Function at 0x4166ef
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x407c
call fcn.0042c5a0
mov eax, dword [0x4a206c]
xor eax, esp
mov dword [esp + 0x4078], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], eax
push edi
xor edi, edi
mov dword [esp + 0x30], edx
push 0xffffffffffffffff
mov cl, byte [esi + 0x98]
mov bh, byte [esi + 0x99]
mov bl, byte [esi + 0x9a]
mov byte [esp + 0x27], cl
mov ecx, dword [esi + 0x94]
mov dword [eax], edi
lea eax, [esp + 0x84]
push dword [0x4b061c]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x2c], ecx
mov byte [esp + 0x17], bh
mov byte [esp + 0x16], bl
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4175ad
mov edx, dword [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0x2c], ecx
nop dword [eax]
cmp dword [0x4a2e48], 0
mov eax, dword [esp + 0x2c]
mov ecx, dword [edx + ecx*8]
mov dword [esp + 0x44], ecx
mov eax, dword [edx + eax*8 + 4]
mov dword [esp + 0x38], eax
jne 0x4163ae
test ecx, ecx
je 0x4163ae
push 0
push 0
push ecx
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
je 0x417508
lea esi, [edi*2 + 2]
mov eax, 0x2000
cmp eax, esi
mov dword [esp + 0x34], esi
sbb eax, eax
neg eax
mov dword [esp + 0x1c], eax
cmp esi, 0x2000
jbe 0x4162d7
push esi
call dword [0x4a2e1c]
add esp, 4
mov dword [esp + 0x14], eax
jmp 0x4162db
mov eax, dword [esp + 0x14]
push edi
push eax
push dword [esp + 0x4c]
push dword [esp + 0x44]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x4174e5
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 0x28], eax
mov edx, 0x2000
nop dword [eax]
mov esi, edi
sub esi, eax
cmp esi, 0x2000
cmova esi, edx
cmp dword [ecx], 0
jne 0x416361
push 0
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x1c]
push esi
lea eax, [ecx + eax*2]
push eax
mov eax, dword [esp + 0x28]
push dword [eax + 0x90]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
jne 0x416354
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
jmp 0x416358
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov edx, 0x2000
add eax, esi
mov dword [esp + 0x28], eax
cmp eax, edi
jb 0x416310
cmp dword [esp + 0x34], 0x2000
jbe 0x4163a3
call fcn.0044c2cd
push dword [esp + 0x14]
mov esi, dword [eax]
call dword [0x4a2e28]
add esp, 4
call fcn.0044c2cd
mov dword [esp + 0x1c], 0
mov dword [eax], esi
lea eax, [esp + 0x80]
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x18]
xor edi, edi
jmp 0x416702
xor eax, eax
mov dword [esp + 0x28], eax
test ecx, ecx
je 0x416706
nop dword [eax]
mov ecx, dword [esp + 0x38]
mov dh, bl
mov dl, byte [eax + ecx]
mov cl, byte [esp + 0x23]
mov al, dl
test cl, cl
jne 0x416417
not al
movzx eax, al
bsr eax, eax
mov dword [esp + 0x34], eax
je 0x41644d
cmp eax, 7
jne 0x4163eb
movzx ecx, dl
jmp 0x416452
cmp eax, 5
ja 0x41644d
mov ecx, 8
sub ecx, eax
mov eax, 0xff
sar eax, cl
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
movzx eax, dl
and ecx, eax
mov al, 6
sub al, byte [esp + 0x34]
mov byte [esp + 0x23], al
jmp 0x416436
and al, 0xc0
cmp al, 0x80
jne 0x416444
dec cl
movzx eax, dl
mov byte [esp + 0x23], cl
and eax, 0x3f
mov ecx, dword [esp + 0x24]
shl ecx, 6
or ecx, eax
mov al, byte [esp + 0x23]
mov dword [esp + 0x24], ecx
test al, al
jne case.0x41649c.27
jmp 0x416456
dec dword [esp + 0x28]
mov byte [esp + 0x23], 0
mov ecx, 0xfffd
mov dword [esp + 0x24], ecx
test bl, bl
jne 0x416480
cmp ecx, 0x1b
je 0x416479
cmp ecx, 0x9b
jne 0x416843
mov bl, 4
mov byte [esi + 0x9b], 0
jmp 0x4166eb
mov bl, 2
jmp 0x4166eb
cmp bl, 2
jne 0x416adb
lea eax, [ecx - 0x1b]
cmp eax, 0x48
ja case.0x41649c.28
movzx eax, byte [eax + 0x4175d4]
jmp dword [eax*4 + 0x4175b8]
mov bl, 8
jmp 0x4166eb
mov eax, dword [esp + 0x10]
xor ebx, ebx
mov ecx, 0x2000
mov esi, edi
sub esi, ebx
cmp esi, 0x2000
cmova esi, ecx
cmp dword [eax], 0
jne 0x416504
push 0
lea eax, [esp + 0x54]
push eax
mov eax, dword [esp + 0x1c]
push esi
lea eax, [eax + ebx*2]
push eax
mov eax, dword [esp + 0x28]
push dword [eax + 0x90]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
jne 0x4164fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, ecx
jmp 0x4164ff
mov eax, dword [esp + 0x10]
mov ecx, 0x2000
add ebx, esi
cmp ebx, edi
jb 0x4164b5
cmp dword [esp + 0x1c], 0
je 0x41653f
call fcn.0044c2cd
push dword [esp + 0x14]
mov esi, dword [eax]
call dword [0x4a2e28]
add esp, 4
call fcn.0044c2cd
mov dword [esp + 0x1c], 0
mov dword [eax], esi
lea eax, [esp + 0x80]
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x10]
xor eax, eax
xor edi, edi
mov dword [esp + 0x3c], eax
mov ax, word [0x4a2e38]
movzx ebx, ax
cmp dword [esi], edi
jne 0x416619
movzx eax, ax
push eax
mov eax, dword [esp + 0x1c]
push dword [eax + 0x90]
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
test eax, eax
jne 0x416585
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov esi, dword [esp + 0x18]
jmp 0x4166e5
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x3c]
push esi
push dword [eax + 0x90]
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
je 0x41660d
nop
lea eax, [esp + 0x68]
push eax
mov eax, dword [esp + 0x1c]
push dword [eax + 0x90]
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x41660d
movsx eax, word [esp + 0x68]
movsx ecx, word [esp + 0x6a]
imul ecx, eax
lea eax, [esp + 0x40]
push eax
mov eax, dword [esp + 0x1c]
push esi
push ecx
push 0x20
push dword [eax + 0x90]
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
test eax, eax
je 0x416602
lea eax, [esp + 0x40]
push eax
mov eax, dword [esp + 0x1c]
push esi
push dword [esp + 0x48]
push ebx
push dword [eax + 0x90]
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
jne 0x416622
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x4165a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov esi, dword [esp + 0x18]
jmp 0x4166e5
lea ecx, [esp + 0x68]
mov dword [0x4a2e44], edi
call fcn.00415830
mov esi, dword [esp + 0x18]
jmp 0x4166e5
mov eax, dword [esp + 0x10]
xor ebx, ebx
mov ecx, 0x2000
mov esi, edi
sub esi, ebx
cmp esi, 0x2000
cmova esi, ecx
cmp dword [eax], 0
jne 0x416694
push 0
lea eax, [esp + 0x58]
push eax
mov eax, dword [esp + 0x1c]
push esi
lea eax, [eax + ebx*2]
push eax
mov eax, dword [esp + 0x28]
push dword [eax + 0x90]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
jne 0x41668b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, ecx
jmp 0x41668f
mov eax, dword [esp + 0x10]
mov ecx, 0x2000
add ebx, esi
cmp ebx, edi
jb 0x416645
cmp dword [esp + 0x1c], 0
je 0x4166cf
call fcn.0044c2cd
push dword [esp + 0x14]
mov esi, dword [eax]
call dword [0x4a2e28]
add esp, 4
call fcn.0044c2cd
mov dword [esp + 0x1c], 0
mov dword [eax], esi
lea eax, [esp + 0x80]
mov dword [esp + 0x14], eax
push dword [esp + 0x10]
xor edi, edi
mov dl, 1
mov esi, dword [esp + 0x1c]
mov ecx, esi
call fcn.00416000
add esp, 4
mov bh, byte [esp + 0xf]
xor bl, bl
mov byte [esp + 0xe], bl
mov eax, dword [esp + 0x28]
inc eax
mov dword [esp + 0x28], eax
cmp eax, dword [esp + 0x44]
jb 0x4163c0
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
inc ecx
mov dword [esp + 0x2c], ecx
cmp ecx, 1
jb 0x416260
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edx, 0x2000
mov dword [esp + 0x2c], eax
nop word [eax + eax]
mov esi, edi
sub esi, eax
cmp esi, 0x2000
cmova esi, edx
cmp dword [ecx], 0
jne 0x417526
push 0
lea ecx, [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x1c]
push esi
lea eax, [ecx + eax*2]
push eax
mov eax, dword [esp + 0x28]
push dword [eax + 0x90]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
jne 0x417519
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
jmp 0x41751d
mov eax, dword [esp + 0x10]
xor ebx, ebx
mov ecx, 0x2000
nop word [eax + eax]
mov esi, edi
sub esi, ebx
cmp esi, 0x2000
cmova esi, ecx
cmp dword [eax], 0
jne 0x4167df
push 0
lea eax, [esp + 0x5c]
push eax
mov eax, dword [esp + 0x1c]
push esi
lea eax, [eax + ebx*2]
push eax
mov eax, dword [esp + 0x28]
push dword [eax + 0x90]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
jne 0x4167d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, ecx
jmp 0x4167da
mov eax, dword [esp + 0x10]
mov ecx, 0x2000
add ebx, esi
cmp ebx, edi
jb 0x416790
cmp dword [esp + 0x1c], 0
je 0x41681a
call fcn.0044c2cd
push dword [esp + 0x14]
mov esi, dword [eax]
call dword [0x4a2e28]
add esp, 4
call fcn.0044c2cd
mov dword [esp + 0x1c], 0
mov dword [eax], esi
lea eax, [esp + 0x80]
mov dword [esp + 0x14], eax
push dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
mov dl, 1
mov ecx, esi
xor edi, edi
call fcn.004160b0
jmp 0x4166e2
lea eax, [ecx - 0x40]
cmp eax, 0x1f
jbe case.0x416bfb.73
mov byte [esp + 0xe], 0
cmp ecx, 0xffff
jbe 0x416855
mov dword [esp + 0x24], 0xfffd
jmp 0x416867
cmp ecx, 0xa
je 0x4169a1
cmp ecx, 0xd
je 0x41692c
mov ecx, 0x2000
mov eax, ecx
sub eax, edi
cmp eax, 1
jae 0x416910
mov eax, dword [esp + 0x10]
xor ebx, ebx
nop
mov esi, edi
sub esi, ebx
cmp esi, 0x2000
cmova esi, ecx
cmp dword [eax], 0
jne 0x4168cf
push 0
lea eax, [esp + 0x60]
push eax
mov eax, dword [esp + 0x1c]
push esi
lea eax, [eax + ebx*2]
push eax
mov eax, dword [esp + 0x28]
push dword [eax + 0x90]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
jne 0x4168c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, ecx
jmp 0x4168ca
mov eax, dword [esp + 0x10]
mov ecx, 0x2000
add ebx, esi
cmp ebx, edi
jb 0x416880
cmp dword [esp + 0x1c], 0
je 0x41690a
call fcn.0044c2cd
push dword [esp + 0x14]
mov esi, dword [eax]
call dword [0x4a2e28]
add esp, 4
call fcn.0044c2cd
mov dword [esp + 0x1c], 0
mov dword [eax], esi
lea eax, [esp + 0x80]
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x18]
xor edi, edi
mov eax, dword [esp + 0x24]
mov bl, byte [esp + 0xe]
mov word [esp + edi*2 + 0x80], ax
inc edi
xor bh, bh
mov byte [esp + 0xf], bh
jmp case.0x41649c.27
cmp bh, 0xa
je 0x416acc
mov edx, 0x2000
mov eax, edx
sub eax, edi
cmp eax, 1
jae 0x416ac3
mov eax, dword [esp + 0x10]
xor ebx, ebx
nop dword [eax]
mov esi, edi
sub esi, ebx
cmp esi, 0x2000
cmova esi, edx
cmp dword [eax], 0
jne 0x416a7a
push 0
lea eax, [esp + 0x68]
push eax
mov eax, dword [esp + 0x1c]
push esi
lea eax, [eax + ebx*2]
push eax
mov eax, dword [esp + 0x28]
push dword [eax + 0x90]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
jne 0x416a71
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, ecx
jmp 0x416a75
cmp bh, 0xd
je 0x416935
mov edx, 0x2000
mov eax, edx
sub eax, edi
cmp eax, 2
jae 0x416a54
mov eax, dword [esp + 0x10]
xor ebx, ebx
nop
mov esi, edi
sub esi, ebx
cmp esi, 0x2000
cmova esi, edx
cmp dword [eax], 0
jne 0x416a0f
push 0
lea eax, [esp + 0x64]
push eax
mov eax, dword [esp + 0x1c]
push esi
lea eax, [eax + ebx*2]
push eax
mov eax, dword [esp + 0x28]
push dword [eax + 0x90]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
jne 0x416a06
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, ecx
jmp 0x416a0a
mov eax, dword [esp + 0x10]
mov edx, 0x2000
add ebx, esi
cmp ebx, edi
jb 0x4169c0
cmp dword [esp + 0x1c], 0
je 0x416a4a
call fcn.0044c2cd
push dword [esp + 0x14]
mov esi, dword [eax]
call dword [0x4a2e28]
add esp, 4
call fcn.0044c2cd
mov dword [esp + 0x1c], 0
mov dword [eax], esi
lea eax, [esp + 0x80]
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x18]
xor edi, edi
mov ecx, dword [esp + 0x24]
mov bl, byte [esp + 0xe]
mov bh, cl
mov dword [esp + edi*2 + 0x80], 0xa000d
add edi, 2
mov byte [esp + 0xf], bh
jmp case.0x41649c.27
mov eax, dword [esp + 0x10]
mov edx, 0x2000
add ebx, esi
cmp ebx, edi
jb 0x416950
cmp dword [esp + 0x1c], 0
je 0x416ab9
call fcn.0044c2cd
push dword [esp + 0x14]
mov esi, dword [eax]
call dword [0x4a2e28]
add esp, 4
call fcn.0044c2cd
mov dword [esp + 0x1c], 0
mov dword [eax], esi
lea eax, [esp + 0x80]
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x18]
xor edi, edi
mov ecx, dword [esp + 0x24]
mov word [esp + edi*2 + 0x80], cx
inc edi
mov bl, byte [esp + 0xe]
mov bh, cl
mov byte [esp + 0xf], bh
jmp case.0x41649c.27
test bl, 4
je 0x417471
test bl, 0x10
jne 0x41745e
lea eax, [ecx - 0x30]
cmp eax, 9
ja 0x416b64
test bl, 0x20
jne 0x416b2a
mov al, byte [esi + 0x9b]
cmp al, 4
jb 0x416b0c
or bl, 0x10
jmp 0x4166eb
inc al
or bl, 0x20
mov byte [esi + 0x9b], al
add ecx, 0xffffffd0
movzx eax, al
mov word [esi + eax*2 + 0x9a], cx
jmp 0x4166eb
movzx eax, byte [esi + 0x9b]
lea ecx, [esi + eax*2]
movzx eax, word [ecx + 0x9a]
lea eax, [eax + eax*4]
add eax, eax
cmp eax, 0xffff
jbe 0x416b4f
or bl, 0x10
jmp 0x4166eb
mov edx, dword [esp + 0x24]
add eax, 0xffffffd0
add eax, edx
mov word [ecx + 0x9a], ax
jmp case.0x41649c.27
cmp ecx, 0x3b
jne 0x416ba2
test bl, 0x20
je 0x416b76
and bl, 0xdf
jmp 0x4166eb
mov al, byte [esi + 0x9b]
cmp al, 4
jb 0x416b88
or bl, 0x10
jmp 0x4166eb
inc al
xor ecx, ecx
mov byte [esi + 0x9b], al
movzx eax, al
mov word [esi + eax*2 + 0x9a], cx
jmp case.0x41649c.27
cmp ecx, 0x3f
jne 0x416bc5
test bl, 0x20
jne 0x416b04
cmp byte [esi + 0x9b], 0
je case.0x41649c.27
or bl, 0x10
jmp 0x4166eb
lea eax, [ecx - 0x40]
cmp eax, 0x3e
ja 0x416b04
mov cl, byte [esi + 0x9b]
mov eax, dword [esp + 0x24]
test cl, cl
jne 0x416be8
cmp eax, 0x5b
je 0x416b04
add eax, 0xffffffbf
cmp eax, 0x34
ja case.0x416bfb.73
movzx eax, byte [eax + 0x417660]
jmp dword [eax*4 + 0x417620]
xor ebx, ebx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov esi, edi
sub esi, ebx
mov eax, 0x2000
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x18]
push esi
lea edx, [eax + ebx*2]
call fcn.00415950
add ebx, esi
add esp, 8
cmp ebx, edi
jb 0x416c04
cmp dword [esp + 0x1c], 0
je 0x416c57
mov ecx, dword [esp + 0x14]
call fcn.00411da0
lea eax, [esp + 0x80]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x18]
xor edi, edi
cmp byte [esi + 0x9b], 0
je 0x416c6f
movzx eax, word [esi + 0x9c]
jmp 0x416c74
mov eax, 1
push dword [esp + 0x10]
neg eax
xor edx, edx
push 1
push eax
push 1
mov ecx, esi
call fcn.00415990
add esp, 0x10
jmp 0x4166e5
xor ebx, ebx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov esi, edi
sub esi, ebx
mov eax, 0x2000
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x18]
push esi
lea edx, [eax + ebx*2]
call fcn.00415950
add ebx, esi
add esp, 8
cmp ebx, edi
jb 0x416c92
cmp dword [esp + 0x1c], 0
je 0x416ce5
mov ecx, dword [esp + 0x14]
call fcn.00411da0
lea eax, [esp + 0x80]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x18]
xor edi, edi
cmp byte [esi + 0x9b], 0
je 0x416cfd
movzx eax, word [esi + 0x9c]
jmp 0x416d02
mov eax, 1
push dword [esp + 0x10]
xor edx, edx
mov ecx, esi
push 1
push eax
push 1
call fcn.00415990
add esp, 0x10
jmp 0x4166e5
xor ebx, ebx
nop
push dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov esi, edi
sub esi, ebx
mov eax, 0x2000
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x18]
push esi
lea edx, [eax + ebx*2]
call fcn.00415950
add ebx, esi
add esp, 8
cmp ebx, edi
jb 0x416d20
cmp dword [esp + 0x1c], 0
je 0x416d73
mov ecx, dword [esp + 0x14]
call fcn.00411da0
lea eax, [esp + 0x80]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x18]
xor edi, edi
cmp byte [esi + 0x9b], 0
je 0x416d8b
movzx edx, word [esi + 0x9c]
jmp 0x416d90
mov edx, 1
push dword [esp + 0x10]
mov ecx, esi
push 1
push 0
push 1
call fcn.00415990
add esp, 0x10
jmp 0x4166e5
xor ebx, ebx
nop dword [eax + eax]
push dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov esi, edi
sub esi, ebx
mov eax, 0x2000
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x18]
push esi
lea edx, [eax + ebx*2]
call fcn.00415950
add ebx, esi
add esp, 8
cmp ebx, edi
jb 0x416db0
cmp dword [esp + 0x1c], 0
je 0x416e03
mov ecx, dword [esp + 0x14]
call fcn.00411da0
lea eax, [esp + 0x80]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x18]
xor edi, edi
cmp byte [esi + 0x9b], 0
je 0x416e1b
movzx edx, word [esi + 0x9c]
jmp 0x416e20
mov edx, 1
push dword [esp + 0x10]
neg edx
mov ecx, esi
push 1
push 0
push 1
call fcn.00415990
add esp, 0x10
jmp 0x4166e5
xor ebx, ebx
nop dword [eax]
push dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov esi, edi
sub esi, ebx
mov eax, 0x2000
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x18]
push esi
lea edx, [eax + ebx*2]
call fcn.00415950
add ebx, esi
add esp, 8
cmp ebx, edi
jb 0x416e40
cmp dword [esp + 0x1c], 0
je 0x416e93
mov ecx, dword [esp + 0x14]
call fcn.00411da0
lea eax, [esp + 0x80]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x18]
xor edi, edi
cmp byte [esi + 0x9b], 0
je 0x416eab
movzx eax, word [esi + 0x9c]
jmp 0x416eb0
mov eax, 1
push dword [esp + 0x10]
xor edx, edx
mov ecx, esi
push 1
push eax
push 0
call fcn.00415990
add esp, 0x10
jmp 0x4166e5
xor ebx, ebx
nop dword [eax]
push dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov esi, edi
sub esi, ebx
mov eax, 0x2000
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x18]
push esi
lea edx, [eax + ebx*2]
call fcn.00415950
add ebx, esi
add esp, 8
cmp ebx, edi
jb 0x416ed0
cmp dword [esp + 0x1c], 0
je 0x416f23
mov ecx, dword [esp + 0x14]
call fcn.00411da0
lea eax, [esp + 0x80]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x18]
xor edi, edi
cmp byte [esi + 0x9b], 0
je 0x416f3b
movzx eax, word [esi + 0x9c]
jmp 0x416f40
mov eax, 1
push dword [esp + 0x10]
neg eax
xor edx, edx
push 1
push eax
push 0
mov ecx, esi
call fcn.00415990
add esp, 0x10
jmp 0x4166e5
xor ebx, ebx
nop
push dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov esi, edi
sub esi, ebx
mov eax, 0x2000
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x18]
push esi
lea edx, [eax + ebx*2]
call fcn.00415950
add ebx, esi
add esp, 8
cmp ebx, edi
jb 0x416f60
cmp dword [esp + 0x1c], 0
je 0x416fb3
mov ecx, dword [esp + 0x14]
call fcn.00411da0
lea eax, [esp + 0x80]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x18]
xor edi, edi
cmp byte [esi + 0x9b], 1
jb 0x416fd3
movzx eax, word [esi + 0x9c]
test ax, ax
je 0x416fd3
lea edx, [eax - 1]
jmp 0x416fd5
xor edx, edx
push dword [esp + 0x10]
mov ecx, esi
push 1
push 0
push 0
call fcn.00415990
add esp, 0x10
jmp 0x4166e5
mov eax, dword [esp + 0x10]
xor ebx, ebx
mov ecx, 0x2000
nop dword [eax]
mov esi, edi
sub esi, ebx
cmp esi, 0x2000
cmova esi, ecx
cmp dword [eax], 0
jne 0x41704f
push 0
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esp + 0x1c]
push esi
lea eax, [eax + ebx*2]
push eax
mov eax, dword [esp + 0x28]
push dword [eax + 0x90]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
jne 0x417046
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, ecx
jmp 0x41704a
mov eax, dword [esp + 0x10]
mov ecx, 0x2000
add ebx, esi
cmp ebx, edi
jb 0x417000
cmp dword [esp + 0x1c], 0
je 0x417078
mov ecx, dword [esp + 0x14]
call fcn.00411da0
lea eax, [esp + 0x80]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x18]
xor edi, edi
mov cl, byte [esi + 0x9b]
cmp cl, 1
jb 0x417098
movzx eax, word [esi + 0x9c]
test ax, ax
je 0x417098
dec eax
jmp 0x41709a
xor eax, eax
cmp cl, 2
jb 0x4170b0
movzx ecx, word [esi + 0x9e]
test cx, cx
je 0x4170b0
lea edx, [ecx - 1]
jmp 0x4170b2
xor edx, edx
push dword [esp + 0x10]
mov ecx, esi
push 0
push eax
push 0
call fcn.00415990
add esp, 0x10
jmp 0x4166e5
xor ebx, ebx
nop dword [eax]
push dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov esi, edi
sub esi, ebx
mov eax, 0x2000
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x18]
push esi
lea edx, [eax + ebx*2]
call fcn.00415950
add ebx, esi
add esp, 8
cmp ebx, edi
jb 0x4170d0
cmp dword [esp + 0x1c], 0
je 0x417123
mov ecx, dword [esp + 0x14]
call fcn.00411da0
lea eax, [esp + 0x80]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x18]
xor edi, edi
cmp byte [esi + 0x9b], 0
je 0x417157
movzx edx, word [esi + 0x9c]
cmp edx, 2
ja 0x4166e5
push dword [esp + 0x10]
mov ecx, esi
push 1
call fcn.00415b00
add esp, 8
jmp 0x4166e5
push dword [esp + 0x10]
xor edx, edx
mov ecx, esi
push 1
call fcn.00415b00
add esp, 8
jmp 0x4166e5
xor ebx, ebx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov esi, edi
sub esi, ebx
mov eax, 0x2000
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x18]
push esi
lea edx, [eax + ebx*2]
call fcn.00415950
add ebx, esi
add esp, 8
cmp ebx, edi
jb 0x417170
cmp dword [esp + 0x1c], 0
je 0x4171c3
mov ecx, dword [esp + 0x14]
call fcn.00411da0
lea eax, [esp + 0x80]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x18]
xor edi, edi
cmp byte [esi + 0x9b], 0
je 0x4171f6
movzx edx, word [esi + 0x9c]
cmp edx, 2
ja 0x4166e5
push dword [esp + 0x10]
mov ecx, esi
push edi
call fcn.00415b00
add esp, 8
jmp 0x4166e5
push dword [esp + 0x10]
xor edx, edx
mov ecx, esi
push edx
call fcn.00415b00
add esp, 8
jmp 0x4166e5
xor ebx, ebx
nop
push dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov esi, edi
sub esi, ebx
mov eax, 0x2000
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x18]
push esi
lea edx, [eax + ebx*2]
call fcn.00415950
add ebx, esi
add esp, 8
cmp ebx, edi
jb 0x417210
cmp dword [esp + 0x1c], 0
je 0x417263
mov ecx, dword [esp + 0x14]
call fcn.00411da0
lea eax, [esp + 0x80]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x18]
xor edi, edi
mov edx, dword [esp + 0x10]
mov ecx, esi
call fcn.00415c90
jmp 0x4166e5
xor ebx, ebx
nop dword [eax + eax]
push dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov esi, edi
sub esi, ebx
mov eax, 0x2000
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x18]
push esi
lea edx, [eax + ebx*2]
call fcn.00415950
add ebx, esi
add esp, 8
cmp ebx, edi
jb 0x417280
cmp dword [esp + 0x1c], 0
je 0x4172d3
mov ecx, dword [esp + 0x14]
call fcn.00411da0
lea eax, [esp + 0x80]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], eax
push dword [esp + 0x10]
xor edi, edi
xor dl, dl
jmp 0x4166d7
xor ebx, ebx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov esi, edi
sub esi, ebx
mov eax, 0x2000
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x18]
push esi
lea edx, [eax + ebx*2]
call fcn.00415950
add ebx, esi
add esp, 8
cmp ebx, edi
jb 0x4172e2
cmp dword [esp + 0x1c], 0
je 0x417335
mov ecx, dword [esp + 0x14]
call fcn.00411da0
lea eax, [esp + 0x80]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], eax
push dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
xor dl, dl
mov ecx, esi
xor edi, edi
call fcn.004160b0
jmp 0x4166e2
cmp cl, 1
jne case.0x416bfb.73
cmp word [esi + 0x9c], 0x19
jne case.0x416bfb.73
xor ebx, ebx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov esi, edi
sub esi, ebx
mov eax, 0x2000
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x18]
push esi
lea edx, [eax + ebx*2]
call fcn.00415950
add ebx, esi
add esp, 8
cmp ebx, edi
jb 0x417366
cmp dword [esp + 0x1c], 0
je 0x4173b9
mov ecx, dword [esp + 0x14]
call fcn.00411da0
lea eax, [esp + 0x80]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x18]
xor edx, edx
push dword [esp + 0x10]
mov ecx, esi
xor edi, edi
call fcn.00416170
jmp 0x4166e2
cmp cl, 1
jne case.0x416bfb.73
cmp word [esi + 0x9c], 0x19
jne case.0x416bfb.73
xor ebx, ebx
nop word [eax + eax]
push dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov esi, edi
sub esi, ebx
mov eax, 0x2000
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x18]
push esi
lea edx, [eax + ebx*2]
call fcn.00415950
add ebx, esi
add esp, 8
cmp ebx, edi
jb 0x4173f0
cmp dword [esp + 0x1c], 0
je 0x417443
mov ecx, dword [esp + 0x14]
call fcn.00411da0
lea eax, [esp + 0x80]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x18]
mov edx, 1
push dword [esp + 0x10]
mov ecx, esi
xor edi, edi
call fcn.00416170
jmp 0x4166e2
lea eax, [ecx - 0x40]
mov ecx, 0x3e
cmp ecx, eax
sbb bl, bl
and bl, dh
jmp 0x4166eb
test bl, 8
je 0x4175ad
test bl, 0x40
je 0x4174a9
test bl, bl
js 0x4174a1
cmp ecx, 0x22
jne 0x417490
and bl, 0xbf
jmp 0x4166eb
cmp ecx, 0x5c
jne case.0x41649c.27
or bl, 0x80
jmp 0x4166eb
and bl, 0x7f
jmp 0x4166eb
cmp ecx, 7
je case.0x416bfb.73
cmp ecx, 0x5c
jne 0x4174c8
test bl, 2
jne case.0x416bfb.73
and bl, 0xfd
jmp 0x4166eb
cmp ecx, 0x1b
jne 0x4174d5
or bl, 2
jmp 0x4166eb
cmp ecx, 0x22
jne 0x4174c0
and bl, 0x3d
or bl, 0x40
jmp 0x4166eb
cmp esi, 0x2000
jbe 0x417508
call fcn.0044c2cd
push dword [esp + 0x14]
mov esi, dword [eax]
call dword [0x4a2e28]
add esp, 4
call fcn.0044c2cd
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
jmp 0x41671c
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
mov edx, 0x2000
add eax, esi
mov dword [esp + 0x2c], eax
cmp eax, edi
jb 0x416730
cmp dword [esp + 0x1c], 0
je 0x417556
call fcn.0044c2cd
push dword [esp + 0x14]
mov esi, dword [eax]
call dword [0x4a2e28]
add esp, 4
call fcn.0044c2cd
mov dword [eax], esi
mov eax, dword [esp + 0x18]
mov cl, byte [esp + 0x23]
push 0
push 1
mov byte [eax + 0x98], cl
mov ecx, dword [esp + 0x2c]
mov dword [eax + 0x94], ecx
mov byte [eax + 0x99], bh
mov byte [eax + 0x9a], bl
push dword [0x4b061c]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x4175b2
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x4084]
pop edi
pop esi
mov eax, dword [eax]
neg eax
pop ebx
sbb eax, eax
xor ecx, esp
call fcn.0042b571
mov esp, ebp
pop ebp
ret
call fcn.0044ca25
call fcn.0044ca25
nop
out dx, eax
inc cx
add byte [edx], bh
inc cx
add byte [edi + 0x67], bh
inc ecx
add byte [ebx + 0x6b004164], ah
inc ecx
add byte [edx + 0x32004164], ch
push 0x6000041
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
add dword [edx], eax
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
add eax, dword [esi]
push es
push es
push es
push es
push es
push es
push es
push es
push es
add al, 6
add eax, dword [ebx]
add eax, dword [esi]
push es
push es
add eax, 33562383
insb byte es:[edi], dx
inc ecx
add byte [eax + 0x1c00416c], dl
insd dword es:[edi], dx
inc ecx
add byte [ecx + 0x3b00416d], ch
outsb dx, byte [esi]
inc ecx
add dl, cl
outsb dx, byte [esi]
inc ecx
add byte [edi + ebp*2 + 0x41], bl
add dh, ch
outsd dx, dword [esi]
inc ecx
add dl, cl
jo 0x417684
add byte [esi + 0x71], ch
inc ecx
add cl, dl
jae 0x41768c
add byte [ebp + 0x73], cl
inc ecx
add byte [edx + esi*2], cl
inc ecx
add byte [ecx + 0x72], bh
inc ecx
add al, ah
jb 0x41769c
add cl, ch
inc cx
add byte [eax], al
add dword [edx], eax
add eax, dword [eax + 135202566]
or dword [edi], ecx
invalid
sysret
or al, 0xf
invalid
int3