Function at 0x404150
Capabilities:
Access peb ldr_data
Create directory
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x443be7
mov eax, dword fs:[0]
push eax
sub esp, 0x580
mov eax, dword [0x45d55c]
xor eax, esp
mov dword [esp + 0x578], eax
push ebx
push esi
push edi
mov eax, dword [0x45d55c]
xor eax, esp
push eax
lea eax, [esp + 0x590]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x18], ecx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], esi
call fcn.00401890
push 0x449f78
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x5a4], 0
call fcn.00401770
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x59c], 1
call fcn.004016b0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
or edi, 0xffffffff
mov byte [esp + 0x598], 0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404210
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40424c
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x598], edi
lea edx, [eax + 0xc]
lock xadd dword [edx], edi
dec edi
test edi, edi
jg 0x404245
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x40506d
push str.obj.txt
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00401770
mov eax, dword [esp + 0x34]
push 0x44796c
push eax
mov byte [esp + 0x5ac], 2
call fcn.0042da56
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x4042d1
mov byte [esp + 0x598], al
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4042a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x598], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x404245
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x40506d
xor edi, edi
mov ecx, esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], edi
call fcn.00401000
test eax, eax
jbe 0x40436a
mov dword [esp + 0x10], edi
mov eax, dword [esi + 4]
test eax, eax
je 0x40430f
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x6572ec3
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x404314
call fcn.0042d299
mov ecx, dword [esp + 0x20]
mov esi, dword [ecx + 4]
add esi, dword [esp + 0x10]
mov ecx, 0x143
lea edi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov edi, str.SetParam64ToPointer
lea esi, [esp + 0x74]
mov ecx, 0x14
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
mov esi, dword [esp + 0x20]
je 0x404362
mov edi, dword [esp + 0x1c]
add dword [esp + 0x10], 0x50c
add edi, 1
mov ecx, esi
mov dword [esp + 0x1c], edi
call fcn.00401000
cmp edi, eax
jb 0x4042ee
jmp 0x40436a
mov dword [esp + 0x24], 1
push 0x449f50
push ebx
call fcn.0042d843
mov eax, dword [esp + 0x38]
push eax
push 0x449f40
push ebx
call fcn.0042d843
push 0x449f24
push ebx
call fcn.0042d843
push 0x449ed8
push ebx
call fcn.0042d843
push 0x449e90
push ebx
call fcn.0042d843
push 0x449e80
push ebx
call fcn.0042d843
push 0x449e64
push ebx
call fcn.0042d843
push 0x449e58
push ebx
call fcn.0042d843
mov ecx, dword [esp + 0x5c]
add esp, 0x44
push ecx
push str.obj.
push ebx
call fcn.0042d843
add esp, 0xc
cmp dword [esp + 0x24], 0
je 0x4043eb
push str.SetParam64ToPointer___r_n_r_n
jmp 0x4043f0
push 0x4480f8
push ebx
call fcn.0042d843
add esp, 8
push 0x449e08
push ebx
call fcn.0042d843
push 0x449df8
push ebx
call fcn.0042d843
push 0x449dbc
push ebx
call fcn.0042d843
push 0x449d9c
push ebx
call fcn.0042d843
push 0x449d58
push ebx
call fcn.0042d843
push 0x449d48
push ebx
call fcn.0042d843
add esp, 0x30
mov ecx, esi
mov dword [esp + 0x1c], 0
call fcn.00401000
test eax, eax
jbe 0x404e7a
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 4]
test eax, eax
je 0x40447c
mov ecx, dword [ecx + 8]
sub ecx, eax
mov eax, 0x6572ec3
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x1c], eax
jb 0x404481
call fcn.0042d299
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
imul esi, esi, 0x50c
add esi, dword [edx + 4]
mov ecx, 0x143
lea edi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
nop
mov cl, byte [esp + eax + 0x74]
mov byte [esp + eax + 0x544], cl
add eax, 1
test cl, cl
jne 0x4044a0
lea eax, [esp + 0x544]
push eax
push 0x449d38
push ebx
call fcn.0042d843
mov eax, dword [esp + 0x544]
add esp, 0xc
cmp eax, 3
jne 0x4044db
push 0x449d30
jmp 0x404509
cmp eax, 0x14
jne 0x4044e7
push 0x449d24
jmp 0x404509
cmp eax, 8
jne 0x4044f3
push 0x449d1c
jmp 0x404509
cmp eax, 4
jne 0x4044ff
push 0x449d14
jmp 0x404509
cmp eax, 5
jne 0x404512
push 0x449d04
push ebx
call fcn.0042d843
add esp, 8
push 0x449cf8
push ebx
call fcn.0042d843
xor esi, esi
add esp, 8
cmp dword [esp + 0xb4], esi
jle 0x4045a6
lea edi, [esp + 0xb8]
push edi
push 0x449cec
push ebx
call fcn.0042d843
mov eax, dword [esp + esi*4 + 0x4c4]
add esp, 0xc
cmp eax, 3
jne 0x404554
push 0x449ce0
jmp 0x40458e
cmp eax, 0x14
jne 0x404560
push 0x449cd4
jmp 0x40458e
cmp eax, 4
jne 0x40456c
push 0x449cc8
jmp 0x40458e
cmp eax, 5
jne 0x404578
push 0x449cb8
jmp 0x40458e
cmp eax, 8
jne 0x404584
push 0x449cac
jmp 0x40458e
cmp eax, 0x1a
jne 0x404597
push 0x449c9c
push ebx
call fcn.0042d843
add esp, 8
add esi, 1
add edi, 0x20
cmp esi, dword [esp + 0xb4]
jl 0x404532
push 0x4480f8
push ebx
call fcn.0042d843
push 0x449c90
push ebx
call fcn.0042d843
add esp, 0x10
cmp dword [esp + 0x538], 8
jne 0x4045d0
push 0x449c84
jmp 0x4045d5
push 0x449c78
push ebx
call fcn.0042d843
add esp, 8
lea ecx, [esp + 0x34]
push ecx
push 0x449c6c
push ebx
call fcn.0042d843
xor edi, edi
add esp, 0xc
cmp dword [esp + 0xb4], edi
jle 0x40463a
lea esi, [esp + 0xb8]
cmp dword [esp + edi*4 + 0x4b8], 0x14
jne 0x40461c
cmp dword [esp + 0x24], 0
je 0x40461c
push esi
push 0x449c58
jmp 0x404622
push esi
push 0x449c50
push ebx
call fcn.0042d843
add edi, 1
add esp, 0xc
add esi, 0x20
cmp edi, dword [esp + 0xb4]
jl 0x404603
push 0x449c48
push ebx
call fcn.0042d843
add esp, 8
mov edi, str.SetDictMem
lea esi, [esp + 0x544]
mov ecx, 0xb
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x404715
lea eax, [esp + 0x544]
push eax
push 0x449c2c
push ebx
call fcn.0042d843
push 0x449d30
push ebx
call fcn.0042d843
push 0x449cf8
push ebx
call fcn.0042d843
push 0x449c14
push ebx
call fcn.0042d843
push 0x449bf8
push ebx
call fcn.0042d843
push 0x449bdc
push ebx
call fcn.0042d843
push 0x449bc0
push ebx
call fcn.0042d843
push 0x4480f8
push ebx
call fcn.0042d843
add esp, 0x44
push str.addr
push ebx
call fcn.0042d843
push str.size
push ebx
call fcn.0042d843
push 0x449b70
push ebx
call fcn.0042d843
lea ecx, [esp + 0x4c]
push ecx
push 0x449c6c
push ebx
call fcn.0042d843
push str.__index__addr__size
push ebx
call fcn.0042d843
push 0x449c48
push ebx
call fcn.0042d843
add esp, 0x34
jmp 0x404e5e
mov edi, str.AppendPicAddr
lea esi, [esp + 0x544]
mov ecx, 0xe
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4047e2
lea eax, [esp + 0x544]
push eax
push 0x449c2c
push ebx
call fcn.0042d843
push 0x449d1c
push ebx
call fcn.0042d843
push 0x449cf8
push ebx
call fcn.0042d843
push 0x449b30
push ebx
call fcn.0042d843
push 0x449b14
push ebx
call fcn.0042d843
push 0x449bdc
push ebx
call fcn.0042d843
push 0x449bc0
push ebx
call fcn.0042d843
push 0x4480f8
push ebx
call fcn.0042d843
add esp, 0x44
push 0x449af8
push ebx
call fcn.0042d843
push 0x449ad8
push ebx
call fcn.0042d843
push 0x449ac4
push ebx
call fcn.0042d843
lea ecx, [esp + 0x4c]
push ecx
push 0x449c6c
push ebx
call fcn.0042d843
push str.__pic_info__addr__size
push ebx
call fcn.0042d843
push 0x449c48
push ebx
call fcn.0042d843
add esp, 0x34
jmp 0x404e5e
mov edi, str.WriteDataFromBin
lea esi, [esp + 0x544]
mov ecx, 0x11
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4048b7
push str.WriteDataZjj
push 0x449d38
push ebx
call fcn.0042d843
push 0x449d30
push ebx
call fcn.0042d843
push 0x449cf8
push ebx
call fcn.0042d843
push 0x449a70
push ebx
call fcn.0042d843
push 0x449a58
push ebx
call fcn.0042d843
push 0x449a38
push ebx
call fcn.0042d843
push 0x449a1c
push ebx
call fcn.0042d843
push 0x449bc0
push ebx
call fcn.0042d843
add esp, 0x44
push 0x4480f8
push ebx
call fcn.0042d843
push str.data
push ebx
call fcn.0042d843
push 0x4499d8
push ebx
call fcn.0042d843
push 0x449b70
push ebx
call fcn.0042d843
lea eax, [esp + 0x54]
push eax
push 0x449c6c
push ebx
call fcn.0042d843
push str.__hwnd__addr__data_size
push ebx
call fcn.0042d843
push 0x449c48
push ebx
call fcn.0042d843
add esp, 0x3c
jmp 0x404e5e
mov edi, str.WriteDataAddrFromBin
lea esi, [esp + 0x544]
mov ecx, 0x15
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40499e
push str.WriteDataAddrZjj
push 0x449d38
push ebx
call fcn.0042d843
push 0x449d30
push ebx
call fcn.0042d843
push 0x449cf8
push ebx
call fcn.0042d843
push 0x449a70
push ebx
call fcn.0042d843
push 0x44997c
push ebx
call fcn.0042d843
push 0x449a38
push ebx
call fcn.0042d843
push 0x449a1c
push ebx
call fcn.0042d843
push 0x449bc0
push ebx
call fcn.0042d843
add esp, 0x44
push 0x4480f8
push ebx
call fcn.0042d843
push str.data
push ebx
call fcn.0042d843
push 0x4499d8
push ebx
call fcn.0042d843
push 0x449b70
push ebx
call fcn.0042d843
lea eax, [esp + 0x54]
push eax
push 0x449c6c
push ebx
call fcn.0042d843
add esp, 0x2c
cmp dword [esp + 0x24], 0
je 0x40498b
push str.__hwnd__
push ebx
call fcn.0042d843
add esp, 8
jmp 0x404e50
push str.__hwnd__addr__data_size
push ebx
call fcn.0042d843
add esp, 8
jmp 0x404e50
mov edi, str.ReadDataToBin
lea esi, [esp + 0x544]
mov ecx, 0xe
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x404aad
push str.ReadDataZjj
push 0x449d38
push ebx
call fcn.0042d843
push 0x449934
push ebx
call fcn.0042d843
push 0x449cf8
push ebx
call fcn.0042d843
push 0x449a70
push ebx
call fcn.0042d843
push 0x449a58
push ebx
call fcn.0042d843
push 0x44991c
push ebx
call fcn.0042d843
push 0x449900
push ebx
call fcn.0042d843
push 0x449a1c
push ebx
call fcn.0042d843
add esp, 0x44
push 0x4498e0
push ebx
call fcn.0042d843
push 0x4480f8
push ebx
call fcn.0042d843
push str.data__obj.
push ebx
call fcn.0042d843
lea eax, [esp + 0x4c]
push eax
push 0x449c6c
push ebx
call fcn.0042d843
push str.__hwnd__addr__size
push ebx
call fcn.0042d843
push 0x4498b0
push ebx
call fcn.0042d843
push 0x44989c
push ebx
call fcn.0042d843
push str.data_size__0_r_n
push ebx
call fcn.0042d843
add esp, 0x44
push 0x449884
push ebx
call fcn.0042d843
push str.data_size__size_r_n
push ebx
call fcn.0042d843
push str.datazjj__
push ebx
call fcn.0042d843
push 0x449830
push ebx
call fcn.0042d843
add esp, 0x20
jmp 0x404e5e
mov edi, str.ReadDataAddrToBin
lea esi, [esp + 0x544]
mov ecx, 0x12
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x404bcd
push str.ReadDataAddrZjj
push 0x449d38
push ebx
call fcn.0042d843
push 0x449934
push ebx
call fcn.0042d843
push 0x449cf8
push ebx
call fcn.0042d843
push 0x449a70
push ebx
call fcn.0042d843
push 0x44997c
push ebx
call fcn.0042d843
push 0x44991c
push ebx
call fcn.0042d843
push 0x449900
push ebx
call fcn.0042d843
push 0x449a1c
push ebx
call fcn.0042d843
add esp, 0x44
push 0x4498e0
push ebx
call fcn.0042d843
push 0x4480f8
push ebx
call fcn.0042d843
push str.data__obj.
push ebx
call fcn.0042d843
lea eax, [esp + 0x4c]
push eax
push 0x449c6c
push ebx
call fcn.0042d843
add esp, 0x24
cmp dword [esp + 0x24], 0
je 0x404b6a
push 0x4497ec
jmp 0x404b6f
push str.__hwnd__addr__size
push ebx
call fcn.0042d843
add esp, 8
push 0x4498b0
push ebx
call fcn.0042d843
push 0x44989c
push ebx
call fcn.0042d843
push str.data_size__0_r_n
push ebx
call fcn.0042d843
push 0x449884
push ebx
call fcn.0042d843
push str.data_size__size_r_n
push ebx
call fcn.0042d843
push str.datazjj__
push ebx
call fcn.0042d843
push 0x449830
push ebx
call fcn.0042d843
add esp, 0x38
jmp 0x404e5e
mov edi, str.FindPicMem
lea esi, [esp + 0x544]
mov ecx, 0xb
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x404c16
mov edi, str.FindPicMemE
lea esi, [esp + 0x544]
mov ecx, 0xc
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x404c16
mov edi, str.FindPicMemEx
lea esi, [esp + 0x544]
mov ecx, 0xd
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x404e5e
lea eax, [esp + 0x544]
push eax
push 0x449c2c
push ebx
call fcn.0042d843
mov eax, dword [esp + 0x544]
add esp, 0xc
cmp eax, 3
jne 0x404c3f
push 0x449d30
jmp 0x404c6d
cmp eax, 0x14
jne 0x404c4b
push 0x449d24
jmp 0x404c6d
cmp eax, 8
jne 0x404c57
push 0x449d1c
jmp 0x404c6d
cmp eax, 4
jne 0x404c63
push 0x449d14
jmp 0x404c6d
cmp eax, 5
jne 0x404c76
push 0x449d04
push ebx
call fcn.0042d843
add esp, 8
push 0x449cf8
push ebx
call fcn.0042d843
xor esi, esi
add esp, 8
cmp dword [esp + 0xb4], esi
mov dword [esp + 0x18], esi
jle 0x404d43
lea ecx, [esp + 0xb8]
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x10]
push edx
push 0x449cec
push ebx
call fcn.0042d843
mov eax, dword [esp + esi*4 + 0x4c4]
add esp, 0xc
cmp eax, 3
jne 0x404cc8
push 0x449ce0
jmp 0x404d1d
cmp eax, 0x14
jne 0x404cd4
push 0x449cd4
jmp 0x404d1d
cmp eax, 4
jne 0x404ce0
push 0x449cc8
jmp 0x404d1d
cmp eax, 5
jne 0x404cec
push 0x449cb8
jmp 0x404d1d
cmp eax, 8
jne 0x404d13
mov esi, dword [esp + 0x10]
mov edi, str.pic_info
mov ecx, 9
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x404d0c
push 0x4497a8
jmp 0x404d1d
push 0x449cac
jmp 0x404d1d
cmp eax, 0x1a
jne 0x404d26
push 0x449c9c
push ebx
call fcn.0042d843
add esp, 8
mov esi, dword [esp + 0x18]
add dword [esp + 0x10], 0x20
add esi, 1
cmp esi, dword [esp + 0xb4]
mov dword [esp + 0x18], esi
jl 0x404ca2
push 0x449bdc
push ebx
call fcn.0042d843
push 0x449bc0
push ebx
call fcn.0042d843
push 0x44978c
push ebx
call fcn.0042d843
push 0x4480f8
push ebx
call fcn.0042d843
push 0x44976c
push ebx
call fcn.0042d843
push 0x449748
push ebx
call fcn.0042d843
push 0x449738
push ebx
call fcn.0042d843
push str.info__AppendPicAddr_info_addr_size__r_n
push ebx
call fcn.0042d843
add esp, 0x40
push 0x449c90
push ebx
call fcn.0042d843
add esp, 8
cmp dword [esp + 0x538], 8
jne 0x404dbd
push 0x449c84
jmp 0x404dc2
push 0x449c78
push ebx
call fcn.0042d843
add esp, 8
lea ecx, [esp + 0x34]
push ecx
push 0x449c6c
push ebx
call fcn.0042d843
add esp, 0xc
cmp dword [esp + 0xb4], 0
mov dword [esp + 0x18], 0
jle 0x404e50
lea edx, [esp + 0xb8]
mov dword [esp + 0x10], edx
jmp 0x404e00
mov esi, dword [esp + 0x10]
mov edi, str.pic_info
mov ecx, 9
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x404e24
push str.__info
push ebx
call fcn.0042d843
add esp, 8
jmp 0x404e37
mov ecx, dword [esp + 0x10]
push ecx
push 0x449c50
push ebx
call fcn.0042d843
add esp, 0xc
mov eax, dword [esp + 0x18]
add dword [esp + 0x10], 0x20
add eax, 1
cmp eax, dword [esp + 0xb4]
mov dword [esp + 0x18], eax
jl 0x404e00
push 0x449c48
push ebx
call fcn.0042d843
add esp, 8
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add esi, 1
mov dword [esp + 0x1c], esi
call fcn.00401000
cmp esi, eax
jb 0x404455
push ebx
call fcn.0042d7c7
push 0x447828
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.00401770
mov ecx, dword [esp + 0x3c]
push 0x44796c
push ecx
mov byte [esp + 0x5b0], 3
call fcn.0042da56
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x404f28
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x598], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404edc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0x598], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404f04
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x598], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x404239
push 0x449660
push esi
call fcn.0042d843
push 0x4495e0
push esi
call fcn.0042d843
push 0x449578
push esi
call fcn.0042d843
mov edi, dword [esp + 0x48]
push edi
push 0x449508
push esi
call fcn.0042d843
push 0x447a50
push esi
call fcn.0042d843
push edi
push 0x4494b8
push esi
call fcn.0042d843
push 0x449468
push esi
call fcn.0042d843
add esp, 0x40
push 0x449410
push esi
call fcn.0042d843
push 0x447994
push esi
call fcn.0042d843
push esi
call fcn.0042d7c7
push 0x447984
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00401770
mov eax, dword [eax]
push eax
push 0x84
mov byte [esp + 0x5c0], 4
call fcn.0040b070
mov esi, eax
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
add esp, 0x28
mov byte [esp + 0x598], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404ff0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x598], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405018
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0x598], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405040
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x598], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40506b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x590]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x578]
xor ecx, esp
call fcn.0042d746
mov esp, ebp
pop ebp
ret