Function at 0x47c6f0
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get program files directory
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac763
mov eax, dword fs:[0]
push eax
mov eax, 0x1084
call fcn.00445e40
mov eax, dword [0x4de880]
xor eax, ebp
mov dword [ebp - 0x40], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xf00], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xf00]
call fcn.004072f0
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x60], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x4ac], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x70], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x64], eax
lea ecx, [ebp - 0x5c]
call fcn.00404240
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x498]
call fcn.00404240
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8c]
call fcn.00404240
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0xf00]
add ecx, 0x40
call fcn.00407600
mov ecx, dword [ebp - 0xf00]
add ecx, 0x34
call fcn.00414600
lea ecx, [ebp - 0x28]
call fcn.00414130
mov byte [ebp - 4], 4
lea ecx, [ebp + 0xc]
call fcn.00419eb0
test eax, eax
jne 0x47c93a
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x9a8], esp
push ecx
mov ecx, dword [ebp - 0xf00]
call fcn.00475600
mov dword [ebp - 0xf04], eax
mov ecx, dword [ebp - 0xf00]
call fcn.004763d0
mov ecx, dword [ebp - 0xf00]
call fcn.00474c80
movzx edx, al
test edx, edx
je 0x47c821
jmp 0x47c938
lea eax, [ebp - 0x6c]
push eax
push str.HOTSPOT
mov ecx, dword [ebp - 0x60]
push ecx
lea edx, [ebp - 0x9c4]
push edx
mov ecx, dword [ebp - 0xf00]
call fcn.00475d80
mov dword [ebp - 0xf08], eax
mov eax, dword [ebp - 0xf08]
mov dword [ebp - 0xf0c], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0xf0c]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.004061d0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x9c4]
call fcn.00401e40
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x60], edx
lea ecx, [ebp - 0x5c]
call fcn.004018e0
test eax, eax
jne 0x47c88b
jmp 0x47c938
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x9c8], esp
lea eax, [ebp - 0x5c]
push eax
call fcn.00403690
mov dword [ebp - 0xf10], eax
lea ecx, [ebp - 0x9e4]
push ecx
mov ecx, dword [ebp - 0xf00]
call fcn.00478860
mov dword [ebp - 0xf14], eax
mov edx, dword [ebp - 0xf14]
mov dword [ebp - 0xf18], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xf18]
push eax
lea ecx, [ebp - 0x5c]
call fcn.004061d0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x9e4]
call fcn.00401e40
lea ecx, [ebp - 0x5c]
call fcn.00401df0
push eax
call fcn.00474c60
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x47c92e
push 0
sub esp, 0x1c
mov edx, esp
mov dword [ebp - 0x9e8], esp
lea eax, [ebp - 0x5c]
push eax
push edx
call fcn.00483e20
add esp, 8
mov dword [ebp - 0xf1c], eax
mov ecx, dword [ebp - 0xf00]
call fcn.0047ab20
cmp dword [ebp - 0x6c], 0
jne 0x47c80a
jmp 0x47c99a
mov dword [ebp - 0x4b0], 0
jmp 0x47c955
mov ecx, dword [ebp - 0x4b0]
add ecx, 1
mov dword [ebp - 0x4b0], ecx
lea ecx, [ebp + 0xc]
call fcn.00419eb0
cmp dword [ebp - 0x4b0], eax
jae 0x47c99a
push 1
mov edx, dword [ebp - 0x4b0]
push edx
lea ecx, [ebp + 0xc]
call fcn.00419ef0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x9ec], esp
push eax
call fcn.00403370
mov dword [ebp - 0xf20], eax
mov ecx, dword [ebp - 0xf00]
call fcn.0047ab20
jmp 0x47c946
movzx eax, byte [ebp + 0x1c]
test eax, eax
jne 0x47c9ae
lea ecx, [ebp + 0xc]
call fcn.00419eb0
test eax, eax
je 0x47c9b3
jmp 0x47d51e
mov dword [ebp - 0x6c], 0
mov byte [ebp - 0x39], 0
mov ecx, dword [ebp - 0xf00]
call fcn.00474c80
movzx ecx, al
test ecx, ecx
je 0x47c9d5
jmp 0x47cf2b
movzx edx, byte [ebp - 0x39]
test edx, edx
jne 0x47c9f0
push str.HOTKEYHKCRInterface
lea ecx, [ebp - 0x5c]
call fcn.00406300
mov byte [ebp - 0x39], 1
jmp 0x47ca5a
lea eax, [ebp - 0x6c]
push eax
push 0x4ba5f4
mov ecx, dword [ebp - 0x70]
push ecx
lea edx, [ebp - 0xa08]
push edx
mov ecx, dword [ebp - 0xf00]
call fcn.00475d80
mov dword [ebp - 0xf24], eax
mov eax, dword [ebp - 0xf24]
mov dword [ebp - 0xf28], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0xf28]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.004061d0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa08]
call fcn.00401e40
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x70], edx
lea ecx, [ebp - 0x5c]
call fcn.004018e0
test eax, eax
jne 0x47ca5a
jmp 0x47cf2b
push str.HOTKEY
lea ecx, [ebp - 0xa24]
call fcn.004021a0
mov byte [ebp - 4], 8
push 0
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x498]
push ecx
lea edx, [ebp - 0xa24]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xa28], esp
lea eax, [ebp - 0x5c]
push eax
call fcn.00403690
mov dword [ebp - 0xf2c], eax
mov ecx, dword [ebp - 0xf00]
call fcn.004782b0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa24]
call fcn.00401e40
mov dword [ebp - 0x8e0], 0
mov dword [ebp - 0x4b8], 0x400
mov dword [ebp - 0x8e8], 0
lea ecx, [ebp - 0x8e8]
push ecx
lea ecx, [ebp - 0x8e4]
call fcn.00403fb0
mov byte [ebp - 4], 9
push 4
push 0
lea edx, [ebp - 0xa44]
push edx
lea ecx, [ebp - 0x498]
call fcn.0040dbc0
mov dword [ebp - 0xf30], eax
mov eax, dword [ebp - 0xf30]
mov dword [ebp - 0xf34], eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0xf34]
push ecx
mov ecx, dword [ebp - 0xf00]
call fcn.00475020
mov dword [ebp - 0x4b4], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa44]
call fcn.00401e40
push 0xffffffffffffffff
push 5
lea edx, [ebp - 0xa60]
push edx
lea ecx, [ebp - 0x498]
call fcn.0040dbc0
mov dword [ebp - 0xf38], eax
mov eax, dword [ebp - 0xf38]
mov dword [ebp - 0xf3c], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0xf3c]
push ecx
lea ecx, [ebp - 0x498]
call fcn.004061d0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa60]
call fcn.00401e40
lea edx, [ebp - 0x8e8]
push edx
lea ecx, [ebp - 0x498]
call fcn.00401df0
push eax
mov eax, dword [ebp - 0x4b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [ebp - 0x4d4]
call fcn.00404240
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x4b8]
push ecx
lea edx, [ebp - 0x8dc]
push edx
mov eax, dword [ebp - 0x8e0]
push eax
mov ecx, dword [ebp - 0x8e8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4d8], 0
jne 0x47cbf9
cmp dword [ebp - 0x4d8], 0x103
jne 0x47cbfe
jmp 0x47cee2
mov edx, dword [ebp - 0x4b4]
push edx
lea eax, [ebp - 0xa7c]
push eax
mov ecx, dword [ebp - 0xf00]
call fcn.00475520
mov dword [ebp - 0xf40], eax
mov ecx, dword [ebp - 0xf40]
mov dword [ebp - 0xf44], ecx
mov byte [ebp - 4], 0xd
push 0x4ba608
mov edx, dword [ebp - 0xf44]
push edx
lea eax, [ebp - 0xa98]
push eax
call fcn.00405970
add esp, 0xc
mov dword [ebp - 0xf48], eax
mov ecx, dword [ebp - 0xf48]
mov dword [ebp - 0xf4c], ecx
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0x498]
push edx
mov eax, dword [ebp - 0xf4c]
push eax
lea ecx, [ebp - 0xab4]
push ecx
call fcn.0040b8f0
add esp, 0xc
mov dword [ebp - 0xf50], eax
mov edx, dword [ebp - 0xf50]
mov dword [ebp - 0xf54], edx
mov byte [ebp - 4], 0xf
push 0x4ba604
mov eax, dword [ebp - 0xf54]
push eax
lea ecx, [ebp - 0xad0]
push ecx
call fcn.00405970
add esp, 0xc
mov dword [ebp - 0xf58], eax
mov edx, dword [ebp - 0xf58]
mov dword [ebp - 0xf5c], edx
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x8dc]
push eax
mov ecx, dword [ebp - 0xf5c]
push ecx
lea edx, [ebp - 0xaec]
push edx
call fcn.00405970
add esp, 0xc
mov dword [ebp - 0xf60], eax
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0xf64], eax
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0xf64]
push ecx
lea edx, [ebp - 0xb08]
push edx
call fcn.004a2e50
add esp, 8
mov dword [ebp - 0xf68], eax
mov eax, dword [ebp - 0xf68]
mov dword [ebp - 0xf6c], eax
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0xf6c]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.004061d0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xb08]
call fcn.00401e40
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xaec]
call fcn.00401e40
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xad0]
call fcn.00401e40
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xab4]
call fcn.00401e40
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xa98]
call fcn.00401e40
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xa7c]
call fcn.00401e40
mov edx, dword [ebp - 0x4b4]
push edx
lea eax, [ebp - 0xb24]
push eax
mov ecx, dword [ebp - 0xf00]
call fcn.00475520
mov dword [ebp - 0xf70], eax
mov ecx, dword [ebp - 0xf70]
mov dword [ebp - 0xf74], ecx
mov byte [ebp - 4], 0x13
push 0x4ba60c
mov edx, dword [ebp - 0xf74]
push edx
lea eax, [ebp - 0xb40]
push eax
call fcn.00405970
add esp, 0xc
mov dword [ebp - 0xf78], eax
mov ecx, dword [ebp - 0xf78]
mov dword [ebp - 0xf7c], ecx
mov byte [ebp - 4], 0x14
lea edx, [ebp - 0x498]
push edx
mov eax, dword [ebp - 0xf7c]
push eax
lea ecx, [ebp - 0xb5c]
push ecx
call fcn.0040b8f0
add esp, 0xc
mov dword [ebp - 0xf80], eax
mov edx, dword [ebp - 0xf80]
mov dword [ebp - 0xf84], edx
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0xf84]
push eax
lea ecx, [ebp - 0x4d4]
call fcn.004061d0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xb5c]
call fcn.00401e40
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xb40]
call fcn.00401e40
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xb24]
call fcn.00401e40
mov ecx, dword [ebp - 0x8e0]
add ecx, 1
mov dword [ebp - 0x8e0], ecx
mov dword [ebp - 0x4b8], 0x105
push 0x4ba610
lea edx, [ebp - 0x5c]
push edx
lea eax, [ebp - 0xb78]
push eax
call fcn.00405970
add esp, 0xc
mov dword [ebp - 0xf88], eax
mov ecx, dword [ebp - 0xf88]
mov dword [ebp - 0xf8c], ecx
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0xf8c]
push edx
lea eax, [ebp - 0x4d4]
push eax
mov ecx, dword [ebp - 0xf00]
add ecx, 0x40
call fcn.00414350
mov ecx, eax
call fcn.00406b20
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xb78]
call fcn.00401e40
mov ecx, 1
test ecx, ecx
jne 0x47cbbc
mov edx, dword [ebp - 0xf00]
mov eax, dword [edx + 0x24]
add eax, 1
mov ecx, dword [ebp - 0xf00]
mov dword [ecx + 0x24], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x4d4]
call fcn.00401e40
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8e4]
call fcn.00403fe0
cmp dword [ebp - 0x6c], 0
jne 0x47c9be
movzx edx, byte [ebp - 0x39]
test edx, edx
jne 0x47c9be
mov dword [ebp - 0x6c], 0
mov ecx, dword [ebp - 0xf00]
call fcn.00474c80
movzx eax, al
test eax, eax
je 0x47cf49
jmp 0x47d3a3
lea ecx, [ebp - 0x6c]
push ecx
push 0x4ba614
mov edx, dword [ebp - 0x68]
push edx
lea eax, [ebp - 0xb94]
push eax
mov ecx, dword [ebp - 0xf00]
call fcn.00475d80
mov dword [ebp - 0xf90], eax
mov ecx, dword [ebp - 0xf90]
mov dword [ebp - 0xf94], ecx
mov byte [ebp - 4], 0x17
mov edx, dword [ebp - 0xf94]
push edx
lea ecx, [ebp - 0x5c]
call fcn.004061d0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xb94]
call fcn.00401e40
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x68], eax
lea ecx, [ebp - 0x5c]
call fcn.004018e0
test eax, eax
jne 0x47cfb3
jmp 0x47d3a3
push 0x4ba61c
lea ecx, [ebp - 0xbb4]
call fcn.004021a0
mov byte [ebp - 4], 0x18
push 0
lea ecx, [ebp - 0x8c]
push ecx
lea edx, [ebp - 0x498]
push edx
lea eax, [ebp - 0xbb4]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xbb8], esp
lea edx, [ebp - 0x5c]
push edx
call fcn.00403690
mov dword [ebp - 0xf98], eax
mov ecx, dword [ebp - 0xf00]
call fcn.004782b0
mov dword [ebp - 0xf9c], eax
mov eax, dword [ebp - 0xf9c]
mov dword [ebp - 0xb98], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xbb4]
call fcn.00401e40
cmp dword [ebp - 0xb98], 0
je 0x47d384
lea ecx, [ebp - 0x920]
call fcn.00404240
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x904]
call fcn.00404240
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x928]
push ecx
mov ecx, dword [ebp - 0xf00]
add ecx, 0x40
call fcn.0041ff80
jmp 0x47d07a
push 0
lea edx, [ebp - 0xbc0]
push edx
lea ecx, [ebp - 0x928]
call fcn.00414660
lea eax, [ebp - 0xbc8]
push eax
mov ecx, dword [ebp - 0xf00]
add ecx, 0x40
call fcn.00414fd0
push eax
lea ecx, [ebp - 0x928]
call fcn.00402910
movzx ecx, al
test ecx, ecx
je 0x47d2f8
lea ecx, [ebp - 0x928]
call fcn.004028b0
push eax
lea ecx, [ebp - 0x920]
call fcn.004061d0
lea edx, [ebp - 0x8c]
push edx
push 0x4ba624
lea eax, [ebp - 0xbe4]
push eax
call fcn.00406a90
add esp, 0xc
mov dword [ebp - 0xfa0], eax
mov ecx, dword [ebp - 0xfa0]
mov dword [ebp - 0xfa4], ecx
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0xfa4]
push edx
lea ecx, [ebp - 0x920]
call fcn.00406b20
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xbe4]
call fcn.00401e40
lea eax, [ebp - 0x920]
push eax
lea ecx, [ebp - 0x904]
call fcn.004061d0
lea ecx, [ebp - 0x920]
push ecx
lea edx, [ebp - 0xc00]
push edx
call fcn.004a2e50
add esp, 8
mov dword [ebp - 0xfa8], eax
mov eax, dword [ebp - 0xfa8]
mov dword [ebp - 0xfac], eax
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0xfac]
push ecx
lea ecx, [ebp - 0x920]
call fcn.004061d0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xc00]
call fcn.00401e40
lea ecx, [ebp - 0x920]
call fcn.00401df0
push eax
lea ecx, [ebp - 0x928]
call fcn.004028b0
add eax, 0x1c
mov ecx, eax
call fcn.00401df0
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x47d2f3
lea edx, [ebp - 0x904]
push edx
mov ecx, dword [ebp - 0xf00]
call fcn.00414350
mov ecx, eax
call fcn.004018e0
test eax, eax
jne 0x47d2f3
lea eax, [ebp - 0x498]
push eax
lea ecx, [ebp - 0x904]
push ecx
mov ecx, dword [ebp - 0xf00]
call fcn.00414350
mov ecx, eax
call fcn.004061d0
push 0x8c
call fcn.00422de0
add esp, 4
mov dword [ebp - 0xc08], eax
cmp dword [ebp - 0xc08], 0
je 0x47d20e
mov ecx, dword [ebp - 0xc08]
call fcn.004073b0
mov dword [ebp - 0xfb0], eax
jmp 0x47d218
mov dword [ebp - 0xfb0], 0
mov edx, dword [ebp - 0xfb0]
mov dword [ebp - 0xc04], edx
mov eax, dword [ebp - 0xc04]
mov dword [ebp - 0x92c], eax
mov ecx, dword [ebp - 0x92c]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc0c], esp
lea edx, [ebp - 0x498]
push edx
call fcn.00403690
mov dword [ebp - 0xfb4], eax
mov eax, dword [ebp - 0xfb4]
mov dword [ebp - 0xfb8], eax
mov byte [ebp - 4], 0x1d
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc10], esp
lea edx, [ebp - 0x904]
push edx
call fcn.00403690
mov dword [ebp - 0xfbc], eax
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0xf00]
call fcn.00475840
mov eax, dword [ebp - 0x92c]
push eax
push 3
mov ecx, dword [ebp - 0xf00]
mov edx, dword [ecx + 0x18]
push edx
mov eax, dword [ebp - 0xf00]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x92c]
mov dword [ebp - 0xc18], edx
mov eax, dword [ebp - 0xc18]
mov dword [ebp - 0xc14], eax
cmp dword [ebp - 0xc14], 0
je 0x47d2e9
push 1
mov ecx, dword [ebp - 0xc14]
call fcn.00407400
mov dword [ebp - 0xfc0], eax
jmp 0x47d2f3
mov dword [ebp - 0xfc0], 0
jmp 0x47d066
push 5
push 2
call fcn.00483880
add esp, 8
mov ecx, eax
mov edx, dword [ebp - 0xf00]
mov eax, dword [edx + 0x24]
xor edx, edx
div ecx
test edx, edx
jne 0x47d366
lea eax, [ebp - 0x904]
push eax
lea ecx, [ebp - 0xc34]
push ecx
call fcn.00483e20
add esp, 8
mov dword [ebp - 0xfc4], eax
mov ecx, dword [ebp - 0xfc4]
call fcn.00401050
push eax
push 4
mov edx, dword [ebp - 0xf00]
mov eax, dword [edx + 0x18]
push eax
mov ecx, dword [ebp - 0xf00]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0xc34]
call fcn.00401030
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x904]
call fcn.00401e40
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x920]
call fcn.00401e40
mov eax, dword [ebp - 0xf00]
mov ecx, dword [eax + 0x24]
add ecx, 1
mov edx, dword [ebp - 0xf00]
mov dword [edx + 0x24], ecx
cmp dword [ebp - 0x6c], 0
jne 0x47cf32
mov ecx, dword [ebp - 0xf00]
call fcn.00474c80
movzx eax, al
test eax, eax
je 0x47d3ba
jmp 0x47d51e
lea ecx, [ebp - 0x6c]
push ecx
push 0x4ba628
mov edx, dword [ebp - 0x64]
push edx
lea eax, [ebp - 0xc50]
push eax
mov ecx, dword [ebp - 0xf00]
call fcn.00475d80
mov dword [ebp - 0xfc8], eax
mov ecx, dword [ebp - 0xfc8]
mov dword [ebp - 0xfcc], ecx
mov byte [ebp - 4], 0x1e
mov edx, dword [ebp - 0xfcc]
push edx
lea ecx, [ebp - 0x5c]
call fcn.004061d0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xc50]
call fcn.00401e40
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x64], eax
lea ecx, [ebp - 0x5c]
call fcn.004018e0
test eax, eax
jne 0x47d424
jmp 0x47d51e
push str.REPLACE
lea ecx, [ebp - 0xc70]
call fcn.004021a0
mov byte [ebp - 4], 0x1f
push 1
lea ecx, [ebp - 0x8c]
push ecx
lea edx, [ebp - 0x498]
push edx
lea eax, [ebp - 0xc70]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc74], esp
lea edx, [ebp - 0x5c]
push edx
call fcn.00403690
mov dword [ebp - 0xfd0], eax
mov ecx, dword [ebp - 0xf00]
call fcn.004782b0
mov dword [ebp - 0xfd4], eax
xor eax, eax
cmp dword [ebp - 0xfd4], 0
sete al
mov byte [ebp - 0xc51], al
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xc70]
call fcn.00401e40
movzx ecx, byte [ebp - 0xc51]
test ecx, ecx
je 0x47d4ff
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc78], esp
lea edx, [ebp - 0x8c]
push edx
call fcn.00403690
mov dword [ebp - 0xfd8], eax
mov eax, dword [ebp - 0xfd8]
mov dword [ebp - 0xfdc], eax
mov byte [ebp - 4], 0x20
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc7c], esp
lea edx, [ebp - 0x498]
push edx
call fcn.00403690
mov dword [ebp - 0xfe0], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xf00]
call fcn.0047c270
mov eax, dword [ebp - 0xf00]
mov ecx, dword [eax + 0x24]
add ecx, 1
mov edx, dword [ebp - 0xf00]
mov dword [edx + 0x24], ecx
cmp dword [ebp - 0x6c], 0
jne 0x47d3a3
mov dword [ebp - 0x18], 0x4ba640
mov dword [ebp - 0x14], 0x4ba64c
mov dword [ebp - 0x10], 0x4ba658
lea ecx, [ebp - 0x4a8]
call fcn.00407500
mov byte [ebp - 4], 0x21
push 0
push 0x23
lea eax, [ebp - 0x47c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [ebp - 0x47c]
push ecx
lea ecx, [ebp - 0xc98]
call fcn.004021a0
mov byte [ebp - 4], 0x22
lea edx, [ebp - 0xc98]
push edx
lea ecx, [ebp - 0x4a8]
call fcn.00404f60
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xc98]
call fcn.00401e40
push 0
push 0x1a
lea eax, [ebp - 0x47c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [ebp - 0x47c]
push ecx
lea ecx, [ebp - 0xcb4]
call fcn.004021a0
mov byte [ebp - 4], 0x23
lea edx, [ebp - 0xcb4]
push edx
lea ecx, [ebp - 0x4a8]
call fcn.00404f60
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xcb4]
call fcn.00401e40
push 0
push 0x19
lea eax, [ebp - 0x47c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [ebp - 0x47c]
push ecx
lea ecx, [ebp - 0xcd0]
call fcn.004021a0
mov byte [ebp - 4], 0x24
lea edx, [ebp - 0xcd0]
push edx
lea ecx, [ebp - 0x4a8]
call fcn.00404f60
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xcd0]
call fcn.00401e40
push 0
push 0
lea eax, [ebp - 0x47c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [ebp - 0x47c]
push ecx
lea ecx, [ebp - 0xcec]
call fcn.004021a0
mov byte [ebp - 4], 0x25
lea edx, [ebp - 0xcec]
push edx
lea ecx, [ebp - 0x4a8]
call fcn.00404f60
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xcec]
call fcn.00401e40
push 0
push 0x16
lea eax, [ebp - 0x47c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x4ba664
lea ecx, [ebp - 0xd08]
call fcn.004021a0
mov dword [ebp - 0xfe4], eax
mov ecx, dword [ebp - 0xfe4]
mov dword [ebp - 0xfe8], ecx
mov byte [ebp - 4], 0x26
mov edx, dword [ebp - 0xfe8]
push edx
lea eax, [ebp - 0x47c]
push eax
lea ecx, [ebp - 0xd24]
push ecx
call fcn.00406a90
add esp, 0xc
mov dword [ebp - 0xfec], eax
mov edx, dword [ebp - 0xfec]
mov dword [ebp - 0xff0], edx
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0xff0]
push eax
lea ecx, [ebp - 0x4a8]
call fcn.00404f60
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xd24]
call fcn.00401e40
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xd08]
call fcn.00401e40
push 0
push 0xb
lea ecx, [ebp - 0x47c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.Programs
lea ecx, [ebp - 0xd40]
call fcn.004021a0
mov dword [ebp - 0xff4], eax
mov edx, dword [ebp - 0xff4]
mov dword [ebp - 0xff8], edx
mov byte [ebp - 4], 0x28
mov eax, dword [ebp - 0xff8]
push eax
lea ecx, [ebp - 0x47c]
push ecx
lea edx, [ebp - 0xd5c]
push edx
call fcn.00406a90
add esp, 0xc
mov dword [ebp - 0xffc], eax
mov eax, dword [ebp - 0xffc]
mov dword [ebp - 0x1000], eax
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0x1000]
push ecx
lea ecx, [ebp - 0x4a8]
call fcn.00404f60
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0xd5c]
call fcn.00401e40
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xd40]
call fcn.00401e40
mov edx, dword [ebp + 8]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x6c], 0
mov ecx, dword [ebp - 0xf00]
call fcn.00474c80
movzx eax, al
test eax, eax
je 0x47d7c6
jmp 0x47db83
lea ecx, [ebp - 0x6c]
push ecx
push 0x4ba67c
mov edx, dword [ebp - 0x34]
push edx
lea eax, [ebp - 0xd78]
push eax
mov ecx, dword [ebp - 0xf00]
call fcn.00475d80
mov dword [ebp - 0x1004], eax
mov ecx, dword [ebp - 0x1004]
mov dword [ebp - 0x1008], ecx
mov byte [ebp - 4], 0x2a
mov edx, dword [ebp - 0x1008]
push edx
lea ecx, [ebp - 0x5c]
call fcn.004061d0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xd78]
call fcn.00401e40
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x5c]
call fcn.004018e0
test eax, eax
jne 0x47d830
jmp 0x47db83
mov dword [ebp - 0x930], 0
push 0
push 0x4ba684
lea ecx, [ebp - 0x5c]
call fcn.0040db10
cmp eax, 0xffffffff
jne 0x47d87a
push 0
push 0x4ba690
lea ecx, [ebp - 0x5c]
call fcn.0040db10
cmp eax, 0xffffffff
jne 0x47d87a
push 0
push 0x4ba69c
lea ecx, [ebp - 0x5c]
call fcn.0040db10
cmp eax, 0xffffffff
je 0x47da44
mov dword [ebp - 0x934], 0
push 0
push 0x4ba6a8
lea ecx, [ebp - 0x5c]
call fcn.0040db10
cmp eax, 0xffffffff
je 0x47d8a4
mov dword [ebp - 0x934], 0
jmp 0x47d8e2
push 0
push 0x4ba6b4
lea ecx, [ebp - 0x5c]
call fcn.0040db10
cmp eax, 0xffffffff
je 0x47d8c4
mov dword [ebp - 0x934], 1
jmp 0x47d8e2
push 0
push 0x4ba6c0
lea ecx, [ebp - 0x5c]
call fcn.0040db10
cmp eax, 0xffffffff
je 0x47d8e2
mov dword [ebp - 0x934], 2
mov dword [ebp - 0x938], 0
jmp 0x47d8fd
mov ecx, dword [ebp - 0x938]
add ecx, 1
mov dword [ebp - 0x938], ecx
cmp dword [ebp - 0x938], 2
jge 0x47da3f
mov edx, dword [ebp - 0x934]
mov eax, dword [ebp + edx*4 - 0x18]
push eax
lea ecx, [ebp - 0xd94]
call fcn.004021a0
mov byte [ebp - 4], 0x2b
mov ecx, dword [ebp - 0x934]
mov edx, dword [ebp - 0x938]
lea eax, [edx + ecx*2]
push eax
lea ecx, [ebp - 0x4a8]
call fcn.00419ef0
push eax
lea ecx, [ebp - 0xd94]
push ecx
lea edx, [ebp - 0x5c]
push edx
lea eax, [ebp - 0x954]
push eax
call fcn.00484d90
add esp, 0x10
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0xd94]
call fcn.00401e40
push 0x4ba6cc
lea ecx, [ebp - 0xdb0]
call fcn.004021a0
mov byte [ebp - 4], 0x2e
push 0
lea ecx, [ebp - 0x8c]
push ecx
lea edx, [ebp - 0x498]
push edx
lea eax, [ebp - 0xdb0]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xdb4], esp
lea edx, [ebp - 0x954]
push edx
call fcn.00403690
mov dword [ebp - 0x100c], eax
mov ecx, dword [ebp - 0xf00]
call fcn.004782b0
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0xdb0]
call fcn.00401e40
mov eax, dword [ebp - 0x930]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xdb8], esp
lea edx, [ebp - 0x8c]
push edx
call fcn.00403690
mov dword [ebp - 0x1010], eax
mov eax, dword [ebp - 0x1010]
mov dword [ebp - 0x1014], eax
mov byte [ebp - 4], 0x2f
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xdbc], esp
lea edx, [ebp - 0x498]
push edx
call fcn.00403690
mov dword [ebp - 0x1018], eax
mov byte [ebp - 4], 0x2d
mov ecx, dword [ebp - 0xf00]
call fcn.004798e0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x954]
call fcn.00401e40
jmp 0x47d8ee
jmp 0x47db79
push str.EXTRA
lea ecx, [ebp - 0xdd8]
call fcn.004021a0
mov byte [ebp - 4], 0x30
push 0
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x498]
push ecx
lea edx, [ebp - 0xdd8]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xddc], esp
lea eax, [ebp - 0x5c]
push eax
call fcn.00403690
mov dword [ebp - 0x101c], eax
mov ecx, dword [ebp - 0xf00]
call fcn.004782b0
mov dword [ebp - 0x1020], eax
mov ecx, dword [ebp - 0x1020]
mov dword [ebp - 0x930], ecx
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xdd8]
call fcn.00401e40
cmp dword [ebp - 0x930], 0
je 0x47db20
mov edx, dword [ebp - 0x930]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xde0], esp
lea eax, [ebp - 0x8c]
push eax
call fcn.00403690
mov dword [ebp - 0x1024], eax
mov ecx, dword [ebp - 0x1024]
mov dword [ebp - 0x1028], ecx
mov byte [ebp - 4], 0x31
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xde4], esp
lea edx, [ebp - 0x498]
push edx
call fcn.00403690
mov dword [ebp - 0x102c], eax
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0xf00]
call fcn.004798e0
jmp 0x47db79
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xde8], esp
lea eax, [ebp - 0x8c]
push eax
call fcn.00403690
mov dword [ebp - 0x1030], eax
mov ecx, dword [ebp - 0x1030]
mov dword [ebp - 0x1034], ecx
mov byte [ebp - 4], 0x32
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xdec], esp
lea edx, [ebp - 0x498]
push edx
call fcn.00403690
mov dword [ebp - 0x1038], eax
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0xf00]
call fcn.0047c4f0
cmp dword [ebp - 0x6c], 0
jne 0x47d7af
mov dword [ebp - 0x6c], 0
mov ecx, dword [ebp - 0xf00]
call fcn.00474c80
movzx eax, al
test eax, eax
je 0x47dba1
jmp 0x47df05
lea ecx, [ebp - 0x6c]
push ecx
push 0x4ba6dc
mov edx, dword [ebp - 0x38]
push edx
lea eax, [ebp - 0xe08]
push eax
mov ecx, dword [ebp - 0xf00]
call fcn.00475d80
mov dword [ebp - 0x103c], eax
mov ecx, dword [ebp - 0x103c]
mov dword [ebp - 0x1040], ecx
mov byte [ebp - 4], 0x33
mov edx, dword [ebp - 0x1040]
push edx
lea ecx, [ebp - 0x5c]
call fcn.004061d0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xe08]
call fcn.00401e40
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x5c]
call fcn.004018e0
test eax, eax
jne 0x47dc0b
jmp 0x47df05
mov dword [ebp - 0x958], 0
push 0
push 0x4ba6e4
lea ecx, [ebp - 0x5c]
call fcn.0040db10
cmp eax, 0xffffffff
jne 0x47dc55
push 0
push 0x4ba6f0
lea ecx, [ebp - 0x5c]
call fcn.0040db10
cmp eax, 0xffffffff
jne 0x47dc55
push 0
push 0x4ba6fc
lea ecx, [ebp - 0x5c]
call fcn.0040db10
cmp eax, 0xffffffff
je 0x47de1a
mov dword [ebp - 0x95c], 0
push 0
push 0x4ba708
lea ecx, [ebp - 0x5c]
call fcn.0040db10
cmp eax, 0xffffffff
je 0x47dc7f
mov dword [ebp - 0x95c], 0
jmp 0x47dcbd
push 0
push 0x4ba714
lea ecx, [ebp - 0x5c]
call fcn.0040db10
cmp eax, 0xffffffff
je 0x47dc9f
mov dword [ebp - 0x95c], 1
jmp 0x47dcbd
push 0
push 0x4ba720
lea ecx, [ebp - 0x5c]
call fcn.0040db10
cmp eax, 0xffffffff
je 0x47dcbd
mov dword [ebp - 0x95c], 2
mov dword [ebp - 0x960], 0
jmp 0x47dcd8
mov ecx, dword [ebp - 0x960]
add ecx, 1
mov dword [ebp - 0x960], ecx
cmp dword [ebp - 0x960], 2
jge 0x47de15
mov edx, dword [ebp - 0x95c]
mov eax, dword [ebp + edx*4 - 0x18]
push eax
lea ecx, [ebp - 0xe24]
call fcn.004021a0
mov byte [ebp - 4], 0x34
mov ecx, dword [ebp - 0x95c]
mov edx, dword [ebp - 0x960]
lea eax, [edx + ecx*2]
push eax
lea ecx, [ebp - 0x4a8]
call fcn.00419ef0
push eax
lea ecx, [ebp - 0xe24]
push ecx
lea edx, [ebp - 0x5c]
push edx
lea eax, [ebp - 0x97c]
push eax
call fcn.00484d90
add esp, 0x10
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0xe24]
call fcn.00401e40
push 0x4ba72c
lea ecx, [ebp - 0xe40]
call fcn.004021a0
mov byte [ebp - 4], 0x37
push 0
lea ecx, [ebp - 0x8c]
push ecx
lea edx, [ebp - 0x498]
push edx
lea eax, [ebp - 0xe40]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xe44], esp
lea edx, [ebp - 0x97c]
push edx
call fcn.00403690
mov dword [ebp - 0x1044], eax
mov ecx, dword [ebp - 0xf00]
call fcn.004782b0
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0xe40]
call fcn.00401e40
push 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xe48], esp
lea eax, [ebp - 0x8c]
push eax
call fcn.00403690
mov dword [ebp - 0x1048], eax
mov ecx, dword [ebp - 0x1048]
mov dword [ebp - 0x104c], ecx
mov byte [ebp - 4], 0x38
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xe4c], esp
lea edx, [ebp - 0x498]
push edx
call fcn.00403690
mov dword [ebp - 0x1050], eax
mov byte [ebp - 4], 0x36
mov ecx, dword [ebp - 0xf00]
call fcn.004798e0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x97c]
call fcn.00401e40
jmp 0x47dcc9
jmp 0x47dee6
push str.DIR
lea ecx, [ebp - 0xe68]
call fcn.004021a0
mov byte [ebp - 4], 0x39
push 0
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x498]
push ecx
lea edx, [ebp - 0xe68]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xe6c], esp
lea eax, [ebp - 0x5c]
push eax
call fcn.00403690
mov dword [ebp - 0x1054], eax
mov ecx, dword [ebp - 0xf00]
call fcn.004782b0
mov dword [ebp - 0x1058], eax
mov ecx, dword [ebp - 0x1058]
mov dword [ebp - 0x958], ecx
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xe68]
call fcn.00401e40
push 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xe70], esp
lea edx, [ebp - 0x8c]
push edx
call fcn.00403690
mov dword [ebp - 0x105c], eax
mov eax, dword [ebp - 0x105c]
mov dword [ebp - 0x1060], eax
mov byte [ebp - 4], 0x3a
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xe74], esp
lea edx, [ebp - 0x498]
push edx
call fcn.00403690
mov dword [ebp - 0x1064], eax
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0xf00]
call fcn.004798e0
mov eax, dword [ebp - 0xf00]
mov ecx, dword [eax + 0x24]
add ecx, 1
mov edx, dword [ebp - 0xf00]
mov dword [edx + 0x24], ecx
cmp dword [ebp - 0x6c], 0
jne 0x47db8a
mov dword [ebp - 0x6c], 0
mov ecx, dword [ebp - 0xf00]
call fcn.00474c80
movzx eax, al
test eax, eax
je 0x47df23
jmp 0x47e28d
lea ecx, [ebp - 0x6c]
push ecx
push 0x4ba73c
mov edx, dword [ebp - 0x4ac]
push edx
lea eax, [ebp - 0xe90]
push eax
mov ecx, dword [ebp - 0xf00]
call fcn.00475d80
mov dword [ebp - 0x1068], eax
mov ecx, dword [ebp - 0x1068]
mov dword [ebp - 0x106c], ecx
mov byte [ebp - 4], 0x3b
mov edx, dword [ebp - 0x106c]
push edx
lea ecx, [ebp - 0x5c]
call fcn.004061d0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xe90]
call fcn.00401e40
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x4ac], eax
lea ecx, [ebp - 0x5c]
call fcn.004018e0
test eax, eax
jne 0x47df93
jmp 0x47e28d
mov dword [ebp - 0x980], 0
push 0
push 0x4ba744
lea ecx, [ebp - 0x5c]
call fcn.0040db10
cmp eax, 0xffffffff
jne 0x47dfdd
push 0
push 0x4ba750
lea ecx, [ebp - 0x5c]
call fcn.0040db10
cmp eax, 0xffffffff
jne 0x47dfdd
push 0
push 0x4ba75c
lea ecx, [ebp - 0x5c]
call fcn.0040db10
cmp eax, 0xffffffff
je 0x47e1a2
mov dword [ebp - 0x984], 0
push 0
push str._APPDATA_
lea ecx, [ebp - 0x5c]
call fcn.0040db10
cmp eax, 0xffffffff
je 0x47e007
mov dword [ebp - 0x984], 0
jmp 0x47e045
push 0
push str._DESKTOP_
lea ecx, [ebp - 0x5c]
call fcn.0040db10
cmp eax, 0xffffffff
je 0x47e027
mov dword [ebp - 0x984], 1
jmp 0x47e045
push 0
push str._PROGRAMS_
lea ecx, [ebp - 0x5c]
call fcn.0040db10
cmp eax, 0xffffffff
je 0x47e045
mov dword [ebp - 0x984], 2
mov dword [ebp - 0x988], 0
jmp 0x47e060
mov ecx, dword [ebp - 0x988]
add ecx, 1
mov dword [ebp - 0x988], ecx
cmp dword [ebp - 0x988], 2
jge 0x47e19d
mov edx, dword [ebp - 0x984]
mov eax, dword [ebp + edx*4 - 0x18]
push eax
lea ecx, [ebp - 0xeac]
call fcn.004021a0
mov byte [ebp - 4], 0x3c
mov ecx, dword [ebp - 0x984]
mov edx, dword [ebp - 0x988]
lea eax, [edx + ecx*2]
push eax
lea ecx, [ebp - 0x4a8]
call fcn.00419ef0
push eax
lea ecx, [ebp - 0xeac]
push ecx
lea edx, [ebp - 0x5c]
push edx
lea eax, [ebp - 0x9a4]
push eax
call fcn.00484d90
add esp, 0x10
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0xeac]
call fcn.00401e40
push 0x4ba78c
lea ecx, [ebp - 0xec8]
call fcn.004021a0
mov byte [ebp - 4], 0x3f
push 0
lea ecx, [ebp - 0x8c]
push ecx
lea edx, [ebp - 0x498]
push edx
lea eax, [ebp - 0xec8]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xecc], esp
lea edx, [ebp - 0x9a4]
push edx
call fcn.00403690
mov dword [ebp - 0x1070], eax
mov ecx, dword [ebp - 0xf00]
call fcn.004782b0
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0xec8]
call fcn.00401e40
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xed0], esp
lea eax, [ebp - 0x8c]
push eax
call fcn.00403690
mov dword [ebp - 0x1074], eax
mov ecx, dword [ebp - 0x1074]
mov dword [ebp - 0x1078], ecx
mov byte [ebp - 4], 0x40
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xed4], esp
lea edx, [ebp - 0x498]
push edx
call fcn.00403690
mov dword [ebp - 0x107c], eax
mov byte [ebp - 4], 0x3e
mov ecx, dword [ebp - 0xf00]
call fcn.004798e0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x9a4]
call fcn.00401e40
jmp 0x47e051
jmp 0x47e26e
push str.DDA
lea ecx, [ebp - 0xef0]
call fcn.004021a0
mov byte [ebp - 4], 0x41
push 0
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x498]
push ecx
lea edx, [ebp - 0xef0]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xef4], esp
lea eax, [ebp - 0x5c]
push eax
call fcn.00403690
mov dword [ebp - 0x1080], eax
mov ecx, dword [ebp - 0xf00]
call fcn.004782b0
mov dword [ebp - 0x1084], eax
mov ecx, dword [ebp - 0x1084]
mov dword [ebp - 0x980], ecx
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xef0]
call fcn.00401e40
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xef8], esp
lea edx, [ebp - 0x8c]
push edx
call fcn.00403690
mov dword [ebp - 0x1088], eax
mov eax, dword [ebp - 0x1088]
mov dword [ebp - 0x108c], eax
mov byte [ebp - 4], 0x42
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xefc], esp
lea edx, [ebp - 0x498]
push edx
call fcn.00403690
mov dword [ebp - 0x1090], eax
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0xf00]
call fcn.004798e0
mov eax, dword [ebp - 0xf00]
mov ecx, dword [eax + 0x24]
add ecx, 1
mov edx, dword [ebp - 0xf00]
mov dword [edx + 0x24], ecx
cmp dword [ebp - 0x6c], 0
jne 0x47df0c
mov eax, dword [ebp - 0xf00]
cmp dword [eax + 0x20], 0
jne 0x47e2a3
mov ecx, dword [ebp - 0xf00]
mov byte [ecx + 0xd], 1
mov edx, dword [ebp - 0xf00]
mov dword [edx + 0x20], 0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x4a8]
call fcn.00404f10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.00414150
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8c]
call fcn.00401e40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x498]
call fcn.00401e40
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.00401e40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00407530
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x40]
xor ecx, ebp
call fcn.0043f9e9
mov esp, ebp
pop ebp
ret 0x18