Function at 0x425580
Capabilities:
Query or enumerate registry value
Resolve dns
Set uefi variable

Disassembly:
push 0xffffffffffffffff
push 0x44ffb1
mov eax, dword fs:[0]
push eax
sub esp, 0x514
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x510], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x528]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x3a0]
mov dword [esp + 0x3c], esi
cmp eax, 6
jbe 0x4255ef
mov dword [esi + 0x3a0], 0
call fcn.004393a7
call fcn.004393a7
mov dword [esi + 0x39c], 1
jmp 0x42637a
inc eax
mov dword [esi + 0x3a0], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x42560b
sub eax, 2
je 0x42560b
sub eax, 4
jne 0x425623
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
xor ebp, ebp
mov dword [esp + 0x1c], ebp
call fcn.00435460
test eax, eax
je 0x425637
call fcn.00419840
mov edi, 0xf
mov dword [esp + 0xe8], edi
mov dword [esp + 0xe4], ebp
mov byte [esp + 0xd4], 0
mov dword [esp + 0x530], 2
mov dword [esp + 0xb0], edi
mov dword [esp + 0xac], ebp
mov byte [esp + 0x9c], 0
mov byte [esp + 0x530], 3
call fcn.004393a7
cdq
mov ecx, 0x14
idiv ecx
mov esi, edx
inc esi
call fcn.004393a7
cdq
idiv esi
cmp edx, esi
jg 0x4256a0
mov eax, esi
cdq
idiv esi
cmp edx, ebp
je 0x4256aa
call fcn.00418970
call fcn.00419890
mov dword [esp + 0xcc], edi
mov dword [esp + 0xc8], ebp
mov byte [esp + 0xb8], 0
mov byte [esp + 0x530], 4
call fcn.00435460
test eax, eax
je 0x4256d6
call fcn.00419900
call fcn.004354c0
test eax, eax
je 0x4256e4
call fcn.00419900
lea edx, [esp + 0x1c]
push edx
push 1
push ebp
lea eax, [esp + 0x2c]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebp
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebx, 0x10
mov dword [esp + 0x44], esp
cmp eax, ebx
jb 0x42571a
mov ecx, dword [edi]
jmp 0x42571c
mov ecx, edi
cmp ecx, 0x457538
ja 0x425755
cmp eax, ebx
jb 0x42572c
mov ecx, dword [edi]
jmp 0x42572e
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x457538
jbe 0x425755
cmp eax, ebx
jb 0x425741
mov edi, dword [edi]
push 0x41
mov eax, 0x457538
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d80
jmp 0x425797
cmp eax, 0x41
jae 0x425767
mov ecx, dword [esi + 0x14]
push ecx
push 0x41
mov ecx, esi
call fcn.004034b0
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x425772
mov eax, dword [edi]
jmp 0x425774
mov eax, edi
push 0x41
push 0x457538
push ecx
push eax
call fcn.00439429
add esp, 0x10
mov dword [esi + 0x14], 0x41
cmp dword [esi + 0x18], ebx
jb 0x425793
mov edi, dword [edi]
mov byte [edi + 0x41], 0
lea esi, [esp + 0x6c]
call fcn.004016b0
mov byte [esp + 0x540], 5
call fcn.00401850
cmp dword [eax + 0x18], ebx
jb 0x4257b7
mov eax, dword [eax + 4]
jmp 0x4257ba
add eax, 4
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
cmp dword [esp + 0x38], ebx
jb 0x4257db
mov edx, dword [esp + 0x24]
push edx
call fcn.004393c9
add esp, 4
lea esi, [esp + 0x40]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebp
mov byte [esp + 0x24], 0
mov byte [esp + 0x530], 4
call fcn.00429e20
push ebp
call fcn.0043a6c4
add esp, 4
cmp edi, ebp
jne 0x425c5d
cmp dword [esp + 0x1c], 0
je 0x425ca1
push 0x3ff
lea eax, [esp + 0x129]
push 0
push eax
mov byte [esp + 0x130], 0
call fcn.0043fbd0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x128]
push edx
push 0
push 0
lea eax, [esp + 0x30]
push eax
sub esp, 0x1c
mov esi, esp
mov ebp, 0x400
mov dword [esp + 0x48], ebp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebx, 0x10
mov dword [esp + 0x44], esp
cmp eax, ebx
jb 0x425884
mov ecx, dword [edi]
jmp 0x425886
mov ecx, edi
cmp ecx, str.t_n_X
ja 0x4258bf
cmp eax, ebx
jb 0x425896
mov ecx, dword [edi]
jmp 0x425898
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, str.t_n_X
jbe 0x4258bf
cmp eax, ebx
jb 0x4258ab
mov edi, dword [edi]
push 0x12
mov eax, str.t_n_X
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d80
jmp 0x425901
cmp eax, 0x12
jae 0x4258d1
mov ecx, dword [esi + 0x14]
push ecx
push 0x12
mov ecx, esi
call fcn.004034b0
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x4258dc
mov eax, dword [edi]
jmp 0x4258de
mov eax, edi
push 0x12
push str.t_n_X
push ecx
push eax
call fcn.00439429
add esp, 0x10
mov dword [esi + 0x14], 0x12
cmp dword [esi + 0x18], ebx
jb 0x4258fd
mov edi, dword [edi]
mov byte [edi + 0x12], 0
lea esi, [esp + 0x70]
call fcn.004016b0
mov byte [esp + 0x544], 6
call fcn.00401770
cmp dword [eax + 0x18], ebx
jb 0x425921
mov eax, dword [eax + 4]
jmp 0x425924
add eax, 4
mov edx, dword [esp + 0x2c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push edx
call ebx
cmp dword [esp + 0x38], 0x10
mov edi, eax
jb 0x425948
mov eax, dword [esp + 0x24]
push eax
call fcn.004393c9
add esp, 4
lea esi, [esp + 0x40]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
mov byte [esp + 0x530], 4
call fcn.00429e20
test edi, edi
jne 0x42598f
lea ecx, [esp + 0x124]
push ecx
lea ecx, [esp + 0xd4]
call fcn.00402c00
push edi
call fcn.0043a6c4
add esp, 4
push ebp
lea edx, [esp + 0x128]
push 0
push edx
mov dword [esp + 0x24], ebp
call fcn.0043fbd0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x128]
push ecx
push 0
push 0
lea edx, [esp + 0x30]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x44], esp
cmp eax, 0x10
jb 0x4259e5
mov ecx, dword [edi]
jmp 0x4259e7
mov ecx, edi
cmp ecx, 0x457590
ja 0x425a22
cmp eax, 0x10
jb 0x4259f8
mov ecx, dword [edi]
jmp 0x4259fa
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x457590
jbe 0x425a22
cmp eax, 0x10
jb 0x425a0e
mov edi, dword [edi]
push 0x12
mov eax, 0x457590
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d80
jmp 0x425a66
cmp eax, 0x12
jae 0x425a34
mov ecx, dword [esi + 0x14]
push ecx
push 0x12
mov ecx, esi
call fcn.004034b0
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x425a40
mov eax, dword [edi]
jmp 0x425a42
mov eax, edi
push 0x12
push 0x457590
push ecx
push eax
call fcn.00439429
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x12
jb 0x425a62
mov edi, dword [edi]
mov byte [edi + 0x12], 0
lea esi, [esp + 0x70]
call fcn.004016b0
mov byte [esp + 0x544], 7
call fcn.00401ca0
cmp dword [eax + 0x18], 0x10
jb 0x425a87
mov eax, dword [eax + 4]
jmp 0x425a8a
add eax, 4
mov edx, dword [esp + 0x2c]
push eax
push edx
call ebx
cmp dword [esp + 0x38], 0x10
mov edi, eax
jb 0x425aa8
mov eax, dword [esp + 0x24]
push eax
call fcn.004393c9
add esp, 4
lea esi, [esp + 0x40]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
mov byte [esp + 0x530], 4
call fcn.00429e20
test edi, edi
jne 0x425ae6
lea ecx, [esp + 0x124]
push ecx
lea ecx, [esp + 0x9c]
call fcn.00402c00
mov dword [esp + 0x18], ebp
call fcn.00435460
test eax, eax
je 0x425afd
call fcn.00418fd0
call fcn.00418100
push ebp
lea edx, [esp + 0x128]
push 0
push edx
call fcn.0043fbd0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x128]
push ecx
push 0
push 0
lea edx, [esp + 0x30]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x44], esp
cmp eax, 0x10
jb 0x425b4f
mov ecx, dword [edi]
jmp 0x425b51
mov ecx, edi
mov ebp, 0x10
cmp ecx, 0x4575a4
ja 0x425b8f
cmp eax, ebp
jb 0x425b66
mov ecx, dword [edi]
jmp 0x425b68
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4575a4
jbe 0x425b8f
cmp eax, ebp
jb 0x425b7b
mov edi, dword [edi]
push 0x12
mov eax, 0x4575a4
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d80
jmp 0x425bd1
cmp eax, 0x12
jae 0x425ba1
mov ecx, dword [esi + 0x14]
push ecx
push 0x12
mov ecx, esi
call fcn.004034b0
mov ecx, dword [esi + 0x18]
cmp ecx, ebp
jb 0x425bac
mov eax, dword [edi]
jmp 0x425bae
mov eax, edi
push 0x12
push 0x4575a4
push ecx
push eax
call fcn.00439429
add esp, 0x10
mov dword [esi + 0x14], 0x12
cmp dword [esi + 0x18], ebp
jb 0x425bcd
mov edi, dword [edi]
mov byte [edi + 0x12], 0
lea esi, [esp + 0x70]
call fcn.004016b0
mov byte [esp + 0x544], 8
call fcn.00401850
cmp dword [eax + 0x18], ebp
jb 0x425bf1
mov eax, dword [eax + 4]
jmp 0x425bf4
add eax, 4
mov edx, dword [esp + 0x2c]
push eax
push edx
call ebx
mov edi, eax
cmp dword [esp + 0x38], ebp
jb 0x425c11
mov eax, dword [esp + 0x24]
push eax
call fcn.004393c9
add esp, 4
lea esi, [esp + 0x40]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
mov byte [esp + 0x530], 4
call fcn.00429e20
call fcn.00417540
test eax, eax
je 0x425c45
call fcn.00418fd0
test edi, edi
jne 0x425c5d
lea ecx, [esp + 0x124]
push ecx
lea ecx, [esp + 0xb8]
call fcn.00402c00
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x425ca1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0
shr esi, 0x18
call fcn.0043a6c4
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
jbe 0x425c96
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov dword [esp + 0x530], 4
xor ebx, ebx
lea ebp, [ebx + 0x10]
cmp dword [esp + 0xe4], ebx
jne 0x425df1
lea edx, [esp + 0x20]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], bl
mov eax, dword [esi + 0x18]
mov dword [esp + 0x34], esp
cmp eax, ebp
jb 0x425cdb
mov ecx, dword [edi]
jmp 0x425cdd
mov ecx, edi
cmp ecx, 0x4575b8
ja 0x425d15
cmp eax, ebp
jb 0x425ced
mov ecx, dword [edi]
jmp 0x425cef
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4575b8
jbe 0x425d15
cmp eax, ebp
jb 0x425d02
mov edi, dword [edi]
push ebp
mov eax, 0x4575b8
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d80
jmp 0x425d50
cmp eax, ebp
jae 0x425d25
mov ecx, dword [esi + 0x14]
push ecx
push ebp
mov ecx, esi
call fcn.004034b0
mov ecx, dword [esi + 0x18]
cmp ecx, ebp
jb 0x425d30
mov eax, dword [edi]
jmp 0x425d32
mov eax, edi
push ebp
push 0x4575b8
push ecx
push eax
call fcn.00439429
add esp, 0x10
mov dword [esi + 0x14], ebp
cmp dword [esi + 0x18], ebp
jb 0x425d4c
mov edi, dword [edi]
mov byte [edi + 0x10], 0
lea esi, [esp + 0x60]
call fcn.004016b0
mov byte [esp + 0x534], 0xb
call fcn.00401770
mov byte [esp + 0x530], 0xc
cmp dword [eax + 0x18], ebp
jb 0x425d78
mov edx, dword [eax + 4]
jmp 0x425d7b
lea edx, [eax + 4]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x425d80
sub eax, esi
push eax
push edx
lea ecx, [esp + 0xd8]
call fcn.004030c0
cmp dword [esp + 0x38], ebp
jb 0x425daa
mov edx, dword [esp + 0x24]
push edx
call fcn.004393c9
add esp, 4
lea esi, [esp + 0x40]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], 0
call fcn.00429e20
call fcn.00417430
sub eax, 1
jne 0x425dd8
call fcn.00419a90
call fcn.00419b40
call fcn.00435460
push ebx
mov dword [esp + 0x534], 4
call fcn.0043a6c4
add esp, 4
cmp dword [esp + 0xac], ebx
jne 0x425f1c
lea eax, [esp + 0x20]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x34], esp
cmp eax, ebp
jb 0x425e27
mov ecx, dword [edi]
jmp 0x425e29
mov ecx, edi
cmp ecx, str.B8__a
ja 0x425e61
cmp eax, ebp
jb 0x425e39
mov ecx, dword [edi]
jmp 0x425e3b
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, str.B8__a
jbe 0x425e61
cmp eax, ebp
jb 0x425e4e
mov edi, dword [edi]
push ebp
mov eax, str.B8__a
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d80
jmp 0x425e9c
cmp eax, ebp
jae 0x425e71
mov ecx, dword [esi + 0x14]
push ecx
push ebp
mov ecx, esi
call fcn.004034b0
mov ecx, dword [esi + 0x18]
cmp ecx, ebp
jb 0x425e7c
mov eax, dword [edi]
jmp 0x425e7e
mov eax, edi
push ebp
push str.B8__a
push ecx
push eax
call fcn.00439429
add esp, 0x10
mov dword [esi + 0x14], ebp
cmp dword [esi + 0x18], ebp
jb 0x425e98
mov edi, dword [edi]
mov byte [edi + 0x10], 0
lea esi, [esp + 0x60]
call fcn.004016b0
mov byte [esp + 0x534], 0xf
call fcn.00401930
mov byte [esp + 0x530], 0x10
cmp dword [eax + 0x18], ebp
jb 0x425ec4
mov edx, dword [eax + 4]
jmp 0x425ec7
lea edx, [eax + 4]
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x425ed0
sub eax, esi
push eax
push edx
lea ecx, [esp + 0xa0]
call fcn.004030c0
cmp dword [esp + 0x38], ebp
jb 0x425efa
mov edx, dword [esp + 0x24]
push edx
call fcn.004393c9
add esp, 4
lea esi, [esp + 0x40]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], 0
mov byte [esp + 0x530], 4
call fcn.00429e20
cmp dword [esp + 0xc8], ebx
jne 0x42605f
lea eax, [esp + 0x20]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x34], esp
cmp eax, ebp
jb 0x425f52
mov ecx, dword [edi]
jmp 0x425f54
mov ecx, edi
cmp ecx, 0x4575e0
ja 0x425f8d
cmp eax, ebp
jb 0x425f64
mov ecx, dword [edi]
jmp 0x425f66
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4575e0
jbe 0x425f8d
cmp eax, ebp
jb 0x425f79
mov edi, dword [edi]
push 8
mov eax, 0x4575e0
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d80
jmp 0x425fcf
cmp eax, 8
jae 0x425f9f
mov ecx, dword [esi + 0x14]
push ecx
push 8
mov ecx, esi
call fcn.004034b0
mov ecx, dword [esi + 0x18]
cmp ecx, ebp
jb 0x425faa
mov eax, dword [edi]
jmp 0x425fac
mov eax, edi
push 8
push 0x4575e0
push ecx
push eax
call fcn.00439429
add esp, 0x10
mov dword [esi + 0x14], 8
cmp dword [esi + 0x18], ebp
jb 0x425fcb
mov edi, dword [edi]
mov byte [edi + 8], 0
lea esi, [esp + 0x60]
call fcn.004016b0
mov byte [esp + 0x534], 0x11
call fcn.00401ca0
mov byte [esp + 0x530], 0x12
cmp dword [eax + 0x18], ebp
jb 0x425ff7
mov edx, dword [eax + 4]
jmp 0x425ffa
lea edx, [eax + 4]
mov eax, edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x426000
sub eax, esi
push eax
push edx
lea ecx, [esp + 0xbc]
call fcn.004030c0
cmp dword [esp + 0x38], ebp
jb 0x42602a
mov edx, dword [esp + 0x24]
push edx
call fcn.004393c9
add esp, 4
lea esi, [esp + 0x40]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], 0
mov byte [esp + 0x530], 4
call fcn.00429e20
call fcn.00435460
test eax, eax
je 0x42605f
call fcn.00417ea0
call fcn.00418970
mov eax, dword [esp + 0xd4]
cmp dword [esp + 0xe8], ebp
jae 0x426076
lea eax, [esp + 0xd4]
push eax
call sub.WS2_32.dll_gethostbyname
mov esi, eax
call fcn.00417500
sub eax, 1
jne 0x426092
call fcn.00418970
call fcn.00418100
cmp esi, ebx
jne 0x426120
cmp dword [esp + 0xcc], ebp
jb 0x4260b3
mov eax, dword [esp + 0xb8]
push eax
call fcn.004393c9
add esp, 4
mov esi, 0xf
mov dword [esp + 0xcc], esi
mov dword [esp + 0xc8], ebx
mov byte [esp + 0xb8], 0
cmp dword [esp + 0xb0], ebp
jb 0x4260e7
mov ecx, dword [esp + 0x9c]
push ecx
call fcn.004393c9
add esp, 4
mov dword [esp + 0xb0], esi
mov dword [esp + 0xac], ebx
mov byte [esp + 0x9c], 0
cmp dword [esp + 0xe8], ebp
jb 0x426116
mov edx, dword [esp + 0xd4]
push edx
call fcn.004393c9
add esp, 4
mov eax, 0x80004005
jmp 0x42637c
mov esi, 0xf
xor edi, edi
mov dword [esp + 0x104], esi
mov dword [esp + 0x100], edi
mov byte [esp + 0xf0], 0
lea eax, [esp + 0xec]
push eax
sub esp, 0x1c
mov ecx, esp
mov bl, 0x13
mov byte [esp + 0x550], bl
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push edi
lea edx, [esp + 0xdc]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], edi
push edx
mov byte [ecx + 4], 0
call fcn.00402d80
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0x56c], 0x14
mov dword [esp + 0x54], esp
push 0xffffffffffffffff
push edi
lea eax, [esp + 0xdc]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], edi
push eax
mov byte [ecx + 4], 0
call fcn.00402d80
mov byte [esp + 0x56c], bl
call fcn.00433240
cmp eax, edi
jge 0x42628b
mov eax, dword [esp + 0xb8]
cmp dword [esp + 0xcc], ebp
jae 0x4261c7
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0xa0]
cmp dword [esp + 0xb4], ebp
jae 0x4261df
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0x28]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x3f
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], edi
push 0x4575f0
mov byte [ecx + 4], 0
call fcn.004030c0
lea esi, [esp + 0x68]
call fcn.004016b0
mov byte [esp + 0x53c], 0x15
call fcn.00401770
mov byte [esp + 0x538], 0x16
cmp dword [eax + 0x18], ebp
jb 0x42622c
mov eax, dword [eax + 4]
jmp 0x42622f
add eax, 4
mov edx, dword [esp + 0x44]
push eax
push 1
push edx
call fcn.0041d220
add esp, 0x14
lea ecx, [esp + 0x20]
call fcn.00402bd0
lea esi, [esp + 0x40]
call fcn.00429e20
lea ecx, [esp + 0xec]
call fcn.00402bd0
lea ecx, [esp + 0xb4]
call fcn.00402bd0
lea ecx, [esp + 0x98]
call fcn.00402bd0
lea ecx, [esp + 0xd0]
call fcn.00402bd0
mov eax, 0x80004005
jmp 0x42637c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x45460f
call fcn.00404230
sub esp, 0x1c
mov byte [esp + 0x568], 0x17
lea eax, [esp + 0x124]
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
call fcn.00402ba0
mov ebp, dword [esp + 0x74]
lea esi, [ebp + 0x18]
mov ecx, esi
mov byte [esp + 0x568], bl
call fcn.00431fe0
mov edi, eax
call fcn.00435460
sub eax, 1
jne 0x4262e7
call fcn.00419c10
call fcn.00419ce0
xor ebx, ebx
cmp edi, ebx
jl 0x426251
mov dword [esp + 0x120], 0xf
mov dword [esp + 0x11c], ebx
mov byte [esp + 0x10c], bl
lea ecx, [esp + 0x108]
mov eax, esi
mov byte [esp + 0x530], 0x18
call fcn.00432860
lea ecx, [esp + 0x108]
test eax, eax
jge 0x426335
call fcn.00402bd0
jmp 0x426251
mov dword [ebp + 0x39c], 1
mov dword [ebp + 0x3a0], ebx
call fcn.00402bd0
lea ecx, [esp + 0xec]
call fcn.00402bd0
lea ecx, [esp + 0xb4]
call fcn.00402bd0
lea ecx, [esp + 0x98]
call fcn.00402bd0
lea ecx, [esp + 0xd0]
call fcn.00402bd0
xor eax, eax
mov ecx, dword [esp + 0x528]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.00438dc1
add esp, 0x520
ret