Function at 0x409bd7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x100
xor eax, eax
cmp byte [edx + 0x40], 2
mov esi, ecx
mov ecx, dword [ecx]
mov edi, edx
setne al
lea edx, [eax + eax + 0x44]
call fcn.00404cbf
test ax, ax
jne 0x40a3fb
mov ecx, dword [esi]
push 9
pop edx
call fcn.00404cbf
test ax, ax
jne 0x40a3fb
mov ebx, dword [edi + 8]
mov edx, dword [edi + 0xc]
mov dword [esp + 0x20], esi
push 0x3f
pop esi
cmp ebx, 0x64
mov eax, edx
sbb eax, 0
jb 0x409c5b
push 0
push 0x64
push edx
push ebx
call fcn.00401793
add esp, 0x10
imul ecx, eax, 0xffffff9c
add ecx, ebx
mov ebx, eax
movzx ecx, word [ecx + ecx + str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899]
mov word [esp + esi + 0xb0], cx
add esi, 0xfffffffe
jmp 0x409c27
xor eax, eax
push 9
pop ecx
cmp ecx, ebx
sbb eax, edx
jb 0x409c73
add bl, 0x30
mov byte [esp + esi + 0xb1], bl
inc esi
jmp 0x409c83
movzx eax, word [ebx + ebx + str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899]
mov word [esp + esi + 0xb0], ax
lea ecx, [esp + esi + 0xb0]
push 0x41
pop edx
sub edx, esi
mov esi, dword [esp + 0x20]
push esi
push 0x42bd80
call fcn.00410769
pop ecx
pop edx
test ax, ax
jne 0x40a3fb
mov ecx, dword [esi]
push 9
pop edx
call fcn.00404cbf
test ax, ax
jne 0x40a3fb
mov eax, dword [edi + 0x2c]
mov esi, dword [edi + 0x24]
mov ecx, dword [edi + 0x20]
mov ebx, dword [edi + 0x28]
mov edi, eax
mov eax, esi
mov dword [esp + 0x30], ecx
or ecx, ebx
mov dword [esp + 0x2c], ebx
or eax, edi
mov dword [esp + 0x1c], edi
or ecx, eax
mov eax, esi
sete byte [esp + 8]
bsr ecx, ebx
bsr edx, edi
xor ecx, 0x1f
xor edx, 0x1f
add ecx, 0x20
test edi, edi
cmovne ecx, edx
bsr edx, dword [esp + 0x30]
bsr esi, esi
xor esi, 0x1f
xor edx, 0x1f
add edx, 0x20
test eax, eax
cmovne edx, esi
add edx, 0x40
or ebx, edi
mov ebx, eax
cmovne edx, ecx
push 0x62
pop eax
sub eax, edx
mov edx, 0
mov edi, 0
mov esi, 0
sbb edx, edx
sbb edi, edi
sbb esi, esi
push 0x7f
pop ecx
cmp ecx, eax
mov ecx, 0
mov dword [esp + 0x28], ebx
mov dword [esp + 4], eax
mov dword [esp + 0x10], edx
mov eax, 0
mov dword [esp + 0xc], edi
sbb ecx, edx
mov ecx, 0
sbb ecx, edi
mov ecx, 0
sbb ecx, esi
setb cl
or cl, byte [esp + 8]
mov ecx, ebx
mov ebx, dword [esp + 0x30]
mov edx, ebx
cmovne ecx, eax
cmovne edx, eax
jne 0x409e65
mov eax, dword [esp + 4]
mov edi, ecx
mov ecx, dword [esp + 0x10]
xor eax, 0x7f
or ecx, esi
or eax, dword [esp + 0xc]
or ecx, eax
mov ecx, edi
mov edi, dword [esp + 0x1c]
je 0x40a04f
mov dword [esp + 0xa0], ebx
mov eax, dword [esp + 0x28]
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xac], edi
and dword [esp + 0x9c], 0
and dword [esp + 0x98], 0
and dword [esp + 0x94], 0
and dword [esp + 0x90], 0
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 4]
xor al, 0x7f
mov ch, al
shr al, 3
and al, 0xf
and ch, 7
neg al
mov cl, ch
movsx eax, al
mov edx, dword [esp + eax + 0xa8]
mov edi, dword [esp + eax + 0xac]
shld edi, edx, cl
shl edx, cl
not cl
mov dword [esp + 0x54], edi
mov dword [esp + 0x34], edx
mov edx, dword [esp + eax + 0xa4]
mov edi, dword [esp + eax + 0xa0]
mov dword [esp + 0x14], 0
mov eax, edx
shr eax, 1
shr eax, cl
mov cl, ch
shld edx, edi, cl
shl edi, cl
xor ecx, ecx
add dword [esp + 4], 1
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edi
mov edi, dword [esp + 0xc]
adc edx, ecx
adc edi, ecx
adc esi, ecx
jae 0x409e6e
mov dword [esp + 0x24], 0
jmp 0x40a031
mov edi, dword [esp + 0x1c]
jmp 0x40a04f
mov ecx, edx
mov edx, ebx
or dword [esp + 0x34], eax
mov ebx, edi
mov dword [esp + 0x70], edx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x1c]
and dword [esp + 0x8c], 0
and dword [esp + 0x88], 0
and dword [esp + 0x84], 0
and dword [esp + 0x80], 0
mov dword [esp + 0x7c], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edi
mov dword [esp + 0x50], esi
mov eax, dword [esp + 4]
mov ch, al
shr al, 3
and al, 0xf
and ch, 7
movzx eax, al
mov cl, ch
mov ebx, dword [esp + eax + 0x78]
mov edx, dword [esp + eax + 0x7c]
mov esi, ebx
add ebx, ebx
shrd esi, edx, cl
mov dword [esp + 0x48], esi
mov esi, dword [esp + eax + 0x74]
mov dword [esp + 0x14], 0
mov edi, esi
shr edi, cl
not cl
shl ebx, cl
mov cl, ch
or ebx, edi
shr edx, cl
mov dword [esp + 0x4c], ebx
mov eax, dword [esp + eax + 0x70]
mov dword [esp + 0x24], 0
shrd eax, esi, cl
mov esi, 0x3b9aca00
mov ecx, 0
add esi, 0xffffffff
mov dword [esp + 0x44], eax
mov dword [esp + 0x64], esi
adc ecx, 0xffffffff
mov esi, 0
mov dword [esp + 0x60], ecx
adc esi, 0xffffffff
mov ecx, 0
adc ecx, 0xffffffff
mov dword [esp + 0x5c], esi
mov dword [esp + 0x58], ecx
mov edi, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
mov ebx, dword [esp + 0x44]
mov ecx, dword [esp + 0x34]
mov esi, dword [esp + 0x24]
mov dword [esp + 0x24], 0
shld edx, edi, 1
shld edi, eax, 1
shld eax, ebx, 1
mov dword [esp + 8], edx
mov edx, dword [esp + 0x54]
shld ebx, edx, 1
shld edx, ecx, 1
or edx, esi
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x38]
shld ecx, edx, 1
or ecx, esi
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x18]
shld edx, ecx, 1
add ecx, ecx
or ecx, dword [esp + 0x14]
or edx, esi
cmp dword [esp + 0x64], ebx
mov esi, dword [esp + 8]
mov dword [esp + 0x38], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x60]
sbb ecx, eax
mov ecx, dword [esp + 0x5c]
sbb ecx, edi
mov ecx, dword [esp + 0x58]
sbb ecx, esi
sar ecx, 0x1f
mov edx, ecx
and edx, 1
mov dword [esp + 0x14], edx
mov edx, 0x3b9aca00
and ecx, edx
sub ebx, ecx
mov ecx, dword [esp + 0x10]
sbb eax, 0
mov dword [esp + 0x44], ebx
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x4c], eax
sbb edi, 0
mov eax, esi
mov esi, dword [esp + 4]
sbb eax, 0
mov dword [esp + 0x48], edi
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
add esi, 0xffffffff
adc ecx, 0xffffffff
mov dword [esp + 4], esi
adc eax, 0xffffffff
mov dword [esp + 0x10], ecx
adc ebx, 0xffffffff
or esi, eax
mov dword [esp + 0xc], eax
or ecx, ebx
mov dword [esp + 0x50], ebx
or esi, ecx
jne 0x409f47
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x38]
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x30]
shld ecx, edx, 1
add edx, edx
or ecx, dword [esp + 0x24]
or edx, dword [esp + 0x14]
neg ebx
mov eax, 0
sbb eax, dword [esp + 0x28]
mov eax, 0
sbb eax, dword [esp + 0x2c]
mov eax, 0
sbb eax, edi
mov eax, 0
cmovge ecx, eax
cmovge edx, eax
push 0
push 0x15180
push ecx
push edx
mov esi, edx
call fcn.00401793
add esp, 0x10
mov ecx, eax
mov dword [esp + 0xb0], eax
imul eax, eax, 0xae80
and edx, 0x7fff
mov bx, 0x7b2
add eax, esi
mov dword [esp + 8], edx
mov word [esp + 0xb4], dx
mov word [esp + 0x68], ax
movzx edx, ax
shr eax, 0x10
and eax, 1
mov byte [esp + 0x6a], al
shl eax, 0x10
or eax, edx
mov dword [esp + 0x18], eax
mov eax, ebx
xor edx, edx
mov si, 0x190
mov dword [esp + 4], 0
mov di, 0x64
div si
mov esi, eax
mov eax, ebx
xor edx, edx
div di
test bl, 3
mov dword [esp + 0xc], ebx
je 0x40a102
mov dword [esp + 0x10], 0x16d
mov byte [esp + 0x14], 0x1c
jmp 0x40a142
imul esi, esi, 0x190
mov edx, 0x7b2
imul eax, eax, 0x64
mov di, 0x7b2
sub edx, esi
mov esi, 0x7b2
sub esi, eax
add esi, ebx
cmp si, di
setne ah
add edx, ebx
cmp dx, di
sete al
or al, ah
movzx edx, al
or al, 0xfc
add edx, 0x16d
mov byte [esp + 0x14], al
mov dword [esp + 0x10], edx
mov esi, dword [esp + 4]
mov eax, 0x7fff
mov ebx, 0x7fff
mov edx, esi
and edx, eax
mov eax, dword [esp + 8]
mov edi, eax
and edi, ebx
mov ebx, dword [esp + 0x10]
cmp ecx, ebx
sbb edi, edx
jb 0x40a178
sub ecx, ebx
mov ebx, dword [esp + 0xc]
sbb eax, esi
mov dword [esp + 8], eax
inc ebx
jmp 0x40a0ca
mov bl, 1
mov al, byte [esp + 0x14]
and ecx, 0x1ff
mov dl, 0x1f
movzx esi, bl
mov word [esp + 0x6e], cx
and esi, 0xf
dec esi
jmp dword [esi*4 + 0x42f144]
mov edx, eax
jmp case.0x40a192.0
mov dl, 0x1e
movzx edx, dl
mov esi, ecx
and edx, 0x1f
and esi, 0x1ff
cmp si, dx
jb case.default.0x40a1c2
inc bl
movzx edx, dx
movzx esi, bl
sub ecx, edx
mov dl, 0x1f
and esi, 0xf
dec esi
jmp dword [esi*4 + 0x42f144]
mov edi, dword [esp + 0x18]
inc cl
and bl, 0xf
mov esi, 0xe10
xor edx, edx
and cl, 0x1f
mov byte [esp + 0x3c], bl
mov byte [esp + 0x42], cl
mov eax, edi
div esi
mov si, 0x3c
imul edx, eax, 0xf1f0
mov bh, al
add edx, edi
and bh, 0x1f
mov eax, edx
xor edx, edx
mov byte [esp + 0x3e], bh
div si
and al, 0x3f
mov word [esp + 8], ax
mov byte [esp + 0x43], al
push 0x3c
pop esi
mov eax, edi
xor edx, edx
div esi
movzx eax, cl
and dl, 0x3f
cmp cl, 9
mov dword [esp + 4], edx
mov byte [esp + 0x40], dl
push 5
pop edi
ja 0x40a23b
add al, 0x30
mov esi, edi
mov byte [esp + 0xb5], al
jmp 0x40a24e
push 4
pop esi
movzx eax, word [eax + eax + str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899]
mov word [esp + 0xb4], ax
lea ecx, [esp + esi + 0xb0]
push 6
pop edx
sub edx, esi
mov esi, dword [esp + 0x20]
push esi
push 0x42b09c
call fcn.00410769
pop ecx
pop edx
test ax, ax
jne 0x40a3fb
mov ecx, dword [esi]
push 0x2f
pop edx
call fcn.00404cbf
test ax, ax
jne 0x40a3fb
movzx eax, bl
cmp al, 9
ja 0x40a29b
or al, 0x30
mov byte [esp + 0xb4], al
push 4
jmp 0x40a2ad
movzx eax, word [eax + eax + str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899]
mov word [esp + 0xb3], ax
push 3
pop eax
sub edi, eax
lea ecx, [esp + eax + 0xb0]
mov edx, edi
push esi
push 0x42b09c
call fcn.00410769
pop ecx
pop edx
test ax, ax
jne 0x40a3fb
mov ecx, dword [esi]
push 0x2f
pop edx
call fcn.00404cbf
test ax, ax
jne 0x40a3fb
push 0xf
pop esi
mov eax, dword [esp + 0xc]
mov cx, 0x64
cmp ax, 0x64
jb 0x40a310
xor edx, edx
div cx
movzx edx, dx
movzx edx, word [edx + edx + str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899]
mov word [esp + esi + 0xb0], dx
add esi, 0xfffffffe
jmp 0x40a2ed
cmp ax, 9
ja 0x40a322
add al, 0x30
mov byte [esp + esi + 0xb1], al
inc esi
jmp 0x40a335
movzx eax, ax
movzx eax, word [eax + eax + str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899]
mov word [esp + esi + 0xb0], ax
lea ecx, [esp + esi + 0xb0]
push 0x11
pop edx
sub edx, esi
mov esi, dword [esp + 0x20]
push esi
push 0x42b0b0
call fcn.00410769
pop ecx
pop edx
test ax, ax
jne 0x40a3fb
mov ecx, dword [esi]
push 0x20
pop edx
call fcn.00404cbf
test ax, ax
jne 0x40a3fb
movzx ecx, bh
mov edx, esi
call fcn.004108d8
test ax, ax
jne 0x40a3fb
mov ecx, dword [esi]
push 0x3a
pop edx
call fcn.00404cbf
test ax, ax
jne 0x40a3fb
movzx ecx, byte [esp + 8]
mov edx, esi
call fcn.004108d8
test ax, ax
jne 0x40a3fb
mov ecx, dword [esi]
push 0x3a
pop edx
call fcn.00404cbf
test ax, ax
jne 0x40a3fb
movzx ecx, byte [esp + 4]
mov edx, esi
call fcn.004108d8
test ax, ax
jne 0x40a3fb
mov ecx, dword [esi]
push 9
pop edx
call fcn.00404cbf
test ax, ax
jne 0x40a3fb
mov edx, dword [esi]
lea esi, [esp + 0xf4]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00404c5c
pop eax
pop ecx
movzx eax, word [esi + 4]
mov ecx, dword [esp + 0x20]
test ax, ax
jne 0x40a3fb
mov ecx, dword [ecx]
push 0xa
pop edx
call fcn.00404cbf
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0xc]
mov ecx, dword [esp]
mov dword [ecx], eax
mov byte [ecx + 4], 1
and word [ecx + 8], 0
jmp 0x40ad1c
mov dword [esp + 8], edi
lea esi, [esp + 0x148]
push 0xfffffffffffffff6
pop edx
mov ecx, esi
call fcn.0040e48b
cmp word [esi + 4], 0
mov ecx, 0
mov dword [esp + 0x18], 0
jne case.default.0x40b8c8
mov ecx, dword [esp + 0x148]
and dword [esp + 0x1c], 0
and dword [esp + 0x78], 0
mov esi, ebp
movzx eax, byte [ebp + 0x85]
mov ebp, ecx
jmp dword [eax*4 + 0x42f264]
and dword [esp + 0x1c], 0
and dword [esp + 0x78], 0
mov dword [esp + 8], edi
mov dword [esp + 0x18], ecx
mov esi, ebp
movzx eax, byte [ebp + 0x85]
mov ebp, ebx
jmp dword [eax*4 + 0x42f264]
lea eax, [esp + 0x90]
lea ecx, [esp + 0xac]
push 0
push 0x42bce0
push eax
push ecx
call sub.KERNEL32.dll_CreatePipe
test eax, eax
je 0x40b9ab
mov ecx, dword [esp + 0x90]
mov dword [esp + 8], edi
call fcn.0040e457
mov ecx, dword [esp + 0xac]
mov edx, dword [esp + 0x90]
test ax, ax
je 0x40b9dc
mov esi, eax
call fcn.0040e472
mov eax, esi
jmp 0x40be9c
mov esi, ebp
and dword [esp + 0x1c], 0
and dword [esp + 0x78], 0
mov dword [esp + 8], edi
xor ebp, ebp
mov dword [esp + 0x18], 0
movzx eax, byte [esi + 0x85]
jmp dword [eax*4 + 0x42f264]
mov edi, esi
lea esi, [esp + 0x150]
push 0xfffffffffffffff5
pop edx
mov ecx, esi
call fcn.0040e48b
cmp word [esi + 4], 0
je case.default.0x40b9a4
and dword [esp + 0x78], 0
and dword [esp + 0x28], 0
and dword [esp + 0x7c], 0
movzx eax, byte [edi + 0x86]
jmp dword [eax*4 + 0x42f274]
call sub.KERNEL32.dll_GetLastError
mov ax, 0xe
jmp 0x40be9c
mov eax, dword [esp + 0x150]
and dword [esp + 0x28], 0
and dword [esp + 0x7c], 0
mov dword [esp + 0x78], eax
movzx eax, byte [edi + 0x86]
jmp dword [eax*4 + 0x42f274]
and dword [esp + 0x1c], 0
and dword [esp + 0x78], 0
mov dword [esp + 0x18], edx
mov esi, ebp
movzx eax, byte [ebp + 0x85]
mov ebp, ecx
jmp dword [eax*4 + 0x42f264]
mov dword [esp + 0x78], ebx
and dword [esp + 0x28], 0
and dword [esp + 0x7c], 0
mov edi, esi
movzx eax, byte [esi + 0x86]
jmp dword [eax*4 + 0x42f274]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x78]
call fcn.0040e4bf
test ax, ax
je case.0x40a1c2.75
mov ecx, dword [esp + 8]
mov esi, eax
cmp byte [ecx], 2
jne 0x40ba42
mov ecx, ebp
mov edx, dword [esp + 0x18]
call fcn.0040e472
cmp byte [esp + 0x20], 0
je 0x40ba4f
push ebx
call sub.ntdll.dll_NtClose
mov eax, esi
jmp 0x40bead
and dword [esp + 0x28], 0
and dword [esp + 0x7c], 0
mov edi, esi
movzx eax, byte [esi + 0x86]
jmp dword [eax*4 + 0x42f274]
lea esi, [esp + 0x158]
push 0xfffffffffffffff4
pop edx
mov ecx, esi
call fcn.0040e48b
cmp word [esi + 4], 0
je 0x40bac3
and dword [esp + 0x7c], 0
jmp case.0x40a1c2.79
mov dword [esp + 0x7c], ebx
jmp case.0x40a1c2.79
lea ecx, [esp + 0x28]
lea edx, [esp + 0x7c]
call fcn.0040e4bf
test ax, ax
je case.0x40a1c2.79
mov esi, dword [esp + 8]
cmp byte [esi], 2
jne 0x40be9c
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x78]
mov edi, eax
jmp 0x40be83
mov eax, dword [esp + 0x158]
mov dword [esp + 0x7c], eax
mov ecx, dword [edi + 0x3c]
mov eax, dword [edi + 0x38]
lea esi, [edi + 8]
mov dword [esp], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], esi
cmp ecx, 2
