File Information hashes and primary classification
File name
3c47eccd8fc8d9a9ce087c5ff5f9dce08d5dd15123b84a44301ca98b6a4f797d
File size
7.4 MiB
Architecture
X86
MD5
024167c8527d96ebbb87014e191023d4
SHA1
7088b2676ee2e21244846435d71c939f2d661940
SHA256
3c47eccd8fc8d9a9ce087c5ff5f9dce08d5dd15123b84a44301ca98b6a4f797d
TLSH
T14e768c9ee622c205fc1e1c751c756c8c2ca421a862e1fedd4ab4380d55b1e7f4afd29e
Imphash
9db8fb801c5bd8b1a1aa19f58cc65475
Rich header
b76d6bc4f64ed34ad62170e8b5a115f0
Metadata parser-extracted fields
General:
Compile date:
2020-07-23 12:26:11
Debug:
Date.Debug.Codeview:
2025-12-11 16:25:45
Path:
wallpaper_manager.pdb
Date.Debug.VcFeature:
2025-12-11 16:25:45
Date.Debug.Pogo:
2025-12-11 16:25:45
YARA Signatures 5 matching rules

Type.UNCOMMON

persistence
AutorunKey
lateral movement
RunShell

Type.INFO

compiler
Rust
MSVC_2022_linker
MSVS2022 v17.14.2-pre.1.0
Kesakode similarity verdict
DustyHammock
18.6%
Spankrat
0.6%
13 malware hits 17 library hits 666 clean hits
Anomalies signals worth reviewing
entropy: BigBufferNoXrefMediumToHighEntropy UnknownOverlayMediumToHighEntropy
strings: BigStringHiScore DynamicString FewStrings HugeStringBase64 StringBase64
time: DebugTimeDifferentThanTimeDateStamp
headers: GuiSubsystemNoWindowApi WeirdDebugInfoType
code: HighXrefLoopingFunction ManyHighValueImmediates ManyUniqueImmediateBytes SpaghettiFunction StackArrayInitialisationX86 XorInLoop
integrity: InvalidChecksum
rich: RichUnknownTool
sections: SectionNameUnknown
Constants identified constants and patterns
crypto: B64EncodeTable__8_byt_ASC_64 1 base64_map__8_byt_80 1
registry: HKEY_CURRENT_USER 4 HKEY_LOCAL_MACHINE 2 autorun 1 HKEY_USERS 1
runtime: msvc_locale 2 msvc_date 1
Strings highest-value extracted strings
Kesakode
2697
Malware 4 Library 0 Unknown 2465 Clean 228
AddressStringRefsEncodingScore
0xB19A13 LOCALAPPDATAMicrosoftWindowsMediaC:\Windows\Temp\WindowsMediaregaddHKCU\Software\Microsoft\Windows\CurrentVersion\Run... 1 ASCII 243
0x40C6CC 0000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000003000000A4C3B... 1 BINARY 216
0x40C852 0100000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000003000000A4C3B... 1 BINARY 211
0x42196A 060000000000000006000000000000000600000000000000000000000000000000000000000000000000000004000000000000000000008000000... 1 BINARY 211
0xB1D59C \cmd.exe 4 ASCII 206
0x421634 2D362799AB4DC06407E23358BE7E902C 1 BINARY 200
0x4110B4 6D5DCBD62C50EB637841A657711B8BB9 1 BINARY 199
0xB1D215 m 2 ASCII 181
0x814200 mKioqK/uXl5v7j+vnV6ebr+fm5uIqKiorjqrS3qrqqrKyq46q2quPu6/7rp7T6yP/+/uXkw+Ts5ae059XjyeX/5P6Kiub62O/p/oqK4u7piq+6uO6wr7q... 0 ASCII 164
0xB1C6A0 note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.\n__rust_end_short_backtrace__... 1 ASCII 163
0x812290 Xl+u/kioqKiun+5tX64+Tt5O/+iun+5tXk7/795fjh+YqKiorp/ubV6Pjj7u3v5Ovn74qK6f7m1fjv5+X+7+Tr5++Kiun+5tXk7/7k6+fviun+5tXj5Pn... 0 ASCII 162
0xB1CED8 NTDLL.DLL 1 UTF16 162
0xB1ED54 mscoree.dll 1 UTF16 154
0xB1B984 assertion failed: match track_edge_idx {\n LeftOrRight::Left(idx) => idx <= old_left_len,\n LeftOrRight::Right(... 2 ASCII 153
0xB1BD14 AccessErrorcannot access a Thread Local Storage value during or after destruction: 1 ASCII 152
0xB1B290 {size limit reached}`fmt::Error` from `SizeLimitedFmtAdapter` was discarded 1 ASCII 152
0xB1C788 PATHfatal runtime error: thread local panicked on drop, aborting\n 1 ASCII 151
0xB1BB84 Utf8Errorvalid_up_toerror_lenNoneSomeTryFromIntError: 1 ASCII 150
0xB1B190 {invalid syntax}{recursion limit reached}?'for<> , []::{closureshim# as mut const ; dyn + unsafe extern " 26 ASCII 148
0xB1B49C 0123456789abcdef 24 ASCII 148
0xB1B7FC assertion failed: edge.height == self.node.height - 1 1 ASCII 147
0xB1DA10 dbghelp.dll 1 ASCII 147
0xB1B6D8 assertion failed: edge.height == self.height - 1| 1 ASCII 146
0xB1A240 ==assertion `left right` failed\n left: \n right: 1 ASCII 144
0xB1C346 a formatting trait implementation returned an error when the underlying stream did notF 2 ASCII 143
0xB1B8F8 assertion failed: old_left_len + count <= CAPACITY 1 ASCII 143
0xB1B844 assertion failed: old_right_len + count <= CAPACITY 1 ASCII 142
0xB1B888 assertion failed: old_left_len >= count 1 ASCII 142
0xB1CB88 Local\RustBacktraceMutex00000000 1 ASCII 142
0xB1AFB4 `fmt::Error`s should be impossible without a `fmt::Formatter` 2 ASCII 141
0xB1A208 panic in a function that cannot unwind 1 ASCII 141
0xB1D400 \\?\UNC\ 1 UTF16 141
0xB1BA24 assertion failed: new_left_len <= CAPACITY 1 ASCII 140
0xB1B93C assertion failed: old_right_len >= count| 1 ASCII 140
0xB1FC40 api-ms-win-core-localization-obsolete-l1-2-0 1 UTF16 139
0xB1D924 assertion failed: is_unlocked(state) 1 ASCII 139
0xB1FE30 api-ms-win-security-systemfunctions-l1-1-0 1 UTF16 138
0xB1DADF SymGetLineFromInlineContextW 1 ASCII 138
0xB1A460 [...]begin <= end ( <= ) when slicing ``e 1 ASCII 137
0xB1B8C0 internal error: entered unreachable code| 14 ASCII 137
0xB1CA08 Box<dyn Any>aborting due to panic at 1 ASCII 137
0xB1B770 assertion failed: self.height > 0 1 ASCII 137
0xB1DAFC SymAddrIncludeInlineTrace 1 ASCII 137
0xB1D5E4 \\?\UNC 1 UTF16 137
0xB1BAF0 assertion failed: self.is_char_boundary(new_len)/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\raw... 1 ASCII 136
0xB1FED0 ext-ms-win-ntuser-windowstation-l1-1-0 1 UTF16 136
0xB1C488 ..extension cannot contain path separators: 2 ASCII 136
0xB1FDE0 api-ms-win-rtcore-ntuser-window-l1-1-0 1 UTF16 135
0xB1D3C4 \\?\ 2 UTF16 135
0xB1FCA0 api-ms-win-core-processthreads-l1-1-2 1 UTF16 134
0xB2003C AppPolicyGetProcessTerminationMethod 2 ASCII 134
0xB1DA6B EnumerateLoadedModulesW64 1 ASCII 134
0xB1B2EC SizeLimitExhausted/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\collections\btree\navigate.rs 1 ASCII 133
0xB1DA59 SymSetSearchPathW 1 ASCII 133
0xB1BFC8 entity not foundpermission deniedconnection refusedconnection resethost unreachablenetwork unreachableconnection abor... 1 ASCII 132
0xB1FBF8 api-ms-win-core-localization-l1-2-1 1 UTF16 132
0xB1FF58 api-ms-win-appmodel-runtime-l1-1-2 1 UTF16 132
0xB1B4CC called `Result::unwrap()` on an `Err` value 4 ASCII 132
0xB1DAC9 SymFromInlineContextW 1 ASCII 132
0xB1FFB0 ext-ms- 1 UTF16 132
0xB1B7A4 assertion failed: src.len() == dst.len()| 6 ASCII 131
0xB1CC08 assertion failed: len >= 0 1 ASCII 131
0xB1DA47 SymGetSearchPathW 1 ASCII 131
0xB1C678 stack backtrace:\n 1 ASCII 131
0xB1B060 internal error: entered unreachable code: str::from_utf8() = was expected to have 1 char, but chars were found` 1 ASCII 130
0xB1EC9C InitializeCriticalSectionEx 2 ASCII 130
0xB1DA91 SymFunctionTableAccess64 1 ASCII 130
0xB1D121 SetThreadDescription 1 ASCII 130
0xB1DB16 SymQueryInlineTrace 1 ASCII 130
0xB1FE88 ext-ms-win-ntuser-dialogbox-l1-1-0 1 UTF16 129
0xB1FAD0 api-ms-win-core-datetime-l1-1-1 1 UTF16 129
0xB1E1B8 Unknown exception 1 ASCII 129
0xB1A2E0 {\n,\n(\n0001020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849505... 2 ASCII 128
0xB2515A api-ms-win-core-synch-l1-2-0.dll 1 ASCII 128
0xB1D53C .exeprogram not found 1 ASCII 128
0xB1BE78 mainmain 4 ASCII 128
0xB1CC64 NotFoundPermissionDeniedConnectionRefusedConnectionResetHostUnreachableNetworkUnreachableConnectionAbortedNotConnecte... 3 ASCII 127
0xB1FD28 api-ms-win-core-sysinfo-l1-2-1 1 UTF16 127
0xB1EBAC api-ms-win-core-fibers-l1-1-1 1 UTF16 127
0xB1ED6C CorExitProcess 1 ASCII 127
0xB1FCEC api-ms-win-core-string-l1-1-0 1 UTF16 126
0xB1FB10 api-ms-win-core-fibers-l1-1-2 1 UTF16 126
0xB1FD68 api-ms-win-core-winrt-l1-1-0 1 UTF16 126
0xB22238 CONOUT$ 1 UTF16 126
0xB1A153 RefCell already borrowedcalled `Option::unwrap()` on a `None` valuelibrary\core\src\panicking.rs 1 ASCII 125
0xB1DAAA SymGetModuleBase64 1 ASCII 125
0xB1DA2A SymSetOptions 1 ASCII 125
0xB1DA85 StackWalk64 1 ASCII 125
0xB1DABD StackWalkEx 1 ASCII 125
0xB1D040 main 1 UTF16 125
0xB1D9A0 fatal runtime error: the global allocator may not use TLS with destructors, aborting\n 1 ASCII 124
0xB1C904 note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace\n 1 ASCII 124
0xB1BDB0 RUST_MIN_STACKfatal runtime error: something here is badly broken!, aborting\n 1 ASCII 124
0xB1B100 boolcharstri8i16i32i64i128isizeu8u16u32u64u128usizef32f64!_... 1 ASCII 124
0xB1FDA4 api-ms-win-core-xstate-l2-1-0 1 UTF16 124
0xB1AD88 EmptyInvalidDigitPosOverflowNegOverflowZeroParseIntError 1 ASCII 124
0xB1FB84 api-ms-win-core-file-l1-2-2 1 UTF16 124
0xB1EC38 api-ms- 2 UTF16 124
0xB2560A ntdll.dll 1 ASCII 124
0xB19DF8 Impossible: must only have 0 to 8 input bytes in last chunk, with no invalid lengths 1 ASCII 123
0xB1D717 Windows stdio in console mode does not support writing non-UTF-8 byte sequences 1 ASCII 123
0xB1FB4C api-ms-win-core-file-l1-2-4 1 UTF16 123
0xB1FBBC api-ms-win-core-file-l2-1-4 1 UTF16 123
0xB1ABC0 copy_from_slice: source slice length () does not match destination slice length ( 1 ASCII 122
0xB1DA38 SymInitializeW 1 ASCII 122
0xB1DA1C SymGetOptions 1 ASCII 122
0xB1C95C <unnamed> 1 ASCII 122
0xB1D118 kernel32 1 ASCII 122
0xB1B20C " fn( -> = falsetrue{ { }0x 1 ASCII 121
0xB20024 LocaleNameToLCID 2 ASCII 121
0xB1FFC4 AreFileApisANSI 2 ASCII 121
0xB1D560 exe\\.\NUL 5 ASCII 121
0xB1D794 Unexpected number of bytes for incomplete UTF-8 codepoint. 1 ASCII 120
0xB1CA48 \nthread panicked while processing panic. aborting.\n 1 ASCII 120
0xB1EC64 FlsFree 2 ASCII 120
0xB1BE26 failed to generate unique thread ID: bitspace exhausted 1 ASCII 119
0xB1E1D8 bad exception 1 ASCII 119
0xB1EC50 FlsAlloc 2 ASCII 119
0xB1B718 internal error: entered unreachable code: empty internal node 1 ASCII 118
0xB1C768 <unknown> 3 ASCII 118
0xB1D29C Windows file names may not contain `"` or end with `\` 1 ASCII 117
0xB1CA94 thread caused non-unwinding panic. aborting.\n 1 ASCII 117
0xB1FFF4 FlsGetValue2 2 ASCII 117
0xB1EC88 FlsSetValue 2 ASCII 117
0xB1EC74 FlsGetValue 2 ASCII 117
0xB1EF78 ja-JP 3 UTF16 117
0xB1EF90 ko-KR 3 UTF16 117
0xB1B3A9 (): /rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\str\pattern.rs 3 ASCII 115
0xB1EBE8 api-ms-win-core-synch-l1-2-0 2 UTF16 115
0xB1B23C .llvm./rust/deps\rustc-demangle-0.1.25\src\lib.rs 1 ASCII 115
0xB1BE9C RUST_BACKTRACElibrary\std\src\sys_common\wtf8.rs 1 ASCII 115
0xB1E9D4 `eh vector vbase copy constructor iterator' 1 ASCII 115
0xB19B4C internal error: entered unreachable code: 1 ASCII 115
0xB1EA64 `vector vbase copy constructor iterator' 1 ASCII 115
0xB1CFC4 \??\PIPE\ 1 UTF16 115
0xB255B0 KERNEL32.dll 1 ASCII 115
0xB1B024 punycode{-0 1 ASCII 115
0xB1D084 strings passed to WinAPI cannot contain NULs 1 ASCII 114
0xB1D888 Once instance has previously been poisoned 1 ASCII 114
0xB1EA90 `managed vector copy constructor iterator' 1 ASCII 114
0xB1BCB0 too many running threads in thread scope 1 ASCII 114
0xB1C3C4 advancing io slices beyond their length 1 ASCII 114
0xB1E868 `eh vector vbase constructor iterator' 1 ASCII 114
0xB1FFDC CompareStringEx 2 ASCII 114
0xB1A4A8 is not a char boundary; it is inside (bytes ) of ` 1 ASCII 113
0xB1E95C `managed vector constructor iterator' 1 ASCII 113
0xB1E7E4 `vector vbase constructor iterator' 1 ASCII 113
0xB1E9AC `eh vector copy constructor iterator' 1 ASCII 112
0xB1E984 `managed vector destructor iterator' 1 ASCII 112
0xB1E8D8 `local vftable constructor closure' 1 ASCII 112
0xB1BF30 failed to write the buffered data 1 ASCII 112
0xB1A1C4 index out of bounds: the len is but the index is 1 ASCII 111
0xB1D818 Unexpected error in MultiByteToWideChar 1 ASCII 111
0xB1EA40 `vector copy constructor iterator' 1 ASCII 111
0xB1E824 `eh vector constructor iterator' 1 ASCII 111
0xB2000C LCMapStringEx 2 ASCII 111
0xB1C404 advancing IoSlice beyond its length 1 ASCII 110
0xB1AB8C slice index starts at but ends at 1 ASCII 110
0xB1C8A8 memory allocation of bytes failed\n 1 ASCII 110
0xB1C848 lies between surrogate codepoints 1 ASCII 110
0xB1E848 `eh vector destructor iterator' 1 ASCII 110
0xB1E7A4 `vector constructor iterator' 1 ASCII 110
0xB1EF84 zh-CN 3 UTF16 110
0xB1EF9C zh-TW 3 UTF16 110
0xB1D388 failure getting env string from OS: 1 ASCII 109
0xB1E764 `default constructor closure' 1 ASCII 109
0xB1E7C4 `vector destructor iterator' 1 ASCII 109
0xB2224C log10 3 ASCII 109
0xB2226C sqrt 2 ASCII 109
0xB2225C asin 2 ASCII 109
0xB22264 acos 2 ASCII 109
0xB1D8BC too many active read locks on RwLock 1 ASCII 108
0xB1D48C comparing environment keys failed: 1 ASCII 108
0xB1BF93 failed to write whole buffer 1 ASCII 108
0xB1E5B8 __preserve_none 1 ASCII 108
0xB1CF78 (FormatMessageW() returned invalid UTF-16) 1 ASCII 107
0xB1D270 batch file arguments are invalidp 1 ASCII 107
0xB1D0EC nul byte found in provided data 1 ASCII 107
0xB1E890 `copy constructor closure' 1 ASCII 107
0xB1FF34 kernelbase 1 UTF16 107
0xB1EA1C `dynamic atexit destructor for ' 1 ASCII 106
0xB1D510 program path has no file name 1 ASCII 106
0xB1E784 `scalar deleting destructor' 1 ASCII 106
0xB1E744 `vector deleting destructor' 1 ASCII 106
0xB1E5C8 __clrcall 1 ASCII 106
0xB1BEFC WouldBlockfailed to create whole tree 3 ASCII 105
0xB1C87C is not a codepoint boundary 1 ASCII 105
0xB198D3 ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ 0 ASCII 104
0xB1D4B8 library\std\src\sys\process\windows.rs 10 ASCII 104
0xB1E93C `placement delete[] closure' 1 ASCII 104
0xB1EB4C Class Hierarchy Descriptor' 1 ASCII 104
0xB1EABC `local static thread guard' 1 ASCII 104
0xB1E920 `placement delete closure' 1 ASCII 104
0xB1FF4C ntdll 1 UTF16 104
0xB1CEEC OS Error (FormatMessageW() returned error 2 ASCII 103
0xB1D164 library\std\src\sys\args\windows.rs 17 ASCII 103
0xB1EB1C Base Class Descriptor at ( 1 ASCII 103
0xB1E808 `virtual displacement map' 1 ASCII 103
0xB1EB88 `anonymous namespace' 1 ASCII 103
0xB1FF20 advapi32 1 UTF16 103
0xB1EAE8 operator co_await 1 ASCII 102
0xB1A28C right` failed: \n left: 1 ASCII 101
0xB1EB6C Complete Object Locator' 1 ASCII 101
0xB1A504 is out of bounds of ` 1 ASCII 101
0xB1CB68 at 1 ASCII 101
0xB1E608 __restrict 1 ASCII 101
0xB1E59C __fastcall 1 ASCII 101
0xB19D58 C:\Users\sharl\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.21.7\src\engine\general_purpose\decode_s... 3 ASCII 100
0xB1B608 /rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\collections\btree\map\entry.rs 1 ASCII 100
0xB1D136 ' has overflowed its stack\n 1 ASCII 100
0xB1EA00 `dynamic initializer for ' 1 ASCII 100
0xB1CFE0 failed to spawn thread 1 ASCII 100
0xB1AB6C range end index l 1 ASCII 100
0xB1C81C byte index is out of bounds 5 ASCII 99
0xB1E5A8 __vectorcall 1 ASCII 99
0xB1E57C __cdecl 1 ASCII 99
0xB19B80 C:\Users\sharl\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.21.7\src\engine\general_purpose\decode.rs 22 ASCII 98
0xB1B430 /rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\iter\traits\iterator.rs 1 ASCII 98
0xB1E70C `local static guard' 1 ASCII 98
0xB1EB38 Base Class Array' 1 ASCII 98
0xB1E658 operator 1 ASCII 98
0xB1FFA0 user32 1 UTF16 97
0xB1E614 __unaligned 1 ASCII 97
0xB1EAFC operator<=> 1 ASCII 97
0xB22E10 _nextafter 1 ASCII 97
0xB1E590 __thiscall 1 ASCII 97
0xB1E5F4 __swift_3 1 ASCII 97
0xB1E584 __stdcall 1 ASCII 97
0xB1E5DC __swift_1 1 ASCII 97
0xB1E5E8 __swift_2 1 ASCII 97
0xB22D98 atan 1 ASCII 97
0xB1E730 `vbase destructor' 1 ASCII 96
0xB1B370 capacity overflow 1 ASCII 96
0xB1E8AC `udt returning' 1 ASCII 96
0xB1EAD8 operator "" 1 ASCII 96
0xB1ACE4 /rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\ops\function.rs 1 ASCII 95
0xB1EC24 kernel32 2 UTF16 95
0xB1E5D4 __eabi 1 ASCII 95
0xB22DA0 atan2 1 ASCII 95
0xB1E8C0 `RTTI 1 ASCII 95
0xB22DBC floor 1 ASCII 95
0xB1BA90 /rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\vec\mod.rs 1 ASCII 94
0xB1BC1C /rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs 1 ASCII 94
0xB1EB08 Type Descriptor' 1 ASCII 94
0xB1E634 delete 1 ASCII 94
0xB1E600 __ptr64 1 ASCII 94
0xB1E8C8 `local vftable' 1 ASCII 93
0xB1E904 delete[] 1 ASCII 93
0xB1E620 restrict( 1 ASCII 93
0xB1C978 \nthread '' panicked at \nx 2 ASCII 92
0xB1B67C /rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\collections\btree\node.rs 15 ASCII 91
0xB1E910 `omni callsig' 1 ASCII 91
0x80F100 Xo4O/p/qqv8qaq+ 0 ASCII 90
0xB232DC wallpaper_manager.pdb 0 ASCII 89
0xB1F45C en-US 2 UTF16 89
0xB1E6EC `vbtable' 1 ASCII 89
Functions high-value functions
Kesakode
1076
Malware 13 Library 183 Unknown 446 Clean 434
Function listings
0x40CA90 sub_40ca90 str 9 api 17 imm 20 Malware 
sub_40ca90() {
    push         ebp
    mov          ebp, esp
    push         ebx
    push         edi
    push         esi
    sub          esp, 0x70
    mov          [ebp-0x1C], esp
    mov          dword ptr [ebp-0x10], 0xFFFFFFFF
    mov          dword ptr [ebp-0x14], SEH.11()
    lea          eax, [ebp-0x18]
    mov          ecx, fs:[0x0]
    mov          [ebp-0x18], ecx
    mov          fs:[0x0], eax
    mov          edi, [0xB269A8]
    test         edi, edi
    jz           .7
.1:
    push         0x00
    push         0xFFFFFFFF
    push         edi
    call         [kernel32.WaitForSingleObjectEx]
    mov          eax, [0xB269C4]
    test         eax, eax
    jnz          .2
    push         "dbghelp.dll"
    call         [kernel32.LoadLibraryA]
    test         eax, eax
    mov          [0xB269C4], eax
    jz           .10
.2:
    xor          ebx, ebx
    cmp          byte ptr [0xB269AC], 0x00
    jnz          .24
    mov          ecx, [0xB269C8]
    test         ecx, ecx
    jnz          .3
    push         "SymGetOptions"
    push         eax
    call         [kernel32.GetProcAddress]
    test         eax, eax
    jz           .23
    mov          ecx, eax
    mov          [0xB269C8], eax
.3:
    call         ecx
    mov          ecx, eax
    mov          eax, [0xB269CC]
    test         eax, eax
    jnz          .4
    mov          esi, ecx
    push         "SymSetOptions"
    push         [0xB269C4]
    call         [kernel32.GetProcAddress]
    test         eax, eax
    jz           .23
    mov          ecx, esi
    mov          [0xB269CC], eax
.4:
    or           ecx, 0x04
    push         ecx
    call         eax
    mov          esi, [0xB269D0]
    test         esi, esi
    jnz          .5
    push         "SymInitializeW"
    push         [0xB269C4]
    call         [kernel32.GetProcAddress]
    test         eax, eax
    jz           .23
    mov          esi, eax
    mov          [0xB269D0], eax
    mov          dword ptr [ebp-0x10], 0x00
.5:
    mov          [ebp-0x30], edi
    call         [kernel32.GetCurrentProcess]
    push         0x01
    push         0x00
    push         eax
    call         esi
    mov          dword ptr [ebp-0x2C], 0x00
    mov          dword ptr [ebp-0x28], 0x02
    mov          dword ptr [ebp-0x24], 0x00
    mov          byte ptr [ebp-0x1D], 0x00
    mov          dword ptr [ebp-0x10], 0x00
    lea          ecx, [ebp-0x2C]
    xor          edx, edx
    push         0x02
    push         0x02
    push         0x400
    call         sub_4315c0()
    add          esp, 0x0C
    mov          esi, [ebp-0x28]
    mov          ebx, [ebp-0x24]
    lea          eax, [esi+ebx*2]
    push         0x7FE
    push         0x00
    push         eax
    call         _memset()
    add          esp, 0x0C
    mov          word ptr [esi+ebx*2+0x7FE], 0x00
    add          ebx, 0x400
    mov          edi, [0xB269D4]
    mov          [ebp-0x24], ebx
    test         edi, edi
    jnz          .6
    push         "SymGetSearchPathW"
    push         [0xB269C4]
    call         [kernel32.GetProcAddress]
    test         eax, eax
    jz           .25
    mov          edi, eax
    mov          [0xB269D4], eax
.6:
    call         [kernel32.GetCurrentProcess]
    push         ebx
    push         esi
    push         eax
    call         edi
    cmp          eax, 0x01
    jnz          .12
    push         esi
    call         [kernel32.lstrlenW]
    test         eax, eax
    js           .27
    cmp          eax, ebx
    jbe          .15
    jmp          .16
.7:
    lea          eax, [ebp-0x58]
    push         0x21
    push         "Local\\RustBacktraceMutex00000000"
    push         eax
    call         sub_422cb0()
    add          esp, 0x0C
    call         [kernel32.GetCurrentProcessId]
    test         eax, eax
    jz           .9
    mov          ecx, 0x1F
    nop         
.8:
    cmp          ecx, 0x20
    jnbe         .28
    mov          edx, eax
    mov          esi, eax
    and          dl, 0x0F
    mov          dh, dl
    mov          ebx, edx
    add          bl, 0x37
    or           dh, 0x30
    cmp          dl, 0x0A
    movzx        edx, dh
    movzx        ebx, bl
    cmovb        ebx, edx
    shr          esi, 0x04
    mov          [ebp+ecx*1-0x58], bl
    dec          ecx
    cmp          eax, 0x10
    mov          eax, esi
    jnb          .8
.9:
    movsd        xmm1, qword ptr [ebp-0x48]
    movzx        eax, byte ptr [ebp-0x38]
    movsd        xmm0, qword ptr [ebp-0x40]
    movsd        xmm2, qword ptr [ebp-0x58]
    movsd        [ebp-0x6C], xmm1
    movsd        xmm1, qword ptr [ebp-0x50]
    mov          [ebp-0x5C], al
    lea          eax, [ebp-0x7C]
    movsd        [ebp-0x64], xmm0
    movsd        [ebp-0x7C], xmm2
    movsd        [ebp-0x74], xmm1
    push         eax
    push         0x00
    push         0x00
    call         [kernel32.CreateMutexA]
    test         eax, eax
    jz           .11
    mov          edi, eax
    xor          eax, eax
    lock cmpxchg      [0xB269A8], edi
    jz           .1
    mov          esi, eax
    push         edi
    call         [kernel32.CloseHandle]
    mov          edi, esi
    jmp          .1
.10:
    push         edi
    call         [kernel32.ReleaseMutex]
.11:
    mov          ebx, 0x01
    jmp          .24
.12:
    mov          dword ptr [ebp-0x24], 0x00
    mov          eax, [ebp-0x2C]
    test         eax, eax
    jnz          .13
    lea          ecx, [ebp-0x2C]
    mov          edx, 0xB1CBE8
    mov          byte ptr [ebp-0x1D], 0x00
    call         loc_40e240
    mov          eax, [ebp-0x2C]
    mov          esi, [ebp-0x28]
.13:
    cmp          eax, 0x01
    mov          word ptr [esi], 0x2E
    mov          dword ptr [ebp-0x24], 0x01
    jnz          .14
    lea          ecx, [ebp-0x2C]
    mov          edx, 0xB1CBF8
    mov          byte ptr [ebp-0x1D], 0x00
    call         loc_40e240
    mov          esi, [ebp-0x28]
.14:
    mov          eax, 0x02
    mov          word ptr [esi+0x02], 0x3B
.15:
    mov          [ebp-0x24], eax
.16:
; listing truncated

/* DISPLAY WARNING: Type casts are NOT being printed */

undefined8 sub_40ca90(void)

{
    uint16_t uVar1;
    int32_t iVar2;
    undefined8 *puVar3;
    code *pcVar4;
    uint32_t uVar5;
    int32_t iVar6;
    uint32_t uVar7;
    int32_t iVar8;
    uint8_t uVar9;
    undefined4 uVar10;
    undefined2 *puVar11;
    int32_t **unaff_FS_OFFSET;
    bool bVar12;
    undefined8 uVar13;
    undefined8 uStack_80;
    undefined8 uStack_78;
    undefined8 uStack_70;
    undefined8 uStack_68;
    undefined uStack_60;
    uint8_t uStack_5d;
    undefined8 uStack_5c;
    int32_t iStack_54;
    int32_t iStack_50;
    undefined8 uStack_4c;
    undefined8 uStack_44;
    undefined uStack_3c;
    int32_t iStack_38;
    int32_t iStack_34;
    int32_t iStack_30;
    undefined2 *puStack_2c;
    uint32_t uStack_28;
    undefined uStack_21;
    undefined8 *puStack_20;
    int32_t *piStack_1c;
    code *pcStack_18;
    undefined4 uStack_14;
    
    puStack_20 = &uStack_80;
    uStack_14 = 0xffffffff;
    pcStack_18 = SEH.11;
    piStack_1c = *unaff_FS_OFFSET;
    *unaff_FS_OFFSET = &piStack_1c;
    iVar6 = [0x0xb269a8];
    iVar8 = [0x0xb269a8];
    puVar3 = &uStack_80;
    if ([0x0xb269a8] == 0) {
        sub_422cb0(&uStack_5c, "Local\\RustBacktraceMutex00000000", 0x21);
        uVar5 = (*kernel32.GetCurrentProcessId)();
        if (uVar5 != 0) {
            uVar7 = 0x1f;
            do {
                if (0x20 < uVar7) {
                    uStack_14 = 0xffffffff;
                    uVar13 = func_0x00430f93(0xb1cbd8);
                    if (iStack_50 != 0) {
                        uVar13 = sub_402bb0();
                    }
                    return uVar13;
                }
                uVar9 = uVar5;
                uVar1 = CONCAT11(uVar9, uVar9) & 0xf0f;
                uVar9 = (uVar9 & 0xf) + 0x37;
                if (uVar1 < 10) {
                    uVar9 = uVar1 >> 8 | 0x30;
                }
                *(&uStack_5c + uVar7) = uVar9;
                uVar7 = uVar7 - 1;
                bVar12 = 0xf < uVar5;
                uVar5 = uVar5 >> 4;
            } while (bVar12);
        }
        uStack_70 = uStack_4c;
        uStack_78._4_4_ = iStack_50;
        uStack_60 = uStack_3c;
        uStack_68 = uStack_44;
        uStack_80 = uStack_5c;
        iVar8 = (*kernel32.CreateMutexA)(0, 0, &uStack_80);
        iStack_34 = iVar6;
        if (iVar8 != 0) {
            iVar6 = 0;
            LOCK();
            bVar12 = [0x0xb269a8] != 0;
            iVar2 = iVar8;
            if (bVar12) {
                iVar6 = [0x0xb269a8];
                iVar2 = [0x0xb269a8];
            }
            [0x0xb269a8] = iVar2;
            UNLOCK();
            puVar3 = puStack_20;
            if (bVar12) {
                (*kernel32.CloseHandle)(iVar8);
                iVar8 = iVar6;
                puVar3 = puStack_20;
            }
            goto code_r0x0040cacb;
        }
    }
    else {
code_r0x0040cacb:
        puStack_20 = puVar3;
        (*kernel32.WaitForSingleObjectEx)(iVar8, 0xffffffff, 0);
        iStack_34 = iVar8;
        if (([0x0xb269c4] != 0) || (00b269c4 = (*kernel32.LoadLibraryA)("dbghelp.dll"), 00b269c4 != 0)) {
            uVar10 = 0;
            if ([0x0xb269ac] != '\0') goto code_r0x0040ce56;
            pcVar4 = 0xb269c8;
            if (((0xb269c8 != 0x0) || (pcVar4 = (*kernel32.GetProcAddress)([0x0xb269c4], "SymGetOptions"), pcVar4 != 0x0))
               && ((0xb269c8 = pcVar4, uVar5 = (*0xb269c8)(), pcVar4 = 0xb269cc, 0xb269cc != 0x0 ||
                   (pcVar4 = (*kernel32.GetProcAddress)([0x0xb269c4], "SymSetOptions"), pcVar4 != 0x0)))) {
                0xb269cc = pcVar4;
                (*0xb269cc)(uVar5 | 4);
                if (0xb269d0 == 0x0) {
                    pcVar4 = (*kernel32.GetProcAddress)([0x0xb269c4], "SymInitializeW");
                    if (pcVar4 == 0x0) goto code_r0x0040ce4f;
                    uStack_14 = 0;
                    pcRam00b269d0 = pcVar4;
                }
                pcVar4 = 0xb269d0;
                uVar10 = (*kernel32.GetCurrentProcess)();
                (*pcVar4)(uVar10, 0, 1);
                iStack_30 = 0;
                puStack_2c = 0x2;
                uStack_28 = 0;
                uStack_21 = 0;
                uStack_14 = 0;
                sub_4315c0(0x400, 2, 2);
                iVar6 = uStack_28;
                puVar11 = puStack_2c;
                _memset(puStack_2c + uStack_28, 0, 0x7fe);
                puVar11[iVar6 + 0x3ff] = 0;
                uVar5 = iVar6 + 0x400;
                pcVar4 = 0xb269d4;
                uStack_28 = uVar5;
                if ((0xb269d4 == 0x0) &&
                   (pcVar4 = (*kernel32.GetProcAddress)([0x0xb269c4], "SymGetSearchPathW"), iVar6 = iStack_34, pcVar4 == 0x0)) {
                    iStack_34 = iVar6;
                    if (iStack_30 != 0) {
                        sub_402bb0();
                        iStack_34 = iVar6;
                    }
                }
                else {
                    0xb269d4 = pcVar4;
                    pcVar4 = 0xb269d4;
                    uVar10 = (*kernel32.GetCurrentProcess)();
                    iVar6 = (*pcVar4)(uVar10, puVar11, uVar5);
                    if (iVar6 == 1) {
                        uVar7 = (*kernel32.lstrlenW)(puVar11);
                        if (uVar7 < 0) {
                            uStack_21 = 0;
                            sub_4310e0(0xb1cc24);
                            do {
                                invalidInstructionException();
                            } while( true );
                        }
                        if (uVar5 < uVar7) {
                            uVar7 = uStack_28;
                        }
                    }
                    else {
                        uStack_28 = 0;
                        if (iStack_30 == 0) {
                            uStack_21 = 0;
                            func_0x0040e240();
                            puVar11 = puStack_2c;
                        }
                        *puVar11 = 0x2e;
                        uStack_28 = 1;
                        if (iStack_30 == 1) {
                            uStack_21 = 0;
                            func_0x0040e240();
                            puVar11 = puStack_2c;
                        }
                        puVar11[1] = 0x3b;
                        uVar7 = 2;
                    }
                    uStack_28 = uVar7;
                    uStack_80 = CONCAT44(puStack_2c, iStack_30);
                    uStack_78 = CONCAT44(uStack_78._4_4_, uStack_28);
                    pcVar4 = 0xb269dc;
                    if ((0xb269dc == 0x0) &&
                       (pcVar4 = (*kernel32.GetProcAddress)([0x0xb269c4], "EnumerateLoadedModulesW64"), pcVar4 == 0x0)) {
                        iVar6 = uStack_80;
                    }
                    else {
                        0xb269dc = pcVar4;
                        pcVar4 = 0xb269dc;
                        uVar10 = (*kernel32.GetCurrentProcess)();
                        (*pcVar4)(uVar10, sub_40e2d0, &uStack_80);
                        uStack_5c = uStack_80;
                        uVar13 = uStack_5c;
                        iStack_54 = uStack_78;
                        uStack_5c._0_4_ = uStack_80;
                        bVar12 = uStack_78 == uStack_5c;
                        iVar8 = uStack_78;
                        iVar6 = uStack_5c;
                        uStack_5c = uVar13;
                        if (bVar12) {
                            iStack_38 = uStack_78;
                            uStack_14 = 1;
                            func_0x0040e240();
                            iVar8 = iStack_38;
                            iVar6 = uStack_5c;
                        }
                        iVar2 = uStack_5c._4_4_;
                        *(uStack_5c._4_4_ + iVar8 * 2) = 0;
                        pcVar4 = 0xb269d8;
                        if ((0xb269d8 != 0x0) ||
                           (pcVar4 = (*kernel32.GetProcAddress)([0x0xb269c4], "SymSetSearchPathW"), pcVar4 != 0x0)) {
                            0xb269d8 = pcVar4;
                            pcVar4 = 0xb269d8;
                            uVar10 = (*kernel32.GetCurrentProcess)();
                            (*pcVar4)(uVar10, iVar2);
/* listing truncated */
0x412766 sub_412766 str 4 api 0 imm 7 Malware 
sub_412766() {
    mov          eax, [eax+0x04]
    mov          [ebp-0x30], eax
    mov          eax, [esi+0x04]
    push         0x02
    push         0xB1C2B5
    push         [esi]
    call         [eax+0x0C]
    add          esp, 0x0C
    mov          [ebp-0x38], esi
    lea          esi, [ebp-0x38]
    mov          [ebp-0x34], al
    mov          byte ptr [ebp-0x33], 0x00
    lea          eax, [ebp-0x30]
    mov          edx, 0xB1C2B7
    mov          ecx, esi
    push         sub_413650()
    push         eax
    push         0x04
    call         sub_403f80()
    add          esp, 0x0C
    mov          ecx, [ebp-0x30]
    call         sub_4129d0()
    mov          [ebp-0x1D], al
    lea          eax, [ebp-0x1D]
    mov          ecx, esi
    mov          edx, 0xB1C2BB
    push         sub_413620()
    push         eax
    push         0x04
    call         sub_403f80()
    add          esp, 0x0C
    mov          edx, [ebp-0x30]
    lea          edi, [ebp-0x2C]
    mov          ecx, edi
    call         sub_4130d0()
    mov          dword ptr [ebp-0x10], 0x00
    mov          ecx, esi
    mov          edx, 0xB1C2BF
    push         sub_413600()
    push         edi
    push         0x07
    call         sub_403f80()
    add          esp, 0x0C
    lea          ecx, [ebp-0x38]
    call         sub_404ce0()
    cmp          dword ptr [ebp-0x2C], 0x00
    jz           .1
    mov          ecx, [ebp-0x28]
    mov          edx, 0x01
    mov          ebx, eax
    call         sub_402bb0()
    mov          eax, ebx
    jmp          .1
.1:
    mov          ecx, [ebp-0x18]
    mov          fs:[0x0], ecx
    add          esp, 0x2C
    pop          esi
    pop          edi
    pop          ebx
    pop          ebp
    ret          
}

/* DISPLAY WARNING: Type casts are NOT being printed */

undefined4 sub_412766(void)

{
    undefined uVar1;
    int32_t in_EAX;
    undefined4 uVar2;
    int32_t unaff_EBP;
    undefined4 *unaff_ESI;
    undefined4 *unaff_FS_OFFSET;
    
    *(unaff_EBP + -0x30) = *(in_EAX + 4);
    uVar1 = (**(unaff_ESI[1] + 0xc))(*unaff_ESI, 0xb1c2b5, 2);
    *(unaff_EBP + -0x38) = unaff_ESI;
    *(unaff_EBP + -0x34) = uVar1;
    *(unaff_EBP + -0x33) = 0;
    sub_403f80(4, unaff_EBP + -0x30, sub_413650);
    uVar1 = sub_4129d0();
    *(unaff_EBP + -0x1d) = uVar1;
    sub_403f80(4, unaff_EBP + -0x1d, sub_413620);
    sub_4130d0();
    *(unaff_EBP + -0x10) = 0;
    sub_403f80(7, unaff_EBP + -0x2c, sub_413600);
    uVar2 = sub_404ce0();
    if (*(unaff_EBP + -0x2c) != 0) {
        sub_402bb0();
    }
    *unaff_FS_OFFSET = *(unaff_EBP + -0x18);
    return uVar2;
}
0x4204F0 sub_4204f0 str 3 api 0 imm 11 Malware 
sub_4204f0() {
    push         ebp
    mov          ebp, esp
    push         ebx
    push         edi
    push         esi
    sub          esp, 0x44
    mov          eax, [ecx+0x0C]
    mov          edx, [ecx+0x14]
    movzx        ebx, word ptr [eax+0x1EA]
    movzx        edi, word ptr [edx+0x1EA]
    lea          esi, [ebx+edi*1+0x01]
    cmp          esi, 0x0C
    jnb          .5
    mov          [ebp-0x14], edx
    mov          edx, [ecx]
    mov          [ebp-0x24], esi
    mov          esi, [ecx+0x10]
    mov          [ebp-0x18], eax
    mov          eax, [ecx+0x04]
    mov          [ebp-0x30], esi
    movzx        esi, word ptr [edx+0x1EA]
    mov          [ebp-0x34], eax
    mov          eax, [ebp-0x18]
    mov          [ebp-0x20], edx
    mov          [ebp-0x2C], esi
    mov          esi, [ecx+0x08]
    mov          ecx, [ebp-0x24]
    mov          [eax+0x1EA], cx
    lea          eax, [esi+esi*8]
    lea          ecx, [eax+eax*2]
    add          ecx, esi
    mov          eax, [edx+ecx*1+0xCC]
    mov          [ebp-0x38], eax
    lea          eax, [edx+ecx*1+0xB4]
    movsd        xmm0, qword ptr [edx+ecx*1+0xC4]
    mov          [ebp-0x10], eax
    mov          eax, esi
    not          eax
    add          eax, [ebp-0x2C]
    movsd        [ebp-0x40], xmm0
    movsd        xmm0, qword ptr [edx+ecx*1+0xB4]
    movsd        xmm1, qword ptr [edx+ecx*1+0xBC]
    lea          ecx, [edx+ecx*1+0xD0]
    lea          edx, [eax+eax*8]
    mov          [ebp-0x28], eax
    lea          edx, [edx+edx*2]
    add          edx, eax
    lea          eax, [ebx+0x01]
    movsd        [ebp-0x48], xmm1
    movsd        [ebp-0x50], xmm0
    mov          [ebp-0x1C], eax
    push         edx
    push         ecx
    push         [ebp-0x10]
    call         sub_422cb0()
    add          esp, 0x0C
    movsd        xmm0, qword ptr [ebp-0x50]
    movsd        xmm1, qword ptr [ebp-0x48]
    mov          edx, [ebp-0x18]
    lea          eax, [ebx+ebx*8]
    lea          eax, [eax+eax*2]
    add          eax, ebx
    movsd        [edx+eax*1+0xB4], xmm0
    movsd        [edx+eax*1+0xBC], xmm1
    movsd        xmm0, qword ptr [ebp-0x40]
    movsd        [edx+eax*1+0xC4], xmm0
    mov          ecx, [ebp-0x38]
    mov          [edx+eax*1+0xCC], ecx
    mov          eax, [ebp-0x14]
    add          eax, 0xB4
    mov          [ebp-0x10], eax
    mov          eax, [ebp-0x1C]
    lea          ecx, [eax+eax*8]
    lea          ecx, [ecx+ecx*2]
    add          ecx, eax
    lea          ecx, [edx+ecx*1+0xB4]
    lea          edx, [edi+edi*8]
    lea          edx, [edx+edx*2]
    add          edx, edi
    push         edx
    push         [ebp-0x10]
    push         ecx
    call         sub_422cb0()
    add          esp, 0x0C
    mov          edx, [ebp-0x20]
    mov          eax, esi
    shl          eax, 0x04
    lea          ecx, [edx+eax*1]
    movsd        xmm0, qword ptr [edx+eax*1]
    movsd        xmm1, qword ptr [edx+eax*1+0x08]
    lea          eax, [edx+eax*1+0x10]
    mov          edx, [ebp-0x28]
    shl          edx, 0x04
    movsd        [ebp-0x48], xmm1
    movsd        [ebp-0x50], xmm0
    push         edx
    push         eax
    push         ecx
    call         sub_422cb0()
    add          esp, 0x0C
    movsd        xmm0, qword ptr [ebp-0x50]
    movsd        xmm1, qword ptr [ebp-0x48]
    mov          ecx, [ebp-0x18]
    mov          eax, ebx
    mov          edx, edi
    shl          eax, 0x04
    shl          edx, 0x04
    movsd        [ecx+eax*1], xmm0
    movsd        [ecx+eax*1+0x08], xmm1
    mov          eax, [ebp-0x1C]
    shl          eax, 0x04
    add          eax, ecx
    push         edx
    push         [ebp-0x14]
    push         eax
    call         sub_422cb0()
    add          esp, 0x0C
    mov          edx, [ebp-0x28]
    mov          ecx, [ebp-0x20]
    lea          eax, [esi+0x01]
    mov          [ebp-0x10], eax
    lea          eax, [ecx+esi*4+0x1F0]
    lea          ecx, [ecx+esi*4+0x1F4]
    shl          edx, 0x02
    push         edx
    push         ecx
    push         eax
    call         sub_422cb0()
    mov          edx, [ebp-0x2C]
    mov          ecx, [ebp-0x20]
    add          esp, 0x0C
    cmp          [ebp-0x10], edx
    jnb          .2
    dec          edx
    nop          cs:[eax+eax*1], ax
    nop          [eax+eax*1], eax
.1:
    mov          eax, [ecx+esi*4+0x1F0]
    inc          esi
    cmp          edx, esi
    mov          [eax+0xB0], ecx
    mov          [eax+0x1E8], si
    jnz          .1
.2:
    dec          word ptr [ecx+0x1EA]
    cmp          dword ptr [ebp-0x34], 0x02
    mov          esi, [ebp-0x18]
    jb           .4
    mov          eax, [ebp-0x24]
    inc          edi
    sub          eax, ebx
    cmp          edi, eax
    jnz          .6
    mov          ecx, [ebp-0x1C]
    lea          eax, [esi+0x1EC]
    lea          edx, [edi*4]
    lea          eax, [eax+ecx*4]
    mov          ecx, [ebp-0x14]
    add          ecx, 0x1EC
    push         edx
    push         ecx
    push         eax
    call         sub_422cb0()
    add          esp, 0x0C
    add          ebx, 0x7C
    nop          [eax], eax
.3:
    mov          eax, [esi+ebx*4]
    lea          ecx, [ebx-0x7B]
    inc          ebx
    dec          edi
    mov          [eax+0xB0], esi
    mov          [eax+0x1E8], cx
    jnz          .3
.4:
    mov          ecx, [ebp-0x14]
    mov          edx, 0x04
    call         sub_402bb0()
    mov          edx, [ebp-0x30]
    mov          eax, esi
    add          esp, 0x44
    pop          esi
    pop          edi
    pop          ebx
    pop          ebp
    ret          
.5:
    mov          ecx, "assertion failed: new_left_len <= CAPACITY"
    mov          edx, 0x2A
    push         0xB1BA50
    call         sub_4310e0()
.6:
    mov          ecx, "assertion failed: src.len() == dst.len()|"
    mov          edx, 0x28
    push         0xB1B7CC
    call         sub_4310e0()
}

/* DISPLAY WARNING: Type casts are NOT being printed */

undefined8 __fastcall sub_4204f0(int32_t *param_1)

{
    int32_t iVar1;
    uint32_t uVar2;
    undefined8 uVar3;
    undefined8 uVar4;
    int32_t iVar5;
    int32_t iVar6;
    uint32_t uVar7;
    undefined4 uVar8;
    code *pcVar9;
    int16_t iVar10;
    int32_t iVar11;
    int32_t iVar12;
    uint32_t uVar13;
    int32_t iVar14;
    uint32_t uVar15;
    uint32_t uVar16;
    uint32_t uVar17;
    int32_t iVar18;
    undefined8 uVar19;
    
    iVar5 = param_1[3];
    iVar14 = param_1[5];
    uVar13 = *(iVar5 + 0x1ea);
    uVar17 = *(iVar14 + 0x1ea);
    uVar2 = uVar13 + 1 + uVar17;
    if (uVar2 < 0xc) {
        iVar18 = *param_1;
        iVar6 = param_1[4];
        uVar7 = param_1[1];
        uVar15 = *(iVar18 + 0x1ea);
        uVar16 = param_1[2];
        *(iVar5 + 0x1ea) = uVar2;
        iVar12 = uVar16 * 0x1c;
        uVar8 = *(iVar18 + 0xcc + iVar12);
        uVar19 = *(iVar18 + 0xc4 + iVar12);
        iVar11 = ~uVar16 + uVar15;
        uVar3 = *(iVar18 + 0xb4 + iVar12);
        uVar4 = *(iVar18 + 0xbc + iVar12);
        iVar1 = uVar13 + 1;
        sub_422cb0(iVar18 + 0xb4 + iVar12, iVar18 + 0xd0 + iVar12, iVar11 * 0x1c);
        iVar12 = uVar13 * 0x1c;
        *(iVar5 + 0xb4 + iVar12) = uVar3;
        *(iVar5 + 0xbc + iVar12) = uVar4;
        *(iVar5 + 0xc4 + iVar12) = uVar19;
        *(iVar5 + 0xcc + iVar12) = uVar8;
        sub_422cb0(iVar5 + 0xb4 + iVar1 * 0x1c, iVar14 + 0xb4, uVar17 * 0x1c);
        iVar12 = uVar16 * 0x10;
        uVar19 = *(iVar18 + iVar12);
        uVar3 = *(iVar18 + 8 + iVar12);
        sub_422cb0(iVar18 + iVar12, iVar18 + 0x10 + iVar12, iVar11 * 0x10);
        *(iVar5 + uVar13 * 0x10) = uVar19;
        *(iVar5 + 8 + uVar13 * 0x10) = uVar3;
        sub_422cb0(iVar1 * 0x10 + iVar5, iVar14, uVar17 << 4);
        sub_422cb0(iVar18 + 0x1f0 + uVar16 * 4, iVar18 + 500 + uVar16 * 4, iVar11 * 4);
        if (uVar16 + 1 < uVar15) {
            do {
                iVar12 = *(iVar18 + 0x1f0 + uVar16 * 4);
                uVar16 = uVar16 + 1;
                *(iVar12 + 0xb0) = iVar18;
                *(iVar12 + 0x1e8) = uVar16;
            } while (uVar15 - 1 != uVar16);
        }
        *(iVar18 + 0x1ea) = *(iVar18 + 0x1ea) + -1;
        if (1 < uVar7) {
            iVar18 = uVar17 + 1;
            if (iVar18 != uVar2 - uVar13) goto code_r0x00420785;
            sub_422cb0(iVar5 + 0x1ec + iVar1 * 4, iVar14 + 0x1ec, iVar18 * 4);
            iVar14 = uVar13 + 0x7c;
            do {
                iVar1 = *(iVar5 + iVar14 * 4);
                iVar10 = iVar14;
                iVar14 = iVar14 + 1;
                iVar18 = iVar18 + -1;
                *(iVar1 + 0xb0) = iVar5;
                *(iVar1 + 0x1e8) = iVar10 + -0x7b;
            } while (iVar18 != 0);
        }
        sub_402bb0();
        return CONCAT44(iVar6, iVar5);
    }
    sub_4310e0(0xb1ba50);
code_r0x00420785:
    sub_4310e0(0xb1b7cc);
    pcVar9 = swi(3);
    uVar19 = (*pcVar9)();
    return uVar19;
}
0x411F10 sub_411f10 str 1 api 0 imm 9 Malware 
sub_411f10() {
    push         ebp
    mov          ebp, esp
    push         ebx
    push         edi
    push         esi
    sub          esp, 0x54
    mov          [ebp-0x1C], esp
    mov          dword ptr [ebp-0x10], 0xFFFFFFFF
    mov          dword ptr [ebp-0x14], SEH.34()
    lea          eax, [ebp-0x18]
    test         ecx, ecx
    mov          esi, fs:[0x0]
    mov          [ebp-0x18], esi
    mov          fs:[0x0], eax
    mov          eax, "<unknown>"
    mov          dword ptr [ebp-0x60], 0xB1D154
    mov          dword ptr [ebp-0x5C], 0x02
    mov          dword ptr [ebp-0x50], 0x00
    mov          dword ptr [ebp-0x30], 0x00
    mov          byte ptr [ebp-0x2C], 0x00
    cmovnz       eax, ecx
    mov          ecx, 0x09
    mov          [ebp-0x38], eax
    lea          eax, [ebp-0x38]
    cmovnz       ecx, edx
    lea          edx, [ebp-0x40]
    mov          [ebp-0x48], eax
    lea          eax, [ebp-0x48]
    mov          [ebp-0x34], ecx
    mov          dword ptr [ebp-0x44], sub_403230()
    lea          ecx, [ebp-0x30]
    mov          [ebp-0x58], eax
    lea          eax, [ebp-0x60]
    mov          dword ptr [ebp-0x54], 0x01
    push         eax
    push         ecx
    push         edx
    call         sub_40af30()
    add          esp, 0x0C
    movzx        eax, byte ptr [ebp-0x40]
    cmp          al, 0x04
    jz           .3
    cmp          al, 0x03
    jnz          .3
    mov          eax, [ebp-0x3C]
    mov          ecx, [eax]
    mov          [ebp-0x28], eax
    mov          eax, [eax+0x04]
    mov          [ebp-0x20], eax
    mov          eax, [eax]
    mov          [ebp-0x24], ecx
    test         eax, eax
    jz           .1
    mov          dword ptr [ebp-0x10], 0x00
    push         [ebp-0x24]
    call         eax
    add          esp, 0x04
.1:
    mov          eax, [ebp-0x20]
    mov          ecx, [ebp-0x24]
    cmp          dword ptr [eax+0x04], 0x00
    jz           .2
    mov          edx, [eax+0x08]
    call         sub_402bb0()
.2:
    mov          ecx, [ebp-0x28]
    mov          edx, 0x04
    call         sub_402bb0()
.3:
    mov          eax, [ebp-0x18]
    mov          fs:[0x0], eax
    add          esp, 0x54
    pop          esi
    pop          edi
    pop          ebx
    pop          ebp
    ret          
}

/* DISPLAY WARNING: Type casts are NOT being printed */

void __fastcall sub_411f10(int32_t param_1,undefined4 param_2)

{
    int32_t **unaff_FS_OFFSET;
    undefined4 uStack_64;
    undefined4 uStack_60;
    int32_t **ppiStack_5c;
    undefined4 uStack_58;
    undefined4 uStack_54;
    int32_t *piStack_4c;
    code *pcStack_48;
    char acStack_44 [4];
    undefined4 *puStack_40;
    int32_t iStack_3c;
    undefined4 uStack_38;
    undefined4 uStack_34;
    undefined uStack_30;
    undefined4 *puStack_2c;
    undefined4 uStack_28;
    code **ppcStack_24;
    undefined4 *puStack_20;
    int32_t *piStack_1c;
    code *pcStack_18;
    undefined4 uStack_14;
    
    puStack_20 = &uStack_64;
    uStack_14 = 0xffffffff;
    pcStack_18 = SEH.34;
    piStack_1c = *unaff_FS_OFFSET;
    *unaff_FS_OFFSET = &piStack_1c;
    uStack_64 = 0xb1d154;
    uStack_60 = 2;
    uStack_54 = 0;
    uStack_34 = 0;
    uStack_30 = 0;
    iStack_3c = "<unknown>";
    if (param_1 != 0) {
        iStack_3c = param_1;
    }
    piStack_4c = &iStack_3c;
    uStack_38 = 9;
    if (param_1 != 0) {
        uStack_38 = param_2;
    }
    ppiStack_5c = &piStack_4c;
    pcStack_48 = sub_403230;
    uStack_58 = 1;
    sub_40af30(acStack_44, &uStack_34, &uStack_64);
    if ((acStack_44[0] != '\x04') && (acStack_44[0] == '\x03')) {
        uStack_28 = *puStack_40;
        puStack_2c = puStack_40;
        ppcStack_24 = puStack_40[1];
        if (*ppcStack_24 != 0x0) {
            uStack_14 = 0;
            (**ppcStack_24)(uStack_28);
        }
        if (ppcStack_24[1] != 0x0) {
            sub_402bb0();
        }
        sub_402bb0();
    }
    *unaff_FS_OFFSET = piStack_1c;
    return;
}
0x411AC0 sub_411ac0 str 0 api 0 imm 11 Malware 
sub_411ac0() {
    push         ebp
    mov          ebp, esp
    push         ebx
    push         edi
    push         esi
    sub          esp, 0x34
    mov          [ebp-0x1C], esp
    mov          dword ptr [ebp-0x10], 0xFFFFFFFF
    mov          dword ptr [ebp-0x14], SEH.33()
    mov          edi, ecx
    call         .1
.1:
    pop          eax
    mov          ecx, fs:[0x0]
    mov          [ebp-0x30], eax
    lea          eax, [ebp-0x18]
    mov          [ebp-0x18], ecx
    mov          fs:[0x0], eax
    cmp          byte ptr [edi+0x0C], 0x00
    jnz          .14
    lea          eax, [edi+0x0D]
    mov          dword ptr [ebp-0x20], 0x00
    mov          [ebp-0x28], edi
    mov          [ebp-0x38], eax
    jmp          .2
    cmp          byte ptr [edx+0x08], 0x23
    jnz          .7
.2:
    mov          edx, [edi+0x08]
    mov          ecx, [ebp-0x20]
    mov          esi, edx
    sub          esi, ecx
    jbe          .5
    mov          byte ptr [edi+0x0C], 0x01
    mov          dword ptr [ebp-0x10], 0x01
    mov          edx, 0xFFFFFFF5
    mov          eax, [edi+0x04]
    add          eax, ecx
    lea          ecx, [ebp-0x40]
    push         [ebp-0x38]
    mov          [ebp-0x2C], esi
    push         esi
    push         eax
    call         sub_40b610()
    add          esp, 0x0C
    movzx        eax, byte ptr [ebp-0x40]
    mov          edx, [ebp-0x3C]
    cmp          al, 0x04
    jz           .3
    test         al, al
    setz         al
    cmp          edx, 0x06
    setz         cl
    and          cl, al
    cmp          cl, 0x01
    jz           .4
.3:
    mov          ebx, [ebp-0x40]
    mov          edi, [ebp-0x28]
    movzx        eax, bl
    mov          byte ptr [edi+0x0C], 0x00
    mov          eax, [eax*4+0x411DD4]
    add          eax, [ebp-0x30]
    jmp          eax
    mov          eax, ebx
    and          eax, 0xFF00
    cmp          eax, 0x2300
    jz           .2
    jmp          .7
.4:
    mov          edi, [ebp-0x28]
    mov          edx, [ebp-0x2C]
    mov          byte ptr [edi+0x0C], 0x00
    mov          eax, [ebp-0x20]
    test         edx, edx
    jz           .6
    add          eax, edx
    mov          [ebp-0x20], eax
    jmp          .2
.5:
    test         ecx, ecx
    jz           .14
    cmp          edx, ecx
    jb           .17
    xor          esi, esi
    mov          ebx, 0x04
    jmp          .10
.6:
    mov          ebx, 0x02
    mov          edx, 0xB1BF54
.7:
    mov          eax, [ebp-0x20]
    test         eax, eax
    jz           .8
    mov          [ebp-0x24], edx
    mov          edx, [edi+0x08]
    mov          esi, edx
    sub          esi, eax
    jb           .16
    mov          dword ptr [edi+0x08], 0x00
    jnz          .9
    mov          edx, [ebp-0x24]
.8:
    cmp          bl, 0x04
    jnz          .11
    jmp          .14
.9:
    mov          eax, [edi+0x04]
    mov          ecx, [ebp-0x20]
    add          ecx, eax
    push         esi
    push         ecx
    push         eax
    call         sub_422cb0()
    add          esp, 0x0C
    mov          edx, [ebp-0x24]
.10:
    mov          [edi+0x08], esi
    cmp          bl, 0x04
    jz           .14
.11:
    cmp          bl, 0x03
    jnz          .14
    mov          eax, [edx]
    mov          [ebp-0x24], edx
    mov          [ebp-0x20], eax
    mov          eax, [edx+0x04]
    mov          [ebp-0x30], eax
    mov          eax, [eax]
    test         eax, eax
    jz           .12
    mov          dword ptr [ebp-0x10], 0x03
    push         [ebp-0x20]
    call         eax
    add          esp, 0x04
.12:
    mov          eax, [ebp-0x30]
    mov          ecx, [ebp-0x20]
    cmp          dword ptr [eax+0x04], 0x00
    jz           .13
    mov          edx, [eax+0x08]
    call         sub_402bb0()
.13:
    mov          ecx, [ebp-0x24]
    mov          edx, 0x04
    call         sub_402bb0()
    mov          edi, [ebp-0x28]
.14:
    cmp          dword ptr [edi], 0x00
    jz           .15
    mov          ecx, [edi+0x04]
    mov          edx, 0x01
    call         sub_402bb0()
.15:
    mov          eax, [ebp-0x18]
    mov          fs:[0x0], eax
    add          esp, 0x34
    pop          esi
    pop          edi
    pop          ebx
    pop          ebp
    ret          
.16:
    mov          ecx, [ebp-0x20]
    mov          dword ptr [ebp-0x10], 0x00
    push         0xB1BAE0
    call         sub_431070()
    add          esp, 0x04
    jmp          .18
.17:
    mov          dword ptr [ebp-0x10], 0x00
    push         0xB1BAE0
    call         sub_431070()
    add          esp, 0x04
.18:
    ud2         
}

/* WARNING: Removing unreachable block (ram,0x00411c6c) */

/* DISPLAY WARNING: Type casts are NOT being printed */

void __fastcall sub_411ac0(int32_t *param_1)

{
    undefined4 *puVar1;
    char cVar2;
    int32_t iVar3;
    int32_t **unaff_FS_OFFSET;
    uint32_t uStack_44;
    int32_t iStack_40;
    int32_t iStack_3c;
    code **ppcStack_34;
    int32_t iStack_30;
    int32_t *piStack_2c;
    undefined4 *puStack_28;
    undefined4 *puStack_24;
    uint32_t *puStack_20;
    int32_t *piStack_1c;
    code *pcStack_18;
    undefined4 uStack_14;
    
    puStack_20 = &uStack_44;
    uStack_14 = 0xffffffff;
    pcStack_18 = SEH.33;
    piStack_1c = *unaff_FS_OFFSET;
    ppcStack_34 = 0x411ae1;
    *unaff_FS_OFFSET = &piStack_1c;
    if (*(param_1 + 3) == '\0') {
        iStack_3c = param_1 + 0xd;
        puStack_24 = 0x0;
        piStack_2c = param_1;
        puStack_20 = &uStack_44;
        while( true ) {
            puVar1 = piStack_2c[2];
            iVar3 = puVar1 - puStack_24;
            if (puVar1 < puStack_24 || iVar3 == 0) break;
            *(piStack_2c + 3) = 1;
            uStack_14 = 1;
            iStack_30 = iVar3;
            sub_40b610(piStack_2c[1] + puStack_24, iVar3, iStack_3c);
            param_1 = piStack_2c;
            if ((uStack_44 == '\x04') || (iStack_40 != 6 || uStack_44 != '\0')) {
                *(piStack_2c + 3) = 0;
    /* WARNING: Could not recover jumptable at 0x00411b9a. Too many branches */
    /* WARNING: Treating indirect jump as call */
                (*(*((uStack_44 & 0xff) * 4 + 0x411dd4) + ppcStack_34))();
                return;
            }
            *(piStack_2c + 3) = 0;
            if (iStack_30 == 0) {
                cVar2 = '\x02';
                if (puStack_24 != 0x0) {
                    puStack_28 = 0xb1bf54;
                    iVar3 = piStack_2c[2] - puStack_24;
                    if (piStack_2c[2] < puStack_24) {
                        uStack_14 = 0;
                        sub_431070(0xb1bae0);
                        goto code_r0x00411d28;
                    }
                    piStack_2c[2] = 0;
                    if (iVar3 != 0) {
                        sub_422cb0(piStack_2c[1], puStack_24 + piStack_2c[1], iVar3);
                        puVar1 = puStack_28;
                        goto code_r0x00411c84;
                    }
                }
                puVar1 = 0xb1bf54;
                goto code_r0x00411c8c;
            }
            puStack_24 = puStack_24 + iStack_30;
        }
        param_1 = piStack_2c;
        if (puStack_24 != 0x0) {
            if (puVar1 < puStack_24) {
                uStack_14 = 0;
                sub_431070(0xb1bae0);
code_r0x00411d28:
                do {
                    invalidInstructionException();
                } while( true );
            }
            iVar3 = 0;
            cVar2 = '\x04';
code_r0x00411c84:
            param_1[2] = iVar3;
            if (cVar2 != '\x04') {
code_r0x00411c8c:
                if (cVar2 == '\x03') {
                    puStack_24 = *puVar1;
                    ppcStack_34 = puVar1[1];
                    puStack_28 = puVar1;
                    if (*ppcStack_34 != 0x0) {
                        uStack_14 = 3;
                        (**ppcStack_34)(puStack_24);
                    }
                    if (ppcStack_34[1] != 0x0) {
                        sub_402bb0();
                    }
                    sub_402bb0();
                    param_1 = piStack_2c;
                }
            }
        }
    }
    if (*param_1 != 0) {
        sub_402bb0();
    }
    *unaff_FS_OFFSET = piStack_1c;
    return;
}
0x41A5D0 sub_41a5d0 str 0 api 0 imm 4 Malware 
sub_41a5d0() {
    push         ebp
    sub          esp, 0x28
    add          ebp, 0x0C
    cmp          dword ptr [ebp-0x98], 0x00
    jz           .1
    mov          ecx, [ebp-0x94]
    mov          edx, 0x02
    call         sub_402bb0()
.1:
    add          esp, 0x28
    pop          ebp
    ret          
}

/* DISPLAY WARNING: Type casts are NOT being printed */

void sub_41a5d0(void)

{
    int32_t unaff_EBP;
    
    if (*(unaff_EBP + -0x8c) != 0) {
        sub_402bb0();
    }
    return;
}
0x41E500 sub_41e500 str 0 api 0 imm 4 Malware 
sub_41e500() {
    push         ebp
    sub          esp, 0x10
    add          ebp, 0x0C
    cmp          dword ptr [ebp-0x24], 0x00
    jz           .1
    mov          ecx, [ebp-0x28]
    mov          edx, 0x02
    call         sub_402bb0()
.1:
    mov          byte ptr [ebp-0x1D], 0x00
    add          esp, 0x10
    pop          ebp
    ret          
}

/* DISPLAY WARNING: Type casts are NOT being printed */

void sub_41e500(void)

{
    int32_t unaff_EBP;
    
    if (*(unaff_EBP + -0x18) != 0) {
        sub_402bb0();
    }
    *(unaff_EBP + -0x11) = 0;
    return;
}
0x41E8D0 sub_41e8d0 str 0 api 0 imm 4 Malware 
sub_41e8d0() {
    push         ebp
    sub          esp, 0x10
    add          ebp, 0x0C
    cmp          dword ptr [ebp-0x24], 0x00
    jz           .1
    mov          ecx, [ebp-0x28]
    mov          edx, 0x02
    call         sub_402bb0()
.1:
    mov          byte ptr [ebp-0x1D], 0x00
    add          esp, 0x10
    pop          ebp
    ret          
}

/* DISPLAY WARNING: Type casts are NOT being printed */

void sub_41e8d0(void)

{
    int32_t unaff_EBP;
    
    if (*(unaff_EBP + -0x18) != 0) {
        sub_402bb0();
    }
    *(unaff_EBP + -0x11) = 0;
    return;
}
0x40C120 sub_40c120 str 0 api 0 imm 3 Malware 
sub_40c120() {
    push         ebp
    sub          esp, 0x10
    lea          esi, [ebp-0x29C]
    mov          ebp, [esi+0x288]
    mov          eax, [esi+0x08]
    mov          ecx, [esi+0x04]
    cmp          dword ptr [eax+0x04], 0x00
    jz           .1
    mov          eax, [esi+0x08]
    mov          edx, [eax+0x08]
    call         sub_402bb0()
.1:
    mov          ecx, [esi+0x10]
    mov          edx, 0x04
    call         sub_402bb0()
    add          esp, 0x10
    pop          ebp
    ret          
}

/* DISPLAY WARNING: Type casts are NOT being printed */

void sub_40c120(void)

{
    int32_t unaff_EBP;
    
    if (*(*(unaff_EBP + -0x294) + 4) != 0) {
        sub_402bb0();
    }
    sub_402bb0();
    return;
}
0x40C160 sub_40c160 str 0 api 0 imm 3 Malware 
sub_40c160() {
    push         ebp
    sub          esp, 0x10
    lea          esi, [ebp-0x29C]
    mov          ebp, [esi+0x288]
    mov          eax, [esi+0x04]
    mov          ecx, [esi+0x0C]
    cmp          dword ptr [eax+0x04], 0x00
    jz           .1
    mov          eax, [esi+0x04]
    mov          edx, [eax+0x08]
    call         sub_402bb0()
.1:
    mov          ecx, [esi+0x08]
    mov          edx, 0x04
    call         sub_402bb0()
    add          esp, 0x10
    pop          ebp
    ret          
}

/* DISPLAY WARNING: Type casts are NOT being printed */

void sub_40c160(void)

{
    int32_t unaff_EBP;
    
    if (*(*(unaff_EBP + -0x298) + 4) != 0) {
        sub_402bb0();
    }
    sub_402bb0();
    return;
}
0x40C1A0 sub_40c1a0 str 0 api 0 imm 3 Malware 
sub_40c1a0() {
    push         ebp
    sub          esp, 0x10
    lea          esi, [ebp-0x29C]
    mov          ebp, [esi+0x288]
    mov          eax, [esi+0x14]
    mov          ecx, [esi+0x10]
    cmp          dword ptr [eax+0x04], 0x00
    jz           .1
    mov          eax, [esi+0x14]
    mov          edx, [eax+0x08]
    call         sub_402bb0()
.1:
    mov          ecx, [esi+0x18]
    mov          edx, 0x04
    call         sub_402bb0()
    add          esp, 0x10
    pop          ebp
    ret          
}

/* DISPLAY WARNING: Type casts are NOT being printed */

void sub_40c1a0(void)

{
    int32_t unaff_EBP;
    
    if (*(*(unaff_EBP + -0x288) + 4) != 0) {
        sub_402bb0();
    }
    sub_402bb0();
    return;
}
0x40C1E0 sub_40c1e0 str 0 api 0 imm 3 Malware 
sub_40c1e0() {
    push         ebp
    sub          esp, 0x10
    lea          esi, [ebp-0x29C]
    mov          ebp, [esi+0x288]
    mov          eax, [esi+0x04]
    mov          ecx, [esi+0x0C]
    cmp          dword ptr [eax+0x04], 0x00
    jz           .1
    mov          eax, [esi+0x04]
    mov          edx, [eax+0x08]
    call         sub_402bb0()
.1:
    mov          ecx, [esi+0x08]
    mov          edx, 0x04
    call         sub_402bb0()
    add          esp, 0x10
    pop          ebp
    ret          
}

/* DISPLAY WARNING: Type casts are NOT being printed */

void sub_40c1e0(void)

{
    int32_t unaff_EBP;
    
    if (*(*(unaff_EBP + -0x298) + 4) != 0) {
        sub_402bb0();
    }
    sub_402bb0();
    return;
}
0x4012A4 sub_4012a4 str 0 api 0 imm 2 Malware 
sub_4012a4() {
    push         ebp
    push         ebx
    push         edi
    push         esi
    mov          edi, [edx+0xB0]
    mov          ebx, [esp+0x14]
    mov          eax, edx
    mov          esi, ecx
    test         edi, edi
    jz           .1
    inc          ebx
    mov          ebp, ebx
    movzx        ebx, word ptr [eax+0x1E8]
    jmp          .2
.1:
    mov          ebp, eax
.2:
    push         0x04
    pop          edx
    mov          ecx, eax
    call         sub_402bb0()
    mov          [esi], edi
    mov          [esi+0x08], ebx
    mov          [esi+0x04], ebp
    pop          esi
    pop          edi
    pop          ebx
    pop          ebp
    ret          
}

/* DISPLAY WARNING: Type casts are NOT being printed */

void __fastcall sub_4012a4(int32_t *param_1,int32_t param_2,uint32_t param_3)

{
    int32_t iVar1;
    int32_t iVar2;
    
    iVar1 = *(param_2 + 0xb0);
    if (iVar1 != 0) {
        iVar2 = param_3 + 1;
        param_3 = *(param_2 + 0x1e8);
        param_2 = iVar2;
    }
    sub_402bb0();
    *param_1 = iVar1;
    param_1[2] = param_3;
    param_1[1] = param_2;
    return;
}
0x4138E0 sub_4138e0 str 81 api 0 imm 31 Unknown 
sub_4138e0() {
    push         ebp
    mov          ebp, esp
    push         ebx
    push         edi
    push         esi
    sub          esp, 0x50
    mov          edi, [ebp+0x08]
    mov          eax, [ebp+0x0C]
    mov          [ebp-0x24], ecx
    call         .1
.1:
    pop          ecx
    mov          dword ptr [ebp-0x5C], 0x00
    mov          dword ptr [ebp-0x48], 0x00
    mov          [ebp-0x28], edx
    mov          [ebp-0x20], ecx
    add          eax, edi
    mov          [ebp-0x34], edi
    mov          [ebp-0x2C], eax
    mov          [ebp-0x30], eax
    xor          eax, eax
.2:
    mov          esi, eax
    jmp          .5
    mov          word ptr [ebp-0x18], 0x6E5C
    nop          cs:[eax+eax*1], ax
    nop          [eax], eax
.3:
    mov          dword ptr [ebp-0x12], 0x00
    mov          dword ptr [ebp-0x16], 0x00
    mov          bh, 0x02
    mov          dword ptr [ebp-0x1C], 0x00
.4:
    movzx        eax, word ptr [ebp-0x10]
    movsd        xmm0, qword ptr [ebp-0x18]
    lea          edx, [ebp-0x58]
    mov          esi, 0x01
    mov          [edx+0x08], ax
    movsd        [edx], xmm0
    mov          edx, [ebp-0x1C]
    mov          al, 0x01
.5:
    cmp          dl, bh
    setb         bl
    and          bl, al
    cmp          bl, 0x01
    jz           .16
    cmp          edi, [ebp-0x2C]
    jz           .19
    movzx        edx, byte ptr [edi]
    movzx        eax, dl
    test         dl, dl
    js           .6
    inc          edi
    jmp          .8
.6:
    movzx        esi, byte ptr [edi+0x01]
    and          eax, 0x1F
    and          esi, 0x3F
    cmp          dl, 0xDF
    jbe          .7
    movzx        ecx, byte ptr [edi+0x02]
    shl          esi, 0x06
    and          ecx, 0x3F
    or           ecx, esi
    cmp          dl, 0xF0
    jb           .10
    movzx        esi, byte ptr [edi+0x03]
    shl          ecx, 0x06
    and          eax, 0x07
    shl          eax, 0x12
    and          esi, 0x3F
    or           esi, ecx
    mov          ecx, [ebp-0x20]
    or           esi, eax
    cmp          esi, 0x110000
    jz           .19
    add          edi, 0x04
    cmp          esi, 0x27
    jbe          .9
    jmp          .11
.7:
    shl          eax, 0x06
    add          edi, 0x02
    or           eax, esi
.8:
    mov          esi, eax
    cmp          esi, 0x27
    jnbe         .11
.9:
    mov          eax, [esi*4+0x413B74]
    add          eax, ecx
    jmp          eax
    mov          word ptr [ebp-0x18], 0x305C
    jmp          .3
.10:
    shl          eax, 0x0C
    add          edi, 0x03
    or           ecx, eax
    mov          esi, ecx
    mov          ecx, [ebp-0x20]
    cmp          esi, 0x27
    jbe          .9
.11:
    cmp          esi, 0x5C
    jnz          .12
    mov          word ptr [ebp-0x18], 0x5C5C
    jmp          .3
.12:
    cmp          esi, 0x2FF
    jbe          .13
    mov          ecx, esi
    call         sub_403a60()
    test         al, al
    jnz          .14
.13:
    mov          ecx, esi
    call         sub_403950()
    test         al, al
    jz           .14
    mov          al, 0x80
    mov          [ebp-0x18], esi
    mov          bh, 0x81
    mov          [ebp-0x1C], eax
    jmp          .15
.14:
    mov          eax, esi
    mov          byte ptr [ebp-0x16], 0x00
    mov          word ptr [ebp-0x18], 0x00
    mov          bh, 0x0A
    or           eax, 0x01
    bsr          eax, eax
    xor          eax, 0x1C
    shr          eax, 0x02
    lea          ecx, [eax-0x02]
    mov          [ebp-0x1C], ecx
    mov          ecx, esi
    shr          ecx, 0x14
    movzx        ecx, byte ptr [ecx+"0123456789abcdef"]
    mov          [ebp-0x15], cl
    mov          ecx, esi
    shr          ecx, 0x10
    and          ecx, 0x0F
    movzx        ecx, byte ptr [ecx+"0123456789abcdef"]
    mov          [ebp-0x14], cl
    mov          ecx, esi
    shr          ecx, 0x0C
    and          ecx, 0x0F
    movzx        ecx, byte ptr [ecx+"0123456789abcdef"]
    mov          [ebp-0x13], cl
    mov          ecx, esi
    shr          ecx, 0x08
    and          ecx, 0x0F
    movzx        ecx, byte ptr [ecx+"0123456789abcdef"]
    mov          [ebp-0x12], cl
    mov          ecx, esi
    and          esi, 0x0F
    shr          ecx, 0x04
    movzx        edx, byte ptr [esi+"0123456789abcdef"]
    and          ecx, 0x0F
    movzx        ecx, byte ptr [ecx+"0123456789abcdef"]
    mov          [ebp-0x11], cl
    mov          [ebp-0x10], dl
    mov          byte ptr [ebp-0x0F], 0x7D
    mov          word ptr [ebp+eax*1-0x1A], 0x755C
    mov          byte ptr [ebp+eax*1-0x18], 0x7B
.15:
    mov          ecx, [ebp-0x20]
    jmp          .4
.16:
    cmp          bh, 0x80
    mov          [ebp-0x5C], esi
    mov          [ebp-0x34], edi
    mov          [ebp-0x4B], bh
    jbe          .17
    mov          eax, [ebp-0x58]
    jmp          .18
.17:
    movzx        eax, dl
    movzx        eax, byte ptr [ebp+eax*1-0x58]
.18:
    inc          dl
    mov          [ebp-0x1C], edx
    push         eax
    push         [ebp-0x24]
    mov          eax, [ebp-0x28]
    call         [eax+0x10]
    mov          edx, [ebp-0x1C]
    add          esp, 0x08
    mov          ecx, [ebp-0x20]
    test         al, al
    mov          eax, esi
    jz           .2
.19:
    mov          eax, ebx
    add          esp, 0x50
    pop          esi
    pop          edi
    pop          ebx
    pop          ebp
    ret          
}

/* DISPLAY WARNING: Type casts are NOT being printed */

uint32_t __fastcall sub_4138e0(undefined4 param_1,uint32_t param_2,uint8_t *param_3,int32_t param_4)

{
    uint8_t *puVar1;
    int16_t iVar2;
    char cVar3;
    undefined4 uVar4;
    uint32_t uVar5;
    uint32_t uVar6;
    int32_t iVar7;
    uint8_t uVar8;
    uint8_t uVar9;
    uint32_t unaff_EBX;
    undefined4 uVar10;
    undefined8 uStack_5c;
    undefined2 uStack_54;
    uint8_t uStack_4f;
    undefined4 uStack_4c;
    uint8_t *puStack_38;
    uint8_t *puStack_34;
    uint8_t *puStack_30;
    uint32_t uStack_2c;
    undefined4 uStack_28;
    int32_t iStack_24;
    undefined4 uStack_20;
    undefined2 uStack_1c;
    undefined uStack_1a;
    undefined uStack_19;
    undefined uStack_18;
    undefined uStack_17;
    undefined uStack_16;
    undefined uStack_15;
    undefined uStack_14;
    undefined uStack_13;
    
    uStack_28 = param_1;
    uVar10 = 0;
    uStack_4c = 0;
    uStack_2c = param_2;
    iStack_24 = 0x4138f7;
    puStack_38 = param_3;
    puStack_30 = param_3 + param_4;
    puStack_34 = param_3 + param_4;
    uVar4 = 0;
    iVar7 = iStack_24;
    uVar5 = param_2;
    while( true ) {
        while( true ) {
            uVar9 = unaff_EBX >> 8;
            uVar8 = uVar5 < uVar9 & uVar4;
            unaff_EBX = CONCAT31(unaff_EBX >> 8, uVar8);
            if (uVar8 != 1) break;
            puStack_38 = param_3;
            uStack_4f = uVar9;
            if (uVar9 < 0x81) {
                uVar6 = *(&uStack_5c + (uVar5 & 0xff));
            }
            else {
                uVar6 = uStack_5c;
            }
            uStack_20 = CONCAT31(uVar5 >> 8, uVar5 + 1);
            uVar10 = uVar4;
            cVar3 = (**(uStack_2c + 0x10))(uStack_28, uVar6, uVar4);
            iVar7 = iStack_24;
            uVar5 = uStack_20;
            if (cVar3 != '\0') {
                return unaff_EBX;
            }
        }
        if (param_3 == puStack_30) {
            return unaff_EBX;
        }
        uVar8 = *param_3;
        uVar5 = uVar8;
        if (uVar8 < '\0') {
            puVar1 = param_3 + 1;
            if (uVar8 < 0xe0) {
                param_3 = param_3 + 2;
                uVar5 = (uVar5 & 0x1f) << 6 | *puVar1 & 0x3f;
            }
            else {
                uVar6 = param_3[2] & 0x3f | (*puVar1 & 0x3f) << 6;
                iVar7 = iStack_24;
                if (uVar8 < 0xf0) {
                    param_3 = param_3 + 3;
                    uVar5 = uVar6 | (uVar5 & 0x1f) << 0xc;
                }
                else {
                    uVar5 = param_3[3] & 0x3f | uVar6 << 6 | (uVar5 & 7) << 0x12;
                    if (uVar5 == 0x110000) {
                        return unaff_EBX;
                    }
                    param_3 = param_3 + 4;
                }
            }
        }
        else {
            param_3 = param_3 + 1;
        }
        if (uVar5 < 0x28) break;
        if (uVar5 == 0x5c) {
            uStack_1c = 0x5c5c;
            uStack_16 = 0;
            uStack_15 = 0;
            uStack_14 = 0;
            uStack_13 = 0;
            uStack_1a = 0;
            uStack_19 = 0;
            uStack_18 = 0;
            uStack_17 = 0;
            unaff_EBX = 0x200;
            uStack_20 = 0;
        }
        else {
            if (((uVar5 < 0x300) || (cVar3 = sub_403a60(uVar10), cVar3 == '\0')) &&
               (uVar4 = sub_403950(), uVar4 != '\0')) {
                uStack_1c = uVar5;
                uStack_1a = uVar5 >> 0x10;
                uStack_19 = uVar5 >> 0x18;
                uStack_19 = 0;
                iVar2 = 0x81;
                uStack_20 = CONCAT31(uVar4 >> 8, 0x80);
            }
            else {
                uStack_1a = 0;
                uStack_1c = 0;
                iVar2 = 10;
                uVar6 = 0x1f;
                if ((uVar5 | 1) != 0) {
                    for (; (uVar5 | 1) >> uVar6 == 0; uVar6 = uVar6 - 1) {
                    }
                }
                uVar6 = (uVar6 ^ 0x1c) >> 2;
                uStack_20 = uVar6 - 2;
                uStack_19 = *((uVar5 >> 0x14) + "0123456789abcdef");
                uStack_18 = *((uVar5 >> 0x10 & 0xf) + "0123456789abcdef");
                uStack_17 = *((uVar5 >> 0xc & 0xf) + "0123456789abcdef");
                uStack_16 = *((uVar5 >> 8 & 0xf) + "0123456789abcdef");
                uStack_15 = *((uVar5 >> 4 & 0xf) + "0123456789abcdef");
                uStack_14 = *((uVar5 & 0xf) + "0123456789abcdef");
                uStack_13 = 0x7d;
                *(&uStack_20 + uVar6 + 2) = 0x755c;
                *(&uStack_1c + uVar6) = 0x7b;
            }
            unaff_EBX = iVar2 << 8;
            iVar7 = iStack_24;
        }
        uVar4 = 1;
        uStack_54 = CONCAT11(uStack_13, uStack_14);
        uStack_5c = CONCAT17(uStack_15, 
                             CONCAT16(uStack_16, 
                                      CONCAT15(uStack_17, 
                                               CONCAT14(uStack_18, CONCAT13(uStack_19, CONCAT12(uStack_1a, uStack_1c))))
                                     ));
        uVar5 = uStack_20;
    }
    /* WARNING: Could not recover jumptable at 0x004139f5. Too many branches */
    /* WARNING: Treating indirect jump as call */
    uVar5 = (*(*(uVar5 * 4 + 0x413b74) + iVar7))();
    return uVar5;
}
0x403460 sub_403460 str 34 api 0 imm 17 Unknown 
sub_403460() {
    push         ebp
    mov          ebp, esp
    push         ebx
    push         edi
    push         esi
    sub          esp, 0x28
    cmp          ecx, 0x3E8
    mov          eax, edx
    mov          edi, 0x14
    mov          [ebp-0x14], edx
    mov          [ebp-0x10], ecx
    sbb          eax, 0x00
    jb           .2
    mov          esi, ecx
    mov          ebx, 0x14
    mov          ecx, edx
    nop         
.1:
    lea          eax, [ebx-0x04]
    mov          [ebp-0x20], ecx
    mov          [ebp-0x1C], eax
    push         0x00
    push         0x2710
    push         ecx
    push         esi
    call         __aulldiv()
    imul         edi, eax, 0x2710
    mov          ecx, esi
    mov          [ebp-0x18], eax
    sub          ecx, edi
    movzx        eax, cx
    shr          eax, 0x02
    imul         eax, eax, 0x147B
    shr          eax, 0x11
    imul         edi, eax, 0x64
    movzx        eax, word ptr [eax+eax*1+0xB1A2EB]
    sub          ecx, edi
    mov          edi, [ebp-0x1C]
    mov          [ebp+ebx*1-0x38], ax
    movzx        eax, cx
    mov          ecx, edx
    movzx        eax, word ptr [eax+eax*1+0xB1A2EB]
    mov          [ebp+ebx*1-0x36], ax
    mov          eax, 0x98967F
    mov          ebx, edi
    cmp          eax, esi
    mov          eax, 0x00
    sbb          eax, [ebp-0x20]
    mov          eax, [ebp-0x18]
    mov          esi, eax
    jb           .1
    jmp          .3
.2:
    mov          eax, ecx
.3:
    mov          ecx, 0x09
    xor          esi, esi
    mov          ebx, 0x00
    cmp          ecx, eax
    sbb          ebx, edx
    mov          ebx, eax
    jnb          .4
    movzx        eax, bx
    shr          eax, 0x02
    imul         eax, eax, 0x147B
    shr          eax, 0x11
    imul         ecx, eax, 0x64
    sub          ebx, ecx
    movzx        ecx, bx
    mov          ebx, eax
    movzx        ecx, word ptr [ecx+ecx*1+0xB1A2EB]
    mov          [ebp+edi*1-0x36], cx
    add          edi, 0xFFFFFFFE
    jmp          .5
.4:
    mov          esi, edx
.5:
    mov          eax, [ebp-0x10]
    mov          ecx, [ebp+0x08]
    or           eax, [ebp-0x14]
    jz           .6
    or           esi, ebx
    jz           .7
.6:
    and          ebx, 0x0F
    movzx        eax, byte ptr [ebx+ebx*1+0xB1A2EC]
    mov          [ebp+edi*1-0x35], al
    dec          edi
.7:
    mov          eax, 0x14
    lea          esi, [ebp+edi*1-0x34]
    mov          edx, 0x01
    sub          eax, edi
    push         eax
    push         esi
    push         0x00
    push         0x01
    call         sub_402c00()
    add          esp, 0x38
    pop          esi
    pop          edi
    pop          ebx
    pop          ebp
    ret          
}

/* DISPLAY WARNING: Type casts are NOT being printed */

void __fastcall sub_403460(uint32_t param_1,uint32_t param_2)

{
    uint32_t uVar1;
    uint32_t uVar2;
    int32_t iVar3;
    int32_t iVar4;
    bool bVar5;
    undefined8 uVar6;
    undefined4 uStack_3c;
    undefined auStack_38 [20];
    uint32_t uStack_24;
    int32_t iStack_20;
    uint32_t uStack_1c;
    uint32_t uStack_18;
    uint32_t uStack_14;
    
    iVar4 = 0x14;
    uStack_18 = param_2;
    uStack_14 = param_1;
    if ((param_1 < 1000) <= param_2) {
        iVar3 = 0x14;
        do {
            iStack_20 = iVar3 + -4;
            uStack_3c = 0;
            uStack_24 = param_2;
            uVar6 = __aulldiv(param_1, param_2, 10000);
            iVar4 = iStack_20;
            param_2 = uVar6 >> 0x20;
            uStack_1c = uVar6;
            uVar2 = param_1 + uStack_1c * -10000;
            uVar1 = (uVar2 & 0xffff) / 100;
            *(auStack_38 + iVar3 + -4) = *(uVar1 * 2 + 0xb1a2eb);
            *(auStack_38 + iVar3 + -2) = *((uVar2 + uVar1 * -100 & 0xffff) * 2 + 0xb1a2eb);
            bVar5 = 9999999 < param_1;
            param_1 = uStack_1c;
            iVar3 = iVar4;
        } while (uStack_24 != 0 || -uStack_24 < bVar5);
    }
    if (param_2 != 0 || -param_2 < (9 < param_1)) {
        uVar1 = (param_1 & 0xffff) / 100;
        *(auStack_38 + iVar4 + -2) = *((param_1 + uVar1 * -100 & 0xffff) * 2 + 0xb1a2eb);
        iVar4 = iVar4 + -2;
        param_1 = uVar1;
        param_2 = 0;
    }
    if (((uStack_14 | uStack_18) == 0) || ((param_2 | param_1) != 0)) {
        auStack_38[iVar4 + -1] = *((param_1 & 0xf) * 2 + 0xb1a2ec);
        iVar4 = iVar4 + -1;
    }
    uStack_3c = 0x14 - iVar4;
    sub_402c00(1, 0, auStack_38 + iVar4);
    return;
}
0x4165E0 sub_4165e0 str 29 api 31 imm 88 Unknown 
sub_4165e0() {
    push         ebp
    mov          ebp, esp
    push         ebx
    push         edi
    push         esi
    sub          esp, 0x500
    mov          [ebp-0x1C], esp
    mov          dword ptr [ebp-0x10], 0xFFFFFFFF
    mov          dword ptr [ebp-0x14], SEH.50()
    mov          [ebp-0xAC], ecx
    call         .1
.1:
    pop          eax
    mov          ecx, fs:[0x0]
    mov          [ebp-0x68], eax
    lea          eax, [ebp-0x18]
    mov          [ebp-0x18], ecx
    mov          fs:[0x0], eax
    mov          eax, edx
    add          edx, 0x48
    mov          dword ptr [ebp-0xE4], 0x00
    cmp          byte ptr [eax+0x55], 0x00
    mov          [ebp-0xA8], eax
    jz           .2
    lea          ecx, [ebp-0xF4]
    mov          dword ptr [ebp-0x10], 0x00
    call         sub_41aaa0()
    jmp          .3
.2:
    movzx        eax, byte ptr [eax+0x54]
    lea          ecx, [ebp-0xF4]
    mov          dword ptr [ebp-0x10], 0x00
    mov          [ebp-0x34], al
    call         sub_41aaa0()
    cmp          byte ptr [ebp-0x34], 0x00
    jz           .8
.3:
    cmp          dword ptr [ebp-0xF4], 0x01
    jnz          .8
    xor          ecx, ecx
    mov          edx, 0x04
    call         sub_4211c0()
    test         eax, eax
    jz           .454
    mov          ecx, eax
    mov          dword ptr [eax], 0x48544150
    mov          [ebp-0x50C], eax
    lea          edx, [ebp-0x50C]
    mov          dword ptr [ebp-0x10], 0x29
    mov          [ebp-0x2C], eax
    add          ecx, 0x04
    mov          [ebp-0x508], ecx
    lea          ecx, [ebp-0x50]
    mov          word ptr [ebp-0x504], 0x00
    call         sub_41b650()
    mov          eax, [ebp-0x48]
    mov          ecx, [ebp-0x2C]
    movsd        xmm0, qword ptr [ebp-0x50]
    mov          dword ptr [ebp-0x50C], 0x04
    mov          edx, [ebp-0xF0]
    mov          dword ptr [ebp-0x28], 0x00
    mov          [ebp-0x508], ecx
    mov          dword ptr [ebp-0x504], 0x04
    mov          dword ptr [ebp-0x500], 0x00
    movsd        [ebp-0x4FC], xmm0
    mov          [ebp-0x4F4], eax
    mov          [ebp-0x20], eax
    test         edx, edx
    mov          eax, [ebp-0x4F8]
    mov          [ebp-0x34], eax
    jz           .11
    mov          eax, [ebp-0xEC]
    mov          [ebp-0x70], eax
.4:
    movzx        ecx, word ptr [edx+0x1EA]
    lea          esi, [edx+0xB4]
    mov          ebx, 0xFFFFFFFF
    mov          [ebp-0x30], edx
    lea          eax, [ecx+ecx*8]
    mov          [ebp-0x38], ecx
    lea          edi, [eax+eax*2]
    add          edi, ecx
.5:
    test         edi, edi
    jz           .6
    push         0x01
    push         [esi+0x18]
    push         [esi+0x14]
    push         [ebp-0x20]
    push         [ebp-0x34]
    call         [kernel32.CompareStringOrdinal]
    inc          ebx
    cmp          eax, 0x01
    jz           .7
    cmp          eax, 0x02
    jz           .9
    add          esi, 0x1C
    add          edi, 0xFFFFFFE4
    cmp          eax, 0x03
    jz           .5
    jmp          .407
.6:
    mov          ebx, [ebp-0x38]
    nop          [eax+eax*1], ax
.7:
    mov          eax, [ebp-0x70]
    sub          eax, 0x01
    jb           .194
    mov          edx, [ebp-0x30]
    mov          [ebp-0x70], eax
    mov          edx, [edx+ebx*4+0x1EC]
    jmp          .4
.8:
    mov          eax, [ebp-0xA8]
    xor          ecx, ecx
    jmp          .13
.9:
    mov          ecx, [ebp-0x30]
    shl          ebx, 0x04
    mov          eax, [ecx+ebx*1+0x04]
    mov          [ebp-0x28], eax
    mov          eax, [ecx+ebx*1+0x08]
.10:
    mov          ecx, [ebp-0x2C]
    jmp          .11
.11:
    mov          edx, 0x01
    mov          [ebp-0x54], eax
    call         sub_402bb0()
    cmp          dword ptr [ebp-0x4FC], 0x00
    jz           .12
    mov          ecx, [ebp-0x34]
    mov          edx, 0x02
    call         sub_402bb0()
.12:
    mov          eax, [ebp-0xA8]
    mov          ecx, [ebp-0x28]
.13:
    mov          esi, [eax+0x20]
    test         esi, esi
    jz           .15
    mov          edx, [eax+0x1C]
    mov          eax, 0x41B8A0
    cmp          esi, 0x04
    mov          [ebp-0x28], ecx
    jb           .14
    mov          eax, [edx]
    mov          ecx, 0x5C5C3F5C
    mov          dword ptr [ebp-0x10], 0x01
    bswap        eax
    cmp          ecx, eax
    mov          ecx, 0x41B890
    setnbe       al
    sbb          al, 0x00
    movsx        eax, al
    test         eax, eax
    mov          eax, 0x41B8A0
    cmovz        eax, ecx
.14:
    movzx        ecx, byte ptr [edx+esi*1-0x01]
    mov          [ebp-0x58], edx
    mov          [ebp-0x30], esi
    mov          byte ptr [ebp-0x21], 0x01
    mov          dword ptr [ebp-0x10], 0x01
    mov          [ebp-0x34], ecx
    push         ecx
    call         eax
    add          esp, 0x04
    test         al, al
    jz           .21
.15:
    mov          byte ptr [ebp-0xB4], 0x02
    mov          dword ptr [ebp-0xB0], 0xB1D530
.16:
    mov          ebx, [ebp-0xB4]
    mov          esi, [ebp-0xB0]
.17:
    mov          eax, [ebp-0xAC]
    cmp          dword ptr [ebp-0xF4], 0x00
    mov          [eax+0x04], esi
    mov          [eax], ebx
    mov          dword ptr [eax+0x08], 0x02
    jz           .19
.18:
    lea          ecx, [ebp-0xF0]
    mov          dword ptr [ebp-0x10], 0x00
    call         sub_41c3b0()
.19:
    cmp          dword ptr [ebp-0xE4], 0x04
    jb           .20
    push         [ebp-0xE0]
    call         [kernel32.CloseHandle]
.20:
    mov          eax, [ebp-0x18]
    mov          fs:[0x0], eax
    add          esp, 0x500
    pop          esi
    pop          edi
    pop          ebx
    pop          ebp
    ret          
.21:
    mov          edi, [ebp-0x30]
    mov          edx, [ebp-0x58]
    lea          esi, [edx+edi*1]
    cmp          edi, 0x03
    mov          [ebp-0x80], esi
    jbe          .22
    movzx        eax, byte ptr [esi-0x04]
    mov          ecx, eax
    add          cl, 0xBF
    cmp          cl, 0x1A
    setb         cl
    shl          cl, 0x05
    or           cl, al
    xor          eax, eax
    cmp          cl, 0x2E
    mov          ecx, 0x00
    jnz          .26
; listing truncated

/* WARNING: Removing unreachable block (ram,0x00417db6) */
/* WARNING: Removing unreachable block (ram,0x0041742f) */
/* WARNING: Removing unreachable block (ram,0x00417e74) */
/* WARNING: Removing unreachable block (ram,0x00417e7d) */
/* WARNING: Removing unreachable block (ram,0x00417e91) */
/* WARNING: Removing unreachable block (ram,0x00417ea0) */
/* WARNING: Removing unreachable block (ram,0x00417eac) */
/* WARNING: Removing unreachable block (ram,0x00417eb4) */
/* WARNING: Removing unreachable block (ram,0x00416b46) */
/* WARNING: Removing unreachable block (ram,0x0041736d) */
/* WARNING: Removing unreachable block (ram,0x00416b94) */
/* WARNING: Removing unreachable block (ram,0x004169c1) */
/* WARNING: Removing unreachable block (ram,0x004172be) */
/* WARNING: Removing unreachable block (ram,0x00417fd7) */
/* WARNING: Removing unreachable block (ram,0x004185e9) */
/* WARNING: Removing unreachable block (ram,0x00419ba4) */
/* WARNING: Removing unreachable block (ram,0x00419bc3) */
/* WARNING: Removing unreachable block (ram,0x00417586) */
/* WARNING: Removing unreachable block (ram,0x004175bb) */
/* WARNING: Removing unreachable block (ram,0x004175e0) */
/* WARNING: Removing unreachable block (ram,0x0041763a) */
/* WARNING: Removing unreachable block (ram,0x004175e5) */
/* WARNING: Removing unreachable block (ram,0x004175f1) */
/* WARNING: Removing unreachable block (ram,0x00417604) */
/* WARNING: Removing unreachable block (ram,0x0041816b) */
/* WARNING: Removing unreachable block (ram,0x00418179) */
/* WARNING: Removing unreachable block (ram,0x00418186) */
/* WARNING: Removing unreachable block (ram,0x0041761a) */
/* WARNING: Removing unreachable block (ram,0x004175c0) */
/* WARNING: Removing unreachable block (ram,0x00417e09) */
/* WARNING: Removing unreachable block (ram,0x00419ff2) */
/* WARNING: Removing unreachable block (ram,0x00417e14) */
/* WARNING: Removing unreachable block (ram,0x004184db) */
/* WARNING: Removing unreachable block (ram,0x00418828) */
/* WARNING: Removing unreachable block (ram,0x004184e6) */
/* WARNING: Removing unreachable block (ram,0x004184f9) */
/* WARNING: Removing unreachable block (ram,0x00417e27) */
/* WARNING: Removing unreachable block (ram,0x0041882d) */
/* WARNING: Removing unreachable block (ram,0x0041883e) */
/* WARNING: Removing unreachable block (ram,0x0041884b) */
/* WARNING: Removing unreachable block (ram,0x00418880) */
/* WARNING: Removing unreachable block (ram,0x00418884) */
/* WARNING: Removing unreachable block (ram,0x004188d7) */
/* WARNING: Removing unreachable block (ram,0x004188f0) */
/* WARNING: Removing unreachable block (ram,0x004189df) */
/* WARNING: Removing unreachable block (ram,0x00418a14) */
/* WARNING: Removing unreachable block (ram,0x00418a47) */
/* WARNING: Removing unreachable block (ram,0x00418a8d) */
/* WARNING: Removing unreachable block (ram,0x00418a99) */
/* WARNING: Removing unreachable block (ram,0x00418bc7) */
/* WARNING: Removing unreachable block (ram,0x00418be2) */
/* WARNING: Removing unreachable block (ram,0x00418bff) */
/* WARNING: Removing unreachable block (ram,0x00418c29) */
/* WARNING: Removing unreachable block (ram,0x004192cf) */
/* WARNING: Removing unreachable block (ram,0x004192d4) */
/* WARNING: Removing unreachable block (ram,0x0041936d) */
/* WARNING: Removing unreachable block (ram,0x00419375) */
/* WARNING: Removing unreachable block (ram,0x00419440) */
/* WARNING: Removing unreachable block (ram,0x00419535) */
/* WARNING: Removing unreachable block (ram,0x00419381) */
/* WARNING: Removing unreachable block (ram,0x00419448) */
/* WARNING: Removing unreachable block (ram,0x00419453) */
/* WARNING: Removing unreachable block (ram,0x00419456) */
/* WARNING: Removing unreachable block (ram,0x00419537) */
/* WARNING: Removing unreachable block (ram,0x0041953c) */
/* WARNING: Removing unreachable block (ram,0x0041953f) */
/* WARNING: Removing unreachable block (ram,0x00419542) */
/* WARNING: Removing unreachable block (ram,0x00419545) */
/* WARNING: Removing unreachable block (ram,0x0041a12e) */
/* WARNING: Removing unreachable block (ram,0x00419554) */
/* WARNING: Removing unreachable block (ram,0x00419557) */
/* WARNING: Removing unreachable block (ram,0x00419577) */
/* WARNING: Removing unreachable block (ram,0x00419594) */
/* WARNING: Removing unreachable block (ram,0x004195b9) */
/* WARNING: Removing unreachable block (ram,0x004195c4) */
/* WARNING: Removing unreachable block (ram,0x004195cc) */
/* WARNING: Removing unreachable block (ram,0x004195ec) */
/* WARNING: Removing unreachable block (ram,0x0041963e) */
/* WARNING: Removing unreachable block (ram,0x0041965d) */
/* WARNING: Removing unreachable block (ram,0x00419662) */
/* WARNING: Removing unreachable block (ram,0x0041966a) */
/* WARNING: Removing unreachable block (ram,0x00419675) */
/* WARNING: Removing unreachable block (ram,0x0041967c) */
/* WARNING: Removing unreachable block (ram,0x00419654) */
/* WARNING: Removing unreachable block (ram,0x00419c3a) */
/* WARNING: Removing unreachable block (ram,0x0041967e) */
/* WARNING: Removing unreachable block (ram,0x0041968f) */
/* WARNING: Removing unreachable block (ram,0x004196f3) */
/* WARNING: Removing unreachable block (ram,0x004196fd) */
/* WARNING: Removing unreachable block (ram,0x0041972a) */
/* WARNING: Removing unreachable block (ram,0x00419737) */
/* WARNING: Removing unreachable block (ram,0x00419770) */
/* WARNING: Removing unreachable block (ram,0x00419746) */
/* WARNING: Removing unreachable block (ram,0x0041977a) */
/* WARNING: Removing unreachable block (ram,0x00419757) */
/* WARNING: Removing unreachable block (ram,0x00419734) */
/* WARNING: Removing unreachable block (ram,0x00419782) */
/* WARNING: Removing unreachable block (ram,0x0041979e) */
/* WARNING: Removing unreachable block (ram,0x00419715) */
/* WARNING: Removing unreachable block (ram,0x004197a7) */
/* WARNING: Removing unreachable block (ram,0x004197af) */
/* WARNING: Removing unreachable block (ram,0x004197bc) */
/* WARNING: Removing unreachable block (ram,0x004197d2) */
/* WARNING: Removing unreachable block (ram,0x004197d7) */
/* WARNING: Removing unreachable block (ram,0x004197e0) */
/* WARNING: Removing unreachable block (ram,0x004197ed) */
/* WARNING: Removing unreachable block (ram,0x00419721) */
/* WARNING: Removing unreachable block (ram,0x004197f9) */
/* WARNING: Removing unreachable block (ram,0x0041983b) */
/* WARNING: Removing unreachable block (ram,0x004197ff) */
/* WARNING: Removing unreachable block (ram,0x00419807) */
/* WARNING: Removing unreachable block (ram,0x0041981e) */
/* WARNING: Removing unreachable block (ram,0x00419845) */
/* WARNING: Removing unreachable block (ram,0x0041986b) */
/* WARNING: Removing unreachable block (ram,0x0041987c) */
/* WARNING: Removing unreachable block (ram,0x00419a72) */
/* WARNING: Removing unreachable block (ram,0x00419a7e) */
/* WARNING: Removing unreachable block (ram,0x00419af3) */
/* WARNING: Removing unreachable block (ram,0x00419a8b) */
/* WARNING: Removing unreachable block (ram,0x00419a91) */
/* WARNING: Removing unreachable block (ram,0x00419a97) */
/* WARNING: Removing unreachable block (ram,0x00419aa1) */
/* WARNING: Removing unreachable block (ram,0x00419aa7) */
/* WARNING: Removing unreachable block (ram,0x00419ab1) */
/* WARNING: Removing unreachable block (ram,0x00419ac8) */
/* WARNING: Removing unreachable block (ram,0x00419ad5) */
/* WARNING: Removing unreachable block (ram,0x00419888) */
/* WARNING: Removing unreachable block (ram,0x004198a2) */
/* WARNING: Removing unreachable block (ram,0x004198e3) */
/* WARNING: Removing unreachable block (ram,0x004198b3) */
/* WARNING: Removing unreachable block (ram,0x004198f9) */
/* WARNING: Removing unreachable block (ram,0x004198c7) */
/* WARNING: Removing unreachable block (ram,0x00419904) */
/* WARNING: Removing unreachable block (ram,0x00419913) */
/* WARNING: Removing unreachable block (ram,0x00419892) */
/* WARNING: Removing unreachable block (ram,0x00419870) */
/* WARNING: Removing unreachable block (ram,0x00419932) */
/* WARNING: Removing unreachable block (ram,0x004199a8) */
/* WARNING: Removing unreachable block (ram,0x004199ad) */
/* WARNING: Removing unreachable block (ram,0x004199b2) */
/* WARNING: Removing unreachable block (ram,0x0041993a) */
/* WARNING: Removing unreachable block (ram,0x004199b5) */
/* WARNING: Removing unreachable block (ram,0x00419a13) */
/* WARNING: Removing unreachable block (ram,0x004199bf) */
/* WARNING: Removing unreachable block (ram,0x0041993f) */
/* WARNING: Removing unreachable block (ram,0x00419948) */
/* WARNING: Removing unreachable block (ram,0x00419a3f) */
/* WARNING: Removing unreachable block (ram,0x0041995e) */
/* WARNING: Removing unreachable block (ram,0x00419962) */
/* WARNING: Removing unreachable block (ram,0x0041996c) */
/* WARNING: Removing unreachable block (ram,0x0041996f) */
/* WARNING: Removing unreachable block (ram,0x00419976) */
/* WARNING: Removing unreachable block (ram,0x0041999f) */
/* WARNING: Removing unreachable block (ram,0x004199e0) */
/* WARNING: Removing unreachable block (ram,0x004199e3) */
/* WARNING: Removing unreachable block (ram,0x004199e5) */
/* WARNING: Removing unreachable block (ram,0x00419851) */
/* WARNING: Removing unreachable block (ram,0x00419860) */
/* WARNING: Removing unreachable block (ram,0x00419694) */
/* WARNING: Removing unreachable block (ram,0x00419686) */
/* WARNING: Removing unreachable block (ram,0x0041969e) */
/* WARNING: Removing unreachable block (ram,0x004196d7) */
/* WARNING: Removing unreachable block (ram,0x004196ad) */
/* WARNING: Removing unreachable block (ram,0x004196e1) */
/* WARNING: Removing unreachable block (ram,0x004196be) */
/* WARNING: Removing unreachable block (ram,0x004196e9) */
/* WARNING: Removing unreachable block (ram,0x004196f1) */
/* WARNING: Removing unreachable block (ram,0x00419687) */
/* WARNING: Removing unreachable block (ram,0x004197ef) */
/* WARNING: Removing unreachable block (ram,0x00419ae0) */
/* WARNING: Removing unreachable block (ram,0x00419aee) */
/* WARNING: Removing unreachable block (ram,0x00419606) */
/* WARNING: Removing unreachable block (ram,0x00419b58) */
/* WARNING: Removing unreachable block (ram,0x00419631) */
/* WARNING: Removing unreachable block (ram,0x00419639) */
/* WARNING: Removing unreachable block (ram,0x00419b1d) */
/* WARNING: Removing unreachable block (ram,0x00419b27) */
/* WARNING: Removing unreachable block (ram,0x00419b44) */
/* WARNING: Removing unreachable block (ram,0x004192dc) */
/* WARNING: Removing unreachable block (ram,0x004192e8) */
/* WARNING: Removing unreachable block (ram,0x0041938b) */
/* WARNING: Removing unreachable block (ram,0x00419392) */
/* WARNING: Removing unreachable block (ram,0x00418c32) */
/* WARNING: Removing unreachable block (ram,0x00418c42) */
/* WARNING: Removing unreachable block (ram,0x00418c4e) */
/* WARNING: Removing unreachable block (ram,0x00418c5a) */
/* WARNING: Removing unreachable block (ram,0x00418c66) */
/* WARNING: Removing unreachable block (ram,0x00418c72) */
/* WARNING: Removing unreachable block (ram,0x00418c7e) */
/* WARNING: Removing unreachable block (ram,0x00418c8a) */
/* WARNING: Removing unreachable block (ram,0x00418c96) */
/* WARNING: Removing unreachable block (ram,0x00418ca2) */
/* WARNING: Removing unreachable block (ram,0x00418cae) */
/* WARNING: Removing unreachable block (ram,0x00418cba) */
/* WARNING: Removing unreachable block (ram,0x00418cc6) */
/* WARNING: Removing unreachable block (ram,0x00418cd2) */
/* WARNING: Removing unreachable block (ram,0x00418cde) */
/* WARNING: Removing unreachable block (ram,0x00418cea) */
/* WARNING: Removing unreachable block (ram,0x00418cf6) */
/* WARNING: Removing unreachable block (ram,0x00418d02) */
/* WARNING: Removing unreachable block (ram,0x00418d0e) */
/* WARNING: Removing unreachable block (ram,0x00418d1a) */
/* WARNING: Removing unreachable block (ram,0x00418d26) */
/* WARNING: Removing unreachable block (ram,0x00418d32) */
/* WARNING: Removing unreachable block (ram,0x00418d3e) */
/* WARNING: Removing unreachable block (ram,0x00418d4a) */
/* WARNING: Removing unreachable block (ram,0x00418d56) */
/* WARNING: Removing unreachable block (ram,0x00418d62) */
/* WARNING: Removing unreachable block (ram,0x00418d6e) */
/* WARNING: Removing unreachable block (ram,0x00418d7a) */
/* WARNING: Removing unreachable block (ram,0x00418d86) */
/* WARNING: Removing unreachable block (ram,0x00418d92) */
/* WARNING: Removing unreachable block (ram,0x0041945b) */
/* WARNING: Removing unreachable block (ram,0x00418d9e) */
/* WARNING: Removing unreachable block (ram,0x00419460) */
/* WARNING: Removing unreachable block (ram,0x00418daa) */
/* WARNING: Removing unreachable block (ram,0x00418db9) */
/* WARNING: Removing unreachable block (ram,0x00419b74) */
/* WARNING: Removing unreachable block (ram,0x00419b7f) */
/* listing truncated */
LibraryFunctions
runtime/other 166
openssl 14
protobuf 5
curl 4
sqlite3 4
rust-1.75 3
rust-1.82 3
rust-1.77 2