ヒープやんけ

1) 0052290A mov dword ptr [edx],eax ; We can control both of EDX and EAX
(2) 00406011 call dword ptr [ebx+0ch] ; We can control EBX

In both cases, we confirmed the ability to execute our own code. This is a common heap overflow vulnerability and can be exploited easily.