Function at 0x426772
Capabilities:
Query or enumerate registry value

Disassembly:
enter 0x570, 2
push ebx
push ecx
push edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
movzx eax, byte [0x4e8cf7]
cmp ax, 0x54
jne 0x4269f7
push 0x4ccb6c
push 0x12
push 3
push 0x3f
push 0x16
push 0x4e
push 0
push 0
call fcn.0040cd00
mov edi, dword [0x4e91ad]
mov dword [ebp - 0x158], edi
push 1
push 0x12
push 3
sub esp, 8
mov esi, 0x4ccb72
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 8
mov esi, 0x4ccb78
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x4e90ad
lea edi, [ebp - 0x258]
call fcn.00401b30
mov esi, 0x4ccb7e
call fcn.00401af0
mov eax, edi
push eax
push 0x4ccb8c
push 0x11
mov eax, dword [ebp - 0x158]
call fcn.00420272
push 2
push 0x16
push 3
sub esp, 8
mov esi, 0x4ccb92
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 8
mov esi, 0x4ccb98
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x4e90ad
lea edi, [ebp - 0x258]
call fcn.00401b30
mov esi, 0x4ccb9e
call fcn.00401af0
mov eax, edi
push eax
push 0x4ccbad
push 0x12
mov eax, dword [ebp - 0x158]
call fcn.00420272
push 1
push 0x13
push 5
push dword [0x4ccbb5]
push 4
push 0x4ccbb9
mov eax, dword [ebp - 0x158]
call fcn.004206d2
push 2
push 0x13
push 0xa
push dword [0x4ccbc0]
push 4
push 0x4ccbc4
mov eax, dword [ebp - 0x158]
call fcn.004206d2
push 3
push 0x23
push 0xa
push dword [0x4ccbcf]
push 4
push 0x4ccbd3
mov eax, dword [ebp - 0x158]
call fcn.004206d2
push 4
push 0x13
push 0xf
push dword [0x4ccbdd]
push 3
push 0x4ccbe1
mov eax, dword [ebp - 0x158]
call fcn.004206d2
push 5
push 0x23
push 0xf
push dword [0x4ccbef]
push 3
push 0x4ccbf3
mov eax, dword [ebp - 0x158]
call fcn.004206d2
push 6
push 0x13
push 0x13
push dword [0x4ccbff]
push 3
push 0x4ccc03
mov eax, dword [ebp - 0x158]
call fcn.004206d2
push 1
push 0x14
push 6
push 0x29
push 3
push 1
mov eax, dword [ebp - 0x158]
call fcn.00429132
push 2
push 0x24
push 0xb
push 0x19
push 3
push 1
mov eax, dword [ebp - 0x158]
call fcn.00429132
push 1
push 0x14
push 0xb
push 0x4ccc17
push 0
mov eax, dword [ebp - 0x158]
call fcn.00428ef2
push 2
push 0x14
push 0xc
push 0x4ccc24
push 0
mov eax, dword [ebp - 0x158]
call fcn.00428ef2
push 3
push 0x14
push 0xd
push 0x4ccc30
push 0
mov eax, dword [ebp - 0x158]
call fcn.00428ef2
push 4
push 0x14
push 0x10
push 0x4ccc39
push 0
mov eax, dword [ebp - 0x158]
call fcn.00428ef2
push 5
push 0x14
push 0x11
push 0x4ccc3f
push 0
mov eax, dword [ebp - 0x158]
call fcn.00428ef2
push 0x2a
push 0x10
push 0x4ccc45
call fcn.00408840
push 0x24
push 0x11
push 0x4ccc53
call fcn.00408840
push 0x15
push 0x14
push 0x4ccc67
call fcn.00408840
push 0x2b
push 0x14
push 0x4ccc74
call fcn.00408840
push 0x2b
push 0x15
push 0x4ccc81
call fcn.00408840
jmp 0x426c63
cmp ax, 0x45
jne 0x426c63
push 0x4ccc8e
push 0x12
push 3
push 0x3f
push 0x16
push 0x4e
push 0
push 0
call fcn.0040cd00
mov edi, dword [0x4e91ad]
mov dword [ebp - 0x15c], edi
push 1
push 0x12
push 3
sub esp, 8
mov esi, 0x4ccc94
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 8
mov esi, 0x4ccc9a
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x4e90ad
lea edi, [ebp - 0x25c]
call fcn.00401b30
mov esi, 0x4ccca0
call fcn.00401af0
mov eax, edi
push eax
push 0x4cccae
push 0x11
mov eax, dword [ebp - 0x15c]
call fcn.00420272
push 2
push 0x16
push 3
sub esp, 8
mov esi, 0x4cccb4
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 8
mov esi, 0x4cccba
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x4e90ad
lea edi, [ebp - 0x25c]
call fcn.00401b30
mov esi, 0x4cccc0
call fcn.00401af0
mov eax, edi
push eax
push 0x4ccccf
push 0x12
mov eax, dword [ebp - 0x15c]
call fcn.00420272
push 1
push 0x13
push 5
push dword [0x4cccd8]
push 4
push 0x4cccdc
mov eax, dword [ebp - 0x15c]
call fcn.004206d2
push 2
push 0x13
push 0xa
push dword [0x4ccce4]
push 4
push 0x4ccce8
mov eax, dword [ebp - 0x15c]
call fcn.004206d2
push 3
push 0x24
push 0xa
push dword [0x4ccced]
push 4
push 0x4cccf1
mov eax, dword [ebp - 0x15c]
call fcn.004206d2
push 4
push 0x13
push 0xf
push dword [0x4cccfb]
push 3
push 0x4cccff
mov eax, dword [ebp - 0x15c]
call fcn.004206d2
push 5
push 0x24
push 0xf
push dword [0x4ccd0f]
push 3
push 0x4ccd13
mov eax, dword [ebp - 0x15c]
call fcn.004206d2
push 6
push 0x13
push 0x13
push dword [0x4ccd1f]
push 3
push 0x4ccd23
mov eax, dword [ebp - 0x15c]
call fcn.004206d2
push 1
push 0x14
push 6
push 0x29
push 3
push 1
mov eax, dword [ebp - 0x15c]
call fcn.00429132
push 2
push 0x25
push 0xb
push 0x18
push 3
push 1
mov eax, dword [ebp - 0x15c]
call fcn.00429132
push 1
push 0x14
push 0xb
push 0x4ccd34
push 0
mov eax, dword [ebp - 0x15c]
call fcn.00428ef2
push 2
push 0x14
push 0xc
push 0x4ccd3e
push 0
mov eax, dword [ebp - 0x15c]
call fcn.00428ef2
push 3
push 0x14
push 0xd
push 0x4ccd4c
push 0
mov eax, dword [ebp - 0x15c]
call fcn.00428ef2
push 4
push 0x14
push 0x10
push 0x4ccd56
push 0
mov eax, dword [ebp - 0x15c]
call fcn.00428ef2
push 5
push 0x14
push 0x11
push 0x4ccd5f
push 0
mov eax, dword [ebp - 0x15c]
call fcn.00428ef2
push 0x2c
push 0x10
push 0x4ccd69
call fcn.00408840
push 0x24
push 0x11
push 0x4ccd76
call fcn.00408840
push 0x15
push 0x14
push 0x4ccd8c
call fcn.00408840
push 0x2e
push 0x14
push 0x4ccd99
call fcn.00408840
push 0x2f
push 0x15
push 0x4ccda4
call fcn.00408840
mov eax, dword [0x4e91ad]
mov dword [ebp - 0x160], eax
call fcn.0041cea2
push 1
push 0x22
push 0x14
push 2
push 1
call fcn.0041fea0
push 2
push 0x38
push 0x14
push 5
push 1
call fcn.0041fea0
push 3
push 0x38
push 0x15
push 5
push 1
call fcn.0041fea0
mov eax, dword [ebp - 0x160]
call fcn.0040b6d2
push 0x38
push 0x10
push 3
call fcn.00408970
push 0x38
push 0x11
push 5
call fcn.00408970
mov eax, dword [ebp - 0x160]
call fcn.004092f2
mov eax, dword [ebp - 4]
call fcn.00428e22
mov eax, dword [ebp - 4]
call fcn.00428d32
mov byte [ebp - 0x13c], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xbe], 0
jbe 0x427c25
push 2
push 0xffffffffffffffff
push 1
push 0x4ccdae
mov eax, dword [0x4e91ad]
call fcn.00428c62
mov byte [ebp - 0x134], al
push 2
push 0xffffffffffffffff
push 2
push 0x4ccdc5
mov eax, dword [0x4e91ad]
call fcn.00428c62
mov byte [ebp - 0x133], al
push 2
push 0xffffffffffffffff
push 3
push 0x4ccddc
mov eax, dword [0x4e91ad]
call fcn.00428c62
mov byte [ebp - 0x132], al
movzx eax, byte [0x4e8cf7]
cmp ax, 0x54
jne 0x426d6e
push 2
push 0xffffffffffffffff
push 4
push 0x4ccde3
mov eax, dword [0x4e91ad]
call fcn.00428c62
mov byte [ebp - 0x131], al
jmp 0x426d8f
cmp ax, 0x45
jne 0x426d8f
push 2
push 0xffffffffffffffff
push 4
push 0x4ccdf6
mov eax, dword [0x4e91ad]
call fcn.00428c62
mov byte [ebp - 0x131], al
push 2
mov eax, dword [ebp - 4]
movsx eax, word [eax + 0x98]
movzx eax, byte [ebp + eax - 0x135]
push eax
mov eax, dword [0x4e91ad]
call fcn.00428c12
mov edi, dword [ebp - 4]
mov word [edi + 0x9a], 0
mov eax, 0
mov dword [ebp - 0x124], eax
lea ebx, [ebp - 0x20]
push ebx
push 1
push 0
push 0x4cce0e
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
lea eax, [ebp - 0x124]
push eax
push 0
push 0
push 0
push 0x4cce43
push dword [ebp - 0x20]
call sub.advapi32.dll_RegQueryValueExA
lea ebx, [ebp - 0x1c]
push ebx
mov eax, dword [ebp - 0x124]
inc eax
push eax
call fcn.00403b50
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x1c]
push 0
push 0
push 0x4cce4a
push dword [ebp - 0x20]
call sub.advapi32.dll_RegQueryValueExA
cmp dword [ebp - 0x124], 0
jle 0x426e4e
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x1c]
call fcn.00403b00
lea edi, [ebp - 0x120]
lea esi, [ebp - 0x260]
call fcn.00401940
jmp 0x426e5e
lea edi, [ebp - 0x120]
mov esi, 0x4cce51
call fcn.00401940
push 0x4cce52
lea eax, [ebp - 0x120]
push eax
call fcn.0040cca0
mov word [ebp - 0x148], ax
cmp ax, 1
jle 0x426eac
lea ebx, [ebp - 0x260]
push ebx
lea eax, [ebp - 0x120]
push eax
push 1
movsx ecx, word [ebp - 0x148]
dec ecx
push ecx
call fcn.00401cd0
lea edi, [ebp - 0x120]
lea esi, [ebp - 0x260]
call fcn.00401940
lea eax, [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 0x124]
inc ebx
push ebx
call fcn.00403320
push dword [ebp - 0x20]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 4]
movsx ebx, word [eax + 0xbe]
test ebx, ebx
jle 0x426fbd
mov word [ebp - 0x164], bx
mov word [ebp - 0x148], 0
inc word [ebp - 0x148]
movsx eax, word [ebp - 0x148]
imul ebx, eax, 0x54
mov edi, dword [ebp - 4]
mov esi, dword [edi]
lea ebx, [esi + ebx - 0x54]
mov dword [ebp - 0x168], ebx
push 1
push 0xffffffffffffffff
movsx eax, word [ebp - 0x148]
push eax
mov esi, dword [ebp - 0x168]
push dword [esi + 4]
mov eax, dword [0x4e91ad]
call fcn.00428c62
mov word [ebp - 0x14c], ax
lea ebx, [ebp - 0x268]
push ebx
lea eax, [ebp - 0x120]
push eax
call fcn.0041b610
lea ecx, [ebp - 0x368]
push ecx
lea eax, [ebp - 0x468]
push eax
mov edi, dword [ebp - 0x168]
push dword [edi + 4]
call fcn.00403b00
lea ebx, [ebp - 0x468]
push ebx
call fcn.0041b610
lea esi, [ebp - 0x368]
lea edi, [ebp - 0x268]
call fcn.00415790
test al, al
jne 0x426f8b
cmp word [ebp - 0x148], 1
jne 0x426fb0
mov eax, dword [ebp - 4]
mov bx, word [ebp - 0x148]
mov word [eax + 0x9a], bx
push 1
mov bx, word [ebp - 0x14c]
push ebx
mov eax, dword [0x4e91ad]
call fcn.00428c12
dec word [ebp - 0x164]
jne 0x426ee8
mov eax, dword [ebp - 4]
call fcn.00427c72
mov byte [ebp - 0x13c], al
test al, al
je 0x427c1b
cmp word [0x4e8869], 0
jne 0x426fee
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x78]
mov bx, word [eax + 0x2c]
mov word [0x4e8869], bx
mov al, byte [0x4e8864]
test al, al
je 0x427000
mov byte [ebp - 0x140], 1
jmp 0x42701a
mov bl, byte [0x4e8865]
test bl, bl
je 0x427013
mov byte [ebp - 0x140], 2
jmp 0x42701a
mov byte [ebp - 0x140], 3
cmp word [0x4e8869], 2
jne 0x427036
cmp byte [ebp - 0x140], 3
je 0x427036
mov byte [ebp - 0x144], 5
jmp 0x427046
mov byte [ebp - 0x144], 4
mov word [0x4e8869], 1
mov al, byte [ebp - 0x140]
push eax
push 1
mov eax, dword [0x4e91ad]
call fcn.00428672
mov al, byte [ebp - 0x144]
push eax
push 1
mov eax, dword [0x4e91ad]
call fcn.00428672
mov edi, dword [ebp - 4]
mov word [edi + 0x9c], 1
mov word [edi + 0x9e], 1
mov word [edi + 0xa0], 1
mov ax, word [edi + 0x9a]
mov word [ebp - 0x14c], ax
movsx eax, word [ebp + 0xc]
movsx ebx, word [edi + 0xa6]
add ebx, eax
movsx ecx, word [edi + 0xa8]
add ebx, ecx
mov word [edi + 0xb6], bx
cmp bx, 0x3c
jge 0x4270c4
mov word [edi + 0xb6], 0x3c
mov eax, dword [ebp - 4]
mov edi, eax
mov bx, word [eax + 0xb6]
mov word [edi + 0xac], bx
mov bx, word [eax + 0xa0]
mov word [ebp - 0x154], bx
push 1
mov eax, dword [0x4e91ad]
call fcn.00428ba2
mov word [ebp - 0x150], 1
push 0x22
push 0x14
mov eax, dword [ebp - 4]
fild word [eax + 0x9c]
sub esp, 8
fstp qword [esp]
wait
push 2
push 0
call fcn.0041fe50
push 0x38
push 0x14
mov eax, dword [ebp - 4]
fild word [eax + 0x9e]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041fe50
push 0x38
push 0x15
mov eax, dword [ebp - 4]
fild word [eax + 0xa0]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041fe50
cmp word [ebp + 0xc], 0x84
jle 0x4271a5
cmp byte [ebp - 0x140], 3
jae 0x4271a5
mov eax, dword [0x4e91ad]
mov dword [ebp - 0x46c], eax
mov bl, byte [ebp - 0x144]
push ebx
push 0
mov eax, dword [ebp - 0x46c]
call fcn.00428672
mov byte [ebp - 0x144], 5
mov al, byte [ebp - 0x144]
push eax
push 1
mov eax, dword [ebp - 0x46c]
call fcn.00428672
mov word [0x4e8869], 2
lea eax, [ebp - 0x140]
push eax
lea ebx, [ebp - 0x144]
push ebx
mov eax, dword [ebp - 4]
call fcn.004284a2
mov al, byte [ebp - 0x144]
push eax
mov eax, dword [ebp - 4]
call fcn.00428a82
mov al, byte [ebp - 0x140]
push eax
lea ebx, [ebp - 0x154]
push ebx
push dword [ebp + 0x14]
mov cx, word [ebp + 0x10]
push ecx
mov eax, dword [ebp - 4]
call fcn.00427e52
mov edi, dword [ebp - 4]
mov ax, word [edi + 0xa0]
cmp word [ebp - 0x154], ax
je 0x427223
mov bx, word [ebp - 0x154]
mov word [edi + 0xa0], bx
push 0x38
push 0x15
fild word [edi + 0xa0]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041fe50
mov eax, dword [0x4e91ad]
mov dword [ebp - 0x470], eax
push 1
mov bl, byte [0x4e8864]
push ebx
mov eax, dword [ebp - 0x470]
call fcn.004286f2
push 2
mov al, byte [0x4e8865]
push eax
mov eax, dword [ebp - 0x470]
call fcn.004286f2
push 3
mov al, byte [0x4e8863]
push eax
mov eax, dword [ebp - 0x470]
call fcn.004286f2
push 4
cmp byte [ebp - 0x140], 3
setb al
push eax
mov eax, dword [ebp - 0x470]
call fcn.004286f2
push 5
cmp byte [ebp - 0x140], 3
setb al
push eax
mov eax, dword [ebp - 0x470]
call fcn.004286f2
push 2
cmp byte [ebp - 0x140], 3
sete al
push eax
mov eax, dword [ebp - 0x470]
call fcn.00428612
mov byte [ebp - 0x138], 1
movsx eax, word [ebp - 0x150]
cmp eax, 1
jne 0x4272d5
push 0x22
push 0x14
push 2
call fcn.0041df70
mov byte [ebp - 0x18], al
jmp 0x4272fa
cmp eax, 3
je 0x4272e3
cmp eax, 2
jne 0x4272fa
push 0x38
movsx ebx, ax
mov ecx, 0x12
add ecx, ebx
push ecx
push 5
call fcn.0041df70
mov byte [ebp - 0x18], al
mov al, byte [ebp - 0x18]
cmp al, 0x12
jne 0x4273ab
mov eax, dword [ebp - 4]
call fcn.00428b32
mov eax, dword [ebp - 4]
call fcn.00421e32
mov eax, dword [ebp - 4]
call fcn.00427c72
mov byte [ebp - 0x13c], al
test al, al
je 0x4273a6
mov edi, dword [ebp - 4]
mov ax, word [edi + 0x9a]
mov word [ebp - 0x14c], ax
lea eax, [ebp - 0x140]
push eax
lea ebx, [ebp - 0x144]
push ebx
mov eax, edi
call fcn.004284a2
mov al, byte [ebp - 0x140]
push eax
lea ebx, [ebp - 0x154]
push ebx
push dword [ebp + 0x14]
mov cx, word [ebp + 0x10]
push ecx
mov eax, dword [ebp - 4]
call fcn.00427e52
mov edi, dword [ebp - 4]
mov ax, word [edi + 0xa0]
cmp word [ebp - 0x154], ax
je 0x4273a6
mov bx, word [ebp - 0x154]
mov word [edi + 0xa0], bx
push 0x38
push 0x15
fild word [edi + 0xa0]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041fe50
jmp 0x427a92
cmp al, 0x21
jne 0x42764b
movsx ebx, word [0x4e91bd]
mov eax, ebx
cmp eax, 3
jg 0x427512
cmp eax, 1
jl 0x427512
movsx eax, word [0x4e91bd]
movzx ebx, byte [ebp - 0x140]
test ebx, ebx
jl 0x4273e6
cmp eax, ebx
je 0x42750d
mov eax, dword [0x4e91ad]
mov dword [ebp - 0x474], eax
mov bl, byte [ebp - 0x140]
push ebx
push 0
mov eax, dword [ebp - 0x474]
call fcn.00428672
mov cl, byte [0x4e91bd]
mov byte [ebp - 0x140], cl
mov al, byte [ebp - 0x140]
push eax
push 1
mov eax, dword [ebp - 0x474]
call fcn.00428672
push 4
cmp byte [ebp - 0x140], 3
setb al
push eax
mov eax, dword [ebp - 0x474]
call fcn.004286f2
push 5
cmp byte [ebp - 0x140], 3
setb al
push eax
mov eax, dword [ebp - 0x474]
call fcn.004286f2
mov al, byte [ebp - 0x140]
push eax
lea ebx, [ebp - 0x154]
push ebx
push dword [ebp + 0x14]
mov cx, word [ebp + 0x10]
push ecx
mov eax, dword [ebp - 4]
call fcn.00427e52
push 2
cmp byte [ebp - 0x140], 3
sete al
push eax
mov eax, dword [ebp - 0x474]
call fcn.00428612
cmp byte [ebp - 0x140], 3
jne 0x4274d2
cmp byte [ebp - 0x144], 4
jbe 0x4274d2
mov al, byte [ebp - 0x144]
push eax
push 0
mov eax, dword [ebp - 0x474]
call fcn.00428672
mov byte [ebp - 0x144], 4
mov al, byte [ebp - 0x144]
push eax
push 1
mov eax, dword [ebp - 0x474]
call fcn.00428672
mov eax, dword [ebp - 4]
mov bx, word [eax + 0xa0]
cmp word [ebp - 0x154], bx
je 0x42750d
mov cx, word [ebp - 0x154]
mov word [eax + 0xa0], cx
push 0x38
push 0x15
fild word [eax + 0xa0]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041fe50
jmp 0x427646
cmp eax, 5
je 0x427524
cmp eax, 4
jne 0x427646
movsx eax, word [0x4e91bd]
movzx ebx, byte [ebp - 0x144]
test ebx, ebx
jl 0x427538
cmp eax, ebx
je 0x427646
mov eax, dword [0x4e91ad]
mov dword [ebp - 0x478], eax
mov bl, byte [ebp - 0x144]
push ebx
push 0
mov eax, dword [ebp - 0x478]
call fcn.00428672
mov cl, byte [0x4e91bd]
mov byte [ebp - 0x144], cl
mov al, byte [ebp - 0x144]
push eax
push 1
mov eax, dword [ebp - 0x478]
call fcn.00428672
cmp byte [ebp - 0x144], 4
jne 0x427591
mov word [0x4e8869], 1
jmp 0x42759a
mov word [0x4e8869], 2
mov eax, dword [ebp - 4]
call fcn.00421e32
mov eax, dword [ebp - 4]
call fcn.00427c72
mov byte [ebp - 0x13c], al
test al, al
je 0x427646
mov edi, dword [ebp - 4]
mov ax, word [edi + 0x9a]
mov word [ebp - 0x14c], ax
lea eax, [ebp - 0x140]
push eax
lea ebx, [ebp - 0x144]
push ebx
mov eax, edi
call fcn.004284a2
mov al, byte [ebp - 0x144]
push eax
mov eax, dword [ebp - 4]
call fcn.00428a82
mov al, byte [ebp - 0x140]
push eax
lea ebx, [ebp - 0x154]
push ebx
push dword [ebp + 0x14]
mov cx, word [ebp + 0x10]
push ecx
mov eax, dword [ebp - 4]
call fcn.00427e52
mov edi, dword [ebp - 4]
mov ax, word [edi + 0xa0]
cmp word [ebp - 0x154], ax
je 0x427646
mov bx, word [ebp - 0x154]
mov word [edi + 0xa0], bx
push 0x38
push 0x15
fild word [edi + 0xa0]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041fe50
jmp 0x427a92
cmp al, 0x22
jne 0x42791a
cmp word [0x4e91c1], 1
jne 0x427889
push 1
mov eax, dword [0x4e91ad]
call fcn.00427dd2
mov edi, dword [ebp - 4]
mov word [edi + 0x9a], ax
movsx ebx, ax
push 0
mov al, byte [edi + 0xbe]
push eax
push 1
push 1
push 0x4cce54
lea edi, [ebp - 0x498]
call fcn.00401403
lea esi, [ebp - 0x498]
mov eax, ebx
push 0xff0000
call fcn.0040148e
mov byte [ebp - 0x138], al
test al, al
je 0x4276cf
mov edi, dword [ebp - 4]
mov ax, word [ebp - 0x14c]
cmp word [edi + 0x9a], ax
setne bl
mov byte [ebp - 0x138], bl
jmp 0x427705
movzx ebx, byte [0x4e8cf7]
mov ax, bx
cmp ax, 0x54
jne 0x4276f0
push 0x4cce74
push 0x4cce8c
call fcn.00414260
jmp 0x427705
cmp ax, 0x45
jne 0x427705
push 0x4cce8d
push 0x4cce9e
call fcn.00414260
mov al, byte [ebp - 0x138]
test al, al
je 0x427884
mov eax, dword [ebp - 4]
call fcn.00421e32
mov eax, dword [ebp - 4]
call fcn.00427c72
mov byte [ebp - 0x13c], al
test al, al
je 0x427884
mov bl, byte [ebp - 0x140]
push ebx
push 0
mov eax, dword [0x4e91ad]
call fcn.00428672
mov al, byte [ebp - 0x144]
push eax
push 0
mov eax, dword [0x4e91ad]
call fcn.00428672
mov edi, dword [ebp - 4]
mov ax, word [ebp - 0x14c]
cmp word [edi + 0x9a], ax
je 0x427778
mov esi, dword [edi + 0x78]
mov bx, word [esi + 0x2c]
mov word [0x4e8869], bx
mov al, byte [0x4e8864]
test al, al
je 0x42778a
mov byte [ebp - 0x140], 1
jmp 0x4277a4
mov bl, byte [0x4e8865]
test bl, bl
je 0x42779d
mov byte [ebp - 0x140], 2
jmp 0x4277a4
mov byte [ebp - 0x140], 3
cmp word [0x4e8869], 2
jne 0x4277c0
cmp byte [ebp - 0x140], 3
je 0x4277c0
mov byte [ebp - 0x144], 5
jmp 0x4277d0
mov byte [ebp - 0x144], 4
mov word [0x4e8869], 1
mov al, byte [ebp - 0x140]
push eax
push 1
mov eax, dword [0x4e91ad]
call fcn.00428672
mov al, byte [ebp - 0x144]
push eax
push 1
mov eax, dword [0x4e91ad]
call fcn.00428672
mov edi, dword [ebp - 4]
mov ax, word [edi + 0x9a]
mov word [ebp - 0x14c], ax
lea eax, [ebp - 0x140]
push eax
lea ebx, [ebp - 0x144]
push ebx
mov eax, edi
call fcn.004284a2
mov al, byte [ebp - 0x144]
push eax
mov eax, dword [ebp - 4]
call fcn.00428a82
mov al, byte [ebp - 0x140]
push eax
lea ebx, [ebp - 0x154]
push ebx
push dword [ebp + 0x14]
mov cx, word [ebp + 0x10]
push ecx
mov eax, dword [ebp - 4]
call fcn.00427e52
mov edi, dword [ebp - 4]
mov ax, word [edi + 0xa0]
cmp word [ebp - 0x154], ax
je 0x427884
mov bx, word [ebp - 0x154]
mov word [edi + 0xa0], bx
push 0x38
push 0x15
fild word [edi + 0xa0]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041fe50
jmp 0x427915
push 2
mov eax, dword [0x4e91ad]
call fcn.00427dd2
mov edi, dword [ebp - 4]
mov word [edi + 0x98], ax
mov eax, edi
call fcn.00428752
lea ebx, [ebp - 0x140]
push ebx
lea eax, [ebp - 0x144]
push eax
mov eax, dword [ebp - 4]
call fcn.004284a2
mov al, byte [ebp - 0x140]
push eax
lea ebx, [ebp - 0x154]
push ebx
push dword [ebp + 0x14]
mov cx, word [ebp + 0x10]
push ecx
mov eax, dword [ebp - 4]
call fcn.00427e52
mov edi, dword [ebp - 4]
mov ax, word [edi + 0xa0]
cmp word [ebp - 0x154], ax
je 0x427915
mov bx, word [ebp - 0x154]
mov word [edi + 0xa0], bx
push 0x38
push 0x15
fild word [edi + 0xa0]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041fe50
jmp 0x427a92
cmp al, 0x2b
je 0x427a92
movsx ebx, word [ebp - 0x150]
mov eax, ebx
cmp eax, 1
jne 0x42796c
lea eax, [ebp - 0x578]
push eax
push 0x22
push 0x14
push 2
call fcn.0041b1e0
lea ebx, [ebp - 0x578]
push ebx
call fcn.0041a6b0
mov edi, dword [ebp - 4]
mov word [edi + 0x9c], ax
cmp ax, 0
setg bl
mov byte [ebp - 0x138], bl
jmp 0x427a23
cmp eax, 2
jne 0x4279c7
lea eax, [ebp - 0x578]
push eax
push 0x38
push 0x14
push 5
call fcn.0041b1e0
lea ebx, [ebp - 0x578]
push ebx
call fcn.0041a6b0
mov edi, dword [ebp - 4]
mov word [edi + 0x9e], ax
cmp ax, 0
jle 0x4279ba
mov esi, edi
mov ax, word [edi + 0x9e]
cmp word [esi + 0xa0], ax
jl 0x4279ba
mov ebx, 1
jmp 0x4279bf
mov ebx, 0
mov byte [ebp - 0x138], bl
jmp 0x427a23
cmp eax, 3
jne 0x427a23
lea eax, [ebp - 0x578]
push eax
push 0x38
push 0x15
push 5
call fcn.0041b1e0
lea ebx, [ebp - 0x578]
push ebx
call fcn.0041a6b0
mov edi, dword [ebp - 4]
mov word [edi + 0xa0], ax
cmp word [ebp - 0x154], ax
jl 0x427a18
mov esi, edi
mov ax, word [edi + 0x9e]
cmp word [esi + 0xa0], ax
jl 0x427a18
mov ebx, 1
jmp 0x427a1d
mov ebx, 0
mov byte [ebp - 0x138], bl
mov al, byte [ebp - 0x138]
test al, al
je 0x427a92
cmp byte [ebp - 0x18], 0x11
jne 0x427a7e
test al, al
je 0x427a71
mov edi, dword [ebp - 4]
cmp word [edi + 0x9e], 0
jle 0x427a71
cmp word [edi + 0xa0], 0
jle 0x427a71
mov esi, edi
mov bx, word [edi + 0x9e]
cmp word [esi + 0xa0], bx
jl 0x427a71
cmp word [esi + 0x9c], 0
jle 0x427a71
mov ecx, 1
jmp 0x427a76
mov ecx, 0
mov byte [ebp - 0x138], cl
jmp 0x427a92
lea ebx, [ebp - 0x150]
push ebx
mov cl, byte [ebp - 0x18]
push ecx
push 1
push 3
call fcn.0041b2c0
mov al, byte [ebp - 0x138]
test al, al
je 0x427ab3
mov esi, 0x4cce9f
movzx eax, byte [ebp - 0x18]
push 0x1f0010
call fcn.0040148e
test al, al
jne 0x427ac1
mov al, byte [ebp - 0x13c]
test al, al
jne 0x427223
mov al, byte [ebp - 0x13c]
test al, al
je 0x427c0a
cmp byte [ebp - 0x18], 0x2b
je 0x427c0a
push 1
mov eax, dword [0x4e91ad]
call fcn.00427dd2
mov edi, dword [ebp - 4]
mov word [edi + 0x9a], ax
mov bx, word [ebp - 0x14c]
cmp word [edi + 0x9a], bx
sete al
mov byte [ebp - 0x13c], al
test al, al
jne 0x427b2b
mov eax, edi
call fcn.00421e32
mov eax, dword [ebp - 4]
call fcn.00427c72
mov byte [ebp - 0x13c], al
test al, al
jne 0x427b2b
mov eax, dword [ebp - 4]
call fcn.00421da2
mov al, byte [ebp - 0x13c]
test al, al
je 0x427c08
mov edi, dword [ebp - 4]
mov esi, edi
mov bx, word [edi + 0xc9]
mov word [esi + 0xa2], bx
mov eax, esi
mov bx, word [esi + 0xcb]
mov word [eax + 0xa4], bx
movzx ebx, byte [ebp - 0x140]
mov eax, ebx
cmp eax, 1
jne 0x427b74
mov eax, dword [ebp + 8]
mov byte [eax], 0x47
jmp 0x427b90
cmp eax, 2
jne 0x427b83
mov eax, dword [ebp + 8]
mov byte [eax], 0x48
jmp 0x427b90
cmp eax, 3
jne 0x427b90
mov eax, dword [ebp + 8]
mov byte [eax], 0x43
lea eax, [ebp - 0x578]
push eax
push 0x22
push 0x14
push 2
call fcn.0041b1e0
lea ebx, [ebp - 0x578]
push ebx
call fcn.0041a6b0
mov edi, dword [ebp - 4]
mov word [edi + 0x9c], ax
lea ebx, [ebp - 0x578]
push ebx
push 0x38
push 0x14
push 5
call fcn.0041b1e0
lea eax, [ebp - 0x578]
push eax
call fcn.0041a6b0
mov edi, dword [ebp - 4]
mov word [edi + 0x9e], ax
lea ebx, [ebp - 0x578]
push ebx
push 0x38
push 0x15
push 5
call fcn.0041b1e0
lea eax, [ebp - 0x578]
push eax
call fcn.0041a6b0
mov edi, dword [ebp - 4]
mov word [edi + 0xa0], ax
jmp 0x427c19
mov byte [ebp - 0x13c], 0
mov eax, dword [ebp - 4]
call fcn.00421da2
jmp 0x427c23
mov eax, dword [ebp - 4]
call fcn.00421da2
jmp 0x427c5b
movzx ebx, byte [0x4e8cf7]
mov ax, bx
cmp ax, 0x54
jne 0x427c46
push 0x4ccea3
push 0x4cceb7
call fcn.00414260
jmp 0x427c5b
cmp ax, 0x45
jne 0x427c5b
push 0x4ccec7
push 0x4cceda
call fcn.00414260
mov al, byte [ebp - 0x13c]
pop edx
pop ecx
pop ebx
leave
ret 0x10