Function at 0x404b20
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Hash data using crc32b
Hash data with crc32

Disassembly:
push 0xffffffffffffffff
push 0x61b8bc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44c
push ebx
push ebp
push esi
push edi
mov edi, ecx
or ebx, 0xffffffff
mov dword [esp + 0x50], edi
cmp dword [edi + 8], ebx
je 0x407040
mov eax, dword [edi + 4]
xor esi, esi
cmp eax, ebx
je 0x4069f9
mov eax, dword [0x6621f4]
mov dl, byte [edi + 8]
push edx
mov ecx, dword [eax + 0x44]
call fcn.0040b830
test al, al
je 0x407040
cmp dword [edi + 8], esi
je 0x4069e7
mov eax, dword [0x6621f4]
mov eax, dword [eax + 0x90]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x4050ba
cmp eax, 0xffffffff
je 0x4050ba
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x405087
push 0x645764
push str.IDR_RCP1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x405087
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x44], eax
je 0x404ebf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x404ebf
mov eax, dword [ebx + 4]
mov ebp, dword [ebx]
push eax
mov dword [esp + 0x14], eax
add esp, 4
mov dword [esp + 0x18], 0x6df000
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x1c], eax
nop
nop
nop
nop
push eax
push section..idr1
push section..idr1_dt
call fcn.0060a650
add esp, 0xc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
cmp eax, edx
je 0x404d1b
mov eax, dword [esp + 0x18]
push eax
call fcn.00608e5c
add esp, 4
xor edi, edi
jmp 0x404ebf
mov edi, dword [esp + 0x18]
mov eax, 0xedb8
mov dword [esp + 0x18], edi
xor esi, esi
mov ecx, 0xf
test al, 1
je 0x404d3c
mov edx, 1
shl edx, cl
or esi, edx
shr eax, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x404d2f
mov edx, 0x8320
xor eax, eax
mov ecx, 0xf
test dl, 1
je 0x404d5e
mov ebx, 1
shl ebx, cl
or eax, ebx
shr edx, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x404d50
shl eax, 0x10
or eax, esi
xor ebx, ebx
mov dword [esp + 0x30], eax
lea eax, [esp + 0x5c]
mov edx, ebx
xor esi, esi
mov ecx, 7
test dl, 1
je 0x404d8c
mov ebp, 1
shl ebp, cl
or esi, ebp
shr edx, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x404d7e
mov edx, dword [esp + 0x30]
mov ecx, 8
shl esi, 0x18
mov dword [eax], esi
mov esi, dword [eax]
mov ebp, dword [eax]
and esi, 0x80000000
neg esi
sbb esi, esi
add ebp, ebp
and esi, edx
xor esi, ebp
dec ecx
mov dword [eax], esi
jne 0x404da2
mov edx, dword [eax]
xor esi, esi
mov ecx, 0x1f
test dl, 1
je 0x404dd2
mov ebp, 1
shl ebp, cl
or esi, ebp
shr edx, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x404dc4
mov dword [eax], esi
inc ebx
add eax, 4
cmp ebx, 0xff
jbe 0x404d75
xor eax, eax
xor edx, edx
mov ecx, 0x1f
test al, 1
je 0x404dfe
mov esi, 1
shl esi, cl
or edx, esi
shr eax, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x404df1
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x404e43
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x5c]
mov esi, dword [esp + 0x14]
shr esi, 8
xor edx, esi
inc ecx
dec eax
mov dword [esp + 0x14], edx
jne 0x404e1e
mov ecx, dword [0x64c46c]
mov esi, dword [esp + 0x14]
xor eax, eax
test ecx, ecx
jle 0x404e73
mov ecx, dword [eax*4 + 0x649ed0]
xor ecx, 0xf91a
add ecx, edi
mov ebx, dword [ecx]
add ebx, edi
inc eax
mov dword [ecx], ebx
mov ecx, dword [0x64c46c]
cmp eax, ecx
jl 0x404e53
mov ecx, dword [0x64c468]
xor eax, eax
test ecx, ecx
jle 0x404ea1
mov edx, dword [eax*8 + 0x649c38]
mov ecx, dword [eax*8 + 0x649c3c]
xor edx, 0xf91a
inc eax
mov dword [edx + edi], ecx
mov ecx, dword [0x64c468]
cmp eax, ecx
jl 0x404e7f
mov edx, dword [0x649c04]
push 0
xor edx, 0xf91a
push 1
push 0
add edx, edi
call edx
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
test edi, edi
je 0x405087
mov eax, dword [0x649bf0]
xor eax, 0xff8e
add eax, edi
call eax
cmp eax, 1
jne 0x40508b
mov ebp, dword [0x649c2c]
xor ebp, 0x7a04
add ebp, edi
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov edx, 8
test byte [esp + 0x14], 1
je 0x404f1c
mov ax, word [esp + 0x14]
shr ax, 1
xor eax, 0x8408
mov dword [esp + 0x14], eax
jmp 0x404f25
shr word [esp + 0x14], 1
mov eax, dword [esp + 0x14]
dec edx
jne 0x404f02
and eax, 0xffff
mov dword [esp + ecx*4 + 0x5c], eax
inc ecx
cmp ecx, 0xff
jbe 0x404ef9
xor eax, eax
xor edx, edx
mov ecx, 0xf
test al, 1
je 0x404f50
mov esi, 1
shl esi, cl
or edx, esi
shr eax, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x404f43
mov esi, dword [0x64c46c]
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
mov edx, ebp
mov dword [esp + 0x10], ecx
sub edx, edi
xor ecx, ecx
mov dword [esp + 0x1c], edx
test esi, esi
jbe 0x404fc4
mov eax, dword [ecx*4 + 0x649ed0]
xor eax, 0xf91a
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp edx, eax
jb 0x404fbf
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
add eax, 0x11f
cmp edx, eax
jae 0x404fc4
mov edx, dword [esp + 0x1c]
mov eax, ebp
sub eax, edx
mov edx, dword [esp + 0x14]
add eax, edx
mov edx, dword [eax]
sub edx, edi
mov dword [eax], edx
mov esi, dword [0x64c46c]
inc ecx
cmp ecx, esi
jb 0x404f78
mov eax, ebp
xor ecx, ecx
mov edx, dword [esp + 0x10]
xor ebx, ebx
mov bl, byte [eax]
and edx, 0xff
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x5c]
mov ebx, dword [esp + 0x10]
shr ebx, 8
xor edx, ebx
inc eax
inc ecx
