Function at 0x485930
Capabilities:
Check os version
Create directory
Create process on windows
Get common file path
Get session user name
Get startup folder
Persist via app paths registry key
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x50a12d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1874
call fcn.004e86d0
mov eax, dword [0x5512c0]
xor eax, esp
mov dword [esp + 0x1870], eax
push ebx
push esi
push edi
mov eax, dword [0x5512c0]
xor eax, esp
push eax
lea eax, [esp + 0x1888]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x1c], esi
add esi, 0xb4
lea eax, [esp + 0x24]
push esi
push eax
mov ebx, 0x51efc8
mov dword [esp + 0x30], esi
call fcn.0045c900
lea ecx, [esp + 0x5c]
push esi
push ecx
mov ebx, 0x51ff38
mov dword [esp + 0x18a0], 0
call fcn.0045c900
lea edx, [esp + 0x4c]
push esi
push edx
mov ebx, str.uninst.exe
mov byte [esp + 0x18a8], 1
call fcn.0045c900
lea eax, [esp + 0x64]
push esi
push eax
mov ebx, 0x51ff8c
mov byte [esp + 0x18b0], 2
call fcn.0045c900
lea ecx, [esp + 0x58]
push esi
push ecx
mov ebx, 0x51ff5c
mov byte [esp + 0x18b8], 3
call fcn.0045c900
mov byte [esp + 0x18b8], 4
mov eax, dword [esi]
push 0x5c
push eax
call fcn.004e6c2f
add esp, 0x30
test eax, eax
jne 0x485a16
or eax, 0xffffffff
jmp 0x485a1a
sub eax, dword [esi]
sar eax, 1
lea ecx, [esp + 0x34]
mov edx, esi
call fcn.0045d440
push 1
push 0x19
lea edx, [esp + 0x474]
push edx
push 0
mov byte [esp + 0x18a0], 5
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x30]
push eax
mov ecx, 0x5245b0
call fcn.004594a0
lea ecx, [esp + 0x58]
push ecx
mov ecx, 0x5245c4
mov byte [esp + 0x1894], 6
call fcn.004594a0
lea edx, [esp + 0x40]
push edx
mov ecx, 0x5245d8
mov byte [esp + 0x1894], 7
call fcn.004594a0
lea eax, [esp + 0x50]
push eax
mov ecx, 0x5245f0
mov byte [esp + 0x1894], 8
call fcn.004594a0
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x524604
mov byte [esp + 0x1894], 9
call fcn.004594a0
push 0
mov byte [esp + 0x1894], 0xa
call dword [sym.imp.ole32.dll_CoInitialize]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
push 0
push edx
lea eax, [esp + 0x474]
push eax
xor edx, edx
mov ebx, 0x524618
call fcn.00492340
test eax, eax
jne 0x485afe
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x1389
call fcn.00472e80
mov ecx, dword [esp + 0x1c]
cmp byte [ecx + 0xc8], 0
jne 0x485bb1
mov edx, dword [0x559d8c]
cmp byte [edx + 0xb9], 0
je 0x485bb1
lea eax, [esp + 0x18]
push esi
push eax
mov ebx, 0x51ff5c
call fcn.0045c900
add esp, 8
mov byte [esp + 0x1890], 0xc
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x18]
push 0
push ecx
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x474]
push edx
mov edx, 0x524624
mov ebx, 0x524638
call fcn.00492340
test eax, eax
jne 0x485b84
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x138a
call fcn.00472e80
jmp 0x485b89
call fcn.0048b0c0
mov byte [esp + 0x1890], 0xa
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485bb1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 1
push 0x1a
lea ecx, [esp + 0x67c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x485beb
lea edi, [esp + 0x674]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x485bd3
mov ecx, 0x15
mov esi, 0x526988
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
push str.Baofeng.StormPlayer.WIN7APPID
push esi
lea edx, [esp + 0x67c]
push edx
xor edx, edx
xor ebx, ebx
call fcn.00492340
test eax, eax
jne 0x485c2d
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x138b
call fcn.00472e80
mov eax, dword [esp + 0x1c]
cmp byte [eax + 0xc8], bl
jne 0x485c82
mov ecx, dword [0x559d8c]
cmp byte [ecx + 0xb9], bl
je 0x485c82
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x38]
push 0
push esi
lea edx, [esp + 0x67c]
push edx
xor edx, edx
xor ebx, ebx
call fcn.00492340
test eax, eax
jne 0x485c82
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x139c
call fcn.00472e80
push 0x104
lea eax, [esp + 0x470]
push 0
push eax
call fcn.004e8ae0
add esp, 0xc
push 1
push 0x17
lea ecx, [esp + 0x474]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x470]
call fcn.004594a0
push 5
push 0x524680
lea ebx, [esp + 0x28]
mov byte [esp + 0x1898], 0xd
call fcn.0045b2d0
mov eax, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push eax
call edi
push 6
push 0x52468c
call fcn.0045b2d0
mov ecx, dword [esp + 0x20]
push 0
push ecx
call edi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x485d21
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
push str.Baofeng.StormPlayer.WIN7APPID
push esi
push eax
xor edx, edx
mov ebx, 0x524618
call fcn.00492340
test eax, eax
jne 0x485d3c
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x138c
call fcn.00472e80
mov eax, dword [esp + 0x20]
test eax, eax
je 0x485d60
mov ecx, dword [esp + 0x50]
mov edi, dword [esp + 0x4c]
push 0
push esi
push eax
xor edx, edx
mov ebx, 0x52469c
call fcn.00492340
test eax, eax
jne 0x485d7b
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x139a
call fcn.00472e80
mov eax, dword [esp + 0x20]
test eax, eax
je 0x485d9f
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
push 0
push esi
push eax
xor edx, edx
mov ebx, 0x5246a8
call fcn.00492340
test eax, eax
jne 0x485dba
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x138e
call fcn.00472e80
mov eax, dword [esp + 0x20]
test eax, eax
je 0x485dde
mov ecx, dword [esp + 0x58]
mov edi, dword [esp + 0x54]
push 0
push esi
push eax
xor edx, edx
mov ebx, 0x5246bc
call fcn.00492340
test eax, eax
jne 0x485df9
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x138d
call fcn.00472e80
mov eax, dword [esp + 0x20]
test eax, eax
je 0x485e1d
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x38]
push 0
push esi
push eax
xor edx, edx
mov ebx, 0x524638
call fcn.00492340
test eax, eax
jne 0x485e38
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x139b
call fcn.00472e80
call dword [sym.imp.ole32.dll_CoUninitialize]
lea edx, [esp + 0x5c]
push edx
mov dword [esp + 0x60], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x60], 6
jne 0x486048
cmp dword [esp + 0x64], 1
jne 0x486048
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x678]
call fcn.004594a0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
mov ebx, 0x51c518
mov byte [esp + 0x1898], 0xe
call fcn.0045c900
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x20]
push edx
mov ebx, eax
mov byte [esp + 0x18a0], 0xf
call fcn.0045c850
add esp, 0x10
lea edi, [esp + 0x18]
mov byte [esp + 0x1890], 0x10
call fcn.0045c9e0
mov byte [esp + 0x1890], 0xf
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485ee9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 0xe
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485f11
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0
push 0
push ecx
push str.taskbarpin
push 0
call esi
mov byte [esp + 0x1890], 0xd
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x485f53
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
cmp byte [ecx + 0xc8], 0
jne 0x486048
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
call fcn.0045cad0
add eax, 0x10
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
mov ebx, 0x51c518
mov byte [esp + 0x1898], 0x14
call fcn.0045c900
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x1c]
push edx
mov ebx, eax
mov byte [esp + 0x18a0], 0x15
call fcn.0045c850
add esp, 0x10
lea edi, [esp + 0x18]
mov byte [esp + 0x1890], 0x16
call fcn.0045c9e0
mov byte [esp + 0x1890], 0x15
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485fe8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 0x14
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486010
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x18]
push 0
push 0
push 0
push edi
push str.taskbarpin
push 0
call esi
lea eax, [edi - 0x10]
mov byte [esp + 0x1890], 0xd
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486048
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x24]
push ecx
push 0x5191b4
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsStormPlayer.exe
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.0045cc50
mov esi, dword [esp + 0x24]
add esp, 8
test al, al
jne 0x486083
lea edi, [esi + 0xb8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x138f
call fcn.00472e80
push 0x524618
push str.DisplayName
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallStormPlayer
call fcn.0045cc50
add esp, 8
test al, al
jne 0x4860b5
lea edi, [esi + 0xb8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1390
call fcn.00472e80
mov edx, dword [esp + 0x3c]
push edx
push str.UninstallString
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallStormPlayer
call fcn.0045cc50
add esp, 8
test al, al
jne 0x4860e7
lea edi, [esi + 0xb8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1391
call fcn.00472e80
mov eax, dword [esp + 0x24]
push eax
push str.DisplayIcon
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallStormPlayer
call fcn.0045cc50
add esp, 8
test al, al
jne 0x486119
lea edi, [esi + 0xb8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1392
call fcn.00472e80
push str.5.36.0428.2211
push str.DisplayVersion
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallStormPlayer
call fcn.0045cc50
add esp, 8
test al, al
jne 0x48614b
lea edi, [esi + 0xb8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1393
call fcn.00472e80
push str.http:__www.Baofeng.com
push str.URLInfoAbout
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallStormPlayer
call fcn.0045cc50
add esp, 8
test al, al
jne 0x48617d
lea edi, [esi + 0xb8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1394
call fcn.00472e80
push 0x5247cc
push str.Publisher
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallStormPlayer
call fcn.0045cc50
add esp, 8
test al, al
jne 0x4861af
lea edi, [esi + 0xb8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1395
call fcn.00472e80
push 4
lea ecx, [esp + 0x1c]
push ecx
push 4
push str.InstallActiveFlag
push str.SoftwareBaofengStormPlayerUserConfig
push SysReAllocString
mov dword [esp + 0x30], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ebx, eax
cmp ebx, 5
jne 0x4862af
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x60]
push eax
mov dword [esp + 0x18], 0x202
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push str.SoftwareBaofengStormPlayerUserConfig
push str.CURRENT_USER
push str._s_s
lea ecx, [esp + 0x1088]
push 0x800
push ecx
call fcn.004e6c5d
add esp, 0x14
push 0xf003f
lea edx, [esp + 0x60]
push edx
push 2
lea edi, [esp + 0x1088]
call fcn.0045ceb0
test eax, eax
je 0x4862af
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push str.InstallActiveFlag
push str.SoftwareBaofengStormPlayerUserConfig
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x268]
push edx
mov ebx, eax
mov dword [esp + 0x1c], 0x202
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push str.SoftwareBaofengStormPlayerUserConfig
push str.CURRENT_USER
push str._s_s
lea eax, [esp + 0x888]
push 0x800
push eax
call fcn.004e6c5d
add esp, 0x14
push 2
lea ecx, [esp + 0x268]
push ecx
push 3
lea edi, [esp + 0x888]
call fcn.0045ceb0
test ebx, ebx
sete al
test al, al
jne 0x4862cf
lea edi, [esi + 0xb8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1396
call fcn.00472e80
cmp dword [esi + 0x14], 0
je 0x486308
push 1
mov ebx, str.InstallType
mov esi, str.SoftwareBaofengStormPlayerUserConfig
call fcn.0045cbe0
add esp, 4
test al, al
jne 0x486308
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1398
call fcn.00472e80
push str.URL:_Storm_Download_Protocol
push 0x5191b4
mov edi, str.StormDL
mov ebx, SysReAllocString
call fcn.0045cc50
push 0x5191b4
push str.URL_Protocol
call fcn.0045cc50
mov edx, dword [esp + 0x38]
push edx
lea eax, [esp + 0x5c]
push eax
mov ebx, 0x51ffe0
call fcn.0045c900
lea ecx, [esp + 0x28]
push 0x51c540
push ecx
lea ecx, [esp + 0x68]
mov byte [esp + 0x18b0], 0x17
call fcn.0048cc50
push eax
lea edx, [esp + 0x4c]
push edx
mov ebx, 0x51c540
mov byte [esp + 0x18b8], 0x18
call fcn.0045c900
push eax
lea eax, [esp + 0x70]
push eax
mov ebx, str.__TypeDZone__DZUrl__1___FromWeb
mov byte [esp + 0x18c0], 0x19
call fcn.0045c900
add esp, 0x30
mov byte [esp + 0x1890], 0x1b
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4863ba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 0x1c
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4863e2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x44]
push ecx
push 0x5191b4
mov edi, str.StormDL_shellopencommand
mov ebx, SysReAllocString
call fcn.0045cc50
mov edx, dword [esp + 0x24]
add esp, 8
cmp dword [edx + 0x14], 0
jne 0x48643b
push 1
mov ebx, str.AutoRun
mov esi, str.SoftwareBaofengStormPlayerConfigRepairAutoRun
call fcn.0045cbe0
add esp, 4
test al, al
jne 0x48643b
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1399
call fcn.00472e80
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push str.FirstHideBox
push str.SoftwareBaofengStormPlayerUserConfig
push SysReAllocString
mov dword [esp + 0x30], 0
call ebx
cmp eax, 5
jne 0x486539
mov esi, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x268]
push edx
mov dword [esp + 0x30], 0x202
call esi
push str.SoftwareBaofengStormPlayerUserConfig
push str.CURRENT_USER
push str._s_s
lea eax, [esp + 0x888]
push 0x800
push eax
call fcn.004e6c5d
add esp, 0x14
push 0xf003f
lea ecx, [esp + 0x268]
push ecx
push 2
lea edi, [esp + 0x888]
call fcn.0045ceb0
test eax, eax
je 0x486539
push 4
lea edx, [esp + 0x1c]
push edx
push 4
push str.FirstHideBox
push str.SoftwareBaofengStormPlayerUserConfig
push SysReAllocString
call ebx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x268]
push ecx
mov dword [esp + 0x18], 0x202
call esi
push str.SoftwareBaofengStormPlayerUserConfig
push str.CURRENT_USER
push str._s_s
lea edx, [esp + 0x888]
push 0x800
push edx
call fcn.004e6c5d
add esp, 0x14
push 2
lea eax, [esp + 0x268]
push eax
push 3
lea edi, [esp + 0x888]
call fcn.0045ceb0
mov byte [esp + 0x1890], 0x17
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486561
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 0xd
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486589
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 0xa
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4865b1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 9
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4865d9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 8
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486601
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 7
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486629
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 6
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486651
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 5
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486679
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 4
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4866a1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 3
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4866c9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 2
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4866f1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 1
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486719
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 0
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486741
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1890], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48676c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x1888]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1870]
xor ecx, esp
call fcn.004e3e00
mov esp, ebp
pop ebp
ret