax
test esi, esi
jns 0xc6d88d
mov edi, dword [ebp - 0x1900]
test esi, esi
js 0xc6d6b3
cmp edi, 0x400000
jbe 0xc6d89f
mov esi, 0x8000ffff
jmp 0xc6e69a
mov dword [ebp - 0x1600], edi
jmp 0xc6d6b9
mov dword [ebp - 0x16bc], eax
mov esi, 0x10000000
mov ebx, dword [ebp - 0x1710]
test esi, esi
js 0xc6e6a0
test ebx, ebx
jne 0xc6d8d1
mov esi, 0x80070057
jmp 0xc6e6a0
test eax, eax
je 0xc6d8c7
mov ecx, dword [ebp - 0x1668]
mov dword [ebp - 0x1ba4], eax
xor eax, eax
mov dword [ebp - 0x1b98], eax
lea eax, [ebp - 0x1904]
push eax
push 0x9f29b8
push 1
mov dword [ebp - 0x1ba8], ebx
mov dword [ebp - 0x1ba0], ecx
mov dword [ebp - 0x1b9c], edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xc6d933
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc6d92a
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc6d97b
mov esi, 0x80004005
jmp 0xc6d97b
push 0x9fc030
push dword [ebp - 0x1904]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xc6d913
xor eax, eax
mov ecx, esi
push eax
push 0x14
lea eax, [ebp - 0x1ba8]
push eax
push 0x86
call dword [0xc99200]
call esi
mov esi, eax
or esi, 0x10000000
jl 0xc6d97b
mov edi, dword [ebp - 0x1b9c]
mov dword [ebp - 0x1600], edi
cmp esi, 0xd0000023
jne 0xc6d98d
mov esi, 0x8007007a
jmp 0xc6e6a0
test esi, esi
js 0xc6e6a0
mov eax, dword [ebp - 0x16bc]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0x1674], ecx
mov ebx, ecx
mov dword [ebp - 0x162c], eax
cmp edi, edx
jae 0xc6d9bc
mov esi, 0xc000003e
jmp 0xc6dda0
mov edi, dword [eax]
lea ecx, [ebp - 0x162c]
push ecx
mov ecx, eax
mov dword [ebp - 0x1678], edi
call fcn.00a32533
mov esi, eax
xor ecx, ecx
test esi, esi
js 0xc6dda0
lea eax, [ebp - 0x1674]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6dd9e
mov eax, dword [ebp - 0x1600]
sub eax, dword [ebp - 0x1674]
cmp eax, edi
jae 0xc6da13
mov esi, 0xc000003e
jmp 0xc6dd9e
mov eax, dword [ebp - 0x162c]
lea ecx, [ebp - 0x162c]
push ecx
mov edx, edi
mov dword [ebp - 0x167c], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6dd9e
mov ecx, dword [ebp - 0x1674]
lea eax, [ebp - 0x1674]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6dd9e
mov eax, dword [ebp - 0x1600]
sub eax, dword [ebp - 0x1674]
push 4
pop edx
cmp eax, edx
jb 0xc6da09
mov ecx, dword [ebp - 0x162c]
lea eax, [ebp - 0x162c]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0x1680], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6dd9e
mov ecx, dword [ebp - 0x1674]
lea eax, [ebp - 0x1674]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6dd9e
mov eax, dword [ebp - 0x1600]
sub eax, dword [ebp - 0x1674]
cmp eax, edi
jb 0xc6da09
mov eax, dword [ebp - 0x162c]
lea ecx, [ebp - 0x162c]
push ecx
mov edx, edi
mov dword [ebp - 0x1610], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6dd9e
mov ecx, dword [ebp - 0x1674]
lea eax, [ebp - 0x1674]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6dd9e
mov eax, dword [ebp - 0x1600]
sub eax, dword [ebp - 0x1674]
push 4
pop edx
cmp eax, edx
jb 0xc6da09
mov ecx, dword [ebp - 0x162c]
mov eax, dword [ecx]
mov dword [ebp - 0x15e8], eax
lea eax, [ebp - 0x162c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6dd9e
mov ecx, dword [ebp - 0x1674]
lea eax, [ebp - 0x1674]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6dd9e
mov eax, dword [ebp - 0x1600]
sub eax, dword [ebp - 0x1674]
mov ecx, dword [ebp - 0x15e8]
cmp eax, ecx
jb 0xc6da09
lea eax, [ebp - 0x1674]
mov edx, ecx
mov ecx, dword [ebp - 0x1674]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6dd9e
mov edx, dword [ebp - 0x1600]
mov eax, edx
sub eax, dword [ebp - 0x1674]
jne 0xc6da09
mov esi, dword [ebp - 0x1678]
mov ecx, dword [ebp - 0x15e8]
add ecx, 0xc
lea eax, [edi + esi]
add eax, ecx
cmp eax, edx
jne 0xc6da09
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc6dbec
mov esi, 0xc0000017
jmp 0xc6dd29
cmp dword [ebp - 0x167c], ebx
je 0xc6dc2d
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc6dc16
mov esi, 0xc0000017
xor eax, eax
jmp 0xc6dcc2
mov dword [edi + 4], eax
push esi
push dword [ebp - 0x167c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc6dc34
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
cmp dword [ebp - 0x1610], ebx
je 0xc6dc70
mov esi, dword [ebp - 0x1680]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc6dc0a
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0x1610]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc6dc76
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
cmp dword [ebp - 0x162c], ebx
je 0xc6dcb6
mov esi, dword [ebp - 0x15e8]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc6dc0a
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0x162c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc6dcbc
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov ebx, edi
mov esi, eax
mov edi, eax
test edi, edi
je 0xc6dd29
cmp dword [edi + 4], 0
je 0xc6dce2
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc6dcfe
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc6dd1a
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test esi, esi
js 0xc6dd37
mov dword [ebp - 0x16b8], ebx
mov ebx, ecx
test ebx, ebx
je 0xc6dda0
cmp dword [ebx + 4], 0
je 0xc6dd57
push dword [ebx + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 4], ecx
cmp dword [ebx + 0xc], 0
je 0xc6dd73
push dword [ebx + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 0xc], ecx
cmp dword [ebx + 0x14], 0
je 0xc6dd8f
push dword [ebx + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 0x14], ecx
push ebx
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
or esi, 0x10000000
jl 0xc6e69a
mov eax, dword [ebp - 0x16b8]
mov ebx, ecx
mov dword [ebp - 0x162c], ebx
mov dword [ebp - 0x1674], ecx
test eax, eax
jne 0xc6ddce
mov esi, 0xd000000d
jmp 0xc6e69a
mov esi, dword [eax + 4]
mov dword [ebp - 0x1678], esi
test esi, esi
je 0xc6ddc4
mov edi, dword [eax]
test edi, edi
je 0xc6ddc4
add edi, 0xfffffff8
mov dword [ebp - 0x167c], ecx
push edi
push ecx
mov dword [ebp - 0x1680], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1610], eax
test eax, eax
je 0xc6e40d
xor ecx, ecx
mov dword [ebp - 0x15e8], esi
mov ebx, esi
mov dword [ebp - 0x6e8], 0xab69605e
mov dl, cl
mov dword [ebp - 0x6e4], 0x7f1137f
mov esi, edi
mov ecx, eax
mov dword [ebp - 0x15dc], ecx
and esi, 7
je 0xc6e3b3
xor eax, eax
and dword [ebp - 0x161c], eax
mov dword [ebp - 0x174c], eax
mov dword [ebp - 0x1684], eax
test esi, esi
je 0xc6deb9
push 0x38
mov edi, eax
pop ecx
movzx eax, byte [ebx]
inc ebx
cmp dword [ebp - 0x161c], 4
jge 0xc6de79
add ecx, 0xffffffe0
shl eax, cl
mov ecx, dword [ebp - 0x16ec]
or edi, eax
jmp 0xc6de81
shl eax, cl
or dword [ebp - 0x174c], eax
mov eax, dword [ebp - 0x161c]
sub ecx, 8
inc eax
mov dword [ebp - 0x16ec], ecx
mov dword [ebp - 0x161c], eax
cmp eax, esi
jl 0xc6de5d
mov ecx, dword [ebp - 0x15dc]
mov dword [ebp - 0x1684], edi
mov edi, dword [ebp - 0x1680]
mov eax, dword [ebp - 0x1684]
mov dword [ebp - 0x15e8], ebx
mov ebx, dword [ebp - 0x174c]
xor eax, 0x92f65a5
and dword [ebp - 0x1634], 0
xor ebx, 0x699a899c
mov dword [ebp - 0x161c], eax
mov dword [ebp - 0x1668], ebx
mov dword [ebp - 0x1600], eax
mov dword [ebp - 0x1608], ebx
test esi, esi
je 0xc6df46
mov edi, dword [ebp - 0x1634]
push 4
pop ebx
lea eax, [ecx + 1]
mov dword [ebp - 0x15dc], eax
cmp edi, ebx
jge 0xc6df12
rol dword [ebp - 0x1600], 8
mov eax, dword [ebp - 0x1600]
jmp 0xc6df1f
rol dword [ebp - 0x1608], 8
mov eax, dword [ebp - 0x1608]
mov byte [ecx], al
inc edi
mov eax, dword [ebp - 0x15dc]
mov ecx, eax
cmp edi, esi
jl 0xc6def6
mov ebx, dword [ebp - 0x1668]
mov edi, dword [ebp - 0x1680]
mov dword [ebp - 0x15dc], eax
mov eax, dword [ebp - 0x161c]
push 4
pop ecx
cmp esi, ecx
jbe 0xc6e38c
push 8
pop ecx
sub ecx, esi
shl ecx, 3
shr ebx, cl
shl ebx, cl
mov dword [ebp - 0x1668], ebx
mov ebx, dword [ebp - 0x15e8]
mov eax, edi
shr eax, 3
mov dword [ebp - 0x15e8], eax
test eax, eax
je 0xc6e355
movzx ecx, word [ebp - 0x6e2]
mov eax, 0x7f1137f
movzx esi, word [ebp - 0x6e6]
movzx eax, ax
mov dword [ebp - 0x1608], ecx
mov ecx, 0xab69605e
mov dword [ebp - 0x1600], eax
movzx eax, cx
mov ecx, dword [ebp - 0x161c]
mov dword [ebp - 0x15d0], eax
mov eax, dword [ebp - 0x15dc]
add eax, 7
mov dword [ebp - 0x1634], esi
mov dword [ebp - 0x15dc], eax
lea esi, [ebx + 2]
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor ecx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
shl edi, 8
add esi, 8
or edi, eax
mov dword [ebp - 0x15ec], esi
mov eax, dword [ebp - 0x1668]
xor eax, edi
xor eax, ecx
xor eax, 0x7f1137f
xor eax, 0xab69605e
mov dword [ebp - 0x1668], eax
mov esi, eax
rol dword [ebp - 0x1668], 0xa
sub eax, 0xab69605e
rol eax, 5
imul eax, dword [ebp - 0x1600]
add eax, dword [ebp - 0x1668]
xor ecx, eax
mov eax, 0x7f1137f
mov dword [ebp - 0x161c], ecx
add ecx, eax
mov eax, dword [ebp - 0x161c]
ror ecx, 9
imul ecx, dword [ebp - 0x1634]
rol eax, 2
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
sub ecx, dword [ebp - 0x1600]
imul ecx, dword [ebp - 0x15d0]
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0x161c]
xor eax, ecx
mov ecx, dword [ebp - 0x1634]
xor ecx, eax
mov dword [ebp - 0x161c], eax
rol ecx, 6
imul ecx, dword [ebp - 0x1608]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, 0xab69605e
sub eax, ecx
mov ecx, dword [ebp - 0x161c]
xor ecx, eax
mov dword [ebp - 0x161c], ecx
mov eax, dword [ebp - 0x161c]
xor eax, dword [ebp - 0x1600]
imul eax, dword [ebp - 0x1634]
ror ecx, 6
xor ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov eax, esi
rol eax, 2
lea ecx, [esi + ecx]
ror ecx, 0xf
imul ecx, dword [ebp - 0x15d0]
add ecx, eax
mov eax, dword [ebp - 0x161c]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x161c], eax
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0x1608]
sub ecx, eax
xor esi, ecx
mov ecx, 0xab69605e
xor ecx, esi
mov eax, esi
ror ecx, 0xc
imul ecx, dword [ebp - 0x1600]
ror eax, 0xa
xor ecx, eax
mov eax, dword [ebp - 0x161c]
xor eax, ecx
mov ecx, dword [ebp - 0x1608]
xor ecx, eax
mov dword [ebp - 0x161c], eax
imul ecx, dword [ebp - 0x1634]
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov ecx, dword [ebp - 0x161c]
mov eax, esi
not eax
ror eax, 5
add eax, dword [ebp - 0x15d0]
imul eax, dword [ebp - 0x1608]
xor ecx, eax
mov dword [ebp - 0x161c], ecx
mov eax, ecx
mov ecx, dword [ebp - 0x1608]
sub eax, ecx
xor eax, esi
mov esi, dword [ebp - 0x161c]
xor eax, 0xab69605e
xor ecx, eax
mov dword [ebp - 0x1668], eax
rol ecx, 2
imul ecx, dword [ebp - 0x1600]
shr eax, 2
add ecx, eax
xor esi, ecx
mov eax, esi
rol eax, 7
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul ecx, dword [ebp - 0x1634]
add ecx, eax
mov eax, dword [ebp - 0x1668]
xor eax, ecx
mov dword [ebp - 0x1668], eax
mov ecx, eax
xor eax, dword [ebp - 0x1600]
imul eax, dword [ebp - 0x15d0]
ror ecx, 9
add ecx, eax
xor esi, ecx
mov ecx, dword [ebp - 0x1634]
xor ecx, esi
mov eax, esi
rol ecx, 5
imul ecx, dword [ebp - 0x1608]
rol eax, 7
add ecx, eax
xor dword [ebp - 0x1668], ecx
mov ecx, dword [ebp - 0x1668]
xor esi, ecx
xor esi, 0xab69605e
xor esi, 0x7f1137f
mov eax, esi
ror eax, 3
sub eax, dword [ebp - 0x1634]
imul eax, dword [ebp - 0x1600]
xor ecx, eax
mov dword [ebp - 0x1668], ecx
sub ecx, 0x7f1137f
mov eax, dword [ebp - 0x1668]
ror ecx, 1
imul ecx, dword [ebp - 0x15d0]
ror eax, 6
sub ecx, eax
xor esi, ecx
mov ecx, 0xab69605e
mov eax, esi
rol eax, 0xe
lea ecx, [esi + ecx]
rol ecx, 3
imul ecx, dword [ebp - 0x1608]
add ecx, eax
mov eax, dword [ebp - 0x1668]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0x1668], eax
rol ecx, 0xf
imul ecx, dword [ebp - 0x1600]
ror eax, 0xe
sub ecx, eax
xor esi, ecx
mov ecx, dword [ebp - 0x15d0]
xor ecx, esi
mov eax, esi
imul ecx, dword [ebp - 0x1634]
shr eax, 3
xor ecx, eax
mov eax, dword [ebp - 0x1668]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x1668], eax
xor ecx, 0x7f1137f
rol eax, 2
rol ecx, 4
imul ecx, dword [ebp - 0x15d0]
xor ecx, eax
mov eax, dword [ebp - 0x1668]
xor ecx, dword [ebp - 0x1684]
xor eax, dword [ebp - 0x174c]
xor esi, ecx
mov ecx, esi
mov dword [ebp - 0x161c], esi
mov esi, dword [ebp - 0x15dc]
mov dword [ebp - 0x1684], ebx
mov dword [ebp - 0x174c], edi
mov byte [esi - 4], cl
mov byte [esi], al
ror ecx, 8
mov byte [esi - 5], cl
ror eax, 8
mov byte [esi - 1], al
ror ecx, 8
mov byte [esi - 6], cl
ror eax, 8
mov byte [esi - 2], al
ror ecx, 8
ror eax, 8
mov byte [esi - 7], cl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror ecx, 8
sub dword [ebp - 0x15e8], 1
mov dword [ebp - 0x15dc], esi
mov esi, dword [ebp - 0x15ec]
mov dword [ebp - 0x1668], eax
jne 0xc6dfca
mov edi, dword [ebp - 0x1680]
mov ecx, dword [ebp - 0x1610]
xor eax, eax
test edi, edi
je 0xc6e369
xor dl, byte [eax + ecx]
inc eax
cmp eax, edi
jb 0xc6e361
mov esi, dword [ebp - 0x1678]
movzx eax, dl
cdq
cmp eax, dword [edi + esi]
jne 0xc6e3cc
cmp edx, dword [edi + esi + 4]
jne 0xc6e3cc
mov esi, dword [ebp - 0x167c]
xor eax, eax
mov ebx, ecx
mov ecx, eax
jmp 0xc6e3df
xor ecx, ecx
push 4
mov dword [ebp - 0x1668], ecx
pop ecx
cmp esi, ecx
jae 0xc6df63
sub ecx, esi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0x161c], eax
jmp 0xc6df63
xor eax, eax
mov dword [ebp - 0x1684], eax
mov dword [ebp - 0x1668], eax
mov dword [ebp - 0x161c], eax
jmp 0xc6df69
mov ebx, dword [ebp - 0x162c]
mov esi, 0xc004d501
mov edi, dword [ebp - 0x1674]
xor eax, eax
test ecx, ecx
je 0xc6e3f2
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc6e40d
xor eax, eax
mov dword [ebp - 0x166c], ebx
mov ebx, eax
mov dword [ebp - 0x16ac], edi
mov esi, 0x10000000
jmp 0xc6e41a
mov edi, dword [ebp - 0x16ac]
mov esi, 0xd0000001
xor eax, eax
test ebx, ebx
je 0xc6e42d
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc6e69a
mov ecx, dword [ebp - 0x166c]
xor eax, eax
push 4
pop ebx
mov dword [ebp - 0x1670], eax
mov dword [ebp - 0x169c], ecx
cmp edi, ebx
jb 0xc6e68f
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0x162c], eax
lea eax, [ebp - 0x169c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6e694
lea eax, [ebp - 0x1670]
mov edx, ebx
push eax
xor ecx, ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6e694
mov eax, edi
sub eax, dword [ebp - 0x1670]
cmp eax, ebx
jb 0xc6e68f
mov ecx, dword [ebp - 0x169c]
lea eax, [ebp - 0x169c]
push eax
push 4
pop eax
mov ebx, dword [ecx]
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6e694
mov ecx, dword [ebp - 0x1670]
lea eax, [ebp - 0x1670]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6e694
mov ecx, dword [ebp - 0x1670]
mov eax, edi
sub eax, ecx
cmp eax, ebx
jb 0xc6e68f
lea eax, [ebp - 0x1670]
mov edx, ebx
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6e694
mov edi, dword [ebp - 0x169c]
mov edx, dword [ebp - 0x16ac]
mov esi, dword [ebp - 0x166c]
lea ecx, [edi + ebx]
lea eax, [edx + esi]
cmp eax, ecx
jb 0xc6e68f
sub edx, edi
sub edx, ebx
add edx, esi
cmp edx, 8
jae 0xc6e68f
xor ecx, ecx
mov dword [ebp - 0x1674], ecx
mov eax, ecx
mov dword [ebp - 0x1670], eax
mov esi, ecx
test edi, edi
je 0xc6e626
lea eax, [ebp - 0x16d0]
mov edx, ebx
push eax
mov ecx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6e694
mov eax, dword [ebp - 0x16d0]
jmp 0xc6e60e
lea eax, [ebp - 0x16d8]
mov ecx, edi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6e694
mov eax, dword [ebp - 0x16d0]
cmp dword [ebp - 0x16d8], eax
ja 0xc6e64b
mov edx, dword [edi]
lea eax, [ebp - 0x16c0]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6e5d0
mov eax, dword [ebp - 0x16c0]
mov dword [ebp - 0x1908], eax
jmp 0xc6e5d6
mov eax, dword [ebp - 0x1908]
test esi, esi
js 0xc6e694
lea ecx, [ebp - 0x16a4]
mov edx, eax
push ecx
mov ecx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xc6e694
mov edi, dword [ebp - 0x16a4]
mov eax, dword [ebp - 0x16d0]
cmp edi, eax
ja 0xc6e64b
inc dword [ebp - 0x1674]
cmp edi, eax
jb 0xc6e57a
cmp edi, eax
jne 0xc6e64b
mov edi, dword [ebp - 0x169c]
mov eax, dword [ebp - 0x1670]
test ebx, ebx
je 0xc6e656
push ebx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1670], eax
test eax, eax
jne 0xc6e652
mov esi, 0xc0000017
jmp 0xc6e67d
mov esi, 0xc000000d
jmp 0xc6e694
xor ecx, ecx
mov esi, ecx
test edi, edi
je 0xc6e66b
push ebx
push edi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0x1670]
add esp, 0xc
mov dword [ebp - 0x1abc], eax
mov eax, dword [ebp - 0x1674]
mov dword [ebp - 0x1ac4], eax
test esi, esi
js 0xc6e694
mov eax, dword [ebp - 0x162c]
cmp eax, dword [ebp - 0x1ac4]
je 0xc6e694
mov esi, 0xc000003e
or esi, 0x10000000
mov ebx, dword [ebp - 0x1710]
mov eax, dword [ebp - 0x16fc]
test eax, eax
je 0xc6e6bb
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0x1718]
test edi, edi
je 0xc6e729
xor eax, eax
cmp dword [edi + 4], eax
je 0xc6e6e2
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc6e6fe
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc6e71a
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
je 0xc6e740
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc6e742
xor ebx, ebx
mov eax, dword [ebp - 0x16bc]
test eax, eax
je 0xc6e75b
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ebx, dword [ebp - 0x16b8]
test ebx, ebx
je 0xc6e7c9
xor eax, eax
cmp dword [ebx + 4], eax
je 0xc6e782
push dword [ebx + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 4], eax
cmp dword [ebx + 0xc], 0
je 0xc6e79e
push dword [ebx + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0xc], eax
cmp dword [ebx + 0x14], 0
je 0xc6e7ba
push dword [ebx + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0x14], eax
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x166c]
test eax, eax
je 0xc6e7e4
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc6e8a2
mov edi, dword [ebp - 0x1ac4]
xor ebx, ebx
inc ebx
cmp edi, ebx
jb 0xc6e8a2
mov esi, dword [ebp - 0x1abc]
test esi, esi
je 0xc6e8a2
test edi, edi
je 0xc6e8a2
lea eax, [ebp - 0x16a0]
mov dword [ebp - 0x16a0], esi
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc6e8a2
mov eax, dword [esi]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x16a0]
push 4
pop ecx
cmp dword [esi], ecx
jne 0xc6e8a2
cmp dword [eax], 0
jl 0xc6e8a2
cmp edi, ebx
jbe 0xc6e8a2
xor eax, eax
mov dword [ebp - 0x1698], esi
mov edi, eax
lea eax, [ebp - 0x1698]
mov edx, ecx
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xc6e8a2
mov edx, dword [esi]
lea eax, [ebp - 0x1698]
mov ecx, dword [ebp - 0x1698]
push eax
call fcn.00a32533
test eax, eax
js 0xc6e8a2
inc edi
cmp edi, ebx
jae 0xc6e8a2
mov esi, dword [ebp - 0x1698]
push 4
pop ecx
jmp 0xc6e856
mov eax, dword [ebp - 0x1ab0]
jmp 0xc6e8ae
mov eax, dword [ebp - 0x1ab0]
jmp 0xc6e8a8
mov eax, dword [ebp - 0x16b4]
mov edi, dword [ebp - 0x163c]
xor ebx, ebx
test eax, eax
je 0xc6e8c3
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0x1abc]
test esi, esi
je 0xc6e8dc
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1614]
test eax, eax
je 0xc6e8f5
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xc6e908
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ebx, dword [ebp - 0x15bc]
mov eax, dword [ebp - 0x1594]
xor ecx, ecx
mov dword [ebp - 0x1594], ecx
mov dword [ebp - 0x1748], eax
jmp 0xc650aa
mov ebx, 0xc004f027
test ebx, ebx
js 0xc65167
push 4
pop edi
cmp dword [ebp - 0x1714], edi
jne 0xc6516a
mov ecx, dword [eax]
mov dword [ebp - 0x1744], ecx
jmp 0xc6516a
call fcn.00aeda94
test al, al
jne 0xc6e961
push 2
pop esi
jmp 0xc6f432
xor eax, eax
mov edx, 0xc96238
mov dword [ebp - 0x1744], eax
mov dword [ebp - 0x190c], eax
mov dword [ebp - 0x15c0], eax
mov dword [ebp - 0x15a0], eax
mov ecx, ebx
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc6e980
mov eax, dword [0xc95890]
or ebx, 0xffffffff
mov dword [ebp - 0x174c], ebx
mov edi, 0x9fbcf2
mov dword [ebp - 0x1750], edi
mov dword [ebp - 0x1754], 0x67
mov dword [ebp - 0x1760], 0x337
test eax, eax
jne 0xc6efd8
push 0x338
mov esi, eax
mov dword [ebp - 0x15b0], eax
push eax
mov dword [ebp - 0x1598], eax
mov dword [ebp - 0x15b4], esi
mov dword [ebp - 0x1698], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x16a0], eax
test eax, eax
je 0xc6efcc
xor edx, edx
mov dword [ebp - 0x6f0], 0xab69605e
add eax, 7
mov dword [ebp - 0x6ec], 0x7f1137f
mov cl, dl
mov dword [ebp - 0x16a4], edx
mov dword [ebp - 0x16c0], ebx
mov esi, edi
mov dword [ebp - 0x16d8], edx
mov dword [ebp - 0x16d0], eax
mov dword [ebp - 0x169c], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [ebp - 0x1670], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [ebp - 0x162c], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [ebp - 0x16d8]
xor esi, edx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x1670]
xor eax, edx
mov dword [ebp - 0x1670], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x1670]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x1670]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x1670], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x1670]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x1670]
xor edx, eax
mov dword [ebp - 0x1670], edx
mov eax, dword [ebp - 0x1670]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x1670]
xor eax, edx
mov dword [ebp - 0x1670], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x1670]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x1670]
xor eax, edx
mov dword [ebp - 0x1670], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x1670]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0x1670]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0x1670], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0x1670]
xor eax, 0xab69605e
mov dword [ebp - 0x16d8], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x16d8]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x16d8]
xor eax, edx
mov dword [ebp - 0x16d8], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0xab69
rol esi, 7
rol eax, 5
imul eax, eax, 0x7f1
add eax, esi
mov esi, dword [ebp - 0x16d8]
xor esi, eax
mov dword [ebp - 0x16d8], esi
xor esi, edx
mov edx, dword [ebp - 0x16d8]
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x16d8], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x16d8]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x16d8]
xor eax, edx
mov dword [ebp - 0x16d8], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x16d8]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x16d8]
xor eax, edx
mov dword [ebp - 0x16d8], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x16d8]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x16d8]
xor edx, dword [ebp - 0x16a4]
xor eax, dword [ebp - 0x16c0]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x1670], esi
mov esi, dword [ebp - 0x16d0]
mov dword [ebp - 0x16a4], ebx
mov dword [ebp - 0x16c0], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x169c], 1
mov dword [ebp - 0x16d0], esi
mov esi, dword [ebp - 0x162c]
mov dword [ebp - 0x16d8], eax
jne 0xc6ea3b
mov esi, dword [ebp - 0x16a0]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc6edb8
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc6edea
cmp edx, dword [0x9fc02c]
jne 0xc6edea
mov edi, esi
xor eax, eax
mov dword [ebp - 0x15b4], edi
mov esi, eax
mov ebx, 0x337
jmp 0xc6edff
mov edi, dword [ebp - 0x15b4]
or ebx, 0xffffffff
mov dword [ebp - 0x1698], 0xc004d501
xor eax, eax
test esi, esi
je 0xc6ee12
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x1698], 0
jl 0xc6efc6
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xc960a0
push eax
push ebx
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xc6ef5c
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1740]
jne 0xc6ee49
sub ecx, ebx
xor eax, eax
sar ecx, 1
push edi
push edx
push eax
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc6efbf
xor eax, eax
mov edx, 0x5a4d
mov ecx, eax
mov eax, dword [edi]
mov dword [ebp - 0x1598], ecx
cmp word [eax], dx
je 0xc6ee98
mov ecx, 0xc000007b
mov dword [ebp - 0x1598], ecx
jmp 0xc6eee2
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc6ee8b
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc6ee8b
cmp dword [edx], 0x4550
jne 0xc6ee8b
movzx eax, word [edx + 0x18]
mov ebx, 0x10b
cmp ax, bx
je 0xc6eed0
mov ebx, 0x20b
cmp ax, bx
je 0xc6eed0
mov ecx, 0xc000000d
jmp 0xc6ee90
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0x1558], eax
xor edx, edx
mov ebx, edx
test eax, eax
je 0xc6ef50
mov edx, esi
mov dword [ebp - 0x15a8], esi
lea eax, [edx + 1]
mov dword [ebp - 0x15a4], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc6ef08
sub edx, dword [ebp - 0x15a4]
inc esi
add esi, edx
test ecx, ecx
js 0xc6ef41
push dword [ebp - 0x15a8]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc6ef5c
mov ecx, dword [ebp - 0x15b0]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x1598]
inc dword [ebp - 0x15b0]
inc ebx
cmp ebx, dword [ebp - 0x1558]
jb 0xc6eef7
add edi, 0x10
cmp byte [esi], 0
jne 0xc6ee42
mov ebx, dword [ebp - 0x1598]
mov esi, dword [ebp - 0x15b4]
test esi, esi
je 0xc6ef7d
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc6efd3
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc6ef96
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc6ef85
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc6efe0
mov ebx, 0xc000007a
jmp 0xc6ef62
mov esi, dword [ebp - 0x15b4]
mov ebx, 0xc000007a
jmp 0xc6ef68
mov eax, dword [0xc95890]
inc eax
xor ebx, ebx
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
mov eax, ebx
mov dword [ebp - 0x15b0], ebx
mov dword [ebp - 0x15b4], eax
mov edi, ebx
mov eax, dword fs:[0x30]
mov dword [ebp - 0x1598], ebx
cmp dword [eax + 0x1d4], ebx
je 0xc6f2d7
mov esi, dword [0xc93088]
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x1558], ecx
test ecx, ecx
jne 0xc6f038
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc6f31f
mov eax, ebx
mov esi, ebx
mov dword [ebp - 0x15b4], eax
mov ebx, dword [0xc93098]
lea edx, [ebp - 0x1910]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xc6f0c7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc6f0a9
xor eax, eax
test esi, esi
jne 0xc6f0a2
push dword [ebp - 0x1910]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc6f09b
mov eax, dword [ebp - 0x1910]
mov ecx, dword [ebp - 0x1558]
jmp 0xc6f042
mov ebx, 0x8007000e
jmp 0xc6f0c3
mov ebx, 0x80004005
jmp 0xc6f0d7
test eax, eax
jne 0xc6f0b4
mov ebx, 0x80004005
jmp 0xc6f0c3
jg 0xc6f0ba
mov ebx, eax
jmp 0xc6f0c3
movzx ebx, ax
or ebx, 0x80070000
xor eax, eax
jmp 0xc6f0d7
mov ebx, dword [ebp - 0x15b4]
xor eax, eax
mov dword [ebp - 0x15b0], esi
mov esi, eax
test esi, esi
je 0xc6f0ea
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc6f2fe
mov esi, dword [0xc93094]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0x1558], ecx
test ecx, ecx
jne 0xc6f13c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc6f12c
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc6f2fe
mov ebx, 0x80004005
jmp 0xc6f2fe
xor edx, edx
mov eax, edx
mov esi, edx
mov dword [ebp - 0x15b4], eax
mov ebx, dword [0xc93098]
lea edx, [ebp - 0x1914]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xc6f1d9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc6f1b5
xor eax, eax
test esi, esi
jne 0xc6f1a8
push dword [ebp - 0x1914]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc6f1a1
mov eax, dword [ebp - 0x1914]
mov ecx, dword [ebp - 0x1558]
jmp 0xc6f148
mov ebx, 0x8007000e
jmp 0xc6f1cf
mov ebx, 0x80004005
mov dword [ebp - 0x15b4], ebx
jmp 0xc6f1e5
test eax, eax
jne 0xc6f1c0
mov ebx, 0x80004005
jmp 0xc6f1cf
jg 0xc6f1c6
mov ebx, eax
jmp 0xc6f1cf
movzx ebx, ax
or ebx, 0x80070000
mov dword [ebp - 0x15b4], ebx
xor eax, eax
jmp 0xc6f1e5
mov ebx, dword [ebp - 0x15b4]
xor eax, eax
mov edi, esi
mov esi, eax
test esi, esi
je 0xc6f1f8
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc6f2e3
mov eax, dword [ebp - 0x15b0]
test eax, eax
je 0xc6f2d7
push 4
mov ecx, 0x9fb9c0
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xc6f23d
test dx, dx
je 0xc6f236
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xc6f23d
add eax, esi
add ecx, esi
test dx, dx
jne 0xc6f216
xor ebx, ebx
xor eax, eax
inc ebx
jmp 0xc6f244
sbb eax, eax
xor ebx, ebx
inc ebx
or eax, ebx
test eax, eax
jne 0xc6f2d7
test edi, edi
je 0xc6f2d7
mov ecx, 0x9f98b0
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xc6f281
test dx, dx
je 0xc6f27b
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xc6f281
add eax, esi
add ecx, esi
test dx, dx
jne 0xc6f25b
xor ecx, ecx
mov eax, ecx
jmp 0xc6f287
sbb eax, eax
or eax, ebx
xor ecx, ecx
test eax, eax
jne 0xc6f2d7
push esi
lea eax, [ebp - 0x16c8]
mov dword [ebp - 0x16c8], ecx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
jne 0xc6f2cc
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc6f2c3
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc6f2e9
mov ebx, 0x80004005
jmp 0xc6f2e9
test byte [ebp - 0x16c8], 0xf
mov eax, ebx
je 0xc6f2dd
mov eax, dword [ebp - 0x1598]
mov dword [ebp - 0x15a0], eax
mov ebx, dword [ebp - 0x15b4]
test edi, edi
je 0xc6f2fe
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x15b0]
test eax, eax
je 0xc6f319
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc6f327
xor ebx, ebx
mov dword [ebp - 0x15a0], ebx
jmp 0xc6f329
xor ebx, ebx
push 4
pop eax
push eax
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x15b0], esi
test esi, esi
jne 0xc6f462
mov ebx, 0x8007000e
mov eax, dword [ebp - 0x16c8]
mov dword [ebp - 0x15c0], eax
mov edx, 0xc96238
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc6f35b
mov eax, dword [0xc95890]
mov esi, dword [ebp - 0x15b0]
test eax, eax
jle 0xc6f3c5
sub eax, 1
mov dword [0xc95890], eax
jne 0xc6f3c5
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc6f396
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc6f385
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x15b0]
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
test esi, esi
je 0xc6f3d9
push esi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, dword [ebp - 0x190c]
test ebx, ebx
jns 0xc78b95
cmp ebx, 0xd0000034
je 0xc6f413
cmp ebx, 0xd00000e5
je 0xc78b88
cmp ebx, 0xc004d501
je 0xc78b88
cmp ebx, 0xd000003e
jne 0xc78b8d
push 4
pop edi
mov esi, dword [ebp - 0x1744]
test eax, eax
je 0xc6f42f
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x190c], eax
xor ebx, ebx
inc ebx
push ecx
push ecx
push ebx
mov ecx, 0xc96880
call fcn.00c79071
cmp esi, 3
je 0xc6f44d
cmp esi, edi
je 0xc6f44d
cmp esi, 5
jne 0xc6f451
xor eax, eax
mov bl, al
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret
mov eax, ebx
mov dword [ebp - 0x1598], ebx
mov dword [ebp - 0x1558], eax
lea edi, [ebp - 0x1adc]
mov dword [ebp - 0x1ac8], eax
xor eax, eax
stosd dword es:[edi], eax
mov dword [ebp - 0x15b4], ebx
mov dword [ebp - 0x15a8], ebx
mov dword [ebp - 0x15a4], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1560], eax
mov ebx, 0xc0000017
mov dword [ebp - 0x16ec], 0x38
test eax, eax
je 0xc72121
push 0x28
pop ecx
mov esi, 0xc94ea0
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, eax
mov dword [ebp - 0x1598], edi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x1574], ecx
test ecx, ecx
jne 0xc6f500
mov dword [ebp - 0x1590], ebx
jmp 0xc7212d
mov eax, dword [0xc94e98]
mov dword [ecx], eax
mov eax, dword [0xc94e9c]
mov dword [ecx + 4], eax
mov dword [ebp - 0x15b4], ecx
rdtsc
mov dword [ebp - 0x1578], eax
mov dword [ebp - 0x15c8], edx
xor eax, eax
mov dword [ebp - 0x1918], eax
lea eax, [ebp - 0x191c]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov esi, dword [ebp - 0x191c]
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
jns 0xc6f55b
mov esi, dword [ebp - 0x1920]
jmp 0xc7212d
lea eax, [ebp - 0x1918]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x1590], ebx
jl 0xc7212d
lea eax, [ebp - 0x1924]
mov edx, 0xa0
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc7212d
mov esi, dword [ebp - 0x1924]
mov ecx, dword [ebp - 0x1918]
lea eax, [ebp - 0x1918]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x1590], ebx
jl 0xc7212d
lea eax, [ebp - 0x1928]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc7212d
mov esi, dword [ebp - 0x1928]
mov ecx, dword [ebp - 0x1918]
lea eax, [ebp - 0x1918]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x1590], ebx
jl 0xc7212d
lea eax, [ebp - 0x192c]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc7212d
mov esi, dword [ebp - 0x192c]
mov ecx, dword [ebp - 0x1918]
lea eax, [ebp - 0x1918]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x1590], ebx
jl 0xc7212d
lea eax, [ebp - 0x1930]
mov edx, SysReAllocString
push eax
mov ecx, 0x9fe768
call fcn.00a41606
test eax, eax
jns 0xc6f69b
mov ebx, 0xc000003e
jmp 0xc6f4f5
mov edx, dword [ebp - 0x1930]
lea eax, [ebp - 0x1934]
push eax
inc edx
push 4
pop eax
mov dword [ebp - 0x1930], edx
mov ecx, eax
add edx, edx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc7212d
mov esi, dword [ebp - 0x1934]
mov ecx, dword [ebp - 0x1918]
lea eax, [ebp - 0x1918]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x1590], ebx
jl 0xc7212d
lea eax, [ebp - 0x1938]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc7212d
mov esi, dword [ebp - 0x1938]
mov ecx, dword [ebp - 0x1918]
lea eax, [ebp - 0x1918]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x1590], ebx
jl 0xc7212d
lea eax, [ebp - 0x193c]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc7212d
mov esi, dword [ebp - 0x193c]
mov ecx, dword [ebp - 0x1918]
lea eax, [ebp - 0x1918]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x1590], ebx
jl 0xc7212d
mov eax, dword [ebp - 0x1918]
push eax
push 8
mov dword [ebp - 0x1acc], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x1554], edi
test edi, edi
jne 0xc6f7cd
mov ebx, 0xc0000017
jmp 0xc72121
mov eax, edi
mov dword [ebp - 0x1558], eax
mov dword [ebp - 0x1ac8], eax
xor eax, eax
mov esi, eax
mov dword [ebp - 0x156c], esi
mov dword [ebp - 0x1940], eax
mov dword [ebp - 0x1944], edi
push 4
pop ecx
lea eax, [ebp - 0x1a74]
mov dword [ebp - 0x1a78], ecx
mov edx, ecx
mov ecx, edi
push eax
call fcn.00a32533
mov ebx, eax
xor edx, edx
mov dword [ebp - 0x1590], ebx
mov ecx, edx
test ebx, ebx
js 0xc72127
mov ecx, dword [ebp - 0x1918]
lea eax, [edi + 8]
add ecx, edi
cmp eax, ecx
jbe 0xc6f837
mov ebx, 0xc0000023
jmp 0xc72121
push 4
pop eax
mov dword [edi], eax
mov eax, dword [ebp - 0x1a74]
mov dword [eax], edx
xor eax, eax
lea esi, [eax + 1]
mov dword [ebp - 0x156c], esi
lea ecx, [eax + 1]
test ebx, ebx
js 0xc72127
mov dword [ebp - 0x1568], edx
mov eax, edi
mov dword [ebp - 0x1948], eax
test ecx, ecx
je 0xc6f8e2
mov edx, dword [eax]
lea ecx, [ebp - 0x194c]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc6f899
mov eax, dword [ebp - 0x194c]
mov dword [ebp - 0x1950], eax
jmp 0xc6f89f
mov eax, dword [ebp - 0x1950]
test ebx, ebx
js 0xc72127
lea ecx, [ebp - 0x1948]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0x1948]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc72127
mov eax, dword [ebp - 0x1568]
inc eax
mov dword [ebp - 0x1568], eax
cmp eax, esi
mov eax, dword [ebp - 0x1948]
jb 0xc6f86c
lea ecx, [ebp - 0x1a0c]
mov dword [ebp - 0x1a10], 0xa0
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc72127
mov edx, dword [ebp - 0x1948]
mov ecx, dword [ebp - 0x1918]
add ecx, edi
lea eax, [edx + 0xa4]
cmp eax, ecx
ja 0xc6f82d
mov esi, dword [ebp - 0x1560]
mov edi, dword [ebp - 0x1a0c]
push 0x28
pop ecx
mov dword [edx], 0xa0
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x156c]
mov edi, dword [ebp - 0x1554]
inc esi
mov dword [ebp - 0x156c], esi
test ebx, ebx
js 0xc72127
xor ecx, ecx
mov eax, edi
mov dword [ebp - 0x1560], eax
mov dword [ebp - 0x1554], ecx
test esi, esi
je 0xc6f9d5
mov edx, dword [eax]
lea ecx, [ebp - 0x1954]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc6f99e
mov eax, dword [ebp - 0x1954]
mov dword [ebp - 0x1958], eax
jmp 0xc6f9a4
mov eax, dword [ebp - 0x1958]
test ebx, ebx
js 0xc72127
add eax, dword [ebp - 0x1560]
cmp eax, dword [ebp - 0x1560]
jb 0xc6fa9f
mov ecx, dword [ebp - 0x1554]
inc ecx
mov dword [ebp - 0x1560], eax
mov dword [ebp - 0x1554], ecx
cmp ecx, esi
jb 0xc6f971
lea ecx, [ebp - 0x1a14]
mov dword [ebp - 0x1a18], 8
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc72127
mov edx, dword [ebp - 0x1560]
mov ecx, dword [ebp - 0x1918]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xc6f82d
mov ecx, dword [ebp - 0x1a14]
inc esi
mov dword [edx], 8
mov edx, dword [ebp - 0x1574]
mov dword [ebp - 0x156c], esi
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
test ebx, ebx
js 0xc72127
mov eax, dword [ebp - 0x1578]
xor ecx, ecx
mov dword [ebp - 0x1a28], eax
mov eax, dword [ebp - 0x15c8]
mov dword [ebp - 0x1a24], eax
mov eax, edi
mov dword [ebp - 0x1560], eax
mov dword [ebp - 0x1574], ecx
test esi, esi
je 0xc6fadc
mov edx, dword [eax]
lea ecx, [ebp - 0x195c]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc6faa9
mov eax, dword [ebp - 0x195c]
mov dword [ebp - 0x1960], eax
jmp 0xc6faaf
mov ebx, 0xc0000095
jmp 0xc72121
mov eax, dword [ebp - 0x1960]
test ebx, ebx
js 0xc72127
add eax, dword [ebp - 0x1560]
cmp eax, dword [ebp - 0x1560]
jb 0xc6fa9f
mov ecx, dword [ebp - 0x1574]
inc ecx
mov dword [ebp - 0x1560], eax
mov dword [ebp - 0x1574], ecx
cmp ecx, esi
jb 0xc6fa72
lea ecx, [ebp - 0x1a2c]
mov dword [ebp - 0x1a30], 8
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc72127
mov edx, dword [ebp - 0x1560]
mov ecx, dword [ebp - 0x1918]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xc6f82d
mov eax, dword [ebp - 0x1a2c]
inc esi
mov ecx, dword [ebp - 0x1578]
mov dword [edx], 8
mov dword [ebp - 0x156c], esi
mov dword [eax], ecx
mov ecx, dword [ebp - 0x15c8]
mov dword [eax + 4], ecx
test ebx, ebx
js 0xc72127
lea eax, [ebp - 0x1964]
mov edx, SysReAllocString
push eax
mov ecx, 0x9fe768
call fcn.00a41606
test eax, eax
jns 0xc6fb72
mov ebx, 0xc000003e
jmp 0xc72121
mov ecx, dword [ebp - 0x1964]
lea eax, [ebp - 0x1964]
xor edx, edx
push eax
inc edx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc72127
mov eax, dword [ebp - 0x1964]
lea edx, [eax + eax]
mov dword [ebp - 0x1560], edx
test edx, edx
je 0xc6fc52
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x1574], ecx
mov ebx, eax
test esi, esi
je 0xc6fbdb
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0xc6fc26
add eax, ecx
cmp eax, ecx
jb 0xc6fc26
inc ebx
mov ecx, eax
mov dword [ebp - 0x1574], ecx
cmp ebx, esi
jb 0xc6fbbe
lea eax, [ebp - 0x1a34]
mov dword [ebp - 0x1a38], edx
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc72127
mov eax, dword [ebp - 0x1560]
mov ecx, dword [ebp - 0x1918]
add eax, 4
mov edx, dword [ebp - 0x1574]
add ecx, edi
add eax, edx
cmp eax, ecx
jbe 0xc6fc2d
mov ebx, 0xc0000023
jmp 0xc6fc57
mov ebx, 0xc0000095
jmp 0xc6fc57
mov eax, dword [ebp - 0x1560]
push eax
push 0x9fe768
push dword [ebp - 0x1a34]
mov dword [edx], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
inc esi
mov dword [ebp - 0x156c], esi
jmp 0xc6fc5d
mov ebx, 0xc000000d
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc72127
mov eax, dword [ebp - 0x15a0]
mov ecx, edi
mov dword [ebp - 0x1968], eax
xor eax, eax
mov dword [ebp - 0x1560], ecx
mov edx, eax
test esi, esi
je 0xc6fca8
push 4
pop ebx
mov eax, dword [ecx]
add eax, 4
cmp eax, ebx
jb 0xc6fd90
add eax, ecx
cmp eax, ecx
jb 0xc6fa9f
inc edx
mov ecx, eax
mov dword [ebp - 0x1560], ecx
cmp edx, esi
jb 0xc6fc84
push 4
pop edx
lea eax, [ebp - 0x1a1c]
mov dword [ebp - 0x1a20], edx
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc72127
mov edx, dword [ebp - 0x1560]
mov ecx, dword [ebp - 0x1918]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xc6f82d
mov ecx, dword [ebp - 0x15a0]
inc esi
push 4
pop eax
mov dword [edx], eax
mov eax, dword [ebp - 0x1a1c]
mov dword [ebp - 0x156c], esi
mov dword [eax], ecx
test ebx, ebx
js 0xc72127
push 4
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x1560], ecx
mov edx, eax
pop ebx
mov dword [ebp - 0x196c], ebx
test esi, esi
je 0xc6fd41
mov eax, dword [ecx]
add eax, 4
cmp eax, ebx
jb 0xc6fda0
add eax, ecx
cmp eax, ecx
jb 0xc6fa9f
inc edx
mov ecx, eax
mov dword [ebp - 0x1560], ecx
cmp edx, esi
jb 0xc6fd21
lea eax, [ebp - 0x1a4c]
mov dword [ebp - 0x1a50], ebx
push eax
mov edx, ebx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc6fdab
mov edx, dword [ebp - 0x1560]
mov ecx, dword [ebp - 0x1918]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xc6f82d
mov eax, dword [ebp - 0x1a4c]
inc esi
push 4
pop ecx
mov dword [edx], ecx
mov dword [eax], ecx
mov dword [ebp - 0x156c], esi
jmp 0xc6fdae
mov ebx, 0xc0000095
mov dword [ebp - 0x1590], ebx
jmp 0xc6fd00
mov ebx, 0xc0000095
mov dword [ebp - 0x1590], ebx
push 4
pop ecx
test ebx, ebx
js 0xc72127
lea eax, [ebp - 0x1970]
mov edx, ecx
push eax
call fcn.00a32533
mov esi, dword [ebp - 0x1970]
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
jns 0xc6fde1
mov esi, dword [ebp - 0x1974]
jmp 0xc6ff5f
lea eax, [ebp - 0x197c]
mov dword [ebp - 0x1978], esi
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc6ff5f
mov esi, dword [ebp - 0x197c]
mov ecx, dword [ebp - 0x1978]
lea eax, [ebp - 0x1978]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc6ff5f
lea eax, [ebp - 0x1980]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc6ff5f
mov esi, dword [ebp - 0x1980]
mov ecx, dword [ebp - 0x1978]
lea eax, [ebp - 0x1978]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc6ff5f
lea eax, [ebp - 0x1984]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc6ff5f
mov esi, dword [ebp - 0x1984]
mov ecx, dword [ebp - 0x1978]
lea eax, [ebp - 0x1978]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc6ff5f
lea eax, [ebp - 0x1988]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc6ff5f
mov esi, dword [ebp - 0x1988]
mov ecx, dword [ebp - 0x1978]
lea eax, [ebp - 0x1978]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc6ff5f
lea eax, [ebp - 0x16b0]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc6ff5f
mov esi, dword [ebp - 0x16b0]
mov ecx, dword [ebp - 0x1978]
lea eax, [ebp - 0x1978]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0x1978]
mov dword [ebp - 0x1590], ebx
test ebx, ebx
jns 0xc6ff65
mov eax, dword [ebp - 0x16b0]
mov dword [ebp - 0x1560], eax
test ebx, ebx
js 0xc72127
xor ecx, ecx
rdtsc
mov esi, ecx
mov dword [ebp - 0x1574], ecx
mov dword [ebp - 0x1554], esi
mov dword [ebp - 0x1568], ecx
mov dword [ebp - 0x1584], ecx
mov dword [ebp - 0x1564], ecx
mov dword [ebp - 0x1570], ecx
mov dword [ebp - 0x155c], ecx
mov dword [ebp - 0x1588], ecx
mov dword [ebp - 0x1580], ecx
mov dword [ebp - 0x1594], ecx
mov dword [ebp - 0x1590], eax
mov dword [ebp - 0x157c], edx
push 8
pop eax
mov dword [ebp - 0x198c], eax
mov edx, dword [ebp - 0x1918]
lea ecx, [ebp - 0x198c]
push ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc700dc
mov eax, dword [ebp - 0x198c]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0x158c], ecx
cmp ecx, eax
jae 0xc70008
mov ebx, 0xc0000095
jmp 0xc700dc
mov dword [ebp - 0x198c], ecx
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xc7002e
mov ebx, 0xc0000017
jmp 0xc700d6
mov eax, dword [ebp - 0x156c]
mov ecx, esi
mov dword [esi], eax
lea eax, [ebp - 0x1990]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0x1990], esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc700c1
mov ecx, dword [ebp - 0x1990]
mov eax, dword [ebp - 0x1918]
mov dword [ecx], eax
lea eax, [ebp - 0x1990]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc700c1
mov eax, dword [ebp - 0x158c]
push dword [ebp - 0x1918]
mov ecx, dword [ebp - 0x1590]
push edi
push dword [ebp - 0x1990]
mov dword [esi + eax - 8], ecx
mov ecx, dword [ebp - 0x157c]
mov dword [esi + eax - 4], ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0x158c]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1574], esi
mov esi, ecx
mov dword [ebp - 0x1554], eax
jmp 0xc700c3
xor ecx, ecx
test esi, esi
je 0xc700d6
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0x1554]
or ebx, 0x10000000
mov dword [ebp - 0x1590], ebx
jl 0xc71a49
xor eax, eax
mov dword [ebp - 0x1590], eax
cmp dword [ebp - 0x1574], eax
jne 0xc70108
mov ebx, 0xc000000d
jmp 0xc70738
test esi, esi
je 0xc70733
lea ebx, [esi + 8]
push ebx
push eax
mov dword [ebp - 0x157c], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x158c], edi
test edi, edi
je 0xc70733
xor eax, eax
mov cl, al
mov edx, eax
test esi, esi
je 0xc70150
mov eax, dword [ebp - 0x1574]
xor cl, byte [edx + eax]
inc edx
cmp edx, esi
jb 0xc70148
mov eax, esi
mov dword [ebp - 0x6f8], 0xb1b54a58
shr eax, 3
mov dword [ebp - 0x6f4], 0xc81ecb17
mov dword [ebp - 0x159c], eax
test eax, eax
je 0xc7055d
movzx edx, word [ebp - 0x6f6]
mov eax, 0xc81ecb17
movzx esi, ax
add edi, 7
movzx eax, word [ebp - 0x6f2]
mov dword [ebp - 0x15b8], eax
mov eax, 0xb1b54a58
movzx eax, ax
mov dword [ebp - 0x15bc], esi
mov esi, dword [ebp - 0x1574]
mov dword [ebp - 0x15ac], eax
add esi, 2
xor eax, eax
mov dword [ebp - 0x15c4], edx
mov dword [ebp - 0x15cc], edi
mov edx, eax
mov dword [ebp - 0x1604], esi
or ebx, 0xffffffff
mov dword [ebp - 0x1620], eax
mov dword [ebp - 0x1690], eax
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0x1604]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0x1604]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0x1604]
shl esi, 8
add dword [ebp - 0x1604], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov eax, ebx
sub eax, dword [ebp - 0x15ac]
xor eax, 0xc81ecb17
xor eax, edi
xor edx, eax
mov dword [ebp - 0x1714], edx
mov edx, 0xc81ecb17
mov eax, dword [ebp - 0x1714]
xor edx, eax
ror edx, 0xf
imul edx, dword [ebp - 0x15c4]
ror eax, 7
add edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
mov eax, ebx
ror eax, 0xa
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [ebp - 0x15bc]
sub edx, eax
mov eax, dword [ebp - 0x1714]
xor eax, edx
mov edx, dword [ebp - 0x15bc]
xor edx, eax
mov dword [ebp - 0x1714], eax
rol edx, 4
imul edx, dword [ebp - 0x15b8]
rol eax, 5
add edx, eax
mov eax, 0xc81ecb17
xor ebx, edx
mov edx, 0xb1b54a58
xor edx, ebx
sub eax, edx
mov edx, dword [ebp - 0x1714]
xor edx, eax
mov dword [ebp - 0x1714], edx
sub edx, dword [ebp - 0x15ac]
imul edx, dword [ebp - 0x15c4]
mov eax, dword [ebp - 0x1714]
shr eax, 6
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0x1714]
mov eax, ebx
ror eax, 0xf
xor eax, dword [ebp - 0x15bc]
imul eax, dword [ebp - 0x15ac]
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [ebp - 0x15b8]
imul eax, dword [ebp - 0x15bc]
xor ebx, eax
mov eax, ebx
sub eax, 0xc81ecb17
sub eax, dword [ebp - 0x15ac]
xor edx, eax
mov eax, dword [ebp - 0x15b8]
mov dword [ebp - 0x1714], edx
xor eax, dword [ebp - 0x1714]
imul eax, dword [ebp - 0x15c4]
ror edx, 0xa
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0x15ac]
xor edx, ebx
mov eax, ebx
rol edx, 6
imul edx, dword [ebp - 0x15bc]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0x1714]
xor eax, edx
mov edx, dword [ebp - 0x15b8]
mov dword [ebp - 0x1714], eax
ror eax, 0xf
sub eax, edx
imul eax, dword [ebp - 0x15ac]
xor ebx, eax
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0x15ac]
shr eax, 1
xor edx, eax
mov eax, ebx
xor dword [ebp - 0x1714], edx
mov edx, ebx
sub edx, dword [ebp - 0x15bc]
rol edx, 3
imul edx, dword [ebp - 0x15ac]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0x1714]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x1714], eax
sub edx, dword [ebp - 0x15bc]
imul edx, dword [ebp - 0x15c4]
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 9
imul edx, dword [ebp - 0x15bc]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0x1714]
xor eax, edx
mov dword [ebp - 0x1714], eax
sub eax, dword [ebp - 0x15b8]
sub eax, 0xb1b54a58
xor ebx, eax
mov eax, dword [ebp - 0x15c4]
xor eax, ebx
mov edx, ebx
imul eax, dword [ebp - 0x15ac]
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0x15b8]
xor dword [ebp - 0x1714], eax
mov eax, dword [ebp - 0x1714]
xor edx, eax
rol edx, 4
imul edx, dword [ebp - 0x15c4]
ror eax, 0x10
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 0xa
imul edx, dword [ebp - 0x15bc]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0x1714]
xor eax, edx
mov edx, eax
mov dword [ebp - 0x1714], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, dword [ebp - 0x15b8]
xor edx, eax
xor ebx, edx
mov edx, 0xc81ecb17
xor edx, ebx
mov eax, ebx
rol edx, 8
imul edx, dword [ebp - 0x15ac]
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0x1714]
xor eax, edx
mov edx, 0xc81ecb17
sub edx, eax
mov dword [ebp - 0x1714], eax
ror edx, 0xb
imul edx, dword [ebp - 0x15c4]
ror eax, 0xc
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0x15c4]
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0x15bc]
shr eax, 8
xor edx, eax
mov eax, 0xc81ecb17
xor dword [ebp - 0x1714], edx
xor eax, 0xb1b54a58
mov edx, dword [ebp - 0x1714]
xor ebx, eax
mov eax, dword [ebp - 0x15cc]
xor ebx, edx
xor edx, dword [ebp - 0x1620]
xor ebx, dword [ebp - 0x1690]
mov dword [ebp - 0x1690], esi
mov esi, dword [ebp - 0x1604]
mov byte [eax - 4], dl
mov byte [eax], bl
ror edx, 8
mov byte [eax - 5], dl
ror ebx, 8
mov byte [eax - 1], bl
ror edx, 8
mov byte [eax - 6], dl
ror ebx, 8
mov byte [eax - 2], bl
ror edx, 8
ror ebx, 8
mov byte [eax - 7], dl
mov byte [eax - 3], bl
add eax, 8
ror edx, 8
ror ebx, 8
sub dword [ebp - 0x159c], 1
mov dword [ebp - 0x1620], edi
mov dword [ebp - 0x15cc], eax
jne 0xc701d8
mov esi, dword [ebp - 0x1554]
mov edi, dword [ebp - 0x158c]
mov ebx, dword [ebp - 0x157c]
movzx eax, cl
cdq
mov dword [edi + esi], eax
mov dword [edi + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x1554], esi
test esi, esi
jne 0xc7058f
mov ebx, 0xc0000017
jmp 0xc7069c
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc705b1
mov ebx, 0xc0000017
xor edx, edx
jmp 0xc70635
mov dword [esi + 4], eax
push ebx
push edi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [esi + 8], eax
push eax
push 8
pop ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc705a5
mov dword [esi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1554]
push ebx
push ebx
mov dword [esi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, dword [ebp - 0x158c]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xc70619
mov ebx, 0xc0000017
jmp 0xc70635
mov dword [esi + 0x14], ecx
mov ebx, edx
mov eax, dword [0xc94e90]
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ebp - 0x1590], esi
mov esi, edx
mov dword [ecx + 4], eax
test esi, esi
je 0xc7069c
cmp dword [esi + 4], 0
je 0xc70655
push dword [esi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 4], edx
cmp dword [esi + 0xc], 0
je 0xc70671
push dword [esi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0xc], edx
cmp dword [esi + 0x14], 0
je 0xc7068d
push dword [esi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0x14], edx
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc706b2
mov eax, dword [ebp - 0x1590]
mov dword [ebp - 0x1568], eax
xor eax, eax
mov esi, eax
jmp 0xc706ba
mov esi, dword [ebp - 0x1590]
xor eax, eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
je 0xc70738
xor eax, eax
cmp dword [esi + 4], eax
je 0xc706ea
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xc70706
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xc70722
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc70738
mov ebx, 0xc0000001
or ebx, 0x10000000
mov dword [ebp - 0x1590], ebx
jl 0xc71a49
mov esi, dword [ebp - 0x1568]
lea eax, [ebp - 0x1994]
push 4
pop edi
push eax
mov edx, dword [esi]
mov ecx, edi
mov dword [ebp - 0x1994], edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc707df
mov ecx, dword [ebp - 0x1994]
lea eax, [ebp - 0x1994]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc707df
mov edx, dword [esi + 8]
lea eax, [ebp - 0x1994]
mov ecx, dword [ebp - 0x1994]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc707df
mov ecx, dword [ebp - 0x1994]
lea eax, [ebp - 0x1994]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc707df
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0x1994]
mov ecx, dword [ebp - 0x1994]
push eax
call fcn.00a32533
mov edi, dword [ebp - 0x1994]
mov ebx, eax
test ebx, ebx
jns 0xc707ed
mov edi, dword [ebp - 0x1998]
test ebx, ebx
js 0xc70956
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xc7080d
mov ebx, 0xc0000017
jmp 0xc70956
mov eax, dword [ebp - 0x1568]
mov ecx, esi
mov dword [ebp - 0x199c], esi
mov eax, dword [eax]
mov dword [esi], eax
lea eax, [ebp - 0x199c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc70941
mov ebx, dword [ebp - 0x1568]
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0x199c]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx]
lea eax, [ebp - 0x199c]
mov ecx, dword [ebp - 0x199c]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc70941
mov eax, dword [ebp - 0x1568]
mov ecx, dword [ebp - 0x199c]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0x199c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc70941
mov ebx, dword [ebp - 0x1568]
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0x199c]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 8]
lea eax, [ebp - 0x199c]
mov ecx, dword [ebp - 0x199c]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc70941
mov eax, dword [ebp - 0x1568]
mov ecx, dword [ebp - 0x199c]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0x199c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc70941
mov ebx, dword [ebp - 0x1568]
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0x199c]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0x199c]
mov ecx, dword [ebp - 0x199c]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
xor eax, eax
test ebx, ebx
js 0xc70943
mov dword [ebp - 0x1584], esi
mov esi, eax
mov dword [ebp - 0x1564], edi
jmp 0xc70943
xor eax, eax
test esi, esi
je 0xc70956
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or ebx, 0x10000000
mov dword [ebp - 0x1590], ebx
jl 0xc71a49
xor eax, eax
mov dword [ebp - 0x19a0], 8
mov dword [ebp - 0x1554], eax
mov dword [ebp - 0x157c], eax
mov edx, dword [ebp - 0x1560]
lea eax, [ebp - 0x19a0]
push eax
push 8
pop ecx
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x1590], ebx
jl 0xc70a0e
mov eax, dword [ebp - 0x19a0]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xc709c2
mov ebx, 0xc0000095
mov dword [ebp - 0x1590], ebx
jmp 0xc709e9
mov dword [ebp - 0x19a8], ecx
lea eax, [ebp - 0x19a8]
push eax
push 8
pop edx
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0x19a8]
mov dword [ebp - 0x1590], ebx
test ebx, ebx
jns 0xc709ef
mov eax, dword [ebp - 0x19a4]
mov dword [ebp - 0x1560], eax
test ebx, ebx
js 0xc70a0e
mov eax, dword [ebp - 0x1558]
test eax, eax
jne 0xc70a44
mov ebx, 0xc000000d
mov dword [ebp - 0x1590], ebx
mov esi, dword [ebp - 0x155c]
test ebx, ebx
js 0xc71a49
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc70c71
mov ecx, dword [ebp - 0x1570]
mov ebx, 0xd0000017
jmp 0xc70c7e
mov esi, dword [ebp - 0x156c]
cmp esi, 1
jbe 0xc70a03
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x1730], ecx
mov edi, eax
mov eax, dword [ecx]
mov dword [ebp - 0x156c], eax
lea eax, [ebp - 0x1730]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc70a0e
mov edx, dword [ebp - 0x156c]
lea eax, [ebp - 0x1730]
mov ecx, dword [ebp - 0x1730]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc70a0e
mov ecx, dword [ebp - 0x1730]
inc edi
cmp edi, 1
jb 0xc70a5b
mov edi, dword [ecx]
lea eax, [ebp - 0x1730]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc70a0e
mov dword [ebp - 0x1554], edi
neg edi
sbb edi, edi
and dword [ebp - 0x1730], edi
test ebx, ebx
js 0xc70a0e
cmp esi, 2
jbe 0xc70a03
mov ecx, dword [ebp - 0x1558]
xor eax, eax
mov dword [ebp - 0x1734], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0x1734]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc70b80
mov ecx, dword [ebp - 0x1734]
lea eax, [ebp - 0x1734]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc70b80
mov ecx, dword [ebp - 0x1734]
inc esi
cmp esi, 2
jb 0xc70b08
mov esi, dword [ecx]
lea eax, [ebp - 0x1734]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc70b80
mov edi, esi
neg esi
sbb esi, esi
and dword [ebp - 0x1734], esi
jmp 0xc70b86
mov edi, dword [ebp - 0x157c]
test ebx, ebx
js 0xc70a0e
mov edx, dword [ebp - 0x1560]
lea eax, [ebp - 0x1728]
push 4
pop esi
push eax
mov ecx, esi
mov dword [ebp - 0x1728], esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc70c45
mov ecx, dword [ebp - 0x1728]
lea eax, [ebp - 0x1728]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc70c45
mov edx, dword [ebp - 0x1554]
lea eax, [ebp - 0x1728]
mov ecx, dword [ebp - 0x1728]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc70c45
mov ecx, dword [ebp - 0x1728]
lea eax, [ebp - 0x1728]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc70c45
mov ecx, dword [ebp - 0x1728]
lea eax, [ebp - 0x1728]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0x1728]
mov dword [ebp - 0x1590], ebx
test ebx, ebx
jns 0xc70c53
mov eax, dword [ebp - 0x1738]
test ebx, ebx
js 0xc70a0e
cmp eax, 0x400000
jbe 0xc70c64
mov ebx, 0x8000ffff
jmp 0xc71a43
mov esi, eax
mov dword [ebp - 0x155c], esi
jmp 0xc70a14
mov ecx, eax
mov dword [ebp - 0x1570], eax
mov ebx, 0x10000000
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc71a49
mov eax, dword [ebp - 0x1584]
test eax, eax
jne 0xc70ca0
mov ebx, 0x80070057
jmp 0xc71a43
test ecx, ecx
je 0xc70c96
mov dword [ebp - 0x1bd0], eax
xor ebx, ebx
mov eax, dword [ebp - 0x1564]
mov dword [ebp - 0x1bc8], eax
lea eax, [ebp - 0x18e0]
push eax
push 0x9f29b8
push 1
mov dword [ebp - 0x1bcc], ecx
mov dword [ebp - 0x1bc4], esi
mov dword [ebp - 0x1bc0], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xc70d18
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
jle 0xc70d05
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc70d97
mov ebx, 0x80004005
mov dword [ebp - 0x1590], ebx
jmp 0xc70d97
push 0x9fc030
push dword [ebp - 0x18e0]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0xc70d5a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
jle 0xc70d52
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0x1590], ebx
test ebx, ebx
mov esi, dword [ebp - 0x155c]
jmp 0xc70d05
push ebx
push 0x14
lea eax, [ebp - 0x1bd0]
mov ecx, esi
push eax
push 0x86
call dword [0xc99200]
call esi
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0x1590], ebx
jl 0xc70d91
mov esi, dword [ebp - 0x1bc4]
mov dword [ebp - 0x155c], esi
jmp 0xc70d97
mov esi, dword [ebp - 0x155c]
cmp ebx, 0xd0000023
jne 0xc70da9
mov ebx, 0x8007007a
jmp 0xc71a43
test ebx, ebx
js 0xc71a49
mov eax, dword [ebp - 0x1570]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0x16c4], ecx
mov edi, ecx
mov dword [ebp - 0x16cc], eax
cmp esi, edx
jae 0xc70dd8
mov ebx, 0xc000003e
jmp 0xc711bc
mov esi, dword [eax]
lea ecx, [ebp - 0x16cc]
push ecx
mov ecx, eax
mov dword [ebp - 0x1560], esi
call fcn.00a32533
mov ebx, eax
xor ecx, ecx
test ebx, ebx
js 0xc711bc
lea eax, [ebp - 0x16c4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc711ba
mov eax, dword [ebp - 0x155c]
sub eax, dword [ebp - 0x16c4]
cmp eax, esi
jae 0xc70e2f
mov ebx, 0xc000003e
jmp 0xc711ba
mov eax, dword [ebp - 0x16cc]
lea ecx, [ebp - 0x16cc]
push ecx
mov edx, esi
mov dword [ebp - 0x1590], eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc711ba
mov ecx, dword [ebp - 0x16c4]
lea eax, [ebp - 0x16c4]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc711ba
mov eax, dword [ebp - 0x155c]
sub eax, dword [ebp - 0x16c4]
push 4
pop edx
cmp eax, edx
jb 0xc70e25
mov ecx, dword [ebp - 0x16cc]
lea eax, [ebp - 0x16cc]
push eax
mov esi, dword [ecx]
mov dword [ebp - 0x1554], esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc711ba
mov ecx, dword [ebp - 0x16c4]
lea eax, [ebp - 0x16c4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc711ba
mov eax, dword [ebp - 0x155c]
sub eax, dword [ebp - 0x16c4]
cmp eax, esi
jb 0xc70e25
mov eax, dword [ebp - 0x16cc]
lea ecx, [ebp - 0x16cc]
push ecx
mov edx, esi
mov dword [ebp - 0x156c], eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc711ba
mov ecx, dword [ebp - 0x16c4]
lea eax, [ebp - 0x16c4]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc711ba
mov eax, dword [ebp - 0x155c]
sub eax, dword [ebp - 0x16c4]
push 4
pop edx
cmp eax, edx
jb 0xc70e25
mov ecx, dword [ebp - 0x16cc]
mov eax, dword [ecx]
mov dword [ebp - 0x1564], eax
lea eax, [ebp - 0x16cc]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc711ba
mov ecx, dword [ebp - 0x16c4]
lea eax, [ebp - 0x16c4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc711ba
mov eax, dword [ebp - 0x155c]
sub eax, dword [ebp - 0x16c4]
mov ecx, dword [ebp - 0x1564]
cmp eax, ecx
jb 0xc70e25
lea eax, [ebp - 0x16c4]
mov edx, ecx
mov ecx, dword [ebp - 0x16c4]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc711ba
mov edx, dword [ebp - 0x155c]
mov eax, edx
sub eax, dword [ebp - 0x16c4]
jne 0xc70e25
mov ebx, dword [ebp - 0x1560]
mov ecx, dword [ebp - 0x1564]
add ecx, 0xc
lea eax, [esi + ebx]
add eax, ecx
cmp eax, edx
jne 0xc70e25
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xc71008
mov ebx, 0xc0000017
jmp 0xc71145
cmp dword [ebp - 0x1590], edi
je 0xc71049
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc71032
mov ebx, 0xc0000017
xor eax, eax
jmp 0xc710de
mov dword [esi + 4], eax
push ebx
push dword [ebp - 0x1590]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc71050
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
cmp dword [ebp - 0x156c], edi
je 0xc7108c
mov ebx, dword [ebp - 0x1554]
push ebx
push 8
mov dword [esi + 8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc71026
mov dword [esi + 0xc], eax
push ebx
push dword [ebp - 0x156c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc71092
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
cmp dword [ebp - 0x16cc], edi
je 0xc710d2
mov ebx, dword [ebp - 0x1564]
push ebx
push 8
mov dword [esi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc71026
mov dword [esi + 0x14], eax
push ebx
push dword [ebp - 0x16cc]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xc710d8
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov edi, esi
mov ebx, eax
mov esi, eax
test esi, esi
je 0xc71145
cmp dword [esi + 4], 0
je 0xc710fe
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xc7111a
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xc71136
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test ebx, ebx
js 0xc71153
mov dword [ebp - 0x1588], edi
mov edi, ecx
test edi, edi
je 0xc711bc
cmp dword [edi + 4], 0
je 0xc71173
push dword [edi + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 4], ecx
cmp dword [edi + 0xc], 0
je 0xc7118f
push dword [edi + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0xc], ecx
cmp dword [edi + 0x14], 0
je 0xc711ab
push dword [edi + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0x14], ecx
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov edi, dword [ebp - 0x1588]
or ebx, 0x10000000
mov dword [ebp - 0x1590], ebx
jl 0xc71a4f
mov dword [ebp - 0x1590], ecx
mov esi, ecx
mov dword [ebp - 0x1560], esi
test edi, edi
jne 0xc711f6
mov ebx, 0xd000000d
mov dword [ebp - 0x1590], ebx
jmp 0xc71a4f
mov ebx, dword [edi + 4]
mov dword [ebp - 0x1554], ebx
test ebx, ebx
je 0xc711e6
mov edi, dword [edi]
test edi, edi
jne 0xc71213
mov ebx, 0xd000000d
jmp 0xc71a43
add edi, 0xfffffff8
mov dword [ebp - 0x156c], ecx
push edi
push ecx
mov dword [ebp - 0x1564], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x155c], eax
test eax, eax
je 0xc7180b
xor ecx, ecx
mov dword [ebp - 0x700], 0xab69605e
mov esi, edi
mov dword [ebp - 0x6fc], 0x7f1137f
mov dword [ebp - 0x157c], ebx
mov dl, cl
mov dword [ebp - 0x158c], eax
mov dword [ebp - 0x15b8], ecx
and esi, 7
je 0xc71397
mov dword [ebp - 0x15ac], ecx
mov eax, ecx
mov dword [ebp - 0x159c], eax
test esi, esi
je 0xc712dd
mov edi, dword [ebp - 0x157c]
push 0x38
pop ebx
movzx eax, byte [edi]
inc edi
cmp ecx, 4
jge 0xc712a5
lea ecx, [ebx - 0x20]
shl eax, cl
or dword [ebp - 0x15b8], eax
jmp 0xc712af
mov ecx, ebx
shl eax, cl
or dword [ebp - 0x159c], eax
mov ecx, dword [ebp - 0x15ac]
sub ebx, 8
inc ecx
mov dword [ebp - 0x15ac], ecx
cmp ecx, esi
jl 0xc7128f
mov eax, edi
mov dword [ebp - 0x157c], edi
mov edi, dword [ebp - 0x1564]
mov dword [ebp - 0x157c], eax
mov eax, dword [ebp - 0x159c]
mov ebx, dword [ebp - 0x15b8]
xor eax, 0x699a899c
xor ebx, 0x92f65a5
mov dword [ebp - 0x15c4], eax
xor ecx, ecx
mov dword [ebp - 0x15ac], ebx
mov dword [ebp - 0x15bc], ebx
mov dword [ebp - 0x15cc], eax
test esi, esi
je 0xc71365
mov edi, dword [ebp - 0x158c]
push 4
pop eax
lea ebx, [edi + 1]
mov dword [ebp - 0x158c], ebx
cmp ecx, eax
jge 0xc71331
rol dword [ebp - 0x15bc], 8
mov ebx, dword [ebp - 0x15bc]
jmp 0xc7133e
rol dword [ebp - 0x15cc], 8
mov ebx, dword [ebp - 0x15cc]
mov byte [edi], bl
inc ecx
mov ebx, dword [ebp - 0x158c]
mov edi, ebx
cmp ecx, esi
jl 0xc71315
mov eax, dword [ebp - 0x15c4]
mov edi, dword [ebp - 0x1564]
mov dword [ebp - 0x158c], ebx
mov ebx, dword [ebp - 0x15ac]
push 4
pop ecx
cmp esi, ecx
jbe 0xc71380
push 8
pop ecx
sub ecx, esi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0x15c4], eax
jmp 0xc713a6
xor eax, eax
mov dword [ebp - 0x15c4], eax
cmp esi, ecx
jae 0xc713a6
sub ecx, esi
shl ecx, 3
shr ebx, cl
shl ebx, cl
jmp 0xc713a6
or dword [ebp - 0x159c], 0xffffffff
mov ebx, ecx
mov dword [ebp - 0x15c4], ecx
mov eax, edi
shr eax, 3
mov dword [ebp - 0x15ac], eax
test eax, eax
je 0xc71793
movzx ecx, word [ebp - 0x6fa]
mov eax, 0x7f1137f
movzx esi, word [ebp - 0x6fe]
mov edi, 0xab69605e
movzx eax, ax
xor edi, 0x7f1137f
mov dword [ebp - 0x1604], ecx
mov ecx, 0xab69605e
mov dword [ebp - 0x15cc], eax
movzx eax, cx
mov ecx, dword [ebp - 0x15c4]
mov dword [ebp - 0x1690], eax
mov eax, dword [ebp - 0x158c]
mov dword [ebp - 0x1620], esi
add eax, 7
mov esi, dword [ebp - 0x157c]
add esi, 2
mov dword [ebp - 0x15bc], edi
mov dword [ebp - 0x158c], eax
mov dword [ebp - 0x157c], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0x157c]
xor ebx, edi
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0x157c]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0x157c]
shl esi, 8
add dword [ebp - 0x157c], 8
movzx eax, byte [eax + 5]
or esi, eax
mov eax, 0x7f1137f
xor ecx, esi
xor eax, 0xab69605e
xor eax, ecx
xor eax, ebx
mov ecx, eax
mov dword [ebp - 0x15c4], eax
sub ecx, 0xab69605e
rol eax, 0xa
rol ecx, 5
imul ecx, dword [ebp - 0x15cc]
add ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ecx + ebx]
ror ecx, 9
imul ecx, dword [ebp - 0x1620]
sub ecx, eax
mov eax, dword [ebp - 0x15c4]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x15c4], eax
sub ecx, dword [ebp - 0x15cc]
imul ecx, dword [ebp - 0x1690]
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0x1620]
xor ecx, ebx
mov eax, ebx
rol ecx, 6
imul ecx, dword [ebp - 0x1604]
rol eax, 2
sub ecx, eax
mov eax, dword [ebp - 0x15c4]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0x15c4], eax
xor ecx, 0xab69605e
mov eax, 0x7f1137f
sub eax, ecx
xor ebx, eax
mov eax, dword [ebp - 0x15cc]
xor eax, ebx
mov ecx, ebx
imul eax, dword [ebp - 0x1620]
ror ecx, 6
xor ecx, eax
mov eax, dword [ebp - 0x15c4]
xor eax, ecx
mov ecx, 0x7f1137f
add ecx, eax
mov dword [ebp - 0x15c4], eax
ror ecx, 0xf
imul ecx, dword [ebp - 0x1690]
rol eax, 2
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0x1604]
sub ecx, eax
mov eax, dword [ebp - 0x15c4]
xor eax, ecx
mov ecx, 0xab69605e
xor ecx, eax
mov dword [ebp - 0x15c4], eax
ror ecx, 0xc
imul ecx, dword [ebp - 0x15cc]
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0x1604]
xor ecx, ebx
mov eax, ebx
imul ecx, dword [ebp - 0x1620]
shr eax, 0xa
xor ecx, eax
mov eax, dword [ebp - 0x15c4]
xor eax, ecx
mov ecx, dword [ebp - 0x1604]
mov dword [ebp - 0x15c4], eax
not eax
ror eax, 5
add eax, dword [ebp - 0x1690]
imul eax, ecx
xor ebx, eax
mov eax, ebx
sub eax, ecx
xor eax, 0xab69605e
xor dword [ebp - 0x15c4], eax
mov eax, dword [ebp - 0x15c4]
xor ecx, eax
rol ecx, 2
imul ecx, dword [ebp - 0x15cc]
shr eax, 2
add ecx, eax
xor ebx, ecx
mov eax, ebx
rol eax, 7
lea ecx, [ebx - 0x7f1137f]
ror ecx, 6
imul ecx, dword [ebp - 0x1620]
add ecx, eax
mov eax, dword [ebp - 0x15c4]
xor eax, ecx
mov dword [ebp - 0x15c4], eax
mov ecx, eax
mov eax, dword [ebp - 0x15cc]
xor eax, dword [ebp - 0x15c4]
imul eax, dword [ebp - 0x1690]
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0x1620]
xor ecx, ebx
mov eax, ebx
rol ecx, 5
imul ecx, dword [ebp - 0x1604]
rol eax, 7
add ecx, eax
mov eax, dword [ebp - 0x15bc]
xor dword [ebp - 0x15c4], ecx
mov ecx, dword [ebp - 0x15c4]
xor eax, ecx
xor ebx, eax
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0x1620]
imul eax, dword [ebp - 0x15cc]
xor ecx, eax
mov dword [ebp - 0x15c4], ecx
sub ecx, 0x7f1137f
mov eax, dword [ebp - 0x15c4]
ror ecx, 1
imul ecx, dword [ebp - 0x1690]
ror eax, 6
sub ecx, eax
xor ebx, ecx
mov ecx, 0xab69605e
mov eax, ebx
rol eax, 0xe
lea ecx, [ecx + ebx]
rol ecx, 3
imul ecx, dword [ebp - 0x1604]
add ecx, eax
mov eax, dword [ebp - 0x15c4]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0x15c4], eax
rol ecx, 0xf
imul ecx, dword [ebp - 0x15cc]
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0x1690]
xor ecx, ebx
mov eax, ebx
imul ecx, dword [ebp - 0x1620]
shr eax, 3
xor ecx, eax
mov eax, dword [ebp - 0x15c4]
xor eax, ecx
mov ecx, 0x7f1137f
xor ecx, eax
mov dword [ebp - 0x15c4], eax
rol ecx, 4
imul ecx, dword [ebp - 0x1690]
rol eax, 2
xor ecx, eax
mov eax, dword [ebp - 0x158c]
xor ecx, dword [ebp - 0x15b8]
xor ebx, ecx
mov dword [ebp - 0x15b8], edi
mov ecx, dword [ebp - 0x15c4]
xor ecx, dword [ebp - 0x159c]
mov byte [eax - 4], bl
mov byte [eax], cl
ror ebx, 8
mov byte [eax - 5], bl
ror ecx, 8
mov byte [eax - 1], cl
ror ebx, 8
mov byte [eax - 6], bl
ror ecx, 8
mov byte [eax - 2], cl
ror ebx, 8
ror ecx, 8
mov byte [eax - 7], bl
mov byte [eax - 3], cl
add eax, 8
ror ebx, 8
ror ecx, 8
sub dword [ebp - 0x15ac], 1
mov dword [ebp - 0x159c], esi
mov esi, dword [ebp - 0x157c]
mov dword [ebp - 0x158c], eax
jne 0xc71424
mov edi, dword [ebp - 0x1564]
mov ecx, dword [ebp - 0x155c]
xor eax, eax
test edi, edi
je 0xc717a7
xor dl, byte [eax + ecx]
inc eax
cmp eax, edi
jb 0xc7179f
mov esi, dword [ebp - 0x1554]
movzx eax, dl
cdq
cmp eax, dword [edi + esi]
jne 0xc717ca
cmp edx, dword [edi + esi + 4]
jne 0xc717ca
mov ebx, dword [ebp - 0x156c]
xor eax, eax
mov esi, ecx
mov ecx, eax
jmp 0xc717dd
mov esi, dword [ebp - 0x1560]
mov ebx, 0xc004d501
mov edi, dword [ebp - 0x1590]
xor eax, eax
test ecx, ecx
je 0xc717f0
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc7180b
xor eax, eax
mov dword [ebp - 0x1580], esi
mov esi, eax
mov dword [ebp - 0x1594], edi
mov ebx, 0x10000000
jmp 0xc71818
mov edi, dword [ebp - 0x1594]
mov ebx, 0xd0000001
xor eax, eax
mov dword [ebp - 0x1590], ebx
test esi, esi
je 0xc71831
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc71a49
mov ecx, dword [ebp - 0x1580]
xor eax, eax
push 4
pop esi
mov dword [ebp - 0x16e0], eax
mov dword [ebp - 0x16e4], ecx
cmp edi, esi
jb 0xc71a38
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0x1560], eax
lea eax, [ebp - 0x16e4]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc71a3d
lea eax, [ebp - 0x16e0]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc71a3d
mov eax, edi
sub eax, dword [ebp - 0x16e0]
cmp eax, esi
jb 0xc71a38
mov ecx, dword [ebp - 0x16e4]
lea eax, [ebp - 0x16e4]
push eax
mov edx, esi
mov edi, dword [ecx]
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc71a3d
mov ecx, dword [ebp - 0x16e0]
lea eax, [ebp - 0x16e0]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc71a3d
mov eax, dword [ebp - 0x1594]
mov ecx, dword [ebp - 0x16e0]
sub eax, ecx
cmp eax, edi
jb 0xc71a38
lea eax, [ebp - 0x16e0]
mov edx, edi
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc71a3d
mov esi, dword [ebp - 0x16e4]
mov edx, dword [ebp - 0x1594]
mov ebx, dword [ebp - 0x1580]
lea ecx, [edi + esi]
lea eax, [ebx + edx]
cmp eax, ecx
jb 0xc71a38
mov eax, ebx
sub eax, edi
sub eax, esi
add eax, edx
cmp eax, 8
jae 0xc71a38
xor ecx, ecx
mov dword [ebp - 0x1554], ecx
mov eax, ecx
mov dword [ebp - 0x1590], eax
mov ebx, ecx
test esi, esi
je 0xc719c1
lea eax, [ebp - 0x1664]
mov edx, edi
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xc71a3d
mov ecx, dword [ebp - 0x1664]
cmp esi, ecx
jae 0xc719b3
mov edx, dword [ebp - 0x1554]
lea eax, [esi + 4]
cmp eax, esi
jb 0xc719f4
cmp eax, ecx
ja 0xc719ed
mov eax, dword [esi]
push 4
add eax, 4
pop ebx
cmp eax, ebx
jb 0xc719e6
add eax, esi
cmp eax, esi
jb 0xc719f4
mov esi, eax
xor eax, eax
mov ebx, eax
cmp esi, ecx
ja 0xc719ed
inc edx
mov dword [ebp - 0x1554], edx
cmp esi, ecx
jb 0xc7197f
cmp esi, ecx
jne 0xc719ed
mov esi, dword [ebp - 0x16e4]
mov eax, dword [ebp - 0x1590]
test edi, edi
je 0xc719ff
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1590], eax
test eax, eax
jne 0xc719fb
mov ebx, 0xc0000017
jmp 0xc71a26
mov ebx, 0xc0000095
jmp 0xc71a26
mov ebx, 0xc000000d
jmp 0xc71a3d
mov ebx, 0xc0000095
jmp 0xc71a3d
xor ecx, ecx
mov ebx, ecx
test esi, esi
je 0xc71a14
push edi
push esi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0x1590]
add esp, 0xc
mov dword [ebp - 0x1ad4], eax
mov eax, dword [ebp - 0x1554]
mov dword [ebp - 0x1adc], eax
test ebx, ebx
js 0xc71a3d
mov eax, dword [ebp - 0x1560]
cmp eax, dword [ebp - 0x1adc]
je 0xc71a3d
mov ebx, 0xc000003e
or ebx, 0x10000000
mov dword [ebp - 0x1590], ebx
mov edi, dword [ebp - 0x1588]
mov eax, dword [ebp - 0x1574]
test eax, eax
je 0xc71a6a
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0x1568]
test esi, esi
je 0xc71ad8
xor eax, eax
cmp dword [esi + 4], eax
je 0xc71a91
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xc71aad
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xc71ac9
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1584]
test eax, eax
je 0xc71af3
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1570]
test eax, eax
je 0xc71b0e
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xc71b76
xor eax, eax
cmp dword [edi + 4], eax
je 0xc71b2f
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc71b4b
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc71b67
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1580]
test eax, eax
je 0xc71b91
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc72127
cmp dword [ebp - 0x1adc], 1
jb 0xc7211c
cmp dword [ebp - 0x1ad4], 0
jne 0xc71c3a
mov ebx, 0xc000000d
mov dword [ebp - 0x1590], ebx
mov eax, dword [ebp - 0x15a4]
push 4
pop edx
test ebx, ebx
js 0xc72127
cmp eax, 0xd0000023
jne 0xc71be1
mov eax, 0x8007007a
mov dword [ebp - 0x15a4], eax
cmp eax, 0x8007007a
je 0xc71bf8
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test eax, eax
js 0xc72127
cmp dword [ebp - 0x1adc], 6
jne 0xc7211c
cmp dword [ebp - 0x1ad4], 0
jne 0xc71cb4
mov edx, dword [ebp - 0x19ac]
mov ebx, 0xc000000d
mov ecx, dword [ebp - 0x19b0]
mov dword [ebp - 0x1590], ebx
mov dword [ebp - 0x1560], edx
mov dword [ebp - 0x1574], ecx
jmp 0xc71d86
cmp dword [ebp - 0x1adc], 0
jbe 0xc71bb3
mov eax, dword [ebp - 0x1ad4]
lea ecx, [ebp - 0x1660]
push ecx
push 4
pop ecx
mov esi, dword [eax]
mov edx, ecx
mov ecx, eax
mov dword [ebp - 0x1660], eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc71c88
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1660]
mov dword [ebp - 0x1660], eax
jmp 0xc71c94
mov esi, dword [ebp - 0x1758]
mov eax, dword [ebp - 0x175c]
test ebx, ebx
js 0xc71bbe
push 4
pop edx
cmp esi, edx
jne 0xc6f82d
mov eax, dword [eax]
mov dword [ebp - 0x15a4], eax
jmp 0xc71bc7
mov ecx, dword [ebp - 0x1ad4]
xor eax, eax
mov dword [ebp - 0x15f8], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0x15f8]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc71d42
mov ecx, dword [ebp - 0x15f8]
lea eax, [ebp - 0x15f8]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc71d42
mov ecx, dword [ebp - 0x15f8]
inc esi
cmp esi, 1
jae 0xc71d0f
push 4
pop edx
jmp 0xc71cc4
mov esi, dword [ecx]
lea eax, [ebp - 0x15f8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc71d42
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x15f8]
mov dword [ebp - 0x15f8], eax
jmp 0xc71d4e
mov esi, dword [ebp - 0x1764]
mov eax, dword [ebp - 0x1768]
test ebx, ebx
js 0xc71d6e
cmp esi, 8
jne 0xc6f82d
mov ecx, dword [eax]
mov dword [ebp - 0x1574], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1560], ecx
jmp 0xc71d86
mov eax, dword [ebp - 0x19ac]
mov dword [ebp - 0x1560], eax
mov eax, dword [ebp - 0x19b0]
mov dword [ebp - 0x1574], eax
test ebx, ebx
js 0xc72127
cmp dword [ebp - 0x1ad4], 0
jne 0xc71dd0
mov ebx, 0xc000000d
mov dword [ebp - 0x1590], ebx
mov eax, dword [ebp - 0x176c]
push 4
pop edx
mov dword [ebp - 0x1554], eax
test ebx, ebx
js 0xc72127
cmp dword [ebp - 0x1ad4], 0
jne 0xc71e84
mov ebx, 0xc000000d
jmp 0xc72121
mov ecx, dword [ebp - 0x1ad4]
xor eax, eax
mov dword [ebp - 0x15d8], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0x15d8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc71e5e
mov ecx, dword [ebp - 0x15d8]
lea eax, [ebp - 0x15d8]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc71e5e
mov ecx, dword [ebp - 0x15d8]
inc esi
cmp esi, 2
jb 0xc71de0
mov esi, dword [ecx]
lea eax, [ebp - 0x15d8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc71e5e
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x15d8]
mov dword [ebp - 0x15d8], eax
jmp 0xc71e6a
mov esi, dword [ebp - 0x1774]
mov eax, dword [ebp - 0x1778]
test ebx, ebx
js 0xc71da2
push 4
pop edx
cmp esi, edx
jne 0xc6f82d
mov eax, dword [eax]
jmp 0xc71dab
mov ecx, dword [ebp - 0x1ad4]
xor eax, eax
mov dword [ebp - 0x15d4], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0x15d4]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc71f18
mov ecx, dword [ebp - 0x15d4]
lea eax, [ebp - 0x15d4]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc71f18
mov ecx, dword [ebp - 0x15d4]
inc esi
cmp esi, 3
jae 0xc71edf
push 4
pop edx
jmp 0xc71e94
mov edi, dword [ecx]
lea eax, [ebp - 0x15d4]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0x156c], edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc71f18
mov esi, edi
neg esi
sbb esi, esi
and esi, dword [ebp - 0x15d4]
mov dword [ebp - 0x15d4], esi
jmp 0xc71f2a
mov eax, dword [ebp - 0x1780]
mov esi, dword [ebp - 0x1784]
mov dword [ebp - 0x156c], eax
test ebx, ebx
js 0xc72127
mov ecx, dword [ebp - 0x1ad4]
xor ebx, ebx
mov edx, ebx
mov edi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jae 0xc71f4d
mov ebx, 0xc0000095
or eax, 0xffffffff
mov dword [ebp - 0x1590], ebx
mov dword [ebp - 0x1630], eax
test ebx, ebx
js 0xc71fc1
lea ecx, [edi + eax]
mov edi, ecx
cmp ecx, eax
jae 0xc71f69
or ecx, 0xffffffff
cmp edi, eax
mov dword [ebp - 0x1630], ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0x1590], ebx
cmp edi, eax
jb 0xc71fc1
push 4
pop eax
inc edx
push 0
pop ebx
cmp edx, eax
jb 0xc71f3c
mov edi, dword [ecx]
lea eax, [ebp - 0x1630]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc71fc1
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1630]
mov dword [ebp - 0x1630], eax
jmp 0xc71fcd
mov edi, dword [ebp - 0x178c]
mov eax, dword [ebp - 0x1790]
test ebx, ebx
js 0xc71fe0
push 4
pop ecx
cmp edi, ecx
jne 0xc6f82d
mov eax, dword [eax]
jmp 0xc71fe6
mov eax, dword [ebp - 0x1794]
mov dword [ebp - 0x1568], eax
test ebx, ebx
js 0xc72127
mov ecx, dword [ebp - 0x1ad4]
xor ebx, ebx
mov edx, ebx
mov edi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jae 0xc7200f
mov ebx, 0xc0000095
or eax, 0xffffffff
mov dword [ebp - 0x1590], ebx
mov dword [ebp - 0x1640], eax
test ebx, ebx
js 0xc72081
lea ecx, [edi + eax]
mov edi, ecx
cmp ecx, eax
jae 0xc7202b
or ecx, 0xffffffff
cmp edi, eax
mov dword [ebp - 0x1640], ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0x1590], ebx
cmp edi, eax
jb 0xc72081
inc edx
push 0
pop ebx
cmp edx, 5
jb 0xc71ffe
mov edi, dword [ecx]
lea eax, [ebp - 0x1640]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0x1590], ebx
test ebx, ebx
js 0xc72081
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1640]
mov dword [ebp - 0x1640], eax
jmp 0xc7208d
mov edi, dword [ebp - 0x179c]
mov eax, dword [ebp - 0x17a0]
push 4
pop edx
test ebx, ebx
js 0xc720a0
cmp edi, edx
jne 0xc6f82d
mov ecx, dword [eax]
jmp 0xc720a6
mov ecx, dword [ebp - 0x15a8]
test ebx, ebx
js 0xc72127
mov eax, dword [ebp - 0x1578]
cmp eax, dword [ebp - 0x1574]
jne 0xc7211c
mov eax, dword [ebp - 0x15c8]
cmp eax, dword [ebp - 0x1560]
jne 0xc7211c
mov dword [ebp - 0x15a0], ecx
cmp dword [ebp - 0x1568], edx
jbe 0xc720e7
mov ecx, dword [ebp - 0x1554]
mov ebx, 0x8007007a
mov dword [ebp - 0x15c0], ecx
jmp 0xc72121
mov eax, dword [ebp - 0x156c]
cmp eax, edx
ja 0xc720d4
push eax
push esi
mov esi, dword [ebp - 0x15b0]
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0x1554]
add esp, 0xc
mov dword [ebp - 0x15c0], eax
mov eax, dword [ebp - 0x15a4]
test eax, eax
je 0xc72127
mov ebx, eax
jmp 0xc72121
mov ebx, 0xc004d501
mov dword [ebp - 0x1590], ebx
mov edi, dword [ebp - 0x1598]
mov eax, dword [ebp - 0x1558]
xor ecx, ecx
mov dword [ebp - 0x1acc], ecx
mov dword [ebp - 0x1ad0], ecx
test eax, eax
je 0xc7215c
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0x1ac8], ecx
mov eax, dword [ebp - 0x1ad4]
mov dword [ebp - 0x1ad8], ecx
mov dword [ebp - 0x1adc], ecx
test eax, eax
je 0xc72189
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0x1ad4], ecx
test edi, edi
je 0xc7219c
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x15b4]
test eax, eax
je 0xc721b7
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc6f34a
mov eax, dword [ebp - 0x15a0]
test eax, eax
je 0xc78b6f
mov dword [0xc95878], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x380]
push eax
push 0x9d0000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0xc76a90
cmp eax, esi
jne 0xc72205
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0xc76a90
mov esi, dword [0xc9307c]
xor ebx, ebx
push 0x403
push ebx
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x15a0], eax
test eax, eax
jne 0xc72233
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc76a92
mov esi, dword [0xc9304c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [0xc95870], eax
lea edi, [ebp - 0x724]
mov eax, dword [0xc95878]
mov dword [ebp - 0x1598], eax
xor eax, eax
stosd dword es:[edi], eax
push 0x2c
push ebx
mov dword [0xc95874], edx
stosd dword es:[edi], eax
mov dword [ebp - 0x19b8], ebx
mov dword [ebp - 0x19b4], ebx
mov dword [ebp - 0x15b4], ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x968]
push eax
mov dword [ebp - 0x15a8], ebx
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x15a4], ebx
mov edx, 0xc96238
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc72299
mov eax, dword [0xc95890]
test eax, eax
jne 0xc728d4
push 0x338
mov esi, ebx
mov dword [ebp - 0x1558], ebx
push ebx
mov dword [ebp - 0x1560], ebx
mov dword [ebp - 0x1574], esi
mov dword [ebp - 0x1578], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x15c8], eax
test eax, eax
je 0xc728c6
or dword [ebp - 0x156c], 0xffffffff
mov edi, 0x9fbcf2
add eax, 7
mov dword [ebp - 0x708], 0xab69605e
mov cl, bl
mov dword [ebp - 0x704], 0x7f1137f
mov dword [ebp - 0x1554], ebx
mov edx, ebx
mov dword [ebp - 0x1568], eax
mov dword [ebp - 0x1584], edi
mov dword [ebp - 0x1564], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0x1584]
xor edx, ebx
mov dword [ebp - 0x1570], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0x1584]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0x1584]
shl edi, 8
add dword [ebp - 0x1584], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
mov dword [ebp - 0x155c], esi
mov esi, edx
xor esi, dword [ebp - 0x155c]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x1570]
xor eax, edx
mov dword [ebp - 0x1570], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x1570]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x1570]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x1570], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x1570]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x1570]
xor edx, eax
mov dword [ebp - 0x1570], edx
mov eax, dword [ebp - 0x1570]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x1570]
xor eax, edx
mov dword [ebp - 0x1570], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x1570]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x1570]
xor eax, edx
mov dword [ebp - 0x1570], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x1570]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0x1570]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0x155c], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x155c]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x155c]
xor eax, edx
mov dword [ebp - 0x155c], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x155c], edx
mov edx, dword [ebp - 0x155c]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x155c], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x155c]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x155c]
xor eax, edx
mov dword [ebp - 0x155c], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x155c]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x155c]
xor eax, edx
mov dword [ebp - 0x155c], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x155c]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x155c]
xor edx, dword [ebp - 0x1554]
xor eax, dword [ebp - 0x156c]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x1570], esi
mov esi, dword [ebp - 0x1568]
mov dword [ebp - 0x156c], edi
mov edi, dword [ebp - 0x1584]
mov dword [ebp - 0x1554], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x1564], 1
mov dword [ebp - 0x1568], esi
mov esi, eax
mov dword [ebp - 0x155c], eax
jne 0xc72331
mov esi, dword [ebp - 0x15c8]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc726b2
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc726e4
cmp edx, dword [0x9fc02c]
jne 0xc726e4
mov edi, esi
xor eax, eax
mov dword [ebp - 0x1574], edi
mov esi, eax
mov ebx, 0x337
jmp 0xc726f9
mov edi, dword [ebp - 0x1574]
or ebx, 0xffffffff
mov dword [ebp - 0x1578], 0xc004d501
xor eax, eax
test esi, esi
je 0xc7270c
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x1578], 0
jl 0xc728c0
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xc960a0
push eax
push ebx
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xc72856
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1740]
jne 0xc72743
sub ecx, ebx
xor eax, eax
sar ecx, 1
push edi
push edx
push eax
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc728b9
xor eax, eax
mov edx, 0x5a4d
mov ecx, eax
mov eax, dword [edi]
mov dword [ebp - 0x1560], ecx
cmp word [eax], dx
je 0xc72792
mov ecx, 0xc000007b
mov dword [ebp - 0x1560], ecx
jmp 0xc727dc
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc72785
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc72785
cmp dword [edx], 0x4550
jne 0xc72785
movzx eax, word [edx + 0x18]
mov ebx, 0x10b
cmp ax, bx
je 0xc727ca
mov ebx, 0x20b
cmp ax, bx
je 0xc727ca
mov ecx, 0xc000000d
jmp 0xc7278a
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0x1578], eax
xor edx, edx
mov ebx, edx
test eax, eax
je 0xc7284a
mov edx, esi
mov dword [ebp - 0x15c8], esi
lea eax, [edx + 1]
mov dword [ebp - 0x1554], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc72802
sub edx, dword [ebp - 0x1554]
inc esi
add esi, edx
test ecx, ecx
js 0xc7283b
push dword [ebp - 0x15c8]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc72856
mov ecx, dword [ebp - 0x1558]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x1560]
inc dword [ebp - 0x1558]
inc ebx
cmp ebx, dword [ebp - 0x1578]
jb 0xc727f1
add edi, 0x10
cmp byte [esi], 0
jne 0xc7273c
mov ebx, dword [ebp - 0x1560]
mov esi, dword [ebp - 0x1574]
test esi, esi
je 0xc72877
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc728cd
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc72890
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc7287f
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc728da
mov ebx, 0xc000007a
jmp 0xc7285c
mov esi, dword [ebp - 0x1574]
mov ebx, 0xc000007a
jmp 0xc72862
mov eax, dword [0xc95890]
xor ebx, ebx
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edx, 0xc96238
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0x1558], ebx
lea edi, [ebp - 0x1b80]
mov dword [ebp - 0x1560], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x1574], ebx
mov dword [ebp - 0x1578], ebx
mov dword [ebp - 0x156c], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x1568], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc72913
mov eax, dword [0xc95890]
test eax, eax
jne 0xc72f50
push 0x338
mov esi, ebx
mov dword [ebp - 0x15c8], ebx
push ebx
mov dword [ebp - 0x1554], ebx
mov dword [ebp - 0x1584], esi
mov dword [ebp - 0x1564], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x1570], eax
test eax, eax
je 0xc72f42
or dword [ebp - 0x1588], 0xffffffff
mov edi, 0x9fbcf2
add eax, 7
mov dword [ebp - 0x710], 0xab69605e
mov cl, bl
mov dword [ebp - 0x70c], 0x7f1137f
mov dword [ebp - 0x155c], ebx
mov edx, ebx
mov dword [ebp - 0x1580], eax
mov dword [ebp - 0x1594], edi
mov dword [ebp - 0x157c], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0x1594]
xor edx, ebx
mov dword [ebp - 0x158c], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0x1594]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0x1594]
shl edi, 8
add dword [ebp - 0x1594], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
mov dword [ebp - 0x159c], esi
mov esi, edx
xor esi, dword [ebp - 0x159c]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x158c]
xor eax, edx
mov dword [ebp - 0x158c], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x158c]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x158c]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x158c], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x158c]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x158c]
xor edx, eax
mov dword [ebp - 0x158c], edx
mov eax, dword [ebp - 0x158c]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x158c]
xor eax, edx
mov dword [ebp - 0x158c], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x158c]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x158c]
xor eax, edx
mov dword [ebp - 0x158c], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x158c]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0x158c]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0x159c], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x159c]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x159c]
xor eax, edx
mov dword [ebp - 0x159c], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x159c], edx
mov edx, dword [ebp - 0x159c]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x159c], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x159c]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x159c]
xor eax, edx
mov dword [ebp - 0x159c], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x159c]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x159c]
xor eax, edx
mov dword [ebp - 0x159c], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x159c]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x159c]
xor edx, dword [ebp - 0x155c]
xor eax, dword [ebp - 0x1588]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x158c], esi
mov esi, dword [ebp - 0x1580]
mov dword [ebp - 0x1588], edi
mov edi, dword [ebp - 0x1594]
mov dword [ebp - 0x155c], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x157c], 1
mov dword [ebp - 0x1580], esi
mov esi, eax
mov dword [ebp - 0x159c], eax
jne 0xc729ab
mov esi, dword [ebp - 0x1570]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc72d2c
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc72d5e
cmp edx, dword [0x9fc02c]
jne 0xc72d5e
mov ebx, esi
xor eax, eax
mov dword [ebp - 0x1584], ebx
mov esi, eax
mov edi, 0x337
jmp 0xc72d73
mov ebx, dword [ebp - 0x1584]
or edi, 0xffffffff
mov dword [ebp - 0x1564], 0xc004d501
xor eax, eax
test esi, esi
je 0xc72d86
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x1564], 0
jl 0xc72f3c
xor eax, eax
mov esi, ebx
push 0x40
push eax
push 0xc960a0
mov byte [edi + ebx], al
call fcn.00ab4bf6
add esp, 0xc
cmp byte [ebx], 0
je 0xc72ed2
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1740]
jne 0xc72dbf
sub ecx, ebx
xor eax, eax
sar ecx, 1
push edi
push edx
push eax
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc72f35
xor eax, eax
mov edx, 0x5a4d
mov ecx, eax
mov eax, dword [edi]
mov dword [ebp - 0x1554], ecx
cmp word [eax], dx
je 0xc72e0e
mov ecx, 0xc000007b
mov dword [ebp - 0x1554], ecx
jmp 0xc72e58
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc72e01
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc72e01
cmp dword [edx], 0x4550
jne 0xc72e01
movzx eax, word [edx + 0x18]
mov ebx, 0x10b
cmp ax, bx
je 0xc72e46
mov ebx, 0x20b
cmp ax, bx
je 0xc72e46
mov ecx, 0xc000000d
jmp 0xc72e06
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0x1564], eax
xor edx, edx
mov ebx, edx
test eax, eax
je 0xc72ec6
mov edx, esi
mov dword [ebp - 0x1570], esi
lea eax, [edx + 1]
mov dword [ebp - 0x155c], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc72e7e
sub edx, dword [ebp - 0x155c]
inc esi
add esi, edx
test ecx, ecx
js 0xc72eb7
push dword [ebp - 0x1570]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc72ed2
mov ecx, dword [ebp - 0x15c8]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x1554]
inc dword [ebp - 0x15c8]
inc ebx
cmp ebx, dword [ebp - 0x1564]
jb 0xc72e6d
add edi, 0x10
cmp byte [esi], 0
jne 0xc72db8
mov ebx, dword [ebp - 0x1554]
mov esi, dword [ebp - 0x1584]
test esi, esi
je 0xc72ef3
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc72f49
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc72f0c
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc72efb
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc72f56
mov ebx, 0xc000007a
jmp 0xc72ed8
mov esi, dword [ebp - 0x1584]
mov ebx, 0xc000007a
jmp 0xc72ede
mov eax, dword [0xc95890]
xor ebx, ebx
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
push 0x54
lea eax, [ebp - 0x1340]
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
mov esi, dword [0xc9307c]
lea edi, [ebp - 0x728]
add esp, 0xc
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
pop edx
push 0x403
push ebx
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x1598]
mov ecx, eax
and ecx, edx
mov dword [ebp - 0x1598], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
and ecx, edx
shr eax, 0xc
mov word [ebp - 0xa], cx
and eax, edx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0xc99200]
call esi
mov dword [ebp - 0x1584], eax
mov dword [ebp - 0x15c8], 0xffffff
test eax, eax
jne 0xc73001
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc72ff1
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc74483
mov ebx, 0x80004005
jmp 0xc74483
mov edi, dword [0xc93050]
mov eax, ebx
mov dword [ebp - 0x155c], eax
mov esi, ebx
lea eax, [ebp - 0x17a8]
mov dword [ebp - 0x1554], esi
push eax
push ebx
lea eax, [ebp - 0x15f4]
mov dword [ebp - 0x17a4], ebx
push eax
push 8
mov ecx, edi
mov dword [ebp - 0x1564], ebx
mov dword [ebp - 0x1570], ebx
mov dword [ebp - 0x17a8], ebx
call dword [0xc99200]
call edi
test eax, eax
jne 0xc73153
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc73069
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc732cd
mov ebx, 0x80004005
mov esi, dword [ebp - 0x1570]
mov edi, dword [ebp - 0x1574]
xor ecx, ecx
test esi, esi
je 0xc730f6
mov eax, ecx
mov dword [ebp - 0x1570], ecx
mov edx, dword [esi + eax*4]
test edx, edx
je 0xc730ea
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x155c], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1740]
jne 0xc730a0
sub ecx, dword [ebp - 0x155c]
xor eax, eax
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc730d5
mov byte [edx], al
inc edx
sub ecx, 1
jne 0xc730c4
mov edx, dword [ebp - 0x1570]
mov edx, dword [esi + edx*4]
push edx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x1570]
inc eax
mov dword [ebp - 0x1570], eax
cmp eax, 3
jb 0xc7308e
mov eax, dword [ebp - 0x17a4]
xor edx, edx
test eax, eax
je 0xc73114
mov ecx, dword [ebp - 0x1564]
test ecx, ecx
je 0xc73114
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0xc7310c
test esi, esi
je 0xc73127
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x17a4]
test eax, eax
je 0xc73a5d
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0x17a4], ecx
jmp 0xc73a5f
mov eax, dword [ebp - 0x17a8]
add eax, eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x1588], edi
test edi, edi
jne 0xc73180
mov ebx, 0x8007000e
jmp 0xc732b8
mov eax, dword [ebp - 0x15f4]
lea eax, [eax*4 + 4]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x1580], esi
test esi, esi
jne 0xc731b4
mov ebx, 0x8007000e
xor ecx, ecx
jmp 0xc7329f
mov ebx, dword [0xc93050]
