Function at 0x42dd00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d06f3
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x5153e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x134], ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0x144], 0
mov ecx, dword [ebx + 4]
push eax
call fcn.00429c90
push 0xf
xor eax, eax
mov dword [ebp - 4], 0
push str.kprometheus.dll
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00408480
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x58]
mov ecx, ebx
push eax
call fcn.00429cb0
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x42ddd3
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42ddc9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42e71a
push edx
push ecx
call fcn.0049211e
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp dword [ebp - 0x48], eax
jne 0x42ddf4
or ebx, 0xffffffff
jmp 0x42e673
call fcn.0042be20
call fcn.0047aa30
test al, al
je 0x42de07
call fcn.00479d90
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00429c30
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
call fcn.00413510
add esp, 8
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 6
call fcn.00402ba0
mov bl, 1
push 0
mov dword [ebp - 0x130], ebx
call fcn.00479e40
add esp, 4
lea ecx, [ebp - 0x40]
push 0x4e0f24
call fcn.0042bed0
mov ecx, 1
test eax, eax
je 0x42dec2
push 0x4dee80
lea ecx, [ebp - 0x40]
call fcn.0042bed0
test eax, eax
je 0x42debd
push 0x4e0f2c
lea ecx, [ebp - 0x40]
call fcn.0042bed0
test eax, eax
je 0x42debd
push 0x4e0f34
lea ecx, [ebp - 0x40]
call fcn.0042bed0
test eax, eax
je 0x42debd
push 0
call fcn.0047a2b0
xor ecx, ecx
movzx ebx, bl
add esp, 4
test al, al
cmovne ebx, ecx
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x130], ebx
push str.prometheus
call fcn.0041f6f0
jmp 0x42dfa3
mov ecx, 1
cmp byte [0x51d3b4], 0
je 0x42def4
lea eax, [ebp - 0x13c]
mov word [ebp - 0x140], cx
push eax
lea eax, [ebp - 0x13e]
push eax
push 0x4e1408
push str.ComponentPreReadImage
push 1
call fcn.0044a570
add esp, 0x14
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
lea esi, [ebp - 0x88]
mov byte [ebp - 4], 7
cmovae eax, dword [ebp - 0x40]
cmp dword [ebp - 0x74], 8
push eax
cmovae esi, dword [ebp - 0x88]
push 0
call fcn.0047a2b0
add esp, 4
xor ecx, ecx
test al, al
setne cl
lea ecx, [ecx*2 + 1]
push ecx
push str.SoftwareKingsoftOffice6.0CommonResourceManager
push esi
lea ecx, [ebp - 0xf0]
call fcn.00442e90
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 8
call fcn.00443fd0
push 0
call fcn.00479e40
add esp, 4
test al, al
jne 0x42df6a
push 0
call fcn.0047a2b0
add esp, 4
test al, al
je 0x42df71
mov byte [ebp - 0x130], 0
lea ecx, [ebp - 0xf0]
call fcn.004431b0
cmp byte [0x51d3b4], 0
mov byte [ebp - 4], 9
je 0x42dfa3
push dword [ebp - 0x13c]
push dword [ebp - 0x13e]
push dword [ebp - 0x140]
call fcn.0044a5d0
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x154], esi
mov dword [ebp - 0x150], esi
push 0x268
mov byte [ebp - 4], 0xb
call fcn.004920ee
add esp, 4
mov dword [ebp - 0x13c], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x42dfe1
mov ecx, eax
call fcn.0042a5b0
mov edi, eax
jmp 0x42dfe3
xor edi, edi
mov dword [ebp - 0x13c], edi
push 0x10
mov byte [ebp - 4], 0xd
call fcn.004920ee
mov ebx, eax
add esp, 4
mov dword [ebp - 0x13c], ebx
test ebx, ebx
je 0x42e01c
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov dword [ebx], vtable.std::_Ref_count_struct_KPromeHostStartupInfo_.0
mov dword [ebx + 0xc], edi
jmp 0x42e01e
xor ebx, ebx
mov ecx, dword [ebp - 0x134]
lea eax, [ebp - 0xb8]
mov byte [edi], 0
mov dword [edi + 8], 0
push eax
