Function at 0x426400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x478747
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb8
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov ebp, ecx
mov dword [esp + 0xc0], 0x47d174
mov word [esp + 0xc4], 0xffff
mov word [esp + 0xc6], bx
mov dword [esp + 0xd0], ebx
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 6
push 0x48b6dc
call fcn.00447db0
mov ecx, dword [0x4987f0]
call fcn.004580d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 6
push 0x48b6d4
call fcn.00447db0
mov ecx, dword [0x4987f0]
call fcn.00458310
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 6
push 0x48b6cc
call fcn.00447db0
mov ecx, dword [0x4987f0]
call fcn.00458310
mov ecx, dword [0x4987f0]
lea eax, [esp + 0xc0]
push eax
call fcn.00458450
cmp ax, 0xffff
je 0x42723f
movsx eax, word [esp + 0xc4]
sub eax, ebx
je 0x426fee
dec eax
jne 0x426447
mov dword [esp + 0x8c], 0x47d174
mov word [esp + 0x90], 0xffff
mov word [esp + 0x92], bx
mov byte [esp + 0xd0], 8
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 6
push 0x48b6c4
call fcn.00447db0
mov ecx, dword [0x4987f0]
call fcn.004580d0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 6
push 0x48b6bc
call fcn.00447db0
mov ecx, dword [0x4987f0]
call fcn.00458310
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 6
push 0x48b6b4
call fcn.00447db0
mov ecx, dword [0x4987f0]
call fcn.00458310
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 6
push 0x48b6ac
call fcn.00447db0
mov ecx, dword [0x4987f0]
call fcn.00458310
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 6
push 0x48b6a4
call fcn.00447db0
mov ecx, dword [0x4987f0]
call fcn.00458310
lea ecx, [esp + 0x8c]
push ecx
mov ecx, dword [0x4987f0]
call fcn.00458450
cmp ax, 0xffff
je 0x426fd7
movsx eax, word [esp + 0x90]
cmp eax, ebx
jl 0x4264fa
cmp eax, 2
jle 0x426abc
cmp eax, 3
jne 0x4264fa
push 6
push 0x48b6a4
lea ecx, [esp + 0x84]
call fcn.00447db0
mov dl, byte [esp + 0x13]
mov dword [esp + 0x64], ebx
mov byte [esp + 0x60], dl
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov al, byte [esp + 0x13]
mov dword [esp + 0x44], ebx
mov byte [esp + 0x40], al
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
push 6
push 0x48b69c
lea ecx, [esp + 0x80]
mov byte [esp + 0xd8], 0x17
call fcn.00447db0
push 9
push 0x48b690
lea ecx, [esp + 0x2c]
mov byte [esp + 0xd8], 0x18
call fcn.00447db0
lea ecx, [esp + 0x24]
mov byte [esp + 0xd0], 0x19
push ecx
mov ecx, ebp
call fcn.004376d0
push ebx
lea ecx, [esp + 0x30]
call fcn.00447d40
push ecx
mov byte [esp + 0xd4], 0x1a
mov ecx, esp
mov dword [esp + 0x18], esp
push ebx
call fcn.00447d40
lea edx, [esp + 0x30]
lea eax, [esp + 0x28]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0xe0], 0x1b
call fcn.00447d20
mov ecx, ebp
mov byte [esp + 0xdc], 0x1a
call fcn.00423cb0
cmp al, bl
je 0x4269b4
lea ecx, [esp + 0x2c]
call fcn.004481a0
cmp ax, 0x3b
jne 0x4269b4
mov byte [esp + 0x13], bl
movzx cx, byte [esp + 0x13]
add ecx, 6
push ecx
lea ecx, [esp + 0x30]
call fcn.00448000
cmp al, 0xff
mov al, byte [esp + 0x13]
jne 0x4266e3
inc al
cmp al, 0x32
mov byte [esp + 0x13], al
jb 0x4266bc
jmp 0x4266eb
cmp al, 0x32
jb 0x4267f3
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x48a2b0
call fcn.00447db0
push ecx
mov byte [esp + 0xe0], 0x1d
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x48b688
call fcn.00447db0
mov ecx, 0x4987f0
mov byte [esp + 0xe0], 0x1a
call fcn.00449ba0
lea ecx, [esp + 0x2c]
mov byte [esp + 0xd0], 0x19
call fcn.00447e50
lea ecx, [esp + 0x24]
mov byte [esp + 0xd0], 0x18
call fcn.00447e50
lea ecx, [esp + 0x78]
mov byte [esp + 0xd0], 0x17
call fcn.00447e50
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
cmp eax, ecx
mov byte [esp + 0xd0], 0x16
mov edi, ecx
mov esi, eax
je 0x42678b
mov ecx, esi
call fcn.00447e50
add esi, 4
cmp esi, edi
jne 0x426779
mov eax, dword [esp + 0x44]
push eax
call fcn.00469f00
mov eax, dword [esp + 0x6c]
mov esi, dword [esp + 0x68]
add esp, 4
cmp esi, eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov byte [esp + 0xd0], 0x15
mov edi, eax
je 0x4267c8
mov ecx, esi
call fcn.00447e50
add esi, 4
cmp esi, edi
jne 0x4267b6
mov esi, dword [esp + 0x64]
push esi
call fcn.00469f00
add esp, 4
lea ecx, [esp + 0x7c]
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov byte [esp + 0xd0], 8
call fcn.00447e50
jmp 0x4264fa
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x48a2b0
call fcn.00447db0
push ecx
mov byte [esp + 0xe0], 0x1e
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x48b680
call fcn.00447db0
mov ecx, 0x4987f0
mov byte [esp + 0xe0], 0x1a
call fcn.00449ba0
mov byte [esp + 0x84], bl
mov edx, dword [esp + 0x84]
lea ecx, [esp + 0x78]
push edx
push 5
call fcn.00448120
mov ecx, dword [esp + 0x68]
lea eax, [esp + 0x78]
push eax
push 1
push ecx
lea ecx, [esp + 0x6c]
call fcn.004054d0
mov eax, dword [esp + 0x48]
lea edx, [esp + 0x24]
push edx
push 1
push eax
lea ecx, [esp + 0x4c]
call fcn.004054d0
mov al, byte [esp + 0x84]
inc al
cmp al, 0x33
mov byte [esp + 0x84], al
jbe 0x42683d
push 0x429610
lea edx, [esp + 0x44]
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.00429690
sub esp, 0x10
lea eax, [esp + 0x84]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
mov byte [esp + 0xf8], 0x1f
call fcn.00429690
push ecx
lea edx, [esp + 0xa4]
mov ecx, esp
mov dword [esp + 0x44], esp
push edx
mov byte [esp + 0xfc], 0x20
call fcn.00447d20
mov ecx, ebp
mov byte [esp + 0xf8], 0x1a
call fcn.00425ac0
lea ecx, [esp + 0x2c]
mov byte [esp + 0xd0], 0x19
call fcn.00447e50
lea ecx, [esp + 0x24]
mov byte [esp + 0xd0], 0x18
call fcn.00447e50
lea ecx, [esp + 0x78]
mov byte [esp + 0xd0], 0x17
call fcn.00447e50
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
cmp eax, ecx
mov byte [esp + 0xd0], 0x16
mov edi, ecx
mov esi, eax
je 0x42694c
mov ecx, esi
call fcn.00447e50
add esi, 4
cmp esi, edi
jne 0x42693a
mov eax, dword [esp + 0x44]
push eax
call fcn.00469f00
mov eax, dword [esp + 0x6c]
mov esi, dword [esp + 0x68]
add esp, 4
cmp esi, eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov byte [esp + 0xd0], 0x15
mov edi, eax
je 0x426989
mov ecx, esi
call fcn.00447e50
add esi, 4
cmp esi, edi
jne 0x426977
mov esi, dword [esp + 0x64]
push esi
call fcn.00469f00
add esp, 4
lea ecx, [esp + 0x7c]
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov byte [esp + 0xd0], 8
call fcn.00447e50
jmp 0x4264fa
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x48a3a8
call fcn.00447db0
push ecx
mov byte [esp + 0xe0], 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x48a640
call fcn.00447db0
mov ecx, 0x4987f0
mov byte [esp + 0xe0], 0x1a
call fcn.00449ba0
lea ecx, [esp + 0x2c]
mov byte [esp + 0xd0], 0x19
call fcn.00447e50
lea ecx, [esp + 0x24]
mov byte [esp + 0xd0], 0x18
call fcn.00447e50
lea ecx, [esp + 0x78]
mov byte [esp + 0xd0], 0x17
call fcn.00447e50
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
cmp eax, ecx
mov byte [esp + 0xd0], 0x16
mov edi, ecx
mov esi, eax
je 0x426a54
mov ecx, esi
call fcn.00447e50
add esi, 4
cmp esi, edi
jne 0x426a42
mov eax, dword [esp + 0x44]
push eax
call fcn.00469f00
mov eax, dword [esp + 0x6c]
mov esi, dword [esp + 0x68]
add esp, 4
cmp esi, eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov byte [esp + 0xd0], 0x15
mov edi, eax
je 0x426a91
mov ecx, esi
call fcn.00447e50
add esi, 4
cmp esi, edi
jne 0x426a7f
mov esi, dword [esp + 0x64]
push esi
call fcn.00469f00
add esp, 4
lea ecx, [esp + 0x7c]
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov byte [esp + 0xd0], 8
call fcn.00447e50
jmp 0x4264fa
push 6
push 0x48b6bc
lea ecx, [esp + 0x78]
call fcn.00447db0
mov al, byte [esp + 0x90]
lea ecx, [esp + 0x70]
inc al
mov byte [esp + 0xd0], 9
push eax
push 5
call fcn.00448120
mov cl, byte [esp + 0x13]
mov dword [esp + 0x34], ebx
mov byte [esp + 0x30], cl
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dl, byte [esp + 0x13]
mov dword [esp + 0x54], ebx
mov byte [esp + 0x50], dl
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
push 6
push 0x48b678
lea ecx, [esp + 0x7c]
mov byte [esp + 0xd8], 0xb
call fcn.00447db0
push 9
push 0x48b66c
lea ecx, [esp + 0x28]
mov byte [esp + 0xd8], 0xc
call fcn.00447db0
movsx ecx, word [esp + 0x90]
mov al, 1
mov byte [esp + 0xd0], 0xd
shl al, cl
lea ecx, [esp + 0x20]
add al, 0x80
push eax
push 7
call fcn.00448120
lea ecx, [esp + 0x20]
push ecx
mov ecx, ebp
call fcn.004376d0
push ebx
lea ecx, [esp + 0x2c]
call fcn.00447d40
push ecx
mov byte [esp + 0xd4], 0xe
mov ecx, esp
mov dword [esp + 0x20], esp
push ebx
call fcn.00447d40
lea edx, [esp + 0x2c]
lea eax, [esp + 0x24]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0xe0], 0xf
call fcn.00447d20
mov ecx, ebp
mov byte [esp + 0xdc], 0xe
call fcn.00423cb0
cmp al, bl
je 0x426ecf
lea ecx, [esp + 0x28]
call fcn.004481a0
cmp ax, 0x14
jne 0x426ecf
mov byte [esp + 0x13], bl
movzx cx, byte [esp + 0x13]
add ecx, 6
push ecx
lea ecx, [esp + 0x2c]
call fcn.00448000
cmp al, 0xff
mov al, byte [esp + 0x13]
jne 0x426c01
inc al
cmp al, 0xb
mov byte [esp + 0x13], al
jb 0x426bda
jmp 0x426c09
cmp al, 0xb
jb 0x426d11
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x48a2b0
call fcn.00447db0
push ecx
mov byte [esp + 0xe0], 0x11
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x48b688
call fcn.00447db0
mov ecx, 0x4987f0
mov byte [esp + 0xe0], 0xe
call fcn.00449ba0
lea ecx, [esp + 0x28]
mov byte [esp + 0xd0], 0xd
call fcn.00447e50
lea ecx, [esp + 0x20]
mov byte [esp + 0xd0], 0xc
call fcn.00447e50
lea ecx, [esp + 0x74]
mov byte [esp + 0xd0], 0xb
call fcn.00447e50
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
cmp eax, ecx
mov byte [esp + 0xd0], 0xa
mov edi, ecx
mov esi, eax
je 0x426ca9
mov ecx, esi
call fcn.00447e50
add esi, 4
cmp esi, edi
jne 0x426c97
mov eax, dword [esp + 0x54]
push eax
call fcn.00469f00
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x38]
add esp, 4
cmp esi, eax
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov byte [esp + 0xd0], 9
mov edi, eax
je 0x426ce6
mov ecx, esi
call fcn.00447e50
add esi, 4
cmp esi, edi
jne 0x426cd4
mov esi, dword [esp + 0x34]
push esi
call fcn.00469f00
add esp, 4
lea ecx, [esp + 0x70]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov byte [esp + 0xd0], 8
call fcn.00447e50
jmp 0x4264fa
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x48a2b0
call fcn.00447db0
push ecx
mov byte [esp + 0xe0], 0x12
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x48b680
call fcn.00447db0
mov ecx, 0x4987f0
mov byte [esp + 0xe0], 0xe
call fcn.00449ba0
mov byte [esp + 0x98], bl
mov edx, dword [esp + 0x98]
lea ecx, [esp + 0x74]
push edx
push 5
call fcn.00448120
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x74]
push eax
push 1
push ecx
lea ecx, [esp + 0x3c]
call fcn.004054d0
mov eax, dword [esp + 0x58]
lea edx, [esp + 0x20]
push edx
push 1
push eax
lea ecx, [esp + 0x5c]
call fcn.004054d0
mov al, byte [esp + 0x98]
inc al
cmp al, 0x24
mov byte [esp + 0x98], al
jbe 0x426d5b
push 0x427bc0
lea edx, [esp + 0x54]
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.00429690
sub esp, 0x10
lea eax, [esp + 0x54]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
mov byte [esp + 0xf8], 0x13
call fcn.00429690
push ecx
lea edx, [esp + 0x98]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
mov byte [esp + 0xfc], 0x14
call fcn.00447d20
mov ecx, ebp
mov byte [esp + 0xf8], 0xe
call fcn.00425ac0
lea ecx, [esp + 0x28]
mov byte [esp + 0xd0], 0xd
call fcn.00447e50
lea ecx, [esp + 0x20]
mov byte [esp + 0xd0], 0xc
call fcn.00447e50
lea ecx, [esp + 0x74]
mov byte [esp + 0xd0], 0xb
call fcn.00447e50
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
cmp eax, ecx
mov byte [esp + 0xd0], 0xa
mov edi, ecx
mov esi, eax
je 0x426e67
mov ecx, esi
call fcn.00447e50
add esi, 4
cmp esi, edi
jne 0x426e55
mov eax, dword [esp + 0x54]
push eax
call fcn.00469f00
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x38]
add esp, 4
cmp esi, eax
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov byte [esp + 0xd0], 9
mov edi, eax
je 0x426ea4
mov ecx, esi
call fcn.00447e50
add esi, 4
cmp esi, edi
jne 0x426e92
mov esi, dword [esp + 0x34]
push esi
call fcn.00469f00
add esp, 4
lea ecx, [esp + 0x70]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov byte [esp + 0xd0], 8
call fcn.00447e50
jmp 0x4264fa
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x48a3a8
call fcn.00447db0
push ecx
mov byte [esp + 0xe0], 0x10
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x48a640
call fcn.00447db0
mov ecx, 0x4987f0
mov byte [esp + 0xe0], 0xe
call fcn.00449ba0
lea ecx, [esp + 0x28]
mov byte [esp + 0xd0], 0xd
call fcn.00447e50
lea ecx, [esp + 0x20]
mov byte [esp + 0xd0], 0xc
call fcn.00447e50
lea ecx, [esp + 0x74]
mov byte [esp + 0xd0], 0xb
call fcn.00447e50
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
cmp eax, ecx
mov byte [esp + 0xd0], 0xa
mov edi, ecx
mov esi, eax
je 0x426f6f
mov ecx, esi
call fcn.00447e50
add esi, 4
cmp esi, edi
jne 0x426f5d
mov eax, dword [esp + 0x54]
push eax
call fcn.00469f00
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x38]
add esp, 4
cmp esi, eax
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov byte [esp + 0xd0], 9
mov edi, eax
je 0x426fac
mov ecx, esi
call fcn.00447e50
add esi, 4
cmp esi, edi
jne 0x426f9a
mov esi, dword [esp + 0x34]
push esi
call fcn.00469f00
add esp, 4
lea ecx, [esp + 0x70]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov byte [esp + 0xd0], 8
call fcn.00447e50
jmp 0x4264fa
mov byte [esp + 0xd0], bl
mov dword [esp + 0x8c], 0x47d174
jmp 0x426447
push 6
push 0x48b6d4
lea ecx, [esp + 0xc4]
call fcn.00447db0
mov al, byte [esp + 0x13]
mov dword [esp + 0xa0], ebx
mov byte [esp + 0x9c], al
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
mov cl, byte [esp + 0x13]
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xac], cl
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
push 6
push 0x48b664
lea ecx, [esp + 0x90]
mov byte [esp + 0xd8], 3
call fcn.00447db0
push 7
push 0x48b65c
lea ecx, [esp + 0x88]
mov byte [esp + 0xd8], 4
call fcn.00447db0
lea edx, [esp + 0x80]
mov ecx, ebp
push edx
mov byte [esp + 0xd4], 5
call fcn.004376d0
mov byte [esp + 0x94], bl
mov eax, dword [esp + 0x94]
lea ecx, [esp + 0x88]
push eax
push 5
call fcn.00448120
mov edx, dword [esp + 0xa4]
lea ecx, [esp + 0x88]
push ecx
push 1
push edx
lea ecx, [esp + 0xa8]
call fcn.004054d0
mov ecx, dword [esp + 0xb4]
lea eax, [esp + 0x80]
push eax
push 1
push ecx
lea ecx, [esp + 0xb8]
call fcn.004054d0
mov al, byte [esp + 0x94]
inc al
cmp al, 0xb
mov byte [esp + 0x94], al
jbe 0x427095
push 0x427260
lea edx, [esp + 0xb0]
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.00429690
sub esp, 0x10
lea eax, [esp + 0xc0]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
mov byte [esp + 0xf8], 6
call fcn.00429690
push ecx
lea edx, [esp + 0xe4]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
mov byte [esp + 0xfc], 7
call fcn.00447d20
mov ecx, ebp
mov byte [esp + 0xf8], 5
call fcn.00425ac0
lea ecx, [esp + 0x80]
mov byte [esp + 0xd0], 4
call fcn.00447e50
lea ecx, [esp + 0x88]
mov byte [esp + 0xd0], 3
call fcn.00447e50
mov ecx, dword [esp + 0xb4]
mov eax, dword [esp + 0xb0]
cmp eax, ecx
mov byte [esp + 0xd0], 2
mov edi, ecx
mov esi, eax
je 0x4271ba
mov ecx, esi
call fcn.00447e50
add esi, 4
cmp esi, edi
jne 0x4271a5
mov eax, dword [esp + 0xb0]
push eax
call fcn.00469f00
mov eax, dword [esp + 0xa8]
mov esi, dword [esp + 0xa4]
add esp, 4
cmp esi, eax
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
mov byte [esp + 0xd0], 1
mov edi, eax
je 0x427209
mov ecx, esi
call fcn.00447e50
add esi, 4
cmp esi, edi
jne 0x4271f4
mov esi, dword [esp + 0xa0]
push esi
call fcn.00469f00
add esp, 4
lea ecx, [esp + 0xbc]
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
mov byte [esp + 0xd0], bl
call fcn.00447e50
jmp 0x426447
mov ecx, dword [esp + 0xc8]
pop edi
pop esi
pop ebp
xor ax, ax
mov dword fs:[0], ecx
pop ebx
add esp, 0xc4
ret