Function at 0x4062b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x5c
push ebx
push ebp
push esi
mov esi, ecx
lea eax, [esp + 0x58]
push edi
mov ecx, dword [esi + 0x20]
push eax
push ecx
mov dword [esp + 0x2c], esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [esp + 0x64]
mov ecx, dword [esp + 0x5c]
mov ebx, dword [esp + 0x68]
mov edx, dword [esp + 0x60]
sub edi, ecx
sub ebx, edx
cmp edi, 1
mov dword [esp + 0x10], ebx
mov eax, 1
jl 0x4062f0
mov eax, edi
push 8
lea ecx, [esi + 0x330]
push 1
push eax
mov dword [esp + 0x54], ecx
call fcn.0040b440
cmp ebx, 1
mov eax, 1
jl 0x406310
mov eax, ebx
push 8
lea ecx, [esi + 0x368]
push eax
push 1
mov dword [esp + 0x58], ecx
call fcn.0040b440
push 8
lea ecx, [esi + 0x250]
push ebx
push edi
mov dword [esp + 0x50], ecx
call fcn.0040b440
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
push 0x14
call esi
push 0xf
mov dword [esp + 0x44], eax
call esi
push 0x10
mov ebx, eax
call esi
mov ecx, ebx
mov esi, eax
and ecx, 0xff
and esi, 0xff
mov dword [esp + 0x3c], ecx
xor ecx, ecx
mov cl, ah
xor edx, edx
mov ebp, ecx
xor ecx, ecx
mov cl, bh
and ebp, 0xff
shr eax, 0x10
and ecx, 0xff
and eax, 0xff
mov dword [esp + 0x38], ecx
mov ecx, eax
neg ecx
mov dword [esp + 0x58], ecx
mov ecx, ebp
neg ecx
mov dword [esp + 0x54], ecx
mov ecx, esi
shr ebx, 0x10
and ebx, 0xff
mov dword [esp + 0x14], edx
neg ecx
shl eax, 7
shl ebp, 7
shl esi, 7
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x18], esi
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
add eax, edx
mov ecx, dword [esp + 0x28]
cdq
and edx, 0x7f
add eax, edx
mov edx, dword [esp + 0x1c]
mov esi, eax
lea eax, [ecx + edx]
mov ecx, dword [esp + 0x30]
cdq
and edx, 0x7f
add eax, edx
mov ebp, eax
mov eax, dword [esp + 0x2c]
add eax, ecx
mov ecx, dword [esp + 0x44]
cdq
and edx, 0x7f
add eax, edx
mov edx, dword [esp + 0x14]
mov ebx, eax
sar ebx, 7
sar ebp, 7
sar esi, 7
push ebx
push ebp
push esi
push edx
call fcn.0040b5a0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x48]
push ebx
push ebp
push esi
push eax
call fcn.0040b5a0
mov ecx, dword [esp + 0x4c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push esi
call fcn.0040b5a0
mov ecx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
add ebp, ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x20], ebp
mov ebp, dword [esp + 0x28]
add ecx, eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x54]
add ebx, edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x2c]
add ebp, ecx
mov ecx, dword [esp + 0x30]
inc esi
add ebx, edx
add ecx, eax
cmp esi, 0x81
mov dword [esp + 0x14], esi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ecx
jl 0x4063d1
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x34]
xor edx, edx
mov ecx, eax
mov dl, ah
and ecx, 0xff
shr eax, 0x10
and eax, 0xff
and edx, 0xff
mov dword [esp + 0x44], eax
mov dword [esp + 0x18], eax
mov eax, esi
mov dword [esp + 0x54], edx
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x38]
neg eax
mov dword [esp + 0x48], eax
mov eax, edx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x14], 1
neg eax
mov dword [esp + 0x4c], eax
mov eax, ecx
neg eax
mov dword [esp + 0x50], eax
mov eax, esi
shl eax, 7
sub eax, esi
mov dword [esp + 0x1c], eax
mov eax, edx
shl eax, 7
sub eax, edx
mov dword [esp + 0x20], eax
mov eax, ecx
shl eax, 7
sub eax, ecx
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
lea eax, [ecx + edx]
mov ecx, dword [esp + 0x2c]
cdq
and edx, 0x7f
add eax, edx
mov esi, eax
mov eax, dword [esp + 0x20]
add eax, ecx
mov ecx, dword [esp + 0x24]
cdq
and edx, 0x7f
add ecx, 0x250
add eax, edx
mov edx, dword [esp + 0x1c]
mov ebp, eax
mov eax, dword [esp + 0x18]
add eax, edx
cdq
and edx, 0x7f
add eax, edx
mov ebx, eax
mov al, byte [esp + 0x14]
sar ebx, 7
sar ebp, 7
sar esi, 7
push ebx
add al, 0x7f
push ebp
push esi
push eax
mov byte [esp + 0x4c], al
call fcn.0040b5a0
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x3c]
push ebx
push ebp
push esi
push edx
lea ecx, [eax + 0x330]
call fcn.0040b5a0
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x24]
push ebx
push ebp
push esi
push ecx
lea ecx, [edx + 0x368]
call fcn.0040b5a0
mov ecx, dword [esp + 0x58]
mov ebx, dword [esp + 0x30]
mov edx, dword [esp + 0x54]
mov esi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
add ebx, ecx
mov ecx, dword [esp + 0x50]
add esi, edx
mov edx, dword [esp + 0x28]
add edx, ecx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x2c], esi
mov esi, dword [esp + 0x18]
add ebp, edx
mov edx, dword [esp + 0x44]
inc eax
add ebx, ecx
add esi, edx
cmp eax, 0x81
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], esi
jl 0x40652c
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov esi, dword [esp + 0x24]
and eax, 0xff
push eax
push ecx
lea ecx, [esi + 0x250]
call fcn.0040b640
lea ecx, [esi + 0x330]
call fcn.0040b420
mov edx, dword [esi + 0x33c]
xor ecx, ecx
test edx, edx
mov ebp, eax
jle 0x406671
mov eax, ecx
and eax, 0x80000001
jns 0x406667
dec eax
or eax, 0xfffffffe
inc eax
neg al
mov byte [ecx + ebp], al
inc ecx
cmp ecx, edx
jl 0x406659
lea ecx, [esi + 0x368]
call fcn.0040b420
mov ebp, dword [esi + 0x378]
xor ecx, ecx
test ebp, ebp
jle 0x4066a3
mov edx, ecx
and edx, 0x80000001
jns 0x406697
dec edx
or edx, 0xfffffffe
inc edx
neg dl
mov byte [eax], dl
add eax, 4
inc ecx
cmp ecx, ebp
jl 0x406688
mov eax, dword [esi + 0x280]
lea ebx, [esi + 0x250]
mov ecx, ebx
mov dword [esp + 0x1c], eax
call fcn.0040b420
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x14], eax
and ecx, 0xff
mov esi, eax
mov dword [esp + 0x20], ecx
mov ebp, 1
lea eax, [ecx + ecx]
cmp eax, 1
jl 0x4066dd
mov ebp, eax
mov eax, 0x7fff
cdq
idiv ebp
mov edx, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov eax, 0xff
sub eax, ecx
dec edx
cmp edx, 8
mov dword [esp + 0x28], eax
ja case.default.0x406702
jmp dword [edx*4 + 0x4070c0]
push 0
mov ecx, ebx
call fcn.0040b7b0
mov eax, 0x7fff
mov dword [esp + 0x3c], 0xc8
cdq
idiv edi
mov dword [esp + 0x58], eax
mov eax, 0x7fff
cdq
idiv dword [esp + 0x10]
mov dword [esp + 0x54], eax
mov esi, dword [sym.imp.MSVCRT.dll_rand]
call esi
cdq
idiv dword [esp + 0x58]
mov dword [esp + 0x70], eax
call esi
cdq
idiv dword [esp + 0x54]
mov ebp, dword [esp + 0x10]
cmp edi, ebp
mov esi, eax
jge 0x406758
mov ebp, edi
mov ebx, dword [sym.imp.MSVCRT.dll_rand]
call ebx
mov ecx, eax
mov eax, 0x7fff
cdq
idiv ebp
mov ebp, eax
mov eax, ecx
cdq
idiv ebp
cdq
sub eax, edx
mov ebp, eax
sar ebp, 1
call ebx
mov ecx, eax
mov eax, 0xa00a00a1
imul ecx
add edx, ecx
xor ebx, ebx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
test ebp, ebp
mov dword [esp + 0x80], edx
jle 0x406822
mov eax, dword [esp + 0x70]
mov dword [esp + 0x74], esi
sub eax, esi
mov dword [esp + 0x7c], eax
mov ecx, dword [esp + 0x7c]
lea eax, [ecx + esi]
test eax, eax
jle 0x4067de
mov edx, dword [esp + 0x74]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
jge 0x4067de
mov ecx, dword [esp + 0x80]
push ecx
push edx
push eax
mov eax, dword [esp + 0x30]
lea ecx, [eax + 0x250]
call fcn.0040b5f0
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x74]
add ecx, edx
cmp ecx, edi
jge 0x406813
test esi, esi
jle 0x406813
mov eax, dword [esp + 0x80]
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x74]
mov ecx, ebx
push esi
sub ecx, eax
add ecx, edi
push ecx
lea ecx, [edx + 0x250]
call fcn.0040b5f0
mov edx, dword [esp + 0x74]
inc ebx
inc edx
dec esi
cmp ebx, ebp
mov dword [esp + 0x74], edx
jl 0x4067ae
mov eax, dword [esp + 0x3c]
dec eax
mov dword [esp + 0x3c], eax
jne 0x406734
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
sub eax, edx
mov ecx, dword [esp + 0x10]
sub eax, 0x28
mov ebp, dword [esp + 0x14]
cdq
sub eax, edx
sar eax, 1
test ecx, ecx
mov dword [esp + 0x7c], eax
jle 0x40706c
mov dword [esp + 0x74], 0
mov dword [esp + 0x70], ecx
xor esi, esi
test edi, edi
jle 0x4068c0
mov eax, dword [esp + 0x74]
mov ebx, dword [esp + 0x7c]
cdq
idiv dword [esp + 0x10]
mov dword [esp + 0x80], eax
mov eax, ebx
neg eax
imul ebx, edi
mov dword [esp + 0x58], eax
mov eax, ebx
mov cl, byte [esp + 0x80]
cdq
idiv edi
mov dl, byte [esi + ebp]
add al, cl
add dl, al
mov byte [esi + ebp], dl
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [esp + 0x18]
mov cl, byte [esi + ebp]
add cl, al
mov byte [esi + ebp], cl
mov ecx, dword [esp + 0x58]
inc esi
add ebx, ecx
cmp esi, edi
jl 0x406888
mov eax, dword [esp + 0x7c]
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x74]
mov ecx, dword [esp + 0x70]
add ebp, esi
add edx, eax
dec ecx
mov dword [esp + 0x74], edx
mov dword [esp + 0x70], ecx
jne 0x406863
jmp 0x40706c
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x40699e
mov ecx, dword [esp + 0x20]
mov eax, 0x40
sub eax, ecx
mov dword [esp + 0x7c], 0
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x7c]
xor ebp, ebp
cdq
idiv dword [esp + 0x10]
mov ecx, eax
sub ecx, 0x7f
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
imul eax, dword [esp + 0x70]
shl eax, 1
cdq
and edx, 0x7f
add eax, edx
mov ebx, eax
sar ebx, 7
add ebx, 0x80
test edi, edi
jle 0x406975
mov byte [esi + ebp], bl
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [esp + 0x18]
mov cl, byte [esp + 0x74]
mov dl, byte [esi + ebp]
sub al, cl
add dl, al
mov byte [esi + ebp], dl
inc ebp
cmp ebp, edi
jl 0x406954
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x7c]
mov eax, dword [esp + 0x80]
add esi, edx
add ecx, 0xff
dec eax
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], eax
jne 0x40690e
mov eax, 0x2aaaaaab
mov dword [esp + 0x80], 0x10
imul edi
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
cmp edx, 0x10
jg 0x4069c3
mov dword [esp + 0x80], edx
mov esi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov eax, esi
xor ecx, ecx
imul eax, esi
cdq
and edx, 3
mov dword [esp + 0x14], ecx
add eax, edx
sar eax, 2
test esi, esi
mov dword [esp + 0x7c], eax
jle 0x40706c
mov eax, esi
mov esi, dword [esp + 0x80]
cdq
sub eax, edx
mov dword [esp + 0x2c], ecx
sar eax, 1
imul esi, eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], esi
jmp 0x406a0e
mov esi, dword [esp + 0x58]
mov edx, dword [esp + 0x2c]
mov ebx, ecx
sub edx, esi
sub ebx, eax
xor esi, esi
mov dword [esp + 0x70], edx
test edi, edi
jle 0x406add
mov eax, edi
mov dword [esp + 0x30], esi
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x70]
imul eax, ebx
cdq
idiv dword [esp + 0x7c]
mov edx, dword [esp + 0x80]
mov ebx, edi
sar ecx, 1
mov dword [esp + 0x54], ecx
sub eax, edx
add eax, ecx
mov dword [esp + 0x3c], eax
shl ebx, 7
jmp 0x406a61
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x3c]
mov edx, esi
sub edx, ecx
cmp edx, eax
mov dword [esp + 0x70], edx
jle 0x406a88
mov eax, ebx
mov cl, byte [esp + 0x20]
cdq
idiv dword [esp + 0x80]
mov edx, dword [esp + 0x70]
add al, cl
mov byte [esi + ebp], al
mov eax, dword [esp + 0x3c]
add eax, edx
test eax, eax
jge 0x406aa3
mov eax, dword [esp + 0x30]
cdq
idiv dword [esp + 0x80]
mov dl, byte [esp + 0x28]
sub dl, al
mov byte [esi + ebp], dl
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [esp + 0x18]
mov dl, byte [esp + 0x74]
mov cl, byte [esi + ebp]
sub ebx, 0x80
sub al, dl
add cl, al
mov byte [esi + ebp], cl
mov ecx, dword [esp + 0x30]
inc esi
add ecx, 0x80
cmp esi, edi
mov dword [esp + 0x30], ecx
jl 0x406a59
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x2c]
add ebp, edx
mov edx, dword [esp + 0x80]
add esi, edx
mov edx, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x2c], esi
cmp ecx, edx
mov dword [esp + 0x14], ecx
jl 0x406a0a
jmp 0x40706c
mov ebx, dword [esp + 0x10]
test ebx, ebx
jle 0x40706c
mov dword [esp + 0x80], 0
mov dword [esp + 0x70], ebx
mov eax, dword [esp + 0x80]
xor ebp, ebp
cdq
idiv ebx
mov ecx, eax
sub ecx, 0x7f
test edi, edi
jle 0x406bee
mov eax, ecx
mov ebx, edi
imul eax, ecx
imul eax, ecx
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
cdq
and edx, 0x7f
add eax, edx
mov edx, dword [esp + 0x20]
sar eax, 7
mov dword [esp + 0x58], eax
mov eax, 0x80
sub eax, edx
shl ebx, 8
mov dword [esp + 0x7c], eax
sub ebx, edi
mov eax, ebx
cdq
idiv edi
mov ecx, eax
sub ecx, 0x7f
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
and edx, 0x7f
mov ecx, dword [esp + 0x20]
add eax, edx
sar eax, 7
cdq
and edx, 0x7f
add eax, edx
mov edx, dword [esp + 0x58]
sar eax, 7
add eax, edx
imul eax, dword [esp + 0x7c]
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
add eax, 0x80
cmp eax, ecx
jge 0x406bb9
mov eax, ecx
mov ecx, dword [esp + 0x28]
cmp eax, ecx
jle 0x406bc3
mov eax, ecx
mov byte [esi + ebp], al
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [esp + 0x18]
mov dl, byte [esp + 0x74]
mov cl, byte [esi + ebp]
sub ebx, 0xff
sub al, dl
add cl, al
mov byte [esi + ebp], cl
inc ebp
cmp ebp, edi
jl 0x406b72
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x70]
add esi, edx
add ecx, 0xff
dec eax
mov dword [esp + 0x80], ecx
mov dword [esp + 0x70], eax
jne 0x406b25
jmp 0x40706c
test edi, edi
mov dword [esp + 0x80], 0
jle 0x40706c
mov esi, edi
mov ebp, 0x80
shl esi, 8
sub ebp, ecx
sub esi, edi
mov dword [esp + 0x7c], ebp
mov dword [esp + 0x70], esi
mov eax, esi
cdq
idiv edi
mov ecx, eax
sub ecx, 0x7f
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
imul eax, ebp
cdq
and edx, 0x7f
add eax, edx
mov ebx, eax
mov eax, dword [esp + 0x10]
sar ebx, 7
add ebx, 0x80
test eax, eax
jle 0x406cc1
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
lea esi, [eax + ecx]
mov byte [esi], bl
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [esp + 0x18]
mov cl, byte [esp + 0x74]
mov dl, byte [esi]
sub al, cl
mov ecx, dword [esp + 0x1c]
add dl, al
mov byte [esi], dl
add esi, ecx
dec ebp
jne 0x406c97
mov ebp, dword [esp + 0x7c]
mov esi, dword [esp + 0x70]
mov eax, dword [esp + 0x80]
sub esi, 0xff
inc eax
mov dword [esp + 0x70], esi
cmp eax, edi
mov dword [esp + 0x80], eax
jl 0x406c45
jmp 0x40706c
mov edx, dword [esp + 0x10]
test edx, edx
jle 0x40706c
mov eax, 0x80
mov dword [esp + 0x80], 0
sub eax, ecx
mov dword [esp + 0x70], edx
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x80]
xor ebp, ebp
cdq
idiv dword [esp + 0x10]
mov ecx, eax
sub ecx, 0x7f
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
imul eax, dword [esp + 0x7c]
cdq
and edx, 0x7f
add eax, edx
mov ebx, eax
sar ebx, 7
add ebx, 0x80
test edi, edi
jle 0x406d75
mov byte [esi + ebp], bl
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [esp + 0x18]
mov cl, byte [esp + 0x74]
mov dl, byte [esi + ebp]
sub al, cl
add dl, al
mov byte [esi + ebp], dl
inc ebp
cmp ebp, edi
jl 0x406d54
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x70]
add esi, edx
add ecx, 0xff
dec eax
mov dword [esp + 0x80], ecx
mov dword [esp + 0x70], eax
jne 0x406d0d
jmp 0x40706c
sub eax, ecx
mov ecx, dword [esp + 0x10]
cdq
sub eax, edx
sar eax, 1
test ecx, ecx
mov dword [esp + 0x7c], eax
jle 0x40706c
mov dword [esp + 0x70], 0
mov dword [esp + 0x3c], ecx
xor ebp, ebp
test edi, edi
jle 0x406e28
mov eax, dword [esp + 0x70]
mov ebx, dword [esp + 0x7c]
cdq
idiv dword [esp + 0x10]
mov dword [esp + 0x80], eax
mov eax, ebx
neg eax
imul ebx, edi
mov dword [esp + 0x58], eax
mov eax, ebx
mov cl, byte [esp + 0x20]
cdq
idiv edi
add al, byte [esp + 0x80]
add al, cl
mov byte [esi + ebp], al
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [esp + 0x18]
mov dl, byte [esp + 0x74]
mov cl, byte [esi + ebp]
sub al, dl
add cl, al
mov byte [esi + ebp], cl
mov ecx, dword [esp + 0x58]
inc ebp
add ebx, ecx
cmp ebp, edi
jl 0x406deb
mov eax, dword [esp + 0x7c]
mov ebx, dword [esp + 0x1c]
mov edx, dword [esp + 0x70]
mov ecx, dword [esp + 0x3c]
add esi, ebx
add edx, eax
dec ecx
mov dword [esp + 0x70], edx
mov dword [esp + 0x3c], ecx
jne 0x406dc6
jmp 0x40706c
sub eax, ecx
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x40706c
mov dword [esp + 0x80], 0
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x20]
cdq
idiv dword [esp + 0x10]
xor ebp, ebp
mov ebx, eax
add ebx, ecx
test edi, edi
jle 0x406ea4
mov byte [esi + ebp], bl
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [esp + 0x18]
mov cl, byte [esp + 0x74]
mov dl, byte [esi + ebp]
sub al, cl
add dl, al
mov byte [esi + ebp], dl
inc ebp
cmp ebp, edi
jl 0x406e83
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x70]
add esi, edx
mov edx, dword [esp + 0x7c]
add ecx, edx
dec eax
mov dword [esp + 0x80], ecx
mov dword [esp + 0x70], eax
jne 0x406e69
jmp 0x40706c
sub eax, ecx
mov dword [esp + 0x80], 0
test edi, edi
jle 0x40706c
mov ecx, eax
neg ecx
imul eax, edi
mov dword [esp + 0x70], ecx
mov dword [esp + 0x7c], eax
cdq
idiv edi
mov edx, dword [esp + 0x20]
mov ebx, eax
mov eax, dword [esp + 0x10]
add ebx, edx
test eax, eax
jle 0x406f3d
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
lea esi, [eax + ecx]
mov byte [esi], bl
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [esp + 0x18]
mov cl, byte [esp + 0x74]
mov dl, byte [esi]
sub al, cl
mov ecx, dword [esp + 0x1c]
add dl, al
mov byte [esi], dl
add esi, ecx
dec ebp
jne 0x406f17
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x80]
mov eax, dword [esp + 0x7c]
inc edx
add eax, ecx
cmp edx, edi
mov dword [esp + 0x80], edx
mov dword [esp + 0x7c], eax
jl 0x406ef2
jmp 0x40706c
sub eax, ecx
mov dword [esp + 0x80], 0
mov esi, eax
test edi, edi
mov dword [esp + 0x7c], esi
jle 0x40706c
mov ecx, esi
imul ecx, edi
mov dword [esp + 0x3c], ecx
mov eax, ecx
cdq
idiv edi
cdq
sub eax, edx
mov edx, dword [esp + 0x20]
sar eax, 1
add eax, edx
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x40700f
mov ecx, eax
cdq
sub eax, edx
mov edx, dword [esp + 0x80]
mov ebx, eax
mov eax, dword [esp + 0x14]
sar ebx, 1
lea ebp, [edx + eax]
mov dword [esp + 0x70], ecx
mov cl, byte [esp + 0x58]
mov byte [ebp], cl
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [esp + 0x18]
mov ecx, eax
mov eax, ebx
cdq
mov esi, eax
mov eax, 0x2aaaaaab
xor esi, edx
sub esi, edx
imul esi
mov eax, edx
shr eax, 0x1f
add edx, eax
mov al, byte [ebp]
add cl, dl
mov dl, byte [esp + 0x74]
sub cl, dl
add al, cl
mov ecx, dword [esp + 0x1c]
mov byte [ebp], al
mov eax, dword [esp + 0x70]
dec ebx
add ebp, ecx
dec eax
mov dword [esp + 0x70], eax
jne 0x406fba
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0x7c]
mov eax, dword [esp + 0x80]
add ecx, esi
inc eax
mov dword [esp + 0x3c], ecx
cmp eax, edi
mov dword [esp + 0x80], eax
jl 0x406f83
jmp 0x40706c
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x40706c
mov ebx, dword [sym.imp.MSVCRT.dll_rand]
mov dword [esp + 0x7c], eax
xor ebp, ebp
test edi, edi
jle 0x40705b
call ebx
cdq
idiv dword [esp + 0x18]
sub al, byte [esp + 0x74]
add al, 0x80
mov byte [esi + ebp], al
inc ebp
cmp ebp, edi
jl 0x407046
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x7c]
add esi, ecx
dec eax
mov dword [esp + 0x7c], eax
jne 0x407040
mov ebx, dword [esp + 0x24]
lea edi, [ebx + 0x250]
lea ecx, [ebx + 0x2c0]
push edi
call fcn.0040b760
lea esi, [ebx + 0x2f8]
push edi
mov ecx, esi
call fcn.0040b760
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x40]
and ecx, 0xff
push ecx
push edx
mov ecx, esi
call fcn.0040b640
push esi
lea ecx, [ebx + 0x288]
call fcn.0040b760
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret 0x14