4FD98830 8BFF MOV EDI,EDI 4FD98832 55 PUSH EBP 4FD98833 8BEC MOV EBP,ESP 4FD98835 6A FF PUSH -1 4FD98837 |. 68 5816E94F PUSH 4FE91658 ; SE handler installation 4FD9883C |. 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] 4FD98842 50 PUSH EAX 4FD98843 64:8925 00000000 MOV DWORD PTR FS:[0],ESP 4FD9884A |. 83EC 0C SUB ESP,0C 4FD9884D 53 PUSH EBX 4FD9884E 56 PUSH ESI 4FD9884F 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8] 4FD98852 57 PUSH EDI 4FD98853 33FF XOR EDI,EDI 4FD98855 3BF7 CMP ESI,EDI 4FD98857 8965 F0 MOV DWORD PTR SS:[EBP-10],ESP 4FD9885A 74 05 JE SHORT 4FD98861 4FD9885C 8D5E 04 LEA EBX,DWORD PTR DS:[ESI+4] 4FD9885F EB 02 JMP SHORT 4FD98863 4FD98861 33DB XOR EBX,EBX 4FD98863 397B 18 CMP DWORD PTR DS:[EBX+18],EDI 4FD98866 895D E8 MOV DWORD PTR SS:[EBP-18],EBX 4FD98869 897D EC MOV DWORD PTR SS:[EBP-14],EDI 4FD9886C 74 07 JE SHORT 4FD98875 4FD9886E 53 PUSH EBX ; /pCriticalSection 4FD9886F FF15 2811D14F CALL DWORD PTR DS:[<&KERNEL32.EnterCriticalSection>] ; \EnterCriticalSection 4FD98875 F646 2C 02 TEST BYTE PTR DS:[ESI+2C],2 4FD98879 897D FC MOV DWORD PTR SS:[EBP-4],EDI 4FD9887C 74 24 JE SHORT 4FD988A2 4FD9887E 397B 18 CMP DWORD PTR DS:[EBX+18],EDI 4FD98881 74 07 JE SHORT 4FD9888A 4FD98883 53 PUSH EBX ; /pCriticalSection 4FD98884 FF15 C010D14F CALL DWORD PTR DS:[<&KERNEL32.LeaveCriticalSection>] ; \LeaveCriticalSection 4FD9888A B8 6C087688 MOV EAX,8876086C 4FD9888F 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C] 4FD98892 64:890D 00000000 MOV DWORD PTR FS:[0],ECX 4FD98899 5F POP EDI 4FD9889A 5E POP ESI 4FD9889B 5B POP EBX 4FD9889C 8BE5 MOV ESP,EBP 4FD9889E 5D POP EBP 4FD9889F C2 1C00 RET 1C 4FD988A2 F646 2C 08 TEST BYTE PTR DS:[ESI+2C],8 4FD988A6 C645 FC 01 MOV BYTE PTR SS:[EBP-4],1 4FD988AA 74 28 JE SHORT 4FD988D4 4FD988AC 8B4D 1C MOV ECX,DWORD PTR SS:[EBP+1C] 4FD988AF 8B55 18 MOV EDX,DWORD PTR SS:[EBP+18] 4FD988B2 8B06 MOV EAX,DWORD PTR DS:[ESI] 4FD988B4 57 PUSH EDI 4FD988B5 8B7D 10 MOV EDI,DWORD PTR SS:[EBP+10] 4FD988B8 51 PUSH ECX 4FD988B9 8B4D 20 MOV ECX,DWORD PTR SS:[EBP+20] 4FD988BC 6A 01 PUSH 1 4FD988BE 52 PUSH EDX 4FD988BF |. 8B55 14 MOV EDX,DWORD PTR SS:[EBP+14] 4FD988C2 51 PUSH ECX 4FD988C3 8D0C17 LEA ECX,DWORD PTR DS:[EDI+EDX] 4FD988C6 8B55 0C MOV EDX,DWORD PTR SS:[EBP+C] 4FD988C9 51 PUSH ECX 4FD988CA |. 52 PUSH EDX 4FD988CB |. 56 PUSH ESI 4FD988CC |. FF90 6C020000 CALL DWORD PTR DS:[EAX+26C] 4FD988D2 |. EB 03 JMP SHORT 4FD988D7 4FD988D4 8B7D 10 MOV EDI,DWORD PTR SS:[EBP+10] 4FD988D7 8B86 0C210000 MOV EAX,DWORD PTR DS:[ESI+210C] 4FD988DD 8978 14 MOV DWORD PTR DS:[EAX+14],EDI 4FD988E0 8B86 A01F0000 MOV EAX,DWORD PTR DS:[ESI+1FA0] 4FD988E6 |. F6C4 02 TEST AH,2 4FD988E9 |. 74 09 JE SHORT 4FD988F4 4FD988EB |. 8B0E MOV ECX,DWORD PTR DS:[ESI] 4FD988ED |. 56 PUSH ESI 4FD988EE |. FF91 68020000 CALL DWORD PTR DS:[ECX+268] 4FD988F4 8B55 20 MOV EDX,DWORD PTR SS:[EBP+20] 4FD988F7 8B45 1C MOV EAX,DWORD PTR SS:[EBP+1C] 4FD988FA 8B4D 18 MOV ECX,DWORD PTR SS:[EBP+18] 4FD988FD 52 PUSH EDX 4FD988FE 8B55 14 MOV EDX,DWORD PTR SS:[EBP+14] 4FD98901 50 PUSH EAX 4FD98902 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C] 4FD98905 51 PUSH ECX 4FD98906 52 PUSH EDX 4FD98907 57 PUSH EDI 4FD98908 50 PUSH EAX 4FD98909 56 PUSH ESI 4FD9890A FF96 28210000 CALL DWORD PTR DS:[ESI+2128] 4FD98910 |. 8B43 18 MOV EAX,DWORD PTR DS:[EBX+18] 4FD98913 |. 83C4 1C ADD ESP,1C 4FD98916 |. 85C0 TEST EAX,EAX 4FD98918 |. 74 07 JE SHORT 4FD98921 4FD9891A |. 53 PUSH EBX ; /pCriticalSection 4FD9891B |. FF15 C010D14F CALL DWORD PTR DS:[<&KERNEL32.LeaveCriticalSection>] ; \LeaveCriticalSection 4FD98921 |> 33C0 XOR EAX,EAX 4FD98923 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C] 4FD98926 64:890D 00000000 MOV DWORD PTR FS:[0],ECX 4FD9892D 5F POP EDI 4FD9892E 5E POP ESI 4FD9892F 5B POP EBX 4FD98930 8BE5 MOV ESP,EBP 4FD98932 5D POP EBP 4FD98933 C2 1C00 RET 1C 4FD98936 B8 3C89D94F MOV EAX,4FD9893C 4FD9893B C3 RET 4FD9893C 8D4D E8 LEA ECX,DWORD PTR SS:[EBP-18] 4FD9893F C745 FC FFFFFFFF MOV DWORD PTR SS:[EBP-4],-1 4FD98946 E8 C5D4F9FF CALL 4FD35E10 4FD9894B 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C] 4FD9894E 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 4FD98951 5F POP EDI 4FD98952 5E POP ESI 4FD98953 64:890D 00000000 MOV DWORD PTR FS:[0],ECX 4FD9895A . 5B POP EBX 4FD9895B . 8BE5 MOV ESP,EBP 4FD9895D . 5D POP EBP 4FD9895E . C2 1C00 RET 1C