Function at 0x4078f0
Capabilities:
Get system information on windows
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c8fe
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x4d506c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 2
push 0x4b32bc
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0x18], reloc.WS2_32.dll_accept
mov dword [ebp - 0xe0], 0xf
mov dword [ebp - 0xe4], 0
mov byte [ebp - 0xf4], 0
call fcn.00406080
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x144]
push 0xf
push 0x4b32c0
mov dword [ebp - 0x130], 0xf
mov dword [ebp - 0x134], 0
mov byte [ebp - 0x144], 0
call fcn.00406080
push ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
push ecx
lea eax, [esi + 0x404]
push eax
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x18]
call fcn.00411ec0
mov edx, dword [ebp - 0x130]
cmp edx, 0x10
jb 0x4079ca
mov ecx, dword [ebp - 0x144]
inc edx
push 1
call fcn.004044e0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xe0]
mov dword [ebp - 0x130], 0xf
mov dword [ebp - 0x134], 0
mov byte [ebp - 0x144], 0
cmp edx, 0x10
jb 0x407a08
mov ecx, dword [ebp - 0xf4]
inc edx
push 1
call fcn.004044e0
add esp, 4
cmp dword [esi + 0x414], 0
jne 0x407d3f
lea ecx, [ebp - 0x15c]
call fcn.00416e80
mov ebx, eax
lea ecx, [ebp - 0x12c]
mov dword [ebp - 4], 2
call fcn.004170b0
mov edi, eax
mov byte [ebp - 4], 3
cmp dword [ebx + 0x14], 0x10
jb 0x407a42
mov ebx, dword [ebx]
cmp dword [edi + 0x14], 0x10
jb 0x407a4a
mov edi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push ebx
push edi
lea eax, [ebp - 0x34]
push str._s_s_d
push eax
call fcn.00419610
add esp, 0x14
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x407a80
mov ecx, dword [ebp - 0x12c]
inc edx
push 1
call fcn.004044e0
add esp, 4
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x148]
cmp edx, 0x10
jb 0x407abb
mov ecx, dword [ebp - 0x15c]
inc edx
push 1
call fcn.004044e0
add esp, 4
cmp dword [ebp - 0x20], 0x10
lea eax, [ebp - 0x34]
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
lea ecx, [ebp - 0xdc]
push eax
mov dword [ebp - 0x148], 0xf
mov dword [ebp - 0x14c], 0
mov byte [ebp - 0x15c], 0
mov byte [ebp - 0x74], 0
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xdc], 0x67452301
mov dword [ebp - 0xd8], 0xefcdab89
mov dword [ebp - 0xd4], 0x98badcfe
mov dword [ebp - 0xd0], 0x10325476
call fcn.00410db0
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0xdc]
call fcn.00411750
mov edi, eax
lea eax, [ebp - 0x34]
cmp eax, edi
je 0x407b7c
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x407b61
mov ecx, dword [ebp - 0x34]
inc edx
push 1
call fcn.004044e0
add esp, 4
push edi
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x34], 0
call fcn.00406390
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0xf8]
cmp edx, 0x10
jb 0x407b9c
mov ecx, dword [ebp - 0x10c]
inc edx
push 1
call fcn.004044e0
add esp, 4
cmp dword [ebp - 0x20], 0x10
lea edx, [ebp - 0x34]
cmovae edx, dword [ebp - 0x34]
cmp byte [edx], 0
jne 0x407bb0
xor ecx, ecx
jmp 0x407bbe
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407bb5
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 0x404]
call fcn.00406080
cmp dword [ebp - 0x20], 0x10
lea edx, [ebp - 0x34]
mov dword [ebp - 0xf8], 0xf
cmovae edx, dword [ebp - 0x34]
mov dword [ebp - 0xfc], 0
mov byte [ebp - 0x10c], 0
cmp byte [edx], 0
jne 0x407bfa
xor ecx, ecx
jmp 0x407c09
mov ecx, edx
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407c00
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x10c]
call fcn.00406080
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xf4]
push 2
push 0x4b32d8
mov dword [ebp - 0xe0], 0xf
mov dword [ebp - 0xe4], 0
mov byte [ebp - 0xf4], 0
call fcn.00406080
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x144]
push 0xf
push str.SoftwareFYBGCC
mov dword [ebp - 0x130], 0xf
mov dword [ebp - 0x134], 0
mov byte [ebp - 0x144], 0
call fcn.00406080
sub esp, 8
lea eax, [ebp - 0x10c]
lea ecx, [ebp - 0x18]
push eax
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.004120b0
mov edx, dword [ebp - 0x130]
cmp edx, 0x10
jb 0x407cb4
mov ecx, dword [ebp - 0x144]
inc edx
push 1
call fcn.004044e0
add esp, 4
mov edx, dword [ebp - 0xe0]
mov dword [ebp - 0x130], 0xf
mov dword [ebp - 0x134], 0
mov byte [ebp - 0x144], 0
cmp edx, 0x10
jb 0x407ceb
mov ecx, dword [ebp - 0xf4]
inc edx
push 1
call fcn.004044e0
add esp, 4
mov edx, dword [ebp - 0xf8]
mov dword [ebp - 0xe0], 0xf
mov dword [ebp - 0xe4], 0
mov byte [ebp - 0xf4], 0
cmp edx, 0x10
jb 0x407d22
mov ecx, dword [ebp - 0x10c]
inc edx
push 1
call fcn.004044e0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x407d3f
mov ecx, dword [ebp - 0x34]
inc edx
push 1
call fcn.004044e0
add esp, 4
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x407d62
lea ecx, [ebp - 0x70]
push ecx
call eax
jmp 0x407d6c
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [ebp - 0x70]
cmp ax, 9
je 0x407d81
cmp ax, 6
mov eax, 0x20
jne 0x407d86
mov eax, 0x40
lea ecx, [ebp - 0x15c]
mov dword [esi + 0x258], eax
call fcn.0041a4f0
mov edx, eax
mov dword [ebp - 4], 0xa
cmp dword [edx + 0x14], 8
jb 0x407da8
mov edx, dword [edx]
xor eax, eax
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x3c], 0
mov word [ebp - 0x4c], ax
cmp word [edx], ax
jne 0x407dc5
xor ecx, ecx
jmp 0x407ddf
mov ecx, edx
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407dd0
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x4c]
call fcn.00405bf0
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x148]
cmp edx, 8
jb 0x407e09
mov ecx, dword [ebp - 0x15c]
inc edx
push 2
call fcn.004044e0
add esp, 4
push 1
push ecx
xor eax, eax
mov dword [ebp - 0x148], 7
push 0x4b32ec
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x14c], 0
mov word [ebp - 0x15c], ax
call fcn.0040da10
push eax
push 0
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00405690
mov edi, eax
lea eax, [ebp - 0x4c]
cmp eax, edi
je 0x407e84
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x407e67
mov ecx, dword [ebp - 0x4c]
inc edx
push 2
call fcn.004044e0
add esp, 4
xor eax, eax
mov dword [ebp - 0x38], 7
push edi
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x3c], 0
mov word [ebp - 0x4c], ax
call fcn.0040ddf0
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x118]
cmp edx, 8
jb 0x407ea4
mov ecx, dword [ebp - 0x12c]
inc edx
push 2
call fcn.004044e0
add esp, 4
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 7
cmp dword [ecx + 0x14], 8
mov dword [ecx + 0x10], 0
jb 0x407ecf
mov eax, dword [ecx]
jmp 0x407ed1
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp - 0x4c]
push edx
push eax
call fcn.00406500
lea ecx, [ebp - 0x12c]
call fcn.00417200
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0xe
cmp dword [edx + 0x14], 0x10
jb 0x407efe
mov edx, dword [edx]
cmp byte [edx], 0
jne 0x407f07
xor ecx, ecx
jmp 0x407f19
mov ecx, edx
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407f10
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 0x28c]
call fcn.00406080
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x407f46
mov ecx, dword [ebp - 0x12c]
inc edx
push 1
call fcn.004044e0
add esp, 4
sub esp, 0x18
mov edi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 7
cmp dword [ecx + 0x14], 8
mov dword [ecx + 0x10], 0
jb 0x407f76
mov eax, dword [ecx]
jmp 0x407f78
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp - 0x4c]
push edx
push eax
call fcn.00406500
mov ecx, edi
call fcn.00417f20
add esp, 0x18
lea ecx, [ebp - 0x12c]
call fcn.00417200
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0xf
cmp dword [edx + 0x14], 0x10
jb 0x407faf
mov edx, dword [edx]
cmp byte [edx], 0
jne 0x407fb8
xor ecx, ecx
jmp 0x407fc9
mov ecx, edx
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407fc0
sub ecx, edi
push ecx
lea ebx, [esi + 0x304]
push edx
mov ecx, ebx
call fcn.00406080
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x407ff8
mov ecx, dword [ebp - 0x12c]
inc edx
push 1
call fcn.004044e0
add esp, 4
lea ecx, [ebp - 0x12c]
call fcn.00418500
mov edx, eax
mov byte [ebp - 4], 0x10
cmp dword [edx + 0x14], 0x10
jb 0x408011
mov edx, dword [edx]
cmp byte [edx], 0
jne 0x40801a
xor ecx, ecx
jmp 0x408029
mov ecx, edx
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408020
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 0x334]
call fcn.00406080
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x408056
mov ecx, dword [ebp - 0x12c]
inc edx
push 1
call fcn.004044e0
add esp, 4
lea ecx, [ebp - 0x12c]
call fcn.00418880
mov edx, eax
mov byte [ebp - 4], 0x11
cmp dword [edx + 0x14], 0x10
jb 0x40806f
mov edx, dword [edx]
cmp byte [edx], 0
jne 0x408078
xor ecx, ecx
jmp 0x408089
mov ecx, edx
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408080
sub ecx, edi
push ecx
lea edi, [esi + 0x2a4]
push edx
mov ecx, edi
call fcn.00406080
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x4080b8
mov ecx, dword [ebp - 0x12c]
inc edx
push 1
call fcn.004044e0
add esp, 4
cmp dword [edi + 0x14], 0x10
jb 0x4080c0
mov edi, dword [edi]
cmp byte [edi], 0
jne 0x4080c9
xor ecx, ecx
jmp 0x4080d9
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4080d0
sub ecx, edx
push ecx
push edi
lea ecx, [esi + 0x31c]
call fcn.00406080
cmp dword [0x4d8928], 0x10
mov edx, 0x4d8914
cmovae edx, dword [0x4d8914]
cmp byte [edx], 0
jne 0x408102
xor ecx, ecx
jmp 0x408110
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408107
sub ecx, edi
push ecx
lea edi, [esi + 0x2ec]
push edx
mov ecx, edi
call fcn.00406080
sub esp, 0x18
mov dword [ebp - 0x18], esp
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 7
cmp dword [ecx + 0x14], 8
mov dword [ecx + 0x10], 0
jb 0x408150
mov eax, dword [ecx]
jmp 0x408152
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp - 0x4c]
push edx
push eax
call fcn.00406500
mov ecx, dword [ebp - 0x18]
call fcn.004181a0
add esp, 0x18
lea ecx, [ebp - 0x12c]
call fcn.00417200
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0x12
cmp dword [edx + 0x14], 0x10
jb 0x40818a
mov edx, dword [edx]
cmp byte [edx], 0
jne 0x408193
xor ecx, ecx
jmp 0x4081aa
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x18], eax
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4081a0
sub ecx, dword [ebp - 0x18]
push ecx
push edx
lea ecx, [esi + 0x34c]
call fcn.00406080
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x4081d7
mov ecx, dword [ebp - 0x12c]
inc edx
push 1
call fcn.004044e0
add esp, 4
cmp dword [ebx + 0x14], 0x10
jb 0x4081df
mov ebx, dword [ebx]
cmp dword [edi + 0x14], 0x10
jb 0x4081e7
mov edi, dword [edi]
push ebx
push 0x4af6ea
push 0x4b32f0
push edi
mov ecx, esi
call fcn.0040c570
lea ecx, [ebp - 0x12c]
call fcn.0041a670
mov edx, eax
mov byte [ebp - 4], 0x13
cmp dword [edx + 0x14], 8
jb 0x408213
mov edx, dword [edx]
cmp word [edx], 0
jne 0x40821d
xor ecx, ecx
jmp 0x408231
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408222
sub ecx, edi
sar ecx, 1
push ecx
lea edi, [esi + 0x25c]
push edx
mov ecx, edi
call fcn.00405bf0
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x118]
cmp edx, 8
jb 0x408260
mov ecx, dword [ebp - 0x12c]
inc edx
push 2
call fcn.004044e0
add esp, 4
push 5
push ecx
push str.Local
mov ecx, edi
call fcn.0040da10
push 7
push str.Roaming
push 5
push eax
mov ecx, edi
call fcn.0040dab0
cmp edi, eax
je 0x408290
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.00406500
push 7
xor eax, eax
mov dword [ebp - 0xf8], 7
push str.maintab
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0xfc], 0
mov word [ebp - 0x10c], ax
call fcn.00405bf0
push 0
push 0x4d5468
push 0x4d5844
push 0
lea eax, [ebp - 0x10c]
mov byte [ebp - 4], 0x14
push eax
mov ecx, esi
call fcn.0042abd0
push eax
call sub.VCRUNTIME140.dll___RTDynamicCast
mov byte [ebp - 4], 0xc
add esp, 0x14
mov edx, dword [ebp - 0xf8]
mov dword [esi + 0x41c], eax
cmp edx, 8
jb 0x40830e
mov ecx, dword [ebp - 0x10c]
inc edx
push 2
call fcn.004044e0
add esp, 4
push 0xe
xor eax, eax
mov dword [ebp - 0xe0], 7
push str.setup_name_pg1
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0xe4], 0
mov word [ebp - 0xf4], ax
call fcn.00405bf0
push 0
push 0x4d5814
push 0x4d5844
push 0
lea eax, [ebp - 0xf4]
mov byte [ebp - 4], 0x15
push eax
mov ecx, esi
call fcn.0042abd0
push eax
call sub.VCRUNTIME140.dll___RTDynamicCast
mov byte [ebp - 4], 0xc
add esp, 0x14
mov edx, dword [ebp - 0xe0]
mov ebx, eax
cmp edx, 8
jb 0x408388
mov ecx, dword [ebp - 0xf4]
inc edx
push 2
call fcn.004044e0
add esp, 4
xor eax, eax
mov dword [ebp - 0xf8], 7
cmp dword [0x4d88b0], 8
mov edx, 0x4d889c
mov dword [ebp - 0xfc], eax
cmovae edx, dword [0x4d889c]
mov word [ebp - 0x10c], ax
mov dword [ebp - 0xe0], 7
mov dword [ebp - 0xe4], 0
mov word [ebp - 0xf4], ax
cmp word [edx], ax
jne 0x4083d8
xor ecx, ecx
jmp 0x4083ef
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4083e0
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x10c]
call fcn.00405bf0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x10c]
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + pe_nt_image_headers32]
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0xf8]
cmp edx, 8
jb 0x408431
mov ecx, dword [ebp - 0x10c]
inc edx
push 2
call fcn.004044e0
add esp, 4
push 0xe
xor eax, eax
mov dword [ebp - 0xe0], 7
push str.setup_name_pg4
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0xe4], 0
mov word [ebp - 0xf4], ax
call fcn.00405bf0
push 0
push 0x4d5814
push 0x4d5844
push 0
lea eax, [ebp - 0xf4]
mov byte [ebp - 4], 0x17
push eax
mov ecx, esi
call fcn.0042abd0
push eax
call sub.VCRUNTIME140.dll___RTDynamicCast
mov byte [ebp - 4], 0xc
add esp, 0x14
mov edx, dword [ebp - 0xe0]
mov edi, eax
cmp edx, 8
jb 0x4084ab
mov ecx, dword [ebp - 0xf4]
inc edx
push 2
call fcn.004044e0
add esp, 4
xor eax, eax
mov dword [ebp - 0xe0], 7
mov dword [ebp - 0xe4], 0
mov word [ebp - 0xf4], ax
test edi, edi
je 0x4084db
mov eax, dword [edi]
mov ecx, edi
push 0x4d889c
call dword [eax + pe_nt_image_headers32]
push 8
xor eax, eax
mov dword [ebp - 0xf8], 7
push str.progress
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0xfc], 0
mov word [ebp - 0x10c], ax
call fcn.00405bf0
push 0
push 0x4d5234
push 0x4d5844
push 0
lea eax, [ebp - 0x10c]
mov byte [ebp - 4], 0x18
push eax
mov ecx, esi
call fcn.0042abd0
push eax
call sub.VCRUNTIME140.dll___RTDynamicCast
mov byte [ebp - 4], 0xc
add esp, 0x14
mov edx, dword [ebp - 0xf8]
mov dword [esi + 0x420], eax
cmp edx, 8
jb 0x408559
mov ecx, dword [ebp - 0x10c]
inc edx
push 2
call fcn.004044e0
add esp, 4
push 0xc
xor eax, eax
mov dword [ebp - 0xf8], 7
push str.progress_msg
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0xfc], 0
mov word [ebp - 0x10c], ax
call fcn.00405bf0
push 0
push 0x4d5814
push 0x4d5844
push 0
lea eax, [ebp - 0x10c]
mov byte [ebp - 4], 0x19
push eax
mov ecx, esi
call fcn.0042abd0
push eax
call sub.VCRUNTIME140.dll___RTDynamicCast
mov byte [ebp - 4], 0xc
add esp, 0x14
mov edx, dword [ebp - 0xf8]
mov dword [esi + 0x424], eax
cmp edx, 8
jb 0x4085d7
mov ecx, dword [ebp - 0x10c]
inc edx
push 2
call fcn.004044e0
add esp, 4
mov ecx, esi
call fcn.00408a30
sub esp, 0x10
mov dword [ebp - 0x138], 0x409140
mov eax, esp
mov dword [ebp - 0x134], 0
movq xmm0, qword [ebp - 0x138]
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x18], esi
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.0040ea40
add esp, 0x10
mov dword [ebp - 0x148], 0
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x114]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x16c]
sub esp, 0xc
push eax
call fcn.0040fa70
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x110]
test ecx, ecx
je 0x408661
or eax, 0xffffffff
lock xadd dword [ecx + 8], eax
jne 0x408661
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x1d
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0x29
push eax
add ecx, 0x234
call fcn.0040f290
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x16c]
push eax
lea ecx, [ecx + 0x14]
call fcn.0040d490
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x148]
test ecx, ecx
je 0x4086b6
mov edx, dword [ecx]
lea eax, [ebp - 0x16c]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
push ecx
mov ecx, esi
call fcn.004287e0
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x4086dd
mov ecx, dword [ebp - 0x4c]
inc edx
push 2
call fcn.004044e0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049abdf
mov esp, ebp
pop ebp
ret