Function at 0x406ec0
Capabilities:
Get common file path
Get disk information
Get disk size
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b78d
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x463024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.09F7EDC5_294E_4180_AF6A_FB0E6A0E9513
mov edx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSPPClients
call fcn.00405a80
add esp, 4
lea ecx, [ebp - 0x244]
push eax
call fcn.00414120
mov dword [ebp - 4], 0
call fcn.00402520
mov ecx, eax
test ecx, ecx
je 0x407bbc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x22c], eax
push 0x448948
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 1
call fcn.00414f80
test al, al
jne 0x406f5a
push 0
push 0x448948
lea ecx, [ebp - 0x22c]
call fcn.00416110
mov byte [ebp - 4], 2
call fcn.00402520
mov ecx, eax
test ecx, ecx
je 0x407bc6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x240], eax
push 0x448948
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 3
call fcn.00414f80
test al, al
jne 0x406fa5
push 0
push 0x448948
lea ecx, [ebp - 0x240]
call fcn.00416110
mov byte [ebp - 4], 4
call fcn.00402520
mov ecx, eax
test ecx, ecx
je 0x407bd0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x228], eax
mov byte [ebp - 4], 5
call fcn.00402520
mov ecx, eax
test ecx, ecx
je 0x407bda
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x23c], eax
push str.Restore_Points
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 6
call fcn.00414f80
test al, al
jne 0x407011
push 0xe
push str.Restore_Points
lea ecx, [ebp - 0x23c]
call fcn.00416110
push 0
push 0x24
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 7
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407031
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x228]
call fcn.00416110
mov esi, dword [ebp - 0x228]
cmp dword [esi - 0xc], 3
lea eax, [esi - 0x10]
mov dword [ebp - 0x21c], eax
jg 0x40707a
mov ecx, eax
call fcn.004160a0
lea edi, [eax + 0x10]
mov dword [ebp - 0x224], edi
jmp 0x4070e1
mov ecx, dword [eax]
test ecx, ecx
je 0x40708b
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x4070a1
call fcn.00402520
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x407be4
mov eax, dword [ecx]
push 2
push 3
call dword [eax]
test eax, eax
je 0x407bee
cmp dword [eax + 8], 3
lea edi, [eax + 0x10]
mov dword [ebp - 0x224], edi
jl 0x407c02
xor eax, eax
mov dword [edi - 0xc], 3
push 6
push esi
mov ecx, edi
mov word [edi + 6], ax
lea edx, [eax + 6]
call fcn.00402010
add esp, 8
lea edx, [edi - 0x10]
mov byte [ebp - 4], 8
lea eax, [esi - 0x10]
mov dword [ebp - 0x220], edx
or ebx, 0xffffffff
cmp edx, eax
je 0x40714f
mov esi, dword [ebp - 0x21c]
cmp dword [esi + 0xc], 0
jl 0x407134
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x407134
mov ecx, edx
call fcn.004160a0
mov edi, eax
lea edx, [esi + 0xc]
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407129
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea esi, [edi + 0x10]
mov dword [ebp - 0x228], esi
jmp 0x407149
push dword [edi - 0xc]
lea ecx, [ebp - 0x228]
push edi
call fcn.00416110
mov esi, dword [ebp - 0x228]
mov edx, dword [ebp - 0x220]
mov byte [ebp - 4], 7
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407167
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
lea ecx, [ebp - 0x2a4]
call fcn.00407c20
push esi
mov byte [ebp - 4], 9
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 3
jne 0x407af5
mov ecx, dword [ebp - 0x22c]
lea edi, [esi - 0x10]
add ecx, 0xfffffff0
mov dword [ebp - 0x220], ecx
cmp edi, ecx
je 0x407203
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x224], eax
jl 0x4071f4
mov eax, dword [edi]
cmp eax, dword [ecx]
jne 0x4071f4
mov ecx, edi
call fcn.004160a0
mov edx, dword [ebp - 0x224]
mov ecx, ebx
mov dword [ebp - 0x21c], eax
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4071e9
mov edi, dword [ebp - 0x220]
push edi
mov ecx, dword [edi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x21c]
add eax, 0x10
mov dword [ebp - 0x22c], eax
jmp 0x407203
push dword [esi - 0xc]
lea ecx, [ebp - 0x22c]
push esi
call fcn.00416110
push ecx
mov edi, esp
lea ecx, [esi - 0x10]
mov dword [ebp - 0x234], edi
call fcn.004160a0
add eax, 0x10
mov dword [edi], eax
call fcn.00406ca0
mov eax, dword [0x46b574]
add esp, 4
mov edi, dword [ebp - 0x29c]
add edi, 0xfffffff0
lea edx, [eax - 0x10]
mov dword [ebp - 0x224], edx
cmp edx, edi
je 0x40728f
cmp dword [edi + 0xc], 0
jl 0x407280
mov edx, dword [edx]
cmp edx, dword [edi]
jne 0x407280
mov ecx, dword [ebp - 0x224]
call fcn.004160a0
mov dword [ebp - 0x224], eax
lea edx, [edi + 0xc]
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407275
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x224]
add eax, 0x10
mov dword [ebp - 0x29c], eax
jmp 0x40728f
push dword [eax - 0xc]
lea ecx, [ebp - 0x29c]
push eax
call fcn.00416110
mov ecx, dword [ebp - 0x2a0]
lea edi, [esi - 0x10]
add ecx, 0xfffffff0
mov dword [ebp - 0x220], ecx
cmp edi, ecx
je 0x407306
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x224], eax
jl 0x4072f7
mov eax, dword [edi]
cmp eax, dword [ecx]
jne 0x4072f7
mov ecx, edi
call fcn.004160a0
mov edx, dword [ebp - 0x224]
mov ecx, ebx
mov dword [ebp - 0x21c], eax
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4072ec
mov eax, dword [ebp - 0x220]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x21c]
add eax, 0x10
mov dword [ebp - 0x2a0], eax
jmp 0x407306
push dword [esi - 0xc]
lea ecx, [ebp - 0x2a0]
push esi
call fcn.00416110
push 0x45c46c
push esi
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
je 0x4073f6
mov ecx, edi
call fcn.004160a0
lea edi, [eax + 0x10]
mov dword [ebp - 0x21c], edi
mov byte [ebp - 4], 0xa
xorps xmm0, xmm0
cmp dword [edi - 4], 1
movlpd qword [0x46b540], xmm0
movlpd qword [0x4697f8], xmm0
jle 0x40735b
push dword [edi - 0xc]
lea ecx, [ebp - 0x21c]
call fcn.004150a0
mov edi, dword [ebp - 0x21c]
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x264]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
test eax, eax
je 0x4073a9
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x234]
mov dword [0x46b540], eax
mov eax, dword [ebp - 0x25c]
mov dword [0x46b544], ecx
mov ecx, dword [ebp - 0x258]
mov dword [0x4697f8], eax
mov dword [0x4697fc], ecx
cmp dword [edi - 4], 1
jle 0x4073c3
push dword [edi - 0xc]
lea ecx, [ebp - 0x21c]
call fcn.004150a0
mov edi, dword [ebp - 0x21c]
push 0
push 0
push 0x4695e8
push 0x46b11c
push edi
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceW]
mov byte [ebp - 4], 9
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4073f3
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
lea edi, [esi - 0x10]
mov eax, dword [0x46b540]
mov ecx, dword [0x46b544]
mov edx, dword [ebp - 0x298]
mov dword [ebp - 0x28c], eax
add edx, 0xfffffff0
mov eax, dword [0x4697f8]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x288], ecx
mov ecx, dword [0x4697fc]
mov dword [ebp - 0x280], ecx
lea ecx, [eax - 0x10]
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x224], ecx
lea ecx, [eax - 0x10]
cmp ecx, edx
je 0x4074af
cmp dword [edx + 0xc], 0
lea ecx, [edx + 0xc]
mov dword [ebp - 0x220], ecx
jl 0x4074a0
mov ecx, dword [eax - 0x10]
cmp ecx, dword [edx]
jne 0x4074a0
mov ecx, dword [ebp - 0x224]
call fcn.004160a0
mov edx, dword [ebp - 0x220]
mov ecx, ebx
mov dword [ebp - 0x230], eax
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407495
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x230]
add eax, 0x10
mov dword [ebp - 0x298], eax
jmp 0x4074af
push dword [eax - 0xc]
lea ecx, [ebp - 0x298]
push eax
call fcn.00416110
cmp dword [edi + 0xc], 1
jle 0x4074c9
push dword [edi + 4]
lea ecx, [ebp - 0x228]
call fcn.004150a0
mov esi, dword [ebp - 0x228]
lea edx, [ebp - 0x2a4]
mov ecx, esi
call fcn.004067e0
cmp eax, 0xffffffff
je 0x407a3b
mov eax, dword [ebp - 0x29c]
mov ecx, 0x448948
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407516
test dx, dx
je 0x407512
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407516
add eax, 4
add ecx, 4
test dx, dx
jne 0x4074f0
xor eax, eax
jmp 0x40751b
sbb eax, eax
or eax, 1
lea ecx, [ebp - 0x21c]
push str._3A_
test eax, eax
je 0x407777
call fcn.00414030
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x2a0]
cmp dword [eax - 0xc], 1
jg 0x407556
lea ecx, [eax - 0x10]
call fcn.004160a0
lea edi, [eax + 0x10]
mov dword [ebp - 0x220], edi
jmp 0x4075c3
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x407568
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x40757e
call fcn.00402520
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x407bf3
mov eax, dword [ecx]
push 2
push 1
call dword [eax]
test eax, eax
je 0x407bfd
cmp dword [eax + 8], 1
lea edi, [eax + 0x10]
mov dword [ebp - 0x220], edi
jl 0x407c02
xor eax, eax
mov dword [edi - 0xc], 1
push 2
push dword [ebp - 0x2a0]
mov ecx, edi
mov word [edi + 2], ax
lea edx, [eax + 2]
call fcn.00402010
add esp, 8
push 0x45c47c
lea edx, [ebp - 0x294]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x234]
call fcn.00413940
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 0xd
push ecx
mov edx, eax
lea ecx, [ebp - 0x258]
call fcn.00413a10
push 0x44895c
mov edx, eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x260]
call fcn.00413940
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0xf
push ecx
mov edx, eax
lea ecx, [ebp - 0x254]
call fcn.00413a10
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0x10
push ecx
mov edx, eax
lea ecx, [ebp - 0x250]
call fcn.00413a10
add esp, 0x14
mov byte [ebp - 4], 0x11
mov edx, dword [eax]
mov ecx, dword [ebp - 0x290]
add ecx, 0xfffffff0
mov dword [ebp - 0x24c], ecx
lea eax, [edx - 0x10]
mov dword [ebp - 0x230], eax
lea eax, [edx - 0x10]
cmp eax, ecx
je 0x4076c9
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x248], eax
jl 0x4076ba
mov eax, dword [edx - 0x10]
cmp eax, dword [ecx]
jne 0x4076ba
mov ecx, dword [ebp - 0x230]
call fcn.004160a0
mov edx, dword [ebp - 0x248]
mov ecx, ebx
mov dword [ebp - 0x230], eax
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4076af
mov eax, dword [ebp - 0x24c]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x230]
add eax, 0x10
mov dword [ebp - 0x290], eax
jmp 0x4076c9
push dword [edx - 0xc]
lea ecx, [ebp - 0x290]
push edx
call fcn.00416110
mov byte [ebp - 4], 0x10
mov eax, ebx
mov edx, dword [ebp - 0x250]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4076ea
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xf
mov eax, ebx
mov edx, dword [ebp - 0x254]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40770b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
mov eax, ebx
mov edx, dword [ebp - 0x260]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40772c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xd
mov eax, ebx
mov edx, dword [ebp - 0x258]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40774d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc
mov eax, ebx
mov edx, dword [ebp - 0x234]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40776e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xb
jmp 0x407982
call fcn.00414030
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x2a0]
cmp dword [eax - 0xc], 1
jg 0x40779f
lea ecx, [eax - 0x10]
call fcn.004160a0
lea edi, [eax + 0x10]
mov dword [ebp - 0x220], edi
jmp 0x40780c
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x4077b1
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x4077c7
call fcn.00402520
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x407c0c
mov eax, dword [ecx]
push 2
push 1
call dword [eax]
test eax, eax
je 0x407c16
cmp dword [eax + 8], 1
lea edi, [eax + 0x10]
mov dword [ebp - 0x220], edi
jl 0x407c02
xor eax, eax
mov dword [edi - 0xc], 1
push 2
push dword [ebp - 0x2a0]
mov ecx, edi
mov word [edi + 2], ax
lea edx, [eax + 2]
call fcn.00402010
add esp, 8
push 0x45c47c
lea edx, [ebp - 0x294]
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x248]
call fcn.00413940
push 0x45c480
mov edx, eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x24c]
call fcn.00413940
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0x15
push ecx
mov edx, eax
lea ecx, [ebp - 0x250]
call fcn.00413a10
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0x16
push ecx
mov edx, eax
lea ecx, [ebp - 0x254]
call fcn.00413a10
add esp, 0x10
mov byte [ebp - 4], 0x17
mov edx, dword [eax]
mov ecx, dword [ebp - 0x290]
add ecx, 0xfffffff0
mov dword [ebp - 0x260], ecx
lea eax, [edx - 0x10]
mov dword [ebp - 0x234], eax
lea eax, [edx - 0x10]
cmp eax, ecx
je 0x4078fa
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x258], eax
jl 0x4078eb
mov eax, dword [edx - 0x10]
cmp eax, dword [ecx]
jne 0x4078eb
mov ecx, dword [ebp - 0x234]
call fcn.004160a0
mov edx, dword [ebp - 0x258]
mov ecx, ebx
mov dword [ebp - 0x234], eax
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4078e0
mov eax, dword [ebp - 0x260]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x234]
add eax, 0x10
mov dword [ebp - 0x290], eax
jmp 0x4078fa
push dword [edx - 0xc]
lea ecx, [ebp - 0x290]
push edx
call fcn.00416110
mov byte [ebp - 4], 0x16
mov eax, ebx
mov edx, dword [ebp - 0x254]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40791b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x15
mov eax, ebx
mov edx, dword [ebp - 0x250]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40793c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x14
mov eax, ebx
mov edx, dword [ebp - 0x24c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40795d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x13
mov eax, ebx
mov edx, dword [ebp - 0x248]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40797e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x12
mov eax, ebx
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x407999
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 9
mov eax, ebx
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4079ba
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x290]
test ecx, ecx
jne 0x4079da
or eax, 0xffffffff
shr eax, 0x1f
xor al, 1
mov dword [ebp - 0x220], eax
mov byte [ebp - 0x26b], al
jmp 0x407a42
mov eax, dword [ebp - 0x244]
cmp dword [eax - 0xc], 0
jge 0x4079fc
or eax, 0xffffffff
shr eax, 0x1f
xor al, 1
mov dword [ebp - 0x220], eax
mov byte [ebp - 0x26b], al
jmp 0x407a42
push ecx
push eax
call fcn.0041bfb5
add esp, 8
test eax, eax
jne 0x407a20
or eax, 0xffffffff
shr eax, 0x1f
xor al, 1
mov dword [ebp - 0x220], eax
mov byte [ebp - 0x26b], al
jmp 0x407a42
sub eax, dword [ebp - 0x244]
sar eax, 1
shr eax, 0x1f
xor al, 1
mov dword [ebp - 0x220], eax
mov byte [ebp - 0x26b], al
jmp 0x407a42
mov byte [ebp - 0x220], 0
lea ecx, [ebp - 0x2a4]
call fcn.00407ce0
mov byte [ebp - 4], 5
mov eax, ebx
mov edx, dword [ebp - 0x224]
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407a6b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x407a86
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
mov eax, ebx
mov edx, dword [ebp - 0x240]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407aa7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x22c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407ac8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x244]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x407aea
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [ebp - 0x220]
jmp 0x407ba0
lea ecx, [ebp - 0x2a4]
call fcn.00407ce0
mov byte [ebp - 4], 5
mov eax, ebx
mov edx, dword [ebp - 0x23c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407b21
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x407b3c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
mov eax, ebx
mov edx, dword [ebp - 0x240]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407b5d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x22c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407b7e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x244]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x407ba0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041ac2f
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402280
push 0x80004005
call fcn.00402280
push 0x80004005
call fcn.00402280
push 0x80004005
call fcn.00402280
push 0x80004005
call fcn.00402280
call fcn.00416100
push 0x80004005
call fcn.00402280
call fcn.00416100
push 0x80070057
call fcn.00402280
push 0x80004005
call fcn.00402280
call fcn.00416100
int3