Function at 0x405a75
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
mov dword [ebp - 0x358], ecx
mov word [ebp - 0x68], 0x40
mov eax, dword [ebp - 0x358]
xor ecx, ecx
mov cl, byte [eax + 0x754]
shl ecx, 0x11
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp - 0x358]
mov eax, dword [ebp - 0x6c]
sub eax, dword [edx + 0x6d4]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x405ac0
mov eax, 0x12c
jmp 0x4067fb
mov ecx, dword [ebp - 0x6c]
push ecx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jne 0x405adf
mov eax, 0x1f8
jmp 0x4067fb
mov edx, dword [ebp - 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x405b06
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x1f8
jmp 0x4067fb
cmp dword [ebp - 4], 0
jle 0x405bd2
mov ecx, dword [ebp - 0x358]
cmp dword [ecx + 0x8a4], 1
jne 0x405bd2
mov edx, dword [ebp - 0x6c]
push edx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jne 0x405b42
mov eax, 0x1f8
jmp 0x4067fb
mov eax, dword [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x78], 0
je 0x405b6a
cmp dword [ebp - 0x74], 0
jne 0x405b88
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x1f8
jmp 0x4067fb
mov edx, dword [ebp - 0x358]
mov eax, dword [edx + 0x6d4]
push eax
mov ecx, dword [ebp - 0x74]
push ecx
mov edx, dword [ebp - 0x78]
add edx, dword [ebp - 4]
push edx
call fcn.00412820
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x7c]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
xor edx, edx
mov dx, word [ecx + 0xc]
cmp edx, 0x1fda
je 0x405bf4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax + 0xc]
cmp ecx, 0xda46
jne 0x405bfa
mov word [ebp - 0x68], 0x100
mov edx, dword [ebp + 8]
xor eax, eax
mov ax, word [edx + 0xc]
cmp eax, 0xbf10
je 0x405c1b
mov ecx, dword [ebp + 8]
xor edx, edx
mov dx, word [ecx + 0xc]
cmp edx, 0xda45
jne 0x405c21
mov word [ebp - 0x68], 0x80
mov eax, dword [ebp - 0x358]
cmp dword [eax + 0x8a4], 2
jne 0x405c36
mov word [ebp - 0x68], 0x10
mov ecx, dword [ebp - 0x358]
cmp dword [ecx + 0x8a4], 3
je 0x405c72
mov edx, dword [ebp - 0x358]
cmp dword [edx + 0x8a4], 4
je 0x405c72
mov eax, dword [ebp - 0x358]
cmp dword [eax + 0x8a4], 5
je 0x405c72
mov ecx, dword [ebp - 0x358]
cmp dword [ecx + 0x8a4], 6
jne 0x405c78
mov word [ebp - 0x68], 0x100
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp + 8]
mov dx, word [ecx + 0xc]
mov word [ebp - 0x4c], dx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x54], eax
mov cx, word [ebp - 0x68]
mov word [ebp - 0x4a], cx
mov edx, dword [ebp - 0x358]
mov al, byte [edx + 0x754]
mov byte [ebp - 0x44], al
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x64], 0x12c0130
lea ecx, [ebp - 0x70]
push ecx
push 0
push 0
push 0x51
lea edx, [ebp - 0x58]
push edx
mov eax, dword [ebp - 0x64]
push eax
call sub.ASUSBIOS.dll_Ordinal_1
mov ecx, dword [ebp - 0x358]
cmp dword [ecx + 0x8a4], 1
je 0x405cf0
mov edx, dword [ebp - 0x358]
cmp dword [edx + 0x8a4], 3
jne 0x40604b
mov dword [ebp - 0x84], 0
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x88]
push ecx
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x5c]
lea ecx, [eax + edx - 0x20000]
push ecx
mov ecx, dword [ebp - 0x358]
call fcn.00408a45
mov dword [ebp - 0x84], eax
or edx, 0xffffffff
sub edx, dword [ebp - 0x6c]
add edx, 1
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x70], 0
push 0x204
push 0
lea eax, [ebp - 0x290]
push eax
call fcn.00412470
add esp, 0xc
mov ecx, dword [ebp - 0x88]
cmp ecx, dword [ebp - 0x8c]
jb 0x405e9b
mov edx, dword [ebp - 0x358]
mov eax, dword [edx + 0x6e0]
cmp eax, dword [ebp - 0x84]
je 0x405d91
mov ecx, dword [ebp - 0x358]
cmp dword [ecx + 0x49ec], 0
je 0x405d8c
mov dword [ebp - 0x70], 0x1f7
jmp 0x405e9b
cmp dword [ebp - 0x88], 0
je 0x405e85
cmp dword [ebp - 0x80], 0
je 0x405e85
mov edx, dword [ebp - 0x358]
cmp dword [edx + 0x49ec], 0
je 0x405e83
mov eax, dword [ebp - 0x358]
cmp dword [eax + 0x8a4], 1
jne 0x405e3a
cmp dword [ebp - 0x84], 0
jne 0x405e3a
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x88]
sub eax, dword [ebp - 0x8c]
mov dword [ebp - 0x29c], eax
mov ecx, dword [ebp - 0x298]
add ecx, dword [ebp - 0x88]
sub ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x294], ecx
mov edx, dword [ebp - 0x80]
push edx
mov eax, dword [ebp - 0x29c]
push eax
mov ecx, dword [ebp - 0x294]
push ecx
call fcn.00412820
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x405e83
mov ecx, dword [ebp - 0x88]
sub ecx, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x290]
mov dword [ebp + edx*4 - 0x28c], ecx
mov eax, dword [ebp - 0x290]
mov ecx, dword [ebp + eax*4 - 0x28c]
mov edx, dword [ebp - 0x80]
lea eax, [ecx + edx - 1]
mov ecx, dword [ebp - 0x290]
mov dword [ebp + ecx*4 - 0x18c], eax
mov edx, dword [ebp - 0x290]
add edx, 1
mov dword [ebp - 0x290], edx
jmp 0x405e9b
mov eax, dword [ebp - 0x358]
cmp dword [eax + 0x49ec], 0
je 0x405e9b
mov dword [ebp - 0x70], 0x1f6
mov ecx, dword [ebp - 0x358]
cmp dword [ecx + 0x8a4], 1
jne 0x405ffd
mov dword [ebp - 0x2a0], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x2a4], 0
jmp 0x405ee8
mov ecx, dword [ebp - 0x2a4]
add ecx, 0x1000
mov dword [ebp - 0x2a4], ecx
mov edx, dword [ebp - 0x2a4]
cmp edx, dword [ebp - 0x6c]
jae 0x405fe5
mov dword [ebp - 0x2ac], 0
jmp 0x405f12
mov eax, dword [ebp - 0x2ac]
add eax, 1
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0x1000
jae 0x405f4f
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x2a4]
mov edx, dword [ebp - 0x2ac]
movsx eax, byte [ecx + edx]
mov ecx, dword [ebp - 0x2a8]
add ecx, dword [ebp - 0x2a4]
mov edx, dword [ebp - 0x2ac]
movsx ecx, byte [ecx + edx]
cmp eax, ecx
je 0x405f4d
jmp 0x405f4f
jmp 0x405f03
cmp dword [ebp - 0x2ac], 0x1000
jb 0x405fbe
cmp dword [ebp - 0x2a0], 0
jne 0x405f9c
mov edx, dword [ebp - 0x290]
mov eax, dword [ebp - 0x2a4]
mov dword [ebp + edx*4 - 0x28c], eax
mov ecx, dword [ebp - 0x2a4]
add ecx, 0xfff
mov edx, dword [ebp - 0x290]
mov dword [ebp + edx*4 - 0x18c], ecx
mov dword [ebp - 0x2a0], 1
jmp 0x405fbc
mov eax, dword [ebp - 0x290]
mov ecx, dword [ebp + eax*4 - 0x18c]
add ecx, 0x1000
mov edx, dword [ebp - 0x290]
mov dword [ebp + edx*4 - 0x18c], ecx
jmp 0x405fe0
cmp dword [ebp - 0x2a0], 1
jne 0x405fe0
mov eax, dword [ebp - 0x290]
add eax, 1
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x2a0], 0
jmp 0x405ed6
cmp dword [ebp - 0x2a0], 1
jne 0x405ffd
mov ecx, dword [ebp - 0x290]
add ecx, 1
mov dword [ebp - 0x290], ecx
cmp dword [ebp - 0x290], 0
jle 0x406046
push 0
lea edx, [ebp - 0x2b0]
push edx
push 0
push 0
push 0x204
lea eax, [ebp - 0x290]
push eax
mov ecx, dword [ebp - 0x358]
mov edx, dword [ecx + 0x794]
neg edx
sbb edx, edx
and edx, 0x222449
add edx, 0x7b
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x4067e4
mov edx, dword [ebp - 0x358]
cmp dword [edx + 0x8a4], 2
je 0x40606d
mov eax, dword [ebp - 0x358]
cmp dword [eax + 0x8a4], 5
jne 0x4064f6
mov byte [ebp - 0x2c8], 0
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 0x2b8], 0
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x5c]
lea eax, [edx + ecx - 0x20000]
mov dword [ebp - 0x2c4], eax
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2bc], 0
mov dword [ebp - 0x2b4], 0
mov ecx, dword [ebp - 0x358]
cmp dword [ecx + 0x794], 0
je 0x4061ab
mov dword [ebp - 0x2e8], 0x10007
mov edx, dword [ebp - 0x2e8]
push edx
call fcn.00423fa9
add esp, 4
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0
jne 0x406111
xor eax, eax
jmp 0x4067fb
mov ecx, dword [ebp - 0x2e8]
push ecx
push 0
mov edx, dword [ebp - 0x2bc]
push edx
call fcn.00412470
add esp, 0xc
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x2ec], eax
mov ecx, dword [ebp - 0x2ec]
mov dword [ecx], 0xf0000
mov edx, dword [ebp - 0x2ec]
mov dword [edx + 4], 0xffff
mov eax, dword [ebp - 0x2e8]
push eax
mov ecx, dword [ebp - 0x2bc]
push ecx
mov edx, dword [ebp - 0x358]
mov eax, dword [edx + 0x728]
push eax
mov ecx, dword [ebp - 0x358]
call fcn.00405894
test eax, eax
jne 0x40619a
mov ecx, dword [ebp - 0x2bc]
mov dword [ebp - 0x344], ecx
mov edx, dword [ebp - 0x344]
push edx
call fcn.00423fd2
add esp, 4
xor eax, eax
jmp 0x4067fb
mov eax, dword [ebp - 0x2bc]
add eax, 8
mov dword [ebp - 0x2b4], eax
jmp 0x4061b5
mov dword [ebp - 0x2b4], 0xf0000
mov byte [ebp - 0x2e4], 0x4b
mov byte [ebp - 0x2e3], 0x41
mov byte [ebp - 0x2e2], 0x46
mov byte [ebp - 0x2e1], 0x4c
mov byte [ebp - 0x2e0], 0x41
mov byte [ebp - 0x2df], 0x53
mov byte [ebp - 0x2de], 0x48
mov byte [ebp - 0x2dd], 0
mov dword [ebp - 0x2d4], 0
jmp 0x406208
mov ecx, dword [ebp - 0x2d4]
add ecx, 1
mov dword [ebp - 0x2d4], ecx
cmp dword [ebp - 0x2d4], 0xffe0
jge 0x406289
mov dword [ebp - 0x2d0], 0
jmp 0x40622f
mov edx, dword [ebp - 0x2d0]
add edx, 1
mov dword [ebp - 0x2d0], edx
cmp dword [ebp - 0x2d0], 7
jge 0x406264
mov eax, dword [ebp - 0x2b4]
add eax, dword [ebp - 0x2d4]
mov ecx, dword [ebp - 0x2d0]
movsx edx, byte [eax + ecx]
mov eax, dword [ebp - 0x2d0]
movsx ecx, byte [ebp + eax - 0x2e4]
cmp edx, ecx
je 0x406262
jmp 0x406264
jmp 0x406220
cmp dword [ebp - 0x2d0], 7
jl 0x406284
mov edx, dword [ebp - 0x2b4]
add edx, dword [ebp - 0x2d4]
mov al, byte [edx + 8]
mov byte [ebp - 0x2c8], al
jmp 0x406289
jmp 0x4061f9
mov ecx, dword [ebp - 0x358]
cmp dword [ecx + 0x794], 0
je 0x4062b3
mov edx, dword [ebp - 0x2bc]
mov dword [ebp - 0x348], edx
mov eax, dword [ebp - 0x348]
push eax
call fcn.00423fd2
add esp, 4
mov ecx, dword [ebp - 0x2c4]
mov dword [ebp - 0x2c0], ecx
push 0x4315c4
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x2dc], eax
mov dword [ebp - 0x2d0], 0
jmp 0x4062eb
mov edx, dword [ebp - 0x2d0]
add edx, 1
mov dword [ebp - 0x2d0], edx
cmp dword [ebp - 0x2d0], 0x20000
jge 0x406463
mov eax, dword [ebp - 0x2c0]
add eax, dword [ebp - 0x2d0]
movsx ecx, byte [eax]
cmp ecx, 0x2a
je 0x406311
jmp 0x4062dc
mov dword [ebp - 0x2d4], 0
jmp 0x40632c
mov edx, dword [ebp - 0x2d4]
add edx, 1
mov dword [ebp - 0x2d4], edx
mov eax, dword [ebp - 0x2d4]
cmp eax, dword [ebp - 0x2dc]
jge 0x406363
mov ecx, dword [ebp - 0x2c0]
add ecx, dword [ebp - 0x2d0]
mov edx, dword [ebp - 0x2d4]
movsx eax, byte [ecx + edx]
mov ecx, dword [ebp - 0x2d4]
movsx edx, byte [ecx + 0x4315cc]
cmp eax, edx
jne 0x406363
jmp 0x40631d
mov eax, dword [ebp - 0x2d4]
cmp eax, dword [ebp - 0x2dc]
jne 0x40645e
mov ecx, dword [ebp - 0x2c0]
add ecx, dword [ebp - 0x2d0]
mov edx, dword [ebp - 0x2dc]
xor eax, eax
mov ax, word [ecx + edx + 0xc]
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0xffff
je 0x406452
mov ecx, dword [ebp - 0x2d8]
and ecx, 0xf000
mov edx, dword [ebp - 0x2d8]
and edx, 0xf
shl edx, 0x10
add ecx, edx
mov dword [ebp - 0x2cc], ecx
mov eax, dword [ebp - 0x2c8]
and eax, 0xff
cmp eax, 6
je 0x4063f6
mov ecx, dword [ebp - 0x2c8]
and ecx, 0xff
cmp ecx, 7
je 0x4063f6
mov edx, dword [ebp - 0x2c8]
and edx, 0xff
cmp edx, 7
jle 0x4063f8
jmp 0x40640e
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x2cc]
lea edx, [ecx + eax - 0x10000]
mov dword [ebp - 0x2cc], edx
mov al, byte [ebp - 0x2c8]
mov byte [ebp - 0x35c], al
cmp byte [ebp - 0x35c], 5
je 0x40642e
cmp byte [ebp - 0x35c], 6
je 0x40643a
jmp 0x406446
mov dword [ebp - 0x2b8], 0x2000
jmp 0x406450
mov dword [ebp - 0x2b8], 0x10000
jmp 0x406450
mov dword [ebp - 0x2b8], 0x1000
jmp 0x40645c
mov dword [ebp - 0x2b8], 0
jmp 0x406463
jmp 0x4062dc
cmp dword [ebp - 0x2b8], 0
jbe 0x4064d1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2f8], eax
mov ecx, dword [ebp - 0x2f4]
add ecx, dword [ebp - 0x2cc]
mov dword [ebp - 0x2f0], ecx
mov edx, dword [ebp - 0x2b8]
push edx
mov eax, dword [ebp - 0x2f8]
push eax
mov ecx, dword [ebp - 0x2f0]
push ecx
call fcn.00412820
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp - 0x70], 0
jmp 0x4064d8
mov dword [ebp - 0x70], 0x1f6
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x5c]
lea eax, [edx + ecx - 0x10000]
push eax
mov ecx, dword [ebp - 0x358]
call fcn.0040d0d9
jmp 0x4067e4
mov ecx, dword [ebp - 0x358]
cmp dword [ecx + 0x8a4], 6
jne 0x4067e4
mov dword [ebp - 0x308], 0
mov dword [ebp - 0x2fc], 0
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x310], 0
mov dword [ebp - 0x304], 0
mov byte [ebp - 0x328], 0x24
mov byte [ebp - 0x327], 0x41
mov byte [ebp - 0x326], 0x53
mov byte [ebp - 0x325], 0x55
mov byte [ebp - 0x324], 0x53
mov byte [ebp - 0x323], 0x42
mov byte [ebp - 0x322], 0x49
mov byte [ebp - 0x321], 0x4f
mov byte [ebp - 0x320], 0x53
mov byte [ebp - 0x31f], 0
mov edx, dword [ebp - 0x358]
cmp dword [edx + 0x794], 0
je 0x406669
mov dword [ebp - 0x32c], 0x10007
mov eax, dword [ebp - 0x32c]
push eax
call fcn.00423fa9
add esp, 4
mov dword [ebp - 0x34c], eax
mov ecx, dword [ebp - 0x34c]
mov dword [ebp - 0x308], ecx
cmp dword [ebp - 0x308], 0
jne 0x4065cf
xor eax, eax
jmp 0x4067fb
mov edx, dword [ebp - 0x32c]
push edx
push 0
mov eax, dword [ebp - 0x308]
push eax
call fcn.00412470
add esp, 0xc
mov ecx, dword [ebp - 0x308]
mov dword [ebp - 0x330], ecx
mov edx, dword [ebp - 0x330]
mov dword [edx], 0xf0000
mov eax, dword [ebp - 0x330]
mov dword [eax + 4], 0xffff
mov ecx, dword [ebp - 0x32c]
push ecx
mov edx, dword [ebp - 0x308]
push edx
mov eax, dword [ebp - 0x358]
mov ecx, dword [eax + 0x728]
push ecx
mov ecx, dword [ebp - 0x358]
call fcn.00405894
test eax, eax
jne 0x406658
mov edx, dword [ebp - 0x308]
mov dword [ebp - 0x350], edx
mov eax, dword [ebp - 0x350]
push eax
call fcn.00423fd2
add esp, 4
xor eax, eax
jmp 0x4067fb
mov ecx, dword [ebp - 0x308]
add ecx, 8
mov dword [ebp - 0x2fc], ecx
jmp 0x406673
mov dword [ebp - 0x2fc], 0xf0000
mov dword [ebp - 0x31c], 0
mov dword [ebp - 0x300], 0
mov dword [ebp - 0x318], 0
jmp 0x4066a2
mov edx, dword [ebp - 0x318]
add edx, 1
mov dword [ebp - 0x318], edx
cmp dword [ebp - 0x318], 0xffe0
jae 0x406745
mov dword [ebp - 0x314], 0
jmp 0x4066cd
mov eax, dword [ebp - 0x314]
add eax, 1
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 9
jae 0x406702
mov ecx, dword [ebp - 0x2fc]
add ecx, dword [ebp - 0x318]
mov edx, dword [ebp - 0x314]
movsx eax, byte [ecx + edx]
mov ecx, dword [ebp - 0x314]
movsx edx, byte [ebp + ecx - 0x328]
cmp eax, edx
je 0x406700
jmp 0x406702
jmp 0x4066be
cmp dword [ebp - 0x314], 9
jb 0x406740
or eax, 0xffffffff
sub eax, dword [ebp - 0x6c]
add eax, 1
mov ecx, dword [ebp - 0x2fc]
add ecx, dword [ebp - 0x318]
mov edx, dword [ecx + 0x20]
sub edx, eax
mov dword [ebp - 0x31c], edx
mov eax, dword [ebp - 0x2fc]
add eax, dword [ebp - 0x318]
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x300], ecx
jmp 0x406693
mov edx, dword [ebp - 0x358]
cmp dword [edx + 0x794], 0
je 0x40676f
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x354], eax
mov ecx, dword [ebp - 0x354]
push ecx
call fcn.00423fd2
add esp, 4
cmp dword [ebp - 0x300], 0
je 0x4067dd
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x338], eax
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x31c]
mov dword [ebp - 0x33c], ecx
mov edx, dword [ebp - 0x338]
add edx, dword [ebp - 0x31c]
mov dword [ebp - 0x334], edx
mov eax, dword [ebp - 0x300]
push eax
mov ecx, dword [ebp - 0x33c]
push ecx
mov edx, dword [ebp - 0x334]
push edx
call fcn.00412820
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp - 0x70], 0
jmp 0x4067e4
mov dword [ebp - 0x70], 0x1f6
mov edx, dword [ebp - 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x70]
mov esp, ebp
pop ebp
ret 4