Function at 0x4470a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x583701
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push ebx
push esi
push edi
mov eax, dword [0x5eb6e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], 0
mov esi, 1
mov dword [ebp - 4], esi
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
push eax
call fcn.00403760
mov ebx, dword [ebp + 0xc]
add eax, 0x10
add esp, 4
mov dword [ebx], eax
mov dword [ebp - 0x34], esi
call fcn.00453e50
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x44710b
push 0x80004005
call fcn.004038e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 2
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x90]
push ecx
lea edx, [ebp - 0x30]
push str._W32:0x_p
push edx
call fcn.00404130
mov eax, dword [esi + 4]
add esp, 0xc
push eax
push str._ROOT_
mov ecx, ebx
call fcn.0042d2a0
mov eax, dword [esi + 0x34]
push eax
push str._DRV_NAME_
mov ecx, ebx
call fcn.0042d2a0
mov eax, dword [esi + 0x30]
push eax
push str._MDL_
mov ecx, ebx
call fcn.0042d2a0
mov eax, dword [ebp - 0x30]
push eax
push str._W32
mov ecx, ebx
call fcn.0042d2a0
mov eax, dword [esi + 0x38]
push eax
push str._MDL_SCN_
mov ecx, ebx
call fcn.0042d2a0
mov eax, dword [esi + 0xa0]
push eax
push str._DEVOP_OPT_INF_
mov ecx, ebx
call fcn.0042d2a0
lea esi, [ebp - 0x2c]
mov edi, 0x5f38c8
call fcn.0040b250
mov byte [ebp - 4], 3
mov eax, dword [eax]
push eax
push str._PRINTER_NAME_
mov ecx, ebx
call fcn.0042d2a0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4471df
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00436d60
mov byte [ebp - 4], 4
mov eax, dword [eax]
push eax
push str._CAPTION_
mov ecx, ebx
call fcn.0042d2a0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44721e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x2c]
push eax
push str._PRODUCT_NAME_
mov ecx, ebx
call fcn.0042d2a0
call fcn.00453e50
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x44724b
push 0x80004005
call fcn.004038e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 5
mov ecx, dword [esi + 0x3c]
push ecx
lea edx, [ebp - 0x2c]
push 0x5b1fe0
push edx
call fcn.00404130
mov eax, dword [ebp - 0x2c]
add esp, 0xc
push eax
push str._CATEGORY_
mov ecx, ebx
call fcn.0042d2a0
call fcn.00453e50
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x44729d
push 0x80004005
call fcn.004038e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x40]
push edx
lea eax, [ebp - 0x28]
push str.0x_X
push eax
call fcn.00404130
mov ecx, dword [ebp - 0x28]
add esp, 0xc
push ecx
push str._REGION_
mov ecx, ebx
call fcn.0042d2a0
lea esi, [ebp - 0x78]
call fcn.00419490
mov edi, esi
mov ecx, 0x5f38c8
mov byte [ebp - 4], 7
call fcn.00417c20
call fcn.00453e50
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x44730a
push 0x80004005
call fcn.004038e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 8
mov cx, word [ebp - 0x64]
mov dx, word [ebp - 0x70]
movzx eax, dx
test cx, cx
je 0x447332
movzx eax, cx
jmp 0x447341
mov ecx, 0xc04
cmp dx, cx
jne 0x447341
mov eax, 0x404
movzx edx, ax
push edx
lea eax, [ebp - 0x1c]
push str.0x_X
push eax
call fcn.00404130
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
push ecx
push str._LCID_
mov ecx, ebx
call fcn.0042d2a0
mov eax, dword [0x5f3a9c]
mov edx, dword [0x5f3a98]
push eax
lea eax, [ebp - 0x1c]
push 0x5b1fe0
push eax
mov dword [ebp - 0x48], edx
call fcn.00404130
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
push ecx
push str._OPT_STM_
mov ecx, ebx
call fcn.0042d2a0
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jl 0x4473d6
push str.RG:W
push eax
call fcn.0055269b
add esp, 8
test eax, eax
je 0x4473d6
sub eax, dword [ebx]
sar eax, 1
cmp eax, 0xffffffff
je 0x4473d6
mov edx, dword [ebp + 8]
test dword [edx + 0x40], 0x100000
je 0x4473d6
push str.RG:J
push str.RG:W
mov ecx, ebx
call fcn.0042d2a0
call fcn.00453e50
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4473f0
push 0x80004005
call fcn.004038e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x24], esi
push 0
mov byte [ebp - 4], 9
mov eax, dword [ebx]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test edi, edi
jle 0x447470
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x447433
push edi
lea ecx, [ebp - 0x24]
call fcn.00403620
mov esi, dword [ebp - 0x24]
mov eax, dword [ebx]
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.00551122
add esp, 8
test eax, eax
jl 0x44754f
cmp eax, dword [esi - 8]
jg 0x44754f
xor ecx, ecx
mov dword [esi - 0xc], eax
lea edx, [ebp - 0x24]
mov word [esi + eax*2], cx
push edx
mov ecx, ebx
call fcn.004037d0
mov edi, dword [ebp + 8]
lea esi, [ebp - 0x20]
call fcn.00448090
push 0x5bb410
push eax
call fcn.00411390
add esp, 8
test al, al
je 0x44749c
mov eax, edi
cmp dword [eax + 0x94], 0
mov byte [ebp - 0xd], 1
jne 0x4474a0
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov dword [ebp - 0x34], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4474c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [ebp - 0xd], 0
je 0x4474f0
push 0x5b25a8
push 0x5be7b4
mov ecx, ebx
call fcn.0042d2a0
push 0x5b25a8
push 0x5be7bc
mov ecx, ebx
call fcn.0042d2a0
mov edi, edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jl 0x4479ae
push 0x5be7c4
push eax
call fcn.0055269b
add esp, 8
test eax, eax
je 0x4479ae
mov ecx, dword [edi]
sub eax, ecx
sar eax, 1
mov esi, eax
cmp esi, 0xffffffff
je 0x4479ae
mov edx, dword [ecx - 0xc]
lea eax, [esi + 1]
test eax, eax
jl 0x447559
cmp eax, edx
jg 0x447559
lea ecx, [ecx + eax*2]
push 0x5be7c4
push ecx
call fcn.0055269b
add esp, 8
test eax, eax
je 0x447559
sub eax, dword [edi]
sar eax, 1
jmp 0x44755c
push 0x80070057
call fcn.004038e0
or eax, 0xffffffff
sub eax, esi
inc eax
push eax
push esi
lea edx, [ebp - 0x14]
push edx
mov ecx, edi
call fcn.00404cf0
mov byte [ebp - 4], 0xa
mov esi, dword [ebp - 0x14]
mov ecx, 0x5be7c8
mov eax, esi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4475a6
test dx, dx
je 0x4475a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4475a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x447580
xor eax, eax
jmp 0x4475ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x447695
mov esi, dword [0x5f3aa0]
cmp esi, 0xffffffff
je 0x44797d
call fcn.00453e50
xor ecx, ecx
xor edi, edi
cmp eax, edi
setne cl
cmp ecx, edi
je 0x447101
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x5c], vtable.CArray_struct_tagSearchResult__struct_tagSearchResult__.0
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], edi
mov byte [ebp - 4], 0xc
mov eax, dword [0x5f3a44]
lea edi, [ebp - 0x5c]
call fcn.00445e60
mov edi, dword [ebp - 0x58]
mov eax, dword [0x5f3a44]
mov ecx, dword [0x5f3a40]
push edi
call fcn.0040adb0
mov ebx, dword [ebp - 0x54]
lea ecx, [esi - 1]
cmp ebx, ecx
jl 0x44765f
test esi, esi
jl 0x4479a9
cmp esi, ebx
jge 0x4479a9
shl esi, 4
add esi, edi
add esi, 0xc
push esi
lea ecx, [ebp - 0x20]
call fcn.004037d0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
push edx
push eax
call fcn.0042d2a0
mov byte [ebp - 4], 0xb
test edi, edi
je 0x447686
test ebx, ebx
jle 0x44767d
mov esi, edi
lea ecx, [ecx]
call fcn.0040ad30
add esi, 0x10
sub ebx, 1
jne 0x447670
push edi
call fcn.004533aa
add esp, 4
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
jmp 0x447964
mov ecx, str._PANEL_GUIDE_
mov eax, esi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4476c6
test dx, dx
je 0x4476c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4476c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4476a0
xor eax, eax
jmp 0x4476cb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x447774
call fcn.00453e50
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x447101
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x20], eax
push 0xf
lea ecx, [ebp - 0x38]
push ecx
mov bl, 0xd
mov ecx, 0x5f38c8
mov byte [ebp - 4], bl
call fcn.00432310
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xe
call fcn.004037d0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44773f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0xc], 0
lea ecx, [ebp - 0x20]
je 0x447754
push 9
push str.wac_p.htm
jmp 0x44775b
push 0xa
push str.wac_np.htm
call fcn.00405900
mov esi, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
push esi
push edx
mov ecx, edi
call fcn.0042d2a0
jmp 0x44795d
mov ecx, str._DEF_FIL_XML_
mov eax, esi
jmp 0x447780
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4477a6
test dx, dx
je 0x4477a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4477a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x447780
xor eax, eax
jmp 0x4477ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x4477ce
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
cmp dword [eax - 0xc], 0
je 0x4477ce
push eax
push esi
mov ecx, edi
call fcn.0042d2a0
jmp 0x44797d
mov ecx, str._SOFTWARE_PATH_
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4477fb
test dx, dx
je 0x4477f7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4477fb
add eax, 4
add ecx, 4
test dx, dx
jne 0x4477d5
xor eax, eax
jmp 0x447800
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x4478df
push 0xe
lea edx, [ebp - 0x18]
push edx
mov ecx, 0x5f38c8
call fcn.00432310
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
push eax
call fcn.00403760
add eax, 0x10
add esp, 4
mov dword [ebp - 0x20], eax
mov bl, 0x10
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
push 0x5c
push eax
call fcn.00550e69
mov ecx, dword [ebp - 0x18]
add esp, 8
test eax, eax
jne 0x447855
or eax, 0xffffffff
jmp 0x447859
sub eax, ecx
sar eax, 1
mov edx, dword [ecx - 0xc]
dec edx
cmp eax, edx
jne 0x4478a1
mov eax, dword [ecx - 0xc]
dec eax
push eax
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x18]
call fcn.0040ab10
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x11
call fcn.004037d0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x3c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4478a1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
push esi
push ecx
mov ecx, edi
call fcn.0042d2a0
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0xf
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4478d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
jmp 0x447964
lea eax, [esi - 0x10]
push eax
call fcn.00403760
lea esi, [eax + 0x10]
add esp, 4
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 0x12
call fcn.00448290
mov ebx, eax
call fcn.004482d0
mov eax, dword [ebp - 0x14]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x44], esp
mov edi, esp
push eax
call fcn.00403760
add esp, 4
lea ecx, [ebp - 0x40]
add eax, 0x10
push ecx
mov ecx, dword [ebp + 8]
mov dword [edi], eax
call fcn.00446f80
mov byte [ebp - 4], 0x13
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
push eax
push esi
call fcn.0042d2a0
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x40]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44795d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0xa
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44797d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4474f0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4474f0
call fcn.00453d3c
mov edi, dword [ebp + 8]
cmp dword [edi + 0x98], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
jne 0x447a1a
push str.PRM_NoSTM
call fcn.00403320
mov byte [ebp - 4], 0x14
mov eax, dword [edi + 0x9c]
push ecx
sub eax, 0x10
mov dword [ebp - 0x40], esp
mov esi, esp
push eax
call fcn.00403760
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 0x15
mov eax, dword [edi]
sub eax, 0x10
mov dword [ebp - 0x3c], esp
mov esi, esp
push eax
call fcn.00403760
add eax, 0x10
lea ecx, [ebp + 8]
add esp, 4
mov dword [esi], eax
push ecx
mov byte [ebp - 4], 9
call fcn.00413730
add esp, 0x10
mov byte [ebp - 4], 0x16
jmp 0x447a72
push str.PRM_YesSTM
call fcn.00403320
mov byte [ebp - 4], 0x17
mov eax, dword [edi + 0x9c]
push ecx
sub eax, 0x10
mov dword [ebp - 0x40], esp
mov esi, esp
push eax
call fcn.00403760
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 0x18
mov eax, dword [edi]
sub eax, 0x10
mov dword [ebp - 0x3c], esp
mov esi, esp
push eax
call fcn.00403760
add eax, 0x10
lea ecx, [ebp + 8]
add esp, 4
mov dword [esi], eax
push ecx
mov byte [ebp - 4], 9
call fcn.00413730
add esp, 0x10
mov byte [ebp - 4], 0x19
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.00405900
mov byte [ebp - 4], 9
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x447aa4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp + 0xc]
call fcn.00448200
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447acf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447af2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x74]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447b15
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x78]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447b34
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447b57
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447b7a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447b9d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447bc0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc