Function at 0x5d212d
Capabilities:
Encrypt data using speck
Inspect section memory permissions

Disassembly:
mov dword [0x479d3c], edx
jmp 0x5d228f
test byte [esi], 1
je 0x5e6421
add esi, 4
jmp 0x5d7a0e
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
jmp 0x5d1a5a
mov eax, dword [0x488530]
lea ecx, [eax - 0x80000000]
cmp dword [ebp - 8], ecx
jb 0x5cffbf
mov ecx, dword [0x48375c]
lea ecx, [ecx + eax - 0x80000000]
cmp dword [ebp - 8], ecx
jb 0x5cffa0
jmp 0x5cffbf
mov edi, eax
mov ecx, edi
call fcn.0040fe28
and eax, 0xffffffdf
or dword [edi], eax
inc dword [esi + 8]
mov edi, dword [edi]
shr edi, 0xc
cmp edi, dword [0x488524]
ja 0x5cff9b
cmp dword [ebp - 8], 0xa0000000
jae 0x5cff50
mov eax, dword [0x488530]
test eax, eax
jne 0x5d002c
mov eax, dword [0x483798]
cmp dword [ebp - 8], eax
jb 0x5d002c
mov ecx, dword [0x488348]
add eax, ecx
cmp dword [ebp - 8], eax
jae 0x5d002c
mov ecx, dword [0x4884c8]
lea eax, [edi + edi*2]
lea edi, [ecx + eax*8]
push edi
call sym.ntoskrnl.exe_MmIsAddressValid
test al, al
je 0x5d002c
lea eax, [edi + 0x17]
push eax
call sym.ntoskrnl.exe_MmIsAddressValid
test al, al
je 0x5d002c
mov eax, dword [edi + 0x14]
xor eax, dword [ebp - 0x48]
mov word [edi + 0xe], 1
and eax, 0x3ffffff
xor dword [edi + 0x14], eax
mov eax, dword [ebp - 0x18]
inc dword [edi + 8]
mov dword [edi + 4], eax
mov eax, dword [edi + 0xc]
and eax, 0xffffde8f
or eax, 0x1600
mov dword [edi + 0xc], eax
jmp 0x5d002c
mov eax, dword [ebp - 0x18]
test byte [eax], 1
jne 0x5cff74
add dword [ebp - 8], 0x1000
add dword [ebp - 0x18], 4
dec dword [ebp - 0x3c]
jne 0x5d0020
add dword [ebp - 0x14], 4
mov edi, dword [ebp - 0x14]
xor esi, esi
dec dword [ebp - 0x38]
je 0x5d029c
cmp dword [0x488530], esi
jne 0x5e645c
mov eax, dword [edi]
test al, 1
jne 0x5d0069
add dword [ebp - 8], 0x400000
jmp 0x5d003c
test al, al
js 0x5d0060
mov ecx, dword [0x4884c8]
shr eax, 0xc
mov dword [ebp - 0x48], eax
lea eax, [eax + eax*2]
lea esi, [ecx + eax*8]
mov eax, dword [esi + 0x14]
xor eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 8]
and eax, 0x3ffffff
xor dword [esi + 0x14], eax
inc dword [esi + 8]
mov word [esi + 0xe], 1
mov eax, dword [esi + 0xc]
shr ecx, 0xa
and eax, 0xffffde8f
and ecx, ebx
or eax, 0x1600
sub ecx, 0x40000000
mov dword [esi + 4], edi
mov dword [esi + 0xc], eax
mov dword [ebp - 0x18], ecx
call fcn.0040fe28
and eax, 0xffffffdf
or dword [edi], eax
mov dword [ebp - 0x3c], 0x400
jmp 0x5d0020
xor esi, esi
jmp 0x5d02dc
call fcn.00405030
mov ecx, dword [0x479d3c]
cmp ecx, esi
mov edi, dword [0x4884c8]
lea eax, [ecx + ecx*2]
lea eax, [edi + eax*8]
je 0x5e64a3
cmp dword [0x488530], esi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0x3c], esi
jne 0x5e64ef
cmp eax, dword [ebp - 0x28]
jne 0x5d1a63
cmp dword [ebp - 0x40], esi
je 0x5e656d
mov edx, dword [0x483658]
mov eax, edi
shr eax, 0xa
and eax, ebx
mov eax, dword [eax - 0x40000000]
shr eax, 0xc
lea ecx, [eax + eax*2]
lea ecx, [edi + ecx*8]
add ecx, 0xc
mov edi, eax
shl edi, 2
mov dword [ecx - 8], edi
mov edi, dword [ecx]
and edi, 0xffffdf8f
or edi, 0x1000
mov dword [ecx], edi
inc word [ecx + 2]
inc eax
add ecx, 0x18
dec edx
jne 0x5d0304
cmp dword [0x488478], esi
jne 0x5d0398
mov eax, dword [0x488524]
mov ecx, dword [0x4884c8]
lea eax, [eax + eax*2]
lea esi, [ecx + eax*8]
test si, 0xfff
je 0x5d0644
mov edi, esi
and edi, 0xfffff000
lea eax, [esi + 0x18]
cmp esi, edi
mov dword [ebp + 8], eax
jbe 0x5d0379
mov eax, esi
sub eax, edi
dec eax
push 0x18
pop ecx
xor edx, edx
div ecx
push 0xffffffffffffffe8
pop ecx
lea eax, [eax + eax*2]
shl eax, 3
sub ecx, eax
mov eax, dword [ebp + 8]
add esi, ecx
sub eax, esi
push 0
push eax
push esi
mov dword [ebp + 8], eax
call sym.ntoskrnl.exe_RtlCompareMemoryUlong
cmp eax, dword [ebp + 8]
je 0x5e6606
cmp esi, dword [0x4884c8]
ja 0x5d0340
cmp dword [ebp - 0x44], 1
mov edi, dword [0x483654]
push 5
pop ecx
mov esi, 0x483640
rep movsd dword es:[edi], dword [esi]
je 0x5e663b
mov eax, dword [0x488480]
mov ecx, dword [ebp - 0x10]
shr eax, 0xa
and eax, ebx
shr ecx, 0xa
and ecx, ebx
mov edx, 0x40000000
sub eax, edx
mov esi, ecx
sub esi, eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [0x488348]
sub esi, edx
sar esi, 2
dec esi
shr eax, 0xc
mov dword [0x48833c], esi
jne 0x5e66ed
xor edi, edi
push edi
push edi
call fcn.005d8e11
push edi
push dword [0x48833c]
push dword [ebp - 0x40]
call fcn.005de2a1
mov eax, dword [0x4835a8]
cmp eax, edi
je 0x5d0417
push eax
call fcn.0043de30
mov eax, dword [0x4835a4]
cmp eax, edi
jne 0x5e67d6
mov esi, 0xfff
cmp dword [0x47a064], 0xffffffff
jne 0x5d7192
mov eax, dword [0x48380c]
cmp eax, edi
jne 0x5e6824
mov edi, dword [0x433df8]
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
xor ecx, ecx
mov byte [ebp + 0xb], al
call fcn.0040fe00
shl eax, 0xc
and edi, esi
or eax, edi
mov dword [0xc0300c04], eax
call fcn.00405030
mov cl, byte [ebp + 0xb]
call dword [sym.imp.HAL.dll_KfLowerIrql]
mov edx, 0xc0301000
xor eax, eax
mov edi, edx
mov ecx, 0x400
rep stosd dword es:[edi], eax
mov eax, edx
mov dword [0x4884b4], eax
mov dword [0x4884b0], 0xc03013fc
mov ecx, dword [eax]
and ecx, esi
or ecx, 0xff000
push 0
mov dword [eax], ecx
push 0x21
mov dword [0x483790], 0xc0503000
call fcn.00473840
mov edi, eax
mov dword [0x4835a0], edi
push 0x21
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [0x4835a0]
mov ecx, dword [eax]
and ecx, esi
or ecx, 0x20000
mov dword [eax], ecx
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
xor ecx, ecx
mov byte [ebp + 0xb], al
call fcn.0040fe00
mov cl, byte [ebp + 0xb]
mov edi, eax
call dword [sym.imp.HAL.dll_KfLowerIrql]
mov eax, dword [0x437760]
shl edi, 0xc
and eax, esi
or eax, edi
mov dword [0xc0301408], eax
xor eax, eax
mov ecx, 0x400
mov edi, 0xc0502000
rep stosd dword es:[edi], eax
cmp dword [0x488530], eax
jne 0x5e6832
mov eax, dword [sym.ntoskrnl.exe_MmHighestUserAddress]
mov ecx, dword [0x4884c8]
and dword [0x483594], 0
add eax, 0xffff0000
shr eax, 0x10
mov dword [0x479d40], eax
mov eax, 0x483598
mov dword [0x48359c], eax
mov dword [0x483598], eax
mov eax, dword [ebp - 0x34]
lea eax, [eax + eax*2]
mov byte [0x483590], 0
mov byte [0x483592], 4
lea edi, [ecx + eax*8]
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
and dword [edi + 8], 0
and word [edi + 0xe], 0
mov byte [ebp + 0xb], al
mov eax, dword [0x437760]
xor ecx, ecx
mov dword [ebp - 4], eax
call fcn.0040fe00
mov edi, dword [0x483790]
mov edx, eax
mov eax, dword [ebp - 4]
shr edi, 0xa
and edi, ebx
mov ecx, edx
shl ecx, 0xc
and eax, esi
or ecx, eax
sub edi, 0x40000000
mov dword [edi], ecx
xor eax, eax
shl edi, 0xa
mov ecx, 0x400
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x4c]
mov dword [edi + 0xec], edx
call fcn.00405030
mov cl, byte [ebp + 0xb]
call dword [sym.imp.HAL.dll_KfLowerIrql]
mov eax, dword [0x479e44]
mov dword [edi + 0x214], eax
mov eax, dword [0x479e40]
mov dword [edi + 0x210], eax
xor eax, eax
push eax
push eax
push eax
push edi
call fcn.0042ca29
cmp dword [0x488530], 0
mov eax, dword [0x483788]
jne 0x5d719c
mov ecx, dword [0x4884c8]
mov edi, eax
shr eax, 0xa
and eax, ebx
sub eax, 0x40000000
mov ebx, eax
mov eax, dword [ebx]
shr edi, 0x14
shr eax, 0xc
lea eax, [eax + eax*2]
and edi, 0xffc
sub edi, 0x3fd00000
lea esi, [ecx + eax*8]
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
cmp word [esi + 0xe], 0
je 0x5e6841
mov cl, al
call dword [sym.imp.HAL.dll_KfLowerIrql]
pop ebx
pop edi
jmp 0x5d2173
lea edi, [esi - 0x1000]
mov eax, esi
jmp 0x5d0356
je 0x5d1a45
cmp eax, 2
je 0x5d19f2
cmp eax, 3
je 0x5d7174
jle 0x5d1aa5
cmp eax, 5
jg 0x5d1aa5
and dword [ebp + 8], 0
test edx, edx
mov ecx, dword [0x4884c8]
lea eax, [esi + esi*2]
lea edi, [ecx + eax*8]
je 0x5d1a45
add edi, 0xc
mov dword [ebp - 0x38], edx
nop
nop
nop
nop
cmp word [edi + 2], 0
jne 0x5d7181
and dword [edi], 0xffffff8f
mov eax, esi
shl eax, 2
mov ecx, esi
mov dword [edi - 8], eax
call fcn.00410f29
inc dword [ebp + 8]
add edi, 0x18
inc esi
dec dword [ebp - 0x38]
jne 0x5d1a10
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x24]
ja 0x5d7132
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
mov ecx, dword [0x479d3c]
mov edi, dword [0x4884c8]
cmp eax, dword [ebp - 0x28]
je 0x5d0298
mov esi, dword [eax + 0xc]
cmp esi, dword [0x488524]
mov edx, dword [eax + 0x10]
ja 0x5cdba7
mov edi, dword [0x488524]
lea ecx, [esi + edx]
inc edi
cmp ecx, edi
ja 0x5e64fb
mov eax, dword [eax + 8]
cmp eax, 6
jle 0x5d19d3
cmp eax, 8
je 0x5d19f2
cmp eax, 0x15
jg 0x5d1b57
mov ecx, dword [ebp - 0x3c]
lea eax, [esi + 0x80000]
shl eax, 0xc
lea edi, [ecx + eax]
mov ecx, edi
shr ecx, 0xa
and ecx, ebx
lea eax, [esi + esi*2]
mov esi, dword [0x4884c8]
sub ecx, 0x40000000
test edx, edx
lea eax, [esi + eax*8]
je 0x5d1a45
mov dword [ebp + 8], edi
mov dword [ebp - 0x38], edx
mov esi, 0x1000
cmp word [eax + 0xe], 0
jne 0x5d1b43
mov edx, dword [ebp + 8]
mov edi, dword [eax + 0x14]
shr edx, 0x14
and edx, 0xffc
mov edx, dword [edx - 0x3fd00000]
shr edx, 0xc
and edi, 0xfc000000
or edx, edi
inc dword [eax + 8]
mov dword [eax + 0x14], edx
mov word [eax + 0xe], 1
mov edx, dword [eax + 0xc]
and edx, 0xfffffe8f
or edx, 0x600
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], ecx
cmp dword [edx + 8], 0x19
je 0x5e652f
mov edx, dword [eax + 0xc]
and edx, 0xffffdfff
or edx, esi
mov dword [eax + 0xc], edx
add dword [ebp + 8], esi
add eax, 0x18
add ecx, 4
dec dword [ebp - 0x38]
je 0x5d1a45
jmp 0x5d1ae0
cmp eax, 0x17
jle 0x5d1a45
jmp 0x5d1aa5
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
cmp dword [0x480f10], 1
push esi
jne 0x5d2178
cmp dword [0x47a1b8], 0
je 0x5d2173
xor esi, esi
cmp dword [0x483620], esi
jbe 0x5d2173
mov eax, dword [esi*8 + 0x483600]
test eax, eax
je 0x5d216a
push dword [esi*8 + 0x483604]
push eax
call fcn.005d17b7
inc esi
cmp esi, dword [0x483620]
jb 0x5d2152
pop esi
leave
ret 4
mov cl, byte [0x47c0ec]
push edi
xor edi, edi
test cl, 0x20
mov dword [ebp - 0x40], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x20], edi
je 0x5d713f
cmp dword [0x488530], edi
jne 0x5d713f
cmp dword [0x48847c], 1
je 0x5e5d2d
mov eax, dword [0x47a0a8]
cmp eax, 0x3c
mov edx, 0xfffff000
jbe 0x5e5d39
mov dword [0x47a0a8], 0xf000
test cl, 0x10
je 0x5d21f6
mov eax, 0x100
or dword [0x47a148], eax
or dword [0x47a14c], eax
mov dword [0x47c334], eax
mov eax, dword [0x47a148]
mov dword [ebp - 4], eax
mov eax, dword [0x47a14c]
mov dword [ebp - 0x18], eax
mov ecx, 0xc0300c00
mov eax, dword [ecx]
shr eax, 0xc
push ebx
mov dword [ebp - 0x34], eax
mov eax, dword fs:[0x124]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x44]
and ecx, edx
mov dword [eax + 0x18], ecx
push dword [0x40d8c4]
mov dword [ebp - 0x4c], eax
push 0x800
push 0xc0300000
call sym.ntoskrnl.exe_RtlFillMemoryUlong
mov ecx, dword [ebp + 8]
mov esi, dword [0x488528]
add ecx, 8
mov dword [0x483654], edi
mov eax, dword [ecx]
mov dword [ebp - 0x28], ecx
cmp eax, ecx
je 0x5d71a9
mov edx, dword [eax + 8]
cmp edx, 6
je 0x5d22bd
cmp edx, 0x17
je 0x5d22bd
cmp edx, 0x1a
je 0x5d22bd
cmp edx, 0x16
je 0x5d22bd
cmp edx, 3
je 0x5d2280
add esi, dword [eax + 0x10]
mov dword [0x488528], esi
mov edx, dword [eax + 0xc]
cmp edx, dword [0x479d3c]
jb 0x5cdb8b
mov edx, dword [eax + 0x10]
mov ebx, dword [eax + 0xc]
add edx, ebx
cmp edx, dword [0x488524]
jbe 0x5d22a6
dec edx
mov dword [0x488524], edx
mov edx, dword [eax + 8]
cmp edx, 2
je 0x5d22c1
cmp edx, 4
je 0x5d22c1
cmp edx, 5
je 0x5d22c1
cmp edx, 8
je 0x5d22c1
mov eax, dword [eax]
jmp 0x5d2253
mov edx, dword [eax + 0x10]
cmp edx, dword [ebp - 0x2c]
jbe 0x5d22bd
mov dword [ebp - 0x2c], edx
mov dword [0x483654], eax
jmp 0x5d22bd
sub esi, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], esi
jmp 0x5d1a45
mov dword [0x47a1b8], edi
jmp 0x5d21b1
mov dword [ebp - 0x14], 1
jmp 0x5d71f1
mov eax, dword [0x488478]
jmp 0x5d7246
push 0x40
pop eax
mov dword [0x48852c], eax
jmp 0x5d741a
sub ecx, edx
jmp 0x5d77aa
test edx, edx
je 0x5d1a45
jmp 0x5e6518
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp - 0x24]
jbe 0x5d1a30
jmp 0x5e655a
call fcn.00439f19
jmp 0x5d0443
test esi, eax
jne 0x5d063d
jmp 0x5e6877
cmp dword [0x4839fc], edi
jne 0x5e5d65
cmp dword [0x47a064], 0xffffffff
mov eax, 0xff00
jne 0x5e5d71
cmp dword [0x4884cc], edi
jne 0x5d71d4
mov dword [0x4884cc], eax
mov ebx, dword [0x488348]
cmp ebx, edi
jne 0x5d714a
cmp dword [0x488340], edi
mov dword [ebp - 0x14], edi
jne 0x5d714a
cmp esi, dword [0x4884cc]
jbe 0x5e5d80
mov eax, dword [0x488478]
shl eax, 0x12
mov dword [0x488478], eax
mov edi, 0x3fffff
jne 0x5e5da6
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x54]
push eax
push 8
push 0x11
call dword [0x4754bc]
test eax, eax
jl 0x5d7156
push 0
push 0x1000
push dword [ebp - 0x50]
push dword [ebp - 0x54]
call sym.ntoskrnl.exe__alldiv
mov dword [0x488478], eax
test eax, eax
mov ebx, dword [0x488348]
jne 0x5e5da6
mov ecx, dword [0x488524]
mov esi, ecx
cmp ecx, edi
mov dword [0x488520], ecx
ja 0x5e5dee
cmp dword [0x47c288], 1
je 0x5e5e1b
mov eax, dword [0x479e0c]
mov esi, dword [0x483654]
dec eax
mov dword [0x48365c], eax
mov eax, dword [0x488528]
cmp eax, 0x44c
push 5
pop ecx
mov edi, 0x483640
rep movsd dword es:[edi], dword [esi]
jb 0x5e5e4e
mov ecx, eax
shr ecx, 3
imul ecx, ecx, 7
mov edx, ebx
shr edx, 0xc
cmp edx, ecx
ja 0x5e5e61
mov ecx, dword [0x479df8]
cmp ebx, ecx
jae 0x5d72d3
lea ebx, [eax - 0x400]
shr ebx, 8
imul ebx, dword [0x479dfc]
add ebx, ecx
mov edi, 0x8000000
cmp ebx, edi
ja 0x5e5e68
cmp dword [0x488340], 0
jne 0x5e5e6f
mov esi, dword [0x488344]
mov ecx, dword [0x488520]
mov edx, 0xfffff000
and ebx, edx
test esi, esi
mov dword [0x488348], ebx
jne 0x5d735e
mov eax, dword [0x488528]
lea esi, [ecx + ecx*2 + 3]
shl esi, 3
and esi, edx
add esi, dword [0x479e00]
cmp eax, 0x1f000
jb 0x5e5ed0
mov edi, dword [0x479e04]
add eax, 0xfffffc00
shr edi, 1
shr eax, 8
imul eax, edi
add esi, eax
mov edi, 0x8000000
cmp esi, edi
mov dword [0x488344], esi
jb 0x5e5ecc
cmp dword [0x488340], 0
jne 0x5e5eec
lea eax, [ecx + ecx*2 + 3]
shl eax, 3
and eax, edx
lea eax, [eax + ebx + 0x10000]
cmp esi, eax
jb 0x5e5f03
cmp dword [0x488530], 0
mov edx, edi
jne 0x5d7386
mov edx, 0x10000000
cmp dword [ebp - 0x14], 1
je 0x5e5f10
cmp esi, edx
ja 0x5e5f25
cmp esi, edi
jbe 0x5d73b4
cmp dword [ebp - 0x14], 0
jne 0x5d73b4
lea eax, [esi - 0x8000000]
cmp ebx, eax
jae 0x5d73b4
mov ebx, eax
mov dword [0x488348], ebx
mov eax, dword [0x48852c]
test eax, eax
jne 0x5d73ed
mov eax, 0xffdff000
mov cl, byte [eax + 0x53]
mov eax, 0xffdff000
test cl, cl
mov eax, dword [eax + 0x90]
mov esi, dword [0x488344]
mov ebx, dword [0x488348]
je 0x5d73e7
movzx ecx, cl
xor edx, edx
div ecx
mov ecx, dword [0x488520]
shr eax, 0xc
mov dword [0x48852c], eax
je 0x5d7160
lea edx, [eax - 1]
test eax, edx
jne 0x5d7160
cmp eax, 2
jb 0x5d7160
cmp eax, 0x400
ja 0x5d7160
lea edx, [eax - 1]
mov dword [0x4884d4], edx
lea eax, [eax + ecx + 1]
lea edx, [eax + eax*2]
shl edx, 3
shr edx, 0xc
inc edx
cmp dword [0x488530], 0
mov dword [0x483658], edx
jne 0x5e5f32
mov edi, dword [0x47a158]
mov eax, dword [0x5e04f8]
mov ecx, dword [0x479e08]
sub edi, esi
mov esi, dword [0x488530]
and edi, 0xfffff000
test esi, esi
mov dword [0x483798], edi
mov dword [0x488330], edi
jne 0x5d74a0
cmp dword [0x47a0a8], 0x7000
jbe 0x5e5f44
cmp ecx, 0xffffffff
je 0x5e5f67
test ecx, ecx
jne 0x5d74a0
cmp dword [0x488528], 0x40000
jae 0x5e5f52
mov eax, dword [0x48833c]
inc eax
shl eax, 0xc
mov ecx, edi
sub ecx, eax
and ecx, 0xffc00000
mov eax, 0xeb000000
cmp ecx, eax
mov dword [0x488480], ecx
jae 0x5d74d9
mov ecx, eax
lea eax, [edi + 0x15000000]
shr eax, 0xc
dec eax
mov dword [0x488480], ecx
mov dword [0x48833c], eax
test esi, esi
jne 0x5d74fa
cmp dword [0x47c30c], esi
jne 0x5d74fa
mov eax, dword [0x479e08]
mov esi, ecx
sub esi, dword [0x47a15c]
cmp eax, esi
ja 0x5e5fa5
mov esi, dword [0x47a158]
shr ecx, 0x14
mov eax, 0xffc
and ecx, eax
sub ecx, 0x3fd00000
dec esi
shr esi, 0x14
and esi, eax
sub esi, 0x3fd00000
cmp ecx, esi
mov dword [ebp - 0x3c], ecx
ja 0x5d7566
mov ebx, ecx
push 1
call fcn.005cdb5a
mov ecx, dword [ebp - 0x18]
and ecx, 0xfff
shl eax, 0xc
or eax, ecx
mov dword [ebx], eax
mov edi, ebx
mov dword [ebp - 0x18], eax
xor eax, eax
shl edi, 0xa
add ebx, 4
cmp ebx, esi
mov ecx, 0x400
rep stosd dword es:[edi], eax
jbe 0x5d7525
mov ebx, dword [0x488348]
mov edx, dword [0x483658]
mov edi, dword [0x483798]
xor eax, eax
cmp dword [0x488530], eax
mov dword [0x483770], eax
jne 0x5e6078
test byte [0x47a1b8], 4
je 0x5d75cb
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx]
cmp eax, ecx
je 0x5d75cb
mov ecx, dword [eax + 0x18]
mov esi, dword [0x483620]
mov dword [esi*8 + 0x483600], ecx
mov esi, dword [eax + 0x18]
mov ecx, dword [eax + 0x20]
lea ecx, [ecx + esi - 1]
mov esi, dword [0x483620]
inc dword [0x483620]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
mov dword [esi*8 + 0x483604], ecx
je 0x5d75cb
mov eax, dword [eax]
cmp eax, dword [ebp + 8]
jne 0x5d758e
test byte [0x47a1b8], 3
je 0x5e6062
mov eax, dword [0x483654]
cmp dword [eax + 0x10], edx
jbe 0x5e6062
push edx
mov dword [ebp - 0x40], 1
call fcn.005cdb5a
mov ecx, dword [0x48375c]
mov edx, dword [0x483658]
mov ebx, dword [0x488348]
mov edi, dword [0x483798]
mov dword [ebp - 0x38], eax
and eax, 0x3ff
or ecx, 0x80000000
shl eax, 0xc
add eax, ecx
mov ecx, dword [0x483620]
mov esi, edx
shl ecx, 3
shl esi, 0xc
inc dword [0x483620]
lea esi, [eax + esi - 1]
mov dword [ecx + 0x483600], eax
mov dword [ecx + 0x483604], esi
shl edx, 0xc
add edx, eax
mov dword [0x4884c8], eax
mov dword [ebp - 0xc], edx
cmp dword [0x488530], 0
mov dword [ebp - 0x10], edi
jne 0x5d766d
mov eax, dword [0x487f54]
mov ecx, eax
sub ecx, dword [ebp - 0xc]
cmp ebx, ecx
ja 0x5e60b0
mov ecx, dword [0x483654]
mov esi, dword [ecx + 0x10]
mov eax, ebx
shr eax, 0xc
cmp eax, esi
mov dword [ebp - 0x20], ebx
ja 0x5e60d2
test byte [0x47a1b8], 2
je 0x5d76d0
mov ecx, eax
shl ecx, 0xc
add ecx, dword [ebp - 0xc]
test ecx, 0x3fffff
je 0x5d76d0
sub esi, eax
cmp esi, 0x400
jbe 0x5d76d0
add ebx, 0x400000
cmp ebx, 0x8000000
jae 0x5d76d0
lea eax, [ecx + 0x3fffff]
and eax, 0xffc00000
sub eax, dword [ebp - 0xc]
shr eax, 0xc
mov ecx, eax
shl ecx, 0xc
mov dword [ebp - 0x20], ecx
mov ecx, eax
shl ecx, 0xc
push eax
mov dword [0x488348], ecx
call fcn.005cdb5a
cmp dword [0x488530], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], eax
mov eax, dword [0x488348]
jne 0x5e618d
mov ecx, dword [ebp - 0xc]
mov ebx, dword [0x4884c8]
shr ebx, 0x14
lea esi, [ecx + eax - 1]
shr esi, 0x14
mov edx, 0xffc
and ebx, edx
mov edi, 0x3fd00000
and esi, edx
sub ebx, edi
sub esi, edi
cmp dword [0x488528], 0x7f00
jbe 0x5d77c3
mov ecx, dword [0x487f54]
add esi, 4
mov dword [ebp - 0x2c], esi
lea esi, [ecx - 1]
shr esi, 0x14
and esi, edx
mov edx, dword [ebp - 0x2c]
sub esi, edi
cmp edx, esi
ja 0x5d77c3
mov edi, esi
sub edi, dword [ebp - 0x2c]
shl edx, 0x14
sar edi, 2
inc edi
cmp dword [0x488338], 0xffffffff
mov dword [0x483764], edx
mov dword [0x483760], ecx
mov dword [0x483780], edi
je 0x5d716d
cmp dword [0x5e04f8], 1
je 0x5d716d
cmp dword [0x47a064], 0xffffffff
jne 0x5d716d
mov edi, dword [0x48380c]
test edi, edi
jne 0x5e60d9
sub ecx, edx
cmp dword [ebp - 8], 1
je 0x5e60e7
mov edx, ecx
and edx, 0xfff
neg edx
sbb edx, edx
neg edx
shr ecx, 0xc
add edx, ecx
mov dword [0x4835a8], edx
cmp ebx, esi
ja 0x5d77fe
test byte [ebx], 1
jne 0x5d77f9
push 1
call fcn.005cdb5a
mov ecx, dword [ebp - 0x18]
shl eax, 0xc
and ecx, 0xfff
or eax, ecx
mov dword [ebx], eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov edi, ebx
mov ecx, 0x400
shl edi, 0xa
rep stosd dword es:[edi], eax
mov eax, dword [0x488348]
add ebx, 4
jmp 0x5d77c3
mov ecx, dword [0x483778]
test ecx, ecx
jne 0x5e60f5
mov edi, dword [ebp - 0xc]
add dword [ebp - 0x10], eax
lea edx, [eax + edi]
mov dword [ebp - 0x3c], edx
mov ecx, edi
shr ecx, 0xa
shr edx, 0xa
mov ebx, 0x3ffffc
and ecx, ebx
mov esi, 0x40000000
and edx, ebx
sub ecx, esi
sub edx, esi
test byte [0x47a1b8], 3
mov dword [0x483798], edi
mov dword [0x483ad8], edi
je 0x5d788c
test cx, 0xfff
je 0x5d7862
mov esi, ecx
shr esi, 2
and esi, 0x3ff
sub dword [ebp - 0x14], esi
and ecx, 0xfffff000
test dx, 0xfff
jne 0x5e617c
mov esi, dword [0x483620]
shl esi, 3
mov dword [esi + 0x483600], edi
mov edi, dword [ebp - 0x3c]
dec edi
inc dword [0x483620]
mov dword [esi + 0x483604], edi
cmp ecx, edx
jae 0x5d78b1
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 0x14]
shl esi, 0xc
and eax, 0xfff
or eax, esi
mov dword [ecx], eax
add ecx, 4
inc dword [ebp - 0x14]
cmp ecx, edx
jb 0x5d7893
mov eax, dword [0x488348]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
add ecx, dword [ebp - 0x10]
mov dword [0x4838e0], ecx
mov esi, 0x40000000
sub eax, dword [ebp - 0x20]
mov ecx, dword [0x483798]
add dword [0x488344], eax
mov dword [0x488330], ecx
call fcn.005de152
mov eax, dword [ebp - 0x20]
sub eax, dword [0x488348]
add dword [0x488344], eax
test byte [0x47a1b8], 1
mov eax, dword [0x47a148]
mov dword [ebp - 4], eax
je 0x5e62b3
mov edi, dword [0x4884c8]
mov eax, dword [0x483658]
shl eax, 0xc
add eax, edi
mov edx, edi
shr edx, 0x14
shr eax, 0xa
mov ecx, edi
shr ecx, 0xa
and edx, 0xffc
and eax, ebx
and ecx, ebx
sub edx, 0x100000
sub eax, esi
sub ecx, esi
shl edx, 0xa
test ax, 0xfff
je 0x5d7948
shr eax, 0xa
and eax, 0xfffffffc
add eax, 4
shl eax, 0xa
mov esi, dword [ebp - 0x38]
sub ecx, edx
sar ecx, 2
sub esi, ecx
cmp edx, eax
mov ecx, edx
jae 0x5d797b
mov edi, dword [ebp - 4]
mov edx, esi
shl edx, 0xc
and edi, 0xfff
or edx, edi
mov dword [ecx], edx
add ecx, 4
inc esi
cmp ecx, eax
mov dword [ebp - 4], edx
jb 0x5d7958
mov edi, dword [0x4884c8]
mov ecx, dword [0x483658]
shl ecx, 0xc
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [0x483754]
cmp eax, 0x8000
ja 0x5e627d
xor esi, esi
inc esi
push esi
push esi
call fcn.00473840
test eax, eax
je 0x5e62a7
cmp dword [0x488530], 0
jne 0x5e63fa
mov eax, dword [0x488520]
mov ecx, dword [0x4884c8]
mov edx, dword [0x48852c]
lea eax, [eax + eax*2 + 3]
lea eax, [ecx + eax*8]
lea ecx, [edx + edx*2]
shl ecx, 2
lea edi, [ecx + eax]
lea ecx, [edi + ecx - 1]
mov esi, eax
shr esi, 0xa
shr ecx, 0xa
and esi, ebx
and ecx, ebx
sub esi, 0x40000000
sub ecx, 0x40000000
mov dword [0x483788], eax
mov dword [0x48378c], edi
mov dword [ebp - 0x2c], ecx
cmp esi, ecx
jbe 0x5cdb96
xor esi, esi
test edx, edx
jbe 0x5d7a52
xor ecx, ecx
or dword [eax + ecx], 0xffffffff
mov eax, dword [0x483788]
and dword [eax + ecx + 8], 0
mov eax, dword [0x48378c]
or dword [eax + ecx], 0xffffffff
mov eax, dword [0x48378c]
and dword [eax + ecx + 8], 0
inc esi
add ecx, 0xc
cmp esi, dword [0x48852c]
jae 0x5d7a52
mov eax, dword [0x483788]
jmp 0x5d7a1e
cmp dword [0x483798], 0xc0000000
jae 0x5d7ae4
test byte [0x47a1b8], 2
je 0x5d7ae4
mov eax, dword [ebp - 0x48]
mov ecx, dword [0x4884c8]
mov dword [ebp - 0x2c], eax
lea eax, [eax + eax*2]
lea eax, [ecx + eax*8]
mov ecx, dword [0x488348]
shr ecx, 0xc
add eax, 0x14
xor edx, edx
mov esi, dword [0x483798]
mov edi, dword [eax]
add esi, edx
shr esi, 0x14
and esi, 0xffc
mov esi, dword [esi - 0x3fd00000]
shr esi, 0xc
and edi, 0xfc000000
or esi, edi
mov dword [eax], esi
mov esi, dword [ebp - 0x2c]
shl esi, 0xc
inc dword [eax - 0xc]
mov dword [eax - 0x10], esi
mov word [eax - 6], 1
mov esi, dword [eax - 8]
and esi, 0xffffde8f
or esi, 0x1600
inc dword [ebp - 0x2c]
mov dword [eax - 8], esi
add edx, 0x1000
add eax, 0x18
dec ecx
jne 0x5d7a8b
mov edi, 0xc0300000
xor esi, esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], esi
mov dword [ebp - 0x38], 0x400
jmp 0x5d004e
and dword [0x47a1b8], 0xfffffffc
jmp 0x5d21be
shl eax, 0xa
add eax, 0xfff
and eax, edx
sub eax, 0x1000
mov esi, 0x3000
cmp eax, esi
mov dword [0x47a0a8], eax
jae 0x5d21db
mov dword [0x47a0a8], esi
jmp 0x5d21db
mov dword [ebp - 8], 1
jmp 0x5d71b5
mov dword [0x4884cc], 0xfffffffe
jmp 0x5d71d4
cmp esi, eax
mov dword [0x47a1b8], edi
ja 0x5d71fd
cmp ebx, edi
jne 0x5d71fd
mov ebx, 0x200000
mov dword [0x488348], ebx
jmp 0x5d71fd
cmp dword [0x488530], 0
je 0x5e5db6
xor eax, eax
mov dword [0x488478], eax
test eax, eax
je 0x5d7254
mov ecx, 0xfffff
lea edx, [eax - 1]
cmp edx, ecx
mov dword [0x488520], ecx
jae 0x5d726a
mov esi, dword [0x488524]
cmp edx, esi
jae 0x5e5de6
lea eax, [esi + 1]
mov dword [0x488478], eax
lea ecx, [eax - 1]
jmp 0x5d725c
cmp dword [0x488530], 0
je 0x5e5e12
cmp esi, edi
mov ecx, edi
mov dword [0x488520], ecx
jbe 0x5d726a
mov dword [0x488524], edi
jmp 0x5d726a
and dword [ebp - 8], 0
jmp 0x5d726a
cmp dword [0x488530], 0
jne 0x5d7277
mov eax, dword [0x4884cc]
cmp dword [0x488528], eax
ja 0x5d7277
cmp ecx, 0x100000
jbe 0x5d7277
and dword [ebp - 8], 0
jmp 0x5d7277
push 0
push dword [0x488524]
push dword [0x479d3c]
jmp 0x5e6414
xor ebx, ebx
jmp 0x5d72b7
mov ebx, edi
jmp 0x5d72e0
mov eax, dword [0x488340]
push 5
pop ecx
cmp eax, ecx
jb 0x5e5e82
push 0x50
pop ecx
cmp eax, ecx
jbe 0x5e5e88
mov dword [0x488340], ecx
mov eax, dword [0x488340]
imul eax, dword [0x488528]
push 0x64
xor edx, edx
pop ecx
div ecx
cmp eax, 0x10000
jbe 0x5e5ea9
mov eax, 0x10000000
jmp 0x5e5eba
shl eax, 0xc
mov ecx, 0x600000
cmp eax, ecx
mov dword [ebp - 0x20], eax
jae 0x5e5ebd
mov eax, ecx
mov dword [ebp - 0x20], eax
cmp ebx, eax
jbe 0x5d72ed
mov ebx, eax
jmp 0x5d72ed
mov esi, edi
jmp 0x5e5ee1
add eax, 0xfffffc00
shr eax, 8
imul eax, dword [0x479e04]
add esi, eax
mov dword [0x488344], esi
jmp 0x5d7351
cmp esi, dword [ebp - 0x20]
jbe 0x5d735e
mov esi, dword [ebp - 0x20]
mov dword [0x488344], esi
jmp 0x5d735e
mov esi, eax
mov dword [0x488344], esi
jmp 0x5d7376
lea eax, [ebx + 0x8000000]
cmp eax, edx
jae 0x5d7390
mov edx, eax
jmp 0x5d7390
mov esi, edx
mov dword [0x488344], esi
jmp 0x5d7398
mov eax, edx
shl eax, 0xc
add esi, eax
mov dword [0x488344], esi
jmp 0x5d7444
cmp dword [0x483778], 0
jne 0x5e5f67
jmp 0x5d7483
test eax, eax
jne 0x5d74a0
cmp dword [0x488338], 0xffffffff
je 0x5d74a0
and dword [ebp - 8], 0
xor ecx, ecx
inc ecx
test eax, eax
mov dword [0x48833c], 0xbb8
mov dword [ebp - 0x44], ecx
mov dword [0x47c30c], ecx
jne 0x5d74a0
cmp dword [0x488528], 0x7f00
ja 0x5d74a0
or dword [0x488338], 0xffffffff
jmp 0x5d74a0
add eax, 0x3fffff
mov esi, 0xffc00000
and eax, esi
mov dword [0x479e08], eax
lea eax, [edi - 0xbb9000]
and eax, esi
mov esi, 0xeb000000
cmp eax, esi
mov dword [ebp - 0x20], eax
jae 0x5e5fcf
mov eax, esi
mov dword [ebp - 0x20], eax
sub eax, dword [0x47a15c]
mov esi, dword [0x479e08]
cmp esi, eax
jbe 0x5e5fe6
mov dword [0x479e08], eax
jmp 0x5e5ff0
mov eax, dword [0x47a15c]
add eax, esi
mov dword [ebp - 0x20], eax
xor eax, eax
inc eax
cmp dword [ebp - 8], eax
mov dword [0x47c30c], eax
jne 0x5e6025
mov eax, ebx
shr eax, 0xc
add eax, dword [0x48833c]
xor edx, edx
push 5
pop esi
div esi
mov edx, dword [ebp - 0x20]
sub edx, ecx
shr edx, 0xc
cmp edx, eax
mov edx, dword [0x483658]
jbe 0x5e6047
and dword [ebp - 8], 0
cmp dword [ebp - 8], 0
jne 0x5e6047
cmp dword [0x5e04f8], 0
jne 0x5e6047
cmp dword [0x488528], 0x7f00
ja 0x5e6047
or dword [0x488338], 0xffffffff
mov ecx, dword [ebp - 0x20]
mov eax, edi
sub eax, ecx
shr eax, 0xc
dec eax
mov dword [0x488480], ecx
mov dword [0x48833c], eax
jmp 0x5d74fa
mov eax, dword [0x48375c]
and dword [0x47a1b8], 0xfffffffc
or eax, 0x80000000
jmp 0x5d7642
mov ecx, dword [0x488344]
lea eax, [edx + 0x1f4]
shl eax, 0xc
sub ecx, ebx
cmp eax, ecx
jbe 0x5d764f
cmp eax, ebx
jae 0x5d764f
mov eax, 0xffe0c
sub eax, edx
shl eax, 0xc
add ebx, eax
mov dword [0x488348], ebx
jmp 0x5d764f
mov edx, ebx
sub edx, eax
add edx, dword [ebp - 0xc]
sub eax, ebx
sub eax, dword [ebp - 0xc]
add dword [ebp - 0x10], edx
add dword [0x488344], eax
mov ebx, ecx
mov dword [0x488348], ebx
jmp 0x5d766d
mov eax, esi
jmp 0x5d7686
cmp edi, 0xffffffff
jne 0x5d716d
jmp 0x5d779e
shr ecx, 0xc
mov dword [0x483770], ecx
jmp 0x5d77c3
mov edx, dword [0x483774]
mov esi, edx
sub esi, ecx
mov edi, esi
and edi, 0xfff
neg edi
sbb edi, edi
neg edi
shr esi, 0xc
add edi, esi
shr ecx, 0x14
mov dword [0x4835a4], edi
mov edi, 0xffc
shr edx, 0x14
and ecx, edi
mov ebx, 0x3fd00000
sub ecx, ebx
and edx, edi
sub edx, ebx
mov esi, ecx
cmp esi, edx
mov dword [ebp - 8], edx
jae 0x5d780c
mov ebx, dword [ebp - 0x18]
push 1
call fcn.005cdb5a
shl eax, 0xc
and ebx, 0xfff
or eax, ebx
mov edi, esi
mov ebx, eax
xor eax, eax
shl edi, 0xa
mov dword [esi], ebx
mov ecx, 0x400
add esi, 4
rep stosd dword es:[edi], eax
inc dword [0x48377c]
cmp esi, dword [ebp - 8]
jb 0x5e6140
mov eax, dword [0x488348]
jmp 0x5d780c
and edx, 0xfffff000
add edx, 0x1000
jmp 0x5d786d
mov edx, dword [0x483798]
mov ecx, edx
lea edx, [eax + edx - 1]
shr ecx, 0xa
shr edx, 0xa
mov ebx, 0x3ffffc
and ecx, ebx
mov esi, 0x40000000
and edx, ebx
sub ecx, esi
sub edx, esi
cmp ecx, edx
ja 0x5e61d6
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0x14]
shl edi, 0xc
and eax, 0xfff
or eax, edi
mov dword [ecx], eax
add ecx, 4
inc dword [ebp - 0x14]
cmp ecx, edx
jbe 0x5e61b8
mov eax, dword [0x488348]
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [0x4838e0], ecx
mov ecx, dword [0x483778]
test ecx, ecx
mov dword [ebp - 0x20], eax
je 0x5d78c4
mov edx, dword [0x483774]
mov esi, edx
sub esi, ecx
mov edi, esi
and edi, 0xfff
neg edi
sbb edi, edi
neg edi
shr esi, 0xc
add edi, esi
shr ecx, 0x14
mov dword [0x4835a4], edi
mov edi, 0xffc
shr edx, 0x14
and ecx, edi
sub ecx, 0x3fd00000
and edx, edi
sub edx, 0x3fd00000
mov esi, ecx
cmp esi, edx
mov dword [ebp - 8], edx
jae 0x5d78bf
push 1
call fcn.005cdb5a
mov ecx, dword [ebp - 0x18]
and ecx, 0xfff
shl eax, 0xc
or eax, ecx
mov dword [esi], eax
mov edi, esi
shl edi, 0xa
mov dword [ebp - 0x18], eax
xor eax, eax
mov ecx, 0x400
add esi, 4
rep stosd dword es:[edi], eax
inc dword [0x48377c]
cmp esi, dword [ebp - 8]
jb 0x5e623d
mov eax, dword [0x488348]
jmp 0x5d78bf
lea esi, [eax - 0x8000]
push 1
push esi
call fcn.00473840
test eax, eax
jne 0x5e6297
push 1
push esi
call fcn.004634ff
neg esi
shl esi, 0xc
add dword [0x47a158], esi
jmp 0x5d79b6
push esi
push esi
call fcn.004634ff
jmp 0x5e63f9
cmp dword [0x488530], 0
je 0x5e6300
push 1
push dword [0x483658]
call fcn.00473840
mov edi, eax
test edi, edi
jne 0x5e62dc
push 1
push dword [0x483658]
call fcn.004634ff
shl edi, 0xa
mov eax, edi
xor edi, edi
inc edi
push edi
push edi
mov dword [0x4884c8], eax
mov dword [0x47a158], eax
call fcn.00473840
test eax, eax
jne 0x5e6300
push edi
push edi
call fcn.004634ff
mov ecx, dword [0x483654]
mov eax, dword [ecx + 0xc]
and dword [ebp - 0x3c], 0
mov dword [ebp - 0x18], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
cmp edx, eax
jmp 0x5e63db
mov eax, dword [edx + 8]
cmp eax, 6
je 0x5e63d6
cmp eax, 0x17
je 0x5e63d6
cmp eax, 0x16
je 0x5e63d6
cmp edx, ecx
jne 0x5e6351
mov eax, dword [0x48364c]
mov edx, dword [0x483650]
jmp 0x5e6357
mov eax, dword [edx + 0xc]
mov edx, dword [edx + 0x10]
mov edi, dword [0x4884c8]
mov dword [ebp - 0x38], edx
lea edx, [eax + eax*2]
lea edx, [edi + edx*8]
mov edi, dword [ebp - 0x38]
add eax, edi
mov edi, dword [0x4884c8]
lea eax, [eax + eax*2]
lea eax, [edi + eax*8 - 1]
shr edx, 0xa
shr eax, 0xa
and edx, ebx
and eax, ebx
sub edx, esi
sub eax, esi
mov dword [ebp - 0x2c], eax
jmp 0x5e63cb
test byte [edx], 1
jne 0x5e63c8
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
shl eax, 0xc
and ecx, 0xfff
or eax, ecx
inc dword [ebp - 0x18]
dec dword [ebp - 0x14]
mov dword [ebp - 4], eax
je 0x5e640a
inc dword [ebp - 0x3c]
mov dword [edx], eax
xor eax, eax
mov edi, edx
mov ecx, 0x400
shl edi, 0xa
rep stosd dword es:[edi], eax
mov ecx, dword [0x483654]
mov eax, dword [ebp - 0x2c]
add edx, 4
cmp edx, eax
jbe 0x5e638b
mov eax, dword [ebp - 8]
mov edx, dword [eax]
jmp 0x5e63d8
mov edx, dword [edx]
cmp edx, dword [ebp - 0x28]
mov dword [ebp - 8], edx
jne 0x5e6322
mov eax, dword [ebp - 0x18]
mov dword [ecx + 0xc], eax
mov eax, dword [0x483654]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x10], ecx
jmp 0x5d79b6
jmp dword [ecx + 0x483658]
mov eax, dword [0x483658]
add dword [0x4838f0], eax
jmp 0x5d79c3
push 1
push dword [0x483650]
push 0
push dword [0x488528]
push 0x7d
call sym.ntoskrnl.exe_KeBugCheckEx
push 1
call fcn.005cdb5a
mov ecx, dword [ebp - 4]
and ecx, 0xfff
shl eax, 0xc
or eax, ecx
mov dword [esi], eax
mov dword [ebp - 4], eax
xor eax, eax
mov edi, esi
mov ecx, 0x400
shl edi, 0xa
rep stosd dword es:[edi], eax
mov edx, dword [0x48852c]
mov eax, dword [0x483788]
mov ecx, dword [ebp - 0x2c]
jmp 0x5cdb9f
cmp edi, 0xc0300800
jb 0x5d005a
mov eax, dword [0x48375c]
add eax, 0x80000000
shr eax, 0x14
and eax, 0xffc
sub eax, 0x3fd00000
cmp edi, eax
jae 0x5d005a
add edi, 4
add dword [ebp - 8], 0x400000
mov dword [ebp - 0x14], edi
jmp 0x5d0045
cmp word [eax + 0xe], si
jne 0x5d02bb
mov ecx, dword [eax + 0x14]
xor ecx, dword [ebp - 0x34]
mov word [eax + 0xe], 0xfff0
and ecx, 0x3ffffff
xor dword [eax + 0x14], ecx
mov ecx, dword [eax + 0xc]
inc dword [eax + 8]
and ecx, 0xffffde8f
or ecx, 0x1600
mov dword [eax + 4], 0xc0300ffc
mov dword [eax + 0xc], ecx
mov ecx, dword [0x479d3c]
mov edi, dword [0x4884c8]
jmp 0x5d02bb
mov dword [ebp - 0x3c], 0x60000000
jmp 0x5d02d3
mov edx, dword [0x488524]
sub edx, esi
inc edx
mov dword [eax + 0x10], edx
jne 0x5d1a87
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
jmp 0x5d1a4e
mov edi, edx
mov edx, esi
mov ecx, 0x479db0
call fcn.00411101
inc esi
dec edi
jne 0x5e651a
jmp 0x5d1a45
and byte [eax + 0x17], 0xfb
xor edx, edx
mov word [eax + 0xe], dx
mov dword [eax], edx
mov dword [eax + 8], edx
mov edx, dword [eax + 0xc]
and edx, 0xfffff8ff
or edx, 0x4008
mov dword [eax + 0xc], edx
jmp 0x5d1b35
mov eax, esi
sub eax, ecx
and dword [ebp + 8], 0
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x30], eax
jmp 0x5d1a30
lea eax, [ecx + ecx*2]
lea eax, [edi + eax*8]
shr eax, 0xa
and eax, ebx
sub eax, 0x40000000
mov ecx, dword [eax]
shr ecx, 0xc
lea ecx, [ecx + ecx*2]
lea ecx, [edi + ecx*8]
or dword [ecx + 0xc], 2
cmp dword [0x488530], esi
mov ecx, dword [0x488520]
jne 0x5e65dd
mov esi, dword [0x4884c8]
lea edx, [ecx + ecx*2]
lea edx, [esi + edx*8]
shr edx, 0xa
and edx, ebx
sub edx, 0x40000000
cmp eax, edx
ja 0x5e65dd
xor esi, esi
inc esi
mov ecx, dword [eax]
mov edi, dword [0x4884c8]
shr ecx, 0xc
lea ecx, [ecx + ecx*2]
lea ecx, [edi + ecx*8]
add eax, 4
cmp eax, edx
mov dword [ecx + 8], esi
mov word [ecx + 0xe], si
jbe 0x5e65b8
mov ecx, dword [0x488520]
lea eax, [ecx + ecx*2]
mov ecx, dword [0x4884c8]
lea eax, [ecx + eax*8]
shr eax, 0xa
and eax, ebx
mov eax, dword [eax - 0x40000000]
shr eax, 0xc
lea eax, [eax + eax*2]
lea eax, [ecx + eax*8]
or dword [eax + 0xc], 4
jmp 0x5d0398
mov edx, dword [0x4884c8]
shr edi, 0xa
and edi, ebx
mov ecx, dword [edi - 0x40000000]
shr ecx, 0xc
lea eax, [ecx + ecx*2]
lea eax, [edx + eax*8]
and word [eax + 0xe], 0
and dword [eax + 0xc], 0xffffff8f
mov edx, ecx
shl edx, 2
mov dword [eax + 4], edx
call fcn.00410f29
jmp 0x5d0390
mov eax, dword [ebp - 0xc]
cmp dword [0x483798], eax
jne 0x5d03b2
mov eax, dword [0x488480]
mov edi, dword [ebp - 0x10]
shr edi, 0x14
mov edx, eax
shr edx, 0x14
mov ecx, 0xffc
and edi, ecx
and edx, ecx
sub edi, 0x3fd00008
sub edx, 0x3fd00000
cmp edi, edx
jbe 0x5d03b7
lea eax, [edi + 4]
shl eax, 0x14
mov dword [ebp - 0x44], eax
mov esi, dword [edi]
mov eax, dword [0x40d8c4]
mov dword [edi], eax
mov ecx, dword [0x4884c8]
shr esi, 0xc
lea eax, [esi + esi*2]
lea eax, [ecx + eax*8]
sub edi, 4
mov dword [ebp - 0x48], eax
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
mov byte [ebp + 0xb], al
mov eax, dword [ebp - 0x48]
or dword [eax + 4], 1
mov ecx, esi
call fcn.00411039
mov ecx, esi
call fcn.00411039
mov cl, byte [ebp + 0xb]
call dword [sym.imp.HAL.dll_KfLowerIrql]
mov eax, dword [0x488480]
shr eax, 0x14
and eax, 0xffc
sub eax, 0x3fd00000
cmp edi, eax
jae 0x5e6680
call fcn.00405030
mov eax, dword [ebp - 0x44]
mov dword [0x488480], eax
jmp 0x5d03b7
mov esi, dword [ebp - 0x30]
mov edx, dword [ebp - 0x24]
dec esi
add ecx, 0xc0000000
mov dword [ebp + 8], edx
mov dword [ebp - 0x48], ecx
mov edi, ecx
mov dword [ebp - 0x44], eax
cmp dword [ebp + 8], 0
je 0x5e6717
inc esi
push esi
call fcn.004374b2
dec dword [ebp + 8]
jmp 0x5e6730
mov ecx, dword [0x487fb8]
and ecx, dword [0x4884d4]
inc dword [0x487fb8]
call fcn.0040fe00
mov esi, eax
mov ecx, dword [0x4884c8]
lea eax, [esi + esi*2]
lea eax, [ecx + eax*8]
mov edx, dword [eax + 0x14]
xor ecx, ecx
inc ecx
mov word [eax + 0xe], cx
mov dword [eax + 8], ecx
mov ecx, edi
shr ecx, 0xa
and ecx, ebx
mov dword [eax + 4], edi
mov dword [eax + 0x10], 0x80
mov ecx, dword [ecx - 0x40000000]
shr ecx, 0xc
and edx, 0xfc000000
or ecx, edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x14], ecx
mov ecx, dword [eax + 0xc]
and ecx, 0xffffdeff
or ecx, 0x1600
mov dword [eax + 0xc], ecx
mov ecx, esi
shl ecx, 0xc
and edx, 0xfff
or ecx, edx
mov dword [edi], ecx
add edi, 4
dec dword [ebp - 0x44]
mov dword [ebp - 4], ecx
jne 0x5e6705
or dword [eax + 0xc], 4
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov ecx, dword [0x4884c8]
push dword [ebp - 0x10]
shr eax, 0xc
lea eax, [eax + eax*2]
lea eax, [ecx + eax*8]
or dword [eax + 0xc], 2
mov esi, dword [0x4838f0]
call fcn.00472510
mov dword [0x4838f0], esi
jmp 0x5d03f0
mov ecx, dword [0x483778]
mov edx, 0x7ffe0000
cmp ecx, edx
jae 0x5e680c
cmp dword [0x483774], edx
jbe 0x5e680c
mov eax, ecx
neg eax
mov esi, 0xfff
and eax, esi
neg eax
sbb eax, eax
sub edx, ecx
neg eax
shr edx, 0xc
add eax, edx
mov dword [0x4835a4], eax
jmp 0x5e6811
mov esi, 0xfff
cmp eax, edi
je 0x5d0429
push eax
call fcn.0043de30
jmp 0x5d0429
cmp eax, 0xffffffff
je 0x5d0443
jmp 0x5d7192
add dword [0x483790], 0x800
jmp 0x5d0519
mov edx, dword [edi]
mov ecx, dword [esi + 0x14]
and ecx, 0xfc000000
shr edx, 0xc
or ecx, edx
inc dword [esi + 8]
mov dword [esi + 0x14], ecx
mov word [esi + 0xe], 1
mov ecx, dword [esi + 0xc]
and ecx, 0xffffde8f
or ecx, 0x1600
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ecx
jmp 0x5d0635
mov ecx, dword [0x48852c]
lea ecx, [ecx + ecx*2]
shl ecx, 3
cmp ecx, 0x1000
jae 0x5d063d
push 0x20206d4d
push ecx
mov esi, eax
push 2
mov dword [ebp + 8], esi
call sym.ntoskrnl.exe_ExAllocatePoolWithTag
mov ecx, dword [0x48852c]
lea edx, [ecx + ecx*2]
lea ecx, [ecx + ecx*2]
mov dword [0x483788], eax
shl ecx, 3
lea edx, [eax + edx*4]
mov edi, eax
mov eax, ecx
shr ecx, 2
mov dword [0x48378c], edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 8]
shr eax, 0xa
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x40d8c4]
and eax, ebx
sub eax, 0x40000000
mov esi, dword [eax]
mov dword [eax], ecx
mov ecx, dword [0x4884c8]
shr esi, 0xc
lea eax, [esi + esi*2]
lea edi, [ecx + eax*8]
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
and dword [edi + 8], 0
or dword [edi + 4], 1
mov ecx, esi
mov bl, al
mov word [edi + 0xe], 1
call fcn.004111f5
mov cl, bl
jmp 0x5d0637