Function at 0x10006af4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
mov edx, 0x1f
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x10006afd
mov ebx, dword [esp + 0x90]
and ebx, ebx
jg 0x10006b1c
xor eax, eax
jmp 0x1000703b
push dword [esp + 0x90]
pop eax
mov dword [esp], eax
mov ebx, dword [esp + 0x90]
mov ebp, dword [esp]
add ebx, dword [ebp + 0x3c]
mov dword [esp + 4], ebx
mov word [esp + 0x54], 4
movzx ebx, word [esp + 0x54]
mov eax, 1
cmp ebx, eax
jl 0x10006b5c
movzx ebx, word [esp + 0x54]
dec ebx
push ebx
pop eax
mov word [esp + 0x58], ax
jmp 0x10006b69
movzx ebx, word [esp + 0x54]
inc ebx
push ebx
pop eax
mov word [esp + 0x58], ax
movzx ebx, word [esp + 0x58]
push ebx
mov ebx, 0xf
cmp ebx, dword [esp]
jne 0x10006b83
add esp, 4
jmp 0x1000703b
mov ebx, 7
cmp ebx, dword [esp]
jne 0x10006b9b
movzx eax, word [esp + 0x5c]
push eax
pop eax
mov word [esp + 0x58], ax
jmp 0x10006bb2
mov ebx, 4
cmp ebx, dword [esp]
jne 0x10006bb2
movzx ebx, word [esp + 0x5c]
inc ebx
push ebx
pop eax
mov word [esp + 0x58], ax
pop eax
mov ebx, dword [esp + 0x90]
mov ebp, dword [esp + 4]
add ebx, dword [ebp + 0x78]
mov dword [esp + 0x24], ebx
lea edx, str.village
lea ecx, [esp + 0x5c]
call fcn.10033008
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 4]
add ebx, dword [ebp + 0x7c]
mov dword [esp + 0x28], ebx
lea edx, str.brussels
lea ecx, [esp + 0x60]
call fcn.10033008
mov ebp, dword [esp + 4]
push ebp
pop ebp
lea eax, [ebp + 0x78]
push eax
pop eax
mov dword [esp + 8], eax
mov ebx, dword [esp + 0x90]
mov ebp, dword [esp + 8]
add ebx, dword [ebp]
mov dword [esp + 0xc], ebx
mov ebp, dword [esp + 0xc]
mov ebx, dword [ebp + 0x24]
and ebx, ebx
jle 0x10006c2b
mov ebp, dword [esp + 0xc]
mov ebx, dword [ebp + 0x20]
and ebx, ebx
jle 0x10006c2b
jmp 0x10006c32
mov eax, 1
jmp 0x10006c34
xor eax, eax
and eax, eax
je 0x10006c4e
lea edx, str.around
lea ecx, [esp + 0x64]
call fcn.10033008
xor eax, eax
jmp 0x1000703b
mov ebx, dword [esp + 0x90]
mov ebp, dword [esp + 0xc]
add ebx, dword [ebp + 0x1c]
mov dword [esp + 0x10], ebx
mov word [esp + 0x68], 0xa
movzx ebx, word [esp + 0x68]
mov eax, 5
cmp ebx, eax
jl 0x10006c84
movzx ebx, word [esp + 0x68]
dec ebx
push ebx
pop eax
mov word [esp + 0x6c], ax
jmp 0x10006c91
movzx ebx, word [esp + 0x68]
inc ebx
push ebx
pop eax
mov word [esp + 0x6c], ax
movzx ebx, word [esp + 0x6c]
push ebx
mov ebx, 0x11
cmp ebx, dword [esp]
jne 0x10006cab
add esp, 4
jmp 0x1000703b
mov ebx, 8
cmp ebx, dword [esp]
jne 0x10006cc3
movzx eax, word [esp + 0x70]
push eax
pop eax
mov word [esp + 0x6c], ax
jmp 0x10006cda
mov ebx, 2
cmp ebx, dword [esp]
jne 0x10006cda
movzx ebx, word [esp + 0x70]
inc ebx
push ebx
pop eax
mov word [esp + 0x6c], ax
pop eax
mov ebx, dword [esp + 0x90]
mov ebp, dword [esp + 0xc]
add ebx, dword [ebp + 0x24]
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x90]
mov ebp, dword [esp + 0xc]
add ebx, dword [ebp + 0x20]
mov dword [esp + 0x18], ebx
mov word [esp + 0x70], 8
movzx ebx, word [esp + 0x70]
mov eax, 5
cmp ebx, eax
jl 0x10006d23
movzx ebx, word [esp + 0x70]
dec ebx
push ebx
pop eax
mov word [esp + 0x74], ax
jmp 0x10006d30
movzx ebx, word [esp + 0x70]
inc ebx
push ebx
pop eax
mov word [esp + 0x74], ax
movzx ebx, word [esp + 0x74]
push ebx
mov ebx, 0xd
cmp ebx, dword [esp]
jne 0x10006d4a
add esp, 4
jmp 0x1000703b
mov ebx, 6
cmp ebx, dword [esp]
jne 0x10006d62
movzx eax, word [esp + 0x78]
push eax
pop eax
mov word [esp + 0x74], ax
jmp 0x10006d79
mov ebx, 5
cmp ebx, dword [esp]
jne 0x10006d79
movzx ebx, word [esp + 0x78]
inc ebx
push ebx
pop eax
mov word [esp + 0x74], ax
pop eax
mov ebp, dword [esp + 0xc]
mov ebx, dword [ebp + 0x18]
cmp ebx, 0x1000
jg 0x10006d96
mov ebp, dword [esp + 0xc]
mov ebx, dword [ebp + 0x18]
and ebx, ebx
jle 0x10006d96
jmp 0x10006d9d
mov eax, 1
jmp 0x10006d9f
xor eax, eax
and eax, eax
je 0x10006daa
xor eax, eax
jmp 0x1000703b
mov dword [esp + 0x1c], 0
jmp 0x10006db4
mov ebp, dword [esp + 0xc]
mov ebx, dword [ebp + 0x18]
dec ebx
cmp ebx, dword [esp + 0x1c]
jl 0x1000701c
push dword [0x10046b70]
push dword [0x10046b70]
push 0x18
push 0xffffffff
mov ebx, dword [esp + 0xa0]
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
shl esi, 2
add edi, esi
push edi
pop eax
call fcn.10033190
add ebx, eax
push ebx
call fcn.1003c930
lea eax, [esp + 0x4c]
push eax
call fcn.1003cd80
mov edx, dword [esp + 0x48]
xor ecx, ecx
call fcn.100331d0
jne 0x10007012
push dword [esp + 0x48]
call fcn.100093cb
mov dword [esp + 0x44], eax
mov ebx, dword [esp + 0x94]
cmp ebx, dword [esp + 0x44]
jne 0x10007012
mov ebx, dword [esp + 0x90]
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
add eax, eax
add esi, eax
push esi
pop eax
call fcn.100331b0
mov esi, eax
shl esi, 2
add edi, esi
push edi
pop eax
call fcn.10033190
add ebx, eax
mov dword [esp + 0x20], ebx
push dword [esp + 0x20]
call fcn.1003ca50
push eax
pop eax
mov byte [esp + 0x4c], al
mov ebx, dword [esp + 0x20]
inc ebx
push ebx
call fcn.1003ca50
push eax
pop eax
mov byte [esp + 0x50], al
movzx ebx, byte [esp + 0x4c]
mov eax, 0xcc
cmp ebx, eax
je 0x10006efb
movzx ebx, byte [esp + 0x4c]
mov eax, 0xcd
cmp ebx, eax
jne 0x10006ebb
movzx ebx, byte [esp + 0x50]
mov eax, 3
cmp ebx, eax
jne 0x10006ebb
mov eax, 1
jmp 0x10006ebd
xor eax, eax
and eax, eax
jne 0x10006eec
movzx ebx, byte [esp + 0x4c]
mov eax, 0xf
cmp ebx, eax
jne 0x10006ee4
movzx ebx, byte [esp + 0x50]
mov eax, 0xb
cmp ebx, eax
jne 0x10006ee4
mov eax, 1
jmp 0x10006ee6
xor eax, eax
and eax, eax
jne 0x10006eec
jmp 0x10006ef3
mov eax, 1
jmp 0x10006ef5
xor eax, eax
and eax, eax
jne 0x10006efb
jmp 0x10006f02
mov eax, 1
jmp 0x10006f04
xor eax, eax
and eax, eax
je 0x10006f15
mov dword [esp + 0x20], 0
jmp 0x1000701c
mov ebx, dword [esp + 0x20]
cmp ebx, dword [esp + 0x24]
jl 0x10006f30
mov ebx, dword [esp + 0x20]
cmp ebx, dword [esp + 0x28]
jg 0x10006f30
mov eax, 1
jmp 0x10006f32
xor eax, eax
and eax, eax
je 0x10007010
push dword [0x10046b70]
push dword [0x10046b70]
push 0x18
push 0xffffffff
push dword [esp + 0x30]
call fcn.1003c930
lea eax, [esp + 0x34]
push eax
call fcn.1003cd80
mov dword [esp + 0x20], 0
push dword [esp + 0x30]
call fcn.1000c3a1
mov dword [esp + 0x34], eax
mov ebx, dword [esp + 0x34]
and ebx, ebx
jle 0x10007010
push dword [0x10046b70]
push dword [0x10046b70]
push dword [esp + 0x3c]
push 0
push dword [esp + 0x40]
call fcn.10033830
lea eax, [esp + 0x40]
push eax
call fcn.1003cd80
push dword [0x10046b70]
push dword [0x10046b70]
mov ebx, dword [esp + 0x3c]
add ebx, 2
push ebx
push dword [esp + 0x3c]
call fcn.100338c0
lea eax, [esp + 0x3c]
push eax
call fcn.1003cd80
lea edx, [0x1003f028]
lea ecx, [esp + 0x30]
call fcn.10033008
push dword [esp + 0x3c]
call fcn.10008ee3
mov dword [esp + 0x40], eax
mov ebx, dword [esp + 0x40]
and ebx, ebx
jle 0x10007010
push dword [esp + 0x38]
call fcn.100093cb
push eax
push dword [esp + 0x44]
call fcn.10006af4
mov dword [esp + 0x20], eax
jmp 0x1000701c
jmp 0x1000701c
inc dword [esp + 0x1c]
jno 0x10006db4
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x20]
jmp 0x1000703b
push dword [esp + 0x60]
call fcn.1003ccf0
push dword [esp + 0x78]
call fcn.1003ccf0
push dword [esp + 0x3c]
call fcn.1003ccf0
push dword [esp + 0x38]
call fcn.1003ccf0
push dword [esp + 0x5c]
call fcn.1003ccf0
push dword [esp + 0x30]
call fcn.1003ccf0
push dword [esp + 0x48]
call fcn.1003ccf0
push dword [esp + 0x64]
call fcn.1003ccf0
add esp, 0x7c
pop esi
pop edi
pop ebx
pop ebp
ret 8