Function at 0x4091a0
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505703
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1d0
push ebx
mov edx, ecx
mov dword [ebp - 0x44], ecx
push esi
push edi
mov byte [ebp - 0x48], 0
lea esi, [edx + 1]
lea ecx, [ecx]
mov al, byte [edx]
inc edx
test al, al
jne 0x4091d0
sub edx, esi
push edx
push ecx
push dword [ebp - 0x48]
lea ecx, [ebp - 0x68]
call fcn.0047c0a0
add esp, 0xc
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x68]
call fcn.00405900
add esp, 4
mov dword [ebp - 0x8c], 0x5356bc
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x90], eax
test edx, edx
je 0x409393
cmp edx, 1
setne bl
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], 0xffffffff
call fcn.0046ca90
test bl, bl
je 0x409e88
lea ecx, [ebp - 0x8c]
call fcn.00408a40
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x84], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x98], eax
push ebx
mov dword [ebp - 4], 1
push 2
mov dword [ebp - 0x1d8], pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x1d8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x4093e6
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
lea eax, [ebp - 0x1d8]
push eax
push esi
call edi
cmp eax, 1
jne 0x4093e6
jmp 0x4092c0
mov dword [ebp - 0x40], 0x928e90da
xor ecx, ecx
mov word [ebp - 0x3c], 0x100
nop
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x40], al
inc ecx
cmp ecx, 4
jb 0x4092d0
lea eax, [ebp - 0x40]
mov byte [ebp - 0x3b], 0
push eax
lea eax, [ebp - 0x1b4]
push eax
call fcn.004e0b60
add esp, 8
test eax, eax
je 0x4093c7
mov dword [ebp - 0x50], 0x84978698
xor ecx, ecx
mov word [ebp - 0x4c], 0x8b
mov byte [ebp - 0x4a], 1
nop
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x50], al
inc ecx
cmp ecx, 5
jb 0x409310
lea eax, [ebp - 0x50]
mov byte [ebp - 0x4a], 0
push eax
lea eax, [ebp - 0x1b4]
push eax
call fcn.004e0b60
add esp, 8
test eax, eax
jne 0x4093c7
mov dword [ebp - 0x29], 0x9f958387
xor ecx, ecx
mov dword [ebp - 0x25], 0x8e8a97
mov byte [ebp - 0x21], 1
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x29], al
inc ecx
cmp ecx, 7
jb 0x409350
lea eax, [ebp - 0x29]
mov byte [ebp - 0x21], 0
push eax
lea eax, [ebp - 0x1b4]
push eax
call fcn.004e0b60
add esp, 8
test eax, eax
jne 0x4093c7
cmp ebx, dword [ebp - 0x88]
je 0x4093a2
mov eax, dword [ebp - 0x1d0]
mov dword [ebx], eax
add ebx, 4
mov dword [ebp - 0x9c], ebx
jmp 0x4093c7
xor bl, bl
test eax, eax
jne 0x409e99
jmp 0x40922b
lea eax, [ebp - 0x1d0]
push eax
push ebx
lea ecx, [ebp - 0xa0]
call fcn.00476eb0
mov eax, dword [ebp - 0x98]
mov ebx, dword [ebp - 0x9c]
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x1d8]
push eax
push esi
call edi
cmp eax, 1
je 0x4092c0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x84], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x44]
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
lea edx, [ecx + 1]
mov dword [ebp - 0x6c], eax
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409410
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x80]
call fcn.00402ae0
mov byte [ebp - 4], 2
xor ecx, ecx
mov dword [ebp - 0x19], 0x100a9ce
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x19], al
inc ecx
cmp ecx, 2
jb 0x409430
sub esp, 0x18
mov byte [ebp - 0x16], 0
mov edx, esp
mov dword [ebp - 0x40], esp
xor eax, eax
lea ecx, [ebp - 0x19]
lea esi, [ecx + 1]
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409462
sub ecx, esi
lea eax, [ebp - 0x19]
push ecx
push eax
mov ecx, edx
call fcn.00402ae0
sub esp, 0x18
mov byte [ebp - 4], 3
lea eax, [ebp - 0x80]
mov ecx, esp
push eax
call fcn.0046a770
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 2
call fcn.0040ab40
add esp, 0x30
mov byte [ebp - 4], 4
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0xa8]
mov esi, dword [ebp - 0xac]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
jb 0x4094e2
lea eax, [esi + 0x18]
lea ecx, [ebp - 0x80]
cmp ecx, eax
je 0x4094e2
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x4094d8
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x80]
call fcn.0046a350
mov word [ebp - 0x10], 0x2f
mov byte [ebp - 0xe], 0
lea esp, [esp]
lea edx, [ebp - 0x10]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4094f6
sub edx, ecx
cmp dword [ebp - 0x6c], 0x10
lea ecx, [ebp - 0x80]
jb 0x40950b
mov ecx, dword [ebp - 0x80]
push edx
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 0x10]
push eax
push 0
call fcn.0046feb0
add esp, 0xc
cmp eax, 0xffffffff
je 0x409730
xor eax, eax
mov word [ebp - 0x14], 0x5c
lea ecx, [ebp - 0x14]
mov byte [ebp - 0x12], 0
mov dword [ebp - 0x68], eax
lea edx, [ecx + 1]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409550
sub ecx, edx
lea eax, [ebp - 0x14]
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.00402ae0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x18]
xor eax, eax
mov word [ebp - 0x18], 0x2f
mov byte [ebp - 0x16], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409590
sub ecx, edx
lea eax, [ebp - 0x18]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.00402ae0
mov byte [ebp - 4], 6
lea esi, [ebp - 0x38]
mov edi, dword [ebp - 0x24]
cmp edi, 0x10
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x44], esi
setae byte [ebp - 0xd]
mov dword [ebp - 0x20], edx
jb 0x4095c7
mov esi, edx
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x6c], 0x10
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x48], ecx
jb 0x4095d9
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x48], ecx
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x70]
cmp ebx, eax
ja 0x4096b8
sub eax, ebx
test ebx, ebx
jne 0x4095f4
xor edi, edi
jmp 0x409698
movsx edx, byte [esi]
inc eax
add eax, ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x50], eax
sub eax, ecx
push eax
push edx
push ecx
call fcn.004e2ce0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4096b2
mov edx, esi
mov ecx, edi
mov esi, ebx
sub esi, 4
jb 0x409633
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x409638
add ecx, 4
add edx, 4
sub esi, 4
jae 0x409622
cmp esi, 0xfffffffc
je 0x40966c
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x409665
cmp esi, 0xfffffffd
je 0x40966c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x409665
cmp esi, 0xfffffffe
je 0x40966c
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x409665
cmp esi, 0xffffffff
je 0x40966c
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x40966c
sbb eax, eax
or eax, 1
jmp 0x40966e
xor eax, eax
test eax, eax
je 0x409690
mov eax, dword [ebp - 0x50]
inc edi
sub eax, edi
push eax
push dword [ebp - 0x40]
push edi
call fcn.004e2ce0
mov esi, dword [ebp - 0x44]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x409617
jmp 0x4096b2
sub edi, dword [ebp - 0x48]
cmp edi, 0xffffffff
je 0x4096b2
cmp dword [ebp - 0x54], 0x10
lea eax, [ebp - 0x68]
jb 0x4096a4
mov eax, dword [ebp - 0x68]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x80]
push eax
push ebx
push edi
call fcn.0046cde0
mov edi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
cmp byte [ebp - 0xd], 0
mov byte [ebp - 4], 5
je 0x4096ed
lea ecx, [edi + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4096e3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409ea8
push ecx
push edx
call fcn.004df511
add esp, 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x54]
cmp ecx, 0x10
jb 0x4094f0
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40971f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409ea8
push ecx
push edx
call fcn.004df511
add esp, 8
jmp 0x4094f0
mov dword [ebp - 0x15], 0x100a9a8
xor ecx, ecx
lea esp, [esp]
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x15], al
inc ecx
cmp ecx, 2
jb 0x409740
lea edx, [ebp - 0x15]
mov byte [ebp - 0x12], 0
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x409757
sub edx, ecx
cmp dword [ebp - 0x6c], 0x10
lea ecx, [ebp - 0x80]
jb 0x40976c
mov ecx, dword [ebp - 0x80]
push edx
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 0x15]
push eax
push 0
call fcn.0046feb0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4099a0
xor eax, eax
mov word [ebp - 0x18], 0x5c
lea ecx, [ebp - 0x18]
mov byte [ebp - 0x16], 0
mov dword [ebp - 0x68], eax
lea edx, [ecx + 1]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
jmp 0x4097b0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4097b0
sub ecx, edx
lea eax, [ebp - 0x18]
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.00402ae0
mov byte [ebp - 4], 7
xor ecx, ecx
mov dword [ebp - 0x11], 0x100a9a8
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x11], al
inc ecx
cmp ecx, 2
jb 0x4097d3
xor eax, eax
mov byte [ebp - 0xe], 0
lea ecx, [ebp - 0x11]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
lea edx, [ecx + 1]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409800
sub ecx, edx
lea eax, [ebp - 0x11]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.00402ae0
mov byte [ebp - 4], 8
lea esi, [ebp - 0x38]
mov edi, dword [ebp - 0x24]
cmp edi, 0x10
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x48], esi
setae byte [ebp - 0xd]
mov dword [ebp - 0x20], edx
jb 0x409837
mov esi, edx
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0x6c], 0x10
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x44], ecx
jb 0x409849
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x44], ecx
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x70]
cmp ebx, eax
ja 0x409928
sub eax, ebx
test ebx, ebx
jne 0x409864
xor edi, edi
jmp 0x409908
movsx edx, byte [esi]
inc eax
add eax, ecx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x40], eax
sub eax, ecx
push eax
push edx
push ecx
call fcn.004e2ce0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x409922
mov edx, esi
mov ecx, edi
mov esi, ebx
sub esi, 4
jb 0x4098a3
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4098a8
add ecx, 4
add edx, 4
sub esi, 4
jae 0x409892
cmp esi, 0xfffffffc
je 0x4098dc
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4098d5
cmp esi, 0xfffffffd
je 0x4098dc
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4098d5
cmp esi, 0xfffffffe
je 0x4098dc
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4098d5
cmp esi, 0xffffffff
je 0x4098dc
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x4098dc
sbb eax, eax
or eax, 1
jmp 0x4098de
xor eax, eax
test eax, eax
je 0x409900
mov eax, dword [ebp - 0x40]
inc edi
sub eax, edi
push eax
push dword [ebp - 0x50]
push edi
call fcn.004e2ce0
mov esi, dword [ebp - 0x48]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x409887
jmp 0x409922
sub edi, dword [ebp - 0x44]
cmp edi, 0xffffffff
je 0x409922
cmp dword [ebp - 0x54], 0x10
lea eax, [ebp - 0x68]
jb 0x409914
mov eax, dword [ebp - 0x68]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x80]
push eax
push ebx
push edi
call fcn.0046cde0
mov edi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
cmp byte [ebp - 0xd], 0
mov byte [ebp - 4], 7
je 0x40995d
lea ecx, [edi + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x409953
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409ea8
push ecx
push edx
call fcn.004df511
add esp, 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x54]
cmp ecx, 0x10
jb 0x409730
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40998f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409ea8
push ecx
push edx
call fcn.004df511
add esp, 8
jmp 0x409730
mov dword [ebp - 0x15], 0x100daa8
xor ecx, ecx
lea esp, [esp]
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x15], al
inc ecx
cmp ecx, 2
jb 0x4099b0
lea edx, [ebp - 0x15]
mov byte [ebp - 0x12], 0
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4099c7
sub edx, ecx
cmp dword [ebp - 0x6c], 0x10
lea ecx, [ebp - 0x80]
jb 0x4099dc
mov ecx, dword [ebp - 0x80]
push edx
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 0x15]
push eax
push 0
call fcn.0046feb0
add esp, 0xc
cmp eax, 0xffffffff
je 0x409c10
xor eax, eax
mov word [ebp - 0x18], 0x5c
lea ecx, [ebp - 0x18]
mov byte [ebp - 0x16], 0
mov dword [ebp - 0x68], eax
lea edx, [ecx + 1]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
jmp 0x409a20
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409a20
sub ecx, edx
lea eax, [ebp - 0x18]
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.00402ae0
mov byte [ebp - 4], 9
xor ecx, ecx
mov dword [ebp - 0x11], 0x100daa8
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x11], al
inc ecx
cmp ecx, 2
jb 0x409a43
xor eax, eax
mov byte [ebp - 0xe], 0
lea ecx, [ebp - 0x11]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
lea edx, [ecx + 1]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409a70
sub ecx, edx
lea eax, [ebp - 0x11]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.00402ae0
mov byte [ebp - 4], 0xa
lea esi, [ebp - 0x38]
mov edi, dword [ebp - 0x24]
cmp edi, 0x10
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x48], esi
setae byte [ebp - 0xd]
mov dword [ebp - 0x20], edx
jb 0x409aa7
mov esi, edx
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0x6c], 0x10
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x44], ecx
jb 0x409ab9
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x44], ecx
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x70]
cmp ebx, eax
ja 0x409b98
sub eax, ebx
test ebx, ebx
jne 0x409ad4
xor edi, edi
jmp 0x409b78
movsx edx, byte [esi]
inc eax
add eax, ecx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x40], eax
sub eax, ecx
push eax
push edx
push ecx
call fcn.004e2ce0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x409b92
mov edx, esi
mov ecx, edi
mov esi, ebx
sub esi, 4
jb 0x409b13
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x409b18
add ecx, 4
add edx, 4
sub esi, 4
jae 0x409b02
cmp esi, 0xfffffffc
je 0x409b4c
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x409b45
cmp esi, 0xfffffffd
je 0x409b4c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x409b45
cmp esi, 0xfffffffe
je 0x409b4c
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x409b45
cmp esi, 0xffffffff
je 0x409b4c
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x409b4c
sbb eax, eax
or eax, 1
jmp 0x409b4e
xor eax, eax
test eax, eax
je 0x409b70
mov eax, dword [ebp - 0x40]
inc edi
sub eax, edi
push eax
push dword [ebp - 0x50]
push edi
call fcn.004e2ce0
mov esi, dword [ebp - 0x48]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x409af7
jmp 0x409b92
sub edi, dword [ebp - 0x44]
cmp edi, 0xffffffff
je 0x409b92
cmp dword [ebp - 0x54], 0x10
lea eax, [ebp - 0x68]
jb 0x409b84
mov eax, dword [ebp - 0x68]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x80]
push eax
push ebx
push edi
call fcn.0046cde0
mov edi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
cmp byte [ebp - 0xd], 0
mov byte [ebp - 4], 9
je 0x409bcd
lea ecx, [edi + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x409bc3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409ea8
push ecx
push edx
call fcn.004df511
add esp, 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x54]
cmp ecx, 0x10
jb 0x4099a0
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x409bff
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409ea8
push ecx
push edx
call fcn.004df511
add esp, 8
jmp 0x4099a0
mov dword [ebp - 0x15], 0x100a9db
xor ecx, ecx
lea esp, [esp]
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x15], al
inc ecx
cmp ecx, 2
jb 0x409c20
lea edx, [ebp - 0x15]
mov byte [ebp - 0x12], 0
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x409c37
sub edx, ecx
cmp dword [ebp - 0x6c], 0x10
lea ecx, [ebp - 0x80]
jb 0x409c4c
mov ecx, dword [ebp - 0x80]
push edx
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 0x15]
push eax
push 0
call fcn.0046feb0
add esp, 0xc
cmp eax, 0xffffffff
je 0x409dc1
xor eax, eax
mov word [ebp - 0x18], 0x5c
lea ecx, [ebp - 0x18]
mov byte [ebp - 0x16], 0
mov dword [ebp - 0x68], eax
lea edx, [ecx + 1]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
jmp 0x409c90
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409c90
sub ecx, edx
lea eax, [ebp - 0x18]
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.00402ae0
mov byte [ebp - 4], 0xb
xor ecx, ecx
mov dword [ebp - 0x11], 0x100a9db
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x11], al
inc ecx
cmp ecx, 2
jb 0x409cb3
xor eax, eax
mov byte [ebp - 0xe], 0
lea ecx, [ebp - 0x11]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
lea edx, [ecx + 1]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409ce0
sub ecx, edx
lea eax, [ebp - 0x11]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.00402ae0
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x38]
mov edi, dword [ebp - 0x24]
cmp edi, 0x10
mov esi, dword [ebp - 0x38]
setae byte [ebp - 0xd]
jb 0x409d0e
mov eax, esi
cmp dword [ebp - 0x6c], 0x10
lea ecx, [ebp - 0x80]
jb 0x409d1a
mov ecx, dword [ebp - 0x80]
mov ebx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x70]
push ebx
push eax
push 0
call fcn.0046feb0
add esp, 0xc
cmp eax, 0xffffffff
je 0x409d4b
cmp dword [ebp - 0x54], 0x10
lea ecx, [ebp - 0x68]
jb 0x409d3d
mov ecx, dword [ebp - 0x68]
push dword [ebp - 0x58]
push ecx
push ebx
push eax
lea ecx, [ebp - 0x80]
call fcn.0046cde0
cmp byte [ebp - 0xd], 0
mov byte [ebp - 4], 0xb
je 0x409d80
lea ecx, [edi + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x409d76
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409ea8
push ecx
push esi
call fcn.004df511
add esp, 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x54]
cmp ecx, 0x10
jb 0x409c10
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x409db2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409ea8
push ecx
push edx
call fcn.004df511
add esp, 8
jmp 0x409c10
mov ebx, dword [ebp - 0x84]
mov edi, ebx
cmp edi, dword [ebp - 0x9c]
je 0x409e04
mov ebx, dword [ebp - 0x8c]
mov esi, dword [edi]
lea eax, [ebp - 0x80]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.0046a770
mov edx, ebx
mov ecx, esi
call fcn.00408d70
add edi, 4
add esp, 0x18
cmp edi, dword [ebp - 0x9c]
jne 0x409dd7
mov ebx, dword [ebp - 0x84]
lea ecx, [ebp - 0xac]
call fcn.0046c860
mov ecx, dword [ebp - 0x6c]
cmp ecx, 0x10
jb 0x409e43
mov edx, dword [ebp - 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x409e39
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409ea8
push ecx
push edx
call fcn.004df511
add esp, 8
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0xf
mov byte [ebp - 0x80], 0
test ebx, ebx
je 0x409e88
mov ecx, dword [ebp - 0x88]
mov eax, ebx
sub ecx, ebx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x409e7e
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409ea8
push ecx
push ebx
call fcn.004df511
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x90]
call fcn.004051b0
call fcn.004e47b0
int3