Function at 0x40fe42
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xce8
mov ecx, dword [0x441b14]
mov dword [esp + 0xc8], 0x734f0346
mov dword [esp + 0xcc], 0
mov word [esp + 0xd0], 0
mov dword [esp + 0x1cc], 0
mov eax, dword [esp + 0x1cc]
cmp eax, 9
ja 0x40fa1a
nop
nop
nop
nop
mov eax, dword [esp + 0x1cc]
mov edx, dword [esp + 0x1cc]
movzx edx, byte [esp + edx + 0xc8]
lea esi, [eax + 0xee]
add eax, edx
and esi, edx
add esi, esi
sub eax, esi
add eax, 0x69abd5ee
mov dword [esp + 0x2d8], eax
mov eax, dword [esp + 0x2d8]
add al, 0x7e
mov edx, dword [esp + 0x1cc]
mov byte [esp + edx + 0xc8], al
inc dword [esp + 0x1cc]
mov eax, dword [esp + 0x1cc]
cmp eax, 0xa
jb 0x40f9c0
mov edx, dword [str.JNrMLk__corp3007]
mov dword [esp + 0x2d8], 0x548c7c75
mov dword [esp + 0x2dc], 0x74717280
mov dword [esp + 0x2e0], 0x8c797680
mov dword [esp + 0x2e4], 0x64999875
mov dword [esp + 0x2e8], 0x9d2e6e6f
mov dword [esp + 0x2ec], 0x534b9f6d
mov dword [esp + 0x2f0], 0x9f265958
mov dword [esp + 0x2f4], 0x37735961
mov dword [esp + 0x2f8], 0
mov dword [esp + 0x2fb], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x30]
cmp eax, 0x26
ja 0x40fae9
nop
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x30]
movzx esi, byte [esp + esi + 0x2d8]
lea edi, [eax + 0x49b1bd83]
add eax, 0x83
and eax, esi
or edi, esi
sub edi, eax
mov dword [esp + 0x1cc], edi
mov eax, dword [esp + 0x1cc]
add al, 0x6b
mov esi, dword [esp + 0x30]
mov byte [esp + esi + 0x2d8], al
inc dword [esp + 0x30]
mov eax, dword [esp + 0x30]
cmp eax, 0x27
jb 0x40faa0
movzx ebx, byte [esp + 0x2d8]
lea eax, [esp + 0x1cc]
test bl, bl
je 0x40fb1b
lea esi, [esp + 0x2d9]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], bl
inc eax
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40fb10
mov byte [eax], 0
movzx ebx, byte [edx]
test bl, bl
je 0x40fb3b
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], bl
inc eax
movzx ebx, byte [edx]
inc edx
test bl, bl
jne 0x40fb30
mov byte [eax], 0
movzx edx, byte [esp + 0xc8]
test dl, dl
je 0x40fb6b
lea esi, [esp + 0xc9]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [esi]
inc esi
test dl, dl
jne 0x40fb60
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40fb8b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40fb80
mov byte [eax], 0
lea ecx, [esp + 0x1cc]
mov dword [esp + 0x2d8], 0xeb25d513
mov dword [esp + 0x2dc], 0xef1ce918
mov dword [esp + 0x2e0], 0xe31eed15
mov dword [esp + 0x2e4], 0xe7d3e116
mov dword [esp + 0x2e8], 0xfb6be532
mov dword [esp + 0x2ec], 0xff03f90a
mov dword [esp + 0x2f0], 0xf3dcfd30
mov dword [esp + 0x2f4], 0xf700f115
mov dword [esp + 0x2f8], 0x8b08f506
mov dword [esp + 0x2fc], 0x8f6d8975
mov dword [esp + 0x300], 0x83788d69
mov dword [esp + 0x304], 0x8771817d
mov dword [esp + 0x308], 0x9bb58574
mov dword [esp + 0x30c], 0x9fab9912
mov dword [esp + 0x310], 0x93159d17
mov dword [esp + 0x314], 0x97a3911b
mov dword [esp + 0x318], 0xab65956c
mov dword [esp + 0x31c], 0xaf5ba95c
mov dword [esp + 0x320], 0xa327ad9d
mov dword [esp + 0x324], 0xa75ca154
mov dword [esp + 0x328], 0xbb56a55d
mov dword [esp + 0x32c], 0xbf49b95f
mov dword [esp + 0x330], 0xb347bd5a
mov dword [esp + 0x334], 0xb7a3b156
mov dword [esp + 0x338], 0x4bb4b5a8
mov word [esp + 0x344], 0
mov dword [esp + 0x340], 0
mov dword [esp + 0x33c], 0
mov dword [esp + 0x30], 0
mov edx, dword [esp + 0x30]
cmp edx, 0x6d
ja 0x40fd2e
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp + 0x30]
mov esi, dword [esp + 0x30]
movzx esi, byte [esp + esi + 0x2d8]
lea edi, [edx + esi]
add edi, 0xaddaa09d
add edx, 0xaddaa09d
and edx, esi
add edx, edx
sub edi, edx
mov dword [esp + 0xc8], edi
mov edx, dword [esp + 0xc8]
add dl, 0xb5
mov esi, dword [esp + 0x30]
mov byte [esp + esi + 0x2d8], dl
inc dword [esp + 0x30]
mov edx, dword [esp + 0x30]
cmp edx, 0x6e
jb 0x40fce0
sub eax, ecx
mov dword [esp + 0xc8], 0xeb33d5e7
mov dword [esp + 0xcc], 0xef17e91a
mov word [esp + 0xd0], 0xedee
mov dword [esp + 0xd2], 0
mov word [esp + 0xd6], 0
mov dword [esp + 0x270], 0
mov edx, dword [esp + 0x270]
cmp edx, 0xf
ja 0x40fddc
nop
nop
nop
nop
mov edx, dword [esp + 0x270]
mov esi, dword [esp + 0x270]
movzx esi, byte [esp + esi + 0xc8]
lea edi, [edx + 0xec9d]
mov ebx, esi
not ebx
or ebx, edi
and edi, esi
add edi, ebx
neg edi
add edx, edi
add edx, 0xec9c
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x30]
add dl, 0xb5
mov esi, dword [esp + 0x270]
mov byte [esp + esi + 0xc8], dl
inc dword [esp + 0x270]
mov edx, dword [esp + 0x270]
cmp edx, 0x10
jb 0x40fd80
lea edx, [esp + 0xc0]
lea esi, [esp + 0x28]
lea ebx, [esp + 0x2d8]
lea edi, [esp + 0xc8]
push edx
push esi
push eax
push ecx
push ebx
push edi
push 0x44731c
call fcn.0040ca60
add esp, 0x1c
movzx eax, al
xor esi, esi
jmp dword [eax*4 + 0x442760]
xor ebx, ebx
test esi, esi
sete bl
xor eax, eax
jmp dword [ebx*4 + 0x442778]
push esi
call fcn.00401e80
add esp, 4
mov dword [esp + 0x2c], eax
mov eax, dword [case.0x40fe0d.11]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
jmp dword [ebx*4 + 0x442790]
push esi
call fcn.00409240
add esp, 4
push dword [esp + 0x2c]
call fcn.00402940
add esp, 4
mov ebx, eax
mov word [esp + 0x2d8], 0x6650
mov byte [esp + 0x2da], 0xf8
mov dword [esp + 0x2db], 0
mov dword [esp + 0x2df], 0
mov word [esp + 0x2e3], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x30]
cmp eax, 0xc
ja 0x40fefe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
movzx ecx, byte [esp + ecx + 0x2d8]
lea edx, [eax + 0x5f]
mov esi, ecx
not esi
or esi, edx
and edx, ecx
add edx, esi
neg edx
add eax, edx
add eax, 0xa70ef55e
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0xc8]
add al, 0x67
mov ecx, dword [esp + 0x30]
mov byte [esp + ecx + 0x2d8], al
inc dword [esp + 0x30]
mov eax, dword [esp + 0x30]
cmp eax, 0xd
jb 0x40feb0
lea esi, [esp + 0x2d8]
push esi
push ebx
call fcn.00402aa0
add esp, 8
xor ecx, ecx
test eax, eax
setg cl
jmp dword [ecx*4 + 0x442798]
call fcn.004342f0
movzx eax, al
jmp dword [eax*4 + 0x4427a0]
mov word [esp + 0x2d8], 0xbda5
mov dword [esp + 0x2da], 0
mov dword [esp + 0x2dd], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x30]
cmp eax, 8
ja 0x40ffb8
nop
nop
nop
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
movzx ecx, byte [esp + ecx + 0x2d8]
mov edx, 0x54
sub edx, eax
add eax, ecx
not ecx
or edx, ecx
lea eax, [eax + edx*2]
add eax, 0x412cead
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0xc8]
mov ecx, eax
xor ecx, 0x52
and eax, 0x52
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 0x30]
mov byte [esp + ecx + 0x2d8], al
inc dword [esp + 0x30]
mov eax, dword [esp + 0x30]
cmp eax, 9
jb 0x40ff60
push esi
push ebx
call fcn.00402aa0
add esp, 8
mov dword [esp + 0xb4], eax
mov word [esp + 0x2d8], 0xcefb
mov byte [esp + 0x2da], 0x64
mov dword [esp + 0x2db], 0
mov dword [esp + 0x2df], 0
mov dword [esp + 0x2e2], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x30]
cmp eax, 0xd
ja 0x41005c
nop
nop
nop
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
movzx ecx, byte [esp + ecx + 0x2d8]
lea edx, [eax + ecx]
add edx, 0x52fe2291
add eax, 0x52fe2291
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0xc8], edx
mov eax, dword [esp + 0xc8]
add al, 9
mov ecx, dword [esp + 0x30]
mov byte [esp + ecx + 0x2d8], al
inc dword [esp + 0x30]
mov eax, dword [esp + 0x30]
cmp eax, 0xe
jb 0x410010
push esi
push ebx
call fcn.00402aa0
add esp, 8
mov esi, eax
mov dword [esp + 0xb8], ebx
push ebx
call fcn.00410f20
add esp, 4
push dword [esp + 0x2c]
call fcn.00402f10
add esp, 4
lea ebx, [esp + 0x270]
mov ecx, ebx
push 1
call fcn.00409bd0
push ebx
call fcn.0041f1f0
add esp, 4
mov ecx, ebx
call fcn.0040a650
lea ebx, [esp + 0xc78]
mov ecx, ebx
push 3
call fcn.00409bd0
push ebx
call fcn.0041fc90
add esp, 4
mov ecx, ebx
call fcn.0040a650
xor ebx, ebx
test esi, esi
setg bl
lea esi, [esp + 0xc10]
mov ecx, esi
push 1
call fcn.00409bd0
push esi
call fcn.0041fee0
add esp, 4
mov ecx, esi
call fcn.0040a650
lea esi, [esp + 0xba8]
mov ecx, esi
push 1
call fcn.00409bd0
push esi
call fcn.00421e20
add esp, 4
push esi
call fcn.00422740
add esp, 4
push esi
call fcn.00422c00
add esp, 4
mov ecx, esi
call fcn.0040a650
lea esi, [esp + 0xb40]
mov ecx, esi
push 1
call fcn.00409bd0
push esi
call fcn.00424db0
add esp, 4
mov ecx, esi
call fcn.0040a650
lea esi, [esp + 0xad8]
mov ecx, esi
push 1
call fcn.00409bd0
push esi
call fcn.00426aa0
add esp, 4
push esi
call fcn.0042f4a0
add esp, 4
jmp dword [ebx*4 + 0x4427b8]
push esi
call fcn.0042f680
add esp, 4
lea ecx, [esp + 0xad8]
call fcn.0040a650
lea eax, [esp + 0x24f]
push eax
call fcn.004350a0
add esp, 4
mov dword [esp + 0x30], 0x607161e0
mov word [esp + 0x34], 0x321e
mov byte [esp + 0x36], 0xfc
mov dword [esp + 0x37], 0
mov word [esp + 0x3b], 0
mov dword [esp + 0xc8], 0
mov eax, dword [esp + 0xc8]
cmp eax, 0xc
ja 0x410224
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0xc8]
mov ecx, dword [esp + 0xc8]
movzx ecx, byte [esp + ecx + 0x30]
lea edx, [eax + 0x9f]
and edx, ecx
add eax, ecx
add edx, edx
sub eax, edx
add eax, 0xb45fc79f
mov dword [esp + 0x2d8], eax
mov eax, dword [esp + 0x2d8]
add al, 0xa7
mov ecx, dword [esp + 0xc8]
mov byte [esp + ecx + 0x30], al
inc dword [esp + 0xc8]
mov eax, dword [esp + 0xc8]
cmp eax, 0xd
jb 0x4101d0
mov eax, dword [0x441b14]
mov dword [esp], 0xf3af23e6
mov dword [esp + 4], 0
mov byte [esp + 8], 0
mov dword [esp + 0xc8], 0
mov ecx, dword [esp + 0xc8]
cmp ecx, 8
ja 0x4102bf
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0xc8]
mov edx, dword [esp + 0xc8]
movzx esi, byte [esp + edx]
lea edx, [ecx + esi]
add edx, 0x722070be
add ecx, 0x722070be
and ecx, esi
add ecx, ecx
mov esi, edx
not esi
and esi, ecx
not ecx
and ecx, edx
sub ecx, esi
mov dword [esp + 0x2d8], ecx
mov ecx, dword [esp + 0x2d8]
add cl, 0xce
mov edx, dword [esp + 0xc8]
mov byte [esp + edx], cl
inc dword [esp + 0xc8]
mov ecx, dword [esp + 0xc8]
cmp ecx, 9
jb 0x410260
mov ecx, dword [str.JNrMLk__corp3007]
mov dword [esp + 0x2d8], 0xae66aaad
mov dword [esp + 0x2dc], 0x9462949b
mov dword [esp + 0x2e0], 0x6c6d9099
mov dword [esp + 0x2e4], 0xd59b9299
mov dword [esp + 0x2e8], 0xbe749866
mov dword [esp + 0x2ec], 0xcdb6b3b4
mov dword [esp + 0x2f0], 0xb68e8c88
mov byte [esp + 0x2f4], 0xe8
mov dword [esp + 0x2f9], 0
mov dword [esp + 0x2f5], 0
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
cmp edx, 0x24
ja 0x4103b2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
movzx edx, byte [esp + edx + 0x2d8]
mov ebx, esi
and ebx, 0xfe66ed5e
xor esi, 0x7e66ed5e
lea esi, [esi + ebx*2]
mov ebx, esi
not ebx
and esi, edx
or ebx, edx
not esi
add esi, edx
sub esi, ebx
mov dword [esp + 0xc8], esi
mov edx, dword [esp + 0xc8]
mov esi, edx
xor esi, 0x6d
and edx, 0x6d
lea edx, [esi + edx*2]
inc dl
mov esi, dword [esp + 0x14]
mov byte [esp + esi + 0x2d8], dl
inc dword [esp + 0x14]
mov edx, dword [esp + 0x14]
cmp edx, 0x25
jb 0x410350
movzx edx, byte [esp + 0x2d8]
test dl, dl
je 0x4103db
lea edi, [esp + 0xc8]
lea esi, [esp + 0x2d9]
nop
nop
nop
nop
mov byte [edi], dl
inc edi
movzx edx, byte [esi]
inc esi
test dl, dl
jne 0x4103d0
mov byte [edi], 0
movzx edx, byte [ecx]
test dl, dl
lea ebx, [esp + 0x2d8]
je 0x4103fb
inc ecx
nop
nop
nop
mov byte [edi], dl
inc edi
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x4103f0
mov byte [edi], 0
movzx ecx, byte [esp]
test cl, cl
je 0x41041b
lea edx, [esp + 1]
nop
nop
nop
nop
nop
nop
mov byte [edi], cl
inc edi
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x410410
mov byte [edi], 0
movzx ecx, byte [eax]
test cl, cl
je 0x41043b
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], cl
inc edi
movzx ecx, byte [eax]
inc eax
test cl, cl
jne 0x410430
mov byte [edi], 0
movzx eax, byte [esp + 0x30]
test al, al
je 0x41045b
lea ecx, [esp + 0x31]
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x410450
mov byte [edi], 0
movzx eax, byte [esp + 0x24f]
test al, al
je 0x41048b
lea ecx, [esp + 0x250]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x410480
mov byte [edi], 0
lea eax, [esp + 0xc8]
mov dword [esp + 0x2d8], 0x1bed19db
mov dword [esp + 0x2dc], 0x179a15e2
mov dword [esp + 0x2e0], 0x13e411ed
mov dword [esp + 0x2e4], 0x2f1b2da0
mov dword [esp + 0x2e8], 0x2ba329c4
mov dword [esp + 0x2ec], 0x27db25d4
mov dword [esp + 0x2f0], 0x230221ea
mov dword [esp + 0x2f4], 0x3fce3ddd
mov dword [esp + 0x2f8], 0x3bce39c8
mov dword [esp + 0x2fc], 0x37d535cd
mov dword [esp + 0x300], 0x33be31d1
mov dword [esp + 0x304], 0xcf39cd35
mov dword [esp + 0x308], 0xcbfdc93e
mov dword [esp + 0x30c], 0xc7f3c54c
mov dword [esp + 0x310], 0xc34dc14f
mov dword [esp + 0x314], 0xdfebdd53
mov dword [esp + 0x318], 0xdb2dd926
mov dword [esp + 0x31c], 0xd723d526
mov dword [esp + 0x320], 0xd35fd1e5
mov dword [esp + 0x324], 0xef1aed1e
mov dword [esp + 0x328], 0xeb1ce915
mov dword [esp + 0x32c], 0xe711e507
mov dword [esp + 0x330], 0xe31fe11c
mov dword [esp + 0x334], 0xffebfd00
mov dword [esp + 0x338], 0xfbfaf9e2
mov dword [esp + 0x33c], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x67
ja 0x41061d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x2d8]
lea esi, [ecx + edx]
add esi, 0xd5003bd4
add ecx, 0xd4
and ecx, edx
add ecx, ecx
mov edx, ecx
xor edx, esi
not ecx
and ecx, esi
add ecx, ecx
sub ecx, edx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x30]
add cl, 0x34
mov edx, dword [esp]
mov byte [esp + edx + 0x2d8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x68
jb 0x4105d0
sub edi, eax
mov dword [esp + 0x30], 0x2b8b2dff
mov dword [esp + 0x34], 0x17bf29b8
mov word [esp + 0x38], 0x1514
mov dword [esp + 0x3a], 0
mov dword [esp + 0x3e], 0
mov dword [esp + 0x42], 0
mov byte [esp + 0x46], 0
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
cmp ecx, 0x16
ja 0x4106b0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
movzx edx, byte [esp + edx + 0x30]
lea esi, [ecx + edx]
add esi, 0x5705945a
add ecx, 0x5705945a
and ecx, edx
add ecx, ecx
sub esi, ecx
mov dword [esp], esi
mov ecx, dword [esp]
add cl, 0x8a
mov edx, dword [esp + 0x14]
mov byte [esp + edx + 0x30], cl
inc dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
cmp ecx, 0x17
jb 0x410670
lea ecx, [esp + 0xbc]
lea edx, [esp + 0x24]
lea esi, [esp + 0x30]
push ecx
push edx
push edi
push eax
push ebx
push esi
push 0x44731c
call fcn.0040ca60
add esp, 0x1c
movzx eax, al
xor ebx, ebx
jmp dword [eax*4 + 0x4427c0]
mov eax, dword [case.0x4106d7.8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
xor eax, eax
test ebx, ebx
setne al
jmp dword [eax*4 + 0x4427e8]
lea edi, [esp + 0x2d8]
mov esi, dword [esp + 0xb8]
mov ebx, dword [esp + 0xb4]
jmp dword [0x4427fc]
jmp dword [0x442768]
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, dword [esp + 0xc0]
mov esi, dword [esp + 0x28]
lea eax, [ecx + ecx*2]
shr eax, 2
movzx edx, byte [ecx + esi - 1]
cmp edx, 0x3d
je 0x41074d
cmp edx, 0x2e
jne 0x41074e
dec eax
movzx ecx, byte [ecx + esi - 2]
cmp ecx, 0x3d
je 0x41075d
cmp ecx, 0x2e
jne 0x41075e
dec eax
push eax
call fcn.00409230
add esp, 4
push eax
push esi
call fcn.004357a0
add esp, 8
push dword [esp + 0x28]
call fcn.00438c40
add esp, 4
jmp case.0x40fe0d.2
dec eax
push eax
call fcn.00409230
add esp, 4
mov esi, eax
push eax
push ebx
call fcn.004357a0
add esp, 8
push dword [esp + 0x28]
call fcn.00438c40
add esp, 4
lea ebx, [esp + 0x2d8]
jmp dword [0x442770]
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, dword [esp + 0xc0]
mov ebx, dword [esp + 0x28]
lea eax, [ecx + ecx*2]
shr eax, 2
movzx edx, byte [ecx + ebx - 1]
cmp edx, 0x3d
je 0x4107db
cmp edx, 0x2e
jne 0x4107dc
dec eax
movzx ecx, byte [ecx + ebx - 2]
cmp ecx, 0x3d
je 0x410780
cmp ecx, 0x2e
je 0x410780
jmp 0x410781
jmp dword [0x4427c8]
mov ecx, dword [esp + 0xbc]
mov esi, dword [esp + 0x24]
lea eax, [ecx + ecx*2]
shr eax, 2
movzx edx, byte [ecx + esi - 1]
cmp edx, 0x3d
je 0x410813
cmp edx, 0x2e
jne 0x410814
dec eax
movzx ecx, byte [ecx + esi - 2]
cmp ecx, 0x3d
je 0x410823
cmp ecx, 0x2e
jne 0x410824
dec eax
push eax
call fcn.00409230
add esp, 4
push eax
push esi
call fcn.004357a0
add esp, 8
push dword [esp + 0x24]
call fcn.00438c40
add esp, 4
jmp case.0x4106d7.2
dec eax
push eax
call fcn.00409230
add esp, 4
mov ebx, eax
push eax
push esi
call fcn.004357a0
add esp, 8
push dword [esp + 0x24]
call fcn.00438c40
add esp, 4
jmp dword [0x4427d4]
mov ecx, dword [esp + 0xbc]
mov esi, dword [esp + 0x24]
lea eax, [ecx + ecx*2]
shr eax, 2
movzx edx, byte [ecx + esi - 1]
cmp edx, 0x3d
je 0x410898
cmp edx, 0x2e
jne 0x410899
dec eax
movzx ecx, byte [ecx + esi - 2]
cmp ecx, 0x3d
je 0x410850
cmp ecx, 0x2e
je 0x410850
jmp 0x410851
push ebx
call fcn.00401e80
add esp, 4
mov esi, eax
xor eax, eax
test ebx, ebx
sete al
jmp dword [eax*4 + 0x4427f0]
push ebx
call fcn.00409240
add esp, 4
push esi
call fcn.004146c0
add esp, 4
push esi
call fcn.00402f10
add esp, 4
lea edi, [esp + 0x2d8]
mov esi, dword [esp + 0xb8]
mov ebx, dword [esp + 0xb4]
jmp dword [0x4427fc]
mov dword [esp + 0x2d8], 0xbbd1dbd2
mov dword [esp + 0x2dc], 0
mov byte [esp + 0x2e0], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja case.0x4106d7.15
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x2d8]
lea edx, [eax + 0x10928d37]
add eax, 0x37
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 0x30], edx
mov eax, dword [esp + 0x30]
add al, 0x7f
mov ecx, dword [esp]
mov byte [esp + ecx + 0x2d8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x410930
jmp case.0x4106d7.15
jmp dword [0x442800]
mov dword [esp + 0x2d8], 0xbbd1dbd2
mov dword [esp + 0x2dc], 0
mov byte [esp + 0x2e0], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x410970
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x2d8]
lea edx, [eax + 0x10928d37]
add eax, 0x37
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 0x30], edx
mov eax, dword [esp + 0x30]
add al, 0x7f
mov ecx, dword [esp]
mov byte [esp + ecx + 0x2d8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x4109b0
jmp 0x410970
push edi
push esi
call fcn.00402aa0
add esp, 8
xor ecx, ecx
test eax, eax
setg cl
jmp dword [ecx*4 + 0x442808]
lea ecx, [esp + 0x2d8]
push 1
call fcn.00409bd0
mov eax, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + 0x447625], 0
lea eax, [eax + 1]
jne 0x410a20
mov dword [esp + 0x30], 0xe6f4f010
mov dword [esp + 0x34], 0xefea3bf3
mov word [esp + 0x38], 0x65e8
mov dword [esp + 0x3e], 0
mov dword [esp + 0x3a], 0
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
cmp ecx, 0x11
ja 0x410abb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
movzx edx, byte [esp + edx + 0x30]
lea esi, [ecx + 0x72]
and esi, edx
add ecx, edx
add esi, esi
sub ecx, esi
add ecx, 0x46514172
mov dword [esp], ecx
mov ecx, dword [esp]
mov edx, ecx
or edx, 0xe1
and ecx, 0xe1
add ecx, edx
inc cl
mov edx, dword [esp + 0x14]
mov byte [esp + edx + 0x30], cl
inc dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
cmp ecx, 0x12
jb 0x410a70
lea esi, [esp + 0x2d8]
mov ecx, esi
push eax
push 0x447624
lea eax, [esp + 0x38]
push eax
call fcn.00409de0
mov ecx, esi
call fcn.0040a650
mov ecx, esi
call fcn.00409c10
xor eax, eax
test ebx, ebx
setg al
jmp dword [eax*4 + 0x442810]
push 0
call fcn.0043bbf0
add esp, 4
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x442818]
mov dword [esp + 0x30], 0x739f6d8b
mov dword [esp + 0x34], 0x77447194
mov dword [esp + 0x38], 0x7b827591
mov dword [esp + 0x3c], 0x7f5e799d
mov dword [esp + 0x40], 0x3f57d5a
mov dword [esp + 0x44], 0x7e701f4
mov dword [esp + 0x48], 0xbfe05f2
mov dword [esp + 0x4c], 0xf3d0928
mov dword [esp + 0x50], 0x13fb0de1
mov dword [esp + 0x54], 0x173611e2
mov dword [esp + 0x58], 0x1bf715f3
mov dword [esp + 0x5c], 0x1f2c19fc
mov dword [esp + 0x60], 0x23da1df9
mov dword [esp + 0x64], 0x270621c5
mov dword [esp + 0x68], 0x2b192502
mov dword [esp + 0x6c], 0x2f0e29cf
mov dword [esp + 0x70], 0x33db2dd8
mov dword [esp + 0x74], 0x37d331dd
mov dword [esp + 0x78], 0x3bcf35c7
mov dword [esp + 0x7c], 0x3f1e39cc
mov dword [esp + 0x80], 0xc3363d0f
mov dword [esp + 0x84], 0xc7f1c1e0
mov dword [esp + 0x88], 0xcbf9c5e4
mov dword [esp + 0x8c], 0xcf3dc93a
mov dword [esp + 0x90], 0xd324cd2a
mov dword [esp + 0x94], 0xd737d135
mov dword [esp + 0x98], 0xdbfad53b
mov dword [esp + 0x9c], 0xdffed9f2
mov dword [esp + 0xa0], 0xe307dd38
mov dword [esp + 0xa4], 0xe7c6e10c
mov dword [esp + 0xa8], 0xebeae5c2
mov dword [esp + 0xac], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x7f
ja 0x410c83
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x30]
lea esi, [ecx + edx]
add ecx, 0x2e
and ecx, edx
add ecx, ecx
sub esi, ecx
add esi, 0xe86ea32e
mov dword [esp + 0x2d8], esi
mov ecx, dword [esp + 0x2d8]
add cl, 0xbe
mov edx, dword [esp]
mov byte [esp + edx + 0x30], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x80
jb 0x410c40
movzx ecx, word [esp + 0x30]
test cx, cx
je 0x410cb1
lea edi, [esp + 0x2d8]
lea edx, [esp + 0x32]
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edi], cx
add edi, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x410ca0
mov word [edi], 0
movzx ecx, word [eax]
test cx, cx
je 0x410ce1
add eax, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edi], cx
add edi, 2
movzx ecx, word [eax]
add eax, 2
test cx, cx
jne 0x410cd0
mov dword [edi], 0x220022
mov dword [edi + 4], 0x22
mov dword [esp + 0x70], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0x44
mov dword [esp + 0x5c], 1
push 0x89047569
push dword [0x448624]
call fcn.0043bd20
add esp, 8
lea ecx, [esp + 0x14]
lea edx, [esp + 0x2d8]
push ecx
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push edx
push 0
call eax
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x442820]
mov eax, dword [esp + 0x14]
mov dword [esp], 0x5c5d5e5f
mov dword [esp + 4], 0
mov dword [esp + 7], 0
mov dword [esp + 0x10], 0
mov ecx, dword [esp + 0x10]
cmp ecx, 0xa
ja 0x410e46
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
movzx edx, byte [esp + edx]
mov esi, ecx
and esi, 0x385652f4
xor ecx, 0xb85652f4
lea esi, [ecx + esi*2]
mov ecx, esi
and ecx, edx
add esi, edx
add ecx, ecx
mov edx, ecx
xor edx, esi
not ecx
and ecx, esi
add ecx, ecx
sub ecx, edx
mov dword [esp + 0xc4], ecx
mov ecx, dword [esp + 0xc4]
add cl, 0x54
mov edx, dword [esp + 0x10]
mov byte [esp + edx], cl
inc dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
cmp ecx, 0xb
jb 0x410df0
mov ecx, dword [0x448630]
test ecx, ecx
je case.0x410ae9.4
mov edx, dword [esp]
xor esi, esi
mov edi, dword [0x448634]
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xad91fd63
je 0x410e7a
inc esi
cmp ecx, esi
jne 0x410e60
jmp case.0x410ae9.4
mov esi, dword [esp + 0x2c]
jmp dword [0x4427ac]
mov ecx, dword [edi + esi*8 + 4]
cmp ecx, edx
je case.0x410ae9.4
push eax
push 1
push dword [0x448638]
push ecx
call fcn.0043a550
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword [0x442834]
lea ecx, [esp + 0xad8]
call fcn.00409c10
lea ecx, [esp + 0xb40]
call fcn.00409c10
lea ecx, [esp + 0xba8]
call fcn.00409c10
lea ecx, [esp + 0xc10]
call fcn.00409c10
lea ecx, [esp + 0xc78]
call fcn.00409c10
lea ecx, [esp + 0x270]
call fcn.00409c10
mov al, 1
jmp case.0x40fe0d.7
push esi
call fcn.00402f10
add esp, 4
push esi
call fcn.00402f10
add esp, 4
xor eax, eax
jmp dword [0x4427b4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
mov dword [esp + 0x34], edi
jmp 0x410fe3
push edi
call fcn.00402ed0
add esp, 4
xor ecx, ecx
cmp esi, eax
setb cl
jmp dword [ecx*4 + 0x442840]
mov edx, esi
mov dword [esp + 0x150], esi
jmp dword [0x442848]
push edx
push edi
call fcn.00402ee0
add esp, 8
mov word [esp + 0x58], 0xb124
mov dword [esp + 0x5a], 0
mov dword [esp + 0x5e], 0
mov byte [esp + 0x62], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xa
lea ebx, [esp + 0x58]
ja 0x412fe4
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x58]
lea esi, [ecx + 0xe8]
and esi, edx
mov edi, 0x263ec717
sub edi, ecx
or edi, edx
not edi
add edi, edx
sub edi, esi
mov dword [esp + 0xf0], edi
mov ecx, dword [esp + 0xf0]
mov edx, ecx
or edx, 0xa7
and ecx, 0xa7
add ecx, edx
inc cl
mov edx, dword [esp]
mov byte [esp + edx + 0x58], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xb
jb 0x412f90
push 3
push ebx
push eax
call fcn.00402db0
add esp, 0xc
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x150]
push edx
push edi
call fcn.00402ee0
add esp, 8
mov ebx, eax
mov word [esp + 0x58], 0xb124
mov dword [esp + 0x5a], 0
mov dword [esp + 0x5e], 0
mov byte [esp + 0x62], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x413093
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x58]
lea edx, [eax + 0xe8]
and edx, ecx
mov esi, 0x263ec717
sub esi, eax
or esi, ecx
not esi
add esi, ecx
sub esi, edx
mov dword [esp + 0xf0], esi
mov eax, dword [esp + 0xf0]
mov ecx, eax
or ecx, 0xa7
and eax, 0xa7
add eax, ecx
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 0x58], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x413040
push 3
lea eax, [esp + 0x5c]
push eax
mov esi, ebx
push ebx
call fcn.00402db0
add esp, 0xc
mov edx, dword [esp + 0x150]
jmp dword [0x442850]
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x442858]
mov al, 1
jmp dword [0x442b68]
mov ecx, dword [case.0x411567.28]
nop
nop
jmp ecx