Function at 0x4721c0
Capabilities:
Accept command line arguments
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
push esi
mov dword [ebp - 0x468], edx
mov word [ebp - 0x464], cx
mov eax, 0xa95
mov word [ebp - 0x448], ax
mov dword [ebp - 0x438], 0x716c92d2
mov dword [ebp - 0x10], 0x3a4b1ae5
mov ecx, 0x569
mov word [ebp - 8], cx
cmp dword [section..data], 0x3a6006be
je 0x472291
mov edx, dword [ebp - 0x468]
mov dword [ebp - 0x46c], edx
cmp dword [ebp - 0x46c], 0
je 0x472230
cmp dword [ebp - 0x46c], 0x94c86651
je 0x472287
jmp 0x472291
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 0x58067a97
je 0x47224a
jmp 0x47227e
lea ecx, [ebp - 0x174]
push ecx
lea edx, [ebp - 0x174]
push edx
call dword [sym.imp.SHELL32.dll_ILFindChild]
mov dword [ebp - 0x174], eax
push 0xf9
mov eax, dword [ebp - 0x468]
push eax
push 0x86
push 0x5f
push 0xffffffffffffff90
call fcn.00429f50
mov dword [ebp - 0x58], 0xca7a
jmp 0x472291
mov dword [ebp - 0x468], 0x507ca507
mov dword [ebp - 0x360], 0x5bd4
mov dword [ebp - 0x128], 0x94c1
mov dword [ebp - 0x54], 0x265f
mov ecx, dword [section..data]
mov dword [ebp - 0x474], ecx
cmp dword [ebp - 0x474], 0x32ab8b0a
je 0x47231b
cmp dword [ebp - 0x474], 0x66524227
je 0x4722d5
jmp 0x472397
mov edx, dword [ebp - 0x468]
mov dword [ebp - 0x25c], edx
movzx eax, word [ebp - 0x464]
sub eax, 0x99
mov word [ebp - 0x448], ax
mov dword [ebp - 0xd0], 0xf422
mov dword [ebp - 0x238], 0x351b
mov byte [ebp - 0xd5], 0xf1
mov dword [ebp - 0x28c], 0xd635
jmp 0x472397
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x478], ecx
cmp dword [ebp - 0x478], 0x95127df0
je 0x472335
jmp 0x472389
mov edx, dword [section..data]
push edx
movzx eax, byte [ebp - 0xd5]
push eax
call fcn.004ef7c0
add esp, 8
push 0xd1
mov ecx, dword [ebp - 0x440]
push ecx
lea edx, [ebp - 0x154]
push edx
mov eax, dword [ebp - 0x260]
push eax
call dword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
mov dword [ebp - 0x154], eax
movzx ecx, byte [ebp - 0xd5]
push ecx
movzx edx, word [ebp - 0x448]
push edx
call section..text
jmp 0x472397
mov ax, word [ebp - 0x448]
mov word [ebp - 0x464], ax
mov dword [ebp - 0x23c], 0x696
mov ecx, dword [ebp - 0x468]
add ecx, 0x3d404c70
mov dword [ebp - 0x25c], ecx
movzx edx, word [ebp - 0x464]
and edx, 0x263
mov word [ebp - 0x448], dx
mov eax, dword [ebp - 0x468]
shl eax, 0x11
mov dword [ebp - 0x25c], eax
mov cx, word [ebp - 0x448]
mov word [ebp - 0x464], cx
mov edx, dword [ebp - 0x468]
shr edx, 0x15
mov dword [ebp - 0x25c], edx
movzx eax, word [ebp - 0x448]
xor eax, 0x498
mov word [ebp - 0x464], ax
movzx ecx, byte [ebp - 0xd5]
or ecx, 0x8e
mov byte [ebp - 0xd5], cl
mov edx, dword [ebp - 0x468]
add edx, 0x743fa079
mov dword [ebp - 0x25c], edx
movzx eax, word [ebp - 0x448]
sub eax, 0xf7b
mov word [ebp - 0x464], ax
movzx ecx, byte [ebp - 0xd5]
and ecx, 0x8b
mov byte [ebp - 0xd5], cl
mov edx, dword [ebp - 0x360]
add edx, 0xfd
mov dword [ebp - 0x360], edx
movzx eax, word [ebp - 0x448]
add eax, 0xeb4
mov word [ebp - 0x464], ax
mov ecx, dword [ebp - 0x468]
sub ecx, 0xe190e6b
mov dword [ebp - 0x25c], ecx
movzx edx, word [ebp - 0x448]
add edx, 0xbae
mov word [ebp - 0x464], dx
movzx eax, byte [ebp - 0xd5]
sub eax, 0x66
mov byte [ebp - 0xd5], al
mov ecx, dword [ebp - 0x468]
shl ecx, 0x1e
mov dword [ebp - 0x25c], ecx
cmp dword [ebp - 0x360], 0xb1cf
jne 0x4723a1
mov edx, dword [section..data]
mov dword [ebp - 0x160], edx
cmp dword [ebp - 0x238], 0x403d
je 0x4727f2
movzx eax, word [ebp - 0x448]
sar eax, 6
mov word [ebp - 0x464], ax
mov ecx, dword [section..data]
or ecx, 0x5b4623ec
mov dword [ebp - 0x160], ecx
movzx edx, word [ebp - 0x448]
xor edx, 0xc55
mov word [ebp - 0x464], dx
mov eax, dword [section..data]
and eax, 0x6a85cd0a
mov dword [ebp - 0x160], eax
movzx ecx, word [ebp - 0x464]
add ecx, 0xfb6
mov word [ebp - 0x448], cx
movzx edx, byte [ebp - 0xd5]
sub edx, 0x37
mov byte [ebp - 0xd5], dl
mov eax, dword [section..data]
add eax, 0x2dbc41a
mov dword [ebp - 0x160], eax
movzx ecx, word [ebp - 0x464]
sub ecx, 0x277
mov word [ebp - 0x448], cx
mov edx, dword [ebp - 0x468]
and edx, 0x9d320e03
mov dword [ebp - 0x25c], edx
movzx eax, word [ebp - 0x448]
sub eax, 0x16f
mov word [ebp - 0x464], ax
mov ecx, dword [ebp - 0x468]
add ecx, 0x4f7b3bc4
mov dword [ebp - 0x25c], ecx
movzx edx, byte [ebp - 0xd5]
sub edx, 2
mov byte [ebp - 0xd5], dl
mov eax, dword [ebp - 0x238]
add eax, 0x72
mov dword [ebp - 0x238], eax
movzx ecx, byte [ebp - 0xd5]
add ecx, 0xf6
mov byte [ebp - 0xd5], cl
mov edx, dword [section..data]
sar edx, 0x11
mov dword [ebp - 0x160], edx
movzx eax, word [ebp - 0x448]
or eax, 0xb05
mov word [ebp - 0x464], ax
mov ecx, dword [ebp - 0x468]
shl ecx, 0xd
mov dword [ebp - 0x25c], ecx
movzx edx, byte [ebp - 0xd5]
xor edx, 0xc6
mov byte [ebp - 0xd5], dl
movzx eax, word [ebp - 0x464]
and eax, 0x2ee
mov word [ebp - 0x448], ax
movzx ecx, byte [ebp - 0xd5]
add ecx, 0x89
mov byte [ebp - 0xd5], cl
mov edx, dword [section..data]
sub edx, 0x4280ba13
mov dword [ebp - 0x160], edx
movzx eax, byte [ebp - 0xd5]
add eax, 0x97
mov byte [ebp - 0xd5], al
mov ecx, dword [section..data]
sub ecx, 0x5a6da486
mov dword [ebp - 0x160], ecx
movzx edx, word [ebp - 0x464]
sub edx, 0xbff
mov word [ebp - 0x448], dx
movzx eax, byte [ebp - 0xd5]
and eax, 0x2f
mov byte [ebp - 0xd5], al
mov ecx, dword [ebp - 0x468]
add ecx, 0x324191f1
mov dword [ebp - 0x25c], ecx
mov edx, dword [section..data]
add edx, 0x297af79c
mov dword [ebp - 0x160], edx
mov eax, dword [section..data]
sub eax, 0x300b8a89
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x468]
shr ecx, 0x1d
mov dword [ebp - 0x25c], ecx
movzx edx, byte [ebp - 0xd5]
shl edx, 3
mov byte [ebp - 0xd5], dl
movzx eax, byte [ebp - 0xd5]
or eax, 0xe7
mov byte [ebp - 0xd5], al
mov ecx, dword [ebp - 0x468]
xor ecx, 0xc724cdfe
mov dword [ebp - 0x25c], ecx
movzx edx, word [ebp - 0x448]
and edx, 0x319
mov word [ebp - 0x464], dx
mov eax, dword [section..data]
add eax, 0x67cde787
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x468]
add ecx, 0x7d6c5b10
mov dword [ebp - 0x25c], ecx
movzx edx, word [ebp - 0x464]
sub edx, 0x50e
mov word [ebp - 0x448], dx
movzx eax, byte [ebp - 0xd5]
add eax, 0x4a
mov byte [ebp - 0xd5], al
movzx ecx, word [ebp - 0x448]
sub ecx, 0xf9e
mov word [ebp - 0x464], cx
mov edx, dword [section..data]
add edx, 0x2d499da0
mov dword [ebp - 0x160], edx
mov eax, dword [ebp - 0x468]
and eax, 0xa5f63d81
mov dword [ebp - 0x25c], eax
movzx ecx, word [ebp - 0x448]
sub ecx, 0x881
mov word [ebp - 0x464], cx
mov edx, dword [section..data]
or edx, 0x1eafc0a2
mov dword [ebp - 0x160], edx
movzx eax, byte [ebp - 0xd5]
shl eax, 6
mov byte [ebp - 0xd5], al
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x468], ecx
jmp 0x4724d7
mov dl, byte [ebp - 0xd5]
mov byte [ebp - 0x47c], dl
cmp byte [ebp - 0x47c], 0xae
je 0x472819
cmp byte [ebp - 0x47c], 0xdb
je 0x4728c0
jmp 0x4728da
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0xaf38185a
je 0x472833
jmp 0x4728ac
push 0xda
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSettings]
mov edx, dword [ebp - 0x25c]
mov ecx, dword [ebp - 0x448]
call fcn.004721c0
lea edx, [ebp - 0x440]
push edx
call dword [sym.imp.ole32.dll_CoSetCancelObject]
mov dword [ebp - 0x15c], eax
movzx eax, word [ebp - 0x448]
sar eax, 1
mov word [ebp - 0x464], ax
movzx ecx, byte [ebp - 0xd5]
xor ecx, 0xd4
mov byte [ebp - 0xd5], cl
lea edx, [ebp - 0xd5]
push edx
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0x148]
push ecx
call dword [sym.imp.ole32.dll_CoMarshalInterThreadInterfaceInStream]
mov dword [ebp - 0x50], eax
jmp 0x4728be
mov edx, dword [section..data]
add edx, 0x7f9d6b37
mov dword [ebp - 0x160], edx
jmp 0x4728da
movzx eax, byte [ebp - 0xd5]
push eax
mov ecx, dword [ebp - 0x25c]
push ecx
push 0x6a
push 0x3b
push 0xffffffffffffffb9
call fcn.00429f50
cmp dword [ebp - 0x128], 0xc4fd
jae 0x472aca
mov edx, dword [ebp - 0x468]
and edx, 0xc429a64e
mov dword [ebp - 0x25c], edx
mov eax, dword [section..data]
add eax, 0x4f469952
mov dword [ebp - 0x160], eax
movzx ecx, word [ebp - 0x448]
sub ecx, 0x6cd
mov word [ebp - 0x464], cx
movzx edx, byte [ebp - 0xd5]
sub edx, 0x4c
mov byte [ebp - 0xd5], dl
movzx eax, word [ebp - 0x448]
add eax, 0xaa5
mov word [ebp - 0x464], ax
movzx ecx, word [ebp - 0x464]
add ecx, 0x386
mov word [ebp - 0x448], cx
mov edx, dword [section..data]
sub edx, 0x7ba1ff2b
mov dword [ebp - 0x160], edx
movzx eax, byte [ebp - 0xd5]
add eax, 0xee
mov byte [ebp - 0xd5], al
movzx ecx, word [ebp - 0x448]
and ecx, 0xa57
mov word [ebp - 0x464], cx
mov edx, dword [ebp - 0x468]
shr edx, 0x1b
mov dword [ebp - 0x25c], edx
movzx eax, word [ebp - 0x464]
or eax, 0xe1b
mov word [ebp - 0x448], ax
mov ecx, dword [ebp - 0x128]
add ecx, 0xc4
mov dword [ebp - 0x128], ecx
movzx edx, word [ebp - 0x448]
xor edx, 0xd5
mov word [ebp - 0x464], dx
movzx eax, word [ebp - 0x464]
shl eax, 0xe
mov word [ebp - 0x448], ax
movzx ecx, byte [ebp - 0xd5]
sub ecx, 0xfc
mov byte [ebp - 0xd5], cl
mov edx, dword [ebp - 0x468]
add edx, 0x50582099
mov dword [ebp - 0x25c], edx
movzx eax, word [ebp - 0x448]
and eax, 0xb50
mov word [ebp - 0x464], ax
movzx ecx, byte [ebp - 0xd5]
sub ecx, 0x95
mov byte [ebp - 0xd5], cl
mov edx, dword [ebp - 0x468]
sub edx, 0x67690ae8
mov dword [ebp - 0x25c], edx
mov eax, dword [section..data]
add eax, 0x13d4f79c
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x468]
add ecx, 0x1143d81b
mov dword [ebp - 0x25c], ecx
movzx edx, word [ebp - 0x448]
sub edx, 0x8f8
mov word [ebp - 0x464], dx
movzx eax, word [ebp - 0x448]
add eax, 0x120
mov word [ebp - 0x464], ax
mov ecx, dword [section..data]
sub ecx, 0x29c95a76
mov dword [ebp - 0x160], ecx
mov edx, dword [ebp - 0x468]
sub edx, 0x24ee2a36
mov dword [ebp - 0x25c], edx
movzx eax, word [ebp - 0x448]
or eax, 0x744
mov word [ebp - 0x464], ax
jmp 0x4728da
mov cl, byte [ebp - 0xd5]
mov byte [ebp - 0x45d], cl
cmp dword [ebp - 0x58], 0xde28
ja 0x472d32
movzx edx, word [ebp - 0x464]
shl edx, 0xa
mov word [ebp - 0x448], dx
movzx eax, word [ebp - 0x448]
xor eax, 0x779
mov word [ebp - 0x464], ax
movzx ecx, byte [ebp - 0xd5]
sar ecx, 7
mov byte [ebp - 0x45d], cl
movzx edx, byte [ebp - 0xd5]
and edx, 0xa
mov byte [ebp - 0x45d], dl
movzx eax, word [ebp - 0x464]
sub eax, 0x7c8
mov word [ebp - 0x448], ax
movzx ecx, word [ebp - 0x448]
add ecx, 0x9f3
mov word [ebp - 0x464], cx
mov edx, dword [section..data]
and edx, 0x635a2448
mov dword [ebp - 0x160], edx
movzx eax, byte [ebp - 0x45d]
sub eax, 0xc7
mov byte [ebp - 0xd5], al
movzx ecx, word [ebp - 0x448]
add ecx, 0x26d
mov word [ebp - 0x464], cx
mov edx, dword [section..data]
sub edx, 0x1aa8b503
mov dword [ebp - 0x160], edx
mov eax, dword [section..data]
add eax, 0x390d13e2
mov dword [ebp - 0x160], eax
movzx ecx, byte [ebp - 0xd5]
sub ecx, 0x15
mov byte [ebp - 0x45d], cl
mov edx, dword [section..data]
shl edx, 0x16
mov dword [ebp - 0x160], edx
mov eax, dword [section..data]
sar eax, 0xf
mov dword [ebp - 0x160], eax
movzx ecx, word [ebp - 0x448]
or ecx, 0x445
mov word [ebp - 0x464], cx
movzx edx, word [ebp - 0x448]
xor edx, 0x90a
mov word [ebp - 0x464], dx
mov eax, dword [ebp - 0x468]
and eax, 0xdad8fc17
mov dword [ebp - 0x25c], eax
movzx ecx, word [ebp - 0x464]
add ecx, 0xeea
mov word [ebp - 0x448], cx
movzx edx, byte [ebp - 0x45d]
sub edx, 0xbc
mov byte [ebp - 0xd5], dl
movzx eax, word [ebp - 0x448]
sub eax, 0x6b0
mov word [ebp - 0x464], ax
mov ecx, dword [ebp - 0x58]
add ecx, 0xe5
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x468]
sub edx, 0x39350e56
mov dword [ebp - 0x25c], edx
movzx eax, word [ebp - 0x448]
and eax, 0xbca
mov word [ebp - 0x464], ax
mov ecx, dword [section..data]
sub ecx, 0x63cd9233
mov dword [ebp - 0x160], ecx
movzx edx, byte [ebp - 0xd5]
add edx, 0x65
mov byte [ebp - 0x45d], dl
mov eax, dword [ebp - 0x468]
add eax, 0x7761fc
mov dword [ebp - 0x25c], eax
movzx ecx, word [ebp - 0x448]
add ecx, 0xca7
mov word [ebp - 0x464], cx
mov edx, dword [ebp - 0x468]
or edx, 0x54a0defc
mov dword [ebp - 0x25c], edx
movzx eax, word [ebp - 0x464]
sar eax, 2
mov word [ebp - 0x448], ax
movzx ecx, byte [ebp - 0x45d]
shl ecx, 3
mov byte [ebp - 0xd5], cl
movzx edx, word [ebp - 0x448]
xor edx, 0x8a6
mov word [ebp - 0x464], dx
movzx eax, word [ebp - 0x464]
and eax, 0x4ee
mov word [ebp - 0x448], ax
movzx ecx, byte [ebp - 0x45d]
sub ecx, 0xad
mov byte [ebp - 0xd5], cl
jmp 0x472ad6
movzx edx, word [ebp - 0x464]
add edx, 0xe3f
movzx eax, word [ebp - 0x448]
cmp edx, eax
jge 0x472e11
mov ecx, dword [ebp - 0x468]
mov dword [ebp - 0x484], ecx
cmp dword [ebp - 0x484], 0xe6c797b5
je 0x472d6b
jmp 0x472df2
push 0x1e
mov edx, dword [ebp - 0xb8]
push edx
lea eax, [ebp - 0x448]
push eax
mov ecx, dword [ebp - 0x17c]
push ecx
call dword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
mov dword [ebp - 0x50], eax
movzx edx, word [ebp - 0x448]
sub edx, 0xaf8
mov word [ebp - 0x464], dx
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.COMDLG32.dll_FindTextW]
mov dword [ebp - 0x370], eax
mov ecx, dword [ebp - 0x468]
sub ecx, 0x15ae584
mov dword [ebp - 0x25c], ecx
push 0xfd
lea edx, [ebp - 0x174]
push edx
push 0x53
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0x174]
push edx
call dword [sym.imp.ole32.dll_CoGetMarshalSizeMax]
mov dword [ebp - 0x15c], eax
jmp 0x472e0c
movzx eax, byte [ebp - 0x45d]
push eax
mov ecx, dword [ebp - 0x25c]
push ecx
push 0x41
push 0xffffffffffffffcb
push 0xffffffffffffffcb
call fcn.00429f50
jmp 0x472ec9
mov edx, dword [ebp - 0x468]
add edx, 0x541c6c12
cmp edx, dword [ebp - 0x25c]
je 0x472ec9
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x178], eax
mov cx, word [ebp - 0x448]
mov word [ebp - 0x450], cx
mov dl, byte [ebp - 0x45d]
mov byte [ebp - 0x488], dl
cmp byte [ebp - 0x488], 0x79
je 0x472ea8
cmp byte [ebp - 0x488], 0xd7
je 0x472e63
jmp 0x472ebf
lea eax, [ebp - 0xd5]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x160]
mov dword [ebp - 0x138], ecx
mov edx, dword [ebp - 0x178]
mov dword [ebp - 0x2dc], edx
lea eax, [ebp - 0x138]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x14c], 0x61b4
mov ecx, dword [ebp - 0x138]
mov dword [ebp - 0x120], ecx
jmp 0x472ebf
movzx edx, word [ebp - 0x450]
movzx eax, word [ebp - 0x464]
and edx, eax
mov word [ebp - 0x448], dx
mov dword [ebp - 0x368], 0x5ebb
movzx ecx, byte [ebp - 0x45d]
mov edx, dword [ebp - 0x4c]
movzx eax, byte [edx]
add ecx, eax
mov byte [ebp - 0xd5], cl
mov ecx, dword [ebp - 0x468]
sub ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x2dc], ecx
mov edx, dword [ebp - 0x160]
add edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0xec]
mov dword [eax], edx
mov ecx, dword [ebp - 0xec]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x160]
shl edx, cl
mov eax, dword [ebp - 0xec]
mov dword [eax], edx
movzx ecx, word [ebp - 0x448]
movzx edx, word [ebp - 0x464]
xor ecx, edx
mov word [ebp - 0x450], cx
movzx eax, word [ebp - 0x448]
movzx ecx, word [ebp - 0x464]
sar eax, cl
mov word [ebp - 0x450], ax
movzx ecx, byte [ebp - 0xd5]
movzx edx, byte [ebp - 0x45d]
or ecx, edx
mov eax, dword [ebp - 0x4c]
mov byte [eax], cl
mov ecx, dword [ebp - 0x2dc]
and ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x178], ecx
mov edx, dword [ebp - 0xec]
mov eax, dword [edx]
add eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
mov edx, dword [ebp - 0xec]
mov eax, dword [edx]
sub eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
mov edx, dword [ebp - 0x178]
sub edx, dword [ebp - 0x468]
mov dword [ebp - 0x25c], edx
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 0xec]
mov dword [edx], ecx
movzx eax, byte [ebp - 0xd5]
movzx ecx, byte [ebp - 0x45d]
add eax, ecx
mov edx, dword [ebp - 0x4c]
mov byte [edx], al
mov eax, dword [ebp - 0x4c]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 0xd5]
sub ecx, edx
mov eax, dword [ebp - 0x4c]
mov byte [eax], cl
mov ecx, dword [ebp - 0xec]
mov edx, dword [ebp - 0x120]
and edx, dword [ecx]
mov dword [ebp - 0x138], edx
mov eax, dword [ebp - 0x468]
sub eax, dword [ebp - 0x178]
mov dword [ebp - 0x2dc], eax
mov edx, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x160]
sar edx, cl
mov eax, dword [ebp - 0xec]
mov dword [eax], edx
mov ecx, dword [ebp - 0xec]
mov edx, dword [ecx]
or edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0xec]
mov dword [eax], edx
movzx ecx, byte [ebp - 0xd5]
mov edx, dword [ebp - 0x4c]
movzx eax, byte [edx]
xor ecx, eax
mov byte [ebp - 0x45d], cl
mov ecx, dword [ebp - 0x368]
add ecx, 0xbd
mov dword [ebp - 0x368], ecx
movzx edx, word [ebp - 0x448]
movzx ecx, word [ebp - 0x464]
shl edx, cl
mov word [ebp - 0x450], dx
mov eax, dword [ebp - 0x138]
add eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
mov edx, dword [ebp - 0xec]
mov eax, dword [ebp - 0x120]
and eax, dword [edx]
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x120]
sub ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 0xec]
mov dword [edx], ecx
mov eax, dword [ebp - 0x120]
add eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
mov edx, dword [ebp - 0xec]
mov eax, dword [edx]
add eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
mov edx, dword [ebp - 0x4c]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0xd5]
add eax, ecx
mov edx, dword [ebp - 0x4c]
mov byte [edx], al
mov eax, dword [ebp - 0x2dc]
sub eax, dword [ebp - 0x178]
mov dword [ebp - 0x25c], eax
movzx ecx, word [ebp - 0x450]
movzx edx, word [ebp - 0x448]
sub ecx, edx
mov word [ebp - 0x464], cx
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x120]
sub ecx, dword [eax]
mov dword [ebp - 0x160], ecx
mov edx, dword [ebp - 0xec]
mov eax, dword [edx]
and eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
movzx edx, word [ebp - 0x464]
movzx eax, word [ebp - 0x450]
xor edx, eax
mov word [ebp - 0x448], dx
movzx ecx, byte [ebp - 0x45d]
movzx edx, byte [ebp - 0xd5]
or ecx, edx
mov eax, dword [ebp - 0x4c]
mov byte [eax], cl
mov ecx, dword [ebp - 0xec]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x138]
shl edx, cl
mov eax, dword [ebp - 0xec]
mov dword [eax], edx
mov edx, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x120]
sar edx, cl
mov eax, dword [ebp - 0xec]
mov dword [eax], edx
cmp dword [ebp - 0x368], 0x7e7a
jne 0x472ec9
movzx eax, word [ebp - 0x448]
movzx ecx, word [ebp - 0x450]
cdq
idiv ecx
movzx edx, word [ebp - 0x464]
cmp eax, edx
jg 0x47326b
lea eax, [ebp - 0x178]
mov dword [ebp - 0x2fc], eax
mov dword [ebp - 0x44c], 0x4c2f
movzx ecx, word [ebp - 0x448]
mov dword [ebp - 0x48c], ecx
cmp dword [ebp - 0x48c], 0x90a
je 0x473206
jmp 0x473236
mov edx, dword [ebp - 0x138]
add edx, dword [ebp - 0x120]
mov eax, dword [ebp - 0xec]
mov dword [eax], edx
push 0xb
lea ecx, [ebp - 0x44]
push ecx
push fcn.00478870
mov edx, dword [ebp - 0x168]
push edx
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [ebp - 0xc], eax
jmp 0x47326b
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x120]
mov dword [ebp - 0x160], ecx
lea edx, [ebp - 0xd5]
mov dword [ebp - 0x208], edx
movzx eax, word [ebp - 0x448]
movzx ecx, word [ebp - 0x450]
imul eax, ecx
mov word [ebp - 8], ax
lea edx, [ebp - 0x25c]
mov dword [ebp - 0xc0], edx
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0xec]
mov dword [edx], ecx
mov eax, dword [ebp - 0x208]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 0x45d]
sub ecx, edx
mov eax, dword [ebp - 0x4c]
mov byte [eax], cl
mov ecx, dword [ebp - 0x208]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x4c]
movzx ecx, byte [eax]
add edx, ecx
mov byte [ebp - 0x45d], dl
mov edx, dword [ebp - 0x2dc]
add edx, dword [ebp - 0x25c]
mov eax, dword [ebp - 0xc0]
mov dword [eax], edx
movzx ecx, word [ebp - 8]
movzx edx, word [ebp - 0x448]
sub ecx, edx
mov word [ebp - 0x464], cx
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0xec]
mov dword [edx], ecx
mov eax, dword [ebp - 0x23c]
add eax, 0x91
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x25c]
mov dword [ebp - 0x2dc], edx
mov eax, dword [ebp - 0x138]
sub eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
movzx edx, byte [ebp - 0x45d]
mov eax, dword [ebp - 0x4c]
movzx ecx, byte [eax]
add edx, ecx
mov byte [ebp - 0xd5], dl
movzx edx, word [ebp - 0x448]
movzx eax, word [ebp - 0x450]
or edx, eax
mov word [ebp - 0x464], dx
mov edx, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x120]
sar edx, cl
mov eax, dword [ebp - 0xec]
mov dword [eax], edx
mov ecx, dword [ebp - 0x160]
xor ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0xec]
mov dword [edx], ecx
mov eax, dword [ebp - 0x2fc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2dc]
shl edx, cl
mov eax, dword [ebp - 0x2fc]
mov dword [eax], edx
cmp dword [ebp - 0x23c], 0x31a2
jb 0x473277
mov cx, word [ebp - 0x464]
mov word [ebp - 0xc8], cx
mov edx, dword [ebp - 0x138]
imul edx, dword [ebp - 0x120]
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x160]
cmp edx, ecx
jne 0x47340c
mov edx, dword [ebp - 0xec]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx]
push edx
call fcn.004ef7c0
add esp, 8
mov eax, dword [ebp - 0x4c]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 0xd5]
sub ecx, edx
mov eax, dword [ebp - 0x208]
mov byte [eax], cl
mov dword [ebp - 0x2b8], 0xf2e2
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0x2fc]
mov eax, dword [edx]
add eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x178], eax
mov ecx, dword [ebp - 0x278]
mov edx, dword [ebp - 0x2dc]
and edx, dword [ecx]
mov eax, dword [ebp - 0x178]
sub eax, dword [ebp - 0x25c]
cmp edx, eax
ja 0x473562
mov ecx, dword [ebp - 0x120]
mov dword [ebp - 0x218], ecx
mov edx, dword [ebp - 0xec]
mov eax, dword [edx]
sub eax, dword [ebp - 0x120]
mov dword [ebp - 0x160], eax
movzx ecx, byte [ebp - 0xd5]
mov edx, dword [ebp - 0x4c]
movzx eax, byte [edx]
add ecx, eax
mov edx, dword [ebp - 0x208]
movzx eax, byte [edx]
movzx edx, byte [ebp - 0x45d]
add eax, edx
cmp ecx, eax
jle 0x4734e9
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
mov dword [ebp - 0x490], ecx
cmp dword [ebp - 0x490], 0x1bb6b832
je 0x4734b9
jmp 0x4734d5
lea edx, [ebp - 0xd5]
push edx
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.ole32.dll_ProgIDFromCLSID]
mov dword [ebp - 0x15c], eax
jmp 0x4734e9
mov ecx, dword [ebp - 0xec]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x120]
mov dword [ebp - 0x218], edx
movzx eax, word [ebp - 0xc8]
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0x9fc
je 0x47354a
cmp dword [ebp - 0x494], 0xea5c
je 0x473510
jmp 0x473562
mov cl, byte [ebp - 0xd5]
mov byte [ebp - 0x109], cl
lea edx, [ebp - 0x450]
mov dword [ebp - 0x150], edx
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x294], 0x398d
mov dword [ebp - 0x290], 0x7dae
jmp 0x473562
mov ecx, dword [ebp - 0xec]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x218]
sar edx, cl
mov eax, dword [ebp - 0xec]
mov dword [eax], edx
mov dword [ebp - 0xdc], 0xf137
mov dword [ebp - 0x35c], 0x5698
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
mov dword [ebp - 0x498], edx
cmp dword [ebp - 0x498], 0xa18
je 0x473619
cmp dword [ebp - 0x498], 0xa240
je 0x4735a6
jmp 0x47368e
lea eax, [ebp - 0x138]
mov dword [ebp - 0x104], eax
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
mov dword [ebp - 0x49c], edx
cmp dword [ebp - 0x49c], 0xc66
je 0x4735cf
jmp 0x473617
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x278]
mov edx, dword [eax]
xor edx, dword [ecx]
mov dword [ebp - 0x214], edx
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0xb8]
push ecx
call dword [sym.imp.SHELL32.dll_ILSaveToStream]
mov dword [ebp - 0x15c], eax
mov edx, dword [ebp - 0x150]
movzx eax, word [edx]
movzx ecx, word [ebp - 8]
or eax, ecx
mov edx, dword [ebp - 0x150]
mov word [edx], ax
jmp 0x47368e
movzx eax, byte [ebp - 0x109]
mov ecx, dword [ebp - 0x4c]
movzx ecx, byte [ecx]
shl eax, cl
mov byte [ebp - 0xd5], al
mov edx, dword [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x208]
movzx ecx, byte [eax]
push ecx
call fcn.004ef7c0
add esp, 8
movzx edx, byte [ebp - 0x109]
movzx eax, byte [ebp - 0x45d]
and edx, eax
mov ecx, dword [ebp - 0x208]
mov byte [ecx], dl
lea edx, [ebp - 0x150]
push edx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.SHELL32.dll_ILCombine]
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0x208]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 0xd5]
add edx, eax
mov byte [ebp - 0x109], dl
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0x468]
sub edx, dword [ecx]
mov dword [ebp - 0x25c], edx
mov dword [ebp - 0x22c], 0x139a
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x104]
add ecx, dword [edx]
mov dword [ebp - 0x120], ecx
lea eax, [ebp - 0xd5]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x14c], 0x9292
jae 0x4739ae
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
movzx eax, word [ebp - 8]
add edx, eax
mov word [ebp - 0x464], dx
mov ecx, dword [ebp - 0xec]
mov edx, dword [ebp - 0x218]
and edx, dword [ecx]
mov eax, dword [ebp - 0x104]
mov dword [eax], edx
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ebp - 0xc0]
mov eax, dword [ecx]
sub eax, dword [edx]
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0xec]
mov edx, dword [ecx]
add edx, dword [ebp - 0x160]
mov dword [ebp - 0x218], edx
mov eax, dword [ebp - 0x218]
sub eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
movzx edx, word [ebp - 0x448]
movzx eax, word [ebp - 0xc8]
sub edx, eax
mov ecx, dword [ebp - 0x150]
mov word [ecx], dx
movzx edx, byte [ebp - 0x45d]
movzx ecx, byte [ebp - 0xd5]
sar edx, cl
mov eax, dword [ebp - 0x220]
mov byte [eax], dl
mov edx, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x214]
shl edx, cl
mov dword [ebp - 0x25c], edx
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
xor ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0x104]
mov dword [edx], ecx
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
or ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x104]
mov dword [edx], ecx
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x104]
mov edx, dword [eax]
and edx, dword [ecx]
mov eax, dword [ebp - 0xec]
mov dword [eax], edx
mov ecx, dword [ebp - 0x104]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0xec]
mov dword [eax], edx
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0x160]
add edx, dword [ecx]
mov dword [ebp - 0x120], edx
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
movzx edx, word [ebp - 8]
add ecx, edx
mov eax, dword [ebp - 0x150]
mov word [eax], cx
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
movzx eax, word [ebp - 0xc8]
sub edx, eax
mov ecx, dword [ebp - 0x150]
mov word [ecx], dx
mov edx, dword [ebp - 0x208]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0x109]
sub eax, ecx
mov byte [ebp - 0xd5], al
mov edx, dword [ebp - 0x2fc]
mov eax, dword [ebp - 0x2dc]
and eax, dword [edx]
mov ecx, dword [ebp - 0xc0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x2fc]
mov eax, dword [ebp - 0x2dc]
sub eax, dword [edx]
mov dword [ebp - 0x178], eax
movzx ecx, word [ebp - 0x450]
movzx edx, word [ebp - 0xc8]
add ecx, edx
mov eax, dword [ebp - 0x150]
mov word [eax], cx
mov ecx, dword [ebp - 0x14c]
add ecx, 0x8b
mov dword [ebp - 0x14c], ecx
mov edx, dword [ebp - 0x4c]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x220]
movzx edx, byte [ecx]
add eax, edx
mov ecx, dword [ebp - 0x208]
mov byte [ecx], al
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x218]
mov ecx, dword [edx]
shl eax, cl
mov dword [ebp - 0x138], eax
mov ecx, dword [ebp - 0x25c]
or ecx, dword [ebp - 0x468]
mov dword [ebp - 0x178], ecx
mov edx, dword [ebp - 0xec]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x160]
sar eax, cl
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x278]
mov edx, dword [ebp - 0xc0]
mov eax, dword [ecx]
xor eax, dword [edx]
mov dword [ebp - 0x468], eax
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x220]
movzx ecx, byte [eax]
and edx, ecx
mov eax, dword [ebp - 0x4c]
mov byte [eax], dl
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x448]
add edx, eax
mov ecx, dword [ebp - 0x150]
mov word [ecx], dx
mov edx, dword [ebp - 0x278]
mov eax, dword [edx]
add eax, dword [ebp - 0x178]
mov dword [ebp - 0x2dc], eax
mov ecx, dword [ebp - 0xec]
mov edx, dword [ecx]
add edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0xec]
mov dword [eax], edx
mov ecx, dword [ebp - 0xec]
mov edx, dword [ebp - 0x160]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x104]
mov dword [eax], edx
mov ecx, dword [ebp - 0xec]
mov edx, dword [ebp - 0x218]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x104]
mov dword [eax], edx
mov ecx, dword [ebp - 0x220]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x208]
movzx ecx, byte [eax]
sub edx, ecx
mov byte [ebp - 0x45d], dl
jmp 0x4736ce
cmp dword [ebp - 0x54], 0x2abd
je 0x473ac0
movzx edx, word [ebp - 0xc8]
movzx eax, word [ebp - 0x450]
and edx, eax
mov ecx, dword [ebp - 0x150]
mov word [ecx], dx
mov edx, dword [ebp - 0x25c]
sub edx, dword [ebp - 0x468]
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0xec]
mov edx, dword [eax]
xor edx, dword [ecx]
mov eax, dword [ebp - 0x104]
mov dword [eax], edx
mov edx, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x120]
shl edx, cl
mov dword [ebp - 0x160], edx
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [eax]
or edx, dword [ecx]
mov eax, dword [ebp - 0x278]
mov dword [eax], edx
mov ecx, dword [ebp - 0x54]
add ecx, 0x1a
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x2fc]
mov eax, dword [ebp - 0xc0]
mov edx, dword [edx]
mov ecx, dword [eax]
shr edx, cl
mov dword [ebp - 0x468], edx
mov eax, dword [ebp - 0x4c]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x220]
movzx eax, byte [edx]
add ecx, eax
mov byte [ebp - 0x109], cl
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x448]
and edx, eax
mov ecx, dword [ebp - 0x150]
mov word [ecx], dx
mov edx, dword [ebp - 0x160]
add edx, dword [ebp - 0x120]
mov dword [ebp - 0x138], edx
mov eax, dword [ebp - 0x278]
mov ecx, dword [ebp - 0xc0]
mov edx, dword [eax]
sub edx, dword [ecx]
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0xec]
mov dword [edx], ecx
jmp 0x4739ae
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax]
mov dword [ebp - 0x4a0], ecx
cmp dword [ebp - 0x4a0], 0x28ec14b3
je 0x473adc
jmp 0x473b39
mov edx, dword [ebp - 0x104]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xec]
add eax, dword [ecx]
mov edx, dword [ebp - 0x104]
mov dword [edx], eax
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.COMDLG32.dll_ChooseFontW]
mov dword [ebp - 0x434], eax
movzx ecx, word [ebp - 0x448]
movzx edx, word [ebp - 0xc8]
sub ecx, edx
mov word [ebp - 0x450], cx
mov eax, dword [ebp - 0x220]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x4c]
movzx eax, byte [edx]
sub ecx, eax
mov edx, dword [ebp - 0x208]
mov byte [edx], cl
jmp 0x473ba4
mov al, byte [ebp - 0x109]
mov byte [ebp - 0x4a4], al
cmp byte [ebp - 0x4a4], 0x40
je 0x473b50
jmp 0x473ba4
mov ecx, dword [ebp - 0x138]
push ecx
movzx edx, byte [ebp - 0xd5]
push edx
call fcn.004ef7c0
add esp, 8
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov dword [ebp - 0x154], eax
movzx eax, byte [ebp - 0x109]
movzx ecx, byte [ebp - 0x45d]
add eax, ecx
mov edx, dword [ebp - 0x4c]
mov byte [edx], al
call fcn.004d7e60
mov eax, dword [ebp - 0x220]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x4c]
movzx eax, byte [edx]
and ecx, eax
mov byte [ebp - 0x109], cl
mov ecx, dword [ebp - 0xec]
mov edx, dword [ecx]
mov dword [ebp - 0x4a8], edx
cmp dword [ebp - 0x4a8], 0x5014
je 0x473bc3
jmp 0x478769
cmp dword [ebp - 0x35c], 0x5fb3
je 0x473e25
movzx eax, word [ebp - 0x448]
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
sub eax, edx
mov word [ebp - 0x464], ax
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x138]
and ecx, dword [eax]
mov edx, dword [ebp - 0xec]
mov dword [edx], ecx
mov eax, dword [ebp - 0x278]
mov ecx, dword [ebp - 0x468]
add ecx, dword [eax]
mov edx, dword [ebp - 0x2fc]
mov dword [edx], ecx
mov eax, dword [ebp - 0x35c]
add eax, 0x6f
mov dword [ebp - 0x35c], eax
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x450]
sub edx, eax
mov ecx, dword [ebp - 0x150]
mov word [ecx], dx
movzx edx, byte [ebp - 0x109]
mov eax, dword [ebp - 0x220]
movzx ecx, byte [eax]
sub edx, ecx
mov eax, dword [ebp - 0x208]
mov byte [eax], dl
mov ecx, dword [ebp - 0x120]
sub ecx, dword [ebp - 0x218]
mov edx, dword [ebp - 0x104]
mov dword [edx], ecx
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x138]
sub ecx, dword [eax]
mov dword [ebp - 0x160], ecx
mov edx, dword [ebp - 0x278]
mov eax, dword [edx]
add eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp - 0x138]
add ecx, dword [ebp - 0x218]
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 0x218]
sub edx, dword [ebp - 0x120]
mov eax, dword [ebp - 0x104]
mov dword [eax], edx
mov ecx, dword [ebp - 0x178]
or ecx, dword [ebp - 0x25c]
mov edx, dword [ebp - 0x2fc]
mov dword [edx], ecx
mov eax, dword [ebp - 0x150]
movzx edx, word [eax]
movzx ecx, word [ebp - 0x450]
sar edx, cl
mov word [ebp - 0x464], dx
movzx eax, word [ebp - 8]
movzx ecx, word [ebp - 0x448]
xor eax, ecx
mov word [ebp - 0x450], ax
movzx edx, byte [ebp - 0xd5]
movzx ecx, byte [ebp - 0x109]
shl edx, cl
mov eax, dword [ebp - 0x208]
mov byte [eax], dl
mov ecx, dword [ebp - 0x278]
mov edx, dword [ebp - 0x178]
and edx, dword [ecx]
mov dword [ebp - 0x468], edx
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 0x104]
mov dword [edx], ecx
movzx eax, word [ebp - 0x464]
movzx ecx, word [ebp - 0xc8]
add eax, ecx
mov word [ebp - 0x450], ax
mov edx, dword [ebp - 0x4c]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0x45d]
and eax, ecx
mov edx, dword [ebp - 0x4c]
mov byte [edx], al
mov eax, dword [ebp - 0x278]
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [eax]
sub edx, dword [ecx]
mov eax, dword [ebp - 0xc0]
mov dword [eax], edx
mov ecx, dword [ebp - 0x138]
sub ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 0x104]
mov dword [edx], ecx
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x218]
sub ecx, dword [eax]
mov edx, dword [ebp - 0xec]
mov dword [edx], ecx
mov eax, dword [ebp - 0x278]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x2fc]
add ecx, dword [edx]
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
movzx ecx, word [ebp - 0x450]
movzx edx, word [ebp - 0xc8]
add ecx, edx
