Function at 0x4098b0
Capabilities:
Check if file exists
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb6c
mov eax, dword [0x48c8b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp - 0xa64]
mov esi, ecx
push ecx
mov edx, dword [esi + 0x180]
mov ecx, dword [esi + 0x17c]
mov dword [ebp - 0xa14], esi
mov dword [ebp - 0xa48], 0
call fcn.00410220
mov eax, dword [esi + 0x17c]
lea ebx, [esi + 0x94]
mov dword [esi + 0x180], eax
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
add esp, 8
mov dword [ebp - 0xa3c], ebx
cmp esi, edi
je 0x409922
mov ecx, esi
call fcn.004050a0
add esi, 0x38
cmp esi, edi
jne 0x409914
mov eax, dword [ebx]
mov dword [ebx + 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.004470b0
add esp, 0xc
mov dword [ebp - 0xa30], 0
mov dword [ebp - 0xa7c], 3
call fcn.00425809
mov ecx, eax
test ecx, ecx
je 0x40b4a7
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0xa5c], edi
call fcn.00425809
mov ecx, eax
test ecx, ecx
je 0x40b4b1
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [ebp - 0xa14]
add ecx, 0xac
add eax, 0x10
mov ebx, dword [ecx + 4]
mov esi, dword [ecx]
mov dword [ebp - 0xa28], eax
mov dword [ebp - 0xa18], eax
mov dword [ebp - 0xa94], ecx
cmp esi, ebx
je 0x4099c8
mov ecx, esi
call fcn.004050a0
add esi, 0x38
cmp esi, ebx
jne 0x4099b4
mov ecx, dword [ebp - 0xa94]
mov eax, dword [ecx]
mov dword [ecx + 4], eax
call fcn.00425809
mov ecx, eax
test ecx, ecx
je 0x40b4bb
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov eax, dword [ebp - 0xa14]
mov dword [ebp - 0xa20], esi
cmp dword [eax + 0xd8], 0
lea ebx, [eax + 0xd8]
mov dword [ebp - 0xa40], esi
mov dword [ebp - 0xa34], ebx
jne 0x409d68
lea ebx, [eax + 0x16c]
add eax, 0x178
push ebx
push eax
call fcn.0040dfa0
add esp, 8
test al, al
je 0x409b51
push str.WindowsSystem32configCOMPONENTS
lea eax, [ebp - 0xac4]
push ebx
push eax
call fcn.0040de20
add esp, 0xc
push dword [eax]
push str.COMPONENTS
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov edx, dword [ebp - 0xac4]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409a73
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0xa
push str.COMPONENTS
lea ecx, [ebp - 0xa5c]
call fcn.00416dd0
push dword [ebp - 0xa34]
mov edi, dword [ebp - 0xa5c]
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x20019
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call eax
mov ebx, eax
test ebx, ebx
je 0x409c8b
mov ecx, 0x47aa78
call fcn.0041efe0
mov esi, dword [eax]
push 0
push 0
lea eax, [ebp - 0xa50]
push eax
push 0x400
push ebx
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push dword [ebp - 0xa50]
lea ecx, [ebp - 0xaac]
call fcn.004169c0
push dword [ebp - 0xa50]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push esi
mov esi, dword [ebp - 0xaac]
mov ecx, dword [ebp - 0xa14]
push esi
call fcn.0042a86d
add esi, 0xfffffff0
or ebx, 0xffffffff
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409b27
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa20]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409b46
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa28]
jmp 0x40b466
push 0x47b744
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push str.WindowsSystem32configCOMPONENTS
lea eax, [ebp - 0xac8]
push ebx
push eax
call fcn.0040de20
add esp, 0xc
push dword [eax]
push 0x47b744
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov ebx, dword [ebp - 0xac8]
add ebx, 0xfffffff0
mov dword [ebp - 0xa50], eax
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409bb4
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xa50]
test eax, eax
je 0x409c12
mov ecx, 0x47aa78
call fcn.0041efe0
mov esi, dword [eax]
push 0
push 0
lea eax, [ebp - 0xa9c]
push eax
push 0x400
push dword [ebp - 0xa50]
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push dword [ebp - 0xa9c]
lea ecx, [ebp - 0xad0]
call fcn.004169c0
push dword [ebp - 0xa9c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push esi
mov esi, dword [ebp - 0xad0]
jmp 0x409aff
push dword [ebp - 0xa34]
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x20019
push 0
push 0x47b744
push SysStringLen
call eax
mov ebx, eax
test ebx, ebx
je 0x409c8b
mov ecx, 0x47aa78
call fcn.0041efe0
mov esi, dword [eax]
push 0
push 0
lea eax, [ebp - 0xa80]
push eax
push 0x400
push ebx
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push dword [ebp - 0xa80]
lea ecx, [ebp - 0xa70]
call fcn.004169c0
push dword [ebp - 0xa80]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push esi
mov esi, dword [ebp - 0xa70]
jmp 0x409aff
mov ebx, dword [ebp - 0xa14]
mov eax, dword [ebp - 0xa34]
add ebx, 0xdc
push ebx
push str.Windows_Update_Clean_Tool
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x409e02
mov eax, dword [ebp - 0xa14]
mov dword [eax + 0x238], 1
lea eax, [ebp - 0xac0]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0xa7c]
push eax
push 0
push str.AppSet
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x409d42
lea eax, [ebp - 0xac0]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0xa7c]
push eax
push 0
push str.AppSet
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x409d42
mov ecx, dword [ebp - 0xa14]
push 1
call fcn.0042c7c0
mov ecx, dword [ebp - 0xa14]
push 4
add ecx, 0x238
push ecx
push 3
push 0
push str.AppSet
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x409d55
movzx eax, word [ebp - 0x210]
mov edx, dword [ebp - 0xa14]
mov dword [edx + 0x238], eax
mov ecx, dword [ebp - 0xa14]
push 0
call fcn.0042c7c0
mov ebx, dword [ebp - 0xa34]
push 0x1b
push 0x47b890
lea ecx, [ebp - 0xa18]
call fcn.00416dd0
mov eax, dword [ebp - 0xa14]
add eax, 0xb8
mov dword [ebp - 0xa28], eax
mov edx, dword [eax]
mov eax, dword [ebp - 0xa18]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
mov ecx, dword [ebp - 0xa28]
push eax
call dword [edx + 0x3c]
xor eax, eax
push 0x3fe
push eax
mov word [ebp - 0x610], ax
lea eax, [ebp - 0x60e]
push eax
call fcn.004470b0
add esp, 0xc
lea eax, [ebp - 0xa0f]
push 0x3ff
push 0
push eax
mov byte [ebp - 0xa10], 0
call fcn.004470b0
add esp, 0xc
mov dword [ebp - 0xa2c], 0x400
mov dword [ebp - 0xa38], 0x400
call fcn.00425809
mov ecx, eax
test ecx, ecx
jne 0x409e53
jmp 0x40b4c5
mov ecx, 0x47aa78
call fcn.0041efe0
mov ebx, dword [eax]
mov ecx, 0x47b87c
call fcn.0041efe0
mov ecx, dword [ebp - 0xa14]
push 0
push ebx
push dword [eax]
call fcn.0042a86d
add esi, 0xfffffff0
or ebx, 0xffffffff
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409b46
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa28]
jmp 0x40b466
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa68], eax
call fcn.00425809
mov ecx, eax
test ecx, ecx
je 0x40b4cf
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa60], eax
lea eax, [ebp - 0xa30]
push eax
push 0x20019
push 0
push str.CanonicalDataDeployments
push dword [ebx]
mov dword [ebp - 0xab8], 0
mov dword [ebp - 0xab4], 0
mov dword [ebp - 0xab0], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b3d5
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push 0x104
lea eax, [ebp - 0x210]
push eax
xor ebx, ebx
push ebx
push dword [ebp - 0xa30]
call edi
test eax, eax
jne 0x40a1c0
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409ef0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0xa18]
call fcn.00416dd0
mov eax, dword [ebp - 0xa18]
mov esi, dword [ebp - 0xa28]
mov ecx, dword [eax - 0xc]
mov edx, dword [esi]
add ecx, ecx
push ecx
push eax
mov ecx, esi
call dword [edx + 0x3c]
mov eax, dword [esi]
push 4
push 0x47c134
mov ecx, esi
call dword [eax + 0x3c]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0xa20]
call fcn.004169c0
lea eax, [ebp - 0xa20]
push eax
lea ecx, [ebp - 0xb30]
call fcn.004035e0
mov edi, dword [ebp - 0xa14]
push eax
lea ecx, [edi + 0x17c]
call fcn.0040e330
mov edx, dword [ebp - 0xb1c]
add edx, 0xfffffff0
or esi, 0xffffffff
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409f92
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xb28]
test eax, eax
je 0x409fc3
push eax
call fcn.004254d3
add esp, 4
mov dword [ebp - 0xb28], 0
mov dword [ebp - 0xb24], 0
mov dword [ebp - 0xb20], 0
mov edx, dword [ebp - 0xb30]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409fe2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa20]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a001
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [edi + 0x180]
sub ecx, dword [edi + 0x17c]
mov eax, 0x2aaaaaab
stosb byte es:[edi], al
sub dh, bh
jmp 0x8b439ad9
ret 0xe8c1
pop ds
add eax, edx
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x17c]
lea esi, [eax + ecx*8]
lea eax, [ebp - 0xa44]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0xa30]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a19c
push 0x400
push eax
lea eax, [ebp - 0x610]
push eax
call fcn.004470b0
add esp, 0xc
lea eax, [ebp - 0xa10]
push 0x400
push 0
push eax
call fcn.004470b0
add esp, 0xc
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0xa10]
push eax
xor edi, edi
push edi
push edi
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x610]
push eax
push edi
push dword [ebp - 0xa44]
mov dword [ebp - 0xa38], 0x400
mov dword [ebp - 0xa2c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40a190
jmp 0x40a0d0
cmp word [ebp - 0x60e], 0x21
jne 0x40a11a
push ecx
lea eax, [ebp - 0x610]
mov ecx, esp
push eax
call fcn.004169c0
lea ecx, [esi - 0x18]
call fcn.004036c0
mov ax, word [ebp - 0x610]
cmp ax, 0x69
jne 0x40a107
mov dword [esi - 0x14], 3
jmp 0x40a11a
cmp ax, 0x70
jne 0x40a11a
cmp dword [esi - 0x14], 0xffffffff
jne 0x40a11a
mov dword [esi - 0x14], 0
push 0x400
lea eax, [ebp - 0x610]
push 0
push eax
inc edi
call fcn.004470b0
add esp, 0xc
lea eax, [ebp - 0xa10]
push 0x400
push 0
push eax
call fcn.004470b0
add esp, 0xc
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0xa10]
push eax
push 0
push 0
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x610]
push eax
push edi
push dword [ebp - 0xa44]
mov dword [ebp - 0xa38], 0x400
mov dword [ebp - 0xa2c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x40a0d0
push dword [ebp - 0xa44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push 0x104
lea eax, [ebp - 0x210]
push eax
inc ebx
push ebx
push dword [ebp - 0xa30]
call edi
test eax, eax
je 0x409ee4
push dword [ebp - 0xa30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xa64]
mov ebx, dword [ebp - 0xa14]
push ecx
mov edx, dword [ebx + 0xd0]
mov ecx, dword [ebx + 0xcc]
call fcn.004102a0
mov eax, dword [ebx + 0xcc]
add esp, 8
mov dword [ebx + 0xd0], eax
cmp dword [ebx + 0x23c], 0
mov dword [ebp - 0xadc], 0
mov dword [ebp - 0xad8], 0
mov dword [ebp - 0xad4], 0
jne 0x40a900
push 0x12
push 0x47b914
lea ecx, [ebp - 0xa18]
call fcn.00416dd0
mov esi, dword [ebp - 0xa18]
mov edx, dword [ebx + 0xb8]
mov eax, dword [esi - 0xc]
lea ecx, [ebx + 0xb8]
add eax, eax
push eax
push esi
call dword [edx + 0x3c]
push str.identity
lea ecx, [ebp - 0xa4c]
call fcn.004169c0
push str.Removed
lea ecx, [ebp - 0xa8c]
call fcn.004169c0
lea eax, [ebp - 0xa30]
push eax
mov eax, dword [ebp - 0xa34]
push 0x20019
push 0
push str.DerivedDataComponents
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a965
push 0x104
mov dword [ebp - 0xa34], eax
lea eax, [ebp - 0x210]
push eax
push 0
push dword [ebp - 0xa30]
call edi
mov edi, dword [ebp - 0xa4c]
mov esi, dword [ebp - 0xa8c]
test eax, eax
jne 0x40a8b9
jmp 0x40a2d0
inc dword [ebp - 0xa34]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a2e0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0xa18]
call fcn.00416dd0
mov eax, dword [ebx + 0xb8]
lea ecx, [ebx + 0xb8]
push 4
push 0x47c134
call dword [eax + 0x3c]
mov eax, dword [ebp - 0xa18]
mov edx, dword [ebx + 0xb8]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
lea ecx, [ebx + 0xb8]
call dword [edx + 0x3c]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0xa98]
call fcn.004169c0
push ecx
mov ecx, esp
push 0x47c3e0
call fcn.004169c0
lea eax, [ebp - 0xa98]
push eax
lea ecx, [ebp - 0xb18]
call fcn.00403b30
mov edx, dword [ebp - 0xa98]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a385
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xb18]
call fcn.00404df0
test al, al
je 0x40a48f
push str..manifest
lea eax, [ebp - 0x210]
push eax
push str.WindowsWinSxSManifests_
lea eax, [ebx + 0x16c]
push eax
lea eax, [ebp - 0xa74]
push eax
call fcn.0040de20
add esp, 0xc
push eax
lea eax, [ebp - 0xa6c]
push eax
call fcn.0040de20
add esp, 0xc
push eax
lea eax, [ebp - 0xaa8]
push eax
call fcn.0040de20
add esp, 0xc
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, dword [ebp - 0xaa8]
add ebx, 0xfffffff0
mov dword [ebp - 0xa70], eax
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a40d
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa6c]
add edx, 0xfffffff0
or ebx, 0xffffffff
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a42f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa74]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a44e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0xa70], 0
je 0x40a880
lea eax, [ebp - 0xb18]
push eax
lea ecx, [ebp - 0xb68]
call fcn.0040b580
mov ecx, dword [ebp - 0xa94]
lea eax, [ebp - 0xb68]
push eax
call fcn.0040e5d0
lea ecx, [ebp - 0xb68]
call fcn.004050a0
jmp 0x40a880
mov ebx, dword [ebp - 0xafc]
mov ecx, dword [ebp - 0xaf8]
sub ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
dec eax
add eax, edx
lea eax, [eax + eax*2]
lea ecx, [ebx + eax*8]
mov eax, dword [ecx + 4]
cmp dword [eax - 0xc], 0xa
jne 0x40a525
cmp dword [eax - 0xc], 4
jl 0x40b4e8
cmp word [eax + 8], 0x2e
jne 0x40a525
mov eax, dword [ebp - 0xa48]
or eax, 3
mov dword [ebp - 0xa48], eax
lea eax, [ebp - 0xa18]
push eax
mov eax, dword [ebp - 0xa14]
add eax, 0x16c
push str.WindowsWinSxS_
push eax
lea eax, [ebp - 0xa1c]
push eax
call fcn.0040de20
add esp, 0xc
push eax
lea eax, [ebp - 0xa24]
push eax
call fcn.0040ddb0
add esp, 0xc
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x40a525
xor bl, bl
jmp 0x40a527
mov bl, 1
mov eax, dword [ebp - 0xa48]
test al, 2
je 0x40a560
mov edx, dword [ebp - 0xa24]
and eax, 0xfffffffd
add edx, 0xfffffff0
mov dword [ebp - 0xa48], eax
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a55a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xa48]
test al, 1
je 0x40a58d
mov edx, dword [ebp - 0xa1c]
and eax, 0xfffffffe
add edx, 0xfffffff0
mov dword [ebp - 0xa48], eax
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a58d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
jne 0x40a880
lea eax, [ebp - 0xa44]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0xa30]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a880
push 0x400
push eax
mov dword [ebp - 0xa20], eax
lea eax, [ebp - 0x610]
push eax
call fcn.004470b0
add esp, 0xc
lea eax, [ebp - 0xa10]
push 0x400
push 0
push eax
call fcn.004470b0
add esp, 0xc
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0xa10]
push eax
push 0
push 0
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x610]
push eax
push 0
push dword [ebp - 0xa44]
mov dword [ebp - 0xa38], 0x400
mov dword [ebp - 0xa2c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40a812
mov ebx, dword [ebp - 0xafc]
nop
cmp word [ebp - 0x610], 0x63
jne 0x40a6c3
cmp word [ebp - 0x60e], 0x21
jne 0x40a6c3
mov eax, dword [ebp - 0xa2c]
mov ebx, dword [ebp - 0xafc]
lea eax, [ebp + eax*2 - 0x630]
push eax
lea eax, [ebx + 8]
push eax
call fcn.0040e060
add esp, 8
test al, al
je 0x40a78b
mov eax, dword [ebp - 0xa2c]
mov ecx, dword [ebp - 0xa14]
lea eax, [ebp + eax*2 - 0x630]
push eax
lea ecx, [ecx + 0x17c]
call fcn.00403980
cmp eax, 0xffffffff
je 0x40a78b
mov edx, dword [ebp - 0xa14]
lea ecx, [eax + eax*2]
mov eax, dword [edx + 0x17c]
lea eax, [eax + ecx*8]
push eax
mov ecx, ebx
call fcn.00403a10
jmp 0x40a78b
lea ecx, [ebp - 0x610]
mov eax, esi
jmp 0x40a6d0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40a6f6
test dx, dx
je 0x40a6f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40a6f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x40a6d0
xor eax, eax
jmp 0x40a6fb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40a70a
mov dword [ebx], 1
jmp 0x40a791
lea ecx, [ebp - 0x610]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40a738
test dx, dx
je 0x40a734
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40a738
add eax, 4
add ecx, 4
test dx, dx
jne 0x40a712
xor eax, eax
jmp 0x40a73d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40a791
cmp byte [ebp - 0xa10], 0x2c
je 0x40a766
lea ebx, [ebx]
inc eax
cmp byte [ebp + eax - 0xa10], 0x2c
jne 0x40a750
cmp eax, 0x400
jae 0x40b4d9
mov byte [ebp + eax - 0xa10], 0
lea eax, [ebp - 0xa10]
push eax
lea ecx, [ebp - 0xaf0]
call fcn.00416390
lea ecx, [ebp - 0xaf0]
call fcn.0040dd50
mov ebx, dword [ebp - 0xafc]
inc dword [ebp - 0xa20]
push 0x400
lea eax, [ebp - 0x610]
push 0
push eax
call fcn.004470b0
add esp, 0xc
lea eax, [ebp - 0xa10]
push 0x400
push 0
push eax
call fcn.004470b0
add esp, 0xc
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0xa10]
push eax
push 0
push 0
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x610]
push eax
mov eax, dword [ebp - 0xa20]
push eax
push dword [ebp - 0xa44]
mov dword [ebp - 0xa38], 0x400
mov dword [ebp - 0xa2c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x40a640
push dword [ebp - 0xa44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0xafc]
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
test eax, 0xfffffffc
jne 0x40a864
mov ecx, dword [ebp - 0xa14]
push dword [ebx + 8]
lea ecx, [ecx + 0x17c]
call fcn.00403980
cmp eax, 0xffffffff
je 0x40a864
mov ecx, dword [ebp - 0xa14]
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0x17c]
mov ecx, ebx
lea eax, [eax + edx*8]
push eax
call fcn.00403a10
sub esp, 0x38
lea eax, [ebp - 0xb18]
mov ecx, esp
push eax
call fcn.0040b580
mov ecx, dword [ebp - 0xa3c]
call fcn.00404f40
lea ecx, [ebp - 0xb18]
call fcn.004050a0
push 0x104
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp - 0xa34]
push eax
push dword [ebp - 0xa30]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x40a8b9
mov ebx, dword [ebp - 0xa14]
jmp 0x40a2d0
push dword [ebp - 0xa30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xfffffff0
or ebx, 0xffffffff
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a8e1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov ecx, ebx
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a8fa
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0xa14]
push 0xa
push 0x47b9c4
lea ecx, [ebp - 0xa18]
call fcn.00416dd0
mov eax, dword [ebp - 0xa18]
mov edx, dword [ebx + 0xb8]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
lea ecx, [ebx + 0xb8]
call dword [edx + 0x3c]
mov eax, dword [ebx + 0x16c]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x40a94a
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x40aa75
call fcn.00425809
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x40aa75
jmp 0x40b4de
mov ecx, 0x47aa78
call fcn.0041efe0
mov edi, dword [eax]
mov ecx, 0x47b8fc
call fcn.0041efe0
push 0
push edi
push dword [eax]
mov ecx, ebx
call fcn.0042a86d
mov edx, dword [ebp - 0xa8c]
add edx, 0xfffffff0
or ebx, 0xffffffff
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a9a9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa4c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a9c8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xadc]
call fcn.00405860
lea ecx, [ebp - 0xab8]
call fcn.0040e8e0
mov edx, dword [ebp - 0xa60]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a9fd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa68]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40aa1c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa40]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40aa3b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40aa54
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa5c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x40b496
mov ecx, dword [edx]
push edx
jmp 0x40b491
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov eax, dword [ebx + 0x16c]
mov dword [ebp - 0xa4c], edi
mov esi, dword [eax - 0xc]
mov dword [ebp - 0xa58], edi
lea ebx, [esi + 0xf]
mov dword [ebp - 0xa1c], eax
test ebx, ebx
js 0x40b4e8
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, ebx
or ecx, eax
jge 0x40aacc
push ebx
lea ecx, [ebp - 0xa58]
call fcn.00416cf0
mov edi, dword [ebp - 0xa58]
mov dword [ebp - 0xa4c], edi
add esi, esi
push esi
push dword [ebp - 0xa1c]
push esi
push edi
call fcn.0043ddca
push 0x1e
push str.Windowswinsxs_
lea eax, [edi + esi]
push 0x1e
push eax
call fcn.0043ddca
add esp, 0x20
cmp ebx, dword [edi - 8]
jg 0x40b4e8
mov dword [edi - 0xc], ebx
xor eax, eax
mov word [edi + ebx*2], ax
mov ebx, dword [ebp - 0xa14]
mov eax, dword [ebx + 0x16c]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x40ab21
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x40ab37
call fcn.00425809
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x40b4f2
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov eax, dword [ebx + 0x16c]
mov dword [ebp - 0xa58], esi
mov ebx, dword [eax - 0xc]
mov dword [ebp - 0xa54], esi
lea edx, [ebx + 0x19]
mov dword [ebp - 0xa1c], eax
mov dword [ebp - 0xa24], ebx
test edx, edx
js 0x40b4fc
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or ecx, eax
jge 0x40ab94
push edx
lea ecx, [ebp - 0xa54]
call fcn.00416cf0
mov esi, dword [ebp - 0xa54]
mov dword [ebp - 0xa58], esi
add ebx, ebx
push ebx
push dword [ebp - 0xa1c]
push ebx
push esi
call fcn.0043ddca
push 0x32
push str.WindowswinsxsManifests_
lea eax, [esi + ebx]
push 0x32
push eax
call fcn.0043ddca
mov eax, dword [ebp - 0xa24]
add eax, 0x19
add esp, 0x20
cmp eax, dword [esi - 8]
jg 0x40b4e8
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
mov esi, dword [ebp - 0xa3c]
mov eax, 0x92492493
mov ecx, dword [esi + 4]
sub ecx, dword [esi]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
dec eax
add eax, edx
mov dword [ebp - 0xa20], eax
cmp eax, 0xffffffff
je 0x40b319
mov ebx, dword [esi]
lea ecx, [eax*8]
sub ecx, eax
shl ecx, 3
add ebx, ecx
mov dword [ebp - 0xa54], ecx
mov eax, dword [ebx + 8]
mov dword [ebp - 0xa24], ebx
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x40ac31
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x40ac45
call fcn.00425809
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
test eax, eax
je 0x40b4a7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov eax, dword [ebx + 8]
mov dword [ebp - 0xa90], esi
mov edi, dword [eax - 0xc]
mov dword [ebp - 0xa1c], eax
lea ebx, [edi + 1]
test ebx, ebx
js 0x40b4e8
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, ebx
or ecx, eax
jge 0x40ac8f
push ebx
lea ecx, [ebp - 0xa90]
call fcn.00416cf0
mov esi, dword [ebp - 0xa90]
add edi, edi
push edi
push dword [ebp - 0xa1c]
push edi
push esi
call fcn.0043ddca
push 2
push 0x47ba30
lea eax, [esi + edi]
push 2
push eax
call fcn.0043ddca
add esp, 0x20
cmp ebx, dword [esi - 8]
jg 0x40b4e8
xor eax, eax
mov dword [esi - 0xc], ebx
mov word [esi + ebx*2], ax
mov ecx, dword [esi - 0x10]
lea eax, [esi - 0x10]
mov dword [ebp - 0xa6c], eax
test ecx, ecx
je 0x40acdf
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x40acf3
call fcn.00425809
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
test eax, eax
je 0x40b4a7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov ebx, dword [esi - 0xc]
lea edi, [eax + 0x10]
mov eax, dword [ebp - 0xa24]
mov dword [ebp - 0xa78], edi
mov eax, dword [eax + 4]
mov dword [ebp - 0xa24], eax
mov eax, dword [eax - 0xc]
mov dword [ebp - 0xa1c], eax
lea edx, [ebx + eax]
mov dword [ebp - 0xa74], ebx
test edx, edx
js 0x40b4e8
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, edx
or ecx, eax
jge 0x40ad52
push edx
lea ecx, [ebp - 0xa78]
call fcn.00416cf0
mov edi, dword [ebp - 0xa78]
add ebx, ebx
push ebx
push esi
push ebx
push edi
call fcn.0043ddca
mov esi, dword [ebp - 0xa1c]
lea eax, [esi + esi]
push eax
push dword [ebp - 0xa24]
push eax
lea eax, [edi + ebx]
push eax
call fcn.0043ddca
mov eax, dword [ebp - 0xa74]
add eax, esi
add esp, 0x20
cmp eax, dword [edi - 8]
jg 0x40b4e8
xor ecx, ecx
mov dword [edi - 0xc], eax
mov word [edi + eax*2], cx
mov ecx, dword [edi - 0x10]
lea eax, [edi - 0x10]
mov dword [ebp - 0xa24], eax
test ecx, ecx
je 0x40adad
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x40adc1
call fcn.00425809
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
test eax, eax
je 0x40b4a7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov ebx, dword [edi - 0xc]
lea esi, [eax + 0x10]
lea edx, [ebx + 2]
mov dword [ebp - 0xaa0], esi
mov dword [ebp - 0xa1c], ebx
test edx, edx
js 0x40b4e8
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or ecx, eax
jge 0x40ae08
push edx
lea ecx, [ebp - 0xaa0]
call fcn.00416cf0
mov esi, dword [ebp - 0xaa0]
add ebx, ebx
push ebx
push edi
push ebx
push esi
call fcn.0043ddca
push 4
push 0x47c134
lea eax, [esi + ebx]
push 4
push eax
call fcn.0043ddca
mov eax, dword [ebp - 0xa1c]
add eax, 2
add esp, 0x20
cmp eax, dword [esi - 8]
jg 0x40b4e8
mov ebx, dword [ebp - 0xa18]
xor ecx, ecx
lea edi, [esi - 0x10]
add ebx, 0xfffffff0
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp edi, ebx
je 0x40aee9
cmp dword [ebx + 0xc], ecx
jl 0x40aeda
mov ecx, dword [edi]
cmp ecx, dword [ebx]
jne 0x40aeda
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
mov ecx, eax
jl 0x40ae83
cmp ecx, dword [edi]
jne 0x40ae83
mov esi, edi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x40aeb8
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov esi, eax
test esi, esi
je 0x40b506
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
lea eax, [edi + 0x10]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push ecx
lea eax, [esi + 0x10]
push eax
call fcn.0043ddca
add esp, 0x10
or eax, 0xffffffff
lea ecx, [ebx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x40aecf
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0x10
mov dword [ebp - 0xa18], esi
jmp 0x40aeef
push dword [esi - 0xc]
lea ecx, [ebp - 0xa18]
push esi
call fcn.00416dd0
mov esi, dword [ebp - 0xa18]
or ebx, 0xffffffff
lea eax, [edi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40af08
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa24]
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40af24
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa6c]
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40af40
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi - 0xc]
mov ecx, dword [ebp - 0xa28]
add eax, eax
mov edx, dword [ecx]
push eax
push esi
call dword [edx + 0x3c]
mov esi, dword [ebp - 0xa3c]
mov edi, dword [ebp - 0xa54]
mov ebx, dword [esi]
add ebx, edi
mov eax, 0x2aaaaaab
mov ecx, dword [ebx + 0x20]
sub ecx, dword [ebx + 0x1c]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jne 0x40afd3
mov esi, dword [ebx + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
test eax, 0xfffffffc
je 0x40afb2
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x40afa1
test al, 2
jne 0x40afb6
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
inc edx
sar eax, 2
add ecx, 4
cmp edx, eax
jne 0x40af93
mov byte [ebx + 0x18], 1
mov esi, dword [ebp - 0xa3c]
mov eax, dword [esi]
mov dword [eax + edi + 0x30], 0
mov dword [eax + edi + 0x34], 0
jmp 0x40b2fd
mov ecx, ebx
call fcn.00404350
cmp eax, 5
jne 0x40b2fd
mov esi, dword [esi]
add esi, edi
mov eax, dword [esi + 0x28]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x40affa
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x40b00e
call fcn.00425809
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
test eax, eax
je 0x40b4a7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea edi, [eax + 0x10]
mov eax, dword [esi + 0x28]
mov dword [ebp - 0xa84], edi
mov ebx, dword [eax - 0xc]
mov dword [ebp - 0xa1c], eax
lea esi, [ebx + 0xd]
test esi, esi
js 0x40b4e8
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, esi
or ecx, eax
jge 0x40b058
push esi
lea ecx, [ebp - 0xa84]
call fcn.00416cf0
mov edi, dword [ebp - 0xa84]
push 0x1a
push 0x47ba44
push 0x1a
push edi
call fcn.0043ddca
lea eax, [ebx + ebx]
push eax
push dword [ebp - 0xa1c]
push eax
lea eax, [edi + 0x1a]
push eax
call fcn.0043ddca
add esp, 0x20
cmp esi, dword [edi - 8]
jg 0x40b4e8
xor eax, eax
mov dword [edi - 0xc], esi
mov word [edi + esi*2], ax
mov ecx, dword [edi - 0x10]
lea eax, [edi - 0x10]
mov dword [ebp - 0xa24], eax
test ecx, ecx
je 0x40b0a9
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x40b0bd
call fcn.00425809
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
test eax, eax
je 0x40b4a7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov ebx, dword [edi - 0xc]
lea esi, [eax + 0x10]
lea edx, [ebx + 7]
mov dword [ebp - 0xa88], esi
mov dword [ebp - 0xa1c], ebx
test edx, edx
js 0x40b4e8
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or ecx, eax
jge 0x40b104
push edx
lea ecx, [ebp - 0xa88]
call fcn.00416cf0
mov esi, dword [ebp - 0xa88]
add ebx, ebx
push ebx
push edi
push ebx
push esi
call fcn.0043ddca
push 0xe
push 0x47ba34
lea eax, [ebx + esi]
push 0xe
push eax
call fcn.0043ddca
mov eax, dword [ebp - 0xa1c]
add eax, 7
add esp, 0x20
cmp eax, dword [esi - 8]
jg 0x40b4e8
mov ebx, dword [ebp - 0xa40]
xor ecx, ecx
lea edi, [esi - 0x10]
add ebx, 0xfffffff0
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp edi, ebx
je 0x40b196
cmp dword [ebx + 0xc], ecx
jl 0x40b187
mov eax, dword [edi]
cmp eax, dword [ebx]
jne 0x40b187
push edi
call fcn.00416ec0
add esp, 4
mov esi, eax
or ecx, 0xffffffff
lea edx, [ebx + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40b17c
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
lea eax, [esi + 0x10]
mov dword [ebp - 0xa40], eax
jmp 0x40b196
push dword [esi - 0xc]
lea ecx, [ebp - 0xa40]
push esi
call fcn.00416dd0
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b1ad
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa24]
or edi, 0xffffffff
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b1cc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xa3c]
mov ebx, dword [ebp - 0xa54]
mov eax, dword [eax]
xor esi, esi
mov ecx, dword [eax + ebx + 0x20]
sub ecx, dword [eax + ebx + 0x1c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x40b2b1
jmp 0x40b200
mov eax, dword [ebp - 0xa3c]
push 0x47c134
mov ecx, dword [eax]
lea eax, [ebp - 0xaa4]
push eax
lea eax, [ebp - 0xacc]
add ecx, ebx
push eax
mov dword [ebp - 0xaa4], esi
call fcn.004045c0
push eax
lea eax, [ebp - 0xabc]
push eax
call fcn.0040de20
mov eax, dword [eax]
add esp, 0xc
push dword [eax - 0xc]
lea ecx, [ebp - 0xa40]
push eax
call fcn.004165a0
mov edx, dword [ebp - 0xabc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b268
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xacc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b287
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xa3c]
inc esi
mov eax, dword [eax]
mov ecx, dword [eax + ebx + 0x20]
sub ecx, dword [eax + ebx + 0x1c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jne 0x40b200
push 2
push 0x47c134
lea ecx, [ebp - 0xa40]
call fcn.004165a0
mov eax, dword [ebp - 0xa40]
mov ebx, dword [ebp - 0xa28]
mov ecx, dword [eax - 0xc]
mov edx, dword [ebx]
add ecx, ecx
push ecx
push eax
mov ecx, ebx
call dword [edx + 0x3c]
mov eax, dword [ebp - 0xa20]
mov esi, dword [ebp - 0xa3c]
mov dword [ebp - 0xa64], eax
lea eax, [ebp - 0xa64]
push eax
mov ecx, esi
call fcn.00404eb0
mov eax, dword [ebp - 0xa20]
dec eax
mov dword [ebp - 0xa20], eax
cmp eax, 0xffffffff
jne 0x40ac02
mov edi, dword [ebp - 0xa4c]
push 0xd
push 0x47ba60
lea ecx, [ebp - 0xa18]
call fcn.00416dd0
mov eax, dword [ebp - 0xa18]
mov ebx, dword [ebp - 0xa28]
mov ecx, dword [eax - 0xc]
mov edx, dword [ebx]
add ecx, ecx
push ecx
push eax
mov ecx, ebx
call dword [edx + 0x3c]
push 4
push 0x47ba7c
lea ecx, [ebp - 0xa18]
call fcn.00416dd0
mov eax, dword [ebp - 0xa18]
mov edx, dword [ebx]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
mov ecx, ebx
call dword [edx + 0x3c]
push 6
push 0x47ba88
lea ecx, [ebp - 0xa18]
call fcn.00416dd0
mov esi, dword [ebp - 0xa18]
mov edx, dword [ebx]
mov eax, dword [esi - 0xc]
add eax, eax
push eax
push esi
mov ecx, ebx
call dword [edx + 0x3c]
mov edx, dword [ebp - 0xa58]
add edx, 0xfffffff0
or ebx, 0xffffffff
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b3b3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov ecx, ebx
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a9d3
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40a9d3
mov ecx, 0x47aa78
call fcn.0041efe0
mov ebx, dword [eax]
mov ecx, 0x47b8fc
call fcn.0041efe0
mov ecx, dword [ebp - 0xa14]
push 0
push ebx
push dword [eax]
call fcn.0042a86d
lea ecx, [ebp - 0xab8]
call fcn.0040e8e0
mov edx, dword [ebp - 0xa60]
add edx, 0xfffffff0
or ebx, 0xffffffff
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b428
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa68]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b447
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b460
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa18]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b47f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
lea eax, [edi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x40b496
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ddbb
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00416fc0
push 0x80004005
call fcn.00416fc0
push 0x80004005
call fcn.00416fc0
push 0x80004005
call fcn.00416fc0
push 0x80004005
call fcn.00416fc0
call fcn.0043ed69
push 0x80004005
call fcn.00416fc0
push 0x80070057
call fcn.00416fc0
push 0x80004005
call fcn.00416fc0
push 0x80070057
call fcn.00416fc0
call fcn.00416e90
int3