Function at 0x421c70
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4fc04f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9c
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi + 0xfc]
mov dword [esp + 0x18], esi
cmp eax, ebx
mov dword [esi + 0x108], 0xa
je 0x421cba
push eax
call fcn.004dbc23
add esp, 4
mov dword [esi + 0xfc], ebx
lea ecx, [esi + 0xe0]
push 1
mov dword [esi + 0x104], ebx
mov dword [esi + 0x100], ebx
mov dword [esp + 0x4c], ecx
call fcn.00451c40
call fcn.0040b6b0
test byte [eax + 0x1a8], 2
jne 0x421cef
mov eax, 1
jmp 0x422785
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, 0x64
mov dword [esp + 0x28], 0x510a6c
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0x11
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebp
push 0xfa0
mov dword [esp + 0xb8], ebx
call fcn.004dbbfa
mov esi, 0x3e8
mov edi, eax
mov ecx, esi
xor eax, eax
mov dword [esp + 0x30], edi
rep stosd dword es:[edi], eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x6c], 0x510a6c
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], 0x11
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebp
push 0xfa0
mov byte [esp + 0xbc], 1
call fcn.004dbbfa
mov edi, eax
mov ecx, esi
xor eax, eax
mov dword [esp + 0x74], edi
rep stosd dword es:[edi], eax
mov dword [esp + 0x78], esi
mov dword [esp + 0x8c], 0x510a6c
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], 0x11
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebp
push 0xfa0
mov byte [esp + 0xc0], 2
call fcn.004dbbfa
mov edi, eax
mov ecx, esi
xor eax, eax
mov dword [esp + 0x94], edi
rep stosd dword es:[edi], eax
mov dword [esp + 0x98], esi
mov dword [esp + 0x58], 0x510a6c
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], 0x11
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebp
push 0xfa0
mov byte [esp + 0xc4], 3
call fcn.004dbbfa
mov edi, eax
mov ecx, esi
xor eax, eax
mov dword [esp + 0x60], edi
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x28]
add esp, 0x10
mov dword [esp + 0x54], esi
mov ecx, dword [eax + 0xd8]
call fcn.0046e6e0
mov ecx, eax
xor eax, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
or ebp, 0xffffffff
xor edi, edi
cmp ecx, ebx
mov dword [esp + 0x1c], ebp
jl 0x42207c
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0xb0]
cmp dword [edx + 0x30], ebx
je 0x42210c
mov ecx, dword [esp + 0x24]
xor esi, esi
cmp edi, ecx
jge 0x421ea5
mov eax, dword [esp + 0x18]
push edi
mov ecx, dword [eax + 0xd8]
call fcn.0046e840
mov esi, eax
mov eax, dword [esp + 0x14]
cmp esi, ebx
je 0x42206f
cmp esi, ebx
mov dword [esp + 0x20], ebx
je 0x421f90
mov ecx, dword [esp + 0x18]
push ebx
push edi
call fcn.00423a20
test eax, eax
je 0x421f8c
cmp word [esi + 0x24], bx
ja 0x421ed4
mov dword [esp + 0x20], 1
jmp 0x421ede
cmp ebp, ebx
jge 0x421ede
mov ebp, edi
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x1c], ebx
jge 0x421ef0
xor eax, eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
jmp 0x421ef4
mov eax, dword [esp + 0x14]
cmp word [esi + 0x24], bx
jbe 0x421f3f
test dword [esi + 0xc], 0x1b000000
je 0x421f3f
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
lea ecx, [ecx + ecx*2]
shl ecx, 6
sub ecx, edx
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea ecx, [edx + ecx*2]
mov edx, dword [esi + 0x1c]
add ecx, edx
mov dword [esp + 0x10], ecx
lea ecx, [eax + eax*2]
shl ecx, 6
sub ecx, eax
lea ecx, [ecx + ecx*4]
lea edx, [ecx + ecx*4]
mov ecx, dword [esi + 0x1c]
lea eax, [eax + edx*2]
add eax, ecx
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x20]
cmp ecx, ebx
je 0x42206f
mov esi, ecx
cmp dword [esp + 0x10], ebx
je 0x421fe0
cmp ebp, ebx
jl 0x421fe0
lea eax, [esp + 0x44]
lea ecx, [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x30]
call fcn.00429e40
cmp eax, ebx
je 0x421fa5
lea edx, [esp + 0x10]
lea ecx, [esp + 0x28]
push edx
call fcn.00429e80
mov dword [eax], 0xfffffffe
jmp 0x421fb9
mov eax, dword [esp + 0x14]
cmp ebp, ebx
jge 0x421f9e
cmp dword [esp + 0x1c], ebx
jl 0x42206f
mov esi, 2
jmp 0x421f4d
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
call fcn.00429e80
mov dword [eax], 0xffffffff
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x6c]
call fcn.00429e80
lea edx, [esp + 0x10]
lea ecx, [esp + 0x84]
push edx
mov dword [eax], ebp
call fcn.00429e80
mov dword [eax], edi
mov eax, dword [esp + 0x14]
cmp esi, 2
jne 0x42206c
cmp eax, ebx
je 0x42205e
cmp eax, dword [esp + 0x10]
je 0x42205e
lea eax, [esp + 0xa0]
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x30]
call fcn.00429e40
cmp eax, ebx
je 0x422023
lea edx, [esp + 0x14]
lea ecx, [esp + 0x28]
push edx
call fcn.00429e80
mov dword [eax], 0xfffffffe
jmp 0x422037
lea eax, [esp + 0x14]
lea ecx, [esp + 0x28]
push eax
call fcn.00429e80
mov dword [eax], 0xffffffff
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x6c]
call fcn.00429e80
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x84]
mov dword [eax], edx
lea eax, [esp + 0x14]
push eax
call fcn.00429e80
mov dword [eax], edi
xor eax, eax
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x14], eax
or ebp, 0xffffffff
mov ecx, dword [esp + 0x24]
inc edi
cmp edi, ecx
jle 0x421e6a
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 0xdc]
call fcn.0046e6e0
or ebp, 0xffffffff
xor edi, edi
cmp eax, ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x14], ebx
jl 0x4222f0
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0xb0]
cmp dword [eax + 0x30], ebx
je 0x422306
mov eax, dword [esp + 0x24]
xor esi, esi
cmp edi, eax
jge 0x4220dd
mov ecx, edx
push edi
mov ecx, dword [ecx + 0xdc]
call fcn.0046e840
mov esi, eax
cmp esi, ebx
je 0x4222e3
cmp esi, ebx
mov dword [esp + 0x20], ebx
je 0x422230
mov ecx, dword [esp + 0x18]
push ebx
push edi
call fcn.00423a20
test eax, eax
je 0x422230
cmp word [esi + 0x24], bx
ja 0x422175
mov dword [esp + 0x20], 1
jmp 0x42217f
mov esi, 0x510a6c
mov dword [esp + 0x4c], esi
lea ecx, [esp + 0x4c]
mov byte [esp + 0xb4], 4
call fcn.00429df0
mov dword [esp + 0x84], esi
lea ecx, [esp + 0x84]
mov byte [esp + 0xb4], 5
call fcn.00429df0
mov dword [esp + 0x68], esi
lea ecx, [esp + 0x68]
mov byte [esp + 0xb4], 6
call fcn.00429df0
mov dword [esp + 0x28], esi
lea ecx, [esp + 0x28]
mov dword [esp + 0xb4], 7
call fcn.00429df0
xor eax, eax
jmp 0x422785
cmp ebp, ebx
jge 0x42217f
mov ebp, edi
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x1c], ebx
jge 0x42218d
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], ebx
cmp word [esi + 0x24], bx
jbe 0x4221d8
test dword [esi + 0xc], 0x1b000000
je 0x4221d8
mov ecx, dword [esp + 0x10]
lea eax, [ecx + ecx*2]
shl eax, 6
sub eax, ecx
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
lea eax, [ecx + edx*2]
mov ecx, dword [esi + 0x1c]
add eax, ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
lea eax, [ecx + ecx*2]
shl eax, 6
sub eax, ecx
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
lea eax, [ecx + edx*2]
mov ecx, dword [esi + 0x1c]
add eax, ecx
mov dword [esp + 0x14], eax
cmp dword [esp + 0x20], ebx
je 0x4222e3
cmp dword [esp + 0x10], ebx
je 0x422261
cmp ebp, ebx
jl 0x422261
lea ecx, [esp + 0xa0]
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x30]
call fcn.00429e40
cmp eax, ebx
je 0x422261
mov eax, dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x422248
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
call fcn.00429e80
lea ecx, [esp + 0x10]
mov dword [eax], ebp
push ecx
lea ecx, [esp + 0x50]
call fcn.00429e80
mov dword [eax], edi
jmp 0x422261
cmp ebp, ebx
jge 0x42223e
cmp dword [esp + 0x1c], ebx
jl 0x4222e3
mov dword [esp + 0x20], 2
jmp 0x4221e2
cmp eax, 0xfffffffe
je 0x422261
lea edx, [esp + 0x10]
lea ecx, [esp + 0x28]
push edx
call fcn.00429e80
mov dword [eax], 0xfffffffe
cmp dword [esp + 0x20], 2
jne 0x4222e0
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4222d4
cmp eax, dword [esp + 0x10]
je 0x4222d4
lea eax, [esp + 0x44]
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x30]
call fcn.00429e40
cmp eax, ebx
je 0x4222d4
mov eax, dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4222bb
lea edx, [esp + 0x14]
lea ecx, [esp + 0x28]
push edx
call fcn.00429e80
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x14]
mov dword [eax], ecx
push edx
lea ecx, [esp + 0x50]
call fcn.00429e80
mov dword [eax], edi
jmp 0x4222d4
cmp eax, 0xfffffffe
je 0x4222d4
lea eax, [esp + 0x14]
lea ecx, [esp + 0x28]
push eax
call fcn.00429e80
mov dword [eax], 0xfffffffe
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x14], ebx
or ebp, 0xffffffff
mov eax, dword [esp + 0x24]
inc edi
cmp edi, eax
jle 0x4220a8
mov edx, dword [esp + 0x34]
neg edx
sbb edx, edx
cmp edx, ebx
je 0x4224b4
mov ebp, dword [esp + 0x30]
jmp 0x422373
mov esi, 0x510a6c
mov dword [esp + 0x4c], esi
lea ecx, [esp + 0x4c]
mov byte [esp + 0xb4], 8
call fcn.00429df0
mov dword [esp + 0x84], esi
lea ecx, [esp + 0x84]
mov byte [esp + 0xb4], 9
call fcn.00429df0
mov dword [esp + 0x68], esi
lea ecx, [esp + 0x68]
mov byte [esp + 0xb4], 0xa
call fcn.00429df0
mov dword [esp + 0x28], esi
lea ecx, [esp + 0x28]
mov dword [esp + 0xb4], 0xb
call fcn.00429df0
xor eax, eax
jmp 0x422785
mov edx, dword [esp + 0x44]
cmp edx, 0xffffffff
jne 0x422390
xor ecx, ecx
cmp ebp, ebx
jbe 0x422390
mov eax, dword [esp + 0x2c]
mov edx, dword [eax]
cmp edx, ebx
jne 0x422390
inc ecx
add eax, 4
cmp ecx, ebp
jb 0x422382
mov esi, dword [edx]
cmp esi, ebx
mov dword [esp + 0x1c], esi
jne 0x4223bb
mov eax, dword [edx + 4]
inc eax
cmp eax, ebp
jae 0x4223bb
mov ecx, dword [esp + 0x2c]
lea ecx, [ecx + eax*4]
mov esi, dword [ecx]
cmp esi, ebx
mov dword [esp + 0x1c], esi
jne 0x4223bb
inc eax
add ecx, 4
cmp eax, ebp
jb 0x4223a9
mov eax, dword [edx + 8]
mov dword [esp + 0x44], esi
mov dword [esp + 0x10], eax
mov edi, dword [edx + 0xc]
cmp edi, ebx
jl 0x4224ac
lea ecx, [esp + 0xa0]
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x70]
call fcn.00429e40
cmp eax, ebx
je 0x4224a8
mov ebp, dword [eax + 0xc]
cmp ebp, ebx
jl 0x4224a8
lea eax, [esp + 0xa4]
lea ecx, [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x8c]
call fcn.00429e40
cmp eax, ebx
je 0x42241e
mov edx, dword [eax + 0xc]
mov dword [esp + 0x20], edx
lea eax, [esp + 0xa8]
lea ecx, [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x54]
call fcn.00429e40
cmp eax, ebx
je 0x42243f
mov edx, dword [eax + 0xc]
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x48]
sub eax, edi
cdq
sub eax, edx
sar eax, 1
add eax, edi
push eax
mov eax, dword [esp + 0x24]
sub eax, ebp
cdq
sub eax, edx
sar eax, 1
add eax, ebp
push eax
call fcn.00451960
mov eax, dword [esp + 0x18]
push 0xffffffffffffffff
mov esi, dword [eax + 0x100]
lea ebx, [eax + 0xf8]
lea ecx, [esi + 1]
push ecx
mov ecx, ebx
call fcn.00429330
mov edx, dword [ebx + 4]
mov eax, dword [esp + 0x20]
shl esi, 4
add edx, esi
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov dword [edx], ebp
mov dword [edx + 4], eax
mov dword [edx + 8], edi
mov dword [edx + 0xc], ecx
mov ebp, dword [esp + 0x30]
jmp 0x4224ac
mov ebp, dword [esp + 0x30]
cmp esi, ebx
jne 0x42236f
mov eax, dword [esp + 0x18]
mov ebx, dword [eax + 0x100]
dec ebx
test ebx, ebx
jl 0x422548
mov esi, ebx
shl esi, 4
mov ebp, dword [eax + 0x100]
mov edx, dword [eax + 0xfc]
xor ecx, ecx
test ebp, ebp
jle 0x422540
mov edi, edx
cmp ebx, ecx
je 0x4224f5
mov eax, dword [edi]
cmp dword [esi + edx], eax
jl 0x4224f1
cmp dword [esi + edx + 4], eax
jle 0x4224ff
mov eax, dword [esp + 0x18]
inc ecx
add edi, 0x10
cmp ecx, ebp
jl 0x4224e0
jmp 0x422540
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0x100]
lea edi, [edx + 0xf8]
sub eax, ebx
dec eax
je 0x42252b
mov ecx, dword [edi + 4]
shl eax, 4
push eax
lea eax, [esi + ecx + 0x10]
add ecx, esi
push eax
push ecx
call fcn.004bf4e0
add esp, 0xc
mov ecx, dword [edi + 8]
push ebx
dec ecx
mov dword [edi + 8], ecx
mov ecx, dword [esp + 0x4c]
call fcn.004518b0
mov eax, dword [esp + 0x18]
dec ebx
sub esi, 0x10
test ebx, ebx
jge 0x4224cc
mov ecx, dword [eax + 0x100]
xor ebp, ebp
test ecx, ecx
jle 0x4225f3
mov ebx, 0x1000
mov edx, dword [eax + 0xb0]
mov ecx, dword [edx + 0x30]
test ecx, ecx
je 0x42279e
mov ecx, dword [eax + 0xfc]
mov esi, ebp
shl esi, 4
add esi, ecx
mov edi, dword [esi]
mov eax, dword [esi + 4]
cmp edi, eax
jge 0x4225ae
mov eax, dword [esp + 0x18]
push edi
mov ecx, dword [eax + 0xd8]
call fcn.0046e840
test eax, eax
je 0x4225a6
mov ecx, dword [eax + 0xc]
or ecx, ebx
mov dword [eax + 0xc], ecx
lea ecx, [ebp + 1]
mov dword [eax + 0x18], ecx
mov eax, dword [esi + 4]
inc edi
cmp edi, eax
jl 0x422584
mov edi, dword [esi + 8]
mov eax, dword [esi + 0xc]
cmp edi, eax
jge 0x4225e2
mov edx, dword [esp + 0x18]
push edi
mov ecx, dword [edx + 0xdc]
call fcn.0046e840
test eax, eax
je 0x4225da
mov ecx, dword [eax + 0xc]
or ecx, ebx
mov dword [eax + 0xc], ecx
lea ecx, [ebp + 1]
mov dword [eax + 0x18], ecx
mov eax, dword [esi + 0xc]
inc edi
cmp edi, eax
jl 0x4225b8
mov eax, dword [esp + 0x18]
inc ebp
cmp ebp, dword [eax + 0x100]
jl 0x42255d
mov esi, dword [esp + 0x48]
mov ecx, esi
call fcn.00451e70
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
call fcn.00451da0
mov ebx, eax
mov ebp, 0x510a6c
neg ebx
sbb ebx, ebx
mov dword [esp + 0x4c], ebp
inc ebx
mov edx, dword [esp + 0x50]
xor esi, esi
cmp edx, esi
mov byte [esp + 0xb4], 0x10
je 0x42264b
mov eax, dword [esp + 0x54]
cmp eax, esi
jbe 0x42264b
mov ecx, edx
mov edi, eax
mov eax, dword [ecx]
cmp eax, esi
je 0x422645
mov eax, dword [eax]
cmp eax, esi
jne 0x42263f
add ecx, 4
dec edi
jne 0x422639
push edx
call fcn.004dbc23
mov ecx, dword [esp + 0x64]
add esp, 4
mov dword [esp + 0x50], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
call fcn.004d660c
mov dword [esp + 0x60], esi
mov dword [esp + 0x84], ebp
mov edi, dword [esp + 0x88]
mov byte [esp + 0xb4], 0x11
cmp edi, esi
je 0x4226a8
mov eax, dword [esp + 0x8c]
cmp eax, esi
jbe 0x4226a8
mov ecx, edi
mov edx, eax
mov eax, dword [ecx]
cmp eax, esi
je 0x4226a2
mov eax, dword [eax]
cmp eax, esi
jne 0x42269c
add ecx, 4
dec edx
jne 0x422696
push edi
call fcn.004dbc23
mov ecx, dword [esp + 0x9c]
add esp, 4
mov dword [esp + 0x88], esi
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], esi
call fcn.004d660c
mov dword [esp + 0x98], esi
mov dword [esp + 0x68], ebp
mov edi, dword [esp + 0x6c]
mov byte [esp + 0xb4], 0x12
cmp edi, esi
je 0x42270b
mov eax, dword [esp + 0x70]
cmp eax, esi
jbe 0x42270b
mov ecx, edi
mov edx, eax
mov eax, dword [ecx]
cmp eax, esi
je 0x422705
mov eax, dword [eax]
cmp eax, esi
jne 0x4226ff
add ecx, 4
dec edx
jne 0x4226f9
push edi
call fcn.004dbc23
mov ecx, dword [esp + 0x80]
add esp, 4
mov dword [esp + 0x6c], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], esi
call fcn.004d660c
mov dword [esp + 0x7c], esi
mov dword [esp + 0x28], ebp
mov edi, dword [esp + 0x2c]
mov dword [esp + 0xb4], 0x13
cmp edi, esi
je 0x422765
mov eax, dword [esp + 0x30]
cmp eax, esi
jbe 0x422765
mov ecx, edi
mov edx, eax
mov eax, dword [ecx]
cmp eax, esi
je 0x42275f
mov eax, dword [eax]
cmp eax, esi
jne 0x422759
add ecx, 4
dec edx
jne 0x422753
push edi
call fcn.004dbc23
mov ecx, dword [esp + 0x40]
add esp, 4
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call fcn.004d660c
mov eax, ebx
mov ecx, dword [esp + 0xac]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xa8
ret
mov esi, 0x510a6c
mov dword [esp + 0x4c], esi
lea ecx, [esp + 0x4c]
mov byte [esp + 0xb4], 0xc
call fcn.00429df0
mov dword [esp + 0x84], esi
lea ecx, [esp + 0x84]
mov byte [esp + 0xb4], 0xd
call fcn.00429df0
mov dword [esp + 0x68], esi
lea ecx, [esp + 0x68]
mov byte [esp + 0xb4], 0xe
call fcn.00429df0
mov dword [esp + 0x28], esi
lea ecx, [esp + 0x28]
mov dword [esp + 0xb4], 0xf
call fcn.00429df0
xor eax, eax
jmp 0x422785