Function at 0x40679c
Capabilities:
Check for software breakpoints
Check for time delay via gettickcount
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd14
mov eax, 0x52c640
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
call fcn.0049b3b8
push esi
lea edi, [ebp - 0x68]
mov esi, str.DONGHAI_COMPUTER_Co.0411_84604338Q0000
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
xor eax, eax
mov word [ebp - 0x18], 8
mov dword [ebp - 4], eax
mov ecx, dword [str.ERREND]
inc dword [ebp - 0xc]
mov dx, word [0x50264f]
mov word [ebp - 0x18], 0x14
mov word [ebp - 0x73], dx
mov dl, byte [0x502651]
mov byte [ebp - 0x71], dl
mov dword [ebp - 0x7c], ecx
mov cx, word [0x502656]
lea edx, [ebp - 0x68]
mov word [ebp - 0x78], cx
mov ax, word [0x502658]
mov word [ebp - 0x7e], ax
push edx
call fcn.0049b078
mov edi, eax
xor eax, eax
pop ecx
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0xc0]
xor ebx, ebx
mov byte [eax], 0
inc ebx
inc eax
cmp ebx, 8
jl 0x406828
mov word [ebp - 0x18], 0x20
push 0x10000
call fcn.0049a2dc
pop ecx
mov dword [ebp - 0x38], eax
push 0x52b29c
mov edx, dword [esi]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403510
add esp, 0xc
test al, al
jne 0x406874
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x38]
push eax
call fcn.0049a104
pop ecx
jmp 0x407511
cmp byte [0x53a2f0], 0x40
jne 0x406893
push 8
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.00403544
mov byte [ebp - 0x47], 0x51
add esp, 0xc
jmp 0x406908
cmp byte [0x53a2f0], 0x30
jne 0x4068ac
mov ecx, dword [ebp + 8]
push ecx
call fcn.004035ac
pop ecx
mov byte [ebp - 0x47], 0x77
jmp 0x406908
cmp byte [0x53a2f0], 0x38
jne 0x4068cb
push 6
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00403544
mov byte [ebp - 0x47], 0x67
add esp, 0xc
jmp 0x406908
cmp byte [0x53a2f0], 0x50
jne 0x4068f4
mov edx, dword [ebp + 8]
push edx
call fcn.004035ac
pop ecx
mov byte [ebp - 0x47], 0x77
mov byte [ebp - 0x4b], 0x39
mov byte [ebp - 0x4a], 0x39
mov byte [ebp - 0x49], 0x31
mov byte [ebp - 0x48], 0x31
jmp 0x406908
push 8
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403544
mov byte [ebp - 0x47], 0x51
add esp, 0xc
push 1
call sub.KERNEL32.DLL_Sleep
mov eax, dword [esi + 4]
cmp byte [eax], 0x91
jne 0x40691d
mov edx, dword [esi + 4]
mov byte [edx], 0xce
mov ecx, dword [esi + 4]
cmp byte [ecx], 0xee
jne 0x406935
mov eax, dword [esi + 4]
cmp byte [eax + 1], 0
jne 0x406935
mov edx, dword [esi + 4]
mov byte [edx + 1], 5
xor ebx, ebx
lea eax, [ebp + edi - 0x6c]
mov dword [ebp - 0xb0], eax
mov edx, dword [esi + 4]
mov eax, edx
mov dl, byte [eax]
mov ecx, dword [ebp - 0xb0]
mov byte [ecx], dl
inc ebx
inc dword [ebp - 0xb0]
inc eax
cmp ebx, 4
jl 0x406946
push edi
lea eax, [ebp - 0x68]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004035d4
add esp, 0xc
lea ecx, [edi + 0xc8]
mov dword [ebp - 0x3c], ecx
xor eax, eax
mov dword [ebp - 0x40], eax
push 1
push 0x3e8
mov edx, dword [ebp - 0x3c]
push edx
lea edx, [ebp - 0x68]
mov ecx, dword [ebp - 0x40]
push ecx
push 0x11
mov eax, dword [ebp - 0x38]
push eax
push edi
push edx
push esi
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040594c
add esp, 0x28
mov edi, eax
test edi, edi
jge 0x4069cb
inc edi
jne 0x4069b5
mov dword [ebp - 0x34], 0x64
jmp 0x4069bc
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x38]
push eax
call fcn.0049a104
pop ecx
jmp 0x407511
mov edx, dword [ebp - 0x38]
xor ecx, ecx
mov cl, byte [edx + 0x10]
mov dword [esi + 0x30], ecx
xor ebx, ebx
lea eax, [ebp - 0xc0]
mov edx, dword [ebp - 0x38]
mov ecx, edx
mov dword [ebp - 0xb0], ecx
mov edx, dword [ebp - 0xb0]
mov cl, byte [edx]
and cl, 0xff
mov byte [eax], cl
inc ebx
inc eax
inc dword [ebp - 0xb0]
cmp ebx, 0x10
jl 0x4069e9
mov eax, dword [ebp - 0x38]
push eax
lea eax, [esi + 0x34]
push eax
call fcn.00404ec0
add esp, 8
test al, al
jne 0x406a31
mov byte [esi + 0x38], 1
mov dword [ebp - 0x34], 2
mov edx, dword [ebp - 0x38]
push edx
call fcn.0049a104
pop ecx
jmp 0x407511
cmp edi, 0x11
jle 0x406a6a
lea ecx, [edi - 0x11]
mov dword [ebp - 0x40], ecx
xor ebx, ebx
mov eax, dword [ebp - 0x38]
add eax, 0x11
cmp ebx, dword [ebp - 0x40]
jge 0x406a55
mov dl, byte [eax]
inc ebx
mov byte [eax - 0x11], dl
inc eax
cmp ebx, dword [ebp - 0x40]
jl 0x406a49
mov ebx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
add eax, ebx
cmp edi, ebx
jle 0x406a6a
mov byte [eax], 0
inc ebx
inc eax
cmp edi, ebx
jg 0x406a61
mov edx, dword [esi + 4]
cmp byte [edx], 0xee
jne 0x406a9a
mov ecx, dword [esi + 4]
xor eax, eax
mov al, byte [ecx + 1]
mov edx, eax
shl edx, 2
lea edx, [edx + edx*4]
add edx, 0x46
push edx
call sub.KERNEL32.DLL_Sleep
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.0049a104
pop ecx
jmp 0x40749c
mov eax, dword [esi + 4]
mov al, byte [eax]
cmp al, 0x92
je 0x406aef
cmp al, 0x95
je 0x406aef
cmp al, 0x91
je 0x406aef
cmp al, 0x9d
je 0x406aef
cmp al, 0x9f
je 0x406aef
cmp al, 0xb0
je 0x406aef
cmp al, 0xb5
je 0x406aef
cmp al, 0xb9
je 0x406aef
cmp al, 0xc2
je 0x406aef
cmp al, 0x9a
je 0x406aef
cmp al, 0x9e
je 0x406aef
cmp al, 0xbd
je 0x406aef
cmp al, 0xc0
je 0x406aef
cmp al, 0xb8
je 0x406aef
cmp al, 0xc8
je 0x406aef
cmp al, 0xc9
je 0x406aef
cmp al, 0xce
je 0x406aef
cmp al, 0xd1
je 0x406aef
cmp al, 0xd2
jne 0x406c89
push 0xa
call sub.KERNEL32.DLL_Sleep
mov dword [ebp - 0x8c], 0x800
mov word [ebp - 0x18], 0x20
mov eax, dword [esi + 0xc]
xor edi, edi
cdq
idiv dword [ebp - 0x8c]
mov dword [ebp - 0x94], edx
mov eax, dword [esi + 0xc]
cdq
idiv dword [ebp - 0x8c]
mov dword [ebp - 0x90], eax
xor ebx, ebx
mov eax, dword [esi + 8]
jmp 0x406b37
xor edx, edx
inc ebx
mov dl, byte [eax]
add edi, edx
inc eax
cmp ebx, dword [esi + 0xc]
jl 0x406b2f
mov ecx, edi
test ecx, ecx
jns 0x406b48
add ecx, 0xff
sar ecx, 8
mov eax, edi
and cl, 0xff
and eax, 0x800000ff
mov byte [ebp - 0x9e], cl
jns 0x406b64
dec eax
or eax, 0xffffff00
inc eax
and al, 0xff
mov byte [ebp - 0x9d], al
xor edi, edi
cmp edi, dword [ebp - 0x90]
jge 0x406ba1
mov eax, dword [ebp - 0x8c]
push eax
mov edx, dword [esi + 8]
mov ecx, edi
imul ecx, dword [ebp - 0x8c]
add edx, ecx
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004035d4
add esp, 0xc
inc edi
cmp edi, dword [ebp - 0x90]
jl 0x406b76
cmp dword [ebp - 0x94], 0
jle 0x406bca
mov edx, dword [ebp - 0x94]
push edx
mov ecx, dword [esi + 8]
imul edi, dword [ebp - 0x8c]
add ecx, edi
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.004035d4
add esp, 0xc
mov dword [ebp - 0x3c], 2
push 1
push 0x3e8
mov edx, dword [ebp - 0x3c]
push edx
push 0
push 2
mov ecx, dword [ebp - 0x38]
push ecx
push 0
mov eax, dword [esi + 8]
push eax
push esi
mov edx, dword [ebp + 8]
push edx
call fcn.0040580c
add esp, 0x28
mov edi, eax
test edi, edi
jge 0x406c1f
inc edi
jne 0x406c09
mov dword [ebp - 0x34], 0x64
jmp 0x406c10
mov dword [ebp - 0x34], 3
mov eax, dword [ebp - 0x38]
push eax
call fcn.0049a104
pop ecx
jmp 0x407511
mov edx, dword [ebp - 0x38]
mov cl, byte [edx]
cmp cl, byte [ebp - 0x9e]
je 0x406c50
mov eax, dword [ebp - 0x38]
mov dl, byte [eax + 1]
cmp dl, byte [ebp - 0x9d]
je 0x406c50
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.0049a104
pop ecx
mov dword [ebp - 0x34], 4
jmp 0x407511
cmp edi, 2
jle 0x406c89
lea eax, [edi - 2]
mov dword [ebp - 0x40], eax
xor ebx, ebx
mov eax, dword [ebp - 0x38]
add eax, 2
cmp ebx, dword [ebp - 0x40]
jge 0x406c74
mov dl, byte [eax]
inc ebx
mov byte [eax - 2], dl
inc eax
cmp ebx, dword [ebp - 0x40]
jl 0x406c68
mov ebx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
add eax, ebx
cmp edi, ebx
jle 0x406c89
mov byte [eax], 0
inc ebx
inc eax
cmp edi, ebx
jg 0x406c80
mov edx, dword [esi + 4]
cmp byte [edx], 0x91
je 0x406c99
mov ecx, dword [esi + 4]
cmp byte [ecx], 0xce
jne 0x406ccf
cmp dword [esi + 0x14], 1
jne 0x406ccf
call fcn.004a2ec0
mov dword [ebp - 0x84], eax
push 1
call sub.KERNEL32.DLL_Sleep
mov eax, dword [0x539ee4]
mov eax, dword [eax]
call fcn.0044f854
call fcn.004a2ec0
sub eax, dword [ebp - 0x84]
cmp eax, 0xbb8
jle 0x406caa
mov edx, dword [esi + 4]
mov al, byte [edx]
cmp al, 0x98
je 0x406d10
cmp al, 0x9c
je 0x406d10
cmp al, 0x9e
je 0x406d10
cmp al, 0x9f
je 0x406d10
cmp al, 0xb0
je 0x406d10
cmp al, 0xb3
je 0x406d10
cmp al, 0xb4
je 0x406d10
cmp al, 0xc2
je 0x406d10
cmp al, 0xb1
je 0x406d10
cmp al, 0x9d
je 0x406d10
cmp al, 0xcc
je 0x406d10
cmp al, 0xc7
je 0x406d10
cmp al, 0xc8
je 0x406d10
cmp al, 0xc9
jne 0x406dc0
xor ebx, ebx
lea eax, [ebp - 0x2ec]
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 0x73]
mov ecx, dword [ebp - 0xb0]
mov dl, 0xff
sub dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ebx
inc dword [ebp - 0xb0]
cmp ebx, 3
jl 0x406d21
mov eax, dword [esi + 0x14]
add eax, 0x35
mov dword [ebp - 0x3c], eax
push 1
mov edx, dword [esi + 0x18]
push edx
mov ecx, dword [ebp - 0x3c]
push ecx
mov eax, dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x2ec]
mov edx, dword [esi + 0x14]
push edx
mov ecx, dword [ebp - 0x38]
push ecx
push 3
push eax
push esi
mov edx, dword [ebp + 8]
push edx
call fcn.0040580c
add esp, 0x28
mov edi, eax
test edi, edi
jge 0x406d97
inc edi
jne 0x406d81
mov dword [ebp - 0x34], 0x64
jmp 0x406d88
mov dword [ebp - 0x34], 6
mov eax, dword [ebp - 0x38]
push eax
call fcn.0049a104
pop ecx
jmp 0x407511
xor ebx, ebx
mov eax, dword [ebp - 0x38]
mov edx, eax
mov dword [ebp - 0xb0], edx
jmp 0x406dbb
mov ecx, dword [esi + 0x10]
mov eax, dword [ebp - 0xb0]
mov dl, byte [eax]
mov byte [ecx + ebx], dl
inc ebx
inc dword [ebp - 0xb0]
cmp ebx, dword [esi + 0x14]
jl 0x406da6
mov ecx, dword [esi + 4]
mov al, byte [ecx]
cmp al, 0xcb
je 0x406dd9
cmp al, 0xcd
je 0x406dd9
cmp al, 0xcf
je 0x406dd9
cmp al, 0xd3
jne 0x406f63
lea edx, [ebp - 0x73]
xor ebx, ebx
mov dword [ebp - 0xb0], edx
lea eax, [ebp - 0x2ec]
mov ecx, dword [ebp - 0xb0]
mov dl, 0xff
sub dl, byte [ecx]
mov byte [eax], dl
inc ebx
inc eax
inc dword [ebp - 0xb0]
cmp ebx, 3
jl 0x406dea
mov eax, dword [esi + 0x14]
mov edx, eax
mov ecx, eax
sar edx, 4
add ecx, 0x35
sar eax, 0
mov dword [ebp - 0x3c], ecx
and edx, 0xf
and eax, 0xf
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0xa8], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp - 0xa4]
add eax, ecx
mov edx, dword [ebp - 0xa8]
mov byte [eax + edx], 0
push 1
push 0xbb8
mov ecx, dword [ebp - 0x3c]
push ecx
mov eax, dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x2ec]
mov edx, dword [ebp - 0xa4]
push edx
mov ecx, dword [ebp - 0x38]
push ecx
push 3
push eax
push esi
mov edx, dword [ebp + 8]
push edx
call fcn.0040580c
add esp, 0x28
mov edi, eax
test edi, edi
jge 0x406e95
inc edi
jne 0x406e7f
mov dword [ebp - 0x34], 0x64
jmp 0x406e86
mov dword [ebp - 0x34], 6
mov eax, dword [ebp - 0x38]
push eax
call fcn.0049a104
pop ecx
jmp 0x407511
xor ebx, ebx
mov eax, dword [ebp - 0x38]
cmp ebx, dword [ebp - 0xa4]
jge 0x406eb4
mov edx, dword [esi + 0x10]
mov cl, byte [eax]
mov byte [edx + ebx], cl
inc ebx
inc eax
cmp ebx, dword [ebp - 0xa4]
jl 0x406ea2
mov eax, dword [esi + 0x10]
mov edx, dword [ebp - 0xa4]
lea ecx, [eax + edx]
mov eax, dword [ebp - 0xa8]
mov byte [ecx + eax], 1
push 1
mov edx, dword [esi + 0x18]
push edx
mov ecx, dword [ebp - 0x3c]
push ecx
mov eax, dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x2ec]
mov edx, dword [ebp - 0xa8]
push edx
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0xa4]
push ecx
push 3
push eax
push esi
mov edx, dword [ebp + 8]
push edx
call fcn.0040594c
add esp, 0x28
mov edi, eax
test edi, edi
jge 0x406f27
inc edi
jne 0x406f11
mov dword [ebp - 0x34], 0x64
jmp 0x406f18
mov dword [ebp - 0x34], 6
mov eax, dword [ebp - 0x38]
push eax
call fcn.0049a104
pop ecx
jmp 0x407511
mov ebx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x38]
add eax, ebx
jmp 0x406f3e
mov edx, dword [esi + 0x10]
mov cl, byte [eax]
mov byte [edx + ebx], cl
inc ebx
inc eax
mov edx, dword [ebp - 0xa4]
add edx, dword [ebp - 0xa8]
cmp ebx, edx
jl 0x406f34
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp - 0xa4]
add eax, ecx
mov edx, dword [ebp - 0xa8]
mov byte [eax + edx], 2
mov ecx, dword [esi + 4]
cmp byte [ecx], 0xb2
jne 0x407059
push 0xa
call sub.KERNEL32.DLL_Sleep
mov eax, dword [esi + 0xc]
push eax
mov edx, dword [esi + 8]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004035d4
add esp, 0xc
lea eax, [ebp - 0x2ec]
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 0x73]
xor ebx, ebx
mov dl, byte [eax]
mov ecx, dword [ebp - 0xb0]
mov byte [ecx], dl
inc ebx
inc dword [ebp - 0xb0]
inc eax
cmp ebx, 3
jl 0x406f9b
mov edx, dword [esi + 8]
xor eax, eax
mov ecx, edx
xor ebx, ebx
mov dword [ebp - 0xb0], ecx
jmp 0x406fd6
mov edx, dword [ebp - 0xb0]
xor ecx, ecx
mov cl, byte [edx]
add eax, ecx
inc ebx
inc dword [ebp - 0xb0]
cmp ebx, dword [esi + 0xc]
jl 0x406fc3
mov edx, eax
test edx, edx
jns 0x406fe7
add edx, 0xff
sar edx, 8
and dl, 0xff
and eax, 0x800000ff
mov byte [ebp - 0xaa], dl
jns 0x407001
dec eax
or eax, 0xffffff00
inc eax
and al, 0xff
lea edx, [ebp - 0x2ec]
mov byte [ebp - 0xa9], al
mov eax, dword [esi + 0x18]
push eax
mov ecx, dword [esi + 0x24]
push ecx
lea ecx, [ebp - 0xaa]
mov eax, dword [esi + 0x20]
push eax
push 3
push edx
push 2
push ecx
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.00405ac0
add esp, 0x24
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x407059
cmp dword [ebp - 0x30], 0xffffffff
jne 0x40704a
mov dword [ebp - 0x34], 0x64
mov edx, dword [ebp - 0x38]
push edx
call fcn.0049a104
pop ecx
jmp 0x407511
mov ecx, dword [esi + 4]
cmp byte [ecx], 0x9a
jne 0x407269
mov dword [ebp - 0x3c], 0x800
lea edx, [ebp - 0x73]
xor ebx, ebx
mov dword [ebp - 0xb0], edx
lea eax, [ebp - 0x2ec]
mov ecx, dword [ebp - 0xb0]
mov dl, 0xff
sub dl, byte [ecx]
mov byte [eax], dl
inc ebx
inc eax
inc dword [ebp - 0xb0]
cmp ebx, 3
jl 0x40707d
push 1
mov eax, dword [esi + 0x18]
push eax
mov ecx, dword [ebp - 0x3c]
add ecx, 3
push ecx
mov eax, dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x2ec]
mov edx, dword [ebp - 0x3c]
push edx
mov ecx, dword [ebp - 0x38]
push ecx
push 3
push eax
push esi
mov edx, dword [ebp + 8]
push edx
call fcn.0040580c
add esp, 0x28
mov edi, eax
test edi, edi
jge 0x4070ed
inc edi
jne 0x4070d7
mov dword [ebp - 0x34], 0x64
jmp 0x4070de
mov dword [ebp - 0x34], 0x12
mov eax, dword [ebp - 0x38]
push eax
call fcn.0049a104
pop ecx
jmp 0x407511
mov edx, dword [esi + 0x44]
xor ecx, ecx
mov dword [edx], ecx
test edi, edi
jle 0x407141
xor ebx, ebx
mov eax, dword [ebp - 0x38]
cmp edi, ebx
jle 0x40710f
mov edx, dword [esi + 0x48]
mov cl, byte [eax]
mov byte [edx + ebx], cl
inc ebx
inc eax
cmp edi, ebx
jg 0x407101
xor eax, eax
mov dword [ebp - 0x2c], eax
lea ebx, [edi - 0x10]
mov eax, dword [esi + 0x48]
add eax, ebx
cmp edi, ebx
jle 0x40712d
xor edx, edx
inc ebx
mov dl, byte [eax]
inc eax
add dword [ebp - 0x2c], edx
cmp edi, ebx
jg 0x407120
mov ecx, dword [esi + 0x44]
add dword [ecx], edi
cmp dword [ebp - 0x2c], 0xff0
je 0x40749c
xor edi, edi
mov eax, dword [ebp - 0x38]
push eax
call fcn.0049a104
pop ecx
mov byte [ebp - 0x7f], 0
call fcn.004a2ec0
mov dword [ebp - 0x84], eax
push 1
call sub.KERNEL32.DLL_Sleep
call fcn.00403fd0
cmp byte [esi + 0x39], 0
je 0x407178
mov dword [ebp - 0x34], 0x64
jmp 0x407511
cmp byte [ebp - 0x7f], 0
je 0x4071a0
xor ebx, ebx
jmp 0x407194
mov eax, dword [esi + 0x48]
lea edx, [eax + ebx]
mov ecx, dword [ebp - 0x3c]
mov dl, byte [edx + ecx]
push edx
pop edx
mov byte [eax + ebx], dl
inc ebx
mov eax, 0x100000
sub eax, dword [ebp - 0x3c]
cmp ebx, eax
jl 0x407182
mov ecx, dword [ebp - 0x3c]
push ecx
mov eax, dword [ebp - 0x3c]
push eax
push edi
mov edx, dword [esi + 0x48]
mov ecx, dword [esi + 0x44]
add edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00403678
add esp, 0x14
mov edi, eax
cmp edi, dword [ebp - 0x3c]
jne 0x407221
cmp byte [ebp - 0x7f], 0
jne 0x40721f
xor edx, edx
mov dword [ebp - 0x2c], edx
lea ebx, [edi - 0x10]
mov eax, dword [esi + 0x48]
add eax, ebx
cmp edi, ebx
jle 0x4071ef
mov edx, dword [esi + 0x44]
inc ebx
mov ecx, dword [edx]
xor edx, edx
mov dl, byte [eax + ecx]
inc eax
add dword [ebp - 0x2c], edx
cmp edi, ebx
jg 0x4071dc
cmp dword [ebp - 0x2c], 0xff0
jne 0x407202
mov eax, dword [esi + 0x44]
add dword [eax], edi
jmp 0x40749c
mov eax, dword [esi + 0x44]
mov ecx, 0x100000
sub ecx, edi
mov edx, dword [eax]
cmp edx, ecx
jge 0x407216
add dword [eax], edi
jmp 0x40721f
mov eax, dword [esi + 0x44]
sub dword [eax], edi
mov byte [ebp - 0x7f], 1
xor edi, edi
mov eax, dword [esi + 0x44]
lea ecx, [ebp - 0x1ec]
mov edx, dword [eax]
push edx
push 0x52b2a9
push ecx
call fcn.0049ddd8
add esp, 0xc
mov eax, dword [esi + 8]
cmp byte [eax + 9], 0
jne 0x407250
mov edx, dword [esi + 4]
cmp byte [edx], 0xb5
je 0x40715a
call fcn.004a2ec0
sub eax, dword [ebp - 0x84]
cmp eax, dword [esi + 0x18]
jg 0x40749c
jmp 0x40715a
mov ecx, dword [esi + 4]
mov al, byte [ecx]
cmp al, 0xb9
je 0x40727e
cmp al, 0xbd
je 0x40727e
cmp al, 0xc0
jne 0x407492
mov dword [ebp - 0x3c], 0x800
xor ebx, ebx
lea eax, [ebp - 0x2ec]
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 0x73]
mov ecx, dword [ebp - 0xb0]
mov dl, 0xff
sub dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ebx
inc dword [ebp - 0xb0]
cmp ebx, 3
jl 0x407296
push 1
mov eax, dword [esi + 0x18]
push eax
mov edx, dword [ebp - 0x3c]
add edx, 3
push edx
mov ecx, dword [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x2ec]
mov eax, dword [ebp - 0x3c]
push eax
mov edx, dword [ebp - 0x38]
push edx
push 3
push ecx
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.0040580c
add esp, 0x28
mov edi, eax
test edi, edi
jge 0x407306
inc edi
jne 0x4072f0
mov dword [ebp - 0x34], 0x64
jmp 0x4072f7
mov dword [ebp - 0x34], 0x12
mov eax, dword [ebp - 0x38]
push eax
call fcn.0049a104
pop ecx
jmp 0x407511
mov edx, dword [esi + 0x44]
xor ecx, ecx
mov dword [edx], ecx
test edi, edi
jle 0x40737c
mov eax, dword [ebp - 0x38]
xor ebx, ebx
mov edx, eax
cmp edi, ebx
mov dword [ebp - 0xb0], edx
jle 0x40733b
mov ecx, dword [esi + 0x48]
mov eax, dword [ebp - 0xb0]
mov dl, byte [eax]
mov byte [ecx + ebx], dl
inc ebx
inc dword [ebp - 0xb0]
cmp edi, ebx
jg 0x407322
mov ecx, dword [esi + 0x48]
mov al, byte [ecx + edi - 3]
cmp al, byte [ebp - 0x7c]
jne 0x407375
mov edx, dword [esi + 0x48]
mov cl, byte [edx + edi - 2]
cmp cl, byte [ebp - 0x7b]
jne 0x407375
mov eax, dword [esi + 0x48]
mov dl, byte [eax + edi - 1]
cmp dl, byte [ebp - 0x7a]
jne 0x407375
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.0049a104
pop ecx
mov dword [ebp - 0x34], 0x14
jmp 0x407511
mov eax, dword [esi + 0x44]
add dword [eax], edi
xor edi, edi
mov eax, dword [ebp - 0x38]
push eax
call fcn.0049a104
pop ecx
mov byte [ebp - 0x7f], 0
call fcn.004a2ec0
mov dword [ebp - 0x84], eax
push 1
call sub.KERNEL32.DLL_Sleep
call fcn.00403fd0
cmp byte [esi + 0x39], 0
je 0x4073b3
mov dword [ebp - 0x34], 0x64
jmp 0x407511
cmp byte [ebp - 0x7f], 0
je 0x4073df
xor ebx, ebx
jmp 0x4073cf
mov eax, dword [esi + 0x48]
lea edx, [eax + ebx]
mov ecx, dword [ebp - 0x3c]
mov dl, byte [edx + ecx]
push edx
pop edx
mov byte [eax + ebx], dl
inc ebx
mov eax, 0x100000
sub eax, dword [ebp - 0x3c]
cmp ebx, eax
jl 0x4073bd
mov byte [ebp - 0x7f], 0
mov ecx, dword [ebp - 0x3c]
push ecx
mov eax, dword [ebp - 0x3c]
push eax
push edi
mov edx, dword [esi + 0x48]
mov ecx, dword [esi + 0x44]
add edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00403678
add esp, 0x14
mov edi, eax
cmp edi, dword [ebp - 0x3c]
jne 0x40747d
mov edx, dword [esi + 0x44]
add dword [edx], edi
mov ecx, dword [esi + 0x44]
mov eax, dword [ecx]
mov edx, dword [esi + 0x48]
mov cl, byte [edx + eax - 3]
cmp cl, byte [ebp - 0x7c]
jne 0x40743e
mov edx, dword [esi + 0x48]
mov cl, byte [edx + eax - 2]
cmp cl, byte [ebp - 0x7b]
jne 0x40743e
mov edx, dword [esi + 0x48]
mov al, byte [edx + eax - 1]
cmp al, byte [ebp - 0x7a]
jne 0x40743e
mov dword [ebp - 0x34], 0x14
jmp 0x407511
mov ecx, dword [esi + 0x44]
mov eax, dword [ecx]
mov edx, dword [esi + 0x48]
mov cl, byte [edx + eax - 3]
cmp cl, byte [ebp - 0x79]
jne 0x407467
mov edx, dword [esi + 0x48]
mov cl, byte [edx + eax - 2]
cmp cl, byte [ebp - 0x78]
jne 0x407467
mov edx, dword [esi + 0x48]
mov cl, byte [edx + eax - 1]
cmp cl, byte [ebp - 0x77]
je 0x40749c
mov edx, 0x100000
sub edx, edi
cmp eax, edx
jl 0x40747b
mov eax, dword [esi + 0x44]
sub dword [eax], edi
mov byte [ebp - 0x7f], 1
xor edi, edi
call fcn.004a2ec0
sub eax, dword [ebp - 0x84]
cmp eax, dword [esi + 0x18]
jg 0x40749c
jmp 0x407395
mov eax, dword [ebp - 0x38]
push eax
call fcn.0049a104
pop ecx
mov edx, dword [esi + 4]
cmp byte [edx], 0xd1
je 0x4074bc
mov ecx, dword [esi + 4]
cmp byte [ecx], 0xd2
je 0x4074bc
push 6
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00403544
add esp, 0xc
cmp byte [esi + 0x1c], 3
je 0x4074c8
cmp byte [esi + 0x1c], 2
jne 0x4074df
mov edx, dword [ebp + 8]
push edx
call fcn.004036e0
pop ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
push eax
call fcn.00402b2c
pop ecx
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0xc]
call fcn.004a6e54
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x40754d
push 6
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403544
add esp, 0xc
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
push edx
call fcn.00402b2c
pop ecx
mov eax, dword [ebp - 0x34]
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004a6e54
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret