Function at 0x548e20
Capabilities:
Extract resource via kernel32 functions
Get graphical window text
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65e698
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
xor ebx, ebx
push ebx
mov edi, ecx
mov eax, dword [edi + 4]
push ebx
push 0x1027
push eax
mov dword [ebp - 0x6c], edi
call esi
mov ecx, dword [edi + 4]
push ebx
push ebx
push 0x1009
push ecx
mov dword [ebp - 0x70], eax
call esi
mov edx, dword [edi + 4]
push ebx
push ebx
push 0x401
push edx
call esi
lea eax, [edi + 0x2bc]
push eax
lea ecx, [ebp - 0x64]
call fcn.00547c70
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x48]
push ecx
call fcn.005bd6c0
mov eax, dword [ebp - 0x48]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add esp, 4
push ebx
lea edx, [ebp - 0x40]
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.AppGroups
push eax
call esi
mov edx, dword [ebp - 0x48]
push ebx
lea ecx, [ebp - 0x4c]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.AppGroupsOptions
push edx
call esi
mov edx, dword [ebp - 0x40]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x290]
push ecx
push ebx
push edx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x50], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x54961d
lea ecx, [ecx]
test eax, eax
jne 0x54961d
mov edx, dword [ebp - 0x40]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
inc dword [ebp - 0x14]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x290]
push ecx
push edx
call esi
mov eax, dword [ebp - 0x54]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x54]
push ecx
push ebx
push 0
push 0
lea edx, [ebp - 0x290]
push edx
push eax
mov dword [ebp - 0x28], ebx
call esi
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], ebx
cmp word [ebx], ax
je 0x54921d
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x60]
je 0x5491fd
mov esi, dword [ebp - 0x18]
mov eax, dword [esi + 4]
cmp dword [eax - 4], 1
jle 0x548f9b
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [esi + 4]
call fcn.00401370
mov edx, dword [0x700724]
mov eax, dword [edx + 0xc]
mov esi, dword [esi + 4]
mov ecx, 0x700724
call eax
add eax, 0x10
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 2
test esi, esi
je 0x5490df
test esi, 0xffff0000
jne 0x5490e3
movzx edi, si
push 0
push edi
call fcn.00403bf0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x549109
mov ecx, edi
shr ecx, 4
inc ecx
movzx edx, cx
push 6
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x549109
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x549109
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x549109
mov ecx, dword [ebp - 0x20]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x549047
cmp esi, eax
jae 0x549109
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x549035
cmp esi, eax
jae 0x549109
movzx eax, word [esi]
test ax, ax
je 0x549109
mov ebx, dword [ebp - 0x24]
mov edi, eax
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, edi
or eax, ecx
jge 0x54907d
push edi
lea ecx, [ebp - 0x24]
call fcn.00401400
mov ebx, dword [ebp - 0x24]
movzx eax, word [esi]
add esi, 2
cmp eax, 0xffffffff
jne 0x5490a0
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x549090
sub eax, edx
sar eax, 1
inc eax
push eax
push esi
push edi
push ebx
call fcn.006115ec
add esp, 0x10
cmp eax, 0x50
ja case.0x5490bc.1
movzx eax, byte [eax + 0x54994c]
jmp dword [eax*4 + 0x54993c]
test edi, edi
js case.0x5490bc.22
cmp edi, dword [ebx - 8]
jg case.0x5490bc.22
xor ecx, ecx
mov dword [ebx - 0xc], edi
mov word [ebx + edi*2], cx
jmp 0x549109
xor eax, eax
jmp 0x5490ff
mov eax, esi
lea edx, [eax + 2]
jmp 0x5490f0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x5490f0
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x24]
call fcn.00401670
mov byte [ebp - 4], 3
xor edx, edx
push 0x1fe
push edx
lea eax, [ebp - 0x68e]
push eax
mov word [ebp - 0x690], dx
call fcn.006100a0
xor ecx, ecx
push 0x1fe
push ecx
lea edx, [ebp - 0x48e]
push edx
mov word [ebp - 0x490], cx
call fcn.006100a0
mov esi, dword [ebp - 0x24]
add esp, 0x18
cmp dword [esi - 4], 1
jle 0x54915e
mov eax, dword [esi - 0xc]
push eax
lea ecx, [ebp - 0x24]
call fcn.00401370
mov esi, dword [ebp - 0x24]
push 0x100
lea ecx, [ebp - 0x490]
push ecx
push 0x100
lea edx, [ebp - 0x690]
push edx
push 0x100
lea eax, [ebp - 0xa98]
push eax
push 3
lea ecx, [ebp - 0x88]
push ecx
push esi
call fcn.00611a16
lea edx, [ebp - 0x490]
push edx
lea eax, [ebp - 0x690]
push eax
lea ecx, [ebp - 0x898]
push 0x674880
push ecx
call fcn.00544290
mov edx, dword [ebp - 0x1c]
push edx
lea eax, [ebp - 0x898]
push eax
call fcn.00611e0e
add esp, 0x3c
test eax, eax
je 0x549276
mov byte [ebp - 4], 1
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5491eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x18]
add eax, 0x24
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x60]
jne 0x548f83
mov esi, dword [ebp - 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esi + eax*2 + 2], 0
lea eax, [esi + eax*2 + 2]
mov dword [ebp - 0x1c], eax
jne 0x548f74
mov edi, dword [ebp - 0x6c]
mov edx, dword [0x700724]
mov eax, dword [edx + 0xc]
mov ecx, 0x700724
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 6
lea eax, [ebp - 0x290]
shr eax, 0x10
mov dword [ebp - 0x44], eax
test eax, eax
lea eax, [ebp - 0x290]
jne 0x549409
movzx ebx, ax
push 0
push ebx
call fcn.00403bf0
add esp, 8
test eax, eax
je 0x549432
push ebx
push eax
lea ecx, [ebp - 0x10]
call fcn.00405a10
jmp 0x54942f
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x34]
mov esi, dword [ebp - 0x38]
cmp eax, edi
jae 0x549325
cmp esi, eax
ja 0x549325
mov ecx, eax
sub ecx, esi
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
cmp edi, dword [ebp - 0x30]
jne 0x54930f
mov ecx, edi
sub ecx, esi
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0x71c71c6
ja 0x5496a0
mov edx, dword [ebp - 0x30]
sub edx, esi
mov eax, 0x38e38e39
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
inc ecx
add eax, edx
cmp ecx, eax
jbe 0x54930f
mov edx, eax
shr edx, 1
mov esi, 0x71c71c7
sub esi, edx
cmp esi, eax
jae 0x5492f8
xor eax, eax
jmp 0x5492fa
add eax, edx
cmp eax, ecx
jae 0x549300
mov eax, ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.00410200
mov edi, dword [ebp - 0x34]
mov esi, dword [ebp - 0x38]
lea ecx, [ebx + ebx*8]
lea edx, [esi + ecx*4]
push edx
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.004092a0
jmp 0x54939c
mov ebx, dword [ebp - 0x30]
cmp edi, ebx
jne 0x54938e
mov ecx, edi
sub ecx, esi
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0x71c71c6
ja 0x5496a0
mov edx, ebx
sub edx, esi
mov eax, 0x38e38e39
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
inc ecx
add eax, edx
cmp ecx, eax
jbe 0x54938e
mov edx, eax
shr edx, 1
mov esi, 0x71c71c7
sub esi, edx
cmp esi, eax
jae 0x54937a
xor eax, eax
jmp 0x54937c
add eax, edx
cmp eax, ecx
jae 0x549382
mov eax, ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.00410200
mov edi, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x2c]
push edi
push edx
call fcn.0040a920
add edi, 0x24
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x28]
mov edi, dword [ebp - 0x60]
add esp, 0xc
push eax
mov eax, dword [ebp - 0x18]
push eax
add eax, 0x24
push edi
push eax
call fcn.00464620
lea ebx, [edi - 0x24]
mov esi, ebx
add esp, 0x10
cmp esi, edi
je 0x5493da
lea ecx, [ebp - 0x58]
push esi
push ecx
call fcn.0040aa40
add esi, 0x24
add esp, 8
cmp esi, edi
jne 0x5493c6
mov dword [ebp - 0x60], ebx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x548f74
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x548f74
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x549410
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x290]
push ecx
lea ecx, [ebp - 0x10]
call fcn.00401670
mov esi, dword [ebp - 0x10]
mov byte [ebp - 4], 7
mov ebx, dword [esi - 0xc]
mov eax, dword [esi - 8]
mov edx, str._Collapsed
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ebx
add ebx, 0xa
mov ecx, 1
sub ecx, dword [esi - 4]
sub edx, esi
sar edx, 1
sub eax, ebx
or eax, ecx
mov dword [ebp - 0x18], edx
jge 0x54946e
push ebx
lea ecx, [ebp - 0x10]
call fcn.00401400
mov esi, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x1c]
ja 0x549479
lea edx, [esi + edx*2]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push 0x14
push eax
lea edx, [esi + ecx*2]
push 0x14
push edx
call fcn.0060fbd3
add esp, 0x10
test ebx, ebx
js case.0x5490bc.22
cmp ebx, dword [esi - 8]
jg case.0x5490bc.22
mov dword [esi - 0xc], ebx
xor eax, eax
lea ecx, [ebp - 0x3c]
push ecx
mov word [esi + ebx*2], ax
mov edx, dword [ebp - 0x4c]
push esi
push edx
mov dword [ebp - 0x3c], eax
call fcn.005bd3d0
movzx eax, byte [edi + 0x2de]
mov ecx, dword [edi + 0x2e0]
add esp, 0xc
push eax
push ecx
lea edx, [ebp - 0x38]
push edx
mov ecx, edi
call fcn.00546730
cmp dword [ebp - 0x3c], 0
lea edx, [ebp - 0x38]
setne al
movzx ecx, al
push ecx
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x20], esp
push edx
call fcn.00547c70
mov byte [ebp - 4], 8
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
push ecx
mov ebx, esp
mov ecx, 0x700724
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x18], ebx
call edx
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 9
cmp dword [ebp - 0x44], 0
lea eax, [ebp - 0x290]
jne 0x549548
movzx eax, ax
push 0
push eax
mov dword [ebp - 0x44], eax
call fcn.00403bf0
add esp, 8
test eax, eax
je 0x54956e
mov ecx, dword [ebp - 0x44]
push ecx
push eax
mov ecx, ebx
call fcn.00405a10
jmp 0x54956e
lea edx, [eax + 2]
jmp 0x549550
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x549550
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x290]
push edx
mov ecx, ebx
call fcn.00401670
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 7
mov ecx, edi
call fcn.00548540
mov eax, dword [ebp - 0x28]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebp - 4], 1
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5495b1
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x38]
cmp esi, ebx
je 0x5495e5
mov ebx, dword [ebp - 0x34]
cmp esi, ebx
je 0x5495da
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.0040aa40
add esi, 0x24
add esp, 8
cmp esi, ebx
jne 0x5495c3
mov esi, dword [ebp - 0x38]
push esi
call fcn.0060faf6
add esp, 4
xor ebx, ebx
mov eax, dword [ebp - 0x14]
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x50]
push ecx
mov ecx, dword [ebp - 0x40]
lea edx, [ebp - 0x290]
push edx
push eax
push ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x50], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x548f00
mov edx, dword [0x700724]
mov eax, dword [edx + 0xc]
mov ecx, 0x700724
call eax
add eax, 0x10
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 0xd
push 0
push 0xe1
call fcn.00403bf0
add esp, 8
test eax, eax
je 0x549658
push 0xe1
push eax
lea ecx, [ebp - 0x3c]
call fcn.00405a10
mov ebx, dword [ebp - 0x3c]
mov ecx, dword [ebx - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add ebx, 0xfffffff0
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x5496aa
cmp eax, dword [ebx]
jne 0x5496aa
mov esi, ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x5496e6
push 0x8007000e
call fcn.004011d0
push 0x80070057
call fcn.004011d0
push 0x80004005
call fcn.004011d0
push str.vector_T__too_long
call fcn.005fb5fb
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x5496c3
call fcn.00404070
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebx + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.0060fbd3
add esp, 0x10
add esi, 0x10
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 0xf
mov eax, dword [esi - 0xc]
mov dword [ebp - 0x1c], eax
add eax, 0xa
mov dword [ebp - 0x10], eax
mov eax, dword [esi - 8]
sub eax, dword [ebp - 0x10]
mov edx, str._Collapsed
mov dword [ebp - 0x14], edx
mov ecx, 1
sub ecx, dword [esi - 4]
sub edx, esi
sar edx, 1
or eax, ecx
mov dword [ebp - 0x28], edx
jge 0x54972f
mov edx, dword [ebp - 0x10]
push edx
lea ecx, [ebp - 0x20]
call fcn.00401400
mov esi, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x1c]
ja 0x54973a
lea eax, [esi + edx*2]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
push 0x14
push ecx
lea eax, [esi + edx*2]
push 0x14
push eax
call fcn.0060fbd3
add esp, 0x10
cmp dword [ebp - 0x10], 0
jl case.0x5490bc.22
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [esi - 8]
jg case.0x5490bc.22
mov eax, ecx
mov dword [esi - 0xc], eax
xor edx, edx
mov word [esi + eax*2], dx
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x68]
push eax
push esi
push ecx
mov dword [ebp - 0x68], edx
call fcn.005bd3d0
movzx edx, byte [edi + 0x2de]
mov eax, dword [edi + 0x2e0]
add esp, 0xc
push edx
push eax
lea ecx, [ebp - 0x64]
push ecx
mov ecx, edi
call fcn.00546730
cmp dword [ebp - 0x68], 0
setne dl
movzx eax, dl
push eax
sub esp, 0x10
lea edx, [ebp - 0x64]
mov ecx, esp
mov dword [ebp - 0x44], esp
push edx
call fcn.00547c70
mov byte [ebp - 4], 0x10
push ecx
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x6c], esp
mov dword [ebp - 0x28], esp
call edx
cmp dword [ebx + 0xc], 0
lea edx, [ebx + 0xc]
jl 0x5497eb
cmp eax, dword [ebx]
jne 0x5497eb
mov dword [ebp - 0x14], ebx
mov eax, 1
lock xadd dword [edx], eax
jmp 0x54982b
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x549805
call fcn.00404070
mov eax, dword [ebx + 4]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 4]
lea edx, [eax + eax + 2]
push edx
lea edx, [ebx + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
add ecx, 0x10
push ecx
call fcn.0060fbd3
add esp, 0x10
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
add ecx, 0x10
mov dword [edx], ecx
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 0xf
mov ecx, edi
call fcn.00548540
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x70]
mov edx, dword [edi + 4]
lea eax, [ebp - 0x80]
push eax
push ecx
push 0x100e
push edx
mov dword [ebp - 0x80], 3
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x7c]
imul eax, dword [ebp - 0x70]
push eax
mov eax, dword [edi + 4]
push 0
push 0x1014
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, edi
call fcn.00545ab0
mov byte [ebp - 4], 0xd
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5498c4
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov byte [ebp - 4], 0
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x5498e1
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp - 0x64]
xor eax, eax
cmp edi, eax
je 0x54991f
mov ebx, dword [ebp - 0x60]
mov esi, edi
cmp edi, ebx
je 0x549914
lea ebx, [ebx]
lea ecx, [ebp - 0x58]
push esi
push ecx
call fcn.0040aa40
add esi, 0x24
add esp, 8
cmp esi, ebx
jne 0x549900
push edi
call fcn.0060faf6
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret