Function at 0x420b1d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x420b26
mov eax, dword [ebp - 4]
add esp, 0xfffffd34
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0xf490], edx
mov dword [ebp - 0xf48c], eax
lea esi, [ebp - 0xf488]
mov eax, 0x49ad74
call fcn.0048dbf8
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0xf494], edx
mov dword [ebp - 0xf498], ecx
mov byte [ebp - 0xf499], 0
mov word [esi + 0x10], 8
mov edx, dword [ebp - 0xf48c]
lea eax, [ebp - 0x7a2c]
call fcn.00403f1c
add dword [esi + 0x1c], 0xa
mov word [esi + 0x10], 0x14
mov word [esi + 0x10], 0x20
lea eax, [ebp - 0xf458]
mov edx, dword [ebp - 0xf48c]
call fcn.00403f1c
add dword [esi + 0x1c], 0xa
mov word [esi + 0x10], 0x14
lea eax, [ebp - 0x7a2c]
mov ecx, ebx
mov edx, dword [ebp - 0xf490]
call fcn.00409244
mov byte [ebp - 0x7a1b], 1
push 0x49ac15
lea eax, [ebp - 0xf8bc]
push eax
call fcn.0048d758
add esp, 8
mov eax, dword [ebp - 0xf490]
call fcn.0040b578
push eax
lea edx, [ebp - 0xf8bc]
push edx
call fcn.0048d67c
add esp, 8
lea eax, [ebp - 0xf8bc]
xor edx, edx
call fcn.0040bda0
push 0x49ac1c
lea ecx, [ebp - 0xfcbc]
push ecx
call fcn.0048d758
add esp, 8
mov eax, dword [ebp - 0xf490]
call fcn.0040b578
push eax
lea edx, [ebp - 0xfcbc]
push edx
call fcn.0048d67c
add esp, 8
mov edx, 0x49ac25
mov eax, dword [ebp - 0xf490]
call fcn.0040b9a4
test al, al
jne 0x420c60
mov edx, 0x49ac29
mov eax, dword [ebp - 0xf490]
call fcn.0040b9a4
test al, al
je 0x420c70
mov edx, 0x49ac2d
lea eax, [ebp - 0xfcbc]
call fcn.0040b88c
lea eax, [ebp - 0xfcbc]
xor edx, edx
call fcn.0040bda0
push 0
push 0
lea ecx, [ebp - 0xf49a]
push ecx
push 0x80000000
push 0
push 0
lea ecx, [ebp - 0xf8bc]
lea edx, [ebp - 0xf458]
mov eax, dword [ebp - 0xf48c]
call fcn.0040af00
test al, al
jne 0x420dc9
cmp byte [ebp - 0xf49a], 0
jne 0x420cd8
mov eax, 0x4a6984
mov edx, 9
call fcn.00429794
lea edx, [ebp - 0xf8bc]
mov eax, 0x4a6984
call fcn.00429668
xor eax, eax
mov edx, 2
mov al, byte [ebp - 0xf49a]
cmp eax, 1
sbb eax, eax
neg eax
push eax
lea eax, [ebp - 0x9410]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
call fcn.0040177c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xa13c]
mov edx, 2
call fcn.0040177c
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0xe088]
mov edx, 2
call fcn.0042462c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xe5ec]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
lea eax, [ebp - 0xf458]
xor edx, edx
call fcn.004090d0
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x19e4]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x2710]
mov edx, 2
call fcn.0040177c
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0x665c]
mov edx, 2
call fcn.0042462c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x6bc0]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.004090d0
pop eax
mov edx, dword [esi]
mov dword fs:[0], edx
jmp 0x421b3f
lea ecx, [ebp - 0xf8bc]
mov eax, 0x267
push ecx
call fcn.004116e0
push eax
lea edx, [ebp - 0x102bc]
push edx
call fcn.00490628
add esp, 0xc
lea eax, [ebp - 0x102bc]
call fcn.00477974
lea edx, [ebp - 0xf458]
lea eax, [ebp - 0x7a2c]
call fcn.0041f780
mov ebx, eax
cmp ebx, 2
jne 0x420f00
lea eax, [ebp - 0xf458]
call fcn.004093cc
mov al, 1
mov edx, 2
push eax
lea eax, [ebp - 0x9410]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
call fcn.0040177c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xa13c]
mov edx, 2
call fcn.0040177c
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0xe088]
mov edx, 2
call fcn.0042462c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xe5ec]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
lea eax, [ebp - 0xf458]
xor edx, edx
call fcn.004090d0
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x19e4]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x2710]
mov edx, 2
call fcn.0040177c
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0x665c]
mov edx, 2
call fcn.0042462c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x6bc0]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.004090d0
pop eax
mov edx, dword [esi]
mov dword fs:[0], edx
jmp 0x421b3f
cmp ebx, 1
jne 0x421037
lea eax, [ebp - 0xf458]
call fcn.004093cc
mov edx, dword [ebp - 0xf48c]
cmp byte [edx + 0x20e0], 0
jne 0x421037
push 0x24
mov eax, 0x262
call fcn.004116e0
push eax
mov eax, 0x275
call fcn.004116e0
push eax
push dword [0x4b982c]
call sub.USER32.DLL_MessageBoxA
cmp eax, 6
je 0x421037
mov al, 1
mov edx, 2
push eax
lea eax, [ebp - 0x9410]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
call fcn.0040177c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xa13c]
mov edx, 2
call fcn.0040177c
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0xe088]
mov edx, 2
call fcn.0042462c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xe5ec]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
lea eax, [ebp - 0xf458]
xor edx, edx
call fcn.004090d0
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x19e4]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x2710]
mov edx, 2
call fcn.0040177c
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0x665c]
mov edx, 2
call fcn.0042462c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x6bc0]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.004090d0
pop eax
mov edx, dword [esi]
mov dword fs:[0], edx
jmp 0x421b3f
test ebx, ebx
jne 0x421046
lea eax, [ebp - 0xf458]
call fcn.00409460
push 0
push 0
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.00409808
push 0
push 0
lea ecx, [ebp - 0xf49a]
push ecx
push 0x80000000
push 0
push 0
lea ecx, [ebp - 0xfcbc]
lea edx, [ebp - 0xf458]
mov eax, dword [ebp - 0xf48c]
call fcn.0040af00
test al, al
jne 0x4211a3
cmp byte [ebp - 0xf49a], 0
jne 0x4210b2
mov eax, 0x4a6984
mov edx, 9
call fcn.00429794
lea edx, [ebp - 0xfcbc]
mov eax, 0x4a6984
call fcn.00429668
xor eax, eax
mov edx, 2
mov al, byte [ebp - 0xf49a]
cmp eax, 1
sbb eax, eax
neg eax
push eax
lea eax, [ebp - 0x9410]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
call fcn.0040177c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xa13c]
mov edx, 2
call fcn.0040177c
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0xe088]
mov edx, 2
call fcn.0042462c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xe5ec]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
lea eax, [ebp - 0xf458]
xor edx, edx
call fcn.004090d0
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x19e4]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x2710]
mov edx, 2
call fcn.0040177c
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0x665c]
mov edx, 2
call fcn.0042462c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x6bc0]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.004090d0
pop eax
mov edx, dword [esi]
mov dword fs:[0], edx
jmp 0x421b3f
lea eax, [ebp - 0x7a2c]
call fcn.00409ac0
mov dword [ebp - 0xf4a4], eax
mov dword [ebp - 0xf4a0], edx
lea edx, [ebp - 0xfcbc]
mov eax, 0x267
push edx
call fcn.004116e0
push eax
lea edx, [ebp - 0x102bc]
push edx
call fcn.00490628
add esp, 0xc
lea eax, [ebp - 0x102bc]
call fcn.00477974
mov byte [ebp - 0xf4a5], 0
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.004042d4
test al, al
je 0x421330
mov byte [ebp - 0xf4a5], 1
mov cx, word [ebp - 0x3350]
mov word [ebp - 0xad7c], cx
mov ax, word [ebp - 0x334e]
mov word [ebp - 0xad7a], ax
cmp byte [ebp - 0xc2c], 0
je 0x421330
mov eax, 0x272
call fcn.004116e0
push eax
lea edx, [ebp - 0x7a15]
push edx
call fcn.00444878
add esp, 8
mov al, 1
push eax
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x9410]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xa13c]
mov edx, 2
call fcn.0040177c
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0xe088]
mov edx, 2
call fcn.0042462c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xe5ec]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
lea eax, [ebp - 0xf458]
xor edx, edx
call fcn.004090d0
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x19e4]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x2710]
mov edx, 2
call fcn.0040177c
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0x665c]
mov edx, 2
call fcn.0042462c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x6bc0]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.004090d0
pop eax
mov edx, dword [esi]
mov dword fs:[0], edx
jmp 0x421b3f
xor ecx, ecx
lea eax, [ebp - 0xf458]
mov dword [ebp - 0xad70], ecx
mov edx, 0x72
mov word [ebp - 0xad74], cx
and word [ebp - 0xad7c], 0xff9f
xor ecx, ecx
call fcn.00401af8
lea eax, [ebp - 0xf458]
xor ecx, ecx
mov edx, 0x73
call fcn.00401af8
mov eax, dword [ebp - 0xc3c]
mov edx, dword [ebp - 0xc38]
add eax, 0xd
adc edx, 0
push edx
push eax
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.00409808
movzx eax, word [ebp - 0xad7a]
add eax, 0xfffffff3
cdq
push edx
push eax
lea edx, [ebp - 0xf458]
lea eax, [ebp - 0x7a2c]
call fcn.00409b54
push 0
push 0
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.00409808
mov word [esi + 0x10], 0x2c
lea eax, [ebp - 0xf464]
mov edx, 0x10000
call fcn.00401a54
inc dword [esi + 0x1c]
mov word [esi + 0x10], 0x14
mov dword [ebp - 0xf4b0], 0
mov dword [ebp - 0xf4ac], 0
mov dword [ebp - 0xf4b8], 0
mov dword [ebp - 0xf4b4], 0
lea eax, [ebp - 0x7a2c]
mov ecx, dword [ebp - 0xf460]
mov edx, dword [ebp - 0xf464]
call fcn.004096a4
mov eax, dword [ebp - 0xf460]
add eax, 0xfffff000
cdq
add dword [ebp - 0xf4b8], eax
adc dword [ebp - 0xf4b4], edx
mov eax, dword [ebp - 0xf460]
add eax, 0xfffff000
cdq
push edx
push eax
mov eax, dword [ebp - 0xf4b0]
mov edx, dword [ebp - 0xf4ac]
call fcn.00491cb4
mov ebx, eax
xor eax, eax
add ebx, dword [ebp - 0xf464]
xor ecx, ecx
mov word [esi + 0x10], 0x14
mov al, byte [ebx + 2]
xor edx, edx
mov dword [ebp - 0xad68], eax
xor eax, eax
mov cl, byte [ebx + 6]
mov dl, byte [ebx + 5]
shl ecx, 8
add dx, cx
mov word [ebp - 0xad62], dx
xor edx, edx
mov dl, byte [ebx + 0x1b]
mov al, byte [ebx + 0x1a]
shl edx, 8
add ax, dx
mov word [ebp - 0xad4a], ax
cmp dword [ebp - 0xad68], 0x74
jne 0x4218d2
cmp word [ebp - 0xad62], 0x1000
jae 0x4218d2
cmp word [ebp - 0xad4a], 0
jbe 0x4218d2
cmp word [ebp - 0xad4a], 0x400
jae 0x4218d2
xor eax, eax
xor ecx, ecx
mov al, byte [ebx + 1]
mov cl, byte [ebx]
shl eax, 8
xor edx, edx
add cx, ax
xor eax, eax
mov word [ebp - 0xad6c], cx
xor ecx, ecx
mov cl, byte [ebx + 4]
mov dl, byte [ebx + 3]
shl ecx, 8
add dx, cx
xor ecx, ecx
mov word [ebp - 0xad64], dx
xor edx, edx
mov dl, byte [ebx + 8]
mov al, byte [ebx + 7]
shl edx, 8
mov cl, byte [ebx + 9]
add eax, edx
xor edx, edx
mov dl, byte [ebx + 0xa]
shl ecx, 0x10
shl edx, 0x18
add eax, ecx
add eax, edx
xor ecx, ecx
mov dword [ebp - 0xad60], eax
xor eax, eax
mov cl, byte [ebx + 0xc]
mov al, byte [ebx + 0xb]
shl ecx, 8
xor edx, edx
add eax, ecx
mov dl, byte [ebx + 0xd]
xor ecx, ecx
mov cl, byte [ebx + 0xe]
shl edx, 0x10
shl ecx, 0x18
add eax, edx
add eax, ecx
xor edx, edx
mov dword [ebp - 0xad5c], eax
xor ecx, ecx
mov al, byte [ebx + 0xf]
mov byte [ebp - 0xad58], al
xor eax, eax
mov dl, byte [ebx + 0x11]
mov al, byte [ebx + 0x10]
shl edx, 8
mov cl, byte [ebx + 0x12]
add eax, edx
xor edx, edx
mov dl, byte [ebx + 0x13]
shl ecx, 0x10
shl edx, 0x18
add eax, ecx
add eax, edx
xor ecx, ecx
mov dword [ebp - 0xad54], eax
xor eax, eax
mov cl, byte [ebx + 0x15]
mov al, byte [ebx + 0x14]
shl ecx, 8
xor edx, edx
add eax, ecx
mov dl, byte [ebx + 0x16]
xor ecx, ecx
mov cl, byte [ebx + 0x17]
shl edx, 0x10
shl ecx, 0x18
add eax, edx
add eax, ecx
xor ecx, ecx
mov dword [ebp - 0xad50], eax
xor edx, edx
mov al, byte [ebx + 0x18]
mov byte [ebp - 0xad4c], al
mov al, byte [ebx + 0x19]
mov byte [ebp - 0xad4b], al
xor eax, eax
mov cl, byte [ebx + 0x1d]
mov dl, byte [ebx + 0x1c]
shl ecx, 8
mov al, byte [ebx + 0x1e]
add edx, ecx
xor ecx, ecx
mov cl, byte [ebx + 0x1f]
shl eax, 0x10
shl ecx, 0x18
add edx, eax
add edx, ecx
mov dword [ebp - 0xad48], edx
test byte [ebp - 0xad63], 1
je 0x421643
xor eax, eax
xor edx, edx
mov al, byte [ebx + 0x21]
mov dl, byte [ebx + 0x20]
shl eax, 8
xor ecx, ecx
add edx, eax
mov cl, byte [ebx + 0x22]
xor eax, eax
mov al, byte [ebx + 0x23]
shl ecx, 0x10
shl eax, 0x18
add edx, ecx
add edx, eax
xor ecx, ecx
mov dword [ebp - 0xad44], edx
xor edx, edx
mov cl, byte [ebx + 0x25]
mov dl, byte [ebx + 0x24]
shl ecx, 8
xor eax, eax
add edx, ecx
mov al, byte [ebx + 0x26]
xor ecx, ecx
mov cl, byte [ebx + 0x27]
shl eax, 0x10
shl ecx, 0x18
add edx, eax
add edx, ecx
mov dword [ebp - 0xad40], edx
jmp 0x421651
xor edx, edx
mov dword [ebp - 0xad40], edx
mov dword [ebp - 0xad44], edx
mov eax, dword [ebp - 0xad44]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0xad60]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xa078], eax
mov dword [ebp - 0xa074], edx
mov eax, dword [ebp - 0xad40]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0xad5c]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xa070], eax
mov dword [ebp - 0xa06c], edx
movzx ecx, word [ebp - 0xad4a]
push ecx
lea eax, [ebp - 0xf458]
xor edx, edx
call fcn.00421baa
add eax, ebx
push eax
lea ecx, [ebp - 0xad3c]
push ecx
call fcn.0048d568
add esp, 0xc
test byte [ebp - 0xad63], 2
je 0x421723
lea eax, [ebp - 0x102d0]
call fcn.004111e0
lea edx, [ebp - 0xad3c]
push edx
call fcn.0048d788
pop ecx
inc eax
movzx ecx, word [ebp - 0xad4a]
sub ecx, eax
lea edx, [ebp - 0xa93c]
push ecx
lea ecx, [ebp - 0xad3c]
add ecx, eax
push edx
lea edx, [ebp - 0xad3c]
push 0x400
lea eax, [ebp - 0x102d0]
call fcn.0041147c
jmp 0x42172c
mov word [ebp - 0xa93c], 0
test byte [ebp - 0xad63], 4
je 0x42175f
push 8
lea eax, [ebp - 0xf458]
xor edx, edx
call fcn.00421baa
add eax, ebx
movzx ecx, word [ebp - 0xad4a]
add eax, ecx
push eax
lea eax, [ebp - 0xa130]
push eax
call fcn.0048d568
add esp, 0xc
movzx edi, word [ebp - 0xad62]
add edi, 0xfffffffe
mov byte [ebp - 0xf4b9], 0
test edi, edi
jg 0x42177d
mov byte [ebp - 0xf4b9], 1
jmp 0x4217bc
test byte [ebp - 0xad64], 8
je 0x4217a1
lea eax, [ebp - 0xf458]
mov dl, 1
call fcn.00421baa
mov edi, eax
movzx eax, word [ebp - 0xad4a]
add edi, eax
add edi, 0xfffffffe
lea edx, [ebx + 2]
mov ecx, edi
or eax, 0xffffffff
call fcn.0040fe58
not ax
and ax, 0xffff
mov word [ebp - 0x8646], ax
cmp byte [ebp - 0xf4b9], 0
jne 0x4218d2
lea ecx, [ebp - 0xf499]
lea edx, [ebp - 0xf458]
mov eax, dword [ebp - 0xf48c]
call fcn.00421b46
test al, al
je 0x4218d2
movzx eax, word [ebp - 0xad62]
cdq
add eax, dword [ebp - 0xf4b0]
mov bl, 1
adc edx, dword [ebp - 0xf4ac]
push edx
push eax
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.00409808
movzx ecx, word [ebp - 0xad4a]
mov byte [ebp + ecx - 0xad3c], 0
call fcn.0040f348
test bl, bl
je 0x4218d2
cmp word [ebp - 0xa93c], 0
jne 0x421840
lea eax, [ebp - 0xad3c]
mov dl, 1
call fcn.0040bda0
movzx ecx, word [ebp - 0xad64]
and ecx, 0xffffefff
or dword [ebp - 0xf498], ecx
lea eax, [ebp - 0xf458]
mov dl, 1
call fcn.00421baa
add ax, word [ebp - 0xad4a]
mov word [ebp - 0xad62], ax
lea eax, [ebp - 0xad3c]
call fcn.0040e5dc
push eax
mov eax, 0x268
call fcn.004116e0
push eax
lea edx, [ebp - 0x102bc]
push edx
call fcn.00490628
add esp, 0xc
lea eax, [ebp - 0x102bc]
call fcn.00477974
inc dword [ebp - 0xf494]
lea eax, [ebp - 0xf458]
xor ecx, ecx
mov edx, 0x74
call fcn.00401af8
mov eax, dword [ebp - 0xad60]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0xf458]
lea eax, [ebp - 0x7a2c]
call fcn.00409b54
add dword [ebp - 0xf4b0], 1
adc dword [ebp - 0xf4ac], 0
mov eax, dword [ebp - 0xf4a4]
mov edx, dword [ebp - 0xf4a0]
sub eax, 0x20
sbb edx, 0
cmp edx, dword [ebp - 0xf4ac]
jne 0x421907
cmp eax, dword [ebp - 0xf4b0]
ja 0x421909
jmp 0x421987
jle 0x421987
mov eax, dword [ebp - 0xf460]
add eax, 0xfffff000
cdq
push edx
push eax
mov eax, dword [ebp - 0xf4b0]
mov edx, dword [ebp - 0xf4ac]
call fcn.00491cb4
cmp edx, 0
jne 0x421432
cmp eax, 0
jne 0x421432
push dword [ebp - 0xf4b4]
push dword [ebp - 0xf4b8]
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.00409808
lea eax, [ebp - 0x7a2c]
mov ecx, dword [ebp - 0xf460]
mov edx, dword [ebp - 0xf464]
call fcn.004096a4
mov eax, dword [ebp - 0xf460]
add eax, 0xfffff000
cdq
add dword [ebp - 0xf4b8], eax
adc dword [ebp - 0xf4b4], edx
jmp 0x421432
test byte [ebp - 0xf498], 3
je 0x421998
or word [ebp - 0xad7c], 1
cmp dword [ebp - 0xf494], 0
jle 0x4219e9
cmp byte [ebp - 0xf4a5], 0
jne 0x4219e9
mov ecx, dword [ebp - 0xf48c]
cmp byte [ecx + 0x20e0], 0
jne 0x4219e9
push 0x24
mov eax, 0x262
call fcn.004116e0
push eax
mov eax, 0x273
call fcn.004116e0
push eax
push dword [0x4b982c]
call sub.USER32.DLL_MessageBoxA
cmp eax, 6
jne 0x4219e9
or word [ebp - 0xad7c], 8
cmp dword [ebp - 0xf494], 0
jne 0x421a0d
mov eax, 0x274
call fcn.004116e0
push eax
push dword [ebp - 0xf490]
call fcn.00444878
add esp, 8
jmp 0x421a4d
push 0
push 0
lea eax, [ebp - 0xf458]
xor edx, edx
call fcn.00409808
lea eax, [ebp - 0xf458]
xor ecx, ecx
mov edx, 0x72
call fcn.00401af8
lea eax, [ebp - 0xf458]
xor ecx, ecx
mov edx, 0x73
call fcn.00401af8
lea eax, [ebp - 0xf458]
call fcn.004093cc
mov al, 1
mov edx, 2
push eax
lea eax, [ebp - 0xf464]
dec dword [esi + 0x1c]
call fcn.00401acc
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x9410]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xa13c]
mov edx, 2
call fcn.0040177c
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0xe088]
mov edx, 2
call fcn.0042462c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xe5ec]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
lea eax, [ebp - 0xf458]
xor edx, edx
call fcn.004090d0
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x19e4]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x2710]
mov edx, 2
call fcn.0040177c
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0x665c]
mov edx, 2
call fcn.0042462c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x6bc0]
mov edx, 2
call fcn.0040177c
dec dword [esi + 0x1c]
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.004090d0
pop eax
mov edx, dword [esi]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret