Function at 0x405e70
Capabilities:
Create directory
Get disk size
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edi
mov eax, dword [edi + 0x16c]
mov byte [edi + 0x18c], 1
test eax, eax
je 0x406a49
mov ecx, dword [edi + 0x178]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x405ec6
test dx, dx
je 0x405ec2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x405ec6
add ecx, 4
add eax, 4
test dx, dx
jne 0x405ea0
xor eax, eax
jmp 0x405ecb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x405edd
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
push 0
call fcn.0043e66e
add esp, 4
lea ecx, [edi + 0x16c]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], edx
call fcn.00419330
mov dword [esp + 0x48], eax
mov eax, dword [edi + 0x19c]
xor ebx, ebx
mov ecx, dword [eax]
xor esi, esi
mov eax, dword [ecx + 0x38]
or eax, dword [ecx + 0x3c]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x24], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0xc], ebx
mov byte [esp + 0x1b], bl
push ebx
lea ecx, [edi + 0x1b4]
je 0x405f68
call fcn.0042ee9c
test eax, eax
je 0x405f8c
mov ecx, dword [edi + 0x98]
sub ecx, dword [edi + 0x94]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0xc], eax
mov byte [esp + 0x1b], 1
jmp 0x405f8c
call fcn.0042ee9c
test eax, eax
je 0x405f8c
push dword [edi + 0x1a8]
lea ecx, [esp + 0x34]
call fcn.0040e1a0
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x24], esi
mov eax, dword [edi + 0x1ac]
sub eax, dword [edi + 0x1a8]
mov ecx, 1
sar eax, 2
mov dword [esp + 0x1c], ecx
cmp eax, ecx
jbe 0x40605a
lea esp, [esp]
push ecx
lea ecx, [edi + 0x1b4]
call fcn.0042ee9c
test eax, eax
je 0x406032
mov eax, dword [edi + 0x1a8]
mov ecx, dword [esp + 0x1c]
lea eax, [eax + ecx*4]
mov dword [esp + 0x20], eax
cmp eax, ebx
jae 0x406007
cmp esi, eax
ja 0x406007
sub eax, esi
sar eax, 2
mov dword [esp + 0x20], eax
cmp ebx, dword [esp + 0x38]
jne 0x405ffe
push ecx
lea ecx, [esp + 0x34]
call fcn.0040e940
mov ebx, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
test ebx, ebx
je 0x40602b
mov eax, dword [esi + eax*4]
jmp 0x406029
cmp ebx, dword [esp + 0x38]
jne 0x406023
push ecx
lea ecx, [esp + 0x34]
call fcn.0040e940
mov ebx, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
test ebx, ebx
je 0x40602b
mov eax, dword [eax]
mov dword [ebx], eax
add ebx, 4
mov dword [esp + 0x34], ebx
mov eax, dword [edi + 0x1ac]
sub eax, dword [edi + 0x1a8]
mov ecx, dword [esp + 0x1c]
inc ecx
sar eax, 2
mov dword [esp + 0x1c], ecx
cmp ecx, eax
jb 0x405fb0
mov dword [esp + 0x24], esi
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0xc]
sub ebx, esi
sar ebx, 2
add eax, ebx
movzx eax, ax
shl eax, 0x10
push eax
push 0
push 0x401
push dword [edi + 0x114]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0x16c]
lea esi, [edi + 0x16c]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x40609d
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x4060b3
call fcn.00425809
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x406a53
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov eax, dword [esi]
mov dword [esp + 0x20], edi
mov esi, dword [eax - 0xc]
mov dword [esp + 0x44], eax
lea edx, [esi + 7]
mov dword [esp + 0xc], esi
test edx, edx
js 0x406a5d
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, edx
or ecx, eax
jge 0x4060f6
push edx
lea ecx, [esp + 0x24]
call fcn.00416cf0
mov edi, dword [esp + 0x20]
add esi, esi
push esi
push dword [esp + 0x48]
push esi
push edi
call fcn.0043ddca
push 0xe
push 0x47ab28
lea eax, [esi + edi]
push 0xe
push eax
call fcn.0043ddca
mov eax, dword [esp + 0x2c]
add eax, 7
add esp, 0x20
cmp eax, dword [edi - 8]
jg 0x406a5d
xor ecx, ecx
mov dword [edi - 0xc], eax
push edi
mov word [edi + eax*2], cx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x40614d
mov edi, dword [esp + 0x14]
mov ecx, edi
call fcn.0040c370
jmp 0x4062b2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4062ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x47aa78
mov esi, eax
call fcn.0041efe0
mov ebx, dword [eax]
push 0
push 0
lea eax, [esp + 0x68]
push eax
push 0x400
push esi
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push dword [esp + 0x60]
