Function at 0x425670
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x528]
sub esp, 0x528
push 0xffffffffffffffff
push 0x466465
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x484540]
xor eax, ebp
mov dword [ebp + 0x524], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x58], ebx
call fcn.0042f5de
mov ecx, eax
test ecx, ecx
je 0x4263bc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
call fcn.0042f5de
mov ecx, eax
test ecx, ecx
je 0x4263c6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
call fcn.0042f5de
mov ecx, eax
test ecx, ecx
je 0x4263d0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 2
call fcn.0042f5de
mov ecx, eax
test ecx, ecx
je 0x4263da
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x1c], edi
mov byte [ebp - 4], 3
call fcn.0042f5de
mov ecx, eax
test ecx, ecx
je 0x4263e4
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 4
call fcn.0042f5de
mov ecx, eax
test ecx, ecx
je 0x4263ee
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 5
call fcn.0042f5de
mov ecx, eax
test ecx, ecx
je 0x4263f8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 6
call fcn.0042f5de
mov ecx, eax
test ecx, ecx
je 0x426402
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
push 0x118
lea eax, [ebp + 4]
mov byte [ebp - 4], 7
push 0
push eax
call fcn.0044bb10
add esp, 0xc
mov dword [ebp], 0x11c
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp + 0x10]
sub eax, 1
je 0x4261b2
sub eax, 1
jne 0x4262ab
mov ecx, dword [ebp + 4]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp ecx, 3
jne 0x425801
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push str.Windows_NT3._d
push eax
call fcn.00408490
add esp, 0xc
jmp 0x425a0b
mov eax, dword [ebp + 8]
cmp ecx, 4
jne 0x425825
test eax, eax
jne 0x4259f8
push 0xb
push str.Windows_NT4
lea ecx, [ebp - 0x14]
call fcn.00402c10
jmp 0x425a0b
cmp ecx, 5
jne 0x4258f4
test eax, eax
jne 0x425846
push 0xc
push str.Windows_2000
lea ecx, [ebp - 0x14]
call fcn.00402c10
jmp 0x425a0b
cmp eax, 1
jne 0x42585f
push 0xa
push str.Windows_XP
lea ecx, [ebp - 0x14]
call fcn.00402c10
jmp 0x425a0b
cmp eax, 2
jne 0x4259f8
push 0x59
call esi
test eax, eax
je 0x425889
mov ecx, 0x16
mov eax, str.Windows_Server_2003_R2
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402c10
jmp 0x425a0b
mov eax, 0x2000
cmp word [ebp + 0x118], ax
jne 0x4258b0
mov ecx, 0x1b
mov eax, str.Windows_Storage_Server_2003
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402c10
jmp 0x425a0b
cmp byte [ebp + 0x11a], 1
jne 0x4258db
call fcn.004254a0
test eax, eax
je 0x4258db
mov ecx, 0xa
mov eax, str.Windows_XP
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402c10
jmp 0x425a0b
mov ecx, 0x13
mov eax, str.Windows_Server_2003
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402c10
jmp 0x425a0b
cmp ecx, 6
jne 0x425a74
test eax, eax
jne 0x42593c
cmp byte [ebp + 0x11a], 1
je 0x425923
mov ecx, 0x13
mov eax, str.Windows_Server_2008
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402c10
jmp 0x425a0b
mov ecx, 0xd
mov eax, str.Windows_Vista
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402c10
jmp 0x425a0b
cmp eax, 1
jne 0x42597b
cmp byte [ebp + 0x11a], al
je 0x425962
mov ecx, 0x16
mov eax, str.Windows_Server_2008_R2
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402c10
jmp 0x425a0b
mov ecx, 9
mov eax, str.Windows_7
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402c10
jmp 0x425a0b
cmp eax, 2
jne 0x4259b5
cmp byte [ebp + 0x11a], 1
je 0x42599f
mov ecx, 0x13
mov eax, str.Windows_Server_2012
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402c10
jmp 0x425a0b
mov ecx, 9
mov eax, str.Windows_8
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402c10
jmp 0x425a0b
cmp eax, 3
jne 0x4259ef
cmp byte [ebp + 0x11a], 1
je 0x4259d9
mov ecx, 0x16
mov eax, str.Windows_Server_2012_R2
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402c10
jmp 0x425a0b
mov ecx, 0xb
mov eax, str.Windows_8.1
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402c10
jmp 0x425a0b
cmp eax, 4
je 0x425a7d
push eax
push ecx
lea eax, [ebp - 0x14]
push str.Windows_NT__d._d
push eax
call fcn.00408490
add esp, 0x10
mov eax, dword [ebp + 4]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, 6
jb 0x425d46
push str.GetProductInfo
push str.kernel32.dll
call ebx
push eax
call edi
test eax, eax
je case.0x425c07.29
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push ecx
push 0
push 0
push dword [ebp + 8]
push dword [ebp + 4]
call eax
mov eax, dword [ebp - 0x30]
cmp eax, 0x14
ja 0x425be5
je 0x425bd9
dec eax
cmp eax, 0x12
ja case.0x425c07.29
jmp dword [eax*4 + 0x42640c]
cmp ecx, 0xa
jb 0x4259f8
cmp byte [ebp + 0x11a], 1
je 0x425ace
mov eax, dword [ebp + 0xc]
cmp eax, 0x4f78
jb 0x425aa9
mov ecx, 0x13
mov eax, str.Windows_Server_2022
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402c10
jmp 0x425a0b
cmp eax, 0x4563
mov eax, str.Windows_Server_2019
jae 0x425aba
mov eax, str.Windows_Server_2016
mov ecx, 0x13
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402c10
jmp 0x425a0b
cmp dword [ebp + 0xc], 0x55ec
mov ecx, 0xa
mov eax, str.Windows_11
jae 0x425ae6
mov eax, str.Windows_10
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402c10
jmp 0x425a0b
push 8
push str.Business
jmp 0x425f3e
push 0xa
push str.Business_N
jmp 0x425f3e
push 0xe
push str.Cluster_Server
jmp 0x425f3e
push 0x1e
push str.Datacenter__Full_installation_
jmp 0x425f3e
push 0x25
push str.Datacenter__Server_Core_installation_
jmp 0x425f3e
push 0xa
push str.Enterprise
jmp 0x425f3e
push 0x1e
push str.Enterprise__Full_installation_
jmp 0x425f3e
push 0x25
push str.Enterprise__Server_Core_installation_
jmp 0x425f3e
push 0x2f
push str.Datacenter_Enterprise_for_Itanium_based_Systems
jmp 0x425f3e
push 0xa
push str.Home_Basic
jmp 0x425f3e
push 0xc
push str.Home_Basic_N
jmp 0x425f3e
push 0xc
push str.Home_Premium
jmp 0x425f3e
push 0xb
push str.Home_Server
jmp 0x425f3e
push 0x15
push str.Small_Business_Server
jmp 0x425f3e
push 0x23
push str.Server_Standard__full_installation_
jmp 0x425f3e
push 0x23
push str.Server_Standard__core_installation_
jmp 0x425f3e
push 7
push str.Starter
jmp 0x425f3e
push 8
push str.Ultimate
jmp 0x425f3e
push 0xa
push str.Web_Server
jmp 0x425f3e
push 0x16
push str.Storage_Server_Express
jmp 0x425f3e
cmp eax, 0x31
ja 0x425cbe
je 0x425c96
add eax, 0xffffffeb
cmp eax, 0x1b
ja case.0x425c07.29
movzx eax, byte [eax + 0x426480]
jmp dword [eax*4 + 0x426458]
push 0xc
push str.Enterprise_N
jmp 0x425f3e
push 0xe
push str.Home_Premium_N
jmp 0x425f3e
push 0x19
push str.Server_for_Small_Business
jmp 0x425f3e
push 0x1d
push str.Small_Business_Server_Premium
jmp 0x425f3e
push 0x19
push str.Storage_Server_Enterprise
jmp 0x425f3e
push 0x17
push str.Storage_Server_Standard
jmp 0x425f3e
push 0x18
push str.Storage_Server_Workgroup
jmp 0x425f3e
push 0xa
push str.Ultimate_N
jmp 0x425f3e
cmp dword [ebp + 8], 2
jb 0x425c85
mov ecx, 3
mov eax, 0x477c44
push ecx
push eax
jmp 0x425f3e
mov ecx, 0xc
mov eax, str.Professional
push ecx
push eax
jmp 0x425f3e
cmp dword [ebp + 8], 2
jb 0x425cad
mov ecx, 5
mov eax, str.Pro_N
push ecx
push eax
jmp 0x425f3e
mov ecx, 0xe
mov eax, str.Professional_N
push ecx
push eax
jmp 0x425f3e
cmp eax, 0xa1
ja 0x425cf2
je 0x425ce6
sub eax, 0x3c
je 0x425cda
sub eax, 1
je 0x425cda
sub eax, 1
jne case.0x425c07.29
push 0x11
push str.Essentials_Server
jmp 0x425f3e
push 0x13
push str.Pro_for_Workstation
jmp 0x425f3e
cmp eax, 0xa5
ja 0x425d2f
je 0x425d23
sub eax, 0xa2
je 0x425d17
sub eax, 2
jne case.0x425c07.29
push 0x11
push str.Pro_for_Education
jmp 0x425f3e
push 0x15
push str.Pro_for_Workstation_N
jmp 0x425f3e
push 0x13
push str.Pro_for_Education_N
jmp 0x425f3e
cmp eax, 0xabcdabcd
jne case.0x425c07.29
push 0xa
push str.Unlicensed
jmp 0x425f3e
cmp eax, 5
jne case.0x425c07.29
mov eax, dword [ebp + 8]
test eax, eax
jne 0x425da9
mov al, byte [ebp + 0x11a]
cmp al, 1
jne 0x425d6c
push 0xc
push str.Professional
jmp 0x425f3e
cmp al, 3
jne case.0x425c07.29
mov eax, dword [ebp + 0x118]
test al, al
jns 0x425d8a
push 0x11
push str.DataCenter_Server
jmp 0x425f3e
lea ecx, [ebp - 0x10]
test al, 2
je 0x425d9d
push 0xf
push str.Advanced_Server
jmp 0x425f41
push 6
push str.Server
jmp 0x425f41
cmp eax, 1
jb case.0x425c07.29
mov eax, dword [ebp + 0x118]
test eax, 0x200
je 0x425dc8
push 0xc
push str.Home_Edition
jmp 0x425e02
test al, al
jns 0x425dd5
push 0x12
push str.Datacenter_Edition
jmp 0x425e02
test al, 2
je 0x425de2
push 0x12
push str.Enterprise_Edition
jmp 0x425e02
test eax, 0x400
je 0x425df2
push 0xb
push str.Web_Edition
jmp 0x425e02
cmp byte [ebp + 0x11a], 1
jne 0x425e0a
push 0xc
push str.Professional
lea ecx, [ebp - 0x10]
call fcn.00402c10
push 0x57
call esi
test eax, eax
je 0x425f2f
push 0x104
lea eax, [ebp + 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.ehomeehshell.exe
mov esi, eax
lea eax, [ebp + 0x11c]
push 0x104
push eax
call fcn.00450af4
add esp, 0xc
test esi, esi
je case.0x425c07.29
lea edx, [ebp + 0x324]
lea ecx, [ebp + 0x11c]
call fcn.00428210
test eax, eax
je case.0x425c07.29
lea ecx, [ebp + 0x324]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425e70
sub ecx, edx
lea eax, [ebp + 0x324]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.00402c10
mov esi, dword [ebp - 0x20]
cmp dword [esi - 0xc], 0
jl case.0x425c07.29
push 0x477e58
push esi
call fcn.0044b0b5
add esp, 8
test eax, eax
je case.0x425c07.29
sub eax, esi
sar eax, 1
jne case.0x425c07.29
push 0xd
push str.Media_Center
lea ecx, [ebp - 0x10]
call fcn.00402c10
push 0x472bd0
push str.5.1.
lea ecx, [ebp - 0x20]
call fcn.00417290
push dword [ebp - 0x20]
call fcn.004546af
fld qword [0x47a9c0]
lea ecx, [ebp - 0x10]
fcomp st(1)
add esp, 4
fnstsw ax
push 4
test ah, 1
jne 0x425f0a
push str.2002
fstp st(0)
call fcn.00408320
jmp case.0x425c07.29
fcomp qword [0x47a9c8]
fnstsw ax
test ah, 0x41
jp 0x425f23
push str.2004
call fcn.00408320
jmp case.0x425c07.29
push str.2005
call fcn.00408320
jmp case.0x425c07.29
push 0x56
call esi
test eax, eax
je case.0x425c07.29
push 9
push str.Tablet_PC
lea ecx, [ebp - 0x10]
call fcn.00402c10
lea ecx, [ebp + 0x14]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425f50
sub ecx, edx
lea eax, [ebp + 0x14]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402c10
push 0x477ec0
push str.Service_Pack
lea ecx, [ebp - 0x2c]
call fcn.00417290
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push dword [ebp + 4]
push str._d._d
push eax
call fcn.00408490
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push 0x4755d4
push eax
call fcn.00408490
add esp, 0x1c
call fcn.004254a0
test eax, eax
je 0x425fb9
mov eax, 0x477ee4
jmp 0x42613e
mov eax, dword [0x484f94]
cmp eax, 0xffffffff
jne 0x426028
xor eax, eax
mov dword [0x484f94], 0
push str.GetNativeSystemInfo
push str.kernel32
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
call ebx
push eax
call edi
test eax, eax
je 0x426023
lea ecx, [ebp - 0x54]
push ecx
call eax
cmp word [ebp - 0x54], 5
jne 0x426023
mov dword [0x484f94], 1
mov eax, str.ARM32
mov ecx, 5
jmp 0x426143
mov eax, dword [0x484f94]
test eax, eax
je 0x42603b
mov eax, str.ARM32
mov ecx, 5
jmp 0x426143
mov eax, dword [0x484f90]
cmp eax, 0xffffffff
jne 0x4260aa
xor eax, eax
mov dword [0x484f90], 0
push str.GetNativeSystemInfo
push str.kernel32
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
call ebx
push eax
call edi
test eax, eax
je 0x4260a5
lea ecx, [ebp - 0x54]
push ecx
call eax
cmp word [ebp - 0x54], 0xc
jne 0x4260a5
mov dword [0x484f90], 1
mov eax, str.ARM64
mov ecx, 5
jmp 0x426143
mov eax, dword [0x484f90]
test eax, eax
je 0x4260bd
mov eax, str.ARM64
mov ecx, 5
jmp 0x426143
mov eax, dword [0x484f98]
cmp eax, 0xffffffff
jne 0x426129
xor eax, eax
mov dword [0x484f98], 0
push str.GetNativeSystemInfo
push str.kernel32
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
call ebx
push eax
call edi
test eax, eax
je 0x426124
lea ecx, [ebp - 0x54]
push ecx
call eax
cmp word [ebp - 0x54], 6
jne 0x426124
mov dword [0x484f98], 1
mov eax, str.IA64
mov ecx, 4
jmp 0x426143
mov eax, dword [0x484f98]
test eax, eax
je 0x426139
mov eax, str.IA64
mov ecx, 4
jmp 0x426143
mov eax, 0x477f10
mov ecx, 3
push ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.00402c10
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x24]
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
cmp dword [eax - 0xc], 0
push esi
push edi
je 0x42618a
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x28]
push dword [ebp - 0x14]
push str._s__s__s___s_Build__s____s_
push eax
call fcn.00408490
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x28]
add esp, 0x20
push eax
call fcn.004027d0
jmp 0x4262ab
push dword [ebp - 0x10]
lea eax, [ebp - 0x28]
push dword [ebp - 0x14]
push str._s__s___s_Build__s____s_
push eax
call fcn.00408490
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x28]
add esp, 0x1c
push eax
call fcn.004027d0
jmp 0x4262ab
mov eax, dword [ebp + 8]
test eax, eax
je 0x426212
cmp eax, 0xa
je 0x4261dc
mov ecx, 0xa
cmp eax, 0x5a
je 0x4261d2
mov eax, str.Windows_9x
jmp 0x426261
mov eax, str.Windows_Me
jmp 0x426261
mov eax, dword [ebp + 0xc]
mov ecx, 0x8ae
cmp ax, cx
jb 0x4261f5
mov eax, str.Windows_98_SE
mov ecx, 0xd
jmp 0x426261
mov ecx, 0x7d0
cmp ax, cx
jb 0x42620b
mov eax, str.Windows_98_SP1
mov ecx, 0xe
jmp 0x426261
mov eax, str.Windows_98
jmp 0x42625c
mov eax, dword [ebp + 0xc]
mov ecx, 0x4be
cmp ax, cx
jb 0x42622b
mov eax, str.Windows_95_OSR2.5
mov ecx, 0x11
jmp 0x426261
mov ecx, 0x4bc
cmp ax, cx
jb 0x426241
mov eax, str.Windows_95_OSR2.1
mov ecx, 0x11
jmp 0x426261
mov ecx, 0x457
cmp ax, cx
jne 0x426257
mov eax, str.Windows_95_OSR2
mov ecx, 0xf
jmp 0x426261
mov eax, str.Windows_95
mov ecx, 0xa
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402c10
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push dword [ebp + 4]
push str._d._d
push eax
call fcn.00408490
movzx eax, word [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push 0x4755d4
push eax
call fcn.00408490
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
push esi
push edi
push dword [ebp - 0x14]
push str._s___s_Build__s_
push ebx
call fcn.00408490
add esp, 0x30
mov byte [ebp - 4], 6
or ebx, 0xffffffff
mov edx, dword [ebp - 0x20]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4262cc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
mov eax, ebx
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4262ea
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov eax, ebx
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x426308
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x426323
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x42633e
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, ebx
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42635c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42637a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x426399
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x524]
xor ecx, ebp
call fcn.0044998e
lea esp, [ebp + 0x528]
pop ebp
ret
push 0x80004005
call fcn.00403110
push 0x80004005
call fcn.00403110
push 0x80004005
call fcn.00403110
push 0x80004005
call fcn.00403110
push 0x80004005
call fcn.00403110
push 0x80004005
call fcn.00403110
push 0x80004005
call fcn.00403110
push 0x80004005
call fcn.00403110
rcr dword [ebx + 0x42], 0
popal
pop ebx
inc edx
add byte [ecx + 0x5b], bh
inc edx
add byte [ecx], dh
pop ebx
inc edx
add byte [ebp + 0x5b], ch
inc edx
add ch, dh
pop edx
inc edx
add byte [ebp + 0x1900425b], bl
pop ebx
inc edx
add byte [ecx + 0x3d00425b], dl
pop ebx
inc edx
add byte [ebp + 0x2500425b], dh
pop ebx
inc edx
add byte [ecx + 0x4900425b], ch
pop ebx
inc edx
add byte [ebp + 0x5b], dl
inc edx
add byte [ecx], al
pop ebx
inc edx
add ch, cl
pop ebx
inc edx
add byte [0x8500425b], cl
pop ebx
inc edx
add byte [edx + 0x5c], cl
inc edx
add byte [esi + 0x5c], dl
inc edx
add byte [esi], bh
pop esp
inc edx
add byte [esi], ah
pop esp
inc edx
add byte [edx], dh
pop esp
inc edx
add byte [edx], bl
pop esp
inc edx
add byte [esi], cl
pop esp
inc edx
add byte [edx + 0x5c], ah
inc edx
add byte [esi + 0x5c], ch
inc edx
add byte [esi + 0x5f], al
inc edx
add byte [eax], al
add dword [edx], eax
add eax, dword [eax + 151586566]
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [eax], ecx
int3