Function at 0x427d60
Capabilities:
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xffffffc0
sub esp, 0x200
mov eax, dword [edx + 8]
mov edi, edx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x18], edx
test eax, eax
jne 0x428213
lea ecx, [esp + 0xc0]
mov edx, 0xf91d24
push 0x11
call fcn.00485960
add esp, 4
mov edi, dword [esp + 0xc0]
mov eax, edi
neg eax
jo 0x427ecb
mov eax, dword [esp + 0xc4]
mov ebx, dword [esp + 0xc8]
test byte [esp + 0xcc], 1
mov dword [esp + 0x10], eax
je 0x427dfd
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x427eb8
cmp ebx, 1
jne 0x427e74
movzx eax, byte [esi]
cmp eax, 0x2b
je 0x427eb8
mov ebx, 1
cmp eax, 0x2d
mov ecx, esi
je 0x427eb8
jmp 0x4280e5
test ebx, ebx
je 0x427eb4
mov edx, dword [esp + 0x10]
lea esi, [edx + ebx]
jmp 0x427e26
add edx, 2
cmp ecx, esi
cmovne ecx, edx
nop word cs:[eax + eax]
cmp ecx, esi
mov edx, ecx
je 0x427dc7
movzx eax, byte [edx]
lea ecx, [edx + 1]
test al, al
jns 0x427e20
cmp al, 0xe0
jb 0x427e0e
cmp al, 0xed
jne 0x427e54
cmp ecx, esi
je 0x427dc7
lea eax, [edx + 2]
cmp eax, esi
je 0x427dc7
cmp byte [edx + 1], 0x9f
ja 0x4295b7
add edx, 3
mov ecx, edx
jmp 0x427e20
add edx, 2
cmp ecx, esi
cmove edx, ecx
xor ecx, ecx
cmp edx, esi
setne cl
add ecx, edx
cmp al, 0xf0
jb 0x427e20
xor eax, eax
cmp ecx, esi
setne al
add ecx, eax
jmp 0x427e20
cmp byte [esi], 0x2b
jne 0x4280da
cmp ebx, 0xa
lea ecx, [esi + 1]
lea ebx, [ebx - 1]
jb 0x4280e5
xor eax, eax
nop
sub ebx, 1
jb 0x428109
mov edx, 0xa
mul edx
jo 0x427eb8
movzx edx, byte [ecx]
add edx, 0xffffffd0
cmp edx, 9
ja 0x427eb8
inc ecx
add eax, edx
jae 0x427e90
jmp 0x427eb8
mov esi, dword [esp + 0x10]
test edi, edi
je 0x427ecb
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ebx, [esp + 0xc0]
mov edx, 0xf91d35
mov ecx, ebx
push 0x11
call fcn.00485960
add esp, 4
mov edi, dword [esp + 0xc0]
mov eax, edi
neg eax
jno 0x427ef9
mov edi, dword [esp + 0x18]
jmp 0x428024
mov eax, dword [esp + 0xc4]
mov ebx, dword [esp + 0xc8]
test byte [esp + 0xcc], 1
mov dword [esp + 0x10], eax
je 0x427f4b
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x428006
cmp ebx, 1
jne 0x427fc4
movzx eax, byte [esi]
cmp eax, 0x2b
je 0x428006
mov ebx, 1
cmp eax, 0x2d
mov ecx, esi
je 0x428006
jmp 0x4281c8
test ebx, ebx
je 0x428002
mov edx, dword [esp + 0x10]
lea esi, [edx + ebx]
jmp 0x427f76
add edx, 2
cmp ecx, esi
cmovne ecx, edx
nop word cs:[eax + eax]
nop
cmp ecx, esi
mov edx, ecx
je 0x427f15
movzx eax, byte [edx]
lea ecx, [edx + 1]
test al, al
jns 0x427f70
cmp al, 0xe0
jb 0x427f5c
cmp al, 0xed
jne 0x427fa4
cmp ecx, esi
je 0x427f15
lea eax, [edx + 2]
cmp eax, esi
je 0x427f15
cmp byte [edx + 1], 0x9f
ja 0x4295cd
add edx, 3
mov ecx, edx
jmp 0x427f70
add edx, 2
cmp ecx, esi
cmove edx, ecx
xor ecx, ecx
cmp edx, esi
setne cl
add ecx, edx
cmp al, 0xf0
jb 0x427f70
xor eax, eax
cmp ecx, esi
setne al
add ecx, eax
jmp 0x427f70
cmp byte [esi], 0x2b
jne 0x4281bd
cmp ebx, 0xa
lea ecx, [esi + 1]
lea ebx, [ebx - 1]
jb 0x4281c8
xor eax, eax
sub ebx, 1
jb 0x4281e9
mov edx, 0xa
mul edx
jo 0x428006
movzx edx, byte [ecx]
add edx, 0xffffffd0
cmp edx, 9
ja 0x428006
inc ecx
add eax, edx
jae 0x427fde
jmp 0x428006
mov esi, dword [esp + 0x10]
test edi, edi
mov edi, dword [esp + 0x18]
lea ebx, [esp + 0xc0]
je 0x428024
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pxor xmm0, xmm0
mov dword [esp + 0xe0], 0
movdqa xmmword [esp + 0xd0], xmm0
movdqa xmmword [esp + 0xc0], xmm0
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0xd4]
test eax, eax
jne 0x428213
mov ecx, dword [0xf95040]
mov eax, dword [0xf95044]
cmp cl, 4
je 0x428213
cmp cl, 4
je 0x428213
mov esi, 1
cmp cl, 3
jne 0x428220
mov ebx, dword [eax + 4]
mov esi, dword [eax]
mov ecx, dword [ebx]
test ecx, ecx
je 0x42809b
push esi
mov edi, eax
call ecx
mov eax, edi
add esp, 4
cmp dword [ebx + 4], 0
je 0x4280bd
cmp dword [ebx + 8], 9
mov edi, eax
jb 0x4280ac
mov esi, dword [esi - 4]
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov edi, dword [esp + 0x18]
push eax
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, 1
jmp 0x428220
cmp ebx, 9
mov ecx, esi
jae 0x427e8c
xor eax, eax
nop word [eax + eax]
movzx edx, byte [ecx]
add edx, 0xffffffd0
cmp edx, 9
ja 0x427eb8
lea eax, [eax + eax*4]
inc ecx
dec ebx
lea eax, [edx + eax*2]
jne 0x4280f0
test edi, edi
je 0x428120
push esi
push 0
push dword [0xfd5200]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
mov edi, dword [esp + 0x18]
test eax, eax
jne 0x428213
pxor xmm0, xmm0
lea eax, [esp + 0xc0]
mov dword [esp + 0xe0], 0
movdqa xmmword [esp + 0xd0], xmm0
movdqa xmmword [esp + 0xc0], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0xd4]
test eax, eax
jne 0x428213
mov ecx, dword [0xf95040]
mov eax, dword [0xf95044]
cmp cl, 4
je 0x428213
cmp cl, 4
je 0x428213
mov esi, 1
cmp cl, 3
jne 0x428220
mov ebx, dword [eax + 4]
mov esi, dword [eax]
mov ecx, dword [ebx]
test ecx, ecx
je 0x4281ae
push esi
mov edi, eax
call ecx
mov eax, edi
mov edi, dword [esp + 0x1c]
add esp, 4
cmp dword [ebx + 4], 0
jne 0x4280a1
jmp 0x4280c1
cmp ebx, 9
mov ecx, esi
jae 0x427fdc
xor eax, eax
nop word [eax + eax]
movzx edx, byte [ecx]
add edx, 0xffffffd0
cmp edx, 9
ja 0x428006
lea eax, [eax + eax*4]
inc ecx
dec ebx
lea eax, [edx + eax*2]
jne 0x4281d0
test edi, edi
lea ebx, [esp + 0xc0]
je 0x428207
push esi
push 0
push dword [0xfd5200]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
mov edi, dword [esp + 0x18]
test eax, eax
je 0x428024
cmp eax, 0xff
mov esi, 0xff
cmovb esi, eax
movzx eax, byte [edi + 0x2d]
test esi, esi
mov dword [esp + 0xc0], 0
mov dword [esp + 0xc4], 4
mov dword [esp + 0xc8], 0
mov dword [esp + 0xcc], 0
mov dword [esp + 0xd0], 4
mov dword [esp + 0xd4], 0
mov dword [esp + 0x30], esi
jne 0x4291b5
mov dword [esp + 0xc0], 0
mov dword [esp + 0xc4], 4
mov dword [esp + 0xc8], 0
mov dword [esp + 0x20], 4
mov dword [esp + 0x40], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c0], 0
mov edi, 4
xor esi, esi
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 4
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0xc8]
movq xmm0, qword [esp + 0xc0]
mov ecx, 0x1c
mov dword [esp + 0x1a8], eax
mov eax, esi
movq qword [esp + 0x1a0], xmm0
mul ecx
jo 0x429606
cmp eax, 0x7ffffffd
jae 0x429606
xor ebx, ebx
test eax, eax
je 0x42833b
movzx ecx, byte [0xfd520d]
mov edx, eax
xor ecx, ecx
call fcn.00494530
test eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], esi
je 0x429606
test esi, esi
jne 0x42834f
jmp 0x42839a
mov dword [esp + 0x10], 4
mov dword [esp + 0x24], 0
test esi, esi
je 0x42839a
mov eax, dword [esp + 0x10]
lea esi, [edi + esi*8]
xor ebx, ebx
lea ecx, [eax + 0x18]
nop dword [eax + eax]
mov edx, dword [edi + ebx*8]
movzx eax, byte [edi + ebx*8 + 4]
mov dword [ecx - 0x18], 0
mov word [ecx - 0x14], 0
mov dword [ecx - 0x10], 0
mov word [ecx - 0xc], 0
mov dword [ecx - 8], 0
mov dword [ecx - 4], edx
lea edx, [edi + ebx*8 + 8]
mov byte [ecx], al
add ecx, 0x1c
inc ebx
cmp edx, esi
jne 0x428360
cmp dword [esp + 0x1c0], 0
je 0x4283b3
push edi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp + 0x30]
test esi, esi
je 0x428405
mov edx, esi
movzx eax, byte [0xfd520d]
xor ecx, ecx
shl edx, 6
add edx, 0x40
call fcn.00494530
test eax, eax
je 0x429606
mov ecx, eax
and ecx, 0xffffffc0
mov dword [ecx + 0x3c], eax
lea edi, [ecx + 0x40]
add ecx, 0x45
mov eax, esi
nop dword [eax]
mov dword [ecx - 5], 0
mov word [ecx - 1], 0
add ecx, 0x40
dec eax
jne 0x4283f0
jmp 0x42840a
mov edi, 0x40
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, 0x2f8
call fcn.00494530
test eax, eax
je 0x429606
mov esi, eax
push 0x2f8
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [esp + 0x1a8]
movsd xmm0, qword [esp + 0x1a0]
xor ecx, ecx
mov edx, 0x180
mov dword [esp + 0x5b], eax
mov eax, dword [esp + 0x18]
movsd qword [esp + 0x53], xmm0
movq xmm0, qword [eax + 0xc]
movsd xmm2, qword [eax + 0x1c]
mov dword [eax + 0xc], 0
mov dword [eax + 0x1c], 0
movsd xmm1, qword [eax + 0x24]
mov dword [eax + 0x24], 0
movaps xmmword [esp + 0x1c0], xmm2
movsd xmm2, qword [esp + 0x50]
movdqa xmmword [esp + 0x190], xmm0
movaps xmmword [esp + 0x1d0], xmm1
movsd xmm1, qword [esp + 0x57]
movsd qword [esp + 0xc7], xmm1
movsd qword [esp + 0xc0], xmm2
movzx eax, byte [0xfd520d]
call fcn.00494530
test eax, eax
je 0x429606
mov ecx, eax
mov edx, dword [esp + 0x2c]
and ecx, 0xffffffc0
mov dword [ecx + 0x3c], eax
mov dword [ecx + 0x40], 1
mov dword [ecx + 0x44], 1
mov dword [ecx + 0x80], 0
mov dword [ecx + 0x84], esi
mov dword [ecx + 0xc0], 0
mov dword [ecx + 0xc4], esi
mov byte [ecx + 0x100], 0
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x1c]
movsd xmm0, qword [esp + 0xc0]
movsd xmm1, qword [esp + 0xc7]
movsd qword [ecx + 0x101], xmm0
movaps xmm0, xmmword [esp + 0x190]
movsd qword [ecx + 0x108], xmm1
unpcklpd xmm0, xmmword [esp + 0x1c0]
movups xmmword [ecx + 0x110], xmm0
movdqa xmm0, xmmword [esp + 0x1d0]
movq qword [ecx + 0x120], xmm0
mov dword [ecx + 0x128], 1
mov dword [ecx + 0x12c], eax
mov dword [ecx + 0x130], edi
mov dword [ecx + 0x134], eax
mov eax, dword [esp + 0x24]
mov dword [ecx + 0x138], 0
mov edi, edx
pxor xmm0, xmm0
shl edi, 4
mov dword [ecx + 0x13c], eax
mov eax, dword [esp + 0x10]
mov dword [ecx + 0x140], eax
lea eax, [ecx + 0x40]
mov dword [ecx + 0x144], ebx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x20]
add edi, eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x58], ecx
test edx, edx
mov dword [esp + 0x5c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x60], esi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x64], esi
lea eax, [esi + eax*8]
mov esi, dword [esp + 0x28]
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], eax
movq qword [esp + 0x70], xmm0
movq qword [esp + 0x78], xmm0
je 0x428f16
mov esi, dword [esp + 0x20]
jmp 0x42862a
mov eax, dword [esp + 0x5c]
mov esi, dword [esp + 0x54]
mov edi, dword [esp + 0x18]
mov dword [esp + 0x30], eax
nop word cs:[eax + eax]
cmp esi, dword [esp + 0x30]
je 0x428f16
lea edx, [esi + 0x10]
mov dword [esp + 0x54], edx
movzx ebx, byte [esi + 0xc]
cmp bl, 2
je 0x428f16
mov eax, dword [esi + 8]
lea ecx, [esp + 0xcd]
mov dword [esp + 0xc8], eax
movsd xmm0, qword [esi]
movsd qword [esp + 0xc0], xmm0
movzx eax, byte [esi + 0xf]
mov byte [ecx + 2], al
movzx eax, word [esi + 0xd]
mov word [ecx], ax
mov eax, dword [esp + 0x64]
mov byte [esp + 0xcc], bl
cmp eax, dword [esp + 0x6c]
je 0x428efe
lea ecx, [eax + 8]
movsd xmm0, qword [esp + 0xc0]
add esi, 0xd
mov dword [esp + 0x190], edx
mov byte [esp + 0x14], bl
mov dword [esp + 0x64], ecx
mov ecx, dword [eax]
mov dword [esp + 0x24], ecx
mov ch, byte [eax + 4]
mov eax, dword [esp + 0xc8]
movsd qword [esp + 0x1b0], xmm0
mov dword [esp + 0x1b8], eax
mov byte [esp + 0x28], ch
movzx eax, word [esi]
mov word [esp + 0x38], ax
movzx eax, byte [esi + 2]
mov esi, dword [esp + 0x7c]
mov byte [esp + 0x3a], al
lea eax, [esi + 1]
mov dword [esp + 0x7c], eax
mov eax, dword [edi + 0x14]
test eax, eax
je 0x428720
mov ecx, dword [edi + 0x18]
push esi
push eax
lea eax, [esp + 0xc8]
push eax
call dword [ecx + 0x10]
add esp, 0xc
mov eax, dword [esp + 0xc0]
mov ecx, dword [esp + 0xc4]
mov edx, dword [esp + 0xc8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x2c], edx
jmp 0x428725
mov eax, 0x80000000
mov ebx, dword [esp + 0x34]
mov ecx, edi
mov edi, dword [edi]
mov edx, dword [ecx + 4]
lock inc dword [ebx]
jle 0x429606
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x94], eax
mov dword [esp + 0x10], edx
movq xmm0, qword [esp + 0x1b0]
test esi, esi
mov dword [esp + 0x98], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x9c], ecx
mov ecx, dword [esp + 0x1b8]
mov dword [esp + 0x8c], edi
mov dword [esp + 0x90], edx
lea edx, [esp + 0xa8]
movq qword [edx], xmm0
mov dword [edx + 8], ecx
movzx ecx, byte [esp + 0x14]
mov byte [esp + 0xb4], cl
movzx ecx, word [esp + 0x38]
mov word [edx + 0xd], cx
movzx ecx, byte [esp + 0x3a]
mov byte [edx + 0xf], cl
mov ecx, dword [esp + 0x24]
movzx edx, byte [esp + 0x28]
mov dword [esp + 0xa0], ecx
mov byte [esp + 0xa4], dl
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], esi
jne 0x4288d0
mov ecx, dword [esp + 0x18]
cmp byte [ecx + 0x2c], 0
je 0x4288d0
mov ecx, dword [0xfd5210]
mov edx, dword fs:[0x2c]
lea edi, [esp + 0xc0]
mov ecx, dword [edx + ecx*4]
cmp dword [ecx + 0x24], 0
jne 0x429520
mov ecx, edi
lea edx, [esp + 0x8c]
call fcn.00426f10
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00494530
test eax, eax
je 0x429606
mov esi, eax
and esi, 0xffffffc0
mov dword [esi + 0x3c], eax
add esi, 0x40
push 0xc0
push edi
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [0xfd5210]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
cmp dword [eax + 0x24], 0
jne 0x429606
mov eax, dword [0xfd5210]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x24], esi
cmp dword [ebx + 0x104], 0
je 0x429606
mov edi, dword [ebx + 0x100]
xor eax, eax
mov cl, 1
lock cmpxchg byte [edi + 4], cl
lea esi, [edi + 4]
jne 0x428ec7
mov byte [edi + 5], 1
lock inc dword [edi]
push edi
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressAll]
xor eax, eax
xchg byte [edi + 4], al
cmp al, 2
jne 0x428606
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
jmp 0x428606
neg eax
mov dword [esp + 0x20], ebx
jno 0x4288f0
mov edx, 0x80000000
xor esi, esi
mov eax, dword [esp + 0x10]
test edi, edi
je 0x428936
jmp 0x428944
mov esi, dword [esp + 0x2c]
test esi, esi
js 0x429606
je 0x428919
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, esi
call fcn.00494530
mov ebx, eax
test eax, eax
jne 0x42891e
jmp 0x429606
mov ebx, 1
push esi
push dword [esp + 0x20]
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, esi
mov eax, dword [esp + 0x10]
test edi, edi
jne 0x428944
mov eax, dword [0xfd5208]
test eax, eax
je 0x4289c6
dec eax
mov ecx, edx
mov dword [esp + 0x10], eax
neg ecx
jno 0x428ac0
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, 0x20
call fcn.00494530
test eax, eax
je 0x429606
mov dword [eax], 1
mov dword [eax + 4], 1
mov dword [eax + 0x10], 2
mov edi, eax
movq xmm0, qword [0xfd51e0]
movd eax, xmm0
pshufd xmm0, xmm0, 0x55
movd edx, xmm0
nop dword [eax + eax]
mov ecx, eax
and ecx, edx
cmp ecx, 0xffffffff
je 0x429606
mov ebx, eax
mov ecx, edx
add ebx, 1
adc ecx, 0
lock cmpxchg8b qword [0xfd51e0]
jne 0x4289a0
jmp 0x428c11
lea ecx, [esp + 0xc0]
mov dword [esp + 0x10], edx
mov edx, 0xfb871d
push 0xe
call fcn.00485960
add esp, 4
mov ecx, dword [esp + 0xc0]
mov eax, ecx
neg eax
jno 0x4289f7
mov eax, 0x200000
jmp 0x428aa0
mov edx, dword [esp + 0xc4]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x44]
mov dword [esp + 0x24], edx
push dword [esp + 0xc8]
call fcn.00416fe0
add esp, 4
test byte [esp + 0x44], 1
jne 0x428a7e
mov edi, dword [esp + 0x4c]
test edi, edi
je 0x428a7e
mov ecx, dword [esp + 0x48]
cmp edi, 1
jne 0x428a48
movzx eax, byte [ecx]
cmp eax, 0x2b
je 0x428a7e
mov edi, 1
cmp eax, 0x2d
je 0x428a7e
jmp 0x428edc
cmp byte [ecx], 0x2b
jne 0x428ed3
inc ecx
cmp edi, 0xa
lea edi, [edi - 1]
jb 0x428edc
xor eax, eax
sub edi, 1
jb 0x428a83
mov edx, 0xa
mul edx
jo 0x428a7e
movzx edx, byte [ecx]
add edx, 0xffffffd0
cmp edx, 9
ja 0x428a7e
inc ecx
add eax, edx
jae 0x428a60
mov eax, 0x200000
cmp dword [esp + 0x14], 0
je 0x428aa0
push dword [esp + 0x24]
push 0
push dword [0xfd5200]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
lea ecx, [eax + 1]
mov dword [0xfd5208], ecx
mov edx, dword [esp + 0x10]
mov ecx, edx
mov dword [esp + 0x10], eax
neg ecx
jo 0x428952
nop dword [eax + eax]
cmp esi, 7
mov dword [esp + 0xc0], edx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], esi
ja 0x428b02
test esi, esi
je 0x428b8d
nop word cs:[eax + eax]
nop dword [eax]
cmp byte [ebx], 0
je 0x429606
inc ebx
dec esi
jne 0x428af0
jmp 0x428b8d
lea edx, [ebx + 3]
and edx, 0xfffffffc
mov eax, edx
sub eax, ebx
jne 0x428b19
lea eax, [esi - 8]
mov dword [esp + 0x14], eax
xor eax, eax
jmp 0x428b40
mov ecx, ebx
sub ecx, edx
mov edx, ebx
nop
cmp byte [edx], 0
je 0x429606
inc edx
inc ecx
jne 0x428b20
lea ecx, [esi - 8]
cmp eax, ecx
mov dword [esp + 0x14], ecx
ja 0x428b6e
nop dword [eax + eax]
mov edi, dword [ebx + eax + 4]
mov edx, dword [ebx + eax]
mov ecx, 0x1010100
sub ecx, edi
or ecx, edi
mov edi, 0x1010100
sub edi, edx
or edi, edx
and edi, ecx
not edi
test edi, 0x80808080
jne 0x428b6e
add eax, 8
cmp eax, dword [esp + 0x14]
jbe 0x428b40
sub esi, eax
je 0x428b8d
add ebx, eax
nop word cs:[eax + eax]
nop
cmp byte [ebx], 0
je 0x429606
inc ebx
dec esi
jne 0x428b80
lea ecx, [esp + 0xc0]
call fcn.00415260
mov esi, eax
movzx eax, byte [0xfd520d]
mov ebx, edx
xor ecx, ecx
mov edx, 0x20
call fcn.00494530
test eax, eax
je 0x429606
mov dword [eax], 1
mov dword [eax + 4], 1
mov dword [eax + 0x10], 1
mov dword [eax + 0x14], esi
mov dword [eax + 0x18], ebx
mov edi, eax
movq xmm0, qword [0xfd51e0]
movd eax, xmm0
pshufd xmm0, xmm0, 0x55
movd edx, xmm0
nop dword [eax]
mov ecx, eax
and ecx, edx
cmp ecx, 0xffffffff
je 0x429606
mov ebx, eax
mov ecx, edx
add ebx, 1
adc ecx, 0
lock cmpxchg8b qword [0xfd51e0]
jne 0x428bf0
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ecx
mov byte [edi + 0x1c], 0
lock inc dword [edi]
jle 0x429606
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, 0x18
call fcn.00494530
test eax, eax
je 0x429606
mov dword [eax], 1
mov dword [eax + 4], 1
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [esp + 0x44], eax
mov ebx, eax
lock inc dword [eax]
jle 0x429606
movzx eax, byte [0xfd5188]
test al, al
je 0x428d00
mov byte [0xfd5188], 1
mov eax, dword [0xfd5210]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov eax, dword [eax + 0x44]
cmp eax, 1
jne 0x428ea3
mov eax, dword [0xfd5210]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov esi, dword [eax + 0x48]
mov dword [eax + 0x48], 0
test esi, esi
je 0x428d00
lock inc dword [esi]
jle 0x429606
mov byte [0xfd5188], 1
mov eax, dword [0xfd5210]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov eax, dword [eax + 0x44]
cmp eax, 1
je 0x428d36
test eax, eax
je 0x428ebd
jmp 0x4295fa
movzx eax, byte [0xfd5188]
test al, al
je 0x428e87
mov byte [0xfd5188], 1
xor esi, esi
mov eax, dword [0xfd5210]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov eax, dword [eax + 0x44]
cmp eax, 1
jne 0x428eb5
mov eax, dword [0xfd5210]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], esi
mov ecx, dword [eax + 0x48]
mov dword [eax + 0x48], esi
test ecx, ecx
je 0x428d63
lock dec dword [ecx]
jne 0x428d63
call fcn.00427450
mov esi, dword [esp + 0x44]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x428d78
lock inc dword [ecx + 0xc]
jle 0x4295ee
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, 0x40
call fcn.00494530
test eax, eax
je 0x429606
mov ecx, dword [esp + 0x14]
mov dword [eax], edi
mov dword [eax + 4], ebx
mov edx, dword [esp + 0x10]
mov dword [eax + 8], ecx
movsd xmm0, qword [esp + 0x8c]
movsd xmm1, qword [esp + 0x94]
movsd qword [eax + 0xc], xmm0
movsd qword [eax + 0x14], xmm1
movsd xmm0, qword [esp + 0x9c]
movsd qword [eax + 0x1c], xmm0
movsd xmm0, qword [esp + 0xa4]
movsd qword [eax + 0x24], xmm0
movsd xmm0, qword [esp + 0xac]
movsd qword [eax + 0x2c], xmm0
movq xmm0, qword [esp + 0xb4]
movq qword [eax + 0x34], xmm0
mov ecx, dword [esp + 0xbc]
mov dword [eax + 0x3c], ecx
lea ecx, [esp + 0xc0]
push 0xf91d00
push eax
call fcn.00492730
add esp, 8
movzx ebx, byte [esp + 0xc0]
cmp bl, 4
jne 0x42901d
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x80], edi
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], eax
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lock dec dword [edi]
jne 0x428e5b
mov ecx, dword [esp + 0x80]
call fcn.00405af0
mov eax, dword [esp + 0x84]
lock dec dword [eax]
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x190]
jne 0x428620
lea ecx, [esp + 0x84]
call fcn.00427490
jmp 0x428620
mov dword [esp + 0x14], 0
mov esi, dword [esp + 0x44]
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x428d6e
jmp 0x428d78
test eax, eax
jne 0x429606
call fcn.004e9850
jmp 0x428c9d
test eax, eax
jne 0x429606
call fcn.004e9850
jmp 0x428d36
mov ecx, esi
call fcn.004e97a0
jmp 0x42889b
cmp edi, 9
jae 0x428a5e
xor eax, eax
nop
movzx edx, byte [ecx]
add edx, 0xffffffd0
cmp edx, 9
ja 0x428a7e
lea eax, [eax + eax*4]
inc ecx
dec edi
lea eax, [edx + eax*2]
jne 0x428ee0
jmp 0x428a83
mov eax, dword [esp + 0xc0]
lock dec dword [eax]
jne 0x428f16
lea ecx, [esp + 0xc0]
call fcn.004271e0
lea ecx, [esp + 0x50]
call fcn.00429610
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
mov dword [ecx + 4], eax
mov byte [ecx], 6
mov esi, dword [edi + 0xc]
test esi, esi
je 0x428f65
mov eax, dword [esp + 0x18]
mov edi, dword [eax + 0x10]
mov eax, dword [edi]
test eax, eax
je 0x428f47
push esi
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x428f65
cmp dword [edi + 8], 9
jb 0x428f56
mov esi, dword [esi - 4]
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x18]
mov esi, dword [eax + 0x14]
test esi, esi
je 0x428fa1
mov eax, dword [esp + 0x18]
mov edi, dword [eax + 0x18]
mov eax, dword [edi]
test eax, eax
je 0x428f83
push esi
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x428fa1
cmp dword [edi + 8], 9
jb 0x428f92
mov esi, dword [esi - 4]
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x18]
mov esi, dword [eax + 0x1c]
test esi, esi
je 0x428fdd
mov eax, dword [esp + 0x18]
mov edi, dword [eax + 0x20]
mov eax, dword [edi]
test eax, eax
je 0x428fbf
push esi
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x428fdd
cmp dword [edi + 8], 9
jb 0x428fce
mov esi, dword [esi - 4]
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x18]
mov esi, dword [eax + 0x24]
test esi, esi
je 0x429015
mov edi, dword [eax + 0x28]
mov eax, dword [edi]
test eax, eax
je 0x428ff7
push esi
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x429015
cmp dword [edi + 8], 9
jb 0x429006
mov esi, dword [esi - 4]
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0xc4]
movzx ecx, byte [esp + 0xc3]
movzx edx, word [esp + 0xc1]
mov dword [esp + 0x10], eax
shl edx, 8
shl ecx, 0x18
lock dec dword [esi]
jne 0x429058
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x44]
mov esi, edx
call fcn.00427490
mov ecx, dword [esp + 0x14]
mov edx, esi
or ecx, edx
lock dec dword [edi]
jne 0x42906a
mov esi, ecx
mov ecx, edi
call fcn.00405af0
mov ecx, esi
mov esi, dword [esp + 0x3c]
mov edx, dword [esp + 0x10]
movzx eax, bl
or ecx, eax
mov dword [esi + 4], edx
mov dword [esi], ecx
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x50]
call fcn.00429610
mov dword [esp + 0x20], esi
lock dec dword [esi + 0xe8]
jne 0x42918f
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0x104]
test eax, eax
je 0x42918f
mov ecx, dword [esp + 0x20]
mov esi, 4
xor ebx, ebx
mov edi, dword [ecx + 0x100]
lea ecx, [eax + eax*8]
lea ecx, [ecx + ecx*2]
add ecx, eax
add edi, 0x10
jmp 0x4290e0
add edi, 0x1c
add esi, 0x40
inc ebx
add ecx, 0xffffffe4
je 0x42918f
mov eax, 3
xchg dword [edi], eax
cmp eax, 2
jne 0x4290d0
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], edi
cmp dword [eax + 0xf4], ebx
jbe 0x429606
mov edi, dword [eax + 0xf0]
mov dl, 1
lea eax, [edi + esi]
mov dword [esp + 0x10], eax
xor eax, eax
lock cmpxchg byte [edi + esi], dl
mov edx, edi
mov dword [esp + 0x14], ecx
jne 0x42916d
cmp byte [edx + esi + 1], 0
mov edi, dword [esp + 0x1c]
je 0x42914d
mov byte [edx + esi + 1], 0
lea eax, [edx + esi - 4]
lock inc dword [edx + esi - 4]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
lock dec dword [eax + 0xf8]
mov edx, dword [esp + 0x10]
xor eax, eax
xchg byte [edx], al
cmp al, 2
jne 0x4290d0
push edx
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
mov ecx, dword [esp + 0x14]
jmp 0x4290d0
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], edx
call fcn.004e97a0
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
cmp byte [edx + esi + 1], 0
mov edi, dword [esp + 0x1c]
jne 0x429129
jmp 0x42914d
mov eax, dword [esp + 0x34]
lock dec dword [eax]
jne 0x4291a1
lea ecx, [esp + 0x34]
call fcn.00427230
mov edi, dword [esp + 0x18]
mov esi, dword [edi + 0xc]
test esi, esi
jne 0x428f34
jmp 0x428f65
mov edx, esi
mov byte [esp + 0x28], al
lea ecx, [esp + 0xc0]
push 0x10
call fcn.004e8c50
add esp, 4
mov edx, esi
lea ecx, [esp + 0xcc]
push 8
call fcn.004e8c50
add esp, 4
mov eax, dword [esp + 0xc8]
mov ecx, dword [esp + 0xc4]
mov edx, dword [esp + 0xd0]
mov ebx, dword [esp + 0xd4]
mov dword [esp + 0x2c], eax
shl eax, 4
mov dword [esp + 0x24], edx
mov edx, ebx
mov dword [esp + 0x20], ecx
lea edi, [eax + ecx + 0xc]
movzx eax, byte [0xfd520d]
cmp byte [esp + 0x28], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], esi
je 0x429290
xor ecx, ecx
mov edx, 0x200
call fcn.00494530
test eax, eax
je 0x429606
mov ebx, eax
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, 8
call fcn.00494530
test eax, eax
je 0x429606
mov dword [eax], ebx
mov dword [esp + 0x1c], ebx
mov dword [eax + 4], 0x40
mov esi, eax
xor ecx, ecx
mov edx, pe_nt_image_headers32
xor ebx, ebx
movzx eax, byte [0xfd520d]
call fcn.00494530
test eax, eax
jne 0x4292ed
jmp 0x429606
xor ecx, ecx
mov edx, 0x200
call fcn.00494530
test eax, eax
je 0x429606
mov ebx, eax
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, 8
call fcn.00494530
test eax, eax
je 0x429606
mov dword [eax], ebx
mov dword [esp + 0x1c], ebx
mov dword [eax + 4], 0x40
mov esi, eax
xor ecx, ecx
mov edx, pe_nt_image_headers32
movzx eax, byte [0xfd520d]
call fcn.00494530
test eax, eax
je 0x429606
mov bl, 1
mov ecx, eax
and ecx, 0xffffffc0
mov dword [ecx + 0x3c], eax
mov dword [ecx + 0x40], 1
mov dword [ecx + 0x44], 1
mov dword [ecx + 0x80], esi
mov dword [ecx + 0xc0], 0
mov dword [ecx + 0xc4], 0
lock inc dword [ecx + 0x40]
mov esi, dword [esp + 0x14]
jle 0x429606
mov eax, dword [esp + 0x1c]
add ecx, 0x40
mov edx, dword [esp + 0x10]
inc dword [esp + 0x2c]
mov dword [edi - 0xc], ecx
mov dword [edi - 8], eax
mov eax, dword [esp + 0x24]
mov dword [edi - 4], 0x40
mov byte [edi], bl
add edi, 0x10
mov dword [eax + edx*8], ecx
mov byte [eax + edx*8 + 4], bl
inc edx
dec esi
jne 0x429210
mov eax, dword [esp + 0xc0]
mov ecx, dword [esp + 0xcc]
mov ebx, dword [esp + 0x30]
lea esi, [esp + 0xcc]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc0], 0
mov dword [esp + 0xc4], 4
mov dword [esp + 0xc8], 0
mov dword [esp + 0xcc], 0
mov dword [esp + 0xd0], 4
mov dword [esp + 0xd4], 0
mov dword [esp + 0x1c0], ecx
mov dword [esp + 0x40], eax
lea ecx, [esp + 0xc0]
mov edx, ebx
push 0x10
call fcn.004e8c50
add esp, 4
mov ecx, esi
mov edx, ebx
push 8
call fcn.004e8c50
add esp, 4
mov eax, dword [esp + 0xd0]
mov ecx, dword [esp + 0xd4]
mov esi, dword [esp + 0xc8]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x14], ecx
mov ecx, esi
shl ecx, 4
lea edi, [ecx + eax + 0xc]
nop word [eax + eax]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x190], esi
xor ecx, ecx
mov edx, 0x200
movzx eax, byte [0xfd520d]
call fcn.00494530
test eax, eax
je 0x429606
mov esi, eax
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, 8
call fcn.00494530
test eax, eax
je 0x429606
mov dword [eax], esi
mov dword [eax + 4], 0x40
mov ebx, eax
xor ecx, ecx
mov edx, pe_nt_image_headers32
movzx eax, byte [0xfd520d]
call fcn.00494530
test eax, eax
je 0x429606
mov ecx, eax
and eax, 0xffffffc0
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], 1
mov dword [eax + 0x44], 1
mov dword [eax + 0x80], ebx
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
lock inc dword [eax + 0x40]
mov ebx, dword [esp + 0x28]
jle 0x429606
add eax, 0x40
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov dword [edi - 0xc], eax
mov dword [edi - 8], esi
mov esi, dword [esp + 0x190]
mov dword [edi - 4], 0x40
mov byte [edi], 0
add edi, 0x10
mov dword [ecx + edx*8], eax
mov byte [ecx + edx*8 + 4], 0
inc edx
inc esi
dec ebx
mov dword [esp + 0x14], edx
jne 0x429420
mov dword [esp + 0xc8], esi
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x28], eax
jmp 0x4282d5
mov ecx, dword [esp + 0x3c]
test eax, 0x7fffffff
mov byte [ecx], 5
jne 0x429567
mov eax, dword [esp + 0xa8]
lock dec dword [eax]
je 0x429585
mov eax, dword [esp + 0xa0]
lock dec dword [eax]
je 0x42959d
mov eax, dword [esp + 0xb8]
lock dec dword [eax]
jne 0x42955e
lea ecx, [esp + 0xb8]
call fcn.00427230
mov esi, dword [esp + 0x34]
jmp 0x429080
push dword [esp + 0x1c]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0xa8]
lock dec dword [eax]
jne 0x42953a
lea ecx, [esp + 0xa8]
call fcn.004271e0
mov eax, dword [esp + 0xa0]
lock dec dword [eax]
jne 0x429546
lea ecx, [esp + 0xa0]
call fcn.004271e0
mov eax, dword [esp + 0xb8]
lock dec dword [eax]
je 0x429552
jmp 0x42955e
mov eax, dword [esp + 0x10]
test edi, 0x7fffffff
je 0x427ecb
push eax
jmp 0x427ebd
test edi, 0x7fffffff
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
lea ebx, [esp + 0xc0]
je 0x428024
push eax
jmp 0x428016
add ecx, 8
xor edx, edx
call fcn.00484550
ud2
lock dec dword [esi]
mov ecx, esi
jne 0x429606
call fcn.00427450
ud2