mov word [ebp - 0x448], cx
mov eax, dword [ebp - 0x208]
movzx edx, byte [eax]
mov eax, dword [ebp - 0x4c]
movzx ecx, byte [eax]
sar edx, cl
mov byte [ebp - 0xd5], dl
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0x120]
mov ecx, dword [ecx]
shl edx, cl
mov eax, dword [ebp - 0xec]
mov dword [eax], edx
mov ecx, dword [ebp - 0x120]
xor ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 0x104]
mov dword [edx], ecx
jmp 0x473bc3
movzx eax, byte [ebp - 0x109]
mov ecx, dword [ebp - 0x208]
movzx edx, byte [ecx]
or eax, edx
mov ecx, dword [ebp - 0x220]
movzx edx, byte [ecx]
movzx ecx, byte [ebp - 0xd5]
and edx, ecx
cmp eax, edx
jl 0x473ed2
movzx edx, word [ebp - 0x464]
mov dword [ebp - 0x4ac], edx
cmp dword [ebp - 0x4ac], 0
je 0x473e69
jmp 0x473ebc
mov eax, dword [ebp - 0x150]
mov cx, word [eax]
mov word [ebp - 0x110], cx
movzx edx, byte [ebp - 0x109]
movzx eax, byte [ebp - 0xd5]
sub edx, eax
mov ecx, dword [ebp - 0x4c]
mov byte [ecx], dl
mov dword [ebp - 0x240], 0xf636
lea edx, [ebp - 0x468]
mov dword [ebp - 0x43c], edx
mov eax, dword [ebp - 0x278]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x214]
mov edx, dword [ebp - 0x278]
mov dword [edx], ecx
jmp 0x473ed2
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0xec]
mov dword [edx], ecx
cmp dword [ebp - 0x240], 0xbee6
jb 0x4741c0
mov eax, dword [ebp - 0x240]
sub eax, 0xf0
mov dword [ebp - 0x240], eax
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x448]
add edx, eax
mov word [ebp - 0x464], dx
mov ecx, dword [ebp - 0x160]
and ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0xec]
mov dword [edx], ecx
movzx eax, word [ebp - 0x464]
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
sub eax, edx
mov word [ebp - 0x450], ax
movzx eax, byte [ebp - 0x45d]
movzx ecx, byte [ebp - 0x109]
add eax, ecx
mov edx, dword [ebp - 0x220]
mov byte [edx], al
mov eax, dword [ebp - 0x43c]
mov ecx, dword [ebp - 0x214]
add ecx, dword [eax]
mov dword [ebp - 0x2dc], ecx
mov edx, dword [ebp - 0x150]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x110]
add eax, ecx
mov word [ebp - 0x464], ax
mov edx, dword [ebp - 0x218]
or edx, dword [ebp - 0x160]
mov eax, dword [ebp - 0xec]
mov dword [eax], edx
mov ecx, dword [ebp - 0x214]
xor ecx, dword [ebp - 0x178]
mov dword [ebp - 0x25c], ecx
movzx edx, word [ebp - 0x448]
movzx ecx, word [ebp - 0x464]
sar edx, cl
mov eax, dword [ebp - 0x150]
mov word [eax], dx
movzx edx, byte [ebp - 0xd5]
movzx ecx, byte [ebp - 0x109]
shl edx, cl
mov byte [ebp - 0x45d], dl
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0xec]
mov dword [edx], ecx
mov eax, dword [ebp - 0x218]
add eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx]
sub eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x278]
mov dword [ecx], eax
mov edx, dword [ebp - 0xec]
mov eax, dword [edx]
add eax, dword [ebp - 0x120]
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x448]
sub edx, eax
mov ecx, dword [ebp - 0x150]
mov word [ecx], dx
movzx edx, word [ebp - 0x110]
movzx eax, word [ebp - 0xc8]
sub edx, eax
mov word [ebp - 0x464], dx
mov ecx, dword [ebp - 0x160]
and ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0xec]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x2fc]
add ecx, dword [edx]
mov dword [ebp - 0x178], ecx
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x120]
add ecx, dword [eax]
mov dword [ebp - 0x160], ecx
mov edx, dword [ebp - 0x120]
sub edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x104]
mov dword [eax], edx
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x448]
or edx, eax
mov ecx, dword [ebp - 0x150]
mov word [ecx], dx
movzx edx, byte [ebp - 0xd5]
mov eax, dword [ebp - 0x208]
movzx ecx, byte [eax]
shl edx, cl
mov byte [ebp - 0x45d], dl
mov ecx, dword [ebp - 0x25c]
xor ecx, dword [ebp - 0x468]
mov dword [ebp - 0x2dc], ecx
mov edx, dword [ebp - 0xec]
mov eax, dword [ebp - 0x218]
mov ecx, dword [edx]
sar eax, cl
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
mov edx, dword [ebp - 0x218]
and edx, dword [ebp - 0x120]
mov eax, dword [ebp - 0x104]
mov dword [eax], edx
mov ecx, dword [ebp - 0x104]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xec]
add edx, dword [eax]
mov ecx, dword [ebp - 0x104]
mov dword [ecx], edx
mov edx, dword [ebp - 0xec]
mov eax, dword [ebp - 0x218]
add eax, dword [edx]
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
mov edx, dword [ebp - 0x208]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x220]
movzx edx, byte [ecx]
add eax, edx
mov ecx, dword [ebp - 0x4c]
mov byte [ecx], al
mov edx, dword [ebp - 0xec]
mov eax, dword [edx]
sub eax, dword [ebp - 0x160]
mov dword [ebp - 0x218], eax
movzx ecx, word [ebp - 0x110]
movzx edx, word [ebp - 0x448]
sub ecx, edx
mov word [ebp - 0x464], cx
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
movzx edx, word [ebp - 0xc8]
add ecx, edx
mov word [ebp - 0x110], cx
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [ebp - 0x25c]
and ecx, dword [eax]
mov dword [ebp - 0x214], ecx
jmp 0x473ed2
mov edx, dword [ebp - 0x43c]
mov eax, dword [edx]
sub eax, dword [ebp - 0x214]
mov edx, dword [ebp - 0x25c]
mov ecx, dword [ebp - 0x2dc]
shr edx, cl
cmp eax, edx
ja 0x478755
mov eax, dword [ebp - 0x160]
cdq
idiv dword [ebp - 0x120]
mov ecx, dword [ebp - 0xec]
mov edx, dword [ecx]
xor edx, dword [ebp - 0x138]
cmp eax, edx
jg 0x474355
movzx eax, byte [ebp - 0x45d]
push eax
push 0xfffffffffffffffd
call fcn.004d1cd0
movzx ecx, word [ebp - 0xc8]
mov dword [ebp - 0x4b0], ecx
cmp dword [ebp - 0x4b0], 0x9be
je 0x474339
cmp dword [ebp - 0x4b0], 0xa50
je 0x474244
jmp 0x474355
movzx edx, byte [ebp - 0x45d]
movzx ecx, byte [ebp - 0xd5]
shl edx, cl
mov eax, dword [ebp - 0x220]
mov byte [eax], dl
mov ecx, dword [ebp - 0x43c]
mov edx, dword [ebp - 0x178]
add edx, dword [ecx]
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x468]
cmp edx, ecx
jae 0x474303
lea edx, [ebp - 0x178]
push edx
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x43c]
push ecx
lea edx, [ebp - 0x288]
push edx
call sub.ole32.dll_CoGetInterceptor
mov dword [ebp - 0x50], eax
movzx eax, word [ebp - 0x448]
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
sub eax, edx
mov word [ebp - 0x464], ax
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x104]
mov dword [edx], ecx
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x178]
push ecx
call dword [sym.imp.ole32.dll_CoSwitchCallContext]
mov dword [ebp - 0x454], eax
mov edx, dword [ebp - 0x2fc]
mov eax, dword [edx]
sub eax, dword [ebp - 0x178]
mov dword [ebp - 0x25c], eax
jmp 0x474337
mov ecx, dword [ebp - 0xec]
mov edx, dword [ebp - 0x138]
add edx, dword [ecx]
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x218]
add ecx, dword [eax]
cmp edx, ecx
jle 0x474337
mov edx, dword [ebp - 0x218]
add edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0xec]
mov dword [eax], edx
jmp 0x474355
lea ecx, [ebp - 0x150]
push ecx
push 0x75
lea edx, [ebp - 0x25c]
push edx
call dword [sym.imp.ole32.dll_CoGetStdMarshalEx]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
mov dword [ebp - 0x4b4], ecx
cmp dword [ebp - 0x4b4], 0xeb2
je 0x47437e
cmp dword [ebp - 0x4b4], 0xfffd
je 0x4743b1
jmp 0x4743f7
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0xec]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x104]
mov dword [edx], ecx
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x464]
and ecx, edx
mov word [ebp - 0x450], cx
jmp 0x4743f7
mov eax, dword [ebp - 0x208]
movzx edx, byte [eax]
mov eax, dword [ebp - 0x220]
movzx ecx, byte [eax]
shl edx, cl
mov ecx, dword [ebp - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx]
mov dword [ebp - 0x364], eax
mov ecx, dword [ebp - 0xec]
mov edx, dword [ecx]
or edx, dword [ebp - 0x160]
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x18], 0x10ac1
mov byte [ebp - 0x5d], 0x5f
movzx eax, byte [ebp - 0x109]
movzx ecx, byte [ebp - 0x45d]
sar eax, cl
movzx ecx, byte [ebp - 0xd5]
mov edx, dword [ebp - 0x208]
movzx edx, byte [edx]
xor ecx, edx
cmp eax, ecx
je 0x474514
movzx eax, word [ebp - 0x448]
movzx ecx, word [ebp - 0x464]
cdq
idiv ecx
movzx edx, word [ebp - 0x110]
mov ecx, dword [ebp - 0x150]
movzx ecx, word [ecx]
sub edx, ecx
cmp eax, edx
je 0x4744ed
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx]
mov dword [ebp - 0x4b8], eax
cmp dword [ebp - 0x4b8], 0x5edb5f4f
je 0x474474
cmp dword [ebp - 0x4b8], 0xefcc479b
je 0x4744d2
jmp 0x4744eb
mov ecx, dword [ebp - 0x220]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 0x109]
sub edx, eax
mov ecx, dword [ebp - 0x4c]
mov byte [ecx], dl
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0xb0]
push eax
push 0x25
mov ecx, dword [ebp - 0x2ac]
push ecx
call dword [sym.imp.SHELL32.dll_SHChangeNotification_Lock]
mov dword [ebp - 0x2e0], eax
mov edx, dword [ebp - 0x220]
movzx eax, byte [edx]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
push 0x20
movzx edx, byte [ebp - 0x5d]
push edx
movzx eax, byte [ebp - 0x5d]
push eax
call fcn.00429f50
jmp 0x4744eb
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x208]
movzx ecx, byte [eax]
and edx, ecx
mov eax, dword [ebp - 0x220]
mov byte [eax], dl
jmp 0x474514
movsx ecx, byte [ebp - 0x5d]
cmp ecx, 0x2f
je 0x474514
lea edx, [ebp - 0x43c]
push edx
push fcn.0046d040
mov eax, dword [ebp - 0x260]
push eax
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [ebp - 0xbc], eax
mov cx, word [ebp - 0x450]
mov word [ebp - 0x3b0], cx
movzx edx, word [ebp - 0xc8]
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
add edx, ecx
movzx eax, word [ebp - 0x3b0]
movzx ecx, word [ebp - 0x450]
sub eax, ecx
cmp edx, eax
jg 0x474573
mov edx, dword [ebp - 0x2dc]
sub edx, dword [ebp - 0x178]
mov dword [ebp - 0x214], edx
call fcn.004d7e60
mov eax, dword [ebp - 0x138]
sub eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
mov edx, dword [ebp - 0x208]
mov al, byte [edx]
mov byte [ebp - 0x4bc], al
cmp byte [ebp - 0x4bc], 0
je 0x47458c
jmp 0x47460a
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x45c], ecx
mov edx, dword [ebp - 0x2fc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x43c]
add eax, dword [ecx]
mov edx, dword [ebp - 0x278]
mov dword [edx], eax
mov eax, dword [ebp - 0x45c]
mov ecx, dword [ebp - 0x138]
add ecx, dword [eax]
mov edx, dword [ebp - 0xec]
mov dword [edx], ecx
lea eax, [ebp - 0xc8]
mov dword [ebp - 0x1dc], eax
lea ecx, [ebp - 0xd5]
mov dword [ebp - 0x234], ecx
mov edx, dword [ebp - 0xec]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x104]
add eax, dword [ecx]
mov edx, dword [ebp - 0xec]
mov dword [edx], eax
mov eax, dword [ebp - 0x2dc]
add eax, dword [ebp - 0x214]
mov dword [ebp - 0x438], eax
jmp 0x474638
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0xec]
mov eax, dword [ecx]
xor eax, dword [edx]
mov dword [ebp - 0x218], eax
lea ecx, [ebp - 0x214]
push ecx
push 0xa4
call dword [sym.imp.ole32.dll_CoGetMalloc]
mov dword [ebp - 0x154], eax
mov edx, dword [ebp - 0xec]
mov eax, dword [ebp - 0x45c]
mov esi, dword [edx]
mov ecx, dword [eax]
sar esi, cl
mov ecx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x138]
cdq
idiv dword [ecx]
cmp esi, eax
jne 0x47468e
mov edx, dword [ebp - 0x2fc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x43c]
add eax, dword [ecx]
mov dword [ebp - 0x468], eax
mov edx, dword [ebp - 0x45c]
mov eax, dword [ebp - 0x160]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
jmp 0x478663
mov edx, dword [ebp - 0x234]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx]
sub eax, edx
mov ecx, dword [ebp - 0x220]
movzx edx, byte [ecx]
movzx ecx, byte [ebp - 0xd5]
sub edx, ecx
cmp eax, edx
jge 0x474775
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x45c]
mov edx, dword [edx]
or edx, dword [eax]
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x120]
sar eax, cl
cmp edx, eax
jl 0x47472f
lea ecx, [ebp - 0x174]
push ecx
lea edx, [ebp - 0x358]
push edx
call dword [sym.imp.ole32.dll_CoAllowSetForegroundWindow]
mov dword [ebp - 0x108], eax
movzx eax, byte [ebp - 0xd5]
mov ecx, dword [ebp - 0x4c]
movzx ecx, byte [ecx]
shl eax, cl
mov edx, dword [ebp - 0x234]
mov byte [edx], al
movzx eax, byte [ebp - 0x45d]
push eax
mov ecx, dword [ebp - 0x438]
push ecx
push 0x95
movzx edx, byte [ebp - 0x5d]
push edx
movzx eax, byte [ebp - 0x5d]
push eax
call fcn.00429f50
mov ecx, dword [ebp - 0x1dc]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
xor edx, ecx
mov word [ebp - 0x448], dx
mov edx, dword [ebp - 0x214]
and edx, dword [ebp - 0x178]
mov eax, dword [ebp - 0xc0]
mov dword [eax], edx
lea ecx, [ebp - 0xe8]
push ecx
lea edx, [ebp - 0x5d]
push edx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x45c]
add ecx, dword [edx]
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
movzx ecx, byte [ebp - 0x45d]
mov edx, dword [ebp - 0x208]
movzx eax, byte [edx]
sub ecx, eax
movzx edx, byte [ebp - 0x109]
movzx eax, byte [ebp - 0xd5]
add edx, eax
cmp ecx, edx
jge 0x4747c9
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx]
push edx
mov eax, dword [ebp - 0x1dc]
movzx ecx, word [eax]
push ecx
call section..text
cmp dword [ebp - 0xd0], 0x13e4e
je 0x474bec
mov edx, dword [ebp - 0x120]
add edx, dword [ebp - 0x160]
mov dword [ebp - 0x138], edx
mov eax, dword [ebp - 0x178]
and eax, dword [ebp - 0x364]
mov dword [ebp - 0x468], eax
movzx ecx, byte [ebp - 0x109]
mov edx, dword [ebp - 0x234]
movzx eax, byte [edx]
add ecx, eax
mov edx, dword [ebp - 0x220]
mov byte [edx], cl
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x464]
sub ecx, edx
mov eax, dword [ebp - 0x150]
mov word [eax], cx
mov ecx, dword [ebp - 0xec]
mov edx, dword [ebp - 0x218]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x45c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x45c]
mov edx, dword [ebp - 0xec]
mov eax, dword [ecx]
sub eax, dword [edx]
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x468]
or ecx, dword [ebp - 0x2dc]
mov edx, dword [ebp - 0x278]
mov dword [edx], ecx
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0xec]
mov edx, dword [eax]
xor edx, dword [ecx]
mov eax, dword [ebp - 0x45c]
mov dword [eax], edx
mov ecx, dword [ebp - 0xec]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x160]
shl edx, cl
mov eax, dword [ebp - 0x104]
mov dword [eax], edx
mov ecx, dword [ebp - 0x43c]
mov edx, dword [ebp - 0x364]
mov ecx, dword [ecx]
shr edx, cl
mov eax, dword [ebp - 0xc0]
mov dword [eax], edx
mov ecx, dword [ebp - 0x160]
and ecx, dword [ebp - 0x218]
mov edx, dword [ebp - 0x104]
mov dword [edx], ecx
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1dc]
movzx eax, word [edx]
add ecx, eax
mov word [ebp - 0x3b0], cx
movzx ecx, byte [ebp - 0xd5]
mov edx, dword [ebp - 0x4c]
movzx eax, byte [edx]
add ecx, eax
mov edx, dword [ebp - 0x208]
mov byte [edx], cl
mov eax, dword [ebp - 0x214]
sub eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x468], eax
mov ecx, dword [ebp - 0x45c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xec]
add edx, dword [eax]
mov dword [ebp - 0x120], edx
movzx ecx, byte [ebp - 0x109]
movzx edx, byte [ebp - 0xd5]
sub ecx, edx
mov byte [ebp - 0x45d], cl
mov eax, dword [ebp - 0x1dc]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x150]
movzx eax, word [edx]
and ecx, eax
mov word [ebp - 0x448], cx
mov ecx, dword [ebp - 0x178]
sub ecx, dword [ebp - 0x214]
mov dword [ebp - 0x2dc], ecx
movzx edx, word [ebp - 8]
movzx eax, word [ebp - 0x110]
sub edx, eax
mov word [ebp - 0x464], dx
mov ecx, dword [ebp - 0x45c]
mov edx, dword [ebp - 0x160]
add edx, dword [ecx]
mov eax, dword [ebp - 0xec]
mov dword [eax], edx
mov ecx, dword [ebp - 0x278]
mov edx, dword [ebp - 0xc0]
mov eax, dword [ecx]
or eax, dword [edx]
mov dword [ebp - 0x364], eax
movzx edx, byte [ebp - 0x45d]
mov eax, dword [ebp - 0x208]
movzx ecx, byte [eax]
shl edx, cl
mov ecx, dword [ebp - 0x220]
mov byte [ecx], dl
movzx edx, word [ebp - 0x110]
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
xor edx, ecx
mov eax, dword [ebp - 0x1dc]
mov word [eax], dx
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0x45c]
mov eax, dword [ecx]
mov ecx, dword [edx]
sar eax, cl
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
mov edx, dword [ebp - 0x104]
mov eax, dword [edx]
and eax, dword [ebp - 0x120]
mov dword [ebp - 0x138], eax
movsx ecx, byte [ebp - 0x5d]
sub ecx, 0x36
mov byte [ebp - 0x5d], cl
movsx edx, byte [ebp - 0x5d]
add edx, 0x7e
mov byte [ebp - 0x5d], dl
mov eax, dword [ebp - 0x1dc]
movzx ecx, word [eax]
movzx edx, word [ebp - 8]
sub ecx, edx
mov word [ebp - 0x464], cx
movzx eax, byte [ebp - 0x45d]
movzx ecx, byte [ebp - 0xd5]
add eax, ecx
mov edx, dword [ebp - 0x208]
mov byte [edx], al
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [ebp - 0x278]
mov edx, dword [eax]
sub edx, dword [ecx]
mov dword [ebp - 0x364], edx
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [ebp - 0x468]
add ecx, dword [eax]
mov dword [ebp - 0x438], ecx
mov edx, dword [ebp - 0xec]
mov eax, dword [edx]
and eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x45c]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov edx, dword [ebp - 0xec]
mov dword [edx], ecx
mov eax, dword [ebp - 0xd0]
add eax, 0xca
mov dword [ebp - 0xd0], eax
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0x45c]
mov eax, dword [ecx]
xor eax, dword [edx]
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
movzx edx, word [ebp - 0xc8]
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
sar edx, cl
mov word [ebp - 0x448], dx
movzx ecx, byte [ebp - 0xd5]
movzx edx, byte [ebp - 0x109]
or ecx, edx
mov eax, dword [ebp - 0x220]
mov byte [eax], cl
mov ecx, dword [ebp - 0x278]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x438]
shl edx, cl
mov eax, dword [ebp - 0x2fc]
mov dword [eax], edx
mov ecx, dword [ebp - 0x278]
mov edx, dword [ebp - 0x214]
add edx, dword [ecx]
mov dword [ebp - 0x468], edx
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x160]
and ecx, dword [eax]
mov edx, dword [ebp - 0x104]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x468]
mov dword [ebp - 0x2dc], ecx
mov edx, dword [ebp - 0x150]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x110]
sub eax, ecx
mov word [ebp - 0x450], ax
mov edx, dword [ebp - 0x220]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0xd5]
sub eax, ecx
mov byte [ebp - 0x45d], al
mov edx, dword [ebp - 0x150]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x1dc]
movzx edx, word [ecx]
add eax, edx
mov word [ebp - 0x464], ax
mov eax, dword [ebp - 0x4c]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x208]
movzx eax, byte [edx]
add ecx, eax
mov edx, dword [ebp - 0x220]
mov byte [edx], cl
mov eax, dword [ebp - 0x178]
sub eax, dword [ebp - 0x468]
mov ecx, dword [ebp - 0x43c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x45c]
mov eax, dword [ebp - 0x138]
add eax, dword [edx]
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
jmp 0x4747c9
mov dx, word [ebp - 0xc8]
mov word [ebp - 0x2f0], dx
mov dword [ebp - 0x2f8], 0x6bae
mov eax, dword [ebp - 0x220]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 0x109]
and ecx, edx
mov byte [ebp - 0xd5], cl
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x218]
sar eax, cl
mov ecx, dword [ebp - 0x45c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x278]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x468]
shl eax, cl
mov ecx, dword [ebp - 0xc0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x45c]
mov eax, dword [edx]
xor eax, dword [ebp - 0x218]
mov dword [ebp - 0x138], eax
mov ecx, dword [ebp - 0x104]
mov edx, dword [ecx]
or edx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x45c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x234]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 0xd5]
add edx, eax
mov ecx, dword [ebp - 0x220]
mov byte [ecx], dl
movzx edx, word [ebp - 0x448]
movzx eax, word [ebp - 0x110]
add edx, eax
mov ecx, dword [ebp - 0x1dc]
mov word [ecx], dx
mov edx, dword [ebp - 0x278]
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [edx]
and ecx, dword [eax]
mov edx, dword [ebp - 0xc0]
mov dword [edx], ecx
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x218]
mov edx, dword [ebp - 0xec]
mov dword [edx], ecx
movzx eax, word [ebp - 0x450]
mov ecx, dword [ebp - 0x1dc]
movzx edx, word [ecx]
sub eax, edx
mov word [ebp - 0x464], ax
mov eax, dword [ebp - 0x218]
sub eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
mov edx, dword [ebp - 0xec]
mov eax, dword [ebp - 0x218]
add eax, dword [edx]
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
movsx edx, byte [ebp - 0x5d]
sub edx, 0x10
mov byte [ebp - 0x5d], dl
movsx eax, byte [ebp - 0x5d]
sub eax, 0x5a
mov byte [ebp - 0x5d], al
movzx ecx, word [ebp - 0xc8]
movzx edx, word [ebp - 0x110]
add ecx, edx
mov eax, dword [ebp - 0x150]
mov word [eax], cx
movzx ecx, byte [ebp - 0x109]
mov edx, dword [ebp - 0x234]
movzx eax, byte [edx]
add ecx, eax
mov edx, dword [ebp - 0x220]
mov byte [edx], cl
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [eax]
or ecx, dword [ebp - 0x25c]
mov edx, dword [ebp - 0xc0]
mov dword [edx], ecx
mov eax, dword [ebp - 0x2fc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x468]
shl edx, cl
mov eax, dword [ebp - 0x278]
mov dword [eax], edx
movzx edx, word [ebp - 0x3b0]
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
sar edx, cl
mov word [ebp - 0x464], dx
mov ecx, dword [ebp - 0x18]
sub ecx, 0xa8
mov dword [ebp - 0x18], ecx
movzx edx, word [ebp - 0x2f0]
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
xor edx, ecx
mov word [ebp - 0x464], dx
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0xec]
mov ecx, dword [edx]
and ecx, dword [eax]
mov edx, dword [ebp - 0x45c]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x43c]
add ecx, dword [edx]
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x160]
sub ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x45c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x218]
mov edx, dword [ebp - 0xec]
mov dword [edx], ecx
movzx eax, word [ebp - 0x2f0]
movzx ecx, word [ebp - 0x464]
add eax, ecx
mov edx, dword [ebp - 0x1dc]
mov word [edx], ax
mov eax, dword [ebp - 0x220]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x4c]
movzx eax, byte [edx]
add ecx, eax
mov edx, dword [ebp - 0x208]
mov byte [edx], cl
cmp dword [ebp - 0x18], 0xde21
jae 0x474c1c
mov eax, dword [ebp - 0x438]
sub eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x43c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x104]
mov eax, dword [edx]
mov dword [ebp - 0x170], eax
lea ecx, [ebp - 0x5d]
mov dword [ebp - 0x20c], ecx
cmp dword [ebp - 0x22c], 0x3a3a
ja 0x475083
movzx edx, word [ebp - 0x2f0]
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
sub edx, ecx
mov eax, dword [ebp - 0x1dc]
mov word [eax], dx
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x208]
movzx ecx, byte [eax]
sub edx, ecx
mov eax, dword [ebp - 0x220]
mov byte [eax], dl
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ecx]
or edx, dword [ebp - 0x178]
mov dword [ebp - 0x2dc], edx
mov eax, dword [ebp - 0x138]
xor eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
mov edx, dword [ebp - 0x45c]
mov eax, dword [ebp - 0x218]
mov ecx, dword [edx]
sar eax, cl
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
mov edx, dword [ebp - 0x43c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x178]
shl eax, cl
mov dword [ebp - 0x25c], eax
movzx ecx, word [ebp - 0x450]
mov edx, dword [ebp - 0x150]
movzx eax, word [edx]
and ecx, eax
mov word [ebp - 0x464], cx
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x208]
movzx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0x4c]
mov byte [eax], dl
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x1dc]
movzx ecx, word [eax]
add edx, ecx
mov word [ebp - 0x464], dx
mov edx, dword [ebp - 0x45c]
mov eax, dword [ebp - 0x138]
sub eax, dword [edx]
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
mov edx, dword [ebp - 0x214]
add edx, dword [ebp - 0x468]
mov dword [ebp - 0x25c], edx
mov eax, dword [ebp - 0x138]
and eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
mov edx, dword [ebp - 0xec]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x104]
add eax, dword [ecx]
mov edx, dword [ebp - 0x45c]
mov dword [edx], eax
mov eax, dword [ebp - 0x208]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x220]
movzx eax, byte [edx]
sub ecx, eax
mov byte [ebp - 0x45d], cl
movzx ecx, word [ebp - 0x2f0]
movzx edx, word [ebp - 0xc8]
sub ecx, edx
mov eax, dword [ebp - 0x1dc]
mov word [eax], cx
mov ecx, dword [ebp - 0x22c]
add ecx, 0x67
mov dword [ebp - 0x22c], ecx
mov edx, dword [ebp - 0x20c]
movsx eax, byte [edx]
movsx ecx, byte [ebp - 0x5d]
sub eax, ecx
mov edx, dword [ebp - 0x20c]
mov byte [edx], al
movzx eax, byte [ebp - 0xd5]
mov ecx, dword [ebp - 0x208]
movzx ecx, byte [ecx]
sar eax, cl
mov byte [ebp - 0x109], al
mov edx, dword [ebp - 0x43c]
mov eax, dword [edx]
xor eax, dword [ebp - 0x438]
mov dword [ebp - 0x468], eax
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0x45c]
mov eax, dword [ecx]
mov ecx, dword [edx]
shl eax, cl
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
mov edx, dword [ebp - 0x234]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0xd5]
or eax, ecx
mov byte [ebp - 0x109], al
jmp 0x474e8f
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx]
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x4c0], 0
je 0x47509f
jmp 0x47518a
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0x45c]
mov eax, dword [ecx]
and eax, dword [edx]
mov ecx, dword [ebp - 0x138]
add ecx, dword [ebp - 0x120]
cmp eax, ecx
je 0x4750d7
mov edx, dword [ebp - 0x150]
movzx eax, word [edx]
movzx ecx, word [ebp - 8]
sub eax, ecx
mov edx, dword [ebp - 0x150]
mov word [edx], ax
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x138]
add ecx, dword [eax]
mov edx, dword [ebp - 0xec]
mov eax, dword [ebp - 0x120]
sub eax, dword [edx]
cmp ecx, eax
jle 0x475121
push 0xfb
push 0x8c
call dword [sym.imp.ole32.dll_CoCancelCall]
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0x214]
add ecx, dword [ebp - 0x178]
mov dword [ebp - 0x364], ecx
jmp 0x475185
movzx edx, word [ebp - 0x448]
movzx eax, word [ebp - 0x464]
sub edx, eax
movzx ecx, word [ebp - 0x450]
mov eax, dword [ebp - 0x1dc]
movzx eax, word [eax]
and ecx, eax
cmp edx, ecx
jge 0x475185
mov ecx, dword [ebp - 0x218]
add ecx, dword [ebp - 0x138]
mov dword [ebp - 0x160], ecx
lea edx, [ebp - 0x120]
mov dword [ebp - 0x2e4], edx
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x364]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x43c]
mov dword [edx], ecx
mov dword [ebp - 0xe4], 0xd8a
jmp 0x475283
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [ebp - 0x214]
shr eax, cl
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ebp - 0x178]
xor edx, dword [ecx]
cmp eax, edx
jbe 0x4751c8
movzx eax, word [ebp - 0xc8]
movzx ecx, word [ebp - 0x448]
shl eax, cl
mov ecx, dword [ebp - 0x150]
mov word [ecx], ax
jmp 0x475269
mov edx, dword [ebp - 0x20c]
movsx eax, byte [edx]
or eax, 0xe
movsx ecx, byte [ebp - 0x5d]
cmp eax, ecx
jle 0x475269
mov edx, dword [ebp - 0x4c]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0xd5]
and eax, ecx
mov byte [ebp - 0x109], al
push 0xa3
push 0xcf
push 0xc8
mov edx, dword [ebp - 0x440]
push edx
call dword [sym.imp.SHELL32.dll_SHUpdateImageW]
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x45c]
mov edx, dword [eax]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x2e4]
mov dword [eax], edx
mov ecx, dword [ebp - 0x104]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x160]
mov dword [ebp - 0x138], edx
mov eax, dword [ebp - 0x170]
push eax
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx]
push edx
call fcn.004ef7c0
add esp, 8
mov eax, dword [ebp - 0x278]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x468]
mov edx, dword [ebp - 0x278]
mov dword [edx], ecx
lea eax, [ebp - 0xfc]
push eax
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.ole32.dll_CoUnmarshalHresult]
mov dword [ebp - 0x154], eax
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x138]
add eax, dword [edx]
mov ecx, dword [ebp - 0x2e4]
mov dword [ecx], eax
lea edx, [ebp - 0x160]
mov dword [ebp - 0xd4], edx
mov dword [ebp - 0x118], 0x87e1
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1dc]
movzx eax, word [edx]
add ecx, eax
movzx edx, word [ebp - 8]
movzx eax, word [ebp - 0xc8]
sub edx, eax
cmp ecx, edx
jne 0x4752e8
mov ecx, dword [ebp - 0x20c]
movsx edx, byte [ecx]
or edx, 0x24
mov byte [ebp - 0x5d], dl
jmp 0x4753eb
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x218]
sar eax, cl
mov ecx, dword [ebp - 0x2e4]
mov edx, dword [ebp - 0x160]
xor edx, dword [ecx]
cmp eax, edx
jl 0x4753bf
mov eax, dword [ebp - 0x45c]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x218]
mov edx, dword [ebp - 0xec]
mov dword [edx], ecx
mov eax, dword [ebp - 0x138]
add eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x2e4]
mov ecx, dword [ecx]
sub ecx, dword [edx]
cmp eax, ecx
je 0x47538c
lea edx, [ebp - 0x3f0]
push edx
lea eax, [ebp - 0x2fc]
push eax
lea ecx, [ebp - 0x288]
push ecx
call dword [sym.imp.ole32.dll_CoMarshalInterThreadInterfaceInStream]
mov dword [ebp - 0x264], eax
mov edx, dword [ebp - 0x234]
movzx eax, byte [edx]
push eax
mov ecx, dword [ebp - 0x43c]
mov edx, dword [ecx]
push edx
push 0x50
movzx eax, byte [ebp - 0x5d]
push eax
mov ecx, dword [ebp - 0x20c]
movzx edx, byte [ecx]
push edx
call fcn.00429f50
mov eax, dword [ebp - 0x220]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 0x45d]
sub ecx, edx
mov byte [ebp - 0xd5], cl
movzx eax, word [ebp - 0xc8]
movzx ecx, word [ebp - 0x110]
sub eax, ecx
mov edx, dword [ebp - 0x1dc]
mov word [edx], ax
jmp 0x4753eb
mov eax, dword [ebp - 0x43c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc0]
add ecx, dword [edx]
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x12c], 0x8057
lea eax, [ebp - 0x120]
mov dword [ebp - 0x210], eax
lea ecx, [ebp - 8]
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x12c], 0x6357
jbe 0x4755dc
mov edx, dword [ebp - 0x208]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x234]
movzx edx, byte [ecx]
add eax, edx
mov ecx, dword [ebp - 0x4c]
mov byte [ecx], al
mov edx, dword [ebp - 0x43c]
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov edx, dword [ebp - 0xc0]
mov dword [edx], ecx
mov eax, dword [ebp - 0x1dc]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x2f0]
and ecx, edx
mov word [ebp - 0x464], cx
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x45c]
mov edx, dword [eax]
mov ecx, dword [ecx]
sar edx, cl
mov eax, dword [ebp - 0x104]
mov dword [eax], edx
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0x278]
mov eax, dword [ecx]
xor eax, dword [edx]
mov ecx, dword [ebp - 0x43c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x4c]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x220]
movzx ecx, byte [ecx]
shl eax, cl
mov byte [ebp - 0x109], al
movzx edx, word [ebp - 8]
movzx eax, word [ebp - 0x110]
or edx, eax
mov ecx, dword [ebp - 0x48]
mov word [ecx], dx
mov edx, dword [ebp - 0x218]
sub edx, dword [ebp - 0x160]
mov eax, dword [ebp - 0xec]
mov dword [eax], edx
mov ecx, dword [ebp - 0x2e4]
mov edx, dword [ebp - 0x138]
sub edx, dword [ecx]
mov dword [ebp - 0x170], edx
mov eax, dword [ebp - 0x20c]
movsx ecx, byte [eax]
and ecx, 0x62
mov byte [ebp - 0x5d], cl
mov edx, dword [ebp - 0x20c]
movsx eax, byte [edx]
sub eax, 0x7c
mov byte [ebp - 0x5d], al
movzx ecx, byte [ebp - 0xd5]
movzx edx, byte [ebp - 0x109]
add ecx, edx
mov eax, dword [ebp - 0x4c]
mov byte [eax], cl
movzx ecx, word [ebp - 0x3b0]
mov edx, dword [ebp - 0x150]
movzx eax, word [edx]
add ecx, eax
mov edx, dword [ebp - 0x1dc]
mov word [edx], cx
mov eax, dword [ebp - 0x43c]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x438]
mov edx, dword [ebp - 0x43c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x214]
mov dword [ebp - 0x2dc], ecx
mov edx, dword [ebp - 0x12c]
sub edx, 0x74
mov dword [ebp - 0x12c], edx
mov eax, dword [ebp - 0x120]
add eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x2e4]
mov dword [ecx], eax
mov edx, dword [ebp - 0x104]
mov eax, dword [edx]
add eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0xd4]
mov dword [ecx], eax
mov edx, dword [ebp - 0xec]
mov eax, dword [edx]
sub eax, dword [ebp - 0x218]
mov dword [ebp - 0x170], eax
movzx ecx, byte [ebp - 0x45d]
mov edx, dword [ebp - 0x234]
movzx eax, byte [edx]
or ecx, eax
mov byte [ebp - 0xd5], cl
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x2f0]
xor edx, eax
mov ecx, dword [ebp - 0x48]
mov word [ecx], dx
mov edx, dword [ebp - 0x468]
mov ecx, dword [ebp - 0x25c]
shr edx, cl
mov eax, dword [ebp - 0x278]
mov dword [eax], edx
jmp 0x4753f1
mov ecx, dword [ebp - 0x20c]
mov dl, byte [ecx]
mov byte [ebp - 0x4c4], dl
cmp byte [ebp - 0x4c4], 0x84
je 0x4755f8
jmp 0x475698
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x170]
shl eax, cl
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0xec]
mov edx, dword [ecx]
mov dword [ebp - 0x4c8], edx
cmp dword [ebp - 0x4c8], 0x3fb33e31
je 0x475634
cmp dword [ebp - 0x4c8], 0x5625f51e
je 0x475676
jmp 0x475696
lea eax, [ebp - 0xe8]
push eax
lea ecx, [ebp - 0x2fc]
push ecx
lea edx, [ebp - 0x20c]
push edx
push 0x31
lea eax, [ebp - 0x174]
push eax
call dword [sym.imp.SHELL32.dll_PathMakeUniqueName]
mov dword [ebp - 0x434], eax
mov ecx, dword [ebp - 0xec]
mov edx, dword [ecx]
and edx, dword [ebp - 0x120]
mov eax, dword [ebp - 0x210]
mov dword [eax], edx
jmp 0x475696
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx]
add edx, dword [ebp - 0x178]
mov dword [ebp - 0x25c], edx
mov al, byte [ebp - 0x109]
mov byte [ebp - 0x441], al
jmp 0x4756f2
mov ecx, dword [ebp - 0x278]
mov edx, dword [ecx]
mov dword [ebp - 0x4cc], edx
cmp dword [ebp - 0x4cc], 0xc865e847
je 0x4756b4
jmp 0x4756cd
movzx eax, byte [ebp - 0x441]
push eax
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
push edx
call section..text
jmp 0x4756f2
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x464]
sub ecx, edx
mov word [ebp - 0x110], cx
movsx eax, byte [ebp - 0x5d]
and eax, 0x4b
mov ecx, dword [ebp - 0x20c]
mov byte [ecx], al
mov edx, dword [ebp - 0x4c]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0x109]
sub eax, ecx
mov edx, dword [ebp - 0x208]
movzx ecx, byte [edx]
movzx edx, byte [ebp - 0x441]
add ecx, edx
cmp eax, ecx
jge 0x475793
mov eax, dword [ebp - 0x208]
mov cl, byte [eax]
mov byte [ebp - 0x4d0], cl
cmp byte [ebp - 0x4d0], 0x94
je 0x475739
cmp byte [ebp - 0x4d0], 0xb3
je 0x47577d
jmp 0x475793
push 0
lea edx, [ebp - 0xb0]
push edx
lea eax, [ebp - 0xe8]
push eax
lea ecx, [ebp - 0xec]
push ecx
call dword [sym.imp.ole32.dll_MonikerRelativePathTo]
mov dword [ebp - 0x15c], eax
mov edx, dword [ebp - 0x4c]
movzx eax, byte [edx]
push eax
mov ecx, dword [ebp - 0x178]
push ecx
push 0x67
movzx edx, byte [ebp - 0x5d]
push edx
movzx eax, byte [ebp - 0x5d]
push eax
call fcn.00429f50
jmp 0x475793
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ebp - 0x468]
add edx, dword [ecx]
mov eax, dword [ebp - 0x43c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x2e4]
mov edx, dword [ebp - 0x138]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x45c]
mov dword [eax], edx
mov dword [ebp - 0x11c], 0x6024
lea ecx, [ebp - 0xd5]
mov dword [ebp - 0x114], ecx
mov edx, dword [ebp - 0x45c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xd4]
add eax, dword [ecx]
mov edx, dword [ebp - 0x104]
mov edx, dword [edx]
mov ecx, dword [ebp - 0x138]
sar edx, cl
cmp eax, edx
jl 0x475890
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x138]
shl eax, cl
mov ecx, dword [ebp - 0x210]
mov edx, dword [ecx]
xor edx, dword [ebp - 0x160]
cmp eax, edx
jg 0x475866
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x274]
push ecx
call dword [sym.imp.ole32.dll_OleGetAutoConvert]
mov dword [ebp - 0xb4], eax
movzx edx, word [ebp - 0x2f0]
movzx eax, word [ebp - 0xc8]
sub edx, eax
mov word [ebp - 0x464], dx
mov ecx, dword [ebp - 0x234]
movzx edx, byte [ecx]
push edx
mov eax, dword [ebp - 0x25c]
push eax
push 0x23
mov ecx, dword [ebp - 0x20c]
movzx edx, byte [ecx]
push edx
mov eax, dword [ebp - 0x20c]
movzx ecx, byte [eax]
push ecx
call fcn.00429f50
jmp 0x475890
mov edx, dword [ebp - 0x218]
add edx, dword [ebp - 0x160]
mov eax, dword [ebp - 0x104]
mov dword [eax], edx
mov ecx, dword [ebp - 0x278]
mov edx, dword [ebp - 0x43c]
mov eax, dword [ecx]
sub eax, dword [edx]
mov dword [ebp - 0x364], eax
mov ecx, dword [ebp - 0x45c]
mov edx, dword [ecx]
add edx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x104]
mov dword [eax], edx
mov ecx, dword [ebp - 0x2e4]
mov edx, dword [ebp - 0x218]
and edx, dword [ecx]
mov dword [ebp - 0x120], edx
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1dc]
movzx eax, word [edx]
sub ecx, eax
mov word [ebp - 0x450], cx
movzx ecx, byte [ebp - 0xd5]
movzx edx, byte [ebp - 0x441]
add ecx, edx
mov eax, dword [ebp - 0x234]
mov byte [eax], cl
mov ecx, dword [ebp - 0x438]
sub ecx, dword [ebp - 0x214]
mov dword [ebp - 0x178], ecx
mov edx, dword [ebp - 0xec]
mov eax, dword [edx]
add eax, dword [ebp - 0x120]
mov dword [ebp - 0x170], eax
mov ecx, dword [ebp - 0x218]
xor ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 0xd4]
mov dword [edx], ecx
mov eax, dword [ebp - 0xec]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x170]
shl edx, cl
mov eax, dword [ebp - 0xd4]
mov dword [eax], edx
mov ecx, dword [ebp - 0xec]
mov edx, dword [ebp - 0xd4]
mov eax, dword [ecx]
mov ecx, dword [edx]
sar eax, cl
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x20c]
movsx edx, byte [ecx]
or edx, 0x33
mov byte [ebp - 0x5d], dl
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x210]
mov dword [edx], ecx
mov eax, dword [ebp - 0x364]
add eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x468], eax
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x464]
sub edx, eax
mov ecx, dword [ebp - 0x150]
mov word [ecx], dx
mov edx, dword [ebp - 0x25c]
sub edx, dword [ebp - 0x214]
mov eax, dword [ebp - 0xc0]
mov dword [eax], edx
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x364]
mov dword [ebp - 0x25c], edx
movzx eax, word [ebp - 0x2f0]
mov ecx, dword [ebp - 0x1dc]
movzx edx, word [ecx]
add eax, edx
mov word [ebp - 0x464], ax
movzx eax, word [ebp - 0x110]
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
and eax, edx
mov word [ebp - 0x464], ax
mov eax, dword [ebp - 0xd4]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x120]
mov dword [ebp - 0x170], ecx
mov edx, dword [ebp - 0x43c]
mov eax, dword [edx]
add eax, dword [ebp - 0x25c]
mov ecx, dword [ebp - 0x278]
mov dword [ecx], eax
mov edx, dword [ebp - 0x45c]
mov eax, dword [ebp - 0x218]
add eax, dword [edx]
mov dword [ebp - 0x170], eax
mov ecx, dword [ebp - 0xec]
mov edx, dword [ebp - 0x138]
mov ecx, dword [ecx]
shl edx, cl
mov eax, dword [ebp - 0x2e4]
mov dword [eax], edx
movzx ecx, byte [ebp - 0x45d]
movzx edx, byte [ebp - 0xd5]
xor ecx, edx
mov byte [ebp - 0x109], cl
movzx eax, word [ebp - 0x464]
mov ecx, dword [ebp - 0x48]
movzx ecx, word [ecx]
sar eax, cl
mov word [ebp - 0x110], ax
mov edx, dword [ebp - 0x278]
mov eax, dword [edx]
or eax, dword [ebp - 0x364]
mov dword [ebp - 0x2dc], eax
movzx ecx, word [ebp - 0x3b0]
mov edx, dword [ebp - 0x150]
movzx eax, word [edx]
and ecx, eax
mov word [ebp - 0x464], cx
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x3b0]
add edx, eax
mov word [ebp - 0x464], dx
mov ecx, dword [ebp - 0x20c]
movsx edx, byte [ecx]
sub edx, 0x36
mov byte [ebp - 0x5d], dl
mov eax, dword [ebp - 0x294]
add eax, 0xeb
mov dword [ebp - 0x294], eax
movzx ecx, byte [ebp - 0x441]
movzx edx, byte [ebp - 0x109]
sub ecx, edx
mov eax, dword [ebp - 0x4c]
mov byte [eax], cl
movzx ecx, word [ebp - 0x450]
movzx edx, word [ebp - 0x464]
sub ecx, edx
mov eax, dword [ebp - 0x48]
mov word [eax], cx
mov ecx, dword [ebp - 0x278]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc0]
add edx, dword [eax]
mov ecx, dword [ebp - 0x43c]
mov dword [ecx], edx
movzx edx, word [ebp - 0x2f0]
movzx eax, word [ebp - 8]
sub edx, eax
mov word [ebp - 0x464], dx
mov ecx, dword [ebp - 0xec]
mov edx, dword [ebp - 0xd4]
mov eax, dword [ecx]
and eax, dword [edx]
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x278]
add edx, dword [eax]
mov ecx, dword [ebp - 0x43c]
mov dword [ecx], edx
mov edx, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x170]
or eax, dword [edx]
mov ecx, dword [ebp - 0x45c]
mov dword [ecx], eax
cmp dword [ebp - 0x294], 0x601b
jne 0x4758ba
mov edx, dword [ebp - 0x364]
mov ecx, dword [ebp - 0x214]
shl edx, cl
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x468]
shr eax, cl
cmp edx, eax
ja 0x4785cc
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x2b0], ecx
mov edx, dword [ebp - 0xd4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x45c]
add eax, dword [ecx]
mov edx, dword [ebp - 0x2e4]
mov dword [edx], eax
mov eax, dword [ebp - 0x218]
add eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x210]
mov dword [ecx], eax
movzx edx, byte [ebp - 0x45d]
movzx eax, byte [ebp - 0x441]
sub edx, eax
mov ecx, dword [ebp - 0x114]
mov byte [ecx], dl
mov edx, dword [ebp - 0x150]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x1dc]
movzx edx, word [ecx]
add eax, edx
mov ecx, dword [ebp - 0x48]
mov word [ecx], ax
mov edx, dword [ebp - 0x150]
movzx eax, word [edx]
movzx ecx, word [ebp - 0xc8]
sub eax, ecx
mov word [ebp - 0x464], ax
mov edx, dword [ebp - 0x208]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x220]
movzx edx, byte [ecx]
add eax, edx
mov ecx, dword [ebp - 0x4c]
mov byte [ecx], al
mov edx, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x468]
add eax, dword [edx]
mov ecx, dword [ebp - 0x2fc]
mov dword [ecx], eax
mov edx, dword [ebp - 0x45c]
mov eax, dword [edx]
and eax, dword [ebp - 0x120]
mov dword [ebp - 0x170], eax
movzx edx, word [ebp - 0x110]
movzx ecx, word [ebp - 0x464]
sar edx, cl
mov eax, dword [ebp - 0x1dc]
mov word [eax], dx
movzx ecx, byte [ebp - 0x441]
mov edx, dword [ebp - 0x114]
movzx eax, byte [edx]
or ecx, eax
mov byte [ebp - 0x109], cl
mov ecx, dword [ebp - 0x2b0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x364]
shl edx, cl
mov eax, dword [ebp - 0x2b0]
mov dword [eax], edx
mov ecx, dword [ebp - 0x1dc]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
xor edx, ecx
mov word [ebp - 0x464], dx
mov edx, dword [ebp - 0xd4]
mov eax, dword [edx]
sub eax, dword [ebp - 0x138]
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x43c]
mov edx, dword [ecx]
add edx, dword [ebp - 0x364]
mov dword [ebp - 0x468], edx
movzx eax, word [ebp - 0xc8]
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
and eax, edx
mov ecx, dword [ebp - 0x1dc]
mov word [ecx], ax
mov edx, dword [ebp - 0x114]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x234]
movzx edx, byte [ecx]
sub eax, edx
mov byte [ebp - 0x109], al
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x2f0]
sub ecx, edx
mov word [ebp - 0x464], cx
mov eax, dword [ebp - 0x28c]
add eax, 0xef
mov dword [ebp - 0x28c], eax
mov ecx, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x120]
add edx, dword [ecx]
mov eax, dword [ebp - 0x104]
mov dword [eax], edx
mov ecx, dword [ebp - 0x2b0]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x364]
mov eax, dword [ebp - 0x2b0]
mov dword [eax], edx
mov ecx, dword [ebp - 0x210]
mov edx, dword [ebp - 0x120]
add edx, dword [ecx]
mov dword [ebp - 0x170], edx
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0x104]
mov dword [edx], ecx
movzx eax, byte [ebp - 0xd5]
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx]
sub eax, edx
mov byte [ebp - 0x109], al
mov eax, dword [ebp - 0x20c]
movsx ecx, byte [eax]
movsx edx, byte [ebp - 0x5d]
sub ecx, edx
mov eax, dword [ebp - 0x20c]
mov byte [eax], cl
mov ecx, dword [ebp - 0x234]
movzx edx, byte [ecx]
movzx ecx, byte [ebp - 0x45d]
shl edx, cl
mov eax, dword [ebp - 0x114]
mov byte [eax], dl
movzx ecx, word [ebp - 8]
mov edx, dword [ebp - 0x48]
movzx eax, word [edx]
or ecx, eax
mov word [ebp - 0x110], cx
mov ecx, dword [ebp - 0x214]
xor ecx, dword [ebp - 0x178]
mov dword [ebp - 0x468], ecx
mov edx, dword [ebp - 0x45c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x170]
sar eax, cl
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
mov edx, dword [ebp - 0x234]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x114]
movzx edx, byte [ecx]
and eax, edx
mov byte [ebp - 0x45d], al
movzx eax, word [ebp - 0x3b0]
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
add eax, edx
mov ecx, dword [ebp - 0x150]
mov word [ecx], ax
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx]
add eax, dword [ebp - 0x178]
mov dword [ebp - 0x438], eax
mov ecx, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x2e4]
mov eax, dword [ecx]
and eax, dword [edx]
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
cmp dword [ebp - 0x28c], 0x103f4
jb 0x475bc2
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0xd4]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x210]
mov dword [edx], ecx
mov eax, dword [ebp - 0x43c]
mov ecx, dword [eax]
mov dword [ebp - 0x4d4], ecx
cmp dword [ebp - 0x4d4], 0
je 0x475ed9
jmp 0x478536
lea edx, [ebp - 0x218]
mov dword [ebp - 0x1c], edx
movzx eax, word [ebp - 0x450]
movzx ecx, word [ebp - 0xc8]
add eax, ecx
movzx edx, word [ebp - 0x3b0]
mov ecx, dword [ebp - 0x1dc]
movzx ecx, word [ecx]
xor edx, ecx
cmp eax, edx
jge 0x475f1e
mov edx, dword [ebp - 0x45c]
mov eax, dword [ebp - 0x170]
or eax, dword [edx]
mov ecx, dword [ebp - 0x210]
mov dword [ecx], eax
lea edx, [ebp - 0x5d]
mov dword [ebp - 0x36c], edx
cmp dword [ebp - 0xe4], 0x3cf
jbe 0x476048
mov eax, dword [ebp - 0x36c]
movsx edx, byte [eax]
mov eax, dword [ebp - 0x20c]
movsx ecx, byte [eax]
shl edx, cl
mov byte [ebp - 0x5d], dl
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
sar edx, cl
mov ecx, dword [ebp - 0x150]
mov word [ecx], dx
mov edx, dword [ebp - 0x114]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x208]
movzx edx, byte [ecx]
and eax, edx
mov ecx, dword [ebp - 0x234]
mov byte [ecx], al
mov edx, dword [ebp - 0x2fc]
mov eax, dword [edx]
sub eax, dword [ebp - 0x2dc]
mov ecx, dword [ebp - 0x278]
mov dword [ecx], eax
mov edx, dword [ebp - 0x2fc]
mov eax, dword [ebp - 0x43c]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov dword [ebp - 0x178], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x218]
add eax, dword [edx]
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x2b0]
mov edx, dword [ecx]
add edx, dword [ebp - 0x364]
mov dword [ebp - 0x468], edx
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x210]
mov edx, dword [eax]
and edx, dword [ecx]
mov eax, dword [ebp - 0xd4]
mov dword [eax], edx
mov ecx, dword [ebp - 0xe4]
sub ecx, 0x35
mov dword [ebp - 0xe4], ecx
movzx edx, word [ebp - 0x448]
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
add edx, ecx
mov word [ebp - 0x2f0], dx
mov edx, dword [ebp - 0x114]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0x45d]
sub eax, ecx
mov edx, dword [ebp - 0x234]
mov byte [edx], al
mov eax, dword [ebp - 0x278]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x438]
mov dword [ebp - 0x214], ecx
jmp 0x475f27
mov edx, dword [ebp - 0x2fc]
mov eax, dword [edx]
sub eax, dword [ebp - 0x468]
mov ecx, dword [ebp - 0x43c]
mov edx, dword [ebp - 0xc0]
mov esi, dword [ecx]
mov ecx, dword [edx]
shl esi, cl
cmp eax, esi
ja 0x478470
cmp dword [ebp - 0x11c], 0x6f27
ja 0x476486
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [ebp - 0x468]
add ecx, dword [eax]
mov edx, dword [ebp - 0x43c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x1dc]
movzx ecx, word [eax]
movzx edx, word [ebp - 0xc8]
sub ecx, edx
mov word [ebp - 0x448], cx
mov eax, dword [ebp - 0x220]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 0x441]
sub ecx, edx
mov eax, dword [ebp - 0x114]
mov byte [eax], cl
mov ecx, dword [ebp - 0x11c]
add ecx, 0x3f
mov dword [ebp - 0x11c], ecx
movsx edx, byte [ebp - 0x5d]
mov eax, dword [ebp - 0x36c]
movsx ecx, byte [eax]
sub edx, ecx
mov eax, dword [ebp - 0x20c]
mov byte [eax], dl
movzx ecx, word [ebp - 0x464]
mov edx, dword [ebp - 0x48]
movzx eax, word [edx]
add ecx, eax
mov edx, dword [ebp - 0x150]
mov word [edx], cx
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x438]
mov dword [ebp - 0x214], ecx
mov edx, dword [ebp - 0x138]
sub edx, dword [ebp - 0x218]
mov eax, dword [ebp - 0xd4]
mov dword [eax], edx
movzx ecx, word [ebp - 0x450]
mov edx, dword [ebp - 0x48]
movzx eax, word [edx]
add ecx, eax
mov edx, dword [ebp - 0x1dc]
mov word [edx], cx
movzx eax, word [ebp - 8]
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
add eax, edx
mov word [ebp - 0x464], ax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xd4]
mov edx, dword [eax]
mov ecx, dword [ecx]
shl edx, cl
mov eax, dword [ebp - 0x45c]
mov dword [eax], edx
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0x438]
or edx, dword [ecx]
mov dword [ebp - 0x2dc], edx
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x160]
mov ecx, dword [eax]
sar edx, cl
mov dword [ebp - 0x170], edx
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x48]
movzx eax, word [edx]
xor ecx, eax
mov word [ebp - 0x464], cx
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x114]
movzx ecx, byte [eax]
and edx, ecx
mov eax, dword [ebp - 0x4c]
mov byte [eax], dl
mov ecx, dword [ebp - 0x1dc]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
sub edx, ecx
mov eax, dword [ebp - 0x150]
mov word [eax], dx
mov ecx, dword [ebp - 0x2b0]
mov edx, dword [ebp - 0x214]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x43c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0x160]
add edx, dword [ecx]
mov eax, dword [ebp - 0x2e4]
mov dword [eax], edx
movzx ecx, word [ebp - 8]
mov edx, dword [ebp - 0x1dc]
movzx eax, word [edx]
add ecx, eax
mov word [ebp - 0x464], cx
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0x170]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x104]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x160]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x20c]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x36c]
movsx ecx, byte [eax]
and edx, ecx
mov byte [ebp - 0x5d], dl
mov edx, dword [ebp - 0x36c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x20c]
movsx edx, byte [ecx]
add eax, edx
mov byte [ebp - 0x5d], al
movzx eax, word [ebp - 0x110]
mov ecx, dword [ebp - 0x150]
movzx ecx, word [ecx]
sar eax, cl
mov word [ebp - 0x464], ax
movzx edx, word [ebp - 0xc8]
movzx eax, word [ebp - 0x464]
or edx, eax
mov word [ebp - 0x110], dx
mov ecx, dword [ebp - 0x2b0]
mov edx, dword [ecx]
xor edx, dword [ebp - 0x25c]
mov dword [ebp - 0x364], edx
mov eax, dword [ebp - 0x2fc]
mov edx, dword [ebp - 0x2dc]
mov ecx, dword [eax]
shl edx, cl
mov eax, dword [ebp - 0xc0]
mov dword [eax], edx
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x2f0]
add edx, eax
mov ecx, dword [ebp - 0x1dc]
mov word [ecx], dx
mov edx, dword [ebp - 0x1dc]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
and eax, edx
mov word [ebp - 0x464], ax
mov eax, dword [ebp - 0x2e4]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xec]
add ecx, dword [edx]
mov dword [ebp - 0x160], ecx
mov eax, dword [ebp - 0x2b0]
mov ecx, dword [ebp - 0x438]
add ecx, dword [eax]
mov dword [ebp - 0x214], ecx
mov edx, dword [ebp - 0x218]
sub edx, dword [ebp - 0x120]
mov eax, dword [ebp - 0xd4]
mov dword [eax], edx
mov ecx, dword [ebp - 0x45c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xd4]
add edx, dword [eax]
mov ecx, dword [ebp - 0x2e4]
mov dword [ecx], edx
mov edx, dword [ebp - 0x234]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0x109]
sub eax, ecx
mov edx, dword [ebp - 0x114]
mov byte [edx], al
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x150]
movzx eax, word [edx]
add ecx, eax
mov word [ebp - 0xc8], cx
mov ecx, dword [ebp - 0x2b0]
mov edx, dword [ebp - 0x43c]
mov eax, dword [ecx]
sub eax, dword [edx]
mov ecx, dword [ebp - 0xc0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x2fc]
mov eax, dword [edx]
and eax, dword [ebp - 0x438]
mov dword [ebp - 0x468], eax
movzx edx, word [ebp - 0x448]
movzx ecx, word [ebp - 0x2f0]
sar edx, cl
mov word [ebp - 0x464], dx
mov eax, dword [ebp - 0x36c]
movsx ecx, byte [eax]
movsx edx, byte [ebp - 0x5d]
or ecx, edx
mov eax, dword [ebp - 0x20c]
mov byte [eax], cl
movzx ecx, byte [ebp - 0x441]
mov edx, dword [ebp - 0x208]
movzx eax, byte [edx]
xor ecx, eax
mov byte [ebp - 0x109], cl
movzx edx, word [ebp - 0x110]
movzx ecx, word [ebp - 0x2f0]
shl edx, cl
mov eax, dword [ebp - 0x150]
mov word [eax], dx
mov ecx, dword [ebp - 0x2b0]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x468]
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 0x45c]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [eax]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x104]
mov dword [eax], edx
mov ecx, dword [ebp - 0xec]
mov edx, dword [ebp - 0x120]
and edx, dword [ecx]
mov dword [ebp - 0x160], edx
mov eax, dword [ebp - 0x278]
mov ecx, dword [ebp - 0x2dc]
sub ecx, dword [eax]
mov dword [ebp - 0x178], ecx
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x45c]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x2e4]
mov dword [edx], ecx
jmp 0x476070
cmp dword [ebp - 0x118], 0x75fb
jb 0x476772
movzx eax, word [ebp - 0x464]
movzx ecx, word [ebp - 8]
add eax, ecx
mov word [ebp - 0x2f0], ax
mov edx, dword [ebp - 0x114]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x220]
movzx edx, byte [ecx]
sub eax, edx
mov ecx, dword [ebp - 0x208]
mov byte [ecx], al
mov edx, dword [ebp - 0xd4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xec]
add eax, dword [ecx]
mov edx, dword [ebp - 0x210]
mov dword [edx], eax
mov eax, dword [ebp - 0x25c]
add eax, dword [ebp - 0x2dc]
mov ecx, dword [ebp - 0x43c]
mov dword [ecx], eax
mov edx, dword [ebp - 0xec]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x104]
add eax, dword [ecx]
mov edx, dword [ebp - 0x210]
mov dword [edx], eax
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x218]
mov edx, dword [ebp - 0xd4]
mov dword [edx], ecx
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x450]
xor ecx, edx
mov eax, dword [ebp - 0x1dc]
mov word [eax], cx
mov ecx, dword [ebp - 0x114]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x208]
movzx ecx, byte [eax]
or edx, ecx
mov eax, dword [ebp - 0x114]
mov byte [eax], dl
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
shl edx, cl
mov word [ebp - 0x464], dx
mov ecx, dword [ebp - 0x36c]
movsx edx, byte [ecx]
movsx ecx, byte [ebp - 0x5d]
sar edx, cl
mov eax, dword [ebp - 0x36c]
mov byte [eax], dl
mov ecx, dword [ebp - 0x43c]
mov edx, dword [ecx]
and edx, dword [ebp - 0x214]
mov eax, dword [ebp - 0x278]
mov dword [eax], edx
mov ecx, dword [ebp - 0x45c]
mov edx, dword [ebp - 0x218]
add edx, dword [ecx]
mov dword [ebp - 0x160], edx
mov eax, dword [ebp - 0x1dc]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x48]
movzx eax, word [edx]
add ecx, eax
mov word [ebp - 0x450], cx
movzx ecx, byte [ebp - 0x109]
movzx edx, byte [ebp - 0x45d]
and ecx, edx
mov byte [ebp - 0xd5], cl
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x468]
mov edx, dword [ebp - 0x2b0]
mov dword [edx], ecx
mov eax, dword [ebp - 0x2b0]
mov ecx, dword [ebp - 0x278]
mov edx, dword [eax]
sub edx, dword [ecx]
mov dword [ebp - 0x468], edx
mov eax, dword [ebp - 0x160]
sub eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x210]
mov dword [ecx], eax
mov edx, dword [ebp - 0x2fc]
mov eax, dword [ebp - 0x178]
add eax, dword [edx]
mov dword [ebp - 0x468], eax
movzx ecx, byte [ebp - 0xd5]
movzx edx, byte [ebp - 0x441]
sub ecx, edx
mov byte [ebp - 0x45d], cl
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1dc]
movzx eax, word [edx]
or ecx, eax
mov edx, dword [ebp - 0x150]
mov word [edx], cx
mov eax, dword [ebp - 0x2e4]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [eax]
mov ecx, dword [ecx]
shl edx, cl
mov eax, dword [ebp - 0xec]
mov dword [eax], edx
mov ecx, dword [ebp - 0xec]
mov edx, dword [ebp - 0x2e4]
mov eax, dword [ecx]
xor eax, dword [edx]
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
mov edx, dword [ebp - 0x25c]
mov ecx, dword [ebp - 0x364]
shr edx, cl
mov dword [ebp - 0x2dc], edx
mov eax, dword [ebp - 0x138]
and eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x45c]
mov eax, dword [edx]
add eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
movsx edx, byte [ebp - 0x5d]
mov eax, dword [ebp - 0x36c]
movsx ecx, byte [eax]
sub edx, ecx
mov eax, dword [ebp - 0x20c]
mov byte [eax], dl
mov ecx, dword [ebp - 0x118]
sub ecx, 0x4f
mov dword [ebp - 0x118], ecx
movsx edx, byte [ebp - 0x5d]
mov eax, dword [ebp - 0x36c]
movsx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0x20c]
mov byte [eax], dl
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
movzx eax, word [ebp - 0xc8]
sub edx, eax
mov ecx, dword [ebp - 0x150]
mov word [ecx], dx
movzx edx, byte [ebp - 0x45d]
mov eax, dword [ebp - 0x220]
movzx ecx, byte [eax]
and edx, ecx
mov eax, dword [ebp - 0x208]
mov byte [eax], dl
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x43c]
add edx, dword [eax]
mov dword [ebp - 0x468], edx
mov ecx, dword [ebp - 0x104]
mov edx, dword [ecx]
add edx, dword [ebp - 0x160]
mov eax, dword [ebp - 0x2e4]
mov dword [eax], edx
jmp 0x476486
mov ecx, dword [ebp - 0xec]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x45c]
mov ecx, dword [ebp - 0x138]
sub ecx, dword [eax]
cmp edx, ecx
jg 0x4768ab
mov edx, dword [ebp - 0x48]
movzx eax, word [edx]
movzx ecx, word [ebp - 8]
or eax, ecx
mov edx, dword [ebp - 0x1dc]
mov word [edx], ax
movzx eax, word [ebp - 0x2f0]
mov dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4d8], 0x937
je 0x4767c9
jmp 0x476873
mov ecx, dword [ebp - 0x1dc]
movzx edx, word [ecx]
mov dword [ebp - 0x4dc], edx
cmp dword [ebp - 0x4dc], 0x542
je 0x47685b
cmp dword [ebp - 0x4dc], 0xb74
je 0x4767f2
jmp 0x476871
mov eax, dword [ebp - 0x4c]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x234]
movzx eax, byte [edx]
xor ecx, eax
mov edx, dword [ebp - 0x114]
mov byte [edx], cl
lea eax, [ebp - 0xfc]
push eax
push str.tolerate_Standstill_Shook_Convertor
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov dword [ebp - 0x244], eax
mov ecx, dword [ebp - 0x2b0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x364]
shl edx, cl
mov eax, dword [ebp - 0x43c]
mov dword [eax], edx
lea ecx, [ebp - 0xb4]
push ecx
push fcn.00478870
mov edx, dword [ebp - 0x260]
push edx
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [ebp - 0x434], eax
jmp 0x476871
movzx eax, word [ebp - 0x450]
mov ecx, dword [ebp - 0x48]
movzx ecx, word [ecx]
sar eax, cl
mov word [ebp - 0x464], ax
jmp 0x4768ab
mov edx, dword [ebp - 0xec]
mov eax, dword [edx]
mov dword [ebp - 0x2ec], eax
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ebp - 0x178]
and edx, dword [ecx]
mov dword [ebp - 0x438], edx
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x464]
add ecx, edx
mov word [ebp - 8], cx
lea eax, [ebp - 0x109]
mov dword [ebp - 0x164], eax
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
add edx, ecx
movzx eax, word [ebp - 0x110]
mov ecx, dword [ebp - 0x1dc]
movzx ecx, word [ecx]
sub eax, ecx
cmp edx, eax
je 0x478452
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x160]
sub eax, dword [edx]
mov dword [ebp - 0x218], eax
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x124], ecx
cmp dword [ebp - 0x44c], 0x5580
ja 0x476a24
mov edx, dword [ebp - 0x20c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x36c]
movsx edx, byte [ecx]
sub eax, edx
mov byte [ebp - 0x5d], al
mov eax, dword [ebp - 0x1dc]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x464]
and ecx, edx
mov word [ebp - 0x450], cx
movzx eax, word [ebp - 0xc8]
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
add eax, edx
mov word [ebp - 0x464], ax
movzx eax, word [ebp - 0x448]
movzx ecx, word [ebp - 0xc8]
sub eax, ecx
mov edx, dword [ebp - 0x150]
mov word [edx], ax
mov eax, dword [ebp - 0x468]
add eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x2b0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x25c]
mov ecx, dword [ebp - 0x438]
shr edx, cl
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 0x44c]
add eax, 0x35
mov dword [ebp - 0x44c], eax
mov ecx, dword [ebp - 0xec]
mov edx, dword [ebp - 0xd4]
mov eax, dword [ecx]
xor eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2ec]
mov ecx, dword [edx]
shl eax, cl
mov ecx, dword [ebp - 0x45c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x45c]
mov eax, dword [ebp - 0xec]
mov ecx, dword [edx]
or ecx, dword [eax]
mov dword [ebp - 0x170], ecx
movzx edx, word [ebp - 0x464]
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
and edx, ecx
mov eax, dword [ebp - 0x1dc]
mov word [eax], dx
mov ecx, dword [ebp - 0x114]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x208]
movzx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0x220]
mov byte [eax], dl
jmp 0x476902
cmp dword [ebp - 0x290], 0xa1e9
jae 0x476db2
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x364]
mov eax, dword [ebp - 0x43c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x2ec]
sub ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 0xd4]
mov dword [edx], ecx
mov eax, dword [ebp - 0x120]
add eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x45c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x214]
sub edx, dword [ebp - 0x25c]
mov dword [ebp - 0x364], edx
movzx eax, byte [ebp - 0x441]
movzx ecx, byte [ebp - 0x109]
sub eax, ecx
mov edx, dword [ebp - 0x114]
mov byte [edx], al
mov eax, dword [ebp - 0x1dc]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x2f0]
and ecx, edx
mov eax, dword [ebp - 0x150]
mov word [eax], cx
mov ecx, dword [ebp - 0x1dc]
movzx edx, word [ecx]
movzx eax, word [ebp - 0xc8]
add edx, eax
mov word [ebp - 0x464], dx
mov ecx, dword [ebp - 0x124]
mov edx, dword [ecx]
or edx, dword [ebp - 0x120]
mov dword [ebp - 0x218], edx
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [ebp - 0x2b0]
mov edx, dword [eax]
mov ecx, dword [ecx]
shl edx, cl
mov eax, dword [ebp - 0x43c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x2e4]
mov edx, dword [ebp - 0xd4]
mov eax, dword [ecx]
mov ecx, dword [edx]
sar eax, cl
mov ecx, dword [ebp - 0x45c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x234]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0x109]
xor eax, ecx
mov byte [ebp - 0x45d], al
movzx edx, word [ebp - 0x464]
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
sub edx, ecx
mov eax, dword [ebp - 0x1dc]
mov word [eax], dx
mov ecx, dword [ebp - 0x138]
and ecx, dword [ebp - 0x218]
mov edx, dword [ebp - 0x2e4]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x468]
mov dword [ebp - 0x25c], ecx
mov edx, dword [ebp - 0x2ec]
sub edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0xd4]
mov dword [eax], edx
mov ecx, dword [ebp - 0xec]
mov edx, dword [ecx]
add edx, dword [ebp - 0x170]
mov eax, dword [ebp - 0x104]
mov dword [eax], edx
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
movzx eax, word [ebp - 8]
add edx, eax
mov ecx, dword [ebp - 0x1dc]
mov word [ecx], dx
movzx edx, byte [ebp - 0xd5]
mov eax, dword [ebp - 0x164]
movzx ecx, byte [eax]
add edx, ecx
mov byte [ebp - 0x45d], dl
mov edx, dword [ebp - 0x278]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x2fc]
add eax, dword [ecx]
mov edx, dword [ebp - 0x43c]
mov dword [edx], eax
mov eax, dword [ebp - 0x2e4]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xd4]
add ecx, dword [edx]
mov eax, dword [ebp - 0x1c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x448]
and edx, eax
mov word [ebp - 0x464], dx
mov ecx, dword [ebp - 0x45c]
mov edx, dword [ebp - 0xd4]
mov eax, dword [ecx]
xor eax, dword [edx]
mov ecx, dword [ebp - 0x210]
mov dword [ecx], eax
mov edx, dword [ebp - 0x2e4]
mov eax, dword [ebp - 0x124]
mov edx, dword [edx]
mov ecx, dword [eax]
shl edx, cl
mov dword [ebp - 0x160], edx
mov eax, dword [ebp - 0x114]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x4c]
movzx eax, byte [edx]
or ecx, eax
mov byte [ebp - 0x45d], cl
movsx edx, byte [ebp - 0x5d]
mov eax, dword [ebp - 0x36c]
movsx ecx, byte [eax]
sar edx, cl
mov ecx, dword [ebp - 0x20c]
mov byte [ecx], dl
movzx edx, byte [ebp - 0xd5]
mov eax, dword [ebp - 0x164]
movzx ecx, byte [eax]
sub edx, ecx
mov eax, dword [ebp - 0x234]
mov byte [eax], dl
movzx ecx, word [ebp - 0x450]
mov edx, dword [ebp - 0x1dc]
movzx eax, word [edx]
add ecx, eax
mov edx, dword [ebp - 0x150]
mov word [edx], cx
mov eax, dword [ebp - 0x278]
mov ecx, dword [ebp - 0x43c]
mov edx, dword [eax]
and edx, dword [ecx]
mov eax, dword [ebp - 0x2b0]
mov dword [eax], edx
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x364]
mov dword [ebp - 0x214], edx
movzx eax, word [ebp - 0x2f0]
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
add eax, edx
mov word [ebp - 0x464], ax
movzx eax, byte [ebp - 0x441]
mov ecx, dword [ebp - 0x164]
movzx edx, byte [ecx]
add eax, edx
mov ecx, dword [ebp - 0x234]
mov byte [ecx], al
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x120]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x2fc]
mov eax, dword [ebp - 0x468]
sub eax, dword [edx]
mov dword [ebp - 0x2dc], eax
mov ecx, dword [ebp - 0x210]
mov edx, dword [ebp - 0x2ec]
add edx, dword [ecx]
mov dword [ebp - 0x160], edx
mov eax, dword [ebp - 0x290]
add eax, 0xaf
mov dword [ebp - 0x290], eax
mov ecx, dword [ebp - 0xec]
mov edx, dword [ebp - 0x104]
mov eax, dword [ecx]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x2e4]
mov dword [ecx], eax
movzx edx, word [ebp - 0x450]
movzx eax, word [ebp - 0x3b0]
sub edx, eax
mov ecx, dword [ebp - 0x150]
mov word [ecx], dx
mov edx, dword [ebp - 0x220]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx]
or eax, edx
mov ecx, dword [ebp - 0x208]
mov byte [ecx], al
mov edx, dword [ebp - 0x278]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x364]
shr eax, cl
mov ecx, dword [ebp - 0x43c]
mov dword [ecx], eax
jmp 0x476a24
mov edx, dword [ebp - 0x2ec]
xor edx, dword [ebp - 0x170]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
movsx edx, byte [ebp - 0x5d]
mov eax, dword [ebp - 0x36c]
movsx ecx, byte [eax]
shl edx, cl
mov ecx, dword [ebp - 0x20c]
mov byte [ecx], dl
mov edx, dword [ebp - 0x36c]
movsx eax, byte [edx]
movsx ecx, byte [ebp - 0x5d]
and eax, ecx
mov edx, dword [ebp - 0x20c]
mov byte [edx], al
movzx eax, word [ebp - 0x448]
movzx ecx, word [ebp - 0x464]
sub eax, ecx
mov word [ebp - 0x2f0], ax
movzx edx, byte [ebp - 0x441]
mov eax, dword [ebp - 0x220]
movzx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0x114]
mov byte [eax], dl
mov ecx, dword [ebp - 0x278]
mov edx, dword [ebp - 0x43c]
mov eax, dword [ecx]
and eax, dword [edx]
mov ecx, dword [ebp - 0x2fc]
mov dword [ecx], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x160]
add eax, dword [edx]
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
mov edx, dword [ebp - 0x104]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x2e4]
add eax, dword [ecx]
mov dword [ebp - 0x120], eax
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx]
add eax, dword [ebp - 0x468]
mov dword [ebp - 0x438], eax
mov ecx, dword [ebp - 0x278]
mov edx, dword [ebp - 0x2fc]
mov eax, dword [ecx]
sub eax, dword [edx]
mov dword [ebp - 0x468], eax
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x1dc]
movzx ecx, word [eax]
sub edx, ecx
mov eax, dword [ebp - 0x150]
mov word [eax], dx
movzx edx, byte [ebp - 0xd5]
mov eax, dword [ebp - 0x208]
movzx ecx, byte [eax]
shl edx, cl
mov ecx, dword [ebp - 0x220]
mov byte [ecx], dl
mov edx, dword [ebp - 0x2e4]
mov eax, dword [ebp - 0x138]
xor eax, dword [edx]
mov dword [ebp - 0x2ec], eax
mov ecx, dword [ebp - 0x278]
mov edx, dword [ebp - 0x43c]
mov eax, dword [ecx]
or eax, dword [edx]
mov ecx, dword [ebp - 0x2b0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x210]
mov eax, dword [ebp - 0x138]
mov ecx, dword [edx]
sar eax, cl
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
mov edx, dword [ebp - 0x2b8]
sub edx, 0xde
mov dword [ebp - 0x2b8], edx
mov eax, dword [ebp - 0x170]
and eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x45c]
mov dword [ecx], eax
movzx edx, byte [ebp - 0x45d]
mov eax, dword [ebp - 0x4c]
movzx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0x234]
mov byte [eax], dl
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x450]
add edx, eax
mov ecx, dword [ebp - 0x150]
mov word [ecx], dx
movsx edx, byte [ebp - 0x5d]
mov eax, dword [ebp - 0x20c]
movsx ecx, byte [eax]
sub edx, ecx
mov eax, dword [ebp - 0x36c]
mov byte [eax], dl
mov ecx, dword [ebp - 0x2b0]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x2dc]
mov eax, dword [ebp - 0xc0]
mov dword [eax], edx
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ebp - 0x364]
and edx, dword [ecx]
mov dword [ebp - 0x468], edx
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x138]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x124]
mov dword [edx], ecx
movzx eax, byte [ebp - 0xd5]
movzx ecx, byte [ebp - 0x109]
sub eax, ecx
mov edx, dword [ebp - 0x234]
mov byte [edx], al
mov eax, dword [ebp - 0x1dc]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x3b0]
add ecx, edx
mov word [ebp - 8], cx
mov eax, dword [ebp - 0x2b0]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc0]
add ecx, dword [edx]
mov dword [ebp - 0x25c], ecx
movzx eax, word [ebp - 0x448]
mov ecx, dword [ebp - 0x1dc]
movzx edx, word [ecx]
or eax, edx
mov word [ebp - 0x464], ax
cmp dword [ebp - 0x2b8], 0xc942
ja 0x476dc3
mov eax, dword [ebp - 0x438]
mov ecx, dword [ebp - 0x25c]
shl eax, cl
mov ecx, dword [ebp - 0x2b0]
mov edx, dword [ebp - 0x278]
mov esi, dword [ecx]
mov ecx, dword [edx]
shr esi, cl
cmp eax, esi
jb 0x47827e
mov eax, 0x7b93
mov word [ebp - 0x134], ax
mov ecx, dword [ebp - 0x36c]
movsx edx, byte [ecx]
movsx eax, byte [ebp - 0x5d]
sub edx, eax
mov ecx, dword [ebp - 0x20c]
mov byte [ecx], dl
mov edx, dword [ebp - 0xdc]
add edx, 0xc9
mov dword [ebp - 0xdc], edx
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x464]
sub ecx, edx
mov eax, dword [ebp - 0x48]
mov word [eax], cx
mov ecx, dword [ebp - 0x208]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x164]
movzx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0x208]
mov byte [eax], dl
mov ecx, dword [ebp - 0x43c]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x364]
mov eax, dword [ebp - 0x2fc]
mov dword [eax], edx
mov ecx, dword [ebp - 0x2ec]
add ecx, dword [ebp - 0x218]
mov dword [ebp - 0x170], ecx
movzx edx, byte [ebp - 0xd5]
movzx eax, byte [ebp - 0x441]
add edx, eax
mov byte [ebp - 0x45d], dl
movzx ecx, word [ebp - 0x464]
mov edx, dword [ebp - 0x1dc]
movzx eax, word [edx]
and ecx, eax
mov edx, dword [ebp - 0x48]
mov word [edx], cx
mov eax, dword [ebp - 0x43c]
mov ecx, dword [ebp - 0x2dc]
sub ecx, dword [eax]
mov edx, dword [ebp - 0xc0]
mov dword [edx], ecx
mov eax, dword [ebp - 0x104]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x120]
shl edx, cl
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x104]
mov eax, dword [ecx]
mov ecx, dword [edx]
sar eax, cl
mov ecx, dword [ebp - 0x2e4]
mov dword [ecx], eax
mov edx, dword [ebp - 0x43c]
mov eax, dword [edx]
or eax, dword [ebp - 0x214]
mov dword [ebp - 0x364], eax
mov ecx, dword [ebp - 0x220]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x234]
movzx ecx, byte [eax]
xor edx, ecx
mov byte [ebp - 0x45d], dl
movzx edx, word [ebp - 0x3b0]
movzx eax, word [ebp - 0x448]
add edx, eax
mov ecx, dword [ebp - 0x150]
mov word [ecx], dx
mov edx, dword [ebp - 0xec]
mov eax, dword [edx]
and eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x210]
mov dword [ecx], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
sub eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x124]
mov dword [ecx], eax
mov edx, dword [ebp - 0x36c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x20c]
movsx edx, byte [ecx]
add eax, edx
mov ecx, dword [ebp - 0x36c]
mov byte [ecx], al
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx]
add eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x2b0]
mov dword [ecx], eax
movzx edx, word [ebp - 0x110]
movzx eax, word [ebp - 0x448]
sub edx, eax
mov ecx, dword [ebp - 0x1dc]
mov word [ecx], dx
movzx edx, word [ebp - 0x3b0]
mov eax, dword [ebp - 0x1dc]
movzx ecx, word [eax]
add edx, ecx
mov word [ebp - 0x464], dx
mov edx, dword [ebp - 0x278]
mov eax, dword [edx]
sub eax, dword [ebp - 0x25c]
mov dword [ebp - 0x178], eax
mov ecx, dword [ebp - 0x278]
mov edx, dword [ebp - 0x178]
sub edx, dword [ecx]
mov eax, dword [ebp - 0xc0]
mov dword [eax], edx
mov ecx, dword [ebp - 0x45c]
mov edx, dword [ecx]
and edx, dword [ebp - 0x170]
mov dword [ebp - 0x160], edx
cmp dword [ebp - 0xdc], 0x12ce3
jne 0x477055
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x160]
or ecx, dword [eax]
mov dword [ebp - 0x2ec], ecx
movzx edx, byte [ebp - 0x109]
mov eax, dword [ebp - 0x220]
movzx ecx, byte [eax]
xor edx, ecx
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
mov ecx, dword [ebp - 0x164]
movzx ecx, byte [ecx]
sar eax, cl
cmp edx, eax
je 0x477342
mov edx, dword [ebp - 0x45c]
mov eax, dword [ebp - 0x170]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x124]
mov dword [ecx], eax
mov edx, dword [ebp - 0x2e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4e0], 0x3cd0f919
je 0x4772ec
cmp dword [ebp - 0x4e0], 0x6b7e3488
je 0x477304
jmp 0x47731e
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x448]
and edx, eax
mov word [ebp - 0x2f0], dx
jmp 0x47731e
movzx ecx, byte [ebp - 0x441]
mov edx, dword [ebp - 0x234]
movzx eax, byte [edx]
add ecx, eax
mov edx, dword [ebp - 0x164]
mov byte [edx], cl
lea eax, [ebp - 0x25c]
push eax
push 0xeb
lea ecx, [ebp - 0x2e0]
push ecx
call dword [sym.imp.ole32.dll_CoGetStdMarshalEx]
mov dword [ebp - 0x108], eax
jmp 0x47743a
mov edx, dword [ebp - 0x25c]
mov dword [ebp - 0xa0], edx
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
mov dword [ebp - 0x4e4], ecx
cmp dword [ebp - 0x4e4], 0
je 0x47737a
cmp dword [ebp - 0x4e4], 0x4366e46a
je 0x477423
jmp 0x47743a
movsx edx, word [ebp - 0x134]
mov dword [ebp - 0x4e8], edx
cmp dword [ebp - 0x4e8], 0x7b93
je 0x477395
jmp 0x47740b
mov eax, dword [ebp - 0x2b0]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
cmp dword [ebp - 0x4ec], 0
je 0x4773ba
cmp dword [ebp - 0x4ec], 0x3f138e8e
je 0x4773f4
jmp 0x477409
mov edx, dword [ebp - 0x124]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x2e4]
add eax, dword [ecx]
mov dword [ebp - 0x160], eax
mov edx, dword [ebp - 0x104]
mov eax, dword [edx]
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x278]
mov edx, dword [ecx]
sub edx, dword [ebp - 0xa0]
mov dword [ebp - 0x364], edx
jmp 0x477409
movzx eax, byte [ebp - 0x441]
movzx ecx, byte [ebp - 0x45d]
add eax, ecx
mov edx, dword [ebp - 0x4c]
mov byte [edx], al
jmp 0x477421
push 0xc8
push 0xf4
call dword [sym.imp.ole32.dll_CoCancelCall]
mov dword [ebp - 0x244], eax
jmp 0x47743a
movzx eax, word [ebp - 0x450]
movzx ecx, word [ebp - 0x2f0]
sub eax, ecx
mov word [ebp - 0x448], ax
mov edx, dword [ebp - 0x468]
add edx, dword [ebp - 0x25c]
mov eax, dword [ebp - 0x43c]
mov ecx, dword [ebp - 0x364]
sub ecx, dword [eax]
cmp edx, ecx
jbe 0x4774c7
call fcn.0046d040
movsx edx, byte [ebp - 0x5d]
mov eax, dword [ebp - 0x36c]
movsx ecx, byte [eax]
sub edx, ecx
mov eax, dword [ebp - 0x20c]
mov byte [eax], dl
movsx ecx, word [ebp - 0x134]
sar ecx, 8
mov word [ebp - 0x134], cx
push 0xb8
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0xd5]
push eax
push 0x50
push 0xa2
mov ecx, dword [ebp - 0x440]
push ecx
call dword [sym.imp.SHELL32.dll_SHDefExtractIconW]
mov dword [ebp - 0x154], eax
mov edx, dword [ebp - 0x2fc]
mov eax, dword [ebp - 0x43c]
mov ecx, dword [edx]
or ecx, dword [eax]
mov edx, dword [ebp - 0x278]
mov dword [edx], ecx
mov eax, dword [ebp - 0x138]
xor eax, dword [ebp - 0x2ec]
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0x120]
mov ecx, dword [ecx]
shl edx, cl
cmp eax, edx
jle 0x477528
mov eax, dword [ebp - 0x160]
push eax
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx]
push edx
call fcn.004ef7c0
add esp, 8
mov eax, dword [ebp - 0x178]
add eax, dword [ebp - 0x438]
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x170]
xor ecx, dword [ebp - 0x224]
mov edx, dword [ebp - 0x124]
mov dword [edx], ecx
jmp 0x4781b8
mov eax, dword [ebp - 0x45c]
mov ecx, dword [eax]
mov dword [ebp - 0x4f0], ecx
cmp dword [ebp - 0x4f0], 0x711364a4
je 0x477550
cmp dword [ebp - 0x4f0], 0x743fa988
je 0x47755e
jmp 0x4775a5
call dword [sym.imp.ole32.dll_CoSuspendClassObjects]
mov dword [ebp - 0x108], eax
jmp 0x4775a5
mov edx, dword [ebp - 0x210]
mov eax, dword [ebp - 0xec]
mov edx, dword [edx]
mov ecx, dword [eax]
shl edx, cl
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
movzx ecx, byte [ebp - 0x45d]
push ecx
mov edx, dword [ebp - 0x214]
push edx
movzx eax, word [ebp - 0x134]
push eax
mov ecx, dword [ebp - 0x20c]
movzx edx, byte [ecx]
push edx
mov eax, dword [ebp - 0x36c]
movzx ecx, byte [eax]
push ecx
call fcn.00429f50
mov edx, dword [ebp - 0x2ec]
mov dword [ebp - 0x4f4], edx
cmp dword [ebp - 0x4f4], 0
je 0x4775bc
jmp 0x47760c
movzx eax, byte [ebp - 0x441]
movzx ecx, byte [ebp - 0x45d]
or eax, ecx
mov edx, dword [ebp - 0x220]
mov byte [edx], al
mov eax, dword [ebp - 0x150]
mov cx, word [eax]
mov word [ebp - 0x158], cx
mov edx, dword [ebp - 0x2b0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x25c]
shr eax, cl
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x210]
mov eax, dword [ecx]
and eax, dword [edx]
mov dword [ebp - 0x10], eax
jmp 0x477620
mov ecx, dword [ebp - 0x2b0]
mov edx, dword [ebp - 0x178]
sub edx, dword [ecx]
mov dword [ebp - 0x468], edx
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x224]
mov dword [ebp - 0x120], ecx
movzx edx, word [ebp - 8]
mov dword [ebp - 0x4f8], edx
cmp dword [ebp - 0x4f8], 0x330
je 0x47764f
jmp 0x477707
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x4fc], 0x8d8fc8e4
je 0x477678
cmp dword [ebp - 0x4fc], 0xabacaba4
je 0x4776ec
jmp 0x477702
movzx ecx, byte [ebp - 0xd5]
movzx edx, byte [ebp - 0x441]
sub ecx, edx
mov eax, dword [ebp - 0x4c]
mov byte [eax], cl
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
add edx, ecx
mov word [ebp - 0x3b0], dx
lea edx, [ebp - 0x274]
push edx
push 0x3b
lea eax, [ebp - 0xbc]
push eax
push 0xc6
lea ecx, [ebp - 0x100]
push ecx
lea edx, [ebp - 0x288]
push edx
call dword [sym.imp.ole32.dll_CoGetStandardMarshal]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [ebp - 0x25c]
add ecx, dword [eax]
mov edx, dword [ebp - 0x278]
mov dword [edx], ecx
jmp 0x477702
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [ebp - 0xc0]
mov edx, dword [eax]
sub edx, dword [ecx]
mov dword [ebp - 0xa0], edx
jmp 0x4780f9
mov eax, dword [ebp - 0x36c]
movsx ecx, byte [eax]
movsx edx, byte [ebp - 0x5d]
xor ecx, edx
mov eax, dword [ebp - 0x20c]
movsx edx, byte [eax]
cmp ecx, edx
jl 0x4777b4
mov ax, word [ebp - 0x464]
mov word [ebp - 0x3b4], ax
mov dword [ebp - 0xe0], 0xdf17
movzx ecx, byte [ebp - 0x45d]
movzx edx, byte [ebp - 0xd5]
or ecx, edx
mov eax, dword [ebp - 0x114]
mov byte [eax], cl
mov ecx, dword [ebp - 0x2e4]
mov edx, dword [ebp - 0xd4]
mov eax, dword [ecx]
and eax, dword [edx]
mov dword [ebp - 0x160], eax
lea ecx, [ebp - 0x25c]
mov dword [ebp - 0x21c], ecx
mov edx, dword [ebp - 0xd4]
mov eax, dword [edx]
add eax, dword [ebp - 0x2ec]
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
mov edx, dword [ebp - 0x170]
mov dword [ebp - 0x2a8], edx
movzx eax, byte [ebp - 0x45d]
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx]
sub eax, edx
mov ecx, dword [ebp - 0x208]
mov byte [ecx], al
jmp 0x477833
movzx edx, byte [ebp - 0xd5]
mov eax, dword [ebp - 0x234]
movzx ecx, byte [eax]
sar edx, cl
movzx eax, byte [ebp - 0x109]
movzx ecx, byte [ebp - 0x45d]
shl eax, cl
cmp edx, eax
jge 0x477833
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
sub edx, ecx
mov eax, dword [ebp - 0x1dc]
mov word [eax], dx
lea ecx, [ebp - 0x430]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x434], eax
mov edx, dword [ebp - 0x278]
mov eax, dword [ebp - 0xa0]
sub eax, dword [edx]
mov dword [ebp - 0x2dc], eax
mov ecx, dword [ebp - 0x45c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xd4]
add edx, dword [eax]
mov ecx, dword [ebp - 0x2e4]
mov dword [ecx], edx
movsx edx, word [ebp - 0x134]
mov dword [ebp - 0x500], edx
cmp dword [ebp - 0x500], 0x3c4
je 0x47784e
jmp 0x4778b0
mov al, byte [ebp - 0x5d]
mov byte [ebp - 0x504], al
cmp byte [ebp - 0x504], 0x39
je 0x477862
jmp 0x477874
lea ecx, [ebp - 0x9c]
push ecx
call dword [sym.imp.COMDLG32.dll_ChooseFontW]
mov dword [ebp - 0x5c], eax
jmp 0x4778ae
mov edx, dword [ebp - 0x48]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x110]
and eax, ecx
mov word [ebp - 0x464], ax
movsx edx, byte [ebp - 0x5d]
mov eax, dword [ebp - 0x20c]
movsx ecx, byte [eax]
sub edx, ecx
mov eax, dword [ebp - 0x36c]
mov byte [eax], dl
mov ecx, dword [ebp - 0x2f4]
push ecx
call dword [sym.imp.SHELL32.dll_DragFinish]
jmp 0x477924
movzx edx, word [ebp - 0x450]
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
add edx, ecx
mov eax, dword [ebp - 0x1dc]
mov word [eax], dx
mov ecx, dword [ebp - 0x234]
mov dl, byte [ecx]
mov byte [ebp - 0x455], dl
mov eax, dword [ebp - 0x2b0]
mov ecx, dword [ebp - 0x468]
add ecx, dword [eax]
mov dword [ebp - 0x25c], ecx
mov edx, dword [ebp - 0x210]
mov eax, dword [edx]
mov dword [ebp - 0x16c], eax
mov edx, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x170]
shl edx, cl
mov eax, dword [ebp - 0x45c]
mov dword [eax], edx
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0x2fc]
mov eax, dword [ecx]
xor eax, dword [edx]
mov dword [ebp - 0x178], eax
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x248], ecx
movzx edx, byte [ebp - 0x109]
movzx eax, byte [ebp - 0xd5]
or edx, eax
mov ecx, dword [ebp - 0x114]
movzx eax, byte [ecx]
movzx ecx, byte [ebp - 0x45d]
sar eax, cl
cmp edx, eax
jge 0x4779ed
mov ecx, dword [ebp - 0x36c]
mov dl, byte [ecx]
mov byte [ebp - 0x508], dl
cmp byte [ebp - 0x508], 7
je 0x4779da
cmp byte [ebp - 0x508], 0x44
je 0x47797c
jmp 0x4779ed
movzx eax, byte [ebp - 0xd5]
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx]
and eax, edx
mov ecx, dword [ebp - 0x208]
mov byte [ecx], al
mov edx, dword [ebp - 0x10]
push edx
movzx eax, byte [ebp - 0x109]
push eax
call fcn.004ef7c0
add esp, 8
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x1dc]
movzx ecx, word [eax]
sub edx, ecx
mov word [ebp - 0x464], dx
mov edx, dword [ebp - 0x210]
mov eax, dword [edx]
sub eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x248]
mov dword [ecx], eax
jmp 0x4779ed
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.COMDLG32.dll_FindTextW]
mov dword [ebp - 0x370], eax
mov eax, dword [ebp - 0x36c]
movsx ecx, byte [eax]
movsx edx, byte [ebp - 0x5d]
add ecx, edx
mov eax, dword [ebp - 0x20c]
movsx edx, byte [eax]
cmp ecx, edx
jne 0x478075
cmp dword [ebp - 0x2f8], 0x2752
jbe 0x477caf
movzx eax, byte [ebp - 0x45d]
movzx ecx, byte [ebp - 0x441]
and eax, ecx
mov byte [ebp - 0x109], al
mov edx, dword [ebp - 0x1dc]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
add eax, edx
mov word [ebp - 0x110], ax
movsx eax, byte [ebp - 0x5d]
mov ecx, dword [ebp - 0x20c]
movsx edx, byte [ecx]
xor eax, edx
mov ecx, dword [ebp - 0x36c]
mov byte [ecx], al
movsx edx, word [ebp - 0x134]
or edx, 0x6d30
mov word [ebp - 0x134], dx
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0xc0]
mov edx, dword [eax]
mov ecx, dword [ecx]
shr edx, cl
mov dword [ebp - 0x468], edx
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0x170]
shl eax, cl
mov ecx, dword [ebp - 0x210]
mov dword [ecx], eax
movzx edx, word [ebp - 0x450]
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
add edx, ecx
mov eax, dword [ebp - 0x150]
mov word [eax], dx
movzx ecx, byte [ebp - 0x45d]
mov edx, dword [ebp - 0x220]
movzx eax, byte [edx]
and ecx, eax
mov edx, dword [ebp - 0x164]
mov byte [edx], cl
mov eax, dword [ebp - 0x25c]
add eax, dword [ebp - 0x438]
mov ecx, dword [ebp - 0x43c]
mov dword [ecx], eax
mov edx, dword [ebp - 0xec]
mov eax, dword [ebp - 0x224]
add eax, dword [edx]
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
mov edx, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x124]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x1c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [ebp - 0x178]
sub ecx, dword [eax]
mov dword [ebp - 0x468], ecx
mov edx, dword [ebp - 0x48]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x1dc]
movzx edx, word [ecx]
sub eax, edx
mov ecx, dword [ebp - 0x150]
mov word [ecx], ax
mov edx, dword [ebp - 0x208]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0x45d]
add eax, ecx
mov byte [ebp - 0x441], al
mov edx, dword [ebp - 0xa0]
add edx, dword [ebp - 0x178]
mov dword [ebp - 0x468], edx
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [eax]
and edx, dword [ecx]
mov dword [ebp - 0x218], edx
mov eax, dword [ebp - 0x2f8]
sub eax, 0xfa
mov dword [ebp - 0x2f8], eax
mov ecx, dword [ebp - 0x2b0]
mov edx, dword [ebp - 0x43c]
mov eax, dword [ecx]
xor eax, dword [edx]
mov dword [ebp - 0xa0], eax
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0x248]
mov eax, dword [ecx]
mov ecx, dword [edx]
shl eax, cl
mov dword [ebp - 0x170], eax
mov ecx, dword [ebp - 0x43c]
mov edx, dword [ebp - 0x2b0]
mov eax, dword [ecx]
or eax, dword [edx]
mov dword [ebp - 0x468], eax
mov ecx, dword [ebp - 0x20c]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x36c]
movsx ecx, byte [eax]
sar edx, cl
mov byte [ebp - 0x5d], dl
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x110]
add edx, eax
mov ecx, dword [ebp - 0x150]
mov word [ecx], dx
mov edx, dword [ebp - 0x220]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0xd5]
add eax, ecx
mov edx, dword [ebp - 0x114]
mov byte [edx], al
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x3b4]
and ecx, edx
mov word [ebp - 0x3b0], cx
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x468]
mov edx, dword [ebp - 0x43c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x160]
sub eax, dword [ebp - 0x2ec]
mov ecx, dword [ebp - 0x124]
mov dword [ecx], eax
movzx edx, byte [ebp - 0xd5]
mov eax, dword [ebp - 0x220]
movzx ecx, byte [eax]
sub edx, ecx
mov byte [ebp - 0x109], dl
mov edx, dword [ebp - 0x1dc]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
sub eax, edx
mov ecx, dword [ebp - 0x150]
mov word [ecx], ax
mov edx, dword [ebp - 0x2b0]
mov eax, dword [ebp - 0x214]
add eax, dword [edx]
mov dword [ebp - 0xa0], eax
jmp 0x477a0d
mov ecx, dword [ebp - 0x278]
mov edx, dword [ebp - 0x43c]
mov eax, dword [ecx]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x2dc]
sub ecx, dword [ebp - 0x214]
cmp eax, ecx
jbe 0x477d86
push 0x3a
mov edx, dword [ebp - 0x228]
push edx
push 0x47
mov eax, dword [ebp - 0xcc]
push eax
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
mov dword [ebp - 0x364], eax
call fcn.0046d040
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x16c]
and edx, dword [ecx]
mov dword [ebp - 0x170], edx
mov eax, dword [ebp - 0x36c]
movsx ecx, byte [eax]
movsx edx, byte [ebp - 0x5d]
add ecx, edx
mov eax, dword [ebp - 0x36c]
mov byte [eax], cl
mov ecx, dword [ebp - 0x160]
push ecx
mov edx, dword [ebp - 0x164]
movzx eax, byte [edx]
push eax
call fcn.004ef7c0
add esp, 8
lea ecx, [ebp - 0x4c]
push ecx
call dword [sym.imp.SHELL32.dll_ILGetSize]
mov dword [ebp - 0x364], eax
movzx edx, byte [ebp - 0x45d]
mov eax, dword [ebp - 0x234]
movzx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0x114]
mov byte [eax], dl
call fcn.004d7e60
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x1dc]
movzx ecx, word [eax]
sub edx, ecx
mov word [ebp - 0x464], dx
jmp 0x477f80
mov edx, dword [ebp - 0x234]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0x109]
add eax, ecx
mov edx, dword [ebp - 0x234]
mov byte [edx], al
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x2dc]
add ecx, dword [eax]
mov edx, dword [ebp - 0xc0]
mov dword [edx], ecx
mov eax, dword [ebp - 0x21c]
mov edx, dword [ebp - 0x2dc]
mov ecx, dword [eax]
shr edx, cl
mov dword [ebp - 0xa0], edx
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x170]
shl eax, cl
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xe0]
sub ecx, 0x23
mov dword [ebp - 0xe0], ecx
mov edx, dword [ebp - 0x1dc]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x110]
or eax, ecx
mov word [ebp - 0x464], ax
mov edx, dword [ebp - 0x248]
mov eax, dword [edx]
xor eax, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
mov edx, dword [ebp - 0x150]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x3b4]
and eax, ecx
mov word [ebp - 8], ax
movzx edx, byte [ebp - 0x45d]
mov eax, dword [ebp - 0x164]
movzx ecx, byte [eax]
sub edx, ecx
mov byte [ebp - 0x109], dl
mov edx, dword [ebp - 0x178]
sub edx, dword [ebp - 0x364]
mov dword [ebp - 0xa0], edx
mov eax, dword [ebp - 0x1dc]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x2f0]
sub ecx, edx
mov word [ebp - 0x464], cx
mov eax, dword [ebp - 0x2dc]
add eax, dword [ebp - 0x214]
mov dword [ebp - 0x468], eax
mov ecx, dword [ebp - 0x2b0]
mov edx, dword [ebp - 0x25c]
and edx, dword [ecx]
mov eax, dword [ebp - 0xc0]
mov dword [eax], edx
movzx ecx, word [ebp - 0x464]
mov edx, dword [ebp - 0x1dc]
movzx eax, word [edx]
add ecx, eax
mov edx, dword [ebp - 0x48]
mov word [edx], cx
movzx eax, byte [ebp - 0x45d]
movzx ecx, byte [ebp - 0xd5]
sub eax, ecx
mov edx, dword [ebp - 0x220]
mov byte [edx], al
movsx eax, byte [ebp - 0x5d]
mov ecx, dword [ebp - 0x36c]
movsx edx, byte [ecx]
add eax, edx
mov ecx, dword [ebp - 0x20c]
mov byte [ecx], al
movzx edx, byte [ebp - 0x109]
movzx eax, byte [ebp - 0x45d]
add edx, eax
mov ecx, dword [ebp - 0x208]
mov byte [ecx], dl
mov edx, dword [ebp - 0x21c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x214]
shl eax, cl
mov ecx, dword [ebp - 0x278]
mov dword [ecx], eax
mov edx, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x224]
mov ecx, dword [edx]
sar eax, cl
mov ecx, dword [ebp - 0x210]
mov dword [ecx], eax
mov edx, dword [ebp - 0x4c]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x208]
movzx edx, byte [ecx]
xor eax, edx
mov byte [ebp - 0x109], al
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1dc]
movzx eax, word [edx]
or ecx, eax
mov edx, dword [ebp - 0x150]
mov word [edx], cx
mov eax, dword [ebp - 0x120]
and eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x2e4]
mov dword [ecx], eax
cmp dword [ebp - 0xe0], 0xd74c
jae 0x477d86
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx]
xor eax, dword [ebp - 0xa0]
mov dword [ebp - 0x468], eax
push 0x82
lea ecx, [ebp - 0x455]
push ecx
push 0
lea edx, [ebp - 0x2d8]
push edx
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x430]
push ecx
call dword [sym.imp.ole32.dll_CoMarshalInterface]
mov dword [ebp - 0x154], eax
mov dl, byte [ebp - 0x45d]
mov byte [ebp - 0x50c], dl
cmp byte [ebp - 0x50c], 0xba
je 0x477fdc
jmp 0x47801a
lea eax, [ebp - 0x1d8]
push eax
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x208]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 0x45d]
sub edx, eax
mov byte [ebp - 0x109], dl
mov ecx, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x2a8]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x124]
mov dword [eax], edx
mov edx, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x224]
sar edx, cl
mov eax, dword [ebp - 0x2e4]
mov dword [eax], edx
mov ecx, dword [ebp - 0x43c]
mov edx, dword [ebp - 0x364]
or edx, dword [ecx]
mov dword [ebp - 0x25c], edx
mov eax, dword [ebp - 0x45c]
mov ecx, dword [eax]
push ecx
movzx edx, byte [ebp - 0x455]
push edx
call fcn.004ef7c0
add esp, 8
mov eax, dword [ebp - 0x1dc]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x448]
and ecx, edx
mov eax, dword [ebp - 0x48]
mov word [eax], cx
mov ecx, dword [ebp - 0x208]
movzx edx, byte [ecx]
push edx
movzx eax, byte [ebp - 0x5d]
push eax
call fcn.004d1cd0
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x278]
add edx, dword [eax]
mov ecx, dword [ebp - 0x2b0]
mov dword [ecx], edx
mov edx, dword [ebp - 0x208]
mov al, byte [edx]
mov byte [ebp - 0x510], al
cmp byte [ebp - 0x510], 0xee
je 0x4780bc
jmp 0x4780df
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x2a8]
mov dword [ebp - 0x170], ecx
mov edx, dword [ebp - 0x138]
sub edx, dword [ebp - 0x2a8]
mov eax, dword [ebp - 0x210]
mov dword [eax], edx
lea ecx, [ebp - 0x2ac]
push ecx
lea edx, [ebp - 0x230]
push edx
call dword [sym.imp.ole32.dll_CoAllowSetForegroundWindow]
mov dword [ebp - 0xb4], eax
mov al, byte [ebp - 0xd5]
mov byte [ebp - 0x514], al
cmp byte [ebp - 0x514], 9
je 0x478120
cmp byte [ebp - 0x514], 0xf1
je 0x4781a1
jmp 0x4781b8
mov ecx, dword [ebp - 0x210]
mov edx, dword [ebp - 0x218]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x124]
mov dword [eax], edx
lea ecx, [ebp - 0x1dc]
push ecx
call dword [sym.imp.ole32.dll_CoDisableCallCancellation]
mov dword [ebp - 0x15c], eax
mov edx, dword [ebp - 0x43c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x2fc]
add eax, dword [ecx]
mov edx, dword [ebp - 0xc0]
mov dword [edx], eax
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0x1dc]
push ecx
lea edx, [ebp - 0x2d8]
push edx
lea eax, [ebp - 0x2f0]
push eax
lea ecx, [ebp - 0x230]
push ecx
lea edx, [ebp - 0x2d8]
push edx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x3ac]
push ecx
call dword [sym.imp.ole32.dll_CoQueryProxyBlanket]
mov dword [ebp - 4], eax
jmp 0x4781b8
mov edx, dword [ebp - 0x20c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x36c]
movsx edx, byte [ecx]
and eax, edx
mov byte [ebp - 0x5d], al
movzx eax, word [ebp - 0xc8]
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
add eax, edx
movzx ecx, word [ebp - 0x3b0]
mov edx, dword [ebp - 0x1dc]
movzx edx, word [edx]
and ecx, edx
cmp eax, ecx
jg 0x478233
mov eax, dword [ebp - 0x1dc]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x48]
movzx eax, word [edx]
add ecx, eax
mov word [ebp - 0x464], cx
mov ecx, dword [ebp - 0x210]
mov edx, dword [ebp - 0x218]
sub edx, dword [ecx]
mov eax, dword [ebp - 0xec]
mov dword [eax], edx
lea ecx, [ebp - 0x2e8]
push ecx
lea edx, [ebp - 0xc4]
push edx
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x1dc]
push ecx
call dword [sym.imp.SHELL32.dll_SHBindToParent]
mov dword [ebp - 0x2e8], eax
mov edx, dword [ebp - 0x2e4]
mov eax, dword [ebp - 0x138]
sub eax, dword [edx]
mov dword [ebp - 0x120], eax
movzx ecx, word [ebp - 0x448]
mov edx, dword [ebp - 0x1dc]
movzx eax, word [edx]
sub ecx, eax
mov edx, dword [ebp - 0x48]
mov word [edx], cx
lea eax, [ebp - 0x168]
push eax
lea ecx, [ebp - 0x3ac]
push ecx
call dword [sym.imp.SHELL32.dll_SHIsFileAvailableOffline]
mov dword [ebp - 0x2e8], eax
jmp 0x4783b6
mov edx, dword [ebp - 0x114]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0x45d]
sub eax, ecx
movzx edx, byte [ebp - 0x109]
movzx ecx, byte [ebp - 0xd5]
sub edx, ecx
cmp eax, edx
jl 0x4782fc
mov edx, dword [ebp - 0xd4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x170]
sar eax, cl
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
push 0x9b
lea edx, [ebp - 0xb8]
push edx
lea eax, [ebp - 0xe8]
push eax
push 0x77
mov ecx, dword [ebp - 0xb8]
push ecx
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
mov dword [ebp - 0x2dc], eax
mov edx, dword [ebp - 0xec]
mov eax, dword [ebp - 0x2e4]
mov edx, dword [edx]
mov ecx, dword [eax]
shl edx, cl
mov dword [ebp - 0x2ec], edx
mov eax, dword [ebp - 0x2b0]
mov ecx, dword [eax]
or ecx, dword [ebp - 0x468]
mov edx, dword [ebp - 0x2b0]
mov dword [edx], ecx
mov al, byte [ebp - 0xd5]
mov byte [ebp - 0x518], al
cmp byte [ebp - 0x518], 0xd
je 0x478370
cmp byte [ebp - 0x518], 0x65
je 0x478335
jmp 0x4783b6
lea ecx, [ebp - 0x2d8]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 0x138], eax
mov edx, dword [ebp - 0x138]
xor edx, dword [ebp - 0x2ec]
mov dword [ebp - 0x160], edx
mov eax, dword [ebp - 0x120]
and eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x124]
mov dword [ecx], eax
jmp 0x4783b6
mov edx, dword [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x164]
movzx ecx, byte [eax]
push ecx
call fcn.004ef7c0
add esp, 8
lea edx, [ebp - 0x3f0]
push edx
push 0xde
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x36c]
push ecx
mov edx, dword [ebp - 0x3f4]
push edx
call dword [sym.imp.SHELL32.dll_SHDoDragDrop]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0xd4]
mov edx, dword [eax]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x45c]
mov ecx, dword [ebp - 0x2ec]
add ecx, dword [eax]
cmp edx, ecx
jg 0x4783fd
mov edx, dword [ebp - 0x218]
add edx, dword [ebp - 0x160]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x364]
sub ecx, dword [ebp - 0x438]
mov dword [ebp - 0x468], ecx
jmp 0x478452
lea edx, [ebp - 0x1c]
push edx
push 0x58
push 0xbb
push 0x28
push 0x24
mov eax, dword [ebp - 0x100]
push eax
call dword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
mov dword [ebp - 0x2dc], eax
movzx ecx, byte [ebp - 0xd5]
movzx edx, byte [ebp - 0x45d]
and ecx, edx
mov eax, dword [ebp - 0x164]
mov byte [eax], cl
mov ecx, dword [ebp - 0x1dc]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
add edx, ecx
mov word [ebp - 0x110], dx
mov edx, dword [ebp - 0x220]
movzx eax, byte [edx]
push eax
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
push edx
call section..text
jmp 0x4784f9
mov eax, dword [ebp - 0x364]
mov ecx, dword [ebp - 0x178]
shr eax, cl
mov ecx, dword [ebp - 0x468]
xor ecx, dword [ebp - 0x214]
cmp eax, ecx
jae 0x4784f9
mov edx, dword [ebp - 0x48]
movzx eax, word [edx]
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x51c], 0x41f
je 0x4784b4
cmp dword [ebp - 0x51c], 0x6e9
je 0x4784de
jmp 0x4784f9
movzx ecx, byte [ebp - 0x45d]
push ecx
mov edx, dword [ebp - 0x438]
push edx
push 0xfc
mov eax, dword [ebp - 0x36c]
movzx ecx, byte [eax]
push ecx
movzx edx, byte [ebp - 0x5d]
push edx
call fcn.00429f50
jmp 0x4784f9
mov eax, dword [ebp - 0x1dc]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x150]
movzx eax, word [edx]
and ecx, eax
mov word [ebp - 0x464], cx
mov ecx, dword [ebp - 0x278]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc8]
call fcn.004721c0
push 0xfd
call dword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
mov dword [ebp - 0xbc], eax
mov edx, dword [ebp - 0x120]
or edx, dword [ebp - 0x170]
mov eax, dword [ebp - 0x210]
mov dword [eax], edx
jmp 0x4785b9
mov ecx, dword [ebp - 0x278]
mov edx, dword [ebp - 0x214]
sub edx, dword [ecx]
mov dword [ebp - 0x25c], edx
mov eax, dword [ebp - 0x150]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1dc]
movzx eax, word [edx]
sub ecx, eax
mov edx, dword [ebp - 0x48]
mov word [edx], cx
push 0x1f
lea eax, [ebp - 0xc4]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemRealloc]
mov dword [ebp - 0x230], eax
movzx ecx, word [ebp - 0x2f0]
push ecx
mov edx, dword [ebp - 0x20c]
movzx eax, byte [edx]
push eax
push 0x2c
mov ecx, dword [ebp - 0x114]
mov dl, byte [ecx]
mov eax, dword [ebp - 0x208]
mov cl, byte [eax]
call fcn.00478870
mov ecx, dword [ebp - 0x114]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x4c]
movzx ecx, byte [eax]
add edx, ecx
mov byte [ebp - 0x441], dl
lea edx, [ebp - 0x3ac]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0xbc], eax
call dword [sym.imp.ole32.dll_CoGetCurrentProcess]
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0x70e20d9b
je 0x4785f2
jmp 0x4785f4
jmp 0x478633
mov ecx, dword [ebp - 0x1dc]
movzx edx, word [ecx]
push edx
mov eax, dword [ebp - 0x20c]
movzx ecx, byte [eax]
push ecx
push 0x67
mov dl, byte [ebp - 0x441]
mov eax, dword [ebp - 0x208]
mov cl, byte [eax]
call fcn.00478870
mov ecx, dword [ebp - 0x104]
mov edx, dword [ecx]
and edx, dword [ebp - 0x160]
mov eax, dword [ebp - 0x2e4]
mov dword [eax], edx
movzx ecx, byte [ebp - 0x441]
mov edx, dword [ebp - 0x234]
movzx eax, byte [edx]
xor ecx, eax
mov edx, dword [ebp - 0x208]
mov byte [edx], cl
movzx eax, word [ebp - 8]
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
sub eax, edx
mov word [ebp - 0x464], ax
mov eax, dword [ebp - 0x104]
mov edx, dword [ebp - 0x138]
mov ecx, dword [eax]
shl edx, cl
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
or ecx, dword [ebp - 0x160]
cmp edx, ecx
jl 0x478755
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0xec]
mov ecx, dword [edx]
and ecx, dword [eax]
mov edx, dword [ebp - 0x45c]
mov dword [edx], ecx
mov al, byte [ebp - 0x5d]
mov byte [ebp - 0x524], al
cmp byte [ebp - 0x524], 0x60
je 0x47873d
cmp byte [ebp - 0x524], 0x7d
je 0x4786c5
jmp 0x478755
mov ecx, dword [ebp - 0x150]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x1dc]
movzx ecx, word [eax]
add edx, ecx
mov word [ebp - 0x3b0], dx
mov edx, dword [ebp - 0x208]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x220]
movzx edx, byte [ecx]
add eax, edx
mov ecx, dword [ebp - 0x234]
mov byte [ecx], al
lea edx, [ebp - 0x358]
push edx
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [ebp - 0x214]
and ecx, dword [eax]
mov dword [ebp - 0x468], ecx
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0xec]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x45c]
mov dword [edx], ecx
jmp 0x478755
lea eax, [ebp - 0x258]
push eax
push str.hillocky
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
mov dword [ebp - 0xb4], eax
mov ecx, dword [ebp - 0x468]
or ecx, dword [ebp - 0x178]
mov dword [ebp - 0x25c], ecx
jmp 0x4787c2
movzx edx, word [ebp - 0x450]
movzx ecx, word [ebp - 0x464]
shl edx, cl
mov eax, dword [ebp - 0x150]
mov word [eax], dx
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x2fc]
add edx, dword [eax]
mov dword [ebp - 0x2dc], edx
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x288]
push edx
lea eax, [ebp - 0x15c]
push eax
push 0x2c
lea ecx, [ebp - 0xfc]
push ecx
call dword [sym.imp.ole32.dll_CoGetClassObject]
mov dword [ebp - 0x108], eax
mov edx, dword [ebp - 0x2fc]
mov eax, dword [ebp - 0x178]
or eax, dword [edx]
mov ecx, dword [ebp - 0xc0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x150]
movzx eax, word [edx]
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 0x4d
je 0x4787f4
jmp 0x47880c
movzx edx, byte [ebp - 0x109]
mov eax, dword [ebp - 0x208]
movzx ecx, byte [eax]
sar edx, cl
mov byte [ebp - 0x45d], dl
call dword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
mov dword [ebp - 0x25c], eax
mov edx, dword [ebp - 0x468]
mov ecx, dword [ebp - 0x450]
call fcn.004721c0
mov ecx, dword [ebp - 0xec]
mov edx, dword [ecx]
xor edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x104]
mov dword [eax], edx
lea ecx, [ebp - 0xc4]
push ecx
mov edx, dword [ebp - 0x228]
push edx
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
mov dword [ebp - 0xc4], eax
mov eax, dword [section..data]
pop esi
mov esp, ebp
pop ebp
ret