Function at 0x425ec0
Capabilities:
Contain obfuscated stackstrings
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x521edf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
mov ecx, esi
call fcn.0050611d
xor ebx, ebx
mov dword [esp + 0x2c], ebx
mov dword [esi + 0xd0], 0x53cfb4
lea eax, [esi + 0xe8]
push eax
mov dword [esi], 0x540888
mov dword [esi + 0xd0], 0x540884
mov byte [esi + 0xdc], bl
mov dword [esi + 0xe0], ebx
call fcn.00413720
mov dword [esi + 0x1400], 0xf
mov dword [esi + 0x13fc], ebx
mov byte [esi + 0x13ec], bl
mov dword [esi + 0x1408], ebx
mov dword [esi + 0x140c], ebx
mov dword [esi + 0x1410], ebx
push ebx
lea ecx, [esi + 0x1414]
push ecx
mov byte [esp + 0x34], 3
call fcn.0040f2d0
mov dword [esi + 0x14e4], ebx
mov dword [esi + 0x14e8], ebx
mov dword [esi + 0x14ec], ebx
mov dword [esi + 0x14f4], ebx
mov dword [esi + 0x14f8], ebx
mov dword [esi + 0x14fc], ebx
mov dword [esi + 0x1504], ebx
mov dword [esi + 0x1508], ebx
mov dword [esi + 0x150c], ebx
mov dword [esi + 0x1514], ebx
mov dword [esi + 0x1518], ebx
mov dword [esi + 0x151c], ebx
mov dword [esi + 0x1524], ebx
mov dword [esi + 0x1528], ebx
mov dword [esi + 0x152c], ebx
mov dword [esi + 0x1534], ebx
mov dword [esi + 0x1538], ebx
mov dword [esi + 0x153c], ebx
mov byte [esp + 0x2c], 0xa
lea edi, [esi + 0x1560]
mov ecx, edi
mov dword [esi + 0x1548], ebx
mov dword [esi + 0x155c], 0xffffffff
call fcn.004f7562
mov dword [edi], 0x53bc60
mov dword [edi + 0x50], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x54], vtable.CBitmap.0
mov ebp, 3
mov dword [edi + 0x74], ebp
mov dword [edi + 0x88], ebx
mov dword [edi + 0x8c], ebx
mov dword [edi + 0x78], ebx
mov dword [edi + 0x7c], 1
mov dword [edi + 0x80], 2
mov dword [edi + 0x84], ebp
lea edi, [esi + 0x15f8]
mov ecx, edi
mov byte [esp + 0x2c], 0xb
call fcn.004f7562
mov dword [edi], 0x53bc60
mov dword [edi + 0x50], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x54], vtable.CBitmap.0
mov dword [edi + 0x74], ebp
mov dword [edi + 0x88], ebx
mov dword [edi + 0x8c], ebx
mov dword [edi + 0x78], ebx
mov dword [edi + 0x7c], 1
mov dword [edi + 0x80], 2
mov dword [edi + 0x84], ebp
lea edi, [esi + 0x1690]
mov ecx, edi
mov byte [esp + 0x2c], 0xc
call fcn.004f7562
mov dword [edi], 0x53bc60
mov dword [edi + 0x50], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x54], vtable.CBitmap.0
mov dword [edi + 0x74], ebp
mov dword [edi + 0x88], ebx
mov dword [edi + 0x8c], ebx
mov dword [edi + 0x78], ebx
mov dword [edi + 0x7c], 1
mov dword [edi + 0x80], 2
mov dword [edi + 0x84], ebp
lea edi, [esi + 0x1728]
mov ecx, edi
mov byte [esp + 0x2c], 0xd
call fcn.004f7562
mov dword [edi], 0x53bc60
mov dword [edi + 0x50], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x54], vtable.CBitmap.0
mov dword [edi + 0x74], ebp
mov dword [edi + 0x88], ebx
mov dword [edi + 0x8c], ebx
mov dword [edi + 0x78], ebx
mov dword [edi + 0x7c], 1
mov dword [edi + 0x80], 2
mov dword [edi + 0x84], ebp
lea edi, [esi + 0x17c0]
mov ecx, edi
mov byte [esp + 0x2c], 0xe
call fcn.004f7562
mov dword [edi], 0x53bc60
mov dword [edi + 0x50], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x54], vtable.CBitmap.0
mov dword [edi + 0x74], ebp
mov dword [edi + 0x88], ebx
mov dword [edi + 0x8c], ebx
mov dword [edi + 0x78], ebx
mov dword [edi + 0x7c], 1
mov dword [edi + 0x80], 2
mov dword [edi + 0x84], ebp
lea edi, [esi + 0x1858]
mov ecx, edi
mov byte [esp + 0x2c], 0xf
call fcn.004f7562
mov dword [edi], 0x53bc60
mov dword [edi + 0x50], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x54], vtable.CBitmap.0
mov dword [edi + 0x74], 4
mov dword [edi + 0x88], ebx
mov dword [edi + 0x8c], ebx
mov dword [edi + 0x78], ebx
mov dword [edi + 0x7c], 1
mov dword [edi + 0x80], 2
mov dword [edi + 0x84], ebp
lea edi, [esi + 0x18f0]
mov ecx, edi
mov byte [esp + 0x2c], 0x10
call fcn.004f7562
mov dword [edi], 0x53bc60
mov dword [edi + 0x50], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x54], vtable.CBitmap.0
mov dword [edi + 0x74], 4
mov dword [edi + 0x88], ebx
mov dword [edi + 0x8c], ebx
mov dword [edi + 0x78], ebx
mov dword [edi + 0x7c], 1
mov dword [edi + 0x80], 2
mov dword [edi + 0x84], ebp
lea edi, [esi + 0x1988]
mov ecx, edi
mov byte [esp + 0x2c], 0x11
call fcn.004f7562
mov dword [edi], 0x53bc60
mov dword [edi + 0x50], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x54], vtable.CBitmap.0
mov dword [edi + 0x74], 4
mov dword [edi + 0x88], ebx
mov dword [edi + 0x8c], ebx
mov dword [edi + 0x78], ebx
mov dword [edi + 0x7c], 1
mov dword [edi + 0x80], 2
mov dword [edi + 0x84], ebp
lea edi, [esi + 0x1a20]
mov ecx, edi
mov byte [esp + 0x2c], 0x12
call fcn.004f7562
mov dword [edi], 0x53bc60
mov dword [edi + 0x50], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x54], vtable.CBitmap.0
mov dword [edi + 0x74], 4
mov dword [edi + 0x88], ebx
mov dword [edi + 0x8c], ebx
mov dword [edi + 0x78], ebx
mov dword [edi + 0x7c], 1
mov dword [edi + 0x80], 2
mov dword [edi + 0x84], ebp
mov byte [esp + 0x2c], 0x13
push ebx
lea edx, [esi + 0x1b28]
push edx
mov dword [esi + 0x1ab8], ebx
mov dword [esi + 0x1acc], ebx
mov dword [esi + 0x1ad0], ebx
mov dword [esi + 0x1ad4], ebx
mov dword [esi + 0x1ad8], ebx
mov dword [esi + 0x1ae4], ebx
mov dword [esi + 0x1ae8], ebx
mov dword [esi + 0x1aec], ebx
mov dword [esi + 0x1af0], ebx
mov dword [esi + 0x1afc], ebx
mov dword [esi + 0x1b08], ebx
mov dword [esi + 0x1b0c], ebx
call fcn.00498dc0
push ebx
lea eax, [esi + 0x1d7c]
push eax
mov byte [esp + 0x34], 0x14
call fcn.00475f70
push ebx
lea ecx, [esi + 0x20cc]
push ecx
mov byte [esp + 0x34], 0x15
call fcn.0040ca90
push ebx
lea edx, [esi + 0x2150]
push edx
mov byte [esp + 0x34], 0x16
call fcn.004866a0
mov byte [esp + 0x2c], 0x17
push ebx
lea eax, [esi + 0x2294]
push eax
call fcn.004058d0
push ebx
lea ecx, [esi + 0x235c]
push ecx
mov byte [esp + 0x34], 0x18
call fcn.004058d0
push ebx
lea edx, [esi + 0x2424]
push edx
mov byte [esp + 0x34], 0x19
call fcn.0040cfe0
push ebx
lea eax, [esi + 0x258c]
push eax
mov byte [esp + 0x34], 0x1a
call fcn.0049aa40
push ebx
lea ecx, [esi + 0x29c8]
push ecx
mov byte [esp + 0x34], 0x1b
call fcn.0049a5f0
mov dword [esi + 0x2a88], 0x525338
mov dword [esi + 0x2a8c], ebx
push ebx
lea edx, [esi + 0x2a90]
push edx
mov byte [esp + 0x34], 0x1d
call fcn.0040f2d0
mov dword [esi + 0x2b9c], ebx
mov dword [esi + 0x2ba0], ebx
mov dword [esi + 0x2ba4], ebx
mov dword [esi + 0x2bac], ebx
mov dword [esi + 0x2bb0], ebx
mov dword [esi + 0x2bb4], ebx
mov dword [esi + 0x2bbc], ebx
mov dword [esi + 0x2bc0], ebx
mov dword [esi + 0x2bc4], ebx
mov dword [esi + 0x2bcc], ebx
mov dword [esi + 0x2bd0], ebx
mov dword [esi + 0x2bd4], ebx
lea ecx, [esi + 0x2bd8]
mov byte [esp + 0x2c], 0x22
call fcn.004f4c7d
mov dword [esi + 0x2fb4], ebx
mov dword [esi + 0x2fb8], ebx
mov dword [esi + 0x2fbc], ebx
mov dword [esi + 0x2fc4], ebx
mov dword [esi + 0x2fc8], ebx
mov dword [esi + 0x2fcc], ebx
mov dword [esi + 0x3114], ebx
mov dword [esi + 0x3118], ebx
mov dword [esi + 0x311c], ebx
mov byte [esp + 0x2c], 0x26
push ebx
lea eax, [esi + 0x3140]
mov dword [esi + 0x3120], ebx
mov dword [esi + 0x3124], ebx
mov dword [esi + 0x3128], ebx
mov dword [esi + 0x312c], ebx
mov dword [esi + 0x3130], ebx
mov dword [esi + 0x3134], ebx
mov byte [esi + 0x3138], bl
mov byte [esi + 0x3139], bl
mov dword [esi + 0x313c], ebx
push eax
call fcn.0041ad10
push ebx
lea ecx, [esi + 0x55f8]
push ecx
mov byte [esp + 0x34], 0x27
call fcn.00487e10
push ebx
lea edx, [esi + 0x6154]
push edx
mov byte [esp + 0x34], 0x28
call fcn.0041a7c0
push ebx
lea eax, [esi + 0x62cc]
push eax
mov byte [esp + 0x34], 0x29
call fcn.0041a4b0
push ebx
lea ecx, [esi + 0x6340]
push ecx
mov byte [esp + 0x34], 0x2a
call fcn.004854e0
mov dword [esi + 0x662c], ebx
mov dword [esi + 0x6634], ebx
mov dword [esi + 0x6638], ebx
mov dword [esi + 0x663c], ebx
mov byte [esp + 0x2c], 0x2c
mov dword [esi + 0x6640], ebx
mov dword [esi + 0x6644], ebx
mov dword [esi + 0x6648], ebx
call fcn.004c9600
mov dword [esi + 0x6650], eax
mov dword [esi + 0x6654], ebx
mov dword [esi + 0x6660], ebx
mov dword [esi + 0x6664], ebx
mov dword [esi + 0x6668], ebx
mov byte [esi + 0x666c], bl
mov edi, 0xf
mov dword [esi + 0x668c], edi
mov dword [esi + 0x6688], ebx
mov byte [esi + 0x6678], bl
mov dword [esi + 0x66b0], edi
mov dword [esi + 0x66ac], ebx
mov byte [esi + 0x669c], bl
mov byte [esp + 0x2c], 0x2e
mov dword [esi + 0x66c8], 0xf953
call fcn.0045af50
mov dword [esi + 0x66e0], eax
mov byte [eax + 0x21], 1
mov eax, dword [esi + 0x66e0]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x66e0]
mov dword [eax], eax
mov eax, dword [esi + 0x66e0]
mov dword [eax + 8], eax
mov dword [esi + 0x66e4], ebx
mov dword [esi + 0x670c], ebx
mov dword [esi + 0x6710], ebx
mov dword [esi + 0x6714], ebx
mov dword [esi + 0x671c], ebx
mov dword [esi + 0x6720], ebx
mov dword [esi + 0x6724], ebx
mov byte [esp + 0x2c], 0x31
call fcn.004cf960
mov dword [esi + 0x6730], eax
mov byte [eax + 0x15], 1
mov eax, dword [esi + 0x6730]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x6730]
mov dword [eax], eax
mov eax, dword [esi + 0x6730]
mov dword [eax + 8], eax
mov dword [esi + 0x6734], ebx
mov dword [esi + 0x6754], edi
mov dword [esi + 0x6750], ebx
mov byte [esi + 0x6740], bl
mov byte [esp + 0x2c], 0x33
call fcn.0045b350
mov dword [esi + 0x675c], eax
mov byte [eax + 0x19], 1
mov eax, dword [esi + 0x675c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x675c]
mov dword [eax], eax
mov eax, dword [esi + 0x675c]
mov dword [eax + 8], eax
mov dword [esi + 0x6760], ebx
mov eax, dword [0x56b5dc]
inc eax
mov dword [esi + 0x6764], 0x540880
mov dword [esi + 0x686c], ebx
mov dword [esi + 0x6870], ebx
mov dword [esi + 0x6874], ebx
mov dword [esi + 0x6878], ebx
mov dword [esi + 0x687c], ebx
mov dword [esi + 0x6880], ebx
mov byte [esi + 0x6884], 1
mov dword [0x56b5dc], eax
mov byte [esi + 0x6768], bl
mov dword [esi + 0x688c], ebx
mov dword [esi + 0x6890], ebx
mov dword [esi + 0x6894], ebx
mov byte [esp + 0x2c], 0x36
mov byte [esi + 0x6898], bl
mov byte [esi + 0x68a0], bl
call fcn.004cf960
mov dword [esi + 0x68ac], eax
mov byte [eax + 0x15], 1
mov eax, dword [esi + 0x68ac]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x68ac]
mov dword [eax], eax
mov eax, dword [esi + 0x68ac]
mov dword [eax + 8], eax
mov dword [esi + 0x68b0], ebx
mov byte [esp + 0x2c], 0x37
call fcn.004cf960
mov dword [esi + 0x68b8], eax
mov byte [eax + 0x15], 1
mov eax, dword [esi + 0x68b8]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x68b8]
mov dword [eax], eax
mov eax, dword [esi + 0x68b8]
mov dword [eax + 8], eax
mov dword [esi + 0x68bc], ebx
mov byte [esi + 0x68c0], bl
mov dword [esi + 0x68c8], ebx
mov dword [esi + 0x68cc], ebx
mov dword [esi + 0x68d0], ebx
mov byte [esp + 0x2c], 0x39
call fcn.004cf960
mov dword [esi + 0x68d8], eax
mov byte [eax + 0x15], 1
mov eax, dword [esi + 0x68d8]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x68d8]
mov dword [eax], eax
mov eax, dword [esi + 0x68d8]
mov dword [eax + 8], eax
mov dword [esi + 0x68dc], ebx
mov dword [esi + 0x68e0], 0xffffffff
mov byte [esi + 0x68e4], bl
mov byte [esi + 0x68e5], bl
mov dword [esi + 0x6900], edi
mov dword [esi + 0x68fc], ebx
mov byte [esi + 0x68ec], bl
mov dword [esi + 0x691c], edi
mov dword [esi + 0x6918], ebx
mov byte [esi + 0x6908], bl
mov byte [esp + 0x2c], 0x3c
mov byte [esi + 0x6920], 1
mov dword [esi + 0x50], ebx
mov dword [esi + 0x6658], ebx
mov dword [esi + 0x665c], ebx
mov edx, dword [0x56bf2c]
mov dword [0x56bb0c], ebx
mov dword [esi + 0x1558], edx
mov eax, dword [0x56bf2c]
push 0x800
mov dword [esi + 0x1550], eax
mov dword [esi + 0x1554], ebx
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x3d
je 0x4267e1
push eax
call fcn.004061f0
jmp 0x4267e3
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0x108
mov dword [esi + 0x1abc], eax
call fcn.004fa746
mov ebp, eax
add esp, 4
mov dword [esp + 0x1c], ebp
cmp ebp, ebx
mov byte [esp + 0x2c], 0x3e
je 0x426832
mov ecx, ebp
call fcn.004a8eac
mov dword [ebp], 0x53daf0
mov byte [ebp + 0xe8], bl
mov dword [ebp + 0x104], edi
mov dword [ebp + 0x100], ebx
mov byte [ebp + 0xf0], bl
jmp 0x426834
xor ebp, ebp
mov byte [esp + 0x2c], 0x3c
push 0x51c
mov dword [esi + 0x1ac0], ebp
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x3f
je 0x426861
push eax
call fcn.00486bd0
jmp 0x426863
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0x844
mov dword [esi + 0x1ac4], eax
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x40
je 0x426891
push ebx
push eax
call fcn.004a16b0
jmp 0x426893
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0x138
mov dword [esi + 0x1ac8], eax
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x41
je 0x4268c0
push eax
call fcn.00417150
jmp 0x4268c2
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0x8c
mov dword [esi + 0x1acc], eax
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x42
je 0x4268ef
push eax
call fcn.00414490
jmp 0x4268f1
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0x8c
mov dword [esi + 0x1ad0], eax
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x43
je 0x42691e
push eax
call fcn.00414490
jmp 0x426920
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0x8c
mov dword [esi + 0x1ad4], eax
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x44
je 0x42694d
push eax
call fcn.00414490
jmp 0x42694f
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0xe8
mov dword [esi + 0x1ad8], eax
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x45
je 0x42697c
push eax
call fcn.00477440
jmp 0x42697e
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0x154
mov dword [esi + 0x1af4], eax
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x46
je 0x4269ab
push eax
call fcn.00490a20
jmp 0x4269ad
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0xf0
mov dword [esi + 0x1afc], eax
call fcn.004fa746
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
cmp edi, ebx
mov byte [esp + 0x2c], 0x47
je 0x4269e9
mov ecx, edi
call fcn.004a8eac
mov dword [edi], 0x543840
mov dword [edi + 0xe8], ebx
jmp 0x4269eb
xor edi, edi
mov byte [esp + 0x2c], 0x3c
push 0xf0
mov dword [esi + 0x1b00], edi
call fcn.004fa746
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
cmp edi, ebx
mov byte [esp + 0x2c], 0x48
je 0x426a27
mov ecx, edi
call fcn.004a8eac
mov dword [edi], 0x543840
mov dword [edi + 0xe8], ebx
jmp 0x426a29
xor edi, edi
mov byte [esp + 0x2c], 0x3c
push 0x788
mov dword [esi + 0x1b04], edi
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x49
je 0x426a56
push eax
call fcn.0047b4e0
jmp 0x426a58
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0x1c8
mov dword [esi + 0x1b08], eax
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x4a
je 0x426a86
push ebx
push eax
call fcn.0047a350
jmp 0x426a88
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0xf0
mov dword [esi + 0x1b10], eax
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x4b
je 0x426ab6
push ebx
push eax
call fcn.0049c6e0
jmp 0x426ab8
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0x218
mov dword [esi + 0x1b14], eax
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x4c
je 0x426ae5
push eax
call fcn.00471330
jmp 0x426ae7
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0x46c
mov dword [esi + 0x1b0c], eax
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x4d
je 0x426b15
push ebx
push eax
call fcn.004191a0
jmp 0x426b17
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0x8c
mov dword [esi + 0x1b18], eax
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x4e
je 0x426b44
push eax
call fcn.00414490
jmp 0x426b46
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0x8c
mov dword [esi + 0x1ae4], eax
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x4f
je 0x426b73
push eax
call fcn.00414490
jmp 0x426b75
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0x8c
mov dword [esi + 0x1ae8], eax
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x50
je 0x426ba2
push eax
call fcn.00414490
jmp 0x426ba4
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0x8c
mov dword [esi + 0x1aec], eax
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x51
je 0x426bd1
push eax
call fcn.00414490
jmp 0x426bd3
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0x134
mov dword [esi + 0x1af0], eax
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x52
je 0x426c00
push eax
call fcn.0040bf60
jmp 0x426c02
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0x1c4
mov dword [esi + 0x1af8], eax
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x53
je 0x426c60
mov ecx, dword [esi + 0x1aec]
mov edx, dword [esi + 0x1ae8]
push ecx
mov ecx, dword [esi + 0x1ae4]
push edx
mov edx, dword [esi + 0x1ad8]
push ecx
mov ecx, dword [esi + 0x1ad4]
push edx
mov edx, dword [esi + 0x1ad0]
push ecx
mov ecx, dword [esi + 0x1acc]
push edx
push ecx
push eax
call fcn.0048f360
jmp 0x426c62
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0xf0
mov dword [esi + 0x1b1c], eax
call fcn.004fa746
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x2c], 0x54
je 0x426cb2
mov edx, dword [esi + 0x1b08]
mov ecx, dword [esi + 0x1b10]
push edx
mov edx, dword [esi + 0x1b04]
push ecx
mov ecx, dword [esi + 0x1b00]
push edx
mov edx, dword [esi + 0x1b18]
push ecx
push edx
push eax
call fcn.0046f030
jmp 0x426cb4
xor eax, eax
mov byte [esp + 0x2c], 0x3c
push 0xa4
mov dword [esi + 0x1b20], eax
call fcn.004fa746
mov edi, eax
add esp, 4
mov dword [esp + 0x20], edi
cmp edi, ebx
mov byte [esp + 0x2c], 0x55
je 0x426d26
mov ecx, dword [esi + 0x1afc]
mov eax, dword [esi + 0x1af4]
mov edx, dword [esi + 0x1af8]
mov ebp, dword [esi + 0x1b0c]
mov dword [esp + 0x18], ecx
mov ecx, edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edx
call fcn.004f7562
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [edi], 0x5454b8
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], ecx
mov dword [edi + 0x58], edx
mov dword [edi + 0x5c], ebp
jmp 0x426d28
xor edi, edi
push 0xa
push ebx
push 0x21
push 0x10
mov byte [esp + 0x3c], 0x3c
push 0x10
lea ecx, [esi + 0x2bd8]
mov dword [esi + 0x1b24], edi
call fcn.004f4ded
push 0xe
push 0x542e04
lea ecx, [esi + 0x673c]
mov dword [esi + 0x6738], ebx
call fcn.00401b10
mov eax, dword [esi + 0x6634]
cmp eax, ebx
je 0x426d72
push eax
call fcn.004fa776
add esp, 4
mov ecx, dword [esp + 0x24]
pop edi
mov dword [esi + 0x6634], ebx
mov dword [esi + 0x6638], ebx
mov dword [esi + 0x663c], ebx
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4