Function at 0x412710
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460abc
mov eax, dword fs:[0]
push eax
sub esp, 0x128
push ebx
push esi
push edi
mov eax, dword [0x4786a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x47b774]
mov eax, dword [eax - 0xc]
xor edi, edi
cmp eax, edi
je 0x41440f
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0x10c], 0
je 0x41440f
cmp byte [ebp + 0xc], 0
jne 0x41276f
cmp dword [0x47b5b8], edi
je 0x41440f
mov edx, dword [0x478034]
mov eax, dword [edx + 0xc]
mov ecx, 0x478034
call eax
add eax, 0x10
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x78]
push ecx
mov ecx, 0x46a058
mov dword [ebp - 4], edi
call fcn.00401110
mov eax, 0xa
mov dword [ebp - 0xcc], edi
mov dword [ebp - 0xc8], edi
mov dword [ebp - 0xc4], edi
mov dword [ebp - 0xc0], edi
mov dword [ebp - 0xbc], edi
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x78]
push edx
lea eax, [ebp - 0xcc]
mov byte [ebp - 4], 3
cmp dword [0x47b5bc], edi
push eax
push 0x47b774
setg byte [ebp + 0xf]
call fcn.00423c50
add esp, 0xc
jmp 0x412800
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x2c], edi
jbe 0x412860
mov esi, dword [ebp - 0x34]
xor eax, eax
cmp esi, edi
setne al
cmp eax, edi
je 0x414425
mov ecx, dword [esi]
mov dword [ebp - 0x34], ecx
mov eax, dword [esi + 8]
sub eax, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412846
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x24]
mov dword [esi], ecx
dec dword [ebp - 0x2c]
mov dword [ebp - 0x24], esi
jne 0x41285b
lea esi, [ebp - 0x34]
call fcn.00423bd0
cmp dword [ebp - 0x2c], edi
ja 0x412810
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x24], edi
cmp eax, edi
je 0x412884
mov esi, dword [eax]
push eax
call fcn.00446332
add esp, 4
mov eax, esi
cmp esi, edi
jne 0x412870
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0xc4]
xor ecx, ecx
mov dword [ebp - 0x40], ecx
cmp eax, edi
jbe 0x413713
cmp ecx, eax
jb 0x41289f
xor eax, eax
jmp 0x4128b6
mov eax, dword [ebp - 0xcc]
cmp eax, edi
jne 0x4128ad
xor eax, eax
jmp 0x4128b6
cmp ecx, edi
jbe 0x4128b6
dec ecx
mov eax, dword [eax]
jne 0x4128b1
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
je 0x414425
mov ecx, dword [eax + 8]
mov esi, dword [ebp - 0x38]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x412915
cmp dword [esi + 0xc], edi
lea ebx, [esi + 0xc]
jl 0x412908
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x412908
call fcn.004218e0
mov edi, eax
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x412900
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add edi, 0x10
mov dword [ebp - 0x38], edi
jmp 0x412915
mov ebx, dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x38]
push ecx
call fcn.00401330
mov esi, dword [ebp - 0x38]
cmp dword [esi - 0xc], 0
je 0x4136fc
push 0x46a05c
push esi
call fcn.0044646f
add esp, 8
test eax, eax
jne 0x412a97
mov edx, dword [ebp + 8]
cmp dword [edx + 0x124], eax
mov edx, dword [0x478034]
sete al
movzx ecx, al
mov eax, dword [edx + 0xc]
push ecx
push ecx
mov ebx, esp
mov dword [ebp - 0x14], esp
mov ecx, 0x478034
xor esi, esi
mov dword [ebp - 0x14], ebx
call eax
add eax, 0x10
mov dword [ebx], eax
mov ecx, 0x46a068
mov byte [ebp - 4], 4
test ecx, 0xffff0000
jne 0x412993
mov edx, ecx
movzx edi, dx
call fcn.004014d0
test eax, eax
je 0x4129a3
push eax
mov eax, edi
mov edi, ebx
call fcn.00401290
jmp 0x4129a3
push 0x46a068
push ebx
mov ebx, 9
call fcn.00401330
mov ebx, esi
mov byte [ebp - 4], 3
call fcn.00416870
test al, al
je 0x4136fc
mov edi, dword [ebp - 0x30]
lea esi, [ebp - 0x34]
call fcn.00426760
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
mov esi, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
add eax, 8
push eax
mov ecx, str.Microsoft_Excel
mov byte [ebp - 4], 5
call fcn.00401110
mov byte [ebp - 4], 3
mov dword [ebp - 0x24], ebx
mov dword [esi + 4], edi
mov dword [esi], 0
mov eax, dword [ebp - 0x30]
inc dword [ebp - 0x2c]
test eax, eax
je 0x4129fe
mov dword [eax], esi
jmp 0x412a01
mov dword [ebp - 0x34], esi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xe8]
push ecx
push str.Microsoft_Excel
lea eax, [ebp - 0x12c]
mov ecx, edi
mov dword [ebp - 0x30], esi
call fcn.00425ac0
test eax, eax
jne 0x4136fc
push ecx
mov edx, esp
mov dword [ebp - 0x14], esp
push edx
mov ecx, 0x46cea0
call fcn.00401110
push ecx
mov byte [ebp - 4], 6
mov eax, esp
mov dword [ebp - 0x18], esp
push eax
mov ecx, str.00020813_0000_0000_C000_000000000046
call fcn.00401110
push ecx
mov byte [ebp - 4], 7
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ecx
mov esi, str.excel.exe
call fcn.0041d6f0
lea edx, [ebp - 0x94]
mov bl, 3
push edx
mov byte [ebp - 4], bl
call fcn.00416a00
mov byte [ebp - 4], 8
mov ecx, dword [eax]
push edi
mov edx, str.Microsoft_Excel
call fcn.00423890
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x94]
jmp 0x412e13
push str.word
push esi
call fcn.0044646f
add esp, 8
test eax, eax
jne 0x412bbf
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x124], eax
sete dl
movzx eax, dl
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push ecx
mov ecx, 0x46a0b4
xor ebx, ebx
call fcn.00401110
call fcn.00416870
test al, al
je 0x4136fc
mov edi, dword [ebp - 0x30]
lea esi, [ebp - 0x34]
call fcn.00426760
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
mov esi, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
add eax, 8
push eax
mov ecx, str.Microsoft_Word
mov byte [ebp - 4], 9
call fcn.00401110
mov byte [ebp - 4], 3
mov dword [ebp - 0x24], ebx
mov dword [esi + 4], edi
mov dword [esi], 0
mov eax, dword [ebp - 0x30]
inc dword [ebp - 0x2c]
test eax, eax
je 0x412b25
mov dword [eax], esi
jmp 0x412b28
mov dword [ebp - 0x34], esi
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x134]
push eax
push str.Microsoft_Word
lea eax, [ebp - 0xd8]
mov dword [ebp - 0x30], esi
call fcn.00425ac0
test eax, eax
jne 0x4136fc
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push ecx
mov ecx, 0x46cea0
call fcn.00401110
push ecx
mov byte [ebp - 4], 0xa
mov edx, esp
mov dword [ebp - 0x18], esp
push edx
mov ecx, str.00020905_0000_0000_C000_000000000046
call fcn.00401110
push ecx
mov byte [ebp - 4], 0xb
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
mov esi, str.winword.exe
call fcn.0041d6f0
lea ecx, [ebp - 0x88]
mov bl, 3
push ecx
mov byte [ebp - 4], bl
call fcn.00416a00
mov edx, dword [ebp + 0x10]
mov byte [ebp - 4], 0xc
mov ecx, dword [eax]
push edx
mov edx, str.Microsoft_Word
call fcn.00423890
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x88]
jmp 0x412e13
push str.infopath
push esi
call fcn.0044646f
add esp, 8
test eax, eax
jne 0x412d31
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x124], eax
sete dl
movzx eax, dl
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push ecx
mov ecx, 0x46a10c
xor ebx, ebx
call fcn.00401110
call fcn.00416870
test al, al
je 0x4136fc
push str.Microsoft_Office_InfoPath
lea ecx, [ebp - 0x34]
call fcn.00423b40
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x108]
push eax
push str.Microsoft_Office_InfoPath
lea eax, [ebp - 0xe0]
call fcn.00425ac0
test eax, eax
jne 0x4136fc
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push ecx
mov ecx, 0x46cea0
call fcn.00401110
push ecx
mov byte [ebp - 4], 0xd
mov edx, esp
mov dword [ebp - 0x18], esp
push edx
mov ecx, str.FD34A360_115F_43CA_8D6F_BBD45FD6F828
call fcn.00401110
push ecx
mov byte [ebp - 4], 0xe
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
mov esi, str.infopath.exe
call fcn.0041d6f0
lea ecx, [ebp - 0x74]
push ecx
mov byte [ebp - 4], 3
call fcn.00416a00
mov bl, 0xf
mov byte [ebp - 4], bl
mov edx, dword [ebp - 0x74]
cmp dword [edx - 0xc], 0
jne 0x412d04
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, 0x46cea0
call fcn.00401110
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x18], esp
push ecx
mov ecx, str.FD34A370_115F_43CA_8D6F_BBD45FD6F828
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x11
mov edx, esp
mov dword [ebp - 0x1c], esp
push edx
call fcn.0041d6f0
lea eax, [ebp - 0xb4]
push eax
mov byte [ebp - 4], bl
call fcn.00416a00
lea edi, [ebp - 0x74]
mov byte [ebp - 4], 0x12
call fcn.0041db20
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0xb4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412d04
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 0x74]
mov edx, str.Microsoft_Office_InfoPath
call fcn.00423890
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x74]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x412e23
push str.access
push esi
call fcn.0044646f
add esp, 8
test eax, eax
jne 0x412e38
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x124], eax
sete dl
movzx eax, dl
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push ecx
mov ecx, 0x46a17c
xor ebx, ebx
call fcn.00401110
call fcn.00416870
test al, al
je 0x4136fc
push str.Microsoft_Access
lea ecx, [ebp - 0x34]
call fcn.00423b40
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x120]
push eax
push str.Microsoft_Access
lea eax, [ebp - 0xd0]
call fcn.00425ac0
test eax, eax
jne 0x4136fc
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push ecx
mov ecx, 0x46cea0
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x13
mov edx, esp
mov dword [ebp - 0x18], esp
push edx
mov ecx, str.4AFFC9A0_5F99_101B_AF4E_00AA003F0F07
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x14
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
mov esi, str.msaccess.exe
call fcn.0041d6f0
lea ecx, [ebp - 0x84]
mov bl, 3
push ecx
mov byte [ebp - 4], bl
call fcn.00416a00
mov edx, dword [ebp + 0x10]
mov byte [ebp - 4], 0x15
mov ecx, dword [eax]
push edx
mov edx, str.Microsoft_Access
call fcn.00423890
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x84]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4136fc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4136fc
push str.outlook
push esi
call fcn.0044646f
add esp, 8
test eax, eax
jne 0x412f1f
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x124], eax
sete dl
movzx eax, dl
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push ecx
mov ecx, 0x46a1dc
xor ebx, ebx
call fcn.00401110
call fcn.00416870
test al, al
je 0x4136fc
push str.Microsoft_Outlook
lea ecx, [ebp - 0x34]
call fcn.00423b40
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x110]
push eax
push str.Microsoft_Outlook
lea eax, [ebp - 0xf0]
call fcn.00425ac0
test eax, eax
jne 0x4136fc
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push ecx
mov ecx, 0x46cea0
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x16
mov edx, esp
mov dword [ebp - 0x18], esp
push edx
mov ecx, str.00062FFF_0000_0000_C000_000000000046
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x17
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
mov esi, str.outlook.exe
call fcn.0041d6f0
lea ecx, [ebp - 0xa0]
mov bl, 3
push ecx
mov byte [ebp - 4], bl
call fcn.00416a00
mov edx, dword [ebp + 0x10]
mov byte [ebp - 4], 0x18
mov ecx, dword [eax]
push edx
mov edx, str.Microsoft_Outlook
call fcn.00423890
mov byte [ebp - 4], bl
lea eax, [ebp - 0xa0]
jmp 0x4136f7
push str.powerpoint
push esi
call fcn.0044646f
add esp, 8
test eax, eax
jne 0x413009
mov eax, dword [ebp + 8]
cmp dword [eax + 0x124], 0
sete cl
movzx edx, cl
push edx
xor ebx, ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, 0x46a23c
call fcn.00401110
call fcn.00416870
test al, al
je 0x4136fc
push str.Microsoft_PowerPoint
lea ecx, [ebp - 0x34]
call fcn.00423b40
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x130]
push edx
push str.Microsoft_PowerPoint
lea eax, [ebp - 0xf8]
call fcn.00425ac0
test eax, eax
jne 0x4136fc
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, 0x46cea0
call fcn.00401110
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x18], esp
push ecx
mov ecx, str.91493440_5A91_11CF_8700_00AA0060263B
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x1a
mov edx, esp
mov dword [ebp - 0x1c], esp
push edx
mov esi, str.powerpnt.exe
call fcn.0041d6f0
lea eax, [ebp - 0x90]
mov bl, 3
push eax
mov byte [ebp - 4], bl
call fcn.00416a00
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 0x1b
mov eax, dword [eax]
push ecx
mov ecx, eax
mov edx, str.Microsoft_PowerPoint
call fcn.00423890
mov byte [ebp - 4], bl
lea eax, [ebp - 0x90]
jmp 0x4136f7
push str.publisher
push esi
call fcn.0044646f
add esp, 8
test eax, eax
jne 0x4130f2
mov edx, dword [ebp + 8]
cmp dword [edx + 0x124], eax
sete al
movzx ecx, al
push ecx
push ecx
mov edx, esp
mov dword [ebp - 0x14], esp
push edx
mov ecx, 0x46a2a8
xor ebx, ebx
call fcn.00401110
call fcn.00416870
test al, al
je 0x4136fc
push str.Microsoft_Publisher
lea ecx, [ebp - 0x34]
call fcn.00423b40
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x118]
push ecx
mov ecx, dword [ebp + 0x10]
push str.Microsoft_Publisher
lea eax, [ebp - 0x100]
call fcn.00425ac0
test eax, eax
jne 0x4136fc
push ecx
mov edx, esp
mov dword [ebp - 0x14], esp
push edx
mov ecx, 0x46cea0
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x1c
mov eax, esp
mov dword [ebp - 0x18], esp
push eax
mov ecx, str.0002123C_0000_0000_C000_000000000046
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x1d
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ecx
mov esi, str.mspub.exe
call fcn.0041d6f0
lea edx, [ebp - 0xb0]
mov bl, 3
push edx
mov byte [ebp - 4], bl
call fcn.00416a00
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 0x1e
mov eax, dword [eax]
push ecx
mov ecx, eax
mov edx, str.Microsoft_Publisher
call fcn.00423890
mov byte [ebp - 4], bl
lea eax, [ebp - 0xb0]
jmp 0x4136f7
lea edx, [ebp - 0x38]
push edx
mov ecx, str.project
call fcn.0041dc60
test eax, eax
jne 0x4131dc
mov eax, dword [ebp + 8]
cmp dword [eax + 0x124], 0
sete cl
movzx edx, cl
push edx
xor ebx, ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, 0x46a300
call fcn.00401110
call fcn.00416870
test al, al
je 0x4136fc
push str.Microsoft_Project
lea ecx, [ebp - 0x34]
call fcn.00423b40
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x128]
push edx
push str.Microsoft_Project
lea eax, [ebp - 0xd4]
call fcn.00425ac0
test eax, eax
jne 0x4136fc
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, 0x46cea0
call fcn.00401110
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x18], esp
push ecx
mov ecx, str.A7107640_94DF_1068_855E_00DD01075445
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x20
mov edx, esp
mov dword [ebp - 0x1c], esp
push edx
mov esi, str.msproject.exe
call fcn.0041d6f0
lea eax, [ebp - 0x98]
mov bl, 3
push eax
mov byte [ebp - 4], bl
call fcn.00416a00
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 0x21
mov eax, dword [eax]
push ecx
mov ecx, eax
mov edx, str.Microsoft_Project
call fcn.00423890
mov byte [ebp - 4], bl
lea eax, [ebp - 0x98]
jmp 0x4136f7
lea edx, [ebp - 0x38]
push edx
mov ecx, str.mappoint
call fcn.0041dc60
test eax, eax
jne 0x4132c6
mov eax, dword [ebp + 8]
cmp dword [eax + 0x124], 0
sete cl
movzx edx, cl
push edx
xor ebx, ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, 0x46a364
call fcn.00401110
call fcn.00416870
test al, al
je 0x4136fc
push str.Microsoft_MapPoint
lea ecx, [ebp - 0x34]
call fcn.00423b40
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0xdc]
push edx
push str.Microsoft_MapPoint
lea eax, [ebp - 0xe4]
call fcn.00425ac0
test eax, eax
jne 0x4136fc
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, 0x46cea0
call fcn.00401110
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x18], esp
push ecx
mov ecx, str.15A40120_24D2_4FDB_8155_5F65FCE7017F
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x23
mov edx, esp
mov dword [ebp - 0x1c], esp
push edx
mov esi, str.mappoint.exe
call fcn.0041d6f0
lea eax, [ebp - 0xa8]
mov bl, 3
push eax
mov byte [ebp - 4], bl
call fcn.00416a00
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 0x24
mov eax, dword [eax]
push ecx
mov ecx, eax
mov edx, str.Microsoft_MapPoint
call fcn.00423890
mov byte [ebp - 4], bl
lea eax, [ebp - 0xa8]
jmp 0x4136f7
lea edx, [ebp - 0x38]
push edx
mov ecx, str.visio
call fcn.0041dc60
test eax, eax
jne 0x4133aa
mov eax, dword [ebp + 8]
cmp dword [eax + 0x124], 0
sete cl
movzx edx, cl
push edx
xor ebx, ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, 0x46a3c4
call fcn.00401110
call fcn.00416870
test al, al
je 0x4136fc
push str.Microsoft_Visio
lea ecx, [ebp - 0x34]
call fcn.00423b40
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0xec]
push edx
push str.Microsoft_Visio
lea eax, [ebp - 0xf4]
call fcn.00425ac0
test eax, eax
jne 0x4136fc
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, 0x46cea0
call fcn.00401110
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x18], esp
push ecx
mov ecx, str.00021A98_0000_0000_C000_000000000046
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x26
mov edx, esp
mov dword [ebp - 0x1c], esp
push edx
mov esi, str.visio.exe
call fcn.0041d6f0
lea eax, [ebp - 0x80]
mov bl, 3
push eax
mov byte [ebp - 4], bl
call fcn.00416a00
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 0x27
mov eax, dword [eax]
push ecx
mov ecx, eax
mov edx, str.Microsoft_Visio
call fcn.00423890
mov byte [ebp - 4], bl
lea eax, [ebp - 0x80]
jmp 0x4136f7
lea edx, [ebp - 0x38]
push edx
mov ecx, str.frontpage
call fcn.0041dc60
test eax, eax
jne 0x413494
mov eax, dword [ebp + 8]
cmp dword [eax + 0x124], 0
sete cl
movzx edx, cl
push edx
xor ebx, ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, 0x46a418
call fcn.00401110
call fcn.00416870
test al, al
je 0x4136fc
push str.Microsoft_FrontPage
lea ecx, [ebp - 0x34]
call fcn.00423b40
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0xfc]
push edx
push str.Microsoft_FrontPage
lea eax, [ebp - 0x104]
call fcn.00425ac0
test eax, eax
jne 0x4136fc
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, 0x46cea0
call fcn.00401110
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x18], esp
push ecx
mov ecx, str.3824BCD5_7042_11CE_8E17_0020AF9F9648
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x29
mov edx, esp
mov dword [ebp - 0x1c], esp
push edx
mov esi, str.frontpage.exe
call fcn.0041d6f0
lea eax, [ebp - 0x8c]
mov bl, 3
push eax
mov byte [ebp - 4], bl
call fcn.00416a00
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 0x2a
mov eax, dword [eax]
push ecx
mov ecx, eax
mov edx, str.Microsoft_FrontPage
call fcn.00423890
mov byte [ebp - 4], bl
lea eax, [ebp - 0x8c]
jmp 0x4136f7
lea edx, [ebp - 0x38]
push edx
mov ecx, str.onenote
call fcn.0041dc60
test eax, eax
jne 0x413578
mov eax, dword [ebp + 8]
cmp dword [eax + 0x124], 0
sete cl
movzx edx, cl
push edx
xor ebx, ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, 0x46a47c
call fcn.00401110
call fcn.00416870
test al, al
je 0x4136fc
push str.Microsoft_OneNote
lea ecx, [ebp - 0x34]
call fcn.00423b40
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x10c]
push edx
push str.Microsoft_OneNote
lea eax, [ebp - 0x114]
call fcn.00425ac0
test eax, eax
jne 0x4136fc
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, 0x46cea0
call fcn.00401110
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0x18], esp
push ecx
mov ecx, 0x46cea0
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x2c
mov edx, esp
mov dword [ebp - 0x1c], esp
push edx
mov esi, str.onenote.exe
call fcn.0041d6f0
lea eax, [ebp - 0x7c]
mov bl, 3
push eax
mov byte [ebp - 4], bl
call fcn.00416a00
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 0x2d
mov eax, dword [eax]
push ecx
mov ecx, eax
mov edx, str.Microsoft_OneNote
call fcn.00423890
mov byte [ebp - 4], bl
lea eax, [ebp - 0x7c]
jmp 0x4136f7
lea edx, [ebp - 0x38]
push edx
mov ecx, str.internet_explorer
call fcn.0041dc60
test eax, eax
je 0x4135a0
lea eax, [ebp - 0x38]
push eax
mov ecx, str.internetexplorer
call fcn.0041dc60
test eax, eax
jne 0x4136fc
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x124], 0
sete dl
movzx eax, dl
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push ecx
mov ecx, 0x46a50c
xor ebx, ebx
call fcn.00401110
call fcn.00416870
test al, al
je 0x4136fc
push str.Internet_Explorer
lea ecx, [ebp - 0x34]
call fcn.00423b40
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x11c]
push eax
push str.Internet_Explorer
lea eax, [ebp - 0x124]
call fcn.00425ac0
test eax, eax
jne 0x4136fc
lea esi, [ebp - 0x44]
call fcn.0041dae0
mov bl, 0x2e
mov byte [ebp - 4], bl
mov esi, dword [ebp - 0x44]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x413638
mov eax, 0x104
lea ecx, [ebp - 0x44]
call fcn.00401440
mov esi, dword [ebp - 0x44]
push esi
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHFOLDER.dll_SHGetFolderPathW]
test eax, eax
jne 0x413683
mov eax, dword [esi - 8]
push eax
push esi
call fcn.004469ac
add esp, 8
test eax, eax
js 0x41442f
cmp eax, dword [esi - 8]
jg 0x41442f
lea edx, [ebp - 0x44]
xor ecx, ecx
push edx
mov dword [esi - 0xc], eax
mov edx, str.Internet_Exploreriexplore.exe
mov word [esi + eax*2], cx
call fcn.0041e6d0
mov esi, dword [ebp - 0x44]
push ecx
lea eax, [esi - 0x10]
mov dword [ebp - 0x14], esp
mov edi, esp
call fcn.004218e0
add eax, 0x10
mov dword [edi], eax
push ecx
mov byte [ebp - 4], 0x2f
mov eax, esp
mov dword [ebp - 0x18], esp
push eax
mov ecx, str.EAB22AC0_30C1_11CF_A7EB_0000C05BAE0B
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x30
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ecx
mov esi, str.iexplore.exe
call fcn.0041d6f0
lea edx, [ebp - 0x9c]
push edx
mov byte [ebp - 4], bl
call fcn.00416a00
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 0x31
mov eax, dword [eax]
push ecx
mov ecx, eax
mov edx, str.Internet_Explorer
call fcn.00423890
lea eax, [ebp - 0x9c]
call fcn.0041d790
mov byte [ebp - 4], 3
lea eax, [ebp - 0x44]
call fcn.0041d790
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0xc4]
inc ecx
xor edi, edi
mov dword [ebp - 0x40], ecx
cmp ecx, eax
jb 0x41289f
mov eax, dword [ebp - 0x2c]
cmp eax, edi
jbe 0x414337
cmp byte [ebp + 0xf], 0
jne 0x41432a
mov edx, dword [0x478034]
mov eax, dword [edx + 0xc]
mov ecx, 0x478034
mov byte [ebp + 0xf], 1
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov esi, str._host_
shr esi, 0x10
mov byte [ebp - 4], 0x32
cmp esi, edi
jne 0x413770
mov ecx, str._host_
movzx edi, cx
call fcn.004014d0
test eax, eax
je 0x413783
push eax
mov eax, edi
lea edi, [ebp - 0x14]
call fcn.00401290
jmp 0x413783
push str._host_
lea edx, [ebp - 0x14]
push edx
mov ebx, 6
call fcn.00401330
mov byte [ebp - 4], 0x33
mov eax, dword [0x478034]
mov edx, dword [eax + 0xc]
mov ecx, 0x478034
call edx
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x34
test esi, esi
jne 0x4137c2
mov eax, str._host_
movzx edi, ax
call fcn.004014d0
test eax, eax
je 0x4137d5
push eax
mov eax, edi
lea edi, [ebp - 0x18]
call fcn.00401290
jmp 0x4137d5
push str._host_
lea ecx, [ebp - 0x18]
push ecx
mov ebx, 6
call fcn.00401330
mov byte [ebp - 4], 0x35
mov edx, dword [0x478034]
mov eax, dword [edx + 0xc]
mov ecx, 0x478034
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0x36
test esi, esi
jne 0x413815
mov ecx, str._host_
movzx edi, cx
call fcn.004014d0
test eax, eax
je 0x413828
push eax
mov eax, edi
lea edi, [ebp - 0x1c]
call fcn.00401290
jmp 0x413828
push str._host_
lea edx, [ebp - 0x1c]
push edx
mov ebx, 6
call fcn.00401330
mov byte [ebp - 4], 0x37
mov eax, dword [0x478034]
mov edx, dword [eax + 0xc]
mov ecx, 0x478034
call edx
add eax, 0x10
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 0x38
test esi, esi
jne 0x413867
mov eax, str._host_
movzx edi, ax
call fcn.004014d0
test eax, eax
je 0x41387a
push eax
mov eax, edi
lea edi, [ebp - 0x60]
call fcn.00401290
jmp 0x41387a
push str._host_
lea ecx, [ebp - 0x60]
push ecx
mov ebx, 6
call fcn.00401330
mov byte [ebp - 4], 0x39
mov edx, dword [0x478034]
mov eax, dword [edx + 0xc]
mov ecx, 0x478034
call eax
add eax, 0x10
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 0x3a
test esi, esi
jne 0x4138ba
mov ecx, str._host_
movzx edi, cx
call fcn.004014d0
test eax, eax
je 0x4138cd
push eax
mov eax, edi
lea edi, [ebp - 0x5c]
call fcn.00401290
jmp 0x4138cd
push str._host_
lea edx, [ebp - 0x5c]
push edx
mov ebx, 6
call fcn.00401330
mov byte [ebp - 4], 0x3b
mov eax, dword [0x478034]
mov edx, dword [eax + 0xc]
mov ecx, 0x478034
call edx
add eax, 0x10
mov dword [ebp - 0x6c], eax
mov byte [ebp - 4], 0x3c
test esi, esi
jne 0x41390c
mov eax, str._host_
movzx edi, ax
call fcn.004014d0
test eax, eax
je 0x41391f
push eax
mov eax, edi
lea edi, [ebp - 0x6c]
call fcn.00401290
jmp 0x41391f
push str._host_
lea ecx, [ebp - 0x6c]
push ecx
mov ebx, 6
call fcn.00401330
mov byte [ebp - 4], 0x3d
mov edx, dword [0x478034]
mov eax, dword [edx + 0xc]
mov ecx, 0x478034
call eax
add eax, 0x10
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 0x3e
test esi, esi
jne 0x41395f
mov ecx, str._host_
movzx edi, cx
call fcn.004014d0
test eax, eax
je 0x413972
push eax
mov eax, edi
lea edi, [ebp - 0x4c]
call fcn.00401290
jmp 0x413972
push str._host_
lea edx, [ebp - 0x4c]
push edx
mov ebx, 6
call fcn.00401330
mov byte [ebp - 4], 0x3f
mov eax, dword [0x478034]
mov edx, dword [eax + 0xc]
mov ecx, 0x478034
call edx
add eax, 0x10
mov dword [ebp - 0x64], eax
mov byte [ebp - 4], 0x40
test esi, esi
jne 0x4139b1
mov eax, str._host_
movzx edi, ax
call fcn.004014d0
test eax, eax
je 0x4139c4
push eax
mov eax, edi
lea edi, [ebp - 0x64]
call fcn.00401290
jmp 0x4139c4
push str._host_
lea ecx, [ebp - 0x64]
push ecx
mov ebx, 6
call fcn.00401330
mov byte [ebp - 4], 0x41
mov edx, dword [0x478034]
mov eax, dword [edx + 0xc]
mov ecx, 0x478034
call eax
add eax, 0x10
mov dword [ebp - 0x70], eax
mov byte [ebp - 4], 0x42
test esi, esi
jne 0x413a04
mov ecx, str._host_
movzx edi, cx
call fcn.004014d0
test eax, eax
je 0x413a17
push eax
mov eax, edi
lea edi, [ebp - 0x70]
call fcn.00401290
jmp 0x413a17
push str._host_
lea edx, [ebp - 0x70]
push edx
mov ebx, 6
call fcn.00401330
mov byte [ebp - 4], 0x43
mov eax, dword [0x478034]
mov edx, dword [eax + 0xc]
mov ecx, 0x478034
call edx
add eax, 0x10
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 0x44
test esi, esi
jne 0x413a56
mov eax, str._host_
movzx edi, ax
call fcn.004014d0
test eax, eax
je 0x413a69
push eax
mov eax, edi
lea edi, [ebp - 0x58]
call fcn.00401290
jmp 0x413a69
push str._host_
lea ecx, [ebp - 0x58]
push ecx
mov ebx, 6
call fcn.00401330
mov byte [ebp - 4], 0x45
mov edx, dword [0x478034]
mov eax, dword [edx + 0xc]
mov ecx, 0x478034
call eax
add eax, 0x10
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 0x46
test esi, esi
jne 0x413aa9
mov ecx, str._host_
movzx edi, cx
call fcn.004014d0
test eax, eax
je 0x413abc
push eax
mov eax, edi
lea edi, [ebp - 0x50]
call fcn.00401290
jmp 0x413abc
push str._host_
lea edx, [ebp - 0x50]
push edx
mov ebx, 6
call fcn.00401330
mov byte [ebp - 4], 0x47
mov eax, dword [0x478034]
mov edx, dword [eax + 0xc]
mov ecx, 0x478034
call edx
add eax, 0x10
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 0x48
test esi, esi
jne 0x413afb
mov eax, str._host_
movzx edi, ax
call fcn.004014d0
test eax, eax
je 0x413b0e
push eax
mov eax, edi
lea edi, [ebp - 0x68]
call fcn.00401290
jmp 0x413b0e
push str._host_
lea ecx, [ebp - 0x68]
push ecx
mov ebx, 6
call fcn.00401330
mov byte [ebp - 4], 0x49
mov edx, dword [0x478034]
mov eax, dword [edx + 0xc]
mov ecx, 0x478034
call eax
add eax, 0x10
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 0x4a
test esi, esi
jne 0x413b4e
mov ecx, str._host_
movzx edi, cx
call fcn.004014d0
test eax, eax
je 0x413b61
push eax
mov eax, edi
lea edi, [ebp - 0x54]
call fcn.00401290
jmp 0x413b61
push str._host_
lea edx, [ebp - 0x54]
push edx
mov ebx, 6
call fcn.00401330
mov byte [ebp - 4], 0x4b
mov eax, dword [0x478034]
mov edx, dword [eax + 0xc]
mov ecx, 0x478034
call edx
add eax, 0x10
mov dword [ebp - 0x40], eax
mov eax, str.You_have_the_following_applications_running_on_your_machine:_r_n___s_r_n___s_r_n___s_r_n___s_r_n___s_r_n___s_r_n___s_r_n___s_r_n___s_r_n___s_r_n___s_r_n___s_r_n___s_r_n_r_nPlease_close_the_above_application_s__for_the_update_process_to_complete._r_nDo_you_want_the_application_s__to_start_automatically_after_the_update_is_installed_
mov byte [ebp - 4], 0x4c
test eax, 0xffff0000
jne 0x413ba5
mov ecx, eax
movzx edi, cx
call fcn.004014d0
test eax, eax
je 0x413bb8
push eax
mov eax, edi
lea edi, [ebp - 0x40]
call fcn.00401290
jmp 0x413bb8
push str.You_have_the_following_applications_running_on_your_machine:_r_n___s_r_n___s_r_n___s_r_n___s_r_n___s_r_n___s_r_n___s_r_n___s_r_n___s_r_n___s_r_n___s_r_n___s_r_n___s_r_n_r_nPlease_close_the_above_application_s__for_the_update_process_to_complete._r_nDo_you_want_the_application_s__to_start_automatically_after_the_update_is_installed_
lea edx, [ebp - 0x40]
push edx
mov ebx, 0x12d
call fcn.00401330
mov byte [ebp - 4], 0x4d
mov eax, dword [ebp - 0x2c]
xor esi, esi
test eax, eax
je 0x413e67
lea esp, [esp]
cmp esi, 0xc
ja case.default.0x413bd9
jmp dword [esi*4 + 0x414440]
test eax, eax
je 0x413be7
mov eax, dword [ebp - 0x34]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x414425
lea edi, [ebp - 0x14]
jmp 0x413e53
cmp eax, 1
ja 0x413c07
xor eax, eax
jmp 0x413c10
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x413c10
mov eax, dword [eax]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x414425
lea edi, [ebp - 0x18]
jmp 0x413e53
cmp eax, 2
ja 0x413c30
xor eax, eax
jmp 0x413c3b
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x413c3b
mov eax, dword [eax]
mov eax, dword [eax]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x414425
lea edi, [ebp - 0x1c]
jmp 0x413e53
cmp eax, 3
ja 0x413c5b
xor eax, eax
jmp 0x413c68
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x413c68
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x414425
lea edi, [ebp - 0x60]
jmp 0x413e53
cmp eax, 4
ja 0x413c88
xor eax, eax
jmp 0x413c97
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x413c97
mov eax, dword [eax]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x414425
lea edi, [ebp - 0x5c]
jmp 0x413e53
cmp eax, 5
ja 0x413cb7
xor eax, eax
jmp 0x413cc8
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x413cc8
mov eax, dword [eax]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx]
mov eax, dword [eax]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x414425
lea edi, [ebp - 0x6c]
jmp 0x413e53
cmp eax, 6
ja 0x413ce8
xor eax, eax
jmp 0x413cfb
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x413cfb
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x414425
lea edi, [ebp - 0x4c]
jmp 0x413e53
cmp eax, 7
ja 0x413d1b
xor eax, eax
jmp 0x413d30
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x413d30
mov eax, dword [eax]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x414425
lea edi, [ebp - 0x64]
jmp 0x413e53
cmp eax, 8
ja 0x413d50
xor eax, eax
jmp 0x413d67
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x413d67
mov eax, dword [eax]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx]
mov eax, dword [eax]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x414425
lea edi, [ebp - 0x70]
jmp 0x413e53
cmp eax, 9
ja 0x413d87
xor eax, eax
jmp 0x413da0
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x413da0
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x414425
lea edi, [ebp - 0x58]
jmp 0x413e53
cmp eax, 0xa
ja 0x413dc0
xor eax, eax
jmp 0x413ddb
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x413ddb
mov eax, dword [eax]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x414425
lea edi, [ebp - 0x50]
jmp 0x413e53
cmp eax, 0xb
ja 0x413df8
xor eax, eax
jmp 0x413e09
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x413e09
mov ecx, 0xb
dec ecx
mov eax, dword [eax]
jne 0x413e04
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x414425
lea edi, [ebp - 0x68]
jmp 0x413e53
cmp eax, 0xc
ja 0x413e26
xor eax, eax
jmp 0x413e41
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x413e41
mov ecx, 2
dec ecx
mov eax, dword [eax]
mov edx, dword [eax]
mov eax, dword [edx]
mov edx, dword [eax]
mov eax, dword [edx]
mov eax, dword [eax]
jne 0x413e32
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x414425
lea edi, [ebp - 0x54]
add eax, 8
call fcn.0041db20
mov eax, dword [ebp - 0x2c]
inc esi
cmp esi, eax
jb 0x413bd0
mov edx, dword [0x478034]
mov eax, dword [edx + 0xc]
mov ecx, 0x478034
call eax
add eax, 0x10
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 0x4e
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x50]
push ecx
mov ecx, dword [ebp - 0x58]
push edx
mov edx, dword [ebp - 0x70]
push eax
mov eax, dword [ebp - 0x64]
push ecx
mov ecx, dword [ebp - 0x4c]
push edx
mov edx, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x5c]
push ecx
mov ecx, dword [ebp - 0x60]
push edx
mov edx, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x14]
push edx
mov edx, dword [ebp - 0x40]
push eax
push ecx
push edx
lea edi, [ebp - 0x3c]
call fcn.00422e30
mov edi, dword [ebp - 0x3c]
add esp, 0x38
cmp dword [edi - 0xc], 0
jl 0x4140fa
push str._host_
push edi
call fcn.00446659
add esp, 8
test eax, eax
je 0x4140fa
sub eax, edi
sar eax, 1
js 0x4140fa
lea ecx, [ebp - 0xa4]
lea edx, [ebp - 0x3c]
call fcn.0041e3e0
mov ebx, eax
mov byte [ebp - 4], 0x4f
call fcn.004202e0
mov ebx, eax
call fcn.00420360
mov esi, dword [eax]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
cmp dword [esi - 4], 0
lea edx, [esi - 4]
jl 0x413f39
cmp eax, dword [esi - 0x10]
jne 0x413f39
lea ebx, [esi - 0x10]
mov eax, 1
lock xadd dword [edx], eax
jmp 0x413f71
mov ecx, dword [esi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
je 0x414439
mov eax, dword [esi - 0xc]
mov dword [ebx + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [ebx + 0x10]
push eax
call fcn.004454a7
add esp, 0x10
lea esi, [ebx + 0x10]
mov dword [ebp - 0x48], esi
mov byte [ebp - 4], 0x51
mov eax, dword [ebp - 0xa4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413f9d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi - 0xc]
lea eax, [ecx - 1]
test eax, eax
js 0x41442f
cmp eax, ecx
jg 0x41442f
cmp word [esi + eax*2], 0xa
jne 0x413fcc
lea edx, [ebp - 0x48]
dec ecx
push edx
mov eax, 1
call fcn.0041dc90
mov esi, dword [ebp - 0x48]
mov ecx, dword [esi - 0xc]
lea eax, [ecx - 1]
test eax, eax
js 0x41442f
cmp eax, ecx
jg 0x41442f
cmp word [esi + eax*2], 0xd
jne 0x413ffb
lea eax, [ebp - 0x48]
push eax
dec ecx
mov eax, 1
call fcn.0041dc90
mov esi, dword [ebp - 0x48]
or ebx, 0xffffffff
xor eax, eax
mov ecx, dword [edi - 0xc]
test eax, eax
js 0x41402d
cmp eax, ecx
jg 0x41402d
lea ecx, [edi + eax*2]
push str._host_
push ecx
call fcn.00446659
add esp, 8
test eax, eax
je 0x41402d
sub eax, edi
sar eax, 1
js 0x41402d
mov ebx, eax
add eax, 6
jmp 0x414000
cmp ebx, 0xffffffff
je 0x4140da
lea edx, [ebp - 0x3c]
lea eax, [ebx + 6]
push edx
xor ecx, ecx
call fcn.0041dc90
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0xac]
push ecx
lea ebx, [ebp - 0x48]
call fcn.0041e450
add esp, 8
mov byte [ebp - 4], 0x52
mov ecx, dword [eax]
mov edi, dword [ebp - 0x3c]
lea eax, [ecx - 0x10]
lea ebx, [edi - 0x10]
cmp eax, ebx
je 0x4140b4
cmp dword [ebx + 0xc], 0
lea edi, [ebx + 0xc]
jl 0x4140a4
mov edx, dword [eax]
cmp edx, dword [ebx]
jne 0x4140a4
call fcn.004218e0
mov esi, eax
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x414099
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
lea edi, [esi + 0x10]
mov esi, dword [ebp - 0x48]
mov dword [ebp - 0x3c], edi
jmp 0x4140b4
mov ebx, dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00401330
mov edi, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x51
mov eax, dword [ebp - 0xac]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4140da
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0x4e
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4140fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x47b758]
mov esi, dword [ebp + 8]
mov edx, dword [esi + 0x40]
push 0x134
push ecx
push edi
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x414120
mov byte [esi + 0x10d], 1
add edi, 0xfffffff0
mov byte [ebp - 4], 0x4d
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x414140
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov byte [ebp - 4], 0x4b
mov eax, dword [ebp - 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414163
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x49
mov eax, dword [ebp - 0x54]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414186
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x47
mov eax, dword [ebp - 0x68]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4141a9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x45
mov eax, dword [ebp - 0x50]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4141cc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x43
mov eax, dword [ebp - 0x58]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4141ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x41
mov eax, dword [ebp - 0x70]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414212
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x3f
mov eax, dword [ebp - 0x64]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414235
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414258
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x3b
mov eax, dword [ebp - 0x6c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41427b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x39
mov eax, dword [ebp - 0x5c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41429e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x37
mov eax, dword [ebp - 0x60]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4142c1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x35
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4142e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x33
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414307
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41432a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x2c]
xor edi, edi
cmp eax, edi
ja 0x412800
mov byte [ebp - 4], 2
cmp eax, edi
jbe 0x414395
mov edi, 1
mov esi, dword [ebp - 0x34]
xor eax, eax
test esi, esi
setne al
test eax, eax
je 0x414425
mov ecx, dword [esi]
mov dword [ebp - 0x34], ecx
mov eax, dword [esi + 8]
sub eax, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41437a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x24]
mov dword [esi], ecx
sub dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], esi
jne 0x41438f
lea esi, [ebp - 0x34]
call fcn.00423bd0
cmp dword [ebp - 0x2c], 0
ja 0x414344
mov eax, dword [ebp - 0x28]
xor edi, edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x24], edi
cmp eax, edi
je 0x4143bb
mov esi, dword [eax]
push eax
call fcn.00446332
add esp, 4
mov eax, esi
cmp esi, edi
jne 0x4143a7
mov dword [ebp - 0x28], edi
lea esi, [ebp - 0xcc]
call fcn.00423bd0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x78]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4143e9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41440f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00401680
push 0x80070057
call fcn.00401680
call fcn.00401280
mov edi, edi
loopne 0x41447d
inc ecx
add dh, bh
cmp eax, dword [ecx]
daa
cmp al, 65
add byte [edx + 0x3c], dl
inc ecx
add byte [edi + 0x3c], bh
inc ecx
add byte [esi - 0x20ffbec4], ch
cmp al, 0x41
add byte [edx], dl
cmp eax, 0x3d470041
inc ecx
add byte [esi + 0x3d], bh
inc ecx
add byte [edi - 0x10ffbec3], dh
cmp eax, 0x3e1d0041
inc ecx
add ah, cl
int3
int3