Function at 0x41bb00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c88ce
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x524ee0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x140], ebx
call fcn.00444480
push str.success
lea ecx, [ebp - 0x120]
mov dword [ebp - 4], 0
call fcn.00444440
lea eax, [ebp - 0x120]
push eax
push 0x4dfc64
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 1
call fcn.00444920
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0
call fcn.00444690
mov byte [ebp - 4], 2
call fcn.00418a30
test al, al
jne 0x41bc00
movd xmm4, dword [0x526340]
movsd xmm3, qword [0x4e1680]
movsd xmm5, qword [0x4e1678]
movsd xmm6, qword [0x4e1688]
xorps xmm2, xmm2
cvtdq2pd xmm4, xmm4
jmp 0x41bbd0
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x41bbea
subsd xmm2, xmm3
divsd xmm3, xmm6
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmm5
ja 0x41bbd0
push 0x4e1118
mov ecx, esi
call fcn.00444a00
sub esp, 0x18
mov ecx, eax
push esp
call fcn.004451d0
lea eax, [ebp - 0x124]
push eax
call fcn.004512c0
add esp, 0x1c
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x110]
push eax
push 0x20019
push 0
push dword [ebp - 0x124]
mov byte [ebp - 4], 3
push VariantInit
mov dword [ebp - 0x110], 0
call esi
test eax, eax
je 0x41bd60
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0043fd80
add esp, 8
push eax
lea eax, [ebp - 0x100]
push str.specialFoldersFromReg_sid_error_RegOpenKeyEx_
push eax
mov byte [ebp - 4], 4
call fcn.0040b7a0
add esp, 0xc
mov edx, dword [ebp - 0x108]
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 6
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x41bcac
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00451390
add esp, 8
push eax
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 7
call fcn.004443a0
push 0x4dfc64
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 8
call fcn.00444920
lea ecx, [ebp - 0x120]
push ecx
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 7
call fcn.00444690
cmp dword [ebp - 0x18], 0x10
jb 0x41bd11
push dword [ebp - 0x2c]
call fcn.004a831e
add esp, 4
mov edx, dword [ebp - 0x100]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
mov byte [ebp - 4], 3
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41bd34
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x124]
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41bd57
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
jmp 0x41c8d6
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x110], 0
call fcn.0040b6c0
add esp, 0xc
mov ecx, dword [0x526340]
mov byte [ebp - 4], 9
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0x18
idiv ecx
cmp edx, 9
jne 0x41bdfb
mov eax, dword [str.pUPrG]
mov dword [ebp - 0x108], eax
mov ax, word [0x4e1208]
mov word [ebp - 0x104], ax
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41bdd0
sub eax, edx
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a7aa0
add esp, 4
push eax
call fcn.004a98f0
add esp, 4
lea eax, [ebp - 0x110]
push eax
push 0x20019
push 0
push dword [ebp - 0x128]
push VariantInit
call esi
test eax, eax
je 0x41bf00
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0043fd80
add esp, 8
push eax
lea eax, [ebp - 0x100]
push str.specialFoldersFromReg_RegOpenKeyEx_
push eax
mov byte [ebp - 4], 0xa
call fcn.0040b7a0
add esp, 0xc
mov edx, dword [ebp - 0x108]
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 0xc
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x41be6d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00451390
add esp, 8
push eax
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0xd
call fcn.004443a0
push 0x4dfc64
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0xe
call fcn.00444920
lea ecx, [ebp - 0x120]
push ecx
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0xd
call fcn.00444690
cmp dword [ebp - 0x18], 0x10
jb 0x41bed2
push dword [ebp - 0x2c]
call fcn.004a831e
add esp, 4
mov edx, dword [ebp - 0x100]
add edx, 0xfffffff0
mov byte [ebp - 4], 9
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41bef5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x128]
jmp 0x41bd17
mov dword [ebp - 0x10c], 0x410
call fcn.004187d0
test al, al
jne 0x41bf25
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
mov dword [ebp - 0x12c], 0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xfc], eax
mov esi, dword [ebp - 0x10c]
shr esi, 1
mov byte [ebp - 4], 0xf
jns 0x41bf5d
push 0x80070057
call fcn.00404410
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x41bf80
push esi
lea ecx, [ebp - 0xfc]
call fcn.004085d0
mov eax, dword [ebp - 0xfc]
lea ecx, [ebp - 0x10c]
push ecx
push eax
lea eax, [ebp - 0x12c]
push eax
push 0
push str.AppData
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41c045
mov eax, dword [ebp - 0xfc]
push dword [eax - 8]
push eax
call fcn.004a9e6a
mov edx, eax
add esp, 8
test edx, edx
js 0x41bf53
mov ecx, dword [ebp - 0xfc]
cmp edx, dword [ecx - 8]
jg 0x41bf53
mov dword [ecx - 0xc], edx
mov eax, dword [ebp - 0xfc]
xor ecx, ecx
mov word [eax + edx*2], cx
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00451390
add esp, 8
push eax
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x10
call fcn.004443a0
push str.AppDataFolder
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x11
call fcn.00444920
lea ecx, [ebp - 0x120]
push ecx
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x10
call fcn.00444690
cmp dword [ebp - 0x18], 0x10
mov byte [ebp - 4], 0xf
jb 0x41c045
push dword [ebp - 0x2c]
call fcn.004a831e
add esp, 4
mov ecx, dword [ebp - 0xfc]
cmp dword [ecx - 0xc], 0
mov ebx, dword [ecx - 0x10]
lea edx, [ecx - 0x10]
je 0x41c08c
cmp dword [edx + 0xc], 0
lea esi, [edx + 0xc]
jge 0x41c297
cmp dword [ecx - 8], 0
jge 0x41c074
push 0x80070057
call fcn.00404410
mov dword [ecx - 0xc], 0
mov eax, dword [ebp - 0xfc]
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 0xfc]
or edi, 0xffffffff
mov esi, dword [0x526340]
lea edx, [esi + 1]
lea eax, [esi + 2]
imul eax, edx
imul eax, esi
cdq
mov esi, 0x15
idiv esi
cmp edx, 0x13
jne 0x41c0b4
dec dword [0x52666c]
mov dword [ebp - 0x10c], 0x410
mov eax, dword [ecx - 8]
mov edx, 1
sub edx, dword [ecx - 4]
sub eax, 0x208
or eax, edx
jge 0x41c0e8
push 0x208
lea ecx, [ebp - 0xfc]
call fcn.004085d0
mov ecx, dword [ebp - 0xfc]
lea eax, [ebp - 0x10c]
push eax
push ecx
lea eax, [ebp - 0x12c]
push eax
push 0
push str.Local_AppData
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41c268
mov eax, dword [ebp - 0xfc]
push dword [eax - 8]
push eax
call fcn.004a9e6a
mov edx, eax
add esp, 8
test edx, edx
js 0x41bf53
mov ecx, dword [ebp - 0xfc]
cmp edx, dword [ecx - 8]
jg 0x41bf53
mov dword [ecx - 0xc], edx
mov eax, dword [ebp - 0xfc]
xor ecx, ecx
mov word [eax + edx*2], cx
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00451390
add esp, 8
push eax
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x12
call fcn.004443a0
push str.LocalAppDataFolder
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x13
call fcn.00444920
lea ecx, [ebp - 0x120]
push ecx
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x12
call fcn.00444690
cmp dword [ebp - 0x18], 0x10
mov byte [ebp - 4], 0xf
jb 0x41c1b5
push dword [ebp - 0x2c]
call fcn.004a831e
add esp, 4
push str._temp
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0040b6c0
add esp, 0xc
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0x14
call fcn.00451390
add esp, 8
push eax
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x15
call fcn.004443a0
push str.temp
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x16
call fcn.00444920
lea ecx, [ebp - 0x120]
push ecx
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x15
call fcn.00444690
cmp dword [ebp - 0x18], 0x10
jb 0x41c233
push dword [ebp - 0x2c]
call fcn.004a831e
add esp, 4
mov edx, dword [ebp - 0x108]
add edx, 0xfffffff0
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 0xf
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41c268
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xfc]
cmp dword [ecx - 0xc], 0
mov ebx, dword [ecx - 0x10]
lea edx, [ecx - 0x10]
je 0x41c2ff
cmp dword [edx + 0xc], 0
lea esi, [edx + 0xc]
jge 0x41c2dc
cmp dword [ecx - 8], 0
jge 0x41c2c2
push 0x80070057
call fcn.00404410
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x41c2ad
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
lea ecx, [eax + 0x10]
mov dword [ebp - 0xfc], ecx
jmp 0x41c08f
mov dword [ecx - 0xc], 0
mov eax, dword [ebp - 0xfc]
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 0xfc]
jmp 0x41c2ff
mov eax, edi
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x41c2ef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
lea ecx, [eax + 0x10]
mov dword [ebp - 0xfc], ecx
mov edx, dword [0x526340]
mov esi, 0x12
lea eax, [edx + 1]
imul eax, edx
cdq
idiv esi
cmp edx, 4
jne 0x41c330
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov ecx, dword [ebp - 0xfc]
mov dword [ebp - 0x10c], 0x410
mov eax, dword [ecx - 8]
mov edx, 1
sub edx, dword [ecx - 4]
sub eax, 0x208
or eax, edx
jge 0x41c364
push 0x208
lea ecx, [ebp - 0xfc]
call fcn.004085d0
mov ecx, dword [ebp - 0xfc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x10c]
push eax
push ecx
lea eax, [ebp - 0x12c]
push eax
push 0
push str.A520A1A4_1780_4FF6_BD18_167343C5AF16
push dword [ebp - 0x110]
call ebx
test eax, eax
jne 0x41c433
mov eax, dword [ebp - 0xfc]
push dword [eax - 8]
push eax
call fcn.004a9e6a
mov edx, eax
add esp, 8
test edx, edx
js 0x41bf53
mov ecx, dword [ebp - 0xfc]
cmp edx, dword [ecx - 8]
jg 0x41bf53
mov dword [ecx - 0xc], edx
mov eax, dword [ebp - 0xfc]
xor ecx, ecx
mov word [eax + edx*2], cx
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00451390
add esp, 8
push eax
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x17
call fcn.004443a0
push str.LocalLowAppDataFolder
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x18
call fcn.00444920
lea ecx, [ebp - 0x120]
push ecx
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x17
call fcn.00444690
cmp dword [ebp - 0x18], 0x10
mov byte [ebp - 4], 0xf
jb 0x41c433
push dword [ebp - 0x2c]
call fcn.004a831e
add esp, 4
mov eax, dword [ebp - 0xfc]
cmp dword [eax - 0xc], 0
mov esi, dword [eax - 0x10]
lea edx, [eax - 0x10]
je 0x41c49b
cmp dword [edx + 0xc], 0
lea ecx, [edx + 0xc]
jge 0x41c478
cmp dword [eax - 8], 0
jge 0x41c45e
push 0x80070057
call fcn.00404410
mov dword [eax - 0xc], 0
mov eax, dword [ebp - 0xfc]
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0xfc]
jmp 0x41c49b
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x41c48b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x10c], 0x410
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, 0x208
or ecx, edx
jge 0x41c4d0
push 0x208
lea ecx, [ebp - 0xfc]
call fcn.004085d0
mov eax, dword [ebp - 0xfc]
lea ecx, [ebp - 0x10c]
push ecx
push eax
lea eax, [ebp - 0x12c]
push eax
push 0
push str.Personal
push dword [ebp - 0x110]
call ebx
test eax, eax
jne 0x41c599
mov eax, dword [ebp - 0xfc]
push dword [eax - 8]
push eax
call fcn.004a9e6a
mov edx, eax
add esp, 8
test edx, edx
js 0x41bf53
mov ecx, dword [ebp - 0xfc]
cmp edx, dword [ecx - 8]
jg 0x41bf53
mov dword [ecx - 0xc], edx
mov eax, dword [ebp - 0xfc]
xor ecx, ecx
mov word [eax + edx*2], cx
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00451390
add esp, 8
push eax
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x19
call fcn.004443a0
push str.MyDocumentsFolder
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x1a
call fcn.00444920
lea ecx, [ebp - 0x120]
push ecx
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x19
call fcn.00444690
cmp dword [ebp - 0x18], 0x10
mov byte [ebp - 4], 0xf
jb 0x41c599
push dword [ebp - 0x2c]
call fcn.004a831e
add esp, 4
mov eax, dword [ebp - 0xfc]
cmp dword [eax - 0xc], 0
mov esi, dword [eax - 0x10]
lea edx, [eax - 0x10]
je 0x41c5fb
cmp dword [edx + 0xc], 0
lea ecx, [edx + 0xc]
jge 0x41c5d8
cmp dword [eax - 8], 0
jge 0x41c5c4
push 0x80070057
call fcn.00404410
mov dword [eax - 0xc], 0
mov eax, dword [ebp - 0xfc]
xor ecx, ecx
mov word [eax], cx
jmp 0x41c5fb
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x41c5eb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0x108]
push eax
call fcn.00435100
add esp, 4
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0x1b
call fcn.00451390
add esp, 8
push eax
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x1c
call fcn.004443a0
push str.ProgFiles32Folder
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x1d
call fcn.00444920
lea ecx, [ebp - 0x120]
push ecx
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x1c
call fcn.00444690
cmp dword [ebp - 0x18], 0x10
jb 0x41c66d
push dword [ebp - 0x2c]
call fcn.004a831e
add esp, 4
mov edx, dword [ebp - 0x108]
add edx, 0xfffffff0
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 0xf
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41c6a2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [0x526340]
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 4
jne 0x41c6c8
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
lea eax, [ebp - 0x108]
push eax
call fcn.00435310
add esp, 4
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0x1e
call fcn.00451390
add esp, 8
push eax
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x1f
call fcn.004443a0
push str.ProgFiles64Folder
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x20
call fcn.00444920
lea ecx, [ebp - 0x120]
push ecx
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x1f
call fcn.00444690
cmp dword [ebp - 0x18], 0x10
jb 0x41c73a
push dword [ebp - 0x2c]
call fcn.004a831e
add esp, 4
mov edx, dword [ebp - 0x108]
add edx, 0xfffffff0
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 0xf
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41c76f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00418970
test al, al
jne 0x41c797
mov eax, dword [0x526340]
xor esi, esi
test eax, eax
je 0x41c791
mov ecx, eax
cdq
and ecx, 1
sub eax, edx
add esi, ecx
sar eax, 1
jne 0x41c783
mov dword [0x526340], esi
call fcn.0043f6e0
lea ecx, [ebp - 0x120]
push eax
call fcn.00444580
push str.is64bitos
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x21
call fcn.00444920
lea ecx, [ebp - 0x120]
push ecx
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0xf
call fcn.00444690
mov edx, dword [ebp - 0xfc]
add edx, 0xfffffff0
mov byte [ebp - 4], 9
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41c7fc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x128]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41c81f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x124]
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41c8cf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x41c8cf
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.004465d0
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
mov byte [ebp - 4], 0x26
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x100], eax
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x27
call fcn.00449500
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 0x28
jb 0x41c91d
mov edx, dword [edx]
sub esp, 0x18
mov esi, esp
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [edx], 0
jne 0x41c93c
xor ecx, ecx
jmp 0x41c94a
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41c941
sub ecx, ebx
push ecx
push edx
mov ecx, esi
call fcn.00401460
lea eax, [ebp - 0x108]
push eax
call fcn.004512c0
add esp, 0x1c
push eax
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0x29
call fcn.00402ab0
mov edx, dword [ebp - 0x108]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x28
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41c995
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x18], 0x10
mov byte [ebp - 4], 0x27
jb 0x41c9aa
push dword [ebp - 0x2c]
call fcn.004a831e
add esp, 4
mov ebx, dword [ebp - 0x140]
mov esi, dword [ebp - 0x100]
mov eax, 8
mov word [ebx], ax
push dword [esi - 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x41c9d1
call fcn.00409970
mov dword [ebx + 8], eax
call fcn.00418910
test al, al
jne 0x41ca2c
movd xmm4, dword [0x526340]
movsd xmm3, qword [0x4e1680]
xorps xmm2, xmm2
cvtdq2pd xmm4, xmm4
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x41ca12
subsd xmm2, xmm3
divsd xmm3, qword [0x4e1688]
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmmword [0x4e1678]
ja 0x41c9f4
add esi, 0xfffffff0
mov byte [ebp - 4], 0x26
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x41ca47
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x34], 0x10
mov byte [ebp - 4], 0
mov dword [ebp - 0x4c], 0x4dfc5c
jb 0x41ca63
push dword [ebp - 0x48]
call fcn.004a831e
add esp, 4
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
call fcn.004466d0
lea ecx, [ebp - 0x13c]
mov dword [ebp - 4], 0xffffffff
call fcn.00444690
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a8b24
mov esp, ebp
pop ebp
ret