Function at 0x40ec70
Capabilities:
Check for peb beingdebugged flag
Check if file exists
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x43e381
mov eax, dword fs:[0]
push eax
mov eax, 0x621c
call fcn.00436370
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x6218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44a2b8]
xor eax, esp
push eax
lea eax, [esp + 0x6230]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6240]
xor ebx, ebx
push 0x40e
mov esi, ecx
lea ecx, [esp + 0x5e22]
push ebx
push ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x50], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x54], ebx
mov word [esp + 0x5e28], bx
call fcn.00429d70
push 0x40e
lea edx, [esp + 0x4ce]
push ebx
push edx
mov word [esp + 0x4d4], bx
call fcn.00429d70
push 0x40e
lea eax, [esp + 0x296a]
push ebx
push eax
mov word [esp + 0x2970], bx
call fcn.00429d70
push 0x40e
lea ecx, [esp + 0x39b6]
push ebx
push ecx
mov word [esp + 0x39bc], bx
call fcn.00429d70
push 0x40e
lea edx, [esp + 0x35b2]
push ebx
push edx
mov word [esp + 0x35b8], bx
call fcn.00429d70
push 0x40e
lea eax, [esp + 0x563e]
push ebx
push eax
mov word [esp + 0x5644], bx
call fcn.00429d70
add esp, 0x48
push 0x40e
lea ecx, [esp + 0x4fea]
push ebx
push ecx
mov word [esp + 0x4ff0], bx
call fcn.00429d70
push 0x40e
lea edx, [esp + 0x5a1e]
push ebx
push edx
mov word [esp + 0x5a24], bx
call fcn.00429d70
push 0x40e
lea eax, [esp + 0x3dba]
push ebx
push eax
mov word [esp + 0x3dc0], bx
call fcn.00429d70
push 0x40e
lea ecx, [esp + 0x49f6]
push ebx
push ecx
mov word [esp + 0x49fc], bx
call fcn.00429d70
push 0x40e
lea edx, [esp + 0x2d92]
push ebx
push edx
mov word [esp + 0x2d98], bx
call fcn.00429d70
push 0x40e
mov word [esp + 0x31ac], bx
push ebx
lea eax, [esp + 0x31b2]
push eax
call fcn.00429d70
add esp, 0x48
push 0x40e
lea ecx, [esp + 0x8d2]
push ebx
push ecx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x2c], ebx
mov word [esp + 0x8d8], bx
call fcn.00429d70
push esi
push 0x441d18
push 0x410
lea edx, [esp + 0x8e4]
push 0x208
push edx
call fcn.00425032
lea eax, [esp + 0x8ec]
add esp, 0x20
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40ee71
sub eax, edx
sar eax, 1
mov esi, 0x5c
cmp word [esp + eax*2 + 0x8ca], si
jne 0x40eeb0
lea eax, [esp + 0x8cc]
push eax
push 0x442790
push 0x410
push 0x208
lea ecx, [esp + 0x4cc]
push ecx
jmp 0x40eecf
lea edx, [esp + 0x8cc]
push edx
push str._sPluginCom.Tencent.QQMusic_binQQMusic
push 0x410
push 0x208
lea eax, [esp + 0x4cc]
push eax
call fcn.00425032
lea eax, [esp + 0x8e0]
add esp, 0x14
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40eee1
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x8ca], si
jne 0x40ef1b
lea ecx, [esp + 0x8cc]
push ecx
push 0x442840
push 0x410
push 0x208
lea edx, [esp + 0x2d6c]
push edx
jmp 0x40ef3a
lea eax, [esp + 0x8cc]
push eax
push str._sPluginCom.Tencent.Qzone_binQQPhotoDrawEx
push 0x410
push 0x208
lea ecx, [esp + 0x2d6c]
push ecx
call fcn.00425032
add esp, 0x14
lea edx, [esp + 0x2d5c]
push edx
push str._sQQPhotoDrawEx.dll
push 0x410
lea eax, [esp + 0x3178]
push 0x208
push eax
call fcn.00425032
lea ecx, [esp + 0x2d70]
push ecx
push 0x441d18
push 0x410
push 0x208
push 0x44e868
call fcn.00425032
lea edx, [esp + 0x4e4]
push edx
push str._sQQMusic.exe
push 0x410
lea eax, [esp + 0x2980]
push 0x208
push eax
call fcn.00425032
lea ecx, [esp + 0x4f8]
push ecx
push str._sQQPlayerSvr.exe
push 0x410
lea edx, [esp + 0x39d4]
push 0x208
push edx
call fcn.00425032
add esp, 0x50
lea eax, [esp + 0x4bc]
push eax
push str._sQzoneMusic.exe
push 0x410
lea ecx, [esp + 0x3588]
push 0x208
push ecx
call fcn.00425032
lea edx, [esp + 0x4d0]
push edx
push str._sQQPlayerProxy.dll
push 0x410
lea eax, [esp + 0x561c]
push 0x208
push eax
call fcn.00425032
lea ecx, [esp + 0x4e4]
push ecx
push str._sQzoneMusic.dll
push 0x410
lea edx, [esp + 0x5018]
push 0x208
push edx
call fcn.00425032
lea eax, [esp + 0x4f8]
push eax
push str._sQQMusicPlayer.dll
push 0x410
lea ecx, [esp + 0x5a54]
push 0x208
push ecx
call fcn.00425032
add esp, 0x50
push 0x44cb80
push str._sprogram_filesTencentQQ2009PluginCom.Tencent.QQMusic_binQQMusic
push 0x410
lea edx, [esp + 0x5e28]
push 0x208
push edx
call fcn.00425032
lea eax, [esp + 0x4d0]
push eax
push str._sQzoneMusic.exe
push 0x410
push 0x208
lea ecx, [esp + 0x3dc0]
push ecx
call fcn.00425032
lea edx, [esp + 0x4e4]
push edx
push str._sQQMusicPlayer.dll
push 0x410
lea eax, [esp + 0x4a00]
push 0x208
push eax
call fcn.00425032
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x3c
lea ecx, [esp + 0x3d9c]
push ecx
call edi
test eax, eax
je 0x40f10c
lea edx, [esp + 0x3d9c]
push edx
call fcn.0040fc70
xor ecx, ecx
add esp, 4
cmp eax, 0x12d
setl cl
mov ebp, 1
mov dword [0x4514dc], ecx
jmp 0x40f117
mov ebp, 1
mov dword [0x4514dc], ebp
lea edx, [esp + 0x49cc]
push edx
call edi
test eax, eax
je 0x40f13e
lea eax, [esp + 0x49cc]
push eax
call fcn.0040fc70
add esp, 4
cmp eax, 0x6a
jge 0x40f21a
mov dword [0x4514e0], ebp
mov dword [esp + 0x20], ebp
mov dword [0x4514e4], ebp
lea ecx, [esp + 0x2c]
push ecx
push 0x20019
push ebx
push str.SOFTWARETencentQQPhotoDrawEx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f1ec
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x4de0]
push eax
lea ecx, [esp + 0x20]
push ecx
push ebx
push str.Version
push edx
mov dword [esp + 0x30], 4
mov dword [esp + 0x34], 0x104
call esi
test eax, eax
jne 0x40f1ec
lea eax, [esp + 0x4ddc]
push eax
call fcn.00425664
add esp, 4
cmp eax, 0x6e
jl 0x40f1ec
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x53f8]
push edx
lea eax, [esp + 0x20]
push eax
push ebx
push str.Install
push ecx
call esi
test eax, eax
jne 0x40f1ec
lea edx, [esp + 0x53f4]
push edx
call edi
test eax, eax
jne 0x40f23d
lea eax, [esp + 0x316c]
push eax
call edi
test eax, eax
je 0x40f237
lea ecx, [esp + 0x316c]
push ecx
call fcn.0040fc70
xor edx, edx
add esp, 4
cmp eax, 0x6e
setl dl
mov dword [0x4514e8], edx
jmp 0x40f23d
cmp dword [0x4514dc], ebp
mov dword [0x4514e0], ebx
je 0x40f144
mov dword [0x4514e4], ebx
jmp 0x40f14e
mov dword [0x4514e8], ebp
push 0x206
lea eax, [esp + 0x2542]
push ebx
push eax
mov word [esp + 0x2548], bx
call fcn.00429d70
push 0x44cb80
push str._sProcDll.dll
push 0x208
lea ecx, [esp + 0x2554]
push 0x104
push ecx
call fcn.00425032
add esp, 0x20
lea edx, [esp + 0x253c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebp, eax
cmp ebp, ebx
mov dword [esp + 0x30], ebp
je 0x40fc42
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.IsProcRunning
push ebp
call esi
push str.WaitKillProcRunning
push ebp
mov dword [esp + 0x20], eax
call esi
push str.WaitKillProcIDRunning
push ebp
mov dword [esp + 0x24], eax
call esi
push str.IsModuleExist
push ebp
mov edi, eax
call esi
cmp dword [esp + 0x18], ebx
mov dword [esp + 0x28], eax
je 0x40fc3b
cmp dword [esp + 0x1c], ebx
je 0x40fc3b
cmp edi, ebx
je 0x40fc3b
cmp eax, ebx
je 0x40fc3b
push 0x207
lea eax, [esp + 0x2749]
push ebx
push eax
mov byte [esp + 0x2750], bl
call fcn.00429d70
push 0x207
lea ecx, [esp + 0x1305]
push ebx
push ecx
mov byte [esp + 0x130c], bl
call fcn.00429d70
push 0x207
lea edx, [esp + 0xcf9]
push ebx
push edx
mov byte [esp + 0xd00], bl
call fcn.00429d70
push 0x207
lea eax, [esp + 0x235d]
push ebx
push eax
mov byte [esp + 0x2364], bl
call fcn.00429d70
push 0x207
lea ecx, [esp + 0x1f59]
push ebx
push ecx
mov byte [esp + 0x1f60], bl
call fcn.00429d70
push 0x207
lea edx, [esp + 0x112d]
push ebx
push edx
mov byte [esp + 0x1134], bl
call fcn.00429d70
add esp, 0x48
push 0x207
lea eax, [esp + 0x1501]
push ebx
push eax
mov byte [esp + 0x1508], bl
call fcn.00429d70
push 0x207
lea ecx, [esp + 0x213d]
push ebx
push ecx
mov byte [esp + 0x2144], bl
call fcn.00429d70
push 0x207
lea edx, [esp + 0xf01]
push ebx
push edx
mov byte [esp + 0xf08], bl
call fcn.00429d70
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0x24
push ebx
push ebx
push 0x208
lea eax, [esp + 0x2138]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x3180]
push ecx
push 0x200
push ebx
call esi
push ebx
push ebx
push 0x208
lea edx, [esp + 0x2750]
push edx
push 0xffffffffffffffff
lea eax, [esp + 0x2960]
push eax
push 0x200
push ebx
call esi
push ebx
push ebx
push 0x208
lea ecx, [esp + 0x1300]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x39a0]
push edx
push 0x200
push ebx
call esi
push ebx
push ebx
push 0x208
lea eax, [esp + 0xce8]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x3590]
push ecx
push 0x200
push ebx
call esi
push ebx
push ebx
push 0x208
lea edx, [esp + 0x1f30]
push edx
push 0xffffffffffffffff
lea eax, [esp + 0x5610]
push eax
push 0x200
push ebx
call esi
push ebx
push ebx
push 0x208
lea ecx, [esp + 0x2340]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x4ff8]
push edx
push 0x200
push ebx
call esi
lea esp, [esp]
push 0x40e
lea eax, [esp + 0x45c2]
push ebx
push eax
mov word [esp + 0x45c8], bx
call fcn.00429d70
push 0x40e
lea ecx, [esp + 0x1b26]
push ebx
push ecx
mov word [esp + 0x1b2c], bx
call fcn.00429d70
push 0x40e
lea edx, [esp + 0xca]
push ebx
push edx
mov word [esp + 0xd0], bx
call fcn.00429d70
push 0x40e
lea eax, [esp + 0x41d6]
push ebx
push eax
xor ebp, ebp
xor esi, esi
mov word [esp + 0x41dc], bx
call fcn.00429d70
push 0x40e
lea ecx, [esp + 0x173a]
push ebx
push ecx
mov word [esp + 0x1740], bx
call fcn.00429d70
add esp, 0x3c
xor edi, edi
cmp dword [esp + 0x20], ebx
je 0x40f6ea
lea edx, [esp + 0x10ec]
push edx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x1f2c]
push ecx
call dword [esp + 0x34]
mov ebp, eax
add esp, 0xc
cmp ebp, ebx
je 0x40f5c6
lea eax, [esp + 0x10ec]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40f576
push 0x208
sub eax, edx
lea edx, [esp + 0x45c0]
push edx
push eax
lea eax, [esp + 0x10f8]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [esp + 0x45bc]
push ecx
push 0x441d18
push 0x410
lea edx, [esp + 0xb8]
push 0x208
push edx
call fcn.00425032
add esp, 0x14
lea eax, [esp + 0x14fc]
push eax
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x233c]
push edx
call dword [esp + 0x34]
mov esi, eax
add esp, 0xc
cmp esi, ebx
je 0x40f6ea
lea eax, [esp + 0x14fc]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40f5f6
push 0x208
lea ecx, [esp + 0x1b18]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x1508]
push edx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0xac]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40f630
sub eax, edx
sar eax, 1
je 0x40f68d
lea eax, [esp + 0x1b14]
lea edx, [eax + 2]
jmp 0x40f650
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40f650
sub eax, edx
sar eax, 1
je 0x40f68d
lea eax, [esp + 0x1b14]
push eax
lea ecx, [esp + 0xb0]
push ecx
push 0x442b6c
push 0x410
mov edx, ecx
push 0x208
push edx
call fcn.00425032
add esp, 0x18
jmp 0x40f6ea
lea eax, [esp + 0xac]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40f697
sub eax, edx
sar eax, 1
jne 0x40f6ea
lea eax, [esp + 0x1b14]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40f6b2
sub eax, edx
sar eax, 1
je 0x40f6ea
lea eax, [esp + 0x1b14]
push eax
push 0x441d18
push 0x410
lea ecx, [esp + 0xb8]
push 0x208
push ecx
call fcn.00425032
add esp, 0x14
lea eax, [esp + 0x294c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40f6f4
sub eax, edx
sar eax, 1
cmp eax, 0x104
ja 0x40f745
lea eax, [esp + 0x294c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40f714
sub eax, edx
sar eax, 1
je 0x40f745
cmp dword [esp + 0x20], ebx
je 0x40f745
push 1
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x274c]
push eax
call dword [esp + 0x24]
add esp, 0xc
mov dword [esp + 0x24], eax
lea eax, [esp + 0xac]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40f750
sub eax, edx
sar eax, 1
je 0x40f790
cmp dword [esp + 0x24], ebx
je 0x40f790
push 0x442b78
lea ecx, [esp + 0xb0]
push ecx
push 0x442b6c
push 0x410
mov edx, ecx
push 0x208
push edx
call fcn.00425032
add esp, 0x18
jmp 0x40f7db
lea eax, [esp + 0xac]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40f7a0
sub eax, edx
sar eax, 1
jne 0x40f7db
cmp dword [esp + 0x24], ebx
je 0x40f7db
push 0x442b78
push 0x441d18
push 0x410
lea eax, [esp + 0xb8]
push 0x208
push eax
call fcn.00425032
add esp, 0x14
cmp dword [0x4514e8], 1
jne 0x40f948
lea ecx, [esp + 0xee4]
push ecx
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x2134]
push eax
call dword [esp + 0x34]
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x40f948
lea eax, [esp + 0xee4]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40f818
push 0x208
lea ecx, [esp + 0x1708]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0xef0]
push edx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x45bc]
push eax
lea ecx, [esp + 0x1708]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40f948
lea edx, [esp + 0x1b14]
push edx
lea eax, [esp + 0x1708]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40f948
lea eax, [esp + 0xac]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40f887
sub eax, edx
sar eax, 1
je 0x40f8df
lea eax, [esp + 0x1704]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40f8a2
sub eax, edx
sar eax, 1
je 0x40f8df
lea ecx, [esp + 0x1704]
push ecx
lea edx, [esp + 0xb0]
push edx
push 0x442b6c
push 0x410
mov eax, edx
push 0x208
push eax
call fcn.00425032
add esp, 0x18
jmp 0x40f948
lea eax, [esp + 0xac]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40f8f0
sub eax, edx
sar eax, 1
jne 0x40f948
lea eax, [esp + 0x1704]
lea edx, [eax + 2]
jmp 0x40f910
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40f910
sub eax, edx
sar eax, 1
je 0x40f948
lea ecx, [esp + 0x1704]
push ecx
push 0x441d18
push 0x410
lea edx, [esp + 0xb8]
push 0x208
push edx
call fcn.00425032
add esp, 0x14
lea ecx, [edi + esi]
add ecx, ebp
add ecx, dword [esp + 0x24]
lea eax, [esp + 0xac]
lea esi, [eax + 2]
jmp 0x40f960
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x40f960
sub eax, esi
sar eax, 1
je 0x40fb2d
cmp ecx, ebx
je 0x40fb2d
lea eax, [esp + 0xac]
push eax
push 0x442b88
push 0x410
lea ecx, [esp + 0x41b8]
push 0x208
push ecx
call fcn.00425032
mov edi, 7
add esp, 0x14
mov dword [esp + 0xa8], edi
mov dword [esp + 0xa4], ebx
mov word [esp + 0x94], bx
mov dword [esp + 0x6238], ebx
push 4
push 0x441834
lea esi, [esp + 0x7c]
mov dword [esp + 0x94], edi
mov dword [esp + 0x90], ebx
mov word [esp + 0x80], bx
call fcn.00401d00
mov byte [esp + 0x6238], 1
lea eax, [esp + 0x41ac]
mov dword [esp + 0x70], edi
mov dword [esp + 0x6c], ebx
mov word [esp + 0x5c], bx
lea edx, [eax + 2]
jmp 0x40fa10
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40fa10
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x41b0]
push edx
lea esi, [esp + 0x60]
call fcn.00401d00
mov eax, esi
push eax
lea ecx, [esp + 0x94]
mov byte [esp + 0x623c], 2
call fcn.00417490
mov esi, 8
add esp, 4
cmp dword [esp + 0x70], esi
jb 0x40fa63
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.004250ac
add esp, 4
mov byte [esp + 0x6238], bl
cmp dword [esp + 0x8c], esi
mov dword [esp + 0x70], edi
mov dword [esp + 0x6c], ebx
mov word [esp + 0x5c], bx
jb 0x40fa8d
mov edx, dword [esp + 0x78]
push edx
call fcn.004250ac
add esp, 4
cmp dword [esp + 0xa8], esi
mov ecx, dword [esp + 0x94]
mov dword [esp + 0x8c], edi
mov dword [esp + 0x88], ebx
mov word [esp + 0x78], bx
jae 0x40fab7
lea ecx, [esp + 0x94]
mov eax, dword [esp + 0x34]
push 0x35
push 0x4418d4
push eax
call fcn.00407d60
add esp, 0xc
cmp eax, 4
jne 0x40fb0f
mov dword [esp + 0x6238], 0xffffffff
cmp dword [esp + 0xa8], esi
jb 0x40faf4
mov ecx, dword [esp + 0x94]
push ecx
call fcn.004250ac
add esp, 4
mov dword [esp + 0xa8], edi
mov dword [esp + 0xa4], ebx
mov word [esp + 0x94], bx
jmp 0x40f4b0
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea esi, [esp + 0x90]
call fcn.00401cd0
xor eax, eax
jmp 0x40fc47
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x18]
mov esi, edi
jmp 0x40fb40
lea eax, [esp + 0x398c]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40fb50
sub eax, edx
sar eax, 1
cmp eax, 0x104
ja 0x40fb9d
lea eax, [esp + 0x398c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40fb70
sub eax, edx
sar eax, 1
je 0x40fb9d
cmp dword [esp + 0x20], ebx
je 0x40fb9d
push 1
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x12fc]
push ecx
call ebp
add esp, 0xc
mov edi, eax
lea eax, [esp + 0x357c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40fba7
sub eax, edx
sar eax, 1
cmp eax, 0x104
ja 0x40fbf4
lea eax, [esp + 0x357c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40fbc7
sub eax, edx
sar eax, 1
je 0x40fbf4
cmp dword [esp + 0x20], ebx
je 0x40fbf4
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0xce4]
push eax
call ebp
add esp, 0xc
mov esi, eax
lea ecx, [esi + edi]
test ecx, ecx
je 0x40fc34
cmp edi, ebx
je 0x40fc13
lea edx, [esp + 0x12f4]
push 0x7d0
push edx
call dword [esp + 0x24]
add esp, 8
cmp esi, ebx
je 0x40fb40
lea eax, [esp + 0xcdc]
push 0x7d0
push eax
call dword [esp + 0x24]
add esp, 8
jmp 0x40fb40
mov ecx, dword [esp + 0x30]
push ecx
jmp 0x40fc3c
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov ecx, dword [esp + 0x6230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x6218]
xor ecx, esp
call fcn.00424e88
add esp, 0x6228
ret