Function at 0x40bbb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
xor edx, edx
xor eax, eax
push edi
push esi
push ebx
sub esp, 0x88
mov edi, dword [esp + 0xa4]
mov dword [esp + eax + 0x48], edx
add eax, 4
cmp eax, 0x20
jb 0x40bbc5
mov eax, dword [esp + 0xa0]
lea ecx, [eax + edi*2]
test edi, edi
je 0x40bbf0
nop
movzx edx, word [eax]
add eax, 2
add word [esp + edx*2 + 0x48], 1
cmp eax, ecx
jne 0x40bbe0
mov eax, dword [esp + 0xac]
movzx esi, word [esp + 0x66]
mov eax, dword [eax]
mov word [esp], si
test si, si
jne 0x40bcf9
cmp word [esp + 0x64], 0
jne 0x40c5d4
cmp word [esp + 0x62], 0
jne 0x40c61f
cmp word [esp + 0x60], 0
jne 0x40c643
cmp word [esp + 0x5e], 0
jne 0x40c68b
cmp word [esp + 0x5c], 0
jne 0x40c667
cmp word [esp + 0x5a], 0
jne 0x40c6af
cmp word [esp + 0x58], 0
jne 0x40c6d3
cmp word [esp + 0x56], 0
jne 0x40c6f7
cmp word [esp + 0x54], 0
jne 0x40c756
cmp word [esp + 0x52], 0
jne 0x40c77a
cmp word [esp + 0x50], 0
jne 0x40c7b2
cmp word [esp + 0x4e], 0
jne 0x40c7d6
cmp word [esp + 0x4c], 0
jne 0x40c7fa
cmp word [esp + 0x4a], 0
jne 0x40c826
mov eax, dword [esp + 0xa8]
mov edi, dword [esp + 0xa8]
mov dword [esp + 0x20], 1
mov eax, dword [eax]
lea edx, [eax + 8]
mov dword [eax], 0x140
mov dword [edi], edx
mov dword [eax + 4], 0x140
mov eax, dword [esp + 0xac]
mov edi, dword [esp + 0x20]
xor edx, edx
mov dword [eax], edi
add esp, 0x88
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 0xf
cmp eax, edx
cmovbe edx, eax
cmp word [esp + 0x4a], 0
mov dword [esp + 8], edx
jne 0x40c99f
mov ebp, 0xf
lea esi, [esi]
nop
cmp word [esp + 0x4c], 0
jne 0x40c738
cmp ebp, 3
je 0x40c7a5
cmp word [esp + 0x4e], 0
jne 0x40c79e
cmp ebp, 4
je 0x40c84c
cmp word [esp + 0x50], 0
jne 0x40c842
cmp ebp, 5
je 0x40c863
cmp word [esp + 0x52], 0
jne 0x40c859
cmp ebp, 6
je 0x40c870
cmp word [esp + 0x54], 0
jne 0x40c87d
cmp ebp, 7
je 0x40c891
cmp word [esp + 0x56], 0
jne 0x40c887
cmp ebp, 8
je 0x40c89e
cmp word [esp + 0x58], 0
jne 0x40c8ab
cmp ebp, 9
je 0x40c8bf
cmp word [esp + 0x5a], 0
jne 0x40c8b5
cmp ebp, 0xa
je 0x40c8cc
cmp word [esp + 0x5c], 0
jne 0x40c8d9
cmp ebp, 0xb
je 0x40c8ed
cmp word [esp + 0x5e], 0
jne 0x40c8e3
cmp ebp, 0xc
je 0x40c911
cmp word [esp + 0x60], 0
jne 0x40c907
cmp ebp, 0xd
je 0x40c8fa
cmp word [esp + 0x62], 0
jne 0x40c91e
cmp ebp, 0xf
jne 0x40c932
cmp word [esp + 0x64], 0
jne 0x40c928
mov dword [esp + 0x24], 0xf
movzx edx, word [esp + 0x4a]
mov eax, 2
mov ecx, edx
sub eax, edx
movzx ebx, word [esp + 0x4c]
add eax, eax
mov edx, ebx
sub eax, ebx
js 0x40c0c0
movzx esi, word [esp + 0x4e]
add eax, eax
mov ebx, esi
sub eax, esi
js 0x40c0c0
movzx esi, word [esp + 0x50]
add eax, eax
mov word [esp + 4], si
sub eax, esi
js 0x40c0c0
movzx esi, word [esp + 0x52]
add eax, eax
mov word [esp + 0xe], si
sub eax, esi
js 0x40c0c0
movzx esi, word [esp + 0x54]
add eax, eax
mov word [esp + 0x10], si
sub eax, esi
js 0x40c0c0
movzx esi, word [esp + 0x56]
add eax, eax
mov word [esp + 0x44], si
sub eax, esi
js 0x40c0c0
movzx esi, word [esp + 0x58]
add eax, eax
mov word [esp + 0x14], si
sub eax, esi
js 0x40c0c0
movzx esi, word [esp + 0x5a]
add eax, eax
mov word [esp + 0x18], si
sub eax, esi
js 0x40c0c0
movzx esi, word [esp + 0x5c]
add eax, eax
mov word [esp + 0x1c], si
sub eax, esi
js 0x40c0c0
movzx esi, word [esp + 0x5e]
add eax, eax
mov word [esp + 0x20], si
sub eax, esi
js 0x40c0c0
movzx esi, word [esp + 0x60]
add eax, eax
mov word [esp + 0x28], si
sub eax, esi
js 0x40c0c0
movzx esi, word [esp + 0x62]
add eax, eax
mov word [esp + 0x2c], si
sub eax, esi
js 0x40c0c0
movzx esi, word [esp + 0x64]
add eax, eax
mov word [esp + 0x30], si
sub eax, esi
js 0x40c0c0
movzx esi, word [esp]
add eax, eax
cmp eax, esi
js 0x40c0c0
je 0x40bf66
mov eax, dword [esp + 0x9c]
test eax, eax
je 0x40c0c0
cmp dword [esp + 0x24], 1
jne 0x40c0c0
add edx, ecx
xor esi, esi
mov word [esp + 0x6c], cx
xor eax, eax
mov word [esp + 0x6e], dx
add edx, ebx
mov word [esp + 0x70], dx
add dx, word [esp + 4]
mov word [esp + 0x72], dx
add dx, word [esp + 0xe]
mov word [esp + 0x74], dx
add dx, word [esp + 0x10]
mov word [esp + 0x76], dx
add dx, word [esp + 0x44]
mov word [esp + 0x78], dx
add dx, word [esp + 0x14]
mov word [esp + 0x7a], dx
add dx, word [esp + 0x18]
mov word [esp + 0x7c], dx
add dx, word [esp + 0x1c]
mov word [esp + 0x7e], dx
add dx, word [esp + 0x20]
mov word [esp + 0x80], dx
add dx, word [esp + 0x28]
mov word [esp + 0x82], dx
add dx, word [esp + 0x2c]
mov word [esp + 0x84], dx
add dx, word [esp + 0x30]
mov word [esp + 0x6a], si
mov word [esp + 0x86], dx
test edi, edi
je 0x40c03d
mov dword [esp], ebp
mov ebx, dword [esp + 0xa0]
mov ebp, dword [esp + 0xb0]
lea esi, [esi]
movzx edx, word [ebx + eax*2]
test dx, dx
je 0x40c033
movzx ecx, word [esp + edx*2 + 0x68]
lea esi, [ecx + 1]
mov word [ebp + ecx*2], ax
mov word [esp + edx*2 + 0x68], si
add eax, 1
cmp edi, eax
jne 0x40c018
mov ebp, dword [esp]
mov ebx, dword [esp + 8]
mov eax, 1
cmp ebp, ebx
cmovae ebx, ebp
mov ecx, ebx
mov dword [esp + 0x20], ebx
shl eax, cl
mov ecx, dword [esp + 0x9c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xa8]
mov eax, dword [eax]
mov dword [esp + 0x38], eax
test ecx, ecx
je 0x40c100
cmp dword [esp + 0x9c], 1
je 0x40c0d2
cmp dword [esp + 0x9c], 2
sete byte [esp + 0x46]
cmp dword [esp + 0x2c], 0x250
movzx eax, byte [esp + 0x46]
jbe 0x40c71b
test al, al
je 0x40c71b
add esp, 0x88
mov edx, 1
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
add esp, 0x88
mov edx, 0xffffffff
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
cmp dword [esp + 0x2c], 0x354
ja 0x40c0a5
mov dword [esp + 0x40], 0x41a020
mov dword [esp + 0x3c], 0x419fe0
mov dword [esp + 0x28], 0x101
mov byte [esp + 0x46], 0
jmp 0x40c11c
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x28], 0x14
mov byte [esp + 0x46], 0
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x9c], 1
mov dword [esp + 0x30], 0xffffffff
sete byte [esp + 0x47]
xor edi, edi
sub eax, 1
mov dword [esp + 4], 0
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
lea esi, [esi]
mov eax, ebp
sub al, byte [esp + 4]
mov ebx, dword [esp + 0x28]
mov byte [esp + 0xe], 0
mov byte [esp + 0x44], al
mov eax, dword [esp + 0x10]
movzx eax, word [eax]
lea edx, [eax + 1]
mov esi, eax
cmp edx, ebx
jb 0x40c1a9
cmp eax, ebx
jb 0x40c2b0
sub eax, ebx
mov ebx, dword [esp + 0x3c]
mov esi, dword [esp + 0x40]
movzx ebx, byte [ebx + eax*2]
movzx esi, word [esi + eax*2]
mov byte [esp + 0xe], bl
mov ebx, dword [esp + 4]
mov eax, ebp
mov edx, 1
mov dword [esp + 0x18], edi
sub eax, ebx
mov ebx, 0xfffffffc
mov ecx, eax
mov dword [esp + 0x14], eax
mov eax, 1
shl edx, cl
movzx ecx, byte [esp + 8]
shl eax, cl
movzx ecx, byte [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp], eax
mov eax, edi
movzx edi, byte [esp + 0x44]
shl ebx, cl
movzx ecx, byte [esp + 4]
mov ebp, ebx
movzx ebx, byte [esp + 0xe]
shr eax, cl
mov ecx, eax
mov eax, dword [esp]
add ecx, eax
mov eax, dword [esp + 0x1c]
sub ecx, edx
lea ecx, [eax + ecx*4]
lea esi, [esi]
lea esi, [esi]
mov eax, edi
mov byte [ecx], bl
mov byte [ecx + 1], al
mov word [ecx + 2], si
add ecx, ebp
sub dword [esp], edx
jne 0x40c210
mov ebp, dword [esp + 0x14]
mov eax, 1
mov edi, dword [esp + 0x18]
lea ecx, [ebp - 1]
shl eax, cl
test edi, eax
je 0x40c2a0
lea esi, [esi]
nop
shr eax, 1
test edi, eax
jne 0x40c240
test eax, eax
jne 0x40c2a0
sub word [esp + ebp*2 + 0x48], 1
jne 0x40c271
mov edi, dword [esp + 0x24]
cmp ebp, edi
je 0x40c596
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0xa0]
movzx edx, word [edi + 2]
movzx ebp, word [esi + edx*2]
mov ebx, dword [esp + 0x20]
cmp ebx, ebp
jae 0x40c28a
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
and edi, eax
mov dword [esp], edi
cmp edi, esi
jne 0x40c2c0
add dword [esp + 0x10], 2
mov edi, eax
jmp 0x40c168
lea edx, [eax - 1]
and edx, edi
add eax, edx
jmp 0x40c24a
mov byte [esp + 0xe], 0x60
xor esi, esi
jmp 0x40c1a9
mov esi, dword [esp + 4]
movzx ecx, byte [esp + 8]
mov edx, 4
mov edi, dword [esp + 0x24]
test esi, esi
cmove esi, ebx
mov ebx, ebp
shl edx, cl
add dword [esp + 0x1c], edx
mov edx, 1
sub ebx, esi
mov dword [esp + 4], esi
mov ecx, ebx
mov dword [esp + 8], ebx
shl edx, cl
cmp ebp, edi
jae 0x40c520
movzx ecx, word [esp + ebp*2 + 0x48]
sub edx, ecx
test edx, edx
jle 0x40c520
lea ecx, [ebx + 1]
add edx, edx
lea ebx, [esi + ecx]
cmp ebx, edi
jae 0x40c590
movzx ebx, word [esp + ebx*2 + 0x48]
sub edx, ebx
test edx, edx
jle 0x40c590
mov ebx, dword [esp + 8]
add edx, edx
lea ecx, [ebx + 2]
lea ebx, [esi + ecx]
cmp ebx, edi
jae 0x40c590
movzx ebx, word [esp + ebx*2 + 0x48]
sub edx, ebx
test edx, edx
jle 0x40c590
mov ebx, dword [esp + 8]
add edx, edx
lea ecx, [ebx + 3]
lea ebx, [esi + ecx]
cmp ebx, edi
jae 0x40c590
movzx ebx, word [esp + ebx*2 + 0x48]
sub edx, ebx
test edx, edx
jle 0x40c590
mov ebx, dword [esp + 8]
add edx, edx
lea ecx, [ebx + 4]
lea ebx, [esi + ecx]
cmp ebx, edi
jae 0x40c590
movzx ebx, word [esp + ebx*2 + 0x48]
sub edx, ebx
test edx, edx
jle 0x40c590
mov ebx, dword [esp + 8]
add edx, edx
lea ecx, [ebx + 5]
lea ebx, [esi + ecx]
cmp ebx, edi
jae 0x40c590
movzx ebx, word [esp + ebx*2 + 0x48]
sub edx, ebx
test edx, edx
jle 0x40c590
mov ebx, dword [esp + 8]
add edx, edx
lea ecx, [ebx + 6]
lea ebx, [esi + ecx]
cmp ebx, edi
jae 0x40c590
movzx ebx, word [esp + ebx*2 + 0x48]
sub edx, ebx
test edx, edx
jle 0x40c590
mov ebx, dword [esp + 8]
add edx, edx
lea ecx, [ebx + 7]
lea ebx, [esi + ecx]
cmp ebx, edi
jae 0x40c590
movzx ebx, word [esp + ebx*2 + 0x48]
sub edx, ebx
test edx, edx
jle 0x40c590
mov ebx, dword [esp + 8]
add edx, edx
lea ecx, [ebx + 8]
lea ebx, [esi + ecx]
cmp ebx, edi
jae 0x40c590
movzx ebx, word [esp + ebx*2 + 0x48]
sub edx, ebx
test edx, edx
jle 0x40c590
mov ebx, dword [esp + 8]
add edx, edx
lea ecx, [ebx + 9]
lea ebx, [esi + ecx]
cmp ebx, edi
jae 0x40c590
movzx ebx, word [esp + ebx*2 + 0x48]
sub edx, ebx
test edx, edx
jle 0x40c590
mov ebx, dword [esp + 8]
add edx, edx
lea ecx, [ebx + 0xa]
lea ebx, [esi + ecx]
cmp ebx, edi
jae 0x40c590
movzx ebx, word [esp + ebx*2 + 0x48]
sub edx, ebx
test edx, edx
jle 0x40c590
mov ebx, dword [esp + 8]
add edx, edx
lea ecx, [ebx + 0xb]
lea ebx, [esi + ecx]
cmp ebx, edi
jae 0x40c590
movzx ebx, word [esp + ebx*2 + 0x48]
sub edx, ebx
test edx, edx
jle 0x40c590
mov ebx, dword [esp + 8]
add edx, edx
add ebx, 0xc
lea ecx, [esi + ebx]
cmp ecx, edi
jae 0x40c5cb
movzx ecx, word [esp + ecx*2 + 0x48]
sub edx, ecx
test edx, edx
jle 0x40c5cb
mov ebx, dword [esp + 8]
add edx, edx
add ebx, 0xd
lea ecx, [esi + ebx]
cmp ecx, edi
jae 0x40c5cb
movzx ecx, word [esp + ecx*2 + 0x48]
sub edx, ecx
test edx, edx
jle 0x40c5cb
mov ebx, dword [esp + 8]
add edx, edx
add ebx, 0xe
lea ecx, [esi + ebx]
cmp ecx, edi
jae 0x40c5cb
movzx ecx, word [esp + ecx*2 + 0x48]
sub edx, ecx
test edx, edx
jle 0x40c5cb
mov ebx, dword [esp + 8]
lea esi, [edx + edx]
lea ecx, [ebx + 0xf]
mov ebx, dword [esp + 4]
lea edx, [ebx + ecx]
cmp edx, edi
jae 0x40c590
mov ebx, dword [esp + 8]
movzx edx, word [esp + edx*2 + 0x48]
add ebx, 0x10
cmp esi, edx
cmovg ecx, ebx
mov dword [esp + 8], ecx
lea esi, [esi]
movzx ecx, byte [esp + 8]
mov edx, 1
shl edx, cl
add dword [esp + 0x2c], edx
mov edi, dword [esp + 0x2c]
cmp edi, 0x354
jbe 0x40c547
cmp byte [esp + 0x47], 0
jne 0x40c0a5
cmp dword [esp + 0x2c], 0x250
jbe 0x40c55c
cmp byte [esp + 0x46], 0
jne 0x40c0a5
mov edi, dword [esp + 0x38]
mov esi, dword [esp]
movzx ebx, byte [esp + 8]
mov ecx, dword [esp + 0x1c]
lea edx, [edi + esi*4]
mov dword [esp + 0x30], esi
mov byte [edx], bl
sub ecx, edi
movzx ebx, byte [esp + 0x20]
sar ecx, 2
mov byte [edx + 1], bl
mov word [edx + 2], cx
jmp 0x40c28a
mov dword [esp + 8], ecx
jmp 0x40c520
test eax, eax
je 0x40c5b2
mov edi, dword [esp + 0x1c]
movzx ebx, byte [esp + 0x44]
xor edx, edx
lea eax, [edi + eax*4]
mov byte [eax], 0x40
mov byte [eax + 1], bl
mov word [eax + 2], dx
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x38]
lea eax, [eax + edi*4]
mov edi, dword [esp + 0xa8]
mov dword [edi], eax
jmp 0x40bcdd
mov dword [esp + 8], ebx
jmp 0x40c520
mov edx, 0xe
cmp eax, edx
cmovbe edx, eax
cmp word [esp + 0x4a], 0
mov dword [esp + 8], edx
jne 0x40c5f4
mov ebp, 0xe
jmp 0x40bd20
mov dword [esp + 0x24], 0xe
movzx ebx, word [esp + 0x4a]
mov eax, 2
mov edx, 0xffffffff
mov ecx, ebx
sub eax, ebx
js 0x40bcec
mov ebp, 1
jmp 0x40be3e
mov edx, 0xd
cmp eax, edx
cmovbe edx, eax
cmp word [esp + 0x4a], 0
mov dword [esp + 8], edx
jne 0x40c951
mov ebp, 0xd
jmp 0x40bd20
mov edx, 0xc
cmp eax, edx
cmovbe edx, eax
cmp word [esp + 0x4a], 0
mov dword [esp + 8], edx
jne 0x40c96b
mov ebp, 0xc
jmp 0x40bd20
mov edx, 0xa
cmp eax, edx
cmovbe edx, eax
cmp word [esp + 0x4a], 0
mov dword [esp + 8], edx
jne 0x40c95e
mov ebp, 0xa
jmp 0x40bd20
mov edx, 0xb
cmp eax, edx
cmovbe edx, eax
cmp word [esp + 0x4a], 0
mov dword [esp + 8], edx
jne 0x40c978
mov ebp, 0xb
jmp 0x40bd20
mov edx, 9
cmp eax, edx
cmovbe edx, eax
cmp word [esp + 0x4a], 0
mov dword [esp + 8], edx
jne 0x40c985
mov ebp, 9
jmp 0x40bd20
mov edx, 8
cmp eax, edx
cmovbe edx, eax
cmp word [esp + 0x4a], 0
mov dword [esp + 8], edx
jne 0x40c992
mov ebp, 8
jmp 0x40bd20
mov edx, 7
cmp eax, edx
cmovbe edx, eax
cmp word [esp + 0x4a], 0
mov dword [esp + 8], edx
jne 0x40c944
mov ebp, 7
jmp 0x40bd20
mov dword [esp + 0x40], 0x419fa0
mov dword [esp + 0x3c], 0x419f60
mov dword [esp + 0x28], 0
jmp 0x40c11c
mov edx, 2
movzx ebx, word [esp + 0x4a]
mov eax, 2
mov dword [esp + 0x24], ebp
mov ebp, edx
mov ecx, ebx
sub eax, ebx
jmp 0x40be3e
mov edx, 6
cmp eax, edx
cmovbe edx, eax
cmp word [esp + 0x4a], 0
mov dword [esp + 8], edx
jne 0x40c9ac
mov ebp, 6
jmp 0x40bd20
mov edx, 5
cmp eax, edx
cmovbe edx, eax
cmp word [esp + 0x4a], 0
mov dword [esp + 8], edx
jne 0x40c9c6
mov ebp, 5
jmp 0x40bd20
mov edx, 3
jmp 0x40c73d
mov dword [esp + 0x24], 3
jmp 0x40be30
mov edx, 4
cmp eax, edx
cmovbe edx, eax
cmp word [esp + 0x4a], 0
mov dword [esp + 8], edx
jne 0x40c9d3
mov ebp, 4
jmp 0x40bd20
mov edx, 3
cmp eax, edx
cmovbe edx, eax
cmp word [esp + 0x4a], 0
mov dword [esp + 8], edx
jne 0x40c9b9
mov ebp, 3
jmp 0x40bd20
mov edx, 2
mov dword [esp + 0x24], 2
cmp eax, edx
cmovbe edx, eax
cmp word [esp + 0x4a], 0
mov dword [esp + 8], edx
jne 0x40c5fc
mov ebp, 2
jmp 0x40be30
cmp eax, 0
mov edx, 1
mov dword [esp + 0x24], 1
cmovbe edx, eax
mov dword [esp + 8], edx
jmp 0x40c5fc
mov edx, 4
jmp 0x40c73d
mov dword [esp + 0x24], 4
jmp 0x40be30
mov edx, 5
jmp 0x40c73d
mov dword [esp + 0x24], 5
jmp 0x40be30
mov dword [esp + 0x24], 6
jmp 0x40be30
mov edx, 6
jmp 0x40c73d
mov edx, 7
jmp 0x40c73d
mov dword [esp + 0x24], 7
jmp 0x40be30
mov dword [esp + 0x24], 8
jmp 0x40be30
mov edx, 8
jmp 0x40c73d
mov edx, 9
jmp 0x40c73d
mov dword [esp + 0x24], 9
jmp 0x40be30
mov dword [esp + 0x24], 0xa
jmp 0x40be30
mov edx, 0xa
jmp 0x40c73d
mov edx, 0xb
jmp 0x40c73d
mov dword [esp + 0x24], 0xb
jmp 0x40be30
mov dword [esp + 0x24], 0xd
jmp 0x40be30
mov edx, 0xc
jmp 0x40c73d
mov dword [esp + 0x24], 0xc
jmp 0x40be30
mov edx, 0xd
jmp 0x40c73d
mov edx, 0xe
jmp 0x40c73d
mov dword [esp + 0x24], 0xe
mov ebp, 0xe
jmp 0x40be30
mov dword [esp + 0x24], 7
jmp 0x40c5fc
mov dword [esp + 0x24], 0xd
jmp 0x40c5fc
mov dword [esp + 0x24], 0xa
jmp 0x40c5fc
mov dword [esp + 0x24], 0xc
jmp 0x40c5fc
mov dword [esp + 0x24], 0xb
jmp 0x40c5fc
mov dword [esp + 0x24], 9
jmp 0x40c5fc
mov dword [esp + 0x24], 8
jmp 0x40c5fc
mov dword [esp + 0x24], 0xf
jmp 0x40c5fc
mov dword [esp + 0x24], 6
jmp 0x40c5fc
mov dword [esp + 0x24], 3
jmp 0x40c5fc
mov dword [esp + 0x24], 5
jmp 0x40c5fc
mov dword [esp + 0x24], 4
jmp 0x40c5fc