Function at 0x409950
Capabilities:
Read .ini file
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x104]
sub esp, 0x104
push 0xffffffffffffffff
push 0x444247
mov eax, dword fs:[0]
push eax
sub esp, 0x1c4
mov eax, dword [0x458640]
xor eax, ebp
mov dword [ebp + 0x100], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x118]
mov esi, ecx
mov ecx, dword [ebp + 0x10c]
xor edi, edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x78], eax
mov dword [ebp - 0xb0], edi
mov ebx, 1
push str.NOFOUND
mov dword [ebp - 4], ebx
call fcn.00405ce0
mov dword [ebp - 0xb0], ebx
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x4099e0
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 2
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409a0d
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xcc], eax
mov byte [ebp - 4], 3
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409a3d
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xc4], eax
mov byte [ebp - 4], 4
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409a6d
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 5
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409a9a
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 6
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409ac7
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 7
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409af4
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 8
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409b21
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x64], eax
mov byte [ebp - 4], 9
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409b4e
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 0xa
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409b7b
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x3c], eax
push 0x67
mov byte [ebp - 4], 0xb
call fcn.004152df
cmp eax, edi
je 0x409ba4
push 0x67
push eax
lea ecx, [ebp - 0x3c]
call fcn.004043c0
push edi
lea ecx, [ebp - 0x1d0]
call fcn.0040fc70
lea ecx, [ebp + 0x110]
push ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xc
call fcn.00401a50
mov dword [ebp - 0x74], edi
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x28], ebx
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409be7
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x70], eax
mov byte [ebp - 4], 0xe
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409c14
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 0xf
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409c41
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 0x10
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409c6e
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 0x11
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409c9b
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 0x12
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409cc8
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x6c], eax
mov byte [ebp - 4], 0x13
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409cf5
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x7c], eax
mov byte [ebp - 4], 0x14
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409d22
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 0x15
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409d4f
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 0x16
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409d7c
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x17
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409da9
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 0x18
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409dd6
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0x19
call fcn.00411614
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x409e03
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
lea ecx, [esi + 0x258]
cmp ecx, edi
mov byte [ebp - 4], 0x1a
jne 0x409e24
xor eax, eax
jmp 0x409e3b
mov eax, ecx
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x409e30
sub eax, esi
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.00401700
push 0x67
call fcn.004152df
cmp eax, edi
je 0x409e5b
push 0x67
push eax
lea ecx, [ebp - 0x70]
call fcn.004043c0
push 0x7d3
call fcn.004152df
cmp eax, edi
je 0x409e77
push 0x7d3
push eax
lea ecx, [ebp - 0x68]
call fcn.004043c0
push 0x3ff
call fcn.004152df
cmp eax, edi
je 0x409e93
push 0x3ff
push eax
lea ecx, [ebp - 0x5c]
call fcn.004043c0
push 0x407
call fcn.004152df
cmp eax, edi
je 0x409eaf
push 0x407
push eax
lea ecx, [ebp - 0x6c]
call fcn.004043c0
mov esi, dword [ebp - 0x44]
push str.W2KSP4
push esi
call fcn.0042ca95
add esp, 8
cmp eax, edi
je 0x409ee6
push str.XPSP1
push esi
call fcn.0042ca95
add esp, 8
cmp eax, edi
je 0x409ee6
push edi
push 0x44796c
lea ecx, [ebp - 0x2c]
call fcn.00401700
jmp 0x409f02
push 0x408
call fcn.004152df
cmp eax, edi
je 0x409f02
push 0x408
push eax
lea ecx, [ebp - 0x2c]
call fcn.004043c0
push 0x67
call fcn.004152df
cmp eax, edi
je 0x409f18
push 0x67
push eax
lea ecx, [ebp - 0x7c]
call fcn.004043c0
push 0x7d4
call fcn.004152df
cmp eax, edi
je 0x409f34
push 0x7d4
push eax
lea ecx, [ebp - 0x50]
call fcn.004043c0
push 0x7d5
call fcn.004152df
cmp eax, edi
je 0x409f50
push 0x7d5
push eax
lea ecx, [ebp - 0x4c]
call fcn.004043c0
push 0x7d6
call fcn.004152df
cmp eax, edi
je 0x409f6c
push 0x7d6
push eax
lea ecx, [ebp - 0x58]
call fcn.004043c0
push 0x7d7
call fcn.004152df
cmp eax, edi
je 0x409f88
push 0x7d7
push eax
lea ecx, [ebp - 0x54]
call fcn.004043c0
push str.SQL2KSP4
push esi
call fcn.0042ca95
add esp, 8
cmp eax, edi
jne 0x409f9d
mov dword [ebp - 0x74], ebx
mov ecx, dword [ebp + 0x114]
push ecx
lea edx, [ebp - 0x34]
push 0x447e90
push edx
call fcn.00404a50
add esp, 0xc
push edi
lea ecx, [ebp - 0x158]
call fcn.004101e0
mov byte [ebp - 4], 0x1b
cmp dword [ebp - 0x28], 1
jl 0x40abf6
push 1
lea eax, [ebp - 0xdc]
push eax
lea ecx, [ebp - 0x18]
call fcn.00401880
mov eax, dword [eax]
push 0x447684
push eax
call fcn.0042ca95
add esp, 8
test eax, eax
mov eax, dword [ebp - 0xdc]
setne bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a017
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x40a066
push 0x447684
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x88]
push edx
call fcn.00401b40
add esp, 0xc
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1c
call fcn.00401a50
mov eax, dword [ebp - 0x88]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x1b
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a066
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.SETUP.LST
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0xb8]
push edx
call fcn.00401b40
add esp, 0xc
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x1d
call fcn.00401a50
mov eax, dword [ebp - 0xb8]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x1b
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a0b1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x40]
push ecx
push 0xff
lea edx, [ebp]
push edx
push 0x44796c
push str.NUMBER
xor ebx, ebx
push str.CDROM
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp], bl
je 0x40a309
lea eax, [ebp]
push eax
call fcn.00443498
add esp, 4
mov edi, str.CD.1
lea esi, [ebp]
mov ecx, 5
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a108
mov ebx, 1
mov dword [ebp - 0x14], ebx
mov edi, str.CD.2
lea esi, [ebp]
mov ecx, 5
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a123
mov ebx, 2
mov dword [ebp - 0x14], ebx
mov edi, str.CD.3
lea esi, [ebp]
mov ecx, 5
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a13e
mov ebx, 3
mov dword [ebp - 0x14], ebx
mov edi, str.CD.4
lea esi, [ebp]
mov ecx, 5
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a159
mov ebx, 4
mov dword [ebp - 0x14], ebx
mov edi, str.CD.5
lea esi, [ebp]
mov ecx, 5
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a174
mov ebx, 5
mov dword [ebp - 0x14], ebx
mov edi, str.CD.6
lea esi, [ebp]
mov ecx, 5
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a18f
mov ebx, 6
mov dword [ebp - 0x14], ebx
mov edi, str.CD.7
lea esi, [ebp]
mov ecx, 5
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a1aa
mov ebx, 7
mov dword [ebp - 0x14], ebx
mov edi, str.CD.8
lea esi, [ebp]
mov ecx, 5
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a1c5
mov ebx, 8
mov dword [ebp - 0x14], ebx
mov edi, str.CD.9
lea esi, [ebp]
mov ecx, 5
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a1e0
mov ebx, 9
mov dword [ebp - 0x14], ebx
mov edi, str.CD.10
lea esi, [ebp]
mov ecx, 6
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a1fb
mov ebx, 0xa
mov dword [ebp - 0x14], ebx
mov edi, str.CD.11
lea esi, [ebp]
mov ecx, 6
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a216
mov ebx, 0xb
mov dword [ebp - 0x14], ebx
mov edi, str.CD.12
lea esi, [ebp]
mov ecx, 6
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a231
mov ebx, 0xc
mov dword [ebp - 0x14], ebx
mov edi, str.CD.13
lea esi, [ebp]
mov ecx, 6
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a24c
mov ebx, 0xd
mov dword [ebp - 0x14], ebx
mov edi, str.CD.14
lea esi, [ebp]
mov ecx, 6
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a267
mov ebx, 0xe
mov dword [ebp - 0x14], ebx
mov edi, str.CD.15
lea esi, [ebp]
mov ecx, 6
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a282
mov ebx, 0xf
mov dword [ebp - 0x14], ebx
mov edi, str.CD.16
lea esi, [ebp]
mov ecx, 6
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a29d
mov ebx, 0x10
mov dword [ebp - 0x14], ebx
mov edi, str.CD.17
lea esi, [ebp]
mov ecx, 6
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a2b8
mov ebx, 0x11
mov dword [ebp - 0x14], ebx
mov edi, str.CD.18
lea esi, [ebp]
mov ecx, 6
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a2d3
mov ebx, 0x12
mov dword [ebp - 0x14], ebx
mov edi, str.CD.19
lea esi, [ebp]
mov ecx, 6
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a2ee
mov ebx, 0x13
mov dword [ebp - 0x14], ebx
mov edi, str.CD.20
lea esi, [ebp]
mov ecx, 6
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a309
mov ebx, 0x14
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x74], 0
mov ecx, dword [ebp - 0x20]
je 0x40a319
call fcn.00403540
jmp 0x40a31e
call fcn.00407830
sub eax, 0
je 0x40a39f
sub eax, 1
je 0x40a371
sub eax, 1
je 0x40a34e
push 0x403
call fcn.004152df
test eax, eax
je 0x40a349
push 0x403
push eax
lea ecx, [ebp - 0x30]
call fcn.004043c0
or edi, 0xffffffff
jmp 0x40a3c2
push 0x401
call fcn.004152df
test eax, eax
je 0x40a36a
push 0x401
push eax
lea ecx, [ebp - 0x30]
call fcn.004043c0
mov eax, 4
jmp 0x40a3c0
mov eax, 9
cmp ebx, eax
je 0x40a3c0
mov eax, 3
push 0x400
mov edi, eax
call fcn.004152df
test eax, eax
je 0x40a3c2
push 0x400
push eax
lea ecx, [ebp - 0x30]
call fcn.004043c0
jmp 0x40a3c2
push 0x402
call fcn.004152df
test eax, eax
je 0x40a3bb
push 0x402
push eax
lea ecx, [ebp - 0x30]
call fcn.004043c0
mov eax, 5
mov edi, eax
mov eax, ebx
sub eax, 3
je 0x40a3fd
sub eax, 1
je 0x40a3e8
sub eax, 1
jne 0x40a3fd
push 0x406
call fcn.004152df
test eax, eax
je 0x40a419
push 0x406
jmp 0x40a410
push 0x405
call fcn.004152df
test eax, eax
je 0x40a419
push 0x405
jmp 0x40a410
push 0x404
call fcn.004152df
test eax, eax
je 0x40a419
push 0x404
push eax
lea ecx, [ebp - 0x38]
call fcn.004043c0
cmp ebx, edi
je 0x40a79f
cmp edi, 0xffffffff
je 0x40a785
mov eax, 3
cmp ebx, eax
je 0x40a449
mov eax, 4
cmp ebx, eax
je 0x40a449
mov eax, 5
cmp ebx, eax
jne 0x40a785
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x5c]
push edx
lea eax, [ebp - 0xa8]
push eax
call fcn.00404ba0
add esp, 0xc
lea ecx, [ebp - 0x38]
push ecx
push eax
lea edx, [ebp - 0xd4]
push edx
mov byte [ebp - 4], 0x1e
call fcn.00404ba0
add esp, 0xc
lea ecx, [ebp - 0x50]
push ecx
push eax
lea edx, [ebp - 0xa0]
push edx
mov byte [ebp - 4], 0x1f
call fcn.00404ba0
add esp, 0xc
lea ecx, [ebp - 0x34]
push ecx
push eax
lea edx, [ebp - 0xc0]
push edx
mov byte [ebp - 4], 0x20
call fcn.00404ba0
add esp, 0xc
lea ecx, [ebp - 0x4c]
push ecx
push eax
lea edx, [ebp - 0x98]
push edx
mov byte [ebp - 4], 0x21
call fcn.00404ba0
add esp, 0xc
lea ecx, [ebp - 0x6c]
push ecx
push eax
lea edx, [ebp - 0xd0]
push edx
mov byte [ebp - 4], 0x22
call fcn.00404ba0
add esp, 0xc
lea ecx, [ebp - 0x2c]
push ecx
push eax
lea edx, [ebp - 0x90]
push edx
mov byte [ebp - 4], 0x23
call fcn.00404ba0
mov ecx, dword [ebp - 0x3c]
mov eax, dword [eax]
add esp, 0xc
push 0x131
push ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
mov eax, dword [ebp - 0x90]
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a52c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0xd0]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x22
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a552
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x98]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x21
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a578
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0xc0]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x20
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a59e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0xa0]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x1f
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a5c4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0xd4]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x1e
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a5ea
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0xa8]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x1b
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a610
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x40a782
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x78]
push ecx
mov ecx, dword [ebp - 0x44]
push 0xff
lea edx, [ebp]
push edx
push 0x44796c
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp], 0
je 0x40a782
lea edx, [ebp]
push edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc8]
push ecx
call fcn.00401b40
add esp, 0xc
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x24
call fcn.00401a50
mov eax, dword [ebp - 0xc8]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x1b
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a68c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
push esi
call fcn.00402990
test eax, eax
je 0x40a782
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0xd8]
push eax
call fcn.00404ba0
add esp, 0xc
lea ecx, [ebp - 0x54]
push ecx
push eax
lea edx, [ebp - 0x80]
push edx
mov byte [ebp - 4], 0x25
call fcn.00404ba0
add esp, 0xc
mov eax, dword [eax]
push 1
push eax
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 0x26
call fcn.0040fd40
mov eax, dword [ebp - 0x80]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x25
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a703
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0xd8]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x1b
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a729
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
mov esi, dword [ebp - 0x20]
mov ecx, esi
call fcn.00404dd0
mov ecx, dword [ebp - 0x2c]
push 0x44796c
push ecx
call fcn.0042ca95
add esp, 8
test eax, eax
setne al
test al, al
je 0x40a755
push 0
call fcn.0042dc46
mov ecx, dword [ebp - 0x48]
lea edx, [ebp - 0x24]
push edx
call fcn.00401a50
lea eax, [ebp - 0x18]
lea ecx, [esi + 0x9d8]
push eax
call fcn.00401a50
mov ecx, dword [ebp - 0x14]
mov edx, esi
mov dword [edx + 0x134], ecx
mov dword [ebp - 0x28], 0
mov ebx, dword [ebp - 0x14]
mov eax, 3
cmp ebx, eax
jne 0x40a9d5
mov eax, 9
cmp edi, eax
jne 0x40a9d5
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x44]
push 0xff
lea ecx, [ebp]
push ecx
push 0x44796c
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp], 0
je 0x40a9d5
lea ecx, [ebp]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x84]
push eax
call fcn.00401b40
add esp, 0xc
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x27
call fcn.00401a50
mov eax, dword [ebp - 0x84]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x1b
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a813
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
push esi
call fcn.00402990
test eax, eax
je 0x40a9d5
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x9c]
push eax
call fcn.00404ba0
add esp, 0xc
lea ecx, [ebp - 0x4c]
push ecx
push eax
lea edx, [ebp - 0x94]
push edx
mov byte [ebp - 4], 0x28
call fcn.00404ba0
add esp, 0xc
lea ecx, [ebp - 0x2c]
push ecx
push eax
lea edx, [ebp - 0x8c]
push edx
mov byte [ebp - 4], 0x29
call fcn.00404ba0
mov ecx, dword [ebp - 0x3c]
mov eax, dword [eax]
add esp, 0xc
push 0
push ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x8c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a8a1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x94]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x28
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a8c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x9c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x1b
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a8ed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0xac]
push eax
call fcn.00404ba0
add esp, 0xc
lea ecx, [ebp - 0x54]
push ecx
push eax
lea edx, [ebp - 0xa4]
push edx
mov byte [ebp - 4], 0x2a
call fcn.00404ba0
add esp, 0xc
mov eax, dword [eax]
push 1
push eax
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 0x2b
call fcn.0040fd40
mov eax, dword [ebp - 0xa4]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x2a
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a956
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0xac]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x1b
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a97c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
mov esi, dword [ebp - 0x20]
mov ecx, esi
call fcn.00404dd0
mov ecx, dword [ebp - 0x2c]
push 0x44796c
push ecx
call fcn.0042ca95
add esp, 8
test eax, eax
setne al
test al, al
je 0x40a9a8
push 0
call fcn.0042dc46
mov ecx, dword [ebp - 0x48]
lea edx, [ebp - 0x24]
push edx
call fcn.00401a50
lea eax, [ebp - 0x18]
lea ecx, [esi + 0x9d8]
push eax
call fcn.00401a50
mov dword [esi + 0x134], ebx
mov dword [ebp - 0x28], 0
jmp 0x409fc5
cmp dword [ebp - 0x28], 1
jl 0x40abf6
mov esi, 1
cmp dword [ebp - 0x28], esi
jle 0x40a9fb
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x68]
push 0x30
push ecx
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xe4]
call fcn.00401a50
push 0x6f
call fcn.004152df
test eax, eax
je 0x40aa20
push 0x6f
push eax
lea ecx, [ebp - 0x64]
call fcn.004043c0
push 0x70
call fcn.004152df
test eax, eax
je 0x40aa36
push 0x70
push eax
lea ecx, [ebp - 0x60]
call fcn.004043c0
lea eax, [edi - 1]
cmp eax, 8
ja case.default.0x40aa42
jmp dword [eax*4 + 0x40b024]
push 0x83
call fcn.004152df
test eax, eax
je 0x40ab3b
push 0x83
jmp 0x40ab32
push 0x84
call fcn.004152df
test eax, eax
je 0x40ab3b
push 0x84
jmp 0x40ab32
push 0x85
call fcn.004152df
test eax, eax
je 0x40ab3b
push 0x85
jmp 0x40ab32
push 0x86
call fcn.004152df
test eax, eax
je 0x40ab3b
push 0x86
jmp 0x40ab32
push 0x87
call fcn.004152df
test eax, eax
je 0x40ab3b
push 0x87
jmp 0x40ab32
push 0x88
call fcn.004152df
test eax, eax
je 0x40ab3b
push 0x88
jmp 0x40ab32
push 0x89
call fcn.004152df
test eax, eax
je 0x40ab3b
push 0x89
jmp 0x40ab32
push 0x8a
call fcn.004152df
test eax, eax
je 0x40ab3b
push 0x8a
jmp 0x40ab32
push 0x8b
call fcn.004152df
test eax, eax
je 0x40ab3b
push 0x8b
jmp 0x40ab32
push 0x82
call fcn.004152df
test eax, eax
je 0x40ab3b
push 0x82
push eax
lea ecx, [ebp - 0x1c]
call fcn.004043c0
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0xbc]
push eax
call fcn.00404ba0
add esp, 0xc
lea ecx, [ebp - 0x60]
push ecx
push eax
lea edx, [ebp - 0xb4]
push edx
mov byte [ebp - 4], 0x2c
call fcn.00404ba0
add esp, 0xc
push eax
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 0x2d
call fcn.00401a50
mov eax, dword [ebp - 0xb4]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x2c
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40aba0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0xbc]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x1b
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40abc6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x158]
call fcn.00413502
cmp eax, 2
jne 0x40b004
mov ecx, dword [ebp - 0x48]
push 7
push str.NOFOUND
call fcn.00401700
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x128], 0
mov eax, dword [ebp - 0xe0]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x2f
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ac1c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0xe4]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x2e
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ac42
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 0x1a
call fcn.00412dc9
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x19
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ac74
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x18
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ac97
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x40]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x17
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40acba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x16
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40acdd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x15
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ad00
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x50]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ad23
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x7c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x13
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ad46
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x6c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x12
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ad69
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ad8c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40adaf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x5c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xf
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40add2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x68]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xe
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40adf5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x70]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xd
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ae18
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xc
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 0xb
call fcn.00412dc9
mov eax, dword [ebp - 0x3c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xa
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ae51
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x60]
add eax, 0xfffffff0
mov byte [ebp - 4], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ae74
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x64]
add eax, 0xfffffff0
mov byte [ebp - 4], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ae97
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff0
mov byte [ebp - 4], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40aeba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x54]
add eax, 0xfffffff0
mov byte [ebp - 4], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40aedd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x58]
add eax, 0xfffffff0
mov byte [ebp - 4], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40af00
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x4c]
add eax, 0xfffffff0
mov byte [ebp - 4], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40af23
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0xc4]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40af49
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0xcc]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40af6f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x44]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40af92
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x114]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40afb8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x110]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40afda
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x100]
xor ecx, ebp
call fcn.0042cf8a
add ebp, 0x104
mov esp, ebp
pop ebp
ret 0x10
lea edx, [ebp - 0xe4]
push edx
lea ecx, [ebp - 0x18]
call fcn.00401a50
add dword [ebp - 0x28], esi
jmp 0x409fc5