Function at 0x485840
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x8c
mov esi, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x38], eax
mov dword [eax + 0x2f4], 0
mov byte [eax + 0x2f0], 1
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x18]
xor edx, eax
lea eax, [ebp - 0x1c]
xor edx, eax
mov eax, edx
sar eax, 0xa
xor eax, edx
sar edx, 0x14
xor eax, edx
and eax, 0xffff
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x485894
mov dword [ebp - 0x14], 0x7384
mov edx, dword [ebp - 0x18]
mov ecx, dword [esi + 0x44]
mov dword [ebp - 0x44], ecx
lea eax, [edx + 0x50]
mov dword [edx + 0x114], eax
mov dword [ebp - 0x48], eax
lea eax, [edx + 0x118]
mov dword [edx + 0x2a4], eax
mov dword [ebp - 0x2c], eax
mov byte [esi + 0x40], 0
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov dword [edx + 0x118], eax
mov edi, dword [ebp + 8]
mov edx, eax
mov dword [ecx + 8], eax
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x18]
mov esi, dword [esi + 0x1c]
add edx, edi
mov dword [ebp - 0x40], esi
mov esi, dword [ebp - 0x44]
mov dword [ecx + 4], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x3c], eax
test esi, esi
je 0x485904
mov edx, dword [ebp - 0x44]
sub esp, 0xc
mov ebx, dword [edx]
push ebx
call dword [edx + 4]
add esp, 0x10
mov ecx, dword [ebp - 0x34]
cmp dword [ebp - 0x30], ecx
jae 0x48597b
lea esi, [esi]
mov eax, dword [ebp - 0x30]
mov cl, byte [eax]
inc eax
mov dword [ebp - 0x30], eax
cmp cl, 0x1f
seta dl
cmp cl, 0x1c
sete al
or eax, edx
test al, 1
je 0x485985
mov esi, 0x10
cmp cl, 0x1c
je 0x485a11
cmp cl, 0xf6
ja 0x4859b0
xor eax, eax
mov al, cl
lea edx, [eax - 0x8b]
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x48]
mov edi, dword [ebx + 0x114]
mov eax, edi
sub eax, ecx
sar eax, 2
cmp eax, 0x2f
jg 0x48720e
mov ecx, esi
lea eax, [edi + 4]
shl edx, cl
mov dword [edi], edx
mov dword [ebx + 0x114], eax
mov edx, dword [ebp - 0x34]
cmp dword [ebp - 0x30], edx
jb 0x485910
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebp - 0x18]
mov edi, dword [esi + 0x114]
mov eax, edi
sub eax, esi
lea ebx, [eax - 0x50]
xor eax, eax
sar ebx, 2
mov al, cl
mov dword [ebp - 0x50], ebx
cmp eax, 0x1f
ja case.0x4859a8.0
jmp dword [eax*4 + 0x65cb30]
cmp cl, 0xfa
jbe 0x4859ed
cmp cl, 0xff
je 0x485cda
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x30], eax
jae case.0x4859a8.0
xor eax, eax
mov edx, 0xfb
mov al, cl
mov ecx, dword [ebp - 0x30]
sub edx, eax
xor eax, eax
shl edx, 8
mov al, byte [ecx]
sub edx, eax
inc ecx
sub edx, 0x6c
mov dword [ebp - 0x30], ecx
jmp 0x485948
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x30], eax
jae case.0x4859a8.0
xor eax, eax
xor edx, edx
mov al, cl
mov ecx, dword [ebp - 0x30]
shl eax, 8
mov dl, byte [ecx]
inc ecx
lea edx, [eax + edx - 0xf694]
jmp 0x4859e5
mov eax, dword [ebp - 0x30]
inc eax
cmp eax, dword [ebp - 0x34]
jae case.0x4859a8.0
mov ecx, dword [ebp - 0x30]
xor edx, edx
xor eax, eax
mov dl, byte [ecx]
mov al, byte [ecx + 1]
shl edx, 8
add ecx, 2
or eax, edx
mov dword [ebp - 0x30], ecx
movsx edx, ax
jmp 0x485948
mov eax, dword [ebp - 0x50]
test eax, eax
jle 0x486fb3
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x485a77
mov eax, dword [ebp - 0x50]
mov esi, dword [ebp - 0x50]
and eax, 0xfffffffe
mov edx, dword [ebp - 0x44]
shl eax, 2
sub edi, eax
mov eax, dword [ebp - 0x50]
shr eax, 0x1f
push edi
add eax, esi
sar eax, 1
push eax
push 0
mov ebx, dword [edx]
push ebx
call dword [edx + 0xc]
add esp, 0x10
mov eax, dword [ebp - 0x50]
mov esi, dword [ebp - 0x18]
shr eax, 0x1f
mov ecx, dword [ebp - 0x50]
add eax, ecx
mov edx, dword [esi + 0x2f4]
sar eax, 1
add edx, eax
mov dword [esi + 0x2f4], edx
mov edi, dword [ebp - 0x44]
test edi, edi
je 0x485ac1
cmp dword [ebp - 0x4c], 0x17
je 0x486f8f
push eax
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x44]
push eax
mov eax, dword [esi + 0x2f4]
push eax
mov eax, dword [edx]
push eax
call dword [edx + 0x14]
add esp, 0x10
mov esi, dword [ebp - 0x18]
mov eax, dword [esi + 0x2f4]
mov edi, dword [ebp - 0x30]
add eax, 7
mov ecx, dword [ebp - 0x34]
sar eax, 3
add edi, eax
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x30], ecx
jb 0x485f79
mov eax, 3
jmp 0x48597d
mov dword [ebp - 0x4c], 6
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov dl, byte [ecx + 0x65bbc0]
test dl, dl
jns 0x485ca9
test ebx, ebx
jle case.0x485b23.0
cmp byte [esi + 0x2f0], 0
je case.0x485b23.0
cmp ecx, 0x18
ja case.0x485b23.0
jmp dword [ecx*4 + 0x65cbb0]
mov dword [ebp - 0x4c], 7
jmp 0x485af2
mov dword [ebp - 0x4c], 0x35
jmp 0x485af2
mov dword [ebp - 0x4c], 0x31
jmp 0x485af2
mov dword [ebp - 0x4c], 0x33
jmp 0x485af2
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x30], eax
jae case.0x4859a8.0
mov edx, dword [ebp - 0x30]
mov al, byte [edx]
inc edx
and eax, 0xff
mov dword [ebp - 0x30], edx
cmp eax, 0x25
ja case.0x4859a8.0
jmp dword [eax*4 + 0x65cc14]
mov dword [ebp - 0x4c], 0x34
jmp 0x485af2
mov dword [ebp - 0x4c], 0x12
jmp 0x485af2
mov dword [ebp - 0x4c], 0x14
jmp 0x485af2
mov dword [ebp - 0x4c], 3
jmp 0x485af2
mov dword [ebp - 0x4c], 4
jmp 0x485af2
mov dword [ebp - 0x4c], 5
jmp 0x485af2
mov dword [ebp - 0x4c], 0xc
jmp 0x485af2
mov dword [ebp - 0x4c], 9
jmp 0x485af2
mov dword [ebp - 0x4c], 0x22
jmp 0x485af2
mov dword [ebp - 0x4c], 0x15
jmp 0x485af2
mov dword [ebp - 0x4c], 0x17
jmp 0x485af2
mov dword [ebp - 0x4c], 0x18
jmp 0x485af2
mov dword [ebp - 0x4c], 1
jmp 0x485af2
mov dword [ebp - 0x4c], 2
jmp 0x485af2
mov dword [ebp - 0x4c], 0x16
jmp 0x485af2
mov dword [ebp - 0x4c], 0xa
jmp 0x485af2
mov dword [ebp - 0x4c], 0xb
jmp 0x485af2
mov dword [ebp - 0x4c], 0xd
jmp 0x485af2
mov dword [ebp - 0x4c], 8
jmp 0x485af2
mov dword [ebp - 0x4c], 0x32
jmp 0x485af2
mov dword [ebp - 0x4c], 0x13
jmp 0x485af2
mov eax, ebx
and eax, 1
test eax, eax
je case.0x485b23.0
mov edx, dword [ebp - 0x48]
movsx eax, word [edx + 2]
mov edx, dword [esi + 0x2ec]
add eax, edx
mov dword [esi + 0x2e8], eax
cmp byte [esi + 0x2f1], 0
jne 0x48597b
dec ebx
mov dword [ebp - 0x50], ebx
nop
mov byte [esi + 0x2f0], 0
xor edx, edx
and edx, 0xf
cmp dword [ebp - 0x50], edx
jl 0x487204
lea eax, [edx*4]
sub edi, eax
mov eax, dword [ebp - 0x50]
sub eax, edx
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x4c], 0x37
ja case.0x485cd3.0
mov ecx, dword [ebp - 0x4c]
jmp dword [ecx*4 + 0x65ccac]
mov eax, dword [ebp - 0x30]
add eax, 3
cmp eax, dword [ebp - 0x34]
jae case.0x4859a8.0
mov eax, dword [ebp - 0x30]
xor edx, edx
mov ecx, eax
xor esi, esi
mov dl, byte [eax]
xor eax, eax
shl edx, 0x18
mov al, byte [ecx + 1]
shl eax, 0x10
or edx, eax
xor eax, eax
mov al, byte [ecx + 2]
shl eax, 8
or edx, eax
xor eax, eax
mov al, byte [ecx + 3]
add ecx, 4
or edx, eax
mov dword [ebp - 0x30], ecx
jmp 0x485948
cmp dword [ebp - 0x50], 7
jle 0x487204
mov esi, dword [ebp - 0x50]
mov eax, 6
sub esi, 2
mov ecx, eax
mov edx, esi
mov eax, esi
sar edx, 0x1f
mov ebx, 0x2aaaaaab
idiv ecx
mov ecx, esi
sub esp, 0xc
sub ecx, edx
mov eax, ecx
imul ebx
mov eax, dword [ebp - 0x40]
mov ebx, edx
push eax
lea esi, [ecx + 2]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
sar ecx, 0x1f
sub ebx, ecx
call fcn.00485640
add esp, 0x10
test eax, eax
jne 0x48597b
lea edx, [ebx + ebx*2 + 2]
mov eax, dword [ebp - 0x38]
call fcn.00485560
test eax, eax
jne 0x48597b
lea eax, [esi*4]
sub edi, eax
jmp 0x485e0b
mov eax, dword [edi + 4]
mov edx, dword [ebp - 0x40]
mov ecx, dword [edi]
mov esi, dword [ebp - 0x3c]
add edx, eax
add esi, ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp - 0x40]
push 0
mov edx, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x38]
dec ebx
call fcn.004855a0
mov edx, dword [edi + 8]
mov ecx, dword [edi + 0xc]
mov eax, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x40]
add eax, edx
add esi, ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], esi
mov edx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
push 0
push ecx
call fcn.004855a0
mov eax, dword [edi + 0x10]
mov edx, dword [ebp - 0x3c]
add edx, eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], edx
mov edx, dword [edi + 0x14]
add eax, edx
push 1
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
push esi
add edi, 0x18
call fcn.004855a0
add esp, 0x18
test ebx, ebx
jg 0x485d90
mov ebx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
mov ecx, dword [edi]
mov eax, dword [edi + 4]
add ebx, ecx
add edx, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], edx
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
push 1
push ecx
call fcn.004855a0
pop eax
mov edi, dword [ebp - 0x48]
pop edx
lea esi, [esi]
mov esi, dword [ebp - 0x18]
mov dword [esi + 0x114], edi
jmp 0x485973
mov edx, dword [ebp - 0x14]
cmp edx, 0x8000
setge al
and eax, 0xff
add edx, eax
mov dword [edi], edx
mov edx, 0x10000
mov eax, dword [ebp - 0x14]
sub edx, eax
imul edx
mov ecx, edx
sar ecx, 0x1f
add ecx, 0x8000
add eax, ecx
adc edx, 0
shr eax, 0x10
shl edx, 0x10
add eax, edx
mov dword [ebp - 0x14], eax
test eax, eax
jne case.0x485cd3.55
mov dword [ebp - 0x14], 0x2873
add edi, 4
jmp case.0x485cd3.25
cmp ebx, 5
sete dl
cmp ebx, 1
sete al
or eax, edx
jmp 0x485c72
mov eax, ebx
and eax, 2
jmp 0x485c75
mov eax, dword [ebp - 0x38]
call fcn.004856f0
mov ecx, dword [ebp - 0x38]
mov byte [ecx + 0x40], 0
mov edx, dword [ebp - 0x3c]
mov eax, dword [edi - 4]
add edx, eax
mov dword [ebp - 0x3c], edx
mov edi, dword [ebp - 0x48]
jmp case.0x485cd3.25
mov eax, 7
jmp 0x48597d
sub esp, 0xc
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x38]
call fcn.00485640
add esp, 0x10
test eax, eax
jne 0x48597b
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
shr edx, 0x1f
add edx, eax
mov eax, dword [ebp - 0x38]
sar edx, 1
call fcn.00485560
test eax, eax
jne 0x48597b
cmp dword [ebp - 0x50], 1
jle 0x487204
mov eax, dword [ebp - 0x50]
mov esi, dword [ebp - 0x18]
and eax, 0xfffffffe
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
shl eax, 2
sub edi, eax
cmp dword [esi + 0x114], edi
jbe 0x485f79
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov esi, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x40]
add esi, edx
add ebx, ecx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], ebx
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
push 1
add edi, 8
push ecx
call fcn.004855a0
pop eax
pop edx
mov esi, dword [ebp - 0x18]
cmp dword [esi + 0x114], edi
ja 0x485f43
mov edi, dword [ebp - 0x48]
jmp 0x485e43
mov eax, dword [ebp - 0x38]
call fcn.004856f0
mov eax, dword [ebp - 0x38]
mov byte [eax + 0x40], 0
mov edx, dword [edi - 4]
mov ecx, dword [ebp - 0x40]
add ecx, edx
mov edi, dword [ebp - 0x48]
mov dword [ebp - 0x40], ecx
jmp case.0x485cd3.25
mov eax, dword [ebp - 0x38]
call fcn.004856f0
mov eax, dword [ebp - 0x38]
mov byte [eax + 0x40], 0
mov edx, dword [edi - 8]
mov esi, dword [ebp - 0x3c]
mov ecx, dword [edi - 4]
mov ebx, dword [ebp - 0x40]
add esi, edx
add ebx, ecx
mov edi, dword [ebp - 0x48]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], ebx
jmp case.0x485cd3.25
mov eax, dword [edi + 0xc]
cmp dword [edi + 8], eax
jle case.0x485cd3.55
mov eax, dword [edi + 4]
mov dword [edi], eax
add edi, 4
jmp case.0x485cd3.25
mov eax, dword [edi]
test eax, eax
sete al
and eax, 0xff
cmp eax, 1
sbb eax, eax
xor eax, 0xffffffff
and eax, 0x10000
mov dword [edi], eax
jmp 0x485fe1
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x40], 0
movsx eax, word [edi + 6]
mov edx, dword [esi + 0x2ec]
add eax, edx
mov dword [esi + 0x2e8], eax
mov edi, dword [edi]
mov dword [ebp - 0x3c], edi
mov edi, dword [ebp - 0x48]
jmp 0x485e43
mov esi, dword [ebp - 0x18]
lea eax, [esi + 0x118]
mov edx, dword [esi + 0x2a4]
cmp edx, eax
jbe case.0x4859a8.0
lea eax, [edx - 0xc]
mov dword [esi + 0x2a4], eax
mov dword [ebp - 0x2c], eax
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], eax
jmp 0x485e43
mov esi, dword [ebp - 0x18]
movsx ebx, word [edi + 2]
mov eax, dword [esi + 0x30c]
add ebx, eax
cmp dword [esi + 0x304], ebx
jbe case.0x4859a8.0
mov edx, dword [ebp - 0x2c]
sub edx, esi
sub edx, 0x118
sar edx, 2
lea eax, [edx + edx*4]
mov ecx, eax
shl ecx, 4
add eax, ecx
mov ecx, eax
shl ecx, 8
add eax, ecx
mov ecx, eax
shl ecx, 0x10
add eax, ecx
lea eax, [edx + eax*2]
cmp eax, 0x1f
jg case.0x4859a8.0
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
mov dword [eax + 8], edx
add eax, 0xc
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x314]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [eax + ebx*4]
mov dword [edx], ecx
test ecx, ecx
mov eax, dword [eax + ebx*4 + 4]
mov dword [edx + 8], ecx
mov dword [edx + 4], eax
je case.0x4859a8.0
cmp eax, ecx
je case.0x4859a8.0
mov dword [esi + 0x2a4], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], eax
jmp 0x485e43
mov esi, dword [ebp - 0x18]
movsx ebx, word [edi + 2]
mov eax, dword [esi + 0x308]
add ebx, eax
cmp dword [esi + 0x300], ebx
jbe case.0x4859a8.0
mov edx, dword [ebp - 0x2c]
sub edx, esi
sub edx, 0x118
sar edx, 2
lea eax, [edx + edx*4]
mov ecx, eax
shl ecx, 4
add eax, ecx
mov ecx, eax
shl ecx, 8
add eax, ecx
mov ecx, eax
shl ecx, 0x10
add eax, ecx
lea eax, [edx + eax*2]
cmp eax, 0x1f
jg case.0x4859a8.0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov eax, dword [esi + 0x310]
mov dword [edx + 8], ecx
add edx, 0xc
mov ecx, dword [eax + ebx*4]
mov dword [ebp - 0x2c], edx
jmp 0x4860cb
movsx ecx, word [edi + 2]
test ecx, ecx
js 0x486fd3
mov eax, dword [ebp - 0x50]
sub eax, 2
cmp eax, ecx
jge 0x48617a
mov ecx, eax
lea eax, [ecx*4 + 4]
neg eax
mov eax, dword [edi + eax]
mov dword [edi], eax
jmp 0x485fe1
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edi], eax
mov dword [edi + 4], edx
add edi, 8
jmp case.0x485cd3.25
mov eax, dword [edi]
test eax, eax
jle 0x486fda
mov ebx, eax
push esi
push esi
push eax
mov ecx, dword [edi]
push ecx
call fcn.004634b0
add esp, 0x10
lea eax, [eax + ebx + 1]
sar eax, 1
cmp eax, ebx
jne 0x4861a9
mov dword [edi], eax
jmp 0x485fe1
mov eax, dword [edi]
mov edx, dword [edi + 4]
imul edx
mov ecx, edx
sar ecx, 0x1f
add ecx, 0x8000
add eax, ecx
adc edx, 0
shr eax, 0x10
shl edx, 0x10
add eax, edx
mov dword [edi], eax
jmp 0x485fe1
neg dword [edi]
add edi, 4
jmp case.0x485cd3.25
push eax
push eax
mov eax, dword [edi + 4]
push eax
mov eax, dword [edi]
push eax
call fcn.004634b0
add esp, 0x10
mov dword [edi], eax
add edi, 4
jmp case.0x485cd3.25
mov eax, dword [edi]
mov edx, dword [edi + 4]
sub eax, edx
mov dword [edi], eax
jmp 0x485fe1
mov ecx, dword [edi]
mov eax, dword [edi + 4]
add ecx, eax
mov dword [edi], ecx
add edi, 4
jmp case.0x485cd3.25
mov eax, dword [edi]
test eax, eax
jns case.0x485cd3.55
neg eax
mov dword [edi], eax
jmp 0x485fe1
cmp dword [ebp - 0x50], 3
jle 0x486f24
mov esi, dword [ebp - 0x18]
mov ecx, dword [edi - 0x10]
mov eax, dword [edi - 0xc]
mov dword [ebp - 0x64], ecx
mov edx, dword [esi + 0x2e8]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x74], ecx
mov eax, pe_nt_image_headers32
movsx edx, word [edi - 6]
cmp byte [esi + 0x324], 0
movsx edi, word [edi - 2]
je 0x486fe8
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x2e8], edx
jmp 0x48597d
sub esp, 0xc
mov ebx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
push ebx
mov dword [ebp - 0x5c], 0
call fcn.00485640
xor esi, esi
add esp, 0x10
test eax, eax
jne 0x48597b
mov edx, 6
mov eax, dword [ebp - 0x38]
call fcn.00485560
test eax, eax
jne 0x48597b
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], ecx
mov eax, edi
mov ebx, 5
mov edx, dword [eax]
mov ecx, dword [ebp - 0x5c]
add ecx, edx
dec ebx
mov edx, dword [eax + 4]
mov dword [ebp - 0x5c], ecx
add esi, edx
add eax, 8
test ebx, ebx
jg 0x4862eb
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x5c]
sar eax, 0x1f
mov ebx, 5
xor ecx, eax
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x5c]
sub edx, eax
mov eax, esi
sar eax, 0x1f
mov dword [ebp - 0x5c], edx
xor esi, eax
sub esi, eax
cmp dword [ebp - 0x5c], esi
setg al
and eax, 0xff
mov esi, eax
mov ecx, dword [edi]
mov eax, dword [ebp - 0x3c]
add eax, ecx
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
mov eax, dword [edi + 4]
add edx, eax
cmp ebx, 3
sete al
mov dword [ebp - 0x40], edx
and eax, 0xff
push eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
dec ebx
push ecx
add edi, 8
call fcn.004855a0
pop eax
test ebx, ebx
pop edx
jg 0x486333
test esi, esi
je 0x486f0f
mov esi, dword [ebp - 0x3c]
mov edx, dword [edi]
add esi, edx
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], ecx
jmp 0x485e24
sub esp, 0xc
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x38]
call fcn.00485640
add esp, 0x10
test eax, eax
jne 0x48597b
mov edx, 6
mov eax, dword [ebp - 0x38]
call fcn.00485560
test eax, eax
jne 0x48597b
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov eax, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x40]
add eax, edx
add esi, ecx
mov ebx, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], esi
mov edx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
push 0
push ecx
call fcn.004855a0
mov eax, dword [edi + 8]
mov edx, dword [ebp - 0x3c]
add edx, eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], edx
mov edx, dword [edi + 0xc]
add eax, edx
push 0
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
call fcn.004855a0
mov ecx, dword [edi + 0x10]
mov esi, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add esi, ecx
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x3c], esi
push 1
mov edx, dword [ebp - 0x3c]
push ecx
call fcn.004855a0
mov eax, dword [edi + 0x14]
mov edx, dword [ebp - 0x3c]
push 0
add edx, eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], edx
push eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
call fcn.004855a0
mov edx, dword [edi + 0x18]
mov ecx, dword [edi + 0x1c]
mov eax, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x40]
add eax, edx
add esi, ecx
add esp, 0x20
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], esi
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
push 0
push ecx
call fcn.004855a0
mov eax, dword [edi + 0x20]
mov edx, dword [ebp - 0x3c]
add edx, eax
push 1
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], ebx
push ebx
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
call fcn.004855a0
mov edi, dword [ebp - 0x48]
add esp, 0x10
jmp case.0x485cd3.25
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x4864d6
mov eax, dword [ebp - 0x50]
mov esi, dword [ebp - 0x50]
and eax, 0xfffffffe
shl eax, 2
sub edi, eax
mov eax, dword [ebp - 0x50]
shr eax, 0x1f
push edi
add eax, esi
sar eax, 1
push eax
cmp dword [ebp - 0x4c], 0x13
sete dl
cmp dword [ebp - 0x4c], 0x15
sete al
or eax, edx
and eax, 1
push eax
mov eax, dword [ebp - 0x44]
mov ebx, dword [eax]
push ebx
call dword [eax + 0xc]
add esp, 0x10
mov eax, dword [ebp - 0x50]
mov esi, dword [ebp - 0x18]
shr eax, 0x1f
mov ecx, dword [ebp - 0x50]
add eax, ecx
mov edx, dword [esi + 0x2f4]
sar eax, 1
mov edi, dword [ebp - 0x48]
add edx, eax
mov dword [esi + 0x2f4], edx
jmp 0x485e43
sub esp, 0xc
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x38]
call fcn.00485640
add esp, 0x10
test eax, eax
jne 0x48597b
mov edx, 6
mov eax, dword [ebp - 0x38]
call fcn.00485560
test eax, eax
jne 0x48597b
mov edx, dword [edi]
mov eax, dword [ebp - 0x3c]
add eax, edx
mov ebx, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
push 0
push ebx
call fcn.004855a0
mov eax, dword [edi + 8]
mov edx, dword [ebp - 0x40]
mov ecx, dword [edi + 4]
mov esi, dword [ebp - 0x3c]
add edx, eax
add esi, ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp - 0x40]
push 0
mov edx, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x38]
call fcn.004855a0
mov edx, dword [edi + 0xc]
mov eax, dword [ebp - 0x3c]
push 1
add eax, edx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x40]
push eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
call fcn.004855a0
mov ecx, dword [edi + 0x10]
mov esi, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add esi, ecx
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x3c], esi
push 0
mov edx, dword [ebp - 0x3c]
push ecx
call fcn.004855a0
mov eax, dword [edi + 0x14]
mov edx, dword [ebp - 0x3c]
add esp, 0x20
add edx, eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], edx
push 0
mov edx, dword [ebp - 0x3c]
push ebx
mov dword [ebp - 0x40], ebx
call fcn.004855a0
mov edx, dword [edi + 0x18]
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x3c]
push 1
add edi, edx
push esi
mov dword [ebp - 0x3c], edi
jmp 0x48647f
sub esp, 0xc
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x38]
call fcn.00485640
add esp, 0x10
test eax, eax
jne 0x48597b
mov edx, 6
mov eax, dword [ebp - 0x38]
call fcn.00485560
test eax, eax
jne 0x48597b
mov ebx, 6
mov eax, dword [edi + 4]
mov edx, dword [ebp - 0x40]
mov ecx, dword [edi]
add edx, eax
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x40], edx
add esi, ecx
cmp ebx, 4
sete dl
cmp ebx, 1
mov dword [ebp - 0x3c], esi
sete al
or eax, edx
mov edx, dword [ebp - 0x3c]
and eax, 1
add edi, 8
push eax
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
call fcn.004855a0
dec ebx
pop esi
pop eax
jne 0x486614
mov edi, dword [ebp - 0x48]
jmp case.0x485cd3.25
cmp dword [ebp - 0x50], 3
jle 0x487204
mov eax, dword [ebp - 0x50]
test eax, eax
js 0x486fbb
mov ebx, eax
mov eax, dword [ebp - 0x50]
and ebx, 0xfffffffc
mov ecx, dword [ebp - 0x40]
sub eax, ebx
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov esi, dword [ebp - 0x50]
test esi, esi
setg al
and eax, 0xff
sub esp, 0xc
add ebx, eax
mov eax, dword [ebp - 0x38]
push ecx
call fcn.00485640
add esp, 0x10
test eax, eax
jne 0x48597b
lea eax, [ebx*4]
sub edi, eax
test bl, 1
je 0x4866c4
mov eax, dword [edi]
mov edx, dword [ebp - 0x3c]
add edx, eax
add edi, 4
mov dword [ebp - 0x3c], edx
dec ebx
mov eax, ebx
test ebx, ebx
js 0x487016
sar eax, 2
lea edx, [eax + eax*2]
mov eax, dword [ebp - 0x38]
call fcn.00485560
test eax, eax
jne 0x48597b
mov esi, dword [ebp - 0x18]
cmp dword [esi + 0x114], edi
jbe 0x485f79
mov edx, dword [edi]
mov eax, dword [ebp - 0x40]
add eax, edx
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x40]
push 0
push esi
call fcn.004855a0
mov eax, dword [edi + 8]
mov edx, dword [ebp - 0x40]
mov ecx, dword [edi + 4]
mov ebx, dword [ebp - 0x3c]
add edx, eax
add ebx, ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x40]
push 0
mov edx, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x38]
call fcn.004855a0
mov edx, dword [edi + 0xc]
mov eax, dword [ebp - 0x40]
push 1
add eax, edx
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
add edi, 0x10
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
call fcn.004855a0
add esp, 0x18
mov esi, dword [ebp - 0x18]
cmp dword [esi + 0x114], edi
ja 0x4866f3
mov edi, dword [ebp - 0x48]
jmp 0x485e43
sub esp, 0xc
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x38]
call fcn.00485640
add esp, 0x10
test eax, eax
jne 0x48597b
cmp dword [ebp - 0x50], 3
jle 0x487204
mov eax, dword [ebp - 0x50]
test eax, eax
js 0x486fc3
mov ebx, eax
mov eax, dword [ebp - 0x50]
and ebx, 0xfffffffc
sub eax, ebx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
test eax, eax
setg al
and eax, 0xff
add ebx, eax
lea eax, [ebx*4]
sub edi, eax
mov eax, ebx
test ebx, ebx
js 0x486fcb
sar eax, 2
lea edx, [eax + eax*2]
mov eax, dword [ebp - 0x38]
call fcn.00485560
test eax, eax
jne 0x487204
cmp dword [ebp - 0x4c], 9
sete al
and eax, 0xff
mov esi, eax
jmp 0x486863
mov edx, dword [edi]
mov eax, dword [ebp - 0x3c]
add eax, edx
push 0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x40]
push eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
call fcn.004855a0
mov ecx, dword [edi + 4]
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
add eax, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [edi + 8]
add edx, eax
push 0
mov dword [ebp - 0x40], edx
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
call fcn.004855a0
mov eax, dword [ebp - 0x40]
mov edx, dword [edi + 0xc]
add esp, 0x10
add eax, edx
cmp ebx, 1
mov dword [ebp - 0x40], eax
je 0x486eff
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
push 1
add edi, 0x10
push ecx
xor esi, 1
call fcn.004855a0
pop eax
pop edx
cmp ebx, 3
jle case.0x485cd3.53
sub ebx, 4
test esi, esi
jne 0x4867f1
mov eax, dword [edi]
mov edx, dword [ebp - 0x40]
add edx, eax
push 0
mov dword [ebp - 0x40], edx
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
call fcn.004855a0
mov edx, dword [edi + 4]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [edi + 8]
add eax, edx
push 0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x40]
add eax, ecx
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.004855a0
mov edx, dword [ebp - 0x3c]
mov eax, dword [edi + 0xc]
add edx, eax
add esp, 0x10
mov dword [ebp - 0x3c], edx
cmp ebx, 1
jne 0x48684a
mov eax, dword [ebp - 0x40]
mov edx, dword [edi + 0x10]
add eax, edx
mov dword [ebp - 0x40], eax
jmp 0x48684a
movsx edx, word [edi + 2]
xor eax, eax
test edx, edx
js 0x487061
mov esi, dword [ebp - 0x18]
cmp dword [esi + 0x2fc], edx
jle 0x486902
mov eax, dword [esi + 0x2f8]
mov eax, dword [eax + edx*4]
mov dword [edi], eax
add edi, 4
jmp 0x485e43
movsx edx, word [edi + 6]
mov ecx, dword [edi]
test edx, edx
js case.0x485cd3.25
mov esi, dword [ebp - 0x18]
cmp dword [esi + 0x2fc], edx
jle 0x485e43
mov eax, dword [esi + 0x2f8]
mov dword [eax + edx*4], ecx
jmp 0x485e43
mov ecx, dword [edi]
test ecx, ecx
jne 0x48694a
mov edx, dword [edi + 4]
xor eax, eax
test edx, edx
je 0x485fdf
mov eax, 0x10000
mov dword [edi], eax
jmp 0x485fe1
mov esi, dword [edi]
test esi, esi
je 0x48696c
mov ebx, dword [edi + 4]
mov eax, 0x10000
test ebx, ebx
jne 0x485fdf
xor eax, eax
mov dword [edi], eax
jmp 0x485fe1
mov eax, dword [edi]
mov dword [edi + 4], eax
add edi, 4
jmp case.0x485cd3.25
movsx esi, word [edi + 2]
movsx ecx, word [edi + 6]
test esi, esi
jle 0x48706e
lea eax, [esi*4]
sub edi, eax
cmp edi, dword [ebp - 0x48]
jb 0x487204
test ecx, ecx
jl 0x48702e
jle 0x4869d6
lea eax, [esi - 2]
mov dword [ebp - 0x94], eax
mov edx, dword [ebp - 0x94]
mov ebx, dword [edi + esi*4 - 4]
test edx, edx
jmp 0x4869cd
mov eax, dword [edi + edx*4]
mov dword [edi + edx*4 + 4], eax
dec edx
jns 0x4869c5
dec ecx
mov dword [edi], ebx
test ecx, ecx
jg 0x4869b7
lea edi, [edi + esi*4]
jmp case.0x485cd3.25
cmp dword [ebp - 0x50], 3
jle 0x487204
mov eax, dword [ebp - 0x50]
test eax, eax
js 0x487026
mov ebx, eax
mov eax, dword [ebp - 0x50]
and ebx, 0xfffffffc
mov edx, dword [ebp - 0x3c]
sub eax, ebx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
test eax, eax
setg al
and eax, 0xff
sub esp, 0xc
add ebx, eax
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
call fcn.00485640
add esp, 0x10
test eax, eax
jne 0x48597b
lea eax, [ebx*4]
sub edi, eax
test bl, 1
je 0x486a48
mov ecx, dword [edi]
mov esi, dword [ebp - 0x40]
add esi, ecx
add edi, 4
mov dword [ebp - 0x40], esi
dec ebx
mov eax, ebx
test ebx, ebx
js 0x48701e
sar eax, 2
lea edx, [eax + eax*2]
mov eax, dword [ebp - 0x38]
call fcn.00485560
test eax, eax
jne 0x48597b
mov esi, dword [ebp - 0x18]
cmp dword [esi + 0x114], edi
jbe 0x485f79
mov eax, dword [edi]
mov edx, dword [ebp - 0x3c]
add edx, eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], edx
push 0
mov edx, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x38]
call fcn.004855a0
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
mov eax, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x40]
add eax, edx
add esi, ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], esi
mov edx, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
push 0
push ebx
call fcn.004855a0
mov eax, dword [edi + 0xc]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
add ecx, eax
push 1
mov dword [ebp - 0x3c], ecx
push edx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
call fcn.004855a0
add edi, 0x10
add esp, 0x18
mov esi, dword [ebp - 0x18]
cmp dword [esi + 0x114], edi
ja 0x486a77
mov edi, dword [ebp - 0x48]
jmp 0x485e43
cmp dword [ebp - 0x50], 7
jle 0x487204
sub esp, 0xc
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x38]
call fcn.00485640
and esi, 0xfffffffe
lea ebx, [esi - 6]
add esp, 0x10
sar ebx, 1
test eax, eax
jne 0x48597b
lea edx, [ebx + 3]
mov eax, dword [ebp - 0x38]
call fcn.00485560
test eax, eax
jne 0x48597b
lea eax, [esi*4]
sub edi, eax
jmp 0x486b6a
mov ecx, dword [edi]
mov eax, dword [ebp - 0x3c]
add eax, ecx
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
mov eax, dword [edi + 4]
add esi, eax
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x40]
push 1
add edi, 8
push ecx
dec ebx
call fcn.004855a0
pop eax
pop edx
test ebx, ebx
jg 0x486b3e
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov esi, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x40]
add esi, edx
add ebx, ecx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], ebx
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
push 0
push ecx
call fcn.004855a0
mov eax, dword [edi + 8]
mov edx, dword [ebp - 0x3c]
add edx, eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], edx
mov edx, dword [edi + 0xc]
add eax, edx
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x40]
push 0
push esi
call fcn.004855a0
mov eax, dword [edi + 0x14]
mov edx, dword [ebp - 0x40]
mov ecx, dword [edi + 0x10]
mov ebx, dword [ebp - 0x3c]
add edx, eax
add ebx, ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x40]
push 1
mov edx, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x38]
call fcn.004855a0
mov edi, dword [ebp - 0x48]
add esp, 0x18
jmp case.0x485cd3.25
cmp dword [ebp - 0x50], 5
jle 0x487204
mov edx, dword [ebp - 0x50]
mov eax, 6
mov ecx, eax
mov eax, edx
sar edx, 0x1f
sub esp, 0xc
idiv ecx
mov ebx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x40]
sub ebx, edx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
push ecx
call fcn.00485640
add esp, 0x10
test eax, eax
jne 0x48597b
mov edx, ebx
mov eax, dword [ebp - 0x38]
shr edx, 0x1f
lea edx, [ebx + edx]
sar edx, 1
call fcn.00485560
test eax, eax
jne 0x48597b
lea eax, [ebx*4]
mov esi, dword [ebp - 0x18]
sub edi, eax
cmp dword [esi + 0x114], edi
jbe 0x485f79
mov eax, dword [edi]
mov edx, dword [ebp - 0x3c]
add edx, eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], edx
mov edx, dword [edi + 4]
add eax, edx
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x40]
push 0
push esi
call fcn.004855a0
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x40]
mov ecx, dword [edi + 8]
mov ebx, dword [ebp - 0x3c]
add edx, eax
add ebx, ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x40]
push 0
mov edx, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x38]
call fcn.004855a0
mov edx, dword [edi + 0x10]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [edi + 0x14]
add eax, edx
push 1
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x40]
add eax, ecx
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
add edi, 0x18
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
call fcn.004855a0
add esp, 0x18
mov esi, dword [ebp - 0x18]
cmp dword [esi + 0x114], edi
ja 0x486c5c
mov edi, dword [ebp - 0x48]
jmp 0x485e43
cmp dword [ebp - 0x4c], 5
mov esi, dword [ebp - 0x50]
sete al
xor ebx, ebx
test esi, esi
mov bl, al
jle 0x487204
sub esp, 0xc
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
push ecx
call fcn.00485640
add esp, 0x10
test eax, eax
jne 0x48597b
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x38]
call fcn.00485560
test eax, eax
jne 0x48597b
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x48]
cmp dword [esi + 0x114], edi
jbe 0x485f79
test ebx, ebx
je 0x486ef0
mov edx, dword [ebp - 0x3c]
mov eax, dword [edi]
add edx, eax
mov dword [ebp - 0x3c], edx
sub esp, 0xc
mov esi, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
push esi
call fcn.004855f0
add esp, 0x10
test eax, eax
jne 0x48597b
add edi, 4
xor ebx, 1
mov esi, dword [ebp - 0x18]
cmp dword [esi + 0x114], edi
ja 0x486d45
mov edi, dword [ebp - 0x48]
jmp 0x485e43
mov dword [ebp - 0x4c], 0xe
jmp 0x485af2
mov dword [ebp - 0x4c], 0xf
jmp 0x485af2
mov dword [ebp - 0x4c], 0x26
jmp 0x485af2
mov dword [ebp - 0x4c], 0x25
jmp 0x485af2
mov dword [ebp - 0x4c], 0x24
jmp 0x485af2
mov dword [ebp - 0x4c], 0x27
jmp 0x485af2
mov dword [ebp - 0x4c], 0x21
jmp 0x485af2
mov dword [ebp - 0x4c], 0x20
jmp 0x485af2
mov dword [ebp - 0x4c], 0x1f
jmp 0x485af2
mov dword [ebp - 0x4c], 0x30
jmp 0x485af2
mov dword [ebp - 0x4c], 0x29
jmp 0x485af2
mov dword [ebp - 0x4c], 0x28
jmp 0x485af2
mov dword [ebp - 0x4c], 0x23
jmp 0x485af2
mov dword [ebp - 0x4c], 0x37
jmp 0x485af2
mov dword [ebp - 0x4c], 0x36
jmp 0x485af2
mov dword [ebp - 0x4c], 0x2f
jmp 0x485af2
mov dword [ebp - 0x4c], 0x1e
jmp 0x485af2
mov dword [ebp - 0x4c], 0x2b
jmp 0x485af2
mov dword [ebp - 0x4c], 0x1d
jmp 0x485af2
mov dword [ebp - 0x4c], 0x1c
jmp 0x485af2
mov dword [ebp - 0x4c], 0x1b
jmp 0x485af2
mov dword [ebp - 0x4c], 0x1a
jmp 0x485af2
mov dword [ebp - 0x4c], 0x2a
jmp 0x485af2
mov dword [ebp - 0x4c], 0x2e
jmp 0x485af2
mov dword [ebp - 0x4c], 0x19
jmp 0x485af2
mov dword [ebp - 0x4c], 0x2d
jmp 0x485af2
mov dword [ebp - 0x4c], 0x2c
jmp 0x485af2
mov dword [ebp - 0x4c], 0x11
jmp 0x485af2
mov dword [ebp - 0x4c], 0x10
jmp 0x485af2
mov eax, dword [ebp - 0x40]
mov edx, dword [edi]
add eax, edx
mov dword [ebp - 0x40], eax
jmp 0x486d57
mov eax, dword [ebp - 0x3c]
mov ecx, dword [edi + 0x10]
add eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x48684a
mov ebx, dword [ebp - 0x40]
mov edx, dword [edi]
mov eax, dword [ebp - 0x54]
add ebx, edx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ebx
jmp 0x485e24
mov eax, dword [ebp - 0x38]
call fcn.004856f0
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x486f75
push ecx
push ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ecx + 0x14]
movsx eax, word [eax + 2]
push eax
mov eax, dword [ebp - 0x44]
mov edx, dword [eax]
push edx
call dword [eax + 8]
add esp, 0x10
test eax, eax
jne case.0x4859a8.0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x38]
mov eax, dword [eax + 0x320]
push eax
mov eax, dword [ecx + 0x48]
push eax
mov eax, dword [ebp - 0x44]
mov edi, dword [ecx + 0x14]
push edi
mov esi, dword [eax]
push esi
call dword [eax + 0x18]
add esp, 0x10
mov ecx, dword [ebp - 0x38]
sub esp, 0xc
mov ebx, dword [ecx + 0xc]
push ebx
call fcn.00463b90
add esp, 0x10
mov eax, dword [ebp - 0x28]
jmp 0x48597d
mov ebx, dword [ebp - 0x30]
push ebx
mov ecx, dword [esi + 0x2f4]
push ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ecx + 0x14]
movsx eax, word [eax + 2]
push eax
mov eax, dword [ebp - 0x44]
mov edx, dword [eax]
push edx
call dword [eax + 0x10]
jmp 0x485abb
mov esi, dword [ebp - 0x18]
jmp 0x485a95
add eax, 3
jmp 0x48666f
add eax, 3
jmp 0x48679c
lea eax, [ebx + 3]
jmp 0x4867cb
xor ecx, ecx
jmp 0x48617a
mov dword [edi], 0
add edi, 4
jmp case.0x485cd3.25
mov ebx, dword [ecx + 0x2b8]
mov eax, ebx
call fcn.004857b0
mov edx, edi
mov dword [ebp - 0x6c], eax
mov eax, ebx
call fcn.004857b0
mov dword [ebp - 0x70], eax
or eax, dword [ebp - 0x6c]
jns 0x487078
mov eax, pe_nt_image_headers32
mov esi, dword [ebp - 0x18]
jmp 0x486289
add eax, 3
jmp 0x4866ce
add eax, 3
jmp 0x486a52
add eax, 3
jmp 0x4869f3
lea ebx, [esi - 1]
mov edx, dword [edi]
mov dword [ebp - 0x90], edx
xor edx, edx
cmp ebx, 0
jmp 0x48704a
mov eax, dword [edi + edx*4 + 4]
mov dword [edi + edx*4], eax
inc edx
cmp ebx, edx
jg 0x487040
mov eax, dword [ebp - 0x90]
inc ecx
mov dword [edi + esi*4 - 4], eax
js 0x487031
lea edi, [edi + esi*4]
jmp case.0x485cd3.25
mov dword [edi], eax
mov esi, dword [ebp - 0x18]
add edi, 4
jmp 0x485e43
mov esi, 1
jmp 0x486992
cmp byte [esi + 0x42], 0
je 0x487113
mov edi, dword [esi + 8]
mov eax, dword [edi + 0x9c]
mov eax, dword [eax]
push ebx
mov dword [ebp - 0x8c], eax
push ebx
push 2
push eax
call fcn.0046ae00
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x4871fa
mov edx, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x6c]
mov dword [edi + 0x48], 0x636f6d70
mov eax, dword [edx + 0x58]
mov edx, dword [ebp - 0x70]
mov dword [eax], ecx
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov word [eax + 4], 0x202
add eax, 0x20
mov ecx, dword [ebp - 0x8c]
mov dword [eax], edx
mov edx, dword [ebp - 0x64]
sar edx, 0x10
mov word [eax + 4], 2
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x68]
sar edx, 0x10
mov dword [eax + 0xc], edx
mov eax, dword [ecx + 0x34]
mov dword [edi + 0x80], 2
mov dword [edi + 0x84], eax
mov dword [ecx + 0x54], 2
sub esp, 0xc
mov ecx, dword [esi + 0xc]
lea edi, [ebp - 0x24]
push ecx
call fcn.00463b60
pop eax
lea eax, [ebp - 0x20]
pop edx
mov edx, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x74]
push edi
call fcn.00485800
add esp, 0x10
test eax, eax
jne 0x48717b
mov byte [esi + 0x324], 1
sub esp, 0xc
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
push eax
mov eax, esi
call fcn.00485840
add esp, 0x10
mov ebx, eax
mov byte [esi + 0x324], 0
test eax, eax
jne 0x4871fa
sub esp, 0xc
mov eax, dword [ebp - 0x20]
mov edx, edi
push eax
mov eax, dword [ebp - 0x74]
call fcn.00485820
add esp, 0x10
mov edx, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov dword [ebp - 0x80], edx
mov edx, dword [esi + 0x2c]
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x84], edx
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebp - 0x64]
mov dword [esi + 0x20], 0
mov dword [esi + 0x18], edx
mov dword [esi + 0x24], 0
mov dword [esi + 0x1c], ecx
mov dword [ebp - 0x88], eax
push eax
push eax
lea eax, [ebp - 0x20]
push eax
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x74]
push edi
call fcn.00485800
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x487218
mov edx, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x7c]
mov dword [esi + 0x20], edx
mov eax, dword [ebp - 0x88]
mov edx, dword [ebp - 0x84]
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov eax, ebx
mov esi, dword [ebp - 0x18]
jmp 0x486289
mov eax, 0x81
jmp 0x48597d
mov eax, 0x82
jmp 0x48597d
mov byte [esi + 0x324], 1
sub esp, 0xc
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
push eax
mov eax, esi
call fcn.00485840
add esp, 0x10
mov ebx, eax
mov byte [esi + 0x324], 0
test eax, eax
jne 0x4871fa
sub esp, 0xc
mov eax, dword [ebp - 0x20]
mov edx, edi
push eax
mov eax, dword [ebp - 0x74]
call fcn.00485820
add esp, 0x10
jmp 0x4871ce