mov dword [esp + 0x38], ecx
mov dword [esp + 0x34], eax
jne 0x40bc8c
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push 7
push str.cmd.exe
call fcn.004062f4
pop ecx
pop edx
test al, 1
mov eax, dword [esp + 0x34]
je 0x40bc8c
mov edx, dword [esi]
lea edi, [esp + 0xc0]
mov ecx, edi
push dword [eax + 0xc]
push dword [eax + 8]
push dword [esi + 4]
call fcn.0040e634
add esp, 0xc
movzx eax, word [edi + 8]
test ax, ax
jne 0x40be5c
mov eax, dword [esp + 0xc0]
mov ecx, ebp
mov ebp, dword [esp + 0x78]
mov edi, dword [esp]
mov dword [esp + 0xfc], 0x44
mov dword [esp + 4], 0
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x138], ebp
mov dword [esp + 0x134], ecx
mov dword [esp + 0x128], 0x100
and dword [esp + 0x104], 0
and dword [esp + 0x100], 0
and dword [esp + 0x10c], 0
and dword [esp + 0x108], 0
and dword [esp + 0x114], 0
and dword [esp + 0x110], 0
and dword [esp + 0x11c], 0
and dword [esp + 0x118], 0
and dword [esp + 0x124], 0
and dword [esp + 0x120], 0
and dword [esp + 0x130], 0
and dword [esp + 0x12c], 0
mov dword [esp + 0x38], eax
mov eax, dword [edi + 0x44]
test eax, eax
je 0x40beb8
mov edx, dword [edi + 8]
lea esi, [esp + 0x160]
mov ecx, esi
push dword [edi + 0x48]
push eax
push dword [edi + 0xc]
call fcn.0040e6ab
add esp, 0xc
movzx esi, word [esi + 8]
test si, si
je 0x40beec
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x24]
push dword [esp + 0x38]
call fcn.0040e902
pop eax
pop ecx
cmp byte [edi + 0x84], 2
jne 0x40ba42
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
call fcn.0040e472
mov eax, dword [esp + 8]
cmp byte [eax], 2
jne 0x40ba42
mov ecx, dword [esp + 0x1c]
mov edx, ebp
call fcn.0040e472
mov eax, dword [esp + 8]
cmp byte [eax], 2
jne 0x40ba42
mov ecx, dword [esp + 0x30]
jmp 0x40ba39
mov ecx, dword [esi + 4]
mov eax, dword [esi]
lea edi, [esp + 0x90]
mov dword [esp + 0x30], ebp
mov dword [edi], 0xaaaaaaaa
and dword [edi + 4], 0
and dword [edi + 8], 0
mov dword [edi + 0x10], ecx
xor ecx, ecx
mov dword [edi + 0xc], eax
cmp ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
je 0x40bec8
mov ebp, dword [eax + ecx*8]
mov esi, dword [eax + ecx*8 + 4]
test ecx, ecx
mov dword [esp + 4], ecx
je 0x40bce2
mov ecx, edi
push 0x20
pop edx
call fcn.0040e684
test ax, ax
jne 0x40be44
xor eax, eax
cmp eax, esi
je 0x40be37
mov cl, byte [ebp + eax]
push 0xfffffffffffffffc
pop edx
test edx, edx
je 0x40bd04
cmp cl, byte [edx + 0x42bcac]
lea edx, [edx + 1]
jne 0x40bcf3
jmp 0x40bd07
inc eax
jmp 0x40bce4
mov ecx, edi
push 0x22
pop edx
call fcn.0040e684
test ax, ax
jne 0x40be44
xor edx, edx
sub esi, 1
jb 0x40bde6
movzx ebx, byte [ebp]
cmp ebx, 0x22
je 0x40bd39
cmp ebx, 0x5c
jne 0x40bd8c
inc edx
jmp 0x40bde0
mov ebx, edi
mov edi, dword [esp + 0x94]
mov ecx, ebx
lea edx, [edi + edx*2 + 1]
call fcn.0040de1d
test ax, ax
jne 0x40be44
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x90]
sub eax, edi
add ecx, edi
push eax
push 0x5c
push ecx
call fcn.00403060
add esp, 0xc
mov ecx, ebx
push 0x22
pop edx
call fcn.0040e684
xor edx, edx
test ax, ax
mov edi, ebx
je 0x40bde0
jmp 0x40be44
mov dword [esp + 0x24], ebp
mov ebp, edi
mov edi, dword [esp + 0x94]
mov ecx, ebp
add edx, edi
call fcn.0040de1d
test ax, ax
jne 0x40be44
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x90]
sub eax, edi
add ecx, edi
push eax
push 0x5c
push ecx
call fcn.00403060
add esp, 0xc
movzx edx, bl
mov ecx, ebp
call fcn.0040e684
mov edi, ebp
mov ebp, dword [esp + 0x24]
xor edx, edx
test ax, ax
jne 0x40be44
inc ebp
jmp 0x40bd1c
mov esi, dword [esp + 0x94]
mov ecx, edi
lea edx, [esi + edx*2]
call fcn.0040de1d
test ax, ax
jne 0x40be44
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x90]
sub eax, esi
add ecx, esi
push eax
push 0x5c
push ecx
call fcn.00403060
add esp, 0xc
mov ecx, edi
push 0x22
pop edx
call fcn.0040e684
mov ebx, dword [esp + 0x14]
test ax, ax
jne 0x40be48
mov ecx, dword [esp + 4]
inc ecx
jmp 0x40bcb2
mov ecx, edi
mov edx, ebp
push esi
call fcn.0040dd58
pop ecx
jmp 0x40be24
mov ebx, dword [esp + 0x14]
mov esi, eax
lea ecx, [esp + 0x90]
call fcn.00404f43
mov ebp, dword [esp + 0x30]
mov eax, esi
mov esi, dword [esp + 8]
cmp byte [esi], 2
jne 0x40be9c
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x7c]
mov edi, eax
call fcn.0040e472
cmp byte [esi], 2
mov eax, edi
jne 0x40be9c
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x78]
call fcn.0040e472
cmp byte [esi], 2
mov eax, edi
jne 0x40be9c
mov edx, dword [esp + 0x18]
mov ecx, ebp
call fcn.0040e472
mov eax, edi
cmp byte [esp + 0x20], 0
je 0x40bead
push ebx
mov esi, eax
call sub.ntdll.dll_NtClose
mov eax, esi
add esp, 0x1f4
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], 0
jmp 0x40bf02
lea ecx, [esp + 0x90]
mov edx, dword [ecx + 4]
inc edx
call fcn.0040de67
test ax, ax
je 0x40c149
mov esi, dword [esp + 0x30]
mov ebp, eax
jmp 0x40c17e
mov eax, dword [esp + 0x164]
mov ecx, dword [esp + 0x160]
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], eax
mov eax, dword [esp]
mov dword [esp + 0x10], ecx
mov ebp, dword [eax + 0x40]
test ebp, ebp
je 0x40c052
lea esi, [esp + 0x1c4]
and dword [esi + 4], 0
mov dword [esi], ebp
push 4
pop ebx
lea edi, [esp + 0xf0]
mov ecx, edi
mov edx, esi
call fcn.0040e91c
cmp byte [esp + 0xf8], 0
je 0x40bf58
mov ecx, dword [esp + 0xf4]
mov eax, dword [esp + 0xf0]
mov ecx, dword [ecx + 4]
add ebx, dword [eax + 4]
lea ebx, [ecx + ebx + 2]
jmp 0x40bf2b
mov eax, dword [esp + 0xc]
lea esi, [esp + 0xac]
mov ecx, esi
mov edx, dword [eax]
push ebx
push dword [eax + 4]
call fcn.0040ddc3
pop eax
pop ecx
movzx eax, word [esi + 8]
test ax, ax
mov dword [esp + 0x2c], eax
jne 0x40c76b
lea eax, [esp + 0x1a4]
mov ecx, dword [esp + 0xb0]
mov edi, dword [esp + 0xac]
xor esi, esi
and dword [eax + 4], 0
mov dword [eax], ebp
mov dword [esp + 0x8c], ecx
lea ecx, [esp + 0x90]
lea edx, [esp + 0x1a4]
call fcn.0040e91c
cmp byte [esp + 0x98], 0
je 0x40c25d
mov eax, dword [esp + 0x90]
mov ebx, dword [esp + 0x94]
lea edx, [edi + esi*2]
lea ecx, [esp + 0xd4]
push dword [eax + 4]
push dword [eax]
call fcn.0040909f
pop eax
pop ecx
movzx eax, word [esp + 0xd8]
test ax, ax
jne 0x40c311
mov ebp, dword [esp + 0xd4]
lea ecx, [esp + 0xdc]
lea eax, [ebp + esi]
lea edx, [edi + eax*2 + 2]
mov word [edx - 2], 0x3d
push dword [ebx + 4]
push dword [ebx]
call fcn.0040909f
pop eax
pop ecx
movzx eax, word [esp + 0xe0]
test ax, ax
jne 0x40c357
mov ecx, dword [esp + 0xdc]
lea eax, [ebp + esi + 1]
lea edx, [ecx + eax]
lea esi, [ecx + eax + 1]
and word [edi + edx*2], 0
jmp 0x40bfa7
mov dword [esp + 0x44], 0
mov ebp, dword [esp]
mov eax, dword [ebp + 0x38]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, esi
mov edx, edi
call fcn.00409b0f
test al, 1
mov byte [esp + 0x8c], al
je 0x40c1ad
mov ecx, esi
mov edx, edi
call fcn.0040a79f
mov ebp, dword [esp + 0xc]
mov ebx, edx
lea ecx, [esp + 0xe4]
mov edx, dword [ebp]
push ebx
push eax
push dword [ebp + 4]
call fcn.0040e6ab
add esp, 0xc
lea eax, [esp + 0xe4]
movzx eax, word [eax + 8]
test ax, ax
je 0x40c329
mov edx, dword [esp + 4]
mov esi, eax
test edx, edx
je 0x40c0cf
mov ecx, dword [esp + 0xc]
push dword [esp + 0x44]
call fcn.0040dd92
pop eax
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 8]
mov ebp, dword [esp]
test edi, edi
je 0x40c0f3
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x48]
push edi
call fcn.0040e9ae
pop eax
pop ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x24]
push dword [esp + 0x38]
call fcn.0040e902
pop eax
pop ecx
cmp byte [ebp + 0x84], 2
jne 0x40c5cc
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
call fcn.0040e472
cmp byte [ebx], 2
jne 0x40c5cc
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x4c]
call fcn.0040e472
cmp byte [ebx], 2
je 0x40c5bf
jmp 0x40c5cc
lea edx, [esp + 0x90]
mov ecx, dword [edx + 4]
mov eax, dword [edx]
lea esi, [ecx + 1]
mov dword [edx + 4], esi
lea esi, [esp + 0xac]
mov byte [eax + ecx], 0
mov ecx, esi
call fcn.00404cdd
movzx ebp, word [esi + 8]
mov esi, dword [esp + 0x30]
test bp, bp
je 0x40c243
lea ecx, [esp + 0x90]
call fcn.00404f43
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc0], eax
mov eax, ebp
mov ebp, esi
mov dword [esp + 0xc4], edi
mov word [esp + 0xc8], ax
jmp 0x40bb32
mov eax, dword [ebp + 0x44]
test eax, eax
je 0x40c33d
mov edx, dword [ebp + 8]
lea ebx, [esp + 0x16c]
mov ecx, ebx
push dword [ebp + 0x48]
push eax
push dword [ebp + 0xc]
call fcn.0040e6ab
add esp, 0xc
movzx eax, word [ebx + 8]
test ax, ax
je 0x40c36f
mov edx, dword [esp + 4]
mov esi, eax
test edx, edx
je 0x40c1f8
mov ecx, dword [esp + 0xc]
push dword [esp + 0x44]
call fcn.0040dd92
pop eax
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 8]
test ebx, ebx
je 0x40c219
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x48]
push ebx
call fcn.0040e9ae
pop eax
pop ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x24]
push dword [esp + 0x38]
call fcn.0040e902
pop eax
pop ecx
cmp byte [ebp + 0x84], 2
je 0x40c59b
jmp 0x40c5cc
mov edi, dword [esp + 0xb0]
mov eax, dword [esp + 0xac]
xor ebp, ebp
dec edi
mov dword [esp + 0x24], eax
jmp 0x40c17e
mov eax, dword [esp + 0xc]
xorps xmm0, xmm0
mov ecx, esi
mov dword [esp + 4], edi
movlps qword [edi + esi*2], xmm0
add ecx, 4
cmp dword [esp + 0x8c], 0
mov ebx, dword [esp + 0x204]
mov esi, dword [eax]
mov ebp, dword [eax + 4]
je 0x40c704
test ecx, ecx
js 0x40c73d
mov eax, dword [esp + 0x8c]
mov edx, dword [esp + 4]
lea edi, [ecx + ecx]
mov dword [esp + 0x44], ecx
mov ecx, esi
add eax, eax
push ebx
push edi
push 1
mov dword [esp + 0x38], eax
push eax
call dword [ebp + 4]
add esp, 0x10
test al, 1
jne 0x40c05a
mov ecx, esi
mov edx, edi
push ebx
push 1
call dword [ebp]
add esp, 8
test eax, eax
je 0x40c73d
mov ecx, dword [esp + 0x2c]
cmp edi, ecx
cmovae edi, ecx
push edi
mov edi, dword [esp + 8]
push edi
push eax
mov dword [esp + 0x98], eax
call fcn.0040307b
add esp, 0xc
mov ecx, esi
mov edx, edi
push ebx
push 1
push dword [esp + 0x34]
call dword [ebp + 8]
add esp, 0xc
mov eax, dword [esp + 0x8c]
jmp 0x40c734
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x2c], eax
movsd xmm0, qword [ecx]
lea ecx, [esp + 0x1cc]
jmp 0x40c758
mov eax, dword [esp + 0xe4]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0xe8]
jmp 0x40c381
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0x42bcec
mov dword [esp + 0x40], 0
jmp 0x40c38b
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x2c], eax
movsd xmm0, qword [ecx]
lea ecx, [esp + 0x1d4]
jmp 0x40c758
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x170]
mov dword [esp + 0x40], eax
mov al, 1
mov dword [esp + 0x54], eax
mov ecx, esi
mov edx, edi
call fcn.00404b32
test byte [esp + 0x8c], 1
mov dword [esp + 0x2c], eax
mov ebp, edx
mov eax, 0
mov ebx, 0
mov dword [esp + 0x3c], 0
jne 0x40c3c1
mov ecx, esi
mov edx, edi
call fcn.0040a79f
mov ebx, edx
test eax, eax
je 0x40c4b6
mov edi, dword [esp + 0xc]
lea esi, [esp + 0x178]
mov ecx, esi
mov edx, dword [edi]
push ebx
push eax
push dword [edi + 4]
call fcn.0040e6ab
add esp, 0xc
movzx eax, word [esi + 8]
test ax, ax
je 0x40c4c0
cmp byte [esp + 0x54], 0
mov ebx, dword [esp]
mov ebp, eax
je 0x40c416
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x40]
push dword [esp + 0x54]
call fcn.0040e9cb
pop eax
pop ecx
mov edx, dword [esp + 4]
mov edi, dword [esp + 8]
mov ecx, dword [esp + 0xc]
test edx, edx
je 0x40c430
push dword [esp + 0x44]
call fcn.0040dd92
pop eax
mov esi, dword [esp + 0x10]
test esi, esi
je 0x40c44d
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x48]
push esi
call fcn.0040e9ae
pop eax
pop ecx
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x24]
push dword [esp + 0x38]
call fcn.0040e902
pop eax
pop ecx
cmp byte [ebx + 0x84], 2
jne 0x40c49f
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
call fcn.0040e472
cmp byte [edi], 2
jne 0x40c49f
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x4c]
call fcn.0040e472
cmp byte [edi], 2
jne 0x40c49f
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
call fcn.0040e472
cmp byte [esp + 0x20], 0
je 0x40c4af
push dword [esp + 0x14]
call sub.ntdll.dll_NtClose
mov eax, ebp
jmp 0x40bead
mov dword [esp + 0x60], 0
jmp 0x40c4d6
mov eax, dword [esp + 0x178]
mov ecx, dword [esp + 0x17c]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x60], ecx
mov edi, dword [esp + 0xc]
lea esi, [esp + 0x184]
mov ecx, esi
mov edx, dword [edi]
push ebp
push dword [esp + 0x30]
push dword [edi + 4]
call fcn.0040e6ab
add esp, 0xc
movzx esi, word [esi + 8]
test si, si
je 0x40c5e0
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 8]
mov ebx, dword [esp]
test ebp, ebp
je 0x40c526
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x60]
push ebp
call fcn.0040e9ae
pop eax
pop ecx
cmp byte [esp + 0x54], 0
mov ebp, dword [esp + 4]
je 0x40c549
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x40]
push dword [esp + 0x54]
call fcn.0040e9cb
pop eax
pop ecx
test ebp, ebp
je 0x40c55d
mov ecx, dword [esp + 0xc]
mov edx, ebp
push dword [esp + 0x44]
call fcn.0040dd92
pop eax
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x40c57a
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x48]
push ebp
call fcn.0040e9ae
pop eax
pop ecx
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x24]
push dword [esp + 0x38]
call fcn.0040e902
pop eax
pop ecx
cmp byte [ebx + 0x84], 2
jne 0x40c5cc
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
call fcn.0040e472
cmp byte [edi], 2
jne 0x40c5cc
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x4c]
call fcn.0040e472
cmp byte [edi], 2
jne 0x40c5cc
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
call fcn.0040e472
cmp byte [esp + 0x20], 0
je 0x40ba4f
push dword [esp + 0x14]
jmp 0x40ba4a
mov eax, dword [esp + 0x188]
mov ebx, dword [esp + 0x184]
mov edx, dword [edi]
lea esi, [esp + 0x190]
mov ecx, esi
mov dword [esp + 0x58], eax
push dword [esp + 0x24]
mov ebp, dword [esp + 0x38]
push ebp
push dword [edi + 4]
call fcn.0040e6ab
add esp, 0xc
movzx eax, word [esi + 8]
test ax, ax
je 0x40c7ff
mov esi, ebx
mov ebx, dword [esp]
mov dword [esp + 0x2c], eax
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x58]
push esi
call fcn.0040e9ae
pop eax
pop ecx
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 8]
test esi, esi
je 0x40c65d
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x60]
push esi
call fcn.0040e9ae
pop eax
pop ecx
cmp byte [esp + 0x54], 0
mov esi, dword [esp + 0xc]
je 0x40c680
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x40]
push dword [esp + 0x54]
call fcn.0040e9cb
pop eax
pop ecx
mov edx, dword [esp + 4]
test edx, edx
je 0x40c694
mov ecx, esi
push dword [esp + 0x44]
call fcn.0040dd92
pop eax
mov esi, dword [esp + 0x10]
test esi, esi
je 0x40c6b1
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x48]
push esi
call fcn.0040e9ae
pop eax
pop ecx
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x24]
push ebp
call fcn.0040e902
pop eax
pop ecx
cmp byte [ebx + 0x84], 2
jne 0x40c98e
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
call fcn.0040e472
cmp byte [edi], 2
jne 0x40c98e
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x4c]
call fcn.0040e472
cmp byte [edi], 2
je 0x40c981
jmp 0x40c98e
lea edi, [esp + 0x1ac]
mov eax, ecx
mov edx, esi
mov ecx, edi
push ebx
mov dword [esp + 0x48], eax
push eax
push ebp
call fcn.0040df33
add esp, 0xc
movzx eax, word [edi + 4]
test ax, ax
mov dword [esp + 0x2c], eax
jne 0x40c745
mov eax, dword [esp + 0x1ac]
mov dword [esp + 4], eax
jmp 0x40c05a
mov ax, 2
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 4]
lea ecx, [esp + 0x1dc]
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov edx, edi
push dword [esp + 0x8c]
call fcn.0040dd92
pop eax
mov edi, dword [esp + 0x10]
mov esi, dword [esp]
test edi, edi
je 0x40c78b
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x48]
push edi
call fcn.0040e9ae
pop eax
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x24]
push dword [esp + 0x38]
call fcn.0040e902
pop eax
pop ecx
cmp byte [esi + 0x84], 2
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0x4c]
jne 0x40c7e9
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
call fcn.0040e472
cmp byte [ebx], 2
jne 0x40c7e9
mov ecx, dword [esp + 0x1c]
mov edx, ebp
call fcn.0040e472
cmp byte [ebx], 2
jne 0x40c7e9
mov edx, dword [esp + 0x18]
mov ecx, edi
call fcn.0040e472
cmp byte [esp + 0x20], 0
je 0x40c7f6
push esi
call sub.ntdll.dll_NtClose
mov eax, dword [esp + 0x2c]
jmp 0x40bead
mov ebp, dword [esp + 0x190]
mov edi, dword [esp + 0x194]
mov ecx, str.PATH
call fcn.0040e9e8
test eax, eax
mov esi, 0x42bcec
mov ecx, str.PATHEXT
cmove edx, eax
cmove eax, esi
mov dword [esp + 0xbc], edx
mov dword [esp + 0xb8], eax
call fcn.0040e9e8
test eax, eax
lea ecx, [esp + 0x80]
cmove edx, eax
cmovne esi, eax
and dword [ecx + 4], 0
and dword [ecx + 8], 0
mov dword [ecx], 0xaaaaaaaa
mov dword [esp + 0xa4], edx
mov edx, dword [esp + 0xc]
mov dword [esp + 0xa8], esi
push dword [esp + 0x58]
push ebx
call fcn.0040ea9a
pop ecx
pop edx
test ax, ax
mov dword [esp + 0x2c], eax
je 0x40c9a2
mov esi, dword [esp]
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x88]
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.0040eada
pop eax
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push edi
push ebp
call fcn.0040e9ae
pop eax
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x58]
push ebx
call fcn.0040e9ae
pop eax
pop ecx
mov edi, dword [esp + 0x3c]
test edi, edi
je 0x40c8e6
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x60]
push edi
call fcn.0040e9ae
pop eax
pop ecx
cmp byte [esp + 0x54], 0
je 0x40c905
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x40]
push dword [esp + 0x54]
call fcn.0040e9cb
pop eax
pop ecx
mov edx, dword [esp + 4]
test edx, edx
je 0x40c91b
mov ecx, dword [esp + 0xc]
push dword [esp + 0x44]
call fcn.0040dd92
pop eax
mov edi, dword [esp + 0x10]
test edi, edi
je 0x40c938
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x48]
push edi
call fcn.0040e9ae
pop eax
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x24]
push dword [esp + 0x38]
call fcn.0040e902
pop eax
pop ecx
cmp byte [esi + 0x84], 2
mov esi, dword [esp + 8]
jne 0x40c98e
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
call fcn.0040e472
cmp byte [esi], 2
jne 0x40c98e
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x4c]
call fcn.0040e472
cmp byte [esi], 2
jne 0x40c98e
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
call fcn.0040e472
cmp byte [esp + 0x20], 0
je 0x40c7f6
push dword [esp + 0x14]
jmp 0x40c7f1
and dword [esp + 0x74], 0
and dword [esp + 0x70], 0
cmp dword [esp + 0x40], 0
mov dword [esp + 0x64], edi
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], 0xaaaaaaaa
je 0x40ca65
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x6c]
push dword [esp + 0x40]
push dword [esp + 0x54]
call fcn.0040ea9a
pop ecx
pop edx
test ax, ax
je 0x40ca65
mov esi, dword [esp]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x74]
mov ebx, eax
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.0040eada
pop eax
pop ecx
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x88]
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.0040eada
pop eax
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x64]
push dword [esp + 0x60]
call fcn.0040e9ae
pop eax
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x58]
push dword [esp + 0x6c]
call fcn.0040e9ae
pop eax
pop ecx
cmp dword [esp + 0x3c], 0
je 0x40cb29
mov eax, dword [esp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
jmp 0x40cb17
cmp dword [esp + 0x3c], 0
je 0x40cbfa
cmp dword [esp + 0x70], 0
je 0x40ca8c
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x6c]
push 0x5c
call fcn.0040eaea
pop ecx
test ax, ax
jne 0x40caac
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x6c]
push dword [esp + 0x60]
push dword [esp + 0x40]
call fcn.0040ea9a
pop ecx
pop edx
test ax, ax
je 0x40cbfa
mov ecx, dword [esp + 0x6c]
mov esi, dword [esp]
mov edx, dword [esp + 0x74]
mov ebx, eax
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.0040eada
pop eax
pop ecx
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x88]
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.0040eada
pop eax
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x64]
push dword [esp + 0x60]
call fcn.0040e9ae
pop eax
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x58]
push dword [esp + 0x6c]
call fcn.0040e9ae
pop eax
pop ecx
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0xc]
mov edx, dword [eax + 8]
push dword [esp + 0x60]
push dword [esp + 0x40]
call fcn.0040e9ae
pop eax
pop ecx
cmp byte [esp + 0x54], 0
je 0x40cb4b
mov eax, dword [esp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
push dword [esp + 0x40]
push dword [esp + 0x54]
call fcn.0040e9cb
pop eax
pop ecx
cmp dword [esp + 4], 0
je 0x40cb64
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
push dword [esp + 0x44]
call fcn.0040dd92
pop eax
cmp dword [esp + 0x10], 0
je 0x40cb86
mov eax, dword [esp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
push dword [esp + 0x48]
push dword [esp + 0x14]
call fcn.0040e9ae
pop eax
pop ecx
mov esi, dword [esp]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x24]
push dword [esp + 0x38]
call fcn.0040e902
pop eax
pop ecx
cmp byte [esi + 0x84], 2
jne 0x40cbe3
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
call fcn.0040e472
mov eax, dword [esp + 8]
cmp byte [eax], 2
jne 0x40cbe3
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x4c]
call fcn.0040e472
mov eax, dword [esp + 8]
cmp byte [eax], 2
jne 0x40cbe3
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
call fcn.0040e472
cmp byte [esp + 0x20], 0
je 0x40cbf3
push dword [esp + 0x14]
call sub.ntdll.dll_NtClose
mov eax, ebx
jmp 0x40bead
mov eax, dword [esp + 0x70]
test eax, eax
je 0x40cd88
mov ebx, dword [esp + 0x6c]
lea esi, [esp + 0x19c]
mov ecx, esi
mov edx, ebx
push eax
call fcn.0040f0d9
pop eax
cmp word [esi + 4], 0
je 0x40cd7d
mov esi, dword [esp]
mov edx, dword [esp + 0x74]
mov ecx, ebx
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.0040eada
pop eax
pop ecx
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x88]
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.0040eada
pop eax
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x64]
push dword [esp + 0x60]
call fcn.0040e9ae
pop eax
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x58]
push dword [esp + 0x6c]
call fcn.0040e9ae
pop eax
pop ecx
cmp dword [esp + 0x3c], 0
je 0x40ccaa
mov eax, dword [esp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
push dword [esp + 0x60]
push dword [esp + 0x40]
call fcn.0040e9ae
pop eax
pop ecx
cmp byte [esp + 0x54], 0
je 0x40cccc
mov eax, dword [esp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
push dword [esp + 0x40]
push dword [esp + 0x54]
call fcn.0040e9cb
pop eax
pop ecx
cmp dword [esp + 4], 0
je 0x40cce5
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
push dword [esp + 0x44]
call fcn.0040dd92
pop eax
cmp dword [esp + 0x10], 0
je 0x40cd07
mov eax, dword [esp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
push dword [esp + 0x48]
push dword [esp + 0x14]
call fcn.0040e9ae
pop eax
pop ecx
mov esi, dword [esp]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x24]
push dword [esp + 0x38]
call fcn.0040e902
pop eax
pop ecx
cmp byte [esi + 0x84], 2
jne 0x40cd64
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
call fcn.0040e472
mov eax, dword [esp + 8]
cmp byte [eax], 2
jne 0x40cd64
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x4c]
call fcn.0040e472
mov eax, dword [esp + 8]
cmp byte [eax], 2
jne 0x40cd64
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
call fcn.0040e472
cmp byte [esp + 0x20], 0
je 0x40cd74
push dword [esp + 0x14]
call sub.ntdll.dll_NtClose
mov ax, 0xd
jmp 0x40bead
mov eax, dword [esp + 0x19c]
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0xc]
lea edi, [esp + 0x1b4]
lea ebp, [esp + 0xfc]
lea edx, [esp + 0x6c]
push edi
push ebp
push dword [esp + 0x18]
push dword [esp + 0x10]
push dword [esp + 0x6c]
push dword [esp + 0xb8]
push dword [esp + 0xc0]
lea eax, [esp + 0x9c]
push eax
call fcn.0040eb17
add esp, 0x20
mov dword [esp + 0x2c], eax
movzx eax, ax
lea ecx, [eax - 8]
cmp ecx, 2
jb 0x40cf4f
test eax, eax
je 0x40d12d
cmp eax, 0x6d
je 0x40cf4f
cmp eax, 0x76
jne 0x40cf69
mov esi, dword [esp]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x74]
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.0040eada
pop eax
pop ecx
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x88]
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.0040eada
pop eax
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x64]
push dword [esp + 0x60]
call fcn.0040e9ae
pop eax
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x58]
push dword [esp + 0x6c]
call fcn.0040e9ae
pop eax
pop ecx
cmp dword [esp + 0x3c], 0
je 0x40ce7c
mov eax, dword [esp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
push dword [esp + 0x60]
push dword [esp + 0x40]
call fcn.0040e9ae
pop eax
pop ecx
cmp byte [esp + 0x54], 0
je 0x40ce9e
mov eax, dword [esp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
push dword [esp + 0x40]
push dword [esp + 0x54]
call fcn.0040e9cb
pop eax
pop ecx
cmp dword [esp + 4], 0
je 0x40ceb7
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
push dword [esp + 0x44]
call fcn.0040dd92
pop eax
cmp dword [esp + 0x10], 0
je 0x40ced9
mov eax, dword [esp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
push dword [esp + 0x48]
push dword [esp + 0x14]
call fcn.0040e9ae
pop eax
pop ecx
mov esi, dword [esp]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x24]
push dword [esp + 0x38]
call fcn.0040e902
pop eax
pop ecx
cmp byte [esi + 0x84], 2
jne 0x40cf36
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
call fcn.0040e472
mov eax, dword [esp + 8]
cmp byte [eax], 2
jne 0x40cf36
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x4c]
call fcn.0040e472
mov eax, dword [esp + 8]
cmp byte [eax], 2
jne 0x40cf36
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
call fcn.0040e472
cmp byte [esp + 0x20], 0
je 0x40cf46
push dword [esp + 0x14]
call sub.ntdll.dll_NtClose
mov ax, 0x6d
jmp 0x40bead
cmp dword [esp + 0x3c], 0
mov cl, byte [esp + 0x8c]
setne al
or cl, al
test cl, 1
je 0x40cff0
mov esi, dword [esp]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x74]
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.0040eada
pop eax
pop ecx
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x88]
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.0040eada
pop eax
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x64]
push dword [esp + 0x60]
call fcn.0040e9ae
pop eax
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x58]
push dword [esp + 0x6c]
call fcn.0040e9ae
pop eax
pop ecx
cmp dword [esp + 0x3c], 0
je 0x40d1e1
mov eax, dword [esp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
push dword [esp + 0x60]
push dword [esp + 0x40]
jmp 0x40d1da
mov eax, dword [esp + 0xb8]
mov edx, dword [esp + 0xbc]
lea ecx, [esp + 0x1e4]
mov ebx, ecx
mov dword [ecx], eax
mov dword [ecx + 4], edx
and dword [ecx + 8], 0
mov word [ecx + 0xc], 0x3b
mov ecx, ebx
call fcn.0040f22b
test eax, eax
je 0x40d17e
mov esi, edx
mov edx, dword [esp + 0xc]
and dword [esp + 0x70], 0
lea ecx, [esp + 0x6c]
push esi
push eax
call fcn.0040ea9a
pop ecx
pop edx
mov edx, dword [esp + 0x6c]
test ax, ax
jne 0x40d29f
lea ecx, [esp + 0xcc]
push dword [esp + 0x70]
call fcn.0040f0d9
pop eax
cmp word [esp + 0xd0], 0
jne 0x40d016
mov eax, dword [esp + 0xcc]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x6c]
mov dword [esp + 0x70], eax
push edi
push ebp
push dword [esp + 0x18]
push dword [esp + 0x10]
push dword [esp + 0x6c]
push dword [esp + 0xb8]
push dword [esp + 0xc0]
lea eax, [esp + 0x9c]
push eax
call fcn.0040eb17
add esp, 0x20
mov esi, eax
movzx eax, ax
lea ecx, [eax - 8]
cmp ecx, 2
jb 0x40d016
cmp eax, 0x6d
je 0x40d016
test eax, eax
je 0x40d12d
cmp eax, 0x76
jne 0x40d55e
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x74]
mov esi, dword [esp]
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.0040eada
pop eax
pop ecx
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x88]
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.0040eada
pop eax
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x64]
push dword [esp + 0x60]
call fcn.0040e9ae
pop eax
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x58]
push dword [esp + 0x6c]
jmp 0x40ce75
mov esi, dword [esp]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x74]
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.0040eada
pop eax
pop ecx
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x88]
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.0040eada
pop eax
pop ecx
cmp dword [esp + 0x18], 0
je 0x40d3d5
mov ecx, dword [esp]
mov eax, dword [esp + 0x18]
mov byte [ecx + 0x14], 1
mov dword [ecx + 0x10], eax
jmp 0x40d3e0
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x74]
mov esi, dword [esp]
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.0040eada
pop eax
pop ecx
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x88]
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.0040eada
pop eax
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x64]
push dword [esp + 0x60]
call fcn.0040e9ae
pop eax
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x58]
push dword [esp + 0x6c]
call fcn.0040e9ae
pop eax
pop ecx
cmp byte [esp + 0x54], 0
je 0x40d203
mov eax, dword [esp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
push dword [esp + 0x40]
push dword [esp + 0x54]
call fcn.0040e9cb
pop eax
pop ecx
cmp dword [esp + 4], 0
je 0x40d21c
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
push dword [esp + 0x44]
call fcn.0040dd92
pop eax
cmp dword [esp + 0x10], 0
je 0x40d23e
mov eax, dword [esp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
push dword [esp + 0x48]
push dword [esp + 0x14]
call fcn.0040e9ae
pop eax
pop ecx
mov esi, dword [esp]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x24]
push dword [esp + 0x38]
call fcn.0040e902
pop eax
pop ecx
cmp byte [esi + 0x84], 2
jne 0x40c98e
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
call fcn.0040e472
mov eax, dword [esp + 8]
cmp byte [eax], 2
jne 0x40c98e
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x4c]
call fcn.0040e472
mov eax, dword [esp + 8]
cmp byte [eax], 2
je 0x40c981
jmp 0x40c98e
mov edi, dword [esp + 0x74]
mov ecx, edx
mov esi, eax
mov edx, edi
mov edi, dword [esp]
push dword [edi + 0xc]
push dword [edi + 8]
call fcn.0040eada
pop eax
pop ecx
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x88]
push dword [edi + 0xc]
push dword [edi + 8]
call fcn.0040eada
pop eax
pop ecx
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x64]
push dword [esp + 0x60]
call fcn.0040e9ae
pop eax
pop ecx
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x58]
push dword [esp + 0x6c]
call fcn.0040e9ae
pop eax
pop ecx
cmp byte [esp + 0x54], 0
je 0x40d326
mov eax, dword [esp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
push dword [esp + 0x40]
push dword [esp + 0x54]
call fcn.0040e9cb
pop eax
pop ecx
cmp dword [esp + 4], 0
je 0x40d33f
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
push dword [esp + 0x44]
call fcn.0040dd92
pop eax
cmp dword [esp + 0x10], 0
je 0x40d361
mov eax, dword [esp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
push dword [esp + 0x48]
push dword [esp + 0x14]
call fcn.0040e9ae
pop eax
pop ecx
mov edi, dword [esp]
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x24]
push dword [esp + 0x38]
call fcn.0040e902
pop eax
pop ecx
cmp byte [edi + 0x84], 2
jne 0x40d3be
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
call fcn.0040e472
mov eax, dword [esp + 8]
cmp byte [eax], 2
jne 0x40d3be
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x4c]
call fcn.0040e472
mov eax, dword [esp + 8]
cmp byte [eax], 2
jne 0x40d3be
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
call fcn.0040e472
cmp byte [esp + 0x20], 0
je 0x40d3ce
push dword [esp + 0x14]
call sub.ntdll.dll_NtClose
mov eax, esi
jmp 0x40bead
mov eax, dword [esp]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40d3f4
mov ecx, dword [esp]
mov byte [ecx + 0x1c], 1
mov dword [ecx + 0x18], eax
jmp 0x40d3ff
mov eax, dword [esp]
and dword [eax + 0x1c], 0
and dword [eax + 0x18], 0
mov eax, dword [esp + 0x28]
test eax, eax
je 0x40d413
mov ecx, dword [esp]
mov byte [ecx + 0x24], 1
mov dword [ecx + 0x20], eax
jmp 0x40d41e
mov eax, dword [esp]
and dword [eax + 0x24], 0
and dword [eax + 0x20], 0
movsd xmm0, qword [esp + 0x1b4]
mov eax, dword [esp]
movsd qword [eax], xmm0
and dword [eax + 0x2c], 0
and dword [eax + 0x28], 0
and dword [eax + 0x34], 0
and dword [eax + 0x30], 0
cmp byte [eax + 0x84], 2
jne 0x40d450
push dword [esp + 0x30]
call sub.ntdll.dll_NtClose
mov eax, dword [esp]
cmp byte [eax + 0x86], 2
jne 0x40d465
push dword [esp + 0x38]
call sub.ntdll.dll_NtClose
mov eax, dword [esp]
cmp byte [eax + 0x85], 2
jne 0x40d47a
push dword [esp + 0x4c]
call sub.ntdll.dll_NtClose
mov esi, dword [esp]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x64]
push dword [esp + 0x60]
call fcn.0040e9ae
pop eax
pop ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [eax + 8]
push dword [esp + 0x58]
push dword [esp + 0x6c]
call fcn.0040e9ae
pop eax
pop ecx
cmp dword [esp + 0x3c], 0
je 0x40d4cf
mov eax, dword [esp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
push dword [esp + 0x60]
push dword [esp + 0x40]
call fcn.0040e9ae
pop eax
pop ecx
cmp byte [esp + 0x54], 0
je 0x40d4f1
mov eax, dword [esp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
push dword [esp + 0x40]
push dword [esp + 0x54]
call fcn.0040e9cb
pop eax
pop ecx
cmp dword [esp + 4], 0
je 0x40d50a
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
push dword [esp + 0x44]
call fcn.0040dd92
pop eax
cmp dword [esp + 0x10], 0
je 0x40d52c
mov eax, dword [esp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
push dword [esp + 0x48]
push dword [esp + 0x14]
call fcn.0040e9ae
pop eax
pop ecx
mov eax, dword [esp]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
push dword [esp + 0x24]
push dword [esp + 0x38]
call fcn.0040e902
pop eax
pop ecx
cmp byte [esp + 0x20], 0
je 0x40d557
push dword [esp + 0x14]
call sub.ntdll.dll_NtClose
xor eax, eax
jmp 0x40bead
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x74]
jmp 0x40d2a9
movzx eax, byte [edx]
xor edx, edx
mov byte [ecx + 2], dl
mov byte [esp + 2], dl
mov word [ecx], ax
and word [ecx + 4], 0
mov word [esp], ax
jmp 0x40e41e
mov bh, byte [edx + 1]
mov si, 0x4a
xor ebp, ebp
mov bl, bh
and bl, 0xc0
cmp bl, 0x80
jne 0x40e361
mov al, byte [edx + 2]
mov bl, al
and bl, 0xc0
cmp bl, 0x80
jne 0x40e361
mov dl, byte [edx]
and bh, 0x3f
and al, 0x3f
mov si, 0x4b
movzx edi, bh
shl edi, 6
and dl, 0xf
movzx edx, dl
shl edx, 0xc
or edi, edx
movzx edx, al
or edx, edi
cmp edx, 0x800
jb 0x40e361
and edi, 0xf800
mov si, 0x4c
cmp edi, 0xd800
je 0x40e361
xor esi, esi
mov ebp, edx
mov word [esp + 8], dx
mov byte [esp + 0xa], 0
movzx eax, si
mov dword [ecx], ebp
jmp 0x40e3d1
mov bl, byte [edx + 1]
mov si, 0x4a
mov bh, bl
and bh, 0xc0
cmp bh, 0x80
jne 0x40e3ca
mov al, byte [edx + 2]
mov bh, al
and bh, 0xc0
cmp bh, 0x80
jne 0x40e3ca
mov bh, byte [edx + 3]
mov ah, bh
and ah, 0xc0
cmp ah, 0x80
jne 0x40e3ca
movzx edx, byte [edx]
and bl, 0x3f
and al, 0x3f
and bh, 0x3f
movzx esi, bl
movzx eax, al
shl esi, 6
shl edx, 0xc
or esi, edx
movzx edx, bh
or eax, esi
mov si, 0x4b
shl eax, 6
or edx, eax
mov edi, edx
and edi, 0x1fffff
cmp edi, 0x10000
jae 0x40e426
xor ebx, ebx
movzx eax, si
mov dword [ecx], ebx
mov dword [ecx + 4], eax
jmp 0x40e41e
mov bl, byte [edx + 1]
mov si, 0x4a
xor eax, eax
mov bh, bl
and bh, 0xc0
cmp bh, 0x80
jne 0x40e416
mov dl, byte [edx]
and bl, 0x3f
and dl, 0x1f
movzx esi, dl
movzx edx, bl
shl esi, 6
or edx, esi
mov si, 0x4b
cmp edx, 0x80
jb 0x40e416
xor esi, esi
mov eax, edx
mov word [esp + 4], dx
mov byte [esp + 6], 0
movzx edx, si
mov dword [ecx], eax
mov dword [ecx + 4], edx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov si, 0x4d
cmp edi, 0x10ffff
mov ebx, 0
ja 0x40e3cc
mov ebx, edx
movzx eax, dx
xor esi, esi
mov word [esp + 0xc], dx
shr ebx, 0x10
and ebx, 0x1f
mov byte [esp + 0xe], bl
shl ebx, 0x10
or ebx, eax
jmp 0x40e3cc
test eax, eax
je 0x40f724
movzx esi, word [edx + eax + 8]
movzx edi, bl
and edi, 0xf
jmp dword [edi*4 + 0x42f294]
mov bl, 1
cmp si, 0x2e
je 0x40f6d8
jmp 0x40f724
mov bl, 2
cmp esi, 0x42
je 0x40f6d8
cmp esi, 0x43
je 0x40f6a0
cmp esi, 0x45
je 0x40f6d6
cmp esi, 0x62
je 0x40f6d8
cmp esi, 0x65
je 0x40f6d6
cmp esi, 0x63
jne 0x40f724
mov bl, 4
jmp 0x40f6d8
or esi, 0x20
mov bl, 3
cmp esi, 0x61
je 0x40f6d8
jmp 0x40f724
mov bl, 5
cmp esi, 0x4d
je 0x40f6d8
cmp esi, 0x6f
je 0x40f6c6
cmp esi, 0x6d
je 0x40f6d8
cmp esi, 0x4f
jne 0x40f724
mov bl, 6
jmp 0x40f6d8
or esi, 0x20
mov bl, 8
cmp esi, 0x78
je 0x40f6d8
jmp 0x40f724
mov bl, 7
add eax, 2
jmp 0x40f655
or esi, 0x20
cmp esi, 0x74
jne 0x40f724
movzx eax, word [0x42bd08]
jmp 0x40f726
or esi, 0x20
cmp esi, 0x64
jne 0x40f724
movzx eax, word [0x42bb70]
jmp 0x40f726
or esi, 0x20
cmp esi, 0x6d
jne 0x40f724
movzx eax, word [0x42bd0a]
jmp 0x40f726
or esi, 0x20
cmp esi, 0x65
jne 0x40f724
movzx eax, word [0x42bd0c]
jmp 0x40f726
xor eax, eax
mov word [ecx], ax
pop esi
pop edi
pop ebx
ret
movzx ebp, ax
mov edi, ebp
shr edi, 8
and edi, 0xf
mov eax, ebp
shr eax, 0xc
cmp eax, 4
ja case.default.0x4122b9
mov esi, ebp
shr esi, 4
and esi, 0xf
and ebp, 0xf
jmp dword [eax*4 + 0x42f2b8]
imul eax, edi, 0x4c
lea edi, [esp + eax + 0x54]
imul eax, esi, 0x4c
lea esi, [esp + eax + 0x54]
mov ecx, 0x13
rep movsd dword es:[edi], dword [esi]
jmp 0x41249e
imul edx, edi, 0x4c
mov ecx, dword [esp + edx + 0x54]
add ecx, 0x1f
xor eax, eax
cmp ecx, 0x20
jb 0x4122fa
lea edx, [esp + edx + 0x54]
shr ecx, 5
xor eax, eax
or eax, dword [edx + ecx*4]
dec ecx
jne 0x4122f4
lea ecx, [eax - 1]
not eax
and eax, ecx
shr eax, 0x1f
not eax
and dword [esp + 4], eax
jmp 0x41249e
imul eax, edi, 0x4c
lea ecx, [esp + eax + 0x54]
mov edx, dword [ecx]
add edx, 0x3f
cmp edx, 0x3f
jbe 0x412483
mov dword [esp], ebx
imul eax, esi, 0x4c
lea edi, [esp + eax + 0x54]
mov esi, edx
shr esi, 5
xor eax, eax
xor ebp, ebp
inc ebp
add eax, dword [ecx + ebp*4]
mov ebx, eax
add ebx, dword [edi + ebp*4]
mov eax, ebx
shr eax, 0x1f
and ebx, 0x7fffffff
mov dword [ecx + ebp*4], ebx
inc ebp
cmp esi, ebp
jne 0x412338
xor edi, edi
cmp edx, 0x40
mov edx, dword [esp + 0x444]
mov edx, dword [edx]
jb 0x41237d
xor ebp, ebp
xor ebx, ebx
inc ebx
add ebp, dword [ecx + ebx*4]
mov edi, ebp
sub edi, dword [edx + ebx*4]
mov ebp, edi
sar ebp, 0x1f
inc ebx
cmp esi, ebx
jne 0x412368
shr edi, 0x1f
mov ebx, dword [esp]
jmp 0x412490
imul eax, edi, 0x4c
lea ecx, [esp + eax + 0x54]
mov eax, dword [ecx]
add eax, 0x3f
xor edi, edi
cmp eax, 0x40
jb 0x4123cd
mov dword [esp], ebx
imul edx, esi, 0x4c
lea edx, [esp + edx + 0x54]
shr eax, 5
xor esi, esi
xor ebp, ebp
inc ebp
add esi, dword [ecx + ebp*4]
mov edi, esi
sub edi, dword [edx + ebp*4]
mov esi, edi
sar esi, 0x1f
mov ebx, edi
and ebx, 0x7fffffff
mov dword [ecx + ebp*4], ebx
inc ebp
cmp eax, ebp
jne 0x4123aa
shr edi, 0x1f
mov ebx, dword [esp]
mov eax, dword [esp + 0x444]
mov edx, dword [eax]
push edi
call fcn.0041153f
jmp 0x41249b
imul eax, edi, 0x4c
lea ecx, [esp + eax + 0x54]
imul eax, esi, 0x4c
lea edx, [esp + eax + 0x54]
imul eax, ebp, 0x4c
lea eax, [esp + eax + 0x54]
mov esi, dword [esp + 0x444]
push dword [esi + 0xc]
push dword [esi]
push eax
call fcn.004116cd
add esp, 0xc
jmp 0x41249e
mov dword [esp], ebx
mov ebx, dword [esp + 0x444]
mov eax, dword [ebx]
mov ecx, dword [eax]
mov edx, ecx
shr edx, 5
neg edx
lea ecx, [ecx + edx + 7]
shr ecx, 3
mov edx, ecx
lea ecx, [esp + 0x12]
mov ebx, edx
mov dword [esp + 0xc], edx
push eax
call fcn.00410e09
add esp, 4
lea eax, [esp + 0x12]
add byte [ebx + eax - 1], 0xfe
imul eax, edi, 0x4c
lea ecx, [esp + eax + 0x54]
imul eax, esi, 0x4c
lea eax, [esp + eax + 0x54]
imul edx, ebp, 0x4c
lea esi, [esp + edx + 0x54]
lea edx, [esp + 0x12]
push esi
push eax
mov eax, dword [esp + 0x44c]
push dword [eax + 0xc]
push dword [eax]
mov ebx, dword [esp + 0x10]
push dword [esp + 0x1c]
call fcn.00411418
add esp, 0x14
jmp 0x41249e
mov eax, dword [esp + 0x444]
mov edx, dword [eax]
xor eax, eax
xor edi, edi
xor edi, 1
or edi, eax
push edi
call fcn.004111af
add esp, 4
mov eax, dword [esp + 0x448]
movzx eax, word [eax + ebx*2 + 2]
inc ebx
test ax, ax
jne 0x412299
jmp 0x4124bd
push 0xe4
lea eax, [esp + 0x58]
push eax
push dword [esp + 0x10]
call fcn.0040307b
add esp, 0xc
mov eax, dword [esp + 4]
add esp, 0x430
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, byte [edx]
inc edx
cmp al, 0x58
ja 0x4162e3
mov esi, dword [esp + 4]
lea edi, [esi - 4]
cmp al, 0x58
ja case.default.0x416224
movzx eax, al
jmp dword [eax*4 + 0x42f2cc]
mov dword [esp + 0x14], edi
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov eax, dword [ebp + 8]
movzx eax, word [eax + 0x4cc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x416326
mov eax, dword [esp + 0x14]
mov esi, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4c8]
mov dword [esp + 0x10], eax
xor edi, edi
mov eax, dword [esp + 0x10]
mov ebx, dword [eax + edi*4]
push ebx
call sub.msvcrt.dll_strlen
add esp, 4
cmp esi, eax
jne 0x416288
push esi
push ebx
push dword [esp + 0x2c]
call fcn.004030d7
add esp, 0xc
test eax, eax
je 0x416294
inc edi
cmp dword [esp + 0x18], edi
jne 0x416262
jmp 0x416326
mov eax, dword [esp + 0x14]
mov dword [eax], edi
mov edi, eax
mov edx, dword [esp + 8]
mov al, byte [edx]
inc edx
cmp al, 0x59
mov ebx, dword [esp + 0xc]
mov esi, dword [esp + 4]
jb 0x41621d
jmp 0x4162e3
mov eax, dword [ebp + 8]
movzx esi, word [eax + 0x4cc]
test esi, esi
jne 0x417bfe
mov eax, dword [esp + 4]
mov dword [eax], 0
add eax, 4
mov dword [esp + 4], eax
mov al, byte [edx]
inc edx
cmp al, 0x59
jb 0x416216
mov edi, edx
movzx eax, al
movzx eax, word [eax + eax + 0x42d408]
lea eax, [eax + 0x42c818]
xor ecx, ecx
movzx edx, byte [eax]
inc eax
mov esi, ecx
shl esi, 7
mov ecx, edx
and ecx, 0x7f
or ecx, esi
test dl, dl
js 0x4162f8
mov edx, 0x42c818
sub edi, edx
lea ebx, [ebx + ecx*4 + 4]
shl ecx, 0x10
add ecx, edi
mov dword [ebx - 4], ecx
mov edx, eax
jmp case.default.0x416224
mov eax, dword [esp + 0x14]
mov dword [eax], 0xffffffff
mov ebx, dword [esp + 0xc]
mov edx, dword [esp + 8]
jmp case.default.0x416224
mov eax, dword [ebx - 4]
add ebx, 0xfffffffc
mov ecx, eax
shr ecx, 0xe
and ecx, 0xfffffffc
sub ebx, ecx
and eax, 0xffff
je 0x417c7a
lea edx, [eax + 0x42c818]
jmp case.default.0x416224
movzx ecx, byte [edx]
inc edx
mov esi, edx
mov edx, ecx
and edx, 0x40
add edx, edx
mov eax, ecx
and eax, 0x7f
sub eax, edx
mov edx, esi
test cl, cl
jns 0x417ad9
movzx ecx, byte [edx]
inc edx
shl eax, 7
mov esi, edx
mov edx, ecx
and edx, 0x7f
or eax, edx
jmp 0x416377
xor eax, eax
movzx ecx, byte [edx]
inc edx
mov esi, edx
mov edx, eax
shl edx, 7
mov eax, ecx
and eax, 0x7f
or eax, edx
mov edx, esi
test cl, cl
js 0x416395
shl eax, 2
mov ecx, ebx
sub ecx, eax
mov eax, dword [ecx - 8]
jmp 0x417ad9
mov dword [esp + 0x14], edi
mov eax, dword [edi]
xor ecx, ecx
mov edi, edx
movzx edx, byte [edi]
inc edi
mov esi, ecx
shl esi, 7
mov ecx, edx
and ecx, 0x7f
or ecx, esi
test dl, dl
js 0x4163c6
shl ecx, 2
mov edx, ebx
sub edx, ecx
mov dword [edx - 8], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
mov edx, edi
jmp case.default.0x416224
mov esi, edx
movzx ecx, byte [edx]
mov edx, ecx
and edx, 0x40
add edx, edx
mov eax, ecx
and eax, 0x7f
sub eax, edx
mov edx, esi
test cl, cl
jns 0x4175bc
movzx ecx, byte [edx + 1]
inc edx
shl eax, 7
mov esi, edx
mov edx, ecx
and edx, 0x7f
or eax, edx
jmp 0x416406
mov esi, edx
movzx ecx, byte [edx]
mov edx, ecx
and edx, 0x40
add edx, edx
mov eax, ecx
and eax, 0x7f
sub eax, edx
mov edx, esi
test cl, cl
jns 0x4175c5
movzx ecx, byte [edx + 1]
inc edx
shl eax, 7
mov esi, edx
mov edx, ecx
and edx, 0x7f
or eax, edx
jmp 0x416436
mov esi, edx
movzx ecx, byte [edx]
mov edx, ecx
and edx, 0x40
add edx, edx
mov eax, ecx
and eax, 0x7f
sub eax, edx
mov edx, esi
test cl, cl
jns 0x4175d2
movzx ecx, byte [edx + 1]
inc edx
shl eax, 7
mov esi, edx
mov edx, ecx
and edx, 0x7f
or eax, edx
jmp 0x416466
mov eax, dword [ebp + 8]
mov esi, dword [eax + 0x31c]
test esi, esi
je case.default.0x416224
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 4]
mov ecx, dword [eax - 8]
mov ebx, dword [ebp + 8]
mov edi, dword [eax - 4]
cmp edi, esi
cmovb esi, edi
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], ecx
add eax, ecx
push esi
push eax
push dword [ebx + 0x310]
call fcn.0040307b
add esp, 0xc
cmp byte [ebx - 0x7b0], 0x16
jne 0x4164e4
mov edx, dword [ebx + 0x310]
mov ecx, dword [esp + 0x28]
push esi
call fcn.00423008
add esp, 4
mov ecx, dword [esp + 0x10]
add ecx, esi
mov eax, dword [esp + 4]
mov dword [eax - 8], ecx
sub edi, esi
mov dword [eax - 4], edi
add dword [ebx + 0x310], esi
sub dword [ebx + 0x31c], esi
jmp 0x416330
mov cl, byte [esi - 4]
shr dword [esi - 8], cl
jmp case.0x416224.82
mov eax, dword [esi - 8]
xor ecx, ecx
cmp eax, dword [esi - 4]
setne cl
jmp 0x4173cd
mov eax, dword [edi]
movzx eax, byte [eax + 0x42d5c8]
jmp 0x417aef
mov eax, dword [esi - 8]
mov edi, dword [esp + 0x1c]
add eax, edi
lea ecx, [esi - 0xc]
mov dword [esp + 0x10], ecx
mov ecx, dword [esi - 0xc]
add ecx, edi
push dword [esi - 4]
push eax
push ecx
mov edi, edx
call fcn.0040307b
mov edx, edi
add esp, 0xc
jmp 0x4175af
movsd xmm0, qword [esi - 8]
shufps xmm0, xmm0, 0xe1
movlps qword [esi - 8], xmm0
jmp case.default.0x416224
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4b4]
mov ecx, dword [eax]
push eax
mov edi, esi
mov esi, edx
call dword [ecx + 0x14]
mov edx, esi
add esp, 4
mov dword [edi], eax
add edi, 4
jmp case.0x416224.82
mov eax, dword [esi - 8]
imul eax, dword [esi - 4]
mov dword [esi - 8], eax
jmp case.0x416224.82
mov eax, dword [ebp + 8]
mov esi, dword [eax + 0x318]
test esi, esi
je case.default.0x416224
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 4]
mov ecx, dword [eax - 8]
mov ebx, dword [ebp + 8]
mov edi, dword [eax - 4]
cmp edi, esi
cmovb esi, edi
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], ecx
add eax, ecx
push esi
push dword [ebx + 0x30c]
push eax
call fcn.0040307b
add esp, 0xc
cmp byte [ebx - 0x7b1], 0x16
jne 0x4165ff
mov edx, dword [ebx + 0x30c]
mov ecx, dword [esp + 0x28]
push esi
call fcn.00423008
add esp, 4
mov ecx, dword [esp + 0x10]
add ecx, esi
mov eax, dword [esp + 4]
mov dword [eax - 8], ecx
sub edi, esi
mov dword [eax - 4], edi
add dword [ebx + 0x30c], esi
sub dword [ebx + 0x318], esi
jmp 0x416330
xor eax, eax
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx + 0x528]
jmp 0x4170a5
not dword [edi]
jmp case.default.0x416224
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x4bc]
test eax, eax
mov dword [esp + 8], edx
je 0x4177e3
mov edx, dword [ecx + 0x4b8]
add edx, 4
xor ecx, ecx
mov esi, dword [edx]
lea ecx, [ecx + esi + 3]
add edx, 8
dec eax
jne 0x416659
jmp 0x4177e5
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x4bc]
test eax, eax
je 0x4175e7
mov ecx, dword [edi + 0x4b8]
mov dword [esp + 8], edx
mov edx, dword [ecx]
mov dword [edi + 0x4c0], edx
mov edx, dword [ecx + 4]
mov dword [edi + 0x4c4], edx
add ecx, 8
mov dword [edi + 0x4b8], ecx
dec eax
mov dword [edi + 0x4bc], eax
mov dword [esi], edx
mov edx, dword [esp + 8]
jmp 0x4170a9
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x52c]
mov dword [esi], eax
mov eax, dword [ecx + 0x530]
mov dword [esi + 4], eax
add esi, 8
mov dword [esp + 4], esi
jmp case.default.0x416224
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x540]
test eax, eax
je case.default.0x416224
mov ecx, dword [eax]
push eax
mov esi, edx
call dword [ecx + 4]
jmp 0x417168
xor eax, eax
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx + 0x524]
jmp 0x4170a5
mov eax, dword [edi]
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + eax]
jmp 0x417aef
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov ecx, dword [esi - 0xc]
xor eax, eax
cmp dword [esi - 8], 0
sete al
shl eax, 4
mov edx, dword [ebp + 8]
mov ecx, dword [edx + ecx*4 + 0x498]
mov dword [esp + 0x18], ecx
mov ebx, dword [ecx + 4]
shr ebx, 8
and ebx, 0x7f
movzx ecx, word [edx - 0xd8]
xor edi, edi
cmp ecx, 0x301
mov eax, dword [eax + edx + 0x4dc]
ja 0x416756
mov edi, dword [eax + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esi - 4]
mov ecx, dword [esi - 0x14]
mov dword [esp + 0x20], ecx
mov edx, dword [esi - 0x10]
mov dword [esp + 0x10], eax
lea esi, [ebx + eax]
mov dword [esp + 0x30], edi
lea eax, [edi + esi]
lea edi, [esp + 0xb0]
mov ecx, dword [esp + 0x1c]
push edi
push eax
call fcn.00418da4
add esp, 8
cmp dword [esp + 0x20], 0
je 0x4177f3
lea eax, [ebx + ebx]
add esi, esi
mov edi, dword [ebp + 8]
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0xb0]
mov dword [esp + 0x20], ecx
jmp 0x41780f
mov esi, edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4b4]
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x18]
add esp, 8
xor ecx, ecx
cmp byte [eax], 2
jne 0x4167d1
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
mov dword [eax + 0x53c], ecx
mov edx, esi
jmp case.default.0x416224
mov eax, dword [esi - 4]
or dword [esi - 8], eax
jmp case.0x416224.82
mov eax, dword [edi]
mov ecx, dword [esp + 0x1c]
movzx eax, word [ecx + eax]
jmp 0x417aef
mov eax, dword [esi - 8]
xor ecx, ecx
cmp eax, dword [esi - 4]
setle cl
jmp 0x4173cd
mov dword [esp + 8], edx
mov edx, dword [esi - 8]
mov edi, dword [esi - 4]
lea eax, [esi - 0xc]
mov dword [esp + 0x10], eax
lea eax, [edi + edi]
cmp dword [esi - 0xc], 0
lea esi, [edi + edi + 4]
cmove esi, eax
mov dword [esp + 0xc], ebx
lea ebx, [esp + edi + 0xb0]
lea eax, [esp + 0xb0]
cmove ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4e4]
mov dword [esp + 0x18], eax
lea eax, [edi + 4]
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0xb0]
push eax
push dword [esp + 8]
call fcn.00418da4
add esp, 8
lea eax, [esp + esi + 0xb0]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x508]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x4f4]
push edi
mov edi, dword [ebp + 8]
push ebx
mov ebx, dword [esp + 0x1c]
push dword [esp + 0x28]
push dword [esp + 0x58]
call dword [ecx + 0xc]
mov edx, dword [esp + 0x20]
add esp, 0x18
jmp 0x4175a8
mov dword [esp + 8], edx
xor edx, edx
cmp dword [esi - 4], 5
sete dl
cmp dword [esi - 8], 0
lea eax, [esp + 0x6c]
mov ecx, dword [esp + 0x34]
mov dword [eax], ecx
mov edi, 0x20
mov dword [eax + 4], edi
lea ecx, [esp + 0xb0]
mov dword [esp + 4], esi
mov esi, ecx
lea ecx, [esp + 0xd0]
cmove esi, ecx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 8], ecx
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0xf0]
lea ecx, [esp + 0xfc]
cmove ebx, ecx
mov dword [eax + 0xc], edi
mov edi, dword [ebp + 8]
movzx edi, word [edi - 0xd8]
cmp edi, 0x303
lea edx, [edx*4 + 0x4d4]
mov edi, 0x4d0
cmovae edi, edx
mov ecx, dword [esp + 4]
lea ecx, [ecx - 8]
mov dword [esp + 0x10], ecx
push eax
push 2
push str.key_expansion
push 0x30
push dword [esp + 0x48]
push 0x58
lea eax, [esp + 0xc8]
push eax
mov eax, dword [ebp + 8]
call dword [eax + edi]
mov edi, dword [ebp + 8]
add esp, 0x1c
mov eax, dword [edi + 0x514]
push ebx
mov ebx, dword [esp + 0x10]
push esi
push dword [edi + 0x4fc]
push dword [edi + 0x4f8]
push dword [esp + 0x50]
call dword [eax + 0xc]
mov edx, dword [esp + 0x1c]
add esp, 0x14
jmp 0x4175af
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x540]
test eax, eax
mov dword [esp + 4], edi
jne 0x4170be
jmp case.default.0x416224
mov eax, dword [esi - 4]
add dword [esi - 8], eax
jmp case.0x416224.82
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov ecx, dword [esi - 0xc]
xor eax, eax
cmp dword [esi - 8], 0
sete al
shl eax, 4
mov edx, dword [ebp + 8]
mov ecx, dword [edx + ecx*4 + 0x498]
mov dword [esp + 0x14], ecx
mov ebx, dword [ecx + 4]
shr ebx, 8
and ebx, 0x7f
movzx ecx, word [edx - 0xd8]
xor edi, edi
cmp ecx, 0x301
mov eax, dword [eax + edx + 0x4e0]
ja 0x4169e5
mov edi, dword [eax + 4]
mov dword [esp + 0x20], eax
mov eax, dword [esi - 4]
mov ecx, dword [esi - 0x14]
mov dword [esp + 0x30], ecx
mov edx, dword [esi - 0x10]
mov dword [esp + 0x10], eax
lea esi, [ebx + eax]
mov dword [esp + 0x3c], edi
lea eax, [edi + esi]
lea edi, [esp + 0xb0]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], edi
push edi
push eax
call fcn.00418da4
add esp, 8
cmp dword [esp + 0x30], 0
je 0x417850
lea eax, [esp + ebx + 0xb0]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
lea eax, [eax + ebx*2]
mov edx, dword [esp + 0x3c]
lea esi, [edx + esi*2]
mov edi, dword [ebp + 8]
jmp 0x41785c
mov eax, dword [esi - 4]
jmp 0x4170a7
mov cl, byte [esi - 4]
sar dword [esi - 8], cl
jmp case.0x416224.82
push 0
mov esi, edx
call dword [sym.imp.msvcrt.dll_time]
mov edx, esi
add esp, 4
bswap eax
mov ecx, dword [esp + 0x2c]
mov dword [ecx], eax
jmp case.default.0x416224
mov eax, dword [esi - 4]
mov dword [esp + 0x10], eax
mov edi, dword [esi - 8]
cmp dword [esi - 0x10], 0
lea eax, [edi + edi]
mov ecx, esi
lea esi, [edi + edi + 4]
cmovne esi, eax
mov dword [esp + 8], edx
mov edx, dword [ecx - 0xc]
lea eax, [ecx - 0x10]
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], ebx
lea ebx, [esp + edi + 0xb0]
lea eax, [esp + 0xb0]
cmovne ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4e8]
mov dword [esp + 4], eax
lea eax, [edi + 4]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0xb0]
push eax
push dword [esp + 0x18]
call fcn.00418da4
add esp, 8
lea eax, [esp + esi + 0xb0]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x51c]
push dword [esp + 0x10]
push eax
push edi
push ebx
mov ebx, dword [esp + 0x1c]
push dword [esp + 0x14]
push dword [esp + 0x54]
call dword [ecx + 0xc]
mov edx, dword [esp + 0x20]
add esp, 0x18
jmp 0x416fa1
mov eax, dword [esi - 4]
sub dword [esi - 8], eax
jmp case.0x416224.82
mov eax, dword [esi - 8]
xor ecx, ecx
cmp eax, dword [esi - 4]
setge cl
jmp 0x4173cd
mov eax, dword [edi]
add eax, dword [esp + 0x1c]
push eax
mov esi, edx
call sub.msvcrt.dll_strlen
mov edx, esi
add esp, 4
jmp 0x417aef
neg dword [edi]
jmp case.default.0x416224
mov cl, byte [esi - 4]
shl dword [esi - 8], cl
jmp case.0x416224.82
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x540]
test eax, eax
je case.default.0x416224
mov ecx, dword [eax]
push eax
mov esi, edx
call dword [ecx + 0x14]
jmp 0x417168
mov eax, dword [esi - 4]
cmp dword [esi - 8], 0
mov dword [esp + 8], edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], eax
je 0x4178a6
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx - 0xa4]
movzx eax, byte [ecx - 0x1e]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x18], eax
jmp 0x4178cd
mov eax, dword [esi - 8]
xor ecx, ecx
cmp eax, dword [esi - 4]
setg cl
jmp 0x4173cd
mov dword [esp + 8], edx
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0x545]
test edx, edx
je 0x417a66
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
push edi
call fcn.00423148
add esp, 4
jmp 0x417a94
mov esi, edx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x310]
sub edx, dword [eax + 0x314]
je 0x416c06
mov ecx, dword [esp + 0x1c]
call fcn.00418af4
mov edx, dword [ebp + 8]
mov eax, dword [edx - 0x7c0]
cmp eax, dword [edx - 0x7bc]
je 0x416c2b
cmp eax, dword [edx - 0x7b8]
je 0x416c2b
mov ecx, dword [esp + 0x1c]
call fcn.00418b1b
mov edx, dword [ebp + 8]
mov al, byte [edx - 0x7b4]
and al, 0xfe
cmp al, 2
jne 0x4175f2
mov ecx, dword [edx - 0x7c0]
mov edi, edx
mov edx, dword [edx - 0x7bc]
xor eax, eax
sub edx, ecx
mov dword [edi + 0x31c], edx
mov edx, esi
je 0x417602
add ecx, dword [edi - 0x7dc]
mov eax, ecx
jmp 0x417602
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov esi, dword [edi]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4b4]
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x18]
add esp, 8
mov ebx, dword [eax + 8]
mov ecx, 0x3c
test ebx, ebx
je 0x417c39
mov dword [esp + 0x18], esi
add eax, 4
mov edx, dword [eax]
mov esi, dword [esp + 0x48]
cmp byte [edx], 0
jne 0x417695
inc edx
dec ebx
jne 0x416ca3
jmp 0x417c39
mov esi, edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4b4]
mov ecx, dword [eax]
lea edx, [esp + 0xb0]
push edx
push eax
call dword [ecx + 0x18]
add esp, 8
test eax, eax
je 0x417ad5
movzx eax, byte [eax]
or eax, dword [esp + 0xb0]
jmp 0x417ad7
mov dword [esp + 8], edx
mov edx, dword [esi - 8]
mov edi, dword [esi - 4]
lea eax, [esi - 0xc]
mov dword [esp + 0x10], eax
lea eax, [edi + edi]
cmp dword [esi - 0xc], 0
lea esi, [edi + edi + 4]
cmovne esi, eax
mov dword [esp + 0xc], ebx
lea ebx, [esp + edi + 0xb0]
lea eax, [esp + 0xb0]
cmovne ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4e4]
mov dword [esp + 0x18], eax
lea eax, [edi + 4]
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0xb0]
push eax
push dword [esp + 8]
call fcn.00418da4
add esp, 8
lea eax, [esp + esi + 0xb0]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x50c]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x4f4]
push edi
push ebx
mov ebx, dword [esp + 0x1c]
push dword [esp + 0x28]
push dword [esp + 0x54]
call dword [ecx + 0xc]
mov edx, dword [esp + 0x20]
add esp, 0x18
jmp 0x4175af
mov edi, dword [ebp + 8]
cmp dword [edi + 0x318], 0
je 0x4175e7
mov esi, ebx
mov eax, dword [edi + 0x30c]
lea ecx, [eax + 1]
mov dword [edi + 0x30c], ecx
movzx ebx, byte [eax]
mov byte [esp + 0xb0], bl
cmp byte [edi - 0x7b1], 0x16
jne 0x416dcc
mov edi, edx
lea edx, [esp + 0xb0]
mov ecx, dword [esp + 0x28]
push 1
call fcn.00423008
mov edx, edi
add esp, 4
mov eax, dword [esp + 4]
mov dword [eax], ebx
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
dec dword [eax + 0x318]
mov ebx, esi
jmp case.default.0x416224
mov ecx, esi
add esi, 0xfffffff8
mov eax, dword [ecx - 8]
add eax, dword [esp + 0x1c]
push dword [ecx - 4]
push eax
push dword [esp + 0x50]
mov edi, edx
call fcn.0041fc1e
mov edx, edi
add esp, 0xc
mov dword [esp + 4], esi
jmp case.default.0x416224
mov eax, dword [ebp + 8]
mov dword [eax + 0x318], 0
jmp case.default.0x416224
mov al, 1
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x318], 0
jne 0x416e68
mov esi, dword [ebp + 8]
movzx ecx, byte [esi - 0x7b4]
xor eax, eax
inc eax
or ecx, 2
cmp ecx, 3
jne 0x416e5f
cmp dword [esi - 0x7c4], 0
je 0x416e5f
xor eax, eax
mov ecx, dword [ebp + 8]
cmp dword [ecx - 0x7cc], 5
setb al
test eax, eax
sete al
mov esi, dword [esp + 4]
movzx eax, al
jmp 0x4170a7
mov esi, ebx
mov bl, byte [edi]
mov byte [esp + 0xb0], bl
mov eax, dword [ebp + 8]
cmp dword [eax + 0x31c], 0
je 0x417aeb
mov dword [esp + 0x14], edi
cmp byte [eax - 0x7b0], 0x16
jne 0x416eb1
mov edi, edx
lea edx, [esp + 0xb0]
mov ecx, dword [esp + 0x28]
push 1
call fcn.00423008
mov edx, edi
add esp, 4
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x310]
lea ecx, [eax + 1]
mov dword [edi + 0x310], ecx
mov byte [eax], bl
dec dword [edi + 0x31c]
xor eax, eax
dec eax
mov ebx, esi
mov edi, dword [esp + 0x14]
jmp 0x417aef
mov eax, dword [esi - 8]
jmp 0x4170a7
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x4b4]
mov esi, edx
mov edx, dword [ecx]
test eax, eax
cmovne eax, dword [esp + 0x60]
push eax
push ecx
call dword [edx + 4]
jmp 0x4173f6
mov eax, dword [esi - 4]
mov dword [esp + 0x10], eax
mov edi, dword [esi - 8]
cmp dword [esi - 0x10], 0
lea eax, [edi + edi]
mov ecx, esi
lea esi, [edi + edi + 4]
cmove esi, eax
mov dword [esp + 8], edx
mov edx, dword [ecx - 0xc]
lea eax, [ecx - 0x10]
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], ebx
lea ebx, [esp + edi + 0xb0]
lea eax, [esp + 0xb0]
cmove ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4e8]
mov dword [esp + 4], eax
lea eax, [edi + 4]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0xb0]
push eax
push dword [esp + 0x18]
call fcn.00418da4
add esp, 8
lea eax, [esp + esi + 0xb0]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x518]
push dword [esp + 0x10]
push eax
push edi
mov edi, dword [ebp + 8]
push ebx
mov ebx, dword [esp + 0x1c]
push dword [esp + 0x14]
push dword [esp + 0x58]
call dword [ecx + 0xc]
mov edx, dword [esp + 0x20]
add esp, 0x18
mov byte [edi - 0x7b3], 1
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
jmp case.default.0x416224
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x520]
test eax, eax
je 0x417af6
mov eax, dword [eax]
jmp 0x4170a7
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
xor eax, eax
mov edx, 0xfffffffb
xor esi, esi
mov ecx, dword [ebp + 8]
mov edi, dword [ecx + edx*4 + 0x4b4]
mov ecx, edx
add cl, 7
xor ebx, ebx
inc ebx
shl ebx, cl
xor ecx, ecx
test edi, edi
cmove ebx, edi
setne cl
add esi, ecx
or eax, ebx
inc edx
jne 0x416fd7
mov ecx, dword [esp + 4]
mov dword [ecx], eax
mov dword [ecx + 4], esi
add ecx, 8
mov dword [esp + 4], ecx
jmp 0x416330
xor eax, eax
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx + 0x318]
jmp 0x4170a5
mov eax, dword [esi - 8]
xor ecx, ecx
cmp eax, dword [esi - 4]
setl cl
jmp 0x4173cd
mov eax, dword [esi - 4]
mov cl, byte [esi - 8]
add esi, 0xfffffff8
mov dword [esp + 4], esi
mov esi, dword [esp + 0x1c]
mov byte [esi + eax], cl
jmp case.default.0x416224
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x4c4]
mov dword [esp + 4], esi
mov esi, 0x200
cmp eax, esi
cmovb esi, eax
push esi
push dword [edi + 0x4c0]
push dword [esp + 0x2c]
mov dword [esp + 0x14], edx
call fcn.0040307b
mov edx, dword [esp + 0x14]
add esp, 0xc
add dword [edi + 0x4c0], esi
sub dword [edi + 0x4c4], esi
mov eax, dword [esp + 4]
mov dword [eax], esi
add eax, 4
mov dword [esp + 4], eax
jmp case.default.0x416224
xor eax, eax
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx + 0x31c]
sbb eax, eax
mov dword [esi], eax
add esi, 4
mov dword [esp + 4], esi
jmp case.default.0x416224
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4b4]
mov ecx, dword [eax]
push dword [edi]
push dword [esp + 0x28]
push eax
mov esi, edx
call dword [ecx + 0xc]
mov edx, esi
add esp, 0xc
jmp case.0x416224.82
mov ecx, dword [esp + 0x28]
mov esi, edx
call fcn.00422f71
mov edx, esi
jmp case.default.0x416224
mov eax, dword [edi]
mov ecx, dword [esp + 0x1c]
movzx eax, byte [ecx + eax]
jmp 0x417aef
lea eax, [esi - 8]
mov dword [esp + 0x10], eax
mov eax, dword [esi - 8]
mov edi, dword [esp + 0x1c]
add eax, edi
mov ecx, dword [esi - 0xc]
add ecx, edi
push dword [esi - 4]
push eax
push ecx
mov edi, edx
call fcn.004030d7
mov edx, edi
add esp, 0xc
xor ecx, ecx
cmp eax, 1
sbb ecx, ecx
mov dword [esi - 0xc], ecx
jmp 0x4175af
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x540]
test eax, eax
jne 0x417160
jmp case.default.0x416224
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4b4]
jmp 0x4173ec
mov eax, dword [esi - 4]
and dword [esi - 8], eax
jmp case.0x416224.82
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4b4]
mov ecx, dword [eax]
push eax
mov esi, edx
call dword [ecx + 0x10]
mov edx, esi
add esp, 4
jmp case.default.0x416224
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov eax, dword [esi - 4]
mov dword [esp + 0x14], eax
mov eax, dword [esi - 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [esi - 8]
mov dword [esp + 0x18], eax
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x4b4]
mov ecx, dword [eax]
xor esi, esi
push esi
push eax
call dword [ecx + 0x18]
add esp, 8
mov dword [esp + 0x20], eax
lea ebx, [esp + 0xb0]
push 0x170
push esi
push ebx
call fcn.00403060
add esp, 0xc
mov ecx, dword [esp + 0x64]
movsd xmm0, qword [ecx]
movsd xmm1, qword [ecx + 8]
lea eax, [esp + 0xc0]
movsd qword [eax + 0x160], xmm0
movsd qword [eax + 0x168], xmm1
movsd xmm0, qword [ecx + 0x10]
movsd qword [eax + 0x170], xmm0
mov ecx, ebx
call fcn.00422f71
mov esi, 0x20
mov ecx, ebx
mov edx, dword [esp + 0x2c]
push esi
call fcn.00423008
add esp, 4
mov ecx, ebx
mov edx, dword [esp + 0x34]
push esi
mov esi, dword [esp + 0x14]
call fcn.00423008
add esp, 4
lea edx, [esp + 0x54]
mov word [edx], 3
mov al, byte [edi - 0xa4]
mov byte [edx + 2], al
mov al, byte [edi - 0x1e]
mov byte [edx + 3], al
mov ecx, ebx
push 4
call fcn.00423008
add esp, 4
movzx eax, byte [edi - 0x1e]
mov ecx, ebx
mov edx, dword [esp + 0x50]
push eax
call fcn.00423008
add esp, 4
lea eax, [esp + 0x6c]
lea ecx, [esp + 0xb0]
test esi, esi
je 0x417afd
mov edx, esi
push eax
call fcn.00423148
add esp, 4
test eax, eax
je 0x417ba8
mov ebx, eax
cmp dword [esp + 0x18], 0
je 0x417bb4
mov eax, dword [esi*4 + 0x42d698]
jmp 0x417b49
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov edi, dword [esi - 8]
mov ecx, dword [ebp + 8]
movzx eax, word [ecx - 0xd8]
cmp eax, 0x303
jb 0x417613
mov edx, dword [esi - 4]
xor eax, eax
cmp edx, 5
sete al
mov ebx, dword [ecx + eax*4 + 0x4d4]
lea eax, [esp + 0xb0]
mov dword [esp + 0x6c], eax
mov ecx, dword [esp + 0x28]
push eax
call fcn.00423148
add esp, 4
jmp 0x41765e
mov ecx, edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x540]
test eax, eax
je 0x417b8e
mov esi, dword [eax]
mov dword [esp + 0x10], esi
lea esi, [esp + 0xb0]
push esi
mov dword [esp + 0x18], ecx
push dword [ecx]
push dword [esp + 0x24]
push eax
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x20]
call dword [eax + 0x18]
mov edx, dword [esp + 0x18]
add esp, 0x10
mov al, byte [esi]
mov byte [edi + 0x544], al
mov al, byte [esi + 4]
mov byte [edi + 0x545], al
mov eax, dword [esi + 8]
mov dword [edi + 0x4b8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x4bc], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
jmp case.default.0x416224
mov eax, dword [esi - 8]
mov ecx, dword [esi - 4]
add esi, 0xfffffff8
mov dword [esp + 4], esi
mov esi, dword [esp + 0x1c]
mov dword [esi + ecx], eax
jmp case.default.0x416224
mov eax, dword [esi - 4]
movzx ecx, word [esi - 8]
add esi, 0xfffffff8
mov dword [esp + 4], esi
mov esi, dword [esp + 0x1c]
mov word [esi + eax], cx
jmp case.default.0x416224
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x4c8]
mov esi, dword [ecx + eax*4]
push esi
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], edx
call sub.msvcrt.dll_strlen
add esp, 4
mov edi, eax
push eax
push esi
push dword [esp + 0x2c]
call fcn.0040307b
mov edx, dword [esp + 0x14]
add esp, 0xc
mov eax, dword [esp + 0x14]
mov dword [eax], edi
jmp case.default.0x416224
mov eax, dword [esi - 8]
xor ecx, ecx
cmp eax, dword [esi - 4]
sete cl
neg ecx
mov dword [esi - 8], ecx
jmp case.0x416224.82
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x540]
test eax, eax
mov dword [esp + 4], edi
je case.default.0x416224
mov ecx, dword [eax]
push dword [edi]
push eax
mov esi, edx
call dword [ecx + 8]
mov edx, esi
add esp, 8
jmp case.0x416224.82
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], edi
mov ebx, dword [edi]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x4b4]
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x18]
add esp, 8
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x23c], ecx
cmp ecx, 0x85
ja 0x417c6f
lea esi, [esp + 0xb0]
push ecx
push dword [eax + 8]
push esi
call fcn.0040307b
add esp, 0xc
mov eax, dword [edi + 0x540]
mov ecx, dword [eax]
lea edx, [esp + 0x23c]
push edx
push esi
push eax
call dword [ecx + 0x1c]
add esp, 0xc
test eax, eax
je 0x417c6f
lea eax, [esp + 0x6c]
mov ecx, dword [esp + 0x2c]
mov dword [eax], ecx
mov ecx, 0x20
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x34]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
xor ecx, ecx
cmp ebx, 5
movzx edx, word [edi - 0xd8]
sete cl
cmp edx, 0x303
lea ecx, [ecx*4 + 0x4d4]
mov edx, 0x4d0
cmovae edx, ecx
mov ecx, dword [esp + 0x23c]
push eax
push 2
push str.master_secret
push ecx
lea eax, [esp + 0xc0]
push eax
push 0x30
push dword [esp + 0x50]
call dword [edi + edx]
add esp, 0x1c
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
jmp 0x416330
mov dword [esp + 8], edx
xor edx, edx
cmp dword [esi - 4], 5
sete dl
cmp dword [esi - 8], 0
lea eax, [esp + 0x6c]
mov ecx, dword [esp + 0x34]
mov dword [eax], ecx
mov edi, 0x20
mov dword [eax + 4], edi
lea ecx, [esp + 0xb0]
mov dword [esp + 4], esi
lea esi, [esp + 0xd0]
cmove esi, ecx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 8], ecx
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0xfc]
lea ecx, [esp + 0xf0]
cmove ebx, ecx
mov dword [eax + 0xc], edi
mov edi, dword [ebp + 8]
movzx edi, word [edi - 0xd8]
cmp edi, 0x303
lea edx, [edx*4 + 0x4d4]
mov edi, 0x4d0
cmovae edi, edx
mov ecx, dword [esp + 4]
lea ecx, [ecx - 8]
mov dword [esp + 0x10], ecx
push eax
push 2
push str.key_expansion
push 0x30
push dword [esp + 0x48]
push 0x58
lea eax, [esp + 0xc8]
push eax
mov eax, dword [ebp + 8]
call dword [eax + edi]
mov edi, dword [ebp + 8]
add esp, 0x1c
mov eax, dword [edi + 0x510]
push ebx
mov ebx, dword [esp + 0x10]
push esi
push dword [edi + 0x4fc]
push dword [edi + 0x4f8]
push dword [esp + 0x54]
call dword [eax + 0xc]
mov edx, dword [esp + 0x1c]
add esp, 0x14
mov byte [edi - 0x7b3], 1
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
jmp case.default.0x416224
lea edx, [edx + eax + 1]
jmp case.default.0x416224
mov ecx, dword [edi]
test ecx, ecx
cmove eax, ecx
lea edx, [edx + eax + 1]
jmp case.0x416224.82
xor ecx, ecx
cmp dword [edi], 0
cmove ecx, eax
lea edx, [edx + ecx + 1]
mov dword [esp + 4], edi
jmp case.default.0x416224
mov dword [esi], 0xffffffff
jmp 0x4170a9
mov dword [edx + 0x31c], 0
xor eax, eax
mov edi, edx
mov edx, esi
mov dword [edi + 0x310], eax
mov dword [edi + 0x314], eax
jmp case.default.0x416224
mov eax, dword [ecx + 0x4d0]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xb0]
mov dword [esp + 0x6c], eax
xor edx, edx
inc edx
mov ebx, edi
mov edi, dword [esp + 0x28]
mov ecx, edi
push eax
call fcn.00423148
add esp, 4
mov ecx, edi
mov edi, ebx
mov ebx, dword [esp + 0x10]
mov edx, 2
lea eax, [esp + 0xc0]
push eax
call fcn.00423148
add esp, 4
mov eax, 0x24
add esi, 0xfffffff8
mov dword [esp + 4], esi
lea ecx, [esp + 0x6c]
mov dword [ecx + 4], eax
test edi, edi
mov eax, str.server_finished
mov edx, str.client_finished
cmove edx, eax
push ecx
push 1
push edx
push 0x30
push dword [esp + 0x48]
push 0xc
push dword [esp + 0x3c]
call ebx
add esp, 0x1c
jmp 0x416330
mov dword [esp + 0x20], eax
cmp ebx, 0x3b
mov edx, dword [esp + 8]
jb 0x417c9e
mov ecx, 0x17
cmp ebx, 0x200
ja 0x417c9e
mov dword [esp + 0x14], edi
lea eax, [ebx - 0x31]
mov dword [esp + 0x10], eax
mov edi, dword [ebp + 8]
lea ecx, [edi + ebx + 0xdc]
mov dword [esp + 0x3c], ecx
movzx eax, word [edi - 0x29e]
rol ax, 8
mov word [ecx], ax
lea eax, [edi + ebx + 0xde]
mov dword [esp + 0x30], eax
push 0x2e
push eax
push esi
call fcn.0041fc1e
add esp, 0xc
lea eax, [esp + 0xb0]
mov ecx, dword [esp + 0x2c]
mov dword [eax], ecx
mov ecx, 0x20
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x34]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
xor ecx, ecx
cmp dword [esp + 0x18], 5
movzx edx, word [edi - 0xd8]
sete cl
cmp edx, 0x303
lea ecx, [ecx*4 + 0x4d4]
mov edx, 0x4d0
cmovae edx, ecx
mov ecx, 0x30
push eax
push 2
push str.master_secret
push ecx
push dword [esp + 0x4c]
push ecx
push dword [esp + 0x50]
call dword [edi + edx]
add esp, 0x1c
mov word [edi + 0x10c], 0x200
mov eax, dword [esp + 0x30]
mov byte [eax - 3], 0
mov dword [esp + 0x18], ebx
lea eax, [ebx - 0x33]
push eax
push dword [esp + 0x60]
push esi
call fcn.0041fc1e
add esp, 0xc
mov esi, 2
mov eax, dword [esp + 0x1c]
cmp byte [eax + esi + 0x8f0], 0
mov ebx, dword [esp + 0x48]
jne 0x4177b0
mov eax, dword [esp + 0x1c]
lea edi, [eax + esi + 0x8f0]
push 1
push edi
push ebx
call fcn.0041fc1e
add esp, 0xc
cmp byte [edi], 0
je 0x41779f
inc esi
cmp dword [esp + 0x10], esi
jne 0x417782
push dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
push esi
push dword [esp + 0x2c]
mov edi, dword [ebp + 8]
call dword [edi + 0x56c]
add esp, 0xc
test eax, eax
je 0x417ca6
mov eax, dword [esp + 0x14]
mov dword [eax], esi
jmp 0x416330
xor ecx, ecx
mov eax, dword [esp + 4]
mov dword [eax], ecx
add eax, 4
jmp 0x417a59
lea eax, [esp + ebx + 0xb0]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
lea eax, [eax + ebx*2]
mov edx, dword [esp + 0x30]
lea esi, [edx + esi*2]
mov edi, dword [ebp + 8]
add dword [esp + 4], 0xffffffec
lea ecx, [esp + esi + 0xb0]
test edx, edx
cmove ecx, edx
lea eax, [esp + eax + 0xb0]
mov edx, dword [edi + 0x504]
push ecx
push ebx
push ebx
push dword [esp + 0x2c]
push dword [esp + 0x28]
push dword [esp + 0x24]
push eax
push dword [esp + 0x30]
push dword [esp + 0x60]
call dword [edx + 0xc]
add esp, 0x24
jmp 0x416330
lea eax, [ebx + ebx]
add esi, esi
mov edi, dword [ebp + 8]
mov edx, dword [esp + 0x3c]
add dword [esp + 4], 0xffffffec
lea ecx, [esp + esi + 0xb0]
test edx, edx
cmove ecx, edx
lea eax, [esp + eax + 0xb0]
mov esi, edi
mov edx, dword [edi + 0x500]
push ecx
push ebx
push ebx
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push eax
push dword [esp + 0x3c]
push dword [esp + 0x64]
call dword [edx + 0xc]
add esp, 0x24
mov byte [edi - 0x7b3], 1
jmp 0x416330
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x4b4]
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x18]
mov ecx, esi
add esp, 8
mov edx, dword [eax + 4]
mov esi, dword [eax + 8]
mov dword [esp + 0x18], esi
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
add dword [esp + 4], 0xfffffff8
mov eax, dword [ecx + 0x520]
mov ecx, dword [eax]
bt ecx, edx
jae 0x417c5e
mov dword [esp + 0xc], ebx
lea ecx, [esp + 0x4c]
push ecx
mov esi, edx
push edx
call dword [eax + 8]
add esp, 8
movzx eax, byte [eax]
mov ecx, 0xff
mov ebx, ecx
shr ecx, 1
cmp ebx, eax
jae 0x4178fd
lea edi, [esp + 0x6c]
push dword [esp + 0x4c]
push edi
push dword [esp + 0x50]
call fcn.0041fc1e
add esp, 0xc
and byte [esp + 0x6c], bl
mov eax, dword [esp + 0x4c]
or byte [eax + edi - 1], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x520]
lea edi, [esp + 0x54]
push edi
push esi
call dword [eax + 4]
add esp, 8
mov eax, dword [esp + 0x10]
cmp dword [edi], eax
mov ebx, dword [esp + 0xc]
jne 0x417c5e
lea eax, [esp + 0xb0]
mov edi, dword [esp + 0x10]
push edi
push dword [esp + 0x1c]
push eax
call fcn.0040307b
add esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x520]
push esi
push dword [esp + 0x50]
lea ecx, [esp + 0x74]
push ecx
push edi
lea ecx, [esp + 0xc0]
push ecx
call dword [eax + 0x10]
add esp, 0x14
test eax, eax
je 0x417c5e
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x520]
lea ecx, [esp + 0x68]
push ecx
push esi
call dword [eax + 0xc]
add esp, 8
lea ecx, [esp + 0x23c]
mov edx, dword [esp + 0x2c]
mov dword [ecx], edx
mov edx, 0x20
mov dword [ecx + 4], edx
mov edi, dword [esp + 0x34]
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edx
xor edx, edx
cmp dword [esp + 0x20], 5
mov edi, dword [ebp + 8]
movzx edi, word [edi - 0xd8]
sete dl
cmp edi, 0x303
lea edx, [edx*4 + 0x4d4]
mov edi, 0x4d0
cmovae edi, edx
lea eax, [esp + eax + 0xb0]
lea edx, [esp + 0x68]
mov edx, dword [edx]
push ecx
push 2
push str.master_secret
push edx
push eax
push 0x30
push dword [esp + 0x50]
mov eax, dword [ebp + 8]
call dword [eax + edi]
mov edi, dword [ebp + 8]
add esp, 0x1c
mov eax, dword [edi + 0x520]
push esi
push dword [esp + 0x50]
lea ecx, [esp + 0x74]
push ecx
lea edi, [esp + 0xbc]
push edi
call dword [eax + 0x14]
add esp, 0x10
mov esi, dword [esp + 0x54]
push esi
push edi
push dword [esp + 0x2c]
call fcn.0040307b
mov ecx, esi
add esp, 0xc
test esi, esi
js 0x417c63
mov eax, dword [esp + 4]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
mov edx, dword [esp + 8]
jmp case.default.0x416224
xor edx, edx
inc edx
mov esi, dword [esp + 0x28]
mov ecx, esi
mov edi, dword [esp + 0x24]
push edi
call fcn.00423148
add esp, 4
mov ecx, esi
mov edx, 2
push dword [esp + 0x58]
call fcn.00423148
add esp, 4
mov eax, 0x24
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x540]
mov esi, edx
mov edx, dword [ecx]
movzx esi, byte [esi + 0x545]
push 0x200
push edi
push eax
push esi
push ecx
call dword [edx + 0x20]
add esp, 0x14
test eax, eax
je 0x417c8f
mov ecx, dword [esp + 4]
mov dword [ecx], eax
add ecx, 4
mov dword [esp + 4], ecx
mov edx, dword [esp + 8]
jmp case.default.0x416224
xor eax, eax
mov edx, esi
mov ecx, dword [esp + 4]
mov dword [ecx], eax
add ecx, 4
mov dword [esp + 4], ecx
jmp case.default.0x416224
xor eax, eax
mov ebx, esi
mov dword [edi], eax
jmp case.default.0x416224
xor eax, eax
jmp 0x4170a7
xor edx, edx
inc edx
push eax
call fcn.00423148
add esp, 4
mov esi, 0x1a
test eax, eax
je 0x417be3
lea ecx, [esp + 0xb0]
mov edx, 2
lea eax, [esp + 0x7c]
push eax
call fcn.00423148
add esp, 4
test eax, eax
mov edx, dword [esp + 8]
je 0x417be7
cmp dword [esp + 0x18], 0
je 0x417baf
xor eax, eax
mov ebx, 0x24
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x20]
add edi, 4
lea esi, [esp + 0x23c]
push esi
push edi
push ebx
push eax
push edx
push dword [esp + 0x38]
call dword [ecx + 0x524]
add esp, 0x18
test eax, eax
je 0x417b87
lea eax, [esp + 0x6c]
push ebx
push eax
push esi
call fcn.004030d7
add esp, 0xc
test eax, eax
je 0x417be1
mov esi, 0x1b
jmp 0x417be3
mov byte [edi + 0x545], 0
mov dword [edi + 0x4bc], 0
mov dword [esp + 4], ecx
jmp case.default.0x416224
mov esi, 0x1a
jmp 0x417be3
mov ebx, 0x24
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x20]
add esi, 4
lea eax, [esp + 0x6c]
push edx
push dword [esp + 0x28]
push esi
push ebx
push eax
push dword [ecx + 0x520]
call dword [ecx + 0x528]
add esp, 0x18
test eax, eax
je 0x417b87
xor esi, esi
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
mov dword [eax - 0xc], esi
add eax, 0xfffffff8
mov dword [esp + 4], eax
mov ebx, dword [esp + 0xc]
jmp case.default.0x416224
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov ebx, dword [eax + 0x4c8]
mov edi, 6
push dword [ebx]
call sub.msvcrt.dll_strlen
add esp, 4
lea edi, [edi + eax + 1]
add ebx, 4
dec esi
jne 0x417c11
mov eax, dword [esp + 4]
mov dword [eax], edi
add eax, 4
jmp 0x4174d4
mov ecx, dword [edi]
mov esi, edi
jmp 0x417c43
mov esi, edi
mov ebx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [ebp + 8]
cmp byte [eax - 0x7b4], 0
je 0x417c7f
mov byte [eax - 0x7b4], 0
mov dword [eax - 0x7e4], ecx
jmp 0x417c7f
mov ecx, 0xffffffe6
mov edx, dword [esp + 8]
mov esi, dword [esp + 4]
neg ecx
jmp 0x417c43
mov ecx, 0x1a
mov esi, dword [esp + 0x14]
jmp 0x417c3b
xor edx, edx
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov dword [eax + 4], ebx
mov dword [eax + 8], edx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x1a
mov edx, dword [esp + 8]
mov esi, dword [esp + 4]
jmp 0x417c43
mov esi, edi
mov ebx, dword [esp + 0xc]
jmp 0x417c43
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, 0x17
jmp 0x417c43
mov al, byte [ebp]
inc ebp
mov esi, ebx
cmp al, 0x3b
ja 0x423528
lea ebx, [esi - 4]
cmp al, 0x3b
ja case.default.0x423334
movzx eax, al
mov dword [esp + 0x10], ebp
jmp dword [eax*4 + 0x42f430]
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edx
mov esi, dword [edi + 0xbcc]
test esi, esi
je 0x423578
mov eax, dword [esp + 8]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x94]
mov edi, dword [eax + 0xbc8]
xor ebx, ebx
cmp dword [edi + 0xc], 0
je 0x423380
inc ebx
add edi, 0x10
cmp esi, ebx
jne 0x42336d
jmp 0x423578
cmp dword [esp + 0xc], 0
mov eax, dword [edi]
je 0x42339b
cmp byte [eax], 0
jne 0x423373
cmp byte [eax + 1], 0
jne 0x423373
mov ecx, 2
jmp 0x42339d
xor ecx, ecx
movzx edx, byte [eax + ecx]
test edx, edx
je 0x423373
mov ebp, dword [esp + 0x94]
cmp dl, byte [ebp + 0x140]
mov ebp, dword [esp + 0x10]
jne 0x423373
add eax, ecx
inc eax
push edx
push dword [esp + 0x1c]
push eax
call fcn.004030d7
add esp, 0xc
test eax, eax
jne 0x423373
mov eax, dword [esp + 8]
mov dword [eax], ebx
mov ebx, eax
mov al, byte [ebp]
inc ebp
cmp al, 0x3c
mov edi, dword [esp + 0x94]
mov edx, dword [esp]
mov esi, dword [esp + 4]
jb 0x423325
jmp 0x423528
mov dword [esp + 4], esi
mov esi, dword [edi + 0x120]
test esi, esi
je 0x4234f4
mov dword [esp], edx
push esi
call sub.msvcrt.dll_strlen
add esp, 4
mov ecx, edi
mov edi, eax
movzx eax, byte [ecx + 0x140]
mov dword [esp + 0xc], eax
cmp edi, eax
jne 0x42345c
xor edx, edx
cmp edi, edx
je 0x423506
mov eax, dword [esp + 0x18]
movzx ebx, byte [eax + edx]
movzx ecx, byte [esi + edx]
mov eax, ebx
add al, 0xbf
lea ebp, [ebx + 0x20]
cmp al, 0x1a
cmovae ebp, ebx
mov eax, ecx
add al, 0xbf
lea ebx, [ecx + 0x20]
cmp al, 0x1a
cmovae ebx, ecx
inc edx
cmp ebp, ebx
mov ebp, dword [esp + 0x10]
je 0x423427
cmp byte [esp + 0xc], 2
mov ebx, dword [esp]
jb 0x423ff4
mov eax, dword [esp + 0x18]
cmp byte [eax], 0x2a
jne 0x423ff4
mov eax, dword [esp + 0x94]
cmp byte [eax + 0x142], 0x2e
jne 0x423ff4
xor edx, edx
test edi, edi
je 0x42349e
cmp byte [esi + edx], 0x2e
je 0x42349e
inc edx
cmp edi, edx
jne 0x423491
mov edx, edi
inc edx
sub edi, edx
mov eax, dword [esp + 0xc]
add eax, 0xfffffffe
cmp eax, edi
jne 0x423ff4
add esi, edx
xor ecx, ecx
cmp edi, ecx
je 0x4234f8
mov eax, dword [esp + 0x94]
movzx ebx, byte [eax + ecx + 0x143]
movzx edx, byte [esi + ecx]
mov eax, ebx
add al, 0xbf
lea ebp, [ebx + 0x20]
cmp al, 0x1a
cmovae ebp, ebx
mov eax, edx
add al, 0xbf
lea ebx, [edx + 0x20]
cmp al, 0x1a
cmovae ebx, edx
inc ecx
cmp ebp, ebx
mov ebp, dword [esp + 0x10]
mov ebx, dword [esp]
je 0x4234b4
jmp 0x423ff4
xor eax, eax
jmp 0x423513
xor eax, eax
dec eax
mov edi, dword [esp + 0x94]
mov edx, ebx
jmp 0x423513
xor eax, eax
dec eax
mov edi, dword [esp + 0x94]
mov edx, dword [esp]
mov esi, dword [esp + 4]
mov dword [esi], eax
add esi, 4
mov al, byte [ebp]
inc ebp
cmp al, 0x3c
jb 0x423322
mov ebx, edx
mov edi, esi
movzx eax, al
movzx eax, word [eax + eax + 0x42e984]
lea eax, [eax + 0x42df10]
xor ecx, ecx
movzx edx, byte [eax]
inc eax
mov esi, ecx
shl esi, 7
mov ecx, edx
and ecx, 0x7f
or ecx, esi
test dl, dl
js 0x42353f
mov edx, 0x42df10
sub ebp, edx
mov edx, ebx
lea edx, [ebx + ecx*4 + 4]
shl ecx, 0x10
add ecx, ebp
mov dword [edx - 4], ecx
mov ebp, eax
mov ebx, edi
mov edi, dword [esp + 0x94]
jmp case.0x423334.19
mov eax, dword [esp + 8]
mov dword [eax], 0xffffffff
mov ebx, dword [esp + 4]
mov edi, dword [esp + 0x94]
mov edx, dword [esp]
jmp case.0x423334.19
mov eax, dword [edx - 4]
add edx, 0xfffffffc
mov ecx, eax
shr ecx, 0xe
and ecx, 0xfffffffc
sub edx, ecx
and eax, 0xffff
je 0x4240f6
lea ebp, [eax + 0x42df10]
jmp case.default.0x423334
mov ebx, edx
movzx ecx, byte [ebp]
inc ebp
mov edx, ecx
and edx, 0x40
add edx, edx
mov eax, ecx
and eax, 0x7f
sub eax, edx
test cl, cl
jns 0x423843
movzx ecx, byte [ebp]
inc ebp
shl eax, 7
mov edx, ecx
and edx, 0x7f
or eax, edx
jmp 0x4235d0
mov ebx, edx
xor eax, eax
movzx ecx, byte [ebp]
inc ebp
mov edx, eax
shl edx, 7
mov eax, ecx
and eax, 0x7f
or eax, edx
test cl, cl
js 0x4235ed
shl eax, 2
mov edx, ebx
mov ecx, ebx
sub ecx, eax
mov eax, dword [ecx - 8]
jmp 0x423f05
mov eax, ebx
mov ebx, edx
mov dword [esp + 8], eax
mov eax, dword [eax]
xor ecx, ecx
movzx edx, byte [ebp]
inc ebp
mov esi, ecx
shl esi, 7
mov ecx, edx
and ecx, 0x7f
or ecx, esi
test dl, dl
js 0x42361f
shl ecx, 2
mov esi, ebx
mov edx, ebx
sub edx, ecx
mov dword [edx - 8], eax
mov edx, ebx
mov ebx, dword [esp + 8]
jmp case.0x423334.19
mov ebx, edx
movzx ecx, byte [ebp]
mov edx, ecx
and edx, 0x40
add edx, edx
mov eax, ecx
and eax, 0x7f
sub eax, edx
test cl, cl
jns 0x423f21
movzx ecx, byte [ebp + 1]
inc ebp
shl eax, 7
mov edx, ecx
and edx, 0x7f
or eax, edx
jmp 0x42365f
mov esi, edx
movzx ecx, byte [ebp]
mov edx, ecx
and edx, 0x40
add edx, edx
mov eax, ecx
and eax, 0x7f
sub eax, edx
test cl, cl
jns 0x423f2e
movzx ecx, byte [ebp + 1]
inc ebp
shl eax, 7
mov edx, ecx
and edx, 0x7f
or eax, edx
jmp 0x42368c
mov esi, edx
movzx ecx, byte [ebp]
mov edx, ecx
and edx, 0x40
add edx, edx
mov eax, ecx
and eax, 0x7f
sub eax, edx
test cl, cl
jns 0x423f40
movzx ecx, byte [ebp + 1]
inc ebp
shl eax, 7
mov edx, ecx
and edx, 0x7f
or eax, edx
jmp 0x4236b9
mov eax, dword [esi - 4]
jmp 0x423f05
mov ecx, dword [esp + 0x1c]
mov ebx, edx
call fcn.00422f71
mov edx, ebx
mov byte [edi + 0x864], 1
jmp case.default.0x423334
mov eax, dword [esi - 8]
xor ecx, ecx
cmp eax, dword [esi - 4]
setne cl
jmp 0x423f17
mov eax, dword [esi - 8]
imul eax, dword [esi - 4]
mov dword [esi - 8], eax
jmp case.0x423334.19
mov eax, dword [esi - 8]
xor ecx, ecx
cmp eax, dword [esi - 4]
setl cl
jmp 0x423f17
mov eax, dword [esi - 0xc]
movsd xmm0, qword [esi - 8]
movsd qword [esi - 0xc], xmm0
mov dword [esi - 4], eax
jmp case.default.0x423334
neg dword [ebx]
jmp case.default.0x423334
mov eax, dword [edi + 0xa34]
push dword [esp + 0x14]
mov ebx, edx
call dword [eax + 8]
mov edx, ebx
add esp, 4
mov byte [edi + 0xa30], 1
jmp case.default.0x423334
mov eax, dword [esi - 8]
mov ecx, dword [esi - 4]
mov dword [esp + 8], ebx
mov ebx, edx
lea edx, [esp + 0x40]
mov byte [edx], 2
mov dword [edx + 4], eax
mov eax, dword [esp + 0x20]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov ecx, edi
call fcn.00424193
mov edx, ebx
mov ebx, dword [esp + 8]
mov dword [esi - 8], eax
jmp case.0x423334.19
mov eax, dword [esi - 4]
or dword [esi - 8], eax
jmp case.0x423334.19
mov eax, dword [esi - 8]
mov ecx, dword [esi - 4]
add esi, 0xfffffff8
mov dword [edi + ecx], eax
jmp case.default.0x423334
mov byte [edi + 0x864], 0
jmp case.default.0x423334
mov eax, dword [esi - 4]
sub dword [esi - 8], eax
jmp case.0x423334.19
mov eax, dword [esi - 8]
mov ecx, edx
cdq
idiv dword [esi - 4]
mov edx, ecx
mov dword [esi - 8], eax
jmp case.0x423334.19
cmp dword [edi + 0x13c], 0
je 0x423f53
mov ebx, edx
mov eax, dword [edi + 0x138]
lea ecx, [eax + 1]
mov dword [edi + 0x138], ecx
mov al, byte [eax]
mov byte [esp + 0x40], al
cmp byte [edi + 0x864], 0
je 0x423818
lea edx, [esp + 0x40]
mov ecx, dword [esp + 0x1c]
push 1
call fcn.00423008
add esp, 4
cmp byte [edi + 0xa30], 0
je 0x423838
mov eax, dword [edi + 0xa34]
lea ecx, [esp + 0x40]
push 1
push ecx
push dword [esp + 0x1c]
call dword [eax + 0xc]
add esp, 0xc
dec dword [edi + 0x13c]
movzx eax, byte [esp + 0x40]
mov dword [esi], eax
add esi, 4
jmp 0x423f25
mov eax, dword [esi - 8]
xor ecx, ecx
cmp eax, dword [esi - 4]
setg cl
jmp 0x423f17
mov eax, dword [edi + 0xa34]
push dword [esp + 0x28]
push dword [esp + 0x18]
mov ebx, edx
call dword [eax + 0x10]
mov edx, ebx
add esp, 8
mov byte [edi + 0xa30], 0
jmp case.default.0x423334
mov eax, dword [esi - 4]
movzx ecx, word [esi - 8]
add esi, 0xfffffff8
mov word [edi + eax], cx
jmp case.default.0x423334
mov eax, ebx
mov dword [esp], edx
mov edx, dword [ebx]
movzx eax, byte [edi + 0x140]
xor ecx, ecx
cmp al, byte [edx + 0x42eb12]
jne 0x4238c8
lea ecx, [edx + 0x42eb12]
inc ecx
push eax
push ecx
push dword [esp + 0x20]
call fcn.004030d7
add esp, 0xc
xor ecx, ecx
cmp eax, 1
sbb ecx, ecx
mov dword [ebx], ecx
mov ebx, esi
mov edx, dword [esp]
jmp case.0x423334.19
mov eax, dword [esi - 4]
add dword [esi - 8], eax
jmp case.0x423334.19
mov eax, dword [ebx]
mov eax, dword [edi + eax]
jmp 0x423ced
mov eax, dword [ebx]
movzx eax, word [edi + eax]
jmp 0x423ced
mov eax, dword [esi - 8]
xor ecx, ecx
cmp eax, dword [esi - 4]
setge cl
jmp 0x423f17
mov cl, byte [esi - 4]
shl dword [esi - 8], cl
jmp case.0x423334.19
mov eax, dword [esi - 4]
and dword [esi - 8], eax
jmp case.0x423334.19
lea eax, [esi - 8]
mov dword [esp + 8], eax
mov eax, dword [esi - 8]
add eax, edi
mov ecx, dword [esi - 0xc]
add ecx, edi
push dword [esi - 4]
push eax
push ecx
mov ebx, edx
call fcn.004030d7
mov edx, ebx
mov ebx, dword [esp + 0x14]
add esp, 0xc
xor ecx, ecx
cmp eax, 1
sbb ecx, ecx
mov dword [esi - 0xc], ecx
jmp case.0x423334.19
mov ecx, esi
mov esi, dword [esi - 4]
add ecx, 0xfffffff8
test esi, esi
mov ebx, ecx
js case.0x423334.19
mov eax, edi
mov edi, dword [edi + 0xbc8]
cmp dword [ecx], 0
je 0x424011
mov ebp, ecx
mov dword [esp], edx
movzx ebx, byte [eax + 0x140]
shl esi, 4
cmp dword [edi + esi + 8], ebx
jbe 0x424025
push ebx
push dword [esp + 0x1c]
push dword [edi + esi + 4]
call fcn.0040307b
add esp, 0xc
mov eax, dword [edi + esi + 4]
mov byte [eax + ebx], 0
mov dword [edi + esi + 0xc], 1
jmp 0x42402d
mov edi, dword [esi - 8]
mov eax, dword [esi - 4]
mov dword [esp + 0xc], eax
add esi, 0xfffffff8
mov dword [esp + 4], esi
push eax
push dword [esp + 0x24]
mov esi, dword [esp + 0x2c]
push esi
mov ebx, edx
call fcn.0040307b
mov edx, ebx
add esp, 0xc
mov eax, dword [esp + 0x94]
mov byte [eax + 4], 2
mov dword [eax + 8], edi
mov edi, dword [esp + 0x94]
mov dword [edi + 0xc], esi
mov eax, dword [esp + 0xc]
mov dword [edi + 0x10], eax
mov ebx, dword [esp + 4]
jmp case.0x423334.19
mov edi, dword [esi - 8]
mov eax, dword [esi - 4]
mov dword [esp + 0xc], eax
add esi, 0xfffffff8
mov dword [esp + 4], esi
add eax, edi
push eax
push dword [esp + 0x24]
mov esi, dword [esp + 0x2c]
push esi
mov ebx, edx
call fcn.0040307b
mov edx, ebx
add esp, 0xc
mov eax, dword [esp + 0x94]
mov byte [eax + 4], 1
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
add edi, esi
mov dword [eax + 0x10], edi
mov edi, dword [esp + 0x94]
mov eax, dword [esp + 0xc]
mov dword [edi + 0x14], eax
mov ebx, dword [esp + 4]
jmp case.0x423334.19
mov cl, byte [esi - 4]
sar dword [esi - 8], cl
jmp case.0x423334.19
mov eax, dword [esi - 8]
mov ecx, edx
cdq
idiv dword [esi - 4]
mov dword [esi - 8], edx
mov edx, ecx
jmp case.0x423334.19
movsd xmm0, qword [esi - 8]
shufps xmm0, xmm0, 0xe1
movlps qword [esi - 8], xmm0
jmp case.default.0x423334
cmp dword [edi + 0x860], 0
mov ebx, esi
je case.0x423334.19
mov dword [esp], edx
xor ebx, ebx
mov ebp, 0x1c
mov dword [esp + 4], esi
mov ecx, dword [edi + 0x85c]
test byte [ecx + ebp - 0x14], 1
jne 0x423bd2
mov eax, dword [ecx + ebp - 0x1c]
mov dword [esp + 8], eax
mov esi, dword [ecx + ebp - 0x18]
mov eax, dword [esp + 0x94]
mov eax, dword [eax + 0xa34]
mov edi, dword [esp + 0x14]
push edi
mov dword [esp + 0x10], ecx
call dword [eax + 8]
add esp, 4
mov eax, dword [esp + 0x94]
mov eax, dword [eax + 0xa34]
push esi
push dword [esp + 0xc]
push edi
call dword [eax + 0xc]
add esp, 0xc
mov eax, dword [esp + 0x94]
mov eax, dword [eax + 0xa34]
lea esi, [esp + 0x40]
push esi
push edi
call dword [eax + 0x10]
add esp, 8
mov eax, dword [esp + 0x94]
mov eax, dword [eax + 0xa34]
mov eax, dword [eax + 4]
shr eax, 8
and eax, 0x7f
push eax
push dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0xa0]
call fcn.004030d7
mov edx, dword [esp + 0x18]
add esp, 0xc
test eax, eax
jne 0x423bd2
movzx eax, byte [edi + 4]
mov cl, byte [edx + ebp - 0x10]
and cl, 0xf
cmp cl, al
jne 0x423bd2
cmp eax, 2
je 0x423ba8
cmp eax, 1
jne 0x423bd2
mov ecx, dword [edi + 8]
mov edx, dword [edi + 0xc]
mov eax, dword [esp + 0xc]
push dword [eax + ebp - 8]
mov eax, dword [esp + 0x10]
push dword [eax + ebp - 0xc]
call fcn.0042428f
mov edx, dword [esp + 0x14]
add esp, 8
test eax, eax
je 0x423bd2
mov ecx, dword [edi + 0x10]
mov eax, edx
mov edx, dword [edi + 0x14]
push dword [eax + ebp]
push dword [eax + ebp - 4]
call fcn.0042428f
add esp, 8
test eax, eax
je 0x423bd2
jmp 0x42410b
mov eax, dword [edi + 8]
cmp eax, dword [edx + ebp - 0xc]
jne 0x423bd2
mov eax, dword [edi + 0x10]
cmp eax, dword [edx + ebp - 4]
jne 0x423bd2
push eax
push dword [edx + ebp - 8]
push dword [edi + 0xc]
call fcn.004030d7
add esp, 0xc
test eax, eax
je 0x42410b
inc ebx
add ebp, 0x20
cmp ebx, dword [edi + 0x860]
jb 0x423aa3
mov ebx, esi
jmp 0x424036
mov eax, dword [ebx]
movzx eax, byte [eax + 0x42eb12]
jmp 0x423ced
mov dword [esp], edx
mov eax, esi
mov esi, dword [esi - 4]
mov ebp, dword [eax - 8]
mov ebx, dword [eax - 0x10]
mov ecx, dword [eax - 0xc]
mov dword [esp + 4], eax
lea edx, [eax - 0x10]
mov eax, dword [edi + 0xbd4]
test eax, eax
je 0x423f5b
push ecx
push ebx
push esi
push ebp
push dword [edi + 0xbd0]
mov esi, edx
call eax
mov edx, esi
add esp, 0x14
mov ecx, eax
add ecx, 0xfffffffe
cmp ecx, 0xfffffffd
mov ebp, dword [esp + 0x10]
jae 0x424098
jmp 0x4240fa
mov eax, dword [esi - 4]
movsd xmm0, qword [esi - 0xc]
movsd qword [esi - 8], xmm0
mov dword [esi - 0xc], eax
jmp case.default.0x423334
lea ebx, [esi - 8]
mov eax, dword [edi + 0xbcc]
test eax, eax
je case.0x423334.19
mov dword [esp + 8], ebx
mov ebp, edx
mov ecx, dword [esi - 8]
mov edx, dword [esi - 4]
mov esi, edi
movzx edi, byte [edi + 0x140]
mov esi, dword [esi + 0xbc8]
add esi, 0xc
cmp dword [esi], 0
jne 0x423ca4
mov ebx, dword [esi - 0xc]
cmp byte [ebx], 0
jne 0x423ca4
movzx ebx, byte [ebx + 1]
cmp edx, ebx
je 0x424057
add esi, 0x10
dec eax
jne 0x423c8b
mov edi, dword [esp + 0x94]
mov edx, ebp
mov ebp, dword [esp + 0x10]
mov ebx, dword [esp + 8]
jmp case.0x423334.19
mov eax, dword [edi + 0xa34]
mov eax, dword [eax + 4]
shr eax, 8
and eax, 0x7f
jmp 0x423f05
mov dword [esp], edx
mov edx, dword [ebx]
mov ecx, dword [esp + 0x1c]
push dword [esp + 0x38]
call fcn.00423148
mov edx, dword [esp + 4]
add esp, 4
mov dword [ebx], eax
jmp case.default.0x423334
mov eax, dword [esi - 8]
add eax, edi
lea ebx, [esi - 0xc]
mov ecx, dword [esi - 0xc]
add ecx, edi
push dword [esi - 4]
push eax
push ecx
mov esi, edx
call fcn.0040307b
mov edx, esi
add esp, 0xc
jmp case.0x423334.19
mov dword [esp], edx
mov ebx, dword [esi - 8]
mov dword [esp + 4], esi
mov esi, dword [esi - 4]
mov ebp, edi
mov edi, dword [edi + 0x13c]
cmp edi, esi
cmovae edi, esi
test ebx, ebx
je 0x423d49
lea eax, [ebp + ebx]
push edi
push dword [ebp + 0x138]
push eax
call fcn.0040307b
add esp, 0xc
cmp byte [ebp + 0x864], 0
je 0x423d65
mov edx, dword [ebp + 0x138]
mov ecx, dword [esp + 0x1c]
push edi
call fcn.00423008
add esp, 4
cmp byte [ebp + 0xa30], 0
je 0x423d85
mov eax, dword [ebp + 0xa34]
push edi
push dword [ebp + 0x138]
push dword [esp + 0x1c]
call dword [eax + 0xc]
add esp, 0xc
add dword [ebp + 0x138], edi
sub dword [ebp + 0x13c], edi
add ebx, edi
mov eax, dword [esp + 4]
mov dword [eax - 8], ebx
sub esi, edi
mov dword [eax - 4], esi
mov ebx, eax
mov edi, ebp
jmp 0x424036
mov eax, dword [esi - 8]
mov ecx, dword [esi - 4]
mov dword [esp + 8], ebx
mov ebx, edx
lea edx, [esp + 0x40]
mov byte [edx], 1
mov dword [esp + 4], esi
mov esi, dword [esp + 0x20]
mov dword [edx + 4], esi
mov dword [edx + 8], eax
add eax, esi
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], ecx
mov ecx, edi
call fcn.00424193
mov edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [esp + 4]
mov dword [ecx - 8], eax
jmp case.0x423334.19
mov eax, dword [esi - 8]
xor ecx, ecx
cmp eax, dword [esi - 4]
sete cl
jmp 0x423f17
mov eax, dword [esi - 8]
jmp 0x423f05
cmp dword [edi + 0x860], 0
mov ebx, esi
je case.0x423334.19
mov dword [esp + 4], esi
mov dword [esp], edx
xor esi, esi
mov ebp, 0xc
mov ebx, dword [edi + 0x85c]
test byte [ebx + ebp - 4], 1
je 0x423ed3
mov eax, dword [ebx + ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + ebp - 8]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x94]
mov eax, dword [eax + 0xa34]
mov edi, dword [esp + 0x14]
push edi
call dword [eax + 8]
add esp, 4
mov eax, dword [esp + 0x94]
mov eax, dword [eax + 0xa34]
push dword [esp + 8]
push dword [esp + 0x10]
push edi
call dword [eax + 0xc]
add esp, 0xc
mov eax, dword [esp + 0x94]
mov eax, dword [eax + 0xa34]
lea ecx, [esp + 0x40]
push ecx
push edi
call dword [eax + 0x10]
add esp, 8
mov eax, dword [esp + 0x94]
mov eax, dword [eax + 0xa34]
mov eax, dword [eax + 4]
shr eax, 8
and eax, 0x7f
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
mov edi, dword [esp + 0xa0]
call fcn.004030d7
add esp, 0xc
test eax, eax
jne 0x423ed3
add ebx, ebp
mov ecx, edi
mov edx, ebx
call fcn.00424193
test eax, eax
je 0x4240df
inc esi
add ebp, 0x20
cmp esi, dword [edi + 0x860]
jb 0x423e1f
mov ebx, dword [esp + 4]
jmp 0x424036
mov eax, dword [esi - 4]
mov cl, byte [esi - 8]
add esi, 0xfffffff8
mov byte [edi + eax], cl
jmp case.default.0x423334
xor eax, eax
cmp dword [edi + 0x120], 1
sbb eax, eax
mov dword [esi], eax
add esi, 4
jmp case.default.0x423334
mov eax, dword [esi - 8]
xor ecx, ecx
cmp eax, dword [esi - 4]
setle cl
neg ecx
mov dword [esi - 8], ecx
jmp case.0x423334.19
lea ebp, [ebp + eax + 1]
mov edx, ebx
mov ebx, esi
jmp case.0x423334.19
mov ecx, dword [ebx]
test ecx, ecx
cmove eax, ecx
lea ebp, [ebp + eax + 1]
mov edx, esi
jmp case.0x423334.19
xor ecx, ecx
cmp dword [ebx], 0
cmove ecx, eax
lea ebp, [ebp + ecx + 1]
mov edx, esi
jmp case.0x423334.19
mov dword [esi], 0xffffffff
jmp 0x423f07
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ecx
mov ebx, dword [edi + 0x128]
mov ecx, dword [edi + 0x12c]
mov eax, ebx
or eax, ecx
jne 0x423fe4
lea edi, [esp + 0x40]
push edi
mov dword [esp + 0x38], edx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ebx, dword [edi]
mov edi, dword [edi + 4]
xor eax, eax
push eax
push 0x989680
push edi
push ebx
call fcn.00401793
add esp, 0x10
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], edx
push 0xc9
push 0x2a69c000
push edi
mov edi, dword [esp + 0xa0]
push ebx
call fcn.00401793
add esp, 0x10
mov ebx, eax
add ebx, 0x8ec32
xor eax, eax
push eax
push 0x15180
push dword [esp + 0x34]
push dword [esp + 0x3c]
call fcn.004017ae
mov edx, dword [esp + 0x44]
add esp, 0x10
mov ecx, eax
xor eax, eax
dec eax
cmp ebx, ebp
jae 0x424042
mov ebp, dword [esp + 0x10]
jmp 0x424098
mov eax, dword [esp + 4]
mov dword [eax], 0
add eax, 4
mov edi, dword [esp + 0x94]
mov edx, ebx
mov ebx, eax
jmp case.0x423334.19
shl esi, 4
mov dword [edi + esi + 0xc], 0xffffffff
mov ebx, ecx
mov edi, eax
jmp case.0x423334.19
mov dword [edi + esi + 0xc], 0xffffffff
mov ebx, ebp
mov edi, dword [esp + 0x94]
mov edx, dword [esp]
mov ebp, dword [esp + 0x10]
jmp case.0x423334.19
mov ebp, dword [esp + 0x10]
jne 0x42404c
cmp ecx, esi
jb 0x424098
cmp ebx, dword [esp + 0xc]
jbe 0x424089
xor eax, eax
inc eax
jmp 0x424098
xor eax, eax
dec eax
test ecx, ecx
je 0x4240a9
cmp dword [esi - 4], edi
mov edx, ebp
mov ebp, dword [esp + 0x10]
jbe 0x4240af
push edi
push dword [esp + 0x1c]
push dword [esi - 8]
mov ebx, edx
call fcn.0040307b
mov edx, ebx
add esp, 0xc
mov eax, dword [esi - 8]
mov byte [eax + edi], 0
xor eax, eax
inc eax
jmp 0x4240af
sete al
cmp ecx, dword [esp + 8]
seta cl
and cl, al
movzx eax, cl
mov ebx, dword [esp + 4]
add ebx, 0xfffffff4
mov dword [edx], eax
mov edx, dword [esp]
jmp case.0x423334.19
mov edx, ebp
mov ebp, dword [esp + 0x10]
mov dword [esi], eax
mov edi, dword [esp + 0x94]
mov ebx, dword [esp + 8]
jmp case.0x423334.19
mov eax, dword [ebx]
mov dword [edi + 0x11c], eax
mov esi, ebx
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], edx
mov dword [edi + 0x20], ebp
add esp, 0x80
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [edi + 0x11c], 0x20
mov edx, dword [esp]
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 4]
jmp case.0x423334.20
xor ebp, ebp
jmp case.0x423334.20
mov dword [edi + 0x11c], 0x35
mov esi, edx
mov edx, dword [esp]
jmp case.0x423334.20
mov dword [edi + 0x11c], 0x20
mov edx, dword [esp]
mov ebp, dword [esp + 0x10]
jmp case.0x423334.20