mov dword [esp + 0x10], edx
cmp ecx, 0x11f
jb 0x404fc8
xor ecx, ecx
test esi, esi
jbe 0x405045
mov eax, dword [ecx*4 + 0x649ed0]
xor eax, 0xf91a
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp edx, eax
jb 0x405040
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
add eax, 0x11f
cmp edx, eax
jae 0x405045
mov edx, dword [esp + 0x1c]
mov eax, ebp
sub eax, edx
mov edx, dword [esp + 0x14]
add eax, edx
mov edx, dword [eax]
add edx, edi
mov dword [eax], edx
mov esi, dword [0x64c46c]
inc ecx
cmp ecx, esi
jb 0x404ff9
mov eax, dword [0x649c2c]
mov ecx, dword [esp + 0x10]
xor eax, 0x7a04
mov edx, edi
and ecx, 0xffff
add edx, eax
push 0x743c8d79
push 0x4ca11b
lea eax, [edx]
nop
nop
nop
nop
nop
call eax
cmp eax, 1
sete al
test al, al
jne 0x405087
push edi
call fcn.00412890
add esp, 4
test al, al
je 0x40507a
mov esi, edi
jmp 0x40508f
mov esi, dword [esp + 0x20]
mov eax, dword [0x649c08]
xor eax, 0xe6b5
add eax, esi
call eax
mov eax, dword [0x649c04]
push 0
xor eax, 0xf91a
push 0
push 0
add eax, esi
call eax
push esi
call fcn.00608e5c
add esp, 4
mov esi, 0x400
push esi
mov dword [0x662b44], esi
call fcn.00401000
push esi
mov dword [0x662b40], eax
mov dword [0x662b64], esi
call fcn.00401000
push esi
mov dword [0x662b60], eax
mov dword [0x662b54], esi
call fcn.00401000
mov ecx, dword [esp + 0x5c]
mov dword [0x662b50], eax
mov dword [0x662b6c], 0
add esp, 0xc
mov eax, dword [ecx + 8]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
nop
nop
nop
nop
nop
je 0x4069e7
test eax, eax
je 0x4069e7
mov edx, eax
and edx, 0x80000001
jns 0x40512f
dec edx
or edx, 0xfffffffe
inc edx
jne 0x405d2f
mov eax, dword [0x6621f4]
mov eax, dword [eax + 0x30]
mov al, byte [eax + 0x2a]
cmp al, 1
je 0x40572a
xor esi, esi
push 0x7fc
mov ecx, 0x662b40
mov dword [esp + 0x48], 0x7fc
mov dword [esp + 0x34], esi
call fcn.00407f40
mov ecx, dword [0x662b40]
push esi
mov dword [esp + 0x4c], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
cmp edi, esi
je 0x40559a
push 0x645764
push str.IDR_RCP
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40559a
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x14], eax
je 0x405404
mov edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x405404
mov eax, dword [ebx + 4]
mov ebp, dword [ebx]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], eax
mov edi, section..idr_dt
push eax
push section..idr
push edi
call fcn.0060a650
add esp, 0xc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
je 0x4052e8
push edi
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
jmp 0x405404
mov ebp, edi
xor ebx, ebx
lea esi, [esp + 0x5c]
push 8
push ebx
call fcn.00407090
add esp, 8
shl eax, 0x18
mov dword [esi], eax
mov eax, 8
mov edx, dword [esi]
mov ecx, dword [esi]
and edx, 0x80000000
neg edx
sbb edx, edx
add ecx, ecx
and edx, 0x4c11db7
xor edx, ecx
dec eax
mov dword [esi], edx
jne 0x405305
mov edx, dword [esi]
push 0x20
push edx
call fcn.00407090
add esp, 8
mov dword [esi], eax
inc ebx
add esi, 4
cmp ebx, 0xff
jbe 0x4052f0
push 0x20
push 0
call fcn.00407090
not eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
not eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x405387
mov ecx, dword [esp + 0x10]
xor edx, edx
mov dl, byte [ebp]
and ecx, 0xff
xor ecx, edx
mov ecx, dword [esp + ecx*4 + 0x5c]
mov edx, dword [esp + 0x10]
shr edx, 8
xor ecx, edx
inc ebp
dec eax
mov dword [esp + 0x10], ecx
jne 0x405361
mov ecx, dword [0x649bd8]
mov esi, dword [esp + 0x10]
xor eax, eax
test ecx, ecx
not esi
jle 0x4053b9
mov ecx, dword [eax*4 + 0x6478b0]
xor ecx, 0x6920
add ecx, edi
mov ebx, dword [ecx]
add ebx, edi
inc eax
mov dword [ecx], ebx
mov ecx, dword [0x649bd8]
cmp eax, ecx
jl 0x405399
mov ecx, dword [0x649bd4]
xor eax, eax
test ecx, ecx
jle 0x4053e7
mov edx, dword [eax*8 + 0x647618]
mov ecx, dword [eax*8 + 0x64761c]
xor edx, 0x6920
inc eax
mov dword [edx + edi], ecx
mov ecx, dword [0x649bd4]
cmp eax, ecx
jl 0x4053c5
mov edx, dword [0x647604]
push 0
xor edx, 0x6920
push 1
push 0
add edx, edi
call edx
lea esi, [edi]
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
je 0x40559a
mov eax, dword [0x647614]
xor eax, 0x38cc
add eax, esi
call eax
cmp eax, 1
jne 0x40559e
mov ecx, dword [0x6475c4]
lea eax, [esp + 0x5c]
xor ecx, 0x38cc
add ecx, esi
xor edi, edi
mov edx, edi
shl edx, 8
mov dword [eax], edx
mov edx, 8
mov ebx, dword [eax]
mov ebp, dword [eax]
and ebx, 0x8000
neg ebx
sbb ebx, ebx
add ebp, ebp
and ebx, 0x1021
xor ebx, ebp
dec edx
mov dword [eax], ebx
jne 0x40544e
inc edi
add eax, 4
cmp edi, 0xff
jbe 0x405442
mov eax, ecx
xor ebp, ebp
sub eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x10], eax
mov eax, dword [0x649bd8]
xor edx, edx
cmp eax, ebp
jbe 0x4054dd
mov edi, dword [edx*4 + 0x6478b0]
xor edi, 0x6920
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
cmp edi, ebx
jb 0x4054d8
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
add edi, 0xf8
cmp ebx, edi
jae 0x4054dd
mov eax, dword [esp + 0x10]
mov edi, ecx
sub edi, eax
mov eax, dword [esp + 0x14]
add eax, edi
mov edi, dword [eax]
sub edi, esi
mov dword [eax], edi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x405490
mov edi, ecx
xor edx, edx
xor ebx, ebx
mov dl, byte [esp + 0x1d]
mov bl, byte [edi]
