Function at 0x411c7a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
sub esp, 0x300
lea ebp, [esp - 4]
mov eax, dword [0x4a4b60]
xor eax, ebp
mov dword [ebp + 0x300], eax
push 0x64
mov eax, 0x47e599
call fcn.00462bd7
mov edi, dword [ebp + 0x30c]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
mov dword [ebp - 0x70], edi
call esi
mov dword [ebp - 0x50], eax
test eax, eax
jne 0x411cbe
xor eax, eax
jmp 0x4126aa
movzx ecx, word [eax + 0xe]
mov dword [ebp - 0x6c], ecx
cmp ecx, 1
je 0x411ce2
cmp ecx, 4
je 0x411ce2
cmp ecx, 8
je 0x411ce2
cmp ecx, 0x18
je 0x411ce2
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x411cb7
mov ebx, dword [eax + 4]
mov eax, dword [eax + 8]
push 8
push eax
push ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x4c], eax
call fcn.00407058
add esp, 0xc
mov dword [ebp - 0x58], eax
test eax, eax
je 0x411cd9
push eax
call esi
mov dword [ebp - 0x38], eax
test eax, eax
je 0x411cd9
imul ebx, ebx, 3
cmp dword [ebp + 0x314], 1
mov edi, 0xc0
lea esi, [edi + 0x20]
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x54], 2
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], 5
mov dword [ebp - 0x44], ebx
jne 0x411d71
and dword [ebp - 0x3c], 0
mov ebx, vtable.CPalette.0
mov dword [ebp - 0x40], ebx
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
call fcn.004113b5
push 0
push dword [ebp - 0x3c]
push dword [ebp - 0x38]
call fcn.004067ee
or dword [ebp - 4], 0xffffffff
add esp, 0x10
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], ebx
call fcn.00402e97
cmp dword [ebp + 0x314], 2
mov edx, 0x100
jne 0x411e08
xor ecx, ecx
mov eax, ecx
and eax, edi
imul eax, eax, 0xff
add eax, 0x60
xor edx, edx
mov ebx, edi
div ebx
xor edx, edx
mov ebx, esi
mov byte [ebp + ecx], al
mov eax, ecx
and eax, 0x38
imul eax, eax, 0x3fc
add eax, 0x70
div ebx
xor edx, edx
mov ebx, edi
mov byte [ebp + ecx + 0x200], al
mov eax, ecx
and eax, 6
imul eax, eax, 0x1fe0
add eax, 0x60
div ebx
inc ecx
mov edx, 0x100
mov byte [ebp + ecx + 0xff], al
cmp ecx, edx
jb 0x411d85
mov ecx, dword [ebp - 0x38]
mov eax, dword [ecx]
add eax, ecx
xor ecx, ecx
inc eax
mov bl, byte [ebp + ecx]
mov byte [eax + 1], bl
mov bl, byte [ebp + ecx + 0x200]
mov byte [eax], bl
mov bl, byte [ebp + ecx + 0x100]
mov byte [eax - 1], bl
inc ecx
add eax, 4
cmp ecx, edx
jb 0x411de6
push 3
pop eax
cmp dword [ebp + 0x314], eax
jne 0x411ead
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], 6
xor ecx, ecx
mov eax, ecx
and eax, esi
imul eax, eax, 0xff
add eax, 0x70
xor edx, edx
mov ebx, esi
div ebx
xor edx, edx
mov byte [ebp + ecx], al
mov eax, ecx
and eax, 0x1c
imul eax, eax, 0x7f8
add eax, 0x70
div ebx
xor edx, edx
mov ebx, edi
mov byte [ebp + ecx + 0x200], al
mov eax, ecx
and eax, 3
imul eax, eax, 0x3fc0
add eax, 0x60
div ebx
inc ecx
mov edx, 0x100
mov byte [ebp + ecx + 0xff], al
cmp ecx, edx
jb 0x411e2c
mov ecx, dword [ebp - 0x38]
mov eax, dword [ecx]
add eax, ecx
xor ecx, ecx
inc eax
mov bl, byte [ebp + ecx]
mov byte [eax + 1], bl
mov bl, byte [ebp + ecx + 0x200]
mov byte [eax], bl
mov bl, byte [ebp + ecx + 0x100]
mov byte [eax - 1], bl
inc ecx
add eax, 4
cmp ecx, edx
jb 0x411e8b
cmp dword [ebp + 0x314], 4
mov eax, 0x80
jne 0x411f5b
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], 2
xor ecx, ecx
mov ebx, ecx
and ebx, eax
imul ebx, ebx, 0xff
add ebx, 0x40
shr ebx, 7
mov byte [ebp + ecx], bl
mov ebx, ecx
and ebx, 0x40
imul ebx, ebx, 0x1fe
add ebx, 0x40
shr ebx, 7
mov byte [ebp + ecx + 0x200], bl
mov ebx, ecx
and ebx, 0x20
imul ebx, ebx, 0x3fc
add ebx, 0x40
shr ebx, 7
mov byte [ebp + ecx + 0x100], bl
inc ecx
cmp ecx, edx
jb 0x411ed8
mov ebx, dword [ebp - 0x38]
mov ecx, dword [ebx]
and dword [ebp - 0x10], 0
add ecx, ebx
inc ecx
mov ebx, dword [ebp - 0x10]
mov bl, byte [ebp + ebx]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 0x10]
mov bl, byte [ebp + ebx + 0x200]
mov byte [ecx], bl
mov ebx, dword [ebp - 0x10]
mov bl, byte [ebp + ebx + 0x100]
inc dword [ebp - 0x10]
mov byte [ecx - 1], bl
add ecx, 4
cmp dword [ebp - 0x10], edx
jb 0x411f2d
cmp dword [ebp + 0x314], 5
jne 0x411fde
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x54], 3
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], 6
xor ecx, ecx
cmp ecx, eax
jae 0x411f98
mov byte [ebp + ecx + 0x100], 0
mov byte [ebp + ecx + 0x200], 0
mov byte [ebp + ecx], 0
jmp 0x411fad
mov byte [ebp + ecx + 0x100], 0xff
mov byte [ebp + ecx + 0x200], 0xff
mov byte [ebp + ecx], 0xff
inc ecx
cmp ecx, edx
jb 0x411f7d
mov ecx, dword [ebp - 0x38]
mov eax, dword [ecx]
add eax, ecx
xor esi, esi
inc eax
mov cl, byte [ebp + esi]
mov byte [eax + 1], cl
mov cl, byte [ebp + esi + 0x200]
mov byte [eax], cl
mov cl, byte [ebp + esi + 0x100]
mov byte [eax - 1], cl
inc esi
add eax, 4
cmp esi, edx
jb 0x411fbc
mov ecx, dword [ebp - 0x50]
mov eax, dword [ecx]
add eax, ecx
cmp dword [ebp + 0x314], 1
mov dword [ebp - 0x34], eax
je 0x41204a
call fcn.0040ae8e
mov esi, dword [ebp - 0x44]
shl esi, 2
push esi
call fcn.00462114
push esi
mov dword [ebp - 0x28], eax
call fcn.00462114
cmp dword [ebp - 0x28], 0
pop ecx
pop ecx
mov dword [ebp - 0x3c], eax
je 0x411cb7
test eax, eax
je 0x411cb7
mov ebx, dword [ebp - 0x58]
cmp dword [ebp + 0x314], 2
jl 0x41267c
mov eax, dword [ebp - 0x50]
cmp dword [eax + 0x10], 3
jne 0x41224c
mov ecx, dword [eax]
lea edi, [ecx + eax + 0xc]
jmp 0x412256
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x4c], 0
jle 0x41267c
mov ebx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x38]
mov edx, ecx
cmp dword [edx + 0x10], 3
jne 0x41206e
mov ecx, dword [edx]
lea ecx, [ecx + edx + 0xc]
jmp 0x412078
mov ecx, dword [edx + 0x20]
mov esi, dword [edx]
lea ecx, [esi + ecx*4]
add ecx, edx
movzx edi, word [edx + 0xe]
imul edi, dword [edx + 4]
add edi, 0x1f
shr edi, 3
and edi, 0x1ffffffc
imul edi, dword [ebp - 0x10]
add edi, ecx
cmp dword [eax + 0x10], 3
jne 0x4120a0
mov ecx, dword [eax]
lea ecx, [ecx + eax + 0xc]
jmp 0x4120aa
mov ecx, dword [eax + 0x20]
mov esi, dword [eax]
lea ecx, [esi + ecx*4]
add ecx, eax
movzx esi, word [eax + 0xe]
imul esi, dword [eax + 4]
add esi, 0x1f
shr esi, 3
and esi, 0x1ffffffc
imul esi, dword [ebp - 0x10]
add esi, ecx
xor ecx, ecx
cmp dword [ebp - 0x24], ecx
mov dword [ebp - 0x3c], ecx
jle 0x412238
lea eax, [edi + 1]
mov dword [ebp - 0x28], edi
sub dword [ebp - 0x28], esi
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x6c]
dec edx
je 0x41214f
sub edx, 3
je 0x412122
sub edx, 4
je 0x41210a
sub edx, 0x10
jne 0x412197
movzx edx, byte [eax]
movzx ebx, byte [eax + 1]
movzx eax, byte [eax - 1]
mov dword [ebp - 0x1c], edx
jmp 0x412194
mov eax, dword [ebp - 0x28]
add eax, ecx
movzx eax, byte [eax + esi]
mov edx, dword [ebp - 0x34]
lea eax, [edx + eax*4]
movzx edx, byte [eax + 1]
mov dword [ebp - 0x1c], edx
jmp 0x41218d
mov eax, ecx
and eax, 0x80000001
jns 0x412130
dec eax
or eax, 0xfffffffe
inc eax
mov eax, ecx
cdq
jne 0x412141
sub eax, edx
sar eax, 1
mov al, byte [eax + edi]
shr al, 4
jmp 0x41214a
sub eax, edx
sar eax, 1
mov al, byte [eax + edi]
and al, 0xf
movzx eax, al
jmp 0x412113
mov eax, dword [ebp - 0x3c]
mov edx, eax
and edx, reloc.OLEAUT32.dll_VariantInit
jns 0x412161
dec edx
or edx, 0xfffffff8
inc edx
push 7
pop ecx
sub ecx, edx
cdq
mov bl, 1
and edx, 7
shl bl, cl
add eax, edx
sar eax, 3
and bl, byte [eax + edi]
je 0x41217a
mov bl, 1
mov ecx, dword [ebp - 0x34]
movzx eax, bl
lea eax, [ecx + eax*4]
movzx ecx, byte [eax + 1]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x3c]
movzx ebx, byte [eax + 2]
movzx eax, byte [eax]
mov dword [ebp - 0x18], eax
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x4121a4
dec ecx
or ecx, 0xfffffff8
inc ecx
mov eax, dword [ebp - 0x10]
and eax, reloc.OLEAUT32.dll_VariantInit
jns 0x4121b3
dec eax
or eax, 0xfffffff8
inc eax
mov al, byte [eax + ecx*8 + 0x49e4c8]
mov ecx, dword [ebp - 0x18]
cmp byte [ecx + 0x49e3b8], al
movzx ecx, cl
seta dl
add dl, byte [ecx + 0x49e2b8]
mov ecx, dword [ebp - 0x1c]
cmp byte [ecx + 0x49e3b8], al
mov byte [ebp - 0x45], al
seta al
movzx ecx, cl
add al, byte [ecx + 0x49e2b8]
movzx edx, dl
mov cl, byte [edx + 0x49e4c0]
movzx eax, al
add cl, byte [eax + 0x49e4b8]
mov al, byte [ebp - 0x45]
cmp byte [ebx + 0x49e3b8], al
seta al
add cl, al
add cl, byte [ebx + 0x49e2b8]
movzx eax, cl
mov al, byte [eax + 0x49e528]
mov ecx, dword [ebp - 0x3c]
mov byte [ecx + esi], al
mov eax, dword [ebp - 0x20]
inc ecx
add eax, 3
cmp ecx, dword [ebp - 0x24]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x20], eax
jl 0x4120de
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x38]
inc dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x4c]
jl 0x412060
jmp 0x412025
mov ecx, dword [eax + 0x20]
mov edx, dword [eax]
lea edi, [edx + ecx*4]
add edi, eax
mov esi, dword [ebp - 0x3c]
xor edx, edx
cmp dword [ebp - 0x24], edx
mov dword [ebp - 0x14], edx
jle 0x41234c
lea ecx, [edi + 1]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x6c]
dec eax
je 0x4122d9
sub eax, 3
je 0x4122ac
sub eax, 4
je 0x412299
sub eax, 0x10
jne 0x412321
movzx eax, byte [ecx]
movzx ebx, byte [ecx + 1]
mov dword [ebp - 0x1c], eax
movzx eax, byte [ecx - 1]
jmp 0x41231e
movzx eax, byte [edx + edi]
mov edx, dword [ebp - 0x34]
lea eax, [edx + eax*4]
movzx edx, byte [eax + 1]
mov dword [ebp - 0x1c], edx
jmp 0x412317
and edx, 0x80000001
jns 0x4122b9
dec edx
or edx, 0xfffffffe
inc edx
mov eax, dword [ebp - 0x14]
cdq
jne 0x4122cb
sub eax, edx
sar eax, 1
mov al, byte [eax + edi]
shr al, 4
jmp 0x4122d4
sub eax, edx
sar eax, 1
mov al, byte [eax + edi]
and al, 0xf
movzx eax, al
jmp 0x41229d
mov eax, dword [ebp - 0x14]
mov edx, eax
and edx, reloc.OLEAUT32.dll_VariantInit
jns 0x4122eb
dec edx
or edx, 0xfffffff8
inc edx
push 7
pop ecx
sub ecx, edx
cdq
mov bl, 1
and edx, 7
shl bl, cl
add eax, edx
sar eax, 3
and bl, byte [eax + edi]
je 0x412304
mov bl, 1
mov ecx, dword [ebp - 0x34]
movzx eax, bl
lea eax, [ecx + eax*4]
movzx ecx, byte [eax + 1]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x20]
movzx ebx, byte [eax + 2]
movzx eax, byte [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov dword [esi], ebx
add esi, 4
mov dword [esi], eax
mov eax, dword [ebp - 0x18]
add esi, 4
mov dword [esi], eax
add esi, 4
inc edx
add ecx, 3
cmp edx, dword [ebp - 0x24]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x20], ecx
jl 0x41226d
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x4c], 0
jle 0x41267c
mov eax, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x3c], edi
cmp edx, eax
je 0x4124a1
mov eax, dword [ebp - 0x50]
cmp dword [eax + 0x10], 3
jne 0x412386
mov ecx, dword [eax]
lea ecx, [ecx + eax + 0xc]
jmp 0x412390
mov ecx, dword [eax + 0x20]
mov esi, dword [eax]
lea ecx, [esi + ecx*4]
add ecx, eax
movzx esi, word [eax + 0xe]
imul esi, dword [eax + 4]
and dword [ebp - 0x14], 0
add esi, 0x1f
shr esi, 3
and esi, 0x1ffffffc
inc edx
imul esi, edx
add esi, ecx
cmp dword [ebp - 0x24], 0
jle 0x4124a1
lea ecx, [esi + 1]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x6c]
dec eax
je 0x41242f
sub eax, 3
je 0x412400
sub eax, 4
je 0x4123ea
sub eax, 0x10
jne 0x412477
movzx eax, byte [ecx]
movzx ebx, byte [ecx + 1]
mov dword [ebp - 0x1c], eax
movzx eax, byte [ecx - 1]
jmp 0x412474
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + esi]
mov edx, dword [ebp - 0x34]
lea eax, [edx + eax*4]
movzx edx, byte [eax + 1]
mov dword [ebp - 0x1c], edx
jmp 0x41246d
mov eax, dword [ebp - 0x14]
and eax, 0x80000001
jns 0x41240f
dec eax
or eax, 0xfffffffe
inc eax
mov eax, dword [ebp - 0x14]
cdq
jne 0x412421
sub eax, edx
sar eax, 1
mov al, byte [eax + esi]
shr al, 4
jmp 0x41242a
sub eax, edx
sar eax, 1
mov al, byte [eax + esi]
and al, 0xf
movzx eax, al
jmp 0x4123f1
mov eax, dword [ebp - 0x14]
mov edx, eax
and edx, reloc.OLEAUT32.dll_VariantInit
jns 0x412441
dec edx
or edx, 0xfffffff8
inc edx
push 7
pop ecx
sub ecx, edx
cdq
mov bl, 1
and edx, 7
shl bl, cl
add eax, edx
sar eax, 3
and bl, byte [eax + esi]
je 0x41245a
mov bl, 1
mov ecx, dword [ebp - 0x34]
movzx eax, bl
lea eax, [ecx + eax*4]
movzx ecx, byte [eax + 1]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x2c]
movzx ebx, byte [eax + 2]
movzx eax, byte [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
mov dword [edi], ebx
add edi, 4
mov dword [edi], eax
mov eax, dword [ebp - 0x18]
add edi, 4
mov dword [edi], eax
add edi, 4
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
add ecx, 3
cmp eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
jl 0x4123be
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x10], 3
jne 0x4124b2
mov ecx, dword [eax]
lea ecx, [ecx + eax + 0xc]
jmp 0x4124bc
mov ecx, dword [eax + 0x20]
mov edx, dword [eax]
lea ecx, [edx + ecx*4]
add ecx, eax
movzx esi, word [eax + 0xe]
imul esi, dword [eax + 4]
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x28]
add esi, 0x1f
shr esi, 3
and esi, 0x1ffffffc
imul esi, dword [ebp - 0x20]
add esi, ecx
cmp dword [ebp - 0x24], 0
jle 0x41266d
mov edx, dword [ebp - 0x3c]
add edx, 8
mov ecx, dword [eax]
