Function at 0xa6fb04
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0xc6c965
call fcn.00be12c8
sub esp, 0xa0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, edi
call fcn.00406d64
movzx eax, al
cmp eax, 0x1d
ja case.default.0xa6fb2f
jmp dword [eax*4 + 0xa71306]
push 0xc00614a4
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
xor ebx, ebx
push ebx
call fcn.00438069
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.004d29c2
lea eax, [ebp - 0x60]
push 0x846
push eax
mov byte [ebp - 4], 1
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
push ebx
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004173e3
push eax
call fcn.00438119
mov ecx, eax
call fcn.0043f559
mov eax, dword [ebp - 0x60]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0xa6fba3
add eax, 0xfffffff4
push eax
call fcn.004033fd
pop ecx
lea eax, [ebp - 0xac]
push 0x1843
push eax
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
mov eax, dword [eax]
push 0x64
push eax
mov dword [ebp - 4], 4
call fcn.00adee8c
mov eax, dword [ebp - 0xac]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
pop ecx
pop ecx
je 0xa6fbe6
add eax, 0xfffffff4
push eax
call fcn.004033fd
pop ecx
push ebx
mov ecx, esi
call fcn.00a7cd84
jmp case.default.0xa6fb2f
mov ecx, edi
call fcn.00406d9a
mov ebx, eax
mov ecx, edi
mov dword [ebp - 0x10], ebx
call fcn.00406d64
mov byte [ebp - 0x25], al
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
test eax, eax
je 0xa6fc1d
mov al, byte [ebp - 0x25]
mov byte [esi + 0x372c], al
mov ecx, edi
call fcn.00406d64
cmp ebx, 0x2179564
movzx eax, al
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], ebx
jne 0xa6fc3e
mov dword [ebp - 0x10], 0x217994c
jmp 0xa6fc80
cmp ebx, 0x2179562
jne 0xa6fc4f
mov dword [ebp - 0x10], 0x217994a
jmp 0xa6fc80
cmp ebx, 0x217e385
jne 0xa6fc60
mov dword [ebp - 0x10], 0x217e76d
jmp 0xa6fc80
cmp ebx, 0x2160ec1
jne 0xa6fc71
mov dword [ebp - 0x10], 0x21612a9
jmp 0xa6fc80
cmp ebx, 0x217bc77
jne 0xa6fc80
mov dword [ebp - 0x10], 0x217c05f
push dword [ebp - 0x10]
mov ecx, dword [0xd7c424]
call fcn.00824297
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x20], eax
je case.default.0xa6fb2f
push dword [ebp - 0x18]
mov ecx, eax
call fcn.0082fc6a
test eax, eax
je 0xa6fdc2
lea eax, [ebp - 0x70]
push eax
mov ecx, esi
call fcn.004d29c2
mov eax, dword [eax]
mov ecx, eax
add eax, 0xfffffff4
neg ecx
sbb ecx, ecx
and ecx, eax
xor eax, eax
cmp dword [ecx + 0x1a0], ebx
lea ecx, [ebp - 0x70]
setne al
mov dword [ebp - 0x14], eax
call fcn.004185f1
cmp dword [ebp - 0x14], ebx
je 0xa6fd20
call fcn.00be246d
mov ecx, dword [ebp - 0x20]
push eax
push dword [ebp - 0x18]
call fcn.0082fc04
cmp dword [ebp - 0x10], 0x423d0d
mov dword [esi + 0x470], eax
jne 0xa6fd0c
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x20]
mov dword [esi + 0x470], eax
mov eax, dword [esi + 0x88]
push ebx
lea ecx, [esi + 0x88]
push 0x64
push 6
call dword [eax + 0x14]
cmp dword [esi + 0x29f8], ebx
je 0xa6fdc2
call fcn.00be246d
mov ecx, dword [ebp - 0x20]
push eax
push dword [ebp - 0x18]
call fcn.0082fc04
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
push ecx
call fcn.004cd0ae
pop ecx
pop ecx
call fcn.004cd1b7
cmp eax, ebx
pop ecx
mov dword [ebp - 0x14], eax
jl 0xa6fd5e
cmp eax, 0x1d
jl 0xa6fd61
mov dword [ebp - 0x14], ebx
mov eax, dword [esi + 0x29f8]
push dword [eax + 0x94]
mov edi, dword [esi + 0x46c]
add eax, 0x8c
push eax
call fcn.00419768
pop ecx
xor edi, eax
pop ecx
mov ecx, dword [esi + 0x29f8]
and edi, 1
push ebx
xor edi, eax
push edi
call fcn.0053f93d
mov edi, dword [esi + 0x29f8]
mov ecx, dword [ebp - 0x14]
lea edx, [edi + 0x98]
call fcn.004197b6
mov ecx, edi
mov dword [edi + 0xa0], eax
mov dword [edi + 0xac], 6
call fcn.0053f014
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
cmp eax, 0x142446
jne 0xa6fdf1
mov ecx, edi
call fcn.00406d64
test al, al
je 0xa6fde3
mov ecx, esi
call fcn.00a7eb98
jmp case.default.0xa6fb2f
push 0xe
mov ecx, esi
call fcn.00a7ad1f
jmp case.default.0xa6fb2f
cmp eax, 0x1522280
jne 0xa6fe35
mov ecx, edi
call fcn.00406d64
test al, al
mov esi, dword [esi + 0x29f8]
je 0xa6fe1f
cmp esi, ebx
je case.default.0xa6fb2f
push 1
mov ecx, esi
call fcn.005410cb
jmp case.default.0xa6fb2f
cmp esi, ebx
je case.default.0xa6fb2f
push 1
mov ecx, esi
call fcn.00541301
jmp case.default.0xa6fb2f
cmp eax, 0x423d0d
jne 0xa6fee3
mov ecx, edi
call fcn.00406d64
movzx eax, al
mov ecx, edi
mov dword [ebp - 0x14], eax
call fcn.00406d9a
lea edi, [esi + 0x88]
mov ecx, edi
mov dword [ebp - 0x10], eax
call fcn.0045c270
xor ecx, ecx
cmp eax, 0xffffffff
setg cl
mov eax, 0x1e0
imul ecx, ecx, 0x904
mov edi, dword [ecx + edi + 0x3f4]
cmp edi, eax
jg 0xa6fe84
mov edi, eax
mov eax, dword [esi]
push ecx
mov edx, esp
mov dword [ebp - 0x1c], esp
push ebx
mov ecx, esi
mov dword [ebp + 8], edx
call dword [eax + 4]
mov ecx, dword [ebp - 0x20]
push eax
push dword [ebp - 0x18]
mov eax, dword [ebp + 8]
push eax
call fcn.0062bd5c
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0x16a0]
call fcn.0042d202
mov ecx, eax
call fcn.0044a38b
push eax
push dword [ebp - 0x14]
mov ecx, esi
push dword [ebp - 0x10]
call fcn.00885c47
push eax
call fcn.00adc3e4
add eax, edi
push eax
call fcn.00438119
mov ecx, eax
call fcn.0044c12e
jmp case.default.0xa6fb2f
cmp eax, 0x1f914cd
jne 0xa6fef6
mov ecx, esi
call fcn.00a7df95
jmp case.default.0xa6fb2f
cmp eax, 0x1f914ce
jne 0xa6ff09
mov ecx, esi
call fcn.00a7e18b
jmp case.default.0xa6fb2f
cmp eax, 0x217994c
jne 0xa6ff35
cmp dword [ebp - 0x24], 0x2179564
push dword [ebp - 0x18]
mov ecx, esi
push dword [ebp - 0x20]
jne 0xa6ff2b
call fcn.00a75365
jmp case.default.0xa6fb2f
call fcn.00a75084
jmp case.default.0xa6fb2f
cmp eax, 0x217994a
jne 0xa6ff45
cmp dword [ebp - 0x24], 0x2179562
jmp 0xa6ff53
cmp eax, 0x217e76d
jne 0xa6ff71
cmp dword [ebp - 0x24], 0x217e385
push dword [ebp - 0x18]
mov ecx, esi
push dword [ebp - 0x20]
jne 0xa6ff67
call fcn.00a7529f
jmp case.default.0xa6fb2f
call fcn.00a75180
jmp case.default.0xa6fb2f
cmp eax, 0x21612a9
jne 0xa6ff81
cmp dword [ebp - 0x24], 0x2160ec1
jmp 0xa6ff8f
cmp eax, 0x217c05f
jne 0xa6ffa7
cmp dword [ebp - 0x24], 0x217bc77
jne case.default.0xa6fb2f
push dword [ebp - 0x18]
mov ecx, esi
push dword [ebp - 0x20]
call fcn.00a75302
jmp case.default.0xa6fb2f
cmp eax, 0x1f962ee
jne 0xa700cc
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x78], ebx
je 0xa6ffbf
mov al, byte [ebp - 0x18]
jmp 0xa6ffc6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x20]
push eax
lea eax, [ebp + 8]
push eax
call fcn.004375f8
push ebx
push ebx
push 3
push 0x7fffffff
mov edi, 0x3e8
push edi
push ecx
lea eax, [esi + 0x16a0]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 4], 6
call fcn.0041733b
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.004d29c2
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 6
call fcn.0045c586
push eax
lea ecx, [ebp + 8]
call fcn.0040b649
push eax
call fcn.00438119
mov ecx, eax
call fcn.00444901
push ebx
push ebx
push 3
push 0x7fffffff
push edi
push ecx
lea eax, [esi + 0x16a0]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0041733b
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, esi
mov byte [ebp - 4], 9
call fcn.004d29c2
push 0xd3c338
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xa
call fcn.00589984
mov edi, eax
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 0xc
call fcn.0045c586
push eax
mov ecx, edi
call fcn.0040b649
push eax
call fcn.00438119
mov ecx, eax
call fcn.00444901
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 6
call fcn.00402dc1
call fcn.00adc3e4
add eax, 0x5a0
jne 0xa700b6
push 1
pop eax
push ebx
push eax
mov ecx, esi
call fcn.00a7e3d9
lea ecx, [ebp + 8]
call fcn.00402dc1
jmp case.default.0xa6fb2f
cmp eax, 0x111ae9
je 0xa70108
cmp eax, 0x12a189
je 0xa70108
cmp eax, 0x142829
je 0xa70108
cdq
mov ecx, 0x989680
idiv ecx
cmp eax, 9
je 0xa70108
push 0x7fffffff
push ebx
push 6
push dword [ebp - 0x18]
mov ecx, esi
push dword [ebp - 0x20]
call fcn.00a6b57d
jmp case.default.0xa6fb2f
mov ecx, edi
call fcn.00406d64
movzx eax, al
push 0x7fffffff
push eax
jmp 0xa700f4
mov ecx, edi
call fcn.00406d9a
mov ecx, edi
mov ebx, eax
call fcn.00406d64
mov ecx, dword [0xd7c424]
push ebx
movzx edi, al
call fcn.00824297
test eax, eax
je case.default.0xa6fb2f
push edi
push eax
mov ecx, esi
call fcn.00a6e102
jmp case.default.0xa6fb2f
mov ecx, edi
call fcn.00406d9a
mov ecx, dword [0xd7c424]
mov ebx, eax
push ebx
call fcn.00824297
cmp ebx, 0x423d0b
mov dword [ebp + 8], eax
jne 0xa701bd
mov ecx, edi
call fcn.00406d9a
mov ecx, edi
mov dword [ebp - 0x10], eax
call fcn.00406d9a
mov ecx, edi
mov dword [ebp - 0x14], eax
call fcn.00406d9a
mov ecx, edi
mov dword [ebp - 0x18], eax
call fcn.00406d9a
xor ebx, ebx
cmp dword [ebp + 8], ebx
je case.default.0xa6fb2f
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push ebx
push 0x320
push dword [ebp + 8]
mov ecx, esi
call fcn.00a6e6a7
jmp case.default.0xa6fb2f
xor ebx, ebx
cmp dword [ebp + 8], ebx
je case.default.0xa6fb2f
push ebx
push ebx
push ebx
push ebx
push 0x3e8
jmp 0xa701ae
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov ecx, edi
mov dword [ebp - 4], 0xd
call fcn.00406d64
movzx eax, al
cmp eax, ebx
jle 0xa703a3
mov dword [ebp - 0x18], eax
mov ecx, edi
call fcn.00406d9a
mov ecx, edi
mov dword [ebp - 0x14], eax
call fcn.00406d9a
push dword [ebp - 0x14]
mov ecx, dword [0xd7c420]
mov esi, eax
lea eax, [ebp + 8]
push eax
call fcn.00677f9a
push dword [ebp - 0x14]
mov ecx, dword [0xd7c420]
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 0xe
call fcn.006783c2
mov eax, dword [ebp + 8]
cmp eax, ebx
mov byte [ebp - 4], 0xf
je 0xa7036e
cmp byte [eax], bl
je 0xa7036e
cmp esi, 1
jle 0xa7028c
lea eax, [ebp - 0x90]
push 0xf7
push eax
call fcn.00877d11
mov ecx, eax
call fcn.00406bc6
mov eax, dword [eax]
push esi
push dword [ebp + 8]
mov byte [ebp - 4], 0x10
push dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0044e655
mov eax, dword [ebp - 0x90]
add esp, 0x14
mov byte [ebp - 4], 0xf
jmp 0xa70335
jne 0xa702c5
lea eax, [ebp - 0x40]
push 0xf8
push eax
call fcn.00877d11
mov ecx, eax
call fcn.00406bc6
push dword [ebp + 8]
mov eax, dword [eax]
push dword [ebp - 0x24]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0044e655
mov eax, dword [ebp - 0x40]
add esp, 0x10
mov byte [ebp - 4], 0xf
jmp 0xa70335
cmp esi, 0xffffffff
jne 0xa702fe
lea eax, [ebp - 0x78]
push 0xfa
push eax
call fcn.00877d11
mov ecx, eax
call fcn.00406bc6
push dword [ebp + 8]
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 0x12
call fcn.0044e655
mov eax, dword [ebp - 0x78]
add esp, 0xc
mov byte [ebp - 4], 0xf
jmp 0xa70335
jge 0xa7036e
lea eax, [ebp - 0x48]
push 0xf9
push eax
call fcn.00877d11
mov ecx, eax
call fcn.00406bc6
mov eax, dword [eax]
neg esi
push esi
push dword [ebp + 8]
mov byte [ebp - 4], 0x13
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0044e655
mov eax, dword [ebp - 0x48]
add esp, 0x10
mov byte [ebp - 4], 0xf
cmp eax, ebx
je 0xa70343
add eax, 0xfffffff4
push eax
call fcn.0042db7e
pop ecx
lea eax, [ebp - 0x10]
push 6
push eax
call fcn.004a6f59
mov eax, dword [ebp - 0x24]
cmp eax, ebx
pop ecx
pop ecx
mov byte [ebp - 4], 0xe
je 0xa70365
add eax, 0xfffffff4
push eax
call fcn.0042db7e
pop ecx
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0xd
jmp 0xa7038a
mov ecx, dword [ebp - 0x24]
cmp ecx, ebx
mov byte [ebp - 4], 0xe
je 0xa70386
add ecx, 0xfffffff4
push ecx
call fcn.0042db7e
mov eax, dword [ebp + 8]
pop ecx
mov byte [ebp - 4], 0xd
cmp eax, ebx
je 0xa70398
add eax, 0xfffffff4
push eax
call fcn.0042db7e
pop ecx
dec dword [ebp - 0x18]
jne 0xa701f4
jmp 0xa7041b
lea eax, [ebp - 0xa0]
push eax
mov ecx, edi
call fcn.00485d76
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x14
call fcn.0041b94d
mov eax, dword [ebp - 0xa0]
cmp eax, ebx
mov byte [ebp - 4], 0xd
je 0xa703d6
add eax, 0xfffffff4
push eax
call fcn.0042db7e
pop ecx
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push eax
mov ecx, esi
call fcn.004d29c2
mov ecx, edi
mov byte [ebp - 4], 0xd
call fcn.00406d9a
push eax
call fcn.00438119
mov ecx, eax
call fcn.00444b0f
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0xa7041b
cmp byte [eax], bl
je 0xa7041b
mov ecx, dword [0xd83750]
cmp ecx, ebx
je 0xa7041b
push 1
push 5
push eax
call fcn.009c009c
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je case.default.0xa6fb2f
add eax, 0xfffffff4
push eax
call fcn.0042db7e
jmp 0xa70c3e
mov ecx, edi
call fcn.00406d64
xor ebx, ebx
mov ecx, edi
mov bl, al
call fcn.00406d9a
mov ecx, dword [esi + 0x29a0]
mov eax, dword [ecx + eax*8 + 4]
test eax, eax
je case.default.0xa6fb2f
push ebx
mov ecx, eax
call fcn.005815c0
jmp case.default.0xa6fb2f
mov ecx, edi
call fcn.00406d64
mov ecx, edi
movzx esi, al
call fcn.00406d64
mov ecx, edi
call fcn.00406d64
xor ebx, ebx
mov dword [ebp + 8], ebx
cmp esi, ebx
mov dword [ebp - 4], 0x16
je 0xa704bc
lea eax, [ebp - 0x50]
push 0xb11
push eax
call fcn.00877d11
mov ecx, eax
call fcn.00406bc6
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x17
call fcn.0041b94d
mov eax, dword [ebp - 0x50]
mov byte [ebp - 4], 0x16
jmp 0xa7051f
mov ecx, edi
call fcn.00406d9a
mov ecx, dword [0xd7c420]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00677f9a
mov esi, eax
lea eax, [ebp - 0x80]
push 0xb12
push eax
mov byte [ebp - 4], 0x18
call fcn.00877d11
mov ecx, eax
call fcn.00406bc6
push dword [esi]
mov eax, dword [eax]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x19
call fcn.0044e655
mov eax, dword [ebp - 0x80]
add esp, 0xc
cmp eax, ebx
mov byte [ebp - 4], 0x18
je 0xa70518
add eax, 0xfffffff4
push eax
call fcn.0042db7e
pop ecx
mov eax, dword [ebp - 0x58]
mov byte [ebp - 4], 0x16
cmp eax, ebx
je 0xa7052d
add eax, 0xfffffff4
push eax
call fcn.0042db7e
pop ecx
lea eax, [ebp + 8]
push 6
push eax
call fcn.004a6f59
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
pop ecx
pop ecx
jmp 0xa70422
xor ebx, ebx
mov dword [ebp + 8], ebx
mov ecx, edi
mov dword [ebp - 4], 0x1a
call fcn.00406d9a
mov esi, eax
lea eax, [ebp - 0x98]
push 0x14b0
push eax
call fcn.00877d11
mov ecx, eax
call fcn.00406bc6
mov eax, dword [eax]
push esi
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x1b
call fcn.0044e655
mov eax, dword [ebp - 0x98]
add esp, 0xc
cmp eax, ebx
mov byte [ebp - 4], 0x1a
je 0xa7059f
add eax, 0xfffffff4
push eax
call fcn.0042db7e
pop ecx
mov ecx, dword [0xd83750]
cmp ecx, ebx
je 0xa705b5
push 1
push 3
push dword [ebp + 8]
call fcn.009c009c
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
jmp 0xa70422
mov ecx, edi
call fcn.00406d9a
mov ecx, edi
mov ebx, eax
call fcn.00406d9a
mov ecx, edi
mov dword [ebp + 8], eax
call fcn.00406d64
movzx eax, al
push eax
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.00a7a9f4
jmp case.default.0xa6fb2f
lea eax, [ebp - 0x2c]
push 0x184a
push eax
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
mov eax, dword [eax]
push 0x64
push eax
mov dword [ebp - 4], 0x1c
call fcn.00adee8c
mov eax, dword [ebp - 0x2c]
or dword [ebp - 4], 0xffffffff
test eax, eax
pop ecx
pop ecx
je case.default.0xa6fb2f
add eax, 0xfffffff4
push eax
call fcn.004033fd
jmp 0xa70c3e
mov eax, dword [esi + 0x29f8]
push 0xffffffffffffffff
xor ebx, ebx
push ecx
cmp eax, ebx
lea eax, [esi + 0x16a0]
mov ecx, esp
je 0xa706b7
mov dword [ebp + 8], esp
push eax
call fcn.0041733b
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
lea ecx, [esi + 0x29f4]
mov dword [ebp - 4], 0x1d
call fcn.00a7f6ec
mov ecx, eax
call fcn.00a7137e
lea eax, [ebp - 0x88]
push 0x164b
push eax
mov byte [ebp - 4], 0x1e
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
push ebx
mov ecx, eax
mov byte [ebp - 4], 0x20
call fcn.004173e3
push eax
call fcn.00438119
mov ecx, eax
call fcn.0043f559
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
jmp 0xa70710
mov dword [ebp + 8], esp
push eax
call fcn.0041733b
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
mov ecx, esi
mov dword [ebp - 4], 0x21
call fcn.004d29c2
lea eax, [ebp - 0x68]
push 0x848
push eax
mov byte [ebp - 4], 0x22
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
push ebx
mov ecx, eax
mov byte [ebp - 4], 0x24
call fcn.004173e3
push eax
call fcn.00438119
mov ecx, eax
call fcn.0043f559
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.004026b4
lea eax, [ebp - 0xa8]
push 0x84c
push eax
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
mov eax, dword [eax]
push 0x64
push eax
mov dword [ebp - 4], 0x25
call fcn.00adee8c
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0xa8]
jmp 0xa712ea
push 0xffffffffffffffff
push ecx
lea eax, [esi + 0x16a0]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.0041733b
xor ebx, ebx
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
mov ecx, esi
mov dword [ebp - 4], 0x26
call fcn.004d29c2
lea eax, [ebp - 0x30]
push 0x849
push eax
mov byte [ebp - 4], 0x27
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
push ebx
mov ecx, eax
mov byte [ebp - 4], 0x29
call fcn.004173e3
push eax
call fcn.00438119
mov ecx, eax
call fcn.0043f559
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004026b4
lea eax, [ebp - 0x34]
push 0x84d
push eax
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
mov eax, dword [eax]
push 0x64
push eax
mov dword [ebp - 4], 0x2a
call fcn.00adee8c
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x34]
jmp 0xa712ea
mov ecx, edi
call fcn.00406d64
movzx eax, al
jmp 0xa70801
mov ecx, edi
call fcn.00406d9a
push 0
push eax
mov ecx, esi
call fcn.00a64b27
jmp case.default.0xa6fb2f
mov ecx, edi
call fcn.00406d9a
xor ebx, ebx
mov edi, eax
mov dword [ebp + 8], ebx
lea eax, [ebp - 0x3c]
push 0x8c2
push eax
mov dword [ebp - 4], 0x2b
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
mov eax, dword [eax]
push edi
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x2c
call fcn.00419a49
add esp, 0xc
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x2b
call fcn.004026b4
push 0xc00614a4
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ebx
call fcn.00438069
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, esi
mov byte [ebp - 4], 0x2d
call fcn.004d29c2
push ebx
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x2b
call fcn.004173e3
push eax
call fcn.00438119
mov ecx, eax
call fcn.00441b38
push 0x29
push edi
call fcn.00ade732
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp + 8]
jmp 0xa712ea
mov ecx, edi
call fcn.00406d9a
xor ebx, ebx
mov edi, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0x2f
mov dword [ebp + 8], ebx
lea eax, [ebp - 0x44]
push 0x8c0
push eax
mov byte [ebp - 4], 0x30
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
mov eax, dword [eax]
push edi
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 0x31
call fcn.00419a49
add esp, 0xc
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x30
call fcn.004026b4
lea eax, [ebp - 0x4c]
push 0x8c1
push eax
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
mov eax, dword [eax]
push edi
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x32
call fcn.00419a49
add esp, 0xc
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x30
call fcn.004026b4
push 0xc00614a4
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ebx
call fcn.00438069
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, esi
mov byte [ebp - 4], 0x33
call fcn.004d29c2
push ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x30
call fcn.004173e3
push eax
call fcn.00438119
mov ecx, eax
call fcn.0043f559
push 0xc0061378
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ebx
call fcn.00438069
push ebx
mov byte [ebp - 4], 0x35
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, esi
call fcn.004d29c2
push ebx
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x30
call fcn.004173e3
push eax
call fcn.00438119
mov ecx, eax
call fcn.0043f559
lea eax, [ebp - 0x54]
push 0x103f
push eax
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
mov eax, dword [eax]
push 0x64
push eax
mov byte [ebp - 4], 0x37
call fcn.00adee8c
pop ecx
pop ecx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x30
call fcn.004026b4
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x2f
call fcn.004026b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
jmp 0xa712ea
lea eax, [ebp - 0x5c]
push eax
mov ecx, edi
call fcn.00485d76
mov eax, dword [eax]
push 0xffffffffffffffff
xor ebx, ebx
push eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0x38
mov dword [ebp + 8], ebx
call fcn.004a63ff
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x3a
call fcn.00406a50
mov eax, dword [esi + 0x1728]
lea ecx, [eax - 0xc]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [eax + 0x1c0]
mov edx, dword [eax + 0x1c4]
imul ecx, ecx, 0xbb8
mov eax, dword [eax + 0x18]
sub ecx, edx
neg eax
sbb eax, eax
and eax, 5
inc eax
inc eax
cmp dword [esi + 0x1728], ebx
lea ecx, [ecx + ecx*4]
lea edi, [eax + ecx*2 - 0x3fff8ada]
jne 0xa70a77
push 0x80004003
call fcn.00be0541
mov eax, dword [esi + 0x1728]
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0xa70a8e
push 0x80004003
call fcn.00be0541
mov eax, dword [0xd808ac]
mov ecx, dword [ebp - 0x14]
mov esi, dword [esi + 0x1728]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.00403ba2
push eax
mov ecx, esi
call fcn.00403b7b
mov ecx, dword [ebp - 0x10]
push eax
dec edi
push edi
push ebx
call fcn.00440724
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
jmp 0xa712ea
push 0x29
mov ecx, edi
call fcn.00406d9a
push eax
call fcn.00ade732
pop ecx
pop ecx
mov ecx, edi
call fcn.00406d64
test al, al
je case.default.0xa6fb2f
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.00485d76
mov eax, dword [esi + 0x1728]
lea ecx, [eax - 0xc]
add esi, 0x1728
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [eax + 0x1c0]
mov edx, dword [eax + 0x1c4]
imul ecx, ecx, 0xbb8
mov eax, dword [eax + 0x18]
sub ecx, edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
and eax, 5
inc eax
push ebx
lea ecx, [ecx + ecx*4]
inc eax
push ebx
mov dword [ebp - 4], 0x3b
lea edi, [eax + ecx*2 - 0x3fff8ada]
call dword [0xd86228]
shl eax, 1
add eax, 3
and eax, 0xfffffffc
call fcn.00be1990
mov dword [ebp - 0x14], esp
dec edi
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ebx
call fcn.00438069
mov ecx, esi
mov byte [ebp - 4], 0x3c
call fcn.00417283
mov ecx, eax
call fcn.00403ba2
push eax
mov ecx, esi
call fcn.00417283
mov ecx, eax
call fcn.00403b7b
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push ebx
call fcn.0043804c
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x14]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x3b
call fcn.0042d27a
push eax
call fcn.0047d919
add esp, 0xc
push eax
call fcn.00438119
mov ecx, eax
call fcn.0043f559
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
jmp 0xa71249
push 0xc00614a4
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
xor ebx, ebx
push ebx
call fcn.00438069
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
mov ecx, esi
mov dword [ebp - 4], 0x3e
call fcn.004d29c2
lea eax, [ebp - 0x64]
push 0x847
push eax
mov byte [ebp - 4], 0x3f
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
push ebx
mov ecx, eax
mov byte [ebp - 4], 0x41
call fcn.004173e3
push eax
call fcn.00438119
mov ecx, eax
call fcn.0043f559
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.004026b4
push 0x64
push str.mCardGet
call fcn.00adee8c
pop ecx
pop ecx
jmp case.default.0xa6fb2f
push 0xc00614a4
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
xor ebx, ebx
push ebx
call fcn.00438069
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
mov ecx, esi
mov dword [ebp - 4], 0x42
call fcn.004d29c2
lea eax, [ebp - 0x6c]
push 0x84a
push eax
mov byte [ebp - 4], 0x43
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
push ebx
mov ecx, eax
mov byte [ebp - 4], 0x45
call fcn.004173e3
push eax
call fcn.00438119
mov ecx, eax
call fcn.0043f559
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.004026b4
lea eax, [ebp - 0x74]
push 0x84e
push eax
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
mov eax, dword [eax]
push 0x64
push eax
mov dword [ebp - 4], 0x46
call fcn.00adee8c
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x74]
jmp 0xa712ea
mov ecx, edi
call fcn.00406d9a
mov ebx, eax
push ebx
push ecx
lea edi, [esi + 0x16a0]
mov ecx, esp
mov dword [ebp + 8], esp
push edi
call fcn.0041733b
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
mov ecx, esi
mov dword [ebp - 4], 0x47
call fcn.004d29c2
or dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.0042d202
mov ecx, eax
call fcn.0044a3b5
push eax
call fcn.00438119
mov ecx, eax
call fcn.004434f8
test ebx, ebx
jne 0xa70d68
lea eax, [ebp - 0x7c]
push 0x446
push eax
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
mov eax, dword [eax]
push 0x64
push eax
mov dword [ebp - 4], 0x49
call fcn.00adee8c
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x7c]
jmp 0xa712ea
cmp ebx, 1
jne case.default.0xa6fb2f
lea eax, [ebp - 0x84]
push 0x447
push eax
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
mov eax, dword [eax]
push 0x64
push eax
mov dword [ebp - 4], 0x4a
call fcn.00adee8c
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x84]
jmp 0xa712ea
push 0xc00614a4
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
xor ebx, ebx
push ebx
call fcn.00438069
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
mov ecx, esi
mov dword [ebp - 4], 0x4b
call fcn.004d29c2
lea eax, [ebp - 0x8c]
push 0x13e6
push eax
mov byte [ebp - 4], 0x4c
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
push ebx
mov ecx, eax
mov byte [ebp - 4], 0x4e
call fcn.004173e3
push eax
call fcn.00438119
mov ecx, eax
call fcn.0043f559
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.004026b4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
test eax, eax
je case.default.0xa6fb2f
lea eax, [ebp - 0x94]
push 0x13e7
push eax
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
mov eax, dword [eax]
push 0x64
push eax
mov dword [ebp - 4], 0x4f
call fcn.00adee8c
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x94]
jmp 0xa712ea
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.00485d76
xor ebx, ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x10]
mov dword [ebp - 4], 0x50
push ebx
push ebx
call dword [0xd86228]
shl eax, 1
add eax, 3
and eax, 0xfffffffc
call fcn.00be1990
mov edi, esp
push 0x3fffffff
push edi
push 0xffffffffffffffff
push dword [ebp - 0x10]
push ebx
push ebx
call dword [0xd86228]
push 0xffffffffffffffff
push edi
lea ecx, [ebp + 8]
mov dword [ebp + 8], ebx
call fcn.0041fdb1
cmp dword [esi + 0x1728], ebx
mov byte [ebp - 4], 0x51
jne 0xa70ecb
push 0x80004003
call fcn.00be0541
mov eax, dword [esi + 0x1728]
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0xa70ee2
push 0x80004003
call fcn.00be0541
mov ecx, dword [ebp - 0x14]
mov esi, dword [esi + 0x1728]
mov ebx, dword [ebp + 8]
mov edi, dword [0xd808ac]
call fcn.00403ba2
push eax
mov ecx, esi
call fcn.00403b7b
push eax
push 0xc00614a4
push ebx
mov ecx, edi
call fcn.00440724
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x50
call fcn.004026b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
jmp 0xa71249
lea eax, [ebp - 0x9c]
push 0xb14
push eax
call fcn.00877d11
mov ecx, eax
call fcn.00406bc6
push 6
push eax
mov dword [ebp - 4], 0x52
call fcn.004a6f59
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x9c]
jmp 0xa71249
mov ecx, edi
call fcn.00406d64
and dword [ebp + 8], 0
movzx esi, al
lea eax, [ebp - 0xa4]
push 0xb13
push eax
mov dword [ebp - 4], 0x53
call fcn.00877d11
mov ecx, eax
call fcn.00406bc6
mov eax, dword [eax]
push esi
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x54
call fcn.0044e655
add esp, 0xc
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x53
call fcn.00406a50
lea eax, [ebp + 8]
push 6
push eax
call fcn.004a6f59
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp + 8]
jmp 0xa71249
call fcn.0043d78a
test eax, eax
je case.default.0xa6fb2f
call fcn.0043d78a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x1c]
cmp eax, 0x13
jne case.default.0xa6fb2f
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.00485d76
xor ebx, ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
mov dword [ebp - 4], 0x55
push ebx
push ebx
call dword [0xd86228]
shl eax, 1
add eax, 3
and eax, 0xfffffffc
call fcn.00be1990
mov edi, esp
push 0xc00614a4
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ebx
call fcn.00438069
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, esi
mov byte [ebp - 4], 0x56
call fcn.004d29c2
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 0x55
call fcn.0045c586
neg eax
sbb eax, eax
inc eax
push eax
push 0xffffffffffffffff
push edi
lea ecx, [ebp + 8]
call fcn.0042d27a
push eax
call fcn.0047d919
add esp, 0xc
push eax
call fcn.00438119
mov ecx, eax
call fcn.0043f559
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
jmp 0xa71249
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.00485d76
mov ecx, edi
mov dword [ebp - 4], 0x58
call fcn.00406d9a
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
je 0xa710a9
cmp byte [eax], bl
jne 0xa710b5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
jmp 0xa71249
push ebx
push ebx
push 0xffffffffffffffff
push eax
push ebx
push ebx
call dword [0xd86228]
shl eax, 1
add eax, 3
and eax, 0xfffffffc
call fcn.00be1990
mov edi, esp
push 0xc00614a4
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ebx
call fcn.00438069
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, esi
mov byte [ebp - 4], 0x59
call fcn.004d29c2
push ebx
push 0xffffffffffffffff
push edi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x58
call fcn.0042d27a
push eax
call fcn.0047d919
add esp, 0xc
push eax
call fcn.00438119
mov ecx, eax
call fcn.0043f559
jmp 0xa710a9
push 0x29
mov ecx, edi
call fcn.00406d9a
push eax
call fcn.00ade732
pop ecx
pop ecx
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.00485d76
mov eax, dword [esi + 0x1728]
lea ecx, [eax - 0xc]
add esi, 0x1728
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [eax + 0x1c0]
mov edx, dword [eax + 0x1c4]
imul ecx, ecx, 0xbb8
mov eax, dword [eax + 0x18]
sub ecx, edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
and eax, 5
inc eax
push ebx
lea ecx, [ecx + ecx*4]
inc eax
push ebx
mov dword [ebp - 4], 0x5b
lea edi, [eax + ecx*2 - 0x3fff8ada]
call dword [0xd86228]
shl eax, 1
add eax, 3
and eax, 0xfffffffc
call fcn.00be1990
mov dword [ebp - 0x14], esp
dec edi
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ebx
call fcn.00438069
mov ecx, esi
mov byte [ebp - 4], 0x5c
call fcn.00417283
mov ecx, eax
call fcn.00403ba2
push eax
mov ecx, esi
call fcn.00417283
mov ecx, eax
call fcn.00403b7b
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push ebx
call fcn.0043804c
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x14]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x5b
call fcn.0042d27a
push eax
call fcn.0047d919
add esp, 0xc
push eax
call fcn.00438119
mov ecx, eax
call fcn.0043f559
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
jmp 0xa71249
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.00485d76
push ecx
mov ecx, esp
and dword [ecx], 0
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 4], 0x5e
call fcn.0041b94d
mov byte [ebp - 4], 0x5e
call fcn.0043d78a
mov ecx, eax
call fcn.006f6f32
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00406a50
jmp case.default.0xa6fb2f
mov ecx, edi
call fcn.00406d9a
mov edi, eax
lea eax, [ebp - 0x24]
push 0x142d
push eax
call fcn.00877d11
mov ecx, eax
call fcn.004069e7
push edi
push dword [ebp - 0x24]
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 4], 0x60
call fcn.00419a49
add esp, 0xc
push 0xffffffffffffffff
push ecx
lea eax, [esi + 0x16a0]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.0041733b
xor ebx, ebx
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
mov ecx, esi
mov byte [ebp - 4], 0x61
call fcn.004d29c2
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 0x60
call fcn.0045c586
neg eax
sbb eax, eax
inc eax
push eax
lea ecx, [ebp - 0x24]
call fcn.004173e3
push eax
call fcn.00438119
mov ecx, eax
call fcn.0043f559
push edi
call fcn.00ae3b7a
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x24]
call fcn.004026b4
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0xb8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4