Function at 0x64451d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0x98]
or eax, dword [ebp - 0x58]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xa8]
or eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x74]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x40]
or eax, dword [ebp - 0x58]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x60]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x7c]
add eax, dword [ebp - 0x7c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x34]
or eax, dword [ebp - 0xa8]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0xc]
or eax, dword [ebp - 0x48]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x88]
add eax, dword [ebp - 0x28]
or eax, dword [ebp - 0x9c]
mov dword [ebp - 0x74], eax
push 0x40
push 0x3000
push 0xf6ecb
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x54]
or eax, dword [ebp - 0x10]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x10]
and eax, dword [ebp - 4]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x58]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x30]
jbe 0x644616
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0xc]
jae 0x64461e
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x60]
jb 0x644642
mov eax, dword [ebp - 0xa8]
sub eax, dword [ebp - 0x30]
or eax, dword [ebp - 0x78]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x6c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x84]
sub eax, dword [ebp - 0x48]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xe0]
add eax, 0x5b000
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0x64], 0
jne 0x64467c
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x24]
je 0x644685
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x80]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x84]
add eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x90]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0xf0], 0x401000
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x68]
mov dword [ebp - 0x74], eax
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x90]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x80]
add eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x84]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x90]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0xec], 0xa9cab74d
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x60]
mov dword [ebp - 4], eax
mov dword [ebp - 0xd8], 0xf7bb409e
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0xa4], 0x77fbbec0
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0x90]
or eax, dword [ebp - 0x44]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc4], 0xcfc0e4ac
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xbc], 0x12e35a01
mov dword [ebp - 0xb0], 0x29758f97
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x40]
or eax, dword [ebp - 0x20]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xa0], 0xa89b019f
mov dword [ebp - 0xe4], 0x5628f4d8
mov dword [ebp - 0x28], 0x4de
mov eax, dword [ebp - 0xc]
or eax, dword [ebp - 0x48]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x78]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
add eax, 0x14
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x78]
sub eax, dword [ebp - 0x94]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x28], 0x4f2
jb 0x644795
mov dword [ebp - 0xcc], 0x95b241ba
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xc8], 0xf2d92e9d
mov eax, dword [ebp - 0x7c]
add eax, dword [ebp - 0x80]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0xac], 0x31b4d4d
cmp dword [ebp - 0x58], 0
ja 0x644812
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 4]
je 0x644812
cmp dword [ebp - 0x48], 0
jae 0x64481e
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x54]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xd0], 0x4e429c69
mov dword [ebp - 0xb8], 0x1202325f
mov dword [ebp - 0xb4], 0x13bb08e
mov eax, dword [ebp - 0x94]
and eax, dword [ebp - 0x68]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xe8], 0xab618b06
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x8c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
and dword [ebp - 8], 0
cmp dword [ebp - 8], 0xb410
jae 0x6453c8
mov eax, dword [ebp - 0x44]
or eax, dword [ebp - 0x30]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xec]
add eax, dword [ebp - 0xd8]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x84]
sub eax, dword [ebp - 0x64]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x74]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0xec]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x9c]
add eax, dword [ebp - 4]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xd0]
xor eax, dword [ebp - 0xe8]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xbc]
xor eax, dword [ebp - 0xc8]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xe8]
xor eax, dword [ebp - 0xb8]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x8c]
and eax, dword [ebp - 0x8c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xac]
xor eax, dword [ebp - 0xd8]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0x68], 0
jb 0x64494e
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x28]
je 0x64494e
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x54]
jb 0x644983
mov eax, dword [ebp - 0x80]
sub eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x8c], 0
jne 0x644968
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x58]
jae 0x64496e
cmp dword [ebp - 0x10], 0
jne 0x644983
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x30]
or eax, dword [ebp - 4]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0xb0]
xor eax, dword [ebp - 0xa0]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x24]
or eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x58]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0xb4]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x44]
and eax, dword [ebp - 4]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0xcc]
add eax, dword [ebp - 0xa0]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xd0]
xor eax, dword [ebp - 0xb8]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x78]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xa0]
add eax, dword [ebp - 0xe4]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x70]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x88]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xe4]
add eax, dword [ebp - 0xcc]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xac]
add eax, dword [ebp - 0xa0]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x88]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xbc]
xor eax, dword [ebp - 0xb0]
mov dword [ebp - 0xbc], eax
and dword [ebp - 0x14], 0
jmp 0x644a7d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jae 0x644a91
mov eax, dword [ebp - 0x7c]
sub eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x80]
mov dword [ebp - 4], eax
jmp 0x644a76
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0xa0]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x38]
or eax, dword [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xb4]
add eax, dword [ebp - 0xe8]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x80]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0xa0]
xor eax, dword [ebp - 0xb4]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0xb4]
add eax, dword [ebp - 0xbc]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0xc4]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x40]
jne 0x644b5e
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x9c]
jae 0x644b5e
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x68]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0xa8]
add eax, dword [ebp - 0x90]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xac]
xor eax, dword [ebp - 0xd0]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x8c]
and eax, dword [ebp - 0x6c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xc8]
add eax, dword [ebp - 0xac]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x50]
and eax, dword [ebp - 0x44]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xb8]
add eax, dword [ebp - 0xa0]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x9c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xb0]
xor eax, dword [ebp - 0xb8]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0x80]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0xc8]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x5c]
jne 0x644c1e
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x30]
je 0x644c1e
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x70]
jne 0x644c1e
mov eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0x60]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xd8]
add eax, dword [ebp - 0xa4]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0xbc]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0x80]
sub eax, dword [ebp - 0x70]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xac]
add eax, dword [ebp - 0xa0]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0x40]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x7c]
add eax, dword [ebp - 0x78]
sub eax, dword [ebp - 0x88]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xb8]
xor eax, dword [ebp - 0xb4]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x8c]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x84]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xa4]
xor eax, dword [ebp - 0xa0]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0x20], 0
ja 0x644cd5
cmp dword [ebp - 0x18], 0
jne 0x644cff
cmp dword [ebp - 0x74], 0
je 0x644cff
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
and dword [ebp - 0x68], 0
jmp 0x644ceb
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jae 0x644cff
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0x34]
and eax, dword [ebp - 0x60]
mov dword [ebp - 0x78], eax
jmp 0x644ce4
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0xe4]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xcc]
add eax, dword [ebp - 0xc8]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x7c]
add eax, dword [ebp - 0x34]
and eax, dword [ebp - 0x60]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x60]
or eax, dword [ebp - 0x7c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xe0]
add eax, dword [ebp - 8]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x68]
add eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x2c]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0x58]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xf0]
add eax, dword [ebp - 8]
mov dword [ebp - 0xf4], eax
and dword [ebp - 0x6c], 0
jmp 0x644d90
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jae 0x644da1
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
jmp 0x644d89
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
sub eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0xf8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x84]
sub eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x98]
and eax, dword [ebp - 0x10]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x2c]
or eax, dword [ebp - 0x48]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x44]
jne 0x644e3d
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x70]
jb 0x644ec5
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x44]
jne 0x644ec5
mov eax, dword [ebp - 0x78]
add eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x5d
je 0x644e8f
cmp dword [ebp - 0xdc], 0x9b
je 0x644e9d
cmp dword [ebp - 0xdc], 0xbf
je 0x644eae
cmp dword [ebp - 0xdc], 0x11f
je 0x644e84
jmp 0x644ebc
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x48]
mov dword [ebp - 0x78], eax
jmp 0x644ec5
mov eax, dword [ebp - 0x60]
sub eax, dword [ebp - 0x74]
or eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
jmp 0x644ec5
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
jmp 0x644ec5
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x60]
mov dword [ebp - 0x3c], eax
jmp 0x644ec5
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
add eax, 0x4f42d
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 4]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x80]
or eax, dword [ebp - 0x88]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x5c], 0xcda
mov eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x9c]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x5c]
add eax, 0xa
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x5c], 0xcf8
jb 0x644ef8
and dword [ebp - 0x34], 0
jmp 0x644f38
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jae 0x644f4c
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
jmp 0x644f31
and dword [ebp - 0xc], 0
jmp 0x644f59
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jae 0x644f6d
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x30], eax
jmp 0x644f52
mov eax, dword [ebp - 8]
sub eax, 0x99cc8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jne 0x644f8b
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x70]
jae 0x644fdf
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x84]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x44]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x90]
add eax, dword [ebp - 0x6c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x58]
or eax, dword [ebp - 0xa8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x88]
sub eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x94]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x78]
sub eax, dword [ebp - 0x70]
add eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 8]
sub eax, 0x7e3a9
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0x68]
or eax, dword [ebp - 0x80]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x80]
sub eax, dword [ebp - 0xc]
or eax, dword [ebp - 0x58]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x94]
sub eax, dword [ebp - 0x88]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x14]
jae 0x645069
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x18]
je 0x645069
cmp dword [ebp - 0x40], 0
je 0x6450a8
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x84]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x84]
add eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x90]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x58]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x7c]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x70]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 8]
sub eax, 0x21d25
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x84]
add eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x28]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x94]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 8]
add eax, 0xc18ca
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x18]
jbe 0x64513e
cmp dword [ebp - 0x44], 0
jb 0x64513e
mov eax, dword [ebp - 0x98]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
add eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x60]
ja 0x64512c
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x54]
ja 0x64512c
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x34]
jne 0x64513e
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x64]
add eax, dword [ebp - 0x50]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x28]
jne 0x645181
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x38]
jne 0x645181
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x8c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 4]
or eax, dword [ebp - 0x48]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x7c]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x3e
je 0x64521a
cmp dword [ebp - 0xc0], 0x41
je 0x6451ed
cmp dword [ebp - 0xc0], 0x6f
je 0x6451e2
cmp dword [ebp - 0xc0], 0x8c
je 0x6451d4
cmp dword [ebp - 0xc0], 0xca
je 0x6451fb
cmp dword [ebp - 0xc0], 0xfb
je 0x645209
jmp 0x645225
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x70]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x74], eax
jmp 0x645231
mov eax, dword [ebp - 0x78]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x50], eax
jmp 0x645231
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
jmp 0x645231
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x54]
mov dword [ebp - 0x28], eax
jmp 0x645231
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x84]
sub eax, dword [ebp - 0x68]
mov dword [ebp - 0x60], eax
jmp 0x645231
mov eax, dword [ebp - 0x38]
or eax, dword [ebp - 0xc]
mov dword [ebp - 0x3c], eax
jmp 0x645231
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x54]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x58]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
add eax, 0xf03b0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x7c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x90]
add eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x9c]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x88]
add eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x50]
or eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 8]
add eax, 0x74506
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x24
je 0x64530e
cmp dword [ebp - 0xd4], 0x84
je 0x6452d9
cmp dword [ebp - 0xd4], 0xb0
je 0x645300
cmp dword [ebp - 0xd4], 0xf7
je 0x6452e7
cmp dword [ebp - 0xd4], 0x133
je 0x6452f2
jmp 0x64531c
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x64]
or eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
jmp 0x645325
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x645325
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
jmp 0x645325
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
jmp 0x645325
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
jmp 0x645325
mov eax, dword [ebp - 0x60]
and eax, dword [ebp - 0x34]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x9c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 8]
sub eax, 0xddc4a
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x30]
jbe 0x645368
cmp dword [ebp - 0x54], 0
jbe 0x645368
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x70]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x98]
or eax, dword [ebp - 0x70]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x34]
or eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x98]
sub eax, dword [ebp - 0x88]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x74]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
sub eax, 0xf2d35
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0x9516c
mov dword [ebp - 8], eax
jmp 0x64486b
mov eax, dword [ebp - 0xe0]
add eax, 0x8450
mov dword [0x650128], eax
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x84]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x1c]
je 0x6453ff
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0xa8]
jb 0x6453ff
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x38]
jb 0x64543b
mov eax, dword [ebp - 0x88]
sub eax, dword [ebp - 0x48]
add eax, dword [ebp - 4]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x94]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x38], 0
jb 0x64543b
cmp dword [ebp - 0x74], 0
jae 0x64543b
mov eax, dword [ebp - 0x64]
add eax, dword [ebp - 0x4c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x90]
sub eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x8c], 0
je 0x64547b
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x94]
jne 0x6454c3
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x78]
je 0x6454c3
mov eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x64]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0x1c], 0
jmp 0x645491
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jae 0x6454a8
mov eax, dword [ebp - 0x88]
sub eax, dword [ebp - 0x50]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
jmp 0x64548a
mov eax, dword [ebp - 0x78]
sub eax, dword [ebp - 0x78]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x98]
mov dword [ebp - 0x78], eax
mov esp, ebp
pop ebp
ret