Function at 0x4052d0
Capabilities:
Access peb ldr_data
Check os version
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x254
mov eax, dword [0x472ca0]
xor eax, esp
mov dword [esp + 0x250], eax
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x4735a8], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x4c]
push 0x9385646d
push dword [0x4735a8]
call fcn.004044c0
add esp, 8
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x48]
call eax
push 0x21
push section..data
push 0x51c00
push 0x421021
call section..text
add esp, 0x10
mov eax, dword [0x42105d]
mov ecx, 0x421021
add eax, ecx
mov dword [esp + 0x50], eax
push 0x731e3b66
push dword [0x4735a8]
call fcn.004044c0
add esp, 8
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
add ecx, 0x18
mov dword [esp + 0x58], ecx
mov ecx, dword [esp + 0x58]
push 4
push 0x1000
push dword [ecx + 0x38]
push 0
call eax
mov dword [esp + 0x44], eax
mov ecx, dword [esp + 0x58]
add ecx, 0x3c
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x5c]
push dword [ecx]
push 0x421021
push eax
call fcn.0040d610
add esp, 0xc
mov eax, 0xf8
lea ebp, [esp + 0x238]
add eax, dword [esp + 0x50]
mov dword [esp + 8], ecx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x60], eax
mov eax, 0xc35e8c18
nop word [eax + eax]
cmp eax, 0x98264bc
jg 0x405480
cmp eax, 0xba721aca
jg 0x405500
cmp eax, 0x91bfe803
jle 0x40575a
cmp eax, 0x9c54d220
jg 0x405897
cmp eax, 0x91bfe804
je 0x405bc8
cmp eax, 0x960b364c
je 0x405bf0
cmp eax, 0x9a152ba7
jne 0x4053e0
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0xe8]
mov edi, 0x421021
lea edx, [edx + edx*4]
mov esi, dword [ecx + edx*8 + 0x14]
add eax, dword [ecx + edx*8 + 0xc]
add esi, edi
push dword [ecx + edx*8 + 0x10]
push esi
push eax
call fcn.0040d610
add esp, 0xc
mov eax, dword [esp + 0xe8]
inc eax
mov dword [esp + 0x2c], eax
mov eax, 0xc35e8c18
cmp eax, 0x98264bc
jle 0x4053eb
nop word cs:[eax + eax]
nop
cmp eax, 0x43f8e062
jg 0x405560
cmp eax, 0x31e95d0d
jg 0x40570d
cmp eax, 0x1f7a1f6c
jg 0x4058fc
cmp eax, 0x98264bd
je 0x405c3d
cmp eax, 0xd46ef60
je 0x405c89
cmp eax, 0x150bbe4f
jne 0x4053e0
mov ecx, dword [esp + 0x100]
mov eax, dword [esp + 0xac]
add ecx, dword [eax]
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x104]
inc eax
mov dword [esp + 0x20], eax
mov eax, 0x8f93b4c
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
cmp eax, 0xd997e3e3
jle 0x4057ba
cmp eax, 0xfc81eb32
jg 0x405959
cmp eax, 0xd997e3e4
je 0x405cef
cmp eax, 0xf894b90c
je 0x405d08
cmp eax, 0xfc189a4d
jne 0x4053e0
mov eax, dword [esp + 0x64]
mov eax, dword [esp + 0x10c]
mov eax, 0x8da1237b
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
cmp eax, 0x77c932c1
jle 0x405822
cmp eax, 0x7cd113dd
jg 0x4059b7
cmp eax, 0x77c932c2
je 0x405d50
cmp eax, 0x796b2140
je 0x405d73
cmp eax, 0x7cc74177
jne 0x4053e0
mov esi, dword [esp + 0xf4]
mov cl, byte [esp + esi + 0x22c]
mov ch, cl
mov edx, ecx
mov ebx, ecx
not ch
and dl, 0x12
xor bl, 0xea
mov dh, ch
and bl, cl
and ch, 0xf0
xor cl, 0xf
and dh, 0xed
mov bh, bl
and bl, 0xbf
or cl, ch
or dl, dh
not bh
mov dh, dl
xor dl, 0xe8
or dl, 0x15
xor dh, 2
mov eax, edx
or dl, bh
and bh, 0x40
and dh, 0xaa
and al, 0x40
or bl, bh
not dl
or dh, al
xor bl, dh
or dl, bl
mov eax, edx
and dl, 0x3a
not al
and al, 0xc5
or dl, al
mov eax, edx
xor dl, 0x22
xor al, 0x80
and dl, 0x72
and al, 0x8d
or al, dl
mov edx, eax
xor al, 0x70
xor dl, 0xd
and al, 0xf0
and dl, 0xf
or al, dl
mov edx, eax
xor dl, 0xf
and dl, al
mov eax, ecx
mov ah, dl
mov dh, dl
not al
and dl, 0xc3
not ah
and dh, 0x49
and ah, 0xb6
or dh, ah
mov ah, cl
xor cl, 0xc3
and cl, al
and ah, 0x29
and al, 0xd6
mov bl, dh
xor dh, 0x8a
or al, ah
xor bl, 0x49
mov ch, al
and dh, bl
xor al, 0x15
xor ch, 0xd6
mov ah, dh
and al, ch
and ah, dl
xor dl, dh
mov dh, al
or dl, ah
mov ah, cl
and al, 0x53
and cl, 0x53
not dh
not ah
mov bh, dh
or dh, ah
and ah, 0xac
and bh, 0xac
or cl, ah
not dh
or al, bh
xor cl, al
mov eax, edx
and dl, 0x53
not al
or dh, cl
and al, 0xac
or dl, al
mov al, dh
and dh, 0x53
not al
and al, 0xac
or dh, al
mov eax, ebx
and al, ch
xor ch, bl
xor dh, dl
or ch, al
mov cl, dh
and dh, 0xcd
mov al, ch
and ch, 0xad
not cl
not al
mov dl, cl
and al, 0x52
and dl, 0x32
or ch, al
or dh, dl
mov al, ch
xor ch, 0x52
xor al, 0x8d
or cl, ch
and ch, 0x32
and al, 0xcd
not cl
or al, ch
xor al, dh
or cl, al
mov eax, ecx
or cl, 0xc7
not al
mov edx, ecx
and cl, 0xc9
or al, 0x38
not dl
mov ah, al
and dl, 0x30
and al, 0xc9
not ah
or dl, cl
and ah, 6
or ah, al
xor ah, dl
mov al, ah
and ah, 0x26
not al
and al, 0xd9
or ah, al
mov byte [esp + esi + 0x22c], ah
mov eax, dword [esp + 0xf4]
inc eax
mov dword [esp + 0xc], eax
jmp 0x405bb3
cmp eax, 0x3862ab9f
jle 0x4059ed
cmp eax, 0x3862aba0
je 0x406ec1
cmp eax, 0x38f242cc
je 0x405db7
cmp eax, 0x3feb4047
jne 0x4053e0
mov eax, dword [esp + 0xc]
mov ecx, 0x7cc74177
mov dword [esp + 0xf4], eax
mov eax, dword [esp + 0xf4]
cmp eax, 0xb
mov eax, 0x7eecd8f1
jmp 0x4057a7
cmp eax, 0x8da1237a
jle 0x405aa3
cmp eax, 0x8da1237b
je 0x405f3b
cmp eax, 0x8f55bf77
je 0x4060d2
cmp eax, 0x8f847cf9
jne 0x4053e0
mov eax, dword [esp + 4]
mov ecx, 0x7cd113de
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x110]
cmp eax, 0xf4
mov eax, 0x960b364c
cmovb eax, ecx
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
cmp eax, 0xc84066e7
jle 0x405ade
cmp eax, 0xc84066e8
je 0x4060e3
cmp eax, 0xcfb28c38
je 0x406139
cmp eax, 0xcfe5ce82
jne 0x4053e0
mov eax, dword [esp + 0x18]
mov dword [esp + 0xfc], eax
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0xfc]
lea eax, [eax + ecx*4]
mov ecx, 0x4f43c7ee
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xa0]
cmp dword [eax], 0
mov eax, 0xfc81eb33
jmp 0x406e7f
cmp eax, 0x4f43c7ed
jle 0x405b37
cmp eax, 0x4f43c7ee
je 0x4061a2
cmp eax, 0x55cd6046
je 0x4061f6
cmp eax, 0x595229b1
jne 0x4053e0
mov eax, dword [esp + 8]
mov byte [esp + 0xef], al
mov eax, dword [esp + 0x10]
mov dword [esp + 0xf0], eax
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0xf0]
lea ecx, [ecx + ecx*4]
lea eax, [eax + ecx*4]
mov ecx, 0x77c932c2
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x78]
cmp dword [eax], 0
mov eax, 0x4e858f6d
jmp 0x406e7f
cmp eax, 0x9c54d221
je 0x406d42
cmp eax, 0xace3b2d7
je 0x40621d
cmp eax, 0xb1a0b620
jne 0x4053e0
mov eax, dword [esp + 0x100]
add eax, 4
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0xac]
mov eax, dword [eax]
add eax, 0xfffffff8
shr eax, 1
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x1c], 0
add eax, 8
mov dword [esp + 0xb4], eax
jmp 0x4064cb
cmp eax, 0x1f7a1f6d
je 0x406246
cmp eax, 0x25f6618d
je 0x4064bf
cmp eax, 0x2facef77
jne 0x4053e0
mov word [esp + 0x11c], 0
mov esi, dword [esp + 0x40]
xor eax, eax
mov eax, esi
and eax, 0xffff
mov word [esp + 0x11c], ax
movzx eax, word [esp + 0x11c]
push eax
push dword [esp + 0x94]
call fcn.00404c50
add esp, 8
jmp 0x405d2a
cmp eax, 0xfc81eb33
je 0x4064e0
cmp eax, 0x1a89da5
je 0x40651e
cmp eax, 0x8f93b4c
jne 0x4053e0
mov eax, dword [esp + 0x24]
mov ecx, 0x7f5f4b8b
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x100]
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0xa8]
cmp dword [eax], 0
mov eax, 0xb1a0b620
jmp 0x406e7f
cmp eax, 0x7cd113de
je 0x406595
cmp eax, 0x7eecd8f1
je 0x406770
cmp eax, 0x7f5f4b8b
jne 0x4053e0
mov eax, 0xcfb28c38
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
cmp eax, 0x31e95d0e
je 0x406cb6
cmp eax, 0x3816a0b8
jne 0x4053e0
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x58]
add eax, dword [ecx + 0x10]
mov dword [esp + 0xc8], eax
lea eax, [esp + 0x34]
mov dword [esp + 0xcc], eax
mov eax, dword [esp + 0xcc]
lea eax, [esp + 0x120]
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0xd0], eax
mov eax, dword [esp + 0xd0]
push 0xf4
push 0x41a00c
push dword [esp + 0xd8]
call fcn.0040d610
add esp, 0xc
mov al, byte [esp + 0xef]
mov ecx, eax
mov ah, al
mov ch, al
not cl
and ah, 0xe2
and ch, 1
mov edx, ecx
and dl, 0x1c
or ah, dl
xor ah, 0xe2
or ch, ah
mov ah, ch
and ch, al
not ah
and cl, ah
or ch, cl
xor ah, ch
test ah, ch
mov eax, 0xace3b2d7
mov ecx, 0xd46ef60
jmp 0x406e7f
cmp eax, 0x80d4df4a
je 0x406cee
cmp eax, 0x87cadf60
jne 0x4053e0
cmp byte [esp + 0xc7], 0
mov eax, 0x3816a0b8
mov ecx, 0x43f8e063
cmovne eax, ecx
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
cmp eax, 0xba721acb
je 0x406d57
cmp eax, 0xc35e8c18
jne 0x4053e0
mov eax, dword [esp + 0x2c]
mov edx, 0x9a152ba7
mov dword [esp + 0xe8], eax
mov eax, dword [esp + 0x50]
add eax, 6
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x64]
movzx eax, word [eax]
mov ecx, dword [esp + 0xe8]
cmp ecx, eax
mov eax, 0xc84066e8
cmovl eax, edx
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
cmp eax, 0x43f8e063
je 0x406d7c
cmp eax, 0x4e858f6d
jne 0x4053e0
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x74]
add eax, dword [ecx + 0xc]
mov dword [esp + 0x84], ebp
mov ecx, ebp
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x84]
push dword [esp + 0x80]
call fcn.00404920
lea eax, [esp + 0x22c]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x88]
mov eax, dword [esp + 0x88]
mov dword [esp + 0xc], 0
mov dword [eax], 0x7e72627c
mov dword [eax + 4], 0x3f747463
mov dword [eax + 8], 0x7d7d75
mov eax, 0x3feb4047
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
mov eax, dword [esp + 0xa4]
mov eax, dword [esp + 0xfc]
inc eax
mov dword [esp + 0x18], eax
mov eax, 0xcfe5ce82
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
mov eax, dword fs:[0x30]
mov ecx, eax
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
sub eax, 8
mov edx, dword [esp + 0x44]
mov dword [ecx + 8], edx
mov dword [eax + 0x18], edx
add eax, 0x24
mov esi, eax
lea edi, [esp + 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x120]
mov dword [ecx + 4], edx
mov dword [ecx], pe_nt_image_headers32
mov eax, 0xd46ef60
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x44]
mov eax, dword [eax + 0x1c]
mov edx, dword [esp + 0xa8]
add ecx, dword [edx]
mov edx, dword [esp + 0xb8]
sub dword [edx + ecx], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0xa8]
mov ecx, dword [ecx]
mov edx, dword [esp + 0xb8]
add ecx, eax
add dword [edx + ecx], eax
mov eax, 0x25f6618d
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
lea eax, [esp + 0x30]
mov dword [esp + 0xe0], eax
mov esi, eax
mov eax, dword [esp + 0xe0]
push 0x6f0c3cd
push dword [0x4735a8]
call fcn.004044c0
add esp, 8
mov ecx, eax
mov eax, dword fs:[0x30]
mov edx, dword [esp + 0x44]
mov dword [eax + 8], edx
push esi
push 0
push 0
push dword [esp + 0xd4]
push 0
push 0
call ecx
mov dword [esp + 0xe4], eax
mov eax, 0x80d4df4a
mov ecx, 0x9c54d221
cmp dword [esp + 0xe4], 0
jmp 0x406e7f
mov eax, 0x1a89da5
mov byte [esp], 1
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0xa0]
mov ecx, dword [ecx]
lea eax, [eax + ecx + 2]
mov ecx, dword [esp + 0x9c]
push eax
push dword [esp + 0x94]
call ecx
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0xfc]
mov dword [ecx + edx*4], eax
mov eax, 0x91bfe804
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x68]
add eax, dword [ecx + 0x28]
mov ecx, 0xcfb28c38
mov dword [esp + 0x7c], eax
mov eax, 0xba721acb
cmp dword [esp + 0x7c], 0
jmp 0x406e7f
mov eax, dword [esp + 0xd4]
mov ecx, dword [esp + 0xbc]
lea edx, [esp + 0x3c]
push edx
push dword [esp + 0x2c]
push dword [eax + 8]
push dword [esp + 0xe4]
call ecx
mov eax, dword [esp + 0x10c]
inc eax
mov dword [esp + 0x14], eax
mov eax, 0x38f242cc
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
mov eax, dword [0x4735ec]
lea ecx, [eax - 1]
imul ecx, eax
mov edx, ecx
mov eax, ecx
xor edx, 0xa278dd7a
and eax, 0xa0689852
and edx, ecx
not ecx
and ecx, 0x2104528
or eax, ecx
xor eax, 0xa0689852
mov ecx, eax
and ecx, edx
xor edx, eax
or edx, ecx
mov eax, edx
and edx, 0xade48784
not eax
and eax, 0x521b787b
or edx, eax
mov eax, edx
mov esi, edx
xor edx, 0x1232069
xor eax, 0xf063a501
xor esi, 0xc081aee
and edx, eax
mov edi, eax
and esi, 0xfc099eef
mov ecx, edx
or edi, 0xebf7a97
and edx, 0xa0b039d6
not ecx
mov ebx, ecx
or ecx, edi
and ebx, 0x5f4fc629
not ecx
or edx, ebx
mov ebx, edi
and edi, 0x5f4fc629
not ebx
and ebx, 0xa0000140
or ebx, edi
xor ebx, edx
or ecx, ebx
mov edx, ecx
and ecx, 0xebf7a96
not edx
and edx, 0xf1408569
or ecx, edx
mov edx, eax
and eax, 1
and edx, 0x3f66110
or edx, esi
mov esi, 0xfc189a4d
xor edx, 0xfc099eee
or eax, edx
mov edx, eax
and eax, 0x59a2a0a3
not edx
and edx, 0xa65d5f5c
or eax, edx
mov edx, ecx
xor eax, 0x59a2a0a3
and edx, eax
xor eax, ecx
or eax, edx
mov ecx, eax
not ecx
and eax, ecx
mov edx, ecx
and edx, eax
xor eax, ecx
or eax, edx
mov ecx, eax
and eax, 0x3f560390
not ecx
mov edx, ecx
and edx, 0xc0a9fc6f
or eax, edx
xor eax, 0x3f560390
or eax, ecx
mov ecx, dword [0x4735f0]
cmp eax, 0xffffffff
sete al
setne dl
cmp ecx, 0xa
setl ah
cmp ecx, 9
setg cl
mov ch, ah
and ah, dl
and ch, al
and dl, cl
and al, cl
or ch, dl
or ah, al
mov dl, ch
mov al, ah
xor dl, cl
xor al, 1
and dl, ch
mov ecx, edx
xor cl, 1
and ah, cl
or cl, al
and al, dl
or al, ah
mov edx, ecx
xor dl, al
test dl, 1
mov edx, 0x8da1237b
cmovne edx, esi
test al, al
mov esi, 0x8da1237b
mov eax, edx
cmovne eax, esi
test cl, cl
cmovne eax, edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x10c], edx
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
mov eax, dword [esp + 0x64]
movzx eax, word [eax]
mov ecx, dword [esp + 0x10c]
cmp ecx, eax
mov eax, dword [0x4735ec]
setl byte [esp + 0xc7]
lea ecx, [eax - 1]
imul ecx, eax
mov edx, ecx
or ecx, 0xa3d0f73
not edx
mov esi, ecx
and ecx, 0xf9ff372d
or edx, 0xf5c2f08c
not esi
mov eax, edx
and esi, 0x400c080
and edx, 0xf9ff372d
not eax
or esi, ecx
and eax, 0x2000852
or eax, edx
xor eax, esi
mov ecx, eax
and eax, 0xfb0cb280
not ecx
and ecx, 0x4f34d7f
or eax, ecx
mov ecx, eax
mov edx, eax
xor eax, 0x12b35fa
xor ecx, 0xece420c
xor edx, 0xc1010c50
mov esi, ecx
and edx, 0xc1854e58
and eax, ecx
and esi, 0x3e7ab1a7
or esi, edx
mov ecx, esi
mov edx, esi
xor esi, 0x1854c10
xor ecx, 0x3e7ab1a7
xor edx, 0xce6039ae
and esi, 0x1fdfec95
and edx, ecx
mov edi, edx
and edi, eax
xor eax, edx
or eax, edi
mov edx, eax
and eax, 0xfe577f7
not edx
and edx, 0xf01a8808
or eax, edx
mov edx, ecx
and ecx, 1
and edx, 0xe020136a
or edx, esi
xor edx, 0x1fdfec94
or ecx, edx
mov edx, eax
not ecx
and edx, ecx
xor ecx, eax
or ecx, edx
mov eax, ecx
and ecx, 0x3baa50d6
not eax
and eax, 0xc455af29
or eax, ecx
mov ecx, eax
xor eax, 0xc0058120
xor ecx, 0x102210c0
and eax, 0xeb8dc136
and ecx, 0x14723ec9
or eax, ecx
xor eax, 0x14723ec9
cmp eax, 0xffffffff
sete dl
setne cl
cmp dword [0x4735f0], 9
setg al
mov ah, al
and ah, cl
xor cl, al
or cl, ah
mov ah, al
or al, dl
xor ah, dl
xor al, 1
not ah
and ah, dl
mov dl, ah
and dl, al
xor al, ah
or al, dl
mov edx, eax
xor dl, 1
mov ch, dl
mov ah, dl
xor dl, cl
and ch, al
xor ah, ch
xor ch, 1
or ch, al
xor ch, 1
or ch, ah
mov ah, ch
xor ch, 1
and ch, cl
xor cl, 1
or al, cl
and ah, cl
xor al, 1
or ch, ah
or al, dl
mov edx, 0xfc189a4d
mov cl, al
xor cl, ch
test al, 1
mov eax, 0x87cadf60
cmovne eax, edx
test ch, ch
cmove eax, edx
test cl, 1
mov edx, 0x87cadf60
jmp 0x4064ac
movzx eax, byte [esp + 0xdf]
lea eax, [eax + eax + 2]
jmp 0x406204
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x58]
add ecx, 0x60
mov dword [esp + 0x68], ecx
mov ecx, dword [esp + 0x68]
add eax, dword [ecx + 8]
mov dword [esp + 0x6c], eax
push 0x5aefa0fb
push dword [0x4735a8]
call fcn.004044c0
add esp, 8
mov dword [esp + 0x70], eax
mov eax, 0x595229b1
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
push 0x8aafdc01
push dword [0x4735a8]
call fcn.004044c0
add esp, 8
mov dword [esp + 0xbc], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0xc0], eax
mov edx, eax
mov eax, dword [esp + 0xc0]
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0xbc]
push edx
push 2
push dword [eax]
push dword [esp + 0x50]
call ecx
mov eax, 0x38f242cc
mov dword [esp + 0x14], 0
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
lea ecx, [esp + 0x214]
call fcn.00406f20
mov eax, dword [esp + 0x8c]
mov eax, dword [esp + 0x88]
mov ecx, ebp
call fcn.00406f20
mov eax, dword [esp + 0x84]
mov eax, dword [esp + 0xf0]
inc eax
mov dword [esp + 0x10], eax
mov eax, 0x595229b1
mov cl, byte [esp + 0xfb]
mov dword [esp + 8], ecx
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
movzx eax, byte [esp + 0xdf]
shl eax, 5
add eax, 0x20
mov dword [esp + 0x28], eax
mov eax, 0x796b2140
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
mov eax, 0x32
cmp eax, 0x6d
jl 0x406229
cdq
cdq
mov eax, 0x8f847cf9
mov dword [esp + 4], 0
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
mov eax, dword [esp + 0xb4]
mov ecx, dword [esp + 0x108]
movzx eax, word [eax + ecx*2]
mov ecx, eax
mov edx, eax
mov edi, eax
not ecx
and edx, 0x78d7
xor edi, 0xf000
mov esi, ecx
and edi, eax
and ecx, 0xee655ac7
and esi, 0xc3158728
or edx, esi
mov esi, edx
xor edx, 0xc3158000
or edx, 0xfff
xor esi, 0x82a2000
mov ebx, edx
and esi, 0xcb2f2000
and ebx, 0xd0b3
or esi, ebx
mov ebx, edi
and edi, 0x2f4c
not ebx
or edx, ebx
and ebx, 0x34d0d0b3
or edi, ebx
not edx
xor edi, esi
or edx, edi
mov esi, edx
and edx, 0x4fb47d0e
not esi
and esi, 0xb04b82f1
or edx, esi
mov esi, edx
xor edx, 0xb04b82f1
mov edi, edx
xor esi, 0x4e245806
or edx, eax
and edi, 0x119aa538
and esi, 0xee655ac7
not edx
or esi, edi
mov edi, eax
and edi, 0xa538
or ecx, edi
mov edi, eax
xor ecx, esi
xor edi, 0x7b28
or edx, ecx
and edi, eax
or eax, 0x839784d7
not edx
mov ecx, eax
mov esi, eax
mov dword [esp + 0xb8], edx
mov edx, edi
not ecx
and esi, 0x385ca8b
and edi, 0x3574
not edx
and ecx, 0x60083120
or eax, edx
and edx, 0x1fe5ca8b
or ecx, esi
or edi, edx
not eax
xor edi, ecx
or eax, edi
mov ecx, eax
and eax, 0x7c687b28
not ecx
and ecx, 0x839784d7
or eax, ecx
mov edx, eax
mov ecx, eax
and eax, 0xc4f3c5a1
not edx
and ecx, 0xb5845a29
and edx, 0x4a7ba5d6
or ecx, edx
mov esi, ecx
mov edx, ecx
xor ecx, 0xb584aa29
xor esi, 0xb5845a29
xor edx, 0x71779f88
and edx, esi
and esi, 0xf000
mov edi, edx
or ecx, esi
and edi, eax
xor eax, edx
mov esi, ecx
and ecx, 0xb8871df8
or eax, edi
not esi
mov edx, eax
and eax, 0x202d9344
and esi, 0x4778e207
not edx
or ecx, esi
and edx, 0xdfd26cbb
or eax, edx
mov edx, eax
xor eax, 0xe4dea6e5
xor edx, 0x3010812
mov esi, eax
and esi, 0xb82e514d
and edx, 0x47d1aeb2
or edx, esi
mov esi, ecx
xor ecx, 0x4778e207
xor esi, 0x810cb0
or eax, ecx
and ecx, 0xb82e514d
and esi, 0x47d1aeb2
not eax
or esi, ecx
xor esi, edx
or eax, esi
mov edx, eax
mov ecx, eax
xor edx, 0xc1eef50e
not ecx
and edx, eax
or eax, 0x3e110af1
and ecx, 0x8028640a
mov edi, edx
mov esi, eax
and edx, 0x9038660a
not edi
and esi, 0x6fc799f5
or eax, edi
and edi, 0x6fc799f5
or ecx, esi
or edx, edi
not eax
xor edx, ecx
or eax, edx
mov edx, 0x98264bd
mov ecx, eax
and eax, 0x74adb765
not ecx
and ecx, 0x8b52489a
or eax, ecx
mov ecx, eax
xor eax, 0x808980
xor ecx, 0x4030220
and eax, 0xb1c0c9cb
and ecx, 0x4e3f3634
or ecx, eax
mov eax, ecx
xor ecx, 0x114001ca
xor eax, 0xa180230
and ecx, 0x556735ce
and eax, 0xaa98ca31
or eax, ecx
mov ecx, eax
xor eax, 0x298ca10
xor ecx, 0x66300c
and eax, 0x5799cfd2
and ecx, 0xa866302d
or ecx, eax
mov eax, 0x25f6618d
xor ecx, 0xa866302d
cmp ecx, 0x3000
cmove eax, edx
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
mov eax, dword [esp + 0x108]
inc eax
mov dword [esp + 0x1c], eax
mov eax, 0x31e95d0e
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
lea eax, [esp + 0x40]
mov ecx, 0x2facef77
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xa4]
mov eax, dword [esp + 0xa0]
mov eax, dword [eax]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0xa4]
movzx eax, word [eax + 2]
cmp eax, 0x8000
mov eax, 0xf894b90c
jmp 0x406e7f
movzx eax, byte [esp]
mov byte [esp + 0xfb], al
mov eax, dword [esp + 0x70]
push dword [esp + 0x80]
call eax
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x78]
mov ecx, dword [ecx]
add ecx, eax
mov dword [esp + 0x94], ecx
mov ecx, dword [esp + 0x74]
add eax, dword [ecx + 0x10]
mov dword [esp + 0x98], eax
push 0xa7c20233
push dword [0x4735a8]
call fcn.004044c0
add esp, 8
mov dword [esp + 0x9c], eax
mov eax, 0xcfe5ce82
mov dword [esp + 0x18], 0
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
mov eax, dword [esp + 0x110]
movzx esi, word [esp + eax*2 + 0x120]
mov dword [esp + 4], eax
mov edx, esi
mov ecx, esi
mov edi, esi
not edx
or ecx, 0xffffcf6b
xor edi, 0x3094
mov ebp, edx
mov ebx, ecx
and edi, esi
and edx, 0x7e50
and esi, 0xffff81af
and ebx, 0xffffa3ba
and ebp, 0x1004
or esi, edx
or ebp, ebx
mov ebx, edi
and edi, 0x5c45
not ebx
or ecx, ebx
and ebx, 0xffffa3ba
or edi, ebx
not ecx
mov ebx, esi
xor esi, 0x3210
xor edi, ebp
xor ebx, 0xffff81af
and esi, 0x331e
or ecx, edi
movzx edx, bl
and ebx, 0xffffcce1
mov edi, ecx
and ecx, 0x3094
or ebx, esi
not edi
xor ebx, 0x33e1
and edi, 0xffffcf6b
or edx, ebx
or ecx, edi
mov esi, edx
and edx, 0x6349
mov edi, ecx
and ecx, 0xdde
not esi
not edi
and esi, 0xffff9cb6
and edi, 0xfffff221
or edx, esi
or ecx, edi
mov edi, ecx
xor ecx, 0xfffff2de
xor edi, 0xd00
and edi, 0xffffff00
or ecx, edi
mov edi, ecx
and ecx, 0x764b
not edi
and edi, 0xffff89b4
or ecx, edi
mov edi, edx
xor edx, 0xffff9cb6
mov esi, edx
xor edi, 0x101
mov ebp, ecx
mov ebx, ecx
xor ecx, 0xffff8233
or edx, 0xfffff478
and esi, 0x6ace
and edi, 0xffff9531
xor ebp, 0x764b
xor ebx, 0xffff89b4
or edi, esi
and ecx, ebp
mov ebp, ebx
mov esi, edi
xor edi, 0xffff9eb6
xor esi, 0xffff9531
and edi, esi
and ebp, esi
xor esi, ebx
and ebx, 0xfffff478
mov eax, ebx
or esi, ebp
lea ebp, [esp + 0x238]
and eax, ecx
xor ecx, ebx
not esi
or ecx, eax
mov eax, edi
and edi, 0x1c0f
not eax
mov ebx, eax
or eax, edx
and ebx, 0xffffe3f0
not eax
or edi, ebx
mov ebx, edx
and edx, 0xffffe3f0
not ebx
and ebx, 0x807
or ebx, edx
xor ebx, edi
or eax, ebx
mov ebx, ecx
and ecx, 0x284f
mov edi, eax
not ebx
and eax, 0x284f
not edi
and ebx, 0xffffd7b0
and edi, 0xffffd7b0
or ecx, ebx
or eax, edi
xor eax, ecx
mov ecx, eax
and ecx, esi
xor esi, eax
mov eax, dword [esp + 4]
or esi, ecx
mov word [esp + eax*2 + 0x120], si
mov eax, dword [esp + 0x110]
inc eax
mov dword [esp + 4], eax
mov eax, 0x8f847cf9
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
lea ecx, [esp + 0x214]
mov dword [esp + 0x8c], ecx
mov eax, dword [esp + 0x8c]
lea eax, [esp + 0x22c]
push eax
call fcn.00404920
mov ecx, dword [0x4735f4]
lea eax, [ecx - 1]
imul eax, ecx
mov edx, eax
mov ecx, eax
xor edx, 0x99a2ad02
not ecx
mov esi, edx
and edx, ecx
and esi, eax
mov ebx, edx
and edx, 0x7e5c3145
mov ecx, esi
not ebx
and esi, 0x7e5c3145
not ecx
mov edi, ecx
or ecx, ebx
and ebx, 0x81a3ceba
and edi, 0x81a3ceba
or edx, ebx
not ecx
or esi, edi
xor edx, esi
mov esi, 0xfd368fe3
or ecx, edx
mov edx, ecx
and ecx, 0x245a0bc8
not edx
and edx, 0xdba5f437
or ecx, edx
mov edx, eax
xor eax, 1
and edx, 1
xor ecx, 0x42075934
or eax, edx
mov edx, eax
and eax, 0xb95140ce
not edx
and edx, 0x46aebf31
or eax, edx
mov edx, ecx
xor eax, 0xb95140ce
and edx, eax
xor eax, ecx
or eax, edx
mov ecx, eax
and eax, 0xf3bc53ce
not ecx
mov edx, ecx
or ecx, 0x673d0086
and edx, 0xc43ac31
or eax, edx
mov edx, eax
xor eax, 0x10000
xor edx, 0x232c0000
or eax, 0xc2e419
and eax, 0x40d3e49f
and edx, 0x272c0000
or edx, eax
mov eax, ecx
and ecx, 0x40d3e49f
not eax
and eax, 0x98001b60
or eax, ecx
xor eax, edx
mov ecx, eax
and eax, 0x37863e91
not ecx
and ecx, 0xc879c16e
or eax, ecx
mov ecx, eax
xor eax, 0x24408008
xor ecx, 0x40810601
and eax, 0x347ab81e
and ecx, 0xcb8547e1
or ecx, eax
mov eax, ecx
xor ecx, 0x2072301c
xor eax, 0x42844460
and ecx, 0xa973339d
and eax, 0x568ccc62
or eax, ecx
mov ecx, dword [0x4735f8]
xor eax, 0x568ccc62
setne al
sete byte [esp + 0x115]
cmp ecx, 9
setg dl
cmp ecx, 0xa
mov ecx, edx
setl byte [esp + 0x116]
xor dl, al
and cl, al
or cl, dl
xor dl, 1
mov eax, ecx
or al, dl
xor dl, cl
mov ecx, eax
xor cl, dl
mov ecx, 0x3163e4a4
cmovne ecx, esi
test dl, dl
mov edx, 0x3163e4a4
mov esi, ecx
cmovne esi, edx
test al, al
mov eax, 0x187da9ae
cmovne esi, ecx
mov dword [esp], esi
cmp eax, 0x3163e4a3
jg 0x4069a0
cmp eax, 0xfd368fe3
je 0x406b46
cmp eax, 0x187da9ae
jne 0x406910
mov al, byte [esp + 0x115]
mov cl, byte [esp + 0x116]
mov esi, 0x37451a86
mov edi, 0xfd368fe3
mov edx, ecx
mov ah, al
mov ch, al
xor dl, 1
xor ah, 1
and ch, cl
and dl, ah
or ch, dl
mov dl, ch
xor dl, ah
xor ah, cl
xor ah, 1
and dl, ch
and ah, cl
xor cl, al
and cl, al
mov al, ah
and al, cl
xor cl, ah
or cl, al
mov eax, 0xfd368fe3
xor cl, dl
mov ch, cl
xor ch, 1
and dl, ch
xor ch, dl
test cl, 1
cmovne eax, esi
test dl, 1
cmove eax, edi
test ch, 1
cmove eax, esi
cmp eax, 0x3163e4a3
jle 0x40691b
nop dword [eax]
cmp eax, 0x3163e4a4
je 0x406e92
cmp eax, 0x37451a86
jne 0x406910
lea edx, [esp + 0x214]
mov ecx, dword [esp + 0x228]
mov eax, dword [esp + 0x224]
mov dword [esp + 0x118], edx
mov edx, dword [esp + 0x118]
cmp ecx, 0xf
mov ecx, 0x1aef9cae
mov dword [esp + 0x11c], edx
mov edx, 0x69a7f13
cmova ecx, edx
mov edx, 0x91f03f7a
nop word cs:[eax + eax]
nop
cmp edx, 0x1aef9cae
je 0x406a41
cmp edx, 0x69a7f13
je 0x406a2b
cmp edx, 0x91f03f7a
jne 0x406a00
mov edi, dword [esp + 0x11c]
mov edx, ecx
cmp edx, 0x1aef9cae
jne 0x406a08
jmp 0x406a41
mov edx, dword [esp + 0x118]
mov edi, dword [edx]
mov edx, 0x1aef9cae
cmp edx, 0x1aef9cae
jne 0x406a08
mov dword [esp + 0x118], ebp
mov ecx, dword [esp + 0x24c]
mov ebx, dword [esp + 0x248]
mov edx, dword [esp + 0x118]
cmp ecx, 0xf
mov ecx, 0x1aef9cae
mov dword [esp + 0x11c], edx
mov edx, 0x69a7f13
cmova ecx, edx
mov edx, 0x91f03f7a
nop dword [eax]
cmp edx, 0x1aef9cae
je 0x406ac1
cmp edx, 0x69a7f13
je 0x406aab
cmp edx, 0x91f03f7a
jne 0x406a80
mov ebp, dword [esp + 0x11c]
mov edx, ecx
cmp edx, 0x1aef9cae
jne 0x406a88
jmp 0x406ac1
mov edx, dword [esp + 0x118]
mov ebp, dword [edx]
mov edx, 0x1aef9cae
cmp edx, 0x1aef9cae
jne 0x406a88
cmp ebx, eax
mov esi, 0x8b13f679
mov eax, 0x21158ca7
mov ecx, 0x21f32a97
cmove esi, eax
nop word cs:[eax + eax]
nop
cmp ecx, 0x8b13f679
je 0x406b23
cmp ecx, 0x21f32a97
je 0x406b17
cmp ecx, 0x21158ca7
jne 0x406ae0
push ebx
push edi
push ebp
call fcn.0040bf8e
add esp, 0xc
test eax, eax
mov ecx, 0x8b13f679
sete al
cmp ecx, 0x8b13f679
jne 0x406ae8
jmp 0x406b23
xor eax, eax
mov ecx, esi
cmp ecx, 0x8b13f679
jne 0x406ae8
and al, 1
lea ebp, [esp + 0x238]
mov byte [esp + 0x117], al
mov eax, dword [esp]
cmp eax, 0x3163e4a3
jle 0x40691b
jmp 0x4069a0
lea edx, [esp + 0x214]
mov ecx, dword [esp + 0x228]
mov eax, dword [esp + 0x224]
mov dword [esp + 0x118], edx
mov edx, dword [esp + 0x118]
cmp ecx, 0xf
mov ecx, 0x1aef9cae
mov dword [esp + 0x11c], edx
mov edx, 0x69a7f13
cmova ecx, edx
mov edx, 0x91f03f7a
nop word cs:[eax + eax]
nop
cmp edx, 0x1aef9cae
je 0x406bcf
cmp edx, 0x69a7f13
je 0x406bbb
cmp edx, 0x91f03f7a
jne 0x406b90
mov edx, dword [esp + 0x11c]
mov edx, ecx
cmp edx, 0x1aef9cae
jne 0x406b98
jmp 0x406bcf
mov edx, dword [esp + 0x118]
mov edx, 0x1aef9cae
cmp edx, 0x1aef9cae
jne 0x406b98
mov dword [esp + 0x118], ebp
mov edx, dword [esp + 0x24c]
mov ecx, dword [esp + 0x248]
mov esi, dword [esp + 0x118]
cmp edx, 0xf
mov edx, 0x1aef9cae
mov dword [esp + 0x11c], esi
mov esi, 0x69a7f13
cmova edx, esi
mov esi, 0x91f03f7a
nop word [eax + eax]
cmp esi, 0x1aef9cae
je 0x406c4f
cmp esi, 0x69a7f13
je 0x406c3b
cmp esi, 0x91f03f7a
jne 0x406c10
mov esi, dword [esp + 0x11c]
mov esi, edx
cmp esi, 0x1aef9cae
jne 0x406c18
jmp 0x406c4f
mov esi, dword [esp + 0x118]
mov esi, 0x1aef9cae
cmp esi, 0x1aef9cae
jne 0x406c18
cmp ecx, eax
mov eax, 0x8b13f679
mov ecx, 0x21158ca7
cmove eax, ecx
mov ecx, 0x21f32a97
nop word cs:[eax + eax]
nop dword [eax]
cmp ecx, 0x8b13f679
je 0x406ca1
cmp ecx, 0x21f32a97
je 0x406c97
cmp ecx, 0x21158ca7
jne 0x406c70
mov ecx, 0x8b13f679
cmp ecx, 0x8b13f679
jne 0x406c78
jmp 0x406ca1
mov ecx, eax
cmp ecx, 0x8b13f679
jne 0x406c78
mov eax, 0x37451a86
cmp eax, 0x3163e4a3
jle 0x40691b
jmp 0x4069a0
mov eax, dword [esp + 0x1c]
mov edx, 0x1f7a1f6d
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0x108]
cmp ecx, eax
mov eax, 0x150bbe4f
cmovb eax, edx
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
push 0x916d883f
push dword [0x4735a8]
call fcn.004044c0
add esp, 8
push 0x1f4
call eax
push 0xf8f151be
push dword [0x4735a8]
call fcn.004044c0
add esp, 8
push 0xffffffffffffffff
push dword [esp + 0xe8]
call eax
push 0x4f3647b6
push dword [0x4735a8]
call fcn.004044c0
add esp, 8
push dword [esp + 0xe4]
call eax
mov eax, 0x3862aba0
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
mov dword [esp + 0x20], 0
mov eax, 0x8f93b4c
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x24], ecx
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x10c]
lea edx, [edx + edx*4]
lea ecx, [ecx + edx*8]
mov dword [esp + 0xd4], ecx
mov ecx, dword [esp + 0xd4]
add eax, dword [ecx + 0xc]
mov dword [esp + 0xd8], eax
mov eax, dword [esp + 0xd4]
mov eax, dword [eax + 0x24]
mov edx, eax
mov esi, eax
not edx
and esi, 0x377ad401
mov ecx, edx
and edx, eax
and ecx, 0xc8852bfe
or esi, ecx
xor esi, 0x377ad401
mov ecx, esi
and ecx, edx
xor edx, esi
or edx, ecx
mov ecx, edx
mov esi, edx
not ecx
xor esi, 0x806eeb2f
mov edi, ecx
and esi, edx
and edx, 0x6cdfd092
and edi, 0x806eeb2f
mov ebx, edi
and ebx, esi
xor esi, edi
or esi, ebx
mov ebx, ecx
and ecx, 0x20000000
mov edi, esi
and ebx, 0x93202f6d
and esi, 0x844d716f
not edi
or ebx, edx
and edi, 0x7bb28e90
xor ebx, 0x4cdfd092
or esi, edi
or ecx, ebx
xor esi, 0x24239a40
not ecx
mov edx, esi
and edx, ecx
xor ecx, esi
or ecx, edx
mov edx, ecx
and ecx, 0xd0ee99ad
not edx
and edx, 0x2f116652
or ecx, edx
mov edx, ecx
xor ecx, 0x25100012
xor edx, 0x90040121
and ecx, 0x65fa989e
and edx, 0x9a056761
or edx, ecx
test eax, eax
mov eax, 0x55cd6046
mov ecx, 0x8f55bf77
sets byte [esp + 0xdf]
xor edx, 0x65fa989e
cmove eax, ecx
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
cmp byte [esp + 0x117], 0
mov dl, byte [esp + 0xef]
mov eax, 0x1a89da5
mov ecx, 0xd997e3e4
cmovne eax, ecx
mov byte [esp], dl
cmp eax, 0x98264bc
jg 0x405480
jmp 0x4053eb
mov eax, dword [esp + 0xe0]
mov eax, dword [esp + 0xd0]
mov eax, dword [esp + 0xcc]
mov eax, dword [esp + 0xc0]
mov eax, dword [esp + 0x54]
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.0040a6c4
add esp, 0x254
pop esi
pop edi
pop ebx
pop ebp
ret