Function at 0x40fae8
Capabilities:
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
pushal
push 0x700000
push 0
call fcn.00403890
mov dword [0x4b3d78], eax
push eax
mov edi, eax
mov ecx, 0x1c0000
or eax, 0xffffffff
rep stosd dword es:[edi], eax
pop edi
lea ebx, [ebp - 0x10]
push ebx
call fcn.00403928
movzx eax, word [ebx]
sub eax, 0x7de
imul edx, eax, 0xc
movzx eax, word [ebx + 2]
add eax, edx
shl eax, 5
movzx edx, word [ebx + 6]
add eax, edx
imul eax, eax, 0x18
movzx edx, word [ebx + 8]
add eax, edx
imul eax, eax, 0x3c
movzx edx, word [ebx + 0xa]
add eax, edx
imul eax, eax, 0x3c
movzx ecx, word [ebx + 0xc]
add ecx, eax
shl ecx, 2
movzx eax, byte [ebx + 0xf]
add eax, ecx
mov dword [edi + 0x4c], eax
xor ebp, ebp
mov eax, dword [ebp*4 + 0x2c4640f]
add eax, 0xa000a
bswap eax
lea ebx, [edi + 0x4ba4]
mov word [ebx + ebp*2], ax
shr eax, 0x10
mov word [ebx + ebp*2 - 0x20], ax
xor esi, esi
xor ebx, ebx
imul ecx, ebp, 0x2b
imul eax, esi, 6
lea ecx, [eax + ecx + 0x2c4615f]
movzx eax, word [ecx + ebx*2]
cdq
push dword [ebx + ecx + 4]
lea ecx, [edx + 0x3c]
div ecx
shl edx, 5
add edx, eax
pop eax
mov ah, al
and ah, 3
jne 0x40fbac
add dh, 8
dec ah
jne 0x40fbb3
add dh, 0x10
shr al, 2
jne 0x40fbbb
add dh, 0x20
dec al
jne 0x40fbc2
add dh, 0x40
imul eax, ebp, 0xe
lea eax, [eax + esi*2]
add eax, ebx
mov word [edi + eax*2 + 0x49c4], dx
xor ebx, 1
jne 0x40fb81
inc esi
cmp esi, 6
jbe 0x40fb7f
inc ebp
cmp ebp, 0xf
jbe 0x40fb5d
push pe_nt_image_headers32
push 0x2dc8290
lea eax, [edi + 0x50]
push eax
call fcn.00403878
lea eax, [edi + 0x150]
mov edx, 0x2dc56bc
mov ecx, 0x2bd4
call fcn.0040f2d0
push 0xe0
push 0x2dc9f90
lea eax, [edi + 0x2d24]
push eax
call fcn.00403878
lea eax, [edi + 0x2e04]
mov edx, 0x2dc83b0
mov ecx, 0x1bc0
call fcn.0040f2d0
add edi, 0x4bd6
mov eax, dword [0x2c4644f]
mov ax, word [eax*2 + 0x42cb38]
bswap eax
mov dword [edi - 4], eax
mov esi, 0x48f7b0
mov ecx, 0x14c
rep movsb byte es:[edi], byte [esi]
mov dword [0x4b3d80], edi
mov edi, dword [0x4b3d78]
add edi, 0x4bc4
mov esi, 0x2c46453
push 7
pop ecx
lodsd eax, dword [esi]
dec eax
js 0x40fc7d
inc eax
stosw word es:[edi], ax
loop 0x40fc78
popal
pushal
mov edi, dword [0x4b3d80]
mov esi, 0x57efe1
xor ecx, ecx
mov edx, 0x57f09c
cmp byte [edx + 7], cl
jne 0x40fd06
mov byte [edx], 0xff
mov esi, 0x40fcb5
mov eax, dword [0x2c4644f]
dec eax
js 0x40fd06
add esi, 0x13
dec eax
je 0x40fd06
add esi, 0xc
jmp 0x40fd06
lodsb al, byte [esi]
or al, al
je 0x40fd16
cmp cl, byte [edx]
jne 0x40fd12
mov al, 0xd
inc edx
stosb byte es:[edi], al
inc ecx
jmp 0x40fd06
mov al, 0xd
stosb byte es:[edi], al
lea eax, [ebp - 0x2c]
push eax
call fcn.00403930
mov eax, dword [ebp - 0x26]
call fcn.0040fce8
mov eax, dword [ebp - 0x2a]
call fcn.0040fce8
movzx eax, word [ebp - 0x2c]
cdq
lea ecx, [edx + 0x64]
div ecx
mov ebx, 0x40fcfb
call ebx
mov eax, edx
call ebx
mov al, 0x20
stosb byte es:[edi], al
mov eax, dword [ebp - 0x24]
call ebx
mov al, 0x3a
stosb byte es:[edi], al
mov eax, dword [ebp - 0x22]
call ebx
mov al, 0
stosb byte es:[edi], al
mov dword [0x4b3d80], edi
popal
pushal
mov edi, dword [0x4b3d80]
mov eax, dword [0x2c4644f]
mov ax, word [eax*2 + 0x42cb30]
mov esi, dword [eax*4 + 0x4c44d4]
xor ebx, ebx
mov byte [edi], 0
mov edx, edi
lodsw ax, word [esi]
call fcn.00407924
inc edi
inc ebx
mov eax, dword [0x2c4644f]
cmp bx, word [eax*2 + 0x42cb38]
jb 0x40fd7e
popal
mov eax, dword [0x4ad558]
mov eax, dword [eax + 0x26c73a7]
movzx eax, word [eax*2 + 0x42cb38]
add dword [0x4b3d80], eax
call fcn.00413e40
call fcn.00407b0c
xor eax, eax
mov dword [ebp - 0x1c], eax
mov esi, dword [0x4ad558]
add esi, 0x11
mov dword [ebp - 0x44], 0x4b3d8c
mov eax, dword [0x4ad558]
add eax, 0x153
mov dword [ebp - 0x48], eax
cmp byte [esi], 0
je 0x41113c
mov ecx, dword [ebp - 0x1c]
mov eax, dword [0x4b329c]
shr eax, cl
test al, 1
je 0x41113c
mov eax, dword [0x4ad558]
movzx eax, byte [eax]
call fcn.00413f14
mov edi, eax
test edi, edi
jbe 0x40fee8
mov eax, dword [ebp - 0x1c]
call fcn.00413f14
mov dword [ebp - 4], eax
mov eax, dword [0x4ad558]
movzx eax, byte [eax]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x4ad558]
cmp byte [edx + eax + 0x11], 3
jne 0x40fe5b
mov eax, dword [0x4ad558]
movzx eax, byte [eax]
shl eax, 0xc
shl eax, 5
mov edx, dword [0x4ad558]
movzx eax, byte [edx + eax*8 + 0x2a087]
mov dword [ebp - 0x18], eax
jmp 0x40fe83
mov eax, dword [0x4ad558]
movzx eax, byte [eax]
shl eax, 0xc
add eax, 0x200
add edi, eax
mov eax, edi
shl eax, 5
mov edx, dword [0x4ad558]
movzx eax, byte [edx + eax*8 + 0x178]
mov dword [ebp - 0x18], eax
cmp byte [esi], 3
je 0x40fee8
mov eax, dword [ebp - 0x1c]
shl eax, 0xc
add eax, 0x200
add eax, dword [ebp - 4]
shl eax, 5
mov edx, dword [0x4ad558]
movzx ecx, byte [ebp - 0x18]
mov byte [edx + eax*8 + 0x178], cl
mov eax, dword [ebp - 0x1c]
shl eax, 0xc
add eax, 0x100
mov edx, dword [ebp - 4]
shl edx, 4
add eax, edx
mov edx, dword [0x4ad558]
movzx edx, byte [edx]
add eax, edx
shl eax, 5
mov edx, dword [0x4ad558]
lea eax, [edx + eax*8 + 0x173]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov byte [eax], 7
mov eax, dword [ebp - 0x40]
or byte [eax + 1], 1
push 0x4000
push 0x4b3ed4
call fcn.00403870
push 0x8000
push 0x4b7ed4
call fcn.00403870
mov eax, dword [0x4b3d78]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [0x4b3d80]
sub ecx, dword [0x4b3d78]
mov dword [eax + edx*4 + 4], ecx
mov eax, dword [ebp - 0x44]
mov edx, dword [0x4b3d80]
mov dword [eax], edx
add dword [0x4b3d80], 4
movzx eax, byte [esi]
movzx eax, byte [eax + 0x48f978]
call fcn.0040f31c
xor edi, edi
mov eax, dword [ebp - 0x1c]
shl eax, 0xc
add eax, 0x39
add eax, 0x200
add eax, edi
shl eax, 5
mov edx, dword [0x4ad558]
mov ecx, dword [edx + eax*8 + 0x17c]
mov eax, ecx
mov ebx, 0x3c
xor edx, edx
div ebx
mov ebx, eax
mov eax, dword [0x4ad558]
mov eax, ecx
mov ecx, 0x3c
xor edx, edx
div ecx
mov eax, edx
shl eax, 5
add bx, ax
mov eax, ebx
call fcn.0040f360
mov eax, dword [ebp - 0x1c]
shl eax, 0xc
add eax, 0x39
add eax, 0x200
add eax, edi
shl eax, 5
mov edx, dword [0x4ad558]
movzx eax, byte [edx + eax*8 + 0x178]
call fcn.0040f31c
inc edi
cmp edi, 4
jne 0x40ff41
cmp byte [esi], 3
jne 0x40ffcf
mov eax, dword [ebp - 0x48]
movzx eax, word [eax]
xor ax, 0x22
call fcn.0040f360
jmp 0x40ffda
mov eax, dword [ebp - 0x48]
movzx eax, word [eax]
call fcn.0040f360
pushal
mov esi, fcn.0040f31c
mov edi, dword [ebp - 0x1c]
imul eax, edi, 0x100000
mov al, byte [eax + 0x5a0920]
call esi
mov ebx, dword [edi*4 + 0x57f1ba]
shld eax, ebx, 0x10
shl ah, 7
add al, ah
call esi
shld eax, ebx, 0xe
and al, 0x80
shl bh, 6
add al, bh
call esi
lea eax, [ebx + 1]
call esi
mov eax, edi
shl eax, 0xc
add ax, 0x29f
call fcn.0040f444
mov byte [ebp - 0x30], al
call esi
mov eax, edi
call fcn.00413f14
mov ebx, eax
xor ebp, ebp
xor eax, eax
or ebx, ebx
je 0x410062
cmp edi, ebp
je 0x410062
mov eax, edi
shl eax, 8
add eax, ebx
shl eax, 4
add eax, ebp
shl eax, 8
mov edx, dword [eax + 0x58f220]
mov al, dh
shl eax, 7
add al, 4
sub al, dl
bswap edx
shl edx, 6
add al, dl
call esi
inc ebp
cmp ebp, 0xf
jbe 0x410033
popal
push esi
imul esi, dword [ebp - 0x1c], 0x100000
xor eax, eax
cdq
xor ecx, ecx
cmp dh, byte [esi + 0x57f21c]
je 0x410083
bts eax, edx
add esi, 0x100
inc cl
jne 0x410078
inc edx
cmp edx, 0xf
jbe 0x410076
pop esi
mov dword [0x4b3dcc], eax
call fcn.0040f360
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x18], 3
mov eax, dword [ebp - 0x1c]
shl eax, 0xc
mov edx, eax
add edx, 0x200
add edx, dword [ebp - 0x18]
shl edx, 5
mov ecx, dword [0x4ad558]
cmp byte [ecx + edx*8 + 0x175], 3
jne 0x410126
mov edx, eax
add edx, dword [ebp - 0x1c]
