Function at 0x407300
Capabilities:
Copy file
Encode data using xor
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x490
mov eax, dword [0x41f080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x474], eax
call fcn.00407090
test al, al
jne 0x40734a
mov eax, dword [0x4201a0]
xor esi, esi
test eax, eax
je 0x407344
mov ecx, eax
cdq
and ecx, 1
sub eax, edx
add esi, ecx
sar eax, 1
jne 0x407336
mov dword [0x4201a0], esi
push 0
call fcn.00409c83
push eax
call fcn.00409317
lea eax, [ebp - 0x490]
push eax
call fcn.00409c83
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.00409350
add esp, 0x18
lea eax, [ebp - 0x108]
push 0x104
push eax
push edi
call fcn.00407270
push eax
call fcn.004030d0
mov eax, dword [0x4201a0]
imul eax, eax
cdq
mov ecx, 0x14
idiv ecx
cmp edx, 0x13
jne 0x407415
xor esi, esi
nop
call fcn.004092f4
movd xmm0, eax
cvtdq2pd xmm0, xmm0
inc esi
movsd qword [ebp + esi*8 - 0x3bc], xmm0
cmp esi, 0x35
jb 0x4073b0
xor ecx, ecx
mov edi, edi
mov eax, 0x34
cmp ecx, eax
jge 0x40740f
lea esp, [esp]
movsd xmm0, qword [ebp + eax*8 - 0x3b4]
movsd xmm1, qword [ebp + eax*8 - 0x3bc]
comisd xmm0, xmm1
jbe 0x40740a
movsd qword [ebp + eax*8 - 0x3b4], xmm1
movsd qword [ebp + eax*8 - 0x3bc], xmm0
dec eax
cmp eax, ecx
jg 0x4073e0
inc ecx
cmp ecx, 0x35
jl 0x4073d0
mov eax, dword [0x420170]
mov ecx, 0x420170
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x488], eax
mov eax, dword [0x420170]
mov ecx, 0x420170
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x484], eax
mov eax, dword [0x420170]
mov ecx, 0x420170
call dword [eax + 0xc]
lea esi, [eax + 0x10]
lea eax, [ebp - 0x108]
mov dword [ebp - 0x45c], esi
test eax, 0xffff0000
jne 0x407485
movzx edi, ax
push 0
push edi
call fcn.00404440
add esp, 8
test eax, eax
je 0x4074b2
push edi
push eax
lea ecx, [ebp - 0x45c]
call fcn.004058b0
jmp 0x4074ac
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407490
sub ecx, edx
push ecx
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x45c]
call fcn.00405ef0
mov esi, dword [ebp - 0x45c]
push 0x5c
push esi
call fcn.00409aea
add esp, 8
test eax, eax
jne 0x4074c6
or eax, 0xffffffff
jmp 0x4074c8
sub eax, esi
push str.utils.exe
inc eax
push eax
lea eax, [ebp - 0x480]
push eax
lea ecx, [ebp - 0x45c]
call fcn.00405840
push eax
lea eax, [ebp - 0x47c]
push eax
call fcn.00404130
mov edx, dword [eax]
lea eax, [esi - 0x10]
lea edi, [edx - 0x10]
add esp, 0xc
or ebx, 0xffffffff
mov dword [ebp - 0x478], eax
cmp edi, eax
je 0x4075b2
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
mov dword [ebp - 0x46c], ecx
jl 0x40759d
mov ecx, dword [edi]
cmp ecx, dword [eax]
jne 0x40759d
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
mov ecx, eax
jl 0x407544
cmp ecx, dword [edi]
jne 0x407544
mov esi, edi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x407573
mov eax, dword [ecx]
push 1
push dword [edi + 4]
call dword [eax]
mov esi, eax
test esi, esi
je 0x407ff2
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 4]
inc ecx
push ecx
lea eax, [edi + 0x10]
push eax
push ecx
lea eax, [esi + 0x10]
push eax
call fcn.00409457
add esp, 0x10
mov ecx, dword [ebp - 0x46c]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x407592
mov edx, dword [ebp - 0x478]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0x10
mov dword [ebp - 0x45c], esi
jmp 0x4075b2
push dword [edx - 0xc]
lea ecx, [ebp - 0x45c]
push edx
call fcn.00405ef0
mov esi, dword [ebp - 0x45c]
mov edx, dword [ebp - 0x47c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4075d1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x480]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4075f0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x488]
push eax
call fcn.00404de0
push dword [ebp - 0x474]
lea eax, [ebp - 0x484]
push dword [ebp - 0x488]
push str._parent_s__s
push eax
call fcn.00404770
add esp, 0x14
call fcn.00407100
test al, al
jne 0x4076b4
mov edx, dword [0x4201a0]
xor edi, edi
mov ecx, edi
and ecx, 1
dec ecx
not ecx
and ecx, edx
mov eax, edi
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
inc edi
add edx, eax
cmp edi, 0x100
jl 0x407631
mov dword [0x4201a0], edx
mov edi, dword [ebp - 0x484]
cmp dword [edi - 0xc], 0
jl 0x407b1b
push str._brwtype
push edi
call fcn.00409b8e
add esp, 8
test eax, eax
je 0x407b1b
sub eax, edi
js 0x407b1b
call fcn.00407190
test al, al
jne 0x4076f1
dec dword [0x420294]
mov eax, dword [0x420170]
mov ecx, 0x420170
mov byte [ebp - 0x46d], 0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x464], eax
mov eax, str._runexe
test eax, 0xffff0000
jne 0x40773b
movzx edi, ax
push 0
push edi
call fcn.00404440
add esp, 8
test eax, eax
je 0x40774d
push edi
push eax
lea ecx, [ebp - 0x464]
call fcn.004058b0
jmp 0x40774d
push 8
push str._runexe
lea ecx, [ebp - 0x464]
call fcn.00405ef0
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x474]
push eax
call fcn.00404a00
mov edx, dword [ebp - 0x464]
add edx, 0xfffffff0
add esp, 0xc
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407789
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x474]
cmp dword [eax - 0xc], 0
je 0x407ae7
lea eax, [ebp - 0x474]
push eax
call fcn.00404510
add esp, 4
test al, al
je 0x407ae7
push 0x103
lea eax, [ebp - 0x20b]
push 0
push eax
mov byte [ebp - 0x20c], 0
call fcn.00409350
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x407ae7
call fcn.004071f0
test al, al
jne 0x4077f8
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, dword [0x420170]
mov ecx, 0x420170
call dword [eax + 0xc]
lea edi, [eax + 0x10]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x468], edi
test eax, 0xffff0000
jne 0x407845
movzx eax, ax
push 0
push eax
call fcn.00404440
add esp, 8
test eax, eax
je 0x407872
lea edx, [ebp - 0x20c]
movzx ecx, dx
push ecx
push eax
lea ecx, [ebp - 0x468]
call fcn.004058b0
jmp 0x40786c
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407850
sub ecx, edx
push ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x468]
call fcn.00405ef0
mov edi, dword [ebp - 0x468]
mov ecx, dword [edi - 0xc]
lea eax, [ecx - 1]
test eax, eax
js 0x407ff7
cmp eax, ecx
jg 0x407ff7
cmp byte [eax + edi], 0x5c
je 0x4078a6
push 1
push 0x418580
lea ecx, [ebp - 0x468]
call fcn.004042d0
mov edi, dword [ebp - 0x468]
lea eax, [ebp - 0x468]
push eax
call fcn.00404650
add esp, 4
test al, al
je 0x407aac
call fcn.00407210
test al, al
jne 0x4078d6
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov eax, dword [0x420170]
mov ecx, 0x420170
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x464], eax
call fcn.004092f4
cdq
mov ecx, 0x2710
idiv ecx
lea eax, [ebp - 0x464]
push edx
push str._d.exe
push eax
call fcn.00404770
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x46c]
push eax
call fcn.00403fb0
add esp, 0x18
push 0
push dword [eax]
push dword [ebp - 0x474]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x46c]
add eax, 0xfffffff0
mov dword [ebp - 0x478], eax
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407968
mov ecx, dword [eax]
push dword [ebp - 0x478]
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x47c], 0
je 0x407a58
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x46c]
push eax
call fcn.00403fb0
push eax
call fcn.00404510
mov byte [ebp - 0x45d], al
mov eax, dword [ebp - 0x46c]
add eax, 0xfffffff0
add esp, 0x10
mov dword [ebp - 0x478], eax
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4079d3
mov ecx, dword [eax]
push dword [ebp - 0x478]
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x45d], 0
je 0x407a31
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x46c]
push eax
call fcn.00403fb0
add esp, 0xc
lea ecx, [ebp - 0x45c]
push eax
call fcn.00403f40
mov edx, dword [ebp - 0x46c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407a24
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x45c]
mov byte [ebp - 0x46d], 1
mov eax, dword [0x4201a0]
imul eax, eax
cdq
mov ecx, 0xd
idiv ecx
cmp edx, 7
jne 0x407a58
push 4
call fcn.00408057
mov ecx, dword [0x4201a0]
add esp, 4
mov dword [eax], ecx
mov edx, dword [0x4201a0]
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
mov ecx, 0xa
idiv ecx
cmp edx, 9
jne 0x407a8d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x50
div ecx
inc edx
mov dword [0x4201a0], edx
mov edx, dword [ebp - 0x464]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407aac
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00407190
test al, al
jne 0x407ac5
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
add edi, 0xfffffff0
mov ecx, ebx
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407ade
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x46d], 0
jne 0x407afc
push 0x418520
push str._brwtype
lea ecx, [ebp - 0x484]
call fcn.00405bf0
mov edx, dword [ebp - 0x474]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407b1b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [esi - 0xc], 0
jne 0x407c87
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407b30
sub ecx, edx
push ecx
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x45c]
call fcn.00405ef0
mov esi, dword [ebp - 0x45c]
push 0x5c
push esi
call fcn.00409aea
add esp, 8
test eax, eax
jne 0x407b66
or eax, 0xffffffff
jmp 0x407b68
sub eax, esi
push str.utils.exe
inc eax
push eax
lea eax, [ebp - 0x480]
push eax
lea ecx, [ebp - 0x45c]
call fcn.00405840
push eax
lea eax, [ebp - 0x47c]
push eax
call fcn.00404130
mov edx, dword [eax]
lea eax, [esi - 0x10]
lea edi, [edx - 0x10]
add esp, 0xc
mov dword [ebp - 0x478], eax
cmp edi, eax
je 0x407c49
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
mov dword [ebp - 0x46c], ecx
jl 0x407c3a
mov ecx, dword [edi]
cmp ecx, dword [eax]
jne 0x407c3a
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
mov ecx, eax
lea eax, [edi + 0xc]
jl 0x407be1
cmp ecx, dword [edi]
jne 0x407be1
mov esi, edi
mov ecx, 1
lock xadd dword [eax], ecx
jmp 0x407c10
mov eax, dword [ecx]
push 1
push dword [edi + 4]
call dword [eax]
mov esi, eax
test esi, esi
je 0x408001
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 4]
inc ecx
push ecx
lea eax, [edi + 0x10]
push eax
push ecx
lea eax, [esi + 0x10]
push eax
call fcn.00409457
add esp, 0x10
mov ecx, dword [ebp - 0x46c]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x407c2f
mov edx, dword [ebp - 0x478]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esi + 0x10]
mov dword [ebp - 0x45c], eax
jmp 0x407c49
push dword [edx - 0xc]
lea ecx, [ebp - 0x45c]
push edx
call fcn.00405ef0
mov edx, dword [ebp - 0x47c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407c68
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x480]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407c87
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x45c]
push eax
call fcn.00405df0
add esp, 8
test al, al
jne 0x407f82
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [ebp - 0x45c]
push eax
push eax
call fcn.0040953d
mov edx, dword [0x420170]
add esp, 8
test eax, eax
mov ecx, 0x420170
sete byte [ebp - 0x45d]
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x46c]
push eax
call fcn.00406590
add esp, 4
call fcn.00407130
test al, al
jne 0x407d5e
mov esi, dword [0x4201a0]
test esi, esi
je 0x407d5e
nop
mov ecx, esi
and ecx, 0x80000001
jns 0x407d0f
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x407d1c
mov eax, esi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
jmp 0x407d23
lea esi, [esi*2 + 1]
mov eax, 0x55555556
imul esi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, esi
lea eax, [eax + eax*2]
sub ecx, eax
mov dword [0x4201a0], esi
sub ecx, 0
je 0x407d4d
sub ecx, 2
je 0x407d50
dec ecx
je 0x407d51
jmp 0x407d5a
add esi, 2
inc esi
add esi, 2
mov dword [0x4201a0], esi
test esi, esi
jne 0x407d00
lea eax, [ebp - 0x478]
push eax
call fcn.00406150
lea eax, [ebp - 0x468]
push eax
call fcn.00406940
lea eax, [ebp - 0x47c]
push eax
call fcn.00406050
lea eax, [ebp - 0x480]
push eax
call fcn.00406800
lea eax, [ebp - 0x474]
push eax
call fcn.004055c0
mov eax, dword [ebp - 0x474]
add esp, 0x14
cmp dword [eax - 0xc], 0
jne 0x407dc1
push 1
push 0x41858c
lea ecx, [ebp - 0x474]
call fcn.00405ef0
mov eax, dword [ebp - 0x474]
push dword [ebp - 0x490]
xor ecx, ecx
cmp byte [ebp - 0x45d], cl
setne cl
push ecx
push edi
mov edi, dword [ebp - 0x468]
push eax
push dword [ebp - 0x480]
lea eax, [ebp - 0x464]
push edi
push dword [ebp - 0x478]
push dword [ebp - 0x47c]
push dword [ebp - 0x46c]
push str._s_ie_error.gif_t_t_actionuninstallation_t_tapp_s_t_tbic_s_t_tverifier_s_t_tver_s_t_tos_s_t_terrorrun_uninstall_from_proxy_t_tlasterror0x_x_t_tfileexists_d_t_trnd_d
push eax
call fcn.00404770
mov ecx, dword [0x4201b8]
add esp, 0x2c
test ecx, ecx
jne 0x407e55
push 0x41f010
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x4201b8], 0
jne 0x407e44
push 0x5c
call fcn.00408057
add esp, 4
test eax, eax
je 0x407e3d
mov ecx, eax
call fcn.00402360
jmp 0x407e3f
xor eax, eax
mov dword [0x4201b8], eax
push 0x41f010
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x4201b8]
mov esi, dword [ebp - 0x464]
push 0
push 0
push 0x418520
push esi
push 0
call fcn.00403790
call fcn.00407060
test al, al
jne 0x407e96
mov esi, dword [0x4201a0]
xor ebx, ebx
mov edi, esi
nop
inc ebx
dec edi
cmp ebx, 0x29
jb 0x407e80
mov esi, dword [ebp - 0x464]
mov edi, dword [ebp - 0x468]
or ebx, 0xffffffff
call fcn.00407130
test al, al
jne 0x407eb5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x50
div ecx
inc edx
mov dword [0x4201a0], edx
mov edx, dword [ebp - 0x474]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407ed4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x480]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407ef3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x47c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407f12
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov ecx, ebx
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407f2b
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x478]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407f4a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x46c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407f69
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407f82
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x45c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407fa1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x484]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407fc0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x488]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
pop edi
pop esi
test ebx, ebx
pop ebx
jg 0x407fe0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00408854
mov esp, ebp
pop ebp
ret 0x10
call fcn.00405f90
push 0x80070057
call fcn.004044b0
call fcn.00405f90
int3