Function at 0x464050
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b8
push esi
mov dword [ebp - 0x94], edx
mov esi, ecx
lea edx, [ebp - 0xb8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x9c], 0xff
call fcn.00463b40
test eax, eax
jne 0x46408a
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 4]
push ebx
mov dword [ebp - 0x64], eax
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
mov dword [esi + 4], ebx
cmp ebx, 0x1000000
ja 0x4640b0
mov ecx, dword [esi]
mov dword [ebp - 0x28], ecx
cmp ecx, 0x1000000
jbe 0x4640ca
mov eax, dword fs:[0x2c]
pop ebx
pop esi
mov eax, dword [eax]
mov dword [eax + 0xc], str.too_large
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xac]
mov edx, dword [ebp - 0xb0]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x20], eax
push edi
mov edi, dword [ebp - 0xb4]
mov dword [ebp - 0x50], edi
cmp edx, 0xc
jne 0x464140
mov edx, dword [ebp - 0xb8]
mov dword [ebp - 0x34], edx
cmp edx, 0x18
jge 0x46415f
mov ecx, edi
sub ecx, eax
mov eax, 0x55555556
sub ecx, 0x18
imul ecx
mov ecx, dword [ebp - 0x28]
mov eax, edx
shr eax, 0x1f
add eax, edx
jmp 0x464158
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x34], eax
cmp eax, 0x10
jge 0x46415f
mov eax, edi
sub eax, dword [ebp - 0x20]
sub eax, edx
sar eax, 2
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x464190
mov eax, dword [esi + 0xac]
sub eax, dword [esi + 0xb4]
add eax, dword [esi + 0xa8]
cmp edi, eax
je 0x464190
mov eax, dword fs:[0x2c]
pop edi
pop ebx
pop esi
mov eax, dword [eax]
mov dword [eax + 0xc], str.bad_offset
xor eax, eax
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x34], 0x18
mov edx, dword [ebp - 0x1c]
jne 0x4641a8
cmp edx, 0xff000000
jne 0x4641a8
mov eax, 3
jmp 0x4641b2
xor eax, eax
test edx, edx
setne al
add eax, 3
mov dword [esi + 8], eax
test ecx, ecx
js 0x465259
jne 0x4641c8
lea edi, [ecx*4]
jmp 0x4641e8
mov eax, 0x7fffffff
cdq
idiv ecx
cmp eax, 4
jl 0x465259
lea edi, [ecx*4]
test edi, edi
js 0x465259
test ebx, ebx
js 0x465259
je 0x464202
mov eax, 0x7fffffff
cdq
idiv ebx
cmp edi, eax
jg 0x465259
test ecx, ecx
je 0x464217
mov eax, 0x7fffffff
cdq
idiv ecx
cmp eax, 4
jl 0x46523e
lea edi, [ecx*4]
test ebx, ebx
je 0x464232
mov eax, 0x7fffffff
cdq
idiv ebx
cmp edi, eax
jg 0x46523e
imul ebx, ecx
lea eax, [ebx*4]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov dword [ebp - 0x2c], ebx
test ebx, ebx
je 0x46523e
xor edi, edi
cmp dword [ebp - 0x34], 0x10
jge 0x464a3d
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x464a18
cmp eax, 0x100
jg 0x464a18
mov dword [ebp - 0x18], edi
test eax, eax
jle 0x4644f9
lea edx, [esi + 0xac]
lea ebx, [esi + 0x20]
nop dword [eax]
mov eax, dword [edx]
mov ecx, dword [esi + 0xb0]
cmp eax, ecx
jae 0x4642aa
mov dl, byte [eax]
inc eax
mov byte [ebp - 1], dl
lea edx, [esi + 0xac]
jmp 0x464307
cmp dword [esi + 0x20], 0
lea ebx, [esi + 0x20]
je 0x46437d
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea edi, [esi + 0x28]
push edi
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
lea edx, [esi + 0xac]
sub ecx, dword [esi + 0xb4]
add esp, 0xc
add dword [esi + 0xa8], ecx
test eax, eax
jne 0x4642f4
lea ecx, [esi + 0x29]
mov dword [ebx], eax
mov dword [esi + 0xb0], ecx
mov byte [edi], al
jmp 0x4642ff
lea ecx, [esi + 0x28]
add ecx, eax
mov dword [esi + 0xb0], ecx
mov al, byte [edi]
mov byte [ebp - 1], al
lea eax, [edi + 1]
mov edi, eax
mov dword [ebp - 0x30], edx
mov dword [edx], edi
lea esi, [ebp - 0x4b6]
mov edi, dword [ebp - 0x18]
mov dl, byte [ebp - 1]
shl edi, 2
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ebx
mov byte [edi + esi], dl
mov esi, dword [ebp - 0x14]
cmp eax, ecx
jb 0x4643a9
cmp dword [ebx], 0
je 0x4643d7
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
add esp, 0xc
sub ecx, dword [esi + 0xb4]
add dword [esi + 0xa8], ecx
mov dword [ebp - 0x28], eax
lea eax, [esi + 0x28]
mov ecx, dword [ebp - 0x28]
mov dword [esi + 0xac], eax
test ecx, ecx
jne 0x464395
mov dword [ebx], ecx
lea ecx, [esi + 0x29]
mov dword [esi + 0xb0], ecx
mov byte [eax], 0
jmp 0x4643a0
mov edi, dword [ebp - 0x18]
lea esi, [ebp - 0x4b6]
shl edi, 2
mov dword [ebp - 8], ebx
mov byte [edi + esi], 0
mov esi, dword [ebp - 0x14]
jmp 0x46432d
add ecx, 0x28
add ecx, esi
mov dword [esi + 0xb0], ecx
mov eax, dword [esi + 0xac]
mov dword [ebp - 0xc], ecx
mov dl, byte [eax]
inc eax
mov dword [esi + 0xac], eax
mov byte [ebp - 1], dl
mov byte [ebp + edi - 0x4b7], dl
cmp eax, ecx
jae 0x4643e1
mov cl, byte [eax]
lea ebx, [esi + 0x20]
inc eax
mov byte [ebp - 1], cl
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0xac], eax
jmp 0x46445a
mov byte [ebp + edi - 0x4b7], 0
jmp 0x4643e4
mov ecx, dword [ebp - 0xc]
cmp dword [ebx], 0
je 0x464456
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
add esp, 0xc
sub ecx, dword [esi + 0xb4]
add dword [esi + 0xa8], ecx
mov dword [ebp - 0x28], eax
lea eax, [esi + 0x28]
mov ecx, dword [ebp - 0x28]
mov dword [esi + 0xac], eax
test ecx, ecx
jne 0x464437
mov ecx, dword [ebp - 8]
mov dword [ecx], 0
lea ecx, [esi + 0x29]
mov dword [esi + 0xb0], ecx
mov byte [eax], 0
jmp 0x464442
add ecx, 0x28
add ecx, esi
mov dword [esi + 0xb0], ecx
mov eax, dword [esi + 0xac]
mov dl, byte [eax]
inc eax
mov byte [ebp - 1], dl
mov dword [esi + 0xac], eax
jmp 0x46445a
mov byte [ebp - 1], 0
cmp dword [ebp - 0x44], 0xc
lea esi, [ebp - 0x4b8]
mov dl, byte [ebp - 1]
mov byte [edi + esi], dl
mov esi, dword [ebp - 0x14]
lea edx, [esi + 0xac]
je 0x4644da
cmp eax, ecx
jae 0x46447e
inc eax
mov dword [edx], eax
jmp 0x4644da
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x4644da
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea edi, [esi + 0x28]
push edi
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
lea edx, [esi + 0xac]
sub ecx, dword [esi + 0xb4]
add esp, 0xc
add dword [esi + 0xa8], ecx
mov dword [edx], edi
test eax, eax
jne 0x4644cd
mov eax, dword [ebp - 8]
mov dword [eax], 0
lea eax, [esi + 0x29]
mov dword [esi + 0xb0], eax
mov byte [edi], 0
jmp 0x4644d8
add eax, 0x28
add eax, esi
mov dword [esi + 0xb0], eax
inc dword [edx]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x4b5]
mov byte [ecx + eax*4], 0xff
inc eax
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x10]
jl 0x464290
mov ebx, dword [ebp - 0x2c]
xor edi, edi
mov ecx, dword [ebp - 0x50]
xor eax, eax
cmp dword [ebp - 0x44], 0xc
setne al
add eax, 3
imul eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x44]
je 0x46455c
test ecx, ecx
jns 0x464528
mov eax, dword [esi + 0xb0]
mov dword [esi + 0xac], eax
jmp 0x46455c
cmp dword [esi + 0x10], 0
je 0x464556
mov edx, dword [esi + 0xb0]
mov eax, edx
sub eax, dword [esi + 0xac]
cmp eax, ecx
jge 0x464556
sub ecx, eax
mov dword [esi + 0xac], edx
mov eax, dword [esi + 0x14]
push ecx
push dword [esi + 0x1c]
call eax
add esp, 8
jmp 0x46455c
add dword [esi + 0xac], ecx
mov edx, dword [ebp - 0x34]
cmp edx, 1
jne 0x46456e
mov eax, dword [esi]
add eax, 7
shr eax, 3
jmp 0x464585
cmp edx, 4
jne 0x46457a
mov eax, dword [esi]
inc eax
shr eax, 1
jmp 0x464585
cmp edx, 8
jne 0x4649f3
mov eax, dword [esi]
mov ecx, dword [esi + 4]
neg eax
and eax, 3
cmp edx, 1
mov dword [ebp - 0x38], eax
mov edx, ecx
jne 0x4647c0
mov dword [ebp - 0x40], 0
test ecx, ecx
jle 0x46516a
nop word [eax + eax]
mov ecx, dword [esi + 0xac]
mov dword [ebp - 8], 7
cmp ecx, dword [esi + 0xb0]
jae 0x4645d0
mov al, byte [ecx]
inc ecx
mov dword [esi + 0xac], ecx
jmp 0x464637
cmp dword [esi + 0x20], 0
je 0x464635
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
add esp, 0xc
sub ecx, dword [esi + 0xb4]
add dword [esi + 0xa8], ecx
test eax, eax
jne 0x46461c
mov dword [esi + 0x20], eax
lea ecx, [esi + 0x29]
lea eax, [esi + 0x29]
mov dword [esi + 0xb0], eax
mov byte [esi + 0x28], 0
mov al, byte [esi + 0x28]
mov dword [esi + 0xac], ecx
jmp 0x464637
add eax, 0x28
lea ecx, [esi + 0x29]
add eax, esi
mov dword [esi + 0xb0], eax
mov al, byte [esi + 0x28]
mov dword [esi + 0xac], ecx
jmp 0x464637
xor al, al
movzx eax, al
mov dword [ebp - 0x30], eax
mov eax, dword [esi]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], eax
test eax, eax
jle 0x46476a
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 8]
sar edx, cl
and edx, 1
movzx eax, byte [ebp + edx*4 - 0x4b8]
mov byte [edi + ebx], al
movzx eax, byte [ebp + edx*4 - 0x4b7]
mov byte [edi + ebx + 1], al
movzx eax, byte [ebp + edx*4 - 0x4b6]
mov edx, dword [ebp - 0x48]
mov ecx, edx
mov byte [edi + ebx + 2], al
mov eax, dword [ebp - 0x24]
mov byte [edi + ebx + 3], 0xff
inc eax
add edi, 4
cmp eax, dword [ebp - 0x1c]
je 0x46476a
sub dword [ebp - 8], 1
jns 0x46474c
mov dword [ebp - 8], 7
cmp edx, dword [esi + 0xb0]
jae 0x4646d5
mov al, byte [edx]
lea ecx, [edx + 1]
mov byte [ebp - 1], al
movzx edx, byte [ebp - 1]
mov eax, dword [ebp - 0x18]
mov dword [esi + 0xac], ecx
mov dword [ebp - 0x30], edx
jmp 0x464755
cmp dword [esi + 0x20], 0
je 0x46473a
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
add esp, 0xc
sub ecx, dword [esi + 0xb4]
add dword [esi + 0xa8], ecx
test eax, eax
jne 0x464715
mov dword [esi + 0x20], eax
lea eax, [esi + 0x29]
mov dword [esi + 0xb0], eax
mov byte [esi + 0x28], 0
jmp 0x464720
add eax, 0x28
add eax, esi
mov dword [esi + 0xb0], eax
mov al, byte [esi + 0x28]
lea ecx, [esi + 0x29]
mov byte [ebp - 1], al
movzx edx, byte [ebp - 1]
mov dword [esi + 0xac], ecx
mov eax, dword [esi]
mov dword [ebp - 0x30], edx
jmp 0x464755
mov eax, dword [ebp - 0x18]
mov ecx, edx
mov byte [ebp - 1], 0
movzx edx, byte [ebp - 1]
mov dword [ebp - 0x30], edx
