Function at 0x407730
Capabilities:
Create thread
Extract resource via kernel32 functions
Get common file path
Resume thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57d1c4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x258
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x4c], 0
push edi
mov dword [ebp - 0x20], ebx
call fcn.0042b438
test ebx, ebx
jne 0x40776a
xor eax, eax
jmp 0x40776d
mov eax, dword [ebx + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x5f2b30], eax
mov eax, dword [ebx + 0x1c8]
test eax, eax
je 0x4077a1
push eax
push 1
push 0x80
push dword [ebx + 0x20]
call esi
push dword [ebx + 0x1c8]
push 0
push 0x80
push dword [ebx + 0x20]
call esi
lea ecx, [ebp - 0x14]
call fcn.004104f0
push str.PATCH.bin
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
call fcn.0040b390
add esp, 0xc
mov byte [ebp - 4], 1
or ebx, 0xffffffff
mov ecx, dword [eax]
mov esi, dword [0x5f2c28]
add esi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x407824
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x407816
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x407816
push edx
call fcn.0040c4e0
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x40780c
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x18]
add eax, 0x10
mov dword [0x5f2c28], eax
jmp 0x407824
push dword [ecx - 0xc]
push ecx
mov ecx, 0x5f2c28
call fcn.0040c620
mov edx, dword [ebp - 0x54]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40783e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40785f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [0x5f2c28]
call fcn.0040fae0
cmp eax, 0xffffffff
je 0x408d6b
mov dword [ebp - 4], 3
call fcn.00437ca1
mov ecx, eax
mov byte [ebp - 4], 2
test ecx, ecx
je 0x408d72
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x54], esi
mov dword [ebp - 4], 4
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x105
or eax, ecx
jge 0x4078c3
push 0x105
lea ecx, [ebp - 0x54]
call fcn.0040c5b0
mov esi, dword [ebp - 0x54]
cmp dword [esi - 8], 0x105
jl 0x408d61
push 0x104
xor eax, eax
mov dword [esi - 0xc], 0x105
push esi
push eax
mov word [esi + 0x20a], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push dword [esi - 8]
push esi
call fcn.0055dbf8
add esp, 8
test eax, eax
js 0x408d61
cmp eax, dword [esi - 8]
jg 0x408d61
xor ecx, ecx
mov dword [esi - 0xc], eax
push ecx
push ecx
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov word [esi + eax*2], cx
mov edi, esp
lea eax, [esi - 0x10]
mov dword [ebp - 0x58], edi
push eax
mov dword [ebp - 0x34], eax
call fcn.0040c4e0
add esp, 4
add eax, 0x10
mov ecx, 0x5f2c58
mov dword [edi], eax
call fcn.00410e50
mov byte [ebp - 4], 6
call fcn.00437ca1
mov ecx, eax
mov byte [ebp - 4], 5
test ecx, ecx
je 0x408d7c
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x50], esi
mov byte [ebp - 4], 7
lea edi, [esi - 0x10]
mov eax, dword [0x5f2c78]
mov ecx, dword [eax + 0x84]
lea edx, [ecx - 0x10]
cmp edx, edi
je 0x4079c0
cmp dword [edi + 0xc], 0
lea esi, [edi + 0xc]
jl 0x4079b1
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x4079b1
push edx
call fcn.0040c4e0
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, ebx
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x4079a9
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x18]
lea esi, [eax + 0x10]
mov dword [ebp - 0x50], esi
jmp 0x4079c0
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x50]
call fcn.0040c620
mov esi, dword [ebp - 0x50]
cmp dword [esi - 0xc], 0
jl 0x407a9c
push 0x5c1e10
push esi
call fcn.0055a0f0
add esp, 8
test eax, eax
je 0x407a9c
sub eax, esi
sar eax, 1
js 0x407a9c
cmp dword [esi - 0xc], 0
jge 0x4079f5
or eax, 0xffffffff
jmp 0x407a10
push 0x5c1e10
push esi
call fcn.0055a0f0
add esp, 8
test eax, eax
jne 0x407a0c
or eax, 0xffffffff
jmp 0x407a10
sub eax, esi
sar eax, 1
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x50]
call fcn.0040b7e0
mov byte [ebp - 4], 8
mov ecx, dword [eax]
mov edi, dword [0x5f2c30]
add edi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, edi
je 0x407a7c
cmp dword [edi + 0xc], 0
jl 0x407a6e
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x407a6e
push edx
call fcn.0040c4e0
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, ebx
lea edx, [edi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407a64
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x18]
add eax, 0x10
mov dword [0x5f2c30], eax
jmp 0x407a7c
push dword [ecx - 0xc]
push ecx
mov ecx, 0x5f2c30
call fcn.0040c620
mov byte [ebp - 4], 7
mov eax, ebx
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407af5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x407af5
mov edi, dword [0x5f2c30]
lea ecx, [esi - 0x10]
add edi, 0xfffffff0
cmp ecx, edi
je 0x407af5
cmp dword [edi + 0xc], 0
jl 0x407ae7
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x407ae7
push ecx
call fcn.0040c4e0
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, ebx
lea edx, [edi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407add
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x18]
add eax, 0x10
mov dword [0x5f2c30], eax
jmp 0x407af5
push dword [esi - 0xc]
mov ecx, 0x5f2c30
push esi
call fcn.0040c620
mov eax, dword [0x5f2c78]
push 1
push dword [eax + 8]
call fcn.00562e6c
add esp, 8
mov edi, eax
mov ecx, 0x5f2c58
mov dword [ebp - 0x10], edi
push edi
push 0
push 0
call fcn.004114e0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [0x5f2b38], eax
mov dword [0x5f2b3c], ecx
mov byte [ebp - 4], 0xb
call fcn.00437ca1
mov ecx, eax
mov byte [ebp - 4], 0xa
test ecx, ecx
je 0x408d86
mov eax, dword [ecx]
call dword [eax + 0xc]
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
lea edi, [eax + 0x10]
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x38], edi
call fcn.0057cbc0
movsd xmm1, qword [0x5cbc00]
movsd xmm2, qword [0x5cbc30]
mulsd xmm0, xmm1
comisd xmm0, xmm2
jb 0x407bb6
mulsd xmm0, xmm1
comisd xmm0, xmm2
jb 0x407ba7
mulsd xmm0, xmm1
comisd xmm0, xmm2
jae 0x407bd2
sub esp, 8
movsd qword [esp], xmm0
push str._.2f_GB
jmp 0x407bc3
sub esp, 8
movsd qword [esp], xmm0
push str._.2f_MB
jmp 0x407bc3
sub esp, 8
movsd qword [esp], xmm0
push str._.2f_KB
lea eax, [ebp - 0x38]
push eax
call fcn.0040c990
mov edi, dword [ebp - 0x38]
add esp, 0x10
mov ecx, dword [0x5f2c34]
lea edx, [edi - 0x10]
add ecx, 0xfffffff0
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
je 0x407c3d
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x18], eax
jl 0x407c2c
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x407c2c
push edx
call fcn.0040c4e0
mov edx, dword [ebp - 0x18]
add esp, 4
mov dword [ebp - 0x4c], eax
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407c22
mov edi, dword [ebp - 0x1c]
push edi
mov ecx, dword [edi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x4c]
add eax, 0x10
mov dword [0x5f2c34], eax
jmp 0x407c3a
push dword [edi - 0xc]
mov ecx, 0x5f2c34
push edi
call fcn.0040c620
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x4c], 0
mov eax, ebx
mov byte [ebp - 4], 7
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407c5c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x10]
lea edx, [edi + 0x10]
test edx, edx
jne 0x407c6a
xor ecx, ecx
jmp 0x407c82
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407c72
sub ecx, dword [ebp - 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, 0x5f2c3c
call fcn.0040c620
mov eax, dword [0x5f2c3c]
mov eax, dword [eax - 0xc]
lea eax, [eax*2 + 0x12]
lea edx, [eax + edi]
mov dword [ebp - 0x1c], eax
test edx, edx
jne 0x407cab
xor ecx, ecx
jmp 0x407cc3
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407cb3
sub ecx, dword [ebp - 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, 0x5f2c2c
call fcn.0040c620
mov eax, dword [0x5f2c2c]
mov ecx, dword [ebp - 0x1c]
add ecx, 2
mov eax, dword [eax - 0xc]
lea eax, [ecx + eax*2]
lea edx, [eax + edi]
mov dword [ebp - 0x1c], eax
test edx, edx
jne 0x407cee
xor ecx, ecx
jmp 0x407d06
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407cf6
sub ecx, dword [ebp - 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, 0x5f2c44
call fcn.0040c620
mov eax, dword [0x5f2c44]
mov ecx, dword [ebp - 0x1c]
add ecx, 2
mov edx, dword [eax - 0xc]
lea edx, [ecx + edx*2]
add edx, edi
jne 0x407d2b
xor ecx, ecx
jmp 0x407d43
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407d33
sub ecx, dword [ebp - 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, 0x5f2cc8
call fcn.0040c620
push edi
call fcn.0055d993
add esp, 4
mov eax, dword [0x5f2c44]
mov edx, 0x5c3514
mov ecx, eax
mov di, word [ecx]
cmp di, word [edx]
jne 0x407d8a
test di, di
je 0x407d86
mov di, word [ecx + 2]
cmp di, word [edx + 2]
jne 0x407d8a
add ecx, 4
add edx, 4
test di, di
jne 0x407d64
xor ecx, ecx
jmp 0x407d8f
sbb ecx, ecx
or ecx, 1
mov byte [ebp - 4], 7
test ecx, ecx
jne 0x407df5
mov ecx, dword [0x5f2c30]
lea edi, [eax - 0x10]
lea edx, [ecx - 0x10]
cmp edx, edi
je 0x407df5
cmp dword [edi + 0xc], 0
jl 0x407de2
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x407de2
push edx
call fcn.0040c4e0
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, ebx
lea edx, [edi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407dd8
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [0x5f2c44], eax
jmp 0x407df5
push dword [ecx - 0xc]
push ecx
mov ecx, 0x5f2c44
call fcn.0040c620
mov eax, dword [0x5f2c44]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x14], ecx
test ecx, ecx
js 0x408d61
mov edx, dword [eax - 8]
mov edi, 1
sub edi, dword [eax - 4]
sub edx, ecx
or edx, edi
jge 0x407e27
push ecx
mov ecx, 0x5f2c44
call fcn.0040c5b0
mov eax, dword [0x5f2c44]
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push eax
call fcn.00562a38
mov eax, dword [0x5f2c44]
add esp, 8
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [eax - 8]
jg 0x408d61
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [0x5f2c44]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x1c]
call fcn.004104f0
mov byte [ebp - 4], 0xd
mov ecx, dword [eax]
mov edi, dword [0x5f2c38]
add edi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, edi
je 0x407eb8
cmp dword [edi + 0xc], 0
jl 0x407eaa
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x407eaa
push edx
call fcn.0040c4e0
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, ebx
lea edx, [edi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407ea0
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [0x5f2c38], eax
jmp 0x407eb8
push dword [ecx - 0xc]
push ecx
mov ecx, 0x5f2c38
call fcn.0040c620
mov byte [ebp - 4], 7
mov eax, ebx
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407ed6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x5f2c38]
mov ecx, 0x5f2c38
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040b7e0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1c]
mov edx, dword [eax]
call fcn.00410cb0
mov byte [ebp - 4], 0xf
mov ecx, dword [eax]
mov edi, dword [0x5f2c38]
add edi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, edi
je 0x407f5b
cmp dword [edi + 0xc], 0
jl 0x407f4d
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x407f4d
push edx
call fcn.0040c4e0
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, ebx
lea edx, [edi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407f43
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [0x5f2c38], eax
jmp 0x407f5b
push dword [ecx - 0xc]
push ecx
mov ecx, 0x5f2c38
call fcn.0040c620
mov edx, dword [ebp - 0x1c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407f75
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov eax, ebx
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407f93
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 5
push str.Crack
mov ecx, 0x5f2c38
call fcn.0040c740
mov ecx, dword [0x5f2c38]
call fcn.0040fae0
cmp eax, 0xffffffff
jne 0x407fbe
mov ecx, 0x5f2c38
call fcn.0040c000
push 0x5f2c44
lea eax, [ebp - 0x14]
push 0x5c3658
push eax
call fcn.0040b200
push 0x5c3654
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 0x10
push eax
call fcn.0040b390
push 0x5f2cc8
push eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0x11
push eax
call fcn.0040b520
add esp, 0x24
mov byte [ebp - 4], 0x12
mov ecx, dword [eax]
mov edi, dword [0x5f2cc0]
add edi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, edi
je 0x408059
cmp dword [edi + 0xc], 0
jl 0x40804b
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x40804b
push edx
call fcn.0040c4e0
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, ebx
lea edx, [edi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408041
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [0x5f2cc0], eax
jmp 0x408059
push dword [ecx - 0xc]
push ecx
mov ecx, 0x5f2cc0
call fcn.0040c620
mov edx, dword [ebp - 0x1c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408073
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40808d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov eax, ebx
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4080ab
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x5f2cc0]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x14], ecx
test ecx, ecx
js 0x408d61
mov edx, dword [eax - 8]
mov edi, 1
sub edi, dword [eax - 4]
sub edx, ecx
or edx, edi
jge 0x4080e2
push ecx
mov ecx, 0x5f2cc0
call fcn.0040c5b0
mov eax, dword [0x5f2cc0]
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push eax
call fcn.00562a38
mov eax, dword [0x5f2cc0]
add esp, 8
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [eax - 8]
jg 0x408d61
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [0x5f2cc0]
mov word [eax + ecx*2], dx
call fcn.0041c393
test eax, eax
je 0x40811e
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x408120
xor eax, eax
push dword [0x5f2cc0]
mov ecx, eax
call fcn.0043637e
lea eax, [ebp - 0x264]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x264]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408150
sub ecx, edx
lea eax, [ebp - 0x264]
sar ecx, 1
push ecx
push eax
mov ecx, 0x5f2cc4
call fcn.0040c620
push 0xa
push str.tenoke.mid
mov ecx, 0x5f2cc4
call fcn.0040c740
mov ecx, dword [0x5f2cc4]
call fcn.0040fae0
cmp eax, 0xffffffff
jne 0x40821a
mov eax, dword [0x5f2cc4]
push 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x5c3684
mov edi, eax
push 0x89
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40821a
push eax
push edi
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 2
push 2
push 0
push 7
push 0x40000000
push dword [ebp - 0x1c]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or ebx, 0xffffffff
push 0x5f2cc4
lea eax, [ebp - 0x10]
push str.Open
push eax
call fcn.0040b200
push 0x5c3e98
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x13
push eax
call fcn.0040b390
mov byte [ebp - 4], 7
add esp, 0x18
mov edx, dword [ebp - 0x10]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408261
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [sym.imp.WINMM.dll_mciSendStringW]
push 0
push 0
push 0
push dword [ebp - 0x14]
call edi
push 0
push 0
push 0
push str.play_Music1_repeat
call edi
mov edx, dword [ebp - 0x14]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408299
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
sub eax, 0x320
cdq
sub eax, edx
mov ebx, eax
push 1
sar ebx, 1
call edi
sub eax, 0x1c2
push 1
cdq
push 0x1c2
sub eax, edx
push 0x320
sar eax, 1
push eax
push ebx
mov ebx, dword [ebp - 0x20]
mov ecx, ebx
call fcn.004361ce
push 0
push 0
push 0x31
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
call fcn.004370aa
mov dword [ebp - 0x58], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x48]
push eax
push dword [ebx + 0x20]
movups xmmword [ebp - 0x48], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0xd0]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
push 0x44c
push dword [ebp - 0x20]
lea edi, [edx + 0xc8]
mov dword [ebp - 0x2c], edx
mov ebx, dword [eax + 0x164]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], edi
lea ecx, [eax + 0x320]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x14]
push eax
push 0x50000000
push 0x5c1e14
call ebx
test eax, eax
je 0x408be1
call fcn.00439dd8
push 0x5c3684
push 0x86
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x4084e7
call fcn.00439dd8
push edi
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4084e7
call fcn.00439dd8
push edi
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov dword [ebp - 0x18], ebx
test ebx, ebx
je 0x4084e7
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
test ecx, ecx
je 0x4084e0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4084e0
push edi
push ecx
push eax
call fcn.0055a7b0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push ebx
mov ebx, dword [ebp - 0x14]
mov ecx, ebx
call fcn.0040cdf0
push dword [ebp - 0x18]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test edi, edi
je 0x4084e7
cmp dword [ebx + 0xb8], 0
je 0x4084e7
cmp dword [ebx + 0xac], 0
je 0x408477
mov ecx, dword [ebx + 0xf0]
mov eax, 0x92492493
sub ecx, dword [ebx + 0xec]
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jbe 0x408477
lea eax, [ebp - 0x5c]
push eax
push 4
push ebx
push 0x40d9a0
push 0
push 0
call fcn.00562dd3
add esp, 0x18
mov dword [ebx + 0xd4], eax
test eax, eax
je 0x4084e7
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x4084e7
mov ecx, dword [ebx + 0xdc]
test ecx, ecx
je 0x4084e7
mov eax, dword [ecx]
lea edx, [ebp - 0x1c]
push edx
push ecx
call dword [eax + 0x18]
mov ecx, dword [ebx + 0xdc]
lea edx, [ebp - 0x10]
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov edi, dword [ebx + 0xdc]
mov ecx, dword [ebp - 0x10]
push 0
mov eax, dword [edi]
mov edx, dword [eax + 0x20]
mov eax, ecx
neg eax
push eax
push dword [ebp - 0x1c]
push ecx
push 0
push dword [ebx + 0x94]
push dword [ebx + 0x90]
push 0
push 0
push dword [ebx + 0xbc]
push edi
call edx
test eax, eax
jne 0x4084e7
push eax
push eax
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4084e7
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x44]
push 0x44d
mov eax, dword [eax + 0x1d0]
lea ecx, [edx + 0x186]
add edx, 0xdc
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], edx
mov ebx, dword [eax + 0x164]
mov eax, dword [ebp - 0x48]
lea edi, [eax + 0xc8]
add eax, 0xa
mov dword [ebp - 0x28], edi
mov edi, dword [ebp - 0x20]
push edi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 0x50000007
push str.OPTIONS
lea ecx, [edi + 0x1d0]
call ebx
test eax, eax
je 0x408be1
mov eax, dword [edi + 0x450]
mov ecx, dword [ebp - 0x44]
push 0x44e
mov ebx, dword [eax + 0x164]
mov eax, dword [ebp - 0x48]
lea edi, [ecx + 0x112]
mov dword [ebp - 0x24], edi
add ecx, 0xfa
mov edi, dword [ebp - 0x20]
push edi
lea edx, [eax + 0x36]
mov dword [ebp - 0x2c], ecx
add eax, 0x1e
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x30], eax
lea ecx, [edi + 0x450]
lea eax, [ebp - 0x30]
push eax
push 0x50000000
push str.music
call ebx
test eax, eax
je 0x408be1
sub esp, 0x18
lea ecx, [edi + 0x450]
call fcn.0040ee00
mov eax, dword [edi + 0x3d0]
mov edx, dword [ebp - 0x44]
push 0x452
mov ebx, dword [eax + 0x164]
mov eax, dword [ebp - 0x48]
lea ecx, [edx + 0x120]
add edx, 0x100
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], edx
lea edi, [eax + 0xa0]
add eax, 0x3c
mov dword [ebp - 0x28], edi
mov edi, dword [ebp - 0x20]
push edi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 0x50000000
push str.MUSIC
lea ecx, [edi + 0x3d0]
call ebx
test eax, eax
je 0x408be1
mov eax, dword [edi + 0x548]
mov ecx, dword [ebp - 0x44]
push 0x453
mov ebx, dword [eax + 0x164]
mov eax, dword [ebp - 0x48]
lea edi, [ecx + 0x13b]
mov dword [ebp - 0x24], edi
add ecx, 0x11d
mov edi, dword [ebp - 0x20]
push edi
lea edx, [eax + 0xbf]
mov dword [ebp - 0x2c], ecx
add eax, 0x1f
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x30], eax
lea ecx, [edi + 0x548]
lea eax, [ebp - 0x30]
push eax
push 0x50000003
push str.COPY_CRACK
call ebx
test eax, eax
je 0x408be1
push 0
push dword [0x5e8b00]
push 0xf1
push dword [edi + 0x568]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x5f2c38]
cmp dword [eax - 0xc], 0
jne 0x40868e
push 0
lea ecx, [edi + 0x548]
call fcn.00435ef2
mov eax, dword [0x5f2c3c]
mov ecx, 0x5c3514
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4086be
test dx, dx
je 0x4086ba
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4086be
add eax, 4
add ecx, 4
test dx, dx
jne 0x408698
xor eax, eax
jmp 0x4086c3
sbb eax, eax
or eax, 1
mov byte [ebp - 4], 7
test eax, eax
jne 0x4086d7
lea ecx, [edi + 0x5c8]
push eax
call fcn.00435ef2
mov eax, dword [edi + 0x250]
mov edx, dword [ebp - 0x44]
push 0x45b
mov ebx, dword [eax + 0x164]
mov eax, dword [ebp - 0x48]
lea ecx, [edx + 0x186]
add edx, 0xdc
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], edx
lea edi, [eax + 0x30c]
add eax, 0xd2
mov dword [ebp - 0x28], edi
mov edi, dword [ebp - 0x20]
push edi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 0x50000007
push str.INSTALL_DIRECTORY
lea ecx, [edi + 0x250]
call ebx
test eax, eax
je 0x408be1
mov eax, dword [ebp - 0x48]
lea ebx, [edi + 0x6c8]
mov edx, dword [ebp - 0x44]
push 0x456
lea edi, [eax + 0x29e]
add eax, 0xf0
mov dword [ebp - 0x28], edi
lea ecx, [edx + 0x10e]
mov edi, dword [ebp - 0x20]
add edx, 0xfb
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push edi
push eax
mov dword [ebp - 0x24], ecx
mov ecx, ebx
push 0x50800080
mov dword [ebp - 0x2c], edx
call fcn.0043891b
test eax, eax
je 0x408be1
mov eax, dword [edi + 0x748]
mov edx, dword [ebp - 0x44]
push 0x451
mov ebx, dword [eax + 0x164]
mov eax, dword [ebp - 0x48]
lea ecx, [edx + 0x110]
add edx, 0xf8
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], edx
lea edi, [eax + 0x2fd]
add eax, 0x2ad
mov dword [ebp - 0x28], edi
mov edi, dword [ebp - 0x20]
push edi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 0x50000000
push str.BROWSER...
lea ecx, [edi + 0x748]
call ebx
test eax, eax
je 0x408be1
mov eax, dword [edi + 0x7c8]
mov ecx, dword [ebp - 0x44]
push 0xc
mov eax, dword [eax + 0x164]
mov dword [ebp - 0x1c], eax
lea edi, [ecx + 0x135]
mov eax, dword [ebp - 0x48]
add ecx, 0x11d
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], edi
lea edx, [eax + 0x302]
add eax, 0xf0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], edx
call fcn.0042a957
mov ebx, eax
mov dword [ebp - 0x14], eax
add esp, 4
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 0x15
test ebx, ebx
je 0x40884d
push str._FREE_DISKSPACE
mov dword [ebx + 4], 0
mov dword [ebx + 8], 1
call fcn.00559730
mov dword [ebx], eax
jmp 0x408852
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 7
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x408d90
push 0x5f2c34
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0x16
push str.REQUIRED
push eax
call fcn.0040b200
mov ebx, dword [eax]
push 0xc
mov byte [ebp - 4], 0x18
call fcn.0042a957
mov edi, eax
add esp, 0x10
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 0x19
test edi, edi
je 0x4088ba
push ebx
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x4088bc
test ebx, ebx
jne 0x408d9a
jmp 0x4088bc
xor edi, edi
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x18], edi
test edi, edi
je 0x408d90
push 0xc
mov dword [ebp - 0x4c], 2
call fcn.0042a957
add esp, 4
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 0x1a
test eax, eax
je 0x4088fd
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x18]
push ecx
mov ecx, eax
call fcn.00403300
mov ecx, eax
mov dword [ebp - 0x38], eax
jmp 0x408902
xor ecx, ecx
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], 0x18
test ecx, ecx
je 0x408d90
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edi + 8], eax
dec eax
jne 0x408953
mov eax, dword [edi]
test eax, eax
je 0x40892e
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x408945
push eax
call fcn.0042ea70
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.00558658
mov ecx, dword [ebp - 0x38]
add esp, 8
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x30]
push 0x457
push edi
push eax
push 0x50000000
push dword [ecx]
mov dword [ebp - 0x18], ecx
lea ecx, [edi + 0x7c8]
call dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, ebx
mov eax, dword [ebp - 0x38]
lock xadd dword [eax + 8], ecx
dec ecx
jne 0x4089be
mov ecx, dword [eax]
test ecx, ecx
je 0x408999
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x38]
mov dword [eax], 0
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x4089b3
push ecx
call fcn.0042ea70
mov eax, dword [ebp - 0x38]
add esp, 4
mov dword [eax + 4], 0
push 0xc
push eax
call fcn.00558658
add esp, 8
mov edx, dword [ebp - 0x5c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4089d8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov eax, ebx
mov ecx, dword [ebp - 0x14]
lock xadd dword [ecx + 8], eax
dec eax
jne 0x408a24
mov eax, dword [ecx]
test eax, eax
je 0x4089ff
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 0x14]
mov dword [ecx], 0
mov eax, dword [ecx + 4]
test eax, eax
je 0x408a19
push eax
call fcn.0042ea70
mov ecx, dword [ebp - 0x14]
add esp, 4
mov dword [ecx + 4], 0
push 0xc
push ecx
call fcn.00558658
add esp, 8
cmp dword [ebp - 0x10], 0
jne 0x408a51
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x408a41
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x34]
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jmp 0x408c06
mov eax, dword [edi + 0x948]
lea ecx, [edi + 0x948]
mov edi, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
push 0x45a
mov ebx, dword [eax + 0x164]
lea eax, [edi + 0xf0]
mov dword [ebp - 0x30], eax
lea eax, [edx + 0x136]
mov dword [ebp - 0x2c], eax
lea eax, [edi + 0x29e]
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
lea eax, [edx + 0x14e]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push edi
push eax
push 0x50000000
call ebx
test eax, eax
je 0x408be1
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0x3e80000
push 0
push 0x401
push dword [edi + 0x968]
call ebx
push 0
push 0
push 0x402
push dword [edi + 0x968]
call ebx
mov eax, dword [edi + 0x8c8]
lea ebx, [edi + 0x8c8]
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
push 0x459
mov edi, dword [eax + 0x164]
push dword [ebp - 0x20]
lea eax, [ecx + 0x2c1]
mov dword [ebp - 0x30], eax
lea eax, [edx + 0x13b]
mov dword [ebp - 0x2c], eax
lea eax, [ecx + 0x2fd]
mov dword [ebp - 0x28], eax
mov ecx, ebx
lea eax, [edx + 0x14f]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
push 0x50000000
push 0x5c3654
call edi
test eax, eax
je 0x408be1
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
push 0x44f
mov eax, dword [ebx + 0x2d0]
push ebx
mov edi, dword [eax + 0x164]
lea eax, [ecx + 0x12c]
mov dword [ebp - 0x30], eax
lea eax, [edx + 0x159]
mov dword [ebp - 0x2c], eax
lea eax, [ecx + 0x190]
mov dword [ebp - 0x28], eax
lea ecx, [ebx + 0x2d0]
lea eax, [edx + 0x177]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
push 0x50000001
push str.PATCH
call edi
test eax, eax
je 0x408be1
mov eax, dword [ebx + 0x350]
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
push 0x450
mov edi, dword [eax + 0x164]
lea eax, [ecx + 0x1f4]
mov dword [ebp - 0x30], eax
lea eax, [edx + 0x159]
mov dword [ebp - 0x2c], eax
lea eax, [ecx + 0x258]
mov dword [ebp - 0x28], eax
lea ecx, [ebx + 0x350]
lea eax, [edx + 0x177]
push ebx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
push 0x50000000
push str.EXIT
call edi
test eax, eax
jne 0x408c23
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408bfb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x34]
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x408c10
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x58]
test edi, edi
je 0x408d12
push 1
push dword [edi + 4]
push 0x30
push dword [ebx + 0x1f0]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [ebx + 0x270]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [ebx + 0x568]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [ebx + 0x5e8]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [ebx + 0x668]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [ebx + 0x3f0]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [ebx + 0x7e8]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [ebx + 0x6e8]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [ebx + 0x8e8]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [ebx + 0x768]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [ebx + 0x2f0]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [ebx + 0x370]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.00406b80
call fcn.00406db0
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408d36
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x34]
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x408d4b
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0xc]
mov eax, 1
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.004027e0
push 0
call fcn.0055e117
push 0x80004005
call fcn.004027e0
push 0x80004005
call fcn.004027e0
push 0x80004005
call fcn.004027e0
push 0x8007000e
call fcn.00559710
push 0x8007000e
call fcn.00559710
int3