Function at 0x41cc81
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x443340]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, 0x400000
mov dword [ebp - 0x9c], eax
mov ebx, 0xfffffff
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
cmp edi, esi
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x90], edi
jb 0x41cb73
mov eax, dword [0x40003c]
mov eax, dword [eax + 0x400050]
add eax, esi
cmp edi, eax
jae 0x41973d
mov ecx, dword [0x4091ac]
and dword [ebp - 0x5c], 0
sub edi, esi
dec ecx
js 0x419121
mov eax, dword [ebp - 0x5c]
add eax, ecx
cdq
sub eax, edx
sar eax, 1
lea edx, [eax*8 + 0x4359d8]
mov dword [ebp - 0x60], edx
mov edx, dword [edx + 4]
and edx, ebx
cmp edi, edx
jae 0x419112
lea ecx, [eax - 1]
jmp 0x41911c
jbe 0x41920f
inc eax
mov dword [ebp - 0x5c], eax
cmp ecx, dword [ebp - 0x5c]
jge 0x4190f0
xor eax, eax
test eax, eax
je 0x419737
mov edi, dword [eax]
mov ecx, dword [eax + 4]
and ecx, 7
lea ecx, [ecx + eax + 8]
and edi, ebx
lea eax, [edi + ecx]
mov dword [ebp - 0x8c], eax
mov eax, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
mov dword [ebp - 0x6c], ecx
sub eax, edi
sub dword [ebp - 0x6c], esi
mov dword [ebp - 0x90], ecx
lea ecx, [eax + 1]
mov edx, ecx
xor eax, eax
mov dword [ebp - 0x80], edi
test ecx, ecx
je 0x41918a
mov esi, dword [reloc.KERNEL32.dll_GetLastError]
imul esi, esi, 0x343fd
add esi, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], esi
shr esi, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, esi
test edx, edx
jne 0x419163
xor edx, edx
div ecx
mov eax, dword [ebp - 0x68]
add edx, eax
push edx
push edi
push dword [ebp - 0x6c]
mov dword [ebp - 0x94], edx
mov eax, 0x2f1fbc3c
mov esi, dword [ebp - 0x90]
mov eax, dword [ebp - 0x8c]
mov ebx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x64], eax
mov eax, edi
add esp, 0xc
mov byte [ebp - 0x55], 0
mov dword [ebp - 0x34], ebx
and eax, 7
mov dword [ebp - 0x5c], eax
je 0x4193a4
xor ecx, ecx
cmp eax, ecx
mov edi, dword [ebp - 0x6c]
mov dword [ebp - 0x74], ecx
not edi
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x68], ecx
jle 0x41923d
mov dword [ebp - 0x88], reloc.KERNEL32.dll_GetProcAddress
movzx edx, byte [esi]
mov ecx, dword [ebp - 0x88]
cmp dword [ebp - 0x68], 4
jge 0x419228
add ecx, 0xffffffe0
shl edx, cl
or dword [ebp - 0x7c], edx
jmp 0x41922d
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
and ecx, ebx
and eax, 0x3f
lea eax, [ecx + eax + 0x400000]
jmp 0x419123
shl edx, cl
or dword [ebp - 0x74], edx
sub dword [ebp - 0x88], 8
inc esi
inc dword [ebp - 0x68]
cmp dword [ebp - 0x68], eax
jl 0x4191f6
mov eax, dword [ebp - 0x6c]
movzx ecx, word [ebp - 0x32]
movzx edx, word [ebp - 0x2e]
sub eax, ebx
sub eax, edx
xor edi, eax
mov eax, dword [ebp - 0x30]
xor eax, ebx
mov ebx, edx
xor eax, edi
xor eax, dword [ebp - 0x6c]
xor ebx, eax
imul ebx, ecx
mov ecx, eax
shr ecx, 5
add ebx, ecx
xor edi, ebx
movzx ebx, word [ebp - 0x34]
mov ecx, edi
sub ecx, edx
rol ecx, 5
imul ecx, ebx
mov ebx, edi
shr ebx, 1
xor ecx, ebx
xor eax, ecx
mov ecx, dword [ebp - 0x34]
xor ecx, eax
rol ecx, 4
imul ecx, edx
mov edx, eax
shr edx, 5
sub ecx, edx
movzx edx, word [ebp - 0x30]
xor edi, ecx
mov ecx, dword [ebp - 0x34]
mov ebx, edi
xor ecx, edi
rol ecx, 2
imul ecx, edx
movzx edx, word [ebp - 0x32]
ror ebx, 0x10
add ebx, ecx
xor eax, ebx
mov ebx, eax
mov ecx, eax
sub ecx, dword [ebp - 0x30]
rol ecx, 8
imul ecx, edx
rol ebx, 3
add ebx, ecx
xor edi, ebx
movzx ecx, word [ebp - 0x34]
mov ebx, edi
ror ebx, 0xe
sub ebx, ecx
mov ecx, dword [ebp - 0x34]
imul ebx, edx
movzx edx, word [ebp - 0x2e]
xor eax, ebx
mov ebx, eax
add ecx, eax
ror ecx, 9
imul ecx, edx
movzx edx, word [ebp - 0x30]
rol ebx, 9
add ebx, ecx
movzx ecx, word [ebp - 0x34]
xor edi, ebx
mov ebx, edi
xor ecx, edi
rol ecx, 6
imul ecx, edx
rol ebx, 7
add ebx, ecx
movzx edx, word [ebp - 0x32]
xor eax, ebx
mov ecx, eax
mov ebx, eax
sub ecx, dword [ebp - 0x30]
ror ecx, 0xd
rol ebx, 0xc
imul ecx, edx
sub ecx, ebx
xor edi, ecx
movzx ecx, word [ebp - 0x2e]
mov edx, edi
mov ebx, dword [ebp - 0x34]
and dword [ebp - 0x68], 0
sub edx, ecx
movzx ecx, bx
imul edx, ecx
mov ecx, edi
xor edi, dword [ebp - 0x74]
shr ecx, 7
sub edx, ecx
xor edx, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x5c]
xor eax, edx
test ecx, ecx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x78], edi
jle 0x41937a
mov edx, dword [ebp - 0x64]
inc dword [ebp - 0x64]
cmp dword [ebp - 0x68], 4
jge 0x419363
rol dword [ebp - 0x70], 8
mov cl, byte [ebp - 0x70]
mov byte [edx], cl
jmp 0x41936c
rol dword [ebp - 0x78], 8
mov cl, byte [ebp - 0x78]
mov byte [edx], cl
xor byte [ebp - 0x55], cl
inc dword [ebp - 0x68]
mov ecx, dword [ebp - 0x5c]
cmp dword [ebp - 0x68], ecx
jl 0x41934c
add ecx, 0xfffffffc
test ecx, ecx
jle 0x419393
push 4
pop edx
sub edx, ecx
shl edx, 3
mov ecx, edx
shr edi, cl
shl edi, cl
mov edx, edi
jmp 0x4193b3
xor edx, edx
test ecx, ecx
jge 0x4193b3
neg ecx
shl ecx, 3
shr eax, cl
shl eax, cl
jmp 0x4193b3
xor edx, edx
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x7c], eax
not eax
mov dword [ebp - 0x74], eax
xor eax, eax
mov edi, dword [ebp - 0x80]
shr edi, 3
test edi, edi
jbe 0x4195a7
mov ecx, dword [ebp - 0x30]
xor ecx, ebx
mov dword [ebp - 0x60], ecx
movzx ecx, word [ebp - 0x2e]
mov dword [ebp - 0x5c], ecx
neg dword [ebp - 0x5c]
mov dword [ebp - 0x88], ecx
movzx ecx, word [ebp - 0x32]
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x84], edi
movzx ebx, byte [esi + 5]
movzx ecx, byte [esi]
shl ecx, 8
movzx edi, byte [esi + 1]
or ecx, edi
shl ecx, 8
movzx edi, byte [esi + 2]
or ecx, edi
shl ecx, 8
movzx edi, byte [esi + 3]
or ecx, edi
movzx edi, byte [esi + 4]
xor eax, ecx
shl edi, 8
or edi, ebx
movzx ebx, byte [esi + 6]
shl edi, 8
mov dword [ebp - 0x70], ecx
or edi, ebx
mov ecx, eax
movzx ebx, byte [esi + 7]
shl edi, 8
or edi, ebx
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x78], edi
sub ecx, dword [ebp - 0x88]
add esi, 8
xor ecx, edi
xor edx, ecx
mov ecx, dword [ebp - 0x60]
xor ecx, edx
xor eax, ecx
mov edi, eax
mov ecx, dword [ebp - 0x88]
xor ecx, eax
imul ecx, dword [ebp - 0x98]
shr edi, 5
add ecx, edi
xor edx, ecx
movzx edi, word [ebp - 0x34]
mov ecx, dword [ebp - 0x5c]
add ecx, edx
rol ecx, 5
imul ecx, edi
mov edi, edx
shr edi, 1
xor ecx, edi
xor eax, ecx
mov ecx, dword [ebp - 0x34]
xor ecx, eax
rol ecx, 4
imul ecx, dword [ebp - 0x88]
mov edi, eax
shr edi, 5
sub ecx, edi
movzx edi, word [ebp - 0x30]
xor edx, ecx
mov ebx, edx
mov ecx, dword [ebp - 0x34]
xor ecx, edx
rol ecx, 2
imul ecx, edi
ror ebx, 0x10
add ebx, ecx
xor eax, ebx
mov edi, eax
mov ebx, dword [ebp - 0x98]
mov ecx, eax
sub ecx, dword [ebp - 0x30]
rol ecx, 8
imul ebx, ecx
rol edi, 3
add edi, ebx
xor edx, edi
mov ebx, edx
ror ebx, 0xe
mov edi, dword [ebp - 0x34]
movzx ecx, di
sub ebx, ecx
imul ebx, dword [ebp - 0x98]
xor eax, ebx
mov ebx, dword [ebp - 0x88]
lea ecx, [eax + edi]
mov edi, eax
ror ecx, 9
imul ebx, ecx
movzx ecx, word [ebp - 0x34]
rol edi, 9
add edi, ebx
xor edx, edi
mov ebx, edx
movzx edi, word [ebp - 0x30]
xor ecx, edx
rol ecx, 6
imul edi, ecx
rol ebx, 7
add ebx, edi
xor eax, ebx
mov edi, eax
mov ebx, dword [ebp - 0x98]
mov ecx, eax
sub ecx, dword [ebp - 0x30]
ror ecx, 0xd
imul ebx, ecx
rol edi, 0xc
movzx ecx, word [ebp - 0x34]
sub ebx, edi
xor edx, ebx
mov edi, edx
sub edi, dword [ebp - 0x88]
imul edi, ecx
mov ecx, edx
xor edx, dword [ebp - 0x74]
shr ecx, 7
sub edi, ecx
xor edi, dword [ebp - 0x7c]
mov cl, byte [ebp - 0x55]
xor eax, edi
mov edi, dword [ebp - 0x64]
mov byte [edi + 3], al
xor cl, al
mov byte [edi + 7], dl
xor cl, dl
ror eax, 8
mov byte [edi + 2], al
xor cl, al
ror edx, 8
mov byte [edi + 6], dl
xor cl, dl
ror eax, 8
mov byte [edi + 1], al
xor cl, al
ror edx, 8
xor cl, dl
mov byte [edi + 5], dl
ror eax, 8
ror edx, 8
mov bl, dl
xor bl, al
xor cl, bl
mov byte [ebp - 0x55], cl
mov ecx, dword [ebp - 0x70]
mov byte [edi], al
mov byte [edi + 4], dl
mov dword [ebp - 0x7c], ecx
add edi, 8
mov ecx, dword [ebp - 0x78]
dec dword [ebp - 0x84]
mov dword [ebp - 0x74], ecx
ror eax, 8
ror edx, 8
mov dword [ebp - 0x64], edi
jne 0x4193e9
mov cl, byte [ebp - 0x55]
mov eax, dword [ebp - 0x8c]
cmp cl, byte [eax + 8]
je 0x419649
call fcn.00405ddc
mov ecx, eax
mov esi, 0x427ab0
mov eax, 0xfffff000
and ecx, eax
mov dword [ebp - 0x60], ecx
mov ecx, dword [ebp - 0x9c]
mov dword [ecx + 8], esi
lea edi, [ecx + 0xc]
and edi, 0xfffffffc
lea ebx, [edi + 0xfff]
mov ecx, 0xffff
mov dword [ebp - 0x5c], ecx
and ebx, eax
xor eax, eax
mov edx, dword [reloc.KERNEL32.dll_GetLastError]
shr dword [ebp - 0x5c], 0x10
imul edx, edx, 0x343fd
add edx, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], edx
shr edx, 0x10
shl eax, 0x10
or eax, edx
cmp dword [ebp - 0x5c], 0
jne 0x4195f0
xor edx, edx
div ecx
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x60]
inc edx
mov dword [eax], edx
mov dword [eax + 0x1c], ecx
mov dword [ebp - 0x60], 0
jmp 0x41963e
mov eax, dword [ebp - 0x60]
mov dword [edi], eax
add edi, 4
cmp edi, ebx
jb 0x419636
mov eax, esi
jmp 0x41d263
mov edx, dword [0x421858]
mov eax, dword [ebp - 0x90]
mov ecx, 0x400000
sub eax, dword [ebp - 0x94]
sub ecx, edx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x8c], ecx
jne 0x419675
test eax, eax
je 0x419722
mov esi, dword [ebp - 0x94]
sub esi, dword [ebp - 0x90]
mov ebx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x80]
add eax, ebx
xor edi, edi
mov ecx, dword [0x4177a0]
mov dword [ebp - 0x60], eax
dec ecx
js 0x4196be
lea eax, [edi + ecx]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x4177a4]
and edx, 0xfffffff
cmp ebx, edx
jae 0x4196b5
lea ecx, [eax - 1]
jmp 0x4196ba
jbe 0x4196c2
lea edi, [eax + 1]
cmp ecx, edi
jge 0x419697
mov ebx, edi
jmp 0x41971a
mov ebx, eax
jmp 0x41971a
mov eax, dword [ebx*4 + 0x4177a4]
mov ecx, eax
and ecx, 0xfffffff
cmp ecx, dword [ebp - 0x60]
jae 0x419722
lea edi, [ecx + esi + 0x400000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x41970a
dec ecx
je 0x419705
dec ecx
jne 0x419713
mov edx, dword [ebp - 0x8c]
jmp 0x419713
mov edx, dword [ebp - 0x5c]
jmp 0x419713
mov edx, dword [ebp - 0x8c]
sub edx, dword [ebp - 0x5c]
dec eax
dec eax
jne 0x419719
add dword [edi], edx
inc ebx
cmp ebx, dword [0x4177a0]
jb 0x4196c6
mov eax, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
mov eax, 0xa82d0fc7
mov eax, dword [ebp - 0x94]
jmp 0x41d263
mov edi, dword [ebp - 0x90]
cmp edi, esi
jb 0x41cb73
mov eax, dword [0x40003c]
mov eax, dword [eax + 0x400050]
add eax, esi
cmp edi, eax
jae 0x419da7
mov ecx, dword [0x401390]
and dword [ebp - 0x5c], 0
sub edi, esi
dec ecx
js 0x41979a
mov eax, dword [ebp - 0x5c]
add eax, ecx
cdq
sub eax, edx
sar eax, 1
lea edx, [eax*8 + 0x40c518]
mov dword [ebp - 0x60], edx
mov edx, dword [edx + 4]
and edx, ebx
cmp edi, edx
jae 0x41978b
lea ecx, [eax - 1]
jmp 0x419795
jbe 0x419880
inc eax
mov dword [ebp - 0x5c], eax
cmp ecx, dword [ebp - 0x5c]
jge 0x419769
xor ecx, ecx
test ecx, ecx
je 0x419da1
mov eax, dword [ecx]
mov edx, eax
shr edx, 1
and edx, 7
shr eax, 4
lea ecx, [edx + ecx + 8]
mov edx, eax
mov eax, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
sub eax, edx
mov dword [ebp - 0x6c], ecx
lea ebx, [ecx + edx]
sub dword [ebp - 0x6c], esi
mov dword [ebp - 0x90], ecx
lea ecx, [eax + 1]
mov dword [ebp - 0x88], edx
xor eax, eax
mov dword [ebp - 0x98], ebx
mov edx, ecx
test ecx, ecx
je 0x41980a
mov esi, dword [reloc.KERNEL32.dll_GetLastError]
imul esi, esi, 0x343fd
add esi, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], esi
shr esi, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, esi
test edx, edx
jne 0x4197e3
xor edx, edx
div ecx
mov eax, dword [ebp - 0x68]
lea edi, [eax + edx]
push edi
push dword [ebp - 0x88]
mov dword [ebp - 0x84], edi
push dword [ebp - 0x6c]
mov eax, 0x9fe53430
mov esi, dword [ebp - 0x90]
mov eax, dword [ebx]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov byte [ebp - 0x55], 0
mov dword [ebp - 0x64], edi
and eax, 7
mov dword [ebp - 0x80], eax
je 0x419a30
mov edi, dword [ebp - 0x6c]
not edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x68], ecx
cmp eax, ecx
jle 0x4198ae
push reloc.KERNEL32.dll_GetProcAddress
pop edx
movzx ebx, byte [esi]
cmp dword [ebp - 0x68], 4
jge 0x41989b
lea ecx, [edx - 0x20]
shl ebx, cl
or dword [ebp - 0x7c], ebx
jmp 0x4198a2
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
shr ecx, 1
and ecx, 0x3f
mov eax, dword [eax + 4]
and eax, ebx
lea ecx, [ecx + eax + 0x400000]
jmp 0x41979c
mov ecx, edx
shl ebx, cl
or dword [ebp - 0x70], ebx
inc esi
inc dword [ebp - 0x68]
sub edx, 8
cmp dword [ebp - 0x68], eax
jl 0x41986d
movzx edx, word [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
xor eax, dword [ebp - 0x6c]
sub ecx, eax
xor edi, ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, edi
mov dword [ebp - 0x60], edx
rol ecx, 0xd
mov eax, edi
imul edx, ecx
movzx ecx, word [ebp - 0x2c]
ror eax, 0xb
mov dword [ebp - 0x94], ecx
add eax, edx
movzx edx, word [ebp - 0x2a]
xor eax, dword [ebp - 0x6c]
mov ebx, eax
xor ecx, eax
imul ecx, edx
ror ebx, 0xa
add ebx, ecx
xor edi, ebx
mov ecx, edi
mov ebx, dword [ebp - 0x94]
mov dword [ebp - 0x74], edx
sub ecx, dword [ebp - 0x28]
mov edx, edi
rol ecx, 0xd
imul ebx, ecx
rol edx, 7
xor edx, ebx
xor eax, edx
movzx edx, word [ebp - 0x26]
mov ebx, eax
mov ecx, eax
sub ecx, dword [ebp - 0x2c]
rol ecx, 4
imul edx, ecx
mov ecx, dword [ebp - 0x2c]
rol ebx, 0xc
sub edx, ebx
xor edi, edx
xor ecx, edi
ror ecx, 0xc
mov edx, dword [ebp - 0x60]
imul edx, ecx
mov ebx, edi
ror ebx, 1
sub edx, ebx
mov ebx, dword [ebp - 0x94]
xor eax, edx
mov ecx, eax
sub ecx, dword [ebp - 0x94]
imul ecx, dword [ebp - 0x74]
mov edx, eax
shr edx, 4
sub ecx, edx
xor edi, ecx
mov edx, edi
mov ecx, dword [ebp - 0x28]
xor ecx, edi
rol ecx, 0xa
imul ebx, ecx
mov ecx, dword [ebp - 0x2c]
ror edx, 9
xor edx, ebx
xor eax, edx
sub ecx, eax
rol ecx, 0xf
movzx edx, word [ebp - 0x26]
imul edx, ecx
mov ebx, eax
mov ecx, dword [ebp - 0x2c]
xor ecx, dword [ebp - 0x28]
ror ebx, 0xc
sub edx, ebx
xor edi, edx
movzx edx, word [ebp - 0x26]
xor ecx, edi
xor eax, ecx
mov ecx, dword [ebp - 0x74]
mov ebx, eax
not ebx
ror ebx, 4
add ebx, ecx
imul ebx, edx
and dword [ebp - 0x68], 0
xor edi, ebx
mov ebx, edi
xor ecx, edi
rol ecx, 4
mov edx, ecx
mov ecx, dword [ebp - 0x94]
imul ecx, edx
xor edi, dword [ebp - 0x70]
rol ebx, 5
sub ecx, ebx
xor ecx, dword [ebp - 0x7c]
mov ebx, dword [ebp - 0x80]
xor eax, ecx
mov dword [ebp - 0x78], eax
test ebx, ebx
mov ecx, edi
jle 0x419a06
cmp dword [ebp - 0x68], 4
jge 0x4199ed
rol dword [ebp - 0x78], 8
mov dl, byte [ebp - 0x78]
mov ebx, dword [ebp - 0x64]
inc dword [ebp - 0x64]
xor byte [ebp - 0x55], dl
mov byte [ebx], dl
jmp 0x4199fb
mov edx, dword [ebp - 0x64]
inc dword [ebp - 0x64]
rol ecx, 8
xor byte [ebp - 0x55], cl
mov byte [edx], cl
inc dword [ebp - 0x68]
mov ebx, dword [ebp - 0x80]
cmp dword [ebp - 0x68], ebx
jl 0x4199d3
add ebx, 0xfffffffc
test ebx, ebx
jle 0x419a1d
push 4
pop ecx
sub ecx, ebx
shl ecx, 3
shr edi, cl
shl edi, cl
mov edx, edi
jmp 0x419a3f
xor edx, edx
test ebx, ebx
jge 0x419a3f
neg ebx
shl ebx, 3
mov ecx, ebx
shr eax, cl
shl eax, cl
jmp 0x419a3f
xor edx, edx
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x7c], eax
not eax
mov dword [ebp - 0x70], eax
xor eax, eax
mov ecx, dword [ebp - 0x88]
shr ecx, 3
test ecx, ecx
jbe 0x419c10
mov edi, dword [ebp - 0x2c]
xor edi, dword [ebp - 0x28]
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x60], edi
movzx edi, word [ebp - 0x26]
mov dword [ebp - 0x5c], edi
movzx edi, word [ebp - 0x2a]
mov dword [ebp - 0x74], edi
movzx ebx, byte [esi + 5]
movzx edi, byte [esi + 1]
movzx ecx, byte [esi]
shl ecx, 8
or ecx, edi
movzx edi, byte [esi + 2]
shl ecx, 8
or ecx, edi
movzx edi, byte [esi + 3]
shl ecx, 8
or ecx, edi
movzx edi, byte [esi + 4]
shl edi, 8
or edi, ebx
xor eax, ecx
movzx ebx, byte [esi + 6]
shl edi, 8
or edi, ebx
shl edi, 8
movzx ebx, byte [esi + 7]
or edi, ebx
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x78], ecx
mov ecx, dword [ebp - 0x28]
xor ecx, eax
sub ebx, ecx
xor ebx, edi
xor edx, ebx
mov ecx, dword [ebp - 0x2c]
mov ebx, edx
xor ecx, edx
add esi, 8
rol ecx, 0xd
mov dword [ebp - 0x8c], edi
movzx edi, word [ebp - 0x28]
imul edi, ecx
movzx ecx, word [ebp - 0x2c]
ror ebx, 0xb
add ebx, edi
xor eax, ebx
mov edi, eax
xor ecx, eax
imul ecx, dword [ebp - 0x74]
ror edi, 0xa
add edi, ecx
xor edx, edi
movzx edi, word [ebp - 0x2c]
mov ecx, edx
sub ecx, dword [ebp - 0x28]
rol ecx, 0xd
mov ebx, edx
imul edi, ecx
rol ebx, 7
xor ebx, edi
xor eax, ebx
mov ecx, eax
mov edi, eax
mov ebx, dword [ebp - 0x5c]
sub ecx, dword [ebp - 0x2c]
rol ecx, 4
imul ebx, ecx
rol edi, 0xc
sub ebx, edi
mov ecx, dword [ebp - 0x2c]
movzx edi, word [ebp - 0x28]
xor edx, ebx
xor ecx, edx
ror ecx, 0xc
imul edi, ecx
mov ebx, edx
ror ebx, 1
sub edi, ebx
xor eax, edi
mov ecx, eax
movzx edi, word [ebp - 0x2c]
sub ecx, edi
imul ecx, dword [ebp - 0x74]
mov ebx, eax
shr ebx, 4
sub ecx, ebx
xor edx, ecx
mov ecx, dword [ebp - 0x28]
xor ecx, edx
rol ecx, 0xa
mov ebx, edx
imul edi, ecx
ror ebx, 9
xor ebx, edi
xor eax, ebx
mov ecx, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x5c]
mov edi, eax
sub ecx, eax
rol ecx, 0xf
imul ebx, ecx
mov ecx, dword [ebp - 0x60]
ror edi, 0xc
sub ebx, edi
xor edx, ebx
xor ecx, edx
xor eax, ecx
mov edi, eax
not edi
mov ecx, dword [ebp - 0x74]
ror edi, 4
add edi, ecx
imul edi, dword [ebp - 0x5c]
xor edx, edi
movzx edi, word [ebp - 0x2c]
mov ebx, edx
xor ecx, edx
rol ecx, 4
imul edi, ecx
xor edx, dword [ebp - 0x70]
mov cl, byte [ebp - 0x55]
rol ebx, 5
sub edi, ebx
xor edi, dword [ebp - 0x7c]
xor eax, edi
mov edi, dword [ebp - 0x64]
xor cl, al
mov byte [edi + 3], al
xor cl, dl
ror eax, 8
xor cl, al
mov byte [edi + 7], dl
ror edx, 8
xor cl, dl
mov byte [edi + 2], al
ror eax, 8
xor cl, al
mov byte [edi + 6], dl
ror edx, 8
xor cl, dl
mov byte [edi + 1], al
ror eax, 8
mov byte [edi + 5], dl
ror edx, 8
mov bl, dl
xor bl, al
xor cl, bl
mov byte [ebp - 0x55], cl
mov ecx, dword [ebp - 0x78]
mov byte [edi], al
mov byte [edi + 4], dl
add edi, 8
mov dword [ebp - 0x7c], ecx
mov ecx, dword [ebp - 0x8c]
dec dword [ebp - 0x80]
ror eax, 8
ror edx, 8
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x64], edi
jne 0x419a6a
mov ecx, dword [ebp - 0x98]
mov al, byte [ebp - 0x55]
cmp al, byte [ecx + 8]
je 0x419cb0
call fcn.00405ddc
mov esi, 0x427ab0
mov ecx, eax
mov eax, 0xfffff000
and ecx, eax
mov dword [ebp - 0x60], ecx
mov ecx, dword [ebp - 0x9c]
mov dword [ecx + 8], esi
lea edi, [ecx + 0xc]
and edi, 0xfffffffc
lea ebx, [edi + 0xfff]
and ebx, eax
mov ecx, 0xffff
xor eax, eax
mov dword [ebp - 0x5c], ecx
mov edx, dword [reloc.KERNEL32.dll_GetLastError]
shr dword [ebp - 0x5c], 0x10
imul edx, edx, 0x343fd
add edx, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], edx
shr edx, 0x10
shl eax, 0x10
or eax, edx
cmp dword [ebp - 0x5c], 0
jne 0x419c59
xor edx, edx
div ecx
inc edx
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x60]
mov dword [eax], edx
mov dword [eax + 0x1c], ecx
mov dword [ebp - 0x60], 0
jmp 0x419ca7
mov eax, dword [ebp - 0x60]
mov dword [edi], eax
add edi, 4
cmp edi, ebx
jb 0x419c9f
jmp 0x419642
mov edx, dword [0x421858]
mov eax, dword [ebp - 0x90]
mov ecx, 0x400000
sub eax, dword [ebp - 0x84]
mov dword [ebp - 0x8c], eax
sub ecx, edx
mov dword [ebp - 0x80], ecx
jne 0x419cdc
test eax, eax
je 0x419d8c
mov ebx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x88]
mov ecx, dword [0x4177a0]
mov esi, dword [ebp - 0x84]
sub esi, dword [ebp - 0x90]
add eax, ebx
mov dword [ebp - 0x60], eax
xor edi, edi
dec ecx
js 0x419d28
lea eax, [edi + ecx]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x4177a4]
and edx, 0xfffffff
cmp ebx, edx
jae 0x419d1f
lea ecx, [eax - 1]
jmp 0x419d24
jbe 0x419d2c
lea edi, [eax + 1]
cmp ecx, edi
jge 0x419d01
mov ebx, edi
jmp 0x419d84
mov ebx, eax
jmp 0x419d84
mov eax, dword [ebx*4 + 0x4177a4]
mov ecx, eax
and ecx, 0xfffffff
cmp ecx, dword [ebp - 0x60]
jae 0x419d8c
lea edi, [ecx + esi + 0x400000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x419d74
dec ecx
je 0x419d6c
dec ecx
jne 0x419d7d
mov edx, dword [ebp - 0x80]
jmp 0x419d7d
mov edx, dword [ebp - 0x8c]
jmp 0x419d7d
mov edx, dword [ebp - 0x80]
sub edx, dword [ebp - 0x8c]
dec eax
dec eax
jne 0x419d83
add dword [edi], edx
inc ebx
cmp ebx, dword [0x4177a0]
jb 0x419d30
mov eax, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
mov eax, 0x5328bd28
mov eax, dword [ebp - 0x84]
jmp 0x41d263
mov edi, dword [ebp - 0x90]
cmp edi, esi
jb 0x41cb73
mov eax, dword [0x40003c]
mov eax, dword [eax + 0x400050]
add eax, esi
cmp edi, eax
jae 0x41a48e
mov ecx, dword [0x40a42c]
and dword [ebp - 0x5c], 0
sub edi, esi
dec ecx
js 0x419e06
mov eax, dword [ebp - 0x5c]
add eax, ecx
cdq
sub eax, edx
sar eax, 1
lea edx, [eax*8 + fcn.00413710]
mov dword [ebp - 0x60], edx
mov edx, dword [edx]
shr edx, 2
and edx, ebx
cmp edi, edx
jae 0x419df7
lea ecx, [eax - 1]
jmp 0x419e01
jbe 0x419efb
inc eax
mov dword [ebp - 0x5c], eax
cmp ecx, dword [ebp - 0x5c]
jge 0x419dd3
xor eax, eax
test eax, eax
je 0x41a488
mov ecx, dword [eax + 4]
and ecx, 7
lea ecx, [ecx + eax + 8]
mov eax, dword [eax]
shr eax, 1
and eax, ebx
lea edx, [ecx + eax]
mov dword [ebp - 0x6c], ecx
sub dword [ebp - 0x6c], esi
mov dword [ebp - 0x90], ecx
mov ecx, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
sub ecx, eax
inc ecx
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x60], edx
xor eax, eax
mov edx, ecx
test ecx, ecx
je 0x419e70
mov edi, dword [reloc.KERNEL32.dll_GetLastError]
imul edi, edi, 0x343fd
add edi, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], edi
shr edi, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, edi
test edx, edx
jne 0x419e49
xor edx, edx
div ecx
mov eax, dword [ebp - 0x68]
add eax, edx
push eax
push dword [ebp - 0x84]
mov dword [ebp - 0x5c], eax
push dword [ebp - 0x6c]
mov eax, 0xaab5e4ba
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov edi, dword [ebp - 0x90]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x84]
add esp, 0xc
and eax, 7
mov byte [ebp - 0x55], 0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x88], eax
je 0x41a10d
xor ecx, ecx
cmp eax, ecx
mov edx, dword [ebp - 0x6c]
not edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x64], ecx
jle 0x419f2c
mov dword [ebp - 0x94], reloc.KERNEL32.dll_GetProcAddress
movzx ebx, byte [edi]
mov ecx, dword [ebp - 0x94]
cmp dword [ebp - 0x64], 4
jge 0x419f17
add ecx, 0xffffffe0
shl ebx, cl
or dword [ebp - 0x74], ebx
jmp 0x419f1c
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
shr ecx, 2
and ecx, ebx
and eax, 0x3f
lea eax, [ecx + eax + 0x400000]
jmp 0x419e08
shl ebx, cl
or dword [ebp - 0x7c], ebx
sub dword [ebp - 0x94], 8
inc edi
inc dword [ebp - 0x64]
cmp dword [ebp - 0x64], eax
jl 0x419ee2
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0xc]
xor eax, edx
movzx edx, word [ebp - 8]
xor eax, dword [ebp - 0x6c]
mov ebx, eax
mov ecx, eax
xor ecx, edx
movzx edx, word [ebp - 6]
rol ecx, 1
imul ecx, edx
rol ebx, 2
xor ebx, ecx
xor dword [ebp - 0x68], ebx
mov edx, dword [ebp - 0x68]
mov ebx, dword [ebp - 0x68]
movzx ecx, word [ebp - 0xc]
xor ebx, ecx
movzx ecx, word [ebp - 8]
imul ebx, ecx
mov ecx, dword [ebp - 8]
ror edx, 0xa
sub ebx, edx
movzx edx, word [ebp - 0xa]
xor eax, ebx
mov ebx, eax
xor ecx, eax
rol ecx, 0xb
imul ecx, edx
movzx edx, word [ebp - 0xc]
rol ebx, 5
add ebx, ecx
xor dword [ebp - 0x68], ebx
mov ecx, dword [ebp - 0x68]
sub ecx, dword [ebp - 8]
sub ecx, edx
xor eax, ecx
mov ecx, eax
xor ecx, edx
mov ebx, eax
rol ecx, 7
movzx edx, word [ebp - 6]
imul ecx, edx
movzx edx, word [ebp - 8]
ror ebx, 0xf
add ebx, ecx
xor dword [ebp - 0x68], ebx
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x68]
mov ebx, dword [ebp - 0x68]
rol ecx, 8
imul ecx, edx
rol ebx, 0xa
movzx edx, word [ebp - 0xa]
sub ecx, ebx
xor eax, ecx
mov ebx, eax
mov ecx, dword [ebp - 8]
add ecx, eax
ror ecx, 2
imul ecx, edx
rol ebx, 2
sub ecx, ebx
xor dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x68]
movzx ecx, word [ebp - 0xc]
sub edx, ecx
movzx ecx, word [ebp - 8]
xor edx, dword [ebp - 8]
xor eax, edx
mov edx, eax
mov ebx, eax
xor edx, ecx
movzx ecx, word [ebp - 6]
imul edx, ecx
movzx ecx, word [ebp - 0xa]
ror ebx, 0xd
add ebx, edx
mov edx, dword [ebp - 0x68]
xor edx, ebx
mov ebx, edx
xor ebx, ecx
movzx ecx, word [ebp - 8]
imul ebx, ecx
mov ecx, edx
shr ecx, 6
xor ebx, ecx
xor eax, ebx
movzx ebx, word [ebp - 6]
mov ecx, eax
xor ecx, ebx
rol ecx, 5
movzx ebx, word [ebp - 0xa]
imul ecx, ebx
mov ebx, eax
shr ebx, 0xd
add ecx, ebx
and dword [ebp - 0x64], 0
xor edx, ecx
movzx ecx, word [ebp - 0xc]
mov ebx, edx
xor edx, dword [ebp - 0x7c]
ror ebx, 4
sub ebx, ecx
movzx ecx, word [ebp - 8]
imul ebx, ecx
mov ecx, dword [ebp - 0x88]
xor ebx, dword [ebp - 0x74]
xor eax, ebx
mov dword [ebp - 0x68], eax
test ecx, ecx
mov dword [ebp - 0x78], edx
jle 0x41a099
mov ebx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
cmp dword [ebp - 0x64], 4
jge 0x41a07f
rol dword [ebp - 0x68], 8
mov cl, byte [ebp - 0x68]
mov byte [ebx], cl
jmp 0x41a088
rol dword [ebp - 0x78], 8
mov cl, byte [ebp - 0x78]
mov byte [ebx], cl
xor byte [ebp - 0x55], cl
inc dword [ebp - 0x64]
mov ecx, dword [ebp - 0x88]
cmp dword [ebp - 0x64], ecx
jl 0x41a068
lea ebx, [ecx - 4]
test ebx, ebx
jle 0x41a0fa
push 4
pop ecx
sub ecx, ebx
shl ecx, 3
shr edx, cl
shl edx, cl
mov ebx, 0xfffffff
mov ecx, dword [ebp - 0x84]
shr ecx, 3
mov dword [ebp - 0x88], ecx
test ecx, ecx
jbe 0x41a2f7
mov ecx, dword [ebp - 8]
xor ecx, dword [ebp - 0xc]
mov dword [ebp - 0x64], ecx
movzx ecx, word [ebp - 6]
mov dword [ebp - 0x94], ecx
movzx ecx, word [ebp - 0xa]
mov dword [ebp - 0x98], ecx
movzx ecx, word [ebp - 8]
mov dword [ebp - 0x80], ecx
mov ecx, dword [ebp - 0x88]
mov dword [ebp - 0x8c], ecx
jmp 0x41a124
xor edx, edx
test ebx, ebx
jge 0x41a0ac
neg ebx
shl ebx, 3
mov ecx, ebx
shr eax, cl
shl eax, cl
jmp 0x41a0ac
xor edx, edx
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x74], eax
not eax
mov dword [ebp - 0x7c], eax
xor eax, eax
jmp 0x41a0b1
mov edi, dword [ebp - 0x88]
movzx ecx, byte [edi]
shl ecx, 8
movzx ebx, byte [edi + 1]
or ecx, ebx
movzx ebx, byte [edi + 2]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [edi + 3]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [edi + 5]
mov dword [ebp - 0x68], ecx
movzx ecx, byte [edi + 4]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [edi + 6]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [edi + 7]
shl ecx, 8
or ecx, ebx
mov dword [ebp - 0x78], ecx
xor edx, ecx
mov ecx, dword [ebp - 0x68]
xor ecx, edx
xor ecx, eax
xor ecx, dword [ebp - 0x64]
mov eax, ecx
add edi, 8
xor ecx, dword [ebp - 0x80]
mov dword [ebp - 0x88], edi
rol ecx, 1
mov edi, eax
imul ecx, dword [ebp - 0x94]
rol edi, 2
xor edi, ecx
movzx ecx, word [ebp - 0xc]
xor edx, edi
mov edi, edx
mov ebx, edx
xor ebx, ecx
movzx ecx, word [ebp - 8]
imul ebx, ecx
ror edi, 0xa
mov ecx, dword [ebp - 8]
sub ebx, edi
xor eax, ebx
mov edi, eax
xor ecx, eax
rol ecx, 0xb
imul ecx, dword [ebp - 0x98]
rol edi, 5
add edi, ecx
xor edx, edi
mov ecx, edx
sub ecx, dword [ebp - 8]
movzx edi, word [ebp - 0xc]
sub ecx, edi
xor eax, ecx
mov ecx, eax
xor ecx, edi
mov edi, eax
rol ecx, 7
imul ecx, dword [ebp - 0x94]
ror edi, 0xf
add edi, ecx
mov ecx, dword [ebp - 0xc]
xor edx, edi
mov ebx, edx
sub ecx, edx
rol ecx, 8
movzx edi, word [ebp - 8]
imul ecx, edi
rol ebx, 0xa
sub ecx, ebx
xor eax, ecx
mov ecx, dword [ebp - 8]
mov edi, eax
add ecx, eax
ror ecx, 2
rol edi, 2
imul ecx, dword [ebp - 0x98]
sub ecx, edi
xor edx, ecx
movzx ecx, word [ebp - 0xc]
mov edi, edx
sub edi, ecx
movzx ecx, word [ebp - 8]
xor edi, dword [ebp - 8]
xor eax, edi
mov ebx, eax
mov edi, eax
xor ebx, ecx
imul ebx, dword [ebp - 0x94]
ror edi, 0xd
add edi, ebx
xor edx, edi
mov ecx, edx
xor ecx, dword [ebp - 0x98]
mov ebx, edx
movzx edi, word [ebp - 8]
imul ecx, edi
shr ebx, 6
xor ecx, ebx
xor eax, ecx
mov ebx, eax
mov ecx, eax
xor ecx, dword [ebp - 0x94]
rol ecx, 5
imul ecx, dword [ebp - 0x98]
shr ebx, 0xd
add ecx, ebx
xor edx, ecx
movzx ecx, word [ebp - 0xc]
mov ebx, edx
xor edx, dword [ebp - 0x7c]
ror ebx, 4
sub ebx, ecx
mov cl, byte [ebp - 0x55]
imul ebx, edi
xor ebx, dword [ebp - 0x74]
mov dword [ebp - 0x80], edi
xor eax, ebx
mov edi, dword [ebp - 0x70]
mov byte [edi + 3], al
mov byte [edi + 7], dl
xor cl, al
xor cl, dl
ror eax, 8
xor cl, al
ror edx, 8
mov byte [edi + 2], al
xor cl, dl
ror eax, 8
mov byte [edi + 6], dl
mov byte [edi + 1], al
xor cl, al
ror edx, 8
ror eax, 8
xor cl, dl
mov byte [edi + 5], dl
ror edx, 8
mov bl, dl
xor bl, al
xor cl, bl
mov ebx, dword [ebp - 0x68]
mov byte [edi], al
mov byte [edi + 4], dl
mov dword [ebp - 0x74], ebx
add edi, 8
mov ebx, dword [ebp - 0x78]
dec dword [ebp - 0x8c]
ror eax, 8
mov byte [ebp - 0x55], cl
ror edx, 8
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x70], edi
jne 0x41a11e
mov ebx, 0xfffffff
jmp 0x41a2fa
mov cl, byte [ebp - 0x55]
mov eax, dword [ebp - 0x60]
cmp cl, byte [eax + 8]
je 0x41a39c
call fcn.00405ddc
mov esi, 0x427ab0
mov ecx, eax
mov eax, 0xfffff000
and ecx, eax
mov dword [ebp - 0x60], ecx
mov ecx, dword [ebp - 0x9c]
lea edi, [ecx + 0xc]
mov dword [ecx + 8], esi
and edi, 0xfffffffc
mov ecx, 0xffff
mov dword [ebp - 0x5c], ecx
lea ebx, [edi + 0xfff]
and ebx, eax
xor eax, eax
mov edx, dword [reloc.KERNEL32.dll_GetLastError]
shr dword [ebp - 0x5c], 0x10
imul edx, edx, 0x343fd
add edx, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], edx
shr edx, 0x10
shl eax, 0x10
or eax, edx
cmp dword [ebp - 0x5c], 0
jne 0x41a33d
xor edx, edx
div ecx
inc edx
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0xa0]
mov dword [eax], edx
mov dword [eax + 0x1c], ecx
cmp edi, ebx
mov dword [ebp - 0x60], 0
mov eax, edi
jae 0x419642
mov ecx, dword [ebp - 0x60]
mov dword [eax], ecx
add eax, 4
cmp eax, ebx
jb 0x41a38b
jmp 0x419642
mov eax, dword [ebp - 0x90]
sub eax, dword [ebp - 0x5c]
mov ecx, dword [0x421858]
sub esi, ecx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x80], esi
jne 0x41a3c0
test eax, eax
je 0x41a476
mov esi, dword [ebp - 0x5c]
mov ecx, dword [0x4177a0]
mov eax, dword [ebp - 0x84]
sub esi, dword [ebp - 0x90]
mov edi, dword [ebp - 0x6c]
add eax, edi
mov dword [ebp - 0x84], eax
xor eax, eax
mov dword [ebp - 0x60], eax
dec ecx
js 0x41a40e
add eax, ecx
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x4177a4]
and edx, ebx
cmp edi, edx
jae 0x41a404
lea ecx, [eax - 1]
mov eax, dword [ebp - 0x60]
jmp 0x41a40a
jbe 0x41a40e
inc eax
mov dword [ebp - 0x60], eax
cmp ecx, eax
jge 0x41a3e8
mov dword [ebp - 0x74], eax
jmp 0x41a46b
mov eax, dword [ebp - 0x74]
mov eax, dword [eax*4 + 0x4177a4]
mov ecx, eax
and ecx, ebx
cmp ecx, dword [ebp - 0x84]
jae 0x41a476
lea edi, [ecx + esi + 0x400000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x41a459
dec ecx
je 0x41a451
dec ecx
jne 0x41a462
mov edx, dword [ebp - 0x80]
jmp 0x41a462
mov edx, dword [ebp - 0x8c]
jmp 0x41a462
mov edx, dword [ebp - 0x80]
sub edx, dword [ebp - 0x8c]
dec eax
dec eax
jne 0x41a468
add dword [edi], edx
inc dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
cmp eax, dword [0x4177a0]
jb 0x41a413
mov eax, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
mov eax, 0x4dcd248f
mov eax, dword [ebp - 0x5c]
jmp 0x41d263
mov edi, dword [ebp - 0x90]
cmp edi, esi
jb 0x41cb73
mov eax, dword [0x40003c]
mov eax, dword [eax + 0x400050]
add eax, esi
cmp edi, eax
jae 0x41aaf9
mov ecx, dword [0x41e5d8]
and dword [ebp - 0x5c], 0
sub edi, esi
dec ecx
js 0x41a4ed
mov eax, dword [ebp - 0x5c]
add eax, ecx
cdq
sub eax, edx
sar eax, 1
lea edx, [eax*8 + fcn.00430288]
mov dword [ebp - 0x60], edx
mov edx, dword [edx]
shr edx, 2
and edx, ebx
cmp edi, edx
jae 0x41a4de
lea ecx, [eax - 1]
jmp 0x41a4e8
jbe 0x41a5cf
inc eax
mov dword [ebp - 0x5c], eax
cmp ecx, dword [ebp - 0x5c]
jge 0x41a4ba
xor eax, eax
test eax, eax
je 0x41aaf3
mov ecx, dword [eax + 4]
mov edi, dword [eax]
and ecx, 7
lea ecx, [ecx + eax + 8]
shr edi, 1
and edi, ebx
lea eax, [edi + ecx]
mov dword [ebp - 0x80], eax
mov eax, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
sub eax, edi
mov dword [ebp - 0x6c], ecx
sub dword [ebp - 0x6c], esi
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x8c], edi
lea ecx, [eax + 1]
mov edx, ecx
xor eax, eax
test ecx, ecx
je 0x41a558
mov esi, dword [reloc.KERNEL32.dll_GetLastError]
imul esi, esi, 0x343fd
add esi, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], esi
shr esi, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, esi
test edx, edx
jne 0x41a531
xor edx, edx
div ecx
mov eax, dword [ebp - 0x68]
lea ebx, [edx + eax]
push ebx
push edi
push dword [ebp - 0x6c]
mov dword [ebp - 0x94], ebx
mov eax, 0xca3668da
mov esi, dword [ebp - 0x90]
mov eax, dword [ebp - 0x80]
mov edx, dword [eax + 4]
mov ecx, dword [eax]
add esp, 0xc
mov eax, edi
and eax, 7
mov byte [ebp - 0x55], 0
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x60], eax
je 0x41a77e
mov edi, dword [ebp - 0x6c]
xor ecx, ecx
not edi
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x64], ecx
cmp eax, ecx
jle 0x41a5fd
mov dword [ebp - 0x5c], reloc.KERNEL32.dll_GetProcAddress
mov ecx, dword [ebp - 0x5c]
cmp dword [ebp - 0x64], 4
movzx ebx, byte [esi]
jge 0x41a5eb
add ecx, 0xffffffe0
shl ebx, cl
or dword [ebp - 0x78], ebx
jmp 0x41a5f0
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
shr ecx, 2
and ecx, ebx
and eax, 0x3f
lea eax, [ecx + eax + 0x400000]
jmp 0x41a4ef
shl ebx, cl
or dword [ebp - 0x7c], ebx
sub dword [ebp - 0x5c], 8
inc esi
inc dword [ebp - 0x64]
cmp dword [ebp - 0x64], eax
jl 0x41a5b9
mov eax, edx
xor eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x3c]
sub ecx, eax
movzx eax, dx
xor edi, ecx
mov ebx, edi
movzx ecx, word [ebp - 0x36]
mov dword [ebp - 0x5c], eax
xor ecx, edi
rol ecx, 1
imul eax, ecx
ror ebx, 8
sub eax, ebx
movzx ecx, word [ebp - 0x3a]
mov dword [ebp - 0x64], ecx
xor eax, dword [ebp - 0x6c]
mov ebx, eax
sub ebx, ecx
mov ecx, edx
xor ebx, edx
movzx edx, word [ebp - 0x3c]
mov dword [ebp - 0x84], edx
xor edi, ebx
sub ecx, edi
ror ecx, 5
mov ebx, edi
imul edx, ecx
rol ebx, 0xe
mov ecx, dword [ebp - 0x3c]
add ebx, edx
xor eax, ebx
mov ebx, eax
movzx edx, word [ebp - 0x36]
sub ecx, eax
ror ecx, 3
imul edx, ecx
ror ebx, 0xa
xor ebx, edx
mov edx, dword [ebp - 0x5c]
xor edi, ebx
mov ebx, dword [ebp - 0x64]
mov ecx, edi
sub ecx, dword [ebp - 0x64]
rol ecx, 2
imul edx, ecx
mov ecx, edi
shr ecx, 4
xor edx, ecx
mov ecx, dword [ebp - 0x38]
xor eax, edx
mov edx, eax
sub ecx, eax
rol ecx, 0xd
imul ebx, ecx
rol edx, 7
mov ecx, dword [ebp - 0x5c]
sub ebx, edx
xor edi, ebx
xor ecx, edi
mov edx, edi
mov ebx, dword [ebp - 0x84]
imul ecx, dword [ebp - 0x84]
shr edx, 0xa
add ecx, edx
xor eax, ecx
mov edx, eax
xor ebx, eax
movzx ecx, word [ebp - 0x36]
imul ebx, ecx
ror edx, 0xd
xor edx, ebx
mov ecx, dword [ebp - 0x3c]
xor edi, edx
xor ecx, edi
ror ecx, 0xb
mov edx, dword [ebp - 0x5c]
imul edx, ecx
mov ecx, dword [ebp - 0x38]
mov ebx, edi
rol ebx, 0xb
add ebx, edx
xor eax, ebx
mov ebx, eax
xor ecx, eax
ror ecx, 2
mov edx, dword [ebp - 0x64]
imul edx, ecx
mov ecx, dword [ebp - 0x84]
ror ebx, 5
xor ebx, edx
and dword [ebp - 0x64], 0
xor edi, ebx
mov ebx, edi
mov edx, edi
sub edx, dword [ebp - 0x38]
xor edi, dword [ebp - 0x7c]
ror edx, 0xa
imul ecx, edx
ror ebx, 0xe
sub ecx, ebx
xor ecx, dword [ebp - 0x78]
mov ebx, dword [ebp - 0x60]
xor eax, ecx
mov dword [ebp - 0x74], eax
mov ecx, edi
test ebx, ebx
jle 0x41a754
cmp dword [ebp - 0x64], 4
jge 0x41a73b
rol dword [ebp - 0x74], 8
mov ebx, dword [ebp - 0x70]
mov dl, byte [ebp - 0x74]
inc dword [ebp - 0x70]
xor byte [ebp - 0x55], dl
mov byte [ebx], dl
jmp 0x41a749
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
rol ecx, 8
xor byte [ebp - 0x55], cl
mov byte [edx], cl
inc dword [ebp - 0x64]
mov ebx, dword [ebp - 0x60]
cmp dword [ebp - 0x64], ebx
jl 0x41a721
add ebx, 0xfffffffc
test ebx, ebx
jle 0x41a76b
push 4
pop ecx
sub ecx, ebx
shl ecx, 3
shr edi, cl
shl edi, cl
mov edx, edi
jmp 0x41a78d
xor edx, edx
test ebx, ebx
jge 0x41a78d
neg ebx
shl ebx, 3
mov ecx, ebx
shr eax, cl
shl eax, cl
jmp 0x41a78d
mov eax, dword [ebp - 0x6c]
xor edx, edx
mov dword [ebp - 0x78], eax
not eax
mov dword [ebp - 0x7c], eax
xor eax, eax
mov edi, dword [ebp - 0x8c]
shr edi, 3
test edi, edi
jbe 0x41a974
movzx ecx, word [ebp - 0x3a]
mov dword [ebp - 0x5c], ecx
neg dword [ebp - 0x5c]
mov dword [ebp - 0x64], ecx
movzx ecx, word [ebp - 0x36]
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x60], edi
movzx ecx, byte [esi]
shl ecx, 8
movzx edi, byte [esi + 1]
movzx ebx, byte [esi + 5]
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 4]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 6]
shl ecx, 8
or ecx, ebx
xor eax, edi
shl ecx, 8
movzx ebx, byte [esi + 7]
or ecx, ebx
mov ebx, dword [ebp - 0x3c]
mov dword [ebp - 0x74], edi
mov edi, dword [ebp - 0x38]
xor edi, eax
sub ebx, edi
movzx edi, word [ebp - 0x38]
mov dword [ebp - 0x88], ecx
xor ebx, ecx
xor edx, ebx
mov ebx, edx
mov ecx, dword [ebp - 0x84]
xor ecx, edx
add esi, 8
rol ecx, 1
imul edi, ecx
mov ecx, dword [ebp - 0x38]
ror ebx, 8
sub edi, ebx
xor eax, edi
mov edi, eax
sub edi, dword [ebp - 0x64]
xor edi, ecx
xor edx, edi
movzx edi, word [ebp - 0x3c]
sub ecx, edx
ror ecx, 5
mov ebx, edx
imul edi, ecx
rol ebx, 0xe
add ebx, edi
mov ecx, dword [ebp - 0x3c]
xor eax, ebx
mov ebx, dword [ebp - 0x84]
sub ecx, eax
mov edi, eax
ror ecx, 3
imul ebx, ecx
ror edi, 0xa
xor edi, ebx
xor edx, edi
movzx edi, word [ebp - 0x38]
mov ebx, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x5c]
add ecx, edx
rol ecx, 2
imul edi, ecx
mov ecx, edx
shr ecx, 4
xor edi, ecx
mov ecx, dword [ebp - 0x38]
xor eax, edi
mov edi, eax
sub ecx, eax
rol ecx, 0xd
imul ebx, ecx
rol edi, 7
movzx ecx, word [ebp - 0x38]
sub ebx, edi
xor edx, ebx
mov ebx, edx
mov edi, ecx
xor edi, edx
movzx ecx, word [ebp - 0x3c]
imul edi, ecx
shr ebx, 0xa
add edi, ebx
xor eax, edi
xor ecx, eax
imul ecx, dword [ebp - 0x84]
mov edi, eax
ror edi, 0xd
xor edi, ecx
xor edx, edi
mov ecx, dword [ebp - 0x3c]
xor ecx, edx
movzx edi, word [ebp - 0x38]
ror ecx, 0xb
imul edi, ecx
mov ecx, dword [ebp - 0x38]
mov ebx, edx
rol ebx, 0xb
add ebx, edi
xor eax, ebx
xor ecx, eax
ror ecx, 2
mov ebx, dword [ebp - 0x64]
imul ebx, ecx
mov edi, eax
ror edi, 5
xor edi, ebx
xor edx, edi
mov ebx, edx
movzx edi, word [ebp - 0x3c]
mov ecx, edx
sub ecx, dword [ebp - 0x38]
xor edx, dword [ebp - 0x7c]
ror ecx, 0xa
imul edi, ecx
ror ebx, 0xe
mov cl, byte [ebp - 0x55]
sub edi, ebx
xor edi, dword [ebp - 0x78]
xor eax, edi
xor cl, al
mov edi, dword [ebp - 0x70]
mov byte [edi + 3], al
xor cl, dl
ror eax, 8
mov byte [edi + 7], dl
mov byte [edi + 2], al
xor cl, al
ror edx, 8
xor cl, dl
ror eax, 8
xor cl, al
mov byte [edi + 6], dl
ror edx, 8
mov byte [edi + 1], al
xor cl, dl
ror eax, 8
mov byte [edi + 5], dl
ror edx, 8
mov bl, dl
xor bl, al
xor cl, bl
mov byte [ebp - 0x55], cl
mov ecx, dword [ebp - 0x74]
mov byte [edi], al
mov byte [edi + 4], dl
add edi, 8
mov dword [ebp - 0x78], ecx
mov ecx, dword [ebp - 0x88]
dec dword [ebp - 0x60]
ror eax, 8
mov dword [ebp - 0x7c], ecx
ror edx, 8
mov dword [ebp - 0x70], edi
jne 0x41a7b8
mov al, byte [ebp - 0x55]
mov ecx, dword [ebp - 0x80]
cmp al, byte [ecx + 8]
je 0x41aa11
call fcn.00405ddc
mov ecx, eax
mov esi, 0x427ab0
mov eax, 0xfffff000
and ecx, eax
mov dword [ebp - 0x60], ecx
mov ecx, dword [ebp - 0x9c]
lea edi, [ecx + 0xc]
and edi, 0xfffffffc
lea ebx, [edi + 0xfff]
mov dword [ecx + 8], esi
mov ecx, 0xffff
mov dword [ebp - 0x5c], ecx
and ebx, eax
xor eax, eax
mov edx, dword [reloc.KERNEL32.dll_GetLastError]
shr dword [ebp - 0x5c], 0x10
imul edx, edx, 0x343fd
add edx, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], edx
shr edx, 0x10
shl eax, 0x10
or eax, edx
cmp dword [ebp - 0x5c], 0
jne 0x41a9ba
xor edx, edx
div ecx
inc edx
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x60]
mov dword [eax], edx
mov dword [eax + 0x1c], ecx
mov dword [ebp - 0x60], 0
jmp 0x41aa08
mov eax, dword [ebp - 0x60]
mov dword [edi], eax
add edi, 4
cmp edi, ebx
jb 0x41aa00
jmp 0x419642
mov edx, dword [0x421858]
mov ecx, 0x400000
mov eax, dword [ebp - 0x90]
sub eax, dword [ebp - 0x94]
mov dword [ebp - 0x80], eax
sub ecx, edx
mov dword [ebp - 0x60], ecx
jne 0x41aa3a
test eax, eax
je 0x419722
mov esi, dword [ebp - 0x94]
mov ebx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x8c]
mov ecx, dword [0x4177a0]
sub esi, dword [ebp - 0x90]
add eax, ebx
mov dword [ebp - 0x8c], eax
xor edi, edi
dec ecx
js 0x41aa89
lea eax, [edi + ecx]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x4177a4]
and edx, 0xfffffff
cmp ebx, edx
jae 0x41aa80
lea ecx, [eax - 1]
jmp 0x41aa85
jbe 0x41aa8d
lea edi, [eax + 1]
cmp ecx, edi
jge 0x41aa62
mov ebx, edi
jmp 0x41aae6
mov ebx, eax
jmp 0x41aae6
mov eax, dword [ebx*4 + 0x4177a4]
mov ecx, eax
and ecx, 0xfffffff
cmp ecx, dword [ebp - 0x8c]
jae 0x419722
lea edi, [ecx + esi + 0x400000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x41aad9
dec ecx
je 0x41aad4
dec ecx
jne 0x41aadf
mov edx, dword [ebp - 0x60]
jmp 0x41aadf
mov edx, dword [ebp - 0x80]
jmp 0x41aadf
mov edx, dword [ebp - 0x60]
sub edx, dword [ebp - 0x80]
dec eax
dec eax
jne 0x41aae5
add dword [edi], edx
inc ebx
cmp ebx, dword [0x4177a0]
jb 0x41aa91
jmp 0x419722
mov edi, dword [ebp - 0x90]
cmp edi, esi
jb 0x41cb73
mov eax, dword [0x40003c]
mov eax, dword [eax + 0x400050]
add eax, esi
cmp edi, eax
jae 0x41b18f
mov ecx, dword [0x4350d0]
and dword [ebp - 0x5c], 0
sub edi, esi
dec ecx
js 0x41ab56
mov eax, dword [ebp - 0x5c]
add eax, ecx
cdq
sub eax, edx
sar eax, 1
lea edx, [eax*8 + 0x4359d8]
mov dword [ebp - 0x60], edx
mov edx, dword [edx + 4]
and edx, ebx
cmp edi, edx
jae 0x41ab47
lea ecx, [eax - 1]
jmp 0x41ab51
jbe 0x41ac4a
inc eax
mov dword [ebp - 0x5c], eax
cmp ecx, dword [ebp - 0x5c]
jge 0x41ab25
xor eax, eax
test eax, eax
je 0x41b189
mov ecx, dword [eax]
shr ecx, 1
and ecx, 7
lea ecx, [ecx + eax + 8]
mov eax, dword [eax + 4]
and eax, ebx
mov dword [ebp - 0x6c], ecx
sub dword [ebp - 0x6c], esi
mov dword [ebp - 0x90], ecx
lea edx, [ecx + eax]
mov ecx, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
mov dword [ebp - 0x94], eax
sub ecx, eax
inc ecx
mov dword [ebp - 0x8c], edx
xor eax, eax
test ecx, ecx
mov edx, ecx
je 0x41abc3
mov esi, dword [reloc.KERNEL32.dll_GetLastError]
imul esi, esi, 0x343fd
add esi, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], esi
shr esi, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, esi
test edx, edx
jne 0x41ab9c
xor edx, edx
div ecx
mov eax, dword [ebp - 0x68]
lea ebx, [edx + eax]
push ebx
push dword [ebp - 0x94]
mov dword [ebp - 0x98], ebx
push dword [ebp - 0x6c]
mov eax, 0x22f2d424
mov eax, dword [ebp - 0x8c]
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x94]
mov edi, dword [ebp - 0x90]
add esp, 0xc
and eax, 7
mov byte [ebp - 0x55], 0
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x60], eax
je 0x41adeb
mov ebx, dword [ebp - 0x6c]
and dword [ebp - 0x7c], 0
and dword [ebp - 0x78], 0
and dword [ebp - 0x64], 0
test eax, eax
not ebx
mov dword [ebp - 0x80], ebx
jle 0x41ac7a
mov dword [ebp - 0x5c], reloc.KERNEL32.dll_GetProcAddress
cmp dword [ebp - 0x64], 4
movzx ebx, byte [edi]
mov ecx, dword [ebp - 0x5c]
jge 0x41ac65
add ecx, 0xffffffe0
shl ebx, cl
or dword [ebp - 0x78], ebx
jmp 0x41ac6a
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
shr ecx, 1
and ecx, 0x3f
and eax, ebx
lea eax, [ecx + eax + 0x400000]
jmp 0x41ab58
shl ebx, cl
or dword [ebp - 0x7c], ebx
sub dword [ebp - 0x5c], 8
inc edi
inc dword [ebp - 0x64]
cmp dword [ebp - 0x64], eax
jl 0x41ac34
mov ebx, dword [ebp - 0x80]
mov eax, ebx
movzx ecx, si
sub eax, ecx
sub eax, edx
movzx ecx, word [ebp - 0x16]
xor eax, dword [ebp - 0x6c]
xor esi, edx
movzx edx, dx
xor esi, ebx
xor esi, eax
mov ebx, ecx
xor ebx, esi
imul ebx, edx
mov edx, esi
shr edx, 0xe
xor ebx, edx
movzx edx, word [ebp - 0x1a]
xor eax, ebx
mov ebx, eax
xor ecx, eax
imul ecx, edx
ror ebx, 0xc
sub ecx, ebx
xor esi, ecx
mov ebx, esi
mov ecx, dword [ebp - 0x18]
movzx edx, word [ebp - 0x1c]
sub ecx, esi
rol ecx, 3
imul ecx, edx
rol ebx, 6
xor ebx, ecx
movzx edx, word [ebp - 0x16]
mov ecx, dword [ebp - 0x1c]
xor eax, ebx
xor ecx, eax
mov ebx, eax
ror ecx, 0xc
imul ecx, edx
rol ebx, 0xf
movzx edx, word [ebp - 0x18]
sub ecx, ebx
xor esi, ecx
mov ecx, esi
mov ebx, esi
sub ecx, dword [ebp - 0x1c]
ror ecx, 9
imul ecx, edx
movzx edx, word [ebp - 0x1a]
ror ebx, 0xb
add ebx, ecx
mov ecx, dword [ebp - 0x18]
xor eax, ebx
add ecx, eax
mov ebx, eax
ror ecx, 5
imul ecx, edx
rol ebx, 0xf
sub ecx, ebx
xor esi, ecx
mov edx, esi
ror edx, 4
movzx ecx, word [ebp - 0x1c]
xor edx, ecx
movzx ecx, word [ebp - 0x16]
imul edx, ecx
mov ecx, dword [ebp - 0x18]
xor eax, edx
mov edx, dword [ebp - 0x1c]
xor ecx, eax
sub edx, ecx
mov ecx, dword [ebp - 0x1c]
xor esi, edx
sub ecx, esi
mov ebx, esi
movzx edx, word [ebp - 0x18]
ror ecx, 9
imul ecx, edx
ror ebx, 7
movzx edx, word [ebp - 0x16]
add ebx, ecx
xor eax, ebx
mov ecx, eax
sub ecx, edx
movzx edx, word [ebp - 0x1a]
rol ecx, 6
imul ecx, edx
and dword [ebp - 0x64], 0
mov ebx, eax
shr ebx, 0xe
xor ecx, ebx
xor esi, ecx
movzx ecx, word [ebp - 0x1c]
mov ebx, esi
xor esi, dword [ebp - 0x7c]
ror ebx, 7
sub ebx, ecx
imul ebx, edx
xor ebx, dword [ebp - 0x78]
mov ecx, esi
xor eax, ebx
mov ebx, dword [ebp - 0x60]
mov dword [ebp - 0x74], eax
test ebx, ebx
jle 0x41adc1
cmp dword [ebp - 0x64], 4
jge 0x41ada8
rol dword [ebp - 0x74], 8
mov ebx, dword [ebp - 0x70]
mov dl, byte [ebp - 0x74]
inc dword [ebp - 0x70]
xor byte [ebp - 0x55], dl
mov byte [ebx], dl
jmp 0x41adb6
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
rol ecx, 8
xor byte [ebp - 0x55], cl
mov byte [edx], cl
inc dword [ebp - 0x64]
mov ebx, dword [ebp - 0x60]
cmp dword [ebp - 0x64], ebx
jl 0x41ad8e
add ebx, 0xfffffffc
test ebx, ebx
jle 0x41add8
push 4
pop ecx
sub ecx, ebx
shl ecx, 3
shr esi, cl
shl esi, cl
mov edx, esi
jmp 0x41adfa
xor edx, edx
test ebx, ebx
jge 0x41adfa
neg ebx
shl ebx, 3
mov ecx, ebx
shr eax, cl
shl eax, cl
jmp 0x41adfa
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
not eax
mov dword [ebp - 0x7c], eax
xor edx, edx
xor eax, eax
mov esi, dword [ebp - 0x94]
shr esi, 3
test esi, esi
jbe 0x41aff3
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0x18]
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x64], ecx
movzx ecx, word [ebp - 0x16]
mov dword [ebp - 0x88], ecx
neg dword [ebp - 0x88]
mov dword [ebp - 0x5c], ecx
movzx ecx, word [ebp - 0x1c]
mov dword [ebp - 0x60], ecx
movzx ecx, word [ebp - 0x1a]
mov dword [ebp - 0x84], ecx
movzx esi, byte [edi + 1]
movzx ebx, byte [edi + 5]
movzx ecx, byte [edi]
shl ecx, 8
or ecx, esi
shl ecx, 8
movzx esi, byte [edi + 2]
or ecx, esi
movzx esi, byte [edi + 3]
shl ecx, 8
or ecx, esi
movzx esi, byte [edi + 4]
shl esi, 8
or esi, ebx
movzx ebx, byte [edi + 6]
shl esi, 8
or esi, ebx
shl esi, 8
movzx ebx, byte [edi + 7]
or esi, ebx
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x74], ecx
xor edx, esi
mov esi, edx
sub esi, dword [ebp - 0x60]
add edi, 8
sub esi, dword [ebp - 0x18]
xor esi, ecx
mov ecx, dword [ebp - 0x64]
xor ecx, edx
xor eax, esi
xor ecx, eax
mov edx, ecx
mov esi, dword [ebp - 0x5c]
xor esi, edx
movzx ecx, word [ebp - 0x18]
imul esi, ecx
mov ecx, edx
shr ecx, 0xe
xor esi, ecx
xor eax, esi
mov esi, dword [ebp - 0x5c]
xor esi, eax
imul esi, dword [ebp - 0x84]
mov ecx, eax
ror ecx, 0xc
sub esi, ecx
xor edx, esi
movzx esi, word [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
sub ecx, edx
rol ecx, 3
mov ebx, edx
imul ecx, esi
rol ebx, 6
xor ebx, ecx
mov ecx, dword [ebp - 0x1c]
xor eax, ebx
mov esi, eax
xor ecx, eax
ror ecx, 0xc
imul ecx, dword [ebp - 0x5c]
rol esi, 0xf
sub ecx, esi
movzx esi, word [ebp - 0x18]
xor edx, ecx
mov ecx, edx
mov ebx, edx
sub ecx, dword [ebp - 0x1c]
ror ecx, 9
imul ecx, esi
ror ebx, 0xb
add ebx, ecx
xor eax, ebx
mov ecx, dword [ebp - 0x18]
add ecx, eax
mov esi, eax
ror ecx, 5
imul ecx, dword [ebp - 0x84]
rol esi, 0xf
sub ecx, esi
xor edx, ecx
movzx ecx, word [ebp - 0x1c]
mov esi, edx
ror esi, 4
xor esi, ecx
mov ecx, dword [ebp - 0x18]
imul esi, dword [ebp - 0x5c]
xor eax, esi
xor ecx, eax
mov esi, dword [ebp - 0x1c]
sub esi, ecx
mov ecx, dword [ebp - 0x1c]
xor edx, esi
movzx esi, word [ebp - 0x18]
mov ebx, edx
sub ecx, edx
ror ecx, 9
imul esi, ecx
mov ecx, dword [ebp - 0x88]
ror ebx, 7
add ebx, esi
xor eax, ebx
mov esi, dword [ebp - 0x84]
add ecx, eax
rol ecx, 6
imul esi, ecx
mov ecx, eax
shr ecx, 0xe
xor esi, ecx
xor edx, esi
movzx ecx, word [ebp - 0x1c]
mov esi, edx
xor edx, dword [ebp - 0x7c]
ror esi, 7
sub esi, ecx
imul esi, dword [ebp - 0x84]
xor esi, dword [ebp - 0x78]
mov dword [ebp - 0x60], ecx
mov cl, byte [ebp - 0x55]
xor eax, esi
mov esi, dword [ebp - 0x70]
mov byte [esi + 3], al
mov byte [esi + 7], dl
xor cl, al
xor cl, dl
ror eax, 8
xor cl, al
mov byte [esi + 2], al
ror edx, 8
mov byte [esi + 6], dl
xor cl, dl
ror eax, 8
mov byte [esi + 1], al
xor cl, al
ror edx, 8
mov byte [esi + 5], dl
xor cl, dl
ror eax, 8
ror edx, 8
mov bl, dl
xor bl, al
xor cl, bl
mov byte [ebp - 0x55], cl
mov ecx, dword [ebp - 0x74]
mov byte [esi], al
mov byte [esi + 4], dl
mov dword [ebp - 0x78], ecx
mov ecx, dword [ebp - 0x68]
add esi, 8
dec dword [ebp - 0x80]
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x70], esi
ror eax, 8
ror edx, 8
jne 0x41ae3b
mov eax, dword [ebp - 0x8c]
mov cl, byte [ebp - 0x55]
cmp cl, byte [eax + 8]
je 0x41b09b
call fcn.00405ddc
mov esi, 0x427ab0
mov ecx, eax
mov eax, 0xfffff000
and ecx, eax
mov dword [ebp - 0x60], ecx
mov ecx, dword [ebp - 0x9c]
lea edi, [ecx + 0xc]
and edi, 0xfffffffc
lea ebx, [edi + 0xfff]
mov dword [ecx + 8], esi
and ebx, eax
xor eax, eax
mov ecx, 0xffff
mov dword [ebp - 0x5c], ecx
mov edx, dword [reloc.KERNEL32.dll_GetLastError]
shr dword [ebp - 0x5c], 0x10
imul edx, edx, 0x343fd
add edx, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], edx
shr edx, 0x10
shl eax, 0x10
or eax, edx
cmp dword [ebp - 0x5c], 0
jne 0x41b03c
xor edx, edx
div ecx
mov ecx, dword [ebp - 0x60]
inc edx
cmp edi, ebx
mov eax, dword [ebp - 0xa0]
mov dword [eax], edx
mov dword [eax + 0x1c], ecx
mov dword [ebp - 0x60], 0
mov eax, edi
jae 0x419642
mov ecx, dword [ebp - 0x60]
mov dword [eax], ecx
add eax, 4
cmp eax, ebx
jb 0x41b08a
jmp 0x419642
mov eax, dword [ebp - 0x90]
mov ecx, 0x400000
sub eax, dword [ebp - 0x98]
mov edx, dword [0x421858]
mov dword [ebp - 0x80], eax
sub ecx, edx
mov dword [ebp - 0x60], ecx
jne 0x41b0c4
test eax, eax
je 0x41b174
mov esi, dword [ebp - 0x98]
mov ebx, dword [ebp - 0x6c]
sub esi, dword [ebp - 0x90]
mov eax, dword [ebp - 0x94]
add eax, ebx
mov ecx, dword [0x4177a0]
mov dword [ebp - 0x8c], eax
xor edi, edi
dec ecx
js 0x41b113
lea eax, [edi + ecx]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x4177a4]
and edx, 0xfffffff
cmp ebx, edx
jae 0x41b10a
lea ecx, [eax - 1]
jmp 0x41b10f
jbe 0x41b117
lea edi, [eax + 1]
cmp ecx, edi
jge 0x41b0ec
mov ebx, edi
jmp 0x41b16c
mov ebx, eax
jmp 0x41b16c
mov eax, dword [ebx*4 + 0x4177a4]
mov ecx, eax
and ecx, 0xfffffff
cmp ecx, dword [ebp - 0x8c]
jae 0x41b174
lea edi, [ecx + esi + 0x400000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x41b15f
dec ecx
je 0x41b15a
dec ecx
jne 0x41b165
mov edx, dword [ebp - 0x60]
jmp 0x41b165
mov edx, dword [ebp - 0x80]
jmp 0x41b165
mov edx, dword [ebp - 0x60]
sub edx, dword [ebp - 0x80]
dec eax
dec eax
jne 0x41b16b
add dword [edi], edx
inc ebx
