Function at 0x49534c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x5958
push 0
push 0
dec ecx
jne 0x495355
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403f34
xor eax, eax
push ebp
push 0x49616a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4a8c8c]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0044d290
mov eax, dword [ebx + 0x45c]
cmp byte [eax + 0x47], 1
jne 0x4953c3
mov eax, dword [ebx + 0x2fc]
call fcn.0045dd0c
call fcn.0045b9c4
lea eax, [eax + eax*4]
cmp byte [ebx + eax*4 + 0xacee], 0
jbe 0x4953c3
mov dword [ebx + 0xa220], 1
mov eax, dword [ebx + 0x45c]
cmp byte [eax + 0x47], 0
jne 0x4953f6
mov eax, dword [ebx + 0x2fc]
call fcn.0045dd0c
call fcn.0045b9c4
lea eax, [eax + eax*4]
cmp byte [ebx + eax*4 + 0xacee], 0
jne 0x4953f6
mov dword [ebx + 0xa220], 1
cmp dword [ebx + 0xa5d4], 1
jne 0x495415
mov eax, dword [ebx + 0x45c]
cmp byte [eax + 0x47], 0
jne 0x495415
mov dword [ebx + 0xa220], 1
cmp dword [ebx + 0xa220], 1
jne 0x49544c
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x254]
call fcn.0045c16c
test eax, eax
jle 0x49544c
mov eax, dword [ebx + 0x2fc]
call fcn.0045dd0c
call fcn.0045b9c4
mov edx, eax
mov eax, ebx
call fcn.00494434
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x254]
call fcn.0045c16c
dec eax
test eax, eax
jl 0x4954e9
inc eax
mov dword [ebp - 0x30], eax
xor edi, edi
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x254]
mov edx, edi
call fcn.0045c5d4
mov eax, dword [eax + 8]
lea edx, [ebp - 0x2c9a8]
call fcn.00408b18
mov eax, dword [ebp - 0x2c9a8]
push eax
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x254]
mov edx, edi
call fcn.0045c5d4
pop edx
call fcn.0045b2a4
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x254]
mov edx, edi
call fcn.0045c5d4
cmp dword [eax + 8], 0
jne 0x4954e3
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x254]
mov edx, edi
call fcn.0045c5d4
mov edx, 0x496184
call fcn.0045b2a4
inc edi
dec dword [ebp - 0x30]
jne 0x49546c
lea eax, [ebp - 0x14]
mov ecx, 0x496194
mov edx, dword [ebx + 0x23780]
call fcn.00403dcc
lea eax, [ebp - 0x18]
mov ecx, 0x4961ac
mov edx, dword [ebx + 0x23780]
call fcn.00403dcc
lea eax, [ebp - 8]
mov ecx, 0x4961c4
mov edx, dword [ebx + 0x23780]
call fcn.00403dcc
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x2fc]
call fcn.0045eeac
mov edx, dword [ebp - 8]
lea eax, [ebx + 0xa748]
call fcn.00405eba
mov eax, dword [0x4a8bb8]
mov byte [eax], 0
mov edx, 1
lea eax, [ebx + 0xa748]
call fcn.00406369
call fcn.0040285c
call fcn.00409ee4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x10]
mov edx, 0x4961d8
call fcn.0040aa9c
lea eax, [ebp - 0x2caa8]
mov edx, dword [ebp - 0x10]
mov ecx, 0xff
call fcn.00403d5c
lea edx, [ebp - 0x2caa8]
lea eax, [ebx + 0x23420]
mov cl, 0xf
call fcn.00402a50
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x60]
mov dword [ebx + 0x23450], eax
mov eax, dword [ebx + 0x45c]
mov eax, dword [eax + 0x60]
mov dword [ebx + 0x2344c], eax
lea edx, [ebp - 0x2caac]
mov eax, ebx
call fcn.00497720
cmp dword [ebx + 0x237a0], 0xb
jne 0x4955d7
mov byte [ebx + 0x233f4], 0
jmp 0x4955ee
call fcn.004029c0
mov eax, 0x7b
call fcn.00402b94
add al, 0x17
mov byte [ebx + 0x233f4], al
call fcn.004029c0
mov eax, 0x4e
call fcn.00402b94
add al, 0x39
mov byte [ebx + 0x2343f], al
mov eax, 0x3c
call fcn.00402b94
add al, 0x2f
mov byte [ebx + 0x23440], al
mov eax, 0x62
call fcn.00402b94
add al, 0x25
mov byte [ebx + 0x23441], al
mov eax, 0x62
call fcn.00402b94
add al, 0x2c
mov byte [ebx + 0x23443], al
cmp dword [ebx + 0x23790], 1
jne 0x495667
xor eax, eax
mov al, byte [ebx + 0x23441]
xor edx, edx
mov dl, byte [ebx + 0x23440]
add eax, edx
mov ecx, 0xea
xor edx, edx
div ecx
mov byte [ebx + 0x23442], dl
jmp 0x49568b
xor eax, eax
mov al, byte [ebx + 0x23441]
xor edx, edx
mov dl, byte [ebx + 0x23440]
add eax, edx
mov ecx, 0xea
xor edx, edx
div ecx
add dl, 0xb
mov byte [ebx + 0x23442], dl
mov eax, 0x4e
call fcn.00402b94
add al, 0x15
mov byte [ebx + 0x23444], al
mov eax, 0x3c
call fcn.00402b94
add al, 0x42
mov byte [ebx + 0x23445], al
mov eax, 0x62
call fcn.00402b94
add al, 0x21
mov byte [ebx + 0x23446], al
mov eax, 0x62
call fcn.00402b94
add al, 0x2f
mov byte [ebx + 0x23447], al
xor eax, eax
mov al, byte [ebx + 0x23446]
xor edx, edx
mov dl, byte [ebx + 0x23445]
add eax, edx
xor edx, edx
mov dl, byte [ebx + 0x23447]
add eax, edx
mov ecx, 0xde
xor edx, edx
div ecx
mov byte [ebx + 0x23448], dl
dec esi
jne 0x4957a5
mov eax, dword [ebx + 0x23794]
cmp eax, 1
jne 0x49573d
xor eax, eax
mov al, byte [ebx + 0x23446]
xor edx, edx
mov dl, byte [ebx + 0x23445]
add eax, edx
xor edx, edx
mov dl, byte [ebx + 0x23447]
add eax, edx
mov ecx, 0xde
xor edx, edx
div ecx
mov byte [ebx + 0x23448], dl
jmp 0x4957a5
cmp eax, 2
jne 0x495772
xor eax, eax
mov al, byte [ebx + 0x23446]
xor edx, edx
mov dl, byte [ebx + 0x23445]
add eax, edx
xor edx, edx
mov dl, byte [ebx + 0x23447]
add eax, edx
mov ecx, 0xde
xor edx, edx
div ecx
add dl, 0xc
mov byte [ebx + 0x23448], dl
jmp 0x4957a5
cmp eax, 3
jne 0x4957a5
xor eax, eax
mov al, byte [ebx + 0x23446]
xor edx, edx
mov dl, byte [ebx + 0x23445]
add eax, edx
xor edx, edx
mov dl, byte [ebx + 0x23447]
add eax, edx
mov ecx, 0xde
xor edx, edx
div ecx
add dl, 0xf
mov byte [ebx + 0x23448], dl
lea eax, [ebp - 0x2cab4]
mov edx, dword [0x4a9a0c]
add edx, 0x234d4
call fcn.00403d24
mov eax, dword [ebp - 0x2cab4]
lea edx, [ebp - 0x2cab0]
call fcn.00408b18
mov eax, dword [ebp - 0x2cab0]
call fcn.00403d80
test eax, eax
jle 0x4957e5
mov byte [ebx + 0x234ac], 1
jmp 0x4957ec
mov byte [ebx + 0x234ac], 0
mov eax, 0xaa
call fcn.00402b94
add al, 0x19
mov byte [ebx + 0x23454], al
mov eax, 0x96
call fcn.00402b94
add al, 0x23
mov byte [ebx + 0x23455], al
mov eax, 0x8c
call fcn.00402b94
add al, 0xb
mov byte [ebx + 0x23454], al
mov eax, 0x92
call fcn.00402b94
add al, 0x16
mov byte [ebx + 0x23455], al
lea eax, [ebx + 0xa748]
call fcn.004060a4
call fcn.0040285c
mov dword [ebx + 0x23498], eax
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x254]
call fcn.0045c16c
mov dword [ebx + 0x2340c], eax
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x254]
call fcn.0045c16c
imul eax, eax, 0x186dc
mov dword [ebx + 0x234a0], eax
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0xa9e0]
call fcn.00405eba
mov edx, 1
lea eax, [ebx + 0xa9e0]
call fcn.00406380
call fcn.0040285c
mov edx, dword [ebx + 0x233bc]
lea eax, [ebx + 0xa894]
call fcn.00405eba
mov eax, dword [0x4a8bb8]
mov byte [eax], 0
mov edx, 1
lea eax, [ebx + 0xa894]
call fcn.00406369
call fcn.0040285c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x2c9a4]
call fcn.00405eba
mov edx, 1
lea eax, [ebp - 0x2c9a4]
call fcn.00406380
call fcn.0040285c
mov edx, dword [ebx + 0x233c0]
lea eax, [ebp - 0x2c858]
call fcn.00405eba
mov eax, dword [0x4a8bb8]
mov byte [eax], 0
mov edx, 1
lea eax, [ebp - 0x2c858]
call fcn.00406369
call fcn.0040285c
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x2340c]
dec eax
test eax, eax
jl 0x495b83
inc eax
mov dword [ebp - 0x30], eax
xor edi, edi
lea esi, [ebp - 0x2c70c]
lea eax, [edi + edi*4]
push esi
push edi
mov edi, esi
lea esi, [ebx + eax*4 + 0xace0]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [esi], eax
lea eax, [edi + edi*4]
mov eax, dword [ebx + eax*4 + 0xacf0]
add eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 0x1c], eax
lea eax, [edi + edi*4]
mov edx, dword [ebx + eax*4 + 0xace0]
dec edx
lea eax, [ebx + 0xa894]
call fcn.004063a0
call fcn.0040285c
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x24]
mov ecx, 4
lea eax, [ebx + 0xa894]
call fcn.00405f5c
call fcn.0040285c
push 0
lea edx, [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
lea eax, [ebx + 0xa9e0]
call fcn.00405fc0
call fcn.0040285c
mov dword [ebp - 0xc], 0x14000
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x495a47
lea eax, [edi + edi*4]
mov eax, dword [ebx + eax*4 + 0xacf0]
sub eax, dword [ebp - 0x28]
cmp eax, 0x14000
jle 0x495a07
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x14030]
mov ecx, 0x14000
lea eax, [ebx + 0xa894]
call fcn.00405f5c
call fcn.0040285c
jmp 0x495a26
lea edx, [ebp - 0xc]
push edx
lea edx, [edi + edi*4]
mov ecx, eax
lea edx, [ebp - 0x14030]
lea eax, [ebx + 0xa894]
call fcn.00405f5c
call fcn.0040285c
push 0
lea edx, [ebp - 0x14030]
mov ecx, dword [ebp - 0xc]
lea eax, [ebx + 0xa9e0]
call fcn.00405fc0
call fcn.0040285c
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x28], eax
cmp dword [ebp - 0xc], 0x14000
jne 0x495a63
lea eax, [edi + edi*4]
mov eax, dword [ebx + eax*4 + 0xacf0]
cmp eax, dword [ebp - 0x28]
jg 0x4959d2
lea eax, [edi + edi*4]
cmp dword [ebx + eax*4 + 0xace8], 0
jle 0x495b76
mov edx, dword [ebp - 0x20]
inc edx
mov dword [esi + 4], edx
mov edx, dword [ebx + eax*4 + 0xace8]
add edx, dword [ebp - 0x20]
add edx, 4
mov dword [ebp - 0x20], edx
mov edx, dword [ebx + eax*4 + 0xace4]
dec edx
lea eax, [ebp - 0x2c858]
call fcn.004063a0
call fcn.0040285c
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x24]
mov ecx, 4
lea eax, [ebp - 0x2c858]
call fcn.00405f5c
call fcn.0040285c
push 0
lea edx, [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x2c9a4]
call fcn.00405fc0
call fcn.0040285c
mov dword [ebp - 0xc], 0x14000
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x495b5a
lea eax, [edi + edi*4]
mov eax, dword [ebx + eax*4 + 0xace8]
sub eax, dword [ebp - 0x28]
cmp eax, 0x14000
jle 0x495b1a
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x14030]
mov ecx, 0x14000
lea eax, [ebp - 0x2c858]
call fcn.00405f5c
call fcn.0040285c
jmp 0x495b39
lea edx, [ebp - 0xc]
push edx
lea edx, [edi + edi*4]
mov ecx, eax
lea edx, [ebp - 0x14030]
lea eax, [ebp - 0x2c858]
call fcn.00405f5c
call fcn.0040285c
push 0
lea edx, [ebp - 0x14030]
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x2c9a4]
call fcn.00405fc0
call fcn.0040285c
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x28], eax
cmp dword [ebp - 0xc], 0x14000
jne 0x495b76
lea eax, [edi + edi*4]
mov eax, dword [ebx + eax*4 + 0xace8]
cmp eax, dword [ebp - 0x28]
jg 0x495ae5
inc edi
add esi, 0x14
dec dword [ebp - 0x30]
jne 0x495945
lea eax, [ebx + 0xa9e0]
call fcn.00406024
call fcn.0040285c
lea eax, [ebx + 0xa894]
call fcn.00406024
call fcn.0040285c
lea eax, [ebp - 0x2c858]
call fcn.00406024
call fcn.0040285c
lea eax, [ebp - 0x2c9a4]
call fcn.00406024
call fcn.0040285c
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x2349c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x234a8], eax
lea edx, [ebp - 0x2cab8]
mov eax, dword [ebx + 0x438]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp dword [ebp - 0x2cab8], 0
je 0x495c82
lea eax, [ebp - 0x2cabc]
mov ecx, 0x4961ec
mov edx, dword [ebx + 0x23780]
call fcn.00403dcc
mov edx, dword [ebp - 0x2cabc]
mov eax, dword [ebx + 0x438]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
lea eax, [ebp - 0x2cac0]
mov ecx, 0x4961ec
mov edx, dword [ebx + 0x23780]
call fcn.00403dcc
mov edx, dword [ebp - 0x2cac0]
lea eax, [ebx + 0xa894]
call fcn.00405eba
mov eax, dword [0x4a8bb8]
mov byte [eax], 0
mov edx, 1
lea eax, [ebx + 0xa894]
call fcn.00406369
call fcn.0040285c
lea eax, [ebx + 0xa894]
call fcn.004060a4
call fcn.0040285c
mov dword [ebx + 0x234a4], eax
jmp 0x495c8a
xor eax, eax
mov dword [ebx + 0x234a4], eax
mov eax, ebx
call fcn.00496ee0
mov eax, dword [ebx + 0x23774]
call fcn.00403f44
mov ecx, eax
lea edx, [ebx + 0x233d4]
