Function at 0x100112c6
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd64
mov eax, dword [0x100cea68]
xor eax, esp
mov dword [esp + 0xd60], eax
push ebx
xor ebx, ebx
mov edx, 0x100d55d8
push esi
push edi
mov dword [esp + 0x15c], ebx
mov dword [esp + 0x138], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x130], ebx
mov dword [esp + 0x74], ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x1001130c
mov eax, dword [0x100d55d4]
mov esi, 0x7f1137f
mov dword [esp + 0xd0], 0x10006d7a
mov dword [esp + 0x98], 0x67
mov dword [esp + 0x54], 0x337
mov dword [esp + 0x104], 0x10b
mov dword [esp + 0xa0], 0x20b
push 0
pop ebx
test eax, eax
jne 0x1001192c
push 0x338
push ebx
mov dword [esp + 0x110], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x70], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [esp + 0x2c], edi
test edi, edi
je 0x100118cb
or dword [esp + 0x58], 0xffffffff
mov eax, ebx
mov dword [esp + 0x40], eax
mov cl, bl
mov dword [esp + 0xec], eax
mov eax, 0x7f1137f
mov edx, eax
mov dword [esp + 0x66c], esi
mov dword [esp + 0x20], 0x7f1137f
xor dword [esp + 0x20], 0xab69605e
mov dword [esp + 0x668], 0xab69605e
movzx esi, word [esp + 0x66a]
shr edx, 0x10
add edi, 7
movzx eax, ax
mov dword [esp + 0x1c], esi
mov esi, 0x10006d7a
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x100], ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x6c], edi
mov dword [esp + 0x78], 0x67
movzx edx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl edx, 8
or edx, eax
shl edi, 8
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
or edi, eax
mov dword [esp + 0x5c], edx
movzx eax, byte [esi + 4]
xor ebx, edx
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
add esi, 8
shl edi, 8
or edi, eax
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x20]
xor eax, edi
xor esi, eax
xor esi, ebx
mov eax, esi
rol eax, 0xa
lea edx, [esi + 0x54969fa2]
rol edx, 5
imul edx, dword [esp + 0x38]
add edx, eax
xor ebx, edx
mov edx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [esp + 0x1c]
sub edx, eax
xor esi, edx
mov eax, esi
sub eax, dword [esp + 0x38]
imul edx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, dword [esp + 0x1c]
xor edx, ebx
mov eax, ebx
rol edx, 6
imul edx, dword [esp + 0x28]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [esp + 0x38]
imul eax, dword [esp + 0x1c]
ror edx, 6
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
add eax, esi
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor ebx, edx
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
imul edx, dword [esp + 0x28]
mov eax, ebx
rol eax, 8
sub edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, dword [esp + 0x38]
xor edx, eax
xor ebx, edx
mov edx, dword [esp + 0x28]
xor edx, ebx
mov eax, ebx
imul edx, dword [esp + 0x1c]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [esp + 0x28]
xor ebx, eax
mov esi, ebx
sub esi, dword [esp + 0x28]
xor esi, edx
mov edx, dword [esp + 0x28]
xor esi, 0xab69605e
xor edx, esi
mov eax, esi
rol edx, 2
imul edx, dword [esp + 0x38]
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [esp + 0x1c]
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, dword [esp + 0x38]
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
xor ebx, edx
mov edx, dword [esp + 0x1c]
xor edx, ebx
mov dword [esp + 0x48], ebx
rol edx, 5
mov eax, ebx
imul edx, dword [esp + 0x28]
rol eax, 7
add edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov ebx, esi
xor ebx, dword [esp + 0x48]
xor ebx, dword [esp + 0x20]
mov eax, ebx
ror eax, 3
sub eax, dword [esp + 0x1c]
imul eax, dword [esp + 0x38]
xor esi, eax
mov eax, esi
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
lea edx, [ebx - 0x54969fa2]
rol edx, 3
mov eax, ebx
imul edx, dword [esp + 0x28]
rol eax, 0xe
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [esp + 0x38]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
shr eax, 3
xor edx, 0x605e
imul edx, dword [esp + 0x1c]
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
xor eax, esi
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [esp + 0x58]
rol eax, 2
mov dword [esp + 0xec], esi
mov esi, dword [esp + 0x24]
xor edx, eax
mov dword [esp + 0x58], edi
xor edx, dword [esp + 0x3c]
xor ebx, edx
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x100], ebx
mov byte [edx - 4], bl
mov al, byte [esp + 0xec]
ror dword [esp + 0x100], 8
mov byte [edx], al
mov al, byte [esp + 0x100]
ror dword [esp + 0xec], 8
mov byte [edx - 5], al
mov al, byte [esp + 0xec]
ror dword [esp + 0x100], 8
mov byte [edx - 1], al
mov al, byte [esp + 0x100]
ror dword [esp + 0xec], 8
mov byte [edx - 6], al
mov al, byte [esp + 0xec]
ror dword [esp + 0x100], 8
mov byte [edx - 2], al
ror dword [esp + 0xec], 8
mov al, byte [esp + 0x100]
mov byte [edx - 7], al
mov al, byte [esp + 0xec]
mov byte [edx - 3], al
add edx, 8
mov eax, dword [esp + 0xec]
mov ebx, dword [esp + 0x100]
ror eax, 8
ror ebx, 8
sub dword [esp + 0x78], 1
mov dword [esp + 0x40], eax
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x100], ebx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x6c], edx
jne 0x10011408
mov esi, dword [esp + 0x2c]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x10011733
movzx eax, cl
cdq
cmp eax, dword [0x100070b0]
jne 0x10011764
cmp edx, dword [0x100070b4]
jne 0x10011764
mov edi, esi
mov dword [esp + 0x40], 0x337
mov dword [esp + 0x34], edi
mov esi, ebx
jmp 0x10011773
or dword [esp + 0x40], 0xffffffff
mov edi, ebx
mov dword [esp + 0x68], 0xc004d501
test esi, esi
je 0x10011786
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x68], ebx
jl 0x100118cb
mov eax, dword [esp + 0x40]
mov esi, edi
push 0x40
push ebx
push 0x100d4fd0
mov byte [eax + edi], bl
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], bl
je 0x100118d2
mov edi, 0x100d4fd0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [esp + 0x48], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x100117c1
sub ecx, dword [esp + 0x48]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x100118cb
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [esp + 0x38], ecx
cmp word [eax], dx
je 0x10011803
mov ecx, 0xc000007b
mov dword [esp + 0x38], ecx
jmp 0x1001184d
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x100117f8
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x100117f8
cmp dword [edx], 0x4550
jne 0x100117f8
movzx eax, word [edx + 0x18]
cmp ax, word [esp + 0x104]
je 0x1001183b
cmp ax, word [esp + 0xa0]
je 0x1001183b
mov ecx, 0xc000000d
jmp 0x100117fd
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [esp + 0x24], eax
mov dword [esp + 0x40], ebx
test eax, eax
je 0x100118b6
mov edx, esi
mov dword [esp + 0x5c], esi
lea eax, [edx + 1]
mov dword [esp + 0x48], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x1001186c
sub edx, dword [esp + 0x48]
inc esi
add esi, edx
test ecx, ecx
js 0x100118a0
push dword [esp + 0x5c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100118c1
mov ecx, dword [esp + 0x108]
mov dword [ecx*4 + 0x100ce210], eax
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x40]
inc dword [esp + 0x108]
inc eax
mov dword [esp + 0x40], eax
cmp eax, dword [esp + 0x24]
jb 0x1001185f
add edi, 0x10
cmp byte [esi], bl
jne 0x100117b6
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
jmp 0x100118d4
mov esi, 0xc000007a
jmp 0x100118c5
mov esi, ebx
test edi, edi
je 0x100118e7
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x10011927
mov esi, ebx
mov eax, dword [esi + 0x100d4fd0]
test eax, eax
je 0x100118fe
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x100118ed
push 0x40
push ebx
push 0x100d4fd0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x100019e0
mov edi, 0x100ce210
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x10011932
mov eax, dword [0x100d55d4]
inc eax
mov dword [0x100d55d4], eax
xor eax, eax
mov ecx, 0x100d55d8
xchg dword [ecx], eax
mov eax, dword fs:[0x30]
mov edi, ebx
mov dword [esp + 0x144], ebx
mov dword [esp + 0x140], ebx
cmp dword [eax + 0x1d4], ebx
je 0x10011c11
mov esi, dword [0x100ce298]
mov ecx, esi
call dword [0x100d6738]
call esi
mov ecx, eax
mov dword [esp + 0x48], ecx
test ecx, ecx
jne 0x1001199e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x1001198e
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x10011c17
mov edi, 0x80004005
jmp 0x10011c17
mov dword [esp + 0x114], ebx
mov edi, ebx
mov eax, ebx
mov esi, ebx
lea edx, [esp + 0x174]
push edx
push eax
push esi
mov esi, dword [0x100ce2a8]
push 2
push ecx
mov ecx, esi
call dword [0x100d6738]
call esi
test eax, eax
jne 0x10011a3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10011a2a
cmp dword [esp + 0x114], 0
jne 0x10011a23
push dword [esp + 0x174]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [esp + 0x114]
mov esi, eax
call fcn.1002ad14
test esi, esi
je 0x10011a1c
mov eax, dword [esp + 0x174]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x114], esi
jmp 0x100119ab
mov edi, 0x8007000e
jmp 0x10011a4d
mov edi, 0x80004005
jmp 0x10011a54
test eax, eax
je 0x10011a23
jg 0x10011a34
mov edi, eax
jmp 0x10011a54
movzx edi, ax
or edi, 0x80070000
jmp 0x10011a54
mov eax, dword [esp + 0x114]
mov dword [esp + 0x144], eax
mov dword [esp + 0x114], ebx
lea ecx, [esp + 0x114]
call fcn.1002ad14
test edi, edi
js 0x10011c17
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [0x100ce2a4]
mov ecx, esi
push eax
call dword [0x100d6738]
call esi
mov ecx, eax
mov dword [esp + 0x48], ecx
test ecx, ecx
je 0x10011977
mov dword [esp + 0x110], ebx
mov edi, ebx
mov eax, ebx
mov esi, ebx
lea edx, [esp + 0x170]
push edx
push eax
push esi
mov esi, dword [0x100ce2a8]
push 2
push ecx
mov ecx, esi
call dword [0x100d6738]
call esi
test eax, eax
jne 0x10011b2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10011b19
cmp dword [esp + 0x110], 0
jne 0x10011b12
push dword [esp + 0x170]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [esp + 0x110]
mov esi, eax
call fcn.1002ad14
test esi, esi
je 0x10011b0b
mov eax, dword [esp + 0x170]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x110], esi
jmp 0x10011a9a
mov edi, 0x8007000e
jmp 0x10011b3c
mov edi, 0x80004005
jmp 0x10011b43
test eax, eax
je 0x10011b12
jg 0x10011b23
mov edi, eax
jmp 0x10011b43
movzx edi, ax
or edi, 0x80070000
jmp 0x10011b43
mov eax, dword [esp + 0x110]
mov dword [esp + 0x140], eax
mov dword [esp + 0x110], ebx
lea ecx, [esp + 0x110]
call fcn.1002ad14
test edi, edi
js 0x10011c17
mov eax, dword [esp + 0x144]
test eax, eax
je 0x10011c11
mov ecx, 0x10006960
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10011b94
test dx, dx
je 0x10011b8d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10011b94
add eax, 4
add ecx, 4
test dx, dx
jne 0x10011b6b
xor esi, esi
mov eax, ebx
inc esi
jmp 0x10011b9b
sbb eax, eax
xor esi, esi
inc esi
or eax, esi
test eax, eax
jne 0x10011c11
mov eax, dword [esp + 0x140]
test eax, eax
je 0x10011c11
mov ecx, 0x10006970
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10011bd5
test dx, dx
je 0x10011bd1
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10011bd5
add eax, 4
add ecx, 4
test dx, dx
jne 0x10011baf
mov eax, ebx
jmp 0x10011bd9
sbb eax, eax
or eax, esi
test eax, eax
jne 0x10011c11
push 4
lea eax, [esp + 0x170]
mov dword [esp + 0x170], ebx
push eax
push 0xb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
test eax, eax
je 0x10011977
test byte [esp + 0x16c], 0xf
mov eax, esi
je 0x10011c13
mov eax, ebx
mov dword [esp + 0x74], eax
lea ecx, [esp + 0x140]
call fcn.1002ad14
lea ecx, [esp + 0x144]
call fcn.1002ad14
test edi, edi
jns 0x10011c37
mov dword [esp + 0x74], ebx
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea ecx, [esp + 0x130]
mov dword [esp + 0x30], esi
call fcn.1002acfd
test esi, esi
jne 0x10011d19
mov dword [esp + 0x130], ebx
mov dword [esp + 0x10], 0x8007000e
mov eax, dword [esp + 0x118]
mov dword [esp + 0x128], eax
xor edi, edi
mov edx, 0x100d55d8
inc edi
mov ecx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10011c80
mov eax, dword [0x100d55d4]
test eax, eax
jle 0x10011cdc
sub eax, 1
mov dword [0x100d55d4], eax
jne 0x10011cdc
mov edi, ebx
mov eax, dword [edi + 0x100d4fd0]
test eax, eax
je 0x10011cb2
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0x10011ca1
push 0x40
push ebx
push 0x100d4fd0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x100019e0
mov edi, 0x100ce210
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor edi, edi
inc edi
xor eax, eax
mov ecx, 0x100d55d8
xchg dword [ecx], eax
lea ecx, [esp + 0x130]
call fcn.1002acfd
mov eax, dword [esp + 0x10]
test eax, eax
jns 0x1001ad5c
cmp eax, 0xd0000034
jne 0x1001ad1a
mov eax, 0xc004f012
mov dword [esp + 0x138], eax
jmp 0x1001ad58
xor eax, eax
mov dword [esp + 0x130], esi
lea edi, [esp + 0x7c]
mov dword [esp + 0x24], ebx
stosd dword es:[edi], eax
mov dword [esp + 0x3c], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x11c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [esp + 0x108], 0x38
mov dword [esp + 0x5c], esi
test esi, esi
jne 0x10011d77
mov esi, 0xc0000017
mov edi, ebx
mov dword [esp + 0x10], esi
jmp 0x10011e0b
push edi
push 0x100cec38
push esi
call sub.msvcrt.dll_memcpy
mov edi, esi
add esp, 0xc
mov dword [esp + 0x14], edi
push 8
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [esp + 0x2c], ecx
test ecx, ecx
jne 0x10011db2
mov esi, 0xc0000017
mov dword [esp + 0x10], esi
jmp 0x10011e0b
mov eax, dword [0x100cec30]
mov dword [ecx], eax
mov eax, dword [0x100cec34]
mov dword [ecx + 4], eax
mov dword [esp + 0x24], ecx
rdtsc
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], edx
push 0xc
pop edi
lea eax, [esp + 0x148]
mov edx, SysReAllocString
push eax
mov ecx, 0x100060c0
call fcn.1002ad4b
test eax, eax
jns 0x10011f17
mov dword [esp + 0x148], ebx
mov esi, 0xc000003e
mov dword [esp + 0x10], esi
mov edi, dword [esp + 0x14]
cmp dword [esp + 0x84], 0
mov dword [esp + 0x80], ebx
mov dword [esp + 0x7c], ebx
je 0x10011e3c
push dword [esp + 0x84]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x84], ebx
mov eax, dword [esp + 0x124]
mov dword [esp + 0x120], ebx
mov dword [esp + 0x11c], ebx
test eax, eax
je 0x10011e6b
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x124], ebx
test edi, edi
je 0x10011e7e
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10011e95
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x10011c6a
mov eax, dword [esp + 0x74]
test eax, eax
je 0x1001ad00
mov dword [0x100d4fb0], eax
mov esi, 0x104
push esi
lea eax, [esp + 0xb64]
mov dword [esp + 0x1ac], ebx
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x10018d8f
cmp eax, esi
jne 0x10011ee9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x10018d8f
mov esi, dword [0x100ce28c]
mov ecx, esi
push 0x403
push ebx
push ebx
call dword [0x100d6738]
call esi
mov dword [esp + 0x38], eax
test eax, eax
jne 0x1001473d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10018d8f
mov eax, dword [esp + 0x148]
inc eax
push 4
mov dword [esp + 0x14c], eax
pop edx
lea eax, [eax*2 + 4]
cmp eax, edx
jb 0x10011f38
mov ecx, eax
jmp 0x10011f3b
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, edx
jb 0x10011e07
mov edi, ecx
lea ecx, [edi + 0xc4]
mov edx, 0xc4
cmp ecx, edx
jb 0x10011f66
mov eax, ecx
jmp 0x10011f69
or eax, 0xffffffff
cmp ecx, edx
sbb esi, esi
and esi, 0xc0000095
add esi, 0x10000000
mov dword [esp + 0x10], esi
cmp ecx, edx
jb 0x1001471e
lea edx, [eax + 8]
cmp edx, eax
jb 0x10011f90
mov ecx, edx
jmp 0x10011f93
or ecx, 0xffffffff
cmp edx, eax
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
add esi, 0x10000000
mov dword [esp + 0x10], esi
cmp edx, eax
jb 0x1001471e
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x10011fbb
mov edx, eax
jmp 0x10011fbe
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, edi
add esi, 0x10000000
mov dword [esp + 0x10], esi
cmp eax, ecx
jb 0x1001471e
push edx
push 8
mov dword [esp + 0x88], edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x10011ffd
mov esi, 0xc0000017
jmp 0x10011e03
mov dword [esp + 0x84], edx
mov ecx, ebx
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x25c], ebx
lea eax, [edx + 4]
cmp eax, edx
jb 0x1001201c
mov edi, eax
jmp 0x1001201f
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, edx
jb 0x1001205c
mov ecx, dword [esp + 0x80]
lea eax, [edx + 8]
add ecx, edx
cmp eax, ecx
jbe 0x1001204b
mov esi, 0xc0000023
jmp 0x10011e03
mov dword [edx], 4
mov dword [edi], ebx
mov ecx, dword [esp + 0x7c]
inc ecx
mov dword [esp + 0x7c], ecx
test esi, esi
js 0x10011e07
cmp dword [esp + 0x84], 0
jne 0x100120ad
mov edi, dword [esp + 0x80]
lea eax, [edi + 0xa4]
cmp eax, edi
jb 0x10012083
mov edx, eax
jmp 0x10012086
or edx, 0xffffffff
cmp eax, edi
mov dword [esp + 0x80], edx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, edi
jb 0x10012194
inc ecx
mov dword [esp + 0x7c], ecx
jmp 0x1001219c
mov edx, dword [esp + 0x84]
mov edi, ebx
test ecx, ecx
je 0x10012130
mov eax, dword [edx]
add eax, 4
mov dword [esp + 0x48], edx
cmp eax, 4
jb 0x100120ce
mov dword [esp + 0x40], eax
jmp 0x100120d3
or dword [esp + 0x40], 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, 4
jb 0x1001218d
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x1a4], ebx
xor ebx, ebx
cmp eax, 4
jb 0x1001218d
mov eax, dword [esp + 0x1a4]
mov esi, edx
add eax, edx
cmp eax, edx
jb 0x10012114
mov edx, eax
jmp 0x10012117
or edx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, dword [esp + 0x48]
jb 0x1001218d
inc edi
cmp edi, ecx
jb 0x100120ba
lea eax, [edx + 4]
cmp eax, edx
jb 0x1001213b
mov edi, eax
jmp 0x1001213e
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, edx
jb 0x1001218d
mov ecx, dword [esp + 0x80]
lea eax, [edx + 0xa4]
add ecx, dword [esp + 0x84]
cmp eax, ecx
ja 0x10012041
mov eax, 0xa0
push eax
push dword [esp + 0x60]
mov dword [edx], eax
push edi
call sub.msvcrt.dll_memcpy
mov ecx, dword [esp + 0x88]
add esp, 0xc
inc ecx
mov dword [esp + 0x7c], ecx
mov edx, dword [esp + 0x80]
test esi, esi
js 0x10011e07
cmp dword [esp + 0x84], 0
jne 0x100121f7
mov eax, edx
lea edx, [eax + 0xc]
mov edi, edx
cmp edx, eax
jae 0x100121b4
or edx, 0xffffffff
cmp edi, eax
mov dword [esp + 0x80], edx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp edi, eax
jb 0x100122e6
mov edi, dword [esp + 0x90]
inc ecx
mov dword [esp + 0x1c0], edi
mov edi, dword [esp + 0x94]
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x1c4], edi
jmp 0x10012314
mov edi, dword [esp + 0x84]
mov dword [esp + 0x58], ebx
test ecx, ecx
je 0x10012284
mov eax, dword [edi]
add eax, 4
mov dword [esp + 0x48], edi
cmp eax, 4
jb 0x1001221a
mov dword [esp + 0x40], eax
jmp 0x1001221f
or dword [esp + 0x40], 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, 4
jb 0x100122e6
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x1b8], ebx
xor ebx, ebx
cmp eax, 4
jb 0x100122e6
mov eax, dword [esp + 0x1b8]
mov esi, edi
add eax, edi
cmp eax, edi
jb 0x10012260
mov edi, eax
jmp 0x10012263
or edi, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, dword [esp + 0x48]
jb 0x100122e6
mov esi, dword [esp + 0x58]
inc esi
mov dword [esp + 0x58], esi
cmp esi, ecx
jb 0x10012206
lea eax, [edi + 4]
cmp eax, edi
jb 0x10012291
mov dword [esp + 0x40], eax
jmp 0x10012298
or esi, 0xffffffff
mov dword [esp + 0x40], esi
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, edi
jb 0x100122e6
mov ecx, dword [esp + 0x84]
lea eax, [edi + 0xc]
add ecx, edx
cmp eax, ecx
ja 0x10012041
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x40]
mov dword [edi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x80]
inc ecx
mov dword [esp + 0x7c], ecx
test esi, esi
js 0x10011e07
cmp dword [esp + 0x84], 0
mov eax, dword [esp + 0x90]
mov dword [esp + 0x1c0], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x1c4], eax
jne 0x1001234c
lea eax, [edx + 0xc]
cmp eax, edx
jb 0x10012324
mov dword [esp + 0x80], eax
jmp 0x1001232c
or dword [esp + 0x80], 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, edx
jb 0x10012432
inc ecx
mov dword [esp + 0x7c], ecx
jmp 0x1001243a
mov edi, dword [esp + 0x84]
mov dword [esp + 0x58], ebx
test ecx, ecx
je 0x100123d9
mov eax, dword [edi]
add eax, 4
mov dword [esp + 0x48], edi
cmp eax, 4
jb 0x1001236f
mov dword [esp + 0x40], eax
jmp 0x10012374
or dword [esp + 0x40], 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, 4
jb 0x10012432
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x1dc], ebx
xor ebx, ebx
cmp eax, 4
jb 0x10012432
mov eax, dword [esp + 0x1dc]
mov esi, edi
add eax, edi
cmp eax, edi
jb 0x100123b5
mov edi, eax
jmp 0x100123b8
or edi, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, dword [esp + 0x48]
jb 0x10012432
mov esi, dword [esp + 0x58]
inc esi
mov dword [esp + 0x58], esi
cmp esi, ecx
jb 0x1001235b
lea eax, [edi + 4]
cmp eax, edi
jb 0x100123e6
mov dword [esp + 0x40], eax
jmp 0x100123eb
or dword [esp + 0x40], 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, edi
jb 0x10012432
mov ecx, dword [esp + 0x84]
lea eax, [edi + 0xc]
add ecx, edx
cmp eax, ecx
ja 0x10012041
mov eax, dword [esp + 0x40]
mov dword [edi], 8
mov edi, dword [esp + 0x90]
mov dword [eax], edi
mov edi, dword [esp + 0x94]
mov dword [eax + 4], edi
inc dword [esp + 0x7c]
test esi, esi
js 0x10011e07
lea eax, [esp + 0x14c]
mov edx, SysReAllocString
push eax
mov ecx, 0x100060c0
call fcn.1002ad4b
test eax, eax
jns 0x10012461
mov dword [esp + 0x14c], ebx
jmp 0x10011dfe
mov ecx, dword [esp + 0x14c]
lea eax, [ecx + 1]
cmp eax, ecx
jb 0x10012477
mov edx, eax
mov dword [esp + 0x6c], eax
jmp 0x1001247e
or edx, 0xffffffff
mov dword [esp + 0x6c], edx
cmp eax, ecx
mov dword [esp + 0x14c], edx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, ecx
jb 0x10012618
lea ecx, [edx + edx]
test ecx, ecx
je 0x1001260f
cmp dword [esp + 0x84], 0
jne 0x1001251f
lea eax, [ecx + 4]
push 4
pop ecx
cmp eax, ecx
jb 0x100124be
mov edx, eax
jmp 0x100124c1
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, ecx
jae 0x100124df
mov edx, dword [esp + 0x1e0]
jmp 0x10012618
mov ecx, dword [esp + 0x80]
lea eax, [ecx + edx]
cmp eax, ecx
jb 0x100124f6
mov dword [esp + 0x80], eax
jmp 0x100124fe
or dword [esp + 0x80], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, ecx
jb 0x10012618
inc dword [esp + 0x7c]
mov esi, ebx
jmp 0x10012614
cmp dword [esp + 0x7c], 0
mov edx, ebx
mov edi, dword [esp + 0x84]
jbe 0x100125ac
mov eax, dword [esp + 0x1e0]
mov dword [esp + 0x58], eax
mov eax, dword [edi]
add eax, 4
mov dword [esp + 0x48], edi
cmp eax, 4
jb 0x1001254e
mov dword [esp + 0x40], eax
jmp 0x10012553
or dword [esp + 0x40], 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, 4
jb 0x10012618
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x58], ebx
xor ebx, ebx
cmp eax, 4
jb 0x10012618
mov eax, dword [esp + 0x58]
mov esi, edi
add eax, edi
cmp eax, edi
jb 0x1001258e
mov edi, eax
jmp 0x10012591
or edi, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, dword [esp + 0x48]
jb 0x10012618
inc edx
cmp edx, dword [esp + 0x7c]
jb 0x1001253a
lea eax, [edi + 4]
cmp eax, edi
jb 0x100125b9
mov dword [esp + 0x40], eax
jmp 0x100125be
or dword [esp + 0x40], 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, edi
jb 0x10012618
mov eax, dword [esp + 0x84]
lea edx, [ecx + 4]
add eax, dword [esp + 0x80]
add edx, edi
cmp edx, eax
jbe 0x100125ee
mov esi, 0xc0000023
jmp 0x10012614
mov ecx, dword [esp + 0x6c]
lea eax, [ecx + ecx]
push eax
push 0x100060c0
push dword [esp + 0x48]
mov dword [edi], eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
inc dword [esp + 0x7c]
jmp 0x10012618
mov esi, 0xc000000d
mov dword [esp + 0x10], esi
test esi, esi
js 0x10011e07
cmp dword [esp + 0x84], 0
mov eax, dword [esp + 0x74]
mov dword [esp + 0x260], eax
jne 0x1001267e
mov ecx, dword [esp + 0x80]
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x1001264c
mov dword [esp + 0x80], eax
jmp 0x10012654
or dword [esp + 0x80], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, ecx
jb 0x10012740
inc dword [esp + 0x7c]
mov dword [esp + 0x1e8], 4
jmp 0x1001275d
cmp dword [esp + 0x7c], 0
mov ecx, ebx
mov edx, dword [esp + 0x84]
jbe 0x100126f7
mov eax, dword [edx]
add eax, 4
mov dword [esp + 0x48], edx
cmp eax, 4
jb 0x100126a0
mov edi, eax
jmp 0x100126a3
or edi, 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, 4
jb 0x100126c0
mov dword [esp + 0x1e4], edi
jmp 0x100126c7
mov edi, dword [esp + 0x1e4]
cmp eax, 4
jb 0x10012740
lea eax, [edx + edi]
mov esi, edx
cmp eax, edx
jb 0x100126d9
mov edx, eax
jmp 0x100126dc
or edx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, dword [esp + 0x48]
jb 0x10012740
inc ecx
cmp ecx, dword [esp + 0x7c]
jb 0x1001268e
lea eax, [edx + 4]
cmp eax, edx
jb 0x10012702
mov edi, eax
jmp 0x10012705
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, edx
jb 0x10012740
mov ecx, dword [esp + 0x80]
lea eax, [edx + 8]
add ecx, dword [esp + 0x84]
cmp eax, ecx
ja 0x10012041
mov eax, dword [esp + 0x74]
mov dword [edx], 4
mov dword [edi], eax
inc dword [esp + 0x7c]
test esi, esi
js 0x10011e07
cmp dword [esp + 0x84], 0
mov dword [esp + 0x1e8], 4
jne 0x1001279b
mov ecx, dword [esp + 0x80]
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x10012774
mov dword [esp + 0x80], eax
jmp 0x1001277c
or dword [esp + 0x80], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, ecx
jb 0x10012858
inc dword [esp + 0x7c]
jmp 0x10012860
cmp dword [esp + 0x7c], 0
mov ecx, ebx
mov edx, dword [esp + 0x84]
jbe 0x10012814
mov eax, dword [edx]
add eax, 4
mov dword [esp + 0x48], edx
cmp eax, 4
jb 0x100127bd
mov edi, eax
jmp 0x100127c0
or edi, 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, 4
jb 0x100127dd
mov dword [esp + 0x1ec], edi
jmp 0x100127e4
mov edi, dword [esp + 0x1ec]
cmp eax, 4
jb 0x10012858
lea eax, [edx + edi]
mov esi, edx
cmp eax, edx
jb 0x100127f6
mov edx, eax
jmp 0x100127f9
or edx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, dword [esp + 0x48]
jb 0x10012858
inc ecx
cmp ecx, dword [esp + 0x7c]
jb 0x100127ab
lea eax, [edx + 4]
cmp eax, edx
jb 0x1001281f
mov edi, eax
jmp 0x10012822
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, edx
jb 0x10012858
mov ecx, dword [esp + 0x80]
lea eax, [edx + 8]
add ecx, dword [esp + 0x84]
cmp eax, ecx
ja 0x10012041
push 4
pop eax
mov dword [edx], eax
mov dword [edi], eax
inc dword [esp + 0x7c]
test esi, esi
js 0x10011e07
rdtsc
mov edi, ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x64], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x48], eax
mov dword [esp + 0x5c], edx
mov ecx, dword [esp + 0x80]
add ecx, 8
cmp ecx, 8
jb 0x100128aa
mov edx, ecx
jmp 0x100128ad
or edx, 0xffffffff
cmp ecx, 8
sbb esi, esi
and esi, 0xc0000095
cmp ecx, 8
jb 0x10012995
lea eax, [edx + 7]
and eax, 0xfffffff8
mov dword [esp + 0x40], eax
cmp eax, edx
jae 0x100128d9
mov esi, 0xc0000095
jmp 0x10012995
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x100128fb
mov esi, 0xc0000017
mov edi, ebx
jmp 0x10012995
mov eax, dword [esp + 0x7c]
mov dword [edi], eax
lea eax, [edi + 4]
cmp eax, edi
jb 0x1001290c
mov ecx, eax
jmp 0x1001290f
or ecx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x1001297e
mov eax, dword [esp + 0x80]
mov dword [ecx], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x10012931
mov edx, eax
jmp 0x10012934
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1001297e
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x48]
mov dword [edi + eax - 8], ecx
mov ecx, dword [esp + 0x5c]
mov dword [edi + eax - 4], ecx
push dword [esp + 0x80]
push dword [esp + 0x88]
push edx
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x4c]
add esp, 0xc
mov dword [esp + 0x88], edi
mov edi, ebx
mov dword [esp + 0x34], eax
test edi, edi
je 0x10012991
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x34]
or esi, 0x10000000
mov dword [esp + 0x10], esi
jl 0x100140b1
cmp dword [esp + 0x88], 0
mov dword [esp + 0xb8], ebx
jne 0x100129c0
mov esi, 0xc000000d
jmp 0x10012fbf
test edi, edi
je 0x10012fba
lea eax, [edi + 8]
push eax
push ebx
mov dword [esp + 0x58], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [esp + 0x8c], esi
test esi, esi
je 0x10012fba
mov cl, bl
mov edx, ebx
test edi, edi
je 0x10012a06
mov eax, dword [esp + 0x88]
xor cl, byte [edx + eax]
inc edx
cmp edx, edi
jb 0x100129fe
mov eax, 0xc81ecb17
mov dword [esp + 0x670], 0xb1b54a58
mov dword [esp + 0x674], eax
or eax, 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 0xe4], eax
mov eax, edi
shr eax, 3
mov dword [esp + 0xe8], ebx
mov dword [esp + 0x70], eax
test eax, eax
je 0x10012dff
movzx edx, word [esp + 0x672]
mov eax, 0xc81ecb17
movzx esi, ax
shr eax, 0x10
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x8c]
add eax, 7
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x88]
add eax, 2
mov dword [esp + 0x1c], esi
mov dword [esp + 0x40], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x9c], ebx
mov ebx, dword [esp + 0x40]
movzx edi, byte [ebx - 2]
movzx eax, byte [ebx - 1]
movzx esi, byte [ebx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ebx]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 3]
or esi, eax
movzx eax, byte [ebx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ebx + 5]
add ebx, 8
shl esi, 8
or esi, eax
mov dword [esp + 0x40], ebx
xor edx, esi
mov eax, 0xc81ecb17
mov dword [esp + 0x10], edx
lea ebx, [edx - 0x4a58]
xor ebx, edi
xor ebx, dword [esp + 0xe8]
xor ebx, eax
mov edx, ebx
xor edx, eax
mov eax, ebx
ror edx, 0xf
imul edx, dword [esp + 0x18]
ror eax, 7
add edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov dword [esp + 0x10], eax
lea edx, [eax - 0x4e4ab5a8]
ror eax, 0xa
ror edx, 9
imul edx, dword [esp + 0x1c]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [esp + 0x1c]
rol eax, 5
rol edx, 4
imul edx, dword [esp + 0x38]
add edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov edx, eax
mov dword [esp + 0x10], eax
xor edx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, edx
xor ebx, eax
mov eax, ebx
shr eax, 6
lea edx, [ebx - 0x4a58]
imul edx, dword [esp + 0x18]
sub edx, eax
xor dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
mov eax, edx
ror eax, 0xf
xor eax, dword [esp + 0x1c]
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, dword [esp + 0x38]
imul eax, dword [esp + 0x1c]
xor edx, eax
mov dword [esp + 0x10], edx
lea eax, [edx + 0x37e0ea91]
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [esp + 0x38]
imul eax, dword [esp + 0x18]
ror edx, 0xa
xor edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov edx, eax
mov dword [esp + 0x10], eax
xor edx, 0x4a58
ror eax, 3
rol edx, 6
imul edx, dword [esp + 0x1c]
xor edx, eax
xor ebx, edx
mov edx, dword [esp + 0x10]
mov eax, ebx
ror eax, 0xf
sub eax, dword [esp + 0x38]
imul eax, eax, 0x4a58
xor edx, eax
mov dword [esp + 0x10], edx
xor edx, dword [esp + 0x38]
mov eax, dword [esp + 0x10]
imul edx, edx, 0x4a58
shr eax, 1
xor edx, eax
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x1c]
xor ebx, edx
rol eax, 3
imul edx, eax, 0x4a58
mov eax, dword [esp + 0x10]
shr eax, 0xf
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
sub edx, dword [esp + 0x1c]
imul edx, dword [esp + 0x18]
shr eax, 0xd
sub edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [esp + 0x10], eax
ror edx, 9
imul edx, dword [esp + 0x1c]
ror eax, 0xb
xor edx, eax
xor ebx, edx
mov edx, dword [esp + 0x10]
mov eax, ebx
sub eax, dword [esp + 0x38]
add eax, 0x4e4ab5a8
xor edx, eax
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x18]
ror edx, 7
imul eax, eax, 0x4a58
sub eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [esp + 0x38]
rol edx, 4
imul edx, dword [esp + 0x18]
ror eax, 0x10
sub edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [esp + 0x10], eax
ror edx, 0xa
imul edx, dword [esp + 0x1c]
ror eax, 4
add edx, eax
xor ebx, edx
mov eax, ebx
ror eax, 9
lea edx, [ebx + 0x4e4ab5a8]
ror edx, 4
imul edx, dword [esp + 0x38]
xor edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov dword [esp + 0x10], eax
xor eax, 0xc81ecb17
rol eax, 8
imul edx, eax, 0x4a58
mov eax, dword [esp + 0x10]
rol eax, 2
sub edx, eax
xor ebx, edx
mov edx, 0xc81ecb17
sub edx, ebx
mov eax, ebx
ror eax, 0xc
ror edx, 0xb
imul edx, dword [esp + 0x18]
sub edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov edx, eax
mov dword [esp + 0x10], eax
xor edx, dword [esp + 0x18]
imul edx, dword [esp + 0x1c]
shr eax, 8
xor edx, eax
xor ebx, edx
mov eax, ebx
xor ebx, dword [esp + 0x28]
xor eax, dword [esp + 0x9c]
xor eax, dword [esp + 0x10]
xor eax, 0xc81ecb17
mov dword [esp + 0xe8], ebx
xor eax, 0xb1b54a58
mov dword [esp + 0x28], edi
mov dword [esp + 0xe4], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x9c], esi
mov byte [eax - 4], bl
mov al, byte [esp + 0xe4]
mov ebx, dword [esp + 0x68]
ror dword [esp + 0xe8], 8
mov byte [ebx], al
ror dword [esp + 0xe4], 8
mov al, byte [esp + 0xe8]
mov byte [ebx - 5], al
mov al, byte [esp + 0xe4]
ror dword [esp + 0xe8], 8
mov byte [ebx - 1], al
ror dword [esp + 0xe4], 8
mov al, byte [esp + 0xe8]
mov byte [ebx - 6], al
mov al, byte [esp + 0xe4]
ror dword [esp + 0xe8], 8
mov byte [ebx - 2], al
ror dword [esp + 0xe4], 8
mov al, byte [esp + 0xe8]
mov byte [ebx - 7], al
mov al, byte [esp + 0xe4]
mov byte [ebx - 3], al
add ebx, 8
mov edx, dword [esp + 0xe4]
ror dword [esp + 0xe8], 8
ror edx, 8
sub dword [esp + 0x70], 1
mov dword [esp + 0xe4], edx
mov dword [esp + 0x68], ebx
jne 0x10012a8d
mov edi, dword [esp + 0x34]
xor ebx, ebx
mov esi, dword [esp + 0x8c]
movzx eax, cl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x10012e2b
mov esi, 0xc0000017
jmp 0x10012f27
mov eax, dword [esp + 0x50]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x10012e4c
mov esi, 0xc0000017
jmp 0x10012ec6
mov dword [edi + 4], eax
push dword [esp + 0x50]
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x10012e45
mov dword [edi + 0xc], eax
push 0xa0
push 0x100ceb88
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [edi + 0x10], esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10012e45
mov dword [edi + 0x14], ecx
mov eax, dword [0x100cec28]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0x100cec2c]
mov dword [esp + 0xb8], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0x10012f27
cmp dword [edi + 4], 0
je 0x10012ee4
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x10012efe
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x10012f18
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x10012f3a
mov eax, dword [esp + 0xb8]
mov edi, ebx
mov dword [esp + 0x64], eax
jmp 0x10012f41
mov edi, dword [esp + 0xb8]
mov eax, dword [esp + 0x8c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x10012fbf
cmp dword [edi + 4], 0
je 0x10012f75
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x10012f8f
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x10012fa9
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10012fbf
mov esi, 0xc0000001
or esi, 0x10000000
mov dword [esp + 0x10], esi
jl 0x100140b1
mov ecx, dword [esp + 0x64]
mov edi, dword [ecx + 8]
mov ecx, dword [ecx]
add ecx, 4
cmp ecx, 4
jb 0x10012fe4
mov eax, ecx
jmp 0x10012fe7
or eax, 0xffffffff
cmp ecx, 4
sbb esi, esi
and esi, 0xc0000095
cmp ecx, 4
jb 0x1001306e
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x10013002
mov edx, ecx
jmp 0x10013005
or edx, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
cmp ecx, eax
jb 0x1001306e
lea eax, [edx + edi]
cmp eax, edx
jb 0x1001301e
mov ecx, eax
jmp 0x10013021
or ecx, 0xffffffff
cmp eax, edx
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
cmp eax, edx
jb 0x1001306e
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x1001303b
mov eax, edx
jmp 0x1001303e
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, edi
cmp edx, ecx
jb 0x1001306e
mov edx, dword [esp + 0x64]
mov ecx, dword [edx + 0x10]
add ecx, eax
cmp ecx, eax
jb 0x1001305d
mov edx, ecx
mov dword [esp + 0x68], ecx
jmp 0x10013064
or edx, 0xffffffff
mov dword [esp + 0x68], edx
cmp ecx, eax
sbb esi, esi
and esi, edi
cmp ecx, eax
jae 0x10013079
mov edx, dword [esp + 0x264]
mov dword [esp + 0x68], edx
test esi, esi
js 0x100131e6
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x100130a1
mov esi, 0xc0000017
jmp 0x100131e6
mov edx, dword [esp + 0x64]
lea ecx, [edi + 4]
mov eax, dword [edx]
mov dword [edi], eax
cmp ecx, edi
jb 0x100130b8
mov eax, ecx
mov dword [esp + 0x50], ecx
jmp 0x100130bf
or eax, 0xffffffff
mov dword [esp + 0x50], eax
cmp ecx, edi
sbb esi, esi
and esi, 0xc0000095
cmp ecx, edi
jb 0x100131d3
push dword [edx]
push dword [edx + 4]
push eax
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x70]
add esp, 0xc
mov ecx, dword [esp + 0x50]
mov eax, dword [edx]
add eax, ecx
cmp eax, ecx
jb 0x100130f3
mov edx, eax
jmp 0x100130f6
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x100131d3
mov eax, dword [esp + 0x64]
lea ecx, [edx + 4]
mov eax, dword [eax + 8]
mov dword [edx], eax
cmp ecx, edx
jb 0x10013120
mov eax, ecx
mov dword [esp + 0x50], ecx
jmp 0x10013127
or eax, 0xffffffff
mov dword [esp + 0x50], eax
cmp ecx, edx
sbb esi, esi
and esi, 0xc0000095
cmp ecx, edx
jb 0x100131d3
mov esi, dword [esp + 0x64]
push dword [esi + 8]
push dword [esi + 0xc]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
mov edx, dword [esp + 0x50]
add eax, edx
cmp eax, edx
jb 0x1001315d
mov ecx, eax
jmp 0x10013160
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x100131d3
mov eax, dword [esp + 0x64]
lea edx, [ecx + 4]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
cmp edx, ecx
jb 0x10013186
mov eax, edx
mov dword [esp + 0x50], edx
jmp 0x1001318d
or eax, 0xffffffff
mov dword [esp + 0x50], eax
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
cmp edx, ecx
jb 0x100131d3
mov esi, dword [esp + 0x64]
push dword [esi + 0x10]
push dword [esi + 0x14]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x10]
add esp, 0xc
mov ecx, dword [esp + 0x50]
add eax, ecx
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x100131d3
mov eax, dword [esp + 0x68]
mov dword [esp + 0x6c], edi
mov edi, ebx
mov dword [esp + 0x4c], eax
test edi, edi
je 0x100131e6
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
or esi, 0x10000000
mov dword [esp + 0x10], esi
jl 0x100140b1
mov dword [esp + 0x50], ebx
cmp dword [esp + 0x84], 0
jne 0x1001323b
mov esi, 0xc000000d
mov dword [esp + 0x10], esi
mov eax, ebx
test esi, esi
js 0x100140b1
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x100133d6
mov esi, 0xd0000017
jmp 0x100140ad
xor eax, eax
inc eax
cmp dword [esp + 0x7c], eax
jbe 0x10013204
mov ecx, dword [esp + 0x84]
mov edi, ebx
mov eax, dword [ecx]
lea edx, [ecx + 4]
mov dword [esp + 0x48], eax
cmp edx, ecx
jb 0x1001325e
mov eax, edx
jmp 0x10013261
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp edx, ecx
jb 0x100132b7
mov ecx, dword [esp + 0x48]
add ecx, eax
mov edx, ecx
cmp ecx, eax
jae 0x10013282
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp edx, eax
jb 0x100132b7
xor eax, eax
inc edi
inc eax
cmp edi, eax
jb 0x1001324d
lea eax, [ecx + 4]
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, ecx
jb 0x100132b7
mov eax, dword [ecx]
mov dword [esp + 0x50], eax
test esi, esi
js 0x1001320d
cmp dword [esp + 0x7c], 2
jbe 0x10013204
mov ecx, dword [esp + 0x84]
mov edi, ebx
mov eax, dword [ecx]
lea edx, [ecx + 4]
mov dword [esp + 0x48], eax
cmp edx, ecx
jb 0x100132e4
mov eax, edx
jmp 0x100132e7
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp edx, ecx
jb 0x10013339
mov ecx, dword [esp + 0x48]
add ecx, eax
mov edx, ecx
cmp ecx, eax
jae 0x10013308
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp edx, eax
jb 0x10013339
inc edi
cmp edi, 2
jb 0x100132d3
lea eax, [ecx + 4]
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, ecx
jb 0x10013339
mov edi, dword [ecx]
jmp 0x1001333b
mov edi, ebx
test esi, esi
js 0x1001320d
mov eax, dword [esp + 0x50]
add eax, 0x50
cmp eax, 0x50
jb 0x10013353
mov ecx, eax
jmp 0x10013356
or ecx, 0xffffffff
cmp eax, 0x50
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp eax, 0x50
jb 0x100133aa
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x10013375
mov eax, edx
jmp 0x10013378
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp edx, ecx
jb 0x100133aa
lea ecx, [eax + edi]
cmp ecx, eax
jb 0x10013395
mov edx, ecx
jmp 0x10013398
or edx, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp ecx, eax
jae 0x100133b1
mov edx, dword [esp + 0x258]
test esi, esi
js 0x1001320d
cmp edx, 0x400000
jbe 0x100133cb
mov esi, 0x8000ffff
jmp 0x100140ad
mov eax, edx
mov dword [esp + 0x44], eax
jmp 0x1001320f
mov dword [esp + 0x2c], edi
mov eax, dword [esp + 0x6c]
test eax, eax
jne 0x100133ec
mov esi, 0x80070057
jmp 0x100140ad
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x204], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x20c], eax
lea eax, [esp + 0x184]
push eax
xor eax, eax
mov dword [esp + 0x20c], edi
push 0x10005ea8
inc eax
mov dword [esp + 0x218], ecx
push eax
mov dword [esp + 0x220], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x10013462
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 0x10], esi
test esi, esi
jle 0x10013451
movzx esi, si
or esi, 0x80070000
mov dword [esp + 0x10], esi
test esi, esi
mov eax, dword [esp + 0x44]
js 0x100134b3
mov esi, 0x80004005
mov dword [esp + 0x10], esi
jmp 0x100134b3
push 0x10008d60
push dword [esp + 0x188]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10013432
push ebx
push 0x14
lea eax, [esp + 0x20c]
mov ecx, esi
push eax
push 0x86
call dword [0x100d6738]
call esi
mov esi, eax
or esi, 0x10000000
mov dword [esp + 0x10], esi
jl 0x100134af
mov eax, dword [esp + 0x210]
mov dword [esp + 0x44], eax
jmp 0x100134b3
mov eax, dword [esp + 0x44]
cmp esi, 0xd0000023
jne 0x100134c5
mov esi, 0x8007007a
jmp 0x100140ad
test esi, esi
js 0x100140b1
mov dword [esp + 0x8c], ebx
cmp eax, 4
jae 0x100134e3
mov esi, 0xc000003e
jmp 0x1001388f
mov ecx, dword [edi]
lea eax, [edi + 4]
mov dword [esp + 0x68], ecx
cmp eax, edi
jb 0x100134f8
mov edx, eax
mov dword [esp + 0x28], eax
jmp 0x100134ff
or edx, 0xffffffff
mov dword [esp + 0x28], edx
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x1001388f
mov eax, dword [esp + 0x44]
add eax, 0xfffffffc
cmp eax, ecx
jb 0x100134d9
lea eax, [edx + ecx]
cmp eax, edx
jb 0x10013527
mov edx, eax
jmp 0x1001352a
or edx, 0xffffffff
cmp eax, dword [esp + 0x28]
sbb esi, esi
and esi, 0xc0000095
cmp eax, dword [esp + 0x28]
jb 0x1001388f
lea eax, [ecx + 4]
cmp eax, 4
jb 0x1001354c
mov ecx, eax
jmp 0x1001354f
or ecx, 0xffffffff
cmp eax, 4
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
cmp eax, 4
jb 0x1001388f
mov eax, dword [esp + 0x44]
sub eax, ecx
cmp eax, 4
jb 0x100134d9
mov eax, dword [edx]
mov dword [esp + 0x4c], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x10013586
mov dword [esp + 0x34], eax
jmp 0x1001358b
or dword [esp + 0x34], 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, edi
cmp eax, edx
jb 0x1001388f
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x100135a4
mov edi, eax
jmp 0x100135a7
or edi, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1001388f
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x4c]
sub eax, edi
cmp eax, edx
jb 0x100134d9
mov esi, dword [esp + 0x34]
lea eax, [edx + esi]
cmp eax, esi
jb 0x100135da
mov ecx, eax
jmp 0x100135dd
or ecx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
cmp eax, dword [esp + 0x34]
jb 0x1001388f
lea eax, [edx + edi]
cmp eax, edi
jb 0x100135fc
mov edx, eax
jmp 0x100135ff
or edx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x1001388f
mov eax, dword [esp + 0x44]
sub eax, edx
cmp eax, 4
jb 0x100134d9
mov edi, dword [ecx]
lea eax, [ecx + 4]
mov dword [esp + 0x48], edi
cmp eax, ecx
jb 0x10013636
mov dword [esp + 0xb8], eax
jmp 0x1001363e
or dword [esp + 0xb8], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1001388f
lea eax, [edx + 4]
cmp eax, edx
jb 0x1001365b
mov ecx, eax
jmp 0x1001365e
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x1001388f
mov eax, dword [esp + 0x44]
sub eax, ecx
cmp eax, edi
jb 0x100134d9
lea eax, [edi + ecx]
cmp eax, ecx
jb 0x10013689
mov edx, eax
jmp 0x1001368c
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1001388f
mov eax, dword [esp + 0x44]
sub eax, edx
jne 0x100134d9
mov esi, dword [esp + 0x4c]
mov ecx, dword [esp + 0x68]
add ecx, 0xc
lea eax, [edi + esi]
add eax, ecx
cmp eax, dword [esp + 0x44]
jne 0x100134d9
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x100136e5
mov esi, 0xc0000017
jmp 0x10013814
cmp dword [esp + 0x28], 0
je 0x10013727
mov eax, dword [esp + 0x68]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x10013710
mov esi, 0xc0000017
jmp 0x100137b3
mov dword [edi + 4], eax
mov ecx, dword [esp + 0x68]
push ecx
push dword [esp + 0x2c]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x1001372c
mov dword [edi], ebx
mov dword [edi + 4], ebx
cmp dword [esp + 0x34], 0
je 0x1001375d
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x10013706
mov dword [edi + 0xc], eax
push esi
push dword [esp + 0x38]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x10013763
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [esp + 0xb8], 0
je 0x100137a2
mov esi, dword [esp + 0x48]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x10013706
mov dword [edi + 0x14], eax
push esi
push dword [esp + 0xbc]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x100137a8
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [esp + 0x8c], edi
mov esi, ebx
mov edi, ebx
test edi, edi
je 0x10013814
cmp dword [edi + 4], 0
je 0x100137d1
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x100137eb
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x10013805
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x10013827
mov eax, dword [esp + 0x8c]
mov edi, ebx
mov dword [esp + 0x58], eax
jmp 0x1001382e
mov edi, dword [esp + 0x8c]
test edi, edi
je 0x1001388f
cmp dword [edi + 4], 0
je 0x1001384c
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x10013866
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x10013880
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
or esi, 0x10000000
mov dword [esp + 0x10], esi
jl 0x100140b1
mov ecx, dword [esp + 0x58]
mov edi, ebx
mov dword [esp + 0x40], ebx
test ecx, ecx
jne 0x100138b7
mov esi, 0xd000000d
jmp 0x100140ad
mov eax, dword [ecx + 4]
mov dword [esp + 0x9c], eax
test eax, eax
je 0x100138ad
mov esi, dword [ecx]
test esi, esi
je 0x100138ad
add esi, 0xfffffff8
push esi
push ebx
mov dword [esp + 0x94], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x70], eax
test eax, eax
je 0x10013e7c
mov ecx, 0x7f1137f
mov dword [esp + 0x68], eax
mov dword [esp + 0x67c], ecx
mov edi, esi
mov ecx, dword [esp + 0x9c]
and edi, 7
mov dword [esp + 0xb8], ecx
mov dl, bl
mov dword [esp + 0x678], 0xab69605e
mov eax, ebx
mov dword [esp + 0x5c], edi
mov ecx, ebx
je 0x10013e25
or dword [esp + 0xb0], 0xffffffff
mov dword [esp + 0xbc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], ecx
test edi, edi
je 0x1001399a
mov eax, dword [esp + 0xb8]
push 0x38
pop esi
lea ebx, [eax + 1]
movzx eax, byte [eax]
mov dword [esp + 0x50], ebx
cmp ecx, 4
jge 0x10013971
lea ecx, [esi - 0x20]
shl eax, cl
or dword [esp + 0x44], eax
jmp 0x10013979
mov ecx, esi
shl eax, cl
or dword [esp + 0x10], eax
mov ecx, dword [esp + 0x4c]
sub esi, 8
mov eax, dword [esp + 0x50]
inc ecx
mov dword [esp + 0x4c], ecx
cmp ecx, edi
jl 0x10013957
mov dword [esp + 0xb8], eax
xor ebx, ebx
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x10]
xor eax, 0x92f65a5
xor ecx, 0x699a899c
mov dword [esp + 0x34], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xb0], ecx
mov dword [esp + 0x48], ebx
test edi, edi
je 0x10013a0c
mov esi, dword [esp + 0x68]
lea edi, [esi + 1]
mov dword [esp + 0x4c], edi
cmp ebx, 4
jge 0x100139de
rol eax, 8
mov byte [esi], al
jmp 0x100139e3
rol ecx, 8
mov byte [esi], cl
mov edi, dword [esp + 0x5c]
inc ebx
mov esi, dword [esp + 0x4c]
cmp ebx, edi
jl 0x100139cb
mov eax, esi
xor ebx, ebx
mov esi, dword [esp + 0xb0]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0xbc]
mov dword [esp + 0x34], eax
jmp 0x10013a10
mov esi, dword [esp + 0x1c]
add edi, 0xfffffffc
test edi, edi
jle 0x10013df5
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [esp + 0x1c], esi
mov dword [esp + 0xb0], esi
mov esi, dword [esp + 0x8c]
mov eax, esi
shr eax, 3
mov dword [esp + 0x50], eax
test eax, eax
je 0x10013dc1
movzx esi, word [esp + 0x67a]
mov eax, 0x7f1137f
mov ebx, dword [esp + 0x34]
mov ecx, eax
movzx eax, ax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x38], esi
add eax, 7
mov esi, dword [esp + 0xb8]
shr ecx, 0x10
add esi, 2
mov dword [esp + 0x28], ecx
mov dword [esp + 0x4c], eax
movzx ecx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ecx, 8
or ecx, eax
shl edi, 8
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 3]
or edi, eax
mov dword [esp + 0x48], ecx
movzx eax, byte [esi + 4]
xor ebx, ecx
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
add esi, 8
shl edi, 8
or edi, eax
mov dword [esp + 0x5c], esi
mov eax, dword [esp + 0x1c]
mov esi, 0x7f1137f
xor eax, edi
xor eax, ebx
xor eax, esi
xor eax, 0xab69605e
mov dword [esp + 0x1c], eax
lea ecx, [eax + 0x54969fa2]
rol eax, 0xa
rol ecx, 5
imul ecx, dword [esp + 0x18]
add ecx, eax
xor ebx, ecx
mov eax, ebx
rol eax, 2
lea ecx, [esi + ebx]
mov esi, dword [esp + 0x1c]
ror ecx, 9
imul ecx, dword [esp + 0x38]
sub ecx, eax
xor esi, ecx
mov eax, esi
sub eax, dword [esp + 0x18]
imul ecx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [esp + 0x38]
rol ecx, 6
imul ecx, dword [esp + 0x28]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, dword [esp + 0x18]
xor eax, ebx
mov ecx, ebx
imul eax, dword [esp + 0x38]
ror ecx, 6
xor ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
add eax, esi
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, esi
rol eax, 2
add ecx, eax
xor ebx, ecx
lea ecx, [ebx + 0x54969fa2]
ror ecx, 0xe
mov eax, ebx
imul ecx, dword [esp + 0x28]
rol eax, 8
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, 0xab69605e
ror eax, 0xa
ror ecx, 0xc
imul ecx, dword [esp + 0x18]
xor ecx, eax
xor ebx, ecx
mov ecx, dword [esp + 0x28]
xor ecx, ebx
mov eax, ebx
imul ecx, dword [esp + 0x38]
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov ecx, dword [esp + 0x28]
mov eax, esi
mov dword [esp + 0x1c], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [esp + 0x28]
xor ebx, eax
mov esi, ebx
sub esi, dword [esp + 0x28]
xor esi, dword [esp + 0x1c]
xor esi, 0xab69605e
xor ecx, esi
mov eax, esi
rol ecx, 2
imul ecx, dword [esp + 0x18]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 6
imul ecx, dword [esp + 0x38]
rol eax, 7
add ecx, eax
mov eax, dword [esp + 0x18]
xor esi, ecx
xor eax, esi
mov ecx, esi
imul eax, eax, 0x605e
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov dword [esp + 0x34], ebx
xor ecx, dword [esp + 0x38]
mov eax, ebx
rol ecx, 5
imul ecx, dword [esp + 0x28]
rol eax, 7
add ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov ebx, esi
xor ebx, dword [esp + 0x34]
xor ebx, ecx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [esp + 0x38]
imul eax, dword [esp + 0x18]
xor esi, eax
mov eax, esi
sub eax, ecx
ror eax, 1
imul ecx, eax, 0x605e
mov eax, esi
ror eax, 6
sub ecx, eax
xor ebx, ecx
mov eax, ebx
rol eax, 0xe
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul ecx, dword [esp + 0x28]
add ecx, eax
xor esi, ecx
mov eax, esi
ror eax, 0xe
lea ecx, [esi - 0x54969fa2]
rol ecx, 0xf
imul ecx, dword [esp + 0x18]
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
shr eax, 3
xor ecx, 0x605e
imul ecx, dword [esp + 0x38]
xor ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
xor eax, esi
rol eax, 4
imul ecx, eax, 0x605e
mov eax, esi
xor esi, dword [esp + 0x10]
rol eax, 2
mov dword [esp + 0xb0], esi
mov esi, dword [esp + 0x4c]
xor ecx, eax
mov dword [esp + 0x10], edi
xor ecx, dword [esp + 0x44]
xor ebx, ecx
mov dword [esp + 0xbc], ebx
mov byte [esi - 4], bl
mov al, byte [esp + 0xb0]
ror dword [esp + 0xbc], 8
mov byte [esi], al
mov al, byte [esp + 0xbc]
ror dword [esp + 0xb0], 8
mov byte [esi - 5], al
mov al, byte [esp + 0xb0]
ror dword [esp + 0xbc], 8
mov byte [esi - 1], al
mov al, byte [esp + 0xbc]
ror dword [esp + 0xb0], 8
mov byte [esi - 6], al
mov al, byte [esp + 0xb0]
ror dword [esp + 0xbc], 8
mov byte [esi - 2], al
ror dword [esp + 0xb0], 8
mov al, byte [esp + 0xbc]
mov byte [esi - 7], al
mov al, byte [esp + 0xb0]
mov byte [esi - 3], al
add esi, 8
mov ebx, dword [esp + 0xbc]
mov ecx, dword [esp + 0xb0]
mov eax, dword [esp + 0x48]
ror ecx, 8
ror ebx, 8
sub dword [esp + 0x50], 1
mov dword [esp + 0x4c], esi
mov esi, dword [esp + 0x5c]
mov dword [esp + 0xbc], ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xb0], ecx
mov dword [esp + 0x44], eax
jne 0x10013a84
mov esi, dword [esp + 0x8c]
xor ebx, ebx
mov ecx, dword [esp + 0x70]
mov eax, ebx
test esi, esi
je 0x10013dd3
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0x10013dcb
mov edi, dword [esp + 0x9c]
movzx eax, dl
cdq
cmp eax, dword [esi + edi]
jne 0x10013e49
cmp edx, dword [esi + edi + 4]
jne 0x10013e49
mov edi, ecx
mov dword [esp + 0x40], esi
mov ecx, ebx
mov esi, ebx
jmp 0x10013e50
mov ecx, ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xb0], ecx
test edi, edi
jns 0x10013a32
neg edi
shl edi, 3
mov ecx, edi
shr eax, cl
shl eax, cl
mov dword [esp + 0x34], eax
mov dword [esp + 0xbc], eax
jmp 0x10013a32
or dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x44], ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xb0], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0xbc], eax
jmp 0x10013a39
mov esi, 0xc004d501
mov edi, ebx
test ecx, ecx
je 0x10013e63
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x10013e7c
mov eax, dword [esp + 0x40]
mov esi, 0x10000000
mov dword [esp + 0x20], edi
mov edi, ebx
mov dword [esp + 0x78], eax
jmp 0x10013e81
mov esi, 0xd0000001
mov dword [esp + 0x10], esi
test edi, edi
je 0x10013e98
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x100140b1
mov edx, dword [esp + 0x78]
cmp edx, 4
jb 0x100140a2
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov dword [esp + 0x48], eax
lea eax, [edi + 4]
cmp eax, edi
jb 0x10013ec2
mov ecx, eax
jmp 0x10013ec5
or ecx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x100140a7
lea eax, [edx - 4]
cmp eax, 4
jb 0x100140a2
mov eax, dword [ecx]
mov dword [esp + 0x68], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x10013ef4
mov edi, eax
jmp 0x10013ef7
or edi, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x100140a7
mov ecx, dword [esp + 0x68]
lea eax, [edx - 8]
cmp eax, ecx
jb 0x100140a2
lea eax, [ecx + 8]
cmp eax, 8
sbb esi, esi
and esi, 0xc0000095
cmp eax, 8
jb 0x100140a7
mov eax, dword [esp + 0x20]
lea edx, [edi + ecx]
mov esi, dword [esp + 0x78]
add eax, esi
cmp eax, edx
jb 0x100140a2
sub esi, edi
sub esi, ecx
add esi, dword [esp + 0x20]
cmp esi, 8
jae 0x100140a2
mov dword [esp + 0x78], ebx
mov eax, ebx
mov dword [esp + 0x70], eax
mov esi, ebx
test edi, edi
je 0x1001403c
mov ecx, edi
cmp edx, edi
jb 0x10013f77
mov eax, edx
mov dword [esp + 0x50], edx
jmp 0x10013f7e
or eax, 0xffffffff
mov dword [esp + 0x50], eax
cmp edx, edi
sbb esi, esi
and esi, 0xc0000095
cmp edx, edi
jb 0x10014091
cmp edi, eax
jae 0x10014032
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x10013fa5
mov dword [esp + 0x4c], edx
jmp 0x10013faa
or dword [esp + 0x4c], 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
cmp edx, ecx
jb 0x10014091
cmp dword [esp + 0x4c], eax
ja 0x1001405f
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0x10013fd4
mov edx, eax
jmp 0x10013fd7
or edx, 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
cmp eax, 4
jb 0x10013ff0
mov dword [esp + 0x188], edx
jmp 0x10013ff7
mov edx, dword [esp + 0x188]
cmp eax, 4
jb 0x10014091
lea eax, [edx + ecx]
cmp eax, ecx
jb 0x1001400b
mov edx, eax
jmp 0x1001400e
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10014091
mov eax, dword [esp + 0x50]
cmp edx, eax
ja 0x1001405f
inc dword [esp + 0x78]
mov ecx, edx
cmp edx, eax
jb 0x10013f98
cmp ecx, eax
jne 0x1001405f
mov ecx, dword [esp + 0x68]
mov eax, ebx
test ecx, ecx
je 0x1001406c
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x70], eax
test eax, eax
jne 0x10014066
mov esi, 0xc0000017
jmp 0x10014091
mov esi, 0xc000000d
jmp 0x100140a7
mov ecx, dword [esp + 0x68]
mov esi, ebx
test edi, edi
je 0x1001407f
push ecx
push edi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x7c]
add esp, 0xc
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x11c], eax
test esi, esi
js 0x100140a7
mov eax, dword [esp + 0x48]
cmp eax, dword [esp + 0x11c]
je 0x100140a7
mov esi, 0xc000003e
or esi, 0x10000000
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x88]
test eax, eax
je 0x100140cb
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x64]
test edi, edi
je 0x10014130
cmp dword [edi + 4], 0
je 0x100140ed
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x10014107
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x10014121
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x10014147
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x1001415e
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x58]
test edi, edi
je 0x100141c3
cmp dword [edi + 4], 0
je 0x10014180
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x1001419a
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x100141b4
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x100141da
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x10011e07
xor eax, eax
inc eax
cmp dword [esp + 0x11c], eax
jae 0x100141f8
mov esi, 0xc004d501
jmp 0x10011e03
cmp dword [esp + 0x124], 0
jne 0x10014276
mov esi, 0xc000000d
mov dword [esp + 0x10], esi
mov eax, ebx
test esi, esi
js 0x10011e07
cmp eax, 0xd0000023
jne 0x10014225
mov eax, 0x8007007a
mov dword [esp + 0x3c], eax
cmp eax, 0x8007007a
je 0x1001423a
mov esi, eax
mov dword [esp + 0x10], esi
test eax, eax
js 0x10011e07
cmp dword [esp + 0x11c], 6
jne 0x100141ee
cmp dword [esp + 0x124], 0
jne 0x100142e7
mov edx, dword [esp + 0x1cc]
mov esi, 0xc000000d
mov ecx, dword [esp + 0x1c8]
mov dword [esp + 0x10], esi
mov dword [esp + 0x6c], edx
mov dword [esp + 0x58], ecx
jmp 0x100143ab
cmp dword [esp + 0x11c], 0
jbe 0x10014202
mov eax, dword [esp + 0x124]
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x10014294
mov edi, ecx
jmp 0x10014297
or edi, 0xffffffff
cmp ecx, dword [esp + 0x124]
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp ecx, dword [esp + 0x124]
jb 0x100142bd
mov eax, edx
neg eax
sbb eax, eax
and eax, edi
jmp 0x100142cb
mov edx, dword [esp + 0x274]
mov eax, dword [esp + 0x268]
test esi, esi
js 0x1001420b
cmp edx, 4
jne 0x10012041
mov eax, dword [eax]
mov dword [esp + 0x3c], eax
jmp 0x1001420d
mov eax, dword [esp + 0x124]
mov edi, ebx
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [esp + 0x48], ecx
cmp edx, eax
jb 0x10014301
mov ecx, edx
jmp 0x10014304
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp edx, eax
jb 0x1001436b
mov eax, dword [esp + 0x48]
add eax, ecx
mov edx, eax
cmp eax, ecx
jae 0x10014325
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp edx, ecx
jb 0x1001436b
xor ecx, ecx
inc edi
inc ecx
cmp edi, ecx
jb 0x100142f0
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x1001434c
mov edi, ecx
jmp 0x1001434f
or edi, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp ecx, eax
jb 0x1001436b
mov eax, edx
neg eax
sbb eax, eax
and eax, edi
jmp 0x10014379
mov edx, dword [esp + 0x26c]
mov eax, dword [esp + 0x270]
test esi, esi
js 0x10014395
cmp edx, 8
jne 0x10012041
mov ecx, dword [eax]
mov dword [esp + 0x58], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x6c], ecx
jmp 0x100143ab
mov eax, dword [esp + 0x1cc]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x1c8]
mov dword [esp + 0x58], eax
test esi, esi
js 0x10011e07
cmp dword [esp + 0x124], 0
jne 0x100143f1
mov esi, 0xc000000d
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x18c]
mov dword [esp + 0x20], eax
test esi, esi
js 0x10011e07
cmp dword [esp + 0x124], 0
jne 0x10014499
mov esi, 0xc000000d
jmp 0x10011e03
mov eax, dword [esp + 0x124]
mov edi, ebx
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [esp + 0x48], ecx
cmp edx, eax
jb 0x1001440b
mov ecx, edx
jmp 0x1001440e
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp edx, eax
jb 0x10014473
mov eax, dword [esp + 0x48]
add eax, ecx
mov edx, eax
cmp eax, ecx
jae 0x1001442f
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp edx, ecx
jb 0x10014473
inc edi
cmp edi, 2
jb 0x100143fa
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x10014454
mov edi, ecx
jmp 0x10014457
or edi, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp ecx, eax
jb 0x10014473
mov eax, edx
neg eax
sbb eax, eax
and eax, edi
jmp 0x10014481
mov edx, dword [esp + 0x224]
mov eax, dword [esp + 0x228]
test esi, esi
js 0x100143c6
cmp edx, 4
jne 0x10012041
mov eax, dword [eax]
jmp 0x100143cd
mov eax, dword [esp + 0x124]
mov edi, ebx
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [esp + 0x48], ecx
cmp edx, eax
jb 0x100144b3
mov ecx, edx
jmp 0x100144b6
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp edx, eax
jb 0x1001451d
mov eax, dword [esp + 0x48]
add eax, ecx
mov edx, eax
cmp eax, ecx
jae 0x100144d7
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp edx, ecx
jb 0x1001451d
inc edi
cmp edi, 3
jb 0x100144a2
mov edi, dword [eax]
lea ecx, [eax + 4]
mov dword [esp + 0x50], edi
cmp ecx, eax
jb 0x10014500
mov edx, ecx
jmp 0x10014503
or edx, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp ecx, eax
jb 0x1001451d
neg edi
sbb edi, edi
and edi, edx
jmp 0x1001452f
mov eax, dword [esp + 0x22c]
mov edi, dword [esp + 0x230]
mov dword [esp + 0x50], eax
test esi, esi
js 0x10011e07
mov eax, dword [esp + 0x124]
mov dword [esp + 0x2c], ebx
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [esp + 0x48], ecx
cmp edx, eax
jb 0x10014553
mov ecx, edx
jmp 0x10014556
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp edx, eax
jb 0x100145c9
mov eax, dword [esp + 0x48]
add eax, ecx
mov edx, eax
cmp eax, ecx
jae 0x10014577
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp edx, ecx
jb 0x100145c9
mov ecx, dword [esp + 0x2c]
inc ecx
mov dword [esp + 0x2c], ecx
cmp ecx, 4
jb 0x10014542
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x100145a6
mov dword [esp + 0x2c], ecx
jmp 0x100145ab
or dword [esp + 0x2c], 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp ecx, eax
jb 0x100145c9
mov eax, edx
neg eax
sbb eax, eax
and eax, dword [esp + 0x2c]
jmp 0x100145d7
mov edx, dword [esp + 0x234]
mov eax, dword [esp + 0x238]
test esi, esi
js 0x100145e8
cmp edx, 4
jne 0x10012041
mov eax, dword [eax]
jmp 0x100145ef
mov eax, dword [esp + 0x23c]
mov dword [esp + 0x4c], eax
test esi, esi
js 0x10011e07
mov eax, dword [esp + 0x124]
mov dword [esp + 0x2c], ebx
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [esp + 0x48], ecx
cmp edx, eax
jb 0x10014617
mov ecx, edx
jmp 0x1001461a
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp edx, eax
jb 0x1001468d
mov eax, dword [esp + 0x48]
add eax, ecx
mov edx, eax
cmp eax, ecx
jae 0x1001463b
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp edx, ecx
jb 0x1001468d
mov ecx, dword [esp + 0x2c]
inc ecx
mov dword [esp + 0x2c], ecx
cmp ecx, 5
jb 0x10014606
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x1001466a
mov dword [esp + 0x2c], ecx
jmp 0x1001466f
or dword [esp + 0x2c], 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [esp + 0x10], esi
cmp ecx, eax
jb 0x1001468d
mov eax, edx
neg eax
sbb eax, eax
and eax, dword [esp + 0x2c]
jmp 0x1001469b
mov edx, dword [esp + 0x240]
mov eax, dword [esp + 0x244]
test esi, esi
js 0x100146ac
cmp edx, 4
jne 0x10012041
mov ecx, dword [eax]
jmp 0x100146ae
mov ecx, ebx
test esi, esi
js 0x10011e07
mov eax, dword [esp + 0x90]
cmp eax, dword [esp + 0x58]
jne 0x100141ee
mov eax, dword [esp + 0x94]
cmp eax, dword [esp + 0x6c]
jne 0x100141ee
cmp dword [esp + 0x4c], 4
mov dword [esp + 0x74], ecx
jbe 0x100146fc
mov eax, dword [esp + 0x20]
mov esi, 0x8007007a
mov dword [esp + 0x10], esi
mov dword [esp + 0x128], eax
jmp 0x10011e07
mov eax, dword [esp + 0x50]
cmp eax, 4
ja 0x100146e3
push eax
push edi
push dword [esp + 0x38]
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x2c]
add esp, 0xc
mov dword [esp + 0x128], eax
test esi, esi
js 0x10011e07
mov eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x14]
test eax, eax
je 0x10011e0b
mov esi, eax
jmp 0x10011dac
mov esi, dword [0x100ce25c]
mov ecx, esi
call dword [0x100d6738]
call esi
mov dword [0x100d4fa8], eax
mov eax, dword [0x100d4fb0]
push 0x54
mov dword [esp + 0x70], eax
lea eax, [esp + 0x27c]
push ebx
push eax
mov dword [0x100d4fac], edx
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [esp + 0x1e0], ebx
lea edi, [esp + 0x5f4]
mov dword [esp + 0x1e4], ebx
stosd dword es:[edi], eax
add esp, 0xc
mov dword [esp + 0x48], ebx
stosd dword es:[edi], eax
push 0x2c
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x7b0]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0x40], ebx
xor ebx, ebx
mov edx, 0x100d55d8
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x100147b1
mov eax, dword [0x100d55d4]
push 0
pop ebx
test eax, eax
jne 0x10014d80
push 0x338
push ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x78], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [esp + 0x58], edi
test edi, edi
je 0x10014d1f
or dword [esp + 0x2c], 0xffffffff
mov eax, 0x7f1137f
mov edx, eax
mov dword [esp + 0x680], 0xab69605e
movzx esi, word [esp + 0x682]
mov cl, bl
shr edx, 0x10
add edi, 7
mov dword [esp + 0x684], eax
movzx eax, ax
mov dword [esp + 0x1c], esi
mov esi, 0x10006d7a
mov dword [esp + 0x24], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], 0x67
movzx edx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl edx, 8
or edx, eax
shl edi, 8
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
or edi, eax
mov dword [esp + 0x5c], edx
movzx eax, byte [esi + 4]
xor ebx, edx
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
add esi, 8
shl edi, 8
or edi, eax
mov dword [esp + 0x9c], esi
mov esi, ebx
mov eax, 0x7f1137f
xor esi, eax
xor esi, edi
xor esi, dword [esp + 0xc8]
xor esi, 0xab69605e
mov eax, esi
rol eax, 0xa
lea edx, [esi + 0x54969fa2]
rol edx, 5
imul edx, dword [esp + 0x18]
add edx, eax
xor ebx, edx
mov edx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [esp + 0x1c]
sub edx, eax
xor esi, edx
mov eax, esi
sub eax, dword [esp + 0x18]
imul edx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, dword [esp + 0x1c]
xor edx, ebx
mov eax, ebx
rol edx, 6
imul edx, dword [esp + 0x28]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, dword [esp + 0x18]
xor eax, ebx
mov edx, ebx
imul eax, dword [esp + 0x1c]
ror edx, 6
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
add eax, esi
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor ebx, edx
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
mov eax, ebx
imul edx, dword [esp + 0x28]
rol eax, 8
sub edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, dword [esp + 0x18]
xor edx, eax
xor ebx, edx
mov edx, dword [esp + 0x28]
xor edx, ebx
mov eax, ebx
imul edx, dword [esp + 0x1c]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [esp + 0x28]
xor ebx, eax
mov esi, ebx
sub esi, dword [esp + 0x28]
xor esi, edx
mov edx, dword [esp + 0x28]
xor esi, 0xab69605e
xor edx, esi
mov eax, esi
rol edx, 2
imul edx, dword [esp + 0x18]
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [esp + 0x1c]
rol eax, 7
add edx, eax
mov eax, dword [esp + 0x18]
xor esi, edx
xor eax, esi
mov edx, esi
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
xor ebx, edx
mov edx, dword [esp + 0x1c]
xor edx, ebx
mov dword [esp + 0x30], ebx
rol edx, 5
mov eax, ebx
imul edx, dword [esp + 0x28]
rol eax, 7
add edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov ebx, edx
xor ebx, dword [esp + 0x30]
xor ebx, esi
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [esp + 0x1c]
imul eax, dword [esp + 0x18]
xor esi, eax
mov eax, esi
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [esp + 0x28]
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [esp + 0x18]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
shr eax, 3
xor edx, 0x605e
imul edx, dword [esp + 0x1c]
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
xor eax, esi
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [esp + 0x2c]
rol eax, 2
mov dword [esp + 0xc8], esi
mov esi, dword [esp + 0x9c]
xor edx, eax
mov dword [esp + 0x2c], edi
xor edx, dword [esp + 0x24]
xor ebx, edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0xfc], ebx
mov byte [edx - 4], bl
mov al, byte [esp + 0xc8]
ror dword [esp + 0xfc], 8
mov byte [edx], al
mov al, byte [esp + 0xfc]
ror dword [esp + 0xc8], 8
mov byte [edx - 5], al
mov al, byte [esp + 0xc8]
ror dword [esp + 0xfc], 8
mov byte [edx - 1], al
mov al, byte [esp + 0xfc]
ror dword [esp + 0xc8], 8
mov byte [edx - 6], al
mov al, byte [esp + 0xc8]
ror dword [esp + 0xfc], 8
mov byte [edx - 2], al
mov al, byte [esp + 0xfc]
ror dword [esp + 0xc8], 8
mov byte [edx - 7], al
mov al, byte [esp + 0xc8]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [esp + 0xfc]
ror dword [esp + 0xc8], 8
mov eax, dword [esp + 0x5c]
ror ebx, 8
sub dword [esp + 0x50], 1
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x4c], edx
jne 0x1001485b
mov esi, dword [esp + 0x58]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x10014b8d
movzx eax, cl
cdq
cmp eax, dword [0x100070b0]
jne 0x10014bbe
cmp edx, dword [0x100070b4]
jne 0x10014bbe
mov edi, esi
mov dword [esp + 0x24], 0x337
mov dword [esp + 0x20], edi
mov esi, ebx
jmp 0x10014bcd
or dword [esp + 0x24], 0xffffffff
mov edi, ebx
mov dword [esp + 0x70], 0xc004d501
test esi, esi
je 0x10014be0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x70], ebx
jl 0x10014d1f
mov eax, dword [esp + 0x24]
mov esi, edi
push 0x40
push ebx
push 0x100d4fd0
mov byte [eax + edi], bl
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], bl
je 0x10014d26
mov edi, 0x100d4fd0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [esp + 0x30], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10014c1b
sub ecx, dword [esp + 0x30]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x10014d1f
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [esp + 0x18], ecx
cmp word [eax], dx
je 0x10014c5d
mov ecx, 0xc000007b
mov dword [esp + 0x18], ecx
jmp 0x10014ca7
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x10014c52
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x10014c52
cmp dword [edx], 0x4550
jne 0x10014c52
movzx eax, word [edx + 0x18]
cmp ax, word [esp + 0x104]
je 0x10014c95
cmp ax, word [esp + 0xa0]
je 0x10014c95
mov ecx, 0xc000000d
jmp 0x10014c57
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], ebx
test eax, eax
je 0x10014d0a
mov edx, esi
mov dword [esp + 0x5c], esi
lea eax, [edx + 1]
mov dword [esp + 0x30], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x10014cc6
sub edx, dword [esp + 0x30]
inc esi
add esi, edx
test ecx, ecx
js 0x10014cf7
push dword [esp + 0x5c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10014d15
mov ecx, dword [esp + 0x3c]
mov dword [ecx*4 + 0x100ce210], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
inc dword [esp + 0x3c]
inc eax
mov dword [esp + 0x24], eax
cmp eax, dword [esp + 0x2c]
jb 0x10014cb9
add edi, 0x10
cmp byte [esi], bl
jne 0x10014c10
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x20]
jmp 0x10014d28
mov esi, 0xc000007a
jmp 0x10014d19
mov esi, ebx
test edi, edi
je 0x10014d3b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x10014d7b
mov esi, ebx
mov eax, dword [esi + 0x100d4fd0]
test eax, eax
je 0x10014d52
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10014d41
push 0x40
push ebx
push 0x100d4fd0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x100019e0
mov edi, 0x100ce210
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x10014d86
mov eax, dword [0x100d55d4]
inc eax
mov dword [0x100d55d4], eax
xor eax, eax
mov edx, 0x100d55d8
xchg dword [edx], eax
xor eax, eax
mov dword [esp + 0xaa8], ebx
lea edi, [esp + 0x178]
mov word [esp + 0xaac], bx
stosd dword es:[edi], eax
mov dword [esp + 0x94], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x158], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x658]
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10014dce
mov eax, dword [0x100d55d4]
push 0
pop ebx
test eax, eax
jne 0x10015396
push 0x338
push ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x78], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [esp + 0x58], edi
test edi, edi
je 0x10015335
or dword [esp + 0x2c], 0xffffffff
mov eax, 0x7f1137f
mov edx, eax
mov dword [esp + 0x688], 0xab69605e
movzx esi, word [esp + 0x68a]
mov cl, bl
shr edx, 0x10
add edi, 7
mov dword [esp + 0x68c], eax
movzx eax, ax
mov dword [esp + 0x1c], esi
mov esi, 0x10006d7a
mov dword [esp + 0x24], ebx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], 0x67
movzx edx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl edx, 8
or edx, eax
shl edi, 8
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
or edi, eax
mov dword [esp + 0x5c], edx
movzx eax, byte [esi + 4]
xor ebx, edx
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
add esi, 8
shl edi, 8
or edi, eax
mov dword [esp + 0x9c], esi
mov esi, edi
mov eax, 0x7f1137f
xor esi, dword [esp + 0xc4]
xor esi, ebx
xor esi, eax
xor esi, 0xab69605e
mov eax, esi
rol eax, 0xa
lea edx, [esi + 0x54969fa2]
rol edx, 5
imul edx, dword [esp + 0x18]
add edx, eax
xor ebx, edx
mov edx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [esp + 0x1c]
sub edx, eax
xor esi, edx
mov eax, esi
sub eax, dword [esp + 0x18]
imul edx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [esp + 0x1c]
rol edx, 6
imul edx, dword [esp + 0x28]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, dword [esp + 0x18]
xor eax, ebx
mov edx, ebx
imul eax, dword [esp + 0x1c]
ror edx, 6
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
add eax, esi
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor ebx, edx
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
mov eax, ebx
imul edx, dword [esp + 0x28]
rol eax, 8
sub edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, dword [esp + 0x18]
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [esp + 0x28]
imul edx, dword [esp + 0x1c]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [esp + 0x28]
xor ebx, eax
mov esi, ebx
sub esi, dword [esp + 0x28]
xor esi, edx
xor esi, 0xab69605e
mov edx, esi
mov eax, esi
xor edx, dword [esp + 0x28]
rol edx, 2
imul edx, dword [esp + 0x18]
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [esp + 0x1c]
rol eax, 7
add edx, eax
mov eax, dword [esp + 0x18]
xor esi, edx
xor eax, esi
mov edx, esi
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
xor ebx, edx
mov edx, ebx
mov dword [esp + 0x30], ebx
xor edx, dword [esp + 0x1c]
mov eax, ebx
rol edx, 5
imul edx, dword [esp + 0x28]
rol eax, 7
add edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov ebx, edx
xor ebx, esi
xor ebx, dword [esp + 0x30]
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [esp + 0x1c]
imul eax, dword [esp + 0x18]
xor esi, eax
mov eax, esi
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [esp + 0x28]
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [esp + 0x18]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
shr eax, 3
xor edx, 0x605e
imul edx, dword [esp + 0x1c]
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
xor eax, esi
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [esp + 0x2c]
rol eax, 2
mov dword [esp + 0xc4], esi
mov esi, dword [esp + 0x9c]
xor edx, eax
mov dword [esp + 0x2c], edi
xor edx, dword [esp + 0x24]
xor ebx, edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0xf8], ebx
mov byte [edx - 4], bl
mov al, byte [esp + 0xc4]
ror dword [esp + 0xf8], 8
mov byte [edx], al
mov al, byte [esp + 0xf8]
ror dword [esp + 0xc4], 8
mov byte [edx - 5], al
mov al, byte [esp + 0xc4]
ror dword [esp + 0xf8], 8
mov byte [edx - 1], al
mov al, byte [esp + 0xf8]
ror dword [esp + 0xc4], 8
mov byte [edx - 6], al
mov al, byte [esp + 0xc4]
ror dword [esp + 0xf8], 8
mov byte [edx - 2], al
mov al, byte [esp + 0xf8]
ror dword [esp + 0xc4], 8
mov byte [edx - 7], al
mov al, byte [esp + 0xc4]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [esp + 0xf8]
ror dword [esp + 0xc4], 8
mov eax, dword [esp + 0x5c]
ror ebx, 8
sub dword [esp + 0x50], 1
mov dword [esp + 0xf8], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x4c], edx
jne 0x10014e78
mov esi, dword [esp + 0x58]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x100151aa
movzx eax, cl
cdq
cmp eax, dword [0x100070b0]
jne 0x100151d6
cmp edx, dword [0x100070b4]
jne 0x100151d6
mov dword [esp + 0x44], esi
mov edi, 0x337
mov esi, ebx
jmp 0x100151e1
mov dword [esp + 0x70], 0xc004d501
or edi, 0xffffffff
test esi, esi
je 0x100151f4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x70], ebx
jl 0x10015335
mov eax, dword [esp + 0x44]
mov esi, eax
push 0x40
push ebx
push 0x100d4fd0
mov byte [edi + eax], bl
call sub.msvcrt.dll_memset
mov eax, esi
add esp, 0xc
cmp byte [eax], bl
je 0x1001533c
mov edi, 0x100d4fd0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [esp + 0x30], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10015231
sub ecx, dword [esp + 0x30]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x10015335
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [esp + 0x18], ecx
cmp word [eax], dx
je 0x10015273
mov ecx, 0xc000007b
mov dword [esp + 0x18], ecx
jmp 0x100152bd
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x10015268
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x10015268
cmp dword [edx], 0x4550
jne 0x10015268
movzx eax, word [edx + 0x18]
cmp ax, word [esp + 0x104]
je 0x100152ab
cmp ax, word [esp + 0xa0]
je 0x100152ab
mov ecx, 0xc000000d
jmp 0x1001526d
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], ebx
test eax, eax
je 0x10015320
mov edx, esi
mov dword [esp + 0x5c], esi
lea eax, [edx + 1]
mov dword [esp + 0x30], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x100152dc
sub edx, dword [esp + 0x30]
inc esi
add esi, edx
test ecx, ecx
js 0x1001530d
push dword [esp + 0x5c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001532b
mov ecx, dword [esp + 0x3c]
mov dword [ecx*4 + 0x100ce210], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
inc dword [esp + 0x3c]
inc eax
mov dword [esp + 0x24], eax
cmp eax, dword [esp + 0x2c]
jb 0x100152cf
add edi, 0x10
cmp byte [esi], bl
jne 0x10015226
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x44]
jmp 0x1001533e
mov esi, 0xc000007a
jmp 0x1001532f
mov esi, ebx
test eax, eax
je 0x10015351
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x10015391
mov esi, ebx
mov eax, dword [esi + 0x100d4fd0]
test eax, eax
je 0x10015368
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10015357
push 0x40
push ebx
push 0x100d4fd0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x100019e0
mov edi, 0x100ce210
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x1001539c
mov eax, dword [0x100d55d4]
inc eax
mov dword [0x100d55d4], eax
xor eax, eax
mov ecx, 0x100d55d8
xchg dword [ecx], eax
push 0x54
lea eax, [esp + 0x27c]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esp + 0x78]
add esp, 0xc
mov esi, dword [0x100ce28c]
mov ecx, eax
mov dword [esp + 0x5e8], ebx
push 0xf
pop edx
and ecx, edx
mov dword [esp + 0x64], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [esp + 0xaa8], cx
mov ecx, eax
shr ecx, 8
push 0x403
and ecx, edx
shr eax, 0xc
push ebx
mov word [esp + 0xab2], cx
and eax, edx
push ebx
mov ecx, esi
mov word [esp + 0xab8], ax
call dword [0x100d6738]
call esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], 0xffffff
test eax, eax
jne 0x10015452
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
jle 0x1001543f
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0x14], edi
test edi, edi
js 0x10016a0d
mov dword [esp + 0x14], 0x80004005
jmp 0x10016a0d
mov esi, dword [0x100ce260]
lea eax, [esp + 0x150]
push eax
push ebx
lea eax, [esp + 0x13c]
mov dword [esp + 0x15c], ebx
push eax
mov edi, ebx
mov dword [esp + 0x148], ebx
push 8
mov ecx, esi
mov dword [esp + 0xac], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x160], ebx
call dword [0x100d6738]
call esi
test eax, eax
jne 0x100154e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
jle 0x100154cf
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0x14], edi
test edi, edi
js 0x1001562f
mov edi, 0x80004005
mov dword [esp + 0x14], edi
jmp 0x1001562f
mov eax, dword [esp + 0x150]
add eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [esp + 0x12c]
mov esi, eax
call fcn.1002ad14
test esi, esi
jne 0x1001551b
mov dword [esp + 0x12c], ebx
mov edi, 0x8007000e
jmp 0x100154da
mov eax, dword [esp + 0x134]
mov dword [esp + 0x12c], esi
lea eax, [eax*4 + 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [esp + 0x10c]
mov esi, eax
call fcn.1002ad14
test esi, esi
jne 0x1001555f
mov edi, 0x8007000e
mov dword [esp + 0x14], edi
jmp 0x10015628
lea eax, [esp + 0x150]
mov dword [esp + 0x10c], esi
mov esi, dword [0x100ce260]
mov ecx, esi
push eax
push dword [esp + 0x130]
lea eax, [esp + 0x13c]
push eax
push 8
call dword [0x100d6738]
call esi
test eax, eax
je 0x100154b0
cmp dword [esp + 0x134], 0
mov edx, dword [esp + 0x10c]
mov eax, dword [esp + 0x12c]
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], ebx
jbe 0x10015608
mov edi, eax
mov esi, dword [0x100ce268]
mov ecx, esi
push ebx
push edi
call dword [0x100d6738]
call esi
mov edx, dword [esp + 0x24]
mov ecx, edi
mov dword [edx], eax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x100155d6
mov eax, dword [esp + 0x2c]
sub ecx, esi
sar ecx, 1
add edx, 4
mov dword [esp + 0x24], edx
lea edi, [edi + ecx*2]
add edi, 2
inc eax
mov dword [esp + 0x2c], eax
cmp eax, dword [esp + 0x134]
jb 0x100155b9
mov edi, dword [esp + 0x14]
mov dword [edx], 0x409
mov eax, dword [esp + 0x10c]
mov dword [esp + 0x154], eax
mov eax, dword [esp + 0x134]
inc eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x10c], ebx
lea ecx, [esp + 0x10c]
call fcn.100111cc
lea ecx, [esp + 0x12c]
call fcn.1002ad14
test edi, edi
js 0x10015d40
cmp dword [esp + 0x24], 0
mov edi, ebx
mov dword [esp + 0x3c], edi
mov esi, ebx
jbe 0x10015688
mov eax, dword [esp + 0x154]
mov edx, ebx
mov ecx, dword [eax + esi*4]
cmp ecx, dword [edx*4 + 0x10006980]
je 0x10015682
inc edx
cmp edx, 0x26
jb 0x10015667
inc esi
cmp esi, dword [esp + 0x24]
jb 0x10015665
jmp 0x10015688
mov edi, edx
mov dword [esp + 0x3c], edx
mov esi, dword [0x100ce264]
lea eax, [esp + 0xab0]
push ebx
push 0x55
push eax
push dword [edi*4 + 0x10006980]
mov ecx, esi
mov dword [esp + 0x80], ebx
call dword [0x100d6738]
call esi
test eax, eax
je 0x100156f0
mov esi, dword [0x100ce258]
lea eax, [esp + 0x920]
push 0x10
push eax
push 0x58
lea eax, [esp + 0xabc]
mov ecx, esi
push eax
call dword [0x100d6738]
call esi
test eax, eax
jle 0x100156f0
mov edi, dword [esp + 0x92c]
xor eax, eax
shr edi, 0x1b
inc eax
and edi, eax
mov dword [esp + 0x70], edi
mov edx, 0x10006a98
mov esi, ebx
mov ecx, edx
mov dword [esp + esi*4 + 0xa58], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10015703
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0x100156f7
imul ecx, dword [esp + 0x3c], 3
movzx eax, byte [ecx + 0x10006a18]
mov esi, dword [esp + eax*4 + 0xa58]
movzx eax, byte [ecx + 0x10006a19]
mov dword [esp + 0x8c], esi
mov dword [esp + 0x178], esi
mov eax, dword [esp + eax*4 + 0xa58]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x17c], eax
movzx eax, byte [ecx + 0x10006a1a]
mov esi, dword [esp + eax*4 + 0xa58]
mov dword [esp + 0x58], esi
mov dword [esp + 0x180], esi
push 0x1c90
mov eax, ebx
push ebx
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [esp + 0x68], edi
test edi, edi
je 0x10015be9
or dword [esp + 0x2c], 0xffffffff
mov ecx, 0x7f1137f
mov edx, ecx
mov dword [esp + 0x690], 0xab69605e
movzx esi, word [esp + 0x692]
mov al, bl
shr edx, 0x10
add edi, 7
mov dword [esp + 0x694], ecx
movzx ecx, cx
mov dword [esp + 0x44], esi
mov esi, 0x100070ba
mov dword [esp + 0x24], ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], 0x392
movzx edx, byte [esi - 2]
movzx ecx, byte [esi - 1]
movzx edi, byte [esi + 2]
shl edx, 8
or edx, ecx
shl edi, 8
movzx ecx, byte [esi]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 3]
or edi, ecx
mov dword [esp + 0x5c], edx
movzx ecx, byte [esi + 4]
xor ebx, edx
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 5]
add esi, 8
shl edi, 8
or edi, ecx
mov dword [esp + 0x78], esi
mov ecx, 0x7f1137f
mov esi, edi
xor esi, ecx
xor esi, dword [esp + 0xcc]
xor esi, ebx
xor esi, 0xab69605e
mov ecx, esi
rol ecx, 0xa
lea edx, [esi + 0x54969fa2]
rol edx, 5
imul edx, dword [esp + 0x18]
add edx, ecx
xor ebx, edx
mov edx, 0x7f1137f
mov ecx, ebx
rol ecx, 2
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [esp + 0x44]
sub edx, ecx
xor esi, edx
mov ecx, esi
sub ecx, dword [esp + 0x18]
imul edx, ecx, 0x605e
mov ecx, esi
shr ecx, 0xd
sub edx, ecx
xor ebx, edx
mov edx, dword [esp + 0x44]
xor edx, ebx
mov ecx, ebx
rol edx, 6
imul edx, dword [esp + 0x34]
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub ecx, edx
xor ebx, ecx
mov ecx, dword [esp + 0x18]
xor ecx, ebx
mov edx, ebx
imul ecx, dword [esp + 0x44]
ror edx, 6
xor edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
add ecx, esi
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, esi
rol ecx, 2
add edx, ecx
xor ebx, edx
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
mov ecx, ebx
imul edx, dword [esp + 0x34]
rol ecx, 8
sub edx, ecx
xor esi, edx
mov edx, esi
mov ecx, esi
xor edx, 0xab69605e
ror ecx, 0xa
ror edx, 0xc
imul edx, dword [esp + 0x18]
xor edx, ecx
xor ebx, edx
mov edx, dword [esp + 0x34]
xor edx, ebx
mov ecx, ebx
imul edx, dword [esp + 0x44]
shr ecx, 0xa
xor edx, ecx
xor edx, esi
mov ecx, edx
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, dword [esp + 0x34]
xor ebx, ecx
mov esi, ebx
sub esi, dword [esp + 0x34]
xor esi, edx
mov edx, dword [esp + 0x34]
xor esi, 0xab69605e
xor edx, esi
mov ecx, esi
rol edx, 2
imul edx, dword [esp + 0x18]
shr ecx, 2
add edx, ecx
mov ecx, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, ecx
mov ecx, ebx
ror edx, 6
imul edx, dword [esp + 0x44]
rol ecx, 7
add edx, ecx
mov ecx, dword [esp + 0x18]
xor esi, edx
xor ecx, esi
mov edx, esi
imul ecx, ecx, 0x605e
ror edx, 9
add edx, ecx
xor ebx, edx
mov edx, dword [esp + 0x44]
xor edx, ebx
mov dword [esp + 0x30], ebx
rol edx, 5
mov ecx, ebx
imul edx, dword [esp + 0x34]
rol ecx, 7
add edx, ecx
xor esi, edx
mov edx, 0x7f1137f
mov ebx, edx
xor ebx, dword [esp + 0x30]
xor ebx, esi
xor ebx, 0xab69605e
mov ecx, ebx
ror ecx, 3
sub ecx, dword [esp + 0x44]
imul ecx, dword [esp + 0x18]
xor esi, ecx
mov ecx, esi
sub ecx, edx
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, esi
ror ecx, 6
sub edx, ecx
xor ebx, edx
mov ecx, ebx
rol ecx, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [esp + 0x34]
add edx, ecx
xor esi, edx
mov ecx, esi
ror ecx, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [esp + 0x18]
sub edx, ecx
xor ebx, edx
mov edx, ebx
mov ecx, ebx
shr ecx, 3
xor edx, 0x605e
imul edx, dword [esp + 0x44]
xor edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
xor ecx, esi
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, esi
xor esi, dword [esp + 0x2c]
rol ecx, 2
mov dword [esp + 0xcc], esi
mov esi, dword [esp + 0x78]
xor edx, ecx
mov dword [esp + 0x2c], edi
xor edx, dword [esp + 0x24]
xor ebx, edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0xf0], ebx
mov byte [edx - 4], bl
mov cl, byte [esp + 0xcc]
ror dword [esp + 0xf0], 8
mov byte [edx], cl
mov cl, byte [esp + 0xf0]
ror dword [esp + 0xcc], 8
mov byte [edx - 5], cl
mov cl, byte [esp + 0xcc]
ror dword [esp + 0xf0], 8
mov byte [edx - 1], cl
mov cl, byte [esp + 0xf0]
ror dword [esp + 0xcc], 8
mov byte [edx - 6], cl
mov cl, byte [esp + 0xcc]
ror dword [esp + 0xf0], 8
mov byte [edx - 2], cl
mov cl, byte [esp + 0xf0]
ror dword [esp + 0xcc], 8
mov byte [edx - 7], cl
mov cl, byte [esp + 0xcc]
mov byte [edx - 3], cl
add edx, 8
mov ebx, dword [esp + 0xf0]
ror dword [esp + 0xcc], 8
mov ecx, dword [esp + 0x5c]
ror ebx, 8
sub dword [esp + 0x50], 1
mov dword [esp + 0xf0], ebx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x4c], edx
jne 0x100157f8
mov ecx, dword [esp + 0x68]
xor ebx, ebx
mov edx, ebx
mov esi, 0x1c90
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0x10015b2a
movzx eax, al
cdq
cmp eax, dword [0x10008d48]
jne 0x10015b5c
cmp edx, dword [0x10008d4c]
jne 0x10015b5c
mov edi, dword [esp + 0x14]
mov dword [esp + 0x13c], ecx
mov ecx, ebx
mov dword [esp + 0x9c], esi
jmp 0x10015b65
mov edi, 0xc004d501
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10015b78
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
js 0x10015d64
mov edi, dword [esp + 0x13c]
mov esi, ebx
mov edx, ebx
mov ebx, dword [esp + 0x3c]
cmp ebx, edx
jne 0x10015b9a
mov dword [esp + esi*4 + 0xa40], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [esp + 0x30], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10015ba3
sub ecx, dword [esp + 0x30]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0x10015b8f
inc esi
push 0
pop ebx
cmp esi, 6
jb 0x10015b89
push 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [esp + 0xe0]
mov edi, eax
call fcn.1002ad14
test edi, edi
jne 0x10015bf7
mov dword [esp + 0xe0], ebx
mov edi, 0x8007000e
mov dword [esp + 0x14], edi
jmp 0x10015d64
mov dword [esp + 0xe0], edi
lea ecx, [esp + 0xaa8]
xor eax, eax
mov dword [esp + 0x24], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, ebx
movzx edx, word [ecx]
mov eax, ebx
cmp dx, word [eax*2 + 0x10006a8c]
je 0x10015c2a
inc eax
cmp eax, 6
jb 0x10015c15
jmp 0x10015cdc
mov edx, dword [esp + eax*4 + 0xa40]
mov ecx, edx
mov dword [esp + 0x30], edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10015c3a
sub ecx, esi
mov esi, dword [0x100ce270]
push ebx
push ebx
lea eax, [ecx + 1]
mov ecx, esi
push eax
push edx
push ebx
push 0xfde9
call dword [0x100d6738]
call esi
mov esi, eax
test esi, esi
je 0x10015d15
lea ecx, [esi + esi]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [esp + 0xe0]
mov dword [ecx + edi], eax
mov eax, dword [esp + 0xe0]
cmp dword [eax + edi], ebx
je 0x10015be9
mov edx, dword [esp + 0x30]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [esp + 0x30], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10015ca3
sub ecx, dword [esp + 0x30]
mov eax, dword [esp + 0xe0]
push esi
mov esi, dword [0x100ce270]
push dword [eax + edi]
lea eax, [ecx + 1]
mov ecx, esi
push eax
push edx
push ebx
push 0xfde9
call dword [0x100d6738]
call esi
test eax, eax
je 0x10015d15
mov ecx, dword [esp + 0x24]
add ecx, 2
add edi, 4
mov dword [esp + 0x24], ecx
cmp edi, 0xc
jb 0x10015c10
mov eax, dword [esp + 0xe0]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x158], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0xe0], ebx
mov dword [esp + 0x278], eax
jmp 0x10015d64
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
jle 0x10015d34
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0x14], edi
test edi, edi
js 0x10015d64
mov edi, 0x80004005
jmp 0x10015bee
mov eax, dword [esp + 0x180]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x17c]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x178]
mov dword [esp + 0x8c], eax
cmp dword [esp + 0xe0], 0
je 0x10015dce
mov esi, ebx
mov eax, dword [esp + 0xe0]
cmp dword [eax + esi], ebx
je 0x10015dc6
mov ecx, dword [eax + esi]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10015d82
mov eax, dword [esp + 0xe0]
sub ecx, edx
sar ecx, 1
mov eax, dword [eax + esi]
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x10015dae
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x10015da6
mov eax, dword [esp + 0xe0]
push dword [eax + esi]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esi, 4
cmp esi, 0xc
jb 0x10015d70
mov eax, dword [esp + 0x13c]
test eax, eax
je 0x10015dec
mov ecx, dword [esp + 0x9c]
test ecx, ecx
je 0x10015dec
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x10015de4
lea ecx, [esp + 0xe0]
call fcn.1002ad14
lea ecx, [esp + 0x13c]
call fcn.1002ad14
lea ecx, [esp + 0x154]
call fcn.1002ad14
test edi, edi
js 0x100169f8
mov eax, dword [esp + 0x158]
lea edi, [esp + 0x218]
mov esi, dword [0x100ce2c4]
push ebx
mov ecx, dword [eax]
mov dword [esp + 0x284], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x288], ecx
mov ecx, esi
mov eax, dword [eax + 8]
mov dword [esp + 0x28c], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x21c]
push eax
push ebx
mov edi, ebx
mov dword [esp + 0x224], 0xc
push 0x42
mov dword [esp + 0x24], edi
call dword [0x100d6738]
call esi
test eax, eax
jne 0x10015ea7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
jle 0x10015e98
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0x14], edi
test edi, edi
mov eax, ebx
js 0x10015eb3
mov edi, 0x80004005
mov dword [esp + 0x14], edi
jmp 0x10015eb3
mov eax, dword [esp + 0x21c]
xor ecx, ecx
inc ecx
and eax, ecx
mov dword [esp + 0x27c], eax
test edi, edi
js 0x100169f8
mov eax, dword [esp + 0x64]
push 0x2a
pop ecx
mov dword [esp + 0x20], ecx
sub eax, 1
je 0x10015efe
sub eax, 1
je 0x10015ef1
sub eax, 1
jne 0x10015f10
mov edi, 0xe1
mov dword [esp + 0x94], edi
mov dword [esp + 0x90], edi
jmp 0x10015f10
mov dword [esp + 0x94], 0xf
jmp 0x10015f05
mov dword [esp + 0x94], ecx
mov dword [esp + 0x90], 0xb
mov esi, 0xdc
mov dword [esp + 0x74], 0x60
push esi
lea eax, [esp + 0x944]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov word [esp + 0x984], si
mov esi, dword [0x100ce280]
lea eax, [esp + 0x940]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0x100d6738]
call esi
test eax, eax
je 0x10015fa1
mov eax, dword [esp + 0x9ec]
movzx edi, word [esp + 0x9e6]
mov ecx, dword [esp + 0x9f0]
push 0x60
mov dword [esp + 0x40], eax
mov dword [esp + 0x664], eax
pop eax
mov dword [esp + 0x74], edi
mov dword [esp + 0x65c], ebx
mov dword [esp + 0x658], ebx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x664], ecx
cmp edi, eax
jae 0x10015fb7
mov dword [esp + 0x74], eax
jmp 0x10015fb7
mov eax, dword [esp + 0x664]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x660]
mov dword [esp + 0x3c], eax
xor eax, eax
inc eax
cmp dword [esp + 0x64], eax
mov eax, dword [esp + 0x8c]
je 0x10015fcb
mov eax, dword [esp + 0x58]
push 0x5c
mov dword [esp + 0x28], eax
lea eax, [esp + 0x804]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x100ce28c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [esp + 0x14], edi
push 0x403
push ebx
push ebx
call dword [0x100d6738]
call esi
mov dword [esp + 0x30], eax
test eax, eax
jne 0x10016039
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
jle 0x10016026
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0x14], edi
test edi, edi
js 0x100160e9
mov dword [esp + 0x14], 0x80004005
jmp 0x100169f8
mov esi, dword [0x100ce26c]
mov ecx, esi
push 0x48
push dword [esp + 0x78]
push dword [esp + 0x9c]
call dword [0x100d6738]
call esi
push dword [esp + 0x24]
neg eax
mov dword [esp + 0x814], 0x190
push 0x20
pop edx
lea ecx, [esp + 0x820]
mov dword [esp + 0x804], eax
mov byte [esp + 0x81e], 5
call fcn.1001ba04
mov esi, dword [0x100ce220]
lea eax, [esp + 0x800]
push eax
mov ecx, esi
call dword [0x100d6738]
call esi
test eax, eax
jne 0x100160cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
jle 0x100160c0
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0x14], edi
test edi, edi
js 0x100160d4
mov edi, 0x80004005
mov dword [esp + 0x14], edi
jmp 0x100160d4
mov dword [esp + 0x28c], eax
push dword [esp + 0x30]
mov esi, dword [0x100ce2c0]
mov ecx, esi
push ebx
call dword [0x100d6738]
call esi
test edi, edi
js 0x100169f8
xor eax, eax
inc eax
cmp dword [esp + 0x64], eax
je 0x10016105
mov eax, dword [esp + 0x58]
mov dword [esp + 0x8c], eax
push 0x5c
lea eax, [esp + 0x864]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x100ce28c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [esp + 0x14], edi
push 0x403
push ebx
push ebx
call dword [0x100d6738]
call esi
mov dword [esp + 0x30], eax
test eax, eax
jne 0x10016167
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
jle 0x1001615c
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0x14], edi
test edi, edi
js 0x1001621a
jmp 0x1001602c
mov esi, dword [0x100ce26c]
mov ecx, esi
push 0x48
push dword [esp + 0x78]
push dword [esp + 0x98]
call dword [0x100d6738]
call esi
push dword [esp + 0x8c]
neg eax
mov dword [esp + 0x874], 0x190
push 0x20
pop edx
lea ecx, [esp + 0x880]
mov dword [esp + 0x864], eax
mov byte [esp + 0x87e], 5
call fcn.1001ba04
mov esi, dword [0x100ce220]
lea eax, [esp + 0x860]
push eax
mov ecx, esi
call dword [0x100d6738]
call esi
test eax, eax
jne 0x100161fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
jle 0x100161f1
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0x14], edi
test edi, edi
js 0x10016205
mov edi, 0x80004005
mov dword [esp + 0x14], edi
jmp 0x10016205
mov dword [esp + 0x290], eax
push dword [esp + 0x30]
mov esi, dword [0x100ce2c0]
mov ecx, esi
push ebx
call dword [0x100d6738]
call esi
test edi, edi
js 0x100169f8
mov esi, dword [esp + 0x64]
mov ecx, ebx
mov eax, esi
mov edx, ebx
sub eax, 1
je 0x1001623b
sub eax, 1
je 0x10016277
sub eax, 1
jne 0x10016243
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x5f0], ecx
mov dword [esp + 0x5f4], edx
xor edx, edx
inc edx
cmp esi, edx
je 0x100162b9
lea eax, [esi - 2]
cmp eax, edx
ja 0x10016289
mov eax, ebx
mov dword [esp + 0x20], ebx
mov edx, ebx
mov dword [esp + 0x94], eax
mov dword [esp + 0x90], ebx
jmp 0x100162d2
mov eax, dword [esp + 0x3c]
cdq
and edx, 3
lea ecx, [edx + eax]
mov edx, ebx
sar ecx, 2
jmp 0x10016243
mov eax, dword [esp + 0x118]
mov edx, dword [esp + 0x118]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x118]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x118]
mov dword [esp + 0x94], eax
jmp 0x100162d2
mov edx, 0x96
mov dword [esp + 0x94], ebx
mov eax, ebx
mov dword [esp + 0x90], 0x20
mov dword [esp + 0x8c], edx
push dword [esp + 0x28c]
mov esi, dword [0x100ce24c]
sub ecx, edx
push dword [esp + 0x20]
mov edi, dword [esp + 0x288]
sub ecx, eax
mov dword [esp + 0x90], ecx
mov eax, ebx
mov dword [esp + 0x2bc], ecx
mov dword [esp + 0x2ac], ecx
mov ecx, esi
mov dword [esp + 0x1c], eax
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce27c]
mov ecx, esi
push ebx
push 0xc50
mov dword [esp + 0x38], eax
lea eax, [esp + 0x2a4]
push eax
push 0xffffffffffffffff
push edi
push dword [esp + 0x30]
call dword [0x100d6738]
call esi
test eax, eax
jne 0x10016352
mov edi, 0x80004005
mov dword [esp + 0x14], edi
jmp 0x10016354
mov edi, ebx
mov eax, dword [esp + 0x30]
test eax, eax
je 0x10016371
mov esi, dword [0x100ce24c]
mov ecx, esi
push eax
push dword [esp + 0x20]
call dword [0x100d6738]
call esi
test edi, edi
js 0x100169f8
push dword [esp + 0x290]
mov esi, dword [0x100ce24c]
mov eax, ebx
push dword [esp + 0x20]
mov edi, dword [esp + 0x28c]
mov ecx, esi
mov dword [esp + 0x1c], eax
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce27c]
mov ecx, esi
push ebx
push 0xc50
mov dword [esp + 0x38], eax
lea eax, [esp + 0x2b4]
push eax
push 0xffffffffffffffff
push edi
push dword [esp + 0x30]
call dword [0x100d6738]
call esi
test eax, eax
jne 0x100163d9
mov edi, 0x80004005
mov dword [esp + 0x14], edi
jmp 0x100163db
mov edi, ebx
mov eax, dword [esp + 0x30]
test eax, eax
je 0x100163f8
mov esi, dword [0x100ce24c]
mov ecx, esi
push eax
push dword [esp + 0x20]
call dword [0x100d6738]
call esi
test edi, edi
js 0x100169f8
mov eax, dword [esp + 0x64]
cmp eax, 2
je 0x1001640e
cmp eax, 3
jne 0x10016435
mov edi, dword [esp + 0x2b4]
mov dword [esp + 0x88], edi
cmp dword [esp + 0x2a4], edi
jle 0x1001643c
mov edi, dword [esp + 0x2a4]
mov dword [esp + 0x88], edi
jmp 0x1001643c
mov edi, dword [esp + 0x88]
cmp dword [esp + 0x278], 0
mov esi, dword [0x100ce2b8]
mov ecx, esi
push dword [esp + 0x20]
je 0x10016495
mov eax, dword [esp + 0x98]
sub eax, dword [esp + 0x2a8]
add eax, edi
push eax
lea eax, [esp + 0x2a4]
push eax
call dword [0x100d6738]
call esi
mov eax, dword [esp + 0x2a8]
add eax, dword [esp + 0x90]
push eax
mov eax, dword [esp + 0x98]
sub eax, dword [esp + 0x2b8]
add eax, edi
push eax
jmp 0x100164c2
push dword [esp + 0x90]
lea eax, [esp + 0x2a4]
push eax
call dword [0x100d6738]
call esi
mov eax, dword [esp + 0x2a8]
add eax, dword [esp + 0x90]
push eax
push dword [esp + 0x90]
mov esi, dword [0x100ce2b8]
lea eax, [esp + 0x2b4]
push eax
mov ecx, esi
call dword [0x100d6738]
call esi
mov eax, dword [esp + 0x64]
cmp eax, 2
je 0x100167da
cmp eax, 3
je 0x100167da
xor edx, edx
inc edx
cmp eax, edx
jne 0x100167fd
push 0x5c
lea eax, [esp + 0x8c4]
mov dword [esp + 0x29c], 0xffffff
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x100ce28c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [esp + 0x14], edi
push 0x403
push ebx
push ebx
call dword [0x100d6738]
call esi
mov dword [esp + 0x30], eax
test eax, eax
jne 0x10016568
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
jle 0x1001655d
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0x14], edi
test edi, edi
js 0x10016613
jmp 0x1001602c
mov esi, dword [0x100ce26c]
mov ecx, esi
push 0x48
push dword [esp + 0x78]
push 0xb
call dword [0x100d6738]
call esi
push dword [esp + 0x6c]
neg eax
mov dword [esp + 0x8d4], 0x190
push 0x20
pop edx
lea ecx, [esp + 0x8e0]
mov dword [esp + 0x8c4], eax
mov byte [esp + 0x8de], 5
call fcn.1001ba04
mov esi, dword [0x100ce220]
lea eax, [esp + 0x8c0]
push eax
mov ecx, esi
call dword [0x100d6738]
call esi
test eax, eax
jne 0x100165f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
jle 0x100165ea
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0x14], edi
test edi, edi
js 0x100165fe
mov edi, 0x80004005
mov dword [esp + 0x14], edi
jmp 0x100165fe
mov dword [esp + 0x294], eax
push dword [esp + 0x30]
mov esi, dword [0x100ce2c0]
mov ecx, esi
push ebx
call dword [0x100d6738]
call esi
test edi, edi
js 0x100169f8
push dword [esp + 0x294]
mov eax, dword [esp + 0x8c]
push dword [esp + 0x20]
mov esi, dword [0x100ce24c]
mov ecx, esi
mov edi, dword [esp + 0x290]
mov dword [esp + 0x2cc], eax
mov eax, ebx
mov dword [esp + 0x1c], eax
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce27c]
mov ecx, esi
push ebx
push 0x460
mov dword [esp + 0x38], eax
lea eax, [esp + 0x2c4]
push eax
push 0xffffffffffffffff
push edi
push dword [esp + 0x30]
call dword [0x100d6738]
call esi
test eax, eax
jne 0x10016689
mov edi, 0x80004005
mov dword [esp + 0x14], edi
jmp 0x1001668b
mov edi, ebx
mov eax, dword [esp + 0x30]
test eax, eax
je 0x100166a8
mov esi, dword [0x100ce24c]
mov ecx, esi
push eax
push dword [esp + 0x20]
call dword [0x100d6738]
call esi
test edi, edi
js 0x100169f8
mov eax, dword [esp + 0x2c4]
push 0x5a
add eax, 0x18
pop ecx
mov dword [esp + 0x2c4], eax
cmp eax, ecx
jge 0x100166cf
mov dword [esp + 0x2c4], ecx
mov edi, dword [esp + 0x74]
mov esi, dword [0x100ce26c]
mov ecx, esi
push 0x60
push edi
push dword [esp + 0x2c4]
mov dword [esp + 0x2d4], 0x20
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce26c]
mov ecx, esi
push 0x60
push edi
push dword [esp + 0x2c8]
mov dword [esp + 0x2c8], eax
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce26c]
mov ecx, esi
push 0x60
push edi
push dword [esp + 0x2cc]
mov dword [esp + 0x2cc], eax
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce26c]
mov ecx, esi
push 0x60
push edi
push dword [esp + 0x2d0]
mov dword [esp + 0x2d0], eax
call dword [0x100d6738]
call esi
cmp dword [esp + 0x278], 0
mov dword [esp + 0x2c8], eax
je 0x100167a9
mov ecx, dword [esp + 0x29c]
cmp ecx, dword [esp + 0x2ac]
jl 0x10016783
mov ecx, dword [esp + 0x2ac]
mov eax, dword [esp + 0x2b8]
add eax, 0x24
mov esi, dword [0x100ce2b8]
push eax
push ecx
lea eax, [esp + 0x2c4]
mov ecx, esi
push eax
call dword [0x100d6738]
call esi
jmp 0x100167fa
mov ecx, dword [esp + 0x2a4]
cmp ecx, dword [esp + 0x2b4]
jg 0x100167c0
mov ecx, dword [esp + 0x2b4]
mov eax, dword [esp + 0x2b8]
sub ecx, dword [esp + 0x2c4]
add eax, 0x24
add ecx, dword [esp + 0x2bc]
jmp 0x1001678d
mov eax, dword [esp + 0x2b8]
mov dword [esp + 0x5f0], edi
mov dword [esp + 0x5f4], eax
mov dword [esp + 0x298], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [esp + 0x278]
lea edi, [esp + 0x714]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x5f4]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5f0]
mov dword [esp + 0x24], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esp + 0x64]
sub eax, 1
je 0x100169e6
sub eax, 1
je 0x10016906
sub eax, 1
jne 0x100169f4
mov esi, dword [0x100ce2b4]
lea edi, [esp + 0x6ec]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce294]
lea ecx, [esp + 0x6ec]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x6f4], 0x28
call dword [0x100d6738]
call esi
test eax, eax
je 0x100169f4
mov esi, dword [0x100ce2b0]
lea eax, [esp + 0x700]
push eax
push ebx
mov ecx, esi
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce2b0]
lea eax, [esp + 0x708]
push eax
push ebx
mov ecx, esi
call dword [0x100d6738]
call esi
mov eax, dword [esp + 0x708]
lea esi, [esp + 0x700]
sub eax, dword [esp + 0x24]
lea edi, [esp + 0x714]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x5e8], eax
mov eax, dword [esp + 0x70c]
sub eax, dword [esp + 0x2c]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
jmp 0x100169da
mov esi, dword [0x100ce2b4]
lea edi, [esp + 0x6b8]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce294]
lea ecx, [esp + 0x6b8]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x6c0], 0x28
call dword [0x100d6738]
call esi
test eax, eax
je 0x100169f4
mov esi, dword [0x100ce2b0]
lea eax, [esp + 0x6cc]
push eax
push ebx
mov ecx, esi
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce2b0]
lea eax, [esp + 0x6d4]
push eax
push ebx
mov ecx, esi
call dword [0x100d6738]
call esi
cmp dword [esp + 0x30], 0
lea esi, [esp + 0x6cc]
lea edi, [esp + 0x714]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x100169b4
imul eax, dword [esp + 0x6d4], 5
cdq
idiv ecx
add eax, dword [esp + 0x6cc]
jmp 0x100169c5
mov eax, dword [esp + 0x6d4]
sub eax, dword [esp + 0x24]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [esp + 0x5e8], eax
mov eax, dword [esp + 0x6d8]
sub eax, dword [esp + 0x2c]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [esp + 0x5ec], eax
jmp 0x100169f4
mov dword [esp + 0x5e8], ebx
mov dword [esp + 0x5ec], ebx
mov dword [esp + 0x14], ebx
push dword [esp + 0x1c]
mov esi, dword [0x100ce2c0]
mov ecx, esi
push ebx
call dword [0x100d6738]
call esi
xor esi, esi
mov edi, 0x100d55d8
inc esi
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x10016a15
mov eax, dword [0x100d55d4]
test eax, eax
jle 0x10016a76
sub eax, 1
mov dword [0x100d55d4], eax
jne 0x10016a76
mov esi, ebx
mov eax, dword [esi + 0x100d4fd0]
test eax, eax
je 0x10016a47
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10016a36
push 0x40
push ebx
push 0x100d4fd0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x100019e0
mov edi, 0x100ce210
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0x100d55d8
inc esi
xor eax, eax
xchg dword [edi], eax
lea ecx, [esp + 0x158]
call fcn.1002ad14
mov eax, dword [esp + 0x14]
test eax, eax
js 0x100184b2
mov eax, dword [esp + 0x5ec]
mov edi, dword [esp + 0x5e8]
push 0x54
mov dword [esp + 0x28], eax
mov dword [esp + 0x1dc], eax
lea eax, [esp + 0x2d4]
push ebx
push eax
mov dword [esp + 0x1e0], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0x2c], esi
mov esi, dword [0x100ce238]
mov ecx, esi
push 7
push dword [esp + 0x3c]
call dword [0x100d6738]
call esi
test eax, eax
je 0x10016b2d
mov esi, dword [0x100ce244]
lea ecx, [esp + 0x2d0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100d6738]
call esi
test eax, eax
je 0x10016b2d
push 0x20
pop eax
cmp word [esp + 0x2e2], ax
jne 0x10016b2d
cmp dword [esp + 0x2e4], 0
je 0x10016b2d
cmp dword [esp + 0x2d4], 0
jle 0x10016b2d
cmp dword [esp + 0x2d8], 0
jg 0x10016b38
cmp dword [esp + 0x64], 1
mov dword [esp + 0x2c], ebx
jne 0x10016ba7
push dword [esp + 0x24]
mov esi, dword [0x100ce2b8]
lea eax, [esp + 0x2a0]
push edi
push eax
mov ecx, esi
call dword [0x100d6738]
call esi
push dword [esp + 0x24]
mov esi, dword [0x100ce2b8]
lea eax, [esp + 0x2b0]
push edi
push eax
mov ecx, esi
call dword [0x100d6738]
call esi
mov edi, dword [esp + 0x64]
cmp edi, 1
jne 0x10016bab
mov eax, dword [esp + 0x27c]
mov esi, dword [0x100ce224]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0x100d6738]
call esi
mov dword [esp + 0x40], eax
jmp 0x10016bab
mov edi, dword [esp + 0x64]
mov esi, dword [0x100ce250]
mov ecx, esi
push 1
push dword [esp + 0x3c]
call dword [0x100d6738]
call esi
cmp dword [esp + 0x278], 0
mov dword [esp + 0x60], eax
mov dword [esp + 0x74], 0x810
je 0x10016bdf
mov dword [esp + 0x74], 0x20812
cmp dword [esp + 0x2c], 0
je 0x10017649
mov eax, dword [esp + 0x27c]
mov esi, dword [esp + 0x280]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x28c]
push 0x54
mov dword [esp + 0x34], eax
lea eax, [esp + 0x384]
push ebx
push eax
mov dword [esp + 0x68], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x4e0]
push 0x54
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0x4c], ebx
lea eax, [esp + 0x750]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x20], ebx
push 0x2c
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [esp + 0x654]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x10018494
mov edi, dword [esp + 0x38]
mov esi, dword [0x100ce238]
mov ecx, esi
push 7
push edi
call dword [0x100d6738]
call esi
test eax, eax
jne 0x10016c8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10018494
mov esi, dword [0x100ce244]
lea ecx, [esp + 0x380]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100d6738]
call esi
test eax, eax
je 0x10016ccf
mov eax, dword [esp + 0x394]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x384]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x388]
mov dword [esp + 0x20], eax
mov esi, dword [0x100ce218]
mov ecx, esi
push edi
call dword [0x100d6738]
call esi
mov esi, eax
mov dword [esp + 0x34], esi
test esi, esi
je 0x10016c84
push 0x2c
lea eax, [esp + 0x754]
mov dword [esp + 0x194], ebx
push ebx
mov edi, ebx
push eax
mov dword [esp + 0xa8], edi
call sub.msvcrt.dll_memset
mov eax, dword [esp + 0x2b0]
add esp, 0xc
sub eax, dword [esp + 0x29c]
mov dword [esp + 0x754], eax
mov eax, dword [esp + 0x2a0]
sub eax, dword [esp + 0x2a8]
mov dword [esp + 0x758], eax
xor eax, eax
push 0x20
inc eax
mov dword [esp + 0x754], 0x28
mov word [esp + 0x760], ax
pop eax
push ebx
push ebx
mov word [esp + 0x766], ax
lea eax, [esp + 0x198]
push eax
push ebx
lea eax, [esp + 0x760]
push eax
push esi
mov esi, dword [0x100ce21c]
mov ecx, esi
call dword [0x100d6738]
call esi
mov dword [esp + 0x70], eax
test eax, eax
jne 0x10016dab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x10016d9b
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x10017101
mov edi, 0x80004005
jmp 0x10017101
mov esi, dword [0x100ce244]
lea ecx, [esp + 0x4e0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100d6738]
call esi
test eax, eax
je 0x10016dd5
mov eax, dword [esp + 0x4f4]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2a4]
sub eax, dword [esp + 0x29c]
push dword [esp + 0x70]
mov esi, dword [0x100ce24c]
mov ecx, esi
push dword [esp + 0x38]
mov dword [esp + 0x658], eax
mov eax, dword [esp + 0x2b0]
sub eax, dword [esp + 0x2a8]
mov dword [esp + 0x65c], eax
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce250]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [esp + 0x38]
call dword [0x100d6738]
call esi
push dword [esp + 0x30]
mov esi, dword [0x100ce24c]
mov ecx, esi
push dword [esp + 0x38]
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce248]
mov ecx, esi
push ebx
mov dword [esp + 0x6c], eax
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce284]
mov ecx, esi
push eax
lea eax, [esp + 0x64c]
push eax
push dword [esp + 0x3c]
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce27c]
lea eax, [esp + 0x648]
push ebx
push dword [esp + 0x78]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [esp + 0x6c]
push dword [esp + 0x48]
call dword [0x100d6738]
call esi
xor eax, eax
inc eax
cmp dword [esp + 0x64], eax
jne 0x10016ed8
cmp dword [esp + 0x24], 0
je 0x10016ecb
mov esi, dword [0x100ce29c]
mov ecx, esi
push 8
call dword [0x100d6738]
call esi
mov dword [esp + 0x88], eax
jmp 0x10016ee3
mov dword [esp + 0x88], 0xffffff
jmp 0x10016ee3
mov dword [esp + 0x88], 0xffa8a8a8
mov esi, dword [esp + 0x29c]
mov edx, ebx
mov eax, dword [esp + 0x2a0]
mov ecx, ebx
mov dword [esp + 0x58], esi
mov dword [esp + 0x24], ebx
test esi, esi
jns 0x10016f0d
mov edx, esi
mov dword [esp + 0x58], ebx
neg edx
mov dword [esp + 0x24], edx
test eax, eax
jns 0x10016f17
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [esp + 0x650]
sub esi, edx
mov edx, dword [esp + 0x3c]
sub edx, dword [esp + 0x58]
mov dword [esp + 0x6c], esi
cmp esi, edx
jl 0x10016f36
mov esi, edx
mov dword [esp + 0x6c], edx
mov edx, dword [esp + 0x654]
sub dword [esp + 0x20], eax
sub edx, ecx
mov dword [esp + 0x78], edx
cmp edx, dword [esp + 0x20]
jl 0x10016f55
mov edx, dword [esp + 0x20]
mov dword [esp + 0x78], edx
test esi, esi
jle 0x100170d0
test edx, edx
jle 0x100170d0
mov ebx, dword [esp + 0x650]
mov edi, dword [esp + 0x3c]
mov esi, dword [esp + 0x2c]
imul ecx, ebx
imul eax, edi
shl ebx, 2
mov dword [esp + 0x30], ebx
add ecx, dword [esp + 0x24]
add eax, dword [esp + 0x58]
shl edi, 2
mov dword [esp + 0x5c], edi
lea ecx, [esi + ecx*4]
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x50], ecx
lea eax, [esi + eax*4]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x4c], eax
test esi, esi
jle 0x100170ae
mov ebx, eax
mov dword [esp + 0x2c], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [esp + 0x20], edx
lea edi, [ecx + 2]
mov dword [esp + 0x24], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x1001707f
mov bl, byte [ebx + edi]
mov eax, dword [esp + 0x88]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x24]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [esp + 0x20]
mov bl, byte [eax - 2]
mov eax, dword [esp + 0x88]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x20]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [esp + 0x8a]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x20]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [esp + 0x2c]
cdq
idiv ecx
mov edx, dword [esp + 0x20]
add al, bl
mov ebx, dword [esp + 0x24]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], esi
jne 0x10016fc4
mov edx, dword [esp + 0x78]
mov esi, dword [esp + 0x6c]
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x5c]
add ecx, ebx
add eax, edi
sub edx, 1
mov dword [esp + 0x50], ecx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x78], edx
jne 0x10016fa6
mov edi, dword [esp + 0x9c]
xor ebx, ebx
push dword [esp + 0x70]
mov esi, dword [0x100ce22c]
mov ecx, esi
call dword [0x100d6738]
call esi
mov eax, dword [esp + 0x68]
test eax, eax
je 0x10017101
mov esi, dword [0x100ce24c]
mov ecx, esi
push eax
push dword [esp + 0x38]
call dword [0x100d6738]
call esi
push dword [esp + 0x34]
mov esi, dword [0x100ce228]
mov ecx, esi
call dword [0x100d6738]
call esi
test edi, edi
js 0x10018494
mov eax, dword [esp + 0x27c]
mov esi, dword [esp + 0x284]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x290]
push 0x54
mov dword [esp + 0x34], eax
lea eax, [esp + 0x32c]
push ebx
push eax
mov dword [esp + 0x68], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x488]
push 0x54
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0x4c], ebx
lea eax, [esp + 0x77c]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x20], ebx
push 0x2c
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [esp + 0x624]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x10018494
mov edi, dword [esp + 0x38]
mov esi, dword [0x100ce238]
mov ecx, esi
push 7
push edi
call dword [0x100d6738]
call esi
test eax, eax
je 0x10016c84
mov esi, dword [0x100ce244]
lea ecx, [esp + 0x328]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100d6738]
call esi
test eax, eax
je 0x100171fb
mov eax, dword [esp + 0x33c]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x32c]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x330]
mov dword [esp + 0x20], eax
mov esi, dword [0x100ce218]
mov ecx, esi
push edi
call dword [0x100d6738]
call esi
mov esi, eax
mov dword [esp + 0x34], esi
test esi, esi
je 0x10016c84
push 0x2c
lea eax, [esp + 0x780]
mov dword [esp + 0x198], ebx
push ebx
mov edi, ebx
push eax
mov dword [esp + 0xa8], edi
call sub.msvcrt.dll_memset
mov eax, dword [esp + 0x2c0]
add esp, 0xc
sub eax, dword [esp + 0x2ac]
mov dword [esp + 0x780], eax
mov eax, dword [esp + 0x2b0]
sub eax, dword [esp + 0x2b8]
mov dword [esp + 0x784], eax
xor eax, eax
push 0x20
inc eax
mov dword [esp + 0x780], 0x28
mov word [esp + 0x78c], ax
pop eax
push ebx
push ebx
mov word [esp + 0x792], ax
lea eax, [esp + 0x19c]
push eax
push ebx
lea eax, [esp + 0x78c]
push eax
push esi
mov esi, dword [0x100ce21c]
mov ecx, esi
call dword [0x100d6738]
call esi
mov dword [esp + 0x70], eax
test eax, eax
jne 0x100172db
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x100172cb
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x10017626
mov edi, 0x80004005
jmp 0x10017626
mov esi, dword [0x100ce244]
lea ecx, [esp + 0x488]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100d6738]
call esi
test eax, eax
je 0x10017305
mov eax, dword [esp + 0x49c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2b4]
sub eax, dword [esp + 0x2ac]
push dword [esp + 0x70]
mov esi, dword [0x100ce24c]
mov ecx, esi
push dword [esp + 0x38]
mov dword [esp + 0x628], eax
mov eax, dword [esp + 0x2c0]
sub eax, dword [esp + 0x2b8]
mov dword [esp + 0x62c], eax
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce250]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [esp + 0x38]
call dword [0x100d6738]
call esi
push dword [esp + 0x30]
mov esi, dword [0x100ce24c]
mov ecx, esi
push dword [esp + 0x38]
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce248]
mov ecx, esi
push ebx
mov dword [esp + 0xbc], eax
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce284]
mov ecx, esi
push eax
lea eax, [esp + 0x61c]
push eax
push dword [esp + 0x3c]
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce27c]
lea eax, [esp + 0x618]
push ebx
push dword [esp + 0x78]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [esp + 0x6c]
push dword [esp + 0x48]
call dword [0x100d6738]
call esi
xor eax, eax
inc eax
cmp dword [esp + 0x64], eax
jne 0x10017401
cmp dword [esp + 0x24], 0
je 0x100173f7
mov esi, dword [0x100ce29c]
mov ecx, esi
push 8
call dword [0x100d6738]
call esi
jmp 0x10017406
mov dword [esp + 0x6c], 0xffffff
jmp 0x1001740e
mov eax, 0xffa8a8a8
mov dword [esp + 0x6c], eax
mov dword [esp + 0x28], eax
mov esi, dword [esp + 0x2ac]
mov edx, ebx
mov eax, dword [esp + 0x2b0]
mov ecx, ebx
mov dword [esp + 0x58], esi
mov dword [esp + 0x24], ebx
test esi, esi
jns 0x10017438
mov edx, esi
mov dword [esp + 0x58], ebx
neg edx
mov dword [esp + 0x24], edx
test eax, eax
jns 0x10017442
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [esp + 0x620]
sub esi, edx
mov edx, dword [esp + 0x3c]
sub edx, dword [esp + 0x58]
mov dword [esp + 0x78], esi
cmp esi, edx
jl 0x10017461
mov esi, edx
mov dword [esp + 0x78], edx
mov edx, dword [esp + 0x624]
sub dword [esp + 0x20], eax
sub edx, ecx
mov dword [esp + 0x68], edx
cmp edx, dword [esp + 0x20]
jl 0x10017480
mov edx, dword [esp + 0x20]
mov dword [esp + 0x68], edx
test esi, esi
jle 0x100175f2
test edx, edx
jle 0x100175f2
mov ebx, dword [esp + 0x620]
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x4c]
imul ecx, ebx
shl ebx, 2
mov dword [esp + 0x30], ebx
add ecx, dword [esp + 0x24]
lea ecx, [edi + ecx*4]
mov edi, dword [esp + 0x3c]
imul eax, edi
mov dword [esp + 0x50], ecx
add eax, dword [esp + 0x58]
shl edi, 2
mov dword [esp + 0x5c], edi
lea eax, [esi + eax*4]
mov esi, dword [esp + 0x78]
mov dword [esp + 0x4c], eax
test esi, esi
jle 0x100175d0
mov ebx, eax
mov dword [esp + 0x2c], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [esp + 0x20], edx
lea edi, [ecx + 2]
mov dword [esp + 0x24], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x100175a1
mov bl, byte [ebx + edi]
mov eax, dword [esp + 0x28]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x24]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [esp + 0x20]
mov bl, byte [eax - 2]
mov eax, dword [esp + 0x28]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x20]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [esp + 0x6e]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x20]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [esp + 0x2c]
cdq
idiv ecx
mov edx, dword [esp + 0x20]
add al, bl
mov ebx, dword [esp + 0x24]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], esi
jne 0x100174ef
mov edx, dword [esp + 0x68]
mov esi, dword [esp + 0x78]
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x5c]
add ecx, ebx
add eax, edi
sub edx, 1
mov dword [esp + 0x50], ecx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x68], edx
jne 0x100174d1
mov edi, dword [esp + 0x9c]
xor ebx, ebx
push dword [esp + 0x70]
mov esi, dword [0x100ce22c]
mov ecx, esi
call dword [0x100d6738]
call esi
mov eax, dword [esp + 0xb8]
test eax, eax
je 0x10017626
mov esi, dword [0x100ce24c]
mov ecx, esi
push eax
push dword [esp + 0x38]
call dword [0x100d6738]
call esi
push dword [esp + 0x34]
mov esi, dword [0x100ce228]
mov ecx, esi
call dword [0x100d6738]
call esi
test edi, edi
js 0x10018494
mov edi, ebx
jmp 0x10018448
xor ecx, ecx
inc ecx
cmp dword [esp + 0x27c], 0
jne 0x1001765e
cmp edi, ecx
je 0x1001765e
mov al, 0xc0
jmp 0x10017660
or al, 0xff
mov byte [esp + 0x6a], al
lea edi, [esp + 0x608]
xor eax, eax
mov esi, dword [0x100ce218]
stosd dword es:[edi], eax
push dword [esp + 0x38]
mov byte [esp + 0x6f], cl
mov ecx, esi
mov byte [esp + 0x6c], bl
stosd dword es:[edi], eax
mov byte [esp + 0x6d], bl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x5fc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [0x100d6738]
call esi
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x100176b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10018494
xor eax, eax
inc eax
cmp dword [esp + 0x64], eax
jne 0x100177dc
mov edi, dword [esp + 0x2a4]
mov eax, edi
mov edx, dword [esp + 0x2b4]
mov ecx, edx
sub ecx, dword [esp + 0x2ac]
sub eax, dword [esp + 0x29c]
mov dword [esp + 0x44], ecx
cmp ecx, eax
jg 0x100176ec
mov ecx, eax
mov dword [esp + 0x44], eax
mov esi, dword [esp + 0x2b8]
mov eax, esi
sub eax, dword [esp + 0x2a0]
cmp dword [esp + 0x278], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], ebx
je 0x10017749
mov eax, dword [esp + 0x29c]
sub eax, edi
add eax, ecx
mov ecx, eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x2ac]
sub eax, edx
mov dword [esp + 0x94], ecx
add eax, dword [esp + 0x44]
mov dword [esp + 0x608], ecx
mov ecx, eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x5f8], ecx
jmp 0x10017764
mov eax, dword [esp + 0x608]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x5f8]
mov dword [esp + 0x18], eax
mov eax, ebx
sub edi, dword [esp + 0x29c]
add edi, dword [esp + 0x24]
sub edx, dword [esp + 0x2ac]
sub esi, dword [esp + 0x2b0]
add edx, eax
mov eax, dword [esp + 0x2b0]
sub eax, dword [esp + 0x2a0]
mov dword [esp + 0x24], edi
mov dword [esp + 0x610], edi
mov edi, dword [esp + 0x2a8]
sub edi, dword [esp + 0x2a0]
add esi, eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x614], edi
mov dword [esp + 0xb8], edx
mov dword [esp + 0x600], edx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x5fc], eax
mov dword [esp + 0x6c], esi
mov dword [esp + 0x604], esi
jmp 0x10017869
mov eax, dword [esp + 0x5f0]
lea esi, [esp + 0x29c]
lea edi, [esp + 0x608]
mov dword [esp + 0x44], eax
movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x5f4]
mov dword [esp + 0x14], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x614]
lea esi, [esp + 0x2ac]
lea edi, [esp + 0x5f8]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x610]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x608]
mov dword [esp + 0x94], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x604]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x600]
mov dword [esp + 0xb8], eax
mov eax, dword [esp + 0x5fc]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x5f8]
mov dword [esp + 0x18], eax
push 0x2c
lea eax, [esp + 0x7ac]
mov dword [esp + 0x19c], ebx
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esp + 0x50]
add esp, 0xc
mov edi, dword [esp + 0x1c]
mov esi, dword [0x100ce21c]
mov ecx, esi
mov dword [esp + 0x7ac], eax
mov eax, dword [esp + 0x14]
neg eax
mov dword [esp + 0x7a8], 0x28
mov dword [esp + 0x7b0], eax
xor eax, eax
push 0x20
inc eax
mov word [esp + 0x7b8], ax
pop eax
push ebx
push ebx
mov word [esp + 0x7be], ax
lea eax, [esp + 0x1a0]
push eax
push ebx
lea eax, [esp + 0x7b8]
push eax
push edi
call dword [0x100d6738]
call esi
mov dword [esp + 0x48], eax
test eax, eax
jne 0x100178f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1001847f
mov esi, dword [0x100ce24c]
mov ecx, esi
push eax
push edi
call dword [0x100d6738]
call esi
xor eax, eax
inc eax
cmp dword [esp + 0x64], eax
jne 0x10017969
mov ecx, dword [esp + 0x40]
test ecx, ecx
je 0x10017969
xor eax, eax
mov esi, dword [0x100ce284]
lea edi, [esp + 0x698]
stosd dword es:[edi], eax
push ecx
mov ecx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x6a4], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x6a8], eax
lea eax, [esp + 0x69c]
push eax
mov eax, dword [esp + 0x24]
push eax
mov dword [esp + 0x6a4], ebx
mov dword [esp + 0x6a8], ebx
call dword [0x100d6738]
call esi
mov eax, dword [esp + 0x27c]
mov esi, dword [esp + 0x280]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x28c]
push 0x54
mov dword [esp + 0x34], eax
lea eax, [esp + 0x3dc]
push ebx
push eax
mov dword [esp + 0x5c], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x538]
push 0x54
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0x4c], ebx
lea eax, [esp + 0x7d4]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x20], ebx
push 0x2c
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [esp + 0x634]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [esp + 0x1c]
test esi, esi
je 0x10018466
mov esi, dword [0x100ce238]
mov ecx, esi
push 7
push edi
call dword [0x100d6738]
call esi
test eax, eax
jne 0x10017a11
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10018466
mov esi, dword [0x100ce244]
lea ecx, [esp + 0x3d8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100d6738]
call esi
test eax, eax
je 0x10017a54
mov eax, dword [esp + 0x3ec]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x3dc]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x3e0]
mov dword [esp + 0x20], eax
mov esi, dword [0x100ce218]
mov ecx, esi
push edi
call dword [0x100d6738]
call esi
mov esi, eax
mov dword [esp + 0x34], esi
test esi, esi
je 0x10017a06
push 0x2c
lea eax, [esp + 0x7d8]
mov dword [esp + 0x1a0], ebx
push ebx
push eax
mov dword [esp + 0x98], ebx
call sub.msvcrt.dll_memset
mov eax, dword [esp + 0x618]
add esp, 0xc
sub eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x24]
sub edi, dword [esp + 0x94]
mov dword [esp + 0x7dc], eax
xor eax, eax
push 0x20
inc eax
mov dword [esp + 0x7d8], 0x28
mov word [esp + 0x7e4], ax
pop eax
push ebx
push ebx
mov word [esp + 0x7ea], ax
lea eax, [esp + 0x1a4]
push eax
push ebx
lea eax, [esp + 0x7e4]
mov dword [esp + 0x7e8], edi
push eax
push esi
mov esi, dword [0x100ce21c]
mov ecx, esi
call dword [0x100d6738]
call esi
mov dword [esp + 0x78], eax
test eax, eax
jne 0x10017b39
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x8c], eax
test eax, eax
jle 0x10017b23
movzx eax, ax
or eax, 0x80070000
mov dword [esp + 0x8c], eax
test eax, eax
js 0x10017e84
mov dword [esp + 0x8c], 0x80004005
jmp 0x10017e84
mov esi, dword [0x100ce244]
lea ecx, [esp + 0x538]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100d6738]
call esi
test eax, eax
je 0x10017b63
mov eax, dword [esp + 0x54c]
mov dword [esp + 0x2c], eax
push dword [esp + 0x78]
mov eax, dword [esp + 0x40]
push dword [esp + 0x38]
mov esi, dword [0x100ce24c]
mov ecx, esi
mov dword [esp + 0x638], edi
mov edi, dword [esp + 0x614]
sub eax, edi
mov dword [esp + 0x63c], eax
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce250]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [esp + 0x38]
call dword [0x100d6738]
call esi
push dword [esp + 0x30]
mov esi, dword [0x100ce24c]
mov ecx, esi
push dword [esp + 0x38]
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce248]
mov ecx, esi
push ebx
mov dword [esp + 0x34], eax
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce284]
mov ecx, esi
push eax
lea eax, [esp + 0x62c]
push eax
push dword [esp + 0x3c]
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce27c]
lea eax, [esp + 0x628]
push ebx
push dword [esp + 0x78]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [esp + 0x60]
push dword [esp + 0x48]
call dword [0x100d6738]
call esi
xor eax, eax
inc eax
cmp dword [esp + 0x64], eax
jne 0x10017c57
cmp dword [esp + 0x70], 0
je 0x10017c4a
mov esi, dword [0x100ce29c]
mov ecx, esi
push 8
call dword [0x100d6738]
call esi
mov dword [esp + 0x88], eax
jmp 0x10017c62
mov dword [esp + 0x88], 0xffffff
jmp 0x10017c62
mov dword [esp + 0x88], 0xffa8a8a8
mov ecx, dword [esp + 0x94]
mov edx, ebx
mov dword [esp + 0x24], ebx
mov eax, ebx
test ecx, ecx
jns 0x10017c7f
mov edx, ecx
mov ecx, ebx
neg edx
mov dword [esp + 0x24], edx
test edi, edi
jns 0x10017c89
mov eax, edi
mov edi, ebx
neg eax
mov esi, dword [esp + 0x630]
sub esi, edx
mov edx, dword [esp + 0x90]
sub edx, ecx
mov dword [esp + 0x3c], esi
cmp esi, edx
jl 0x10017ca9
mov esi, edx
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x634]
sub dword [esp + 0x20], edi
sub edx, eax
mov dword [esp + 0x58], edx
cmp edx, dword [esp + 0x20]
jl 0x10017cc8
mov edx, dword [esp + 0x20]
mov dword [esp + 0x58], edx
test esi, esi
jle 0x10017e53
test edx, edx
jle 0x10017e53
imul edi, dword [esp + 0x90]
mov ebx, dword [esp + 0x630]
mov esi, dword [esp + 0x2c]
imul eax, ebx
shl ebx, 2
add edi, ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x4c], ebx
mov ebx, dword [esp + 0x90]
add eax, dword [esp + 0x24]
shl ebx, 2
lea ecx, [ecx + edi*4]
mov dword [esp + 0x50], ebx
mov ebx, dword [esp + 0x4c]
mov edi, dword [esp + 0x50]
lea eax, [esi + eax*4]
mov esi, dword [esp + 0x3c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x9c], ecx
test esi, esi
jle 0x10017e35
mov ebx, ecx
mov dword [esp + 0x2c], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [esp + 0x20], edx
lea edi, [eax + 2]
mov dword [esp + 0x24], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x10017e03
mov bl, byte [ebx + edi]
mov eax, dword [esp + 0x88]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x24]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [esp + 0x20]
mov bl, byte [eax - 2]
mov eax, dword [esp + 0x88]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x20]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [esp + 0x8a]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x20]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [esp + 0x2c]
cdq
idiv ecx
mov edx, dword [esp + 0x20]
add al, bl
mov ebx, dword [esp + 0x24]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], esi
jne 0x10017d48
mov edx, dword [esp + 0x58]
mov esi, dword [esp + 0x3c]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x9c]
mov ebx, dword [esp + 0x4c]
mov edi, dword [esp + 0x50]
add eax, ebx
add ecx, edi
sub edx, 1
mov dword [esp + 0x70], eax
mov dword [esp + 0x9c], ecx
mov dword [esp + 0x58], edx
jne 0x10017d2a
xor ebx, ebx
push dword [esp + 0x78]
mov esi, dword [0x100ce22c]
mov ecx, esi
call dword [0x100d6738]
call esi
mov eax, dword [esp + 0x30]
test eax, eax
je 0x10017e84
mov esi, dword [0x100ce24c]
mov ecx, esi
push eax
push dword [esp + 0x38]
call dword [0x100d6738]
call esi
push dword [esp + 0x34]
mov esi, dword [0x100ce228]
mov ecx, esi
call dword [0x100d6738]
call esi
cmp dword [esp + 0x8c], 0
jl 0x10018462
mov eax, dword [esp + 0x27c]
mov esi, dword [esp + 0x284]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x290]
push 0x54
mov dword [esp + 0x34], eax
lea eax, [esp + 0x434]
push ebx
push eax
mov dword [esp + 0x58], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x590]
push 0x54
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0x2c], ebx
lea eax, [esp + 0x724]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x20], ebx
push 0x2c
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [esp + 0x644]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [esp + 0x1c]
test esi, esi
je 0x10018466
mov esi, dword [0x100ce238]
mov ecx, esi
push 7
push edi
call dword [0x100d6738]
call esi
test eax, eax
je 0x10017a06
mov esi, dword [0x100ce244]
lea ecx, [esp + 0x430]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100d6738]
call esi
test eax, eax
je 0x10017f8a
mov eax, dword [esp + 0x444]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x434]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x438]
mov dword [esp + 0x20], eax
mov esi, dword [0x100ce218]
mov ecx, esi
push edi
call dword [0x100d6738]
call esi
mov esi, eax
mov dword [esp + 0x34], esi
test esi, esi
je 0x10017a06
push 0x2c
lea eax, [esp + 0x728]
mov dword [esp + 0x1a4], ebx
push ebx
push eax
mov dword [esp + 0x9c], ebx
call sub.msvcrt.dll_memset
mov eax, dword [esp + 0xc4]
add esp, 0xc
sub eax, dword [esp + 0x18]
mov edi, dword [esp + 0x5c]
mov dword [esp + 0xb8], eax
mov dword [esp + 0x728], eax
mov eax, edi
sub eax, dword [esp + 0x6c]
mov dword [esp + 0x72c], eax
xor eax, eax
push 0x20
inc eax
mov dword [esp + 0x728], 0x28
mov word [esp + 0x734], ax
pop eax
push ebx
push ebx
mov word [esp + 0x73a], ax
lea eax, [esp + 0x1a8]
push eax
push ebx
lea eax, [esp + 0x734]
push eax
push esi
mov esi, dword [0x100ce21c]
mov ecx, esi
call dword [0x100d6738]
call esi
mov dword [esp + 0x78], eax
test eax, eax
jne 0x10018079
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x90], eax
test eax, eax
jle 0x10018063
movzx eax, ax
or eax, 0x80070000
mov dword [esp + 0x90], eax
test eax, eax
js 0x100183b0
mov dword [esp + 0x90], 0x80004005
jmp 0x100183b0
mov esi, dword [0x100ce244]
lea ecx, [esp + 0x590]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100d6738]
call esi
test eax, eax
je 0x100180a3
mov eax, dword [esp + 0x5a4]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xb8]
push dword [esp + 0x78]
mov esi, dword [0x100ce24c]
mov ecx, esi
push dword [esp + 0x38]
mov dword [esp + 0x648], eax
mov eax, dword [esp + 0x74]
sub eax, edi
mov dword [esp + 0x64c], eax
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce250]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [esp + 0x38]
call dword [0x100d6738]
call esi
push dword [esp + 0x30]
mov esi, dword [0x100ce24c]
mov ecx, esi
push dword [esp + 0x38]
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce248]
mov ecx, esi
push ebx
mov dword [esp + 0x34], eax
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce284]
mov ecx, esi
push eax
lea eax, [esp + 0x63c]
push eax
push dword [esp + 0x3c]
call dword [0x100d6738]
call esi
mov esi, dword [0x100ce27c]
lea eax, [esp + 0x638]
push ebx
push dword [esp + 0x78]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [esp + 0x5c]
push dword [esp + 0x48]
call dword [0x100d6738]
call esi
xor eax, eax
inc eax
cmp dword [esp + 0x64], eax
jne 0x10018197
cmp dword [esp + 0x50], 0
je 0x1001818d
mov esi, dword [0x100ce29c]
mov ecx, esi
push 8
call dword [0x100d6738]
call esi
mov edx, eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x3c], edx
jmp 0x100181a4
mov dword [esp + 0x3c], 0xffffff
jmp 0x100181a4
mov eax, 0xffa8a8a8
mov dword [esp + 0x28], eax
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x18]
mov esi, ebx
mov eax, ebx
test ecx, ecx
jns 0x100181b8
mov esi, ecx
mov dword [esp + 0x18], ebx
neg esi
test edi, edi
jns 0x100181c2
mov eax, edi
mov edi, ebx
neg eax
mov edx, dword [esp + 0x640]
mov ecx, dword [esp + 0x94]
sub edx, esi
sub ecx, dword [esp + 0x18]
mov dword [esp + 0x4c], edx
cmp edx, ecx
jl 0x100181e4
mov edx, ecx
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x644]
sub dword [esp + 0x20], edi
sub ecx, eax
mov dword [esp + 0x58], ecx
cmp ecx, dword [esp + 0x20]
jl 0x10018203
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x58], ecx
test edx, edx
jle 0x1001837f
test ecx, ecx
jle 0x1001837f
mov ebx, dword [esp + 0x640]
imul edi, dword [esp + 0x94]
imul eax, ebx
shl ebx, 2
add edi, dword [esp + 0x18]
add eax, esi
mov esi, dword [esp + 0x24]
lea eax, [esi + eax*4]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x2c], ebx
mov ebx, dword [esp + 0x94]
shl ebx, 2
lea esi, [esi + edi*4]
mov dword [esp + 0x50], ebx
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x70], eax
mov dword [esp + 0x9c], esi
test edx, edx
jle 0x10018361
lea ebx, [esi + 3]
mov dword [esp + 0x24], edx
sub esi, eax
mov dword [esp + 0x20], ebx
lea edi, [eax + 2]
mov dword [esp + 0x5c], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x1001832f
mov bl, byte [esi + edi]
mov eax, dword [esp + 0x28]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x5c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [esp + 0x20]
mov bl, byte [eax - 2]
mov eax, dword [esp + 0x28]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x20]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [esp + 0x3e]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x20]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [esp + 0x5c]
cdq
idiv ecx
mov edx, dword [esp + 0x24]
add al, bl
mov ebx, dword [esp + 0x20]
mov byte [ebx], al
add ebx, 4
add edi, 4
sub edx, 1
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], edx
jne 0x1001827d
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x9c]
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x50]
add eax, ebx
add esi, edi
sub ecx, 1
mov dword [esp + 0x70], eax
mov dword [esp + 0x9c], esi
mov dword [esp + 0x58], ecx
jne 0x10018261
xor ebx, ebx
push dword [esp + 0x78]
mov esi, dword [0x100ce22c]
mov ecx, esi
call dword [0x100d6738]
call esi
mov eax, dword [esp + 0x30]
test eax, eax
je 0x100183b0
mov esi, dword [0x100ce24c]
mov ecx, esi
push eax
push dword [esp + 0x38]
call dword [0x100d6738]
call esi
push dword [esp + 0x34]
mov esi, dword [0x100ce228]
mov ecx, esi
call dword [0x100d6738]
call esi
cmp dword [esp + 0x90], 0
mov edi, dword [esp + 0x1c]
jl 0x10018466
xor eax, eax
inc eax
cmp dword [esp + 0x64], eax
jne 0x10018413
mov esi, dword [0x100ce210]
mov ecx, esi
push 0xcc0020
push ebx
push ebx
push edi
push dword [esp + 0x24]
push dword [esp + 0x58]
push dword [esp + 0x2b8]
push dword [esp + 0x2b8]
push dword [esp + 0x58]
call dword [0x100d6738]
call esi
jmp 0x10018448
push dword [esp + 0x68]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x48]
mov esi, dword [0x100ce230]
push ecx
push eax
push ebx
push ebx
push edi
push ecx
push eax
push dword [esp + 0x60c]
mov ecx, esi
push dword [esp + 0x60c]
push dword [esp + 0x60]
call dword [0x100d6738]
call esi
push dword [esp + 0x60]
mov esi, dword [0x100ce250]
mov ecx, esi
push dword [esp + 0x3c]
call dword [0x100d6738]
call esi
jmp 0x10018466
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x48]
test eax, eax
je 0x1001847f
mov esi, dword [0x100ce22c]
mov ecx, esi
push eax
call dword [0x100d6738]
call esi
test edi, edi
je 0x10018494
mov esi, dword [0x100ce228]
mov ecx, esi
push edi
call dword [0x100d6738]
call esi
mov eax, dword [esp + 0x40]
test eax, eax
je 0x100184ad
mov esi, dword [0x100ce22c]
mov ecx, esi
push eax
call dword [0x100d6738]
call esi
mov edi, 0x100d55d8
mov ecx, dword [esp + 0x280]
test ecx, ecx
je 0x10018505
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x100184c0
mov eax, dword [esp + 0x280]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x100184e9
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x100184e1
push dword [esp + 0x280]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x280], ebx
mov ecx, dword [esp + 0x284]
test ecx, ecx
je 0x10018558
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10018513
mov eax, dword [esp + 0x284]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x1001853c
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x10018534
push dword [esp + 0x284]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x284], ebx
mov edx, dword [esp + 0x288]
test edx, edx
je 0x100185a7
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10018568
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x10018591
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0x10018582
mov edx, dword [esp + 0x288]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x288], ebx
cmp dword [esp + 0x28c], 0
je 0x100185cf
push dword [esp + 0x28c]
mov esi, dword [0x100ce22c]
mov ecx, esi
call dword [0x100d6738]
call esi
mov dword [esp + 0x28c], ebx
cmp dword [esp + 0x290], 0
je 0x100185f7
push dword [esp + 0x290]
mov esi, dword [0x100ce22c]
mov ecx, esi
call dword [0x100d6738]
call esi
mov dword [esp + 0x290], ebx
cmp dword [esp + 0x294], 0
je 0x1001861f
push dword [esp + 0x294]
mov esi, dword [0x100ce22c]
mov ecx, esi
call dword [0x100d6738]
call esi
mov dword [esp + 0x294], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x10018621
mov eax, dword [0x100d55d4]
push 0
pop ebx
test eax, eax
jle 0x10018683
sub eax, 1
mov dword [0x100d55d4], eax
jne 0x10018683
mov esi, ebx
mov eax, dword [esi + 0x100d4fd0]
test eax, eax
je 0x10018657
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10018646
push 0x40
push ebx
push 0x100d4fd0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x100019e0
mov edi, 0x100ce210
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x100d55d8
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0x100d4fb0]
mov esi, dword [0x100ce25c]
mov ecx, esi
mov dword [esp + 0x70], eax
call dword [0x100d6738]
call esi
sub eax, dword [0x100d4fa8]
lea edi, [esp + 0xa20]
push 8
mov dword [esp + 0x54], eax
mov edx, 0x100d55d8
xor eax, eax
xor ebx, ebx
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x100186bf
mov eax, dword [0x100d55d4]
push 0
pop ebx
test eax, eax
jne 0x10018c9c
push 0x338
push ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [esp + 0x4c], edi
test edi, edi
je 0x10018c3b
or dword [esp + 0x5c], 0xffffffff
mov eax, ebx
mov dword [esp + 0x40], eax
mov cl, bl
mov dword [esp + 0xdc], eax
mov eax, 0x7f1137f
mov edx, eax
mov dword [esp + 0x6e0], 0xab69605e
movzx esi, word [esp + 0x6e2]
shr edx, 0x10
add edi, 7
movzx eax, ax
mov dword [esp + 0x18], esi
mov esi, ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0xf4], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x74], edx
mov dword [esp + 0x24], edi
mov edi, dword [esp + 0xd0]
movzx edx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl edx, 8
or edx, eax
movzx eax, byte [edi]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl edx, 8
or edx, eax
shl edi, 8
mov eax, dword [esp + 0xd0]
xor ebx, edx
mov dword [esp + 0x30], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [esp + 0xd0]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [esp + 0xd0]
shl edi, 8
add dword [esp + 0xd0], 8
movzx eax, byte [eax + 5]
or edi, eax
mov eax, 0x7f1137f
xor esi, edi
xor esi, ebx
xor esi, eax
xor esi, 0xab69605e
mov eax, esi
rol eax, 0xa
lea edx, [esi + 0x54969fa2]
rol edx, 5
imul edx, dword [esp + 0x28]
add edx, eax
xor ebx, edx
mov edx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea edx, [ebx + edx]
ror edx, 9
imul edx, dword [esp + 0x18]
sub edx, eax
xor esi, edx
mov eax, esi
sub eax, dword [esp + 0x28]
imul edx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, dword [esp + 0x18]
xor edx, ebx
mov eax, ebx
rol edx, 6
imul edx, dword [esp + 0x74]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [esp + 0x28]
imul eax, dword [esp + 0x18]
ror edx, 6
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
add eax, esi
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 8
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
imul edx, dword [esp + 0x74]
sub edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, dword [esp + 0x28]
xor edx, eax
xor ebx, edx
mov edx, dword [esp + 0x74]
xor edx, ebx
mov eax, ebx
imul edx, dword [esp + 0x18]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [esp + 0x74]
mov eax, esi
mov dword [esp + 0x40], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, edx
xor ebx, eax
mov esi, ebx
sub esi, edx
xor esi, dword [esp + 0x40]
xor esi, 0xab69605e
xor edx, esi
mov eax, esi
rol edx, 2
imul edx, dword [esp + 0x28]
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [esp + 0x18]
rol eax, 7
add edx, eax
mov eax, dword [esp + 0x28]
xor esi, edx
xor eax, esi
mov edx, esi
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
xor ebx, edx
mov edx, dword [esp + 0x18]
xor edx, ebx
mov dword [esp + 0x60], ebx
rol edx, 5
mov eax, ebx
imul edx, dword [esp + 0x74]
rol eax, 7
add edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov ebx, esi
xor ebx, dword [esp + 0x60]
xor ebx, edx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [esp + 0x18]
imul eax, dword [esp + 0x28]
xor esi, eax
mov eax, esi
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [esp + 0x74]
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [esp + 0x28]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, 0x605e
shr eax, 3
imul edx, dword [esp + 0x18]
xor edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [esp + 0x5c]
rol eax, 2
mov dword [esp + 0xdc], esi
mov dword [esp + 0x5c], edi
xor edx, eax
xor edx, dword [esp + 0x48]
xor ebx, edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0xf4], ebx
mov byte [edx - 4], bl
mov al, byte [esp + 0xdc]
ror dword [esp + 0xf4], 8
mov byte [edx], al
mov al, byte [esp + 0xf4]
ror dword [esp + 0xdc], 8
mov byte [edx - 5], al
mov al, byte [esp + 0xdc]
ror dword [esp + 0xf4], 8
mov byte [edx - 1], al
mov al, byte [esp + 0xf4]
ror dword [esp + 0xdc], 8
mov byte [edx - 6], al
mov al, byte [esp + 0xdc]
ror dword [esp + 0xf4], 8
mov byte [edx - 2], al
ror dword [esp + 0xdc], 8
mov al, byte [esp + 0xf4]
mov byte [edx - 7], al
mov al, byte [esp + 0xdc]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [esp + 0xf4]
mov esi, dword [esp + 0xdc]
mov eax, dword [esp + 0x30]
ror ebx, 8
ror esi, 8
sub dword [esp + 0x98], 1
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xdc], esi
mov dword [esp + 0x48], eax
mov dword [esp + 0x24], edx
jne 0x1001875d
mov esi, dword [esp + 0x4c]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x10018aab
movzx eax, cl
cdq
cmp eax, dword [0x100070b0]
jne 0x10018ad4
cmp edx, dword [0x100070b4]
jne 0x10018ad4
mov edi, esi
mov esi, ebx
mov dword [esp + 0x20], edi
jmp 0x10018ae3
or dword [esp + 0x54], 0xffffffff
mov edi, ebx
mov dword [esp + 0x2c], 0xc004d501
test esi, esi
je 0x10018af6
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x2c], ebx
jl 0x10018c3b
mov eax, dword [esp + 0x54]
mov esi, edi
push 0x40
push ebx
push 0x100d4fd0
mov byte [eax + edi], bl
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], bl
je 0x10018c42
mov edi, 0x100d4fd0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [esp + 0x60], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10018b31
sub ecx, dword [esp + 0x60]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x10018c3b
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [esp + 0x28], ecx
cmp word [eax], dx
je 0x10018b73
mov ecx, 0xc000007b
mov dword [esp + 0x28], ecx
jmp 0x10018bbd
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x10018b68
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x10018b68
cmp dword [edx], 0x4550
jne 0x10018b68
movzx eax, word [edx + 0x18]
cmp ax, word [esp + 0x104]
je 0x10018bab
cmp ax, word [esp + 0xa0]
je 0x10018bab
mov ecx, 0xc000000d
jmp 0x10018b6d
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [esp + 0x98], eax
mov dword [esp + 0x54], ebx
test eax, eax
je 0x10018c26
mov edx, esi
mov dword [esp + 0x30], esi
lea eax, [edx + 1]
mov dword [esp + 0x60], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x10018bdf
sub edx, dword [esp + 0x60]
inc esi
add esi, edx
test ecx, ecx
js 0x10018c10
push dword [esp + 0x30]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10018c31
mov ecx, dword [esp + 0x3c]
mov dword [ecx*4 + 0x100ce210], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x54]
inc dword [esp + 0x3c]
inc eax
mov dword [esp + 0x54], eax
cmp eax, dword [esp + 0x98]
jb 0x10018bd2
add edi, 0x10
cmp byte [esi], bl
jne 0x10018b26
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
jmp 0x10018c44
mov esi, 0xc000007a
jmp 0x10018c35
mov esi, ebx
test edi, edi
je 0x10018c57
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x10018c97
mov esi, ebx
mov eax, dword [esi + 0x100d4fd0]
test eax, eax
je 0x10018c6e
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10018c5d
push 0x40
push ebx
push 0x100d4fd0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x100019e0
mov edi, 0x100ce210
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x10018ca2
mov eax, dword [0x100d55d4]
inc eax
mov dword [0x100d55d4], eax
xor eax, eax
mov edi, 0x100d55d8
xchg dword [edi], eax
mov eax, dword [esp + 0x50]
xor ecx, ecx
mov esi, dword [0x100ce278]
inc ecx
mov dword [esp + 0xa24], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0xa3c], eax
lea eax, [esp + 0xa20]
push eax
push 4
push 0x2021
mov dword [esp + 0xa2c], ecx
mov dword [esp + 0xa34], ecx
mov dword [esp + 0xa40], ecx
mov dword [esp + 0xa3c], ecx
mov dword [esp + 0xa44], ecx
mov ecx, esi
push ebx
mov dword [esp + 0xa3c], 0x9966f291
call dword [0x100d6738]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x10018d14
mov eax, dword [0x100d55d4]
push 0
pop ebx
test eax, eax
jle 0x10018d76
sub eax, 1
mov dword [0x100d55d4], eax
jne 0x10018d76
mov esi, ebx
mov eax, dword [esi + 0x100d4fd0]
test eax, eax
je 0x10018d4a
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10018d39
push 0x40
push ebx
push 0x100d4fd0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x100019e0
mov edi, 0x100ce210
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x100d55d8
xor eax, eax
xchg dword [edi], eax
push dword [esp + 0x38]
mov esi, dword [0x100ce2c0]
mov ecx, esi
push ebx
call dword [0x100d6738]
call esi
lea ecx, [esp + 0x1a8]
call fcn.1002ad34
xor eax, eax
lea edi, [esp + 0xa4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x160]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [esp + 0x54], esi
test esi, esi
je 0x1001ac88
push edi
push 0x100cec38
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [esp + 0x64], esi
push 8
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x98], eax
test eax, eax
je 0x1001ac8a
mov ecx, dword [0x100cec30]
mov edi, eax
mov dword [eax], ecx
mov ecx, dword [0x100cec34]
mov dword [eax + 4], ecx
mov dword [esp + 0x44], edi
rdtsc
mov dword [esp + 0x48], eax
mov dword [esp + 0x5c], edx
mov eax, 0xc4
push eax
push 8
mov dword [esp + 0xb0], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x1001ac8c
mov dword [esp + 0xac], edx
mov ecx, ebx
mov dword [esp + 0xa4], ecx
lea eax, [edx + 4]
cmp eax, edx
jb 0x10018e6b
mov edi, eax
jmp 0x10018e6e
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x10018ea6
mov ecx, dword [esp + 0xa8]
lea eax, [edx + 8]
add ecx, edx
cmp eax, ecx
ja 0x1001ac7e
push 4
pop eax
mov dword [edx], eax
mov dword [edi], eax
mov ecx, dword [esp + 0xa4]
inc ecx
mov dword [esp + 0xa4], ecx
test esi, esi
js 0x1001ac7e
cmp dword [esp + 0xac], 0
jne 0x10018ef6
mov edx, dword [esp + 0xa8]
lea eax, [edx + 0xa4]
cmp eax, edx
jb 0x10018ecd
mov esi, eax
jmp 0x10018ed0
or esi, 0xffffffff
cmp eax, edx
mov dword [esp + 0xa8], esi
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x10018fc2
inc ecx
mov dword [esp + 0xa4], ecx
jmp 0x10018fca
mov edx, dword [esp + 0xac]
mov esi, ebx
test ecx, ecx
je 0x10018f5f
mov eax, dword [edx]
add eax, 4
mov dword [esp + 0x30], edx
cmp eax, 4
jb 0x10018f15
mov edi, eax
jmp 0x10018f18
or edi, 0xffffffff
cmp eax, 4
jb 0x10018f26
mov dword [esp + 0x1ac], edi
jmp 0x10018f2d
mov edi, dword [esp + 0x1ac]
cmp eax, 4
jb 0x1001ac7e
lea eax, [edx + edi]
mov dword [esp + 0x60], edx
cmp eax, edx
jb 0x10018f45
mov edx, eax
jmp 0x10018f48
or edx, 0xffffffff
cmp eax, dword [esp + 0x60]
sbb edi, edi
and edi, 0xc0000095
cmp eax, dword [esp + 0x30]
jb 0x10018fbb
inc esi
cmp esi, ecx
jb 0x10018f03
lea eax, [edx + 4]
cmp eax, edx
jb 0x10018f6a
mov esi, eax
jmp 0x10018f6d
or esi, 0xffffffff
cmp eax, edx
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x10018fbb
mov ecx, dword [esp + 0xa8]
lea eax, [edx + 0xa4]
add ecx, dword [esp + 0xac]
cmp eax, ecx
ja 0x1001ac7e
mov eax, 0xa0
push eax
push dword [esp + 0x58]
mov dword [edx], eax
push esi
call sub.msvcrt.dll_memcpy
mov ecx, dword [esp + 0xb0]
add esp, 0xc
inc ecx
mov dword [esp + 0xa4], ecx
mov esi, dword [esp + 0xa8]
test edi, edi
js 0x1001ac7e
cmp dword [esp + 0xac], 0
jne 0x10019008
mov eax, esi
lea esi, [eax + 0xc]
mov edx, esi
cmp esi, eax
jae 0x10018fe2
or esi, 0xffffffff
cmp edx, eax
mov dword [esp + 0xa8], esi
sbb edi, edi
and edi, 0xc0000095
cmp edx, eax
jb 0x100190e2
inc ecx
mov dword [esp + 0xa4], ecx
jmp 0x100190f4
mov edx, dword [esp + 0xac]
mov dword [esp + 0x54], ebx
test ecx, ecx
je 0x1001907b
mov eax, dword [edx]
add eax, 4
mov dword [esp + 0x30], edx
cmp eax, 4
jb 0x10019029
mov edi, eax
jmp 0x1001902c
or edi, 0xffffffff
cmp eax, 4
jb 0x1001903a
mov dword [esp + 0x1b0], edi
jmp 0x10019041
mov edi, dword [esp + 0x1b0]
cmp eax, 4
jb 0x1001ac7e
lea eax, [edx + edi]
mov dword [esp + 0x60], edx
cmp eax, edx
jb 0x10019059
mov edx, eax
jmp 0x1001905c
or edx, 0xffffffff
cmp eax, dword [esp + 0x60]
sbb edi, edi
and edi, 0xc0000095
cmp eax, dword [esp + 0x30]
jb 0x100190e2
mov edi, dword [esp + 0x54]
inc edi
mov dword [esp + 0x54], edi
cmp edi, ecx
jb 0x10019017
lea eax, [edx + 4]
cmp eax, edx
jb 0x10019088
mov dword [esp + 0x54], eax
jmp 0x1001908f
or edi, 0xffffffff
mov dword [esp + 0x54], edi
cmp eax, edx
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x100190e2
mov ecx, dword [esp + 0xac]
lea eax, [edx + 0xc]
add ecx, esi
cmp eax, ecx
ja 0x1001ac7e
mov ecx, dword [esp + 0x98]
mov dword [edx], 8
mov edx, dword [esp + 0x54]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov ecx, dword [esp + 0xa4]
mov esi, dword [esp + 0xa8]
inc ecx
mov dword [esp + 0xa4], ecx
test edi, edi
js 0x1001ac7e
cmp dword [esp + 0xac], 0
jne 0x10019128
mov eax, esi
lea esi, [eax + 0xc]
mov edx, esi
cmp esi, eax
jae 0x10019102
or esi, 0xffffffff
cmp edx, eax
mov dword [esp + 0xa8], esi
sbb edi, edi
and edi, 0xc0000095
cmp edx, eax
jb 0x100191fe
inc ecx
mov dword [esp + 0xa4], ecx
jmp 0x10019206
mov edx, dword [esp + 0xac]
mov dword [esp + 0x54], ebx
test ecx, ecx
je 0x1001919b
mov eax, dword [edx]
add eax, 4
mov dword [esp + 0x30], edx
cmp eax, 4
jb 0x10019149
mov edi, eax
jmp 0x1001914c
or edi, 0xffffffff
cmp eax, 4
jb 0x1001915a
mov dword [esp + 0x1b4], edi
jmp 0x10019161
mov edi, dword [esp + 0x1b4]
cmp eax, 4
jb 0x1001ac7e
lea eax, [edx + edi]
mov dword [esp + 0x60], edx
cmp eax, edx
jb 0x10019179
mov edx, eax
jmp 0x1001917c
or edx, 0xffffffff
cmp eax, dword [esp + 0x60]
sbb edi, edi
and edi, 0xc0000095
cmp eax, dword [esp + 0x30]
jb 0x100191fe
mov edi, dword [esp + 0x54]
inc edi
mov dword [esp + 0x54], edi
cmp edi, ecx
jb 0x10019137
lea eax, [edx + 4]
cmp eax, edx
jb 0x100191a8
mov dword [esp + 0x54], eax
jmp 0x100191af
or edi, 0xffffffff
mov dword [esp + 0x54], edi
cmp eax, edx
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x100191fe
mov ecx, dword [esp + 0xac]
lea eax, [edx + 0xc]
add ecx, esi
cmp eax, ecx
ja 0x1001ac7e
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x48]
mov dword [edx], 8
mov dword [eax], ecx
mov ecx, dword [esp + 0x5c]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0xa4]
mov esi, dword [esp + 0xa8]
inc ecx
mov dword [esp + 0xa4], ecx
test edi, edi
js 0x1001ac7e
rdtsc
mov edi, ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0xa0], edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x60], eax
mov dword [esp + 0x30], edx
lea eax, [esi + 8]
cmp eax, 8
jb 0x1001924c
mov edx, eax
jmp 0x1001924f
or edx, 0xffffffff
cmp eax, 8
sbb esi, esi
and esi, 0xc0000095
cmp eax, 8
jb 0x10019344
lea eax, [edx + 7]
and eax, 0xfffffff8
mov dword [esp + 0x54], eax
cmp eax, edx
jae 0x1001927b
mov esi, 0xc0000095
jmp 0x10019344
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1001929d
mov esi, 0xc0000017
mov edi, ebx
jmp 0x1001933d
mov eax, dword [esp + 0xa4]
mov dword [edi], eax
lea eax, [edi + 4]
cmp eax, edi
jb 0x100192b1
mov ecx, eax
jmp 0x100192b4
or ecx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x10019323
mov eax, dword [esp + 0xa8]
mov dword [ecx], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x100192d6
mov edx, eax
jmp 0x100192d9
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10019323
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x60]
mov dword [edi + eax - 8], ecx
mov ecx, dword [esp + 0x30]
mov dword [edi + eax - 4], ecx
push dword [esp + 0xa8]
push dword [esp + 0xb0]
push edx
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x60]
add esp, 0xc
mov dword [esp + 0x20], edi
mov edi, ebx
mov dword [esp + 0xa0], eax
test edi, edi
je 0x10019336
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0xa0]
mov ecx, dword [esp + 0xa4]
or esi, 0x10000000
jl 0x1001aa91
cmp dword [esp + 0x20], 0
mov dword [esp + 0x3c], ebx
jne 0x10019365
mov esi, 0xc000000d
jmp 0x10019956
test edi, edi
je 0x10019951
lea eax, [edi + 8]
push eax
push ebx
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [esp + 0x58], esi
test esi, esi
je 0x1001994a
mov cl, bl
mov eax, ebx
test edi, edi
je 0x100193a5
mov edx, dword [esp + 0x20]
xor cl, byte [eax + edx]
inc eax
cmp eax, edi
jb 0x1001939d
or eax, 0xffffffff
mov dword [esp + 0x6a8], 0xb1b54a58
mov dword [esp + 0x14], eax
mov dword [esp + 0xd4], eax
mov eax, edi
shr eax, 3
mov dword [esp + 0xd8], ebx
mov dword [esp + 0x5c], eax
test eax, eax
je 0x10019794
movzx edx, word [esp + 0x6aa]
mov eax, 0xc81ecb17
movzx esi, ax
shr eax, 0x10
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x58]
add eax, 7
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x20]
add eax, 2
mov dword [esp + 0x38], esi
mov dword [esp + 0x54], eax
mov dword [esp + 0x98], ebx
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x54]
movzx edi, byte [ebx - 2]
movzx eax, byte [ebx - 1]
movzx esi, byte [ebx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ebx]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 3]
or esi, eax
movzx eax, byte [ebx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ebx + 5]
add ebx, 8
shl esi, 8
or esi, eax
mov dword [esp + 0x54], ebx
xor edx, esi
mov eax, 0xc81ecb17
mov dword [esp + 0x14], edx
lea ebx, [edx - 0x4a58]
xor ebx, edi
xor ebx, dword [esp + 0xd8]
xor ebx, eax
mov edx, ebx
xor edx, eax
mov eax, ebx
ror edx, 0xf
imul edx, dword [esp + 0x18]
ror eax, 7
add edx, eax
mov eax, dword [esp + 0x14]
xor eax, edx
mov dword [esp + 0x14], eax
lea edx, [eax - 0x4e4ab5a8]
ror eax, 0xa
ror edx, 9
imul edx, dword [esp + 0x38]
sub edx, eax
xor ebx, edx
mov edx, dword [esp + 0x38]
xor edx, ebx
mov eax, ebx
rol eax, 5
rol edx, 4
imul edx, dword [esp + 0x28]
add edx, eax
mov eax, dword [esp + 0x14]
xor eax, edx
mov edx, eax
mov dword [esp + 0x14], eax
xor edx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, edx
xor ebx, eax
mov eax, ebx
shr eax, 6
lea edx, [ebx - 0x4a58]
imul edx, dword [esp + 0x18]
sub edx, eax
xor dword [esp + 0x14], edx
mov edx, dword [esp + 0x14]
mov eax, edx
ror eax, 0xf
xor eax, dword [esp + 0x38]
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, dword [esp + 0x28]
imul eax, dword [esp + 0x38]
xor edx, eax
mov dword [esp + 0x14], edx
sub edx, 0xc81ecb17
sub edx, 0x4a58
mov eax, dword [esp + 0x28]
xor ebx, edx
xor eax, ebx
mov edx, ebx
imul eax, dword [esp + 0x18]
ror edx, 0xa
xor edx, eax
mov eax, dword [esp + 0x14]
xor eax, edx
mov edx, eax
mov dword [esp + 0x14], eax
xor edx, 0x4a58
ror eax, 3
rol edx, 6
imul edx, dword [esp + 0x38]
xor edx, eax
xor ebx, edx
mov edx, dword [esp + 0x14]
mov eax, ebx
ror eax, 0xf
sub eax, dword [esp + 0x28]
imul eax, eax, 0x4a58
xor edx, eax
mov eax, dword [esp + 0x28]
xor eax, edx
mov dword [esp + 0x14], edx
imul edx, eax, 0x4a58
mov eax, dword [esp + 0x14]
shr eax, 1
xor edx, eax
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x38]
xor ebx, edx
rol eax, 3
imul edx, eax, 0x4a58
mov eax, dword [esp + 0x14]
shr eax, 0xf
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
sub edx, dword [esp + 0x38]
imul edx, dword [esp + 0x18]
shr eax, 0xd
sub edx, eax
mov eax, dword [esp + 0x14]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [esp + 0x14], eax
ror edx, 9
imul edx, dword [esp + 0x38]
ror eax, 0xb
xor edx, eax
xor ebx, edx
mov edx, dword [esp + 0x14]
mov eax, ebx
sub eax, dword [esp + 0x28]
add eax, 0x4e4ab5a8
xor edx, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], edx
xor eax, dword [esp + 0x14]
imul eax, eax, 0x4a58
ror edx, 7
sub eax, edx
mov edx, dword [esp + 0x28]
xor ebx, eax
xor edx, ebx
mov eax, ebx
rol edx, 4
imul edx, dword [esp + 0x18]
ror eax, 0x10
sub edx, eax
mov eax, dword [esp + 0x14]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [esp + 0x14], eax
ror edx, 0xa
imul edx, dword [esp + 0x38]
ror eax, 4
add edx, eax
xor ebx, edx
mov eax, ebx
ror eax, 9
lea edx, [ebx + 0x4e4ab5a8]
ror edx, 4
imul edx, dword [esp + 0x28]
xor edx, eax
mov eax, dword [esp + 0x14]
xor eax, edx
mov dword [esp + 0x14], eax
xor eax, 0xc81ecb17
rol eax, 8
imul edx, eax, 0x4a58
mov eax, dword [esp + 0x14]
rol eax, 2
sub edx, eax
xor ebx, edx
mov edx, 0xc81ecb17
sub edx, ebx
mov eax, ebx
ror eax, 0xc
ror edx, 0xb
imul edx, dword [esp + 0x18]
sub edx, eax
mov eax, dword [esp + 0x14]
xor eax, edx
mov edx, dword [esp + 0x18]
xor edx, eax
mov dword [esp + 0x14], eax
imul edx, dword [esp + 0x38]
shr eax, 8
xor edx, eax
xor ebx, edx
mov eax, ebx
xor ebx, dword [esp + 0x98]
xor eax, dword [esp + 0x14]
xor eax, 0xc81ecb17
mov dword [esp + 0xd8], ebx
xor eax, dword [esp + 0x48]
xor eax, 0xb1b54a58
mov dword [esp + 0x98], edi
mov dword [esp + 0xd4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x48], esi
mov byte [eax - 4], bl
mov al, byte [esp + 0xd4]
mov ebx, dword [esp + 0x40]
ror dword [esp + 0xd8], 8
mov byte [ebx], al
ror dword [esp + 0xd4], 8
mov al, byte [esp + 0xd8]
mov byte [ebx - 5], al
mov al, byte [esp + 0xd4]
ror dword [esp + 0xd8], 8
mov byte [ebx - 1], al
ror dword [esp + 0xd4], 8
mov al, byte [esp + 0xd8]
mov byte [ebx - 6], al
mov al, byte [esp + 0xd4]
ror dword [esp + 0xd8], 8
mov byte [ebx - 2], al
ror dword [esp + 0xd4], 8
mov al, byte [esp + 0xd8]
mov byte [ebx - 7], al
mov al, byte [esp + 0xd4]
mov byte [ebx - 3], al
add ebx, 8
mov edx, dword [esp + 0xd4]
ror dword [esp + 0xd8], 8
ror edx, 8
sub dword [esp + 0x5c], 1
mov dword [esp + 0xd4], edx
mov dword [esp + 0x40], ebx
jne 0x1001941a
mov edi, dword [esp + 0xa0]
xor ebx, ebx
mov esi, dword [esp + 0x58]
movzx eax, cl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x100197c0
mov esi, 0xc0000017
jmp 0x100198b9
mov eax, dword [esp + 0x24]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x100197e1
mov esi, 0xc0000017
jmp 0x10019858
mov dword [edi + 4], eax
push dword [esp + 0x24]
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x100197da
mov dword [edi + 0xc], eax
push 0xa0
push 0x100ceb88
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [edi + 0x10], esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100197da
mov dword [edi + 0x14], ecx
mov eax, dword [0x100cec28]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0x100cec2c]
mov dword [esp + 0x3c], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0x100198b9
cmp dword [edi + 4], 0
je 0x10019876
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x10019890
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x100198aa
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x100198c9
mov eax, dword [esp + 0x3c]
mov edi, ebx
mov dword [esp + 0x34], eax
jmp 0x100198cd
mov edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x58]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x10019941
cmp dword [edi + 4], 0
je 0x100198fe
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x10019918
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x10019932
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0xa4]
jmp 0x10019956
mov ecx, dword [esp + 0xa4]
mov esi, 0xc0000001
or esi, 0x10000000
jl 0x1001aa91
mov edx, dword [esp + 0x34]
mov eax, dword [edx + 0x10]
mov dword [esp + 0x30], eax
mov eax, dword [edx + 8]
mov edx, dword [edx]
add edx, 4
mov dword [esp + 0x60], eax
cmp edx, 4
jb 0x10019982
mov eax, edx
jmp 0x10019985
or eax, 0xffffffff
cmp edx, 4
sbb esi, esi
and esi, 0xc0000095
cmp edx, 4
jb 0x10019a13
lea edx, [eax + 4]
cmp edx, eax
jb 0x100199a0
mov edi, edx
jmp 0x100199a3
or edi, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
cmp edx, eax
jb 0x10019a13
mov eax, dword [esp + 0x60]
add eax, edi
cmp eax, edi
jb 0x100199bf
mov edx, eax
jmp 0x100199c2
or edx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x10019a13
lea edi, [edx + 4]
cmp edi, edx
jb 0x100199db
mov eax, edi
jmp 0x100199de
or eax, 0xffffffff
cmp edi, edx
sbb esi, esi
and esi, 0xc0000095
cmp edi, edx
jb 0x10019a13
mov edx, dword [esp + 0x30]
add edx, eax
cmp edx, eax
jb 0x100199fe
mov edi, edx
mov dword [esp + 0x3c], edx
jmp 0x10019a05
or edi, 0xffffffff
mov dword [esp + 0x3c], edi
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
cmp edx, eax
jae 0x10019a1e
mov edi, dword [esp + 0x248]
mov dword [esp + 0x3c], edi
test esi, esi
js 0x10019bae
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x10019a46
mov esi, 0xc0000017
jmp 0x10019ba7
mov edx, dword [esp + 0x34]
lea ecx, [edi + 4]
mov eax, dword [edx]
mov dword [edi], eax
cmp ecx, edi
jb 0x10019a5d
mov eax, ecx
mov dword [esp + 0x54], ecx
jmp 0x10019a64
or eax, 0xffffffff
mov dword [esp + 0x54], eax
cmp ecx, edi
sbb esi, esi
and esi, 0xc0000095
cmp ecx, edi
jb 0x10019b94
push dword [edx]
push dword [edx + 4]
push eax
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x40]
add esp, 0xc
mov ecx, dword [esp + 0x54]
mov esi, dword [edx]
add esi, ecx
mov dword [esp + 0x60], esi
cmp esi, ecx
jb 0x10019a9e
mov dword [esp + 0x54], esi
jmp 0x10019aa5
or eax, 0xffffffff
mov dword [esp + 0x54], eax
cmp esi, ecx
sbb esi, esi
and esi, 0xc0000095
cmp dword [esp + 0x60], ecx
jb 0x10019b94
mov ecx, dword [esp + 0x54]
mov eax, dword [edx + 8]
lea esi, [ecx + 4]
mov dword [ecx], eax
mov dword [esp + 0x60], esi
cmp esi, ecx
jb 0x10019ad5
mov eax, esi
mov dword [esp + 0x40], esi
jmp 0x10019adc
or eax, 0xffffffff
mov dword [esp + 0x40], eax
cmp esi, ecx
sbb esi, esi
and esi, 0xc0000095
cmp dword [esp + 0x60], ecx
jb 0x10019b94
push dword [edx + 8]
push dword [edx + 0xc]
push eax
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x40]
add esp, 0xc
mov esi, dword [esp + 0x40]
mov eax, dword [esp + 0x40]
add esi, dword [edx + 8]
mov dword [esp + 0x60], esi
cmp esi, eax
jb 0x10019b1a
mov ecx, esi
jmp 0x10019b1d
or ecx, 0xffffffff
cmp esi, eax
sbb esi, esi
and esi, 0xc0000095
cmp dword [esp + 0x60], eax
jb 0x10019b94
mov eax, dword [edx + 0x10]
lea esi, [ecx + 4]
mov dword [ecx], eax
mov dword [esp + 0x60], esi
cmp esi, ecx
jb 0x10019b45
mov eax, esi
mov dword [esp + 0x54], esi
jmp 0x10019b4c
or eax, 0xffffffff
mov dword [esp + 0x54], eax
cmp esi, ecx
sbb esi, esi
and esi, 0xc0000095
cmp dword [esp + 0x60], ecx
jb 0x10019b94
push dword [edx + 0x10]
push dword [edx + 0x14]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x40]
add esp, 0xc
mov ecx, dword [esp + 0x54]
mov eax, dword [eax + 0x10]
add eax, ecx
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10019b94
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x6c], edi
mov edi, ebx
mov dword [esp + 0x2c], eax
test edi, edi
je 0x10019ba7
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0xa4]
or esi, 0x10000000
jl 0x1001aa91
mov dword [esp + 0x98], ebx
cmp dword [esp + 0xac], 0
jne 0x10019bfe
mov esi, 0xc000000d
mov eax, ebx
test esi, esi
js 0x1001aa91
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x10019d81
mov esi, 0xd0000017
jmp 0x1001aa91
xor eax, eax
inc eax
cmp ecx, eax
jbe 0x10019bcb
mov edx, dword [esp + 0xac]
mov dword [esp + 0x54], ebx
mov eax, dword [edx]
lea edi, [edx + 4]
mov dword [esp + 0x60], eax
cmp edi, edx
jb 0x10019c21
mov eax, edi
jmp 0x10019c24
or eax, 0xffffffff
cmp edi, edx
sbb esi, esi
and esi, 0xc0000095
cmp edi, edx
jb 0x10019c79
mov edx, dword [esp + 0x60]
add edx, eax
mov edi, edx
cmp edx, eax
jae 0x10019c41
or edx, 0xffffffff
cmp edi, eax
sbb esi, esi
and esi, 0xc0000095
cmp edi, eax
jb 0x10019c79
mov eax, dword [esp + 0x54]
xor esi, esi
inc eax
inc esi
mov dword [esp + 0x54], eax
cmp eax, esi
jb 0x10019c10
lea eax, [edx + 4]
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x10019c79
mov eax, dword [edx]
mov dword [esp + 0x98], eax
test esi, esi
js 0x10019bd0
cmp ecx, 2
jbe 0x10019bcb
mov ecx, dword [esp + 0xac]
mov edi, ebx
mov eax, dword [ecx]
lea edx, [ecx + 4]
mov dword [esp + 0x60], eax
cmp edx, ecx
jb 0x10019ca4
mov eax, edx
jmp 0x10019ca7
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
cmp edx, ecx
jb 0x10019ced
mov ecx, dword [esp + 0x60]
add ecx, eax
mov edx, ecx
cmp ecx, eax
jae 0x10019cc4
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
cmp edx, eax
jb 0x10019ced
inc edi
cmp edi, 2
jb 0x10019c93
lea eax, [ecx + 4]
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10019ced
mov edi, dword [ecx]
jmp 0x10019cef
mov edi, ebx
test esi, esi
js 0x10019bd0
mov eax, dword [esp + 0x98]
add eax, 0x30
cmp eax, 0x30
jb 0x10019d0a
mov ecx, eax
jmp 0x10019d0d
or ecx, 0xffffffff
cmp eax, 0x30
sbb esi, esi
and esi, 0xc0000095
cmp eax, 0x30
jb 0x10019d55
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x10019d28
mov eax, edx
jmp 0x10019d2b
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
cmp edx, ecx
jb 0x10019d55
lea edx, [eax + edi]
cmp edx, eax
jb 0x10019d44
mov ecx, edx
jmp 0x10019d47
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
cmp edx, eax
jae 0x10019d5c
mov ecx, dword [esp + 0x24c]
test esi, esi
js 0x10019bd0
cmp ecx, 0x400000
jbe 0x10019d76
mov esi, 0x8000ffff
jmp 0x1001aa91
mov eax, ecx
mov dword [esp + 0x1c], eax
jmp 0x10019bd2
mov dword [esp + 0x4c], edi
mov eax, dword [esp + 0x6c]
test eax, eax
jne 0x10019d97
mov esi, 0x80070057
jmp 0x1001aa91
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x1f0], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1f8], eax
lea eax, [esp + 0x118]
push eax
xor eax, eax
mov dword [esp + 0x1f8], edi
push 0x10005ea8
inc eax
mov dword [esp + 0x204], ecx
push eax
mov dword [esp + 0x20c], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x10019e01
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10019df4
movzx esi, si
or esi, 0x80070000
test esi, esi
mov eax, dword [esp + 0x1c]
js 0x10019e4e
mov esi, 0x80004005
jmp 0x10019e4e
push 0x10008d60
push dword [esp + 0x11c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10019ddd
push ebx
push 0x14
lea eax, [esp + 0x1f8]
mov ecx, esi
push eax
push 0x86
call dword [0x100d6738]
call esi
mov esi, eax
or esi, 0x10000000
jl 0x10019e4a
mov eax, dword [esp + 0x1fc]
mov dword [esp + 0x1c], eax
jmp 0x10019e4e
mov eax, dword [esp + 0x1c]
cmp esi, 0xd0000023
jne 0x10019e60
mov esi, 0x8007007a
jmp 0x1001aa91
test esi, esi
js 0x1001aa91
mov dword [esp + 0x58], ebx
cmp eax, 4
jae 0x10019e7b
mov esi, 0xc000003e
jmp 0x1001a247
mov ecx, dword [edi]
lea eax, [edi + 4]
mov dword [esp + 0x40], ecx
cmp eax, edi
jb 0x10019e93
mov edx, eax
mov dword [esp + 0xa0], eax
jmp 0x10019e9d
or edx, 0xffffffff
mov dword [esp + 0xa0], edx
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x1001a247
mov eax, dword [esp + 0x1c]
add eax, 0xfffffffc
cmp eax, ecx
jb 0x10019e71
lea edi, [edx + ecx]
cmp edi, edx
jb 0x10019ec5
mov edx, edi
jmp 0x10019ec8
or edx, 0xffffffff
cmp edi, dword [esp + 0xa0]
sbb esi, esi
and esi, 0xc0000095
cmp edi, dword [esp + 0xa0]
jb 0x1001a247
lea eax, [ecx + 4]
cmp eax, 4
jb 0x10019ef0
mov ecx, eax
jmp 0x10019ef3
or ecx, 0xffffffff
cmp eax, 4
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
cmp eax, 4
jb 0x1001a247
mov eax, dword [esp + 0x1c]
sub eax, ecx
cmp eax, 4
jb 0x10019e71
mov eax, dword [edx]
mov dword [esp + 0x98], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x10019f30
mov dword [esp + 0x104], eax
jmp 0x10019f38
or dword [esp + 0x104], 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, edi
cmp eax, edx
jb 0x1001a247
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x10019f51
mov edi, eax
jmp 0x10019f54
or edi, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1001a247
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x98]
sub eax, edi
cmp eax, ecx
jb 0x10019e71
mov edx, dword [esp + 0x104]
lea esi, [ecx + edx]
cmp esi, edx
jb 0x10019f8f
mov dword [esp + 0x54], esi
jmp 0x10019f96
or eax, 0xffffffff
mov dword [esp + 0x54], eax
cmp esi, edx
lea eax, [ecx + edx]
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x1001a247
lea eax, [ecx + edi]
cmp eax, edi
jb 0x10019fb6
mov edx, eax
jmp 0x10019fb9
or edx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x1001a247
mov eax, dword [esp + 0x1c]
sub eax, edx
cmp eax, 4
jb 0x10019e71
mov eax, dword [esp + 0x54]
mov edi, dword [eax]
lea ecx, [eax + 4]
mov dword [esp + 0x60], edi
cmp ecx, eax
jb 0x10019ff1
mov dword [esp + 0x3c], ecx
jmp 0x10019ff6
or dword [esp + 0x3c], 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
cmp ecx, eax
jb 0x1001a247
lea eax, [edx + 4]
cmp eax, edx
jb 0x1001a013
mov ecx, eax
jmp 0x1001a016
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x1001a247
mov eax, dword [esp + 0x1c]
sub eax, ecx
cmp eax, edi
jb 0x10019e71
lea eax, [edi + ecx]
cmp eax, ecx
jb 0x1001a041
mov edx, eax
jmp 0x1001a044
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1001a247
mov eax, dword [esp + 0x1c]
sub eax, edx
jne 0x10019e71
mov esi, dword [esp + 0x98]
mov ecx, dword [esp + 0x40]
add ecx, 0xc
lea eax, [edi + esi]
add eax, ecx
cmp eax, dword [esp + 0x1c]
jne 0x10019e71
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1001a0a0
mov esi, 0xc0000017
jmp 0x1001a1d2
cmp dword [esp + 0xa0], 0
je 0x1001a0e8
mov eax, dword [esp + 0x40]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x1001a0ce
mov esi, 0xc0000017
jmp 0x1001a171
mov dword [edi + 4], eax
mov ecx, dword [esp + 0x40]
push ecx
push dword [esp + 0xa4]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x1001a0ed
mov dword [edi], ebx
mov dword [edi + 4], ebx
cmp dword [esp + 0x104], 0
je 0x1001a124
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1001a0c4
mov dword [edi + 0xc], eax
push esi
push dword [esp + 0x108]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x1001a12a
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [esp + 0x3c], 0
je 0x1001a163
mov esi, dword [esp + 0x60]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1001a0c4
mov dword [edi + 0x14], eax
push esi
push dword [esp + 0x40]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x1001a169
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [esp + 0x58], edi
mov esi, ebx
mov edi, ebx
test edi, edi
je 0x1001a1d2
cmp dword [edi + 4], 0
je 0x1001a18f
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x1001a1a9
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x1001a1c3
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x1001a1e2
mov eax, dword [esp + 0x58]
mov edi, ebx
mov dword [esp + 0x78], eax
jmp 0x1001a1e6
mov edi, dword [esp + 0x58]
test edi, edi
je 0x1001a247
cmp dword [edi + 4], 0
je 0x1001a204
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x1001a21e
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x1001a238
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
or esi, 0x10000000
jl 0x1001aa91
mov ecx, dword [esp + 0x78]
mov edi, ebx
mov dword [esp + 0x2c], ebx
test ecx, ecx
jne 0x1001a26b
mov esi, 0xd000000d
jmp 0x1001aa91
mov eax, dword [ecx + 4]
mov dword [esp + 0x24], eax
test eax, eax
je 0x1001a261
mov esi, dword [ecx]
test esi, esi
je 0x1001a261
add esi, 0xfffffff8
push esi
push ebx
mov dword [esp + 0xa8], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x5c], eax
test eax, eax
je 0x1001a83d
mov ecx, dword [esp + 0x24]
mov edi, esi
and edi, 7
mov dword [esp + 0x40], eax
mov dl, bl
mov dword [esp + 0x6b0], 0xab69605e
mov dword [esp + 0x98], ecx
mov eax, ebx
mov dword [esp + 0x30], edi
je 0x1001a7e5
or dword [esp + 0xb4], 0xffffffff
mov esi, ebx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
test edi, edi
je 0x1001a334
lea eax, [ecx + 1]
mov dword [esp + 0x60], eax
movzx eax, byte [ecx]
mov ecx, dword [esp + 0x108]
cmp esi, 4
jge 0x1001a30c
add ecx, 0xffffffe0
shl eax, cl
or dword [esp + 0x18], eax
jmp 0x1001a310
shl eax, cl
or ebx, eax
sub dword [esp + 0x108], 8
inc esi
mov eax, dword [esp + 0x60]
mov ecx, eax
cmp esi, edi
jl 0x1001a2eb
mov dword [esp + 0x1c], ebx
xor ebx, ebx
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor eax, 0x92f65a5
xor ecx, 0x699a899c
mov dword [esp + 0x38], eax
mov dword [esp + 0xc0], eax
mov dword [esp + 0x74], ecx
mov dword [esp + 0xb4], ecx
mov dword [esp + 0x60], ebx
test edi, edi
je 0x1001a3a6
mov esi, dword [esp + 0x40]
lea edi, [esi + 1]
mov dword [esp + 0x54], edi
cmp ebx, 4
jge 0x1001a378
rol eax, 8
mov byte [esi], al
jmp 0x1001a37d
rol ecx, 8
mov byte [esi], cl
mov edi, dword [esp + 0x30]
inc ebx
mov esi, dword [esp + 0x54]
cmp ebx, edi
jl 0x1001a365
mov eax, esi
xor ebx, ebx
mov esi, dword [esp + 0xb4]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0xc0]
mov dword [esp + 0x38], eax
jmp 0x1001a3aa
mov esi, dword [esp + 0x74]
add edi, 0xfffffffc
test edi, edi
jle 0x1001a7b5
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [esp + 0x74], esi
mov dword [esp + 0xb4], esi
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0xa0]
mov eax, esi
shr eax, 3
mov dword [esp + 0x48], eax
test eax, eax
je 0x1001a784
movzx esi, word [esp + 0x6b2]
mov eax, 0x7f1137f
mov ecx, eax
mov dword [esp + 0x28], esi
mov esi, dword [esp + 0x98]
movzx eax, ax
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x40]
shr ecx, 0x10
add eax, 7
mov dword [esp + 0xd0], ecx
add esi, 2
mov dword [esp + 0x54], eax
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx ecx, byte [esi + 2]
shl ecx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or ecx, eax
mov dword [esp + 0x60], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl ecx, 8
or ecx, eax
mov dword [esp + 0x38], edi
movzx eax, byte [esi + 5]
add esi, 8
mov ebx, dword [esp + 0x38]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x98], esi
mov edi, ecx
mov esi, dword [esp + 0x3c]
xor edi, dword [esp + 0x74]
mov eax, 0x7f1137f
mov dword [esp + 0x30], ecx
xor edi, ebx
xor edi, eax
xor edi, 0xab69605e
mov eax, edi
rol eax, 0xa
lea ecx, [edi + 0x54969fa2]
rol ecx, 5
imul ecx, esi
add ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ebx + ecx]
ror ecx, 9
imul ecx, dword [esp + 0x28]
sub ecx, eax
xor edi, ecx
mov eax, edi
sub eax, esi
imul ecx, eax, 0x605e
mov eax, edi
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [esp + 0x28]
rol ecx, 6
imul ecx, dword [esp + 0xd0]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor edi, ecx
mov ecx, edi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, esi
ror ecx, 6
imul eax, dword [esp + 0x28]
xor ecx, eax
mov eax, 0x7f1137f
xor edi, ecx
add eax, edi
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, edi
rol eax, 2
add ecx, eax
xor ebx, ecx
mov eax, ebx
rol eax, 8
lea ecx, [ebx + 0x54969fa2]
ror ecx, 0xe
imul ecx, dword [esp + 0xd0]
sub ecx, eax
xor edi, ecx
mov ecx, edi
mov eax, edi
xor ecx, 0xab69605e
ror eax, 0xa
ror ecx, 0xc
imul ecx, esi
xor ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [esp + 0xd0]
imul ecx, dword [esp + 0x28]
shr eax, 0xa
xor ecx, eax
xor edi, ecx
mov eax, edi
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [esp + 0xd0]
xor ebx, eax
mov esi, ebx
sub esi, dword [esp + 0xd0]
xor esi, edi
xor esi, 0xab69605e
mov ecx, esi
mov eax, esi
xor ecx, dword [esp + 0xd0]
rol ecx, 2
imul ecx, dword [esp + 0x3c]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 6
imul ecx, dword [esp + 0x28]
rol eax, 7
add ecx, eax
xor esi, ecx
mov eax, esi
mov ecx, esi
xor eax, dword [esp + 0x3c]
imul eax, eax, 0x605e
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov dword [esp + 0x38], ebx
xor ecx, dword [esp + 0x28]
mov eax, ebx
rol ecx, 5
imul ecx, dword [esp + 0xd0]
rol eax, 7
add ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov ebx, esi
xor ebx, dword [esp + 0x38]
xor ebx, ecx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [esp + 0x28]
imul eax, dword [esp + 0x3c]
xor esi, eax
mov eax, esi
sub eax, ecx
ror eax, 1
imul ecx, eax, 0x605e
mov eax, esi
ror eax, 6
sub ecx, eax
xor ebx, ecx
mov eax, ebx
rol eax, 0xe
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul ecx, dword [esp + 0xd0]
add ecx, eax
xor esi, ecx
mov eax, esi
ror eax, 0xe
lea ecx, [esi - 0x54969fa2]
rol ecx, 0xf
imul ecx, dword [esp + 0x3c]
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
shr eax, 3
xor ecx, 0x605e
imul ecx, dword [esp + 0x28]
xor ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov eax, esi
xor eax, ecx
rol eax, 4
imul ecx, eax, 0x605e
mov eax, esi
xor esi, dword [esp + 0x1c]
rol eax, 2
mov dword [esp + 0xb4], esi
mov esi, dword [esp + 0x98]
xor ecx, eax
xor ecx, dword [esp + 0x18]
xor ebx, ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0xc0], ebx
mov byte [ecx - 4], bl
mov al, byte [esp + 0xb4]
ror dword [esp + 0xc0], 8
mov byte [ecx], al
mov al, byte [esp + 0xc0]
ror dword [esp + 0xb4], 8
mov byte [ecx - 5], al
mov al, byte [esp + 0xb4]
ror dword [esp + 0xc0], 8
mov byte [ecx - 1], al
mov al, byte [esp + 0xc0]
ror dword [esp + 0xb4], 8
mov byte [ecx - 6], al
mov al, byte [esp + 0xb4]
ror dword [esp + 0xc0], 8
mov byte [ecx - 2], al
ror dword [esp + 0xb4], 8
mov al, byte [esp + 0xc0]
mov byte [ecx - 7], al
mov al, byte [esp + 0xb4]
mov byte [ecx - 3], al
add ecx, 8
mov eax, dword [esp + 0xb4]
mov edi, dword [esp + 0xc0]
ror eax, 8
mov dword [esp + 0x74], eax
mov dword [esp + 0xb4], eax
mov eax, dword [esp + 0x60]
ror edi, 8
sub dword [esp + 0x48], 1
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc0], edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x54], ecx
jne 0x1001a421
mov esi, dword [esp + 0xa0]
xor ebx, ebx
mov ecx, dword [esp + 0x5c]
mov eax, ebx
test esi, esi
je 0x1001a796
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0x1001a78e
mov edi, dword [esp + 0x24]
movzx eax, dl
cdq
cmp eax, dword [esi + edi]
jne 0x1001a807
cmp edx, dword [esi + edi + 4]
jne 0x1001a807
mov edi, ecx
mov dword [esp + 0x2c], esi
mov ecx, ebx
mov esi, ebx
jmp 0x1001a80e
mov ecx, ebx
mov dword [esp + 0x74], ecx
mov dword [esp + 0xb4], ecx
test edi, edi
jns 0x1001a3cc
neg edi
shl edi, 3
mov ecx, edi
shr eax, cl
shl eax, cl
mov dword [esp + 0x38], eax
mov dword [esp + 0xc0], eax
jmp 0x1001a3cc
or dword [esp + 0x1c], 0xffffffff
mov edi, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x74], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xc0], edi
jmp 0x1001a3d7
mov esi, 0xc004d501
mov edi, ebx
test ecx, ecx
je 0x1001a821
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x1001a83d
mov eax, dword [esp + 0x2c]
mov esi, 0x10000000
mov dword [esp + 0x88], edi
mov edi, ebx
mov dword [esp + 0x68], eax
jmp 0x1001a842
mov esi, 0xd0000001
test edi, edi
je 0x1001a855
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x1001aa91
mov edx, dword [esp + 0x68]
cmp edx, 4
jb 0x1001aa86
mov edi, dword [esp + 0x88]
mov eax, dword [edi]
mov dword [esp + 0x30], eax
lea eax, [edi + 4]
cmp eax, edi
jb 0x1001a882
mov ecx, eax
jmp 0x1001a885
or ecx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x1001aa8b
lea eax, [edx - 4]
cmp eax, 4
jb 0x1001aa86
mov edx, dword [ecx]
lea eax, [ecx + 4]
mov dword [esp + 0x48], edx
cmp eax, ecx
jb 0x1001a8b4
mov edi, eax
jmp 0x1001a8b7
or edi, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1001aa8b
mov eax, dword [esp + 0x68]
add eax, 0xfffffff8
cmp eax, edx
jb 0x1001aa86
lea eax, [edx + 8]
cmp eax, 8
sbb esi, esi
and esi, 0xc0000095
cmp eax, 8
jb 0x1001aa8b
mov eax, dword [esp + 0x88]
lea ecx, [edi + edx]
mov esi, dword [esp + 0x68]
add eax, esi
mov dword [esp + 0x60], ecx
cmp eax, ecx
jb 0x1001aa86
sub esi, edi
sub esi, edx
add esi, dword [esp + 0x88]
cmp esi, 8
jae 0x1001aa86
mov dword [esp + 0x3c], ebx
mov eax, ebx
mov dword [esp + 0x5c], eax
mov esi, ebx
test edi, edi
je 0x1001aa20
lea esi, [edi + edx]
mov ecx, edi
cmp esi, edi
jb 0x1001a947
mov eax, esi
mov dword [esp + 0x98], esi
jmp 0x1001a951
or eax, 0xffffffff
mov dword [esp + 0x98], eax
cmp esi, edi
sbb esi, esi
and esi, 0xc0000095
cmp dword [esp + 0x60], edi
jb 0x1001aa75
cmp edi, eax
jae 0x1001aa1a
lea esi, [ecx + 4]
mov dword [esp + 0x60], esi
cmp esi, ecx
jb 0x1001a97e
mov dword [esp + 0x54], esi
jmp 0x1001a983
or dword [esp + 0x54], 0xffffffff
cmp esi, ecx
sbb esi, esi
and esi, 0xc0000095
cmp dword [esp + 0x60], ecx
jb 0x1001aa75
cmp dword [esp + 0x54], eax
ja 0x1001aa43
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0x1001a9b1
mov dword [esp + 0x54], eax
jmp 0x1001a9b6
or dword [esp + 0x54], 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
cmp eax, 4
jb 0x1001aa75
mov edx, dword [esp + 0x54]
mov dword [esp + 0x1bc], edx
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x1bc]
add eax, ecx
cmp eax, ecx
jb 0x1001a9ec
mov dword [esp + 0x40], eax
jmp 0x1001a9f1
or dword [esp + 0x40], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1001aa75
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x40]
cmp ecx, eax
ja 0x1001aa43
inc dword [esp + 0x3c]
cmp ecx, eax
jb 0x1001a96d
cmp ecx, eax
jne 0x1001aa43
mov eax, ebx
test edx, edx
je 0x1001aa50
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x5c], eax
test eax, eax
jne 0x1001aa4a
mov esi, 0xc0000017
jmp 0x1001aa75
mov esi, 0xc000000d
jmp 0x1001aa8b
mov edx, dword [esp + 0x48]
mov esi, ebx
test edi, edi
je 0x1001aa63
push edx
push edi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x68]
add esp, 0xc
mov dword [esp + 0x168], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x160], eax
test esi, esi
js 0x1001aa8b
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x160]
je 0x1001aa8b
mov esi, 0xc000003e
or esi, 0x10000000
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1001aaa8
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x34]
test edi, edi
je 0x1001ab0d
cmp dword [edi + 4], 0
je 0x1001aaca
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x1001aae4
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x1001aafe
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x1001ab24
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x1001ab3b
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x78]
test edi, edi
je 0x1001aba0
cmp dword [edi + 4], 0
je 0x1001ab5d
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x1001ab77
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x1001ab91
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x88]
test eax, eax
je 0x1001abba
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x1001ac7e
xor eax, eax
inc eax
cmp dword [esp + 0x160], eax
jb 0x1001ac7e
mov eax, dword [esp + 0x168]
test eax, eax
je 0x1001ac7e
cmp dword [esp + 0x160], 0
jbe 0x1001ac7e
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x1001abfc
mov edi, ecx
jmp 0x1001abff
or edi, 0xffffffff
cmp ecx, dword [esp + 0x168]
sbb esi, esi
and esi, 0xc0000095
cmp ecx, dword [esp + 0x168]
jb 0x1001ac21
mov eax, edx
neg eax
sbb eax, eax
and eax, edi
jmp 0x1001ac2f
mov edx, dword [esp + 0x250]
mov eax, dword [esp + 0x254]
test esi, esi
js 0x1001ac7e
cmp edx, 4
jne 0x1001ac7e
cmp dword [eax], 0
jl 0x1001ac7e
xor eax, eax
inc eax
cmp dword [esp + 0x160], eax
jbe 0x1001ac7e
mov eax, dword [esp + 0x168]
mov esi, ebx
mov edi, dword [eax]
lea edx, [eax + 4]
cmp edx, eax
jb 0x1001ac5f
mov ecx, edx
jmp 0x1001ac62
or ecx, 0xffffffff
cmp edx, eax
jb 0x1001ac7e
lea eax, [edi + ecx]
mov edx, eax
cmp eax, ecx
jae 0x1001ac72
or eax, 0xffffffff
cmp edx, ecx
jb 0x1001ac7e
xor ecx, ecx
inc esi
inc ecx
cmp esi, ecx
jb 0x1001ac52
mov esi, dword [esp + 0x64]
mov edi, dword [esp + 0x44]
jmp 0x1001ac8c
mov esi, ebx
mov edi, ebx
cmp dword [esp + 0xac], 0
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xa4], ebx
je 0x1001acc0
push dword [esp + 0xac]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0xac], ebx
mov eax, dword [esp + 0x168]
test eax, eax
je 0x1001acda
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x1001aced
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x1001ad00
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x130]
mov dword [esp + 0x130], ebx
mov dword [esp + 0x15c], eax
jmp 0x10011c78
cmp eax, 0xd00000e5
je 0x1001ad39
cmp eax, 0xc004d501
je 0x1001ad39
cmp eax, 0xd000003e
jne 0x1001ad3e
mov eax, 0xc004f028
jmp 0x10011d0d
mov eax, 0xc004f027
test eax, eax
jns 0x1001ad5c
cmp eax, 0x8007007a
jne 0x10011d0d
mov dword [esp + 0x138], 0xc004f01e
mov esi, ebx
jmp 0x1001ad6f
cmp dword [esp + 0x128], 4
jne 0x1001ad4d
mov eax, dword [esp + 0x15c]
mov esi, dword [eax]
lea ecx, [esp + 0x15c]
call fcn.1002acfd
cmp dword [esp + 0x138], 0
jl 0x1001adca
test esi, esi
je 0x1001adca
cmp dword [ebp + 0xc], edi
jne 0x1001adb4
call fcn.1001b504
mov eax, section..data
mov edx, 0x1001b890
push eax
push eax
mov ecx, 0x10005b08
call fcn.1001b99e
cmp byte [0x100d4e88], 0
je 0x1001adc4
jmp 0x1001adc6
cmp dword [ebp + 0xc], 0
jne 0x1001adc4
mov ecx, section..data
call fcn.1001b864
mov ebx, edi
mov eax, ebx
jmp 0x1001adcc
xor eax, eax
mov ecx, dword [esp + 0xd6c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100c6890
mov esp, ebp
pop ebp
ret 0xc