Function at 0x4681b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f9dee
mov eax, dword fs:[0]
push eax
sub esp, 0x83c
mov eax, dword [0x6b7e40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], 0
jne 0x4681ff
push 0xa
push str.solidworks
lea ecx, [ebp + 0xc]
call fcn.00402090
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
jne 0x468267
lea edx, [ebp + 0xc]
lea ecx, [ebp + 8]
call fcn.0042ef40
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
jne 0x468267
lea edx, [eax - 0x10]
or ebx, 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [edx + 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x46823c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x46825d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 0xfffffffc
jmp 0x468fed
push 0x63bfdc
lea ecx, [ebp - 0x7f4]
call fcn.004021e0
push str.TryNowSerial
lea ecx, [ebp - 0x7fc]
mov byte [ebp - 4], 2
call fcn.004021e0
push str.SoftwareSolidWorksIM
lea ecx, [ebp - 0x804]
mov byte [ebp - 4], 3
call fcn.004021e0
mov byte [ebp - 4], 4
xor eax, eax
mov word [ebp - 0x7e0], ax
lea eax, [ebp - 0x7f0]
push eax
push 0x20019
push 0
push dword [ebp - 0x804]
mov dword [ebp - 0x808], 0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x824], 0x7d0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x468349
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x7e0]
push eax
lea eax, [ebp - 0x808]
push eax
push 0
push dword [ebp - 0x7fc]
push dword [ebp - 0x7f0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x7f0]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x468349
lea ecx, [ebp - 0x7e0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x468327
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x7e0]
push eax
lea ecx, [ebp - 0x7f4]
call fcn.00402090
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x804]
add edx, 0xfffffff0
or ebx, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x46836f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x7fc]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x468392
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x7f4]
cmp dword [eax - 0xc], 0
je 0x468436
mov ecx, dword [ebp + 8]
xor edx, edx
test ecx, ecx
setne dl
test edx, edx
jne 0x4683ba
push 0x80004005
call fcn.00402040
push ecx
push eax
call fcn.005be8d5
add esp, 8
test eax, eax
jne 0x468436
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x7f4]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4683eb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46840b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x46842c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 0xfffffffe
jmp 0x468fed
call fcn.004364e0
lea ecx, [ebp - 0x844]
mov dword [ebp - 0x7f0], eax
call fcn.00434ff0
push str.GetEntitlement.aspx
push eax
lea eax, [ebp - 0x7f8]
push eax
mov byte [ebp - 4], 5
call fcn.004067b0
add esp, 0xc
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x844]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x468488
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.004046f0
add eax, 0x10
add esp, 4
lea ecx, [ebp - 0x818]
mov dword [esi], eax
call fcn.004365b0
add esp, 4
lea eax, [ebp - 0x810]
push eax
mov ecx, 0x6c2000
mov byte [ebp - 4], 8
call fcn.004457a0
lea eax, [ebp - 0x820]
push eax
lea ecx, [edi + 0x58]
mov byte [ebp - 4], 9
call fcn.004465e0
lea ecx, [ebp - 0x81c]
mov byte [ebp - 4], 0xa
call fcn.0041c5c0
mov byte [ebp - 4], 0xb
call fcn.004a4516
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x468504
push 0x80004005
call fcn.00402040
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x80c], eax
lea ecx, [ebp - 0x824]
mov byte [ebp - 4], 0xc
call fcn.00419000
mov ecx, eax
mov byte [ebp - 4], 0xd
call fcn.00419220
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x824]
add edx, 0xfffffff0
movzx esi, ax
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x468554
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push esi
lea eax, [ebp - 0x80c]
push 0x641d0c
push eax
call fcn.00404520
add esp, 0xc
lea ecx, [ebp - 0x814]
call fcn.0043f750
mov byte [ebp - 4], 0xe
call fcn.004a4516
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x468594
push 0x80004005
call fcn.00402040
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x804], eax
push 0
push 0
lea eax, [ebp - 0x804]
push str._d:_d
push eax
mov byte [ebp - 4], 0xf
call fcn.00404520
add esp, 0x10
call fcn.004a4516
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4685dc
push 0x80004005
call fcn.00402040
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x7fc], eax
push 0x3e7
lea eax, [ebp - 0x7fc]
push 0x641d0c
push eax
mov byte [ebp - 4], 0x10
call fcn.00404520
add esp, 0xc
call fcn.004a4516
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x468625
push 0x80004005
call fcn.00402040
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x7e4], eax
push 0x63bfdc
push 0x63bfdc
push 0x63bfdc
mov byte [ebp - 4], 0x11
mov edi, dword [ebp - 0x7fc]
mov ebx, dword [ebp - 0x804]
push 0x63bfdc
push edi
push ebx
push dword [ebp - 0x814]
lea eax, [ebp - 0x7e4]
push dword [ebp - 0x80c]
push dword [ebp - 0x81c]
push dword [ebp - 0x820]
push dword [ebp + 0xc]
push dword [ebp - 0x810]
push dword [ebp - 0x7f0]
push dword [ebp - 0x818]
push str._serial_number_sdebug_dversion_sproduct_srtp_sosa_slid_sapp_scx_scm_slfr_slfp_slfv_s_s
push eax
call fcn.00404520
mov eax, dword [ebp - 0x7e4]
add esp, 0x3c
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.004046f0
add eax, 0x10
add esp, 4
mov edx, 4
lea ecx, [ebp - 0x824]
mov dword [esi], eax
call fcn.00440960
add esp, 4
push eax
lea ecx, [ebp - 0x7e4]
mov byte [ebp - 4], 0x12
call fcn.00404570
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x824]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4686fc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x6463b8
push 0x63c0a0
lea ecx, [ebp - 0x7e4]
call fcn.00411ec0
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x7f8]
push eax
lea eax, [ebp - 0x800]
push eax
call fcn.004066f0
add esp, 0xc
lea eax, [ebp - 0x7f0]
push eax
mov ecx, 0x6c1f28
mov byte [ebp - 4], 0x13
call fcn.00402500
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x7f0]
add eax, 0xfffffff0
push eax
mov dword [ebp - 0x824], eax
call fcn.004046f0
add eax, 0x10
add esp, 4
mov dword [ebp - 0x808], eax
push 0
mov dl, 1
lea ecx, [ebp - 0x808]
mov byte [ebp - 4], 0x15
call fcn.0041a520
add esp, 4
call fcn.004a4516
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46879a
push 0x80004005
call fcn.00402040
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x7e8], eax
mov byte [ebp - 4], 0x16
push dword [ebp + 8]
mov esi, dword [ebp - 0x808]
push esi
lea eax, [ebp - 0x7e8]
push str._sSubscriptionInfo__s.xml
push eax
call fcn.00404520
add esp, 0x10
lea ecx, [ebp - 0x7ec]
push 0x63bfdc
call fcn.004021e0
push ecx
lea eax, [ebp - 0x7ec]
push eax
lea edx, [ebp - 0x7e8]
lea ecx, [ebp - 0x800]
mov byte [ebp - 4], 0x17
call fcn.0040a940
add esp, 8
test al, al
jne 0x468a6f
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x7ec]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x468828
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x7e8]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46884c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov ecx, esi
lea eax, [edx + 0xc]
mov byte [ebp - 4], 0x14
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46886c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x824]
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46888c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x800]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4688af
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x7e4]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4688d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov ecx, esi
lea eax, [edi + 0xc]
mov byte [ebp - 4], 0xf
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4688ef
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov ecx, esi
lea eax, [ebx + 0xc]
mov byte [ebp - 4], 0xe
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46890c
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x814]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46892f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x80c]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x468952
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x81c]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x468975
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x820]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x468998
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x810]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4689bb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x818]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4689de
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x7f8]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x468a01
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x7f4]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x468a24
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x468a44
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x468a65
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 0xfffffffb
jmp 0x468fed
push 0x63bfdc
lea ecx, [ebp - 0x83c]
mov byte [ebp - 0x840], 0
call fcn.004021e0
mov byte [ebp - 4], 0x18
push 0x63bfdc
lea ecx, [ebp - 0x834]
mov byte [ebp - 0x838], 0
call fcn.004021e0
mov dword [ebp - 0x830], 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x840]
push eax
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x7ec]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x828], esp
push eax
call fcn.004046f0
mov ecx, dword [ebp - 0x828]
add eax, 0x10
add esp, 4
mov dword [ecx], eax
call fcn.004481c0
test al, al
jne 0x468af7
lea ecx, [ebp - 0x840]
call fcn.00469010
jmp 0x468804
lea ecx, [ebp - 0x844]
call fcn.00434ff0
push str.GetEntitlementEx.aspx
push eax
lea eax, [ebp - 0x828]
push eax
mov byte [ebp - 4], 0x1a
call fcn.004067b0
add esp, 0xc
push eax
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x1b
call fcn.00404570
mov byte [ebp - 4], 0x1a
mov edx, dword [ebp - 0x828]
add edx, 0xfffffff0
or ebx, 0xffffffff
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x468b51
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0x844]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x468b74
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x7f8]
push eax
lea eax, [ebp - 0x828]
push eax
call fcn.004066f0
add esp, 0xc
push eax
lea ecx, [ebp - 0x800]
mov byte [ebp - 4], 0x1c
call fcn.00404570
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0x828]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x468bc2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp + 8]
lea eax, [ebp - 0x7e8]
push esi
push str._sSubscriptionInfoEx__s.xml
push eax
call fcn.00404520
add esp, 0xc
lea eax, [ebp - 0x7ec]
push eax
lea edx, [ebp - 0x7e8]
lea ecx, [ebp - 0x800]
call fcn.0040a940
add esp, 8
test al, al
jne 0x468cd2
lea ecx, [ebp - 0x840]
call fcn.00469010
lea ecx, [ebp - 0x7ec]
call fcn.00401020
lea ecx, [ebp - 0x7e8]
call fcn.00401020
lea ecx, [ebp - 0x808]
call fcn.00401020
lea ecx, [ebp - 0x7f0]
call fcn.00401020
lea ecx, [ebp - 0x800]
call fcn.00401020
lea ecx, [ebp - 0x7e4]
call fcn.00401020
lea ecx, [ebp - 0x7fc]
call fcn.00401020
lea ecx, [ebp - 0x804]
call fcn.00401020
lea ecx, [ebp - 0x814]
call fcn.00401020
lea ecx, [ebp - 0x80c]
call fcn.00401020
lea ecx, [ebp - 0x81c]
call fcn.00401020
lea ecx, [ebp - 0x820]
call fcn.00401020
lea ecx, [ebp - 0x810]
call fcn.00401020
lea ecx, [ebp - 0x818]
call fcn.00401020
lea ecx, [ebp - 0x7f8]
call fcn.00401020
lea ecx, [ebp - 0x7f4]
call fcn.00401020
lea ecx, [ebp + 8]
call fcn.00401020
lea ecx, [ebp + 0xc]
call fcn.00401020
mov eax, 0xfffffffb
jmp 0x468fed
push ecx
lea eax, [ebp - 0x840]
push eax
mov eax, dword [ebp - 0x7ec]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.004046f0
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00448450
test al, al
je 0x468bfd
cmp byte [ebp - 0x840], 0
jne 0x468bfd
cmp byte [ebp - 0x838], 0
jne 0x468df0
lea ecx, [ebp - 0x840]
call fcn.00469010
lea ecx, [ebp - 0x7ec]
call fcn.00401020
lea ecx, [ebp - 0x7e8]
call fcn.00401020
lea ecx, [ebp - 0x808]
call fcn.00401020
lea ecx, [ebp - 0x7f0]
call fcn.00401020
lea ecx, [ebp - 0x800]
call fcn.00401020
lea ecx, [ebp - 0x7e4]
call fcn.00401020
lea ecx, [ebp - 0x7fc]
call fcn.00401020
lea ecx, [ebp - 0x804]
call fcn.00401020
lea ecx, [ebp - 0x814]
call fcn.00401020
lea ecx, [ebp - 0x80c]
call fcn.00401020
lea ecx, [ebp - 0x81c]
call fcn.00401020
lea ecx, [ebp - 0x820]
call fcn.00401020
lea ecx, [ebp - 0x810]
call fcn.00401020
lea ecx, [ebp - 0x818]
call fcn.00401020
lea ecx, [ebp - 0x7f8]
call fcn.00401020
lea ecx, [ebp - 0x7f4]
call fcn.00401020
lea ecx, [ebp + 8]
call fcn.00401020
lea ecx, [ebp + 0xc]
call fcn.00401020
mov eax, 0xfffffffe
jmp 0x468fed
mov eax, dword [ebp - 0x834]
cmp dword [eax - 0xc], 0
je 0x468d1b
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.004046f0
add eax, 0x10
add esp, 4
xor edx, edx
lea ecx, [ebp - 0x848]
mov dword [esi], eax
call fcn.0041d860
add esp, 4
lea ecx, [ebp - 0x82c]
call fcn.00407580
push dword [ebp - 0x828]
lea ecx, [ebp - 0x848]
push dword [ebp - 0x82c]
call fcn.00476090
lea ecx, [ebp - 0x840]
test al, al
je 0x468f23
call fcn.00469010
lea ecx, [ebp - 0x7ec]
call fcn.00401020
lea ecx, [ebp - 0x7e8]
call fcn.00401020
lea ecx, [ebp - 0x808]
call fcn.00401020
lea ecx, [ebp - 0x7f0]
call fcn.00401020
lea ecx, [ebp - 0x800]
call fcn.00401020
lea ecx, [ebp - 0x7e4]
call fcn.00401020
lea ecx, [ebp - 0x7fc]
call fcn.00401020
lea ecx, [ebp - 0x804]
call fcn.00401020
lea ecx, [ebp - 0x814]
call fcn.00401020
lea ecx, [ebp - 0x80c]
call fcn.00401020
lea ecx, [ebp - 0x81c]
call fcn.00401020
lea ecx, [ebp - 0x820]
call fcn.00401020
lea ecx, [ebp - 0x810]
call fcn.00401020
lea ecx, [ebp - 0x818]
call fcn.00401020
lea ecx, [ebp - 0x7f8]
call fcn.00401020
lea ecx, [ebp - 0x7f4]
call fcn.00401020
lea ecx, [ebp + 8]
call fcn.00401020
lea ecx, [ebp + 0xc]
call fcn.00401020
mov eax, 0xfffffffd
jmp 0x468fed
call fcn.00469010
lea ecx, [ebp - 0x7ec]
call fcn.00401020
lea ecx, [ebp - 0x7e8]
call fcn.00401020
lea ecx, [ebp - 0x808]
call fcn.00401020
lea ecx, [ebp - 0x7f0]
call fcn.00401020
lea ecx, [ebp - 0x800]
call fcn.00401020
lea ecx, [ebp - 0x7e4]
call fcn.00401020
lea ecx, [ebp - 0x7fc]
call fcn.00401020
lea ecx, [ebp - 0x804]
call fcn.00401020
lea ecx, [ebp - 0x814]
call fcn.00401020
lea ecx, [ebp - 0x80c]
call fcn.00401020
lea ecx, [ebp - 0x81c]
call fcn.00401020
lea ecx, [ebp - 0x820]
call fcn.00401020
lea ecx, [ebp - 0x810]
call fcn.00401020
lea ecx, [ebp - 0x818]
call fcn.00401020
lea ecx, [ebp - 0x7f8]
call fcn.00401020
lea ecx, [ebp - 0x7f4]
call fcn.00401020
lea ecx, [ebp + 8]
call fcn.00401020
lea ecx, [ebp + 0xc]
call fcn.00401020
mov eax, 3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bc16b
mov esp, ebp
pop ebp
ret 8