Function at 0x40566c
Capabilities:
Access peb ldr_data
Authenticate hmac
Check os version
Encode data using base64
Encrypt data using speck
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x1c], esi
xor edi, esi
mov ecx, dword [ebp - 0x50]
lea eax, [eax + 0x21]
add ebx, edi
cmp byte [ecx + 0x1e], 0
jne 0x404e3c
sub ecx, dword [ebp - 0x44]
sub edi, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x30]
xor edi, dword [ebp - 0x5c]
push dword [ecx - 4]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x28], 0xffffffcf
jne 0x4049c7
mov ecx, dword [ebp - 0x30]
or edi, eax
test dword [ebp - 0x28], 0
je 0x4049df
mov eax, edi
mov edi, edi
push ebp
mov ebp, esp
push dword [ecx - 0x98]
call fcn.004075b1
sub edi, dword [ebp - 0x38]
lea edi, [ebp - 0x68]
push edi
mov edi, dword [ebp - 0x50]
push dword [edi + 0x24]
call fcn.0040456b
sub ebx, dword [ebp - 0x5c]
cmp dword [ebp - 0x28], 0x30
jne 0x404a17
test byte [ebp + 8], 1
je 0x4049d8
push esi
call fcn.0040af1f
add esp, 4
lea esi, [ebp - 0x68]
push esi
mov esi, dword [ebp - 0x50]
push dword [esi + 0x34]
call fcn.00404623
mov word [ebp - 0x64], 0x152
or ecx, ebx
push 4
push 0x3000
mov word [ebp - 0x48], 0xd2a
xor eax, dword [ebp - 0x44]
push 0x2800
mov dword [ebp - 0x2c], edi
add ebx, 0x38b7
mov ebx, 0x4641530f
mov ebx, edi
cmp dword [ebp - 0x3c], 0x400002
jne 0x404a81
lea ecx, [ebp - 0x24]
lea ecx, [ebp - 0xf0]
lea ecx, [ebp - 0xf0]
lea ecx, [ebp - 0xf0]
lea ecx, [ebp - 0x1a0]
mov edx, dword [esp + 8]
push 0
sub eax, dword [ebp - 0x34]
cmp dword [ebp - 0x28], 0
je 0x404a9d
add esp, 0xc
cmp eax, ebx
je 0x40b7b5
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x1c], 0x551
mov edx, dword [ebp - 0x68]
call dword [edx]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x68], edx
cmp dword [ebp - 0x3c], 1
je 0x404ad8
mov dword [ebp - 0x50], 0x431390
call fcn.00416b74
push esi
call dword [0x41a058]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esi, dword [ebp - 0x30]
lea esi, [esi - 0xa4]
push esi
push dword [ebp - 0x20]
call fcn.0040456b
mov edi, dword [ebp - 0x50]
mov cl, byte [ebp - 0x68]
mov cl, byte [edi + 0x99]
mov byte [ebp - 0x68], cl
mov esi, 0xff
mov dword [ebp - 0x48], 0x1bf
and dword [ebp - 0x68], esi
cmp dword [ebp - 0x3c], 0x400002
jne 0x404b30
pop ecx
test eax, eax
je 0x417ace
mov eax, dword [ebx]
test byte [edi + eax + 4], 0x80
je 0x4160c7
mov ecx, dword [ebp - 0x50]
mov dl, byte [ebp - 0x54]
mov dl, byte [ecx + 0x98]
mov byte [ebp - 0x54], dl
add word [ebp - 0x64], 0x75a
and dword [ebp - 0x2c], esi
mov edi, 0xff
xor dword [ebp - 0x6c], ecx
lea esi, [edx]
and dword [ebp - 0x54], edi
sub eax, dword [ebp - 0x34]
or dword [ebp - 0x5c], edi
add edx, dword [ebp - 0x48]
push dword [ebp - 0x54]
add esi, eax
mov dword [ebp - 0x44], edi
sub ecx, dword [ebp - 0x38]
push dword [ebp - 0x68]
mov edx, dword [ebp - 0x50]
add eax, dword [ebp - 0x1c]
push dword [edx + 0x94]
mov ecx, dword [ebp - 0x20]
cmp dword [ebp - 0x28], 0x400002
jne 0x404b9b
add esp, 0xc
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], edi
jb 0x404bb9
mov eax, dword [esi]
mov esi, dword [ebp - 0x50]
xor edx, dword [ebp - 0x58]
lea ecx, [esi + 0x688]
mov dword [ebp - 0x20], ecx
or edx, dword [ebp - 0x5c]
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
push dword [eax - 0xa4]
or dword [ebp - 0x48], ecx
push 0
and ecx, dword [ebp - 0x5c]
xor edi, dword [ebp - 0x44]
call fcn.004143e6
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x50]
or esi, dword [ebp - 0x1c]
lea eax, [ecx + 0x688]
mov dword [ebp - 0x68], eax
and dword [ebp - 0x48], ecx
cmp dword [ebp - 0x28], 0x52
jne 0x404bf0
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x54]
sub esi, eax
add eax, 0xa31
mov edx, dword [ebp - 0x50]
lea edi, [edx + 0xfbc]
mov dword [ebp - 0x54], edi
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x5c], edi
push ecx
cmp dword [ebp - 0x3c], 0x400002
jne 0x404c27
push dword [ebp - 0x68]
call fcn.004046fb
cmp dword [ebp - 0x3c], 0x400002
jne 0x404c47
push 1
push esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
push dword [ebp - 0x54]
lea ecx, [eax + ecx + 0x1964]
mov ebx, dword [ebp - 0x30]
xor eax, edx
or ecx, edx
push dword [ebx - 0xa4]
xor edx, ebx
add edx, 0xff0f
mov ebx, dword [ebp - 0x20]
add eax, dword [ebp - 0x64]
xor ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x50]
lea ebx, [ecx + 0x688]
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x28], 0xffffffc9
jne 0x404c98
mov ecx, dword [edx - 0x6c]
xor ecx, eax
call fcn.004116e2
mov ecx, dword [edx - 4]
xor ecx, eax
call fcn.00413f52
push dword [ebp - 0x20]
call fcn.0041797f
cmp dword [ebp - 0x3c], 1
je 0x404cae
call fcn.0040dfc3
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 0x50]
push dword [eax + 0x24]
call fcn.0040456b
cmp dword [ebp - 0x3c], 1
je 0x404ccb
lea edi, [ebp - 0x68]
push edi
mov edi, dword [ebp - 0x50]
push dword [edi + 0x38]
call fcn.00404623
cmp dword [ebp - 0x3c], 0x400002
jne 0x404ceb
call fcn.00407318
and dword [ebp - 0x48], ecx
push 0x8000
and word [ebp - 0x64], 0x446
cmp dword [ebp - 0x28], 0x400002
jne 0x404d12
pop ecx
test eax, eax
je 0x404ce6
mov al, byte [ebp + 8]
push 2
mov byte [ebp - 4], al
or dword [ebp - 0x5c], ebx
sub eax, dword [ebp - 0x1c]
push 0
mov ebx, dword [ebp - 0x30]
xor dword [ebp - 0x6c], ecx
push dword [ebx - 0xa4]
xor edi, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
call dword [eax]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x68], edx
or dword [ebp - 0x44], 0x1ca
mov eax, dword [ebp - 0x68]
xor dword [ebp - 0x58], 0x43a
lea edx, [edi + 0x1ffb]
mov ecx, dword [ebp - 0x50]
xor ebx, dword [ebp - 0x38]
and edx, dword [ebp - 0x6c]
lea eax, [ecx + 0x688]
mov dword [ebp - 0x68], eax
xor edx, dword [ebp - 0x44]
cmp dword [ebp - 0x3c], 1
je 0x404d79
add esp, 4
mov ecx, eax
call fcn.0041054b
mov eax, dword [ebp - 0x54]
or edi, dword [ebp - 0x64]
mov edi, dword [ebp - 0x50]
lea eax, [edi + 0xfbc]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x34], 0xb1e
lea eax, [edx + edi*8 + 0x35]
lea edx, [ebp - 0x54]
add ebx, 0x7087
sub edi, dword [ebp - 0x58]
push edx
sub ebx, dword [ebp - 0x5c]
push dword [ebp - 0x68]
xor ebx, edx
call fcn.004046fb
and dword [ebp - 0x2c], edi
mov esi, dword [ebp - 0x50]
cmp dword [ebp - 0x3c], 0xfffffffa
jne 0x404dd6
call fcn.004060bd
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
xor esi, esi
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
push dword [esi + 0x28]
mov byte [ebp - 0x44], 0xfa
or dword [ebp - 0x58], eax
xor eax, esi
push dword [ebp - 0x54]
or eax, ecx
add dword [ebp - 0x1c], eax
push dword [ebp - 0x68]
sub esi, dword [ebp - 0x48]
cmp dword [ebp - 0x3c], 1
je 0x404dff
int3
call fcn.00418221
cmp dword [ebp - 0x3c], 0x6e
jne 0x404e1c
push esi
push dword [0x41a312]
push dword [0x41a3f7]
call edi
mov ebx, dword [ebp - 0x50]
xor eax, esi
mov byte [ebx + 0x1e], 1
xor eax, ebx
cmp dword [ebp - 0x3c], 1
je 0x404e3c
mov eax, dword fs:[0x30]
mov dword [ebp - 0x20], eax
add dword [ebp - 0x34], 0xffffffc5
and dword [ebp - 0x5c], 0xda6
lea ebx, [ebp - 0x20]
push ebx
mov ebx, dword [ebp - 0x20]
push dword [ebx + 0xc]
call fcn.0040456b
cmp dword [ebp - 0x3c], 1
je 0x404e7a
lea esi, [ebp - 0x68]
push esi
mov esi, dword [ebp - 0x20]
push dword [esi + 0x1c]
call fcn.0040456b
xor word [ebp - 0x48], 0xdb8
cmp dword [ebp - 0x3c], 1
je 0x404ea8
push eax
call fcn.0040d4a7
add esp, 8
push eax
call fcn.00408723
push eax
xor edi, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x68]
xor edi, edx
mov ebx, dword [ebp - 0x68]
add ecx, dword [ebp - 0x5c]
lea eax, [ebx - 0x10]
mov dword [ebp - 0x68], eax
mov ebx, dword [ebp - 0x30]
lea ebx, [ebx - 8]
push ebx
push dword [ebp - 0x68]
call fcn.0040456b
xor eax, edx
cmp dword [ebp - 0x3c], 0x400002
jne 0x404ee5
mov eax, dword [esi + ecx*4 - 8]
mov dword [edi + ecx*4 - 8], eax
mov eax, dword [esi + ecx*4 - 4]
lea ebx, [ebp - 0x20]
push ebx
mov ebx, dword [ebp - 0x68]
push dword [ebx + 0x18]
call fcn.0040456b
or dword [ebp - 0x6c], edi
mov edx, dword [ebp - 0x30]
lea edx, [edx - 0x78]
push edx
push dword [ebp - 0x20]
call fcn.0040456b
and ecx, dword [ebp - 0x34]
or ebx, eax
and dword [ebp - 0x58], esi
mov edx, dword [ebp - 0x4c]
add edi, dword [ebp - 0x48]
cmp dword [ebp - 0x3c], 1
je 0x404f2e
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x41a27a], 0
jne 0x404f1f
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x50]
lea edx, [eax + 0x68c]
mov dword [ebp - 0x4c], edx
xor edx, ecx
sub esi, dword [ebp - 0x64]
mov ebx, dword [ebp - 0x40]
xor edx, eax
cmp dword [ebp - 0x3c], 1
je 0x404f56
mov byte [esi + 2], 0x31
add esi, 3
mov eax, esi
mov ecx, dword [ebp - 0x50]
sub edi, dword [ebp - 0x6c]
lea ebx, [ecx + 0x58c]
mov dword [ebp - 0x40], ebx
jmp 0x40505b
mov ecx, dword [ebp - 0x50]
push dword [ecx + 0xfb8]
mov ecx, ebx
pop dword [ebp - 0x54]
or edx, dword [ebp - 0x64]
lea esi, [ebp - 0x54]
push esi
mov esi, dword [ebp - 0x4c]
push dword [esi]
call fcn.004047c6
and edx, eax
mov edx, 0x456a5d13
mov edx, ecx
mov edx, 0x65839f16
mov edx, ecx
or word [ebp - 0x64], 0x96e
sub edx, eax
add edx, 0x1688
push dword [ebp - 0x54]
xor dword [ebp - 0x5c], 0xc22
xor dword [ebp - 0x64], edi
mov ecx, dword [ebp - 0x30]
push dword [ecx - 0x78]
call fcn.00416fbe
add dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x3c], 0x400002
jne 0x404ff8
or dword [ebp - 0x20], eax
je 0x405056
cmp dword [ebp - 0x28], 0x30
jne 0x40501e
mov edx, dword [esi]
push edx
call fcn.00417898
add esp, 4
push 0
mov dword [esi + 0x14], 0xf
push dword [ebp - 0x40]
push dword [ebp - 0x20]
call fcn.0040456b
add dword [ebp - 0x40], 4
lea edx, [ebx + 0x158a]
mov word [ebp - 0x34], 0xe45
mov ecx, 4
or word [ebp - 0x38], 0x25c
add dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], 0x107
jmp 0x40505b
jmp 0x405add
cmp dword [ebp - 0x3c], 1
je 0x40506f
call fcn.00414025
add esp, 4
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x4c]
or ecx, dword [ebp - 0x48]
cmp dword [eax], 0
jne 0x404f80
mov esi, dword [ebp - 0x20]
cmp dword [ebp - 0x28], 0xffffff96
jne 0x405092
cmp eax, 0xffffffff
je 0x40508f
cmp eax, 0xfffffffe
mov edi, dword [ebp - 0x50]
lea esi, [edi + 0xc24]
mov dword [ebp - 0x20], esi
or dword [ebp - 0x38], ebx
push dword [ebp - 0x20]
xor dword [ebp - 0x44], 0xa59
or dword [ebp - 0x64], esi
push dword [ebp - 0x50]
add eax, 0x741a
add eax, ebx
call fcn.0041303c
mov esi, dword [ebp - 0x50]
lea esi, [esi + 0x9c]
push esi
push dword [ebp - 0x20]
call fcn.0040456b
cmp dword [ebp - 0x3c], 0x400002
jne 0x4050de
mov eax, ecx
push dword [ebp - 0x50]
mov dword [ebp - 0x5c], edi
call fcn.00412b77
xor ebx, esi
mov edx, dword [ebp - 0x30]
lea edx, [edx - 0x8c]
push edx
push dword [ebp - 0x54]
call fcn.0040456b
and edi, dword [ebp - 0x48]
mov ebx, dword [ebp - 0x50]
cmp dword [ebp - 0x3c], 9
jne 0x405116
mov dword [edx], esi
mov edx, dword [ecx + 0x20]
mov dword [edx], eax
mov ecx, dword [ecx + 0x30]
cmp dword [ebx], 0
jne 0x405b82
add esi, dword [ebp - 0x2c]
push dword [ebp - 0x50]
push dword [ebp - 0x20]
call fcn.00404623
add dword [ebp - 0x48], ecx
mov eax, dword fs:[0x30]
mov dword [ebp - 0x20], eax
xor edi, dword [ebp - 0x44]
lea ebx, [ebp - 0x68]
push ebx
mov ebx, dword [ebp - 0x20]
push dword [ebx + 0xc]
call fcn.0040456b
lea ebx, [ebp - 0x68]
push ebx
mov ebx, dword [ebp - 0x68]
push dword [ebx + 0xc]
call fcn.0040456b
xor dword [ebp - 0x34], ebx
add edi, dword [ebp - 0x38]
or ebx, ecx
mov esi, dword [ebp - 0x68]
and ebx, ecx
mov ebx, 0x6e7ec462
mov ebx, edi
mov ebx, ecx
mov ebx, dword [ebp - 0x68]
cmp dword [ebp - 0x3c], 1
je 0x40517d
int3
lea esi, [ebx + 0x24]
mov dword [ebp - 0x68], esi
cmp dword [ebp - 0x28], 0
je 0x40519a
push eax
mov byte [ebp - 4], 6
call fcn.00412e53
add esp, 8
push eax
lea ebx, [ebp - 0x54]
push ebx
mov ebx, dword [ebp - 0x68]
push dword [ebx]
call fcn.0040456b
and esi, edi
mov ecx, 0xffff
and dword [ebp - 0x54], ecx
push dword [ebp - 0x54]
test dword [ebp - 0x28], 0
je 0x4051c2
push eax
mov esi, dword [ebp - 0x68]
xor ecx, ebx
add dword [ebp - 0x38], edi
push dword [esi + 4]
and word [ebp - 0x5c], 0xd56
sub eax, edi
mov eax, edi
mov byte [ebp - 0x38], 0xc5
add edx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x20]
add edx, dword [ebp - 0x58]
sub ebx, edi
mov edi, dword [ebp - 0x50]
sub ebx, dword [ebp - 0x64]
lea ecx, [edi + 0xa8]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x3c], 1
je 0x405204
cmp dword [ebp - 0x28], 0x400002
jne 0x405211
pop ebx
push dword [ebp - 0x20]
add esi, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x58]
call fcn.0041797f
push 0xffffffff
test dword [ebp - 0x28], 0
je 0x405233
mov ecx, dword [ebp - 0xc]
xor word [ebp - 0x34], 0xd59
cmp dword [ebp - 0x3c], 1
je 0x40524e
add esp, 8
test word [ebp + 8], ax
mov eax, 0x41a349
push dword [ebp - 0x50]
xor dword [ebp - 0x34], 0x9b8
test dword [ebp - 0x28], 0
je 0x405272
jb 0x40529c
test dword [edi + 0xc], 0x2000
push 0
push dword [ebp - 4]
call fcn.0041146b
lea ecx, [ebp - 0x68]
lea edi, [esi + 0x17]
push ecx
push dword [ebp - 0x20]
call fcn.0040456b
and dword [ebp - 0x58], ebx
or esi, edi
xor esi, ebx
test dword [ebp - 0x20], 0x100000
je 0x4052c4
xor edi, esi
sub ebx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x50]
or dword [ecx + 4], 1
cmp dword [ebp - 0x28], 0
je 0x4052c4
test ah, 0x44
jnp 0x40bbad
fldz
fcom st(1)
fnstsw ax
test ah, 0x41
and dword [ebp - 0x2c], 0x68
test dword [ebp - 0x20], 0x200000
je 0x40530a
and word [ebp - 0x58], 0x119
or ecx, esi
xor dword [ebp - 0x44], 0x7bd
mov ecx, dword [ebp - 0x50]
cmp dword [ebp - 0x28], 0x400002
jne 0x4052fd
mov ecx, ebx
shr ecx, 1
shr edx, 1
cmp ecx, edx
jbe 0x4052bf
or dword [ecx + 4], 1
or ebx, dword [ebp - 0x5c]
xor edx, dword [ebp - 0x44]
test dword [ebp - 0x20], 0x1000000
je 0x40532a
or dword [ebp - 0x48], esi
add dword [ebp - 0x6c], ebx
mov ebx, dword [ebp - 0x50]
or dword [ebx + 4], 2
add ebx, dword [ebp - 0x44]
cmp dword [ebp - 0x3c], 0x1b
jne 0x40533b
add esi, 0xfffffff6
fxch st(1)
adc ecx, 0xffffffff
push dword [ebp - 0x50]
add esi, 0xb9e1
and eax, dword [ebp - 0x58]
call fcn.004112d0
add dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x20]
or dword [ebp - 0x20], eax
je 0x4053a5
or dword [ebp - 0x5c], edi
add esi, 0x14e9
mov ecx, 0xff000
and dword [ebp - 0x20], ecx
and dword [ebp - 0x5c], ebx
push dword [ebp - 0x50]
push dword [ebp - 0x20]
call fcn.00404623
lea esi, [edi + esi*2 - 0x73]
mov word [ebp - 0x48], 0x579
jmp 0x4053e7
test dword [ebp - 0x28], 0
je 0x4053b7
mov ecx, dword [esi]
movzx eax, byte [ecx]
inc ecx
mov edx, 0xff000
cmp dword [ebp - 0x3c], 0x400002
jne 0x4053d0
js 0x4053cf
xor edi, edi
lea eax, [esi + 4]
push eax
and dword [ebp - 0x68], edx
sub ebx, dword [ebp - 0x58]
and dword [ebp - 0x2c], edi
push dword [ebp - 0x50]
push dword [ebp - 0x68]
call fcn.00404623
mov dword [ebp - 0x64], ecx
add dword [ebp - 0x28], 0
je 0x4053f1
push esi
mov edi, 0xf0000
and dword [ebp - 0x68], edi
or edi, ecx
and dword [ebp - 0x64], ecx
mov ebx, dword [ebp - 0x68]
and dword [ebp - 0x44], 0xffffffad
and ecx, dword [ebp - 0x48]
or dword [ebp - 0x68], ebx
je 0x4057f0
add edx, dword [ebp - 0x64]
push 1
and eax, ebx
or ebx, dword [ebp - 0x44]
cmp dword [ebp - 0x28], 0x400002
jne 0x405433
mov ecx, dword [ebp - 0x20]
sub edx, eax
and edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x50]
lea ecx, [esi + 0x4a8]
mov dword [ebp - 0x20], ecx
xor dword [ebp - 0x6c], ecx
cmp dword [ebp - 0x3c], 1
je 0x40545d
push dword [ebp - 0x20]
mov edx, eax
xor edx, dword [ebp - 0x34]
cmp dword [ebp - 0x3c], 1
je 0x405470
int3
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x50]
and edx, dword [ebp - 0x6c]
cmp dword [ebp - 0x3c], 0xfffffff1
jne 0x405487
and eax, edx
add esp, 0x10
lea ebx, [ecx + 0xde0]
mov dword [ebp - 0x20], ebx
add dword [ebp - 0x28], 0
je 0x40549b
cmp edi, ebx
add dword [ebp - 0x38], 0x2d
push dword [ebp - 0x20]
and edi, ecx
mov ecx, dword [ebp - 0x20]
and ebx, dword [ebp - 0x58]
mov edi, dword [ebp - 0x50]
add eax, dword [ebp - 0x6c]
xor dword [ebp - 0x6c], edi
lea ecx, [edi + 0xd70]
mov dword [ebp - 0x20], ecx
and esi, ecx
mov esi, ecx
sub edx, dword [ebp - 0x5c]
cmp dword [ebp - 0x3c], 1
je 0x4054d7
call fcn.00411984
pop ecx
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp - 0x20]
and dword [ebp - 0x2c], edx
and dword [ebp - 0x44], eax
cmp dword [ebp - 0x3c], 0x400002
jne 0x4054f4
int3
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
push dword [ebp - 0x50]
add dword [ebp - 0x34], 0x6e
call fcn.0040f5f0
add eax, edx
mov esi, dword [ebp - 0x20]
sub edx, dword [ebp - 0x64]
or dword [ebp - 0x20], esi
je 0x40554c
cmp dword [ebp - 0x28], 0
je 0x405524
xor eax, eax
add eax, 9
cmp dword [ebp + 8], eax
ja 0x4054ee
mov ebx, dword [ebp - 0x50]
cmp dword [ebp - 0x3c], 0x400002
jne 0x40553e
xor ecx, dword [eax + edi]
call fcn.00409ab4
mov ecx, dword [esi + 0xc]
cmp word [ebx + 0x4a8], 0
jne 0x4055f1
or ebx, ecx
cmp dword [ebp - 0x3c], 0xffffffec
jne 0x40555a
pop ebx
mov esp, ebp
push 0x1a
xor ebx, dword [ebp - 0x6c]
and esi, dword [ebp - 0x64]
sub esi, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x20]
or edi, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x50]
lea ecx, [edx + 0xcc8]
mov dword [ebp - 0x20], ecx
or eax, dword [ebp - 0x1c]
xor dword [ebp - 0x1c], 0x19
add dword [ebp - 0x28], 0
je 0x405597
add ecx, ecx
push ecx
push eax
push ebx
call fcn.00405f23
mov ecx, dword [ebp + 0xc]
push dword [ebp - 0x20]
add dword [ebp - 0x64], ebx
cmp dword [ebp - 0x28], 0x71
jne 0x4055aa
mov ebp, esp
push ebx
push esi
mov edx, dword [ebp - 0x20]
mov word [ebp - 0x44], 0x17a
sub edi, esi
mov ebx, dword [ebp - 0x50]
add edi, esi
lea edx, [ebx + 0x4a8]
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x3c], 1
je 0x4055d2
pop ecx
call fcn.0040c537
lea edx, [esi + 0x123c]
push dword [ebp - 0x20]
or ebx, esi
call fcn.0041797f
add dword [ebp - 0x28], 0
je 0x4055f1
mov dword [ebp - 0x23c], edi
add eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x50]
cmp dword [ebp - 0x28], 0xfffffff7
jne 0x40560e
mov edi, dword [ebp + 8]
mov esi, dword [0x41a1da]
mov eax, dword [edi]
lea ecx, [edi + 0x4a8]
mov dword [ebp - 0x20], ecx
add ebx, dword [ebp - 0x5c]
add ebx, ecx
cmp dword [ebp - 0x28], 0x5b
jne 0x405633
mov edi, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov ecx, dword [esi + 0x18]
sub edi, eax
sub ecx, ebx
push dword [ebp - 0x20]
cmp dword [ebp - 0x28], 0x48
jne 0x405657
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
mov dword [ebp + 8], 0
call fcn.0040b200
push 0x41a2d7
push dword [ebp - 0x50]
call fcn.004100e1
and dword [ebp - 0x58], 0xffffff9e
cmp dword [ebp - 0x3c], 1
je 0x405674
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov edi, dword [ebp - 0x20]
or dword [ebp - 0x20], edi
je 0x4057d6
lea ebx, [ebp - 0x54]
sub edi, dword [ebp - 0x44]
sub esi, dword [ebp - 0x48]
push ebx
push dword [ebp - 0x20]
test dword [ebp - 0x28], 0
je 0x4056a4
pop ebx
mov esp, ebp
pop ebp
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
xor edx, edx
call fcn.0040456b
xor esi, dword [ebp - 0x34]
mov eax, dword fs:[0x30]
mov dword [ebp - 0x20], eax
lea edi, [ebp - 0x68]
push edi
mov edi, dword [ebp - 0x20]
push dword [edi + 0xc]
call fcn.0040456b
or ebx, ecx
and word [ebp - 0x34], 0x75f
lea edi, [ebp - 0x68]
push edi
mov edi, dword [ebp - 0x68]
push dword [edi + 0xc]
call fcn.0040456b
cmp dword [ebp - 0x3c], 1
je 0x4056e6
mov edx, dword [ebp - 0x68]
add dword [ebp - 0x48], edi
mov edi, dword [ebp - 0x68]
lea edx, [edi + 0x24]
mov dword [ebp - 0x68], edx
lea edi, [ebp - 0x68]
push edi
mov edi, dword [ebp - 0x68]
push dword [edi + 4]
call fcn.0040456b
sub esi, edi
and word [ebp - 0x2c], 0xe06
xor dword [ebp - 0x64], 0xfffffffc
or esi, dword [ebp - 0x44]
push dword [ebp - 0x68]
cmp dword [ebp - 0x3c], 1
je 0x40572f
mov eax, dword [esi + ecx*4 + 0xc]
mov dword [edi + ecx*4 + 0xc], eax
mov eax, dword [esi + ecx*4 + 8]
mov dword [edi + ecx*4 + 8], eax
and edi, dword [ebp - 0x6c]
push dword [ebp - 0x54]
and dword [ebp - 0x44], 0xfffffffa
cmp dword [ebp - 0x28], 0
je 0x40574b
mov ecx, dword [ebp + 0xc]
and edx, esi
add esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x50]
mov dword [ebp - 0x6c], edx
and edx, dword [ebp - 0x5c]
or dword [edi + 4], 4
xor eax, esi
sub eax, dword [ebp - 0x38]
pop ebx
pop edi
push dword [ebp - 0x4c]
add dword [ebp - 0x28], 0
je 0x41355d
cmp eax, 0xffffffff
push dword [ebp - 0x50]
and dword [ebp - 0x44], 0x59d
or ebx, ecx
mov edx, dword [ebp - 0x30]
mov dword [edx - 0xc], 0
cmp dword [ebp - 0x28], 0x400002
jne 0x413587
int3
lea esi, [ebp - 0x50]
push esi
mov esi, dword [ebp - 0x30]
push dword [esi + 8]
call fcn.0040456b
mov edx, dword [ebp - 0x50]
and dword [ebp - 0x5c], 0x6e2
push dword [edx + 0x68]
mov esi, dword [ebp - 0x50]
add dword [ebp - 0x28], 0
je 0x4135b9
lea ebx, [ebx]
cmp dword [ebp - 0x1c], 0
push dword [esi + 4]
call fcn.004166ed
cmp dword [ebp - 0x20], 1
jne 0x413a79
mov esi, edx
add edx, ecx
mov ebx, dword [ebp - 0x30]
lea ebx, [ebx - 4]
push ebx
push dword [ebp - 0x68]
call fcn.0040456b
lea ecx, [ebp - 0x68]
push ecx
mov ecx, dword [ebp - 0x30]
push dword [ecx - 4]
call fcn.0040456b
lea edi, [ebp - 0x68]
push edi
mov edi, dword [ebp - 0x68]
push dword [edi + 0x3c]
call fcn.00404623
lea ebx, [ebp - 0x54]
push ebx
mov ebx, dword [ebp - 0x68]
push dword [ebx + 0xa0]
call fcn.0040456b
xor dword [ebp - 0x2c], edi
cmp dword [ebp - 0x3c], 0x400002
jne 0x41362d
push dword [ebp - 0x54]
add word [ebp - 0x44], 0xf91
add dword [ebp - 0x28], 0
je 0x413641
mov esi, dword [ebp - 0x68]
push dword [esi + 0x34]
sub edi, esi
add eax, dword [ebp - 0x38]
mov edi, dword [ebp - 0x50]
and dword [ebp - 0x34], 0xffffffea
add ebx, dword [ebp - 0x58]
push dword [edi + 8]
mov edi, dword [ebp - 0x30]
xor ecx, dword [ebp - 0x44]
sub esi, dword [ebp - 0x38]
push dword [edi - 4]
call fcn.00417618
mov edi, dword [ebp - 0x4c]
mov ebx, dword [ebp - 0x50]
or eax, edi
mov eax, 0xf2589b7b
mov eax, edi
lea edi, [ebx + 0x10]
mov dword [ebp - 0x4c], edi
and ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x40]
push ecx
mov ecx, dword [ebp - 0x50]
push dword [ecx + 0x60]
call fcn.0040456b
lea edi, [ebp - 0x20]
push edi
mov edi, dword [ebp - 0x50]
push dword [edi + 0xc]
call fcn.0040456b
cmp dword [ebp - 0x3c], 0x400002
jne 0x4136c5
jg 0x404990
jl 0x4136b7
cmp esi, eax
ja 0x414cb7
sub edi, dword [ebp - 4]
mov eax, dword [ecx + 0x30]
and esi, dword [ebp - 0x64]
and ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
or esi, dword [ebp - 0x38]
mov dword [ecx - 0x10], 0
jmp 0x413925
lea ebx, [esi + 0x3a]
mov esi, dword [ebp - 0x4c]
push dword [esi]
lea eax, [edi - 0x5e]
sub ecx, esi
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x58], edx
push dword [edx - 4]
or eax, dword [ebp - 0x44]
call fcn.00416fbe
cmp dword [ebp - 0x3c], 0x400002
jne 0x41371a
cmp word [ebx], ax
cmp dword [ebp - 0x3c], 0x400002
jne 0x413728
mov ebx, dword [ebp - 0x20]
or dword [ebp - 0x20], ebx
je 0x4138d7
cmp dword [ebp - 0x3c], 0x400002
jne 0x413743
add eax, 0x10
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x20]
cmp dword [ebp - 0x28], 0x61
jne 0x413767
mov eax, dword [edx + 4]
mov ecx, dword [eax + esi + 0x38]
mov dword [ebp - 4], 0xffffffff
cmp ecx, ebx
je 0x413771
mov edx, dword [ecx]
call fcn.0040456b
sub edx, dword [ebp - 0x48]
or edx, eax
add word [ebp - 0x2c], 0x833
cmp dword [ebp - 0x28], 0xffffffdb
jne 0x41378f
mov edx, dword [ecx + 0x14]
and edx, 0x41a58d
or edx, 0x41a589
mov ecx, dword [ebp - 0x54]
or dword [ebp - 0x5c], eax
mov edi, dword [ebp - 0x50]
sub esi, ebx
lea ecx, [edi + 0x38]
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x54]
push ecx
mov ecx, dword [ebp - 0x30]
push dword [ecx - 0x10]
call fcn.00404623
cmp dword [ebp - 0x28], 0xffffff86
jne 0x4137bf
add dl, 0x30
mov byte [ecx], dl
inc ecx
inc ebx
lea edi, [ebp - 0x54]
push edi
mov edi, dword [ebp - 0x54]
push dword [edi]
call fcn.0040456b
xor esi, ebx
add esi, dword [ebp - 0x48]
cmp dword [ebp - 0x28], 0x58
jne 0x4137dc
push esi
mov eax, dword [ebp - 0x68]
cmp word [eax], 0xff8b
jne 0x41382e
or eax, dword [ebp - 0x2c]
add word [ebp - 0x34], 0x4de
or ebx, dword [ebp - 0x2c]
add dword [ebp - 0x2c], 0x396
mov edx, 0xff
cmp dword [ebp - 0x3c], 1
je 0x413810
and dword [ebp - 0x54], edx
jmp 0x413840
mov ebx, dword [ebp - 0x54]
shr ebx, 0x10
mov dword [ebp - 0x54], ebx
add esi, 0xfdf4
xor ecx, dword [ebp - 0x6c]
push dword [ebp - 0x54]
and dword [ebp - 0x5c], ecx
and edi, dword [ebp - 0x34]
and edx, dword [ebp - 0x64]
push dword [ebp - 0x40]
mov edi, dword [ebp - 0x50]
cmp dword [ebp - 0x3c], 1
je 0x41385d
push dword [edi + 8]
xor ebx, dword [ebp - 0x34]
cmp dword [ebp - 0x3c], 0xffffffb9
jne 0x41386f
push dword [ebp - 0x68]
or edx, ebx
mov ecx, dword [ebp - 0x30]
push dword [ecx - 4]
or esi, eax
sub edx, dword [ebp - 0x1c]
add edi, ecx
mov edx, dword [ebp - 0x50]
push dword [edx]
and eax, edx
mov edi, dword [ebp - 0x50]
add dword [ebp - 0x28], 0
je 0x413899
mov ecx, 0x41a46e
push dword [edi + 0x64]
test dword [ebp - 0x28], 0
je 0x4138ad
call fcn.00413ad5
cmp dword [ebp - 0x3c], 3
jne 0x4138be
mov esi, dword [ebp - 8]
jmp 0x4138dc
jmp 0x413947
and dword [ebp - 0x64], esi
mov ebx, 4
lea edx, [ecx + edx*2 + 0x43]
add dword [ebp - 0x4c], ebx
and eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x3c], 0xffffffe5
jne 0x413900
call fcn.00406074
test eax, eax
jne fcn.00413953
sub edi, dword [ebp - 0x58]
add dword [ebp - 0x40], 4
and ebx, dword [ebp - 0x58]
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x2c], edx
add dword [esi - 0x10], 4
sub edi, ebx
lea edi, [edx + eax*4 + 0x73]
mov edi, ecx
cmp dword [ebp - 0x3c], 0x64
jne 0x413938
call fcn.004129eb
pop ecx
pop ecx
mov esp, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
xor ecx, dword [ebp - 0x38]
cmp dword [eax], 0
jne 0x4136ea
or dword [ebp - 0x48], esi
cmp dword [ebp - 0x28], 0
je 0x41395f
mov eax, dword [ebp - 0x4c]
sub edi, eax
cmp dword [eax], 0
jne 0x413997
cmp dword [ebp - 0x3c], 1
je 0x41398a
jbe 0x4139e7
sub ecx, eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x50], 0
mov eax, dword [edx + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov dword [eax - 0xc], 1
cmp dword [ebp - 0x28], 0x400002
jne 0x4139bb
push 0x41a1de
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x4314e8
call fcn.0041832d
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0x30]
and dword [ebp - 0x5c], eax
mov dword [edx - 8], 0
add ebx, 0xafb2
lea ebx, [ebp - 0x68]
push ebx
mov ebx, dword [ebp - 0x50]
push dword [ebx + 0x68]
call fcn.0040456b
or ecx, edx
push 0x8000
add ecx, 0x1c2c
add dword [ebp - 0x64], ecx
mov edi, dword [ebp - 0x20]
lea ecx, [edi + edx + 0xf12]
add ebx, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x30]
lea eax, [edi + 0xa08]
lea edi, [ebx - 8]
mov dword [ebp - 0x20], edi
sub eax, dword [ebp - 0x44]
push dword [ebp - 0x20]
xor edx, eax
mov eax, dword [ebp - 0x20]
or dword [ebp - 0x48], ecx
mov edi, dword [ebp - 0x30]
xor dword [ebp - 0x2c], 0xffffff90
lea eax, [edi - 4]
mov dword [ebp - 0x20], eax
and dword [ebp - 0x6c], eax
xor dword [ebp - 0x44], esi
cmp dword [ebp - 0x3c], 0xffffffe7
jne 0x413a3b
jne 0x413aa1
mov eax, dword [esi + 0xc]
push dword [ebp - 0x20]
xor eax, ebx
push 0xffffffff
test dword [ebp - 0x28], 0
je 0x413a54
xor eax, eax
pop ebp
cmp dword [ebp - 0x28], 0x400002
jne 0x413a65
mov edx, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x68]
add ecx, 0x5a4
call dword [ecx]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x68], edx
add dword [ebp - 0x2c], ecx
and dword [ebp - 0x2c], esi
pop dword [ebp - 0x50]
xor esi, dword [ebp - 0x64]
and ecx, dword [ebp - 0x64]
pop dword [ebp - 0x4c]
pop dword [ebp - 0x40]
xor word [ebp - 0x2c], 0x6f2
add edi, 0x508c
mov ecx, dword [ebp - 0x30]
add esi, ecx
mov esi, ecx
add eax, 0xe60d
mov esp, ecx
lea ecx, [edx + 0x75]
xor word [ebp - 0x5c], 0xff9
mov dword [ebp - 0x2c], eax
pop dword [ebp - 0x30]
or edi, esi
mov dword [ebp - 0x34], 0xeb7
ret 4
test esi, esi
mov esi, dword [ebp - 0x4c]
add esi, 0x5cc
call dword [esi]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x68], edx
cmp dword [ebp - 0x3c], 0xffffffa4
jne 0x4160e9
and word [ebp - 0x38], 0x42a
mov dword [ebp - 0x30], esp
sub ebx, eax
push dword [ebp - 0x20]
xor dword [ebp - 0x1c], 0x8e9
add edx, ebx
push dword [ebp - 0x54]
xor edx, eax
mov edx, esi
push dword [ebp - 0x50]
lea edx, [ebp - 0x50]
push edx
mov edx, dword [ebp - 0x30]
push dword [edx + 8]
call fcn.0040456b
cmp dword [ebp - 0x28], 0x35
jne 0x417b0a
lea ecx, [ebp - 0x14]
lea esi, [ebp - 0x54]
push esi
mov esi, dword [ebp - 0x30]
push dword [esi + 0xc]
call fcn.0040456b
or edi, edx
sub ebx, dword [ebp - 0x2c]
jmp 0x417b74
call fcn.004171cc
mov esi, eax
push dword [ebp - 0x50]
xor dword [ebp - 0x58], esi
or ecx, dword [ebp - 0x5c]
call fcn.00417c2f
and dword [ebp - 0x48], 0xee9
mov edx, 1
or eax, ecx
and word [ebp - 0x5c], 0x16a
sub dword [ebp - 0x54], edx
sub edi, edx
cmp dword [ebp - 0x3c], 1
je 0x417b74
cmp eax, 0x20
jae 0x417b2f
mov eax, 0x41a488
test eax, eax
je 0x417b19
mov eax, dword [ebp - 0x54]
or edx, dword [ebp - 0x38]
or dword [ebp - 0x54], eax
jne 0x417b36
cmp dword [ebp - 0x28], 0x65
jne 0x417b9c
mov esi, ecx
push dword [esi]
call fcn.00407d18
push dword [esi]
call fcn.0040ec5f
and dword [ebp - 0x48], 0x7a0
pop dword [ebp - 0x50]
cmp dword [ebp - 0x3c], 0x400002
jne 0x417bbb
mov dword [ebp - 4], 0xffffffff
test esi, esi
cmp dword [ebp - 0x28], 0xffffffd2
jne 0x417bcb
int3
pop dword [ebp - 0x54]
mov dword [ebp - 0x6c], 0x6d
lea ebx, [edi]
pop dword [ebp - 0x20]
xor eax, ecx
sub esi, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x30]
mov esp, esi
add dword [ebp - 0x44], ecx
cmp dword [ebp - 0x3c], 1
je 0x417bf3
pop ebp
mov edi, edi
pop dword [ebp - 0x30]
add word [ebp - 0x58], 0x7c
cmp dword [ebp - 0x3c], 0x400002
jne 0x417c10
jne 0x417bb2
push dword [ebp + 0x18]
push dword [ebp - 0x1c]
ret 8