Function at 0x4bb8e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xa8
mov eax, dword [esp + 0xc8]
mov ecx, dword [eax + 4]
test ecx, ecx
jle 0x4bb901
mov edx, dword [eax]
mov ebx, dword [edx]
test bl, 1
jne 0x4bb912
push 0x24d
push str.external_boringssl_src_crypto_fipsmodule_bn_exponentiation.c
push 0x68
jmp 0x4bbc4e
cmp dword [eax + 0xc], 0
je 0x4bb929
push 0x251
push str.external_boringssl_src_crypto_fipsmodule_bn_exponentiation.c
push 0x6d
jmp 0x4bbc4e
mov eax, dword [esp + 0xc0]
cmp dword [eax + 0xc], 0
jne 0x4bbc42
mov dword [esp], ebx
mov ebp, dword [eax]
mov esi, dword [eax + 4]
cmp esi, ecx
mov ebx, ecx
cmovb ebx, esi
test ebx, ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 4], edx
mov dword [esp + 0xc], esi
je 0x4bb983
mov edx, dword [ebp]
mov edi, dword [esp]
mov ecx, edi
xor ecx, edx
mov esi, edx
sub esi, edi
xor esi, edx
or esi, ecx
xor esi, edx
sar esi, 0x1f
or esi, 1
test ecx, ecx
cmove esi, ecx
cmp ebx, 1
jne 0x4bb987
mov edx, dword [esp + 4]
jmp 0x4bb9c5
xor esi, esi
jmp 0x4bb9c5
mov ecx, 1
nop dword [eax]
mov edx, dword [esp + 4]
mov edx, dword [edx + ecx*4]
mov eax, esi
mov esi, ebp
mov ebp, dword [ebp + ecx*4]
mov edi, ebp
sub edi, edx
xor edx, ebp
xor edi, ebp
or edi, edx
xor edi, ebp
mov ebp, esi
mov esi, eax
sar edi, 0x1f
or edi, 1
test edx, edx
mov edx, dword [esp + 4]
cmovne esi, edi
add ecx, 1
cmp ebx, ecx
jne 0x4bb990
mov ebx, dword [esp + 0xc]
mov eax, ebx
mov edi, dword [esp + 0x10]
sub eax, edi
jae 0x4bba0f
mov ebp, edi
sub ebp, ebx
xor eax, eax
cmp ebp, 8
jb 0x4bbb30
mov eax, ebp
and eax, 0xfffffff8
mov dword [esp + 8], eax
add eax, 0xfffffff8
mov edi, eax
shr edi, 3
add edi, 1
mov ecx, edi
and ecx, 3
cmp eax, 0x18
jae 0x4bba57
pxor xmm0, xmm0
xor eax, eax
pxor xmm1, xmm1
jmp 0x4bbac1
jbe 0x4bbc3e
xor ecx, ecx
mov edx, eax
mov eax, edi
cmp edx, 8
jb 0x4bbc20
mov dword [esp + 0x1c], edx
mov eax, edx
and eax, 0xfffffff8
lea ecx, [eax - 8]
mov edx, ecx
shr edx, 3
add edx, 1
mov dword [esp + 8], edx
and edx, 3
cmp ecx, 0x18
jae 0x4bbb4f
pxor xmm0, xmm0
xor edi, edi
pxor xmm1, xmm1
jmp 0x4bbbc0
and edi, 0xfffffffc
lea edx, [edx + ebx*4]
add edx, 0x70
pxor xmm0, xmm0
xor eax, eax
pxor xmm1, xmm1
movdqu xmm2, xmmword [edx + eax*4 - 0x70]
por xmm2, xmm0
movdqu xmm0, xmmword [edx + eax*4 - 0x60]
por xmm0, xmm1
movdqu xmm1, xmmword [edx + eax*4 - 0x50]
movdqu xmm3, xmmword [edx + eax*4 - 0x40]
movdqu xmm4, xmmword [edx + eax*4 - 0x30]
por xmm4, xmm1
por xmm4, xmm2
movdqu xmm2, xmmword [edx + eax*4 - 0x20]
por xmm2, xmm3
por xmm2, xmm0
movdqu xmm0, xmmword [edx + eax*4 - 0x10]