cmp ebx, dword [0x4177a0]
jb 0x41b11b
mov eax, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
mov eax, 0xb9bad68c
mov eax, dword [ebp - 0x98]
jmp 0x41d263
mov edi, dword [ebp - 0x90]
cmp edi, esi
jb 0x41cb73
mov eax, dword [0x40003c]
mov eax, dword [eax + 0x400050]
add eax, esi
cmp edi, eax
jae 0x41b7de
mov ecx, dword [0x434b84]
and dword [ebp - 0x5c], 0
sub edi, esi
dec ecx
js 0x41b1ec
mov eax, dword [ebp - 0x5c]
add eax, ecx
cdq
sub eax, edx
sar eax, 1
lea edx, [eax*8 + fcn.004304c0]
mov dword [ebp - 0x60], edx
mov edx, dword [edx + 4]
and edx, ebx
cmp edi, edx
jae 0x41b1dd
lea ecx, [eax - 1]
jmp 0x41b1e7
jbe 0x41b2cf
inc eax
mov dword [ebp - 0x5c], eax
cmp ecx, dword [ebp - 0x5c]
jge 0x41b1bb
xor ecx, ecx
test ecx, ecx
je 0x41b7d8
mov eax, dword [ecx]
mov edx, eax
and eax, ebx
shr edx, 0x1d
lea ecx, [edx + ecx + 8]
mov edx, eax
mov eax, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
sub eax, edx
lea ebx, [ecx + edx]
mov dword [ebp - 0x6c], ecx
sub dword [ebp - 0x6c], esi
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x98], ebx
lea ecx, [eax + 1]
mov edx, ecx
xor eax, eax
test ecx, ecx
je 0x41b259
mov esi, dword [reloc.KERNEL32.dll_GetLastError]
imul esi, esi, 0x343fd
add esi, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], esi
shr esi, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, esi
test edx, edx
jne 0x41b232
xor edx, edx
div ecx
mov eax, dword [ebp - 0x68]
lea edi, [eax + edx]
push edi
push dword [ebp - 0x84]
mov dword [ebp - 0x94], edi
push dword [ebp - 0x6c]
mov eax, 0xb0e2c38f
mov esi, dword [ebp - 0x90]
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x84]
add esp, 0xc
mov byte [ebp - 0x55], 0
and eax, 7
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x60], eax
je 0x41b46e
xor ecx, ecx
cmp eax, ecx
mov edi, dword [ebp - 0x6c]
mov dword [ebp - 0x7c], ecx
not edi
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x64], ecx
jle 0x41b2fd
push reloc.KERNEL32.dll_GetProcAddress
pop edx
movzx ebx, byte [esi]
cmp dword [ebp - 0x64], 4
jge 0x41b2ea
lea ecx, [edx - 0x20]
shl ebx, cl
or dword [ebp - 0x78], ebx
jmp 0x41b2f1
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
shr ecx, 1
and ecx, 0x3f
mov eax, dword [eax + 4]
and eax, ebx
lea ecx, [ecx + eax + 0x400000]
jmp 0x41b1ee
mov ecx, edx
shl ebx, cl
or dword [ebp - 0x7c], ebx
inc esi
inc dword [ebp - 0x64]
sub edx, 8
cmp dword [ebp - 0x64], eax
jl 0x41b2bc
mov ecx, dword [ebp - 0x14]
movzx edx, word [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x6c]
sub ecx, eax
xor edi, ecx
mov eax, edi
mov ecx, edi
sub ecx, dword [ebp - 0x14]
ror ecx, 9
imul ecx, edx
movzx edx, word [ebp - 0x12]
rol eax, 7
add eax, ecx
xor eax, dword [ebp - 0x6c]
mov ecx, eax
sub ecx, dword [ebp - 0x10]
mov ebx, eax
ror ecx, 5
imul ecx, edx
ror ebx, 5
sub ecx, ebx
xor edi, ecx
movzx edx, word [ebp - 0x14]
mov ebx, edi
mov ecx, edi
sub ecx, dword [ebp - 0x10]
rol ecx, 7
imul ecx, edx
ror ebx, 3
xor ebx, ecx
xor eax, ebx
mov ecx, eax
mov ebx, eax
xor ecx, edx
rol ecx, 3
movzx edx, word [ebp - 0xe]
imul ecx, edx
ror ebx, 0xa
movzx edx, word [ebp - 0x10]
sub ecx, ebx
xor edi, ecx
mov ecx, dword [ebp - 0x14]
mov ebx, edi
sub ecx, edi
ror ecx, 9
imul ecx, edx
movzx edx, word [ebp - 0x12]
rol ebx, 6
add ebx, ecx
xor eax, ebx
mov ecx, dword [ebp - 0x10]
mov ebx, eax
xor ecx, eax
rol ecx, 7
imul ecx, edx
shr ebx, 0xc
sub ecx, ebx
xor edi, ecx
movzx ecx, word [ebp - 0x14]
mov ebx, edi
ror ebx, 8
sub ebx, ecx
imul ebx, edx
mov ecx, dword [ebp - 0x14]
movzx edx, word [ebp - 0xe]
xor eax, ebx
mov ebx, eax
xor ecx, eax
rol ecx, 5
imul ecx, edx
ror ebx, 6
xor ebx, ecx
mov ecx, dword [ebp - 0x14]
xor ecx, dword [ebp - 0x10]
xor edi, ebx
xor ecx, edi
xor eax, ecx
mov edx, eax
movzx ecx, word [ebp - 0x10]
xor edx, ecx
movzx ecx, word [ebp - 0x12]
imul edx, ecx
mov ecx, eax
and dword [ebp - 0x64], 0
shr ecx, 5
add edx, ecx
mov ecx, dword [ebp - 0x10]
xor edi, edx
xor ecx, edi
movzx edx, word [ebp - 0x14]
ror ecx, 1
imul ecx, edx
mov ebx, edi
xor edi, dword [ebp - 0x7c]
rol ebx, 0xc
add ebx, ecx
mov ecx, edi
xor ebx, dword [ebp - 0x78]
xor eax, ebx
mov ebx, dword [ebp - 0x60]
test ebx, ebx
mov dword [ebp - 0x74], eax
jle 0x41b444
cmp dword [ebp - 0x64], 4
jge 0x41b42b
rol dword [ebp - 0x74], 8
mov ebx, dword [ebp - 0x70]
mov dl, byte [ebp - 0x74]
inc dword [ebp - 0x70]
xor byte [ebp - 0x55], dl
mov byte [ebx], dl
jmp 0x41b439
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
rol ecx, 8
xor byte [ebp - 0x55], cl
mov byte [edx], cl
inc dword [ebp - 0x64]
mov ebx, dword [ebp - 0x60]
cmp dword [ebp - 0x64], ebx
jl 0x41b411
add ebx, 0xfffffffc
test ebx, ebx
jle 0x41b45b
push 4
pop ecx
sub ecx, ebx
shl ecx, 3
shr edi, cl
shl edi, cl
mov edx, edi
jmp 0x41b47d
xor edx, edx
test ebx, ebx
jge 0x41b47d
neg ebx
shl ebx, 3
mov ecx, ebx
shr eax, cl
shl eax, cl
jmp 0x41b47d
xor edx, edx
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
not eax
mov dword [ebp - 0x7c], eax
xor eax, eax
mov ecx, dword [ebp - 0x84]
shr ecx, 3
test ecx, ecx
jbe 0x41b656
movzx edi, word [ebp - 0xe]
mov dword [ebp - 0x60], edi
mov edi, dword [ebp - 0x14]
xor edi, dword [ebp - 0x10]
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x8c], edi
movzx edi, word [ebp - 0x12]
mov dword [ebp - 0x5c], edi
movzx ebx, byte [esi + 5]
movzx ecx, byte [esi]
movzx edi, byte [esi + 1]
shl ecx, 8
or edi, ecx
shl edi, 8
movzx ecx, byte [esi + 2]
or edi, ecx
shl edi, 8
movzx ecx, byte [esi + 3]
or edi, ecx
movzx ecx, byte [esi + 4]
shl ecx, 8
or ecx, ebx
shl ecx, 8
movzx ebx, byte [esi + 6]
or ecx, ebx
movzx ebx, byte [esi + 7]
shl ecx, 8
or ecx, ebx
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x74], edi
xor eax, edi
mov edi, dword [ebp - 0x10]
xor edi, eax
sub ebx, edi
xor ebx, ecx
movzx edi, word [ebp - 0x10]
xor edx, ebx
add esi, 8
mov ecx, edx
sub ecx, dword [ebp - 0x14]
ror ecx, 9
imul ecx, edi
mov ebx, edx
rol ebx, 7
add ebx, ecx
xor eax, ebx
mov ecx, eax
sub ecx, dword [ebp - 0x10]
mov edi, eax
ror ecx, 5
imul ecx, dword [ebp - 0x5c]
ror edi, 5
sub ecx, edi
movzx edi, word [ebp - 0x14]
xor edx, ecx
mov ecx, edx
mov ebx, edx
sub ecx, dword [ebp - 0x10]
rol ecx, 7
imul ecx, edi
ror ebx, 3
xor ebx, ecx
xor eax, ebx
mov ecx, eax
xor ecx, edi
mov edi, eax
rol ecx, 3
imul ecx, dword [ebp - 0x60]
ror edi, 0xa
sub ecx, edi
movzx edi, word [ebp - 0x10]
xor edx, ecx
mov ebx, edx
mov ecx, dword [ebp - 0x14]
sub ecx, edx
ror ecx, 9
imul ecx, edi
rol ebx, 6
add ebx, ecx
xor eax, ebx
mov ecx, dword [ebp - 0x10]
mov edi, eax
xor ecx, eax
rol ecx, 7
imul ecx, dword [ebp - 0x5c]
shr edi, 0xc
sub ecx, edi
xor edx, ecx
mov edi, edx
movzx ecx, word [ebp - 0x14]
ror edi, 8
sub edi, ecx
mov ecx, dword [ebp - 0x14]
imul edi, dword [ebp - 0x5c]
xor eax, edi
xor ecx, eax
mov edi, eax
rol ecx, 5
imul ecx, dword [ebp - 0x60]
ror edi, 6
xor edi, ecx
xor edx, edi
mov ecx, edx
xor ecx, eax
xor ecx, dword [ebp - 0x8c]
mov eax, ecx
mov edi, eax
movzx ecx, word [ebp - 0x10]
xor edi, ecx
mov ecx, eax
imul edi, dword [ebp - 0x5c]
shr ecx, 5
add edi, ecx
xor edx, edi
movzx edi, word [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov ebx, edx
xor ecx, edx
ror ecx, 1
imul ecx, edi
xor edx, dword [ebp - 0x7c]
rol ebx, 0xc
add ebx, ecx
mov edi, dword [ebp - 0x70]
mov cl, byte [ebp - 0x55]
xor ebx, dword [ebp - 0x78]
xor eax, ebx
xor cl, al
xor cl, dl
mov byte [edi + 3], al
mov byte [edi + 7], dl
ror eax, 8
xor cl, al
mov byte [edi + 2], al
ror edx, 8
mov byte [edi + 6], dl
xor cl, dl
ror eax, 8
xor cl, al
mov byte [edi + 1], al
ror edx, 8
xor cl, dl
ror eax, 8
mov byte [edi + 5], dl
ror edx, 8
mov bl, dl
xor bl, al
xor cl, bl
mov byte [ebp - 0x55], cl
mov ecx, dword [ebp - 0x74]
mov byte [edi], al
mov byte [edi + 4], dl
mov dword [ebp - 0x78], ecx
mov ecx, dword [ebp - 0x88]
add edi, 8
dec dword [ebp - 0x80]
ror eax, 8
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x70], edi
ror edx, 8
jne 0x41b4ab
mov ecx, dword [ebp - 0x98]
mov al, byte [ebp - 0x55]
cmp al, byte [ecx + 8]
je 0x41b6f6
call fcn.00405ddc
mov esi, 0x427ab0
mov ecx, eax
mov eax, 0xfffff000
and ecx, eax
mov dword [ebp - 0x60], ecx
mov ecx, dword [ebp - 0x9c]
mov dword [ecx + 8], esi
lea edi, [ecx + 0xc]
mov ecx, 0xffff
mov dword [ebp - 0x5c], ecx
and edi, 0xfffffffc
lea ebx, [edi + 0xfff]
and ebx, eax
xor eax, eax
mov edx, dword [reloc.KERNEL32.dll_GetLastError]
shr dword [ebp - 0x5c], 0x10
imul edx, edx, 0x343fd
add edx, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], edx
shr edx, 0x10
shl eax, 0x10
or eax, edx
cmp dword [ebp - 0x5c], 0
jne 0x41b69f
xor edx, edx
div ecx
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x60]
inc edx
mov dword [eax], edx
mov dword [eax + 0x1c], ecx
mov dword [ebp - 0x60], 0
jmp 0x41b6ed
mov eax, dword [ebp - 0x60]
mov dword [edi], eax
add edi, 4
cmp edi, ebx
jb 0x41b6e5
jmp 0x419642
mov ecx, 0x400000
mov eax, dword [ebp - 0x90]
mov edx, dword [0x421858]
sub eax, dword [ebp - 0x94]
sub ecx, edx
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x60], ecx
jne 0x41b71f
test eax, eax
je 0x419722
mov eax, dword [ebp - 0x84]
mov esi, dword [ebp - 0x94]
mov ebx, dword [ebp - 0x6c]
sub esi, dword [ebp - 0x90]
mov ecx, dword [0x4177a0]
add eax, ebx
xor edi, edi
mov dword [ebp - 0x8c], eax
dec ecx
js 0x41b76e
lea eax, [edi + ecx]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x4177a4]
and edx, 0xfffffff
cmp ebx, edx
jae 0x41b765
lea ecx, [eax - 1]
jmp 0x41b76a
jbe 0x41b772
lea edi, [eax + 1]
cmp ecx, edi
jge 0x41b747
mov ebx, edi
jmp 0x41b7cb
mov ebx, eax
jmp 0x41b7cb
mov eax, dword [ebx*4 + 0x4177a4]
mov ecx, eax
and ecx, 0xfffffff
cmp ecx, dword [ebp - 0x8c]
jae 0x419722
lea edi, [ecx + esi + 0x400000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x41b7be
dec ecx
je 0x41b7b9
dec ecx
jne 0x41b7c4
mov edx, dword [ebp - 0x60]
jmp 0x41b7c4
mov edx, dword [ebp - 0x80]
jmp 0x41b7c4
mov edx, dword [ebp - 0x60]
sub edx, dword [ebp - 0x80]
dec eax
dec eax
jne 0x41b7ca
add dword [edi], edx
inc ebx
cmp ebx, dword [0x4177a0]
jb 0x41b776
jmp 0x419722
mov edi, dword [ebp - 0x90]
cmp edi, esi
jb 0x41cb73
mov eax, dword [0x40003c]
mov eax, dword [eax + 0x400050]
add eax, esi
cmp edi, eax
jae 0x41be95
mov ecx, dword [0x4013b8]
and dword [ebp - 0x5c], 0
sub edi, esi
dec ecx
js 0x41b83b
mov eax, dword [ebp - 0x5c]
add eax, ecx
cdq
sub eax, edx
sar eax, 1
lea edx, [eax*8 + 0x40abf0]
mov dword [ebp - 0x60], edx
mov edx, dword [edx + 4]
and edx, ebx
cmp edi, edx
jae 0x41b82c
lea ecx, [eax - 1]
jmp 0x41b836
jbe 0x41b936
inc eax
mov dword [ebp - 0x5c], eax
cmp ecx, dword [ebp - 0x5c]
jge 0x41b80a
xor ecx, ecx
test ecx, ecx
je 0x41be8f
mov eax, dword [ecx]
mov edx, eax
and edx, 7
shr eax, 3
lea ecx, [edx + ecx + 8]
mov dword [ebp - 0x6c], ecx
and eax, ebx
sub dword [ebp - 0x6c], esi
mov dword [ebp - 0x90], ecx
lea edx, [ecx + eax]
mov ecx, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
sub ecx, eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x8c], edx
inc ecx
xor eax, eax
test ecx, ecx
mov edx, ecx
je 0x41b8a8
mov edi, dword [reloc.KERNEL32.dll_GetLastError]
imul edi, edi, 0x343fd
add edi, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], edi
shr edi, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, edi
test edx, edx
jne 0x41b881
xor edx, edx
div ecx
mov eax, dword [ebp - 0x68]
add eax, edx
push eax
push dword [ebp - 0x94]
mov dword [ebp - 0x88], eax
push dword [ebp - 0x6c]
mov eax, 0x2725450e
mov eax, dword [ebp - 0x8c]
mov edi, dword [ebp - 0x90]
mov edx, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x6c]
mov byte [ebp - 0x55], 0
mov dword [ebp - 0x24], ecx
and edx, 7
mov dword [ebp - 0x84], edx
je 0x41bb2b
xor ecx, ecx
cmp edx, ecx
not eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x64], ecx
jle 0x41b964
mov dword [ebp - 0x5c], reloc.KERNEL32.dll_GetProcAddress
mov ecx, dword [ebp - 0x5c]
cmp dword [ebp - 0x64], 4
movzx ebx, byte [edi]
jge 0x41b952
add ecx, 0xffffffe0
shl ebx, cl
or dword [ebp - 0x74], ebx
jmp 0x41b957
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
shr ecx, 2
mov eax, dword [eax + 4]
and ecx, 0x3f
and eax, ebx
lea ecx, [ecx + eax + 0x400000]
jmp 0x41b83d
shl ebx, cl
or dword [ebp - 0x7c], ebx
sub dword [ebp - 0x5c], 8
inc edi
inc dword [ebp - 0x64]
cmp dword [ebp - 0x64], edx
jl 0x41b920
sub eax, dword [ebp - 0x20]
movzx edx, word [ebp - 0x1e]
movzx ecx, word [ebp - 0x24]
sub eax, ecx
xor eax, dword [ebp - 0x6c]
mov ebx, eax
mov ecx, dword [ebp - 0x24]
sub ecx, eax
ror ecx, 2
imul ecx, edx
rol ebx, 7
movzx edx, word [ebp - 0x24]
xor ebx, ecx
xor dword [ebp - 0x68], ebx
mov ecx, dword [ebp - 0x68]
xor ecx, edx
movzx edx, word [ebp - 0x20]
mov ebx, dword [ebp - 0x68]
rol ecx, 7
imul ecx, edx
ror ebx, 8
xor ebx, ecx
xor eax, ebx
mov ecx, eax
xor ecx, edx
movzx edx, word [ebp - 0x22]
rol ecx, 4
mov ebx, eax
imul ecx, edx
rol ebx, 3
sub ecx, ebx
xor dword [ebp - 0x68], ecx
movzx ecx, word [ebp - 0x24]
mov ebx, dword [ebp - 0x68]
sub ebx, edx
imul ebx, ecx
mov ecx, dword [ebp - 0x68]
shr ecx, 6
sub ebx, ecx
xor eax, ebx
mov ebx, eax
movzx ecx, word [ebp - 0x1e]
not ebx
ror ebx, 0xa
add ebx, ecx
imul ebx, edx
mov ecx, dword [ebp - 0x24]
xor dword [ebp - 0x68], ebx
xor ecx, dword [ebp - 0x20]
xor ecx, dword [ebp - 0x68]
xor eax, ecx
mov ebx, eax
mov edx, eax
movzx ecx, word [ebp - 0x20]
xor ebx, ecx
movzx ecx, word [ebp - 0x22]
imul ebx, ecx
mov ecx, dword [ebp - 0x20]
ror edx, 2
add edx, ebx
xor dword [ebp - 0x68], edx
movzx edx, word [ebp - 0x24]
mov ebx, dword [ebp - 0x68]
xor ecx, dword [ebp - 0x68]
ror ecx, 5
imul ecx, edx
rol ebx, 3
sub ecx, ebx
xor eax, ecx
mov ebx, eax
ror ebx, 5
movzx ecx, word [ebp - 0x1e]
sub ebx, ecx
imul ebx, edx
movzx ecx, word [ebp - 0x20]
xor dword [ebp - 0x68], ebx
mov ebx, dword [ebp - 0x68]
xor ebx, edx
imul ebx, ecx
mov ecx, dword [ebp - 0x68]
shr ecx, 6
xor ebx, ecx
xor eax, ebx
mov ecx, dword [ebp - 0x20]
xor ecx, eax
mov ebx, dword [ebp - 0x24]
sub ebx, ecx
xor dword [ebp - 0x68], ebx
mov ebx, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x68]
and dword [ebp - 0x64], 0
rol ecx, 0xa
imul ecx, edx
mov edx, dword [ebp - 0x68]
xor edx, dword [ebp - 0x7c]
rol ebx, 0xd
sub ecx, ebx
xor ecx, dword [ebp - 0x74]
mov dword [ebp - 0x78], edx
xor eax, ecx
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x68], eax
test ecx, ecx
jle 0x41babd
mov ebx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
cmp dword [ebp - 0x64], 4
jge 0x41baa3
rol dword [ebp - 0x68], 8
mov cl, byte [ebp - 0x68]
mov byte [ebx], cl
jmp 0x41baac
rol dword [ebp - 0x78], 8
mov cl, byte [ebp - 0x78]
mov byte [ebx], cl
xor byte [ebp - 0x55], cl
inc dword [ebp - 0x64]
mov ecx, dword [ebp - 0x84]
cmp dword [ebp - 0x64], ecx
jl 0x41ba8c
lea ebx, [ecx - 4]
test ebx, ebx
jle 0x41bb18
push 4
pop ecx
sub ecx, ebx
shl ecx, 3
shr edx, cl
shl edx, cl
mov ebx, 0xfffffff
mov ecx, dword [ebp - 0x94]
shr ecx, 3
test ecx, ecx
mov dword [ebp - 0x84], ecx
jbe 0x41bcf8
mov ecx, dword [ebp - 0x24]
xor ecx, dword [ebp - 0x20]
mov dword [ebp - 0x64], ecx
movzx ecx, word [ebp - 0x22]
mov dword [ebp - 0x5c], ecx
movzx ecx, word [ebp - 0x1e]
mov dword [ebp - 0x98], ecx
movzx ecx, word [ebp - 0x24]
mov dword [ebp - 0x60], ecx
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x80], ecx
jmp 0x41bb3f
xor edx, edx
test ebx, ebx
jge 0x41bad0
neg ebx
shl ebx, 3
mov ecx, ebx
shr eax, cl
shl eax, cl
jmp 0x41bad0
xor edx, edx
mov dword [ebp - 0x74], eax
not eax
mov dword [ebp - 0x7c], eax
xor eax, eax
jmp 0x41bad5
mov edi, dword [ebp - 0x84]
movzx ecx, byte [edi]
movzx ebx, byte [edi + 1]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [edi + 2]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [edi + 3]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [edi + 5]
mov dword [ebp - 0x68], ecx
movzx ecx, byte [edi + 4]
shl ecx, 8
or ecx, ebx
shl ecx, 8
movzx ebx, byte [edi + 6]
or ecx, ebx
movzx ebx, byte [edi + 7]
shl ecx, 8
or ecx, ebx
mov dword [ebp - 0x78], ecx
xor edx, ecx
mov ecx, edx
add edi, 8
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x84], edi
sub ecx, dword [ebp - 0x60]
xor ecx, dword [ebp - 0x68]
xor eax, ecx
mov edi, eax
mov ecx, dword [ebp - 0x24]
sub ecx, eax
ror ecx, 2
imul ecx, dword [ebp - 0x98]
rol edi, 7
xor edi, ecx
xor edx, edi
mov ebx, edx
mov ecx, edx
movzx edi, word [ebp - 0x24]
xor ecx, edi
rol ecx, 7
movzx edi, word [ebp - 0x20]
imul ecx, edi
ror ebx, 8
xor ebx, ecx
xor eax, ebx
mov ecx, eax
xor ecx, edi
mov edi, eax
rol ecx, 4
imul ecx, dword [ebp - 0x5c]
rol edi, 3
sub ecx, edi
xor edx, ecx
mov edi, edx
sub edi, dword [ebp - 0x5c]
movzx ecx, word [ebp - 0x24]
imul edi, ecx
mov ecx, edx
shr ecx, 6
sub edi, ecx
xor eax, edi
mov ecx, eax
not ecx
ror ecx, 0xa
add ecx, dword [ebp - 0x98]
imul ecx, dword [ebp - 0x5c]
xor edx, ecx
mov ecx, edx
xor ecx, eax
xor ecx, dword [ebp - 0x64]
mov eax, ecx
mov edi, eax
mov ebx, eax
movzx ecx, word [ebp - 0x20]
xor ebx, ecx
imul ebx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x20]
ror edi, 2
add edi, ebx
xor edx, edi
mov ebx, edx
xor ecx, edx
ror ecx, 5
movzx edi, word [ebp - 0x24]
imul ecx, edi
rol ebx, 3
sub ecx, ebx
xor eax, ecx
mov ecx, eax
ror ecx, 5
sub ecx, dword [ebp - 0x98]
mov dword [ebp - 0x60], edi
imul ecx, edi
xor edx, ecx
mov ebx, edx
movzx ecx, word [ebp - 0x20]
xor ebx, edi
imul ebx, ecx
mov ecx, edx
shr ecx, 6
xor ebx, ecx
xor eax, ebx
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
xor ecx, eax
sub ebx, ecx
mov ecx, dword [ebp - 0x20]
xor edx, ebx
sub ecx, edx
rol ecx, 0xa
mov ebx, edx
imul ecx, edi
xor edx, dword [ebp - 0x7c]
rol ebx, 0xd
mov edi, dword [ebp - 0x70]
sub ecx, ebx
xor ecx, dword [ebp - 0x74]
xor eax, ecx
mov cl, byte [ebp - 0x55]
xor cl, al
xor cl, dl
mov byte [edi + 3], al
mov byte [edi + 7], dl
ror eax, 8
xor cl, al
ror edx, 8
mov byte [edi + 2], al
xor cl, dl
mov byte [edi + 6], dl
ror eax, 8
xor cl, al
mov byte [edi + 1], al
ror edx, 8
mov byte [edi + 5], dl
ror eax, 8
xor cl, dl
ror edx, 8
mov bl, dl
xor bl, al
xor cl, bl
mov ebx, dword [ebp - 0x68]
mov byte [edi], al
mov byte [edi + 4], dl
add edi, 8
mov dword [ebp - 0x74], ebx
mov ebx, dword [ebp - 0x78]
dec dword [ebp - 0x80]
ror eax, 8
ror edx, 8
mov byte [ebp - 0x55], cl
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x70], edi
jne 0x41bb39
mov ebx, 0xfffffff
jmp 0x41bcfb
mov cl, byte [ebp - 0x55]
mov eax, dword [ebp - 0x8c]
cmp cl, byte [eax + 8]
je 0x41bda0
call fcn.00405ddc
mov ecx, eax
mov esi, 0x427ab0
mov eax, 0xfffff000
and ecx, eax
mov dword [ebp - 0x60], ecx
mov ecx, dword [ebp - 0x9c]
mov dword [ecx + 8], esi
lea edi, [ecx + 0xc]
mov ecx, 0xffff
mov dword [ebp - 0x5c], ecx
and edi, 0xfffffffc
lea ebx, [edi + 0xfff]
and ebx, eax
xor eax, eax
mov edx, dword [reloc.KERNEL32.dll_GetLastError]
shr dword [ebp - 0x5c], 0x10
imul edx, edx, 0x343fd
add edx, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], edx
shr edx, 0x10
shl eax, 0x10
or eax, edx
cmp dword [ebp - 0x5c], 0
jne 0x41bd41
xor edx, edx
div ecx
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0xa0]
inc edx
cmp edi, ebx
mov dword [eax], edx
mov dword [eax + 0x1c], ecx
mov eax, edi
mov dword [ebp - 0x60], 0
jae 0x419642
mov ecx, dword [ebp - 0x60]
mov dword [eax], ecx
add eax, 4
cmp eax, ebx
jb 0x41bd8f
jmp 0x419642
mov eax, dword [ebp - 0x90]
sub eax, dword [ebp - 0x88]
mov ecx, dword [0x421858]
mov dword [ebp - 0x8c], eax
sub esi, ecx
mov dword [ebp - 0x80], esi
jne 0x41bdc7
test eax, eax
je 0x41be7a
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp - 0x6c]
mov ecx, dword [0x4177a0]
mov eax, dword [ebp - 0x94]
sub esi, dword [ebp - 0x90]
add eax, edi
mov dword [ebp - 0x5c], eax
xor eax, eax
dec ecx
mov dword [ebp - 0x60], eax
js 0x41be15
add eax, ecx
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x4177a4]
and edx, ebx
cmp edi, edx
jae 0x41be0b
lea ecx, [eax - 1]
mov eax, dword [ebp - 0x60]
jmp 0x41be11
jbe 0x41be15
inc eax
mov dword [ebp - 0x60], eax
cmp ecx, eax
jge 0x41bdef
mov dword [ebp - 0x74], eax
jmp 0x41be6f
mov eax, dword [ebp - 0x74]
mov eax, dword [eax*4 + 0x4177a4]
mov ecx, eax
and ecx, ebx
cmp ecx, dword [ebp - 0x5c]
jae 0x41be7a
lea edi, [ecx + esi + 0x400000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x41be5d
dec ecx
je 0x41be55
dec ecx
jne 0x41be66
mov edx, dword [ebp - 0x80]
jmp 0x41be66
mov edx, dword [ebp - 0x8c]
jmp 0x41be66
mov edx, dword [ebp - 0x80]
sub edx, dword [ebp - 0x8c]
dec eax
dec eax
jne 0x41be6c
add dword [edi], edx
inc dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
cmp eax, dword [0x4177a0]
jb 0x41be1a
mov eax, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
mov eax, 0x11f9309c
mov eax, dword [ebp - 0x88]
jmp 0x41d263
mov edi, dword [ebp - 0x90]
cmp edi, esi
jb 0x41cb73
mov eax, dword [0x40003c]
mov eax, dword [eax + 0x400050]
add eax, esi
cmp edi, eax
jae 0x41c501
mov ecx, dword [0x40a6d0]
and dword [ebp - 0x5c], 0
sub edi, esi
dec ecx
js 0x41bef2
mov eax, dword [ebp - 0x5c]
add eax, ecx
cdq
sub eax, edx
sar eax, 1
lea edx, [eax*8 + fcn.00415820]
mov dword [ebp - 0x60], edx
mov edx, dword [edx + 4]
and edx, ebx
cmp edi, edx
jae 0x41bee3
lea ecx, [eax - 1]
jmp 0x41beed
jbe 0x41bfe7
inc eax
mov dword [ebp - 0x5c], eax
cmp ecx, dword [ebp - 0x5c]
jge 0x41bec1
xor ecx, ecx
test ecx, ecx
je 0x41c4fb
mov eax, dword [ecx]
mov edx, eax
shr edx, 0x1d
shr eax, 1
lea ecx, [edx + ecx + 8]
and eax, ebx
mov dword [ebp - 0x6c], ecx
sub dword [ebp - 0x6c], esi
lea edx, [ecx + eax]
mov dword [ebp - 0x90], ecx
mov ecx, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
sub ecx, eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x88], edx
inc ecx
xor eax, eax
mov edx, ecx
test ecx, ecx
je 0x41bf5e
mov esi, dword [reloc.KERNEL32.dll_GetLastError]
imul esi, esi, 0x343fd
add esi, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], esi
shr esi, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, esi
test edx, edx
jne 0x41bf37
xor edx, edx
div ecx
mov eax, dword [ebp - 0x68]
lea esi, [eax + edx]
push esi
push dword [ebp - 0x84]
mov dword [ebp - 0x94], esi
push dword [ebp - 0x6c]
mov eax, 0x2783af30
mov edi, dword [ebp - 0x90]
mov eax, dword [ebp - 0x88]
mov edx, dword [eax]
mov ebx, dword [eax + 4]
mov eax, dword [ebp - 0x84]
add esp, 0xc
mov byte [ebp - 0x55], 0
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x70], esi
and eax, 7
mov dword [ebp - 0x8c], eax
je 0x41c180
mov ecx, dword [ebp - 0x6c]
not ecx
mov dword [ebp - 0x60], ecx
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x64], ecx
jle 0x41c012
mov dword [ebp - 0x5c], reloc.KERNEL32.dll_GetProcAddress
cmp dword [ebp - 0x64], 4
movzx esi, byte [edi]
mov ecx, dword [ebp - 0x5c]
jge 0x41c000
add ecx, 0xffffffe0
shl esi, cl
or dword [ebp - 0x78], esi
jmp 0x41c005
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
and ecx, ebx
and eax, 0x3f
lea ecx, [ecx + eax + 0x400000]
jmp 0x41bef4
shl esi, cl
or dword [ebp - 0x7c], esi
sub dword [ebp - 0x5c], 8
inc edi
inc dword [ebp - 0x64]
cmp dword [ebp - 0x64], eax
jl 0x41bfd1
mov esi, edx
xor esi, ebx
movzx ebx, bx
xor esi, dword [ebp - 0x60]
xor esi, dword [ebp - 0x6c]
mov ecx, esi
mov eax, esi
sub ecx, edx
mov dword [ebp - 0x60], ebx
movzx edx, dx
rol ecx, 3
imul ebx, ecx
rol eax, 0xa
xor eax, ebx
xor eax, dword [ebp - 0x6c]
movzx ecx, word [ebp - 0x52]
mov ebx, eax
sub ebx, edx
mov dword [ebp - 0x68], ecx
imul ebx, ecx
mov ecx, eax
shr ecx, 1
sub ebx, ecx
xor esi, ebx
mov dword [ebp - 0x80], edx
mov ecx, esi
sub ecx, dword [ebp - 0x50]
rol ecx, 1
mov ebx, esi
imul edx, ecx
mov ecx, dword [ebp - 0x54]
rol ebx, 6
sub edx, ebx
xor eax, edx
mov edx, dword [ebp - 0x50]
xor edx, eax
mov ebx, ecx
sub ebx, edx
xor esi, ebx
mov edx, esi
mov ebx, dword [ebp - 0x60]
sub ecx, esi
ror ecx, 6
imul ebx, ecx
ror edx, 0x10
mov ecx, dword [ebp - 0x50]
sub ebx, edx
xor eax, ebx
xor ecx, eax
mov edx, eax
mov ebx, dword [ebp - 0x68]
ror ecx, 0xf
imul ebx, ecx
rol edx, 5
xor edx, ebx
mov ecx, dword [ebp - 0x68]
movzx ebx, word [ebp - 0x4e]
xor esi, edx
xor ecx, esi
mov edx, esi
imul ecx, dword [ebp - 0x80]
shr edx, 0xa
xor ecx, edx
mov edx, dword [ebp - 0x68]
xor eax, ecx
mov ecx, eax
xor edx, eax
imul edx, ebx
ror ecx, 1
sub edx, ecx
mov ecx, dword [ebp - 0x68]
xor esi, edx
xor ecx, esi
mov edx, dword [ebp - 0x60]
rol ecx, 7
imul edx, ecx
mov ecx, dword [ebp - 0x80]
mov ebx, esi
ror ebx, 0xe
sub edx, ebx
xor eax, edx
mov ebx, dword [ebp - 0x68]
mov edx, eax
sub edx, ecx
rol edx, 7
imul ebx, edx
mov edx, eax
and dword [ebp - 0x64], 0
shr edx, 0xc
xor ebx, edx
xor esi, ebx
mov ebx, esi
mov edx, dword [ebp - 0x50]
xor edx, esi
ror edx, 3
imul ecx, edx
xor esi, dword [ebp - 0x7c]
rol ebx, 1
sub ecx, ebx
mov ebx, dword [ebp - 0x8c]
xor ecx, dword [ebp - 0x78]
xor eax, ecx
test ebx, ebx
mov ecx, esi
mov dword [ebp - 0x74], eax
jle 0x41c156
cmp dword [ebp - 0x64], 4
jge 0x41c13a
rol dword [ebp - 0x74], 8
mov dl, byte [ebp - 0x74]
mov ebx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
xor byte [ebp - 0x55], dl
mov byte [ebx], dl
jmp 0x41c148
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
rol ecx, 8
xor byte [ebp - 0x55], cl
mov byte [edx], cl
inc dword [ebp - 0x64]
mov ebx, dword [ebp - 0x8c]
cmp dword [ebp - 0x64], ebx
jl 0x41c120
add ebx, 0xfffffffc
test ebx, ebx
jle 0x41c16d
push 4
pop ecx
sub ecx, ebx
shl ecx, 3
shr esi, cl
shl esi, cl
mov edx, esi
jmp 0x41c18f
xor edx, edx
test ebx, ebx
jge 0x41c18f
neg ebx
shl ebx, 3
mov ecx, ebx
shr eax, cl
shl eax, cl
jmp 0x41c18f
xor edx, edx
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
not eax
mov dword [ebp - 0x7c], eax
xor eax, eax
mov esi, dword [ebp - 0x84]
shr esi, 3
test esi, esi
jbe 0x41c371
mov ecx, dword [ebp - 0x54]
xor ecx, dword [ebp - 0x50]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x80], ecx
movzx ecx, word [ebp - 0x4e]
mov dword [ebp - 0x8c], ecx
movzx ecx, word [ebp - 0x54]
mov dword [ebp - 0x5c], ecx
movzx ecx, word [ebp - 0x52]
neg dword [ebp - 0x5c]
mov dword [ebp - 0x68], ecx
movzx ebx, byte [edi + 5]
movzx ecx, byte [edi]
shl ecx, 8
movzx esi, byte [edi + 1]
or ecx, esi
shl ecx, 8
movzx esi, byte [edi + 2]
or ecx, esi
shl ecx, 8
movzx esi, byte [edi + 3]
or ecx, esi
movzx esi, byte [edi + 4]
shl esi, 8
or esi, ebx
shl esi, 8
movzx ebx, byte [edi + 6]
or esi, ebx
movzx ebx, byte [edi + 7]
xor eax, ecx
shl esi, 8
mov dword [ebp - 0x74], ecx
or esi, ebx
mov ecx, dword [ebp - 0x80]
xor ecx, esi
xor ecx, edx
xor ecx, eax
mov edx, ecx
sub ecx, dword [ebp - 0x54]
add edi, 8
mov ebx, edx
rol ecx, 3
mov dword [ebp - 0x98], esi
movzx esi, word [ebp - 0x50]
imul esi, ecx
rol ebx, 0xa
xor ebx, esi
movzx esi, word [ebp - 0x54]
xor eax, ebx
mov ecx, eax
sub ecx, esi
imul ecx, dword [ebp - 0x68]
mov ebx, eax
shr ebx, 1
sub ecx, ebx
xor edx, ecx
mov ecx, edx
mov ebx, edx
sub ecx, dword [ebp - 0x50]
rol ecx, 1
imul esi, ecx
mov ecx, dword [ebp - 0x54]
rol ebx, 6
sub esi, ebx
xor eax, esi
mov ebx, ecx
mov esi, dword [ebp - 0x50]
xor esi, eax
sub ebx, esi
movzx esi, word [ebp - 0x50]
xor edx, ebx
sub ecx, edx
ror ecx, 6
imul esi, ecx
mov ebx, edx
mov ecx, dword [ebp - 0x50]
ror ebx, 0x10
sub esi, ebx
mov ebx, dword [ebp - 0x68]
xor eax, esi
mov esi, eax
xor ecx, eax
ror ecx, 0xf
imul ebx, ecx
movzx ecx, word [ebp - 0x54]
rol esi, 5
xor esi, ebx
xor edx, esi
mov esi, dword [ebp - 0x68]
xor esi, edx
imul esi, ecx
mov ecx, edx
shr ecx, 0xa
xor esi, ecx
xor eax, esi
mov esi, dword [ebp - 0x68]
mov ecx, eax
xor esi, eax
imul esi, dword [ebp - 0x8c]
ror ecx, 1
sub esi, ecx
mov ecx, dword [ebp - 0x68]
xor edx, esi
xor ecx, edx
mov ebx, edx
movzx esi, word [ebp - 0x50]
rol ecx, 7
imul esi, ecx
ror ebx, 0xe
sub esi, ebx
mov ecx, dword [ebp - 0x5c]
xor eax, esi
add ecx, eax
rol ecx, 7
mov esi, dword [ebp - 0x68]
imul esi, ecx
mov ecx, eax
shr ecx, 0xc
xor esi, ecx
xor edx, esi
mov ebx, edx
movzx esi, word [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
xor ecx, edx
ror ecx, 3
imul esi, ecx
mov cl, byte [ebp - 0x55]
xor edx, dword [ebp - 0x7c]
rol ebx, 1
sub esi, ebx
xor esi, dword [ebp - 0x78]
xor eax, esi
xor cl, al
mov esi, dword [ebp - 0x70]
xor cl, dl
mov byte [esi + 3], al
mov byte [esi + 7], dl
ror eax, 8
xor cl, al
mov byte [esi + 2], al
ror edx, 8
xor cl, dl
ror eax, 8
xor cl, al
mov byte [esi + 6], dl
ror edx, 8
xor cl, dl
mov byte [esi + 1], al
ror eax, 8
mov byte [esi + 5], dl
ror edx, 8
mov bl, dl
xor bl, al
xor cl, bl
mov byte [ebp - 0x55], cl
mov ecx, dword [ebp - 0x74]
mov byte [esi], al
mov byte [esi + 4], dl
add esi, 8
mov dword [ebp - 0x78], ecx
mov ecx, dword [ebp - 0x98]
dec dword [ebp - 0x60]
ror eax, 8
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x70], esi
ror edx, 8
jne 0x41c1c7
mov eax, dword [ebp - 0x88]
mov cl, byte [ebp - 0x55]
cmp cl, byte [eax + 8]
je 0x41c419
call fcn.00405ddc
mov ecx, eax
mov esi, 0x427ab0
mov eax, 0xfffff000
and ecx, eax
mov dword [ebp - 0x60], ecx
mov ecx, dword [ebp - 0x9c]
mov dword [ecx + 8], esi
lea edi, [ecx + 0xc]
and edi, 0xfffffffc
lea ebx, [edi + 0xfff]
and ebx, eax
mov ecx, 0xffff
mov dword [ebp - 0x5c], ecx
xor eax, eax
mov edx, dword [reloc.KERNEL32.dll_GetLastError]
shr dword [ebp - 0x5c], 0x10
imul edx, edx, 0x343fd
add edx, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], edx
shr edx, 0x10
shl eax, 0x10
or eax, edx
cmp dword [ebp - 0x5c], 0
jne 0x41c3ba
xor edx, edx
div ecx
inc edx
cmp edi, ebx
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0xa0]
mov dword [eax], edx
mov dword [eax + 0x1c], ecx
mov dword [ebp - 0x60], 0
mov eax, edi
jae 0x419642
mov ecx, dword [ebp - 0x60]
mov dword [eax], ecx
add eax, 4
cmp eax, ebx
jb 0x41c408
jmp 0x419642
mov edx, dword [0x421858]
mov eax, dword [ebp - 0x90]
sub eax, dword [ebp - 0x94]
mov dword [ebp - 0x80], eax
mov ecx, 0x400000
sub ecx, edx
mov dword [ebp - 0x60], ecx
jne 0x41c442
test eax, eax
je 0x419722
mov ecx, dword [0x4177a0]
mov esi, dword [ebp - 0x94]
mov eax, dword [ebp - 0x84]
mov ebx, dword [ebp - 0x6c]
sub esi, dword [ebp - 0x90]
add eax, ebx
xor edi, edi
dec ecx
mov dword [ebp - 0x8c], eax
js 0x41c491
lea eax, [edi + ecx]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x4177a4]
and edx, 0xfffffff
cmp ebx, edx
jae 0x41c488
lea ecx, [eax - 1]
jmp 0x41c48d
jbe 0x41c495
lea edi, [eax + 1]
cmp ecx, edi
jge 0x41c46a
mov ebx, edi
jmp 0x41c4ee
mov ebx, eax
jmp 0x41c4ee
mov eax, dword [ebx*4 + 0x4177a4]
mov ecx, eax
and ecx, 0xfffffff
cmp ecx, dword [ebp - 0x8c]
jae 0x419722
lea edi, [ecx + esi + 0x400000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x41c4e1
dec ecx
je 0x41c4dc
dec ecx
jne 0x41c4e7
mov edx, dword [ebp - 0x60]
jmp 0x41c4e7
mov edx, dword [ebp - 0x80]
jmp 0x41c4e7
mov edx, dword [ebp - 0x60]
sub edx, dword [ebp - 0x80]
dec eax
dec eax
jne 0x41c4ed
add dword [edi], edx
inc ebx
cmp ebx, dword [0x4177a0]
jb 0x41c499
jmp 0x419722
mov edi, dword [ebp - 0x90]
cmp edi, esi
jb 0x41cb73
mov eax, dword [0x40003c]
mov eax, dword [eax + 0x400050]
add eax, esi
cmp edi, eax
jae 0x41cb73
mov ecx, dword [0x432ad0]
and dword [ebp - 0x5c], 0
sub edi, esi
dec ecx
js 0x41c560
mov eax, dword [ebp - 0x5c]
add eax, ecx
cdq
sub eax, edx
sar eax, 1
lea edx, [eax*8 + 0x432a50]
mov dword [ebp - 0x60], edx
mov edx, dword [edx]
shr edx, 2
and edx, ebx
cmp edi, edx
jae 0x41c551
lea ecx, [eax - 1]
jmp 0x41c55b
jbe 0x41c64e
inc eax
mov dword [ebp - 0x5c], eax
cmp ecx, dword [ebp - 0x5c]
jge 0x41c52d
xor eax, eax
test eax, eax
je 0x41cb73
mov edi, dword [eax + 4]
mov ecx, dword [eax]
shr ecx, 2
and ecx, 7
and edi, ebx
lea ecx, [ecx + eax + 8]
lea eax, [edi + ecx]
mov dword [ebp - 0x80], eax
mov eax, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
sub eax, edi
mov dword [ebp - 0x6c], ecx
sub dword [ebp - 0x6c], esi
mov dword [ebp - 0x90], ecx
lea ecx, [eax + 1]
mov edx, ecx
mov dword [ebp - 0x84], edi
xor eax, eax
test ecx, ecx
je 0x41c5cc
mov esi, dword [reloc.KERNEL32.dll_GetLastError]
imul esi, esi, 0x343fd
add esi, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], esi
shr esi, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, esi
test edx, edx
jne 0x41c5a5
xor edx, edx
div ecx
mov eax, dword [ebp - 0x68]
add edx, eax
push edx
push edi
push dword [ebp - 0x6c]
mov dword [ebp - 0x94], edx
mov eax, 0x2035ea79
mov eax, dword [ebp - 0x80]
mov ebx, dword [eax]
mov esi, dword [ebp - 0x90]
mov eax, dword [eax + 4]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x70], eax
mov eax, edi
add esp, 0xc
and eax, 7
mov byte [ebp - 0x55], 0
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x78], eax
je 0x41c9e2
mov edx, dword [ebp - 0x6c]
xor ecx, ecx
not edx
cmp eax, ecx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
jle 0x41c682
mov dword [ebp - 0x5c], reloc.KERNEL32.dll_GetProcAddress
cmp dword [ebp - 0x64], 4
mov ecx, dword [ebp - 0x5c]
movzx edi, byte [esi]
jge 0x41c66a
add ecx, 0xffffffe0
shl edi, cl
or dword [ebp - 0x68], edi
jmp 0x41c672
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
shr ecx, 2
and ecx, ebx
and eax, 0x3f
lea eax, [ecx + eax + 0x400000]
jmp 0x41c562
shl edi, cl
or dword [ebp - 0x88], edi
sub dword [ebp - 0x5c], 8
inc esi
inc dword [ebp - 0x64]
cmp dword [ebp - 0x64], eax
jl 0x41c638
mov dword [ebp - 0x5c], esi
movzx edi, word [ebp - 0x4a]
mov esi, ebx
xor esi, dword [ebp - 0x48]
xor esi, edx
xor esi, dword [ebp - 0x6c]
mov eax, esi
mov ecx, esi
movzx edx, word [ebp - 0x48]
sub ecx, ebx
mov dword [ebp - 0x60], edx
ror ecx, 0xf
imul edx, ecx
ror eax, 1
xor eax, edx
xor eax, dword [ebp - 0x6c]
mov edx, eax
movzx ecx, bx
mov ebx, edi
mov dword [ebp - 0x8c], ecx
xor ecx, eax
rol ecx, 2
imul ebx, ecx
ror edx, 9
sub ebx, edx
xor esi, ebx
mov ecx, esi
sub ecx, dword [ebp - 0x8c]
sub ecx, dword [ebp - 0x48]
mov dword [ebp - 0x74], edi
xor eax, ecx
mov ebx, edi
mov edx, eax
xor ebx, eax
movzx ecx, word [ebp - 0x46]
imul ebx, ecx
ror edx, 3
add edx, ebx
xor esi, edx
mov edx, esi
ror edx, 6
sub edx, dword [ebp - 0x60]
imul edx, ecx
xor eax, edx
mov ebx, eax
mov edx, dword [ebp - 0x48]
xor edx, eax
rol edx, 1
imul edi, edx
ror ebx, 2
add ebx, edi
mov edx, ecx
movzx edi, word [ebp - 0x4c]
xor esi, ebx
xor edx, esi
mov ebx, esi
rol edx, 7
imul edi, edx
ror ebx, 0xa
add ebx, edi
mov edx, dword [ebp - 0x4c]
xor eax, ebx
mov edi, eax
xor edx, eax
mov ebx, ecx
rol edx, 0xc
imul ebx, edx
mov edx, dword [ebp - 0x60]
rol edi, 0xe
xor edi, ebx
xor esi, edi
mov edi, ecx
xor edi, esi
rol edi, 1
imul edx, edi
mov edi, esi
shr edi, 0xf
add edx, edi
mov edi, dword [ebp - 0x74]
xor eax, edx
mov ebx, eax
mov edx, dword [ebp - 0x48]
sub edx, eax
ror edx, 7
imul edi, edx
and dword [ebp - 0x64], 0
ror ebx, 4
add ebx, edi
xor esi, ebx
mov edi, dword [ebp - 0x78]
xor ecx, esi
mov ebx, dword [ebp - 0x4c]
movzx edx, bx
imul ecx, edx
mov edx, esi
xor esi, dword [ebp - 0x88]
shr edx, 3
add ecx, edx
xor ecx, dword [ebp - 0x68]
mov dword [ebp - 0x98], esi
xor eax, ecx
mov dword [ebp - 0x7c], eax
test edi, edi
jle 0x41c7c5
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
cmp dword [ebp - 0x64], 4
jge 0x41c7ab
rol dword [ebp - 0x7c], 8
mov cl, byte [ebp - 0x7c]
mov byte [edx], cl
jmp 0x41c7ba
rol dword [ebp - 0x98], 8
mov cl, byte [ebp - 0x98]
mov byte [edx], cl
xor byte [ebp - 0x55], cl
inc dword [ebp - 0x64]
cmp dword [ebp - 0x64], edi
jl 0x41c794
add edi, 0xfffffffc
test edi, edi
jle 0x41c9c8
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov edx, esi
mov esi, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x84]
mov ecx, edi
shr ecx, 3
test ecx, ecx
jbe 0x41c9f9
xor ebx, dword [ebp - 0x48]
movzx edi, word [ebp - 0x4a]
mov dword [ebp - 0x74], edi
movzx edi, word [ebp - 0x46]
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x60], ecx
movzx ebx, byte [esi + 5]
movzx ecx, byte [esi]
shl ecx, 8
movzx edi, byte [esi + 1]
or ecx, edi
shl ecx, 8
movzx edi, byte [esi + 2]
or ecx, edi
movzx edi, byte [esi + 3]
shl ecx, 8
or ecx, edi
movzx edi, byte [esi + 4]
shl edi, 8
or edi, ebx
shl edi, 8
movzx ebx, byte [esi + 6]
or edi, ebx
movzx ebx, byte [esi + 7]
mov dword [ebp - 0x7c], ecx
shl edi, 8
or edi, ebx
xor eax, ecx
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x98], edi
xor ecx, edi
movzx edi, word [ebp - 0x48]
xor ecx, edx
xor ecx, eax
mov edx, ecx
mov ebx, edx
sub ecx, dword [ebp - 0x4c]
add esi, 8
ror ecx, 0xf
imul edi, ecx
ror ebx, 1
movzx ecx, word [ebp - 0x4c]
xor ebx, edi
xor eax, ebx
mov ebx, dword [ebp - 0x74]
xor ecx, eax
rol ecx, 2
imul ebx, ecx
mov edi, eax
ror edi, 9
sub ebx, edi
movzx ecx, word [ebp - 0x4c]
xor edx, ebx
mov ebx, dword [ebp - 0x74]
mov edi, edx
sub edi, ecx
sub edi, dword [ebp - 0x48]
xor eax, edi
mov ecx, eax
mov edi, dword [ebp - 0x74]
xor edi, eax
imul edi, dword [ebp - 0x78]
ror ecx, 3
add ecx, edi
xor edx, ecx
mov edi, edx
ror edi, 6
movzx ecx, word [ebp - 0x48]
sub edi, ecx
imul edi, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x48]
xor eax, edi
xor ecx, eax
rol ecx, 1
imul ebx, ecx
mov edi, eax
mov ecx, dword [ebp - 0x78]
ror edi, 2
add edi, ebx
xor edx, edi
xor ecx, edx
movzx edi, word [ebp - 0x4c]
mov ebx, edx
rol ecx, 7
imul edi, ecx
mov ecx, dword [ebp - 0x4c]
ror ebx, 0xa
add ebx, edi
xor eax, ebx
mov ebx, dword [ebp - 0x78]
mov edi, eax
xor ecx, eax
rol ecx, 0xc
imul ebx, ecx
rol edi, 0xe
xor edi, ebx
mov ecx, dword [ebp - 0x78]
xor edx, edi
xor ecx, edx
rol ecx, 1
movzx edi, word [ebp - 0x48]
mov ebx, dword [ebp - 0x74]
imul edi, ecx
mov ecx, edx
shr ecx, 0xf
add edi, ecx
mov ecx, dword [ebp - 0x48]
xor eax, edi
sub ecx, eax
ror ecx, 7
mov edi, eax
imul ebx, ecx
ror edi, 4
add edi, ebx
movzx ecx, word [ebp - 0x4c]
xor edx, edi
mov edi, dword [ebp - 0x78]
xor edi, edx
imul edi, ecx
mov ecx, edx
xor edx, dword [ebp - 0x88]
shr ecx, 3
add edi, ecx
xor edi, dword [ebp - 0x68]
xor eax, edi
mov edi, dword [ebp - 0x70]
mov cl, byte [ebp - 0x55]
xor cl, al
xor cl, dl
mov byte [edi + 3], al
mov byte [edi + 7], dl
ror eax, 8
xor cl, al
ror edx, 8
xor cl, dl
mov byte [edi + 2], al
mov byte [edi + 6], dl
ror eax, 8
mov byte [edi + 1], al
xor cl, al
ror edx, 8
mov byte [edi + 5], dl
ror eax, 8
xor cl, dl
ror edx, 8
mov bl, dl
xor bl, al
xor cl, bl
mov ebx, dword [ebp - 0x7c]
mov byte [edi], al
mov byte [edi + 4], dl
add edi, 8
mov dword [ebp - 0x68], ebx
mov ebx, dword [ebp - 0x98]
dec dword [ebp - 0x60]
ror eax, 8
ror edx, 8
mov byte [ebp - 0x55], cl
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x70], edi
jne 0x41c80e
mov edi, dword [ebp - 0x84]
jmp 0x41c9fc
xor edx, edx
test edi, edi
jge 0x41c7de
neg edi
shl edi, 3
mov ecx, edi
shr eax, cl
shl eax, cl
jmp 0x41c7de
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x68], eax
not eax
xor edx, edx
mov dword [ebp - 0x88], eax
xor eax, eax
jmp 0x41c7e7
mov cl, byte [ebp - 0x55]
mov eax, dword [ebp - 0x80]
cmp cl, byte [eax + 8]
je 0x41ca96
call fcn.00405ddc
mov esi, 0x427ab0
mov ecx, eax
mov eax, 0xfffff000
and ecx, eax
mov dword [ebp - 0x60], ecx
mov ecx, dword [ebp - 0x9c]
lea edi, [ecx + 0xc]
and edi, 0xfffffffc
lea ebx, [edi + 0xfff]
and ebx, eax
xor eax, eax
mov dword [ecx + 8], esi
mov ecx, 0xffff
mov dword [ebp - 0x5c], ecx
mov edx, dword [reloc.KERNEL32.dll_GetLastError]
shr dword [ebp - 0x5c], 0x10
imul edx, edx, 0x343fd
add edx, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], edx
shr edx, 0x10
shl eax, 0x10
or eax, edx
cmp dword [ebp - 0x5c], 0
jne 0x41ca3f
xor edx, edx
div ecx
mov eax, dword [ebp - 0xa0]
inc edx
mov ecx, dword [ebp - 0x60]
mov dword [eax], edx
mov dword [eax + 0x1c], ecx
mov dword [ebp - 0x60], 0
jmp 0x41ca8d
mov eax, dword [ebp - 0x60]
mov dword [edi], eax
add edi, 4
cmp edi, ebx
jb 0x41ca85
jmp 0x419642
mov edx, dword [0x421858]
mov ecx, 0x400000
mov eax, dword [ebp - 0x90]
sub eax, dword [ebp - 0x94]
mov dword [ebp - 0x80], eax
sub ecx, edx
mov dword [ebp - 0x60], ecx
jne 0x41cabf
test eax, eax
je 0x419722
mov esi, dword [ebp - 0x94]
mov ebx, dword [ebp - 0x6c]
mov ecx, dword [0x4177a0]
lea eax, [edi + ebx]
sub esi, dword [ebp - 0x90]
xor edi, edi
dec ecx
mov dword [ebp - 0x8c], eax
js 0x41cb09
lea eax, [edi + ecx]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x4177a4]
and edx, 0xfffffff
cmp ebx, edx
jae 0x41cb00
lea ecx, [eax - 1]
jmp 0x41cb05
jbe 0x41cb0d
lea edi, [eax + 1]
cmp ecx, edi
jge 0x41cae2
mov ebx, edi
jmp 0x41cb66
mov ebx, eax
jmp 0x41cb66
mov eax, dword [ebx*4 + 0x4177a4]
mov ecx, eax
and ecx, 0xfffffff
cmp ecx, dword [ebp - 0x8c]
jae 0x419722
lea edi, [ecx + esi + 0x400000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x41cb59
dec ecx
je 0x41cb54
dec ecx
jne 0x41cb5f
mov edx, dword [ebp - 0x60]
jmp 0x41cb5f
mov edx, dword [ebp - 0x80]
jmp 0x41cb5f
mov edx, dword [ebp - 0x60]
sub edx, dword [ebp - 0x80]
dec eax
dec eax
jne 0x41cb65
add dword [edi], edx
inc ebx
cmp ebx, dword [0x4177a0]
jb 0x41cb11
jmp 0x419722
mov edi, dword [ebp - 0x90]
cmp edi, esi
jb 0x41d1d1
mov eax, dword [0x40003c]
mov eax, dword [eax + 0x400050]
add eax, esi
cmp edi, eax
jae 0x41d1d1
mov ecx, dword [0x4086fc]
and dword [ebp - 0x5c], 0
sub edi, esi
dec ecx
js 0x41cbd5
mov eax, dword [ebp - 0x5c]
add eax, ecx
cdq
sub eax, edx
sar eax, 1
lea edx, [eax*8 + fcn.00426960]
mov dword [ebp - 0x60], edx
mov edx, dword [edx]
and edx, ebx
cmp edi, edx
jae 0x41cbc6
lea ecx, [eax - 1]
jmp 0x41cbd0
jbe 0x41ccbd
inc eax
mov dword [ebp - 0x5c], eax
cmp ecx, dword [ebp - 0x5c]
jge 0x41cba5
xor ecx, ecx
test ecx, ecx
je 0x41d1d1
mov eax, dword [ecx]
mov edx, eax
shr eax, 1
and eax, ebx
shr edx, 0x1d
lea ecx, [edx + ecx + 8]
mov edx, eax
mov eax, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
lea ebx, [ecx + edx]
mov dword [ebp - 0x6c], ecx
sub eax, edx
sub dword [ebp - 0x6c], esi
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0xa4], ebx
lea ecx, [eax + 1]
xor eax, eax
test ecx, ecx
mov edx, ecx
je 0x41cc44
mov esi, dword [reloc.KERNEL32.dll_GetLastError]
imul esi, esi, 0x343fd
add esi, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], esi
shr esi, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, esi
test edx, edx
jne 0x41cc1d
xor edx, edx
div ecx
mov eax, dword [ebp - 0x68]
lea edi, [eax + edx]
push edi
push dword [ebp - 0x84]
mov dword [ebp - 0x7c], edi
push dword [ebp - 0x6c]
mov eax, 0x78704e51
mov eax, dword [ebx]
mov esi, dword [ebp - 0x90]
mov dword [ebp - 0x44], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x84]
add esp, 0xc
and eax, 7
mov byte [ebp - 0x55], 0
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x60], eax
je 0x41ce57
mov edi, dword [ebp - 0x6c]
xor ecx, ecx
mov dword [ebp - 0x74], ecx
cmp eax, ecx
not edi
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x64], ecx
jle 0x41cce9
push reloc.KERNEL32.dll_GetProcAddress
pop edx
movzx ebx, byte [esi]
cmp dword [ebp - 0x64], 4
jge 0x41ccd6
lea ecx, [edx - 0x20]
shl ebx, cl
or dword [ebp - 0x98], ebx
jmp 0x41ccdd
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 4]
and ecx, 0x3f
mov eax, dword [eax]
and eax, ebx
lea ecx, [ecx + eax + 0x400000]
jmp 0x41cbd7
mov ecx, edx
shl ebx, cl
or dword [ebp - 0x74], ebx
inc esi
inc dword [ebp - 0x64]
sub edx, 8
cmp dword [ebp - 0x64], eax
jl 0x41cca7
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x6c]
movzx edx, word [ebp - 0x3e]
sub ecx, eax
sub ecx, edx
xor edi, ecx
mov ebx, edi
add eax, edi
movzx ecx, word [ebp - 0x40]
ror eax, 0xc
imul eax, ecx
rol ebx, 9
sub eax, ebx
xor eax, dword [ebp - 0x6c]
mov ecx, eax
mov ebx, eax
xor ecx, edx
rol ecx, 6
movzx edx, word [ebp - 0x42]
imul ecx, edx
movzx edx, word [ebp - 0x44]
rol ebx, 0xc
sub ecx, ebx
xor edi, ecx
mov ebx, edi
mov ecx, dword [ebp - 0x40]
xor ecx, edi
ror ecx, 0xf
imul ecx, edx
ror ebx, 0xe
xor ebx, ecx
movzx ecx, word [ebp - 0x3e]
xor eax, ebx
mov ebx, eax
ror ebx, 4
sub ebx, ecx
imul ebx, edx
mov ecx, dword [ebp - 0x40]
xor ecx, dword [ebp - 0x44]
xor edi, ebx
xor ecx, edi
xor eax, ecx
movzx ecx, word [ebp - 0x42]
mov ebx, eax
sub ebx, edx
imul ebx, ecx
mov ecx, eax
shr ecx, 8
sub ebx, ecx
mov ecx, dword [ebp - 0x40]
xor edi, ebx
mov ebx, edi
sub ecx, edi
ror ecx, 2
imul ecx, edx
rol ebx, 0xd
xor ebx, ecx
xor eax, ebx
movzx ecx, word [ebp - 0x3e]
mov ebx, eax
ror ebx, 0xe
xor ebx, ecx
imul ebx, edx
xor edi, ebx
mov ebx, edi
mov ecx, edi
xor ecx, edx
rol ecx, 7
movzx edx, word [ebp - 0x40]
imul ecx, edx
rol ebx, 1
add ebx, ecx
xor eax, ebx
movzx ebx, word [ebp - 0x3e]
mov ecx, eax
sub ecx, ebx
rol ecx, 7
movzx ebx, word [ebp - 0x42]
imul ecx, ebx
mov ebx, eax
shr ebx, 4
xor ecx, ebx
xor edi, ecx
mov ebx, edi
and dword [ebp - 0x64], 0
mov ecx, edi
xor ecx, edx
rol ecx, 4
movzx edx, word [ebp - 0x44]
imul ecx, edx
xor edi, dword [ebp - 0x74]
ror ebx, 4
xor ebx, ecx
xor ebx, dword [ebp - 0x98]
xor eax, ebx
mov ebx, dword [ebp - 0x60]
mov ecx, edi
test ebx, ebx
mov dword [ebp - 0x88], eax
jle 0x41ce2d
cmp dword [ebp - 0x64], 4
jge 0x41ce14
rol dword [ebp - 0x88], 8
mov dl, byte [ebp - 0x88]
mov ebx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
xor byte [ebp - 0x55], dl
mov byte [ebx], dl
jmp 0x41ce22
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
rol ecx, 8
xor byte [ebp - 0x55], cl
mov byte [edx], cl
inc dword [ebp - 0x64]
mov ebx, dword [ebp - 0x60]
cmp dword [ebp - 0x64], ebx
jl 0x41cdf4
add ebx, 0xfffffffc
test ebx, ebx
jle 0x41ce44
push 4
pop ecx
sub ecx, ebx
shl ecx, 3
shr edi, cl
shl edi, cl
mov edx, edi
jmp 0x41ce69
xor edx, edx
test ebx, ebx
jge 0x41ce69
neg ebx
shl ebx, 3
mov ecx, ebx
shr eax, cl
shl eax, cl
jmp 0x41ce69
xor edx, edx
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x98], eax
not eax
mov dword [ebp - 0x74], eax
xor eax, eax
mov ecx, dword [ebp - 0x84]
shr ecx, 3
test ecx, ecx
jbe 0x41d040
mov edi, dword [ebp - 0x40]
xor edi, dword [ebp - 0x44]
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x80], edi
movzx edi, word [ebp - 0x3e]
mov dword [ebp - 0x94], edi
neg dword [ebp - 0x94]
mov dword [ebp - 0x5c], edi
movzx edi, word [ebp - 0x42]
mov dword [ebp - 0x78], edi
movzx ecx, byte [esi]
movzx ebx, byte [esi + 5]
movzx edi, byte [esi + 1]
shl ecx, 8
or ecx, edi
shl ecx, 8
movzx edi, byte [esi + 2]
or ecx, edi
shl ecx, 8
movzx edi, byte [esi + 3]
or ecx, edi
movzx edi, byte [esi + 4]
xor eax, ecx
shl edi, 8
mov dword [ebp - 0x88], ecx
mov ecx, dword [ebp - 0x44]
or edi, ebx
shl edi, 8
movzx ebx, byte [esi + 6]
or edi, ebx
shl edi, 8
movzx ebx, byte [esi + 7]
or edi, ebx
mov ebx, eax
sub ebx, ecx
sub ebx, dword [ebp - 0x5c]
mov dword [ebp - 0x8c], edi
add esi, 8
xor ebx, edi
xor edx, ebx
add ecx, edx
mov ebx, edx
ror ecx, 0xc
movzx edi, word [ebp - 0x40]
imul ecx, edi
rol ebx, 9
sub ecx, ebx
xor eax, ecx
mov edi, eax
mov ecx, eax
xor ecx, dword [ebp - 0x5c]
rol ecx, 6
imul ecx, dword [ebp - 0x78]
rol edi, 0xc
sub ecx, edi
movzx edi, word [ebp - 0x44]
xor edx, ecx
mov ebx, edx
mov ecx, dword [ebp - 0x40]
xor ecx, edx
ror ecx, 0xf
imul ecx, edi
ror ebx, 0xe
xor ebx, ecx
xor eax, ebx
mov ecx, eax
ror ecx, 4
sub ecx, dword [ebp - 0x5c]
imul ecx, edi
xor edx, ecx
mov ecx, edx
xor ecx, eax
xor ecx, dword [ebp - 0x80]
mov eax, ecx
sub ecx, edi
imul ecx, dword [ebp - 0x78]
mov ebx, eax
shr ebx, 8
sub ecx, ebx
xor edx, ecx
mov ecx, dword [ebp - 0x40]
mov ebx, edx
sub ecx, edx
ror ecx, 2
imul ecx, edi
rol ebx, 0xd
xor ebx, ecx
xor eax, ebx
mov ecx, eax
ror ecx, 0xe
xor ecx, dword [ebp - 0x5c]
imul ecx, edi
xor edx, ecx
mov ecx, edx
xor ecx, edi
mov ebx, edx
movzx edi, word [ebp - 0x40]
rol ecx, 7
imul ecx, edi
rol ebx, 1
add ebx, ecx
xor eax, ebx
mov ebx, eax
mov ecx, dword [ebp - 0x94]
add ecx, eax
rol ecx, 7
imul ecx, dword [ebp - 0x78]
shr ebx, 4
xor ecx, ebx
xor edx, ecx
mov ebx, edx
mov ecx, edx
xor ecx, edi
movzx edi, word [ebp - 0x44]
rol ecx, 4
imul ecx, edi
mov edi, dword [ebp - 0x70]
xor edx, dword [ebp - 0x74]
ror ebx, 4
xor ebx, ecx
xor ebx, dword [ebp - 0x98]
mov cl, byte [ebp - 0x55]
xor eax, ebx
xor cl, al
xor cl, dl
mov byte [edi + 3], al
mov byte [edi + 7], dl
ror eax, 8
mov byte [edi + 2], al
xor cl, al
ror edx, 8
xor cl, dl
ror eax, 8
mov byte [edi + 6], dl
mov byte [edi + 1], al
xor cl, al
ror edx, 8
xor cl, dl
mov byte [edi + 5], dl
ror eax, 8
ror edx, 8
mov bl, dl
xor bl, al
xor cl, bl
mov byte [ebp - 0x55], cl
mov ecx, dword [ebp - 0x88]
mov byte [edi], al
mov byte [edi + 4], dl
add edi, 8
mov dword [ebp - 0x98], ecx
mov ecx, dword [ebp - 0x8c]
dec dword [ebp - 0x60]
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], edi
ror eax, 8
ror edx, 8
jne 0x41cea0
mov ecx, dword [ebp - 0xa4]
mov al, byte [ebp - 0x55]
cmp al, byte [ecx + 8]
je 0x41d0ec
call fcn.00405ddc
mov ecx, eax
mov eax, 0xfffff000
mov esi, 0x427ab0
and ecx, eax
mov dword [ebp - 0xa4], ecx
mov ecx, dword [ebp - 0x9c]
lea edi, [ecx + 0xc]
and edi, 0xfffffffc
mov dword [ecx + 8], esi
lea ebx, [edi + 0xfff]
mov ecx, 0xffff
and ebx, eax
xor eax, eax
mov dword [ebp - 0x5c], ecx
mov edx, dword [reloc.KERNEL32.dll_GetLastError]
shr dword [ebp - 0x5c], 0x10
imul edx, edx, 0x343fd
add edx, reloc.KERNEL32.dll_K32EnumProcessModules
mov dword [reloc.KERNEL32.dll_GetLastError], edx
shr edx, 0x10
shl eax, 0x10
or eax, edx
cmp dword [ebp - 0x5c], 0
jne 0x41d08c
xor edx, edx
div ecx
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa0]
inc edx
mov dword [eax], edx
mov dword [eax + 0x1c], ecx
mov dword [ebp - 0xa4], 0
jmp 0x41d0e3
mov eax, dword [ebp - 0xa4]
mov dword [edi], eax
add edi, 4
cmp edi, ebx
jb 0x41d0d8
jmp 0x419642
mov edx, dword [0x421858]
mov eax, dword [ebp - 0x90]
mov ecx, 0x400000
sub eax, dword [ebp - 0x7c]
sub ecx, edx
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x60], ecx
jne 0x41d112
test eax, eax
je 0x41d1bf
mov eax, dword [ebp - 0x84]
mov ebx, dword [ebp - 0x6c]
mov ecx, dword [0x4177a0]
mov esi, dword [ebp - 0x7c]
sub esi, dword [ebp - 0x90]
add eax, ebx
mov dword [ebp - 0xa4], eax
xor edi, edi
dec ecx
js 0x41d15e
lea eax, [edi + ecx]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x4177a4]
and edx, 0xfffffff
cmp ebx, edx
jae 0x41d155
lea ecx, [eax - 1]
jmp 0x41d15a
jbe 0x41d162
lea edi, [eax + 1]
cmp ecx, edi
jge 0x41d137
mov ebx, edi
jmp 0x41d1b7
mov ebx, eax
jmp 0x41d1b7
mov eax, dword [ebx*4 + 0x4177a4]
mov ecx, eax
and ecx, 0xfffffff
cmp ecx, dword [ebp - 0xa4]
jae 0x41d1bf
lea edi, [ecx + esi + 0x400000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x41d1aa
dec ecx
je 0x41d1a5
dec ecx
jne 0x41d1b0
mov edx, dword [ebp - 0x60]
jmp 0x41d1b0
mov edx, dword [ebp - 0x80]
jmp 0x41d1b0
mov edx, dword [ebp - 0x60]
sub edx, dword [ebp - 0x80]
dec eax
dec eax
jne 0x41d1b6
add dword [edi], edx
inc ebx
cmp ebx, dword [0x4177a0]
jb 0x41d166
mov eax, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
mov eax, 0x95cac741
mov eax, dword [ebp - 0x7c]
jmp 0x41d263
mov eax, 0x4f2968d4
mov esi, section..data
mov edi, dword [ebp - 0x68]
cmp edi, esi
jb 0x41d219
mov ecx, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [0x431be8]
imul eax, ecx
lea eax, [eax + section..data]
cmp edi, eax
jae 0x41d219
mov eax, edi
mov ecx, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
sub eax, esi
xor edx, edx
div ecx
mov ecx, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
imul ecx, eax
lea ecx, [ecx + section..data]
jmp 0x41d21b
xor ecx, ecx
test ecx, ecx
je 0x41d240
mov ecx, dword [reloc.KERNEL32.dll_QueryDosDeviceW]
mov eax, edi
sub eax, esi
xor edx, edx
div ecx
mov ecx, dword [0x431be8]
mov dword [eax*4 + 0x443368], 0xf443
jmp 0x41d25d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x8000
mov esi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
xor ecx, ebp
call fcn.004217ea
leave
ret 0x10