Function at 0x4259b2
Capabilities:
Query or enumerate registry value

Disassembly:
enter 0x570, 2
push ebx
push ecx
push edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
movzx eax, byte [0x4d8cf7]
cmp ax, 0x54
jne 0x425c37
push 0x4c3b41
push 0x12
push 3
push 0x3f
push 0x16
push 0x4e
push 0
push 0
call fcn.0040cba0
mov edi, dword [0x4d91ad]
mov dword [ebp - 0x158], edi
push 1
push 0x12
push 3
sub esp, 8
mov esi, 0x4c3b47
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 8
mov esi, 0x4c3b4d
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x4d90ad
lea edi, [ebp - 0x258]
call fcn.00401b30
mov esi, 0x4c3b53
call fcn.00401af0
mov eax, edi
push eax
push 0x4c3b61
push 0x11
mov eax, dword [ebp - 0x158]
call fcn.0041f502
push 2
push 0x16
push 3
sub esp, 8
mov esi, 0x4c3b67
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 8
mov esi, 0x4c3b6d
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x4d90ad
lea edi, [ebp - 0x258]
call fcn.00401b30
mov esi, 0x4c3b73
call fcn.00401af0
mov eax, edi
push eax
push 0x4c3b82
push 0x12
mov eax, dword [ebp - 0x158]
call fcn.0041f502
push 1
push 0x13
push 5
push dword [0x4c3b8a]
push 4
push 0x4c3b8e
mov eax, dword [ebp - 0x158]
call fcn.0041f962
push 2
push 0x13
push 0xa
push dword [0x4c3b95]
push 4
push 0x4c3b99
mov eax, dword [ebp - 0x158]
call fcn.0041f962
push 3
push 0x23
push 0xa
push dword [0x4c3ba4]
push 4
push 0x4c3ba8
mov eax, dword [ebp - 0x158]
call fcn.0041f962
push 4
push 0x13
push 0xf
push dword [0x4c3bb2]
push 3
push 0x4c3bb6
mov eax, dword [ebp - 0x158]
call fcn.0041f962
push 5
push 0x23
push 0xf
push dword [0x4c3bc4]
push 3
push 0x4c3bc8
mov eax, dword [ebp - 0x158]
call fcn.0041f962
push 6
push 0x13
push 0x13
push dword [0x4c3bd4]
push 3
push 0x4c3bd8
mov eax, dword [ebp - 0x158]
call fcn.0041f962
push 1
push 0x14
push 6
push 0x29
push 3
push 1
mov eax, dword [ebp - 0x158]
call fcn.00428372
push 2
push 0x24
push 0xb
push 0x19
push 3
push 1
mov eax, dword [ebp - 0x158]
call fcn.00428372
push 1
push 0x14
push 0xb
push 0x4c3bec
push 0
mov eax, dword [ebp - 0x158]
call fcn.00428132
push 2
push 0x14
push 0xc
push 0x4c3bf9
push 0
mov eax, dword [ebp - 0x158]
call fcn.00428132
push 3
push 0x14
push 0xd
push 0x4c3c05
push 0
mov eax, dword [ebp - 0x158]
call fcn.00428132
push 4
push 0x14
push 0x10
push 0x4c3c0e
push 0
mov eax, dword [ebp - 0x158]
call fcn.00428132
push 5
push 0x14
push 0x11
push 0x4c3c14
push 0
mov eax, dword [ebp - 0x158]
call fcn.00428132
push 0x2a
push 0x10
push 0x4c3c1a
call fcn.004086e0
push 0x24
push 0x11
push 0x4c3c28
call fcn.004086e0
push 0x15
push 0x14
push 0x4c3c3c
call fcn.004086e0
push 0x2b
push 0x14
push 0x4c3c49
call fcn.004086e0
push 0x2b
push 0x15
push 0x4c3c56
call fcn.004086e0
jmp 0x425ea3
cmp ax, 0x45
jne 0x425ea3
push 0x4c3c63
push 0x12
push 3
push 0x3f
push 0x16
push 0x4e
push 0
push 0
call fcn.0040cba0
mov edi, dword [0x4d91ad]
mov dword [ebp - 0x15c], edi
push 1
push 0x12
push 3
sub esp, 8
mov esi, 0x4c3c69
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 8
mov esi, 0x4c3c6f
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x4d90ad
lea edi, [ebp - 0x25c]
call fcn.00401b30
mov esi, 0x4c3c75
call fcn.00401af0
mov eax, edi
push eax
push 0x4c3c83
push 0x11
mov eax, dword [ebp - 0x15c]
call fcn.0041f502
push 2
push 0x16
push 3
sub esp, 8
mov esi, 0x4c3c89
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 8
mov esi, 0x4c3c8f
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x4d90ad
lea edi, [ebp - 0x25c]
call fcn.00401b30
mov esi, 0x4c3c95
call fcn.00401af0
mov eax, edi
push eax
push 0x4c3ca4
push 0x12
mov eax, dword [ebp - 0x15c]
call fcn.0041f502
push 1
push 0x13
push 5
push dword [0x4c3cad]
push 4
push 0x4c3cb1
mov eax, dword [ebp - 0x15c]
call fcn.0041f962
push 2
push 0x13
push 0xa
push dword [0x4c3cb9]
push 4
push 0x4c3cbd
mov eax, dword [ebp - 0x15c]
call fcn.0041f962
push 3
push 0x24
push 0xa
push dword [0x4c3cc2]
push 4
push 0x4c3cc6
mov eax, dword [ebp - 0x15c]
call fcn.0041f962
push 4
push 0x13
push 0xf
push dword [0x4c3cd0]
push 3
push 0x4c3cd4
mov eax, dword [ebp - 0x15c]
call fcn.0041f962
push 5
push 0x24
push 0xf
push dword [0x4c3ce4]
push 3
push 0x4c3ce8
mov eax, dword [ebp - 0x15c]
call fcn.0041f962
push 6
push 0x13
push 0x13
push dword [0x4c3cf4]
push 3
push 0x4c3cf8
mov eax, dword [ebp - 0x15c]
call fcn.0041f962
push 1
push 0x14
push 6
push 0x29
push 3
push 1
mov eax, dword [ebp - 0x15c]
call fcn.00428372
push 2
push 0x25
push 0xb
push 0x18
push 3
push 1
mov eax, dword [ebp - 0x15c]
call fcn.00428372
push 1
push 0x14
push 0xb
push 0x4c3d09
push 0
mov eax, dword [ebp - 0x15c]
call fcn.00428132
push 2
push 0x14
push 0xc
push 0x4c3d13
push 0
mov eax, dword [ebp - 0x15c]
call fcn.00428132
push 3
push 0x14
push 0xd
push 0x4c3d21
push 0
mov eax, dword [ebp - 0x15c]
call fcn.00428132
push 4
push 0x14
push 0x10
push 0x4c3d2b
push 0
mov eax, dword [ebp - 0x15c]
call fcn.00428132
push 5
push 0x14
push 0x11
push 0x4c3d34
push 0
mov eax, dword [ebp - 0x15c]
call fcn.00428132
push 0x2c
push 0x10
push 0x4c3d3e
call fcn.004086e0
push 0x24
push 0x11
push 0x4c3d4b
call fcn.004086e0
push 0x15
push 0x14
push 0x4c3d61
call fcn.004086e0
push 0x2e
push 0x14
push 0x4c3d6e
call fcn.004086e0
push 0x2f
push 0x15
push 0x4c3d79
call fcn.004086e0
mov eax, dword [0x4d91ad]
mov dword [ebp - 0x160], eax
call fcn.0041c112
push 1
push 0x22
push 0x14
push 2
push 1
call fcn.0041f130
push 2
push 0x38
push 0x14
push 5
push 1
call fcn.0041f130
push 3
push 0x38
push 0x15
push 5
push 1
call fcn.0041f130
mov eax, dword [ebp - 0x160]
call fcn.0040b572
push 0x38
push 0x10
push 3
call fcn.00408810
push 0x38
push 0x11
push 5
call fcn.00408810
mov eax, dword [ebp - 0x160]
call fcn.00409192
mov eax, dword [ebp - 4]
call fcn.00428062
mov eax, dword [ebp - 4]
call fcn.00427f72
mov byte [ebp - 0x13c], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xbe], 0
jbe 0x426e65
push 2
push 0xffffffffffffffff
push 1
push 0x4c3d83
mov eax, dword [0x4d91ad]
call fcn.00427ea2
mov byte [ebp - 0x134], al
push 2
push 0xffffffffffffffff
push 2
push 0x4c3d9a
mov eax, dword [0x4d91ad]
call fcn.00427ea2
mov byte [ebp - 0x133], al
push 2
push 0xffffffffffffffff
push 3
push 0x4c3db1
mov eax, dword [0x4d91ad]
call fcn.00427ea2
mov byte [ebp - 0x132], al
movzx eax, byte [0x4d8cf7]
cmp ax, 0x54
jne 0x425fae
push 2
push 0xffffffffffffffff
push 4
push 0x4c3db8
mov eax, dword [0x4d91ad]
call fcn.00427ea2
mov byte [ebp - 0x131], al
jmp 0x425fcf
cmp ax, 0x45
jne 0x425fcf
push 2
push 0xffffffffffffffff
push 4
push 0x4c3dcb
mov eax, dword [0x4d91ad]
call fcn.00427ea2
mov byte [ebp - 0x131], al
push 2
mov eax, dword [ebp - 4]
movsx eax, word [eax + 0x98]
movzx eax, byte [ebp + eax - 0x135]
push eax
mov eax, dword [0x4d91ad]
call fcn.00427e52
mov edi, dword [ebp - 4]
mov word [edi + 0x9a], 0
mov eax, 0
mov dword [ebp - 0x124], eax
lea ebx, [ebp - 0x20]
push ebx
push 1
push 0
push 0x4c3de3
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
lea eax, [ebp - 0x124]
push eax
push 0
push 0
push 0
push 0x4c3e18
push dword [ebp - 0x20]
call sub.advapi32.dll_RegQueryValueExA
lea ebx, [ebp - 0x1c]
push ebx
mov eax, dword [ebp - 0x124]
inc eax
push eax
call fcn.004039f0
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x1c]
push 0
push 0
push 0x4c3e1f
push dword [ebp - 0x20]
call sub.advapi32.dll_RegQueryValueExA
cmp dword [ebp - 0x124], 0
jle 0x42608e
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x1c]
call fcn.004039a0
lea edi, [ebp - 0x120]
lea esi, [ebp - 0x260]
call fcn.00401940
jmp 0x42609e
lea edi, [ebp - 0x120]
mov esi, 0x4c3e26
call fcn.00401940
push 0x4c3e27
lea eax, [ebp - 0x120]
push eax
call fcn.0040cb40
mov word [ebp - 0x148], ax
cmp ax, 1
jle 0x4260ec
lea ebx, [ebp - 0x260]
push ebx
lea eax, [ebp - 0x120]
push eax
push 1
movsx ecx, word [ebp - 0x148]
dec ecx
push ecx
call fcn.00401cd0
lea edi, [ebp - 0x120]
lea esi, [ebp - 0x260]
call fcn.00401940
lea eax, [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 0x124]
inc ebx
push ebx
call fcn.004031c0
push dword [ebp - 0x20]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 4]
movsx ebx, word [eax + 0xbe]
test ebx, ebx
jle 0x4261fd
mov word [ebp - 0x164], bx
mov word [ebp - 0x148], 0
inc word [ebp - 0x148]
movsx eax, word [ebp - 0x148]
imul ebx, eax, 0x54
mov edi, dword [ebp - 4]
mov esi, dword [edi]
lea ebx, [esi + ebx - 0x54]
mov dword [ebp - 0x168], ebx
push 1
push 0xffffffffffffffff
movsx eax, word [ebp - 0x148]
push eax
mov esi, dword [ebp - 0x168]
push dword [esi + 4]
mov eax, dword [0x4d91ad]
call fcn.00427ea2
mov word [ebp - 0x14c], ax
lea ebx, [ebp - 0x268]
push ebx
lea eax, [ebp - 0x120]
push eax
call fcn.0041a8a0
lea ecx, [ebp - 0x368]
push ecx
lea eax, [ebp - 0x468]
push eax
mov edi, dword [ebp - 0x168]
push dword [edi + 4]
call fcn.004039a0
lea ebx, [ebp - 0x468]
push ebx
call fcn.0041a8a0
lea esi, [ebp - 0x368]
lea edi, [ebp - 0x268]
call fcn.00414a20
test al, al
jne 0x4261cb
cmp word [ebp - 0x148], 1
jne 0x4261f0
mov eax, dword [ebp - 4]
mov bx, word [ebp - 0x148]
mov word [eax + 0x9a], bx
push 1
mov bx, word [ebp - 0x14c]
push ebx
mov eax, dword [0x4d91ad]
call fcn.00427e52
dec word [ebp - 0x164]
jne 0x426128
mov eax, dword [ebp - 4]
call fcn.00426eb2
mov byte [ebp - 0x13c], al
test al, al
je 0x426e5b
cmp word [0x4d8869], 0
jne 0x42622e
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x78]
mov bx, word [eax + 0x2c]
mov word [0x4d8869], bx
mov al, byte [0x4d8864]
test al, al
je 0x426240
mov byte [ebp - 0x140], 1
jmp 0x42625a
mov bl, byte [0x4d8865]
test bl, bl
je 0x426253
mov byte [ebp - 0x140], 2
jmp 0x42625a
mov byte [ebp - 0x140], 3
cmp word [0x4d8869], 2
jne 0x426276
cmp byte [ebp - 0x140], 3
je 0x426276
mov byte [ebp - 0x144], 5
jmp 0x426286
mov byte [ebp - 0x144], 4
mov word [0x4d8869], 1
mov al, byte [ebp - 0x140]
push eax
push 1
mov eax, dword [0x4d91ad]
call fcn.004278b2
mov al, byte [ebp - 0x144]
push eax
push 1
mov eax, dword [0x4d91ad]
call fcn.004278b2
mov edi, dword [ebp - 4]
mov word [edi + 0x9c], 1
mov word [edi + 0x9e], 1
mov word [edi + 0xa0], 1
mov ax, word [edi + 0x9a]
mov word [ebp - 0x14c], ax
movsx eax, word [ebp + 0xc]
movsx ebx, word [edi + 0xa6]
add ebx, eax
movsx ecx, word [edi + 0xa8]
add ebx, ecx
mov word [edi + 0xb6], bx
cmp bx, 0x3c
jge 0x426304
mov word [edi + 0xb6], 0x3c
mov eax, dword [ebp - 4]
mov edi, eax
mov bx, word [eax + 0xb6]
mov word [edi + 0xac], bx
mov bx, word [eax + 0xa0]
mov word [ebp - 0x154], bx
push 1
mov eax, dword [0x4d91ad]
call fcn.00427de2
mov word [ebp - 0x150], 1
push 0x22
push 0x14
mov eax, dword [ebp - 4]
fild word [eax + 0x9c]
sub esp, 8
fstp qword [esp]
wait
push 2
push 0
call fcn.0041f0e0
push 0x38
push 0x14
mov eax, dword [ebp - 4]
fild word [eax + 0x9e]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041f0e0
push 0x38
push 0x15
mov eax, dword [ebp - 4]
fild word [eax + 0xa0]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041f0e0
cmp word [ebp + 0xc], 0x84
jle 0x4263e5
cmp byte [ebp - 0x140], 3
jae 0x4263e5
mov eax, dword [0x4d91ad]
mov dword [ebp - 0x46c], eax
mov bl, byte [ebp - 0x144]
push ebx
push 0
mov eax, dword [ebp - 0x46c]
call fcn.004278b2
mov byte [ebp - 0x144], 5
mov al, byte [ebp - 0x144]
push eax
push 1
mov eax, dword [ebp - 0x46c]
call fcn.004278b2
mov word [0x4d8869], 2
lea eax, [ebp - 0x140]
push eax
lea ebx, [ebp - 0x144]
push ebx
mov eax, dword [ebp - 4]
call fcn.004276e2
mov al, byte [ebp - 0x144]
push eax
mov eax, dword [ebp - 4]
call fcn.00427cc2
mov al, byte [ebp - 0x140]
push eax
lea ebx, [ebp - 0x154]
push ebx
push dword [ebp + 0x14]
mov cx, word [ebp + 0x10]
push ecx
mov eax, dword [ebp - 4]
call fcn.00427092
mov edi, dword [ebp - 4]
mov ax, word [edi + 0xa0]
cmp word [ebp - 0x154], ax
je 0x426463
mov bx, word [ebp - 0x154]
mov word [edi + 0xa0], bx
push 0x38
push 0x15
fild word [edi + 0xa0]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041f0e0
mov eax, dword [0x4d91ad]
mov dword [ebp - 0x470], eax
push 1
mov bl, byte [0x4d8864]
push ebx
mov eax, dword [ebp - 0x470]
call fcn.00427932
push 2
mov al, byte [0x4d8865]
push eax
mov eax, dword [ebp - 0x470]
call fcn.00427932
push 3
mov al, byte [0x4d8863]
push eax
mov eax, dword [ebp - 0x470]
call fcn.00427932
push 4
cmp byte [ebp - 0x140], 3
setb al
push eax
mov eax, dword [ebp - 0x470]
call fcn.00427932
push 5
cmp byte [ebp - 0x140], 3
setb al
push eax
mov eax, dword [ebp - 0x470]
call fcn.00427932
push 2
cmp byte [ebp - 0x140], 3
sete al
push eax
mov eax, dword [ebp - 0x470]
call fcn.00427852
mov byte [ebp - 0x138], 1
movsx eax, word [ebp - 0x150]
cmp eax, 1
jne 0x426515
push 0x22
push 0x14
push 2
call fcn.0041d1e0
mov byte [ebp - 0x18], al
jmp 0x42653a
cmp eax, 3
je 0x426523
cmp eax, 2
jne 0x42653a
push 0x38
movsx ebx, ax
mov ecx, 0x12
add ecx, ebx
push ecx
push 5
call fcn.0041d1e0
mov byte [ebp - 0x18], al
mov al, byte [ebp - 0x18]
cmp al, 0x12
jne 0x4265eb
mov eax, dword [ebp - 4]
call fcn.00427d72
mov eax, dword [ebp - 4]
call fcn.00421072
mov eax, dword [ebp - 4]
call fcn.00426eb2
mov byte [ebp - 0x13c], al
test al, al
je 0x4265e6
mov edi, dword [ebp - 4]
mov ax, word [edi + 0x9a]
mov word [ebp - 0x14c], ax
lea eax, [ebp - 0x140]
push eax
lea ebx, [ebp - 0x144]
push ebx
mov eax, edi
call fcn.004276e2
mov al, byte [ebp - 0x140]
push eax
lea ebx, [ebp - 0x154]
push ebx
push dword [ebp + 0x14]
mov cx, word [ebp + 0x10]
push ecx
mov eax, dword [ebp - 4]
call fcn.00427092
mov edi, dword [ebp - 4]
mov ax, word [edi + 0xa0]
cmp word [ebp - 0x154], ax
je 0x4265e6
mov bx, word [ebp - 0x154]
mov word [edi + 0xa0], bx
push 0x38
push 0x15
fild word [edi + 0xa0]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041f0e0
jmp 0x426cd2
cmp al, 0x21
jne 0x42688b
movsx ebx, word [0x4d91bd]
mov eax, ebx
cmp eax, 3
jg 0x426752
cmp eax, 1
jl 0x426752
movsx eax, word [0x4d91bd]
movzx ebx, byte [ebp - 0x140]
test ebx, ebx
jl 0x426626
cmp eax, ebx
je 0x42674d
mov eax, dword [0x4d91ad]
mov dword [ebp - 0x474], eax
mov bl, byte [ebp - 0x140]
push ebx
push 0
mov eax, dword [ebp - 0x474]
call fcn.004278b2
mov cl, byte [0x4d91bd]
mov byte [ebp - 0x140], cl
mov al, byte [ebp - 0x140]
push eax
push 1
mov eax, dword [ebp - 0x474]
call fcn.004278b2
push 4
cmp byte [ebp - 0x140], 3
setb al
push eax
mov eax, dword [ebp - 0x474]
call fcn.00427932
push 5
cmp byte [ebp - 0x140], 3
setb al
push eax
mov eax, dword [ebp - 0x474]
call fcn.00427932
mov al, byte [ebp - 0x140]
push eax
lea ebx, [ebp - 0x154]
push ebx
push dword [ebp + 0x14]
mov cx, word [ebp + 0x10]
push ecx
mov eax, dword [ebp - 4]
call fcn.00427092
push 2
cmp byte [ebp - 0x140], 3
sete al
push eax
mov eax, dword [ebp - 0x474]
call fcn.00427852
cmp byte [ebp - 0x140], 3
jne 0x426712
cmp byte [ebp - 0x144], 4
jbe 0x426712
mov al, byte [ebp - 0x144]
push eax
push 0
mov eax, dword [ebp - 0x474]
call fcn.004278b2
mov byte [ebp - 0x144], 4
mov al, byte [ebp - 0x144]
push eax
push 1
mov eax, dword [ebp - 0x474]
call fcn.004278b2
mov eax, dword [ebp - 4]
mov bx, word [eax + 0xa0]
cmp word [ebp - 0x154], bx
je 0x42674d
mov cx, word [ebp - 0x154]
mov word [eax + 0xa0], cx
push 0x38
push 0x15
fild word [eax + 0xa0]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041f0e0
jmp 0x426886
cmp eax, 5
je 0x426764
cmp eax, 4
jne 0x426886
movsx eax, word [0x4d91bd]
movzx ebx, byte [ebp - 0x144]
test ebx, ebx
jl 0x426778
cmp eax, ebx
je 0x426886
mov eax, dword [0x4d91ad]
mov dword [ebp - 0x478], eax
mov bl, byte [ebp - 0x144]
push ebx
push 0
mov eax, dword [ebp - 0x478]
call fcn.004278b2
mov cl, byte [0x4d91bd]
mov byte [ebp - 0x144], cl
mov al, byte [ebp - 0x144]
push eax
push 1
mov eax, dword [ebp - 0x478]
call fcn.004278b2
cmp byte [ebp - 0x144], 4
jne 0x4267d1
mov word [0x4d8869], 1
jmp 0x4267da
mov word [0x4d8869], 2
mov eax, dword [ebp - 4]
call fcn.00421072
mov eax, dword [ebp - 4]
call fcn.00426eb2
mov byte [ebp - 0x13c], al
test al, al
je 0x426886
mov edi, dword [ebp - 4]
mov ax, word [edi + 0x9a]
mov word [ebp - 0x14c], ax
lea eax, [ebp - 0x140]
push eax
lea ebx, [ebp - 0x144]
push ebx
mov eax, edi
call fcn.004276e2
mov al, byte [ebp - 0x144]
push eax
mov eax, dword [ebp - 4]
call fcn.00427cc2
mov al, byte [ebp - 0x140]
push eax
lea ebx, [ebp - 0x154]
push ebx
push dword [ebp + 0x14]
mov cx, word [ebp + 0x10]
push ecx
mov eax, dword [ebp - 4]
call fcn.00427092
mov edi, dword [ebp - 4]
mov ax, word [edi + 0xa0]
cmp word [ebp - 0x154], ax
je 0x426886
mov bx, word [ebp - 0x154]
mov word [edi + 0xa0], bx
push 0x38
push 0x15
fild word [edi + 0xa0]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041f0e0
jmp 0x426cd2
cmp al, 0x22
jne 0x426b5a
cmp word [0x4d91c1], 1
jne 0x426ac9
push 1
mov eax, dword [0x4d91ad]
call fcn.00427012
mov edi, dword [ebp - 4]
mov word [edi + 0x9a], ax
movsx ebx, ax
push 0
mov al, byte [edi + 0xbe]
push eax
push 1
push 1
push 0x4c3e29
lea edi, [ebp - 0x498]
call fcn.00401403
lea esi, [ebp - 0x498]
mov eax, ebx
push 0xff0000
call fcn.0040148e
mov byte [ebp - 0x138], al
test al, al
je 0x42690f
mov edi, dword [ebp - 4]
mov ax, word [ebp - 0x14c]
cmp word [edi + 0x9a], ax
setne bl
mov byte [ebp - 0x138], bl
jmp 0x426945
movzx ebx, byte [0x4d8cf7]
mov ax, bx
cmp ax, 0x54
jne 0x426930
push 0x4c3e49
push 0x4c3e61
call fcn.004135d0
jmp 0x426945
cmp ax, 0x45
jne 0x426945
push 0x4c3e62
push 0x4c3e73
call fcn.004135d0
mov al, byte [ebp - 0x138]
test al, al
je 0x426ac4
mov eax, dword [ebp - 4]
call fcn.00421072
mov eax, dword [ebp - 4]
call fcn.00426eb2
mov byte [ebp - 0x13c], al
test al, al
je 0x426ac4
mov bl, byte [ebp - 0x140]
push ebx
push 0
mov eax, dword [0x4d91ad]
call fcn.004278b2
mov al, byte [ebp - 0x144]
push eax
push 0
mov eax, dword [0x4d91ad]
call fcn.004278b2
mov edi, dword [ebp - 4]
mov ax, word [ebp - 0x14c]
cmp word [edi + 0x9a], ax
je 0x4269b8
mov esi, dword [edi + 0x78]
mov bx, word [esi + 0x2c]
mov word [0x4d8869], bx
mov al, byte [0x4d8864]
test al, al
je 0x4269ca
mov byte [ebp - 0x140], 1
jmp 0x4269e4
mov bl, byte [0x4d8865]
test bl, bl
je 0x4269dd
mov byte [ebp - 0x140], 2
jmp 0x4269e4
mov byte [ebp - 0x140], 3
cmp word [0x4d8869], 2
jne 0x426a00
cmp byte [ebp - 0x140], 3
je 0x426a00
mov byte [ebp - 0x144], 5
jmp 0x426a10
mov byte [ebp - 0x144], 4
mov word [0x4d8869], 1
mov al, byte [ebp - 0x140]
push eax
push 1
mov eax, dword [0x4d91ad]
call fcn.004278b2
mov al, byte [ebp - 0x144]
push eax
push 1
mov eax, dword [0x4d91ad]
call fcn.004278b2
mov edi, dword [ebp - 4]
mov ax, word [edi + 0x9a]
mov word [ebp - 0x14c], ax
lea eax, [ebp - 0x140]
push eax
lea ebx, [ebp - 0x144]
push ebx
mov eax, edi
call fcn.004276e2
mov al, byte [ebp - 0x144]
push eax
mov eax, dword [ebp - 4]
call fcn.00427cc2
mov al, byte [ebp - 0x140]
push eax
lea ebx, [ebp - 0x154]
push ebx
push dword [ebp + 0x14]
mov cx, word [ebp + 0x10]
push ecx
mov eax, dword [ebp - 4]
call fcn.00427092
mov edi, dword [ebp - 4]
mov ax, word [edi + 0xa0]
cmp word [ebp - 0x154], ax
je 0x426ac4
mov bx, word [ebp - 0x154]
mov word [edi + 0xa0], bx
push 0x38
push 0x15
fild word [edi + 0xa0]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041f0e0
jmp 0x426b55
push 2
mov eax, dword [0x4d91ad]
call fcn.00427012
mov edi, dword [ebp - 4]
mov word [edi + 0x98], ax
mov eax, edi
call fcn.00427992
lea ebx, [ebp - 0x140]
push ebx
lea eax, [ebp - 0x144]
push eax
mov eax, dword [ebp - 4]
call fcn.004276e2
mov al, byte [ebp - 0x140]
push eax
lea ebx, [ebp - 0x154]
push ebx
push dword [ebp + 0x14]
mov cx, word [ebp + 0x10]
push ecx
mov eax, dword [ebp - 4]
call fcn.00427092
mov edi, dword [ebp - 4]
mov ax, word [edi + 0xa0]
cmp word [ebp - 0x154], ax
je 0x426b55
mov bx, word [ebp - 0x154]
mov word [edi + 0xa0], bx
push 0x38
push 0x15
fild word [edi + 0xa0]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041f0e0
jmp 0x426cd2
cmp al, 0x2b
je 0x426cd2
movsx ebx, word [ebp - 0x150]
mov eax, ebx
cmp eax, 1
jne 0x426bac
lea eax, [ebp - 0x578]
push eax
push 0x22
push 0x14
push 2
call fcn.0041a470
lea ebx, [ebp - 0x578]
push ebx
call fcn.00419940
mov edi, dword [ebp - 4]
mov word [edi + 0x9c], ax
cmp ax, 0
setg bl
mov byte [ebp - 0x138], bl
jmp 0x426c63
cmp eax, 2
jne 0x426c07
lea eax, [ebp - 0x578]
push eax
push 0x38
push 0x14
push 5
call fcn.0041a470
lea ebx, [ebp - 0x578]
push ebx
call fcn.00419940
mov edi, dword [ebp - 4]
mov word [edi + 0x9e], ax
cmp ax, 0
jle 0x426bfa
mov esi, edi
mov ax, word [edi + 0x9e]
cmp word [esi + 0xa0], ax
jl 0x426bfa
mov ebx, 1
jmp 0x426bff
mov ebx, 0
mov byte [ebp - 0x138], bl
jmp 0x426c63
cmp eax, 3
jne 0x426c63
lea eax, [ebp - 0x578]
push eax
push 0x38
push 0x15
push 5
call fcn.0041a470
lea ebx, [ebp - 0x578]
push ebx
call fcn.00419940
mov edi, dword [ebp - 4]
mov word [edi + 0xa0], ax
cmp word [ebp - 0x154], ax
jl 0x426c58
mov esi, edi
mov ax, word [edi + 0x9e]
cmp word [esi + 0xa0], ax
jl 0x426c58
mov ebx, 1
jmp 0x426c5d
mov ebx, 0
mov byte [ebp - 0x138], bl
mov al, byte [ebp - 0x138]
test al, al
je 0x426cd2
cmp byte [ebp - 0x18], 0x11
jne 0x426cbe
test al, al
je 0x426cb1
mov edi, dword [ebp - 4]
cmp word [edi + 0x9e], 0
jle 0x426cb1
cmp word [edi + 0xa0], 0
jle 0x426cb1
mov esi, edi
mov bx, word [edi + 0x9e]
cmp word [esi + 0xa0], bx
jl 0x426cb1
cmp word [esi + 0x9c], 0
jle 0x426cb1
mov ecx, 1
jmp 0x426cb6
mov ecx, 0
mov byte [ebp - 0x138], cl
jmp 0x426cd2
lea ebx, [ebp - 0x150]
push ebx
mov cl, byte [ebp - 0x18]
push ecx
push 1
push 3
call fcn.0041a550
mov al, byte [ebp - 0x138]
test al, al
je 0x426cf3
mov esi, 0x4c3e74
movzx eax, byte [ebp - 0x18]
push 0x1f0010
call fcn.0040148e
test al, al
jne 0x426d01
mov al, byte [ebp - 0x13c]
test al, al
jne 0x426463
mov al, byte [ebp - 0x13c]
test al, al
je 0x426e4a
cmp byte [ebp - 0x18], 0x2b
je 0x426e4a
push 1
mov eax, dword [0x4d91ad]
call fcn.00427012
mov edi, dword [ebp - 4]
mov word [edi + 0x9a], ax
mov bx, word [ebp - 0x14c]
cmp word [edi + 0x9a], bx
sete al
mov byte [ebp - 0x13c], al
test al, al
jne 0x426d6b
mov eax, edi
call fcn.00421072
mov eax, dword [ebp - 4]
call fcn.00426eb2
mov byte [ebp - 0x13c], al
test al, al
jne 0x426d6b
mov eax, dword [ebp - 4]
call fcn.00420fe2
mov al, byte [ebp - 0x13c]
test al, al
je 0x426e48
mov edi, dword [ebp - 4]
mov esi, edi
mov bx, word [edi + 0xc9]
mov word [esi + 0xa2], bx
mov eax, esi
mov bx, word [esi + 0xcb]
mov word [eax + 0xa4], bx
movzx ebx, byte [ebp - 0x140]
mov eax, ebx
cmp eax, 1
jne 0x426db4
mov eax, dword [ebp + 8]
mov byte [eax], 0x47
jmp 0x426dd0
cmp eax, 2
jne 0x426dc3
mov eax, dword [ebp + 8]
mov byte [eax], 0x48
jmp 0x426dd0
cmp eax, 3
jne 0x426dd0
mov eax, dword [ebp + 8]
mov byte [eax], 0x43
lea eax, [ebp - 0x578]
push eax
push 0x22
push 0x14
push 2
call fcn.0041a470
lea ebx, [ebp - 0x578]
push ebx
call fcn.00419940
mov edi, dword [ebp - 4]
mov word [edi + 0x9c], ax
lea ebx, [ebp - 0x578]
push ebx
push 0x38
push 0x14
push 5
call fcn.0041a470
lea eax, [ebp - 0x578]
push eax
call fcn.00419940
mov edi, dword [ebp - 4]
mov word [edi + 0x9e], ax
lea ebx, [ebp - 0x578]
push ebx
push 0x38
push 0x15
push 5
call fcn.0041a470
lea eax, [ebp - 0x578]
push eax
call fcn.00419940
mov edi, dword [ebp - 4]
mov word [edi + 0xa0], ax
jmp 0x426e59
mov byte [ebp - 0x13c], 0
mov eax, dword [ebp - 4]
call fcn.00420fe2
jmp 0x426e63
mov eax, dword [ebp - 4]
call fcn.00420fe2
jmp 0x426e9b
movzx ebx, byte [0x4d8cf7]
mov ax, bx
cmp ax, 0x54
jne 0x426e86
push 0x4c3e78
push 0x4c3e8c
call fcn.004135d0
jmp 0x426e9b
cmp ax, 0x45
jne 0x426e9b
push 0x4c3e9c
push 0x4c3eaf
call fcn.004135d0
mov al, byte [ebp - 0x13c]
pop edx
pop ecx
pop ebx
leave
ret 0x10