lea ecx, [esp + 0x60]
call fcn.004169c0
push dword [esp + 0x60]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x47c134
mov ecx, 0x47ab38
call fcn.0041efe0
push eax
lea eax, [esp + 0x84]
push eax
call fcn.0040de20
mov esi, eax
add esp, 0xc
mov ecx, dword [esi]
mov ecx, dword [ecx - 0x10]
test ecx, ecx
je 0x4061db
mov edx, dword [ecx]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x4061f1
call fcn.00425809
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x406a67
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [esi]
add eax, 0x10
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x5c]
push dword [eax - 0xc]
push eax
push dword [ecx - 0xc]
lea eax, [esp + 0x60]
push ecx
push eax
call fcn.0040e7f0
mov esi, dword [esp + 0x68]
mov ecx, dword [esp + 0x28]
add esp, 0x14
push 0
push ebx
push esi
call fcn.0042a86d
add esi, 0xfffffff0
or ebx, 0xffffffff
lea ecx, [esi + 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x406245
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 0x7c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x406262
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 0x5c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40627f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esp + 0x24]
add edi, 0xfffffff0
lea eax, [edi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x40629a
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x4062a7
push esi
call fcn.004254d3
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0x16c]
mov ecx, 0x47ab50
mov eax, dword [eax - 0xc]
sub eax, 2
mov dword [edi + 0x188], eax
call fcn.0041efe0
mov esi, eax
lea eax, [esp + 0x84]
push eax
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov dword [esp + 0x44], 0
test ebx, ebx
je 0x40654d
mov edi, dword [esp + 0x24]
jmp 0x406300
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x23c], 1
je 0x40654b
mov eax, dword [esi]
mov edi, dword [edi]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x406325
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x406339
call fcn.00425809
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
test eax, eax
je 0x406a49
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov ecx, dword [esp + 0x1c]
lea esi, [eax + 0x10]
mov eax, dword [edi + 0x28]
mov ecx, dword [ecx]
mov dword [esp + 0x28], eax
mov eax, dword [eax - 0xc]
mov edi, dword [ecx - 0xc]
mov dword [esp + 0x64], esi
lea edx, [edi + eax]
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x10], edi
test edx, edx
js 0x406a5d
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or ecx, eax
jge 0x406390
push edx
lea ecx, [esp + 0x68]
call fcn.00416cf0
mov esi, dword [esp + 0x64]
add edi, edi
push edi
push dword [esp + 0x30]
push edi
push esi
call fcn.0043ddca
mov eax, dword [esp + 0x1c]
add eax, eax
push eax
push dword [esp + 0x3c]
push eax
lea eax, [edi + esi]
push eax
call fcn.0043ddca
mov eax, dword [esp + 0x30]
add eax, dword [esp + 0x2c]
add esp, 0x20
cmp eax, dword [esi - 8]
jg 0x406a5d
mov edi, dword [esp + 0x14]
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov ecx, dword [edi + 0x168]
lea eax, [edi + 0x168]
lea edx, [esi - 0x10]
sub ecx, 0x10
mov dword [esp + 0xc], edx
mov dword [esp + 0x28], ecx
cmp edx, ecx
je 0x406456
cmp dword [ecx + 0xc], 0
lea edi, [ecx + 0xc]
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
jl 0x406447
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x406441
push edx
call fcn.00416ec0
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14]
add esp, 4
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x406432
mov esi, dword [esp + 0x28]
push esi
mov ecx, dword [esi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x2c]
add eax, 0x10
mov dword [edi + 0x168], eax
jmp 0x406452
lea eax, [edi + 0x168]
push dword [esi - 0xc]
mov ecx, eax
push esi
call fcn.00416dd0
mov edx, dword [esp + 0xc]
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40646d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
mov ecx, edi
call fcn.0042c7c0
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x80]
mov esi, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov eax, dword [esi + 0x30]
cmp eax, 8
je 0x406510
cmp eax, 0x18
je 0x406510
mov ecx, esi
test al, 1
jne 0x4064a8
call fcn.00402190
jmp 0x4064ad
call fcn.00402220
test al, al
jne 0x406510
mov esi, dword [esp + 0x14]
add esi, 0x190
mov eax, dword [esi + 4]
cmp edi, eax
jae 0x4064f4
mov edx, dword [esi]
cmp edx, edi
ja 0x4064f4
mov ecx, edi
sub ecx, edx
sar ecx, 2
mov dword [esp + 0x10], ecx
cmp eax, dword [esi + 8]
jne 0x4064e4
push ecx
mov ecx, esi
call fcn.0040e940
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 4]
test edx, edx
je 0x40650c
mov eax, dword [esi]
mov eax, dword [eax + ecx*4]
mov dword [edx], eax
jmp 0x40650c
cmp eax, dword [esi + 8]
jne 0x406501
push ecx
mov ecx, esi
call fcn.0040e940
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x40650c
mov eax, dword [edi]
mov dword [ecx], eax
add dword [esi + 4], 4
mov eax, dword [esp + 0x14]
push 0
push 0
push 0x405
push dword [eax + 0x114]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x44]
mov esi, dword [esp + 0x1c]
inc ecx
add edi, 4
mov dword [esp + 0x44], ecx
mov dword [esp + 0x24], edi
cmp ecx, ebx
jne 0x406300
mov edi, dword [esp + 0x14]
jmp 0x40654d
mov edi, eax
cmp byte [esp + 0x1b], 0
je 0x4066fd
mov eax, dword [edi + 0x19c]
mov edi, dword [eax]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x406574
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x40658a
call fcn.00425809
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x406a71
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [esp + 0x1c]
lea esi, [eax + 0x10]
mov eax, dword [edi + 0x28]
mov ecx, dword [ecx]
mov dword [esp + 0x2c], eax
mov eax, dword [eax - 0xc]
mov edi, dword [ecx - 0xc]
mov dword [esp + 0x68], esi
lea ebx, [edi + eax]
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], ecx
test ebx, ebx
js 0x406a7b
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, ebx
or ecx, eax
jge 0x4065db
push ebx
lea ecx, [esp + 0x6c]
call fcn.00416cf0
mov esi, dword [esp + 0x68]
add edi, edi
push edi
push dword [esp + 0x14]
push edi
push esi
call fcn.0043ddca
mov eax, dword [esp + 0x38]
add eax, eax
push eax
push dword [esp + 0x40]
push eax
lea eax, [edi + esi]
push eax
call fcn.0043ddca
add esp, 0x20
cmp ebx, dword [esi - 8]
jg 0x406a5d
mov edi, dword [esp + 0x14]
xor eax, eax
mov dword [esi - 0xc], ebx
mov word [esi + ebx*2], ax
mov eax, dword [edi + 0x168]
sub eax, 0x10
lea ebx, [esi - 0x10]
mov dword [esp + 0x28], eax
cmp ebx, eax
je 0x4066d6
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
mov dword [esp + 0x10], ecx
jl 0x4066c7
mov ecx, dword [ebx]
cmp ecx, dword [eax]
jne 0x4066c7
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [ebx + 0xc], 0
lea edx, [ebx + 0xc]
mov ecx, eax
jl 0x40666b
cmp ecx, dword [ebx]
jne 0x40666b
mov esi, ebx
mov eax, 1
lock xadd dword [edx], eax
jmp 0x4066a0
mov eax, dword [ecx]
push 2
push dword [ebx + 4]
call dword [eax]
mov esi, eax
test esi, esi
je 0x406a85
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 4]
lea ecx, [eax*2 + 2]
push ecx
lea eax, [ebx + 0x10]
push eax
push ecx
lea eax, [esi + 0x10]
push eax
call fcn.0043ddca
add esp, 0x10
mov ecx, dword [esp + 0x10]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4066bc
mov edx, dword [esp + 0x28]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esi + 0x10]
mov dword [edi + 0x168], eax
jmp 0x4066d6
push dword [esi - 0xc]
lea ecx, [edi + 0x168]
push esi
call fcn.00416dd0
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4066ed
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
mov ecx, edi
call fcn.0042c7c0
mov ecx, edi
call fcn.0040d030
mov eax, dword [edi + 0x16c]
cmp dword [eax - 0xc], 0
jl 0x406a8a
movzx eax, word [eax]
push ecx
push eax
lea ecx, [esp + 0x60]
call fcn.00419f00
lea ecx, [esp + 0x58]
push 2
push 0x47aa5c
call fcn.004165a0
mov esi, dword [esp + 0x58]
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x80]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov eax, dword [esp + 0x74]
mul dword [esp + 0x70]
push 0
push dword [esp + 0x70]
push edx
push eax
call fcn.0044b3e0
mov ebx, eax
mov eax, edx
lea edx, [esi - 0x10]
mov dword [esp + 0x10], eax
lea ecx, [edx + 0xc]
or esi, 0xffffffff
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x40678b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x4c]
cmp eax, edx
ja 0x4067a8
jb 0x40679d
mov ecx, dword [esp + 0x48]
cmp ebx, ecx
ja 0x4067ac
xorps xmm0, xmm0
movlpd qword [esp + 0x48], xmm0
jmp 0x4067b8
mov ecx, dword [esp + 0x48]
sub ebx, ecx
sbb eax, edx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], eax
mov ecx, edi
call fcn.0040c370
mov ecx, 0x47ab60
mov dword [esp + 0x10], eax
call fcn.0041efe0
mov esi, dword [eax]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
call dword [edx + 0x10]
cmp dword [esi - 4], 0
lea edx, [esi - 4]
mov ecx, eax
jl 0x4067f5
cmp ecx, dword [esi - 0x10]
jne 0x4067f5
lea ebx, [esi - 0x10]
mov eax, 1
lock xadd dword [edx], eax
jmp 0x406827
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov ebx, eax
test ebx, ebx
je 0x406a94
mov eax, dword [esi - 0xc]
mov dword [ebx + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax*2 + 2]
push ecx
push esi
push ecx
lea eax, [ebx + 0x10]
push eax
call fcn.0043ddca
add esp, 0x10
lea eax, [ebx + 0x10]
lea edx, [esp + 0x48]
lea ecx, [esp + 0x78]
mov dword [esp + 0xc], eax
call fcn.00419150
push dword [eax]
push ecx
lea ecx, [esp + 0x14]
call fcn.0040db50
mov edx, dword [esp + 0x78]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x406865
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [edi + 0x194]
sub ecx, dword [edi + 0x190]
mov eax, dword [edi + 0x22c]
sub eax, dword [edi + 0x228]
sar ecx, 2
test eax, 0xfffffffc
je 0x406888
inc ecx
test ecx, ecx
jne 0x406893
cmp dword [esp + 0x10], 1
je 0x4068b3
mov ecx, 0x47ab7c
call fcn.0041efe0
mov eax, dword [eax]
lea ecx, [esp + 0xc]
push dword [eax - 0xc]
push eax
call fcn.004165a0
mov ecx, edi
call fcn.0040c370
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x3ec
mov ecx, edi
call fcn.0042e17c
mov ecx, eax
call fcn.0042e399
push 0
call fcn.0043e66e
mov esi, eax
add esp, 4
sub esi, dword [esp + 0x3c]
mov ebx, edx
sbb ebx, dword [esp + 0x40]
mov ecx, 0x47ab90
mov dword [esp + 0x3c], esi
call fcn.0041efe0
push 0
push 0x3c
push ebx
push esi
mov dword [esp + 0x50], eax
call fcn.0044b330
mov esi, eax
mov eax, dword [esp + 0x3c]
mov edx, esi
shl edx, 4
sub edx, esi
shl edx, 2
mov ecx, eax
sub ecx, edx
push ecx
push 0
push 0xe10
push ebx
push eax
add edi, 0x168
call fcn.0044b330
mov ecx, eax
shl ecx, 4
sub ecx, eax
mov eax, dword [esp + 0x44]
shl ecx, 2
sub esi, ecx
push esi
push dword [eax]
push edi
call fcn.00416560
mov ebx, dword [esp + 0x24]
add esp, 0x10
mov byte [ebx + 0x18c], 0
cmp dword [ebx + 0x23c], 0
mov esi, dword [esp + 0xc]
jne 0x406a20
sub esp, 8
mov eax, esp
lea edi, [esi - 0x10]
mov dword [eax], ebx
mov ecx, dword [edi]
mov dword [esp + 0x44], eax
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
mov ecx, eax
lea eax, [edi + 0xc]
jl 0x406996
cmp ecx, dword [edi]
jne 0x406996
mov ecx, 1
lock xadd dword [eax], ecx
jmp 0x4069d3
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov edx, eax
mov dword [esp + 0x48], edx
test edx, edx
je 0x406a99
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax*2 + 2]
push ecx
lea eax, [edi + 0x10]
push eax
push ecx
lea eax, [edx + 0x10]
push eax
call fcn.0043ddca
mov edi, dword [esp + 0x58]
add esp, 0x10
mov ecx, dword [esp + 0x44]
lea eax, [edi + 0x10]
mov dword [ecx + 4], eax
lea ecx, [esp + 0x90]
call fcn.0040fa50
mov edi, dword [esp + 0x8c]
test edi, edi
je 0x406a19
lea eax, [edi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x406a19
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lea eax, [edi + 8]
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x406a19
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov ecx, ebx
call fcn.00407600
add esi, 0xfffffff0
or ebx, 0xffffffff
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x406a3c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x20]
jmp 0x406283
push 0x80004005
call fcn.00416fc0
push 0x80004005
call fcn.00416fc0
push 0x80070057
call fcn.00416fc0
push 0x80004005
call fcn.00416fc0
push 0x80004005
call fcn.00416fc0
push 0x80070057
call fcn.00416fc0
call fcn.00416e90
push 0x80070057
call fcn.00416fc0
call fcn.00416e90
call fcn.00416e90
int3