Function at 0x4c8dc0
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x6c19b5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2a8
push ebx
push ebp
push esi
xor esi, esi
push edi
mov ebp, ecx
mov dword [esp + 0x88], esi
mov al, byte [esp + 0x3e]
push esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x2c4], 1
mov byte [esp + 0x20], al
call fcn.004138c0
mov cl, byte [esp + 0x3e]
push esi
mov byte [esp + 0x7c], cl
lea ecx, [esp + 0x7c]
mov byte [esp + 0x2c4], 2
call fcn.004138c0
mov edi, str.______
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea ecx, [esp + 0x7c]
push ebx
call fcn.00414230
test al, al
je 0x4c8e6c
mov edi, dword [esp + 0x7c]
mov ecx, ebx
mov edx, ecx
mov esi, str.______
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x80], ebx
xor esi, esi
mov byte [eax + ebx], 0
mov cl, byte [esp + 0x3e]
mov dword [esp + 0x54], esi
mov byte [esp + 0x50], cl
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
lea ecx, [esp + 0x44]
mov byte [esp + 0x2c0], 4
call fcn.0061d780
lea ecx, [esp + 0x40]
mov byte [esp + 0x2c0], 5
call fcn.0061d780
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c0], 6
call fcn.0061d780
lea ecx, [esp + 0x60]
mov byte [esp + 0x2c0], 7
call fcn.0061d780
lea ecx, [esp + 0x48]
mov byte [esp + 0x2c0], 8
call fcn.0061d780
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2c0], 9
call fcn.0061d780
mov eax, dword [esp + 0x2d4]
mov byte [esp + 0x2c0], 0xa
cmp eax, esi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], esi
mov dword [esp + 0x30], esi
je 0x4c8f22
mov ebx, dword [esp + 0x2d8]
sub ebx, eax
sar ebx, 2
cmp bl, 0xa
mov byte [esp + 0x74], bl
jae 0x4c9063
mov edi, dword [esp + 0x2c8]
mov dl, byte [esp + 0x78]
xor ebp, ebp
mov ecx, edi
push ebp
mov byte [edi], dl
call fcn.004138c0
mov eax, dword [0x6dd1fc]
lea ecx, [esp + 0x78]
push eax
push ebp
push ecx
mov ecx, edi
call fcn.004136c0
mov dword [esp + 0x88], 1
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2c0], 9
call fcn.0061d8c0
lea ecx, [esp + 0x48]
mov byte [esp + 0x2c0], 8
call fcn.0061d8c0
lea ecx, [esp + 0x60]
mov byte [esp + 0x2c0], 7
call fcn.0061d8c0
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c0], 6
call fcn.0061d8c0
lea ecx, [esp + 0x40]
mov byte [esp + 0x2c0], 5
call fcn.0061d8c0
lea ecx, [esp + 0x44]
mov byte [esp + 0x2c0], 4
call fcn.0061d8c0
mov eax, dword [esp + 0x58]
mov esi, dword [esp + 0x54]
cmp esi, eax
mov byte [esp + 0x2c0], 3
mov ebx, eax
je 0x4c8fe6
push ebp
mov ecx, esi
call fcn.004cb790
add esi, 0x10
cmp esi, ebx
jne 0x4c8fd3
mov esi, dword [esp + 0x54]
push esi
call fcn.006a64d0
add esp, 4
lea ecx, [esp + 0x78]
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
push 1
mov dword [esp + 0x60], ebp
mov byte [esp + 0x2c4], 2
call fcn.004138c0
push 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2c4], 1
call fcn.004138c0
mov eax, dword [esp + 0x2d8]
mov esi, dword [esp + 0x2d4]
cmp esi, eax
mov byte [esp + 0x2c0], 0
mov ebx, eax
je 0x4c9053
push ebp
mov ecx, esi
call fcn.00415c90
add esi, 4
cmp esi, ebx
jne 0x4c903d
mov esi, dword [esp + 0x2d4]
push esi
call fcn.006a64d0
add esp, 4
mov eax, edi
jmp 0x4ca383
push ecx
mov ecx, dword [esp + 0x2d0]
mov edx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.0061afb0
lea ecx, [esp + 0x50]
call fcn.0061dab0
lea ecx, [esp + 0x4c]
call fcn.0061dc40
mov esi, eax
push 0xffffffffffffffff
lea eax, [esp + 0x1bc]
push 0
push eax
lea ecx, [esp + 0x58]
call fcn.0061dc70
push 2
lea ecx, [esp + 0x2d4]
call fcn.00690c60
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0061d790
lea ecx, [esp + 0x4c]
call fcn.0061dab0
push 6
lea ecx, [esp + 0x2d4]
call fcn.00690c60
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0061d790
lea ecx, [esp + 0x48]
call fcn.0061dab0
push 7
lea ecx, [esp + 0x2d4]
call fcn.00690c60
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0061d790
lea ecx, [esp + 0x44]
call fcn.0061dab0
lea ecx, [esp + 0x40]
call fcn.0061dc40
push ecx
mov edi, eax
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0
mov dword [esp + 0x1c], edi
call fcn.0061d7b0
lea ecx, [esp + 0x14]
call fcn.0061dab0
push 0
lea ecx, [esp + 0x48]
call fcn.0061daa0
movsx ecx, di
and eax, 0xff
movsx edx, si
add eax, ecx
cmp eax, edx
jle 0x4c9165
push 0
lea ecx, [esp + 0x48]
call fcn.0061daa0
movzx ax, al
sub esi, eax
mov edi, esi
mov dword [esp + 0x14], edi
test di, di
jge 0x4c92af
mov edi, dword [esp + 0x2c8]
mov cl, byte [esp + 0x78]
xor ebp, ebp
mov byte [edi], cl
push ebp
mov ecx, edi
call fcn.004138c0
mov edx, dword [0x6dd1fc]
lea eax, [esp + 0x78]
push edx
push ebp
push eax
mov ecx, edi
call fcn.004136c0
lea ecx, [esp + 0x4c]
mov dword [esp + 0x88], 1
mov byte [esp + 0x2c0], 9
call fcn.0061d8c0
lea ecx, [esp + 0x48]
mov byte [esp + 0x2c0], 8
call fcn.0061d8c0
lea ecx, [esp + 0x60]
mov byte [esp + 0x2c0], 7
call fcn.0061d8c0
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c0], 6
call fcn.0061d8c0
lea ecx, [esp + 0x40]
mov byte [esp + 0x2c0], 5
call fcn.0061d8c0
lea ecx, [esp + 0x44]
mov byte [esp + 0x2c0], 4
call fcn.0061d8c0
mov eax, dword [esp + 0x58]
mov esi, dword [esp + 0x54]
cmp esi, eax
mov byte [esp + 0x2c0], 3
mov ebx, eax
je 0x4c9233
push ebp
mov ecx, esi
call fcn.004cb790
add esi, 0x10
cmp esi, ebx
jne 0x4c9220
mov esi, dword [esp + 0x54]
push esi
call fcn.006a64d0
add esp, 4
lea ecx, [esp + 0x78]
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
push 1
mov dword [esp + 0x60], ebp
mov byte [esp + 0x2c4], 2
call fcn.004138c0
push 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2c4], 1
call fcn.004138c0
mov eax, dword [esp + 0x2d8]
mov esi, dword [esp + 0x2d4]
cmp esi, eax
mov byte [esp + 0x2c0], 0
mov ebx, eax
je 0x4c929f
mov ecx, esi
call fcn.0061d8c0
add esi, 4
cmp esi, ebx
jne 0x4c928a
mov esi, dword [esp + 0x2d4]
push esi
call fcn.006a64d0
add esp, 4
mov eax, edi
jmp 0x4ca383
xor esi, esi
test di, di
jle 0x4c92ef
push esi
lea ecx, [esp + 0x48]
call fcn.0061daa0
mov bl, al
push esi
lea ecx, [esp + 0x44]
and ebx, 0xff
call fcn.0061daa0
mov cl, byte [esp + ebx + 0x1b8]
and cl, al
push ecx
lea ecx, [esp + 0x14]
call fcn.0061dc20
inc esi
cmp si, di
jl 0x4c92b6
mov bl, byte [esp + 0x74]
lea ecx, [esp + 0x48]
call fcn.0061dc40
cmp ax, 6
jle 0x4c94ac
lea edx, [esp + 0x50]
lea eax, [esp + 0x48]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0061d790
mov ecx, ebp
call fcn.004c8a30
test eax, eax
jne 0x4c94ac
mov edi, dword [esp + 0x2c8]
mov cl, byte [esp + 0x78]
xor ebp, ebp
mov byte [edi], cl
push ebp
mov ecx, edi
call fcn.004138c0
mov edx, dword [0x6dd1fc]
lea eax, [esp + 0x78]
push edx
push ebp
push eax
mov ecx, edi
call fcn.004136c0
lea ecx, [esp + 0x4c]
mov dword [esp + 0x88], 1
mov byte [esp + 0x2c0], 9
call fcn.0061d8c0
lea ecx, [esp + 0x48]
mov byte [esp + 0x2c0], 8
call fcn.0061d8c0
lea ecx, [esp + 0x60]
mov byte [esp + 0x2c0], 7
call fcn.0061d8c0
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c0], 6
call fcn.0061d8c0
lea ecx, [esp + 0x40]
mov byte [esp + 0x2c0], 5
call fcn.0061d8c0
lea ecx, [esp + 0x44]
mov byte [esp + 0x2c0], 4
call fcn.0061d8c0
mov eax, dword [esp + 0x58]
mov esi, dword [esp + 0x54]
cmp esi, eax
mov byte [esp + 0x2c0], 3
mov ebx, eax
je 0x4c93ed
push 1
mov ecx, esi
call fcn.004138c0
add esi, 0x10
cmp esi, ebx
jne 0x4c93d9
mov esi, dword [esp + 0x54]
push esi
call fcn.006a64d0
mov eax, dword [esp + 0x80]
add esp, 4
cmp eax, ebp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], ebp
je 0x4c942a
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x4c9421
cmp al, 0xff
je 0x4c9421
dec al
mov byte [ecx], al
jmp 0x4c942a
push ecx
call fcn.006a64d0
add esp, 4
mov eax, dword [esp + 0x20]
mov dword [esp + 0x7c], ebp
cmp eax, ebp
mov dword [esp + 0x80], ebp
mov dword [esp + 0x84], ebp
je 0x4c9461
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x4c9458
cmp al, 0xff
je 0x4c9458
dec al
mov byte [ecx], al
jmp 0x4c9461
push ecx
call fcn.006a64d0
add esp, 4
mov ebx, dword [esp + 0x2d8]
mov esi, dword [esp + 0x2d4]
cmp esi, ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov byte [esp + 0x2c0], 0
je 0x4c949c
mov ecx, esi
call fcn.0061d8c0
add esi, 4
cmp esi, ebx
jne 0x4c9487
mov esi, dword [esp + 0x2d4]
push esi
call fcn.006a64d0
add esp, 4
mov eax, edi
jmp 0x4ca383
xor ax, ax
mov dword [esp + 0x2c], 8
mov al, bl
cmp ax, 8
mov word [esp + 0x3e], ax
jle 0x4ca13d
mov ebp, dword [esp + 0x30]
movsx edi, word [esp + 0x2c]
push edi
lea ecx, [esp + 0x2d4]
call fcn.00690c60
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.0061d790
lea ecx, [esp + 0x64]
call fcn.0061dab0
xor ebx, ebx
push 0xffffffffffffffff
lea ecx, [esp + 0x90]
push ebx
push ecx
lea ecx, [esp + 0x6c]
call fcn.0061dc90
mov esi, str.CTEM_STATUS
lea eax, [esp + 0x8c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4c953a
test cl, cl
je 0x4c9536
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4c953a
add eax, 2
add esi, 2
test cl, cl
jne 0x4c9516
xor eax, eax
jmp 0x4c953f
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4c96cf
mov ecx, dword [esp + 0x74]
lea eax, [edi + 3]
and ecx, 0xff
cmp eax, ecx
jg 0x4ca13d
mov eax, dword [esp + 0x2d4]
push 0xffffffffffffffff
lea edx, [esp + 0x90]
push ebx
push edx
lea ecx, [eax + edi*4 + 4]
call fcn.0061dc90
mov esi, str.default
lea eax, [esp + 0x8c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4c95a7
test cl, cl
je 0x4c95a3
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4c95a7
add eax, 2
add esi, 2
test cl, cl
jne 0x4c9583
xor eax, eax
jmp 0x4c95ac
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4c9669
lea eax, [esp + 0x8c]
push eax
call fcn.006a7714
mov edx, dword [esp + 0x2d8]
add esp, 4
lea ecx, [esp + 0x8c]
mov dword [esp + 0x64], eax
push 0xffffffffffffffff
push ebx
push ecx
lea ecx, [edx + edi*4 + 8]
call fcn.0061dc90
lea eax, [esp + 0x8c]
push eax
call fcn.006a7714
mov ecx, dword [esp + 0x18]
add esp, 4
xor ebp, ebp
mov dword [esp + 0x68], eax
lea esi, [ecx - 1]
mov dword [esp + 0x30], ebp
cmp si, bx
mov dword [esp + 0x34], ebx
jl 0x4c9669
push esi
lea ecx, [esp + 0x44]
call fcn.0061daa0
xor ebx, ebx
push esi
lea ecx, [esp + 0x44]
call fcn.0061daa0
mov cl, bl
shr al, cl
test al, 1
je 0x4c9658
push esi
lea ecx, [esp + 0x14]
call fcn.0061daa0
mov cl, bl
shr al, cl
and al, 1
mov byte [esp + 0x18], al
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x18]
mov cl, al
and edx, 0xff
shl edx, cl
add ebp, edx
inc eax
mov dword [esp + 0x34], eax
inc ebx
cmp bx, 8
jl 0x4c9619
dec esi
test si, si
jge 0x4c960d
mov dword [esp + 0x30], ebp
cmp ebp, dword [esp + 0x64]
jb 0x4c9679
cmp ebp, dword [esp + 0x68]
jbe 0x4c9a00
mov esi, str.default
lea eax, [esp + 0x8c]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4c96ad
test cl, cl
je 0x4c96a9
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4c96ad
add eax, 2
add esi, 2
test cl, cl
jne 0x4c9685
xor eax, eax
jmp 0x4c96b2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4c9a00
mov ecx, dword [esp + 0x6c]
mov eax, dword [esp + 0x2c]
inc ecx
add eax, 3
mov dword [esp + 0x6c], ecx
jmp 0x4c99ec
mov esi, str.CTEM_LINEARITY
lea eax, [esp + 0x8c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4c96ff
test cl, cl
je 0x4c96fb
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4c96ff
add eax, 2
add esi, 2
test cl, cl
jne 0x4c96db
xor eax, eax
jmp 0x4c9704
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4c9860
mov ecx, dword [esp + 0x74]
lea eax, [edi + 9]
and ecx, 0xff
cmp eax, ecx
jg 0x4ca13d
mov eax, dword [esp + 0x2d4]
push 0xffffffffffffffff
lea edx, [esp + 0x90]
push ebx
push edx
lea ecx, [eax + edi*4 + 4]
call fcn.0061dc90
mov esi, str.default
lea eax, [esp + 0x8c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4c976c
test cl, cl
je 0x4c9768
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4c976c
add eax, 2
add esi, 2
test cl, cl
jne 0x4c9748
xor eax, eax
jmp 0x4c9771
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4c97fd
lea eax, [esp + 0x8c]
push eax
call fcn.006a7714
mov edx, dword [esp + 0x2d8]
add esp, 4
lea ecx, [esp + 0x8c]
mov dword [esp + 0x64], eax
push 0xffffffffffffffff
push ebx
push ecx
lea ecx, [edx + edi*4 + 8]
call fcn.0061dc90
lea eax, [esp + 0x8c]
push eax
call fcn.006a7714
add esp, 4
xor esi, esi
cmp word [esp + 0x14], bx
mov dword [esp + 0x68], eax
mov dword [esp + 0x30], ebx
jle 0x4c97fd
movsx ecx, word [esp + 0x14]
lea edi, [ecx*8 - 8]
push esi
lea ecx, [esp + 0x14]
call fcn.0061daa0
mov ebx, dword [esp + 0x30]
and eax, 0xff
mov ecx, edi
sub edi, 8
shl eax, cl
add ebx, eax
inc esi
cmp si, word [esp + 0x14]
mov dword [esp + 0x30], ebx
jl 0x4c97d5
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x64]
cmp ebp, eax
jb 0x4c9813
cmp ebp, dword [esp + 0x68]
jbe 0x4c9a26
mov esi, str.default
lea eax, [esp + 0x8c]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4c9847
test cl, cl
je 0x4c9843
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4c9847
add eax, 2
add esi, 2
test cl, cl
jne 0x4c981f
xor eax, eax
jmp 0x4c984c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4c9a26
mov eax, dword [esp + 0x2c]
add eax, 9
jmp 0x4c99ec
mov esi, str.CTEM_LINER_SINGLE
lea eax, [esp + 0x8c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4c9890
test cl, cl
je 0x4c988c
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4c9890
add eax, 2
add esi, 2
test cl, cl
jne 0x4c986c
xor eax, eax
jmp 0x4c9895
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4c9e08
mov ecx, dword [esp + 0x74]
lea eax, [edi + 6]
and ecx, 0xff
cmp eax, ecx
jg 0x4ca13d
mov eax, dword [esp + 0x2d4]
push 0xffffffffffffffff
lea edx, [esp + 0x90]
push ebx
push edx
lea ecx, [eax + edi*4 + 4]
call fcn.0061dc90
mov esi, str.default
lea eax, [esp + 0x8c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4c98fd
test cl, cl
je 0x4c98f9
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4c98fd
add eax, 2
add esi, 2
test cl, cl
jne 0x4c98d9
xor eax, eax
jmp 0x4c9902
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4c998e
lea eax, [esp + 0x8c]
push eax
call fcn.006a7714
mov edx, dword [esp + 0x2d8]
add esp, 4
lea ecx, [esp + 0x8c]
mov dword [esp + 0x64], eax
push 0xffffffffffffffff
push ebx
push ecx
lea ecx, [edx + edi*4 + 8]
call fcn.0061dc90
lea eax, [esp + 0x8c]
push eax
call fcn.006a7714
add esp, 4
xor esi, esi
cmp word [esp + 0x14], bx
mov dword [esp + 0x68], eax
mov dword [esp + 0x30], ebx
jle 0x4c998e
movsx ecx, word [esp + 0x14]
lea edi, [ecx*8 - 8]
push esi
lea ecx, [esp + 0x14]
call fcn.0061daa0
mov ebx, dword [esp + 0x30]
and eax, 0xff
mov ecx, edi
sub edi, 8
shl eax, cl
add ebx, eax
inc esi
cmp si, word [esp + 0x14]
mov dword [esp + 0x30], ebx
jl 0x4c9966
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x64]
cmp ebp, eax
jb 0x4c99a4
cmp ebp, dword [esp + 0x68]
jbe 0x4c9be7
mov esi, str.default
lea eax, [esp + 0x8c]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4c99d8
test cl, cl
je 0x4c99d4
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4c99d8
add eax, 2
add esi, 2
test cl, cl
jne 0x4c99b0
xor eax, eax
jmp 0x4c99dd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4c9be7
mov eax, dword [esp + 0x2c]
add eax, 6
cmp ax, word [esp + 0x3e]
mov dword [esp + 0x2c], eax
jl 0x4c94cc
jmp 0x4ca13d
movsx edx, word [esp + 0x6c]
mov ecx, dword [0x6dd1fc]
push ecx
mov ecx, dword [esp + 0x58]
shl edx, 4
add edx, ecx
push 0
push edx
lea ecx, [esp + 0x28]
call fcn.004136c0
jmp 0x4ca13d
xor esi, esi
mov dword [esp + 0x34], 0
cmp word [esp + 0x14], si
mov dword [esp + 0x38], 0
jle 0x4c9ae6
movsx eax, word [esp + 0x2c]
mov bl, 0x53
lea edi, [eax*4 + 0xc]
mov edx, dword [esp + 0x2d4]
push 0xffffffffffffffff
lea ecx, [esp + 0x90]
push 0
push ecx
lea ecx, [edx + edi]
call fcn.0061dc90
cmp byte [esp + 0x8c], bl
jne 0x4c9aa0
lea eax, [esp + 0x8d]
push eax
call fcn.006a763c
fstp qword [esp + 0x70]
add esp, 4
lea ecx, [esp + 0x10]
push esi
call fcn.0061daa0
movsx ecx, al
mov dword [esp + 0x18], ecx
fild dword [esp + 0x18]
jmp 0x4c9acb
lea edx, [esp + 0x8c]
push edx
call fcn.006a763c
fstp qword [esp + 0x70]
add esp, 4
lea ecx, [esp + 0x10]
push esi
call fcn.0061daa0
and eax, 0xff
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul qword [esp + 0x6c]
inc esi
add edi, 4
cmp si, word [esp + 0x14]
fadd qword [esp + 0x34]
fstp qword [esp + 0x34]
jl 0x4c9a51
movsx esi, word [esp + 0x2c]
mov ecx, dword [esp + 0x2d4]
push 0xffffffffffffffff
lea eax, [esp + 0x90]
push 0
push eax
lea ecx, [ecx + esi*4 + 0x1c]
call fcn.0061dc90
lea edx, [esp + 0x8c]
push edx
call fcn.006a763c
fadd qword [esp + 0x38]
mov ecx, dword [esp + 0x2d8]
add esp, 4
lea eax, [esp + 0x154]
push 0xffffffffffffffff
push 0
fstp qword [esp + 0x3c]
push eax
lea ecx, [ecx + esi*4 + 0x20]
call fcn.0061dc90
lea edx, [esp + 0x154]
push 0x64
push edx
call fcn.006a7580
add esp, 8
test eax, eax
je 0x4c9b72
fld qword [esp + 0x34]
call fcn.006a7274
push eax
lea eax, [esp + 0x90]
push 0x713498
push eax
call fcn.006a6fa5
add esp, 0xc
jmp 0x4c9b94
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push ecx
lea eax, [esp + 0x158]
push edx
lea ecx, [esp + 0x94]
push eax
push ecx
call fcn.006a6fa5
add esp, 0x10
lea edi, [esp + 0x8c]
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea ecx, [esp + 0x20]
push ebx
call fcn.00414230
test al, al
je 0x4ca13d
mov edi, dword [esp + 0x20]
mov ecx, ebx
mov edx, ecx
lea esi, [esp + 0x8c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], ebx
mov byte [eax + ebx], 0
jmp 0x4ca13d
movsx edi, word [esp + 0x2c]
mov edx, dword [esp + 0x2d4]
push 0xffffffffffffffff
lea ecx, [esp + 0x90]
push 0
push ecx
lea ecx, [edx + edi*4 + 0xc]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
call fcn.0061dc90
mov al, byte [esp + 0x8c]
mov bl, 0x53
cmp al, bl
jne 0x4c9c2f
lea eax, [esp + 0x8d]
push eax
jmp 0x4c9c37
lea ecx, [esp + 0x8c]
push ecx
call fcn.006a763c
mov ebp, dword [esp + 0x18]
add esp, 4
fstp qword [esp + 0x6c]
xor esi, esi
test bp, bp
jle 0x4c9cbe
cmp byte [esp + 0x8c], bl
jne 0x4c9c74
test si, si
jne 0x4c9c74
push 0
lea ecx, [esp + 0x14]
call fcn.0061daa0
movsx edx, al
mov dword [esp + 0x18], edx
fild dword [esp + 0x18]
jmp 0x4c9c8b
push esi
lea ecx, [esp + 0x14]
call fcn.0061daa0
and eax, 0xff
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul qword [esp + 0x6c]
cmp bp, 1
jle 0x4c9cb0
movsx eax, bp
movsx edx, si
dec eax
mov ecx, esi
cmp edx, eax
jge 0x4c9cb0
fmul qword [0x6ddb68]
inc ecx
movsx edx, cx
cmp edx, eax
jl 0x4c9ca2
fadd qword [esp + 0x34]
inc esi
cmp si, bp
fstp qword [esp + 0x34]
jl 0x4c9c4e
mov ecx, dword [esp + 0x2d4]
push 0xffffffffffffffff
lea eax, [esp + 0x90]
push 0
push eax
lea ecx, [ecx + edi*4 + 0x10]
call fcn.0061dc90
lea edx, [esp + 0x8c]
push edx
call fcn.006a763c
fadd qword [esp + 0x38]
mov ecx, dword [esp + 0x2d8]
add esp, 4
lea eax, [esp + 0x154]
push 0xffffffffffffffff
push 0
fstp qword [esp + 0x3c]
push eax
lea ecx, [ecx + edi*4 + 0x14]
call fcn.0061dc90
lea edx, [esp + 0x154]
push 0x64
push edx
call fcn.006a7580
add esp, 8
test eax, eax
je 0x4c9d45
fld qword [esp + 0x34]
call fcn.006a7274
push eax
lea eax, [esp + 0x90]
push 0x713498
push eax
call fcn.006a6fa5
add esp, 0xc
jmp 0x4c9d67
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push ecx
lea eax, [esp + 0x158]
push edx
lea ecx, [esp + 0x94]
push eax
push ecx
call fcn.006a6fa5
add esp, 0x10
lea edi, [esp + 0x8c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea ecx, [esp + 0x1c]
call fcn.00414a50
cmp eax, ebx
jae 0x4c9d8c
call fcn.006a64db
mov edi, dword [esp + 0x20]
test edi, edi
je 0x4c9da8
mov al, byte [edi - 1]
test al, al
je 0x4c9da8
cmp al, 0xff
je 0x4c9da8
test ebx, ebx
jne 0x4c9dd4
jmp 0x4c9faa
test ebx, ebx
jne 0x4c9dbc
push 1
lea ecx, [esp + 0x20]
call fcn.004138c0
jmp 0x4ca13d
mov eax, dword [esp + 0x28]
cmp eax, 0x1f
ja 0x4c9dc9
cmp eax, ebx
jae 0x4c9de2
push 1
lea ecx, [esp + 0x20]
call fcn.004138c0
push ebx
lea ecx, [esp + 0x20]
call fcn.00414a60
mov edi, dword [esp + 0x20]
mov ecx, ebx
lea esi, [esp + 0x8c]
mov edx, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
call fcn.00414210
jmp 0x4ca13d
mov esi, str.CTEM_DISPLAY
lea eax, [esp + 0x8c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4c9e38
test cl, cl
je 0x4c9e34
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4c9e38
add eax, 2
add esi, 2
test cl, cl
jne 0x4c9e14
xor eax, eax
jmp 0x4c9e3d
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4c9fed
movsx eax, word [esp + 0x2c]
mov ecx, dword [esp + 0x74]
lea edx, [eax + 2]
and ecx, 0xff
cmp edx, ecx
jg 0x4ca13d
mov edx, dword [esp + 0x2d4]
push 0xffffffffffffffff
lea ecx, [esp + 0x90]
push ebx
push ecx
lea ecx, [edx + eax*4 + 4]
call fcn.0061dc90
lea eax, [esp + 0x8c]
push str._02X
push eax
call fcn.006a74f0
add esp, 8
test eax, eax
jne 0x4c9eac
lea ecx, [esp + 0x8c]
push str._02x
push ecx
call fcn.006a74f0
add esp, 8
test eax, eax
je 0x4c9ef4
xor esi, esi
cmp word [esp + 0x14], bx
jle 0x4c9ee5
lea edi, [esp + 0x8c]
push esi
lea ecx, [esp + 0x14]
call fcn.0061daa0
and eax, 0xff
push eax
push str._02x
push edi
call fcn.006a6fa5
add esp, 0xc
inc esi
add edi, 2
cmp si, word [esp + 0x14]
jl 0x4c9ebc
movsx edx, word [esp + 0x14]
xor ebx, ebx
mov byte [esp + edx*2 + 0x8c], 0
lea eax, [esp + 0x8c]
push 0x713828
push eax
call fcn.006a74f0
add esp, 8
test eax, eax
jne 0x4c9f26
lea ecx, [esp + 0x8c]
push 0x715ad4
push ecx
call fcn.006a74f0
add esp, 8
test eax, eax
je 0x4c9f6a
xor esi, esi
cmp word [esp + 0x14], bx
jle 0x4c9f5d
lea edi, [esp + 0x8c]
push esi
lea ecx, [esp + 0x14]
call fcn.0061daa0
and eax, 0xff
push eax
push 0x713828
push edi
call fcn.006a6fa5
add esp, 0xc
inc esi
inc edi
cmp si, word [esp + 0x14]
jl 0x4c9f36
movsx edx, word [esp + 0x14]
mov byte [esp + edx + 0x8c], 0
lea edi, [esp + 0x8c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea ecx, [esp + 0x1c]
call fcn.00414a50
cmp eax, ebx
jae 0x4c9f8f
call fcn.006a64db
mov edi, dword [esp + 0x20]
test edi, edi
je 0x4c9fbf
mov al, byte [edi - 1]
test al, al
je 0x4c9fbf
cmp al, 0xff
je 0x4c9fbf
test ebx, ebx
jne 0x4ca10c
dec al
push 0
lea ecx, [esp + 0x20]
mov byte [edi - 1], al
call fcn.004138c0
jmp 0x4ca13d
test ebx, ebx
jne 0x4c9fd3
push 1
lea ecx, [esp + 0x20]
call fcn.004138c0
jmp 0x4ca13d
mov eax, dword [esp + 0x28]
cmp eax, 0x1f
ja 0x4ca101
cmp eax, ebx
jae 0x4ca11a
jmp 0x4ca101
mov esi, str.CTEM_TimeDisplay
lea eax, [esp + 0x8c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4ca01d
test cl, cl
je 0x4ca019
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4ca01d
add eax, 2
add esi, 2
test cl, cl
jne 0x4c9ff9
xor eax, eax
jmp 0x4ca022
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4ca13d
push 0
lea ecx, [esp + 0x14]
call fcn.0061daa0
movzx si, al
push 1
lea ecx, [esp + 0x14]
shl esi, 8
call fcn.0061daa0
movzx ax, al
add esi, eax
mov ecx, 0xe10
and esi, 0xffff
mov edi, 0x3c
mov eax, esi
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
cdq
idiv edi
mov eax, 0x88888889
push edx
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x91a2b3c5
push edx
imul esi
add edx, esi
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
push edx
lea edx, [esp + 0x98]
push str._02d:_02d:_02d
push edx
call fcn.006a6fa5
lea edi, [esp + 0xa0]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea ecx, [esp + 0x1c]
call fcn.00414a50
cmp eax, ebx
jae 0x4ca0cc
call fcn.006a64db
mov edi, dword [esp + 0x20]
test edi, edi
je 0x4ca0e3
mov al, byte [edi - 1]
test al, al
je 0x4ca0e3
cmp al, 0xff
jne 0x4c9fa2
test ebx, ebx
jne 0x4ca0f4
push 1
lea ecx, [esp + 0x20]
call fcn.004138c0
jmp 0x4ca13d
mov eax, dword [esp + 0x28]
cmp eax, 0x1f
ja 0x4ca101
cmp eax, ebx
jae 0x4ca11a
push 1
lea ecx, [esp + 0x20]
call fcn.004138c0
push ebx
lea ecx, [esp + 0x20]
call fcn.00414a60
mov edi, dword [esp + 0x20]
mov ecx, ebx
lea esi, [esp + 0x8c]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x24], ebx
mov byte [ecx + ebx], 0
mov ebp, dword [esp + 0x2c8]
mov dl, byte [esp + 0x1c]
mov ecx, dword [esp + 0x24]
xor edi, edi
mov byte [ebp], dl
mov dword [ebp + 4], edi
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], edi
mov eax, dword [0x6dd1fc]
mov ebx, ecx
cmp eax, ebx
jae 0x4ca167
mov ebx, eax
lea edx, [esp + 0x1c]
cmp ebp, edx
jne 0x4ca186
push eax
push ebx
mov ecx, ebp
call fcn.004140f0
push edi
push edi
mov ecx, ebp
call fcn.004140f0
jmp 0x4ca208
cmp ebx, edi
jbe 0x4ca1d2
cmp ebx, ecx
jne 0x4ca1d2
mov eax, dword [esp + 0x20]
cmp eax, edi
jne 0x4ca19b
mov eax, 0x6dd1f8
cmp byte [eax - 1], 0xfe
jae 0x4ca1d2
push 1
mov ecx, ebp
call fcn.004138c0
mov eax, dword [esp + 0x20]
cmp eax, edi
jne 0x4ca1b7
mov eax, 0x6dd1f8
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [ebp + 4], eax
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], edx
mov cl, byte [eax - 1]
inc cl
mov byte [eax - 1], cl
jmp 0x4ca208
push 1
push ebx
mov ecx, ebp
call fcn.00414230
test al, al
je 0x4ca208
mov esi, dword [esp + 0x20]
cmp esi, edi
jne 0x4ca1ed
mov esi, 0x6dd1f8
mov edi, dword [ebp + 4]
mov ecx, ebx
mov eax, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebp
call fcn.00414210
lea ecx, [esp + 0x4c]
mov dword [esp + 0x88], 1
mov byte [esp + 0x2c0], 9
call fcn.0061d8c0
lea ecx, [esp + 0x48]
mov byte [esp + 0x2c0], 8
call fcn.0061d8c0
lea ecx, [esp + 0x60]
mov byte [esp + 0x2c0], 7
call fcn.0061d8c0
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c0], 6
call fcn.0061d8c0
lea ecx, [esp + 0x40]
mov byte [esp + 0x2c0], 5
call fcn.0061d8c0
lea ecx, [esp + 0x44]
mov byte [esp + 0x2c0], 4
call fcn.0061d8c0
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
cmp ecx, eax
mov edi, eax
je 0x4ca2c7
lea esi, [ecx + 4]
xor ebx, ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x4ca2af
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x4ca2a6
cmp al, 0xff
je 0x4ca2a6
dec al
mov byte [ecx], al
jmp 0x4ca2af
push ecx
call fcn.006a64d0
add esp, 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
add esi, 0x10
lea ecx, [esi - 4]
cmp ecx, edi
jne 0x4ca28c
mov ecx, dword [esp + 0x54]
jmp 0x4ca2c9
xor ebx, ebx
push ecx
call fcn.006a64d0
mov eax, dword [esp + 0x80]
add esp, 4
cmp eax, ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
je 0x4ca306
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x4ca2fd
cmp al, 0xff
je 0x4ca2fd
dec al
mov byte [ecx], al
jmp 0x4ca306
push ecx
call fcn.006a64d0
add esp, 4
mov eax, dword [esp + 0x20]
mov dword [esp + 0x7c], ebx
cmp eax, ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
je 0x4ca33d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x4ca334
cmp al, 0xff
je 0x4ca334
dec al
mov byte [ecx], al
jmp 0x4ca33d
push ecx
call fcn.006a64d0
add esp, 4
mov edi, dword [esp + 0x2d8]
mov esi, dword [esp + 0x2d4]
cmp esi, edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x2c0], 0
je 0x4ca378
mov ecx, esi
call fcn.0061d8c0
add esi, 4
cmp esi, edi
jne 0x4ca363
mov esi, dword [esp + 0x2d4]
push esi
call fcn.006a64d0
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x2b8]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x2b4
ret 0x18