mov ecx, dword [ecx + 4]
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x154], edi
mov dword [ebp - 0x150], ebx
call fcn.00429c30
push eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0xe
push eax
call fcn.00413510
add esp, 8
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x10
call fcn.00402ba0
push 0
call fcn.0047a040
add esp, 4
test al, al
je 0x42e14f
push 0x4e0f24
lea ecx, [ebp - 0x70]
mov byte [edi], 1
call fcn.0042bed0
test eax, eax
jne 0x42e0ae
push 0x1b
lea ecx, [edi + 0x2c]
push str.wpsoffice_wps_starup_object
call fcn.00408480
mov dword [edi + 8], 1
jmp 0x42e15e
push 0x4e0f2c
lea ecx, [ebp - 0x70]
call fcn.0042bed0
test eax, eax
jne 0x42e0da
push 0x1b
lea ecx, [edi + 0x2c]
push str.wpsoffice_wpp_starup_object
call fcn.00408480
mov dword [edi + 8], 3
jmp 0x42e15e
push 0x4dee80
lea ecx, [ebp - 0x70]
call fcn.0042bed0
test eax, eax
jne 0x42e101
push str.wpsoffice_et_starup_object
lea ecx, [edi + 0x2c]
call fcn.0041f6f0
mov dword [edi + 8], 2
jmp 0x42e15e
push 0x4e0f34
lea ecx, [ebp - 0x70]
call fcn.0042bed0
test eax, eax
jne 0x42e128
push str.wpsoffice_pdf_starup_object
lea ecx, [edi + 0x2c]
call fcn.0041f6f0
mov dword [edi + 8], 4
jmp 0x42e15e
push 0x4e1628
lea ecx, [ebp - 0x70]
call fcn.0042bed0
test eax, eax
jne 0x42e15e
push str.wpsoffice_ofd_starup_object
lea ecx, [edi + 0x2c]
call fcn.0041f6f0
mov dword [edi + 8], 5
jmp 0x42e15e
push 0x17
lea ecx, [edi + 0x2c]
push str.wpsoffice_starup_object
call fcn.00408480
mov eax, dword [0x519f04]
test al, 1
jne 0x42e1c2
or eax, 1
mov dword [0x519f04], eax
push str.GetCurrentPackageFamilyName
push 0x4db838
mov byte [ebp - 4], 0x11
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42e1b5
push 0
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x13c], 0
push ecx
call eax
cmp eax, 0x7a
jne 0x42e1b5
mov al, 1
mov byte [ebp - 4], 0x10
mov byte [0x519f00], al
jmp 0x42e1c7
xor al, al
mov byte [ebp - 4], 0x10
mov byte [0x519f00], al
jmp 0x42e1c7
mov al, byte [0x519f00]
test al, al
je 0x42e1da
push 4
lea ecx, [edi + 0x2c]
push str._uwp
call fcn.00402e10
lea eax, [ebp - 0x160]
push eax
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax + 4]
call fcn.00404060
mov ecx, eax
call fcn.00403500
mov ecx, eax
call fcn.00405f10
push edi
push eax
mov byte [ebp - 4], 0x12
call fcn.00423250
add esp, 8
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x160]
call fcn.00402c00
mov eax, dword [ebp - 0x130]
test al, al
je 0x42e3a2
cmp dword [ebp - 0x60], 0
jne 0x42e252
push 0
call fcn.00479e40
add esp, 4
test al, al
je 0x42e252
mov eax, dword [edi + 8]
dec eax
cmp eax, 3
ja 0x42e252
xor al, al
mov dword [ebp - 0x130], eax
jmp 0x42e3a2
push edi
call fcn.00425a00
push ecx
mov dword [ebp - 0x13c], esp
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
test ebx, ebx
je 0x42e276
lock inc dword [ebx + 4]
mov dword [eax], edi
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x134]
mov byte [ebp - 4], 0x13
mov ecx, dword [eax + 4]
call fcn.004042d0
mov ecx, eax
mov byte [ebp - 4], 0x10
call fcn.00428070
call fcn.0047a030
test al, al
je 0x42e2aa
call fcn.0047a0b0
test al, al
je 0x42e301
push 0xe
xor eax, eax
mov dword [ebp - 0x90], 0
push str.WPSPlusVersion
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x8c], 7
mov word [ebp - 0xa0], ax
call fcn.00408480
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x14
push eax
mov dword [ebp - 0x144], 1
call fcn.0047a330
add esp, 4
mov byte [ebp - 0x129], 0
test al, al
je 0x42e308
mov byte [ebp - 0x129], 1
test byte [ebp - 0x144], 1
mov dword [ebp - 4], 0x10
je 0x42e358
mov edx, dword [ebp - 0x8c]
cmp edx, 8
jb 0x42e358
mov ecx, dword [ebp - 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42e34e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42e71f
push edx
push ecx
call fcn.0049211e
add esp, 8
cmp byte [ebp - 0x129], 0
je 0x42e39c
push 0x58
call fcn.004920ee
add esp, 4
mov dword [ebp - 0x13c], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x42e389
push edi
lea ecx, [ebp - 0x70]
push ecx
mov ecx, eax
call fcn.0043a8b0
mov esi, eax
jmp 0x42e38b
xor esi, esi
mov ecx, esi
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x148], esi
call fcn.0043ba40
mov eax, dword [ebp - 0x130]
xor ecx, ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], cx
mov byte [ebp - 4], 0x16
test al, al
jne 0x42e419
mov eax, dword [edi + 8]
dec eax
cmp eax, 3
ja case.default.0x42e3c7
jmp dword [eax*4 + 0x42e730]
push 0x4e0f2c
lea ecx, [ebp - 0x28]
call fcn.0041f6f0
jmp 0x42e419
push 0x4e0f24
lea ecx, [ebp - 0x28]
call fcn.0041f6f0
jmp 0x42e419
push 0x4dee80
lea ecx, [ebp - 0x28]
call fcn.0041f6f0
jmp 0x42e419
push 0x4e0f34
lea ecx, [ebp - 0x28]
call fcn.0041f6f0
jmp 0x42e419
push 3
push 0x4e0f24
lea ecx, [ebp - 0x28]
call fcn.00408480
cmp byte [edi + 1], 0
mov edi, dword [ebp - 0x134]
je 0x42e438
mov ecx, dword [edi + 4]
lea eax, [ebp - 0x28]
push eax
call fcn.004042d0
mov ecx, eax
call fcn.00427d10
cmp byte [ebp - 0x130], 0
mov eax, dword [ebp - 0x14]
jne 0x42e488
cmp eax, 8
jb 0x42e47b
mov ecx, dword [ebp - 0x28]
lea edx, [eax*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42e471
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42e724
push edx
push ecx
call fcn.0049211e
add esp, 8
xor eax, eax
mov dword [ebp - 0x134], eax
jmp 0x42e62b
mov byte [ebp - 4], 0x10
cmp eax, 8
jb 0x42e4c3
mov ecx, dword [ebp - 0x28]
lea edx, [eax*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42e4b9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42e724
push edx
push ecx
call fcn.0049211e
add esp, 8
mov ecx, edi
call fcn.0042f130
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x88]
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x74], 8
push ecx
cmovae eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x128]
push 0
push str.SoftwareKingsoftOffice6.0CommonResourceManager
push eax
call fcn.00442e90
cmp byte [0x51d3b4], 0
mov byte [ebp - 4], 0x17
je 0x42e535
mov eax, 1
mov word [ebp - 0x138], ax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x136]
push eax
push 0x4e1408
push str.PrometheusPreReadImage
push 1
call fcn.0044a570
add esp, 0x14
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 0x18
call fcn.00443fd0
cmp byte [0x51d3b4], 0
mov byte [ebp - 4], 0x19
je 0x42e56b
push dword [ebp - 0x134]
push dword [ebp - 0x136]
push dword [ebp - 0x138]
call fcn.0044a5d0
add esp, 0xc
mov byte [ebp - 4], 0x17
call fcn.0042bf50
test al, al
je 0x42e5a3
cmp byte [edi + 0x14], 0
jne 0x42e5a3
cmp dword [edi + 0xc], 0xffffffff
jne 0x42e5a3
lea eax, [edi + 0x10]
push eax
push 0
push edi
push 0x42ce70
push 0
push 0
call fcn.004a42ef
add esp, 0x18
mov dword [edi + 0xc], eax
mov byte [edi + 0x14], 1
lea ecx, [ebp - 0x12a]
call fcn.00439d20
lea ecx, [ebp - 0x12a]
call fcn.004092e0
or eax, 0xffffffff
cmp dword [ebp - 0x44], 8
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [ebp - 0x148]
mov dword [edi + 8], eax
test eax, eax
je 0x42e60f
push str.xmain
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42e606
push esi
push dword [ebp - 0x14c]
push dword [ebp + 8]
call eax
add esp, 0xc
mov dword [ebp - 0x134], eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.0042bf50
test al, al
je 0x42e620
lea ecx, [edi + 0xc]
call fcn.0042d320
lea ecx, [ebp - 0x128]
call fcn.004431b0
lea ecx, [ebp - 0x70]
call fcn.00402ba0
test ebx, ebx
je 0x42e658
or edi, 0xffffffff
mov eax, edi
lock xadd dword [ebx + 4], eax
jne 0x42e658
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
lock xadd dword [ebx + 8], edi
dec edi
jne 0x42e658
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
test esi, esi
je 0x42e665
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0x14]
lea ecx, [ebp - 0x40]
call fcn.00402ba0
mov ebx, dword [ebp - 0x134]
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x42e6ad
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42e6a3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42e729
push edx
push ecx
call fcn.0049211e
add esp, 8
mov edx, dword [ebp - 0x74]
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
cmp edx, 8
jb 0x42e6fa
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42e6f0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42e729
push edx
push ecx
call fcn.0049211e
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049212c
mov esp, ebp
pop ebp
ret 8
call fcn.0049da69
call fcn.0049da69
call fcn.0049da69
call fcn.0049da69
mov edi, edi
fucom st(3)
inc edx
add ah, ch
jecxz 0x42e779
add dh, cl
jecxz 0x42e77d
add bl, bh
jecxz 0x42e781
add byte [ebp - 0x75], dl
in al, dx
push 0xffffffffffffffff
push 0x4d07ae
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x5153e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x94], ebx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x70]
push eax
call fcn.00429c90
push 0xf
xor eax, eax
mov dword [ebp - 4], 0
test dword [edi + edi*8 - 1], esp
dec dword [ebp - 0x17af6fbb]
add eax, 0x6affffb5
rdpmc
rol bh, 0x45
cld
add byte [eax], al
add byte [eax], al
push str.kprometheus.dll
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00408480
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
mov ecx, ebx
push eax
call fcn.00429cb0
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x42e806
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42e7fc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ec1d
push edx
push ecx
call fcn.0049211e
add esp, 8
cmp dword [ebp - 0x30], 0
jne 0x42e814
or ebx, 0xffffffff
jmp 0x42eb7d
call fcn.0042be20
xor esi, esi
mov dword [ebp - 0x98], esi
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], esi
push 0x268
mov byte [ebp - 4], 5
call fcn.004920ee
add esp, 4
mov dword [ebp - 0x8c], eax
mov byte [ebp - 4], 6
test eax, eax
je 0x42e857
mov ecx, eax
call fcn.0042a5b0
mov ebx, eax
jmp 0x42e859
xor ebx, ebx
mov dword [ebp - 0x8c], ebx
push 0x10
mov byte [ebp - 4], 7
call fcn.004920ee
mov edi, eax
add esp, 4
mov dword [ebp - 0x8c], edi
test edi, edi
je 0x42e892
mov dword [edi + 4], 1
mov dword [edi + 8], 1
mov dword [edi], vtable.std::_Ref_count_struct_KPromeHostStartupInfo_.0
mov dword [edi + 0xc], ebx
jmp 0x42e894
xor edi, edi
mov ecx, dword [ebp - 0x94]
lea eax, [ebp - 0x88]
mov byte [ebx], 0
mov dword [ebx + 8], 0
push eax
mov ecx, dword [ecx + 4]
mov byte [ebp - 4], 5
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], edi
call fcn.00429c10
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 8
push eax
call fcn.00413510
add esp, 8
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0xa
call fcn.00402ba0
push 0
call fcn.0047a040
add esp, 4
test al, al
je 0x42e92d
push 0x4e1628
lea ecx, [ebp - 0x58]
call fcn.0042bed0
test eax, eax
jne 0x42e94f
lea eax, [ebp - 0x28]
push str.wpsoffice_ofd
push eax
call fcn.00426450
add esp, 8
lea ecx, [ebx + 0x2c]
push eax
call fcn.00402ca0
lea ecx, [ebp - 0x28]
call fcn.00402ba0
mov dword [ebx + 8], 5
jmp 0x42e94f
lea eax, [ebp - 0x28]
push str.wpsoffice
push eax
call fcn.00426450
add esp, 8
lea ecx, [ebx + 0x2c]
push eax
call fcn.00402ca0
lea ecx, [ebp - 0x28]
call fcn.00402ba0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + 4]
call fcn.00404060
mov ecx, eax
call fcn.00403500
mov ecx, eax
call fcn.00405f10
push ebx
push eax
mov byte [ebp - 4], 0xb
call fcn.00423250
add esp, 8
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1c]
call fcn.00402c00
push ebx
call fcn.00425a00
push ecx
mov dword [ebp - 0x8c], esp
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
test edi, edi
je 0x42e9ad
lock inc dword [edi + 4]
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, dword [ebp - 0x94]
mov byte [ebp - 4], 0xc
mov ecx, dword [eax + 4]
call fcn.004042d0
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.00428070
cmp byte [ebx + 1], 0
je 0x42ea52
xor eax, eax
mov dword [ebp - 0x18], 0
push eax
push 0x4db638
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00408480
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xd
push eax
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + 4]
call fcn.004042d0
mov ecx, eax
call fcn.00427d10
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 0xa
cmp edx, 8
jb 0x42ea52
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42ea48
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ec22
push edx
push ecx
call fcn.0049211e
add esp, 8
call fcn.0047a030
test al, al
je 0x42ea96
push 0x58
call fcn.004920ee
add esp, 4
mov dword [ebp - 0x8c], eax
mov byte [ebp - 4], 0xe
test eax, eax
je 0x42ea83
push ebx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, eax
call fcn.0043a8b0
mov esi, eax
jmp 0x42ea85
xor esi, esi
mov ecx, esi
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x98], esi
call fcn.0043ba40
or eax, 0xffffffff
lea ecx, [ebp - 0x8d]
mov dword [ebp - 0x8c], eax
call fcn.00439d20
lea ecx, [ebp - 0x8d]
call fcn.004092e0
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, dword [ebp - 0x94]
mov dword [ebx + 8], eax
test eax, eax
je 0x42eb02
push str.xmain
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42eaf9
push esi
push dword [ebp - 0x9c]
push dword [ebp + 8]
call eax
add esp, 0xc
mov dword [ebp - 0x8c], eax
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.0042bf50
test al, al
je 0x42eb3d
mov eax, dword [ebx + 0xc]
cmp eax, 0xffffffff
je 0x42eb3d
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebx + 0xc]
cmp eax, 0xffffffff
je 0x42eb2b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebx + 0x14], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0xc], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00402ba0
test edi, edi
je 0x42eb6a
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x42eb6a
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], ebx
dec ebx
jne 0x42eb6a
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
test esi, esi
je 0x42eb77
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0x14]
mov ebx, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x42ebb3
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42eba9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ec27
push edx
push ecx
call fcn.0049211e
add esp, 8
mov edx, dword [ebp - 0x5c]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp edx, 8
jb 0x42ebfd
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42ebf3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ec27
push edx
push ecx
call fcn.0049211e
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049212c
mov esp, ebp
pop ebp
ret 8
call fcn.0049da69
call fcn.0049da69
call fcn.0049da69
int3