Function at 0x44d7e0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4beedf
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
push ebx
push esi
push edi
mov eax, dword [0x4e9688]
xor eax, esp
push eax
lea eax, [esp + 0xd0]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
xor esi, esi
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 4
call fcn.00462da0
push eax
call fcn.00462f40
test eax, eax
jne 0x44d856
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [edi + 0x4f8]
push eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xcc], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov dword [esp + 0xdc], esi
call fcn.0044c940
mov ebx, 1
cmp dword [0x4f1648], esi
jne 0x44dc61
mov edx, dword [0x4f1670]
mov byte [esp + 0x13], 0
test edx, edx
jne 0x44d8c7
mov eax, dword [0x4f166c]
test eax, eax
jne 0x44d8c7
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x44d8c7
mov eax, dword [esp + 0x18]
mov dword [0x4f166c], eax
mov dword [edi + 0x4f4], ebx
mov dword [esp + 0x14], 0
call fcn.00401020
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test al, al
jne 0x44d939
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x3c]
push eax
push str.i18n
push str.SYSTEMCurrentControlSet_services360SelfProtection
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x44d911
push 4
lea ecx, [esp + 0x18]
push ecx
jmp 0x44d91e
cmp dword [esp + 0x14], ebx
je 0x44d939
push 4
lea edx, [esp + 0x18]
push edx
push 4
push str.i18n
push str.SYSTEMCurrentControlSet_services360SelfProtection
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call fcn.0040fb60
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x3c]
push edx
push str.AppMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], ebx
call esi
test eax, eax
je 0x44d977
push ebx
push edi
mov dword [esp + 0x1c], ebx
call fcn.0044f950
mov byte [esp + 0x13], bl
jmp 0x44d992
cmp dword [esp + 0x14], ebx
jne 0x44d98a
push ebx
push edi
call fcn.0044f950
mov byte [esp + 0x13], bl
jmp 0x44d992
push 0
push edi
call fcn.0044f950
xor eax, eax
mov ecx, 8
mov dword [esp + 0xb8], eax
mov dword [esp + 0xc0], ecx
mov dword [esp + 0xb8], ecx
lea ecx, [esp + 0xb4]
push ecx
push 0
mov dword [esp + 0xc4], eax
lea eax, [esp + 0xc8]
push 0x4a
push ecx
mov dword [esp + 0xd4], 0xff
mov dword [esp + 0xc4], 0x41505343
mov dword [esp + 0xcc], eax
call fcn.004349a0
add esp, 4
push eax
xor edx, edx
mov ecx, str.Q360SafeMonClass
call fcn.004370f0
cmp dword [esp + 0x14], ebx
je 0x44da07
mov dword [0x4f11d0], ebx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
push ecx
push str.DrvFWAccess2
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x44da3c
push ebx
push edi
mov dword [esp + 0x1c], ebx
call fcn.0044f630
mov byte [esp + 0x13], bl
jmp 0x44da57
cmp dword [esp + 0x14], ebx
jne 0x44da4f
push ebx
push edi
call fcn.0044f630
mov byte [esp + 0x13], bl
jmp 0x44da57
push 0
push edi
call fcn.0044f630
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
push ecx
push str.NetMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x44daba
lea edx, [esp + 0xa8]
push edx
push str.mode
mov ecx, str.SOFTWARE360TotalSecurityActiveProtection
mov dword [esp + 0xb0], 2
call fcn.004019c0
add esp, 8
test al, al
jne 0x44daaa
mov dword [esp + 0x14], ebx
jmp 0x44dac0
xor eax, eax
cmp dword [esp + 0xa8], ebx
setne al
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
jne 0x44dad8
mov ecx, edi
call fcn.00452870
test al, al
jne 0x44dad8
push ebx
push edi
call fcn.00450860
mov byte [esp + 0x13], bl
jmp 0x44dae0
push 0
push edi
call fcn.00450860
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x3c]
push eax
push str.FileMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x44db15
push ebx
push edi
mov dword [esp + 0x1c], ebx
call fcn.00450cb0
mov byte [esp + 0x13], bl
jmp 0x44db30
cmp dword [esp + 0x14], ebx
jne 0x44db28
push ebx
push edi
call fcn.00450cb0
mov byte [esp + 0x13], bl
jmp 0x44db30
push 0
push edi
call fcn.00450cb0
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x3c]
push eax
push str.MonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x44db65
push ebx
push edi
mov dword [esp + 0x1c], ebx
call fcn.004511c0
mov byte [esp + 0x13], bl
jmp 0x44db80
cmp dword [esp + 0x14], ebx
jne 0x44db78
push ebx
push edi
call fcn.004511c0
mov byte [esp + 0x13], bl
jmp 0x44db80
push 0
push edi
call fcn.004511c0
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x3c]
push eax
push str.AVEnable
push str.SOFTWARE360Safe_filemon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x44dbaa
mov dword [esp + 0x14], ebx
jmp 0x44dbb0
cmp dword [esp + 0x14], ebx
jne 0x44dbb5
call fcn.00432780
lea ecx, [esp + 0xa4]
push ecx
xor eax, eax
push str.AVWriteProtectEnable
mov ecx, str.SOFTWARE360Safe_filemon
mov dword [esp + 0xac], eax
mov dword [esp + 0xa8], eax
call fcn.004019c0
lea edx, [esp + 0xa8]
push edx
push str.AVReadProtectEnable
mov ecx, str.SOFTWARE360Safe_filemon
call fcn.004019c0
add esp, 0x10
cmp dword [esp + 0xa0], 0
jne 0x44dc0a
cmp dword [esp + 0xa4], 0
je 0x44dc0e
mov byte [esp + 0x13], bl
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x3c]
push edx
push str.upref
push str.SOFTWARE360Safe_safemon_safecamera
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x44dc38
mov dword [esp + 0x14], ebx
jmp 0x44dc3e
cmp dword [esp + 0x14], ebx
jne 0x44dc45
push ebx
push edi
call fcn.004516d0
movzx ecx, byte [esp + 0x13]
cmp byte [0x4f11fc], bl
je 0x44dc61
push 0xbd3
xor edx, edx
call fcn.00442030
add esp, 4
mov eax, dword [0x4f11dc]
add dword [0x4f1648], ebx
mov dword [esp + 0xb0], 0
test eax, eax
je 0x44dca1
cmp dword [eax + 0xc], 0
je 0x44dca1
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0xb0]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
push 0x40a
push eax
mov eax, dword [ecx + 0x20]
call eax
cmp dword [edi + 0xbc], 0
mov dword [esp + 0x3c], 0x80004005
jne 0x44e133
lea esi, [edi + 0xc8]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 0
mov byte [esp + 0xd8], 1
call fcn.00429fd0
cmp dword [ebp + 0xc], 0xce
jne 0x44dd01
mov dword [0x4f11d0], ebx
test eax, eax
jne 0x44ddfd
mov byte [esp + 0xd8], al
lea eax, [esp + 0x1c]
call fcn.004447c0
jmp 0x44e133
call fcn.00444500
lea ecx, [esp + 0x88]
push ecx
mov dword [esp + 0x24], eax
call fcn.00432fb0
lea edx, [esp + 0x88]
push edx
push 0x77a
add edi, 0x74
push edi
mov byte [esp + 0xe4], 3
call fcn.00427b30
mov edi, dword [esp + 0x94]
mov eax, dword [esp + 0x98]
cmp edi, eax
jbe 0x44dd53
call fcn.00492f40
mov eax, dword [esp + 0x98]
mov ebx, dword [esp + 0x88]
lea ebx, [ebx]
mov esi, eax
cmp dword [esp + 0x94], eax
jbe 0x44dd70
call fcn.00492f40
test ebx, ebx
je 0x44dd7d
cmp ebx, dword [esp + 0x88]
je 0x44dd82
call fcn.00492f40
cmp edi, esi
je 0x44e0c4
mov eax, dword [ebp + 8]
cmp dword [eax + 0xbc], 0
jne 0x44e029
test ebx, ebx
jne 0x44e01b
call fcn.00492f40
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x44ddb3
call fcn.00492f40
mov ecx, dword [edi]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
lea eax, [esp + 0x3c]
push eax
mov eax, dword [ebp + 0xc]
xor esi, esi
push esi
push eax
push 0x77a
call edx
cmp eax, esi
jne 0x44e041
cmp ebx, esi
jne 0x44e022
call fcn.00492f40
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x44ddee
call fcn.00492f40
mov eax, dword [esp + 0x98]
add edi, 4
jmp 0x44dd60
call fcn.0042a1c0
lea ecx, [esp + 0x58]
push ecx
call fcn.00432fb0
lea edx, [esp + 0x58]
push edx
push 0x77a
add edi, 0x74
push edi
mov byte [esp + 0xe4], 2
call fcn.00427b30
mov dword [esp + 0x18], 0x4f10cc
nop
mov eax, dword [esp + 0x18]
cmp dword [eax], 0
je 0x44df25
mov esi, dword [esp + 0x1c]
xor edi, edi
cmp dword [esp + 0x20], edi
je 0x44de6d
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x44de69
call eax
push esi
call fcn.00444710
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x44de69
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], edi
mov dword [esp + 0x20], edi
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
call fcn.00444500
mov edi, dword [esp + 0x64]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x68]
cmp edi, eax
jbe 0x44de91
call fcn.00492f40
mov eax, dword [esp + 0x68]
mov ebx, dword [esp + 0x58]
mov esi, eax
cmp dword [esp + 0x64], eax
jbe 0x44dea2
call fcn.00492f40
test ebx, ebx
je 0x44deac
cmp ebx, dword [esp + 0x58]
je 0x44deb1
call fcn.00492f40
cmp edi, esi
je 0x44df25
mov edx, dword [ebp + 8]
cmp dword [edx + 0xbc], 0
jne 0x44df6c
test ebx, ebx
jne 0x44df1d
call fcn.00492f40
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x44deda
call fcn.00492f40
mov ecx, dword [edi]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [esp + 0x3c]
push edx
push 0
push 0xce
push 0x77a
call eax
test eax, eax
jne 0x44df9d
test ebx, ebx
jne 0x44df21
call fcn.00492f40
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x44df11
call fcn.00492f40
mov eax, dword [esp + 0x68]
add edi, 4
jmp 0x44de95
mov eax, dword [ebx]
jmp 0x44ded0
mov eax, dword [ebx]
jmp 0x44df07
mov eax, dword [esp + 0x18]
add eax, 4
cmp eax, 0x4f1108
mov dword [esp + 0x18], eax
jl 0x44de30
mov eax, dword [esp + 0x64]
test eax, eax
je 0x44df4c
push eax
call fcn.00491276
add esp, 4
mov eax, dword [esp + 0x58]
xor edi, edi
push eax
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x70], edi
call fcn.00491276
add esp, 4
jmp 0x44e101
mov eax, dword [esp + 0x64]
test eax, eax
je 0x44df7d
push eax
call fcn.00491276
add esp, 4
mov ecx, dword [esp + 0x58]
xor edi, edi
push ecx
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x70], edi
call fcn.00491276
add esp, 4
jmp 0x44e101
mov eax, dword [esp + 0x64]
test eax, eax
je 0x44dfae
push eax
call fcn.00491276
add esp, 4
mov edx, dword [esp + 0x58]
push edx
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
call fcn.00491276
add esp, 4
mov byte [esp + 0xd8], 0
cmp dword [esp + 0x20], 0
je 0x44e133
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x44e133
call eax
push esi
call fcn.00444710
mov eax, dword [esi + 0x20]
test eax, eax
je 0x44e133
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], 0
jmp 0x44e133
mov eax, dword [ebx]
jmp 0x44dda9
mov eax, dword [ebx]
jmp 0x44dde4
mov eax, dword [esp + 0x94]
test eax, eax
je 0x44e03d
push eax
call fcn.00491276
add esp, 4
xor esi, esi
jmp 0x44e055
mov eax, dword [esp + 0x94]
cmp eax, esi
je 0x44e055
push eax
call fcn.00491276
add esp, 4
mov eax, dword [esp + 0x88]
push eax
mov dword [esp + 0x98], esi
mov dword [esp + 0x9c], esi
mov dword [esp + 0xa0], esi
call fcn.00491276
add esp, 4
mov byte [esp + 0xd8], 0
cmp dword [esp + 0x20], esi
je 0x44e133
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x44e133
call eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.00444710
mov eax, dword [esi + 0x20]
test eax, eax
je 0x44e133
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, esi
mov dword [edx + 0x20], 0
jmp 0x44e133
mov eax, dword [esp + 0x94]
test eax, eax
je 0x44e0d8
push eax
call fcn.00491276
add esp, 4
xor eax, eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x88]
push eax
call fcn.00491276
add esp, 4
xor edi, edi
mov byte [esp + 0xd8], 0
cmp dword [esp + 0x20], edi
je 0x44e133
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x44e133
call eax
push esi
call fcn.00444710
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x44e133
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], edi
cmp dword [0x4f11d0], 0
je 0x44e5a2
mov esi, dword [ebp + 8]
cmp dword [esi + 0xbc], 0
jne 0x44e359
lea ecx, [esi + 0xc8]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 0
mov byte [esp + 0xd8], 4
call fcn.00429fd0
mov dword [0x4f11d0], 1
test eax, eax
jne 0x44e192
mov byte [esp + 0xd8], al
lea eax, [esp + 0x2c]
call fcn.004447c0
jmp 0x44e359
call fcn.0042a1c0
lea edx, [esp + 0x70]
push edx
call fcn.00432fb0
lea eax, [esp + 0x70]
push eax
push 0x417
add esi, 0x74
push esi
mov byte [esp + 0xe4], 5
call fcn.00427b30
mov dword [esp + 0x18], 0x4f10cc
jmp 0x44e1d0
mov ecx, dword [esp + 0x18]
cmp dword [ecx], 0
je 0x44e2d2
mov esi, dword [esp + 0x2c]
xor edi, edi
cmp dword [esp + 0x30], edi
je 0x44e20d
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x44e209
call eax
push esi
call fcn.00444710
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x44e209
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], edi
mov dword [esp + 0x30], edi
mov edx, dword [esp + 0x18]
mov eax, dword [edx]
call fcn.00444500
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x80]
cmp edi, eax
jbe 0x44e237
call fcn.00492f40
mov eax, dword [esp + 0x80]
mov ebx, dword [esp + 0x70]
jmp 0x44e240
mov esi, eax
cmp dword [esp + 0x7c], eax
jbe 0x44e24d
call fcn.00492f40
test ebx, ebx
je 0x44e257
cmp ebx, dword [esp + 0x70]
je 0x44e25c
call fcn.00492f40
cmp edi, esi
je 0x44e2d2
mov eax, dword [ebp + 8]
cmp dword [eax + 0xbc], 0
jne 0x44e2e8
test ebx, ebx
jne 0x44e2ca
call fcn.00492f40
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x44e281
call fcn.00492f40
mov ecx, dword [edi]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
lea eax, [esp + 0x3c]
push eax
push 0x168
push 0xce
push 0x417
call edx
test eax, eax
jne 0x44e3ab
test ebx, ebx
jne 0x44e2ce
call fcn.00492f40
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x44e2bb
call fcn.00492f40
mov eax, dword [esp + 0x80]
add edi, 4
jmp 0x44e240
mov eax, dword [ebx]
jmp 0x44e277
mov eax, dword [ebx]
jmp 0x44e2b1
mov eax, dword [esp + 0x18]
add eax, 4
cmp eax, 0x4f1108
mov dword [esp + 0x18], eax
jl 0x44e1d0
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x44e2f9
push eax
call fcn.00491276
add esp, 4
mov eax, dword [esp + 0x70]
xor esi, esi
push eax
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], esi
call fcn.00491276
add esp, 4
mov byte [esp + 0xd8], 0
cmp dword [esp + 0x30], esi
je 0x44e359
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x44e359
call eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.00444710
mov eax, dword [esi + 0x20]
test eax, eax
je 0x44e359
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, esi
mov dword [edx + 0x20], 0
mov esi, dword [ebp + 8]
cmp dword [esi + 0xbc], 0
jne 0x44e5a2
lea eax, [esi + 0xc8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
mov byte [esp + 0xd8], 7
call fcn.00429fd0
mov dword [0x4f11d0], 1
test eax, eax
jne 0x44e3fc
mov byte [esp + 0xd8], al
lea eax, [esp + 0x24]
call fcn.004447c0
jmp 0x44e5a2
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x44e3bc
push eax
call fcn.00491276
add esp, 4
mov eax, dword [esp + 0x70]
push eax
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
call fcn.00491276
add esp, 4
mov byte [esp + 0xd8], 0
cmp dword [esp + 0x30], 0
jmp 0x44e329
call fcn.0042a1c0
lea ecx, [esp + 0x40]
push ecx
call fcn.00432fb0
lea edx, [esp + 0x40]
push edx
push 0x418
add esi, 0x74
push esi
mov byte [esp + 0xe4], 8
call fcn.00427b30
mov dword [esp + 0x18], 0x4f10cc
mov edi, edi
mov eax, dword [esp + 0x18]
cmp dword [eax], 0
je 0x44e524
mov esi, dword [esp + 0x24]
xor edi, edi
cmp dword [esp + 0x28], edi
je 0x44e46d
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x44e469
call eax
push esi
call fcn.00444710
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x44e469
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], edi
mov dword [esp + 0x28], edi
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
call fcn.00444500
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x50]
cmp edi, eax
jbe 0x44e491
call fcn.00492f40
mov eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x40]
mov esi, eax
cmp dword [esp + 0x4c], eax
jbe 0x44e4a2
call fcn.00492f40
test ebx, ebx
je 0x44e4ac
cmp ebx, dword [esp + 0x40]
je 0x44e4b1
call fcn.00492f40
cmp edi, esi
je 0x44e524
mov edx, dword [ebp + 8]
cmp dword [edx + 0xbc], 0
jne 0x44e53a
test ebx, ebx
jne 0x44e51c
call fcn.00492f40
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x44e4d6
call fcn.00492f40
mov ecx, dword [edi]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [esp + 0x3c]
push edx
push 0x168
push 0xce
push 0x418
call eax
test eax, eax
jne 0x44e605
test ebx, ebx
jne 0x44e520
call fcn.00492f40
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x44e510
call fcn.00492f40
mov eax, dword [esp + 0x50]
add edi, 4
jmp 0x44e495
mov eax, dword [ebx]
jmp 0x44e4cc
mov eax, dword [ebx]
jmp 0x44e506
mov eax, dword [esp + 0x18]
add eax, 4
cmp eax, 0x4f1108
mov dword [esp + 0x18], eax
jl 0x44e430
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x44e54b
push eax
call fcn.00491276
add esp, 4
mov ecx, dword [esp + 0x40]
xor esi, esi
push ecx
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
call fcn.00491276
add esp, 4
mov byte [esp + 0xd8], 0
cmp dword [esp + 0x28], esi
je 0x44e5a2
mov edx, dword [esp + 0x24]
mov eax, dword [edx + 0x10]
test eax, eax
je 0x44e5a2
call eax
mov esi, dword [esp + 0x24]
push esi
call fcn.00444710
mov eax, dword [esi + 0x20]
test eax, eax
je 0x44e5a2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov dword [eax + 0x20], 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.0044f1c0
test byte [0x4f44e4], 1
jne 0x44e5d0
or dword [0x4f44e4], 1
call fcn.00430d00
push 0x4bfa30
call fcn.004914a4
add esp, 4
mov edx, dword [esp + 0xac]
push edx
mov dword [0x4f11d8], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x44e616
push eax
call fcn.00491276
add esp, 4
mov ecx, dword [esp + 0x40]
push ecx
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
call fcn.00491276
add esp, 4
mov byte [esp + 0xd8], 0
cmp dword [esp + 0x28], 0
jmp 0x44e572