Function at 0x1006ab60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4bc
mov dword [ebp - 0x98], edx
lea edx, [ebp - 0xbc]
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xa0], 0xff
call fcn.1006a630
test eax, eax
je 0x1006abc0
mov eax, dword [esi + 4]
mov dword [ebp - 0x68], eax
cdq
xor eax, edx
sub eax, edx
mov dword [esi + 4], eax
cmp eax, 0x1000000
jbe 0x1006abc7
mov ecx, dword [0x10099d0c]
mov eax, dword fs:[0x2c]
mov eax, dword [eax + ecx*4]
mov dword [eax + 0xc], str.too_large
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esi], 0x1000000
ja 0x1006aba7
mov eax, dword [ebp - 0xb0]
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xa0]
push ebx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x58], edx
push edi
mov edi, dword [ebp - 0xb8]
mov dword [ebp - 0x54], edi
cmp eax, 0xc
jne 0x1006ac43
mov ebx, dword [ebp - 0xbc]
mov dword [ebp - 0x20], ebx
cmp ebx, 0x18
jge 0x1006ac61
mov ecx, edi
mov eax, 0x55555556
sub ecx, edx
sub ecx, 0x18
imul ecx
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jmp 0x1006ac5a
mov ecx, dword [ebp - 0xbc]
mov dword [ebp - 0x20], ecx
cmp ecx, 0x10
jge 0x1006ac61
mov ebx, edi
sub ebx, edx
sub ebx, eax
sar ebx, 2
mov dword [ebp - 0x10], ebx
test ebx, ebx
jne 0x1006acda
mov ecx, dword [esi + 0xa8]
sub ecx, dword [esi + 0xb4]
mov edx, dword [esi + 0xac]
add ecx, edx
lea eax, [ecx - 1]
cmp eax, 0x3ff
ja 0x1006be29
cmp edi, ecx
jl 0x1006be07
sub edi, ecx
cmp edi, 0x400
jg 0x1006be07
test edi, edi
je 0x1006acda
jns 0x1006aca7
mov eax, dword [esi + 0xb0]
jmp 0x1006acd4
cmp dword [esi + 0x10], 0
je 0x1006acd1
mov ecx, dword [esi + 0xb0]
mov eax, ecx
sub eax, edx
cmp eax, edi
jge 0x1006acd1
sub edi, eax
mov dword [esi + 0xac], ecx
mov eax, dword [esi + 0x14]
push edi
push dword [esi + 0x1c]
call eax
add esp, 8
jmp 0x1006acda
lea eax, [edi + edx]
mov dword [esi + 0xac], eax
cmp dword [ebp - 0x20], 0x18
mov eax, dword [ebp - 0x18]
jne 0x1006acf1
cmp eax, 0xff000000
jne 0x1006acf1
mov edx, 3
jmp 0x1006acfb
xor edx, edx
test eax, eax
setne dl
add edx, 3
mov dword [esi + 8], edx
mov ecx, dword [esi]
mov edi, dword [esi + 4]
mov dword [ebp - 0x14], edx
test ecx, ecx
js 0x1006bde5
je 0x1006ad23
mov eax, 0x7fffffff
cdq
idiv ecx
mov edx, dword [ebp - 0x14]
cmp edx, eax
jg 0x1006bde5
mov ebx, edx
imul ebx, ecx
test ebx, ebx
js 0x1006bde5
test edi, edi
js 0x1006bde5
je 0x1006ad4d
mov eax, 0x7fffffff
cdq
idiv edi
cmp ebx, eax
jg 0x1006bde5
mov edx, dword [ebp - 0x14]
test ecx, ecx
jne 0x1006ad58
mov ebx, ecx
imul ebx, edx
jmp 0x1006ad70
mov eax, 0x7fffffff
cdq
idiv ecx
mov edx, dword [ebp - 0x14]
cmp edx, eax
jg 0x1006bdc3
mov ebx, edx
imul ebx, ecx
test edi, edi
je 0x1006ad84
mov eax, 0x7fffffff
cdq
idiv edi
cmp ebx, eax
jg 0x1006bdc3
mov eax, dword [ebp - 0x14]
imul edi, ecx
imul eax, edi
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x1006bdc3
xor edi, edi
cmp dword [ebp - 0x20], 0x10
jge 0x1006b576
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1006b54a
cmp eax, 0x100
jg 0x1006b54a
mov dword [ebp - 0xc], edi
test eax, eax
jle 0x1006b01f
lea edx, [esi + 0xac]
lea ebx, [esi + 0x20]
nop word [eax + eax]
mov eax, dword [edx]
mov ecx, dword [esi + 0xb0]
cmp eax, ecx
jae 0x1006adfa
mov dl, byte [eax]
inc eax
mov byte [ebp - 1], dl
lea edx, [esi + 0xac]
jmp 0x1006ae57
cmp dword [esi + 0x20], 0
lea ebx, [esi + 0x20]
je 0x1006aec8
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea edi, [esi + 0x28]
push edi
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
lea edx, [esi + 0xac]
sub ecx, dword [esi + 0xb4]
add esp, 0xc
add dword [esi + 0xa8], ecx
test eax, eax
jne 0x1006ae44
lea ecx, [esi + 0x29]
mov dword [ebx], eax
mov dword [esi + 0xb0], ecx
mov byte [edi], al
jmp 0x1006ae4f
lea ecx, [esi + 0x28]
add ecx, eax
mov dword [esi + 0xb0], ecx
mov al, byte [edi]
mov byte [ebp - 1], al
lea eax, [edi + 1]
mov dword [ebp - 0x30], edx
mov edi, eax
mov dword [edx], edi
mov edi, dword [ebp - 0xc]
mov dl, byte [ebp - 1]
lea edi, [ebp + edi*4 - 0x4bc]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x1c], ebx
mov byte [edi + 2], dl
cmp eax, ecx
jb 0x1006aeef
cmp dword [ebx], 0
je 0x1006af16
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
add esp, 0xc
sub ecx, dword [esi + 0xb4]
add dword [esi + 0xa8], ecx
mov dword [ebp - 0x44], eax
lea eax, [esi + 0x28]
mov ecx, dword [ebp - 0x44]
mov dword [esi + 0xac], eax
test ecx, ecx
jne 0x1006aedb
mov dword [ebx], ecx
lea ecx, [esi + 0x29]
mov dword [esi + 0xb0], ecx
mov byte [eax], 0
jmp 0x1006aee6
mov edi, dword [ebp - 0xc]
lea edi, [ebp + edi*4 - 0x4bc]
mov dword [ebp - 0x1c], ebx
mov byte [edi + 2], 0
jmp 0x1006ae78
add ecx, 0x28
add ecx, esi
mov dword [esi + 0xb0], ecx
mov eax, dword [esi + 0xac]
mov dword [ebp - 8], ecx
mov dl, byte [eax]
inc eax
mov dword [esi + 0xac], eax
mov byte [ebp - 1], dl
mov byte [edi + 1], dl
cmp eax, ecx
jae 0x1006af1c
mov cl, byte [eax]
lea ebx, [esi + 0x20]
inc eax
mov byte [ebp - 1], cl
mov ecx, dword [ebp - 8]
mov dword [esi + 0xac], eax
jmp 0x1006af90
mov byte [edi + 1], 0
jmp 0x1006af1f
mov ecx, dword [ebp - 8]
cmp dword [ebx], 0
je 0x1006af8c
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
add esp, 0xc
sub ecx, dword [esi + 0xb4]
add dword [esi + 0xa8], ecx
lea ecx, [esi + 0x28]
mov dword [esi + 0xac], ecx
test eax, eax
jne 0x1006af6d
mov eax, dword [ebp - 0x1c]
lea ecx, [esi + 0x29]
mov dword [esi + 0xb0], ecx
mov dword [eax], 0
mov byte [esi + 0x28], 0
jmp 0x1006af78
lea ecx, [esi + 0x28]
add ecx, eax
mov dword [esi + 0xb0], ecx
mov eax, dword [esi + 0xac]
mov dl, byte [eax]
inc eax
mov byte [ebp - 1], dl
mov dword [esi + 0xac], eax
jmp 0x1006af90
mov byte [ebp - 1], 0
cmp dword [ebp - 0x34], 0xc
mov dl, byte [ebp - 1]
mov byte [edi], dl
lea edx, [esi + 0xac]
je 0x1006b002
cmp eax, ecx
jae 0x1006afaa
inc eax
mov dword [edx], eax
jmp 0x1006b002
mov edi, dword [ebp - 0x1c]
cmp dword [edi], 0
je 0x1006b002
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
lea edx, [esi + 0xac]
sub ecx, dword [esi + 0xb4]
add esp, 0xc
add dword [esi + 0xa8], ecx
lea ecx, [esi + 0x28]
mov dword [edx], ecx
test eax, eax
jne 0x1006aff5
mov dword [edi], eax
lea eax, [esi + 0x29]
mov dword [esi + 0xb0], eax
mov byte [ecx], 0
jmp 0x1006b000
add eax, 0x28
add eax, esi
mov dword [esi + 0xb0], eax
inc dword [edx]
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax*4 - 0x4b9], 0xff
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp - 0x10]
jl 0x1006ade0
mov ebx, dword [ebp - 0x24]
xor edi, edi
mov ecx, dword [ebp - 0x54]
xor eax, eax
cmp dword [ebp - 0x34], 0xc
setne al
add eax, 3
imul eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, dword [ebp - 0x58]
sub ecx, dword [ebp - 0x34]
je 0x1006b082
test ecx, ecx
jns 0x1006b04e
mov eax, dword [esi + 0xb0]
mov dword [esi + 0xac], eax
jmp 0x1006b082
cmp dword [esi + 0x10], 0
je 0x1006b07c
mov edx, dword [esi + 0xb0]
mov eax, edx
sub eax, dword [esi + 0xac]
cmp eax, ecx
jge 0x1006b07c
sub ecx, eax
mov dword [esi + 0xac], edx
mov eax, dword [esi + 0x14]
push ecx
push dword [esi + 0x1c]
call eax
add esp, 8
jmp 0x1006b082
add dword [esi + 0xac], ecx
mov edx, dword [ebp - 0x20]
cmp edx, 1
jne 0x1006b094
mov eax, dword [esi]
add eax, 7
shr eax, 3
jmp 0x1006b0ab
cmp edx, 4
jne 0x1006b0a0
mov eax, dword [esi]
inc eax
shr eax, 1
jmp 0x1006b0ab
cmp edx, 8
jne 0x1006b51e
mov eax, dword [esi]
mov ecx, dword [esi + 4]
neg eax
and eax, 3
mov dword [ebp - 8], ecx
mov dword [ebp - 0x3c], eax
cmp edx, 1
jne 0x1006b2ea
mov dword [ebp - 0x48], 0
test ecx, ecx
jle 0x1006b516
mov ecx, dword [esi + 0xac]
mov dword [ebp - 0xc], 7
cmp ecx, dword [esi + 0xb0]
jae 0x1006b0f1
mov al, byte [ecx]
inc ecx
mov dword [esi + 0xac], ecx
jmp 0x1006b158
cmp dword [esi + 0x20], 0
je 0x1006b156
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
add esp, 0xc
sub ecx, dword [esi + 0xb4]
add dword [esi + 0xa8], ecx
test eax, eax
jne 0x1006b13d
mov dword [esi + 0x20], eax
lea ecx, [esi + 0x29]
lea eax, [esi + 0x29]
mov dword [esi + 0xb0], eax
mov byte [esi + 0x28], 0
mov al, byte [esi + 0x28]
mov dword [esi + 0xac], ecx
jmp 0x1006b158
add eax, 0x28
lea ecx, [esi + 0x29]
add eax, esi
mov dword [esi + 0xb0], eax
mov al, byte [esi + 0x28]
mov dword [esi + 0xac], ecx
jmp 0x1006b158
xor al, al
movzx eax, al
mov dword [ebp - 0x30], eax
mov eax, dword [esi]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], eax
test eax, eax
jle 0x1006b291
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
sar edx, cl
and edx, 1
movzx eax, byte [ebp + edx*4 - 0x4bc]
mov byte [edi + ebx], al
movzx eax, byte [ebp + edx*4 - 0x4bb]
mov byte [edi + ebx + 1], al
movzx eax, byte [ebp + edx*4 - 0x4ba]
mov byte [edi + ebx + 2], al
add edi, 3
cmp dword [ebp - 0x14], 4
jne 0x1006b1b4
mov byte [edi + ebx], 0xff
inc edi
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x4c]
inc eax
mov ecx, edx
cmp eax, dword [ebp - 0x18]
je 0x1006b291
sub dword [ebp - 0xc], 1
jns 0x1006b273
mov dword [ebp - 0xc], 7
cmp edx, dword [esi + 0xb0]
jae 0x1006b1fc
mov al, byte [edx]
lea ecx, [edx + 1]
mov byte [ebp - 1], al
movzx edx, byte [ebp - 1]
mov eax, dword [ebp - 0x2c]
mov dword [esi + 0xac], ecx
mov dword [ebp - 0x30], edx
jmp 0x1006b27c
cmp dword [esi + 0x20], 0
je 0x1006b261
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
add esp, 0xc
sub ecx, dword [esi + 0xb4]
add dword [esi + 0xa8], ecx
test eax, eax
jne 0x1006b23c
mov dword [esi + 0x20], eax
lea eax, [esi + 0x29]
mov dword [esi + 0xb0], eax
mov byte [esi + 0x28], 0
jmp 0x1006b247
add eax, 0x28
add eax, esi
mov dword [esi + 0xb0], eax
mov al, byte [esi + 0x28]
lea ecx, [esi + 0x29]
mov byte [ebp - 1], al
movzx edx, byte [ebp - 1]
mov dword [esi + 0xac], ecx
mov eax, dword [esi]
mov dword [ebp - 0x30], edx
jmp 0x1006b27c
mov eax, dword [ebp - 0x2c]
mov ecx, edx
mov byte [ebp - 1], 0
movzx edx, byte [ebp - 1]
mov dword [ebp - 0x30], edx
jmp 0x1006b27c
mov ecx, dword [esi + 0xac]
mov eax, dword [ebp - 0x2c]
inc dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x28], eax
jl 0x1006b178
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x1006b2ce
cmp dword [esi + 0x10], 0
je 0x1006b2c6
mov edx, dword [esi + 0xb0]
sub edx, ecx
cmp edx, eax
jge 0x1006b2c6
mov ecx, dword [esi + 0xb0]
sub eax, edx
push eax
push dword [esi + 0x1c]
mov eax, dword [esi + 0x14]
mov dword [esi + 0xac], ecx
call eax
add esp, 8
jmp 0x1006b2ce
add eax, ecx
mov dword [esi + 0xac], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [esi + 4]
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 8], ecx
cmp eax, ecx
jl 0x1006b0d1
mov eax, ecx
jmp 0x1006bcd0
xor edx, edx
mov dword [ebp - 0x38], edx
test ecx, ecx
jle 0x1006b516
nop word [eax + eax]
cmp dword [esi], 0
mov dword [ebp - 0x40], 0
jle 0x1006b4c9
mov ecx, dword [esi + 0xac]
mov edx, dword [esi + 0xb0]
cmp ecx, edx
jae 0x1006b32b
mov al, byte [ecx]
inc ecx
mov dword [esi + 0xac], ecx
jmp 0x1006b38e
cmp dword [esi + 0x20], 0
je 0x1006b38c
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
add esp, 0xc
sub ecx, dword [esi + 0xb4]
add dword [esi + 0xa8], ecx
test eax, eax
jne 0x1006b373
lea edx, [esi + 0x29]
mov dword [esi + 0x20], eax
mov dword [esi + 0xb0], edx
lea ecx, [esi + 0x29]
mov byte [esi + 0x28], al
mov dword [esi + 0xac], ecx
jmp 0x1006b38e
lea edx, [esi + 0x28]
add edx, eax
lea ecx, [esi + 0x29]
mov dword [esi + 0xb0], edx
mov al, byte [esi + 0x28]
mov dword [esi + 0xac], ecx
jmp 0x1006b38e
xor al, al
cmp dword [ebp - 0x20], 4
movzx eax, al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], 0
jne 0x1006b3ae
mov dword [ebp - 0xc], eax
and dword [ebp - 0xc], 0xf
shr eax, 4
mov dword [ebp - 0x1c], eax
movzx eax, byte [ebp + eax*4 - 0x4bc]
mov byte [edi + ebx], al
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax*4 - 0x4bb]
mov byte [edi + ebx + 1], al
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax*4 - 0x4ba]
mov byte [edi + ebx + 2], al
add edi, 3
cmp dword [ebp - 0x14], 4
jne 0x1006b3e5
mov byte [edi + ebx], 0xff
inc edi
mov eax, dword [ebp - 0x40]
inc eax
cmp eax, dword [esi]
je 0x1006b4c6
cmp dword [ebp - 0x20], 8
jne 0x1006b481
cmp ecx, edx
jae 0x1006b40f
mov dl, byte [ecx]
lea eax, [ecx + 1]
mov dword [esi + 0xac], eax
movzx ecx, dl
jmp 0x1006b484
cmp dword [esi + 0x20], 0
je 0x1006b47a
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
add esp, 0xc
sub ecx, dword [esi + 0xb4]
add dword [esi + 0xa8], ecx
test eax, eax
jne 0x1006b45e
mov dword [esi + 0x20], eax
lea eax, [esi + 0x29]
mov dword [esi + 0xb0], eax
lea eax, [esi + 0x29]
mov byte [esi + 0x28], 0
mov dl, byte [esi + 0x28]
mov dword [esi + 0xac], eax
movzx ecx, dl
jmp 0x1006b484
add eax, 0x28
add eax, esi
mov dword [esi + 0xb0], eax
lea eax, [esi + 0x29]
mov dl, byte [esi + 0x28]
mov dword [esi + 0xac], eax
movzx ecx, dl
jmp 0x1006b484
xor dl, dl
movzx ecx, dl
jmp 0x1006b484
mov ecx, dword [ebp - 0xc]
movzx eax, byte [ebp + ecx*4 - 0x4bc]
mov byte [edi + ebx], al
movzx eax, byte [ebp + ecx*4 - 0x4bb]
mov byte [edi + ebx + 1], al
movzx eax, byte [ebp + ecx*4 - 0x4ba]
mov byte [edi + ebx + 2], al
add edi, 3
cmp dword [ebp - 0x14], 4
jne 0x1006b4b5
mov byte [edi + ebx], 0xff
inc edi
mov eax, dword [ebp - 0x40]
add eax, 2
mov dword [ebp - 0x40], eax
cmp eax, dword [esi]
jl 0x1006b310
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x1006b504
cmp dword [esi + 0x10], 0
je 0x1006b4fe
mov edx, dword [esi + 0xb0]
mov ecx, edx
sub ecx, dword [esi + 0xac]
cmp ecx, eax
jge 0x1006b4fe
sub eax, ecx
mov dword [esi + 0xac], edx
push eax
push dword [esi + 0x1c]
mov eax, dword [esi + 0x14]
call eax
mov eax, dword [ebp - 0x3c]
add esp, 8
jmp 0x1006b504
add dword [esi + 0xac], eax
inc dword [ebp - 0x38]
mov ecx, dword [esi + 4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 0x38], ecx
jl 0x1006b300
mov eax, dword [ebp - 8]
jmp 0x1006bcd0
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [0x10099d0c]
add esp, 4
mov eax, dword fs:[0x2c]
pop edi
mov eax, dword [eax + ecx*4]
pop ebx
pop esi
mov dword [eax + 0xc], str.bad_bpp
xor eax, eax
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [0x10099d0c]
add esp, 4
mov eax, dword fs:[0x2c]
pop edi
mov eax, dword [eax + ecx*4]
pop ebx
pop esi
mov dword [eax + 0xc], str.invalid
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x28], edi
sub eax, dword [ebp - 0x34]
je 0x1006b604
test eax, eax
jns 0x1006b5d1
mov eax, dword [esi + 0xb0]
mov dword [esi + 0xac], eax
jmp 0x1006b604
cmp dword [esi + 0x10], edi
je 0x1006b5fe
mov edx, dword [esi + 0xb0]
mov ecx, edx
sub ecx, dword [esi + 0xac]
cmp ecx, eax
jge 0x1006b5fe
sub eax, ecx
mov dword [esi + 0xac], edx
push eax
push dword [esi + 0x1c]
mov eax, dword [esi + 0x14]
call eax
add esp, 8
jmp 0x1006b604
add dword [esi + 0xac], eax
mov edx, dword [ebp - 0x20]
cmp edx, 0x18
jne 0x1006b613
mov eax, dword [esi]
lea eax, [eax + eax*2]
jmp 0x1006b620
cmp edx, 0x10
jne 0x1006b61e
mov eax, dword [esi]
add eax, eax
jmp 0x1006b620
xor eax, eax
neg eax
and eax, 3
mov dword [ebp - 0x94], eax
cmp edx, 0x18
jne 0x1006b63c
mov dword [ebp - 0x28], 1
jmp 0x1006b812
mov ecx, dword [ebp - 0xc]
cmp edx, 0x20
jne 0x1006b674
cmp ecx, 0xff
jne 0x1006b674
cmp dword [ebp - 0x2c], 0xff00
jne 0x1006b674
mov eax, dword [ebp - 0x38]
cmp eax, 0xff0000
jne 0x1006b674
cmp dword [ebp - 0x18], 0xff000000
jne 0x1006b695
mov dword [ebp - 0x28], 2
jmp 0x1006b812
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x1006bd97
cmp dword [ebp - 0x2c], edi
je 0x1006bd97
test ecx, ecx
je 0x1006bd97
mov ecx, eax
call fcn.1006a550
sub eax, 7
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x38]
mov edx, eax
and eax, 0x55555555
shr edx, 1
and edx, 0x55555555
add edx, eax
mov eax, edx
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov ecx, eax
shr ecx, 4
add ecx, eax
and ecx, 0xf0f0f0f
mov eax, ecx
shr eax, 8
add ecx, eax
mov eax, ecx
shr eax, 0x10
add eax, ecx
mov ecx, dword [ebp - 0x2c]
movzx eax, al
mov dword [ebp - 0x3c], eax
call fcn.1006a550
sub eax, 7
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x2c]
mov edx, eax
and eax, 0x55555555
shr edx, 1
and edx, 0x55555555
add edx, eax
mov eax, edx
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov ecx, eax
shr ecx, 4
add ecx, eax
and ecx, 0xf0f0f0f
mov eax, ecx
shr eax, 8
add ecx, eax
mov eax, ecx
shr eax, 0x10
add eax, ecx
mov ecx, dword [ebp - 0xc]
movzx eax, al
mov dword [ebp - 0x40], eax
call fcn.1006a550
sub eax, 7
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xc]
mov edx, eax
and eax, 0x55555555
shr edx, 1
and edx, 0x55555555
add edx, eax
mov eax, edx
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov ecx, eax
shr ecx, 4
add ecx, eax
and ecx, 0xf0f0f0f
mov eax, ecx
shr eax, 8
add ecx, eax
mov eax, ecx
shr eax, 0x10
add eax, ecx
movzx eax, al
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
call fcn.1006a550
sub eax, 7
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x18]
mov edx, eax
and eax, 0x55555555
shr edx, 1
and edx, 0x55555555
add edx, eax
mov eax, edx
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov ecx, eax
shr ecx, 4
add ecx, eax
and ecx, 0xf0f0f0f
mov eax, ecx
shr eax, 8
add ecx, eax
mov eax, ecx
shr eax, 0x10
add eax, ecx
cmp dword [ebp - 0x3c], 8
movzx eax, al
mov dword [ebp - 0x30], eax
ja 0x1006bd97
cmp dword [ebp - 0x40], 8
ja 0x1006bd97
cmp dword [ebp - 0x1c], 8
ja 0x1006bd97
cmp eax, 8
ja 0x1006bd97
mov edx, dword [ebp - 0x20]
mov ecx, dword [esi + 4]
mov eax, ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 8], eax
test ecx, ecx
jle 0x1006bcd0
mov eax, dword [ebp - 0x60]
neg eax
mov dword [ebp - 0x74], eax
mov eax, 8
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x64]
neg eax
mov dword [ebp - 0x7c], eax
mov eax, 8
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x48]
neg eax
mov dword [ebp - 0x84], eax
mov eax, 8
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x4c]
neg eax
mov dword [ebp - 0x8c], eax
mov eax, 8
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x90], eax
nop dword [eax]
cmp dword [ebp - 0x28], 0
mov eax, dword [esi]
mov dword [ebp - 0x5c], 0
je 0x1006bb43
test eax, eax
jle 0x1006bc76
lea eax, [ebx + 2]
mov dword [ebp - 0x6c], eax
lea edx, [esi + 0xac]
lea eax, [ebx + 1]
mov dword [ebp - 0x70], eax
nop dword [eax]
mov ecx, dword [esi + 0xb0]
mov eax, dword [edx]
mov dword [ebp - 0x10], ecx
cmp eax, ecx
jae 0x1006b8cd
mov cl, byte [eax]
inc eax
mov byte [ebp - 1], cl
lea ecx, [esi + 0x20]
mov dword [ebp - 8], ecx
jmp 0x1006b936
cmp dword [esi + 0x20], 0
lea ecx, [esi + 0x20]
mov dword [ebp - 8], ecx
je 0x1006b95b
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
lea edx, [esi + 0xac]
sub ecx, dword [esi + 0xb4]
add esp, 0xc
add dword [esi + 0xa8], ecx
mov ecx, dword [ebp - 8]
test eax, eax
jne 0x1006b91f
mov dword [ecx], eax
lea eax, [esi + 0x29]
mov dword [esi + 0xb0], eax
mov byte [esi + 0x28], 0
jmp 0x1006b92a
add eax, 0x28
add eax, esi
mov dword [esi + 0xb0], eax
mov dword [ebp - 0x10], eax
mov al, byte [esi + 0x28]
mov byte [ebp - 1], al
lea eax, [esi + 0x29]
mov ebx, eax
mov dword [ebp - 0x58], eax
mov dword [edx], ebx
mov bl, byte [ebp - 1]
mov dword [ebp - 0x54], edx
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x34], ecx
mov byte [edx + edi], bl
cmp eax, dword [ebp - 0x10]
jae 0x1006b963
mov bl, byte [eax]
mov byte [ebp - 1], bl
jmp 0x1006b9d9
mov dword [ebp - 0x34], ecx
mov byte [edi + ebx + 2], 0
mov ebx, dword [ebp - 0x34]
cmp dword [ebx], 0
mov ebx, dword [ebp - 0x24]
je 0x1006b9ff
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
add esp, 0xc
sub ecx, dword [esi + 0xb4]
add dword [esi + 0xa8], ecx
lea ecx, [esi + 0x28]
mov dword [esi + 0xac], ecx
test eax, eax
jne 0x1006b9ba
mov eax, dword [ebp - 0x34]
mov dword [eax], 0
lea eax, [esi + 0x29]
mov dword [esi + 0xb0], eax
mov byte [ecx], 0
jmp 0x1006b9c5
add eax, 0x28
add eax, esi
mov dword [esi + 0xb0], eax
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0xac]
mov cl, byte [eax]
mov byte [ebp - 1], cl
lea ecx, [esi + 0x20]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x70]
inc eax
mov bl, byte [ebp - 1]
mov dword [esi + 0xac], eax
mov byte [edx + edi], bl
cmp eax, dword [ebp - 0x10]
jae 0x1006ba07
mov bl, byte [eax]
inc eax
mov byte [ebp - 1], bl
mov dword [esi + 0xac], eax
jmp 0x1006ba83
mov dword [ebp - 8], ecx
mov byte [edi + ebx + 1], 0
mov ebx, dword [ebp - 0x34]
cmp dword [ebx], 0
mov ebx, dword [ebp - 0x24]
je 0x1006ba7c
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
add esp, 0xc
sub ecx, dword [esi + 0xb4]
add dword [esi + 0xa8], ecx
lea ecx, [esi + 0x28]
mov dword [esi + 0xac], ecx
test eax, eax
jne 0x1006ba57
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
lea eax, [esi + 0x29]
mov dword [esi + 0xb0], eax
mov byte [esi + 0x28], 0
jmp 0x1006ba62
add eax, 0x28
add eax, esi
mov dword [esi + 0xb0], eax
mov eax, dword [esi + 0xac]
mov cl, byte [eax]
inc eax
mov byte [ebp - 1], cl
lea ecx, [esi + 0x20]
mov dword [esi + 0xac], eax
mov dword [ebp - 8], ecx
jmp 0x1006ba86
mov byte [ebp - 1], 0
mov dword [ebp - 8], ecx
mov ebx, dword [ebp - 0x24]
mov dl, byte [ebp - 1]
mov byte [edi + ebx], dl
add edi, 3
cmp dword [ebp - 0x28], 2
lea edx, [esi + 0xac]
jne 0x1006bb19
cmp eax, dword [esi + 0xb0]
jae 0x1006baae
mov cl, byte [eax]
inc eax
mov dword [edx], eax
jmp 0x1006bb1c
cmp dword [ecx], 0
je 0x1006bb15
push dword [esi + 0x24]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x28]
push ecx
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0xac]
lea edx, [esi + 0xac]
sub ecx, dword [esi + 0xb4]
add esp, 0xc
add dword [esi + 0xa8], ecx
lea ecx, [esi + 0x28]
mov dword [edx], ecx
test eax, eax
jne 0x1006bb01
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
lea eax, [esi + 0x29]
mov dword [esi + 0xb0], eax
mov byte [esi + 0x28], 0
mov eax, dword [edx]
mov cl, byte [eax]
inc eax
mov dword [edx], eax
jmp 0x1006bb1c
add eax, 0x28
add eax, esi
mov dword [esi + 0xb0], eax
mov eax, dword [edx]
mov cl, byte [eax]
inc eax
mov dword [edx], eax
jmp 0x1006bb1c
xor cl, cl
jmp 0x1006bb1c
or cl, 0xff
movzx eax, cl
or dword [ebp - 0x50], eax
cmp dword [ebp - 0x14], 4
jne 0x1006bb2c
mov byte [edi + ebx], cl
inc edi
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp eax, dword [esi]
jl 0x1006b8b0
mov dword [ebp - 0x10], edi
jmp 0x1006bc76
test eax, eax
jle 0x1006bc76
nop dword [eax + eax]
mov ecx, esi
cmp edx, 0x10
jne 0x1006bb5e
call fcn.100611c0
jmp 0x1006bb74
call fcn.100611c0
mov ecx, esi
mov edi, eax
call fcn.100611c0
shl eax, 0x10
add eax, edi
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x60]
mov edx, eax
and edx, dword [ebp - 0x38]
test ecx, ecx
jns 0x1006bb87
mov ecx, dword [ebp - 0x74]
shl edx, cl
jmp 0x1006bb89
shr edx, cl
mov ecx, dword [ebp - 0x78]
shr edx, cl
mov ecx, dword [ebp - 0x3c]
imul edx, dword [ecx*4 + 0x10082f00]
mov ecx, dword [ecx*4 + 0x10082f54]
sar edx, cl
mov ecx, dword [ebp - 0x64]
mov byte [edi + ebx], dl
mov edx, eax
and edx, dword [ebp - 0x2c]
test ecx, ecx
jns 0x1006bbb8
mov ecx, dword [ebp - 0x7c]
shl edx, cl
jmp 0x1006bbba
shr edx, cl
mov ecx, dword [ebp - 0x80]
shr edx, cl
mov ecx, dword [ebp - 0x40]
imul edx, dword [ecx*4 + 0x10082f00]
mov ecx, dword [ecx*4 + 0x10082f54]
sar edx, cl
mov ecx, dword [ebp - 0x48]
mov byte [edi + ebx + 1], dl
mov edx, eax
and edx, dword [ebp - 0xc]
test ecx, ecx
jns 0x1006bbed
mov ecx, dword [ebp - 0x84]
shl edx, cl
jmp 0x1006bbef
shr edx, cl
mov ecx, dword [ebp - 0x88]
shr edx, cl
mov ecx, dword [ebp - 0x1c]
imul edx, dword [ecx*4 + 0x10082f00]
mov ecx, dword [ecx*4 + 0x10082f54]
sar edx, cl
mov ecx, dword [ebp - 0x18]
mov byte [edi + ebx + 2], dl
add edi, 3
mov dword [ebp - 0x10], edi
test ecx, ecx
je 0x1006bc4f
and eax, ecx
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
jns 0x1006bc2f
mov ecx, dword [ebp - 0x8c]
shl eax, cl
jmp 0x1006bc31
shr eax, cl
mov ecx, dword [ebp - 0x90]
shr eax, cl
mov ecx, dword [ebp - 0x30]
imul eax, dword [ecx*4 + 0x10082f00]
mov ecx, dword [ecx*4 + 0x10082f54]
sar eax, cl
jmp 0x1006bc54
mov eax, 0xff
or dword [ebp - 0x50], eax
cmp dword [ebp - 0x14], 4
jne 0x1006bc64
mov byte [edi + ebx], al
inc edi
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x5c], ecx
cmp ecx, dword [esi]
jl 0x1006bb50
mov edx, dword [ebp - 0x94]
test edx, edx
je 0x1006bcb6
cmp dword [esi + 0x10], 0
je 0x1006bcb0
mov eax, dword [esi + 0xb0]
mov ecx, eax
sub ecx, dword [esi + 0xac]
cmp ecx, edx
jge 0x1006bcb0
mov dword [esi + 0xac], eax
mov eax, edx
sub eax, ecx
push eax
push dword [esi + 0x1c]
mov eax, dword [esi + 0x14]
call eax
add esp, 8
jmp 0x1006bcb6
add dword [esi + 0xac], edx
mov edx, dword [ebp - 0x44]
mov ecx, dword [esi + 4]
inc edx
mov eax, ecx
mov dword [ebp - 0x44], edx
cmp edx, ecx
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x20]
jl 0x1006b880
cmp dword [ebp - 0x14], 4
mov edx, eax
jne 0x1006bcfd
cmp dword [ebp - 0x50], 0
jne 0x1006bcfd
mov eax, dword [esi]
mov edx, dword [ebp - 8]
imul eax, ecx
lea eax, [eax*4 - 1]
test eax, eax
js 0x1006bcfd
mov byte [ebx + eax], 0xff
sub eax, 4
jns 0x1006bcf1
mov edx, dword [esi + 4]
cmp dword [ebp - 0x68], 0
jle 0x1006bd70
xor edi, edi
mov dword [ebp - 0x44], edi
test edx, 0xfffffffe
jle 0x1006bd70
mov ecx, dword [esi]
sub edx, edi
mov eax, dword [ebp - 0x14]
dec edx
imul eax, ecx
imul eax, edi
xor edi, edi
add eax, ebx
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x14]
imul edx, eax
imul eax, ecx
imul edx, ecx
add edx, ebx
test eax, eax
jle 0x1006bd5e
mov ebx, dword [ebp - 0x68]
sub ebx, edx
nop dword [eax]
mov al, byte [edx]
lea edx, [edx + 1]
mov cl, byte [ebx + edx - 1]
inc edi
mov byte [ebx + edx - 1], al
mov byte [edx - 1], cl
mov eax, dword [esi]
imul eax, dword [ebp - 0x14]
cmp edi, eax
jl 0x1006bd40
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x44]
mov edx, dword [esi + 4]
inc edi
mov eax, edx
mov dword [ebp - 0x44], edi
sar eax, 1
cmp edi, eax
jl 0x1006bd10
mov ecx, dword [ebp - 0x98]
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 4]
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x1006bd8e
mov eax, dword [esi + 8]
mov dword [ecx], eax
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [0x10099d0c]
add esp, 4
mov eax, dword fs:[0x2c]
pop edi
mov eax, dword [eax + ecx*4]
pop ebx
pop esi
mov dword [eax + 0xc], str.bad_masks
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x10099d0c]
mov eax, dword fs:[0x2c]
pop edi
pop ebx
pop esi
mov eax, dword [eax + ecx*4]
mov dword [eax + 0xc], str.outofmem
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x10099d0c]
mov eax, dword fs:[0x2c]
pop edi
pop ebx
pop esi
mov eax, dword [eax + ecx*4]
mov dword [eax + 0xc], str.too_large
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x10099d0c]
mov eax, dword fs:[0x2c]
pop edi
pop ebx
pop esi
mov eax, dword [eax + ecx*4]
mov dword [eax + 0xc], str.bad_offset
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x10099d0c]
mov eax, dword fs:[0x2c]
pop edi
pop ebx
pop esi
mov eax, dword [eax + ecx*4]
mov dword [eax + 0xc], str.bad_header
xor eax, eax
mov esp, ebp
pop ebp
ret