Function at 0x4b1540
Capabilities:
Create thread

Disassembly:
push ebp
lea ebp, [esp - 0x254]
sub esp, 0x254
push 0xffffffffffffffff
push 0x55c4e7
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x5d0074]
xor eax, ebp
mov dword [ebp + 0x250], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp + 0x264]
mov esi, dword [ebp + 0x260]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x4c], eax
call fcn.00413cd0
mov ecx, eax
test ecx, ecx
je 0x4b21ff
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x60], eax
mov dword [ebp - 4], 1
cmp dword [esi + 4], 0
jle 0x4b15d3
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
call fcn.004b1440
mov esi, eax
test esi, esi
je 0x4b15d3
or ebx, 0xffffffff
jmp 0x4b21b9
call fcn.00413cd0
mov ecx, eax
test ecx, ecx
je 0x4b2209
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x3c], esi
mov byte [ebp - 4], 4
call fcn.00413cd0
mov ecx, eax
test ecx, ecx
je 0x4b2213
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x24], edi
mov byte [ebp - 4], 6
cmp byte [ebp + 0x268], 0
jne 0x4b178e
lea edx, [ebx + 0x60]
lea ecx, [ebp - 0x40]
call fcn.00493c30
mov byte [ebp - 4], 7
lea ecx, [esi - 0x10]
mov edx, dword [eax]
mov dword [ebp - 0x48], ecx
lea eax, [edx - 0x10]
mov dword [ebp - 0x10], eax
cmp eax, ecx
je 0x4b1688
cmp dword [ecx + 0xc], 0
lea esi, [ecx + 0xc]
jl 0x4b1679
mov eax, dword [eax]
cmp eax, dword [ecx]
jne 0x4b1679
mov ecx, dword [ebp - 0x10]
call fcn.0040be70
mov dword [ebp - 0x10], eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x4b1671
mov esi, dword [ebp - 0x48]
push esi
mov ecx, dword [esi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x10]
lea esi, [eax + 0x10]
mov dword [ebp - 0x3c], esi
jmp 0x4b1688
push dword [edx - 0xc]
lea ecx, [ebp - 0x3c]
push edx
call fcn.004143c0
mov esi, dword [ebp - 0x3c]
mov byte [ebp - 4], 6
or eax, 0xffffffff
mov edx, dword [ebp - 0x40]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b16a7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi - 0xc]
test eax, eax
jle 0x4b16d2
lea ecx, [eax - 1]
test ecx, ecx
js 0x4b221d
cmp ecx, eax
jg 0x4b221d
cmp word [esi + ecx*2], 0x5c
je 0x4b16d2
push 0x5c
lea ecx, [ebp - 0x3c]
call fcn.00492e20
mov edx, dword [ebx + 0x68]
lea esi, [edi - 0x10]
lea ecx, [edx - 0x10]
cmp ecx, esi
je 0x4b1724
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x4b1715
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x4b1715
call fcn.0040be70
mov dword [ebp - 0x10], eax
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x4b170d
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x10]
mov dword [ebp - 0x24], edi
jmp 0x4b1724
push dword [edx - 0xc]
lea ecx, [ebp - 0x24]
push edx
call fcn.004143c0
mov edi, dword [ebp - 0x24]
mov eax, dword [edi - 0xc]
test eax, eax
jle 0x4b174f
lea ecx, [eax - 1]
test ecx, ecx
js 0x4b221d
cmp ecx, eax
jg 0x4b221d
cmp word [edi + ecx*2], 0x5c
je 0x4b174f
push 0x5c
lea ecx, [ebp - 0x24]
call fcn.00492e20
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.004b2370
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x24]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00418250
mov byte [ebp - 4], 6
or eax, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b178b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x74]
mov dword [ebp - 0x54], eax
call fcn.00413cd0
mov ecx, eax
test ecx, ecx
je 0x4b2227
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x74], eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0x57dd44
mov dword [ebp - 0x68], 0
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x14], 0
cmp dword [ecx + 4], 0
jle 0x4b1ea7
push 0x260
call fcn.00520c21
mov esi, eax
mov dword [ebp - 0x8c], esi
mov byte [ebp - 4], 0x12
push 0x260
push 0
push esi
call fcn.00522fa0
add esp, 0x10
mov dword [esi], 0xffffffff
lea ecx, [esi + 0x10]
mov byte [esi + 8], 1
call fcn.004d0200
mov byte [ebp - 4], 0x13
lea ebx, [esi + 0x258]
mov dword [esi + 0x250], 0
mov dword [esi + 0x254], 0
mov dword [ebp - 0x58], ebx
call fcn.00413cd0
mov ecx, eax
test ecx, ecx
je 0x4b21ff
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
cmp ecx, ebx
jne 0x4b18ec
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x84]
cmp eax, edx
jb 0x4b18b2
lea eax, [edx + ebx*4]
lea edx, [ebp - 0x84]
cmp edx, eax
mov edx, dword [ebp - 0x34]
jb 0x4b21ff
test ebx, ebx
jne 0x4b18bd
mov ebx, 1
jmp 0x4b18cc
lea ebx, [ecx + ecx]
test ebx, ebx
js 0x4b190d
cmp ebx, 0x1fffffff
ja 0x4b190d
push 4
push ebx
push edx
call fcn.00528b26
add esp, 0xc
test eax, eax
je 0x4b18e7
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ebx
jmp 0x4b18ef
mov ecx, dword [ebp - 0x30]
jmp 0x4b190a
mov eax, dword [ebp - 0x34]
lea eax, [eax + ecx*4]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0x16
test eax, eax
je 0x4b18ff
mov dword [eax], esi
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x30]
inc ecx
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x4b2231
cmp eax, ecx
jge 0x4b2231
lea ebx, [eax*4]
mov eax, dword [ebx + edx]
mov dword [ebp - 0x28], eax
lea ecx, [eax + 0x10]
mov dword [ebp - 0x48], ecx
mov cl, byte [ebp + 0x268]
mov byte [eax + 8], cl
lea eax, [ebp - 0x60]
push eax
call fcn.004d03a0
test al, al
je 0x4b1f57
call fcn.00413cd0
mov ecx, eax
test ecx, ecx
je 0x4b21ff
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 0x1b
cmp byte [ebp + 0x268], 0
je 0x4b1b75
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [eax + 4]
jge 0x4b2231
mov eax, dword [eax]
mov edx, dword [ebp - 0x28]
mov eax, dword [eax + ebx]
mov dword [edx], eax
mov eax, dword [ebp - 0x38]
cmp ecx, dword [eax + 4]
jge 0x4b2231
mov eax, dword [eax]
mov eax, dword [eax + ebx]
test eax, eax
js 0x4b2231
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 0x7c]
cmp eax, ebx
jge 0x4b2231
mov ecx, eax
shl ecx, 5
add ecx, dword [edx + 0x78]
mov dword [ebp - 0x20], ecx
test eax, eax
js 0x4b2231
cmp eax, ebx
jge 0x4b2231
mov ebx, dword [ebp - 0x28]
shl eax, 5
add eax, dword [edx + 0x78]
mov eax, dword [eax + 8]
shr eax, 1
and eax, 0xffffff01
mov dword [ebp - 0x64], eax
mov eax, dword [ecx]
mov dword [ebx + 4], eax
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x44], ebx
lea eax, [ebx - 4]
cmp eax, 6
ja case.0x4b1a03.6
movzx eax, byte [eax + 0x4b2248]
jmp dword [eax*4 + 0x4b2240]
lea eax, [edx + 0x70]
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jne 0x4b1a1e
lea eax, [edx + 0x68]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
lea eax, [ecx + 0x18]
push eax
lea ecx, [ebp - 0x50]
call fcn.00490c60
add esp, 4
mov byte [ebp - 4], 0x1c
cmp ebx, 9
je 0x4b1a3e
cmp ebx, 0xa
jne 0x4b1aa3
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x50]
add edx, 0x258
mov dword [ebp - 0x10], edx
mov ebx, dword [edx]
lea ecx, [eax - 0x10]
sub ebx, 0x10
cmp ecx, ebx
je 0x4b1aa3
cmp dword [ebx + 0xc], 0
jl 0x4b1a98
mov edx, dword [ecx]
cmp edx, dword [ebx]
jne 0x4b1a95
call fcn.0040be70
mov dword [ebp - 0x10], eax
or ecx, 0xffffffff
lea eax, [ebx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4b1a84
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [ecx + 0x258], eax
jmp 0x4b1aa3
mov edx, dword [ebp - 0x10]
push dword [eax - 0xc]
mov ecx, edx
push eax
call fcn.004143c0
lea edx, [ebp - 0x50]
lea ecx, [ebp - 0x88]
call fcn.00493c30
mov byte [ebp - 4], 0x1d
lea ebx, [esi - 0x10]
mov edx, dword [eax]
lea ecx, [edx - 0x10]
cmp ecx, ebx
je 0x4b1b06
cmp dword [ebx + 0xc], 0
lea esi, [ebx + 0xc]
jl 0x4b1af7
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x4b1af7
call fcn.0040be70
mov dword [ebp - 0x10], eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x4b1aef
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x10]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
jmp 0x4b1b06
push dword [edx - 0xc]
lea ecx, [ebp - 0x18]
push edx
call fcn.004143c0
mov esi, dword [ebp - 0x18]
mov byte [ebp - 4], 0x1c
or eax, 0xffffffff
mov edx, dword [ebp - 0x88]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b1b28
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x1c]
xor edx, edx
cmp byte [ebp - 0x64], dl
cmovne edx, ebx
lea eax, [ebx + 0xfc]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [edx + 4]
neg edx
lea ecx, [ebx + 0x60]
sbb edx, edx
and edx, eax
mov eax, dword [ebp - 0x20]
push edx
push 0
push dword [eax + 0xc]
push 0
push dword [eax + 0x10]
push ecx
mov ecx, dword [ebp - 0x48]
call fcn.004d0440
test eax, eax
jne 0x4b1f01
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x50]
jmp 0x4b1e0d
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ecx + 4]
jge 0x4b2231
mov eax, dword [ecx]
mov eax, dword [eax + ebx]
test eax, eax
js 0x4b2231
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x9c]
cmp eax, edx
jge 0x4b2231
mov ebx, dword [ecx + 0x98]
mov ebx, dword [ebx + eax*8 + 4]
mov dword [ebp - 0x44], ebx
cmp ebx, 9
je 0x4b1bbd
cmp ebx, 0xa
jne 0x4b1c95
test eax, eax
js 0x4b2231
cmp eax, edx
jge 0x4b2231
mov edx, dword [ecx + 0x98]
add ebx, 0xfffffffc
lea eax, [edx + eax*8]
mov dword [ebp - 0x20], eax
cmp ebx, 6
ja case.0x4b1be8.6
movzx eax, byte [ebx + 0x4b2258]
jmp dword [eax*4 + 0x4b2250]
mov eax, dword [ecx + 0x70]
lea edx, [ecx + 0x70]
cmp dword [eax - 0xc], 0
jne 0x4b1bfe
lea edx, [ecx + 0x68]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x54]
call fcn.00490c60
add esp, 4
mov byte [ebp - 4], 0x25
mov ebx, dword [ebp - 0x28]
mov edx, dword [eax]
mov ebx, dword [ebx + 0x258]
lea ecx, [edx - 0x10]
sub ebx, 0x10
cmp ecx, ebx
je 0x4b1c73
cmp dword [ebx + 0xc], 0
jl 0x4b1c61
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x4b1c61
call fcn.0040be70
mov dword [ebp - 0x20], eax
lea edx, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b1c53
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
add eax, 0x10
mov dword [edx + 0x258], eax
jmp 0x4b1c73
mov ecx, dword [ebp - 0x28]
push dword [edx - 0xc]
push edx
lea ecx, [ecx + 0x258]
call fcn.004143c0
mov byte [ebp - 4], 0x1b
or eax, 0xffffffff
mov edx, dword [ebp - 0x54]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b1c92
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
cmp eax, dword [edx + 4]
jge 0x4b2231
mov ebx, dword [ebp - 0x14]
mov eax, dword [edx]
lea edx, [ebx*4]
mov ebx, dword [ebp - 0x44]
mov edx, dword [eax + edx]
test edx, edx
js 0x4b2231
cmp edx, dword [ecx + 0x9c]
jge 0x4b2231
mov eax, dword [ecx + 0x98]
lea ecx, [ebp - 0x40]
lea eax, [eax + edx*8]
push eax
lea edx, [ebp - 0x3c]
call fcn.00490c60
mov byte [ebp - 4], 0x27
lea eax, [ebp]
push 0x250
push 0
push eax
call fcn.00522fa0
add esp, 0x10
lea eax, [ebp]
push eax
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x94], 0x589e2c
mov dword [ebp - 0x90], eax
mov byte [ebp - 4], 0x28
xor ecx, ecx
add ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x1c]
adc edx, 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x64], edx
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x94], 0x589e2c
test eax, eax
je 0x4b1d4b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x90], 0
cmp ebx, 6
je 0x4b1d84
cmp ebx, 7
je 0x4b1d84
add ebx, 0xfffffffc
cmp ebx, 6
ja case.0x4b1d64.6
movzx eax, byte [ebx + 0x4b2268]
jmp dword [eax*4 + 0x4b2260]
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x70]
lea ecx, [edx + 0x70]
cmp dword [eax - 0xc], 0
je 0x4b1d7f
jmp 0x4b1d87
mov edx, dword [ebp - 0x1c]
lea ecx, [edx + 0x68]
jmp 0x4b1d87
lea ecx, [ebp - 0x24]
mov edx, dword [ecx]
lea ebx, [esi - 0x10]
lea ecx, [edx - 0x10]
cmp ecx, ebx
je 0x4b1dd8
cmp dword [ebx + 0xc], 0
lea esi, [ebx + 0xc]
jl 0x4b1dc9
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x4b1dc9
call fcn.0040be70
mov dword [ebp - 0x20], eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x4b1dc1
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x20]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
jmp 0x4b1dd8
push dword [edx - 0xc]
lea ecx, [ebp - 0x18]
push edx
call fcn.004143c0
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x48]
lea eax, [ebx + 0xfc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp - 0x64]
lea eax, [ebp - 0x40]
push dword [ebp - 0x10]
push 0
push 0
push eax
call fcn.004d0440
test eax, eax
jne 0x4b1f0a
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x40]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b1e25
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebx + 0xb0]
mov dl, 1
push eax
lea ecx, [ebp - 0x18]
call fcn.00494c60
add esp, 4
cmp byte [ebx + 0x94], 0
je 0x4b1e54
cmp dword [ebp - 0x44], 6
jne 0x4b1e54
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x80]
call fcn.0048e320
mov eax, dword [ebp - 0x4c]
cmp dword [eax], 0
je 0x4b1e75
push dword [ebp - 0x48]
mov eax, dword [0x5d63ec]
call eax
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x250], eax
mov dword [ecx + 0x254], edx
mov byte [ebp - 4], 0x11
or eax, 0xffffffff
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b1e94
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, dword [ecx + 4]
jl 0x4b1811
mov eax, dword [ebp + 0x25c]
mov dword [ebp - 0xac], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0x9c], 0x57dd44
mov dword [ebp - 0x98], 0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0xb0]
mov ebx, dword [ebp - 0x4c]
push ebx
call fcn.004d0520
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4b1f69
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4b205b
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x50]
jmp 0x4b1f11
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x40]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b1f29
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x11
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4b1f45
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], 0xe
jmp 0x4b2080
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], 0xb
jmp 0x4b2080
cmp dword [ebp - 0x7c], 0
mov ebx, dword [ebx + 8]
mov dword [ebp - 0x70], ebx
jne 0x4b1f87
mov dword [ebp - 0x14], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4b205b
test ebx, ebx
je 0x4b1fb8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x68]
mov esi, eax
cmp esi, ecx
je 0x4b1fb0
mov edx, dword [ebp - 0x6c]
lea ecx, [ebp - 0x6c]
call dword [edx + 4]
mov ecx, esi
mov dword [ebp - 0x68], ecx
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0x20]
lea eax, [ebp - 0x4c]
push eax
push 0
lea eax, [ebp - 0x80]
push eax
push 0x4cf270
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [ebp - 0x5c], 0x57dd44
mov dword [ebp - 0x58], esi
mov byte [ebp - 4], 0x36
test ebx, ebx
je 0x4b1fec
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 4]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x4b202f
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0x31
mov dword [ebp - 0x5c], 0x57dd44
test esi, esi
je 0x4b1f7c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov dword [ebp - 0x58], 0
jmp 0x4b205b
mov byte [ebp - 4], 0x31
mov dword [ebp - 0x5c], 0x57dd44
test esi, esi
je 0x4b2050
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov dword [ebp - 0x58], 0
jmp 0x4b2056
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x9c], 0x57dd44
test eax, eax
je 0x4b2080
push eax
call esi
mov dword [ebp - 0x98], 0
mov byte [ebp - 4], 0x39
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6c], 0x57dd44
test eax, eax
je 0x4b209c
push eax
call esi
mov dword [ebp - 0x68], 0
mov byte [ebp - 4], 0x38
lea eax, [ebp - 0x74]
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 0x38
or eax, 0xffffffff
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b20c5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x80]
call fcn.0047e6b0
mov byte [ebp - 4], 0x3c
xor esi, esi
mov ecx, dword [ebp - 0x30]
mov eax, ecx
mov dword [ebp - 0x54], eax
test eax, eax
jle 0x4b2151
test esi, esi
js 0x4b2231
cmp esi, ecx
jge 0x4b2231
mov eax, dword [ebp - 0x34]
mov ebx, dword [eax + esi*4]
mov dword [ebp - 0x58], ebx
test ebx, ebx
je 0x4b214b
mov byte [ebp - 4], 0x3d
lea eax, [ebx + 0x258]
mov dword [ebp - 0x8c], eax
mov byte [ebp - 4], 0x3d
mov edx, dword [eax]
or eax, 0xffffffff
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b212e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x3c
lea ecx, [ebx + 0x10]
call fcn.004d02c0
push 0x260
push ebx
call fcn.00520c13
mov ecx, dword [ebp - 0x30]
add esp, 8
inc esi
cmp esi, dword [ebp - 0x54]
jl 0x4b20e3
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x4b216c
push eax
call fcn.005260e4
add esp, 4
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 4
or ebx, 0xffffffff
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4b2198
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, ebx
mov edx, dword [ebp - 0x3c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b21b6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x60]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4b21d8
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x250]
xor ecx, ebp
call fcn.00520c02
lea esp, [ebp + 0x254]
pop ebp
ret 0x10
push 0x80004005
call fcn.004143a0
push 0x80004005
call fcn.004143a0
push 0x80004005
call fcn.004143a0
push 0x80070057
call fcn.004143a0
push 0x80004005
call fcn.004143a0
push 1
push 0xc000008c
call fcn.0040f790
nop dword [eax]
or bl, byte [edx]
dec ebx
add byte [eax], bl
sbb cl, byte [ebx]
add byte [eax], al
add dword [ecx], eax
add dword [eax], eax
add byte [eax + case.0x4b1be8.4], dl
sti
sbb ecx, dword [ebx]
add byte [eax], al
add dword [ecx], eax
add dword [eax], eax
add byte [eax + case.0x4b1d64.4], dl
jl 4924035
dec ebx
add byte [eax], al
add byte [ecx], al
add dword [ecx], eax
add byte [eax], al
int3
or byte [esi - 0x5f], dl
je 0x4b2288
pop ebp
add byte [ebx], dh
lds edx, [eax - 0x73]
inc ebp
hlt