Function at 0x438440
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55e79f
mov eax, dword fs:[0]
push eax
sub esp, 0x72c
mov eax, dword [0x5b4450]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0
lea eax, [ebp - 0x6cc]
mov ebx, ecx
push str.CUNINSTALLERDlg::DeleteThread
push eax
mov dword [ebp - 0x63c], ebx
call fcn.0040ac70
add esp, 0xc
mov dword [ebp - 4], 0
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4384b0
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x6c4], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x6bc], 1
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4384ea
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x664], eax
mov byte [ebp - 4], 2
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x43851a
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x6c0], eax
mov byte [ebp - 4], 3
call fcn.00442c4d
mov esi, dword [eax + 4]
xor edi, edi
mov dword [ebp - 0x650], esi
mov dword [ebp - 0x68c], edi
call fcn.0040bea0
push edi
xor ecx, ecx
mov edx, ebx
mov dword [ebp - 0x67c], eax
call fcn.00435410
mov dword [esi + 0x17c], edi
call fcn.00434300
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 2
mov dword [esi + 0x19c], eax
call fcn.00442c4d
mov ecx, dword [eax + 4]
call fcn.004499ce
push edi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esi + 0x870], 1
mov ecx, dword [ebx + 0xb4]
push 0x1004
push ecx
call edi
mov edx, dword [ebx + 0xb4]
push 0
push 0
push 0x1032
push edx
mov dword [ebp - 0x66c], eax
call edi
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x66c]
xor ecx, ecx
mov edx, 4
mul edx
seto cl
mov dword [ebp - 0x6a0], 1
mov byte [ebp - 4], 5
neg ecx
or ecx, eax
push ecx
call fcn.004401c2
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x66c]
add esp, 4
mov dword [ebp - 4], 4
test eax, eax
jle 0x4395f3
xor esi, esi
test eax, eax
je 0x438642
nop
mov eax, dword [ebx + 0xb4]
push 2
push esi
push 0x102c
push eax
call edi
mov edx, dword [ebp - 0x668]
xor ecx, ecx
cmp eax, 2
sete cl
inc esi
mov dword [edx + esi*4 - 4], ecx
cmp esi, dword [ebp - 0x66c]
jb 0x438610
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0x678], 0
test eax, eax
je 0x4395d7
jmp 0x438666
mov ebx, dword [ebp - 0x63c]
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4384a6
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x654], eax
mov ecx, 0x58a8c8
mov byte [ebp - 4], 9
test ecx, 0xffff0000
jne 0x4386bb
mov edx, ecx
movzx esi, dx
push esi
call fcn.00440235
test eax, eax
je 0x4386cd
push esi
push eax
lea ecx, [ebp - 0x654]
call fcn.00401350
jmp 0x4386cd
push 0
push 0x58a8c8
lea ecx, [ebp - 0x654]
call fcn.004016b0
mov ecx, dword [ebp - 0x678]
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x668]
cmp dword [eax + ecx*4], 1
jne 0x4393be
push 2
mov edx, ecx
push edx
lea eax, [ebp - 0x684]
lea edi, [ebx + 0x94]
push eax
mov ecx, edi
call fcn.0044a820
mov byte [ebp - 4], 0xb
mov ecx, dword [eax]
mov esi, dword [ebp - 0x664]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x43876b
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
jl 0x43875b
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x43875b
push eax
call fcn.004017c0
mov dword [ebp - 0x648], eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x43874a
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [ebp - 0x648]
add ecx, 0x10
mov dword [ebp - 0x664], ecx
jmp 0x43876b
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x664]
call fcn.004016b0
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x684]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x438791
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x678]
push 1
push ecx
lea edx, [ebp - 0x658]
push edx
mov ecx, edi
call fcn.0044a820
mov byte [ebp - 4], 0xc
mov ecx, dword [eax]
mov esi, dword [ebp - 0x654]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x438813
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
jl 0x438803
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x438803
push eax
call fcn.004017c0
mov dword [ebp - 0x648], eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x4387f2
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [ebp - 0x648]
add ecx, 0x10
mov dword [ebp - 0x654], ecx
jmp 0x438813
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x654]
call fcn.004016b0
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x658]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x438839
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x664]
mov edx, dword [esi - 0xc]
test edx, edx
js 0x439402
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x43886d
push edx
lea ecx, [ebp - 0x664]
call fcn.00401760
mov esi, dword [ebp - 0x664]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.005343a3
add esp, 8
test eax, eax
js 0x439402
cmp eax, dword [esi - 8]
jg 0x439402
mov ecx, dword [ebp - 0x664]
mov dword [ecx - 0xc], eax
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 0x678]
push eax
mov ecx, edi
call fcn.00449e67
mov ebx, eax
mov ecx, dword [ebx + 4]
push ecx
lea ecx, [ebp - 0x644]
mov dword [ebp - 0x648], ebx
call fcn.00401210
mov byte [ebp - 4], 0xd
dec dword [ebp - 0x634]
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4384a6
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x65c], eax
mov byte [ebp - 4], 0xe
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4384a6
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x670], eax
mov byte [ebp - 4], 0xf
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4384a6
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x64c], eax
push 3
mov byte [ebp - 4], 0x10
call fcn.00440235
test eax, eax
je 0x438960
push 3
push eax
lea ecx, [ebp - 0x670]
call fcn.00401350
push 0x410
lea ecx, [ebp - 0x428]
push 0
push ecx
call fcn.005373f0
mov ecx, dword [ebx + 4]
add esp, 0xc
push 0x208
lea edx, [ebp - 0x428]
push edx
push 4
call fcn.00416630
add esp, 0xc
cmp eax, 1
jne 0x4389d3
push 0x3d
call fcn.00440235
test eax, eax
je 0x4389ad
push 0x3d
push eax
lea ecx, [ebp - 0x64c]
call fcn.00401350
mov eax, dword [ebx + 8]
mov edx, dword [ebp - 0x64c]
push eax
lea ecx, [ebp - 0x428]
push ecx
push edx
lea eax, [ebp - 0x65c]
push eax
call fcn.00405ba0
add esp, 0x10
jmp 0x438a60
push 0x208
lea ecx, [ebp - 0x428]
push ecx
mov ecx, dword [ebx + 4]
push 3
call fcn.00416630
add esp, 0xc
cmp eax, 1
jne 0x438a2d
push 0xd
call fcn.00440235
test eax, eax
je 0x438a0a
push 0xd
push eax
lea ecx, [ebp - 0x64c]
call fcn.00401350
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 0x64c]
lea edx, [ebp - 0x428]
push edx
push eax
push ecx
lea edx, [ebp - 0x65c]
push edx
call fcn.00405ba0
add esp, 0x10
jmp 0x438a60
push 0xc
call fcn.00440235
test eax, eax
je 0x438a46
push 0xc
push eax
lea ecx, [ebp - 0x64c]
call fcn.00401350
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 0x64c]
push eax
push ecx
lea edx, [ebp - 0x65c]
push edx
call fcn.00405ba0
add esp, 0xc
push 0
lea eax, [ebp - 0x6d4]
push str.CUNINSTALLERDlg::beSilent
push eax
call fcn.0040ac70
add esp, 0xc
mov byte [ebp - 4], 0x11
call fcn.00442c4d
mov esi, dword [eax + 4]
mov ecx, dword [esi + 0x140]
mov eax, dword [ecx + 0x28]
push eax
push str.return___08x
lea edx, [ebp - 0x6d4]
push 2
push edx
call fcn.0040aed0
mov eax, dword [esi + 0x140]
mov esi, dword [eax + 0x28]
add esp, 0x10
lea ecx, [ebp - 0x6d4]
mov byte [ebp - 4], 0x10
call fcn.0040ae50
test esi, esi
jne 0x438afb
mov edi, dword [ebp - 0x63c]
mov ecx, dword [ebp - 0x670]
mov edx, dword [ebp - 0x65c]
push esi
push 0x34
push edi
call fcn.004344a0
mov ecx, dword [edi + 0x20]
push ecx
mov esi, eax
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp esi, 7
jne 0x438afb
movzx edx, word [ebx + 2]
shl edx, 0x10
or edx, 1
mov dword [ebx], edx
jmp 0x439326
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4384a6
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x680], edi
mov ecx, dword [ebp - 0x650]
mov byte [ebp - 4], 0x12
mov ecx, dword [ecx + 0xf0]
lea eax, [ecx - 0x10]
lea esi, [edi - 0x10]
cmp eax, esi
je 0x438b92
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x438b7c
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x438b7c
push eax
call fcn.004017c0
mov ebx, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x438b6b
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [ebp - 0x680], ebx
mov ebx, dword [ebp - 0x648]
jmp 0x438b8c
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x680]
call fcn.004016b0
mov edi, dword [ebp - 0x680]
mov eax, dword [edi - 0xc]
cmp eax, 1
jne 0x438be9
test eax, eax
js 0x439402
cmp word [edi], 0x31
jne 0x438bc4
mov ecx, dword [ebp - 0x63c]
mov edx, dword [ebx + 4]
mov ecx, dword [ecx + 0x20]
call fcn.004193b0
mov dword [ebp - 0x640], eax
jmp 0x438c76
cmp eax, 1
jne 0x438be9
test eax, eax
js 0x439402
cmp word [edi], 0x30
je 0x438c02
cmp eax, eax
jne 0x438be9
test eax, eax
js 0x439402
cmp word [edi], 0x32
je 0x438c02
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x43931a
mov ecx, dword [ebx + 4]
push 2
push 0x58d4d0
push ecx
call fcn.00534305
add esp, 0xc
test eax, eax
jne 0x438c3c
mov edx, 0x1000
cmp word [ebx + 2], dx
jne 0x438c3c
mov edx, dword [ebp - 0x664]
mov ecx, dword [ebx + 4]
call fcn.004152b0
mov ecx, eax
mov dword [ebp - 0x640], ecx
jmp 0x438c55
mov eax, dword [ebp - 0x63c]
mov edx, dword [ebx + 4]
mov ecx, dword [eax + 0x20]
call fcn.00413d30
mov ecx, eax
mov dword [ebp - 0x640], eax
mov eax, dword [edi - 0xc]
cmp eax, 1
jne 0x438c76
test eax, eax
js 0x439402
cmp word [edi], 0x32
jne 0x438c76
cmp ecx, 6
jne 0x438c76
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x67c], 0xa
jne 0x438efe
mov ecx, dword [ebp - 0x650]
cmp dword [ecx + 0x170], 0
jg 0x438cd8
mov ecx, 0x58e1bc
mov eax, edi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x438cc6
test dx, dx
je 0x438cc2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x438cc6
add eax, 4
add ecx, 4
test dx, dx
jne 0x438ca0
xor eax, eax
jmp 0x438ccb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x438efe
push 0
lea edx, [ebp - 0x6dc]
push str.CUNINSTALLERDlg::beSilent
push edx
call fcn.0040ac70
add esp, 0xc
mov byte [ebp - 4], 0x13
call fcn.00442c4d
mov esi, dword [eax + 4]
mov eax, dword [esi + 0x140]
mov eax, dword [eax + 0x28]
push eax
push str.return___08x
lea ecx, [ebp - 0x6dc]
push 2
push ecx
call fcn.0040aed0
mov edx, dword [esi + 0x140]
mov esi, dword [edx + 0x28]
add esp, 0x10
lea ecx, [ebp - 0x6dc]
mov byte [ebp - 4], 0x12
call fcn.0040ae50
test esi, esi
mov esi, dword [ebp - 0x650]
je 0x438d49
cmp dword [esi + 0x194], 1
jne 0x438efe
cmp dword [esi + 0x19c], 0
je 0x438d84
mov eax, dword [ebp - 0x678]
mov ecx, dword [ebp - 0x66c]
inc eax
cmp eax, ecx
jae 0x438d7a
mov edx, dword [ebp - 0x668]
cmp dword [edx + eax*4], 1
je 0x438d76
inc eax
cmp eax, ecx
jb 0x438d63
jmp 0x438d7a
cmp eax, ecx
jb 0x438d84
mov dword [esi + 0x19c], 1
lea ecx, [ebp - 0x654]
call fcn.0041ee60
test eax, eax
jne 0x438efe
cmp dword [esi + 0x19c], eax
je 0x438eb4
push 0x58a8c8
lea ecx, [ebp - 0x6a8]
call fcn.00401210
push 0x58a8c8
lea ecx, [ebp - 0x6b0]
mov byte [ebp - 4], 0x14
call fcn.00401210
push 3
mov byte [ebp - 4], 0x15
call fcn.00440235
test eax, eax
je 0x438de4
push 3
push eax
lea ecx, [ebp - 0x6b0]
call fcn.00401350
mov ecx, 0x58f9f8
mov eax, edi
jmp 0x438df0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x438e16
test dx, dx
je 0x438e12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x438e16
add eax, 4
add ecx, 4
test dx, dx
jne 0x438df0
xor eax, eax
jmp 0x438e1b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x438e33
push 0x56
call fcn.00440235
test eax, eax
je 0x438e4c
push 0x56
jmp 0x438e40
push 0x57
call fcn.00440235
test eax, eax
je 0x438e4c
push 0x57
push eax
lea ecx, [ebp - 0x6a8]
call fcn.00401350
mov eax, dword [ebp - 0x63c]
mov ecx, dword [ebp - 0x6b0]
mov edx, dword [ebp - 0x6a8]
push 0
push 0x30
push eax
call fcn.004344a0
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x6b0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x438e8e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x6a8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x438eb4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, 0x58f9f8
mov eax, edi
jmp 0x438ec0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x438ee6
test dx, dx
je 0x438ee2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x438ee6
add eax, 4
add ecx, 4
test dx, dx
jne 0x438ec0
xor eax, eax
jmp 0x438eeb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x438efe
mov dword [ebp - 0x68c], 1
mov eax, dword [ebp - 0x640]
test eax, eax
jne 0x439069
movzx ecx, word [ebx + 2]
push eax
shl ecx, 0x10
lea edx, [ebp - 0x6b8]
or ecx, 0x10
push str.CUNINSTALLERDlg::beSilent
push edx
mov dword [ebx], ecx
call fcn.0040ac70
add esp, 0xc
mov byte [ebp - 4], 0x16
call fcn.00442c4d
mov esi, dword [eax + 4]
mov eax, dword [esi + 0x140]
mov eax, dword [eax + 0x28]
push eax
push str.return___08x
lea ecx, [ebp - 0x6b8]
push 2
push ecx
call fcn.0040aed0
mov edx, dword [esi + 0x140]
mov esi, dword [edx + 0x28]
add esp, 0x10
lea ecx, [ebp - 0x6b8]
mov byte [ebp - 4], 0x12
call fcn.0040ae50
test esi, esi
je 0x439300
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4384a6
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x660], eax
mov byte [ebp - 4], 0x17
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4384a6
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x640], esi
push 0x36
mov byte [ebp - 4], 0x18
call fcn.00440235
test eax, eax
je 0x438fec
push 0x36
push eax
lea ecx, [ebp - 0x640]
call fcn.00401350
mov esi, dword [ebp - 0x640]
mov ecx, dword [ebp - 0x648]
mov edx, dword [ecx + 4]
push edx
lea eax, [ebp - 0x660]
push esi
push eax
call fcn.00405ba0
mov ecx, dword [ebp - 0x63c]
mov edi, dword [ebp - 0x660]
add esp, 0xc
push 0
push 0
push ecx
xor ecx, ecx
mov edx, edi
call fcn.004344a0
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0x17
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x439040
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0x12
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439300
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x439300
cmp eax, 2
je 0x43940c
cmp eax, 5
je 0x4392f6
cmp eax, 6
je 0x4392f6
call fcn.00442c4d
mov eax, dword [eax + 4]
mov dword [eax + 0x148], 1
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4384a6
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x660], eax
mov byte [ebp - 4], 0x19
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4384a6
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x688], ebx
mov byte [ebp - 4], 0x1a
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4384a6
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x674], esi
mov edx, dword [ebp - 0x678]
mov byte [ebp - 4], 0x1b
mov edi, dword [ebp - 0x648]
movzx ecx, word [edi + 2]
push edi
push 0
push 0
push 0
shl ecx, 0x10
push 0
or ecx, 1
push 4
mov dword [edi], ecx
mov ecx, dword [ebp - 0x63c]
push 0
push edx
add ecx, 0x94
call fcn.0044a2aa
cmp dword [ebp - 0x640], 3
jne 0x43918c
push 0xb
call fcn.00440235
test eax, eax
je 0x439173
push 0xb
push eax
lea ecx, [ebp - 0x674]
call fcn.00401350
mov esi, dword [ebp - 0x674]
mov eax, dword [edi + 8]
push eax
lea ecx, [ebp - 0x660]
push esi
push ecx
call fcn.00405ba0
add esp, 0xc
jmp 0x439216
cmp dword [ebp - 0x640], 4
jne 0x4391c3
push 0x10
call fcn.00440235
test eax, eax
je 0x4391b4
push 0x10
push eax
lea ecx, [ebp - 0x674]
call fcn.00401350
mov esi, dword [ebp - 0x674]
mov eax, dword [edi + 8]
push eax
push eax
push esi
lea edx, [ebp - 0x660]
push edx
jmp 0x43920e
push 3
call fcn.00440235
test eax, eax
je 0x4391e2
push 3
push eax
lea ecx, [ebp - 0x688]
call fcn.00401350
mov ebx, dword [ebp - 0x688]
push 4
call fcn.00440235
test eax, eax
je 0x439201
push 4
push eax
lea ecx, [ebp - 0x674]
call fcn.00401350
mov esi, dword [ebp - 0x674]
mov eax, dword [edi + 8]
push eax
push eax
push esi
lea eax, [ebp - 0x660]
push eax
call fcn.00405ba0
add esp, 0x10
push 3
call fcn.00440235
cmp dword [ebp - 0x634], 0
jle 0x439461
test eax, eax
je 0x439242
push 3
push eax
lea ecx, [ebp - 0x688]
call fcn.00401350
mov ebx, dword [ebp - 0x688]
push 0x12
call fcn.00440235
test eax, eax
je 0x439261
push 0x12
push eax
lea ecx, [ebp - 0x674]
call fcn.00401350
mov esi, dword [ebp - 0x674]
mov eax, dword [esi - 0xc]
push eax
push esi
lea ecx, [ebp - 0x660]
call fcn.004058b0
mov ecx, dword [ebp - 0x63c]
mov edi, dword [ebp - 0x660]
push 0
push 0x34
push ecx
mov ecx, ebx
mov edx, edi
call fcn.004344a0
mov byte [ebp - 4], 0x1a
cmp eax, 7
je 0x439443
lea eax, [esi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4392b4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 0x19
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4392d4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0x12
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439300
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x439300
mov dword [ebp - 0x6a0], 0
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x680]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439326
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x64c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43934c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x670]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439372
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x65c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439398
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x644]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4393be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x654]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4393e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x678]
inc eax
mov dword [ebp - 0x678], eax
cmp eax, dword [ebp - 0x66c]
jb 0x438660
jmp 0x4395d7
push 0x80070057
call fcn.004010a0
movzx ecx, word [ebx + 2]
shl ecx, 0x10
or ecx, 1
mov dword [ebx], ecx
call fcn.00442c4d
mov eax, dword [eax + 4]
mov dword [eax + 0x148], 1
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x43950d
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4394b3
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
jmp 0x4394b3
test eax, eax
je 0x439479
push 3
push eax
lea ecx, [ebp - 0x688]
call fcn.00401350
mov ebx, dword [ebp - 0x688]
mov ecx, dword [ebp - 0x63c]
mov edi, dword [ebp - 0x660]
push 0
push 0x30
push ecx
mov ecx, ebx
mov edx, edi
call fcn.004344a0
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0x1a
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4394b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 0x19
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4394d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 0x12
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4394f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x680]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439519
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x64c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43953f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x670]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439565
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x65c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43958b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x644]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4395b1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x654]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4395d7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x668]
test eax, eax
je 0x439735
push eax
call fcn.004401b7
add esp, 4
jmp 0x439735
lea ecx, [esi + 0xf0]
push ecx
push 0x58e1bc
call fcn.004252a0
add esp, 8
test al, al
je 0x439721
call fcn.00434300
test eax, eax
je 0x439721
mov edi, dword [esi + 0x140]
cmp dword [edi + 0x48], 0
je 0x439721
xor edx, edx
push 0x40e
push edx
lea eax, [ebp - 0x426]
push eax
mov word [ebp - 0x428], dx
call fcn.005373f0
add esp, 0xc
lea esi, [ebp - 0x658]
mov eax, edi
call fcn.0040be40
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x428]
push 0x208
push ecx
call fcn.00535afa
mov eax, dword [ebp - 0x658]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x439690
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebx + 0x20]
lea edx, [ebp - 0x428]
call fcn.004193b0
test eax, eax
jne 0x439721
call fcn.00434300
test eax, eax
je 0x439735
lea ecx, [ebp - 0x648]
call fcn.004011e0
lea ecx, [ebp - 0x634]
call fcn.004011e0
push 0x36
lea ecx, [ebp - 0x634]
mov byte [ebp - 4], 0x1d
call fcn.00401320
mov edx, dword [ebp - 0x634]
lea ecx, [ebp - 0x428]
push ecx
push edx
lea eax, [ebp - 0x648]
push eax
call fcn.00405ba0
mov edx, dword [ebp - 0x648]
add esp, 0xc
push 0
push 0
push ebx
xor ecx, ecx
call fcn.004344a0
lea ecx, [ebp - 0x634]
call fcn.00401500
lea ecx, [ebp - 0x648]
mov byte [ebp - 4], 4
call fcn.00401500
jmp 0x439735
mov dword [ebp - 0x68c], 1
mov dword [ebp - 0x6a0], 0
xor esi, esi
push 0x14
mov dword [ebp - 0x694], esi
call fcn.00440188
add esp, 4
cmp eax, esi
je 0x43a311
mov dword [ebp - 0x698], eax
mov dword [eax], eax
mov eax, dword [ebp - 0x698]
mov dword [eax + 4], eax
mov eax, dword [ebp - 0x698]
mov dword [eax + 8], eax
mov ecx, dword [ebp - 0x698]
mov byte [ecx + 0x10], 1
mov edx, dword [ebp - 0x698]
mov byte [edx + 0x11], 1
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp - 0x698]
mov edi, dword [eax + 4]
cmp byte [edi + 0x11], 0
mov esi, edi
jne 0x4397d9
mov eax, dword [esi + 8]
push eax
lea ecx, [ebp - 0x69c]
call fcn.0043b140
mov eax, dword [edi + 0xc]
mov esi, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4397c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
call fcn.004401b7
add esp, 4
cmp byte [esi + 0x11], 0
mov edi, esi
je 0x439792
mov eax, dword [ebp - 0x698]
mov esi, dword [sym.imp.WINSPOOL.DRV_EnumPrinterDriversW]
mov dword [eax + 4], eax
mov eax, dword [ebp - 0x698]
mov dword [eax], eax
mov eax, dword [ebp - 0x698]
mov dword [eax + 8], eax
xor eax, eax
lea ecx, [ebp - 0x6ac]
push ecx
lea edx, [ebp - 0x6a4]
push edx
push eax
push eax
push 3
push eax
push eax
mov dword [ebp - 0x694], eax
mov dword [ebp - 0x6a4], eax
mov dword [ebp - 0x6ac], eax
call esi
test eax, eax
jne 0x4398ca
mov byte [ebp - 0x635], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x439bd2
mov eax, dword [ebp - 0x6a4]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x439bd2
mov eax, dword [ebp - 0x6a4]
lea ecx, [ebp - 0x6ac]
push ecx
lea edx, [ebp - 0x6a4]
push edx
push eax
push ebx
push 3
push 0
push 0
call esi
test eax, eax
je 0x4398b6
xor esi, esi
cmp dword [ebp - 0x6ac], esi
jbe 0x4398af
lea ecx, [esi + esi*4]
lea edx, [ebx + ecx*8 + 0x20]
push edx
lea ecx, [ebp - 0x69c]
call fcn.0043bac0
push eax
lea eax, [ebp - 0x69c]
push eax
lea edi, [ebp - 0x6b8]
call fcn.0043b6e0
inc esi
cmp esi, dword [ebp - 0x6ac]
jb 0x439880
mov byte [ebp - 0x635], 0
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp byte [ebp - 0x635], 0
jne 0x439bd2
call fcn.00442c4d
mov esi, dword [eax + 4]
mov dword [ebp - 0x640], esi
test esi, esi
je 0x439bd2
cmp dword [esi + 0x134], 0
je 0x439bd2
push 0x208
lea ecx, [ebp - 0x630]
push 0
push ecx
call fcn.005373f0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x630]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov esi, dword [esi + 0x134]
xor ebx, ebx
mov eax, esi
lea esp, [esp]
mov eax, dword [eax]
mov ecx, 0x58a8c8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43995d
test dx, dx
je 0x439959
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43995d
add eax, 4
add ecx, 4
test dx, dx
jne 0x439937
xor eax, eax
jmp 0x439962
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x439a61
mov edi, dword [ebp - 0x698]
lea esi, [esi + ebx*8]
mov ecx, esi
lea eax, [ebp - 0x69c]
call fcn.0043b2c0
mov dword [ebp - 0x658], eax
cmp eax, dword [ebp - 0x698]
je 0x4399e3
mov ecx, dword [eax + 0xc]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x4384a6
mov eax, dword [esi]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4399cd
test dx, dx
je 0x4399c9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4399cd
add eax, 4
add ecx, 4
test dx, dx
jne 0x4399a7
xor eax, eax
jmp 0x4399d2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sets al
test al, al
jne 0x4399e3
lea eax, [ebp - 0x658]
jmp 0x4399f5
mov ecx, dword [ebp - 0x698]
mov dword [ebp - 0x684], ecx
lea eax, [ebp - 0x684]
cmp dword [eax], edi
jne 0x439a4c
mov edx, dword [ebp - 0x640]
mov eax, dword [edx + 0x134]
lea esi, [eax + ebx*8 + 4]
mov eax, dword [esi]
cmp dword [eax - 4], 1
jle 0x439a1c
mov ecx, dword [eax - 0xc]
push ecx
mov ecx, esi
call fcn.00401840
mov esi, dword [esi]
push esi
lea edx, [ebp - 0x630]
push edx
lea eax, [ebp - 0x220]
push 0x58b914
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x439a69
mov edx, dword [ebp - 0x640]
mov esi, dword [edx + 0x134]
inc ebx
lea eax, [esi + ebx*8]
jmp 0x439930
xor eax, eax
je 0x439bd2
call fcn.0040bea0
cmp eax, 0xa
jne 0x439a82
call fcn.0040e2f0
mov ecx, str.SPOOLER
call fcn.0040e4e0
mov eax, dword [ebp - 0x640]
mov esi, dword [eax + 0x134]
mov dword [ebp - 0x634], 0
mov eax, esi
lea ebx, [ebx]
mov eax, dword [eax]
mov ecx, 0x58a8c8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x439acd
test dx, dx
je 0x439ac9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x439acd
add eax, 4
add ecx, 4
test dx, dx
jne 0x439aa7
xor eax, eax
jmp 0x439ad2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x439bd2
mov edi, dword [ebp - 0x634]
mov ebx, dword [ebp - 0x698]
add edi, edi
add edi, edi
add edi, edi
add esi, edi
mov ecx, esi
lea eax, [ebp - 0x69c]
call fcn.0043b2c0
mov dword [ebp - 0x658], eax
cmp eax, dword [ebp - 0x698]
je 0x439b57
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4384a6
mov ecx, eax
mov eax, dword [esi]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x439b46
test dx, dx
je 0x439b42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x439b46
add eax, 4
add ecx, 4
test dx, dx
jne 0x439b20
xor eax, eax
jmp 0x439b4b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
js 0x439b57
lea eax, [ebp - 0x658]
jmp 0x439b69
mov ecx, dword [ebp - 0x698]
mov dword [ebp - 0x684], ecx
lea eax, [ebp - 0x684]
cmp dword [eax], ebx
mov ebx, dword [ebp - 0x640]
jne 0x439bb7
mov esi, dword [ebx + 0x134]
mov eax, dword [esi + edi]
add esi, edi
cmp dword [eax - 4], 1
jle 0x439b8f
mov edx, dword [eax - 0xc]
push edx
mov ecx, esi
call fcn.00401840
mov eax, dword [ebx + 0x134]
mov esi, dword [esi]
lea edi, [eax + edi + 4]
mov eax, dword [edi]
cmp dword [eax - 4], 1
jle 0x439bae
mov ecx, dword [eax - 0xc]
push ecx
mov ecx, edi
call fcn.00401840
mov edi, dword [edi]
mov ecx, esi
call fcn.004162a0
mov eax, dword [ebp - 0x634]
mov esi, dword [ebx + 0x134]
inc eax
mov dword [ebp - 0x634], eax
lea eax, [esi + eax*8]
jmp 0x439aa0
cmp dword [ebp - 0x67c], 0xa
jne 0x439e8b
push 0
lea edx, [ebp - 0x6b8]
push str.CUNINSTALLERDlg::beSilent
push edx
call fcn.0040ac70
add esp, 0xc
mov byte [ebp - 4], 0x1f
call fcn.00442c4d
mov esi, dword [eax + 4]
mov eax, dword [esi + 0x140]
mov eax, dword [eax + 0x28]
push eax
push str.return___08x
lea ecx, [ebp - 0x6b8]
push 2
push ecx
call fcn.0040aed0
mov edx, dword [esi + 0x140]
mov esi, dword [edx + 0x28]
add esp, 0x10
lea ecx, [ebp - 0x6b8]
mov byte [ebp - 4], 0x1e
call fcn.0040ae50
mov edi, dword [ebp - 0x650]
test esi, esi
je 0x439c50
cmp dword [edi + 0x194], 1
jne 0x439e91
cmp dword [edi + 0x19c], 0
jne 0x439e91
xor ecx, ecx
call fcn.0041ee60
test eax, eax
jne 0x439e87
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x439c86
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x644], eax
mov esi, 0x58a8c8
shr esi, 0x10
mov byte [ebp - 4], 0x20
test esi, esi
jne 0x439ceb
mov ecx, 0x58a8c8
movzx edi, cx
push edi
call fcn.00440235
test eax, eax
je 0x439cc7
push edi
push eax
lea ecx, [ebp - 0x644]
call fcn.00401350
mov edi, dword [ebp - 0x650]
mov byte [ebp - 4], 0x21
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x439cff
push 0x80004005
call fcn.004010a0
push 0
push 0x58a8c8
lea ecx, [ebp - 0x644]
call fcn.004016b0
jmp 0x439ccd
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x668], eax
mov byte [ebp - 4], 0x22
test esi, esi
jne 0x439d3a
mov ecx, 0x58a8c8
movzx esi, cx
push esi
call fcn.00440235
test eax, eax
je 0x439d4c
push esi
push eax
lea ecx, [ebp - 0x668]
call fcn.00401350
jmp 0x439d4c
push 0
push 0x58a8c8
lea ecx, [ebp - 0x668]
call fcn.004016b0
push 3
mov byte [ebp - 4], 0x23
call fcn.00440235
test eax, eax
je 0x439d69
push 3
push eax
lea ecx, [ebp - 0x668]
call fcn.00401350
mov eax, dword [edi + 0xf0]
mov ecx, 0x58f9f8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x439d9a
test dx, dx
je 0x439d96
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x439d9a
add eax, 4
add ecx, 4
test dx, dx
jne 0x439d74
xor eax, eax
jmp 0x439d9f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x439db7
push 0x56
call fcn.00440235
test eax, eax
je 0x439dd0
push 0x56
jmp 0x439dc4
push 0x57
call fcn.00440235
test eax, eax
je 0x439dd0
push 0x57
push eax
lea ecx, [ebp - 0x644]
call fcn.00401350
mov edx, dword [ebp - 0x63c]
mov ebx, dword [ebp - 0x668]
push 0
push 0x30
push edx
mov edx, dword [ebp - 0x644]
mov ecx, ebx
call fcn.004344a0
mov eax, dword [edi + 0xf0]
mov ecx, 0x58f9f8
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x439e26
test dx, dx
je 0x439e22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x439e26
add eax, 4
add ecx, 4
test dx, dx
jne 0x439e00
xor eax, eax
jmp 0x439e2b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
mov esi, 1
test al, al
jne 0x439e3f
mov esi, dword [ebp - 0x68c]
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 0x21
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439e5f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp - 0x644]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439e97
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x439e97
xor esi, esi
jmp 0x439e97
mov edi, dword [ebp - 0x650]
mov esi, dword [ebp - 0x68c]
call fcn.00418870
mov ebx, eax
mov dword [ebp - 0x684], ebx
test ebx, ebx
jne 0x439eff
mov eax, dword [edi + 0x5e8]
mov ecx, str.CAPT
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x439ed9
test dx, dx
je 0x439ed5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x439ed9
add eax, 4
add ecx, 4
test dx, dx
jne 0x439eb3
xor eax, eax
jmp 0x439ede
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x439eff
cmp dword [edi + 0x62c], 0
je 0x439eff
call fcn.004228f0
test eax, eax
jne 0x439eff
mov dword [ebp - 0x6a0], eax
test esi, esi
jne 0x43a04d
mov ecx, dword [ebp - 0x650]
mov eax, dword [ecx + 0x140]
xor edi, edi
cmp dword [eax + 0x54], edi
je 0x43a04d
cmp dword [eax + 0x5c], edi
je 0x43a074
lea esi, [ebp - 0x658]
call fcn.0040be70
mov edx, dword [eax]
cmp dword [edx - 0xc], edi
mov eax, dword [ebp - 0x658]
setne bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439f5c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x439f71
cmp dword [ebp - 0x684], edi
jne 0x43a04d
jmp 0x43a044
lea ecx, [ebp - 0x738]
push ecx
call fcn.00401a30
lea eax, [ebp - 0x738]
mov byte [ebp - 4], 0x24
call fcn.00401ca0
push 0
lea edx, [ebp - 0x704]
push edx
lea eax, [ebp - 0x738]
push eax
lea eax, [ebp - 0x714]
mov ebx, 2
call fcn.00401dd0
test eax, eax
je 0x43a031
mov ecx, dword [ebp - 0x650]
mov eax, dword [ecx + 0x140]
lea esi, [ebp - 0x658]
call fcn.0040be40
mov byte [ebp - 4], 0x25
mov ecx, dword [ebp - 0x734]
cmp ecx, 8
jne 0x439fe8
push eax
lea ebx, [ebp - 0x738]
call fcn.00401d20
jmp 0x439ffd
cmp ecx, 2
jne 0x439ffb
push eax
lea ebx, [ebp - 0x738]
call fcn.00401e60
jmp 0x439ffd
xor eax, eax
test eax, eax
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0x658]
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43a028
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x43a031
mov edi, 1
lea ecx, [ebp - 0x738]
mov byte [ebp - 4], 0x1e
call fcn.00401b40
test edi, edi
je 0x43a04d
call fcn.0040edb0
test eax, eax
je 0x43a05a
cmp dword [ebp - 0x6a0], 0
jne 0x43a197
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x43a0ab
push 0x80004005
call fcn.004010a0
cmp dword [ebp - 0x66c], edi
jle 0x43a080
test ebx, ebx
je 0x43a044
call fcn.00434300
test eax, eax
je 0x43a04d
mov ecx, dword [ebp - 0x650]
mov edx, dword [ecx + 0x140]
cmp dword [edx + 0x48], edi
je 0x43a04d
mov ecx, dword [ebp - 0x63c]
call fcn.0043a3c0
test eax, eax
jne 0x43a04d
jmp 0x43a044
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x67c], ebx
mov byte [ebp - 4], 0x26
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x43a0db
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x634], esi
push 0x21
mov byte [ebp - 4], 0x27
call fcn.00440235
test eax, eax
je 0x43a110
push 0x21
push eax
lea ecx, [ebp - 0x67c]
call fcn.00401350
mov ebx, dword [ebp - 0x67c]
push 3
call fcn.00440235
test eax, eax
je 0x43a12f
push 3
push eax
lea ecx, [ebp - 0x634]
call fcn.00401350
mov esi, dword [ebp - 0x634]
mov edi, dword [ebp - 0x63c]
push 0
push 0x30
push edi
mov ecx, esi
mov edx, ebx
call fcn.004344a0
call fcn.00442c4d
mov eax, dword [eax + 4]
mov dword [eax + 0x148], 1
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0x26
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a175
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 0x1e
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a19d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x43a19d
mov edi, dword [ebp - 0x63c]
cmp dword [ebp - 0x6bc], 1
jne 0x43a21a
mov ecx, dword [edi + 0xb4]
push 0
push 0
push 0xb
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [ebp - 0x66c]
xor esi, esi
test ebx, ebx
jle 0x43a207
jmp 0x43a1d0
push esi
lea ecx, [edi + 0x94]
call fcn.00449e67
cmp word [eax], 0x10
jne 0x43a202
push eax
call fcn.004401b7
mov edx, dword [edi + 0xb4]
add esp, 4
push 0
push esi
push 0x1008
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
dec esi
dec ebx
inc esi
cmp esi, ebx
jl 0x43a1d0
mov eax, dword [edi + 0xb4]
push 0
push 1
push 0xb
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x58a8c8
lea ecx, [ebp - 0x6cc]
push 2
push ecx
call fcn.0040aed0
add esp, 0xc
mov byte [ebp - 4], 0x28
mov eax, dword [ebp - 0x698]
mov ecx, dword [eax]
push eax
push ecx
lea edi, [ebp - 0x6bc]
lea esi, [ebp - 0x69c]
call fcn.0043b200
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x698]
push edx
call fcn.004401b7
add esp, 4
lea ecx, [ebp - 0x635]
mov byte [ebp - 4], 3
call fcn.0040aa10
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x6c0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a297
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x664]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a2bd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x6c4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a2e3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x6cc]
mov dword [ebp - 4], 0xffffffff
call fcn.0040ae50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005337cb
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x648]
push ecx
lea ecx, [ebp - 0x6e8]
mov dword [ebp - 0x648], esi
call fcn.00533d5a
push 0x5a7844
lea edx, [ebp - 0x6e8]
push edx
mov dword [ebp - method.std::bad_alloc.virtual_0], vtable.std::bad_alloc.0
call fcn.005372e6
mov ecx, dword [ebp - 0x6ec]
call fcn.0044089c
lea ecx, [ebp - 0x634]
call fcn.004011e0
lea ecx, [ebp - 0x67c]
call fcn.004011e0
push 0x45
lea ecx, [ebp - 0x634]
mov byte [ebp - 4], 8
call fcn.00401320
push 3
lea ecx, [ebp - 0x67c]
call fcn.00401320
mov eax, dword [ebp - 0x63c]
mov ecx, dword [ebp - 0x67c]
mov edx, dword [ebp - 0x634]
push 0
push 0x30
push eax
call fcn.004344a0
lea esi, [ebp - 0x6f8]
call fcn.00406170
push 0x5a7844
mov ecx, esi
push ecx
call fcn.005372e6
int3