Function at 0x404ba0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x442108
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x4573c0]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], eax
mov esi, ecx
call fcn.004390f3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], 0
call fcn.004390f3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebp, [eax + 0x10]
mov dword [esp + 0x18], ebp
mov byte [esp + 0x28], 1
call fcn.004390f3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov edi, dword [esp + 0x30]
test edi, edi
mov byte [esp + 0x28], 2
mov dword [esi + 0x5c], 1
jne 0x404c25
xor eax, eax
jmp 0x404c2e
push edi
call fcn.004237f7
add esp, 4
push eax
push edi
lea ecx, [esp + 0x18]
call fcn.00401f80
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx - 0xc]
test eax, eax
jne 0x404c8e
add ebx, 0xfffffff0
mov byte [esp + 0x28], 1
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x404c63
mov ecx, dword [ebx]
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
lea eax, [ebp - 0x10]
mov byte [esp + 0x28], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404c82
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
jmp 0x404ea4
mov edi, dword [esp + 0x34]
test edi, edi
lea ebp, [esi + 0x38]
jne 0x404c9d
xor eax, eax
jmp 0x404ca6
push edi
call fcn.004237f7
add esp, 4
push eax
push edi
mov ecx, ebp
call fcn.00401f80
mov ebp, dword [esp + 0x38]
test ebp, ebp
lea edi, [esi + 0x3c]
jne 0x404cbe
xor eax, eax
jmp 0x404cc7
push ebp
call fcn.004237f7
add esp, 4
push eax
push ebp
mov ecx, edi
call fcn.00401f80
mov eax, dword [esp + 0x3c]
mov ecx, dword [esi + 0x38]
mov dword [esi + 0x64], eax
mov eax, dword [ecx - 0xc]
xor ebp, ebp
cmp eax, ebp
jne 0x404d00
mov edx, dword [edi]
cmp dword [edx - 0xc], ebp
jne 0x404d00
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
call fcn.00402e30
mov dword [esi + 0x68], ebp
jmp 0x404dce
push ebx
mov dword [esi + 0x68], 1
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x404d23
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call fcn.00402e30
mov dword [esi + 0x68], ebp
cmp dword [esi + 0x68], ebp
je 0x404dce
push 0x445970
push ebx
call fcn.0042380d
add esp, 8
cmp eax, ebp
je 0x404d8a
sub eax, ebx
sar eax, 1
cmp eax, 0xffffffff
je 0x404d8a
push ebx
lea edx, [esp + 0x34]
push edx
mov ecx, esi
call fcn.00404570
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 3
call fcn.00402e30
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x28], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404d86
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ebx, dword [esp + 0x10]
push 0x44591c
push ebx
lea eax, [esp + 0x38]
push eax
mov ecx, esi
call fcn.00404660
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 4
call fcn.00402e30
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x28], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404dce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, esi
call fcn.00404800
push ebp
mov ebp, dword [esp + 0x18]
push ebp
mov ecx, esi
call fcn.0041af11
test eax, eax
je 0x404e5f
mov eax, dword [esi + 0x44]
lea edi, [esi + 0x44]
push 0
push ebp
mov ecx, edi
call dword [eax + 0x40]
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x44]
mov ecx, esi
mov dword [esi + 0x6c], eax
call fcn.00403d90
test eax, eax
je 0x404e31
add ebx, 0xfffffff0
mov byte [esp + 0x28], 1
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x404f02
mov ecx, dword [ebx]
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
jmp 0x404f02
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x404e5f
mov ecx, esi
call fcn.0041ac42
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x44]
mov ecx, esi
mov dword [esi + 0x6c], eax
call fcn.00403d90
test eax, eax
jne 0x404ee3
mov eax, dword [esi + 0x6c]
test eax, eax
jne 0x404e38
add ebx, 0xfffffff0
mov byte [esp + 0x28], 1
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x404e7e
mov ecx, dword [ebx]
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x28], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404ea1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x10]
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404ec3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
xor eax, eax
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x10]
pop ebx
call fcn.00423e28
add esp, 0x1c
ret 0x10
add ebx, 0xfffffff0
mov byte [esp + 0x28], 1
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404f02
mov ecx, dword [ebx]
mov eax, dword [ecx]
push ebx
call dword [eax + 4]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x28], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404f25
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x10]
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404f47
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, 1
jmp 0x404ec5