Function at 0x408bce
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
cmp dword [ebp + 0x28], 0x64
push ebx
push esi
push edi
jne 0x409269
cmp dword [ebp + 0x2c], 0x64
jne 0x409269
push dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalLock]
call ebx
mov esi, eax
test esi, esi
mov dword [ebp - 0x4c], esi
je 0x408c45
movzx eax, word [esi + 0xe]
cmp eax, 1
mov dword [ebp - 0x34], eax
je 0x408c1d
cmp eax, 4
je 0x408c1d
cmp eax, 8
je 0x408c1d
cmp eax, 0x18
jne 0x408c45
mov eax, dword [esi + 8]
mov edi, dword [esi + 4]
push 8
push eax
push edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x28], eax
call fcn.00404a52
add esp, 0xc
mov dword [ebp - 0x3c], eax
test eax, eax
jne 0x408c4c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push eax
call ebx
test eax, eax
mov dword [ebp - 0x44], eax
je 0x408c3c
mov eax, dword [ebp + 0x20]
push 0x64
imul eax, eax, 0x5fa
cdq
pop ecx
idiv ecx
xor ecx, ecx
mov dword [ebp - 0x58], eax
lea eax, [edi + edi*2]
mov dword [ebp + 0x28], eax
mov edi, 0xc0
mov eax, ecx
mov ebx, edi
and eax, edi
imul eax, eax, 0xff
add eax, 0x60
cdq
idiv ebx
mov ebx, 0xe0
mov byte [ebp + ecx - 0x25c], al
mov eax, ecx
and eax, 0x38
imul eax, eax, 0x3fc
add eax, 0x70
cdq
idiv ebx
mov ebx, edi
mov byte [ebp + ecx - 0x15c], al
mov eax, ecx
and eax, 6
imul eax, eax, 0x1fe0
add eax, 0x60
cdq
idiv ebx
inc ecx
mov edx, 0x100
cmp ecx, edx
mov byte [ebp + ecx - 0x35d], al
jl 0x408c75
mov ecx, dword [ebp - 0x44]
mov eax, dword [ecx]
add eax, ecx
xor ecx, ecx
inc eax
mov bl, byte [ebp + ecx - 0x25c]
inc ecx
mov byte [eax + 1], bl
mov bl, byte [ebp + ecx - 0x15d]
mov byte [eax], bl
mov bl, byte [ebp + ecx - 0x35d]
mov byte [eax - 1], bl
add eax, 4
cmp ecx, edx
jl 0x408cd9
mov edi, dword [esi]
add edi, esi
mov dword [ebp - 0x30], edi
call fcn.00406115
mov eax, dword [ebp + 0x28]
mov ebx, eax
shl ebx, 2
push ebx
mov dword [ebp - 0x54], ebx
call fcn.0042df00
push ebx
mov dword [ebp - 0xc], eax
call fcn.0042df00
push ebx
mov dword [ebp - 0x20], eax
call fcn.0042df00
add esp, 0xc
cmp dword [ebp - 0xc], 0
mov dword [ebp - 0x2c], eax
je 0x408c45
xor ebx, ebx
cmp dword [ebp - 0x20], ebx
je 0x408c45
cmp eax, ebx
je 0x408c45
cmp dword [esi + 0x10], 3
jne 0x408d5e
mov eax, dword [esi]
lea ecx, [eax + esi + 0xc]
jmp 0x408d68
mov eax, dword [esi + 0x20]
mov ecx, dword [esi]
lea ecx, [ecx + eax*4]
add ecx, esi
cmp dword [ebp - 0x10], ebx
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x18], ecx
mov dword [ebp + 0x28], ebx
jle 0x408e8a
lea edx, [ecx + 1]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x34]
dec eax
je 0x408e16
sub eax, 3
je 0x408dd1
sub eax, 4
je 0x408db6
sub eax, 0x10
jne 0x408e5c
movzx eax, byte [edx + 1]
mov dword [ebp + 0x2c], eax
movzx eax, byte [edx]
mov dword [ebp + 0x20], eax
movzx eax, byte [edx - 1]
mov dword [ebp - 8], eax
jmp 0x408e5c
movzx eax, byte [ebx + ecx]
movzx ebx, byte [edi + eax*4 + 2]
lea eax, [edi + eax*4]
mov dword [ebp + 0x2c], ebx
movzx ebx, byte [eax + 1]
movzx eax, byte [eax]
mov dword [ebp + 0x20], ebx
jmp 0x408dae
mov eax, ebx
push 2
cdq
pop ebx
idiv ebx
mov eax, dword [ebp + 0x28]
test edx, edx
cdq
jne 0x408ded
sub eax, edx
sar eax, 1
mov al, byte [eax + ecx]
shr al, 4
jmp 0x408df6
sub eax, edx
sar eax, 1
mov al, byte [eax + ecx]
and al, 0xf
movzx eax, al
movzx edx, byte [edi + eax*4 + 2]
lea eax, [edi + eax*4]
mov dword [ebp + 0x2c], edx
movzx edx, byte [eax + 1]
movzx eax, byte [eax]
mov dword [ebp + 0x20], edx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 8], eax
jmp 0x408e5c
mov eax, dword [ebp + 0x28]
push 8
cdq
pop ecx
mov bl, 1
idiv ecx
mov eax, dword [ebp + 0x28]
push 7
pop ecx
push 8
sub ecx, edx
shl bl, cl
cdq
pop ecx
idiv ecx
mov ecx, dword [ebp - 0x18]
and bl, byte [eax + ecx]
je 0x408e3b
mov bl, 1
movzx eax, bl
movzx ecx, byte [edi + eax*4 + 2]
lea eax, [edi + eax*4]
mov edx, dword [ebp - 0x14]
mov dword [ebp + 0x2c], ecx
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
mov dword [ebp + 0x20], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x2c]
mov ebx, dword [ebp + 0x28]
mov dword [esi], eax
mov eax, dword [ebp + 0x20]
add esi, 4
add edx, 3
mov dword [ebp - 0x14], edx
mov dword [esi], eax
mov eax, dword [ebp - 8]
add esi, 4
mov dword [esi], eax
add esi, 4
inc ebx
cmp ebx, dword [ebp - 0x10]
mov dword [ebp + 0x28], ebx
jl 0x408d80
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x28], 0
jle 0x409236
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], edi
dec eax
cmp edx, eax
je 0x408fe8
mov eax, dword [ebp - 0x4c]
cmp dword [eax + 0x10], 3
jne 0x408ec4
mov ecx, dword [eax]
lea ecx, [ecx + eax + 0xc]
jmp 0x408ece
mov ecx, dword [eax + 0x20]
mov esi, dword [eax]
lea ecx, [esi + ecx*4]
add ecx, eax
movzx esi, word [eax + 0xe]
imul esi, dword [eax + 4]
add esi, 0x1f
and dword [ebp + 0x28], 0
shr esi, 3
and esi, 0x1ffffffc
inc edx
imul esi, edx
add esi, ecx
cmp dword [ebp - 0x10], 0
jle 0x408fe8
lea ecx, [esi + 1]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x34]
dec eax
je 0x408f79
sub eax, 3
je 0x408f37
sub eax, 4
je 0x408f2e
sub eax, 0x10
jne 0x408fbb
movzx eax, byte [ecx + 1]
mov dword [ebp + 0x2c], eax
movzx eax, byte [ecx]
mov dword [ebp + 0x20], eax
movzx eax, byte [ecx - 1]
mov dword [ebp - 8], eax
jmp 0x408fbb
mov eax, dword [ebp + 0x28]
movzx eax, byte [eax + esi]
jmp 0x408f60
mov eax, dword [ebp + 0x28]
push 2
cdq
pop ebx
idiv ebx
mov eax, dword [ebp + 0x28]
test edx, edx
cdq
jne 0x408f54
sub eax, edx
sar eax, 1
mov al, byte [eax + esi]
shr al, 4
jmp 0x408f5d
sub eax, edx
sar eax, 1
mov al, byte [eax + esi]
and al, 0xf
movzx eax, al
mov edx, dword [ebp - 0x30]
lea eax, [edx + eax*4]
movzx edx, byte [eax + 2]
mov dword [ebp + 0x2c], edx
movzx edx, byte [eax + 1]
movzx eax, byte [eax]
mov dword [ebp + 0x20], edx
jmp 0x408f26
mov eax, dword [ebp + 0x28]
push 8
cdq
pop ecx
mov bl, 1
idiv ecx
mov eax, dword [ebp + 0x28]
push 7
pop ecx
push 8
sub ecx, edx
shl bl, cl
cdq
pop ecx
idiv ecx
and bl, byte [eax + esi]
je 0x408f9b
mov bl, 1
mov ecx, dword [ebp - 0x30]
movzx eax, bl
lea eax, [ecx + eax*4]
movzx ecx, byte [eax + 2]
mov dword [ebp + 0x2c], ecx
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
mov dword [ebp + 0x20], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x2c]
add ecx, 3
mov dword [edi], eax
mov eax, dword [ebp + 0x20]
add edi, 4
mov dword [ebp - 0x18], ecx
mov dword [edi], eax
mov eax, dword [ebp - 8]
add edi, 4
mov dword [edi], eax
add edi, 4
inc dword [ebp + 0x28]
mov eax, dword [ebp + 0x28]
cmp eax, dword [ebp - 0x10]
jl 0x408efc
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0x10], 3
jne 0x408ff9
mov ecx, dword [eax]
lea ecx, [ecx + eax + 0xc]
jmp 0x409003
mov ecx, dword [eax + 0x20]
mov edx, dword [eax]
lea ecx, [edx + ecx*4]
add ecx, eax
movzx esi, word [eax + 0xe]
imul esi, dword [eax + 4]
add esi, 0x1f
push dword [ebp - 0x54]
shr esi, 3
and esi, 0x1ffffffc
push dword [ebp - 0xc]
imul esi, dword [ebp - 0x14]
push dword [ebp - 0x2c]
add esi, ecx
call fcn.0042d5f0
mov edx, dword [ebp - 0x2c]
and dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0xc]
add esp, 0xc
cmp dword [ebp - 0x10], 0
mov dword [ebp - 0x18], edx
jle 0x409227
mov eax, dword [ebp - 0x20]
lea edi, [eax + 8]
jmp 0x409050
mov edx, dword [ebp - 0x18]
mov ebx, dword [ecx]
add ecx, 4
mov dword [ebp + 0x28], ebx
mov eax, 0xff
mov ebx, dword [ecx]
add ecx, 4
mov dword [ebp - 0x24], ebx
mov ebx, dword [ecx]
add ecx, 4
cmp dword [ebp + 0x28], 0
mov dword [ebp - 4], ebx
mov dword [ebp - 0x38], ecx
jge 0x40907a
and dword [ebp + 0x28], 0
cmp dword [ebp + 0x28], eax
jle 0x409082
mov dword [ebp + 0x28], eax
cmp dword [ebp - 0x24], 0
jge 0x40908c
and dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], eax
jle 0x409094
mov dword [ebp - 0x24], eax
cmp dword [ebp - 4], 0
jge 0x40909e
and dword [ebp - 4], 0
cmp dword [ebp - 4], eax
jle 0x4090a6
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0x24]
sar eax, 3
and eax, 0x18
and ebx, 0xe0
or eax, ebx
mov ebx, dword [ebp + 0x28]
sar eax, 2
and ebx, 0xc0
or eax, ebx
cmp dword [ebp + 0x24], 0
mov dword [ebp - 0x40], eax
je 0x40912e
mov eax, dword [edx]
mov ebx, dword [edx + 4]
movzx ecx, byte [ebp + 0x1c]
add edx, 4
mov dword [ebp - 0x48], eax
add edx, 4
mov eax, dword [edx]
add edx, 4
sub ecx, eax
mov dword [ebp - 0x18], edx
push ecx
call fcn.0042e0cb
mov edx, eax
movzx eax, byte [ebp + 0x18]
sub eax, ebx
mov ebx, edx
push eax
call fcn.0042e0cb
add ebx, eax
movzx eax, byte [ebp + 0x14]
sub eax, dword [ebp - 0x48]
push eax
call fcn.0042e0cb
add ebx, eax
add esp, 0xc
cmp ebx, dword [ebp - 0x58]
jg 0x409127
or byte [esi], 0xff
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
jmp 0x409130
mov eax, dword [ebp - 0x40]
mov byte [esi], al
jmp 0x409122
mov byte [esi], al
movzx edx, byte [ebp + eax - 0x25c]
mov ebx, 0x100
sub ebx, edx
movzx edx, byte [ebp + eax - 0x15c]
add dword [ebp + 0x28], ebx
mov ebx, 0x100
movzx eax, byte [ebp + eax - 0x35c]
sub ebx, edx
mov edx, dword [ebp - 0x24]
add edx, ebx
mov ebx, 0x100
sub ebx, eax
mov eax, dword [ebp - 0x10]
add dword [ebp - 4], ebx
dec eax
cmp dword [ebp - 0x1c], eax
je 0x409194
mov eax, dword [ebp + 0x28]
mov eax, dword [eax*4 + 0x453d78]
add dword [ecx], eax
mov eax, dword [edx*4 + 0x453d78]
add dword [ecx + 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x453d78]
add dword [ecx + 8], eax
mov eax, dword [ebp - 0x28]
dec eax
cmp dword [ebp - 0x14], eax
je 0x409217
mov eax, dword [ebp + 0x28]
shl eax, 2
shl edx, 2
mov ebx, dword [eax + 0x454578]
add dword [edi - 8], ebx
mov ebx, dword [edx + 0x454578]
add dword [edi - 4], ebx
mov ebx, dword [ebp - 4]
shl ebx, 2
mov dword [ebp + 0x28], ebx
mov ebx, dword [ebx + 0x454578]
add dword [edi], ebx
cmp dword [ebp - 0x1c], 0
jle 0x4091ed
mov ebx, dword [eax + 0x454d78]
add dword [edi - 0x14], ebx
mov ebx, dword [edx + 0x454d78]
add dword [edi - 0x10], ebx
mov ebx, dword [ebp + 0x28]
mov ebx, dword [ebx + 0x454d78]
add dword [edi - 0xc], ebx
mov ebx, dword [ebp - 0x10]
dec ebx
cmp dword [ebp - 0x1c], ebx
je 0x409214
mov eax, dword [eax + 0x455578]
add dword [edi + 4], eax
mov eax, dword [edx + 0x455578]
add dword [edi + 8], eax
mov eax, dword [ebp + 0x28]
mov eax, dword [eax + 0x455578]
add dword [edi + 0xc], eax
add edi, 0xc
inc dword [ebp - 0x1c]
inc esi
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x10]
jl 0x40904d
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jl 0x408e98
push dword [ebp - 0xc]
call fcn.0042deb8
push dword [ebp - 0x20]
call fcn.0042deb8
push dword [ebp - 0x2c]
call fcn.0042deb8
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
add esp, 0xc
push dword [ebp + 8]
call esi
push dword [ebp - 0x3c]
call esi
mov eax, dword [ebp - 0x3c]
jmp 0x408c47
push dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalLock]
call ebx
mov esi, eax
test esi, esi
mov dword [ebp - 0x3c], esi
je 0x408c45
movzx eax, word [esi + 0xe]
cmp eax, 1
mov dword [ebp - 0x38], eax
je 0x4092a0
cmp eax, 4
je 0x4092a0
cmp eax, 8
je 0x4092a0
cmp eax, 0x18
jne 0x408c45
mov eax, dword [esi + 4]
push 0x64
mov dword [ebp - 0x10], eax
imul eax, dword [ebp + 0x28]
xor edx, edx
pop edi
div edi
mov ecx, dword [esi + 8]
push 0x64
mov dword [ebp - 0x58], ecx
xor edx, edx
mov edi, eax
mov eax, ecx
imul eax, dword [ebp + 0x2c]
pop ecx
mov dword [ebp - 4], edi
div ecx
push 8
push eax
push edi
mov dword [ebp - 0x24], eax
call fcn.00404a52
add esp, 0xc
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x408c3c
push eax
call ebx
test eax, eax
mov dword [ebp - 0x40], eax
je 0x408c3c
mov eax, dword [ebp + 0x20]
push 0x64
imul eax, eax, 0x5fa
cdq
pop ecx
idiv ecx
xor ecx, ecx
mov dword [ebp - 0x5c], eax
lea eax, [edi + edi*2]
mov dword [ebp + 0x28], eax
mov edi, 0xc0
mov eax, ecx
xor edx, edx
and eax, edi
mov ebx, edi
imul eax, eax, 0xff
add eax, 0x60
div ebx
xor edx, edx
mov ebx, 0xe0
mov byte [ebp + ecx - 0x35c], al
mov eax, ecx
and eax, 0x38
imul eax, eax, 0x3fc
add eax, 0x70
div ebx
xor edx, edx
mov ebx, edi
mov byte [ebp + ecx - 0x15c], al
mov eax, ecx
and eax, 6
imul eax, eax, 0x1fe0
add eax, 0x60
div ebx
inc ecx
mov edx, 0x100
cmp ecx, edx
mov byte [ebp + ecx - 0x25d], al
jb 0x409310
mov eax, dword [ebp - 0x40]
xor ecx, ecx
add eax, dword [eax]
inc eax
mov bl, byte [ebp + ecx - 0x35c]
inc ecx
mov byte [eax + 1], bl
mov bl, byte [ebp + ecx - 0x15d]
mov byte [eax], bl
mov bl, byte [ebp + ecx - 0x25d]
mov byte [eax - 1], bl
add eax, 4
cmp ecx, edx
jb 0x409375
mov eax, esi
add eax, dword [esi]
mov dword [ebp - 0x20], eax
call fcn.00406115
mov eax, dword [ebp + 0x28]
mov edi, eax
shl edi, 2
push edi
mov dword [ebp - 0x50], edi
call fcn.0042df00
push edi
mov dword [ebp - 0x1c], eax
call fcn.0042df00
mov ebx, eax
push edi
mov dword [ebp - 0x18], ebx
call fcn.0042df00
xor ecx, ecx
add esp, 0xc
cmp dword [ebp - 0x1c], ecx
mov dword [ebp - 0x2c], eax
je 0x408c45
cmp ebx, ecx
je 0x408c45
cmp eax, ecx
je 0x408c45
cmp dword [esi + 0x10], 3
jne 0x4093fa
mov eax, dword [esi]
lea eax, [esi + eax + 0xc]
jmp 0x409402
mov eax, dword [esi + 0x20]
lea eax, [esi + eax*4]
add eax, dword [esi]
cmp dword [ebp - 4], ecx
mov dword [ebp + 0x2c], eax
mov dword [ebp + 0x20], ecx
mov dword [ebp - 0xc], ebx
jle 0x409501
mov edi, dword [ebp + 0x1c]
mov ebx, dword [ebp - 0x28]
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp + 0x20]
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
cmp esi, dword [ebp - 0x10]
jl 0x409436
mov eax, dword [ebp - 0x10]
lea esi, [eax - 1]
mov eax, dword [ebp - 0x38]
dec eax
je 0x40949c
sub eax, 3
je 0x40946d
sub eax, 4
je 0x409464
sub eax, 0x10
jne 0x4094d8
mov eax, dword [ebp + 0x2c]
lea eax, [eax + esi*2]
add esi, eax
movzx edi, byte [esi + 2]
movzx ebx, byte [esi + 1]
movzx eax, byte [esi]
jmp 0x4094d5
mov eax, dword [ebp + 0x2c]
movzx eax, byte [esi + eax]
jmp 0x4094c2
mov eax, esi
push 2
cdq
pop ecx
idiv ecx
mov eax, esi
test edx, edx
cdq
jne 0x40948b
mov ecx, dword [ebp + 0x2c]
sub eax, edx
sar eax, 1
mov al, byte [eax + ecx]
shr al, 4
jmp 0x409497
mov ecx, dword [ebp + 0x2c]
sub eax, edx
sar eax, 1
mov al, byte [eax + ecx]
and al, 0xf
movzx eax, al
jmp 0x4094c2
mov eax, esi
push 8
cdq
pop ecx
mov bl, 1
idiv ecx
push 7
mov eax, esi
pop ecx
push 8
sub ecx, edx
shl bl, cl
cdq
pop ecx
idiv ecx
mov ecx, dword [ebp + 0x2c]
and bl, byte [eax + ecx]
je 0x4094bf
mov bl, 1
movzx eax, bl
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + eax*4 + 2]
movzx ebx, byte [ecx + eax*4 + 1]
lea eax, [ecx + eax*4]
movzx eax, byte [eax]
mov dword [ebp + 0x28], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x28]
mov dword [eax], edi
add eax, 4
mov dword [eax], ebx
add eax, 4
mov dword [eax], ecx
add eax, 4
inc dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
cmp eax, dword [ebp - 4]
jl 0x40941a
xor ecx, ecx
cmp dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], ecx
jle 0x40998a
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x14]
dec eax
cmp ecx, eax
je 0x40973e
push dword [ebp - 0x24]
mov esi, dword [ebp - 0x58]
inc ecx
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
cmp eax, esi
jl 0x409541
lea eax, [esi - 1]
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx + 0x10], 3
jne 0x409552
mov edx, dword [ecx]
lea edx, [ecx + edx + 0xc]
jmp 0x40955a
mov edx, dword [ecx + 0x20]
lea edx, [ecx + edx*4]
add edx, dword [ecx]
mov ecx, dword [ebp - 0x3c]
xor ebx, ebx
movzx esi, word [ecx + 0xe]
imul esi, dword [ecx + 4]
add esi, 0x1f
shr esi, 3
and esi, 0x1ffffffc
imul esi, eax
add esi, edx
cmp dword [ebp - 4], ebx
jle 0x40973e
push dword [ebp - 4]
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov edi, eax
cmp edi, dword [ebp - 0x10]
jl 0x40959b
mov eax, dword [ebp - 0x10]
lea edi, [eax - 1]
push dword [ebp - 4]
lea eax, [ebx + 1]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
cmp eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jl 0x4095bd
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x4095c7
lea eax, [edi + 1]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x38]
sub edx, edi
xor ecx, ecx
xor ebx, ebx
dec eax
mov dword [ebp + 0x20], edx
mov dword [ebp + 0x28], ecx
mov dword [ebp - 0x28], ecx
je 0x4096a9
sub eax, 3
je 0x409650
sub eax, 4
je 0x409628
sub eax, 0x10
jne 0x40971a
cmp edi, dword [ebp - 8]
jge 0x409700
lea eax, [esi + edi*2]
mov dword [ebp + 0x2c], edx
lea eax, [edi + eax + 1]
movzx edx, byte [eax + 1]
add ebx, edx
movzx edx, byte [eax]
add ecx, edx
movzx edx, byte [eax - 1]
add dword [ebp + 0x28], edx
add eax, 3
dec dword [ebp + 0x2c]
jne 0x409609
jmp 0x409700
cmp edi, dword [ebp - 8]
jge 0x409700
movzx eax, byte [edi + esi]
mov edx, dword [ebp - 0x20]
lea eax, [edx + eax*4]
movzx edx, byte [eax + 2]
add ebx, edx
movzx edx, byte [eax + 1]
movzx eax, byte [eax]
add dword [ebp + 0x28], eax
add ecx, edx
inc edi
jmp 0x409628
cmp edi, dword [ebp - 8]
mov dword [ebp + 0x2c], edi
jge 0x409700
mov eax, dword [ebp + 0x2c]
push 2
cdq
pop edi
idiv edi
mov eax, dword [ebp + 0x2c]
test edx, edx
cdq
jne 0x40967a
sub eax, edx
sar eax, 1
movzx eax, byte [eax + esi]
shr eax, 4
jmp 0x409684
sub eax, edx
sar eax, 1
mov al, byte [eax + esi]
and eax, 0xf
mov edx, dword [ebp - 0x20]
lea eax, [edx + eax*4]
movzx edx, byte [eax + 2]
add ebx, edx
movzx edx, byte [eax + 1]
movzx eax, byte [eax]
add dword [ebp + 0x28], eax
add ecx, edx
inc dword [ebp + 0x2c]
mov eax, dword [ebp + 0x2c]
cmp eax, dword [ebp - 8]
jl 0x40965c
jmp 0x409700
cmp edi, dword [ebp - 8]
mov dword [ebp + 0x2c], edi
jge 0x409700
mov eax, dword [ebp + 0x2c]
push 8
cdq
pop ecx
idiv ecx
mov eax, dword [ebp + 0x2c]
push 7
pop ecx
push 1
pop edi
push 8
sub ecx, edx
shl edi, cl
cdq
pop ecx
idiv ecx
movzx eax, byte [eax + esi]
and edi, eax
je 0x4096d8
push 1
pop edi
mov eax, dword [ebp - 0x20]
movzx ecx, byte [eax + edi*4 + 2]
lea eax, [eax + edi*4]
add ebx, ecx
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
add dword [ebp - 0x28], ecx
add dword [ebp + 0x28], eax
inc dword [ebp + 0x2c]
mov eax, dword [ebp + 0x2c]
cmp eax, dword [ebp - 8]
jl 0x4096b1
mov ecx, dword [ebp - 0x28]
mov eax, ebx
cdq
idiv dword [ebp + 0x20]
mov ebx, eax
mov eax, ecx
cdq
idiv dword [ebp + 0x20]
mov ecx, eax
mov eax, dword [ebp + 0x28]
cdq
idiv dword [ebp + 0x20]
mov dword [ebp + 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], ebx
mov ebx, dword [ebp - 0x48]
add eax, 4
mov dword [eax], ecx
mov ecx, dword [ebp + 0x28]
add eax, 4
mov dword [eax], ecx
add eax, 4
cmp ebx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
jl 0x409581
mov eax, dword [ebp - 0x40]
cmp dword [eax + 0x10], 3
jne 0x40974f
mov ecx, dword [eax]
lea ecx, [eax + ecx + 0xc]
jmp 0x409757
mov ecx, dword [eax + 0x20]
lea ecx, [eax + ecx*4]
add ecx, dword [eax]
movzx esi, word [eax + 0xe]
imul esi, dword [eax + 4]
add esi, 0x1f
push dword [ebp - 0x50]
shr esi, 3
and esi, 0x1ffffffc
push dword [ebp - 0x1c]
imul esi, dword [ebp - 0x14]
push dword [ebp - 0x2c]
add esi, ecx
call fcn.0042d5f0
mov edx, dword [ebp - 0x2c]
and dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
cmp dword [ebp - 4], 0
mov dword [ebp - 0x44], edx
jle 0x40997b
mov eax, dword [ebp - 0x18]
lea edi, [eax + 8]
jmp 0x4097a4
mov edx, dword [ebp - 0x44]
mov ebx, dword [ecx]
add ecx, 4
mov dword [ebp + 0x28], ebx
mov eax, 0xff
mov ebx, dword [ecx]
add ecx, 4
mov dword [ebp + 0x20], ebx
mov ebx, dword [ecx]
add ecx, 4
cmp dword [ebp + 0x28], 0
mov dword [ebp + 0x2c], ebx
mov dword [ebp - 0x30], ecx
jge 0x4097ce
and dword [ebp + 0x28], 0
cmp dword [ebp + 0x28], eax
jle 0x4097d6
mov dword [ebp + 0x28], eax
cmp dword [ebp + 0x20], 0
jge 0x4097e0
and dword [ebp + 0x20], 0
cmp dword [ebp + 0x20], eax
jle 0x4097e8
mov dword [ebp + 0x20], eax
cmp dword [ebp + 0x2c], 0
jge 0x4097f2
and dword [ebp + 0x2c], 0
cmp dword [ebp + 0x2c], eax
jle 0x4097fa
mov dword [ebp + 0x2c], eax
mov eax, dword [ebp + 0x2c]
mov ebx, dword [ebp + 0x20]
sar eax, 3
and eax, 0x18
and ebx, 0xe0
or eax, ebx
mov ebx, dword [ebp + 0x28]
sar eax, 2
and ebx, 0xc0
or eax, ebx
cmp dword [ebp + 0x24], 0
mov dword [ebp - 0x34], eax
je 0x409882
mov eax, dword [edx]
mov ebx, dword [edx + 4]
movzx ecx, byte [ebp + 0x1c]
add edx, 4
mov dword [ebp - 0x54], eax
add edx, 4
mov eax, dword [edx]
add edx, 4
sub ecx, eax
mov dword [ebp - 0x44], edx
push ecx
call fcn.0042e0cb
mov edx, eax
movzx eax, byte [ebp + 0x18]
sub eax, ebx
mov ebx, edx
push eax
call fcn.0042e0cb
add ebx, eax
movzx eax, byte [ebp + 0x14]
sub eax, dword [ebp - 0x54]
push eax
call fcn.0042e0cb
add ebx, eax
add esp, 0xc
cmp ebx, dword [ebp - 0x5c]
jg 0x40987b
or byte [esi], 0xff
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
jmp 0x409884
mov eax, dword [ebp - 0x34]
mov byte [esi], al
jmp 0x409876
mov byte [esi], al
movzx edx, byte [ebp + eax - 0x35c]
mov ebx, 0x100
sub ebx, edx
movzx edx, byte [ebp + eax - 0x15c]
add dword [ebp + 0x28], ebx
mov ebx, 0x100
movzx eax, byte [ebp + eax - 0x25c]
sub ebx, edx
mov edx, dword [ebp + 0x20]
add edx, ebx
mov ebx, 0x100
sub ebx, eax
mov eax, dword [ebp - 4]
add dword [ebp + 0x2c], ebx
dec eax
cmp dword [ebp - 0xc], eax
je 0x4098e8
mov eax, dword [ebp + 0x28]
mov eax, dword [eax*4 + 0x453d78]
add dword [ecx], eax
mov eax, dword [edx*4 + 0x453d78]
add dword [ecx + 4], eax
mov eax, dword [ebp + 0x2c]
mov eax, dword [eax*4 + 0x453d78]
add dword [ecx + 8], eax
mov eax, dword [ebp - 0x24]
dec eax
cmp dword [ebp - 0x14], eax
je 0x40996b
mov eax, dword [ebp + 0x28]
shl eax, 2
shl edx, 2
mov ebx, dword [eax + 0x454578]
add dword [edi - 8], ebx
mov ebx, dword [edx + 0x454578]
add dword [edi - 4], ebx
mov ebx, dword [ebp + 0x2c]
shl ebx, 2
mov dword [ebp + 0x28], ebx
mov ebx, dword [ebx + 0x454578]
add dword [edi], ebx
cmp dword [ebp - 0xc], 0
jle 0x409941
mov ebx, dword [eax + 0x454d78]
add dword [edi - 0x14], ebx
mov ebx, dword [edx + 0x454d78]
add dword [edi - 0x10], ebx
mov ebx, dword [ebp + 0x28]
mov ebx, dword [ebx + 0x454d78]
add dword [edi - 0xc], ebx
mov ebx, dword [ebp - 4]
dec ebx
cmp dword [ebp - 0xc], ebx
je 0x409968
mov eax, dword [eax + 0x455578]
add dword [edi + 4], eax
mov eax, dword [edx + 0x455578]
add dword [edi + 8], eax
mov eax, dword [ebp + 0x28]
mov eax, dword [eax + 0x455578]
add dword [edi + 0xc], eax
add edi, 0xc
inc dword [ebp - 0xc]
inc esi
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jl 0x4097a1
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x24]
jl 0x40950d
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call esi
push dword [ebp - 0x4c]
call esi
push dword [ebp - 0x1c]
call fcn.0042deb8
push dword [ebp - 0x18]
call fcn.0042deb8
push dword [ebp - 0x2c]
call fcn.0042deb8
mov eax, dword [ebp - 0x4c]
add esp, 0xc
jmp 0x408c47