Function at 0x41eae0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x497218
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b8a40]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov dword [esp + 0x74], 3
mov ecx, dword [esp + 0x7c]
mov eax, dword [ecx - 0xc]
mov dword [esp + 0x2c], 1
test eax, eax
jne 0x41ebdb
lea eax, [ecx - 0x10]
mov byte [esp + 0x74], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41eb47
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x74], 1
mov eax, dword [esp + 0x80]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41eb6f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x74], 0
mov eax, dword [esp + 0x84]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41eb97
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x74], 0xffffffff
mov eax, dword [esp + 0x88]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ebc2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
call fcn.004448fb
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41ebf5
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x74], 4
mov ecx, dword [esp + 0x80]
mov eax, dword [ecx - 0xc]
mov ebx, 5
test eax, eax
jne 0x41ec2f
push ebx
push 0x4a6d90
lea ecx, [esp + 0x88]
call fcn.00402260
lea edx, [esp + 0x24]
push 0x26
push edx
call fcn.00431c80
push 0x4a04bc
push eax
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x88], bl
call fcn.00405010
add esp, 0x14
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x78], 6
call fcn.00401f70
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ec88
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x74], 4
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ecad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x80]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00405740
mov edi, dword [esp + 0x18]
push ecx
lea eax, [edi - 0x10]
mov dword [esp + 0x34], esp
mov esi, esp
push eax
call fcn.00402360
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.004061d0
add esp, 4
test eax, eax
jne 0x41ecf2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 1
push 0x4a04bc
lea ecx, [esp + 0x20]
call fcn.00405740
call fcn.004448fb
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41ed1c
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0x74], 7
mov eax, dword [esp + 0x84]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x41ee4f
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x34], esp
mov esi, esp
push eax
call fcn.00402360
lea ecx, [esp + 0x30]
add esp, 4
add eax, 0x10
push ecx
mov dword [esi], eax
call fcn.00431d90
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x34]
push ecx
mov byte [esp + 0x88], 8
call fcn.0040b570
add esp, 0x14
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x78], 9
call fcn.00401f70
mov byte [esp + 0x74], 8
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41edb8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x20]
push ecx
add esi, 0xfffffff0
mov dword [esp + 0x34], esp
mov edi, esp
push esi
call fcn.00402360
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x7c], 0xa
mov eax, dword [esp + 0x8c]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
call fcn.00402360
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x7c], 8
call fcn.0040a6a0
add esp, 4
mov dword [esp + 0x34], esp
mov edi, esp
push esi
call fcn.00402360
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.004061d0
add esp, 4
test eax, eax
jne 0x41ee2a
lea ecx, [esp + 0x20]
call fcn.00401ff0
mov byte [esp + 0x74], 7
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ee4f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.004448fb
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41ee69
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x7c], 0xb
call fcn.0041f900
add esp, 8
mov byte [esp + 0x74], 0xc
mov eax, dword [esp + 0x88]
cmp dword [eax - 0xc], 0
jne 0x41eeb3
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x8c]
call fcn.00401f70
xor esi, esi
mov dword [esp + 0x44], vtable.CArray_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____.0
mov dword [esp + 0x48], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], esi
mov bl, 0xd
push str.chrome.exe
lea ecx, [esp + 0x28]
mov byte [esp + 0x78], bl
call fcn.00401bc0
mov edi, eax
mov byte [esp + 0x74], 0xe
mov eax, dword [esp + 0x4c]
cmp eax, esi
mov ebp, eax
jge 0x41eef7
call fcn.00444e04
inc eax
lea esi, [esp + 0x44]
call fcn.004225d0
mov edx, dword [esp + 0x48]
lea ecx, [edx + ebp*4]
push edi
call fcn.00401f70
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ef32
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.sogouexplorer.exe
lea ecx, [esp + 0x28]
call fcn.00401bc0
mov edi, eax
mov byte [esp + 0x74], 0xf
mov eax, dword [esp + 0x4c]
mov ebp, eax
test eax, eax
jge 0x41ef56
call fcn.00444e04
inc eax
lea esi, [esp + 0x44]
call fcn.004225d0
mov ecx, dword [esp + 0x48]
lea ecx, [ecx + ebp*4]
push edi
call fcn.00401f70
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41ef91
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.qqbrowser.exe
lea ecx, [esp + 0x28]
call fcn.00401bc0
mov edi, eax
mov byte [esp + 0x74], 0x10
mov eax, dword [esp + 0x4c]
mov ebp, eax
test eax, eax
jge 0x41efb5
call fcn.00444e04
inc eax
lea esi, [esp + 0x44]
call fcn.004225d0
mov ecx, dword [esp + 0x48]
lea ecx, [ecx + ebp*4]
push edi
call fcn.00401f70
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41eff0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.2345explorer.exe
lea ecx, [esp + 0x28]
call fcn.00401bc0
mov edi, eax
mov byte [esp + 0x74], 0x11
mov eax, dword [esp + 0x4c]
mov ebp, eax
test eax, eax
jge 0x41f014
call fcn.00444e04
inc eax
lea esi, [esp + 0x44]
call fcn.004225d0
mov ecx, dword [esp + 0x48]
lea ecx, [ecx + ebp*4]
push edi
call fcn.00401f70
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f04f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.liebao.exe
lea ecx, [esp + 0x28]
call fcn.00401bc0
mov edi, eax
mov byte [esp + 0x74], 0x12
mov eax, dword [esp + 0x4c]
mov ebp, eax
test eax, eax
jge 0x41f073
call fcn.00444e04
inc eax
lea esi, [esp + 0x44]
call fcn.004225d0
mov ecx, dword [esp + 0x48]
lea ecx, [ecx + ebp*4]
push edi
call fcn.00401f70
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f0ae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.maxthon.exe
lea ecx, [esp + 0x28]
call fcn.00401bc0
mov edi, eax
mov byte [esp + 0x74], 0x13
mov eax, dword [esp + 0x4c]
mov ebp, eax
test eax, eax
jge 0x41f0d2
call fcn.00444e04
inc eax
lea esi, [esp + 0x44]
call fcn.004225d0
mov ecx, dword [esp + 0x48]
lea ecx, [ecx + ebp*4]
push edi
call fcn.00401f70
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f10d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.firefox.exe
lea ecx, [esp + 0x28]
call fcn.00401bc0
mov edi, eax
mov byte [esp + 0x74], 0x14
mov eax, dword [esp + 0x4c]
mov ebp, eax
test eax, eax
jge 0x41f131
call fcn.00444e04
inc eax
lea esi, [esp + 0x44]
call fcn.004225d0
mov ecx, dword [esp + 0x48]
lea ecx, [ecx + ebp*4]
push edi
call fcn.00401f70
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f16c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.iexplore.exe
lea ecx, [esp + 0x28]
call fcn.00401bc0
mov edi, eax
mov byte [esp + 0x74], 0x15
mov eax, dword [esp + 0x4c]
mov ebp, eax
test eax, eax
jge 0x41f190
call fcn.00444e04
inc eax
lea esi, [esp + 0x44]
call fcn.004225d0
mov ecx, dword [esp + 0x48]
lea ecx, [ecx + ebp*4]
push edi
call fcn.00401f70
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f1cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.baidubrowser.exe
lea ecx, [esp + 0x28]
call fcn.00401bc0
mov edi, eax
mov byte [esp + 0x74], 0x16
mov eax, dword [esp + 0x4c]
mov ebp, eax
test eax, eax
jge 0x41f1ef
call fcn.00444e04
inc eax
lea esi, [esp + 0x44]
call fcn.004225d0
mov ecx, dword [esp + 0x48]
lea ecx, [ecx + ebp*4]
push edi
call fcn.00401f70
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f22a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.360se.exe
lea ecx, [esp + 0x28]
call fcn.00401bc0
mov edi, eax
mov byte [esp + 0x74], 0x17
mov eax, dword [esp + 0x4c]
mov ebp, eax
test eax, eax
jge 0x41f24e
call fcn.00444e04
inc eax
lea esi, [esp + 0x44]
call fcn.004225d0
mov ecx, dword [esp + 0x48]
lea ecx, [ecx + ebp*4]
push edi
call fcn.00401f70
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f289
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.theworld.exe
lea ecx, [esp + 0x28]
call fcn.00401bc0
mov edi, eax
mov byte [esp + 0x74], 0x18
mov eax, dword [esp + 0x4c]
mov ebp, eax
test eax, eax
jge 0x41f2ad
call fcn.00444e04
inc eax
lea esi, [esp + 0x44]
call fcn.004225d0
mov ecx, dword [esp + 0x48]
lea ecx, [ecx + ebp*4]
push edi
call fcn.00401f70
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f2e8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.launcher.exe
lea ecx, [esp + 0x28]
call fcn.00401bc0
mov edi, eax
mov byte [esp + 0x74], 0x19
mov eax, dword [esp + 0x4c]
mov ebp, eax
test eax, eax
jge 0x41f30c
call fcn.00444e04
inc eax
lea esi, [esp + 0x44]
call fcn.004225d0
mov ecx, dword [esp + 0x48]
lea ecx, [ecx + ebp*4]
push edi
call fcn.00401f70
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f347
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.ruiying.exe
lea ecx, [esp + 0x28]
call fcn.00401bc0
mov edi, eax
mov byte [esp + 0x74], 0x1a
mov eax, dword [esp + 0x4c]
mov ebp, eax
test eax, eax
jge 0x41f36b
call fcn.00444e04
inc eax
lea esi, [esp + 0x44]
call fcn.004225d0
mov ecx, dword [esp + 0x48]
lea ecx, [ecx + ebp*4]
push edi
call fcn.00401f70
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f3a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.taobrowser.exe
lea ecx, [esp + 0x28]
call fcn.00401bc0
mov edi, eax
mov byte [esp + 0x74], 0x1b
mov eax, dword [esp + 0x4c]
mov ebp, eax
test eax, eax
jge 0x41f3ca
call fcn.00444e04
inc eax
lea esi, [esp + 0x44]
call fcn.004225d0
mov ecx, dword [esp + 0x48]
lea ecx, [ecx + ebp*4]
push edi
call fcn.00401f70
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f405
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.safari.exe
lea ecx, [esp + 0x28]
call fcn.00401bc0
mov edi, eax
mov byte [esp + 0x74], 0x1c
mov eax, dword [esp + 0x4c]
mov ebp, eax
test eax, eax
jge 0x41f429
call fcn.00444e04
inc eax
lea esi, [esp + 0x44]
call fcn.004225d0
mov ecx, dword [esp + 0x48]
lea ecx, [ecx + ebp*4]
push edi
call fcn.00401f70
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f464
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.ttraveler.exe
lea ecx, [esp + 0x28]
call fcn.00401bc0
mov edi, eax
mov byte [esp + 0x74], 0x1d
mov eax, dword [esp + 0x4c]
mov ebp, eax
test eax, eax
jge 0x41f488
call fcn.00444e04
inc eax
lea esi, [esp + 0x44]
call fcn.004225d0
mov ecx, dword [esp + 0x48]
lea ecx, [ecx + ebp*4]
push edi
call fcn.00401f70
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f4c3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.xskywalker.exe
lea ecx, [esp + 0x28]
call fcn.00401bc0
mov edi, eax
mov byte [esp + 0x74], 0x1e
mov eax, dword [esp + 0x4c]
mov ebp, eax
test eax, eax
jge 0x41f4e7
call fcn.00444e04
inc eax
lea esi, [esp + 0x44]
call fcn.004225d0
mov ecx, dword [esp + 0x48]
lea ecx, [ecx + ebp*4]
push edi
call fcn.00401f70
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f522
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.115chrome.exe
lea ecx, [esp + 0x34]
call fcn.00401bc0
mov edi, eax
mov byte [esp + 0x74], 0x1f
mov eax, dword [esp + 0x4c]
mov ebp, eax
test eax, eax
jge 0x41f546
call fcn.00444e04
inc eax
lea esi, [esp + 0x44]
call fcn.004225d0
mov ecx, dword [esp + 0x48]
lea ecx, [ecx + ebp*4]
push edi
call fcn.00401f70
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f581
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
push 0x5c
push ecx
call fcn.004624a7
xor ebp, ebp
add esp, 8
cmp eax, ebp
jne 0x41f59b
or eax, 0xffffffff
jmp 0x41f5a1
sub eax, dword [esp + 0x1c]
sar eax, 1
inc eax
push eax
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x24]
call fcn.00404ee0
lea edi, [esp + 0x24]
mov byte [esp + 0x74], 0x20
call fcn.00404e80
mov eax, dword [esp + 0x4c]
cmp eax, ebp
mov edi, eax
jge 0x41f5ce
call fcn.00444e04
inc eax
lea esi, [esp + 0x44]
call fcn.004225d0
mov eax, dword [esp + 0x48]
lea edx, [esp + 0x24]
lea ecx, [eax + edi*4]
push edx
call fcn.00401f70
mov dword [esp + 0x58], vtable.CArray_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____.0
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x68], ebp
mov dword [esp + 0x64], ebp
mov dword [esp + 0x60], ebp
lea eax, [esp + 0x58]
push eax
mov byte [esp + 0x78], 0x21
call fcn.0041e480
mov eax, dword [esp + 0x64]
add esp, 4
cmp eax, ebp
mov edi, eax
jge 0x41f622
call fcn.00444e04
inc eax
lea esi, [esp + 0x58]
call fcn.004225d0
mov ecx, dword [esp + 0x5c]
lea edx, [esp + 0x7c]
lea ecx, [ecx + edi*4]
push edx
call fcn.00401f70
mov eax, dword [esp + 0x8c]
mov ebp, dword [esp + 0x18]
test al, 1
je 0x41f6a3
mov esi, eax
mov eax, dword [esp + 0x7c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x38], esp
mov edi, esp
push eax
and esi, 4
call fcn.00402360
add eax, 0x10
mov dword [edi], eax
lea eax, [esp + 0x60]
add esp, 4
push eax
mov ecx, esi
lea ebx, [esp + 0x4c]
call fcn.00420740
add esp, 8
test eax, eax
jle 0x41f69a
test byte [esp + 0x8c], 2
mov dword [esp + 0x2c], 0
jne 0x41f771
mov eax, dword [esp + 0x8c]
mov bl, 0xd
mov ecx, eax
and cl, 0x20
movsx edx, cl
neg edx
sbb edx, edx
mov ecx, eax
push 1
and al, 8
and edx, 3
shr ecx, 4
push edx
and ecx, 1
movsx esi, al
push ecx
push ecx
neg esi
lea eax, [ebp - 0x10]
sbb esi, esi
mov dword [esp + 0x44], esp
mov edi, esp
push eax
and esi, 3
call fcn.00402360
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x88], 0x22
mov eax, dword [esp + 0x90]
add eax, 0xfffffff0
mov dword [esp + 0x4c], esp
mov edi, esp
push eax
call fcn.00402360
add eax, 0x10
add esp, 4
mov dword [edi], eax
mov byte [esp + 0x88], 0x23
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x9c]
push edx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x58], esp
mov edi, esp
push eax
call fcn.00402360
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x94], 0x24
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
mov dword [esp + 0x60], esp
mov edi, esp
push eax
call fcn.00402360
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov ecx, esi
mov byte [esp + 0x94], 0x21
call fcn.00421190
add esp, 0x20
test eax, eax
je 0x41f773
mov dword [esp + 0x2c], 0
jmp 0x41f773
mov bl, 0xd
lea edi, [esp + 0x58]
call fcn.00422510
mov byte [esp + 0x74], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f7a0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea edi, [esp + 0x44]
call fcn.00422510
mov byte [esp + 0x74], 0xb
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f7ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x74], 7
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f7f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x74], 4
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f818
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov byte [esp + 0x74], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f839
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x74], 2
mov eax, dword [esp + 0x7c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f85e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x74], 1
mov eax, dword [esp + 0x80]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f886
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x74], 0
mov eax, dword [esp + 0x84]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f8ae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x74], 0xffffffff
mov eax, dword [esp + 0x88]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f8d9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret