Function at 0xc4be1f
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0xea4
mov eax, 0xbcd79c
call fcn.00bc132b
mov esi, ecx
mov dword [ebp - 0xc98], esi
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0xbd0], eax
push ebx
push eax
call fcn.00c4bc22
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0xc4beab
lea eax, [ebp - 0x3a0]
push eax
push dword [esi + 0x14]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetWindowRect]
mov eax, dword [ebp - 0x398]
sub eax, dword [ebp - 0x3a0]
cdq
sub eax, edx
mov ebx, eax
mov eax, dword [ebp - 0x394]
sub eax, dword [ebp - 0x39c]
cdq
sub eax, edx
sar ebx, 1
add ebx, dword [ebp - 0x3a0]
mov esi, eax
sar esi, 1
add esi, dword [ebp - 0x39c]
push esi
push ebx
mov dword [ebp - 0xc88], ebx
mov dword [ebp - 0xc8c], esi
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetCursorPos]
xor ebx, ebx
inc ebx
jmp 0xc4bebe
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [ebp - 0xc88], ecx
mov dword [ebp - 0xc8c], eax
xor edx, edx
mov esi, 0xd0aed4
mov dword [ebp - 0xc3c], edx
mov dword [ebp - 0xd54], edx
mov dword [ebp - 0xc10], edx
mov dword [ebp - 0xa7c], edx
mov ecx, ebx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xc4bedd
mov eax, dword [0xd0a150]
mov ebx, 0xb2bef2
mov dword [ebp - 0xbec], ebx
mov dword [ebp - 0xbbc], 0x67
mov dword [ebp - 0xb7c], 0x337
mov dword [ebp - 0xba4], 0x10b
mov dword [ebp - 0xba8], 0x20b
test eax, eax
jne 0xc4c541
push 0x338
mov esi, edx
mov dword [ebp - 0xad8], edx
push edx
mov dword [ebp - 0xa78], edx
mov dword [ebp - 0xaa8], esi
mov dword [ebp - 0xb94], edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb44], eax
test eax, eax
je 0xc4c535
or dword [ebp - 0xb8c], 0xffffffff
xor edx, edx
mov edi, edx
mov dword [ebp - 0x408], 0xab69605e
add eax, 7
mov dword [ebp - 0x404], 0x7f1137f
mov cl, dl
mov dword [ebp - 0xbe8], edx
mov dword [ebp - 0xb38], edx
mov esi, ebx
mov dword [ebp - 0xb6c], edi
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xb34], 0x67
movzx edx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx ebx, byte [esi + 2]
shl edx, 8
or edx, eax
shl ebx, 8
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
or ebx, eax
mov dword [ebp - 0xb70], edx
movzx eax, byte [esi + 4]
xor edi, edx
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 5]
add esi, 8
shl ebx, 8
or ebx, eax
mov dword [ebp - 0xc20], esi
mov esi, ebx
xor esi, dword [ebp - 0xb38]
xor esi, edi
xor esi, 0xac987321
mov edx, esi
rol edx, 0xa
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul eax, eax, 0x137f
add edx, eax
xor edi, edx
mov edx, edi
rol edx, 2
lea eax, [edi + 0x7f1137f]
ror eax, 9
imul eax, eax, 0xab69
sub eax, edx
xor esi, eax
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0xab69
rol edx, 2
rol eax, 6
imul eax, eax, 0x7f1
sub eax, edx
xor esi, eax
mov eax, 0x7f1137f
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
mov edx, esi
rol edx, 2
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul eax, eax, 0x605e
add edx, eax
xor edi, edx
mov edx, edi
rol edx, 8
lea eax, [edi + 0x54969fa2]
ror eax, 0xe
imul eax, eax, 0x7f1
sub eax, edx
xor esi, eax
mov eax, esi
mov edx, esi
xor eax, 0xab69605e
ror edx, 0xa
ror eax, 0xc
imul eax, eax, 0x137f
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, edi
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edi, eax
mov dword [ebp - 0xaf0], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xaf0]
xor edi, 0xab69605e
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, edi
shr eax, 2
add edx, eax
xor esi, edx
mov edx, esi
rol edx, 7
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul eax, eax, 0xab69
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xaf0], esi
xor eax, 0xab69
mov edx, esi
rol eax, 5
imul eax, eax, 0x7f1
rol edx, 7
add edx, eax
mov eax, esi
xor edi, edx
xor eax, edi
xor eax, 0xac987321
mov dword [ebp - 0xaf0], eax
ror eax, 3
mov esi, dword [ebp - 0xaf0]
sub eax, 0xab69
imul eax, eax, 0x137f
xor edi, eax
mov edx, edi
ror edx, 6
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul eax, eax, 0x605e
sub eax, edx
xor esi, eax
mov edx, esi
rol edx, 0xe
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul eax, eax, 0x7f1
add edx, eax
xor edi, edx
lea eax, [edi - 0x54969fa2]
mov edx, edi
rol eax, 0xf
imul eax, eax, 0x137f
ror edx, 0xe
sub eax, edx
xor esi, eax
mov eax, esi
mov dword [ebp - 0xaf0], esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor edi, dword [ebp - 0xb8c]
xor eax, 0x7f1137f
rol eax, 4
imul eax, eax, 0x605e
rol edx, 2
mov dword [ebp - 0xb38], edi
mov dword [ebp - 0xb8c], ebx
xor edx, eax
mov eax, esi
xor edx, dword [ebp - 0xbe8]
xor eax, edx
mov esi, dword [ebp - 0xc20]
mov edx, dword [ebp - 0xad4]
mov dword [ebp - 0xb6c], eax
mov byte [edx - 4], al
mov al, byte [ebp - 0xb38]
ror dword [ebp - 0xb6c], 8
mov byte [edx], al
mov al, byte [ebp - 0xb6c]
ror dword [ebp - 0xb38], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb38]
ror dword [ebp - 0xb6c], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb6c]
ror dword [ebp - 0xb38], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb38]
ror dword [ebp - 0xb6c], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xb6c]
ror dword [ebp - 0xb38], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb38]
mov byte [edx - 3], al
add edx, 8
mov eax, dword [ebp - 0xb6c]
ror dword [ebp - 0xb38], 8
ror eax, 8
sub dword [ebp - 0xb34], 1
mov dword [ebp - 0xaf0], eax
mov edi, dword [ebp - 0xaf0]
mov dword [ebp - 0xb6c], eax
mov eax, dword [ebp - 0xb70]
mov dword [ebp - 0xbe8], eax
mov dword [ebp - 0xad4], edx
jne 0xc4bfac
mov esi, dword [ebp - 0xb44]
xor eax, eax
mov edx, eax
xor cl, byte [edx + esi]
inc edx
cmp edx, 0x338
jb 0xc4c308
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xc4c33b
cmp edx, dword [0xb2c22c]
jne 0xc4c33b
mov edi, esi
xor eax, eax
mov dword [ebp - 0xaa8], edi
mov esi, eax
mov ebx, 0x337
jmp 0xc4c350
mov edi, dword [ebp - 0xaa8]
or ebx, 0xffffffff
mov dword [ebp - 0xb94], 0xc004d501
xor eax, eax
test esi, esi
je 0xc4c363
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb94], 0
jl 0xc4c52f
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xd0ae80
push eax
push ebx
call fcn.00bc259b
add esp, 0xc
cmp byte [edi], 0
je 0xc4c4c5
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbd0]
jne 0xc4c39a
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc4c528
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa78], edx
cmp word [eax], cx
je 0xc4c3e7
mov edx, 0xc000007b
mov dword [ebp - 0xa78], edx
jmp 0xc4c42f
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xc4c3da
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xc4c3da
cmp dword [ecx], 0x4550
jne 0xc4c3da
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xba4]
je 0xc4c41d
cmp ax, word [ebp - 0xba8]
je 0xc4c41d
mov edx, 0xc000000d
jmp 0xc4c3df
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xa84], eax
test eax, eax
je 0xc4c4b9
mov ecx, esi
mov dword [ebp - 0xabc], esi
xor eax, eax
mov dword [ebp - 0xc84], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xb70], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc4c459
sub ecx, dword [ebp - 0xb70]
inc esi
add esi, ecx
test edx, edx
js 0xc4c4a3
mov ecx, dword [ebp - 0xabc]
lea eax, [ebp - 0xc84]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa78], edx
test edx, edx
js 0xc4c4c5
mov eax, dword [ebp - 0xad8]
mov ecx, dword [ebp - 0xc84]
mov dword [eax*4 + section..data], ecx
jmp 0xc4c4a9
mov eax, dword [ebp - 0xad8]
inc eax
inc ebx
mov dword [ebp - 0xad8], eax
cmp ebx, dword [ebp - 0xa84]
jb 0xc4c440
add edi, 0x10
cmp byte [esi], 0
jne 0xc4c393
mov ebx, dword [ebp - 0xa78]
mov esi, dword [ebp - 0xaa8]
test esi, esi
je 0xc4c4e6
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc4c53c
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc4c4ff
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc4c4ee
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc4c547
mov ebx, 0xc000007a
jmp 0xc4c4cb
mov esi, dword [ebp - 0xaa8]
mov ebx, 0xc000007a
jmp 0xc4c4d1
mov eax, dword [0xd0a150]
inc eax
mov dword [0xd0a150], eax
xor eax, eax
mov ecx, 0xd0aed4
xchg dword [ecx], eax
xor ecx, ecx
mov eax, ecx
mov dword [ebp - 0xaa4], ecx
mov dword [ebp - 0xa70], eax
mov ebx, ecx
mov eax, dword fs:[0x30]
mov edi, ecx
cmp dword [eax + 0x1d4], ecx
je 0xc4c85f
mov esi, dword [0xd08088]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, eax
mov dword [ebp - 0xabc], ecx
test ecx, ecx
jne 0xc4c59d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc4c8af
xor edx, edx
mov eax, edx
mov esi, edx
mov dword [ebp - 0xa70], eax
lea edx, [ebp - 0xc6c]
push edx
push eax
mov eax, dword [0xd08098]
push esi
push 2
push ecx
mov ecx, eax
mov dword [ebp - 0xb70], eax
call dword [0xd0cffc]
call dword [ebp - 0xb70]
test eax, eax
jne 0xc4c634
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc4c61c
test esi, esi
jne 0xc4c615
push dword [ebp - 0xc6c]
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc4c60b
mov eax, dword [ebp - 0xc6c]
mov ecx, dword [ebp - 0xabc]
jmp 0xc4c5a9
mov eax, 0x8007000e
jmp 0xc4c8ab
mov eax, 0x80004005
jmp 0xc4c62a
test eax, eax
je 0xc4c615
jle 0xc4c62a
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xa70], eax
xor eax, eax
jmp 0xc4c63a
xor eax, eax
mov ebx, esi
mov esi, eax
test esi, esi
je 0xc4c64d
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xa70]
test eax, eax
js 0xc4c890
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov esi, dword [0xd08094]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov ecx, eax
mov dword [ebp - 0xabc], ecx
test ecx, ecx
jne 0xc4c6b4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xa70], eax
test eax, eax
jle 0xc4c69e
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xa70], eax
test eax, eax
js 0xc4c890
mov eax, 0x80004005
mov dword [ebp - 0xa70], eax
jmp 0xc4c890
xor eax, eax
mov esi, eax
mov dword [ebp - 0xa70], eax
lea edx, [ebp - 0xc68]
push edx
push eax
mov eax, dword [0xd08098]
push esi
push 2
push ecx
mov ecx, eax
mov dword [ebp - 0xb70], eax
call dword [0xd0cffc]
call dword [ebp - 0xb70]
test eax, eax
jne 0xc4c757
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc4c733
xor eax, eax
test esi, esi
jne 0xc4c727
push dword [ebp - 0xc68]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc4c720
mov eax, dword [ebp - 0xc68]
mov ecx, dword [ebp - 0xabc]
jmp 0xc4c6be
mov eax, 0x8007000e
jmp 0xc4c6a9
mov dword [ebp - 0xa70], 0x80004005
jmp 0xc4c75d
test eax, eax
jne 0xc4c743
mov dword [ebp - 0xa70], 0x80004005
jmp 0xc4c753
jle 0xc4c74d
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xa70], eax
xor eax, eax
jmp 0xc4c75d
xor eax, eax
mov edi, esi
mov esi, eax
test esi, esi
je 0xc4c770
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xa70]
test eax, eax
js 0xc4c86f
test ebx, ebx
je 0xc4c863
push 4
mov ecx, 0xb2be5c
mov eax, ebx
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xc4c7b4
test dx, dx
je 0xc4c7b0
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xc4c7b4
add eax, esi
add ecx, esi
test dx, dx
jne 0xc4c790
xor eax, eax
jmp 0xc4c7b9
sbb eax, eax
or eax, 1
test eax, eax
jne 0xc4c863
test edi, edi
je 0xc4c863
mov ecx, 0xb2be6c
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xc4c7f6
test dx, dx
je 0xc4c7f0
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xc4c7f6
add eax, esi
add ecx, esi
test dx, dx
jne 0xc4c7d0
xor ecx, ecx
mov eax, ecx
jmp 0xc4c7fd
sbb eax, eax
or eax, 1
xor ecx, ecx
test eax, eax
jne 0xc4c863
push esi
lea eax, [ebp - 0xc64]
mov dword [ebp - 0xc64], ecx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
jne 0xc4c851
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xa70], eax
test eax, eax
jle 0xc4c842
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xa70], eax
test eax, eax
js 0xc4c875
mov eax, 0x80004005
mov dword [ebp - 0xa70], eax
jmp 0xc4c875
test byte [ebp - 0xc64], 0xf
jne 0xc4c863
xor eax, eax
inc eax
jmp 0xc4c869
mov eax, ecx
jmp 0xc4c869
mov eax, dword [ebp - 0xaa4]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebp - 0xa70]
test edi, edi
je 0xc4c890
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xa70]
test ebx, ebx
je 0xc4c8ab
push ebx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xa70]
test eax, eax
jns 0xc4c8b7
xor eax, eax
mov dword [ebp - 0xa7c], eax
push 4
pop eax
push eax
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
xor edx, edx
mov dword [ebp - 0xb70], eax
test eax, eax
jne 0xc4c991
mov ebx, edx
mov dword [ebp - 0xa6c], 0x8007000e
mov eax, dword [ebp - 0xc4c]
mov dword [ebp - 0xc10], eax
xor edx, edx
mov esi, 0xd0aed4
lea ecx, [edx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xc4c8f2
mov eax, dword [0xd0a150]
push 0
pop edx
test eax, eax
jle 0xc4c951
sub eax, 1
mov dword [0xd0a150], eax
jne 0xc4c951
mov edi, edx
mov eax, dword [edi + 0xd0ae80]
test eax, eax
je 0xc4c928
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xc4c917
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0xd0aed4
xchg dword [ecx], eax
test ebx, ebx
je 0xc4c965
push ebx
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov ecx, dword [ebp - 0xa6c]
mov eax, dword [ebp - 0xc3c]
test ecx, ecx
jns 0xc565e3
cmp ecx, 0xd0000034
jne 0xc565a5
mov ecx, 0xc004f012
mov ebx, ecx
jmp 0xc565fc
mov ebx, eax
mov dword [ebp - 0xa68], edx
xor eax, eax
mov dword [ebp - 0xaa4], ebx
lea edi, [ebp - 0xbe4]
mov dword [ebp - 0xa84], edx
stosd dword es:[edi], eax
mov dword [ebp - 0xcc0], edx
mov dword [ebp - 0xcbc], edx
mov dword [ebp - 0xa88], edx
stosd dword es:[edi], eax
mov dword [ebp - 0xadc], edx
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xb8c], 0x38
mov dword [ebp - 0xabc], esi
test esi, esi
jne 0xc4c9fd
mov esi, 0xc0000017
jmp 0xc4f936
push edi
push 0xd08d58
push esi
call fcn.00bc13d0
mov edi, esi
add esp, 0xc
mov dword [ebp - 0xa68], edi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xa80], ecx
test ecx, ecx
jne 0xc4ca41
mov esi, 0xc0000017
mov dword [ebp - 0xa6c], esi
jmp 0xc4f942
mov eax, dword [0xd08d50]
mov dword [ecx], eax
mov eax, dword [0xd08d54]
mov dword [ecx + 4], eax
mov dword [ebp - 0xa84], ecx
rdtsc
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xa74], edx
xor eax, eax
mov dword [ebp - 0xa8c], eax
lea eax, [ebp - 0xce0]
push eax
push 4
pop ecx
mov edx, ecx
call fcn.00b84e9a
mov edi, dword [ebp - 0xce0]
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
jns 0xc4ca9a
mov edi, dword [ebp - 0xe30]
jmp 0xc4f93c
lea eax, [ebp - 0xa8c]
mov edx, edi
push eax
xor ecx, ecx
call fcn.00b84e9a
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xa6c], esi
jl 0xc4f93c
lea eax, [ebp - 0xce4]
mov edx, 0xa0
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f93c
mov edi, dword [ebp - 0xce4]
mov ecx, dword [ebp - 0xa8c]
lea eax, [ebp - 0xa8c]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xa6c], esi
jl 0xc4f93c
lea eax, [ebp - 0xce8]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f93c
mov edi, dword [ebp - 0xce8]
mov ecx, dword [ebp - 0xa8c]
lea eax, [ebp - 0xa8c]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xa6c], esi
jl 0xc4f93c
lea eax, [ebp - 0xcfc]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f93c
mov edi, dword [ebp - 0xcfc]
mov ecx, dword [ebp - 0xa8c]
lea eax, [ebp - 0xa8c]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xa6c], esi
jl 0xc4f93c
lea eax, [ebp - 0xc60]
mov edx, SysReAllocString
push eax
mov ecx, 0xb3f830
call fcn.00b84ebc
test eax, eax
jns 0xc4cbda
mov esi, 0xc000003e
jmp 0xc4f936
mov eax, dword [ebp - 0xc60]
inc eax
mov dword [ebp - 0xc60], eax
lea edx, [eax + eax]
lea eax, [ebp - 0xd14]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f93c
mov edi, dword [ebp - 0xd14]
mov ecx, dword [ebp - 0xa8c]
lea eax, [ebp - 0xa8c]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xa6c], esi
jl 0xc4f93c
lea eax, [ebp - 0xd24]
push eax
push 4
pop ecx
mov edx, ecx
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f93c
mov edi, dword [ebp - 0xd24]
mov ecx, dword [ebp - 0xa8c]
lea eax, [ebp - 0xa8c]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xa6c], esi
jl 0xc4f93c
lea eax, [ebp - 0xd28]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f93c
mov edi, dword [ebp - 0xd28]
mov ecx, dword [ebp - 0xa8c]
lea eax, [ebp - 0xa8c]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xa6c], esi
jl 0xc4f93c
mov eax, dword [ebp - 0xa8c]
push eax
push 8
mov dword [ebp - 0xcc0], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xab4], edi
test edi, edi
je 0xc4c9f3
mov dword [ebp - 0xcbc], edi
xor eax, eax
mov dword [ebp - 0xa70], eax
mov dword [ebp - 0xe2c], eax
mov dword [ebp - 0xbfc], edi
push 4
pop ecx
lea eax, [ebp - 0xdd8]
mov dword [ebp - 0xddc], ecx
mov edx, ecx
mov ecx, edi
push eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4cd77
mov ecx, dword [ebp - 0xa8c]
lea eax, [edi + 8]
add ecx, edi
cmp eax, ecx
jbe 0xc4cd5d
mov esi, 0xc0000023
jmp 0xc4f936
push 4
pop eax
mov dword [edi], eax
xor ecx, ecx
mov eax, dword [ebp - 0xdd8]
mov dword [eax], ecx
xor eax, eax
inc eax
mov dword [ebp - 0xa70], eax
jmp 0xc4cd7f
mov eax, dword [ebp - 0xa70]
xor ecx, ecx
test esi, esi
js 0xc4f93c
mov dword [ebp - 0xc38], edi
mov dword [ebp - 0xaa0], ecx
test eax, eax
je 0xc4ce0d
mov edx, dword [edi]
lea eax, [ebp - 0xd2c]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4cdc4
mov eax, dword [ebp - 0xd2c]
mov dword [ebp - 0xd30], eax
jmp 0xc4cdca
mov eax, dword [ebp - 0xd30]
test esi, esi
js 0xc4ce7b
lea ecx, [ebp - 0xc38]
mov edx, eax
push ecx
mov ecx, edi
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4ce7b
mov eax, dword [ebp - 0xaa0]
mov edi, dword [ebp - 0xc38]
inc eax
mov dword [ebp - 0xaa0], eax
cmp eax, dword [ebp - 0xa70]
jb 0xc4cd97
lea eax, [ebp - 0xde8]
mov dword [ebp - 0xdec], 0xa0
push eax
push 4
pop eax
mov edx, eax
mov ecx, edi
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4ce7b
mov ecx, dword [ebp - 0xa8c]
lea eax, [edi + 0xa4]
add ecx, dword [ebp - 0xab4]
cmp eax, ecx
ja 0xc4cd53
mov eax, 0xa0
push eax
push dword [ebp - 0xabc]
mov dword [edi], eax
push dword [ebp - 0xde8]
call fcn.00bc13d0
mov eax, dword [ebp - 0xa70]
add esp, 0xc
inc eax
mov dword [ebp - 0xa70], eax
jmp 0xc4ce81
mov eax, dword [ebp - 0xa70]
test esi, esi
js 0xc4f93c
mov edi, dword [ebp - 0xab4]
xor ecx, ecx
mov dword [ebp - 0xc2c], edi
mov dword [ebp - 0xaa0], ecx
test eax, eax
je 0xc4cf17
mov edx, dword [edi]
lea eax, [ebp - 0xd34]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4cece
mov eax, dword [ebp - 0xd34]
mov dword [ebp - 0xd38], eax
jmp 0xc4ced4
mov eax, dword [ebp - 0xd38]
test esi, esi
js 0xc4cf82
lea ecx, [ebp - 0xc2c]
mov edx, eax
push ecx
mov ecx, edi
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4cf82
mov eax, dword [ebp - 0xaa0]
mov edi, dword [ebp - 0xc2c]
inc eax
mov dword [ebp - 0xaa0], eax
cmp eax, dword [ebp - 0xa70]
jb 0xc4cea1
lea eax, [ebp - 0xdc8]
mov dword [ebp - 0xdcc], 8
push eax
push 4
pop eax
mov edx, eax
mov ecx, edi
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4cf82
mov ecx, dword [ebp - 0xa8c]
lea eax, [edi + 0xc]
add ecx, dword [ebp - 0xab4]
cmp eax, ecx
ja 0xc4cd53
mov edx, dword [ebp - 0xa80]
mov ecx, dword [ebp - 0xdc8]
mov dword [edi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xa70]
inc eax
mov dword [ebp - 0xa70], eax
jmp 0xc4cf88
mov eax, dword [ebp - 0xa70]
test esi, esi
js 0xc4f93c
mov ecx, dword [ebp - 0xab0]
mov edi, dword [ebp - 0xab4]
mov dword [ebp - 0xe48], ecx
mov ecx, dword [ebp - 0xa74]
mov dword [ebp - 0xe44], ecx
xor ecx, ecx
mov dword [ebp - 0xaa0], ecx
test eax, eax
je 0xc4d037
mov edx, dword [edi]
lea eax, [ebp - 0xd50]
push eax
push 4
pop eax
mov ecx, eax
mov dword [ebp - 0xabc], edi
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4cfed
mov eax, dword [ebp - 0xd50]
mov dword [ebp - 0xd5c], eax
jmp 0xc4cff3
mov eax, dword [ebp - 0xd5c]
test esi, esi
js 0xc4f93c
add eax, edi
mov ecx, edi
cmp eax, edi
jb 0xc4d007
mov edi, eax
jmp 0xc4d00a
or edi, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xa6c], esi
cmp eax, dword [ebp - 0xabc]
jb 0xc4d09e
mov eax, dword [ebp - 0xaa0]
inc eax
mov dword [ebp - 0xaa0], eax
cmp eax, dword [ebp - 0xa70]
jb 0xc4cfba
lea eax, [ebp - 0xdb8]
mov dword [ebp - 0xdbc], 8
push eax
push 4
pop eax
mov edx, eax
mov ecx, edi
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f93c
mov ecx, dword [ebp - 0xa8c]
lea eax, [edi + 0xc]
add ecx, dword [ebp - 0xab4]
cmp eax, ecx
ja 0xc4cd53
mov eax, dword [ebp - 0xdb8]
mov ecx, dword [ebp - 0xab0]
inc dword [ebp - 0xa70]
mov dword [edi], 8
mov dword [eax], ecx
mov ecx, dword [ebp - 0xa74]
mov dword [eax + 4], ecx
test esi, esi
js 0xc4f93c
lea eax, [ebp - 0xc28]
mov edx, SysReAllocString
push eax
mov ecx, 0xb3f830
call fcn.00b84ebc
test eax, eax
js 0xc4cbd0
mov ecx, dword [ebp - 0xc28]
lea eax, [ebp - 0xc28]
push eax
xor eax, eax
lea edx, [eax + 1]
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f93c
mov eax, dword [ebp - 0xc28]
add eax, eax
mov dword [ebp - 0xac0], eax
je 0xc4d213
mov edi, dword [ebp - 0xab4]
xor ecx, ecx
mov dword [ebp - 0xaa0], ecx
cmp dword [ebp - 0xa70], ecx
jbe 0xc4d1a4
mov edx, dword [edi]
lea eax, [ebp - 0xd60]
push eax
push 4
pop eax
mov ecx, eax
mov dword [ebp - 0xabc], edi
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4d14c
mov eax, dword [ebp - 0xd60]
mov dword [ebp - 0xd74], eax
jmp 0xc4d152
mov eax, dword [ebp - 0xd74]
test esi, esi
js 0xc4f93c
add eax, edi
mov ecx, edi
cmp eax, edi
jb 0xc4d166
mov edi, eax
jmp 0xc4d169
or edi, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xa6c], esi
cmp eax, dword [ebp - 0xabc]
jb 0xc4d21e
mov eax, dword [ebp - 0xaa0]
inc eax
mov dword [ebp - 0xaa0], eax
cmp eax, dword [ebp - 0xa70]
jb 0xc4d119
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0xdd4], eax
mov ecx, edi
lea eax, [ebp - 0xdd0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f93c
mov edx, dword [ebp - 0xac0]
mov eax, dword [ebp - 0xab4]
add eax, dword [ebp - 0xa8c]
mov ebx, dword [ebp - 0xaa4]
lea ecx, [edx + 4]
add ecx, edi
cmp ecx, eax
jbe 0xc4d1f5
mov esi, 0xc0000023
jmp 0xc4d218
push edx
push 0xb3f830
push dword [ebp - 0xdd0]
mov dword [edi], edx
call fcn.00bc13d0
add esp, 0xc
inc dword [ebp - 0xa70]
jmp 0xc4d21e
mov esi, 0xc000000d
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f93c
mov eax, dword [ebp - 0xa7c]
mov ecx, dword [ebp - 0xa70]
mov edi, dword [ebp - 0xab4]
mov dword [ebp - 0xe38], eax
xor eax, eax
mov dword [ebp - 0xaa0], eax
test ecx, ecx
je 0xc4d2c8
mov eax, dword [edi]
push 4
add eax, 4
mov dword [ebp - 0xabc], edi
pop esi
cmp eax, esi
jb 0xc4d260
mov edx, eax
jmp 0xc4d263
or edx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xa6c], esi
cmp eax, 4
jb 0xc4d280
mov dword [ebp - 0xd78], edx
jmp 0xc4d286
mov edx, dword [ebp - 0xd78]
cmp eax, 4
jb 0xc4d330
lea eax, [edx + edi]
mov esi, edi
cmp eax, edi
jb 0xc4d29c
mov edi, eax
jmp 0xc4d29f
or edi, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xa6c], esi
cmp eax, dword [ebp - 0xabc]
jb 0xc4d330
mov edx, dword [ebp - 0xaa0]
inc edx
mov dword [ebp - 0xaa0], edx
cmp edx, ecx
jb 0xc4d24a
push 4
pop ecx
lea eax, [ebp - 0xdc0]
mov dword [ebp - 0xdc4], ecx
mov edx, ecx
mov ecx, edi
push eax
call fcn.00b84e9a
mov edx, dword [ebp - 0xab4]
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4d328
mov ecx, dword [ebp - 0xa8c]
lea eax, [edi + 8]
add ecx, edx
cmp eax, ecx
ja 0xc4cd53
mov ecx, dword [ebp - 0xa7c]
push 4
pop eax
mov dword [edi], eax
mov eax, dword [ebp - 0xdc0]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xa70]
inc ecx
mov dword [ebp - 0xa70], ecx
jmp 0xc4d336
mov ecx, dword [ebp - 0xa70]
jmp 0xc4d336
mov edx, dword [ebp - 0xab4]
test esi, esi
js 0xc4f93c
push 4
xor eax, eax
mov edi, edx
mov dword [ebp - 0xaa0], eax
pop esi
mov dword [ebp - 0xe34], esi
test ecx, ecx
je 0xc4d3d3
mov eax, dword [edi]
add eax, 4
mov dword [ebp - 0xabc], edi
cmp eax, esi
jb 0xc4d368
mov edx, eax
jmp 0xc4d36b
or edx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xa6c], esi
cmp eax, 4
jb 0xc4d388
mov dword [ebp - 0xd7c], edx
jmp 0xc4d38e
mov edx, dword [ebp - 0xd7c]
cmp eax, 4
jb 0xc4d421
lea eax, [edi + edx]
mov esi, edi
cmp eax, edi
jb 0xc4d3a4
mov edi, eax
jmp 0xc4d3a7
or edi, 0xffffffff
cmp eax, esi
push 4
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xa6c], esi
cmp eax, dword [ebp - 0xabc]
jb 0xc4d423
mov edx, dword [ebp - 0xaa0]
inc edx
mov dword [ebp - 0xaa0], edx
pop esi
cmp edx, ecx
jb 0xc4d355
lea eax, [ebp - 0xdb0]
mov dword [ebp - 0xdb4], esi
push eax
mov edx, esi
mov ecx, edi
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4d421
mov ecx, dword [ebp - 0xa8c]
lea eax, [edi + 8]
add ecx, dword [ebp - 0xab4]
cmp eax, ecx
ja 0xc4cd53
mov eax, dword [ebp - 0xdb0]
inc dword [ebp - 0xa70]
push 4
pop ecx
mov dword [edi], ecx
mov dword [eax], ecx
jmp 0xc4d424
push 4
pop ecx
test esi, esi
js 0xc4f93c
lea eax, [ebp - 0xd80]
mov edx, ecx
push eax
call fcn.00b84e9a
mov edi, dword [ebp - 0xd80]
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
jns 0xc4d457
mov edi, dword [ebp - 0xe40]
jmp 0xc4d5ca
lea eax, [ebp - 0xcd4]
mov dword [ebp - 0xb78], edi
push eax
push 8
pop edx
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4d5ca
mov edi, dword [ebp - 0xcd4]
mov ecx, dword [ebp - 0xb78]
lea eax, [ebp - 0xb78]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4d5ca
lea eax, [ebp - 0xcd8]
push eax
push 4
pop ecx
mov edx, ecx
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4d5ca
mov edi, dword [ebp - 0xcd8]
mov ecx, dword [ebp - 0xb78]
lea eax, [ebp - 0xb78]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4d5ca
lea eax, [ebp - 0xcdc]
push eax
push 4
pop ecx
mov edx, ecx
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4d5ca
mov edi, dword [ebp - 0xcdc]
mov ecx, dword [ebp - 0xb78]
lea eax, [ebp - 0xb78]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4d5ca
lea eax, [ebp - 0xc30]
push eax
push 4
pop ecx
mov edx, ecx
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4d5ca
mov edi, dword [ebp - 0xc30]
mov ecx, dword [ebp - 0xb78]
lea eax, [ebp - 0xb78]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4d5ca
lea eax, [ebp - 0xc34]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4d5ca
mov edi, dword [ebp - 0xc34]
mov ecx, dword [ebp - 0xb78]
lea eax, [ebp - 0xb78]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0xa6c], esi
test esi, esi
jns 0xc4d5d0
mov eax, dword [ebp - 0xbfc]
mov dword [ebp - 0xa9c], eax
test esi, esi
js 0xc4f93c
xor ecx, ecx
rdtsc
mov edi, ecx
mov dword [ebp - 0xa98], ecx
mov dword [ebp - 0xae8], edi
mov dword [ebp - 0xac4], ecx
mov dword [ebp - 0xac0], ecx
mov dword [ebp - 0xa80], ecx
mov dword [ebp - 0xaec], ecx
mov dword [ebp - 0xa78], ecx
mov dword [ebp - 0xaa0], ecx
mov dword [ebp - 0xab8], ecx
mov dword [ebp - 0xb0c], ecx
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xaac], edx
push 8
pop ecx
mov dword [ebp - 0xc24], ecx
mov edx, dword [ebp - 0xa8c]
lea eax, [ebp - 0xc24]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4d74a
mov eax, dword [ebp - 0xc24]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0xa94], ecx
cmp ecx, eax
jae 0xc4d671
mov esi, 0xc0000095
jmp 0xc4d74a
mov dword [ebp - 0xc24], ecx
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc4d697
mov esi, 0xc0000017
jmp 0xc4d744
mov eax, dword [ebp - 0xa70]
mov ecx, edi
mov dword [edi], eax
lea eax, [ebp - 0xc14]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xc14], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4d72f
mov ecx, dword [ebp - 0xc14]
mov eax, dword [ebp - 0xa8c]
mov dword [ecx], eax
lea eax, [ebp - 0xc14]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4d72f
mov eax, dword [ebp - 0xa94]
push dword [ebp - 0xa8c]
mov ecx, dword [ebp - 0xabc]
push dword [ebp - 0xab4]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xaac]
push dword [ebp - 0xc14]
mov dword [edi + eax - 4], ecx
call fcn.00bc13d0
mov eax, dword [ebp - 0xa94]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xa98], edi
mov edi, ecx
mov dword [ebp - 0xae8], eax
jmp 0xc4d731
xor ecx, ecx
test edi, edi
je 0xc4d744
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xae8]
or esi, 0x10000000
mov dword [ebp - 0xa6c], esi
jl 0xc4f1f2
xor ecx, ecx
mov dword [ebp - 0xaf4], ecx
cmp dword [ebp - 0xa98], ecx
jne 0xc4d776
mov esi, 0xc000000d
jmp 0xc4de7b
test edi, edi
je 0xc4de76
lea eax, [edi + 8]
push eax
push ecx
mov dword [ebp - 0xa90], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xa94], esi
test esi, esi
je 0xc4de76
xor eax, eax
mov dl, al
mov ecx, eax
test edi, edi
je 0xc4d7c4
mov ebx, dword [ebp - 0xa98]
xor dl, byte [ecx + ebx]
inc ecx
cmp ecx, edi
jb 0xc4d7b6
mov ebx, dword [ebp - 0xaa4]
mov eax, dword [ebp - 0xa98]
or ecx, 0xffffffff
mov dword [ebp - 0xad8], eax
xor eax, eax
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0xb18], eax
xor eax, eax
mov dword [ebp - 0x3f0], 0xb1b54a58
mov dword [ebp - 0x3ec], 0xc81ecb17
mov dword [ebp - 0xae0], esi
mov dword [ebp - 0xb1c], ecx
mov dword [ebp - 0xaf8], eax
mov dword [ebp - 0xa6c], eax
je 0xc4d8f5
mov ecx, eax
mov dword [ebp - 0xa6c], eax
xor esi, esi
mov dword [ebp - 0xaf8], ecx
mov edi, esi
jbe 0xc4d880
mov ebx, dword [ebp - 0xad8]
push 0x38
pop esi
push 4
pop eax
cmp edi, eax
movzx eax, byte [ebx]
jge 0xc4d84f
lea ecx, [esi - 0x20]
shl eax, cl
or dword [ebp - 0xa6c], eax
mov ecx, dword [ebp - 0xaf8]
jmp 0xc4d861
mov ecx, esi
shl eax, cl
mov ecx, dword [ebp - 0xaf8]
or ecx, eax
mov dword [ebp - 0xaf8], ecx
inc edi
sub esi, 8
xor eax, eax
inc ebx
cmp edi, eax
jl 0xc4d832
mov eax, dword [ebp - 0xa6c]
xor esi, esi
mov dword [ebp - 0xad8], ebx
mov ebx, dword [ebp - 0xaa4]
xor eax, 0xb17a307a
xor ecx, 0x42f6b18d
xor edi, edi
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0xb18], eax
jbe 0xc4d8ca
mov edi, dword [ebp - 0xae0]
cmp esi, 4
jge 0xc4d8ad
rol eax, 8
mov byte [edi], al
jmp 0xc4d8b2
rol ecx, 8
mov byte [edi], cl
inc edi
add esi, 1
js 0xc4d8a1
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0xae0], edi
mov dword [ebp - 0xaa8], eax
push 0xfffffffffffffffc
xor eax, eax
pop esi
mov ecx, eax
mov dword [ebp - 0xb1c], ecx
test esi, esi
jg 0xc4d8e9
jns 0xc4d8e9
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0xb18], eax
mov edi, dword [ebp - 0xae8]
mov esi, dword [ebp - 0xae0]
mov eax, edi
shr eax, 3
mov dword [ebp - 0xaac], eax
test eax, eax
je 0xc4dc95
mov edi, dword [ebp - 0xad8]
add esi, 7
mov ebx, dword [ebp - 0xaa8]
add edi, 2
mov dword [ebp - 0xac8], esi
mov dword [ebp - 0xae0], edi
movzx esi, byte [edi - 2]
movzx eax, byte [edi - 1]
shl esi, 8
or esi, eax
movzx eax, byte [edi]
shl esi, 8
or esi, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl esi, 8
or esi, eax
shl edi, 8
mov eax, dword [ebp - 0xae0]
mov dword [ebp - 0xad8], esi
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xae0]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xae0]
shl edi, 8
add dword [ebp - 0xae0], 8
movzx eax, byte [eax + 5]
or edi, eax
xor ecx, edi
mov dword [ebp - 0xabc], ecx
add ecx, 0xffffb5a8
xor ecx, esi
xor ecx, ebx
mov ebx, 0xc81ecb17
xor ecx, ebx
mov eax, ecx
mov dword [ebp - 0xaa8], ecx
xor eax, ebx
mov esi, dword [ebp - 0xaa8]
mov ebx, dword [ebp - 0xabc]
ror eax, 0xf
imul eax, eax, 0xb1b5
ror ecx, 7
add ecx, eax
xor ebx, ecx
mov ecx, ebx
ror ecx, 0xa
lea eax, [ebx - 0x4e4ab5a8]
ror eax, 9
imul eax, eax, 0xcb17
sub eax, ecx
xor esi, eax
mov eax, esi
mov ecx, esi
xor eax, 0xcb17
rol ecx, 5
rol eax, 4
imul eax, eax, 0xc81e
add ecx, eax
mov eax, 0xc81ecb17
xor ebx, ecx
mov ecx, ebx
xor ecx, 0xb1b54a58
sub eax, ecx
xor esi, eax
imul ecx, esi, 0xb1b5
mov eax, esi
shr eax, 6
mov dword [ebp - 0xaa8], esi
sub ecx, eax
sub ecx, 0x339b6838
xor ebx, ecx
mov ecx, esi
mov eax, ebx
ror eax, 0xf
xor eax, 0xcb17
imul eax, eax, 0x4a58
xor ecx, eax
mov eax, ecx
not eax
ror eax, 3
add eax, 0xc81e
imul eax, eax, 0xcb17
xor ebx, eax
lea eax, [ebx + 0x37e0ea91]
xor ecx, eax
mov dword [ebp - 0xaa8], ecx
mov esi, dword [ebp - 0xaa8]
mov eax, esi
xor eax, 0xc81e
ror ecx, 0xa
imul eax, eax, 0xb1b5
xor ecx, eax
xor ebx, ecx
mov eax, ebx
mov ecx, ebx
xor eax, 0x4a58
ror ecx, 3
rol eax, 6
imul eax, eax, 0xcb17
xor ecx, eax
xor esi, ecx
mov ecx, 0xc81e
mov eax, esi
ror eax, 0xf
sub eax, ecx
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
xor eax, ecx
imul ecx, eax, 0x4a58
mov eax, ebx
shr eax, 1
xor ecx, eax
lea eax, [ebx - 0xcb17]
rol eax, 3
xor esi, ecx
imul ecx, eax, 0x4a58
mov eax, ebx
shr eax, 0xf
xor ecx, eax
xor esi, ecx
imul ecx, esi, 0xb1b5
mov eax, esi
shr eax, 0xd
sub ecx, eax
mov eax, 0xb1b54a58
add ecx, 0x730581bd
xor ebx, ecx
sub eax, ebx
mov ecx, ebx
ror eax, 9
imul eax, eax, 0xcb17
ror ecx, 0xb
xor ecx, eax
xor esi, ecx
lea eax, [esi + 0x4e49ed8a]
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0xb1b5
ror ecx, 7
imul eax, eax, 0x4a58
sub eax, ecx
xor esi, eax
mov eax, esi
mov ecx, esi
xor eax, 0xc81e
ror ecx, 0x10
rol eax, 4
imul eax, eax, 0xb1b5
sub eax, ecx
xor ebx, eax
mov eax, 0xb1b54a58
sub eax, ebx
mov ecx, ebx
ror eax, 0xa
imul eax, eax, 0xcb17
ror ecx, 4
add ecx, eax
xor esi, ecx
mov ecx, esi
lea eax, [esi + 0x4e4ab5a8]
ror eax, 4
ror ecx, 9
imul eax, eax, 0xc81e
xor ecx, eax
xor ebx, ecx
mov eax, ebx
mov ecx, ebx
xor eax, 0xc81ecb17
rol ecx, 2
rol eax, 8
imul eax, eax, 0x4a58
sub eax, ecx
xor esi, eax
mov eax, 0xc81ecb17
sub eax, esi
mov ecx, esi
ror eax, 0xb
imul eax, eax, 0xb1b5
ror ecx, 0xc
sub eax, ecx
xor ebx, eax
mov eax, ebx
xor eax, 0xb1b5
imul ecx, eax, 0xcb17
mov eax, ebx
shr eax, 8
xor ecx, eax
xor esi, ecx
mov ecx, esi
mov dword [ebp - 0xaa8], esi
mov esi, dword [ebp - 0xac8]
mov eax, ecx
xor eax, dword [ebp - 0xaf8]
xor ecx, dword [ebp - 0xa6c]
xor eax, ebx
xor eax, 0x79ab814f
mov dword [ebp - 0xb18], ecx
mov dword [ebp - 0xb1c], eax
mov byte [esi - 4], cl
mov al, byte [ebp - 0xb1c]
ror dword [ebp - 0xb18], 8
mov byte [esi], al
mov al, byte [ebp - 0xb18]
ror dword [ebp - 0xb1c], 8
mov byte [esi - 5], al
mov al, byte [ebp - 0xb1c]
ror dword [ebp - 0xb18], 8
mov byte [esi - 1], al
mov al, byte [ebp - 0xb18]
ror dword [ebp - 0xb1c], 8
mov byte [esi - 6], al
mov al, byte [ebp - 0xb1c]
ror dword [ebp - 0xb18], 8
mov byte [esi - 2], al
ror dword [ebp - 0xb1c], 8
mov al, byte [ebp - 0xb18]
mov byte [esi - 7], al
mov al, byte [ebp - 0xb1c]
mov byte [esi - 3], al
add esi, 8
mov ebx, dword [ebp - 0xb18]
mov ecx, dword [ebp - 0xb1c]
mov eax, dword [ebp - 0xad8]
ror ebx, 8
ror ecx, 8
sub dword [ebp - 0xaac], 1
mov dword [ebp - 0xaf8], edi
mov edi, dword [ebp - 0xae0]
mov dword [ebp - 0xb18], ebx
mov dword [ebp - 0xb1c], ecx
mov dword [ebp - 0xa6c], eax
mov dword [ebp - 0xac8], esi
jne 0xc4d926
mov ebx, dword [ebp - 0xaa4]
mov edi, dword [ebp - 0xae8]
mov ecx, dword [ebp - 0xa94]
movzx eax, dl
cdq
mov dword [ecx + edi], eax
mov dword [ecx + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc4dcc7
mov esi, 0xc0000017
jmp 0xc4ddda
mov esi, dword [ebp - 0xa90]
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc4dcef
mov esi, 0xc0000017
xor edx, edx
jmp 0xc4dd73
mov dword [edi + 4], eax
push esi
push dword [ebp - 0xa94]
push eax
call fcn.00bc13d0
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc4dce3
mov dword [edi + 0xc], eax
push 0xa0
push 0xd08ca8
push eax
call fcn.00bc13d0
add esp, 0xc
mov dword [edi + 0x10], esi
push esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
xor edx, edx
test eax, eax
jne 0xc4dd55
mov esi, 0xc0000017
jmp 0xc4dd73
mov ecx, eax
mov dword [edi + 0x14], eax
mov eax, dword [0xd08d48]
mov esi, edx
mov dword [ebp - 0xaf4], edi
mov edi, edx
mov dword [ecx], eax
mov eax, dword [0xd08d4c]
mov dword [ecx + 4], eax
test edi, edi
je 0xc4ddda
cmp dword [edi + 4], 0
je 0xc4dd93
push dword [edi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 4], edx
cmp dword [edi + 0xc], 0
je 0xc4ddaf
push dword [edi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0xc], edx
cmp dword [edi + 0x14], 0
je 0xc4ddcb
push dword [edi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0x14], edx
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc4ddf0
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0xac4], eax
xor eax, eax
mov edi, eax
jmp 0xc4ddf8
mov edi, dword [ebp - 0xaf4]
xor eax, eax
push dword [ebp - 0xa94]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xc4de7b
xor eax, eax
cmp dword [edi + 4], eax
je 0xc4de2d
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc4de49
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc4de65
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc4de7b
mov esi, 0xc0000001
mov edi, 0x10000000
or esi, edi
mov dword [ebp - 0xa6c], esi
jl 0xc4f1f2
mov edi, dword [ebp - 0xac4]
lea eax, [ebp - 0xb9c]
push 4
pop ecx
push eax
mov edx, dword [edi]
mov dword [ebp - 0xb9c], ecx
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4df24
lea eax, [ebp - 0xb9c]
mov edx, ecx
mov ecx, dword [ebp - 0xb9c]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4df24
mov edx, dword [edi + 8]
lea eax, [ebp - 0xb9c]
mov ecx, dword [ebp - 0xb9c]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4df24
mov ecx, dword [ebp - 0xb9c]
lea eax, [ebp - 0xb9c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4df24
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0xb9c]
mov ecx, dword [ebp - 0xb9c]
push eax
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xb9c]
test esi, esi
jns 0xc4df2a
mov eax, dword [ebp - 0xe4c]
mov dword [ebp - 0xaac], eax
test esi, esi
js 0xc4e0a7
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc4df58
mov esi, 0xc0000017
jmp 0xc4e0a7
mov eax, dword [ebp - 0xac4]
mov ecx, edi
mov dword [ebp - 0xad0], edi
mov eax, dword [eax]
mov dword [edi], eax
lea eax, [ebp - 0xad0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4e092
mov esi, dword [ebp - 0xac4]
push dword [esi]
push dword [esi + 4]
push dword [ebp - 0xad0]
call fcn.00bc13d0
mov edx, dword [esi]
lea eax, [ebp - 0xad0]
mov ecx, dword [ebp - 0xad0]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4e092
mov eax, dword [ebp - 0xac4]
mov ecx, dword [ebp - 0xad0]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xad0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4e092
mov esi, dword [ebp - 0xac4]
push dword [esi + 8]
push dword [esi + 0xc]
push dword [ebp - 0xad0]
call fcn.00bc13d0
mov edx, dword [esi + 8]
lea eax, [ebp - 0xad0]
mov ecx, dword [ebp - 0xad0]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4e092
mov eax, dword [ebp - 0xac4]
mov ecx, dword [ebp - 0xad0]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xad0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4e092
mov esi, dword [ebp - 0xac4]
push dword [esi + 0x10]
push dword [esi + 0x14]
push dword [ebp - 0xad0]
call fcn.00bc13d0
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0xad0]
mov ecx, dword [ebp - 0xad0]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
xor ecx, ecx
test esi, esi
js 0xc4e094
mov eax, dword [ebp - 0xaac]
mov dword [ebp - 0xac0], edi
mov edi, ecx
mov dword [ebp - 0xa80], eax
jmp 0xc4e094
xor ecx, ecx
test edi, edi
je 0xc4e0a7
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, 0x10000000
or esi, edi
mov dword [ebp - 0xa6c], esi
jl 0xc4f1f2
xor eax, eax
mov dword [ebp - 0xc5c], 8
mov dword [ebp - 0xaac], eax
mov dword [ebp - 0xac8], eax
mov edx, dword [ebp - 0xa9c]
lea eax, [ebp - 0xc5c]
push eax
push 8
pop ecx
call fcn.00b84e9a
mov esi, eax
or esi, edi
mov dword [ebp - 0xa6c], esi
jl 0xc4e15f
mov eax, dword [ebp - 0xc5c]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xc4e110
mov esi, 0xc0000095
mov dword [ebp - 0xa6c], esi
jmp 0xc4e137
mov dword [ebp - 0xc90], ecx
lea eax, [ebp - 0xc90]
push eax
push 8
pop edx
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xc90]
mov dword [ebp - 0xa6c], esi
test esi, esi
jns 0xc4e13d
mov eax, dword [ebp - 0xcec]
mov dword [ebp - 0xa94], eax
test esi, esi
js 0xc4e15f
mov edi, dword [ebp - 0xa70]
xor eax, eax
inc eax
cmp edi, eax
ja 0xc4e195
mov esi, 0xc000000d
mov dword [ebp - 0xa6c], esi
mov edi, dword [ebp - 0xa78]
test esi, esi
js 0xc4f1f2
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc4e3d7
mov ecx, dword [ebp - 0xaec]
mov esi, 0xd0000017
jmp 0xc4e3e4
mov ecx, dword [ebp - 0xab4]
xor eax, eax
mov dword [ebp - 0xbb8], ecx
mov dword [ebp - 0xa9c], eax
mov eax, dword [ecx]
mov dword [ebp - 0xa90], eax
lea eax, [ebp - 0xbb8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4e15f
mov edx, dword [ebp - 0xa90]
lea eax, [ebp - 0xbb8]
mov ecx, dword [ebp - 0xbb8]
push eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4e15f
mov eax, dword [ebp - 0xa9c]
mov ecx, dword [ebp - 0xbb8]
inc eax
mov dword [ebp - 0xa9c], eax
cmp eax, 1
jb 0xc4e1a9
mov edi, dword [ecx]
lea eax, [ebp - 0xbb8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4e23d
mov dword [ebp - 0xaac], edi
neg edi
sbb edi, edi
and dword [ebp - 0xbb8], edi
mov edi, dword [ebp - 0xa70]
test esi, esi
js 0xc4e15f
cmp edi, 2
jbe 0xc4e154
mov ecx, dword [ebp - 0xab4]
xor eax, eax
mov dword [ebp - 0xbb4], ecx
mov edi, eax
lea eax, [ebp - 0xbb4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4e15f
mov edx, dword [ecx]
lea eax, [ebp - 0xbb4]
mov ecx, dword [ebp - 0xbb4]
push eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4e15f
mov ecx, dword [ebp - 0xbb4]
inc edi
cmp edi, 2
jb 0xc4e264
mov edi, dword [ecx]
lea eax, [ebp - 0xbb4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4e15f
mov dword [ebp - 0xac8], edi
neg edi
sbb edi, edi
and dword [ebp - 0xbb4], edi
test esi, esi
js 0xc4e15f
mov edx, dword [ebp - 0xa94]
lea eax, [ebp - 0xb98]
push 4
pop edi
push eax
mov ecx, edi
mov dword [ebp - 0xb98], edi
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4e3ab
mov ecx, dword [ebp - 0xb98]
lea eax, [ebp - 0xb98]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4e3ab
mov edx, dword [ebp - 0xaac]
lea eax, [ebp - 0xb98]
mov ecx, dword [ebp - 0xb98]
push eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4e3ab
mov ecx, dword [ebp - 0xb98]
lea eax, [ebp - 0xb98]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4e3ab
mov edx, dword [ebp - 0xac8]
lea eax, [ebp - 0xb98]
mov ecx, dword [ebp - 0xb98]
push eax
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xb98]
mov dword [ebp - 0xa6c], esi
test esi, esi
jns 0xc4e3b9
mov eax, dword [ebp - 0xe50]
test esi, esi
js 0xc4e15f
cmp eax, 0x400000
jbe 0xc4e3ca
mov esi, 0x8000ffff
jmp 0xc4f1ec
mov edi, eax
mov dword [ebp - 0xa78], edi
jmp 0xc4e165
mov ecx, eax
mov dword [ebp - 0xaec], eax
mov esi, 0x10000000
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f1f2
mov eax, dword [ebp - 0xac0]
test eax, eax
jne 0xc4e406
mov esi, 0x80070057
jmp 0xc4f1ec
test ecx, ecx
je 0xc4e3fc
mov dword [ebp - 0xe00], eax
mov eax, dword [ebp - 0xa80]
mov dword [ebp - 0xdf8], eax
xor eax, eax
mov dword [ebp - 0xdf0], eax
lea eax, [ebp - 0xcf0]
push eax
xor eax, eax
mov dword [ebp - 0xdfc], ecx
push 0xb2be98
inc eax
mov dword [ebp - 0xdf4], edi
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xc4e47c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
jle 0xc4e46d
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4e4ca
mov esi, 0x80004005
mov dword [ebp - 0xa6c], esi
jmp 0xc4e4ca
push 0xb2be7c
push dword [ebp - 0xcf0]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xc4e44a
xor eax, eax
mov ecx, esi
push eax
push 0x14
lea eax, [ebp - 0xe00]
push eax
push 0x86
call dword [0xd0cffc]
call esi
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xa6c], esi
jl 0xc4e4ca
mov edi, dword [ebp - 0xdf4]
mov dword [ebp - 0xa78], edi
cmp esi, 0xd0000023
jne 0xc4e4dc
mov esi, 0x8007007a
jmp 0xc4f1ec
test esi, esi
js 0xc4f1f2
mov eax, dword [ebp - 0xaec]
xor edx, edx
push 4
pop esi
mov dword [ebp - 0xaf4], edx
mov dword [ebp - 0xb04], edx
mov dword [ebp - 0xae4], eax
cmp edi, esi
jae 0xc4e50f
mov esi, 0xc000003e
jmp 0xc4e909
mov edi, dword [eax]
lea ecx, [ebp - 0xae4]
push ecx
mov edx, esi
mov dword [ebp - 0xa90], edi
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4e907
lea eax, [ebp - 0xb04]
xor ecx, ecx
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4e907
mov eax, dword [ebp - 0xa78]
sub eax, dword [ebp - 0xb04]
cmp eax, edi
jae 0xc4e568
mov esi, 0xc000003e
jmp 0xc4e907
mov eax, dword [ebp - 0xae4]
lea ecx, [ebp - 0xae4]
push ecx
mov edx, edi
mov dword [ebp - 0xa80], eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4e907
mov ecx, dword [ebp - 0xb04]
lea eax, [ebp - 0xb04]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4e907
mov eax, dword [ebp - 0xa78]
sub eax, dword [ebp - 0xb04]
push 4
pop edx
cmp eax, edx
jb 0xc4e55e
mov ecx, dword [ebp - 0xae4]
lea eax, [ebp - 0xae4]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0xabc], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4e907
mov ecx, dword [ebp - 0xb04]
lea eax, [ebp - 0xb04]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4e907
mov eax, dword [ebp - 0xa78]
sub eax, dword [ebp - 0xb04]
cmp eax, edi
jb 0xc4e55e
mov eax, dword [ebp - 0xae4]
lea ecx, [ebp - 0xae4]
push ecx
mov edx, edi
mov dword [ebp - 0xa9c], eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4e907
mov ecx, dword [ebp - 0xb04]
lea eax, [ebp - 0xb04]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4e907
mov eax, dword [ebp - 0xa78]
sub eax, dword [ebp - 0xb04]
push 4
pop edx
cmp eax, edx
jb 0xc4e55e
mov ecx, dword [ebp - 0xae4]
mov eax, dword [ecx]
mov dword [ebp - 0xa94], eax
lea eax, [ebp - 0xae4]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4e907
mov ecx, dword [ebp - 0xb04]
lea eax, [ebp - 0xb04]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4e907
mov eax, dword [ebp - 0xa78]
sub eax, dword [ebp - 0xb04]
mov ecx, dword [ebp - 0xa94]
cmp eax, ecx
jb 0xc4e55e
lea eax, [ebp - 0xb04]
mov edx, ecx
mov ecx, dword [ebp - 0xb04]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4e907
mov ecx, dword [ebp - 0xa78]
mov eax, ecx
sub eax, dword [ebp - 0xb04]
jne 0xc4e55e
mov eax, dword [ebp - 0xa94]
mov esi, dword [ebp - 0xa90]
add eax, 0xc
add eax, edi
add eax, esi
cmp eax, ecx
jne 0xc4e55e
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc4e740
mov esi, 0xc0000017
jmp 0xc4e884
cmp dword [ebp - 0xa80], 0
je 0xc4e782
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc4e76b
mov esi, 0xc0000017
xor eax, eax
jmp 0xc4e81d
mov dword [edi + 4], eax
push esi
push dword [ebp - 0xa80]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc4e789
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
cmp dword [ebp - 0xa9c], 0
je 0xc4e7c6
mov esi, dword [ebp - 0xabc]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc4e75f
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xa9c]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc4e7cc
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
cmp dword [ebp - 0xae4], 0
je 0xc4e80d
mov esi, dword [ebp - 0xa94]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc4e75f
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xae4]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc4e813
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [ebp - 0xaf4], edi
mov esi, eax
mov edi, eax
test edi, edi
je 0xc4e884
cmp dword [edi + 4], 0
je 0xc4e83d
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc4e859
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc4e875
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
test esi, esi
js 0xc4e89a
mov eax, dword [ebp - 0xaf4]
mov edi, edx
mov dword [ebp - 0xaa0], eax
jmp 0xc4e8a0
mov edi, dword [ebp - 0xaf4]
test edi, edi
je 0xc4e909
cmp dword [edi + 4], 0
je 0xc4e8c0
push dword [edi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 4], edx
cmp dword [edi + 0xc], 0
je 0xc4e8dc
push dword [edi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0xc], edx
cmp dword [edi + 0x14], 0
je 0xc4e8f8
push dword [edi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0x14], edx
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
or esi, 0x10000000
mov dword [ebp - 0xa6c], esi
jl 0xc4f1f2
mov ecx, dword [ebp - 0xaa0]
mov edi, edx
mov dword [ebp - 0xad8], edi
mov dword [ebp - 0xab4], edx
test ecx, ecx
jne 0xc4e943
mov esi, 0xd000000d
mov dword [ebp - 0xa6c], esi
jmp 0xc4ef68
mov eax, dword [ecx + 4]
mov dword [ebp - 0xa78], eax
test eax, eax
je 0xc4e933
mov esi, dword [ecx]
test esi, esi
je 0xc4e933
add esi, 0xfffffff8
mov dword [ebp - 0xa70], edx
push esi
push edx
mov dword [ebp - 0xaac], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xac8], eax
test eax, eax
je 0xc4ef46
xor ecx, ecx
mov dword [ebp - 0x400], 0xab69605e
mov dword [ebp - 0x3fc], 0x7f1137f
mov dl, cl
mov ecx, dword [ebp - 0xa78]
mov dword [ebp - 0xa94], ecx
mov ecx, eax
mov dword [ebp - 0xaa8], ecx
and esi, 7
je 0xc4eed7
or dword [ebp - 0xb00], 0xffffffff
xor eax, eax
mov dword [ebp - 0xb10], eax
mov ecx, eax
mov dword [ebp - 0xaf8], ecx
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xa80], eax
test esi, esi
je 0xc4ea37
mov ebx, dword [ebp - 0xa94]
push 0x38
pop edi
push 4
pop ecx
cmp eax, ecx
movzx eax, byte [ebx]
jge 0xc4ea04
lea ecx, [edi - 0x20]
shl eax, cl
or dword [ebp - 0xae0], eax
mov ecx, dword [ebp - 0xaf8]
jmp 0xc4ea16
mov ecx, edi
shl eax, cl
mov ecx, dword [ebp - 0xaf8]
or ecx, eax
mov dword [ebp - 0xaf8], ecx
mov eax, dword [ebp - 0xa80]
sub edi, 8
inc eax
inc ebx
mov dword [ebp - 0xa80], eax
cmp eax, esi
jl 0xc4e9e7
mov dword [ebp - 0xa94], ebx
mov ebx, dword [ebp - 0xaa4]
mov eax, dword [ebp - 0xae0]
xor ecx, 0x699a899c
xor eax, 0x92f65a5
mov dword [ebp - 0xaf4], ecx
xor edi, edi
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xb10], eax
mov dword [ebp - 0xb00], ecx
test esi, esi
je 0xc4eaa3
mov ebx, dword [ebp - 0xaa8]
cmp edi, 4
jge 0xc4ea78
rol eax, 8
mov byte [ebx], al
jmp 0xc4ea7d
rol ecx, 8
mov byte [ebx], cl
inc edi
inc ebx
cmp edi, esi
jl 0xc4ea6c
mov eax, dword [ebp - 0xb10]
mov edi, dword [ebp - 0xb00]
mov dword [ebp - 0xaa8], ebx
mov ebx, dword [ebp - 0xaa4]
mov dword [ebp - 0xae8], eax
jmp 0xc4eaa9
mov edi, dword [ebp - 0xaf4]
add esi, 0xfffffffc
test esi, esi
jle 0xc4eea9
push 4
pop eax
mov ecx, eax
sub ecx, esi
shl ecx, 3
shr edi, cl
shl edi, cl
mov dword [ebp - 0xb00], edi
mov ecx, dword [ebp - 0xaa8]
mov esi, dword [ebp - 0xaac]
mov eax, esi
shr eax, 3
mov dword [ebp - 0xa9c], eax
test eax, eax
je 0xc4ee66
mov ebx, dword [ebp - 0xae8]
add ecx, 7
mov dword [ebp - 0xa80], ecx
mov ecx, dword [ebp - 0xa94]
add ecx, 2
mov dword [ebp - 0xaa8], ecx
movzx esi, byte [ecx - 2]
movzx eax, byte [ecx - 1]
shl esi, 8
or esi, eax
movzx eax, byte [ecx]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 1]
movzx ecx, byte [ecx + 2]
shl ecx, 8
shl esi, 8
or esi, eax
mov eax, dword [ebp - 0xaa8]
xor ebx, esi
mov dword [ebp - 0xa90], esi
mov esi, 0xab69605e
movzx eax, byte [eax + 3]
or ecx, eax
mov eax, dword [ebp - 0xaa8]
shl ecx, 8
movzx eax, byte [eax + 4]
or ecx, eax
mov eax, dword [ebp - 0xaa8]
shl ecx, 8
add dword [ebp - 0xaa8], 8
movzx eax, byte [eax + 5]
or ecx, eax
xor edi, ecx
mov dword [ebp - 0xabc], ecx
xor edi, ebx
xor edi, 0xac987321
mov ecx, edi
rol ecx, 0xa
lea eax, [edi + 0x54969fa2]
rol eax, 5
imul eax, eax, 0x137f
add ecx, eax
xor ebx, ecx
mov ecx, ebx
rol ecx, 2
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul eax, eax, 0xab69
sub eax, ecx
xor edi, eax
imul ecx, edi, 0x605e
mov eax, edi
shr eax, 0xd
sub ecx, eax
sub ecx, 0x756c8a2
xor ebx, ecx
mov eax, ebx
mov ecx, ebx
xor eax, 0xab69
rol ecx, 2
rol eax, 6
imul eax, eax, 0x7f1
sub eax, ecx
xor edi, eax
mov eax, 0x7f1137f
mov ecx, edi
xor ecx, esi
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0x137f
ror ecx, 6
imul eax, eax, 0xab69
xor ecx, eax
xor edi, ecx
mov ecx, edi
rol ecx, 2
lea eax, [edi + 0x7f1137f]
ror eax, 0xf
imul eax, eax, 0x605e
add ecx, eax
xor ebx, ecx
mov ecx, ebx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul eax, eax, 0x7f1
rol ecx, 8
sub eax, ecx
xor edi, eax
mov eax, edi
mov ecx, edi
xor eax, esi
ror ecx, 0xa
ror eax, 0xc
imul eax, eax, 0x137f
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x7f1
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor ecx, eax
xor edi, ecx
mov eax, edi
mov dword [ebp - 0xaf4], edi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea edi, [ebx - 0x7f1]
xor edi, dword [ebp - 0xaf4]
xor edi, esi
mov esi, 0xab69
mov eax, edi
mov ecx, edi
xor eax, 0x7f1
shr ecx, 2
rol eax, 2
imul eax, eax, 0x137f
add ecx, eax
xor ebx, ecx
mov ecx, ebx
rol ecx, 7
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul eax, eax, 0xab69
add ecx, eax
xor edi, ecx
mov eax, edi
mov ecx, edi
xor eax, 0x137f
ror ecx, 9
imul eax, eax, 0x605e
add ecx, eax
xor ebx, ecx
mov eax, ebx
mov ecx, ebx
xor eax, esi
rol ecx, 7
rol eax, 5
imul eax, eax, 0x7f1
add ecx, eax
xor edi, ecx
mov eax, edi
xor eax, ebx
xor eax, 0xac987321
mov dword [ebp - 0xa94], eax
ror eax, 3
sub eax, esi
mov esi, dword [ebp - 0xa94]
imul eax, eax, 0x137f
xor edi, eax
mov ecx, edi
ror ecx, 6
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul eax, eax, 0x605e
sub eax, ecx
xor esi, eax
mov ecx, esi
rol ecx, 0xe
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul eax, eax, 0x7f1
add ecx, eax
xor edi, ecx
mov ecx, edi
ror ecx, 0xe
lea eax, [edi - 0x54969fa2]
rol eax, 0xf
imul eax, eax, 0x137f
sub eax, ecx
xor esi, eax
mov eax, esi
mov dword [ebp - 0xa94], esi
xor eax, 0x605e
imul ecx, eax, 0xab69
mov eax, esi
shr eax, 3
xor ecx, eax
xor edi, ecx
mov eax, edi
mov ecx, edi
xor edi, dword [ebp - 0xaf8]
xor eax, 0x7f1137f
rol eax, 4
imul eax, eax, 0x605e
rol ecx, 2
mov dword [ebp - 0xb00], edi
xor ecx, eax
mov eax, esi
xor ecx, dword [ebp - 0xae0]
xor eax, ecx
mov ecx, dword [ebp - 0xa80]
mov dword [ebp - 0xb10], eax
mov byte [ecx - 4], al
mov al, byte [ebp - 0xb00]
ror dword [ebp - 0xb10], 8
mov byte [ecx], al
mov al, byte [ebp - 0xb10]
ror dword [ebp - 0xb00], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb00]
ror dword [ebp - 0xb10], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xb10]
ror dword [ebp - 0xb00], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xb00]
ror dword [ebp - 0xb10], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xb00], 8
mov al, byte [ebp - 0xb10]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb00]
mov byte [ecx - 3], al
add ecx, 8
mov ebx, dword [ebp - 0xb10]
mov edi, dword [ebp - 0xb00]
mov eax, dword [ebp - 0xa90]
ror ebx, 8
ror edi, 8
sub dword [ebp - 0xa9c], 1
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0xa80], ecx
mov ecx, dword [ebp - 0xaa8]
mov dword [ebp - 0xb10], ebx
mov dword [ebp - 0xb00], edi
mov dword [ebp - 0xaf8], eax
jne 0xc4eb05
mov ebx, dword [ebp - 0xaa4]
mov esi, dword [ebp - 0xaac]
mov edi, dword [ebp - 0xac8]
xor eax, eax
mov ecx, eax
test esi, esi
je 0xc4ee7c
xor dl, byte [ecx + edi]
inc ecx
cmp ecx, esi
jb 0xc4ee74
mov ecx, dword [ebp - 0xa78]
movzx eax, dl
cdq
cmp eax, dword [esi + ecx]
jne 0xc4eeff
cmp edx, dword [esi + ecx + 4]
jne 0xc4eeff
xor eax, eax
mov dword [ebp - 0xad8], edi
mov dword [ebp - 0xab4], esi
mov edi, eax
mov esi, dword [ebp - 0xa70]
jmp 0xc4ef06
xor ecx, ecx
mov edi, ecx
mov dword [ebp - 0xb00], edi
test esi, esi
jns 0xc4eac8
neg esi
shl esi, 3
mov ecx, esi
shr eax, cl
shl eax, cl
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xb10], eax
jmp 0xc4eac8
xor eax, eax
or dword [ebp - 0xaf8], 0xffffffff
mov edi, eax
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xb00], edi
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xb10], eax
jmp 0xc4eace
mov esi, 0xc004d501
xor eax, eax
test edi, edi
je 0xc4ef19
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc4ef40
mov esi, dword [ebp - 0xad8]
xor edx, edx
mov eax, dword [ebp - 0xab4]
mov edi, edx
mov dword [ebp - 0xab8], esi
mov esi, 0x10000000
mov dword [ebp - 0xb0c], eax
jmp 0xc4ef4d
mov edi, dword [ebp - 0xad8]
mov esi, 0xd0000001
xor edx, edx
mov dword [ebp - 0xa6c], esi
test edi, edi
je 0xc4ef68
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
test esi, esi
js 0xc4f1f2
mov edi, dword [ebp - 0xb0c]
mov ecx, dword [ebp - 0xab8]
push 4
mov dword [ebp - 0xb74], edx
pop edx
mov dword [ebp - 0xb48], ecx
cmp edi, edx
jb 0xc4f1e1
mov eax, dword [ecx]
mov dword [ebp - 0xa90], eax
lea eax, [ebp - 0xb48]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4f1e6
lea eax, [ebp - 0xb74]
xor ecx, ecx
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4f1e6
mov eax, edi
sub eax, dword [ebp - 0xb74]
push 4
pop edx
cmp eax, edx
jb 0xc4f1e1
mov ecx, dword [ebp - 0xb48]
lea eax, [ebp - 0xb48]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0xa80], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4f1e6
mov ecx, dword [ebp - 0xb74]
lea eax, [ebp - 0xb74]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4f1e6
mov eax, dword [ebp - 0xb0c]
mov ecx, dword [ebp - 0xb74]
sub eax, ecx
cmp eax, edi
jb 0xc4f1e1
lea eax, [ebp - 0xb74]
mov edx, edi
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4f1e6
mov edx, dword [ebp - 0xb0c]
mov esi, dword [ebp - 0xab8]
mov ecx, dword [ebp - 0xb48]
add ecx, edi
lea eax, [edx + esi]
cmp eax, ecx
jb 0xc4f1e1
mov ecx, dword [ebp - 0xb48]
sub edx, ecx
sub edx, edi
add edx, esi
cmp edx, 8
jae 0xc4f1e1
xor edx, edx
mov dword [ebp - 0xaf4], edx
mov eax, edx
mov dword [ebp - 0xa94], eax
mov esi, edx
test ecx, ecx
je 0xc4f16b
mov edx, dword [ebp - 0xa80]
lea eax, [ebp - 0xb80]
push eax
mov edi, ecx
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc4f1e6
cmp ecx, dword [ebp - 0xb80]
jae 0xc4f157
lea eax, [edi + 4]
cmp eax, edi
jb 0xc4f197
cmp eax, dword [ebp - 0xb80]
ja 0xc4f190
mov eax, dword [edi]
push 4
add eax, 4
pop esi
cmp eax, esi
jb 0xc4f0f3
mov edx, eax
jmp 0xc4f0f6
or edx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
cmp eax, 4
jb 0xc4f10d
mov dword [ebp - 0xcf4], edx
jmp 0xc4f113
mov edx, dword [ebp - 0xcf4]
cmp eax, 4
jb 0xc4f1cf
add edx, edi
cmp edx, edi
jb 0xc4f126
mov eax, edx
jmp 0xc4f129
or eax, 0xffffffff
cmp edx, edi
sbb esi, esi
and esi, 0xc0000095
cmp edx, edi
jb 0xc4f1cf
cmp eax, dword [ebp - 0xb80]
ja 0xc4f190
inc dword [ebp - 0xaf4]
mov edi, eax
cmp eax, dword [ebp - 0xb80]
jb 0xc4f0cc
cmp edi, dword [ebp - 0xb80]
jne 0xc4f190
mov edi, dword [ebp - 0xa80]
mov eax, dword [ebp - 0xa94]
test edi, edi
je 0xc4f1a8
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xa94], eax
test eax, eax
jne 0xc4f19e
mov esi, 0xc0000017
jmp 0xc4f1cf
mov esi, 0xc000000d
jmp 0xc4f1e6
mov esi, 0xc0000095
jmp 0xc4f1e6
xor ecx, ecx
mov esi, ecx
mov ecx, dword [ebp - 0xb48]
test ecx, ecx
je 0xc4f1bd
push edi
push ecx
push eax
call fcn.00bc13d0
mov eax, dword [ebp - 0xa94]
add esp, 0xc
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0xbe4], eax
test esi, esi
js 0xc4f1e6
mov eax, dword [ebp - 0xa90]
cmp eax, dword [ebp - 0xbe4]
je 0xc4f1e6
mov esi, 0xc000003e
or esi, 0x10000000
mov dword [ebp - 0xa6c], esi
mov eax, dword [ebp - 0xa98]
test eax, eax
je 0xc4f20d
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xac4]
test edi, edi
je 0xc4f27b
xor eax, eax
cmp dword [edi + 4], eax
je 0xc4f234
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc4f250
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc4f26c
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xac0]
test eax, eax
je 0xc4f296
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xaec]
test eax, eax
je 0xc4f2b1
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xaa0]
test edi, edi
je 0xc4f31f
xor eax, eax
cmp dword [edi + 4], eax
je 0xc4f2d8
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc4f2f4
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc4f310
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xab8]
test eax, eax
je 0xc4f33a
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc4f93c
xor eax, eax
inc eax
cmp dword [ebp - 0xbe4], eax
jb 0xc4f931
cmp dword [ebp - 0xbdc], 0
jne 0xc4f3e5
mov esi, 0xc000000d
mov dword [ebp - 0xa6c], esi
mov eax, dword [ebp - 0xadc]
push 4
pop edx
test esi, esi
js 0xc4f93c
cmp eax, 0xd0000023
jne 0xc4f38c
mov eax, 0x8007007a
mov dword [ebp - 0xadc], eax
cmp eax, 0x8007007a
je 0xc4f3a3
mov esi, eax
mov dword [ebp - 0xa6c], esi
test eax, eax
js 0xc4f93c
cmp dword [ebp - 0xbe4], 6
jne 0xc4f931
cmp dword [ebp - 0xbdc], 0
jne 0xc4f45d
mov edx, dword [ebp - 0xd64]
mov esi, 0xc000000d
mov ecx, dword [ebp - 0xd68]
mov dword [ebp - 0xa6c], esi
mov dword [ebp - 0xac0], edx
mov dword [ebp - 0xaa0], ecx
jmp 0xc4f53b
cmp dword [ebp - 0xbe4], 0
jbe 0xc4f35e
mov ecx, dword [ebp - 0xbdc]
lea eax, [ebp - 0xc54]
push eax
push 4
pop eax
mov edi, dword [ecx]
mov edx, eax
mov dword [ebp - 0xc54], ecx
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f431
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xc54]
mov dword [ebp - 0xc54], eax
jmp 0xc4f43d
mov edi, dword [ebp - 0xe54]
mov eax, dword [ebp - 0xe58]
test esi, esi
js 0xc4f369
push 4
pop edx
cmp edi, edx
jne 0xc4cd53
mov eax, dword [eax]
mov dword [ebp - 0xadc], eax
jmp 0xc4f372
mov ecx, dword [ebp - 0xbdc]
xor eax, eax
mov dword [ebp - 0xbb0], ecx
mov edi, eax
mov eax, dword [ecx]
mov dword [ebp - 0xa90], eax
lea eax, [ebp - 0xbb0]
push eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f4f7
mov edx, dword [ebp - 0xa90]
lea eax, [ebp - 0xbb0]
mov ecx, dword [ebp - 0xbb0]
push eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f4f7
mov ecx, dword [ebp - 0xbb0]
xor eax, eax
inc edi
inc eax
cmp edi, eax
jae 0xc4f4c4
push 4
pop edx
jmp 0xc4f46d
mov edi, dword [ecx]
lea eax, [ebp - 0xbb0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f4f7
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xbb0], eax
jmp 0xc4f503
mov edi, dword [ebp - 0xe80]
mov eax, dword [ebp - 0xe94]
test esi, esi
js 0xc4f523
cmp edi, 8
jne 0xc4cd53
mov ecx, dword [eax]
mov dword [ebp - 0xaa0], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xac0], ecx
jmp 0xc4f53b
mov eax, dword [ebp - 0xd64]
mov dword [ebp - 0xac0], eax
mov eax, dword [ebp - 0xd68]
mov dword [ebp - 0xaa0], eax
test esi, esi
js 0xc4f93c
cmp dword [ebp - 0xbdc], 0
jne 0xc4f585
mov esi, 0xc000000d
mov dword [ebp - 0xa6c], esi
mov eax, dword [ebp - 0xcf8]
push 4
pop edx
mov dword [ebp - 0xa94], eax
test esi, esi
js 0xc4f93c
cmp dword [ebp - 0xbdc], 0
jne 0xc4f643
mov esi, 0xc000000d
jmp 0xc4f936
mov ecx, dword [ebp - 0xbdc]
xor eax, eax
mov dword [ebp - 0xbc8], ecx
mov edi, eax
mov eax, dword [ecx]
mov dword [ebp - 0xa90], eax
lea eax, [ebp - 0xbc8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f61d
mov edx, dword [ebp - 0xa90]
lea eax, [ebp - 0xbc8]
mov ecx, dword [ebp - 0xbc8]
push eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f61d
mov ecx, dword [ebp - 0xbc8]
inc edi
cmp edi, 2
jb 0xc4f595
mov edi, dword [ecx]
lea eax, [ebp - 0xbc8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f61d
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbc8]
mov dword [ebp - 0xbc8], eax
jmp 0xc4f629
mov edi, dword [ebp - 0xe84]
mov eax, dword [ebp - 0xe88]
test esi, esi
js 0xc4f557
push 4
pop edx
cmp edi, edx
jne 0xc4cd53
mov eax, dword [eax]
jmp 0xc4f560
mov ecx, dword [ebp - 0xbdc]
xor eax, eax
mov dword [ebp - 0xbc4], ecx
mov edi, eax
mov eax, dword [ecx]
mov dword [ebp - 0xa90], eax
lea eax, [ebp - 0xbc4]
push eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f6df
mov edx, dword [ebp - 0xa90]
lea eax, [ebp - 0xbc4]
mov ecx, dword [ebp - 0xbc4]
push eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f6df
mov ecx, dword [ebp - 0xbc4]
inc edi
cmp edi, 3
jae 0xc4f6a8
push 4
pop edx
jmp 0xc4f653
mov edi, dword [ecx]
lea eax, [ebp - 0xbc4]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xaac], edi
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f6df
neg edi
sbb edi, edi
and edi, dword [ebp - 0xbc4]
mov dword [ebp - 0xbc4], edi
jmp 0xc4f6f1
mov eax, dword [ebp - 0xe8c]
mov edi, dword [ebp - 0xe3c]
mov dword [ebp - 0xaac], eax
test esi, esi
js 0xc4f93c
mov ecx, dword [ebp - 0xbdc]
xor eax, eax
push 4
mov dword [ebp - 0xbc0], ecx
mov dword [ebp - 0xa80], eax
pop edx
mov eax, dword [ecx]
mov dword [ebp - 0xa90], eax
lea eax, [ebp - 0xbc0]
push eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f7a8
mov edx, dword [ebp - 0xa90]
lea eax, [ebp - 0xbc0]
mov ecx, dword [ebp - 0xbc0]
push eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f7a8
mov eax, dword [ebp - 0xa80]
mov ecx, dword [ebp - 0xbc0]
inc eax
push 4
pop edx
mov dword [ebp - 0xa80], eax
cmp eax, edx
jb 0xc4f710
mov eax, dword [ecx]
mov dword [ebp - 0xa90], eax
lea eax, [ebp - 0xbc0]
push eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f7a8
mov ecx, dword [ebp - 0xa90]
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc0], eax
jmp 0xc4f7b4
mov ecx, dword [ebp - 0xe5c]
mov eax, dword [ebp - 0xe90]
test esi, esi
js 0xc4f7c7
push 4
pop edx
cmp ecx, edx
jne 0xc4cd53
mov eax, dword [eax]
jmp 0xc4f7cd
mov eax, dword [ebp - 0xe18]
mov dword [ebp - 0xa9c], eax
test esi, esi
js 0xc4f93c
mov ecx, dword [ebp - 0xbdc]
xor eax, eax
mov dword [ebp - 0xa80], eax
mov eax, dword [ecx]
lea edx, [ecx + 4]
mov dword [ebp - 0xa90], eax
cmp edx, ecx
jb 0xc4f7fc
mov eax, edx
jmp 0xc4f7ff
or eax, 0xffffffff
cmp edx, ecx
mov dword [ebp - 0xb54], eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xa6c], esi
cmp edx, ecx
jb 0xc4f897
mov ecx, dword [ebp - 0xa90]
add ecx, eax
mov edx, ecx
mov esi, ecx
cmp ecx, eax
jae 0xc4f82c
or ecx, 0xffffffff
cmp esi, eax
mov dword [ebp - 0xb54], ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xa6c], esi
cmp edx, eax
jb 0xc4f897
mov eax, dword [ebp - 0xa80]
inc eax
mov dword [ebp - 0xa80], eax
cmp eax, 5
jb 0xc4f7e9
mov eax, dword [ecx]
mov dword [ebp - 0xa90], eax
lea eax, [ebp - 0xb54]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
mov dword [ebp - 0xa6c], esi
test esi, esi
js 0xc4f897
mov ecx, dword [ebp - 0xa90]
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb54]
mov dword [ebp - 0xb54], eax
jmp 0xc4f8a3
mov ecx, dword [ebp - 0xe1c]
mov eax, dword [ebp - 0xe20]
test esi, esi
js 0xc4f8b6
push 4
pop edx
cmp ecx, edx
jne 0xc4cd53
mov ecx, dword [eax]
jmp 0xc4f8bc
mov ecx, dword [ebp - 0xa88]
test esi, esi
js 0xc4f93c
mov eax, dword [ebp - 0xab0]
cmp eax, dword [ebp - 0xaa0]
jne 0xc4f931
mov eax, dword [ebp - 0xa74]
cmp eax, dword [ebp - 0xac0]
jne 0xc4f931
mov eax, dword [ebp - 0xa94]
push 4
mov dword [ebp - 0xa7c], ecx
pop ecx
mov dword [ebp - 0xc10], eax
cmp dword [ebp - 0xa9c], ecx
jbe 0xc4f900
mov esi, 0x8007007a
jmp 0xc4f936
mov eax, dword [ebp - 0xaac]
cmp eax, ecx
ja 0xc4f8f9
push eax
push edi
push dword [ebp - 0xb70]
call fcn.00bc13d0
add esp, 0xc
mov eax, dword [ebp - 0xadc]
mov edi, dword [ebp - 0xa68]
test eax, eax
je 0xc4f942
mov esi, eax
jmp 0xc4ca36
mov esi, 0xc004d501
mov dword [ebp - 0xa6c], esi
mov edi, dword [ebp - 0xa68]
mov eax, dword [ebp - 0xcbc]
xor edx, edx
mov dword [ebp - 0xcc0], edx
mov dword [ebp - 0xcc4], edx
test eax, eax
je 0xc4f971
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0xcbc], edx
mov ecx, dword [ebp - 0xbdc]
mov dword [ebp - 0xbe0], edx
mov dword [ebp - 0xbe4], edx
test ecx, ecx
je 0xc4f99e
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0xbdc], edx
test edi, edi
je 0xc4f9b1
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xa84]
test eax, eax
je 0xc4f9cc
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc4c8df
mov eax, dword [ebp - 0xa7c]
test eax, eax
je 0xc56590
mov dword [0xd09360], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x2cc]
push eax
push 0xb10000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0xc5440c
cmp eax, esi
jne 0xc4fa1a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0xc5440c
mov esi, dword [0xd0807c]
xor ebx, ebx
push 0x403
push ebx
push ebx
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xac4], eax
test eax, eax
jne 0xc4fa48
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc5440e
mov esi, dword [0xd0804c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ebx, dword [0xd09360]
mov dword [0xd09358], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x770]
mov dword [0xd0935c], edx
push eax
mov dword [ebp - 0xac0], ebx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0xc0c]
stosd dword es:[edi], eax
xor ecx, ecx
push 0x2c
push ecx
mov dword [ebp - 0xd70], ecx
stosd dword es:[edi], eax
mov dword [ebp - 0xd6c], ecx
mov dword [ebp - 0xab4], ecx
mov dword [ebp - 0xabc], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x45c]
push eax
call fcn.00bc259b
add esp, 0x18
mov esi, 0xd0aed4
xor edx, edx
mov dword [ebp - 0xaf4], edx
lea ecx, [edx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xc4fac5
mov eax, dword [0xd0a150]
push 0
pop edx
test eax, eax
jne 0xc50131
push 0x338
push edx
mov dword [ebp - 0xab0], edx
mov dword [ebp - 0xa78], edx
mov dword [ebp - 0xaa4], edx
mov dword [ebp - 0xac8], edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xa94], eax
test eax, eax
je 0xc5011f
or dword [ebp - 0xa80], 0xffffffff
xor edx, edx
mov edi, edx
mov dword [ebp - 0xa84], edx
mov ebx, edx
mov dword [ebp - 0x3f8], 0xab69605e
mov cl, dl
mov dword [ebp - 0x3f4], 0x7f1137f
add eax, 7
mov dword [ebp - 0xb3c], edi
mov edx, 0xb2bef2
mov dword [ebp - 0xb68], ebx
mov dword [ebp - 0xa9c], eax
mov dword [ebp - 0xa7c], edx
mov dword [ebp - 0xaac], 0x67
movzx esi, byte [edx - 2]
movzx eax, byte [edx - 1]
shl esi, 8
or esi, eax
movzx eax, byte [edx]
shl esi, 8
or esi, eax
movzx eax, byte [edx + 1]
movzx edx, byte [edx + 2]
shl edx, 8
shl esi, 8
or esi, eax
mov eax, dword [ebp - 0xa7c]
xor ebx, esi
mov dword [ebp - 0xa90], esi
mov esi, 0xab69605e
movzx eax, byte [eax + 3]
or edx, eax
mov eax, dword [ebp - 0xa7c]
shl edx, 8
movzx eax, byte [eax + 4]
or edx, eax
mov eax, dword [ebp - 0xa7c]
shl edx, 8
add dword [ebp - 0xa7c], 8
movzx eax, byte [eax + 5]
or edx, eax
xor edi, edx
mov dword [ebp - 0xaa0], edx
xor edi, ebx
xor edi, 0xac987321
mov edx, edi
rol edx, 0xa
lea eax, [edi + 0x54969fa2]
rol eax, 5
imul eax, eax, 0x137f
add edx, eax
xor ebx, edx
mov edx, ebx
rol edx, 2
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul eax, eax, 0xab69
sub eax, edx
xor edi, eax
imul edx, edi, 0x605e
mov eax, edi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor ebx, edx
mov eax, ebx
mov edx, ebx
xor eax, 0xab69
rol edx, 2
rol eax, 6
imul eax, eax, 0x7f1
sub eax, edx
xor edi, eax
mov eax, 0x7f1137f
mov edx, edi
xor edx, esi
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor edi, edx
mov edx, edi
rol edx, 2
lea eax, [edi + 0x7f1137f]
ror eax, 0xf
imul eax, eax, 0x605e
add edx, eax
xor ebx, edx
mov edx, ebx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul eax, eax, 0x7f1
rol edx, 8
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, esi
ror edx, 0xa
ror eax, 0xc
imul eax, eax, 0x137f
xor edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
mov dword [ebp - 0xa88], edi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea edi, [ebx - 0x7f1]
xor edi, dword [ebp - 0xa88]
xor edi, esi
mov esi, 0xab69
mov eax, edi
mov edx, edi
xor eax, 0x7f1
shr edx, 2
rol eax, 2
imul eax, eax, 0x137f
add edx, eax
xor ebx, edx
mov edx, ebx
rol edx, 7
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul eax, eax, 0xab69
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor ebx, edx
mov eax, ebx
mov edx, ebx
xor eax, esi
rol edx, 7
rol eax, 5
imul eax, eax, 0x7f1
add edx, eax
xor edi, edx
mov eax, edi
xor eax, ebx
xor eax, 0xac987321
mov dword [ebp - 0xa74], eax
ror eax, 3
sub eax, esi
mov esi, dword [ebp - 0xa74]
imul eax, eax, 0x137f
xor edi, eax
mov edx, edi
ror edx, 6
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul eax, eax, 0x605e
sub eax, edx
xor esi, eax
mov edx, esi
rol edx, 0xe
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul eax, eax, 0x7f1
add edx, eax
xor edi, edx
mov edx, edi
ror edx, 0xe
lea eax, [edi - 0x54969fa2]
rol eax, 0xf
imul eax, eax, 0x137f
sub eax, edx
xor esi, eax
mov eax, esi
mov dword [ebp - 0xa74], esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor edi, dword [ebp - 0xa80]
xor eax, 0x7f1137f
rol eax, 4
imul eax, eax, 0x605e
rol edx, 2
mov dword [ebp - 0xb3c], edi
xor edx, eax
mov eax, esi
xor edx, dword [ebp - 0xa84]
xor eax, edx
mov edx, dword [ebp - 0xa9c]
mov dword [ebp - 0xb68], eax
mov byte [edx - 4], al
mov al, byte [ebp - 0xb3c]
ror dword [ebp - 0xb68], 8
mov byte [edx], al
mov al, byte [ebp - 0xb68]
ror dword [ebp - 0xb3c], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb3c]
ror dword [ebp - 0xb68], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb68]
ror dword [ebp - 0xb3c], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb3c]
ror dword [ebp - 0xb68], 8
mov byte [edx - 2], al
ror dword [ebp - 0xb3c], 8
mov al, byte [ebp - 0xb68]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb3c]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [ebp - 0xb68]
mov edi, dword [ebp - 0xb3c]
mov eax, dword [ebp - 0xa90]
ror ebx, 8
ror edi, 8
sub dword [ebp - 0xaac], 1
mov dword [ebp - 0xa84], eax
mov eax, dword [ebp - 0xaa0]
mov dword [ebp - 0xa9c], edx
mov edx, dword [ebp - 0xa7c]
mov dword [ebp - 0xb68], ebx
mov dword [ebp - 0xb3c], edi
mov dword [ebp - 0xa80], eax
jne 0xc4fb6e
mov ebx, dword [ebp - 0xac0]
xor eax, eax
mov esi, dword [ebp - 0xa94]
mov edx, eax
xor cl, byte [edx + esi]
inc edx
cmp edx, 0x338
jb 0xc4fed3
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xc4ff04
cmp edx, dword [0xb2c22c]
jne 0xc4ff04
xor eax, eax
mov dword [ebp - 0xaa4], esi
mov esi, eax
mov edi, 0x337
jmp 0xc4ff13
or edi, 0xffffffff
mov dword [ebp - 0xac8], 0xc004d501
xor eax, eax
test esi, esi
je 0xc4ff26
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xac8], 0
jl 0xc5011f
mov eax, dword [ebp - 0xaa4]
xor ecx, ecx
push 0x40
push ecx
push 0xd0ae80
mov esi, eax
mov byte [edi + eax], cl
call fcn.00bc259b
mov eax, esi
add esp, 0xc
cmp byte [eax], 0
je 0xc500c0
mov edi, 0xd0ae80
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xa88], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbd0]
jne 0xc4ff6d
sub ecx, dword [ebp - 0xa88]
xor eax, eax
sar ecx, 1
push edi
push edx
push eax
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc5011f
xor eax, eax
mov ecx, 0x5a4d
mov edx, eax
mov eax, dword [edi]
mov dword [ebp - 0xa78], edx
cmp word [eax], cx
je 0xc4ffc0
mov edx, 0xc000007b
mov dword [ebp - 0xa78], edx
jmp 0xc50008
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xc4ffb3
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xc4ffb3
cmp dword [ecx], 0x4550
jne 0xc4ffb3
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xba4]
je 0xc4fff6
cmp ax, word [ebp - 0xba8]
je 0xc4fff6
mov edx, 0xc000000d
jmp 0xc4ffb8
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xa80], eax
xor ecx, ecx
mov dword [ebp - 0xa84], ecx
test eax, eax
je 0xc500ae
mov ecx, esi
mov dword [ebp - 0xa90], esi
xor eax, eax
mov dword [ebp - 0xbf8], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xa88], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc5003e
sub ecx, dword [ebp - 0xa88]
inc esi
add esi, ecx
test edx, edx
js 0xc50088
mov ecx, dword [ebp - 0xa90]
lea eax, [ebp - 0xbf8]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa78], edx
test edx, edx
js 0xc500ba
mov eax, dword [ebp - 0xab0]
mov ecx, dword [ebp - 0xbf8]
mov dword [eax*4 + section..data], ecx
jmp 0xc5008e
mov eax, dword [ebp - 0xab0]
inc eax
mov dword [ebp - 0xab0], eax
mov eax, dword [ebp - 0xa84]
inc eax
mov dword [ebp - 0xa84], eax
cmp eax, dword [ebp - 0xa80]
jb 0xc50025
add edi, 0x10
cmp byte [esi], 0
jne 0xc4ff60
mov eax, dword [ebp - 0xaa4]
mov esi, dword [ebp - 0xa78]
test eax, eax
je 0xc500db
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0xc5012c
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc500f4
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc500e3
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc50137
mov eax, dword [ebp - 0xaa4]
mov esi, 0xc000007a
jmp 0xc500c6
mov eax, dword [0xd0a150]
inc eax
mov dword [0xd0a150], eax
xor eax, eax
mov esi, 0xd0aed4
xchg dword [esi], eax
xor eax, eax
lea edi, [ebp - 0xc80]
stosd dword es:[edi], eax
xor edx, edx
mov dword [ebp - 0x16], edx
mov dword [ebp - 0xab8], edx
mov dword [ebp - 0xaec], edx
stosd dword es:[edi], eax
mov dword [ebp - 0xaa0], edx
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xda0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [edx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xc5016e
mov eax, dword [0xd0a150]
push 0
pop edx
test eax, eax
jne 0xc507c3
push 0x338
push edx
mov dword [ebp - 0xa74], edx
mov dword [ebp - 0xa78], edx
mov dword [ebp - 0xaa4], edx
mov dword [ebp - 0xac8], edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xab0], eax
test eax, eax
je 0xc507b1
or dword [ebp - 0xa80], 0xffffffff
xor edx, edx
mov edi, edx
mov dword [ebp - 0xa84], edx
mov ebx, edx
mov dword [ebp - 0x3e8], 0xab69605e
mov cl, dl
mov dword [ebp - 0x3e4], 0x7f1137f
add eax, 7
mov dword [ebp - 0xb40], edi
mov edx, 0xb2bef2
mov dword [ebp - 0xb64], ebx
mov dword [ebp - 0xa9c], eax
mov dword [ebp - 0xa7c], edx
mov dword [ebp - 0xaac], 0x67
movzx esi, byte [edx - 2]
movzx eax, byte [edx - 1]
shl esi, 8
or esi, eax
movzx eax, byte [edx]
shl esi, 8
or esi, eax
movzx eax, byte [edx + 1]
movzx edx, byte [edx + 2]
shl edx, 8
shl esi, 8
or esi, eax
mov eax, dword [ebp - 0xa7c]
xor ebx, esi
mov dword [ebp - 0xa88], esi
movzx eax, byte [eax + 3]
or edx, eax
mov eax, dword [ebp - 0xa7c]
shl edx, 8
movzx eax, byte [eax + 4]
or edx, eax
mov eax, dword [ebp - 0xa7c]
shl edx, 8
add dword [ebp - 0xa7c], 8
movzx eax, byte [eax + 5]
or edx, eax
mov esi, edx
mov dword [ebp - 0xa90], edx
xor esi, edi
mov edi, 0xab69605e
xor esi, ebx
xor esi, 0xac987321
mov edx, esi
rol edx, 0xa
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul eax, eax, 0x137f
add edx, eax
xor ebx, edx
mov edx, ebx
rol edx, 2
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul eax, eax, 0xab69
sub eax, edx
xor esi, eax
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor ebx, edx
mov eax, ebx
mov edx, ebx
xor eax, 0xab69
rol edx, 2
rol eax, 6
imul eax, eax, 0x7f1
sub eax, edx
xor esi, eax
mov eax, 0x7f1137f
mov edx, esi
xor edx, edi
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
mov edx, esi
rol edx, 2
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul eax, eax, 0x605e
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul eax, eax, 0x7f1
mov edx, ebx
rol edx, 8
sub eax, edx
xor esi, eax
mov eax, esi
mov edx, esi
xor eax, edi
ror edx, 0xa
ror eax, 0xc
imul eax, eax, 0x137f
xor edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea edi, [ebx - 0x7f1]
xor edi, esi
mov esi, 0xab69
xor edi, 0xab69605e
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, edi
shr eax, 2
add edx, eax
xor ebx, edx
mov edx, ebx
rol edx, 7
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul eax, eax, 0xab69
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor ebx, edx
mov eax, ebx
mov edx, ebx
xor eax, esi
rol edx, 7
rol eax, 5
imul eax, eax, 0x7f1
add edx, eax
xor edi, edx
xor ebx, edi
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, esi
imul eax, eax, 0x137f
xor edi, eax
mov edx, edi
ror edx, 6
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul eax, eax, 0x605e
sub eax, edx
xor ebx, eax
mov edx, ebx
rol edx, 0xe
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul eax, eax, 0x7f1
add edx, eax
xor edi, edx
lea eax, [edi - 0x54969fa2]
mov edx, edi
rol eax, 0xf
imul eax, eax, 0x137f
ror edx, 0xe
sub eax, edx
xor ebx, eax
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor edi, dword [ebp - 0xa80]
xor eax, 0x7f1137f
rol eax, 4
imul eax, eax, 0x605e
rol edx, 2
mov dword [ebp - 0xb40], edi
xor edx, eax
xor edx, dword [ebp - 0xa84]
xor ebx, edx
mov edx, dword [ebp - 0xa9c]
mov dword [ebp - 0xb64], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb40]
ror dword [ebp - 0xb64], 8
mov byte [edx], al
mov al, byte [ebp - 0xb64]
ror dword [ebp - 0xb40], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb40]
ror dword [ebp - 0xb64], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb64]
ror dword [ebp - 0xb40], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb40]
ror dword [ebp - 0xb64], 8
mov byte [edx - 2], al
ror dword [ebp - 0xb40], 8
mov al, byte [ebp - 0xb64]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb40]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [ebp - 0xb64]
mov edi, dword [ebp - 0xb40]
mov eax, dword [ebp - 0xa88]
ror ebx, 8
ror edi, 8
sub dword [ebp - 0xaac], 1
mov dword [ebp - 0xa84], eax
mov eax, dword [ebp - 0xa90]
mov dword [ebp - 0xa9c], edx
mov edx, dword [ebp - 0xa7c]
mov dword [ebp - 0xb64], ebx
mov dword [ebp - 0xb40], edi
mov dword [ebp - 0xa80], eax
jne 0xc50217
mov ebx, dword [ebp - 0xac0]
xor eax, eax
mov esi, dword [ebp - 0xab0]
mov edx, eax
xor cl, byte [edx + esi]
inc edx
cmp edx, 0x338
jb 0xc50565
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xc50596
cmp edx, dword [0xb2c22c]
jne 0xc50596
xor eax, eax
mov dword [ebp - 0xaa4], esi
mov esi, eax
mov edi, 0x337
jmp 0xc505a5
or edi, 0xffffffff
mov dword [ebp - 0xac8], 0xc004d501
xor eax, eax
test esi, esi
je 0xc505b8
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xac8], 0
jl 0xc507b1
mov eax, dword [ebp - 0xaa4]
xor ecx, ecx
push 0x40
push ecx
push 0xd0ae80
mov esi, eax
mov byte [edi + eax], cl
call fcn.00bc259b
mov eax, esi
add esp, 0xc
cmp byte [eax], 0
je 0xc50752
mov edi, 0xd0ae80
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xa88], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbd0]
jne 0xc505ff
sub ecx, dword [ebp - 0xa88]
xor eax, eax
sar ecx, 1
push edi
push edx
push eax
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc507b1
xor eax, eax
mov ecx, 0x5a4d
mov edx, eax
mov eax, dword [edi]
mov dword [ebp - 0xa78], edx
cmp word [eax], cx
je 0xc50652
mov edx, 0xc000007b
mov dword [ebp - 0xa78], edx
jmp 0xc5069a
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xc50645
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xc50645
cmp dword [ecx], 0x4550
jne 0xc50645
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xba4]
je 0xc50688
cmp ax, word [ebp - 0xba8]
je 0xc50688
mov edx, 0xc000000d
jmp 0xc5064a
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xa80], eax
xor ecx, ecx
mov dword [ebp - 0xa84], ecx
test eax, eax
je 0xc50740
mov ecx, esi
mov dword [ebp - 0xa90], esi
xor eax, eax
mov dword [ebp - 0xbac], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xa88], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc506d0
sub ecx, dword [ebp - 0xa88]
inc esi
add esi, ecx
test edx, edx
js 0xc5071a
mov ecx, dword [ebp - 0xa90]
lea eax, [ebp - 0xbac]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa78], edx
test edx, edx
js 0xc5074c
mov eax, dword [ebp - 0xa74]
mov ecx, dword [ebp - 0xbac]
mov dword [eax*4 + section..data], ecx
jmp 0xc50720
mov eax, dword [ebp - 0xa74]
inc eax
mov dword [ebp - 0xa74], eax
mov eax, dword [ebp - 0xa84]
inc eax
mov dword [ebp - 0xa84], eax
cmp eax, dword [ebp - 0xa80]
jb 0xc506b7
add edi, 0x10
cmp byte [esi], 0
jne 0xc505f2
mov eax, dword [ebp - 0xaa4]
mov esi, dword [ebp - 0xa78]
test eax, eax
je 0xc5076d
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0xc507be
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc50786
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc50775
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc507c9
mov eax, dword [ebp - 0xaa4]
mov esi, 0xc000007a
jmp 0xc50758
mov eax, dword [0xd0a150]
inc eax
mov dword [0xd0a150], eax
xor eax, eax
mov ecx, 0xd0aed4
xchg dword [ecx], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x770]
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
mov eax, ebx
xor ecx, ecx
mov dword [ebp - 0xc0c], ecx
push 0xf
pop edx
and eax, edx
mov dword [ebp - 0xa78], eax
mov eax, ebx
shr eax, 4
and eax, edx
mov word [ebp - 0x18], ax
mov eax, ebx
push 0x403
push ecx
shr eax, 8
shr ebx, 0xc
and eax, edx
and ebx, edx
mov word [ebp - 0x16], ax
push ecx
mov ecx, esi
mov word [ebp - 0x14], bx
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa70], eax
mov dword [ebp - 0xaa8], 0xffffff
test eax, eax
jne 0xc50878
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa68], edi
test edi, edi
jle 0xc50868
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa68], edi
test edi, edi
js 0xc51ee5
mov ebx, 0x80004005
jmp 0xc51eeb
mov edi, dword [0xd08050]
xor edx, edx
mov eax, edx
mov dword [ebp - 0xbf4], edx
mov dword [ebp - 0xa68], eax
mov esi, edx
lea eax, [ebp - 0xc50]
mov dword [ebp - 0xa98], esi
push eax
push edx
lea eax, [ebp - 0xbf0]
mov dword [ebp - 0xad8], edx
push eax
push 8
mov ecx, edi
mov dword [ebp - 0xc50], edx
mov ebx, edx
call dword [0xd0cffc]
call edi
test eax, eax
jne 0xc508fc
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa68], edi
test edi, edi
jle 0xc508e6
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa68], edi
test edi, edi
js 0xc50a87
mov edi, 0x80004005
mov dword [ebp - 0xa68], edi
jmp 0xc51286
mov eax, dword [ebp - 0xc50]
add eax, eax
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xa9c], edi
test edi, edi
jne 0xc50928
mov edi, 0x8007000e
jmp 0xc508f1
mov eax, dword [ebp - 0xbf0]
lea eax, [eax*4 + 4]
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xa80], eax
test eax, eax
je 0xc50ac4
mov esi, eax
lea eax, [ebp - 0xc50]
push eax
push edi
mov edi, dword [0xd08050]
lea eax, [ebp - 0xbf0]
push eax
push 8
mov ecx, edi
call dword [0xd0cffc]
call edi
test eax, eax
jne 0xc509b2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa68], edi
test edi, edi
jle 0xc5099e
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa68], edi
test edi, edi
js 0xc509ab
mov edi, 0x80004005
mov dword [ebp - 0xa68], edi
xor ecx, ecx
jmp 0xc50a58
mov eax, dword [ebp - 0xa80]
xor ecx, ecx
mov edi, dword [ebp - 0xa9c]
mov dword [ebp - 0xa74], eax
mov dword [ebp - 0xa84], ecx
cmp dword [ebp - 0xbf0], ecx
jbe 0xc50a31
mov ebx, eax
mov esi, dword [0xd08058]
push ecx
push edi
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, edi
mov dword [ebx], eax
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0xc509f1
sub ecx, edx
sar ecx, 1
push 4
pop eax
add ebx, eax
mov eax, dword [ebp - 0xa84]
lea edi, [edi + ecx*2]
add edi, 2
inc eax
push 0
mov dword [ebp - 0xa84], eax
pop ecx
cmp eax, dword [ebp - 0xbf0]
jb 0xc509d6
mov dword [ebp - 0xa74], ebx
mov ebx, esi
mov eax, dword [ebp - 0xa74]
mov edi, dword [ebp - 0xa68]
mov esi, ecx
mov dword [eax], 0x409
mov eax, dword [ebp - 0xa80]
mov dword [ebp - 0xa98], eax
mov eax, dword [ebp - 0xbf0]
inc eax
mov dword [ebp - 0xa84], eax
test esi, esi
je 0xc50a6b
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xa98]
push dword [ebp - 0xa9c]
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0xc51286
xor eax, eax
mov edi, eax
mov edx, eax
mov dword [ebp - 0xab0], edi
cmp dword [ebp - 0xa84], eax
jbe 0xc50adb
mov ecx, eax
mov eax, dword [esi + edx*4]
cmp eax, dword [ecx*4 + 0xb40a18]
je 0xc50ad1
inc ecx
cmp ecx, 0x26
jb 0xc50aa5
inc edx
xor eax, eax
cmp edx, dword [ebp - 0xa84]
jae 0xc50adb
jmp 0xc50aa3
mov edi, 0x8007000e
mov dword [ebp - 0xa68], edi
jmp 0xc50a71
mov edi, ecx
xor eax, eax
mov dword [ebp - 0xab0], edi
push eax
mov dword [ebp - 0xa94], eax
lea eax, [ebp - 0xc4]
push 0x55
push eax
push dword [edi*4 + 0xb40a18]
mov edi, dword [0xd08054]
mov ecx, edi
call dword [0xd0cffc]
call edi
test eax, eax
je 0xc50b3e
mov edi, dword [0xd08048]
lea eax, [ebp - 0x640]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xc4]
mov ecx, edi
push eax
call dword [0xd0cffc]
call edi
test eax, eax
jle 0xc50b3e
mov eax, dword [ebp - 0x634]
shr eax, 0x1b
and eax, 1
mov dword [ebp - 0xa94], eax
xor eax, eax
mov edx, 0xb2fcd8
mov edi, eax
mov ecx, edx
mov dword [ebp + edi*4 - 0x350], edx
lea eax, [ecx + 2]
mov dword [ebp - 0xa88], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbd0]
jne 0xc50b59
sub ecx, dword [ebp - 0xa88]
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc edi
cmp edi, 0x13
jb 0xc50b47
imul ecx, dword [ebp - 0xab0], 3
movzx eax, byte [ecx + 0xb320b0]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xc80], eax
movzx eax, byte [ecx + 0xb320b1]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xc7c], eax
movzx eax, byte [ecx + 0xb320b2]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xc78], eax
xor ecx, ecx
push 0x1c90
mov eax, ecx
push ecx
mov dword [ebp - 0xa68], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
mov dword [ebp - 0xac0], ecx
test ecx, ecx
je 0xc510a1
or dword [ebp - 0xa80], 0xffffffff
mov ebx, edx
mov esi, edx
mov dword [ebp - 0xa84], edx
mov al, dl
mov dword [ebp - 0x3e0], 0xab69605e
add ecx, 7
mov dword [ebp - 0x3dc], 0x7f1137f
mov edx, 0xb40ac2
mov dword [ebp - 0xb58], ebx
mov dword [ebp - 0xb60], esi
mov dword [ebp - 0xa9c], ecx
mov dword [ebp - 0xadc], edx
mov dword [ebp - 0xaac], 0x392
movzx edi, byte [edx - 2]
movzx ecx, byte [edx - 1]
shl edi, 8
or edi, ecx
movzx ecx, byte [edx]
shl edi, 8
or edi, ecx
movzx ecx, byte [edx + 1]
movzx edx, byte [edx + 2]
shl edx, 8
shl edi, 8
or edi, ecx
mov ecx, dword [ebp - 0xadc]
xor esi, edi
mov dword [ebp - 0xa88], edi
movzx ecx, byte [ecx + 3]
or edx, ecx
mov ecx, dword [ebp - 0xadc]
shl edx, 8
movzx ecx, byte [ecx + 4]
or edx, ecx
mov ecx, dword [ebp - 0xadc]
shl edx, 8
add dword [ebp - 0xadc], 8
movzx ecx, byte [ecx + 5]
or edx, ecx
mov edi, edx
mov dword [ebp - 0xa90], edx
xor edi, ebx
mov ebx, 0xab69605e
xor edi, esi
xor edi, 0xac987321
mov edx, edi
rol edx, 0xa
lea ecx, [edi + 0x54969fa2]
rol ecx, 5
imul ecx, ecx, 0x137f
add edx, ecx
xor esi, edx
mov edx, esi
rol edx, 2
lea ecx, [esi + 0x7f1137f]
ror ecx, 9
imul ecx, ecx, 0xab69
sub ecx, edx
xor edi, ecx
imul edx, edi, 0x605e
mov ecx, edi
shr ecx, 0xd
sub edx, ecx
sub edx, 0x756c8a2
xor esi, edx
mov ecx, esi
mov edx, esi
xor ecx, 0xab69
rol edx, 2
rol ecx, 6
imul ecx, ecx, 0x7f1
sub ecx, edx
xor edi, ecx
mov ecx, 0x7f1137f
mov edx, edi
xor edx, ebx
sub ecx, edx
xor esi, ecx
mov ecx, esi
mov edx, esi
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor edi, edx
mov edx, edi
rol edx, 2
lea ecx, [edi + 0x7f1137f]
ror ecx, 0xf
imul ecx, ecx, 0x605e
add edx, ecx
xor esi, edx
lea ecx, [esi + 0x54969fa2]
ror ecx, 0xe
imul ecx, ecx, 0x7f1
mov edx, esi
rol edx, 8
sub ecx, edx
xor edi, ecx
mov ecx, edi
mov edx, edi
xor ecx, ebx
ror edx, 0xa
ror ecx, 0xc
imul ecx, ecx, 0x137f
xor edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, esi
shr ecx, 0xa
xor edx, ecx
xor edi, edx
mov ecx, edi
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor esi, ecx
lea ecx, [esi - 0x7f1]
xor ecx, edi
mov edi, ecx
mov dword [ebp - 0xa7c], ecx
xor edi, ebx
mov ebx, 0xab69
mov ecx, edi
mov edx, edi
xor ecx, 0x7f1
shr edx, 2
rol ecx, 2
imul ecx, ecx, 0x137f
add edx, ecx
xor esi, edx
mov edx, esi
rol edx, 7
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul ecx, ecx, 0xab69
add edx, ecx
xor edi, edx
mov ecx, edi
mov edx, edi
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor esi, edx
mov ecx, esi
mov edx, esi
xor ecx, ebx
rol edx, 7
rol ecx, 5
imul ecx, ecx, 0x7f1
add edx, ecx
xor edi, edx
mov ecx, edi
xor ecx, esi
xor ecx, 0xac987321
mov dword [ebp - 0xa74], ecx
ror ecx, 3
sub ecx, ebx
imul ecx, ecx, 0x137f
xor edi, ecx
mov edx, edi
mov dword [ebp - 0xa7c], edi
ror edx, 6
lea ecx, [edi - 0x7f1137f]
mov edi, dword [ebp - 0xa74]
ror ecx, 1
imul ecx, ecx, 0x605e
sub ecx, edx
xor edi, ecx
lea ecx, [edi - 0x54969fa2]
rol ecx, 3
imul ecx, ecx, 0x7f1
mov edx, edi
rol edx, 0xe
add edx, ecx
mov ecx, dword [ebp - 0xa7c]
xor ecx, edx
mov dword [ebp - 0xa7c], ecx
add ecx, 0xab69605e
mov edx, dword [ebp - 0xa7c]
rol ecx, 0xf
imul ecx, ecx, 0x137f
ror edx, 0xe
sub ecx, edx
xor edi, ecx
mov ecx, edi
mov dword [ebp - 0xa74], edi
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, edi
mov edi, dword [ebp - 0xa7c]
shr ecx, 3
xor edx, ecx
xor edi, edx
mov ecx, edi
mov edx, edi
xor edi, dword [ebp - 0xa80]
xor ecx, 0x7f1137f
rol ecx, 4
imul ecx, ecx, 0x605e
rol edx, 2
mov dword [ebp - 0xb58], edi
xor edx, ecx
mov ecx, dword [ebp - 0xa74]
xor edx, dword [ebp - 0xa84]
xor ecx, edx
mov edx, dword [ebp - 0xa9c]
mov dword [ebp - 0xb60], ecx
mov byte [edx - 4], cl
mov cl, byte [ebp - 0xb58]
ror dword [ebp - 0xb60], 8
mov byte [edx], cl
mov cl, byte [ebp - 0xb60]
ror dword [ebp - 0xb58], 8
mov byte [edx - 5], cl
mov cl, byte [ebp - 0xb58]
ror dword [ebp - 0xb60], 8
mov byte [edx - 1], cl
mov cl, byte [ebp - 0xb60]
ror dword [ebp - 0xb58], 8
mov byte [edx - 6], cl
mov cl, byte [ebp - 0xb58]
ror dword [ebp - 0xb60], 8
mov byte [edx - 2], cl
ror dword [ebp - 0xb58], 8
mov cl, byte [ebp - 0xb60]
mov byte [edx - 7], cl
mov cl, byte [ebp - 0xb58]
mov byte [edx - 3], cl
add edx, 8
mov esi, dword [ebp - 0xb60]
mov ebx, dword [ebp - 0xb58]
mov ecx, dword [ebp - 0xa88]
ror esi, 8
ror ebx, 8
sub dword [ebp - 0xaac], 1
mov dword [ebp - 0xa84], ecx
mov ecx, dword [ebp - 0xa90]
mov dword [ebp - 0xa9c], edx
mov edx, dword [ebp - 0xadc]
mov dword [ebp - 0xb60], esi
mov dword [ebp - 0xb58], ebx
mov dword [ebp - 0xa80], ecx
jne 0xc50c3f
mov esi, dword [ebp - 0xa98]
xor ecx, ecx
mov edi, dword [ebp - 0xac0]
mov edx, ecx
mov ebx, ecx
xor al, byte [edx + edi]
mov ecx, 0x1c90
inc edx
cmp edx, ecx
jb 0xc50fcf
movzx eax, al
cdq
cmp eax, dword [0xb42750]
jne 0xc51008
cmp edx, dword [0xb42754]
jne 0xc51008
xor edx, edx
mov dword [ebp - 0xbf4], edi
mov edi, dword [ebp - 0xa68]
mov eax, edx
mov dword [ebp - 0xad8], ecx
jmp 0xc5101b
mov eax, dword [ebp - 0xac0]
mov edi, 0xc004d501
mov dword [ebp - 0xa68], edi
xor edx, edx
test eax, eax
je 0xc5102e
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0xc51286
mov edi, dword [ebp - 0xbf4]
xor eax, eax
mov esi, dword [ebp - 0xab0]
mov edx, eax
cmp esi, edx
jne 0xc51051
mov dword [ebp + ebx*4 - 0x304], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0xa88], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc5105c
sub ecx, dword [ebp - 0xa88]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0xc51046
inc ebx
push 0
pop eax
cmp ebx, 6
jb 0xc51044
push 0xc
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, dword [ebp - 0xa98]
mov edx, eax
mov dword [ebp - 0xa84], edx
test edx, edx
jne 0xc510b1
xor edx, edx
mov ebx, edx
mov edi, 0x8007000e
mov dword [ebp - 0xa68], edi
jmp 0xc51288
mov edi, edx
xor eax, eax
mov ebx, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xa74], eax
movzx edx, word [ebp + ecx*2 - 0x18]
cmp dx, word [eax*2 + 0xb40ab0]
je 0xc510de
inc eax
cmp eax, 6
jb 0xc510c9
jmp 0xc511a1
mov edx, dword [ebp + eax*4 - 0x304]
mov ecx, edx
mov dword [ebp - 0xa88], edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc510f0
xor eax, eax
sub ecx, edi
mov edi, dword [0xd08060]
push eax
push eax
lea eax, [ecx + 1]
mov ecx, edi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0xd0cffc]
call edi
mov dword [ebp - 0xa90], eax
test eax, eax
je 0xc511df
lea ecx, [eax + eax]
xor eax, eax
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0xa74]
mov edi, eax
mov eax, dword [ebp - 0xa84]
mov dword [eax + ecx*4], edi
test edi, edi
je 0xc511d8
mov edx, dword [ebp - 0xa88]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xa88], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc51166
push dword [ebp - 0xa90]
sub ecx, dword [ebp - 0xa88]
push edi
mov edi, dword [0xd08060]
lea eax, [ecx + 1]
mov ecx, edi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0xd0cffc]
call edi
test eax, eax
je 0xc511df
mov ecx, dword [ebp - 0xa74]
inc ecx
mov dword [ebp - 0xa74], ecx
push 0
pop eax
cmp ecx, 3
jb 0xc510c4
mov eax, dword [ebp - 0xa84]
xor edx, edx
mov edi, dword [ebp - 0xa68]
mov ebx, edx
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0xa94]
mov dword [ebp - 0x770], eax
jmp 0xc51211
mov edi, 0x8007000e
jmp 0xc51209
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa68], edi
test edi, edi
jle 0xc51202
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa68], edi
test edi, edi
js 0xc5120f
mov edi, 0x80004005
mov dword [ebp - 0xa68], edi
xor edx, edx
test ebx, ebx
je 0xc51288
mov eax, edx
mov dword [ebp - 0xa74], edx
mov edx, dword [ebx + eax*4]
test edx, edx
je 0xc5127a
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0xa88], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbd0]
jne 0xc5122f
sub ecx, dword [ebp - 0xa88]
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc5125b
xor eax, eax
mov byte [edx], al
inc edx
sub ecx, 1
jne 0xc51253
mov eax, dword [ebp - 0xa74]
push dword [ebx + eax*4]
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xa74]
inc eax
mov dword [ebp - 0xa74], eax
cmp eax, 3
jb 0xc5121d
xor edx, edx
mov eax, dword [ebp - 0xbf4]
test eax, eax
je 0xc512a4
mov ecx, dword [ebp - 0xad8]
test ecx, ecx
je 0xc512a4
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0xc5129c
test ebx, ebx
je 0xc512bb
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc512bd
xor ebx, ebx
mov eax, dword [ebp - 0xbf4]
test eax, eax
je 0xc512dc
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xbf4], ebx
test esi, esi
je 0xc512ef
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0xc51ec4
mov eax, dword [ebp - 0xaa0]
mov esi, dword [0xd080b4]
mov ecx, dword [eax]
mov dword [ebp - 0x768], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x764], ecx
xor ecx, ecx
mov eax, dword [eax + 8]
mov edi, ecx
push ecx
mov dword [ebp - 0x760], eax
lea eax, [ebp - 0xdac]
push eax
push ecx
push 0x42
mov ecx, esi
mov dword [ebp - 0xda8], ebx
mov dword [ebp - 0xda4], ebx
mov dword [ebp - 0xa68], edi
mov dword [ebp - 0xdac], 0xc
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc51388
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa68], edi
test edi, edi
jle 0xc51379
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa68], edi
test edi, edi
js 0xc51393
mov edi, 0x80004005
mov dword [ebp - 0xa68], edi
jmp 0xc51393
mov ebx, dword [ebp - 0xda8]
xor eax, eax
inc eax
and ebx, eax
mov dword [ebp - 0x76c], ebx
test edi, edi
js 0xc51ec4
mov edi, dword [ebp - 0xa78]
mov eax, edi
push 0x2a
pop ecx
mov dword [ebp - 0xb0c], ecx
sub eax, 1
je 0xc513e0
sub eax, 1
je 0xc513d4
sub eax, 1
jne 0xc513f0
mov ebx, 0xe1
mov dword [ebp - 0xab8], ebx
mov dword [ebp - 0xaec], ebx
jmp 0xc513f0
mov dword [ebp - 0xab8], 0xf
jmp 0xc513e6
mov dword [ebp - 0xab8], ecx
mov dword [ebp - 0xaec], 0xb
mov esi, 0xdc
mov dword [ebp - 0xa7c], 0x60
push esi
xor ebx, ebx
lea eax, [ebp - 0x71c]
push ebx
push eax
call fcn.00bc259b
add esp, 0xc
mov word [ebp - 0x6d8], si
mov esi, dword [0xd08070]
lea eax, [ebp - 0x71c]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0xd0cffc]
call esi
xor edx, edx
test eax, eax
je 0xc51485
mov eax, dword [ebp - 0x670]
movzx ebx, word [ebp - 0x676]
mov ecx, dword [ebp - 0x66c]
push 0x60
mov dword [ebp - 0xa74], eax
mov dword [ebp - 0xd98], eax
pop eax
mov dword [ebp - 0xa7c], ebx
mov dword [ebp - 0xd9c], edx
mov dword [ebp - 0xda0], edx
mov dword [ebp - 0xa84], ecx
mov dword [ebp - 0xd94], ecx
cmp ebx, eax
jae 0xc5149d
mov dword [ebp - 0xa7c], eax
jmp 0xc5149d
mov eax, dword [ebp - 0xd94]
mov dword [ebp - 0xa84], eax
mov eax, dword [ebp - 0xd98]
mov dword [ebp - 0xa74], eax
mov ebx, dword [ebp - 0xc80]
xor eax, eax
inc eax
cmp edi, eax
je 0xc514b0
mov ebx, dword [ebp - 0xc78]
push 0x5c
push edx
lea eax, [ebp - 0x620]
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov edi, eax
mov dword [ebp - 0xa68], edi
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa88], eax
test eax, eax
jne 0xc51520
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa68], edi
test edi, edi
jle 0xc51510
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa68], edi
test edi, edi
js 0xc515d2
mov ebx, 0x80004005
jmp 0xc51eca
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0xa7c]
push dword [ebp - 0xab8]
call dword [0xd0cffc]
call esi
push ebx
push 0x20
neg eax
mov dword [ebp - 0x610], 0x190
pop edx
lea ecx, [ebp - 0x604]
mov dword [ebp - 0x620], eax
mov byte [ebp - 0x606], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x620]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc515b3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa68], edi
test edi, edi
jle 0xc515a4
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa68], edi
test edi, edi
js 0xc515b9
mov edi, 0x80004005
mov dword [ebp - 0xa68], edi
jmp 0xc515b9
mov dword [ebp - 0x75c], eax
push dword [ebp - 0xa88]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test edi, edi
js 0xc51ec4
mov ebx, dword [ebp - 0xc80]
xor eax, eax
inc eax
cmp dword [ebp - 0xa78], eax
je 0xc515f1
mov ebx, dword [ebp - 0xc78]
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0x5c4]
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov edi, eax
mov dword [ebp - 0xa68], edi
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa88], eax
test eax, eax
jne 0xc5165e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa68], edi
test edi, edi
jle 0xc51653
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa68], edi
test edi, edi
js 0xc51710
jmp 0xc51516
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0xa7c]
push dword [ebp - 0xaec]
call dword [0xd0cffc]
call esi
push ebx
push 0x20
neg eax
mov dword [ebp - 0x5b4], 0x190
pop edx
lea ecx, [ebp - 0x5a8]
mov dword [ebp - 0x5c4], eax
mov byte [ebp - 0x5aa], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x5c4]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc516f1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa68], edi
test edi, edi
jle 0xc516e2
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa68], edi
test edi, edi
js 0xc516f7
mov edi, 0x80004005
mov dword [ebp - 0xa68], edi
jmp 0xc516f7
mov dword [ebp - 0x758], eax
push dword [ebp - 0xa88]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test edi, edi
js 0xc51ec4
mov esi, dword [ebp - 0xa78]
xor edx, edx
mov eax, esi
mov ebx, edx
mov ecx, edx
sub eax, 1
je 0xc51735
sub eax, 1
je 0xc51773
sub eax, 1
jne 0xc51741
mov ebx, dword [ebp - 0xa74]
mov ecx, dword [ebp - 0xa84]
mov dword [ebp - 0xc04], ebx
mov dword [ebp - 0xc00], ecx
xor eax, eax
inc eax
cmp esi, eax
je 0xc517b3
jbe 0xc51787
cmp esi, 3
ja 0xc51787
mov ecx, edx
mov dword [ebp - 0xb0c], edx
mov eax, edx
mov dword [ebp - 0xa74], ecx
mov dword [ebp - 0xab8], edx
jmp 0xc517ca
mov eax, dword [ebp - 0xa74]
push 4
pop ecx
cdq
idiv ecx
xor edx, edx
mov ebx, eax
mov ecx, edx
jmp 0xc51741
mov eax, dword [ebp - 0xbfc]
mov ecx, dword [ebp - 0xbfc]
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0xbfc]
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0xbfc]
mov dword [ebp - 0xa74], ecx
jmp 0xc517ca
mov eax, 0x96
mov dword [ebp - 0xa74], edx
mov ecx, edx
mov dword [ebp - 0xab8], 0x20
mov dword [ebp - 0xab0], eax
push dword [ebp - 0x75c]
mov esi, dword [0xd0803c]
sub ebx, eax
push dword [ebp - 0xa70]
mov edi, dword [ebp - 0x768]
sub ebx, ecx
mov eax, edx
mov dword [ebp - 0x734], ebx
mov ecx, esi
mov dword [ebp - 0x744], ebx
mov dword [ebp - 0xa68], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0xa88], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x74c]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xa70]
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc51849
mov edi, 0x80004005
mov dword [ebp - 0xa68], edi
jmp 0xc5184f
mov edi, dword [ebp - 0xa68]
mov eax, dword [ebp - 0xa88]
test eax, eax
je 0xc51870
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push dword [ebp - 0xa70]
call dword [0xd0cffc]
call esi
test edi, edi
js 0xc51ec4
push dword [ebp - 0x758]
mov esi, dword [0xd0803c]
xor eax, eax
push dword [ebp - 0xa70]
mov edi, dword [ebp - 0x764]
mov ecx, esi
mov dword [ebp - 0xa68], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0xa88], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x73c]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xa70]
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc518e1
mov edi, 0x80004005
mov dword [ebp - 0xa68], edi
jmp 0xc518e7
mov edi, dword [ebp - 0xa68]
mov eax, dword [ebp - 0xa88]
test eax, eax
je 0xc51908
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push dword [ebp - 0xa70]
call dword [0xd0cffc]
call esi
test edi, edi
js 0xc51ec4
mov eax, dword [ebp - 0xa78]
cmp eax, 2
je 0xc51920
cmp eax, 3
jne 0xc51934
mov ebx, dword [ebp - 0x734]
cmp dword [ebp - 0x744], ebx
jle 0xc51934
mov ebx, dword [ebp - 0x744]
cmp dword [ebp - 0x770], 0
mov esi, dword [0xd080a8]
mov ecx, esi
push dword [ebp - 0xb0c]
je 0xc51987
mov eax, ebx
sub eax, dword [ebp - 0x744]
add eax, dword [ebp - 0xa74]
push eax
lea eax, [ebp - 0x74c]
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x740]
add eax, dword [ebp - 0xab8]
push eax
mov eax, ebx
sub eax, dword [ebp - 0x734]
add eax, dword [ebp - 0xa74]
push eax
jmp 0xc519ab
mov edi, dword [ebp - 0xab0]
lea eax, [ebp - 0x74c]
push edi
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x740]
add eax, dword [ebp - 0xab8]
push eax
push edi
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x73c]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xa78]
cmp eax, 2
je 0xc51cbe
cmp eax, 3
je 0xc51cbe
xor edx, edx
inc edx
cmp eax, edx
jne 0xc51cdd
xor eax, eax
mov dword [ebp - 0x750], 0xffffff
push 0x5c
push eax
lea eax, [ebp - 0x568]
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov edi, eax
mov dword [ebp - 0xa68], edi
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa88], eax
test eax, eax
jne 0xc51a5c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa68], edi
test edi, edi
jle 0xc51a51
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa68], edi
test edi, edi
js 0xc51b0f
jmp 0xc51516
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0xa7c]
push 0xb
call dword [0xd0cffc]
call esi
push dword [ebp - 0xc7c]
neg eax
mov dword [ebp - 0x558], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x54c]
mov dword [ebp - 0x568], eax
mov byte [ebp - 0x54e], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x568]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc51af0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xa68], edi
test edi, edi
jle 0xc51ae1
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xa68], edi
test edi, edi
js 0xc51af6
mov edi, 0x80004005
mov dword [ebp - 0xa68], edi
jmp 0xc51af6
mov dword [ebp - 0x754], eax
push dword [ebp - 0xa88]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test edi, edi
js 0xc51ec4
push dword [ebp - 0x754]
mov esi, dword [0xd0803c]
xor eax, eax
push dword [ebp - 0xa70]
mov edi, dword [ebp - 0x760]
mov ecx, esi
mov dword [ebp - 0x724], ebx
mov dword [ebp - 0xa68], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ebx, eax
xor eax, eax
mov ecx, esi
push eax
push 0x460
lea eax, [ebp - 0x72c]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xa70]
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc51b82
mov edi, 0x80004005
mov dword [ebp - 0xa68], edi
jmp 0xc51b88
mov edi, dword [ebp - 0xa68]
test ebx, ebx
je 0xc51ba3
mov esi, dword [0xd0803c]
mov ecx, esi
push ebx
push dword [ebp - 0xa70]
call dword [0xd0cffc]
call esi
test edi, edi
js 0xc51ec4
mov eax, dword [ebp - 0x724]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x724], eax
cmp eax, ecx
jge 0xc51bc7
mov dword [ebp - 0x724], ecx
mov ebx, dword [ebp - 0xa7c]
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x60
pop edi
push edi
push ebx
push dword [ebp - 0x72c]
mov dword [ebp - 0x720], 0x20
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x728]
mov dword [ebp - 0x72c], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x728], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x720]
mov dword [ebp - 0x724], eax
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0x770], 0
mov dword [ebp - 0x720], eax
je 0xc51c93
mov ecx, dword [ebp - 0x74c]
cmp ecx, dword [ebp - 0x73c]
jl 0xc51c6f
mov ecx, dword [ebp - 0x73c]
mov eax, dword [ebp - 0x730]
add eax, 0x24
mov esi, dword [0xd080a8]
push eax
push ecx
lea eax, [ebp - 0x72c]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
jmp 0xc51cda
mov ecx, dword [ebp - 0x744]
cmp ecx, dword [ebp - 0x734]
jg 0xc51ca7
mov ecx, dword [ebp - 0x734]
mov eax, dword [ebp - 0x730]
sub ecx, dword [ebp - 0x724]
add eax, 0x24
add ecx, dword [ebp - 0x72c]
jmp 0xc51c78
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0xc04], ebx
mov dword [ebp - 0xc00], eax
mov dword [ebp - 0x750], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x770]
lea edi, [ebp - 0xea4]
mov ebx, dword [ebp - 0xc04]
mov dword [ebp - 0xa88], eax
mov eax, dword [ebp - 0xc00]
mov dword [ebp - 0xa84], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xa78]
sub eax, 1
je 0xc51eb4
sub eax, 1
je 0xc51de5
sub eax, 1
jne 0xc51dde
mov esi, dword [0xd080a4]
lea edi, [ebp - 0x430]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08084]
lea ecx, [ebp - 0x430]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x430], 0x28
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc51dde
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x41c]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x414]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x414]
lea esi, [ebp - 0x41c]
sub eax, ebx
lea edi, [ebp - 0xea4]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc0c], eax
mov eax, dword [ebp - 0x410]
sub eax, dword [ebp - 0xa84]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
mov dword [ebp - 0xc08], eax
xor ebx, ebx
jmp 0xc51eca
mov esi, dword [0xd080a4]
lea edi, [ebp - 0x3d8]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08084]
lea ecx, [ebp - 0x3d8]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x3d8], 0x28
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc51dde
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x3c4]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x3bc]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xa88], 0
lea esi, [ebp - 0x3c4]
lea edi, [ebp - 0xea4]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xc51e8c
imul eax, dword [ebp - 0x3bc], 5
cdq
idiv ecx
add eax, dword [ebp - 0x3c4]
jmp 0xc51e9a
mov eax, dword [ebp - 0x3bc]
sub eax, ebx
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0xc0c], eax
mov eax, dword [ebp - 0x3b8]
sub eax, dword [ebp - 0xa84]
imul eax, eax, 0x5f
jmp 0xc51dd5
xor ebx, ebx
mov dword [ebp - 0xc0c], ebx
mov dword [ebp - 0xc08], ebx
jmp 0xc51eca
mov ebx, dword [ebp - 0xa68]
push dword [ebp - 0xa70]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xc51eeb
mov ebx, dword [ebp - 0xa68]
xor esi, esi
mov edi, 0xd0aed4
inc esi
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc51ef3
mov eax, dword [0xd0a150]
test eax, eax
jle 0xc51f58
sub eax, 1
mov dword [0xd0a150], eax
jne 0xc51f58
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc51f27
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc51f16
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0xd0aed4
inc esi
xor eax, eax
xchg dword [edi], eax
mov eax, dword [ebp - 0xaa0]
test eax, eax
je 0xc51f77
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc535d2
mov edi, dword [ebp - 0xc0c]
xor eax, eax
mov ebx, dword [ebp - 0xc08]
push 0x54
push eax
lea eax, [ebp - 0x7c4]
mov dword [ebp - 0xd70], edi
push eax
mov dword [ebp - 0xd6c], ebx
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0xa84], esi
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push dword [ebp - 0xac4]
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc52012
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x7c4]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc52012
push 0x20
pop eax
cmp word [ebp - 0x7b2], ax
jne 0xc52012
cmp dword [ebp - 0x7b0], 0
je 0xc52012
cmp dword [ebp - 0x7c0], 0
jle 0xc52012
cmp dword [ebp - 0x7bc], 0
jg 0xc52023
xor eax, eax
cmp dword [ebp - 0xa78], 1
mov dword [ebp - 0xa84], eax
jne 0xc5208d
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x74c]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x73c]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ebx, dword [ebp - 0xa78]
cmp ebx, 1
jne 0xc52093
mov eax, dword [ebp - 0x76c]
mov esi, dword [0xd08014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xaf4], eax
jmp 0xc52093
mov ebx, dword [ebp - 0xa78]
mov esi, dword [0xd08040]
mov ecx, esi
push 1
push dword [ebp - 0xac4]
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0x770], 0
mov dword [ebp - 0xbd4], eax
mov dword [ebp - 0xae0], 0x810
je 0xc520ce
mov dword [ebp - 0xae0], 0x20812
cmp dword [ebp - 0xa84], 0
je 0xc52be6
mov eax, dword [ebp - 0x76c]
mov ebx, dword [ebp - 0x768]
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0xa88], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x914]
push eax
call fcn.00bc259b
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa64]
push eax
call fcn.00bc259b
xor ecx, ecx
lea eax, [ebp - 0x4b4]
push 0x2c
push ecx
push eax
mov dword [ebp - 0xaac], ecx
mov dword [ebp - 0xa80], ecx
mov dword [ebp - 0xa74], ecx
mov dword [ebp - 0xa84], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x370]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xc535b2
mov edi, dword [ebp - 0xac4]
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc52183
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc535b2
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x914]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc521c5
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0xa74], eax
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0xa84], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xac0], eax
test eax, eax
je 0xc52178
mov edi, dword [ebp - 0x740]
xor eax, eax
mov esi, dword [ebp - 0x744]
sub edi, dword [ebp - 0x748]
sub esi, dword [ebp - 0x74c]
push 0x2c
push eax
mov dword [ebp - 0xd00], eax
mov dword [ebp - 0xab8], eax
lea eax, [ebp - 0x4b4]
push eax
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0x4b0], esi
mov esi, dword [0xd0800c]
xor eax, eax
inc eax
mov dword [ebp - 0x4b4], 0x28
mov word [ebp - 0x4a8], ax
xor ecx, ecx
push 0x20
pop eax
push ecx
push ecx
mov word [ebp - 0x4a6], ax
neg edi
lea eax, [ebp - 0xd00]
mov dword [ebp - 0x4ac], edi
mov edi, dword [ebp - 0xac0]
push eax
push ecx
lea eax, [ebp - 0x4b4]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa94], eax
test eax, eax
jne 0xc522ad
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xab8], eax
test eax, eax
jle 0xc52298
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xab8], eax
test eax, eax
js 0xc52637
mov dword [ebp - 0xab8], 0x80004005
jmp 0xc52637
mov esi, dword [0xd08034]
lea ecx, [ebp - 0xa64]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc522d7
mov eax, dword [ebp - 0xa50]
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0x744]
sub eax, dword [ebp - 0x74c]
push dword [ebp - 0xa94]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x740]
sub eax, dword [ebp - 0x748]
push edi
mov dword [ebp - 0x364], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0xa88]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xad8], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x370]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xae0]
lea eax, [ebp - 0x370]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa78], eax
jne 0xc523ce
cmp dword [ebp - 0xa90], 0
je 0xc523c2
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa98], eax
jmp 0xc523d8
mov dword [ebp - 0xa98], 0xffffff
jmp 0xc523d8
mov dword [ebp - 0xa98], 0xffa8a8a8
mov edi, dword [ebp - 0x74c]
xor edx, edx
mov eax, dword [ebp - 0x748]
mov esi, edx
mov dword [ebp - 0xa9c], edi
mov ecx, edx
test edi, edi
jns 0xc52400
mov esi, edi
mov dword [ebp - 0xa9c], edx
neg esi
mov edi, edx
test eax, eax
jns 0xc5240a
mov ecx, eax
mov eax, edx
neg ecx
mov ebx, dword [ebp - 0x368]
mov edx, dword [ebp - 0xa74]
sub ebx, esi
sub edx, edi
mov dword [ebp - 0xab0], ebx
cmp ebx, edx
jl 0xc5242c
mov ebx, edx
mov dword [ebp - 0xab0], edx
mov edi, dword [ebp - 0x364]
mov edx, dword [ebp - 0xa84]
sub edi, ecx
sub edx, eax
mov dword [ebp - 0xaa0], edi
cmp edi, edx
jl 0xc5244e
mov edi, edx
mov dword [ebp - 0xaa0], edx
test ebx, ebx
jle 0xc525ff
test edi, edi
jle 0xc525ff
mov edx, dword [ebp - 0x368]
mov ebx, dword [ebp - 0xaac]
imul ecx, edx
add ecx, esi
mov esi, dword [ebp - 0xa80]
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xa74]
imul eax, esi
mov dword [ebp - 0xac8], ecx
add eax, dword [ebp - 0xa9c]
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xab0]
mov dword [ebp - 0xa9c], eax
test edi, edi
jle 0xc525ff
shl edx, 2
shl esi, 2
mov dword [ebp - 0xa88], edx
mov dword [ebp - 0xa90], esi
test ebx, ebx
jle 0xc525e0
mov esi, eax
mov dword [ebp - 0xa80], ebx
lea edx, [eax + 3]
sub esi, ecx
mov dword [ebp - 0xa7c], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xa84], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc525a0
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xa98]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xa7c]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xa98]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa7c]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xa96]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa7c]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xa84]
cdq
idiv ecx
mov edx, dword [ebp - 0xa7c]
add al, bl
mov ebx, dword [ebp - 0xa80]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xa7c], edx
mov dword [ebp - 0xa80], ebx
jne 0xc524da
mov edi, dword [ebp - 0xaa0]
mov ebx, dword [ebp - 0xab0]
mov ecx, dword [ebp - 0xac8]
mov eax, dword [ebp - 0xa9c]
mov edx, dword [ebp - 0xa88]
mov esi, dword [ebp - 0xa90]
add ecx, edx
add eax, esi
sub edi, 1
mov dword [ebp - 0xac8], ecx
mov dword [ebp - 0xa9c], eax
mov dword [ebp - 0xaa0], edi
jne 0xc524b6
push dword [ebp - 0xa94]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xad8]
mov edi, dword [ebp - 0xac0]
test eax, eax
je 0xc52637
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xab8], 0
jl 0xc535b2
mov eax, dword [ebp - 0x76c]
mov ebx, dword [ebp - 0x764]
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0xa88], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x8c0]
push eax
call fcn.00bc259b
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa10]
push eax
call fcn.00bc259b
xor ecx, ecx
lea eax, [ebp - 0x488]
push 0x2c
push ecx
push eax
mov dword [ebp - 0xaac], ecx
mov dword [ebp - 0xa80], ecx
mov dword [ebp - 0xa74], ecx
mov dword [ebp - 0xa84], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x390]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xc535b2
mov edi, dword [ebp - 0xac4]
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc52178
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x8c0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc52738
mov eax, dword [ebp - 0x8ac]
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0xa74], eax
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0xa84], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa94], eax
test eax, eax
je 0xc52178
mov edi, dword [ebp - 0x730]
xor eax, eax
mov esi, dword [ebp - 0x734]
sub edi, dword [ebp - 0x738]
sub esi, dword [ebp - 0x73c]
push 0x2c
push eax
mov dword [ebp - 0xd04], eax
mov dword [ebp - 0xab8], eax
lea eax, [ebp - 0x488]
push eax
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0x484], esi
mov esi, dword [0xd0800c]
xor eax, eax
inc eax
mov dword [ebp - 0x488], 0x28
mov word [ebp - 0x47c], ax
xor ecx, ecx
push 0x20
pop eax
push ecx
push ecx
mov word [ebp - 0x47a], ax
neg edi
lea eax, [ebp - 0xd04]
mov dword [ebp - 0x480], edi
mov edi, dword [ebp - 0xa94]
push eax
push ecx
lea eax, [ebp - 0x488]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xad8], eax
test eax, eax
jne 0xc52824
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xab8], eax
test eax, eax
jle 0xc5280f
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xab8], eax
test eax, eax
js 0xc52bbd
mov dword [ebp - 0xab8], 0x80004005
jmp 0xc52bbd
mov esi, dword [0xd08034]
lea ecx, [ebp - 0xa10]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc5284e
mov eax, dword [ebp - 0x9fc]
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0x734]
sub eax, dword [ebp - 0x73c]
push dword [ebp - 0xad8]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x730]
sub eax, dword [ebp - 0x738]
push edi
mov dword [ebp - 0x384], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0xa88]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xaec], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x390]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xae0]
lea eax, [ebp - 0x390]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa78], eax
jne 0xc5294d
cmp dword [ebp - 0xa90], 0
je 0xc52941
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov ebx, eax
mov dword [ebp - 0xaa8], ebx
mov dword [ebp - 0xab0], ebx
jmp 0xc5295e
mov dword [ebp - 0xab0], 0xffffff
jmp 0xc5295e
mov eax, 0xffa8a8a8
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0xab0], eax
mov edi, dword [ebp - 0x73c]
xor ebx, ebx
mov eax, dword [ebp - 0x738]
mov edx, ebx
mov dword [ebp - 0xa9c], edi
mov ecx, ebx
test edi, edi
jns 0xc52986
mov edx, edi
mov dword [ebp - 0xa9c], ebx
neg edx
mov edi, ebx
test eax, eax
jns 0xc52990
mov ecx, eax
mov eax, ebx
neg ecx
mov ebx, dword [ebp - 0x388]
mov esi, dword [ebp - 0xa74]
sub ebx, edx
sub esi, edi
mov dword [ebp - 0xaa0], ebx
cmp ebx, esi
jl 0xc529b2
mov ebx, esi
mov dword [ebp - 0xaa0], esi
mov edi, dword [ebp - 0x384]
mov esi, dword [ebp - 0xa84]
sub edi, ecx
sub esi, eax
mov dword [ebp - 0xac0], edi
cmp edi, esi
jl 0xc529d4
mov edi, esi
mov dword [ebp - 0xac0], esi
test ebx, ebx
jle 0xc52b85
test edi, edi
jle 0xc52b85
mov esi, dword [ebp - 0x388]
mov ebx, dword [ebp - 0xaac]
imul ecx, esi
add ecx, edx
mov edx, dword [ebp - 0xa80]
lea ecx, [edx + ecx*4]
mov edx, dword [ebp - 0xa74]
imul eax, edx
mov dword [ebp - 0xac8], ecx
add eax, dword [ebp - 0xa9c]
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xaa0]
mov dword [ebp - 0xa9c], eax
test edi, edi
jle 0xc52b85
shl esi, 2
shl edx, 2
mov dword [ebp - 0xa88], esi
mov dword [ebp - 0xa90], edx
test ebx, ebx
jle 0xc52b66
mov esi, eax
mov dword [ebp - 0xa80], ebx
lea edx, [eax + 3]
sub esi, ecx
mov dword [ebp - 0xa98], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xa84], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc52b26
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xaa8]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xa98]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xaa8]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa98]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xaae]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa98]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xa84]
cdq
idiv ecx
mov edx, dword [ebp - 0xa98]
add al, bl
mov ebx, dword [ebp - 0xa80]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xa98], edx
mov dword [ebp - 0xa80], ebx
jne 0xc52a60
mov edi, dword [ebp - 0xac0]
mov ebx, dword [ebp - 0xaa0]
mov ecx, dword [ebp - 0xac8]
mov eax, dword [ebp - 0xa9c]
mov esi, dword [ebp - 0xa88]
mov edx, dword [ebp - 0xa90]
add ecx, esi
add eax, edx
sub edi, 1
mov dword [ebp - 0xac8], ecx
mov dword [ebp - 0xa9c], eax
mov dword [ebp - 0xac0], edi
jne 0xc52a3c
push dword [ebp - 0xad8]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xaec]
mov edi, dword [ebp - 0xa94]
test eax, eax
je 0xc52bbd
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xab8], 0
jl 0xc535b2
mov edi, dword [ebp - 0xab4]
jmp 0xc53b9e
xor edx, edx
inc edx
cmp dword [ebp - 0x76c], 0
jne 0xc52bfa
cmp ebx, edx
je 0xc52bfa
mov al, 0xc0
jmp 0xc52bfc
or al, 0xff
mov byte [ebp - 0xad6], al
lea edi, [ebp - 0xcb8]
xor eax, eax
mov esi, dword [0xd08008]
stosd dword es:[edi], eax
xor ecx, ecx
push dword [ebp - 0xac4]
mov byte [ebp - 0xad8], cl
mov byte [ebp - 0xad7], cl
mov ecx, esi
stosd dword es:[edi], eax
mov byte [ebp - 0xad5], dl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xca8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xab4], eax
test eax, eax
jne 0xc52c59
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc535b2
xor eax, eax
inc eax
cmp ebx, eax
jne 0xc52d56
mov eax, dword [ebp - 0x744]
mov ecx, dword [ebp - 0x734]
mov ebx, dword [ebp - 0x74c]
sub eax, ebx
mov edi, dword [ebp - 0x73c]
sub ecx, edi
cmp ecx, eax
jle 0xc52c8e
mov edx, ecx
mov dword [ebp - 0xaa4], edx
jmp 0xc52c96
mov edx, eax
mov dword [ebp - 0xaa4], eax
mov esi, dword [ebp - 0x730]
sub esi, dword [ebp - 0x748]
cmp dword [ebp - 0x770], 0
mov dword [ebp - 0xaf8], esi
je 0xc52ccf
sub ebx, dword [ebp - 0x744]
sub edi, dword [ebp - 0x734]
add ebx, edx
add edi, edx
mov dword [ebp - 0xcb8], ebx
mov dword [ebp - 0xca8], edi
jmp 0xc52cdb
mov ebx, dword [ebp - 0xcb8]
mov edi, dword [ebp - 0xca8]
add eax, ebx
mov dword [ebp - 0xa74], ebx
mov ebx, dword [ebp - 0x738]
sub ebx, dword [ebp - 0x748]
mov dword [ebp - 0xa98], eax
mov dword [ebp - 0xcb0], eax
mov eax, dword [ebp - 0x740]
sub eax, dword [ebp - 0x748]
mov dword [ebp - 0xab0], ebx
mov dword [ebp - 0xca4], ebx
sub ebx, dword [ebp - 0x738]
mov dword [ebp - 0xa68], edi
add edi, ecx
add ebx, dword [ebp - 0x730]
mov dword [ebp - 0xa70], ebx
mov dword [ebp - 0xc9c], ebx
mov ebx, dword [ebp - 0xaa4]
mov dword [ebp - 0xab8], eax
mov dword [ebp - 0xcac], eax
mov dword [ebp - 0xadc], edi
mov dword [ebp - 0xca0], edi
jmp 0xc52de8
mov eax, dword [ebp - 0xc00]
lea esi, [ebp - 0x74c]
lea edi, [ebp - 0xcb8]
mov ebx, dword [ebp - 0xc04]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xaf8], eax
mov dword [ebp - 0xaa4], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xcac]
lea esi, [ebp - 0x73c]
lea edi, [ebp - 0xca8]
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0xcb0]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xa98], eax
mov eax, dword [ebp - 0xcb8]
mov dword [ebp - 0xa74], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xc9c]
mov esi, dword [ebp - 0xaf8]
mov dword [ebp - 0xa70], eax
mov eax, dword [ebp - 0xca0]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0xca4]
mov dword [ebp - 0xab0], eax
mov eax, dword [ebp - 0xca8]
mov dword [ebp - 0xa68], eax
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd08], eax
lea eax, [ebp - 0x45c]
push eax
call fcn.00bc259b
mov edi, dword [ebp - 0xab4]
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x45c], 0x28
inc eax
mov dword [ebp - 0x458], ebx
mov word [ebp - 0x450], ax
xor ecx, ecx
push 0x20
pop eax
push ecx
push ecx
mov word [ebp - 0x44e], ax
neg esi
lea eax, [ebp - 0xd08]
mov dword [ebp - 0x454], esi
mov esi, dword [0xd0800c]
push eax
push ecx
lea eax, [ebp - 0x45c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xabc], eax
test eax, eax
jne 0xc52e6d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc5359d
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa78], eax
jne 0xc52ede
mov ecx, dword [ebp - 0xaf4]
test ecx, ecx
je 0xc52ede
mov esi, dword [0xd08074]
lea edi, [ebp - 0x3ac]
xor eax, eax
stosd dword es:[edi], eax
push ecx
mov ecx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0xaf8]
mov dword [ebp - 0x3a4], eax
lea eax, [ebp - 0x3b0]
push eax
mov eax, dword [ebp - 0xab4]
push eax
mov dword [ebp - 0x3a8], ebx
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x76c]
mov ebx, dword [ebp - 0x768]
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0xa88], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x86c]
push eax
call fcn.00bc259b
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x9bc]
push eax
call fcn.00bc259b
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xa80], eax
mov dword [ebp - 0xa84], eax
mov dword [ebp - 0xaec], eax
mov dword [ebp - 0xa7c], eax
lea eax, [ebp - 0x50c]
push eax
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x360]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xab4]
test ebx, ebx
je 0xc53582
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc52f86
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc53582
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x86c]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc52fc8
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0x868]
mov dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0xa7c], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xae8], eax
test eax, eax
je 0xc52f7b
mov esi, dword [ebp - 0xab8]
xor eax, eax
sub esi, dword [ebp - 0xcb4]
mov edi, dword [ebp - 0xa74]
sub dword [ebp - 0xa98], edi
push 0x2c
push eax
mov dword [ebp - 0xd0c], eax
mov dword [ebp - 0xb0c], eax
lea eax, [ebp - 0x50c]
push eax
mov dword [ebp - 0xab8], esi
call fcn.00bc259b
mov eax, dword [ebp - 0xa98]
add esp, 0xc
mov dword [ebp - 0x508], eax
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x50c], 0x28
inc eax
neg esi
push 0x20
mov word [ebp - 0x500], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x4fe], ax
lea eax, [ebp - 0xd0c]
push eax
push ecx
lea eax, [ebp - 0x50c]
mov dword [ebp - 0x504], esi
mov esi, dword [0xd0800c]
mov ecx, esi
push eax
push dword [ebp - 0xae8]
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa94], eax
test eax, eax
jne 0xc530bb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xb0c], eax
test eax, eax
jle 0xc530a6
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb0c], eax
test eax, eax
js 0xc5344f
mov dword [ebp - 0xb0c], 0x80004005
jmp 0xc5344f
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x9bc]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc530e5
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0xa84], eax
push dword [ebp - 0xa94]
mov eax, dword [ebp - 0xa98]
push dword [ebp - 0xae8]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0xab8]
mov dword [ebp - 0x354], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xae8]
call dword [0xd0cffc]
call esi
push dword [ebp - 0xa88]
mov esi, dword [0xd0803c]
mov ecx, esi
push dword [ebp - 0xae8]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xa88], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x360]
push eax
push dword [ebp - 0xae8]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xae0]
lea eax, [ebp - 0x360]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push dword [ebp - 0xae8]
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa78], eax
jne 0xc531e9
cmp dword [ebp - 0xa90], 0
je 0xc531dd
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa98], eax
jmp 0xc531f3
mov dword [ebp - 0xa98], 0xffffff
jmp 0xc531f3
mov dword [ebp - 0xa98], 0xffa8a8a8
xor edx, edx
mov esi, edx
mov eax, edx
test edi, edi
jns 0xc53203
mov esi, edi
mov edi, edx
neg esi
mov ecx, dword [ebp - 0xcb4]
test ecx, ecx
jns 0xc53213
mov eax, ecx
mov ecx, edx
neg eax
mov ebx, dword [ebp - 0x358]
mov edx, dword [ebp - 0xaec]
sub ebx, esi
sub edx, edi
mov dword [ebp - 0xa9c], ebx
cmp ebx, edx
jl 0xc53235
mov ebx, edx
mov dword [ebp - 0xa9c], edx
mov edx, dword [ebp - 0x354]
sub dword [ebp - 0xa7c], ecx
sub edx, eax
mov dword [ebp - 0xa74], edx
cmp edx, dword [ebp - 0xa7c]
jl 0xc5325d
mov edx, dword [ebp - 0xa7c]
mov dword [ebp - 0xa74], edx
test ebx, ebx
jle 0xc53418
test edx, edx
jle 0xc53418
imul eax, dword [ebp - 0x358]
imul ecx, dword [ebp - 0xaec]
add eax, esi
mov esi, dword [ebp - 0xa84]
add ecx, edi
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xa80]
mov dword [ebp - 0xaa0], eax
lea ecx, [esi + ecx*4]
mov dword [ebp - 0xac0], ecx
test edx, edx
jle 0xc53418
mov esi, dword [ebp - 0x358]
shl esi, 2
mov dword [ebp - 0xaac], esi
mov esi, dword [ebp - 0xaec]
shl esi, 2
mov dword [ebp - 0xac8], esi
mov esi, dword [ebp - 0xaac]
mov edi, dword [ebp - 0xac8]
test ebx, ebx
jle 0xc533f9
mov esi, ecx
mov dword [ebp - 0xa80], ebx
lea edx, [ecx + 3]
sub esi, eax
mov dword [ebp - 0xa7c], edx
lea edi, [eax + 2]
mov dword [ebp - 0xa84], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc533b9
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xa98]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xa7c]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xa98]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa7c]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xa96]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa7c]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xa84]
cdq
idiv ecx
mov edx, dword [ebp - 0xa7c]
add al, bl
mov ebx, dword [ebp - 0xa80]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xa7c], edx
mov dword [ebp - 0xa80], ebx
jne 0xc532f3
mov edx, dword [ebp - 0xa74]
mov ebx, dword [ebp - 0xa9c]
mov eax, dword [ebp - 0xaa0]
mov ecx, dword [ebp - 0xac0]
mov esi, dword [ebp - 0xaac]
mov edi, dword [ebp - 0xac8]
add eax, esi
add ecx, edi
sub edx, 1
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0xac0], ecx
mov dword [ebp - 0xa74], edx
jne 0xc532cf
push dword [ebp - 0xa94]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xa88]
test eax, eax
je 0xc5344f
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push dword [ebp - 0xae8]
call dword [0xd0cffc]
call esi
push dword [ebp - 0xae8]
mov esi, dword [0xd08018]
mov ecx, esi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xb0c], 0
jl 0xc5357c
mov eax, dword [ebp - 0x76c]
mov ebx, dword [ebp - 0x764]
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0xa88], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x818]
push eax
call fcn.00bc259b
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x968]
push eax
call fcn.00bc259b
xor ecx, ecx
lea eax, [ebp - 0x4e0]
push 0x2c
push ecx
push eax
mov dword [ebp - 0xaac], ecx
mov dword [ebp - 0xa9c], ecx
mov dword [ebp - 0xab8], ecx
mov dword [ebp - 0xa84], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x380]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xab4]
test ebx, ebx
je 0xc53582
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc52f7b
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x818]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc53555
mov eax, dword [ebp - 0x804]
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0xa84], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov edi, eax
mov dword [ebp - 0xb0c], edi
test edi, edi
jne 0xc5367f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, dword [ebp - 0xab4]
mov eax, dword [ebp - 0xabc]
test eax, eax
je 0xc5359d
mov esi, dword [0xd0801c]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
test edi, edi
je 0xc535b2
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xaf4]
test eax, eax
je 0xc535cd
mov esi, dword [0xd0801c]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov edi, 0xd0aed4
mov ebx, dword [ebp - 0x768]
xor edx, edx
test ebx, ebx
je 0xc53625
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0xc535e1
mov eax, dword [ebp - 0x768]
sub ebx, ecx
sar ebx, 1
lea ebx, [ebx*2 + 2]
test ebx, ebx
je 0xc53609
mov byte [eax], dl
inc eax
sub ebx, 1
jne 0xc53601
push dword [ebp - 0x768]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0x768], edx
mov ebx, dword [ebp - 0x764]
test ebx, ebx
je 0xc53bbf
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0xc53636
mov eax, dword [ebp - 0x764]
sub ebx, ecx
sar ebx, 1
lea ebx, [ebx*2 + 2]
test ebx, ebx
je 0xc5365e
mov byte [eax], dl
inc eax
sub ebx, 1
jne 0xc53656
push dword [ebp - 0x764]
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x764], ebx
jmp 0xc53bc1
mov eax, dword [ebp - 0xadc]
sub eax, dword [ebp - 0xa68]
mov esi, dword [ebp - 0xa70]
sub esi, dword [ebp - 0xab0]
mov dword [ebp - 0xadc], eax
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd10], eax
mov dword [ebp - 0xaec], eax
lea eax, [ebp - 0x4e0]
push eax
mov dword [ebp - 0xa70], esi
call fcn.00bc259b
mov eax, dword [ebp - 0xadc]
add esp, 0xc
mov dword [ebp - 0x4dc], eax
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x4e0], 0x28
inc eax
neg esi
push 0x20
mov word [ebp - 0x4d4], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x4d2], ax
lea eax, [ebp - 0xd10]
push eax
push ecx
lea eax, [ebp - 0x4e0]
mov dword [ebp - 0x4d8], esi
mov esi, dword [0xd0800c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xa94], eax
test eax, eax
jne 0xc53758
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xaec], eax
test eax, eax
jle 0xc53743
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xaec], eax
test eax, eax
js 0xc53af7
mov dword [ebp - 0xaec], 0x80004005
jmp 0xc53af7
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x968]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc53782
mov eax, dword [ebp - 0x954]
mov dword [ebp - 0xa9c], eax
push dword [ebp - 0xa94]
mov eax, dword [ebp - 0xadc]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0xa70]
push edi
mov dword [ebp - 0x374], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0xa88]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xa88], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x380]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xae0]
lea eax, [ebp - 0x380]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa78], eax
jne 0xc53875
cmp dword [ebp - 0xa90], 0
je 0xc53869
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov edx, eax
mov dword [ebp - 0xaa8], edx
mov dword [ebp - 0xa74], edx
jmp 0xc53886
mov dword [ebp - 0xa74], 0xffffff
jmp 0xc53886
mov eax, 0xffa8a8a8
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0xa74], eax
mov ecx, dword [ebp - 0xa68]
xor ebx, ebx
mov dword [ebp - 0xa80], ebx
mov esi, ebx
mov eax, ebx
test ecx, ecx
jns 0xc538a8
mov esi, ecx
mov ecx, ebx
neg esi
mov dword [ebp - 0xa80], esi
mov edx, dword [ebp - 0xab0]
test edx, edx
jns 0xc538b8
mov eax, edx
mov edx, ebx
neg eax
mov ebx, dword [ebp - 0x378]
sub ebx, esi
mov esi, dword [ebp - 0xab8]
sub esi, ecx
mov dword [ebp - 0xab0], ebx
cmp ebx, esi
jl 0xc538da
mov ebx, esi
mov dword [ebp - 0xab0], esi
mov edi, dword [ebp - 0x374]
mov esi, dword [ebp - 0xa84]
sub edi, eax
sub esi, edx
mov dword [ebp - 0xaa0], edi
cmp edi, esi
jl 0xc538fc
mov edi, esi
mov dword [ebp - 0xaa0], esi
test ebx, ebx
jle 0xc53abf
test edi, edi
jle 0xc53abf
imul edx, dword [ebp - 0xab8]
mov esi, dword [ebp - 0x378]
mov ebx, dword [ebp - 0xa9c]
imul eax, esi
add edx, ecx
mov ecx, dword [ebp - 0xaac]
add eax, dword [ebp - 0xa80]
lea ecx, [ecx + edx*4]
mov dword [ebp - 0xac0], ecx
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xab0]
mov dword [ebp - 0xac8], eax
test edi, edi
jle 0xc53abf
mov edx, esi
shl edx, 2
mov dword [ebp - 0xa9c], edx
mov edx, dword [ebp - 0xab8]
shl edx, 2
mov dword [ebp - 0xaac], edx
mov edx, dword [ebp - 0xa9c]
mov esi, dword [ebp - 0xaac]
test ebx, ebx
jle 0xc53aa0
mov esi, ecx
mov dword [ebp - 0xa80], ebx
lea edx, [ecx + 3]
sub esi, eax
mov dword [ebp - 0xa98], edx
lea edi, [eax + 2]
mov dword [ebp - 0xa84], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc53a60
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xaa8]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xa98]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xaa8]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa98]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xa72]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa98]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xa84]
cdq
idiv ecx
mov edx, dword [ebp - 0xa98]
add al, bl
mov ebx, dword [ebp - 0xa80]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xa98], edx
mov dword [ebp - 0xa80], ebx
jne 0xc5399a
mov edi, dword [ebp - 0xaa0]
mov ebx, dword [ebp - 0xab0]
mov eax, dword [ebp - 0xac8]
mov ecx, dword [ebp - 0xac0]
mov edx, dword [ebp - 0xa9c]
mov esi, dword [ebp - 0xaac]
add eax, edx
add ecx, esi
sub edi, 1
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xac0], ecx
mov dword [ebp - 0xaa0], edi
jne 0xc53976
push dword [ebp - 0xa94]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xa88]
mov edi, dword [ebp - 0xb0c]
test eax, eax
je 0xc53af7
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xaec], 0
jl 0xc5357c
mov edi, dword [ebp - 0xab4]
xor eax, eax
inc eax
cmp dword [ebp - 0xa78], eax
jne 0xc53b61
mov esi, dword [section..data]
xor eax, eax
push 0xcc0020
push eax
push eax
mov eax, dword [ebp - 0xaa4]
mov ecx, esi
push edi
push dword [ebp - 0xaf8]
push eax
push dword [ebp - 0x748]
push dword [ebp - 0x74c]
push dword [ebp - 0xac4]
call dword [0xd0cffc]
call esi
jmp 0xc53b9e
push dword [ebp - 0xad8]
mov ecx, dword [ebp - 0xaf8]
xor edx, edx
mov eax, dword [ebp - 0xaa4]
mov esi, dword [0xd08020]
push ecx
push eax
push edx
push edx
push edi
push ecx
push eax
push dword [ebp - 0xc08]
mov ecx, esi
push dword [ebp - 0xc0c]
push dword [ebp - 0xac4]
call dword [0xd0cffc]
call esi
push dword [ebp - 0xbd4]
mov esi, dword [0xd08040]
mov ecx, esi
push dword [ebp - 0xac4]
call dword [0xd0cffc]
call esi
jmp 0xc53582
xor ebx, ebx
mov edx, dword [ebp - 0x760]
test edx, edx
je 0xc53c0d
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc53bd0
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc53bf8
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xc53bea
mov edx, dword [ebp - 0x760]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x760], ebx
cmp dword [ebp - 0x75c], 0
je 0xc53c32
push dword [ebp - 0x75c]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x75c], ebx
cmp dword [ebp - 0x758], 0
je 0xc53c57
push dword [ebp - 0x758]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x758], ebx
cmp dword [ebp - 0x754], 0
je 0xc53c7c
push dword [ebp - 0x754]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x754], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc53c7e
mov eax, dword [0xd0a150]
push 0
pop ebx
test eax, eax
jle 0xc53ce0
sub eax, 1
mov dword [0xd0a150], eax
jne 0xc53ce0
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc53cb4
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc53ca3
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xd0aed4
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0xd09360]
mov esi, dword [0xd0804c]
mov ecx, esi
mov dword [ebp - 0xa80], eax
call dword [0xd0cffc]
call esi
sub eax, dword [0xd09358]
lea edi, [ebp - 0x2ec]
push 8
mov dword [ebp - 0xa84], eax
mov esi, 0xd0aed4
xor eax, eax
xor ebx, ebx
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xc53d1f
mov eax, dword [0xd0a150]
push 0
pop ebx
test eax, eax
jne 0xc54316
push 0x338
mov esi, ebx
mov dword [ebp - 0xa74], ebx
push ebx
mov dword [ebp - 0xa78], ebx
mov dword [ebp - 0xaa4], esi
mov dword [ebp - 0xc30], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xc34], eax
test eax, eax
je 0xc5430a
or dword [ebp - 0xbac], 0xffffffff
mov edi, ebx
add eax, 7
mov dword [ebp - 0xabc], ebx
mov cl, bl
mov dword [ebp - 0xb2c], ebx
mov dword [ebp - 0xb5c], edi
mov dword [ebp - 0xbf8], eax
mov esi, dword [ebp - 0xbec]
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edx, eax
mov dword [ebp - 0xa88], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl edx, 8
mov ebx, 0xab69605e
or edx, eax
movzx eax, byte [esi + 5]
shl edx, 8
add esi, 8
or edx, eax
mov dword [ebp - 0xbec], esi
mov esi, edx
mov dword [ebp - 0xa90], edx
xor esi, dword [ebp - 0xb2c]
xor esi, edi
xor esi, 0xac987321
mov edx, esi
rol edx, 0xa
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul eax, eax, 0x137f
add edx, eax
xor edi, edx
mov edx, edi
rol edx, 2
lea eax, [edi + 0x7f1137f]
ror eax, 9
imul eax, eax, 0xab69
sub eax, edx
xor esi, eax
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0xab69
rol edx, 2
rol eax, 6
imul eax, eax, 0x7f1
sub eax, edx
xor esi, eax
mov eax, 0x7f1137f
mov edx, esi
xor edx, ebx
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
mov edx, esi
rol edx, 2
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul eax, eax, 0x605e
add edx, eax
xor edi, edx
mov edx, edi
lea eax, [edi + 0x54969fa2]
ror eax, 0xe
imul eax, eax, 0x7f1
rol edx, 8
sub eax, edx
xor esi, eax
mov eax, esi
mov edx, esi
xor eax, ebx
ror edx, 0xa
ror eax, 0xc
imul eax, eax, 0x137f
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, edi
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edi, eax
mov dword [ebp - 0xbd4], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xbd4]
xor edi, ebx
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, edi
shr eax, 2
add edx, eax
xor esi, edx
mov edx, esi
rol edx, 7
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul eax, eax, 0xab69
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0xab69
rol edx, 7
rol eax, 5
imul eax, eax, 0x7f1
add edx, eax
xor edi, edx
mov ebx, edi
xor ebx, esi
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor edi, eax
mov edx, edi
ror edx, 6
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul eax, eax, 0x605e
sub eax, edx
xor ebx, eax
mov edx, ebx
rol edx, 0xe
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul eax, eax, 0x7f1
add edx, eax
xor edi, edx
mov edx, edi
ror edx, 0xe
lea eax, [edi - 0x54969fa2]
rol eax, 0xf
imul eax, eax, 0x137f
sub eax, edx
xor ebx, eax
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor edi, dword [ebp - 0xbac]
xor eax, 0x7f1137f
rol eax, 4
imul eax, eax, 0x605e
rol edx, 2
mov dword [ebp - 0xb2c], edi
xor edx, eax
xor edx, dword [ebp - 0xabc]
xor ebx, edx
mov edx, dword [ebp - 0xbf8]
mov dword [ebp - 0xb5c], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb2c]
ror dword [ebp - 0xb5c], 8
mov byte [edx], al
mov al, byte [ebp - 0xb5c]
ror dword [ebp - 0xb2c], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb2c]
ror dword [ebp - 0xb5c], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb5c]
ror dword [ebp - 0xb2c], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb2c]
ror dword [ebp - 0xb5c], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xb5c]
ror dword [ebp - 0xb2c], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb2c]
mov byte [edx - 3], al
add edx, 8
mov edi, dword [ebp - 0xb5c]
mov eax, dword [ebp - 0xa88]
ror dword [ebp - 0xb2c], 8
ror edi, 8
sub dword [ebp - 0xbbc], 1
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0xa90]
mov dword [ebp - 0xb5c], edi
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xbf8], edx
jne 0xc53d9d
mov esi, dword [ebp - 0xc34]
xor eax, eax
mov edx, eax
xor cl, byte [edx + esi]
inc edx
cmp edx, 0x338
jb 0xc540dc
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xc54110
cmp edx, dword [0xb2c22c]
jne 0xc54110
mov ebx, dword [ebp - 0xc30]
mov edi, esi
xor eax, eax
mov dword [ebp - 0xaa4], edi
mov esi, eax
jmp 0xc54124
or dword [ebp - 0xb7c], 0xffffffff
mov ebx, 0xc004d501
mov edi, dword [ebp - 0xaa4]
xor eax, eax
test esi, esi
je 0xc54137
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc54304
mov eax, dword [ebp - 0xb7c]
xor ecx, ecx
push 0x40
push ecx
mov ebx, 0xd0ae80
mov esi, edi
push ebx
mov byte [eax + edi], cl
call fcn.00bc259b
add esp, 0xc
cmp byte [edi], 0
je 0xc5429a
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbd0]
jne 0xc5416f
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc542fd
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa78], edx
cmp word [eax], cx
je 0xc541bc
mov edx, 0xc000007b
mov dword [ebp - 0xa78], edx
jmp 0xc54204
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xc541af
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xc541af
cmp dword [ecx], 0x4550
jne 0xc541af
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xba4]
je 0xc541f2
cmp ax, word [ebp - 0xba8]
je 0xc541f2
mov edx, 0xc000000d
jmp 0xc541b4
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xa90], eax
test eax, eax
je 0xc5428e
mov ecx, esi
mov dword [ebp - 0xa88], esi
xor eax, eax
mov dword [ebp - 0xacc], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xbd4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc5422e
sub ecx, dword [ebp - 0xbd4]
inc esi
add esi, ecx
test edx, edx
js 0xc54278
mov ecx, dword [ebp - 0xa88]
lea eax, [ebp - 0xacc]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa78], edx
test edx, edx
js 0xc5429a
mov eax, dword [ebp - 0xa74]
mov ecx, dword [ebp - 0xacc]
mov dword [eax*4 + section..data], ecx
jmp 0xc5427e
mov eax, dword [ebp - 0xa74]
inc eax
inc ebx
mov dword [ebp - 0xa74], eax
cmp ebx, dword [ebp - 0xa90]
jb 0xc54215
add edi, 0x10
cmp byte [esi], 0
jne 0xc54168
mov ebx, dword [ebp - 0xa78]
mov esi, dword [ebp - 0xaa4]
test esi, esi
je 0xc542bb
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc54311
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc542d4
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc542c3
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc5431e
mov ebx, 0xc000007a
jmp 0xc542a0
mov esi, dword [ebp - 0xaa4]
mov ebx, 0xc000007a
jmp 0xc542a6
mov eax, dword [0xd0a150]
inc eax
xor ebx, ebx
mov dword [0xd0a150], eax
xor eax, eax
mov edi, 0xd0aed4
xchg dword [edi], eax
mov eax, dword [ebp - 0xa84]
xor ecx, ecx
mov esi, dword [0xd08068]
inc ecx
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0xa80]
mov dword [ebp - 0x2d0], eax
lea eax, [ebp - 0x2ec]
push eax
push 4
pop eax
push eax
push 0x2021
mov dword [ebp - 0x2ec], ecx
mov dword [ebp - 0x2e4], ecx
mov dword [ebp - 0x2d8], ecx
mov dword [ebp - 0x2dc], ecx
mov dword [ebp - 0x2d4], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x2e0], 0x9966f291
call dword [0xd0cffc]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc5438d
mov eax, dword [0xd0a150]
push 0
pop ebx
test eax, eax
jle 0xc543ef
sub eax, 1
mov dword [0xd0a150], eax
jne 0xc543ef
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc543c3
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc543b2
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xd0aed4
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xac4]
mov esi, dword [0xd080b0]
mov ecx, esi
push ebx
call dword [0xd0cffc]
call esi
jmp 0xc5440e
xor ebx, ebx
mov eax, ebx
mov dword [ebp - 0xa8c], ebx
mov dword [ebp - 0xbac], eax
lea edi, [ebp - 0xcd0]
xor eax, eax
mov dword [ebp - 0xeac], ebx
stosd dword es:[edi], eax
mov esi, ebx
mov dword [ebp - 0xa68], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xbd4], ebx
test ebx, ebx
je 0xc5651a
push edi
push 0xd08d58
push ebx
call fcn.00bc13d0
add esp, 0xc
mov dword [ebp - 0xa8c], ebx
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc56528
mov ecx, dword [0xd08d50]
mov dword [esi], ecx
mov ecx, dword [0xd08d54]
mov dword [esi + 4], ecx
mov dword [ebp - 0xa68], esi
rdtsc
mov dword [ebp - 0xa88], eax
mov dword [ebp - 0xa90], edx
xor eax, eax
mov dword [ebp - 0xb88], eax
lea eax, [ebp - 0xd18]
push eax
push 4
pop edi
mov edx, edi
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xc56528
mov edx, dword [ebp - 0xd18]
lea eax, [ebp - 0xb88]
push eax
xor ecx, ecx
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc56528
lea eax, [ebp - 0xd1c]
mov edx, 0xa0
push eax
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xc56528
mov edx, dword [ebp - 0xd1c]
lea eax, [ebp - 0xb88]
mov ecx, dword [ebp - 0xb88]
push eax
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc56528
lea eax, [ebp - 0xd20]
mov ecx, edi
push eax
push 8
pop edx
call fcn.00b84e9a
test eax, eax
js 0xc56528
mov edx, dword [ebp - 0xd20]
lea eax, [ebp - 0xb88]
mov ecx, dword [ebp - 0xb88]
push eax
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc56528
lea eax, [ebp - 0xc40]
mov ecx, edi
push eax
push 8
pop edx
call fcn.00b84e9a
test eax, eax
js 0xc56528
mov edx, dword [ebp - 0xc40]
lea eax, [ebp - 0xb88]
mov ecx, dword [ebp - 0xb88]
push eax
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc56528
mov edi, dword [ebp - 0xb88]
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xbec], ebx
test ebx, ebx
je 0xc56522
mov dword [ebp - 0xbac], eax
lea eax, [ebp - 0xe60]
mov ecx, ebx
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc56522
lea ecx, [ebx + edi]
lea eax, [ebx + 8]
mov dword [ebp - 0xb7c], ecx
cmp eax, ecx
ja 0xc56522
mov eax, dword [ebp - 0xe60]
push 4
pop ecx
mov dword [ebx], ecx
mov dword [eax], ecx
mov edi, ebx
xor eax, eax
mov dword [ebp - 0xb94], edi
mov dword [ebp - 0xacc], eax
mov edx, dword [edi]
lea eax, [ebp - 0xc44]
push eax
call fcn.00b84e9a
test eax, eax
js 0xc56522
mov edx, dword [ebp - 0xc44]
lea eax, [ebp - 0xb94]
push eax
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xc56522
mov eax, dword [ebp - 0xacc]
xor ecx, ecx
inc eax
inc ecx
mov dword [ebp - 0xacc], eax
cmp eax, ecx
jae 0xc54670
mov edi, dword [ebp - 0xb94]
push 4
pop ecx
jmp 0xc5461f
mov ecx, dword [ebp - 0xb94]
lea eax, [ebp - 0xe68]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc56522
lea eax, [ecx + 0xa4]
cmp eax, dword [ebp - 0xb7c]
ja 0xc56522
mov eax, 0xa0
push eax
push dword [ebp - 0xbd4]
mov dword [ecx], eax
push dword [ebp - 0xe68]
call fcn.00bc13d0
add esp, 0xc
mov edi, ebx
xor eax, eax
mov dword [ebp - 0xb34], edi
mov dword [ebp - 0xacc], eax
mov edx, dword [edi]
lea eax, [ebp - 0xc58]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
test eax, eax
js 0xc56522
mov edx, dword [ebp - 0xc58]
lea eax, [ebp - 0xb34]
push eax
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xc56522
mov eax, dword [ebp - 0xacc]
inc eax
mov dword [ebp - 0xacc], eax
cmp eax, 2
jae 0xc5471e
mov edi, dword [ebp - 0xb34]
jmp 0xc546cd
mov ecx, dword [ebp - 0xb34]
lea eax, [ebp - 0xe70]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc56522
mov edi, dword [ebp - 0xb7c]
lea eax, [ecx + 0xc]
cmp eax, edi
ja 0xc56522
mov dword [ecx], 8
mov ecx, dword [ebp - 0xe70]
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
xor eax, eax
mov dword [ebp - 0xad4], ebx
mov esi, eax
mov edx, dword [ebx]
lea eax, [ebp - 0xc48]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
test eax, eax
js 0xc56522
mov edx, dword [ebp - 0xc48]
lea eax, [ebp - 0xad4]
push eax
mov ecx, ebx
call fcn.00b84e9a
test eax, eax
js 0xc56522
inc esi
cmp esi, 3
jae 0xc547b3
mov ebx, dword [ebp - 0xad4]
jmp 0xc5476e
mov ecx, dword [ebp - 0xad4]
lea eax, [ebp - 0xe78]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc56522
lea eax, [ecx + 0xc]
cmp eax, edi
ja 0xc56522
mov eax, dword [ebp - 0xe78]
push 8
pop ebx
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xa88]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xa90]
mov dword [eax + 4], ecx
lea eax, [ebp - 0xbcc]
push eax
push 4
pop edi
mov edx, edi
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xc56522
mov esi, dword [ebp - 0xbcc]
lea eax, [ebp - 0xb28]
push eax
mov edx, ebx
mov dword [ebp - 0xb44], esi
call fcn.00b84e9a
test eax, eax
js 0xc56522
mov edx, dword [ebp - 0xb28]
lea eax, [ebp - 0xb44]
push eax
mov ecx, esi
call fcn.00b84e9a
test eax, eax
js 0xc56522
xor ecx, ecx
rdtsc
mov edi, ecx
mov dword [ebp - 0xb74], ecx
mov ebx, ecx
mov dword [ebp - 0xb54], edi
mov dword [ebp - 0xb48], ebx
mov dword [ebp - 0xae4], ecx
mov dword [ebp - 0xabc], ecx
mov dword [ebp - 0xba8], ecx
mov dword [ebp - 0xad0], ecx
mov dword [ebp - 0xab0], ecx
mov dword [ebp - 0xba4], ecx
mov dword [ebp - 0xa74], ecx
mov dword [ebp - 0xb28], eax
mov dword [ebp - 0xbcc], edx
push 8
pop ecx
mov dword [ebp - 0xc94], ecx
mov edx, dword [ebp - 0xb88]
lea eax, [ebp - 0xc94]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc549b6
mov eax, dword [ebp - 0xc94]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0xacc], ecx
cmp ecx, eax
jae 0xc548e7
mov esi, 0xc0000095
jmp 0xc549b6
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc54909
mov esi, 0xc0000017
mov edi, ebx
jmp 0xc549b6
push 4
pop ecx
lea eax, [ebp - 0xba0]
mov dword [edi], ecx
mov edx, ecx
mov dword [ebp - 0xba0], edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc5499b
mov ecx, dword [ebp - 0xba0]
mov eax, dword [ebp - 0xb88]
mov dword [ecx], eax
lea eax, [ebp - 0xba0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc5499b
mov eax, dword [ebp - 0xacc]
push dword [ebp - 0xb88]
mov ecx, dword [ebp - 0xb28]
push dword [ebp - 0xbec]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xbcc]
push dword [ebp - 0xba0]
mov dword [edi + eax - 4], ecx
call fcn.00bc13d0
mov eax, dword [ebp - 0xacc]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xb74], edi
mov edi, ecx
mov dword [ebp - 0xb54], eax
jmp 0xc5499d
xor ecx, ecx
test edi, edi
je 0xc549b0
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xb54]
or esi, 0x10000000
jl 0xc56329
xor ecx, ecx
mov dword [ebp - 0xb94], ecx
cmp dword [ebp - 0xb74], ecx
jne 0xc549dc
mov esi, 0xc000000d
jmp 0xc55135
test edi, edi
je 0xc55130
lea eax, [edi + 8]
push eax
push ecx
mov dword [ebp - 0xb7c], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xbbc], esi
test esi, esi
je 0xc55130
xor eax, eax
mov dl, al
mov ecx, eax
test edi, edi
je 0xc54a26
mov ebx, dword [ebp - 0xb74]
xor dl, byte [ecx + ebx]
inc ecx
cmp ecx, edi
jb 0xc54a1c
mov ebx, eax
mov eax, dword [ebp - 0xb74]
or ecx, 0xffffffff
mov dword [ebp - 0xad4], eax
xor eax, eax
mov dword [ebp - 0xb80], eax
mov dword [ebp - 0xb20], eax
xor eax, eax
mov dword [ebp - 0xa98], esi
mov dword [ebp - 0xb24], ecx
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xa7c], eax
je 0xc54b60
xor esi, esi
mov dword [ebp - 0xa7c], eax
mov ecx, eax
mov dword [ebp - 0xacc], eax
mov dword [ebp - 0xadc], ecx
jbe 0xc54ae0
mov ebx, dword [ebp - 0xad4]
mov edi, eax
push 0x38
pop esi
push 4
pop ecx
cmp eax, ecx
movzx eax, byte [ebx]
jge 0xc54a9f
lea ecx, [esi - 0x20]
shl eax, cl
mov ecx, dword [ebp - 0xadc]
or edi, eax
jmp 0xc54ab1
mov ecx, esi
shl eax, cl
mov ecx, dword [ebp - 0xadc]
or ecx, eax
mov dword [ebp - 0xadc], ecx
mov eax, dword [ebp - 0xacc]
sub esi, 8
inc eax
inc ebx
mov dword [ebp - 0xacc], eax
test eax, eax
js 0xc54a86
mov dword [ebp - 0xa7c], edi
xor esi, esi
mov edi, dword [ebp - 0xb54]
mov dword [ebp - 0xad4], ebx
mov ebx, dword [ebp - 0xb48]
mov eax, dword [ebp - 0xa7c]
xor ecx, 0x42f6b18d
xor eax, 0xb17a307a
cmp dword [ebp - 0xbd0], 0
mov dword [ebp - 0xb80], eax
mov dword [ebp - 0xb20], eax
jbe 0xc54b3b
mov ebx, dword [ebp - 0xa98]
cmp esi, 4
jge 0xc54b18
rol eax, 8
mov byte [ebx], al
jmp 0xc54b1d
rol ecx, 8
mov byte [ebx], cl
inc ebx
add esi, 1
js 0xc54b0c
mov eax, dword [ebp - 0xb20]
mov dword [ebp - 0xa98], ebx
mov ebx, dword [ebp - 0xb48]
mov dword [ebp - 0xb80], eax
push 0xfffffffffffffffc
xor eax, eax
pop esi
mov ecx, eax
mov dword [ebp - 0xb24], ecx
test esi, esi
jg 0xc54b5a
jns 0xc54b5a
mov dword [ebp - 0xb80], eax
mov dword [ebp - 0xb20], eax
mov esi, dword [ebp - 0xa98]
mov eax, edi
shr eax, 3
mov dword [ebp - 0xacc], eax
test eax, eax
je 0xc54f51
mov ebx, dword [ebp - 0xad4]
lea eax, [esi + 7]
mov dword [ebp - 0xb34], eax
add ebx, 2
movzx edi, byte [ebx - 2]
movzx eax, byte [ebx - 1]
movzx esi, byte [ebx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ebx]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 3]
or esi, eax
movzx eax, byte [ebx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ebx + 5]
add ebx, 8
shl esi, 8
or esi, eax
mov dword [ebp - 0xb28], ebx
xor ecx, esi
mov dword [ebp - 0xa70], ecx
lea ebx, [ecx - 0x4a58]
mov ecx, 0xc81ecb17
xor ebx, edi
xor ebx, dword [ebp - 0xb80]
xor ebx, ecx
mov eax, ebx
xor eax, ecx
mov ecx, ebx
ror eax, 0xf
imul eax, eax, 0xb1b5
ror ecx, 7
add ecx, eax
mov eax, dword [ebp - 0xa70]
xor eax, ecx
mov dword [ebp - 0xa70], eax
add eax, 0xb1b54a58
mov ecx, dword [ebp - 0xa70]
ror eax, 9
imul eax, eax, 0xcb17
ror ecx, 0xa
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0xcb17
rol ecx, 5
rol eax, 4
imul eax, eax, 0xc81e
add ecx, eax
mov eax, dword [ebp - 0xa70]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xa70], eax
xor ecx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, ecx
xor ebx, eax
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 6
sub ecx, eax
sub ecx, 0x339b6838
xor dword [ebp - 0xa70], ecx
mov ecx, dword [ebp - 0xa70]
mov eax, ecx
ror eax, 0xf
xor eax, 0xcb17
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, 0xc81e
imul eax, eax, 0xcb17
xor ecx, eax
mov dword [ebp - 0xa70], ecx
lea eax, [ecx + 0x37e0ea91]
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0xc81e
ror ecx, 0xa
imul eax, eax, 0xb1b5
xor ecx, eax
mov eax, dword [ebp - 0xa70]
xor eax, ecx
mov dword [ebp - 0xa70], eax
xor eax, 0x4a58
rol eax, 6
mov ecx, dword [ebp - 0xa70]
imul eax, eax, 0xcb17
ror ecx, 3
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa70]
mov eax, ebx
ror eax, 0xf
sub eax, 0xc81e
imul eax, eax, 0x4a58
xor ecx, eax
mov dword [ebp - 0xa70], ecx
xor ecx, 0xc81e
mov eax, dword [ebp - 0xa70]
shr eax, 1
imul ecx, ecx, 0x4a58
xor ecx, eax
mov eax, dword [ebp - 0xa70]
add eax, 0xffff34e9
xor ebx, ecx
rol eax, 3
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa70]
shr eax, 0xf
xor ecx, eax
xor ebx, ecx
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 0xd
sub ecx, eax
mov eax, 0xb1b54a58
add ecx, 0x730581bd
xor dword [ebp - 0xa70], ecx
mov ecx, dword [ebp - 0xa70]
sub eax, ecx
ror eax, 9
imul eax, eax, 0xcb17
ror ecx, 0xb
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa70]
lea eax, [ebx + 0x4e49ed8a]
xor ecx, eax
mov dword [ebp - 0xa70], ecx
mov eax, dword [ebp - 0xa70]
xor eax, 0xb1b5
ror ecx, 7
imul eax, eax, 0x4a58
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0xc81e
ror ecx, 0x10
rol eax, 4
imul eax, eax, 0xb1b5
sub eax, ecx
mov ecx, dword [ebp - 0xa70]
xor ecx, eax
mov eax, 0xb1b54a58
sub eax, ecx
mov dword [ebp - 0xa70], ecx
ror eax, 0xa
imul eax, eax, 0xcb17
ror ecx, 4
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x4e4ab5a8]
ror eax, 4
imul eax, eax, 0xc81e
mov ecx, ebx
ror ecx, 9
xor ecx, eax
mov eax, dword [ebp - 0xa70]
xor eax, ecx
mov dword [ebp - 0xa70], eax
xor eax, 0xc81ecb17
mov ecx, dword [ebp - 0xa70]
rol eax, 8
imul eax, eax, 0x4a58
rol ecx, 2
sub eax, ecx
xor ebx, eax
mov eax, 0xc81ecb17
sub eax, ebx
mov ecx, ebx
ror eax, 0xb
imul eax, eax, 0xb1b5
ror ecx, 0xc
sub eax, ecx
mov ecx, dword [ebp - 0xa70]
xor ecx, eax
mov dword [ebp - 0xa70], ecx
xor ecx, 0xb1b5
mov eax, dword [ebp - 0xa70]
shr eax, 8
imul ecx, ecx, 0xcb17
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor ebx, dword [ebp - 0xa7c]
xor eax, dword [ebp - 0xa70]
xor eax, dword [ebp - 0xadc]
xor eax, 0x79ab814f
mov dword [ebp - 0xb20], ebx
mov dword [ebp - 0xb24], eax
mov eax, dword [ebp - 0xb34]
mov dword [ebp - 0xa7c], edi
mov dword [ebp - 0xadc], esi
mov byte [eax - 4], bl
mov al, byte [ebp - 0xb24]
mov ebx, dword [ebp - 0xb34]
ror dword [ebp - 0xb20], 8
mov byte [ebx], al
mov al, byte [ebp - 0xb20]
ror dword [ebp - 0xb24], 8
mov byte [ebx - 5], al
mov al, byte [ebp - 0xb24]
ror dword [ebp - 0xb20], 8
mov byte [ebx - 1], al
mov al, byte [ebp - 0xb20]
ror dword [ebp - 0xb24], 8
mov byte [ebx - 6], al
mov al, byte [ebp - 0xb24]
ror dword [ebp - 0xb20], 8
mov byte [ebx - 2], al
ror dword [ebp - 0xb24], 8
mov al, byte [ebp - 0xb20]
mov byte [ebx - 7], al
mov al, byte [ebp - 0xb24]
mov byte [ebx - 3], al
add ebx, 8
mov eax, dword [ebp - 0xb20]
mov ecx, dword [ebp - 0xb24]
ror eax, 8
ror ecx, 8
sub dword [ebp - 0xacc], 1
mov dword [ebp - 0xb34], ebx
mov ebx, dword [ebp - 0xb28]
mov dword [ebp - 0xb80], eax
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb24], ecx
jne 0xc54b85
mov ebx, dword [ebp - 0xb48]
mov edi, dword [ebp - 0xb54]
mov esi, dword [ebp - 0xbbc]
movzx eax, dl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc54f83
mov esi, 0xc0000017
jmp 0xc55096
mov eax, dword [ebp - 0xb7c]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc54fab
mov esi, 0xc0000017
xor edx, edx
jmp 0xc5502f
mov dword [edi + 4], eax
push dword [ebp - 0xb7c]
push esi
push eax
call fcn.00bc13d0
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc54f9f
mov dword [edi + 0xc], eax
push 0xa0
push 0xd08ca8
push eax
call fcn.00bc13d0
add esp, 0xc
mov dword [edi + 0x10], esi
push esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
xor edx, edx
test eax, eax
jne 0xc55011
mov esi, 0xc0000017
jmp 0xc5502f
mov ecx, eax
mov dword [edi + 0x14], eax
mov eax, dword [0xd08d48]
mov esi, edx
mov dword [ebp - 0xb94], edi
mov edi, edx
mov dword [ecx], eax
mov eax, dword [0xd08d4c]
mov dword [ecx + 4], eax
test edi, edi
je 0xc55096
cmp dword [edi + 4], 0
je 0xc5504f
push dword [edi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 4], edx
cmp dword [edi + 0xc], 0
je 0xc5506b
push dword [edi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0xc], edx
cmp dword [edi + 0x14], 0
je 0xc55087
push dword [edi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0x14], edx
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
test esi, esi
js 0xc550ac
mov ebx, dword [ebp - 0xb94]
mov edi, eax
mov dword [ebp - 0xb48], ebx
jmp 0xc550b2
mov edi, dword [ebp - 0xb94]
push dword [ebp - 0xbbc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xc55135
xor eax, eax
cmp dword [edi + 4], eax
je 0xc550e7
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc55103
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc5511f
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc55135
mov esi, 0xc0000001
or esi, 0x10000000
jl 0xc56323
mov edx, dword [ebx]
lea eax, [ebp - 0xb90]
push 4
pop edi
push eax
mov ecx, edi
mov dword [ebp - 0xb90], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc551d0
mov ecx, dword [ebp - 0xb90]
lea eax, [ebp - 0xb90]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc551d0
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xb90]
mov ecx, dword [ebp - 0xb90]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc551d0
mov ecx, dword [ebp - 0xb90]
lea eax, [ebp - 0xb90]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc551d0
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xb90]
mov ecx, dword [ebp - 0xb90]
push eax
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xb90]
test esi, esi
jns 0xc551d6
mov eax, dword [ebp - 0xe24]
mov dword [ebp - 0xacc], eax
test esi, esi
js 0xc5532f
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc55204
mov esi, 0xc0000017
jmp 0xc5532f
mov eax, dword [ebx]
mov ecx, edi
mov dword [edi], eax
lea eax, [ebp - 0xb30]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xb30], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc5531a
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0xb30]
call fcn.00bc13d0
mov edx, dword [ebx]
lea eax, [ebp - 0xb30]
mov ecx, dword [ebp - 0xb30]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc5531a
mov ecx, dword [ebp - 0xb30]
mov eax, dword [ebx + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xb30]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc5531a
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0xb30]
call fcn.00bc13d0
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xb30]
mov ecx, dword [ebp - 0xb30]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc5531a
mov ecx, dword [ebp - 0xb30]
mov eax, dword [ebx + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xb30]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc5531a
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0xb30]
call fcn.00bc13d0
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xb30]
mov ecx, dword [ebp - 0xb30]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
xor ecx, ecx
test esi, esi
js 0xc5531c
mov eax, dword [ebp - 0xacc]
mov dword [ebp - 0xae4], edi
mov edi, ecx
mov dword [ebp - 0xabc], eax
jmp 0xc5531c
xor ecx, ecx
test edi, edi
je 0xc5532f
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xc56323
xor eax, eax
mov dword [ebp - 0xc74], 8
mov dword [ebp - 0xacc], eax
mov dword [ebp - 0xad4], eax
mov edx, dword [ebp - 0xb44]
lea eax, [ebp - 0xc74]
push eax
push 8
pop ecx
call fcn.00b84e9a
mov esi, eax
or esi, 0x10000000
jl 0xc5557d
mov eax, dword [ebp - 0xc74]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xc5538d
mov esi, 0xc0000095
jmp 0xc553ae
mov dword [ebp - 0xc70], ecx
lea eax, [ebp - 0xc70]
push eax
push 8
pop edx
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xc70]
test esi, esi
jns 0xc553b4
mov eax, dword [ebp - 0xd3c]
mov dword [ebp - 0xb34], eax
test esi, esi
js 0xc5557d
mov ebx, dword [ebp - 0xbec]
xor eax, eax
mov ecx, ebx
mov edi, eax
mov dword [ebp - 0xb50], ecx
mov eax, dword [ecx]
mov dword [ebp - 0xb28], eax
lea eax, [ebp - 0xb50]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc5557d
mov edx, dword [ebp - 0xb28]
lea eax, [ebp - 0xb50]
mov ecx, dword [ebp - 0xb50]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc5557d
mov ecx, dword [ebp - 0xb50]
xor eax, eax
inc edi
inc eax
cmp edi, eax
jb 0xc553d4
mov edi, dword [ecx]
lea eax, [ebp - 0xb50]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc5557d
mov dword [ebp - 0xacc], edi
xor eax, eax
mov dword [ebp - 0xb4c], ebx
mov edi, eax
lea eax, [ebp - 0xb4c]
mov ecx, ebx
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc554b6
mov edx, dword [ebx]
lea eax, [ebp - 0xb4c]
mov ecx, dword [ebp - 0xb4c]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc554b6
inc edi
cmp edi, 2
jae 0xc55495
mov ebx, dword [ebp - 0xb4c]
jmp 0xc55454
mov ecx, dword [ebp - 0xb4c]
lea eax, [ebp - 0xb4c]
push eax
push 4
pop eax
mov edi, dword [ecx]
mov edx, eax
call fcn.00b84e9a
mov esi, eax
mov ebx, edi
test esi, esi
jns 0xc554c4
mov ebx, dword [ebp - 0xad4]
test esi, esi
js 0xc5557d
mov edx, dword [ebp - 0xb34]
lea eax, [ebp - 0xaf0]
push 4
pop edi
push eax
mov ecx, edi
mov dword [ebp - 0xaf0], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc55559
mov ecx, dword [ebp - 0xaf0]
lea eax, [ebp - 0xaf0]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc55559
mov edx, dword [ebp - 0xacc]
lea eax, [ebp - 0xaf0]
mov ecx, dword [ebp - 0xaf0]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc55559
mov ecx, dword [ebp - 0xaf0]
lea eax, [ebp - 0xaf0]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc55559
mov ecx, dword [ebp - 0xaf0]
lea eax, [ebp - 0xaf0]
push eax
mov edx, ebx
call fcn.00b84e9a
mov edi, dword [ebp - 0xaf0]
mov esi, eax
test esi, esi
jns 0xc55563
mov edi, dword [ebp - 0xe28]
test esi, esi
js 0xc5557d
cmp edi, 0x400000
jbe 0xc55575
mov esi, 0x8000ffff
jmp 0xc56323
mov dword [ebp - 0xad0], edi
jmp 0xc55583
mov edi, dword [ebp - 0xad0]
test esi, esi
js 0xc56323
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc555ac
mov ecx, dword [ebp - 0xba8]
mov esi, 0xd0000017
jmp 0xc555b9
mov ecx, eax
mov dword [ebp - 0xba8], eax
mov esi, 0x10000000
mov ebx, dword [ebp - 0xae4]
test esi, esi
js 0xc56329
test ebx, ebx
jne 0xc555d5
mov esi, 0x80070057
jmp 0xc56329
test ecx, ecx
je 0xc555cb
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0xe0c], eax
xor eax, eax
mov dword [ebp - 0xe04], eax
lea eax, [ebp - 0xd40]
push eax
xor eax, eax
mov dword [ebp - 0xe14], ebx
push 0xb2be98
inc eax
mov dword [ebp - 0xe10], ecx
push eax
mov dword [ebp - 0xe08], edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xc55639
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc55630
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc55681
mov esi, 0x80004005
jmp 0xc55681
push 0xb2be7c
push dword [ebp - 0xd40]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xc55619
xor eax, eax
mov ecx, esi
push eax
push 0x14
lea eax, [ebp - 0xe14]
push eax
push 0x86
call dword [0xd0cffc]
call esi
mov esi, eax
or esi, 0x10000000
jl 0xc55681
mov edi, dword [ebp - 0xe08]
mov dword [ebp - 0xad0], edi
cmp esi, 0xd0000023
jne 0xc55693
mov esi, 0x8007007a
jmp 0xc56329
test esi, esi
js 0xc56329
mov eax, dword [ebp - 0xba8]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xb08], ecx
mov ebx, ecx
mov dword [ebp - 0xb84], eax
cmp edi, edx
jae 0xc556c2
mov esi, 0xc000003e
jmp 0xc55aa5
mov edi, dword [eax]
lea ecx, [ebp - 0xb84]
push ecx
mov ecx, eax
mov dword [ebp - 0xb28], edi
call fcn.00b84e9a
mov esi, eax
xor ecx, ecx
test esi, esi
js 0xc55aa5
lea eax, [ebp - 0xb08]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc55aa3
mov eax, dword [ebp - 0xad0]
sub eax, dword [ebp - 0xb08]
cmp eax, edi
jae 0xc55719
mov esi, 0xc000003e
jmp 0xc55aa3
mov eax, dword [ebp - 0xb84]
lea ecx, [ebp - 0xb84]
push ecx
mov edx, edi
mov dword [ebp - 0xb44], eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc55aa3
mov ecx, dword [ebp - 0xb08]
lea eax, [ebp - 0xb08]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc55aa3
mov eax, dword [ebp - 0xad0]
sub eax, dword [ebp - 0xb08]
push 4
pop edx
cmp eax, edx
jb 0xc5570f
mov ecx, dword [ebp - 0xb84]
lea eax, [ebp - 0xb84]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0xbcc], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc55aa3
mov ecx, dword [ebp - 0xb08]
lea eax, [ebp - 0xb08]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc55aa3
mov eax, dword [ebp - 0xad0]
sub eax, dword [ebp - 0xb08]
cmp eax, edi
jb 0xc5570f
mov eax, dword [ebp - 0xb84]
lea ecx, [ebp - 0xb84]
push ecx
mov edx, edi
mov dword [ebp - 0xacc], eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc55aa3
mov ecx, dword [ebp - 0xb08]
lea eax, [ebp - 0xb08]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc55aa3
mov eax, dword [ebp - 0xad0]
sub eax, dword [ebp - 0xb08]
push 4
pop edx
cmp eax, edx
jb 0xc5570f
mov ecx, dword [ebp - 0xb84]
mov eax, dword [ecx]
mov dword [ebp - 0xad4], eax
lea eax, [ebp - 0xb84]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc55aa3
mov ecx, dword [ebp - 0xb08]
lea eax, [ebp - 0xb08]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc55aa3
mov eax, dword [ebp - 0xad0]
sub eax, dword [ebp - 0xb08]
mov ecx, dword [ebp - 0xad4]
cmp eax, ecx
jb 0xc5570f
lea eax, [ebp - 0xb08]
mov edx, ecx
mov ecx, dword [ebp - 0xb08]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc55aa3
mov ecx, dword [ebp - 0xad0]
mov eax, ecx
sub eax, dword [ebp - 0xb08]
jne 0xc5570f
mov eax, dword [ebp - 0xad4]
mov esi, dword [ebp - 0xb28]
add eax, 0xc
add eax, edi
add eax, esi
cmp eax, ecx
jne 0xc5570f
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc558f1
mov esi, 0xc0000017
jmp 0xc55a2e
cmp dword [ebp - 0xb44], ebx
je 0xc55932
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc5591b
mov esi, 0xc0000017
xor eax, eax
jmp 0xc559c7
mov dword [edi + 4], eax
push esi
push dword [ebp - 0xb44]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc55939
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
cmp dword [ebp - 0xacc], ebx
je 0xc55975
mov esi, dword [ebp - 0xbcc]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc5590f
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xacc]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc5597b
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
cmp dword [ebp - 0xb84], ebx
je 0xc559bb
mov esi, dword [ebp - 0xad4]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc5590f
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xb84]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc559c1
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov ebx, edi
mov esi, eax
mov edi, eax
test edi, edi
je 0xc55a2e
cmp dword [edi + 4], 0
je 0xc559e7
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc55a03
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc55a1f
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test esi, esi
js 0xc55a3c
mov dword [ebp - 0xab0], ebx
mov ebx, ecx
test ebx, ebx
je 0xc55aa5
cmp dword [ebx + 4], 0
je 0xc55a5c
push dword [ebx + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 4], ecx
cmp dword [ebx + 0xc], 0
je 0xc55a78
push dword [ebx + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 0xc], ecx
cmp dword [ebx + 0x14], 0
je 0xc55a94
push dword [ebx + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 0x14], ecx
push ebx
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
or esi, 0x10000000
jl 0xc56323
mov eax, dword [ebp - 0xab0]
mov edi, ecx
mov dword [ebp - 0xc44], edi
mov dword [ebp - 0xc40], ecx
test eax, eax
jne 0xc55ad3
mov esi, 0xd000000d
jmp 0xc560a7
mov esi, dword [eax + 4]
mov dword [ebp - 0xc48], esi
test esi, esi
je 0xc55ac9
mov ebx, dword [eax]
test ebx, ebx
je 0xc55ac9
add ebx, 0xfffffff8
mov dword [ebp - 0xc58], ecx
push ebx
push ecx
mov dword [ebp - 0xba0], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xbbc], eax
test eax, eax
je 0xc5608b
xor ecx, ecx
mov edi, esi
mov dl, cl
mov dword [ebp - 0xb44], edi
mov esi, ebx
mov ecx, eax
mov dword [ebp - 0xad4], ecx
and esi, 7
je 0xc56026
or dword [ebp - 0xafc], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0xb14], ebx
mov eax, ebx
mov dword [ebp - 0xb50], ebx
mov dword [ebp - 0xb4c], eax
test esi, esi
je 0xc55ba4
push 0x38
pop eax
push 4
pop ecx
cmp ebx, ecx
jge 0xc55b6c
lea ecx, [eax - 0x20]
movzx eax, byte [edi]
shl eax, cl
or dword [ebp - 0xb4c], eax
jmp 0xc55b7d
movzx eax, byte [edi]
mov ecx, dword [ebp - 0xb8c]
shl eax, cl
or dword [ebp - 0xb50], eax
mov eax, dword [ebp - 0xb8c]
inc ebx
sub eax, 8
inc edi
mov dword [ebp - 0xb8c], eax
cmp ebx, esi
jl 0xc55b55
mov ecx, dword [ebp - 0xad4]
mov eax, dword [ebp - 0xb4c]
mov dword [ebp - 0xb44], edi
mov ebx, dword [ebp - 0xb50]
xor eax, 0x92f65a5
xor ebx, 0x699a899c
mov dword [ebp - 0xac4], eax
xor edi, edi
mov dword [ebp - 0xb14], eax
mov dword [ebp - 0xafc], ebx
test esi, esi
je 0xc55bfc
cmp edi, 4
jge 0xc55bd9
rol eax, 8
mov byte [ecx], al
jmp 0xc55bde
rol ebx, 8
mov byte [ecx], bl
inc edi
inc ecx
cmp edi, esi
jl 0xc55bcd
mov eax, dword [ebp - 0xb14]
mov ebx, dword [ebp - 0xafc]
mov dword [ebp - 0xad4], ecx
mov dword [ebp - 0xac4], eax
add esi, 0xfffffffc
test esi, esi
jle 0xc55ff8
push 4
pop eax
mov ecx, eax
sub ecx, esi
shl ecx, 3
shr ebx, cl
shl ebx, cl
mov dword [ebp - 0xb28], ebx
mov edi, ebx
mov dword [ebp - 0xafc], ebx
mov esi, dword [ebp - 0xac4]
mov ebx, dword [ebp - 0xba0]
mov eax, ebx
shr eax, 3
mov dword [ebp - 0xb7c], eax
test eax, eax
je 0xc55fbd
mov eax, dword [ebp - 0xad4]
mov ecx, dword [ebp - 0xb44]
add eax, 7
add ecx, 2
mov dword [ebp - 0xacc], eax
mov dword [ebp - 0xa7c], ecx
movzx ebx, byte [ecx - 2]
movzx eax, byte [ecx - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 1]
movzx ecx, byte [ecx + 2]
shl ecx, 8
shl ebx, 8
or ebx, eax
mov eax, dword [ebp - 0xa7c]
xor esi, ebx
mov dword [ebp - 0xb28], ebx
mov dword [ebp - 0xac4], esi
mov ebx, dword [ebp - 0xac4]
movzx eax, byte [eax + 3]
or ecx, eax
mov eax, dword [ebp - 0xa7c]
shl ecx, 8
movzx eax, byte [eax + 4]
or ecx, eax
mov eax, dword [ebp - 0xa7c]
shl ecx, 8
add dword [ebp - 0xa7c], 8
movzx eax, byte [eax + 5]
or ecx, eax
mov esi, ecx
mov dword [ebp - 0xbcc], ecx
xor esi, edi
mov edi, 0xab69605e
xor esi, ebx
xor esi, 0xac987321
mov ecx, esi
rol ecx, 0xa
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul eax, eax, 0x137f
add ecx, eax
xor ebx, ecx
mov ecx, ebx
rol ecx, 2
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul eax, eax, 0xab69
sub eax, ecx
xor esi, eax
imul ecx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub ecx, eax
sub ecx, 0x756c8a2
xor ebx, ecx
mov eax, ebx
mov ecx, ebx
xor eax, 0xab69
rol ecx, 2
rol eax, 6
imul eax, eax, 0x7f1
sub eax, ecx
xor esi, eax
mov eax, 0x7f1137f
mov ecx, esi
xor ecx, edi
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0x137f
ror ecx, 6
imul eax, eax, 0xab69
xor ecx, eax
xor esi, ecx
mov ecx, esi
rol ecx, 2
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul eax, eax, 0x605e
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x54969fa2]
mov ecx, ebx
ror eax, 0xe
imul eax, eax, 0x7f1
rol ecx, 8
sub eax, ecx
xor esi, eax
mov eax, esi
mov ecx, esi
xor eax, edi
ror ecx, 0xa
ror eax, 0xc
imul eax, eax, 0x137f
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x7f1
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea edi, [ebx - 0x7f1]
xor edi, esi
xor edi, 0xab69605e
mov eax, edi
mov ecx, edi
xor eax, 0x7f1
shr ecx, 2
rol eax, 2
imul eax, eax, 0x137f
add ecx, eax
xor ebx, ecx
mov ecx, ebx
rol ecx, 7
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul eax, eax, 0xab69
add ecx, eax
xor edi, ecx
mov eax, edi
mov ecx, edi
xor eax, 0x137f
ror ecx, 9
imul eax, eax, 0x605e
add ecx, eax
xor ebx, ecx
mov eax, ebx
mov dword [ebp - 0xac4], ebx
xor eax, 0xab69
mov ecx, ebx
rol eax, 5
imul eax, eax, 0x7f1
rol ecx, 7
add ecx, eax
xor edi, ecx
mov ebx, edi
xor ebx, dword [ebp - 0xac4]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor edi, eax
mov ecx, edi
ror ecx, 6
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul eax, eax, 0x605e
sub eax, ecx
xor ebx, eax
mov ecx, ebx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
rol ecx, 0xe
imul eax, eax, 0x7f1
add ecx, eax
xor edi, ecx
mov ecx, edi
ror ecx, 0xe
lea eax, [edi - 0x54969fa2]
rol eax, 0xf
imul eax, eax, 0x137f
sub eax, ecx
xor ebx, eax
mov eax, ebx
xor eax, 0x605e
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor ecx, eax
xor edi, ecx
mov eax, edi
mov ecx, edi
xor edi, dword [ebp - 0xb50]
xor eax, 0x7f1137f
rol eax, 4
imul eax, eax, 0x605e
rol ecx, 2
mov dword [ebp - 0xafc], edi
xor ecx, eax
xor ecx, dword [ebp - 0xb4c]
xor ebx, ecx
mov ecx, dword [ebp - 0xacc]
mov dword [ebp - 0xb14], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xafc]
ror dword [ebp - 0xb14], 8
mov byte [ecx], al
mov al, byte [ebp - 0xb14]
ror dword [ebp - 0xafc], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xafc]
ror dword [ebp - 0xb14], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xb14]
ror dword [ebp - 0xafc], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xafc]
ror dword [ebp - 0xb14], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xafc], 8
mov al, byte [ebp - 0xb14]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xafc]
mov byte [ecx - 3], al
add ecx, 8
mov esi, dword [ebp - 0xb14]
mov edi, dword [ebp - 0xafc]
mov eax, dword [ebp - 0xb28]
ror esi, 8
ror edi, 8
sub dword [ebp - 0xb7c], 1
mov dword [ebp - 0xb4c], eax
mov eax, dword [ebp - 0xbcc]
mov dword [ebp - 0xacc], ecx
mov ecx, dword [ebp - 0xa7c]
mov dword [ebp - 0xb14], esi
mov dword [ebp - 0xafc], edi
mov dword [ebp - 0xb50], eax
jne 0xc55c60
mov ebx, dword [ebp - 0xba0]
mov ecx, dword [ebp - 0xbbc]
xor eax, eax
mov esi, eax
test ebx, ebx
je 0xc55fd3
xor dl, byte [esi + ecx]
inc esi
cmp esi, ebx
jb 0xc55fcb
mov esi, dword [ebp - 0xc48]
movzx eax, dl
cdq
cmp eax, dword [ebx + esi]
jne 0xc5604a
cmp edx, dword [ebx + esi + 4]
jne 0xc5604a
xor eax, eax
mov edi, ecx
mov esi, ebx
mov ecx, eax
mov ebx, dword [ebp - 0xc58]
jmp 0xc5605d
xor ecx, ecx
mov edi, ecx
mov dword [ebp - 0xafc], edi
test esi, esi
jns 0xc55c23
neg esi
shl esi, 3
mov ecx, esi
shr eax, cl
shl eax, cl
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xb14], eax
jmp 0xc55c23
xor eax, eax
or dword [ebp - 0xb50], 0xffffffff
mov edi, eax
mov dword [ebp - 0xb4c], eax
mov esi, eax
mov dword [ebp - 0xafc], edi
mov dword [ebp - 0xb14], esi
jmp 0xc55c2f
mov edi, dword [ebp - 0xc44]
mov ebx, 0xc004d501
mov esi, dword [ebp - 0xc40]
xor eax, eax
test ecx, ecx
je 0xc56070
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc5608b
xor ecx, ecx
mov dword [ebp - 0xba4], edi
mov dword [ebp - 0xa74], esi
mov edi, ecx
mov esi, 0x10000000
jmp 0xc56092
mov esi, 0xd0000001
xor ecx, ecx
test edi, edi
je 0xc560a7
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test esi, esi
js 0xc56323
mov edi, dword [ebp - 0xa74]
push 4
pop ebx
mov dword [ebp - 0xbd8], ecx
mov ecx, dword [ebp - 0xba4]
mov dword [ebp - 0xc1c], ecx
cmp edi, ebx
jb 0xc56318
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0xb28], eax
lea eax, [ebp - 0xc1c]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc5631d
lea eax, [ebp - 0xbd8]
mov edx, ebx
push eax
xor ecx, ecx
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc5631d
mov eax, edi
sub eax, dword [ebp - 0xbd8]
cmp eax, ebx
jb 0xc56318
mov ecx, dword [ebp - 0xc1c]
lea eax, [ebp - 0xc1c]
push eax
push 4
pop eax
mov ebx, dword [ecx]
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc5631d
mov ecx, dword [ebp - 0xbd8]
lea eax, [ebp - 0xbd8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc5631d
mov ecx, dword [ebp - 0xbd8]
mov eax, edi
sub eax, ecx
cmp eax, ebx
jb 0xc56318
lea eax, [ebp - 0xbd8]
mov edx, ebx
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc5631d
mov edi, dword [ebp - 0xc1c]
mov edx, dword [ebp - 0xa74]
mov esi, dword [ebp - 0xba4]
lea ecx, [edi + ebx]
lea eax, [edx + esi]
cmp eax, ecx
jb 0xc56318
sub edx, edi
sub edx, ebx
add edx, esi
cmp edx, 8
jae 0xc56318
xor ecx, ecx
mov dword [ebp - 0xad4], ecx
mov eax, ecx
mov dword [ebp - 0xb8c], eax
mov esi, ecx
test edi, edi
je 0xc562af
lea eax, [ebp - 0xbe8]
mov dword [ebp - 0xb44], edi
push eax
mov edx, ebx
mov ecx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc5631d
mov eax, dword [ebp - 0xbe8]
cmp edi, eax
jae 0xc562a5
lea eax, [ebp - 0xd44]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc5631d
mov eax, dword [ebp - 0xbe8]
cmp dword [ebp - 0xd44], eax
ja 0xc562d4
mov edx, dword [ecx]
lea eax, [ebp - 0xd48]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc56255
mov eax, dword [ebp - 0xd48]
mov dword [ebp - 0xd4c], eax
jmp 0xc5625b
mov eax, dword [ebp - 0xd4c]
test esi, esi
js 0xc5631d
lea ecx, [ebp - 0xc4c]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xb44]
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc5631d
mov ecx, dword [ebp - 0xc4c]
mov eax, dword [ebp - 0xbe8]
mov dword [ebp - 0xb44], ecx
cmp ecx, eax
ja 0xc562d4
inc dword [ebp - 0xad4]
cmp ecx, eax
jb 0xc56201
cmp ecx, eax
jne 0xc562d4
mov eax, dword [ebp - 0xb8c]
test ebx, ebx
je 0xc562df
push ebx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb8c], eax
test eax, eax
jne 0xc562db
mov esi, 0xc0000017
jmp 0xc56306
mov esi, 0xc000000d
jmp 0xc5631d
xor ecx, ecx
mov esi, ecx
test edi, edi
je 0xc562f4
push ebx
push edi
push eax
call fcn.00bc13d0
mov eax, dword [ebp - 0xb8c]
add esp, 0xc
mov dword [ebp - 0xcc8], eax
mov eax, dword [ebp - 0xad4]
mov dword [ebp - 0xcd0], eax
test esi, esi
js 0xc5631d
mov eax, dword [ebp - 0xb28]
cmp eax, dword [ebp - 0xcd0]
je 0xc5631d
mov esi, 0xc000003e
or esi, 0x10000000
mov ebx, dword [ebp - 0xae4]
mov eax, dword [ebp - 0xb74]
test eax, eax
je 0xc56344
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xb48]
test edi, edi
je 0xc563b2
xor eax, eax
cmp dword [edi + 4], eax
je 0xc5636b
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc56387
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc563a3
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
je 0xc563c9
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc563cb
xor ebx, ebx
mov eax, dword [ebp - 0xba8]
test eax, eax
je 0xc563e4
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ebx, dword [ebp - 0xab0]
test ebx, ebx
je 0xc56452
xor eax, eax
cmp dword [ebx + 4], eax
je 0xc5640b
push dword [ebx + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 4], eax
cmp dword [ebx + 0xc], 0
je 0xc56427
push dword [ebx + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0xc], eax
cmp dword [ebx + 0x14], 0
je 0xc56443
push dword [ebx + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0x14], eax
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xba4]
xor ebx, ebx
test eax, eax
je 0xc5646d
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc56522
mov esi, dword [ebp - 0xcd0]
xor eax, eax
inc eax
cmp esi, eax
jb 0xc56522
mov ecx, dword [ebp - 0xcc8]
test ecx, ecx
je 0xc56522
test esi, esi
je 0xc56522
lea eax, [ebp - 0xc20]
mov dword [ebp - 0xc20], ecx
push eax
push 4
pop edi
mov edx, edi
call fcn.00b84e9a
test eax, eax
js 0xc56522
mov eax, dword [ecx]
neg eax
sbb eax, eax
and eax, dword [ebp - 0xc20]
cmp dword [ecx], edi
jne 0xc56522
cmp dword [eax], 0
jl 0xc56522
xor eax, eax
inc eax
cmp esi, eax
jbe 0xc56522
mov dword [ebp - 0xc18], ecx
mov esi, ebx
mov edi, dword [ecx]
lea eax, [ebp - 0xc18]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc56522
mov ecx, dword [ebp - 0xc18]
lea eax, [ebp - 0xc18]
push eax
mov edx, edi
call fcn.00b84e9a
test eax, eax
js 0xc56522
xor eax, eax
inc esi
inc eax
cmp esi, eax
jae 0xc56522
mov ecx, dword [ebp - 0xc18]
jmp 0xc564db
mov ebx, dword [ebp - 0xa8c]
jmp 0xc5652e
mov ebx, dword [ebp - 0xa8c]
mov esi, dword [ebp - 0xa68]
mov eax, dword [ebp - 0xbac]
test eax, eax
je 0xc56549
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ecx, dword [ebp - 0xcc8]
test ecx, ecx
je 0xc56564
push ecx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
je 0xc5657b
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc5657d
xor ebx, ebx
test esi, esi
je 0xc56590
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb70]
xor edx, edx
mov ebx, edx
mov dword [ebp - 0xc3c], eax
jmp 0xc4c8eb
cmp ecx, 0xd00000e5
je 0xc565c7
cmp ecx, 0xc004d501
je 0xc565c7
cmp ecx, 0xd000003e
jne 0xc565cc
mov ecx, 0xc004f028
jmp 0xc4c98a
mov ecx, 0xc004f027
test ecx, ecx
jns 0xc565e3
cmp ecx, 0x8007007a
jne 0xc4c98a
mov ebx, 0xc004f01e
jmp 0xc565fc
push 4
pop ecx
cmp dword [ebp - 0xc10], ecx
jne 0xc565dc
mov ecx, dword [eax]
mov ebx, dword [ebp - 0xd54]
mov dword [ebp - 0xd58], ecx
test eax, eax
je 0xc56611
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0xc3c], eax
jmp 0xc56613
xor eax, eax
test ebx, ebx
js 0xc56658
cmp dword [ebp - 0xd58], 0
je 0xc56658
mov ebx, dword [ebp - 0xc98]
mov esi, 0x1a2e
movzx eax, byte [ebx + 0x53]
neg eax
sbb eax, eax
and eax, 8
push eax
push esi
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_CheckMenuItem]
call fcn.00c70dd2
neg eax
sbb eax, eax
inc eax
push eax
push esi
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_EnableMenuItem]
jmp 0xc5666d
mov ebx, dword [ebp - 0xc98]
push eax
push 0x1a2e
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_RemoveMenu]
xor eax, eax
push eax
push 0x1a2d
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
xor eax, eax
mov dword [ebp - 0xd90], eax
mov dword [ebp - 0xd8c], eax
mov dword [ebp - 0xd88], eax
mov dword [ebp - 0xd84], eax
mov esi, dword [ebp - 0xc88]
mov edi, dword [ebp - 0xc8c]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xd90]
push eax
mov dword [ebp - 0xde4], esi
lea eax, [ebp - 0xde4]
mov dword [ebp - 0xde0], edi
mov edx, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x34]
push 8
push eax
call fcn.00cbbcde
xor eax, eax
push eax
push dword [ebx + 0x14]
push edi
push esi
push 0x100
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
push eax
mov ecx, ebx
call fcn.00c4bc5b
mov edx, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x34]
call fcn.00cbc3e9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd90]
call fcn.00c4b827
lea ecx, [ebp - 0xd90]
call fcn.00b83655
call fcn.00bc12da
ret 4