Function at 0x415ac0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf24c
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x5116c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x254], ecx
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
add eax, 0x200
mov dword [ebp - 0x258], ebx
push eax
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x260], ebx
mov dword [0x511668], 0xffffffff
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 0x234], eax
test eax, eax
je 0x416c00
lea ecx, [ebp - 0x244]
mov byte [eax], bl
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__18]
lea ecx, [ebp - 0x23c]
mov dword [ebp - 4], ebx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__18]
push 0x6978
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc140u.dll_ATL::CStringT_char_StrTraitMFC_DLL_char_ATL::ChTraitsCRT_char__5]
mov esi, dword [0x5206f4]
lea ecx, [esi + 0x2c]
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
push eax
push str.HyperSnap_DX_4
lea ecx, [ebp - 0x228]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__27]
push dword [ebp - 0x228]
lea ecx, [esi + 0x2c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__25]
lea ecx, [ebp - 0x228]
mov esi, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
test esi, esi
jne 0x415bbf
push str.PD:HyperSnap_DX_ver._4.xx
lea ecx, [ebp - 0x23c]
call dword [sym.imp.mfc140u.dll_Ordinal_1533]
jmp 0x415c76
mov esi, dword [0x5206f4]
lea ecx, [esi + 0x2c]
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
push eax
push str.FileBox_eXtender_1
lea ecx, [ebp - 0x228]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__27]
push dword [ebp - 0x228]
lea ecx, [esi + 0x2c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__25]
lea ecx, [ebp - 0x228]
mov esi, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
test esi, esi
jne 0x415c14
push str.PD:FileBox_eXtender_ver._1.xx
lea ecx, [ebp - 0x23c]
call dword [sym.imp.mfc140u.dll_Ordinal_1533]
jmp 0x415c76
push str.PD:
lea ecx, [ebp - 0x228]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov eax, dword [0x5206f4]
add eax, 0x2c
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.004019e2
add esp, 0xc
push dword [eax]
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140u.dll_ATL::CStringT_char_StrTraitMFC_DLL_char_ATL::ChTraitsCRT_char__3]
lea ecx, [ebp - 0x22c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, dword [ebp - 0x244]
mov ecx, 0x4df37c
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x415ca1
test dl, dl
je 0x415c9d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x415ca1
add eax, 2
add ecx, 2
test dl, dl
jne 0x415c81
xor eax, eax
jmp 0x415ca6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x415cc0
push 0x4e0508
lea ecx, [ebp - 0x23c]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_char_1_::operator]
jmp 0x415d87
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 4
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__21]
push eax
lea ecx, [ebp - 0x238]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x258], 0x10
push dword [eax - 0xc]
push eax
push 1
lea eax, [ebp - 0x238]
push 0x4df514
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_char_1_::Concatenate]
add esp, 0x14
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 5
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__21]
push eax
lea ecx, [ebp - 0x24c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
mov eax, dword [ebp - 0x238]
push 1
push 0x4e0508
mov dword [ebp - 0x258], 0x30
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_char_1_::Concatenate]
add esp, 0x14
lea eax, [ebp - 0x24c]
lea ecx, [ebp - 0x23c]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_char_1_::operator_1]
lea ecx, [ebp - 0x24c]
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
xor ebx, ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x260], ebx
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
mov esi, dword [ebp - 0x23c]
push esi
push edi
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
jne 0x415fd5
lea edi, [eax + 0x5c]
mov dword [ebp - 0x228], eax
cmp eax, 0xa
jge 0x415de1
push 0x4d4174
lea ecx, [ebp - 0x22c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov ecx, dword [ebp - 0x254]
or ebx, 1
push dword [ebp - 0x22c]
lea ecx, [ecx + edi]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__25]
mov byte [ebp - 0x245], 1
test eax, eax
jg 0x415de8
mov byte [ebp - 0x245], 0
test bl, 1
je 0x415dfc
lea ecx, [ebp - 0x22c]
and ebx, 0xfffffffe
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
cmp byte [ebp - 0x245], 0
je 0x416bd9
push str.PD:
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov esi, dword [0x5206f4]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 7
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
push eax
lea ecx, [ebp - 0x24c]
call dword [sym.imp.mfc140u.dll_Ordinal_285]
mov eax, dword [esi + edi]
or ebx, 2
mov dword [ebp - 0x258], ebx
push dword [eax - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::Concatenate]
add esp, 0x14
lea ecx, [ebp - 0x23c]
push dword [ebp - 0x24c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_char_StrTraitMFC_DLL_char_ATL::ChTraitsCRT_char__3]
and ebx, 0xfffffffd
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x260], ebx
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, dword [ebp - 0x244]
mov ecx, 0x4df37c
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x415ec0
test dl, dl
je 0x415ebc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x415ec0
add eax, 2
add ecx, 2
test dl, dl
jne 0x415ea0
xor eax, eax
jmp 0x415ec5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x415edf
push 0x4e0508
lea ecx, [ebp - 0x23c]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_char_1_::operator]
jmp 0x415fa8
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 8
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__21]
push eax
lea ecx, [ebp - 0x238]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
mov eax, dword [ebp - 0x244]
or ebx, 4
mov dword [ebp - 0x258], ebx
push dword [eax - 0xc]
push eax
push 1
lea eax, [ebp - 0x238]
push 0x4df514
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_char_1_::Concatenate]
add esp, 0x14
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 9
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__21]
push eax
lea ecx, [ebp - 0x250]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
mov eax, dword [ebp - 0x238]
or ebx, 8
push 1
push 0x4e0508
mov dword [ebp - 0x258], ebx
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_char_1_::Concatenate]
add esp, 0x14
lea eax, [ebp - 0x250]
lea ecx, [ebp - 0x23c]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_char_1_::operator_1]
lea ecx, [ebp - 0x250]
and ebx, 0xfffffff7
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
and ebx, 0xfffffffb
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x260], ebx
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
mov esi, dword [ebp - 0x23c]
push esi
push dword [ebp - 0x240]
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x228]
jne 0x415fd0
inc eax
add edi, 4
jmp 0x415da2
mov dword [0x511668], eax
mov ecx, dword [ebp - 0x234]
mov edx, ecx
sub edx, esi
nop
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [esi + edx - 1], al
test al, al
jne 0x415fe0
lea edi, [ecx - 1]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x415ff0
mov ax, word [0x4e0628]
push str.LO:
push dword [ebp - 0x240]
mov word [edi], ax
call sub.VCRUNTIME140.dll_strstr
mov esi, eax
add esp, 8
test esi, esi
je 0x416bd9
push 0x7d
push esi
call sub.VCRUNTIME140.dll_strchr
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x416bd9
mov byte [ebx], 0
mov edx, esi
nop word [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x416040
mov edi, dword [ebp - 0x234]
sub esi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x416050
mov ecx, esi
mov dword [ebp - 0x22c], esi
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x22c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x234]
lea ecx, [esi - 1]
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x416080
mov ax, word [0x4e062c]
mov word [ecx], ax
mov al, byte [0x4e062e]
mov byte [ecx + 2], al
mov eax, 1
mov byte [ebx], 0x7d
mov dword [ebp - 0x22c], eax
nop dword [eax]
push eax
lea eax, [ebp - 0x18]
push str.A_1d:
push eax
call fcn.0040eb90
lea eax, [ebp - 0x18]
push eax
push ebx
call sub.VCRUNTIME140.dll_strstr
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x41616f
push 0x7d
push ebx
call sub.VCRUNTIME140.dll_strchr
mov edx, eax
add esp, 8
mov dword [ebp - 0x250], edx
test edx, edx
je 0x41692f
mov ecx, ebx
mov byte [edx], 0
mov dword [ebp - 0x228], ecx
nop dword [eax]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x416100
sub ebx, ecx
lea edi, [esi - 1]
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x416110
mov esi, dword [ebp - 0x228]
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x234]
lea ecx, [esi - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x416135
mov ax, word [0x4e062c]
mov ebx, dword [ebp - 0x250]
mov word [ecx], ax
mov al, byte [0x4e062e]
mov byte [ecx + 2], al
mov eax, dword [ebp - 0x22c]
inc eax
mov byte [edx], 0x7d
mov dword [ebp - 0x22c], eax
cmp eax, 0xa
jl 0x4160b0
push str.SN:
push dword [ebp - 0x240]
call sub.VCRUNTIME140.dll_strstr
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x416bd9
push 0x7d
push ebx
call sub.VCRUNTIME140.dll_strchr
mov edx, eax
add esp, 8
test edx, edx
je 0x416bd9
mov ecx, ebx
mov byte [edx], 0
mov dword [ebp - 0x22c], ecx
nop dword [eax]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4161b0
sub ebx, ecx
lea edi, [esi - 1]
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4161c0
mov esi, dword [ebp - 0x22c]
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x234]
lea ecx, [esi - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4161e5
mov ax, word [0x4e062c]
mov word [ecx], ax
mov al, byte [0x4e062e]
push str.NC:
push dword [ebp - 0x240]
mov byte [ecx + 2], al
mov byte [edx], 0x7d
call sub.VCRUNTIME140.dll_strstr
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x416bd9
lea ecx, [ebx + 4]
push ecx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
test eax, eax
je 0x416bd9
cmp eax, 0xfffffffe
jl 0x416bd9
push 0x7d
push ebx
call sub.VCRUNTIME140.dll_strchr
mov edx, eax
add esp, 8
test edx, edx
je 0x416bd9
mov ecx, ebx
mov byte [edx], 0
mov dword [ebp - 0x22c], ecx
nop
mov al, byte [ebx]
inc ebx
test al, al
jne 0x416260
sub ebx, ecx
lea edi, [esi - 1]
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x416270
mov esi, dword [ebp - 0x22c]
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x234]
lea ecx, [esi - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x416295
mov ax, word [0x4e062c]
mov word [ecx], ax
mov al, byte [0x4e062e]
mov byte [ecx + 2], al
lea ecx, [ebp - 0x25c]
mov byte [edx], 0x7d
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push str.LD:
push dword [ebp - 0x240]
mov byte [ebp - 4], 0xa
call sub.VCRUNTIME140.dll_strstr
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x416365
push 0x7d
push ebx
call sub.VCRUNTIME140.dll_strchr
add esp, 8
mov dword [ebp - 0x22c], eax
test eax, eax
je 0x41690f
lea ecx, [ebx + 4]
mov byte [eax], 0
push ecx
lea ecx, [ebp - 0x25c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__19]
mov edx, ebx
nop
mov al, byte [ebx]
inc ebx
test al, al
jne 0x416310
sub ebx, edx
lea edi, [esi - 1]
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x416320
mov ecx, ebx
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x234]
lea ecx, [esi - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x416341
mov ax, word [0x4e062c]
mov word [ecx], ax
mov al, byte [0x4e062e]
