Function at 0x40fe90
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
mov edx, dword [0x43a4a0]
push ebp
shl eax, 2
xor al, 0xfe
inc eax
mov edx, 0xfffffffe
shr ebp, 0x7e
xor eax, eax
cmp ecx, esi
mov ecx, dword [0x43a4a0]
dec eax
imul ebp, ebx, 0xfb6bcd3
shl edx, 5
mov ecx, dword [0x43a4a0]
add ebp, eax
inc ecx
and edx, esi
mov ecx, ecx
shr ecx, 0xfc
imul ecx, edi, 0xffffffaf
add edx, edx
mov ebp, dword [0x43a4a0]
inc eax
and ebp, 0xfffffffd
or eax, 0xffffffe2
shr ebp, 6
mov edx, dword [0x43a4a0]
and eax, esi
mov edx, esp
add dx, 0x4865
lea ebp, [esp + ecx*4 - 4]
cmp edi, ebp
mov bp, word [0x43a4a0]
sbb eax, edi
not ecx
and ebp, ecx
shr ebp, cl
xor eax, eax
seta al
cmp dword [0x43a4a0], esp
mov edx, dword [0x43a4a0]
lea ebp, [edx + ebx*2 + 1]
add edx, 0
cmp eax, dword [0x43a4a0]
mul esi
mov ecx, esi
add ecx, eax
sub eax, dword [0x43a4a0]
lea ebp, [esp + edx*4 + 2]
sub ecx, 0xfffffffa
sbb edx, edi
neg edx
dec eax
sub eax, 0
cmp dword [0x43a4a0], ecx
mov edx, dword [0x43a4a0]
sbb ebp, esp
neg eax
dec ebp
sub ecx, edx
cmp ecx, edi
mov eax, dword [0x43a4a0]
setne dl
mov ebp, esp
sub eax, 0xfffffffd
imul edx, edi
mov edx, esp
sub ecx, 0x49
shl ecx, 0xfc
mov eax, dword [0x43a4a0]
add ecx, 0x45
sub ecx, 4
sbb eax, esi
mov edx, dword [0x43a4a0]
lea edx, [esi + ebp*2 - 7]
imul edx, esi
inc ecx
mov ecx, ecx
sub eax, 0xfffff1fe
inc edx
cmp ebp, 0xffff91f6
mov ecx, dword [0x43a4a0]
lea eax, [edx*8]
shl edx, cl
add eax, 0x5936
sub esp, 0x208
sbb edx, ebp
neg eax
mov eax, dword [0x43a4a0]
imul ecx, ebp, 0xfffffffb
mov edx, esi
xor eax, ebp
inc edx
seta dl
mov dword [ebp - 4], eax
lea edx, [0x71b4011]
mov edx, dword [0x43a4a0]
push ebx
push esi
mov ecx, dword [ebp - 4]
imul edx, edx
xor ecx, ecx
or edx, edi
xor edx, edx
mov al, 1
sub edx, 0x44
adc edx, 0xffffffe8
push edi
add edx, 0xffff8dd1
cmp dword [ebp - 4], 0x2c4b
lea ebx, [ebx]
add edx, 0x9659dd38
mov edx, dword [ebp - 4]
add edx, 2
mov edx, dword [ebp - 4]
movzx edx, al
test ebx, eax
mov byte [ebp + edx - 0x104], cl
mov dl, al
and dl, 0x80
test ebx, edi
mov byte [ebp + ecx - 0x204], al
inc ecx
neg dl
sbb dl, dl
nop
mov bl, al
cmp ebp, edx
and dl, 0x1b
add bl, bl
test edx, esi
xor dl, bl
test esi, edx
xor al, dl
test ecx, ebp
cmp ecx, 0x100
jl 0x40fffd
sub edx, dword [0x43a4a0]
cmp esi, 0x30e4
mov al, 1
mov ecx, 0x469560
add edx, edi
mov dl, bl
lea edx, [esi - 6]
add dword [ecx], esp
movzx edx, al
or dword [ecx], edi
mov dword [ecx], 0xffffffda
shl edx, 0x18
cmp eax, ebp
sete byte [ecx]
mov dword [ecx], edx
cmp cl, 0x8d
mov dl, al
and dl, 0x80
add ecx, 4
neg dl
sbb dl, dl
and dl, 0x1b
add al, al
xor al, dl
cmp ecx, 0x469588
jl 0x410055
sub edx, 0x86f68fec
lea edx, [ecx + esi*2 - 0x312ca824]
mov dword [0x468960], 0x63
mov dword [0x46bb2c], 0
mov edx, 1
and ecx, 0xbf33e205
inc ecx
jmp 0x4100d6
lea eax, [ecx + eax*4 - 0x37]
adc eax, 0xffffffbe
movzx eax, byte [ebp + edx - 0x104]
shl ecx, cl
or ecx, edi
lea ecx, [ebp - 0x105]
sub ecx, eax
mov cl, byte [ecx]
mov al, cl
rol al, 1
xor cl, al
mov dword [edx*4 + 0x468960], ecx
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
cmp dword [edx*4 + 0x468960], eax
nop
sbb dword [edx*4 + 0x468960], ebp
and dword [edx*4 + 0x468960], 0x5e
mov dword [edx*4 + 0x468960], ebx
dec dword [edx*4 + 0x468960]
cmp ecx, 7
setne byte [edx*4 + 0x468960]
mov dword [edx*4 + 0x468960], edi
and dword [edx*4 + 0x468960], 0
mov dword [edx*4 + 0x468960], edx
add dword [edx*4 + 0x468960], eax
mov word [edx*4 + 0x468960], bx
mov dword [edx*4 + 0x468960], ebp
dec dword [edx*4 + 0x468960]
mov dword [edx*4 + 0x468960], ebp
dec dword [edx*4 + 0x468960]
cmp eax, esi
sete byte [edx*4 + 0x468960]
inc dword [edx*4 + 0x468960]
mov dword [edx*4 + 0x468960], edi
add dword [edx*4 + 0x468960], edi
and dword [edx*4 + 0x468960], 0x6b62
sub dword [edx*4 + 0x468960], 0xfffffff0
shl dword [edx*4 + 0x468960], 0xfe
or dword [edx*4 + 0x468960], eax
cmp dword [edx*4 + 0x468960], 0xffffc4c2
sete byte [edx*4 + 0x468960]
inc dword [edx*4 + 0x468960]
mov dword [edx*4 + 0x468960], ebx
cmp dword [edx*4 + 0x468960], esi
mov dword [edx*4 + 0x468960], ecx
sbb dword [edx*4 + 0x468960], edi
and dword [edx*4 + 0x468960], 0x2a
mov dword [edx*4 + 0x468960], ebx
and dword [edx*4 + 0x468960], 0xfffffffe
or dword [edx*4 + 0x468960], eax
xor dword [edx*4 + 0x468960], ecx
and dword [edx*4 + 0x468960], edi
test esi, eax
setne byte [edx*4 + 0x468960]
mov dword [edx*4 + 0x468960], ebp
sbb dword [edx*4 + 0x468960], edx
sub dword [edx*4 + 0x468960], esp
or dword [edx*4 + 0x468960], ecx
or dword [edx*4 + 0x468960], esp
cmp edx, edi
mov dword [edx*4 + 0x468960], edi
and dword [edx*4 + 0x468960], 0x795afe8
or dword [edx*4 + 0x468960], edx
cmp dword [edx*4 + 0x468960], ebp
mov word [edx*4 + 0x468960], 0x10
add dword [edx*4 + 0x468960], 0xffffff96
shl dword [edx*4 + 0x468960], 0x83
or dword [edx*4 + 0x468960], esp
or dword [edx*4 + 0x468960], ebp
cmp dword [edx*4 + 0x468960], edx
mov dword [edx*4 + 0x468960], eax
or dword [edx*4 + 0x468960], ebp
and dword [edx*4 + 0x468960], 7
or dword [edx*4 + 0x468960], eax
mov dword [edx*4 + 0x468960], edx
and dword [edx*4 + 0x468960], 3
or dword [edx*4 + 0x468960], ecx
test edi, eax
mov dword [edx*4 + 0x468960], eax
shl dword [edx*4 + 0x468960], 3
or dword [edx*4 + 0x468960], esi
cmp ebp, 0xffffff93
mov dword [edx*4 + 0x468960], eax
and dword [edx*4 + 0x468960], 0xfffffffe
or dword [edx*4 + 0x468960], ebp
test eax, edx
mov word [edx*4 + 0x468960], di
dec dword [edx*4 + 0x468960]
test esp, ecx
xor al, cl
test ebp, eax
mov dword [edx*4 + 0x468960], edi
add dword [edx*4 + 0x468960], edi
adc dword [edx*4 + 0x468960], 0xa458b543
nop
xor al, 0x63
mov dword [edx*4 + 0x468960], esi
cmp edx, dword [edx*4 + 0x468960]
mov dword [edx*4 + 0x468960], 7
setne byte [edx*4 + 0x468960]
mov dword [edx*4 + 0x468960], esp
nop
shl dword [edx*4 + 0x468960], 0x11
movzx eax, al
test edi, ebp
setne byte [edx*4 + 0x468960]
mov dword [edx*4 + 0x468960], eax
and dword [eax*4 + 0x46b9a0], ebx
mov dword [eax*4 + 0x46b9a0], edx
inc edx
cmp edx, 0x100
jl 0x4100dd
shl edi, 0x13
shr edi, 0xfb
xor ecx, ecx
cmp dword [ecx + 0x46b1a0], edi
adc edi, 5
add edi, 0x8b1361d3
lea edi, [ebx + ebx*2]
mov dl, byte [ecx + 0x468960]
mov al, dl
neg esi
and al, 0x80
add edi, dword [ecx + 0x46a1a0]
xor edi, eax
neg al
mov esi, edx
lea edi, [eax + eax - 0x11]
sbb al, al
not edi
and al, 0x1b
add dword [ecx + 0x46b5a0], 0x5f
adc edi, ebp
mov bl, dl
inc dword [ecx + 0x46b5a0]
mov esi, ecx
add bl, bl
mov esi, dword [ecx + 0x46ada0]
and esi, esi
xor al, bl
mov esi, dword [ecx + 0x46a1a0]
xor edi, ebp
movzx esi, al
test al, dl
xchg ebx, edi
movzx edx, dl
xor ebx, edx
not ebx
mov eax, esi
sub edi, 6
sar ebx, 0xa8
shl eax, 8
sub ebx, ebp
sbb edi, ebx
xor eax, edx
mov ebx, dword [ecx + 0x46b5a0]
xor ebx, ebp
inc ebx
mov edi, dword [ecx + 0x46a9a0]
imul ebx, edx, 0x1fc6
shl eax, 8
cmp ebx, 0xd3d7f040
lea ebx, [ebx + 0x4dc80955]
mov dword [ecx + 0x46b5a0], esi
imul edi, esi, 0xffffff89
mov edi, dword [ecx + 0x46b1a0]
shr ebx, 0x51
lea ebx, [esi + esi]
mov edi, dword [ecx + 0x46b1a0]
sub ebx, 0xfffff87b
sub ebx, 0x77f
imul edi, esp, 0xfffffffa
mov ebx, dword [ecx + 0x469160]
sub ebx, 0xfffff32f
inc ebx
and dword [ecx + 0x46b5a0], 0xfffffff9
mov dword [ecx + 0x46b5a0], eax
lea ebx, [edx*8 + 0x15]
add ebx, 0x6b
adc ebx, eax
mov ebx, esi
and edi, 4
inc edi
cmp edi, 0xe9731ae7
mov bl, 0xa9
lea ebx, [ebp + ebx*4 - 0x1e2aba31]
sub ebx, 0x54219c19
dec dword [ecx + 0x46b5a0]
mov ebx, edi
shl edi, cl
shr edi, 0xfc
xor ebx, ebp
add edi, 0x53e51089
adc ebx, 0x71
dec edi
mov dword [ecx + 0x46b5a0], 0xffffff82
sub dword [ecx + 0x46b5a0], ebx
sbb edi, edi
mov dword [ecx + 0x46b5a0], esi
lea ebx, [esp + 0x32e06ca1]
imul edi, dword [ecx + 0x468d60]
mov edi, ebp
shl edi, cl
cmp eax, esp
mov bl, byte [ecx + 0x46b1a0]
movsx edi, cl
cmp dword [ecx + 0x468d60], 0xffffffb3
lea edi, [esp - 0x6e93c8d]
mov dword [ecx + 0x46b5a0], esi
xor edi, eax
shr edi, cl
test ecx, ecx
mov ebx, 0xffff8c1b
shl edi, 0xfc
shr edi, 0xc3
sub ebx, 0x449e7ee7
mov dword [ecx + 0x46b5a0], eax
lea edi, [ebx*8 - 0x1a]
xor ebx, edx
mov edi, dword [ecx + 0x46a9a0]
inc edi
xor dword [ecx + 0x46b5a0], ecx
test eax, eax
inc edi
and edi, 0x42
movzx edi, word [ecx + reloc.shell32.dll_SHGetSpecialFolderPathW]
shr ebx, 2
and edi, 0x22
test eax, edi
setne bl
mov ebx, eax
imul edi, esp, 0xd9cce97f
lea ebx, [eax + edi*4 + 0x16]
mov dword [ecx + 0x46b5a0], eax
lea ebx, [0xffffffba]
mov edi, dword [ecx + 0x46b5a0]
shl edi, 0x94
sub edi, 0xfe912cde
add edi, 0
dec edi
inc ebx
mov ebx, dword [ecx + 0x46ada0]
add edi, 0xffffffff
lea ebx, [ebx + esi*8 + 5]
mov ebx, dword [ecx + 0x46ada0]
xor edi, eax
lea ebx, [0x18]
add ebx, 0x35
mov dword [ecx + 0x46b5a0], ebx
xor ebx, ebx
cmp esi, esi
lea edi, [esp + esi*4 + 6]
xor edi, ecx
inc edi
mov dword [ecx + 0x46b5a0], ecx
or edi, esp
add edi, 0x64e9ec5f
lea edi, [esp + esi*2 - 0x4bc1]
mov ebx, 0xa1567558
xor ebx, ebx
sub ebx, 0xfffffffc
inc ebx
mov ebx, dword [ecx + 0x46b5a0]
and dword [ecx + 0x46b5a0], 0xfffffffa
add edi, ebx
mov edi, dword [ecx + 0x46a5a0]
sbb ebx, ecx
imul edi, ecx, 0x74bb
add ebx, esi
lea ebx, [edx*4 + 0x3a]
mov ebx, dword [ecx + 0x46a9a0]
shr ebx, 0x81
and dword [ecx + 0x46b5a0], 0xffffff9f
xor edi, esp
lea ebx, [esi + ebp*2 - 0x4ff7d410]
mov ebx, ecx
xor edi, ebp
inc edi
and dword [ecx + 0x46b5a0], 0xffff9545
mov dword [ecx + 0x46b5a0], edi
movzx edi, byte [ecx + 0x46a9a0]
inc ebx
xor ebx, esi
mov ebx, dword [ecx + 0x46a5a0]
setl bl
sar edi, 0xfa
shr edi, 0xfd
mov edi, dword [ecx + 0x469160]
shr edi, 0xa6
not edi
and dword [ecx + 0x46b5a0], esi
add ebx, ebx
neg ebx
mov edi, dword [ecx + 0x469160]
neg ebx
sbb ebx, ebx
not ebx
and byte [ecx + 0x46b5a0], 0x2d
shl ebx, 0x39
mov edi, esi
shr edi, 0xba
mov edi, ebx
mov dword [ecx + 0x46b5a0], edi
movzx edi, bx
mov edi, dword [ecx + 0x46a5a0]
sub ebx, 0x463f8654
xor ebx, ecx
inc ebx
add edi, 0x5a2f
sub edi, 0xffffffff
lea edi, [ebx + ecx*2 + 0x25]
adc edi, eax
mov edi, esi
dec ebx
sub ebx, esi
cmp dword [ecx + 0x46b5a0], edi
setne bl
mov ebx, dword [ecx + 0x46b1a0]
dec dword [ecx + 0x46b5a0]
mov dword [ecx + 0x46b5a0], ebx
lea ebx, [0xffff95c4]
test dl, cl
mov edi, ebp
lea ebx, [eax + eax + 0x4b]
mov dword [ecx + 0x46b5a0], ebp
adc edi, 0xffffffc4
xchg edi, ebx
add edi, 0xffffa2f2
inc dword [ecx + 0x46b5a0]
shr ebx, 6
dec edi
mov dword [ecx + 0x46b5a0], edi
lea edi, [esp + edx*2]
sub edi, 0xfffffffc
add dword [ecx + 0x46b5a0], ecx
setg bl
dec edi
movsx edi, dl
lea ebx, [edx + esi*2 - 0x15]
xor ebx, ebx
shl edi, 0x23
mov ebx, edi
sub ebx, 0xfffffff7
mov dword [ecx + 0x46b5a0], ecx
shl ebx, 0xfa
add ebx, ebx
lea ebx, [edx - 0x52d1ffb3]
sub edi, 0xfffffffb
adc ebx, ebp
inc edi
and edi, ebx
mov edi, dword [ecx + 0x46a9a0]
movzx ebx, byte [ecx + 0x468d60]
mov ebx, dword [ecx + 0x46b5a0]
xor edi, ebx
sub ebx, 0xffffffff
mov ebx, edi
neg edi
mov dword [ecx + 0x46b5a0], esi
sub ebx, 0xffffd6f0
sbb edi, ecx
xor ebx, ebp
nop
sub ebx, 0xffffffff
mov ebx, dword [ecx + 0x46ada0]
shl dword [ecx + 0x46b5a0], 0xdc
and dword [ecx + 0x46b5a0], 0x5e7fcc9e
xor edi, ebx
add edi, ebp
mov edi, edi
shl ebx, cl
add ebx, edi
sub ebx, 0xffffa568
sbb edi, eax
and dword [ecx + 0x46b5a0], 0xffffffbf
add ebx, 0xffffa5a6
lea edi, [ebx + ebx + 1]
sbb ebx, ebp
mov dword [ecx + 0x46b5a0], eax
sar ebx, 0x9f
not ebx
and ebx, 0xfffffffd
add edi, 0xfffffffb
lea edi, [edx + edx]
mov edi, eax
lea ebx, [esi + ebp*8 - 0xddcfdb2]
mov di, word [ecx + reloc.shell32.dll_SHGetSpecialFolderPathW]
adc ebx, ebx
inc ebx
mov dword [ecx + 0x46b5a0], eax
add ebx, ebx
lea ebx, [esp + ecx*4]
inc ebx
mov dword [ecx + 0x46b5a0], 0xe48732a1
xor ebx, eax
mov ebx, eax
add dword [ecx + 0x46b5a0], 0x1debd471
mov ebx, dword [ecx + 0x46a5a0]
and dword [ecx + 0x46b5a0], esi
shr ebx, 0xf
add edi, 0xffffff8d
mov ebx, dword [ecx + 0x46a9a0]
lea edi, [edx + edx*4]
adc ebx, edi
dec ebx
mov ebx, edx
add edi, 0xc110085d
cmp ebx, ebp
mov word [ecx + 0x46b5a0], 0x6c
add ebx, 4
lea ebx, [edx + edx*2 - 0x1f]
cmp ebx, 0x2063
lea ebx, [eax*4 + 0x941555b]
mov ebx, dword [ecx + 0x46a5a0]
sbb bl, al
xor ebx, dword [ecx + 0x46a1a0]
sub edi, 0x8408eac0
mov ebx, dword [ecx + 0x469160]
shr ebx, 1
add edi, 0x8408eac6
lea ebx, [edi + ecx*8 - 0x4f85110b]
test dl, bl
mov dword [ecx + 0x46b5a0], esp
xor ebx, ebp
inc ebx
shl edi, 0x8a
shr ebx, cl
mov bl, byte [ecx + 0x46a1a0]
lea ebx, [esi - 0x331b]
movzx edi, byte [ecx + 0x46b5a0]
shl ebx, 6
mov dword [ecx + 0x46b5a0], ebx
and ebx, edx
or ebx, 0x3cb8655
seta bl
not ebx
xor ebx, edi
xor eax, edx
mov ebx, dword [ecx + 0x46a9a0]
adc ebx, ecx
nop
sub ebx, esp
imul ebx, edx, 0xffffff85
lea edi, [ecx + ebx*8]
mov edi, esp
lea ebx, [ecx + edi*4]
add edi, esi
sub dword [ecx + 0x46b5a0], 0x2d
inc dword [ecx + 0x46b5a0]
shr edi, 0xfc
dec ebx
mov ebx, dword [ecx + 0x46b5a0]
dec ebx
sub ebx, 0xffffffff
sbb ebx, edi
lea edi, [esi + esi*8 - 0x1f60]
add ebx, edx
mov word [ecx + 0x46b5a0], 0x95df
imul ebx, esp
shl edi, 0x35
add dword [ecx + 0x46b5a0], esi
sub ebx, 0xf2e20b83
sub ebx, 0xaba8d9d6
xor ebx, esi
inc ebx
test esi, 0xfc11bb31
setne bl
mov dword [ecx + 0x46b5a0], edi
shl edi, 7
add edi, 0x42
sub ebx, 0x229c
mov edi, ecx
imul edi, dword [ecx + 0x46a5a0]
dec ebx
neg ebx
not ebx
sbb ebx, ebp
add ebx, edi
and edi, edx
xor ebx, eax
cmp dword [ecx + 0x46b5a0], esi
lea ebx, [esp + ecx*2 + 4]
mov edi, esi
shl edi, 0x60
add edi, 0x4baf44f9
movzx ebx, word [ecx + reloc.shell32.dll_SHGetSpecialFolderPathW]
setne bl
imul edi, ebp, 0xef280777
sub edi, dword [ecx + 0x46b5a0]
mov ebx, dword [ecx + 0x46ada0]
sar ebx, 0x7d
not ebx
and dword [ecx + 0x46b5a0], ecx
inc edi
not ebx
add edi, dword [ecx + 0x46b5a0]
lea ebx, [0xffffffce]
mov edi, ebp
movzx ebx, word [ecx + reloc.shell32.dll_SHGetSpecialFolderPathW]
mov ebx, dword [ecx + 0x46a9a0]
and word [ecx + 0x46b5a0], 0xffd1
mov edi, dword [ecx + 0x46a5a0]
shl edi, 0xd7
xor edi, ecx
add bx, 0x470c
lea ebx, [ecx + ebp*8]
mov dword [ecx + 0x46b5a0], ecx
lea ebx, [eax - 0x7ba]
mov word [ecx + 0x46b5a0], di
add dword [ecx + 0x46b5a0], edx
test ebx, esi
xchg edi, edi
sub edi, 1
mov word [ecx + 0x46b5a0], 0xff87
or dword [ecx + 0x46b5a0], ecx
xor ebx, eax
mov dword [ecx + 0x46b5a0], edx
test dword [ecx + 0x469160], edi
cmp ebp, esp
mov edi, dword [ecx + 0x46b1a0]
sub ebx, 0xfffffff0
lea ebx, [ebx + 0x651baabd]
or ebx, 0xfffff3d0
cmp ebp, 1
mov dword [ecx + 0x46b5a0], 0x743a
lea ebx, [edi + ebp*4 - 0x31]
mov ebx, dword [ecx + 0x46a9a0]
sub dword [ecx + 0x46b5a0], 0x7437
add ebx, 0xb48d55aa
mov edi, dword [ecx + 0x46a1a0]
lea edi, [edi + edi]
mov edi, dword [ecx + 0x46b1a0]
xor edi, ecx
add edi, 0xc35278e7
setge bl
or dword [ecx + 0x46b5a0], ecx
add edi, 0x3cad871e
add edi, 1
lea ebx, [edx - 0x34a1b0b9]
add edi, edx
mov ebx, dword [ecx + 0x46a5a0]
movzx ebx, word [ecx + reloc.shell32.dll_SHGetSpecialFolderPathW]
mov ebx, dword [ecx + 0x46b5a0]
imul ebx, edi
mov edi, esi
xor edi, ebx
lea ebx, [0xffffefa9]
cmp ebp, 0xffffd3a7
setne bl
mov dword [ecx + 0x46b5a0], ecx
setl bl
imul edi, eax, 0x305f
mov ebx, dword [ecx + 0x46a5a0]
inc ebx
shl edi, 0x7d
mov dword [ecx + 0x46b5a0], edx
add edi, 0xffffc010
and ebx, edx
add edi, 0xfffffffb
lea ebx, [ebp + ebp + 0x6cfb]
mov edi, dword [ecx + 0x46b5a0]
shl edi, 5
mov edi, dword [ecx + 0x46ada0]
or dword [ecx + 0x46b5a0], edx
sub edi, dword [ecx + 0x46a1a0]
dec dword [ecx + 0x46b5a0]
mov edi, dword [ecx + 0x46a5a0]
shl edi, 0xfa
mov ebx, dword [ecx + 0x46a1a0]
shr ebx, 0x10
and edi, 0xffffc6c4
mov ebx, dword [ecx + 0x46ada0]
xor ebx, ecx
movzx ebx, cl
shl edi, 0x3d
add edi, 0x4f
mov dword [ecx + 0x46b5a0], edi
shl ebx, 0x56
add edi, 3
adc ebx, dword [ecx + 0x46a1a0]
dec edi
inc ebx
mov bl, byte [ecx + 0x469160]
add edi, 0xffffffa1
neg ebx
adc edi, ecx
movsx edi, dl
sub dword [ecx + 0x46b5a0], 0xffff8b3a
shl edi, 0xfe
xor edi, edx
add dword [ecx + 0x46b5a0], 0xffff8b3b
lea ebx, [edx + ebp*4]
shl ebx, 0xa2
cmp word [ecx + reloc.shell32.dll_SHGetSpecialFolderPathW], bp
mov ebx, eax
setne bl
mov ebx, dword [ecx + 0x46a5a0]
sar edi, 0x74
not ebx
and ebx, 0x21
lea edi, [ebx - 0x75]
mov edi, edx
or dword [ecx + 0x46b5a0], esi
mov dword [ecx + 0x46b5a0], edi
add edi, 0xe02aba00
shr ebx, 1
mov dword [ecx + 0x46b5a0], eax
or ebx, ecx
xor edi, esi
cmp dword [ecx + 0x46a1a0], edi
lea ebx, [esi + ecx*4 + 0x2f5e]
mov edi, ebp
xor edi, ebx
mov edi, dword [ecx + 0x469160]
inc edi
mov dword [ecx + 0x46b5a0], 0xe131151b
lea ebx, [0x6bc49791]
sub edi, 0xff14df72
sbb ebx, ebx
and dword [ecx + 0x46b5a0], 0xcee958db
add edi, 1
lea edi, [edx + eax*8 - 0x21]
add ebx, 0xfffffffc
mov ebx, 0x37449858
add edi, 0x5e52
mov edi, dword [ecx + 0x46ada0]
sub ebx, 0xac634f13
sub ebx, 0x76bf3a89
sub ebx, 0x14220eb5
mov edi, dword [ecx + 0x46ada0]
imul edi, ebx, 0xffffe38e
shl edi, 0x6d
or dword [ecx + 0x46b5a0], esp
add ebx, 0xfffffffb
lea edi, [ecx + ecx - 0x10343606]
sub edi, 0x22cb
mov ebx, dword [ecx + 0x46a1a0]
sbb edi, ebp
imul edi, edi
neg edi
add dword [ecx + 0x46b5a0], 0xffffffc2
add dword [ecx + 0x46b5a0], 0x3d
cmp esp, edx
lea ebx, [eax]
mov dword [ecx + 0x46b5a0], esp
shr edi, 0xb
xor ebx, edx
add dword [ecx + 0x46b5a0], ebp
shr edi, 4
and word [ecx + 0x46b5a0], 0xff81
mov dword [ecx + 0x46b5a0], edx
lea edi, [ebx + ecx*4 + 5]
xor edi, esi
mov dword [ecx + 0x46b5a0], ebp
xor edi, ecx
shr edi, 0xdc
and bx, 3
sub ebx, 0x60d5
sub ebx, 0xffff9f2c
xor ebx, ebp
sub ebx, 1
sub ebx, 0xffffffff
shl ebx, 1
mov edi, esi
sub edi, 0x1a45d591
sub edi, 0x5f2d2ea8
sub edi, 0x88529088
add edi, 0x88529049
mov ebx, ebp
lea ebx, [ecx + edi*4 - 0x4a26e3a]
mov ebx, dword [ecx + 0x46a5a0]
xor ebx, eax
mov edi, dword [ecx + 0x469160]
cmp edi, 0
mov ebx, eax
cmp dword [ecx + 0x469160], ebx
mov edi, dword [ecx + 0x46a9a0]
lea edi, [edx*4 - 0x74d6cfe1]
sar ebx, 0x71
shr ebx, 0x76
inc ebx
add ebx, 0xffffffed
lea edi, [ebp + ebx*8 + 0x5eeb]
mov ebx, esp
shl ebx, 0xfc
xor edi, esp
sub edi, 0xffffac5c
sub edi, 7
lea edi, [ebp + 0x5a68]
sub ebx, 0xffffffff
mov dword [ecx + 0x46b5a0], esi
inc dword [ecx + 0x46b5a0]
lea ebx, [ebx + 0x23]
shl edi, 0xfb
xor ebx, esp
mov di, si
add edi, 0xffffffc1
lea edi, [ebp + ebp*4 + 0x104f0ca9]
sub ebx, 0x3c
mov dword [ecx + 0x46b5a0], esp
inc ebx
xor edi, esp
and ebx, 0x43
shr ebx, 0x71
and ebx, 0x82e0c5a6
test esp, eax
mov dword [ecx + 0x46b5a0], 0xffff805e
and ebx, 0xffffffca
lea ebx, [ebx + ebx*4 - 0x7b03]
add ebx, 1
lea edi, [ecx*8 + 0x79ebfc1f]
mov bx, word [ecx + reloc.shell32.dll_SHGetSpecialFolderPathW]
shl edi, 0xfb
mov dword [ecx + 0x46b5a0], ecx
add edi, 0x4173e8e3
lea edi, [ebx + eax*2]
add ebx, 0xffffa6fa
mov dword [ecx + 0x46b5a0], ecx
and dword [ecx + 0x46b5a0], 4
lea edi, [eax + ebx*2 + 0x4229d938]
or ebx, eax
shr edi, 7
neg ebx
nop
nop
xor edi, esp
lea ebx, [ecx + edi*8 + 0x1547d5a3]
mov dword [ecx + 0x46b5a0], edx
test edi, esi
setne bl
sub edi, 0x184fb209
mov edi, dword [ecx + 0x468d60]
sub edi, 0xc2cb2dfc
mov ebx, edi
sar ebx, 0xef
not ebx
neg edi
and dword [ecx + 0x46b5a0], 0xffffffca
xor ebx, esp
cmp eax, 0x65
mov dword [ecx + 0x46b5a0], 0x2fcd
add ebx, ebp
xor ebx, ecx
sub dword [ecx + 0x46b5a0], 0x77ed
imul ebx, dword [ecx + 0x46a9a0]
setg bl
mov ebx, dword [ecx + 0x469160]
and dword [ecx + 0x46b5a0], 0xffffffb2
or ebx, esp
mov edi, eax
dec edi
sub edi, 0x1851
sbb ebx, 0xffffea19
xor ebx, esp
add edi, 0x39f8
lea ebx, [edi + 0x39ee]
sub edi, 0xd36aa053
mov dword [ecx + 0x46b5a0], edx
shr edi, 0xfe
mov ebx, dword [ecx + 0x46a1a0]
lea edi, [ebx + ebp*8 - 4]
sub edi, ecx
sbb ebx, ebx
add ebx, 0xffffcc68
xor edi, esp
inc edi
sub ebx, 0x5f57c439
add ebx, dword [ecx + 0x46b5a0]
mov dword [ecx + 0x46b5a0], edi
lea ebx, [ebx + ebx*4 - 0x2b]
cmp ecx, edi
lea ebx, [eax + esi*2]
mov dword [ecx + 0x46b5a0], 0x3d81
xor edi, 0xfffffff7
nop
sub dword [ecx + 0x46b5a0], 5
add edi, ebp
mov dword [ecx + 0x46b5a0], 0x71f9c7f7
adc dword [ecx + 0x46b5a0], ebp
dec ebx
test esp, esi
mov dword [ecx + 0x46b5a0], edx
xor byte [ecx + 0x46b5a0], bl
add ebx, 0xfffffff9
inc edi
mov ebx, ecx
dec ebx
add edi, 0x15f368ce
jmp 0x411012
lea ebx, [ebx + ecx*8]
sub ebx, 0xffffffae
mov ebx, esi
lea edi, [ebx + ecx*8]
mov ebx, dword [ecx + 0x46a5a0]
sub bl, cl
inc ebx
mov dword [ecx + 0x46b5a0], edi
shl ebx, cl
call fcn.00410eaf
setne bl
mov dword [ecx + 0x46b5a0], ebx
xor edi, edi
sbb ebx, edx
call fcn.00410ef7
lea ebx, [edi]
mov dword [ecx + 0x46b5a0], edx
nop
lea ebx, [edi + edx*2 - 6]
shr ebx, 0x98
mov ebx, dword [ecx + 0x46ada0]
and dword [ecx + 0x46b5a0], 0xffffeb04
xor ebx, ebx
mov ebx, dword [ecx + 0x46b5a0]
or dword [ecx + 0x46b5a0], ebx
mov dword [ecx + 0x46b5a0], edx
xor edi, esi
shr ebx, 0xf9
and dword [ecx + 0x46b5a0], 0xfffffffa
mov dword [ecx + 0x46b5a0], ebx
shl eax, 8
mov dword [ecx + 0x46b5a0], ebx
sub ebx, 0xffffffff
add edi, ebx
lea ebx, [ecx + ebp*8 - 0x4dcb4615]
test eax, esi
mov dword [ecx + 0x46b5a0], esi
shr ebx, 0x5a
and dword [ecx + 0x46b5a0], 0x4d
xor eax, esi
xor eax, edx
dec edx
inc dword [ecx + 0x46b5a0]
lea ebx, [edx - 5]
inc edi
mov dword [ecx + 0x46b5a0], eax
ror eax, 8
mov dword [ecx + 0x46b1a0], eax
ror eax, 8
mov dword [ecx + 0x46ada0], eax
ror eax, 8
mov dword [ecx + 0x46a9a0], eax
shl ebx, cl
xor ebx, edi
mov al, byte [ecx + 0x46b9a0]
mov edi, 0xffffffe6
cmp esi, edi
mov edx, edx
sete bl
add edi, 1
cmp al, 0x51
mov bx, word [ecx + reloc.shell32.dll_SHGetSpecialFolderPathW]
sub edx, dword [ecx + 0x46a1a0]
mov edi, esp
test al, al
xchg edx, edx
mov edx, dword [ecx + 0x46a9a0]
lea edi, [esi + edx*2 + 0x4e]
movzx edi, word [ecx + reloc.shell32.dll_SHGetSpecialFolderPathW]
je 0x411246
xor ebx, edi
sbb esi, ecx
mov ebx, ebx
shl esi, 0xe0
shr edx, 5
xor esi, eax
shr edi, 1
mov ebx, eax
movzx edx, al
movzx esi, byte [ebp + edx - 0x104]
xor edi, ebp
inc ebx
mov eax, 0xfffffffe
xor edi, 0x71
add edi, 0xffff8e31
cmp dword [ecx + 0x46b1a0], eax
mov eax, dword [ecx + 0x46a9a0]
sete bl
movzx eax, byte [ebp - 0xf9]
mov edi, dword [ecx + 0x46b5a0]
test ebp, esi
add eax, esi
cdq
sub ebx, 0xffffa5ff
add ebx, 7
and ebx, eax
mov edi, 0xfb
sub edi, 0xfffffffc
idiv edi
movzx eax, byte [ebp + edx - 0x204]
xor ebx, ebp
sub ebx, 0xffffffff
mov dword [ebp - 0x208], eax
lea ebx, [ebx + edx*2]
dec eax
sub eax, 0x673b8daa
movzx eax, byte [ebp - 0xf7]
shl ebx, cl
sbb ebx, edi
add eax, esi
cdq
idiv edi
movzx eax, byte [ebp - 0xfb]
shl ebx, 0xfb
mov ebx, dword [ecx + 0x46b1a0]
add eax, esi
mov bx, cx
xor ebx, 0x7a
movzx ebx, byte [ebp + edx - 0x204]
cdq
idiv edi
movzx eax, byte [ebp - 0xf6]
mov edi, ebp
shl edi, 0x2e
add eax, esi
lea esi, [eax + ebx*4 + 0x5c]
sbb edi, ebp
mov esi, 0x30b5
add esi, 0xffffd04a
lea edi, [ebp + ebp*4 - 1]
inc edi
add edi, 0x5c7a6616
movzx edi, byte [ebp + edx - 0x204]
cdq
idiv esi
movzx eax, byte [ebp + edx - 0x204]
cmp dword [ecx + 0x46ada0], 0x527838a
mov edx, dword [ebp - 0x208]
or dword [ecx + 0x46a5a0], 0xffffeb23
mov dword [ecx + 0x46a5a0], ecx
jno 0x411275
jo 0x411275
test esi, ebp
setge bl
xor edx, edx
jmp 0x41125d
xor ebx, ebx
neg eax
xor edi, edi
xor eax, eax
sub dword [ecx + 0x46a5a0], 0xffffffff
mov dword [ecx + 0x46a5a0], ebp
sub dword [ecx + 0x46a5a0], 0xffffff34
sub dword [ecx + 0x46a5a0], 0x51
mov dword [ecx + 0x46a5a0], edi
shl eax, 8
or dword [ecx + 0x46a5a0], edx
nop
xor eax, edi
inc dword [ecx + 0x46a5a0]
mov dword [ecx + 0x46a5a0], ebx
shl eax, 8
or byte [ecx + 0x46a5a0], 0x74
mov dword [ecx + 0x46a5a0], ebx
xor eax, ebx
inc dword [ecx + 0x46a5a0]
mov dword [ecx + 0x46a5a0], 0
shl eax, 8
or dword [ecx + 0x46a5a0], esi
mov dword [ecx + 0x46a5a0], esi
xor eax, edx
inc dword [ecx + 0x46a5a0]
mov dword [ecx + 0x46a5a0], eax
ror eax, 8
mov dword [ecx + 0x46a1a0], eax
ror eax, 8
mov dword [ecx + 0x469160], eax
ror eax, 8
nop
mov dword [ecx + 0x468d60], eax
add ecx, 4
cmp ecx, 0x400
jl 0x4103bf
call fcn.00411250
lea esi, [eax + esi*2 - 0x31]
xor edi, dword [ebp - 4]
mov ecx, dword [ebp - 4]
xor ebx, ebx
mov esi, dword [ebp - 4]
pop edi
pop esi
sub ebx, 0x1f8d13ec
add ebx, 0x987c0c0f
xor ecx, ebp
inc ebx
mov ebx, eax
pop ebx
call fcn.0041fd66
cmp dl, 3
mov esp, ebp
test ebp, esi
pop ebp
nop
ret