Function at 0x4241f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x562e8e
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x5d26e8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x3dc], edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x3d8], ebx
call fcn.00426f90
xor esi, esi
mov dword [ebp - 0x39c], esi
mov dword [ebp - 0x398], esi
mov dword [ebp - 0x394], esi
mov dword [ebp - 0x390], esi
mov dword [ebp - 0x38c], esi
mov dword [ebp - 0x388], esi
lea eax, [ebp - 0x39c]
push eax
push ebx
call fcn.004a1e94
test eax, eax
je 0x424dd9
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x39d]
call fcn.004fd3d0
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
mov edx, dword [edi]
mov ecx, edi
mov eax, dword [edx + 0x58]
call eax
mov edx, dword [edi]
mov ecx, edi
mov eax, dword [edx + 0x6c]
call eax
mov edx, dword [edi]
push 1
mov ecx, edi
mov eax, dword [edx + 0x5c]
call eax
push esi
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [edi + 0x6c]
mov dword [ebp - 0x3c4], ecx
mov edx, dword [edi + 0x7c]
mov dword [ebp - 0x3c8], edx
mov eax, dword [edi + 0x78]
mov dword [ebp - 0x3d0], eax
mov ecx, dword [edi + 0x70]
mov dword [ebp - 0x3bc], ecx
mov edx, dword [edi + 0x74]
mov dword [ebp - 0x400], edx
mov ebx, dword [edi + 0x80]
mov dword [ebp - 0x3f0], ebx
call fcn.00422260
mov dword [ebp - 0x3f4], eax
mov esi, dword [edi + 0x50]
mov byte [esi + 0x449], bl
mov byte [ebp - 0x3a5], 0
cmp byte [esi + 0x46a], 0
je 0x4249df
push 1
push 0x58a919
mov ecx, esi
call fcn.0042a5b0
mov byte [esi + 0x454], 1
mov byte [esi + 0x448], 0
push 0x58a919
lea eax, [ebp - 0x41c]
push eax
mov ecx, esi
call fcn.0042c110
test al, al
je 0x424b73
mov ecx, dword [ebp - 0x414]
shr ecx, 0x10
and ecx, 0x7fff
mov dword [esi + 0xc], ecx
push 1
push 0x58a919
mov ecx, esi
call fcn.0042ae50
test eax, eax
jne 0x424b73
mov edx, dword [esi]
push 1
push esi
mov eax, dword [edx + 0x20]
call eax
test eax, eax
jne 0x424b73
push 1
push 1
movzx ecx, byte [esi + 0x449]
push ecx
mov ecx, esi
call fcn.0042a8d0
cmp byte [esi + 0x450], 0
je 0x4243b9
cmp eax, 4
je 0x4243a4
cmp eax, 1
jne 0x4243b9
movzx edx, byte [esi + 0x448]
or dl, 0x30
mov byte [esi + 0x448], dl
jmp 0x424b73
lea eax, [ebp - 0x408]
push eax
call fcn.00422520
mov ecx, dword [eax]
mov dword [ebp - 0x3fc], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x3f8], edx
xor bl, bl
mov byte [ebp - 0x3ad], bl
cmp byte [esi + 0x450], bl
je 0x424487
push 1
push 0x58a919
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x424487
cmp word [esi + 0x12], 0
jne 0x424455
lea ebx, [esi + 0x14]
lea eax, [ebp - 0x3c0]
push eax
push 0x17
push ebx
call fcn.00469d00
mov cx, word [ebp - 0x3c0]
mov word [ebp - 0x3de], cx
lea edx, [ebp - 0x3c0]
push edx
push 0x18
push ebx
call fcn.00469d00
mov ax, word [ebp - 0x3c0]
mov word [ebp - 0x3e0], ax
push 0
mov ecx, esi
call fcn.00428070
mov bl, 1
mov byte [ebp - 0x3ad], bl
test bl, bl
je 0x4249ca
mov eax, dword [ebp - 0x3e0]
cdq
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], edx
movzx eax, byte [esi + 0x449]
cmp eax, 3
ja case.default.0x424480
jmp dword [eax*4 + 0x4250ec]
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x118]
push edx
push 0x104
push str..ini
push str.TasManager
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
je 0x424506
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x260], ebx
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x118]
push ecx
call fcn.004a1e94
test eax, eax
je 0x424506
mov ebx, dword [ebp - 0x274]
mov dword [ebp - 0x3d4], ebx
mov edx, dword [ebp - 0x270]
mov dword [ebp - 0x3d0], edx
jmp 0x42451b
mov ebx, 0x41b43985
mov dword [ebp - 0x3d4], ebx
mov dword [ebp - 0x3d0], 0
lea eax, [ebp - 0x3cc]
push eax
push 0xf003f
push 0
push str.SoftwareDataEnvDesSolLtdManager
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x3c8], 4
test eax, eax
jne 0x424702
lea ecx, [ebp - 0x3c8]
push ecx
lea edx, [ebp - 0x3b4]
push edx
lea eax, [ebp - 0x3e0]
push eax
push 0
push str.LastEnv
mov ecx, dword [ebp - 0x3cc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x3b8], eax
rol eax, 0x17
mov dword [ebp - 0x3b8], eax
movsx ecx, byte [ebp - 0x3b8]
shr eax, 0x18
xor eax, ecx
mov byte [ebp - 0x3b5], al
movsx eax, byte [ebp - 0x3b7]
xor eax, ecx
mov byte [ebp - 0x3b7], al
movsx eax, al
movsx edx, byte [ebp - 0x3b6]
xor edx, eax
mov byte [ebp - 0x3b6], dl
xor eax, ecx
mov byte [ebp - 0x3b8], al
mov ecx, dword [ebp - 0x3b8]
mov eax, ecx
shr eax, 0x18
mov edx, ecx
shr edx, 0x12
xor al, dl
mov edx, ecx
shr edx, 0xc
xor al, dl
mov edx, ecx
shr edx, 6
xor al, dl
and al, 0x3f
mov edx, ecx
shr edx, 0x1e
xor al, dl
mov edx, ecx
and edx, 0x3f
cmp dl, al
je 0x424613
mov ecx, 0x7fffffc0
jmp 0x424616
and ecx, 0xffffffc0
mov dword [ebp - 0x3b8], ecx
mov dword [ebp - 0x3b4], ecx
cmp dword [ebp - 0x3d0], 0
je 0x424800
lea eax, [ebp - 0x3ec]
push eax
lea ecx, [ebp - 0x3cc]
push ecx
push 0
push 0xf003f
push 0
push str.REG_DWORD
push 0
push str.SoftwareDataEnvDesSolLtdManager
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x3d0], eax
mov dword [ebp - 0x3b4], ebx
mov ecx, ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x3ac], ecx
mov eax, ecx
shr eax, 6
xor eax, ecx
shr eax, 6
xor eax, ecx
shr eax, 6
xor eax, ecx
and eax, 0xfc0
mov edx, ecx
shr edx, 0x18
xor eax, edx
shr eax, 6
and ecx, 0xffffffc0
or eax, ecx
mov dword [ebp - 0x3ac], eax
shr eax, 8
movsx ecx, byte [ebp - 0x3ac]
xor eax, ecx
mov byte [ebp - 0x3ac], al
movsx ecx, byte [ebp - 0x3ab]
movsx edx, byte [ebp - 0x3aa]
xor edx, ecx
mov byte [ebp - 0x3aa], dl
movsx eax, al
xor ecx, eax
mov byte [ebp - 0x3ab], cl
movsx ecx, byte [ebp - 0x3a9]
xor ecx, eax
mov byte [ebp - 0x3a9], cl
mov eax, dword [ebp - 0x3ac]
ror eax, 0x17
mov dword [ebp - 0x3ac], eax
jmp 0x4247d0
lea edx, [ebp - 0x3ec]
push edx
lea eax, [ebp - 0x3cc]
push eax
push 0
push 0xf003f
push 0
push str.REG_DWORD
push 0
push str.SoftwareDataEnvDesSolLtdManager
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x3d0], eax
mov dword [ebp - 0x3b4], ebx
mov ecx, ebx
mov dword [ebp - 0x408], ecx
mov dword [ebp - 0x404], 0
mov dword [ebp - 0x3a4], ecx
mov eax, ecx
shr eax, 6
xor eax, ecx
shr eax, 6
xor eax, ecx
shr eax, 6
xor eax, ecx
and eax, 0xfc0
mov edx, ecx
shr edx, 0x18
xor eax, edx
shr eax, 6
and ecx, 0xffffffc0
or eax, ecx
mov dword [ebp - 0x3a4], eax
shr eax, 8
movsx ecx, byte [ebp - 0x3a4]
xor eax, ecx
mov byte [ebp - 0x3a4], al
movsx ecx, byte [ebp - 0x3a3]
movsx edx, byte [ebp - 0x3a2]
xor edx, ecx
mov byte [ebp - 0x3a2], dl
movsx eax, al
xor ecx, eax
mov byte [ebp - 0x3a3], cl
movsx ecx, byte [ebp - 0x3a1]
xor ecx, eax
mov byte [ebp - 0x3a1], cl
mov eax, dword [ebp - 0x3a4]
ror eax, 0x17
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0x3b4], eax
mov edx, dword [ebp - 0x3c8]
push edx
lea eax, [ebp - 0x3b4]
push eax
push 4
push 0
push str.LastEnv
mov ecx, dword [ebp - 0x3cc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x3b4], ebx
mov edx, dword [ebp - 0x3cc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3d0], 0
jne 0x4249ca
mov byte [ebp - 0x3ad], 1
jmp 0x42445d
mov eax, dword [esi + 0x430]
shl eax, 0x10
cdq
mov dword [ebp - 0x3e4], eax
mov ebx, edx
movzx eax, byte [esi + 0x440]
cdq
jmp 0x4248b4
mov eax, dword [esi + 0x438]
shl eax, 0x10
cdq
mov dword [ebp - 0x3e4], eax
mov ebx, edx
movzx eax, byte [esi + 0x442]
cdq
jmp 0x4248b4
mov eax, dword [esi + 0x434]
shl eax, 0x10
cdq
mov dword [ebp - 0x3e4], eax
mov ebx, edx
movzx eax, byte [esi + 0x441]
cdq
jmp 0x4248b4
mov eax, dword [esi + 0x43c]
shl eax, 0x10
cdq
mov dword [ebp - 0x3e4], eax
mov ebx, edx
movzx eax, byte [esi + 0x443]
cdq
jmp 0x4248b4
mov ebx, dword [ebp - 0x3e0]
mov edx, dword [ebp - 0x404]
mov eax, dword [ebp - 0x408]
push 0
push 0x93a80
push edx
push eax
call fcn.004cf660
add eax, dword [ebp - 0x3e4]
adc edx, ebx
cmp dword [ebp - 0x3f8], ebx
jl 0x4249b6
mov ebx, dword [ebp - 0x3fc]
jg 0x4248ea
cmp ebx, dword [ebp - 0x3e4]
jb 0x4249b6
mov ecx, dword [ebp - 0x3f8]
cmp ecx, edx
jg 0x4249b6
jl 0x424902
cmp ebx, eax
ja 0x4249b6
mov eax, dword [ebp - 0x410]
add eax, 0xffffeae8
cdq
xor eax, edx
sub eax, edx
cdq
cmp ecx, edx
jl 0x4249b6
jg 0x424925
cmp ebx, eax
jbe 0x4249b6
movzx eax, byte [esi + 0x449]
cmp dword [ebp - 0x3f0], eax
jne 0x4249a1
movzx eax, byte [esi + 0x44b]
lea ecx, [eax + eax*4]
movzx edx, byte [esi + 0x44c]
lea ecx, [edx + ecx*2]
mov eax, dword [ebp - 0x400]
lea edx, [eax + eax*4]
mov eax, dword [ebp - 0x3bc]
lea edx, [eax + edx*2]
cmp edx, ecx
jg 0x4249a1
mov eax, dword [ebp - 0x414]
shr eax, 0x10
and eax, 0x7fff
cmp eax, dword [esi + 0xc]
jne 0x42498c
mov ecx, esi
call fcn.0042acd0
cmp byte [esi + 0x44f], al
jne 0x42498c
mov dword [esi + 4], 0xffffffff
jmp 0x424b73
movzx ecx, byte [esi + 0x448]
or cl, 0x21
mov byte [esi + 0x448], cl
jmp 0x424b73
movzx edx, byte [esi + 0x448]
or dl, 0x22
mov byte [esi + 0x448], dl
jmp 0x424b73
movzx eax, byte [esi + 0x448]
or al, 0x24
mov byte [esi + 0x448], al
jmp 0x424b73
movzx ecx, byte [esi + 0x448]
or cl, 0x28
mov byte [esi + 0x448], cl
jmp 0x424b73
mov ecx, dword [esi + 0x460]
mov edx, dword [ecx]
mov eax, dword [edx + 0x40]
call eax
mov ecx, dword [esi + 0x460]
cmp byte [ecx + 0x128], 0
je 0x424b47
cmp byte [ecx + 0x129], 0
jne 0x424b47
test eax, eax
jne 0x424b47
movzx eax, byte [esi + 0x449]
cmp eax, 3
ja case.default.0x424a20
jmp dword [eax*4 + 0x4250fc]
mov eax, 1
jmp 0x424a49
mov eax, 2
jmp 0x424a49
mov eax, 4
jmp 0x424a49
mov eax, 3
jmp 0x424a49
mov eax, dword [ebp - 0x3e0]
push 0
push eax
call fcn.00552af0
test eax, eax
je 0x424b73
mov ecx, dword [esi + 0x460]
call fcn.0054b840
test eax, eax
je 0x424b73
mov ecx, dword [esi + 0x460]
push 0x57c8f4
push str.VersionMajor
call fcn.0054b870
push eax
call fcn.004d1a94
add esp, 4
mov ebx, eax
mov ecx, dword [esi + 0x460]
push 0x57c8f4
push str.VersionMinor1
call fcn.0054b870
push eax
call fcn.004d1a94
add esp, 4
mov dword [ebp - 0x3f0], eax
mov ecx, dword [esi + 0x460]
push 0x57c8f4
push str.VersionMinor2
call fcn.0054b870
push eax
call fcn.004d1a94
add esp, 4
mov dword [ebp - 0x3ec], eax
mov ecx, dword [esi + 0x460]
push 0x57c8f4
push str.VersionMinor3
call fcn.0054b870
push eax
call fcn.004d1a94
add esp, 4
lea ecx, [ebx + ebx*4]
mov edx, dword [ebp - 0x3f0]
lea ecx, [edx + ecx*2]
lea ecx, [ecx + ecx*4]
mov edx, dword [ebp - 0x3ec]
lea ecx, [edx + ecx*2]
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*2]
mov eax, dword [ebp - 0x400]
lea edx, [eax + eax*4]
mov eax, dword [ebp - 0x3bc]
lea eax, [eax + edx*2]
lea edx, [eax + eax*4]
mov eax, dword [ebp - 0x3d0]
lea eax, [eax + edx*2]
lea edx, [eax + eax*4]
mov eax, dword [ebp - 0x3c8]
lea eax, [eax + edx*2]
cmp ecx, eax
jl 0x424b73
mov dword [esi + 4], 0xffffffff
jmp 0x424b73
cmp byte [esi + 0x468], 0
jne 0x424b68
test al, 0x10
je 0x424b68
mov byte [esi + 0x468], 1
mov ecx, dword [esi + 0x460]
call fcn.00420b90
jmp 0x424b73
test al, 0x40
je 0x424b73
mov byte [ebp - 0x3a5], 1
mov eax, 1
add dword [esi + 4], eax
mov ebx, dword [ebp - 0x3f4]
cmp dword [ebp - 0x3c4], 0
je 0x424bab
cmp dword [esi + 8], eax
jne 0x424ba2
push 0
push 0x6e
push 0x111
mov ecx, dword [ebx + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
inc dword [esi + 8]
mov eax, dword [esi + 8]
add dword [esi + 4], eax
mov eax, dword [esi + 4]
cmp eax, 2
jle 0x424c0d
cmp eax, 7
jge 0x424c0d
cdq
mov ecx, 3
idiv ecx
test edx, edx
jne 0x424c0d
mov eax, dword [esi + 0x460]
push edx
cmp byte [eax + 0x128], dl
jne 0x424be3
push 0x8092
push 0x111
mov edx, dword [ebx + 0x1c]
push edx
jmp 0x424c07
cmp byte [ebp - 0x3a5], 0
je 0x424bfc
push 0x8094
push 0x111
mov eax, dword [ebx + 0x1c]
push eax
jmp 0x424c07
push 0x66
push 0x111
mov ecx, dword [ebx + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esi + 4]
cmp eax, 7
jle 0x424c34
cmp eax, 0xd
jge 0x424c34
cdq
mov ecx, 3
idiv ecx
test edx, edx
jne 0x424c34
push edx
push edx
push 0x10
mov edx, dword [ebx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esi + 4]
cmp eax, 0xd
jle 0x424c54
cmp eax, 0x13
jge 0x424c54
cdq
mov ecx, 3
idiv ecx
test edx, edx
jne 0x424c54
push edx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [esi + 4]
cmp eax, 0x13
jle 0x424c7a
cdq
mov ecx, 3
idiv ecx
test edx, edx
jne 0x424c7a
push edx
push 0x68
push 0x111
mov edx, dword [ebx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [esi + 0x454], 0
xor ebx, ebx
push ebx
mov ecx, esi
call fcn.00428070
mov ecx, dword [edi + 0x60]
cmp byte [edi + 0x8c], bl
je 0x424cb2
call fcn.004f9530
mov eax, dword [edi + 0x88]
push eax
call fcn.004ce2e1
add esp, 4
mov byte [edi + 0x8c], bl
jmp 0x424cbb
cmp ecx, ebx
je 0x424cbb
call fcn.004f9590
mov dword [edi + 0x60], ebx
mov eax, dword [edi + 0x5c]
cmp eax, ebx
je 0x424cd0
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
mov dword [edi + 0x5c], ebx
push 0x60
call fcn.004947e1
add esp, 4
mov dword [ebp - 0x3e0], eax
mov byte [ebp - 4], 3
cmp eax, ebx
je 0x424cf1
mov ecx, eax
call fcn.00430c00
jmp 0x424cf3
xor eax, eax
mov byte [ebp - 4], 2
mov dword [edi + 0x5c], eax
mov esi, dword [ebp - 0x3d8]
push esi
lea ecx, [ebp - 0x3bc]
call fcn.004087e0
mov byte [ebp - 4], 4
xor eax, eax
cmp byte [edi + 0x64], al
setne al
inc eax
push eax
lea ecx, [ebp - 0x3bc]
push ecx
mov ecx, dword [edi + 0x5c]
call fcn.0042f2e0
mov bl, al
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3bc]
call fcn.004022b0
test bl, bl
je 0x424de0
mov byte [ebp - 4], 5
push 0
push 0x12
push str.database
mov edx, dword [edi + 0x5c]
push edx
call fcn.004f9b60
add esp, 0x10
mov dword [edi + 0x60], eax
mov dword [ebp - 4], 2
jmp 0x424e55
xor eax, eax
jmp 0x425042
mov eax, dword [edi + 0x5c]
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
mov dword [edi + 0x5c], 0
mov byte [ebp - 4], 8
push esi
lea ecx, [ebp - 0x3bc]
call fcn.004087e0
mov bl, 9
mov byte [ebp - 4], bl
lea eax, [ebp - 0x3bc]
push eax
lea ecx, [ebp - 0x3c4]
push ecx
call fcn.0042ce50
add esp, 8
mov byte [ebp - 4], 0xa
mov eax, dword [eax]
push 0
push 0x1b4
push 0
push eax
call fcn.004f9370
add esp, 0x10
mov dword [edi + 0x60], eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3c4]
call fcn.004022b0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x3bc]
call fcn.004022b0
mov dword [ebp - 4], 2
mov edx, dword [edi]
push 0
mov ecx, edi
mov eax, dword [edx + 0x5c]
call eax
mov dword [ebp - 4], 1
jmp 0x424eee
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x39d]
call fcn.004fcd10
mov dword [ebp - 4], 0xffffffff
jmp 0x424f19
lea ecx, [ebp - 0x14c]
call fcn.004264f0
mov ebx, 0xf
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x14c]
call fcn.00507220
mov dword [0x5d8794], eax
mov eax, dword [edi + 0x60]
mov dword [0x5d8790], eax
mov ecx, dword [edi + 0x60]
test ecx, ecx
je 0x424fb5
push str.TasDocumentVersion
call fcn.004f96c0
test eax, eax
jne 0x424fa4
push 0x803f
lea ecx, [ebp - 0x3c4]
push ecx
call fcn.0041d0c0
add esp, 8
mov byte [ebp - 4], 0x10
mov eax, dword [eax]
push 0
push 0
push eax
call fcn.004a0dad
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3c4]
call fcn.004022b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14c]
call fcn.00427f70
xor eax, eax
jmp 0x425042
push 0
mov ecx, eax
call fcn.004fc3d0
mov edx, dword [eax]
mov dword [edi + 0x84], edx
mov esi, dword [edi + 0x84]
mov eax, dword [edi]
mov ecx, edi
mov edx, dword [eax + 0xb0]
call edx
mov ecx, edi
cmp eax, esi
jle 0x4250a3
mov eax, dword [edi]
push esi
mov edx, dword [eax + 0xc0]
call edx
mov ecx, edi
test al, al
mov eax, dword [edi]
je 0x425086
mov edx, dword [eax + 0xb0]
call edx
cmp eax, dword [edi + 0x84]
jle 0x42502b
jmp 0x425000
mov eax, dword [edi]
mov ecx, dword [ebp - 0x3d8]
push ecx
mov ecx, edi
mov edx, dword [eax + 0xc4]
call edx
mov ecx, edi
test al, al
mov eax, dword [edi]
je 0x425060
mov edx, dword [eax + 0xb0]
call edx
cmp eax, dword [edi + 0x84]
jg 0x425000
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14c]
call fcn.00427f70
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004cdc91
mov esp, ebp
pop ebp
ret 4
mov edx, dword [eax + 0x70]
call edx
call fcn.00422260
test eax, eax
je 0x424f8b
push 1
push edi
call fcn.00422260
mov ecx, eax
call fcn.004a3880
jmp 0x424f8b
mov edx, dword [eax + 0x70]
call edx
call fcn.004a10cf
test eax, eax
je 0x424f8b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x74]
call eax
jmp 0x42506a
mov edx, dword [edi]
mov eax, dword [edx + 0xb0]
call eax
cmp eax, dword [edi + 0x84]
jge 0x42502b
mov edx, dword [edi]
mov ecx, edi
mov eax, dword [edx + 0x70]
call eax
call fcn.004a2512
test eax, eax
je 0x424f8b
push 0x8042
lea ecx, [ebp - 0x3c4]
push ecx
call fcn.0041d0c0
add esp, 8
mov byte [ebp - 4], 0x11
jmp 0x424f71