Function at 0x42a490
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4858d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push ebp
push ebp
mov ebx, ecx
push ebx
push 0x4247f0
push ebp
push ebp
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 5
push 0x43c
mov ecx, ebx
call fcn.00476dee
mov ecx, eax
call fcn.00476fb8
xor eax, eax
mov dword [0x4ac1d8], eax
mov dword [0x4ac1dc], eax
mov dword [0x4ac1e0], eax
mov dword [0x4ac1e4], eax
mov dword [0x4ac1e8], eax
mov dword [0x4ac1ec], eax
mov dword [0x4ac1f0], eax
mov dword [0x4ac1f4], eax
mov dword [0x4ac1f8], eax
mov dword [0x4ac1fc], eax
mov eax, dword [0x4ac998]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4ac998]
mov dword [eax + 4], eax
cmp esi, dword [0x4ac998]
mov dword [0x4ac99c], ebp
je 0x42a580
lea esp, [esp]
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a54f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a56c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4ac998]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x42a530
mov eax, dword [0x4ac9a4]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4ac9a4]
mov dword [eax + 4], eax
cmp esi, dword [0x4ac9a4]
mov dword [0x4ac9a8], ebp
je 0x42a5f0
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a5bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a5dc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4ac9a4]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x42a5a0
mov eax, dword [0x4ac9b0]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4ac9b0]
mov dword [eax + 4], eax
cmp esi, dword [0x4ac9b0]
mov dword [0x4ac9b4], ebp
je 0x42a660
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a62f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a64c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4ac9b0]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x42a610
mov eax, dword [0x4ac9bc]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4ac9bc]
mov dword [eax + 4], eax
cmp esi, dword [0x4ac9bc]
mov dword [0x4ac9c0], ebp
je 0x42a6d0
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a69f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a6bc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4ac9bc]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x42a680
mov eax, dword [0x4ac9c8]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4ac9c8]
mov dword [eax + 4], eax
cmp esi, dword [0x4ac9c8]
mov dword [0x4ac9cc], ebp
je 0x42a740
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a70f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a72c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4ac9c8]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x42a6f0
mov eax, dword [0x4ac9d4]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4ac9d4]
mov dword [eax + 4], eax
cmp esi, dword [0x4ac9d4]
mov dword [0x4ac9d8], ebp
je 0x42a7b0
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a77f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a79c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4ac9d4]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x42a760
mov eax, dword [0x4ac9e0]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4ac9e0]
mov dword [eax + 4], eax
cmp esi, dword [0x4ac9e0]
mov dword [0x4ac9e4], ebp
je 0x42a820
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a7ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a80c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4ac9e0]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x42a7d0
mov eax, dword [0x4ac9ec]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4ac9ec]
mov dword [eax + 4], eax
cmp esi, dword [0x4ac9ec]
mov dword [0x4ac9f0], ebp
je 0x42a890
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a85f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a87c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4ac9ec]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x42a840
mov eax, dword [0x4ac9f8]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4ac9f8]
mov dword [eax + 4], eax
cmp esi, dword [0x4ac9f8]
mov dword [0x4ac9fc], ebp
je 0x42a900
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a8cf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a8ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4ac9f8]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x42a8b0
mov eax, dword [0x4aca04]
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [0x4aca04]
mov dword [eax + 4], eax
cmp esi, dword [0x4aca04]
mov dword [0x4aca08], ebp
je 0x42a970
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a93f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a95c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00477b19
mov eax, dword [0x4aca04]
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x42a920
push ebp
push 4
mov ecx, ebx
mov dword [0x4ac2c0], ebp
call fcn.00476dee
mov ecx, eax
call fcn.00476ff4
push ebp
push 5
mov ecx, ebx
call fcn.00476dee
mov ecx, eax
call fcn.00476ff4
push ebp
push 1
mov ecx, ebx
call fcn.00476dee
mov ecx, eax
call fcn.00476ff4
mov eax, dword [ebx + 0xc90]
cmp dword [0x4ac294], ebp
mov dword [0x4ac2c8], eax
mov dword [esp + 0x18], eax
lea eax, [eax + eax + 0xa]
push eax
mov dword [0x4ac2c4], eax
mov ecx, dword [ebx + 0x594]
push ebp
je 0x42a9ec
cmp ecx, ebp
jne 0x42a9f0
lea esi, [ebx + 0x294]
mov ecx, esi
call fcn.0042fc80
push ebp
mov ecx, esi
call fcn.0042fcc0
jmp 0x42aa0e
cmp ecx, ebp
jne 0x42a9d5
lea esi, [ebx + 0xb1c]
mov ecx, esi
call fcn.0042fc80
mov ecx, esi
push ebp
call fcn.0042fcc0
mov ecx, esi
push 5
call fcn.00476fb8
call fcn.00477b74
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x24], eax
call fcn.00477b74
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x28], eax
mov eax, dword [ebx + 0xc8c]
mov ecx, dword [eax]
cmp ecx, eax
mov dword [esp + 0x34], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ecx
je 0x42b4ea
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x10], eax
je 0x42b4ea
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0xc]
mov ebp, dword [esp + 0x24]
lea esi, [eax - 0x10]
add ebp, 0xfffffff0
cmp esi, ebp
je 0x42ab08
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jl 0x42aafa
mov ecx, dword [esi]
cmp ecx, dword [ebp]
jne 0x42aafa
mov edx, dword [ecx]
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x42aaa5
cmp eax, dword [esi]
jne 0x42aaa5
mov ebx, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x42aad9
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
mov ebx, eax
test ebx, ebx
je 0x42b56e
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
shr ecx, 2
add esi, 0x10
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea eax, [ebp + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42aaf1
mov ecx, dword [ebp]
mov edx, dword [ecx]
push ebp
call dword [edx + 4]
add ebx, 0x10
mov dword [esp + 0x24], ebx
jmp 0x42ab08
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.00401b80
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x10]
mov ebp, dword [esp + 0x28]
lea esi, [eax - 0x10]
add ebp, 0xfffffff0
cmp esi, ebp
je 0x42abb2
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jl 0x42aba4
mov ecx, dword [esi]
cmp ecx, dword [ebp]
jne 0x42aba4
mov edx, dword [ecx]
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x42ab4f
cmp eax, dword [esi]
jne 0x42ab4f
mov ebx, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x42ab83
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
mov ebx, eax
test ebx, ebx
je 0x42b56e
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
shr ecx, 2
add esi, 0x10
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea eax, [ebp + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42ab9b
mov ecx, dword [ebp]
mov edx, dword [ecx]
push ebp
call dword [edx + 4]
add ebx, 0x10
mov dword [esp + 0x28], ebx
jmp 0x42abb2
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x30]
call fcn.00401b80
mov esi, dword [0x4ac998]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x20]
push eax
push ecx
push esi
mov ecx, 0x4ac994
call fcn.00418410
push 1
mov ecx, 0x4ac994
mov edi, eax
call fcn.004185c0
mov edx, dword [esp + 0x14]
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
mov eax, dword [esp + 0x10]
mov ecx, dword [edx]
mov edx, dword [esp + 0x18]
inc eax
cmp eax, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
je 0x42b4ea
mov eax, dword [ecx + 0xc]
mov ebp, dword [esp + 0x24]
lea esi, [eax - 0x10]
add ebp, 0xfffffff0
cmp esi, ebp
je 0x42aca7
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jl 0x42ac99
mov ecx, dword [esi]
cmp ecx, dword [ebp]
jne 0x42ac99
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x42ac44
cmp eax, dword [esi]
jne 0x42ac44
mov ebx, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x42ac78
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
mov ebx, eax
test ebx, ebx
je 0x42b56e
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
shr ecx, 2
add esi, 0x10
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea eax, [ebp + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42ac90
mov ecx, dword [ebp]
mov edx, dword [ecx]
push ebp
call dword [edx + 4]
add ebx, 0x10
mov dword [esp + 0x24], ebx
jmp 0x42aca7
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.00401b80
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x10]
mov ebp, dword [esp + 0x28]
lea esi, [eax - 0x10]
add ebp, 0xfffffff0
cmp esi, ebp
je 0x42ad51
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jl 0x42ad43
mov ecx, dword [esi]
cmp ecx, dword [ebp]
jne 0x42ad43
mov edx, dword [ecx]
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x42acee
cmp eax, dword [esi]
jne 0x42acee
mov ebx, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x42ad22
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
mov ebx, eax
test ebx, ebx
je 0x42b56e
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
shr ecx, 2
add esi, 0x10
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea eax, [ebp + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42ad3a
mov ecx, dword [ebp]
mov edx, dword [ecx]
push ebp
call dword [edx + 4]
add ebx, 0x10
mov dword [esp + 0x28], ebx
jmp 0x42ad51
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x30]
call fcn.00401b80
mov esi, dword [0x4ac9a4]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x20]
push eax
push ecx
push esi
mov ecx, 0x4ac9a0
call fcn.00418410
push 1
mov ecx, 0x4ac9a0
mov edi, eax
call fcn.004185c0
mov edx, dword [esp + 0x14]
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
mov eax, dword [esp + 0x10]
mov ecx, dword [edx]
mov edx, dword [esp + 0x18]
inc eax
cmp eax, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
je 0x42b4ea
mov eax, dword [ecx + 0xc]
mov ebp, dword [esp + 0x24]
lea esi, [eax - 0x10]
add ebp, 0xfffffff0
cmp esi, ebp
je 0x42ae46
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jl 0x42ae38
mov ecx, dword [esi]
cmp ecx, dword [ebp]
jne 0x42ae38
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x42ade3
cmp eax, dword [esi]
jne 0x42ade3
mov ebx, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x42ae17
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
mov ebx, eax
test ebx, ebx
je 0x42b56e
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
shr ecx, 2
add esi, 0x10
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea eax, [ebp + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42ae2f
mov ecx, dword [ebp]
mov edx, dword [ecx]
push ebp
call dword [edx + 4]
add ebx, 0x10
mov dword [esp + 0x24], ebx
jmp 0x42ae46
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.00401b80
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x10]
mov ebp, dword [esp + 0x28]
lea esi, [eax - 0x10]
add ebp, 0xfffffff0
cmp esi, ebp
je 0x42aef0
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jl 0x42aee2
mov ecx, dword [esi]
cmp ecx, dword [ebp]
jne 0x42aee2
mov edx, dword [ecx]
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x42ae8d
cmp eax, dword [esi]
jne 0x42ae8d
mov ebx, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x42aec1
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
mov ebx, eax
test ebx, ebx
je 0x42b56e
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
shr ecx, 2
add esi, 0x10
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea eax, [ebp + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42aed9
mov ecx, dword [ebp]
mov edx, dword [ecx]
push ebp
call dword [edx + 4]
add ebx, 0x10
mov dword [esp + 0x28], ebx
jmp 0x42aef0
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x30]
call fcn.00401b80
mov esi, dword [0x4ac9b0]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x20]
push eax
push ecx
push esi
mov ecx, 0x4ac9ac
call fcn.00418410
push 1
mov ecx, 0x4ac9ac
mov edi, eax
call fcn.004185c0
mov edx, dword [esp + 0x14]
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
mov eax, dword [esp + 0x10]
mov ecx, dword [edx]
mov edx, dword [esp + 0x18]
inc eax
cmp eax, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
je 0x42b4ea
mov eax, dword [ecx + 0xc]
mov ebp, dword [esp + 0x24]
lea esi, [eax - 0x10]
add ebp, 0xfffffff0
cmp esi, ebp
je 0x42afe5
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jl 0x42afd7
mov ecx, dword [esi]
cmp ecx, dword [ebp]
jne 0x42afd7
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x42af82
cmp eax, dword [esi]
jne 0x42af82
mov ebx, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x42afb6
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
mov ebx, eax
test ebx, ebx
je 0x42b56e
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
shr ecx, 2
add esi, 0x10
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea eax, [ebp + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42afce
mov ecx, dword [ebp]
mov edx, dword [ecx]
push ebp
call dword [edx + 4]
add ebx, 0x10
mov dword [esp + 0x24], ebx
jmp 0x42afe5
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.00401b80
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x10]
mov ebp, dword [esp + 0x28]
lea esi, [eax - 0x10]
add ebp, 0xfffffff0
cmp esi, ebp
je 0x42b08f
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jl 0x42b081
mov ecx, dword [esi]
cmp ecx, dword [ebp]
jne 0x42b081
mov edx, dword [ecx]
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x42b02c
cmp eax, dword [esi]
jne 0x42b02c
mov ebx, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x42b060
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
mov ebx, eax
test ebx, ebx
je 0x42b56e
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
shr ecx, 2
add esi, 0x10
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea eax, [ebp + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42b078
mov ecx, dword [ebp]
mov edx, dword [ecx]
push ebp
call dword [edx + 4]
add ebx, 0x10
mov dword [esp + 0x28], ebx
jmp 0x42b08f
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x30]
call fcn.00401b80
mov esi, dword [0x4ac9bc]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x20]
push eax
push ecx
push esi
mov ecx, 0x4ac9b8
call fcn.00418410
push 1
mov ecx, 0x4ac9b8
mov edi, eax
call fcn.004185c0
mov edx, dword [esp + 0x14]
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
mov eax, dword [esp + 0x10]
mov ecx, dword [edx]
mov edx, dword [esp + 0x18]
inc eax
cmp eax, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
je 0x42b4ea
mov eax, dword [ecx + 0xc]
mov ebp, dword [esp + 0x24]
lea esi, [eax - 0x10]
add ebp, 0xfffffff0
cmp esi, ebp
je 0x42b184
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jl 0x42b176
mov ecx, dword [esi]
cmp ecx, dword [ebp]
jne 0x42b176
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x42b121
cmp eax, dword [esi]
jne 0x42b121
mov ebx, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x42b155
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
mov ebx, eax
test ebx, ebx
je 0x42b56e
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
shr ecx, 2
add esi, 0x10
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea eax, [ebp + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42b16d
mov ecx, dword [ebp]
mov edx, dword [ecx]
push ebp
call dword [edx + 4]
add ebx, 0x10
mov dword [esp + 0x24], ebx
jmp 0x42b184
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.00401b80
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x10]
mov ebp, dword [esp + 0x28]
lea esi, [eax - 0x10]
add ebp, 0xfffffff0
cmp esi, ebp
je 0x42b22e
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jl 0x42b220
mov ecx, dword [esi]
cmp ecx, dword [ebp]
jne 0x42b220
mov edx, dword [ecx]
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x42b1cb
cmp eax, dword [esi]
jne 0x42b1cb
mov ebx, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x42b1ff
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
mov ebx, eax
test ebx, ebx
je 0x42b56e
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
shr ecx, 2
add esi, 0x10
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea eax, [ebp + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42b217
mov ecx, dword [ebp]
mov edx, dword [ecx]
push ebp
call dword [edx + 4]
add ebx, 0x10
mov dword [esp + 0x28], ebx
jmp 0x42b22e
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x30]
call fcn.00401b80
mov esi, dword [0x4ac9c8]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x20]
push eax
push ecx
push esi
mov ecx, 0x4ac9c4
call fcn.00418410
push 1
mov ecx, 0x4ac9c4
mov edi, eax
call fcn.004185c0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
mov eax, dword [esp + 0x10]
mov ebp, dword [edx]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
je 0x42b4ea
mov edx, dword [ebp + 0xc]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea esi, [edx - 0x10]
cmp esi, eax
mov dword [esp + 0x14], eax
je 0x42b325
mov ecx, dword [eax + 0xc]
test ecx, ecx
jl 0x42b317
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x42b317
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x42b2bf
cmp eax, dword [esi]
jne 0x42b2bf
mov ebx, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x42b2f3
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
mov ebx, eax
test ebx, ebx
je 0x42b56e
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
shr ecx, 2
add esi, 0x10
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x14]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b30e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
add ebx, 0x10
mov dword [esp + 0x24], ebx
jmp 0x42b325
mov eax, dword [edx - 0xc]
push eax
push edx
lea ecx, [esp + 0x2c]
call fcn.00401b80
lea eax, [ebp + 0x10]
push eax
lea ecx, [esp + 0x2c]
call fcn.00401e70
mov esi, dword [0x4ac9d4]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x20]
push eax
push ecx
push esi
mov ecx, 0x4ac9d0
call fcn.00418410
push 1
mov ecx, 0x4ac9d0
mov edi, eax
call fcn.004185c0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
inc ecx
mov dword [eax], edi
mov ebx, dword [ebp]
mov eax, ecx
cmp eax, edx
mov dword [esp + 0x10], ecx
je 0x42b4ea
lea eax, [ebx + 0xc]
push eax
lea ecx, [esp + 0x28]
call fcn.00401e70
lea eax, [ebx + 0x10]
push eax
lea ecx, [esp + 0x2c]
call fcn.00401e70
mov esi, dword [0x4ac9e0]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x20]
push eax
push ecx
push esi
mov ecx, 0x4ac9dc
call fcn.00418410
push 1
mov ecx, 0x4ac9dc
mov edi, eax
call fcn.004185c0
mov ebp, dword [esp + 0x10]
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
mov eax, dword [esp + 0x18]
mov ebx, dword [ebx]
inc ebp
cmp ebp, eax
je 0x42b4ea
lea eax, [ebx + 0xc]
push eax
lea ecx, [esp + 0x28]
call fcn.00401e70
lea eax, [ebx + 0x10]
push eax
lea ecx, [esp + 0x2c]
call fcn.00401e70
mov esi, dword [0x4ac9ec]
mov eax, dword [esi + 4]
lea edx, [esp + 0x20]
push edx
push eax
push esi
mov ecx, 0x4ac9e8
call fcn.00418410
push 1
mov ecx, 0x4ac9e8
mov edi, eax
call fcn.004185c0
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
mov eax, dword [esp + 0x18]
mov ebx, dword [ebx]
inc ebp
cmp ebp, eax
je 0x42b478
lea eax, [ebx + 0xc]
push eax
lea ecx, [esp + 0x28]
call fcn.00401e70
lea eax, [ebx + 0x10]
push eax
lea ecx, [esp + 0x2c]
call fcn.00401e70
mov esi, dword [0x4ac9f8]
mov edx, dword [esi + 4]
lea ecx, [esp + 0x20]
push ecx
push edx
push esi
mov ecx, 0x4ac9f4
call fcn.00418410
push 1
mov ecx, 0x4ac9f4
mov edi, eax
call fcn.004185c0
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
mov eax, dword [esp + 0x18]
mov ebx, dword [ebx]
inc ebp
cmp ebp, eax
je 0x42b4cd
lea eax, [ebx + 0xc]
push eax
lea ecx, [esp + 0x28]
call fcn.00401e70
lea eax, [ebx + 0x10]
push eax
lea ecx, [esp + 0x2c]
call fcn.00401e70
mov esi, dword [0x4aca04]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x20]
push eax
push ecx
push esi
mov ecx, 0x4aca00
call fcn.00418410
push 1
mov ecx, 0x4aca00
mov edi, eax
call fcn.004185c0
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
mov edx, dword [esp + 0x1c]
mov ebx, dword [ebx]
mov eax, dword [edx + 0xc8c]
inc ebp
cmp ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
jne 0x42aa50
mov esi, dword [esp + 0x1c]
push 0
push 0
push esi
push 0x423ca0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [esi + 0x1c]
push 0
push 0x3e8
push 2
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esp + 0x34], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b53b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b559
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 4
call fcn.004012b0
int3