Function at 0x40eed0
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x470
mov ecx, dword [0x5b5574]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
lea eax, [esp + 0x80]
push 0x40
push eax
xor ebx, ebx
push 0x4e73
push ecx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x74], ebx
call esi
mov eax, dword [esp + 0x490]
lea edx, [esp + 0x80]
push 0x598360
push edx
push eax
call fcn.004d5ee1
mov ecx, dword [esp + 0x4a0]
mov edx, dword [0x5b5574]
add esp, 0xc
push 0x20
push ecx
push 0x4cd
push edx
call esi
mov ebp, dword [esp + 0x484]
push 0x598030
push ebp
call fcn.004d5ece
mov edi, eax
add esp, 8
cmp edi, ebx
mov dword [esp + 0x10], edi
jne 0x40efaf
mov ecx, dword [0x5b5574]
lea eax, [esp + 0x80]
push 0x40
push eax
push 0x4e70
push ecx
call esi
mov eax, dword [esp + 0x490]
lea edx, [esp + 0x80]
push ebp
push edx
push eax
call fcn.004d5ee1
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x470
ret
push edi
push 0x1e
lea ecx, [esp + 0x2c]
push 1
push ecx
call fcn.004d58aa
add esp, 0x10
cmp eax, 0x1e
je 0x40efcc
push edi
jmp 0x4103a1
mov eax, dword [esp + 0x28]
xor edx, edx
mov dl, byte [esp + 0x29]
xor ecx, ecx
shl eax, 8
mov cl, byte [esp + 0x31]
xor dl, al
and edx, 0xff
xor edx, eax
mov eax, dword [esp + 0x30]
shl eax, 8
xor cl, al
mov di, dx
and ecx, 0xff
mov word [esp + 0x28], di
xor ecx, eax
mov word [esp + 0x30], cx
mov ecx, dword [esp + 0x36]
mov eax, ecx
mov edx, ecx
and eax, 0xff0000
shr edx, 0x10
or eax, edx
mov edx, ecx
shl edx, 0x10
and ecx, 0xff00
or edx, ecx
mov ecx, dword [esp + 0x32]
shr eax, 8
shl edx, 8
or eax, edx
mov esi, ecx
mov edx, ecx
and esi, 0xff0000
shr edx, 0x10
or esi, edx
mov edx, ecx
shl edx, 0x10
and ecx, 0xff00
mov dword [esp + 0x36], eax
or edx, ecx
mov ecx, dword [esp + 0x3a]
shr esi, 8
shl edx, 8
or esi, edx
xor edx, edx
mov dl, byte [esp + 0x3b]
mov dword [esp + 0x32], esi
shl ecx, 8
xor dl, cl
and edx, 0xff
xor edx, ecx
mov ecx, dword [esp + 0x3c]
mov word [esp + 0x3a], dx
xor edx, edx
mov dl, byte [esp + 0x3d]
shl ecx, 8
xor dl, cl
and edx, 0xff
xor edx, ecx
mov ecx, dword [esp + 0x3e]
mov word [esp + 0x3c], dx
mov edx, ecx
mov ebp, ecx
and edx, 0xff0000
shr ebp, 0x10
or edx, ebp
mov ebp, ecx
shl ebp, 0x10
and ecx, 0xff00
or ebp, ecx
mov ecx, 0x7530
shr edx, 8
shl ebp, 8
or edx, ebp
cmp di, 2
mov dword [esp + 0x3e], edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x50], ecx
jne 0x40f0e2
mov ecx, 0x493e0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x50], ecx
lea ebp, [esp + 0x24]
mov ecx, str.8BPS
mov ebp, dword [ebp]
cmp ebp, dword [ecx]
jne 0x41039c
test eax, eax
jle 0x41039c
test esi, esi
jle 0x41039c
cmp eax, dword [esp + 0x50]
ja 0x41039c
cmp esi, dword [esp + 0x20]
ja 0x41039c
cmp di, 1
je 0x40f12a
cmp di, 2
jne 0x41039c
mov eax, dword [esp + 0x3a]
mov ecx, dword [esp + 0x30]
and eax, 0xffff
and ecx, 0xffff
imul eax, ecx
cmp eax, 1
jl 0x410395
mov cx, word [esp + 0x3a]
cmp cx, 1
je 0x40f16a
cmp cx, 8
je 0x40f16a
cmp cx, 0x10
je 0x40f16a
cmp cx, 0x20
jne 0x410395
mov cx, word [esp + 0x30]
test cx, cx
jbe 0x410395
cmp cx, 0x38
ja 0x410395
mov si, word [esp + 0x3c]
cmp si, 9
ja 0x410395
mov ecx, dword [esp + 0x488]
test ecx, ecx
je 0x40f19e
mov dword [ecx], eax
xor eax, eax
mov byte [esp + eax + 0x180], al
mov byte [esp + eax + 0x280], al
mov byte [esp + eax + 0x380], al
inc eax
cmp eax, 0x100
jb 0x40f1a0
cmp si, 2
je 0x40f1c7
test edx, edx
je 0x40f1ee
cmp edx, 0x300
jb 0x40f1d4
mov edx, 0x300
mov esi, dword [esp + 0x10]
push esi
push edx
lea edx, [esp + 0x188]
push 1
push edx
call fcn.004d58aa
add esp, 0x10
jmp 0x40f1f2
mov esi, dword [esp + 0x10]
push esi
push 4
lea eax, [esp + 0x84]
push 1
push eax
call fcn.004d58aa
mov eax, dword [esp + 0x8c]
push esi
mov ecx, eax
mov edx, eax
and ecx, 0xff0000
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
mov dword [esp + 0x90], ecx
call fcn.004d5c9d
mov ebp, eax
mov eax, dword [esp + 0x90]
add esp, 0x14
test eax, eax
jle 0x40f25f
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push eax
push esi
call fcn.0040ed60
add esp, 0x10
push 0
push ebp
push esi
call fcn.004d5be4
mov eax, dword [esp + 0x88]
push 1
push eax
push esi
call fcn.004d5be4
add esp, 0x18
cmp word [esp + 0x28], 2
lea ecx, [esp + 0x74]
push esi
jne 0x40f2b0
push 8
push 1
push ecx
call fcn.004d58aa
mov edx, dword [esp + 0x88]
mov eax, dword [esp + 0x84]
push edx
push eax
call fcn.0040eb90
add esp, 0x18
mov dword [esp + 0x78], edx
jmp 0x40f320
push 4
push 1
push ecx
call fcn.004d58aa
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0x88]
mov edx, ecx
mov esi, ecx
shrd edx, eax, 0x10
xor eax, eax
xor edi, edi
and edx, 0xff00
and esi, 0xff0000
or eax, edi
or edx, esi
mov esi, eax
xor ebp, ebp
shrd edx, esi, 8
mov eax, edx
mov edx, ecx
and edx, 0xff
and ecx, 0xff00
shld edi, edx, 0x10
shl edx, 0x10
or edx, ecx
or edi, ebp
shld edi, edx, 8
shl edx, 8
shr esi, 8
add esp, 0x10
or eax, edx
or esi, edi
mov dword [esp + 0x78], esi
mov esi, dword [esp + 0x10]
push 1
push eax
push esi
mov dword [esp + 0x80], eax
call fcn.004d5be4
push esi
push 2
lea eax, [esp + 0x78]
push 1
push eax
call fcn.004d58aa
mov ebp, dword [esp + 0x80]
mov edi, dword [esp + 0x4b0]
mov eax, ebp
mov ecx, ebp
shl eax, 8
sar ecx, 8
xor cl, al
add esp, 0x1c
and ecx, 0xff
xor eax, ecx
cmp ax, 1
mov dword [esp + 0x64], eax
jne 0x40f383
mov edx, dword [0x5b5574]
push 0x20
push edi
push 0x4e74
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
mov ebp, 4
cmp word [esp + 0x3c], bp
jne 0x40f39d
push str.__CMYK
push edi
call fcn.004d62f1
add esp, 8
cmp word [esp + 0x28], 2
jne 0x40f3b3
push str.__PSB_
push edi
call fcn.004d62f1
add esp, 8
test byte [esi + 0xc], 0x30
jne 0x410392
mov ecx, dword [esp + 0x3a]
mov eax, dword [esp + 0x30]
and ecx, 0xffff
and eax, 0xffff
imul ecx, eax
cmp ecx, 0x10
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x60], ecx
jne 0x40f3e7
mov ecx, 8
jmp 0x40f412
cmp ecx, 0x20
jne 0x40f3fb
cmp word [esp + 0x64], 0
jne 0x40f416
mov ecx, 0x18
jmp 0x40f412
jle 0x40f416
cmp word [esp + 0x3c], bp
mov ecx, 0x18
mov dword [esp + 0x60], ecx
jne 0x40f416
mov ecx, 0x20
mov dword [esp + 0x60], ecx
cmp ecx, 8
mov dword [esp + 0x54], 0
jg 0x40f42e
mov eax, 1
shl eax, cl
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x60]
mov edi, dword [esp + 0x36]
imul eax, edi
add eax, 0x1f
mov esi, dword [esp + 0x32]
cdq
and edx, 0x1f
add eax, edx
mov ebp, eax
sar ebp, 5
shl ebp, 2
mov ecx, ebp
mov dword [esp + 0x48], ebp
imul ecx, esi
test edi, edi
jle 0x41038b
test esi, esi
jle 0x41038b
test ebp, ebp
jle 0x41038b
mov eax, ecx
xor edx, edx
div esi
test eax, eax
jle 0x41038b
test ecx, ecx
jle 0x41038b
cmp edi, dword [esp + 0x50]
ja 0x41038b
cmp esi, dword [esp + 0x20]
ja 0x41038b
cmp eax, ebp
jb 0x41038b
cmp ecx, 0xfffffbd7
ja 0x41038b
mov edx, dword [esp + 0x54]
lea eax, [ecx + edx*4 + 0x28]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [esp + 0x68], eax
jne 0x40f4fe
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004d5e20
mov edx, dword [esp + 0x494]
mov eax, dword [0x5b5574]
add esp, 4
push 0x80
push edx
push 0x50a
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x470
ret
mov ecx, dword [esp + 0x68]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push ecx
call edi
mov dword [eax], 0x28
mov edx, dword [esp + 0x36]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x32]
mov dword [eax + 0x20], edx
xor edx, edx
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x60]
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x24], edx
mov edx, dword [esp + 0x1c]
cmp ecx, 8
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x14]
mov word [eax + 0xe], cx
mov word [eax + 0xc], 1
mov dword [eax + 0x1c], edx
jg 0x40f5aa
cmp dword [esp + 0x6c], 8
je 0x40f578
cmp ecx, 8
je 0x40f578
mov byte [eax + 0x2e], 0
mov byte [eax + 0x2d], 0
mov byte [eax + 0x2c], 0
mov byte [eax + 0x2a], 0xff
mov byte [eax + 0x29], 0xff
mov byte [eax + 0x28], 0xff
jmp 0x40f5aa
xor esi, esi
lea ecx, [eax + 0x29]
mov dl, byte [esp + esi + 0x180]
inc esi
mov byte [ecx + 1], dl
mov dl, byte [esp + esi + 0x27f]
mov byte [ecx], dl
mov dl, byte [esp + esi + 0x37f]
mov byte [ecx - 1], dl
add ecx, 4
cmp esi, 0x100
jb 0x40f57d
mov ebp, dword [esp + 0x48]
mov ecx, dword [eax]
mov edx, dword [esp + 0x54]
lea ecx, [ecx + edx*4]
add ecx, eax
mov eax, dword [esp + 0x6c]
cmp eax, 0x18
mov dword [esp + 0x1c], ecx
jl 0x40f67e
mov esi, dword [esp + 0x36]
mov ebx, dword [esp + 0x32]
mov ecx, ebx
lea eax, [esi + esi]
imul ecx, eax
test esi, esi
mov dword [esp + 0x18], eax
jle 0x40f652
test ebx, ebx
jle 0x40f652
test eax, eax
jle 0x40f652
mov eax, ecx
xor edx, edx
div ebx
test eax, eax
jle 0x40f652
test ecx, ecx
jle 0x40f652
cmp esi, dword [esp + 0x50]
ja 0x40f652
cmp ebx, dword [esp + 0x20]
ja 0x40f652
cmp eax, dword [esp + 0x18]
jb 0x40f652
cmp ecx, 0xfffffbd7
ja 0x40f652
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call edi
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x44], ebx
jne 0x40f67e
mov eax, dword [esp + 0x10]
push eax
call fcn.004d5e20
mov ecx, dword [esp + 0x494]
mov edx, dword [0x5b5574]
add esp, 4
push 0x80
push ecx
push 0x50a
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
jmp 0x40f65f
mov eax, dword [esp + 0x10]
push eax
call fcn.004d5e20
add esp, 4
mov esi, dword [esp + 0x68]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x470
ret
mov eax, dword [esp + 0x64]
cmp ax, 1
jne 0x40f7ac
mov eax, dword [esp + 0x36]
lea eax, [eax + eax*2]
add eax, eax
test eax, eax
mov dword [esp + 0x70], eax
jle 0x40f6be
mov ecx, dword [esp + 0x32]
shl ecx, 4
test ecx, ecx
jle 0x40f6be
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
push 0x40
call esi
push eax
call edi
test eax, eax
mov dword [esp + 0x5c], eax
jne 0x40f706
mov edx, dword [esp + 0x10]
push edx
call fcn.004d5e20
mov eax, dword [esp + 0x494]
mov ecx, dword [0x5b5574]
add esp, 4
push 0x80
push eax
push 0x50a
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
test ebx, ebx
je 0x40f791
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
jmp 0x40f785
cmp word [esp + 0x28], 2
jne 0x40f718
mov edx, dword [esp + 0x32]
shl edx, 4
push edx
jmp 0x40f724
mov eax, dword [esp + 0x32]
lea ecx, [eax*8]
push ecx
push 0x40
call esi
push eax
call edi
test eax, eax
mov dword [esp + 0x4c], eax
jne 0x40f7a8
mov edx, dword [esp + 0x10]
push edx
call fcn.004d5e20
mov eax, dword [esp + 0x494]
mov ecx, dword [0x5b5574]
add esp, 4
push 0x80
push eax
push 0x50a
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
mov edi, dword [esp + 0x5c]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push edi
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push eax
call ebp
push edi
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
call edi
test ebx, ebx
je 0x40f791
push ebx
call esi
push eax
call ebp
push ebx
call esi
push eax
call edi
mov esi, dword [esp + 0x68]
push esi
call ebp
push esi
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x470
ret
mov eax, dword [esp + 0x64]
test ax, ax
jne 0x40fc31
mov edx, dword [esp + 0x6c]
lea eax, [edx - 1]
cmp eax, 0x5f
ja case.0x40fc53.6
xor ecx, ecx
mov cl, byte [eax + 0x4103d0]
jmp dword [ecx*4 + 0x4103b8]
mov edx, dword [esp + 0x36]
lea eax, [edx + 7]
shr eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x32]
dec eax
test eax, eax
jl case.0x40fc53.6
mov esi, eax
mov ecx, dword [esp + 0x1c]
imul esi, ebp
mov edi, ebp
lea ebp, [eax + 1]
neg edi
add esi, ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push ecx
push 1
push edx
push esi
call fcn.004d58aa
add esp, 0x10
add esi, edi
dec ebp
jne 0x40f801
jmp case.0x40fc53.6
mov eax, dword [esp + 0x32]
dec eax
test eax, eax
jl case.0x40fc53.6
mov esi, eax
mov ecx, dword [esp + 0x1c]
imul esi, ebp
mov edi, ebp
lea ebp, [eax + 1]
neg edi
add esi, ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x36]
push ecx
push 1
push edx
push esi
call fcn.004d58aa
add esp, 0x10
add esi, edi
dec ebp
jne 0x40f83f
jmp case.0x40fc53.6
mov eax, dword [esp + 0x36]
lea ecx, [eax + eax]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call edi
mov esi, eax
test esi, esi
je case.0x40fc53.6
mov edx, dword [esp + 0x32]
lea ecx, [edx - 1]
test ecx, ecx
jl 0x40f8de
mov edi, ecx
mov eax, dword [esp + 0x36]
imul edi, ebp
mov edx, ebp
add eax, eax
neg edx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x1c]
add edi, edx
lea ebp, [ecx + 1]
mov ecx, dword [esp + 0x10]
push ecx
push 1
push eax
push esi
call fcn.004d58aa
mov edx, dword [esp + 0x46]
add esp, 0x10
xor ecx, ecx
lea eax, [edx + edx]
test eax, eax
jbe 0x40f8d5
mov edx, edi
mov al, byte [esi + ecx]
add ecx, 2
mov byte [edx], al
mov eax, dword [esp + 0x36]
add eax, eax
inc edx
cmp ecx, eax
jb 0x40f8c2
mov edx, dword [esp + 0x14]
add edi, edx
dec ebp
jne 0x40f8a2
mov edi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp case.0x40fc53.6
mov ax, word [esp + 0x3a]
cmp ax, 8
jne 0x40fa8b
mov edx, dword [esp + 0x32]
mov ecx, dword [esp + 0x10]
imul edx, dword [esp + 0x36]
push ecx
push 1
push edx
push ebx
call fcn.004d58aa
mov edx, dword [esp + 0x42]
add esp, 0x10
xor esi, esi
lea eax, [edx - 1]
test eax, eax
jl 0x40f98e
mov ecx, ebp
mov edi, dword [esp + 0x1c]
neg ecx
mov dword [esp + 0x18], ecx
mov ecx, eax
imul ecx, ebp
inc eax
lea edi, [ecx + edi + 2]
mov ecx, dword [esp + 0x36]
mov dword [esp + 0x14], eax
xor eax, eax
test ecx, ecx
jbe 0x40f97a
mov edx, edi
mov ebp, esi
add edx, 3
imul ebp, ecx
add ebp, eax
inc eax
mov cl, byte [ebx + ebp]
mov byte [edx - 3], cl
mov ecx, dword [esp + 0x36]
cmp eax, ecx
jb 0x40f959
mov edx, dword [esp + 0x32]
mov ebp, dword [esp + 0x48]
mov eax, dword [esp + 0x18]
add edi, eax
mov eax, dword [esp + 0x14]
inc esi
dec eax
mov dword [esp + 0x14], eax
jne 0x40f951
jmp 0x40f992
mov ecx, dword [esp + 0x36]
mov eax, dword [esp + 0x10]
imul edx, ecx
push eax
push 1
push edx
push ebx
call fcn.004d58aa
mov edx, dword [esp + 0x42]
add esp, 0x10
xor esi, esi
lea eax, [edx - 1]
test eax, eax
jl 0x40fa0e
mov ecx, ebp
mov edi, dword [esp + 0x1c]
neg ecx
mov dword [esp + 0x18], ecx
mov ecx, eax
imul ecx, ebp
inc eax
lea edi, [ecx + edi + 1]
mov ecx, dword [esp + 0x36]
mov dword [esp + 0x14], eax
xor eax, eax
test ecx, ecx
jbe 0x40f9fa
mov edx, edi
mov ebp, esi
add edx, 3
imul ebp, ecx
add ebp, eax
inc eax
mov cl, byte [ebx + ebp]
mov byte [edx - 3], cl
mov ecx, dword [esp + 0x36]
cmp eax, ecx
jb 0x40f9d9
mov edx, dword [esp + 0x32]
mov ebp, dword [esp + 0x48]
mov eax, dword [esp + 0x18]
add edi, eax
mov eax, dword [esp + 0x14]
inc esi
dec eax
mov dword [esp + 0x14], eax
jne 0x40f9d1
jmp 0x40fa12
mov ecx, dword [esp + 0x36]
mov eax, dword [esp + 0x10]
imul edx, ecx
push eax
push 1
push edx
push ebx
call fcn.004d58aa
mov ecx, dword [esp + 0x42]
add esp, 0x10
xor esi, esi
lea eax, [ecx - 1]
test eax, eax
jl case.0x40fc53.6
mov edi, eax
mov edx, dword [esp + 0x1c]
imul edi, ebp
mov ecx, ebp
add edi, edx
mov edx, dword [esp + 0x36]
neg ecx
inc eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
xor eax, eax
test edx, edx
jbe 0x40fa78
mov ecx, edi
mov ebp, esi
add ecx, 3
imul ebp, edx
add ebp, eax
inc eax
mov dl, byte [ebx + ebp]
mov byte [ecx - 3], dl
mov edx, dword [esp + 0x36]
cmp eax, edx
jb 0x40fa5b
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add edi, ecx
inc esi
dec eax
mov dword [esp + 0x14], eax
jne 0x40fa53
jmp case.0x40fc53.6
cmp ax, 0x10
jne case.0x40fc53.6
mov ecx, dword [esp + 0x32]
mov eax, dword [esp + 0x10]
imul ecx, dword [esp + 0x36]
push eax
add ecx, ecx
push 1
push ecx
push ebx
call fcn.004d58aa
mov esi, dword [esp + 0x42]
mov edx, dword [esp + 0x46]
add esp, 0x10
xor edi, edi
lea eax, [esi - 1]
test eax, eax
jl 0x40fb24
mov ebx, ebp
lea ecx, [edx + edx]
neg ebx
mov dword [esp + 0x18], ebx
mov ebx, eax
imul ebx, ebp
mov ebp, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x14], eax
lea ebp, [ebx + ebp + 2]
mov ebx, dword [esp + 0x44]
xor eax, eax
test ecx, ecx
jbe 0x40fb0e
mov esi, ebp
mov ecx, edi
add esi, 3
imul ecx, edx
lea edx, [eax + ecx*2]
add eax, 2
mov cl, byte [edx + ebx]
mov byte [esi - 3], cl
mov edx, dword [esp + 0x36]
lea ecx, [edx + edx]
cmp eax, ecx
jb 0x40faeb
mov esi, dword [esp + 0x32]
mov eax, dword [esp + 0x18]
add ebp, eax
mov eax, dword [esp + 0x14]
inc edi
dec eax
mov dword [esp + 0x14], eax
jne 0x40fae3
mov ebp, dword [esp + 0x48]
imul esi, edx
mov eax, dword [esp + 0x10]
add esi, esi
push eax
push 1
push esi
push ebx
call fcn.004d58aa
mov esi, dword [esp + 0x42]
mov edx, dword [esp + 0x46]
add esp, 0x10
xor edi, edi
lea eax, [esi - 1]
test eax, eax
jl 0x40fba9
mov ebx, ebp
lea ecx, [edx + edx]
neg ebx
mov dword [esp + 0x18], ebx
mov ebx, eax
imul ebx, ebp
mov ebp, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x14], eax
lea ebp, [ebx + ebp + 1]
mov ebx, dword [esp + 0x44]
xor eax, eax
test ecx, ecx
jbe 0x40fb97
mov esi, ebp
mov ecx, edi
add esi, 3
imul ecx, edx
lea edx, [eax + ecx*2]
add eax, 2
mov cl, byte [edx + ebx]
mov byte [esi - 3], cl
mov edx, dword [esp + 0x36]
lea ecx, [edx + edx]
cmp eax, ecx
jb 0x40fb74
mov esi, dword [esp + 0x32]
mov eax, dword [esp + 0x18]
add ebp, eax
mov eax, dword [esp + 0x14]
inc edi
dec eax
mov dword [esp + 0x14], eax
jne 0x40fb6c
imul esi, edx
mov eax, dword [esp + 0x10]
add esi, esi
push eax
push 1
push esi
push ebx
call fcn.004d58aa
mov ecx, dword [esp + 0x42]
add esp, 0x10
xor edi, edi
lea eax, [ecx - 1]
test eax, eax
jl case.0x40fc53.6
mov edx, dword [esp + 0x48]
mov esi, dword [esp + 0x36]
mov ebp, edx
neg ebp
mov dword [esp + 0x18], ebp
mov ebp, eax
imul ebp, edx
mov edx, dword [esp + 0x1c]
lea ecx, [esi + esi]
add ebp, edx
inc eax
mov dword [esp + 0x14], eax
xor eax, eax
test ecx, ecx
jbe 0x40fc1a
mov edx, ebp
mov ecx, edi
add edx, 3
imul ecx, esi
lea ecx, [eax + ecx*2]
add eax, 2
mov cl, byte [ecx + ebx]
mov byte [edx - 3], cl
mov esi, dword [esp + 0x36]
lea ecx, [esi + esi]
cmp eax, ecx
jb 0x40fbfb
mov eax, dword [esp + 0x18]
add ebp, eax
mov eax, dword [esp + 0x14]
inc edi
dec eax
mov dword [esp + 0x14], eax
jne 0x40fbf3
jmp case.0x40fc53.6
cmp ax, 1
jne case.0x40fc53.6
mov edx, dword [esp + 0x6c]
lea eax, [edx - 1]
cmp eax, 0x5f
ja case.0x40fc53.6
xor ecx, ecx
mov cl, byte [eax + 0x410448]
jmp dword [ecx*4 + 0x410430]
mov edi, dword [esp + 0x10]
cmp word [esp + 0x28], 2
mov esi, dword [esp + 0x4c]
push edi
jne 0x40fc74
mov edx, dword [esp + 0x36]
push edx
push 4
jmp 0x40fc7b
mov eax, dword [esp + 0x36]
push eax
push 2
push esi
call fcn.004d58aa
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x80]
add esp, 0x10
lea edx, [esp + 0x50]
mov dword [esp + 0x50], 0
push ebp
push ecx
mov ecx, dword [esp + 0x64]
push edx
mov edx, dword [esp + 0x34]
push 1
push ebp
push eax
mov eax, dword [esp + 0x4a]
and edx, 0xffff
push ecx
push edx
dec eax
push esi
push eax
push edi
call fcn.0040ec00
add esp, 0x2c
jmp case.0x40fc53.6
mov edi, dword [esp + 0x10]
cmp word [esp + 0x28], 2
mov esi, dword [esp + 0x4c]
push edi
jne 0x40fce4
mov ecx, dword [esp + 0x36]
lea edx, [ecx + ecx]
push edx
push 4
jmp 0x40fcee
mov eax, dword [esp + 0x36]
lea ecx, [eax + eax]
push ecx
push 2
push esi
call fcn.004d58aa
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x80]
add esp, 0x10
lea eax, [esp + 0x50]
mov dword [esp + 0x50], 0
push ebp
push edx
mov edx, dword [esp + 0x64]
push eax
mov eax, dword [esp + 0x34]
push 1
push ebp
push ecx
mov ecx, dword [esp + 0x4a]
and eax, 0xffff
push edx
push eax
dec ecx
push esi
push ecx
push edi
call fcn.0040ec00
add esp, 0x2c
jmp case.0x40fc53.6
cmp word [esp + 0x3c], 4
jne case.0x40fc53.3
mov edx, dword [esp + 0x32]
mov esi, dword [esp + 0x10]
cmp word [esp + 0x28], 2
mov ecx, dword [esp + 0x4c]
lea eax, [edx*4]
push esi
push eax
jne 0x40fd66
push 4
jmp 0x40fd68
push 2
push ecx
call fcn.004d58aa
add esp, 0x10
cmp word [esp + 0x30], 4
jbe 0x40fd99
mov edx, dword [esp + 0x30]
push 1
and edx, 0xffff
sub edx, 4
imul edx, dword [esp + 0x36]
add edx, edx
push edx
push esi
call fcn.004d5be4
add esp, 0xc
mov eax, dword [esp + 0x36]
xor esi, esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x60]
push ebx
push edx
mov edx, dword [esp + 0x34]
push 1
push eax
mov eax, dword [esp + 0x84]
push eax
mov eax, dword [esp + 0x64]
push ecx
mov ecx, dword [esp + 0x4e]
and edx, 0xffff
dec ecx
push edx
mov edx, dword [esp + 0x30]
push eax
push ecx
push edx
call fcn.0040ec00
add esp, 0x2c
cmp esi, 3
ja case.default.0x40fdee
jmp dword [esi*4 + 0x4104a8]
mov eax, dword [esp + 0x32]
xor esi, esi
test eax, eax
jle case.default.0x40fdee
mov eax, dword [esp + 0x1c]
lea edi, [eax + 2]
mov eax, dword [esp + 0x36]
xor ecx, ecx
test eax, eax
jbe 0x40fe33
mov edx, edi
mov ebp, esi
add edx, 4
imul ebp, eax
add ebp, ecx
inc ecx
mov al, byte [ebx + ebp]
mov byte [edx - 4], al
mov eax, dword [esp + 0x36]
cmp ecx, eax
jb 0x40fe16
mov ebp, dword [esp + 0x48]
mov ecx, dword [esp + 0x32]
inc esi
add edi, ebp
cmp esi, ecx
jl 0x40fe0e
jmp 0x40ff24
mov eax, dword [esp + 0x32]
xor esi, esi
test eax, eax
jle case.default.0x40fdee
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x36]
lea edi, [ecx + 1]
xor ecx, ecx
test eax, eax
jbe 0x40fe81
mov edx, edi
mov ebp, esi
add edx, 4
imul ebp, eax
add ebp, ecx
inc ecx
mov al, byte [ebx + ebp]
mov byte [edx - 4], al
mov eax, dword [esp + 0x36]
cmp ecx, eax
jb 0x40fe64
mov ebp, dword [esp + 0x48]
mov ecx, dword [esp + 0x32]
inc esi
add edi, ebp
cmp esi, ecx
jl 0x40fe5c
jmp 0x40ff24
mov eax, dword [esp + 0x32]
xor esi, esi
test eax, eax
jle case.default.0x40fdee
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x36]
xor ecx, ecx
test eax, eax
jbe 0x40fecc
mov edx, edi
mov ebp, esi
add edx, 4
imul ebp, eax
add ebp, ecx
inc ecx
mov al, byte [ebx + ebp]
mov byte [edx - 4], al
mov eax, dword [esp + 0x36]
cmp ecx, eax
jb 0x40feaf
mov ebp, dword [esp + 0x48]
mov ecx, dword [esp + 0x32]
inc esi
add edi, ebp
cmp esi, ecx
jl 0x40fea7
jmp 0x40ff24
mov eax, dword [esp + 0x32]
xor esi, esi
test eax, eax
mov eax, dword [esp + 0x36]
jle 0x40ff24
mov ecx, dword [esp + 0x1c]
lea edi, [ecx + 3]
xor ecx, ecx
test eax, eax
jbe 0x40ff13
mov edx, edi
mov ebp, esi
add edx, 4
imul ebp, eax
add ebp, ecx
inc ecx
mov al, byte [ebx + ebp]
mov byte [edx - 4], al
mov eax, dword [esp + 0x36]
cmp ecx, eax
jb 0x40fef6
mov ebp, dword [esp + 0x48]
mov ecx, dword [esp + 0x32]
inc esi
add edi, ebp
cmp esi, ecx
jl 0x40feee
jmp 0x40ff24
mov eax, dword [esp + 0x36]
mov esi, dword [esp + 0x54]
inc esi
cmp esi, 4
mov dword [esp + 0x54], esi
jb 0x40fda7
cmp word [esp + 0x3c], 4
jne case.0x40fc53.6
mov ecx, dword [esp + 0x48c]
test ecx, ecx
jne case.0x40fc53.6
mov ecx, dword [esp + 0x32]
mov dword [esp + 0x20], 0
test ecx, ecx
jle case.0x40fc53.6
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
test eax, eax
mov dword [esp + 0x14], 0
jbe 0x41001c
mov ecx, dword [esp + 0x18]
mov ebp, 1
mov ebx, 2
mov esi, 3
xor eax, eax
mov al, byte [ecx]
mov dl, byte [esi + ecx]
mov edi, eax
mov byte [esp + 0x6c], dl
mov eax, 0x80808081
mov esi, dword [esp + 0x6c]
add ecx, 4
and esi, 0xff
imul edi, esi
imul edi
add edx, edi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x80808081
mov byte [ecx - 4], dl
xor edx, edx
mov dl, byte [ecx + ebp - 4]
mov edi, edx
imul edi, esi
imul edi
add edx, edi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x80808081
mov byte [ecx + ebp - 4], dl
xor edx, edx
mov dl, byte [ebx + ecx - 4]
mov edi, edx
imul edi, esi
imul edi
add edx, edi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov byte [ebx + ecx - 4], dl
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x36]
inc edx
cmp edx, eax
mov dword [esp + 0x14], edx
jb 0x40ff8b
mov edx, dword [esp + 0x48]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
add esi, edx
mov edx, dword [esp + 0x32]
inc ecx
cmp ecx, edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], esi
jl 0x40ff6d
mov ebx, dword [esp + 0x44]
jmp case.0x40fc53.6
mov esi, dword [esp + 0x10]
cmp word [esp + 0x28], 2
mov eax, dword [esp + 0x32]
push esi
jne 0x410066
mov ecx, dword [esp + 0x50]
lea eax, [eax + eax*2]
push eax
push 4
push ecx
jmp 0x410071
lea edx, [eax + eax*2]
mov eax, dword [esp + 0x50]
push edx
push 2
push eax
call fcn.004d58aa
add esp, 0x10
cmp word [esp + 0x30], 3
jbe 0x4100a1
mov ecx, dword [esp + 0x30]
push 1
and ecx, 0xffff
sub ecx, 3
imul ecx, dword [esp + 0x36]
add ecx, ecx
push ecx
push esi
call fcn.004d5be4
add esp, 0xc
xor edi, edi
cmp word [esp + 0x3a], 0x10
mov dword [esp + 0x50], edi
mov esi, 1
jne 0x4100b9
mov esi, 2
mov eax, dword [esp + 0x36]
mov dword [esp + 0x54], edi
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x50]
push edx
mov edx, dword [esp + 0x74]
push ebx
push ecx
mov ecx, dword [esp + 0x34]
push esi
push eax
mov eax, dword [esp + 0x70]
push edx
mov edx, dword [esp + 0x64]
push eax
mov eax, dword [esp + 0x4e]
and ecx, 0xffff
dec eax
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
call fcn.0040ec00
mov eax, edi
xor ecx, ecx
add esp, 0x2c
sub eax, ecx
je 0x4101df
dec eax
je 0x410179
dec eax
jne 0x410243
mov eax, dword [esp + 0x32]
mov dword [esp + 0x20], ecx
cmp eax, ecx
jle 0x410243
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x36]
mov dword [esp + 0x44], edx
mov ecx, dword [esp + 0x20]
xor edi, edi
imul ecx, eax
test eax, eax
jbe 0x410159
imul ecx, esi
mov edx, dword [esp + 0x44]
add ecx, ebx
mov al, byte [ecx]
inc edi
mov byte [edx], al
mov eax, dword [esp + 0x36]
add ecx, esi
add edx, 3
cmp edi, eax
jb 0x410143
mov ebp, dword [esp + 0x48]
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x44]
mov edx, dword [esp + 0x32]
inc ecx
add edi, ebp
cmp ecx, edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x44], edi
jl 0x41012d
jmp 0x410247
mov eax, dword [esp + 0x32]
mov dword [esp + 0x20], ecx
cmp eax, ecx
jle 0x410243
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x36]
inc ecx
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x20]
xor edi, edi
imul ecx, eax
test eax, eax
jbe 0x4101c2
imul ecx, esi
mov edx, dword [esp + 0x44]
add ecx, ebx
mov al, byte [ecx]
inc edi
mov byte [edx], al
mov eax, dword [esp + 0x36]
add ecx, esi
add edx, 3
cmp edi, eax
jb 0x4101ac
mov ebp, dword [esp + 0x48]
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x44]
mov edx, dword [esp + 0x32]
inc ecx
add edi, ebp
cmp ecx, edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x44], edi
jl 0x410196
jmp 0x410247
mov eax, dword [esp + 0x32]
mov dword [esp + 0x20], ecx
cmp eax, ecx
jle 0x410243
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x36]
add ecx, 2
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x20]
xor edi, edi
imul ecx, eax
test eax, eax
jbe 0x410226
imul ecx, esi
mov edx, dword [esp + 0x44]
add ecx, ebx
mov al, byte [ecx]
inc edi
mov byte [edx], al
mov eax, dword [esp + 0x36]
add ecx, esi
add edx, 3
cmp edi, eax
jb 0x410210
mov ebp, dword [esp + 0x48]
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x44]
mov edx, dword [esp + 0x32]
inc ecx
add edi, ebp
cmp ecx, edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x44], edi
jl 0x4101fa
jmp 0x410247
mov eax, dword [esp + 0x36]
mov edi, dword [esp + 0x54]
inc edi
cmp edi, 3
mov dword [esp + 0x54], edi
jb 0x4100c1
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004d5e20
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
add esp, 4
test ebx, ebx
je 0x41028a
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push eax
call edi
push ebx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
call ebx
jmp 0x410296
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebp, dword [esp + 0x5c]
test ebp, ebp
je 0x4102aa
push ebp
call esi
push eax
call edi
push ebp
call esi
push eax
call ebx
mov ebp, dword [esp + 0x4c]
test ebp, ebp
je 0x4102be
push ebp
call esi
push eax
call edi
push ebp
call esi
push eax
call ebx
cmp word [esp + 0x3c], 9
jne 0x410373
cmp dword [esp + 0x60], 0x18
jne 0x410373
mov eax, dword [esp + 0x32]
mov dword [esp + 0x20], 0
test eax, eax
jle 0x410373
mov eax, dword [esp + 0x36]
mov dword [esp + 0x18], 0
xor ebp, ebp
test eax, eax
jbe 0x410354
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov edi, ecx
lea eax, [ecx + 1]
sub edi, eax
sub ecx, eax
lea esi, [eax + edx]
lea ebx, [ecx + 2]
lea eax, [esp + 0x5a]
lea ecx, [esp + 0x5b]
push eax
mov al, byte [edi + esi]
lea edx, [esp + 0x5d]
push ecx
mov cl, byte [esi]
push edx
mov dl, byte [ebx + esi]
push eax
push ecx
push edx
call fcn.00410900
mov al, byte [esp + 0x72]
mov cl, byte [esp + 0x73]
mov dl, byte [esp + 0x71]
add esp, 0x18
mov byte [edi + esi], al
mov byte [esi], cl
mov byte [ebx + esi], dl
mov eax, dword [esp + 0x36]
inc ebp
add esi, 3
cmp ebp, eax
jb 0x410312
mov edx, dword [esp + 0x48]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
add esi, edx
mov edx, dword [esp + 0x32]
inc ecx
cmp ecx, edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], esi
jl 0x4102f5
mov esi, dword [esp + 0x68]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x470
ret
mov eax, dword [esp + 0x10]
push eax
jmp 0x4103a1
push esi
jmp 0x4103a1
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x4103a1
mov edx, dword [esp + 0x10]
push edx
call fcn.004d5e20
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x470
ret