Function at 0x468890
Capabilities:
Accept command line arguments
Check if file exists
Check mutex on windows
Check os version
Delete file
Extract resource via kernel32 functions
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46fb44
mov eax, dword fs:[0]
push eax
mov eax, 0x2548
call fcn.0043d9c0
mov eax, dword [0x48d740]
xor eax, ebp
mov dword [ebp - 0x48], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24d8], ecx
push str.Mutex_QiyiInstaller
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 0x24d8]
mov dword [ecx + 0x250], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x46894b
push 0x47c67c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x47c6a8
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x468944
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0xa
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x40]
push eax
push 0
push 0x4a
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x44], eax
xor eax, eax
jmp 0x469722
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0x24d8]
mov dword [edx + 0x230], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x24d8]
mov dword [ecx + 0x234], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0x24d8]
mov dword [edx + 0x238], eax
mov eax, dword [ebp - 0x24d8]
add eax, 0x254
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x10], eax
push 0x58
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
test eax, eax
jle 0x4689d0
push 0x58
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, eax
mov eax, 0x3c0
cdq
idiv ecx
mov edx, dword [ebp - 0x24d8]
mov dword [edx + 0x118], eax
push 0x58
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [0x492134], eax
push 0x5a
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [0x492130], eax
mov edx, dword [ebp - 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0x47c6bc
push 0
call fcn.0043bea9
add esp, 8
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x20], 0xff
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea ecx, [ebp - 0x2488]
push ecx
mov ecx, dword [ebp - 0x24d8]
call fcn.00467860
mov dword [ebp - 0x24dc], eax
mov edx, dword [ebp - 0x24dc]
mov dword [ebp - 0x24e0], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24e0]
push eax
mov ecx, 0x4923cc
call fcn.004022f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2488]
call fcn.00404e70
mov ecx, dword [ebp - 0x24d8]
call fcn.00426224
push 0
call fcn.00427cec
add esp, 4
mov ecx, dword [ebp - 0x24d8]
call fcn.004674a0
push 0x104
push 0x104
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xb4
call fcn.00401a80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xb4
call fcn.00405b80
push 0
push 0x19
push 0x104
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xac
call fcn.00401a80
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xac
call fcn.00405b80
push 0
push 0
push 0x104
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xb0
call fcn.00401a80
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xb0
call fcn.00405b80
push 0
push 2
push 0x104
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xd4
call fcn.00401a80
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xd4
call fcn.00405b80
push 0
push 0x17
push 0x104
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xc0
call fcn.00401a80
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xc0
call fcn.00405b80
push 0x104
push 0x104
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xc8
call fcn.00401a80
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xc8
call fcn.00405b80
push 0x5c
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xc8
call fcn.00404ad0
add eax, 1
push eax
lea ecx, [ebp - 0x248c]
push ecx
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xc8
call fcn.00404c20
mov dword [ebp - 0x24e4], eax
mov edx, dword [ebp - 0x24e4]
mov dword [ebp - 0x24e8], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x24e8]
push eax
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xb8
call fcn.004022f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248c]
call fcn.00404e70
push 0
push 0x1a
push 0x104
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xcc
call fcn.00401a80
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xcc
call fcn.00405b80
push 0x104
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xd0
call fcn.00401a80
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xd0
call fcn.00405b80
push 1
lea ecx, [ebp - 0x2494]
push ecx
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xd0
call fcn.00404b90
mov dword [ebp - 0x24ec], eax
push 0x47c6c0
mov edx, dword [ebp - 0x24ec]
push edx
call fcn.00404d10
add esp, 8
mov byte [ebp - 0x248d], al
lea ecx, [ebp - 0x2494]
call fcn.00404e70
movzx eax, byte [ebp - 0x248d]
test eax, eax
je 0x468d1a
push 0x47c6c4
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xd0
call fcn.00404790
call fcn.00403480
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xd0
call fcn.004024e0
push eax
call fcn.0045aa50
mov ecx, dword [ebp - 0x24d8]
add ecx, 0x11c
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4690e8
lea ecx, [ebp - 0x258]
call fcn.00404e50
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0x24d8]
cmp dword [edx + 0x120], 6
jae 0x468f10
push 0x47c6c8
mov ecx, dword [ebp - 0x24d8]
add ecx, 0x110
call fcn.00402160
push 0
push 0x23
lea eax, [ebp - 0x254]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x254]
push ecx
lea ecx, [ebp - 0x25c]
call fcn.00401d70
mov byte [ebp - 4], 3
push str.QiYi
lea edx, [ebp - 0x25c]
push edx
lea eax, [ebp - 0x2498]
push eax
call fcn.00401530
add esp, 0xc
mov dword [ebp - 0x24f0], eax
mov ecx, dword [ebp - 0x24f0]
mov dword [ebp - 0x24f4], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x24f4]
push edx
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xa8
call fcn.004022f0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2498]
call fcn.00404e70
push str.QiYiQiyiClientcache_
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x249c]
push ecx
call fcn.00401530
add esp, 0xc
mov dword [ebp - 0x24f8], eax
mov edx, dword [ebp - 0x24f8]
mov dword [ebp - 0x24fc], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x24fc]
push eax
lea ecx, [ebp - 0x258]
call fcn.004022f0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x249c]
call fcn.00404e70
mov ecx, dword [ebp - 0x24d8]
cmp dword [ecx + 0x120], 5
jne 0x468ed7
mov edx, dword [ebp - 0x24d8]
cmp dword [edx + 0x124], 1
jne 0x468e98
push str.windowsXP
mov ecx, dword [ebp - 0x24d8]
add ecx, 0x114
call fcn.00402160
jmp 0x468ed5
mov eax, dword [ebp - 0x24d8]
cmp dword [eax + 0x124], 2
jne 0x468ebf
push str.windows2003
mov ecx, dword [ebp - 0x24d8]
add ecx, 0x114
call fcn.00402160
jmp 0x468ed5
push str.windows2000
mov ecx, dword [ebp - 0x24d8]
add ecx, 0x114
call fcn.00402160
jmp 0x468efc
mov ecx, dword [ebp - 0x24d8]
cmp dword [ecx + 0x120], 5
jae 0x468efc
push str.windows98
mov ecx, dword [ebp - 0x24d8]
add ecx, 0x114
call fcn.00402160
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x25c]
call fcn.00404e70
jmp 0x4690c5
push 0x47c764
mov ecx, dword [ebp - 0x24d8]
add ecx, 0x110
call fcn.00402160
push 0x104
lea edx, [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x260]
call fcn.00401d70
mov byte [ebp - 4], 6
push 2
lea ecx, [ebp - 0x24a0]
push ecx
lea ecx, [ebp - 0x260]
call fcn.00404c20
mov dword [ebp - 0x2500], eax
mov edx, dword [ebp - 0x2500]
mov dword [ebp - 0x2504], edx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x2504]
push eax
lea ecx, [ebp - 0x260]
call fcn.004022f0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24a0]
call fcn.00404e70
push str.UsersPublicQiYi
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x24a4]
push edx
call fcn.00401530
add esp, 0xc
mov dword [ebp - 0x2508], eax
mov eax, dword [ebp - 0x2508]
mov dword [ebp - 0x250c], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x250c]
push ecx
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xa8
call fcn.004022f0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24a4]
call fcn.00404e70
push str.UsersPublicQiYiQiyiClientcache_
lea edx, [ebp - 0x260]
push edx
lea eax, [ebp - 0x24a8]
push eax
call fcn.00401530
add esp, 0xc
mov dword [ebp - 0x2510], eax
mov ecx, dword [ebp - 0x2510]
mov dword [ebp - 0x2514], ecx
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x2514]
push edx
lea ecx, [ebp - 0x258]
call fcn.004022f0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24a8]
call fcn.00404e70
mov eax, dword [ebp - 0x24d8]
cmp dword [eax + 0x120], 6
jne 0x4690b6
mov ecx, dword [ebp - 0x24d8]
cmp dword [ecx + 0x124], 1
jne 0x469079
push str.windows7
mov ecx, dword [ebp - 0x24d8]
add ecx, 0x114
call fcn.00402160
jmp 0x4690b6
mov edx, dword [ebp - 0x24d8]
cmp dword [edx + 0x124], 2
jne 0x4690a0
push str.windows8
mov ecx, dword [ebp - 0x24d8]
add ecx, 0x114
call fcn.00402160
jmp 0x4690b6
push str.windows_Vista
mov ecx, dword [ebp - 0x24d8]
add ecx, 0x114
call fcn.00402160
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x260]
call fcn.00404e70
lea ecx, [ebp - 0x258]
call fcn.004024e0
push eax
call fcn.0045aa50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.00404e70
push 0x47c828
mov ecx, dword [ebp - 0x24d8]
add ecx, 0x110
call fcn.00402160
push str.install.ini
mov eax, dword [ebp - 0x24d8]
add eax, 0xb8
push eax
lea ecx, [ebp - 0x24ac]
push ecx
call fcn.00401530
add esp, 0xc
mov dword [ebp - 0x2518], eax
mov edx, dword [ebp - 0x2518]
mov dword [ebp - 0x251c], edx
mov dword [ebp - 4], 0xa
mov eax, dword [ebp - 0x251c]
push eax
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xbc
call fcn.004022f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24ac]
call fcn.00404e70
cmp dword [0x4912d8], 1
jle 0x469215
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x264], eax
mov ecx, dword [ebp - 0x264]
push ecx
lea ecx, [ebp - 0x268]
call fcn.00401d70
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0x268]
call fcn.00404b20
push 0
push str._uinst
lea ecx, [ebp - 0x268]
call fcn.00404a50
cmp eax, 0xffffffff
je 0x4691c5
mov edx, dword [ebp - 0x24d8]
mov dword [edx + 0xf8], 0
push 0
push 0x47c858
lea ecx, [ebp - 0x268]
call fcn.00404a50
cmp eax, 0xffffffff
jne 0x4691f3
push 0
push 0x47c860
lea ecx, [ebp - 0x268]
call fcn.00404a50
cmp eax, 0xffffffff
je 0x469203
mov eax, dword [ebp - 0x24d8]
mov dword [eax + 0xfc], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.00404e70
push 0x47c868
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xb8
push ecx
lea edx, [ebp - 0x24b0]
push edx
call fcn.00401530
add esp, 0xc
mov dword [ebp - 0x2520], eax
mov eax, dword [ebp - 0x2520]
mov dword [ebp - 0x2524], eax
mov dword [ebp - 4], 0xc
mov ecx, dword [ebp - 0x2524]
push ecx
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xc4
call fcn.004022f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24b0]
call fcn.00404e70
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xbc
call fcn.004024e0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x469563
push 0x47c88c
push 0x320
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
je 0x46954e
push 0x47c894
mov edx, dword [ebp - 0x24d8]
add edx, 0xd0
push edx
lea eax, [ebp - 0x24b4]
push eax
call fcn.00401530
add esp, 0xc
mov dword [ebp - 0x2528], eax
mov ecx, dword [ebp - 0x2528]
call fcn.004024e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x24b4]
call fcn.00404e70
mov ecx, dword [ebp - 0x26c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
je 0x46954c
mov edx, dword [ebp - 0x270]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x26c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x274], eax
lea ecx, [ebp - 0x284]
call fcn.00426de7
mov dword [ebp - 4], 0xd
push 0x47c8b8
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xd0
push ecx
lea edx, [ebp - 0x24bc]
push edx
call fcn.00401530
add esp, 0xc
mov dword [ebp - 0x252c], eax
mov eax, dword [ebp - 0x252c]
mov dword [ebp - 0x2530], eax
mov byte [ebp - 4], 0xe
push 0
push 0x1002
mov ecx, dword [ebp - 0x2530]
call fcn.004024e0
push eax
lea ecx, [ebp - 0x284]
call fcn.0042722b
mov dword [ebp - 0x24b8], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x24bc]
call fcn.00404e70
cmp dword [ebp - 0x24b8], 0
je 0x46952d
mov ecx, dword [ebp - 0x274]
push ecx
mov edx, dword [ebp - 0x288]
push edx
lea ecx, [ebp - 0x284]
call fcn.00426b35
lea ecx, [ebp - 0x284]
call fcn.00426c1b
lea ecx, [ebp - 0x284]
call fcn.00426d85
push str.qiyi_install.ini
mov eax, dword [ebp - 0x24d8]
add eax, 0xd0
push eax
lea ecx, [ebp - 0x24c0]
push ecx
call fcn.00401530
add esp, 0xc
mov dword [ebp - 0x2534], eax
mov edx, dword [ebp - 0x2534]
mov dword [ebp - 0x2538], edx
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x2538]
push eax
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xbc
call fcn.004022f0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x24c0]
call fcn.00404e70
mov ecx, dword [ebp - 0x24d8]
cmp dword [ecx + 0xf8], 0
je 0x4694d0
push str.QiyiClientQiyiInstaller.log
mov edx, dword [ebp - 0x24d8]
add edx, 0xa8
push edx
lea eax, [ebp - 0x24c4]
push eax
call fcn.00401530
add esp, 0xc
mov dword [ebp - 0x253c], eax
mov ecx, dword [ebp - 0x253c]
mov dword [ebp - 0x2540], ecx
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x2540]
push edx
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xc4
call fcn.004022f0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x24c4]
call fcn.00404e70
jmp 0x46952d
push str.QiyiInstaller.log
mov eax, dword [ebp - 0x24d8]
add eax, 0xd0
push eax
lea ecx, [ebp - 0x24c8]
push ecx
call fcn.00401530
add esp, 0xc
mov dword [ebp - 0x2544], eax
mov edx, dword [ebp - 0x2544]
mov dword [ebp - 0x2548], edx
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x2548]
push eax
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xc4
call fcn.004022f0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x24c8]
call fcn.00404e70
mov ecx, dword [ebp - 0x270]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x284]
call fcn.00426ef4
jmp 0x469563
push 0
push 0
push str.b_rN0R
call fcn.004284a9
xor eax, eax
jmp 0x469722
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xc4
call fcn.004024e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x1041
mov ecx, dword [ebp - 0x24d8]
add ecx, 0xc4
call fcn.004024e0
push eax
mov ecx, dword [ebp - 0x24d8]
add ecx, 0x240
mov edx, dword [ebp - 0x24d8]
mov eax, dword [edx + 0x240]
mov edx, dword [eax + 0x20]
call edx
mov ecx, dword [ebp - 0x24d8]
add ecx, 0x240
call fcn.00405b60
mov byte [ebp - 0x18], 0xff
mov byte [ebp - 0x17], 0xfe
push 2
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x24d8]
add ecx, 0x240
mov edx, dword [ebp - 0x24d8]
mov eax, dword [edx + 0x240]
mov edx, dword [eax + 0x38]
call edx
mov ecx, dword [ebp - 0x24d8]
call fcn.00467de0
push 0x47c978
mov ecx, dword [ebp - 0x24d8]
call fcn.00428547
push 0x47c998
push ecx
mov ecx, esp
mov dword [ebp - 0x24d0], esp
push 0x47c99c
call fcn.00401d70
mov dword [ebp - 0x254c], eax
lea eax, [ebp - 0x24d4]
push eax
call fcn.0045b5e0
add esp, 8
mov dword [ebp - 0x2550], eax
mov ecx, dword [ebp - 0x2550]
mov dword [ebp - 0x2554], ecx
mov edx, dword [ebp - 0x2554]
push edx
call fcn.00402e30
add esp, 8
mov byte [ebp - 0x24c9], al
lea ecx, [ebp - 0x24d4]
call fcn.00404e70
movzx eax, byte [ebp - 0x24c9]
test eax, eax
je 0x469682
mov ecx, dword [ebp - 0x24d8]
mov dword [ecx + 0xfc], 1
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x24d8]
cmp dword [edx + 0xf8], 0
je 0x4696dd
push 0
lea ecx, [ebp - 0x160c]
call fcn.00465ca0
mov dword [ebp - 4], 0x12
mov eax, dword [ebp - 0x24d8]
lea ecx, [ebp - 0x160c]
mov dword [eax + 0x20], ecx
lea ecx, [ebp - 0x160c]
call fcn.00425851
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160c]
call fcn.00404640
jmp 0x469720
push 0
lea ecx, [ebp - 0x2484]
call fcn.0046c9f0
mov dword [ebp - 4], 0x13
mov edx, dword [ebp - 0x24d8]
lea eax, [ebp - 0x2484]
mov dword [edx + 0x20], eax
lea ecx, [ebp - 0x2484]
call fcn.00425851
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2484]
call fcn.0046c920
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x48]
xor ecx, ebp
call fcn.0043aa6f
mov esp, ebp
pop ebp
ret