Function at 0x496f18
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x45d8
push 0
push 0
dec ecx
jne 0x496f21
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403f24
xor eax, eax
push ebp
push 0x49870c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x237e8]
lea eax, [ebp - 0x22d94]
mov ecx, 0x498724
call fcn.00403dbc
mov edx, dword [ebp - 0x22d94]
mov eax, dword [ebp - 8]
call fcn.00403e80
je 0x496f86
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004a3544
mov eax, dword [0x4acc8c]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0044cc98
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44c]
cmp byte [eax + 0x47], 1
jne 0x496fd5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
call fcn.0045d630
call fcn.0045b3dc
lea eax, [eax + eax*4]
mov edx, dword [ebp - 4]
cmp byte [edx + eax*4 + 0xad56], 0
jbe 0x496fd5
mov eax, dword [ebp - 4]
mov dword [eax + 0xa26c], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44c]
cmp byte [eax + 0x47], 0
jne 0x497014
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
call fcn.0045d630
call fcn.0045b3dc
lea eax, [eax + eax*4]
mov edx, dword [ebp - 4]
cmp byte [edx + eax*4 + 0xad56], 0
jne 0x497014
mov eax, dword [ebp - 4]
mov dword [eax + 0xa26c], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa388], 1
jne 0x49703c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44c]
cmp byte [eax + 0x47], 0
jne 0x49703c
mov eax, dword [ebp - 4]
mov dword [eax + 0xa26c], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
call fcn.0045d630
call fcn.0045b3dc
lea eax, [eax + eax*4]
mov edx, dword [ebp - 4]
cmp byte [edx + eax*4 + 0xad56], 5
je 0x497082
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
call fcn.0045d630
call fcn.0045b3dc
lea eax, [eax + eax*4]
mov edx, dword [ebp - 4]
cmp byte [edx + eax*4 + 0xad56], 6
jne 0x49708d
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa26c], edx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa26c], 1
jne 0x4970ce
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x254]
call fcn.0045bb84
test eax, eax
jle 0x4970ce
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
call fcn.0045d630
call fcn.0045b3dc
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00495fec
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x254]
call fcn.0045bb84
mov edi, eax
dec edi
test edi, edi
jl 0x49717b
inc edi
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x254]
mov edx, ebx
call fcn.0045bfec
mov eax, dword [eax + 8]
lea edx, [ebp - 0x22d98]
call fcn.00408af0
mov eax, dword [ebp - 0x22d98]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x254]
mov edx, ebx
call fcn.0045bfec
pop edx
call fcn.0045acbc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x254]
mov edx, ebx
call fcn.0045bfec
cmp dword [eax + 8], 0
jne 0x497173
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x254]
mov edx, ebx
call fcn.0045bfec
mov edx, 0x49873c
call fcn.0045acbc
inc ebx
dec edi
jne 0x4970f0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x237e8]
lea eax, [ebp - 0x1c]
mov ecx, 0x49874c
call fcn.00403dbc
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x237e8]
lea eax, [ebp - 0x20]
mov ecx, 0x498764
call fcn.00403dbc
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x237e8]
lea eax, [ebp - 0xc]
mov ecx, 0x49877c
call fcn.00403dbc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov edx, dword [ebp - 0xc]
call fcn.0045e774
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov edx, dword [ebp - 0xc]
call fcn.00405e7a
mov eax, dword [0x4acbbc]
mov byte [eax], 0
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov edx, 1
call fcn.00406329
call fcn.0040284c
call fcn.00409ea8
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x18]
mov edx, 0x498790
call fcn.0040aa60
lea eax, [ebp - 0x22e98]
mov edx, dword [ebp - 0x18]
mov ecx, 0xff
call fcn.00403d4c
lea edx, [ebp - 0x22e98]
mov eax, dword [ebp - 4]
add eax, 0x23488
mov cl, 0xf
call fcn.00402a40
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x60]
mov edx, dword [ebp - 4]
mov dword [edx + 0x234b8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44c]
mov eax, dword [eax + 0x60]
mov edx, dword [ebp - 4]
mov dword [edx + 0x234b4], eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x24764]
mov edx, dword [ebp - 4]
mov byte [edx + 0x23516], al
lea edx, [ebp - 0x22e9c]
mov eax, dword [ebp - 4]
call fcn.00499d50
mov eax, dword [ebp - 4]
cmp dword [eax + 0x23810], 0xb
jne 0x4972a0
mov eax, dword [ebp - 4]
mov byte [eax + 0x2345c], 0
jmp 0x4972ba
call fcn.004029b0
mov eax, 0x7b
call fcn.00402b84
add al, 0x17
mov edx, dword [ebp - 4]
mov byte [edx + 0x2345c], al
call fcn.004029b0
mov eax, 0x4e
call fcn.00402b84
add al, 0x39
mov edx, dword [ebp - 4]
mov byte [edx + 0x234a7], al
mov eax, 0x3c
call fcn.00402b84
add al, 0x2f
mov edx, dword [ebp - 4]
mov byte [edx + 0x234a8], al
mov eax, 0x62
call fcn.00402b84
add al, 0x25
mov edx, dword [ebp - 4]
mov byte [edx + 0x234a9], al
mov eax, 0x62
call fcn.00402b84
add al, 0x2c
mov edx, dword [ebp - 4]
mov byte [edx + 0x234ab], al
mov eax, dword [ebp - 4]
cmp dword [eax + 0x237f8], 1
jne 0x497349
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x234a9]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x234a8]
add eax, edx
mov ecx, 0xea
xor edx, edx
div ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x234aa], dl
jmp 0x497374
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x234a9]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x234a8]
add eax, edx
mov ecx, 0xea
xor edx, edx
div ecx
add dl, 0xb
mov eax, dword [ebp - 4]
mov byte [eax + 0x234aa], dl
mov eax, 0x4e
call fcn.00402b84
add al, 0x15
mov edx, dword [ebp - 4]
mov byte [edx + 0x234ac], al
mov eax, 0x3c
call fcn.00402b84
add al, 0x42
mov edx, dword [ebp - 4]
mov byte [edx + 0x234ad], al
mov eax, 0x62
call fcn.00402b84
add al, 0x21
mov edx, dword [ebp - 4]
mov byte [edx + 0x234ae], al
mov eax, 0x62
call fcn.00402b84
mov ebx, eax
add bl, 0x2f
mov eax, dword [ebp - 4]
mov byte [eax + 0x234af], bl
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x234ae]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x234ad]
add eax, edx
xor edx, edx
mov dl, bl
add eax, edx
mov ecx, 0xde
xor edx, edx
div ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x234b0], dl
dec esi
jne 0x4974be
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x237fc]
cmp eax, 1
jne 0x497444
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x234ae]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x234ad]
add eax, edx
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x234af]
add eax, edx
mov ecx, 0xde
xor edx, edx
div ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x234b0], dl
jmp 0x4974be
cmp eax, 2
jne 0x497482
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x234ae]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x234ad]
add eax, edx
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x234af]
add eax, edx
mov ecx, 0xde
xor edx, edx
div ecx
add dl, 0xc
mov eax, dword [ebp - 4]
mov byte [eax + 0x234b0], dl
jmp 0x4974be
cmp eax, 3
jne 0x4974be
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x234ae]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x234ad]
add eax, edx
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x234af]
add eax, edx
mov ecx, 0xde
xor edx, edx
div ecx
add dl, 0xf
mov eax, dword [ebp - 4]
mov byte [eax + 0x234b0], dl
lea eax, [ebp - 0x22ea4]
mov edx, dword [0x4ada04]
add edx, 0x2353c
call fcn.00403d14
mov eax, dword [ebp - 0x22ea4]
lea edx, [ebp - 0x22ea0]
call fcn.00408af0
mov eax, dword [ebp - 0x22ea0]
call fcn.00403d70
test eax, eax
jle 0x497501
mov eax, dword [ebp - 4]
mov byte [eax + 0x23514], 1
jmp 0x49750b
mov eax, dword [ebp - 4]
mov byte [eax + 0x23514], 0
mov eax, 0xaa
call fcn.00402b84
add al, 0x19
mov edx, dword [ebp - 4]
mov byte [edx + 0x234bc], al
mov eax, 0x96
call fcn.00402b84
add al, 0x23
mov edx, dword [ebp - 4]
mov byte [edx + 0x234bd], al
mov eax, 0x8c
call fcn.00402b84
add al, 0xb
mov edx, dword [ebp - 4]
mov byte [edx + 0x234bc], al
mov eax, 0x92
call fcn.00402b84
add al, 0x16
mov edx, dword [ebp - 4]
mov byte [edx + 0x234bd], al
mov eax, dword [ebp - 4]
add eax, 0xa7b0
call fcn.00406064
call fcn.0040284c
mov edx, dword [ebp - 4]
mov dword [edx + 0x23500], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x254]
call fcn.0045bb84
mov edx, dword [ebp - 4]
mov dword [edx + 0x23474], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x254]
call fcn.0045bb84
imul eax, eax, 0x186dc
mov edx, dword [ebp - 4]
mov dword [edx + 0x23508], eax
xor eax, eax
push ebp
push 0x4975e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0xa3cc
call fcn.00405fe4
call fcn.0040284c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4975ee
xor eax, eax
push ebp
push 0x497618
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0xa518
call fcn.00405fe4
call fcn.0040284c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x497622
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x23424]
call fcn.00408f14
test al, al
jne 0x4977a4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa2d0], edx
mov eax, dword [ebp - 4]
push dword [eax + 0x237e8]
push 0x4987a4
push 0x4987b4
push 0x4987c4
mov eax, dword [ebp - 4]
add eax, 0x23424
mov edx, 4
call fcn.00403e30
mov ebx, 1
jmp 0x4976b2
inc ebx
mov eax, dword [ebp - 4]
push dword [eax + 0x237e8]
push 0x4987a4
push 0x4987b4
lea edx, [ebp - 0x22ea8]
mov eax, ebx
call fcn.00408ca4
push dword [ebp - 0x22ea8]
push 0x4987d4
mov eax, dword [ebp - 4]
add eax, 0x23424
mov edx, 5
call fcn.00403e30
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x23424]
call fcn.00408f14
test al, al
jne 0x497674
lea edx, [ebp - 0x22eac]
mov eax, ebx
call fcn.00408ca4
mov edx, dword [ebp - 0x22eac]
mov eax, dword [ebp - 4]
add eax, 0x2383c
call fcn.00403b44
mov eax, dword [ebp - 4]
push dword [eax + 0x237e8]
push 0x4987a4
push 0x4987b4
push 0x4987e4
lea edx, [ebp - 0x22eb0]
mov eax, ebx
call fcn.00408ca4
push dword [ebp - 0x22eb0]
push 0x4987d4
mov eax, dword [ebp - 4]
add eax, 0x23428
mov edx, 6
call fcn.00403e30
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x23424]
mov eax, dword [ebp - 4]
add eax, 0xa664
call fcn.00405e7a
mov eax, dword [ebp - 4]
add eax, 0xa664
mov edx, 1
call fcn.00406340
call fcn.0040284c
mov eax, dword [ebp - 4]
add eax, 0xa664
call fcn.00405fe4
call fcn.0040284c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x23428]
mov eax, dword [ebp - 4]
add eax, 0xa664
call fcn.00405e7a
mov eax, dword [ebp - 4]
add eax, 0xa664
mov edx, 1
call fcn.00406340
call fcn.0040284c
mov eax, dword [ebp - 4]
add eax, 0xa664
call fcn.00405fe4
call fcn.0040284c
lea edx, [ebp - 0x22eb4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2342c]
call fcn.00408af0
cmp dword [ebp - 0x22eb4], 0
je 0x497c5f
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2342c]
lea eax, [ebp - 0x22af8]
call fcn.00405e7a
mov eax, dword [0x4acbbc]
mov byte [eax], 0
mov edx, 1
lea eax, [ebp - 0x22af8]
call fcn.00406329
call fcn.0040284c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x23424]
lea eax, [ebp - 0x22c44]
call fcn.00405e7a
mov eax, dword [0x4acbbc]
mov byte [eax], 1
mov edx, 1
lea eax, [ebp - 0x22c44]
call fcn.00406329
call fcn.0040284c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x23434], 0
jle 0x49784c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x23434]
lea eax, [ebp - 0x22c44]
call fcn.00406360
call fcn.0040284c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x23428]
lea eax, [ebp - 0x22d90]
call fcn.00405e7a
mov eax, dword [0x4acbbc]
mov byte [eax], 1
mov edx, 1
lea eax, [ebp - 0x22d90]
call fcn.00406329
call fcn.0040284c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x23438], 0
jle 0x4978a2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x23438]
lea eax, [ebp - 0x22d90]
call fcn.00406360
call fcn.0040284c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x254]
call fcn.0045bb84
mov edi, eax
dec edi
test edi, edi
jl 0x497c2f
inc edi
xor ebx, ebx
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 4]
cmp byte [edx + eax*4 + 0xad57], 0
jne 0x497c27
mov edx, dword [ebp - 4]
cmp dword [edx + eax*4 + 0xad48], 0
jle 0x49790c
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*4 + 0xad48]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0xa334]
dec edx
lea eax, [ebp - 0x22af8]
call fcn.00406360
call fcn.0040284c
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x38]
mov ecx, 4
lea eax, [ebp - 0x22af8]
call fcn.00405f1c
call fcn.0040284c
push 0
lea edx, [ebp - 0x38]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x22c44]
call fcn.00405f80
call fcn.0040284c
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*4 + 0xad56]
cmp al, 4
je 0x497965
lea edx, [ebx + ebx*4]
mov ecx, dword [ebp - 4]
cmp al, 5
je 0x497965
lea edx, [ebx + ebx*4]
mov ecx, dword [ebp - 4]
cmp al, 6
jne 0x4979a1
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0xa038]
mov ecx, 0x1e
lea eax, [ebp - 0x22af8]
call fcn.00405f1c
call fcn.0040284c
push 0
lea edx, [ebp - 0xa038]
mov ecx, 0x1e
lea eax, [ebp - 0x22c44]
call fcn.00405f80
call fcn.0040284c
xor esi, esi
mov dword [ebp - 0x14], 0xa000
jmp 0x497a23
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 0xad58]
sub eax, esi
cmp eax, 0xa000
jle 0x4979e3
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0xa038]
mov ecx, 0xa000
lea eax, [ebp - 0x22af8]
call fcn.00405f1c
call fcn.0040284c
jmp 0x497a05
lea edx, [ebp - 0x14]
push edx
lea edx, [ebx + ebx*4]
mov ecx, dword [ebp - 4]
mov ecx, eax
lea edx, [ebp - 0xa038]
lea eax, [ebp - 0x22af8]
call fcn.00405f1c
call fcn.0040284c
push 0
lea edx, [ebp - 0xa038]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x22c44]
call fcn.00405f80
call fcn.0040284c
add esi, dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xa000
jne 0x497a3f
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 4]
cmp esi, dword [edx + eax*4 + 0xad58]
jl 0x4979ac
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 4]
cmp byte [edx + eax*4 + 0xad56], 0
jne 0x497b5c
mov edx, dword [ebp - 4]
cmp dword [edx + eax*4 + 0xad50], 0
jle 0x497b74
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*4 + 0xad4c]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0xa33c]
dec edx
lea eax, [ebp - 0x22af8]
call fcn.00406360
call fcn.0040284c
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x38]
mov ecx, 4
lea eax, [ebp - 0x22af8]
call fcn.00405f1c
call fcn.0040284c
push 0
lea edx, [ebp - 0x38]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x22d90]
call fcn.00405f80
call fcn.0040284c
xor esi, esi
mov dword [ebp - 0x14], 0xa000
jmp 0x497b3e
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 0xad50]
sub eax, esi
cmp eax, 0xa000
jle 0x497afe
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0xa038]
mov ecx, 0xa000
lea eax, [ebp - 0x22af8]
call fcn.00405f1c
call fcn.0040284c
jmp 0x497b20
lea edx, [ebp - 0x14]
push edx
lea edx, [ebx + ebx*4]
mov ecx, dword [ebp - 4]
mov ecx, eax
lea edx, [ebp - 0xa038]
lea eax, [ebp - 0x22af8]
call fcn.00405f1c
call fcn.0040284c
push 0
lea edx, [ebp - 0xa038]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x22d90]
call fcn.00405f80
call fcn.0040284c
add esi, dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xa000
jne 0x497b74
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 4]
cmp esi, dword [edx + eax*4 + 0xad50]
jl 0x497ac7
jmp 0x497b74
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx + eax*4 + 0xad50], ecx
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx + eax*4 + 0xad4c], ecx
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 4]
mov byte [edx + eax*4 + 0xad57], 1
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x23434]
inc ecx
mov dword [edx + eax*4 + 0xad48], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 0xad58]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x23434]
add eax, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x23434], eax
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 4]
mov dl, byte [edx + eax*4 + 0xad56]
cmp dl, 4
je 0x497bdd
lea ecx, [ebx + ebx*4]
mov esi, dword [ebp - 4]
cmp dl, 5
je 0x497bdd
lea ecx, [ebx + ebx*4]
mov esi, dword [ebp - 4]
cmp dl, 6
jne 0x497be7
mov edx, dword [ebp - 4]
add dword [edx + 0x23434], 0x1e
mov edx, dword [ebp - 4]
cmp dword [edx + eax*4 + 0xad50], 0
jle 0x497c27
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x23438]
inc ecx
mov dword [edx + eax*4 + 0xad4c], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 0xad50]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x23438]
add eax, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x23438], eax
inc ebx
dec edi
jne 0x4978c4
lea eax, [ebp - 0x22c44]
call fcn.00405fe4
call fcn.0040284c
lea eax, [ebp - 0x22af8]
call fcn.00405fe4
call fcn.0040284c
lea eax, [ebp - 0x22d90]
call fcn.00405fe4
call fcn.0040284c
mov eax, dword [ebp - 4]
add eax, 0xaa48
mov edx, dword [ebp - 0x1c]
call fcn.00405e7a
mov eax, dword [ebp - 4]
add eax, 0xaa48
mov edx, 1
call fcn.00406340
call fcn.0040284c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x23424]
mov eax, dword [ebp - 4]
add eax, 0xa8fc
call fcn.00405e7a
mov eax, dword [0x4acbbc]
mov byte [eax], 0
mov eax, dword [ebp - 4]
add eax, 0xa8fc
mov edx, 1
call fcn.00406329
call fcn.0040284c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x229ac]
call fcn.00405e7a
mov edx, 1
lea eax, [ebp - 0x229ac]
call fcn.00406340
call fcn.0040284c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x23428]
lea eax, [ebp - 0x22860]
call fcn.00405e7a
mov eax, dword [0x4acbbc]
mov byte [eax], 0
mov edx, 1
lea eax, [ebp - 0x22860]
call fcn.00406329
call fcn.0040284c
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x23474]
dec edi
test edi, edi
jl 0x49800c
inc edi
xor ebx, ebx
lea esi, [ebp - 0x22714]
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 4]
push esi
push edi
mov edi, esi
lea esi, [edx + eax*4 + 0xad48]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [esi], eax
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 0xad58]
add eax, dword [ebp - 0x24]
add eax, 4
mov dword [ebp - 0x24], eax
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*4 + 0xad48]
dec edx
mov eax, dword [ebp - 4]
add eax, 0xa8fc
call fcn.00406360
call fcn.0040284c
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
add eax, 0xa8fc
mov ecx, 4
call fcn.00405f1c
call fcn.0040284c
push 0
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
add eax, 0xaa48
mov ecx, dword [ebp - 0x10]
call fcn.00405f80
call fcn.0040284c
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*4 + 0xad56]
cmp al, 4
je 0x497de7
lea edx, [ebx + ebx*4]
mov ecx, dword [ebp - 4]
cmp al, 5
je 0x497de7
lea edx, [ebx + ebx*4]
mov ecx, dword [ebp - 4]
cmp al, 6
jne 0x497e2b
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0xa038]
mov eax, dword [ebp - 4]
add eax, 0xa8fc
mov ecx, 0x1e
call fcn.00405f1c
call fcn.0040284c
push 0
lea edx, [ebp - 0xa038]
mov eax, dword [ebp - 4]
add eax, 0xaa48
mov ecx, 0x1e
call fcn.00405f80
call fcn.0040284c
add dword [ebp - 0x24], 0x1e
mov dword [ebp - 0x10], 0xa000
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x497ebd
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 0xad58]
sub eax, dword [ebp - 0x30]
cmp eax, 0xa000
jle 0x497e76
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0xa038]
mov eax, dword [ebp - 4]
add eax, 0xa8fc
mov ecx, 0xa000
call fcn.00405f1c
call fcn.0040284c
jmp 0x497e9a
lea edx, [ebp - 0x10]
push edx
lea edx, [ebx + ebx*4]
mov ecx, dword [ebp - 4]
mov ecx, eax
lea edx, [ebp - 0xa038]
mov eax, dword [ebp - 4]
add eax, 0xa8fc
call fcn.00405f1c
call fcn.0040284c
push 0
lea edx, [ebp - 0xa038]
mov eax, dword [ebp - 4]
add eax, 0xaa48
mov ecx, dword [ebp - 0x10]
call fcn.00405f80
call fcn.0040284c
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x30], eax
cmp dword [ebp - 0x10], 0xa000
jne 0x497edc
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 0xad58]
cmp eax, dword [ebp - 0x30]
jg 0x497e3c
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 4]
cmp dword [edx + eax*4 + 0xad50], 0
jle 0x498001
mov edx, dword [ebp - 0x28]
inc edx
mov dword [esi + 4], edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*4 + 0xad50]
add edx, dword [ebp - 0x28]
add edx, 4
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*4 + 0xad4c]
dec edx
lea eax, [ebp - 0x22860]
call fcn.00406360
call fcn.0040284c
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x2c]
mov ecx, 4
lea eax, [ebp - 0x22860]
call fcn.00405f1c
call fcn.0040284c
push 0
lea edx, [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x229ac]
call fcn.00405f80
call fcn.0040284c
mov dword [ebp - 0x10], 0xa000
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x497fe2
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 0xad50]
sub eax, dword [ebp - 0x30]
cmp eax, 0xa000
jle 0x497f9f
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0xa038]
mov ecx, 0xa000
lea eax, [ebp - 0x22860]
call fcn.00405f1c
call fcn.0040284c
jmp 0x497fc1
lea edx, [ebp - 0x10]
push edx
lea edx, [ebx + ebx*4]
mov ecx, dword [ebp - 4]
mov ecx, eax
lea edx, [ebp - 0xa038]
lea eax, [ebp - 0x22860]
call fcn.00405f1c
call fcn.0040284c
push 0
lea edx, [ebp - 0xa038]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x229ac]
call fcn.00405f80
call fcn.0040284c
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x30], eax
cmp dword [ebp - 0x10], 0xa000
jne 0x498001
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 0xad50]
cmp eax, dword [ebp - 0x30]
jg 0x497f67
inc ebx
add esi, 0x14
dec edi
jne 0x497d34
mov eax, dword [ebp - 4]
add eax, 0xaa48
call fcn.00405fe4
call fcn.0040284c
mov eax, dword [ebp - 4]
add eax, 0xa8fc
call fcn.00405fe4
call fcn.0040284c
lea eax, [ebp - 0x22860]
call fcn.00405fe4
call fcn.0040284c
lea eax, [ebp - 0x229ac]
call fcn.00405fe4
call fcn.0040284c
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
mov dword [eax + 0x23504], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x23510], edx
lea edx, [ebp - 0x22eb8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x428]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp dword [ebp - 0x22eb8], 0
je 0x49812a
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x237e8]
lea eax, [ebp - 0x22ebc]
mov ecx, 0x4987f0
call fcn.00403dbc
mov edx, dword [ebp - 0x22ebc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x428]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x237e8]
lea eax, [ebp - 0x22ec0]
mov ecx, 0x4987f0
call fcn.00403dbc
mov edx, dword [ebp - 0x22ec0]
mov eax, dword [ebp - 4]
add eax, 0xa8fc
call fcn.00405e7a
mov eax, dword [0x4acbbc]
mov byte [eax], 0
mov eax, dword [ebp - 4]
add eax, 0xa8fc
mov edx, 1
call fcn.00406329
call fcn.0040284c
mov eax, dword [ebp - 4]
add eax, 0xa8fc
call fcn.00406064
call fcn.0040284c
mov edx, dword [ebp - 4]
mov dword [edx + 0x2350c], eax
jmp 0x498135
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x2350c], edx
mov eax, dword [ebp - 4]
call fcn.00499500
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x237dc]
call fcn.00403f34
mov ecx, eax
mov eax, dword [ebp - 4]
lea edx, [eax + 0x2343c]
mov eax, dword [ebp - 4]
call fcn.0049980c
mov ebx, 1
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx + 0x237c7]
mov edx, dword [ebp - 4]
mov byte [edx + ebx + 0x234bd], al
inc ebx
cmp ebx, 0x15
jne 0x498163
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x237e0]
call fcn.00403f34
mov ecx, eax
mov eax, dword [ebp - 4]
lea edx, [eax + 0x2343c]
mov eax, dword [ebp - 4]
call fcn.0049980c
mov ebx, 1
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx + 0x237c7]
mov edx, dword [ebp - 4]
mov byte [edx + ebx + 0x234d1], al
inc ebx
cmp ebx, 0x15
jne 0x4981a3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x237e4]
call fcn.00403f34
mov ecx, eax
mov eax, dword [ebp - 4]
lea edx, [eax + 0x2343c]
mov eax, dword [ebp - 4]
call fcn.0049980c
mov ebx, 1
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx + 0x237c7]
mov edx, dword [ebp - 4]
mov byte [edx + ebx + 0x234e5], al
inc ebx
cmp ebx, 0x15
jne 0x4981e3
mov eax, dword [ebp - 4]
lea edx, [eax + 0x2343c]
mov eax, dword [ebp - 4]
call fcn.00499668
mov edx, dword [ebp - 4]
mov byte [edx + 0x2351f], al
mov eax, dword [ebp - 8]
call fcn.00408f24
cmp eax, 0xffffffff
je 0x498266
and eax, 1
dec eax
jne 0x498266
mov eax, dword [ebp - 4]
add eax, 0xa7b0
call fcn.00405fe4
call fcn.0040284c
push 0
mov ecx, 0x498800
mov edx, 0x498808
mov eax, dword [0x4acb28]
mov eax, dword [eax]
call fcn.0044eb9c
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.00493364
xor ebx, ebx
jmp 0x4986c4
mov eax, dword [ebp - 4]
add eax, 0xa664
mov edx, dword [ebp - 8]
call fcn.00405e7a
mov eax, dword [0x4acbbc]
mov byte [eax], 2
mov eax, dword [ebp - 4]
add eax, 0xa664
mov edx, 1
call fcn.00406340
call fcn.0040284c
push 0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x2343c]
mov eax, dword [ebp - 4]
add eax, 0xa664
mov ecx, pe_nt_image_headers32
call fcn.00405f80
call fcn.0040284c
lea edx, [ebp - 0x22ec4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x428]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp dword [ebp - 0x22ec4], 0
je 0x49837e
mov dword [ebp - 0x10], 0xa000
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0xa038]
mov eax, dword [ebp - 4]
add eax, 0xa8fc
mov ecx, 0xa000
call fcn.00405f1c
call fcn.0040284c
mov edi, dword [ebp - 0x10]
test edi, edi
jle 0x498322
lea esi, [ebp - 0xa038]
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x234bd]
add byte [esi], al
inc esi
dec edi
jne 0x498313
push 0
lea edx, [ebp - 0xa038]
mov eax, dword [ebp - 4]
add eax, 0xa664
mov ecx, dword [ebp - 0x10]
call fcn.00405f80
call fcn.0040284c
cmp dword [ebp - 0x10], 0xa000
je 0x4982e5
mov eax, dword [ebp - 4]
add eax, 0xa8fc
call fcn.00405fe4
call fcn.0040284c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x237e8]
lea eax, [ebp - 0x22ec8]
mov ecx, 0x4987f0
call fcn.00403dbc
mov eax, dword [ebp - 0x22ec8]
call fcn.00408f60
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x23474]
dec edi
test edi, edi
jl 0x4983b4
inc edi
lea esi, [ebp - 0x22714]
push 0
mov edx, esi
mov eax, dword [ebp - 4]
add eax, 0xa664
mov ecx, 0x14
call fcn.00405f80
call fcn.0040284c
add esi, 0x14
dec edi
jne 0x498393
mov dword [ebp - 0x10], 0xa000
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0xa038]
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov ecx, 0xa000
call fcn.00405f1c
call fcn.0040284c
mov edi, dword [ebp - 0x10]
test edi, edi
jle 0x498404
lea esi, [ebp - 0xa038]
xor eax, eax
mov al, byte [esi]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x234bd]
add eax, edx
and eax, 0xff
mov byte [esi], al
inc esi
dec edi
jne 0x4983e9
push 0
lea edx, [ebp - 0xa038]
mov eax, dword [ebp - 4]
add eax, 0xa664
mov ecx, dword [ebp - 0x10]
call fcn.00405f80
call fcn.0040284c
cmp dword [ebp - 0x10], 0xa000
je 0x4983bb
mov eax, dword [ebp - 4]
add eax, 0xa7b0
call fcn.00405fe4
call fcn.0040284c
mov eax, dword [ebp - 0xc]
call fcn.00408f60
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov edx, dword [ebp - 0x1c]
call fcn.00405e7a
mov eax, dword [0x4acbbc]
mov byte [eax], 0
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov edx, 1
call fcn.00406329
call fcn.0040284c
mov dword [ebp - 0x10], 0xa000
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0xa038]
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov ecx, 0xa000
call fcn.00405f1c
call fcn.0040284c
push 0
lea edx, [ebp - 0xa038]
mov eax, dword [ebp - 4]
add eax, 0xa664
mov ecx, dword [ebp - 0x10]
call fcn.00405f80
call fcn.0040284c
cmp dword [ebp - 0x10], 0xa000
je 0x49847a
mov eax, dword [ebp - 4]
add eax, 0xa7b0
call fcn.00405fe4
call fcn.0040284c
mov eax, dword [ebp - 0x1c]
call fcn.00408f60
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov edx, dword [ebp - 0x20]
call fcn.00405e7a
mov eax, dword [0x4acbbc]
mov byte [eax], 0
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov edx, 1
call fcn.00406329
call fcn.0040284c
mov dword [ebp - 0x10], 0xa000
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0xa038]
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov ecx, 0xa000
call fcn.00405f1c
call fcn.0040284c
push 0
lea edx, [ebp - 0xa038]
mov eax, dword [ebp - 4]
add eax, 0xa664
mov ecx, dword [ebp - 0x10]
call fcn.00405f80
call fcn.0040284c
cmp dword [ebp - 0x10], 0xa000
je 0x498511
mov eax, dword [ebp - 4]
add eax, 0xa7b0
call fcn.00405fe4
call fcn.0040284c
mov eax, dword [ebp - 0x20]
call fcn.00408f60
mov eax, dword [ebp - 4]
add eax, 0xad04
mov edx, 0x498834
call fcn.00402a70
jbe 0x4985c0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x23838], 0
je 0x4985c0
lea eax, [ebp - 0x22e98]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x23838]
mov ecx, 0xff
call fcn.00403d4c
lea edx, [ebp - 0x22e98]
mov eax, dword [ebp - 4]
add eax, 0x235bd
mov cl, 0x14
call fcn.00402a40
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 4]
mov dword [edx + 0x235f4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 4]
mov dword [edx + 0x235f0], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp - 4]
mov dword [edx + 0x235f8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x235fc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa3b4]
mov edx, dword [ebp - 4]
mov dword [edx + 0x23600], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa3c4]
mov edx, dword [ebp - 4]
mov dword [edx + 0x23604], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa3c8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x23608], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa3bc]
mov edx, dword [ebp - 4]
mov dword [edx + 0x2360c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa3c0]
mov edx, dword [ebp - 4]
mov dword [edx + 0x23610], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa3b8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x23614], eax
push 0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x2353c]
mov eax, dword [ebp - 4]
add eax, 0xa664
mov ecx, 0x28c
call fcn.00405f80
call fcn.0040284c
mov eax, dword [ebp - 4]
add eax, 0xa664
call fcn.00405fe4
call fcn.0040284c
push 0xe4
mov ecx, 0xe4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0049ca6c
mov eax, dword [0x4acc8c]
mov eax, dword [eax]
xor edx, edx
call fcn.0044cc98
mov ebx, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498713
lea eax, [ebp - 0x22ec8]
mov edx, 0xc
call fcn.00403b14
lea eax, [ebp - 0x22d98]
mov edx, 2
call fcn.00403b14
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403b14
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403b14
ret