Function at 0x401420
Capabilities:
Encode data using xor
Get system information on windows
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xae4
mov eax, dword [0x46e040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x50
xorps xmm0, xmm0
mov dword [ebp - 0x9ec], ecx
lea eax, [ebp - 0x110]
movlpd qword [ebp - 0x9f8], xmm0
push 0
push eax
movlpd qword [ebp - 0xa50], xmm0
call fcn.004235b0
mov esi, dword [0x46fe2c]
xor edi, edi
add esp, 0xc
mov dword [ebp - 0xa20], edi
test esi, esi
jne 0x401485
call fcn.00413580
mov esi, eax
mov dword [0x46fe2c], esi
test esi, esi
je 0x4014d9
lea eax, [ebp - 0xb4]
mov ecx, esi
push eax
lea eax, [ebp - 0xbc]
push eax
push 0xffffffffffffffff
call dword [0x44227c]
call esi
nop
test eax, eax
je 0x4014d9
movzx eax, word [ebp - 0xb4]
cmp eax, 0x14c
je 0x4014d5
cmp eax, 0x8664
je 0x4014ce
nop dword [eax]
cmp eax, 0xaa64
jne 0x4014d9
mov eax, 0xc
jmp 0x4014ed
mov eax, 9
jmp 0x4014ed
xor eax, eax
jmp 0x4014ed
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [ebp - 0x134]
mov dword [ebp - 0x9fc], eax
lea eax, [ebp - 0xa08]
push eax
lea eax, [ebp - 0xa10]
mov dword [ebp - 0xa08], edi
push eax
push ecx
call fcn.00413600
test al, al
je 0x401545
mov ebx, dword [ebp - 0xa08]
test ebx, ebx
jne 0x401558
mov dword [ebp - 0xf4], 0x18
mov eax, dword ds:[ebp - 0x9ec]
lea ecx, [ebp - 0x110]
mov edx, 1
mov dword [eax + 0x28], 3
call fcn.0040d7a0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004218f3
mov esp, ebp
pop ebp
ret
mov esi, dword ds:[ebp - 0xa10]
cmp esi, 0x16
jae 0x401571
mov dword [ebp - 0xf4], 8
jmp 0x401525
lea ecx, [ebp - 0x110]
call fcn.0040c2a0
nop dword [eax]
test eax, eax
je 0x401525
lea eax, [ebp - 0x110]
mov dword [ebp - 0xf8], 2
mov dword [ebp - 0xcc], eax
lea ecx, [ebp - 0x110]
mov eax, dword [ebp - 0xc8]
xor edx, edx
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0xd8], 0x40d8c0
mov dword [ebp - 0xd0], edi
mov dword [eax + 0x48], ebx
mov eax, dword [ebp - 0xc8]
mov dword [eax + 0x4c], esi
call fcn.0040c8e0
test eax, eax
jne 0x4015eb
xor edx, edx
lea ecx, [ebp - 0x110]
call fcn.0040d7a0
jmp 0x401525
mov eax, dword [ebp - 0x9f4]
xor ebx, ebx
mov edi, dword [ebp - 0x9fc]
mov dword [ebp - 0xa04], eax
mov eax, dword [ebp - 0x9f8]
mov dword [ebp - 0xa00], eax
nop dword [eax + eax]
cmp ebx, dword [ebp - 0x100]
jae 0x4018ce
mov ecx, dword [ebp - 0xc8]
test ecx, ecx
je 0x401630
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebx*4]
add eax, dword [ecx]
jmp 0x401632
xor eax, eax
push 0
lea ecx, [ebp - 0x590]
mov edx, ebx
push ecx
push eax
lea ecx, [ebp - 0x110]
call fcn.0040d920
test eax, eax
je 0x4018c8
lea edx, [ebp - 0x540]
lea ecx, [edx + 1]
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x401660
sub edx, ecx
lea ecx, [ebp - 0x540]
call fcn.004073e0
mov esi, eax
mov dword [ebp - 0xa14], 0x3e
push 0
lea edx, [ebp - 0xa14]
mov dword [ebp - 0xa10], str.SystemInformer.exe.settings.xml
mov ecx, esi
call fcn.00406dc0
nop dword [eax]
cmp eax, 0xffffffff
jne 0x4018c8
push 0
lea edx, [ebp - 0x9f8]
mov dword [ebp - 0x9f8], 0x1e
mov ecx, esi
mov dword [ebp - 0x9f4], str.usernotesdb.xml
call fcn.00406dc0
cmp eax, 0xffffffff
jne 0x4018c8
mov eax, dword ds:[esi + 4]
cmp di, 9
jne 0x40177f
cmp dword [esi], 0xa
mov dword [ebp - 0xa0c], 0xa
mov dword [ebp - 0xa08], str.i386_
mov dword [ebp - 0xa18], eax
mov dword [ebp - 0xa1c], 0xa
jb 0x40172e
push 1
lea edx, [ebp - 0xa0c]
lea ecx, [ebp - 0xa1c]
call fcn.00406b00
test al, al
jne 0x4018c8
cmp dword [esi], 0xc
mov eax, dword [esi + 4]
mov dword [ebp - 0xc0], 0xc
mov dword [ebp - 0xbc], str.arm64_
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb8], 0xc
jb 0x4018a4
push 1
lea edx, [ebp - 0xc0]
lea ecx, [ebp - 0xb8]
call fcn.00406b00
test al, al
je 0x4018a4
inc ebx
jmp 0x401610
nop
cmp di, 0xc
jne 0x40181f
cmp dword [esi], 0xa
mov dword [ebp - 0xa28], 0xa
mov dword [ebp - 0xa24], str.i386_
mov dword [ebp - 0xa2c], eax
mov dword [ebp - 0xa30], 0xa
jb 0x4017ce
push 1
lea edx, [ebp - 0xa28]
lea ecx, [ebp - 0xa30]
call fcn.00406b00
test al, al
jne 0x4018c8
cmp dword [esi], 0xc
mov eax, dword [esi + 4]
mov dword [ebp - 0xa38], 0xc
mov dword [ebp - 0xa34], str.amd64_
mov dword [ebp - 0xa3c], eax
mov dword [ebp - 0xa40], 0xc
jb 0x4018a4
push 1
lea edx, [ebp - 0xa38]
lea ecx, [ebp - 0xa40]
call fcn.00406b00
test al, al
je 0x4018a4
inc ebx
jmp 0x401610
cmp dword [esi], 0xc
mov dword [ebp - 0xa48], 0xc
mov dword [ebp - 0xa44], str.amd64_
mov dword [ebp - 0xa64], eax
mov dword [ebp - 0xa68], 0xc
jb 0x40185f
push 1
lea edx, [ebp - 0xa48]
lea ecx, [ebp - 0xa68]
call fcn.00406b00
test al, al
jne 0x4018c8
cmp dword [esi], 0xc
mov eax, dword [esi + 4]
mov dword [ebp - 0xa60], 0xc
mov dword [ebp - 0xa5c], str.arm64_
mov dword [ebp - 0xa54], eax
mov dword [ebp - 0xa58], 0xc
jb 0x4018a4
push 1
lea edx, [ebp - 0xa60]
lea ecx, [ebp - 0xa58]
call fcn.00406b00
nop
test al, al
jne 0x4018c8
mov ecx, dword [ebp - 0xa00]
add ecx, dword [ebp - 0x568]
mov eax, dword [ebp - 0xa04]
adc eax, dword [ebp - 0x564]
mov dword [ebp - 0xa00], ecx
mov dword [ebp - 0xa04], eax
inc ebx
jmp 0x401610
mov ebx, dword ds:[ebp - 0x9ec]
push 0
push 0
push 0x467
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0xa4c]
xor edx, edx
mov dword [ebp - 0xa08], eax
or ebx, 0xffffffff
mov eax, dword [ebp - 0xa50]
mov edi, edx
mov dword [ebp - 0xa18], eax
mov dword [ebp - 0xa10], edx
cmp edx, dword [ebp - 0x100]
jae 0x402249
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0xbc], 0
test ecx, ecx
je 0x401935
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edx*4]
add eax, dword [ecx]
jmp 0x401937
xor eax, eax
push 0
lea ecx, [ebp - 0x9e8]
push ecx
push eax
lea ecx, [ebp - 0x110]
call fcn.0040d920
test eax, eax
je 0x4021c6
lea edx, [ebp - 0x998]
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x401960
sub edx, ecx
lea ecx, [ebp - 0x998]
call fcn.004073e0
mov esi, eax
mov dword [ebp - 0xa50], 0x3e
push 0
lea edx, [ebp - 0xa50]
mov dword [ebp - 0xa4c], str.SystemInformer.exe.settings.xml
mov ecx, esi
call fcn.00406dc0
nop dword [eax]
cmp eax, 0xffffffff
jne 0x4021c6
push 0
lea edx, [ebp - 0xa58]
mov dword [ebp - 0xa58], 0x1e
mov ecx, esi
mov dword [ebp - 0xa54], str.usernotesdb.xml
call fcn.00406dc0
cmp eax, 0xffffffff
jne 0x4021c6
mov ecx, dword ds:[ebp - 0x9fc]
mov eax, dword [esi + 4]
cmp cx, 9
jne 0x401b26
cmp dword [esi], 0xa
mov dword [ebp - 0xa60], 0xa
mov dword [ebp - 0xa5c], str.i386_
mov dword [ebp - 0xa64], eax
mov dword [ebp - 0xa68], 0xa
jb 0x401a2e
push 1
lea edx, [ebp - 0xa60]
lea ecx, [ebp - 0xa68]
call fcn.00406b00
test al, al
jne 0x4021c6
cmp dword [esi], 0xc
mov eax, dword [esi + 4]
mov dword [ebp - 0xa48], 0xc
mov dword [ebp - 0xa44], str.arm64_
mov dword [ebp - 0xa3c], eax
mov dword [ebp - 0xa40], 0xc
jb 0x401a75
push 1
lea edx, [ebp - 0xa48]
lea ecx, [ebp - 0xa40]
call fcn.00406b00
test al, al
jne 0x4021c6
cmp dword ds:[esi], 0xc
mov eax, dword [esi + 4]
mov dword [ebp - 0xa38], 0xc
mov dword [ebp - 0xa34], str.amd64_
mov dword [ebp - 0xa2c], eax
mov dword [ebp - 0xa30], 0xc
jb 0x401d48
lea edx, [ebp - 0xa38]
lea ecx, [ebp - 0xa30]
push 1
call fcn.00406b00
nop dword [eax]
test al, al
je 0x401d48
mov ebx, dword [esi]
mov eax, dword [esi + 4]
and ebx, 0xfffffffe
mov edx, dword [0x46fcb4]
sub ebx, 0xc
add eax, 0xc
mov dword [ebp - 0x9f4], eax
lea ecx, [ebx + 0xa]
call fcn.004060a0
mov ecx, eax
xor edx, edx
lea eax, [ecx + 8]
mov dword [ebp - 0xb4], ecx
mov dword [ecx], ebx
mov dword [ecx + 4], eax
mov word [eax + ebx], dx
mov eax, dword [ebp - 0x9f4]
test eax, eax
je 0x401b1d
push ebx
push eax
push dword [ecx + 4]
call fcn.00423710
mov ecx, dword [ebp - 0xb4]
add esp, 0xc
mov eax, esi
mov esi, ecx
jmp 0x401d30
cmp cx, 0xc
jne 0x401bfe
cmp dword [esi], 0xa
mov dword [ebp - 0xa28], 0xa
mov dword [ebp - 0xa24], str.i386_
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xae0], 0xa
jb 0x401b74
push 1
lea edx, [ebp - 0xa28]
lea ecx, [ebp - 0xae0]
call fcn.00406b00
test al, al
jne 0x4021c6
cmp dword ds:[esi], 0xc
mov eax, dword [esi + 4]
mov dword [ebp - 0xac0], 0xc
mov dword [ebp - 0xabc], str.amd64_
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xac8], 0xc
jb 0x401bbd
push 1
lea edx, [ebp - 0xac0]
lea ecx, [ebp - 0xac8]
call fcn.00406b00
test al, al
jne 0x4021c6
cmp dword [esi], 0xc
mov eax, dword [esi + 4]
mov dword [ebp - 0xad0], 0xc
mov dword [ebp - 0xacc], str.arm64_
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xad8], 0xc
jb 0x401d48
lea edx, [ebp - 0xad0]
lea ecx, [ebp - 0xad8]
jmp 0x401ab2
cmp dword [esi], 0xc
mov dword [ebp - 0xa70], 0xc
mov dword [ebp - 0xa6c], str.amd64_
mov dword [ebp - 0xa74], eax
mov dword [ebp - 0xa78], 0xc
jb 0x401c48
push 1
lea edx, [ebp - 0xa70]
lea ecx, [ebp - 0xa78]
call fcn.00406b00
nop word [eax + eax]
test al, al
jne 0x4021c6
cmp dword [esi], 0xc
mov eax, dword [esi + 4]
mov dword [ebp - 0xa80], 0xc
mov dword [ebp - 0xa7c], str.arm64_
mov dword [ebp - 0xa84], eax
mov dword [ebp - 0xa88], 0xc
jb 0x401c8f
push 1
lea edx, [ebp - 0xa80]
lea ecx, [ebp - 0xa88]
call fcn.00406b00
test al, al
jne 0x4021c6
cmp dword [esi], 0xa
mov eax, dword [esi + 4]
mov dword [ebp - 0xa90], 0xa
mov dword [ebp - 0xa8c], str.i386_
mov dword [ebp - 0xa94], eax
mov dword [ebp - 0xa98], 0xa
jb 0x401d48
push 1
lea edx, [ebp - 0xa90]
lea ecx, [ebp - 0xa98]
call fcn.00406b00
test al, al
je 0x401d48
mov ecx, dword [esi]
mov eax, dword [esi + 4]
and ecx, 0xfffffffe
mov edx, dword [0x46fcb4]
add eax, 0xa
mov dword [ebp - 0xb4], eax
lea eax, [ecx - 0xa]
mov dword [ebp - 0x9f4], eax
call fcn.004060a0
mov ecx, dword [ebp - 0x9f4]
mov ebx, eax
lea eax, [ebx + 8]
xor edx, edx
mov dword [ebx + 4], eax
mov dword [ebx], ecx
mov word [eax + ecx], dx
mov eax, dword [ebp - 0xb4]
test eax, eax
je 0x401d2c
push ecx
push eax
push dword [ebx + 4]
call fcn.00423710
add esp, 0xc
mov eax, esi
mov esi, ebx
test eax, eax
je 0x401d48
lea ecx, ds:[eax - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x401d48
call fcn.00406180
mov edx, dword ds:[ebp - 0x9e8]
lea eax, [ebp - 0xbc]
push ecx
push eax
lea ecx, [ebp - 0x110]
call fcn.0040e560
mov edx, eax
mov dword [ebp - 0x9f4], edx
test edx, edx
je 0x4021fa
mov ebx, dword [ebp - 0xbc]
or eax, 0xffffffff
mov ecx, ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xbc], ecx
cmp ecx, 4
jb 0x401e0e
mov edi, ebx
shr edi, 2
nop word [eax + eax]
movzx ecx, byte [edx]
sub ebx, 4
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x468440]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x468440]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x468440]
movzx ecx, byte [edx + 3]
add edx, 4
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x468440]
sub edi, 1
jne 0x401da0
mov edi, dword [ebp - 0xa20]
mov dword [ebp - 0xbc], ebx
mov ebx, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xbc]
test ecx, ecx
je 0x401e38
mov ebx, dword [ebp - 0xbc]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x468440]
sub ebx, 1
jne 0x401e18
mov ebx, dword [ebp - 0xb4]
not eax
cmp eax, dword [ebp - 0x9d0]
jne 0x4021eb
push esi
mov esi, dword [ebp - 0x9ec]
lea edx, [ebp - 0xaa0]
mov dword [ebp - 0xaa0], 2
mov dword [ebp - 0xa9c], 0x466468
mov ecx, dword [esi + 0x18]
call fcn.004070e0
mov edi, eax
mov ecx, edi
mov dword [ebp - 0xa20], edi
call fcn.00410fc0
test eax, eax
js 0x4021e2
lfence
mov dword [ebp - 0xbc], 5
mov dword [ebp - 0xaa8], 0x10
mov dword [ebp - 0xaa4], 0x4664fc
nop
mov ecx, dword [edi]
mov byte [ebp - 0xb1], 0
cmp ecx, 0x10
jb 0x401f32
mov eax, dword [edi + 4]
lea edx, [ebp - 0xaa8]
add ecx, 0xfffffff0
mov dword [ebp - 0xab0], 0x10
add eax, ecx
lea ecx, [ebp - 0xab0]
push 0
mov dword [ebp - 0xaac], eax
call fcn.00406b00
test al, al
je 0x401f32
mov esi, dword [ebp - 0x9f4]
mov ecx, edi
push ebx
mov edx, esi
call section..text
nop dword [eax]
test al, al
jne 0x401f86
push ebx
mov edx, esi
mov ecx, edi
call fcn.004055e0
test al, al
jne 0x401f86
mov ecx, dword [ebp - 0x9ec]
mov edx, edi
push ebx
push esi
call fcn.00401200
test al, al
jne 0x401f86
mov byte [ebp - 0xb1], 1
jmp 0x401f49
mov esi, dword ds:[ebp - 0x9f4]
mov ecx, edi
push ebx
mov edx, esi
call fcn.004055e0
test al, al
jne 0x401f86
lea edx, [ebp - 0xab8]
mov dword [ebp - 0xab8], 0xff676980
mov dword [ebp - 0xab4], 0xffffffff
call fcn.00413420
sub dword [ebp - 0xbc], 1
jne 0x401eb0
cmp byte ds:[ebp - 0xb1], 0
jne 0x4021d2
push dword ds:[ebp - 0xa04]
lfence
add dword [ebp - 0xa18], ebx
mov ebx, 0x64
mov eax, dword [ebp - 0xa08]
push dword [ebp - 0xa00]
adc eax, 0
mov dword [ebp - 0xa08], eax
mul ebx
mov ecx, eax
mov eax, dword [ebp - 0xa18]
mul ebx
add ecx, edx
push ecx
push eax
call fcn.0043f500
mov ecx, edi
mov dword [ebp - 0x9f4], eax
mov dword [ebp - 0xb4], edx
call fcn.00411d60
mov ebx, eax
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0xa0], 0x18
mov dword [ebp - 0x9c], str.Extracting:
test ebx, ebx
je 0x402004
lfence
mov edx, dword [ebx + 4]
jmp 0x402009
mov edx, 0x46642c
mov ecx, edx
mov dword [ebp - 0x98], 1
lea eax, [ecx + 2]
mov dword [ebp - 0xbc], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402020
sub ecx, dword ds:[ebp - 0xbc]
sar ecx, 1
push 0
push 0x208
mov dword [ebp - 0x84], edx
mov edx, 2
lea eax, [ecx + ecx]
mov dword [ebp - 0x88], eax
lea ecx, [ebp - 0xb0]
lea eax, [ebp - 0x340]
push eax
call fcn.00409400
test al, al
je 0x402086
lea eax, ds:[ebp - 0x340]
push eax
mov eax, dword [ebp - 0x9ec]
push 3
push 0x472
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0xa18]
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x88], eax
mov edx, 7
mov eax, dword [ebp - 0xa08]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0xa00]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0xa04]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x9f4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xb4]
push 0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x340]
push 0x208
push eax
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0xa0], 0x14
mov dword [ebp - 0x9c], str.Progress:
mov dword [ebp - 0x98], 0xd
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x70], 8
mov dword [ebp - 0x6c], str._of
mov dword [ebp - 0x68], 0xd
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x3c], 0x466550
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 0x466558
call fcn.00409400
test al, al
je 0x402175
lea eax, [ebp - 0x340]
push eax
mov eax, dword [ebp - 0x9ec]
push 0
push 0x472
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x9ec]
push 0
push dword [ebp - 0x9f4]
push 0x46a
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
test ebx, ebx
je 0x4021b1
lea ecx, [ebx - 8]
or ebx, 0xffffffff
lfence
mov eax, ebx
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4021b4
lfence
call fcn.00406180
jmp 0x4021b4
or ebx, 0xffffffff
push esi
push 0
push dword [0x46fcc0]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edx, dword [ebp - 0xa10]
inc edx
jmp 0x401905
mov eax, dword ds:[ebp - 0x9ec]
mov dword [eax + 0x28], 0x94
jmp 0x402207
mov dword [esi + 0x28], 0x150
jmp 0x402207
mov eax, dword [ebp - 0x9ec]
mov dword [eax + 0x28], 0x17
jmp 0x402207
mov eax, dword [ebp - 0x9ec]
mov dword [eax + 0x28], 0x3ee
mov edx, 1
lea ecx, [ebp - 0x110]
call fcn.0040d7a0
test edi, edi
je 0x401545
lea ecx, [edi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x401545
call fcn.00406180
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004218f3
mov esp, ebp
pop ebp
ret
mov edx, 1
lea ecx, [ebp - 0x110]
call fcn.0040d7a0
test edi, edi
je 0x40226d
lea ecx, [edi - 8]
lock xadd dword [ecx + 4], ebx
dec ebx
jne 0x40226d
call fcn.00406180
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004218f3
mov esp, ebp
pop ebp
ret