Function at 0x433ab0
Capabilities:
Get common file path
Get disk information
Get program files directory
Get session user name
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x4b77ea
mov eax, dword fs:[0]
push eax
sub esp, 0x53c
mov eax, dword [0x4e1370]
xor eax, esp
mov dword [esp + 0x538], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e1370]
xor eax, esp
push eax
lea eax, [esp + 0x550]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x46]
push ecx
mov word [esp + 0x48], ax
call fcn.00494b20
add esp, 0xc
push 0x104
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
or ebp, 0xffffffff
test eax, eax
je 0x433b85
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x40]
call fcn.00405a20
mov dword [esp + 0x558], 0
mov eax, dword [0x4e9a60]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a4c
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov dword [esp + 0x558], ebp
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433b85
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x104
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x433c02
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov dword [esp + 0x558], 1
mov eax, dword [0x4e9a60]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a4c
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov dword [esp + 0x558], ebp
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433c02
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.0047b3d7
cmp dword [0x4e882c], 0x400
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
jge 0x433d11
push 0
push 0x1a
lea ecx, [esp + 0x44]
push ecx
push 0
call ebx
test eax, eax
je 0x433c97
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov dword [esp + 0x558], 2
mov eax, dword [0x4e9a60]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a4c
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov dword [esp + 0x558], ebp
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433c97
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x23
lea ecx, [esp + 0x44]
push ecx
push 0
call ebx
test eax, eax
je 0x433d11
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov dword [esp + 0x558], 3
mov eax, dword [0x4e9a60]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a4c
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov dword [esp + 0x558], ebp
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433d11
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x14
lea ecx, [esp + 0x44]
push ecx
push 0
call ebx
test eax, eax
je 0x433d8b
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov dword [esp + 0x558], 4
mov eax, dword [0x4e9a60]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a4c
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov dword [esp + 0x558], ebp
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433d8b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x2b
lea ecx, [esp + 0x44]
push ecx
push 0
call ebx
test eax, eax
je 0x433e05
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov dword [esp + 0x558], 5
mov eax, dword [0x4e9a60]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a4c
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov dword [esp + 0x558], ebp
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433e05
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00443a00
lea edx, [esp + 0x244]
push edx
mov ebx, 6
push 0x80
mov dword [esp + 0x560], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [esp + 0x244], 0
lea esi, [esp + 0x244]
je 0x433f2e
movzx eax, word [esi]
cmp ax, 0x61
jb 0x433e57
cmp ax, 0x63
jb 0x433f09
add eax, 0xffffffbf
cmp ax, 1
jbe 0x433f09
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x433f09
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.00405a20
mov byte [esp + 0x558], 7
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 2
jl 0x433ee3
mov eax, 2
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x18]
call fcn.00435e40
mov ebx, eax
lea edi, [esp + 0x20]
mov byte [esp + 0x558], 8
call fcn.00435eb0
mov byte [esp + 0x558], 7
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, ebp
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x433ede
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, 6
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433f09
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x433f10
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 + 2], cx
lea esi, [esi + eax*2 + 2]
jne 0x433e44
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x2c]
xor ebp, ebp
sar eax, 2
test eax, eax
jbe 0x43403a
cmp ebp, eax
jb 0x433f4c
call fcn.00490387
mov ecx, dword [esp + 0x2c]
mov esi, dword [ecx + ebp*4]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
sub esi, 0x10
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x433f7a
cmp eax, dword [esi]
jne 0x433f7a
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x433fb5
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x435964
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004903e8
add esp, 0x10
add edi, 0x10
mov dword [esp + 0x18], edi
push 0xe
push 0x4c902c
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x564], 9
call fcn.00425be0
mov eax, dword [0x4e9a7c]
mov ecx, dword [eax + 4]
lea edi, [eax + 4]
lea edx, [esp + 0x18]
push edx
push ecx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x434026
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x2c]
inc ebp
sar eax, 2
cmp ebp, eax
jb 0x433f4c
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x34e]
push edx
mov word [esp + 0x350], cx
call fcn.00494b20
add esp, 0xc
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x348]
push ecx
mov dword [esp + 0x40], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x434106
mov edx, dword [0x4e7464]
mov eax, dword [edx + 0xc]
mov ecx, 0x4e7464
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x344]
push ecx
push str.C:Documents_and_Settings_sMy_Documents
lea edi, [esp + 0x20]
mov byte [esp + 0x560], 0xa
call fcn.00404aa0
mov eax, dword [0x4e9a7c]
mov ecx, dword [eax + 4]
add esp, 8
lea edi, [eax + 4]
lea edx, [esp + 0x18]
push edx
push ecx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x434106
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebp, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434184
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0xb
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434184
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 1
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x4341fc
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0xc
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4341fc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 2
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434274
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0xd
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434274
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 3
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x4342ec
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0xe
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4342ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 4
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434364
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0xf
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434364
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 5
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x4343dc
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x10
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4343dc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push ebx
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434453
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x11
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434453
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 7
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x4344cb
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x12
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4344cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 8
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434543
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x13
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434543
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 9
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x4345bb
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x14
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4345bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0xa
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434633
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x15
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434633
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0xb
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x4346ab
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x16
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4346ab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 5
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434723
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x17
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434723
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0xd
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x43479b
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x18
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43479b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0xe
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434813
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x19
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434813
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x11
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x43488b
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x1a
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43488b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x13
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434903
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x1b
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434903
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x13
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x43497b
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x1c
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43497b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x14
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x4349f3
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x1d
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4349f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x15
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434a6b
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x1e
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434a6b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x16
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434ae3
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x1f
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434ae3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x17
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434b5b
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x20
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434b5b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x18
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434bd3
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x21
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434bd3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x19
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434c4b
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x22
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434c4b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x1a
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434cc3
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x23
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434cc3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x1c
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434d3b
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x24
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434d3b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x1d
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434db3
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x25
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434db3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x1e
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434e2b
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x26
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434e2b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x1f
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434ea3
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x27
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434ea3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x20
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434f1b
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x28
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434f1b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x21
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x434f93
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x29
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434f93
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x22
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x43500b
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x2a
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43500b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x23
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x435083
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x2b
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435083
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x24
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x4350fb
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x2c
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4350fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x25
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x435173
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x2d
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435173
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x26
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x4351eb
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x2e
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4351eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x27
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x435263
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x2f
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435263
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x28
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x4352db
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x30
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4352db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x29
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x435353
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x31
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435353
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x2a
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x4353cb
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x32
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4353cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x2b
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x435443
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x33
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435443
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x2c
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x4354bb
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x34
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4354bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x2d
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x435533
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x35
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435533
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x2e
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x4355ab
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x36
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4355ab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x2f
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x435623
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x37
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435623
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x30
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x43569b
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x38
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43569b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x31
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x435713
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x39
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435713
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x35
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x43578b
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x3a
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43578b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x36
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x435803
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x3b
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435803
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x37
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x43587b
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x3c
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43587b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0x1a
lea ecx, [esp + 0x44]
push ecx
push 0
call ebp
test eax, eax
je 0x435903
push 0x4c90a8
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x40]
call fcn.00405a20
mov byte [esp + 0x558], 0x3d
mov eax, dword [0x4e9a7c]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x1c]
push ecx
push edx
push eax
call fcn.004363e0
mov ecx, 0x4e9a68
mov esi, eax
call fcn.0048ee70
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x558], bl
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435903
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
xor esi, esi
cmp eax, esi
je 0x435923
mov edi, dword [esp + 0x30]
call fcn.00436680
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00490210
add esp, 4
mov edx, dword [esp + 0x20]
push edx
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call fcn.00490210
add esp, 4
mov ecx, dword [esp + 0x550]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x538]
xor ecx, esp
call fcn.0049021b
add esp, 0x548
ret
call fcn.00405210
int3