Function at 0x4073c0
Capabilities:
Access peb ldr_data
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4651ba
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xdc
push esi
push edi
push 0x180
mov dword [ebp - 0x14], ecx
call fcn.00441881
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x180
push 0
push esi
mov dword [ebp - 4], 0
call fcn.00445960
add esp, 0x10
mov ecx, esi
call fcn.00410570
mov dword [esi + 0xf0], 0
lea ecx, [esi + 0xf8]
mov dword [esi + 0xf4], 0
lea eax, [esi + 0xf0]
xor edx, edx
mov dword [ebp - 0x2c], eax
lea eax, [ecx + 8]
mov dword [ebp - 0x5c], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x34], eax
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], dx
lea eax, [esi + 0x160]
movups xmmword [ecx + 0x20], xmm0
mov dword [ecx + 0x30], edx
mov dword [ecx + 0x34], 7
mov word [ecx + 0x20], dx
mov dword [ecx + 0x50], edx
mov dword [ecx + 0x58], edx
mov dword [ecx + 0x5c], edx
mov dword [ecx + 0x60], edx
mov byte [ecx + 0x64], dl
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [ebp - 0x70], eax
mov dword [esi + 0x170], edx
mov dword [esi + 0x174], edx
mov dword [esi + 0x178], edx
mov byte [esi + 0x17c], dl
mov dword [ebp - 0x18], esi
push 0x10
mov dword [ebp - 4], 1
call fcn.00441881
mov edi, eax
mov dword [ebp - 0x78], esi
xorps xmm0, xmm0
mov dword [ebp - 0x38], edi
lea eax, [edi + 4]
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x60], eax
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [eax], 1
mov dword [edi + 8], 1
mov dword [edi], vtable.std::_Ref_count_struct_blackbone::ImageContext_.0
mov dword [edi + 0xc], esi
sub esp, 0x14
mov dword [ebp - 4], 2
mov ecx, esp
push dword [ebp + 0xc]
call fcn.00404d00
lea ecx, [ebp - 0x58]
call fcn.0040f390
add esp, 0x18
lea ecx, [esi + 0x118]
push eax
call fcn.00404c20
mov ecx, dword [ebp - 0x44]
cmp ecx, 8
jb 0x40754a
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x407540
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4083aa
push ecx
push edx
call fcn.004418b1
add esp, 8
lea edx, [esi + 0x118]
lea ecx, [ebp - 0x58]
call fcn.0040ebc0
mov ecx, dword [ebp - 0x34]
push eax
call fcn.00404c20
mov ecx, dword [ebp - 0x44]
cmp ecx, 8
jb 0x40759b
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x407591
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4083af
push ecx
push edx
call fcn.004418b1
add esp, 8
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x178], eax
test ecx, ecx
je 0x4075bf
mov al, byte [ebp + 0x18]
xor al, 1
movzx eax, al
push eax
push ecx
push ecx
mov ecx, esi
call fcn.00410a20
jmp 0x4075cf
shr eax, 0xf
mov ecx, esi
and al, 1
push eax
push dword [ebp + 0xc]
call fcn.00410840
mov dword [ebp + 0x18], eax
test eax, eax
jns 0x407627
push 0
mov ecx, esi
call fcn.00410ad0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov dword [eax], ecx
mov byte [eax + 0xc], 0
or esi, 0xffffffff
lea edx, [edi + 4]
mov eax, esi
lock xadd dword [edx], eax
jne 0x407610
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lea eax, [edi + 8]
lock xadd dword [eax], esi
dec esi
jne 0x407610
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov edi, dword [ebp + 8]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
or esi, 0xffffffff
test dword [ebp + 0x1c], 0x100
jne 0x4076a8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax]
xor eax, eax
add ecx, 0x10
cmp byte [edx + 0xd], al
setne al
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push eax
call fcn.00401aa0
cmp dword [ebp - 0x1c], 0
je 0x407683
mov ecx, dword [ebp - 0x10]
push 0
call fcn.00410ad0
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [esi], 0
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
mov byte [esi + 0xc], 1
jmp 0x4075eb
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4076a8
mov eax, esi
lock xadd dword [ecx + 4], eax
jne 0x4076a8
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x18]
mov eax, esi
lock xadd dword [ecx + 8], eax
jne 0x4076a8
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov al, byte [edx + 0xd]
mov byte [ebp + 0x1b], al
test al, al
jne 0x4076df
mov eax, dword [ecx]
mov eax, dword [eax + 8]
mov al, byte [eax + 0xd]
test al, al
jne 0x4076df
push 0
mov ecx, edx
call fcn.00410ad0
mov eax, dword [ebp + 8]
mov dword [eax], 0xc0000359
mov byte [eax + 0xc], 0
jmp 0x4075ee
xor eax, eax
cmp byte [ebp + 0x1b], al
setne al
mov dword [edx + 0x134], eax
mov eax, dword [ebp + 0x1c]
test al, 0x20
je 0x407702
push dword [edx + 0x28]
push ecx
call fcn.0040bc30
jmp 0x40793a
test al, 0x10
je 0x40793d
mov eax, dword [edx + 0x20]
mov ecx, dword [edx + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [edx + 0x28]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
call fcn.004069f0
push 0
xorps xmm0, xmm0
mov dword [ebp + 0x18], eax
push 0x493708
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], 0
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x44], 0
call fcn.00405e90
mov byte [ebp - 4], 3
mov ecx, dword [ebp + 0x18]
cmp dword [ecx], 0
jle 0x40775f
xor eax, eax
jmp 0x4077c1
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push 0x494efc
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, eax
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0xc], edx
mov ecx, dword [eax]
cmp edx, ecx
je 0x40779c
test ecx, ecx
jle 0x407798
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
mov ecx, edx
test ecx, ecx
jle 0x4077ab
mov dword [eax + 4], 0
xor eax, eax
jmp 0x4077c1
sub esp, 0x18
lea eax, [ebp - 0x58]
mov ecx, esp
push eax
call fcn.00404d00
mov ecx, dword [ebp + 0x18]
call fcn.00421890
shr eax, 0x1f
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x44]
mov dword [ebp + 0x18], eax
cmp ecx, 8
jb 0x407808
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4077fb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4083b4
push ecx
push edx
call fcn.004418b1
mov eax, dword [ebp + 0x18]
add esp, 8
test al, al
je 0x40784e
mov ecx, dword [ebp - 0x10]
push 0
call fcn.00410ad0
call fcn.004069f0
mov ecx, dword [ebp + 8]
lea edx, [edi + 4]
mov eax, dword [eax + 4]
mov dword [ecx], eax
mov eax, ecx
mov byte [eax + 0xc], 0
mov eax, esi
lock xadd dword [edx], eax
je 0x4075f9
mov edi, ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
call fcn.004069f0
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x1c]
sub esp, 0xc
mov ecx, dword [ecx]
push edx
lea edx, [ebp - 0x28]
push edx
push dword [ecx + 4]
mov ecx, eax
call fcn.00421dc0
test eax, eax
jns 0x4078ca
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x1c], eax
call fcn.004069f0
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x1c]
sub esp, 0xc
mov ecx, dword [ecx]
push edx
lea edx, [ebp - 0x28]
push edx
push dword [ecx + 4]
mov ecx, eax
call fcn.00421dc0
mov dword [ebp + 0x18], eax
test eax, eax
jns 0x4078ca
mov ecx, dword [ebp - 0x10]
push 0
call fcn.00410ad0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov dword [eax], ecx
mov byte [eax + 0xc], 0
jmp 0x4075ee
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x40]
push 1
push 1
push 0x40
push dword [ebp - 0x1c]
mov eax, dword [eax]
push dword [ebp - 0x24]
add eax, 0x58
push dword [ebp - 0x28]
push eax
call fcn.00417c70
mov edx, dword [ebp - 0x2c]
mov dword [ebp + 0xc], eax
mov ecx, dword [edx]
mov dword [ebp + 0x18], ecx
mov ecx, dword [eax]
cmp dword [ebp + 0x18], ecx
je 0x407912
mov dword [edx], ecx
mov ecx, dword [ebp + 0x18]
mov dword [eax], ecx
mov eax, dword [eax + 4]
mov ecx, dword [edx + 4]
mov dword [edx + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [ebp + 0x18], ecx
test ecx, ecx
je 0x40793a
mov eax, esi
lock xadd dword [ecx + 4], eax
jne 0x40793a
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp + 0x18]
mov eax, esi
lock xadd dword [ecx + 8], eax
jne 0x40793a
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0xf0]
test ecx, ecx
je 0x407952
mov eax, dword [ecx]
or eax, dword [ecx + 4]
jne 0x407a3e
mov eax, dword [ebp - 0x14]
push 1
push dword [edx + 0x24]
push dword [edx + 0x20]
mov ecx, dword [eax]
lea eax, [ebp - 0x50]
push 0x40
push dword [edx + 0x28]
add ecx, 0x58
push eax
call fcn.0041f760
mov byte [ebp - 4], 4
cmp dword [ebp - 0x50], 0
jge 0x4079d5
mov ecx, dword [ebp - 0x10]
push 0
call fcn.00410ad0
cmp byte [ebp - 0x44], 0
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x50]
mov dword [ecx], eax
mov eax, ecx
mov byte [eax + 0xc], 0
je 0x4075ee
mov ecx, dword [ebp - 0x48]
mov dword [ebp + 0x18], ecx
test ecx, ecx
je 0x4075ee
mov eax, esi
lock xadd dword [ecx + 4], eax
jne 0x4075ee
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp + 0x18]
mov eax, esi
lock xadd dword [ecx + 8], eax
jne 0x4075ee
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4075ee
mov cl, byte [ebp - 0x44]
test cl, cl
je 0x4083b9
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov dword [ebp + 0x18], edx
mov edx, dword [ebp - 0x4c]
cmp dword [ebp + 0x18], edx
je 0x407a0c
mov ecx, dword [ebp + 0x18]
mov dword [eax], edx
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x48]
mov dword [ecx + 4], eax
mov cl, byte [ebp - 0x44]
mov dword [ebp - 0x48], edx
jmp 0x407a0f
mov edx, dword [ebp - 0x48]
mov dword [ebp + 0x18], edx
mov byte [ebp - 4], 2
test cl, cl
je 0x407a3e
test edx, edx
je 0x407a3e
mov eax, esi
lock xadd dword [edx + 4], eax
jne 0x407a3e
mov eax, dword [edx]
mov ecx, edx
call dword [eax]
mov ecx, dword [ebp + 0x18]
mov eax, esi
lock xadd dword [ecx + 8], eax
jne 0x407a3e
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x407a4e
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x407a5c
xorps xmm0, xmm0
movlpd qword [ebp - 0x40], xmm0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x5c]
mov dword [edx], ecx
mov ecx, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov eax, dword [ecx + 0x28]
mov dword [edx + 0x38], eax
mov eax, dword [ebp + 0x1c]
or eax, 0x8000
cmp dword [ecx + 0x38], 0
cmovne eax, dword [ebp + 0x1c]
mov dword [ebp + 0x1c], eax
test eax, 0x8000
jne 0x407a9e
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.0040a7f0
mov ecx, dword [ebp - 0x10]
mov dword [ebp + 0x18], eax
test eax, eax
js 0x4078b2
sub esp, 8
lea edx, [edi + 4]
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
lock inc dword [edx]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], edi
call fcn.004083d0
mov dword [ebp + 0x18], eax
test eax, eax
jns 0x407aee
mov ecx, dword [ebp - 0x10]
push 0
call fcn.00410ad0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov dword [eax], ecx
mov byte [eax + 0xc], 0
mov eax, esi
lea ecx, [edi + 4]
lock xadd dword [ecx], eax
jmp 0x4075f7
sub esp, 8
lea ecx, [edi + 4]
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
lock inc dword [ecx]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax], edx
mov dword [eax + 4], edi
call fcn.004085e0
mov dword [ebp + 0x18], eax
test eax, eax
js 0x407aca
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov eax, dword [ecx + 0x3c]
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 5
test dword [ebp + 0x1c], 0x100
push ecx
push ecx
je 0x407bae
lea eax, [ebp - 0xcc]
push eax
call fcn.004040c0
mov edi, eax
push 0x60
mov byte [ebp - 4], 6
call fcn.00441881
mov dword [ebp + 0x18], eax
xorps xmm0, xmm0
add esp, 4
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax], vtable.std::_Ref_count_obj2_struct_blackbone::ModuleData_const__.0
add eax, 0x10
push edi
mov ecx, eax
mov dword [ebp + 0x10], eax
call fcn.00404280
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0xcc]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edi
call fcn.00404020
jmp 0x407d3e
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
lea eax, [ebp - 0xcc]
push eax
call fcn.004040c0
lea eax, [ebp - 0xc4]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0xe8]
call fcn.00404d00
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xd0], eax
lea eax, [edi + 0x1c]
mov byte [ebp - 4], 8
push 0x60
mov dword [ebp + 0x10], eax
call fcn.00441881
add esp, 4
mov dword [ebp + 0x18], eax
mov byte [ebp - 4], 9
lea edi, [eax + 0x10]
mov ecx, dword [ebp - 0xc8]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax], vtable.std::_Ref_count_obj2_struct_blackbone::ModuleData_const__.0
mov eax, dword [ebp - 0xcc]
mov dword [edi], eax
lea eax, [ebp - 0xc4]
mov dword [edi + 4], ecx
lea ecx, [edi + 8]
push eax
mov dword [ebp - 0x18], edi
call fcn.00404d00
lea eax, [ebp - 0xac]
mov byte [ebp - 4], 0xb
lea ecx, [edi + 0x20]
push eax
call fcn.00404d00
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x88]
mov dword [edi + 0x38], eax
mov eax, dword [ebp - 0x90]
mov dword [edi + 0x3c], eax
mov eax, dword [ebp - 0x8c]
mov dword [edi + 0x40], eax
mov al, byte [ebp - 0x84]
mov byte [edi + 0x48], al
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004057e0
mov edi, dword [eax]
mov eax, dword [edi + 0x28]
test eax, eax
je 0x407cb5
lock inc dword [eax + 4]
mov eax, dword [edi + 0x24]
mov edi, dword [edi + 0x28]
mov dword [ebp + 0x18], edi
mov ecx, dword [ebp - 0x18]
mov dword [ebp + 0x10], eax
test ecx, ecx
je 0x407ce6
mov eax, esi
lock xadd dword [ecx + 4], eax
jne 0x407ce6
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x18]
mov eax, esi
lock xadd dword [ecx + 8], eax
jne 0x407ce6
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0xd4]
cmp ecx, 8
jb 0x407d2a
mov edx, dword [ebp - 0xe8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x407d20
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4083be
push ecx
push edx
call fcn.004418b1
add esp, 8
lea ecx, [ebp - 0xcc]
call fcn.00404020
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edi
test dword [ebp + 0x1c], 0x20000
jne 0x407d72
cmp dword [ebp + 0xc], 1
jne 0x407d72
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov eax, dword [eax + 8]
cmp byte [eax + 0xc], 0
je 0x407d72
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
mov byte [ebp - 0x24], 1
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
jmp 0x407d7d
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x24], 0
mov ecx, dword [ebp - 0x60]
push 0
sub esp, 8
mov byte [ebp - 4], 0xd
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
lock inc dword [ecx]
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x38]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], edi
call fcn.00408e80
mov dword [ebp - 0x20], eax
test eax, eax
jns 0x407e23
mov ecx, dword [ebp - 0x10]
push 0
call fcn.00410ad0
mov eax, dword [ebp - 0x14]
push dword [ebp + 0xc]
push dword [ebp - 0x34]
mov ecx, dword [eax]
add ecx, 0x10
call fcn.00404330
cmp byte [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov byte [eax + 0xc], 0
je 0x407ded
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x407ae0
mov eax, esi
lock xadd dword [ecx + 4], eax
jne 0x407ae0
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp + 0x18]
mov eax, esi
lock xadd dword [ecx + 8], eax
jne 0x407ae0
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x407ae0
test dword [ebp + 0x1c], 0x4000
jne 0x407ecf
push 1
sub esp, 8
lea ecx, [edi + 4]
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
lock inc dword [ecx]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], edi
call fcn.00408e80
mov dword [ebp - 0x20], eax
test eax, eax
jns 0x407ecf
mov ecx, dword [ebp - 0x10]
push 0
call fcn.00410ad0
mov eax, dword [ebp - 0x14]
push dword [ebp + 0xc]
push dword [ebp - 0x34]
mov ecx, dword [eax]
add ecx, 0x10
call fcn.00404330
cmp byte [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov byte [eax + 0xc], 0
je 0x407e99
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x407ae0
mov eax, esi
lock xadd dword [ecx + 4], eax
jne 0x407ae0
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp + 0x18]
mov eax, esi
lock xadd dword [ecx + 8], eax
jne 0x407ae0
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x407ae0
mov byte [ebp - 4], 5
cmp byte [ebp - 0x24], 0
je 0x407ee2
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
mov eax, dword [ebp + 0x1c]
and eax, 0x10
mov dword [ebp - 0x18], eax
jne 0x407fff
lea eax, [edi + 4]
lock inc dword [eax]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edi
mov byte [ebp - 4], 0xe
mov ecx, dword [eax + 0x48]
mov eax, dword [eax + 0x4c]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
cmp ecx, eax
je 0x407fd8
nop dword [eax + eax]
mov eax, dword [ecx + 0x24]
test eax, 0x20000000
je 0x407f46
test eax, eax
jns 0x407f35
mov eax, 0x40
jmp 0x407f5d
and eax, 0x40000000
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
jmp 0x407f5d
test eax, eax
jns 0x407f51
mov eax, 4
jmp 0x407f5d
test eax, 0x40000000
je 0x407f74
mov eax, 2
push 0
push dword [ecx + 8]
push dword [ecx + 0xc]
mov ecx, dword [ebp - 0x2c]
push eax
call fcn.00418010
test eax, eax
js 0x407fd8
jmp 0x407fc6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
add eax, 0x58
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x407f95
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x30], eax
jmp 0x407fa9
xorps xmm0, xmm0
movlpd qword [ebp - 0x68], xmm0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x64], eax
mov edx, dword [ecx + 0xc]
xor eax, eax
add edx, dword [ebp - 0x64]
push 0x4000
push dword [ecx + 8]
adc eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x6c]
push eax
push edx
call fcn.0041f790
mov ecx, dword [ebp - 0x20]
add ecx, 0x28
mov dword [ebp - 0x20], ecx
cmp ecx, dword [ebp - 0x24]
jne 0x407f20
lea ecx, [edi + 4]
mov byte [ebp - 4], 5
mov eax, esi
lock xadd dword [ecx], eax
jne 0x408002
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lea ecx, [edi + 8]
mov eax, esi
lock xadd dword [ecx], eax
jne 0x407fff
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
lea ecx, [edi + 4]
test dword [ebp + 0x1c], 0x1000
jne 0x40806c
sub esp, 8
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
lock inc dword [ecx]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], edi
call fcn.00409680
mov dword [ebp - 0x24], eax
test eax, eax
jns 0x40806c
cmp eax, 0xc0000225
je 0x40806c
mov ecx, dword [ebp - 0x10]
push 0
call fcn.00410ad0
mov eax, dword [ebp - 0x14]
push dword [ebp + 0xc]
push dword [ebp - 0x34]
mov ecx, dword [eax]
add ecx, 0x10
call fcn.00404330
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
mov byte [eax + 0xc], 0
jmp 0x407ded
sub esp, 8
lea ecx, [edi + 4]
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
lock inc dword [ecx]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], edi
call fcn.00409a70
mov dword [ebp - 0x24], eax
test eax, eax
js 0x40803e
cmp dword [ebp - 0x18], 0
je 0x4080e1
push dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
call fcn.0040bb70
mov dword [ebp - 0x18], eax
test eax, eax
jns 0x4080e1
mov ecx, dword [ebp - 0x10]
push 0
call fcn.00410ad0
mov eax, dword [ebp - 0x14]
push dword [ebp + 0xc]
push dword [ebp - 0x34]
mov ecx, dword [eax]
add ecx, 0x10
call fcn.00404330
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov byte [eax + 0xc], 0
jmp 0x407ded
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x4080f7
mov edx, dword [eax]
mov dword [ebp - 0x20], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x30], edx
jmp 0x40810b
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x2c]
test eax, eax
je 0x40811f
xor edx, edx
add eax, dword [ebp - 0x20]
adc edx, dword [ebp - 0x30]
jmp 0x40812d
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ecx + 0x150], eax
mov eax, dword [ebp + 0x1c]
and al, 2
mov dword [ecx + 0x154], edx
movzx eax, al
neg eax
sbb eax, eax
and eax, 0xff
mov dword [ecx + 0x148], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x34]
test edx, edx
je 0x408183
push dword [ebp + 0x10]
push dword [eax]
push dword [eax + 0x38]
lea eax, [ebp - 0x48]
push 1
push eax
call edx
mov eax, dword [ebp - 0x44]
add esp, 0x14
mov ecx, dword [ebp - 0x10]
cmp eax, 0xde
je 0x408180
mov dword [ecx + 0x148], eax
mov eax, dword [ebp - 0x14]
cmp dword [ecx + 0x148], 0
je 0x40819f
mov ecx, dword [eax]
push dword [ebp - 0x5c]
add ecx, 0x210
call fcn.0041abe0
mov ecx, dword [ebp - 0x10]
test dword [ebp + 0x1c], 0x10000
jne 0x4082e0
lea eax, [edi + 4]
lock inc dword [eax]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], edi
mov byte [ebp - 4], 0xf
cmp byte [ecx + 0xd], 0
je 0x4081cc
mov eax, dword [ecx + 0x18]
add eax, 0xd0
jmp 0x4081d4
mov eax, dword [ecx + 0x14]
add eax, 0xc0
mov eax, dword [eax]
test eax, eax
jne 0x4081df
mov dword [ebp + 0x1c], eax
jmp 0x4081ed
push 1
push eax
call fcn.004116a0
mov ecx, dword [ebp - 0x10]
mov dword [ebp + 0x1c], eax
mov eax, dword [ecx + 0xf0]
test eax, eax
je 0x408204
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x30], eax
jmp 0x408218
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 8]
cdq
mov ecx, eax
mov edi, edx
mov eax, dword [ebp + 0x1c]
cdq
sub eax, ecx
sbb edx, edi
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
adc edx, dword [ebp - 0x30]
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x4082b6
cmp dword [eax + 8], 0
je 0x4082b6
mov eax, dword [ebp - 0x14]
push edx
push dword [ebp - 0x18]
mov ecx, dword [eax]
push dword [ebp - 0x5c]
add ecx, 0x210
call fcn.0041b210
mov dword [ebp + 0x1c], eax
mov ecx, esi
mov eax, dword [ebp - 0x60]
mov byte [ebp - 4], 5
lock xadd dword [eax], ecx
mov edi, dword [ebp - 0x38]
jne 0x408282
mov edx, dword [edi]
mov ecx, edi
call dword [edx]
mov eax, esi
lea ecx, [edi + 8]
lock xadd dword [ecx], eax
jne 0x408282
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
cmp dword [ebp + 0x1c], 0
jge 0x4082e0
mov ecx, dword [ebp - 0x10]
push 0
call fcn.00410ad0
mov eax, dword [ebp - 0x14]
push dword [ebp + 0xc]
push dword [ebp - 0x34]
mov ecx, dword [eax]
add ecx, 0x10
call fcn.00404330
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x1c]
mov dword [eax], ecx
mov byte [eax + 0xc], 0
jmp 0x407ded
mov ecx, dword [ebp - 0x60]
mov eax, esi
mov byte [ebp - 4], 5
lock xadd dword [ecx], eax
mov edi, dword [ebp - 0x38]
jne 0x4082e0
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, esi
lea ecx, [edi + 8]
lock xadd dword [ecx], eax
jne 0x4082e0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x4082f0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x4082fe
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
push dword [ebp - 0x70]
push eax
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00411740
mov ecx, dword [ebp - 0x10]
push 0
call fcn.00410ad0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x408322
mov byte [eax + 0x10], 0
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx + 0x24]
cmp ecx, dword [edx + 0x28]
je 0x40833d
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
mov dword [ecx + 4], edi
xor ecx, ecx
add dword [edx + 0x24], 8
jmp 0x40834d
lea eax, [ebp - 0x78]
push eax
push ecx
lea ecx, [edx + 0x20]
call fcn.0040c410
mov ecx, dword [ebp - 0x74]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x1c], ecx
mov dword [edi], 0
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 8], eax
mov byte [edi + 0xc], 1
test ecx, ecx
je 0x407613
mov eax, esi
lock xadd dword [ecx + 4], eax
jne 0x407613
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp + 0x1c]
lock xadd dword [ecx + 8], esi
dec esi
jne 0x407613
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0x18
call fcn.00449a39
call fcn.00449a39
call fcn.00449a39
call fcn.004016f0
call fcn.00449a39
int3