Function at 0x4029e0
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4107bb
mov eax, dword fs:[0]
push eax
sub esp, 0x554
mov eax, dword [0x41700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x3a0]
call fcn.00408460
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x334]
call fcn.00401a90
mov byte [ebp - 4], 1
mov dword [ebp - method.CWString.virtual_0], 0x412424
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 0
mov byte [ebp - 4], 2
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x244], 0x40
mov byte [ebp - 4], 3
mov dword [ebp - method.CWString.virtual_0], 0x412424
mov dword [ebp - 0x52c], 0x650078
mov word [ebp - 0x528], 0
mov word [ebp - 0x550], 0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x270], 0
mov byte [ebp - 4], 4
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x260], 0x40
mov byte [ebp - 4], 5
mov dword [ebp - method.CWString.virtual_0], 0x412424
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x28c], 0
mov byte [ebp - 4], 6
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x284], 0
mov dword [ebp - 0x27c], 0x40
mov byte [ebp - 4], 7
mov esi, dword [ebp - 0x248]
mov dword [ebp - 0x2d4], 0
mov dword [ebp - 0x2d8], 0
lea eax, [esi + 0x10]
cmp eax, esi
jne 0x402b99
mov eax, dword [ebp - 0x250]
jmp 0x402bfa
test eax, eax
jne 0x402bee
mov ecx, dword [ebp - 0x250]
test ecx, ecx
je 0x402bcc
mov eax, dword [ebp - 0x25c]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x402bc4
mov ecx, 0x417968
call fcn.0040e650
jmp 0x402bcc
lea ecx, [ebp - 0x25c]
call eax
mov dword [ebp - 0x250], 0
xor eax, eax
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x24c], 0
jmp 0x402bfa
push eax
lea ecx, [ebp - 0x25c]
call fcn.0040da40
movaps xmm0, xmmword [0x412ec0]
push 1
movups xmmword [eax + esi], xmm0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
lea edx, [ebp - 0x25c]
lea ecx, [ebp - 0x524]
mov esi, eax
call fcn.00409800
mov byte [ebp - 4], 8
mov edx, eax
push ecx
lea ecx, [ebp - 0x308]
call fcn.0040f0d0
add esp, 4
mov byte [ebp - 4], 9
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x402c50
cmp dword [eax + 0x24], ecx
mov ecx, 0x412b70
je 0x402c50
mov ecx, dword [eax + 0x1c]
push ecx
push 0x412494
push esi
call fcn.004043e0
add esp, 0xc
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x308]
call fcn.00401780
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x524]
call fcn.00401780
mov ecx, dword [ebp - 0x250]
mov edx, 0x40
mov dword [ebp - 0x248], 0
test ecx, ecx
jne 0x402ca7
push 0x26
lea ecx, [ebp - 0x25c]
call fcn.0040da40
mov ecx, eax
jmp 0x402d25
mov esi, dword [ebp - 0x244]
test esi, esi
mov eax, dword [ebp - 0x24c]
cmovle esi, edx
cmp eax, 0x26
jl 0x402cd0
add eax, 0xffffffda
cmp eax, esi
jg 0x402cd0
mov dword [ebp - 0x248], 0x26
jmp 0x402d2a
mov eax, 0x26
cdq
idiv esi
mov eax, dword [ebp - 0x25c]
sub esi, edx
add esi, 0x26
push esi
mov eax, dword [eax + 8]
push ecx
cmp eax, method.CWString.virtual_8
jne 0x402d05
mov ecx, 0x417968
call fcn.0040e5c0
mov ecx, eax
test ecx, ecx
je 0x402f26
jmp 0x402d0f
lea ecx, [ebp - 0x25c]
call eax
mov ecx, eax
mov dword [ebp - 0x250], ecx
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x248], 0x26
mov edx, 0x40
movaps xmm0, xmmword [0x412f10]
mov eax, dword [ebp - 0x52c]
movups xmmword [ecx], xmm0
movaps xmm0, xmmword [0x412ef0]
movups xmmword [ecx + 0x10], xmm0
mov dword [ecx + 0x20], eax
mov ax, word [ebp - 0x528]
mov word [ecx + 0x24], ax
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 0x26c]
mov dword [ebp - 0x298], eax
lea edi, [eax + 0x12]
cmp edi, eax
je 0x402e3b
test edi, edi
jne 0x402dbf
test ecx, ecx
je 0x402d9d
mov eax, dword [ebp - 0x278]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x402d95
mov ecx, 0x417968
call fcn.0040e650
jmp 0x402d9d
lea ecx, [ebp - 0x278]
call eax
mov dword [ebp - 0x26c], 0
xor ecx, ecx
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x268], 0
jmp 0x402e3b
test ecx, ecx
jne 0x402dd3
push edi
lea ecx, [ebp - 0x278]
call fcn.0040da40
mov ecx, eax
jmp 0x402e3b
mov esi, dword [ebp - 0x260]
test esi, esi
mov eax, dword [ebp - 0x268]
cmovle esi, edx
cmp eax, edi
jl 0x402dee
sub eax, edi
cmp eax, esi
jle 0x402e35
mov eax, edi
cdq
idiv esi
mov eax, dword [ebp - 0x278]
sub esi, edx
add esi, edi
push esi
mov eax, dword [eax + 8]
push ecx
cmp eax, method.CWString.virtual_8
jne 0x402e1f
mov ecx, 0x417968
call fcn.0040e5c0
mov ecx, eax
test ecx, ecx
je 0x402f26
jmp 0x402e29
lea ecx, [ebp - 0x278]
call eax
mov ecx, eax
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x264], edi
mov edx, dword [ebp - 0x298]
movaps xmm0, xmmword [0x412f00]
mov ax, word [ebp - 0x550]
movups xmmword [ecx + edx], xmm0
mov word [ecx + edx + 0x10], ax
mov esi, dword [ebp - 0x280]
mov ecx, dword [ebp - 0x288]
mov dword [ebp - 0x240], esi
lea edi, [esi + 0x50]
cmp edi, esi
je 0x402f50
test edi, edi
jne 0x402ec7
test ecx, ecx
je 0x402ea2
mov eax, dword [ebp - 0x294]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x402e9a
mov ecx, 0x417968
call fcn.0040e650
jmp 0x402ea2
lea ecx, [ebp - 0x294]
call eax
mov dword [ebp - 0x288], 0
xor ecx, ecx
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x284], 0
jmp 0x402f50
test ecx, ecx
jne 0x402edb
push edi
lea ecx, [ebp - 0x294]
call fcn.0040da40
mov ecx, eax
jmp 0x402f50
mov esi, dword [ebp - 0x27c]
mov eax, 0x40
test esi, esi
cmovle esi, eax
mov eax, dword [ebp - 0x284]
cmp eax, edi
jl 0x402efb
sub eax, edi
cmp eax, esi
jle 0x402f44
mov eax, edi
cdq
idiv esi
mov eax, dword [ebp - 0x294]
sub esi, edx
add esi, edi
push esi
mov eax, dword [eax + 8]
push ecx
cmp eax, method.CWString.virtual_8
jne 0x402f2e
mov ecx, 0x417968
call fcn.0040e5c0
mov ecx, eax
test ecx, ecx
jne 0x402f38
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea ecx, [ebp - 0x294]
call eax
mov ecx, eax
mov dword [ebp - 0x288], ecx
mov dword [ebp - 0x284], esi
mov esi, dword [ebp - 0x240]
mov dword [ebp - 0x280], edi
movaps xmm0, xmmword [0x412ee0]
xor edi, edi
movups xmmword [ecx + esi], xmm0
movaps xmm0, xmmword [0x412f20]
movups xmmword [ecx + esi + 0x10], xmm0
movaps xmm0, xmmword [0x412f20]
movups xmmword [ecx + esi + 0x20], xmm0
movaps xmm0, xmmword [str.SDKResLUserDataleGame.eQRSL.exeWmgpMobiPatcher]
movups xmmword [ecx + esi + 0x30], xmm0
movaps xmm0, xmmword [str.ist.xml]
movups xmmword [ecx + esi + 0x40], xmm0
nop dword [eax]
lea edx, [ebp - 0x25c]
lea ecx, [ebp - 0x41c]
call fcn.00409800
mov byte [ebp - 4], 0xa
mov ecx, eax
call fcn.00401030
mov esi, eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x3b8], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x400]
test ecx, ecx
je 0x402ffb
mov eax, dword [ebp - 0x40c]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x402ff3
mov ecx, 0x417968
call fcn.0040e650
jmp 0x402ffb
lea ecx, [ebp - 0x40c]
call eax
mov dword [ebp - 0x400], 0
mov dword [ebp - 0x3f8], 0
mov dword [ebp - 0x3fc], 0
mov byte [ebp - 4], 0xb
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 7
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
test esi, esi
je 0x4039fe
cmp dword [ebp - 0x2d4], 0
jne 0x4031ac
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
lea ecx, [ebp - 0x524]
mov esi, eax
call fcn.00401a90
mov byte [ebp - 4], 0xe
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x518], 0x41249c
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x364]
call fcn.00401a90
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x354]
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x354]
mov dword [ebp - method.CWString.virtual_0], vtable.CWString.0
call dword [eax + 0x44]
lea eax, [ebp - 0x514]
push eax
lea ecx, [ebp - 0x354]
call fcn.00401ea0
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x358]
test eax, eax
jne 0x4030fd
cmp dword [ebp - 0x340], 0
mov eax, 0x412b70
cmovne eax, dword [ebp - 0x348]
push eax
push 0x412494
push esi
call fcn.004043e0
add esp, 0xc
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x354]
mov dword [ebp - 0x3bc], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x348]
test ecx, ecx
je 0x403159
mov eax, dword [ebp - 0x354]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x403151
mov ecx, 0x417968
call fcn.0040e650
jmp 0x403159
lea ecx, [ebp - 0x354]
call eax
mov dword [ebp - 0x348], 0
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x344], 0
mov byte [ebp - 4], 0x12
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0xf
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x524]
call fcn.00401780
mov dword [ebp - 0x2d4], 1
lea edx, [ebp - 0x278]
lea ecx, [ebp - 0x448]
call fcn.00409800
mov byte [ebp - 4], 0x16
mov ecx, eax
call fcn.00401030
mov esi, eax
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x438]
mov dword [ebp - 0x3c0], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x42c]
test ecx, ecx
je 0x403217
mov eax, dword [ebp - 0x438]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x40320f
mov ecx, 0x417968
call fcn.0040e650
jmp 0x403217
lea ecx, [ebp - 0x438]
call eax
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x428], 0
mov byte [ebp - 4], 0x17
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 7
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
test esi, esi
je 0x403a06
cmp dword [ebp - 0x2d8], 0
jne 0x4033c8
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
lea ecx, [ebp - 0x308]
mov esi, eax
call fcn.00401a90
mov byte [ebp - 4], 0x1a
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x2fc], 0x4124c4
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x390]
call fcn.00401a90
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x380]
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x380]
mov dword [ebp - method.CWString.virtual_0], vtable.CWString.0
call dword [eax + 0x44]
lea eax, [ebp - 0x2f8]
push eax
lea ecx, [ebp - 0x380]
call fcn.00401ea0
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0x384]
test eax, eax
jne 0x403319
cmp dword [ebp - 0x36c], 0
mov eax, 0x412b70
cmovne eax, dword [ebp - 0x374]
push eax
push 0x412494
push esi
call fcn.004043e0
add esp, 0xc
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0x380]
mov dword [ebp - 0x3c4], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp - 0x374]
test ecx, ecx
je 0x403375
mov eax, dword [ebp - 0x380]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x40336d
mov ecx, 0x417968
call fcn.0040e650
jmp 0x403375
lea ecx, [ebp - 0x380]
call eax
mov dword [ebp - 0x374], 0
mov dword [ebp - 0x36c], 0
mov dword [ebp - 0x370], 0
mov byte [ebp - 4], 0x1e
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x1b
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x308]
call fcn.00401780
mov dword [ebp - 0x2d8], 1
lea edx, [ebp - 0x25c]
lea ecx, [ebp - 0x4a0]
call fcn.00409800
mov esi, eax
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x2d0]
call fcn.00401a90
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x238]
push 0x228
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x4034fe
lea eax, [ebp - 0x23c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4034f6
nop dword [eax]
xor eax, eax
mov dword [ebp - 0x2c4], eax
mov ecx, dword [ebp - 0x2b4]
test ecx, ecx
je 0x403468
mov eax, dword [ebp - 0x2c0]
push ecx
lea ecx, [ebp - 0x2c0]
call dword [eax + 0xc]
mov eax, dword [ebp - 0x2c4]
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0x2b4], ecx
mov dword [ebp - 0x2ac], edx
mov dword [ebp - 0x2b0], ecx
cmp word [ebp - 0x218], cx
je 0x4034ab
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2c0]
call fcn.0040db50
mov edx, dword [ebp - 0x2ac]
mov ecx, dword [ebp - 0x2b4]
mov eax, dword [ebp - 0x2c4]
test eax, eax
jne 0x4034b9
test edx, edx
mov eax, 0x412b70
cmovne eax, ecx
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x4034cd
cmp dword [esi + 0x24], ecx
mov ecx, 0x412b70
je 0x4034cd
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x4035af
lea eax, [ebp - 0x23c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x403440
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call eax
mov byte [ebp - 4], 0x22
xor esi, esi
lea ecx, [ebp - 0x2d0]
call fcn.00401780
mov edx, esi
lea ecx, [ebp - 0x474]
call fcn.004011c0
mov esi, eax
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x334]
mov edx, dword [ebp - 0x334]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x330], ecx
mov ecx, dword [esi + 8]
mov dword [ebp - 0x32c], ecx
lea ecx, [ebp - 0x324]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x324]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x324]
call fcn.00401ea0
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0x464]
mov dword [ebp - 0x3c8], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x458]
test ecx, ecx
je 0x4035ce
mov eax, dword [ebp - 0x464]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x4035c6
mov ecx, 0x417968
call fcn.0040e650
jmp 0x4035ce
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call eax
mov esi, dword [ebp - 0x234]
mov byte [ebp - 4], 0x22
jmp 0x403504
lea ecx, [ebp - 0x464]
call eax
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x454], 0
mov byte [ebp - 4], 0x25
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x22
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x28
lea eax, [ebp - 0x490]
mov dword [ebp - 0x3cc], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x2a
mov ecx, dword [ebp - 0x484]
test ecx, ecx
je 0x403655
mov eax, dword [ebp - 0x490]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x40364d
mov ecx, 0x417968
call fcn.0040e650
jmp 0x403655
lea ecx, [ebp - 0x490]
call eax
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x480], 0
mov byte [ebp - 4], 0x28
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 7
lea edx, [ebp - 0x294]
lea ecx, [ebp - 0x4f8]
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
call fcn.00409800
mov esi, eax
mov byte [ebp - 4], 0x2b
lea edx, [ebp - 0x25c]
lea ecx, [ebp - 0x4cc]
call fcn.00409800
mov byte [ebp - 4], 0x2c
mov edi, dword [esi + 0xc]
mov dword [ebp - 0x29c], edi
test edi, edi
jne 0x4036db
cmp dword [esi + 0x24], edi
mov edi, 0x412b70
je 0x4036d5
mov edi, dword [esi + 0x1c]
mov dword [ebp - 0x29c], edi
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x2a4], edx
test edx, edx
jne 0x4036fb
cmp dword [eax + 0x24], edx
mov edx, 0x412b70
je 0x4036f5
mov edx, dword [eax + 0x1c]
mov dword [ebp - 0x2a4], edx
mov esi, dword [ebp - 0x328]
mov dword [ebp - 0x2dc], 1
test esi, esi
je 0x403723
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x403712
sub esi, ecx
sar esi, 1
jmp 0x403730
mov esi, dword [ebp - 0x310]
test esi, esi
je 0x403730
shr esi, 1
dec esi
mov ecx, edx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403735
sub ecx, edx
mov edx, edi
sar ecx, 1
mov dword [ebp - 0x2a0], ecx
lea edi, [edx + 2]
lea eax, [ecx + ecx]
mov dword [ebp - 0x338], eax
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x403760
sub edx, edi
sar edx, 1
lea eax, [edx + edx]
mov dword [ebp - 0x298], eax
cmp esi, ecx
jl 0x403850
test esi, esi
jle 0x403850
test ecx, ecx
je 0x403850
lea ecx, [ebp - 0x334]
call fcn.0040e990
mov edi, dword [ebp - 0x328]
test edi, edi
jne 0x4037b8
cmp dword [ebp - 0x310], 0
mov edi, 0x412b70
cmovne edi, dword [ebp - 0x318]
mov eax, dword [ebp - 0x2a0]
nop
push eax
push dword [ebp - 0x2a4]
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x40383e
push dword [ebp - 0x298]
mov eax, dword [ebp - 0x318]
xor ecx, ecx
cmp dword [ebp - 0x310], ecx
push dword [ebp - 0x29c]
cmove eax, ecx
lea ecx, [ebp - 0x324]
push dword [ebp - 0x338]
sub edi, eax
push edi
call fcn.0040dc60
mov eax, dword [ebp - 0x2dc]
test eax, eax
jle 0x40381b
sub eax, 1
mov dword [ebp - 0x2dc], eax
je 0x403850
mov eax, dword [ebp - 0x318]
xor ecx, ecx
cmp dword [ebp - 0x310], ecx
cmove eax, ecx
add edi, dword [ebp - 0x298]
add edi, eax
mov eax, dword [ebp - 0x2a0]
sub esi, eax
jmp 0x403848
mov eax, dword [ebp - 0x2a0]
add edi, 2
dec esi
cmp esi, eax
jge 0x4037c0
mov byte [ebp - 4], 0x2d
lea eax, [ebp - 0x4bc]
mov dword [ebp - 0x3d0], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp - 0x4b0]
test ecx, ecx
je 0x40389d
mov eax, dword [ebp - 0x4bc]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x403895
mov ecx, 0x417968
call fcn.0040e650
jmp 0x40389d
lea ecx, [ebp - 0x4bc]
call eax
mov dword [ebp - 0x4b0], 0
mov dword [ebp - 0x4a8], 0
mov dword [ebp - 0x4ac], 0
mov byte [ebp - 4], 0x2d
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x2b
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x30
lea eax, [ebp - 0x4e8]
mov dword [ebp - 0x3d4], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x32
mov ecx, dword [ebp - 0x4dc]
test ecx, ecx
je 0x403924
mov eax, dword [ebp - 0x4e8]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x40391c
mov ecx, 0x417968
call fcn.0040e650
jmp 0x403924
lea ecx, [ebp - 0x4e8]
call eax
mov dword [ebp - 0x4dc], 0
mov dword [ebp - 0x4d4], 0
mov dword [ebp - 0x4d8], 0
mov byte [ebp - 4], 0x30
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 7
mov esi, dword [ebp - 0x394]
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x403979
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x14], 0
mov ecx, dword [ebp - 0x328]
mov edx, dword [ebp - 0x310]
test ecx, ecx
je 0x403993
xor eax, eax
cmp word [ecx], ax
sete al
jmp 0x40399b
xor eax, eax
cmp edx, 2
setle al
test eax, eax
jne 0x4039f7
mov dword [ebp - 0x3b4], 0xc
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x3ac], 1
test ecx, ecx
jne 0x4039cb
test edx, edx
mov ecx, 0x412b70
cmovne ecx, dword [ebp - 0x318]
push 0
push 0x80
push 3
lea eax, [ebp - 0x3b4]
push eax
push 2
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4039f7
mov ecx, dword [ebp - 0x394]
mov dword [ecx + 0x14], eax
mov edi, 1
jmp 0x403a06
test edi, edi
jne 0x403b00
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x3a8]
mov dword [ebp - 0x240], eax
push ecx
push eax
mov dword [ebp - 0x3a8], 0xffd9da60
mov dword [ebp - 0x3a4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x240]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x403aef
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
push 1
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x3d8], 0
push 0
lea eax, [ebp - 0x3f0]
movq qword [ebp - 0x3e0], xmm0
push eax
movups xmmword [ebp - 0x3f0], xmm0
call esi
test eax, eax
je 0x403acf
nop dword [eax]
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x3f0]
push eax
call esi
test eax, eax
jne 0x403aa0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x240]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
jne 0x403a68
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402f90
mov esi, dword [ebp - 0x394]
mov eax, dword [esi + 0x14]
test eax, eax
je 0x403b1b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x14], 0
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
lea ecx, [ebp - 0x308]
mov esi, eax
call fcn.00401a90
mov byte [ebp - 4], 0x33
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x2fc], 0x4124d8
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x2d0]
call fcn.00401a90
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x2c0]
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - method.CWString.virtual_0], vtable.CWString.0
call dword [eax + 0x44]
lea eax, [ebp - 0x2f8]
push eax
lea ecx, [ebp - 0x2c0]
call fcn.00401ea0
mov byte [ebp - 4], 0x36
mov edi, 0x412b70
mov eax, dword [ebp - 0x2c4]
test eax, eax
jne 0x403bd0
cmp dword [ebp - 0x2ac], 0
mov eax, edi
cmovne eax, dword [ebp - 0x2b4]
push eax
push 0x412494
push esi
call fcn.004043e0
add esp, 0xc
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x2d0]
call fcn.00401780
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x308]
call fcn.00401780
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
lea ecx, [ebp - 0x308]
mov esi, eax
call fcn.00401a90
mov byte [ebp - 4], 0x38
mov dword [ebp - method.CWString.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x2fc], 0x4124fc
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x2d0]
call fcn.00401a90
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x2c0]
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - method.CWString.virtual_0], vtable.CWString.0
call dword [eax + 0x44]
lea eax, [ebp - 0x2f8]
push eax
lea ecx, [ebp - 0x2c0]
call fcn.00401ea0
mov byte [ebp - 4], 0x3b
mov eax, dword [ebp - 0x2c4]
test eax, eax
jne 0x403cac
cmp dword [ebp - 0x2ac], eax
cmovne edi, dword [ebp - 0x2b4]
mov eax, edi
push eax
push 0x412494
push esi
call fcn.004043e0
add esp, 0xc
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x2d0]
call fcn.00401780
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x308]
call fcn.00401780
lea ecx, [ebp - 0x308]
call fcn.00408080
lea ecx, [ebp - 0x308]
call fcn.00401780
mov byte [ebp - 4], 5
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x3d
mov ecx, dword [ebp - 0x288]
test ecx, ecx
je 0x403d30
mov eax, dword [ebp - 0x294]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x403d28
mov ecx, 0x417968
call fcn.0040e650
jmp 0x403d30
lea ecx, [ebp - 0x294]
call eax
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x284], 0
mov byte [ebp - 4], 5
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 3
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x3e
mov ecx, dword [ebp - 0x26c]
test ecx, ecx
je 0x403d9d
mov eax, dword [ebp - 0x278]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x403d95
mov ecx, 0x417968
call fcn.0040e650
jmp 0x403d9d
lea ecx, [ebp - 0x278]
call eax
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x268], 0
mov byte [ebp - 4], 3
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 1
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x3f
mov edx, dword [ebp - 0x250]
test edx, edx
je 0x403e0a
mov eax, dword [ebp - 0x25c]
push edx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x403e02
mov ecx, 0x417968
call fcn.0040e650
jmp 0x403e0a
lea ecx, [ebp - 0x25c]
call eax
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x24c], 0
mov byte [ebp - 4], 1
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x334]
call fcn.00401780
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - method.CWString.virtual_0], vtable.CVolRefObject.0
mov dword [ebp - 4], 0x41
mov ecx, dword [ebp - 0x394]
test ecx, ecx
je 0x403e6c
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f190
mov esp, ebp
pop ebp
ret