por xmm0, xmm4
movdqu xmm1, xmmword [edx + eax*4]
por xmm1, xmm2
add eax, 0x20
add edi, 0xfffffffc
jne 0x4bba6a
test ecx, ecx
mov edx, dword [esp + 4]
je 0x4bbafa
mov edi, ecx
add eax, ebx
lea eax, [edx + eax*4]
add eax, 0x10
shl edi, 5
xor ecx, ecx
nop dword [eax + eax]
movdqu xmm2, xmmword [eax + ecx - 0x10]
por xmm0, xmm2
movdqu xmm2, xmmword [eax + ecx]
por xmm1, xmm2
add ecx, 0x20
cmp edi, ecx
jne 0x4bbae0
por xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movd eax, xmm0
mov ecx, dword [esp + 8]
cmp ebp, ecx
mov edi, dword [esp + 0x10]
je 0x4bbb3a
add ebx, ecx
nop word cs:[eax + eax]
nop dword [eax]
or eax, dword [edx + ebx*4]
add ebx, 1
cmp edi, ebx
jne 0x4bbb30
mov ecx, eax
not ecx
add eax, 0xffffffff
and eax, ecx
sar eax, 0x1f
not eax
or esi, eax
jmp 0x4bbc3e
and dword [esp + 8], 0xfffffffc
lea ecx, [edi*4 + 0x70]
add ecx, ebp
pxor xmm0, xmm0
xor edi, edi
pxor xmm1, xmm1
movdqu xmm2, xmmword [ecx + edi*4 - 0x70]
por xmm2, xmm0
movdqu xmm0, xmmword [ecx + edi*4 - 0x60]
por xmm0, xmm1
movdqu xmm1, xmmword [ecx + edi*4 - 0x50]
movdqu xmm3, xmmword [ecx + edi*4 - 0x40]
movdqu xmm4, xmmword [ecx + edi*4 - 0x30]
por xmm4, xmm1
por xmm4, xmm2
movdqu xmm2, xmmword [ecx + edi*4 - 0x20]
por xmm2, xmm3
por xmm2, xmm0
movdqu xmm0, xmmword [ecx + edi*4 - 0x10]
por xmm0, xmm4
movdqu xmm1, xmmword [ecx + edi*4]
por xmm1, xmm2
add edi, 0x20
add dword [esp + 8], 0xfffffffc
jne 0x4bbb67
mov dword [esp + 8], edx
test edx, edx
je 0x4bbbf8
add edi, dword [esp + 0x10]
lea ecx, [edi*4 + 0x10]
add ecx, ebp
shl dword [esp + 8], 5
xor edx, edx
movdqu xmm2, xmmword [ecx + edx - 0x10]
por xmm0, xmm2
movdqu xmm2, xmmword [ecx + edx]
por xmm1, xmm2
add edx, 0x20
cmp dword [esp + 8], edx
jne 0x4bbbdc
por xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movd ecx, xmm0
cmp dword [esp + 0x1c], eax
je 0x4bbc2b
add eax, dword [esp + 0x10]
nop dword [eax]
or ecx, dword [ebp + eax*4]
add eax, 1
cmp ebx, eax
jne 0x4bbc20
mov eax, ecx
not eax
add ecx, 0xffffffff
and ecx, eax
sar ecx, 0x1f
and esi, ecx
add esi, ecx
add esi, 1
test esi, esi
js 0x4bbc69
push 0x255
push str.external_boringssl_src_crypto_fipsmodule_bn_exponentiation.c
push 0x6b
push 0
push 3
call sym.fastboot.exe_ERR_put_error
add esp, 0x14
xor ebx, ebx
mov eax, ebx
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0xd0]
mov dword [esp + 8], eax
mov edi, dword [esp + 0xc4]
mov ebp, dword [esp + 0xbc]
mov edx, dword [edi + 4]
xor ecx, ecx
test edx, edx
cmovs ecx, edx
mov eax, edx
nop
test eax, eax
jle 0x4bbca3
mov esi, dword [edi]
mov esi, dword [esi + eax*4 - 4]
add eax, 0xffffffff
test esi, esi
je 0x4bbc90
jmp 0x4bbcb6
test edx, edx
jns 0x4bbde0
mov eax, dword [edi]
mov esi, dword [eax + ecx*4 - 4]
add ecx, 0xffffffff
mov eax, ecx
shl eax, 5
xor edx, edx
test esi, esi
setne dl
mov edi, esi
shr edi, 0x10
xor ecx, ecx
cmp esi, 0x10000
setae cl
cmovb edi, esi
shl ecx, 4
mov dword [esp + 0xc], ecx
mov ecx, edi
shr ecx, 8
xor ebx, ebx
cmp edi, 0x100
setae bl
mov dword [esp + 0x1c], ebx
cmovb ecx, edi
mov esi, ecx
shr esi, 4
xor ebx, ebx
cmp ecx, 0x10
cmovb esi, ecx
setae bl
mov ebp, ebx
mov edi, esi
shr edi, 2
xor ebx, ebx
cmp esi, 4
cmovb edi, esi
setae bl
xor ecx, ecx
cmp edi, 2
setae cl
or edx, eax
add edx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
lea eax, [edx + eax*8]
lea eax, [eax + ebp*4]
lea esi, [eax + ebx*2]
mov ebp, dword [esp + 0xbc]
add esi, ecx
je 0x4bbde0
pxor xmm0, xmm0
movdqu xmmword [esp + 0x98], xmm0
movdqu xmmword [esp + 0x8c], xmm0
movdqu xmmword [esp + 0x7c], xmm0
movdqu xmmword [esp + 0x6c], xmm0
movdqu xmmword [esp + 0x5c], xmm0
movdqu xmmword [esp + 0x4c], xmm0
movdqu xmmword [esp + 0x3c], xmm0
movdqu xmmword [esp + 0x2c], xmm0
mov ebp, dword [esp + 0xcc]
cmp byte [ebp + 0x14], 0
jne 0x4bbf6a
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
cmp ecx, dword [ebp + 0xc]
jne 0x4bbe33
lea eax, [ecx + ecx*2]
shr eax, 1
test ecx, ecx
mov ebx, 0x20
cmovne ebx, eax
cmp ebx, ecx
jbe 0x4bbf64
cmp ebx, 0x3fffffff
ja 0x4bbf64
lea eax, [ebx*4]
push eax
push dword [ebp + 4]
call sym.fastboot.exe_OPENSSL_realloc
add esp, 8
test eax, eax
je 0x4bbf64
mov dword [ebp + 4], eax
mov dword [ebp + 0xc], ebx
mov ecx, dword [ebp + 8]
jmp 0x4bbe36
mov edx, dword [esp]
xor edx, 1
mov ecx, dword [esp + 0x10]
cmp ecx, 2
jl 0x4bbf14
lea eax, [ecx - 1]
mov esi, 1
cmp eax, 8
jae 0x4bbe09
mov eax, dword [esp + 4]
jmp 0x4bbf0a
mov esi, eax
and esi, 0xfffffff8
movd xmm0, edx
lea ecx, [esi - 8]
mov ebx, ecx
shr ebx, 3
add ebx, 1
mov edx, ebx
and edx, 3
cmp ecx, 0x18
jae 0x4bbe42
pxor xmm1, xmm1
xor edi, edi
mov ebp, dword [esp + 4]
jmp 0x4bbea7
mov eax, dword [ebp + 4]
mov dword [eax + ecx*4], edi
add dword [ebp + 8], 1
jmp 0x4bbf6a
and ebx, 0xfffffffc
pxor xmm1, xmm1
xor edi, edi
mov ebp, dword [esp + 4]
movdqu xmm2, xmmword [ebp + edi*4 + 4]
por xmm2, xmm0
movdqu xmm0, xmmword [ebp + edi*4 + 0x14]
por xmm0, xmm1
movdqu xmm1, xmmword [ebp + edi*4 + 0x24]
movdqu xmm3, xmmword [ebp + edi*4 + 0x34]
movdqu xmm4, xmmword [ebp + edi*4 + 0x44]
por xmm4, xmm1
por xmm4, xmm2
movdqu xmm2, xmmword [ebp + edi*4 + 0x54]
por xmm2, xmm3
por xmm2, xmm0
movdqu xmm0, xmmword [ebp + edi*4 + 0x64]
por xmm0, xmm4
movdqu xmm1, xmmword [ebp + edi*4 + 0x74]
por xmm1, xmm2
add edi, 0x20
add ebx, 0xfffffffc
jne 0x4bbe4f
test edx, edx
je 0x4bbed1
lea ecx, [edi*4]
or ecx, 4
movdqu xmm2, xmmword [ebp + ecx]
por xmm0, xmm2
movdqu xmm2, xmmword [ebp + ecx + 0x10]
por xmm1, xmm2
add edi, 8
add edx, 0xffffffff
jne 0x4bbeab
por xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movd edx, xmm0
cmp eax, esi
jne 0x4bbef8
mov ebp, dword [esp + 0xbc]
jmp 0x4bbf14
or esi, 1
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 4]
mov ebp, dword [esp + 0xbc]
or edx, dword [eax + esi*4]
add esi, 1
cmp ecx, esi
jne 0x4bbf0a
test edx, edx
je 0x4bbf4c
push 1
push ebp
call fcn.004b36f0
add esp, 8
test eax, eax
je 0x4bbc5a
mov dword [ebp + 0xc], 0
mov eax, dword [ebp]
mov dword [eax], 1
mov dword [ebp + 4], 1
mov ebx, 1
jmp 0x4bbc5c
mov dword [ebp + 0xc], 0
mov dword [ebp + 4], 0
mov ebx, 1
jmp 0x4bbc5c
mov word [ebp + 0x14], 0x101
push ebp
call sym.fastboot.exe_BN_CTX_get
add esp, 4
mov edi, eax
push ebp
call sym.fastboot.exe_BN_CTX_get
add esp, 4
mov dword [esp + 0x28], eax
xor ebx, ebx
mov dword [esp + 4], edi
test edi, edi
je 0x4bc3f2
mov edx, eax
mov eax, 0
test edx, edx
je 0x4bc428
xor ecx, ecx
cmp dword [esp + 0xd0], 0
jne 0x4bbfcd
push ebp
push dword [esp + 0xcc]
mov edi, edx
call sym.fastboot.exe_BN_MONT_CTX_new_consttime
mov edx, edi
add esp, 8
mov ecx, eax
mov dword [esp + 8], eax
test eax, eax
je 0x4bc411
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 6
cmp esi, 0x29f
jg 0x4bc00f
mov dword [esp + 0x10], 5
cmp esi, 0xef
jg 0x4bc00f
mov dword [esp + 0x10], 4
cmp esi, 0x4f
jg 0x4bc00f
xor eax, eax
cmp esi, 0x18
setge al
add eax, eax
add eax, 1
mov dword [esp + 0x10], eax
push ebp
mov eax, dword [esp + 0xc]
push eax
push eax
push dword [esp + 0xcc]
mov edi, edx
push edx
call sym.fastboot.exe_BN_mod_mul_montgomery
add esp, 0x14
xor ebx, ebx
test eax, eax
je 0x4bc424
cmp dword [esp + 0x10], 2
jb 0x4bc0cd
mov ebp, dword [esp + 0xcc]
push ebp
call sym.fastboot.exe_BN_CTX_get
add esp, 4
test eax, eax
je 0x4bc424
push ebp
push dword [esp + 0xc]
push edi
push edi
mov dword [esp + 0x10], eax
push eax
call sym.fastboot.exe_BN_mod_mul_montgomery
add esp, 0x14
test eax, eax
je 0x4bc424
mov eax, dword [esp + 0x10]
mov ecx, eax
add cl, 0xff
mov edi, 1
mov eax, 1
shl eax, cl
mov dword [esp + 0x1c], eax
mov ebp, dword [esp + 0xcc]
push ebp
call sym.fastboot.exe_BN_CTX_get
add esp, 4
mov dword [esp + edi*4 + 0x28], eax
test eax, eax
je 0x4bc424
push ebp
push dword [esp + 0xc]
push dword [esp + 8]
push dword [esp + edi*4 + 0x30]
push eax
call sym.fastboot.exe_BN_mod_mul_montgomery
add esp, 0x14
test eax, eax
je 0x4bc41d
add edi, 1
cmp dword [esp + 0x1c], edi
jne 0x4bc08a
add esi, 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffffe
mov dword [esp + 0x1c], eax
xor ebx, ebx
mov edi, dword [esp + 0xbc]
mov ebp, dword [esp + 0xcc]
test esi, esi
js 0x4bc113
mov eax, dword [esp + 0xc4]
mov eax, dword [eax + 4]
mov ecx, esi
shr ecx, 5
cmp ecx, eax
jae 0x4bc113
mov edx, dword [esp + 0xc4]
mov edx, dword [edx]
mov ecx, dword [edx + ecx*4]
bt ecx, esi
jb 0x4bc141
test bl, 1
je 0x4bc134
push ebp
push dword [esp + 0xc]
mov eax, dword [esp + 0xc]
push eax
push eax
push eax
call sym.fastboot.exe_BN_mod_mul_montgomery
add esp, 0x14
test eax, eax
je 0x4bc417
test esi, esi
je 0x4bc3f6
add esi, 0xffffffff
jmp 0x4bc0eb
cmp dword [esp + 0x10], 2
jb 0x4bc373
test esi, esi
je 0x4bc373
lea ecx, [esi - 1]
mov edi, dword [esp + 0x1c]
cmp ecx, edi
cmovb edi, ecx
mov ebp, edi
mov dword [esp], 0
test esi, esi
jle 0x4bc181
mov edi, ecx
shr edi, 5
cmp edi, eax
jae 0x4bc181
mov edi, dword [edx + edi*4]
shr edi, cl
and edi, 1
mov dword [esp], edi
mov ecx, dword [esp]
add ecx, ecx
add ecx, 1
mov dword [esp + 0x14], ecx
test ebp, ebp
je 0x4bc2fc
add ebp, 1
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], 0
cmp esi, 2
jl 0x4bc1c9
lea ecx, [esi - 2]
mov edi, ecx
mov dword [esp + 0x24], ecx
shr ecx, 5
cmp ecx, eax
jae 0x4bc1c9
mov edi, dword [edx + ecx*4]
mov ecx, dword [esp + 0x24]
shr edi, cl
and edi, 1
mov dword [esp + 0x18], edi
cmp dword [esp], 1
mov cl, 1
adc cl, 0
mov edi, dword [esp + 0x14]
mov ebp, edi
shl ebp, cl
or ebp, 1
cmp dword [esp + 0x18], 0
cmovne edi, ebp
mov dword [esp + 0x14], edi
mov ecx, 2
mov edi, dword [esp]
cmovne edi, ecx
mov dword [esp], edi
cmp dword [esp + 0x20], 2
je 0x4bc2fc
mov dword [esp + 0x18], 0
cmp esi, 3
jl 0x4bc227
lea ecx, [esi - 3]
mov edi, ecx
shr edi, 5
cmp edi, eax
jae 0x4bc227
mov edi, dword [edx + edi*4]
shr edi, cl
and edi, 1
mov dword [esp + 0x18], edi
mov ecx, dword [esp]
xor cl, 3
mov ebp, dword [esp + 0x14]
mov edi, ebp
shl edi, cl
or edi, 1
cmp dword [esp + 0x18], 0
cmovne ebp, edi
mov dword [esp + 0x14], ebp
mov ecx, 3
mov edi, dword [esp]
cmovne edi, ecx
mov dword [esp], edi
cmp dword [esp + 0x20], 3
je 0x4bc2fc
mov dword [esp + 0x18], 0
cmp esi, 4
jl 0x4bc282
lea ecx, [esi - 4]
mov edi, ecx
shr edi, 5
cmp edi, eax
jae 0x4bc282
mov edi, dword [edx + edi*4]
shr edi, cl
and edi, 1
mov dword [esp + 0x18], edi
mov cl, 4
sub cl, byte [esp]
mov ebp, dword [esp + 0x14]
mov edi, ebp
shl edi, cl
or edi, 1
cmp dword [esp + 0x18], 0
cmovne ebp, edi
mov dword [esp + 0x14], ebp
mov ecx, 4
mov edi, dword [esp]
cmovne edi, ecx
mov dword [esp], edi
cmp dword [esp + 0x20], 4
je 0x4bc2fc
xor edi, edi
cmp esi, 5
jl 0x4bc2d6
lea ecx, [esi - 5]
mov ebp, ecx
mov dword [esp + 0x20], ecx
shr ecx, 5
cmp ecx, eax
jae 0x4bc2d6
mov edi, dword [edx + ecx*4]
mov ecx, dword [esp + 0x20]
shr edi, cl
and edi, 1
mov cl, 5
mov edx, dword [esp]
sub cl, dl
mov ebp, dword [esp + 0x14]
mov eax, ebp
shl eax, cl
or eax, 1
test edi, edi
cmovne ebp, eax
mov dword [esp + 0x14], ebp
mov eax, 5
cmovne edx, eax
mov dword [esp], edx
test bl, 1
mov ebp, dword [esp + 0xcc]
jne 0x4bc387
mov eax, dword [esp + 0x14]
and eax, 0xfffffffe
mov edi, dword [esp + eax*2 + 0x28]
cmp edi, dword [esp + 4]
je 0x4bc3d9
push dword [edi + 4]
push dword [esp + 8]
call fcn.004b36f0
add esp, 8
test eax, eax
je 0x4bc41b
mov eax, dword [edi + 4]
lea ecx, [eax*4]
test ecx, ecx
je 0x4bc356
push ecx
push dword [edi]
mov eax, dword [esp + 0xc]
push dword [eax]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [edi + 4]
mov ecx, dword [esp + 4]
mov dword [ecx + 4], eax
mov eax, dword [edi + 0xc]
mov dword [ecx + 0xc], eax
mov edi, dword [esp + 0xbc]
mov ebp, dword [esp + 0xcc]
jmp 0x4bc3e0
mov dword [esp], 0
mov dword [esp + 0x14], 1
test bl, 1
je 0x4bc308
mov edi, 0xffffffff
push ebp
push dword [esp + 0xc]
mov eax, dword [esp + 0xc]
push eax
push eax
push eax
call sym.fastboot.exe_BN_mod_mul_montgomery
add esp, 0x14
xor ebx, ebx
test eax, eax
je 0x4bc424
add edi, 1
cmp dword [esp], edi
jne 0x4bc38c
mov eax, dword [esp + 0x14]
and eax, 0xfffffffe
push ebp
push dword [esp + 0xc]
push dword [esp + eax*2 + 0x30]
mov eax, dword [esp + 0x10]
push eax
push eax
call sym.fastboot.exe_BN_mod_mul_montgomery
add esp, 0x14
test eax, eax
mov edi, dword [esp + 0xbc]
jne 0x4bc3e0
jmp 0x4bc424
mov edi, dword [esp + 0xbc]
mov eax, dword [esp]
cmp esi, eax
je 0x4bc3f6
not eax
add esi, eax
mov bl, 1
jmp 0x4bc0eb
xor eax, eax
jmp 0x4bc428
push ebp
push dword [esp + 0xc]
push dword [esp + 0xc]
push edi
call sym.fastboot.exe_BN_from_montgomery
add esp, 0x10
xor ebx, ebx
test eax, eax
setne bl
jmp 0x4bc424
xor ebx, ebx
xor eax, eax
jmp 0x4bc428
xor ebx, ebx
jmp 0x4bc424
xor ebx, ebx
mov ebp, dword [esp + 0xcc]
mov eax, dword [esp + 0xc]
push eax
call sym.fastboot.exe_BN_MONT_CTX_free
add esp, 4
cmp byte [ebp + 0x14], 0
jne 0x4bbc5c
mov eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
lea edx, [ecx - 1]
mov dword [ebp + 8], edx
mov eax, dword [eax + ecx*4 - 4]
mov dword [ebp + 0x10], eax
jmp 0x4bbc5c