Function at 0x6c28b368
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
mov esi, dword [esp + 0x158]
mov ebx, dword [esp + 0x154]
mov edi, dword [ebx]
mov ebx, dword [esp + 0x150]
mov ecx, dword [ebx]
mov dword [esp + 0xcc], ecx
mov dword [esp + 0xd0], edi
mov dword [esp + 0xd4], edi
mov dword [esp + 0x12c], 0
mov ebx, dword [esp + 0x160]
mov eax, dword [ebx]
cmp eax, 2
jbe 0x6c28b3e0
mov ebx, 0x3d
mov eax, dword [esp + 0x150]
mov dword [eax], ecx
mov edx, dword [esp + 0x154]
mov dword [edx], edi
mov eax, ebx
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
je 0x6c28b82a
dec eax
je 0x6c28b80f
mov eax, dword [esp + 0x15c]
shr eax, 3
add eax, 8
mov dword [esp + 0x40], eax
cmp eax, 0xfffe
mov eax, 0xffff
cmova eax, dword [esp + 0x40]
mov dword [esp + 0x40], eax
mov edx, dword [esp + 0x40]
mov ebx, dword [esp + 0x15c]
lea eax, [edx + ebx - 1]
xor edx, edx
div dword [esp + 0x40]
mov dword [esp + 0x44], 1
test eax, eax
cmove eax, dword [esp + 0x44]
mov dword [esp + 0x44], eax
mov ebx, dword [esp + 0x160]
mov ebx, dword [ebx + 8]
mov dword [esp + 0x2c], ebx
mov dword [esp], 0x40000
mov dword [esp + 0x24], ecx
call sub.msvcrt.dll_malloc
mov ebx, eax
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x2c]
shl eax, 2
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [esp + 0x3c], eax
mov dword [esp + 0x80], eax
mov edx, dword [esp + 0x2c]
shl edx, 1
mov dword [esp], edx
mov dword [esp + 0x28], edx
call sub.msvcrt.dll_malloc
mov dword [esp + 0x34], eax
mov dword [esp + 0x7c], eax
mov edx, dword [esp + 0x28]
mov dword [esp], edx
call sub.msvcrt.dll_malloc
mov dword [esp + 0x38], eax
mov dword [esp + 0x8c], eax
mov dword [esp], 0x40c
call sub.msvcrt.dll_malloc
mov ebp, eax
mov dword [esp + 0x84], eax
mov edx, dword [esp + 0x28]
mov dword [esp], edx
call sub.msvcrt.dll_malloc
mov dword [esp + 0x88], eax
test ebx, ebx
mov ecx, dword [esp + 0x24]
je 0x6c28b820
mov edx, dword [esp + 0x34]
test edx, edx
je 0x6c28b820
mov edx, dword [esp + 0x3c]
test edx, edx
je 0x6c28b820
test ebp, ebp
je 0x6c28b820
test eax, eax
je 0x6c28b820
mov edx, dword [esp + 0x38]
test edx, edx
je 0x6c28b820
xor edx, edx
mov dword [ebx + edx*4], 0xffffffff
inc edx
cmp edx, 0x10000
jne 0x6c28b514
mov ebx, dword [esp + 0x2c]
test ebx, ebx
je 0x6c28b559
xor edx, edx
mov ecx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x3c]
nop
mov dword [ebx + edx*4], 0xffffffff
inc edx
cmp ecx, edx
jne 0x6c28b538
xor edx, edx
mov ecx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x34]
nop
mov word [ebx + edx*2], dx
inc edx
cmp ecx, edx
jne 0x6c28b550
xor edx, edx
nop
mov dword [ebp + edx*4], 0xffffffff
inc edx
cmp edx, 0x103
jne 0x6c28b55c
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x6c28b585
xor dx, dx
mov ecx, dword [esp + 0x2c]
mov word [eax + edx*2], dx
inc edx
cmp ecx, edx
jne 0x6c28b57c
mov ebx, dword [esp + 0x44]
dec ebx
mov dword [esp + 0x48], ebx
xor edi, edi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x64], esi
jmp 0x6c28b5c7
cmp eax, 2
je 0x6c28b94c
xor ebx, ebx
inc dword [esp + 0x2c]
mov edx, dword [esp + 0x2c]
cmp dword [esp + 0x44], edx
je 0x6c28bbbd
test ebx, ebx
jne 0x6c28bbbd
mov edi, ebp
mov ebx, dword [esp + 0x48]
cmp dword [esp + 0x2c], ebx
sete bl
movzx ebx, bl
mov dword [esp + 0x38], ebx
mov ebp, dword [esp + 0x40]
add ebp, edi
cmp ebp, dword [esp + 0x15c]
mov ebx, dword [esp + 0x15c]
cmovbe ebx, ebp
mov dword [esp + 0x34], ebx
mov ebx, dword [esp + 0x160]
mov eax, dword [ebx]
cmp eax, 1
jne 0x6c28b5a0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0
mov dword [esp], 0x480
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x6c28bd45
xor eax, eax
mov dword [ebx + eax*4], 8
inc eax
cmp eax, 0x90
jne 0x6c28b65c
nop
mov dword [ebx + eax*4], 9
inc eax
cmp eax, 0x100
jne 0x6c28b66c
nop
mov dword [ebx + eax*4], 7
inc eax
cmp eax, 0x118
jne 0x6c28b67c
nop
mov dword [ebx + eax*4], 8
inc eax
cmp eax, 0x120
jne 0x6c28b68c
lea esi, [esp + 0x90]
mov ecx, 0x120
mov edx, ebx
mov eax, esi
call fcn.6c28acb8
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov dword [esp], pe_nt_image_headers32
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x6c28bd51
xor eax, eax
mov dword [ebx + eax*4], 5
inc eax
cmp eax, 0x20
jne 0x6c28b6d0
lea eax, [esp + 0xa4]
mov dword [esp + 0x4c], eax
mov ecx, 0x20
mov edx, ebx
call fcn.6c28acb8
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov ecx, dword [esp + 0x12c]
test cl, 7
je 0x6c28bd09
mov eax, dword [esp + 0xd0]
dec eax
add eax, dword [esp + 0xcc]
and ecx, 7
mov ebx, dword [esp + 0x38]
shl ebx, cl
or byte [eax], bl
mov ecx, dword [esp + 0x12c]
inc ecx
mov dword [esp + 0x12c], ecx
test cl, 7
je 0x6c28bd27
mov eax, dword [esp + 0xd0]
dec eax
add eax, dword [esp + 0xcc]
and ecx, 7
mov edx, 1
shl edx, cl
or byte [eax], dl
mov eax, dword [esp + 0x12c]
inc eax
mov dword [esp + 0x12c], eax
test al, 7
je 0x6c28bceb
inc eax
mov dword [esp + 0x12c], eax
mov ebx, dword [esp + 0x160]
mov edx, dword [ebx + 4]
test edx, edx
jne 0x6c28bc6d
lea eax, [esp + 0xcc]
cmp dword [esp + 0x34], edi
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x12c]
mov dword [esp + 0x38], eax
jbe 0x6c28b7d6
mov ebx, dword [esp + 0x64]
nop
movzx eax, byte [ebx + edi]
shl eax, 2
mov edx, dword [esi + 4]
mov ecx, dword [edx + eax]
mov edx, dword [esi + 8]
mov eax, dword [edx + eax]
mov dword [esp], eax
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
call fcn.6c28a154
inc edi
cmp dword [esp + 0x34], edi
ja 0x6c28b7ac
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x400]
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x400]
mov dword [esp], eax
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
call fcn.6c28a154
xor ebx, ebx
mov eax, esi
call fcn.6c289ea0
mov eax, dword [esp + 0x4c]
call fcn.6c289ea0
jmp 0x6c28b5ab
mov ebx, dword [esp + 0x15c]
mov dword [esp + 0x40], ebx
jmp 0x6c28b413
mov ebx, 0x53
jmp 0x6c28b3be
mov eax, dword [esp + 0x15c]
add eax, 0xfffe
mov edx, 0x80008001
mul edx
shr edx, 0xf
mov dword [esp + 0x40], edx
je 0x6c28bde7
dec edx
mov dword [esp + 0x3c], edx
xor ebx, ebx
mov dword [esp + 0x2c], 0
lea ebp, [esp + 0xcc]
mov ecx, dword [esp + 0x3c]
xor edx, edx
cmp dword [esp + 0x2c], ecx
sete dl
mov eax, ebp
call fcn.6c28a0c0
mov eax, dword [esp + 0x15c]
sub eax, ebx
cmp eax, 0xfffe
ja 0x6c28b930
mov ecx, 0xffff
sub ecx, eax
movzx edx, al
movzx eax, ah
mov dword [esp + 0x30], eax
movzx eax, cl
mov dword [esp + 0x34], eax
movzx edi, ch
mov eax, ebp
call fcn.6c28a0c0
mov edx, dword [esp + 0x30]
mov eax, ebp
call fcn.6c28a0c0
mov edx, dword [esp + 0x34]
mov eax, ebp
call fcn.6c28a0c0
mov edx, edi
mov eax, ebp
call fcn.6c28a0c0
cmp dword [esp + 0x15c], ebx
jbe 0x6c28b909
lea ecx, [ebx + 1]
mov dword [esp + 0x30], ecx
movzx edx, byte [esi + ebx]
mov eax, ebp
call fcn.6c28a0c0
lea edi, [ebx + 0xffff]
mov ebx, dword [esp + 0x30]
jmp 0x6c28b900
movzx edx, byte [esi + ebx]
inc ebx
mov eax, ebp
call fcn.6c28a0c0
cmp ebx, edi
je 0x6c28b909
cmp ebx, dword [esp + 0x15c]
jne 0x6c28b8f0
inc dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
cmp dword [esp + 0x40], ecx
jne 0x6c28b860
mov ecx, dword [esp + 0xcc]
mov edi, dword [esp + 0xd0]
xor ebx, ebx
jmp 0x6c28b3be
xor edi, edi
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0xff
mov edx, 0xff
jmp 0x6c28b8a3
mov dword [esp + 0xd8], 0
mov dword [esp + 0xe0], 0
mov dword [esp + 0xdc], 0
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0xb8], 0
mov dword [esp + 0xbc], 0
mov dword [esp + 0xc0], 0
mov dword [esp + 0xe4], 0
mov dword [esp + 0xec], 0
mov dword [esp + 0xe8], 0
mov dword [esp + 0xf0], 0
mov dword [esp + 0xf8], 0
mov dword [esp + 0xf4], 0
mov dword [esp + 0xfc], 0
mov dword [esp + 0x104], 0
mov dword [esp + 0x100], 0
mov dword [esp + 0x108], 0
mov dword [esp + 0x110], 0
mov dword [esp + 0x10c], 0
mov dword [esp + 0x114], 0
mov dword [esp + 0x11c], 0
mov dword [esp + 0x118], 0
mov dword [esp + 0x120], 0
mov dword [esp + 0x128], 0
mov dword [esp + 0x124], 0
mov ebx, dword [esp + 0x160]
mov eax, dword [ebx + 4]
test eax, eax
je 0x6c28bc24
lea eax, [esp + 0xd8]
mov dword [esp + 0x54], eax
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 8]
mov dword [esp + 8], eax
mov ebx, dword [esp + 0x34]
mov dword [esp + 4], ebx
mov dword [esp], edi
mov ecx, dword [esp + 0x64]
lea edx, [esp + 0x78]
mov eax, dword [esp + 0x54]
call fcn.6c28a2ec
mov ebx, eax
test eax, eax
jne 0x6c28bb0f
mov edx, 0x11e
lea eax, [esp + 0xe4]
call fcn.6c28a97c
test eax, eax
jne 0x6c28bdb2
mov ebx, 0x53
lea esi, [esp + 0x90]
lea eax, [esp + 0xa4]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0xf0]
mov dword [esp + 0x60], eax
lea eax, [esp + 0x108]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x114]
mov dword [esp + 0x34], eax
lea eax, [esp + 0xfc]
mov dword [esp + 0x5c], eax
lea edi, [esp + 0xb8]
lea eax, [esp + 0x120]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x54]
call fcn.6c289e50
mov eax, dword [esp + 0x4c]
call fcn.6c289ea0
mov eax, esi
call fcn.6c289ea0
mov eax, edi
call fcn.6c289ea0
lea eax, [esp + 0xe4]
call fcn.6c289e50
mov eax, dword [esp + 0x60]
call fcn.6c289e50
mov eax, dword [esp + 0x5c]
call fcn.6c289e50
mov eax, dword [esp + 0x34]
call fcn.6c289e50
mov eax, dword [esp + 0x58]
call fcn.6c289e50
mov eax, dword [esp + 0x50]
call fcn.6c289e50
jmp 0x6c28b5ab
mov eax, dword [esp + 0x78]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x80]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x7c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x8c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x84]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov ecx, dword [esp + 0xcc]
mov edi, dword [esp + 0xd0]
jmp 0x6c28b3be
mov edx, dword [esp + 0x34]
sub edx, edi
lea eax, [esp + 0xd8]
mov dword [esp + 0x54], eax
call fcn.6c289ff8
test eax, eax
je 0x6c28bb0a
cmp dword [esp + 0x34], edi
jbe 0x6c28baf1
mov edx, dword [esp + 0xd8]
mov ecx, dword [esp + 0x34]
mov ebx, dword [esp + 0x64]
nop
movzx eax, byte [ebx + edi]
mov dword [edx + edi*4], eax
inc edi
cmp ecx, edi
ja 0x6c28bc5c
jmp 0x6c28baf1
mov dword [esp + 0xd8], 0
mov dword [esp + 0xe0], 0
mov dword [esp + 0xdc], 0
mov ebx, dword [esp + 0x160]
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 8]
mov dword [esp + 8], eax
mov ebx, dword [esp + 0x34]
mov dword [esp + 4], ebx
mov dword [esp], edi
mov ecx, dword [esp + 0x64]
lea edx, [esp + 0x78]
lea eax, [esp + 0xd8]
call fcn.6c28a2ec
mov ebx, eax
test eax, eax
je 0x6c28bd61
lea eax, [esp + 0xd8]
call fcn.6c289e50
jmp 0x6c28b7fa
lea eax, [esp + 0xcc]
mov dword [esp + 0x3c], eax
xor edx, edx
call fcn.6c28a0c0
mov eax, dword [esp + 0x12c]
jmp 0x6c28b770
lea eax, [esp + 0xcc]
mov dword [esp + 0x3c], eax
xor edx, edx
call fcn.6c28a0c0
mov ecx, dword [esp + 0x12c]
jmp 0x6c28b70c
lea eax, [esp + 0xcc]
mov dword [esp + 0x3c], eax
xor edx, edx
call fcn.6c28a0c0
mov ecx, dword [esp + 0x12c]
jmp 0x6c28b73e
lea esi, [esp + 0x90]
jmp 0x6c28b6b8
lea eax, [esp + 0xa4]
mov dword [esp + 0x4c], eax
jmp 0x6c28b6fc
lea eax, [esp + 0xcc]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x12c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
lea edx, [esp + 0xdc]
mov dword [esp], edx
lea ecx, [esp + 0xd8]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
call fcn.6c28a1c4
lea eax, [esp + 0xd8]
call fcn.6c289e50
jmp 0x6c28b7d6
lea eax, [esp + 0xf0]
mov dword [esp + 0x60], eax
mov edx, 0x1e
call fcn.6c28a97c
test eax, eax
jne 0x6c28bdee
mov ebx, 0x53
lea esi, [esp + 0x90]
lea eax, [esp + 0xa4]
mov dword [esp + 0x4c], eax
jmp 0x6c28bb2c
xor ebx, ebx
jmp 0x6c28b3be
mov eax, dword [esp + 0xdc]
test eax, eax
je 0x6c28c19d
mov ecx, dword [esp + 0xd8]
mov ebx, dword [esp + 0xe4]
mov esi, dword [esp + 0xf0]
xor edx, edx
mov eax, dword [ecx + edx*4]
inc dword [ebx + eax*4]
cmp eax, 0x100
jbe 0x6c28be2b
mov eax, dword [ecx + edx*4 + 8]
inc dword [esi + eax*4]
add edx, 3
inc edx
cmp edx, dword [esp + 0xdc]
jne 0x6c28be14
mov dword [ebx + 0x400], 1
lea eax, [esp + 0xa4]
mov dword [esp + 0x4c], eax
mov dword [esp + 4], 0xf
mov eax, dword [esp + 0xe8]
mov dword [esp], eax
mov ecx, 0x101
mov edx, ebx
mov eax, dword [esp + 0x4c]
call fcn.6c28b2b0
mov ebx, eax
lea esi, [esp + 0x90]
test eax, eax
jne 0x6c28bb2c
mov dword [esp + 4], 0xf
mov eax, dword [esp + 0xf4]
mov dword [esp], eax
mov ecx, 2
mov edx, dword [esp + 0xf0]
mov eax, esi
call fcn.6c28b2b0
mov ebx, eax
test eax, eax
jne 0x6c28bb2c
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x6c], 0x11e
cmp eax, 0x11e
cmova eax, dword [esp + 0x6c]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x68], 0x1e
cmp eax, 0x1e
cmova eax, dword [esp + 0x68]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x6c28c18d
xor ebx, ebx
lea eax, [esp + 0x108]
mov dword [esp + 0x58], eax
mov edi, dword [esp + 0x4c]
mov eax, dword [edi + 8]
mov edx, dword [eax + ebx*4]
mov eax, dword [esp + 0x58]
call fcn.6c28a2bc
inc ebx
cmp dword [esp + 0x6c], ebx
jne 0x6c28bf01
mov eax, dword [esp + 0x68]
test eax, eax
je 0x6c28bf37
xor ebx, ebx
mov eax, dword [esi + 8]
mov edx, dword [eax + ebx*4]
mov eax, dword [esp + 0x58]
call fcn.6c28a2bc
inc ebx
cmp dword [esp + 0x68], ebx
jne 0x6c28bf21
mov ebx, dword [esp + 0x10c]
test ebx, ebx
je 0x6c28c1a9
xor edi, edi
lea eax, [esp + 0x114]
mov dword [esp + 0x34], eax
mov dword [esp + 0x5c], ebp
mov ebp, esi
lea ecx, [edi + 1]
mov dword [esp + 0x3c], ecx
mov eax, dword [esp + 0x108]
cmp ecx, ebx
jae 0x6c28c183
mov edx, dword [esp + 0x3c]
mov ecx, dword [eax + edx*4]
lea esi, [eax + edi*4]
mov eax, dword [esi]
cmp ecx, eax
jne 0x6c28c17a
lea edx, [ebx - 1]
sub edx, edi
mov ebx, 1
jmp 0x6c28bf9a
lea eax, [ebx + 1]
cmp dword [esi + eax*4], ecx
jne 0x6c28bf9e
mov ebx, eax
cmp ebx, edx
jne 0x6c28bf90
test ecx, ecx
jne 0x6c28c030
cmp ebx, 1
jbe 0x6c28c09a
lea esi, [ebx + 1]
cmp esi, 0xa
jbe 0x6c28c138
cmp esi, 0x8a
mov edx, 0x8a
cmova esi, edx
mov dl, 0x12
mov eax, dword [esp + 0x34]
call fcn.6c28a2bc
lea edx, [esi - 0xb]
mov eax, dword [esp + 0x34]
call fcn.6c28a2bc
add edi, esi
mov ebx, dword [esp + 0x10c]
cmp ebx, edi
jne 0x6c28bf59
mov esi, ebp
mov ebp, dword [esp + 0x5c]
lea eax, [esp + 0xfc]
mov dword [esp + 0x5c], eax
mov edx, 0x13
call fcn.6c28a97c
test eax, eax
jne 0x6c28c0ae
mov ebx, 0x53
lea edi, [esp + 0xb8]
lea eax, [esp + 0x120]
mov dword [esp + 0x50], eax
jmp 0x6c28bb5f
cmp ebx, 2
jbe 0x6c28c09a
mov eax, 0xaaaaaaab
mul ebx
mov esi, edx
shr esi, 2
lea eax, [esi + esi*2]
shl eax, 1
mov edx, ebx
sub edx, eax
mov dword [esp + 0x50], edx
mov edx, ecx
mov eax, dword [esp + 0x34]
call fcn.6c28a2bc
test esi, esi
je 0x6c28c080
xor edi, edi
mov edx, 0x10
mov eax, dword [esp + 0x34]
call fcn.6c28a2bc
mov edx, 3
mov eax, dword [esp + 0x34]
call fcn.6c28a2bc
inc edi
cmp edi, esi
jne 0x6c28c05f
cmp dword [esp + 0x50], 2
ja 0x6c28c157
sub ebx, dword [esp + 0x50]
mov edi, dword [esp + 0x3c]
add edi, ebx
jmp 0x6c28bfe2
mov edx, ecx
mov eax, dword [esp + 0x34]
call fcn.6c28a2bc
mov edi, dword [esp + 0x3c]
jmp 0x6c28bfe2
mov ebx, dword [esp + 0xfc]
mov eax, dword [esp + 0x118]
test eax, eax
je 0x6c28c0e1
mov edi, dword [esp + 0x114]
xor ecx, ecx
lea eax, [edi + ecx*4]
mov edx, dword [eax]
inc dword [ebx + edx*4]
cmp dword [eax], 0x10
sbb ecx, 0xffffffff
inc ecx
cmp ecx, dword [esp + 0x118]
jne 0x6c28c0c9
mov ecx, dword [esp + 0x100]
lea edi, [esp + 0xb8]
mov dword [esp + 4], 7
mov dword [esp], ecx
mov edx, ebx
mov eax, edi
call fcn.6c28b2b0
mov ebx, eax
lea eax, [esp + 0x120]
mov dword [esp + 0x50], eax
test ebx, ebx
jne 0x6c28bb5f
mov edx, dword [esp + 0xc8]
call fcn.6c289ff8
test eax, eax
jne 0x6c28c1b9
mov ebx, 0x53
jmp 0x6c28bb5f
mov edx, 0x11
mov eax, dword [esp + 0x34]
call fcn.6c28a2bc
lea edx, [ebx - 2]
mov eax, dword [esp + 0x34]
call fcn.6c28a2bc
jmp 0x6c28bfe0
mov edx, 0x10
mov eax, dword [esp + 0x34]
call fcn.6c28a2bc
mov edx, dword [esp + 0x50]
sub edx, 3
mov eax, dword [esp + 0x34]
call fcn.6c28a2bc
jmp 0x6c28c08f
mov ecx, eax
xor ebx, ebx
jmp 0x6c28bf9e
mov ecx, dword [eax + edi*4]
xor ebx, ebx
jmp 0x6c28bf9e
lea eax, [esp + 0x108]
mov dword [esp + 0x58], eax
jmp 0x6c28bf17
mov ebx, dword [esp + 0xe4]
jmp 0x6c28be35
lea eax, [esp + 0x114]
mov dword [esp + 0x34], eax
jmp 0x6c28bff7
mov eax, dword [esp + 0xc8]
test eax, eax
je 0x6c28c1f3
mov edx, dword [esp + 0x120]
mov dword [esp + 0x3c], edx
xor ecx, ecx
mov edx, dword [ecx*4 + 0x6c3757a0]
mov eax, dword [edi + 8]
mov eax, dword [eax + edx*4]
mov edx, dword [esp + 0x3c]
mov dword [edx + ecx*4], eax
inc ecx
cmp ecx, dword [esp + 0xc8]
jne 0x6c28c1d1
mov ecx, edx
jmp 0x6c28c1fe
mov ecx, dword [esp + 0x120]
mov dword [esp + 0x3c], ecx
mov eax, dword [esp + 0x124]
lea edx, [eax - 1]
mov ecx, dword [ecx + edx*4]
test ecx, ecx
jne 0x6c28c22e
cmp eax, 4
jbe 0x6c28c22e
mov eax, dword [esp + 0x50]
call fcn.6c289ff8
test eax, eax
je 0x6c28c12c
mov ecx, dword [esp + 0x120]
jmp 0x6c28c1fe
mov ecx, dword [esp + 0x12c]
lea eax, [esp + 0xcc]
mov dword [esp + 0x3c], eax
test cl, 7
jne 0x6c28c253
xor edx, edx
call fcn.6c28a0c0
mov ecx, dword [esp + 0x12c]
mov eax, dword [esp + 0xd0]
dec eax
add eax, dword [esp + 0xcc]
and ecx, 7
mov edx, dword [esp + 0x38]
shl edx, cl
or byte [eax], dl
mov eax, dword [esp + 0x12c]
inc eax
mov dword [esp + 0x12c], eax
test al, 7
jne 0x6c28c292
xor edx, edx
mov eax, dword [esp + 0x3c]
call fcn.6c28a0c0
mov eax, dword [esp + 0x12c]
lea ecx, [eax + 1]
mov dword [esp + 0x12c], ecx
test cl, 7
jne 0x6c28c2b3
xor edx, edx
mov eax, dword [esp + 0x3c]
call fcn.6c28a0c0
mov ecx, dword [esp + 0x12c]
mov eax, dword [esp + 0xd0]
dec eax
add eax, dword [esp + 0xcc]
and ecx, 7
mov edx, 1
shl edx, cl
or byte [eax], dl
inc dword [esp + 0x12c]
mov ecx, dword [esp + 0x6c]
sub ecx, 0x101
mov eax, dword [esp + 0x68]
dec eax
mov dword [esp + 0x6c], eax
mov edx, dword [esp + 0x124]
lea eax, [edx - 4]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x120]
mov edx, dword [eax + edx*4 - 4]
test edx, edx
jne 0x6c28c374
mov edx, dword [esp + 0x68]
test edx, edx
je 0x6c28c31d
mov edx, dword [esp + 0x68]
dec edx
cmp dword [eax + edx*4 + 0xc], 0
jne 0x6c28c370
test edx, edx
jne 0x6c28c311
lea eax, [esp + 0x12c]
mov dword [esp + 0x38], eax
mov dword [esp], 5
mov edx, dword [esp + 0x3c]
call fcn.6c28a0f0
mov dword [esp], 5
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
call fcn.6c28a0f0
mov dword [esp], 4
xor ecx, ecx
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
call fcn.6c28a0f0
mov dword [esp + 0x68], 4
jmp 0x6c28c3cc
mov dword [esp + 0x68], edx
lea eax, [esp + 0x12c]
mov dword [esp + 0x38], eax
mov dword [esp], 5
mov edx, dword [esp + 0x3c]
call fcn.6c28a0f0
mov dword [esp], 5
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
call fcn.6c28a0f0
mov dword [esp], 4
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
call fcn.6c28a0f0
mov edx, dword [esp + 0x68]
add edx, 4
mov dword [esp + 0x68], edx
je 0x6c28c404
mov dword [esp + 0x6c], 0
mov eax, dword [esp + 0x120]
mov edx, dword [esp + 0x6c]
mov ecx, dword [eax + edx*4]
mov dword [esp], 3
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
call fcn.6c28a0f0
inc dword [esp + 0x6c]
mov ecx, dword [esp + 0x6c]
cmp dword [esp + 0x68], ecx
jne 0x6c28c3d4
mov eax, dword [esp + 0x118]
test eax, eax
je 0x6c28c49e
xor eax, eax
mov dword [esp + 0x6c], ebp
mov ebp, ebx
mov ebx, eax
lea eax, [ebx*4]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x114]
mov edx, dword [esp + 0x68]
mov eax, dword [eax + edx]
shl eax, 2
mov edx, dword [edi + 4]
mov ecx, dword [edx + eax]
mov edx, dword [edi + 8]
mov eax, dword [edx + eax]
mov dword [esp], eax
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
call fcn.6c28a154
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x68]
mov edx, dword [eax + ecx]
cmp edx, 0x10
je 0x6c28c4fa
cmp edx, 0x11
je 0x6c28c4e0
cmp edx, 0x12
jne 0x6c28c48e
inc ebx
mov ecx, dword [eax + ebx*4]
mov dword [esp], 7
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
call fcn.6c28a0f0
inc ebx
cmp ebx, dword [esp + 0x118]
jne 0x6c28c41d
mov ebx, ebp
mov ebp, dword [esp + 0x6c]
mov dword [esp + 8], esi
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], eax
lea edx, [esp + 0xdc]
mov dword [esp], edx
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
call fcn.6c28a1c4
mov ecx, dword [esp + 0x4c]
mov eax, dword [ecx + 8]
mov edx, dword [eax + 0x400]
test edx, edx
jne 0x6c28c517
mov ebx, 0x40
jmp 0x6c28bb5f
inc ebx
mov ecx, dword [eax + ebx*4]
mov dword [esp], 3
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
call fcn.6c28a0f0
jmp 0x6c28c48e
inc ebx
mov ecx, dword [eax + ebx*4]
mov dword [esp], 2
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
call fcn.6c28a0f0
jmp 0x6c28c48e
mov eax, dword [ecx + 4]
mov ecx, dword [eax + 0x400]
mov dword [esp], edx
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
call fcn.6c28a154
jmp 0x6c28bb5f