mov eax, ebx
call fcn.004971dc
mov edi, 1
mov al, byte [ebx + edi + 0x2375f]
mov byte [ebx + edi + 0x23455], al
inc edi
cmp edi, 0x15
jne 0x495cb0
mov eax, dword [ebx + 0x23778]
call fcn.00403f44
mov ecx, eax
lea edx, [ebx + 0x233d4]
mov eax, ebx
call fcn.004971dc
mov edi, 1
mov al, byte [ebx + edi + 0x2375f]
mov byte [ebx + edi + 0x23469], al
inc edi
cmp edi, 0x15
jne 0x495ce3
mov eax, dword [ebx + 0x2377c]
call fcn.00403f44
mov ecx, eax
lea edx, [ebx + 0x233d4]
mov eax, ebx
call fcn.004971dc
mov edi, 1
mov al, byte [ebx + edi + 0x2375f]
mov byte [ebx + edi + 0x2347d], al
inc edi
cmp edi, 0x15
jne 0x495d16
lea edx, [ebx + 0x233d4]
mov eax, ebx
call fcn.00497038
mov byte [ebx + 0x234b7], al
mov eax, dword [ebp - 4]
call fcn.00408fcc
cmp eax, 0xffffffff
je 0x495d89
and eax, 1
dec eax
jne 0x495d89
lea eax, [ebx + 0xa748]
call fcn.00406024
call fcn.0040285c
push 0
mov ecx, 0x4961fc
mov edx, 0x496204
mov eax, dword [0x4a8b24]
mov eax, dword [eax]
call fcn.0044f194
mov edx, dword [ebp - 0x2c]
mov eax, ebx
call fcn.004924a8
xor ebx, ebx
jmp 0x496127
mov edx, dword [ebp - 4]
lea eax, [ebx + 0xa5fc]
call fcn.00405eba
mov eax, dword [0x4a8bb8]
mov byte [eax], 2
mov edx, 1
lea eax, [ebx + 0xa5fc]
call fcn.00406380
call fcn.0040285c
push 0
lea edx, [ebx + 0x233d4]
mov ecx, pe_nt_image_headers32
lea eax, [ebx + 0xa5fc]
call fcn.00405fc0
call fcn.0040285c
lea edx, [ebp - 0x2cac4]
mov eax, dword [ebx + 0x438]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp dword [ebp - 0x2cac4], 0
je 0x495e8e
mov dword [ebp - 0xc], 0x14000
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x14030]
mov ecx, 0x14000
lea eax, [ebx + 0xa894]
call fcn.00405f5c
call fcn.0040285c
mov eax, dword [ebp - 0xc]
test eax, eax
jle 0x495e39
mov dword [ebp - 0x30], eax
lea esi, [ebp - 0x14030]
mov al, byte [ebx + 0x23455]
add byte [esi], al
inc esi
dec dword [ebp - 0x30]
jne 0x495e2b
push 0
lea edx, [ebp - 0x14030]
mov ecx, dword [ebp - 0xc]
lea eax, [ebx + 0xa5fc]
call fcn.00405fc0
call fcn.0040285c
cmp dword [ebp - 0xc], 0x14000
je 0x495dfc
lea eax, [ebx + 0xa894]
call fcn.00406024
call fcn.0040285c
lea eax, [ebp - 0x2cac8]
mov ecx, 0x4961ec
mov edx, dword [ebx + 0x23780]
call fcn.00403dcc
mov eax, dword [ebp - 0x2cac8]
call fcn.00409008
mov eax, dword [ebx + 0x2340c]
dec eax
test eax, eax
jl 0x495ec4
inc eax
mov dword [ebp - 0x30], eax
lea esi, [ebp - 0x2c70c]
push 0
mov edx, esi
mov ecx, 0x14
lea eax, [ebx + 0xa5fc]
call fcn.00405fc0
call fcn.0040285c
add esi, 0x14
dec dword [ebp - 0x30]
jne 0x495ea3
mov dword [ebp - 0xc], 0x14000
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x14030]
mov ecx, 0x14000
lea eax, [ebx + 0xa748]
call fcn.00405f5c
call fcn.0040285c
mov eax, dword [ebp - 0xc]
test eax, eax
jle 0x495f15
mov dword [ebp - 0x30], eax
lea esi, [ebp - 0x14030]
xor eax, eax
mov al, byte [esi]
xor edx, edx
mov dl, byte [ebx + 0x23455]
add eax, edx
and eax, 0xff
mov byte [esi], al
inc esi
dec dword [ebp - 0x30]
jne 0x495efa
push 0
lea edx, [ebp - 0x14030]
mov ecx, dword [ebp - 0xc]
lea eax, [ebx + 0xa5fc]
call fcn.00405fc0
call fcn.0040285c
cmp dword [ebp - 0xc], 0x14000
je 0x495ecb
lea eax, [ebx + 0xa748]
call fcn.00406024
call fcn.0040285c
mov eax, dword [ebp - 8]
call fcn.00409008
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0xa748]
call fcn.00405eba
mov eax, dword [0x4a8bb8]
mov byte [eax], 0
mov edx, 1
lea eax, [ebx + 0xa748]
call fcn.00406369
call fcn.0040285c
mov dword [ebp - 0xc], 0x14000
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x14030]
mov ecx, 0x14000
lea eax, [ebx + 0xa748]
call fcn.00405f5c
call fcn.0040285c
push 0
lea edx, [ebp - 0x14030]
mov ecx, dword [ebp - 0xc]
lea eax, [ebx + 0xa5fc]
call fcn.00405fc0
call fcn.0040285c
cmp dword [ebp - 0xc], 0x14000
je 0x495f83
lea eax, [ebx + 0xa748]
call fcn.00406024
call fcn.0040285c
mov eax, dword [ebp - 0x14]
call fcn.00409008
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0xa748]
call fcn.00405eba
mov eax, dword [0x4a8bb8]
mov byte [eax], 0
mov edx, 1
lea eax, [ebx + 0xa748]
call fcn.00406369
call fcn.0040285c
mov dword [ebp - 0xc], 0x14000
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x14030]
mov ecx, 0x14000
lea eax, [ebx + 0xa748]
call fcn.00405f5c
call fcn.0040285c
push 0
lea edx, [ebp - 0x14030]
mov ecx, dword [ebp - 0xc]
lea eax, [ebx + 0xa5fc]
call fcn.00405fc0
call fcn.0040285c
cmp dword [ebp - 0xc], 0x14000
je 0x496010
lea eax, [ebx + 0xa748]
call fcn.00406024
call fcn.0040285c
mov eax, dword [ebp - 0x18]
call fcn.00409008
lea eax, [ebx + 0xac9c]
mov edx, 0x496230
call fcn.00402a80
jbe 0x4960af
cmp dword [ebx + 0x237c8], 0
je 0x4960af
lea eax, [ebp - 0x2caa8]
mov edx, dword [ebx + 0x237c8]
mov ecx, 0xff
call fcn.00403d5c
lea edx, [ebp - 0x2caa8]
lea eax, [ebx + 0x23555]
mov cl, 0x14
call fcn.00402a50
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0x2358c], eax
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x23588], eax
mov eax, dword [ebx + 0x38]
mov dword [ebx + 0x23590], eax
mov eax, dword [ebx + 0x3c]
mov dword [ebx + 0x23594], eax
push 0
lea edx, [ebx + 0x234d4]
mov ecx, 0x28c
lea eax, [ebx + 0xa5fc]
call fcn.00405fc0
call fcn.0040285c
lea eax, [ebx + 0xa5fc]
call fcn.00406024
call fcn.0040285c
push 0xe4
mov ecx, 0xe4
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0049ab8c
mov eax, dword [0x4a8c8c]
mov eax, dword [eax]
xor edx, edx
call fcn.0044d290
mov ebx, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496171
lea eax, [ebp - 0x2cac8]
mov edx, 8
call fcn.00403b24
lea eax, [ebp - 0x2c9a8]
call fcn.00403b00
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00403b24
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b24
ret