add eax, 4
mov edi, dword [eax]
add eax, 4
mov dword [ebp - 0x14], edi
mov edi, dword [eax]
mov dword [ebp - 0x30], edi
add eax, 4
xor edi, edi
cmp ecx, edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x44], eax
jge 0x412511
mov dword [ebp - 0x10], edi
mov eax, 0xff
cmp dword [ebp - 0x10], eax
jle 0x41251e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], edi
jge 0x412526
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], eax
jle 0x41252e
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x30], edi
jge 0x412536
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x30], eax
jle 0x41253e
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
and eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x60]
mov edi, dword [ebp - 0x14]
and edi, dword [ebp - 0x68]
sar eax, cl
mov ecx, dword [ebp - 0x54]
sar edi, cl
mov ecx, dword [ebp - 0x10]
and ecx, dword [ebp - 0x5c]
or eax, edi
or eax, ecx
movzx ecx, byte [ebp + eax]
mov edi, 0x100
sub edi, ecx
movzx ecx, byte [ebp + eax + 0x200]
add dword [ebp - 0x10], edi
mov byte [esi], al
movzx eax, byte [ebp + eax + 0x100]
mov edi, 0x100
sub edi, ecx
add dword [ebp - 0x14], edi
mov ecx, 0x100
sub ecx, eax
add dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x24]
dec eax
cmp dword [ebp - 0x2c], eax
je 0x4125c7
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax*4 + 0x4a69f0]
mov eax, dword [ebp - 0x44]
add dword [eax], ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx*4 + 0x4a69f0]
add dword [eax + 4], ecx
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ecx*4 + 0x4a69f0]
add dword [eax + 8], ecx
jmp 0x4125ca
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x4c]
dec ecx
cmp dword [ebp - 0x20], ecx
je 0x41265d
mov ecx, dword [ebp - 0x10]
shl ecx, 2
mov edi, dword [ecx + 0x4a71f0]
add dword [edx - 8], edi
mov edi, dword [ebp - 0x14]
shl edi, 2
mov dword [ebp - 0x44], edi
mov edi, dword [edi + 0x4a71f0]
add dword [edx - 4], edi
mov edi, dword [ebp - 0x30]
shl edi, 2
mov dword [ebp - 0x10], edi
mov edi, dword [edi + 0x4a71f0]
add dword [edx], edi
cmp dword [ebp - 0x2c], 0
jle 0x412630
mov edi, dword [ecx + 0x4a79f0]
add dword [edx - 0x14], edi
mov edi, dword [ebp - 0x44]
mov edi, dword [edi + 0x4a79f0]
add dword [edx - 0x10], edi
mov edi, dword [ebp - 0x10]
mov edi, dword [edi + 0x4a79f0]
add dword [edx - 0xc], edi
mov edi, dword [ebp - 0x24]
dec edi
cmp dword [ebp - 0x2c], edi
je 0x41265a
mov ecx, dword [ecx + 0x4a81f0]
add dword [edx + 4], ecx
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx + 0x4a81f0]
add dword [edx + 8], ecx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x4a81f0]
add dword [edx + 0xc], ecx
add edx, 0xc
inc dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
inc esi
cmp dword [ebp - 0x2c], ecx
jl 0x4124ed
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x4c]
jl 0x41235a
push dword [ebp - 0x70]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call esi
push dword [ebp - 0x58]
call esi
cmp dword [ebp + 0x314], 1
je 0x4126a7
push dword [ebp - 0x28]
call fcn.00461ccb
push dword [ebp - 0x3c]
call fcn.00461ccb
pop ecx
pop ecx
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x300]
xor ecx, ebp
call fcn.00461b8a
add ebp, 0x304
leave
ret