Function at 0x4b7150
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd44
push esi
push edi
cmp dword [ebp + 0x1c], 4
jl 0x4b7173
push str.________main_sort_initialise_..._n
push 0x52ba60
call fcn.004be45c
add esp, 8
mov dword [ebp - 0xd04], 0x10000
jmp 0x4b718e
mov eax, dword [ebp - 0xd04]
sub eax, 1
mov dword [ebp - 0xd04], eax
cmp dword [ebp - 0xd04], 0
jl 0x4b71a9
mov ecx, dword [ebp - 0xd04]
mov edx, dword [ebp + 0x14]
mov dword [edx + ecx*4], 0
jmp 0x4b717f
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
shl ecx, 8
mov dword [ebp - 0xd20], ecx
mov edx, dword [ebp + 0x18]
sub edx, 1
mov dword [ebp - 0xd04], edx
jmp 0x4b71d5
mov eax, dword [ebp - 0xd04]
sub eax, 4
mov dword [ebp - 0xd04], eax
cmp dword [ebp - 0xd04], 3
jl 0x4b7315
mov ecx, dword [ebp - 0xd04]
mov edx, dword [ebp + 0x10]
mov word [edx + ecx*2], 0
mov eax, dword [ebp - 0xd20]
sar eax, 8
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xd04]
movzx edx, byte [ecx]
shl edx, 8
or eax, edx
mov dword [ebp - 0xd20], eax
mov eax, dword [ebp - 0xd20]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + eax*4]
add edx, 1
mov eax, dword [ebp - 0xd20]
mov ecx, dword [ebp + 0x14]
mov dword [ecx + eax*4], edx
mov edx, dword [ebp - 0xd04]
mov eax, dword [ebp + 0x10]
mov word [eax + edx*2 - 2], 0
mov ecx, dword [ebp - 0xd20]
sar ecx, 8
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xd04]
movzx eax, byte [edx - 1]
shl eax, 8
or ecx, eax
mov dword [ebp - 0xd20], ecx
mov ecx, dword [ebp - 0xd20]
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + ecx*4]
add eax, 1
mov ecx, dword [ebp - 0xd20]
mov edx, dword [ebp + 0x14]
mov dword [edx + ecx*4], eax
mov eax, dword [ebp - 0xd04]
mov ecx, dword [ebp + 0x10]
mov word [ecx + eax*2 - 4], 0
mov edx, dword [ebp - 0xd20]
sar edx, 8
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xd04]
movzx ecx, byte [eax - 2]
shl ecx, 8
or edx, ecx
mov dword [ebp - 0xd20], edx
mov edx, dword [ebp - 0xd20]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + edx*4]
add ecx, 1
mov edx, dword [ebp - 0xd20]
mov eax, dword [ebp + 0x14]
mov dword [eax + edx*4], ecx
mov ecx, dword [ebp - 0xd04]
mov edx, dword [ebp + 0x10]
mov word [edx + ecx*2 - 6], 0
mov eax, dword [ebp - 0xd20]
sar eax, 8
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xd04]
movzx edx, byte [ecx - 3]
shl edx, 8
or eax, edx
mov dword [ebp - 0xd20], eax
mov eax, dword [ebp - 0xd20]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + eax*4]
add edx, 1
mov eax, dword [ebp - 0xd20]
mov ecx, dword [ebp + 0x14]
mov dword [ecx + eax*4], edx
jmp 0x4b71c6
jmp 0x4b7326
mov edx, dword [ebp - 0xd04]
sub edx, 1
mov dword [ebp - 0xd04], edx
cmp dword [ebp - 0xd04], 0
jl 0x4b737b
mov eax, dword [ebp - 0xd04]
mov ecx, dword [ebp + 0x10]
mov word [ecx + eax*2], 0
mov edx, dword [ebp - 0xd20]
sar edx, 8
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xd04]
movzx ecx, byte [eax]
shl ecx, 8
or edx, ecx
mov dword [ebp - 0xd20], edx
mov edx, dword [ebp - 0xd20]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + edx*4]
add ecx, 1
mov edx, dword [ebp - 0xd20]
mov eax, dword [ebp + 0x14]
mov dword [eax + edx*4], ecx
jmp 0x4b7317
mov dword [ebp - 0xd04], 0
jmp 0x4b7396
mov ecx, dword [ebp - 0xd04]
add ecx, 1
mov dword [ebp - 0xd04], ecx
cmp dword [ebp - 0xd04], 0x22
jge 0x4b73cd
mov edx, dword [ebp + 0x18]
add edx, dword [ebp - 0xd04]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xd04]
mov ecx, dword [ebp + 0xc]
mov al, byte [eax]
mov byte [ecx + edx], al
mov ecx, dword [ebp + 0x18]
add ecx, dword [ebp - 0xd04]
mov edx, dword [ebp + 0x10]
mov word [edx + ecx*2], 0
jmp 0x4b7387
cmp dword [ebp + 0x1c], 4
jl 0x4b73e5
push str.________bucket_sorting_..._n
push 0x52ba60
call fcn.004be45c
add esp, 8
mov dword [ebp - 0xd04], 1
jmp 0x4b7400
mov eax, dword [ebp - 0xd04]
add eax, 1
mov dword [ebp - 0xd04], eax
cmp dword [ebp - 0xd04], 0x10000
jg 0x4b7433
mov ecx, dword [ebp - 0xd04]
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + ecx*4]
mov ecx, dword [ebp - 0xd04]
mov edx, dword [ebp + 0x14]
add eax, dword [edx + ecx*4 - 4]
mov ecx, dword [ebp - 0xd04]
mov edx, dword [ebp + 0x14]
mov dword [edx + ecx*4], eax
jmp 0x4b73f1
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
shl ecx, 8
mov word [ebp - 0xd08], cx
mov edx, dword [ebp + 0x18]
sub edx, 1
mov dword [ebp - 0xd04], edx
jmp 0x4b7460
mov eax, dword [ebp - 0xd04]
sub eax, 4
mov dword [ebp - 0xd04], eax
cmp dword [ebp - 0xd04], 3
jl 0x4b75f2
movzx ecx, word [ebp - 0xd08]
sar ecx, 8
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xd04]
movzx eax, byte [edx]
shl eax, 8
or ecx, eax
mov word [ebp - 0xd08], cx
movzx ecx, word [ebp - 0xd08]
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + ecx*4]
sub eax, 1
mov dword [ebp - 0xd20], eax
movzx ecx, word [ebp - 0xd08]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0xd20]
mov dword [edx + ecx*4], eax
mov ecx, dword [ebp - 0xd20]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xd04]
mov dword [edx + ecx*4], eax
movzx ecx, word [ebp - 0xd08]
sar ecx, 8
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xd04]
movzx eax, byte [edx - 1]
shl eax, 8
or ecx, eax
mov word [ebp - 0xd08], cx
movzx ecx, word [ebp - 0xd08]
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + ecx*4]
sub eax, 1
mov dword [ebp - 0xd20], eax
movzx ecx, word [ebp - 0xd08]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0xd20]
mov dword [edx + ecx*4], eax
mov ecx, dword [ebp - 0xd04]
sub ecx, 1
mov edx, dword [ebp - 0xd20]
mov eax, dword [ebp + 8]
mov dword [eax + edx*4], ecx
movzx ecx, word [ebp - 0xd08]
sar ecx, 8
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xd04]
movzx eax, byte [edx - 2]
shl eax, 8
or ecx, eax
mov word [ebp - 0xd08], cx
movzx ecx, word [ebp - 0xd08]
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + ecx*4]
sub eax, 1
mov dword [ebp - 0xd20], eax
movzx ecx, word [ebp - 0xd08]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0xd20]
mov dword [edx + ecx*4], eax
mov ecx, dword [ebp - 0xd04]
sub ecx, 2
mov edx, dword [ebp - 0xd20]
mov eax, dword [ebp + 8]
mov dword [eax + edx*4], ecx
movzx ecx, word [ebp - 0xd08]
sar ecx, 8
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xd04]
movzx eax, byte [edx - 3]
shl eax, 8
or ecx, eax
mov word [ebp - 0xd08], cx
movzx ecx, word [ebp - 0xd08]
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + ecx*4]
sub eax, 1
mov dword [ebp - 0xd20], eax
movzx ecx, word [ebp - 0xd08]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0xd20]
mov dword [edx + ecx*4], eax
mov ecx, dword [ebp - 0xd04]
sub ecx, 3
mov edx, dword [ebp - 0xd20]
mov eax, dword [ebp + 8]
mov dword [eax + edx*4], ecx
jmp 0x4b7451
jmp 0x4b7603
mov ecx, dword [ebp - 0xd04]
sub ecx, 1
mov dword [ebp - 0xd04], ecx
cmp dword [ebp - 0xd04], 0
jl 0x4b766b
movzx edx, word [ebp - 0xd08]
sar edx, 8
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xd04]
movzx ecx, byte [eax]
shl ecx, 8
or edx, ecx
mov word [ebp - 0xd08], dx
movzx edx, word [ebp - 0xd08]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + edx*4]
sub ecx, 1
mov dword [ebp - 0xd20], ecx
movzx edx, word [ebp - 0xd08]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xd20]
mov dword [eax + edx*4], ecx
mov edx, dword [ebp - 0xd20]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xd04]
mov dword [eax + edx*4], ecx
jmp 0x4b75f4
mov dword [ebp - 0xd04], 0
jmp 0x4b7686
mov edx, dword [ebp - 0xd04]
add edx, 1
mov dword [ebp - 0xd04], edx
cmp dword [ebp - 0xd04], 0xff
jg 0x4b76b5
mov eax, dword [ebp - 0xd04]
mov byte [ebp + eax - 0x100], 0
mov ecx, dword [ebp - 0xd04]
mov edx, dword [ebp - 0xd04]
mov dword [ebp + ecx*4 - 0x500], edx
jmp 0x4b7677
mov dword [ebp - 0xd24], 1
mov eax, dword [ebp - 0xd24]
imul eax, eax, 3
add eax, 1
mov dword [ebp - 0xd24], eax
cmp dword [ebp - 0xd24], 0x100
jle 0x4b76bf
mov eax, dword [ebp - 0xd24]
cdq
mov ecx, 3
idiv ecx
mov dword [ebp - 0xd24], eax
mov edx, dword [ebp - 0xd24]
mov dword [ebp - 0xd04], edx
jmp 0x4b770e
mov eax, dword [ebp - 0xd04]
add eax, 1
mov dword [ebp - 0xd04], eax
cmp dword [ebp - 0xd04], 0xff
jg 0x4b77ff
mov ecx, dword [ebp - 0xd04]
mov edx, dword [ebp + ecx*4 - 0x500]
mov dword [ebp - 0xd28], edx
mov eax, dword [ebp - 0xd04]
mov dword [ebp - 0xd20], eax
mov ecx, dword [ebp - 0xd20]
sub ecx, dword [ebp - 0xd24]
mov edx, dword [ebp + ecx*4 - 0x500]
add edx, 1
shl edx, 8
mov eax, dword [ebp - 0xd20]
sub eax, dword [ebp - 0xd24]
mov ecx, dword [ebp + eax*4 - 0x500]
shl ecx, 8
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 0x14]
mov edx, dword [eax + edx*4]
sub edx, dword [esi + ecx*4]
mov eax, dword [ebp - 0xd28]
add eax, 1
shl eax, 8
mov ecx, dword [ebp - 0xd28]
shl ecx, 8
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x14]
mov eax, dword [esi + eax*4]
sub eax, dword [edi + ecx*4]
cmp edx, eax
jbe 0x4b77e7
mov ecx, dword [ebp - 0xd20]
sub ecx, dword [ebp - 0xd24]
mov edx, dword [ebp - 0xd20]
mov eax, dword [ebp + ecx*4 - 0x500]
mov dword [ebp + edx*4 - 0x500], eax
mov ecx, dword [ebp - 0xd20]
sub ecx, dword [ebp - 0xd24]
mov dword [ebp - 0xd20], ecx
mov edx, dword [ebp - 0xd24]
sub edx, 1
cmp dword [ebp - 0xd20], edx
jg 0x4b77e2
jmp 0x4b77e7
jmp 0x4b773d
mov eax, dword [ebp - 0xd20]
mov ecx, dword [ebp - 0xd28]
mov dword [ebp + eax*4 - 0x500], ecx
jmp 0x4b76ff
cmp dword [ebp - 0xd24], 1
jne 0x4b76dd
mov dword [ebp - 0xd0c], 0
mov dword [ebp - 0xd04], 0
jmp 0x4b7831
mov edx, dword [ebp - 0xd04]
add edx, 1
mov dword [ebp - 0xd04], edx
cmp dword [ebp - 0xd04], 0xff
jg 0x4b7de2
mov eax, dword [ebp - 0xd04]
mov ecx, dword [ebp + eax*4 - 0x500]
mov dword [ebp - 0xd1c], ecx
mov dword [ebp - 0xd20], 0
jmp 0x4b786f
mov edx, dword [ebp - 0xd20]
add edx, 1
mov dword [ebp - 0xd20], edx
cmp dword [ebp - 0xd20], 0xff
jg 0x4b79b9
mov eax, dword [ebp - 0xd20]
cmp eax, dword [ebp - 0xd1c]
je 0x4b79b4
mov ecx, dword [ebp - 0xd1c]
shl ecx, 8
add ecx, dword [ebp - 0xd20]
mov dword [ebp - 0xd10], ecx
mov edx, dword [ebp - 0xd10]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + edx*4]
and ecx, 0x200000
jne 0x4b7996
mov edx, dword [ebp - 0xd10]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + edx*4]
and ecx, 0xffdfffff
mov dword [ebp - 0xd2c], ecx
mov edx, dword [ebp - 0xd10]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + edx*4 + 4]
and ecx, 0xffdfffff
sub ecx, 1
mov dword [ebp - 0xd30], ecx
mov edx, dword [ebp - 0xd30]
cmp edx, dword [ebp - 0xd2c]
jle 0x4b7996
cmp dword [ebp + 0x1c], 4
jl 0x4b7941
mov eax, dword [ebp - 0xd30]
sub eax, dword [ebp - 0xd2c]
add eax, 1
push eax
mov ecx, dword [ebp - 0xd0c]
push ecx
mov edx, dword [ebp - 0xd20]
push edx
mov eax, dword [ebp - 0xd1c]
push eax
push str.________qsort__0x_x__0x_x____done__d___this__d_n
push 0x52ba60
call fcn.004be45c
add esp, 0x18
mov ecx, dword [ebp + 0x20]
push ecx
push 2
mov edx, dword [ebp - 0xd30]
push edx
mov eax, dword [ebp - 0xd2c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004b7e20
add esp, 0x20
mov edx, dword [ebp - 0xd30]
sub edx, dword [ebp - 0xd2c]
mov eax, dword [ebp - 0xd0c]
lea ecx, [eax + edx + 1]
mov dword [ebp - 0xd0c], ecx
mov edx, dword [ebp + 0x20]
cmp dword [edx], 0
jge 0x4b7996
jmp 0x4b7e0f
mov eax, dword [ebp - 0xd10]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + eax*4]
or edx, 0x200000
mov eax, dword [ebp - 0xd10]
mov ecx, dword [ebp + 0x14]
mov dword [ecx + eax*4], edx
jmp 0x4b7860
mov edx, dword [ebp - 0xd1c]
movzx eax, byte [ebp + edx - 0x100]
test eax, eax
je 0x4b79d8
push 0x3ee
call fcn.00491d40
add esp, 4
mov dword [ebp - 0xd20], 0
jmp 0x4b79f3
mov ecx, dword [ebp - 0xd20]
add ecx, 1
mov dword [ebp - 0xd20], ecx
cmp dword [ebp - 0xd20], 0xff
jg 0x4b7a55
mov edx, dword [ebp - 0xd20]
shl edx, 8
add edx, dword [ebp - 0xd1c]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + edx*4]
and ecx, 0xffdfffff
mov edx, dword [ebp - 0xd20]
mov dword [ebp + edx*4 - 0xd00], ecx
mov eax, dword [ebp - 0xd20]
shl eax, 8
add eax, dword [ebp - 0xd1c]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + eax*4 + 4]
and edx, 0xffdfffff
sub edx, 1
mov eax, dword [ebp - 0xd20]
mov dword [ebp + eax*4 - 0x900], edx
jmp 0x4b79e4
mov ecx, dword [ebp - 0xd1c]
shl ecx, 8
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + ecx*4]
and eax, 0xffdfffff
mov dword [ebp - 0xd20], eax
jmp 0x4b7a80
mov ecx, dword [ebp - 0xd20]
add ecx, 1
mov dword [ebp - 0xd20], ecx
mov edx, dword [ebp - 0xd1c]
mov eax, dword [ebp - 0xd20]
cmp eax, dword [ebp + edx*4 - 0xd00]
jge 0x4b7b21
mov ecx, dword [ebp - 0xd20]
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx*4]
sub eax, 1
mov dword [ebp - 0xd18], eax
jns 0x4b7abf
mov ecx, dword [ebp - 0xd18]
add ecx, dword [ebp + 0x18]
mov dword [ebp - 0xd18], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xd18]
mov al, byte [edx]
mov byte [ebp - 0xd11], al
movzx ecx, byte [ebp - 0xd11]
movzx edx, byte [ebp + ecx - 0x100]
test edx, edx
jne 0x4b7b1c
movzx eax, byte [ebp - 0xd11]
mov ecx, dword [ebp + eax*4 - 0xd00]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xd18]
mov dword [edx + ecx*4], eax
movzx ecx, byte [ebp - 0xd11]
mov edx, dword [ebp + ecx*4 - 0xd00]
add edx, 1
movzx eax, byte [ebp - 0xd11]
mov dword [ebp + eax*4 - 0xd00], edx
jmp 0x4b7a71
mov ecx, dword [ebp - 0xd1c]
add ecx, 1
shl ecx, 8
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + ecx*4]
and eax, 0xffdfffff
sub eax, 1
mov dword [ebp - 0xd20], eax
jmp 0x4b7b52
mov ecx, dword [ebp - 0xd20]
sub ecx, 1
mov dword [ebp - 0xd20], ecx
mov edx, dword [ebp - 0xd1c]
mov eax, dword [ebp - 0xd20]
cmp eax, dword [ebp + edx*4 - 0x900]
jle 0x4b7bf3
mov ecx, dword [ebp - 0xd20]
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx*4]
sub eax, 1
mov dword [ebp - 0xd18], eax
jns 0x4b7b91
mov ecx, dword [ebp - 0xd18]
add ecx, dword [ebp + 0x18]
mov dword [ebp - 0xd18], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xd18]
mov al, byte [edx]
mov byte [ebp - 0xd11], al
movzx ecx, byte [ebp - 0xd11]
movzx edx, byte [ebp + ecx - 0x100]
test edx, edx
jne 0x4b7bee
movzx eax, byte [ebp - 0xd11]
mov ecx, dword [ebp + eax*4 - 0x900]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xd18]
mov dword [edx + ecx*4], eax
movzx ecx, byte [ebp - 0xd11]
mov edx, dword [ebp + ecx*4 - 0x900]
sub edx, 1
movzx eax, byte [ebp - 0xd11]
mov dword [ebp + eax*4 - 0x900], edx
jmp 0x4b7b43
mov ecx, dword [ebp - 0xd1c]
mov edx, dword [ebp + ecx*4 - 0xd00]
sub edx, 1
mov eax, dword [ebp - 0xd1c]
cmp edx, dword [ebp + eax*4 - 0x900]
je 0x4b7c44
mov ecx, dword [ebp - 0xd1c]
cmp dword [ebp + ecx*4 - 0xd00], 0
jne 0x4b7c37
mov edx, dword [ebp + 0x18]
sub edx, 1
mov eax, dword [ebp - 0xd1c]
cmp dword [ebp + eax*4 - 0x900], edx
je 0x4b7c44
push 0x3ef
call fcn.00491d40
add esp, 4
mov dword [ebp - 0xd20], 0
jmp 0x4b7c5f
mov ecx, dword [ebp - 0xd20]
add ecx, 1
mov dword [ebp - 0xd20], ecx
cmp dword [ebp - 0xd20], 0xff
jg 0x4b7c9d
mov edx, dword [ebp - 0xd20]
shl edx, 8
add edx, dword [ebp - 0xd1c]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + edx*4]
or ecx, 0x200000
mov edx, dword [ebp - 0xd20]
shl edx, 8
add edx, dword [ebp - 0xd1c]
mov eax, dword [ebp + 0x14]
mov dword [eax + edx*4], ecx
jmp 0x4b7c50
mov ecx, dword [ebp - 0xd1c]
mov byte [ebp + ecx - 0x100], 1
cmp dword [ebp - 0xd04], 0xff
jge 0x4b7ddd
mov edx, dword [ebp - 0xd1c]
shl edx, 8
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + edx*4]
and ecx, 0xffdfffff
mov dword [ebp - 0xd38], ecx
mov edx, dword [ebp - 0xd1c]
add edx, 1
shl edx, 8
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + edx*4]
and ecx, 0xffdfffff
sub ecx, dword [ebp - 0xd38]
mov dword [ebp - 0xd3c], ecx
mov dword [ebp - 0xd34], 0
mov edx, dword [ebp - 0xd3c]
mov ecx, dword [ebp - 0xd34]
sar edx, cl
cmp edx, 0xfffe
jle 0x4b7d2b
mov eax, dword [ebp - 0xd34]
add eax, 1
mov dword [ebp - 0xd34], eax
jmp 0x4b7d04
mov ecx, dword [ebp - 0xd3c]
sub ecx, 1
mov dword [ebp - 0xd20], ecx
jmp 0x4b7d4b
mov edx, dword [ebp - 0xd20]
sub edx, 1
mov dword [ebp - 0xd20], edx
cmp dword [ebp - 0xd20], 0
jl 0x4b7db7
mov eax, dword [ebp - 0xd38]
add eax, dword [ebp - 0xd20]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0xd44], edx
mov eax, dword [ebp - 0xd20]
mov ecx, dword [ebp - 0xd34]
sar eax, cl
mov word [ebp - 0xd40], ax
mov ecx, dword [ebp - 0xd44]
mov edx, dword [ebp + 0x10]
mov ax, word [ebp - 0xd40]
mov word [edx + ecx*2], ax
cmp dword [ebp - 0xd44], 0x22
jge 0x4b7db5
mov ecx, dword [ebp - 0xd44]
add ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
mov ax, word [ebp - 0xd40]
mov word [edx + ecx*2], ax
jmp 0x4b7d3c
mov edx, dword [ebp - 0xd3c]
sub edx, 1
mov ecx, dword [ebp - 0xd34]
sar edx, cl
cmp edx, 0xffff
jle 0x4b7ddd
push 0x3ea
call fcn.00491d40
add esp, 4
jmp 0x4b7822
cmp dword [ebp + 0x1c], 4
jl 0x4b7e0f
mov eax, dword [ebp + 0x18]
sub eax, dword [ebp - 0xd0c]
push eax
mov ecx, dword [ebp - 0xd0c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
push str._________d_pointers___d_sorted___d_scanned_n
push 0x52ba60
call fcn.004be45c
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret