Function at 0x43d4c0
Capabilities:
Generate random numbers via winapi
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x560471
mov eax, dword fs:[0]
push eax
mov eax, 0x128c
call fcn.00540b00
mov eax, dword [0x5b7b5c]
xor eax, esp
mov dword [esp + 0x1288], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b7b5c]
xor eax, esp
push eax
lea eax, [esp + 0x12a0]
mov dword fs:[0], eax
mov eax, dword [esp + 0x12b0]
xor ebp, ebp
mov esi, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebp
mov byte [esp + 0x34], 0
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x20], ebp
push esi
push 0x14
lea ecx, [esp + 0x28]
mov dword [esp + 0x12b0], ebp
call fcn.0043b5b0
push 0x10
call fcn.004ff95f
mov ecx, dword [0x5ec78c]
add esp, 4
mov edi, eax
push edi
push 0x10
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0x10
push edi
lea ecx, [esp + 0x28]
call fcn.0043a2e0
push edi
call fcn.004ff96a
add esp, 4
mov byte [esp + 0xe4], 0
xor edi, edi
mov eax, dword [edi*4 + 0x5ec794]
push eax
lea edx, [esp + 0xe8]
push 0x1f4
push edx
call fcn.00541bdf
add esp, 0xc
cmp edi, 1
jge 0x43d5bd
push 0x578ac0
lea eax, [esp + 0xe8]
push 0x1f4
push eax
call fcn.00541bdf
add esp, 0xc
inc edi
cmp edi, 2
jl 0x43d581
lea eax, [esp + 0xe4]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43d5d0
sub eax, edx
mov ebx, eax
push 4
mov dword [esp + 0x18], ebx
call fcn.004ff95f
movzx ecx, byte [esp + 0x1b]
mov edi, eax
mov byte [edi], cl
mov dl, byte [esp + 0x1a]
mov byte [edi + 1], dl
mov al, byte [esp + 0x19]
push 4
mov byte [edi + 2], al
movzx ecx, byte [esp + 0x1c]
push edi
lea edx, [esp + 0x20]
push 4
push edx
mov byte [edi + 3], cl
call fcn.0053f74e
push edi
call fcn.004ff96a
add esp, 0x18
push 4
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.0043a2e0
push ebx
lea ecx, [esp + 0xe8]
push ecx
lea ecx, [esp + 0x28]
call fcn.0043a2e0
cmp dword [0x5ec790], ebp
je 0x43d863
mov edx, dword [str.ssh_rsa]
push edx
lea eax, [esp + 0xe8]
push 0x1f4
push eax
mov byte [esp + 0xf0], 0
call fcn.00541c53
push 0x578ac0
lea ecx, [esp + 0xf4]
push 0x1f4
push ecx
call fcn.00541bdf
mov edx, dword [str.ssh_dss]
push edx
lea eax, [esp + 0x100]
push 0x1f4
push eax
call fcn.00541bdf
lea eax, [esp + 0x108]
add esp, 0x24
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43d6b0
sub eax, edx
mov ebx, eax
push 4
mov dword [esp + 0x18], ebx
call fcn.004ff95f
movzx ecx, byte [esp + 0x1b]
mov edi, eax
mov byte [edi], cl
mov dl, byte [esp + 0x1a]
mov byte [edi + 1], dl
mov al, byte [esp + 0x19]
push 4
mov byte [edi + 2], al
movzx ecx, byte [esp + 0x1c]
push edi
lea edx, [esp + 0x20]
push 4
push edx
mov byte [edi + 3], cl
call fcn.0053f74e
push edi
call fcn.004ff96a
add esp, 0x18
push 4
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.0043a2e0
push ebx
lea ecx, [esp + 0xe8]
push ecx
lea ecx, [esp + 0x28]
call fcn.0043a2e0
cmp dword [esi + 0xa0], 2
mov byte [esp + 0xe4], 0
jne 0x43d763
mov edx, dword [str.aes128_cbc]
push edx
lea eax, [esp + 0xe8]
push 0x1f4
push eax
call fcn.00541c53
push 0x578ac0
lea ecx, [esp + 0xf4]
push 0x1f4
push ecx
call fcn.00541bdf
add esp, 0x18
mov edx, dword [str.3des_cbc]
push edx
lea eax, [esp + 0xe8]
push 0x1f4
push eax
call fcn.00541bdf
lea eax, [esp + 0xf0]
add esp, 0xc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43d790
sub eax, edx
mov ebx, eax
push 4
mov dword [esp + 0x18], ebx
call fcn.004ff95f
movzx ecx, byte [esp + 0x1b]
mov edi, eax
mov byte [edi], cl
movzx edx, byte [esp + 0x1a]
mov byte [edi + 1], dl
movzx eax, byte [esp + 0x19]
push 4
mov byte [edi + 2], al
movzx ecx, byte [esp + 0x1c]
push edi
lea edx, [esp + 0x20]
push 4
push edx
mov byte [edi + 3], cl
call fcn.0053f74e
push edi
call fcn.004ff96a
add esp, 0x18
push 4
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.0043a2e0
push ebx
lea ecx, [esp + 0xe8]
push ecx
lea ecx, [esp + 0x28]
call fcn.0043a2e0
push 4
mov dword [esp + 0x18], ebx
call fcn.004ff95f
movzx edx, byte [esp + 0x1b]
mov edi, eax
mov byte [edi], dl
movzx eax, byte [esp + 0x1a]
mov byte [edi + 1], al
movzx ecx, byte [esp + 0x19]
push 4
mov byte [edi + 2], cl
movzx edx, byte [esp + 0x1c]
push edi
lea eax, [esp + 0x20]
push 4
push eax
mov byte [edi + 3], dl
call fcn.0053f74e
push edi
call fcn.004ff96a
add esp, 0x18
push 4
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x28]
call fcn.0043a2e0
push ebx
lea edx, [esp + 0xe8]
push edx
jmp 0x43d9a9
mov ebp, dword [str.ssh_dss]
mov eax, ebp
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43d870
sub eax, edx
mov ebx, eax
push 4
mov dword [esp + 0x18], ebx
call fcn.004ff95f
mov edi, eax
movzx eax, byte [esp + 0x1b]
mov byte [edi], al
mov cl, byte [esp + 0x1a]
mov byte [edi + 1], cl
mov dl, byte [esp + 0x19]
push 4
mov byte [edi + 2], dl
movzx eax, byte [esp + 0x1c]
push edi
lea ecx, [esp + 0x20]
push 4
push ecx
mov byte [edi + 3], al
call fcn.0053f74e
push edi
call fcn.004ff96a
add esp, 0x18
push 4
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x28]
call fcn.0043a2e0
push ebx
push ebp
lea ecx, [esp + 0x28]
call fcn.0043a2e0
mov ebp, dword [str.3des_cbc]
mov eax, ebp
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x43d8e3
sub eax, ecx
mov ebx, eax
push 4
mov dword [esp + 0x18], ebx
call fcn.004ff95f
mov edi, eax
movzx eax, byte [esp + 0x1b]
mov byte [edi], al
movzx ecx, byte [esp + 0x1a]
mov byte [edi + 1], cl
movzx edx, byte [esp + 0x19]
push 4
mov byte [edi + 2], dl
movzx eax, byte [esp + 0x1c]
push edi
lea ecx, [esp + 0x20]
push 4
push ecx
mov byte [edi + 3], al
call fcn.0053f74e
push edi
call fcn.004ff96a
add esp, 0x18
push 4
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x28]
call fcn.0043a2e0
push ebx
push ebp
lea ecx, [esp + 0x28]
call fcn.0043a2e0
mov ebp, dword [str.3des_cbc]
push 4
mov dword [esp + 0x18], ebx
call fcn.004ff95f
mov edi, eax
movzx eax, byte [esp + 0x1b]
mov byte [edi], al
movzx ecx, byte [esp + 0x1a]
mov byte [edi + 1], cl
movzx edx, byte [esp + 0x19]
push 4
mov byte [edi + 2], dl
movzx eax, byte [esp + 0x1c]
push edi
lea ecx, [esp + 0x20]
push 4
push ecx
mov byte [edi + 3], al
call fcn.0053f74e
push edi
call fcn.004ff96a
add esp, 0x18
push 4
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x28]
call fcn.0043a2e0
push ebx
push ebp
lea ecx, [esp + 0x28]
call fcn.0043a2e0
mov ebp, dword [str.hmac_sha1]
mov eax, ebp
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43d9c0
sub eax, edx
mov ebx, eax
push 4
mov dword [esp + 0x18], ebx
call fcn.004ff95f
mov edi, eax
movzx eax, byte [esp + 0x1b]
mov byte [edi], al
mov cl, byte [esp + 0x1a]
mov byte [edi + 1], cl
mov dl, byte [esp + 0x19]
push 4
mov byte [edi + 2], dl
movzx eax, byte [esp + 0x1c]
push edi
lea ecx, [esp + 0x20]
push 4
push ecx
mov byte [edi + 3], al
call fcn.0053f74e
push edi
call fcn.004ff96a
add esp, 0x18
push 4
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x28]
call fcn.0043a2e0
push ebx
push ebp
lea ecx, [esp + 0x28]
call fcn.0043a2e0
mov ebx, dword [str.hmac_sha1]
mov eax, ebx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43da33
sub eax, edi
mov ebp, eax
push 4
mov dword [esp + 0x18], ebp
call fcn.004ff95f
mov edi, eax
movzx eax, byte [esp + 0x1b]
mov byte [edi], al
movzx ecx, byte [esp + 0x1a]
mov byte [edi + 1], cl
movzx edx, byte [esp + 0x19]
push 4
mov byte [edi + 2], dl
movzx eax, byte [esp + 0x1c]
push edi
lea ecx, [esp + 0x20]
push 4
push ecx
mov byte [edi + 3], al
call fcn.0053f74e
push edi
call fcn.004ff96a
add esp, 0x18
push 4
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x28]
call fcn.0043a2e0
push ebp
push ebx
lea ecx, [esp + 0x28]
call fcn.0043a2e0
push 4
mov dword [esp + 0x18], 4
call fcn.004ff95f
mov edi, eax
movzx eax, byte [esp + 0x1b]
mov byte [edi], al
movzx ecx, byte [esp + 0x1a]
mov byte [edi + 1], cl
movzx edx, byte [esp + 0x19]
push 4
mov byte [edi + 2], dl
movzx eax, byte [esp + 0x1c]
push edi
lea ecx, [esp + 0x20]
push 4
push ecx
mov byte [edi + 3], al
call fcn.0053f74e
push edi
call fcn.004ff96a
add esp, 0x18
push 4
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x28]
call fcn.0043a2e0
push 4
push str.none
lea ecx, [esp + 0x28]
call fcn.0043a2e0
push 4
mov dword [esp + 0x18], 4
call fcn.004ff95f
mov edi, eax
movzx eax, byte [esp + 0x1b]
mov byte [edi], al
movzx ecx, byte [esp + 0x1a]
mov byte [edi + 1], cl
movzx edx, byte [esp + 0x19]
push 4
mov byte [edi + 2], dl
movzx eax, byte [esp + 0x1c]
push edi
lea ecx, [esp + 0x20]
push 4
push ecx
mov byte [edi + 3], al
call fcn.0053f74e
push edi
call fcn.004ff96a
add esp, 0x18
push 4
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x28]
call fcn.0043a2e0
push 4
push str.none
lea ecx, [esp + 0x28]
call fcn.0043a2e0
xor ebx, ebx
push 4
mov dword [esp + 0x18], ebx
call fcn.004ff95f
mov edi, eax
movzx eax, byte [esp + 0x1b]
mov byte [edi], al
movzx ecx, byte [esp + 0x1a]
mov byte [edi + 1], cl
movzx edx, byte [esp + 0x19]
push 4
mov byte [edi + 2], dl
movzx eax, byte [esp + 0x1c]
push edi
lea ecx, [esp + 0x20]
push 4
push ecx
mov byte [edi + 3], al
call fcn.0053f74e
push edi
call fcn.004ff96a
add esp, 0x18
push 4
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x28]
call fcn.0043a2e0
push ebx
push 0x57297f
lea ecx, [esp + 0x28]
call fcn.0043a2e0
push 4
mov dword [esp + 0x18], ebx
call fcn.004ff95f
mov edi, eax
movzx eax, byte [esp + 0x1b]
mov byte [edi], al
movzx ecx, byte [esp + 0x1a]
mov byte [edi + 1], cl
movzx edx, byte [esp + 0x19]
push 4
mov byte [edi + 2], dl
movzx eax, byte [esp + 0x1c]
push edi
lea ecx, [esp + 0x20]
push 4
push ecx
mov byte [edi + 3], al
call fcn.0053f74e
push edi
call fcn.004ff96a
add esp, 0x18
push 4
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x28]
call fcn.0043a2e0
push ebx
push 0x57297f
lea ecx, [esp + 0x28]
call fcn.0043a2e0
push 1
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x54], bl
call fcn.0043a2e0
push 4
mov dword [esp + 0x18], ebx
call fcn.004ff95f
movzx ecx, byte [esp + 0x1b]
mov edi, eax
mov byte [edi], cl
movzx edx, byte [esp + 0x1a]
mov byte [edi + 1], dl
movzx eax, byte [esp + 0x19]
push 4
mov byte [edi + 2], al
movzx ecx, byte [esp + 0x1c]
push edi
lea edx, [esp + 0x20]
push 4
push edx
mov byte [edi + 3], cl
call fcn.0053f74e
push edi
call fcn.004ff96a
add esp, 0x18
push 4
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.0043a2e0
mov ebx, dword [0x5e3ec8]
mov ecx, dword [esp + 0x28]
mov ebp, 0x88b8
sub ebp, ebx
push 4
lea ebx, [ebx + 0x5e3ed0]
mov dword [esp + 0x18], ecx
call fcn.004ff95f
movzx edx, byte [esp + 0x1b]
mov edi, eax
mov byte [edi], dl
movzx eax, byte [esp + 0x1a]
mov byte [edi + 1], al
movzx ecx, byte [esp + 0x19]
push 4
mov byte [edi + 2], cl
movzx edx, byte [esp + 0x1c]
push edi
lea eax, [esp + 0x20]
push 4
push eax
mov byte [edi + 3], dl
call fcn.0053f74e
push edi
call fcn.004ff96a
push 4
lea ecx, [esp + 0x30]
push ecx
push ebp
push ebx
call fcn.0053f74e
mov edi, dword [esp + 0x50]
mov edx, dword [esp + 0x68]
push edi
push edx
add ebp, 0xfffffffc
push ebp
add ebx, 4
push ebx
call fcn.0053f74e
mov eax, dword [0x5e3ec8]
mov edx, dword [0x5ec78c]
add esp, 0x38
lea ecx, [eax + edi + 4]
lea eax, [esi + 0x1e78]
push eax
push esi
lea edi, [esi + 0x1d34]
push edi
lea ebx, [esi + 0x1d28]
push ebx
mov dword [0x5e3ec8], ecx
push edx
lea ecx, [esp + 0x34]
call fcn.0043a470
test eax, eax
jne 0x43dd7e
mov eax, dword [esp + 0x40]
push eax
call fcn.004ff96a
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.004ff96a
mov edx, dword [esp + 0x44]
push edx
call fcn.004ff96a
add esp, 0xc
xor eax, eax
jmp 0x43ed70
cmp dword [esp + 0x12b4], 0
jne 0x43ddc9
lea eax, [esi + 0x1e74]
push eax
push esi
push edi
mov edi, dword [esp + 0x24]
push ebx
mov ecx, edi
call fcn.0043b620
test eax, eax
jne 0x43ddcd
mov ecx, dword [esp + 0x40]
push ecx
call fcn.004ff96a
mov edx, dword [esp + 0x3c]
push edx
call fcn.004ff96a
mov eax, dword [esp + 0x44]
push eax
call fcn.004ff96a
add esp, 0xc
xor eax, eax
jmp 0x43ed70
mov edi, dword [esp + 0x18]
mov ebp, dword [edi + 8]
mov ecx, dword [edi + 0x20]
mov dword [esp + 0x44], ecx
test ebp, ebp
jle 0x43de23
mov eax, dword [0x5e3ec8]
mov ebx, 0x88b8
sub ebx, eax
push ebp
lea eax, [eax + 0x5e3ed0]
push ebx
push eax
mov dword [esp + 0x54], eax
call fcn.00438e30
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
push ebp
push edx
add ebx, 0xfffffffc
add eax, 4
push ebx
push eax
call fcn.0053f74e
mov ecx, dword [0x5e3ec8]
lea edx, [ecx + ebp + 4]
add esp, 0x1c
mov dword [0x5e3ec8], edx
mov eax, dword [edi + 0x10]
mov edx, dword [edi + 8]
cmp eax, edx
jge 0x43de3c
mov ecx, dword [edi + 0x20]
mov cl, byte [eax + ecx]
inc eax
mov dword [edi + 0x10], eax
cmp cl, 0x14
je 0x43de7b
cmp dword [esi + 0xc0], 0
jne 0x43de53
push 0xffffffffffffffff
push 0x10
push 0x549f
call fcn.0050c4d3
mov edx, dword [esp + 0x40]
push edx
call fcn.004ff96a
mov eax, dword [esp + 0x3c]
push eax
call fcn.004ff96a
mov ecx, dword [esp + 0x44]
push ecx
call fcn.004ff96a
add esp, 0xc
xor eax, eax
jmp 0x43ed70
xor ebx, ebx
cmp eax, edx
mov dword [0x5ec788], ebx
jge 0x43de8d
add eax, 0x10
mov dword [edi + 0x10], eax
lea edx, [esp + 0x1c]
push edx
mov ecx, edi
call fcn.0043a5e0
mov ebp, eax
jmp 0x43dea0
mov eax, dword [esp + 0x1c]
mov ecx, dword [ebx*4 + 0x5ec794]
push eax
push ebp
push ecx
call fcn.00438fc0
add esp, 0xc
test eax, eax
jne 0x43dec2
inc ebx
cmp ebx, 2
jl 0x43dea0
jmp 0x43decf
mov edx, dword [ebx*4 + 0x5ec794]
mov dword [0x5ec788], edx
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.0043a5e0
mov ebx, eax
call fcn.005089db
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x43def7
push 0x80004005
call fcn.00401340
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov ebp, dword [esp + 0x1c]
mov ecx, dword [str.ssh_dss]
push ebp
push ebx
push ecx
mov byte [esp + 0x12b4], 1
call fcn.00438fc0
mov edx, dword [str.ssh_rsa]
push ebp
push ebx
push edx
mov dword [esp + 0x5c], eax
call fcn.00438fc0
add esp, 0x18
cmp dword [esp + 0x44], 0
jne 0x43dff8
test eax, eax
jne 0x43dff8
mov ecx, dword [esi + 0xa8]
push 0x7e1
lea eax, [esp + 0x2dc]
push eax
push ebp
neg ecx
push ebx
sbb ecx, ecx
push 0
and ecx, 0xfde9
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
mov word [esp + eax*2 + 0x2d8], dx
lea eax, [esp + 0x2d8]
push eax
lea ecx, [esp + 0x18]
push 0x54a0
push ecx
call fcn.00402140
add esp, 0xc
cmp dword [esi + 0xc0], 0
mov esi, dword [esp + 0x14]
jne 0x43dfac
push 0
push 0x10
push esi
call fcn.0050c485
lea eax, [esi - 0x10]
mov byte [esp + 0x12a8], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43dfd0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x40]
push ecx
call fcn.004ff96a
mov edx, dword [esp + 0x3c]
push edx
call fcn.004ff96a
mov eax, dword [esp + 0x44]
push eax
call fcn.004ff96a
add esp, 0xc
xor eax, eax
jmp 0x43ed70
lea ecx, [esp + 0x1c]
push ecx
mov ecx, edi
call fcn.0043a5e0
cmp dword [esi + 0xa0], 2
mov ebx, eax
jne 0x43e020
cmp dword [0x5ec790], 0
mov dword [esp + 0x50], 1
jne 0x43e028
mov dword [esp + 0x50], 0
mov ebp, dword [esp + 0x1c]
mov edx, dword [str.3des_cbc]
push ebp
push ebx
push edx
call fcn.00438fc0
push ebp
mov dword [esp + 0x28], eax
mov eax, dword [str.aes128_cbc]
push ebx
push eax
call fcn.00438fc0
add esp, 0x18
cmp dword [esp + 0x50], 0
jne 0x43e24c
cmp dword [esp + 0x18], 0
je 0x43e254
lea ecx, [esp + 0x1c]
push ecx
mov ecx, edi
call fcn.0043a5e0
mov ebp, dword [esp + 0x1c]
mov edx, dword [str.3des_cbc]
mov ebx, eax
push ebp
push ebx
push edx
call fcn.00438fc0
push ebp
mov dword [esp + 0x28], eax
mov eax, dword [str.aes128_cbc]
push ebx
push eax
call fcn.00438fc0
add esp, 0x18
cmp dword [esp + 0x50], 0
jne 0x43e303
cmp dword [esp + 0x18], 0
je 0x43e30b
lea ecx, [esp + 0x1c]
push ecx
mov ecx, edi
call fcn.0043a5e0
mov edx, dword [esp + 0x1c]
push edx
push eax
mov eax, dword [str.hmac_sha1]
push eax
call fcn.00438fc0
add esp, 0xc
test eax, eax
jne 0x43e0e8
cmp dword [esi + 0xc0], eax
jne 0x43e0e8
push 0xffffffffffffffff
push 0x30
push 0x54a2
call fcn.0050c4d3
lea ecx, [esp + 0x1c]
push ecx
mov ecx, edi
call fcn.0043a5e0
mov edx, dword [esp + 0x1c]
push edx
push eax
mov eax, dword [str.hmac_sha1]
push eax
call fcn.00438fc0
add esp, 0xc
test eax, eax
jne 0x43e122
cmp dword [esi + 0xc0], eax
jne 0x43e122
push 0xffffffffffffffff
push 0x30
push 0x54a2
call fcn.0050c4d3
lea ecx, [esp + 0x1c]
push ecx
mov ecx, edi
call fcn.0043a5e0
mov edx, dword [esp + 0x1c]
push edx
push eax
push str.none
call fcn.00438fc0
add esp, 0xc
test eax, eax
jne 0x43e15b
cmp dword [esi + 0xc0], eax
jne 0x43e15b
push 0xffffffffffffffff
push 0x30
push 0x54a3
call fcn.0050c4d3
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.0043a5e0
mov ecx, dword [esp + 0x1c]
push ecx
push eax
push str.none
call fcn.00438fc0
add esp, 0xc
test eax, eax
jne 0x43e194
cmp dword [esi + 0xc0], eax
jne 0x43e194
push 0xffffffffffffffff
push 0x30
push 0x54a3
call fcn.0050c4d3
mov edx, dword [0x5ec788]
mov dword [esp + 0x44], 0
cmp edx, dword [str.diffie_hellman_group_exchange_sha1]
jne 0x43e505
push esi
push 0x1e
lea ecx, [esp + 0x28]
mov dword [esp + 0x4c], 0x400
call fcn.0043b5b0
push 0x400
lea ecx, [esp + 0x24]
call fcn.0043a360
lea eax, [esi + 0x1e78]
push eax
mov eax, dword [0x5ec78c]
push esi
lea ebx, [esi + 0x1d34]
push ebx
lea ebp, [esi + 0x1d28]
push ebp
push eax
lea ecx, [esp + 0x34]
call fcn.0043a470
test eax, eax
jne 0x43e3ba
mov byte [esp + 0x12a8], al
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43e224
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x40]
push ecx
call fcn.004ff96a
mov edx, dword [esp + 0x3c]
push edx
call fcn.004ff96a
mov eax, dword [esp + 0x44]
push eax
call fcn.004ff96a
add esp, 0xc
xor eax, eax
jmp 0x43ed70
test eax, eax
jne 0x43e064
mov edx, dword [esi + 0xa8]
push 0x7e1
lea ecx, [esp + 0x2dc]
push ecx
push ebp
neg edx
push ebx
sbb edx, edx
push 0
and edx, 0xfde9
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [esp + 0x2d8]
xor ecx, ecx
push edx
mov word [esp + eax*2 + 0x2dc], cx
lea eax, [esp + 0x18]
push 0x54a1
push eax
call fcn.00402140
add esp, 0xc
cmp dword [esi + 0xc0], 0
mov esi, dword [esp + 0x14]
jne 0x43e2b7
push 0
push 0x10
push esi
call fcn.0050c485
lea eax, [esi - 0x10]
mov byte [esp + 0x12a8], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43e2db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x40]
push ecx
call fcn.004ff96a
mov edx, dword [esp + 0x3c]
push edx
call fcn.004ff96a
mov eax, dword [esp + 0x44]
push eax
call fcn.004ff96a
add esp, 0xc
xor eax, eax
jmp 0x43ed70
test eax, eax
jne 0x43e0ae
mov edx, dword [esi + 0xa8]
push 0x7e1
lea ecx, [esp + 0x2dc]
push ecx
push ebp
neg edx
push ebx
sbb edx, edx
push 0
and edx, 0xfde9
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [esp + 0x2d8]
xor ecx, ecx
push edx
mov word [esp + eax*2 + 0x2dc], cx
lea eax, [esp + 0x18]
push 0x54a1
push eax
call fcn.00402140
add esp, 0xc
cmp dword [esi + 0xc0], 0
mov esi, dword [esp + 0x14]
jne 0x43e36e
push 0
push 0x10
push esi
call fcn.0050c485
lea eax, [esi - 0x10]
mov byte [esp + 0x12a8], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43e392
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x40]
push ecx
call fcn.004ff96a
mov edx, dword [esp + 0x3c]
push edx
call fcn.004ff96a
mov eax, dword [esp + 0x44]
push eax
call fcn.004ff96a
add esp, 0xc
xor eax, eax
jmp 0x43ed70
lea ecx, [esi + 0x1e74]
push ecx
push esi
push ebx
push ebp
mov ecx, edi
call fcn.0043b620
test eax, eax
jne 0x43e41e
mov byte [esp + 0x12a8], al
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43e3f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x40]
push ecx
call fcn.004ff96a
mov edx, dword [esp + 0x3c]
push edx
call fcn.004ff96a
mov eax, dword [esp + 0x44]
push eax
call fcn.004ff96a
add esp, 0xc
xor eax, eax
jmp 0x43ed70
mov eax, dword [edi + 0x10]
cmp eax, dword [edi + 8]
jge 0x43e435
mov ecx, dword [edi + 0x20]
mov cl, byte [eax + ecx]
inc eax
mov dword [edi + 0x10], eax
cmp cl, 0x1f
je 0x43e49c
cmp dword [esi + 0xc0], 0
jne 0x43e44c
push 0xffffffffffffffff
push 0x10
push 0x54a4
call fcn.0050c4d3
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x12a8], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43e474
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x40]
push ecx
call fcn.004ff96a
mov edx, dword [esp + 0x3c]
push edx
call fcn.004ff96a
mov eax, dword [esp + 0x44]
push eax
call fcn.004ff96a
add esp, 0xc
xor eax, eax
jmp 0x43ed70
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x1c]
push edx
mov ecx, edi
mov ebp, 0x20
mov dword [esp + 0x50], 0x21
call fcn.0043b980
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x60]
push ecx
mov ecx, edi
call fcn.0043b980
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x1c]
push eax
push ecx
lea ebx, [esi + 0x1e3c]
push edx
mov ecx, ebx
call fcn.00439e20
mov eax, dword [esp + 0x18]
push eax
call fcn.004ff96a
mov ecx, dword [esp + 0x60]
push ecx
call fcn.004ff96a
add esp, 8
jmp 0x43e530
push 1
push 0x5b3ca8
push 0x80
lea ebx, [esi + 0x1e3c]
push 0x5b3c28
mov ecx, ebx
mov ebp, 0x1e
mov dword [esp + 0x58], 0x1f
call fcn.00439e20
mov ecx, ebx
call fcn.00439ec0
test eax, eax
jne 0x43e5a1
cmp dword [esi + 0xc0], eax
jne 0x43e551
push 0xffffffffffffffff
push 0x10
push 0x54a6
call fcn.0050c4d3
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x12a8], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43e579
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x40]
push ecx
call fcn.004ff96a
mov edx, dword [esp + 0x3c]
push edx
call fcn.004ff96a
mov eax, dword [esp + 0x44]
push eax
call fcn.004ff96a
add esp, 0xc
xor eax, eax
jmp 0x43ed70
push esi
push ebp
lea ecx, [esp + 0x28]
call fcn.0043b5b0
mov ecx, dword [esi + 0x1e58]
mov edx, dword [esi + 0x1e44]
push ecx
push edx
lea ecx, [esp + 0x28]
call fcn.0043a3e0
lea eax, [esi + 0x1e78]
push eax
push esi
lea ebp, [esi + 0x1d34]
push ebp
lea eax, [esi + 0x1d28]
push eax
mov eax, dword [0x5ec78c]
push eax
lea ecx, [esp + 0x34]
call fcn.0043a470
test eax, eax
jne 0x43e63b
mov byte [esp + 0x12a8], al
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43e613
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x40]
push ecx
call fcn.004ff96a
mov edx, dword [esp + 0x3c]
push edx
call fcn.004ff96a
mov eax, dword [esp + 0x44]
push eax
call fcn.004ff96a
add esp, 0xc
xor eax, eax
jmp 0x43ed70
lea ecx, [esi + 0x1e74]
push ecx
push esi
push ebp
lea eax, [esi + 0x1d28]
push eax
mov ecx, edi
call fcn.0043b620
test eax, eax
jne 0x43e6a5
mov byte [esp + 0x12a8], al
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43e67d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x40]
push ecx
call fcn.004ff96a
mov edx, dword [esp + 0x3c]
push edx
call fcn.004ff96a
mov eax, dword [esp + 0x44]
push eax
call fcn.004ff96a
add esp, 0xc
xor eax, eax
jmp 0x43ed70
mov eax, dword [edi + 0x10]
cmp eax, dword [edi + 8]
jl 0x43e6b1
xor cl, cl
jmp 0x43e6bb
mov ecx, dword [edi + 0x20]
mov cl, byte [eax + ecx]
inc eax
mov dword [edi + 0x10], eax
movzx edx, cl
cmp edx, dword [esp + 0x48]
je 0x43e6f4
cmp dword [esi + 0xc0], 0
jne 0x43e6db
push 0xffffffffffffffff
push 0x10
push 0x54a7
call fcn.0050c4d3
lea ecx, [esp + 0x14]
call fcn.00401b40
lea ecx, [esp + 0x20]
call fcn.0043b3b0
xor eax, eax
jmp 0x43ed70
lea eax, [esp + 0x60]
push eax
mov ecx, edi
call fcn.0043a5e0
lea ecx, [esp + 0x64]
push ecx
lea edx, [esp + 0x4c]
mov ebp, eax
push edx
mov ecx, edi
mov dword [esp + 0x20], ebp
call fcn.0043b980
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x48]
push eax
push ecx
mov ecx, ebx
call fcn.00439e80
mov edx, dword [esp + 0x48]
push edx
call fcn.004ff96a
add esp, 4
mov ecx, ebx
call fcn.0043a0f0
test eax, eax
jne 0x43e753
cmp dword [esi + 0xc0], eax
jne 0x43e6db
push 0xffffffffffffffff
push 0x10
push 0x54a5
jmp 0x43e6d6
lea eax, [esp + 0x6c]
push eax
mov ecx, edi
call fcn.0043a5e0
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x54], eax
mov eax, dword [0x5e3ec8]
push ecx
mov edx, 0x88b8
sub edx, eax
push ebp
push edx
lea eax, [eax + 0x5e3ed0]
push eax
call fcn.00438e90
mov ecx, dword [0x5e3ec8]
mov edx, dword [0x5ec788]
add ecx, eax
add esp, 0x10
mov dword [0x5e3ec8], ecx
cmp edx, dword [str.diffie_hellman_group_exchange_sha1]
jne 0x43e82b
mov eax, dword [esp + 0x44]
push eax
mov edx, 0x88b8
sub edx, ecx
push edx
lea eax, [ecx + 0x5e3ed0]
push eax
call fcn.00438e30
mov ecx, dword [0x5e3ec8]
mov edx, dword [esi + 0x1e50]
push edx
add ecx, eax
mov eax, dword [ebx]
push eax
mov edx, 0x88b8
sub edx, ecx
push edx
lea eax, [ecx + 0x5e3ed0]
push eax
mov dword [0x5e3ec8], ecx
call fcn.00438ed0
mov ecx, dword [0x5e3ec8]
mov edx, dword [esi + 0x1e54]
push edx
add ecx, eax
mov eax, dword [esi + 0x1e40]
push eax
mov edx, 0x88b8
sub edx, ecx
push edx
lea eax, [ecx + 0x5e3ed0]
push eax
mov dword [0x5e3ec8], ecx
call fcn.00438ed0
mov ecx, dword [0x5e3ec8]
add esp, 0x2c
add ecx, eax
mov dword [0x5e3ec8], ecx
mov edx, dword [esi + 0x1e58]
mov eax, dword [esi + 0x1e44]
push edx
push eax
mov edx, 0x88b8
sub edx, ecx
push edx
lea eax, [ecx + 0x5e3ed0]
push eax
call fcn.00438ed0
mov ecx, dword [0x5e3ec8]
mov edx, dword [esi + 0x1e5c]
push edx
add ecx, eax
mov eax, dword [esi + 0x1e48]
push eax
mov edx, 0x88b8
sub edx, ecx
push edx
lea eax, [ecx + 0x5e3ed0]
push eax
mov dword [0x5e3ec8], ecx
call fcn.00438ed0
mov ecx, dword [0x5e3ec8]
mov edx, dword [esi + 0x1e60]
push edx
add ecx, eax
mov eax, dword [esi + 0x1e4c]
push eax
mov edx, 0x88b8
sub edx, ecx
push edx
lea eax, [ecx + 0x5e3ed0]
push eax
mov dword [0x5e3ec8], ecx
call fcn.00438ed0
mov ecx, dword [0x5e3ec8]
add esp, 0x30
add ecx, eax
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0xac]
push eax
push ecx
push 0x5e3ed0
mov dword [0x5e3ec8], ecx
push 0x8004
mov ecx, 0x5ec78c
mov dword [esp + 0x6c], 0x14
call fcn.004390d0
push ebp
mov dword [0x5e3ec8], 0
call fcn.00438f60
add esp, 4
mov edx, str.ssh_rsa
lea ebx, [ebp + 4]
cmp eax, 4
jb 0x43e91c
mov ecx, dword [ebx]
cmp ecx, dword [edx]
jne 0x43e920
sub eax, 4
add edx, 4
add ebx, 4
cmp eax, 4
jae 0x43e908
test eax, eax
je 0x43e96b
movzx ecx, byte [ebx]
movzx ebp, byte [edx]
sub ecx, ebp
jne 0x43e95b
cmp eax, 1
jbe 0x43e967
movzx ecx, byte [ebx + 1]
movzx ebp, byte [edx + 1]
sub ecx, ebp
jne 0x43e95b
cmp eax, 2
jbe 0x43e967
movzx ecx, byte [ebx + 2]
movzx ebp, byte [edx + 2]
sub ecx, ebp
jne 0x43e95b
cmp eax, 3
jbe 0x43e967
movzx ecx, byte [ebx + 3]
movzx edx, byte [edx + 3]
sub ecx, edx
mov ebp, dword [esp + 0x18]
sar ecx, 0x1f
or ecx, 1
jmp 0x43e96d
mov ebp, dword [esp + 0x18]
xor ecx, ecx
xor ebx, ebx
xor eax, eax
cmp ecx, ebx
sete al
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x84], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x98], ebx
push eax
mov eax, dword [esp + 0x64]
push eax
push ebp
lea ecx, [esp + 0x7c]
mov byte [esp + 0x12b4], 2
call fcn.00439630
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x6c]
push ecx
mov ecx, dword [esp + 0x58]
push 0x14
lea edx, [esp + 0xb0]
push edx
push eax
push ecx
lea ecx, [esp + 0x84]
call fcn.004399a0
test eax, eax
je 0x43ea9d
mov edx, dword [esp + 0x18]
push edx
lea ecx, [esp + 0x74]
call fcn.00439750
mov ebp, eax
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x74]
call fcn.0043b450
mov dword [esp + 0x44], eax
mov eax, dword [esi + 0x8c]
cmp eax, ebx
jge 0x43ea46
mov eax, 0x16
mov ecx, dword [esp + 0x44]
mov edx, dword [esi + 0x6c]
push ecx
push ebp
push eax
push edx
mov ecx, esi
call fcn.0043cff0
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x44]
push eax
call fcn.004ff96a
push ebp
call fcn.004ff96a
add esp, 8
cmp dword [esp + 0x54], ebx
jne 0x43eb0c
cmp dword [esi + 0xc0], ebx
jne 0x43ea8f
push 0xffffffffffffffff
push 0x40
push 0x4e2d
call fcn.0050c4d3
lea ecx, [esp + 0x70]
call fcn.00439560
jmp 0x43e6db
cmp dword [esi + 0xc0], ebx
jne 0x43eab3
push 0xffffffffffffffff
push 0x10
push 0x54a8
call fcn.0050c4d3
lea ecx, [esp + 0x70]
call fcn.00439560
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x12a8], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43eae4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x40]
push ecx
call fcn.004ff96a
mov edx, dword [esp + 0x3c]
push edx
call fcn.004ff96a
mov eax, dword [esp + 0x44]
push eax
call fcn.004ff96a
add esp, 0xc
xor eax, eax
jmp 0x43ed70
push esi
push 0x15
lea ecx, [esp + 0x28]
call fcn.0043b5b0
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0043b260
test eax, eax
je 0x43ea8f
push edi
mov ecx, esi
call fcn.0043bd90
test eax, eax
je 0x43ea8f
mov ecx, edi
call fcn.0043a6d0
cmp al, 0x15
je 0x43eb6b
cmp dword [esi + 0xc0], ebx
jne 0x43eb5d
push 0xffffffffffffffff
push 0x10
push 0x54a9
call fcn.0050c4d3
lea ecx, [esp + 0x70]
call fcn.00439560
jmp 0x43e6db
cmp dword [esi + 0x1e6c], ebx
jne 0x43eb98
push 0x14
lea edx, [esp + 0xac]
push edx
lea eax, [esi + 0x1e98]
push 0x14
push eax
call fcn.0053f74e
mov ecx, dword [esp + 0x68]
add esp, 0x10
mov dword [esi + 0x1e94], ecx
mov ecx, dword [esi + 0x1e60]
lea edx, [esp + 0xbc]
push edx
mov edx, dword [esi + 0x1e4c]
push 0x43
lea edi, [esi + 0x1e98]
push edi
lea eax, [esp + 0xb4]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0043b120
mov eax, dword [esp + 0x50]
push eax
push 1
lea ecx, [esp + 0xc4]
push ecx
lea ebp, [esi + 0x1d28]
mov ecx, ebp
call fcn.00439140
test eax, eax
je 0x43ea8f
mov ecx, dword [esi + 0x1e60]
lea edx, [esp + 0xbc]
push edx
mov edx, dword [esi + 0x1e4c]
push 0x44
push edi
lea eax, [esp + 0xb4]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0043b120
mov eax, dword [esp + 0x50]
push eax
push ebx
lea ecx, [esp + 0xc4]
push ecx
mov ecx, ebp
call fcn.00439140
test eax, eax
je 0x43ea8f
mov ecx, dword [esi + 0x1e60]
lea edx, [esp + 0xbc]
push edx
mov edx, dword [esi + 0x1e4c]
push 0x41
push edi
lea eax, [esp + 0xb4]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0043b120
mov eax, dword [esi + 0x1d2c]
cmp eax, ebx
je 0x43ea8f
mov ebp, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push ebx
lea ecx, [esp + 0xc0]
push ecx
push 1
push eax
call ebp
cmp eax, ebx
je 0x43ea8f
mov ecx, dword [esi + 0x1e60]
lea edx, [esp + 0xbc]
push edx
mov edx, dword [esi + 0x1e4c]
push 0x42
push edi
lea eax, [esp + 0xb4]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0043b120
mov eax, dword [esi + 0x1d30]
cmp eax, ebx
je 0x43ea8f
push ebx
lea ecx, [esp + 0xc0]
push ecx
push 1
push eax
call ebp
cmp eax, ebx
je 0x43ea8f
mov ecx, dword [esi + 0x1e60]
lea edx, [esp + 0xbc]
push edx
mov edx, dword [esi + 0x1e4c]
push 0x45
push edi
lea eax, [esp + 0xb4]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0043b120
push ebx
push 1
lea eax, [esp + 0xc4]
lea ebp, [esi + 0x1d34]
push eax
mov ecx, ebp
call fcn.004394b0
mov eax, dword [esi + 0x1e60]
lea ecx, [esp + 0xbc]
push ecx
mov ecx, dword [esi + 0x1e4c]
push 0x46
push edi
lea edx, [esp + 0xb4]
push edx
push eax
push ecx
mov ecx, esi
call fcn.0043b120
push ebx
push ebx
lea edx, [esp + 0xc4]
push edx
mov ecx, ebp
call fcn.004394b0
lea ecx, [esp + 0x70]
mov dword [esi + 0x1e6c], 1
call fcn.00439560
lea ecx, [esp + 0x14]
call fcn.00401b40
lea ecx, [esp + 0x20]
call fcn.0043b3b0
mov eax, 1
mov ecx, dword [esp + 0x12a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1288]
xor ecx, esp
call fcn.0053f73f
add esp, 0x1298
ret 8