Function at 0xcf8840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x11c
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x20]
movzx ebx, word [ebp + 0x1c]
add eax, 0x2b4
mov esi, dword [ebp + 0x20]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp + 0x20]
add edx, 0x6a6
add ecx, 0x74e
mov dword [ebp - 0x98], edx
mov edx, dword [ebp + 0x20]
mov dword [ebp - 0x94], ecx
mov ecx, dword [ebp + 0x20]
add esi, 0x72e
add eax, 0x76e
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 0x20]
add edx, 0x78e
add ecx, 0x80e
mov dword [ebp - 0x8c], edx
mov edx, dword [ebp + 0x20]
add eax, 0x88e
mov dword [ebp - 0xc0], eax
movsx eax, word [ebp + 8]
mov dword [ebp - 0xe4], ecx
mov ecx, dword [ebp + 0x18]
add edx, 0xa8e
mov dword [ebp - 0x88], edx
movzx eax, word [eax + eax + 0x12e0d20]
add ecx, 0x47e
mov dword [ebp - 0xb8], ecx
mov word [ebp - 0x68], ax
mov eax, dword [ebp + 0x14]
mov word [eax], 0x140
movsx eax, bx
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00cfebb0
test ax, ax
mov word [ebp - 0x6e], ax
jne 0xcfa99f
cmp bx, 3
je 0xcf9790
cmp bx, 1
nop
je 0xcf9790
cmp bx, 7
je 0xcf9be9
cmp bx, 2
je 0xcf9be9
mov eax, dword [ebp + 0x18]
mov word [ebp - 0x6c], 0
mov word [ebp - 0x6a], 0
sar word [eax + 0x47a], 1
mov ecx, dword [ebp + 0x18]
movzx eax, word [ecx + 0x5e6]
cmp ax, 1
je 0xcf97d7
cmp ax, 2
je 0xcfaa43
cmp word [ebp - 0x6e], 0
jne 0xcf97f4
lea edx, [ebp + 0xc]
mov dword [esp], edx
call fcn.00d03f30
cmp word [ebp - 0x6c], 0
jne 0xcf89c2
test ax, ax
jne 0xcfaa81
mov ecx, dword [ebp + 0x18]
movsx eax, word [ecx + 0x5ee]
add eax, 1
mov edx, eax
mov ecx, eax
sar edx, 0x1f
mov ebx, edx
sar ecx, 0xf
xor ebx, 0x7fff
cmp ecx, edx
mov edx, dword [ebp + 0x18]
cmovne eax, ebx
mov word [edx + 0x5ee], ax
mov dword [esp + 8], 0x1f0
mov edx, dword [ebp + 0x18]
mov dword [esp + 4], edx
mov ecx, dword [ebp - 0x9c]
mov dword [esp], ecx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x9c]
add eax, 0x1f0
cmp word [ebp - 0x68], 0x84
mov dword [ebp - 0x84], eax
jg 0xcf9af1
lea edx, [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], 8
call fcn.00d03ea0
lea ecx, [ebp + 0xc]
mov word [ebp - 0x24], ax
mov dword [esp + 4], ecx
mov dword [esp], 8
call fcn.00d03ea0
mov word [ebp - 0x22], ax
lea eax, [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0xe
call fcn.00d03ea0
lea edx, [ebp + 0xc]
mov word [ebp - 0x20], ax
and eax, 0x7f
sar word [ebp - 0x20], 7
mov word [ebp - 0x1e], ax
mov dword [esp + 4], edx
mov dword [esp], 6
call fcn.00d03ea0
movsx ecx, word [ebp - 0x6c]
mov dword [ebp - 0x60], ecx
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 0x18]
add eax, 0x210
mov dword [ebp - 0x5c], eax
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], ecx
mov eax, dword [ebp + 0x18]
add eax, 0x230
mov dword [esp + 0x10], eax
mov edx, dword [ebp - 0x5c]
mov dword [esp + 0xc], edx
mov eax, dword [ebp + 0x18]
add eax, 0x290
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0x94]
lea eax, [ebp - 0x24]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00d01a80
mov dword [esp + 8], 0x10
mov dword [esp + 4], esi
mov edx, dword [ebp - 0x94]
mov dword [esp], edx
call fcn.00d02e60
mov ecx, dword [ebp + 0x18]
cmp word [ecx + 0x47c], 0
lea ebx, [ecx + 0x1f0]
jne 0xcfab5a
mov eax, dword [ebp - 0x98]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], 0x12e0d34
mov dword [esp + 0xc], eax
call fcn.00d02f20
mov eax, dword [esi]
mov edx, dword [ebp + 0x18]
mov dword [edx + 0x1f0], eax
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov ecx, dword [ebp - 0x94]
mov esi, dword [ebp + 0x18]
movsx eax, word [ecx]
movsx edx, word [esi + 0x210]
mov esi, 0x7fffffff
mov edi, esi
sub eax, edx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
mov ecx, dword [ebp + 0x18]
cmovne eax, ebx
cwde
imul eax, eax
cmp eax, 0x40000000
lea edx, [eax + eax]
cmovne edi, edx
mov edx, dword [ebp - 0x94]
movsx eax, word [edx + 2]
movsx edx, word [ecx + 0x212]
sub eax, edx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
mov ebx, edx
sar ecx, 0xf
xor ebx, 0x7fff
cmp ecx, edx
cmovne eax, ebx
cwde
imul eax, eax
cmp eax, 0x40000000
lea edx, [eax + eax]
cmove edx, esi
lea esi, [edx + edi]
xor edx, edi
js 0xcf8bc9
mov eax, esi
xor eax, edi
js 0xcfad68
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp + 0x18]
movsx eax, word [edx + 4]
movsx edx, word [ecx + 0x214]
sub eax, edx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
cmovne eax, ebx
mov edx, 0x7fffffff
cwde
imul eax, eax
cmp eax, 0x40000000
lea ecx, [eax + eax]
cmovne edx, ecx
lea edi, [edx + esi]
xor edx, esi
js 0xcf8c1b
mov eax, edi
xor eax, esi
js 0xcfad58
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp + 0x18]
movsx eax, word [edx + 6]
movsx edx, word [ecx + 0x216]
sub eax, edx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
cmovne eax, ebx
mov edx, 0x7fffffff
cwde
imul eax, eax
cmp eax, 0x40000000
lea ecx, [eax + eax]
cmovne edx, ecx
lea esi, [edx + edi]
xor edx, edi
js 0xcf8c6d
mov eax, esi
xor eax, edi
js 0xcfada8
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp + 0x18]
movsx eax, word [edx + 8]
movsx edx, word [ecx + 0x218]
sub eax, edx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
cmovne eax, ebx
mov edx, 0x7fffffff
cwde
imul eax, eax
cmp eax, 0x40000000
lea ecx, [eax + eax]
cmovne edx, ecx
lea edi, [edx + esi]
xor edx, esi
js 0xcf8cbf
mov eax, edi
xor eax, esi
js 0xcfad98
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp + 0x18]
movsx eax, word [edx + 0xa]
movsx edx, word [ecx + 0x21a]
sub eax, edx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
cmovne eax, ebx
mov edx, 0x7fffffff
cwde
imul eax, eax
cmp eax, 0x40000000
lea ecx, [eax + eax]
cmovne edx, ecx
lea esi, [edx + edi]
xor edx, edi
js 0xcf8d11
mov eax, esi
xor eax, edi
js 0xcfad88
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp + 0x18]
movsx eax, word [edx + 0xc]
movsx edx, word [ecx + 0x21c]
sub eax, edx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
cmovne eax, ebx
mov edx, 0x7fffffff
cwde
imul eax, eax
cmp eax, 0x40000000
lea ecx, [eax + eax]
cmovne edx, ecx
lea edi, [edx + esi]
xor edx, esi
js 0xcf8d63
mov eax, edi
xor eax, esi
js 0xcfad78
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp + 0x18]
movsx eax, word [edx + 0xe]
movsx edx, word [ecx + 0x21e]
sub eax, edx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
cmovne eax, ebx
mov edx, 0x7fffffff
cwde
imul eax, eax
cmp eax, 0x40000000
lea ecx, [eax + eax]
cmovne edx, ecx
lea esi, [edx + edi]
xor edx, edi
js 0xcf8db5
mov eax, esi
xor eax, edi
js 0xcfae28
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp + 0x18]
movsx eax, word [edx + 0x10]
movsx edx, word [ecx + 0x220]
sub eax, edx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
cmovne eax, ebx
mov edx, 0x7fffffff
cwde
imul eax, eax
cmp eax, 0x40000000
lea ecx, [eax + eax]
cmovne edx, ecx
lea edi, [edx + esi]
xor edx, esi
js 0xcf8e07
mov eax, edi
xor eax, esi
js 0xcfae18
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp + 0x18]
movsx eax, word [edx + 0x12]
movsx edx, word [ecx + 0x222]
sub eax, edx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
cmovne eax, ebx
mov edx, 0x7fffffff
cwde
imul eax, eax
cmp eax, 0x40000000
lea ecx, [eax + eax]
cmovne edx, ecx
lea esi, [edx + edi]
xor edx, edi
js 0xcf8e59
mov eax, esi
xor eax, edi
js 0xcfae08
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp + 0x18]
movsx eax, word [edx + 0x14]
movsx edx, word [ecx + 0x224]
sub eax, edx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
cmovne eax, ebx
mov edx, 0x7fffffff
cwde
imul eax, eax
cmp eax, 0x40000000
lea ecx, [eax + eax]
cmovne edx, ecx
lea edi, [edx + esi]
xor edx, esi
js 0xcf8eab
mov eax, edi
xor eax, esi
js 0xcfadf8
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp + 0x18]
movsx eax, word [edx + 0x16]
movsx edx, word [ecx + 0x226]
sub eax, edx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
cmovne eax, ebx
mov edx, 0x7fffffff
cwde
imul eax, eax
cmp eax, 0x40000000
lea ecx, [eax + eax]
cmovne edx, ecx
lea esi, [edx + edi]
xor edx, edi
js 0xcf8efd
mov eax, esi
xor eax, edi
js 0xcfade8
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp + 0x18]
movsx eax, word [edx + 0x18]
movsx edx, word [ecx + 0x228]
sub eax, edx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
cmovne eax, ebx
mov edx, 0x7fffffff
cwde
imul eax, eax
cmp eax, 0x40000000
lea ecx, [eax + eax]
cmovne edx, ecx
lea edi, [edx + esi]
xor edx, esi
js 0xcf8f4f
mov eax, edi
xor eax, esi
js 0xcfadd8
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp + 0x18]
movsx eax, word [edx + 0x1a]
movsx edx, word [ecx + 0x22a]
sub eax, edx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
cmovne eax, ebx
mov edx, 0x7fffffff
cwde
imul eax, eax
cmp eax, 0x40000000
lea ecx, [eax + eax]
cmovne edx, ecx
lea esi, [edx + edi]
xor edx, edi
js 0xcf8fa1
mov eax, esi
xor eax, edi
js 0xcfadc8
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp + 0x18]
movsx eax, word [edx + 0x1c]
movsx edx, word [ecx + 0x22c]
sub eax, edx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
cmovne eax, ebx
mov edx, 0x7fffffff
cwde
imul eax, eax
lea ecx, [eax + eax]
cmp eax, 0x40000000
cmovne edx, ecx
lea ecx, [edx + esi]
xor edx, esi
js 0xcf8ff3
mov eax, ecx
xor eax, esi
js 0xcfadb8
mov edx, ecx
shl edx, 8
mov eax, edx
sar eax, 8
cmp ecx, eax
je 0xcf900c
mov edx, ecx
sar edx, 0x1f
xor edx, 0x7fffffff
sar edx, 0x10
imul eax, edx, 0x6666
mov ecx, eax
mov edx, eax
sar ecx, 0x1f
sar eax, 0x1e
mov ebx, ecx
xor ebx, 0x7fff
sar edx, 0xf
cmp eax, ecx
cmovne edx, ebx
mov ebx, 0x5000
sub bx, dx
movsx edx, bx
lea ecx, [edx + edx]
movsx eax, cx
sar eax, 1
cmp edx, eax
je 0xcf9051
mov ecx, ebx
sar cx, 0xf
xor cx, 0x7fff
xor edx, edx
test cx, cx
mov esi, dword [ebp - 0x90]
cmovns edx, ecx
mov ecx, dword [ebp - 0x5c]
movsx edx, dx
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ecx + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [ecx + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 0x1c]
mov dword [esi + 0x1c], eax
mov ecx, dword [ebp - 0x94]
mov esi, dword [ebp - 0x5c]
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ecx + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [ecx + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 0x1c]
mov dword [esi + 0x1c], eax
mov ecx, dword [ebp + 0x20]
mov eax, dword [ebp - 0x98]
cmp word [ebp - 0x68], 0x84
movsx esi, word [ebp - 0x68]
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x80], eax
movsx eax, word [ebp - 0x6a]
setg byte [ebp - 0x55]
add ecx, 0x42c
mov dword [ebp - 0xd0], esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xbc], ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0xe0], edx
mov edx, dword [ebp + 0x18]
add esi, 0x45c
add eax, 0x7e
add ecx, 0x41e
add edx, 0x45a
mov word [ebp - 0x70], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xe8], edx
mov dword [ebp - 0xec], ecx
movzx esi, word [ebp - 0x4c]
mov word [ebp - 0x76], si
add si, 0xff80
je 0xcf9c92
cmp word [ebp - 0x76], 0
je 0xcf9c9c
cmp word [ebp - 0x68], 0xb1
jg 0xcfa9d5
lea edx, [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], 5
call fcn.00d03ea0
mov esi, eax
sar ax, 1
add ax, word [ebp - 0x70]
mov ebx, eax
sub bx, word [ebp - 0x70]
mov word [ebp - 0xaa], ax
movsx edx, bx
lea eax, [edx + edx]
movsx ecx, ax
mov eax, ecx
sar eax, 1
cmp edx, eax
je 0xcf91c4
sar bx, 0xf
xor bx, 0x7fff
movsx ecx, bx
movsx eax, si
sub eax, ecx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
mov ecx, eax
cmovne ecx, ebx
movsx edx, cx
lea edi, [edx + edx]
movsx eax, di
sar eax, 1
cmp edx, eax
je 0xcf91fc
mov edi, ecx
sar di, 0xf
xor di, 0x7fff
movzx ecx, word [ebp - 0xaa]
mov word [ebp - 0xe], cx
cmp word [ebp - 0x6c], 0
movsx eax, di
jne 0xcf9d78
mov edx, dword [ebp - 0x48]
add edx, 0x4a4
mov dword [ebp - 0xa8], edx
mov dword [esp + 0xc], 0x41
mov dword [esp + 8], eax
movsx eax, word [ebp - 0xe]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00d03060
cmp word [ebp - 0x6a], 0
jne 0xcf9e78
cmp word [ebp - 0x68], 0xb1
jg 0xcf9bf4
xor ebx, ebx
lea esi, [esi]
mov ecx, dword [ebp - 0x4c]
mov esi, dword [ebp + 0x20]
add ecx, ebx
movsx eax, word [esi + ecx*2 + 0x4a2]
movsx edx, word [esi + ecx*2 + 0x4a6]
add edx, eax
movsx eax, word [esi + ecx*2 + 0x4a4]
imul edx, edx, 0x170a
imul eax, eax, 0x51ec
add edx, eax
lea eax, [edx + edx]
mov edx, 0x7fff
cmp eax, 0x7fffffff
je 0xcf92a9
add eax, 0x8000
mov edx, eax
shr edx, 0x10
mov eax, dword [ebp + 0x20]
mov word [eax + ebx*2 + 0x78e], dx
add ebx, 1
cmp ebx, 0x40
jne 0xcf9260
mov dword [esp + 8], pe_nt_image_headers32
mov edx, dword [ebp - 0x8c]
mov dword [esp + 4], edx
mov ecx, dword [ebp - 0xa8]
mov dword [esp], ecx
call sub.msvcrt.dll_memcpy
cmp word [ebp - 0x68], 0x84
jle 0xcfa801
cmp word [ebp - 0x68], 0xb1
jle 0xcfa927
cmp word [ebp - 0x68], 0xfd
jle 0xcf9c14
cmp word [ebp - 0x68], 0x11d
jle 0xcfab9a
cmp word [ebp - 0x68], 0x13d
jle 0xcfac12
cmp word [ebp - 0x68], 0x16d
nop
jle 0xcfaa92
cmp word [ebp - 0x68], 0x18d
lea esi, [esi]
jg 0xcfac90
lea eax, [ebp + 0xc]
mov dword [esp + 4], eax
lea esi, [ebp + 0xc]
mov dword [esp], 0xa
call fcn.00d03ea0
lea edx, [ebp + 0xc]
mov word [ebp - 0x24], ax
mov dword [esp + 4], edx
mov dword [esp], 0xa
call fcn.00d03ea0
lea ecx, [ebp + 0xc]
mov word [ebp - 0x22], ax
mov dword [esp + 4], ecx
mov dword [esp], 2
call fcn.00d03ea0
mov word [ebp - 0x20], ax
mov dword [esp + 4], esi
mov dword [esp], 2
call fcn.00d03ea0
mov word [ebp - 0x1e], ax
mov dword [esp + 4], esi
mov dword [esp], 0xa
call fcn.00d03ea0
mov word [ebp - 0x1c], ax
mov dword [esp + 4], esi
mov dword [esp], 0xa
call fcn.00d03ea0
mov word [ebp - 0x1a], ax
mov dword [esp + 4], esi
mov dword [esp], 0xe
call fcn.00d03ea0
mov word [ebp - 0x18], ax
mov dword [esp + 4], esi
mov dword [esp], 0xe
call fcn.00d03ea0
lea edx, [ebp - 0x24]
mov word [ebp - 0x16], ax
mov eax, dword [ebp - 0x8c]
mov dword [esp + 4], 0x48
mov dword [esp], edx
mov dword [esp + 8], eax
call fcn.00d04070
mov dword [esp + 8], 0x40
mov edx, dword [ebp + 0x18]
movsx eax, word [edx + 0x2b0]
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x8c]
mov dword [esp], ecx
call fcn.00d04870
xor eax, eax
cmp di, 3
setge al
add ax, word [ebp - 0xe]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x6ccd
cwde
mov dword [esp + 4], eax
mov esi, dword [ebp - 0x8c]
mov dword [esp], esi
call fcn.00d04910
cmp word [ebp - 0x68], 0xb1
jg 0xcfa5ea
lea eax, [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 6
call fcn.00d03ea0
mov edx, dword [ebp - 0xbc]
mov dword [esp + 0x2c], edx
mov ecx, dword [ebp + 0x18]
cwde
movsx edx, word [ecx + 0x5ee]
mov dword [esp + 0x28], edx
mov esi, dword [ebp - 0xd4]
mov dword [esp + 0x24], esi
movsx edx, word [ecx + 0x47a]
lea esi, [ebp - 0x10]
mov dword [esp + 0x20], edx
movsx edx, word [ecx + 0x478]
lea ecx, [ebp - 0x14]
mov dword [esp + 0x1c], edx
mov edx, dword [ebp - 0x60]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x40
mov dword [esp + 0x18], edx
mov edx, dword [ebp - 0x8c]
mov dword [esp + 4], 6
mov dword [esp], eax
mov dword [esp + 8], edx
call fcn.00cfbad0
mov ecx, dword [ebp + 0x18]
movzx edx, word [ecx + 0x2b8]
movzx eax, word [ecx + 0x2b4]
cmp word [ecx + 0x2b6], ax
cmovle ax, word [ecx + 0x2b6]
cmp ax, dx
cmovg eax, edx
mov edx, dword [ebp - 0x14]
cmp word [ecx + 0x2ba], ax
cmovle ax, word [ecx + 0x2ba]
mov ecx, 8
cmp ax, 8
cmovle ecx, eax
cmp edx, 0x7ffffff
jle 0xcfa5bb
mov word [ebp - 0x78], 0
xor eax, eax
cmp edx, 0x7fffffff
mov dword [ebp - 0x54], 0x7fff
je 0xcf9555
add edx, 0x8000
sar edx, 0x10
mov dword [ebp - 0x54], edx
mov esi, dword [ebp + 0x18]
sub ax, word [esi + 0x2b2]
mov dword [esp + 4], 0x138
cwde
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x48]
add eax, 0x2b4
mov dword [esp], eax
call fcn.00d05c10
movzx eax, word [ebp - 0x78]
cmp word [ebp - 0x6c], 0
mov word [esi + 0x2b2], ax
jne 0xcf95e1
movzx eax, word [esi + 0x428]
mov word [esi + 0x42a], ax
movzx eax, word [esi + 0x426]
mov word [esi + 0x428], ax
movzx eax, word [esi + 0x424]
mov word [esi + 0x426], ax
movzx eax, word [esi + 0x422]
mov word [esi + 0x424], ax
movzx eax, word [ebp - 0xe]
mov word [esi + 0x420], 0
mov word [esi + 0x422], ax
mov word [esi + 0x41e], ax
mov ecx, dword [ebp - 0x48]
xor ebx, ebx
movsx edx, word [ecx + 0x522]
xor eax, eax
cmp dx, 0x7fff
setne al
sub ecx, 2
lea eax, [edx + eax*4]
mov edx, dword [ebp + 0x20]
sar eax, 3
mov word [ebx + edx + 0x90c], ax
sub ebx, 2
cmp ebx, 0xffffff80
jne 0xcf95e6
cmp word [ebp - 0x68], 0xb1
jle 0xcfa672
movsx ecx, word [ebp - 0x10]
mov word [ebp - 0x66], 0
mov dword [ebp - 0xcc], ecx
mov dword [esp + 0x14], 0x40
mov ecx, dword [ebp - 0x54]
xor edi, edi
mov dword [esp + 0x10], ecx
mov esi, dword [ebp - 0x8c]
mov dword [esp + 0xc], esi
mov eax, dword [ebp - 0xcc]
mov dword [esp + 4], 0xfffffffd
mov dword [esp + 8], eax
mov edx, dword [ebp - 0xc0]
mov dword [esp], edx
call fcn.00d049b0
mov ecx, dword [ebp + 0x18]
mov word [ebp - 0x7a], ax
sar ax, 2
add ax, 0x2000
mov word [ecx + 0x2b0], ax
mov dword [esp + 8], pe_nt_image_headers32
mov esi, dword [ebp - 0xa8]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0xc0]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
movsx edx, word [ebp - 0x10]
mov esi, dword [ebp - 0x48]
mov dword [ebp - 0x74], 1
mov dword [ebp - 0xcc], edx
jmp 0xcf9716
lea edx, [ecx + ecx]
mov eax, edx
sar eax, 1
cmp ecx, eax
je 0xcf96cc
mov edx, ecx
sar edx, 0x1f
xor edx, 0x7fffffff
cmp edx, 0x7fffffff
mov ecx, 0x7fff
mov eax, 0x7fff
je 0xcf96fd
lea eax, [edx + 0x8000]
mov ecx, eax
shr ecx, 0x10
mov eax, ecx
mov edx, ecx
shr ax, 0xf
sub dx, ax
mov eax, edx
sar ax, 0xf
xor eax, edx
cwde
add edi, 1
mov word [esi + 0x4a4], cx
add esi, 2
or dword [ebp - 0x74], eax
cmp edi, 0x40
je 0xcf9ec4
mov ecx, dword [ebp + 0x20]
mov ebx, 0x7fffffff
movsx eax, word [ecx + edi*2 + 0x78e]
imul eax, dword [ebp - 0x54]
cmp eax, 0x40000000
je 0xcf974d
mov ebx, eax
shl ebx, 6
lea edx, [eax + eax]
mov eax, ebx
sar eax, 5
cmp edx, eax
je 0xcf974d
mov ebx, edx
sar ebx, 0x1f
xor ebx, 0x7fffffff
movsx eax, word [esi + 0x4a4]
mov edx, 0x7fffffff
imul eax, dword [ebp - 0xcc]
lea ecx, [eax + eax]
cmp eax, 0x40000000
cmovne edx, ecx
lea ecx, [edx + ebx]
xor edx, ebx
js 0xcf96b6
mov eax, ecx
xor eax, ebx
jns 0xcf96b6
mov ecx, ebx
sar ecx, 0x1f
xor ecx, 0x7fffffff
jmp 0xcf96b6
mov word [ebp - 0x6a], 0
mov edx, dword [ebp + 0x18]
mov word [ebp - 0x6c], 1
movzx eax, word [edx + 0x47a]
add eax, 1
cmp ax, 6
mov word [edx + 0x47a], ax
jle 0xcf8950
mov ecx, dword [ebp + 0x18]
mov word [edx + 0x47a], 6
movzx eax, word [ecx + 0x5e6]
cmp ax, 1
jne 0xcf8964
cmp word [ebp - 0x6e], 0
mov word [ecx + 0x47a], 5
mov word [ecx + 0x478], 0
je 0xcf8979
mov dword [esp + 4], esi
mov dword [esp + 8], 0x10
mov eax, dword [ebp - 0x94]
mov dword [esp], eax
call fcn.00d02e60
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0x10
mov edx, dword [ebp - 0x98]
mov dword [esp], esi
mov dword [esp + 4], edx
call fcn.00d01000
mov ecx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x18]
mov edx, dword [ebp - 0x90]
add ecx, 0x210
mov dword [ebp - 0xb4], ecx
mov eax, dword [esi + 0x210]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0x10]
mov dword [edx + 0x10], eax
mov eax, dword [ecx + 0x14]
mov dword [edx + 0x14], eax
mov eax, dword [ecx + 0x18]
mov dword [edx + 0x18], eax
mov eax, dword [ecx + 0x1c]
mov dword [edx + 0x1c], eax
movsx eax, word [ebp - 0x6c]
mov ecx, dword [ebp - 0xc0]
movsx esi, word [ebp - 0x6e]
movsx edx, word [ebp - 0x68]
mov word [ebp - 0x32], 0
mov dword [ebp - 0xd8], eax
movzx eax, word [ebp - 0x32]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], 0
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xd0], edx
sar ax, 6
mov edx, 0x7fff
cwde
movsx eax, word [eax + eax + 0x12e0d34]
sub edx, eax
mov dword [ebp - 0x38], eax
mov ecx, edx
mov eax, edx
sar ecx, 0x1f
sar eax, 0xf
cmp ecx, eax
jne 0xcf9962
xor esi, esi
movsx edi, dx
jmp 0xcf990f
cmp eax, 0x7fffffff
mov edx, 0x7fff
je 0xcf98f8
add eax, 0x8000
mov edx, eax
shr edx, 0x10
mov eax, dword [ebp + 0x20]
mov word [eax + esi*2 + 0xa8e], dx
add esi, 1
cmp esi, 0x10
je 0xcf99e7
mov ecx, dword [ebp + 0x20]
movsx eax, word [ecx + esi*2 + 0x76e]
mov ecx, 0x7fffffff
mov ebx, ecx
imul eax, edi
cmp eax, 0x40000000
lea edx, [eax + eax]
cmovne ebx, edx
mov edx, dword [ebp + 0x20]
movsx eax, word [edx + esi*2 + 0x74e]
imul eax, dword [ebp - 0x38]
cmp eax, 0x40000000
lea edx, [eax + eax]
cmove edx, ecx
lea eax, [edx + ebx]
xor edx, ebx
js 0xcf98e2
mov ecx, eax
xor ecx, ebx
jns 0xcf98e2
mov eax, ebx
sar eax, 0x1f
xor eax, 0x7fffffff
jmp 0xcf98e2
xor ecx, 0x7fff
xor esi, esi
movsx edi, cx
mov edx, dword [ebp + 0x20]
mov ecx, 0x7fffffff
mov ebx, ecx
movsx eax, word [edx + esi*2 + 0x76e]
imul eax, edi
cmp eax, 0x40000000
lea edx, [eax + eax]
cmovne ebx, edx
mov edx, dword [ebp + 0x20]
movsx eax, word [edx + esi*2 + 0x74e]
imul eax, dword [ebp - 0x38]
cmp eax, 0x40000000
lea edx, [eax + eax]
cmove edx, ecx
lea eax, [edx + ebx]
xor edx, ebx
js 0xcf99be
mov ecx, eax
xor ecx, ebx
jns 0xcf99be
mov eax, ebx
sar eax, 0x1f
xor eax, 0x7fffffff
cmp eax, 0x7fffffff
mov edx, 0x7fff
je 0xcf99d4
add eax, 0x8000
mov edx, eax
shr edx, 0x10
mov eax, dword [ebp + 0x20]
mov word [eax + esi*2 + 0xa8e], dx
add esi, 1
cmp esi, 0x10
jne 0xcf996d
mov edx, dword [ebp + 0x20]
mov dword [esp + 0x28], edx
mov ecx, dword [ebp - 0xd8]
mov dword [esp + 0x24], ecx
mov esi, dword [ebp + 0x18]
mov dword [esp + 0x20], esi
mov eax, dword [ebp - 0xdc]
mov dword [esp + 0x1c], eax
mov edx, dword [ebp - 0xd0]
mov dword [esp + 0x18], edx
mov ecx, dword [ebp - 0x88]
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], ecx
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x44]
mov esi, dword [ebp + 0x10]
add eax, 3
test ebx, ebx
cmovns eax, dword [ebp - 0x44]
mov dword [esp + 8], 0
sar eax, 2
lea eax, [esi + eax*2]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 4], eax
mov edx, dword [ebp - 0x98]
mov dword [esp], edx
call fcn.00d05220
movzx eax, word [ebp - 0x32]
add dword [ebp - 0x44], 0x140
sub dword [ebp - 0x40], 0xffffff80
add eax, 0x40
cmp ax, 0x100
mov word [ebp - 0x32], ax
jne 0xcf98b2
mov dword [esp + 4], 0
mov ecx, dword [ebp + 0x18]
mov dword [esp], ecx
call fcn.00cf84a0
mov esi, dword [ebp - 0x94]
mov edx, dword [ebp - 0xb4]
mov eax, dword [esi]
mov dword [edx], eax
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edx + 0x1c], eax
movzx esi, word [ebp - 0x6c]
mov ecx, dword [ebp + 0x18]
movzx eax, word [ebp - 0x6e]
mov word [ecx + 0x478], si
mov word [ecx + 0x5e6], ax
add esp, 0x11c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
lea edx, [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], 8
call fcn.00d03ea0
lea ecx, [ebp + 0xc]
mov word [ebp - 0x24], ax
mov dword [esp + 4], ecx
mov dword [esp], 8
call fcn.00d03ea0
mov word [ebp - 0x22], ax
lea eax, [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 6
call fcn.00d03ea0
lea edx, [ebp + 0xc]
mov word [ebp - 0x20], ax
mov dword [esp + 4], edx
mov dword [esp], 7
call fcn.00d03ea0
lea ecx, [ebp + 0xc]
mov word [ebp - 0x1e], ax
mov dword [esp + 4], ecx
mov dword [esp], 7
call fcn.00d03ea0
mov word [ebp - 0x1c], ax
lea eax, [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 5
call fcn.00d03ea0
lea edx, [ebp + 0xc]
mov word [ebp - 0x1a], ax
mov dword [esp + 4], edx
mov dword [esp], 5
call fcn.00d03ea0
movsx ecx, word [ebp - 0x6c]
mov dword [ebp - 0x60], ecx
mov word [ebp - 0x18], ax
mov eax, dword [ebp + 0x18]
add eax, 0x210
mov dword [ebp - 0x5c], eax
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], ecx
mov eax, dword [ebp + 0x18]
add eax, 0x230
mov dword [esp + 0x10], eax
mov edx, dword [ebp - 0x5c]
mov dword [esp + 0xc], edx
mov eax, dword [ebp + 0x18]
add eax, 0x290
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0x94]
lea eax, [ebp - 0x24]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00d02440
jmp 0xcf8ab6
mov word [ebp - 0x6a], 1
jmp 0xcf9796
lea ecx, [ebp + 0xc]
mov dword [esp], ecx
call fcn.00d03f30
test ax, ax
je 0xcf9257
cmp word [ebp - 0x68], 0xfd
jg 0xcf9300
lea eax, [ebp + 0xc]
mov dword [esp + 4], eax
lea esi, [ebp + 0xc]
mov dword [esp], 9
call fcn.00d03ea0
lea edx, [ebp + 0xc]
mov word [ebp - 0x24], ax
mov dword [esp + 4], edx
mov dword [esp], 9
call fcn.00d03ea0
lea ecx, [ebp + 0xc]
mov word [ebp - 0x22], ax
mov dword [esp + 4], ecx
mov dword [esp], 9
call fcn.00d03ea0
mov word [ebp - 0x20], ax
mov dword [esp + 4], esi
mov dword [esp], 9
call fcn.00d03ea0
lea edx, [ebp - 0x24]
mov word [ebp - 0x1e], ax
mov eax, dword [ebp - 0x8c]
mov dword [esp + 4], 0x24
mov dword [esp], edx
mov dword [esp + 8], eax
call fcn.00d04070
jmp 0xcf93ff
cmp byte [ebp - 0x55], 0
je 0xcf9172
cmp word [ebp - 0x68], 0xb1
jg 0xcf9dc2
lea eax, [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 8
call fcn.00d03ea0
cmp ax, 0x73
mov esi, eax
jg 0xcfa8d1
sar ax, 1
add eax, 0x22
mov word [ebp - 0xae], ax
cwde
sub eax, 0x22
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
mov ecx, eax
cmovne ecx, ebx
movsx edx, cx
lea eax, [edx + edx]
movsx ebx, ax
mov eax, ebx
sar eax, 1
cmp edx, eax
je 0xcf9d0e
sar cx, 0xf
xor cx, 0x7fff
movsx ebx, cx
movsx eax, si
sub eax, ebx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
mov ecx, eax
cmovne ecx, ebx
movsx edx, cx
lea edi, [edx + edx]
movsx eax, di
sar eax, 1
cmp edx, eax
je 0xcf9d46
mov edi, ecx
sar di, 0xf
xor di, 0x7fff
movzx edx, word [ebp - 0xae]
mov word [ebp - 0xe], dx
mov eax, edx
sub eax, 8
cmp ax, 0x21
mov word [ebp - 0x70], ax
jg 0xcf9e60
cmp word [ebp - 0x6c], 0
movsx eax, di
mov word [ebp - 0x70], 0x22
je 0xcf9215
mov ecx, dword [ebp - 0xd4]
xor edi, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebp - 0xe8]
mov dword [esp + 0x10], esi
mov eax, dword [ebp - 0xec]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xe]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x18]
add eax, 0x422
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x18]
add eax, 0x44e
mov dword [esp], eax
call fcn.00cfdfe0
xor eax, eax
jmp 0xcf9215
lea ecx, [ebp + 0xc]
mov dword [esp + 4], ecx
mov dword [esp], 9
call fcn.00d03ea0
cmp ax, 0x177
mov esi, eax
jg 0xcfa830
sar ax, 2
lea edi, [eax + 0x22]
movsx eax, di
sub eax, 0x22
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
mov ecx, eax
cmovne ecx, ebx
movsx edx, cx
lea eax, [edx*4]
movsx ebx, ax
mov eax, ebx
sar eax, 2
cmp edx, eax
je 0xcf9e29
sar cx, 0xf
xor cx, 0x7fff
movsx ebx, cx
movsx eax, si
sub eax, ebx
mov edx, eax
mov ecx, eax
mov word [ebp - 0xe], di
mov edi, eax
movzx eax, word [ebp - 0xe]
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
cmovne edi, ebx
sub eax, 8
cmp ax, 0x21
mov word [ebp - 0x70], ax
jle 0xcf9d64
add eax, 0xf
cmp ax, 0xe7
jle 0xcf9207
mov word [ebp - 0x70], 0xd8
jmp 0xcf9207
mov esi, dword [ebp + 0x18]
mov ebx, 1
add esi, 0x41a
mov dword [esp], esi
call fcn.00d03f50
mov edx, dword [ebp + 0x20]
sar ax, 3
mov word [edx + 0x78e], ax
lea esi, [esi]
mov dword [esp], esi
call fcn.00d03f50
mov ecx, dword [ebp + 0x20]
sar ax, 3
mov word [ecx + ebx*2 + 0x78e], ax
add ebx, 1
cmp ebx, 0x40
jne 0xcf9ea0
jmp 0xcf93ff
movsx edx, word [ebp - 0x78]
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0xa4], edx
mov dword [esp], ecx
call fcn.00d04bc0
mov esi, dword [ebp + 0x18]
sub eax, 0x10
cwde
add eax, dword [ebp - 0xa4]
mov edx, eax
mov ecx, eax
sar edx, 0x1f
mov ebx, edx
sar ecx, 0xf
xor ebx, 0x7fff
cmp ecx, edx
movzx edx, word [esi + 0x2b8]
cmovne eax, ebx
sub eax, 1
mov word [esi + 0x2ba], dx
movzx edx, word [esi + 0x2b6]
mov word [esi + 0x2b8], dx
movzx edx, word [esi + 0x2b4]
mov word [esi + 0x2b4], ax
xor eax, eax
cmp word [ebp - 0x68], 0x84
mov word [esi + 0x2b6], dx
jle 0xcf9f49
xor eax, eax
cmp word [ebp - 0x68], 0xb1
setg al
add eax, 1
mov edx, dword [ebp + 0x20]
mov dword [esp + 0x14], edx
mov ecx, dword [ebp - 0xc4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov esi, dword [ebp - 0x8c]
mov dword [esp + 8], esi
movsx eax, word [ebp - 0x10]
mov dword [esp + 4], eax
movsx eax, word [ebp - 0x12]
mov dword [esp], eax
call fcn.00d04cc0
movzx edx, word [ebp - 0x7a]
mov eax, 0x4000
sar dx, 1
sub ax, dx
cwde
imul eax, dword [ebp - 0xe0]
mov ecx, eax
mov edx, eax
sar ecx, 0x1f
sar eax, 0x1e
mov ebx, ecx
xor ebx, 0x7fff
sar edx, 0xf
cmp eax, ecx
mov eax, dword [ebp + 0x18]
cmovne edx, ebx
mov ebx, dword [ebp - 0x14]
movsx edx, dx
mov dword [ebp - 0x64], edx
mov eax, dword [eax + 0x2bc]
cmp ebx, eax
mov dword [ebp - 0xa0], eax
jge 0xcfa589
mov edi, ebx
mov eax, 0x18520000
sar edi, 0x1f
mov esi, ebx
imul ecx, edi, 0x18520000
mul ebx
lea edx, [ecx + edx]
mov eax, edx
add eax, eax
add eax, ebx
cmp eax, dword [ebp - 0xa0]
cmovg eax, dword [ebp - 0xa0]
mov dword [ebp - 0x3c], eax
mov ecx, eax
mov edx, dword [ebp + 0x18]
mov eax, 0x7fff
sub eax, dword [ebp - 0x64]
shl dword [ebp - 0x64], 0x10
shl eax, 0x10
mov dword [edx + 0x2bc], ecx
mov edx, eax
mov ecx, edi
sar edx, 0x1f
mov ebx, edx
imul ecx, eax
imul ebx, esi
mul esi
add ecx, ebx
lea edx, [ecx + edx]
mov eax, edx
lea ecx, [eax + eax]
mov eax, dword [ebp - 0x3c]
imul dword [ebp - 0x64]
lea eax, [edx + edx]
lea ebx, [eax + ecx]
xor eax, ecx
js 0xcfa049
mov edx, ebx
xor edx, ecx
js 0xcfa8f7
cmp word [ebp - 0x78], 0
mov dword [ebp - 0x14], ebx
jle 0xcfa7bb
movzx ecx, byte [ebp - 0xa4]
mov edx, ebx
shl edx, cl
mov eax, edx
sar eax, cl
cmp ebx, eax
je 0xcfa075
mov edx, ebx
sar edx, 0x1f
xor edx, 0x7fffffff
cmp edx, 0x7fffffff
mov dword [ebp - 0x50], 0x7fff
je 0xcfa090
add edx, 0x8000
sar edx, 0x10
mov dword [ebp - 0x50], edx
sar word [ebp - 0x7a], 3
mov edx, 0x7fffffff
movzx eax, word [ebp - 0x7a]
mov esi, dword [ebp - 0x8c]
add ax, 0x1000
movsx edi, ax
movsx eax, word [esi + 2]
movsx ebx, word [esi]
imul eax, edi
shl ebx, 0x10
lea ecx, [eax + eax]
cmp eax, 0x40000000
cmovne edx, ecx
mov ecx, ebx
sub ecx, edx
xor edx, ebx
js 0xcfa7e7
cmp ecx, 0x7fffffff
mov eax, 0x7fff
je 0xcfa0e5
lea eax, [ecx + 0x8000]
sar eax, 0x10
imul eax, dword [ebp - 0x50]
mov ebx, 0x7fffffff
cmp eax, 0x40000000
je 0xcfa111
mov ebx, eax
shl ebx, 6
lea edx, [eax + eax]
mov eax, ebx
sar eax, 5
cmp edx, eax
je 0xcfa111
mov ebx, edx
sar ebx, 0x1f
xor ebx, 0x7fffffff
mov edx, dword [ebp - 0xc0]
movsx ecx, word [ebp - 0x10]
movsx eax, word [edx]
mov edx, 0x7fffffff
mov dword [ebp - 0xcc], ecx
imul eax, ecx
lea ecx, [eax + eax]
cmp eax, 0x40000000
cmovne edx, ecx
lea ecx, [edx + ebx]
xor edx, ebx
js 0xcfa148
mov esi, ecx
xor esi, ebx
js 0xcfa917
lea edx, [ecx + ecx]
mov eax, edx
sar eax, 1
cmp ecx, eax
je 0xcfa15e
mov edx, ecx
sar edx, 0x1f
xor edx, 0x7fffffff
cmp edx, 0x7fffffff
mov eax, 0x7fff
je 0xcfa174
lea eax, [edx + 0x8000]
shr eax, 0x10
mov edx, dword [ebp - 0xc0]
xor esi, esi
mov word [edx], ax
jmp 0xcfa242
cmp ecx, 0x7fffffff
mov eax, 0x7fff
je 0xcfa19a
lea eax, [ecx + 0x8000]
sar eax, 0x10
imul eax, dword [ebp - 0x50]
mov ebx, 0x7fffffff
cmp eax, 0x40000000
je 0xcfa1c6
mov ebx, eax
shl ebx, 6
lea edx, [eax + eax]
mov eax, ebx
sar eax, 5
cmp edx, eax
je 0xcfa1c6
mov ebx, edx
sar ebx, 0x1f
xor ebx, 0x7fffffff
mov edx, dword [ebp + 0x20]
movsx eax, word [edx + esi*2 + 0x890]
mov edx, 0x7fffffff
imul eax, dword [ebp - 0xcc]
lea ecx, [eax + eax]
cmp eax, 0x40000000
cmovne edx, ecx
lea ecx, [edx + ebx]
xor edx, ebx
js 0xcfa1f9
mov eax, ecx
xor eax, ebx
js 0xcfa2a0
lea edx, [ecx + ecx]
mov eax, edx
sar eax, 1
cmp ecx, eax
je 0xcfa20f
mov edx, ecx
sar edx, 0x1f
xor edx, 0x7fffffff
cmp edx, 0x7fffffff
mov eax, 0x7fff
je 0xcfa225
lea eax, [edx + 0x8000]
shr eax, 0x10
mov edx, dword [ebp + 0x20]
mov word [edx + esi*2 + 0x890], ax
add esi, 1
cmp esi, 0x3e
je 0xcfa2b0
movsx ecx, word [ebp - 0x10]
mov dword [ebp - 0xcc], ecx
mov eax, dword [ebp + 0x20]
mov edx, eax
movsx ebx, word [eax + esi*2 + 0x790]
movzx eax, word [eax + esi*2 + 0x792]
add ax, word [edx + esi*2 + 0x78e]
mov edx, 0x7fffffff
shl ebx, 0x10
cwde
imul eax, edi
cmp eax, 0x40000000
lea ecx, [eax + eax]
cmovne edx, ecx
mov ecx, ebx
sub ecx, edx
xor edx, ebx
jns 0xcfa184
mov eax, ecx
xor eax, ebx
jns 0xcfa184
mov ecx, ebx
sar ecx, 0x1f
xor ecx, 0x7fffffff
jmp 0xcfa184
mov ecx, ebx
sar ecx, 0x1f
xor ecx, 0x7fffffff
jmp 0xcfa1f9
mov ecx, dword [ebp - 0x8c]
mov edx, 0x7fffffff
movsx eax, word [ecx + 0x7c]
movsx ebx, word [ecx + 0x7e]
imul eax, edi
shl ebx, 0x10
lea ecx, [eax + eax]
cmp eax, 0x40000000
cmovne edx, ecx
mov ecx, ebx
sub ecx, edx
xor edx, ebx
js 0xcfa7cd
cmp ecx, 0x7fffffff
mov eax, 0x7fff
je 0xcfa2f6
lea eax, [ecx + 0x8000]
sar eax, 0x10
imul eax, dword [ebp - 0x50]
mov ebx, 0x7fffffff
cmp eax, 0x40000000
je 0xcfa322
mov ebx, eax
shl ebx, 6
lea edx, [eax + eax]
mov eax, ebx
sar eax, 5
cmp edx, eax
je 0xcfa322
mov ebx, edx
sar ebx, 0x1f
xor ebx, 0x7fffffff
mov eax, dword [ebp - 0xc0]
movsx edx, word [eax + 0x7e]
movsx eax, word [ebp - 0x10]
imul edx, eax
mov eax, 0x7fffffff
cmp edx, 0x40000000
lea ecx, [edx + edx]
cmovne eax, ecx
lea edx, [eax + ebx]
xor eax, ebx
js 0xcfa355
mov ecx, edx
xor ecx, ebx
js 0xcfa907
lea ecx, [edx + edx]
mov eax, ecx
sar eax, 1
cmp edx, eax
je 0xcfa36b
mov ecx, edx
sar ecx, 0x1f
xor ecx, 0x7fffffff
cmp ecx, 0x7fffffff
mov eax, 0x7fff
je 0xcfa381
lea eax, [ecx + 0x8000]
shr eax, 0x10
mov esi, dword [ebp - 0xc8]
cmp word [ebp - 0x68], 0xb1
mov word [esi], ax
jg 0xcfa419
cmp word [ebp - 0x66], 0x4000
jle 0xcfa419
xor esi, esi
mov edx, dword [ebp + 0x20]
movsx eax, word [edx + esi*2 + 0x80e]
movsx edx, word [edx + esi*2 + 0x88e]
add eax, edx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
mov ecx, dword [ebp + 0x20]
cmovne eax, ebx
mov word [ecx + esi*2 + 0x80e], ax
add esi, 1
cmp esi, 0x40
jne 0xcfa3a0
mov dword [esp + 8], 0x40
mov esi, dword [ebp - 0xe4]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0xc0]
mov dword [esp], eax
call fcn.00d04fd0
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], esi
mov edx, dword [ebp - 0xc0]
mov dword [esp], edx
call sub.msvcrt.dll_memcpy
cmp word [ebp - 0x68], 0x84
jg 0xcfa4dc
movzx eax, word [ebp - 0x76]
mov edx, 0x7fff
sar ax, 6
cwde
movsx eax, word [eax + eax + 0x12e0d34]
sub edx, eax
mov dword [ebp - 0x30], eax
mov ecx, edx
mov eax, edx
sar ecx, 0x1f
sar eax, 0xf
cmp ecx, eax
jne 0xcfae38
xor esi, esi
movsx edi, dx
jmp 0xcfa489
cmp eax, 0x7fffffff
mov edx, 0x7fff
je 0xcfa476
add eax, 0x8000
mov edx, eax
shr edx, 0x10
mov eax, dword [ebp + 0x20]
mov word [eax + esi*2 + 0xa8e], dx
add esi, 1
cmp esi, 0x10
je 0xcfa4ff
mov ecx, dword [ebp + 0x20]
movsx eax, word [ecx + esi*2 + 0x76e]
mov ecx, 0x7fffffff
mov ebx, ecx
imul eax, edi
cmp eax, 0x40000000
lea edx, [eax + eax]
cmovne ebx, edx
mov edx, dword [ebp + 0x20]
movsx eax, word [edx + esi*2 + 0x74e]
imul eax, dword [ebp - 0x30]
cmp eax, 0x40000000
lea edx, [eax + eax]
cmove edx, ecx
lea eax, [edx + ebx]
xor edx, ebx
js 0xcfa460
mov ecx, eax
xor ecx, ebx
jns 0xcfa460
mov eax, ebx
sar eax, 0x1f
xor eax, 0x7fffffff
jmp 0xcfa460
mov edx, dword [ebp + 0x18]
mov dword [edx + 0x33e], 0
mov dword [edx + 0x342], 0
cmp word [ebp - 0x68], 0x1dc
jg 0xcfaa68
xor eax, eax
mov esi, dword [ebp + 0x20]
mov dword [esp + 0x28], esi
mov edx, dword [ebp - 0x60]
mov dword [esp + 0x24], edx
mov ecx, dword [ebp + 0x18]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov esi, dword [ebp - 0xd0]
mov dword [esp + 0x18], esi
mov edx, dword [ebp - 0x88]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov ecx, dword [ebp + 0x10]
sar word [ebp - 0x76], 2
movsx eax, word [ebp - 0x76]
add eax, dword [ebp - 0x4c]
lea eax, [ecx + eax*2]
mov dword [esp + 0xc], eax
mov esi, dword [ebp - 0xa4]
mov dword [esp + 8], esi
mov eax, dword [ebp - 0xc0]
mov dword [esp + 4], eax
mov edx, dword [ebp - 0x80]
mov dword [esp], edx
call fcn.00d05220
add dword [ebp - 0x4c], 0x40
sub dword [ebp - 0x48], 0xffffff80
cmp dword [ebp - 0x4c], 0x100
je 0xcfa728
add dword [ebp - 0x80], 0x22
jmp 0xcf9155
mov edi, ebx
mov eax, 0x6b900000
sar edi, 0x1f
mov esi, ebx
imul ecx, edi, 0x6b900000
mul ebx
lea edx, [ecx + edx]
mov eax, edx
add eax, eax
cmp eax, dword [ebp - 0xa0]
cmovl eax, dword [ebp - 0xa0]
mov ecx, eax
mov dword [ebp - 0x3c], eax
jmp 0xcf9ffc
test cx, cx
mov word [ebp - 0x78], 0
jle 0xcf9532
add edx, edx
add word [ebp - 0x78], 1
cmp edx, 0x7ffffff
jle 0xcfa5e2
movzx eax, word [ebp - 0x78]
jmp 0xcf953a
cmp cx, word [ebp - 0x78]
jg 0xcfa5ca
jmp 0xcfa5d9
lea ecx, [ebp + 0xc]
mov dword [esp + 4], ecx
mov dword [esp], 7
call fcn.00d03ea0
mov esi, dword [ebp - 0xbc]
mov dword [esp + 0x2c], esi
mov ecx, dword [ebp + 0x18]
cwde
movsx edx, word [ecx + 0x5ee]
mov dword [esp + 0x28], edx
mov esi, dword [ebp - 0xd4]
mov dword [esp + 0x24], esi
movsx edx, word [ecx + 0x47a]
lea esi, [ebp - 0x10]
mov dword [esp + 0x20], edx
movsx edx, word [ecx + 0x478]
lea ecx, [ebp - 0x14]
mov dword [esp + 0x1c], edx
mov edx, dword [ebp - 0x60]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x40
mov dword [esp + 0x18], edx
mov edx, dword [ebp - 0x8c]
mov dword [esp + 4], 7
mov dword [esp], eax
mov dword [esp + 8], edx
call fcn.00cfbad0
jmp 0xcf94e2
movzx ecx, word [ebp - 0x10]
movsx edx, cx
lea esi, [edx + edx]
movsx edi, si
mov eax, edi
sar eax, 1
cmp edx, eax
mov word [ebp - 0x66], si
je 0xcfa69d
sar cx, 0xf
mov word [ebp - 0x66], cx
xor word [ebp - 0x66], 0x7fff
movsx edi, word [ebp - 0x66]
cmp word [ebp - 0x66], 0x4000
jle 0xcfa7ac
movsx eax, word [ebp - 0x10]
mov esi, dword [ebp - 0xe4]
mov dword [ebp - 0xcc], eax
jmp 0xcfa6ec
add eax, eax
mov edx, 0x7fff
sar eax, 1
cmp eax, 0x7fffffff
je 0xcfa6da
add eax, 0x8000
mov edx, eax
shr edx, 0x10
mov word [esi], dx
add esi, 2
cmp esi, dword [ebp - 0xc0]
je 0xcf962f
movsx eax, word [esi + 0x80]
imul eax, edi
mov ecx, eax
mov edx, eax
sar ecx, 0x1f
sar eax, 0x1e
mov ebx, ecx
sar edx, 0xf
xor ebx, 0x7fff
cmp eax, ecx
cmovne edx, ebx
movsx eax, dx
imul eax, dword [ebp - 0xcc]
cmp eax, 0x40000000
jne 0xcfa6c0
mov eax, 0x40007fff
jmp 0xcfa6d5
mov eax, dword [ebp - 0x9c]
mov dword [esp + 8], 0x1f0
add eax, 0x200
mov dword [esp + 4], eax
mov ecx, dword [ebp + 0x18]
mov dword [esp], ecx
call sub.msvcrt.dll_memcpy
neg word [ebp - 0x78]
movsx eax, word [ebp - 0x78]
mov dword [esp + 4], 0x100
mov dword [esp + 8], eax
mov esi, dword [ebp - 0x84]
mov dword [esp], esi
call fcn.00d05c10
mov dword [esp + 8], esi
mov eax, dword [ebp - 0x94]
mov dword [esp + 4], eax
mov edx, dword [ebp - 0xb8]
mov dword [esp], edx
call fcn.00cff330
mov ecx, dword [ebp + 0x18]
xor eax, eax
movzx esi, word [ebp - 0x6c]
mov word [ecx + 0x5e6], 0
mov word [ecx + 0x478], si
add esp, 0x11c
pop ebx
pop esi
pop edi
pop ebp
ret
movsx edx, word [ebp - 0x10]
mov dword [ebp - 0xcc], edx
jmp 0xcf962f
movzx ecx, word [ebp - 0x78]
mov edx, ebx
neg ecx
and ecx, 0xf
sar edx, cl
jmp 0xcfa075
mov esi, ecx
xor esi, ebx
jns 0xcfa2e0
mov ecx, ebx
sar ecx, 0x1f
xor ecx, 0x7fffffff
jmp 0xcfa2e0
mov eax, ecx
xor eax, ebx
jns 0xcfa0cf
mov ecx, ebx
sar ecx, 0x1f
xor ecx, 0x7fffffff
jmp 0xcfa0cf
lea esi, [ebp + 0xc]
mov dword [esp + 4], esi
mov dword [esp], 0xc
call fcn.00d03ea0
mov edx, dword [ebp - 0x8c]
mov word [ebp - 0x24], ax
cwde
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00d03f70
jmp 0xcf93ff
cmp ax, 0x1b7
jg 0xcfaa5d
sub si, 0x178
mov eax, esi
sar ax, 1
sub ax, 0xff80
mov word [ebp - 0xac], ax
cwde
add eax, 0xffffff80
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
cmove ebx, eax
movsx edx, bx
lea eax, [edx + edx]
movsx ecx, ax
mov eax, ecx
sar eax, 1
cmp edx, eax
je 0xcfa887
sar bx, 0xf
xor bx, 0x7fff
movsx ecx, bx
movsx eax, si
sub eax, ecx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
mov ecx, eax
cmovne ecx, ebx
movsx edx, cx
lea edi, [edx + edx]
movsx eax, di
sar eax, 1
cmp edx, eax
je 0xcfa8bf
mov edi, ecx
sar di, 0xf
xor di, 0x7fff
movzx esi, word [ebp - 0xac]
mov eax, esi
mov word [ebp - 0xe], si
jmp 0xcf9d53
cwde
sub eax, 0x18
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
cmovne eax, ebx
xor edi, edi
mov word [ebp - 0xe], ax
jmp 0xcf9d53
mov ebx, ecx
sar ebx, 0x1f
xor ebx, 0x7fffffff
jmp 0xcfa049
mov edx, ebx
sar edx, 0x1f
xor edx, 0x7fffffff
jmp 0xcfa355
mov ecx, ebx
sar ecx, 0x1f
xor ecx, 0x7fffffff
jmp 0xcfa148
lea ecx, [ebp + 0xc]
mov dword [esp + 4], ecx
lea esi, [ebp + 0xc]
mov dword [esp], 5
call fcn.00d03ea0
mov word [ebp - 0x24], ax
mov dword [esp + 4], esi
mov dword [esp], 5
call fcn.00d03ea0
mov word [ebp - 0x22], ax
mov dword [esp + 4], esi
mov dword [esp], 5
call fcn.00d03ea0
mov word [ebp - 0x20], ax
mov dword [esp + 4], esi
lea esi, [ebp - 0x24]
mov dword [esp], 5
call fcn.00d03ea0
mov ecx, dword [ebp - 0x8c]
mov word [ebp - 0x1e], ax
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x14
mov dword [esp], esi
call fcn.00d04070
jmp 0xcf93ff
lea eax, [ebp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x94]
mov dword [esp + 0xc], eax
movsx edx, word [ebp - 0x6e]
mov dword [esp + 8], edx
mov ecx, dword [ebp - 0xc0]
mov dword [esp + 4], ecx
mov eax, dword [ebp - 0xb8]
mov dword [esp], eax
call fcn.00cff830
jmp 0xcf8911
lea esi, [ebp + 0xc]
mov dword [esp + 4], esi
mov dword [esp], 6
call fcn.00d03ea0
movzx edx, word [ebp - 0x70]
mov esi, eax
sar ax, 2
lea edi, [eax + edx]
mov ebx, edi
sub bx, dx
movsx edx, bx
lea eax, [edx*4]
movsx ecx, ax
mov eax, ecx
sar eax, 2
cmp edx, eax
je 0xcfaa1c
sar bx, 0xf
xor bx, 0x7fff
movsx ecx, bx
movsx eax, si
sub eax, ecx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
mov word [ebp - 0xe], di
mov edi, eax
cmovne edi, ebx
jmp 0xcf9207
mov eax, dword [ebp + 0x18]
mov word [eax + 0x47a], 5
mov word [eax + 0x478], 1
jmp 0xcf896e
cwde
sub eax, 0x118
jmp 0xcfa8d5
lea ecx, [ebp + 0xc]
mov dword [esp + 4], ecx
mov dword [esp], 4
call fcn.00d03ea0
cwde
jmp 0xcfa501
mov ecx, dword [ebp + 0x18]
mov word [ecx + 0x5ee], 0
jmp 0xcf89c2
lea ecx, [ebp + 0xc]
mov dword [esp + 4], ecx
lea esi, [ebp + 0xc]
mov dword [esp], 2
call fcn.00d03ea0
mov word [ebp - 0x24], ax
mov dword [esp + 4], esi
mov dword [esp], 2
call fcn.00d03ea0
mov word [ebp - 0x22], ax
mov dword [esp + 4], esi
mov dword [esp], 2
call fcn.00d03ea0
mov word [ebp - 0x20], ax
mov dword [esp + 4], esi
mov dword [esp], 2
call fcn.00d03ea0
mov word [ebp - 0x1e], ax
mov dword [esp + 4], esi
mov dword [esp], 0xe
call fcn.00d03ea0
mov word [ebp - 0x1c], ax
mov dword [esp + 4], esi
mov dword [esp], 0xe
call fcn.00d03ea0
mov word [ebp - 0x1a], ax
mov dword [esp + 4], esi
mov dword [esp], 0xe
call fcn.00d03ea0
mov word [ebp - 0x18], ax
mov dword [esp + 4], esi
lea esi, [ebp - 0x24]
mov dword [esp], 0xe
call fcn.00d03ea0
mov ecx, dword [ebp - 0x8c]
mov word [ebp - 0x16], ax
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x40
mov dword [esp], esi
call fcn.00d04070
jmp 0xcf93ff
mov word [ecx + 0x47c], 0
mov eax, dword [esi]
mov dword [ecx + 0x1f0], eax
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
jmp 0xcf8ae7
lea ecx, [ebp + 0xc]
mov dword [esp + 4], ecx
lea esi, [ebp + 0xc]
mov dword [esp], 0xd
call fcn.00d03ea0
mov word [ebp - 0x24], ax
mov dword [esp + 4], esi
mov dword [esp], 0xd
call fcn.00d03ea0
mov word [ebp - 0x22], ax
mov dword [esp + 4], esi
mov dword [esp], 9
call fcn.00d03ea0
mov word [ebp - 0x20], ax
mov dword [esp + 4], esi
lea esi, [ebp - 0x24]
mov dword [esp], 9
call fcn.00d03ea0
mov ecx, dword [ebp - 0x8c]
mov word [ebp - 0x1e], ax
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x2c
mov dword [esp], esi
call fcn.00d04070
jmp 0xcf93ff
lea eax, [ebp + 0xc]
mov dword [esp + 4], eax
lea esi, [ebp + 0xc]
mov dword [esp], 0xd
call fcn.00d03ea0
lea edx, [ebp + 0xc]
mov word [ebp - 0x24], ax
mov dword [esp + 4], edx
mov dword [esp], 0xd
call fcn.00d03ea0
lea ecx, [ebp + 0xc]
mov word [ebp - 0x22], ax
mov dword [esp + 4], ecx
mov dword [esp], 0xd
call fcn.00d03ea0
mov word [ebp - 0x20], ax
mov dword [esp + 4], esi
mov dword [esp], 0xd
call fcn.00d03ea0
lea edx, [ebp - 0x24]
mov word [ebp - 0x1e], ax
mov eax, dword [ebp - 0x8c]
mov dword [esp + 4], 0x34
mov dword [esp], edx
mov dword [esp + 8], eax
call fcn.00d04070
jmp 0xcf93ff
lea ecx, [ebp + 0xc]
mov dword [esp + 4], ecx
lea esi, [ebp + 0xc]
mov dword [esp], 0xb
call fcn.00d03ea0
mov word [ebp - 0x24], ax
mov dword [esp + 4], esi
mov dword [esp], 0xb
call fcn.00d03ea0
mov word [ebp - 0x22], ax
mov dword [esp + 4], esi
mov dword [esp], 0xb
call fcn.00d03ea0
mov word [ebp - 0x20], ax
mov dword [esp + 4], esi
mov dword [esp], 0xb
call fcn.00d03ea0
mov word [ebp - 0x1e], ax
mov dword [esp + 4], esi
mov dword [esp], 0xb
call fcn.00d03ea0
mov word [ebp - 0x1c], ax
mov dword [esp + 4], esi
mov dword [esp], 0xb
call fcn.00d03ea0
mov word [ebp - 0x1a], ax
mov dword [esp + 4], esi
mov dword [esp], 0xb
call fcn.00d03ea0
mov word [ebp - 0x18], ax
mov dword [esp + 4], esi
lea esi, [ebp - 0x24]
mov dword [esp], 0xb
call fcn.00d03ea0
mov ecx, dword [ebp - 0x8c]
mov word [ebp - 0x16], ax
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x58
mov dword [esp], esi
call fcn.00d04070
jmp 0xcf93ff
mov edi, esi
sar edi, 0x1f
xor edi, 0x7fffffff
jmp 0xcf8c1b
mov esi, edi
sar esi, 0x1f
xor esi, 0x7fffffff
jmp 0xcf8bc9
mov edi, esi
sar edi, 0x1f
xor edi, 0x7fffffff
jmp 0xcf8d63
mov esi, edi
sar esi, 0x1f
xor esi, 0x7fffffff
jmp 0xcf8d11
mov edi, esi
sar edi, 0x1f
xor edi, 0x7fffffff
jmp 0xcf8cbf
mov esi, edi
sar esi, 0x1f
xor esi, 0x7fffffff
jmp 0xcf8c6d
mov ecx, esi
sar ecx, 0x1f
xor ecx, 0x7fffffff
jmp 0xcf8ff3
mov esi, edi
sar esi, 0x1f
xor esi, 0x7fffffff
jmp 0xcf8fa1
mov edi, esi
sar edi, 0x1f
xor edi, 0x7fffffff
jmp 0xcf8f4f
mov esi, edi
sar esi, 0x1f
xor esi, 0x7fffffff
jmp 0xcf8efd
mov edi, esi
sar edi, 0x1f
xor edi, 0x7fffffff
jmp 0xcf8eab
mov esi, edi
sar esi, 0x1f
xor esi, 0x7fffffff
jmp 0xcf8e59
mov edi, esi
sar edi, 0x1f
xor edi, 0x7fffffff
jmp 0xcf8e07
mov esi, edi
sar esi, 0x1f
xor esi, 0x7fffffff
jmp 0xcf8db5
xor ecx, 0x7fff
xor esi, esi
movsx edi, cx
mov edx, dword [ebp + 0x20]
mov ecx, 0x7fffffff
mov ebx, ecx
movsx eax, word [edx + esi*2 + 0x76e]
imul eax, edi
cmp eax, 0x40000000
lea edx, [eax + eax]
cmovne ebx, edx
mov edx, dword [ebp + 0x20]
movsx eax, word [edx + esi*2 + 0x74e]
imul eax, dword [ebp - 0x30]
cmp eax, 0x40000000
lea edx, [eax + eax]
cmove edx, ecx
lea eax, [edx + ebx]
xor edx, ebx
js 0xcfae94
mov ecx, eax
xor ecx, ebx
jns 0xcfae94
mov eax, ebx
sar eax, 0x1f
xor eax, 0x7fffffff
cmp eax, 0x7fffffff
mov edx, 0x7fff
je 0xcfaeaa
add eax, 0x8000
mov edx, eax
shr edx, 0x10
mov eax, dword [ebp + 0x20]
mov word [eax + esi*2 + 0xa8e], dx
add esi, 1
cmp esi, 0x10
jne 0xcfae43
jmp 0xcfa4ff