Function at 0x1003ca50
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Encode data using base64
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x530
call 0x1003ca64
pop eax
mov dword [esp + 0x88], ecx
mov ecx, dword [edx + 0x50]
mov dword [esp + 0x10c], 0
mov dword [esp + 0x14], edx
mov dword [esp + 0xb4], eax
movzx eax, byte [edx + 0x54]
test al, al
jne 0x1003cab0
test ecx, ecx
jne 0x1003cab0
mov dword [esp + 0x114], 0
mov dword [esp + 0x1c], 0
lea ecx, [esp + 0x118]
jmp 0x1003d521
test al, al
mov dword [esp + 0xec], 0
mov dword [esp + 0xf4], 0
jne 0x1003ccad
mov dword [esp + 0x20], ecx
call sub.KERNEL32.dll_GetEnvironmentStringsW
test eax, eax
je 0x10040383
mov ebx, eax
mov dword [esp + 0x38], eax
jmp 0x1003caf4
mov ebx, dword [esp + 0x10]
cmp word [ebx], 0
je 0x1003cca0
mov edi, 0xffffffff
mov ecx, 0xfffffffe
nop dword [eax + eax]
cmp word [ebx + edi*2 + 2], 0
mov eax, ecx
lea edi, [edi + 1]
lea ecx, [ecx + 2]
jne 0x1003cb10
lea ecx, [ebx + edi*2 + 2]
cmp edi, 1
mov dword [esp + 0x10], ecx
je 0x1003caf0
test edi, edi
je 0x10040297
xor esi, esi
nop word [eax + eax]
cmp word [ebx + esi*2 + 2], 0x3d
je 0x1003cb50
inc esi
add eax, 0xfffffffe
jne 0x1003cb40
jmp 0x1003caf0
lea eax, [esi + 1]
cmp esi, edi
jae 0x100402cc
mov edx, ebx
lea ecx, [esp + 0x44]
push eax
call fcn.10017730
add esp, 4
add esi, 2
mov eax, edi
sub eax, esi
jb 0x100402e2
lea edx, [ebx + esi*2]
lea ecx, [esp + 0x12c]
push eax
call fcn.10017730
add esp, 4
mov edi, dword [esp + 0x44]
cmp edi, 0x80000000
je 0x1003cca0
mov eax, dword [esp + 0x12c]
movq xmm0, qword [esp + 0x4c]
mov ebx, dword [esp + 0x48]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x130]
movd esi, xmm0
mov dword [esp + 0x44], ebx
movdqa xmmword [esp + 0xa0], xmm0
add esi, ebx
mov dword [esp + 0x48], esi
mov esi, dword [esp + 0x134]
mov word [esp + 0x4c], 0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x138]
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x44]
call fcn.10040b00
movaps xmm0, xmmword [esp + 0xa0]
mov eax, dword [esp + 0xc8]
lea ecx, [esp + 0x13c]
mov dword [esp + 0x12c], edi
mov dword [esp + 0x130], ebx
movlps qword [esp + 0x134], xmm0
mov dword [ecx + 8], eax
mov eax, dword [esp + 0xc]
movq xmm0, qword [esp + 0xc0]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x18]
movq qword [ecx], xmm0
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], eax
lea edx, [esp + 0xec]
lea eax, [esp + 0x44]
lea ecx, [esp + 0xc0]
push eax
lea eax, [esp + 0x130]
push eax
call fcn.10040cc0
add esp, 8
test dword [esp + 0xc0], 0x7fffffff
mov ebx, dword [esp + 0x10]
je 0x1003caf4
mov ecx, dword [esp + 0xc4]
mov edx, 1
call fcn.10006c20
jmp 0x1003caf4
push dword [esp + 0x38]
call sub.KERNEL32.dll_FreeEnvironmentStringsW
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov ebx, dword [eax + 0x48]
mov eax, dword [eax + 0x4c]
mov dword [esp + 0x10], eax
xor eax, eax
test ebx, ebx
setne al
cmove ecx, ebx
xor edx, edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jmp 0x1003cce2
xor ebx, ebx
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x1003d351
cmp dword [esp + 0x1c], 0
je 0x100401e1
mov eax, dword [esp + 0x10]
test edx, edx
je 0x1003cd10
mov edi, eax
jmp 0x1003cd2b
xor edi, edi
mov edx, ebx
test eax, eax
mov dword [esp + 0x1c], 1
je 0x1003cd29
mov edx, dword [edx + 0x1ec]
dec eax
jne 0x1003cd20
xor ebx, ebx
movzx eax, word [edx + 0x1ea]
cmp edi, eax
jae 0x1003cd40
mov esi, edx
jmp 0x1003cd61
mov esi, dword [edx + 0xb0]
test esi, esi
je 0x1003fe4e
movzx edi, word [edx + 0x1e8]
inc ebx
mov edx, esi
cmp di, word [esi + 0x1ea]
jae 0x1003cd40
lea eax, [edi + 1]
test ebx, ebx
je 0x1003cd90
lea eax, [esi + eax*4 + 0x1ec]
nop
mov edx, dword [eax]
dec ebx
lea eax, [edx + 0x1ec]
jne 0x1003cd70
mov dword [esp + 0x10], 0
jmp 0x1003cd96
mov dword [esp + 0x10], eax
mov edx, esi
lea eax, [edi + edi*8]
dec ecx
lea eax, [eax + eax*2]
mov dword [esp + 0x20], ecx
add eax, edi
shl edi, 4
cmp dword [esi + edi], 0x80000000
lea eax, [esi + eax + 0xb4]
jne 0x1003ce00
mov esi, dword [esp + 0xec]
xor ebx, ebx
test esi, esi
je 0x1003cce2
mov edi, eax
mov eax, dword [esp + 0xf0]
mov dword [esp + 0x18], edx
mov edx, esi
lea ecx, [esp + 0x28]
push dword [edi + 0x18]
push dword [edi + 0x14]
mov edi, eax
push eax
call fcn.10041a70
add esp, 0xc
cmp dword [esp + 0x28], 0
je 0x1003cfba
mov edx, dword [esp + 0x18]
jmp 0x1003cce2
mov ebx, dword [eax + 4]
mov dword [esp + 0xa0], eax
mov eax, dword [eax + 8]
mov dword [esp + 0x18], edx
test eax, eax
mov dword [esp + 0xc], eax
je 0x1003ce3a
js 0x1004025d
movzx eax, byte [0x1008b0d4]
mov edx, dword [esp + 0xc]
xor ecx, ecx
call fcn.10045ab0
test eax, eax
jne 0x1003ce3f
jmp 0x10040256
mov eax, 1
push dword [esp + 0xc]
push ebx
mov dword [esp + 0x40], eax
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0xa0]
movzx ecx, byte [eax + 0xc]
mov byte [esp + 0x90], cl
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0x18]
test eax, eax
mov dword [esp + 0xa0], eax
je 0x1003ceb2
lea edx, [eax + eax]
cmp eax, 0x3fffffff
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x24], edx
ja 0x10040274
movzx eax, byte [0x1008b0d4]
xor ecx, ecx
call fcn.10045ab0
test eax, eax
je 0x1004026d
mov ebx, eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x8c]
jmp 0x1003ceb9
mov ebx, 2
xor eax, eax
add esi, edi
push eax
push ecx
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], ecx
mov dword [esp + 0x134], eax
movzx eax, byte [esp + 0x90]
mov byte [esp + 0x138], al
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ebx
mov dword [esp + 0x144], eax
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
test edx, edx
mov dword [esp + 0xc], edx
je 0x1003cf40
js 0x10040252
mov edi, eax
movzx eax, byte [0x1008b0d4]
xor ecx, ecx
call fcn.10045ab0
test eax, eax
je 0x10040284
mov ebx, eax
mov eax, edi
jmp 0x1003cf45
mov ebx, 1
mov edi, dword [esp + 0xc]
push edi
push eax
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
movzx eax, byte [esi + 0xc]
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], edi
mov byte [esp + 0x50], al
lea edx, [esp + 0xec]
lea eax, [esp + 0x44]
lea ecx, [esp + 0xc0]
push eax
lea eax, [esp + 0x130]
push eax
call fcn.10040cc0
add esp, 8
test dword [esp + 0xc0], 0x7fffffff
mov edx, dword [esp + 0x18]
je 0x1003cce0
mov ecx, dword [esp + 0xc4]
mov esi, edx
mov edx, 1
call fcn.10006c20
mov edx, esi
jmp 0x1003cce0
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
mov byte [esp + 0xfc], 0
test ecx, ecx
je 0x1003d0bb
nop word cs:[eax + eax]
mov eax, dword [eax + edx*4 + 0x1ec]
dec ecx
je 0x1003cff3
movzx edx, word [eax + 0x1ea]
jmp 0x1003cfe0
movzx ecx, word [eax + 0x1ea]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], 0
dec ecx
mov dword [esp + 0x9c], ecx
lea edx, [esp + 0x94]
lea eax, [esp + 0xfc]
lea ecx, [esp + 0x12c]
push eax
call fcn.10041b90
add esp, 4
movsd xmm2, qword [esp + 0x144]
movsd xmm1, qword [esp + 0x13c]
mov eax, dword [esp + 0x154]
movq xmm0, qword [esp + 0x14c]
mov edx, dword [esp + 0x158]
mov ecx, dword [esp + 0x160]
mov dword [esp + 0xc], esi
movsd qword [esp + 0xd8], xmm2
movsd qword [esp + 0xd0], xmm1
movsd xmm2, qword [esp + 0x12c]
movsd xmm1, qword [esp + 0x134]
mov dword [esp + 0xe8], eax
movq qword [esp + 0xe0], xmm0
movsd qword [esp + 0xc8], xmm1
movsd qword [esp + 0xc0], xmm2
movzx eax, word [edx + 0x1ea]
cmp ecx, eax
jae 0x1003d0eb
mov eax, edx
jmp 0x1003d123
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], edx
lea edx, [esp + 0x44]
lea eax, [esp + 0xfc]
lea ecx, [esp + 0x12c]
push eax
call fcn.10041b90
add esp, 4
jmp 0x1003d237
mov esi, dword [esp + 0x15c]
nop word cs:[eax + eax]
nop dword [eax]
mov eax, dword [edx + 0xb0]
test eax, eax
je 0x1003d11f
movzx ecx, word [edx + 0x1e8]
inc esi
mov edx, eax
cmp cx, word [eax + 0x1ea]
jae 0x1003d100
jmp 0x1003d123
xor eax, eax
mov ecx, esi
lea edx, [ecx + ecx*8]
lea edx, [edx + edx*2]
add edx, ecx
shl ecx, 4
mov esi, dword [eax + edx + 0xcc]
mov dword [esp + 0x5c], esi
mov esi, dword [esp + 0xd8]
movsd xmm0, qword [eax + edx + 0xc4]
movsd qword [esp + 0x54], xmm0
movsd xmm0, qword [eax + edx + 0xb4]
movsd xmm1, qword [eax + edx + 0xbc]
movsd qword [esp + 0x4c], xmm1
movsd qword [esp + 0x44], xmm0
mov dword [eax + edx + 0xcc], esi
lea esi, [esp + 0xdc]
movsd xmm0, qword [esp + 0xd0]
movsd qword [eax + edx + 0xc4], xmm0
movsd xmm0, qword [esp + 0xc0]
movsd xmm1, qword [esp + 0xc8]
movsd qword [eax + edx + 0xbc], xmm1
movsd qword [eax + edx + 0xb4], xmm0