lea eax, [ebp - 0x17a8]
push eax
push edi
lea eax, [ebp - 0x15f4]
mov ecx, ebx
push eax
push 8
call dword [0xc99200]
call ebx
test eax, eax
jne 0xc731f9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc731f0
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc731ad
mov ebx, 0x80004005
jmp 0xc731ad
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x1554], ecx
cmp dword [ebp - 0x15f4], ecx
jbe 0xc7327e
mov dword [ebp - 0x1594], edi
mov edi, esi
mov esi, dword [ebp - 0x1594]
mov ebx, dword [0xc93058]
push ecx
push esi
mov ecx, ebx
call dword [0xc99200]
call ebx
mov ecx, esi
mov dword [edi], eax
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc73234
sub ecx, edx
sar ecx, 1
push 4
pop eax
add edi, eax
mov eax, dword [ebp - 0x1554]
lea esi, [esi + ecx*2]
add esi, 2
inc eax
push 0
mov dword [ebp - 0x1554], eax
pop ecx
cmp eax, dword [ebp - 0x15f4]
jb 0xc73219
mov esi, dword [ebp - 0x1580]
mov dword [ebp - 0x1554], edi
mov edi, dword [ebp - 0x1588]
mov eax, dword [ebp - 0x1554]
mov ebx, dword [ebp - 0x155c]
mov dword [eax], 0x409
mov eax, dword [ebp - 0x15f4]
inc eax
mov dword [ebp - 0x1554], esi
mov esi, ecx
mov dword [ebp - 0x1588], eax
test esi, esi
je 0xc732b2
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0x1554]
test edi, edi
je 0xc732cd
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc73074
xor eax, eax
mov ebx, eax
mov ecx, eax
mov dword [ebp - 0x1580], ebx
cmp dword [ebp - 0x1588], eax
jbe 0xc73312
mov edx, dword [esi + ecx*4]
cmp edx, dword [eax*4 + 0xa192e8]
je 0xc73308
inc eax
cmp eax, 0x26
jb 0xc732ec
inc ecx
xor eax, eax
cmp ecx, dword [ebp - 0x1588]
jae 0xc73312
jmp 0xc732e9
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x1580], ebx
mov esi, dword [0xc93054]
mov ecx, esi
push eax
mov dword [ebp - 0x1588], eax
lea eax, [ebp - 0xc8]
push 0x55
push eax
push dword [ebx*4 + 0xa192e8]
call dword [0xc99200]
call esi
test eax, eax
je 0xc7337b
mov esi, dword [0xc93048]
lea eax, [ebp - 0x7f8]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xc8]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
test eax, eax
jle 0xc7337b
mov ebx, dword [ebp - 0x7ec]
shr ebx, 0x1b
and ebx, 1
mov dword [ebp - 0x1588], ebx
mov ebx, dword [ebp - 0x1580]
xor eax, eax
mov edx, 0x9fba10
mov esi, eax
mov ecx, edx
mov dword [ebp + esi*4 - 0x698], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1740]
jne 0xc73390
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0xc73384
imul ecx, ebx, 3
movzx eax, byte [ecx + 0xa00b58]
mov eax, dword [ebp + eax*4 - 0x698]
mov dword [ebp - 0x1578], eax
movzx eax, byte [ecx + 0xa00b59]
mov eax, dword [ebp + eax*4 - 0x698]
mov dword [ebp - 0x156c], eax
movzx eax, byte [ecx + 0xa00b5a]
mov eax, dword [ebp + eax*4 - 0x698]
mov dword [ebp - 0x1568], eax
xor ebx, ebx
push 0x1c90
mov eax, ebx
push ebx
mov dword [ebp - 0x155c], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x1594], ecx
test ecx, ecx
jne 0xc73421
mov ebx, 0x8007000e
jmp 0xc73074
or dword [ebp - 0x158c], 0xffffffff
mov al, bl
add ecx, 7
mov dword [ebp - 0x718], 0xab69605e
mov dword [ebp - 0x714], 0x7f1137f
mov edx, ebx
mov dword [ebp - 0x157c], ebx
mov esi, 0xa19392
mov dword [ebp - 0x159c], ebx
mov dword [ebp - 0x15b8], ecx
mov dword [ebp - 0x15ac], 0x392
movzx ebx, byte [esi - 2]
movzx ecx, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, ecx
shl edi, 8
movzx ecx, byte [esi]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 3]
or edi, ecx
xor edx, ebx
movzx ecx, byte [esi + 4]
shl edi, 8
or edi, ecx
mov dword [ebp - 0x15c4], edx
movzx ecx, byte [esi + 5]
add esi, 8
mov dword [ebp - 0x15bc], esi
shl edi, 8
or edi, ecx
mov esi, edi
xor esi, dword [ebp - 0x159c]
xor esi, edx
xor esi, 0xac987321
lea ecx, [esi + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, esi
rol ecx, 0xa
add edx, ecx
mov ecx, dword [ebp - 0x15c4]
xor ecx, edx
mov dword [ebp - 0x15c4], ecx
add ecx, 0x7f1137f
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0x15c4]
rol ecx, 2
sub edx, ecx
xor esi, edx
imul edx, esi, 0x605e
mov ecx, esi
shr ecx, 0xd
sub edx, ecx
mov ecx, dword [ebp - 0x15c4]
sub edx, 0x756c8a2
xor ecx, edx
mov dword [ebp - 0x15c4], ecx
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0x15c4]
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub ecx, edx
mov edx, dword [ebp - 0x15c4]
xor edx, ecx
mov dword [ebp - 0x15c4], edx
mov ecx, dword [ebp - 0x15c4]
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor esi, edx
lea ecx, [esi + 0x7f1137f]
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, esi
rol ecx, 2
add edx, ecx
mov ecx, dword [ebp - 0x15c4]
xor ecx, edx
mov dword [ebp - 0x15c4], ecx
add ecx, 0x54969fa2
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0x15c4]
rol ecx, 8
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69605e
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, esi
ror ecx, 0xa
xor edx, ecx
mov ecx, dword [ebp - 0x15c4]
xor ecx, edx
mov dword [ebp - 0x15c4], ecx
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0x15c4]
shr ecx, 0xa
xor edx, ecx
xor edx, esi
mov esi, dword [ebp - 0x15c4]
mov ecx, edx
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor esi, ecx
lea ecx, [esi - 0x7f1]
xor ecx, edx
xor ecx, 0xab69605e
mov dword [ebp - 0x159c], ecx
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0x159c]
shr ecx, 2
add edx, ecx
xor esi, edx
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, esi
rol ecx, 7
add edx, ecx
mov ecx, dword [ebp - 0x159c]
xor ecx, edx
mov dword [ebp - 0x159c], ecx
mov edx, ecx
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69
rol ecx, 5
imul edx, ecx, 0x7f1
mov ecx, esi
rol ecx, 7
add edx, ecx
xor dword [ebp - 0x159c], edx
mov edx, dword [ebp - 0x159c]
xor esi, edx
xor esi, 0xac987321
mov ecx, esi
ror ecx, 3
imul ecx, ecx, 0x137f
sub ecx, 0xd0dd417
xor edx, ecx
mov dword [ebp - 0x159c], edx
lea ecx, [edx - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0x159c]
ror ecx, 6
sub edx, ecx
xor esi, edx
lea ecx, [esi - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, esi
rol ecx, 0xe
add edx, ecx
mov ecx, dword [ebp - 0x159c]
xor ecx, edx
mov dword [ebp - 0x159c], ecx
add ecx, 0xab69605e
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0x159c]
ror ecx, 0xe
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, esi
shr ecx, 3
xor edx, ecx
mov ecx, dword [ebp - 0x159c]
xor ecx, edx
mov dword [ebp - 0x159c], ecx
xor ecx, 0x7f1137f
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0x159c]
rol ecx, 2
xor edx, ecx
mov ecx, dword [ebp - 0x159c]
xor edx, dword [ebp - 0x157c]
xor ecx, dword [ebp - 0x158c]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x15c4], esi
mov esi, dword [ebp - 0x15b8]
mov dword [ebp - 0x157c], ebx
mov dword [ebp - 0x158c], edi
mov byte [esi - 4], dl
mov byte [esi], cl
ror edx, 8
mov byte [esi - 5], dl
ror ecx, 8
mov byte [esi - 1], cl
ror edx, 8
mov byte [esi - 6], dl
ror ecx, 8
mov byte [esi - 2], cl
ror edx, 8
ror ecx, 8
mov byte [esi - 7], dl
mov byte [esi - 3], cl
add esi, 8
ror ecx, 8
ror edx, 8
sub dword [ebp - 0x15ac], 1
mov dword [ebp - 0x15b8], esi
mov esi, dword [ebp - 0x15bc]
mov dword [ebp - 0x159c], ecx
jne 0xc73464
xor ecx, ecx
mov esi, 0x1c90
mov edx, ecx
mov ecx, dword [ebp - 0x1594]
xor al, byte [ecx + edx]
inc edx
cmp edx, esi
jb 0xc737e3
movzx eax, al
cdq
cmp eax, dword [0xa1b020]
jne 0xc73817
cmp edx, dword [0xa1b024]
jne 0xc73817
mov ebx, dword [ebp - 0x155c]
xor edx, edx
mov dword [ebp - 0x17a4], ecx
mov ecx, edx
mov dword [ebp - 0x1564], esi
jmp 0xc73824
mov ebx, 0xc004d501
xor edx, edx
mov dword [ebp - 0x155c], ebx
test ecx, ecx
je 0xc73837
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc73074
mov edi, dword [ebp - 0x17a4]
xor eax, eax
mov ebx, dword [ebp - 0x1580]
mov esi, eax
mov edx, eax
cmp ebx, edx
jne 0xc7385c
mov dword [ebp + esi*4 - 0x5a0], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0x1570], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc73867
sub ecx, dword [ebp - 0x1570]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0xc73851
inc esi
push 0
pop eax
cmp esi, 6
jb 0xc7384f
push 0xc
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, dword [ebp - 0x155c]
mov esi, eax
test esi, esi
jne 0xc738ac
mov ebx, 0x8007000e
jmp 0xc7307a
xor eax, eax
mov edi, esi
mov edx, esi
mov dword [ebp - 0x155c], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov ecx, eax
mov eax, esi
sub eax, esi
mov dword [ebp - 0x1570], ecx
mov dword [ebp - 0x1580], eax
movzx edi, word [ebp + ecx*2 - 0xc]
xor eax, eax
cmp di, word [eax*2 + 0xa19380]
je 0xc738eb
inc eax
cmp eax, 6
jb 0xc738d6
jmp 0xc739d1
mov edi, dword [ebp + eax*4 - 0x5a0]
mov ecx, edi
mov edx, dword [0xc93060]
mov dword [ebp - 0x1594], edx
lea eax, [ecx + 1]
mov dword [ebp - 0x157c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc73909
sub ecx, dword [ebp - 0x157c]
xor eax, eax
push eax
push eax
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
xor eax, eax
push eax
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0x1594]
mov dword [ebp - 0x1594], eax
test eax, eax
je 0xc73a30
lea ecx, [eax + eax]
xor eax, eax
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0x155c]
mov edx, dword [ebp - 0x1580]
mov dword [edx + ecx], eax
mov eax, dword [ecx]
mov dword [ebp - 0x157c], eax
test eax, eax
je 0xc738a2
mov edx, dword [0xc93060]
mov ecx, edi
mov dword [ebp - 0x158c], edx
lea eax, [ecx + 1]
mov dword [ebp - 0x159c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc7398d
push dword [ebp - 0x1594]
sub ecx, dword [ebp - 0x159c]
push dword [ebp - 0x157c]
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
xor eax, eax
push eax
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0x158c]
test eax, eax
je 0xc73a09
mov ecx, dword [ebp - 0x1570]
mov edx, dword [ebp - 0x155c]
push 4
inc ecx
pop eax
add edx, eax
mov dword [ebp - 0x1570], ecx
mov dword [ebp - 0x155c], edx
cmp ecx, 3
jb 0xc738cf
mov eax, dword [ebp - 0x1588]
mov edi, esi
xor ecx, ecx
mov dword [ebp - 0x1574], edi
mov esi, ecx
mov dword [ebp - 0x1340], eax
jmp 0xc73082
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc73a20
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc7307a
mov ebx, 0x80004005
jmp 0xc7307a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc73a47
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
mov edi, dword [ebp - 0x1574]
js 0xc73080
mov ebx, 0x80004005
jmp 0xc73080
xor ecx, ecx
mov eax, dword [ebp - 0x1554]
test eax, eax
je 0xc73a78
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc7446a
mov eax, dword [edi]
xor ecx, ecx
mov esi, dword [0xc930b4]
mov ebx, ecx
mov dword [ebp - 0x1338], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x1334], eax
mov eax, dword [edi + 8]
mov edi, ecx
push ecx
mov dword [ebp - 0x1330], eax
lea eax, [ebp - 0x1ae8]
push eax
push ecx
mov dword [ebp - 0x1ae4], ecx
mov dword [ebp - 0x1ae0], ecx
mov ecx, esi
push 0x42
mov dword [ebp - 0x1ae8], 0xc
call dword [0xc99200]
call esi
test eax, eax
jne 0xc73af5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc73aec
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc73afe
mov ebx, 0x80004005
jmp 0xc73afe
mov edi, dword [ebp - 0x1ae4]
and edi, 1
mov dword [ebp - 0x133c], edi
test ebx, ebx
js 0xc7446a
mov eax, dword [ebp - 0x1598]
push 0x2a
pop ecx
mov dword [ebp - 0x1554], ecx
sub eax, 1
je 0xc73b49
sub eax, 1
je 0xc73b3d
sub eax, 1
jne 0xc73b59
mov ebx, 0xe1
mov dword [ebp - 0x1558], ebx
mov dword [ebp - 0x1560], ebx
jmp 0xc73b59
mov dword [ebp - 0x1558], 0xf
jmp 0xc73b4f
mov dword [ebp - 0x1558], ecx
mov dword [ebp - 0x1560], 0xb
push 0x60
pop edi
xor ebx, ebx
mov dword [ebp - 0x1564], edi
lea eax, [ebp - 0xd90]
lea esi, [edi + 0x7c]
push esi
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov word [ebp - 0xd4c], si
mov esi, dword [0xc93070]
lea eax, [ebp - 0xd90]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xc73c4f
movzx ebx, word [ebp - 0xcea]
mov eax, dword [ebp - 0xce4]
mov ecx, dword [ebp - 0xce0]
mov dword [ebp - 0x1564], ebx
mov dword [ebp - 0x1570], eax
mov dword [ebp - 0x1b78], eax
mov dword [ebp - 0x155c], ecx
mov dword [ebp - 0x1b74], ecx
cmp ebx, edi
jae 0xc73bdc
mov dword [ebp - 0x1564], edi
xor ebx, ebx
cmp dword [ebp - 0x1598], 1
mov edi, dword [ebp - 0x1578]
je 0xc73bf3
mov edi, dword [ebp - 0x1568]
push 0x5c
lea eax, [ebp - 0xb30]
push ebx
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0x1588], eax
test eax, eax
jne 0xc73c6c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc73c3f
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc73d0c
mov ebx, 0x80004005
jmp 0xc7446a
mov eax, dword [ebp - 0x1b74]
mov dword [ebp - 0x155c], eax
mov eax, dword [ebp - 0x1b78]
mov dword [ebp - 0x1570], eax
jmp 0xc73bde
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0x1564]
push dword [ebp - 0x1558]
call dword [0xc99200]
call esi
push edi
push 0x20
neg eax
mov dword [ebp - 0xb20], 0x190
pop edx
lea ecx, [ebp - 0xb14]
mov dword [ebp - 0xb30], eax
mov byte [ebp - 0xb16], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0xb30]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xc73ced
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc73ce4
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc73cf3
mov ebx, 0x80004005
jmp 0xc73cf3
mov dword [ebp - 0x132c], eax
push dword [ebp - 0x1588]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xc7446a
cmp dword [ebp - 0x1598], 1
je 0xc73d29
mov eax, dword [ebp - 0x1568]
mov dword [ebp - 0x1578], eax
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0xad0]
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov edi, eax
test edi, edi
jne 0xc73d80
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc73d75
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc73e20
invalid
invalid