Function at 0x40cafd
Capabilities:
Encode data using xor
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x260
mov edi, esp
xorps xmm0, xmm0
mov esi, edx
mov dword [esp + 0x214], ecx
movaps xmmword [edi + 0x10], xmm0
movaps xmmword [edi], xmm0
mov dword [edi + 0x20], 0
push edi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [edi + 0x14]
test eax, eax
jne 0x40cb48
mov ecx, 2
mov edx, 0x47ef54
call fcn.00429aac
xor eax, eax
inc eax
mov dword [esp + 0xec], eax
mov dword [esp + 0x44], esi
xor ecx, ecx
mov edx, 0x210
xor edi, edi
mov al, byte [0x48fdb4]
call fcn.0045a4d0
test eax, eax
mov dword [esp + 0x30], eax
je 0x40f804
lea eax, [0x46bc4a]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0xff87d36c
mov edx, dword [esp]
call fcn.00403e9f
mov ecx, 0xd7c44efe
xor edx, edx
xor ecx, dword [eax]
mov dword [esp + 0x74], ecx
mov ecx, 7
movzx ebx, byte [eax + 6]
movzx esi, word [eax + 4]
xor esi, 0x9f93
xor bl, 0x6f
call fcn.0043b1bc
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x74], edx
mov dword [edx], eax
lea eax, [0x46d766]
mov word [edx + 4], si
mov byte [edx + 6], bl
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x1c165fc5
mov edx, dword [esp]
call fcn.00403a4c
mov esi, 0x7297b493
mov ecx, 6
xor edx, edx
xor esi, dword [eax]
movzx ebx, word [eax + 4]
xor ebx, 0x44b1
call fcn.0043b1bc
mov dword [esp + 0xc4], eax
lea eax, [0x465e47]
mov dword [edx], esi
mov word [edx + 4], bx
mov dword [esp + 0x3c], edx
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0xf6857974
mov edx, dword [esp]
call fcn.00403d3d
mov ecx, 0xfed82a5f
xor edx, edx
xor ecx, dword [eax]
mov dword [esp + 0x38], ecx
mov ecx, 7
movzx ebx, byte [eax + 6]
movzx esi, word [eax + 4]
xor esi, 0x4556
xor bl, 0xe5
call fcn.0043b1bc
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x38], edx
mov dword [edx], eax
lea eax, [0x467e52]
mov word [edx + 4], si
mov byte [edx + 6], bl
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0xdd0fe4fb
mov edx, dword [esp]
call fcn.00403d75
mov esi, 0x228dd4fa
mov ecx, 6
xor edx, edx
xor esi, dword [eax]
movzx ebx, word [eax + 4]
xor ebx, 0xc693
call fcn.0043b1bc
mov dword [esp + 0xe8], eax
lea eax, [0x46c3bf]
mov dword [edx], esi
mov word [edx + 4], bx
mov dword [esp + 0x78], edx
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x3dbd1a56
mov edx, dword [esp]
call fcn.00403774
mov esi, 0x8540c396
mov ecx, 6
xor edx, edx
xor esi, dword [eax]
movzx ebx, word [eax + 4]
xor ebx, 0xecef
call fcn.0043b1bc
mov dword [esp + 0x9c], eax
lea eax, [0x468b8b]
mov dword [edx], esi
mov word [edx + 4], bx
mov dword [esp + 0xc0], edx
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0xacf2835b
mov edx, dword [esp]
call fcn.00403237
mov esi, 0xc95b463e
mov ecx, 5
xor edx, edx
xor esi, dword [eax]
mov bl, byte [eax + 4]
xor bl, 0xf0
call fcn.0043b1bc
mov dword [esp + 0xac], eax
lea eax, [0x46f593]
mov dword [edx], esi
mov byte [edx + 4], bl
mov dword [esp + 0x98], edx
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x9d1b5633
mov edx, dword [esp]
call fcn.00403a85
mov ecx, 0xaeccea72
xor edx, edx
xor ecx, dword [eax]
mov dword [esp + 0x40], ecx
mov ecx, 7
movzx ebx, byte [eax + 6]
movzx esi, word [eax + 4]
xor esi, 0xc5d3
xor bl, 0xd4
call fcn.0043b1bc
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x40], edx
mov dword [edx], eax
lea eax, [0x468125]
mov word [edx + 4], si
mov byte [edx + 6], bl
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x7ba86f9
mov edx, dword [esp]
call fcn.00403654
mov cl, 1
xor ebx, ebx
mov dword [esp + 4], edi
mov dword [esp], edi
mov edx, edi
movzx esi, byte [edi + 0x4736fd]
or edx, 1
movzx edx, byte [edx + 0x4736fd]
shl edx, 8
or edx, esi
mov esi, edi
or esi, 2
movzx esi, byte [esi + 0x4736fd]
shl esi, 0x10
or edx, esi
mov esi, edi
or esi, 3
movzx esi, byte [esi + 0x4736fd]
shl esi, 0x18
or edx, esi
xor edx, dword [eax + edi]
test cl, 1
mov ecx, 0
mov dword [esp + edi], edx
mov edi, 4
jne 0x40cdd8
mov esi, dword [esp]
mov edi, dword [esp + 4]
mov ecx, 8
xor edx, edx
call fcn.0043b1bc
mov dword [esp + 0xa8], eax
lea eax, [0x46bf51]
mov dword [edx + 4], edi
mov dword [edx], esi
mov dword [esp + 0xbc], edx
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x5cb0ddb3
mov edx, dword [esp]
call fcn.00403fe1
mov cl, 1
xor edi, edi
mov dword [esp + 4], ebx
mov dword [esp], ebx
mov edx, ebx
movzx esi, byte [ebx + 0x473705]
or edx, 1
movzx edx, byte [edx + 0x473705]
shl edx, 8
or edx, esi
mov esi, ebx
or esi, 2
movzx esi, byte [esi + 0x473705]
shl esi, 0x10
or edx, esi
mov esi, ebx
or esi, 3
movzx esi, byte [esi + 0x473705]
shl esi, 0x18
or edx, esi
xor edx, dword [eax + ebx]
test cl, 1
mov ecx, 0
mov dword [esp + ebx], edx
mov ebx, 4
jne 0x40ce75
movzx ecx, byte [eax + 0xa]
movzx eax, word [eax + 8]
xor edx, edx
xor eax, 0xe9a4
xor cl, 0xf6
mov word [esp + 8], ax
mov byte [esp + 0xa], cl
mov ecx, 0xb
movsd xmm0, qword [esp]
mov eax, dword [esp + 7]
movsd qword [esp + 0x100], xmm0
mov dword [esp + 0x107], eax
call fcn.0043b1bc
movsd xmm0, qword [esp + 0x100]
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], edx
movsd qword [edx], xmm0
mov eax, dword [esp + 0x107]
mov dword [edx + 7], eax
lea eax, [0x46b6ee]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x652f0706
mov edx, dword [esp]
call fcn.00403aa4
mov esi, 0xaef2fe89
mov ecx, 6
xor edx, edx
xor esi, dword [eax]
movzx ebx, word [eax + 4]
xor ebx, 0x6518
call fcn.0043b1bc
mov dword [esp + 0x84], eax
lea eax, [0x473925]
mov dword [edx], esi
mov word [edx + 4], bx
mov dword [esp + 0xb8], edx
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x3467104c
mov edx, dword [esp]
call fcn.00403587
mov esi, 0x5d896ceb
mov ecx, 6
xor edx, edx
xor esi, dword [eax]
movzx ebx, word [eax + 4]
xor ebx, 0xa8c1
call fcn.0043b1bc
mov dword [esp + 0xb0], eax
lea eax, [0x465793]
mov dword [edx], esi
mov word [edx + 4], bx
mov dword [esp + 0xb4], edx
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x884b7ce1
mov edx, dword [esp]
call fcn.00403e6e
mov cl, 1
xor ebx, ebx
mov dword [esp + 4], edi
mov dword [esp], edi
mov edx, edi
movzx esi, byte [edi + 0x473710]
or edx, 1
movzx edx, byte [edx + 0x473710]
shl edx, 8
or edx, esi
mov esi, edi
or esi, 2
movzx esi, byte [esi + 0x473710]
shl esi, 0x10
or edx, esi
mov esi, edi
or esi, 3
movzx esi, byte [esi + 0x473710]
shl esi, 0x18
or edx, esi
xor edx, dword [eax + edi]
test cl, 1
mov ecx, 0
mov dword [esp + edi], edx
mov edi, 4
jne 0x40cfeb
mov esi, dword [esp]
mov edi, dword [esp + 4]
mov ecx, 8
xor edx, edx
call fcn.0043b1bc
mov dword [esp + 0x20c], eax
lea eax, [0x470cd6]
mov dword [edx + 4], edi
mov dword [edx], esi
mov dword [esp + 0x210], edx
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x5d0f17f3
mov edx, dword [esp]
call fcn.004035be
mov cl, 1
xor edi, edi
mov dword [esp + 4], ebx
mov dword [esp], ebx
mov edx, ebx
movzx esi, byte [ebx + 0x473718]
or edx, 1
movzx edx, byte [edx + 0x473718]
shl edx, 8
or edx, esi
mov esi, ebx
or esi, 2
movzx esi, byte [esi + 0x473718]
shl esi, 0x10
or edx, esi
mov esi, ebx
or esi, 3
movzx esi, byte [esi + 0x473718]
shl esi, 0x18
or edx, esi
xor edx, dword [eax + ebx]
test cl, 1
mov ecx, 0
mov dword [esp + ebx], edx
mov ebx, 4
jne 0x40d088
movzx eax, word [eax + 8]
movsd xmm0, qword [esp]
mov ecx, 0xa
xor edx, edx
xor eax, 0xca2f
movsd qword [esp + 0x230], xmm0
mov word [esp + 0x238], ax
call fcn.0043b1bc
movsd xmm0, qword [esp + 0x230]
mov dword [esp + 0x204], eax
mov dword [esp + 0x208], edx
movsd qword [edx], xmm0
movzx eax, word [esp + 0x238]
mov word [edx + 8], ax
lea eax, [0x472228]
mov dword [esp], eax
mov eax, esp
mov ebx, eax
mov ecx, dword [esp]
mov dword [esp], 0x2be0cc0c
mov edx, dword [esp]
call fcn.00403b02
mov esi, 0xb6aeddea
mov ecx, 4
xor edx, edx
xor esi, dword [eax]
call fcn.0043b1bc
mov dword [esp + 0x1fc], eax
lea eax, [0x46aa39]
mov dword [edx], esi
mov dword [esp + 0x200], edx
mov dword [esp], eax
mov ecx, dword [esp]
mov dword [esp], 0x7e1126b3
mov edx, dword [esp]
call fcn.00403e21
mov esi, 0xbd7ab10
mov ecx, 5
xor edx, edx
xor esi, dword [eax]
mov bl, byte [eax + 4]
xor bl, 0xa
call fcn.0043b1bc
mov dword [esp + 0x1f4], eax
lea eax, [0x47001d]
mov dword [edx], esi
mov byte [edx + 4], bl
mov dword [esp + 0x1f8], edx
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0xaae55141
mov edx, dword [esp]
call fcn.0040394c
mov esi, 0x29c80c08
mov ecx, 5
xor edx, edx
xor esi, dword [eax]
mov bl, byte [eax + 4]
xor bl, 0xac
call fcn.0043b1bc
mov dword [esp + 0x1ec], eax
lea eax, [0x468616]
mov dword [edx], esi
mov byte [edx + 4], bl
mov dword [esp + 0x1f0], edx
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0xc65a5f46
mov edx, dword [esp]
call fcn.00403f90
mov ecx, 0xfffffffc
mov dword [esp + 4], edi
mov dword [esp], edi
mov dword [esp + 8], edi
mov edx, dword [ecx + 0x473726]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 4], edx
add ecx, 4
cmp ecx, 8
jb 0x40d228
mov eax, dword [esp + 8]
movsd xmm0, qword [esp]
mov ecx, 0xc
xor edx, edx
mov dword [esp + 0x90], eax
movsd qword [esp + 0x88], xmm0
call fcn.0043b1bc
movsd xmm0, qword [esp + 0x88]
mov dword [esp + 0x1e4], eax
mov dword [esp + 0x1e8], edx
movsd qword [edx], xmm0
mov eax, dword [esp + 0x90]
mov dword [edx + 8], eax
lea eax, [0x46d12e]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x86c22be6
mov edx, dword [esp]
call fcn.00403859
xorps xmm0, xmm0
mov ecx, 0xfffffffc
movaps xmmword [esp], xmm0
mov edx, dword [ecx + 0x473732]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 4], edx
add ecx, 4
cmp ecx, 0xc
jb 0x40d2b1
movaps xmm0, xmmword [esp]
mov ecx, 0x10
xor edx, edx
xor ebx, ebx
movaps xmmword [esp + 0x240], xmm0
call fcn.0043b1bc
movaps xmm0, xmmword [esp + 0x240]
mov dword [esp + 0x1dc], eax
lea eax, [0x471efc]
mov dword [esp + 0x1e0], edx
movups xmmword [edx], xmm0
mov dword [esp], eax
mov eax, esp
mov edi, eax
mov ecx, dword [esp]
mov dword [esp], 0x2129b2cb
mov edx, dword [esp]
call fcn.00403eb3
mov esi, 0x8f0ccb4c
mov ecx, 5
xor edx, edx
xor esi, dword [eax]
mov al, byte [eax + 4]
xor al, 0xbe
mov byte [esp + 0xe4], al
call fcn.0043b1bc
mov dword [esp + 0x1d8], eax
mov al, byte [esp + 0xe4]
mov dword [edx], esi
mov dword [esp + 0x240], edx
mov byte [edx + 4], al
lea eax, [0x464216]
mov dword [esp], eax
mov ecx, dword [esp]
mov dword [esp], 0xb04cf64a
mov edx, dword [esp]
call fcn.00403a19
mov edi, 0x40d7a4ef
xor edx, edx
xor edi, dword [eax]
movzx ecx, byte [eax + 6]
movzx esi, word [eax + 4]
xor cl, 9
xor esi, 0xc78a
mov dword [esp + 0xe0], ecx
mov ecx, 7
call fcn.0043b1bc
mov dword [esp + 0x1d4], eax
mov eax, dword [esp + 0xe0]
mov dword [edx], edi
mov word [edx + 4], si
mov dword [esp + 0xe4], edx
mov byte [edx + 6], al
lea eax, [0x47009f]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x20ed1659
mov edx, dword [esp]
call fcn.00403f76
mov cl, 1
xor edi, edi
mov dword [esp + 4], ebx
mov dword [esp], ebx
mov edx, ebx
movzx esi, byte [ebx + 0x47373e]
or edx, 1
movzx edx, byte [edx + 0x47373e]
shl edx, 8
or edx, esi
mov esi, ebx
or esi, 2
movzx esi, byte [esi + 0x47373e]
shl esi, 0x10
or edx, esi
mov esi, ebx
or esi, 3
movzx esi, byte [esi + 0x47373e]
shl esi, 0x18
or edx, esi
xor edx, dword [eax + ebx]
test cl, 1
mov ecx, 0
mov dword [esp + ebx], edx
mov ebx, 4
jne 0x40d3de
movzx eax, word [eax + 8]
movsd xmm0, qword [esp]
mov ecx, 0xa
xor edx, edx
xor eax, 0x29a0
movsd qword [esp + 0xf0], xmm0
mov word [esp + 0xf8], ax
call fcn.0043b1bc
movsd xmm0, qword [esp + 0xf0]
mov dword [esp + 0x1d0], eax
mov dword [esp + 0xe0], edx
movsd qword [edx], xmm0
movzx eax, word [esp + 0xf8]
mov word [edx + 8], ax
lea eax, [0x46e93f]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0xa93d8fe1
mov edx, dword [esp]
call fcn.00403375
mov esi, 0x3e093ec7
mov ecx, 5
xor edx, edx
xor esi, dword [eax]
mov bl, byte [eax + 4]
xor bl, 0xcf
call fcn.0043b1bc
mov dword [esp + 0x1cc], eax
lea eax, [0x4714d0]
mov dword [edx], esi
mov byte [edx + 4], bl
mov dword [esp + 0x1c8], edx
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x39be72c3
mov edx, dword [esp]
call fcn.00403fc5
mov esi, 0x635b0fe1
mov ecx, 5
xor edx, edx
xor esi, dword [eax]
mov bl, byte [eax + 4]
xor bl, 0xf2
call fcn.0043b1bc
mov dword [esp + 0x1c0], eax
lea eax, [0x46bfdc]
mov dword [edx], esi
mov byte [edx + 4], bl
mov dword [esp + 0x1c4], edx
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x57a3a888
mov edx, dword [esp]
call fcn.00403429
mov ecx, 0xc1572c98
xor edx, edx
xor ecx, dword [eax]
mov dword [esp + 0xdc], ecx
mov ecx, 7
movzx ebx, byte [eax + 6]
movzx esi, word [eax + 4]
xor esi, 0xe1ba
xor bl, 0x43
call fcn.0043b1bc
mov dword [esp + 0x1bc], eax
mov eax, dword [esp + 0xdc]
mov dword [esp + 0xdc], edx
mov dword [edx], eax
lea eax, [0x466505]
mov word [edx + 4], si
mov byte [edx + 6], bl
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x23f2dcff
mov edx, dword [esp]
call fcn.004038a7
mov esi, 0xc2e21c76
mov ecx, 6
xor edx, edx
xor esi, dword [eax]
movzx ebx, word [eax + 4]
xor ebx, 0x4c0
call fcn.0043b1bc
mov dword [esp + 0x1b4], eax
lea eax, [0x469468]
mov dword [edx], esi
mov word [edx + 4], bx
mov dword [esp + 0x1b8], edx
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x3d43d7ff
mov edx, dword [esp]
call fcn.00403909
mov ecx, 0xde0d313a
xor edx, edx
xor ecx, dword [eax]
mov dword [esp + 0xd8], ecx
mov ecx, 7
movzx ebx, byte [eax + 6]
movzx esi, word [eax + 4]
xor esi, 0xe8cf
xor bl, 0x63
call fcn.0043b1bc
mov dword [esp + 0x1b0], eax
mov eax, dword [esp + 0xd8]
mov dword [esp + 0xd8], edx
mov dword [edx], eax
lea eax, [0x4677ad]
mov word [edx + 4], si
mov byte [edx + 6], bl
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x70892038
mov edx, dword [esp]
call fcn.00403e8d
mov cl, 1
xor ebx, ebx
mov dword [esp + 4], edi
mov dword [esp], edi
mov edx, edi
movzx esi, byte [edi + 0x473748]
or edx, 1
movzx edx, byte [edx + 0x473748]
shl edx, 8
or edx, esi
mov esi, edi
or esi, 2
movzx esi, byte [esi + 0x473748]
shl esi, 0x10
or edx, esi
mov esi, edi
or esi, 3
movzx esi, byte [esi + 0x473748]
shl esi, 0x18
or edx, esi
xor edx, dword [eax + edi]
test cl, 1
mov ecx, 0
mov dword [esp + edi], edx
mov edi, 4
jne 0x40d653
mov esi, dword [esp]
mov edi, dword [esp + 4]
mov ecx, 8
xor edx, edx
call fcn.0043b1bc
mov dword [esp + 0x1ac], eax
lea eax, [0x464b9c]
mov dword [edx + 4], edi
mov dword [edx], esi
mov dword [esp + 0x1a8], edx
mov edi, esp
mov dword [esp], eax
mov ecx, dword [esp]
mov dword [esp], 0x404687dc
mov edx, dword [esp]
call fcn.00403ae3
movzx ecx, byte [eax + 2]
movzx esi, word [eax]
xor edx, edx
xor cl, 0xb3
xor esi, 0x1d4
mov edi, ecx
mov ecx, 3
call fcn.0043b1bc
mov dword [esp + 0x1a0], eax
mov eax, edi
mov word [edx], si
mov dword [esp + 0x1a4], edx
mov byte [edx + 2], al
lea eax, [0x47043a]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0xe846f5d5
mov edx, dword [esp]
call fcn.004033ca
mov ecx, 0xfffffffc
mov dword [esp + 4], ebx
mov dword [esp], ebx
mov dword [esp + 8], ebx
mov edx, dword [ecx + 0x473754]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 4], edx
add ecx, 4
cmp ecx, 8
jb 0x40d746
movzx eax, word [eax + 0xc]
mov ecx, 0xe
xor edx, edx
xor edi, edi
xor eax, 0x5f5b
mov word [esp + 0xc], ax
movsd xmm0, qword [esp]
movsd xmm1, qword [esp + 6]
movsd qword [esp + 0x48], xmm0
movsd qword [esp + 0x4e], xmm1
call fcn.0043b1bc
movsd xmm0, qword [esp + 0x48]
movsd xmm1, qword [esp + 0x4e]
mov dword [esp + 0x198], eax
lea eax, [0x46f18d]
mov dword [esp + 0x19c], edx
movsd qword [edx], xmm0
movsd qword [edx + 6], xmm1
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x516ec755
mov edx, dword [esp]
call fcn.0040403d
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor edx, edx
xor esi, 0xec64
xor bl, 0x48
call fcn.0043b1bc
mov dword [esp + 0x190], eax
lea eax, [0x46785f]
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0x194], edx
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x1e12499d
mov edx, dword [esp]
call fcn.0040396b
mov esi, 0x898698b9
mov ecx, 5
xor edx, edx
xor esi, dword [eax]
mov bl, byte [eax + 4]
xor bl, 0xd1
call fcn.0043b1bc
mov dword [esp + 0x188], eax
lea eax, [0x467e77]
mov dword [edx], esi
mov byte [edx + 4], bl
mov dword [esp + 0x18c], edx
mov ebx, esp
mov dword [esp], eax
mov ecx, dword [esp]
mov dword [esp], 0xb54acc7
mov edx, dword [esp]
call fcn.00403db9
mov esi, 0xf8cc1e6e
mov ecx, 4
xor edx, edx
xor esi, dword [eax]
call fcn.0043b1bc
mov dword [esp + 0x184], eax
lea eax, [0x4726da]
mov dword [edx], esi
mov dword [esp + 0x180], edx
mov dword [esp], eax
mov ecx, dword [esp]
mov dword [esp], 0xd3ee680a
mov edx, dword [esp]
call fcn.004039be
mov cl, 1
xor ebx, ebx
mov dword [esp + 4], edi
mov dword [esp], edi
mov edx, edi
movzx esi, byte [edi + 0x47375e]
or edx, 1
movzx edx, byte [edx + 0x47375e]
shl edx, 8
or edx, esi
mov esi, edi
or esi, 2
movzx esi, byte [esi + 0x47375e]
shl esi, 0x10
or edx, esi
mov esi, edi
or esi, 3
movzx esi, byte [esi + 0x47375e]
shl esi, 0x18
or edx, esi
xor edx, dword [eax + edi]
test cl, 1
mov ecx, 0
mov dword [esp + edi], edx
mov edi, 4
jne 0x40d8ae
mov esi, dword [esp]
mov edi, dword [esp + 4]
mov ecx, 8
xor edx, edx
call fcn.0043b1bc
mov dword [esp + 0x17c], eax
lea eax, [0x46c23a]
mov dword [edx + 4], edi
mov dword [edx], esi
mov dword [esp + 0x178], edx
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0xcaceea93
mov edx, dword [esp]
call fcn.00403f3e
mov cl, 1
xor edi, edi
mov dword [esp + 4], ebx
mov dword [esp], ebx
mov edx, ebx
movzx esi, byte [ebx + 0x473766]
or edx, 1
movzx edx, byte [edx + 0x473766]
shl edx, 8
or edx, esi
mov esi, ebx
or esi, 2
movzx esi, byte [esi + 0x473766]
shl esi, 0x10
or edx, esi
mov esi, ebx
or esi, 3
movzx esi, byte [esi + 0x473766]
shl esi, 0x18
or edx, esi
xor edx, dword [eax + ebx]
test cl, 1
mov ecx, 0
mov dword [esp + ebx], edx
mov ebx, 4
jne 0x40d94b
movzx ecx, byte [eax + 0xa]
movzx eax, word [eax + 8]
xor edx, edx
xor eax, 0x87b2
xor cl, 0xc4
mov word [esp + 8], ax
mov byte [esp + 0xa], cl
mov ecx, 0xb
movsd xmm0, qword [esp]
mov eax, dword [esp + 7]
movsd qword [esp + 0x110], xmm0
mov dword [esp + 0x117], eax
call fcn.0043b1bc
movsd xmm0, qword [esp + 0x110]
mov dword [esp + 0x174], eax
mov dword [esp + 0x170], edx
movsd qword [edx], xmm0
mov eax, dword [esp + 0x117]
mov dword [edx + 7], eax
lea eax, [0x465ecc]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0xbcc8e0
mov edx, dword [esp]
call fcn.0040366f
mov esi, 0x660aaabb
mov ecx, 6
xor edx, edx
xor esi, dword [eax]
movzx ebx, word [eax + 4]
xor ebx, 0xb1b5
call fcn.0043b1bc
mov dword [esp + 0x16c], eax
lea eax, [0x464423]
mov dword [edx], esi
mov word [edx + 4], bx
mov dword [esp + 0x168], edx
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x48c1b88d
mov edx, dword [esp]
call fcn.00403c5a
mov cl, 1
xor ebx, ebx
mov dword [esp + 4], edi
mov dword [esp], edi
mov edx, edi
movzx esi, byte [edi + 0x473771]
or edx, 1
movzx edx, byte [edx + 0x473771]
shl edx, 8
or edx, esi
mov esi, edi
or esi, 2
movzx esi, byte [esi + 0x473771]
shl esi, 0x10
or edx, esi
mov esi, edi
or esi, 3
movzx esi, byte [esi + 0x473771]
shl esi, 0x18
or edx, esi
xor edx, dword [eax + edi]
test cl, 1
mov ecx, 0
mov dword [esp + edi], edx
mov edi, 4
jne 0x40da73
movzx ecx, byte [eax + 0xa]
movzx eax, word [eax + 8]
xor edx, edx
xor eax, 0xe579
not cl
mov word [esp + 8], ax
mov byte [esp + 0xa], cl
mov ecx, 0xb
movsd xmm0, qword [esp]
mov eax, dword [esp + 7]
movsd qword [esp + 0x120], xmm0
mov dword [esp + 0x127], eax
call fcn.0043b1bc
movsd xmm0, qword [esp + 0x120]
mov dword [esp + 0x164], eax
mov dword [esp + 0x160], edx
movsd qword [edx], xmm0
mov eax, dword [esp + 0x127]
mov dword [edx + 7], eax
lea eax, [0x46bc9c]
mov dword [esp], eax
mov eax, esp
mov edi, eax
mov ecx, dword [esp]
mov dword [esp], 0x6a2b28b3
mov edx, dword [esp]
call fcn.004034ff
mov esi, 0x869fea4d
mov ecx, 5
xor edx, edx
xor esi, dword [eax]
mov al, byte [eax + 4]
xor al, 0x66
mov byte [esp + 0xd4], al
call fcn.0043b1bc
mov dword [esp + 0x15c], eax
mov al, byte [esp + 0xd4]
mov dword [edx], esi
mov dword [esp + 0x158], edx
mov byte [edx + 4], al
lea eax, [0x46e3de]
mov dword [esp], eax
mov ecx, dword [esp]
mov dword [esp], 0x6c90aa04
mov edx, dword [esp]
call fcn.0040329a
mov esi, 0xf0844ada
mov ecx, 5
xor edx, edx
xor esi, dword [eax]
mov al, byte [eax + 4]
xor al, 0x95
mov byte [esp + 0xd0], al
call fcn.0043b1bc
mov dword [esp + 0xd4], eax
mov al, byte [esp + 0xd0]
mov dword [edx], esi
mov dword [esp + 0x154], edx
mov byte [edx + 4], al
lea eax, [0x472506]
mov dword [esp], eax
mov ecx, dword [esp]
mov dword [esp], 0xa2efdd3e
mov edx, dword [esp]
call fcn.00403546
movzx ecx, byte [eax + 2]
movzx esi, word [eax]
xor edx, edx
xor cl, 0xf2
xor esi, 0x11ac
mov edi, ecx
mov ecx, 3
call fcn.0043b1bc
mov dword [esp + 0xd0], eax
mov eax, edi
mov word [edx], si
mov dword [esp + 0x150], edx
mov edi, esp
mov byte [edx + 2], al
lea eax, [fcn.00468776]
mov dword [esp], eax
mov ecx, dword [esp]
mov dword [esp], 0xb227adfa
mov edx, dword [esp]
call fcn.00403bff
mov esi, 0xfd7123b0
mov ecx, 4
xor edx, edx
xor esi, dword [eax]
call fcn.0043b1bc
mov dword [esp + 0x14c], eax
lea eax, [0x470007]
mov dword [edx], esi
mov dword [esp + 0x148], edx
mov dword [esp], eax
mov ecx, dword [esp]
mov dword [esp], 0xa8941861
mov edx, dword [esp]
call fcn.00403283
movzx ecx, byte [eax + 2]
movzx esi, word [eax]
xor edx, edx
xor cl, 0xcb
xor esi, 0x2c85
mov edi, ecx
mov ecx, 3
call fcn.0043b1bc
mov dword [esp + 0x144], eax
mov eax, edi
mov word [edx], si
mov dword [esp + 0x140], edx
mov edi, esp
mov byte [edx + 2], al
lea eax, [0x470ba4]
mov dword [esp], eax
mov ecx, dword [esp]
mov dword [esp], 0x21cf9f87
mov edx, dword [esp]
call fcn.00403e52
mov edi, 0x185087d3
xor edx, edx
xor edi, dword [eax]
movzx ecx, byte [eax + 6]
movzx esi, word [eax + 4]
xor cl, 0xf6
xor esi, 0x9346
mov dword [esp + 0xcc], ecx
mov ecx, 7
call fcn.0043b1bc
mov dword [esp + 0x13c], eax
mov eax, dword [esp + 0xcc]
mov dword [edx], edi
mov word [edx + 4], si
mov dword [esp + 0x138], edx
mov byte [edx + 6], al
lea eax, [0x46d191]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0xf2ec4174
mov edx, dword [esp]
call fcn.00403efb
mov esi, 0xfebc7045
xor edx, edx
xor esi, dword [eax]
movzx ecx, byte [eax + 6]
movzx edi, word [eax + 4]
xor cl, 0x29
xor edi, 0xebff
mov dword [esp + 0xc8], ecx
mov ecx, 7
call fcn.0043b1bc
mov dword [esp + 0xcc], eax
mov eax, dword [esp + 0xc8]
mov dword [edx], esi
mov word [edx + 4], di
mov dword [esp + 0x134], edx
mov byte [edx + 6], al
lea eax, [0x46745b]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x72185e57
mov edx, dword [esp]
call fcn.00403394
mov cl, 1
mov dword [esp + 4], ebx
mov dword [esp], ebx
mov edx, ebx
movzx esi, byte [ebx + 0x47377c]
or edx, 1
movzx edx, byte [edx + 0x47377c]
shl edx, 8
or edx, esi
mov esi, ebx
or esi, 2
movzx esi, byte [esi + 0x47377c]
shl esi, 0x10
or edx, esi
mov esi, ebx
or esi, 3
movzx esi, byte [esi + 0x47377c]
shl esi, 0x18
or edx, esi
xor edx, dword [eax + ebx]
test cl, 1
mov ecx, 0
mov dword [esp + ebx], edx
mov ebx, 4
jne 0x40dda0
mov al, byte [eax + 8]
movsd xmm0, qword [esp]
mov ecx, 9
xor edx, edx
xor al, 0x7a
movsd qword [esp + 0x218], xmm0
mov byte [esp + 0x220], al
call fcn.0043b1bc
movsd xmm0, qword [esp + 0x218]
mov dword [esp + 0xc8], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x130], edx
mov ebx, 6
mov esi, 5
mov edi, 7
movsd qword [edx], xmm0
mov al, byte [esp + 0x220]
mov byte [edx + 8], al
mov eax, dword [esp + 0x30]
mov edx, 7
mov dword [eax], ecx
mov ecx, dword [esp + 0x74]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0xc4]
mov dword [eax + 8], edx
mov dword [esp + 0xc4], 0
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x3c]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x7c]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x38], 0
mov dword [eax + 0x1c], ecx
mov ecx, dword [esp + 0xe8]
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x80]
mov dword [eax + 0x24], ecx
mov ecx, dword [esp + 0x78]
mov dword [eax + 0x28], ecx
mov ecx, dword [esp + 0x9c]
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 0xc0]
mov dword [esp + 0xc0], 0
mov dword [eax + 0x34], ecx
mov ecx, dword [esp + 0xac]
mov dword [eax + 0x38], ebx
mov dword [esp + 0xac], 0
mov dword [eax + 0x3c], ecx
mov ecx, dword [esp + 0x98]
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], esi
mov dword [eax + 0x48], edx
mov edx, dword [esp + 0x40]
mov ecx, 8
mov dword [esp + 0x40], 0
mov dword [eax + 0x4c], edx
mov edx, dword [esp + 0xa8]
mov dword [eax + 0x50], edi
mov edi, dword [esp + 0x1fc]
mov dword [eax + 0x54], edx
mov edx, dword [esp + 0xbc]
mov dword [eax + 0x58], edx
mov edx, dword [esp + 0xa0]
mov dword [eax + 0x5c], ecx
mov dword [esp + 0xa0], 0
mov dword [eax + 0x60], edx
mov edx, dword [esp + 0xa4]
mov dword [esp + 0xa4], 0
mov dword [eax + 0x64], edx
mov edx, 0xb
mov dword [eax + 0x68], edx
mov edx, dword [esp + 0x84]
mov dword [eax + 0x6c], edx
mov edx, dword [esp + 0xb8]
mov dword [esp + 0xb8], 0
mov dword [eax + 0x70], edx
mov edx, dword [esp + 0xb0]
mov dword [eax + 0x74], ebx
mov dword [esp + 0xb0], 0
mov dword [eax + 0x78], edx
mov edx, dword [esp + 0xb4]
mov dword [esp + 0xb4], 0
mov dword [eax + 0x7c], edx
mov edx, dword [esp + 0x20c]
mov dword [eax + 0x80], ebx
mov dword [eax + 0x84], edx
mov edx, dword [esp + 0x210]
mov dword [eax + 0x88], edx
mov edx, dword [esp + 0x204]
mov dword [eax + 0x8c], ecx
mov ecx, 7
mov dword [eax + 0x90], edx
mov edx, dword [esp + 0x208]
mov dword [eax + 0x94], edx
mov edx, 0xa
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edi
mov edi, dword [esp + 0x200]
mov dword [eax + 0xa0], edi
mov edi, 4
mov dword [eax + 0xa4], edi
mov edi, dword [esp + 0x1f4]
mov dword [eax + 0xa8], edi
mov edi, dword [esp + 0x1f8]
mov dword [eax + 0xac], edi
mov edi, dword [esp + 0x1ec]
mov dword [eax + 0xb0], esi
mov dword [eax + 0xb4], edi
mov edi, dword [esp + 0x1f0]
mov dword [eax + 0xb8], edi
mov edi, dword [esp + 0x1e4]
mov dword [eax + 0xbc], esi
mov dword [eax + 0xc0], edi
mov edi, dword [esp + 0x1e8]
mov dword [eax + 0xc4], edi
mov edi, dword [esp + 0x1dc]
mov dword [eax + 0xc8], 0xc
mov dword [eax + 0xcc], edi
mov edi, dword [esp + 0x1e0]
mov dword [eax + 0xd0], edi
mov edi, dword [esp + 0x1d8]
mov dword [eax + 0xd4], 0x10
mov dword [eax + 0xd8], edi
mov edi, dword [esp + 0x240]
mov dword [eax + 0xdc], edi
mov edi, dword [esp + 0x1d4]
mov dword [eax + 0xe0], esi
mov dword [eax + 0xe4], edi
mov edi, dword [esp + 0xe4]
mov dword [eax + 0xe8], edi
mov edi, dword [esp + 0x1d0]
mov dword [eax + 0xec], ecx
mov dword [eax + 0xf0], edi
mov edi, dword [esp + 0xe0]
mov dword [eax + 0xf4], edi
mov dword [eax + 0xf8], edx
mov edx, dword [esp + 0x1cc]
mov edi, dword [esp + 0x198]
mov dword [eax + 0xfc], edx
mov edx, dword [esp + 0x1c8]
mov dword [eax + 0x100], edx
mov edx, dword [esp + 0x1c0]
mov dword [eax + 0x104], esi
mov dword [eax + 0x108], edx
mov edx, dword [esp + 0x1c4]
mov dword [eax + 0x10c], edx
mov edx, dword [esp + 0x1bc]
mov dword [eax + 0x110], esi
mov dword [eax + 0x114], edx
mov edx, dword [esp + 0xdc]
mov dword [eax + 0x118], edx
mov edx, dword [esp + 0x1b4]
mov dword [eax + 0x11c], ecx
mov dword [eax + 0x120], edx
mov edx, dword [esp + 0x1b8]
mov dword [eax + 0x124], edx
mov edx, dword [esp + 0x1b0]
mov dword [eax + 0x128], ebx
mov dword [eax + 0x12c], edx
mov edx, dword [esp + 0xd8]
mov dword [eax + 0x130], edx
mov edx, dword [esp + 0x1ac]
mov dword [eax + 0x134], ecx
mov ecx, 8
mov dword [eax + 0x138], edx
mov edx, dword [esp + 0x1a8]
mov dword [eax + 0x13c], edx
mov edx, dword [esp + 0x1a0]
mov dword [eax + 0x140], ecx
mov dword [eax + 0x144], edx
mov edx, dword [esp + 0x1a4]
mov dword [eax + 0x148], edx
mov edx, 3
mov dword [eax + 0x14c], edx
mov dword [eax + 0x150], edi
mov edi, dword [esp + 0x19c]
mov dword [eax + 0x154], edi
mov edi, dword [esp + 0x190]
mov dword [eax + 0x158], 0xe
mov dword [eax + 0x15c], edi
mov edi, dword [esp + 0x194]
mov dword [eax + 0x160], edi
mov edi, dword [esp + 0x188]
mov dword [eax + 0x164], edx
mov dword [eax + 0x168], edi
mov edi, dword [esp + 0x18c]
mov dword [eax + 0x16c], edi
mov edi, dword [esp + 0x184]
mov dword [eax + 0x170], esi
mov dword [eax + 0x174], edi
mov edi, dword [esp + 0x180]
mov dword [eax + 0x178], edi
mov edi, 4
mov dword [eax + 0x17c], edi
mov edi, dword [esp + 0x17c]
mov dword [eax + 0x180], edi
mov edi, dword [esp + 0x178]
mov dword [eax + 0x184], edi
mov edi, dword [esp + 0x174]
mov dword [eax + 0x188], ecx
mov ecx, 0xb
mov dword [eax + 0x18c], edi
mov edi, dword [esp + 0x170]
mov dword [eax + 0x190], edi
mov edi, dword [esp + 0x16c]
mov dword [eax + 0x194], ecx
mov dword [eax + 0x198], edi
mov edi, dword [esp + 0x168]
mov dword [eax + 0x19c], edi
mov edi, dword [esp + 0x164]
mov dword [eax + 0x1a0], ebx
mov ebx, dword [esp + 0x140]
mov dword [eax + 0x1a4], edi
mov edi, dword [esp + 0x160]
mov dword [eax + 0x1a8], edi
mov edi, dword [esp + 0x15c]
mov dword [eax + 0x1ac], ecx
mov ecx, dword [esp + 0xd0]
mov dword [eax + 0x1b0], edi
mov edi, dword [esp + 0x158]
mov dword [eax + 0x1b4], edi
mov edi, dword [esp + 0xd4]
mov dword [eax + 0x1b8], esi
mov dword [eax + 0x1bc], edi
mov edi, dword [esp + 0x154]
mov dword [eax + 0x1c0], edi
mov edi, dword [esp + 0x150]
mov dword [eax + 0x1c4], esi
mov esi, dword [esp + 0x14c]
mov dword [eax + 0x1c8], ecx
mov dword [eax + 0x1cc], edi
mov edi, dword [esp + 0x148]
mov dword [eax + 0x1d0], edx
mov dword [eax + 0x1d4], esi
mov esi, dword [esp + 0x144]
mov dword [eax + 0x1d8], edi
mov edi, 4
mov dword [eax + 0x1dc], edi
mov dword [eax + 0x1e0], esi
mov esi, dword [esp + 0x13c]
mov dword [eax + 0x1e4], ebx
mov dword [eax + 0x1e8], edx
mov edx, dword [esp + 0x138]
mov ebx, dword [esp + 0x134]
mov dword [eax + 0x1ec], esi
mov esi, dword [esp + 0xcc]
mov dword [eax + 0x1f0], edx
mov edx, 7
mov dword [eax + 0x1f4], edx
mov dword [eax + 0x1f8], esi
mov dword [eax + 0x1fc], ebx
mov dword [eax + 0x200], edx
mov esi, dword [esp + 0xc8]
mov edx, dword [esp + 0x130]
lea ebx, [esp + 0x224]
mov dword [eax + 0x204], esi
mov dword [eax + 0x208], edx
mov edx, 0x2c
mov dword [eax + 0x20c], 9
mov esi, 0
mov dword [ebx], edx
mov dword [ebx + 4], eax
lea eax, [esp + 0xf0]
mov dword [ebx + 8], edx
mov ebx, dword [esp + 0x44]
mov edx, 4
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], esi
lea eax, [esp + 0x100]
mov dword [eax], esi
xor esi, esi
mov dword [eax + 4], edx
mov dword [eax + 8], esi
mov al, 1
mov dword [esp + 0xbc], eax
xor eax, eax
inc eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x78], eax
mov esi, dword [ebx + 0x10]
test esi, esi
je 0x40e4b0
xor edi, edi
mov dword [ebx + 0x10], 0
mov ecx, esp
mov edx, ebx
call fcn.00456620
mov eax, dword [esp]
cmp eax, 0x80000000
je 0x40e4a8
test eax, eax
je 0x40e4a1
push dword [esp + 4]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
inc edi
cmp esi, edi
jne 0x40e478
jmp 0x40e4b0
cmp edi, esi
jne 0x40f6dc
lea ecx, [esp + 0x110]
mov edx, ebx
call fcn.00456620
mov eax, dword [esp + 0x110]
cmp eax, 0x80000000
je 0x40f6dc
mov dword [esp + 0x34], eax
lea eax, [0x46a43c]
mov edi, dword [esp + 0x114]
mov esi, dword [esp + 0x118]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x6cdf32f
mov edx, dword [esp]
call fcn.00403bbb
movzx eax, word [eax]
mov dword [esp + 0x30], edi
xor eax, 0x38a3
cmp esi, 2
mov word [esp + 0x48], ax
jne 0x40e523
movzx eax, word [edi]
cmp ax, word [esp + 0x48]
je 0x40e6b4
lea eax, [0x4691b3]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0xb01f1012
mov edx, dword [esp]
call fcn.00403691
xor ecx, ecx
mov dl, 1
mov dword [esp + 4], ecx
mov dword [esp], ecx
mov edi, ecx
movzx ebx, byte [ecx + 0x473785]
or edi, 1
movzx edi, byte [edi + 0x473785]
shl edi, 8
or edi, ebx
mov ebx, ecx
or ebx, 2
movzx ebx, byte [ebx + 0x473785]
shl ebx, 0x10
or edi, ebx
mov ebx, ecx
or ebx, 3
movzx ebx, byte [ebx + 0x473785]
shl ebx, 0x18
or edi, ebx
xor edi, dword [eax + ecx]
test dl, 1
mov edx, 0
mov dword [esp + ecx], edi
mov ecx, 4
jne 0x40e54b
movsd xmm0, qword [esp]
cmp esi, 8
movsd qword [esp + 0x48], xmm0
jne 0x40e5c3
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
xor eax, dword [esp + 0x48]
xor ecx, dword [esp + 0x4c]
or ecx, eax
je 0x40e6b4
lea eax, [0x473a13]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x2c784071
mov edx, dword [esp]
call fcn.004032c1
xor ecx, ecx
mov dl, 1
mov dword [esp + 4], ecx
mov dword [esp], ecx
mov edi, ecx
movzx ebx, byte [ecx + 0x47378d]
or edi, 1
movzx edi, byte [edi + 0x47378d]
shl edi, 8
or edi, ebx
mov ebx, ecx
or ebx, 2
movzx ebx, byte [ebx + 0x47378d]
shl ebx, 0x10
or edi, ebx
mov ebx, ecx
or ebx, 3
movzx ebx, byte [ebx + 0x47378d]
shl ebx, 0x18
or edi, ebx
xor edi, dword [eax + ecx]
test dl, 1
mov edx, 0
mov dword [esp + ecx], edi
mov ecx, 4
jne 0x40e5eb
mov al, byte [eax + 8]
movsd xmm0, qword [esp]
xor al, 0xc0
cmp esi, 9
movsd qword [esp + 0x48], xmm0
mov byte [esp + 0x50], al
jne 0x40e66a
push 9
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x38]
call fcn.00460cfe
add esp, 0xc
test eax, eax
je 0x40e6b4
lea eax, [0x46507b]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x5b5751ac
mov edx, dword [esp]
call fcn.00403f1c
movzx eax, word [eax]
mov ebx, dword [esp + 0x44]
xor eax, 0x7fa5
cmp esi, 2
mov word [esp + 0x48], ax
jne 0x40e703
mov eax, dword [esp + 0x30]
movzx eax, word [eax]
cmp ax, word [esp + 0x48]
lea eax, [esp + 0x48]
jne 0x40e707
jmp 0x40eb59
mov ebx, dword [esp + 0x44]
mov esi, dword [ebx + 0x10]
test esi, esi
je 0x40eba9
xor edi, edi
mov dword [ebx + 0x10], 0
mov ecx, esp
mov edx, ebx
call fcn.00456620
mov eax, dword [esp]
cmp eax, 0x80000000
je 0x40eba1
test eax, eax
je 0x40e6f9
push dword [esp + 4]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
inc edi
cmp esi, edi
jne 0x40e6cc
jmp 0x40eba9
lea eax, [esp + 0x48]
lea ecx, [0x46e9b0]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x48], 0x54ed6cb3
mov edx, dword [esp + 0x48]
call fcn.00403333
mov ecx, dword [eax]
movzx eax, word [eax + 4]
mov edi, 0xcb975fc5
lea edx, [esp + 0x48]
xor ecx, edi
xor eax, 0x11b2
cmp esi, 6
mov dword [esp], ecx
mov word [esp + 4], ax
jne 0x40e766
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
movzx ecx, word [ecx + 4]
xor cx, word [esp + 4]
xor eax, dword [esp]
movzx ecx, cx
or ecx, eax
je 0x40eb59
lea eax, [0x468de7]
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x48], 0x24d4c48d
mov edx, dword [esp + 0x48]
call fcn.00403e3f
mov edx, dword [eax]
mov ecx, 0x87bce65c
xor edx, ecx
movzx ecx, byte [eax + 6]
movzx eax, word [eax + 4]
mov dword [esp], edx
xor eax, 0x1707
xor cl, 0x9a
cmp esi, 7
mov word [esp + 4], ax
mov byte [esp + 6], cl
jne 0x40e7c7
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
mov ecx, dword [ecx + 3]
xor eax, dword [esp]
xor ecx, dword [esp + 3]
or ecx, eax
je 0x40eb59
lea eax, [0x471ce9]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0xc556ac56
mov edx, dword [esp]
call fcn.00403c1a
movzx eax, word [eax]
xor eax, 0x3a1c
cmp esi, 2
mov word [esp + 0x48], ax
jne 0x40e808
mov eax, dword [esp + 0x30]
movzx eax, word [eax]
cmp ax, word [esp + 0x48]
je 0x40ec05
lea eax, [0x467d90]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0xeb888c93
mov edx, dword [esp]
call fcn.0040340a
xor ecx, ecx
mov dl, 1
mov dword [esp + 4], ecx
mov dword [esp], ecx
mov edi, ecx
movzx ebx, byte [ecx + 0x473796]
or edi, 1
movzx edi, byte [edi + 0x473796]
shl edi, 8
or edi, ebx
mov ebx, ecx
or ebx, 2
movzx ebx, byte [ebx + 0x473796]
shl ebx, 0x10
or edi, ebx
mov ebx, ecx
or ebx, 3
movzx ebx, byte [ebx + 0x473796]
shl ebx, 0x18
or edi, ebx
xor edi, dword [eax + ecx]
test dl, 1
mov edx, 0
mov dword [esp + ecx], edi
mov ecx, 4
jne 0x40e830
movsd xmm0, qword [esp]
cmp esi, 8
movsd qword [esp + 0x48], xmm0
jne 0x40e8a8
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
xor eax, dword [esp + 0x48]
xor ecx, dword [esp + 0x4c]
or ecx, eax
je 0x40ec05
lea eax, [0x46f3b3]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x31c20ce7
mov edx, dword [esp]
call fcn.00404005
xor ecx, ecx
mov dl, 1
mov dword [esp + 4], ecx
mov dword [esp], ecx
mov edi, ecx
movzx ebx, byte [ecx + 0x47379e]
or edi, 1
movzx edi, byte [edi + 0x47379e]
shl edi, 8
or edi, ebx
mov ebx, ecx
or ebx, 2
movzx ebx, byte [ebx + 0x47379e]
shl ebx, 0x10
or edi, ebx
mov ebx, ecx
or ebx, 3
movzx ebx, byte [ebx + 0x47379e]
shl ebx, 0x18
or edi, ebx
xor edi, dword [eax + ecx]
test dl, 1
mov edx, 0
mov dword [esp + ecx], edi
mov ecx, 4
jne 0x40e8d0
mov al, byte [eax + 8]
movsd xmm0, qword [esp]
xor al, 0x32
cmp esi, 9
movsd qword [esp + 0x48], xmm0
mov byte [esp + 0x50], al
jne 0x40e953
push 9
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x38]
call fcn.00460cfe
add esp, 0xc
test eax, eax
je 0x40ec05
lea eax, [0x471bfd]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x5f30c245
mov edx, dword [esp]
call fcn.004037ee
movzx eax, word [eax]
xor eax, 0x11d0
cmp esi, 2
mov word [esp + 0x48], ax
jne 0x40e994
mov eax, dword [esp + 0x30]
movzx eax, word [eax]
cmp ax, word [esp + 0x48]
je 0x40ed30
lea eax, [0x469e28]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0xe8912e33
mov edx, dword [esp]
call fcn.0040409d
xor ecx, ecx
mov dl, 1
mov dword [esp + 4], ecx
mov dword [esp], ecx
mov edi, ecx
movzx ebx, byte [ecx + 0x4737a7]
or edi, 1
movzx edi, byte [edi + 0x4737a7]
shl edi, 8
or edi, ebx
mov ebx, ecx
or ebx, 2
movzx ebx, byte [ebx + 0x4737a7]
shl ebx, 0x10
or edi, ebx
mov ebx, ecx
or ebx, 3
movzx ebx, byte [ebx + 0x4737a7]
shl ebx, 0x18
or edi, ebx
xor edi, dword [eax + ecx]
test dl, 1
mov edx, 0
mov dword [esp + ecx], edi
mov ecx, 4
jne 0x40e9bc
movzx eax, word [eax + 8]
movsd xmm0, qword [esp]
xor eax, 0x3d88
cmp esi, 0xa
movsd qword [esp + 0x48], xmm0
mov word [esp + 0x50], ax
jne 0x40ea44
push 0xa
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x38]
call fcn.00460cfe
add esp, 0xc
test eax, eax
je 0x40ed30
lea eax, [0x46d69e]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0xf11bc5f9
mov edx, dword [esp]
call fcn.004033ac
xor ecx, ecx
mov dl, 1
mov dword [esp + 4], ecx
mov dword [esp], ecx
mov edi, ecx
movzx ebx, byte [ecx + 0x4737b1]
or edi, 1
movzx edi, byte [edi + 0x4737b1]
shl edi, 8
or edi, ebx
mov ebx, ecx
or ebx, 2
movzx ebx, byte [ebx + 0x4737b1]
shl ebx, 0x10
or edi, ebx
mov ebx, ecx
or ebx, 3
movzx ebx, byte [ebx + 0x4737b1]
shl ebx, 0x18
or edi, ebx
xor edi, dword [eax + ecx]
test dl, 1
mov edx, 0
mov dword [esp + ecx], edi
mov ecx, 4
jne 0x40ea6c
movzx ecx, byte [eax + 0xa]
movzx eax, word [eax + 8]
xor eax, 0x4ff6
xor cl, 0x2f
cmp esi, 0xb
mov word [esp + 8], ax
mov byte [esp + 0xa], cl
movsd xmm0, qword [esp]
mov eax, dword [esp + 7]
movsd qword [esp + 0x48], xmm0
mov dword [esp + 0x4f], eax
jne 0x40eb07
push 0xb
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x38]
call fcn.00460cfe
add esp, 0xc
test eax, eax
je 0x40ed30
lea eax, [0x470e2f]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x5e87d748
mov edx, dword [esp]
call fcn.00403888
movzx eax, word [eax]
mov ebx, dword [esp + 0x44]
xor eax, 0xbe2e
cmp esi, 2
mov word [esp + 0x48], ax
jne 0x40ede5
mov eax, dword [esp + 0x30]
movzx eax, word [eax]
cmp ax, word [esp + 0x48]
lea eax, [esp + 0x48]
jne 0x40ede9
jmp 0x40eeeb
mov esi, dword [ebx + 0x10]
test esi, esi
je 0x40ec1b
xor edi, edi
mov dword [ebx + 0x10], 0
mov ecx, esp
mov edx, ebx
call fcn.00456620
mov eax, dword [esp]
cmp eax, 0x80000000
je 0x40ec13
test eax, eax
je 0x40eb9a
push dword [esp + 4]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
inc edi
cmp esi, edi
jne 0x40eb6d
jmp 0x40ec1b
cmp edi, esi
jne 0x40ed3d
mov ecx, esp
mov edx, ebx
call fcn.00456620
mov edi, dword [esp]
cmp edi, 0x80000000
je 0x40ed3d
mov esi, dword [esp + 4]
lea ecx, [esp + 0x48]
mov edx, esi
push dword [esp + 8]
call fcn.0041c200
add esp, 4
cmp byte [esp + 0x48], 0
jne 0x40ebe9
mov eax, dword [esp + 0x4c]
mov dword [esp + 0xec], eax
test edi, edi
je 0x40ed3d
push esi
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x40ed3d
mov al, 1
mov dword [esp + 0xc4], eax
jmp 0x40ed39
cmp edi, esi
jne 0x40ed3d
lea ecx, [esp + 0x120]
mov edx, ebx
call fcn.00456620
mov eax, dword [esp + 0x120]
cmp eax, 0x80000000
je 0x40ed3d
mov ecx, dword [esp + 0x124]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x128]
mov edx, 0x5c
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0xe8], ecx
xor ecx, ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 1
mov dword [esp + 0x60], edx
mov dword [esp + 0x64], ecx
lea ecx, [esp + 0x48]
mov dword [esp + 0x68], eax
mov word [esp + 0x6c], 1
mov dword [esp + 0x70], 2
call fcn.0040c908
test eax, eax
je 0x40eede
mov ecx, 4
mov esi, eax
mov edi, edx
call fcn.0042a5ef
mov dword [edx], esi
mov dword [edx + 4], edi
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], edx
mov dword [esp + 0x74], edx
mov dword [esp + 0x90], 1
mov ecx, 0xb
mov edi, esp
lea esi, [esp + 0x48]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
inc esi
mov ecx, esp
call fcn.0040c908
test eax, eax
je 0x40ed60
cmp esi, dword [esp + 0x88]
mov edi, eax
mov ebx, edx
je 0x40ed10
mov eax, dword [esp + 0x74]
mov dword [eax + esi*8], edi
mov dword [eax + esi*8 + 4], ebx
inc esi
mov dword [esp + 0x90], esi
jmp 0x40ece3
lea ecx, [esp + 0x88]
mov edx, esi
push 1
call fcn.0046f2c1
add esp, 4
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x74], eax
jmp 0x40ecfb
mov al, 1
mov dword [esp + 0xc0], eax
mov ebx, dword [esp + 0x44]
mov esi, dword [esp + 0x34]
test esi, esi
je 0x40e468
push dword [esp + 0x30]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x40e468
mov edx, dword [esp + 0x88]
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x3c]
test esi, esi
je 0x40f1d2
mov ebx, dword [esp + 0x44]
cmp esi, 1
mov dword [esp + 0x84], edx
mov dword [esp + 0x80], ecx
jne 0x40f1f9
mov edi, dword [ecx + 4]
mov esi, dword [ecx]
xor edx, edx
mov ecx, edi
call fcn.0043b1bc
mov dword [esp + 0x9c], eax
mov dword [esp + 0xac], edi
push edi
push esi
mov dword [esp + 0xa0], edx
push edx
call fcn.00462380
add esp, 0xc
cmp dword [esp + 0x38], 0
je 0x40f32d
push dword [esp + 0x78]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x40f32d
lea eax, [esp + 0x48]
lea ecx, [0x468310]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x48], 0x73e14c1c
mov edx, dword [esp + 0x48]
call fcn.0040407e
mov ecx, dword [eax]
mov al, byte [eax + 4]
mov edi, 0xeb33449b
lea edx, [esp + 0x48]
xor ecx, edi
xor al, 0x2b
cmp esi, 5
mov dword [esp], ecx
mov byte [esp + 4], al
jne 0x40ee41
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
mov cl, byte [ecx + 4]
xor cl, byte [esp + 4]
xor eax, dword [esp]
movzx ecx, cl
or ecx, eax
je 0x40eeeb
lea eax, [0x46c8a7]
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x48], 0x8668c775
mov edx, dword [esp + 0x48]
call fcn.00403355
mov ecx, dword [eax]
movzx eax, word [eax + 4]
mov edx, 0xc611db06
xor ecx, edx
xor eax, 0xd27e
cmp esi, 6
mov dword [esp], ecx
mov word [esp + 4], ax
jne 0x40ee98
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
movzx ecx, word [ecx + 4]
xor cx, word [esp + 4]
xor eax, dword [esp]
movzx ecx, cx
or ecx, eax
je 0x40eeeb
lea eax, [0x4687af]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x97ae39fa
mov edx, dword [esp]
call fcn.00403213
movzx eax, word [eax]
xor eax, 0x8802
cmp esi, 2
mov word [esp + 0x48], ax
jne 0x40ef2d
mov eax, dword [esp + 0x30]
movzx eax, word [eax]
cmp ax, word [esp + 0x48]
lea eax, [esp + 0x48]
jne 0x40ef31
jmp 0x40f33e
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x7c]
jmp 0x40f671
lea ecx, [esp + 0x48]
mov edx, ebx
call section..text
mov edi, dword [esp + 0x48]
cmp edi, 0x80000000
je 0x40ed3d
mov esi, dword [esp + 0x4c]
mov ecx, esp
mov edx, esi
push dword [esp + 0x50]
call fcn.00414b10
add esp, 4
lea ecx, [esp + 0x224]
mov edx, esp
call fcn.00402140
jmp 0x40ebe9
lea eax, [esp + 0x48]
lea ecx, [0x47321e]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x48], 0x90799b58
mov edx, dword [esp + 0x48]
call fcn.00403b26
mov ecx, dword [eax]
mov al, byte [eax + 4]
mov edi, 0x7203672e
lea edx, [esp + 0x48]
xor ecx, edi
xor al, 0xfd
cmp esi, 5
mov dword [esp], ecx
mov byte [esp + 4], al
jne 0x40ef89
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
mov cl, byte [ecx + 4]
xor cl, byte [esp + 4]
xor eax, dword [esp]
movzx ecx, cl
or ecx, eax
je 0x40f33e
lea eax, [0x469ec3]
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x48], 0x22557128
mov edx, dword [esp + 0x48]
call fcn.0040326f
mov ecx, dword [eax]
movzx eax, word [eax + 4]
mov edx, 0x271d9029
xor ecx, edx
xor eax, 0xae05
cmp esi, 6
mov dword [esp], ecx
mov word [esp + 4], ax
jne 0x40efe4
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
movzx ecx, word [ecx + 4]
xor cx, word [esp + 4]
xor eax, dword [esp]
movzx ecx, cx
or ecx, eax
je 0x40f33e
lea eax, [0x4667a8]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x84ad32c7
mov edx, dword [esp]
call fcn.004032e4
movzx eax, word [eax]
xor eax, 0xe832
cmp esi, 2
mov word [esp + 0x48], ax
jne 0x40f025
mov eax, dword [esp + 0x30]
movzx eax, word [eax]
cmp ax, word [esp + 0x48]
je 0x40f3f7
lea eax, [0x470ac7]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0xb37f8673
mov edx, dword [esp]
call fcn.00404057
xor ecx, ecx
mov dl, 1
mov dword [esp + 4], ecx
mov dword [esp], ecx
mov edi, ecx
movzx ebx, byte [ecx + 0x4737bc]
or edi, 1
movzx edi, byte [edi + 0x4737bc]
shl edi, 8
or edi, ebx
mov ebx, ecx
or ebx, 2
movzx ebx, byte [ebx + 0x4737bc]
shl ebx, 0x10
or edi, ebx
mov ebx, ecx
or ebx, 3
movzx ebx, byte [ebx + 0x4737bc]
shl ebx, 0x18
or edi, ebx
xor edi, dword [eax + ecx]
test dl, 1
mov edx, 0
mov dword [esp + ecx], edi
mov ecx, 4
jne 0x40f04d
mov al, byte [eax + 8]
movsd xmm0, qword [esp]
xor al, 0x70
cmp esi, 9
movsd qword [esp + 0x48], xmm0
mov byte [esp + 0x50], al
jne 0x40f0d0
push 9
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x38]
call fcn.00460cfe
add esp, 0xc
test eax, eax
je 0x40f3f7
lea eax, [0x466b94]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x6636c9cf
mov edx, dword [esp]
call fcn.00403cd9
xor ecx, ecx
mov dl, 1
mov dword [esp + 4], ecx
mov dword [esp], ecx
mov edi, ecx
movzx ebx, byte [ecx + 0x4737c5]
or edi, 1
movzx edi, byte [edi + 0x4737c5]
shl edi, 8
or edi, ebx
mov ebx, ecx
or ebx, 2
movzx ebx, byte [ebx + 0x4737c5]
shl ebx, 0x10
or edi, ebx
mov ebx, ecx
or ebx, 3
movzx ebx, byte [ebx + 0x4737c5]
shl ebx, 0x18
or edi, ebx
xor edi, dword [eax + ecx]
test dl, 1
mov edx, 0
mov dword [esp + ecx], edi
mov ecx, 4
jne 0x40f0f8
movzx eax, word [eax + 8]
movsd xmm0, qword [esp]
xor eax, 0x79a8
cmp esi, 0xa
movsd qword [esp + 0x48], xmm0
mov word [esp + 0x50], ax
jne 0x40f180
push 0xa
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x38]
call fcn.00460cfe
add esp, 0xc
test eax, eax
je 0x40f3f7
lea eax, [0x467f21]
mov dword [esp], eax
mov eax, esp
mov ecx, dword [esp]
mov dword [esp], 0x75ed2e37
mov edx, dword [esp]
call fcn.004035d7
movzx eax, word [eax]
mov ebx, dword [esp + 0x44]
xor eax, 0x6307
cmp esi, 2
mov word [esp + 0x48], ax
jne 0x40f407
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x48]
movzx eax, word [eax]
cmp ax, word [esp + 0x48]
jne 0x40f40b
jmp 0x40f504
mov esi, dword [esp + 0x78]
mov ebx, dword [esp + 0x44]
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x98], esi
mov esi, dword [esp + 0x38]
mov dword [esp + 0x9c], esi
mov esi, dword [esp + 0x34]
jmp 0x40f644
mov edi, dword [ecx + 4]
mov esi, dword [ecx]
xor edx, edx
mov ecx, edi
call fcn.0043b1bc
mov dword [esp + 0x9c], eax
mov dword [esp + 0xac], edi
push edi
push esi
mov dword [esp + 0xa0], edx
push edx
call fcn.00462380
add esp, 0xc
cmp dword [esp + 0x38], 0
je 0x40f240
push dword [esp + 0x78]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [esp + 0x80]
mov edx, 0x3a
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], eax
xor eax, eax
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], 1
mov dword [esp + 0x60], edx
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], ecx
lea ecx, [esp + 0x48]
mov word [esp + 0x6c], 1
mov dword [esp + 0x70], 2
call fcn.0040c908
test eax, eax
je 0x40f32d
mov ecx, 4
mov esi, eax
mov edi, edx
call fcn.0042a5ef
mov dword [edx], esi
mov dword [edx + 4], edi
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], edx
mov dword [esp + 0x74], edx
mov dword [esp + 0x90], 1
mov ecx, 0xb
mov edi, esp
lea esi, [esp + 0x48]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
inc esi
mov ecx, esp
call fcn.0040c908
test eax, eax
je 0x40f39c
cmp esi, dword [esp + 0x88]
mov edi, eax
mov ebx, edx
je 0x40f30d
mov eax, dword [esp + 0x74]
mov dword [eax + esi*8], edi
mov dword [eax + esi*8 + 4], ebx
inc esi
mov dword [esp + 0x90], esi
jmp 0x40f2dc
lea ecx, [esp + 0x88]
mov edx, esi
push 1
call fcn.0046f2c1
add esp, 4
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x74], eax
jmp 0x40f2f8
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x7c]
jmp 0x40f636
lea ecx, [esp + 0x48]
mov edx, ebx
call section..text
mov edi, dword [esp + 0x48]
cmp edi, 0x80000000
je 0x40ed3d
mov esi, dword [esp + 0x4c]
mov ecx, esp
mov edx, esi
push dword [esp + 0x50]
call fcn.00414b10
add esp, 4
lea ecx, [esp + 0x224]
mov edx, esp
call fcn.00402176
cmp dword [esp], 0
je 0x40ebe9
push dword [esp + 4]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x40ebe9
mov ecx, dword [esp + 0x88]
mov ebx, dword [esp + 0x8c]
mov eax, dword [esp + 0x3c]
test esi, esi
mov dword [esp + 0x74], ecx
je 0x40f556
cmp esi, 1
jne 0x40f563
mov esi, dword [ebx + 4]
mov edi, dword [ebx]
xor edx, edx
mov ecx, esi
call fcn.0043b1bc
mov dword [esp + 0xa0], esi
push esi
mov esi, eax
push edi
mov dword [esp + 0x40], edx
push edx
call fcn.00462380
add esp, 0xc
cmp dword [esp + 0x40], 0
mov eax, dword [esp + 0x3c]
jmp 0x40f5f7
mov dword [esp + 0xbc], 0
jmp 0x40ed39
lea edx, [esp + 0x48]
lea eax, [0x47185a]
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x48], 0x81e363d6
mov edx, dword [esp + 0x48]
call fcn.00403f62
mov ecx, dword [eax]
mov al, byte [eax + 4]
mov edi, 0x1a1f765e
lea edx, [esp + 0x48]
xor ecx, edi
xor al, 0xb4
cmp esi, 5
mov dword [esp], ecx
mov byte [esp + 4], al
jne 0x40f463
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
mov cl, byte [ecx + 4]
xor cl, byte [esp + 4]
xor eax, dword [esp]
movzx ecx, cl
or ecx, eax
je 0x40f504
lea eax, [0x4725b5]
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x48], 0xeb71e22e
mov edx, dword [esp + 0x48]
call fcn.00403467
mov ecx, dword [eax]
movzx eax, word [eax + 4]
mov edi, 0xddf13973
lea edx, [esp + 0x48]
xor ecx, edi
xor eax, 0xa79c
cmp esi, 6
mov dword [esp], ecx
mov word [esp + 4], ax
jne 0x40f4be
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
movzx ecx, word [ecx + 4]
xor cx, word [esp + 4]
xor eax, dword [esp]
movzx ecx, cx
or ecx, eax
je 0x40f504
mov edi, dword [esp + 0x30]
mov ecx, edx
mov edx, edi
push esi
call fcn.0045d4f0
add esp, 4
cmp dword [esp + 0x48], 0x80000000
jne 0x40f693
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x100]
mov edx, esp
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov byte [esp + 0xc], 1
call fcn.00402106
jmp 0x40f6ce
mov ecx, edx
mov edx, ebx
call section..text
mov edi, dword [esp + 0x48]
cmp edi, 0x80000000
je 0x40ed3d
mov esi, dword [esp + 0x4c]
mov ecx, esp
mov edx, esi
push dword [esp + 0x50]
call fcn.0041c2a0
add esp, 4
cmp byte [esp], 0
jne 0x40ebe9
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb0], ecx
jmp 0x40ebe9
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x38], eax
jmp 0x40f614
mov esi, dword [ebx + 4]
mov edi, dword [ebx]
xor edx, edx
mov ecx, esi
call fcn.0043b1bc
mov dword [esp + 0x78], eax
mov dword [esp + 0xa0], esi
push esi
push edi
mov dword [esp + 0x40], edx
push edx
call fcn.00462380
add esp, 0xc
cmp dword [esp + 0x40], 0
je 0x40f5a4
push dword [esp + 0x3c]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
mov eax, dword [ebx + 8]
xor edx, edx
mov ecx, esi
mov dword [esp + 0x40], eax
call fcn.0043b1bc
mov dword [esp + 0x3c], eax
mov edi, edx
mov dword [esp + 0xb8], esi
push esi
push dword [esp + 0x44]
push edx
call fcn.00462380
add esp, 0xc
mov eax, dword [esp + 0xa8]
mov esi, dword [esp + 0x78]
cmp dword [esp + 0xa4], 0
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0xa8], edi
mov dword [esp + 0xa4], ecx
mov dword [esp + 0x40], esi
mov edi, dword [esp + 0x7c]
je 0x40f614
push eax
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 0x40], esi
cmp dword [esp + 0x74], 0
mov esi, dword [esp + 0x34]
je 0x40f62e
push ebx
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp + 0x38]
mov ebx, dword [esp + 0x44]
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x84]
test edx, edx
mov dword [esp + 0x3c], eax
je 0x40f65b
push ecx
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x9c]
mov dword [esp + 0x78], eax
mov dword [esp + 0x38], ecx
test edi, edi
je 0x40ed41
push dword [esp + 0xe8]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x40ed41
lea ecx, [esp + 0xf0]
lea edx, [esp + 0x48]
call fcn.00402106
cmp dword [esp + 0x34], 0
je 0x40e468
push dword [esp + 0x30]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esp + 0x48], 0x80000000
jne 0x40e468
lea ecx, [esp + 0x48]
call fcn.00401ef2
jmp 0x40e468
mov ecx, dword [esp + 0x214]
mov eax, dword [esp + 0x38]
movsd xmm0, qword [esp + 0x224]
mov esi, dword [esp + 0xb0]
mov edi, dword [ebx + 0xc]
mov edx, dword [esp + 0xb4]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x78]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0xac]
mov dword [ecx + 0x10], eax
mov eax, dword [esp + 0x40]
mov dword [ecx + 0x14], eax
mov eax, dword [esp + 0x3c]
mov dword [ecx + 0x18], eax
mov eax, dword [esp + 0xa0]
mov dword [ecx + 0x1c], eax
mov eax, dword [esp + 0xa4]
mov dword [ecx + 0x20], eax
mov eax, dword [esp + 0xa8]
mov dword [ecx + 0x24], eax
mov eax, dword [esp + 0xb8]
mov dword [ecx + 0x28], eax
mov eax, dword [esp + 0x22c]
movsd qword [ecx + 0x2c], xmm0
movsd xmm0, qword [esp + 0xf0]
mov dword [ecx + 0x34], eax
mov eax, dword [esp + 0xf8]
movsd qword [ecx + 0x38], xmm0
movsd xmm0, qword [esp + 0x100]
mov dword [ecx + 0x40], eax
mov eax, dword [esp + 0x108]
movsd qword [ecx + 0x4c], xmm0
mov dword [ecx + 0x54], eax
mov eax, dword [esp + 0xec]
mov dword [ecx + 0x44], eax
mov eax, dword [esp + 0xc4]
and al, 1
mov byte [ecx + 0x48], al
mov eax, dword [esp + 0xc0]
and al, 1
mov byte [ecx + 0x49], al
mov eax, dword [esp + 0xbc]
and al, 1
mov byte [ecx + 0x4a], al
mov dword [ecx], esi
mov esi, dword [ebx + 4]
mov dword [ecx + 4], edx
sub edi, esi
je 0x40f7e6
shr edi, 4
add esi, 4
cmp dword [esi - 4], 0
je 0x40f7e0
push dword [esi]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
add esi, 0x10
dec edi
jne 0x40f7ca
cmp dword [ebx + 8], 0
je 0x40f7fc
push dword [ebx]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 0x210
call fcn.0046d190
int3