Function at 0x404690
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491820
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc8
push ebx
push esi
push edi
push 0x180
mov dword [ebp - 0x10], ecx
call fcn.0046d49f
mov esi, eax
mov dword [ebp - 0x2c], esi
push 0x180
push 0
push esi
mov dword [ebp - 4], 0
call fcn.00470f10
add esp, 0x10
mov ecx, esi
call fcn.00413270
mov dword [esi + 0xf0], 0
lea eax, [esi + 0xf8]
mov dword [esi + 0xf4], 0
lea ecx, [eax + 8]
mov dword [ecx + 0x10], 0
lea edi, [eax + 0x20]
mov dword [ecx + 0x14], 7
xor edx, edx
mov word [ecx], dx
mov dword [edi + 0x10], edx
mov dword [edi + 0x14], 7
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov word [edi], cx
mov dword [eax + 0x50], ecx
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x60], ecx
mov byte [eax + 0x64], cl
mov dword [esi + 0x160], ecx
mov dword [esi + 0x164], ecx
mov dword [esi + 0x168], ecx
mov dword [ebp - 0x5c], eax
mov dword [esi + 0x170], ecx
mov dword [esi + 0x174], ecx
mov dword [esi + 0x178], ecx
mov byte [esi + 0x17c], cl
mov dword [ebp - 0x14], esi
push 0x10
mov dword [ebp - 4], 1
call fcn.0046d49f
mov ebx, eax
xorps xmm0, xmm0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], ebx
movq qword [ebx], xmm0
mov dword [ebx + 8], 0
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov dword [ebx], 0x4b3d0c
mov dword [ebx + 0xc], esi
sub esp, 0x14
mov dword [ebp - 4], 2
mov ecx, esp
push dword [ebp + 0xc]
call fcn.00402dc0
lea ecx, [ebp - 0x50]
call fcn.00402af0
add esp, 0x18
mov ecx, edi
push eax
call fcn.004095f0
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x404804
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4047fa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4057a5
push edx
push ecx
call fcn.0046d4cf
add esp, 8
mov edx, edi
lea ecx, [ebp - 0x50]
call fcn.00402440
mov ecx, dword [ebp - 0x28]
push eax
call fcn.004095f0
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x404851
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404847
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4057aa
push edx
push ecx
call fcn.0046d4cf
add esp, 8
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x178], eax
test ecx, ecx
je 0x404875
mov al, byte [ebp + 0x18]
xor al, 1
movzx eax, al
push eax
push ecx
push ecx
mov ecx, esi
call fcn.00413780
jmp 0x404885
shr eax, 0xf
mov ecx, esi
and al, 1
push eax
push dword [ebp + 0xc]
call fcn.004135b0
mov edi, eax
test edi, edi
jns 0x4048a1
push 0
mov ecx, esi
call fcn.00413830
mov esi, dword [ebp + 8]
mov dword [esi], edi
or edi, 0xffffffff
jmp 0x404d56
or edi, 0xffffffff
test dword [ebp + 0x1c], 0x100
jne 0x404920
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
xor eax, eax
add ecx, 0x10
cmp byte [esi + 0xd], al
setne al
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
call fcn.0040e8d0
cmp dword [ebp - 0x18], 0
je 0x4048fb
push 0
mov ecx, esi
call fcn.00413830
mov esi, dword [ebp + 8]
or edi, edi
mov eax, dword [ebp - 0x18]
mov dword [esi], 0
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 8], eax
mov byte [esi + 0xc], 1
jmp 0x404d6d
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x404920
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x404920
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x14]
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x404920
mov eax, dword [ecx]
call dword [eax + 4]
mov dl, byte [esi + 0xd]
mov ecx, dword [ebp - 0x10]
test dl, dl
jne 0x40494d
mov eax, dword [ecx]
mov eax, dword [eax + 8]
mov al, byte [eax + 0xd]
test al, al
jne 0x40494d
push 0
mov ecx, esi
call fcn.00413830
mov esi, dword [ebp + 8]
mov dword [esi], 0xc0000359
jmp 0x404d56
xor eax, eax
test dl, dl
setne al
mov dword [esi + 0x134], eax
mov eax, dword [ebp + 0x1c]
test al, 0x20
je 0x40496f
push dword [esi + 0x28]
push ecx
call fcn.004091e0
jmp 0x404b5f
test al, 0x10
je 0x404b5f
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
call fcn.00403a50
mov dword [ebp + 0x18], eax
lea ecx, [ebp - 0x50]
xor eax, eax
mov dword [ebp - 0x40], 0
push eax
push 0x4aa71c
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.00402f30
mov ecx, dword [ebp + 0x18]
mov byte [ebp - 4], 3
cmp dword [ecx], 0
jle 0x4049ca
xor eax, eax
jmp 0x404a2c
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push 0x4acf2c
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, eax
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0xc], edx
mov ecx, dword [eax]
cmp edx, ecx
je 0x404a07
test ecx, ecx
jle 0x404a03
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
mov ecx, edx
test ecx, ecx
jle 0x404a16
mov dword [eax + 4], 0
xor eax, eax
jmp 0x404a2c
sub esp, 0x18
lea eax, [ebp - 0x50]
mov ecx, esp
push eax
call fcn.00402dc0
mov ecx, dword [ebp + 0x18]
call fcn.00420a00
shr eax, 0x1f
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x3c]
mov dword [ebp + 0x18], eax
cmp edx, 8
jb 0x404a73
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404a66
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4057af
push edx
push ecx
call fcn.0046d4cf
mov eax, dword [ebp + 0x18]
add esp, 8
test al, al
je 0x404a8d
push 0
mov ecx, esi
call fcn.00413830
call fcn.00403a50
mov eax, dword [eax + 4]
jmp 0x404d51
call fcn.00403a50
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
sub esp, 0xc
mov ecx, dword [ecx]
push edx
lea edx, [ebp - 0x24]
push edx
push dword [ecx + 4]
mov ecx, eax
call fcn.00421060
test eax, eax
jns 0x404aef
mov eax, dword [esi + 0x28]
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
call fcn.00403a50
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
sub esp, 0xc
mov ecx, dword [ecx]
push edx
lea edx, [ebp - 0x24]
push edx
push dword [ecx + 4]
mov ecx, eax
call fcn.00421060
mov dword [ebp + 0x18], eax
test eax, eax
js 0x404d45
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x38]
push 1
push 1
push 0x40
push dword [ebp - 0x18]
mov eax, dword [eax]
push dword [ebp - 0x20]
add eax, 0x58
push dword [ebp - 0x24]
push eax
call fcn.00418280
mov ecx, dword [esi + 0xf0]
mov edx, eax
mov eax, dword [edx]
cmp ecx, eax
je 0x404b37
mov dword [esi + 0xf0], eax
mov eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [esi + 0xf4]
mov dword [esi + 0xf4], eax
mov dword [edx + 4], ecx
mov ecx, dword [ebp - 0x34]
mov dword [ebp + 0x18], ecx
test ecx, ecx
je 0x404b5f
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x404b5f
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp + 0x18]
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x404b5f
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esi + 0xf0]
test ecx, ecx
je 0x404b74
mov eax, dword [ecx]
or eax, dword [ecx + 4]
jne 0x404c8d
mov eax, dword [ebp - 0x10]
push 1
push dword [esi + 0x24]
push dword [esi + 0x20]
mov ecx, dword [eax]
lea eax, [ebp - 0x48]
push 0x40
push dword [esi + 0x28]
add ecx, 0x58
push eax
call fcn.0041fb00
mov byte [ebp - 4], 4
cmp dword [ebp - 0x48], 0
jge 0x404c25
push 0
mov ecx, esi
call fcn.00413830
cmp byte [ebp - 0x3c], 0
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x48]
mov dword [esi], eax
movq qword [esi + 4], xmm0
mov dword [esi + 0xc], 0
mov byte [esi + 4], 0
mov byte [esi + 0xc], 0
je 0x404bf6
mov ecx, dword [ebp - 0x40]
mov dword [ebp + 0x18], ecx
test ecx, ecx
je 0x404bf6
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x404bf6
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp + 0x18]
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x404bf6
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
lea ecx, [ebx + 4]
lock xadd dword [ecx], eax
jne 0x405790
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
lea eax, [ebx + 8]
lock xadd dword [eax], edi
dec edi
jne 0x405790
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
jmp 0x405790
mov al, byte [ebp - 0x3c]
test al, al
je 0x4057b4
mov edx, dword [esi + 0xf0]
mov ecx, dword [ebp - 0x44]
cmp edx, ecx
je 0x404c5d
mov dword [esi + 0xf0], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], edx
mov ecx, dword [esi + 0xf4]
mov dword [esi + 0xf4], eax
mov al, byte [ebp - 0x3c]
mov dword [ebp - 0x40], ecx
jmp 0x404c60
mov ecx, dword [ebp - 0x40]
mov dword [ebp + 0x18], ecx
mov byte [ebp - 4], 2
test al, al
je 0x404c8d
test ecx, ecx
je 0x404c8d
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x404c8d
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp + 0x18]
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x404c8d
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x404c9e
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x404cac
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov dword [esi + 0xf8], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0xfc], eax
or ecx, 0x8000
mov eax, dword [esi + 0x28]
mov dword [esi + 0x130], eax
cmp dword [esi + 0x38], 0
cmovne ecx, dword [ebp + 0x1c]
mov dword [ebp + 0x1c], ecx
test ecx, 0x8000
jne 0x404ced
mov ecx, dword [ebp - 0x10]
push esi
call fcn.00407da0
mov dword [ebp + 0x18], eax
test eax, eax
js 0x404d45
sub esp, 8
lea ecx, [ebx + 4]
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
lock inc dword [ecx]
mov ecx, dword [ebp - 0x10]
mov dword [eax], esi
mov dword [eax + 4], ebx
call fcn.00405860
mov dword [ebp + 0x18], eax
test eax, eax
js 0x404d45
sub esp, 8
lea ecx, [ebx + 4]
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
lock inc dword [ecx]
mov ecx, dword [ebp - 0x10]
mov dword [eax], esi
mov dword [eax + 4], ebx
call fcn.00405a70
mov dword [ebp + 0x18], eax
test eax, eax
jns 0x404d9c
push 0
mov ecx, esi
call fcn.00413830
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov dword [esi], eax
xorps xmm0, xmm0
movq qword [esi + 4], xmm0
mov dword [esi + 0xc], 0
mov byte [esi + 4], 0
mov byte [esi + 0xc], 0
mov eax, edi
lea ecx, [ebx + 4]
lock xadd dword [ecx], eax
jne 0x405790
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
lea eax, [ebx + 8]
lock xadd dword [eax], edi
dec edi
jne 0x405790
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
jmp 0x405790
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov eax, dword [ecx + 0x3c]
mov dword [ebp + 0xc], eax
test dword [ebp + 0x1c], 0x100
push ecx
mov byte [ebp - 4], 5
push ecx
je 0x404e2d
lea eax, [ebp - 0xd4]
push eax
call fcn.00410a80
mov esi, eax
push 0x60
mov byte [ebp - 4], 6
call fcn.0046d49f
xorps xmm0, xmm0
mov dword [ebp + 0x18], eax
add esp, 4
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax], 0x4b3d5c
add eax, 0x10
push esi
mov ecx, eax
mov dword [ebp + 0x10], eax
call fcn.0040a960
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
call fcn.004057c0
jmp 0x404f20
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
lea eax, [ebp - 0xd4]
push eax
call fcn.00410a80
lea eax, [ebp - 0xcc]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x84]
call fcn.00402dc0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x6c], eax
lea edx, [ebp - 0xd4]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x18]
call fcn.004114f0
push eax
lea eax, [ebp - 0x84]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [esi + 0x1c]
call fcn.004115b0
mov eax, dword [eax]
mov esi, dword [eax + 0x28]
mov dword [ebp + 0x18], esi
test esi, esi
je 0x404e9d
lock inc dword [esi + 4]
mov esi, dword [eax + 0x28]
mov dword [ebp + 0x18], esi
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
mov dword [ebp + 0x10], eax
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x404ecb
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x404ecb
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x1c]
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x404ecb
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x70]
cmp edx, 8
jb 0x404f0c
mov ecx, dword [ebp - 0x84]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404f02
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4057b9
push edx
push ecx
call fcn.0046d4cf
add esp, 8
lea ecx, [ebp - 0xd4]
call fcn.004057c0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], esi
test dword [ebp + 0x1c], 0x20000
jne 0x404f54
cmp dword [ebp + 0xc], 1
jne 0x404f54
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 8]
cmp byte [eax + 0xc], 0
je 0x404f54
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
mov byte [ebp - 0x20], 1
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
jmp 0x404f5f
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x20], 0
push 0
sub esp, 8
mov byte [ebp - 4], 0xa
mov eax, esp
lea ecx, [ebx + 4]
mov dword [eax], 0
mov dword [eax + 4], 0
lock inc dword [ecx]
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov dword [eax], esi
mov dword [eax + 4], ebx
call fcn.00406270
mov dword [ebp - 0x1c], eax
test eax, eax
jns 0x405036
push 0
mov ecx, esi
call fcn.00413830
mov eax, dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x28]
mov ecx, dword [eax]
add ecx, 0x10
call fcn.00410bf0
cmp byte [ebp - 0x20], 0
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov dword [esi], eax
movq qword [esi + 4], xmm0
mov dword [esi + 0xc], 0
mov byte [esi + 4], 0
mov byte [esi + 0xc], 0
je 0x404fe2
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x405007
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x405007
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp + 0x18]
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x405007
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
lea ecx, [ebx + 4]
lock xadd dword [ecx], eax
jne 0x405790
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
lea eax, [ebx + 8]
lock xadd dword [eax], edi
dec edi
jne 0x405790
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
jmp 0x405790
test dword [ebp + 0x1c], 0x4000
jne 0x405113
push 1
sub esp, 8
lea ecx, [ebx + 4]
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
lock inc dword [ecx]
mov ecx, dword [ebp - 0x10]
mov dword [eax], esi
mov dword [eax + 4], ebx
call fcn.00406270
mov dword [ebp - 0x1c], eax
test eax, eax
jns 0x405113
push 0
mov ecx, esi
call fcn.00413830
mov eax, dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x28]
mov ecx, dword [eax]
add ecx, 0x10
call fcn.00410bf0
cmp byte [ebp - 0x20], 0
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov dword [esi], eax
movq qword [esi + 4], xmm0
mov dword [esi + 0xc], 0
mov byte [esi + 4], 0
mov byte [esi + 0xc], 0
je 0x4050bf
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x4050e4
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x4050e4
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp + 0x18]
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x4050e4
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
lea ecx, [ebx + 4]
lock xadd dword [ecx], eax
jne 0x405790
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
lea eax, [ebx + 8]
lock xadd dword [eax], edi
dec edi
jne 0x405790
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
jmp 0x405790
mov byte [ebp - 4], 5
cmp byte [ebp - 0x20], 0
je 0x405126
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
mov eax, dword [ebp + 0x1c]
and eax, 0x10
mov dword [ebp - 0x14], eax
jne 0x405243
lea eax, [ebx + 4]
lock inc dword [eax]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 4], 0xb
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], eax
cmp ecx, eax
je 0x40521c
nop dword [eax]
mov eax, dword [ecx + 0x24]
test eax, 0x20000000
je 0x405186
test eax, eax
jns 0x405175
mov eax, 0x40
jmp 0x40519d
and eax, 0x40000000
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
jmp 0x40519d
test eax, eax
jns 0x405191
mov eax, 4
jmp 0x40519d
test eax, 0x40000000
je 0x4051b7
mov eax, 2
push 0
push dword [ecx + 8]
push dword [ecx + 0xc]
lea ecx, [esi + 0xf0]
push eax
call fcn.00418650
test eax, eax
js 0x40521c
jmp 0x40520a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
add eax, 0x58
mov dword [ebp - 0x60], eax
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x4051d9
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x30], eax
jmp 0x4051ed
xorps xmm0, xmm0
movlpd qword [ebp - 0x58], xmm0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x54], eax
mov edx, dword [ecx + 0xc]
xor eax, eax
add edx, dword [ebp - 0x54]
push 0x4000
push dword [ecx + 8]
adc eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x60]
push eax
push edx
call fcn.0041fb30
mov ecx, dword [ebp - 0x1c]
add ecx, 0x28
mov dword [ebp - 0x1c], ecx
cmp ecx, dword [ebp - 0x20]
jne 0x405160
lea ecx, [ebx + 4]
mov byte [ebp - 4], 5
mov eax, edi
lock xadd dword [ecx], eax
jne 0x405246
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
lea ecx, [ebx + 8]
mov eax, edi
lock xadd dword [ecx], eax
jne 0x405243
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
lea ecx, [ebx + 4]
test dword [ebp + 0x1c], 0x1000
jne 0x40531a
sub esp, 8
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
lock inc dword [ecx]
mov ecx, dword [ebp - 0x10]
mov dword [eax], esi
mov dword [eax + 4], ebx
call fcn.00406ba0
mov dword [ebp - 0x20], eax
test eax, eax
jns 0x40531a
cmp eax, 0xc0000225
je 0x40531a
push 0
mov ecx, esi
call fcn.00413830
mov eax, dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x28]
mov ecx, dword [eax]
add ecx, 0x10
call fcn.00410bf0
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x18]
mov dword [esi], eax
movq qword [esi + 4], xmm0
mov dword [esi + 0xc], 0
mov byte [esi + 4], 0
mov byte [esi + 0xc], 0
test ecx, ecx
je 0x4052eb
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x4052eb
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp + 0x18]
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x4052eb
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
lea ecx, [ebx + 4]
lock xadd dword [ecx], eax
jne 0x405790
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
lea eax, [ebx + 8]
lock xadd dword [eax], edi
dec edi
jne 0x405790
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
jmp 0x405790
sub esp, 8
lea ecx, [ebx + 4]
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
lock inc dword [ecx]
mov ecx, dword [ebp - 0x10]
mov dword [eax], esi
mov dword [eax + 4], ebx
call fcn.00406f80
mov dword [ebp - 0x20], eax
test eax, eax
jns 0x4053d9
push 0
mov ecx, esi
call fcn.00413830
mov eax, dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x28]
mov ecx, dword [eax]
add ecx, 0x10
call fcn.00410bf0
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x18]
mov dword [esi], eax
movq qword [esi + 4], xmm0
mov dword [esi + 0xc], 0
mov byte [esi + 4], 0
mov byte [esi + 0xc], 0
test ecx, ecx
je 0x4053aa
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x4053aa
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp + 0x18]
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x4053aa
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
lea ecx, [ebx + 4]
lock xadd dword [ecx], eax
jne 0x405790
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
lea eax, [ebx + 8]
lock xadd dword [eax], edi
dec edi
jne 0x405790
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
jmp 0x405790
cmp dword [ebp - 0x14], 0
je 0x40548c
mov ecx, dword [ebp - 0x10]
lea eax, [esi + 0xf0]
push eax
call fcn.00409120
mov dword [ebp - 0x14], eax
test eax, eax
jns 0x40548c
push 0
mov ecx, esi
call fcn.00413830
mov eax, dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x28]
mov ecx, dword [eax]
add ecx, 0x10
call fcn.00410bf0
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x18]
mov dword [esi], eax
movq qword [esi + 4], xmm0
mov dword [esi + 0xc], 0
mov byte [esi + 4], 0
mov byte [esi + 0xc], 0
test ecx, ecx
je 0x40545d
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x40545d
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp + 0x18]
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x40545d
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
lea ecx, [ebx + 4]
lock xadd dword [ecx], eax
jne 0x405790
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
lea eax, [ebx + 8]
lock xadd dword [eax], edi
dec edi
jne 0x405790
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
jmp 0x405790
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x4054a0
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov dword [ebp - 0x1c], ecx
jmp 0x4054b1
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x4054c1
xor ecx, ecx
add eax, edx
adc ecx, dword [ebp - 0x1c]
jmp 0x4054cf
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x150], eax
mov eax, dword [ebp + 0x1c]
and al, 2
mov dword [esi + 0x154], ecx
movzx eax, al
neg eax
sbb eax, eax
and eax, 0xff
mov dword [esi + 0x148], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x34]
test ecx, ecx
je 0x405522
push dword [ebp + 0x10]
push dword [eax]
push dword [eax + 0x38]
lea eax, [ebp - 0x40]
push 1
push eax
call ecx
mov eax, dword [ebp - 0x3c]
add esp, 0x14
cmp eax, 0xde
je 0x40551f
mov dword [esi + 0x148], eax
mov eax, dword [ebp - 0x10]
cmp dword [esi + 0x148], 0
je 0x40553f
mov ecx, dword [eax]
lea edx, [esi + 0xf8]
add ecx, 0x1e8
push edx
call fcn.0041b000
test dword [ebp + 0x1c], 0x10000
jne 0x4056e7
lea eax, [ebx + 4]
lock inc dword [eax]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 4], 0xc
cmp byte [esi + 0xd], 0
je 0x40556c
mov eax, dword [esi + 0x18]
add eax, 0xd0
jmp 0x405574
mov eax, dword [esi + 0x14]
add eax, 0xc0
mov eax, dword [eax]
test eax, eax
jne 0x40557f
mov dword [ebp + 0x1c], eax
jmp 0x40558c
push 1
push eax
mov ecx, esi
call fcn.00414380
mov dword [ebp + 0x1c], eax
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x4055a3
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x30], eax
jmp 0x4055b7
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 8]
cdq
mov ecx, eax
mov esi, edx
mov eax, dword [ebp + 0x1c]
cdq
sub eax, ecx
sbb edx, esi
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
adc edx, dword [ebp - 0x30]
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x4056bd
cmp dword [eax + 8], 0
je 0x4056bd
mov esi, dword [ebp - 0x10]
push edx
push dword [ebp - 0x14]
mov ecx, dword [esi]
push dword [ebp - 0x5c]
add ecx, 0x1e8
call fcn.0041b650
mov dword [ebp + 0x1c], eax
mov ecx, edi
mov byte [ebp - 4], 5
lea eax, [ebx + 4]
lock xadd dword [eax], ecx
jne 0x405626
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx]
mov eax, edi
lea ecx, [ebx + 8]
lock xadd dword [ecx], eax
jne 0x405626
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
cmp dword [ebp + 0x1c], 0
jge 0x4056e4
mov ecx, dword [ebp - 0x2c]
push 0
call fcn.00413830
push dword [ebp + 0xc]
mov ecx, dword [esi]
push dword [ebp - 0x28]
add ecx, 0x10
call fcn.00410bf0
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov dword [esi], eax
movq qword [esi + 4], xmm0
mov dword [esi + 0xc], 0
mov byte [esi + 4], 0
mov byte [esi + 0xc], 0
test ecx, ecx
je 0x40568e
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x40568e
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp + 0x18]
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x40568e
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
lea ecx, [ebx + 4]
lock xadd dword [ecx], eax
jne 0x405790
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
lea eax, [ebx + 8]
lock xadd dword [eax], edi
dec edi
jne 0x405790
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
jmp 0x405790
mov byte [ebp - 4], 5
lea ecx, [ebx + 4]
mov eax, edi
lock xadd dword [ecx], eax
jne 0x4056e4
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
mov eax, edi
lea ecx, [ebx + 8]
lock xadd dword [ecx], eax
jne 0x4056e4
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov esi, dword [ebp - 0x2c]
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x4056f8
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x405706
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
lea edx, [esi + 0x160]
push edx
push eax
push ecx
mov ecx, esi
call fcn.00414420
push 0
mov ecx, esi
call fcn.00413830
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x40572d
mov byte [eax + 0x10], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
mov eax, dword [ecx + 4]
cmp eax, dword [ecx + 8]
je 0x405748
mov dword [eax + 4], ebx
xor ebx, ebx
mov dword [eax], esi
add dword [ecx + 4], 8
jmp 0x405755
lea edx, [ebp - 0x68]
push edx
push eax
call fcn.00409e20
mov ebx, dword [ebp - 0x64]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [esi], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 8], eax
mov byte [esi + 0xc], 1
test ebx, ebx
je 0x405790
mov eax, edi
lock xadd dword [ebx + 4], eax
jne 0x405790
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
lock xadd dword [ebx + 8], edi
dec edi
jne 0x405790
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 4]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x18
call fcn.00472aca
call fcn.00472aca
call fcn.00472aca
call fcn.00403950
call fcn.00472aca
int3