Function at 0x406b24
Capabilities:
Access peb ldr_data
Check os version
Contain obfuscated stackstrings
Encrypt data using salsa20 or chacha
Encrypt data using speck
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xffffffe0
sub esp, 0xa40
call 0x406b38
pop eax
mov ebx, 0x3ad
mov edi, 0x3ee
mov ecx, 0x335
mov esi, 0x292b1
mov dword [esp + 0x178], eax
mov eax, 0x47c
sub esi, 1
jb 0x406b98
xor edx, edx
cmp eax, 0xffffffff
je 0x406b76
test eax, eax
je 0x407147
mov ebx, eax
mov eax, edi
cdq
idiv ebx
mov eax, ebx
mov ebx, eax
xor eax, eax
cmp edx, ebx
setns al
add eax, 0x7fffffff
sub edx, ebx
cmovo edx, eax
mov eax, ebx
imul eax, ecx
mov edi, edx
sar eax, cl
add eax, ecx
mov ecx, ebx
jmp 0x406b59
cmp ebx, 0x3f1
mov edx, ecx
je 0x406bcf
cmp ebx, 0x407
je 0x406bc7
cmp ebx, 0x47c
jne 0x406bd8
mov esi, eax
mov eax, ecx
mov ebx, 0x7fffffff
add eax, 0x47c
cmovno ebx, eax
mov eax, esi
jmp 0x406bd8
lea ebx, [eax + 0x407]
jmp 0x406bd8
mov ebx, 0x3f1
mov ecx, edx
shr ebx, cl
cmp edi, 0xfffffaf6
je 0x406c0d
cmp edi, 0xfffffbdd
je 0x406c18
cmp edi, 0xfffffd10
je 0x406c23
cmp edi, 0xfffffe6f
jne 0x406c28
mov ecx, eax
mov eax, edx
mov edi, 0x80000000
add eax, 0xfffffe6f
cmovno edi, eax
mov eax, ecx
jmp 0x406c28
mov edi, 0xfffffaf6
mov ecx, ebx
shl edi, cl
jmp 0x406c28
mov edi, 0xfffffbdd
mov ecx, eax
sar edi, cl
jmp 0x406c28
mov edi, 0x8bfffff
cmp eax, 0x26d
je 0x406c87
cmp eax, 0x2b7
je 0x406c44
cmp eax, 0x335
jne 0x406c4f
mov eax, 0x35030000
jmp 0x406c4f
sub esp, 0xfe8
mov eax, 0x2b7
cmp edx, 0x372
je 0x406c6b
cmp edx, 0x476
mov dword [esp + 0x20], eax
jne 0x406c95
lea edx, [edi + 0x476]
jmp 0x406c95
cmp ebx, 0xffffffff
je 0x406c8f
test ebx, ebx
je 0x407147
mov dword [esp + 0x20], eax
mov eax, 0x372
xor edx, edx
idiv ebx
jmp 0x406c95
sub esp, 0x988
ud2
mov dword [esp + 0x20], eax
xor edx, edx
mov eax, 0x28f
mov ecx, 0x82e0
mov dword [esp + 0x10], edi
sub ecx, 1
jb 0x406d54
mov ebx, dword [esp + 0x20]
mov dword [esp + 0xc], ecx
mov edi, 0x80000000
mov esi, ebx
imul esi, eax
lea ecx, [esi + eax]
sar ecx, 0x1f
xor ecx, edi
add esi, eax
mov eax, 0xfffffa72
cmovo esi, ecx
imul ecx, edx, 0x58e
mov edx, dword [esp + 0x10]
add ecx, eax
cmovo ecx, edi
lea eax, [ecx + esi]
sar eax, 0x1f
bswap edx
xor eax, edi
add ecx, esi
mov edi, 0xf0f0f0f
cmovo ecx, eax
mov eax, edx
and edx, edi
shr eax, 4
shl edx, 4
and eax, edi
mov edi, 0x33333333
or edx, eax
mov eax, edx
shr edx, 2
and eax, edi
and edx, edi
mov edi, 0x55555555
lea eax, [edx + eax*4]
mov edx, eax
shr eax, 1
and edx, edi
and eax, edi
mov edi, 0x80000000
lea eax, [eax + edx*2]
mov edx, 0xfffffa72
add eax, edx
cmovo eax, edi
add ebx, edx
mov edx, esi
add ebx, eax
mov dword [esp + 0x10], ebx
call fcn.004015c4
mov ecx, dword [esp + 0xc]
mov edx, eax
mov eax, 0x58e
mov dword [esp + 0x20], esi
jmp 0x406ca3
mov ebx, dword [esp + 0x10]
cmp ebx, 0x778
je 0x406d71
cmp ebx, 0xe32
mov eax, edx
jne 0x406d8a
mov ebx, 0x320e0000
jmp 0x406d8a
mov ebx, 0x778
xor ecx, ecx
mov eax, edx
cmp ebx, edx
setns cl
add ecx, 0x7fffffff
sub ebx, edx
cmovo ebx, ecx
mov ecx, dword [esp + 0x20]
cmp ecx, 0xca223aba
je 0x406db8
cmp ecx, 0xca223ec5
je 0x406dc9
cmp ecx, 0xca223f98
je 0x406dd9
cmp ecx, 0xca224663
jne 0x406de1
mov dword [esp + 0x20], 0xc6624453
jmp 0x406de1
mov eax, 0xca223aba
mov ecx, ebx
sar eax, cl
mov dword [esp + 0x20], eax
mov eax, edx
jmp 0x406de1
sub esp, 0xe05
mov dword [esp + 0x20], 0xca223ec5
jmp 0x406de1
mov dword [esp + 0x20], 0xca224526
cmp eax, 0x84c
je 0x406e0d
cmp eax, 0xd88
je 0x406dfd
cmp eax, 0xe2a
jne 0x406e18
mov eax, 0x2a0e0000
jmp 0x406e18
mov edx, dword [esp + 0x20]
mov ecx, 0xd88
call fcn.004015e0
jmp 0x406e18
mov eax, 0x84c
sub esp, 0x620
imul ecx, dword [esp + 0x20], 0x58e
mov edi, 0x3ea
mov edx, 0xb11
mov esi, 0x18d02
mov dword [esp + 0xc0], 0x71a00000
mov dword [esp + 0x60], 0x8e60058e
mov dword [esp + 0xc], 0xddb
mov dword [esp + 0x14], 0x842
mov dword [esp + 0x1c], 0x9e6
mov dword [esp + 0x40], 0x690
mov dword [esp + 0xa0], ecx
mov ecx, edi
sub esi, 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x90], edi
mov dword [esp + 0x70], edx
jb 0x406f7f
sub ebx, edx
mov edx, dword [esp + 0xa0]
mov edi, 0x7fffffff
mov eax, ebx
xor eax, edx
shr eax, 0x1f
add eax, edi
imul ebx, edx
mov edi, 0xf0f0f0f
cmovo ebx, eax
add edx, ecx
bswap edx
bswap ebx
mov eax, edx
and edx, edi
mov dword [esp + 0x10], ebx
shr eax, 4
shl edx, 4
and eax, edi
mov edi, 0x33333333
or edx, eax
mov eax, edx
shr edx, 2
and eax, edi
and edx, edi
mov edi, ecx
lea eax, [edx + eax*4]
mov edx, 0x55555555
mov ecx, eax
shr eax, 1
and ecx, edx
and eax, edx
mov edx, ebx
lea ecx, [eax + ecx*2]
call fcn.004015c4
mov edx, dword [esp + 0xc]
xor ecx, ecx
mov ebx, 0x7fffffff
mov dword [esp + 0xa0], eax
cmp edx, eax
setns cl
add ecx, ebx
sub edx, eax
mov ebx, dword [esp + 0x14]
cmovo edx, ecx
mov ecx, dword [esp + 0x1c]
lea eax, [edx + edi]
sar eax, 0x1f
add eax, 0x80000000
add edx, edi
lea edi, [edi + edi]
cmovo edx, eax
shl edi, cl
mov dword [esp + 0xc], edx
xor edx, edx
cmp ebx, 0xffffffff
je 0x406f4e
test ebx, ebx
je 0x407147
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x40]
mov ebx, dword [esp + 0x14]
sar eax, cl
sub eax, dword [esp + 0xc]
cdq
idiv ebx
mov ecx, dword [esp + 0x1c]
add ebx, ecx
mov eax, dword [esp + 0x90]
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0xc0], eax
mov dword [esp + 0x40], ebx
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x10]
jmp 0x406e69
mov eax, dword [esp + 0xc0]
cmp eax, 0xd16
je 0x406fa7
cmp eax, 0xf84
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0xa0]
jne 0x406fb8
add esp, 0xbbf
jmp 0x406fb8
add esp, 0x13d0
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0xa0]
imul edi, edx, 0x29
cmp ebx, 0x29
cmovne edi, ebx
test eax, eax
je 0x407022
mov ebx, dword [esp + 0xc]
cmp eax, 0x5a7
je 0x406fe6
cmp eax, 0xc49
je 0x406ffd
cmp eax, 0xf7b
jne 0x40702a
imul eax, esi, 0xf7b
jmp 0x40702a
mov edx, 0x5a7
mov eax, ecx
mov ecx, dword [esp + 0x70]
shl edx, cl
mov ecx, eax
mov eax, edx
mov edx, dword [esp + 0x70]
jmp 0x40702a
mov esi, ecx
mov dword [esp + 0x20], edi
mov edi, edx
mov ecx, 0xc49
mov edx, esi
call fcn.004015e0
mov edx, edi
mov ecx, esi
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0xa0]
jmp 0x40702a
mov ebx, dword [esp + 0xc]
mov eax, ebx
neg eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
cmp eax, 0xb3c
je 0x407067
cmp eax, 0xddd
jne 0x407079
cmp edi, 0xffffffff
je 0x407071
test edi, edi
je 0x407147
mov esi, edx
mov eax, 0xddd
xor edx, edx
idiv edi
mov dword [esp + 0x18], edx
mov edx, esi
mov esi, dword [esp + 0xa0]
jmp 0x407079
mov dword [esp + 0x18], 0x3cd00000
jmp 0x407079
mov dword [esp + 0x18], 0
cmp esi, 0x282
jne 0x40709c
mov esi, edx
mov edx, dword [esp + 0x14]
mov ecx, 0x282
call fcn.004015e0
mov ecx, dword [esp + 0x90]
mov edx, esi
mov esi, eax
cmp ebx, 0x95ff3983
je 0x4070bb
cmp ebx, 0x95ff3e10
je 0x4070d7
cmp ebx, 0x95ff4540
jne 0x4070e6
mov ebx, 0x4045ff95
jmp 0x4070e6
mov ebx, 0x95ff3983
xor eax, eax
cmp ebx, dword [esp + 0x1c]
setns al
add eax, 0x7fffffff
sub ebx, dword [esp + 0x1c]
cmovo ebx, eax
jmp 0x4070e6
mov eax, ecx
mov ebx, 0x95ff3e10
mov ecx, dword [esp + 0x40]
shl ebx, cl
mov ecx, eax
test ecx, ecx
je 0x407112
cmp ecx, 0x734
je 0x407109
cmp ecx, 0xb14
je 0x407129
cmp ecx, 0xdd5
jne 0x407136
mov ecx, 0xd50d0000
jmp 0x407136
mov ecx, 0x734
sub ecx, esi
jmp 0x407136
mov ecx, esi
xor eax, eax
neg ecx
mov ecx, esi
setns al
add eax, 0x7fffffff
neg ecx
cmovo ecx, eax
jmp 0x407136
mov eax, 0xb14
mov ecx, dword [esp + 0x40]
shr eax, cl
mov ecx, eax
cmp edx, 0x77c
jne 0x407156
cmp edi, 0xffffffff
je 0x407149
test edi, edi
jne 0x40714d
ud2
xor edx, edx
jmp 0x407156
mov eax, 0x77c
xor edx, edx
idiv edi
mov dword [esp + 0x70], edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x90], ecx
cmp edx, 0xf05a1618
je 0x407185
cmp edx, 0xf05a15d3
jne 0x40719e
mov eax, 0xf05a15d3
mov ecx, dword [esp + 0x90]
sar eax, cl
jmp 0x407193
mov edx, dword [esp + 0x18]
mov ecx, 0xf05a1618
call fcn.004015e0
mov ecx, dword [esp + 0x90]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x40]
mov edx, ebx
test eax, eax
je 0x4071ca
cmp eax, 0x126
je 0x4071c3
cmp eax, 0xca9
jne 0x4071cc
add esp, 0x530
mov eax, 0xca9
jmp 0x4071cc
mov eax, 0x64800000
jmp 0x4071cc
mov eax, ecx
mov ecx, edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x40], eax
mov ebx, 0xaa1
mov eax, 0xc3c
mov dword [esp + 0x8c], 0xe19
mov dword [esp + 0x38], 0xb64
mov dword [esp + 0xd0], 0xf82
mov dword [esp + 0x3c], 0x6b3
mov dword [esp + 0x17c], 0x38f8
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x17c]
mov dword [esp + 0xbc], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edx
sub eax, 1
jb 0x4074d9
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x17c], eax
mov edi, 0x80000000
mov dword [esp + 0x3c], 0
lea eax, [ecx + edx]
sar eax, 0x1f
xor eax, edi
add ecx, edx
mov edx, 0xf0f0f0f
cmovo ecx, eax
bswap ecx
mov eax, ecx
and ecx, edx
shr eax, 4
shl ecx, 4
and eax, edx
mov edx, 0x33333333
or ecx, eax
mov eax, ecx
shr ecx, 2
and eax, edx
and ecx, edx
mov edx, 0x55555555
lea eax, [ecx + eax*4]
mov ecx, eax
shr eax, 1
and ecx, edx
and eax, edx
mov edx, 0
lea ebx, [eax + ecx*2]
mov ecx, dword [esp + 0x90]
lea eax, [ebx + ecx]
sar eax, 0x1f
xor eax, edi
add ebx, ecx
cmovo ebx, eax
mov eax, dword [esp + 0xd0]
cmp eax, 0xffffffff
je 0x4072e5
test eax, eax
je 0x407147
mov eax, dword [esp + 0x60]
mov edi, dword [esp + 0xbc]
xor edx, edx
sub eax, dword [esp + 0x10]
cmp eax, edi
setns dl
add edx, 0x7fffffff
sub eax, edi
cmovo eax, edx
cdq
idiv dword [esp + 0xd0]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x20]
mov edi, 0xf0f0f0f
sub ebx, esi
mov dword [esp + 0x18], ebx
bswap edx
mov eax, edx
and edx, edi
shr eax, 4
shl edx, 4
and eax, edi
mov edi, 0x33333333
or edx, eax
mov eax, edx
shr edx, 2
and eax, edi
and edx, edi
mov edi, 0x55555555
lea eax, [edx + eax*4]
mov edx, eax
shr eax, 1
and edx, edi
and eax, edi
lea eax, [eax + edx*2]
mov edx, dword [esp + 0x38]
mov dword [esp + 0x20], eax
call fcn.004015c4
mov edx, dword [esp + 0x10]
mov ecx, eax
call fcn.004015e0
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x70]
mov ecx, eax
mov dword [esp + 0x90], eax
xor eax, eax
mov ebx, 0x7fffffff
add edi, edx
sar edi, cl
mov ecx, dword [esp + 0x40]
cmp edi, ecx
setns al
add eax, ebx
sub edi, ecx
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x5c]
cmovo edi, eax
imul esi, dword [esp + 0x38]
mov dword [esp + 0x70], edi
lea eax, [esi + ebx]
sar eax, 0x1f
add eax, 0x80000000
add esi, ebx
cmovo esi, eax
shl esi, cl
mov ecx, dword [esp + 0x20]
shl edx, cl
mov ecx, dword [esp + 0x8c]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0xc]
mov dword [esp + 0xa0], esi
mov esi, edx
sub esi, edi
mov edi, 0x7fffffff
mov eax, esi
xor eax, ecx
shr eax, 0x1f
add eax, edi
imul esi, ecx
mov ecx, ebx
cmovo esi, eax
sar esi, cl
mov ecx, dword [esp + 0x10]
call fcn.004015c4
mov edi, dword [esp + 0x20]
mov ecx, eax
cmp edi, 0xffffffff
je 0x407407
test edi, edi
je 0x407147
mov ebx, dword [esp + 0xc]
mov eax, dword [esp + 0x8c]
lea edx, [eax + ebx]
sar edx, 0x1f
add edx, 0x80000000
add eax, ebx
cmovo eax, edx
cdq
idiv edi
mov dword [esp + 0x3c], edx
bswap esi
mov edi, 0xf0f0f0f
mov dword [esp + 0x1d8], ecx
mov ecx, 0x33333333
mov ebx, dword [esp + 0xc]
mov eax, esi
and esi, edi
shr eax, 4
shl esi, 4
and eax, edi
or esi, eax
sub dword [esp + 0x14], ebx
mov eax, esi
shr esi, 2
and eax, ecx
and esi, ecx
lea eax, [esi + eax*4]
mov esi, 0x55555555
mov edx, eax
shr eax, 1
and edx, esi
and eax, esi
lea eax, [eax + edx*2]
mov edx, dword [esp + 0xd0]
mov dword [esp + 0x1c], eax
bswap edx
mov eax, edx
and edx, edi
shr eax, 4
shl edx, 4
and eax, edi
mov edi, dword [esp + 0xbc]
or edx, eax
mov eax, edx
shr edx, 2
and eax, ecx
and edx, ecx
mov ecx, dword [esp + 0x60]
lea eax, [edx + eax*4]
mov edx, eax
shr eax, 1
and edx, esi
and eax, esi
mov esi, dword [esp + 0x5c]
lea eax, [eax + edx*2]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x60], ecx
mov dword [esp + 0xd0], eax
mov eax, ecx
mov ecx, ebx
mov ebx, dword [esp + 0x1d8]
mov dword [esp + 0x38], ecx
imul eax, esi
mov dword [esp + 0x40], esi
add eax, edx
mov dword [esp + 0x8c], edx
mov edx, dword [esp + 0x1c]
imul eax, esi
mov esi, dword [esp + 0x10]
mov dword [esp + 0xc0], esi
mov esi, dword [esp + 0xa0]
jmp 0x407211
mov ebx, dword [esp + 0xc0]
mov eax, dword [esp + 0x18]
cmp ebx, 7
je 0x407509
mov edx, dword [esp + 0x70]
cmp ebx, 0xb
je 0x407518
cmp ebx, 0x10
jne 0x40751d
push 0x10
pop ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xd0]
shr ebx, cl
jmp 0x40751d
add esp, 0xf27
push 7
pop ebx
mov edx, dword [esp + 0x70]
jmp 0x40751d
mov ebx, 0xd0000000
cmp edi, 0xf
jne 0x407534
push 0xf
pop ecx
mov edx, esi
call fcn.004015c4
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x70]
mov edi, dword [esp + 0xc]
cmp eax, 0x80000a9d
jne 0x407551
mov edx, dword [esp + 0x40]
mov ecx, 0x80000a9d
call fcn.004015e0
mov edx, dword [esp + 0x70]
neg esi
jno 0x407567
mov edx, dword [esp + 0x38]
mov ecx, 0x80000000
call fcn.004015c4
mov edx, dword [esp + 0x70]
cmp dword [esp + 0xbc], 0xfffffffc
jne 0x407581
push 0xfffffffffffffffc
pop ecx
mov edx, dword [esp + 0x10]
call fcn.004015e0
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x90]
lea ecx, [eax - 1]
ror ecx, 1
cmp ecx, 6
ja 0x4075d2
mov ecx, dword [ecx*4 + 0x409d00]
add ecx, dword [esp + 0x178]
jmp ecx
cmp edx, 0xe6e
jne 0x4075e0
sub esp, 0x586
cmp dword [esp + 0x14], 0xccc
jne 0x4075f0
sub esp, 0xbe4
mov esi, eax
lea eax, [edi - 5]
cmp eax, 7
ja 0x407639
mov ecx, dword [esp + 0x178]
add ecx, dword [eax*4 + 0x409d1c]
jmp ecx
cmp dword [esp + 0x40], 0x11d
jne 0x40764b
add esp, 0x8fe
ud2
cmp dword [esp + 0x8c], 0xefde934c
jne 0x407664
mov ecx, 0xefde934c
mov edx, edi
call fcn.004015e0
cmp dword [esp + 0x5c], 0x3ba
jne 0x407674
add esp, 0xb40
cmp dword [esp + 0x3c], 0xefdea309
jne 0x407699
mov ecx, esi
push 0xfffffffffffffff8
pop edx
mov edi, dword [esp + 0x38]
shl edx, cl
mov ecx, 0xefdea309
cmp edi, 0xfffffff8
cmovne edx, edi
call fcn.004015c4
and dword [esp + 0x13c], 0
mov dword [esp + 0x1dc], 0x55
push 0x18
pop eax
mov eax, dword fs:[eax]
lea edx, [esp + 0x6e0]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
and dword [edx], 0
mov dword [edx + 4], 3
lea ecx, [eax + 0xc]
lea esi, [eax + 0x14]
add eax, 0x1c
mov dword [edx + 8], ecx
mov dword [edx + 0xc], esi
mov dword [edx + 0x10], eax
and dword [edx + 0x14], 0
lea ecx, [esp + 0x440]
lea edx, [esp + 0x6e0]
call fcn.004010c5
test byte [esp + 0x440], 1
je 0x407994
mov eax, dword [esp + 0x444]
mov ecx, dword [esp + 0x448]
shl eax, 3
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, dword [ecx]
cmp ecx, dword [esp + 0x10]
je 0x4076df
mov dword [esp + 0x20], ecx
sub ecx, dword [esp + 0xc]
xor esi, esi
movzx ebx, word [ecx + 0x2c]
mov eax, dword [ecx + 0x30]
mov dword [esp + 0x14], ecx
sub ebx, 1
jb 0x40775c
movzx edx, byte [eax]
mov ecx, edx
lea edi, [edx - 0x41]
or ecx, 0x20
cmp edi, 0x1a
cmovae ecx, edx
imul edx, esi, 0x1003f
add edx, ecx
test ecx, ecx
cmovne esi, edx
inc eax
jmp 0x407736
mov ecx, dword [esp + 0x20]
cmp esi, 0xd22e2014
jne 0x407719
mov eax, dword [esp + 0x14]
mov edi, dword [eax + 0x18]
mov ecx, edi
mov edx, 0x2ed1f2c9
call fcn.00402672
mov esi, eax
mov eax, 0xc0
mov eax, dword fs:[eax]
test eax, eax
setne al
push 0x34
pop edx
mov ecx, 0xd2
cmove ecx, edx
neg al
mov edx, 0x100
or al, 0xf
sub edx, 1
jb 0x407147
cmp byte [esi], al
jne 0x4077b0
cmp byte [esi + 1], cl
je 0x4077b3
inc esi
jmp 0x40779e
mov ecx, edi
mov edx, 0xeef3794a
call fcn.00402672
mov ecx, edi
mov edx, 0x7fbeec6d
mov dword [esp + 0x20], eax
call fcn.00402672
mov ecx, edi
mov edx, 0xcf995029
mov dword [esp + 0x10], eax
call fcn.00402672
mov ecx, edi
mov edx, 0x36162edc
mov dword [esp + 0xc], eax
call fcn.00402672
mov dword [esp + 0x14], eax
xorps xmm0, xmm0
lea eax, [esp + 0x13c]
and dword [esp + 0x6ec], 0
movsd qword [esp + 0x6e4], xmm0
or dword [esp + 0x6f0], 0xffffffff
mov dword [esp + 0x6f4], eax
and dword [esp + 0x6f8], 0
lea eax, [esp + 0x1dc]
mov dword [esp + 0x6fc], eax
mov dword [esp + 0x700], 0x3000
mov dword [esp + 0x704], 4
mov dword [esp + 0x6e0], esi
push 0x18
pop eax
mov eax, dword fs:[eax]
mov ecx, dword [eax + 0x30]
movzx eax, word [ecx + 0xac]
cmp ax, 0x55ef
jbe 0x40786b
push 0xb
pop edx
jmp 0x407871
mov edx, dword [ecx + 0xa4]
lea ecx, [esp + 0x440]
lea esi, [0x40fd58]
mov dword [ecx], 0x40fc80
mov dword [ecx + 4], esi
push eax
call fcn.00402601
pop ecx
mov ecx, eax
mov ebx, eax
call fcn.004016ee
mov edi, dword [ebx + 4]
mov edx, 0x40fdf0
mov ebx, 0x98
mov esi, 0x40fd58
mov eax, 0xc0
mov eax, dword fs:[eax]
lea ecx, [edx + ebx]
add ebx, esi
test eax, eax
lea eax, [esp + 0x440]
cmove edx, esi
cmovne ebx, ecx
lea ecx, [esp + 0x440]
mov dword [eax], edx
mov edx, 0x2ed1f2c9
mov dword [eax + 4], ebx
call fcn.004025e1
mov ecx, eax
mov esi, eax
call fcn.004016dd
cmp edi, 0x87804835
je 0x40799b
cmp edi, 0xcbed7875
je 0x40799f
cmp edi, 0x87fe57b6
je 0x4079a3
cmp edi, 0x887c6733
je 0x4079a7
cmp edi, 0x887c6739
je 0x4079ab
cmp edi, 0x88fa76b4
je 0x4079af
cmp edi, 0x88fa76ba
je 0x4079b3
cmp edi, 0x89788635
je 0x4079b7
cmp edi, 0x8978863b
je 0x4079bb
cmp edi, 0xb390cb6c
je 0x4079bf
cmp edi, 0xb3c8d932
je 0x4079c3
cmp edi, 0xb446e8b2
je 0x4079c7
cmp edi, 0xb446e8b3
je 0x4079cb
cmp edi, 0xb4c4f834
je 0x4079cf
cmp edi, 0xca7349f2
je 0x4079d3
cmp edi, 0xcaf15973
je 0x4079d7
cmp edi, 0xcb6f68f4
je 0x4079db
cmp edi, 0x8781486e
jne 0x408e3c
push 0x2c
jmp 0x4079dd
xor edi, edi
jmp 0x40776f
push 0x28
jmp 0x4079dd
push 0x18
jmp 0x4079dd
push 0x14
jmp 0x4079dd
push 0x3c
jmp 0x4079dd
push 4
jmp 0x4079dd
push 0x40
jmp 0x4079dd
push 0x48
jmp 0x4079dd
push 0x34
jmp 0x4079dd
push 0x38
jmp 0x4079dd
push 0x1c
jmp 0x4079dd
push 0xc
jmp 0x4079dd
push 0x10
jmp 0x4079dd
push 0x44
jmp 0x4079dd
push 0x20
jmp 0x4079dd
push 0x30
jmp 0x4079dd
push 8
jmp 0x4079dd
push 0x24
pop eax
mov eax, dword [esi + eax]
and dword [esp + 0x440], 0
mov dword [esp + 0x6e4], eax
and dword [esp + 0x6e8], 0
mov dword [esp + 0x6ec], 6
push 0
lea eax, [esp + 0x6e4]
push eax
push 0x401047
lea eax, [esp + 0x44c]
push eax
call dword [esp + 0x30]
push dword [esp + 0x440]
call dword [esp + 0x14]
push 0
push dword [esp + 0x444]
call dword [esp + 0x14]
push dword [esp + 0x440]
call dword [esp + 0x18]
mov ebx, dword [esp + 0x13c]
test ebx, ebx
je 0x407147
push 0x55
pop esi
lea edi, [esp + 0x9d7]
push esi
push 0x40f42a
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [esp + 0x254]
mov dword [eax - 8], edi
mov dword [eax - 4], esi
and dword [eax], 0
mov dword [eax + 4], 1
and dword [eax + 8], 0
lea ecx, [esp + 0x254]
call fcn.00402631
test al, 1
je 0x408e46
mov esi, dword [esp + 0x250]
mov edi, dword [esp + 0x25c]
mov edx, dword [esp + 0x24c]
lea ecx, [esi - 0x48]
lea eax, [edi + 1]
mov dword [esp + 0x20], edx
mov dword [esp + 0x25c], eax
lea eax, [edx + 0x38]
mov dword [esp + 0xc], ecx
push ecx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp esi, 0x17
jbe 0x407147
mov ecx, esi
cmp esi, 0x37
jbe 0x407147
shl edi, 5
cmp edi, 0xffffffe0
je 0x407147
lea eax, [edi - 0x7e1]
mov dword [esp + 0x10], ebx
cmp eax, 0xfffff7ff
jb 0x407147
movsd xmm0, qword [edi + 0x40f497]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
movsd qword [esp + 0x298], xmm0
movsd xmm0, qword [edi + 0x40f48f]
lea eax, [edx + 0x18]
mov dword [esp + 0x18], eax
lea eax, [edx + ecx]
lea edx, [esp + 0x450]
lea ecx, [esp + 0xe0]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x280]
mov dword [esp + 0x1a0], eax
lea eax, [esp + 0x2a0]
mov dword [esp + 0x1a4], 0x20
movsd qword [esp + 0x290], xmm0
movsd xmm0, qword [edi + 0x40f487]
mov dword [esp + 0x1a8], eax
and dword [esp + 0x1ac], 0
lea eax, [esp + 0x1a0]
mov dword [esp + 0x1b0], 4
movsd qword [esp + 0x288], xmm0
movsd xmm0, qword [edi + 0x40f47f]
movsd qword [esp + 0x280], xmm0
xorps xmm0, xmm0
movsd qword [edx + 0x28], xmm0
movsd qword [edx + 0x20], xmm0
movsd qword [edx + 0x18], xmm0
movsd qword [edx + 0x10], xmm0
movsd qword [edx + 8], xmm0
movsd qword [edx], xmm0
mov dword [esp + 0x44c], 0x6b206574
mov dword [esp + 0x448], 0x79622d32
mov dword [esp + 0x444], 0x3320646e
mov dword [esp + 0x440], 0x61707865
push eax
lea eax, [esp + 0x474]
push eax
call fcn.00401621
pop eax
pop ecx
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xe8]
mov edx, dword [esp + 0xf8]
mov ebx, dword [esp + 0xfc]
mov edi, dword [esp + 0x100]
cmp ebx, edi
jae 0x407c43
cmp edx, 4
jne 0x407147
mov esi, dword [ecx + ebx*4]
mov dword [eax + ebx*4], esi
inc ebx
jmp 0x407c2d
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0xe0]
lea edx, [esp + 0x470]
mov dword [esp + 0x180], eax
add eax, 0x10
mov dword [esp + 0x184], 0x10
mov dword [esp + 0x188], eax
and dword [esp + 0x18c], 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x180]
mov dword [esp + 0x190], 4
push eax
lea eax, [esp + 0x484]
push eax
call fcn.00401621
pop eax
pop ecx
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xe8]
mov edx, dword [esp + 0xf8]
mov ebx, dword [esp + 0xfc]
mov edi, dword [esp + 0x100]
cmp ebx, edi
jae 0x407cd8
cmp edx, 4
jne 0x407147
mov esi, dword [ecx + ebx*4]
mov dword [eax + ebx*4], esi
inc ebx
jmp 0x407cc2
push 0xa
pop edi
sub edi, 1
jb 0x407dac
xor ecx, ecx
push 4
pop edx
lea esi, [esp + 0x440]
push esi
push 0xc
pop eax
push eax
push 8
pop eax
push eax
call fcn.00409f21
add esp, 0xc
xor ecx, ecx
inc ecx
push 5
pop edx
push esi
push 0xd
pop esi
push esi
push 9
pop eax
push eax
call fcn.00409f21
add esp, 0xc
push 2
pop ecx
push 6
pop edx
lea ebx, [esp + 0x440]
push ebx
push 0xe
pop eax
push eax
push 0xa
pop esi
push esi
call fcn.00409f21
add esp, 0xc
push 3
pop ecx
push 7
pop edx
push ebx
mov esi, ebx
push 0xf
pop ebx
push ebx
push 0xb
pop eax
push eax
call fcn.00409f21
add esp, 0xc
xor ecx, ecx
push 5
pop edx
push esi
push ebx
push 0xa
pop eax
push eax
call fcn.00409f21
add esp, 0xc
xor ecx, ecx
inc ecx
push 6
pop edx
push esi
push 0xc
pop eax
push eax
push 0xb
pop eax
push eax
call fcn.00409f21
add esp, 0xc
push 2
pop ecx
push 7
pop edx
push esi
push 0xd
pop eax
push eax
push 8
pop eax
push eax
call fcn.00409f21
add esp, 0xc
push 3
pop ecx
push 4
pop edx
push esi
push 0xe
pop eax
push eax
push 9
pop eax
push eax
call fcn.00409f21
add esp, 0xc
jmp 0x407cdb
lea eax, [esp + 0x1e0]
xorps xmm0, xmm0
lea ecx, [esp + 0xe0]
lea edx, [esp + 0x140]
mov dword [esp + 0x148], eax
lea eax, [esp + 0x1f0]
mov dword [esp + 0x14c], 0x10
movaps xmmword [esp + 0x1f0], xmm0
movaps xmmword [esp + 0x1e0], xmm0
mov dword [esp + 0x140], eax
and dword [esp + 0x144], 0
lea eax, [esp + 0x440]
mov dword [esp + 0x150], 4
push eax
call fcn.0040168a
pop eax
mov eax, dword [esp + 0xe8]
mov ecx, dword [esp + 0xf0]
mov edx, dword [esp + 0xf4]
mov edi, dword [esp + 0xfc]
mov ebx, dword [esp + 0x100]
cmp edi, ebx
jae 0x407e52
test eax, eax
je 0x407e52
cmp ecx, 4
jne 0x407147
mov esi, dword [edx + edi*4]
mov dword [eax + edi*4], esi
inc edi
jmp 0x407e38
lea eax, [esp + 0x1f0]
lea ecx, [esp + 0xe0]
lea edx, [esp + 0x140]
mov dword [esp + 0x148], eax
lea eax, [esp + 0x200]
mov dword [esp + 0x14c], 0x10
mov dword [esp + 0x140], eax
and dword [esp + 0x144], 0
lea eax, [esp + 0x470]
mov dword [esp + 0x150], 4
push eax
call fcn.0040168a
pop eax
mov eax, dword [esp + 0xe8]
mov ecx, dword [esp + 0xf0]
mov edx, dword [esp + 0xf4]
mov edi, dword [esp + 0xfc]
mov ebx, dword [esp + 0x100]
cmp edi, ebx
jae 0x407ee5
test eax, eax
je 0x407ee5
cmp ecx, 4
jne 0x407147
mov esi, dword [edx + edi*4]
mov dword [eax + edi*4], esi
inc edi
jmp 0x407ecb
movaps xmm0, xmmword [esp + 0x1e0]
movaps xmm1, xmmword [esp + 0x1f0]
mov eax, dword [esp + 0x20]
and dword [esp + 0x1a0], 0
lea edx, [esp + 0x450]
lea ecx, [esp + 0xe0]
movaps xmmword [esp + 0x2b0], xmm1
movaps xmmword [esp + 0x2a0], xmm0
movsd xmm0, qword [eax]
lea eax, [esp + 0x2a0]
mov dword [esp + 0x140], eax
lea eax, [esp + 0x2c0]
mov dword [esp + 0x144], 0x20
mov dword [esp + 0x148], eax
and dword [esp + 0x14c], 0
lea eax, [esp + 0x140]
mov dword [esp + 0x150], 4
movsd qword [esp + 0x1a4], xmm0
xorps xmm0, xmm0
movsd qword [edx + 0x28], xmm0
movsd qword [edx + 0x20], xmm0
movsd qword [edx + 0x18], xmm0
movsd qword [edx + 0x10], xmm0
movsd qword [edx + 8], xmm0
movsd qword [edx], xmm0
mov dword [esp + 0x44c], 0x6b206574
mov dword [esp + 0x448], 0x79622d32
mov dword [esp + 0x444], 0x3320646e
mov dword [esp + 0x440], 0x61707865
push eax
lea eax, [esp + 0x474]
push eax
call fcn.00401621
pop eax
pop ecx
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xe8]
mov edx, dword [esp + 0xf8]
mov edi, dword [esp + 0xfc]
mov esi, dword [esp + 0x100]
cmp edi, esi
jae 0x408002
cmp edx, 4
jne 0x407147
mov ebx, dword [ecx + edi*4]
mov dword [eax + edi*4], ebx
inc edi
jmp 0x407fec
lea eax, [esp + 0x1a0]
lea ecx, [esp + 0xe0]
lea edx, [esp + 0x474]
mov dword [esp + 0x1e0], eax
lea eax, [esp + 0x1ac]
mov dword [esp + 0x1e4], 0xc
mov dword [esp + 0x1e8], eax
and dword [esp + 0x1ec], 0
lea eax, [esp + 0x1e0]
mov dword [esp + 0x1f0], 4
push eax
lea eax, [esp + 0x484]
push eax
call fcn.00401621
pop eax
pop ecx
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xe8]
mov edx, dword [esp + 0xf8]
mov edi, dword [esp + 0xfc]
mov esi, dword [esp + 0x100]
cmp edi, esi
jae 0x40809a
cmp edx, 4
jne 0x407147
mov ebx, dword [ecx + edi*4]
mov dword [eax + edi*4], ebx
inc edi
jmp 0x408084
mov al, byte [0x523600]
cmp al, 0xff
jne 0x408173
lea ecx, [esp + 0x180]
call fcn.00409f73
lea ecx, [esp + 0xe0]
call fcn.00409f90
mov ecx, 0x40fe8a
mov edx, 0x40fe8d
call fcn.0040a335
test al, al
je 0x4080f0
mov ebx, dword [esp + 0x188]
mov eax, ebx
not eax
test eax, 0xc000000
jne 0x408157
call fcn.004016ff
and eax, 2
shr eax, 1
jmp 0x408159
mov ecx, 0x40fe8a
mov edx, 0x40fe8a
call fcn.0040a335
test al, al
je 0x408120
mov ebx, dword [esp + 0x188]
mov eax, ebx
not eax
test eax, 0xc000000
jne 0x408157
call fcn.004016ff
not eax
test al, 6
jmp 0x408152
mov ecx, 0x40fe8a
mov edx, 0x40fe90
call fcn.0040a335
mov ebx, dword [esp + 0x188]
mov ecx, eax
mov al, 1
test cl, cl
je 0x408159
mov eax, ebx
not eax
test eax, 0xc000000
jne 0x408157
call fcn.004016ff
not eax
test al, 0xe6
sete al
jmp 0x408159
xor eax, eax
mov ecx, dword [esp + 0xe4]
shr ebx, 0x1c
and bl, al
and ecx, 0x20
shr ecx, 5
and bl, cl
mov byte [0x523600], bl
push 0x10
pop edx
lea ebx, [esp + 0x440]
mov ecx, edx
lea edi, [esp + 0x33c]
xor eax, eax
xorps xmm0, xmm0
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x37c]
mov edi, edx
rep stosd dword es:[edi], eax
mov byte [edx + 0x40], 0
movaps xmmword [esp + 0x230], xmm0
movaps xmmword [esp + 0x220], xmm0
lea ecx, [esp + 0x33c]
lea edx, [esp + 0x220]
push 0x20
call fcn.00401705
pop eax
mov al, byte [0x523601]
cmp al, 0xff
je 0x4087d5
cmp al, 1
jne 0x4088a2
lea esi, [esp + 0x440]
lea edx, [esp + 0x220]
mov ecx, esi
call fcn.0040c2a6
movaps xmm1, xmmword [esp + 0x450]
lea eax, [esp + 0x450]
movaps xmm0, xmmword [esp + 0x440]
lea edx, [esp + 0x2a0]
mov ecx, esi
movaps xmm3, xmmword [eax + 0x10]
movaps xmm2, xmmword [eax + 0x30]
movaps xmmword [esp + 0xa0], xmm1
movaps xmm1, xmmword [eax + 0x20]
movaps xmmword [esp + 0x90], xmm0
movaps xmmword [esp + 0x2a0], xmm3
movaps xmmword [esp + 0x2c0], xmm2
movaps xmmword [esp + 0x2b0], xmm1
movaps xmm1, xmmword [eax + 0x40]
movaps xmmword [esp + 0x2d0], xmm1
push edx
call fcn.0040a42e
pop eax
movaps xmm1, xmmword [esp + 0x470]
movaps xmm0, xmmword [esp + 0x460]
movaps xmm2, xmmword [esp + 0x440]
xor edx, edx
lea ecx, [esp + 0x3c0]
mov esi, ecx
dec edx
movaps xmmword [esp + 0x60], xmm1
movaps xmm1, xmmword [esp + 0x450]
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x20], xmm2
movaps xmmword [esp + 0x70], xmm1
push 0
mov eax, 0x3ffffff
push eax
push 0
push eax
push 0
push eax
push 0xffffffffffffffff
call fcn.0040a9a1
add esp, 0x1c
movaps xmm0, xmmword [esp + 0x70]
movaps xmm1, xmmword [esp + 0x20]
lea ecx, [esp + 0x2e0]
lea edx, [esp + 0x300]
movaps xmmword [esp + 0x310], xmm0
movaps xmmword [esp + 0x300], xmm1
push esi
call fcn.0040ac0a
pop eax
lea ecx, [esp + 0x400]
mov ebx, ecx
push 0x40
pop edx
push 0
push 0x1a
pop esi
push esi
push 0
push esi
push 0
push esi
push 0
call fcn.0040a9a1
add esp, 0x1c
movaps xmm0, xmmword [esp + 0x70]
movaps xmm1, xmmword [esp + 0x20]
lea edi, [esp + 0x680]
lea edx, [esp + 0x3e0]
mov ecx, edi
movaps xmmword [esp + 0x3f0], xmm0
movaps xmmword [esp + 0x3e0], xmm1
push ebx
call fcn.0040c31a
pop eax
lea esi, [esp + 0x6a0]
mov edx, edi
mov ecx, esi
call fcn.0040ac1e
lea edi, [esp + 0xe0]
lea edx, [esp + 0x2e0]
mov ecx, edi
push esi
call fcn.0040aa12
pop eax
movaps xmm0, xmmword [esp + 0xe0]
movaps xmm1, xmmword [esp + 0xf0]
lea ebx, [esp + 0x1a0]
lea edx, [esp + 0x260]
mov ecx, ebx
movaps xmmword [esp + 0xc0], xmm0
movaps xmmword [esp + 0xd0], xmm1
movaps xmmword [esp + 0x270], xmm1
movaps xmmword [esp + 0x260], xmm0
call fcn.0040c24c
lea esi, [esp + 0x140]
mov edx, ebx
mov ecx, esi
call fcn.0040ac1e
movaps xmm0, xmmword [esp + 0x60]
movaps xmm1, xmmword [esp + 0x40]
mov ecx, edi
lea edx, [esp + 0x180]
movaps xmmword [esp + 0x190], xmm0
movaps xmmword [esp + 0x180], xmm1
push esi
call fcn.0040aa12
pop eax
movaps xmm0, xmmword [esp + 0xe0]
movaps xmm1, xmmword [esp + 0xf0]
mov ecx, edi
mov edx, 0x3ffffff
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x70], xmm1
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
call fcn.0040a9a1
add esp, 0x1c
movaps xmm0, xmmword [esp + 0xd0]
movaps xmm1, xmmword [esp + 0xc0]
lea ecx, [esp + 0x420]
lea edx, [esp + 0x1e0]
movaps xmmword [esp + 0x1f0], xmm0
movaps xmmword [esp + 0x1e0], xmm1
push edi
call fcn.0040ac0a
pop eax
lea ebx, [esp + 0x6a0]
mov ecx, ebx
push 0x40
pop edx
push 0
push 0x1a
pop eax
push eax
push 0
push edx
push 0
push edx
push 0
call fcn.0040a9a1
add esp, 0x1c
movaps xmm0, xmmword [esp + 0x70]
movaps xmm1, xmmword [esp + 0x20]
mov ecx, edi
lea edx, [esp + 0x2e0]
movaps xmmword [esp + 0x2f0], xmm0
movaps xmmword [esp + 0x2e0], xmm1
push ebx
call fcn.0040c31a
pop eax
movaps xmm0, xmmword [esp + 0xe0]
movaps xmm1, xmmword [esp + 0xf0]
lea esi, [esp + 0x180]
lea eax, [esp + 0x260]
lea edx, [esp + 0x420]
mov ecx, esi
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x60], xmm1
movaps xmmword [esp + 0x270], xmm1
movaps xmmword [esp + 0x260], xmm0
push eax
call fcn.0040aa12
pop eax
movaps xmm0, xmmword [esp + 0x60]
movaps xmm1, xmmword [esp + 0x40]
lea ebx, [esp + 0x140]
lea edx, [esp + 0x1a0]
mov ecx, ebx
movaps xmmword [esp + 0x1b0], xmm0
movaps xmmword [esp + 0x1a0], xmm1
call fcn.0040c32f
mov ecx, edi
mov edx, esi
push ebx
call fcn.0040aa12
pop eax
movaps xmm0, xmmword [esp + 0xe0]
movaps xmm1, xmmword [esp + 0xf0]
mov ecx, edi
xor edx, edx
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x60], xmm1
push 0
mov eax, 0x3ffffff
push eax
push 0
push 0
push 0
push 0
push 0
call fcn.0040a9a1
add esp, 0x1c
movaps xmm0, xmmword [esp + 0x70]
movaps xmm1, xmmword [esp + 0x20]
lea ecx, [esp + 0x680]
lea edx, [esp + 0x1e0]
movaps xmmword [esp + 0x1f0], xmm0
movaps xmmword [esp + 0x1e0], xmm1
push edi
call fcn.0040ac0a
pop eax
xor edx, edx
lea esi, [esp + 0x3e0]
mov ecx, esi
dec edx
push 0
mov eax, 0x3ffffff
push eax
push 0
push eax
push 0
push eax
push 0xffffffffffffffff
call fcn.0040a9a1
add esp, 0x1c
movaps xmm0, xmmword [esp + 0x60]
movaps xmm1, xmmword [esp + 0x40]
lea ecx, [esp + 0x420]
lea edx, [esp + 0x3c0]
movaps xmmword [esp + 0x3d0], xmm0
movaps xmmword [esp + 0x3c0], xmm1
push esi
call fcn.0040ac0a
pop eax
lea ebx, [esp + 0x2e0]
mov ecx, ebx
push 0x40
pop edx
push 0
push 0x1a
pop eax
push eax
push 0
push eax
push 0
push eax
push 0
call fcn.0040a9a1
add esp, 0x1c
movaps xmm0, xmmword [esp + 0x60]
movaps xmm1, xmmword [esp + 0x40]
lea esi, [esp + 0x6a0]
lea edx, [esp + 0x400]
mov ecx, esi
movaps xmmword [esp + 0x410], xmm0
movaps xmmword [esp + 0x400], xmm1
push ebx
call fcn.0040c31a
pop eax
lea edi, [esp + 0x260]
mov edx, esi
mov ecx, edi
call fcn.0040ac1e
lea ebx, [esp + 0xe0]
lea edx, [esp + 0x420]
mov ecx, ebx
push edi
call fcn.0040aa12
pop eax
movaps xmm0, xmmword [esp + 0xe0]
movaps xmm1, xmmword [esp + 0xf0]
lea esi, [esp + 0x180]
lea edx, [esp + 0x1a0]
mov ecx, esi
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x70], xmm1
movaps xmmword [esp + 0x1b0], xmm1
movaps xmmword [esp + 0x1a0], xmm0
call fcn.0040c24c
lea edi, [esp + 0x140]
mov edx, esi
mov ecx, edi
call fcn.0040ac1e
lea ecx, [esp + 0x300]
lea edx, [esp + 0x680]
push edi
call fcn.0040aa12
pop eax
mov ecx, ebx
mov edx, 0x3ffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
call fcn.0040a9a1
add esp, 0x1c
movaps xmm0, xmmword [esp + 0x70]
movaps xmm1, xmmword [esp + 0x20]
lea ecx, [esp + 0x6c0]
lea edx, [esp + 0x1e0]
movaps xmmword [esp + 0x1f0], xmm0
movaps xmmword [esp + 0x1e0], xmm1
push ebx
call fcn.0040ac0a
pop eax
lea ecx, [esp + 0x180]
xor edx, edx
push 0
push 2
pop edi
push edi
push 4
pop ebx
push ebx
push 6
pop esi
push esi
push 0
push ebx
push esi
call fcn.0040a3b2
add esp, 0x1c
lea edi, [esp + 0x1e0]
lea eax, [esp + 0x180]
lea edx, [esp + 0x6c0]
mov ecx, edi
push eax
call fcn.0040a3f6
pop eax
lea ecx, [esp + 0x140]
xor edx, edx
push 0
push 2
pop eax
push eax
push ebx
push esi
push 0
push ebx
push esi
call fcn.0040a3b2
add esp, 0x1c
lea ebx, [esp + 0xe0]
lea eax, [esp + 0x140]
lea edx, [esp + 0x300]
mov ecx, ebx
push eax
call fcn.0040a3f6
pop eax
lea esi, [esp + 0x1a0]
mov edx, edi
mov ecx, esi
push ebx
call fcn.0040c340
pop eax
mov ecx, edi
mov edx, esi
call fcn.0040c156
lea ecx, [esp + 0x440]
call fcn.0040a347
push 0xffffffffffffffc0
pop eax
test eax, eax
je 0x4087c8
movsd xmm0, qword [esp + 0x440]
movsd xmm1, qword [esp + 0x448]
movsd qword [esp + eax + 0x128], xmm1
movsd qword [esp + eax + 0x120], xmm0
add eax, 0x10
jmp 0x40879b
mov dword [esp + 0x20], 0
jmp 0x40893b
lea ecx, [esp + 0xe0]
call fcn.00409f73
mov ecx, ebx
call fcn.00409f90
mov ecx, 0x40fe8a
mov edx, 0x40fe8d
call fcn.0040a335
test al, al
je 0x408819
mov ebx, dword [esp + 0xe8]
mov eax, ebx
not eax
test eax, 0xc000000
jne 0x408880
call fcn.004016ff
and eax, 2
shr eax, 1
jmp 0x408882
mov ecx, 0x40fe8a
mov edx, 0x40fe8a
call fcn.0040a335
test al, al
je 0x408849
mov ebx, dword [esp + 0xe8]
mov eax, ebx
not eax
test eax, 0xc000000
jne 0x408880
call fcn.004016ff
not eax
test al, 6
jmp 0x40887b
mov ecx, 0x40fe8a
mov edx, 0x40fe90
call fcn.0040a335
mov ebx, dword [esp + 0xe8]
mov ecx, eax
mov al, 1
test cl, cl
je 0x408882
mov eax, ebx
not eax
test eax, 0xc000000
jne 0x408880
call fcn.004016ff
not eax
test al, 0xe6
sete al
jmp 0x408882
xor eax, eax
mov ecx, dword [esp + 0x444]
shr ebx, 0x1c
and bl, al
and ecx, 0x20
shr ecx, 5
and bl, cl
mov byte [0x523601], bl
jne 0x4081db
mov ecx, dword [esp + 0x220]
mov ebx, dword [esp + 0x223]
mov eax, 0x3ffffff
mov edx, dword [esp + 0x226]
mov esi, dword [esp + 0x229]
mov edi, dword [esp + 0x22c]
and dword [esp + 0x190], 0
xorps xmm0, xmm0
movaps xmmword [esp + 0x180], xmm0
and ecx, eax
shr ebx, 2
mov eax, dword [esp + 0x230]
shr edx, 4
shr esi, 6
shr edi, 8
mov dword [esp + 0x70], ecx
mov ecx, dword [esp + 0x234]
and ebx, 0x3ffff03
and edx, 0x3ffc0ff
and esi, 0x3f03fff
and edi, 0xfffff
mov dword [esp + 0x20], eax
shr eax, 8
mov dword [esp + 0x40], ecx
mov ecx, ebx
mov ebx, dword [esp + 0x238]
mov dword [esp + 0x60], ebx
mov ebx, dword [esp + 0x23c]
mov dword [esp + 0xc0], ebx
mov ebx, dword [esp + 0x20]
movsd xmm0, qword [esp + 0x180]
movsd xmm1, qword [esp + 0x188]
mov byte [esp + 0x6e0], bl
mov word [esp + 0x6e1], ax
shr eax, 0x10
mov byte [esp + 0x6e3], al
mov eax, dword [esp + 0x40]
mov dword [esp + 0x6e4], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x6e8], eax
mov eax, dword [esp + 0xc0]
mov dword [esp + 0x6ec], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x6f0], eax
mov eax, dword [esp + 0x190]
mov dword [esp + 0x6f4], ecx
mov dword [esp + 0x6f8], edx
mov dword [esp + 0x6fc], esi
lea esi, [esp + 0x920]
mov dword [esp + 0x700], edi
movsd qword [esi - 0x214], xmm1
movsd qword [esi - 0x21c], xmm0
mov dword [esi - 0x20c], eax
push 0x108
lea edi, [esp + 0x444]
push edi
lea eax, [esp + 0x720]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movaps xmm1, xmmword [esp + 0x90]
movaps xmm0, xmmword [esp + 0xa0]
movaps xmm2, xmmword [esp + 0x2d0]
movaps xmm3, xmmword [esp + 0x1f0]
xor eax, eax
lea ecx, [esp + 0x220]
movaps xmmword [esp + 0x820], xmm1
movaps xmm1, xmmword [esp + 0x2c0]
movaps xmmword [esp + 0x830], xmm0
movaps xmmword [esi - 0xb0], xmm2
movaps xmm2, xmmword [esp + 0x2a0]
movaps xmmword [esi - 0xc0], xmm1
movaps xmm1, xmmword [esp + 0x2b0]
movaps xmmword [esi - 0xe0], xmm2
movaps xmm2, xmmword [esp + 0x1e0]
movaps xmmword [esi - 0xd0], xmm1
movaps xmm1, xmmword [esp + 0x210]
movaps xmmword [esi - 0x90], xmm3
movaps xmmword [esi - 0xa0], xmm2
movaps xmm3, xmmword [esp + 0xf0]
movaps xmm2, xmmword [esp + 0xe0]
movaps xmmword [esi - 0x70], xmm1
movaps xmm1, xmmword [esp + 0x200]
movaps xmmword [esi - 0x80], xmm1
movaps xmm1, xmmword [esp + 0x110]
movaps xmmword [esi - 0x60], xmm2
movaps xmmword [esi - 0x50], xmm3
movsd xmm2, qword [esp + 0x140]
movaps xmmword [esi - 0x30], xmm1
movaps xmm1, xmmword [esp + 0x100]
movaps xmmword [esi - 0x40], xmm1
and dword [esp + 0x900], 0
mov byte [esp + 0x904], al
mov eax, dword [esp + 0x157]
movsd xmm1, qword [esp + 0x150]
movsd qword [esi - 0x1b], xmm2
mov dword [esi - 4], eax
movsd qword [esi - 0xb], xmm1
movsd xmm1, qword [esp + 0x148]
movsd qword [esi - 0x13], xmm1
push 0x20
pop edx
call fcn.0040d176
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [esp + 0x36c], ebx
mov byte [esp + 0x3bc], al
push 0x84
lea edi, [esp + 0x340]
push edi
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, dword [esp + 0x18]
lea esi, [esp + 0x6e0]
mov ecx, esi
push 0x20
pop eax
push eax
call fcn.00401172
pop eax
mov ebx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, esi
push ebx
call fcn.00401172
pop eax
mov ecx, edi
call fcn.0040a347
push 0x20
pop eax
mov dword [esp + 0x33c], eax
and dword [esp + 0x340], 0
and dword [esp + 0x348], 0
mov dword [esp + 0x344], ebx
xor eax, eax
lea edi, [esp + 0x440]
mov ecx, esi
movsd xmm0, qword [esp + 0x344]
movsd xmm1, qword [esp + 0x33c]
inc eax
mov edx, edi
movsd qword [esp + 0x448], xmm0
movsd qword [esp + 0x440], xmm1
push eax
call fcn.004011c1
pop eax
push 0x240
push esi
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov al, byte [0x523601]
cmp al, 1
jne 0x408be9
lea ecx, [esp + 0xe0]
mov edx, edi
call fcn.0040ac2c
jmp 0x408d99
mov eax, dword [esp + 0x468]
mov edx, 0x3ffffff
mov ecx, eax
and eax, edx
shr ecx, 0x1a
add ecx, dword [esp + 0x46c]
mov edx, ecx
mov ebx, ecx
shr edx, 0x1a
add edx, dword [esp + 0x470]
mov dword [esp + 0x90], edx
shr edx, 0x1a
add edx, dword [esp + 0x474]
mov esi, dword [esp + 0x90]
mov ecx, edx
mov dword [esp + 0x70], edx
shr ecx, 0x1a
lea ecx, [ecx + ecx*4]
add ecx, dword [esp + 0x464]
mov edi, ecx
shr edi, 0x1a
add edi, eax
mov eax, 0x3ffffff
and ebx, eax
and esi, eax
mov eax, edx
mov edx, 0x3ffffff
and ecx, edx
and eax, edx
mov dword [esp + 0x90], esi
mov dword [esp + 0x40], ebx
lea edx, [ecx + 5]
mov dword [esp + 0xa0], ecx
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x20]
shr ecx, 0x1a
add ecx, edi
mov dword [esp + 0x60], ecx
shr ecx, 0x1a
add ecx, ebx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
shr ecx, 0x1a
add ecx, esi
mov esi, ecx
shr esi, 0x1a
lea edx, [esi + eax]
lea eax, [esi + eax - 0x4000000]
mov esi, eax
shr eax, 0x1f
mov dword [esp + 0xc0], edx
mov edx, 0x3ffffff
dec eax
sar esi, 0x1f
mov ebx, eax
and edi, esi
and eax, dword [esp + 0xc0]
and ebx, edx
mov edx, dword [esp + 0x60]
and dword [esp + 0x20], ebx
and dword [esp + 0x18], ebx
and edx, ebx
and ebx, ecx
mov ecx, dword [esp + 0xa0]
or edi, edx
mov edx, dword [esp + 0x90]
and ecx, esi
or ecx, dword [esp + 0x20]
and edx, esi
or edx, ebx
mov dword [esp + 0xa0], ecx
mov ecx, dword [esp + 0x40]
and ecx, esi
and esi, dword [esp + 0x70]
or ecx, dword [esp + 0x18]
or esi, eax
mov eax, edi
shr edi, 6
shl eax, 0x1a
mov ebx, ecx
shr ecx, 0xc
shl esi, 8
add eax, dword [esp + 0xa0]
shl ebx, 0x14
or ebx, edi
mov edi, edx
shr edx, 0x12
shl edi, 0xe
or esi, edx
or edi, ecx
lea ecx, [esp + 0x33c]
add eax, dword [esp + 0x440]
adc ebx, dword [esp + 0x444]
mov dword [esp + 0x20], eax
adc edi, dword [esp + 0x448]
adc esi, dword [esp + 0x44c]
call fcn.0040a347
mov eax, dword [esp + 0x20]
mov dword [esp + 0x33c], eax
mov dword [esp + 0x340], ebx
mov dword [esp + 0x344], edi
mov dword [esp + 0x348], esi
movsd xmm0, qword [esp + 0x33c]
movsd xmm1, qword [esp + 0x344]
movsd qword [esp + 0xe0], xmm0
movsd qword [esp + 0xe8], xmm1
mov edi, dword [esp + 0x1c]
mov bl, 1
push 0xfffffffffffffff0
pop esi
test esi, esi
je 0x408dc5
mov al, byte [edi + esi]
xor ecx, ecx
xor al, byte [esp + esi + 0xf0]
mov edx, eax
neg dl
or dl, al
setns cl
call fcn.0040d169
and bl, al
inc esi
jmp 0x408da2
movzx ecx, bl
call fcn.0040d169
mov esi, dword [esp + 0x10]
mov ebx, eax
test al, al
je 0x408dea
lea ecx, [esp + 0x920]
mov edx, esi
push dword [esp + 0xc]
call fcn.00401705
pop eax
lea ecx, [esp + 0x960]
push 0x40
pop edx
call fcn.0040d176
mov byte [esp + 0x9a0], 0
push 0xffffffffffffffc0
pop eax
mov ecx, dword [esp + 0x14]
test eax, eax
je 0x408e1c
mov dword [esp + eax + 0x960], 0
add eax, 4
jmp 0x408e08
test bl, bl
je 0x407147
mov ebx, esi
add ebx, ecx
lea ecx, [esp + 0x280]
push 0x20
pop edx
call fcn.0040d176
jmp 0x407a84
mov ecx, 0x656c7901
call fcn.0040d13b
mov edi, dword [esp + 0x13c]
lea esi, [esp + 0x6e0]
mov ecx, esi
call fcn.00401547
mov ecx, dword [esi + 4]
mov dword [ecx + 4], 1
mov dword [ecx + 8], edi
call fcn.00401611
xor ecx, ecx
inc ecx
cmp ecx, 0x6dc0
je 0x408ee5
lea eax, [ecx + 1]
imul ebx, ecx, 0x28
shl ecx, 4
xor edi, edi
mov dword [esp + 0x20], eax
push 0xfffffffffffffff0
pop edx
xor esi, esi
test ecx, ecx
je 0x408e9f
mov eax, 0x112600
sub eax, edi
add edi, ecx
cmp eax, ecx
ja 0x408ea7
jmp 0x408edf
cmp edi, 0x112600
je 0x408edf
lea eax, [edi + 1]
test edx, edx
je 0x408edf
test ebx, ebx
je 0x408ec1
mov ecx, 0x112600
sub ecx, esi
add esi, ebx
cmp ecx, ebx
ja 0x408ec9
jmp 0x408edf
cmp esi, 0x112600
je 0x408edf
mov cl, byte [esi + section..data]
inc esi
inc edx
xor ebx, ebx
mov byte [edi + section..data], cl
xor ecx, ecx
mov edi, eax
jmp 0x408e8c
mov ecx, dword [esp + 0x20]
jmp 0x408e70
mov eax, 0x6dc00
mov esi, section..data
xor edi, edi
test eax, eax
je 0x408f43
mov dword [esp + 0x20], edi
and edi, 0x780
mov ebx, 0x800
mov ecx, pe_nt_image_headers32
mov edx, pe_nt_image_headers32
sub ebx, edi
cmp eax, ecx
cmovb edx, eax
sub eax, edx
cmp edx, ebx
lea ecx, [esi + edx]
cmovae edx, ebx
xor ebx, ebx
mov dword [esp + 0x10], ecx
cmp edx, ebx
je 0x408f36
mov cl, byte [edi + ebx + 0x40f47f]
xor byte [esi + ebx], cl
inc ebx
jmp 0x408f25
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x10]
sub edi, 0xffffff80
jmp 0x408ef1
lea edx, [esp + 0x6e0]
and dword [edx], 0
mov byte [edx + 0xc], 0
mov dword [edx + 4], 0x411000
and dword [edx + 8], 0
xor ecx, ecx
inc ecx
call fcn.00402c9c
mov esi, 0x753
mov ebx, 0x9fc
mov ecx, 0x20e92
mov eax, 0x55555555
mov dword [esp + 0x20], 0xaec
mov dword [esp + 0x14], 0xe19
mov dword [esp + 0x10], 0x487
mov edx, ebx
sub ecx, 1
jb 0x408fe3
mov ebx, dword [esp + 0x10]
imul esi, edx
mov edi, 0xf0f0f0f
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], edx
bswap esi
bswap ebx
mov dword [esp + 0x10], ebx
mov ebx, esi
and esi, edi
shr ebx, 4
shl esi, 4
and ebx, edi
mov edi, 0x33333333
or esi, ebx
mov ebx, esi
shr esi, 2
and ebx, edi
and esi, edi
lea esi, [esi + ebx*4]
mov ebx, esi
shr esi, 1
and ebx, eax
and esi, eax
lea esi, [esi + ebx*2]
mov ebx, edx
bswap ebx
jmp 0x408f90
cmp dword [esp + 0x20], 0xfc090000
mov dword [esp + 0xc], edx
je 0x40901b
cmp dword [esp + 0x20], 0xfc090e6a
jne 0x409027
mov ecx, dword [esp + 0x10]
mov edx, 0xfc090e6a
xor eax, eax
cmp edx, ecx
setns al
add eax, 0x7fffffff
sub edx, ecx
cmovo edx, eax
mov dword [esp + 0x20], edx
jmp 0x409027
imul eax, dword [esp + 0x10], 0xfc090000
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x10]
mov ecx, 0xfc090ecc
mov edi, dword [esp + 0x14]
xor eax, eax
mov ebx, 0xfc090ecc
cmp ecx, edx
setns al
add eax, 0x7fffffff
sub ebx, edx
cmovo ebx, eax
cmp edi, ecx
cmovne ebx, edi
cmp edx, 0x37b
je 0x40907d
cmp dword [esp + 0x10], 0x39e
je 0x40908d
cmp dword [esp + 0x10], 0x46c
je 0x409095
cmp dword [esp + 0x10], 0x487
jne 0x4090a4
lea eax, [esi + 0x487]
jmp 0x4090a0
add esp, 0x1056
mov dword [esp + 0x10], 0x37b
jmp 0x4090a4
add esp, 0xa9e
ud2
mov eax, 0x46c
mov ecx, dword [esp + 0x20]
shr eax, cl
mov dword [esp + 0x10], eax
cmp esi, 0xacc
jne 0x4090c3
mov ecx, dword [esp + 0xc]
mov eax, ecx
shr eax, 0x1f
add eax, 0x7fffffff
imul esi, ecx, 0xacc
cmovo esi, eax
cmp dword [esp + 0xc], 0x9fc
je 0x4090ef
cmp dword [esp + 0xc], 0x778
je 0x4090fe
cmp dword [esp + 0xc], 0x2dd
jne 0x409111
mov ecx, 0x2dd
mov edx, esi
call fcn.004015c4
jmp 0x4090f8
mov eax, 0x9fc
sub eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
jmp 0x409111
mov eax, esi
mov ecx, 0x7fffffff
add eax, 0x778
cmovno ecx, eax
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x10]
mov ecx, 0x1c8bb
mov dword [esp + 0x14], 0xab0
sub ecx, 1
mov dword [esp + 0x10], ecx
jb 0x4091c1
mov ebx, dword [esp + 0xc]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x14]
mov ecx, ebx
and ecx, 0x1f
sar esi, cl
lea edx, [esi + edi]
sar edx, 0x1f
add edx, 0x80000000
add esi, edi
cmovo esi, edx
mov dword [esp + 0x20], esi
xor esi, esi
cmp ebx, 0xffffffff
je 0x40917f
test ebx, ebx
je 0x407147
add eax, 0xba6
mov edx, 0x7fffffff
cmovo eax, edx
add eax, 0xfffff45a
shl eax, cl
cdq
idiv ebx
mov esi, edx
mov eax, dword [esp + 0x20]
bswap eax
mov dword [esp + 0x20], eax
mov eax, ebx
mov ebx, 0xba6
add eax, ebx
cdq
idiv ebx
mov ecx, dword [esp + 0x14]
lea eax, [edx + esi]
sar eax, 0x1f
add eax, 0x80000000
add edx, esi
cmovo edx, eax
mov dword [esp + 0xc], edx
call fcn.004015c4
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov eax, esi
jmp 0x409122
cmp dword [esp + 0x20], 0
mov edi, ebx
mov dword [esp + 0x10], eax
je 0x4091ea
cmp dword [esp + 0x20], 0xb18
je 0x4091f0
cmp dword [esp + 0x20], 0xf52
jne 0x409207
sub esp, 0x41b
ud2
mov dword [esp + 0x20], esi
jmp 0x409207
mov eax, esi
shr eax, 0x1f
add eax, 0x7fffffff
imul ecx, esi, 0xb18
cmovo ecx, eax
mov dword [esp + 0x20], ecx
cmp edi, 0xba8
jne 0x40921d
mov ecx, 0xba8
mov edx, esi
call fcn.004015c4
mov edi, eax
cmp dword [esp + 0x10], 0x568
jne 0x40922d
sub esp, 0x119b
cmp esi, 0xc69
je 0x409247
cmp esi, 0x355
je 0x409253
test esi, esi
jne 0x40925e
mov esi, dword [esp + 0x14]
jmp 0x40925e
mov eax, dword [esp + 0xc]
lea esi, [eax + 0xc69]
jmp 0x40925e
sub esp, 0x8cb
mov esi, 0x355
cmp dword [esp + 0xc], 0x238
je 0x409284
cmp dword [esp + 0xc], 0x23f
je 0x40928e
cmp dword [esp + 0xc], 0x3e0
jne 0x40929d
lea eax, [edi + 0x3e0]
jmp 0x409299
imul eax, dword [esp + 0x20], 0x238
jmp 0x409299
mov eax, 0x23f
mov ecx, dword [esp + 0x10]
shr eax, cl
mov dword [esp + 0xc], eax
cmp dword [esp + 0x14], 0
je 0x4092cc
cmp dword [esp + 0x14], 0xf80
je 0x4092e9
cmp dword [esp + 0x14], 0x5c5
je 0x4092fb
cmp dword [esp + 0x14], 0x479
jne 0x409309
mov dword [esp + 0x14], 0x9e200000
jmp 0x409309
mov edx, dword [esp + 0x10]
xor eax, eax
mov ecx, edx
neg ecx
setns al
add eax, 0x7fffffff
neg edx
cmovo edx, eax
mov dword [esp + 0x14], edx
jmp 0x409309
mov ecx, 0xf80
mov edx, esi
call fcn.004015e0
mov dword [esp + 0x14], eax
jmp 0x409309
sub esp, 0x1039
mov dword [esp + 0x14], 0x5c5
mov ebx, edi
mov eax, 0x611
mov ecx, 0x60c
mov edi, 0xfa38
mov dword [esp + 0xd0], 0xc36
mov dword [esp + 0xa0], 0x28c
mov dword [esp + 0x18], 0xd27
mov dword [esp + 0xc0], 0xc43
mov dword [esp + 0x40], 0x374
mov dword [esp + 0x1c], 0x2fc
mov dword [esp + 0x60], 0xba6
sub edi, 1
mov dword [esp + 0x90], eax
mov dword [esp + 0x38], edi
jb 0x409615
mov ebx, dword [esp + 0xa0]
xor eax, eax
mov edi, 0x7fffffff
mov edx, 0x7fffffff
cmp ecx, ebx
setns al
add eax, edi
mov edi, ecx
sub edi, ebx
mov ebx, ecx
cmovo edi, eax
xor ecx, esi
mov eax, esi
shr ecx, 0x1f
mov dword [esp + 0x70], edi
mov edi, 0xf0f0f0f
add ecx, edx
imul eax, ebx
mov edx, esi
cmovo eax, ecx
mov ecx, dword [esp + 0xc]
shl eax, cl
bswap eax
mov ecx, eax
and eax, edi
shr ecx, 4
shl eax, 4
and ecx, edi
mov edi, 0x33333333
or eax, ecx
mov ecx, eax
shr eax, 2
and ecx, edi
and eax, edi
mov edi, 0x55555555
lea eax, [eax + ecx*4]
mov ecx, eax
shr eax, 1
and ecx, edi
and eax, edi
mov edi, dword [esp + 0x60]
lea eax, [eax + ecx*2]
sub eax, dword [esp + 0x1c]
mov ecx, eax
mov dword [esp + 0x5c], eax
xor eax, eax
and ecx, 0x1f
mov dword [esp + 0x3c], ecx
shl edi, cl
mov ecx, 0x7fffffff
cmp edi, ebx
setns al
add eax, ecx
mov ecx, dword [esp + 0x20]
sub edi, ebx
cmovo edi, eax
mov dword [esp + 0x60], edi
call fcn.004015c4
mov ecx, dword [esp + 0xc]
mov edx, ebx
mov esi, eax
call fcn.004015e0
mov edx, dword [esp + 0x18]
mov ecx, eax
mov edi, 0x7fffffff
xor ecx, edx
mov dword [esp + 0x18], edx
shr ecx, 0x1f
add ecx, edi
mov edi, dword [esp + 0x90]
imul eax, edx
mov edx, dword [esp + 0x10]
cmovo eax, ecx
lea ecx, [eax + edi]
sar ecx, 0x1f
add ecx, 0x80000000
add eax, edi
cmovo eax, ecx
sub esi, ebx
mov ebx, dword [esp + 0x14]
add edx, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov eax, edi
mov ecx, ebx
xor eax, edx
shl esi, cl
shr eax, 0x1f
mov ecx, 0x7fffffff
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x40]
add eax, ecx
imul edx, edi
mov ecx, dword [esp + 0x1c]
cmovo edx, eax
sar edx, cl
mov ecx, 0x7fffffff
mov dword [esp + 0x10], edx
mov edx, edi
mov edi, dword [esp + 0xa0]
mov eax, esi
xor eax, ebx
shr eax, 0x1f
add eax, ecx
mov ecx, dword [esp + 0x1c]
imul ebx, esi
cmovo ebx, eax
call fcn.004015c4
xor edx, edx
cmp edi, 0xffffffff
mov dword [esp + 0x90], eax
je 0x4094e5
mov ecx, dword [esp + 0x90]
test edi, edi
je 0x407147
mov esi, dword [esp + 0x40]
mov eax, esi
sar eax, cl
cdq
idiv edi
mov ecx, ebx
mov ebx, 0xf0f0f0f
bswap edx
bswap ecx
mov eax, ecx
and ecx, ebx
shr eax, 4
shl ecx, 4
and eax, ebx
mov ebx, 0x33333333
or ecx, eax
mov eax, ecx
shr ecx, 2
and eax, ebx
and ecx, ebx
mov ebx, 0x55555555
lea eax, [ecx + eax*4]
mov ecx, eax
shr eax, 1
and ecx, ebx
and eax, ebx
mov ebx, 0x7fffffff
lea eax, [eax + ecx*2]
mov ecx, dword [esp + 0x20]
imul eax, esi
mov esi, dword [esp + 0xc]
add edi, eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
imul edi, dword [esp + 0xd0]
bswap esi
add dword [esp + 0x70], eax
xor eax, eax
mov dword [esp + 0xc], esi
sar edi, cl
cmp edi, esi
setns al
add eax, ebx
sub edi, esi
mov esi, dword [esp + 0xc0]
mov ebx, dword [esp + 0x1c]
cmovo edi, eax
mov dword [esp + 0xa0], edi
mov edi, dword [esp + 0x18]
imul esi, ecx
mov ecx, 0xf0f0f0f
bswap esi
mov eax, esi
and esi, ecx
shr eax, 4
shl esi, 4
and eax, ecx
mov ecx, 0x33333333
or esi, eax
mov eax, esi
shr esi, 2
and eax, ecx
and esi, ecx
lea ecx, [esi + eax*4]
mov esi, 0x55555555
mov eax, ecx
shr ecx, 1
and eax, esi
and ecx, esi
mov esi, 0x7fffffff
lea ecx, [ecx + eax*2]
add eax, eax
xor eax, edi
shr eax, 0x1f
add eax, esi
imul ecx, edi
cmovo ecx, eax
lea eax, [ecx + edi]
sar eax, 0x1f
add eax, 0x80000000
add ecx, edi
mov edi, dword [esp + 0x38]
cmovo ecx, eax
mov eax, edx
xor eax, ebx
mov dword [esp + 0xc0], ecx
mov ecx, dword [esp + 0x3c]
shr eax, 0x1f
add eax, esi
imul edx, ebx
mov esi, dword [esp + 0x5c]
cmovo edx, eax
mov eax, dword [esp + 0x70]
shl dword [esp + 0xd0], cl
mov dword [esp + 0x40], edx
mov ecx, eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x1c], eax
jmp 0x40935b
mov edx, dword [esp + 0x40]
mov edi, dword [esp + 0x20]
mov eax, 0x4002001
mov dword [esp + 0x38], ecx
mov dword [esp + 0xc], ebx
add edx, eax
cmp edi, eax
cmovne edx, edi
cmp ebx, 1
mov dword [esp + 0x70], edx
je 0x409661
cmp dword [esp + 0xc], 0xa
je 0x4096e4
cmp dword [esp + 0xc], 0xc
je 0x4096ec
cmp dword [esp + 0xc], 0xe
jne 0x409680
mov dword [esp + 0xc], 0x70000000
jmp 0x409680
mov edx, dword [esp + 0xa0]
xor eax, eax
xor ecx, ecx
inc ecx
cmp ecx, edx
setns al
add eax, 0x7fffffff
sub ecx, edx
cmovo ecx, eax
mov dword [esp + 0xc], ecx
mov ecx, esi
xor eax, eax
mov edx, 0x265
neg ecx
mov ecx, esi
setns al
add eax, 0x7fffffff
neg ecx
cmovo ecx, eax
mov eax, dword [esp + 0x10]
test eax, eax
cmovne ecx, eax
mov eax, 0x265
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0xc0]
shr edx, cl
cmp esi, eax
cmovne edx, esi
cmp dword [esp + 0x60], 0x77
mov dword [esp + 0xbc], edx
je 0x4096f4
cmp dword [esp + 0x60], 0xe53
jne 0x4096fc
mov eax, dword [esp + 0xbc]
add eax, 0xe53
mov dword [esp + 0x60], eax
jmp 0x4096fc
add esp, 0x90a
ud2
sub esp, 0x5df
ud2
mov dword [esp + 0x60], 0x77000000
cmp dword [esp + 0x14], 0xaaa
je 0x409718
cmp dword [esp + 0x14], 0xf94
jne 0x40971e
sub esp, 0xc92
jmp 0x40971e
sub esp, 0xa92
cmp dword [esp + 0x1c], 3
je 0x409736
cmp dword [esp + 0x1c], 0xa
jne 0x409755
mov dword [esp + 0x1c], 0x50000000
jmp 0x409755
xor eax, eax
push 3
pop ecx
mov edx, dword [esp + 0x90]
cmp ecx, edx
setns al
add eax, 0x7fffffff
sub ecx, edx
cmovo ecx, eax
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x38], 0xfeff87cb
jne 0x409767
sub esp, 0xb1c
ud2
push 9
pop eax
mov edi, dword [esp + 0x90]
sub eax, dword [esp + 0xd0]
cmp edi, 9
cmovne eax, edi
cmp dword [esp + 0x40], 0x76f
mov dword [esp + 0x14], eax
je 0x4097aa
cmp dword [esp + 0x40], 0x90f
jne 0x4097b2
mov edx, dword [esp + 0x60]
mov ecx, 0x90f
call fcn.004015e0
mov dword [esp + 0x40], eax
jmp 0x4097b2
mov dword [esp + 0x40], 0xf6e00000
mov ecx, dword [esp + 0xc0]
mov eax, ecx
neg eax
mov eax, pe_nt_image_headers32
cmovno eax, ecx
cmp dword [esp + 0x18], 0xfeff8000
mov dword [esp + 0x3c], eax
je 0x4097e5
cmp dword [esp + 0x18], 0xfeff8127
jne 0x4097f1
sub esp, 0xa51
ud2
imul eax, dword [esp + 0x38], 0xfeff8000
mov dword [esp + 0x18], eax
cmp dword [esp + 0xa0], 0xff000000
je 0x409839
cmp dword [esp + 0xa0], 0xff0001b9
je 0x409846
cmp dword [esp + 0xa0], 0xff00022a
je 0x409afc
cmp dword [esp + 0xa0], 0xff0009ba
jne 0x40985b
mov edx, dword [esp + 0x40]
mov ecx, 0xff0009ba
call fcn.004015c4
jmp 0x409854
mov dword [esp + 0xa0], 0xff
jmp 0x40985b
mov edx, dword [esp + 0x40]
mov ecx, 0xff0001b9
call fcn.004015e0
mov dword [esp + 0xa0], eax
mov ebx, dword [esp + 0x38]
xor eax, eax
mov ecx, ebx
neg ecx
setns al
add eax, 0x7fffffff
neg ebx
cmovo ebx, eax
mov eax, dword [esp + 0xd0]
test eax, eax
cmovne ebx, eax
mov dword [esp + 0x5c], ebx
push 0x24
pop eax
mov esi, dword [esp + 0x40]
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0xa0]
mov ebx, dword [esp + 0xbc]
mov edx, 0x985
mov dword [esp + 0x90], eax
mov dword [esp + 0x20], 0xb1d
mov dword [esp + 0xc0], 0xf6a
mov dword [esp + 0xd0], 0x354
mov dword [esp + 0x8c], 0x2c4fe
sub dword [esp + 0x8c], 1
jb 0x409abb
mov ebx, dword [esp + 0x70]
mov edi, dword [esp + 0x60]
mov ecx, 0x80000000
mov edx, 0xf0f0f0f
add ebx, dword [esp + 0x20]
lea eax, [ebx + edi]
sar eax, 0x1f
xor eax, ecx
mov ecx, dword [esp + 0xc]
add ebx, edi
cmovo ebx, eax
bswap ecx
mov eax, ecx
and ecx, edx
shr eax, 4
shl ecx, 4
and eax, edx
mov edx, 0x33333333
or ecx, eax
mov eax, ecx
shr ecx, 2
and eax, edx
and ecx, edx
mov edx, 0x55555555
lea eax, [ecx + eax*4]
mov ecx, eax
shr eax, 1
and ecx, edx
and eax, edx
mov edx, dword [esp + 0x18]
lea ecx, [eax + ecx*2]
call fcn.004015c4
mov ecx, eax
xor eax, eax
mov dword [esp + 0x70], ebx
sub ecx, ebx
mov ebx, 0x7fffffff
cmp ecx, esi
setns al
add eax, ebx
sub ecx, esi
mov esi, dword [esp + 0xc0]
cmovo ecx, eax
mov dword [esp + 0xc], ecx
shl edi, cl
mov ecx, edi
mov edx, esi
call fcn.004015e0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x90]
sub eax, esi
mov esi, 0x80000000
mov edi, 0
mov dword [esp + 0x60], eax
sub edx, eax
lea eax, [edx + ecx]
sar eax, 0x1f
xor eax, esi
add edx, ecx
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x5c]
cmovo edx, eax
xor eax, eax
bswap ecx
cmp ecx, esi
setns al
add eax, ebx
sub ecx, esi
mov esi, dword [esp + 0xd0]
cmovo ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x20]
sar edx, cl
mov eax, edx
xor eax, ecx
shr eax, 0x1f
add eax, ebx
imul edx, ecx
cmovo edx, eax
xor ebx, ebx
cmp esi, 0xffffffff
mov dword [esp + 0x14], edx
je 0x409a24
test esi, esi
je 0x407147
mov ecx, dword [esp + 0x3c]
mov edx, 0xf0f0f0f
bswap ecx
mov eax, ecx
and ecx, edx
shr eax, 4
shl ecx, 4
and eax, edx
mov edx, 0x33333333
or ecx, eax
mov eax, ecx
shr ecx, 2
and eax, edx
and ecx, edx
mov edx, 0x55555555
lea eax, [ecx + eax*4]
mov ecx, eax
shr eax, 1
and ecx, edx
and eax, edx
lea eax, [eax + ecx*2]
cdq
idiv esi
mov edi, edx
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
lea eax, [esi + ecx]
sar eax, 0x1f
add eax, 0x80000000
add esi, ecx
mov ecx, dword [esp + 0x60]
cmovo esi, eax
mov eax, dword [esp + 0xc]
shl esi, cl
cmp eax, 0xffffffff
je 0x409a60
test eax, eax
je 0x407147
mov ecx, eax
mov eax, dword [esp + 0x20]
cdq
idiv ecx
mov eax, ecx
mov ebx, edx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x3c], edi
mov edi, dword [esp + 0x20]
mov dword [esp + 0x20], ebx
imul ecx, dword [esp + 0x70]
sub ecx, eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0xd0], eax
mov dword [esp + 0xc0], eax
mov edx, eax
bswap eax
add esi, ecx
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x14]
imul esi, ecx
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x40]
mov dword [esp + 0x5c], eax
mov ebx, esi
jmp 0x4098d0
cmp dword [esp + 0x10], 0xe27
mov esi, ecx
mov dword [esp + 0xc], edx
jne 0x409ad1
add esp, 0x79d
cmp ebx, 0x563
je 0x409b04
cmp ebx, 0xc38
je 0x409b11
cmp ebx, 0xd74
jne 0x409b1f
mov eax, dword [esp + 0x18]
mov ebx, 0x7fffffff
add eax, 0xd74
cmovno ebx, eax
jmp 0x409b1f
sub esp, 0x10c7
ud2
sub esp, 0x1040
mov ebx, 0x563
jmp 0x409b1f
mov ecx, 0xc38
mov edx, edi
call fcn.004015e0
mov ebx, eax
cmp dword [esp + 0x60], 0xfe000ce0
je 0x409b51
cmp dword [esp + 0x60], 0xfe000575
je 0x409b65
cmp dword [esp + 0x60], 0xfe000c78
je 0x409b75
cmp dword [esp + 0x60], 0xfdffffdb
jne 0x409b7d
imul eax, dword [esp + 0x14], 0xfdffffdb
jmp 0x409b5f
mov edx, dword [esp + 0x40]
mov ecx, 0xfe000ce0
call fcn.004015c4
mov dword [esp + 0x60], eax
jmp 0x409b7d
sub esp, 0xfe3
mov dword [esp + 0x60], 0xfe000575
jmp 0x409b7d
mov dword [esp + 0x60], 0x780c00fe
cmp esi, 0xfdffffdb
je 0x409b9a
cmp esi, 0xfe00098c
jne 0x409ba4
add esp, 0xdbf
mov esi, 0xfe00098c
jmp 0x409ba4
mov esi, dword [esp + 0x38]
add esi, 0xfdffffdb
cmp dword [esp + 0x14], 0xc67
je 0x409bc0
cmp dword [esp + 0x14], 0xd3
jne 0x409bc6
sub esp, 0x11ad
ud2
add esp, 0xadb
cmp dword [esp + 0x40], 0
je 0x409bdf
cmp dword [esp + 0x40], 0xc70
jne 0x409bea
sub esp, 0x9d3
ud2
cmp dword [esp + 0xc], 0
je 0x407147
cmp dword [esp + 0x3c], 0xc
je 0x409c09
cmp dword [esp + 0x3c], 0xf
jne 0x409c0f
push 0xf
pop ecx
mov edx, dword [esp + 0x90]
call fcn.004015c4
jmp 0x409c0f
sub esp, 0x43d
cmp dword [esp + 0x18], 0xbc000559
je 0x409c3d
cmp dword [esp + 0x18], 0xbc000e92
je 0x409c49
cmp dword [esp + 0x18], 0xbc0014bb
jne 0x409c51
sub esp, 0x7ec
mov dword [esp + 0x18], 0xbc0014bb
jmp 0x409c51
lea eax, [ebx - 0x43fffaa7]
mov dword [esp + 0x18], eax
jmp 0x409c51
mov dword [esp + 0x18], 0x920e00bc
cmp edi, 0x9ec
jne 0x409c65
mov ecx, 0x9ec
mov edx, ebx
call fcn.004015c4
cmp dword [esp + 0x5c], 0xb8b
jne 0x409c7d
mov edx, dword [esp + 0x60]
mov ecx, 0xb8b
call fcn.004015e0
cmp dword [esp + 0xd0], 0x24000000
jne 0x409c96
mov ecx, 0x24000000
mov edx, esi
call fcn.004015c4
cmp dword [esp + 0xc0], 0xba2
je 0x409cbb
cmp dword [esp + 0xc0], 0x4e5
jne 0x409cca
mov eax, 0x4e5
sub eax, dword [esp + 0x60]
jmp 0x409cc3
imul eax, dword [esp + 0x18], 0xba2
mov dword [esp + 0xc0], eax
cmp dword [esp + 0x20], 0x11
jne 0x409cdd
push 0x11
pop ecx
mov edx, dword [esp + 0x18]
call fcn.004015c4
cmp dword [esp + 0x90], 0xd
jne 0x409cf6
push 0xd
pop ecx
mov edx, dword [esp + 0xc0]
call fcn.004015c4
xor ecx, ecx
call fcn.0040d13b
nop dword [eax]
push 0xa
add byte [eax], al
jo 0x409d10
add byte [eax], al
lcall 0xa, 0x8100000a
add byte [edx - 0x65fffff6], bl
or al, byte [eax]
lcall 0xa, 0x9a00000a
add byte [edx + ecx + 0xad20000], cl
add byte [eax], al
invalid