Function at 0x407160
Capabilities:
Authenticate hmac
Create thread
Encode data using xor
Inject dll
Inject thread
Set console window title

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b718
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x88
push esi
push edi
mov eax, dword [0x4803a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ax, word [0x47c130]
xor edx, edx
movq xmm0, qword [str.blt]
mov word [ebp - 0x2c], ax
mov al, byte [0x47c132]
movq qword [ebp - 0x34], xmm0
mov byte [ebp - 0x2a], al
mov dword [ebp - 0x14], edx
mov eax, 0xa0a0a0a1
mul edx
shr edx, 5
movsx eax, dl
mov edx, dword [ebp - 0x14]
mov cl, dl
imul eax, eax, 0x33
sub cl, al
add cl, 0x36
xor byte [ebp + edx - 0x34], cl
inc edx
mov dword [ebp - 0x14], edx
cmp edx, 0xb
jl 0x4071c2
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.00404a50
cmp byte [0x47c343], 0
mov edi, 5
movups xmm0, xmmword [0x47c32c]
mov esi, dword [0x480bdc]
movups xmmword [ebp - 0x6c], xmm0
lea eax, [edi + 0x1a]
movq xmm0, qword [0x47c33c]
movq qword [ebp - 0x5c], xmm0
je 0x407383
xor ecx, ecx
cmp esi, 2
jl 0x407362
movaps xmm0, xmmword [str.6666666666666666]
movaps xmm4, xmmword [0x47c3d0]
movaps xmm3, xmmword [0x47c470]
movaps xmm6, xmmword [0x47c3f0]
movaps xmmword [ebp - 0x40], xmm0
mov edx, dword [ebp - 0x40]
movd xmm5, edi
movd xmm7, eax
movd xmm0, ecx
lea eax, [ecx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x47c450]
packuswb xmm1, xmm1
movd xmm0, edx
paddb xmm1, xmm0
movd xmm0, dword [ebp + ecx - 0x6c]
pxor xmm1, xmm0
movd xmm0, eax
pshufd xmm2, xmm0, 0
movd dword [ebp + ecx - 0x6c], xmm1
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckldq xmm1, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x47c450]
packuswb xmm1, xmm1
movd xmm0, edx
paddb xmm1, xmm0
movd xmm0, dword [ebp + ecx - 0x68]
pxor xmm1, xmm0
movd dword [ebp + ecx - 0x68], xmm1
add ecx, 8
cmp ecx, 0x18
jl 0x407261
jmp 0x407383
mov eax, 0xa0a0a0a1
mul ecx
shr edx, 5
movsx eax, dl
mov dl, cl
imul eax, eax, 0x33
sub dl, al
add dl, 0x36
xor byte [ebp + ecx - 0x6c], dl
inc ecx
cmp ecx, 0x18
jl 0x407362
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x6c]
call fcn.00409b60
call fcn.00405070
mov eax, dword [0x47c10c]
xor ecx, ecx
mov dword [ebp - 0x5c], eax
mov al, byte [0x47c110]
mov byte [ebp - 0x58], al
movups xmm0, xmmword [0x47c0fc]
movups xmmword [ebp - 0x6c], xmm0
cmp esi, 2
jl 0x4074f4
movaps xmm0, xmmword [str.6666666666666666]
mov eax, 0x1f
movaps xmm4, xmmword [0x47c3d0]
movaps xmm3, xmmword [0x47c470]
movaps xmm6, xmmword [0x47c3f0]
movaps xmmword [ebp - 0x40], xmm0
mov edx, dword [ebp - 0x40]
movd xmm5, edi
movd xmm7, eax
nop dword [eax]
movd xmm0, ecx
lea eax, [ecx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x47c450]
packuswb xmm1, xmm1
movd xmm0, edx
paddb xmm1, xmm0
movd xmm0, dword [ebp + ecx - 0x6c]
pxor xmm1, xmm0
movd xmm0, eax
pshufd xmm2, xmm0, 0
movd dword [ebp + ecx - 0x6c], xmm1
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckldq xmm1, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x47c450]
packuswb xmm1, xmm1
movd xmm0, edx
paddb xmm1, xmm0
movd xmm0, dword [ebp + ecx - 0x68]
pxor xmm1, xmm0
movd dword [ebp + ecx - 0x68], xmm1
add ecx, 8
cmp ecx, 0x10
jl 0x4073f0
cmp ecx, 0x15
jge 0x40751e
mov eax, 0xa0a0a0a1
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dl, cl
movsx eax, al
imul eax, eax, 0x33
sub dl, al
add dl, 0x36
xor byte [ebp + ecx - 0x6c], dl
inc ecx
cmp ecx, 0x15
jl 0x4074f4
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x6c]
call fcn.00409b60
call fcn.004062e0
movups xmm0, xmmword [0x47c2a8]
mov ax, word [0x47c2c8]
xor edx, edx
mov word [ebp - 0x70], ax
mov al, byte [0x47c2ca]
mov byte [ebp - 0x6e], al
mov dword [ebp - 0x14], edx
movups xmmword [ebp - 0x90], xmm0
movups xmm0, xmmword [0x47c2b8]
movups xmmword [ebp - 0x80], xmm0
cmp esi, 2
jl 0x4076b3
movaps xmm0, xmmword [str.6666666666666666]
mov eax, 0x1f
movaps xmm4, xmmword [0x47c3d0]
movaps xmm3, xmmword [0x47c470]
movaps xmm6, xmmword [0x47c3f0]
movaps xmmword [ebp - 0x40], xmm0
mov ecx, dword [ebp - 0x40]
movd xmm5, edi
movd xmm7, eax
nop word [eax + eax]
movd xmm0, edx
lea eax, [edx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x47c450]
packuswb xmm1, xmm1
movd xmm0, ecx
paddb xmm1, xmm0
movd xmm0, dword [ebp + edx - 0x90]
pxor xmm1, xmm0
movd xmm0, eax
pshufd xmm2, xmm0, 0
movd dword [ebp + edx - 0x90], xmm1
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckldq xmm1, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x47c450]
packuswb xmm1, xmm1
movd xmm0, ecx
paddb xmm1, xmm0
movd xmm0, dword [ebp + edx - 0x8c]
pxor xmm1, xmm0
movd dword [ebp + edx - 0x8c], xmm1
add edx, 8
cmp edx, 0x20
jl 0x4075a0
mov dword [ebp - 0x14], edx
cmp edx, 0x23
jge 0x4076e7
mov eax, 0xa0a0a0a1
imul edx
add edx, dword [ebp - 0x14]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0x14]
movsx eax, al
mov cl, dl
imul eax, eax, 0x33
sub cl, al
add cl, 0x36
xor byte [ebp + edx - 0x90], cl
inc edx
mov dword [ebp - 0x14], edx
cmp edx, 0x23
jl 0x4076b3
lea eax, [ebp - 0x90]
push eax
call fcn.00401e10
add esp, 4
call fcn.00404fb0
mov edi, eax
test edi, edi
jne 0x407717
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00404fb0
mov edi, eax
test edi, edi
je 0x407701
mov eax, dword [0x47c370]
xor edx, edx
movq xmm0, qword [0x47c368]
mov dword [ebp - 0x30], eax
mov al, byte [0x47c374]
movq qword [ebp - 0x38], xmm0
mov byte [ebp - 0x2c], al
mov dword [ebp - 0x14], edx
cmp esi, 2
jl 0x407853
movaps xmm2, xmmword [0x47c3d0]
mov eax, 5
movaps xmm4, xmmword [0x47c470]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
mov edx, 8
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
movd xmm5, eax
psrad xmm1, xmm5
mov eax, 0x1f
mov dword [ebp - 0x14], edx
movaps xmm0, xmm1
movd xmm6, eax
mov eax, dword [str.6666666666666666]
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x47c3f0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x47c3e0]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x47c450]
packuswb xmm1, xmm1
movd xmm0, eax
paddb xmm1, xmm0
movd xmm0, dword [0x47c368]
pxor xmm1, xmm0
movaps xmm0, xmm2
movd dword [ebp - 0x38], xmm1
movaps xmm1, xmm2
punpckldq xmm1, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x47c3f0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x47c450]
packuswb xmm1, xmm1
movd xmm0, eax
paddb xmm1, xmm0
movd xmm0, dword [ebp - 0x34]
pxor xmm1, xmm0
movd dword [ebp - 0x34], xmm1
mov eax, 0xa0a0a0a1
imul edx
add edx, dword [ebp - 0x14]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0x14]
movsx eax, al
mov cl, dl
imul eax, eax, 0x33
sub cl, al
add cl, 0x36
xor byte [ebp + edx - 0x38], cl
inc edx
mov dword [ebp - 0x14], edx
cmp edx, 0xd
jl 0x407853
lea eax, [ebp - 0x38]
push edi
push eax
call fcn.00401e10
add esp, 8
lea ecx, [ebp - 0x88]
call fcn.004038a0
mov ecx, eax
mov dword [ebp - 4], 0
mov esi, dword [ecx + 0x14]
mov eax, esi
mov edx, dword [ecx + 0x10]
sub eax, edx
cmp eax, 1
jb 0x4078cb
lea eax, [edx + 1]
mov dword [ecx + 0x10], eax
mov eax, ecx
cmp esi, 0x10
jb 0x4078c3
mov eax, dword [ecx]
mov word [eax + edx], 0x5c
jmp 0x4078e2
push 1
push 0x47b2d4
mov byte [ebp - 0x14], 0
push dword [ebp - 0x14]
push 1
call fcn.00409e80
mov ecx, eax
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
movups xmm0, xmmword [ecx]
movups xmmword [ebp - 0x6c], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [ebp - 0x5c], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x58]
mov eax, edx
mov ecx, dword [ebp - 0x5c]
sub eax, ecx
push 0xa
push str.tw_w32.dll
cmp eax, 0xa
jb 0x407957
cmp edx, 0x10
lea esi, [ebp - 0x6c]
lea eax, [ecx + 0xa]
cmovae esi, dword [ebp - 0x6c]
add esi, ecx
mov dword [ebp - 0x5c], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0xa], 0
lea eax, [ebp - 0x6c]
jmp 0x407968
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x6c]
push dword [ebp - 0x14]
push 0xa
call fcn.00409e80
movups xmm0, xmmword [eax]
push edi
push 0
movups xmmword [ebp - 0x40], xmm0
lea esi, [ebp - 0x40]
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x30], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
cmp dword [ebp - 0x2c], 0x10
push 0x1fffff
cmovae esi, dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, 0xffffffff
je 0x407a80
push 4
push 0x3000
push 0x104
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edx, eax
mov eax, esi
mov dword [ebp - 0x14], edx
lea ecx, [eax + 1]
mov dword [ebp - 0x18], ecx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4079d0
sub eax, dword [ebp - 0x18]
push 0
inc eax
push eax
push esi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4079f7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x407a80
push 0
push 0
push dword [ebp - 0x14]
push 0x47b298
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x407a54
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x407a30
sub esi, ecx
push 0x8000
lea eax, [esi + 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x407a80
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x407a60
sub esi, ecx
push 0x8000
lea eax, [esi + 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push dword [ebp - 0x18]
call edi
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x407ab4
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407aaa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407b31
push edx
push ecx
call fcn.00469eed
add esp, 8
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp edx, 0x10
jb 0x407af6
mov ecx, dword [ebp - 0x6c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407aec
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407b31
push edx
push ecx
call fcn.00469eed
add esp, 8
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0xf
mov byte [ebp - 0x6c], 0
cmp edx, 0x10
jb 0x407b41
mov ecx, dword [ebp - 0x88]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407b37
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x407b37
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00469eed
add esp, 8
movups xmm0, xmmword [0x47c2cc]
mov ax, word [0x47c2dc]
mov word [ebp - 0x44], ax
movups xmmword [ebp - 0x54], xmm0
test ah, ah
je 0x407cf1
xor edx, edx
cmp dword [0x480bdc], 2
mov dword [ebp - 0x14], edx
jl 0x407cc0
movaps xmm0, xmmword [str.6666666666666666]
mov eax, 5
movaps xmm4, xmmword [0x47c3d0]
movaps xmm3, xmmword [0x47c470]
movaps xmm6, xmmword [0x47c3f0]
movd xmm5, eax
mov eax, 0x1f
movaps xmmword [ebp - 0x40], xmm0
mov ecx, dword [ebp - 0x40]
movd xmm7, eax
nop word [eax + eax]
movd xmm0, edx
lea eax, [edx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x47c450]
packuswb xmm1, xmm1
movd xmm0, ecx
paddb xmm1, xmm0
movd xmm0, dword [ebp + edx - 0x54]
pxor xmm1, xmm0
movd xmm0, eax
pshufd xmm2, xmm0, 0
movd dword [ebp + edx - 0x54], xmm1
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckldq xmm1, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x47c450]
packuswb xmm1, xmm1
movd xmm0, ecx
paddb xmm1, xmm0
movd xmm0, dword [ebp + edx - 0x50]
pxor xmm1, xmm0
movd dword [ebp + edx - 0x50], xmm1
add edx, 8
cmp edx, 0x10
jl 0x407bb0
mov dword [ebp - 0x14], edx
cmp edx, 0x12
jge 0x407cf1
nop word [eax + eax]
mov eax, 0xa0a0a0a1
imul edx
add edx, dword [ebp - 0x14]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0x14]
movsx eax, al
mov cl, dl
imul eax, eax, 0x33
sub cl, al
add cl, 0x36
xor byte [ebp + edx - 0x54], cl
inc edx
mov dword [ebp - 0x14], edx
cmp edx, 0x12
jl 0x407cc0
lea eax, [ebp - 0x54]
push eax
call fcn.00401e10
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret