Function at 0x420bf5
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x420bfe
mov eax, dword [ebp - 4]
add esp, 0xfffffd30
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0xf490], edx
mov dword [ebp - 0xf48c], eax
lea esi, [ebp - 0xf458]
lea edi, [ebp - 0xf488]
mov eax, 0x49ad04
call fcn.0048d8c4
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0xf494], edx
mov dword [ebp - 0xf498], ecx
mov byte [ebp - 0xf499], 0
mov word [edi + 0x10], 8
mov edx, dword [ebp - 0xf48c]
lea eax, [ebp - 0x7a2c]
call fcn.00403f1c
add dword [edi + 0x1c], 0xa
mov word [edi + 0x10], 0x14
mov word [edi + 0x10], 0x20
mov eax, esi
mov edx, dword [ebp - 0xf48c]
call fcn.00403f1c
add dword [edi + 0x1c], 0xa
mov word [edi + 0x10], 0x14
lea eax, [ebp - 0x7a2c]
mov ecx, ebx
mov edx, dword [ebp - 0xf490]
call fcn.0040925c
mov byte [ebp - 0x7a1b], 1
push 0x49ab99
lea eax, [ebp - 0xf8c0]
push eax
call fcn.0048d424
add esp, 8
mov eax, dword [ebp - 0xf490]
call fcn.0040b590
push eax
lea edx, [ebp - 0xf8c0]
push edx
call fcn.0048d348
add esp, 8
lea eax, [ebp - 0xf8c0]
xor edx, edx
call fcn.0040bdb8
push 0x49aba0
lea ecx, [ebp - 0xfcc0]
push ecx
call fcn.0048d424
add esp, 8
mov eax, dword [ebp - 0xf490]
call fcn.0040b590
push eax
lea edx, [ebp - 0xfcc0]
push edx
call fcn.0048d348
add esp, 8
mov edx, 0x49aba9
mov eax, dword [ebp - 0xf490]
call fcn.0040b9bc
test al, al
jne 0x420d3a
mov edx, 0x49abad
mov eax, dword [ebp - 0xf490]
call fcn.0040b9bc
test al, al
je 0x420d4a
mov edx, 0x49abb1
lea eax, [ebp - 0xfcc0]
call fcn.0040b8a4
lea eax, [ebp - 0xfcc0]
xor edx, edx
call fcn.0040bdb8
push 0
push 0
lea ecx, [ebp - 0xf49a]
push ecx
push 0x80000000
push 0
push 0
lea ecx, [ebp - 0xf8c0]
mov edx, esi
mov eax, dword [ebp - 0xf48c]
call fcn.0040af18
test al, al
jne 0x420e9b
cmp byte [ebp - 0xf49a], 0
jne 0x420dae
mov eax, 0x4a697c
mov edx, 9
call fcn.004298f4
lea edx, [ebp - 0xf8c0]
mov eax, 0x4a697c
call fcn.004297c8
xor eax, eax
mov edx, 2
mov al, byte [ebp - 0xf49a]
cmp eax, 1
sbb eax, eax
neg eax
push eax
lea eax, [esi + 0x6048]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
call fcn.0040177c
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0x531c]
mov edx, 2
call fcn.0040177c
sub dword [edi + 0x1c], 2
lea eax, [esi + 0x13d0]
mov edx, 2
call fcn.004247a4
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0xe6c]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
mov eax, esi
xor edx, edx
call fcn.004090e8
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x19e4]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x2710]
mov edx, 2
call fcn.0040177c
sub dword [edi + 0x1c], 2
lea eax, [ebp - 0x665c]
mov edx, 2
call fcn.004247a4
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x6bc0]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.004090e8
pop eax
mov edx, dword [edi]
mov dword fs:[0], edx
jmp 0x421c85
lea ecx, [ebp - 0xf8c0]
mov eax, 0x267
push ecx
call fcn.004117b8
push eax
lea edx, [ebp - 0x102c0]
push edx
call fcn.004902f4
add esp, 0xc
lea eax, [ebp - 0x102c0]
call fcn.004776c4
mov edx, esi
lea eax, [ebp - 0x7a2c]
call fcn.0041f858
mov ebx, eax
cmp ebx, 2
jne 0x420fc6
mov eax, esi
call fcn.004093e4
mov al, 1
mov edx, 2
push eax
lea eax, [esi + 0x6048]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
call fcn.0040177c
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0x531c]
mov edx, 2
call fcn.0040177c
sub dword [edi + 0x1c], 2
lea eax, [esi + 0x13d0]
mov edx, 2
call fcn.004247a4
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0xe6c]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
mov eax, esi
xor edx, edx
call fcn.004090e8
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x19e4]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x2710]
mov edx, 2
call fcn.0040177c
sub dword [edi + 0x1c], 2
lea eax, [ebp - 0x665c]
mov edx, 2
call fcn.004247a4
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x6bc0]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.004090e8
pop eax
mov edx, dword [edi]
mov dword fs:[0], edx
jmp 0x421c85
cmp ebx, 1
jne 0x4210f5
mov eax, esi
call fcn.004093e4
mov edx, dword [ebp - 0xf48c]
cmp byte [edx + 0x20e0], 0
jne 0x4210f5
push 0x24
mov eax, 0x262
call fcn.004117b8
push eax
mov eax, 0x275
call fcn.004117b8
push eax
push dword [0x4b9824]
call sub.USER32.DLL_MessageBoxA
cmp eax, 6
je 0x4210f5
mov al, 1
mov edx, 2
push eax
lea eax, [esi + 0x6048]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
call fcn.0040177c
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0x531c]
mov edx, 2
call fcn.0040177c
sub dword [edi + 0x1c], 2
lea eax, [esi + 0x13d0]
mov edx, 2
call fcn.004247a4
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0xe6c]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
mov eax, esi
xor edx, edx
call fcn.004090e8
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x19e4]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x2710]
mov edx, 2
call fcn.0040177c
sub dword [edi + 0x1c], 2
lea eax, [ebp - 0x665c]
mov edx, 2
call fcn.004247a4
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x6bc0]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.004090e8
pop eax
mov edx, dword [edi]
mov dword fs:[0], edx
jmp 0x421c85
test ebx, ebx
jne 0x421100
mov eax, esi
call fcn.00409478
push 0
push 0
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.00409820
push 0
push 0
lea ecx, [ebp - 0xf49a]
push ecx
push 0x80000000
push 0
push 0
lea ecx, [ebp - 0xfcc0]
mov edx, esi
mov eax, dword [ebp - 0xf48c]
call fcn.0040af18
test al, al
jne 0x421255
cmp byte [ebp - 0xf49a], 0
jne 0x421168
mov eax, 0x4a697c
mov edx, 9
call fcn.004298f4
lea edx, [ebp - 0xfcc0]
mov eax, 0x4a697c
call fcn.004297c8
xor eax, eax
mov edx, 2
mov al, byte [ebp - 0xf49a]
cmp eax, 1
sbb eax, eax
neg eax
push eax
lea eax, [esi + 0x6048]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
call fcn.0040177c
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0x531c]
mov edx, 2
call fcn.0040177c
sub dword [edi + 0x1c], 2
lea eax, [esi + 0x13d0]
mov edx, 2
call fcn.004247a4
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0xe6c]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
mov eax, esi
xor edx, edx
call fcn.004090e8
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x19e4]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x2710]
mov edx, 2
call fcn.0040177c
sub dword [edi + 0x1c], 2
lea eax, [ebp - 0x665c]
mov edx, 2
call fcn.004247a4
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x6bc0]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.004090e8
pop eax
mov edx, dword [edi]
mov dword fs:[0], edx
jmp 0x421c85
lea eax, [ebp - 0x7a2c]
call fcn.00409ad8
mov dword [ebp - 0xf4a4], eax
mov dword [ebp - 0xf4a0], edx
lea edx, [ebp - 0xfcc0]
mov eax, 0x267
push edx
call fcn.004117b8
push eax
lea edx, [ebp - 0x102c0]
push edx
call fcn.004902f4
add esp, 0xc
lea eax, [ebp - 0x102c0]
call fcn.004776c4
mov byte [ebp - 0xf4a5], 0
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.004042d4
test al, al
je 0x4213de
mov byte [ebp - 0xf4a5], 1
mov cx, word [ebp - 0x3350]
mov word [esi + 0x46dc], cx
mov ax, word [ebp - 0x334e]
mov word [esi + 0x46de], ax
cmp byte [ebp - 0xc2c], 0
je 0x4213de
mov eax, 0x272
call fcn.004117b8
push eax
lea edx, [ebp - 0x7a15]
push edx
call fcn.00444944
add esp, 8
mov al, 1
push eax
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0x6048]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0x531c]
mov edx, 2
call fcn.0040177c
sub dword [edi + 0x1c], 2
lea eax, [esi + 0x13d0]
mov edx, 2
call fcn.004247a4
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0xe6c]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
mov eax, esi
xor edx, edx
call fcn.004090e8
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x19e4]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x2710]
mov edx, 2
call fcn.0040177c
sub dword [edi + 0x1c], 2
lea eax, [ebp - 0x665c]
mov edx, 2
call fcn.004247a4
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x6bc0]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.004090e8
pop eax
mov edx, dword [edi]
mov dword fs:[0], edx
jmp 0x421c85
xor ecx, ecx
mov eax, esi
mov dword [esi + 0x46e8], ecx
mov edx, 0x72
mov word [esi + 0x46e4], cx
and word [esi + 0x46dc], 0xff9f
xor ecx, ecx
call fcn.00401af8
mov eax, esi
xor ecx, ecx
mov edx, 0x73
call fcn.00401af8
mov eax, dword [ebp - 0xc3c]
mov edx, dword [ebp - 0xc38]
add eax, 0xd
adc edx, 0
push edx
push eax
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.00409820
movzx eax, word [esi + 0x46de]
add eax, 0xfffffff3
cdq
push edx
push eax
mov edx, esi
lea eax, [ebp - 0x7a2c]
call fcn.00409b6c
push 0
push 0
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.00409820
mov word [edi + 0x10], 0x2c
lea eax, [ebp - 0xf464]
mov edx, 0x7918
call fcn.00401a54
inc dword [edi + 0x1c]
mov word [edi + 0x10], 0x14
mov dword [ebp - 0xf4b0], 0
mov dword [ebp - 0xf4ac], 0
mov dword [ebp - 0xf4b8], 0
mov dword [ebp - 0xf4b4], 0
lea eax, [ebp - 0x7a2c]
mov ecx, dword [ebp - 0xf460]
mov edx, dword [ebp - 0xf464]
call fcn.004096bc
mov eax, dword [ebp - 0xf460]
add eax, 0xfffffc18
cdq
add dword [ebp - 0xf4b8], eax
adc dword [ebp - 0xf4b4], edx
mov eax, dword [ebp - 0xf460]
add eax, 0xfffffc18
cdq
push edx
push eax
mov eax, dword [ebp - 0xf4b0]
mov edx, dword [ebp - 0xf4ac]
call fcn.00491980
mov ebx, eax
xor eax, eax
add ebx, dword [ebp - 0xf464]
xor ecx, ecx
mov word [edi + 0x10], 0x14
mov al, byte [ebx + 2]
xor edx, edx
mov dword [esi + 0x46f0], eax
mov cl, byte [ebx + 0x1b]
mov dl, byte [ebx + 0x1a]
shl ecx, 8
add dx, cx
mov word [esi + 0x470e], dx
cmp dword [esi + 0x46f0], 0x74
jne 0x421a29
cmp word [esi + 0x470e], 0
jbe 0x421a29
cmp word [esi + 0x470e], 0x400
jae 0x421a29
xor edx, edx
xor eax, eax
mov dl, byte [ebx + 1]
mov al, byte [ebx]
shl edx, 8
xor ecx, ecx
add ax, dx
xor edx, edx
mov word [esi + 0x46ec], ax
xor eax, eax
mov al, byte [ebx + 4]
mov cl, byte [ebx + 3]
shl eax, 8
add cx, ax
xor eax, eax
mov word [esi + 0x46f4], cx
xor ecx, ecx
mov cl, byte [ebx + 6]
mov dl, byte [ebx + 5]
shl ecx, 8
add dx, cx
xor ecx, ecx
mov word [esi + 0x46f6], dx
xor edx, edx
mov dl, byte [ebx + 8]
mov al, byte [ebx + 7]
shl edx, 8
mov cl, byte [ebx + 9]
add eax, edx
xor edx, edx
mov dl, byte [ebx + 0xa]
shl ecx, 0x10
shl edx, 0x18
add eax, ecx
add eax, edx
xor ecx, ecx
mov dword [esi + 0x46f8], eax
xor eax, eax
mov cl, byte [ebx + 0xc]
mov al, byte [ebx + 0xb]
shl ecx, 8
xor edx, edx
add eax, ecx
mov dl, byte [ebx + 0xd]
xor ecx, ecx
mov cl, byte [ebx + 0xe]
shl edx, 0x10
shl ecx, 0x18
add eax, edx
add eax, ecx
xor edx, edx
mov dword [esi + 0x46fc], eax
xor ecx, ecx
mov al, byte [ebx + 0xf]
mov byte [esi + 0x4700], al
xor eax, eax
mov dl, byte [ebx + 0x11]
mov al, byte [ebx + 0x10]
shl edx, 8
mov cl, byte [ebx + 0x12]
add eax, edx
xor edx, edx
mov dl, byte [ebx + 0x13]
shl ecx, 0x10
shl edx, 0x18
add eax, ecx
add eax, edx
xor ecx, ecx
mov dword [esi + 0x4704], eax
xor eax, eax
mov cl, byte [ebx + 0x15]
mov al, byte [ebx + 0x14]
shl ecx, 8
xor edx, edx
add eax, ecx
mov dl, byte [ebx + 0x16]
xor ecx, ecx
mov cl, byte [ebx + 0x17]
shl edx, 0x10
shl ecx, 0x18
add eax, edx
add eax, ecx
xor ecx, ecx
mov dword [esi + 0x4708], eax
xor edx, edx
mov al, byte [ebx + 0x18]
mov byte [esi + 0x470c], al
mov al, byte [ebx + 0x19]
mov byte [esi + 0x470d], al
xor eax, eax
mov cl, byte [ebx + 0x1d]
mov dl, byte [ebx + 0x1c]
shl ecx, 8
mov al, byte [ebx + 0x1e]
add edx, ecx
xor ecx, ecx
mov cl, byte [ebx + 0x1f]
shl eax, 0x10
shl ecx, 0x18
add edx, eax
add edx, ecx
mov dword [esi + 0x4710], edx
test byte [esi + 0x46f5], 1
je 0x4216d6
xor eax, eax
xor edx, edx
mov al, byte [ebx + 0x21]
mov dl, byte [ebx + 0x20]
shl eax, 8
xor ecx, ecx
add edx, eax
mov cl, byte [ebx + 0x22]
xor eax, eax
mov al, byte [ebx + 0x23]
shl ecx, 0x10
shl eax, 0x18
add edx, ecx
add edx, eax
xor ecx, ecx
mov dword [esi + 0x4714], edx
xor edx, edx
mov cl, byte [ebx + 0x25]
mov dl, byte [ebx + 0x24]
shl ecx, 8
xor eax, eax
add edx, ecx
mov al, byte [ebx + 0x26]
xor ecx, ecx
mov cl, byte [ebx + 0x27]
shl eax, 0x10
shl ecx, 0x18
add edx, eax
add edx, ecx
mov dword [esi + 0x4718], edx
jmp 0x4216e4
xor edx, edx
mov dword [esi + 0x4718], edx
mov dword [esi + 0x4714], edx
mov eax, dword [esi + 0x4714]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [esi + 0x46f8]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [esi + 0x53e0], eax
mov dword [esi + 0x53e4], edx
mov eax, dword [esi + 0x4718]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [esi + 0x46fc]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [esi + 0x53e8], eax
mov dword [esi + 0x53ec], edx
movzx ecx, word [esi + 0x470e]
push ecx
mov eax, esi
call fcn.004063a8
add eax, ebx
push eax
lea edx, [esi + 0x471c]
push edx
call fcn.0048d234
add esp, 0xc
test byte [esi + 0x46f5], 2
je 0x4217b0
lea eax, [ebp - 0x102d4]
call fcn.004112b8
lea edx, [esi + 0x471c]
push edx
call fcn.0048d454
pop ecx
inc eax
movzx ecx, word [esi + 0x470e]
sub ecx, eax
lea edx, [esi + 0x4b1c]
push ecx
lea ecx, [esi + 0x471c]
add ecx, eax
push edx
lea edx, [esi + 0x471c]
push 0x400
lea eax, [ebp - 0x102d4]
call fcn.00411554
jmp 0x4217b9
mov word [esi + 0x4b1c], 0
mov eax, dword [ebp - 0xf4a4]
mov edx, dword [ebp - 0xf4a0]
sub eax, dword [ebp - 0xf4b0]
sbb edx, dword [ebp - 0xf4ac]
push edx
push eax
mov eax, esi
call fcn.004063a8
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
movzx eax, word [esi + 0x470e]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, dword [esi + 0x46f8]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x421810
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x42187b
jmp 0x421814
pop edx
pop eax
jle 0x42187b
mov eax, dword [ebp - 0xf4a4]
mov edx, dword [ebp - 0xf4a0]
sub eax, dword [ebp - 0xf4b0]
sbb edx, dword [ebp - 0xf4ac]
push edx
push eax
mov eax, esi
call fcn.004063a8
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
movzx eax, word [esi + 0x470e]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov dword [ebp - 0xf4c0], eax
mov dword [ebp - 0xf4bc], edx
mov eax, dword [ebp - 0xf4c0]
mov dword [esi + 0x46f8], eax
mov eax, dword [ebp - 0xf4bc]
mov edx, eax
mov dword [esi + 0x4714], eax
sar edx, 0x1f
mov eax, esi
call fcn.004063a8
mov ecx, eax
movzx edx, word [esi + 0x470e]
add ecx, edx
add ecx, 0xfffffffe
lea edx, [ebx + 2]
or eax, 0xffffffff
call fcn.0040ff30
not ax
and ax, 0xffff
lea ecx, [ebp - 0xf499]
mov word [esi + 0x6e12], ax
mov edx, esi
mov eax, dword [ebp - 0xf48c]
call fcn.00421c8c
test al, al
je 0x421a29
test byte [esi + 0x46f4], 8
mov bl, 1
je 0x421939
mov eax, esi
call fcn.004063a8
cdq
push edx
push eax
movzx eax, word [esi + 0x470e]
cdq
add eax, dword [ebp - 0xf4b0]
adc edx, dword [ebp - 0xf4ac]
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.00409820
lea eax, [ebp - 0x7a2c]
call fcn.00405014
mov eax, esi
call fcn.004063a8
movzx edx, word [esi + 0x470e]
add eax, edx
movzx ecx, word [ebp - 0x1906]
add eax, ecx
movzx edx, word [esi + 0x46f6]
cmp eax, edx
je 0x42195c
xor ebx, ebx
jmp 0x42195c
movzx eax, word [esi + 0x46f6]
cdq
add eax, dword [ebp - 0xf4b0]
adc edx, dword [ebp - 0xf4ac]
push edx
push eax
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.00409820
movzx ecx, word [esi + 0x470e]
mov byte [esi + ecx + 0x471c], 0
call fcn.0040f420
test bl, bl
je 0x421a29
cmp word [esi + 0x4b1c], 0
jne 0x42198f
lea eax, [esi + 0x471c]
mov dl, 1
call fcn.0040bdb8
movzx ecx, word [esi + 0x46f4]
or dword [ebp - 0xf498], ecx
lea eax, [esi + 0x471c]
call fcn.0040e6b4
push eax
mov eax, 0x268
call fcn.004117b8
push eax
lea edx, [ebp - 0x102c0]
push edx
call fcn.004902f4
add esp, 0xc
lea eax, [ebp - 0x102c0]
call fcn.004776c4
inc dword [ebp - 0xf494]
mov eax, esi
xor ecx, ecx
mov edx, 0x74
call fcn.00401af8
test byte [esi + 0x46f4], 8
je 0x421a12
mov eax, esi
xor ecx, ecx
mov edx, 0x75
call fcn.00401af8
movzx eax, word [ebp - 0x1906]
add eax, 0xfffffff3
cdq
push edx
push eax
mov edx, esi
lea eax, [ebp - 0x7a2c]
call fcn.00409b6c
mov eax, dword [esi + 0x46f8]
xor edx, edx
push edx
push eax
mov edx, esi
lea eax, [ebp - 0x7a2c]
call fcn.00409b6c
add dword [ebp - 0xf4b0], 1
adc dword [ebp - 0xf4ac], 0
mov eax, dword [ebp - 0xf4a4]
mov edx, dword [ebp - 0xf4a0]
push edx
push eax
mov eax, esi
call fcn.004063a8
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, dword [ebp - 0xf4ac]
jne 0x421a68
cmp eax, dword [ebp - 0xf4b0]
ja 0x421a6a
jmp 0x421ae1
jle 0x421ae1
mov eax, dword [ebp - 0xf460]
add eax, 0xfffffc18
cdq
push edx
push eax
mov eax, dword [ebp - 0xf4b0]
mov edx, dword [ebp - 0xf4ac]
call fcn.00491980
cmp edx, 0
jne 0x4214d4
cmp eax, 0
jne 0x4214d4
push dword [ebp - 0xf4b4]
push dword [ebp - 0xf4b8]
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.00409820
lea eax, [ebp - 0x7a2c]
mov ecx, dword [ebp - 0xf460]
mov edx, dword [ebp - 0xf464]
call fcn.004096bc
add dword [ebp - 0xf4b8], 0x7530
adc dword [ebp - 0xf4b4], 0
jmp 0x4214d4
test byte [ebp - 0xf498], 3
je 0x421af2
or word [esi + 0x46dc], 1
cmp dword [ebp - 0xf494], 0
jle 0x421b43
cmp byte [ebp - 0xf4a5], 0
jne 0x421b43
mov eax, dword [ebp - 0xf48c]
cmp byte [eax + 0x20e0], 0
jne 0x421b43
push 0x24
mov eax, 0x262
call fcn.004117b8
push eax
mov eax, 0x273
call fcn.004117b8
push eax
push dword [0x4b9824]
call sub.USER32.DLL_MessageBoxA
cmp eax, 6
jne 0x421b43
or word [esi + 0x46dc], 8
cmp dword [ebp - 0xf494], 0
jne 0x421b67
mov eax, 0x274
call fcn.004117b8
push eax
push dword [ebp - 0xf490]
call fcn.00444944
add esp, 8
jmp 0x421b97
push 0
push 0
mov eax, esi
xor edx, edx
call fcn.00409820
mov eax, esi
xor ecx, ecx
mov edx, 0x72
call fcn.00401af8
mov eax, esi
xor ecx, ecx
mov edx, 0x73
call fcn.00401af8
mov eax, esi
call fcn.004093e4
mov al, 1
mov edx, 2
push eax
lea eax, [ebp - 0xf464]
dec dword [edi + 0x1c]
call fcn.00401acc
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0x6048]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0x531c]
mov edx, 2
call fcn.0040177c
sub dword [edi + 0x1c], 2
lea eax, [esi + 0x13d0]
mov edx, 2
call fcn.004247a4
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [esi + 0xe6c]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
mov eax, esi
xor edx, edx
call fcn.004090e8
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x19e4]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x2710]
mov edx, 2
call fcn.0040177c
sub dword [edi + 0x1c], 2
lea eax, [ebp - 0x665c]
mov edx, 2
call fcn.004247a4
dec dword [edi + 0x1c]
dec dword [edi + 0x1c]
lea eax, [ebp - 0x6bc0]
mov edx, 2
call fcn.0040177c
dec dword [edi + 0x1c]
lea eax, [ebp - 0x7a2c]
xor edx, edx
call fcn.004090e8
pop eax
mov edx, dword [edi]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret