Function at 0x44e480
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bfa7f
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
push ebx
push esi
push edi
mov eax, dword [0x4ea688]
xor eax, esp
push eax
lea eax, [esp + 0xd0]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
xor esi, esi
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 4
call fcn.00463aa0
push eax
call fcn.00463c40
test eax, eax
jne 0x44e4f6
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [edi + 0x4f8]
push eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xcc], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov dword [esp + 0xdc], esi
call fcn.0044d5f0
mov ebx, 1
cmp dword [0x4f26a8], esi
jne 0x44e901
mov edx, dword [0x4f26d0]
mov byte [esp + 0x13], 0
test edx, edx
jne 0x44e567
mov eax, dword [0x4f26cc]
test eax, eax
jne 0x44e567
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x44e567
mov eax, dword [esp + 0x18]
mov dword [0x4f26cc], eax
mov dword [edi + 0x4f4], ebx
mov dword [esp + 0x14], 0
call fcn.00401020
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test al, al
jne 0x44e5d9
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x3c]
push eax
push str.i18n
push str.SYSTEMCurrentControlSet_services360SelfProtection
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x44e5b1
push 4
lea ecx, [esp + 0x18]
push ecx
jmp 0x44e5be
cmp dword [esp + 0x14], ebx
je 0x44e5d9
push 4
lea edx, [esp + 0x18]
push edx
push 4
push str.i18n
push str.SYSTEMCurrentControlSet_services360SelfProtection
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call fcn.00410430
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x3c]
push edx
push str.AppMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], ebx
call esi
test eax, eax
je 0x44e617
push ebx
push edi
mov dword [esp + 0x1c], ebx
call fcn.004505f0
mov byte [esp + 0x13], bl
jmp 0x44e632
cmp dword [esp + 0x14], ebx
jne 0x44e62a
push ebx
push edi
call fcn.004505f0
mov byte [esp + 0x13], bl
jmp 0x44e632
push 0
push edi
call fcn.004505f0
xor eax, eax
mov ecx, 8
mov dword [esp + 0xb8], eax
mov dword [esp + 0xc0], ecx
mov dword [esp + 0xb8], ecx
lea ecx, [esp + 0xb4]
push ecx
push 0
mov dword [esp + 0xc4], eax
lea eax, [esp + 0xc8]
push 0x4a
push ecx
mov dword [esp + 0xd4], 0xff
mov dword [esp + 0xc4], 0x41505343
mov dword [esp + 0xcc], eax
call fcn.00435460
add esp, 4
push eax
xor edx, edx
mov ecx, str.Q360SafeMonClass
call fcn.00437bb0
cmp dword [esp + 0x14], ebx
je 0x44e6a7
mov dword [0x4f2230], ebx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
push ecx
push str.DrvFWAccess2
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x44e6dc
push ebx
push edi
mov dword [esp + 0x1c], ebx
call fcn.004502d0
mov byte [esp + 0x13], bl
jmp 0x44e6f7
cmp dword [esp + 0x14], ebx
jne 0x44e6ef
push ebx
push edi
call fcn.004502d0
mov byte [esp + 0x13], bl
jmp 0x44e6f7
push 0
push edi
call fcn.004502d0
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
push ecx
push str.NetMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x44e75a
lea edx, [esp + 0xa8]
push edx
push str.mode
mov ecx, str.SOFTWARE360TotalSecurityActiveProtection
mov dword [esp + 0xb0], 2
call fcn.004019c0
add esp, 8
test al, al
jne 0x44e74a
mov dword [esp + 0x14], ebx
jmp 0x44e760
xor eax, eax
cmp dword [esp + 0xa8], ebx
setne al
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
jne 0x44e778
mov ecx, edi
call fcn.00453510
test al, al
jne 0x44e778
push ebx
push edi
call fcn.00451500
mov byte [esp + 0x13], bl
jmp 0x44e780
push 0
push edi
call fcn.00451500
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x3c]
push eax
push str.FileMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x44e7b5
push ebx
push edi
mov dword [esp + 0x1c], ebx
call fcn.00451950
mov byte [esp + 0x13], bl
jmp 0x44e7d0
cmp dword [esp + 0x14], ebx
jne 0x44e7c8
push ebx
push edi
call fcn.00451950
mov byte [esp + 0x13], bl
jmp 0x44e7d0
push 0
push edi
call fcn.00451950
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x3c]
push eax
push str.MonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x44e805
push ebx
push edi
mov dword [esp + 0x1c], ebx
call fcn.00451e60
mov byte [esp + 0x13], bl
jmp 0x44e820
cmp dword [esp + 0x14], ebx
jne 0x44e818
push ebx
push edi
call fcn.00451e60
mov byte [esp + 0x13], bl
jmp 0x44e820
push 0
push edi
call fcn.00451e60
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x3c]
push eax
push str.AVEnable
push str.SOFTWARE360Safe_filemon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x44e84a
mov dword [esp + 0x14], ebx
jmp 0x44e850
cmp dword [esp + 0x14], ebx
jne 0x44e855
call fcn.00433290
lea ecx, [esp + 0xa4]
push ecx
xor eax, eax
push str.AVWriteProtectEnable
mov ecx, str.SOFTWARE360Safe_filemon
mov dword [esp + 0xac], eax
mov dword [esp + 0xa8], eax
call fcn.004019c0
lea edx, [esp + 0xa8]
push edx
push str.AVReadProtectEnable
mov ecx, str.SOFTWARE360Safe_filemon
call fcn.004019c0
add esp, 0x10
cmp dword [esp + 0xa0], 0
jne 0x44e8aa
cmp dword [esp + 0xa4], 0
je 0x44e8ae
mov byte [esp + 0x13], bl
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x3c]
push edx
push str.upref
push str.SOFTWARE360Safe_safemon_safecamera
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x44e8d8
mov dword [esp + 0x14], ebx
jmp 0x44e8de
cmp dword [esp + 0x14], ebx
jne 0x44e8e5
push ebx
push edi
call fcn.00452370
movzx ecx, byte [esp + 0x13]
cmp byte [0x4f225c], bl
je 0x44e901
push 0xbd3
xor edx, edx
call fcn.00442a40
add esp, 4
mov eax, dword [0x4f223c]
add dword [0x4f26a8], ebx
mov dword [esp + 0xb0], 0
test eax, eax
je 0x44e941
cmp dword [eax + 0xc], 0
je 0x44e941
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0xb0]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
push 0x40a
push eax
mov eax, dword [ecx + 0x20]
call eax
cmp dword [edi + 0xbc], 0
mov dword [esp + 0x3c], 0x80004005
jne 0x44edd3
lea esi, [edi + 0xc8]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 0
mov byte [esp + 0xd8], 1
call fcn.0042aaf0
cmp dword [ebp + 0xc], 0xce
jne 0x44e9a1
mov dword [0x4f2230], ebx
test eax, eax
jne 0x44ea9d
mov byte [esp + 0xd8], al
lea eax, [esp + 0x1c]
call fcn.00445500
jmp 0x44edd3
call fcn.00445240
lea ecx, [esp + 0x88]
push ecx
mov dword [esp + 0x24], eax
call fcn.004439c0
lea edx, [esp + 0x88]
push edx
push 0x77a
add edi, 0x74
push edi
mov byte [esp + 0xe4], 3
call fcn.00428440
mov edi, dword [esp + 0x94]
mov eax, dword [esp + 0x98]
cmp edi, eax
jbe 0x44e9f3
call fcn.00493a81
mov eax, dword [esp + 0x98]
mov ebx, dword [esp + 0x88]
lea ebx, [ebx]
mov esi, eax
cmp dword [esp + 0x94], eax
jbe 0x44ea10
call fcn.00493a81
test ebx, ebx
je 0x44ea1d
cmp ebx, dword [esp + 0x88]
je 0x44ea22
call fcn.00493a81
cmp edi, esi
je 0x44ed64
mov eax, dword [ebp + 8]
cmp dword [eax + 0xbc], 0
jne 0x44ecc9
test ebx, ebx
jne 0x44ecbb
call fcn.00493a81
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x44ea53
call fcn.00493a81
mov ecx, dword [edi]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
lea eax, [esp + 0x3c]
push eax
mov eax, dword [ebp + 0xc]
xor esi, esi
push esi
push eax
push 0x77a
call edx
cmp eax, esi
jne 0x44ece1
cmp ebx, esi
jne 0x44ecc2
call fcn.00493a81
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x44ea8e
call fcn.00493a81
mov eax, dword [esp + 0x98]
add edi, 4
jmp 0x44ea00
call fcn.0042ace0
lea ecx, [esp + 0x58]
push ecx
call fcn.004439c0
lea edx, [esp + 0x58]
push edx
push 0x77a
add edi, 0x74
push edi
mov byte [esp + 0xe4], 2
call fcn.00428440
mov dword [esp + 0x18], 0x4f212c
nop
mov eax, dword [esp + 0x18]
cmp dword [eax], 0
je 0x44ebc5
mov esi, dword [esp + 0x1c]
xor edi, edi
cmp dword [esp + 0x20], edi
je 0x44eb0d
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x44eb09
call eax
push esi
call fcn.00445450
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x44eb09
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], edi
mov dword [esp + 0x20], edi
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
call fcn.00445240
mov edi, dword [esp + 0x64]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x68]
cmp edi, eax
jbe 0x44eb31
call fcn.00493a81
mov eax, dword [esp + 0x68]
mov ebx, dword [esp + 0x58]
mov esi, eax
cmp dword [esp + 0x64], eax
jbe 0x44eb42
call fcn.00493a81
test ebx, ebx
je 0x44eb4c
cmp ebx, dword [esp + 0x58]
je 0x44eb51
call fcn.00493a81
cmp edi, esi
je 0x44ebc5
mov edx, dword [ebp + 8]
cmp dword [edx + 0xbc], 0
jne 0x44ec0c
test ebx, ebx
jne 0x44ebbd
call fcn.00493a81
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x44eb7a
call fcn.00493a81
mov ecx, dword [edi]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [esp + 0x3c]
push edx
push 0
push 0xce
push 0x77a
call eax
test eax, eax
jne 0x44ec3d
test ebx, ebx
jne 0x44ebc1
call fcn.00493a81
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x44ebb1
call fcn.00493a81
mov eax, dword [esp + 0x68]
add edi, 4
jmp 0x44eb35
mov eax, dword [ebx]
jmp 0x44eb70
mov eax, dword [ebx]
jmp 0x44eba7
mov eax, dword [esp + 0x18]
add eax, 4
cmp eax, 0x4f2168
mov dword [esp + 0x18], eax
jl 0x44ead0
mov eax, dword [esp + 0x64]
test eax, eax
je 0x44ebec
push eax
call fcn.00491da6
add esp, 4
mov eax, dword [esp + 0x58]
xor edi, edi
push eax
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x70], edi
call fcn.00491da6
add esp, 4
jmp 0x44eda1
mov eax, dword [esp + 0x64]
test eax, eax
je 0x44ec1d
push eax
call fcn.00491da6
add esp, 4
mov ecx, dword [esp + 0x58]
xor edi, edi
push ecx
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x70], edi
call fcn.00491da6
add esp, 4
jmp 0x44eda1
mov eax, dword [esp + 0x64]
test eax, eax
je 0x44ec4e
push eax
call fcn.00491da6
add esp, 4
mov edx, dword [esp + 0x58]
push edx
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
call fcn.00491da6
add esp, 4
mov byte [esp + 0xd8], 0
cmp dword [esp + 0x20], 0
je 0x44edd3
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x44edd3
call eax
push esi
call fcn.00445450
mov eax, dword [esi + 0x20]
test eax, eax
je 0x44edd3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], 0
jmp 0x44edd3
mov eax, dword [ebx]
jmp 0x44ea49
mov eax, dword [ebx]
jmp 0x44ea84
mov eax, dword [esp + 0x94]
test eax, eax
je 0x44ecdd
push eax
call fcn.00491da6
add esp, 4
xor esi, esi
jmp 0x44ecf5
mov eax, dword [esp + 0x94]
cmp eax, esi
je 0x44ecf5
push eax
call fcn.00491da6
add esp, 4
mov eax, dword [esp + 0x88]
push eax
mov dword [esp + 0x98], esi
mov dword [esp + 0x9c], esi
mov dword [esp + 0xa0], esi
call fcn.00491da6
add esp, 4
mov byte [esp + 0xd8], 0
cmp dword [esp + 0x20], esi
je 0x44edd3
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x44edd3
call eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.00445450
mov eax, dword [esi + 0x20]
test eax, eax
je 0x44edd3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, esi
mov dword [edx + 0x20], 0
jmp 0x44edd3
mov eax, dword [esp + 0x94]
test eax, eax
je 0x44ed78
push eax
call fcn.00491da6
add esp, 4
xor eax, eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x88]
push eax
call fcn.00491da6
add esp, 4
xor edi, edi
mov byte [esp + 0xd8], 0
cmp dword [esp + 0x20], edi
je 0x44edd3
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x44edd3
call eax
push esi
call fcn.00445450
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x44edd3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], edi
cmp dword [0x4f2230], 0
je 0x44f242
mov esi, dword [ebp + 8]
cmp dword [esi + 0xbc], 0
jne 0x44eff9
lea ecx, [esi + 0xc8]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 0
mov byte [esp + 0xd8], 4
call fcn.0042aaf0
mov dword [0x4f2230], 1
test eax, eax
jne 0x44ee32
mov byte [esp + 0xd8], al
lea eax, [esp + 0x2c]
call fcn.00445500
jmp 0x44eff9
call fcn.0042ace0
lea edx, [esp + 0x70]
push edx
call fcn.004439c0
lea eax, [esp + 0x70]
push eax
push 0x417
add esi, 0x74
push esi
mov byte [esp + 0xe4], 5
call fcn.00428440
mov dword [esp + 0x18], 0x4f212c
jmp 0x44ee70
mov ecx, dword [esp + 0x18]
cmp dword [ecx], 0
je 0x44ef72
mov esi, dword [esp + 0x2c]
xor edi, edi
cmp dword [esp + 0x30], edi
je 0x44eead
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x44eea9
call eax
push esi
call fcn.00445450
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x44eea9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], edi
mov dword [esp + 0x30], edi
mov edx, dword [esp + 0x18]
mov eax, dword [edx]
call fcn.00445240
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x80]
cmp edi, eax
jbe 0x44eed7
call fcn.00493a81
mov eax, dword [esp + 0x80]
mov ebx, dword [esp + 0x70]
jmp 0x44eee0
mov esi, eax
cmp dword [esp + 0x7c], eax
jbe 0x44eeed
call fcn.00493a81
test ebx, ebx
je 0x44eef7
cmp ebx, dword [esp + 0x70]
je 0x44eefc
call fcn.00493a81
cmp edi, esi
je 0x44ef72
mov eax, dword [ebp + 8]
cmp dword [eax + 0xbc], 0
jne 0x44ef88
test ebx, ebx
jne 0x44ef6a
call fcn.00493a81
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x44ef21
call fcn.00493a81
mov ecx, dword [edi]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
lea eax, [esp + 0x3c]
push eax
push 0x168
push 0xce
push 0x417
call edx
test eax, eax
jne 0x44f04b
test ebx, ebx
jne 0x44ef6e
call fcn.00493a81
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x44ef5b
call fcn.00493a81
mov eax, dword [esp + 0x80]
add edi, 4
jmp 0x44eee0
mov eax, dword [ebx]
jmp 0x44ef17
mov eax, dword [ebx]
jmp 0x44ef51
mov eax, dword [esp + 0x18]
add eax, 4
cmp eax, 0x4f2168
mov dword [esp + 0x18], eax
jl 0x44ee70
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x44ef99
push eax
call fcn.00491da6
add esp, 4
mov eax, dword [esp + 0x70]
xor esi, esi
push eax
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], esi
call fcn.00491da6
add esp, 4
mov byte [esp + 0xd8], 0
cmp dword [esp + 0x30], esi
je 0x44eff9
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x44eff9
call eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.00445450
mov eax, dword [esi + 0x20]
test eax, eax
je 0x44eff9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, esi
mov dword [edx + 0x20], 0
mov esi, dword [ebp + 8]
cmp dword [esi + 0xbc], 0
jne 0x44f242
lea eax, [esi + 0xc8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
mov byte [esp + 0xd8], 7
call fcn.0042aaf0
mov dword [0x4f2230], 1
test eax, eax
jne 0x44f09c
mov byte [esp + 0xd8], al
lea eax, [esp + 0x24]
call fcn.00445500
jmp 0x44f242
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x44f05c
push eax
call fcn.00491da6
add esp, 4
mov eax, dword [esp + 0x70]
push eax
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
call fcn.00491da6
add esp, 4
mov byte [esp + 0xd8], 0
cmp dword [esp + 0x30], 0
jmp 0x44efc9
call fcn.0042ace0
lea ecx, [esp + 0x40]
push ecx
call fcn.004439c0
lea edx, [esp + 0x40]
push edx
push 0x418
add esi, 0x74
push esi
mov byte [esp + 0xe4], 8
call fcn.00428440
mov dword [esp + 0x18], 0x4f212c
mov edi, edi
mov eax, dword [esp + 0x18]
cmp dword [eax], 0
je 0x44f1c4
mov esi, dword [esp + 0x24]
xor edi, edi
cmp dword [esp + 0x28], edi
je 0x44f10d
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x44f109
call eax
push esi
call fcn.00445450
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x44f109
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], edi
mov dword [esp + 0x28], edi
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
call fcn.00445240
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x50]
cmp edi, eax
jbe 0x44f131
call fcn.00493a81
mov eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x40]
mov esi, eax
cmp dword [esp + 0x4c], eax
jbe 0x44f142
call fcn.00493a81
test ebx, ebx
je 0x44f14c
cmp ebx, dword [esp + 0x40]
je 0x44f151
call fcn.00493a81
cmp edi, esi
je 0x44f1c4
mov edx, dword [ebp + 8]
cmp dword [edx + 0xbc], 0
jne 0x44f1da
test ebx, ebx
jne 0x44f1bc
call fcn.00493a81
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x44f176
call fcn.00493a81
mov ecx, dword [edi]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [esp + 0x3c]
push edx
push 0x168
push 0xce
push 0x418
call eax
test eax, eax
jne 0x44f2a5
test ebx, ebx
jne 0x44f1c0
call fcn.00493a81
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x44f1b0
call fcn.00493a81
mov eax, dword [esp + 0x50]
add edi, 4
jmp 0x44f135
mov eax, dword [ebx]
jmp 0x44f16c
mov eax, dword [ebx]
jmp 0x44f1a6
mov eax, dword [esp + 0x18]
add eax, 4
cmp eax, 0x4f2168
mov dword [esp + 0x18], eax
jl 0x44f0d0
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x44f1eb
push eax
call fcn.00491da6
add esp, 4
mov ecx, dword [esp + 0x40]
xor esi, esi
push ecx
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
call fcn.00491da6
add esp, 4
mov byte [esp + 0xd8], 0
cmp dword [esp + 0x28], esi
je 0x44f242
mov edx, dword [esp + 0x24]
mov eax, dword [edx + 0x10]
test eax, eax
je 0x44f242
call eax
mov esi, dword [esp + 0x24]
push esi
call fcn.00445450
mov eax, dword [esi + 0x20]
test eax, eax
je 0x44f242
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov dword [eax + 0x20], 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.0044fe60
test byte [0x4f554c], 1
jne 0x44f270
or dword [0x4f554c], 1
call fcn.004317e0
push 0x4c0640
call fcn.00491fd4
add esp, 4
mov edx, dword [esp + 0xac]
push edx
mov dword [0x4f2238], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x44f2b6
push eax
call fcn.00491da6
add esp, 4
mov ecx, dword [esp + 0x40]
push ecx
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
call fcn.00491da6
add esp, 4
mov byte [esp + 0xd8], 0
cmp dword [esp + 0x28], 0
jmp 0x44f212