Function at 0x414970
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46a7a7
mov eax, dword fs:[0]
push eax
mov eax, 0x3020
call fcn.0045e940
mov eax, dword [0x4846a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x487934]
mov eax, dword [eax - 0xc]
xor esi, esi
mov ebx, ecx
mov edi, edx
mov dword [ebp - 0x2f30], ebx
mov dword [ebp - 0x2f38], edi
cmp eax, esi
je 0x4164c6
cmp byte [ebx + 0x128], 0
je 0x4164c6
cmp byte [ebp + 8], 0
jne 0x4149e3
cmp dword [0x4876ec], esi
je 0x4164c6
mov edx, dword [0x484034]
mov eax, dword [edx + 0xc]
mov ecx, 0x484034
call eax
add eax, 0x10
mov dword [ebp - 0x2f2c], eax
lea ecx, [ebp - 0x2f68]
push ecx
mov ecx, 0x474360
mov dword [ebp - 4], esi
call fcn.00401110
mov eax, 0xa
mov dword [ebp - 0x2f80], esi
mov dword [ebp - 0x2f7c], esi
mov dword [ebp - 0x2f78], esi
mov dword [ebp - 0x2f74], esi
mov dword [ebp - 0x2f70], esi
mov dword [ebp - 0x2f6c], eax
mov dword [ebp - 0x2f50], esi
mov dword [ebp - 0x2f4c], esi
mov dword [ebp - 0x2f48], esi
mov dword [ebp - 0x2f44], esi
mov dword [ebp - 0x2f40], esi
mov dword [ebp - 0x2f3c], eax
lea edx, [ebp - 0x2f68]
push edx
lea eax, [ebp - 0x2f80]
mov byte [ebp - 4], 3
cmp dword [0x4876f0], esi
push eax
push 0x487934
setg byte [ebp - 0x2f31]
call fcn.00429ca0
add esp, 0xc
lea esp, [esp]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x2f48], esi
jbe 0x414b09
mov esi, dword [ebp - 0x2f50]
xor eax, eax
test esi, esi
setne al
test eax, eax
je 0x41621c
mov ecx, dword [esi]
mov dword [ebp - 0x2f50], ecx
mov eax, dword [esi + 8]
sub eax, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x414adf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x2f40]
mov dword [esi], ecx
dec dword [ebp - 0x2f48]
mov dword [ebp - 0x2f40], esi
jne 0x414b00
lea esi, [ebp - 0x2f50]
call fcn.00429be0
cmp dword [ebp - 0x2f48], 0
ja 0x414aa3
mov ecx, dword [ebp - 0x2f44]
xor eax, eax
mov dword [ebp - 0x2f50], eax
mov dword [ebp - 0x2f4c], eax
mov dword [ebp - 0x2f40], eax
cmp ecx, eax
je 0x414b47
mov eax, ecx
lea esp, [esp]
mov esi, dword [eax]
push eax
call fcn.0044fac2
add esp, 4
mov eax, esi
test esi, esi
jne 0x414b30
mov dword [ebp - 0x2f44], esi
mov edx, dword [ebp - 0x2f78]
mov dword [ebp - 0x2f54], eax
cmp edx, eax
jbe 0x414de8
jmp 0x414b60
mov ecx, dword [ebp - 0x2f54]
cmp ecx, edx
jb 0x414b6e
xor eax, eax
jmp 0x414b85
mov eax, dword [ebp - 0x2f80]
test eax, eax
je 0x414b85
test ecx, ecx
je 0x414b85
lea esp, [esp]
dec ecx
mov eax, dword [eax]
jne 0x414b80
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x41621c
mov ecx, dword [eax + 8]
mov esi, dword [ebp - 0x2f2c]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x414bf4
cmp dword [esi + 0xc], 0
jl 0x414bde
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x414bde
call fcn.00426710
mov ebx, eax
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x414bd3
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [ebp - 0x2f2c], ebx
jmp 0x414bee
mov ebx, dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x2f2c]
push ecx
call fcn.00401330
mov ebx, dword [ebp - 0x2f30]
mov edx, dword [ebp - 0x2f2c]
cmp dword [edx - 0xc], 0
je 0x414dcd
mov esi, edx
push 0x474364
push esi
call fcn.0044fbff
add esp, 8
test eax, eax
jne 0x414f24
cmp dword [ebx + 0x144], eax
mov edx, dword [0x484034]
push eax
sete al
movzx ecx, al
mov eax, dword [edx + 0xc]
push ecx
push 0
push ecx
mov esi, esp
mov dword [ebp - 0x2f20], esp
mov ecx, 0x484034
mov dword [ebp - 0x2f20], esi
call eax
add eax, 0x10
mov dword [esi], eax
mov ecx, 0x474370
mov byte [ebp - 4], 4
test ecx, 0xffff0000
jne 0x414c7b
mov edx, ecx
movzx edi, dx
call fcn.004014d0
test eax, eax
je 0x414c8b
push eax
mov eax, edi
mov edi, esi
call fcn.00401290
jmp 0x414c8b
push 0x474370
push esi
mov ebx, 9
call fcn.00401330
mov byte [ebp - 4], 3
call fcn.004197d0
test al, al
je 0x414dc1
mov edi, dword [ebp - 0x2f4c]
lea esi, [ebp - 0x2f50]
call fcn.0042cc40
mov eax, dword [ebp - 0x2f40]
mov ebx, dword [eax]
mov esi, eax
mov dword [ebp - 0x2f20], esi
mov dword [ebp - 0x2f24], eax
add eax, 8
push eax
mov ecx, str.Microsoft_Excel
mov byte [ebp - 4], 5
call fcn.00401110
mov byte [ebp - 4], 3
mov dword [ebp - 0x2f40], ebx
mov dword [esi + 4], edi
mov dword [esi], 0
mov eax, dword [ebp - 0x2f4c]
inc dword [ebp - 0x2f48]
test eax, eax
je 0x414cfc
mov dword [eax], esi
jmp 0x414d02
mov dword [ebp - 0x2f50], esi
mov edi, dword [ebp - 0x2f38]
lea eax, [ebp - 0x2f20]
push eax
lea ecx, [ebp - 0x301c]
push ecx
push str.Microsoft_Excel
lea eax, [ebp - 0x2fc0]
mov ecx, edi
mov dword [ebp - 0x2f4c], esi
call fcn.0042bf50
test eax, eax
jne 0x414dc1
push ecx
mov edx, esp
mov dword [ebp - 0x2f20], esp
push edx
mov ecx, 0x4776c8
call fcn.00401110
push ecx
mov byte [ebp - 4], 6
mov eax, esp
mov dword [ebp - 0x2f24], esp
push eax
mov ecx, str.00020813_0000_0000_C000_000000000046
call fcn.00401110
push ecx
mov byte [ebp - 4], 7
mov ecx, esp
mov dword [ebp - 0x2f28], esp
push ecx
mov esi, str.excel.exe
call fcn.004211b0
lea edx, [ebp - 0x2fac]
push edx
mov byte [ebp - 4], 3
call fcn.00419c80
mov byte [ebp - 4], 8
mov ecx, dword [eax]
push edi
mov edx, str.Microsoft_Excel
call fcn.00429900
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x2fac]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414dc1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp - 0x2f38]
mov ebx, dword [ebp - 0x2f30]
mov eax, dword [ebp - 0x2f54]
mov edx, dword [ebp - 0x2f78]
inc eax
mov dword [ebp - 0x2f54], eax
cmp eax, edx
jb 0x414b60
mov eax, dword [ebp - 0x2f48]
test eax, eax
je 0x416328
cmp byte [ebp - 0x2f31], 0
jne 0x416207
lea eax, [ebp - 0x2f84]
push eax
push ebx
lea ecx, [ebp - 0x2f50]
mov byte [ebp - 0x2f31], 1
call fcn.004164f0
mov byte [ebp - 4], 0x35
cmp dword [ebx + 0x190], 0
jne 0x414e69
cmp dword [ebx + 0x150], 0
je 0x414e69
cmp dword [ebx + 0x144], 0
jne 0x414e69
mov ecx, dword [0x487970]
push str.YesNoCancel
push ecx
call fcn.0044fbff
add esp, 8
test eax, eax
jne 0x414e69
mov edx, str.OkCancel
mov edi, 0x487970
call fcn.004011b0
mov ebx, dword [ebp - 0x2f30]
mov edx, dword [0x487970]
push 0x4748d4
push edx
call fcn.0044fbff
add esp, 8
test eax, eax
je 0x415e30
mov eax, dword [0x487970]
push str.OkCancel
push eax
call fcn.0044fbff
add esp, 8
test eax, eax
je 0x415e30
lea esi, [ebp - 0x2f1c]
call fcn.00404e50
fld dword [0x4876dc]
mov edx, dword [0x487918]
fstp dword [ebp - 0x26b8]
mov ecx, dword [ebx + 0x1cc]
fld dword [0x4876d8]
mov edi, dword [ebp - 0x2f84]
fstp dword [ebp - 0x26b4]
or dword [ebp - 0x2f08], 1
push 0x20010133
push edx
mov edx, dword [ebx + 0x40]
mov dword [ebp - 0x2f00], ecx
push edi
mov ecx, esi
mov dword [ebp - 0x2efc], 0xc8
mov dword [ebp - 0x26d0], str.....CommonSourceADXBootstrapperClickTwice.DownloaderBootstrapper.cpp
call fcn.004493b0
and eax, 0xff
add esp, 0xc
cmp eax, 6
jne 0x415d97
mov byte [ebx + 0x129], 1
jmp 0x4161db
push str.word
push esi
call fcn.0044fbff
add esp, 8
test eax, eax
jne 0x415078
cmp dword [ebx + 0x144], eax
push eax
sete cl
movzx edx, cl
push edx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x2f20], esp
push eax
mov ecx, 0x4743bc
call fcn.00401110
call fcn.004197d0
test al, al
je 0x414dcd
mov ebx, dword [ebp - 0x2f4c]
lea esi, [ebp - 0x2f50]
call fcn.0042cc40
mov eax, dword [ebp - 0x2f40]
mov edi, dword [eax]
mov esi, eax
mov dword [ebp - 0x2f20], esi
mov dword [ebp - 0x2f24], eax
add eax, 8
push eax
mov ecx, str.Microsoft_Word
mov byte [ebp - 4], 9
call fcn.00401110
mov byte [ebp - 4], 3
mov dword [ebp - 0x2f40], edi
mov dword [esi + 4], ebx
mov dword [esi], 0
mov eax, dword [ebp - 0x2f4c]
inc dword [ebp - 0x2f48]
test eax, eax
je 0x414fca
mov dword [eax], esi
jmp 0x414fd0
mov dword [ebp - 0x2f50], esi
mov edi, dword [ebp - 0x2f38]
lea ecx, [ebp - 0x2f20]
push ecx
lea edx, [ebp - 0x3024]
push edx
push str.Microsoft_Word
lea eax, [ebp - 0x302c]
mov ecx, edi
mov dword [ebp - 0x2f4c], esi
call fcn.0042bf50
test eax, eax
jne 0x414dc1
push ecx
mov eax, esp
mov dword [ebp - 0x2f20], esp
push eax
mov ecx, 0x4776c8
call fcn.00401110
push ecx
mov ecx, esp
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x2f24], esp
push ecx
mov ecx, str.00020905_0000_0000_C000_000000000046
call fcn.00401110
push ecx
mov byte [ebp - 4], 0xb
mov edx, esp
mov dword [ebp - 0x2f28], esp
push edx
mov esi, str.winword.exe
call fcn.004211b0
lea eax, [ebp - 0x2f88]
push eax
mov byte [ebp - 4], 3
call fcn.00419c80
mov byte [ebp - 4], 0xc
mov ecx, dword [eax]
push edi
mov edx, str.Microsoft_Word
call fcn.00429900
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x2f88]
jmp 0x414da5
push str.infopath
push esi
call fcn.0044fbff
add esp, 8
test eax, eax
jne 0x415227
cmp dword [ebx + 0x144], eax
push eax
sete cl
movzx edx, cl
push edx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x2f20], esp
push eax
mov ecx, 0x474414
call fcn.00401110
call fcn.004197d0
test al, al
je 0x414dcd
push str.Microsoft_Office_InfoPath
lea ecx, [ebp - 0x2f50]
call fcn.00429b50
lea ecx, [ebp - 0x2f20]
push ecx
lea edx, [ebp - 0x2fc8]
push edx
push str.Microsoft_Office_InfoPath
lea eax, [ebp - 0x3020]
mov ecx, edi
call fcn.0042bf50
test eax, eax
jne 0x414dcd
push ecx
mov eax, esp
mov dword [ebp - 0x2f20], esp
push eax
mov ecx, 0x4776c8
call fcn.00401110
push ecx
mov ecx, esp
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x2f24], esp
push ecx
mov ecx, str.FD34A360_115F_43CA_8D6F_BBD45FD6F828
call fcn.00401110
push ecx
mov byte [ebp - 4], 0xe
mov edx, esp
mov dword [ebp - 0x2f28], esp
push edx
mov esi, str.infopath.exe
call fcn.004211b0
lea eax, [ebp - 0x2f64]
push eax
mov byte [ebp - 4], 3
call fcn.00419c80
mov bl, 0xf
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x2f64]
cmp dword [ecx - 0xc], 0
jne 0x4151e7
push ecx
mov edx, esp
mov dword [ebp - 0x2f20], esp
push edx
mov ecx, 0x4776c8
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x10
mov eax, esp
mov dword [ebp - 0x2f24], esp
push eax
mov ecx, str.FD34A370_115F_43CA_8D6F_BBD45FD6F828
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x11
mov ecx, esp
mov dword [ebp - 0x2f28], esp
push ecx
call fcn.004211b0
lea edx, [ebp - 0x2fb4]
push edx
mov byte [ebp - 4], bl
call fcn.00419c80
lea edi, [ebp - 0x2f64]
mov byte [ebp - 4], 0x12
call fcn.00421630
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x2fb4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4151e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp - 0x2f38]
mov ecx, dword [ebp - 0x2f64]
push edi
mov edx, str.Microsoft_Office_InfoPath
call fcn.00429900
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x2f64]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414dc7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x414dc7
push str.access
push esi
call fcn.0044fbff
add esp, 8
test eax, eax
jne 0x415339
cmp dword [ebx + 0x144], eax
push eax
sete cl
movzx edx, cl
push edx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x2f20], esp
push eax
mov ecx, 0x474484
call fcn.00401110
call fcn.004197d0
test al, al
je 0x414dcd
push str.Microsoft_Access
lea ecx, [ebp - 0x2f50]
call fcn.00429b50
lea ecx, [ebp - 0x2f20]
push ecx
lea edx, [ebp - 0x2fd0]
push edx
push str.Microsoft_Access
lea eax, [ebp - 0x3000]
mov ecx, edi
call fcn.0042bf50
test eax, eax
jne 0x414dcd
push ecx
mov eax, esp
mov dword [ebp - 0x2f20], esp
push eax
mov ecx, 0x4776c8
call fcn.00401110
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x2f24], esp
push ecx
mov ecx, str.4AFFC9A0_5F99_101B_AF4E_00AA003F0F07
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x14
mov edx, esp
mov dword [ebp - 0x2f28], esp
push edx
mov esi, str.msaccess.exe
call fcn.004211b0
lea eax, [ebp - 0x2fbc]
push eax
mov byte [ebp - 4], 3
call fcn.00419c80
mov byte [ebp - 4], 0x15
mov ecx, dword [eax]
push edi
mov edx, str.Microsoft_Access
call fcn.00429900
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x2fbc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414dcd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x414dcd
push str.outlook
push esi
call fcn.0044fbff
add esp, 8
test eax, eax
jne 0x415430
cmp dword [ebx + 0x144], eax
push eax
sete cl
movzx edx, cl
push edx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x2f20], esp
push eax
mov ecx, 0x4744e4
call fcn.00401110
call fcn.004197d0
test al, al
je 0x414dcd
push str.Microsoft_Outlook
lea ecx, [ebp - 0x2f50]
call fcn.00429b50
lea ecx, [ebp - 0x2f20]
push ecx
lea edx, [ebp - 0x2fd8]
push edx
push str.Microsoft_Outlook
lea eax, [ebp - 0x3018]
mov ecx, edi
call fcn.0042bf50
test eax, eax
jne 0x414dcd
push ecx
mov eax, esp
mov dword [ebp - 0x2f20], esp
push eax
mov ecx, 0x4776c8
call fcn.00401110
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x2f24], esp
push ecx
mov ecx, str.00062FFF_0000_0000_C000_000000000046
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x17
mov edx, esp
mov dword [ebp - 0x2f28], esp
push edx
mov esi, str.outlook.exe
call fcn.004211b0
lea eax, [ebp - 0x2f90]
push eax
mov byte [ebp - 4], 3
call fcn.00419c80
mov byte [ebp - 4], 0x18
mov ecx, dword [eax]
push edi
mov edx, str.Microsoft_Outlook
call fcn.00429900
lea eax, [ebp - 0x2f90]
mov byte [ebp - 4], 3
call fcn.004245a0
jmp 0x414dcd
push str.powerpoint
push esi
call fcn.0044fbff
add esp, 8
test eax, eax
jne 0x415527
cmp dword [ebx + 0x144], eax
push eax
sete cl
movzx edx, cl
push edx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x2f20], esp
push eax
mov ecx, 0x474544
call fcn.00401110
call fcn.004197d0
test al, al
je 0x414dcd
push str.Microsoft_PowerPoint
lea ecx, [ebp - 0x2f50]
call fcn.00429b50
lea ecx, [ebp - 0x2f20]
push ecx
lea edx, [ebp - 0x2fe0]
push edx
push str.Microsoft_PowerPoint
lea eax, [ebp - 0x3008]
mov ecx, edi
call fcn.0042bf50
test eax, eax
jne 0x414dcd
push ecx
mov eax, esp
mov dword [ebp - 0x2f20], esp
push eax
mov ecx, 0x4776c8
call fcn.00401110
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x2f24], esp
push ecx
mov ecx, str.91493440_5A91_11CF_8700_00AA0060263B
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x1a
mov edx, esp
mov dword [ebp - 0x2f28], esp
push edx
mov esi, str.powerpnt.exe
call fcn.004211b0
lea eax, [ebp - 0x2fa8]
push eax
mov byte [ebp - 4], 3
call fcn.00419c80
mov byte [ebp - 4], 0x1b
mov ecx, dword [eax]
push edi
mov edx, str.Microsoft_PowerPoint
call fcn.00429900
lea eax, [ebp - 0x2fa8]
mov byte [ebp - 4], 3
call fcn.004245a0
jmp 0x414dcd
push str.publisher
push esi
call fcn.0044fbff
add esp, 8
test eax, eax
jne 0x41561e
cmp dword [ebx + 0x144], eax
push eax
sete cl
movzx edx, cl
push edx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x2f20], esp
push eax
mov ecx, 0x4745b0
call fcn.00401110
call fcn.004197d0
test al, al
je 0x414dcd
push str.Microsoft_Publisher
lea ecx, [ebp - 0x2f50]
call fcn.00429b50
lea ecx, [ebp - 0x2f20]
push ecx
lea edx, [ebp - 0x2fe8]
push edx
push str.Microsoft_Publisher
lea eax, [ebp - 0x3028]
mov ecx, edi
call fcn.0042bf50
test eax, eax
jne 0x414dcd
push ecx
mov eax, esp
mov dword [ebp - 0x2f20], esp
push eax
mov ecx, 0x4776c8
call fcn.00401110
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x2f24], esp
push ecx
mov ecx, str.0002123C_0000_0000_C000_000000000046
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x1d
mov edx, esp
mov dword [ebp - 0x2f28], esp
push edx
mov esi, str.mspub.exe
call fcn.004211b0
lea eax, [ebp - 0x2f98]
push eax
mov byte [ebp - 4], 3
call fcn.00419c80
mov byte [ebp - 4], 0x1e
mov ecx, dword [eax]
push edi
mov edx, str.Microsoft_Publisher
call fcn.00429900
lea eax, [ebp - 0x2f98]
mov byte [ebp - 4], 3
call fcn.004245a0
jmp 0x414dcd
lea ecx, [ebp - 0x2f2c]
push ecx
mov ecx, str.project
call fcn.00421770
test eax, eax
jne 0x4157fd
cmp dword [ebx + 0x144], eax
push eax
sete dl
movzx eax, dl
push eax
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x2f20], esp
push ecx
mov ecx, 0x474608
call fcn.00401110
call fcn.004197d0
test al, al
je 0x415719
push str.Microsoft_Project
lea ecx, [ebp - 0x2f50]
call fcn.00429b50
lea edx, [ebp - 0x2f20]
push edx
lea eax, [ebp - 0x2ff0]
push eax
push str.Microsoft_Project
lea eax, [ebp - 0x3010]
mov ecx, edi
call fcn.0042bf50
test eax, eax
jne 0x414dcd
push ecx
mov ecx, esp
mov dword [ebp - 0x2f20], esp
push ecx
mov ecx, 0x4776c8
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x1f
mov edx, esp
mov dword [ebp - 0x2f24], esp
push edx
mov ecx, str.A7107640_94DF_1068_855E_00DD01075445
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x20
mov eax, esp
mov dword [ebp - 0x2f28], esp
push eax
mov esi, str.msproject.exe
call fcn.004211b0
lea ecx, [ebp - 0x2fb8]
push ecx
mov byte [ebp - 4], 3
call fcn.00419c80
mov byte [ebp - 4], 0x21
mov ecx, dword [eax]
push edi
mov edx, str.Microsoft_Project
call fcn.00429900
lea eax, [ebp - 0x2fb8]
mov byte [ebp - 4], 3
call fcn.004245a0
jmp 0x414dcd
cmp dword [ebx + 0x144], 0
push 0
sete dl
movzx eax, dl
push eax
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x2f20], esp
push ecx
mov ecx, 0x474658
call fcn.00401110
call fcn.004197d0
test al, al
je 0x414dcd
push str.Microsoft_Project
lea ecx, [ebp - 0x2f50]
call fcn.00429b50
lea edx, [ebp - 0x2f20]
push edx
lea eax, [ebp - 0x2ff8]
push eax
push str.Microsoft_Project
lea eax, [ebp - 0x2fc4]
mov ecx, edi
call fcn.0042bf50
test eax, eax
jne 0x414dcd
push ecx
mov ecx, esp
mov dword [ebp - 0x2f20], esp
push ecx
mov ecx, 0x4776c8
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x22
mov edx, esp
mov dword [ebp - 0x2f24], esp
push edx
mov ecx, str.A7107640_94DF_1068_855E_00DD01075445
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x23
mov eax, esp
mov dword [ebp - 0x2f28], esp
push eax
mov esi, str.winproj.exe
call fcn.004211b0
lea ecx, [ebp - 0x2fa0]
push ecx
mov byte [ebp - 4], 3
call fcn.00419c80
mov byte [ebp - 4], 0x24
mov ecx, dword [eax]
push edi
mov edx, str.Microsoft_Project
call fcn.00429900
lea eax, [ebp - 0x2fa0]
mov byte [ebp - 4], 3
call fcn.004245a0
jmp 0x414dcd
lea edx, [ebp - 0x2f2c]
push edx
mov ecx, str.mappoint
call fcn.00421770
test eax, eax
jne 0x4158f8
cmp dword [ebx + 0x144], eax
push eax
sete al
movzx ecx, al
push ecx
push 0
push ecx
mov edx, esp
mov dword [ebp - 0x2f20], esp
push edx
mov ecx, 0x474690
call fcn.00401110
call fcn.004197d0
test al, al
je 0x414dcd
push str.Microsoft_MapPoint
lea ecx, [ebp - 0x2f50]
call fcn.00429b50
lea eax, [ebp - 0x2f20]
push eax
lea ecx, [ebp - 0x2fcc]
push ecx
push str.Microsoft_MapPoint
lea eax, [ebp - 0x2fd4]
mov ecx, edi
call fcn.0042bf50
test eax, eax
jne 0x414dcd
push ecx
mov edx, esp
mov dword [ebp - 0x2f20], esp
push edx
mov ecx, 0x4776c8
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x25
mov eax, esp
mov dword [ebp - 0x2f24], esp
push eax
mov ecx, str.15A40120_24D2_4FDB_8155_5F65FCE7017F
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x26
mov ecx, esp
mov dword [ebp - 0x2f28], esp
push ecx
mov esi, str.mappoint.exe
call fcn.004211b0
lea edx, [ebp - 0x2fb0]
push edx
mov byte [ebp - 4], 3
call fcn.00419c80
mov byte [ebp - 4], 0x27
mov ecx, dword [eax]
push edi
mov edx, str.Microsoft_MapPoint
call fcn.00429900
lea eax, [ebp - 0x2fb0]
mov byte [ebp - 4], 3
call fcn.004245a0
jmp 0x414dcd
lea eax, [ebp - 0x2f2c]
push eax
mov ecx, str.visio
call fcn.00421770
test eax, eax
jne 0x4159f2
cmp dword [ebx + 0x144], eax
push eax
sete cl
movzx edx, cl
push edx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x2f20], esp
push eax
mov ecx, 0x4746f0
call fcn.00401110
call fcn.004197d0
test al, al
je 0x414dcd
push str.Microsoft_Visio
lea ecx, [ebp - 0x2f50]
call fcn.00429b50
lea ecx, [ebp - 0x2f20]
push ecx
lea edx, [ebp - 0x2fdc]
push edx
push str.Microsoft_Visio
lea eax, [ebp - 0x2fe4]
mov ecx, edi
call fcn.0042bf50
test eax, eax
jne 0x414dcd
push ecx
mov eax, esp
mov dword [ebp - 0x2f20], esp
push eax
mov ecx, 0x4776c8
call fcn.00401110
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x2f24], esp
push ecx
mov ecx, str.00021A98_0000_0000_C000_000000000046
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x29
mov edx, esp
mov dword [ebp - 0x2f28], esp
push edx
mov esi, str.visio.exe
call fcn.004211b0
lea eax, [ebp - 0x2f8c]
push eax
mov byte [ebp - 4], 3
call fcn.00419c80
mov byte [ebp - 4], 0x2a
mov ecx, dword [eax]
push edi
mov edx, str.Microsoft_Visio
call fcn.00429900
lea eax, [ebp - 0x2f8c]
mov byte [ebp - 4], 3
call fcn.004245a0
jmp 0x414dcd
lea ecx, [ebp - 0x2f2c]
push ecx
mov ecx, str.frontpage
call fcn.00421770
test eax, eax
jne 0x415aed
cmp dword [ebx + 0x144], eax
push eax
sete dl
movzx eax, dl
push eax
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x2f20], esp
push ecx
mov ecx, 0x474744
call fcn.00401110
call fcn.004197d0
test al, al
je 0x414dcd
push str.Microsoft_FrontPage
lea ecx, [ebp - 0x2f50]
call fcn.00429b50
lea edx, [ebp - 0x2f20]
push edx
lea eax, [ebp - 0x2fec]
push eax
push str.Microsoft_FrontPage
lea eax, [ebp - 0x2ff4]
mov ecx, edi
call fcn.0042bf50
test eax, eax
jne 0x414dcd
push ecx
mov ecx, esp
mov dword [ebp - 0x2f20], esp
push ecx
mov ecx, 0x4776c8
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x2b
mov edx, esp
mov dword [ebp - 0x2f24], esp
push edx
mov ecx, str.3824BCD5_7042_11CE_8E17_0020AF9F9648
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x2c
mov eax, esp
mov dword [ebp - 0x2f28], esp
push eax
mov esi, str.frontpage.exe
call fcn.004211b0
lea ecx, [ebp - 0x2f94]
push ecx
mov byte [ebp - 4], 3
call fcn.00419c80
mov byte [ebp - 4], 0x2d
mov ecx, dword [eax]
push edi
mov edx, str.Microsoft_FrontPage
call fcn.00429900
lea eax, [ebp - 0x2f94]
mov byte [ebp - 4], 3
call fcn.004245a0
jmp 0x414dcd
lea edx, [ebp - 0x2f2c]
push edx
mov ecx, str.onenote
call fcn.00421770
test eax, eax
jne 0x415be8
cmp dword [ebx + 0x144], eax
push eax
sete al
movzx ecx, al
push ecx
push 0
push ecx
mov edx, esp
mov dword [ebp - 0x2f20], esp
push edx
mov ecx, 0x4747a8
call fcn.00401110
call fcn.004197d0
test al, al
je 0x414dcd
push str.Microsoft_OneNote
lea ecx, [ebp - 0x2f50]
call fcn.00429b50
lea eax, [ebp - 0x2f20]
push eax
lea ecx, [ebp - 0x2ffc]
push ecx
push str.Microsoft_OneNote
lea eax, [ebp - 0x3004]
mov ecx, edi
call fcn.0042bf50
test eax, eax
jne 0x414dcd
push ecx
mov edx, esp
mov dword [ebp - 0x2f20], esp
push edx
mov ecx, 0x4776c8
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x2e
mov eax, esp
mov dword [ebp - 0x2f24], esp
push eax
mov ecx, 0x4776c8
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x2f
mov ecx, esp
mov dword [ebp - 0x2f28], esp
push ecx
mov esi, str.onenote.exe
call fcn.004211b0
lea edx, [ebp - 0x2f9c]
push edx
mov byte [ebp - 4], 3
call fcn.00419c80
mov byte [ebp - 4], 0x30
mov ecx, dword [eax]
push edi
mov edx, str.Microsoft_OneNote
call fcn.00429900
lea eax, [ebp - 0x2f9c]
mov byte [ebp - 4], 3
call fcn.004245a0
jmp 0x414dcd
lea eax, [ebp - 0x2f2c]
push eax
mov ecx, str.internet_explorer
call fcn.00421770
test eax, eax
je 0x415c16
lea ecx, [ebp - 0x2f2c]
push ecx
mov ecx, str.internetexplorer
call fcn.00421770
test eax, eax
jne 0x414dcd
cmp dword [ebx + 0x144], 0
push 0
sete dl
movzx eax, dl
push eax
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x2f20], esp
push ecx
mov ecx, 0x474838
call fcn.00401110
call fcn.004197d0
test al, al
je 0x414dcd
push str.Internet_Explorer
lea ecx, [ebp - 0x2f50]
call fcn.00429b50
lea edx, [ebp - 0x2f20]
push edx
lea eax, [ebp - 0x300c]
push eax
push str.Internet_Explorer
lea eax, [ebp - 0x3014]
mov ecx, edi
call fcn.0042bf50
test eax, eax
jne 0x414dcd
lea esi, [ebp - 0x2f58]
call fcn.00421580
mov byte [ebp - 4], 0x31
mov esi, dword [ebp - 0x2f58]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x105
or eax, ecx
jge 0x415cc0
mov eax, 0x105
lea ecx, [ebp - 0x2f58]
call fcn.00401440
mov esi, dword [ebp - 0x2f58]
push esi
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHFOLDER.dll_SHGetFolderPathW]
test eax, eax
jne 0x415d11
mov eax, dword [esi - 8]
push eax
push esi
call fcn.0045013c
add esp, 8
test eax, eax
js 0x416226
cmp eax, dword [esi - 8]
jg 0x416226
lea edx, [ebp - 0x2f58]
xor ecx, ecx
push edx
mov dword [esi - 0xc], eax
mov edx, str.Internet_Exploreriexplore.exe
mov word [esi + eax*2], cx
call fcn.004221e0
mov esi, dword [ebp - 0x2f58]
push ecx
lea eax, [esi - 0x10]
mov dword [ebp - 0x2f20], esp
mov ebx, esp
call fcn.00426710
add eax, 0x10
mov dword [ebx], eax
push ecx
mov byte [ebp - 4], 0x32
mov eax, esp
mov dword [ebp - 0x2f24], esp
push eax
mov ecx, str.EAB22AC0_30C1_11CF_A7EB_0000C05BAE0B
call fcn.00401110
push ecx
mov byte [ebp - 4], 0x33
mov ecx, esp
mov dword [ebp - 0x2f28], esp
push ecx
mov esi, str.iexplore.exe
call fcn.004211b0
lea edx, [ebp - 0x2fa4]
push edx
mov byte [ebp - 4], 0x31
call fcn.00419c80
mov byte [ebp - 4], 0x34
mov ecx, dword [eax]
push edi
mov edx, str.Internet_Explorer
call fcn.00429900
lea eax, [ebp - 0x2fa4]
call fcn.004245a0
lea eax, [ebp - 0x2f58]
mov byte [ebp - 4], 3
call fcn.004245a0
jmp 0x414dc7
cmp eax, 2
jne 0x4161db
lea eax, [edi - 0x10]
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415dc0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esi, [ebp - 0x2f50]
call fcn.00429be0
lea esi, [ebp - 0x2f80]
call fcn.00429be0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x2f68]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415dfc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2f2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416321
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
jmp 0x4164c8
cmp dword [ebx + 0x190], 0
mov dword [ebp - 0x2f20], 0x20000000
mov dword [ebp - 0x2f24], 0x1000000
jne 0x415e69
cmp dword [ebx + 0x150], 0
je 0x415e69
cmp dword [ebx + 0x144], 0
jne 0x415e69
mov dword [ebp - 0x2f24], 0
mov eax, dword [0x487970]
push str.OkCancel
push eax
call fcn.0044fbff
add esp, 8
test eax, eax
jne 0x415e8a
mov dword [ebp - 0x2f20], 0x20000001
lea esi, [ebp - 0x2f1c]
call fcn.00404e50
fld dword [0x4876dc]
mov ecx, dword [ebx + 0x1cc]
fstp dword [ebp - 0x26b8]
mov edx, dword [0x484034]
fld dword [0x4876d8]
mov eax, dword [edx + 0xc]
fstp dword [ebp - 0x26b4]
or dword [ebp - 0x2f08], 1
mov dword [ebp - 0x2f00], ecx
mov ecx, 0x484034
mov dword [ebp - 0x2efc], 0xc8
mov dword [ebp - 0x26d0], str.....CommonSourceADXBootstrapperClickTwice.DownloaderBootstrapper.cpp
call eax
add eax, 0x10
mov dword [ebp - 0x2f54], eax
mov byte [ebp - 4], 0x36
mov edx, dword [0x484034]
mov eax, dword [edx + 0xc]
mov ecx, 0x484034
call eax
add eax, 0x10
mov dword [ebp - 0x2f5c], eax
mov ecx, str.these
mov byte [ebp - 4], 0x37
test ecx, 0xffff0000
jne 0x415f39
mov edx, ecx
movzx edi, dx
call fcn.004014d0
test eax, eax
je 0x415f4f
push eax
mov eax, edi
lea edi, [ebp - 0x2f5c]
call fcn.00401290
jmp 0x415f4f
push str.these
lea eax, [ebp - 0x2f5c]
push eax
mov ebx, 5
call fcn.00401330
mov byte [ebp - 4], 0x38
mov edx, dword [0x484034]
mov eax, dword [edx + 0xc]
mov ecx, 0x484034
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x2f60], esi
mov ecx, 0x474984
mov byte [ebp - 4], 0x39
test ecx, 0xffff0000
jne 0x415f9b
mov edx, ecx
movzx edi, dx
call fcn.004014d0
test eax, eax
je 0x415fb7
push eax
mov eax, edi
lea edi, [ebp - 0x2f60]
call fcn.00401290
jmp 0x415fb1
push 0x474984
lea eax, [ebp - 0x2f60]
push eax
mov ebx, 1
call fcn.00401330
mov esi, dword [ebp - 0x2f60]
mov byte [ebp - 4], 0x3a
cmp dword [ebp - 0x2f48], 1
jne 0x41602f
push 0x474988
lea ecx, [ebp - 0x2f5c]
push ecx
mov ebx, 4
call fcn.00401330
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x41602f
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x416007
cmp dword [esi - 8], 0
jl 0x416226
xor edx, edx
mov dword [esi - 0xc], 0
mov word [esi], dx
jmp 0x41602f
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41601d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x2f60], esi
mov eax, dword [ebp - 0x2f30]
cmp dword [eax + 0x190], 0
jne 0x416054
cmp dword [eax + 0x150], 0
je 0x416054
cmp dword [eax + 0x144], 0
je 0x41610f
mov edx, dword [0x484034]
mov eax, dword [edx + 0xc]
mov ecx, 0x484034
call eax
add eax, 0x10
mov dword [ebp - 0x2f28], eax
mov ecx, str.Check_if_you_want_to_run__s_application_s_automatically_after_the_r_nupgrade_is_installed_r_n
mov byte [ebp - 4], 0x3b
test ecx, 0xffff0000
jne 0x41609c
mov edx, ecx
movzx edi, dx
call fcn.004014d0
test eax, eax
je 0x4160ac
push eax
mov eax, edi
lea edi, [ebp - 0x2f28]
call fcn.00401290
jmp 0x4160ac
mov ebx, str.Check_if_you_want_to_run__s_application_s_automatically_after_the_r_nupgrade_is_installed_r_n
lea eax, [ebp - 0x2f28]
call fcn.004216a0
mov byte [ebp - 4], 0x3c
mov eax, dword [ebp - 0x2f5c]
mov ebx, dword [ebp - 0x2f28]
push esi
push eax
push ebx
lea edi, [ebp - 0x2f54]
call fcn.00428b20
mov eax, dword [ebp - 0x2f54]
lea edx, [ebp - 0x2094]
add esp, 0xc
sub edx, eax
jmp 0x4160e0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4160e0
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 0x3a
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41610f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x2f24]
or eax, dword [ebp - 0x2f20]
mov ecx, dword [0x487918]
mov edi, dword [ebp - 0x2f84]
mov ebx, dword [ebp - 0x2f30]
mov edx, dword [ebx + 0x40]
or eax, 0x10030
push eax
push ecx
push edi
lea ecx, [ebp - 0x2f1c]
mov dword [ebp - 0x26b0], 1
call fcn.004493b0
mov ecx, eax
and ecx, 0xff
add esp, 0xc
cmp ecx, 2
je 0x416230
test eax, 0x1000000
je 0x41616f
mov byte [ebx + 0x129], 1
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0x38
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41618f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x36
mov eax, dword [ebp - 0x2f5c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4161b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x35
mov eax, dword [ebp - 0x2f54]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4161db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4161fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0x2f30]
mov edi, dword [ebp - 0x2f38]
mov eax, dword [ebp - 0x2f48]
test eax, eax
je 0x416328
xor esi, esi
jmp 0x414a90
push 0x80004005
call fcn.00401680
push 0x80070057
call fcn.00401680
add esi, 0xfffffff0
mov byte [ebp - 4], 0x38
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416250
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov byte [ebp - 4], 0x36
mov eax, dword [ebp - 0x2f5c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416276
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x35
mov eax, dword [ebp - 0x2f54]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41629c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add edi, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4162bc
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
lea esi, [ebp - 0x2f50]
call fcn.00429be0
lea esi, [ebp - 0x2f80]
call fcn.00429be0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x2f68]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4162f8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2f2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416321
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
jmp 0x4164c8
mov byte [ebp - 4], 2
test eax, eax
je 0x416396
mov esi, dword [ebp - 0x2f50]
xor eax, eax
test esi, esi
setne al
test eax, eax
je 0x41621c
mov ecx, dword [esi]
mov dword [ebp - 0x2f50], ecx
mov eax, dword [esi + 8]
sub eax, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41636c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x2f40]
mov dword [esi], ecx
dec dword [ebp - 0x2f48]
mov dword [ebp - 0x2f40], esi
jne 0x41638d
lea esi, [ebp - 0x2f50]
call fcn.00429be0
cmp dword [ebp - 0x2f48], 0
ja 0x416330
mov eax, dword [ebp - 0x2f44]
xor ecx, ecx
mov dword [ebp - 0x2f50], ecx
mov dword [ebp - 0x2f4c], ecx
mov dword [ebp - 0x2f40], ecx
cmp eax, ecx
je 0x4163cb
mov esi, dword [eax]
push eax
call fcn.0044fac2
add esp, 4
mov eax, esi
test esi, esi
jne 0x4163b4
mov dword [ebp - 0x2f44], esi
mov byte [ebp - 4], 1
cmp dword [ebp - 0x2f78], 0
jbe 0x41643e
mov esi, dword [ebp - 0x2f80]
xor eax, eax
test esi, esi
setne al
test eax, eax
je 0x41621c
mov edx, dword [esi]
mov dword [ebp - 0x2f80], edx
mov eax, dword [esi + 8]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416414
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x2f70]
mov dword [esi], ecx
dec dword [ebp - 0x2f78]
mov dword [ebp - 0x2f70], esi
jne 0x416435
lea esi, [ebp - 0x2f80]
call fcn.00429be0
cmp dword [ebp - 0x2f78], 0
ja 0x4163d8
mov eax, dword [ebp - 0x2f74]
xor ecx, ecx
mov dword [ebp - 0x2f80], ecx
mov dword [ebp - 0x2f7c], ecx
mov dword [ebp - 0x2f70], ecx
cmp eax, ecx
je 0x416477
lea esp, [esp]
mov esi, dword [eax]
push eax
call fcn.0044fac2
add esp, 4
mov eax, esi
test esi, esi
jne 0x416460
mov dword [ebp - 0x2f74], esi
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x2f68]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41649d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2f2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4164c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044ebd7
mov esp, ebp
pop ebp
ret 4