Function at 0x41f2f9
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xd
add esp, 0xfffff004
push eax
dec eax
jne 0x41f302
mov eax, dword [ebp - 4]
add esp, 0xfffff258
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0xd368], edx
mov dword [ebp - 0xd364], eax
lea esi, [ebp - 0xd330]
lea edi, [ebp - 0xd360]
mov eax, 0x493e88
call fcn.00482ea0
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0xd36c], edx
mov dword [ebp - 0xd370], ecx
mov byte [ebp - 0xd371], 0
mov word [edi + 0x10], 8
mov edx, dword [ebp - 0xd364]
lea eax, [ebp - 0x6998]
call fcn.00403b30
add dword [edi + 0x1c], 9
mov word [edi + 0x10], 0x14
mov word [edi + 0x10], 0x20
mov eax, esi
mov edx, dword [ebp - 0xd364]
call fcn.00403b30
add dword [edi + 0x1c], 9
mov word [edi + 0x10], 0x14
lea eax, [ebp - 0x6998]
mov ecx, ebx
mov edx, dword [ebp - 0xd368]
call fcn.00408c4c
mov byte [ebp - 0x6987], 1
push 0x493d29
lea eax, [ebp - 0xd798]
push eax
call fcn.00482a00
add esp, 8
mov eax, dword [ebp - 0xd368]
call fcn.0040a924
push eax
lea edx, [ebp - 0xd798]
push edx
call fcn.00482924
add esp, 8
push 0x493d30
lea ecx, [ebp - 0xdb98]
push ecx
call fcn.00482a00
add esp, 8
mov eax, dword [ebp - 0xd368]
call fcn.0040a924
push eax
lea edx, [ebp - 0xdb98]
push edx
call fcn.00482924
add esp, 8
lea ecx, [ebp - 0xd372]
mov edx, esi
push 0
push 0
push ecx
push 0x80000000
push 0
push 0
lea ecx, [ebp - 0xd798]
mov eax, dword [ebp - 0xd364]
call fcn.0040a4fc
test al, al
jne 0x41f54b
cmp byte [ebp - 0xd372], 0
jne 0x41f460
mov eax, 0x49e7d8
mov edx, 9
call fcn.00427738
lea edx, [ebp - 0xd798]
mov eax, 0x49e7d8
call fcn.004276d0
xor eax, eax
mov edx, 2
mov al, byte [ebp - 0xd372]
cmp eax, 1
sbb eax, eax
neg eax
push eax
lea eax, [esi + 0x4fd4]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
call fcn.00401780
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0x42cc]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
lea eax, [esi + 0x13bc]
mov edx, 2
call fcn.00422cbc
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0xe6c]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
mov eax, esi
xor edx, edx
call fcn.00408b08
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x19c4]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x26cc]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
lea eax, [ebp - 0x55dc]
mov edx, 2
call fcn.00422cbc
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x5b2c]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
lea eax, [ebp - 0x6998]
xor edx, edx
call fcn.00408b08
pop eax
mov edx, dword [edi]
mov dword fs:[0], edx
jmp 0x42032b
lea ecx, [ebp - 0xd798]
mov eax, 0x267
push ecx
call fcn.00410804
push eax
lea edx, [ebp - 0xdd98]
push edx
call fcn.00486578
add esp, 0xc
lea eax, [ebp - 0xdd98]
call fcn.0046c264
mov edx, esi
lea eax, [ebp - 0x6998]
call fcn.0041e03c
mov ebx, eax
cmp ebx, 2
jne 0x41f674
mov eax, esi
call fcn.00408db4
mov al, 1
mov edx, 2
push eax
lea eax, [esi + 0x4fd4]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
call fcn.00401780
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0x42cc]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
lea eax, [esi + 0x13bc]
mov edx, 2
call fcn.00422cbc
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0xe6c]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
mov eax, esi
xor edx, edx
call fcn.00408b08
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x19c4]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x26cc]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
lea eax, [ebp - 0x55dc]
mov edx, 2
call fcn.00422cbc
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x5b2c]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
lea eax, [ebp - 0x6998]
xor edx, edx
call fcn.00408b08
pop eax
mov edx, dword [edi]
mov dword fs:[0], edx
jmp 0x42032b
cmp ebx, 1
jne 0x41f7a1
mov eax, esi
call fcn.00408db4
mov edx, dword [ebp - 0xd364]
cmp byte [edx + 0x18c8], 0
jne 0x41f7a1
push 0x24
mov eax, 0x262
call fcn.00410804
push eax
mov eax, 0x275
call fcn.00410804
push eax
push dword [0x4ad5b4]
call sub.USER32.DLL_MessageBoxA
cmp eax, 6
je 0x41f7a1
mov al, 1
mov edx, 2
push eax
lea eax, [esi + 0x4fd4]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
call fcn.00401780
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0x42cc]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
lea eax, [esi + 0x13bc]
mov edx, 2
call fcn.00422cbc
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0xe6c]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
mov eax, esi
xor edx, edx
call fcn.00408b08
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x19c4]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x26cc]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
lea eax, [ebp - 0x55dc]
mov edx, 2
call fcn.00422cbc
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x5b2c]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
lea eax, [ebp - 0x6998]
xor edx, edx
call fcn.00408b08
pop eax
mov edx, dword [edi]
mov dword fs:[0], edx
jmp 0x42032b
test ebx, ebx
jne 0x41f7ac
mov eax, esi
call fcn.00408e40
push 0
push 0
lea eax, [ebp - 0x6998]
xor edx, edx
call fcn.004091a4
push 0
push 0
lea ecx, [ebp - 0xd372]
push ecx
push 0x80000000
push 0
push 0
lea ecx, [ebp - 0xdb98]
mov edx, esi
mov eax, dword [ebp - 0xd364]
call fcn.0040a4fc
test al, al
jne 0x41f8ff
cmp byte [ebp - 0xd372], 0
jne 0x41f814
mov eax, 0x49e7d8
mov edx, 9
call fcn.00427738
lea edx, [ebp - 0xdb98]
mov eax, 0x49e7d8
call fcn.004276d0
xor eax, eax
mov edx, 2
mov al, byte [ebp - 0xd372]
cmp eax, 1
sbb eax, eax
neg eax
push eax
lea eax, [esi + 0x4fd4]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
call fcn.00401780
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0x42cc]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
lea eax, [esi + 0x13bc]
mov edx, 2
call fcn.00422cbc
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0xe6c]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
mov eax, esi
xor edx, edx
call fcn.00408b08
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x19c4]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x26cc]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
lea eax, [ebp - 0x55dc]
mov edx, 2
call fcn.00422cbc
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x5b2c]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
lea eax, [ebp - 0x6998]
xor edx, edx
call fcn.00408b08
pop eax
mov edx, dword [edi]
mov dword fs:[0], edx
jmp 0x42032b
lea eax, [ebp - 0x6998]
call fcn.0040940c
mov dword [ebp - 0xd37c], eax
mov dword [ebp - 0xd378], edx
lea edx, [ebp - 0xdb98]
mov eax, 0x267
push edx
call fcn.00410804
push eax
lea edx, [ebp - 0xdd98]
push edx
call fcn.00486578
add esp, 0xc
lea eax, [ebp - 0xdd98]
call fcn.0046c264
mov byte [ebp - 0xd37d], 0
lea eax, [ebp - 0x6998]
xor edx, edx
call fcn.00403ee8
test al, al
je 0x41fa86
mov byte [ebp - 0xd37d], 1
mov cx, word [ebp - 0x330c]
mov word [esi + 0x368c], cx
mov ax, word [ebp - 0x330a]
mov word [esi + 0x368e], ax
cmp byte [ebp - 0xc2c], 0
je 0x41fa86
mov eax, 0x272
call fcn.00410804
push eax
lea edx, [ebp - 0x6983]
push edx
call fcn.0044142c
add esp, 8
mov al, 1
push eax
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0x4fd4]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0x42cc]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
lea eax, [esi + 0x13bc]
mov edx, 2
call fcn.00422cbc
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0xe6c]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
mov eax, esi
xor edx, edx
call fcn.00408b08
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x19c4]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x26cc]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
lea eax, [ebp - 0x55dc]
mov edx, 2
call fcn.00422cbc
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x5b2c]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
lea eax, [ebp - 0x6998]
xor edx, edx
call fcn.00408b08
pop eax
mov edx, dword [edi]
mov dword fs:[0], edx
jmp 0x42032b
xor ecx, ecx
mov eax, esi
mov dword [esi + 0x3698], ecx
mov edx, 0x72
mov word [esi + 0x3694], cx
and word [esi + 0x368c], 0xff9f
xor ecx, ecx
call fcn.00401afc
mov eax, esi
xor ecx, ecx
mov edx, 0x73
call fcn.00401afc
mov eax, dword [ebp - 0xc3c]
mov edx, dword [ebp - 0xc38]
add eax, 0xd
adc edx, 0
push edx
push eax
lea eax, [ebp - 0x6998]
xor edx, edx
call fcn.004091a4
movzx eax, word [esi + 0x368e]
add eax, 0xfffffff3
cdq
push edx
push eax
mov edx, esi
lea eax, [ebp - 0x6998]
call fcn.004094a0
push 0
push 0
lea eax, [ebp - 0x6998]
xor edx, edx
call fcn.004091a4
mov word [edi + 0x10], 0x2c
lea eax, [ebp - 0xd33c]
mov edx, 0x7918
call fcn.00401a58
inc dword [edi + 0x1c]
mov word [edi + 0x10], 0x14
mov dword [ebp - 0xd388], 0
mov dword [ebp - 0xd384], 0
mov dword [ebp - 0xd390], 0
mov dword [ebp - 0xd38c], 0
lea eax, [ebp - 0x6998]
mov ecx, dword [ebp - 0xd338]
mov edx, dword [ebp - 0xd33c]
call fcn.00409054
mov eax, dword [ebp - 0xd338]
add eax, 0xfffffc18
cdq
add dword [ebp - 0xd390], eax
adc dword [ebp - 0xd38c], edx
mov eax, dword [ebp - 0xd338]
add eax, 0xfffffc18
cdq
push edx
push eax
mov eax, dword [ebp - 0xd388]
mov edx, dword [ebp - 0xd384]
call fcn.00489c70
mov ebx, eax
xor eax, eax
add ebx, dword [ebp - 0xd33c]
xor ecx, ecx
mov word [edi + 0x10], 0x14
mov al, byte [ebx + 2]
xor edx, edx
mov dword [esi + 0x36a0], eax
mov cl, byte [ebx + 0x1b]
mov dl, byte [ebx + 0x1a]
shl ecx, 8
add dx, cx
mov word [esi + 0x36be], dx
cmp dword [esi + 0x36a0], 0x74
jne 0x4200d1
cmp word [esi + 0x36be], 0
jbe 0x4200d1
cmp word [esi + 0x36be], 0x400
jae 0x4200d1
xor edx, edx
xor eax, eax
mov dl, byte [ebx + 1]
mov al, byte [ebx]
shl edx, 8
xor ecx, ecx
add ax, dx
xor edx, edx
mov word [esi + 0x369c], ax
xor eax, eax
mov al, byte [ebx + 4]
mov cl, byte [ebx + 3]
shl eax, 8
add cx, ax
xor eax, eax
mov word [esi + 0x36a4], cx
xor ecx, ecx
mov cl, byte [ebx + 6]
mov dl, byte [ebx + 5]
shl ecx, 8
add dx, cx
xor ecx, ecx
mov word [esi + 0x36a6], dx
xor edx, edx
mov dl, byte [ebx + 8]
mov al, byte [ebx + 7]
shl edx, 8
mov cl, byte [ebx + 9]
add eax, edx
xor edx, edx
mov dl, byte [ebx + 0xa]
shl ecx, 0x10
shl edx, 0x18
add eax, ecx
add eax, edx
xor ecx, ecx
mov dword [esi + 0x36a8], eax
xor eax, eax
mov cl, byte [ebx + 0xc]
mov al, byte [ebx + 0xb]
shl ecx, 8
xor edx, edx
add eax, ecx
mov dl, byte [ebx + 0xd]
xor ecx, ecx
mov cl, byte [ebx + 0xe]
shl edx, 0x10
shl ecx, 0x18
add eax, edx
add eax, ecx
xor edx, edx
mov dword [esi + 0x36ac], eax
xor ecx, ecx
mov al, byte [ebx + 0xf]
mov byte [esi + 0x36b0], al
xor eax, eax
mov dl, byte [ebx + 0x11]
mov al, byte [ebx + 0x10]
shl edx, 8
mov cl, byte [ebx + 0x12]
add eax, edx
xor edx, edx
mov dl, byte [ebx + 0x13]
shl ecx, 0x10
shl edx, 0x18
add eax, ecx
add eax, edx
xor ecx, ecx
mov dword [esi + 0x36b4], eax
xor eax, eax
mov cl, byte [ebx + 0x15]
mov al, byte [ebx + 0x14]
shl ecx, 8
xor edx, edx
add eax, ecx
mov dl, byte [ebx + 0x16]
xor ecx, ecx
mov cl, byte [ebx + 0x17]
shl edx, 0x10
shl ecx, 0x18
add eax, edx
add eax, ecx
xor ecx, ecx
mov dword [esi + 0x36b8], eax
xor edx, edx
mov al, byte [ebx + 0x18]
mov byte [esi + 0x36bc], al
mov al, byte [ebx + 0x19]
mov byte [esi + 0x36bd], al
xor eax, eax
mov cl, byte [ebx + 0x1d]
mov dl, byte [ebx + 0x1c]
shl ecx, 8
mov al, byte [ebx + 0x1e]
add edx, ecx
xor ecx, ecx
mov cl, byte [ebx + 0x1f]
shl eax, 0x10
shl ecx, 0x18
add edx, eax
add edx, ecx
mov dword [esi + 0x36c0], edx
test byte [esi + 0x36a5], 1
je 0x41fd7e
xor eax, eax
xor edx, edx
mov al, byte [ebx + 0x21]
mov dl, byte [ebx + 0x20]
shl eax, 8
xor ecx, ecx
add edx, eax
mov cl, byte [ebx + 0x22]
xor eax, eax
mov al, byte [ebx + 0x23]
shl ecx, 0x10
shl eax, 0x18
add edx, ecx
add edx, eax
xor ecx, ecx
mov dword [esi + 0x36c4], edx
xor edx, edx
mov cl, byte [ebx + 0x25]
mov dl, byte [ebx + 0x24]
shl ecx, 8
xor eax, eax
add edx, ecx
mov al, byte [ebx + 0x26]
xor ecx, ecx
mov cl, byte [ebx + 0x27]
shl eax, 0x10
shl ecx, 0x18
add edx, eax
add edx, ecx
mov dword [esi + 0x36c8], edx
jmp 0x41fd8c
xor edx, edx
mov dword [esi + 0x36c8], edx
mov dword [esi + 0x36c4], edx
mov eax, dword [esi + 0x36c4]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [esi + 0x36a8]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [esi + 0x4370], eax
mov dword [esi + 0x4374], edx
mov eax, dword [esi + 0x36c8]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [esi + 0x36ac]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [esi + 0x4378], eax
mov dword [esi + 0x437c], edx
movzx ecx, word [esi + 0x36be]
push ecx
mov eax, esi
call fcn.00405dec
add eax, ebx
push eax
lea edx, [esi + 0x36cc]
push edx
call fcn.00482810
add esp, 0xc
test byte [esi + 0x36a5], 2
je 0x41fe58
lea eax, [ebp - 0xddac]
call fcn.00410304
lea edx, [esi + 0x36cc]
push edx
call fcn.00482a30
pop ecx
inc eax
movzx ecx, word [esi + 0x36be]
sub ecx, eax
lea edx, [esi + 0x3acc]
push ecx
lea ecx, [esi + 0x36cc]
add ecx, eax
push edx
lea edx, [esi + 0x36cc]
push 0x400
lea eax, [ebp - 0xddac]
call fcn.004105a0
jmp 0x41fe61
mov word [esi + 0x3acc], 0
mov eax, dword [ebp - 0xd37c]
mov edx, dword [ebp - 0xd378]
sub eax, dword [ebp - 0xd388]
sbb edx, dword [ebp - 0xd384]
push edx
push eax
mov eax, esi
call fcn.00405dec
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
movzx eax, word [esi + 0x36be]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, dword [esi + 0x36a8]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x41feb8
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x41ff23
jmp 0x41febc
pop edx
pop eax
jle 0x41ff23
mov eax, dword [ebp - 0xd37c]
mov edx, dword [ebp - 0xd378]
sub eax, dword [ebp - 0xd388]
sbb edx, dword [ebp - 0xd384]
push edx
push eax
mov eax, esi
call fcn.00405dec
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
movzx eax, word [esi + 0x36be]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov dword [ebp - 0xd398], eax
mov dword [ebp - 0xd394], edx
mov eax, dword [ebp - 0xd398]
mov dword [esi + 0x36a8], eax
mov eax, dword [ebp - 0xd394]
mov edx, eax
mov dword [esi + 0x36c4], eax
sar edx, 0x1f
mov eax, esi
call fcn.00405dec
mov ecx, eax
movzx edx, word [esi + 0x36be]
add ecx, edx
add ecx, 0xfffffffe
lea edx, [ebx + 2]
or eax, 0xffffffff
call fcn.0040ef9c
not ax
and ax, 0xffff
lea ecx, [ebp - 0xd371]
mov word [esi + 0x5d7e], ax
mov edx, esi
mov eax, dword [ebp - 0xd364]
call fcn.00420332
test al, al
je 0x4200d1
test byte [esi + 0x36a4], 8
mov bl, 1
je 0x41ffe1
mov eax, esi
call fcn.00405dec
cdq
push edx
push eax
movzx eax, word [esi + 0x36be]
cdq
add eax, dword [ebp - 0xd388]
adc edx, dword [ebp - 0xd384]
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
lea eax, [ebp - 0x6998]
xor edx, edx
call fcn.004091a4
lea eax, [ebp - 0x6998]
call fcn.00404b38
mov eax, esi
call fcn.00405dec
movzx edx, word [esi + 0x36be]
add eax, edx
movzx ecx, word [ebp - 0x1906]
add eax, ecx
movzx edx, word [esi + 0x36a6]
cmp eax, edx
je 0x420004
xor ebx, ebx
jmp 0x420004
movzx eax, word [esi + 0x36a6]
cdq
add eax, dword [ebp - 0xd388]
adc edx, dword [ebp - 0xd384]
push edx
push eax
lea eax, [ebp - 0x6998]
xor edx, edx
call fcn.004091a4
movzx ecx, word [esi + 0x36be]
mov byte [esi + ecx + 0x36cc], 0
call fcn.0040e520
test bl, bl
je 0x4200d1
cmp word [esi + 0x3acc], 0
jne 0x420037
lea eax, [esi + 0x36cc]
mov dl, 1
call fcn.0040b0f8
movzx ecx, word [esi + 0x36a4]
or dword [ebp - 0xd370], ecx
lea eax, [esi + 0x36cc]
call fcn.0040d7dc
push eax
mov eax, 0x268
call fcn.00410804
push eax
lea edx, [ebp - 0xdd98]
push edx
call fcn.00486578
add esp, 0xc
lea eax, [ebp - 0xdd98]
call fcn.0046c264
inc dword [ebp - 0xd36c]
mov eax, esi
xor ecx, ecx
mov edx, 0x74
call fcn.00401afc
test byte [esi + 0x36a4], 8
je 0x4200ba
mov eax, esi
xor ecx, ecx
mov edx, 0x75
call fcn.00401afc
movzx eax, word [ebp - 0x1906]
add eax, 0xfffffff3
cdq
push edx
push eax
mov edx, esi
lea eax, [ebp - 0x6998]
call fcn.004094a0
mov eax, dword [esi + 0x36a8]
xor edx, edx
push edx
push eax
mov edx, esi
lea eax, [ebp - 0x6998]
call fcn.004094a0
add dword [ebp - 0xd388], 1
adc dword [ebp - 0xd384], 0
mov eax, dword [ebp - 0xd37c]
mov edx, dword [ebp - 0xd378]
push edx
push eax
mov eax, esi
call fcn.00405dec
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, dword [ebp - 0xd384]
jne 0x420110
cmp eax, dword [ebp - 0xd388]
ja 0x420112
jmp 0x420189
jle 0x420189
mov eax, dword [ebp - 0xd338]
add eax, 0xfffffc18
cdq
push edx
push eax
mov eax, dword [ebp - 0xd388]
mov edx, dword [ebp - 0xd384]
call fcn.00489c70
cmp edx, 0
jne 0x41fb7c
cmp eax, 0
jne 0x41fb7c
push dword [ebp - 0xd38c]
push dword [ebp - 0xd390]
lea eax, [ebp - 0x6998]
xor edx, edx
call fcn.004091a4
lea eax, [ebp - 0x6998]
mov ecx, dword [ebp - 0xd338]
mov edx, dword [ebp - 0xd33c]
call fcn.00409054
add dword [ebp - 0xd390], 0x7530
adc dword [ebp - 0xd38c], 0
jmp 0x41fb7c
test byte [ebp - 0xd370], 3
je 0x42019a
or word [esi + 0x368c], 1
cmp dword [ebp - 0xd36c], 0
jle 0x4201eb
cmp byte [ebp - 0xd37d], 0
jne 0x4201eb
mov eax, dword [ebp - 0xd364]
cmp byte [eax + 0x18c8], 0
jne 0x4201eb
push 0x24
mov eax, 0x262
call fcn.00410804
push eax
mov eax, 0x273
call fcn.00410804
push eax
push dword [0x4ad5b4]
call sub.USER32.DLL_MessageBoxA
cmp eax, 6
jne 0x4201eb
or word [esi + 0x368c], 8
cmp dword [ebp - 0xd36c], 0
jne 0x42020f
mov eax, 0x274
call fcn.00410804
push eax
push dword [ebp - 0xd368]
call fcn.0044142c
add esp, 8
jmp 0x42023f
push 0
push 0
mov eax, esi
xor edx, edx
call fcn.004091a4
mov eax, esi
xor ecx, ecx
mov edx, 0x72
call fcn.00401afc
mov eax, esi
xor ecx, ecx
mov edx, 0x73
call fcn.00401afc
mov eax, esi
call fcn.00408db4
mov al, 1
mov edx, 2
push eax
lea eax, [ebp - 0xd33c]
dec dword [edi + 0x1c]
call fcn.00401ad0
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0x4fd4]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0x42cc]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
lea eax, [esi + 0x13bc]
mov edx, 2
call fcn.00422cbc
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0xe6c]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
mov eax, esi
xor edx, edx
call fcn.00408b08
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x19c4]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x26cc]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
lea eax, [ebp - 0x55dc]
mov edx, 2
call fcn.00422cbc
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x5b2c]
mov edx, 2
call fcn.00401780
dec dword [edi + 0x1c]
lea eax, [ebp - 0x6998]
xor edx, edx
call fcn.00408b08
pop eax
mov edx, dword [edi]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret