Function at 0x427120
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x528]
sub esp, 0x528
push 0xffffffffffffffff
push 0x467fa5
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x486540]
xor eax, ebp
mov dword [ebp + 0x524], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x58], ebx
call fcn.00430fae
mov ecx, eax
test ecx, ecx
je 0x427e6c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
call fcn.00430fae
mov ecx, eax
test ecx, ecx
je 0x427e76
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
call fcn.00430fae
mov ecx, eax
test ecx, ecx
je 0x427e80
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 2
call fcn.00430fae
mov ecx, eax
test ecx, ecx
je 0x427e8a
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x1c], edi
mov byte [ebp - 4], 3
call fcn.00430fae
mov ecx, eax
test ecx, ecx
je 0x427e94
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 4
call fcn.00430fae
mov ecx, eax
test ecx, ecx
je 0x427e9e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 5
call fcn.00430fae
mov ecx, eax
test ecx, ecx
je 0x427ea8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 6
call fcn.00430fae
mov ecx, eax
test ecx, ecx
je 0x427eb2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
push 0x118
lea eax, [ebp + 4]
mov byte [ebp - 4], 7
push 0
push eax
call fcn.0044d4e0
add esp, 0xc
mov dword [ebp], 0x11c
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp + 0x10]
sub eax, 1
je 0x427c62
sub eax, 1
jne 0x427d5b
mov ecx, dword [ebp + 4]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp ecx, 3
jne 0x4272b1
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push str.Windows_NT3._d
push eax
call fcn.00408310
add esp, 0xc
jmp 0x4274bb
mov eax, dword [ebp + 8]
cmp ecx, 4
jne 0x4272d5
test eax, eax
jne 0x4274a8
push 0xb
push str.Windows_NT4
lea ecx, [ebp - 0x14]
call fcn.00402840
jmp 0x4274bb
cmp ecx, 5
jne 0x4273a4
test eax, eax
jne 0x4272f6
push 0xc
push str.Windows_2000
lea ecx, [ebp - 0x14]
call fcn.00402840
jmp 0x4274bb
cmp eax, 1
jne 0x42730f
push 0xa
push str.Windows_XP
lea ecx, [ebp - 0x14]
call fcn.00402840
jmp 0x4274bb
cmp eax, 2
jne 0x4274a8
push 0x59
call esi
test eax, eax
je 0x427339
mov ecx, 0x16
mov eax, str.Windows_Server_2003_R2
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402840
jmp 0x4274bb
mov eax, 0x2000
cmp word [ebp + 0x118], ax
jne 0x427360
mov ecx, 0x1b
mov eax, str.Windows_Storage_Server_2003
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402840
jmp 0x4274bb
cmp byte [ebp + 0x11a], 1
jne 0x42738b
call fcn.00426f50
test eax, eax
je 0x42738b
mov ecx, 0xa
mov eax, str.Windows_XP
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402840
jmp 0x4274bb
mov ecx, 0x13
mov eax, str.Windows_Server_2003
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402840
jmp 0x4274bb
cmp ecx, 6
jne 0x427524
test eax, eax
jne 0x4273ec
cmp byte [ebp + 0x11a], 1
je 0x4273d3
mov ecx, 0x13
mov eax, str.Windows_Server_2008
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402840
jmp 0x4274bb
mov ecx, 0xd
mov eax, str.Windows_Vista
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402840
jmp 0x4274bb
cmp eax, 1
jne 0x42742b
cmp byte [ebp + 0x11a], al
je 0x427412
mov ecx, 0x16
mov eax, str.Windows_Server_2008_R2
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402840
jmp 0x4274bb
mov ecx, 9
mov eax, str.Windows_7
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402840
jmp 0x4274bb
cmp eax, 2
jne 0x427465
cmp byte [ebp + 0x11a], 1
je 0x42744f
mov ecx, 0x13
mov eax, str.Windows_Server_2012
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402840
jmp 0x4274bb
mov ecx, 9
mov eax, str.Windows_8
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402840
jmp 0x4274bb
cmp eax, 3
jne 0x42749f
cmp byte [ebp + 0x11a], 1
je 0x427489
mov ecx, 0x16
mov eax, str.Windows_Server_2012_R2
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402840
jmp 0x4274bb
mov ecx, 0xb
mov eax, str.Windows_8.1
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402840
jmp 0x4274bb
cmp eax, 4
je 0x42752d
push eax
push ecx
lea eax, [ebp - 0x14]
push str.Windows_NT__d._d
push eax
call fcn.00408310
add esp, 0x10
mov eax, dword [ebp + 4]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, 6
jb 0x4277f6
push str.GetProductInfo
push str.kernel32.dll
call ebx
push eax
call edi
test eax, eax
je case.0x4276b7.29
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push ecx
push 0
push 0
push dword [ebp + 8]
push dword [ebp + 4]
call eax
mov eax, dword [ebp - 0x30]
cmp eax, 0x14
ja 0x427695
je 0x427689
dec eax
cmp eax, 0x12
ja case.0x4276b7.29
jmp dword [eax*4 + 0x427ebc]
cmp ecx, 0xa
jb 0x4274a8
cmp byte [ebp + 0x11a], 1
je 0x42757e
mov eax, dword [ebp + 0xc]
cmp eax, 0x4f78
jb 0x427559
mov ecx, 0x13
mov eax, str.Windows_Server_2022
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402840
jmp 0x4274bb
cmp eax, 0x4563
mov eax, str.Windows_Server_2019
jae 0x42756a
mov eax, str.Windows_Server_2016
mov ecx, 0x13
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402840
jmp 0x4274bb
cmp dword [ebp + 0xc], 0x55ec
mov ecx, 0xa
mov eax, str.Windows_11
jae 0x427596
mov eax, str.Windows_10
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402840
jmp 0x4274bb
push 8
push str.Business
jmp 0x4279ee
push 0xa
push str.Business_N
jmp 0x4279ee
push 0xe
push str.Cluster_Server
jmp 0x4279ee
push 0x1e
push str.Datacenter__Full_installation_
jmp 0x4279ee
push 0x25
push str.Datacenter__Server_Core_installation_
jmp 0x4279ee
push 0xa
push str.Enterprise
jmp 0x4279ee
push 0x1e
push str.Enterprise__Full_installation_
jmp 0x4279ee
push 0x25
push str.Enterprise__Server_Core_installation_
jmp 0x4279ee
push 0x2f
push str.Datacenter_Enterprise_for_Itanium_based_Systems
jmp 0x4279ee
push 0xa
push str.Home_Basic
jmp 0x4279ee
push 0xc
push str.Home_Basic_N
jmp 0x4279ee
push 0xc
push str.Home_Premium
jmp 0x4279ee
push 0xb
push str.Home_Server
jmp 0x4279ee
push 0x15
push str.Small_Business_Server
jmp 0x4279ee
push 0x23
push str.Server_Standard__full_installation_
jmp 0x4279ee
push 0x23
push str.Server_Standard__core_installation_
jmp 0x4279ee
push 7
push str.Starter
jmp 0x4279ee
push 8
push str.Ultimate
jmp 0x4279ee
push 0xa
push str.Web_Server
jmp 0x4279ee
push 0x16
push str.Storage_Server_Express
jmp 0x4279ee
cmp eax, 0x31
ja 0x42776e
je 0x427746
add eax, 0xffffffeb
cmp eax, 0x1b
ja case.0x4276b7.29
movzx eax, byte [eax + 0x427f30]
jmp dword [eax*4 + 0x427f08]
push 0xc
push str.Enterprise_N
jmp 0x4279ee
push 0xe
push str.Home_Premium_N
jmp 0x4279ee
push 0x19
push str.Server_for_Small_Business
jmp 0x4279ee
push 0x1d
push str.Small_Business_Server_Premium
jmp 0x4279ee
push 0x19
push str.Storage_Server_Enterprise
jmp 0x4279ee
push 0x17
push str.Storage_Server_Standard
jmp 0x4279ee
push 0x18
push str.Storage_Server_Workgroup
jmp 0x4279ee
push 0xa
push str.Ultimate_N
jmp 0x4279ee
cmp dword [ebp + 8], 2
jb 0x427735
mov ecx, 3
mov eax, 0x478d8c
push ecx
push eax
jmp 0x4279ee
mov ecx, 0xc
mov eax, str.Professional
push ecx
push eax
jmp 0x4279ee
cmp dword [ebp + 8], 2
jb 0x42775d
mov ecx, 5
mov eax, str.Pro_N
push ecx
push eax
jmp 0x4279ee
mov ecx, 0xe
mov eax, str.Professional_N
push ecx
push eax
jmp 0x4279ee
cmp eax, 0xa1
ja 0x4277a2
je 0x427796
sub eax, 0x3c
je 0x42778a
sub eax, 1
je 0x42778a
sub eax, 1
jne case.0x4276b7.29
push 0x11
push str.Essentials_Server
jmp 0x4279ee
push 0x13
push str.Pro_for_Workstation
jmp 0x4279ee
cmp eax, 0xa5
ja 0x4277df
je 0x4277d3
sub eax, 0xa2
je 0x4277c7
sub eax, 2
jne case.0x4276b7.29
push 0x11
push str.Pro_for_Education
jmp 0x4279ee
push 0x15
push str.Pro_for_Workstation_N
jmp 0x4279ee
push 0x13
push str.Pro_for_Education_N
jmp 0x4279ee
cmp eax, 0xabcdabcd
jne case.0x4276b7.29
push 0xa
push str.Unlicensed
jmp 0x4279ee
cmp eax, 5
jne case.0x4276b7.29
mov eax, dword [ebp + 8]
test eax, eax
jne 0x427859
mov al, byte [ebp + 0x11a]
cmp al, 1
jne 0x42781c
push 0xc
push str.Professional
jmp 0x4279ee
cmp al, 3
jne case.0x4276b7.29
mov eax, dword [ebp + 0x118]
test al, al
jns 0x42783a
push 0x11
push str.DataCenter_Server
jmp 0x4279ee
lea ecx, [ebp - 0x10]
test al, 2
je 0x42784d
push 0xf
push str.Advanced_Server
jmp 0x4279f1
push 6
push str.Server
jmp 0x4279f1
cmp eax, 1
jb case.0x4276b7.29
mov eax, dword [ebp + 0x118]
test eax, 0x200
je 0x427878
push 0xc
push str.Home_Edition
jmp 0x4278b2
test al, al
jns 0x427885
push 0x12
push str.Datacenter_Edition
jmp 0x4278b2
test al, 2
je 0x427892
push 0x12
push str.Enterprise_Edition
jmp 0x4278b2
test eax, 0x400
je 0x4278a2
push 0xb
push str.Web_Edition
jmp 0x4278b2
cmp byte [ebp + 0x11a], 1
jne 0x4278ba
push 0xc
push str.Professional
lea ecx, [ebp - 0x10]
call fcn.00402840
push 0x57
call esi
test eax, eax
je 0x4279df
push 0x104
lea eax, [ebp + 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.ehomeehshell.exe
mov esi, eax
lea eax, [ebp + 0x11c]
push 0x104
push eax
call fcn.004524c4
add esp, 0xc
test esi, esi
je case.0x4276b7.29
lea edx, [ebp + 0x324]
lea ecx, [ebp + 0x11c]
call fcn.00429cc0
test eax, eax
je case.0x4276b7.29
lea ecx, [ebp + 0x324]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427920
sub ecx, edx
lea eax, [ebp + 0x324]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.00402840
mov esi, dword [ebp - 0x20]
cmp dword [esi - 0xc], 0
jl case.0x4276b7.29
push 0x478fa0
push esi
call fcn.0044ca85
add esp, 8
test eax, eax
je case.0x4276b7.29
sub eax, esi
sar eax, 1
jne case.0x4276b7.29
push 0xd
push str.Media_Center
lea ecx, [ebp - 0x10]
call fcn.00402840
push 0x4733b8
push str.5.1.
lea ecx, [ebp - 0x20]
call fcn.00418d90
push dword [ebp - 0x20]
call fcn.0045607f
fld qword [0x47bb00]
lea ecx, [ebp - 0x10]
fcomp st(1)
add esp, 4
fnstsw ax
push 4
test ah, 1
jne 0x4279ba
push str.2002
fstp st(0)
call fcn.004081a0
jmp case.0x4276b7.29
fcomp qword [0x47bb08]
fnstsw ax
test ah, 0x41
jp 0x4279d3
push str.2004
call fcn.004081a0
jmp case.0x4276b7.29
push str.2005
call fcn.004081a0
jmp case.0x4276b7.29
push 0x56
call esi
test eax, eax
je case.0x4276b7.29
push 9
push str.Tablet_PC
lea ecx, [ebp - 0x10]
call fcn.00402840
lea ecx, [ebp + 0x14]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427a00
sub ecx, edx
lea eax, [ebp + 0x14]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402840
push 0x479008
push str.Service_Pack
lea ecx, [ebp - 0x2c]
call fcn.00418d90
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push dword [ebp + 4]
push str._d._d
push eax
call fcn.00408310
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push 0x4766fc
push eax
call fcn.00408310
add esp, 0x1c
call fcn.00426f50
test eax, eax
je 0x427a69
mov eax, 0x47902c
jmp 0x427bee
mov eax, dword [0x486f94]
cmp eax, 0xffffffff
jne 0x427ad8
xor eax, eax
mov dword [0x486f94], 0
push str.GetNativeSystemInfo
push str.kernel32
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
call ebx
push eax
call edi
test eax, eax
je 0x427ad3
lea ecx, [ebp - 0x54]
push ecx
call eax
cmp word [ebp - 0x54], 5
jne 0x427ad3
mov dword [0x486f94], 1
mov eax, str.ARM32
mov ecx, 5
jmp 0x427bf3
mov eax, dword [0x486f94]
test eax, eax
je 0x427aeb
mov eax, str.ARM32
mov ecx, 5
jmp 0x427bf3
mov eax, dword [0x486f90]
cmp eax, 0xffffffff
jne 0x427b5a
xor eax, eax
mov dword [0x486f90], 0
push str.GetNativeSystemInfo
push str.kernel32
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
call ebx
push eax
call edi
test eax, eax
je 0x427b55
lea ecx, [ebp - 0x54]
push ecx
call eax
cmp word [ebp - 0x54], 0xc
jne 0x427b55
mov dword [0x486f90], 1
mov eax, str.ARM64
mov ecx, 5
jmp 0x427bf3
mov eax, dword [0x486f90]
test eax, eax
je 0x427b6d
mov eax, str.ARM64
mov ecx, 5
jmp 0x427bf3
mov eax, dword [0x486f98]
cmp eax, 0xffffffff
jne 0x427bd9
xor eax, eax
mov dword [0x486f98], 0
push str.GetNativeSystemInfo
push str.kernel32
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
call ebx
push eax
call edi
test eax, eax
je 0x427bd4
lea ecx, [ebp - 0x54]
push ecx
call eax
cmp word [ebp - 0x54], 6
jne 0x427bd4
mov dword [0x486f98], 1
mov eax, str.IA64
mov ecx, 4
jmp 0x427bf3
mov eax, dword [0x486f98]
test eax, eax
je 0x427be9
mov eax, str.IA64
mov ecx, 4
jmp 0x427bf3
mov eax, 0x472fcc
mov ecx, 3
push ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.00402840
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x24]
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
cmp dword [eax - 0xc], 0
push esi
push edi
je 0x427c3a
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x28]
push dword [ebp - 0x14]
push str._s__s__s___s_Build__s____s_
push eax
call fcn.00408310
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x28]
add esp, 0x20
push eax
call fcn.00402400
jmp 0x427d5b
push dword [ebp - 0x10]
lea eax, [ebp - 0x28]
push dword [ebp - 0x14]
push str._s__s___s_Build__s____s_
push eax
call fcn.00408310
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x28]
add esp, 0x1c
push eax
call fcn.00402400
jmp 0x427d5b
mov eax, dword [ebp + 8]
test eax, eax
je 0x427cc2
cmp eax, 0xa
je 0x427c8c
mov ecx, 0xa
cmp eax, 0x5a
je 0x427c82
mov eax, str.Windows_9x
jmp 0x427d11
mov eax, str.Windows_Me
jmp 0x427d11
mov eax, dword [ebp + 0xc]
mov ecx, 0x8ae
cmp ax, cx
jb 0x427ca5
mov eax, str.Windows_98_SE
mov ecx, 0xd
jmp 0x427d11
mov ecx, 0x7d0
cmp ax, cx
jb 0x427cbb
mov eax, str.Windows_98_SP1
mov ecx, 0xe
jmp 0x427d11
mov eax, str.Windows_98
jmp 0x427d0c
mov eax, dword [ebp + 0xc]
mov ecx, 0x4be
cmp ax, cx
jb 0x427cdb
mov eax, str.Windows_95_OSR2.5
mov ecx, 0x11
jmp 0x427d11
mov ecx, 0x4bc
cmp ax, cx
jb 0x427cf1
mov eax, str.Windows_95_OSR2.1
mov ecx, 0x11
jmp 0x427d11
mov ecx, 0x457
cmp ax, cx
jne 0x427d07
mov eax, str.Windows_95_OSR2
mov ecx, 0xf
jmp 0x427d11
mov eax, str.Windows_95
mov ecx, 0xa
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.00402840
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push dword [ebp + 4]
push str._d._d
push eax
call fcn.00408310
movzx eax, word [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push 0x4766fc
push eax
call fcn.00408310
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
push esi
push edi
push dword [ebp - 0x14]
push str._s___s_Build__s_
push ebx
call fcn.00408310
add esp, 0x30
mov byte [ebp - 4], 6
or ebx, 0xffffffff
mov edx, dword [ebp - 0x20]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x427d7c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
mov eax, ebx
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x427d9a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov eax, ebx
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x427db8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x427dd3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x427dee
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, ebx
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x427e0c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x427e2a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x427e49
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x524]
xor ecx, ebp
call fcn.0044b35e
lea esp, [ebp + 0x528]
pop ebp
ret
push 0x80004005
call fcn.00402d40
push 0x80004005
call fcn.00402d40
push 0x80004005
call fcn.00402d40
push 0x80004005
call fcn.00402d40
push 0x80004005
call fcn.00402d40
push 0x80004005
call fcn.00402d40
push 0x80004005
call fcn.00402d40
push 0x80004005
call fcn.00402d40
jno 0x427f34
inc edx
add byte [ecx], dl
jbe 0x427f05
add byte [ecx], ch
jbe 0x427f09
add cl, ah
jne 0x427f0d
add byte [0xa5004276], bl
jne 0x427f15
add byte [ebp + 0x76], cl
inc edx
add cl, cl
jne 0x427f1d
add byte [ecx + 0x76], al
inc edx
add ch, ch
jne 0x427f25
add byte [ebp + 0x76], ah
inc edx
add ch, dl
jne 0x427f2d
add byte [ecx + 0x76], bl
inc edx
add cl, bh
jne 0x427f35
add byte [0xb1004276], al
jne 0x427f3d
add byte [ebp + 0x76], bh
inc edx
add byte [ebp + 0x35004275], bh
jbe 0x427f49
add dl, bh
jbe 0x427f4d
add byte [esi], al
ja 0x427f51
add dh, ch
jbe 0x427f55
add dh, dl
jbe 0x427f59
add dl, ah
jbe 0x427f5d
add dl, cl
jbe 0x427f61
add byte [esi + 0x12004276], bh
ja 0x427f69
add byte [esi], bl
ja 0x427f6d
add dh, dh
jns 0x427f71
add byte [eax], al
add dword [edx], eax
add eax, dword [eax + 151586566]
add al, 5
push es
pop es
or dword [ecx], ecx
add eax, 0x9090706
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [eax], ecx
int3
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or ah, cl
int3
add byte [ecx], ah
add byte [eax], al
add byte [eax + 0x51], dl
lds edx, [eax - 0x73]
inc ebp
hlt
add byte [eax], al
add byte [ebx - 0xf8a760f], cl