mov byte [ecx + 2], al
mov eax, dword [ebp - 0x22c]
mov byte [eax], 0x7d
push str.EY:
push dword [ebp - 0x240]
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x14], 0
call sub.VCRUNTIME140.dll_strstr
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4165ab
push 0x7d
push ebx
call sub.VCRUNTIME140.dll_strchr
mov edi, eax
add esp, 8
mov dword [ebp - 0x22c], edi
test edi, edi
je 0x41690f
lea ecx, [ebx + 4]
push ecx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
mov dword [ebp - 0x228], eax
mov byte [edi], 0
mov edx, ebx
mov cl, byte [ebx]
inc ebx
test cl, cl
jne 0x4163d0
sub ebx, edx
lea edi, [esi - 1]
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4163e0
mov ecx, ebx
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x234]
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x416400
mov ax, word [0x4e062c]
mov word [ecx], ax
mov al, byte [0x4e062e]
mov byte [ecx + 2], al
mov eax, dword [ebp - 0x22c]
push str.EM:
push dword [ebp - 0x240]
mov byte [eax], 0x7d
call sub.VCRUNTIME140.dll_strstr
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x41690f
push 0x7d
push ebx
call sub.VCRUNTIME140.dll_strchr
mov esi, eax
add esp, 8
mov dword [ebp - 0x22c], esi
test esi, esi
je 0x41690f
lea ecx, [ebx + 4]
push ecx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov byte [esi], 0
add esp, 4
mov dword [ebp - 0x250], eax
mov esi, ebx
mov cl, byte [ebx]
inc ebx
test cl, cl
jne 0x416474
mov edx, dword [ebp - 0x234]
sub ebx, esi
lea edi, [edx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x416486
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [edx - 1]
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4164a0
mov ax, word [0x4e062c]
mov word [ecx], ax
mov al, byte [0x4e062e]
mov byte [ecx + 2], al
mov eax, dword [ebp - 0x22c]
push str.ED:
push dword [ebp - 0x240]
mov byte [eax], 0x7d
call sub.VCRUNTIME140.dll_strstr
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x41690f
push 0x7d
push ebx
call sub.VCRUNTIME140.dll_strchr
mov esi, eax
add esp, 8
mov dword [ebp - 0x22c], esi
test esi, esi
je 0x41690f
lea ecx, [ebx + 4]
push ecx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov byte [esi], 0
add esp, 4
mov dword [ebp - 0x14], eax
mov esi, ebx
mov cl, byte [ebx]
inc ebx
test cl, cl
jne 0x416511
mov edx, dword [ebp - 0x234]
sub ebx, esi
lea edi, [edx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x416523
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [edx - 1]
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x416540
mov ax, word [0x4e062c]
push 0xffffffffffffffff
push 0
push 0x3b
mov word [ecx], ax
mov al, byte [0x4e062e]
push 0x17
push dword [ebp - 0x14]
mov byte [ecx + 2], al
lea ecx, [ebp - 0x230]
mov eax, dword [ebp - 0x22c]
push dword [ebp - 0x250]
push dword [ebp - 0x228]
mov byte [eax], 0x7d
call fcn.0040f7b0
push dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x254]
push dword [ebp - 0x230]
lea ecx, [ecx + 0xb4]
call fcn.00411400
test al, al
jne 0x41690f
push str.KI:
push dword [ebp - 0x240]
call sub.VCRUNTIME140.dll_strstr
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x41690f
push 0x7d
push ebx
call sub.VCRUNTIME140.dll_strchr
add esp, 8
mov dword [ebp - 0x22c], eax
test eax, eax
je 0x41690f
push 0xa
lea ecx, [ebx + 4]
mov byte [eax], 0
push ecx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add esp, 0xc
mov byte [ebp - 0x1b], 0
mov esi, ebx
nop dword [eax]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x416600
mov edx, dword [ebp - 0x234]
sub ebx, esi
lea edi, [edx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x416612
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [edx - 1]
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x416630
mov ax, word [0x4e062c]
mov word [ecx], ax
mov al, byte [0x4e062e]
mov byte [ecx + 2], al
mov eax, dword [ebp - 0x22c]
push str.FS:
push dword [ebp - 0x240]
mov dword [ebp - 0x24c], 0
mov byte [eax], 0x7d
call sub.VCRUNTIME140.dll_strstr
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x416704
push 0x7d
push ebx
call sub.VCRUNTIME140.dll_strchr
mov esi, eax
add esp, 8
mov dword [ebp - 0x22c], esi
test esi, esi
je 0x41690f
lea ecx, [ebx + 4]
push ecx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov byte [esi], 0
add esp, 4
mov dword [ebp - 0x24c], eax
mov esi, ebx
nop
mov cl, byte [ebx]
inc ebx
test cl, cl
jne 0x4166b0
mov edx, dword [ebp - 0x234]
sub ebx, esi
lea edi, [edx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4166c2
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [edx - 1]
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4166e0
mov ax, word [0x4e062c]
mov word [ecx], ax
mov al, byte [0x4e062e]
mov byte [ecx + 2], al
mov eax, dword [ebp - 0x22c]
mov byte [eax], 0x7d
mov eax, dword [ebp - 0x254]
push str.SV:
push dword [ebp - 0x240]
mov dword [eax + 0x28], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x20], 0
call sub.VCRUNTIME140.dll_strstr
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x416834
push 0x7d
push ebx
call sub.VCRUNTIME140.dll_strchr
add esp, 8
mov dword [ebp - 0x22c], eax
test eax, eax
je 0x41690f
lea ecx, [ebx + 4]
mov byte [eax], 0
lea edx, [ebp - 0x224]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x416763
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
lea eax, [ebp - 0x224]
push 0x4df63c
push eax
call esi
add esp, 8
test eax, eax
je 0x4167d8
mov edi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
push eax
call edi
mov ecx, dword [ebp - 0x254]
push 0x4df63c
push 0
mov dword [ecx + 0x20], eax
call esi
add esp, 0xc
test eax, eax
je 0x4167d8
push eax
call edi
mov ecx, dword [ebp - 0x254]
push 0x4df63c
push 0
mov dword [ecx + 0x24], eax
call esi
add esp, 0xc
test eax, eax
je 0x4167d8
push eax
call edi
mov ecx, dword [ebp - 0x254]
add esp, 4
mov dword [ecx + 0x28], eax
mov esi, ebx
nop word [eax + eax]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4167e0
mov edx, dword [ebp - 0x234]
sub ebx, esi
lea edi, [edx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4167f2
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [edx - 1]
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x416810
mov ax, word [0x4e062c]
mov word [ecx], ax
mov al, byte [0x4e062e]
mov byte [ecx + 2], al
mov eax, dword [ebp - 0x22c]
mov byte [eax], 0x7d
push str.KD:
push dword [ebp - 0x240]
call sub.VCRUNTIME140.dll_strstr
mov esi, eax
add esp, 8
test esi, esi
je 0x41690f
movsx ecx, byte [esi + 4]
add esi, 4
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
push ecx
call edi
add esp, 4
test eax, eax
jne 0x416877
movsx eax, byte [esi + 1]
inc esi
push eax
call edi
add esp, 4
test eax, eax
je 0x416868
movsx eax, byte [esi]
push eax
call edi
add esp, 4
test eax, eax
je 0x416893
movsx eax, byte [esi + 1]
inc esi
push eax
call edi
add esp, 4
test eax, eax
jne 0x416884
movsx eax, byte [esi]
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
push eax
call edi
add esp, 4
test eax, eax
je 0x4168b5
movsx eax, byte [esi + 1]
inc esi
push eax
call edi
add esp, 4
test eax, eax
jne 0x4168a6
push str.EK:
push esi
call sub.VCRUNTIME140.dll_strstr
add esp, 8
mov dword [ebp - 0x22c], eax
test eax, eax
je 0x41690f
mov byte [eax], 0
xor edi, edi
mov ecx, dword [0x5204a4]
test ecx, ecx
je 0x41690c
mov ebx, dword [ebp - 0x234]
push esi
lea eax, [ecx + 6]
push ebx
push eax
call fcn.004140d0
add esp, 0xc
mov dword [ebp - 0x238], eax
test eax, eax
jne 0x416935
mov ecx, dword [edi*4 + 0x5204a8]
inc edi
test ecx, ecx
jne 0x4168e2
mov eax, dword [ebp - 0x22c]
mov byte [eax], 0x45
push dword [ebp - 0x234]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
lea ecx, [ebp - 0x25c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
jmp 0x416be8
push esi
jmp 0x416bdf
mov edi, dword [ebp - 0x254]
mov eax, dword [eax + 8]
push eax
mov dword [edi + 0x23c], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push dword [edi + 0x23c]
mov esi, dword [ebp - 0x238]
push esi
push eax
mov dword [edi + 0x240], eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x10
mov ecx, esi
push 1
call fcn.004116f0
mov eax, dword [ebp - 0x22c]
lea ecx, [edi + 0x254]
mov byte [eax], 0x45
mov eax, dword [ebp - 0x228]
mov dword [edi + 0x248], eax
mov eax, dword [ebp - 0x250]
mov dword [edi + 0x24c], eax
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x250], eax
mov eax, dword [ebp - 0x24c]
mov dword [edi + 0x244], eax
lea eax, [ebp - 0x25c]
push eax
mov dword [edi + 0x238], ebx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
mov edi, dword [0x5206f4]
mov edx, dword [edi + 0x238]
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x4169d0
sub edx, ecx
xor esi, esi
cmp edx, 0xb
jle 0x416a41
mov ebx, dword [edi + 0x23c]
cmp ebx, 0x10
jle 0x416a41
xor ecx, ecx
nop dword [eax]
mov eax, dword [edi + 0x238]
movsx eax, byte [eax + ecx]
inc ecx
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x511268]
cmp ecx, edx
jl 0x4169f0
mov edi, dword [edi + 0x240]
xor ecx, ecx
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x511268]
cmp ecx, ebx
jl 0x416a16
mov edi, dword [0x5206f4]
test esi, esi
jne 0x416a41
mov esi, 0xb
xor ecx, ecx
jmp 0x4169f0
mov eax, dword [edi + 0x248]
test eax, eax
je 0x416a8f
push 0xffffffffffffffff
push 0
push 0x3b
push 0x17
push dword [edi + 0x250]
lea ecx, [ebp - 0x230]
push dword [edi + 0x24c]
push eax
call fcn.0040f7b0
push dword [ebp - 0x22c]
mov ecx, dword [0x5206f4]
push dword [ebp - 0x230]
lea ecx, [ecx + 0xb4]
call fcn.00411400
xor ecx, ecx
test al, al
cmovne esi, ecx
mov ebx, dword [ebp - 0x254]
push str.SN:
push dword [ebx + 0x238]
call sub.VCRUNTIME140.dll_strstr
add esp, 8
lea ecx, [ebp - 0x22c]
add eax, 4
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_char_StrTraitMFC_DLL_char_ATL::ChTraitsCRT_char__4]
push 0x4e0508
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 0xb
push ecx
mov ecx, eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_char_StrTraitMFC_DLL_char_ATL::ChTraitsCRT_char__6]
lea ecx, [ebp - 0x22c]
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 0xe
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__21]
push eax
lea ecx, [ebp - 0x238]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
mov eax, dword [ebp - 0x264]
mov edi, dword [ebp - 0x260]
or edi, 0x40
mov dword [ebp - 0x258], edi
push dword [eax - 0xc]
push eax
push 1
lea eax, [ebp - 0x238]
push 0x4e0670
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_char_1_::Concatenate]
add esp, 0x14
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0xf
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__21]
push eax
lea ecx, [ebp - 0x228]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
mov eax, dword [ebp - 0x238]
or edi, 0x80
push 1
push 0x4e0508
mov dword [ebp - 0x258], edi
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_char_1_::Concatenate]
push dword [ebp - 0x228]
push dword [ebx + 0x234]
call sub.VCRUNTIME140.dll_strstr
add esp, 0x1c
lea ecx, [ebp - 0x228]
mov edi, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
lea ecx, [ebp - 0x238]
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
xor ebx, ebx
lea ecx, [ebp - 0x264]
test edi, edi
cmove ebx, esi
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
lea ecx, [ebp - 0x25c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x23c]
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
lea ecx, [ebp - 0x244]
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
mov eax, ebx
jmp 0x416c02
push dword [ebp - 0x234]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
lea ecx, [ebp - 0x23c]
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
lea ecx, [ebp - 0x244]
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00418035
mov esp, ebp
pop ebp
ret 8