Function at 0x406620
Capabilities:
Get common file path
Get disk information
Get disk size
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b93d
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x464024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.09F7EDC5_294E_4180_AF6A_FB0E6A0E9513
mov edx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSPPClients
call fcn.004051e0
add esp, 4
lea ecx, [ebp - 0x244]
push eax
call fcn.00414580
mov dword [ebp - 4], 0
call fcn.004024e0
mov ecx, eax
test ecx, ecx
je 0x40731c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x22c], eax
push 0x449958
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 1
call fcn.004153b0
test al, al
jne 0x4066ba
push 0
push 0x449958
lea ecx, [ebp - 0x22c]
call fcn.00416540
mov byte [ebp - 4], 2
call fcn.004024e0
mov ecx, eax
test ecx, ecx
je 0x407326
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x240], eax
push 0x449958
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 3
call fcn.004153b0
test al, al
jne 0x406705
push 0
push 0x449958
lea ecx, [ebp - 0x240]
call fcn.00416540
mov byte [ebp - 4], 4
call fcn.004024e0
mov ecx, eax
test ecx, ecx
je 0x407330
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x228], eax
mov byte [ebp - 4], 5
call fcn.004024e0
mov ecx, eax
test ecx, ecx
je 0x40733a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x23c], eax
push str.Restore_Points
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 6
call fcn.004153b0
test al, al
jne 0x406771
push 0xe
push str.Restore_Points
lea ecx, [ebp - 0x23c]
call fcn.00416540
push 0
push 0x24
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 7
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406791
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x228]
call fcn.00416540
mov esi, dword [ebp - 0x228]
cmp dword [esi - 0xc], 3
lea eax, [esi - 0x10]
mov dword [ebp - 0x21c], eax
jg 0x4067da
mov ecx, eax
call fcn.004164d0
lea edi, [eax + 0x10]
mov dword [ebp - 0x224], edi
jmp 0x406841
mov ecx, dword [eax]
test ecx, ecx
je 0x4067eb
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x406801
call fcn.004024e0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x407344
mov eax, dword [ecx]
push 2
push 3
call dword [eax]
test eax, eax
je 0x40734e
cmp dword [eax + 8], 3
lea edi, [eax + 0x10]
mov dword [ebp - 0x224], edi
jl 0x407362
xor eax, eax
mov dword [edi - 0xc], 3
push 6
push esi
mov ecx, edi
mov word [edi + 6], ax
lea edx, [eax + 6]
call fcn.00401fd0
add esp, 8
lea edx, [edi - 0x10]
mov byte [ebp - 4], 8
lea eax, [esi - 0x10]
mov dword [ebp - 0x220], edx
or ebx, 0xffffffff
cmp edx, eax
je 0x4068af
mov esi, dword [ebp - 0x21c]
cmp dword [esi + 0xc], 0
jl 0x406894
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x406894
mov ecx, edx
call fcn.004164d0
mov edi, eax
lea edx, [esi + 0xc]
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406889
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea esi, [edi + 0x10]
mov dword [ebp - 0x228], esi
jmp 0x4068a9
push dword [edi - 0xc]
lea ecx, [ebp - 0x228]
push edi
call fcn.00416540
mov esi, dword [ebp - 0x228]
mov edx, dword [ebp - 0x220]
mov byte [ebp - 4], 7
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4068c7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea ecx, [ebp - 0x2a4]
call fcn.00407380
push esi
mov byte [ebp - 4], 9
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x407255
mov ecx, dword [ebp - 0x22c]
lea edi, [esi - 0x10]
add ecx, 0xfffffff0
mov dword [ebp - 0x220], ecx
cmp edi, ecx
je 0x406963
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x224], eax
jl 0x406954
mov eax, dword [edi]
cmp eax, dword [ecx]
jne 0x406954
mov ecx, edi
call fcn.004164d0
mov edx, dword [ebp - 0x224]
mov ecx, ebx
mov dword [ebp - 0x21c], eax
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406949
mov edi, dword [ebp - 0x220]
push edi
mov ecx, dword [edi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x21c]
add eax, 0x10
mov dword [ebp - 0x22c], eax
jmp 0x406963
push dword [esi - 0xc]
lea ecx, [ebp - 0x22c]
push esi
call fcn.00416540
push ecx
mov edi, esp
lea ecx, [esi - 0x10]
mov dword [ebp - 0x234], edi
call fcn.004164d0
add eax, 0x10
mov dword [edi], eax
call fcn.00406400
mov eax, dword [0x46c58c]
add esp, 4
mov edi, dword [ebp - 0x29c]
add edi, 0xfffffff0
lea edx, [eax - 0x10]
mov dword [ebp - 0x224], edx
cmp edx, edi
je 0x4069ef
cmp dword [edi + 0xc], 0
jl 0x4069e0
mov edx, dword [edx]
cmp edx, dword [edi]
jne 0x4069e0
mov ecx, dword [ebp - 0x224]
call fcn.004164d0
mov dword [ebp - 0x224], eax
lea edx, [edi + 0xc]
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4069d5
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x224]
add eax, 0x10
mov dword [ebp - 0x29c], eax
jmp 0x4069ef
push dword [eax - 0xc]
lea ecx, [ebp - 0x29c]
push eax
call fcn.00416540
mov ecx, dword [ebp - 0x2a0]
lea edi, [esi - 0x10]
add ecx, 0xfffffff0
mov dword [ebp - 0x220], ecx
cmp edi, ecx
je 0x406a66
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x224], eax
jl 0x406a57
mov eax, dword [edi]
cmp eax, dword [ecx]
jne 0x406a57
mov ecx, edi
call fcn.004164d0
mov edx, dword [ebp - 0x224]
mov ecx, ebx
mov dword [ebp - 0x21c], eax
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406a4c
mov eax, dword [ebp - 0x220]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x21c]
add eax, 0x10
mov dword [ebp - 0x2a0], eax
jmp 0x406a66
push dword [esi - 0xc]
lea ecx, [ebp - 0x2a0]
push esi
call fcn.00416540
push 0x45d47c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x406b56
mov ecx, edi
call fcn.004164d0
lea edi, [eax + 0x10]
mov dword [ebp - 0x21c], edi
mov byte [ebp - 4], 0xa
xorps xmm0, xmm0
cmp dword [edi - 4], 1
movlpd qword [0x46c578], xmm0
movlpd qword [0x46a820], xmm0
jle 0x406abb
push dword [edi - 0xc]
lea ecx, [ebp - 0x21c]
call fcn.004154d0
mov edi, dword [ebp - 0x21c]
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x264]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x406b09
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x234]
mov dword [0x46c578], eax
mov eax, dword [ebp - 0x25c]
mov dword [0x46c57c], ecx
mov ecx, dword [ebp - 0x258]
mov dword [0x46a820], eax
mov dword [0x46a824], ecx
cmp dword [edi - 4], 1
jle 0x406b23
push dword [edi - 0xc]
lea ecx, [ebp - 0x21c]
call fcn.004154d0
mov edi, dword [ebp - 0x21c]
push 0
push 0
push 0x46a5f0
push 0x46c150
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov byte [ebp - 4], 9
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x406b53
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
lea edi, [esi - 0x10]
mov eax, dword [0x46c578]
mov ecx, dword [0x46c57c]
mov edx, dword [ebp - 0x298]
mov dword [ebp - 0x28c], eax
add edx, 0xfffffff0
mov eax, dword [0x46a820]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x288], ecx
mov ecx, dword [0x46a824]
mov dword [ebp - 0x280], ecx
lea ecx, [eax - 0x10]
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x224], ecx
lea ecx, [eax - 0x10]
cmp ecx, edx
je 0x406c0f
cmp dword [edx + 0xc], 0
lea ecx, [edx + 0xc]
mov dword [ebp - 0x220], ecx
jl 0x406c00
mov ecx, dword [eax - 0x10]
cmp ecx, dword [edx]
jne 0x406c00
mov ecx, dword [ebp - 0x224]
call fcn.004164d0
mov edx, dword [ebp - 0x220]
mov ecx, ebx
mov dword [ebp - 0x230], eax
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406bf5
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x230]
add eax, 0x10
mov dword [ebp - 0x298], eax
jmp 0x406c0f
push dword [eax - 0xc]
lea ecx, [ebp - 0x298]
push eax
call fcn.00416540
cmp dword [edi + 0xc], 1
jle 0x406c29
push dword [edi + 4]
lea ecx, [ebp - 0x228]
call fcn.004154d0
mov esi, dword [ebp - 0x228]
lea edx, [ebp - 0x2a4]
mov ecx, esi
call fcn.00405f40
cmp eax, 0xffffffff
je 0x40719b
mov eax, dword [ebp - 0x29c]
mov ecx, 0x449958
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x406c76
test dx, dx
je 0x406c72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x406c76
add eax, 4
add ecx, 4
test dx, dx
jne 0x406c50
xor eax, eax
jmp 0x406c7b
sbb eax, eax
or eax, 1
lea ecx, [ebp - 0x21c]
push str._3A_
test eax, eax
je 0x406ed7
call fcn.00414490
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x2a0]
cmp dword [eax - 0xc], 1
jg 0x406cb6
lea ecx, [eax - 0x10]
call fcn.004164d0
lea edi, [eax + 0x10]
mov dword [ebp - 0x220], edi
jmp 0x406d23
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x406cc8
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x406cde
call fcn.004024e0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x407353
mov eax, dword [ecx]
push 2
push 1
call dword [eax]
test eax, eax
je 0x40735d
cmp dword [eax + 8], 1
lea edi, [eax + 0x10]
mov dword [ebp - 0x220], edi
jl 0x407362
xor eax, eax
mov dword [edi - 0xc], 1
push 2
push dword [ebp - 0x2a0]
mov ecx, edi
mov word [edi + 2], ax
lea edx, [eax + 2]
call fcn.00401fd0
add esp, 8
push 0x45d48c
lea edx, [ebp - 0x294]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x234]
call fcn.00413da0
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 0xd
push ecx
mov edx, eax
lea ecx, [ebp - 0x258]
call fcn.00413e70
push 0x44996c
mov edx, eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x260]
call fcn.00413da0
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0xf
push ecx
mov edx, eax
lea ecx, [ebp - 0x254]
call fcn.00413e70
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0x10
push ecx
mov edx, eax
lea ecx, [ebp - 0x250]
call fcn.00413e70
add esp, 0x14
mov byte [ebp - 4], 0x11
mov edx, dword [eax]
mov ecx, dword [ebp - 0x290]
add ecx, 0xfffffff0
mov dword [ebp - 0x24c], ecx
lea eax, [edx - 0x10]
mov dword [ebp - 0x230], eax
lea eax, [edx - 0x10]
cmp eax, ecx
je 0x406e29
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x248], eax
jl 0x406e1a
mov eax, dword [edx - 0x10]
cmp eax, dword [ecx]
jne 0x406e1a
mov ecx, dword [ebp - 0x230]
call fcn.004164d0
mov edx, dword [ebp - 0x248]
mov ecx, ebx
mov dword [ebp - 0x230], eax
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406e0f
mov eax, dword [ebp - 0x24c]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x230]
add eax, 0x10
mov dword [ebp - 0x290], eax
jmp 0x406e29
push dword [edx - 0xc]
lea ecx, [ebp - 0x290]
push edx
call fcn.00416540
mov byte [ebp - 4], 0x10
mov eax, ebx
mov edx, dword [ebp - 0x250]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x406e4a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xf
mov eax, ebx
mov edx, dword [ebp - 0x254]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x406e6b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
mov eax, ebx
mov edx, dword [ebp - 0x260]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x406e8c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xd
mov eax, ebx
mov edx, dword [ebp - 0x258]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x406ead
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc
mov eax, ebx
mov edx, dword [ebp - 0x234]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x406ece
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xb
jmp 0x4070e2
call fcn.00414490
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x2a0]
cmp dword [eax - 0xc], 1
jg 0x406eff
lea ecx, [eax - 0x10]
call fcn.004164d0
lea edi, [eax + 0x10]
mov dword [ebp - 0x220], edi
jmp 0x406f6c
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x406f11
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x406f27
call fcn.004024e0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x40736c
mov eax, dword [ecx]
push 2
push 1
call dword [eax]
test eax, eax
je 0x407376
cmp dword [eax + 8], 1
lea edi, [eax + 0x10]
mov dword [ebp - 0x220], edi
jl 0x407362
xor eax, eax
mov dword [edi - 0xc], 1
push 2
push dword [ebp - 0x2a0]
mov ecx, edi
mov word [edi + 2], ax
lea edx, [eax + 2]
call fcn.00401fd0
add esp, 8
push 0x45d48c
lea edx, [ebp - 0x294]
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x248]
call fcn.00413da0
push 0x45d490
mov edx, eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x24c]
call fcn.00413da0
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0x15
push ecx
mov edx, eax
lea ecx, [ebp - 0x250]
call fcn.00413e70
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0x16
push ecx
mov edx, eax
lea ecx, [ebp - 0x254]
call fcn.00413e70
add esp, 0x10
mov byte [ebp - 4], 0x17
mov edx, dword [eax]
mov ecx, dword [ebp - 0x290]
add ecx, 0xfffffff0
mov dword [ebp - 0x260], ecx
lea eax, [edx - 0x10]
mov dword [ebp - 0x234], eax
lea eax, [edx - 0x10]
cmp eax, ecx
je 0x40705a
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x258], eax
jl 0x40704b
mov eax, dword [edx - 0x10]
cmp eax, dword [ecx]
jne 0x40704b
mov ecx, dword [ebp - 0x234]
call fcn.004164d0
mov edx, dword [ebp - 0x258]
mov ecx, ebx
mov dword [ebp - 0x234], eax
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407040
mov eax, dword [ebp - 0x260]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x234]
add eax, 0x10
mov dword [ebp - 0x290], eax
jmp 0x40705a
push dword [edx - 0xc]
lea ecx, [ebp - 0x290]
push edx
call fcn.00416540
mov byte [ebp - 4], 0x16
mov eax, ebx
mov edx, dword [ebp - 0x254]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40707b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x15
mov eax, ebx
mov edx, dword [ebp - 0x250]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40709c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x14
mov eax, ebx
mov edx, dword [ebp - 0x24c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4070bd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x13
mov eax, ebx
mov edx, dword [ebp - 0x248]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4070de
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x12
mov eax, ebx
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4070f9
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 9
mov eax, ebx
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40711a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x290]
test ecx, ecx
jne 0x40713a
or eax, 0xffffffff
shr eax, 0x1f
xor al, 1
mov dword [ebp - 0x220], eax
mov byte [ebp - 0x26b], al
jmp 0x4071a2
mov eax, dword [ebp - 0x244]
cmp dword [eax - 0xc], 0
jge 0x40715c
or eax, 0xffffffff
shr eax, 0x1f
xor al, 1
mov dword [ebp - 0x220], eax
mov byte [ebp - 0x26b], al
jmp 0x4071a2
push ecx
push eax
call fcn.0041c1a5
add esp, 8
test eax, eax
jne 0x407180
or eax, 0xffffffff
shr eax, 0x1f
xor al, 1
mov dword [ebp - 0x220], eax
mov byte [ebp - 0x26b], al
jmp 0x4071a2
sub eax, dword [ebp - 0x244]
sar eax, 1
shr eax, 0x1f
xor al, 1
mov dword [ebp - 0x220], eax
mov byte [ebp - 0x26b], al
jmp 0x4071a2
mov byte [ebp - 0x220], 0
lea ecx, [ebp - 0x2a4]
call fcn.00407440
mov byte [ebp - 4], 5
mov eax, ebx
mov edx, dword [ebp - 0x224]
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4071cb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4071e6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
mov eax, ebx
mov edx, dword [ebp - 0x240]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407207
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x22c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407228
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x244]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x40724a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [ebp - 0x220]
jmp 0x407300
lea ecx, [ebp - 0x2a4]
call fcn.00407440
mov byte [ebp - 4], 5
mov eax, ebx
mov edx, dword [ebp - 0x23c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407281
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40729c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
mov eax, ebx
mov edx, dword [ebp - 0x240]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4072bd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x22c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4072de
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x244]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x407300
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041ae8f
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402240
push 0x80004005
call fcn.00402240
push 0x80004005
call fcn.00402240
push 0x80004005
call fcn.00402240
push 0x80004005
call fcn.00402240
call fcn.00416530
push 0x80004005
call fcn.00402240
call fcn.00416530
push 0x80070057
call fcn.00402240
push 0x80004005
call fcn.00402240
call fcn.00416530
int3