Function at 0x426f70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x90
push ebx
push ebp
push esi
xor esi, esi
cmp byte [0x47d050], 0
push edi
jne 0x426f91
mov byte [0x47d050], 1
call fcn.00426170
mov edi, dword [esp + 0xa4]
mov dword [0x454630], esi
mov dword [0x466b40], esi
mov esi, dword [0x16aac80]
add edi, 8
mov dword [0x46509c], 0xffffffff
mov eax, dword [edi]
mov ebx, eax
shl ebx, 0x10
mov ecx, eax
mov edx, eax
and ecx, 0xff00
add ebx, ecx
shr edx, 8
shl ebx, 8
and edx, 0xff00
shr eax, 0x18
add ebx, edx
add ebx, eax
mov eax, dword [edi + 4]
add edi, 8
cmp eax, 0x52444849
jne 0x42710d
mov eax, dword [edi]
mov ecx, eax
shl ecx, 0x10
mov edx, eax
and edx, 0xff00
add ecx, edx
mov edx, eax
shr edx, 8
shl ecx, 8
and edx, 0xff00
add ecx, edx
shr eax, 0x18
add ecx, eax
mov dword [0x466b30], ecx
test ecx, ecx
jle 0x4273c3
mov ecx, dword [edi + 4]
mov eax, ecx
shl eax, 0x10
mov edx, ecx
and edx, 0xff00
add eax, edx
mov edx, ecx
shr edx, 8
shl eax, 8
and edx, 0xff00
add eax, edx
shr ecx, 0x18
add eax, ecx
mov dword [0x45425c], eax
test eax, eax
jle 0x4273c3
mov cl, byte [edi + 8]
mov ebp, 1
shl ebp, cl
mov byte [0x16aac88], cl
test ebp, 0x116
je 0x4273c3
mov cl, byte [edi + 9]
mov eax, 1
shl eax, cl
mov byte [0x16aac90], cl
test al, 0x5d
je 0x4273c3
cmp byte [edi + 0xa], 0
jne 0x4273c3
cmp byte [edi + 0xb], 0
jne 0x4273c3
mov al, byte [edi + 0xc]
cmp al, 2
jae 0x4273c3
movzx eax, al
lea edx, [eax*8]
sub edx, eax
mov dword [0x454420], edx
test cl, cl
je 0x4270c4
cmp cl, 4
jne case.0x42719a.1
mov eax, 0xff
cdq
lea ecx, [ebp - 1]
idiv ecx
xor ecx, ecx
mov esi, 0xff000000
mov dword [0x16aac80], ebp
imul eax, eax, 0x10101
test ebp, ebp
jle 0x4270fe
mov edx, ebp
jmp 0x4270f0
mov dword [ecx*4 + 0x16aa880], esi
inc ecx
add esi, eax
cmp ecx, edx
jl 0x4270f0
mov esi, dword [0x16aac80]
lea edi, [edi + ebx + 4]
jmp 0x426fb7
cmp eax, 0x45544c50
jne 0x42717f
mov eax, 0x55555556
imul ebx
mov esi, edx
shr esi, 0x1f
add esi, edx
lea ecx, [esi - 1]
mov dword [0x16aac80], esi
test ecx, ecx
js case.0x42719a.1
lea edx, [edi + ecx*2]
add edx, ecx
mov eax, dword [edx]
mov esi, eax
shl esi, 0x10
mov ebp, eax
and ebp, 0xff00
add esi, ebp
mov ebp, eax
shl esi, 8
shr ebp, 8
and ebp, 0xff00
add esi, ebp
shr eax, 0x18
add esi, eax
shr esi, 8
or esi, 0xff000000
mov dword [ecx*4 + 0x16aa880], esi
sub edx, 3
dec ecx
jns 0x427134
mov esi, dword [0x16aac80]
lea edi, [edi + ebx + 4]
jmp 0x426fb7
cmp eax, 0x44474b62
jne 0x427284
movsx eax, byte [0x16aac90]
cmp eax, 6
ja case.0x42719a.1
jmp dword [eax*4 + 0x427dbc]
movzx eax, byte [edi]
movzx edx, byte [edi + 1]
mov cl, byte [0x16aac88]
shl eax, 8
add eax, edx
imul eax, eax, 0xff
mov ebp, 1
shl ebp, cl
cdq
lea edi, [edi + ebx + 4]
dec ebp
idiv ebp
imul eax, eax, 0x10101
sub eax, 0x1000000
mov dword [0x16aac94], eax
jmp 0x426fb7
cmp byte [0x16aac88], 8
jne 0x42720f
movzx eax, byte [edi + 1]
movzx ecx, byte [edi + 3]
movzx edx, byte [edi + 5]
sub eax, 0x100
shl eax, 8
add eax, ecx
shl eax, 8
add eax, edx
mov dword [0x16aac94], eax
lea edi, [edi + ebx + 4]
jmp 0x426fb7
xor esi, esi
mov ebp, 0xff000000
jmp 0x427220
movzx ecx, byte [edi + esi*2]
movzx eax, byte [edi + esi*2 + 1]
shl ecx, 8
add ecx, eax
mov eax, 0x7f807f81
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, 2
sub ecx, esi
add ecx, ecx
add ecx, ecx
add ecx, ecx
shl edx, cl
inc esi
add ebp, edx
cmp esi, 3
jl 0x427220
mov esi, dword [0x16aac80]
mov dword [0x16aac94], ebp
lea edi, [edi + ebx + 4]
jmp 0x426fb7
movzx eax, byte [edi]
mov ecx, dword [eax*4 + 0x16aa880]
mov dword [0x16aac94], ecx
lea edi, [edi + ebx + 4]
jmp 0x426fb7
cmp eax, 0x534e5274
jne 0x427338
movsx eax, byte [0x16aac90]
sub eax, 0
je 0x427316
sub eax, 2
je 0x4272e0
dec eax
jne case.0x42719a.1
mov eax, ebx
cmp ebx, esi
jl 0x4272af
mov eax, esi
dec eax
js case.0x42719a.1
jmp 0x4272c0
movzx edx, byte [edi + eax]
shl edx, 0x18
or edx, 0xffffff
and dword [eax*4 + 0x16aa880], edx
dec eax
jns 0x4272c0
lea edi, [edi + ebx + 4]
jmp 0x426fb7
cmp byte [0x16aac88], 8
jne case.0x42719a.1
movzx eax, byte [edi + 1]
movzx ecx, byte [edi + 3]
movzx edx, byte [edi + 5]
sub eax, 0x100
shl eax, 8
add eax, ecx
shl eax, 8
add eax, edx
mov dword [0x454630], eax
lea edi, [edi + ebx + 4]
jmp 0x426fb7
cmp byte [0x16aac88], 8
jg case.0x42719a.1
movzx eax, byte [edi + 1]
mov byte [eax*4 + 0x16aa883], 0
lea edi, [edi + ebx + 4]
jmp 0x426fb7
cmp eax, 0x54414449
jne case.0x42719a.1
mov eax, dword [esp + 0xa8]
lea ecx, [edi + ebx - 4]
mov dword [0x4542b4], edi
mov dword [0x4542b4], ecx
mov ecx, dword [esp + 0xac]
mov dword [0x44ba44], ecx
mov ecx, dword [esp + 0xb4]
mov dword [0x465098], eax
mov eax, dword [esp + 0xb0]
mov dword [0x4661a0], ecx
movsx ecx, byte [0x16aac90]
lea edx, [ebx*8]
mov esi, 0x20
sub esi, edx
mov dword [0x454428], eax
xor edx, edx
mov eax, ecx
mov edi, 2
sub eax, edi
mov dword [0x454384], esi
mov dword [0x4661ac], edx
je 0x4273f1
sub eax, edi
je 0x4273e9
sub eax, edi
je 0x4273d7
mov dword [0x454408], edx
jmp 0x427407
mov dword [0x4542b4], edi
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x90
ret
mov dword [0x454410], 3
mov dword [0x454414], edx
jmp 0x4273f7
mov dword [0x45440c], edx
jmp 0x4273fd
mov dword [0x454410], edx
mov dword [0x45440c], edi
mov dword [0x454408], 1
movsx edx, byte [0x16aac88]
mov eax, edx
dec eax
je 0x42745f
dec eax
je 0x42743d
sub eax, edi
jne 0x42747c
mov eax, 0x10
nop
mov ebx, eax
and ebx, 0xf
mov ebx, dword [ebx*4 + 0x16aa880]
mov dword [eax*4 + 0x16aa880], ebx
inc eax
cmp eax, 0x100
jl 0x427420
jmp 0x42747c
mov eax, 4
mov ebx, eax
and ebx, 3
mov ebx, dword [ebx*4 + 0x16aa880]
mov dword [eax*4 + 0x16aa880], ebx
inc eax
cmp eax, 0x100
jl 0x427442
jmp 0x42747c
mov eax, edi
mov ebx, eax
and ebx, 1
mov ebx, dword [ebx*4 + 0x16aa880]
mov dword [eax*4 + 0x16aa880], ebx
inc eax
cmp eax, 0x100
jl 0x427461
add ecx, ecx
add ecx, ecx
mov eax, 0x4021301
sar eax, cl
mov ecx, edx
and eax, 0xf
imul eax, dword [0x466b30]
dec ecx
mov dword [0x465014], eax
je 0x4274af
dec ecx
je 0x4274a7
sub ecx, edi
jne 0x4274ba
inc eax
sar eax, 1
jmp 0x4274b5
add eax, 3
sar eax, 2
jmp 0x4274b5
add eax, 7
sar eax, 3
mov dword [0x465014], eax
inc eax
cmp eax, 0x10000
ja 0x4273c9
call fcn.004263b0
mov eax, dword [0x4542b4]
mov edx, esi
sar edx, 3
mov edi, dword [edx + eax]
mov ecx, esi
and ecx, 7
sar edi, cl
mov ebp, 0x4000
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], ebp
and edi, 0xffff
add esi, 0x10
mov dword [0x454384], esi
js 0x42750c
call fcn.00426e20
mov esi, dword [0x454384]
mov dword [0x16aac84], edi
mov eax, dword [0x4542b4]
mov edx, esi
sar edx, 3
mov eax, dword [edx + eax]
mov ecx, esi
and ecx, 7
sar eax, cl
and eax, 1
inc esi
mov dword [esp + 0x20], eax
mov dword [0x454384], esi
js 0x427541
call fcn.00426e20
mov esi, dword [0x454384]
mov eax, dword [0x4542b4]
mov edx, esi
sar edx, 3
mov edi, dword [edx + eax]
mov ecx, esi
and ecx, 7
sar edi, cl
and edi, 3
add esi, 2
mov dword [0x454384], esi
js 0x42756e
call fcn.00426e20
mov esi, dword [0x454384]
test edi, edi
jne 0x4276b8
mov ecx, esi
neg ecx
and ecx, 7
add esi, ecx
mov dword [0x454384], esi
js 0x427592
call fcn.00426e20
mov esi, dword [0x454384]
mov eax, dword [0x4542b4]
mov edx, esi
sar edx, 3
mov ebx, dword [edx + eax]
mov ecx, esi
and ecx, 7
sar ebx, cl
and ebx, 0xffff
add esi, 0x10
mov dword [0x454384], esi
js 0x4275c2
call fcn.00426e20
mov esi, dword [0x454384]
mov eax, dword [0x4542b4]
mov edx, esi
sar edx, 3
mov edi, dword [edx + eax]
mov ecx, esi
and ecx, 7
sar edi, cl
mov dword [esp + 0x14], ebx
and edi, 0xffff
add esi, 0x10
mov dword [0x454384], esi
js 0x4275f6
call fcn.00426e20
mov esi, dword [0x454384]
xor edi, ebx
cmp edi, 0xffff
jne 0x4273c9
test ebx, ebx
je 0x427d30
mov edi, 2
cmp dword [esp + 0x10], ebp
jl 0x427661
lea ecx, [ebp - 0x4000]
and ecx, 0x7fff
add ecx, 0x44c258
push 0x4000
push ecx
call fcn.00426760
mov edx, dword [0x454634]
add ebp, 0x4000
add esp, 8
mov dword [esp + 0x18], ebp
cmp edx, dword [0x4661a0]
jl 0x42765b
cmp dword [0x454420], edi
jl 0x427d9b
mov esi, dword [0x454384]
mov edx, dword [0x4542b4]
mov eax, esi
sar eax, 3
mov ebx, dword [eax + edx]
mov ecx, esi
and ecx, 7
sar ebx, cl
and ebx, 0xff
add esi, 8
mov dword [0x454384], esi
js 0x427692
call fcn.00426e20
mov esi, dword [0x454384]
mov eax, dword [esp + 0x10]
mov ecx, eax
and ecx, 0x7fff
inc eax
dec dword [esp + 0x14]
mov byte [ecx + 0x44c258], bl
mov dword [esp + 0x10], eax
jne 0x427611
jmp 0x427d30
cmp edi, 3
je 0x427d30
cmp edi, 1
jne 0x427850
mov eax, 8
mov ecx, 0x90
mov edi, 0x4661b0
rep stosd dword es:[edi], eax
mov eax, 9
mov ecx, 0x70
mov edi, 0x4663f0
rep stosd dword es:[edi], eax
mov eax, 7
mov dword [0x4665b0], eax
mov dword [0x4665b4], eax
mov dword [0x4665b8], eax
mov dword [0x4665bc], eax
mov dword [0x4665c0], eax
mov dword [0x4665c4], eax
mov dword [0x4665c8], eax
mov dword [0x4665cc], eax
mov dword [0x4665d0], eax
mov dword [0x4665d4], eax
mov dword [0x4665d8], eax
mov dword [0x4665dc], eax
mov dword [0x4665e0], eax
mov dword [0x4665e4], eax
mov dword [0x4665e8], eax
mov dword [0x4665ec], eax
mov dword [0x4665f0], eax
mov dword [0x4665f4], eax
mov dword [0x4665f8], eax
mov dword [0x4665fc], eax
mov dword [0x466600], eax
mov dword [0x466604], eax
mov dword [0x466608], eax
mov dword [0x46660c], eax
mov eax, 8
mov dword [0x466610], eax
mov dword [0x466614], eax
mov dword [0x466618], eax
mov dword [0x46661c], eax
mov dword [0x466620], eax
mov dword [0x466624], eax
mov dword [0x466628], eax
mov dword [0x46662c], eax
mov eax, 5
mov dword [esp + 0x1c], 0x120
mov dword [esp + 0x14], 0x20
mov dword [0x466630], eax
mov dword [0x466634], eax
mov dword [0x466638], eax
mov dword [0x46663c], eax
mov dword [0x466640], eax
mov dword [0x466644], eax
mov dword [0x466648], eax
mov dword [0x46664c], eax
mov dword [0x466650], eax
mov dword [0x466654], eax
mov dword [0x466658], eax
mov dword [0x46665c], eax
mov dword [0x466660], eax
mov dword [0x466664], eax
mov dword [0x466668], eax
mov dword [0x46666c], eax
mov dword [0x466670], eax
mov dword [0x466674], eax
mov dword [0x466678], eax
mov dword [0x46667c], eax
mov dword [0x466680], eax
mov dword [0x466684], eax
mov dword [0x466688], eax
mov dword [0x46668c], eax
mov dword [0x466690], eax
mov dword [0x466694], eax
mov dword [0x466698], eax
mov dword [0x46669c], eax
mov dword [0x4666a0], eax
mov dword [0x4666a4], eax
mov dword [0x4666a8], eax
mov dword [0x4666ac], eax
jmp 0x427ad6
mov eax, dword [0x4542b4]
inc dword [0x16aac8c]
mov edx, esi
sar edx, 3
mov edi, dword [edx + eax]
mov ecx, esi
and ecx, 7
sar edi, cl
and edi, 0x1f
add esi, 5
mov dword [0x454384], esi
js 0x427883
call fcn.00426e20
mov esi, dword [0x454384]
mov eax, dword [0x4542b4]
add edi, 0x101
mov edx, esi
mov dword [esp + 0x1c], edi
sar edx, 3
mov edi, dword [edx + eax]
mov ecx, esi
and ecx, 7
sar edi, cl
and edi, 0x1f
add esi, 5
mov dword [0x454384], esi
js 0x4278ba
call fcn.00426e20
mov esi, dword [0x454384]
mov eax, dword [0x4542b4]
inc edi
mov edx, esi
mov dword [esp + 0x14], edi
sar edx, 3
mov edi, dword [edx + eax]
mov ecx, esi
and ecx, 7
sar edi, cl
and edi, 0xf
add esi, 4
mov dword [0x454384], esi
js 0x4278ec
call fcn.00426e20
mov esi, dword [0x454384]
lea ebp, [edi + 4]
xor edx, edx
xor ebx, ebx
cmp ebp, edx
jle 0x427948
jmp 0x427900
mov edi, dword [0x4542b4]
mov eax, esi
sar eax, 3
mov edi, dword [eax + edi]
mov ecx, esi
and ecx, 7
sar edi, cl
and edi, 7
add esi, 3
mov dword [0x454384], esi
js 0x427930
call fcn.00426e20
mov esi, dword [0x454384]
xor edx, edx
mov ecx, dword [ebx*4 + 0x44a6b0]
inc ebx
mov dword [ecx*4 + 0x454268], edi
cmp ebx, ebp
jl 0x427900
cmp ebx, 0x13
jge 0x427963
lea eax, [ebx*4 + 0x44a6b0]
nop
mov ecx, dword [eax]
add eax, 4
mov dword [ecx*4 + 0x454268], edx
cmp eax, 0x44a6fc
jl 0x427950
mov eax, 0x1e
dec eax
mov dword [esp + eax*4 + 0x28], edx
jne 0x427968
mov eax, 0x4542b0
mov ecx, dword [eax]
inc dword [esp + ecx*4 + 0x24]
lea ecx, [esp + ecx*4 + 0x24]
sub eax, 4
cmp eax, 0x454268
jge 0x427974
mov dword [0x454388], edx
mov dword [esp + 0x24], edx
xor eax, eax
jmp 0x4279a0
mov ecx, dword [esp + eax + 0x24]
add ecx, dword [eax + 0x454388]
add eax, 4
mov dword [eax + 0x454388], ecx
cmp eax, 0x7c
jl 0x4279a0
xor eax, eax
lea ebx, [ebx]
mov ecx, dword [eax*4 + 0x454268]
cmp ecx, edx
je 0x4279e3
mov edx, dword [ecx*4 + 0x454388]
mov dword [edx*4 + 0x4666b0], eax
inc edx
mov dword [ecx*4 + 0x454388], edx
xor edx, edx
inc eax
cmp eax, 0x13
jl 0x4279c0
mov ebp, dword [esp + 0x14]
add ebp, dword [esp + 0x1c]
xor ebx, ebx
cmp ebp, edx
jle 0x427ad6
jmp 0x427a00
push 0x454388
push 0x4666b0
call fcn.00426f10
add esp, 8
cmp eax, 0x10
jge 0x427a24
mov dword [ebx*4 + 0x4661b0], eax
inc ebx
jmp 0x427ace
mov esi, dword [0x4542b4]
jne 0x427a6b
mov eax, dword [0x454384]
mov edx, eax
sar edx, 3
mov esi, dword [edx + esi]
mov ecx, eax
and ecx, 7
sar esi, cl
and esi, 3
add eax, 2
mov dword [0x454384], eax
js 0x427a52
call fcn.00426e20
lea eax, [esi + 3]
test eax, eax
je 0x427ace
lea edi, [ebx*4 + 0x4661b0]
lea esi, [edi - 4]
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
add ebx, eax
jmp 0x427ace
cmp eax, 0x11
mov eax, dword [0x454384]
mov edx, eax
mov ecx, eax
jne 0x427a9b
sar edx, 3
mov esi, dword [edx + esi]
and ecx, 7
sar esi, cl
and esi, 7
add eax, 3
mov dword [0x454384], eax
js 0x427a96
call fcn.00426e20
lea edx, [esi + 3]
jmp 0x427abb
sar edx, 3
mov esi, dword [edx + esi]
and ecx, 7
sar esi, cl
and esi, 0x7f
add eax, 7
mov dword [0x454384], eax
js 0x427ab8
call fcn.00426e20
lea edx, [esi + 0xb]
test edx, edx
je 0x427ace
lea edi, [ebx*4 + 0x4661b0]
xor eax, eax
mov ecx, edx
rep stosd dword es:[edi], eax
add ebx, edx
cmp ebx, ebp
jl 0x427a00
mov edi, dword [esp + 0x1c]
push 0x4666b0
push edi
mov esi, 0x454388
mov edx, 0x4661b0
call fcn.00426650
push 9
push 0x454430
push 0x454638
push 0x4666b0
mov ecx, esi
call fcn.00426d40
mov eax, dword [esp + 0x2c]
push 0x4542b8
push eax
lea edx, [edi*4 + 0x4661b0]
mov esi, 0x465018
call fcn.00426650
push 6
push 0x454338
push 0x4660a0
push 0x4542b8
mov ecx, esi
call fcn.00426d40
mov esi, dword [0x454384]
add esp, 0x30
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x10]
jmp 0x427b50
cmp ebp, edi
jl 0x427b9f
lea ecx, [edi - 0x4000]
and ecx, 0x7fff
add ecx, 0x44c258
push 0x4000
push ecx
call fcn.00426760
mov edx, dword [0x454634]
add edi, 0x4000
add esp, 8
mov dword [esp + 0x18], edi
cmp edx, dword [0x4661a0]
jl 0x427b99
cmp dword [0x454420], 2
jl 0x427d9b
mov esi, dword [0x454384]
mov edx, dword [0x4542b4]
mov eax, esi
sar eax, 3
mov eax, dword [eax + edx]
mov ecx, esi
and ecx, 7
sar eax, cl
and eax, 0x1ff
mov cl, byte [eax + 0x454430]
test cl, cl
je 0x427bde
mov ebx, dword [eax*4 + 0x454638]
movzx eax, cl
add esi, eax
mov dword [0x454384], esi
js 0x427bf8
call fcn.00426e20
jmp 0x427bf2
push 0x454388
push 0x4666b0
call fcn.00426f10
add esp, 8
mov ebx, eax
mov esi, dword [0x454384]
cmp ebx, 0x100
jge 0x427c18
mov ecx, ebp
and ecx, 0x7fff
inc ebp
mov byte [ecx + 0x44c258], bl
mov dword [esp + 0x10], ebp
jmp 0x427b50
je 0x427d2c
mov edi, dword [0x4542b4]
mov eax, dword [ebx*8 + 0x464720]
mov edx, esi
sar edx, 3
mov ebp, dword [edx + edi]
mov ecx, esi
and ecx, 7
sar ebp, cl
and ebp, dword [eax*4 + 0x443ed0]
add esi, eax
mov dword [0x454384], esi
js 0x427c56
call fcn.00426e20
mov esi, dword [0x454384]
mov edx, dword [0x4542b4]
mov edi, dword [ebx*8 + 0x464724]
mov eax, esi
sar eax, 3
mov eax, dword [eax + edx]
mov ecx, esi
and ecx, 7
sar eax, cl
add edi, ebp
and eax, 0x3f
mov cl, byte [eax + 0x454338]
test cl, cl
je 0x427c9c
mov ebp, dword [eax*4 + 0x4660a0]
movzx eax, cl
add esi, eax
mov dword [0x454384], esi
js 0x427cb6
call fcn.00426e20
jmp 0x427cb0
push 0x465018
push 0x4542b8
call fcn.00426f10
add esp, 8
mov ebp, eax
mov esi, dword [0x454384]
mov ebx, dword [0x4542b4]
mov eax, dword [ebp*8 + 0x464e38]
mov edx, esi
sar edx, 3
mov ebx, dword [edx + ebx]
mov ecx, esi
and ecx, 7
sar ebx, cl
and ebx, dword [eax*4 + 0x443ed0]
add esi, eax
mov dword [0x454384], esi
js 0x427cee
call fcn.00426e20
mov esi, dword [0x454384]
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp*8 + 0x464e3c]
add edx, ebx
mov eax, ecx
add edi, ecx
sub eax, edx
mov edx, eax
and edx, 0x7fff
mov dl, byte [edx + 0x44c258]
mov ebx, ecx
and ebx, 0x7fff
inc ecx
inc eax
mov byte [ebx + 0x44c258], dl
cmp ecx, edi
jl 0x427d01
mov dword [esp + 0x10], ecx
jmp 0x427b43
mov ebp, dword [esp + 0x18]
cmp dword [esp + 0x20], 0
je 0x427512
mov esi, dword [esp + 0x10]
sub ebp, 0x4000
mov eax, ebp
xor eax, esi
test eax, 0x8000
jne 0x427d6a
sub esi, ebp
and ebp, 0x7fff
push esi
add ebp, 0x44c258
push ebp
call fcn.00426760
add esp, 8
jmp 0x427d9b
mov ecx, ebp
neg ecx
and ecx, 0x7fff
and ebp, 0x7fff
push ecx
add ebp, 0x44c258
push ebp
call fcn.00426760
and esi, 0x7fff
push esi
push 0x44c258
call fcn.00426760
add esp, 0x10
cmp byte [0x16aac90], 4
jne 0x427dae
mov dword [0x16aac80], 0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret