Function at 0x41eed0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Delete directory
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58441e
mov eax, dword fs:[0]
push eax
sub esp, 0x3bc
mov eax, dword [0x5ebdb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x3b0]
mov esi, ecx
push eax
mov dword [ebp - 0x314], esi
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
mov dword [ebp - 0x318], ecx
cmp ecx, eax
je 0x4206e3
mov ebx, esi
mov edi, dword [ebp - 0x318]
lea ecx, [ebp - 0x308]
add edi, 8
push ecx
call fcn.0041c2f0
mov dword [ebp - 4], 0
cmp byte [ebp - 0x2e8], 0
jne 0x4206b2
mov esi, dword [ebp - 0x308]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi - 4], 0
lea ecx, [esi - 4]
jl 0x41ef7d
cmp eax, dword [esi - 0x10]
jne 0x41ef7d
lea edi, [esi - 0x10]
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x41efb5
mov ecx, dword [esi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4206fb
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00550da7
add esp, 0x10
add edi, 0x10
mov dword [ebp - 0x324], edi
lea ecx, [ebp - 0x34c]
push ecx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0x34c]
sub eax, dword [ebp - 0x3b0]
mov ecx, dword [ebp - 0x348]
sbb ecx, dword [ebp - 0x3ac]
push 0
push 0x2710
push ecx
push eax
call fcn.00560170
push 0
push 0x3e8
push edx
push eax
call fcn.00560170
mov esi, eax
mov eax, dword [ebx + 0x10]
mov ecx, edx
cdq
cmp ecx, edx
ja 0x420700
jb 0x41f01d
cmp esi, eax
ja 0x420700
mov eax, dword [ebp - 0x300]
cmp dword [eax - 0xc], 0
jl 0x41f048
push str.regkey
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x41f048
sub eax, dword [ebp - 0x300]
sar eax, 1
cmp eax, 0xffffffff
jne 0x41f07f
mov eax, dword [ebp - 0x300]
cmp dword [eax - 0xc], 0
jl 0x41f187
push str.REG_KEY
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x41f187
sub eax, dword [ebp - 0x300]
sar eax, 1
cmp eax, 0xffffffff
je 0x41f187
push str.HKEY_LOCAL_MACHINE
push str.hklm
lea ecx, [ebp - 0x2fc]
call fcn.00404aa0
push str.HKEY_LOCAL_MACHINE
push str.HKLM
lea ecx, [ebp - 0x2fc]
call fcn.00404aa0
push str.HKEY_CURRENT_USER
push str.HKCU
lea ecx, [ebp - 0x2fc]
call fcn.00404aa0
push str.HKEY_CURRENT_USER
push str.hkcu
lea ecx, [ebp - 0x2fc]
call fcn.00404aa0
push 0x5b0bc8
lea ecx, [ebp - 0x358]
call fcn.00401d90
lea edx, [ebp - 0x358]
push edx
lea ecx, [ebp - 0x2fc]
mov byte [ebp - 4], 7
call fcn.0043cb80
test al, al
je 0x41f161
mov eax, dword [ebp - 0x300]
cmp dword [eax - 0xc], 0
jl 0x41f12f
push str.exists
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x41f12f
sub eax, dword [ebp - 0x300]
sar eax, 1
cmp eax, 0xffffffff
je 0x41f12f
mov byte [ebp - 0x2e8], 1
mov eax, dword [ebp - 0x2f4]
cmp dword [eax - 0xc], 0
jl 0x41f161
push str.exists
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x41f161
sub eax, dword [ebp - 0x2f4]
sar eax, 1
cmp eax, 0xffffffff
je 0x41f161
mov byte [ebp - 0x2e8], 1
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x358]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f187
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x300]
cmp dword [eax - 0xc], 0
jl 0x41f1b2
push str.regvalue
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x41f1b2
sub eax, dword [ebp - 0x300]
sar eax, 1
cmp eax, 0xffffffff
jne 0x41f1e9
mov eax, dword [ebp - 0x300]
cmp dword [eax - 0xc], 0
jl 0x41f861
push str.REG_VALUE
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x41f861
sub eax, dword [ebp - 0x300]
sar eax, 1
cmp eax, 0xffffffff
je 0x41f861
push 0x5b0bc8
lea ecx, [ebp - 0x2e0]
call fcn.00401d90
lea ecx, [ebp - 0x2e0]
push ecx
lea ecx, [ebp - 0x2fc]
mov byte [ebp - 4], 8
call fcn.0043d9c0
test al, al
je 0x41f83b
mov esi, dword [ebp - 0x2f4]
mov ecx, str.equals
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41f24a
test dx, dx
je 0x41f246
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41f24a
add eax, 4
add ecx, 4
test dx, dx
jne 0x41f224
xor eax, eax
jmp 0x41f24f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41f2af
mov ecx, dword [ebp - 0x2f0]
test ecx, ecx
setne al
test eax, eax
je 0x42087b
mov eax, dword [ebp - 0x2e0]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41f296
test dx, dx
je 0x41f292
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41f296
add eax, 4
add ecx, 4
test dx, dx
jne 0x41f270
xor eax, eax
jmp 0x41f29b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41f83b
mov byte [ebp - 0x2e8], 1
jmp 0x41f83b
cmp dword [esi - 0xc], 0
jl 0x41f83b
push str.contains
push esi
call fcn.0055125b
mov esi, dword [ebp - 0x2f4]
add esp, 8
test eax, eax
je 0x41f40d
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x41f40d
mov eax, dword [ebp - 0x2f0]
test eax, eax
je 0x41f328
mov ecx, dword [ebp - 0x2e0]
cmp dword [ecx - 0xc], 0
jl 0x41f328
push eax
push ecx
call fcn.0055125b
add esp, 8
test eax, eax
je 0x41f322
sub eax, dword [ebp - 0x2e0]
sar eax, 1
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x2f0]
je 0x41f328
mov byte [ebp - 0x2e8], 1
jmp 0x41f328
mov eax, dword [ebp - 0x2f0]
mov edx, dword [eax - 0xc]
lea ecx, [edx - 1]
test ecx, ecx
js 0x420885
cmp ecx, edx
jg 0x420885
cmp word [eax + ecx*2], 0x2a
jne 0x41f83b
add eax, 0xfffffff0
push eax
call fcn.00405320
add eax, 0x10
add esp, 4
mov dword [ebp - 0x2dc], eax
mov bl, 9
mov byte [ebp - 4], bl
mov eax, dword [eax - 0xc]
dec eax
push eax
lea edx, [ebp - 0x39c]
push edx
lea ecx, [ebp - 0x2dc]
call fcn.0041ba20
push eax
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0xa
call fcn.004050b0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x39c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f3af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x2dc]
test esi, esi
je 0x41f3e4
mov eax, dword [ebp - 0x2e0]
cmp dword [eax - 0xc], 0
jl 0x41f3e4
push esi
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x41f3e4
sub eax, dword [ebp - 0x2e0]
sar eax, 1
jne 0x41f3e4
mov byte [ebp - 0x2e8], 1
lea eax, [esi - 0x10]
mov byte [ebp - 4], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f83b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41f83b
cmp dword [esi - 0xc], 0
jl 0x41f83b
push str.greater
push esi
call fcn.0055125b
add esp, 8
test eax, eax
je 0x41f83b
sub eax, dword [ebp - 0x2f4]
sar eax, 1
cmp eax, 0xffffffff
je 0x41f83b
mov eax, dword [ebp - 0x2e0]
add eax, 0xfffffff0
push eax
call fcn.00405320
lea esi, [eax + 0x10]
add esp, 4
mov dword [ebp - 0x2dc], esi
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x2f0]
add eax, 0xfffffff0
push eax
call fcn.00405320
add eax, 0x10
add esp, 4
mov dword [ebp - 0x2e4], eax
mov byte [ebp - 4], 0xc
mov edi, dword [esi - 0xc]
dec edi
mov dword [ebp - 0x4c], 0x64636261
mov dword [ebp - 0x48], 0x68676665
mov dword [ebp - 0x44], 0x6c6b6a69
mov dword [ebp - 0x40], 0x706f6e6d
mov dword [ebp - 0x3c], 0x74737271
mov dword [ebp - 0x38], 0x78777675
mov dword [ebp - 0x34], 0x41417a79
mov dword [ebp - 0x30], 0x46454443
mov dword [ebp - 0x2c], 0x4a494847
mov dword [ebp - 0x28], 0x4e4d4c4b
mov dword [ebp - 0x24], 0x5251504f
mov dword [ebp - 0x20], 0x56555453
mov dword [ebp - 0x1c], 0x5a595857
mov dword [ebp - 0x18], 0x7b2d2928
mov dword [ebp - 0x14], 0x5c5d5b7d
js 0x41f61a
mov dword [ebp - 0x31c], 0
lea esp, [esp]
test edi, edi
js 0x420885
cmp edi, dword [esi - 0xc]
jg 0x420885
mov ecx, dword [ebp - 0x31c]
movzx eax, word [esi + edi*2]
movsx edx, byte [ebp + ecx - 0x4c]
cmp eax, edx
jne 0x41f5fd
mov eax, dword [esi - 0xc]
sub eax, edi
inc eax
push eax
lea ecx, [edi + 1]
push ecx
lea edx, [ebp - 0x38c]
push edx
lea ecx, [ebp - 0x2dc]
call fcn.00404fd0
mov esi, eax
push edi
push 0
lea eax, [ebp - 0x3a4]
push eax
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0xd
call fcn.00404fd0
push esi
push eax
lea ecx, [ebp - 0x378]
mov bl, 0xe
push ecx
mov byte [ebp - 4], bl
call fcn.0041bac0
add esp, 0xc
push eax
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0xf
call fcn.004050b0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x378]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f5ab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x3a4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f5d1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x38c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f5f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x2dc]
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp eax, 0x3c
jb 0x41f500
dec edi
jns 0x41f4ef
mov eax, dword [esi - 0xc]
xor edi, edi
mov dword [ebp - 0x31c], edi
cmp eax, edi
jle 0x41f73f
test edi, edi
js 0x420885
cmp edi, eax
jg 0x420885
cmp word [esi + edi*2], 0x2e
jne 0x41f733
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp eax, 1
jle 0x41f733
mov esi, dword [esi - 0xc]
sub esi, edi
inc esi
push esi
lea ecx, [edi + 1]
push ecx
lea edx, [ebp - 0x390]
push edx
lea ecx, [ebp - 0x2dc]
call fcn.00404fd0
mov esi, eax
push edi
push 0
lea eax, [ebp - 0x368]
push eax
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0x10
call fcn.00404fd0
push esi
push eax
lea ecx, [ebp - 0x364]
mov bl, 0x11
push ecx
mov byte [ebp - 4], bl
call fcn.0041bac0
add esp, 0xc
push eax
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0x12
call fcn.004050b0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x364]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f6e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x368]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f707
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x390]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f72d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x2dc]
mov eax, dword [esi - 0xc]
inc edi
cmp edi, eax
jl 0x41f62d
mov ecx, dword [ebp - 0x2e4]
mov eax, dword [ecx - 0xc]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push eax
push ecx
call ebx
test eax, eax
je 0x4206fb
mov edi, 0xf423f
xor ecx, ecx
cmp word [eax + ecx*2], 0
je 0x41f774
mov dl, byte [eax + ecx*2]
mov byte [ebp + ecx - 0xd0], dl
jmp 0x41f77e
xor edi, edi
mov byte [ebp + ecx - 0xd0], 0
inc ecx
cmp ecx, edi
jb 0x41f761
lea eax, [ebp - 0xd0]
push eax
call fcn.00551a7d
fstp qword [ebp - 0x320]
mov eax, dword [esi - 0xc]
add esp, 4
push eax
push esi
call ebx
test eax, eax
je 0x4206fb
mov edi, 0xf423f
xor ecx, ecx
mov edi, edi
cmp word [eax + ecx*2], 0
je 0x41f7c3
mov dl, byte [eax + ecx*2]
mov byte [ebp + ecx - 0x90], dl
jmp 0x41f7cd
xor edi, edi
mov byte [ebp + ecx - 0x90], 0
inc ecx
cmp ecx, edi
jb 0x41f7b0
lea eax, [ebp - 0x90]
push eax
call fcn.00551a7d
fcomp qword [ebp - 0x320]
add esp, 4
fnstsw ax
test ah, 0x41
jne 0x41f7f5
mov byte [ebp - 0x2e8], 1
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x2e4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f81b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 0xfffffff0
mov byte [ebp - 4], 8
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f83b
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2e0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f861
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x300]
cmp dword [eax - 0xc], 0
jl 0x41f88c
push str.file
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x41f88c
sub eax, dword [ebp - 0x300]
sar eax, 1
cmp eax, 0xffffffff
jne 0x41f8c3
mov eax, dword [ebp - 0x300]
cmp dword [eax - 0xc], 0
jl 0x41fdeb
push str.FILE
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x41fdeb
sub eax, dword [ebp - 0x300]
sar eax, 1
cmp eax, 0xffffffff
je 0x41fdeb
mov eax, dword [ebp - 0x2fc]
cmp dword [eax - 0xc], 0
jge 0x41f8d7
or edi, 0xffffffff
jmp 0x41fab9
push str.ff
push eax
call fcn.0055125b
add esp, 8
test eax, eax
jne 0x41f8f1
or edi, 0xffffffff
jmp 0x41fab9
sub eax, dword [ebp - 0x2fc]
sar eax, 1
mov edi, eax
cmp edi, 0xffffffff
je 0x41fab9
push str._appdata_
lea ecx, [ebp - 0x354]
call fcn.00401d90
push 0x104
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x354]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push str.extensions.sqlite
lea ecx, [ebp - 0x35c]
call fcn.00401d90
xor eax, eax
mov dword [ebp - 0x388], eax
mov dword [ebp - 0x384], eax
mov dword [ebp - 0x380], eax
lea eax, [ebp - 0x2d8]
push eax
lea ecx, [ebp - 0x398]
mov byte [ebp - 4], 0x15
call fcn.00401d90
lea ecx, [ebp - 0x388]
push ecx
lea edx, [ebp - 0x35c]
push edx
push eax
lea ecx, [ebp - 0x33d]
mov byte [ebp - 4], 0x16
call fcn.00428b50
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x398]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f9af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x384]
sub ecx, dword [ebp - 0x388]
sar ecx, 2
test ecx, ecx
je 0x41fa5e
mov edx, dword [ebp - 0x2fc]
mov eax, dword [edx - 0xc]
sub eax, edi
sub eax, 4
push eax
lea eax, [ebp - 0x3a8]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.0041b9a0
mov bl, 0x17
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x388]
push eax
push ecx
lea edx, [ebp - 0x3a0]
push edx
call fcn.0041bac0
add esp, 0xc
push eax
lea ecx, [ebp - 0x2fc]
mov byte [ebp - 4], 0x18
call fcn.004050b0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x3a0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fa38
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x3a8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fa5e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ebx, [ebp - 0x388]
mov byte [ebp - 4], 0x14
call fcn.00421fc0
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x35c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fa93
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x354]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fab9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x2fc]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi - 4], 0
lea ecx, [esi - 4]
jl 0x41fae5
cmp eax, dword [esi - 0x10]
jne 0x41fae5
lea ebx, [esi - 0x10]
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x41fb1d
mov ecx, dword [esi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
je 0x4206fb
mov eax, dword [esi - 0xc]
mov dword [ebx + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [ebx + 0x10]
push eax
call fcn.00550da7
add esp, 0x10
add ebx, 0x10
mov dword [ebp - 0x31c], ebx
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x2fc]
cmp dword [eax - 0xc], 0
jl 0x41fd4e
push 0x5b097c
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x41fd4e
sub eax, dword [ebp - 0x2fc]
sar eax, 1
mov esi, eax
cmp esi, 0xffffffff
je 0x41fd4e
cmp edi, 0xffffffff
jne 0x41fd4e
push esi
lea ecx, [ebp - 0x370]
push ecx
lea ecx, [ebp - 0x2fc]
call fcn.0041ba20
push eax
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 0x1a
call fcn.004050b0
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x370]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41fbb4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x2fc]
mov eax, dword [ecx - 0xc]
sub eax, esi
sub eax, 2
push eax
lea edx, [ebp - 0x36c]
push edx
lea ecx, [ebp - 0x2fc]
call fcn.0041b9a0
push eax
lea ecx, [ebp - 0x2fc]
mov byte [ebp - 4], 0x1b
call fcn.004050b0
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x36c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fc0b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebp - 0x31c]
push 0x104
lea ecx, [ebp - 0x2d8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x5b38c8
lea ecx, [ebp - 0x338]
call fcn.00401d90
mov esi, eax
lea eax, [ebp - 0x2d8]
push eax
lea ecx, [ebp - 0x344]
mov byte [ebp - 4], 0x1c
call fcn.00401d90
push esi
push eax
lea ecx, [ebp - 0x394]
push ecx
mov byte [ebp - 4], 0x1d
call fcn.0041bac0
add esp, 0xc
lea edx, [ebp - 0x2fc]
push edx
push eax
lea eax, [ebp - 0x374]
mov bl, 0x1e
push eax
mov byte [ebp - 4], bl
call fcn.0041bac0
add esp, 0xc
push eax
lea ecx, [ebp - 0x2fc]
mov byte [ebp - 4], 0x1f
call fcn.004050b0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x374]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fcb2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0x394]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fcd8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp - 0x344]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fcfe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x338]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fd24
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x5b097c
push 0x5b38c8
lea ecx, [ebp - 0x2fc]
call fcn.00404aa0
push 0x5b38c8
push 0x5b097c
lea ecx, [ebp - 0x2fc]
call fcn.00404aa0
mov eax, dword [ebp - 0x2f4]
mov ecx, str.exists
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41fd86
test dx, dx
je 0x41fd82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41fd86
add eax, 4
add ecx, 4
test dx, dx
jne 0x41fd60
xor eax, eax
jmp 0x41fd8b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41fdc5
mov ecx, dword [ebp - 0x2fc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41fdc5
mov eax, dword [ebp - 0x2fc]
lea edx, [ebp - 0x34]
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x41fdbe
cmp dword [ebp - 0x14], 0
je 0x41fdc5
mov byte [ebp - 0x2e8], 1
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x31c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fdeb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x300]
cmp dword [eax - 0xc], 0
jl 0x41fe16
push str.user
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x41fe16
sub eax, dword [ebp - 0x300]
sar eax, 1
cmp eax, 0xffffffff
jne 0x41fe4d
mov eax, dword [ebp - 0x300]
cmp dword [eax - 0xc], 0
jl 0x41ff8a
push str.USER
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x41ff8a
sub eax, dword [ebp - 0x300]
sar eax, 1
cmp eax, 0xffffffff
je 0x41ff8a
mov eax, dword [ebp - 0x2f4]
mov ecx, str.equals
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41fe7e
test dx, dx
je 0x41fe7a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41fe7e
add eax, 4
add ecx, 4
test dx, dx
jne 0x41fe58
xor eax, eax
jmp 0x41fe83
sbb eax, eax
sbb eax, 0xffffffff
mov esi, dword [ebp - 0x2f0]
test eax, eax
jne 0x41fef0
cmp dword [esi - 0xc], eax
jl 0x41fef0
push str.admin
push esi
call fcn.0055125b
mov esi, dword [ebp - 0x2f0]
add esp, 8
test eax, eax
je 0x41feb3
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
jne 0x41feda
cmp dword [esi - 0xc], 0
jl 0x41fef0
push str.ADMIN
push esi
call fcn.0055125b
mov esi, dword [ebp - 0x2f0]
add esp, 8
test eax, eax
je 0x41fef0
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x41fef0
call fcn.0043e670
mov esi, dword [ebp - 0x2f0]
test eax, eax
je 0x41fef0
mov byte [ebp - 0x2e8], 1
mov eax, dword [ebp - 0x2f4]
mov ecx, str.notequals
jmp 0x41ff00
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41ff26
test dx, dx
je 0x41ff22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41ff26
add eax, 4
add ecx, 4
test dx, dx
jne 0x41ff00
xor eax, eax
jmp 0x41ff2b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41ff8a
cmp dword [esi - 0xc], eax
jl 0x41ff8a
push str.admin
push esi
call fcn.0055125b
mov esi, dword [ebp - 0x2f0]
add esp, 8
test eax, eax
je 0x41ff55
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
jne 0x41ff7a
cmp dword [esi - 0xc], 0
jl 0x41ff8a
push str.ADMIN
push esi
call fcn.0055125b
add esp, 8
test eax, eax
je 0x41ff8a
sub eax, dword [ebp - 0x2f0]
sar eax, 1
cmp eax, 0xffffffff
je 0x41ff8a
call fcn.0043e670
test eax, eax
jne 0x41ff8a
mov byte [ebp - 0x2e8], 1
mov eax, dword [ebp - 0x300]
cmp dword [eax - 0xc], 0
jl 0x41ffb5
push 0x5b3c0c
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x41ffb5
sub eax, dword [ebp - 0x300]
sar eax, 1
cmp eax, 0xffffffff
jne 0x41ffec
mov eax, dword [ebp - 0x300]
cmp dword [eax - 0xc], 0
jl 0x42031d
push 0x5b3c14
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x42031d
sub eax, dword [ebp - 0x300]
sar eax, 1
cmp eax, 0xffffffff
je 0x42031d
lea ecx, [ebp - 0x3c4]
push ecx
call fcn.00422a30
mov byte [ebp - 4], 0x20
mov edx, dword [ebp - 0x2fc]
cmp dword [edx - 0xc], 0
jle 0x4202d5
push 0x5b0bc8
lea ecx, [ebp - 0x32c]
call fcn.00401d90
push 0x5b0bc8
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 0x21
call fcn.00401d90
lea eax, [ebp - 0x328]
push eax
lea ecx, [ebp - 0x32c]
push ecx
lea edx, [ebp - 0x2fc]
lea ecx, [ebp - 0x3c4]
mov byte [ebp - 4], 0x22
call fcn.00423d80
test al, al
je 0x420289
mov eax, dword [ebp - 0x2ec]
add eax, 0xfffffff0
push eax
call fcn.00405320
add eax, 0x10
add esp, 4
mov dword [ebp - 0x2dc], eax
push 0x5b097c
lea edx, [ebp - 0x32c]
push edx
lea eax, [ebp - 0x330]
push eax
mov byte [ebp - 4], 0x23
call fcn.0041bb80
add esp, 0xc
lea ecx, [ebp - 0x2dc]
push ecx
push eax
lea edx, [ebp - 0x334]
mov bl, 0x24
push edx
mov byte [ebp - 4], bl
call fcn.0041bac0
add esp, 0xc
push eax
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0x25
call fcn.004050b0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x334]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4200e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x23
mov eax, dword [ebp - 0x330]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42010c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x5b097c
push 0x5b38c8
lea ecx, [ebp - 0x2dc]
call fcn.00404aa0
push 0x5b0bc8
lea ecx, [ebp - 0x360]
mov dword [ebp - 0x2e4], 0xffffffff
call fcn.00401d90
lea ecx, [ebp - 0x2e4]
push ecx
mov bl, 0x26
lea edx, [ebp - 0x360]
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], bl
call fcn.0043c280
test al, al
je 0x420230
mov eax, dword [ebp - 0x2e4]
push 0xa
lea edx, [ebp - 0x30]
push edx
push eax
call fcn.0056ee1a
add esp, 0xc
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x33c]
call fcn.0041b840
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0x2f4]
mov ecx, str.exists
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4201b9
test dx, dx
je 0x4201b5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4201b9
add eax, 4
add ecx, 4
test dx, dx
jne 0x420193
xor eax, eax
jmp 0x4201be
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4201ee
push str.equals
lea ecx, [ebp - 0x2f4]
call fcn.0041b8e0
test eax, eax
je 0x4201ee
mov edx, dword [ebp - 0x2f0]
push edx
lea ecx, [ebp - 0x33c]
call fcn.0041b8e0
test eax, eax
je 0x42020b
jmp 0x420204
mov eax, dword [ebp - 0x2f0]
push eax
lea ecx, [ebp - 0x33c]
call fcn.0041b8e0
test eax, eax
jne 0x42020b
mov byte [ebp - 0x2e8], 1
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x33c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420230
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x32c]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov byte [ebp - 4], 0x23
mov eax, dword [ebp - 0x360]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x420263
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x22
mov eax, dword [ebp - 0x2dc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420289
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x328]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4202af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x32c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4202d5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x3c0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4202fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x3c4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42031d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x300]
cmp dword [eax - 0xc], 0
jl 0x420348
push str.browser
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x420348
sub eax, dword [ebp - 0x300]
sar eax, 1
cmp eax, 0xffffffff
jne 0x42037f
mov eax, dword [ebp - 0x300]
cmp dword [eax - 0xc], 0
jl 0x420401
push str.BROWSER
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x420401
sub eax, dword [ebp - 0x300]
sar eax, 1
cmp eax, 0xffffffff
je 0x420401
push 0x5b0bc8
lea ecx, [ebp - 0x310]
call fcn.00401d90
lea ecx, [ebp - 0x310]
push ecx
mov byte [ebp - 4], 0x28
call fcn.0041d080
mov eax, dword [ebp - 0x2fc]
test eax, eax
je 0x4203db
mov ecx, dword [ebp - 0x310]
cmp dword [ecx - 0xc], 0
jl 0x4203e1
push eax
push ecx
call fcn.0055125b
add esp, 8
test eax, eax
je 0x4203db
mov ecx, dword [ebp - 0x310]
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x4203e1
mov byte [ebp - 0x2e8], 1
jmp 0x4203e1
mov ecx, dword [ebp - 0x310]
lea eax, [ecx - 0x10]
mov byte [ebp - 4], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x420401
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x300]
cmp dword [eax - 0xc], 0
jl 0x42042c
push 0x5b3c3c
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x42042c
sub eax, dword [ebp - 0x300]
sar eax, 1
cmp eax, 0xffffffff
jne 0x420463
mov eax, dword [ebp - 0x300]
cmp dword [eax - 0xc], 0
jl 0x4204e4
push 0x5b3c44
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x4204e4
sub eax, dword [ebp - 0x300]
sar eax, 1
cmp eax, 0xffffffff
je 0x4204e4
push 0x5b0bc8
lea ecx, [ebp - 0x30c]
call fcn.00401d90
lea esi, [ebp - 0x30c]
mov byte [ebp - 4], 0x29
call fcn.0043e420
mov eax, dword [ebp - 0x2fc]
test eax, eax
je 0x4204be
mov ecx, dword [ebp - 0x30c]
cmp dword [ecx - 0xc], 0
jl 0x4204c4
push eax
push ecx
call fcn.0055125b
add esp, 8
test eax, eax
je 0x4204be
mov ecx, dword [ebp - 0x30c]
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x4204c4
mov byte [ebp - 0x2e8], 1
jmp 0x4204c4
mov ecx, dword [ebp - 0x30c]
lea eax, [ecx - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4204e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x300]
cmp dword [eax - 0xc], 0
jl 0x42050f
push str.bits
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x42050f
sub eax, dword [ebp - 0x300]
sar eax, 1
cmp eax, 0xffffffff
jne 0x420546
mov eax, dword [ebp - 0x300]
cmp dword [eax - 0xc], 0
jl 0x420648
push str.BITS
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x420648
sub eax, dword [ebp - 0x300]
sar eax, 1
cmp eax, 0xffffffff
je 0x420648
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x2e4], 0
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov esi, eax
test esi, esi
je 0x420581
lea ecx, [ebp - 0x2e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x2e4], 0
je 0x4205cb
mov eax, dword [ebp - 0x2fc]
mov ecx, 0x5b3c64
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4205bb
test dx, dx
je 0x4205b7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4205bb
add eax, 4
add ecx, 4
test dx, dx
jne 0x420595
xor eax, eax
jmp 0x4205c0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4205cb
mov byte [ebp - 0x2e8], 1
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x2e4], 0
call ebx
push eax
call edi
mov esi, eax
test esi, esi
je 0x4205fa
lea edx, [ebp - 0x2e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x2e4], 0
jne 0x420648
mov eax, dword [ebp - 0x2fc]
mov ecx, 0x5b3c6c
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x420636
test dx, dx
je 0x420632
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x420636
add eax, 4
add ecx, 4
test dx, dx
jne 0x420610
xor eax, eax
jmp 0x42063b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x420648
mov byte [ebp - 0x2e8], 1
jmp 0x420651
cmp byte [ebp - 0x2e8], 1
jne 0x42068c
mov edi, dword [ebp - 0x314]
mov eax, dword [edi + 0x14]
mov esi, dword [eax]
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x308]
push eax
push ecx
push esi
call fcn.0041c120
mov ecx, dword [edi + 0x18]
mov edx, 0x71c71c6
sub edx, ecx
cmp edx, 1
jb 0x42088f
inc ecx
mov dword [edi + 0x18], ecx
mov dword [esi + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x324]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4206b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x308]
mov dword [ebp - 4], 0xffffffff
call fcn.00406da0
mov ecx, dword [ebp - 0x318]
mov eax, dword [ecx]
mov ebx, dword [ebp - 0x314]
mov dword [ebp - 0x318], eax
cmp eax, dword [ebx + 0x14]
jne 0x41ef28
mov esi, ebx
mov eax, dword [esi + 0x20]
mov ebx, dword [eax]
mov dword [ebp - 0x310], ebx
cmp ebx, eax
je 0x420e84
jmp 0x4208a6
call fcn.004022c0
lea edx, [ebp - 0x328]
push edx
call fcn.00434830
push 0x5b0bc8
lea ecx, [ebp - 0x344]
mov byte [ebp - 4], 2
call fcn.00401d90
mov esi, eax
push 0x5b0f34
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 3
call fcn.00401d90
mov edi, eax
push 0x5b0f34
lea ecx, [ebp - 0x334]
mov byte [ebp - 4], 4
call fcn.00401d90
mov ebx, eax
push 0x5b3ac0
lea ecx, [ebp - 0x330]
mov byte [ebp - 4], 5
call fcn.00401d90
push esi
push edi
push ebx
push eax
mov eax, dword [ebp - 0x314]
add eax, 4
push eax
lea ecx, [ebp - 0x328]
push ecx
mov ecx, 1
mov byte [ebp - 4], 6
call fcn.004392c0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x330]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4207ab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x334]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4207d1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x338]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4207f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x344]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42081d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x328]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420843
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x324]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420869
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x308]
call fcn.00406da0
xor al, al
jmp 0x420e86
push 0x80004005
call fcn.00401090
push 0x80070057
call fcn.00401090
push str.list_T__too_long
call fcn.0056e0f3
lea esp, [esp]
mov ebx, dword [ebp - 0x310]
mov esi, dword [ebx + 8]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi - 4], 0
lea ecx, [esi - 4]
jl 0x4208cf
cmp eax, dword [esi - 0x10]
jne 0x4208cf
lea edi, [esi - 0x10]
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x420907
mov ecx, dword [esi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4206fb
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00550da7
add esp, 0x10
add edi, 0x10
mov dword [ebp - 0x350], edi
mov dword [ebp - 4], 0x2a
mov esi, dword [ebx + 0xc]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi - 4], 0
lea edx, [esi - 4]
jl 0x420940
cmp eax, dword [esi - 0x10]
jne 0x420940
lea edi, [esi - 0x10]
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x420978
mov ecx, dword [esi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4206fb
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00550da7
add esp, 0x10
mov ecx, dword [ebp - 0x310]
mov al, byte [ecx + 0x10]
lea ebx, [edi + 0x10]
mov dword [ebp - 0x34c], ebx
mov byte [ebp - 0x348], al
mov dword [ebp - 4], 0x2b
test al, al
jne 0x420e22
mov ecx, dword [ebx - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
lea esi, [ebx - 0x10]
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x4209c6
cmp eax, dword [esi]
jne 0x4209c6
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x420a01
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4206fb
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00550da7
add esp, 0x10
add edi, 0x10
mov dword [ebp - 0x2dc], edi
mov ecx, dword [ebp - 0x314]
mov byte [ebp - 4], 0x2c
mov eax, dword [ecx + 0x14]
mov edi, dword [eax]
mov dword [ebp - 0x318], edi
cmp edi, eax
je 0x420daa
jmp 0x420a36
mov edi, dword [ebp - 0x318]
lea edx, [ebp - 0x34]
add edi, 8
push edx
call fcn.0041c2f0
mov byte [ebp - 4], 0x2d
mov esi, dword [ebp - 0x34]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
cmp dword [esi - 4], 0
lea ecx, [esi - 4]
jl 0x420a6f
cmp eax, dword [esi - 0x10]
jne 0x420a6f
lea edi, [esi - 0x10]
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x420aa7
mov ecx, dword [esi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4206fb
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00550da7
add esp, 0x10
lea ebx, [edi + 0x10]
mov dword [ebp - 0x324], ebx
mov byte [ebp - 4], 0x2e
call fcn.0046aab1
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x42087b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x2e0], eax
mov ecx, 0x5b1974
mov byte [ebp - 4], 0x2f
test ecx, 0xffff0000
jne 0x420b09
mov edx, ecx
movzx esi, dx
push esi
call fcn.00464815
test eax, eax
je 0x420b1b
push esi
push eax
lea ecx, [ebp - 0x2e0]
call fcn.00401f90
jmp 0x420b1b
push 1
push 0x5b1974
lea ecx, [ebp - 0x2e0]
call fcn.004021b0
mov byte [ebp - 4], 0x30
cmp byte [ebp - 0x14], 0
je 0x420c75
call fcn.0046aab1
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x42087b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x30c], edi
mov ecx, 0x5b1200
mov byte [ebp - 4], 0x31
test ecx, 0xffff0000
jne 0x420b7e
mov edx, ecx
movzx esi, dx
push esi
call fcn.00464815
test eax, eax
je 0x420b96
push esi
push eax
lea ecx, [ebp - 0x30c]
call fcn.00401f90
jmp 0x420b90
push 1
push 0x5b1200
lea ecx, [ebp - 0x30c]
call fcn.004021b0
mov edi, dword [ebp - 0x30c]
mov byte [ebp - 4], 0x32
mov ebx, dword [ebp - 0x2e0]
lea esi, [edi - 0x10]
add ebx, 0xfffffff0
cmp esi, ebx
je 0x420c52
cmp dword [ebx + 0xc], 0
jl 0x420c42
mov ecx, dword [esi]
cmp ecx, dword [ebx]
jne 0x420c42
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x420be3
cmp eax, dword [esi]
jne 0x420be3
mov edi, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x420c1e
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4206fb
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esi + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.00550da7
add esp, 0x10
lea eax, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [eax], edx
dec edx
test edx, edx
jg 0x420c37
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
add edi, 0x10
mov dword [ebp - 0x2e0], edi
jmp 0x420c52
mov eax, dword [edi - 0xc]
push eax
push edi
lea ecx, [ebp - 0x2e0]
call fcn.004021b0
mov byte [ebp - 4], 0x30
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x420c6f
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ebx, dword [ebp - 0x324]
test ebx, ebx
je 0x420d35
mov eax, dword [ebp - 0x2dc]
cmp dword [eax - 0xc], 0
jl 0x420d35
push ebx
push eax
call fcn.0055125b
add esp, 8
test eax, eax
je 0x420d35
sub eax, dword [ebp - 0x2dc]
sar eax, 1
cmp eax, 0xffffffff
je 0x420d35
mov ecx, 0x5b1200
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x420cdd
test dx, dx
je 0x420cd9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x420cdd
add eax, 4
add ecx, 4
test dx, dx
jne 0x420cb7
xor eax, eax
jmp 0x420ce2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x420d35
mov ecx, 0x5b1974
mov eax, ebx
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x420d16
test dx, dx
je 0x420d12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x420d16
add eax, 4
add ecx, 4
test dx, dx
jne 0x420cf0
xor eax, eax
jmp 0x420d1b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x420d35
lea ecx, [ebp - 0x2e0]
push ecx
lea edx, [ebp - 0x34]
push edx
lea edi, [ebp - 0x2dc]
call fcn.00421a10
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0x2e0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420d5b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 0x2d
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420d7b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0x2c
call fcn.00406da0
mov ecx, dword [ebp - 0x318]
mov eax, dword [ecx]
mov edx, dword [ebp - 0x314]
mov dword [ebp - 0x318], eax
cmp eax, dword [edx + 0x14]
jne 0x420a30
mov ebx, dword [ebp - 0x34c]
mov edi, dword [ebp - 0x314]
lea eax, [ebp - 0x2dc]
push eax
mov ecx, edi
call fcn.00420eb0
mov byte [ebp - 0x348], al
cmp al, 1
jne 0x420dfc
mov eax, dword [edi + 0x20]
mov esi, dword [eax]
mov ecx, dword [esi + 4]
push ecx
push esi
lea ecx, [ebp - 0x350]
call fcn.0041c1e0
mov ecx, dword [edi + 0x24]
mov edx, 0x15555554
sub edx, ecx
cmp edx, 1
jb 0x42088f
inc ecx
mov dword [edi + 0x24], ecx
mov dword [esi + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
mov byte [ebp - 4], 0x2b
mov eax, dword [ebp - 0x2dc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420e22
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420e45
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x350]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420e67
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x310]
mov eax, dword [ecx]
mov edx, dword [ebp - 0x314]
mov dword [ebp - 0x310], eax
cmp eax, dword [edx + 0x20]
jne 0x4208a0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550891
mov esp, ebp
pop ebp
ret