Function at 0x411da0
Capabilities:
Access peb ldr_data
Get disk size
Get kernel32 base address
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x47d2ad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x47c
mov eax, dword [0x4a8ae4]
xor eax, esp
push ebx
push ebp
push esi
mov dword [esp + 0x484], eax
mov eax, dword [esp + 0x498]
push edi
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x4a0]
xor ebx, ebx
mov dword [esp + 0x18], ebx
or edi, 0xffffffff
push 0x20
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x38], edi
call fcn.004620d8
add esp, 4
lea ecx, [esp + 0x48]
mov dword [esp + 0x7c], eax
call fcn.0042c3a0
mov dword [esp + 0x494], ebx
call fcn.004621d7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0x494], 1
call fcn.004621d7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x40], eax
mov esi, 7
mov dword [esp + 0x23c], esi
mov dword [esp + 0x238], ebx
mov word [esp + 0x228], bx
mov dword [esp + 0x31c], esi
mov dword [esp + 0x318], ebx
mov word [esp + 0x308], bx
mov dword [esp + 0x2ac], esi
mov dword [esp + 0x2a8], ebx
mov word [esp + 0x298], bx
mov eax, 0xf
mov dword [esp + 0x274], eax
mov dword [esp + 0x270], ebx
mov byte [esp + 0x260], bl
mov dword [esp + 0x2e4], eax
mov dword [esp + 0x2e0], ebx
mov byte [esp + 0x2d0], bl
mov dword [esp + 0x258], eax
mov dword [esp + 0x254], ebx
mov byte [esp + 0x244], bl
mov dword [esp + 0x300], eax
mov dword [esp + 0x2fc], ebx
mov byte [esp + 0x2ec], bl
mov dword [esp + 0x2c8], eax
mov dword [esp + 0x2c4], ebx
mov byte [esp + 0x2b4], bl
mov dword [esp + 0x290], eax
mov dword [esp + 0x28c], ebx
mov byte [esp + 0x27c], bl
mov byte [esp + 0x494], 0xb
call fcn.0046249e
cmp eax, ebx
je 0x411f28
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x411f2a
xor eax, eax
push eax
lea ecx, [esp + 0xac]
call fcn.00425d80
mov byte [esp + 0x494], 0xc
call fcn.00476002
mov ebp, dword [eax + 4]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x1e8], esi
mov dword [esp + 0x1e4], ebx
mov word [esp + 0x1d4], bx
mov byte [esp + 0x13], bl
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
lea eax, [esp + 0x3e8]
push eax
mov byte [esp + 0x498], 0x10
mov dword [esp + 0x2c], 1
call fcn.004361d0
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x2a0]
mov byte [esp + 0x4a0], 0x11
call fcn.00401f80
mov eax, dword [esp + 0x400]
mov esi, 8
cmp eax, esi
mov byte [esp + 0x494], 0x10
jb 0x411fee
mov ecx, dword [esp + 0x3ec]
push ecx
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x2ac], esi
mov eax, dword [esp + 0x298]
jae 0x412005
lea eax, [esp + 0x298]
lea edx, [esp + 0x304]
push edx
push eax
call fcn.00435fe0
add esp, 8
lea ecx, [esp + 0x20]
mov byte [esp + 0x1f], bl
call fcn.00403ad0
mov eax, dword [esp + 0x23c]
cmp eax, esi
mov ecx, dword [esp + 0x228]
jae 0x41203c
lea ecx, [esp + 0x228]
mov edx, dword [esp + 0x238]
cmp eax, esi
mov eax, dword [esp + 0x228]
lea ecx, [ecx + edx*2]
jae 0x412058
lea eax, [esp + 0x228]
push ecx
push eax
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x230]
call fcn.0040c010
lea ecx, [esp + 0x3e8]
push ecx
mov ecx, dword [esp + 0x30]
call fcn.0042b6f0
cmp dword [eax + 0x18], esi
mov byte [esp + 0x494], 0x12
jb 0x41208e
mov esi, dword [eax + 4]
jmp 0x412091
lea esi, [eax + 4]
cmp esi, ebx
jne 0x412099
xor eax, eax
jmp 0x4120a2
push esi
call fcn.00449da9
add esp, 4
push eax
push esi
lea ecx, [esp + 0x28]
call fcn.004082f0
cmp dword [esp + 0x400], 8
mov byte [esp + 0x494], 0x10
jb 0x4120cf
mov edx, dword [esp + 0x3ec]
push edx
call fcn.004620d3
add esp, 4
mov eax, dword [esp + 0x20]
cmp dword [eax - 4], 1
mov esi, dword [eax - 0xc]
jle 0x4120e9
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [esp + 0x24]
call fcn.00401300
mov edx, dword [esp + 0x20]
push esi
push edx
lea ecx, [esp + 0x22c]
call fcn.00402410
cmp byte [ebp + 0x15a], bl
je 0x41215b
cmp byte [ebp + 0x158], bl
jne 0x41215b
mov eax, dword [ebp + 0x154]
cmp dword [eax - 0xc], 1
lea esi, [ebp + 0x154]
jle 0x41215b
lea ecx, [esp + 0x1d0]
call fcn.0040c0e0
mov ecx, dword [esi]
mov edi, dword [ecx - 0xc]
mov eax, ecx
mov ecx, dword [eax - 4]
sub eax, 0x10
cmp ecx, 1
jle 0x412146
mov edx, dword [eax + 4]
push edx
mov ecx, esi
call fcn.00401300
mov esi, dword [esi]
push edi
push esi
lea ecx, [esp + 0x1d8]
call fcn.00401d60
jmp 0x412335
cmp dword [ebp + 0xdc8], ebx
je 0x412187
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0xdac]
push eax
lea ecx, [esp + 0x1dc]
call fcn.00401f80
mov byte [ebp + 0x158], bl
mov dword [esp + 0x28], 1
cmp byte [ebp + 0x15a], bl
jne 0x4121e3
cmp dword [ebp + 0xdc8], ebx
jne 0x4121e3
mov eax, dword [esp + 0x20]
push ebx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x40], esp
mov esi, esp
push eax
call fcn.00401570
add eax, 0x10
add esp, 4
lea ecx, [esp + 0xb0]
mov dword [esi], eax
call fcn.00425fb0
mov dword [esp + 0x28], eax
cmp dword [ebp + 0xb8], 2
jae 0x4121e3
mov ecx, dword [esp + 0x30]
push 0xf4
mov dword [esp + 0x2c], 2
call fcn.0040e720
mov esi, dword [esp + 0x28]
jmp 0x4121f0
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0xac]
call fcn.004255f0
mov ecx, dword [esp + 0x18]
mov edx, dword [eax]
mov eax, dword [edx - 0xc]
or ecx, 1
cmp eax, ebx
mov dword [esp + 0x18], ecx
jne 0x41223b
mov eax, dword [esp + 0x30]
cmp dword [eax + 0x1e4], ebx
je 0x41223b
cmp byte [ebp + 0x14c], bl
jne 0x41223b
cmp esi, 1
jne 0x41223b
cmp dword [ebp + 0xdc8], ebx
mov byte [esp + 0x27], 1
je 0x41223f
mov byte [esp + 0x27], bl
test byte [esp + 0x18], 1
je 0x41226f
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x38]
and edx, 0xfffffffe
add eax, 0xfffffff0
mov dword [esp + 0x18], edx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41226f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
cmp byte [esp + 0x27], bl
je 0x41232c
mov esi, dword [esp + 0x20]
push 1
push ecx
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x30], esp
mov dword [esp + 0x30], esp
call dword [eax + 0x10]
mov edx, dword [esi + 0xc]
cmp edx, ebx
lea ecx, [esi + 0xc]
jl 0x4122ae
cmp eax, dword [esi]
jne 0x4122ae
mov eax, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x4122e3
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 2
push ecx
mov ecx, eax
call dword [edx]
cmp eax, ebx
je 0x412327
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
lea ecx, [ecx + ecx + 2]
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
add eax, 0x10
mov dword [ecx], eax
lea ecx, [esp + 0xb0]
call fcn.00425fb0
mov esi, eax
cmp dword [ebp + 0xb8], 2
mov dword [esp + 0x28], esi
jae 0x4121f0
mov ecx, dword [esp + 0x30]
mov esi, 2
push 0xf4
mov dword [esp + 0x2c], esi
call fcn.0040e720
jmp 0x4121f0
call fcn.004012f0
cmp esi, 1
jne 0x4124b0
cmp byte [ebp + 0x158], bl
je 0x412491
mov edx, dword [esp + 0x1e8]
cmp edx, 8
mov ecx, dword [esp + 0x1d4]
mov eax, ecx
jae 0x41235d
lea eax, [esp + 0x1d4]
cmp edx, 8
mov esi, dword [esp + 0x1e4]
lea eax, [eax + esi*2]
jae 0x412373
lea ecx, [esp + 0x1d4]
push eax
push ecx
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0x1dc]
call fcn.0040c010
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0xac]
call fcn.004255f0
mov edi, eax
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0xac]
mov byte [esp + 0x498], 0x13
call fcn.004255f0
mov esi, eax
mov eax, dword [esi]
mov ecx, dword [eax - 4]
mov edx, dword [edi]
mov edi, dword [edx - 0xc]
sub eax, 0x10
cmp ecx, 1
mov byte [esp + 0x494], 0x14
jle 0x4123d9
mov eax, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00401300
mov esi, dword [esi]
push edi
push esi
lea ecx, [esp + 0x1d8]
call fcn.00401d60
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov byte [esp + 0x494], 0x13
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41240f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
mov byte [esp + 0x494], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412435
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0xa8]
call fcn.00424ec0
lea ecx, [esp + 0xa8]
call fcn.00424ed0
mov edi, eax
dec edi
neg edi
sbb edi, edi
mov dword [esp + 0x3c], eax
mov al, byte [esp + 0x12c]
and edi, 0x10
lea ecx, [esp + 0xa8]
add edi, 0x10
mov byte [esp + 0x13], al
mov byte [ebp + 0x14c], al
call fcn.00424ed0
mov dword [ebp + 0x150], eax
cmp byte [esp + 0x13], bl
jne 0x41248d
mov byte [ebp + 0x158], bl
xor esi, esi
jmp 0x4124e0
mov edi, dword [ebp + 0x150]
mov al, byte [ebp + 0x14c]
dec edi
neg edi
sbb edi, edi
and edi, 0x10
add edi, 0x10
mov byte [esp + 0x13], al
xor esi, esi
jmp 0x4124e0
cmp esi, 3
mov esi, dword [esp + 0x2c]
mov ecx, esi
call fcn.0042afa0
cmp esi, ebx
je 0x4124d2
mov ecx, esi
call fcn.0042acf0
push esi
call fcn.004620d3
add esp, 4
mov dword [esp + 0x2c], ebx
mov esi, 0x80004005
mov byte [esp + 0x1f], 1
mov eax, dword [esp + 0x1c8]
cmp eax, ebx
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
jne 0x413ab5
mov edx, dword [esp + 0x30]
cmp dword [edx + 0xd70], ebx
jne 0x413ab5
cmp esi, ebx
jne 0x4134bb
lea ecx, [esp + 0x25c]
call fcn.00401c30
lea ecx, [esp + 0x2b0]
call fcn.00401c30
lea ecx, [esp + 0x278]
call fcn.00401c30
mov esi, dword [esp + 0x7c]
xor eax, eax
mov ecx, esi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
lea ecx, [esp + 0x80]
call fcn.0040a730
lea ecx, [esp + 0x4c]
call fcn.0040ca20
mov edx, dword [esp + 0x3c]
push esi
push edx
call fcn.00434d90
add esp, 8
push edi
push esi
lea ecx, [esp + 0x2b8]
call fcn.00402320
push esi
push 1
call fcn.00434d90
add esp, 8
push 0x10
push esi
lea ecx, [esp + 0x280]
call fcn.00402320
lea ecx, [esp + 0x2cc]
call fcn.00401c30
lea ecx, [esp + 0x240]
call fcn.00401c30
lea ecx, [esp + 0x2e8]
call fcn.00401c30
lea ecx, [esp + 0x430]
call fcn.00431d20
push 0x3e8
lea ecx, [esp + 0x434]
mov byte [esp + 0x498], 0x15
call fcn.004313f0
lea ecx, [esp + 0x45c]
call fcn.00431d20
lea ecx, [esp + 0x404]
mov byte [esp + 0x494], 0x16
call fcn.00431d20
mov dword [esp + 0x400], 0xf
mov dword [esp + 0x3fc], ebx
mov byte [esp + 0x3ec], bl
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
cmp dword [esp + 0x1e4], ebx
mov byte [esp + 0x494], 0x19
ja 0x41264f
mov eax, dword [esp + 0x30]
cmp dword [eax + 0x1e4], ebx
jne 0x4126cc
lea ecx, [esp + 0x1d0]
push ecx
lea ecx, [esp + 0x84]
call fcn.004037f0
push 0x3ea
lea ecx, [esp + 0x408]
call fcn.004313f0
sub esp, 0x10
lea edx, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.0040c5e0
push 0x3ed
lea ecx, [esp + 0x418]
call fcn.00431e10
lea ecx, [esp + 0x404]
call fcn.004314d0
lea eax, [esp + 0x2cc]
push eax
lea ecx, [esp + 0x408]
call fcn.00431bc0
lea ecx, [esp + 0x2cc]
push ecx
lea ecx, [esp + 0x50]
call fcn.0040cad0
cmp byte [ebp + 0x374], bl
je 0x4127c3
mov dword [esp + 0x204], 0xf
mov dword [esp + 0x200], ebx
mov byte [esp + 0x1f0], bl
lea edx, [ebp + 0x274]
push edx
lea ecx, [esp + 0x20c]
mov byte [esp + 0x498], 0x1a
call fcn.004027f0
lea eax, [esp + 0x1ec]
push eax
sub esp, 0x1c
lea edx, [esp + 0x228]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov byte [esp + 0x4b8], 0x1b
call fcn.00402090
call fcn.00435140
add esp, 0x20
lea eax, [esp + 0x1ec]
push eax
lea ecx, [esp + 0x60]
call fcn.0040cad0
push 0x3ec
lea ecx, [esp + 0x460]
call fcn.004313f0
lea ecx, [esp + 0x5c]
push ecx
push 0x3ef
lea ecx, [esp + 0x464]
call fcn.004319a0
lea ecx, [esp + 0x45c]
call fcn.004314d0
lea edx, [esp + 0x1ec]
push edx
lea ecx, [esp + 0x460]
call fcn.00431bc0
lea eax, [esp + 0x1ec]
push eax
lea ecx, [esp + 0x50]
call fcn.0040cad0
lea ecx, [esp + 0x208]
call fcn.00401a60
lea ecx, [esp + 0x1ec]
mov byte [esp + 0x494], 0x19
call fcn.00401c00
cmp byte [ebp + 0x375], bl
je 0x412b96
lea ecx, [esp + 0x3a0]
call fcn.00431d20
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
push 0x3eb
lea ecx, [esp + 0x3a4]
mov byte [esp + 0x498], 0x1d
call fcn.004313f0
lea ecx, [esp + 0x320]
call fcn.00431d20
mov dword [esp + 0x204], 0xf
mov dword [esp + 0x200], ebx
mov byte [esp + 0x1f0], bl
lea ecx, [ebp + 0x238]
push ecx
lea ecx, [esp + 0x388]
mov byte [esp + 0x498], 0x1f
call fcn.00402090
lea edx, [ebp + 0x21c]
push edx
lea ecx, [esp + 0x20c]
mov byte [esp + 0x498], 0x20
call fcn.00402090
lea eax, [ebp + 0x254]
push eax
lea ecx, [esp + 0x350]
mov byte [esp + 0x498], 0x21
call fcn.00402090
mov edi, dword [ebp + 0x270]
mov dword [esp + 0x380], 7
mov dword [esp + 0x37c], ebx
mov word [esp + 0x36c], bx
cmp dword [esp + 0x39c], 8
mov eax, dword [esp + 0x388]
mov byte [esp + 0x494], 0x23
jae 0x4128b6
lea eax, [esp + 0x388]
push eax
call fcn.00449da9
mov esi, eax
add esp, 4
cmp esi, ebx
jle 0x41291b
mov edx, dword [esp + 0x39c]
cmp edx, 8
mov eax, dword [esp + 0x388]
mov ecx, eax
jae 0x4128e1
lea ecx, [esp + 0x388]
cmp edx, 8
mov cx, word [ecx + esi*2 - 4]
mov word [esp + 0x3c], cx
jae 0x4128f7
lea eax, [esp + 0x388]
mov dx, word [eax + esi*2 - 2]
push 2
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x370]
mov word [esp + 0x46], dx
call fcn.00401d60
sub esi, 2
cmp esi, ebx
jg 0x4128c5
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x370]
push ecx
lea ecx, [esp + 0x390]
call fcn.00401f80
push 0x44c
lea ecx, [esp + 0x324]
call fcn.004313f0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x3a8]
mov esi, 7
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push edx
mov word [ecx + 4], bx
call fcn.00401f80
push 0x44d
lea ecx, [esp + 0x340]
call fcn.00431640
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x22c]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], bx
call fcn.00401f80
push 0x44e
lea ecx, [esp + 0x340]
call fcn.00431640
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x370]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push edx
mov word [ecx + 4], bx
call fcn.00401f80
push 0x44f
lea ecx, [esp + 0x340]
call fcn.00431640
push edi
push 0x450
lea ecx, [esp + 0x328]
call fcn.00431800
lea ecx, [esp + 0x320]
call fcn.004314d0
lea eax, [esp + 0x1ec]
push eax
lea ecx, [esp + 0x324]
call fcn.00431bc0
lea ecx, [esp + 0x1ec]
push ecx
lea ecx, [esp + 0x70]
call fcn.0040cad0
lea edx, [esp + 0x6c]
push edx
push 0x3ee
lea ecx, [esp + 0x3a8]
call fcn.004319a0
lea ecx, [esp + 0x3a0]
call fcn.004314d0
lea eax, [esp + 0x240]
push eax
lea ecx, [esp + 0x3a4]
call fcn.00431bc0
lea ecx, [esp + 0x240]
push ecx
lea ecx, [esp + 0x50]
call fcn.0040cad0
cmp dword [esp + 0x380], 8
jb 0x412a88
mov edx, dword [esp + 0x36c]
push edx
call fcn.004620d3
add esp, 4
mov eax, dword [esp + 0x364]
mov edi, 8
cmp eax, edi
mov dword [esp + 0x380], esi
mov dword [esp + 0x37c], ebx
mov word [esp + 0x36c], bx
jb 0x412abe
mov eax, dword [esp + 0x350]
push eax
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x220], edi
mov dword [esp + 0x364], esi
mov dword [esp + 0x360], ebx
mov word [esp + 0x350], bx
jb 0x412aed
mov ecx, dword [esp + 0x20c]
push ecx
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x39c], edi
mov dword [esp + 0x220], esi
mov dword [esp + 0x21c], ebx
mov word [esp + 0x20c], bx
jb 0x412b1c
mov edx, dword [esp + 0x388]
push edx
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x204], 0x10
mov dword [esp + 0x39c], esi
mov dword [esp + 0x398], ebx
mov word [esp + 0x388], bx
jb 0x412b4c
mov eax, dword [esp + 0x1f0]
push eax
call fcn.004620d3
add esp, 4
lea ecx, [esp + 0x320]
mov dword [esp + 0x204], 0xf
mov dword [esp + 0x200], ebx
mov byte [esp + 0x1f0], bl
mov byte [esp + 0x494], 0x1d
call fcn.004313a0
lea ecx, [esp + 0x6c]
call fcn.0040ca20
lea ecx, [esp + 0x3a0]
mov byte [esp + 0x494], 0x19
call fcn.004313a0
cmp byte [esp + 0x13], bl
je 0x413119
cmp byte [ebp + 0x158], bl
lea ecx, [esp + 0x3a0]
je 0x412efa
call fcn.00431d20
push 0x3eb
lea ecx, [esp + 0x3a4]
mov byte [esp + 0x498], 0x24
call fcn.004313f0
mov eax, dword [esp + 0x120]
cmp eax, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
jle 0x412ea6
xor edi, edi
mov esi, ebx
lea esp, [esp]
cmp edi, ebx
jl 0x412ef5
cmp esi, eax
jge 0x412ef5
mov ecx, dword [esp + 0x11c]
cmp byte [edi + ecx + 0x58], bl
je 0x412e92
lea ecx, [esp + 0x320]
call fcn.00431d20
mov dword [esp + 0x204], 0xf
mov dword [esp + 0x200], ebx
mov byte [esp + 0x1f0], bl
cmp esi, dword [esp + 0x120]
mov byte [esp + 0x494], 0x26
jge 0x412ef5
mov edx, dword [esp + 0x11c]
push 0xffffffffffffffff
lea eax, [edi + edx]
push ebx
push eax
lea ecx, [esp + 0x358]
mov dword [esp + 0x370], 7
mov dword [esp + 0x36c], ebx
mov word [esp + 0x35c], bx
call fcn.00401f80
cmp esi, dword [esp + 0x120]
mov byte [esp + 0x494], 0x27
jge 0x412ef5
mov eax, dword [esp + 0x11c]
push 0xffffffffffffffff
lea ecx, [edi + eax + 0x1c]
push ebx
push ecx
lea ecx, [esp + 0x214]
mov dword [esp + 0x22c], 7
mov dword [esp + 0x228], ebx
mov word [esp + 0x218], bx
call fcn.00401f80
cmp esi, dword [esp + 0x120]
mov byte [esp + 0x494], 0x28
jge 0x412ef5
mov edx, dword [esp + 0x11c]
lea eax, [edi + edx + 0x38]
push eax
lea ecx, [esp + 0x36c]
call fcn.00402090
cmp esi, dword [esp + 0x120]
mov byte [esp + 0x494], 0x29
jge 0x412ef5
mov ecx, dword [esp + 0x11c]
mov esi, dword [edi + ecx + 0x54]
push 0x44c
lea ecx, [esp + 0x324]
call fcn.004313f0
sub esp, 0x1c
lea edx, [esp + 0x368]
mov ecx, esp
mov dword [esp + 0x50], esp
push edx
call fcn.00402090
push 0x44d
lea ecx, [esp + 0x340]
call fcn.00431640
sub esp, 0x1c
lea eax, [esp + 0x224]
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
call fcn.00402090
push 0x44e
lea ecx, [esp + 0x340]
call fcn.00431640
sub esp, 0x1c
lea edx, [esp + 0x384]
mov ecx, esp
mov dword [esp + 0x50], esp
push edx
call fcn.00402090
push 0x44f
lea ecx, [esp + 0x340]
call fcn.00431640
push esi
push 0x450
lea ecx, [esp + 0x328]
call fcn.00431800
lea ecx, [esp + 0x320]
call fcn.004314d0
lea eax, [esp + 0x1ec]
push eax
lea ecx, [esp + 0x324]
call fcn.00431bc0
lea ecx, [esp + 0x1ec]
push ecx
lea ecx, [esp + 0x94]
call fcn.0040cad0
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x354]
push edx
lea ecx, [ebp + 0x178]
call fcn.00401f80
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x210]
push eax
lea ecx, [ebp + 0x194]
call fcn.00401f80
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x370]
push ecx
lea ecx, [ebp + 0x1b0]
call fcn.00401f80
lea edx, [esp + 0x1ec]
push edx
lea ecx, [ebp + 0x1d0]
mov dword [ebp + 0x1cc], esi
call fcn.0040cad0
lea ecx, [esp + 0x368]
mov byte [ebp + 0x158], bl
call fcn.00401a60
lea ecx, [esp + 0x208]
call fcn.00401a60
lea ecx, [esp + 0x34c]
call fcn.00401a60
lea ecx, [esp + 0x1ec]
call fcn.00401c00
lea ecx, [esp + 0x320]
mov byte [esp + 0x494], 0x24
call fcn.004313a0
mov eax, dword [esp + 0x120]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
inc esi
add edi, 0x5c
cmp esi, ecx
mov dword [esp + 0x18], esi
jl 0x412bf0
lea eax, [esp + 0x90]
push eax
push 0x3ee
lea ecx, [esp + 0x3a8]
call fcn.004319a0
lea ecx, [esp + 0x3a0]
call fcn.004314d0
lea ecx, [esp + 0x240]
push ecx
lea ecx, [esp + 0x3a4]
call fcn.00431bc0
lea edx, [esp + 0x240]
push edx
lea ecx, [esp + 0x50]
call fcn.0040cad0
jmp 0x413105
call fcn.0045a790
call fcn.00431d20
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
push 0x3eb
lea ecx, [esp + 0x3a4]
mov byte [esp + 0x498], 0x2b
call fcn.004313f0
lea ecx, [esp + 0x320]
call fcn.00431d20
mov dword [esp + 0x220], 0xf
mov dword [esp + 0x21c], ebx
mov byte [esp + 0x20c], bl
lea eax, [ebp + 0x178]
push eax
lea ecx, [esp + 0x36c]
mov byte [esp + 0x498], 0x2d
call fcn.00402090
lea ecx, [ebp + 0x194]
push ecx
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x498], 0x2e
call fcn.00402090
lea edx, [ebp + 0x1b0]
push edx
lea ecx, [esp + 0x350]
mov byte [esp + 0x498], 0x2f
call fcn.00402090
mov esi, dword [ebp + 0x1cc]
push 0x44c
lea ecx, [esp + 0x324]
mov byte [esp + 0x498], 0x30
call fcn.004313f0
sub esp, 0x1c
lea eax, [esp + 0x384]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00402090
push 0x44d
lea ecx, [esp + 0x340]
call fcn.00431640
sub esp, 0x1c
lea edx, [esp + 0x208]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.00402090
push 0x44e
lea ecx, [esp + 0x340]
call fcn.00431640
sub esp, 0x1c
lea eax, [esp + 0x368]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00402090
push 0x44f
lea ecx, [esp + 0x340]
call fcn.00431640
push esi
push 0x450
lea ecx, [esp + 0x328]
call fcn.00431800
lea ecx, [esp + 0x320]
call fcn.004314d0
lea ecx, [esp + 0x208]
push ecx
lea ecx, [esp + 0x324]
call fcn.00431bc0
lea edx, [esp + 0x208]
push edx
lea ecx, [esp + 0x70]
call fcn.0040cad0
lea eax, [esp + 0x6c]
push eax
push 0x3ee
lea ecx, [esp + 0x3a8]
call fcn.004319a0
lea ecx, [esp + 0x3a0]
call fcn.004314d0
lea ecx, [esp + 0x240]
push ecx
lea ecx, [esp + 0x3a4]
call fcn.00431bc0
lea edx, [esp + 0x240]
push edx
lea ecx, [esp + 0x50]
call fcn.0040cad0
lea ecx, [esp + 0x34c]
call fcn.00401a60
lea ecx, [esp + 0x1ec]
call fcn.00401a60
lea ecx, [esp + 0x368]
call fcn.00401a60
lea ecx, [esp + 0x208]
call fcn.00401c00
lea ecx, [esp + 0x320]
mov byte [esp + 0x494], 0x2b
call fcn.004313a0
lea ecx, [esp + 0x6c]
call fcn.0040ca20
lea ecx, [esp + 0x3a0]
mov byte [esp + 0x494], 0x19
call fcn.004313a0
lea eax, [esp + 0x4c]
push eax
push 0x3e9
lea ecx, [esp + 0x438]
call fcn.004319a0
lea ecx, [esp + 0x430]
call fcn.004314d0
lea ecx, [esp + 0x2e8]
push ecx
lea ecx, [esp + 0x434]
call fcn.00431bc0
call fcn.004621d7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
mov edi, 7
mov dword [esp + 0x3e4], edi
mov dword [esp + 0x3e0], ebx
mov word [esp + 0x3d0], bx
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x208]
push eax
mov byte [esp + 0x498], 0x32
call fcn.0042b730
mov ecx, dword [eax + 0x18]
mov esi, 8
cmp ecx, esi
mov byte [esp + 0x494], 0x33
jb 0x4131af
mov eax, dword [eax + 4]
jmp 0x4131b2
add eax, 4
push eax
lea ecx, [esp + 0x1c]
call fcn.00405a70
cmp dword [esp + 0x220], esi
mov byte [esp + 0x494], 0x32
jb 0x4131dd
mov ecx, dword [esp + 0x20c]
push ecx
call fcn.004620d3
add esp, 4
push 3
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x20]
call fcn.00405220
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x498], 0x34
call fcn.00403cc0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x494], 0x32
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413225
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0xa8]
push ecx
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0xac]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x413797
mov ecx, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x20c]
push edx
call fcn.0040f870
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x3d8]
mov byte [esp + 0x4a0], 0x35
call fcn.00401f80
lea ecx, [esp + 0x208]
mov byte [esp + 0x494], 0x32
call fcn.00401a60
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x3f0]
mov esi, 7
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], bx
call fcn.00401f80
lea ecx, [esp + 0x278]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x70], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x2bc]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [esp + 0x4dc], 0x36
mov byte [ecx + 4], bl
call fcn.0040c120
lea eax, [esp + 0x2ec]
push eax
lea ecx, [esp + 0x328]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x9c], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x28c]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push edx
mov byte [esp + 0x500], 0x37
mov word [ecx + 4], bx
call fcn.00401f80
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xc0], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x388]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov byte [esp + 0x51c], 0x38
mov word [ecx + 4], bx
call fcn.00401f80
lea ecx, [esp + 0xc4]
mov byte [esp + 0x510], 0x32
call fcn.0042c7f0
mov esi, eax
cmp esi, ebx
jne 0x413416
lea ecx, [esp + 0x40]
call fcn.00403ad0
cmp dword [esp + 0x274], 0x10
mov ecx, dword [esp + 0x260]
jae 0x41339d
lea ecx, [esp + 0x260]
mov eax, dword [esp + 0x270]
cdq
sub eax, edx
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x48]
call fcn.004082f0
sub esp, 0x1c
lea edx, [esp + 0x2cc]
mov ecx, esp
mov dword [esp + 0x60], esp
push edx
call fcn.0040c220
mov edi, dword [esp + 0x48]
mov ecx, edi
call fcn.0042b580
sub esp, 0x1c
lea eax, [esp + 0x294]
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call fcn.0040c220
mov ecx, edi
call fcn.0042b650
mov edx, dword [esp + 0x40]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x60], esp
push edx
call fcn.004027f0
mov ecx, edi
call fcn.0042b4d0
push ebx
mov ecx, edi
call fcn.0042abc0
jmp 0x413435
mov edi, dword [esp + 0x2c]
mov ecx, edi
call fcn.0042afa0
cmp edi, ebx
je 0x413435
mov ecx, edi
call fcn.0042acf0
push edi
call fcn.004620d3
add esp, 4
lea ecx, [esp + 0x3cc]
call fcn.00401a60
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x494], 0x19
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413467
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x90]
call fcn.0040ca20
lea ecx, [esp + 0x3e8]
call fcn.00401c00
lea ecx, [esp + 0x404]
mov byte [esp + 0x494], 0x16
call fcn.004313a0
lea ecx, [esp + 0x45c]
mov byte [esp + 0x494], 0x15
call fcn.004313a0
lea ecx, [esp + 0x430]
mov byte [esp + 0x494], 0x10
call fcn.004313a0
push 0xffffffffffffffff
lea ecx, [esp + 0x24]
mov edi, 0x10
call fcn.004043b0
mov eax, dword [esp + 0x7c]
cmp eax, ebx
je 0x4134dc
push eax
call fcn.004620d3
add esp, 4
mov al, byte [esp + 0x1f]
neg al
lea ecx, [esp + 0xa8]
sbb eax, eax
and eax, 0x80004005
mov dword [esp + 0x14], eax
call fcn.0045f100
mov eax, dword [esp + 0x30]
cmp dword [eax + 0xd8], ebx
je 0x41351b
cmp byte [ebp + 0x160], bl
jne 0x41351b
cmp esi, ebx
jne 0x41351b
mov ecx, dword [esp + 0x30]
push ebx
call fcn.0040e1e0
lea ecx, [esp + 0x5c]
call fcn.0040ca20
lea ecx, [esp + 0x80]
call fcn.0040a730
cmp dword [esp + 0x1e8], 8
jb 0x41354a
mov ecx, dword [esp + 0x1d4]
push ecx
call fcn.004620d3
add esp, 4
mov ebp, 7
lea ecx, [esp + 0x4c]
mov dword [esp + 0x1e8], ebp
mov dword [esp + 0x1e4], ebx
mov word [esp + 0x1d4], bx
call fcn.0040ca20
lea ecx, [esp + 0xa8]
mov byte [esp + 0x494], 0xb
call fcn.00425ed0
cmp dword [esp + 0x290], edi
jb 0x41359b
mov edx, dword [esp + 0x27c]
push edx
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x2c8], edi
mov esi, 0xf
mov dword [esp + 0x290], esi
mov dword [esp + 0x28c], ebx
mov byte [esp + 0x27c], bl
jb 0x4135ce
mov eax, dword [esp + 0x2b4]
push eax
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x300], edi
mov dword [esp + 0x2c8], esi
mov dword [esp + 0x2c4], ebx
mov byte [esp + 0x2b4], bl
jb 0x4135fc
mov ecx, dword [esp + 0x2ec]
push ecx
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x258], edi
mov dword [esp + 0x300], esi
mov dword [esp + 0x2fc], ebx
mov byte [esp + 0x2ec], bl
jb 0x41362a
mov edx, dword [esp + 0x244]
push edx
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x2e4], edi
mov dword [esp + 0x258], esi
mov dword [esp + 0x254], ebx
mov byte [esp + 0x244], bl
jb 0x413658
mov eax, dword [esp + 0x2d0]
push eax
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x274], edi
mov dword [esp + 0x2e4], esi
mov dword [esp + 0x2e0], ebx
mov byte [esp + 0x2d0], bl
jb 0x413686
mov ecx, dword [esp + 0x260]
push ecx
call fcn.004620d3
add esp, 4
mov eax, dword [esp + 0x2ac]
mov dword [esp + 0x274], esi
mov esi, 8
cmp eax, esi
mov dword [esp + 0x270], ebx
mov byte [esp + 0x260], bl
jb 0x4136bb
mov edx, dword [esp + 0x298]
push edx
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x31c], esi
mov dword [esp + 0x2ac], ebp
mov dword [esp + 0x2a8], ebx
mov word [esp + 0x298], bx
jb 0x4136ea
mov eax, dword [esp + 0x308]
push eax
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x23c], esi
mov dword [esp + 0x31c], ebp
mov dword [esp + 0x318], ebx
mov word [esp + 0x308], bx
jb 0x413719
mov ecx, dword [esp + 0x228]
push ecx
call fcn.004620d3
add esp, 4
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
mov dword [esp + 0x23c], ebp
mov dword [esp + 0x238], ebx
mov word [esp + 0x228], bx
mov byte [esp + 0x494], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x413755
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x494], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41377a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x48]
mov dword [esp + 0x494], 0xffffffff
call fcn.0042c3d0
mov eax, dword [esp + 0x14]
jmp 0x413da9
mov eax, dword [esp + 0x3e4]
mov ebp, 8
cmp eax, ebp
jb 0x4137b7
mov eax, dword [esp + 0x3d0]
push eax
call fcn.004620d3
add esp, 4
lea eax, [esi - 0x10]
mov dword [esp + 0x3e4], edi
mov dword [esp + 0x3e0], ebx
mov word [esp + 0x3d0], bx
mov byte [esp + 0x494], 0x19
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4137ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x90]
call fcn.0040ca20
lea ecx, [esp + 0x404]
mov byte [esp + 0x494], 0x16
call fcn.004313a0
lea ecx, [esp + 0x45c]
mov byte [esp + 0x494], 0x15
call fcn.004313a0
lea ecx, [esp + 0x430]
mov byte [esp + 0x494], 0x10
call fcn.004313a0
lea ecx, [esp + 0x5c]
call fcn.0040ca20
lea ecx, [esp + 0x80]
call fcn.0040a730
cmp dword [esp + 0x1e8], ebp
jb 0x413865
mov eax, dword [esp + 0x1d4]
push eax
call fcn.004620d3
add esp, 4
lea ecx, [esp + 0x4c]
mov dword [esp + 0x1e8], edi
mov dword [esp + 0x1e4], ebx
mov word [esp + 0x1d4], bx
call fcn.0040ca20
lea ecx, [esp + 0xa8]
mov byte [esp + 0x494], 0xb
call fcn.00425ed0
mov eax, dword [esp + 0x290]
mov esi, 0x10
cmp eax, esi
jb 0x4138b8
mov ecx, dword [esp + 0x27c]
push ecx
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x2c8], esi
mov ebp, 0xf
mov dword [esp + 0x290], ebp
mov dword [esp + 0x28c], ebx
mov byte [esp + 0x27c], bl
jb 0x4138eb
mov edx, dword [esp + 0x2b4]
push edx
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x300], esi
mov dword [esp + 0x2c8], ebp
mov dword [esp + 0x2c4], ebx
mov byte [esp + 0x2b4], bl
jb 0x413919
mov eax, dword [esp + 0x2ec]
push eax
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x258], esi
mov dword [esp + 0x300], ebp
mov dword [esp + 0x2fc], ebx
mov byte [esp + 0x2ec], bl
jb 0x413947
mov ecx, dword [esp + 0x244]
push ecx
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x2e4], esi
mov dword [esp + 0x258], ebp
mov dword [esp + 0x254], ebx
mov byte [esp + 0x244], bl
jb 0x413975
mov edx, dword [esp + 0x2d0]
push edx
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x274], esi
mov dword [esp + 0x2e4], ebp
mov dword [esp + 0x2e0], ebx
mov byte [esp + 0x2d0], bl
jb 0x4139a3
mov eax, dword [esp + 0x260]
push eax
call fcn.004620d3
add esp, 4
mov eax, dword [esp + 0x2ac]
mov esi, 8
cmp eax, esi
mov dword [esp + 0x274], ebp
mov dword [esp + 0x270], ebx
mov byte [esp + 0x260], bl
jb 0x4139d8
mov ecx, dword [esp + 0x298]
push ecx
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x31c], esi
mov dword [esp + 0x2ac], edi
mov dword [esp + 0x2a8], ebx
mov word [esp + 0x298], bx
jb 0x413a07
mov edx, dword [esp + 0x308]
push edx
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x23c], esi
mov dword [esp + 0x31c], edi
mov dword [esp + 0x318], ebx
mov word [esp + 0x308], bx
jb 0x413a36
mov eax, dword [esp + 0x228]
push eax
call fcn.004620d3
add esp, 4
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
mov dword [esp + 0x23c], edi
mov dword [esp + 0x238], ebx
mov word [esp + 0x228], bx
mov byte [esp + 0x494], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413a72
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x494], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413a97
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x48]
mov dword [esp + 0x494], 0xffffffff
call fcn.0042c3d0
mov eax, 0x80004005
jmp 0x413da9
mov esi, dword [esp + 0x2c]
mov ecx, esi
call fcn.0042ac00
test al, al
je 0x413adf
mov ecx, esi
call fcn.0042afa0
cmp esi, ebx
je 0x413adf
mov ecx, esi
call fcn.0042acf0
push esi
call fcn.004620d3
add esp, 4
mov eax, dword [esp + 0x60]
cmp eax, ebx
je 0x413b09
mov ecx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x68]
lea edx, [esp + 0x60]
push edx
push ecx
push eax
call fcn.0040c2f0
mov edx, dword [esp + 0x70]
push edx
call fcn.004620d3
add esp, 0x14
cmp dword [esp + 0x1e8], 8
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
jb 0x413b2f
mov eax, dword [esp + 0x1d4]
push eax
call fcn.004620d3
add esp, 4
mov eax, dword [esp + 0x50]
cmp eax, ebx
mov ebp, 7
mov dword [esp + 0x1e8], ebp
mov dword [esp + 0x1e4], ebx
mov word [esp + 0x1d4], bx
je 0x413b74
mov ecx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x58]
lea edx, [esp + 0x50]
push edx
push ecx
push eax
call fcn.0040c2f0
mov edx, dword [esp + 0x60]
push edx
call fcn.004620d3
add esp, 0x14
lea ecx, [esp + 0xa8]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov byte [esp + 0x494], 0xb
call fcn.00425ed0
mov eax, dword [esp + 0x290]
mov edi, 0x10
cmp eax, edi
jb 0x413bb4
mov eax, dword [esp + 0x27c]
push eax
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x2c8], edi
mov esi, 0xf
mov dword [esp + 0x290], esi
mov dword [esp + 0x28c], ebx
mov byte [esp + 0x27c], bl
jb 0x413be7
mov ecx, dword [esp + 0x2b4]
push ecx
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x300], edi
mov dword [esp + 0x2c8], esi
mov dword [esp + 0x2c4], ebx
mov byte [esp + 0x2b4], bl
jb 0x413c15
mov edx, dword [esp + 0x2ec]
push edx
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x258], edi
mov dword [esp + 0x300], esi
mov dword [esp + 0x2fc], ebx
mov byte [esp + 0x2ec], bl
jb 0x413c43
mov eax, dword [esp + 0x244]
push eax
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x2e4], edi
mov dword [esp + 0x258], esi
mov dword [esp + 0x254], ebx
mov byte [esp + 0x244], bl
jb 0x413c71
mov ecx, dword [esp + 0x2d0]
push ecx
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x274], edi
mov dword [esp + 0x2e4], esi
mov dword [esp + 0x2e0], ebx
mov byte [esp + 0x2d0], bl
jb 0x413c9f
mov edx, dword [esp + 0x260]
push edx
call fcn.004620d3
add esp, 4
mov eax, dword [esp + 0x2ac]
mov dword [esp + 0x274], esi
mov esi, 8
cmp eax, esi
mov dword [esp + 0x270], ebx
mov byte [esp + 0x260], bl
jb 0x413cd4
mov eax, dword [esp + 0x298]
push eax
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x31c], esi
mov dword [esp + 0x2ac], ebp
mov dword [esp + 0x2a8], ebx
mov word [esp + 0x298], bx
jb 0x413d03
mov ecx, dword [esp + 0x308]
push ecx
call fcn.004620d3
add esp, 4
cmp dword [esp + 0x23c], esi
mov dword [esp + 0x31c], ebp
mov dword [esp + 0x318], ebx
mov word [esp + 0x308], bx
jb 0x413d32
mov edx, dword [esp + 0x228]
push edx
call fcn.004620d3
add esp, 4
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
mov dword [esp + 0x23c], ebp
mov dword [esp + 0x238], ebx
mov word [esp + 0x228], bx
mov byte [esp + 0x494], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413d6e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x494], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413d93
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x48]
mov dword [esp + 0x494], 0xffffffff
call fcn.0042c3d0
xor eax, eax
mov ecx, dword [esp + 0x48c]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x480]
pop ebp
pop ebx
xor ecx, esp
call fcn.0044a318
add esp, 0x488
ret 8