Function at 0x47469f
Capabilities:
Create directory

Disassembly:
push 0xa8
mov eax, 0x51eaff
call fcn.004d8abf
mov ebx, ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 4], 1
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x4746e7
push 0x1fc1
push 0x80004005
push ecx
mov ecx, esp
push str.Administrator_rights_required
call fcn.00406fea
mov ecx, ebx
call fcn.00406620
jmp 0x4750bf
mov eax, dword [ebp + 8]
mov byte [ebp - 0x15], 1
mov eax, dword [eax + 0xc]
inc dword [eax + 0x14]
mov eax, dword [0x57d3ec]
add eax, 0x54
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 2
call fcn.0044f24f
push 1
lea ecx, [eax + 0x28]
call fcn.004ab7d2
call fcn.0044f24f
fld1
mov eax, dword [eax + 0x28]
fstp qword [eax]
call fcn.0044f24f
mov byte [eax + 0x1a9], 1
call fcn.0044f24f
mov ecx, eax
mov eax, dword [ecx + 0x1b0]
sub eax, dword [ecx + 0x1ac]
mov ecx, 0xa8
cdq
idiv ecx
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx + 4]
je 0x474792
push 0x1fcc
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x6c]
call fcn.00406620
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 3
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x64]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x15]
call fcn.0044f694
jmp 0x4750bf
mov eax, dword [ecx]
mov esi, dword [eax]
cmp esi, eax
je 0x47480b
xor edi, edi
mov dword [ebp - 0x30], edi
mov eax, dword [esi + 8]
mov dword [ebp - 0x48], eax
call fcn.0044f24f
mov eax, dword [eax + 0x1ac]
cmp byte [eax + edi + 0x55], 0
je 0x4747f7
call fcn.0044f24f
mov eax, dword [eax + 0x1ac]
cmp byte [eax + edi + 0x54], 0
jne 0x4747f7
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0x3c]
inc dword [eax + 0xc]
call fcn.0044f24f
push ecx
mov ecx, esp
push str.Waiting_to_uninstall
mov edi, dword [eax + 0x1ac]
add edi, dword [ebp - 0x30]
call fcn.00406fea
mov ecx, edi
call fcn.0044eeac
mov edi, dword [ebp - 0x30]
mov eax, dword [ebp + 8]
add edi, 0xa8
mov ecx, dword [esi]
mov esi, ecx
mov dword [ebp - 0x30], edi
cmp ecx, dword [eax]
jne 0x47479f
lea ecx, [ebp - 0x15]
mov byte [ebp - 4], 1
call fcn.0044f694
mov eax, dword [ebp + 8]
and dword [ebp - 0x54], 0
mov eax, dword [eax]
mov esi, dword [eax]
cmp esi, eax
je 0x4750b0
and dword [ebp - 0x24], 0
mov byte [ebp - 0x15], 1
mov eax, dword [0x57d3ec]
mov edi, dword [esi + 8]
add eax, 0x54
push eax
mov dword [ebp - 0x20], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 4
call fcn.0044f24f
mov edi, dword [ebp - 0x24]
lea ecx, [ebp - 0x15]
mov eax, dword [eax + 0x1ac]
mov bl, byte [eax + edi + 0x55]
mov byte [ebp - 4], 1
call fcn.0044f694
test bl, bl
je 0x475096
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xd], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 5
call fcn.0044f24f
lea ecx, [ebp - 0xd]
mov eax, dword [eax + 0x1ac]
mov bl, byte [eax + edi + 0x54]
mov byte [ebp - 4], 1
call fcn.0044f694
test bl, bl
jne 0x475096
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xd], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x80]
mov ebx, dword [ebp - 0x20]
mov edx, 0x54b3f4
push ebx
call fcn.004093b4
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x7c]
mov edx, eax
mov dword [esp], 0x552df4
call fcn.00409442
pop ecx
push eax
mov byte [ebp - 4], 8
call fcn.0044f24f
lea ecx, [eax + 0x48]
call fcn.00405d6e
mov ecx, dword [ebp - 0x7c]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.00407189
call fcn.0044f24f
push ecx
mov ecx, esp
push str.Uninstalling
mov edi, dword [eax + 0x1ac]
add edi, dword [ebp - 0x24]
call fcn.00406fea
mov ecx, edi
call fcn.0044eeac
call fcn.0044f24f
lea ecx, [ebp - 0xd]
mov byte [eax + 0x1a9], 1
call fcn.0044f694
xor edi, edi
lea eax, [ebp - 0x28]
push edi
push eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x28], edi
push eax
mov ecx, ebx
call fcn.00438c63
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x78]
call fcn.0040121b
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x78], edi
jl 0x4751ba
mov ecx, dword [ebp - 0x70]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp dword [ebp - 0x6c], edi
je 0x474a52
lea ecx, [ebp - 0x48]
call fcn.0040687a
mov ebx, str.Skipped__not_installed_
mov byte [ebp - 4], 0xc
push ebx
call fcn.004ddaa2
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x48]
call fcn.00406efb
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xd], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0xd
call fcn.0044f24f
mov ebx, dword [ebp - 0x24]
mov eax, dword [eax + 0x1ac]
mov byte [eax + ebx + 0x56], 1
call fcn.0044f24f
mov eax, dword [eax + 0x1ac]
mov byte [eax + ebx + 0x54], 1
call fcn.0044f24f
push ecx
push ecx
mov dword [ebp - 0x20], esp
mov eax, dword [eax + 0x1ac]
add eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, esp
mov ecx, esp
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [ecx], edi
mov dword [ecx + 4], edi
push ecx
mov byte [ebp - 4], 0xe
mov edi, esp
mov dword [ebp - 0x28], edi
mov ebx, dword [ebp - 0x48]
lea ecx, [ebx - 0x10]
call fcn.004070e7
mov ecx, dword [ebp - 0x1c]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0xd
call fcn.0044ef0e
lea ecx, [ebp - 0xd]
call fcn.0044f694
lea ecx, [ebx - 0x10]
call fcn.00407189
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x64]
jmp 0x47508e
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x64]
add ecx, 0xfffffff0
call fcn.00407189
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x475189
mov eax, dword [eax + 0x110]
mov byte [eax], 1
mov eax, dword [0x57d3ec]
cmp byte [eax + 1], 0
je 0x474b25
push 0x200d
push 1
push ecx
mov ecx, esp
push str.User_abort
call fcn.00406fea
lea ecx, [ebp - 0x9c]
call fcn.00406620
mov byte [ebp - 4], 0x10
mov ecx, dword [ebx + 0x3c]
push eax
call fcn.004032ed
mov ecx, dword [ebp - 0x94]
add ecx, 0xfffffff0
call fcn.00407189
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xd], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x11
call fcn.0044f24f
push ecx
push ecx
xor ebx, ebx
mov dword [ebp - 0x1c], esp
mov edi, dword [eax + 0x1ac]
mov eax, esp
add edi, dword [ebp - 0x24]
mov ecx, eax
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x12
push str.Canceled
call fcn.00406fea
mov ecx, edi
mov byte [ebp - 4], 0x11
call fcn.0044ef0e
lea ecx, [ebp - 0xd]
mov byte [ebp - 4], 1
call fcn.0044f694
jmp 0x475096
lea ecx, [ebp - 0x88]
call fcn.004282f6
mov edi, eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x13
call fcn.004283a1
push edi
mov edx, eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x2c]
call fcn.0040a037
pop ecx
mov ecx, dword [ebp - 0x84]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x88]
add ecx, 0xfffffff0
call fcn.00407189
push 0
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x47513e
push ecx
mov edi, esp
mov dword [ebp - 0x1c], edi
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x30]
mov dword [edi], eax
call fcn.004284ba
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x14], edi
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
mov dword [ebp - 0x1c], esp
call fcn.004070e7
add eax, 0x10
mov dword [edi], eax
push dword [ebp + 0x14]
mov byte [ebp - 4], 0x1a
push ecx
mov edi, esp
mov dword [ebp - 0x14], edi
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.004070e7
push dword [ebp - 0x54]
add eax, 0x10
lea ecx, [ebp - 0x44]
push dword [ebp - 0x28]
mov dword [edi], eax
mov edx, ebx
mov byte [ebp - 4], 0x19
call fcn.0046b602
add esp, 0x10
mov byte [ebp - 4], 0x1b
mov edi, esp
mov dword [ebp - 0x14], edi
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
xor ecx, ecx
mov dword [edi], eax
call fcn.00428b15
pop ecx
test eax, eax
jns 0x474c3e
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov edi, esp
mov dword [ebp - 0x14], edi
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
xor ecx, ecx
mov dword [edi], eax
call fcn.00428b15
pop ecx
mov eax, dword [0x57d3ec]
cmp byte [eax + 1], 0
je 0x474cf4
cmp dword [ebp - 0x44], 0
je 0x474cf4
push 0x2027
push 1
push ecx
mov ecx, esp
push str.User_abort
call fcn.00406fea
lea ecx, [ebp - 0xa8]
call fcn.00406620
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebx + 0x3c]
push eax
call fcn.004032ed
mov ecx, dword [ebp - 0xa0]
add ecx, 0xfffffff0
call fcn.00407189
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xd], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x1d
call fcn.0044f24f
push ecx
push ecx
xor edx, edx
mov dword [ebp - 0x14], esp
mov edi, dword [eax + 0x1ac]
mov eax, esp
add edi, dword [ebp - 0x24]
mov ecx, eax
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [ecx], edx
mov dword [ecx + 4], edx
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1e
push str.Canceled
call fcn.00406fea
mov ecx, edi
mov byte [ebp - 4], 0x1d
call fcn.0044ef0e
lea ecx, [ebp - 0xd]
call fcn.0044f694
jmp 0x475071
mov ecx, dword [ebx + 0x3c]
lea eax, [ebp - 0x44]
push eax
call fcn.004032ed
cmp dword [ebp - 0x44], 1
je 0x474e07
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xd], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x1f
call fcn.0044f24f
cmp dword [ebp - 0x44], 0
mov ebx, eax
mov edi, dword [ebp - 0x20]
setl cl
movzx ecx, cl
push ecx
mov edi, dword [edi]
push ecx
mov ecx, esp
push str.Uninstall_app
call fcn.00406fea
push 0xa
push edi
mov ecx, ebx
call fcn.0044ebc5
mov edi, dword [ebp - 0x20]
and dword [ebp - 0x1c], 0
cmp dword [edi + 0x48], 1
jbe 0x474db5
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.00438c63
mov ecx, dword [ebp - 0xac]
lea ecx, [ecx - 0x10]
call fcn.00407189
call fcn.0044f24f
cmp dword [ebp - 0x44], 0
mov ebx, eax
mov edi, dword [edi]
setl cl
movzx ecx, cl
push ecx
push ecx
mov ecx, esp
push dword [ebp - 0x1c]
push str.Uninstall_app___d_
push ecx
call fcn.004011e0
add esp, 0xc
mov ecx, ebx
push 0xa
push edi
call fcn.0044ebc5
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x7c], 1
jbe 0x474dfc
call fcn.0044f24f
cmp dword [ebp - 0x44], 0
mov ebx, eax
mov eax, dword [ebp - 0x28]
mov edi, dword [edi]
setl dl
movzx edx, dl
push edx
mov ecx, dword [eax + 0x110]
push ecx
mov edx, esp
push dword [ecx + 4]
push dword [ebp - 0x1c]
push str.Uninstall_app___d___ws
push edx
call fcn.004011e0
add esp, 0x10
mov ecx, ebx
push 0xa
push edi
call fcn.0044ebc5
lea ecx, [ebp - 0xd]
call fcn.0044f694
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp + 0x14]
cmp byte [eax + 0x10], 0
jne 0x474eed
lea ecx, [ebp - 0x50]
call fcn.0040687a
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x44]
test eax, eax
jns 0x474e5f
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x8c]
push str.0x_08x___d___ws
push eax
call fcn.004011e0
add esp, 0x14
push eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x21
call fcn.00405d6e
mov ecx, dword [ebp - 0x8c]
add ecx, 0xfffffff0
call fcn.00407189
jmp 0x474e77
jne 0x474e77
mov edi, 0x53d410
push edi
call fcn.004ddaa2
pop ecx
push eax
push edi
lea ecx, [ebp - 0x50]
call fcn.00406efb
mov eax, dword [ebp - 0x50]
add eax, 0xfffffff0
mov dword [ebp - 0x1c], eax
cmp dword [eax + 4], 0
je 0x474ee6
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xd], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x22
call fcn.0044f24f
mov ebx, dword [ebx]
push ecx
mov edi, esp
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], esp
call fcn.004070e7
add eax, 0x10
mov dword [edi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x23
push 0x54b4a0
call fcn.00406fea
mov ecx, dword [ebp - 0x20]
push ebx
mov byte [ebp - 4], 0x22
call fcn.0044ed57
lea ecx, [ebp - 0xd]
call fcn.0044f694
mov eax, dword [ebp - 0x1c]
mov ecx, eax
call fcn.00407189
lea ecx, [ebp - 0x34]
call fcn.0040687a
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0x44]
test eax, eax
jns 0x474f51
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Uninstall_failed
call fcn.00406fea
sub esp, 0xc
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.0040121b
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x24
call fcn.0044f0b0
add esp, 0x10
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x26
call fcn.00405d6e
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
call fcn.00407189
mov edi, dword [ebp - 0x24]
jmp 0x474fff
cmp eax, 1
jne 0x474faf
mov eax, dword [ebp - 0x3c]
cmp dword [eax - 0xc], 0
jne 0x474f77
mov ebx, str.Skipped
push ebx
call fcn.004ddaa2
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x34]
call fcn.00406efb
jmp 0x474f83
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x34]
call fcn.00405d6e
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xd], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x27
call fcn.0044f24f
mov edi, dword [ebp - 0x24]
mov eax, dword [eax + 0x1ac]
mov byte [eax + edi + 0x56], 1
jmp 0x474ff7
test eax, eax
jne 0x4750de
mov ebx, 0x53d410
push ebx
call fcn.004ddaa2
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x34]
call fcn.00406efb
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xd], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x29
call fcn.0044f24f
mov edi, dword [ebp - 0x24]
mov eax, dword [eax + 0x1ac]
mov byte [eax + edi + 0x54], 1
lea ecx, [ebp - 0xd]
call fcn.0044f694
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0xd], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x2a
call fcn.0044f24f
push ecx
push ecx
xor edx, edx
mov dword [ebp - 0x14], esp
mov eax, dword [eax + 0x1ac]
add eax, edi
mov dword [ebp - 0x1c], eax
mov eax, esp
mov ecx, esp
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [ecx], edx
mov dword [ecx + 4], edx
push ecx
mov byte [ebp - 4], 0x2b
mov edi, esp
mov dword [ebp - 0x20], edi
mov ebx, dword [ebp - 0x34]
lea ecx, [ebx - 0x10]
call fcn.004070e7
mov ecx, dword [ebp - 0x1c]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x2a
call fcn.0044ef0e
lea ecx, [ebp - 0xd]
call fcn.0044f694
lea ecx, [ebx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x3c]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, dword [ebp + 8]
mov esi, dword [esi]
inc dword [ebp - 0x54]
add dword [ebp - 0x24], 0xa8
cmp esi, dword [eax]
jne 0x474832
mov ebx, dword [ebp - 0x38]
and dword [ebx], 0
lea ecx, [ebx + 8]
and dword [ebx + 4], 0
call fcn.0040687a
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4750cb
call fcn.00405adf
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, ebx
call fcn.004d8a8d
ret
push 0x205a
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x60]
call fcn.00406620
mov esi, dword [ebp - 0x38]
lea eax, [ebp - 0x60]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x28
call fcn.0040121b
mov ecx, dword [ebp - 0x58]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x34]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x3c]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x2c]
jmp 0x475211
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x2013
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x60]
call fcn.00406620
mov esi, dword [ebp - 0x38]
lea eax, [ebp - 0x60]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x18
call fcn.0040121b
mov ecx, dword [ebp - 0x58]
jmp 0x47512e
push 0x2008
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x60]
call fcn.00406620
mov esi, dword [ebp - 0x38]
lea eax, [ebp - 0x60]
push eax
mov ecx, esi
mov byte [ebp - 4], 0xf
call fcn.0040121b
mov ecx, dword [ebp - 0x58]
jmp 0x475211
cmp dword [ebp - 0x74], 0
mov eax, 0x1ffa
cmovne eax, dword [ebp - 0x74]
push eax
push dword [ebp - 0x78]
push ecx
mov esi, esp
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 0x70]
lea ecx, [edi - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x60]
mov dword [esi], eax
call fcn.00406620
mov esi, dword [ebp - 0x38]
lea eax, [ebp - 0x60]
push eax
mov ecx, esi
mov byte [ebp - 4], 0xb
call fcn.0040121b
mov ecx, dword [ebp - 0x58]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [edi - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x64]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x475225
call fcn.00405adf
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, esi
jmp 0x4750d8