add edx, 0x100
mov ecx, dword [ebp - 0x18]
shl ecx, 4
add edx, ecx
mov dword [ebp - 0x3c], edx
push 0xa9
add eax, 0x200
shl eax, 5
mov edx, dword [0x4ad558]
lea eax, [edx + eax*8 + 0xa08b]
push eax
mov ebx, dword [ebp - 0x3c]
shl ebx, 5
mov eax, dword [0x4ad558]
lea eax, [eax + ebx*8 + 0x18b]
push eax
call fcn.00403878
mov eax, dword [0x4ad558]
mov byte [eax + ebx*8 + 0x174], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jne 0x4100ac
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [esi - 0x10]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [0x4b3dcc]
shr eax, cl
test al, 1
je 0x41107a
push 0x20
push 0x4bfed4
call fcn.00403870
mov eax, dword [0x4b3d80]
mov dword [0x4b3dd0], eax
push edi
or eax, 0xffffffff
lea ecx, [eax + 9]
mov edi, dword [0x4b3dd0]
rep stosd dword es:[edi], eax
pop edi
push pe_nt_image_headers32
push 0x4b3dd4
call fcn.00403870
mov eax, dword [ebp - 0x1c]
call fcn.00413f14
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x4101ca
mov eax, dword [ebp - 0x1c]
mov edx, eax
shl eax, 0xc
add eax, edx
add eax, 0x100
mov edx, dword [ebp - 0x14]
shl edx, 4
add eax, edx
shl eax, 5
mov edx, dword [0x4ad558]
lea eax, [edx + eax*8 + 0x173]
mov byte [eax], 7
mov byte [eax + 1], 1
movzx edx, byte [esi]
mov byte [eax + 2], dl
cmp dword [ebp - 0x18], 1
jne 0x410209
cmp byte [esi], 3
jne 0x410209
push 0x1000
mov eax, dword [ebp - 0x1c]
shl eax, 0xc
add eax, 0x100
shl eax, 5
mov edx, dword [0x4ad558]
lea edx, [edx + eax*8 + 0xf173]
push edx
mov edx, dword [0x4ad558]
lea eax, [edx + eax*8 + 0x3173]
push eax
call fcn.00403878
mov eax, dword [ebp - 0x4c]
cmp byte [eax], 0xb
je 0x410326
xor eax, eax
mov dword [ebp - 0x14], eax
mov ebx, 0x4b3dd4
mov eax, dword [ebp - 0x1c]
shl eax, 0xc
mov edx, dword [ebp - 0x18]
shl edx, 8
add eax, edx
add eax, dword [ebp - 0x14]
shl eax, 5
mov edx, dword [0x4ad558]
lea eax, [edx + eax*8 + 0x173]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp byte [eax], 5
jne 0x410285
mov eax, dword [ebp - 0xc]
test byte [eax + 5], 1
je 0x410270
mov eax, dword [ebp - 0x14]
and eax, 1
add eax, dword [ebp - 0x14]
mov byte [eax + 0x4b3dd4], 0x85
mov byte [eax + 0x4b3dd5], 0x85
jmp 0x410315
mov eax, dword [ebp - 0x14]
and eax, 1
add eax, dword [ebp - 0x14]
mov byte [eax + 0x4b3dd4], 5
jmp 0x410315
mov eax, dword [ebp - 0xc]
cmp byte [eax + 1], 0
ja 0x4102c2
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
add al, 0xf6
sub al, 5
jb 0x4102c2
sub al, 1
je 0x4102c2
add al, 0xfd
sub al, 4
jb 0x4102c2
cmp dword [ebp - 0x18], 2
jne 0x410315
mov eax, dword [ebp - 0x14]
sub eax, 3
jb 0x4102c2
add eax, 0xfffffff2
sub eax, 4
jb 0x4102c2
add eax, 0xffffffd8
sub eax, 0x27
jae 0x410315
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
mov byte [ebx], al
cmp dword [ebp - 0x18], 2
jne 0x4102fc
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0
jne 0x4102fc
mov eax, dword [ebp - 0x14]
sub eax, 3
jb 0x4102f0
add eax, 0xfffffff2
sub eax, 4
jb 0x4102f0
add eax, 0xffffffd8
sub eax, 0x27
jae 0x4102f3
mov byte [ebx], 0xb
cmp dword [ebp - 0x14], 2
ja 0x4102fc
mov byte [ebx], 0x81
cmp byte [ebx], 7
jne 0x410315
mov ecx, dword [ebp - 0x14]
and ecx, 0xf
mov eax, dword [0x4b329c]
shr eax, cl
test al, 1
jne 0x410315
mov byte [ebx], 0
inc dword [ebp - 0x14]
inc ebx
cmp dword [ebp - 0x14], 0x100
jne 0x41021f
cmp dword [ebp - 0x18], 1
jne 0x41033d
cmp byte [esi], 3
jne 0x41033d
push 0x10
push 0x4b3ec4
call fcn.00403870
xor eax, eax
mov dword [ebp - 0x14], eax
mov ebx, 0x4b3dd4
cmp byte [ebx], 0
je 0x410356
call fcn.0040fac8
call fcn.0040f868
inc dword [ebp - 0x14]
inc ebx
cmp dword [ebp - 0x14], 0x100
jne 0x410347
cmp dword [ebp - 0x18], 1
jne 0x41037a
cmp dword [ebp - 0x3c], 0
jl 0x41037a
movzx eax, byte [ebp - 0x3c]
mov byte [eax + 0x4b3dd4], 7
add dword [0x4b3d80], 0x20
xor eax, eax
mov dword [ebp - 0x14], eax
mov ebx, 0x4b3dd4
call fcn.0040fac8
mov eax, dword [0x4b3d80]
inc eax
mov dword [0x4b3d7c], eax
movzx eax, byte [ebx]
cmp eax, 0xf
jg 0x4103f5
je 0x410f52
cmp eax, 0xe
ja case.0x41040c.17
jmp dword [eax*4 + 0x4103b9]
cmp eax, 0x1b
jg 0x41043b
je 0x4105a0
add eax, 0xfffffff0
cmp eax, 9
ja case.0x41040c.17
jmp dword [eax*4 + 0x410413]
sub eax, 0x1c
je 0x410618
dec eax
je 0x410660
sub eax, 0x64
je 0x410c50
sub eax, 4
je case.0x4103b2.5
jmp case.0x41040c.17
mov al, 0x8a
call fcn.0040f31c
xor eax, eax
call fcn.0040f31c
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 2]
movzx eax, byte [eax + 0x48f978]
call fcn.0040f31c
xor eax, eax
call fcn.0040f31c
mov eax, dword [ebp - 0x10]
call fcn.0040f380
jmp 0x411039
mov al, 0x87
call fcn.0040f31c
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 1]
and al, 4
add eax, eax
add eax, eax
add eax, eax
call fcn.0040f31c
mov eax, dword [ebp - 0xc]
movzx edi, byte [eax + 5]
mov eax, dword [ebp - 0x10]
or eax, 0xff
shl eax, 5
mov edx, dword [0x4ad558]
cmp byte [edx + eax*8 + 0x173], 0x1a
jne 0x4104ea
mov edx, dword [0x4ad558]
cmp byte [edx + eax*8 + 0x175], 0
jbe 0x4104ea
add edi, 0x80
mov eax, edi
call fcn.0040f31c
cmp byte [ebx], 0x13
jne 0x41051a
mov eax, dword [ebp - 0x10]
call fcn.0040f444
mov byte [ebp - 0x2f], al
movzx eax, byte [ebp - 0x2f]
cmp al, byte [ebp - 0x30]
je 0x41051a
mov eax, dword [0x4b3d7c]
inc byte [eax]
movzx eax, byte [ebp - 0x2f]
call fcn.0040f31c
mov eax, dword [ebp - 0x10]
call fcn.0040f380
call fcn.0040f5b4
call fcn.0040f680
call fcn.0040f6f0
call fcn.0040f614
cmp byte [ebx], 0x13
jne 0x410571
xor edi, edi
mov ecx, edi
mov eax, dword [ebp - 0xc]
add eax, 7
mov eax, dword [eax]
shr eax, cl
test al, 1
je 0x41056b
mov eax, edi
shl eax, 0x18
add eax, 0x481483
call fcn.0040f458
mov eax, edi
shl eax, 0x18
add eax, 0x491487
call fcn.0040f458
inc edi
cmp edi, 0x10
jne 0x41053d
mov eax, dword [ebp - 0x10]
call fcn.0040f46c
mov eax, dword [0x4b3d7c]
test byte [eax], 0xdf
jne 0x411039
sub dword [0x4b3d80], 3
mov eax, dword [0x4b3dd0]
mov edx, dword [ebp - 0x14]
call fcn.00421858
jmp 0x411039
push esi
mov esi, dword [ebp - 0xc]
imul eax, dword [esi + 1], 8
and eax, 0x20
mov ah, 0x95
call fcn.0040f360
push 0x10
cmp byte [esi + 0xc1], 0x2b
je 0x4105d5
mov eax, dword [0x2c4644f]
cmp eax, 2
jae 0x4105d5
add eax, 0x2b343230
call fcn.0040f370
sub dword [esp], 4
pop eax
lea edx, [esi + 0xc1]
call fcn.0040f328
mov eax, dword [esi + 5]
bswap eax
shr al, 4
call fcn.0040f370
mov ah, byte [esi + 8]
and ah, 7
mov al, byte [esi + 0x14]
call fcn.0040f360
push 0x14
pop eax
lea edx, [esi + 0xdf]
call fcn.0040f328
pop esi
mov eax, dword [ebp - 0x10]
call fcn.0040f380
jmp 0x411039
pushal
mov ebx, fcn.0040f31c
mov esi, dword [ebp - 0xc]
movzx edi, byte [esi + 8]
mov al, 0x93
call ebx
xor eax, eax
call ebx
mov al, byte [edi + 0x42cb40]
call ebx
push dword [esi + 9]
add esi, 0xc1
mov ebx, fcn.0040f370
lodsd eax, dword [esi]
call ebx
pop eax
call fcn.0040f360
lodsd eax, dword [esi]
call ebx
lodsd eax, dword [esi]
call ebx
popal
mov eax, dword [ebp - 0x10]
call fcn.0040f380
jmp 0x411039
pushal
mov esi, fcn.0040f360
xor eax, eax
mov ah, 0x94
call esi
mov edi, dword [ebp - 0xc]
mov eax, dword [edi + 5]
shl ax, 0xe
shr eax, 0xe
movzx edx, byte [edi + 8]
mov ah, byte [edx + 0x42cb40]
call esi
mov ebx, dword [ebp - 0x14]
mov bh, byte [ebp - 0x1c]
shl ebx, 0xc
add ebx, 0x57c9eb
mov ebp, fcn.0040f328
mov eax, 0x8000001e
mov edx, ebx
call ebp
sub edx, 0x708
call ebp
add edx, 0xc8
mov al, 0x14
call ebp
add edx, 0x190
add al, al
call ebp
mov eax, dword [edi + 0xc9]
call fcn.0040f370
mov eax, dword [edi + 0x16]
call esi
xor eax, eax
inc eax
push eax
call esi
pop eax
push eax
call esi
pop eax
mov edx, 0x48f998
call ebp
call ebp
popal
mov eax, dword [ebp - 0x10]
call fcn.0040f380
jmp 0x411039
mov al, 0x8e
call fcn.0040f31c
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 1]
and al, 4
add eax, eax
add eax, eax
add eax, eax
call fcn.0040f31c
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 2]
shl eax, 6
mov edx, dword [ebp - 0xc]
add al, byte [edx + 9]
call fcn.0040f31c
mov eax, dword [ebp - 0x10]
call fcn.0040f444
mov byte [ebp - 0x2f], al
movzx eax, byte [ebp - 0x2f]
cmp al, byte [ebp - 0x30]
je 0x410744
mov eax, dword [0x4b3d7c]
inc byte [eax]
movzx eax, byte [ebp - 0x2f]
call fcn.0040f31c
mov eax, dword [ebp - 0x10]
call fcn.0040f380
call fcn.0040f5b4
call fcn.0040f680
call fcn.0040f6f0
call fcn.0040f614
mov eax, dword [ebp - 0x10]
call fcn.0040f46c
mov eax, dword [0x4b3d7c]
test byte [eax], 0xdf
jne 0x411039
sub dword [0x4b3d80], 3
mov eax, dword [0x4b3dd0]
mov edx, dword [ebp - 0x14]
call fcn.00421858
jmp 0x411039
movzx eax, byte [ebx]
add al, 0x78
call fcn.0040f31c
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 1]
and al, 4
add eax, eax
add eax, eax
add eax, eax
call fcn.0040f31c
cmp byte [ebx], 0x19
jae 0x4107bf
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 2]
dec eax
call fcn.0040f31c
mov eax, dword [ebp - 0x10]
call fcn.0040f380
jmp 0x411039
mov al, 0x88
call fcn.0040f31c
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 1]
and al, 4
add eax, eax
add eax, eax
add eax, eax
call fcn.0040f31c
mov eax, dword [ebp - 0x10]
and eax, 0xf000
mov edx, dword [ebp - 0x10]
and edx, 0xff0
shr edx, 4
add eax, edx
shl eax, 5
mov edx, dword [0x4ad558]
cmp byte [edx + eax*8 + 0x10175], 3
jne 0x410820
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 5]
and al, 1
call fcn.0040f31c
jmp 0x410830
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 9]
shr eax, 0xe
and al, 0xc
call fcn.0040f31c
mov eax, dword [ebp - 0x10]
call fcn.0040f380
call fcn.0040f5b4
call fcn.0040f680
mov eax, dword [ebp - 0x10]
call fcn.0040f46c
jmp 0x411039
mov al, 0x88
call fcn.0040f31c
xor eax, eax
call fcn.0040f31c
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 5]
and al, 1
movzx eax, al
mov edi, eax
add edi, edi
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 6]
and al, 1
movzx eax, al
add edi, eax
mov eax, dword [ebp - 0x10]
or eax, 0xff
shl eax, 5
mov edx, dword [0x4ad558]
cmp byte [edx + eax*8 + 0x173], 0x1a
jne 0x4108b7
mov eax, dword [ebp - 0x10]
or eax, 0xff
shl eax, 5
mov edx, dword [0x4ad558]
cmp byte [edx + eax*8 + 0x175], 0
jbe 0x4108b7
add edi, 0x80
mov eax, edi
call fcn.0040f31c
mov eax, dword [ebp - 0x10]
call fcn.0040f380
call fcn.0040f5b4
call fcn.0040f680
call fcn.0040f6f0
mov eax, dword [ebp - 0x10]
call fcn.0040f46c
jmp 0x411039
mov al, 0x89
call fcn.0040f31c
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 1]
and al, 4
add eax, eax
add eax, eax
add eax, eax
call fcn.0040f31c
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 2]
movzx eax, byte [eax + 0x48f97c]
call fcn.0040f31c
mov eax, dword [ebp - 0x10]
call fcn.0040f444
mov byte [ebp - 0x2f], al
movzx eax, byte [ebp - 0x2f]
cmp al, byte [ebp - 0x30]
je 0x410934
mov eax, dword [0x4b3d7c]
inc byte [eax]
movzx eax, byte [ebp - 0x2f]
call fcn.0040f31c
mov eax, dword [ebp - 0x10]
call fcn.0040f380
call fcn.0040f5b4
call fcn.0040f6f0
mov eax, dword [ebp - 0x10]
call fcn.0040f46c
jmp 0x411039
mov al, 0x84
call fcn.0040f31c
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 1]
and al, 4
add eax, eax
add eax, eax
add eax, eax
call fcn.0040f31c
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 9]
add eax, eax
add al, 2
call fcn.0040f31c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 9]
shr ax, 8
add eax, eax
add al, 2
call fcn.0040f31c
mov eax, dword [ebp - 0x10]
call fcn.0040f444
mov byte [ebp - 0x2f], al
movzx eax, byte [ebp - 0x2f]
cmp al, byte [ebp - 0x30]
je 0x4109b5
mov eax, dword [0x4b3d7c]
inc byte [eax]
movzx eax, byte [ebp - 0x2f]
call fcn.0040f31c
mov eax, dword [ebp - 0x10]
call fcn.0040f380
call fcn.0040f5b4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 9]
shr eax, 0x11
test al, 1
je 0x410a53
mov edi, 0x1e8480
mov eax, dword [0x4ad558]
add eax, 0x1a7da37
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, word [eax]
test ax, ax
jne 0x4109fa
mov edx, dword [ebp - 0x50]
cmp word [edx + 2], 0
je 0x410a53
mov edx, dword [ebp - 0x50]
movzx edx, word [edx + 2]
cmp edx, dword [ebp - 0x10]
jne 0x410a4c
movzx edx, ax
shl edx, 5
mov ecx, dword [0x4ad558]
movzx edx, byte [ecx + edx*8 + 0x173]
sub dl, 4
je 0x410a36
sub dl, 6
je 0x410a36
sub dl, 4
je 0x410a36
sub dl, 2
je 0x410a36
add dl, 0xfe
sub dl, 5
jae 0x410a4c
movzx eax, ax
shl eax, 0x10
add eax, 0x20
add eax, 3
add eax, 0x600
call fcn.0040f458
add dword [ebp - 0x50], 5
dec edi
jne 0x4109e5
call fcn.0040f680
call fcn.0040f6f0
call fcn.0040f614
mov eax, dword [ebp - 0x10]
call fcn.0040f46c
jmp 0x411039
mov al, 0x85
call fcn.0040f31c
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 1]
and al, 4
add eax, eax
add eax, eax
add eax, eax
call fcn.0040f31c
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 2]
movzx eax, byte [eax + 0x42cb58]
and al, 0x7f
call fcn.0040f31c
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 2]
mov edx, dword [0x4ad514]
movzx eax, byte [edx + eax]
shr eax, 7
mov byte [ebp - 0x2e], al
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 2]
cmp byte [eax + 0x42cb58], 0x80
jae 0x410b87
mov eax, dword [ebp - 0xc]
cmp byte [eax + 2], 0x20
je 0x410adc
mov eax, dword [ebp - 0xc]
cmp byte [eax + 2], 0x21
jne 0x410af0
mov eax, dword [ebp - 0xc]
or dword [eax + 9], 0x4000
mov eax, dword [ebp - 0xc]
or dword [eax + 0xd], 0x4000
mov eax, dword [ebp - 0xc]
cmp byte [eax + 2], 0x1f
jne 0x410b0d
mov eax, dword [ebp - 0xc]
and dword [eax + 9], 0x180
mov eax, dword [ebp - 0xc]
and dword [eax + 0xd], 0x180
add byte [ebp - 0x2e], 0x10
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 2]
mov edx, dword [0x4ad514]
movzx eax, byte [edx + eax]
and al, 0x7f
cmp al, 0x32
jbe 0x410b87
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 9]
mov edx, dword [ebp - 0xc]
cmp eax, dword [edx + 0xd]
je 0x410b3f
mov eax, dword [ebp - 0xc]
cmp byte [eax + 2], 0x23
jne 0x410b76
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 2]
mov edx, dword [0x4ad514]
movzx eax, byte [edx + eax]
and al, 0x7f
movzx eax, al
mov edx, dword [0x4ad580]
mov eax, dword [edx + eax*4 - 0xc8]
mov edx, dword [ebp - 0xc]
cmp eax, dword [edx + 9]
jne 0x410b70
add byte [ebp - 0x2e], 0x20
jmp 0x410b87
add byte [ebp - 0x2e], 4
jmp 0x410b87
add byte [ebp - 0x2e], 8
mov eax, dword [ebp - 0xc]
test byte [eax + 0x11], 0x40
jbe 0x410b87
add byte [ebp - 0x2e], 2
mov eax, dword [ebp - 0xc]
cmp byte [eax + 2], 0x24
jne 0x410b94
or byte [ebp - 0x2e], 0x20
mov eax, dword [ebp - 0xc]
cmp byte [eax + 2], 0x23
jne 0x410baa
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 9]
shr eax, 7
add byte [ebp - 0x2e], al
mov eax, dword [ebp - 0xc]
cmp byte [eax + 2], 0x1e
jne 0x410bc0
mov eax, dword [ebp - 0xc]
cmp dword [eax + 9], 0
jge 0x410bc0
mov byte [ebp - 0x2e], 0x30
mov eax, dword [ebp - 0x10]
call fcn.0040f5c0
add al, byte [ebp - 0x2e]
mov edx, dword [ebp - 0xc]
movzx edx, byte [edx + 0x14]
shl edx, 7
add al, dl
call fcn.0040f31c
test byte [ebp - 0x2e], 0xc
jbe 0x410c03
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [edx + 9]
rol eax, 0x10
call fcn.0040f370
pop edx
test byte [ebp - 0x2e], 8
je 0x410c03
mov eax, dword [edx + 0xd]
rol eax, 0x10
call fcn.0040f370
mov eax, dword [ebp - 0x10]
call fcn.0040f444
mov byte [ebp - 0x2f], al
movzx eax, byte [ebp - 0x2f]
cmp al, byte [ebp - 0x30]
je 0x410c27
mov eax, dword [0x4b3d7c]
inc byte [eax]
movzx eax, byte [ebp - 0x2f]
call fcn.0040f31c
mov eax, dword [ebp - 0x10]
call fcn.0040f380
call fcn.0040f5b4
call fcn.0040f680
call fcn.0040f6f0
call fcn.0040f614
mov eax, dword [ebp - 0x10]
call fcn.0040f46c
jmp 0x411039
movzx eax, byte [ebp - 0x14]
add al, 0x10
call fcn.0040f31c
xor eax, eax
call fcn.0040f31c
mov eax, dword [ebp - 0x10]
call fcn.0040f380
jmp 0x411039
pushal
mov esi, dword [ebp - 0xc]
movzx ebx, byte [esi + 2]
mov edi, fcn.0040f31c
mov eax, dword [ebx + 0x42cb84]
call edi
xor eax, eax
call edi
mov eax, dword [esi + 5]
cmp bl, 3
jne 0x410caa
mov ecx, dword [ebp - 0x1c]
imul edx, ecx, 0x11
cmp byte [edx + 0x57f0b9], 3
jne 0x410cb4
shl ecx, 0x14
mov eax, dword [ecx + 0x5a912f]
jmp 0x410cb4
cmp bl, 2
je 0x410cb4
cmp bl, 0xa
jne 0x410cd2
shl al, 7
shl ax, 7
shr eax, 0xe
cmp bl, 3
jne 0x410cd0
and al, 0xfe
push eax
call fcn.004130a4
pop edx
or dl, byte [eax]
mov eax, edx
call edi
cmp bl, 5
jb 0x410ce4
cmp bl, 9
ja 0x410ce4
mov eax, dword [ebx + 0x42cb8b]
call edi
dec bl
jne 0x410cfd
imul eax, dword [ebp - 0x1c], 0x10
add eax, dword [ebp - 0x14]
mov al, byte [eax + 0x2c4646f]
dec al
js 0x410cfb
dec eax
dec eax
call edi
mov eax, dword [ebp - 0x10]
call fcn.0040f444
cmp al, byte [ebp - 0x30]
je 0x410d13
call edi
mov eax, dword [0x4b3d7c]
inc byte [eax]
popal
mov eax, dword [ebp - 0x10]
call fcn.0040f380
call fcn.0040f5b4
call fcn.0040f6f0
mov eax, dword [ebp - 0x10]
call fcn.0040f46c
jmp 0x411039
mov al, 0x8d
call fcn.0040f31c
xor edx, edx
mov ecx, dword [ebp - 0x14]
cmp byte [ecx + 0x4b3dd4], 5
sete al
and ecx, 3
je 0x410d57
cmp ecx, 3
jne 0x410d55
inc dh
inc dh
neg edx
add edx, dword [ebp - 0xc]
mov ah, byte [edx + 1]
and ah, 4
shl ah, 3
call fcn.0040f360
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov edi, dword [ebp - 0x10]
and edi, 0xfffc
mov eax, dword [ebp - 0x10]
shr eax, 1
and eax, 1
add edi, eax
mov eax, edi
call fcn.0040f444
mov byte [ebp - 0x2f], al
movzx eax, byte [ebp - 0x2f]
cmp al, byte [ebp - 0x30]
je 0x410da6
mov eax, dword [0x4b3d7c]
inc byte [eax]
movzx eax, byte [ebp - 0x2f]
call fcn.0040f31c
mov eax, dword [ebp - 0x10]
and eax, 3
dec eax
je 0x410db4
dec eax
je 0x410db9
jmp 0x410dbc
inc dword [ebp - 0x10]
jmp 0x410dbc
dec dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
call fcn.0040f380
call fcn.0040f5b4
cmp byte [ebx], 5
jne 0x410dd5
call fcn.0040f6f0
jmp 0x410ddd
mov dword [ebp - 0x10], edi
call fcn.0040f6f0
mov eax, dword [ebp - 0x38]
call fcn.0040f46c
jmp 0x411039
mov al, 0x86
call fcn.0040f31c
xor eax, eax
call fcn.0040f31c
mov eax, dword [ebp - 0x10]
call fcn.0040f380
jmp 0x411039
mov al, 0x88
call fcn.0040f31c
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 1]
and al, 4
add eax, eax
add eax, eax
add eax, eax
call fcn.0040f31c
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 6]
and al, 1
mov edx, dword [ebp - 0xc]
movzx edx, byte [edx + 5]
and dl, 1
add edx, edx
add al, dl
mov edx, dword [ebp - 0xc]
movzx edx, byte [edx + 7]
and dl, 1
shl edx, 4
add al, dl
call fcn.0040f31c
mov eax, dword [ebp - 0x10]
call fcn.0040f380
call fcn.0040f5b4
call fcn.0040f680
call fcn.0040f6f0
mov eax, dword [ebp - 0x10]
call fcn.0040f46c
jmp 0x411039
pushal
mov edi, fcn.0040f31c
mov al, 0x8b
call edi
xor eax, eax
call edi
mov eax, dword [ebp - 0xc]
imul ebx, dword [ebp - 0x1c], 0xa
add bl, byte [eax + 2]
shl ebx, 0xe
mov al, byte [eax + 5]
call edi
mov eax, dword [ebp - 0x10]
call fcn.0040f380
call fcn.0040f5b4
xor esi, esi
mov eax, 0x5830000
shrd eax, esi, 0x10
bt dword [ebx + 0x29c615f], esi
jae 0x410eb5
call fcn.0040f458
bt dword [ebx + 0x29c815f], esi
jae 0x410ec5
mov ah, 0x15
call fcn.0040f458
inc si
jne 0x410e9e
popal
call fcn.0040f6f0
call fcn.0040f680
mov eax, dword [ebp - 0x10]
call fcn.0040f46c
mov eax, dword [0x4b3d7c]
cmp byte [eax], 0
jne 0x411039
sub dword [0x4b3d80], 3
mov eax, dword [0x4b3dd0]
mov edx, dword [ebp - 0x14]
call fcn.00421858
jmp 0x411039
mov al, 0x86
call fcn.0040f31c
xor eax, eax
call fcn.0040f31c
mov eax, dword [ebp - 0x10]
call fcn.0040f380
call fcn.0040f5b4
call fcn.0040f6f0
mov eax, dword [ebp - 0x10]
call fcn.0040f46c
mov eax, dword [0x4b3d7c]
cmp byte [eax], 0
jne 0x411039
sub dword [0x4b3d80], 2
mov eax, dword [0x4b3dd0]
mov edx, dword [ebp - 0x14]
call fcn.00421858
jmp 0x411039
mov al, 0x86
call fcn.0040f31c
xor eax, eax
call fcn.0040f31c
mov eax, dword [ebp - 0x10]
call fcn.0040f380
call fcn.0040f5b4
pushal
mov esi, dword [ebp - 0x1c]
shl esi, 0x14
mov edi, esi
shl edi, 8
mov eax, dword [ebp - 0xc]
movzx ebx, byte [eax + 2]
mov ebp, fcn.0040f458
dec ebx
jne 0x410f98
cmp byte [esi + 0x5a1e23], bl
je 0x410f98
lea eax, [edi + 0x22c0083]
call ebp
cmp ebx, 4
jne 0x410fb3
cmp byte [esi + 0x5a1f23], bh
je 0x410fb3
lea eax, [edi + 0x22d0083]
call ebp
mov ax, 0x187
call ebp
sub ebx, 0xa
jne 0x410ffa
xor eax, eax
mov edx, esi
shr edx, 7
bt dword [edx + 0x298615f], eax
jae 0x410fda
shl eax, 0x10
mov ax, 0x623
call ebp
mov ax, 0x187
call ebp
shr eax, 0x10
inc ax
jne 0x410fba
cmp byte [esi + 0x5a2023], bh
je 0x410ffa
lea eax, [edi + 0x22e0083]
call ebp
mov ax, 0x187
call ebp
mov ax, 0x623
call ebp
dec ebx
jne 0x41101c
xor eax, eax
mov edx, esi
shr edx, 7
bt dword [edx + 0x29a615f], eax
jae 0x411018
push eax
shl eax, 0x10
mov ax, 0x623
call ebp
pop eax
inc ax
jne 0x410fff
popal
call fcn.0040f6f0
mov eax, dword [ebp - 0x10]
call fcn.0040f46c
jmp 0x411039
mov eax, dword [0x4b3dd0]
mov edx, dword [ebp - 0x14]
call fcn.00421858
inc dword [ebp - 0x14]
inc ebx
cmp dword [ebp - 0x14], 0x100
jne 0x41038b
pushal
imul esi, dword [ebp - 0x1c], 0x10
add esi, dword [ebp - 0x18]
shl esi, 0x10
xor ebx, ebx
xor edi, edi
bt dword [0x4bfed4], edi
jae 0x411074
push 0xa9
lea eax, [ebx + esi + 0x57f233]
push eax
call fcn.00403870
inc edi
inc bh
jne 0x411059
popal
inc dword [ebp - 0x18]
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x18], 0x10
jne 0x41013e
cmp dword [ebp - 0x3c], 0
jl 0x4110ba
push 0xa9
mov ebx, dword [ebp - 0x3c]
shl ebx, 5
mov eax, dword [0x4ad558]
lea eax, [eax + ebx*8 + 0x18b]
push eax
call fcn.00403870
mov eax, dword [0x4ad558]
mov byte [eax + ebx*8 + 0x174], 0
pushal
mov esi, dword [ebp - 0x1c]
shl esi, 0x14
add esi, 0x5a9235
mov edi, dword [0x4b3d80]
movzx ecx, byte [esi - 1]
jecxz 0x4110d7
push esi
rep movsb byte es:[edi], byte [esi]
pop esi
add esi, 0x53
lodsb al, byte [esi]
movzx ecx, al
dec al
js 0x4110ea
cmp byte [esi - 0x55], ch
je 0x4110ea
mov al, 0xd
stosb byte es:[edi], al
jecxz 0x4110ee
rep movsb byte es:[edi], byte [esi]
xor eax, eax
stosb byte es:[edi], al
mov dword [0x4b3d80], edi
popal
mov eax, dword [0x4b3d78]
mov edx, dword [ebp - 0x1c]
push dword [eax + edx*4 + 4]
mov eax, dword [0x4b3d80]
pop edx
sub eax, edx
sub eax, dword [0x4b3d78]
call fcn.0040f2e8
mov edx, dword [ebp - 0x44]
mov edx, dword [edx]
mov dword [edx], eax
mov eax, dword [0x4b3d78]
mov edx, dword [ebp - 0x1c]
mov eax, dword [eax + edx*4 + 4]
call fcn.0040f2e8
mov edx, dword [0x4b3d78]
mov ecx, dword [ebp - 0x1c]
mov dword [edx + ecx*4 + 4], eax
inc dword [ebp - 0x1c]
add dword [ebp - 0x48], 2
add dword [ebp - 0x44], 4
add esi, 0x11
cmp dword [ebp - 0x1c], 0x10
jne 0x40fde1
mov eax, dword [0x4b3d80]
mov edx, dword [0x4b3d78]
sub eax, edx
add eax, 7
and al, 0xfc
mov ecx, eax
bswap eax
mov dword [edx + 0x44], eax
bswap eax
shr eax, 9
mov dword [0x4bff00], eax
push ebx
xor eax, eax
shr ecx, 2
dec ecx
mov ebx, dword [edx + ecx*4]
bswap ebx
add eax, ebx
loop 0x41117e
neg eax
bswap eax
mov dword [edx], eax
pop ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret