Function at 0x412f20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x5c
push ebx
push ebp
push esi
mov esi, ecx
lea eax, [esp + 0x58]
push edi
mov ecx, dword [esi + 0x20]
push eax
push ecx
mov dword [esp + 0x28], esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [esp + 0x68]
mov edx, dword [esp + 0x60]
mov edi, dword [esp + 0x64]
mov ecx, dword [esp + 0x5c]
sub ebx, edx
sub edi, ecx
movsx edx, word [esi + 0x1f4]
shl edx, 1
mov eax, edi
mov dword [esp + 0x10], ebx
sub eax, edx
dec eax
cmp eax, 1
jge 0x412f6c
mov eax, 1
push 8
lea ecx, [esi + 0x12c]
push 1
push eax
mov dword [esp + 0x54], ecx
call fcn.00411ff0
movsx ecx, word [esi + 0x1f4]
shl ecx, 1
mov eax, ebx
sub eax, ecx
cmp eax, 1
jge 0x412f97
mov eax, 1
push 8
lea ecx, [esi + 0x160]
push eax
push 1
mov dword [esp + 0x58], ecx
call fcn.00411ff0
push 8
lea ecx, [esi + 0x5c]
push ebx
push edi
mov dword [esp + 0x50], ecx
call fcn.00411ff0
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
push 0x14
call esi
push 0xf
mov dword [esp + 0x44], eax
call esi
push 0x10
mov ebx, eax
call esi
mov ecx, ebx
mov esi, eax
and ecx, 0xff
and esi, 0xff
mov dword [esp + 0x3c], ecx
xor ecx, ecx
mov cl, ah
xor edx, edx
mov ebp, ecx
xor ecx, ecx
mov cl, bh
and ebp, 0xff
shr eax, 0x10
and ecx, 0xff
and eax, 0xff
mov dword [esp + 0x38], ecx
mov ecx, eax
neg ecx
mov dword [esp + 0x58], ecx
mov ecx, ebp
neg ecx
mov dword [esp + 0x54], ecx
mov ecx, esi
shr ebx, 0x10
and ebx, 0xff
mov dword [esp + 0x14], edx
neg ecx
shl eax, 7
shl ebp, 7
shl esi, 7
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x18], esi
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
add eax, edx
mov ecx, dword [esp + 0x28]
cdq
and edx, 0x7f
add eax, edx
mov edx, dword [esp + 0x1c]
mov esi, eax
lea eax, [ecx + edx]
mov ecx, dword [esp + 0x30]
cdq
and edx, 0x7f
add eax, edx
mov ebp, eax
mov eax, dword [esp + 0x2c]
add eax, ecx
mov ecx, dword [esp + 0x44]
cdq
and edx, 0x7f
add eax, edx
mov edx, dword [esp + 0x14]
mov ebx, eax
sar ebx, 7
sar ebp, 7
sar esi, 7
push ebx
push ebp
push esi
push edx
call fcn.00412150
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x48]
push ebx
push ebp
push esi
push eax
call fcn.00412150
mov ecx, dword [esp + 0x4c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push esi
call fcn.00412150
mov ecx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
add ebp, ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x24], ebp
mov ebp, dword [esp + 0x28]
add ecx, eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x54]
add ebx, edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x2c]
add ebp, ecx
mov ecx, dword [esp + 0x30]
inc esi
add ebx, edx
add ecx, eax
cmp esi, 0x81
mov dword [esp + 0x14], esi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ecx
jl 0x413055
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x34]
xor edx, edx
mov ecx, eax
mov dl, ah
and ecx, 0xff
shr eax, 0x10
and eax, 0xff
and edx, 0xff
mov dword [esp + 0x44], eax
mov dword [esp + 0x18], eax
mov eax, esi
mov dword [esp + 0x54], edx
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x38]
neg eax
mov dword [esp + 0x48], eax
mov eax, edx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x14], 1
neg eax
mov dword [esp + 0x4c], eax
mov eax, ecx
neg eax
mov dword [esp + 0x50], eax
mov eax, esi
shl eax, 7
sub eax, esi
mov dword [esp + 0x1c], eax
mov eax, edx
shl eax, 7
sub eax, edx
mov dword [esp + 0x24], eax
mov eax, ecx
shl eax, 7
sub eax, ecx
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
lea eax, [ecx + edx]
mov ecx, dword [esp + 0x2c]
cdq
and edx, 0x7f
add eax, edx
mov esi, eax
mov eax, dword [esp + 0x24]
add eax, ecx
mov ecx, dword [esp + 0x20]
cdq
and edx, 0x7f
add ecx, 0x5c
add eax, edx
mov edx, dword [esp + 0x1c]
mov ebp, eax
mov eax, dword [esp + 0x18]
add eax, edx
cdq
and edx, 0x7f
add eax, edx
mov ebx, eax
mov al, byte [esp + 0x14]
sar ebx, 7
sar ebp, 7
sar esi, 7
push ebx
add al, 0x7f
push ebp
push esi
push eax
mov byte [esp + 0x4c], al
call fcn.00412150
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x3c]
push ebx
push ebp
push esi
push edx
lea ecx, [eax + 0x12c]
call fcn.00412150
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x20]
push ebx
push ebp
push esi
push ecx
lea ecx, [edx + 0x160]
call fcn.00412150
mov ecx, dword [esp + 0x58]
mov ebx, dword [esp + 0x30]
mov edx, dword [esp + 0x54]
mov esi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
add ebx, ecx
mov ecx, dword [esp + 0x50]
add esi, edx
mov edx, dword [esp + 0x28]
add edx, ecx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x2c], esi
mov esi, dword [esp + 0x18]
add ebp, edx
mov edx, dword [esp + 0x44]
inc eax
add ebx, ecx
add esi, edx
cmp eax, 0x81
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], esi
jl 0x4131b0
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov esi, dword [esp + 0x20]
and eax, 0xff
push eax
push ecx
lea ecx, [esi + 0x5c]
call fcn.004121f0
lea ecx, [esi + 0x12c]
call fcn.00411fd0
mov edx, dword [esi + 0x134]
xor ecx, ecx
test edx, edx
mov ebp, eax
jle 0x4132ef
mov eax, ecx
and eax, 0x80000001
jns 0x4132e5
dec eax
or eax, 0xfffffffe
inc eax
neg al
mov byte [ecx + ebp], al
inc ecx
cmp ecx, edx
jl 0x4132d7
lea ecx, [esi + 0x160]
call fcn.00411fd0
mov ebp, dword [esi + 0x16c]
xor ecx, ecx
test ebp, ebp
jle 0x413321
mov edx, ecx
and edx, 0x80000001
jns 0x413315
dec edx
or edx, 0xfffffffe
inc edx
neg dl
mov byte [eax], dl
add eax, 4
inc ecx
cmp ecx, ebp
jl 0x413306
mov eax, dword [esi + 0x88]
lea ebx, [esi + 0x5c]
mov ecx, ebx
mov dword [esp + 0x80], eax
call fcn.00411fd0
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x14], eax
and ecx, 0xff
mov esi, eax
mov dword [esp + 0x1c], ecx
mov ebp, 1
lea eax, [ecx + ecx]
cmp eax, 1
jl 0x41335b
mov ebp, eax
mov eax, 0x7fff
cdq
idiv ebp
mov edx, dword [esp + 0x70]
mov dword [esp + 0x7c], eax
mov eax, 0xff
sub eax, ecx
dec edx
cmp edx, 7
mov dword [esp + 0x28], eax
ja case.default.0x413380
jmp dword [edx*4 + 0x413c0c]
push 0
mov ecx, ebx
call fcn.00412360
mov eax, 0x7fff
mov dword [esp + 0x38], 0xc8
cdq
idiv edi
mov dword [esp + 0x58], eax
mov eax, 0x7fff
cdq
idiv dword [esp + 0x10]
mov dword [esp + 0x54], eax
mov esi, dword [sym.imp.MSVCRT.dll_rand]
call esi
cdq
idiv dword [esp + 0x58]
mov dword [esp + 0x24], eax
call esi
cdq
idiv dword [esp + 0x54]
mov ebp, dword [esp + 0x10]
cmp edi, ebp
mov esi, eax
jge 0x4133d6
mov ebp, edi
mov ebx, dword [sym.imp.MSVCRT.dll_rand]
call ebx
mov ecx, eax
mov eax, 0x7fff
cdq
idiv ebp
mov ebp, eax
mov eax, ecx
cdq
idiv ebp
cdq
sub eax, edx
mov ebp, eax
sar ebp, 1
call ebx
mov ecx, eax
mov eax, 0xa00a00a1
imul ecx
add edx, ecx
xor ebx, ebx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
test ebp, ebp
mov dword [esp + 0x70], edx
jle 0x41348d
mov eax, dword [esp + 0x24]
mov dword [esp + 0x74], esi
sub eax, esi
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x3c]
lea eax, [ecx + esi]
test eax, eax
jle 0x41344f
mov edx, dword [esp + 0x74]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
jge 0x41344f
mov ecx, dword [esp + 0x70]
push ecx
push edx
push eax
mov eax, dword [esp + 0x2c]
lea ecx, [eax + 0x5c]
call fcn.004121a0
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x74]
add ecx, edx
cmp ecx, edi
jge 0x41347e
test esi, esi
jle 0x41347e
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
mov ecx, ebx
push esi
sub ecx, eax
add ecx, edi
push ecx
lea ecx, [edx + 0x5c]
call fcn.004121a0
mov edx, dword [esp + 0x74]
inc ebx
inc edx
dec esi
cmp ebx, ebp
mov dword [esp + 0x74], edx
jl 0x413425
mov eax, dword [esp + 0x38]
dec eax
mov dword [esp + 0x38], eax
jne 0x4133b2
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
sub eax, edx
mov ecx, dword [esp + 0x10]
sub eax, 0x28
mov ebp, dword [esp + 0x14]
cdq
sub eax, edx
sar eax, 1
test ecx, ecx
mov dword [esp + 0x18], eax
jle 0x413bbd
mov dword [esp + 0x74], 0
mov dword [esp + 0x3c], ecx
xor esi, esi
test edi, edi
jle 0x413525
mov eax, dword [esp + 0x74]
mov ebx, dword [esp + 0x18]
cdq
idiv dword [esp + 0x10]
mov dword [esp + 0x70], eax
mov eax, ebx
neg eax
imul ebx, edi
mov dword [esp + 0x58], eax
mov eax, ebx
mov cl, byte [esp + 0x70]
cdq
idiv edi
mov dl, byte [esi + ebp]
add al, cl
add dl, al
mov byte [esi + ebp], dl
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [esp + 0x7c]
mov cl, byte [esi + ebp]
add cl, al
mov byte [esi + ebp], cl
mov ecx, dword [esp + 0x58]
inc esi
add ebx, ecx
cmp esi, edi
jl 0x4134f0
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x80]
mov edx, dword [esp + 0x74]
mov ecx, dword [esp + 0x3c]
add ebp, esi
add edx, eax
dec ecx
mov dword [esp + 0x74], edx
mov dword [esp + 0x3c], ecx
jne 0x4134ce
jmp 0x413bbd
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x413600
mov ecx, dword [esp + 0x1c]
mov eax, 0x40
sub eax, ecx
mov dword [esp + 0x70], 0
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x70]
xor ebp, ebp
cdq
idiv dword [esp + 0x10]
mov ecx, eax
sub ecx, 0x7f
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
imul eax, dword [esp + 0x58]
shl eax, 1
cdq
and edx, 0x7f
add eax, edx
mov ebx, eax
sar ebx, 7
add ebx, 0x80
test edi, edi
jle 0x4135da
mov byte [esi + ebp], bl
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [esp + 0x7c]
mov cl, byte [esp + 0x74]
mov dl, byte [esi + ebp]
sub al, cl
add dl, al
mov byte [esi + ebp], dl
inc ebp
cmp ebp, edi
jl 0x4135b9
mov edx, dword [esp + 0x80]
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x3c]
add esi, edx
add ecx, 0xff
dec eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0x3c], eax
jne 0x413573
mov eax, 0x2aaaaaab
mov dword [esp + 0x70], 0x10
imul edi
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
cmp edx, 0x10
jg 0x41361f
mov dword [esp + 0x70], edx
mov esi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov eax, esi
xor ecx, ecx
imul eax, esi
cdq
and edx, 3
mov dword [esp + 0x14], ecx
add eax, edx
sar eax, 2
test esi, esi
mov dword [esp + 0x18], eax
jle 0x413bbd
mov eax, esi
mov esi, dword [esp + 0x70]
cdq
sub eax, edx
mov dword [esp + 0x2c], ecx
sar eax, 1
imul esi, eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x58], esi
jmp 0x413667
mov esi, dword [esp + 0x58]
mov edx, dword [esp + 0x2c]
mov ebx, ecx
sub edx, esi
sub ebx, eax
xor esi, esi
mov dword [esp + 0x54], edx
test edi, edi
jle 0x41372d
mov eax, edi
mov dword [esp + 0x30], esi
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x54]
imul eax, ebx
cdq
idiv dword [esp + 0x18]
mov edx, dword [esp + 0x70]
mov ebx, edi
sar ecx, 1
mov dword [esp + 0x50], ecx
sub eax, edx
add eax, ecx
mov dword [esp + 0x3c], eax
shl ebx, 7
jmp 0x4136b7
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x3c]
mov edx, esi
sub edx, ecx
cmp edx, eax
mov dword [esp + 0x24], edx
jle 0x4136db
mov eax, ebx
mov cl, byte [esp + 0x1c]
cdq
idiv dword [esp + 0x70]
mov edx, dword [esp + 0x24]
add al, cl
mov byte [esi + ebp], al
mov eax, dword [esp + 0x3c]
add eax, edx
test eax, eax
jge 0x4136f3
mov eax, dword [esp + 0x30]
cdq
idiv dword [esp + 0x70]
mov dl, byte [esp + 0x28]
sub dl, al
mov byte [esi + ebp], dl
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [esp + 0x7c]
mov dl, byte [esp + 0x74]
mov cl, byte [esi + ebp]
sub ebx, 0x80
sub al, dl
add cl, al
mov byte [esi + ebp], cl
mov ecx, dword [esp + 0x30]
inc esi
add ecx, 0x80
cmp esi, edi
mov dword [esp + 0x30], ecx
jl 0x4136af
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x80]
mov esi, dword [esp + 0x2c]
add ebp, edx
mov edx, dword [esp + 0x70]
add esi, edx
mov edx, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x2c], esi
cmp ecx, edx
mov dword [esp + 0x14], ecx
jl 0x413663
jmp 0x413bbd
mov ebx, dword [esp + 0x10]
test ebx, ebx
jle 0x413bbd
mov dword [esp + 0x70], 0
mov dword [esp + 0x3c], ebx
mov eax, dword [esp + 0x70]
xor ebp, ebp
cdq
idiv ebx
mov ecx, eax
sub ecx, 0x7f
test edi, edi
jle 0x413838
mov eax, ecx
mov ebx, edi
imul eax, ecx
imul eax, ecx
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
cdq
and edx, 0x7f
add eax, edx
mov edx, dword [esp + 0x1c]
sar eax, 7
mov dword [esp + 0x58], eax
mov eax, 0x80
sub eax, edx
shl ebx, 8
mov dword [esp + 0x18], eax
sub ebx, edi
mov eax, ebx
cdq
idiv edi
mov ecx, eax
sub ecx, 0x7f
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
and edx, 0x7f
mov ecx, dword [esp + 0x1c]
add eax, edx
sar eax, 7
cdq
and edx, 0x7f
add eax, edx
mov edx, dword [esp + 0x58]
sar eax, 7
add eax, edx
imul eax, dword [esp + 0x18]
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
add eax, 0x80
cmp eax, ecx
jge 0x413803
mov eax, ecx
mov ecx, dword [esp + 0x28]
cmp eax, ecx
jle 0x41380d
mov eax, ecx
mov byte [esi + ebp], al
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [esp + 0x7c]
mov dl, byte [esp + 0x74]
mov cl, byte [esi + ebp]
sub ebx, 0xff
sub al, dl
add cl, al
mov byte [esi + ebp], cl
inc ebp
cmp ebp, edi
jl 0x4137bc
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0x80]
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x3c]
add esi, edx
add ecx, 0xff
dec eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0x3c], eax
jne 0x413772
jmp 0x413bbd
test edi, edi
mov dword [esp + 0x70], 0
jle 0x413bbd
mov esi, edi
mov ebp, 0x80
shl esi, 8
sub ebp, ecx
sub esi, edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x3c], esi
mov eax, esi
cdq
idiv edi
mov ecx, eax
sub ecx, 0x7f
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
imul eax, ebp
cdq
and edx, 0x7f
add eax, edx
mov ebx, eax
mov eax, dword [esp + 0x10]
sar ebx, 7
add ebx, 0x80
test eax, eax
jle 0x413905
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
lea esi, [eax + ecx]
mov byte [esi], bl
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [esp + 0x7c]
mov cl, byte [esp + 0x74]
mov dl, byte [esi]
sub al, cl
mov ecx, dword [esp + 0x80]
add dl, al
mov byte [esi], dl
add esi, ecx
dec ebp
jne 0x4138d8
mov esi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x70]
sub esi, 0xff
inc eax
mov dword [esp + 0x3c], esi
cmp eax, edi
mov dword [esp + 0x70], eax
jl 0x413889
jmp 0x413bbd
mov edx, dword [esp + 0x10]
test edx, edx
jle 0x413bbd
mov eax, 0x80
mov dword [esp + 0x70], 0
sub eax, ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x70]
xor ebp, ebp
cdq
idiv dword [esp + 0x10]
mov ecx, eax
sub ecx, 0x7f
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
imul eax, dword [esp + 0x18]
cdq
and edx, 0x7f
add eax, edx
mov ebx, eax
sar ebx, 7
add ebx, 0x80
test edi, edi
jle 0x4139ad
mov byte [esi + ebp], bl
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [esp + 0x7c]
mov cl, byte [esp + 0x74]
mov dl, byte [esi + ebp]
sub al, cl
add dl, al
mov byte [esi + ebp], dl
inc ebp
cmp ebp, edi
jl 0x41398c
mov edx, dword [esp + 0x80]
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x3c]
add esi, edx
add ecx, 0xff
dec eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0x3c], eax
jne 0x413948
jmp 0x413bbd
sub eax, ecx
mov ecx, dword [esp + 0x10]
cdq
sub eax, edx
sar eax, 1
test ecx, ecx
mov dword [esp + 0x18], eax
jle 0x413bbd
mov dword [esp + 0x30], 0
mov dword [esp + 0x3c], ecx
xor ebp, ebp
test edi, edi
jle 0x413a57
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x18]
cdq
idiv dword [esp + 0x10]
mov dword [esp + 0x70], eax
mov eax, ebx
neg eax
imul ebx, edi
mov dword [esp + 0x58], eax
mov eax, ebx
mov cl, byte [esp + 0x1c]
cdq
idiv edi
add al, byte [esp + 0x70]
add al, cl
mov byte [esi + ebp], al
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [esp + 0x7c]
mov dl, byte [esp + 0x74]
mov cl, byte [esi + ebp]
sub al, dl
add cl, al
mov byte [esi + ebp], cl
mov ecx, dword [esp + 0x58]
inc ebp
add ebx, ecx
cmp ebp, edi
jl 0x413a1d
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x80]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x3c]
add esi, ebx
add edx, eax
dec ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x3c], ecx
jne 0x4139fb
jmp 0x413bbd
sub eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x413bbd
mov dword [esp + 0x70], 0
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x1c]
cdq
idiv dword [esp + 0x10]
xor ebp, ebp
mov ebx, eax
add ebx, ecx
test edi, edi
jle 0x413ad0
mov byte [esi + ebp], bl
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [esp + 0x7c]
mov cl, byte [esp + 0x74]
mov dl, byte [esi + ebp]
sub al, cl
add dl, al
mov byte [esi + ebp], dl
inc ebp
cmp ebp, edi
jl 0x413aaf
mov edx, dword [esp + 0x80]
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x3c]
add esi, edx
mov edx, dword [esp + 0x18]
add ecx, edx
dec eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0x3c], eax
jne 0x413a98
jmp 0x413bbd
sub eax, ecx
mov dword [esp + 0x70], 0
test edi, edi
jle 0x413bbd
mov ecx, eax
neg ecx
imul eax, edi
mov dword [esp + 0x58], ecx
mov dword [esp + 0x3c], eax
cdq
idiv edi
mov edx, dword [esp + 0x1c]
mov ebx, eax
mov eax, dword [esp + 0x10]
add ebx, edx
test eax, eax
jle 0x413b63
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
lea esi, [eax + ecx]
mov byte [esi], bl
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [esp + 0x7c]
mov cl, byte [esp + 0x74]
mov dl, byte [esi]
sub al, cl
mov ecx, dword [esp + 0x80]
add dl, al
mov byte [esi], dl
add esi, ecx
dec ebp
jne 0x413b3a
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x3c]
inc edx
add eax, ecx
cmp edx, edi
mov dword [esp + 0x70], edx
mov dword [esp + 0x3c], eax
jl 0x413b18
jmp 0x413bbd
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x413bbd
mov ebx, dword [sym.imp.MSVCRT.dll_rand]
mov dword [esp + 0x70], eax
xor ebp, ebp
test edi, edi
jle 0x413ba9
call ebx
cdq
idiv dword [esp + 0x7c]
sub al, byte [esp + 0x74]
add al, 0x80
mov byte [esi + ebp], al
inc ebp
cmp ebp, edi
jl 0x413b94
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x70]
add esi, ecx
dec eax
mov dword [esp + 0x70], eax
jne 0x413b8e
mov ebx, dword [esp + 0x20]
lea edi, [ebx + 0x5c]
lea ecx, [ebx + 0xc4]
push edi
call fcn.00412320
lea esi, [ebx + 0xf8]
push edi
mov ecx, esi
call fcn.00412320
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x40]
and edx, 0xff
mov ecx, esi
push edx
push eax
call fcn.004121f0
push esi
lea ecx, [ebx + 0x90]
call fcn.00412320
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret 0x14