lea edx, [esp + 0x60]
movsd xmm0, qword [eax + ecx]
movsd xmm1, qword [eax + ecx + 8]
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm0
movsd xmm0, qword [esi]
movsd xmm1, qword [esi + 8]
mov esi, dword [esp + 0xc]
movsd qword [eax + ecx], xmm0
movsd qword [eax + ecx + 8], xmm1
movsd xmm1, qword [esp + 0x4c]
mov eax, dword [esp + 0x6c]
movq xmm0, qword [esp + 0x44]
movsd xmm2, qword [esp + 0x5c]
movsd qword [esp + 0x134], xmm1
movsd xmm1, qword [esp + 0x54]
mov dword [esp + 0x154], eax
movq qword [esp + 0x12c], xmm0
movsd qword [esp + 0x144], xmm2
movsd qword [esp + 0x13c], xmm1
movsd xmm1, qword [esp + 0x64]
movsd qword [esp + 0x14c], xmm1
movsd xmm2, qword [esp + 0x144]
movsd xmm1, qword [esp + 0x13c]
mov eax, dword [esp + 0x154]
movq xmm0, qword [esp + 0x14c]
dec dword [esp + 0xf4]
cmp byte [esp + 0xfc], 0
movsd qword [esp + 0x5c], xmm2
movsd qword [esp + 0x54], xmm1
movsd xmm2, qword [esp + 0x12c]
movsd xmm1, qword [esp + 0x134]
mov dword [esp + 0x6c], eax
movq qword [esp + 0x64], xmm0
movsd qword [esp + 0x4c], xmm1
movsd qword [esp + 0x44], xmm2
je 0x1003d2d1
test edi, edi
je 0x100402f8
mov eax, dword [esi + 0x1ec]
dec edi
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], edi
mov dword [eax + 0xb0], 0
mov ecx, esi
mov edx, 4
call fcn.10006c20
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov esi, dword [esp + 0x54]
mov edi, dword [esp + 0x64]
mov dword [esp + 0xa0], edx
mov edx, dword [esp + 0x60]
cmp eax, 0x80000000
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x18]
je 0x1003cce2
test eax, eax
je 0x1003d315
mov edx, 1
call fcn.10006c20
mov edx, dword [esp + 0x18]
test esi, esi
je 0x1003d32e
mov ecx, dword [esp + 0xa0]
mov edx, 2
call fcn.10006c20
mov edx, dword [esp + 0x18]
test dword [esp + 0xc], 0x7fffffff
je 0x1003cce2
mov ecx, edi
mov edx, 1
call fcn.10006c20
mov edx, dword [esp + 0x18]
jmp 0x1003cce2
mov eax, dword [esp + 0xf4]
movq xmm0, qword [esp + 0xec]
mov dword [esp + 0x120], eax
movq qword [esp + 0x118], xmm0
mov dword [esp + 0x114], 1
movzx eax, byte [0x1008b0d4]
xor ecx, ecx
mov edx, 4
call fcn.10045ab0
test eax, eax
je 0x10040330
mov esi, eax
mov dword [eax], 0x48544150
add eax, 4
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], eax
mov word [esp + 0x4c], 0
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x44]
call fcn.10040b00
mov eax, dword [esp + 0xc8]
movq xmm0, qword [esp + 0xc0]
mov dword [esp + 0x12c], 4
mov dword [esp + 0x130], esi
mov dword [esp + 0x134], 4
mov dword [esp + 0x138], 0
mov edx, dword [esp + 0x118]
movq qword [esp + 0x13c], xmm0
mov dword [esp + 0x144], eax
mov dword [esp + 0x10], eax
test edx, edx
mov eax, dword [esp + 0x140]
mov dword [esp + 0x20], eax
je 0x1003d4ee
mov eax, dword [esp + 0x11c]
mov dword [esp + 0x38], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], eax
lea ecx, [edx + 0xb4]
mov dword [esp + 0xc], edx
movzx edx, word [edx + 0x1ea]
mov ebx, 0xffffffff
lea eax, [edx + edx*8]
mov dword [esp + 0xa0], edx
lea esi, [eax + eax*2]
add esi, edx
nop word cs:[eax + eax]
nop dword [eax]
test esi, esi
je 0x1003d4a0
lea edi, [ecx + 0x1c]
push 1
push dword [ecx + 0x18]
push dword [ecx + 0x14]
push dword [esp + 0x1c]
push dword [esp + 0x30]
call sub.KERNEL32.dll_CompareStringOrdinal
add esi, 0xffffffe4
inc ebx
cmp eax, 3
mov ecx, edi
je 0x1003d470
cmp eax, 1
jne 0x1003d4c8
jmp 0x1003d4a7
mov ebx, dword [esp + 0xa0]
mov eax, dword [esp + 0x18]
sub eax, 1
jb 0x1003d9f0
mov edx, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov edx, dword [edx + ebx*4 + 0x1ec]
jmp 0x1003d43e
cmp eax, 2
jne 0x100401f0
mov ecx, dword [esp + 0xc]
shl ebx, 4
mov eax, dword [ecx + ebx + 4]
mov ecx, dword [ecx + ebx + 8]
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], ecx
mov esi, dword [esp + 0x38]
jmp 0x1003d4f6
mov dword [esp + 0x1c], 0
mov ecx, esi
mov edx, 1
call fcn.10006c20
cmp dword [esp + 0x13c], 0
je 0x1003d51a
mov ecx, dword [esp + 0x20]
mov edx, 2
call fcn.10006c20
lea ecx, [esp + 0x118]
mov eax, dword [esp + 0x14]
mov edi, dword [eax + 0x20]
test edi, edi
je 0x1003d57b
mov dword [esp + 0x38], ecx
mov ecx, dword [eax + 0x1c]
mov eax, 0x100422d0
cmp edi, 4
mov dword [esp + 0x10], ecx
jb 0x1003d568
mov eax, dword [ecx]
xor ecx, ecx
bswap eax
cmp eax, 0x5c5c3f5c
setb cl
cmp eax, 0x5c5c3f5d
mov eax, 0x100422d0
adc ecx, 0xffffffff
mov ecx, 0x100422c0
cmove eax, ecx
mov ecx, dword [esp + 0x10]
movzx ebx, byte [edi + ecx - 1]
push ebx
call eax
add esp, 4
test al, al
je 0x1003d616
mov byte [esp + 0x98], 2
mov dword [esp + 0x9c], 0x1007cdc8
mov ecx, dword [esp + 0x98]
mov edi, dword [esp + 0x9c]
mov eax, dword [esp + 0x88]
mov dword [eax + 4], edi
mov dword [eax], ecx
mov dword [eax + 8], 2
cmp dword [esp + 0x114], 0
je 0x1003d6d6
mov ecx, dword [esp + 0x118]
test ecx, ecx
je 0x1003d6b1
mov edx, dword [esp + 0x11c]
mov eax, dword [esp + 0x120]
mov dword [esp + 0x130], 0
mov dword [esp + 0x134], ecx
mov dword [esp + 0x138], edx
mov dword [esp + 0x140], 0
mov dword [esp + 0x144], ecx
mov ecx, 1
mov dword [esp + 0x148], edx
jmp 0x1003d6b5
mov ecx, dword [esp + 0x10]
cmp edi, 3
mov dword [esp + 0x20], edi
lea eax, [ecx + edi]
mov dword [esp + 0xa0], eax
jbe 0x1003d6f4
movzx eax, byte [eax - 4]
mov ecx, eax
add cl, 0xbf
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
xor eax, eax
cmp cl, 0x2e
mov ecx, 0
jne 0x1003d730
mov esi, dword [esp + 0xa0]
movzx ecx, byte [esi - 3]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x65
jne 0x1003d720
movzx ecx, byte [esi - 2]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x78
jne 0x1003d724
mov ecx, ebx
add cl, 0xbf
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, bl
cmp cl, 0x65
sete cl
jmp 0x1003d730
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x12c], ecx
mov dword [esp + 0x13c], ecx
mov dword [esp + 0x14c], eax
lea ecx, [esp + 0x12c]
call fcn.10042910
cmp dword [esp + 0x10c], 4
jb 0x1003d6ec
push dword [esp + 0x110]
call sub.KERNEL32.dll_CloseHandle
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, edi
nop word cs:[eax + eax]
test eax, eax
je 0x1003d873
movzx edx, byte [ecx]
cmp edx, 0x2f
je 0x1003d7a2
inc ecx
dec eax
cmp edx, 0x5c
jne 0x1003d700
jmp 0x1003d7a2
xor ecx, ecx
jmp 0x1003d730
xor ecx, ecx
nop word cs:[eax + eax]
cmp edi, eax
je 0x1003d873
mov edx, dword [esp + 0x10]
movzx edx, byte [edx + eax]
cmp edx, 0x2f
je 0x1003d74b
inc eax
cmp edx, 0x5c
jne 0x1003d730
test cl, cl
je 0x1003d7a2
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x12c]
push edi
call fcn.10037e80
add esp, 4
mov edx, dword [esp + 0x12c]
mov eax, dword [esp + 0x130]
mov ecx, dword [esp + 0x134]
cmp edx, 0x80000000
jne 0x1003d9c3
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], ecx
mov dword [esp + 0x94], 0x80000000
jmp 0x1003dcdc
test edi, edi
js 0x100403f4
movzx eax, byte [0x1008b0d4]
xor ecx, ecx
mov edx, edi
call fcn.10045ab0
test eax, eax
je 0x10040338
mov esi, eax
push edi
push dword [esp + 0x14]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [esp + 0x12c], edi
mov dword [esp + 0x130], esi
mov dword [esp + 0x134], edi
mov dword [esp + 0x138], 0
mov edx, str..exeprogram_not_found
lea ecx, [esp + 0x12c]
push 4
call fcn.10039b90
add esp, 4
mov edi, dword [esp + 0x12c]
mov ebx, dword [esp + 0x130]
mov esi, dword [esp + 0x134]
mov edx, ebx
lea ecx, [esp + 0x44]
push esi
call fcn.100423c0
add esp, 4
cmp dword [esp + 0x44], 0x80000000
jne 0x1003d944
mov ecx, ebx
mov edx, esi
call fcn.1003c510
test eax, eax
je 0x1003dc5a
cmp edx, 2
mov dword [esp + 0x20], edi
jne 0x1003d963
movzx ecx, word [eax]
cmp ecx, 0x2e2e
jne 0x1003d963
mov edi, 2
xor ecx, ecx
jmp 0x1003dc08
mov eax, dword [esp + 0x10]
xor esi, esi
jmp 0x1003d88b
xor esi, esi
test cx, cx
je 0x1003d929
mov cx, 1
test si, si
jne 0x1003d880
cmp eax, dword [esp + 0xa0]
je 0x1003d99b
movzx edx, byte [eax]
test dl, dl
js 0x1003d8ab
inc eax
jmp 0x1003d920
movzx edi, byte [eax + 1]
mov esi, edx
and esi, 0x1f
and edi, 0x3f
cmp dl, 0xdf
jbe 0x1003d8e6
movzx ebx, byte [eax + 2]
shl edi, 6
and ebx, 0x3f
or ebx, edi
cmp dl, 0xf0
jb 0x1003d8f6
movzx edx, byte [eax + 3]
and esi, 7
shl ebx, 6
add eax, 4
shl esi, 0x12
and edx, 0x3f
or edx, ebx
or edx, esi
jmp 0x1003d900
shl esi, 6
add eax, 2
or esi, edi
mov edi, dword [esp + 0x20]
mov edx, esi
jmp 0x1003d920
shl esi, 0xc
add eax, 3
or ebx, esi
mov edx, ebx
mov edi, dword [esp + 0x20]
cmp edx, 0xffff
jbe 0x1003d920
and edx, 0x3ff
or edx, 0xdc00
mov esi, edx
jmp 0x1003d882
xor esi, esi
mov ecx, edx
jmp 0x1003d882
mov dword [esp + 0x98], 2
mov dword [esp + 0x9c], 0x1007cd9c
jmp 0x1003d58e
mov eax, dword [esp + 0x4c]
movq xmm0, qword [esp + 0x44]
mov dword [esp + 0x9c], eax
movq qword [esp + 0x94], xmm0
jmp 0x1003dccc
mov edi, edx
mov dword [esp + 0xc], edx
nop dword [eax]
test edi, edi
je 0x1003d9f5
mov edx, edi
dec edi
cmp byte [eax + edx - 1], 0x2e
jne 0x1003d970
test edi, edi
je 0x1003dc00
mov ecx, eax
sub dword [esp + 0xc], edx
add ecx, edx
mov edx, dword [esp + 0xc]
jmp 0x1003dc08
cmp edi, 7
ja 0x1003da02
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
nop dword [eax + eax]
cmp byte [eax], 0x2e
je 0x1003da1e
inc eax
dec edi
jne 0x1003d9b0
mov dword [esp + 0x24], 0
jmp 0x1003da26
mov dword [esp + 0x12c], edx
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], ecx
lea ecx, [esp + 0x94]
lea edx, [esp + 0x12c]
call fcn.100422f0
jmp 0x1003dcdc
jmp 0x1003d4e8
mov edx, dword [esp + 0xc]
mov ecx, eax
xor eax, eax
jmp 0x1003dc06
mov edx, dword [esp + 0x10]
mov ecx, 0x2e
push edi
call fcn.1000a3a0
add esp, 4
mov edx, dword [esp + 0xc]
mov dword [esp + 0x24], eax
jmp 0x1003da26
mov dword [esp + 0x24], 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1003da66
add edx, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], edx
mov word [esp + 0x4c], 0
mov byte [esp + 0x50], 1
lea ecx, [esp + 0x12c]
lea edx, [esp + 0x44]
call fcn.10039790
mov eax, dword [esp + 0x12c]
cmp eax, 0x80000000
jne 0x1003db13
lea ecx, [esp + 0x44]
call fcn.100399f0
mov ebx, dword [esp + 0x44]
cmp ebx, 0x80000000
jne 0x1003dabc
cmp byte [esp + 0x48], 3
jne 0x1003ee90
mov edi, dword [esp + 0x4c]
mov esi, dword [edi + 4]
mov ebx, dword [edi]
mov eax, dword [esi]
test eax, eax
je 0x1003da9b
push ebx
call eax
add esp, 4
cmp dword [esi + 4], 0
je 0x1003daab
mov edx, dword [esi + 8]
mov ecx, ebx
call fcn.10006c20
mov ecx, edi
mov edx, 4
call fcn.10006c20
jmp 0x1003ee90
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x48]
mov esi, dword [esp + 0x4c]
mov dword [esp + 0xc], eax
mov ecx, edi
mov edx, esi
call fcn.1003bb60
test eax, eax
je 0x1003edf8
test edx, edx
je 0x1003edf6
cmp esi, edx
jbe 0x1003edec
cmp byte [edi + edx], 0xbf
jg 0x1003edf2
mov edx, 0x37
mov ecx, 0x1007c39a
push 0x1007c3d4
call fcn.10008230
add esp, 4
jmp 0x10040459
lea edi, [esp + 0x12c]
lea ebx, [esp + 0x44]
jmp 0x1003db3b
mov ecx, edi
mov edx, ebx
call fcn.10039790
mov eax, dword [esp + 0x12c]
cmp eax, 0x80000000
je 0x1003da66
mov edx, dword [esp + 0x134]
mov ecx, dword [esp + 0x130]
test edx, edx
je 0x1003dbe9
mov esi, dword [esp + 0x138]
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], ecx
mov dword [esp + 0x134], edx
mov dword [esp + 0x138], esi
mov edx, dword [esp + 0x10]
mov ecx, edi
push dword [esp + 0x20]
call fcn.1003abb0
add esp, 4
cmp dword [esp + 0x24], 1
je 0x1003db94
mov ecx, edi
call fcn.1003c630
mov esi, dword [esp + 0x130]
mov edx, esi
lea ecx, [esp + 0xc0]
push dword [esp + 0x134]
call fcn.100423c0
add esp, 4
cmp dword [esp + 0x12c], 0
je 0x1003dbc9
mov ecx, esi
mov edx, 1
call fcn.10006c20
mov eax, dword [esp + 0xc0]
cmp eax, 0x80000000
jne 0x1003edba
mov ecx, edi
mov edx, ebx
call fcn.10039790
jmp 0x1003db29
test eax, eax
je 0x1003db20
mov edx, 1
call fcn.10006c20
jmp 0x1003db20
mov edx, dword [esp + 0xc]
xor ecx, ecx
mov edi, edx
test eax, eax
cmovne ecx, eax
test ecx, ecx
je 0x1003dc46
test eax, eax
cmove edi, edx
add ecx, edi
sub ecx, ebx
je 0x1003dc4c
mov edi, dword [esp + 0x20]
cmp esi, ecx
jbe 0x1003dc52
cmp byte [ebx + ecx], 0xbf
jg 0x1003dc54
mov edx, 0x37
mov ecx, 0x1007c39a
push 0x1007c3d4
call fcn.10008230
add esp, 4
jmp 0x10040459
mov edi, dword [esp + 0x20]
jmp 0x1003dc5a
mov edi, dword [esp + 0x20]
jmp 0x1003dc58
jne 0x1003dc2a
cmp esi, ecx
jb 0x1003dc5a
mov esi, ecx
mov edx, ebx
lea ecx, [esp + 0x12c]
push esi
call fcn.10037e80
add esp, 4
mov edx, dword [esp + 0x12c]
mov eax, dword [esp + 0x130]
mov ecx, dword [esp + 0x134]
cmp edx, 0x80000000
jne 0x1003dca4
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], ecx
mov dword [esp + 0x94], 0x80000000
jmp 0x1003dccc
mov dword [esp + 0x12c], edx
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], ecx
lea ecx, [esp + 0x94]
lea edx, [esp + 0x12c]
call fcn.100422f0
test edi, edi
je 0x1003dcdc
mov ecx, ebx
mov edx, 1
call fcn.10006c20
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x98]
mov edi, dword [esp + 0x9c]
cmp eax, 0x80000000
mov dword [esp + 0x90], eax
je 0x1003d59c
cmp edi, 4
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edi
jb 0x1003dd43
mov edx, dword [esp + 0x20]
mov ecx, 0x5c005c
mov eax, 0x5c003f
xor ecx, dword [edx]
mov edx, dword [edx + 4]
xor edx, eax
or edx, ecx
je 0x1003defd
mov edx, dword [esp + 0x20]
mov ecx, 0x3f005c
xor ecx, dword [edx]
xor eax, dword [edx + 4]
or eax, ecx
je 0x1003defd
mov ebx, 0x200
xor edi, edi
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 2
mov dword [esp + 0x4c], 0
mov dword [esp + 0x1c], 2
cmp ebx, 0x201
jb 0x1003dd8e
jmp 0x1003ddb0
jbe 0x1003de3c
cmp ebx, 0x201
jae 0x1003ddb0
lea eax, [esp + 0x12c]
mov esi, ebx
mov dword [esp + 0xc], 0x200
mov ebx, eax
jmp 0x1003dddd
sub ebx, edi
je 0x1003ddcf
mov edx, edi
lea ecx, [esp + 0x44]
push ebx
call fcn.10018d80
add esp, 4
mov edi, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
mov esi, edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0xc], edi
push 0
call sub.KERNEL32.dll_SetLastError
push 0
mov dword [esp + 0x1c], ebx
push ebx
push esi
push dword [esp + 0x2c]
call sub.KERNEL32.dll_GetFullPathNameW
mov ebx, eax
test eax, eax
jne 0x1003de08
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x1003df94
cmp ebx, esi
jne 0x1003dd80
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x100402b0
lea ebx, [esi + esi]
test esi, esi
mov eax, 0xffffffff
cmovs ebx, eax
cmp ebx, 0x201
jae 0x1003ddb0
jmp 0x1003dd8e
mov edx, dword [esp + 0xc]
cmp ebx, edx
ja 0x100403fb
cmp ebx, 4
jb 0x1003ded7
mov eax, dword [esp + 0x18]
cmp word [eax + ebx*2 - 8], 0x2e
jne 0x1003ded7
movzx eax, word [eax + ebx*2 - 6]
mov dword [esp + 0x1c], 0
lea ecx, [eax - 0x42]
cmp ecx, 0x21
ja 0x1003dedf
mov edx, dword [esp + 0xb4]
add edx, dword [ecx*4 + 0x10040998]
jmp edx
mov dword [esp + 0x1c], 0
cmp dword [esp + 0x44], 0
je 0x1003dfc7
mov ecx, dword [esp + 0x48]
mov edx, 2
call fcn.10006c20
jmp 0x1003dfc7
cmp edi, 4
je 0x1003dfbf
mov eax, dword [esp + 0x20]
cmp word [eax + edi*2 - 0xa], 0x2e
jne 0x1003dfbf
movzx eax, word [eax + edi*2 - 8]
mov dword [esp + 0x1c], 0
lea ecx, [eax - 0x42]
cmp ecx, 0x21
ja 0x1003dfc7
mov edx, dword [esp + 0xb4]
add edx, dword [ecx*4 + 0x10040a20]
jmp edx
call sub.KERNEL32.dll_GetLastError
cmp dword [esp + 0x44], 0
mov esi, eax
je 0x1003dfb0
mov ecx, dword [esp + 0x48]
mov edx, 2
call fcn.10006c20
mov eax, dword [esp + 0x88]
mov byte [eax], 0
jmp 0x1003ebcd
mov dword [esp + 0x1c], 0
cmp byte [esp + 0x1c], 0
je 0x1003e0c2
lea eax, [esp + 0x48]
mov edi, 0x200
xor ebx, ebx
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 2
mov dword [esp + 0x4c], 0
mov dword [esp + 0x18], 2
mov dword [esp + 0xa0], eax
cmp edi, 0x201
jb 0x1003e01e
jmp 0x1003e040
jbe 0x1003e1f5
cmp edi, 0x201
jae 0x1003e040
lea eax, [esp + 0x12c]
mov esi, edi
mov dword [esp + 0x10], 0x200
mov edi, eax
jmp 0x1003e06d
sub edi, ebx
je 0x1003e05f
mov edx, ebx
lea ecx, [esp + 0x44]
push edi
call fcn.10018d80
add esp, 4
mov ebx, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov edi, dword [esp + 0x18]
mov esi, ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x10], ebx
push 0
call sub.KERNEL32.dll_SetLastError
push esi
mov dword [esp + 0x10], edi
push edi
call sub.KERNEL32.dll_GetSystemDirectoryW
mov edi, eax
test eax, eax
jne 0x1003e092
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x1003e232
cmp edi, esi
jne 0x1003e010
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x10040314
lea edi, [esi + esi]
test esi, esi
mov eax, 0xffffffff
cmovs edi, eax
cmp edi, 0x201
jae 0x1003e040
jmp 0x1003e01e
mov eax, dword [esp + 0x14]
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 2
mov dword [esp + 0x4c], 0
mov ebx, dword [eax + 0x2c]
mov esi, dword [eax + 0x30]
movzx eax, byte [eax + 0x69]
mov byte [esp + 0xc], al
lea ecx, [esp + 0x44]
call fcn.10038520
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0xa0]
mov word [eax], 0x22
mov eax, dword [esp + 0x10]
mov dword [esp + 0x4c], 1
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], edi
mov word [esp + 0x134], 0
lea ecx, [esp + 0x44]
lea edx, [esp + 0x12c]
call fcn.100385b0
mov edi, dword [esp + 0x4c]
cmp edi, dword [esp + 0x44]
jne 0x1003e14c
lea ecx, [esp + 0x44]
call fcn.10038520
mov eax, dword [esp + 0x48]
mov word [eax + edi*2], 0x22
inc edi
test esi, esi
mov dword [esp + 0x4c], edi
je 0x1003e1c0
movzx eax, byte [esp + 0xc]
shl esi, 2
lea edi, [esi + esi*4]
mov dword [esp + 0x10], eax
nop
mov esi, dword [esp + 0x4c]
cmp esi, dword [esp + 0x44]
jne 0x1003e183
lea ecx, [esp + 0x44]
call fcn.10038520
mov eax, dword [esp + 0x48]
mov word [eax + esi*2], 0x20
inc esi
mov dword [esp + 0x4c], esi
lea edx, [esp + 0x44]
lea ecx, [esp + 0xc0]
push dword [esp + 0x10]
push ebx
call fcn.100424c0
add esp, 8
cmp byte [esp + 0xc0], 4
jne 0x1003eba1
add ebx, 0x14
add edi, 0xffffffec
jne 0x1003e170
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x90]
mov ebx, dword [esp + 0x48]
mov esi, dword [esp + 0x4c]
cmp eax, 0x80000000
mov dword [esp + 0x8c], ecx
mov dword [esp + 0xb4], edx
je 0x1003ebc4
jmp 0x1003e711
mov edx, dword [esp + 0x10]
cmp edi, edx
ja 0x1004040c
test edi, edi
je 0x1003e255
lea ebx, [edi + edi]
cmp edi, 0x3fffffff
ja 0x1004041d
movzx eax, byte [0x1008b0d4]
xor ecx, ecx
mov edx, ebx
call fcn.10045ab0
test eax, eax
jne 0x1003e25c
mov ecx, 2
jmp 0x1004041f
call sub.KERNEL32.dll_GetLastError
cmp dword [esp + 0x44], 0
mov esi, eax
je 0x1003e24e
mov ecx, dword [esp + 0x48]
mov edx, 2
call fcn.10006c20
xor ecx, ecx
jmp 0x1003e458
mov eax, 2
xor ebx, ebx
push ebx
push dword [esp + 0x10]
mov esi, eax
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp dword [esp + 0x44], 0
je 0x1003e281
mov ecx, dword [esp + 0x48]
mov edx, 2
call fcn.10006c20
lea eax, [esp + 0xc4]
mov edx, esi
mov ecx, 0x1007ce02
xor ebx, ebx
mov dword [esp + 0xc0], edi
mov dword [esp + 0xc4], esi
mov dword [esp + 0xc8], edi
mov dword [esp + 0xc], 0
mov dword [esp + 0xa0], eax
jmp 0x1003e2d8
mov dword [esp + 0x10], ecx
mov ecx, edx
mov edx, esi
mov word [edx + edi*2], bx
mov ebx, dword [esp + 0x10]
inc edi
mov dword [esp + 0xc8], edi
test ecx, ecx
je 0x1003e340
test bx, bx
je 0x1003e320
mov esi, edx
mov edx, ecx
xor ecx, ecx
cmp edi, dword [esp + 0xc0]
jne 0x1003e2c0
mov eax, 0x1007ce02
mov esi, edx
sub eax, edx
mov edx, 0xaaaaaaab
add eax, 0xa
mul edx
mov eax, edx
mov edx, dword [esp + 0xc]
shr eax, 1
cmp cx, 1
mov dword [esp + 0x10], ecx
mov ecx, esi
adc edx, 0xffffffff
sub eax, edx
inc eax
jmp 0x1003e372
lea eax, [0x1007ce0a]
cmp ecx, eax
je 0x1003e340
movzx ebx, byte [ecx]
test bl, bl
js 0x1003e395
inc ecx
mov esi, edx
mov edx, ecx
xor ecx, ecx
jmp 0x1003e2e7
cmp dword [esp + 0xc], 1
mov ecx, dword [esp + 0xc0]
je 0x1003e42d
mov dword [esp + 0x10], ebx
xor ebx, ebx
cmp edi, ecx
mov ecx, 0
mov eax, 0
mov dword [esp + 0xc], 1
jne 0x1003e2c8
mov esi, ecx
inc eax
mov edx, edi
lea ecx, [esp + 0xc0]
push eax
call fcn.10018d80
add esp, 4
mov edx, dword [esp + 0xc4]
mov ecx, esi
jmp 0x1003e2c8
movzx esi, byte [ecx + 1]
mov eax, ebx
mov dword [esp + 0x10], edx
and eax, 0x1f
and esi, 0x3f
cmp bl, 0xdf
jbe 0x1003e3d6
mov edx, ecx
movzx ecx, byte [ecx + 2]
shl esi, 6
and ecx, 0x3f
or ecx, esi
cmp bl, 0xf0
jb 0x1003e3ed
movzx ebx, byte [edx + 3]
and eax, 7
shl ecx, 6
add edx, 4
shl eax, 0x12
and ebx, 0x3f
or ebx, ecx
or ebx, eax
jmp 0x1003e3f7
shl eax, 6
add ecx, 2
or eax, esi
mov esi, dword [esp + 0x10]
mov edx, ecx
xor ecx, ecx
mov ebx, eax
jmp 0x1003e2e7
shl eax, 0xc
add edx, 3
or ecx, eax
mov ebx, ecx
mov esi, dword [esp + 0x10]
cmp ebx, 0xffff
jbe 0x1003e426
lea eax, [ebx + 0xff0000]
and ebx, 0x3ff
shr eax, 0xa
or ebx, 0xdc00
or eax, 0xd800
mov ecx, ebx
mov ebx, eax
jmp 0x1003e2e7
xor ecx, ecx
jmp 0x1003e2e7
mov eax, dword [esp + 0xc4]
cmp ecx, 0x80000000
mov dword [esp + 0xb4], ecx
mov dword [esp + 0x8c], eax
jne 0x1003e472
mov esi, dword [esp + 0xc8]
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x88]
xor ebx, ebx
mov dword [eax + 4], esi
mov dword [eax], ecx
mov dword [eax + 8], 2
jmp 0x1003ebd9
xor ecx, ecx
test cl, cl
jne 0x1004042d
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x2c]
mov dword [esp + 0x3c], ecx
mov ecx, dword [eax + 0x30]
movzx eax, byte [eax + 0x69]
mov dword [esp + 0x18], ecx
mov byte [esp + 0x40], al
movzx eax, byte [0x1008b0d4]
xor ecx, ecx
mov edx, 0x14
call fcn.10045ab0
test eax, eax
je 0x10040428
lea edi, [esp + 0x130]
lea esi, [0x1007ca21]
mov ecx, 0xa
xor edx, edx
mov word [eax], 0x63
mov dword [esp + 0xa0], edi
mov edi, 1
mov dword [esp + 0x12c], ecx
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], 1
mov dword [esp + 0x10], esi
jmp 0x1003e50e
mov word [eax + edi*2], dx
inc edi
mov edx, ebx
mov dword [esp + 0x134], edi
test dx, dx
jne 0x1003e532
lea ecx, [0x1007ca3c]
cmp dword [esp + 0x10], ecx
je 0x1003e648
mov ecx, dword [esp + 0x10]
movzx edx, byte [ecx]
test dl, dl
js 0x1003e58e
inc dword [esp + 0x10]
xor ebx, ebx
cmp edi, dword [esp + 0x12c]
jne 0x1003e500
mov ecx, dword [esp + 0x10]
mov eax, 0x1007ca20
mov dword [esp + 0xc], edx
mov esi, ebx
sub eax, ecx
mov ecx, 0xaaaaaaab
add eax, 0x1e
mul ecx
mov eax, edx
shr eax, 1
cmp bx, 1
sbb eax, 0
add eax, 2
mov ebx, edi
mov edx, edi
lea ecx, [esp + 0x12c]
push eax
call fcn.10018d80
add esp, 4
mov eax, dword [esp + 0x130]
mov edx, dword [esp + 0xc]
mov edi, ebx
mov ebx, esi
jmp 0x1003e500
mov esi, dword [esp + 0x10]
mov ecx, edx
and ecx, 0x1f
movzx ebx, byte [esi + 1]
and ebx, 0x3f
cmp dl, 0xdf
jbe 0x1003e5e1
mov esi, edx
mov edx, dword [esp + 0x10]
shl ebx, 6
movzx edx, byte [edx + 2]
and edx, 0x3f
or edx, ebx
mov ebx, esi
cmp bl, 0xf0
jb 0x1003e601
mov esi, dword [esp + 0x10]
mov ebx, edi
shl edx, 6
and ecx, 7
shl ecx, 0x12
movzx edi, byte [esi + 3]
add esi, 4
mov dword [esp + 0x10], esi
and edi, 0x3f
or edi, edx
mov edx, edi
mov edi, ebx
jmp 0x1003e609
add dword [esp + 0x10], 2
shl ecx, 6
or ecx, ebx
xor ebx, ebx
mov edx, ecx
cmp edi, dword [esp + 0x12c]
jne 0x1003e500
jmp 0x1003e53d
add dword [esp + 0x10], 3
shl ecx, 0xc
or edx, ecx
cmp edx, 0xffff
jbe 0x1003e532
lea ecx, [edx + 0xff0000]
and edx, 0x3ff
shr ecx, 0xa
or edx, 0xdc00
or ecx, 0xd800
mov ebx, edx
mov edx, ecx
cmp edi, dword [esp + 0x12c]
jne 0x1003e500
jmp 0x1003e53d
movq xmm0, qword [esp + 0x12c]
mov esi, dword [esp + 0x134]
movq qword [esp + 0x44], xmm0
mov dword [esp + 0x4c], esi
cmp esi, dword [esp + 0x44]
jne 0x1003e671
lea ecx, [esp + 0x44]
call fcn.10038520
mov ebx, dword [esp + 0x48]
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
xor ecx, ecx
mov word [ebx + esi*2], 0x22
inc esi
lea eax, [edi + edi]
mov dword [esp + 0x4c], esi
nop dword [eax]
cmp eax, ecx
je 0x1003ec5e
cmp word [edx + ecx], 0x22
lea ecx, [ecx + 2]
jne 0x1003e690
xor edi, edi
mov esi, 0x1007caa4
mov ebx, 2
cmp dword [esp + 0x44], 0
je 0x1003e6c3
mov ecx, dword [esp + 0x48]
mov edx, 2
call fcn.10006c20
mov eax, 0x80000000
and edi, 0xffffff00
movzx ebx, bl
or ebx, edi
cmp eax, 0x80000000
jne 0x1003e711
mov eax, dword [esp + 0x88]
cmp dword [esp + 0xb4], 0
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 2
je 0x1003ebd7
mov ecx, dword [esp + 0x8c]
mov edx, 2
call fcn.10006c20
jmp 0x1003ebd7
cmp eax, esi
mov dword [esp + 0xfc], eax
mov dword [esp + 0x100], ebx
mov dword [esp + 0x104], esi
jne 0x1003e73d
lea ecx, [esp + 0xfc]
call fcn.10038520
mov ebx, dword [esp + 0x100]
mov ecx, dword [esp + 0x14]
mov word [ebx + esi*2], 0
inc esi
mov eax, 0x400
mov edx, 0x608
mov dword [esp + 0x104], esi
cmp byte [ecx + 0x68], 0
cmove edx, eax
or edx, dword [ecx + 0x58]
cmp dword [esp + 0x114], 0
mov dword [esp + 0xf8], edx
je 0x1003ec8d
mov eax, dword [esp + 0x38]
xor edi, edi
mov ebx, 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 2
mov dword [esp + 0x30], 0
mov dword [esp + 0x18], 2
mov esi, dword [eax + 8]
movq xmm0, qword [eax]
test esi, esi
mov dword [esp + 0x9c], esi
movq qword [esp + 0x94], xmm0
jne 0x1003e7e3
mov bl, 1
lea ecx, [esp + 0x28]
call fcn.10038520
mov eax, dword [esp + 0x2c]
mov ebx, 1
mov word [eax], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x30], 1
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x98]
xor edx, edx
test eax, eax
setne dl
cmove esi, eax
mov dword [esp + 0x12c], edx
mov dword [esp + 0x130], 0
mov dword [esp + 0x134], eax
mov dword [esp + 0x138], ecx
mov dword [esp + 0x13c], edx
mov dword [esp + 0x140], 0
mov dword [esp + 0x144], eax
mov dword [esp + 0x148], ecx
mov dword [esp + 0x14c], esi
lea esi, [esp + 0x44]
lea edx, [esp + 0x12c]
mov ecx, esi
call fcn.1003c8d0
mov eax, dword [esp + 0x44]
mov dword [esp + 0x108], ebx
test eax, eax
je 0x1003fda2
mov edx, dword [esp + 0x4c]
lea ecx, [edx + edx*8]
lea ecx, [ecx + ecx*2]
add ecx, edx
mov esi, dword [eax + ecx + 0xb4]
cmp esi, 0x80000000
je 0x1003fda2
shl edx, 4
mov dword [esp + 0xbc], esi
mov dword [esp + 0xc], edi
xor edi, edi
mov esi, dword [eax + edx]
mov dword [esp + 0x3c], esi
mov esi, dword [eax + edx + 4]
mov edx, dword [eax + edx + 8]
mov dword [esp + 0xa0], esi
mov esi, dword [eax + ecx + 0xc4]
mov dword [esp + 0x10], edx
mov edx, dword [eax + ecx + 0xb8]
mov dword [esp + 0x40], esi
mov esi, dword [eax + ecx + 0xc8]
mov dword [esp + 0x24], edx
mov dword [esp + 0xb8], esi
mov esi, dword [eax + ecx + 0xcc]
mov dword [esp + 0x128], esi
mov esi, dword [eax + ecx + 0xbc]
add esi, edx
mov dword [esp + 0x38], esi
jmp 0x1003e8fc
xor edi, edi
test bx, bx
je 0x1003ebfe
mov bx, 1
test di, di
jne 0x1003e8f1
cmp edx, esi
je 0x1003e987
movzx eax, byte [edx]
test al, al
js 0x1003e913
inc edx
jmp 0x1003e97e
movzx ecx, byte [edx + 1]
mov edi, eax
and edi, 0x1f
and ecx, 0x3f
cmp al, 0xdf
jbe 0x1003e94c
movzx esi, byte [edx + 2]
shl ecx, 6
and esi, 0x3f
or esi, ecx
cmp al, 0xf0
jb 0x1003e958
movzx eax, byte [edx + 3]
and edi, 7
shl esi, 6
add edx, 4
shl edi, 0x12
and eax, 0x3f
or eax, esi
or eax, edi
jmp 0x1003e962
shl edi, 6
add edx, 2
or edi, ecx
mov eax, edi
jmp 0x1003e97e
shl edi, 0xc
add edx, 3
or esi, edi
mov eax, esi
mov esi, dword [esp + 0x38]
cmp eax, 0xffff
jbe 0x1003e97e
and eax, 0x3ff
or eax, 0xdc00
mov edi, eax
jmp 0x1003e8f3
xor edi, edi
mov ebx, eax
jmp 0x1003e8f3
cmp dword [esp + 0xbc], 0
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x128]
je 0x1003e9b0
mov ebx, ecx
mov ecx, esi
mov edx, 1
call fcn.10006c20
mov ecx, ebx
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x108]
sub eax, ebx
cmp eax, edi
jae 0x1003e9d8
mov edx, ebx
lea ecx, [esp + 0x28]
push edi
call fcn.10018d80
add esp, 4
mov ecx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x18], ecx
lea eax, [edi + edi]
lea ecx, [ecx + ebx*2]
push eax
mov esi, edi
mov edi, dword [esp + 0xbc]
push edi
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
add ebx, esi
cmp dword [esp + 0x40], 0
mov dword [esp + 0x30], ebx
je 0x1003ea0f
mov ecx, edi
mov edx, 2
call fcn.10006c20
cmp ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
jne 0x1003ea2a
lea ecx, [esp + 0x28]
call fcn.10038520
mov eax, dword [esp + 0x2c]
mov word [eax + ebx*2], 0x3d
mov ecx, dword [esp + 0xa0]
mov eax, dword [esp + 0x10]
and esi, 0xffffff00
inc ebx
mov dword [esp + 0x24], esi
xor esi, esi
mov dword [esp + 0x30], ebx
add eax, ecx
mov edi, ecx
mov dword [esp + 0xc], eax
jmp 0x1003ea61
xor esi, esi
test dx, dx
je 0x1003f3fb
mov dx, 1
test si, si
jne 0x1003ea56
cmp edi, eax
je 0x1003eb0a
movzx ebx, byte [edi]
test bl, bl
js 0x1003ea7f
inc edi
jmp 0x1003eb01
movzx eax, byte [edi + 1]
mov esi, ebx
and esi, 0x1f
and eax, 0x3f
cmp bl, 0xdf
jbe 0x1003eaba
movzx ecx, byte [edi + 2]
shl eax, 6
and ecx, 0x3f
or ecx, eax
cmp bl, 0xf0
jb 0x1003ead1
movzx ebx, byte [edi + 3]
and esi, 7
shl ecx, 6
add edi, 4
shl esi, 0x12
and ebx, 0x3f
or ebx, ecx
or ebx, esi
jmp 0x1003eadb
shl esi, 6
mov ecx, dword [esp + 0xa0]
add edi, 2
or esi, eax
mov eax, dword [esp + 0xc]
mov ebx, esi
jmp 0x1003eb01
shl esi, 0xc
add edi, 3
or ecx, esi
mov ebx, ecx
mov ecx, dword [esp + 0xa0]
mov eax, dword [esp + 0xc]
cmp ebx, 0xffff
jbe 0x1003eb01
and ebx, 0x3ff
or ebx, 0xdc00
mov esi, ebx
jmp 0x1003ea58
xor esi, esi
mov edx, ebx
jmp 0x1003ea58
mov edi, dword [esp + 0x3c]
mov eax, ecx
lea esi, [esp + 0x44]
shr eax, 8
mov dword [esp + 0x124], eax
cmp edi, 0x80000000
je 0x100401d9
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc0], ecx
mov dword [esp + 0xc4], eax
mov word [esp + 0xc8], 0
lea ecx, [esp + 0x28]
lea edx, [esp + 0xc0]
call fcn.100385b0
test edi, edi
je 0x1003eb6b
mov ecx, dword [esp + 0xa0]
mov edx, 1
call fcn.10006c20
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
cmp ebx, dword [esp + 0x28]
jne 0x1003eb82
lea ecx, [esp + 0x28]
call fcn.10038520
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x12c]
mov word [eax + ebx*2], 0
inc ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x30], ebx
jmp 0x1003e84d
mov ebx, dword [esp + 0xc0]
mov esi, dword [esp + 0xc4]
cmp dword [esp + 0x44], 0
je 0x1003ebc4
mov ecx, dword [esp + 0x48]
mov edx, 2
call fcn.10006c20
mov eax, dword [esp + 0x88]
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 2
xor ebx, ebx
cmp dword [esp + 0x90], 0
je 0x1003ebf1
mov ecx, dword [esp + 0x20]
mov edx, 2
call fcn.10006c20
test bl, bl
je 0x1003d5af
jmp 0x1003d6d6
cmp dword [esp + 0xbc], 0
je 0x1003ec16
mov ecx, dword [esp + 0x24]
mov edx, 1
call fcn.10006c20
cmp dword [esp + 0x3c], 0
mov edi, dword [esp + 0xc]
je 0x1003ec32
mov ecx, dword [esp + 0xa0]
mov edx, 1
call fcn.10006c20
or edi, 2
cmp dword [esp + 0x40], 0
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x10], 0x1007cd9c
je 0x1003f425
mov edx, 2
call fcn.10006c20
jmp 0x1003f425
mov eax, dword [esp + 0x20]
mov ecx, edi
mov edx, ebx
xor edi, edi
mov ebx, ecx
sub ebx, 1
jb 0x1003f472
mov ecx, eax
movzx eax, word [eax + ebx*2]
cmp ax, 0x5c
jne 0x1003f464
mov esi, 0x1007caa4
jmp 0x1003fce4
mov edi, 2
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], edi
cmp dword [eax + 0x34], 0x80000000
jne 0x1003ed01
mov ebx, 2
xor esi, esi
mov dword [esp + 0xa0], 0
pxor xmm0, xmm0
mov cl, 1
xor eax, eax
movdqu xmmword [esp + 0x28], xmm0
lock cmpxchg byte [0x1008b0a0], cl
jne 0x1003fe3f
mov eax, dword [0x1008b080]
mov dword [esp + 0x38], esi
test eax, 0x7fffffff
je 0x1003fab9
call fcn.10018eb0
xor al, 1
jmp 0x1003fabb
mov edx, dword [eax + 0x38]
mov eax, dword [eax + 0x3c]
xor edi, edi
add eax, edx
mov dword [esp + 0x38], edx
mov dword [esp + 0xa0], eax
jmp 0x1003ed23
xor edi, edi
test si, si
je 0x1003edc6
mov si, 1
test di, di
jne 0x1003ed18
cmp edx, eax
je 0x1003fd35
movzx ebx, byte [edx]
test bl, bl
js 0x1003ed3e
inc edx
jmp 0x1003edb1
movzx ecx, byte [edx + 1]
mov edi, ebx
and edi, 0x1f
and ecx, 0x3f
cmp bl, 0xdf
jbe 0x1003ed79
movzx eax, byte [edx + 2]
shl ecx, 6
and eax, 0x3f
or eax, ecx
cmp bl, 0xf0
jb 0x1003ed85
movzx ebx, byte [edx + 3]
and edi, 7
shl eax, 6
add edx, 4
shl edi, 0x12
and ebx, 0x3f
or ebx, eax
or ebx, edi
jmp 0x1003ed8f
shl edi, 6
add edx, 2
or edi, ecx
mov ebx, edi
jmp 0x1003edb1
shl edi, 0xc
add edx, 3
or eax, edi
mov ebx, eax
mov eax, dword [esp + 0xa0]
cmp ebx, 0xffff
jbe 0x1003edb1
and ebx, 0x3ff
or ebx, 0xdc00
mov edi, ebx
jmp 0x1003ed1a
xor edi, edi
mov esi, ebx
jmp 0x1003ed1a
mov dword [esp + 0x90], eax
jmp 0x1003f036
mov edi, dword [esp + 0xc]
mov esi, 0x1007cd9c
mov ebx, 2
mov eax, dword [esp + 0x88]
mov dword [eax + 4], esi
mov dword [eax], ebx
mov dword [eax + 8], 2
jmp 0x1004017e
jne 0x1003daf7
cmp esi, edx
jb 0x1003edf8
mov esi, edx
mov eax, dword [esp + 0xc]
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x130], edi
mov dword [esp + 0x134], esi
mov dword [esp + 0x138], eax
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x12c]
push dword [esp + 0x20]
call fcn.1003abb0
add esp, 4
cmp dword [esp + 0x24], 1
je 0x1003ee42
lea ecx, [esp + 0x12c]
call fcn.1003c630
mov esi, dword [esp + 0x130]
mov edx, esi
lea ecx, [esp + 0xc0]
push dword [esp + 0x134]
call fcn.100423c0
add esp, 4
cmp dword [esp + 0x12c], 0
je 0x1003ee77
mov ecx, esi
mov edx, 1
call fcn.10006c20
mov eax, dword [esp + 0xc0]
cmp eax, 0x80000000
mov dword [esp + 0x90], eax
jne 0x1003f036
mov ebx, 0x200
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 2
mov dword [esp + 0x30], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], 2
cmp ebx, 0x201
jb 0x1003eee2
jmp 0x1003ef00
mov edi, dword [esp + 0x20]
jbe 0x1003ef84
cmp ebx, 0x201
jae 0x1003ef00
mov dword [esp + 0x18], 0x200
lea esi, [esp + 0x12c]
mov edi, ebx
jmp 0x1003ef33
mov edi, dword [esp + 0xc]
sub ebx, edi
je 0x1003ef23
mov edx, edi
lea ecx, [esp + 0x28]
push ebx
call fcn.10018d80
add esp, 4
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x30], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], edi
push 0
call sub.KERNEL32.dll_SetLastError
push edi
push esi
call sub.KERNEL32.dll_GetSystemDirectoryW
mov ebx, eax
test eax, eax
jne 0x1003ef54
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x1003f049
cmp ebx, edi
jne 0x1003eed0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x1004034b
lea ebx, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs ebx, eax
cmp ebx, 0x201
jae 0x1003ef00
jmp 0x1003eee2
mov edx, dword [esp + 0x18]
cmp ebx, edx
ja 0x10040439
mov edx, esi
lea ecx, [esp + 0x44]
push ebx
call fcn.10017730
add esp, 4
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x44]
push edi
call fcn.1003abb0
add esp, 4
cmp dword [esp + 0x24], 1
je 0x1003efc0
lea ecx, [esp + 0x44]
call fcn.1003c630
mov esi, dword [esp + 0x48]
mov edx, esi
lea ecx, [esp + 0xc0]
push dword [esp + 0x4c]
call fcn.100423c0
add esp, 4
cmp dword [esp + 0x44], 0
je 0x1003efec
mov ecx, esi
mov edx, 1
call fcn.10006c20
mov eax, dword [esp + 0xc0]
mov edi, dword [esp + 0xc8]
cmp dword [esp + 0x28], 0
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0xc4]
je 0x1003f021
mov ecx, dword [esp + 0x2c]
mov edx, 2
mov esi, eax
call fcn.10006c20
mov eax, esi
cmp dword [esp + 0x90], 0x80000001
jg 0x1003f242
je 0x1003f067
jmp 0x1003f09c
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0xc8]
jmp 0x1003f242
call sub.KERNEL32.dll_GetLastError
cmp dword [esp + 0x28], 0
mov edi, eax
je 0x1003f065
mov ecx, dword [esp + 0x2c]
mov edx, 2
call fcn.10006c20
xor eax, eax
cmp al, 3
jne 0x1003f09c
mov eax, edi
mov edi, dword [edi]
mov esi, dword [eax + 4]
mov ebx, eax
mov eax, dword [esi]
test eax, eax
je 0x1003f080
push edi
call eax
add esp, 4
cmp dword [esi + 4], 0
je 0x1003f090
mov edx, dword [esi + 8]
mov ecx, edi
call fcn.10006c20
mov ecx, ebx
mov edx, 4
call fcn.10006c20
mov ebx, 0x200
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 2
mov dword [esp + 0x30], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], 2
cmp ebx, 0x201
jb 0x1003f0f2
jmp 0x1003f110
mov edi, dword [esp + 0x20]
jbe 0x1003f194
cmp ebx, 0x201
jae 0x1003f110
mov dword [esp + 0x18], 0x200
lea esi, [esp + 0x12c]
mov edi, ebx
jmp 0x1003f143
mov edi, dword [esp + 0xc]
sub ebx, edi
je 0x1003f133
mov edx, edi
lea ecx, [esp + 0x28]
push ebx
call fcn.10018d80
add esp, 4
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x30], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], edi
push 0
call sub.KERNEL32.dll_SetLastError
push edi
push esi
call sub.KERNEL32.dll_GetWindowsDirectoryW
mov ebx, eax
test eax, eax
jne 0x1003f164
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x1003f249
cmp ebx, edi
jne 0x1003f0e0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x10040367
lea ebx, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs ebx, eax
cmp ebx, 0x201
jae 0x1003f110
jmp 0x1003f0f2
mov edx, dword [esp + 0x18]
cmp ebx, edx
ja 0x1004044a
mov edx, esi
lea ecx, [esp + 0x44]
push ebx
call fcn.10017730
add esp, 4
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x44]
push edi
call fcn.1003abb0
add esp, 4
cmp dword [esp + 0x24], 1
je 0x1003f1d0
lea ecx, [esp + 0x44]
call fcn.1003c630
mov esi, dword [esp + 0x48]
mov edx, esi
lea ecx, [esp + 0xc0]
push dword [esp + 0x4c]
call fcn.100423c0
add esp, 4
cmp dword [esp + 0x44], 0
je 0x1003f1fc
mov ecx, esi
mov edx, 1
call fcn.10006c20
mov eax, dword [esp + 0xc0]
mov edi, dword [esp + 0xc8]
cmp dword [esp + 0x28], 0
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0xc4]
je 0x1003f231
mov ecx, dword [esp + 0x2c]
mov edx, 2
mov esi, eax
call fcn.10006c20
mov eax, esi
cmp dword [esp + 0x90], 0x80000001
jg 0x1003f242
je 0x1003f267
jmp 0x1003f29c
mov ecx, eax
jmp 0x1003dd03
call sub.KERNEL32.dll_GetLastError
cmp dword [esp + 0x28], 0
mov edi, eax
je 0x1003f265
mov ecx, dword [esp + 0x2c]
mov edx, 2
call fcn.10006c20
xor eax, eax
cmp al, 3
jne 0x1003f29c
mov eax, edi
mov edi, dword [edi]
mov esi, dword [eax + 4]
mov ebx, eax
mov eax, dword [esi]
test eax, eax
je 0x1003f280
push edi
call eax
add esp, 4
cmp dword [esi + 4], 0
je 0x1003f290
mov edx, dword [esi + 8]
mov ecx, edi
call fcn.10006c20
mov ecx, ebx
mov edx, 4
call fcn.10006c20
mov edx, str.PATHlibrary_std_src_sys_commonwtf8.rsassertion_failed:_is_code_point_boundary_self__new_len_
lea ecx, [esp + 0xc0]
push 4
call fcn.100387d0
add esp, 4
mov esi, dword [esp + 0xc0]
cmp esi, 0x80000000
je 0x1003f3e3
mov ecx, dword [esp + 0xc4]
mov eax, dword [esp + 0xc8]
lea edi, [esp + 0x12c]
lea ebx, [esp + 0x44]
mov dword [esp + 0xc], esi
add eax, ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x48], eax
mov word [esp + 0x4c], 0
mov byte [esp + 0x50], 1
mov ecx, edi
mov edx, ebx
call fcn.10039790
jmp 0x1003f310
mov ecx, edi
mov edx, ebx
call fcn.10039790
mov eax, dword [esp + 0x12c]
cmp eax, 0x80000000
je 0x1003f3d1
mov edx, dword [esp + 0x134]
mov ecx, dword [esp + 0x130]
test edx, edx
jne 0x1003f344
test eax, eax
je 0x1003f307
mov edx, 1
call fcn.10006c20
jmp 0x1003f307
mov esi, dword [esp + 0x138]
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], ecx
mov dword [esp + 0x134], edx
mov dword [esp + 0x138], esi
mov edx, dword [esp + 0x10]
mov ecx, edi
push dword [esp + 0x20]
call fcn.1003abb0
add esp, 4
cmp dword [esp + 0x24], 1
je 0x1003f387
mov ecx, edi
call fcn.1003c630
mov esi, dword [esp + 0x130]
mov edx, esi
lea ecx, [esp + 0x28]
push dword [esp + 0x134]
call fcn.100423c0
add esp, 4
cmp dword [esp + 0x12c], 0
je 0x1003f3b9
mov ecx, esi
mov edx, 1
call fcn.10006c20
mov eax, dword [esp + 0x28]
cmp eax, 0x80000000
jne 0x1003fec5
mov esi, dword [esp + 0xc]
jmp 0x1003f2fc
test esi, esi
je 0x1003f3e3
mov ecx, dword [esp + 0x18]
mov edx, 1
call fcn.10006c20
mov byte [esp + 0x98], 2
mov dword [esp + 0x9c], 0x1007cdec
jmp 0x1003d58e
cmp dword [esp + 0x3c], 0
mov esi, 2
mov dword [esp + 0x10], 0x1007cd9c
je 0x1003f419
mov edx, 1
call fcn.10006c20
mov edi, dword [esp + 0x124]
shl edi, 8
or edi, esi
xor ebx, ebx
lea ecx, [esp + 0x12c]
call fcn.10042910
cmp dword [esp + 0x28], 0
je 0x1003f448
mov ecx, dword [esp + 0x2c]
mov edx, 2
call fcn.10006c20
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x10]
mov dword [eax + 4], ecx
mov dword [eax], edi
mov dword [eax + 8], 2
jmp 0x10040191
xor edi, edi
test ax, ax
mov eax, ecx
cmove edi, ecx
mov ecx, dword [esp + 0x24]
test edi, edi
cmove ebx, ecx
mov ecx, dword [esp + 0x44]
cmove edi, eax
mov eax, ecx
sub eax, esi
cmp eax, ebx
jae 0x1003f4a7
mov edx, esi
lea ecx, [esp + 0x44]
push ebx
call fcn.10018d80
add esp, 4
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
mov dword [esp + 0x10], eax
jmp 0x1003f4ab
mov dword [esp + 0x10], ecx
lea eax, [ebx + ebx]
lea ecx, [edx + esi*2]
push eax
push edi
push ecx
mov edi, edx
call sub.msvcrt.dll_memcpy
add esp, 0xc
add esi, ebx
mov eax, edi
cmp esi, dword [esp + 0x10]
mov dword [esp + 0x4c], esi
jne 0x1003f4d9
lea ecx, [esp + 0x44]
call fcn.10038520
mov eax, dword [esp + 0x48]
mov word [eax + esi*2], 0x22
mov eax, dword [esp + 0x18]
inc esi
mov dword [esp + 0x4c], esi
test eax, eax
je 0x1003fe61
mov ecx, dword [esp + 0x3c]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*4]
mov dword [esp + 0xbc], eax
mov edi, dword [esp + 0x4c]
cmp edi, dword [esp + 0x44]
jne 0x1003f514
lea ecx, [esp + 0x44]
call fcn.10038520
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
lea ebx, [edi + 1]
mov word [eax + edi*2], 0x20
mov dword [esp + 0x4c], ebx
cmp dword [esi], 0
je 0x1003f56f
movzx eax, byte [esp + 0x40]
lea edx, [esp + 0x44]
lea ecx, [esp + 0x12c]
push eax
push esi
call fcn.100424c0
add esp, 8
cmp byte [esp + 0x12c], 4
jne 0x1003fe9f
mov eax, dword [esp + 0x3c]
add eax, 0x14
cmp eax, dword [esp + 0xbc]
mov dword [esp + 0x3c], eax
jne 0x1003f501
jmp 0x1003fe5d
mov dword [esp + 0xb8], edi
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0xc]
mov edi, dword [esi + 8]
mov dword [esp + 0xa0], eax
add eax, edi
mov dword [esp + 0x18], eax
mov eax, edi
jmp 0x1003f59a
inc eax
cmp dl, cl
je 0x1003faad
cmp eax, dword [esp + 0x18]
je 0x1003f5c4
movzx ecx, byte [eax]
mov esi, 0xffffffff
nop dword [eax + eax]
movzx edx, byte [esi + 0x1007cab1]
cmp dl, cl
je 0x1003f591
test esi, esi
lea esi, [esi + 1]
jne 0x1003f5b0
jmp 0x1003f591
mov dword [esp + 0x24], edi
mov ecx, edi
mov edi, dword [esp + 0xc]
xor esi, esi
jmp 0x1003f5dd
xor esi, esi
test dx, dx
je 0x1003fcdf
mov dx, 1
test si, si
jne 0x1003f5d2
cmp ecx, dword [esp + 0x18]
je 0x1003f682
movzx eax, byte [ecx]
test al, al
js 0x1003f5fa
inc ecx
jmp 0x1003f66c
movzx edi, byte [ecx + 1]
mov esi, eax
and esi, 0x1f
and edi, 0x3f
cmp al, 0xdf
jbe 0x1003f63d
mov dword [esp + 0x10], ecx
movzx ecx, byte [ecx + 2]
shl edi, 6
and ecx, 0x3f
or ecx, edi
cmp al, 0xf0
mov edi, ecx
jb 0x1003f649
mov ecx, dword [esp + 0x10]
and esi, 7
shl edi, 6
shl esi, 0x12
movzx eax, byte [ecx + 3]
add ecx, 4
and eax, 0x3f
or eax, edi
or eax, esi
jmp 0x1003f657
shl esi, 6
add ecx, 2
or esi, edi
mov eax, esi
jmp 0x1003f66c
mov ecx, dword [esp + 0x10]
shl esi, 0xc
or edi, esi
mov eax, edi
add ecx, 3
cmp eax, 0xffff
jbe 0x1003f66c
and eax, 0x3ff
or eax, 0xdc00
mov esi, eax
jmp 0x1003f670
xor esi, esi
mov edx, eax
mov edi, dword [esp + 0xc]
test dx, dx
jne 0x1003f5dd
jmp 0x1003fcdf
mov ecx, dword [esp + 0xa0]
test ecx, ecx
je 0x1003f78e
cmp byte [esp + 0x40], 0
mov edi, dword [esp + 0x24]
setne al
cmp byte [ecx + edi - 1], 0x5c
sete cl
or cl, al
mov byte [esp + 0x10], cl
jmp 0x1003f6bc
mov byte [esp + 0x10], 1
cmp edi, dword [esp + 0x18]
je 0x1003f77a
movzx ecx, byte [edi]
test cl, cl
js 0x1003f6c6
inc edi
jmp 0x1003f719
movzx edx, byte [edi + 1]
mov eax, ecx
and eax, 0x1f
and edx, 0x3f
cmp cl, 0xdf
jbe 0x1003f705
mov esi, ecx
movzx ecx, byte [edi + 2]
shl edx, 6
and ecx, 0x3f
or ecx, edx
mov edx, esi
cmp dl, 0xf0
jb 0x1003f711
movzx edx, byte [edi + 3]
shl ecx, 6
and eax, 7
add edi, 4
shl eax, 0x12
and edx, 0x3f
or edx, ecx
mov ecx, edx
jmp 0x1003f717
shl eax, 6
add edi, 2
or eax, edx
mov ecx, eax
jmp 0x1003f719
add edi, 3
shl eax, 0xc
or ecx, eax
cmp ecx, 0x110000
je 0x1003f6b2
mov eax, ecx
and eax, 0x1ff800
cmp eax, 0xd800
je 0x1003f6b2
cmp ecx, 0x80
jae 0x1003f768
lea eax, [ecx - 0x30]
cmp eax, 0xa
jb 0x1003f768
mov eax, ecx
and eax, 0x5f
add eax, 0xffffffbf
cmp eax, 0x19
jbe 0x1003f768
mov esi, ecx
mov edx, 0x1007ca14
push 0xc
call fcn.1000a3a0
mov ecx, esi
add esp, 4
cmp eax, 1
jne 0x1003f6ad
call fcn.1000bad0
test al, al
jne 0x1003f6ad
jmp 0x1003f6b2
test byte [esp + 0x10], 1
mov edi, dword [esp + 0xc]
mov al, 1
mov dword [esp + 0xf8], eax
je 0x1003f7c1
cmp ebx, dword [esp + 0x44]
jne 0x1003f7a1
lea ecx, [esp + 0x44]
call fcn.10038520
mov edi, dword [esp + 0x48]
mov ebx, dword [esp + 0xb8]
mov dword [esp + 0xf8], 0
mov word [edi + ebx*2 + 2], 0x22
add ebx, 2
mov dword [esp + 0x4c], ebx
xor eax, eax
xor esi, esi
jmp 0x1003f7db
mov eax, dword [esp + 0x10]
mov word [edi + ebx*2], ax
inc ebx
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x4c], ebx
test ax, ax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edi
je 0x1003f7ef
xor edx, edx
jmp 0x1003f8c0
mov ecx, dword [esp + 0x24]
cmp ecx, dword [esp + 0x18]
je 0x1003fa0a
movzx eax, byte [ecx]
test al, al
js 0x1003f814
inc ecx
mov dword [esp + 0x10], eax
xor edx, edx
mov dword [esp + 0x24], ecx
jmp 0x1003f8c0
movzx edx, byte [ecx + 1]
mov edi, eax
and edi, 0x1f
and edx, 0x3f
cmp al, 0xdf
jbe 0x1003f86b
mov dword [esp + 0xa0], edi
movzx edi, byte [ecx + 2]
shl edx, 6
mov dword [esp + 0x10], edi
and dword [esp + 0x10], 0x3f
add dword [esp + 0x10], edx
cmp al, 0xf0
jb 0x1003f87f
movzx edx, byte [ecx + 3]
mov edi, dword [esp + 0xa0]
mov eax, dword [esp + 0x10]
add ecx, 4
mov dword [esp + 0x24], ecx
and edi, 7
shl eax, 6
and edx, 0x3f
shl edi, 0x12
or edx, eax
or edx, edi
jmp 0x1003f896
shl edi, 6
add ecx, 2
or edi, edx
mov dword [esp + 0x24], ecx
xor edx, edx
mov dword [esp + 0x10], edi
jmp 0x1003f8c0
mov eax, dword [esp + 0xa0]
mov edx, dword [esp + 0x10]
add ecx, 3
mov dword [esp + 0x24], ecx
shl eax, 0xc
or edx, eax
cmp edx, 0xffff
jbe 0x1003fa01
lea eax, [edx + 0xff0000]
and edx, 0x3ff
shr eax, 0xa
or edx, 0xdc00
or eax, 0xd800
mov dword [esp + 0x10], eax
movzx eax, word [esp + 0x10]
mov dword [esp + 0xa0], edx
cmp eax, 0x24
jg 0x1003f908
cmp eax, 0xd
je 0x1003f915
cmp eax, 0x22
jne 0x1003f93a
mov eax, dword [esp + 0x44]
mov ecx, eax
sub ecx, ebx
cmp ecx, esi
jae 0x1003f96c
mov edx, ebx
lea ecx, [esp + 0x44]
push esi
call fcn.10018d80
add esp, 4
mov eax, dword [esp + 0x48]
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0xc], eax
jmp 0x1003f970
cmp eax, 0x25
je 0x1003f915
cmp eax, 0x5c
jne 0x1003f93a
inc esi
jmp 0x1003f93c
mov eax, dword [esp + 0x44]
sub eax, ebx
cmp eax, 6
ja 0x1003f945
mov edx, ebx
lea ecx, [esp + 0x44]
push 7
call fcn.10018d80
add esp, 4
mov edi, dword [esp + 0x48]
mov ebx, dword [esp + 0x4c]
jmp 0x1003f949
xor esi, esi
mov edi, dword [esp + 0xc]
jmp 0x1003f9e5
mov edi, dword [esp + 0xc]
mov word [edi + ebx*2 + 0xc], 0x2c
mov dword [edi + ebx*2 + 8], 0x7e003a
mov dword [edi + ebx*2 + 4], 0x640063
mov dword [edi + ebx*2], 0x250025
add ebx, 7
jmp 0x1003f9df
test esi, esi
je 0x1003f9bf
xor eax, eax
cmp esi, 0x10
jae 0x1003f97d
mov ecx, dword [esp + 0xc]
jmp 0x1003f9af
mov ecx, dword [esp + 0xc]
movdqa xmm0, xmmword [0x1005d1c0]
mov eax, esi
and eax, 0xfffffff0
mov edx, eax
lea ecx, [ecx + ebx*2 + 0x10]
movdqu xmmword [ecx - 0x10], xmm0
movdqu xmmword [ecx], xmm0
add ecx, 0x20
add edx, 0xfffffff0
jne 0x1003f994
mov ecx, dword [esp + 0xc]
add ebx, eax
cmp esi, eax
je 0x1003f9bb
sub esi, eax
mov word [ecx + ebx*2], 0x5c
inc ebx
dec esi
jne 0x1003f9b1
mov eax, dword [esp + 0x44]
mov edi, dword [esp + 0xc]
cmp ebx, eax
mov dword [esp + 0x4c], ebx
jne 0x1003f9d8
lea ecx, [esp + 0x44]
call fcn.10038520
mov edi, dword [esp + 0x48]
mov word [edi + ebx*2], 0x22
inc ebx
mov dword [esp + 0x4c], ebx
xor esi, esi
cmp ebx, dword [esp + 0x44]
jne 0x1003f7c7
lea ecx, [esp + 0x44]
call fcn.10038520
mov edi, dword [esp + 0x48]
jmp 0x1003f7c7
mov dword [esp + 0x10], edx
jmp 0x1003f7e8
cmp byte [esp + 0xf8], 0
jne 0x1003f556
mov eax, dword [esp + 0x44]
mov ecx, eax
sub ecx, ebx
cmp ecx, esi
jae 0x1003fa3d
mov edx, ebx
lea ecx, [esp + 0x44]
push esi
call fcn.10018d80
add esp, 4
mov edi, dword [esp + 0x48]
mov ebx, dword [esp + 0x4c]
jmp 0x1003fa41
test esi, esi
je 0x1003fa88
xor eax, eax
cmp esi, 0x10
jae 0x1003fa4c
mov ecx, edi
jmp 0x1003fa78
movdqa xmm0, xmmword [0x1005d1c0]
mov eax, esi
lea ecx, [edi + ebx*2 + 0x10]
and eax, 0xfffffff0
mov edx, eax
movdqu xmmword [ecx - 0x10], xmm0
movdqu xmmword [ecx], xmm0
add ecx, 0x20
add edx, 0xfffffff0
jne 0x1003fa5f
add ebx, eax
cmp esi, eax
mov ecx, edi
je 0x1003fa84
sub esi, eax
mov word [ecx + ebx*2], 0x5c
inc ebx
dec esi
jne 0x1003fa7a
mov eax, dword [esp + 0x44]
cmp ebx, eax
mov dword [esp + 0x4c], ebx
jne 0x1003fa9d
lea ecx, [esp + 0x44]
call fcn.10038520
mov edi, dword [esp + 0x48]
mov word [edi + ebx*2], 0x22
inc ebx
mov dword [esp + 0x4c], ebx
jmp 0x1003f556
xor edi, edi
mov esi, 0x1007ca60
jmp 0x1003e6a9
xor eax, eax
movzx ecx, byte [0x1008b0a1]
xor edx, edx
mov dword [esp + 0xf0], 0x1008b0a0
mov byte [esp + 0xf4], al
lea eax, [esp + 0x10c]
mov dword [esp + 0xc0], 0
mov dword [esp + 0xc8], 0
mov dword [esp + 0xd0], 0
test cl, cl
mov ecx, dword [esp + 0x14]
setne dl
mov dword [esp + 0xec], edx
cmp dword [ecx], 6
mov edx, ecx
lea edi, [ecx + 8]
lea esi, [ecx + 0x10]
cmove edx, eax
cmp dword [ecx + 8], 6
cmove edi, eax
cmp dword [ecx + 0x10], 6
cmove esi, eax
lea eax, [esp + 0xc0]
lea ecx, [esp + 0x12c]
push eax
push 0xfffffffffffffff6
call fcn.100429a0
add esp, 8
movzx eax, byte [esp + 0x12c]
cmp al, 4
jne 0x1003fca5
mov ecx, dword [esp + 0x130]
lea eax, [esp + 0xc8]
mov dword [esp + 0x24], ecx
mov edx, edi
lea ecx, [esp + 0x12c]
push eax
push 0xfffffffffffffff5
call fcn.100429a0
add esp, 8
movzx eax, byte [esp + 0x12c]
mov edi, dword [esp + 0xc]
cmp al, 4
jne 0x1003fcfb
mov ecx, dword [esp + 0x130]
lea eax, [esp + 0xd0]
mov dword [esp + 0x3c], ecx
mov edx, esi
lea ecx, [esp + 0x12c]
push eax
push 0xfffffffffffffff4
call fcn.100429a0
add esp, 8
movzx eax, byte [esp + 0x12c]
mov esi, dword [esp + 0x24]
cmp al, 4
jne 0x1003fe02
mov ecx, dword [esp + 0x130]
pxor xmm0, xmm0
test esi, esi
mov dword [esp + 0x84], 0
movdqu xmmword [esp + 0x74], xmm0
movdqu xmmword [esp + 0x64], xmm0
movdqu xmmword [esp + 0x54], xmm0
movdqu xmmword [esp + 0x44], xmm0
jne 0x1003fc09
cmp dword [esp + 0x3c], 0
jne 0x1003fc09
mov eax, 1
test ecx, ecx
je 0x1003fc2c
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x70], 0x100
mov dword [esp + 0x7c], esi
mov dword [esp + 0x80], eax
mov eax, 0x101
mov dword [esp + 0x84], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0xbc], ecx
mov dword [esp + 0x40], ebx
cmp word [edx + 0x44], 0
je 0x1003fc4f
movzx ecx, word [edx + 0x46]
mov dword [esp + 0x70], eax
mov word [esp + 0x74], cx
mov ebx, dword [edx + 0x64]
test ebx, ebx
je 0x1003fe8e
add edx, 0x5c
mov dword [esp + 0x44], 0x48
lea ecx, [esp + 0x94]
call fcn.100430a0
cmp dword [esp + 0x94], 0
mov edx, dword [esp + 0x98]
mov ecx, dword [esp + 0x9c]
je 0x1003fef2
mov eax, dword [esp + 0x88]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [eax + 8], 2
jmp 0x100400ab
mov edx, dword [esp + 0x88]
movzx edi, word [esp + 0x12d]
movzx ecx, byte [esp + 0x12f]
mov esi, dword [esp + 0x130]
mov word [edx + 1], di
mov edi, dword [esp + 0xc]
mov byte [edx + 3], cl
mov byte [edx], al
mov dword [edx + 4], esi
