Function at 0x406430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4652ae
mov eax, dword fs:[0]
push eax
sub esp, 0x88
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47a770]
xor eax, esp
push eax
lea eax, [esp + 0x9c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xa4], 0
mov eax, dword [esp + 0xac]
push esi
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x4c], esp
mov edi, esp
push eax
call fcn.00429de0
add eax, 0x10
mov dword [edi], eax
lea eax, [esp + 0x70]
add esp, 4
push eax
call fcn.00405850
add esp, 0xc
mov byte [esp + 0xa4], 1
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x24]
call fcn.0042a2b0
mov byte [esp + 0xa4], 3
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4064d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x20]
push 0x46eae8
push ecx
call fcn.0044d749
add esp, 8
test eax, eax
setne al
test al, al
je 0x406b47
call fcn.0042eec8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x406b38
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0xa4], 4
mov eax, dword [esp + 0xac]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
call fcn.00429de0
add eax, 0x10
add esp, 4
lea ebx, [esp + 0x30]
mov dword [edi], eax
call fcn.00405590
add esp, 4
mov dword [esp + 0x28], 0
mov edi, dword [esp + 0xac]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x18], esp
mov ebp, esp
call eax
cmp dword [edi + 0xc], 0
lea ecx, [edi + 0xc]
jl 0x40658e
cmp eax, dword [edi]
jne 0x40658e
mov ebx, edi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x4065c2
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
je 0x406b42
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 4]
inc eax
push eax
add edi, 0x10
push edi
push eax
lea ecx, [ebx + 0x10]
push ecx
call fcn.0044b46f
add esp, 0x10
lea edx, [esp + 0x58]
add ebx, 0x10
push edx
mov ecx, esi
mov dword [ebp], ebx
call fcn.00405610
add esp, 8
mov byte [esp + 0xa4], 5
mov ecx, dword [eax]
mov ebx, dword [esp + 0x1c]
lea eax, [ecx - 0x10]
lea edi, [ebx - 0x10]
cmp eax, edi
je 0x40663a
cmp dword [edi + 0xc], 0
lea ebx, [edi + 0xc]
jl 0x406628
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x406628
push eax
call fcn.00429de0
mov ebp, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x40661f
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
add ebp, 0x10
mov dword [esp + 0x1c], ebp
jmp 0x406636
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.00401fa0
mov ebx, dword [esp + 0x1c]
mov byte [esp + 0xa4], 4
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
or edi, 0xffffffff
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406664
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 2
push 0
lea ecx, [esp + 0x80]
push ecx
lea ecx, [esp + 0x2c]
call fcn.004286a0
mov eax, dword [eax]
test eax, eax
jne 0x406685
mov dword [esp + 0x24], edi
jmp 0x4066ab
cmp dword [ebx - 0xc], 0
jge 0x406691
mov dword [esp + 0x24], edi
jmp 0x4066ab
push eax
push ebx
call fcn.0044d4ee
add esp, 8
test eax, eax
jne 0x4066a5
mov dword [esp + 0x24], edi
jmp 0x4066ab
sub eax, ebx
mov dword [esp + 0x24], eax
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x78]
add eax, 0xfffffff0
mov dword [esp + 0x7c], edx
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4066d2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 2
push 2
lea ecx, [esp + 0x58]
push ecx
lea ecx, [esp + 0x2c]
call fcn.004286a0
mov eax, dword [eax]
test eax, eax
jne 0x4066f0
mov dword [esp + 0x14], edi
jmp 0x406716
cmp dword [ebx - 0xc], 0
jge 0x4066fc
mov dword [esp + 0x14], edi
jmp 0x406716
push eax
push ebx
call fcn.0044d4ee
add esp, 8
test eax, eax
jne 0x406710
mov dword [esp + 0x14], edi
jmp 0x406716
sub eax, ebx
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
mov dword [esp + 0x80], edx
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406740
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 2
push 4
lea ecx, [esp + 0x60]
push ecx
lea ecx, [esp + 0x2c]
call fcn.004286a0
mov eax, dword [eax]
test eax, eax
jne 0x40675c
mov ebp, edi
jmp 0x40677c
cmp dword [ebx - 0xc], 0
jge 0x406766
mov ebp, edi
jmp 0x40677c
push eax
push ebx
call fcn.0044d4ee
add esp, 8
test eax, eax
jne 0x406778
mov ebp, edi
jmp 0x40677c
sub eax, ebx
mov ebp, eax
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
mov dword [esp + 0x84], ebp
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4067a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 2
push 6
lea ecx, [esp + 0x70]
push ecx
lea ecx, [esp + 0x2c]
call fcn.004286a0
mov eax, dword [eax]
test eax, eax
je 0x4067d2
cmp dword [ebx - 0xc], 0
jl 0x4067d2
push eax
push ebx
call fcn.0044d4ee
add esp, 8
test eax, eax
je 0x4067d2
sub eax, ebx
mov edi, eax
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
mov dword [esp + 0x88], edi
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4067f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x24], 0
jl 0x4068d2
cmp dword [esp + 0x14], 0
jl 0x4068d2
test ebp, ebp
jl 0x4068d2
test edi, edi
jl 0x4068d2
push 0
call fcn.0044bf56
push eax
call fcn.0044bf22
add esp, 8
call fcn.0044bf34
cdq
mov ecx, 0xa
idiv ecx
mov edi, edx
call fcn.0044bf34
cdq
mov ecx, 0xa
idiv ecx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + eax*4 + 0x7c]
cmp eax, 6
ja case.0x406858.7
jmp dword [eax*4 + 0x406ca4]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
lea edx, [ecx + edx + 0x4d]
lea edi, [eax + edi + 0x2a]
jmp 0x40689b
mov eax, dword [esp + 0x2c]
lea edi, [eax + edi + 0x5c]
jmp 0x406893
mov eax, dword [esp + 0x2c]
lea edi, [eax + edi + 0x8e]
jmp 0x406893
mov eax, dword [esp + 0x2c]
lea edi, [eax + edi + 0xc0]
mov ecx, dword [esp + 0x30]
lea edx, [ecx + edx + 0x4f]
mov eax, dword [esp + 0xac]
push edx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov ebx, esp
push eax
call fcn.00429de0
add eax, 0x10
add esp, 4
mov ecx, edi
mov edx, esi
mov dword [ebx], eax
call fcn.004062f0
add esp, 8
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x28]
inc eax
cmp eax, 4
mov dword [esp + 0x28], eax
jl 0x406559
mov ebx, dword [esp + 0xac]
push 1
push 0x66
push ecx
mov ecx, dword [ebx - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add ebx, 0xfffffff0
mov dword [esp + 0x34], esp
mov ebp, esp
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x40691d
cmp eax, dword [ebx]
jne 0x40691d
mov edi, ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x406951
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x406b42
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 4]
inc eax
push eax
add ebx, 0x10
push ebx
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.0044b46f
add esp, 0x10
add edi, 0x10
mov dword [ebp], edi
mov edi, esi
call fcn.004034b0
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, dword [0x47bb18]
lea edx, [esp + 0x70]
push edx
push esi
call ebp
mov eax, dword [esp + 0x70]
push eax
push 0
push 0x1fffff
mov dword [esp + 0x40], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0x8c]
push ecx
push 4
lea edx, [esp + 0x3c]
push edx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edi, eax
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x60]
push eax
push esi
call ebp
mov ecx, dword [esp + 0x60]
push ecx
push 0
push 0x1fffff
mov dword [esp + 0x48], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x94]
push edx
mov edi, eax
push 4
lea eax, [esp + 0x44]
push eax
add ecx, 0x50
push ecx
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x74]
push edx
push esi
call ebp
mov eax, dword [esp + 0x74]
push eax
push 0
push 0x1fffff
mov dword [esp + 0x54], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0x90]
push ecx
push 4
mov edi, eax
mov eax, dword [esp + 0x44]
lea edx, [esp + 0x50]
push edx
push eax
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x6c]
push ecx
push esi
call ebp
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x40], 0
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [esp + 0x48]
mov edi, eax
lea eax, [esp + 0x98]
push eax
push 4
lea ecx, [esp + 0x48]
push ecx
add edx, 0x70
push edx
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x5c]
push eax
push esi
call ebp
mov ecx, dword [esp + 0x5c]
push ecx
push 0
push 0x1fffff
mov dword [esp + 0x44], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x4c]
push edx
mov edi, eax
push 4
lea eax, [esp + 0x40]
push eax
push ecx
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x44]
push edx
push esi
call ebp
mov eax, dword [esp + 0x44]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [esp + 0x38]
push 0
push 1
lea ecx, [esp + 0x23]
push ecx
add edx, 0x28
mov edi, eax
push edx
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x1b], 0
mov byte [esp + 0xa4], 3
mov eax, dword [esp + 0x1c]
setne bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406b2b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x4064fa
jmp 0x406c31
push 0x80004005
call fcn.004020f0
call fcn.00401ea0
mov ecx, dword [0x47bb18]
push ecx
mov ecx, esi
call fcn.0042bd60
add eax, 0x50
push eax
mov ecx, esi
call fcn.0042bd60
push eax
mov ecx, esi
call fcn.0042bd60
add eax, 0x70
push eax
mov ecx, esi
call fcn.0042bd60
push eax
mov ecx, esi
call fcn.0042bd60
add eax, 0x28
push eax
mov ecx, esi
call fcn.0042bdc0
test al, al
setne al
test al, al
jne 0x406c31
push 0
call fcn.0044bf56
push eax
call fcn.0044bf22
call fcn.0044bf34
cdq
mov ecx, 5
idiv ecx
mov edi, 2
sub edi, edx
call fcn.0044bf34
cdq
mov ecx, 5
idiv ecx
mov eax, dword [esp + 0xb4]
add esp, 4
add eax, 0xfffffff0
mov ebp, 2
mov dword [esp + 0x50], esp
mov ebx, esp
push eax
sub ebp, edx
call fcn.00429de0
add eax, 0x10
mov dword [ebx], eax
add esp, 4
lea ebx, [esp + 0x30]
call fcn.00405590
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
add esp, 4
lea eax, [edx + ebp + 0x4d]
push eax
mov eax, dword [esp + 0xb0]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x54], esp
mov ebx, esp
push eax
lea edi, [ecx + edi + 0x3f]
call fcn.00429de0
add eax, 0x10
add esp, 4
mov ecx, edi
mov edx, esi
mov dword [ebx], eax
call fcn.004062f0
add esp, 8
mov byte [esp + 0xa4], 0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406c59
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xa4], 0xffffffff
mov eax, dword [esp + 0xac]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406c87
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x9c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret