Function at 0x411cc0
Capabilities:
Encode data using xor
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c5015
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x51eee0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov edx, dword [0x520340]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x94], eax
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
mov ecx, 0xc
idiv ecx
mov eax, dword [0x520448]
mov ecx, 0xc6c365d1
push 0
mov dword [ebp - 0x78], 0
cmp edx, 3
cmove eax, ecx
lea ecx, [ebp - 0xa4]
mov dword [0x520448], eax
call fcn.00442860
mov esi, dword [0x520340]
mov dword [ebp - 4], 0
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 0x16
idiv ecx
cmp edx, 0x12
jne 0x411df3
xor edx, edx
nop
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, esi
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
inc edx
add esi, eax
cmp edx, 0x100
jl 0x411d70
mov dword [0x520340], esi
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x70], ebx
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
mov byte [ebp - 4], 1
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x74], edi
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
mov byte [ebp - 4], 2
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x68], esi
mov ecx, dword [ebp - 0x50]
push str.hive
mov byte [ebp - 4], 4
call fcn.00442de0
sub esp, 0x18
mov ecx, eax
push esp
call fcn.004435b0
lea eax, [ebp - 0x5c]
push eax
call fcn.0044ee90
add esp, 0x1c
mov edx, dword [eax]
lea ecx, [ebx - 0x10]
lea eax, [edx - 0x10]
mov byte [ebp - 4], 5
mov dword [ebp - 0x6c], ecx
cmp eax, ecx
je 0x411f2d
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x80], eax
jl 0x411f1e
mov eax, dword [edx - 0x10]
lea ebx, [edx - 0x10]
mov dword [ebp - 0x54], eax
cmp eax, dword [ecx]
jne 0x411f1e
mov eax, dword [eax]
mov ecx, dword [ebp - 0x54]
call dword [eax + 0x10]
cmp dword [ebx + 0xc], 0
lea edx, [ebx + 0xc]
mov ecx, eax
jl 0x411eb9
cmp ecx, dword [ebx]
jne 0x411eb9
mov eax, 1
lock xadd dword [edx], eax
jmp 0x411efc
mov eax, dword [ecx]
push 2
push dword [ebx + 4]
call dword [eax]
mov edx, eax
mov dword [ebp - 0x54], edx
test edx, edx
jne 0x411ed0
call fcn.0040c2e0
mov eax, dword [ebx + 4]
mov dword [edx + 4], eax
mov ecx, dword [ebx + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebx + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edx + 0x10]
push eax
call fcn.004a7195
mov ebx, dword [ebp - 0x54]
add esp, 0x10
mov ecx, dword [ebp - 0x80]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x411f16
mov edx, dword [ebp - 0x6c]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0x10
mov dword [ebp - 0x70], ebx
jmp 0x411f2d
push dword [edx - 0xc]
lea ecx, [ebp - 0x70]
push edx
call fcn.00409950
mov ebx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x5c]
add edx, 0xfffffff0
mov byte [ebp - 4], 4
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x411f4e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebx - 0x10]
push ecx
mov ecx, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ecx]
mov dword [ebp - 0x6c], esp
call dword [eax + 0x10]
lea ecx, [ebx - 0x10]
mov edx, eax
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x5c], eax
jl 0x411f82
cmp edx, dword [ecx]
jne 0x411f82
mov edx, dword [ebp - 0x5c]
mov eax, 1
lock xadd dword [edx], eax
jmp 0x411fc4
mov eax, dword [edx]
push 2
push dword [ecx + 4]
mov ecx, edx
call dword [eax]
mov edx, eax
mov dword [ebp - 0x5c], edx
test edx, edx
jne 0x411f9b
call fcn.0040c2e0
mov eax, dword [ebx - 0xc]
mov dword [edx + 4], eax
mov ecx, dword [ebx - 0xc]
lea eax, [ecx*2 + 2]
push eax
lea eax, [ecx*2 + 2]
push ebx
push eax
lea eax, [edx + 0x10]
push eax
call fcn.004a7195
mov ecx, dword [ebp - 0x5c]
add esp, 0x10
lea eax, [ecx + 0x10]
mov ecx, dword [ebp - 0x6c]
mov dword [ecx], eax
call fcn.004155d0
add esp, 4
mov dword [ebp - 0x60], eax
test eax, eax
jne 0x4120dd
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x50]
push str.enumRegKeys_hive_error_
push eax
call fcn.0040b800
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 6
call fcn.0044ef60
add esp, 8
push eax
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 7
call fcn.00442780
push 0x4d968c
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 8
call fcn.00442d00
lea ecx, [ebp - 0x90]
push ecx
mov ecx, eax
call fcn.00442b10
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 7
call fcn.00442a70
cmp dword [ebp - 0x18], 0x10
jb 0x41205a
push dword [ebp - 0x2c]
call fcn.004a5bbe
add esp, 4
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 4
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41207d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41209a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4120b7
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x54]
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4120d4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
jmp 0x412697
mov ecx, dword [ebp - 0x50]
push 0x4d9ab8
call fcn.00442de0
sub esp, 0x18
mov ecx, eax
push esp
call fcn.004435b0
lea eax, [ebp - 0xa8]
push eax
call fcn.0044ee90
add esp, 0x1c
mov edx, dword [eax]
lea ecx, [edi - 0x10]
lea eax, [edx - 0x10]
mov byte [ebp - 4], 9
mov dword [ebp - 0x80], ecx
cmp eax, ecx
je 0x4121d2
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x6c], eax
jl 0x4121c3
mov eax, dword [edx - 0x10]
lea edi, [edx - 0x10]
mov dword [ebp - 0x5c], eax
cmp eax, dword [ecx]
jne 0x4121c3
mov eax, dword [eax]
mov ecx, dword [ebp - 0x5c]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
mov ecx, eax
jl 0x41215e
cmp ecx, dword [edi]
jne 0x41215e
mov eax, 1
lock xadd dword [edx], eax
jmp 0x4121a1
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov edx, eax
mov dword [ebp - 0x5c], edx
test edx, edx
jne 0x412175
call fcn.0040c2e0
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, dword [edi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edx + 0x10]
push eax
call fcn.004a7195
mov edi, dword [ebp - 0x5c]
add esp, 0x10
mov ecx, dword [ebp - 0x6c]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4121bb
mov edx, dword [ebp - 0x80]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0x10
mov dword [ebp - 0x74], edi
jmp 0x4121d2
push dword [edx - 0xc]
lea ecx, [ebp - 0x74]
push edx
call fcn.00409950
mov edi, dword [ebp - 0x74]
mov edx, dword [ebp - 0xa8]
add edx, 0xfffffff0
mov byte [ebp - 4], 4
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4121f6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x50]
push 0x4d9ac4
call fcn.00443e00
test al, al
je 0x41221d
mov ecx, dword [ebp - 0x50]
push 0x4d9ac4
call fcn.00442de0
mov ecx, eax
call fcn.004434b0
jmp 0x41221f
xor eax, eax
mov ecx, 0x20019
cmp eax, 0x20
jne 0x412230
mov ecx, 0x20219
jmp 0x41223b
mov edx, 0x20119
cmp eax, 0x40
cmove ecx, edx
lea eax, [ebp - 0x78]
push eax
push ecx
push 0
push edi
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x412380
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.0043e100
add esp, 8
push eax
lea eax, [ebp - 0x50]
push str.enumRegKeys_RegOpenKeyEx_
push eax
mov byte [ebp - 4], 0xa
call fcn.0040b800
add esp, 0xc
mov edx, dword [ebp - 0x60]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 0xc
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41229a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0044ef60
add esp, 8
push eax
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0xd
call fcn.00442780
push 0x4d968c
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0xe
call fcn.00442d00
lea ecx, [ebp - 0x90]
push ecx
mov ecx, eax
call fcn.00442b10
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0xd
call fcn.00442a70
cmp dword [ebp - 0x18], 0x10
jb 0x4122fc
push dword [ebp - 0x2c]
call fcn.004a5bbe
add esp, 4
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
mov byte [ebp - 4], 4
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41231c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x412339
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x412356
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x54]
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4120d4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
jmp 0x412697
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x64], 0x104
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x58], esi
mov edx, dword [ebp - 0x64]
mov byte [ebp - 4], 0xf
test edx, edx
jns 0x4123b6
push 0x80070057
call fcn.00404480
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x4123d3
push edx
lea ecx, [ebp - 0x58]
call fcn.004088a0
mov esi, dword [ebp - 0x58]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x50]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, 0x103
je 0x412520
mov ecx, dword [ebp - 0x58]
push dword [ecx - 8]
push ecx
call fcn.004a773a
mov edx, eax
add esp, 8
test edx, edx
js 0x4123ac
mov ecx, dword [ebp - 0x58]
cmp edx, dword [ecx - 8]
jg 0x4123ac
mov dword [ecx - 0xc], edx
mov eax, dword [ebp - 0x58]
xor ecx, ecx
mov word [eax + edx*2], cx
test esi, esi
jne 0x41247b
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0044ef60
add esp, 8
push eax
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0x10
call fcn.00442780
push eax
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x11
call fcn.00443340
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0x10
call fcn.00442a70
cmp dword [ebp - 0x18], 0x10
mov byte [ebp - 4], 0xf
jb 0x41247b
push dword [ebp - 0x2c]
call fcn.004a5bbe
add esp, 4
mov esi, dword [ebp - 0x58]
cmp dword [esi - 0xc], 0
mov eax, dword [esi - 0x10]
lea edx, [esi - 0x10]
mov dword [ebp - 0x60], eax
je 0x4124dc
cmp dword [edx + 0xc], 0
lea ecx, [edx + 0xc]
jge 0x4124ba
cmp dword [esi - 8], 0
jge 0x4124a6
push 0x80070057
call fcn.00404480
mov dword [esi - 0xc], 0
mov eax, dword [ebp - 0x58]
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x58]
jmp 0x4124dc
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4124ce
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x60]
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x58], esi
inc dword [ebp - 0x50]
call fcn.00417940
test al, al
jne 0x412513
mov eax, 0x42
mov edx, 0x9f
mov dword [ebp - 0x54], eax
test eax, eax
je 0x41250c
mov ecx, eax
mov eax, edx
cdq
idiv dword [ebp - 0x54]
mov eax, edx
mov dword [ebp - 0x54], edx
mov edx, ecx
test ecx, ecx
jne 0x4124f5
add eax, edx
mov dword [0x520340], eax
mov edx, 0x104
mov dword [ebp - 0x64], edx
jmp 0x4123a8
lea ecx, [ebp - 0xa4]
call fcn.004437f0
test al, al
je 0x412570
push str.empty
lea ecx, [ebp - 0x90]
call fcn.00442820
push 0x4d968c
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x12
call fcn.00442d00
lea ecx, [ebp - 0x90]
push ecx
mov ecx, eax
call fcn.00442b10
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0xf
call fcn.00442a70
mov edx, dword [ebp - 0x58]
add edx, 0xfffffff0
or esi, 0xffffffff
mov byte [ebp - 4], 4
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x412593
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 4], 2
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4125b3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edi + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4125d0
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
lea edx, [ebx - 0x10]
or ebx, 0xffffffff
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x412697
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x412697
mov eax, dword [0x520340]
imul eax, eax
and eax, reloc.OLEAUT32.dll_VariantInit
jns 0x4126ab
dec eax
or eax, 0xfffffff8
inc eax
mov esi, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp eax, 5
jne 0x4126c4
push 0
push 0
push 0
push 0
push 0
push 0
call esi
mov eax, dword [ebp - 0x78]
test eax, eax
je 0x4126d9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x78], 0
lea ecx, [ebp - 0x4c]
call fcn.004449b0
mov byte [ebp - 4], 0x17
call fcn.004177d0
test al, al
jne 0x4126fc
push 0
push 0
push 0
push 0
push 0
push 0
call esi
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x64], esi
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x18
call fcn.004478c0
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 0x19
jb 0x412734
mov edx, dword [edx]
sub esp, 0x18
mov edi, esp
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp byte [edx], 0
jne 0x412753
xor ecx, ecx
jmp 0x41276a
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x68], eax
jmp 0x412760
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412760
sub ecx, dword [ebp - 0x68]
push ecx
push edx
mov ecx, edi
call fcn.00401460
lea eax, [ebp - 0x7c]
push eax
call fcn.0044ee90
add esp, 0x1c
mov ecx, dword [eax]
lea edi, [esi - 0x10]
lea edx, [ecx - 0x10]
mov byte [ebp - 4], 0x1a
cmp edx, edi
je 0x4127d7
cmp dword [edi + 0xc], 0
lea esi, [edi + 0xc]
jl 0x4127c8
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x4127c8
push edx
call fcn.00404840
add esp, 4
mov dword [ebp - 0x68], eax
mov ecx, ebx
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x4127c0
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x68]
lea esi, [eax + 0x10]
mov dword [ebp - 0x64], esi
jmp 0x4127d7
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x64]
call fcn.00409950
mov esi, dword [ebp - 0x64]
mov edx, dword [ebp - 0x7c]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x19
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4127f7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x18], 0x10
mov byte [ebp - 4], 0x18
jb 0x41280c
push dword [ebp - 0x2c]
call fcn.004a5bbe
add esp, 4
mov edi, dword [ebp - 0x94]
mov eax, 8
mov word [edi], ax
push dword [esi - 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x41282d
call fcn.0040c2e0
add esi, 0xfffffff0
mov dword [edi + 8], eax
mov byte [ebp - 4], 0x17
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x41284b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x34], 0x10
mov byte [ebp - 4], 0
mov dword [ebp - 0x4c], 0x4d9684
jb 0x412867
push dword [ebp - 0x48]
call fcn.004a5bbe
add esp, 4
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
call fcn.00444ab0
lea ecx, [ebp - 0xa4]
mov dword [ebp - 4], 0xffffffff
call fcn.00442a70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a63c4
mov esp, ebp
pop ebp
ret