Function at 0x426f29
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ac
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x428389
lea eax, [ebp + 0x24]
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x178], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x130], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x198]
movzx eax, byte [eax]
test eax, eax
je 0x42703d
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x12c]
movzx eax, byte [eax]
test eax, eax
je 0x426fcc
mov byte [ebp - 0x13], 0
movzx eax, byte [ebp - 0x13]
test eax, eax
je 0x426fca
push 0xf30
call dword [sym.imp.KERNEL32.dll_TlsFree]
jmp 0x427038
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
movzx eax, byte [eax]
test eax, eax
je 0x427038
push 1
push 0x1af6
push 0x5f3e
push 0x490
push 0x3371
push 1
push 0x6a7f
push 0x6ca2
push 0x26fd
push 0x37b
push 0x5db5
push 0x5eb8
push 0xc39
push 1
push 1
call fcn.00412695
add esp, 0x3c
jmp 0x428387
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x138]
movzx eax, byte [eax]
test eax, eax
je 0x4270a0
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x42709b
push 1
push 1
push 0x5ad3
push 1
push 1
call fcn.004129a2
add esp, 0x14
jmp 0x428387
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x104], 1
mov dword [ebp - 0x108], 0x7bf0b96c
mov dword [ebp - 0xf4], 6
mov dword [ebp - 0x64], 9
push 1
lea ecx, [ebp - 0x218]
call fcn.004359e4
push 0x9a
push 0
push 0xe12
lea eax, [ebp - 0x228]
push eax
push 1
lea eax, [ebp - 0x218]
push eax
push 0
push 0x2474
push 0x3a2
call fcn.0041fb47
add esp, 0x24
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x108], 0
je 0x4271bd
mov dword [ebp - 0x1a0], 0x315362da
mov dword [ebp - 0x148], 0xfa32a17d
push 1
push 0x208f
push 0xba7
push 0x4d61
push 0x19cd
lea eax, [ebp - 0x148]
push eax
push 0x31be
lea eax, [ebp - 0x108]
push eax
push 0x1997
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0xf4]
push eax
push 0x3b03
push 0
push 0x6066
push 0x2f89
lea eax, [ebp - 0x64]
push eax
push 0x53d6
push 0
push 0xc13
push 1
call fcn.0041e332
add esp, 0x50
jmp 0x42724e
push 0x7a8b
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0x139e
push 1
push 0x5554
push 0x4cb8
lea eax, [ebp - 0xf4]
push eax
push 0x30b7
push 0x3b2d
push 0x481b
push 0
push 1
push 0x7440
push 0x3e53
call fcn.00415629
add esp, 0x40
push 1
push 0x29c9
push 0x23ad
push 0
push 0x28fa
push 0x696c
push 1
push 0x6714
push 0x325a
push 0x562f
push 1
push 0x15ce
push 0x5d1b
push 0x5e18
call fcn.00416360
add esp, 0x38
lea ecx, [ebp - 0x218]
call fcn.00435ab6
mov eax, dword [ebp - 0x40]
mov eax, dword [eax + 4]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x24], 9
push 3
lea ecx, [ebp - 0x1d0]
call fcn.004359e4
mov dword [ebp - 0x23c], 0xfffffff9
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x158], 0x9a1f
mov dword [ebp - 0x258], 0xfffffff7
mov dword [ebp - 0x260], 0x93f07ca
lea eax, [ebp - 0x1d0]
push eax
push 0
push 0x3f66
push 0
lea eax, [ebp - 0x268]
push eax
push 0x7353
call fcn.0042f2a2
add esp, 0x18
xor eax, eax
inc eax
je 0x4276d4
mov dword [ebp - 0x34], 0x5459eeda
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x3c], 0
jmp 0x4272fd
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x427310
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x30], 1
jmp 0x4272f6
mov dword [ebp - 4], 0
jmp 0x427320
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jg 0x4276c4
mov dword [ebp - 0x58], 0xfffffff6
mov dword [ebp - 0xd4], 0xffffffff
mov dword [ebp - 0xfc], 0xfffc
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x60], 3
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x30]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x30], 0
je 0x42738a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
je 0x42738a
mov dword [ebp - 0x6c], 1
jmp 0x42738e
and dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
sub eax, 0x7363
je 0x4273b9
cmp dword [ebp - 4], 0
je 0x4273b9
mov eax, 0x1d77f172
test eax, eax
je 0x4273b9
mov dword [ebp - 0xbc], 1
jmp 0x4273c0
and dword [ebp - 0xbc], 0
cmp dword [ebp - 0xbc], 0xffff
je 0x4273d5
mov dword [ebp - 0x74], 1
jmp 0x4273d9
and dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 1
jl 0x4273ef
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x4273ef
and dword [ebp - 0xe4], 0
jmp 0x4273f9
mov dword [ebp - 0xe4], 1
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x58], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 4]
cmp dword [ebp + eax - 0x30], ecx
jl 0x42741d
mov dword [ebp - 0x150], 1
jmp 0x427424
and dword [ebp - 0x150], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x18]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x30]
cmp eax, dword [ebp - 4]
jne 0x427454
mov dword [ebp - 0x7c], 1
jmp 0x427458
and dword [ebp - 0x7c], 0
mov dword [ebp - 0x34], 0xf644accb
mov eax, dword [ebp - 0x7c]
add eax, 0xda73
cmp dword [ebp - 0x34], eax
jg 0x427478
mov dword [ebp - 0xc4], 1
jmp 0x42747f
and dword [ebp - 0xc4], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x30]
cmp eax, dword [ebp - 0xc4]
jge 0x42749a
mov dword [ebp - 0x84], 1
jmp 0x4274a1
and dword [ebp - 0x84], 0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x84]
cmp eax, 0x5a27557b
jne 0x4274ba
mov dword [ebp - 0x5c], 1
jmp 0x4274be
and dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x288], eax
cmp dword [ebp - 4], 0
je 0x4275e9
cmp dword [ebp - 0x34], 0x1ede
jg 0x4274ec
mov dword [ebp - 0x8c], 1
jmp 0x4274f3
and dword [ebp - 0x8c], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x30]
sub eax, dword [ebp - 0x8c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
add eax, 0xfff8
neg eax
jne 0x427524
cmp dword [ebp - 0x18], 0
jne 0x427524
and dword [ebp - 0xcc], 0
jmp 0x42752e
mov dword [ebp - 0xcc], 1
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x30]
cmp dword [ebp - 0xcc], eax
jge 0x427549
mov dword [ebp - 0x94], 1
jmp 0x427550
and dword [ebp - 0x94], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x94], eax
jl 0x42756c
or eax, 0xffffffff
je 0x42756c
mov dword [ebp - 0x48], 1
jmp 0x427570
and dword [ebp - 0x48], 0
push 1
lea ecx, [ebp - 0x1d0]
call fcn.00435ad2
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x54], eax
jne 0x42759c
mov dword [ebp - 0xec], 1
jmp 0x4275a3
and dword [ebp - 0xec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
cmp dword [ebp - 0xec], eax
jge 0x4275c1
mov dword [ebp - 0x9c], 1
jmp 0x4275c8
and dword [ebp - 0x9c], 0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x9c]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0xd4], 0
jne 0x427600
xor eax, eax
inc eax
jne 0x427600
mov eax, 0xa13e
test eax, eax
jne 0x427600
and dword [ebp - 0xa4], 0
jmp 0x42760a
mov dword [ebp - 0xa4], 1
cmp dword [ebp - 0xa4], 0xde8b
jl 0x427622
mov dword [ebp - 0xac], 1
jmp 0x427629
and dword [ebp - 0xac], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0xac], eax
je 0x427643
mov dword [ebp - 0xdc], 1
jmp 0x42764a
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0xdc]
sub eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x18]
je 0x427664
mov dword [ebp - 0xb4], 1
jmp 0x42766b
and dword [ebp - 0xb4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x30]
add eax, dword [ebp - 0xb4]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
sub eax, 0xf466
cmp eax, 0xfff6
jbe 0x427696
mov dword [ebp - 0x68], 1
jmp 0x42769a
and dword [ebp - 0x68], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x68]
sub ecx, dword [ebp + eax*4 - 0x30]
cmp ecx, dword [ebp - 4]
jle 0x4276b2
mov dword [ebp - 0x70], 1
jmp 0x4276b6
and dword [ebp - 0x70], 0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x70]
mov dword [ebp - 0x24], eax
jmp 0x427319
push 1
push 0
call fcn.00429b61
pop ecx
pop ecx
jmp 0x427845
mov dword [ebp - 0x298], 0x505b3ea
mov dword [ebp - 0x230], 0x4000348e
mov dword [ebp - 0x26c], 0xfffffffd
mov dword [ebp - 0x238], 0xfa7f9cd9
mov dword [ebp - 0x294], 5
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0x240], 0x4a1f699d
push 2
lea ecx, [ebp - 0x200]
call fcn.004359e4
mov dword [ebp - 0x190], 1
mov dword [ebp - 0x274], 0xfffffffa
mov dword [ebp - 0x160], 7
push 0x3219
push 0x2674
push 0x6c65
push 0
push 0
push 1
lea eax, [ebp - 0x200]
push eax
push 0x4612
lea eax, [ebp - 0x248]
push eax
push 0x2639
push 0x2bff
push 0x3b62
push 0x22ca
push 0x6a65
push 0x23d7
call fcn.00410bd7
add esp, 0x3c
push 0
push 0
push 0x11a6
push 0x2184
push 1
push 0x49d6
push 0x4e03
push 0x15a1
push 0x218f
push 1
push 0x6212
push 0
push 0x349b
push 0x16ad
push 0x69b0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1d0]
push eax
push 0x3964
call fcn.0040e2f8
add esp, 0x48
lea eax, [ebp - 0x1d0]
push eax
lea eax, [ebp - 0x158]
push eax
push 0x61da
push 1
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x190]
push eax
push 0
push 0x192e
push 0x3770
push 0x34fb
push 0x4598
lea eax, [ebp - 0x200]
push eax
push 0
push 1
call fcn.004107de
add esp, 0x3c
lea ecx, [ebp - 0x200]
call fcn.00435ab6
lea ecx, [ebp - 0x1d0]
call fcn.00435ab6
push 1
lea ecx, [ebp - 0x224]
call fcn.004359e4
mov dword [ebp - 0x1c], 0x4896
mov dword [ebp - 0x114], 0x6928694a
mov dword [ebp - 0x168], 0xffffffff
push 0
lea eax, [ebp - 0x224]
push eax
push 0
push 0x41f2
push 0x7448
lea eax, [ebp - 0x28c]
push eax
push 0x2aea
push 0x6890
call fcn.004292fa
add esp, 0x20
push 1
push 0x65fa
push 0x7b47
push 0x521e
push 0x69fd
push 0x680f
push 1
push 0
push 0x7182
push 0
push 1
push 1
push 0x2240
push 1
lea eax, [ebp - 0x1c]
push eax
call fcn.004205dd
add esp, 0x3c
mov dword [ebp - 0x1c], 0
jmp 0x4278f3
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jg 0x4279c8
mov dword [ebp - 0x118], 1
push 2
lea ecx, [ebp - 0x20c]
call fcn.004359e4
lea eax, [ebp - 0x254]
push eax
push 0
push 0x2297
push 0x6fd6
push 0x1ab6
push 1
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x6666
push 0x52ed
push 0x76e8
push 1
push 0x1ea6
push 0x23e5
push 0
call fcn.0042e39d
add esp, 0x3c
push 0
push 0
push 0x5abf
lea eax, [ebp - 0x168]
push eax
push 1
push 0x2b83
push 0x3ec6
push 0x4993
lea eax, [ebp - 0x224]
push eax
push 1
lea eax, [ebp - 0x1c]
push eax
push 1
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
push 0x515e
push 0x4ebf
push 0x2898
lea eax, [ebp - 0x20c]
push eax
call fcn.0040e2f8
add esp, 0x48
lea ecx, [ebp - 0x20c]
call fcn.00435ab6
jmp 0x4278ec
lea ecx, [ebp - 0x224]
call fcn.00435ab6
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x124], 4
mov dword [ebp - 0x110], 0xffffffff
mov dword [ebp - 0x134], 0x6c2e7ccc
mov dword [ebp - 0x13c], 0x2f3ccd24
push 0x2d35
push 0
push 0x5bc4
push 1
push 0
push 0
push 1
push 0x7aec
push 0x59f7
push 0x33b5
push 0x218c
push 0x5cac
call fcn.004215b1
add esp, 0x30
push 0
lea eax, [ebp - 0x124]
push eax
push 0x42ae
lea eax, [ebp - 0x110]
push eax
push 0x2693
push 0x5d80
lea eax, [ebp - 0x134]
push eax
push 0
lea eax, [ebp - 0x13c]
push eax
push 1
push 0x6b86
call fcn.00409e9f
add esp, 0x2c
and dword [ebp - 0x4c], 0
jmp 0x427a99
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x10]
add eax, 0x28
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x4c], eax
jge 0x428387
mov dword [ebp - 0x78], 0xffffffff
mov dword [ebp - 0xc], 0x457102d1
mov dword [ebp - 0xa0], 0xffffffff
mov dword [ebp - 0xd0], 7
cmp dword [ebp - 0x78], 0
je 0x427b7f
push 1
push 0x669f
push 0x6a54
push 0
lea eax, [ebp - 0xc]
push eax
push 0x4a24
push 0x1f96
push 0x6390
push 0
lea eax, [ebp - 0x78]
push eax
push 0x61da
push 0x4c26
push 0
push 0x6c07
call fcn.0042a8ca
add esp, 0x38
mov byte [ebp - 0x12], 0
push 0x6b1e
push 1
push 0x1b6f
push 0x4af1
push 0x2cc2
push 0x566
push 0
push 0
push 0x6468
push 0x4e78
push 0x6397
push 0x79f0
push 0
push 0x3250
lea eax, [ebp - 0x12]
push eax
push 0x706f
push 0x52f4
push 0x7166
push 0x3bf3
push 0x548c
call fcn.0042f8ff
add esp, 0x50
jmp 0x427d90
mov dword [ebp - 8], 0
jmp 0x427b8f
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x427ba5
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1c0], 0xfffffff9
jmp 0x427b88
mov dword [ebp - 8], 0
jmp 0x427bb5
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x427bcb
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x2ac], 0xf20920a6
jmp 0x427bae
push 0x52e9
push 0x401
push 0x4f80
push 1
push 0x7e3f
push 0x2f9f
push 0
push 1
call fcn.0041216f
add esp, 0x20
mov dword [ebp - 0xc], 0
jmp 0x427c02
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jg 0x427d90
mov dword [ebp - 0x90], 0x520ea0c8
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x27c], eax
xor eax, eax
cmp eax, 0x6758e356
je 0x427c34
mov dword [ebp - 0x80], 1
jmp 0x427c38
and dword [ebp - 0x80], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2ac]
cmp dword [ebp - 0x80], eax
jle 0x427c56
mov dword [ebp - 0x88], 1
jmp 0x427c5d
and dword [ebp - 0x88], 0
cmp dword [ebp - 0x88], 3
jb 0x427c72
mov dword [ebp - 0x98], 1
jmp 0x427c79
and dword [ebp - 0x98], 0
mov eax, dword [ebp - 0x90]
imul eax, dword [ebp - 0x98]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xc], eax
je 0x427ca3
mov dword [ebp - 0xa8], 1
jmp 0x427caa
and dword [ebp - 0xa8], 0
cmp dword [ebp - 0xa8], 0x89a5
jne 0x427cc2
mov dword [ebp - 0xb8], 1
jmp 0x427cc9
and dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x1c0]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x1c0], ecx
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0xb8]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x2ac]
cmp eax, 0xfbb9
jl 0x427d16
mov dword [ebp - 0xc0], 1
jmp 0x427d1d
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0xc0]
add eax, 0xfffb
jne 0x427d43
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x1c0], 0
jne 0x427d43
mov dword [ebp - 0xc8], 1
jmp 0x427d4a
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xd0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xd0]
mov dword [ebp + eax - 0x2ac], ecx
push 0x643b
push 1
push 0x1439
push 0x7609
push 1
push 0x2b14
push 0
call fcn.0041231b
add esp, 0x1c
jmp 0x427bfb
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x10], 0
jne 0x427f11
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x14c], 0xaa6e6f7
mov dword [ebp - 0x44], 0xfffffff2
jmp 0x427dbe
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffee
jl 0x427e91
mov dword [ebp - 0x38], 0
jmp 0x427dd8
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x427dee
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1e8], 0
jmp 0x427dd1
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1e8], 0
jmp 0x427e19
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e8]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1e8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1e8], 9
jle 0x427e8c
mov dword [ebp - 0x144], 1
push 1
push 0x7e3e
push 1
push 0x66e1
push 0x4ef9
push 0x1267
push 0x35ff
push 0
push 0
push 0x1849
push 0x57b9
push 0x218d
push 0x55f5
push 0x45f8
push 0x9a4
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.0040bb2e
add esp, 0x44
jmp 0x427e00
jmp 0x427db7
push 0
push 1
push 0x3fed
push 0x39e7
lea eax, [ebp - 0x10]
push eax
push 0x5552
lea eax, [ebp - 0xd8]
push eax
push 0
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x50]
push eax
push 0x9df
push 0x126b
push 0
push 0x1cef
call fcn.0042c500
add esp, 0x38
push 1
push 0x434e
push 1
push 0x742
push 1
push 0xe27
push 0x5b86
push 0
push 0xcf6
push 0
push 0x1976
push 0
push 0x212b
call fcn.00421895
add esp, 0x34
jmp 0x427a89
push 4
push 0x1000
mov eax, dword [ebp - 0x10]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xd8]
add ecx, dword [eax + 0xc]
push ecx
push 0x72ad
push 0x6595
call fcn.00406e86
pop ecx
pop ecx
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x10]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x15c]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x50]
call fcn.0040772e
add esp, 0xc
mov dword [ebp - 0x164], 0xdcec
mov dword [ebp - 0xe0], 0xfffffffa
mov dword [ebp - 0x194], 0xe31d8329
mov dword [ebp - 0x18c], 0xfffffff8
push 3
lea ecx, [ebp - 0x1b0]
call fcn.004359e4
mov dword [ebp - 0x25c], 4
mov dword [ebp - 0x174], 0x711e7bff
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x184], 0x7a912e75
push 0x7b9b
push 0x135e
push 0x4da5
push 0x6f45
push 0x5ce8
push 1
push 0x3880
lea eax, [ebp - 0x29c]
push eax
push 0x4ac4
push 0x38a7
push 0
push 0x5684
push 1
lea eax, [ebp - 0x1b0]
push eax
push 0x45e2
push 0x63f4
push 0x4985
push 0x2122
call fcn.00417f8a
add esp, 0x48
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
je 0x4280dc
mov dword [ebp - 0x264], 0xfffffffb
mov dword [ebp - 0x16c], 0xffffffff
mov dword [ebp - 0x17c], 4
mov dword [ebp - 0x284], 4
mov dword [ebp - 0x22c], 2
lea eax, [ebp - 0x20]
push eax
push 1
push 0x48f4
push 0x2efe
lea eax, [ebp - 0x16c]
push eax
push 0x6ddc
push 0x53a8
lea eax, [ebp - 0x174]
push eax
push 0x1bea
push 0x6d8f
push 0x6e5f
push 0
push 0x4aa4
push 0x5e77
push 0x6db
push 0x6369
lea eax, [ebp - 0x1b0]
push eax
push 0x344e
push 0x792a
push 0
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x184]
push eax
call fcn.0041fd09
add esp, 0x58
jmp 0x42831e
push 2
lea ecx, [ebp - 0x1f4]
call fcn.004359e4
push 0x7345
push 0x113e
lea eax, [ebp - 0x28]
push eax
push 1
push 1
push 0x20ff
push 0
lea eax, [ebp - 0x1f4]
push eax
push 0x3e5b
push 0x1c37
push 0x54f1
push 0x73e3
push 0x2e08
push 0
push 0x5405
push 1
push 1
call fcn.0041c77e
add esp, 0x44
mov dword [ebp - 0x28], 0
jmp 0x428145
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x42815b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x250], 0xf6a1241a
jmp 0x42813e
mov dword [ebp - 0x20], 0xfffffff5
jmp 0x42816b
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff5
jl 0x4282ce
push 1
lea ecx, [ebp - 0x1dc]
call fcn.004359e4
lea eax, [ebp - 0x1dc]
push eax
push 0x142d
push 0x199f
push 1
push 0x68d2
push 1
push 0x1325
lea eax, [ebp - 0x234]
push eax
push 0x1e05
push 0x37f0
push 0x1b
push 0x1fa3
push 0
push 0
push 0x14be
push 0x5c30
call fcn.00415629
add esp, 0x40
cmp dword [ebp - 0x18c], 0
je 0x4281ea
mov eax, 0xe3d2f551
test eax, eax
jne 0x4281ea
and dword [ebp - 0xe8], 0
jmp 0x4281f4
mov dword [ebp - 0xe8], 1
cmp dword [ebp - 0x194], 0xffff
jne 0x42820c
mov dword [ebp - 0x19c], 1
jmp 0x428213
and dword [ebp - 0x19c], 0
push 0
lea ecx, [ebp - 0x1dc]
call fcn.00435ad2
push 0
lea ecx, [ebp - 0x1f4]
call fcn.00435ad2
mov ecx, dword [ebp - 0xe8]
cmp ecx, dword [eax]
je 0x428243
mov dword [ebp - 0xf0], 1
jmp 0x42824a
and dword [ebp - 0xf0], 0
cmp dword [ebp - 0xf0], 1
jg 0x42825f
mov dword [ebp - 0xf8], 1
jmp 0x428266
and dword [ebp - 0xf8], 0
push 0
lea ecx, [ebp - 0x1dc]
call fcn.00435ad2
mov ecx, dword [ebp - 0xf8]
cmp ecx, dword [eax]
jg 0x4282a4
push 2
lea ecx, [ebp - 0x1b0]
call fcn.00435ad2
cmp dword [eax], 0
je 0x4282a4
mov eax, 0xd49acb08
test eax, eax
je 0x4282a4
mov dword [ebp - 0x100], 1
jmp 0x4282ab
and dword [ebp - 0x100], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x100]
mov dword [ebp + eax - 0x250], ecx
lea ecx, [ebp - 0x1dc]
call fcn.00435ab6
jmp 0x428164
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1b0]
push eax
push 0x5d00
push 0x17d2
push 0x561
push 1
push 0
push 0x5360
push 0x43a1
push 0x5385
push 0
push 1
push 0
push 0x6b5
push 0x34b
call fcn.004093ae
add esp, 0x3c
lea ecx, [ebp - 0x1f4]
call fcn.00435ab6
lea ecx, [ebp - 0x1b0]
call fcn.00435ab6
push 0
push 0x22fc
push 0x4a33
push 0x4f2d
lea eax, [ebp - 0x50]
push eax
push 0x24c5
push 1
push 0x34b6
push 0x2422
push 0x2a42
lea eax, [ebp - 0x10]
push eax
push 0x74d1
push 0x1f79
push 0x1892
push 0
push 0x7e99
push 0x17a6
push 1
push 0x6ea6
call fcn.00420ca1
add esp, 0x4c
jmp 0x427a89
jmp 0x428391
push 0
call fcn.0040876c
pop ecx
mov esp, ebp
pop ebp
ret