Function at 0x425905
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x11
add esp, 0xfffff004
push eax
dec eax
jne 0x42590e
mov eax, dword [ebp - 4]
add esp, 0xfffffcc4
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10500], edx
mov dword [ebp - 0x104fc], eax
lea esi, [ebp - 0x104f8]
mov eax, 0x4ae528
call fcn.004a0204
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x10504], edx
mov dword [ebp - 0x10508], ecx
mov byte [ebp - 0x10509], 0
mov word [esi + 0x10], 8
mov edx, dword [ebp - 0x104fc]
lea eax, [ebp - 0x8264]
call fcn.0040429c
add dword [esi + 0x1c], 0xa
mov word [esi + 0x10], 0x14
mov word [esi + 0x10], 0x20
lea eax, [ebp - 0x104c8]
mov edx, dword [ebp - 0x104fc]
call fcn.0040429c
add dword [esi + 0x1c], 0xa
mov word [esi + 0x10], 0x14
lea eax, [ebp - 0x8264]
mov ecx, ebx
mov edx, dword [ebp - 0x10500]
call fcn.00409940
mov byte [ebp - 0x8253], 1
push 0x4ae44d
lea eax, [ebp - 0x1092c]
push eax
call fcn.0049fdd4
add esp, 8
mov eax, dword [ebp - 0x10500]
call fcn.0040c4d0
push eax
lea edx, [ebp - 0x1092c]
push edx
call fcn.0049fcf8
add esp, 8
lea eax, [ebp - 0x1092c]
xor edx, edx
call fcn.0040cfb4
push 0x4ae454
lea ecx, [ebp - 0x10d2c]
push ecx
call fcn.0049fdd4
add esp, 8
mov eax, dword [ebp - 0x10500]
call fcn.0040c4d0
push eax
lea edx, [ebp - 0x10d2c]
push edx
call fcn.0049fcf8
add esp, 8
mov edx, 0x4ae45d
mov eax, dword [ebp - 0x10500]
call fcn.0040c948
test al, al
jne 0x425a48
mov edx, 0x4ae461
mov eax, dword [ebp - 0x10500]
call fcn.0040c948
test al, al
je 0x425a58
mov edx, 0x4ae465
lea eax, [ebp - 0x10d2c]
call fcn.0040c830
lea eax, [ebp - 0x10d2c]
xor edx, edx
call fcn.0040cfb4
push 0
lea eax, [ebp - 0x1050a]
mov ecx, dword [ebp - 0x104fc]
lea edx, [ebp - 0x104c8]
push dword [ecx + 0x28a4]
push eax
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 0x104fc]
lea ecx, [ebp - 0x1092c]
call fcn.0040bd90
test al, al
jne 0x425bb2
cmp byte [ebp - 0x1050a], 0
jne 0x425aca
mov eax, 0x4bb2e4
mov edx, 9
call fcn.0042ecec
lea edx, [ebp - 0x1092c]
mov eax, 0x4bb2e4
call fcn.0042ebb8
mov al, byte [ebp - 0x1050a]
mov edx, 2
push eax
lea eax, [ebp - 0x9c48]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
call fcn.004017f0
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xa974]
mov edx, 2
call fcn.004017f0
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0xf0f8]
mov edx, 2
call fcn.0042957c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xf65c]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
lea eax, [ebp - 0x104c8]
xor edx, edx
call fcn.004097d4
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x19e4]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x2710]
mov edx, 2
call fcn.004017f0
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0x6e94]
mov edx, 2
call fcn.0042957c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x73f8]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
lea eax, [ebp - 0x8264]
xor edx, edx
call fcn.004097d4
pop eax
mov edx, dword [esi]
mov dword fs:[0], edx
jmp 0x426932
lea ecx, [ebp - 0x1092c]
mov eax, 0x267
push ecx
call fcn.00413388
push eax
lea edx, [ebp - 0x1132c]
push edx
call fcn.004a2e18
add esp, 0xc
lea eax, [ebp - 0x1132c]
call fcn.00478308
lea edx, [ebp - 0x104c8]
lea eax, [ebp - 0x8264]
call fcn.00424548
mov ebx, eax
cmp ebx, 2
jne 0x425ce9
lea eax, [ebp - 0x104c8]
call fcn.00409af8
mov al, 1
mov edx, 2
push eax
lea eax, [ebp - 0x9c48]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
call fcn.004017f0
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xa974]
mov edx, 2
call fcn.004017f0
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0xf0f8]
mov edx, 2
call fcn.0042957c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xf65c]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
lea eax, [ebp - 0x104c8]
xor edx, edx
call fcn.004097d4
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x19e4]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x2710]
mov edx, 2
call fcn.004017f0
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0x6e94]
mov edx, 2
call fcn.0042957c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x73f8]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
lea eax, [ebp - 0x8264]
xor edx, edx
call fcn.004097d4
pop eax
mov edx, dword [esi]
mov dword fs:[0], edx
jmp 0x426932
cmp ebx, 1
jne 0x425e20
lea eax, [ebp - 0x104c8]
call fcn.00409af8
mov edx, dword [ebp - 0x104fc]
cmp byte [edx + 0x28e8], 0
jne 0x425e20
push 0x24
mov eax, 0x262
call fcn.00413388
push eax
mov eax, 0x275
call fcn.00413388
push eax
push dword [0x4cfe40]
call sub.USER32.DLL_MessageBoxA
cmp eax, 6
je 0x425e20
mov al, 1
mov edx, 2
push eax
lea eax, [ebp - 0x9c48]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
call fcn.004017f0
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xa974]
mov edx, 2
call fcn.004017f0
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0xf0f8]
mov edx, 2
call fcn.0042957c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xf65c]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
lea eax, [ebp - 0x104c8]
xor edx, edx
call fcn.004097d4
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x19e4]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x2710]
mov edx, 2
call fcn.004017f0
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0x6e94]
mov edx, 2
call fcn.0042957c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x73f8]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
lea eax, [ebp - 0x8264]
xor edx, edx
call fcn.004097d4
pop eax
mov edx, dword [esi]
mov dword fs:[0], edx
jmp 0x426932
test ebx, ebx
jne 0x425e2f
lea eax, [ebp - 0x104c8]
call fcn.00409b88
push 0
push 0
lea eax, [ebp - 0x8264]
xor edx, edx
call fcn.00409f94
push 0
lea eax, [ebp - 0x1050a]
mov ecx, dword [ebp - 0x104fc]
lea edx, [ebp - 0x104c8]
push dword [ecx + 0x28a4]
push eax
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 0x104fc]
lea ecx, [ebp - 0x10d2c]
call fcn.0040bd90
test al, al
jne 0x425f96
cmp byte [ebp - 0x1050a], 0
jne 0x425ea5
mov eax, 0x4bb2e4
mov edx, 9
call fcn.0042ecec
lea edx, [ebp - 0x10d2c]
mov eax, 0x4bb2e4
call fcn.0042ebb8
xor eax, eax
mov edx, 2
mov al, byte [ebp - 0x1050a]
cmp eax, 1
sbb eax, eax
neg eax
push eax
lea eax, [ebp - 0x9c48]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
call fcn.004017f0
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xa974]
mov edx, 2
call fcn.004017f0
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0xf0f8]
mov edx, 2
call fcn.0042957c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xf65c]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
lea eax, [ebp - 0x104c8]
xor edx, edx
call fcn.004097d4
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x19e4]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x2710]
mov edx, 2
call fcn.004017f0
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0x6e94]
mov edx, 2
call fcn.0042957c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x73f8]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
lea eax, [ebp - 0x8264]
xor edx, edx
call fcn.004097d4
pop eax
mov edx, dword [esi]
mov dword fs:[0], edx
jmp 0x426932
lea eax, [ebp - 0x8264]
call fcn.0040a25c
mov dword [ebp - 0x10514], eax
mov dword [ebp - 0x10510], edx
lea edx, [ebp - 0x10d2c]
mov eax, 0x267
push edx
call fcn.00413388
push eax
lea edx, [ebp - 0x1132c]
push edx
call fcn.004a2e18
add esp, 0xc
lea eax, [ebp - 0x1132c]
call fcn.00478308
mov byte [ebp - 0x10515], 0
lea eax, [ebp - 0x8264]
xor edx, edx
call fcn.00404688
test al, al
je 0x426123
mov byte [ebp - 0x10515], 1
mov cx, word [ebp - 0x3350]
mov word [ebp - 0xb5b4], cx
mov ax, word [ebp - 0x334e]
mov word [ebp - 0xb5b2], ax
cmp byte [ebp - 0xc2c], 0
je 0x426123
mov eax, 0x272
call fcn.00413388
push eax
lea edx, [ebp - 0x824d]
push edx
call fcn.00480d50
add esp, 8
mov al, 1
push eax
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x9c48]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xa974]
mov edx, 2
call fcn.004017f0
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0xf0f8]
mov edx, 2
call fcn.0042957c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xf65c]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
lea eax, [ebp - 0x104c8]
xor edx, edx
call fcn.004097d4
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x19e4]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x2710]
mov edx, 2
call fcn.004017f0
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0x6e94]
mov edx, 2
call fcn.0042957c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x73f8]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
lea eax, [ebp - 0x8264]
xor edx, edx
call fcn.004097d4
pop eax
mov edx, dword [esi]
mov dword fs:[0], edx
jmp 0x426932
xor ecx, ecx
lea eax, [ebp - 0x104c8]
mov dword [ebp - 0xb5ac], ecx
mov edx, 0x72
mov word [ebp - 0xb5b0], cx
and word [ebp - 0xb5b4], 0xff9f
xor ecx, ecx
call fcn.00401cb0
lea eax, [ebp - 0x104c8]
xor ecx, ecx
mov edx, 0x73
call fcn.00401cb0
mov eax, dword [ebp - 0xc3c]
mov edx, dword [ebp - 0xc38]
add eax, 0xd
adc edx, 0
push edx
push eax
lea eax, [ebp - 0x8264]
xor edx, edx
call fcn.00409f94
movzx eax, word [ebp - 0xb5b2]
add eax, 0xfffffff3
cdq
push edx
push eax
lea edx, [ebp - 0x104c8]
lea eax, [ebp - 0x8264]
call fcn.0040a2f0
push 0
push 0
lea eax, [ebp - 0x8264]
xor edx, edx
call fcn.00409f94
mov word [esi + 0x10], 0x2c
lea eax, [ebp - 0x104d4]
mov edx, 0x10000
call fcn.00401c0c
inc dword [esi + 0x1c]
mov word [esi + 0x10], 0x14
mov dword [ebp - 0x10520], 0
mov dword [ebp - 0x1051c], 0
mov dword [ebp - 0x10528], 0
mov dword [ebp - 0x10524], 0
lea eax, [ebp - 0x8264]
mov ecx, dword [ebp - 0x104d0]
mov edx, dword [ebp - 0x104d4]
call fcn.00409e1c
mov eax, dword [ebp - 0x104d0]
add eax, 0xfffff000
cdq
add dword [ebp - 0x10528], eax
adc dword [ebp - 0x10524], edx
mov eax, dword [ebp - 0x104d0]
add eax, 0xfffff000
cdq
push edx
push eax
mov eax, dword [ebp - 0x10520]
mov edx, dword [ebp - 0x1051c]
call fcn.004a4480
mov ebx, eax
xor eax, eax
add ebx, dword [ebp - 0x104d4]
xor ecx, ecx
mov word [esi + 0x10], 0x14
mov al, byte [ebx + 2]
xor edx, edx
mov dword [ebp - 0xb5a0], eax
xor eax, eax
mov cl, byte [ebx + 6]
mov dl, byte [ebx + 5]
shl ecx, 8
add dx, cx
mov word [ebp - 0xb59a], dx
xor edx, edx
mov dl, byte [ebx + 0x1b]
mov al, byte [ebx + 0x1a]
shl edx, 8
add ax, dx
mov word [ebp - 0xb582], ax
cmp dword [ebp - 0xb5a0], 0x74
jne 0x4266c5
cmp word [ebp - 0xb59a], 0x1000
jae 0x4266c5
cmp word [ebp - 0xb582], 0
jbe 0x4266c5
cmp word [ebp - 0xb582], 0x400
jae 0x4266c5
xor eax, eax
xor ecx, ecx
mov al, byte [ebx + 1]
mov cl, byte [ebx]
shl eax, 8
xor edx, edx
add cx, ax
xor eax, eax
mov word [ebp - 0xb5a4], cx
xor ecx, ecx
mov cl, byte [ebx + 4]
mov dl, byte [ebx + 3]
shl ecx, 8
add dx, cx
xor ecx, ecx
mov word [ebp - 0xb59c], dx
xor edx, edx
mov dl, byte [ebx + 8]
mov al, byte [ebx + 7]
shl edx, 8
mov cl, byte [ebx + 9]
add eax, edx
xor edx, edx
mov dl, byte [ebx + 0xa]
shl ecx, 0x10
shl edx, 0x18
add eax, ecx
add eax, edx
xor ecx, ecx
mov dword [ebp - 0xb598], eax
xor eax, eax
mov cl, byte [ebx + 0xc]
mov al, byte [ebx + 0xb]
shl ecx, 8
xor edx, edx
add eax, ecx
mov dl, byte [ebx + 0xd]
xor ecx, ecx
mov cl, byte [ebx + 0xe]
shl edx, 0x10
shl ecx, 0x18
add eax, edx
add eax, ecx
xor edx, edx
mov dword [ebp - 0xb594], eax
xor ecx, ecx
mov al, byte [ebx + 0xf]
mov byte [ebp - 0xb590], al
xor eax, eax
mov dl, byte [ebx + 0x11]
mov al, byte [ebx + 0x10]
shl edx, 8
mov cl, byte [ebx + 0x12]
add eax, edx
xor edx, edx
mov dl, byte [ebx + 0x13]
shl ecx, 0x10
shl edx, 0x18
add eax, ecx
add eax, edx
xor ecx, ecx
mov dword [ebp - 0xb58c], eax
xor eax, eax
mov cl, byte [ebx + 0x15]
mov al, byte [ebx + 0x14]
shl ecx, 8
xor edx, edx
add eax, ecx
mov dl, byte [ebx + 0x16]
xor ecx, ecx
mov cl, byte [ebx + 0x17]
shl edx, 0x10
shl ecx, 0x18
add eax, edx
add eax, ecx
xor ecx, ecx
mov dword [ebp - 0xb588], eax
xor edx, edx
mov al, byte [ebx + 0x18]
mov byte [ebp - 0xb584], al
mov al, byte [ebx + 0x19]
mov byte [ebp - 0xb583], al
xor eax, eax
mov cl, byte [ebx + 0x1d]
mov dl, byte [ebx + 0x1c]
shl ecx, 8
mov al, byte [ebx + 0x1e]
add edx, ecx
xor ecx, ecx
mov cl, byte [ebx + 0x1f]
shl eax, 0x10
shl ecx, 0x18
add edx, eax
add edx, ecx
mov dword [ebp - 0xb580], edx
test byte [ebp - 0xb59b], 1
je 0x426436
xor eax, eax
xor edx, edx
mov al, byte [ebx + 0x21]
mov dl, byte [ebx + 0x20]
shl eax, 8
xor ecx, ecx
add edx, eax
mov cl, byte [ebx + 0x22]
xor eax, eax
mov al, byte [ebx + 0x23]
shl ecx, 0x10
shl eax, 0x18
add edx, ecx
add edx, eax
xor ecx, ecx
mov dword [ebp - 0xb57c], edx
xor edx, edx
mov cl, byte [ebx + 0x25]
mov dl, byte [ebx + 0x24]
shl ecx, 8
xor eax, eax
add edx, ecx
mov al, byte [ebx + 0x26]
xor ecx, ecx
mov cl, byte [ebx + 0x27]
shl eax, 0x10
shl ecx, 0x18
add edx, eax
add edx, ecx
mov dword [ebp - 0xb578], edx
jmp 0x426444
xor edx, edx
mov dword [ebp - 0xb578], edx
mov dword [ebp - 0xb57c], edx
mov eax, dword [ebp - 0xb57c]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0xb598]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xa8b0], eax
mov dword [ebp - 0xa8ac], edx
mov eax, dword [ebp - 0xb578]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0xb594]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xa8a8], eax
mov dword [ebp - 0xa8a4], edx
movzx ecx, word [ebp - 0xb582]
push ecx
lea eax, [ebp - 0x104c8]
xor edx, edx
call fcn.004269a7
add eax, ebx
push eax
lea ecx, [ebp - 0xb574]
push ecx
call fcn.0049fbe4
add esp, 0xc
test byte [ebp - 0xb59b], 2
je 0x426516
lea eax, [ebp - 0x11340]
call fcn.00412e80
lea edx, [ebp - 0xb574]
push edx
call fcn.0049fe04
pop ecx
inc eax
movzx ecx, word [ebp - 0xb582]
sub ecx, eax
lea edx, [ebp - 0xb174]
push ecx
lea ecx, [ebp - 0xb574]
add ecx, eax
push edx
lea edx, [ebp - 0xb574]
push 0x400
lea eax, [ebp - 0x11340]
call fcn.00413118
jmp 0x42651f
mov word [ebp - 0xb174], 0
test byte [ebp - 0xb59b], 4
je 0x426552
push 8
lea eax, [ebp - 0x104c8]
xor edx, edx
call fcn.004269a7
add eax, ebx
movzx ecx, word [ebp - 0xb582]
add eax, ecx
push eax
lea eax, [ebp - 0xa968]
push eax
call fcn.0049fbe4
add esp, 0xc
movzx edi, word [ebp - 0xb59a]
add edi, 0xfffffffe
mov byte [ebp - 0x10529], 0
test edi, edi
jg 0x426570
mov byte [ebp - 0x10529], 1
jmp 0x4265af
test byte [ebp - 0xb59c], 8
je 0x426594
lea eax, [ebp - 0x104c8]
mov dl, 1
call fcn.004269a7
mov edi, eax
movzx eax, word [ebp - 0xb582]
add edi, eax
add edi, 0xfffffffe
lea edx, [ebx + 2]
mov ecx, edi
or eax, 0xffffffff
call fcn.00411a00
not ax
and ax, 0xffff
mov word [ebp - 0x8e7e], ax
cmp byte [ebp - 0x10529], 0
jne 0x4266c5
lea ecx, [ebp - 0x10509]
lea edx, [ebp - 0x104c8]
mov eax, dword [ebp - 0x104fc]
call fcn.00426939
test al, al
je 0x4266c5
movzx eax, word [ebp - 0xb59a]
cdq
add eax, dword [ebp - 0x10520]
mov bl, 1
adc edx, dword [ebp - 0x1051c]
push edx
push eax
lea eax, [ebp - 0x8264]
xor edx, edx
call fcn.00409f94
movzx ecx, word [ebp - 0xb582]
mov byte [ebp + ecx - 0xb574], 0
call fcn.00410b54
test bl, bl
je 0x4266c5
cmp word [ebp - 0xb174], 0
jne 0x426633
lea eax, [ebp - 0xb574]
mov dl, 1
call fcn.0040cfb4
movzx ecx, word [ebp - 0xb59c]
and ecx, 0xffffefff
or dword [ebp - 0x10508], ecx
lea eax, [ebp - 0x104c8]
mov dl, 1
call fcn.004269a7
add ax, word [ebp - 0xb582]
mov word [ebp - 0xb59a], ax
lea eax, [ebp - 0xb574]
call fcn.0040fd80
push eax
mov eax, 0x268
call fcn.00413388
push eax
lea edx, [ebp - 0x1132c]
push edx
call fcn.004a2e18
add esp, 0xc
lea eax, [ebp - 0x1132c]
call fcn.00478308
inc dword [ebp - 0x10504]
lea eax, [ebp - 0x104c8]
xor ecx, ecx
mov edx, 0x74
call fcn.00401cb0
mov eax, dword [ebp - 0xb598]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x104c8]
lea eax, [ebp - 0x8264]
call fcn.0040a2f0
add dword [ebp - 0x10520], 1
adc dword [ebp - 0x1051c], 0
mov eax, dword [ebp - 0x10514]
mov edx, dword [ebp - 0x10510]
sub eax, 0x20
sbb edx, 0
cmp edx, dword [ebp - 0x1051c]
jne 0x4266fa
cmp eax, dword [ebp - 0x10520]
ja 0x4266fc
jmp 0x42677a
jle 0x42677a
mov eax, dword [ebp - 0x104d0]
add eax, 0xfffff000
cdq
push edx
push eax
mov eax, dword [ebp - 0x10520]
mov edx, dword [ebp - 0x1051c]
call fcn.004a4480
cmp edx, 0
jne 0x426225
cmp eax, 0
jne 0x426225
push dword [ebp - 0x10524]
push dword [ebp - 0x10528]
lea eax, [ebp - 0x8264]
xor edx, edx
call fcn.00409f94
lea eax, [ebp - 0x8264]
mov ecx, dword [ebp - 0x104d0]
mov edx, dword [ebp - 0x104d4]
call fcn.00409e1c
mov eax, dword [ebp - 0x104d0]
add eax, 0xfffff000
cdq
add dword [ebp - 0x10528], eax
adc dword [ebp - 0x10524], edx
jmp 0x426225
test byte [ebp - 0x10508], 3
je 0x42678b
or word [ebp - 0xb5b4], 1
cmp dword [ebp - 0x10504], 0
jle 0x4267dc
cmp byte [ebp - 0x10515], 0
jne 0x4267dc
mov ecx, dword [ebp - 0x104fc]
cmp byte [ecx + 0x28e8], 0
jne 0x4267dc
push 0x24
mov eax, 0x262
call fcn.00413388
push eax
mov eax, 0x273
call fcn.00413388
push eax
push dword [0x4cfe40]
call sub.USER32.DLL_MessageBoxA
cmp eax, 6
jne 0x4267dc
or word [ebp - 0xb5b4], 8
cmp dword [ebp - 0x10504], 0
jne 0x426800
mov eax, 0x274
call fcn.00413388
push eax
push dword [ebp - 0x10500]
call fcn.00480d50
add esp, 8
jmp 0x426840
push 0
push 0
lea eax, [ebp - 0x104c8]
xor edx, edx
call fcn.00409f94
lea eax, [ebp - 0x104c8]
xor ecx, ecx
mov edx, 0x72
call fcn.00401cb0
lea eax, [ebp - 0x104c8]
xor ecx, ecx
mov edx, 0x73
call fcn.00401cb0
lea eax, [ebp - 0x104c8]
call fcn.00409af8
mov al, 1
mov edx, 2
push eax
lea eax, [ebp - 0x104d4]
dec dword [esi + 0x1c]
call fcn.00401c84
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x9c48]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xa974]
mov edx, 2
call fcn.004017f0
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0xf0f8]
mov edx, 2
call fcn.0042957c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0xf65c]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
lea eax, [ebp - 0x104c8]
xor edx, edx
call fcn.004097d4
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x19e4]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x2710]
mov edx, 2
call fcn.004017f0
sub dword [esi + 0x1c], 2
lea eax, [ebp - 0x6e94]
mov edx, 2
call fcn.0042957c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebp - 0x73f8]
mov edx, 2
call fcn.004017f0
dec dword [esi + 0x1c]
lea eax, [ebp - 0x8264]
xor edx, edx
call fcn.004097d4
pop eax
mov edx, dword [esi]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret