Function at 0x4202a9
Capabilities:
Parse pe header

Disassembly:
push ebp
push ebx
push edi
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4202b1
call fcn.004ceb50
mov edx, dword [esp + 0x38]
lea ecx, [esp]
call fcn.0044f000
mov edx, 0x5e60ba
lea ecx, [0xf81384]
call fcn.0044f008
mov dword [0xf81460], 0
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed434
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x42032e
cmp edi, 0xffffffff
je 0x420332
xor eax, eax
jmp 0x420337
mov eax, 1
or eax, eax
je 0x4203c4
mov edx, dword [esp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81420]
push eax
call fcn.004ceac0
push dword [0xf815dc]
push dword [0xf81420]
call fcn.004cc840
mov ebx, eax
and ebx, ebx
jle 0x420395
mov edx, dword [0xf815a4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81578]
push eax
call fcn.004ceac0
jmp 0x4203b5
mov edx, dword [0xf81420]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81578]
push eax
call fcn.004ceac0
mov dword [0xf814cc], 1
jmp 0x4206d5
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.filesOfficeData
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x420409
cmp edi, 0xffffffff
je 0x42040d
xor eax, eax
jmp 0x420412
mov eax, 1
or eax, eax
je 0x4204c5
mov edx, dword [esp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.files_
push edx
call fcn.004cea70
lea eax, [esp + 4]
push eax
call fcn.004ceac0
mov edx, dword [esp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81420]
push eax
call fcn.004ceac0
push dword [0xf815dc]
push dword [0xf81420]
call fcn.004cc840
mov ebx, eax
and ebx, ebx
jle 0x420496
mov edx, dword [0xf815a4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81578]
push eax
call fcn.004ceac0
jmp 0x4204b6
mov edx, dword [0xf81420]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81578]
push eax
call fcn.004ceac0
mov dword [0xf814cc], 1
jmp 0x4206d5
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [0xf815dc]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed434
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x42050c
cmp edi, 0xffffffff
je 0x420510
xor eax, eax
jmp 0x420515
mov eax, 1
or eax, eax
je 0x4205c3
mov edx, dword [0xf815dc]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [esp + 4]
push eax
call fcn.004ceac0
mov edx, dword [0xf815dc]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81420]
push eax
call fcn.004ceac0
push dword [0xf815dc]
push dword [0xf81420]
call fcn.004cc840
mov ebx, eax
and ebx, ebx
jle 0x420594
mov edx, dword [0xf815a4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81578]
push eax
call fcn.004ceac0
jmp 0x4205b4
mov edx, dword [0xf81420]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81578]
push eax
call fcn.004ceac0
mov dword [0xf814cc], 1
jmp 0x4206d5
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [0xf815dc]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.filesOfficeData
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x42060a
cmp edi, 0xffffffff
je 0x42060e
xor eax, eax
jmp 0x420613
mov eax, 1
or eax, eax
je 0x42069b
mov edx, dword [0xf815dc]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.files_
push edx
call fcn.004cea70
lea eax, [0xf81420]
push eax
call fcn.004ceac0
mov edx, dword [0xf815dc]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.files_
push edx
call fcn.004cea70
lea eax, [esp + 4]
push eax
call fcn.004ceac0
mov dword [0xf814cc], 1
mov edx, dword [0xf815a4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81578]
push eax
call fcn.004ceac0
jmp 0x4206d5
mov edx, dword [0xf815a4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81578]
push eax
call fcn.004ceac0
mov dword [0xf814cc], 0
mov edx, 0x5e60ba
lea ecx, [0xf81420]
call fcn.0044f008
mov ebx, dword [0xf814cc]
and ebx, ebx
jle 0x42079c
mov edx, dword [0xf81470]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81330]
push eax
call fcn.004ceac0
mov dword [esp + 4], 0
jmp 0x42070d
push dword [0xf8169c]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x42074d
mov edx, dword [0xf816a0]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf8169c]
mov edx, 0x5e7212
lea ecx, [ebp]
call fcn.0044f008
inc dword [esp + 4]
jno 0x42070d
mov dword [esp + 4], 0
jmp 0x420757
push dword [0xf81690]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x420797
mov edx, dword [0xf81694]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81690]
mov edx, 0x5e7212
lea ecx, [ebp]
call fcn.0044f008
inc dword [esp + 4]
jno 0x420757
jmp 0x420850
mov edx, dword [0xf81470]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81330]
push eax
call fcn.004ceac0
mov dword [esp + 4], 0
jmp 0x4207c6
push dword [0xf8169c]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x420806
mov edx, dword [0xf816a0]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf8169c]
mov edx, 0x5e7216
lea ecx, [ebp]
call fcn.0044f008
inc dword [esp + 4]
jno 0x4207c6
mov dword [esp + 4], 0
jmp 0x420810
push dword [0xf81690]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x420850
mov edx, dword [0xf81694]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81690]
mov edx, 0x5e7216
lea ecx, [ebp]
call fcn.0044f008
inc dword [esp + 4]
jno 0x420810
mov ebx, dword [0xf814cc]
and ebx, ebx
jle 0x42098a
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4c3e
push eax
mov edx, dword [0xf81420]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed434
push edx
call fcn.004cea70
call fcn.004ceb30
push 0
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x42095e
push 0
call fcn.004baf70
and eax, eax
je 0x420954
push 0
call fcn.004badeb
mov ebx, eax
cmp ebx, 1
jne 0x42094f
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.0042205d
lea eax, [esp + 0xc]
push eax
call fcn.004ceac0
push dword [esp + 8]
mov edx, 0x5e60ba
pop ecx
call fcn.0044f3d0
jne 0x42094f
push edx
call fcn.004cea40
pop edx
push eax
mov edx, 0x5e62ec
push edx
call fcn.004cea70
mov edx, dword [esp + 0xc]
push edx
call fcn.004cea70
mov edx, 0x5e6e76
push edx
call fcn.004cea70
lea eax, [esp + 0x10]
push eax
call fcn.004ceac0
jmp 0x4208b0
push 0
call fcn.004baf3e
mov edx, dword [0xf81484]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, dword [esp + 0x10]
push edx
call fcn.004cea70
lea eax, [0xf8157c]
push eax
call fcn.004ceac0
jmp 0x4209aa
mov edx, dword [0xf81374]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf8157c]
push eax
call fcn.004ceac0
mov ebx, dword [0xf81430]
and ebx, ebx
jne 0x4209c5
mov ebx, dword [0xf81434]
and ebx, ebx
jne 0x4209c5
mov eax, 1
jmp 0x4209c7
xor eax, eax
and eax, eax
je 0x420a18
call fcn.004bd7c4
push 0
call fcn.004bda93
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
add ebx, 0xfffffebe
mov dword [0xf81430], ebx
push 0
call fcn.004bdab6
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
add ebx, 0xffffff2b
mov dword [0xf81434], ebx
push 0
call fcn.004b8af1
and eax, eax
je 0x420a2a
xor eax, eax
jmp 0x420a2f
mov eax, 1
and eax, eax
je 0x420ede
push 0x1aa
push 0x284
push dword [0xf81434]
push dword [0xf81430]
call fcn.00441a41
push dword [0xf815cc]
call fcn.004c78ad
cdq
push edx
push eax
push 8
call fcn.004b031c
push dword [0xf812b0]
call fcn.004c78ad
cdq
push edx
push eax
push 0xa
call fcn.004b031c
push dword [0xf81464]
call fcn.004c78ad
cdq
push edx
push eax
push 9
call fcn.004b031c
push dword [0xf8136c]
call fcn.004c78ad
cdq
push edx
push eax
push 0xb
call fcn.004b031c
push 0
lea eax, [0x415a48]
push eax
call fcn.004b95d7
push 0x7d0
push 0x309
push 0
call fcn.004b963d
push 0xea60
push 0x30a
push 0
call fcn.004b963d
push 1
push 0x3c
call fcn.004b02dd
push 1
push 0x3d
call fcn.004b02dd
push 0
push 0x41
call fcn.004b02dd
push dword [0xf814c0]
mov edx, 0x5e92f8
pop ecx
call fcn.0044f3d0
je 0x420b79
mov eax, 0x5ed84a
push eax
push 0x4c
call fcn.004b253c
mov eax, 0x5f5bfc
push eax
push 0x4c
call fcn.004b32a4
mov ebx, dword [0xf814cc]
and ebx, ebx
jne 0x420b67
push dword [0xf8133c]
push 0x51
call fcn.004b32a4
jmp 0x420b77
push dword [0xf8158c]
push 0x51
call fcn.004b32a4
jmp 0x420b89
mov eax, str.Windows_10_or_11_only____
push eax
push 0x4c
call fcn.004b32a4
push dword [0xf813f0]
push 0x35
call fcn.004b32a4
push 0
call fcn.004b8c12
push dword [0xf81470]
push 0
call fcn.004b8ac8
call fcn.00438de2
push 0
push 1
push 0x4f
call fcn.004b031c
push 0x4d
call fcn.0043f1a8
push 0
push 0
push 0x4d
call fcn.004b031c
push dword [0xf8128c]
push 0xffffffff
push 0x4e
call fcn.004b2473
push dword [0xf81368]
push 0xffffffff
push 0x4e
call fcn.004b2473
push dword [0xf812c0]
push 0xffffffff
push 0x4e
call fcn.004b2473
push 0
push 1
push 0x4e
call fcn.004b031c
push 1
mov eax, 0x5e7892
push eax
call fcn.0043dd1a
mov eax, 0x5f3cf6
push eax
push 0xffffffff
push 0x45
call fcn.004b2473
mov eax, 0x5f0ffa
push eax
push 0xffffffff
push 0x45
call fcn.004b2473
mov eax, 0x5f64be
push eax
push 0xffffffff
push 0x45
call fcn.004b2473
push 0
push 0
push 0x45
call fcn.004b031c
push dword [0xf813bc]
push 0xffffffff
push 0x48
call fcn.004b2473
push dword [0xf812ec]
push 0xffffffff
push 0x48
call fcn.004b2473
push 0
push 0
push 0x48
call fcn.004b031c
mov edx, 0x5e7892
lea ecx, [0xf812d8]
call fcn.0044f008
push 0x3f
call fcn.0043f1a8
push dword [0xf8137c]
push 0xffffffff
push 0x3f
call fcn.004b2473
push 0
push 1
push 0x3f
call fcn.004b031c
call fcn.00447736
push 0x47
call fcn.004b2425
mov dword [esp + 4], 0
jmp 0x420d3a
push dword [0xf8169c]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x420d82
mov edx, dword [0xf816a0]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf8169c]
push dword [ebp]
push 0xffffffff
push 0x47
call fcn.004b2473
inc dword [esp + 4]
jno 0x420d3a
push 2
push 0
push 0x47
call fcn.004b0456
push 0x5a
call fcn.004b2425
call fcn.0043f942
push 0x260
push 0x2bc
push 0
push 0
call fcn.00412eb6
push dword [0xf81524]
lea eax, [0x4166bd]
push eax
call fcn.004b95d7
push dword [0xf8155c]
call fcn.004c78ad
push eax
push 0
push 0x4d
call fcn.004b3451
push dword [0xf8155c]
call fcn.004c78ad
push eax
push 1
push 0x4d
call fcn.004b3451
push dword [0xf8155c]
call fcn.004c78ad
push eax
push 2
push 0x4d
call fcn.004b3451
push dword [0xf8155c]
call fcn.004c78ad
push eax
push 3
push 0x4d
call fcn.004b3451
push dword [0xf8155c]
call fcn.004c78ad
push eax
push 4
push 0x4d
call fcn.004b3451
push dword [0xf8155c]
call fcn.004c78ad
push eax
push 5
push 0x4d
call fcn.004b3451
push dword [0xf8155c]
call fcn.004c78ad
push eax
push 6
push 0x4d
call fcn.004b3451
push dword [0xf8155c]
call fcn.004c78ad
push eax
push 7
push 0x4d
call fcn.004b3451
push dword [0xf8155c]
call fcn.004c78ad
push eax
push 8
push 0x4d
call fcn.004b3451
push dword [0xf8155c]
call fcn.004c78ad
push eax
push 9
push 0x4d
call fcn.004b3451
call fcn.004b884b
mov ebx, eax
cmp ebx, 0x6e
jl 0x420efb
push 0
push 0x4c
call fcn.004b2448
jmp 0x420f0a
push 1
push 0x4c
call fcn.004b2448
push 0x36
call fcn.004b347f
push 0x4b
call fcn.004b347f
push 0x35
call fcn.004b347f
push 0x27
call fcn.004b347f
push 0x34
call fcn.004b347f
push 0x37
call fcn.004b347f
push 0xffff0001
push 0xffff0001
push 0xffff0001
push 0x64
push 0x2e
call fcn.004b35d8
push 0
push 0x28
call fcn.004b02dd
push 0x42
call fcn.004b347f
mov ebx, dword [0xf814cc]
and ebx, ebx
jle 0x421aae
push 0
push 0x40
push 0
call fcn.004c5706
push eax
push 1
push 0x59
call fcn.004b238a
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4c3e
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed434
push edx
call fcn.004cea70
call fcn.004ceb30
push 0
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x4216a0
push 0
call fcn.004baf70
and eax, eax
je 0x421696
push 0
call fcn.004badeb
mov ebx, eax
cmp ebx, 2
jne 0x421691
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5ec7ca
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004cc840
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jg 0x4210a8
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5eb390
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004cc840
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jg 0x4210a8
jmp 0x4210af
mov eax, 1
jmp 0x4210b1
xor eax, eax
and eax, eax
je 0x421691
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5ec7ca
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004cc840
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jle 0x4211a6
push 0
push 1
push 0x4e
call fcn.004b031c
mov edx, 0x5e7892
lea ecx, [0xf812d8]
call fcn.0044f008
push dword [0xf81470]
push 0
call fcn.004b8ac8
push 0x47
call fcn.004b2425
mov dword [esp + 4], 0
jmp 0x421145
push dword [0xf8169c]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x42118d
mov edx, dword [0xf816a0]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf8169c]
push dword [ebp]
push 0xffffffff
push 0x47
call fcn.004b2473
inc dword [esp + 4]
jno 0x421145
push 2
push 0
push 0x47
call fcn.004b0456
jmp 0x42124a
push 0
push 0
push 0x4e
call fcn.004b031c
mov edx, 0x5e7860
lea ecx, [0xf812d8]
call fcn.0044f008
push dword [0xf81470]
push 0
call fcn.004b8ac8
push 0x47
call fcn.004b2425
mov dword [esp + 4], 0
jmp 0x4211ee
push dword [0xf81690]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x421236
mov edx, dword [0xf81694]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81690]
push dword [ebp]
push 0xffffffff
push 0x47
call fcn.004b2473
inc dword [esp + 4]
jno 0x4211ee
push 2
push 0
push 0x47
call fcn.004b0456
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
lea eax, [esp + 0x14]
push eax
call fcn.004ceac0
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eeb88
push edx
call fcn.004cea70
mov edx, dword [esp + 0x18]
push edx
call fcn.004cea70
mov edx, str._stream.x64.x_none.dat
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4212ce
jl 0x4212ca
cmp ebx, 0
ja 0x4212ce
xor eax, eax
jmp 0x4212d3
mov eax, 1
or eax, eax
je 0x421347
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eeb88
push edx
call fcn.004cea70
mov edx, dword [esp + 0x18]
push edx
call fcn.004cea70
mov edx, str._stream.x86.x_none.dat
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x421337
jl 0x421333
cmp ebx, 0
ja 0x421337
xor eax, eax
jmp 0x42133c
mov eax, 1
or eax, eax
je 0x421347
mov eax, 1
jmp 0x421349
xor eax, eax
and eax, eax
je 0x42135c
mov dword [0xf815b0], 0
jmp 0x421450
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eeb88
push edx
call fcn.004cea70
mov edx, dword [esp + 0x18]
push edx
call fcn.004cea70
mov edx, str._stream.x64.x_none.dat
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x4213bc
jg 0x4213b8
cmp ebx, 0x64
jb 0x4213bc
xor eax, eax
jmp 0x4213c1
mov eax, 1
or eax, eax
je 0x4213d1
mov dword [0xf815b0], 0x56
jmp 0x421450
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eeb88
push edx
call fcn.004cea70
mov edx, dword [esp + 0x18]
push edx
call fcn.004cea70
mov edx, str._stream.x86.x_none.dat
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x421431
jg 0x42142d
cmp ebx, 0x64
jb 0x421431
xor eax, eax
jmp 0x421436
mov eax, 1
or eax, eax
je 0x421446
mov dword [0xf815b0], 0x40
jmp 0x421450
mov dword [0xf815b0], 0
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4c3e
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eeb88
push edx
call fcn.004cea70
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
pop eax
call fcn.004ceb30
push 1
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x421691
push 1
call fcn.004baf70
and eax, eax
je 0x421687
push 1
call fcn.004badeb
mov ebx, eax
cmp ebx, 1
jne 0x421682
push dword [0xf812d8]
mov edx, 0x5e7892
pop ecx
call fcn.0044f3d0
je 0x4215c0
mov dword [esp + 4], 0
jmp 0x421503
push dword [0xf8169c]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x4215bb
push edx
call fcn.004cea40
pop edx
push eax
push 1
push 1
mov edx, dword [0xf816a0]
imul edx, dword [esp + 0x10]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf8169c]
push dword [ebp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 1
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004cc7a0
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jle 0x4215b1
mov edx, dword [0xf816a0]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf8169c]
mov edx, 0x5e7216
lea ecx, [ebp]
call fcn.0044f008
mov dword [0xf81460], 1
inc dword [esp + 4]
jno 0x421503
jmp 0x421682
mov dword [esp + 4], 0
jmp 0x4215ca
push dword [0xf81690]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x421682
push edx
call fcn.004cea40
pop edx
push eax
push 1
push 1
mov edx, dword [0xf81694]
imul edx, dword [esp + 0x10]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81690]
push dword [ebp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 1
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004cc7a0
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jle 0x421678
mov edx, dword [0xf81694]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81690]
mov edx, 0x5e7216
lea ecx, [ebp]
call fcn.0044f008
mov dword [0xf81460], 1
inc dword [esp + 4]
jno 0x4215ca
jmp 0x4214bb
push 1
call fcn.004baf3e
jmp 0x420fff
push 0
call fcn.004baf3e
mov ebx, dword [0xf81460]
and ebx, ebx
jne 0x421976
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4c3e
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed434
push edx
call fcn.004cea70
call fcn.004ceb30
push 0
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x421941
push 0
call fcn.004baf70
and eax, eax
je 0x421937
push 0
call fcn.004badeb
mov ebx, eax
cmp ebx, 2
jne 0x421932
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5ec7ca
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004cc840
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jle 0x421932
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4c3e
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eeb88
push edx
call fcn.004cea70
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
pop eax
call fcn.004ceb30
push 1
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x421932
push 1
call fcn.004baf70
and eax, eax
je 0x421928
push 1
call fcn.004badeb
mov ebx, eax
cmp ebx, 1
jne 0x421923
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 1
call fcn.004bad68
lea eax, [esp + 0x18]
push eax
call fcn.004ceac0
push 1
mov eax, str.stream.x64.x
push eax
push dword [esp + 0x1c]
call fcn.004cc720
mov ebx, eax
and ebx, ebx
jg 0x421855
push 1
mov eax, str.stream.x86.x
push eax
push dword [esp + 0x1c]
call fcn.004cc720
mov ebx, eax
and ebx, ebx
jg 0x421855
jmp 0x42185c
mov eax, 1
jmp 0x42185e
xor eax, eax
and eax, eax
je 0x421867
jmp 0x421923
push 1
mov eax, str.stream.x64.
push eax
push dword [esp + 0x1c]
call fcn.004cc720
mov ebx, eax
and ebx, ebx
jg 0x42189d
push 1
mov eax, str.stream.x86.
push eax
push dword [esp + 0x1c]
call fcn.004cc720
mov ebx, eax
and ebx, ebx
jg 0x42189d
jmp 0x4218a4
mov eax, 1
jmp 0x4218a6
xor eax, eax
and eax, eax
je 0x421923
push 1
mov eax, 0x5ebf64
push eax
push dword [esp + 0x1c]
call fcn.004cc720
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
and ebx, ebx
jle 0x421903
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push dword [esp + 0x1c]
call fcn.004cc6f0
mov ebx, eax
add ebx, 0xfffffff1
push ebx
push 0xc
push dword [esp + 0x24]
call fcn.004cc880
lea eax, [0xf81384]
push eax
call fcn.004ceac0
push 1
call fcn.004baf3e
push 0
call fcn.004baf3e
mov dword [0xf81460], 1
jmp 0x421941
jmp 0x4217d4
push 1
call fcn.004baf3e
jmp 0x4216fe
push 0
call fcn.004baf3e
mov dword [esp + 0x1c], 0x10
push dword [0xf81384]
mov edx, 0x5e60ba
pop ecx
call fcn.0044f3d0
jne 0x421971
push dword [0xf81384]
push 0xffffffff
push 0x5a
call fcn.004b2473
jmp 0x421a95
push 0x5a
call fcn.004b2425
push dword [0xf812d8]
mov edx, 0x5e7892
pop ecx
call fcn.0044f3d0
je 0x421a17
mov dword [esp + 4], 0
jmp 0x4219a1
push dword [0xf8169c]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x421a15
mov edx, dword [0xf816a0]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf8169c]
push dword [ebp]
mov edx, 0x5e7216
pop ecx
call fcn.0044f3d0
je 0x421a0f
mov edx, dword [0xf816a0]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf8169c]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.004b2473
inc dword [esp + 4]
jno 0x4219a1
jmp 0x421a95
mov dword [esp + 4], 0
jmp 0x421a21
push dword [0xf81690]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x421a95
mov edx, dword [0xf81694]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81690]
push dword [ebp]
mov edx, 0x5e7216
pop ecx
call fcn.0044f3d0
je 0x421a8f
mov edx, dword [0xf81694]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81690]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.004b2473
inc dword [esp + 4]
jno 0x421a21
push 0
push 0
push 0x26
call fcn.004b031c
jmp 0x421b9f
mov dword [0xf815b0], 0
push 0
push 0
push pe_nt_image_headers32
call fcn.004c5706
push eax
push 1
push 0x59
call fcn.004b238a
push 0x5a
call fcn.004b2425
push dword [0xf812d8]
mov edx, 0x5e7892
pop ecx
call fcn.0044f3d0
je 0x421b4d
mov dword [esp + 4], 0
jmp 0x421b03
push dword [0xf8169c]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x421b4b
mov edx, dword [0xf816a0]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf8169c]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.004b2473
inc dword [esp + 4]
jno 0x421b03
jmp 0x421b9f
mov dword [esp + 4], 0
jmp 0x421b57
push dword [0xf81690]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x421b9f
mov edx, dword [0xf81694]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81690]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.004b2473
inc dword [esp + 4]
jno 0x421b57
mov ebx, dword [0xf815b0]
cmp ebx, 0x56
jne 0x421bc0
push 0
push 1
push 0x4f
call fcn.004b031c
jmp 0x421beb
mov ebx, dword [0xf815b0]
cmp ebx, 0x40
jne 0x421be1
push 0
push 1
push 0x50
call fcn.004b031c
jmp 0x421beb
mov dword [0xf815b0], 0
mov ebx, dword [0xf814cc]
and ebx, ebx
jle 0x421c15
push 0
call fcn.004b8af1
and eax, eax
je 0x421c13
push dword [0xf812e4]
push 0x51
call fcn.004b253c
jmp 0x421c33
push 0
call fcn.004b8af1
and eax, eax
je 0x421c33
push dword [0xf815a4]
push 0x51
call fcn.004b253c
push dword [0xf81420]
mov edx, 0x5e60ba
pop ecx
call fcn.0044f3d0
jne 0x421d5f
push dword [0xf81420]
call fcn.004cc6f0
mov ebx, eax
cmp ebx, 0x1e
jle 0x421cfa
mov dword [esp + 0x20], 1
jmp 0x421c6a
mov eax, 0x5e7fa0
push eax
push dword [0xf81420]
call fcn.004ccf40
cmp eax, dword [esp + 0x20]
jl 0x421cb6
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5e7fa0
push eax
push dword [esp + 0x2c]
push dword [0xf81420]
call fcn.004cd090
lea eax, [esp + 0x28]
push eax
call fcn.004ceac0
inc dword [esp + 0x20]
jno 0x421c6a
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
mov edx, str.Office_Folder:
push edx
call fcn.004cea70
mov edx, dword [esp + 0x2c]
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x55
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004b253c
call fcn.0044f440
jmp 0x421d5d
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
mov edx, str.Office_Path:
push edx
call fcn.004cea70
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push dword [0xf81420]
call fcn.004cc6f0
mov ebx, eax
dec ebx
push ebx
push dword [0xf81420]
call fcn.004ccff0
pop eax
call fcn.004ceb30
push 0x55
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004b253c
call fcn.0044f440
jmp 0x421d6f
mov eax, 0x5e60ba
push eax
push 0x55
call fcn.004b253c
xor eax, eax
push dword [esp]
call fcn.004cebc0
push dword [esp + 0xc]
call fcn.004cebc0
push dword [esp + 8]
call fcn.004cebc0
push dword [esp + 0x10]
call fcn.004cebc0
push dword [esp + 0x14]
call fcn.004cebc0
push dword [esp + 0x24]
call fcn.004cebc0
add esp, 0x28
pop edi
pop ebx
pop ebp
ret 4