Function at 0x475237
Capabilities:
Create thread

Disassembly:
push 0xf8
mov eax, 0x51ecc8
call fcn.004d8abf
mov dword [ebp - 0x7c], edx
mov ebx, ecx
mov dword [ebp - 0x30], ebx
xor edi, edi
mov dword [ebp - 4], 1
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x475284
push 0x2069
push 0x80004005
push ecx
mov ecx, esp
push str.Administrator_rights_required
call fcn.00406fea
mov ecx, ebx
call fcn.00406620
jmp 0x475f38
mov eax, dword [ebp + 8]
mov byte [ebp - 0xe], 1
mov eax, dword [eax + 0xc]
inc dword [eax + 0x14]
mov eax, dword [0x57d3ec]
add eax, 0x54
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 2
call fcn.0044f24f
push 1
lea ecx, [eax + 0x28]
call fcn.004ab7d2
call fcn.0044f24f
fld1
mov eax, dword [eax + 0x28]
fstp qword [eax]
call fcn.0044f24f
mov byte [eax + 0x1a9], 1
call fcn.0044f24f
mov ecx, eax
mov eax, dword [ecx + 0x1b0]
sub eax, dword [ecx + 0x1ac]
mov ecx, 0xa8
cdq
idiv ecx
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx + 4]
je 0x47532f
push 0x2076
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x6c]
call fcn.00406620
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 3
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x64]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0xe]
call fcn.0044f694
jmp 0x475f38
mov eax, dword [ecx]
mov esi, dword [eax]
cmp esi, eax
je 0x4753f4
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x18], edi
mov eax, dword [esi + 8]
mov dword [ebp - 0x38], eax
call fcn.0044f24f
mov eax, dword [eax + 0x1ac]
cmp byte [eax + edi + 0x55], 0
je 0x4753d7
call fcn.0044f24f
mov eax, dword [eax + 0x1ac]
cmp byte [eax + edi + 0x54], 0
jne 0x4753d7
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x3c]
inc dword [eax + 0xc]
call fcn.0044f24f
push ecx
mov ecx, esp
mov edi, dword [eax + 0x1ac]
add edi, dword [ebp - 0x18]
call fcn.0044e82b
test al, al
mov dword [ebp - 0x38], str.Waiting_to_download
mov edx, str.Waiting_to_retrieve
cmove edx, dword [ebp - 0x38]
push edx
call fcn.00406fea
mov ecx, edi
call fcn.0044eeac
cmp byte [ebx + 0xb0], 0
je 0x4753d4
call fcn.0044f24f
push ecx
mov ecx, esp
push str.Waiting
mov edi, dword [eax + 0x1ac]
add edi, dword [ebp - 0x18]
call fcn.00406fea
mov ecx, edi
call fcn.0044eeac
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
add edi, 0xa8
mov ecx, dword [esi]
mov esi, ecx
mov dword [ebp - 0x18], edi
cmp ecx, dword [eax]
jne 0x475341
mov ebx, dword [ebp - 0x30]
xor edi, edi
lea ecx, [ebp - 0xe]
call fcn.0044f694
lea ecx, [ebp - 0xc4]
call fcn.0040687a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0xc0], edi
call fcn.004d615e
push edi
push edi
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 5
call fcn.004d5dc9
push edi
push 1
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 6
call fcn.004d5dc9
mov byte [ebp - 4], 7
push 0x18
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x98], edi
call fcn.004d8429
pop ecx
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x4c], edi
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 9
mov dword [ebp - 0xc0], eax
lea eax, [ebp + 0x10]
push eax
call fcn.00405d6e
push edi
push edi
lea eax, [ebp - 0xc4]
push eax
push 0x47238e
push edi
push edi
call fcn.004f5f5d
mov esi, eax
add esp, 0x18
mov dword [ebp - 0x4c], esi
test esi, esi
jne 0x4754f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x20ae
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x6c]
call fcn.00406620
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 0xa
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x64]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x475f2d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x60], edi
mov edi, 0x80004005
mov ecx, dword [eax]
mov eax, dword [ecx]
mov dword [ebp - 0x38], eax
cmp eax, ecx
je 0x475cae
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
mov byte [ebp - 0xe], 1
mov dword [ebp - 0x20], edi
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x57d3ec]
add eax, 0x54
push eax
call esi
mov byte [ebp - 4], 0xb
call fcn.0044f24f
lea ecx, [ebp - 0xe]
mov eax, dword [eax + 0x1ac]
mov bl, byte [eax + edi + 0x55]
call fcn.0044f694
test bl, bl
je 0x475c82
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xd], 1
push eax
call esi
mov byte [ebp - 4], 0xc
call fcn.0044f24f
lea ecx, [ebp - 0xd]
mov eax, dword [eax + 0x1ac]
mov bl, byte [eax + edi + 0x54]
call fcn.0044f694
test bl, bl
jne 0x475c82
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x24]
and dword [ebp - 0x24], 0
mov ecx, ebx
push 0
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00438c63
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x78]
call fcn.0040121b
mov byte [ebp - 4], 0xe
cmp dword [ebp - 0x78], 0
jl 0x475dbc
mov ecx, dword [ebp - 0x70]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp dword [ebp - 0x88], 0
je 0x475708
lea ecx, [ebp - 0x5c]
call fcn.0040687a
mov eax, dword [ebp + 0x14]
mov byte [ebp - 4], 0x10
cmp byte [eax + 0x29], 0
je 0x475663
call fcn.0044e82b
test al, al
je 0x475663
mov ebx, str.Skipped__not_installed_
push ebx
call fcn.004ddaa2
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x5c]
call fcn.00406efb
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xd], 1
push eax
call esi
mov byte [ebp - 4], 0x11
call fcn.0044f24f
mov ebx, 0x1ac
lea ecx, [ebp - 0xd]
mov eax, dword [eax + ebx]
mov byte [eax + edi + 0x56], 1
call fcn.0044f694
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xd], 1
push eax
call esi
mov byte [ebp - 4], 0x12
call fcn.0044f24f
lea ecx, [ebp - 0xd]
mov eax, dword [eax + ebx]
mov byte [eax + edi + 0x54], 1
call fcn.0044f694
jmp 0x475693
push str.Skipped
call fcn.004ddaa2
pop ecx
push eax
push str.Skipped
lea ecx, [ebp - 0x5c]
call fcn.00406efb
mov ecx, dword [ebx + 0x3c]
add ecx, 8
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
je 0x475693
push ecx
lea ecx, [ebp - 0x5c]
call fcn.00405d6e
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xd], 1
push eax
call esi
mov byte [ebp - 4], 0x13
call fcn.0044f24f
push ecx
push ecx
xor edx, edx
mov dword [ebp - 0x34], esp
mov ebx, dword [eax + 0x1ac]
mov eax, esp
mov ecx, esp
add ebx, edi
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [ecx], edx
mov dword [ecx + 4], edx
push ecx
mov byte [ebp - 4], 0x14
mov esi, esp
mov dword [ebp - 0x24], esi
mov edi, dword [ebp - 0x5c]
lea ecx, [edi - 0x10]
call fcn.004070e7
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
mov byte [ebp - 4], 0x13
call fcn.0044ef0e
lea ecx, [ebp - 0xd]
call fcn.0044f694
lea ecx, [edi - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x80]
lea ecx, [ecx - 0x10]
jmp 0x475c74
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.00407189
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x475d88
mov eax, dword [eax + 0x110]
mov byte [ebp - 0xd], 1
mov byte [eax], 1
mov eax, dword [0x57d3ec]
add eax, 0x54
push eax
call esi
mov byte [ebp - 4], 0x16
call fcn.0044f24f
lea ecx, [ebp - 0xd]
and dword [eax + 0x10], 0
mov byte [ebp - 4], 9
call fcn.0044f694
mov eax, dword [0x57d3ec]
cmp byte [eax + 1], 0
je 0x4757f6
push 0x20e0
push 1
push ecx
mov ecx, esp
push str.User_abort
call fcn.00406fea
lea ecx, [ebp - 0xe0]
call fcn.00406620
mov byte [ebp - 4], 0x17
mov ecx, dword [ebx + 0x3c]
push eax
call fcn.004032ed
mov ecx, dword [ebp - 0xd8]
add ecx, 0xfffffff0
call fcn.00407189
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xd], 1
push eax
call esi
mov byte [ebp - 4], 0x18
call fcn.0044f24f
push ecx
push ecx
xor ebx, ebx
mov dword [ebp - 0x34], esp
mov esi, dword [eax + 0x1ac]
mov eax, esp
mov ecx, esp
add esi, edi
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x19
push str.Canceled
call fcn.00406fea
mov ecx, esi
mov byte [ebp - 4], 0x18
call fcn.0044ef0e
lea ecx, [ebp - 0xd]
call fcn.0044f694
jmp 0x475c7c
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xd], 1
push eax
call esi
mov byte [ebp - 4], 0x1a
call fcn.0044f24f
mov ecx, dword [eax + 0x1ac]
mov ecx, dword [ecx + edi + 0x58]
sub ecx, 0x10
call fcn.004070e7
lea edi, [eax + 0x10]
mov dword [ebp - 0x34], edi
lea ecx, [ebp - 0xd]
call fcn.0044f694
xor ebx, ebx
mov dword [ebp - 0x58], 0x80004005
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x54], ebx
call fcn.0040687a
mov byte [ebp - 4], 0x1d
cmp dword [edi - 0xc], ebx
je 0x4758bd
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
call fcn.0040687a
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 0x1e
push eax
lea ecx, [ebp - 0x58]
call fcn.004032ed
mov ecx, dword [ebp - 0x64]
add ecx, 0xfffffff0
call fcn.00407189
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xd], 1
push eax
call esi
mov byte [ebp - 4], 0x1f
call fcn.0044f24f
push ecx
mov ecx, esp
push str.Waiting_to_install...
mov esi, dword [eax + 0x1ac]
add esi, dword [ebp - 0x20]
call fcn.00406fea
mov ecx, esi
call fcn.0044eeac
lea ecx, [ebp - 0xd]
mov byte [ebp - 4], 0x1d
call fcn.0044f694
mov ebx, dword [ebp - 0x58]
jmp 0x475bda
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push eax
push ecx
mov bl, byte [eax + 0xb0]
mov esi, esp
mov dword [ebp - 0x1c], esi
mov ecx, dword [ecx + 0x14]
sub ecx, 0x10
call fcn.004070e7
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0xec]
push ebx
push dword [ebp - 0x7c]
add eax, 0x10
mov edx, edi
mov dword [esi], eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x60]
push dword [ebp - 0x24]
call fcn.004720b1
add esp, 0x1c
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x20
call fcn.004032ed
mov ecx, dword [ebp - 0xe4]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, dword [0x57d3ec]
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add eax, 0x54
push eax
mov byte [ebp - 0xd], 1
call esi
mov byte [ebp - 4], 0x21
call fcn.0044f24f
push 1
lea ecx, [eax + 0x28]
call fcn.004ab7d2
call fcn.0044f24f
lea ecx, [ebp - 0xd]
and dword [eax + 0x10], 0
mov byte [ebp - 4], 0x1d
call fcn.0044f694
mov eax, dword [0x57d3ec]
cmp byte [eax + 1], 0
mov ebx, dword [ebp - 0x58]
je 0x475a24
test ebx, ebx
je 0x475a24
push 0x2102
push 1
push ecx
mov ecx, esp
push str.User_abort
call fcn.00406fea
lea ecx, [ebp - 0xf8]
call fcn.00406620
mov byte [ebp - 4], 0x22
mov ecx, dword [edi + 0x3c]
push eax
call fcn.004032ed
mov ecx, dword [ebp - 0xf0]
add ecx, 0xfffffff0
call fcn.00407189
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xd], 1
push eax
call esi
mov byte [ebp - 4], 0x23
call fcn.0044f24f
mov edi, dword [ebp - 0x20]
xor edx, edx
push ecx
push ecx
mov esi, dword [eax + 0x1ac]
mov eax, esp
mov ecx, esp
mov dword [ebp - 0x1c], esp
add esi, edi
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [ecx], edx
mov dword [ecx + 4], edx
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x24
push str.Canceled
call fcn.00406fea
mov ecx, esi
mov byte [ebp - 4], 0x23
call fcn.0044ef0e
lea ecx, [ebp - 0xd]
call fcn.0044f694
mov ecx, dword [ebp - 0x50]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x34]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x475c7c
cmp ebx, 1
je 0x475a7a
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xd], 1
push eax
call esi
mov byte [ebp - 4], 0x25
call fcn.0044f24f
mov esi, dword [ebp - 0x18]
test ebx, ebx
mov edi, eax
sets cl
movzx ecx, cl
mov esi, dword [esi]
push ecx
push ecx
mov ecx, esp
push str.Download_failed
call fcn.00406fea
push 0xa
push esi
mov ecx, edi
call fcn.0044ebc5
lea ecx, [ebp - 0xd]
mov byte [ebp - 4], 0x1d
call fcn.0044f694
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.Waiting_to_install
lea ecx, [ebp - 0x2c]
call fcn.00406fea
mov byte [ebp - 4], 0x26
test ebx, ebx
jns 0x475ada
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Download_failed
call fcn.00406fea
sub esp, 0xc
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x58]
mov ecx, esp
push eax
call fcn.0040121b
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x26
call fcn.0044f0b0
add esp, 0x10
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x28
call fcn.00405d6e
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00407189
jmp 0x475b0c
cmp ebx, 1
jne 0x475b0c
mov eax, dword [ebp - 0x50]
cmp dword [eax - 0xc], 0
jne 0x475b00
mov edi, str.Skipped
push edi
call fcn.004ddaa2
pop ecx
push eax
push edi
lea ecx, [ebp - 0x2c]
call fcn.00406efb
jmp 0x475b0c
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00405d6e
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0x25], 1
push eax
call esi
test ebx, ebx
mov byte [ebp - 4], 0x29
setne byte [ebp - 0xd]
call fcn.0044f24f
push ecx
mov edi, dword [eax + 0x1ac]
add edi, dword [ebp - 0x20]
test ebx, ebx
je 0x475b73
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
mov ecx, eax
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [ecx], edx
mov dword [ecx + 4], edx
push ecx
mov byte [ebp - 4], 0x2a
mov esi, esp
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
mov byte [ebp - 4], 0x29
call fcn.0044ef0e
jmp 0x475b8f
mov esi, esp
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.0044eeac
cmp byte [ebp - 0xd], 0
je 0x475bc0
call fcn.0044f24f
mov esi, dword [ebp - 0x20]
mov edi, 0x1ac
mov eax, dword [eax + edi]
mov byte [eax + esi + 0x68], 1
call fcn.0044f24f
mov ecx, dword [eax + edi]
lea eax, [ebp - 0x58]
add ecx, 0x6c
push eax
add ecx, esi
call fcn.004032ed
lea ecx, [ebp - 0x25]
call fcn.0044f694
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.00407189
mov edi, dword [ebp - 0x34]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x48]
cmp dword [eax - 0xc], 0
je 0x475c10
push eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x475d1c
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
mov byte [ebp - 4], 0x1d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 1
je 0x475c57
test ebx, ebx
js 0x475c57
push dword [ebp - 0x60]
push ecx
mov esi, esp
lea ecx, [edi - 0x10]
mov dword [ebp - 0x14], esi
call fcn.004070e7
push dword [ebp - 0x24]
add eax, 0x10
lea ecx, [ebp - 0xc4]
push dword [ebp - 0x18]
mov dword [esi], eax
lea eax, [ebp - 0x104]
push eax
call fcn.0047227a
mov ecx, dword [ebp - 0xfc]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x475c66
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x3c]
call fcn.004032ed
mov ecx, dword [ebp - 0x50]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [edi - 0x10]
call fcn.00407189
mov edi, dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x38]
add edi, 0xa8
mov ecx, dword [ebp + 8]
inc dword [ebp - 0x60]
mov dword [ebp - 0x20], edi
mov edx, dword [eax]
mov eax, edx
mov dword [ebp - 0x38], eax
cmp edx, dword [ecx]
jne 0x47551e
mov esi, dword [ebp - 0x4c]
mov edi, 0x80004005
mov ebx, dword [ebp - 0x30]
push dword [ebp - 0xa0]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x475e15
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1e1e
cmovle ecx, eax
mov eax, edi
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0xd4]
call fcn.00406620
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 0x2d
push eax
lea ecx, [ebp - 0x48]
call fcn.0040121b
mov ecx, dword [ebp - 0xcc]
add ecx, 0xfffffff0
call fcn.00407189
jmp 0x475e25
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x2134
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x48]
call fcn.00406620
mov ebx, dword [ebp - 0x30]
lea eax, [ebp - 0x48]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x2c
call fcn.0040121b
mov ecx, dword [ebp - 0x40]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x50]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [edi - 0x10]
call fcn.00407189
push dword [ebp - 0x4c]
jmp 0x475f27
push 0x20d9
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x48]
call fcn.00406620
mov ebx, dword [ebp - 0x30]
lea eax, [ebp - 0x48]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x15
call fcn.0040121b
mov ecx, dword [ebp - 0x40]
lea ecx, [ecx - 0x10]
jmp 0x475d7b
cmp dword [ebp - 0x74], 0
mov eax, 0x20c4
cmovne eax, dword [ebp - 0x74]
push eax
push dword [ebp - 0x78]
push ecx
mov esi, esp
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 0x70]
lea ecx, [edi - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x48]
mov dword [esi], eax
call fcn.00406620
mov ebx, dword [ebp - 0x30]
lea eax, [ebp - 0x48]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0xf
call fcn.0040121b
mov ecx, dword [ebp - 0x40]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [edi - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x80]
jmp 0x475db7
and dword [ebp - 0x48], 0
lea ecx, [ebp - 0x40]
and dword [ebp - 0x44], 0
call fcn.0040687a
mov byte [ebp - 4], 0x2e
cmp dword [ebp - 0x48], 0
jge 0x475ec0
cmp dword [ebp - 0x44], 0
mov eax, 0x2144
cmovne eax, dword [ebp - 0x44]
push eax
push dword [ebp - 0x48]
push ecx
mov edi, esp
mov dword [ebp - 0x14], edi
mov ebx, dword [ebp - 0x40]
lea ecx, [ebx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x94]
mov dword [edi], eax
call fcn.00406620
mov edi, dword [ebp - 0x30]
lea eax, [ebp - 0x94]
push eax
mov ecx, edi
mov byte [ebp - 4], 0x2f
call fcn.0040121b
mov ecx, dword [ebp - 0x8c]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebx - 0x10]
call fcn.00407189
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xc4]
call fcn.00475f57
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x475eae
call fcn.00405adf
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, edi
jmp 0x475f51
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00407189
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x475f17
push 0x2147
push edi
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x94]
call fcn.00406620
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 0x30
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x8c]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x475f26
and dword [ebx], 0
lea ecx, [ebx + 8]
and dword [ebx + 4], 0
call fcn.0040687a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xc4]
call fcn.00475f57
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x475f44
call fcn.00405adf
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, ebx
call fcn.004d8a8d
ret