mov dword [edx + 8], 2
jmp 0x100400ca
mov esi, 0x1007cd9c
mov ebx, 2
xor edi, edi
cmp dword [esp + 0x44], 0
jne 0x1003e6b5
jmp 0x1003e6c3
movzx ecx, byte [esp + 0x12f]
mov edx, dword [esp + 0x88]
mov esi, dword [esp + 0x130]
mov byte [edx + 3], cl
movzx ecx, word [esp + 0x12d]
mov word [edx + 1], cx
mov byte [edx], al
mov dword [edx + 4], esi
mov dword [edx + 8], 2
push dword [esp + 0x24]
jmp 0x100400c5
mov esi, dword [esp + 0x38]
mov ecx, eax
mov dword [esp + 0x12c], esi
mov dword [esp + 0x130], ecx
mov word [esp + 0x134], 0
mov edi, dword [esp + 0xc]
lea ecx, [esp + 0x44]
lea edx, [esp + 0x12c]
call fcn.10040b00
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x4c]
cmp esi, eax
jne 0x1003fd80
lea ecx, [esp + 0x44]
call fcn.10038520
mov eax, dword [esp + 0x44]
mov ebx, dword [esp + 0x48]
cmp eax, 0x80000000
mov dword [esp + 0xa0], eax
mov word [ebx + esi*2], 0
jne 0x1003fe38
inc esi
jmp 0x1003edd4
xor ebx, ebx
lea ecx, [esp + 0x12c]
call fcn.10042910
mov ecx, dword [esp + 0x108]
mov eax, dword [esp + 0x18]
cmp ecx, dword [esp + 0x28]
jne 0x1003fdd7
xor ebx, ebx
lea ecx, [esp + 0x28]
call fcn.10038520
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x108]
mov word [eax + ecx*2], 0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
cmp eax, 0x80000000
mov dword [esp + 0x10], eax
jne 0x1003eca2
inc ecx
mov dword [esp + 0x10], ecx
jmp 0x1003f448
movzx ecx, byte [esp + 0x12f]
mov edx, dword [esp + 0x88]
mov byte [edx + 3], cl
movzx ecx, word [esp + 0x12d]
mov word [edx + 1], cx
mov ecx, dword [esp + 0x130]
mov byte [edx], al
mov dword [edx + 4], ecx
mov dword [edx + 8], 2
jmp 0x100400bb
mov esi, ebx
jmp 0x1003ecc5
mov ecx, 0x1008b0a0
call fcn.10018e10
jmp 0x1003ece1
mov ecx, 0x1007b4ec
call fcn.10009070
jmp 0x10040459
mov esi, dword [esp + 0x4c]
mov eax, dword [esp + 0x44]
cmp esi, eax
jne 0x1003fe76
lea ecx, [esp + 0x44]
call fcn.10038520
mov eax, dword [esp + 0x44]
mov ebx, dword [esp + 0x48]
mov edi, ebx
mov word [ebx + esi*2], 0x22
inc esi
and edi, 0xffffff00
jmp 0x1003e6c8
mov dword [esp + 0x44], 0x44
lea edx, [esp + 0x44]
jmp 0x1003ff2d
mov ebx, dword [esp + 0x12c]
mov esi, dword [esp + 0x130]
mov edi, ebx
and edi, 0xffffff00
cmp dword [esp + 0x44], 0
jne 0x1003e6b5
jmp 0x1003e6c3
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
cmp dword [esp + 0xc], 0
mov dword [esp + 0x90], eax
je 0x1003fee9
mov ecx, dword [esp + 0x18]
mov edx, 1
call fcn.10006c20
mov eax, esi
mov ecx, esi
jmp 0x1003dd03
mov eax, edx
lea edx, [esp + 0x12c]
mov dword [esp + 0x14], ecx
or dword [esp + 0xf8], 0x80000
lea esi, [esp + 0x44]
mov ecx, 0x11
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xb8], eax
mov dword [esp + 0x170], eax
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x28]
push eax
push edx
push dword [esp + 0x40]
push dword [esp + 0x24]
push dword [esp + 0x108]
push 1
push 0
push 0
push dword [esp + 0x120]
push dword [esp + 0xb0]
call sub.KERNEL32.dll_CreateProcessW
test eax, eax
je 0x10040068
mov eax, dword [esp + 0x88]
movsd xmm1, qword [esp + 0xc8]
movq xmm0, qword [esp + 0xd0]
movsd xmm2, qword [esp + 0xc0]
test ebx, ebx
movsd qword [eax + 0x10], xmm1
movsd xmm1, qword [esp + 0x28]
movq qword [eax + 0x18], xmm0
movsd qword [eax + 8], xmm2
movsd qword [eax], xmm1
je 0x1003ffb2
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0x14]
call fcn.10043300
push dword [esp + 0xbc]
call sub.KERNEL32.dll_CloseHandle
push dword [esp + 0x3c]
call sub.KERNEL32.dll_CloseHandle
push esi
call sub.KERNEL32.dll_CloseHandle
mov ebx, dword [esp + 0x40]
lea ecx, [esp + 0xec]
call fcn.10043330
cmp dword [esp + 0xa0], 0
je 0x1003fff3
mov ecx, ebx
mov edx, 2
call fcn.10006c20
cmp dword [esp + 0x10], 0
je 0x10040006
mov ecx, edi
mov edx, 2
call fcn.10006c20
cmp dword [esp + 0xfc], 0
je 0x10040021
mov ecx, dword [esp + 0x100]
mov edx, 2
call fcn.10006c20
cmp dword [esp + 0xb4], 0
je 0x1004003c
mov ecx, dword [esp + 0x8c]
mov edx, 2
call fcn.10006c20
cmp byte [esp + 0x1c], 0
je 0x1003d6d6
cmp dword [esp + 0x90], 0
je 0x1003d6d6
mov ecx, dword [esp + 0x20]
mov edx, 2
call fcn.10006c20
jmp 0x1003d6d6
call sub.KERNEL32.dll_GetLastError
movzx ecx, word [esp + 0x94]
mov edx, dword [esp + 0x88]
test ebx, ebx
mov word [edx + 1], cx
mov ch, byte [esp + 0x96]
mov byte [edx + 3], ch
mov byte [edx], 0
mov dword [edx + 4], eax
mov dword [edx + 8], 2
je 0x100400ab
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0x14]
call fcn.10043300
push dword [esp + 0xbc]
call sub.KERNEL32.dll_CloseHandle
mov ebx, dword [esp + 0x40]
push dword [esp + 0x3c]
call sub.KERNEL32.dll_CloseHandle
push esi
call sub.KERNEL32.dll_CloseHandle
cmp dword [esp + 0xc0], 0
je 0x100400e0
push dword [esp + 0xc4]
call sub.KERNEL32.dll_CloseHandle
cmp dword [esp + 0xc8], 0
je 0x100400f6
push dword [esp + 0xcc]
call sub.KERNEL32.dll_CloseHandle
cmp dword [esp + 0xd0], 0
je 0x1004010c
push dword [esp + 0xd4]
call sub.KERNEL32.dll_CloseHandle
cmp dword [esp + 0xec], 0
mov esi, dword [esp + 0xf0]
movzx eax, byte [esp + 0xf4]
je 0x1004013c
test al, al
jne 0x10040159
mov eax, dword [0x1008b080]
test eax, 0x7fffffff
je 0x10040159
call fcn.10018eb0
jmp 0x10040151
test al, al
jne 0x10040159
mov eax, dword [0x1008b080]
test eax, 0x7fffffff
je 0x10040159
call fcn.10018eb0
test al, al
jne 0x10040159
mov byte [esi + 1], 1
xor eax, eax
xchg byte [esi], al
cmp al, 2
jne 0x10040168
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
cmp dword [esp + 0xa0], 0
je 0x1004017e
mov ecx, ebx
mov edx, 2
call fcn.10006c20
cmp dword [esp + 0x10], 0
je 0x10040191
mov ecx, edi
mov edx, 2
call fcn.10006c20
cmp dword [esp + 0xfc], 0
je 0x100401ac
mov ecx, dword [esp + 0x100]
mov edx, 2
call fcn.10006c20
cmp dword [esp + 0xb4], 0
je 0x100401c7
mov ecx, dword [esp + 0x8c]
mov edx, 2
call fcn.10006c20
cmp byte [esp + 0x1c], 0
mov bl, 1
jne 0x1003ebd9
jmp 0x1003d6d6
movzx esi, cl
jmp 0x1003f419
mov ecx, 0x1007ac68
call fcn.10009070
jmp 0x10040459
call sub.KERNEL32.dll_GetLastError
lea edi, [esp + 0xc0]
lea esi, [esp + 0x28]
mov byte [esp + 0xc0], 0
mov dword [esp + 0x44], 0x1007cd38
mov dword [esp + 0x48], 1
mov dword [esp + 0x54], 0
mov dword [esp + 0xc4], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x2c], 0x10039260
mov dword [esp + 0x50], 1
lea ecx, [esp + 0x44]
mov edx, 0x1007cd6c
call fcn.10007890
jmp 0x10040459
xor ecx, ecx
jmp 0x10040289
mov ecx, 1
jmp 0x1004025f
xor ecx, ecx
mov edx, dword [esp + 0xc]
call fcn.10006fb0
jmp 0x10040459
mov ecx, 2
jmp 0x10040276
xor ecx, ecx
mov edx, dword [esp + 0x24]
call fcn.10006fb0
jmp 0x10040459
mov ecx, 1
mov edx, dword [esp + 0xc]
call fcn.10006fb0
jmp 0x10040459
xor edx, edx
mov ecx, 1
push 0x1007cc00
call fcn.100078d0
add esp, 4
jmp 0x10040459
mov edx, 0x28
mov ecx, str.internal_error:_entered_unreachable_code
push 0x1007d124
call fcn.10008230
add esp, 4
jmp 0x10040459
mov edx, edi
mov ecx, eax
push 0x1007cc10
call fcn.10007fd0
add esp, 4
jmp 0x10040459
mov edx, edi
mov ecx, esi
push 0x1007cc20
call fcn.100078d0
add esp, 4
jmp 0x10040459
mov edx, 0x21
mov ecx, str.assertion_failed:_self.height___0
push 0x1007b210
call fcn.10008230
add esp, 4
jmp 0x10040459
mov edx, 0x28
mov ecx, str.internal_error:_entered_unreachable_code
push 0x1007d124
call fcn.10008230
add esp, 4
jmp 0x10040459
mov dword [esp + 0x20], 4
mov ecx, 1
mov edx, dword [esp + 0x20]
call fcn.10006fb0
jmp 0x10040459
mov edx, 0x28
mov ecx, str.internal_error:_entered_unreachable_code
push 0x1007d124
call fcn.10008230
add esp, 4
jmp 0x10040459
mov edx, 0x28
mov ecx, str.internal_error:_entered_unreachable_code
push 0x1007d124
call fcn.10008230
add esp, 4
jmp 0x10040459
call sub.KERNEL32.dll_GetLastError
mov byte [esp + 0x44], 0
mov dword [esp + 0x48], eax
lea esi, [esp + 0x44]
lea eax, [esp + 0xc0]
mov dword [esp + 0x12c], 0x1007cc54
mov dword [esp + 0x130], 1
mov dword [esp + 0x13c], 0
mov dword [esp + 0xc0], esi
mov dword [esp + 0x134], eax
mov dword [esp + 0xc4], 0x10039260
mov dword [esp + 0x138], 1
lea ecx, [esp + 0x12c]
mov edx, 0x1007cc5c
call fcn.10007890
jmp 0x10040459
xor ecx, ecx
jmp 0x1004033d
mov ecx, ebx
push 0x1007d114
call fcn.10007fd0
add esp, 4
jmp 0x10040459
mov ecx, edi
push 0x1007d114
call fcn.10007fd0
add esp, 4
jmp 0x10040459
xor ecx, ecx
mov edx, ebx
call fcn.10006fb0
jmp 0x10040459
mov ecx, 2
mov edx, 0x14
call fcn.10006fb0
jmp 0x10040459
mov ecx, ebx
push 0x1007d114
call fcn.10007fd0
add esp, 4
jmp 0x10040459
mov ecx, ebx
push 0x1007d114
call fcn.10007fd0
add esp, 4
ud2