jmp 0x464755
mov ecx, dword [esi + 0xac]
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x24], eax
jl 0x464657
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x4647a7
cmp dword [esi + 0x10], 0
je 0x46479f
mov edx, dword [esi + 0xb0]
sub edx, ecx
cmp edx, eax
jge 0x46479f
mov ecx, dword [esi + 0xb0]
sub eax, edx
push eax
push dword [esi + 0x1c]
mov eax, dword [esi + 0x14]
mov dword [esi + 0xac], ecx
call eax
add esp, 8
jmp 0x4647a7
add eax, ecx
mov dword [esi + 0xac], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [esi + 4]
inc eax
mov dword [ebp - 0x40], eax
mov edx, ecx
cmp eax, ecx
jl 0x4645b0
jmp 0x46516a
mov dword [ebp - 0x20], 0
test ecx, ecx
jle 0x46516a
nop
cmp dword [esi], 0
mov dword [ebp - 0x3c], 0
jle 0x4649a2
mov ecx, dword [esi + 0xac]
mov edx, dword [esi + 0xb0]
cmp ecx, edx
jae 0x4647fb
mov al, byte [ecx]
inc ecx
mov dword [esi + 0xac], ecx
jmp 0x46485e
cmp dword [esi + 0x20], 0
je 0x46485c
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
add esp, 0xc
sub ecx, dword [esi + 0xb4]
add dword [esi + 0xa8], ecx
test eax, eax
jne 0x464843
lea edx, [esi + 0x29]
mov dword [esi + 0x20], eax
mov dword [esi + 0xb0], edx
lea ecx, [esi + 0x29]
mov byte [esi + 0x28], al
mov dword [esi + 0xac], ecx
jmp 0x46485e
lea edx, [esi + 0x28]
add edx, eax
lea ecx, [esi + 0x29]
mov dword [esi + 0xb0], edx
mov al, byte [esi + 0x28]
mov dword [esi + 0xac], ecx
jmp 0x46485e
xor al, al
cmp dword [ebp - 0x34], 4
movzx eax, al
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
jne 0x46487e
mov dword [ebp - 8], eax
and dword [ebp - 8], 0xf
shr eax, 4
mov dword [ebp - 0x14], eax
movzx eax, byte [ebp + eax*4 - 0x4b8]
mov byte [edi + ebx], al
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax*4 - 0x4b7]
mov byte [edi + ebx + 1], al
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax*4 - 0x4b6]
mov byte [edi + ebx + 2], al
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
mov byte [edi + ebx + 3], 0xff
inc eax
add edi, 4
cmp eax, dword [esi]
je 0x46499f
cmp dword [ebp - 0x34], 8
jne 0x46495d
cmp ecx, edx
jae 0x4648e4
mov dl, byte [ecx]
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0x14]
mov dword [esi + 0xac], eax
movzx edx, dl
jmp 0x464963
cmp dword [esi + 0x20], 0
je 0x464953
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
add esp, 0xc
sub ecx, dword [esi + 0xb4]
add dword [esi + 0xa8], ecx
test eax, eax
jne 0x464935
mov dword [esi + 0x20], eax
lea eax, [esi + 0x29]
mov dword [esi + 0xb0], eax
lea eax, [esi + 0x29]
mov byte [esi + 0x28], 0
mov dl, byte [esi + 0x28]
mov dword [esi + 0xac], eax
mov ecx, dword [esi]
movzx edx, dl
jmp 0x464963
add eax, 0x28
add eax, esi
mov dword [esi + 0xb0], eax
lea eax, [esi + 0x29]
mov dl, byte [esi + 0x28]
mov dword [esi + 0xac], eax
mov ecx, dword [esi]
movzx edx, dl
jmp 0x464963
mov ecx, dword [ebp - 0x14]
xor dl, dl
movzx edx, dl
jmp 0x464963
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
movzx eax, byte [ebp + edx*4 - 0x4b8]
mov byte [edi + ebx], al
movzx eax, byte [ebp + edx*4 - 0x4b7]
mov byte [edi + ebx + 1], al
movzx eax, byte [ebp + edx*4 - 0x4b6]
mov byte [edi + ebx + 2], al
mov eax, dword [ebp - 0x3c]
add eax, 2
mov byte [edi + ebx + 3], 0xff
add edi, 4
mov dword [ebp - 0x3c], eax
cmp eax, ecx
jl 0x4647e0
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x4649dd
cmp dword [esi + 0x10], 0
je 0x4649d7
mov edx, dword [esi + 0xb0]
mov ecx, edx
sub ecx, dword [esi + 0xac]
cmp ecx, eax
jge 0x4649d7
sub eax, ecx
mov dword [esi + 0xac], edx
push eax
push dword [esi + 0x1c]
mov eax, dword [esi + 0x14]
call eax
mov eax, dword [ebp - 0x38]
add esp, 8
jmp 0x4649dd
add dword [esi + 0xac], eax
mov ecx, dword [esi + 4]
mov edx, ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x4647d0
jmp 0x46516a
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword fs:[0x2c]
add esp, 4
mov eax, dword [eax]
pop edi
pop ebx
pop esi
mov dword [eax + 0xc], str.bad_bpp
xor eax, eax
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword fs:[0x2c]
add esp, 4
mov eax, dword [eax]
pop edi
pop ebx
pop esi
mov dword [eax + 0xc], str.invalid
xor eax, eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], edi
sub eax, dword [ebp - 0x44]
je 0x464ac5
test eax, eax
jns 0x464a92
mov eax, dword [esi + 0xb0]
mov dword [esi + 0xac], eax
jmp 0x464ac5
cmp dword [esi + 0x10], edi
je 0x464abf
mov edx, dword [esi + 0xb0]
mov ecx, edx
sub ecx, dword [esi + 0xac]
cmp ecx, eax
jge 0x464abf
sub eax, ecx
mov dword [esi + 0xac], edx
push eax
push dword [esi + 0x1c]
mov eax, dword [esi + 0x14]
call eax
add esp, 8
jmp 0x464ac5
add dword [esi + 0xac], eax
mov ecx, dword [ebp - 0x34]
cmp ecx, 0x18
jne 0x464ad4
mov eax, dword [esi]
lea eax, [eax + eax*2]
jmp 0x464ae1
cmp ecx, 0x10
jne 0x464adf
mov eax, dword [esi]
add eax, eax
jmp 0x464ae1
xor eax, eax
neg eax
and eax, 3
mov dword [ebp - 0x90], eax
cmp ecx, 0x18
jne 0x464aff
mov dword [ebp - 0x18], 1
xor eax, eax
jmp 0x464cd7
mov edx, dword [ebp - 0x24]
cmp ecx, 0x20
mov ecx, dword [ebp - 8]
jne 0x464b3b
cmp ecx, 0xff
jne 0x464b3b
cmp edx, 0xff00
jne 0x464b3b
mov eax, dword [ebp - 0x38]
cmp eax, 0xff0000
jne 0x464b3b
cmp dword [ebp - 0x1c], 0xff000000
jne 0x464b5b
mov dword [ebp - 0x18], 2
xor eax, eax
jmp 0x464cd7
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x465219
test edx, edx
je 0x465219
test ecx, ecx
je 0x465219
mov ecx, eax
call fcn.00463a40
sub eax, 7
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x38]
mov edx, eax
and eax, 0x55555555
shr edx, 1
and edx, 0x55555555
add edx, eax
mov eax, edx
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov ecx, eax
shr ecx, 4
add ecx, eax
and ecx, 0xf0f0f0f
mov eax, ecx
shr eax, 8
add ecx, eax
mov eax, ecx
shr eax, 0x10
add eax, ecx
mov ecx, dword [ebp - 0x24]
movzx eax, al
mov dword [ebp - 0x3c], eax
call fcn.00463a40
sub eax, 7
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x24]
mov edx, eax
and eax, 0x55555555
shr edx, 1
and edx, 0x55555555
add edx, eax
mov eax, edx
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov ecx, eax
shr ecx, 4
add ecx, eax
and ecx, 0xf0f0f0f
mov eax, ecx
shr eax, 8
add ecx, eax
mov eax, ecx
shr eax, 0x10
add eax, ecx
mov ecx, dword [ebp - 8]
movzx eax, al
mov dword [ebp - 0x14], eax
call fcn.00463a40
sub eax, 7
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 8]
mov edx, eax
and eax, 0x55555555
shr edx, 1
and edx, 0x55555555
add edx, eax
mov eax, edx
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov ecx, eax
shr ecx, 4
add ecx, eax
and ecx, 0xf0f0f0f
mov eax, ecx
shr eax, 8
add ecx, eax
mov eax, ecx
shr eax, 0x10
add eax, ecx
movzx eax, al
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x1c]
call fcn.00463a40
sub eax, 7
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x1c]
mov edx, eax
and eax, 0x55555555
shr edx, 1
and edx, 0x55555555
add edx, eax
mov eax, edx
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov ecx, eax
shr ecx, 4
add ecx, eax
and ecx, 0xf0f0f0f
mov eax, ecx
shr eax, 8
add ecx, eax
mov eax, ecx
shr eax, 0x10
add eax, ecx
cmp dword [ebp - 0x3c], 8
movzx ecx, al
mov dword [ebp - 0x30], ecx
ja 0x465219
cmp dword [ebp - 0x14], 8
ja 0x465219
mov eax, dword [ebp - 0x40]
cmp eax, 8
ja 0x465219
cmp ecx, 8
ja 0x465219
mov ecx, dword [esi + 4]
mov edx, ecx
mov dword [ebp - 0x28], edi
test ecx, ecx
jle 0x46516a
mov ecx, dword [ebp - 0x58]
neg ecx
mov dword [ebp - 0x70], ecx
mov ecx, 8
sub ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp - 0x60]
neg ecx
mov dword [ebp - 0x78], ecx
mov ecx, 8
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x7c], ecx
mov ecx, dword [ebp - 0x5c]
neg ecx
mov dword [ebp - 0x80], ecx
mov ecx, 8
sub ecx, eax
mov eax, dword [ebp - 0x48]
neg eax
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x88], eax
mov eax, 8
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x8c], eax
nop dword [eax + eax]
cmp dword [ebp - 0x18], 0
mov eax, dword [esi]
mov dword [ebp - 0x54], 0
je 0x464ffd
test eax, eax
jle 0x465116
lea eax, [ebx + 2]
mov dword [ebp - 0x68], eax
lea edx, [esi + 0xac]
lea eax, [ebx + 1]
mov dword [ebp - 0x6c], eax
nop dword [eax]
mov ecx, dword [esi + 0xb0]
mov eax, dword [edx]
mov dword [ebp - 0x10], ecx
cmp eax, ecx
jae 0x464d8d
mov cl, byte [eax]
inc eax
mov byte [ebp - 1], cl
lea ecx, [esi + 0x20]
mov dword [ebp - 0xc], ecx
jmp 0x464df6
cmp dword [esi + 0x20], 0
lea ecx, [esi + 0x20]
mov dword [ebp - 0xc], ecx
je 0x464e1b
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
lea edx, [esi + 0xac]
sub ecx, dword [esi + 0xb4]
add esp, 0xc
add dword [esi + 0xa8], ecx
mov ecx, dword [ebp - 0xc]
test eax, eax
jne 0x464ddf
mov dword [ecx], eax
lea eax, [esi + 0x29]
mov dword [esi + 0xb0], eax
mov byte [esi + 0x28], 0
jmp 0x464dea
add eax, 0x28
add eax, esi
mov dword [esi + 0xb0], eax
mov dword [ebp - 0x10], eax
mov al, byte [esi + 0x28]
mov byte [ebp - 1], al
lea eax, [esi + 0x29]
mov ebx, eax
mov dword [ebp - 0x44], edx
mov dword [edx], ebx
mov edx, dword [ebp - 0x68]
mov bl, byte [ebp - 1]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x20], ecx
mov byte [edx + edi], bl
cmp eax, dword [ebp - 0x10]
jae 0x464e23
mov bl, byte [eax]
mov byte [ebp - 1], bl
jmp 0x464e99
mov dword [ebp - 0x20], ecx
mov byte [edi + ebx + 2], 0
mov ebx, dword [ebp - 0x20]
cmp dword [ebx], 0
mov ebx, dword [ebp - 0x2c]
je 0x464ebf
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
add esp, 0xc
sub ecx, dword [esi + 0xb4]
add dword [esi + 0xa8], ecx
lea ecx, [esi + 0x28]
mov dword [esi + 0xac], ecx
test eax, eax
jne 0x464e7a
mov eax, dword [ebp - 0x20]
mov dword [eax], 0
lea eax, [esi + 0x29]
mov dword [esi + 0xb0], eax
mov byte [ecx], 0
jmp 0x464e85
add eax, 0x28
add eax, esi
mov dword [esi + 0xb0], eax
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0xac]
mov cl, byte [eax]
mov byte [ebp - 1], cl
lea ecx, [esi + 0x20]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x6c]
inc eax
mov bl, byte [ebp - 1]
mov dword [esi + 0xac], eax
mov byte [edx + edi], bl
cmp eax, dword [ebp - 0x10]
jae 0x464ec7
mov bl, byte [eax]
inc eax
mov byte [ebp - 1], bl
mov dword [esi + 0xac], eax
jmp 0x464f43
mov dword [ebp - 0xc], ecx
mov byte [ebx + edi + 1], 0
mov ebx, dword [ebp - 0x20]
cmp dword [ebx], 0
mov ebx, dword [ebp - 0x2c]
je 0x464f3c
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
add esp, 0xc
sub ecx, dword [esi + 0xb4]
add dword [esi + 0xa8], ecx
lea ecx, [esi + 0x28]
mov dword [esi + 0xac], ecx
test eax, eax
jne 0x464f17
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
lea eax, [esi + 0x29]
mov dword [esi + 0xb0], eax
mov byte [esi + 0x28], 0
jmp 0x464f22
add eax, 0x28
add eax, esi
mov dword [esi + 0xb0], eax
mov eax, dword [esi + 0xac]
mov cl, byte [eax]
inc eax
mov byte [ebp - 1], cl
lea ecx, [esi + 0x20]
mov dword [esi + 0xac], eax
mov dword [ebp - 0xc], ecx
jmp 0x464f46
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], ecx
mov ebx, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], 2
mov dl, byte [ebp - 1]
mov byte [edi + ebx], dl
lea edx, [esi + 0xac]
jne 0x464fd6
cmp eax, dword [esi + 0xb0]
jae 0x464f6b
mov cl, byte [eax]
inc eax
mov dword [edx], eax
jmp 0x464fd9
cmp dword [ecx], 0
je 0x464fd2
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
lea edx, [esi + 0xac]
sub ecx, dword [esi + 0xb4]
add esp, 0xc
add dword [esi + 0xa8], ecx
lea ecx, [esi + 0x28]
mov dword [edx], ecx
test eax, eax
jne 0x464fbe
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
lea eax, [esi + 0x29]
mov dword [esi + 0xb0], eax
mov byte [esi + 0x28], 0
mov eax, dword [edx]
mov cl, byte [eax]
inc eax
mov dword [edx], eax
jmp 0x464fd9
add eax, 0x28
add eax, esi
mov dword [esi + 0xb0], eax
mov eax, dword [edx]
mov cl, byte [eax]
inc eax
mov dword [edx], eax
jmp 0x464fd9
xor cl, cl
jmp 0x464fd9
or cl, 0xff
movzx eax, cl
or dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x54]
inc eax
mov byte [edi + ebx + 3], cl
add edi, 4
mov dword [ebp - 0x54], eax
cmp eax, dword [esi]
jl 0x464d70
mov dword [ebp - 0x10], edi
jmp 0x465116
test eax, eax
jle 0x465116
mov ecx, esi
call fcn.0045a880
cmp dword [ebp - 0x34], 0x10
je 0x465023
mov ecx, esi
mov edi, eax
call fcn.0045a880
shl eax, 0x10
add eax, edi
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x58]
mov edx, eax
and edx, dword [ebp - 0x38]
test ecx, ecx
jns 0x465036
mov ecx, dword [ebp - 0x70]
shl edx, cl
jmp 0x465038
shr edx, cl
mov ecx, dword [ebp - 0x74]
shr edx, cl
mov ecx, dword [ebp - 0x3c]
imul edx, dword [ecx*4 + 0x49286c]
mov ecx, dword [ecx*4 + 0x4928b0]
sar edx, cl
mov ecx, dword [ebp - 0x60]
mov byte [edi + ebx], dl
mov edx, eax
and edx, dword [ebp - 0x24]
test ecx, ecx
jns 0x465067
mov ecx, dword [ebp - 0x78]
shl edx, cl
jmp 0x465069
shr edx, cl
mov ecx, dword [ebp - 0x7c]
shr edx, cl
mov ecx, dword [ebp - 0x14]
imul edx, dword [ecx*4 + 0x49286c]
mov ecx, dword [ecx*4 + 0x4928b0]
sar edx, cl
mov ecx, dword [ebp - 0x5c]
mov byte [edi + ebx + 1], dl
mov edx, eax
and edx, dword [ebp - 8]
test ecx, ecx
jns 0x465099
mov ecx, dword [ebp - 0x80]
shl edx, cl
jmp 0x46509b
shr edx, cl
mov ecx, dword [ebp - 0x84]
shr edx, cl
mov ecx, dword [ebp - 0x40]
imul edx, dword [ecx*4 + 0x49286c]
mov ecx, dword [ecx*4 + 0x4928b0]
sar edx, cl
mov ecx, dword [ebp - 0x1c]
mov byte [edi + ebx + 2], dl
test ecx, ecx
je 0x4650f5
and eax, ecx
mov ecx, dword [ebp - 0x48]
test ecx, ecx
jns 0x4650d5
mov ecx, dword [ebp - 0x88]
shl eax, cl
jmp 0x4650d7
shr eax, cl
mov ecx, dword [ebp - 0x8c]
shr eax, cl
mov ecx, dword [ebp - 0x30]
imul eax, dword [ecx*4 + 0x49286c]
mov ecx, dword [ecx*4 + 0x4928b0]
sar eax, cl
jmp 0x4650fa
mov eax, 0xff
mov ecx, dword [ebp - 0x54]
or dword [ebp - 0x4c], eax
inc ecx
mov byte [edi + ebx + 3], al
add edi, 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x54], ecx
cmp ecx, dword [esi]
jl 0x465005
mov edx, dword [ebp - 0x90]
test edx, edx
je 0x465156
cmp dword [esi + 0x10], 0
je 0x465150
mov eax, dword [esi + 0xb0]
mov ecx, eax
sub ecx, dword [esi + 0xac]
cmp ecx, edx
jge 0x465150
mov dword [esi + 0xac], eax
mov eax, edx
sub eax, ecx
push eax
push dword [esi + 0x1c]
mov eax, dword [esi + 0x14]
call eax
add esp, 8
jmp 0x465156
add dword [esi + 0xac], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [esi + 4]
inc eax
mov dword [ebp - 0x28], eax
mov edx, ecx
cmp eax, ecx
jl 0x464d40
cmp dword [ebp - 0x4c], 0
jne 0x46518c
mov eax, dword [esi]
imul eax, ecx
lea eax, [eax*4 - 1]
test eax, eax
js 0x46518c
mov byte [eax + ebx], 0xff
sub eax, 4
jns 0x465180
mov edx, dword [esi + 4]
cmp dword [ebp - 0x64], 0
jle 0x465201
xor edi, edi
mov ecx, edx
mov dword [ebp - 0x28], edi
test ecx, 0xfffffffe
jle 0x465201
mov eax, dword [esi]
sub ecx, edi
dec ecx
mov edx, eax
imul ecx, eax
imul edx, edi
xor edi, edi
shl eax, 2
shl ecx, 2
shl edx, 2
mov dword [ebp - 0x64], edx
lea edx, [ecx + ebx]
test eax, eax
jle 0x4651ed
mov ebx, dword [ebp - 0x64]
sub ebx, ecx
nop dword [eax + eax]
mov al, byte [edx]
lea edx, [edx + 1]
mov cl, byte [edx + ebx - 1]
inc edi
mov byte [edx + ebx - 1], al
mov byte [edx - 1], cl
mov eax, dword [esi]
shl eax, 2
cmp edi, eax
jl 0x4651d0
mov ebx, dword [ebp - 0x2c]
mov edx, dword [esi + 4]
mov ecx, edx
mov edi, dword [ebp - 0x28]
mov eax, ecx
inc edi
sar eax, 1
mov dword [ebp - 0x28], edi
cmp edi, eax
jl 0x4651a1
mov ecx, dword [ebp - 0x94]
mov eax, dword [esi]
pop edi
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword fs:[0x2c]
add esp, 4
mov eax, dword [eax]
pop edi
pop ebx
pop esi
mov dword [eax + 0xc], str.bad_masks
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword fs:[0x2c]
pop edi
pop ebx
pop esi
mov eax, dword [eax]
mov dword [eax + 0xc], str.outofmem
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword fs:[0x2c]
pop edi
pop ebx
pop esi
mov eax, dword [eax]
mov dword [eax + 0xc], str.too_large
xor eax, eax
mov esp, ebp
pop ebp
ret