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x5c]
mov ebx, dword [esp + 0x1c]
shl ebx, 8
xor edx, ebx
inc edi
inc ebp
mov dword [esp + 0x1c], edx
cmp ebp, 0xf8
jb 0x4054df
xor edx, edx
test eax, eax
jbe 0x405558
mov edi, dword [edx*4 + 0x6478b0]
xor edi, 0x6920
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
cmp edi, ebx
jb 0x405553
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
add eax, 0xf8
cmp edi, eax
jae 0x405558
mov eax, dword [esp + 0x10]
mov edi, ecx
sub edi, eax
mov eax, dword [esp + 0x14]
add eax, edi
mov edi, dword [eax]
add edi, esi
mov dword [eax], edi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x40550c
mov eax, dword [0x6475c4]
mov ecx, dword [esp + 0x1c]
xor eax, 0x38cc
mov edx, esi
and ecx, 0xffff
add edx, eax
push 0x9eb13c2e
push 0x4ca11b
lea eax, [edx]
nop
nop
nop
nop
nop
call eax
cmp eax, 1
sete al
test al, al
jne 0x40559a
push esi
call fcn.00412660
add esp, 4
test al, al
je 0x40558d
mov dword [esp + 0x30], esi
mov ecx, dword [0x6475f0]
mov ebp, dword [esp + 0x30]
xor ecx, 0x38cc
lea eax, [esp + 0x5c]
add ecx, ebp
xor esi, esi
mov edx, esi
shl edx, 8
mov dword [eax], edx
mov edx, 8
mov edi, dword [eax]
mov ebx, dword [eax]
and edi, 0x8000
neg edi
sbb edi, edi
add ebx, ebx
and edi, 0x1021
xor edi, ebx
dec edx
mov dword [eax], edi
jne 0x4055c2
inc esi
add eax, 4
cmp esi, 0xff
jbe 0x4055b6
mov eax, ecx
xor edi, edi
sub eax, ebp
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
mov eax, dword [0x649bd8]
xor edx, edx
cmp eax, edi
jbe 0x405651
mov esi, dword [edx*4 + 0x6478b0]
xor esi, 0x6920
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
cmp esi, ebx
jb 0x40564c
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
add esi, 0x7cb
cmp ebx, esi
jae 0x405651
mov eax, dword [esp + 0x10]
mov esi, ecx
sub esi, eax
mov eax, dword [esp + 0x14]
add eax, esi
mov esi, dword [eax]
sub esi, ebp
mov dword [eax], esi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x405604
mov esi, ecx
xor edx, edx
xor ebx, ebx
mov dl, byte [esp + 0x1d]
mov bl, byte [esi]
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x5c]
mov ebx, dword [esp + 0x1c]
shl ebx, 8
xor edx, ebx
inc esi
inc edi
mov dword [esp + 0x1c], edx
cmp edi, 0x7cb
jb 0x405653
xor edx, edx
test eax, eax
jbe 0x4056cc
mov esi, dword [edx*4 + 0x6478b0]
xor esi, 0x6920
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
cmp esi, edi
jb 0x4056c7
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
add eax, 0x7cb
cmp esi, eax
jae 0x4056cc
mov eax, dword [esp + 0x10]
mov esi, ecx
sub esi, eax
mov eax, dword [esp + 0x14]
add eax, esi
mov esi, dword [eax]
add esi, ebp
mov dword [eax], esi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x405680
mov eax, dword [0x6475f0]
mov ecx, dword [esp + 0x1c]
xor eax, 0x38cc
mov edx, ebp
mov esi, dword [esp + 0x48]
and ecx, 0xffff
add edx, eax
lea eax, [edx]
nop
nop
nop
nop
nop
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x44]
push ecx
lea ecx, [edx + edx + 2]
push esi
push ecx
jmp dword [section.hack]
mov ecx, dword [0x6621f4]
mov eax, dword [ecx + 0x30]
cmp byte [eax + 0x2a], 1
je 0x4069e7
mov edx, dword [esp + 0x18]
xor esi, esi
push 0x1ffc
mov ecx, 0x662b50
lea eax, [edx + edx + 0xbd]
mov dword [esp + 0x4c], 0x1ffc
mov dword [esp + 0x50], eax
mov dword [esp + 0x18], esi
call fcn.00407f40
mov ecx, dword [0x662b50]
push esi
mov dword [esp + 0x48], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
cmp edi, esi
je 0x405b9e
push 0x645764
push str.IDR_RCP
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x405b9e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x405a08
mov edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x405a08
mov eax, dword [ebx + 4]
mov ebp, dword [ebx]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, section..idr_dt
mov dword [esp + 0x18], eax
push eax
push section..idr
push edi
call fcn.0060a650
add esp, 0xc
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
cmp ecx, eax
je 0x4058ec
push edi
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
jmp 0x405a08
mov ebp, edi
xor ebx, ebx
lea esi, [esp + 0x5c]
push 8
push ebx
call fcn.00407090
add esp, 8
shl eax, 0x18
mov dword [esi], eax
mov eax, 8
mov edx, dword [esi]
mov ecx, dword [esi]
and edx, 0x80000000
neg edx
sbb edx, edx
add ecx, ecx
and edx, 0x4c11db7
xor edx, ecx
dec eax
mov dword [esi], edx
jne 0x405909
mov edx, dword [esi]
push 0x20
push edx
call fcn.00407090
add esp, 8
mov dword [esi], eax
inc ebx
add esi, 4
cmp ebx, 0xff
jbe 0x4058f4
push 0x20
push 0
call fcn.00407090
not eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
not eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x40598b
mov ecx, dword [esp + 0x10]
xor edx, edx
mov dl, byte [ebp]
and ecx, 0xff
xor ecx, edx
mov ecx, dword [esp + ecx*4 + 0x5c]
mov edx, dword [esp + 0x10]
shr edx, 8
xor ecx, edx
inc ebp
dec eax
mov dword [esp + 0x10], ecx
jne 0x405965
mov ecx, dword [0x649bd8]
mov esi, dword [esp + 0x10]
xor eax, eax
test ecx, ecx
not esi
jle 0x4059bd
mov ecx, dword [eax*4 + 0x6478b0]
xor ecx, 0x6920
add ecx, edi
mov ebx, dword [ecx]
add ebx, edi
inc eax
mov dword [ecx], ebx
mov ecx, dword [0x649bd8]
cmp eax, ecx
jl 0x40599d
mov ecx, dword [0x649bd4]
xor eax, eax
test ecx, ecx
jle 0x4059eb
mov edx, dword [eax*8 + 0x647618]
mov ecx, dword [eax*8 + 0x64761c]
xor edx, 0x6920
inc eax
mov dword [edx + edi], ecx
mov ecx, dword [0x649bd4]
cmp eax, ecx
jl 0x4059c9
mov edx, dword [0x647604]
push 0
xor edx, 0x6920
push 1
push 0
add edx, edi
call edx
lea esi, [edi]
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
je 0x405b9e
mov eax, dword [0x647614]
xor eax, 0x38cc
add eax, esi
call eax
cmp eax, 1
jne 0x405ba2
mov ecx, dword [0x6475c4]
lea eax, [esp + 0x5c]
xor ecx, 0x38cc
add ecx, esi
xor edi, edi
mov edx, edi
shl edx, 8
mov dword [eax], edx
mov edx, 8
mov ebx, dword [eax]
mov ebp, dword [eax]
and ebx, 0x8000
neg ebx
sbb ebx, ebx
add ebp, ebp
and ebx, 0x1021
xor ebx, ebp
dec edx
mov dword [eax], ebx
jne 0x405a52
inc edi
add eax, 4
cmp edi, 0xff
jbe 0x405a46
mov eax, ecx
xor ebp, ebp
sub eax, esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], eax
mov eax, dword [0x649bd8]
xor edx, edx
cmp eax, ebp
jbe 0x405ae1
mov edi, dword [edx*4 + 0x6478b0]
xor edi, 0x6920
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
cmp edi, ebx
jb 0x405adc
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
add edi, 0xf8
cmp ebx, edi
jae 0x405ae1
mov eax, dword [esp + 0x10]
mov edi, ecx
sub edi, eax
mov eax, dword [esp + 0x14]
add eax, edi
mov edi, dword [eax]
sub edi, esi
mov dword [eax], edi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x405a94
mov edi, ecx
xor edx, edx
xor ebx, ebx
mov dl, byte [esp + 0x19]
mov bl, byte [edi]
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x5c]
mov ebx, dword [esp + 0x18]
shl ebx, 8
xor edx, ebx
inc edi
inc ebp
mov dword [esp + 0x18], edx
cmp ebp, 0xf8
jb 0x405ae3
xor edx, edx
test eax, eax
jbe 0x405b5c
mov edi, dword [edx*4 + 0x6478b0]
xor edi, 0x6920
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
cmp edi, ebx
jb 0x405b57
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
add eax, 0xf8
cmp edi, eax
jae 0x405b5c
mov eax, dword [esp + 0x10]
mov edi, ecx
sub edi, eax
mov eax, dword [esp + 0x14]
add eax, edi
mov edi, dword [eax]
add edi, esi
mov dword [eax], edi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x405b10
mov eax, dword [0x6475c4]
mov ecx, dword [esp + 0x18]
xor eax, 0x38cc
mov edx, esi
and ecx, 0xffff
add edx, eax
push 0x9eb13c2e
push 0x4ca11b
lea eax, [edx]
nop
nop
nop
nop
nop
call eax
cmp eax, 1
sete al
test al, al
jne 0x405b9e
push esi
call fcn.00412660
add esp, 4
test al, al
je 0x405b91
mov dword [esp + 0x14], esi
mov ecx, dword [0x647610]
mov ebp, dword [esp + 0x14]
xor ecx, 0x38cc
lea eax, [esp + 0x5c]
add ecx, ebp
xor esi, esi
mov edx, esi
shl edx, 8
mov dword [eax], edx
mov edx, 8
mov edi, dword [eax]
mov ebx, dword [eax]
and edi, 0x8000
neg edi
sbb edi, edi
add ebx, ebx
and edi, 0x1021
xor edi, ebx
dec edx
mov dword [eax], edi
jne 0x405bc6
inc esi
add eax, 4
cmp esi, 0xff
jbe 0x405bba
mov eax, ecx
xor edi, edi
sub eax, ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], eax
mov eax, dword [0x649bd8]
xor edx, edx
cmp eax, edi
jbe 0x405c55
mov esi, dword [edx*4 + 0x6478b0]
xor esi, 0x6920
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
cmp esi, ebx
jb 0x405c50
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
add esi, 0x7fa
cmp ebx, esi
jae 0x405c55
mov eax, dword [esp + 0x10]
mov esi, ecx
sub esi, eax
mov eax, dword [esp + 0x14]
add eax, esi
mov esi, dword [eax]
sub esi, ebp
mov dword [eax], esi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x405c08
mov esi, ecx
xor edx, edx
xor ebx, ebx
mov dl, byte [esp + 0x19]
mov bl, byte [esi]
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x5c]
mov ebx, dword [esp + 0x18]
shl ebx, 8
xor edx, ebx
inc esi
inc edi
mov dword [esp + 0x18], edx
cmp edi, 0x7fa
jb 0x405c57
xor edx, edx
test eax, eax
jbe 0x405cd0
mov esi, dword [edx*4 + 0x6478b0]
xor esi, 0x6920
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
cmp esi, edi
jb 0x405ccb
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
add eax, 0x7fa
cmp esi, eax
jae 0x405cd0
mov eax, dword [esp + 0x10]
mov esi, ecx
sub esi, eax
mov eax, dword [esp + 0x14]
add eax, esi
mov esi, dword [eax]
add esi, ebp
mov dword [eax], esi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x405c84
mov eax, dword [0x647610]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x44]
xor eax, 0x38cc
mov edx, ebp
and ecx, 0xffff
add edx, eax
lea eax, [edx]
nop
nop
nop
nop
nop
mov edx, dword [esp + 0x4c]
lea ecx, [esp + 0x48]
push ecx
push esi
push edx
jmp dword [0x6f9004]
mov ecx, dword [0x6621f4]
mov eax, dword [ecx + 0x30]
mov al, byte [eax + 0x2a]
cmp al, 1
je 0x406385
xor edi, edi
push 0x7fc
mov ecx, 0x662b40
mov dword [esp + 0x58], 0x7fc
mov dword [esp + 0x48], edi
call fcn.00407f40
mov edx, dword [0x662b40]
push edi
mov dword [esp + 0x24], edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
cmp esi, edi
je 0x4061cf
push 0x645764
push str.IDR_RCP1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4061cf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x406001
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x406001
mov ebp, dword [ebx + 4]
mov ecx, dword [ebx]
push ebp
mov dword [esp + 0x50], ecx
mov dword [esp + 0x4c], ebp
add esp, 4
mov edi, section..idr1_dt
mov dword [esp + 0x30], ebp
push ebp
push section..idr1
push edi
call fcn.0060a650
add esp, 0xc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esp + 0x30], ebp
je 0x405ec7
push edi
call fcn.00608e5c
add esp, 4
xor edi, edi
jmp 0x406001
push 0x10
push 0x8320
mov dword [esp + 0x54], edi
call fcn.00407090
mov ebp, eax
push 0x10
push 0xedb8
shl ebp, 0x10
call fcn.00407090
add esp, 0x10
or ebp, eax
xor ebx, ebx
lea esi, [esp + 0x5c]
push 8
push ebx
call fcn.00407090
add esp, 8
shl eax, 0x18
mov dword [esi], eax
mov eax, 8
mov ecx, dword [esi]
mov edx, dword [esi]
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add edx, edx
and ecx, ebp
xor ecx, edx
dec eax
mov dword [esi], ecx
jne 0x405f08
mov eax, dword [esi]
push 0x20
push eax
call fcn.00407090
add esp, 8
mov dword [esi], eax
inc ebx
add esi, 4
cmp ebx, 0xff
jbe 0x405ef3
push 0x20
push 0
call fcn.00407090
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x50]
add esp, 8
test ecx, ecx
je 0x405f85
mov eax, dword [esp + 0x4c]
mov edx, dword [esp + 0x10]
xor ebx, ebx
mov bl, byte [eax]
and edx, 0xff
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x5c]
mov esi, dword [esp + 0x10]
shr esi, 8
xor edx, esi
inc eax
dec ecx
mov dword [esp + 0x10], edx
jne 0x405f60
mov ecx, dword [0x64c46c]
mov esi, dword [esp + 0x10]
xor eax, eax
test ecx, ecx
jle 0x405fb5
mov ecx, dword [eax*4 + 0x649ed0]
xor ecx, 0xf91a
add ecx, edi
mov ebx, dword [ecx]
add ebx, edi
inc eax
mov dword [ecx], ebx
mov ecx, dword [0x64c46c]
cmp eax, ecx
jl 0x405f95
mov ecx, dword [0x64c468]
xor eax, eax
test ecx, ecx
jle 0x405fe3
mov edx, dword [eax*8 + 0x649c38]
mov ecx, dword [eax*8 + 0x649c3c]
xor edx, 0xf91a
inc eax
mov dword [edx + edi], ecx
mov ecx, dword [0x64c468]
cmp eax, ecx
jl 0x405fc1
mov edx, dword [0x649c04]
push 0
xor edx, 0xf91a
push 1
push 0
add edx, edi
call edx
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
test edi, edi
je 0x4061cf
mov eax, dword [0x649bf0]
xor eax, 0xff8e
add eax, edi
call eax
cmp eax, 1
jne 0x4061cb
mov ebp, dword [0x649c2c]
xor ebp, 0x7a04
add ebp, edi
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov edx, 8
test byte [esp + 0x10], 1
je 0x40605e
mov ax, word [esp + 0x10]
shr ax, 1
xor eax, 0x8408
mov dword [esp + 0x10], eax
jmp 0x406067
shr word [esp + 0x10], 1
mov eax, dword [esp + 0x10]
dec edx
jne 0x406044
and eax, 0xffff
mov dword [esp + ecx*4 + 0x5c], eax
inc ecx
cmp ecx, 0xff
jbe 0x40603b
xor eax, eax
xor edx, edx
mov ecx, 0xf
test al, 1
je 0x406092
mov esi, 1
shl esi, cl
or edx, esi
shr eax, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x406085
mov esi, dword [0x64c46c]
mov dword [esp + 0x1c], edx
mov ecx, dword [esp + 0x1c]
mov edx, ebp
mov dword [esp + 0x1c], ecx
sub edx, edi
xor ecx, ecx
mov dword [esp + 0x10], edx
test esi, esi
jbe 0x406106
mov eax, dword [ecx*4 + 0x649ed0]
xor eax, 0xf91a
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp edx, eax
jb 0x406101
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add eax, 0x11f
cmp edx, eax
jae 0x406106
mov edx, dword [esp + 0x10]
mov eax, ebp
sub eax, edx
mov edx, dword [esp + 0x14]
add eax, edx
mov edx, dword [eax]
sub edx, edi
mov dword [eax], edx
mov esi, dword [0x64c46c]
inc ecx
cmp ecx, esi
jb 0x4060ba
mov eax, ebp
xor ecx, ecx
mov edx, dword [esp + 0x1c]
xor ebx, ebx
mov bl, byte [eax]
and edx, 0xff
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x5c]
mov ebx, dword [esp + 0x1c]
shr ebx, 8
xor edx, ebx
inc eax
inc ecx
mov dword [esp + 0x1c], edx
cmp ecx, 0x11f
jb 0x40610a
xor ecx, ecx
test esi, esi
jbe 0x406187
mov eax, dword [ecx*4 + 0x649ed0]
xor eax, 0xf91a
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp edx, eax
jb 0x406182
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add eax, 0x11f
cmp edx, eax
jae 0x406187
mov edx, dword [esp + 0x10]
mov eax, ebp
sub eax, edx
mov edx, dword [esp + 0x14]
add eax, edx
mov edx, dword [eax]
add edx, edi
mov dword [eax], edx
mov esi, dword [0x64c46c]
inc ecx
cmp ecx, esi
jb 0x40613b
mov eax, dword [0x649c2c]
mov ecx, dword [esp + 0x1c]
xor eax, 0x7a04
mov edx, edi
and ecx, 0xffff
add edx, eax
push 0x743c8d79
push 0x4ca11b
lea eax, [edx]
nop
nop
nop
nop
nop
call eax
cmp eax, 1
sete al
test al, al
jne 0x4061cf
push edi
call fcn.00412890
add esp, 4
test al, al
je 0x4061bc
jmp 0x4061cf
mov edi, dword [esp + 0x44]
mov ebp, dword [0x649c10]
xor ebp, 0x820c
add ebp, edi
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov edx, 8
test byte [esp + 0x10], 1
je 0x406202
mov ax, word [esp + 0x10]
shr ax, 1
xor eax, 0x8408
mov dword [esp + 0x10], eax
jmp 0x40620b
shr word [esp + 0x10], 1
mov eax, dword [esp + 0x10]
dec edx
jne 0x4061e8
and eax, 0xffff
mov dword [esp + ecx*4 + 0x5c], eax
inc ecx
cmp ecx, 0xff
jbe 0x4061df
xor edx, edx
xor eax, eax
mov ecx, 0xf
test dl, 1
je 0x406237
mov esi, 1
shl esi, cl
or eax, esi
shr edx, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x406229
mov esi, dword [0x64c46c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov ecx, ebp
sub ecx, edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
xor ecx, ecx
test esi, esi
jbe 0x4062ad
mov edx, dword [ecx*4 + 0x649ed0]
xor edx, 0xf91a
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
cmp eax, edx
jb 0x4062a8
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
add edx, 0xa0f
cmp eax, edx
jae 0x4062ad
mov eax, dword [esp + 0x10]
mov edx, ebp
sub edx, eax
mov eax, dword [esp + 0x14]
add eax, edx
mov edx, dword [eax]
sub edx, edi
mov dword [eax], edx
mov esi, dword [0x64c46c]
inc ecx
cmp ecx, esi
jb 0x40625f
mov eax, ebp
xor ecx, ecx
mov edx, dword [esp + 0x1c]
xor ebx, ebx
mov bl, byte [eax]
and edx, 0xff
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x5c]
mov ebx, dword [esp + 0x1c]
shr ebx, 8
xor edx, ebx
inc eax
inc ecx
mov dword [esp + 0x1c], edx
cmp ecx, 0xa0f
jb 0x4062b1
xor ecx, ecx
test esi, esi
jbe 0x40632e
mov eax, dword [ecx*4 + 0x649ed0]
xor eax, 0xf91a
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp edx, eax
jb 0x406329
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add eax, 0xa0f
cmp edx, eax
jae 0x40632e
mov edx, dword [esp + 0x10]
mov eax, ebp
sub eax, edx
mov edx, dword [esp + 0x14]
add eax, edx
mov edx, dword [eax]
add edx, edi
mov dword [eax], edx
mov esi, dword [0x64c46c]
inc ecx
cmp ecx, esi
jb 0x4062e2
mov eax, dword [0x649c10]
mov ecx, dword [esp + 0x1c]
xor eax, 0x820c
mov edx, edi
mov esi, dword [esp + 0x20]
and ecx, 0xffff
add edx, eax
lea eax, [esp + 0x54]
push eax
push esi
lea ecx, [edx]
nop
nop
nop
nop
nop
mov edx, dword [esp + 0x20]
lea eax, [edx + edx + 2]
push eax
jmp dword [0x6f9008]
mov ecx, dword [0x6621f4]
mov eax, dword [ecx + 0x30]
cmp byte [eax + 0x2a], 1
je 0x4069e7
mov edx, dword [esp + 0x18]
xor edi, edi
push 0x1ffc
mov ecx, 0x662b50
lea eax, [edx + edx + 0xbd]
mov dword [esp + 0x4c], 0x1ffc
mov dword [esp + 0x20], eax
mov dword [esp + 0x50], edi
call fcn.00407f40
mov ecx, dword [0x662b50]
push edi
mov dword [esp + 0x48], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
cmp esi, edi
je 0x406835
push 0x645764
push str.IDR_RCP1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x406835
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x10], eax
je 0x406667
mov edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x406667
mov ebp, dword [ebx + 4]
mov eax, dword [ebx]
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x58], ebp
add esp, 4
mov dword [esp + 0x30], ebp
mov edi, section..idr1_dt
push ebp
push section..idr1
push edi
call fcn.0060a650
add esp, 0xc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esp + 0x30], ebp
je 0x40652d
push edi
call fcn.00608e5c
add esp, 4
xor edi, edi
jmp 0x406667
push 0x10
push 0x8320
mov dword [esp + 0x28], edi
call fcn.00407090
mov ebp, eax
push 0x10
push 0xedb8
shl ebp, 0x10
call fcn.00407090
add esp, 0x10
or ebp, eax
xor ebx, ebx
lea esi, [esp + 0x5c]
push 8
push ebx
call fcn.00407090
add esp, 8
shl eax, 0x18
mov dword [esi], eax
mov eax, 8
mov edx, dword [esi]
mov ecx, dword [esi]
and edx, 0x80000000
neg edx
sbb edx, edx
add ecx, ecx
and edx, ebp
xor edx, ecx
dec eax
mov dword [esi], edx
jne 0x40656e
mov edx, dword [esi]
push 0x20
push edx
call fcn.00407090
add esp, 8
mov dword [esi], eax
inc ebx
add esi, 4
cmp ebx, 0xff
jbe 0x406559
push 0x20
push 0
call fcn.00407090
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
add esp, 8
test ecx, ecx
mov dword [esp + 0x18], eax
je 0x4065eb
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
xor ebx, ebx
mov bl, byte [eax]
and edx, 0xff
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x5c]
mov esi, dword [esp + 0x18]
shr esi, 8
xor edx, esi
inc eax
dec ecx
mov dword [esp + 0x18], edx
jne 0x4065c6
mov ecx, dword [0x64c46c]
mov esi, dword [esp + 0x18]
xor eax, eax
test ecx, ecx
jle 0x40661b
mov ecx, dword [eax*4 + 0x649ed0]
xor ecx, 0xf91a
add ecx, edi
mov ebx, dword [ecx]
add ebx, edi
inc eax
mov dword [ecx], ebx
mov ecx, dword [0x64c46c]
cmp eax, ecx
jl 0x4065fb
mov ecx, dword [0x64c468]
xor eax, eax
test ecx, ecx
jle 0x406649
mov edx, dword [eax*8 + 0x649c38]
mov ecx, dword [eax*8 + 0x649c3c]
xor edx, 0xf91a
inc eax
mov dword [edx + edi], ecx
mov ecx, dword [0x64c468]
cmp eax, ecx
jl 0x406627
mov edx, dword [0x649c04]
push 0
xor edx, 0xf91a
push 1
push 0
add edx, edi
call edx
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
test edi, edi
je 0x406835
mov eax, dword [0x649bf0]
xor eax, 0xff8e
add eax, edi
call eax
cmp eax, 1
jne 0x406831
mov ebp, dword [0x649c2c]
xor ebp, 0x7a04
add ebp, edi
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov edx, 8
test byte [esp + 0x18], 1
je 0x4066c4
mov ax, word [esp + 0x18]
shr ax, 1
xor eax, 0x8408
mov dword [esp + 0x18], eax
jmp 0x4066cd
shr word [esp + 0x18], 1
mov eax, dword [esp + 0x18]
dec edx
jne 0x4066aa
and eax, 0xffff
mov dword [esp + ecx*4 + 0x5c], eax
inc ecx
cmp ecx, 0xff
jbe 0x4066a1
xor eax, eax
xor edx, edx
mov ecx, 0xf
test al, 1
je 0x4066f8
mov esi, 1
shl esi, cl
or edx, esi
shr eax, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x4066eb
mov esi, dword [0x64c46c]
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
mov edx, ebp
mov dword [esp + 0x10], ecx
sub edx, edi
xor ecx, ecx
mov dword [esp + 0x18], edx
test esi, esi
jbe 0x40676c
mov eax, dword [ecx*4 + 0x649ed0]
xor eax, 0xf91a
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp edx, eax
jb 0x406767
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
add eax, 0x11f
cmp edx, eax
jae 0x40676c
mov edx, dword [esp + 0x18]
mov eax, ebp
sub eax, edx
mov edx, dword [esp + 0x14]
add eax, edx
mov edx, dword [eax]
sub edx, edi
mov dword [eax], edx
mov esi, dword [0x64c46c]
inc ecx
cmp ecx, esi
jb 0x406720
mov eax, ebp
xor ecx, ecx
mov edx, dword [esp + 0x10]
xor ebx, ebx
mov bl, byte [eax]
and edx, 0xff
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x5c]
mov ebx, dword [esp + 0x10]
shr ebx, 8
xor edx, ebx
inc eax
inc ecx
mov dword [esp + 0x10], edx
cmp ecx, 0x11f
jb 0x406770
xor ecx, ecx
test esi, esi
jbe 0x4067ed
mov eax, dword [ecx*4 + 0x649ed0]
xor eax, 0xf91a
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp edx, eax
jb 0x4067e8
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
add eax, 0x11f
cmp edx, eax
jae 0x4067ed
mov edx, dword [esp + 0x18]
mov eax, ebp
sub eax, edx
mov edx, dword [esp + 0x14]
add eax, edx
mov edx, dword [eax]
add edx, edi
mov dword [eax], edx
mov esi, dword [0x64c46c]
inc ecx
cmp ecx, esi
jb 0x4067a1
mov eax, dword [0x649c2c]
mov ecx, dword [esp + 0x10]
xor eax, 0x7a04
mov edx, edi
and ecx, 0xffff
add edx, eax
push 0x743c8d79
push 0x4ca11b
lea eax, [edx]
nop
nop
nop
nop
nop
call eax
cmp eax, 1
sete al
test al, al
jne 0x406835
push edi
call fcn.00412890
add esp, 4
test al, al
je 0x406822
jmp 0x406835
mov edi, dword [esp + 0x4c]
mov ebp, dword [0x649c18]
xor ebp, 0xaeb9
add ebp, edi
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov edx, 8
test byte [esp + 0x18], 1
je 0x406868
mov ax, word [esp + 0x18]
shr ax, 1
xor eax, 0x8408
mov dword [esp + 0x18], eax
jmp 0x406871
shr word [esp + 0x18], 1
mov eax, dword [esp + 0x18]
dec edx
jne 0x40684e
and eax, 0xffff
mov dword [esp + ecx*4 + 0x5c], eax
inc ecx
cmp ecx, 0xff
jbe 0x406845
xor edx, edx
xor eax, eax
mov ecx, 0xf
test dl, 1
je 0x40689d
mov esi, 1
shl esi, cl
or eax, esi
shr edx, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x40688f
mov esi, dword [0x64c46c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov ecx, ebp
sub ecx, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ecx
xor ecx, ecx
test esi, esi
jbe 0x406913
mov edx, dword [ecx*4 + 0x649ed0]
xor edx, 0xf91a
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
cmp eax, edx
jb 0x40690e
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add edx, 0xa2f
cmp eax, edx
jae 0x406913
mov eax, dword [esp + 0x18]
mov edx, ebp
sub edx, eax
mov eax, dword [esp + 0x14]
add eax, edx
mov edx, dword [eax]
sub edx, edi
mov dword [eax], edx
mov esi, dword [0x64c46c]
inc ecx
cmp ecx, esi
jb 0x4068c5
mov eax, ebp
xor ecx, ecx
mov edx, dword [esp + 0x10]
xor ebx, ebx
mov bl, byte [eax]
and edx, 0xff
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x5c]
mov ebx, dword [esp + 0x10]
shr ebx, 8
xor edx, ebx
inc eax
inc ecx
mov dword [esp + 0x10], edx
cmp ecx, 0xa2f
jb 0x406917
xor ecx, ecx
test esi, esi
jbe 0x406994
mov eax, dword [ecx*4 + 0x649ed0]
xor eax, 0xf91a
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp edx, eax
jb 0x40698f
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
add eax, 0xa2f
cmp edx, eax
jae 0x406994
mov edx, dword [esp + 0x18]
mov eax, ebp
sub eax, edx
mov edx, dword [esp + 0x14]
add eax, edx
mov edx, dword [eax]
add edx, edi
mov dword [eax], edx
mov esi, dword [0x64c46c]
inc ecx
cmp ecx, esi
jb 0x406948
mov eax, dword [0x649c18]
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x44]
xor eax, 0xaeb9
mov edx, edi
and ecx, 0xffff
add edx, eax
lea eax, [edx]
nop
nop
nop
nop
nop
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x48]
push ecx
push esi
push edx
jmp dword [0x6f900c]
mov ecx, dword [esp + 0x50]
call fcn.004070c0
mov edi, dword [esp + 0x50]
or ebx, 0xffffffff
xor esi, esi
mov byte [esp + 0x18], 0xc6
mov byte [esp + 0x19], 0xf0
mov byte [esp + 0x1a], 0xf7
mov byte [esp + 0x1b], 0xff
mov dword [esp + 0x464], esi
mov byte [esp + 0x10], 0x51
mov byte [esp + 0x11], 0x58
mov byte [esp + 0x12], 0x97
mov byte [esp + 0x13], 0xff
mov dword [esp + 0x20], 0x3f000000
mov dword [esp + 0x24], 0x3ca3d70a
mov dword [esp + 0x54], 0x3e800000
mov dword [esp + 0x58], 0x3f75c28f
mov ecx, dword [0x6621f4]
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x24]
mov eax, dword [ecx + 8]
lea ecx, [esp + 0x14]
push ecx
push 0x66218c
mov eax, dword [eax + 4]
lea ecx, [esp + 0x60]
push edx
push ecx
mov eax, dword [eax + 8]
mov byte [esp + 0x478], 3
mov ecx, eax
call fcn.00414ca0
mov edx, dword [0x6621f4]
mov al, byte [edi + 8]
push eax
mov dword [esp + 0x468], ebx
mov ecx, dword [edx + 0x44]
call fcn.0040b980
cmp eax, 1
jne 0x40702c
cmp dword [edi + 8], esi
je 0x406fca
mov ecx, dword [0x6621f4]
mov edx, dword [ecx + 0x30]
cmp byte [edx + 0x2a], 1
je 0x406f92
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
cmp edi, esi
je 0x406f65
push 0x645764
push str.IDR_RCP
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x406f65
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x406dce
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x406dce
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, section..idr_dt
mov dword [esp + 0x20], ebp
mov dword [esp + 0x54], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], eax
push eax
push section..idr
push ebp
call fcn.0060a650
add esp, 0xc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
cmp eax, edx
je 0x406c74
push ebp
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
jmp 0x406dce
mov dword [esp + 0x20], ebp
xor edi, edi
lea eax, [esp + 0x5c]
mov edx, edi
xor esi, esi
mov ecx, 7
test dl, 1
je 0x406c95
mov ebx, 1
shl ebx, cl
or esi, ebx
shr edx, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x406c87
shl esi, 0x18
mov dword [eax], esi
mov ecx, 8
mov edx, dword [eax]
mov esi, dword [eax]
and edx, 0x80000000
neg edx
sbb edx, edx
add esi, esi
and edx, 0x4c11db7
xor edx, esi
dec ecx
mov dword [eax], edx
jne 0x406ca7
mov edx, dword [eax]
xor esi, esi
mov ecx, 0x1f
test dl, 1
je 0x406cdb
mov ebx, 1
shl ebx, cl
or esi, ebx
shr edx, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x406ccd
mov dword [eax], esi
inc edi
add eax, 4
cmp edi, 0xff
jbe 0x406c7e
xor edx, edx
xor eax, eax
mov ecx, 0x1f
test dl, 1
je 0x406d08
mov esi, 1
shl esi, cl
or eax, esi
shr edx, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x406cfa
not eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
not eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x406d51
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x5c]
mov esi, dword [esp + 0x18]
shr esi, 8
xor edx, esi
inc ecx
dec eax
mov dword [esp + 0x18], edx
jne 0x406d2c
mov ecx, dword [0x649bd8]
mov esi, dword [esp + 0x18]
xor eax, eax
test ecx, ecx
not esi
jle 0x406d83
mov ecx, dword [eax*4 + 0x6478b0]
xor ecx, 0x6920
add ecx, ebp
mov edi, dword [ecx]
add edi, ebp
inc eax
mov dword [ecx], edi
mov ecx, dword [0x649bd8]
cmp eax, ecx
jl 0x406d63
mov ecx, dword [0x649bd4]
xor eax, eax
test ecx, ecx
jle 0x406db1
mov edx, dword [eax*8 + 0x647618]
mov ecx, dword [eax*8 + 0x64761c]
xor edx, 0x6920
inc eax
mov dword [edx + ebp], ecx
mov ecx, dword [0x649bd4]
cmp eax, ecx
jl 0x406d8f
mov edx, dword [0x647604]
push 0
xor edx, 0x6920
push 1
push 0
add edx, ebp
call edx
lea esi, [ebp]
nop
nop
nop
nop
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
je 0x406f65
mov eax, dword [0x647614]
xor eax, 0x38cc
add eax, esi
call eax
cmp eax, 1
jne 0x406f61
mov ecx, dword [0x6475c4]
lea eax, [esp + 0x5c]
xor ecx, 0x38cc
add ecx, esi
xor edi, edi
mov edx, edi
shl edx, 8
mov dword [eax], edx
mov edx, 8
mov ebx, dword [eax]
mov ebp, dword [eax]
and ebx, 0x8000
neg ebx
sbb ebx, ebx
add ebp, ebp
and ebx, 0x1021
xor ebx, ebp
dec edx
mov dword [eax], ebx
jne 0x406e18
inc edi
add eax, 4
cmp edi, 0xff
jbe 0x406e0c
mov eax, ecx
xor ebp, ebp
sub eax, esi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], eax
mov eax, dword [0x649bd8]
xor edx, edx
cmp eax, ebp
jbe 0x406ea7
mov edi, dword [edx*4 + 0x6478b0]
xor edi, 0x6920
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
cmp edi, ebx
jb 0x406ea2
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
add edi, 0xf8
cmp ebx, edi
jae 0x406ea7
mov eax, dword [esp + 0x18]
mov edi, ecx
sub edi, eax
mov eax, dword [esp + 0x14]
add eax, edi
mov edi, dword [eax]
sub edi, esi
mov dword [eax], edi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x406e5a
mov edi, ecx
xor edx, edx
xor ebx, ebx
mov dl, byte [esp + 0x11]
mov bl, byte [edi]
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x5c]
mov ebx, dword [esp + 0x10]
shl ebx, 8
xor edx, ebx
inc edi
inc ebp
mov dword [esp + 0x10], edx
cmp ebp, 0xf8
jb 0x406ea9
xor edx, edx
test eax, eax
jbe 0x406f22
mov edi, dword [edx*4 + 0x6478b0]
xor edi, 0x6920
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
cmp edi, ebx
jb 0x406f1d
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
add eax, 0xf8
cmp edi, eax
jae 0x406f22
mov eax, dword [esp + 0x18]
mov edi, ecx
sub edi, eax
mov eax, dword [esp + 0x14]
add eax, edi
mov edi, dword [eax]
add edi, esi
mov dword [eax], edi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x406ed6
mov eax, dword [0x6475c4]
mov ecx, dword [esp + 0x10]
xor eax, 0x38cc
mov edx, esi
and ecx, 0xffff
add edx, eax
push 0x9eb13c2e
push 0x4ca11b
lea eax, [edx]
nop
nop
nop
nop
nop
call eax
cmp eax, 1
je 0x406f65
push esi
call fcn.00412660
add esp, 4
test al, al
je 0x406f52
jmp 0x406f65
mov esi, dword [esp + 0x20]
mov eax, dword [0x647604]
push 0
xor eax, 0x6920
push 0
push 0
add eax, esi
call eax
push esi
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x50]
or ebx, 0xffffffff
xor esi, esi
mov eax, dword [0x662b40]
cmp eax, esi
je 0x406fa4
push eax
call fcn.00407060
add esp, 4
mov ecx, 0x662b60
mov dword [0x662b40], esi
mov dword [0x662b48], esi
call fcn.00430150
mov ecx, 0x662b50
call fcn.00430150
mov dword [0x662b6c], esi
mov ecx, dword [edi + 8]
mov edx, dword [edi + 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x20]
push edx
mov dword [edi + 8], ebx
call fcn.0040ff10
mov eax, dword [edi + 4]
mov dword [edi + 0xc], 0xfffffffe
push eax
mov eax, dword [0x6621f4]
xor edx, edx
push 2
mov ecx, dword [eax + 0x94]
mov dx, word [ecx + 0x24]
mov ecx, dword [eax + 0x44]
push edx
call fcn.0040bc10
mov eax, dword [0x6621f4]
push esi
mov ecx, dword [eax + 0x28]
call fcn.00408fc0
mov ecx, dword [0x6621f4]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 4]
mov ecx, dword [eax + 8]
call fcn.00414cb0
mov al, 1
jmp 0x407042
mov ecx, dword [0x6621f4]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 4]
mov ecx, dword [eax + 8]
call fcn.00414cb0
xor al, al
mov ecx, dword [esp + 0x45c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x458
ret