Function at 0x445aa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ffb2e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x438
push esi
push edi
xor edi, edi
mov dword [ebp - 0x100], edi
mov dword [ebp - 4], edi
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
mov dword [ebp - 0x164], edi
cmovae ecx, dword [ebp + 8]
call fcn.0040b940
cmp byte [0x53c100], 2
jne 0x446fc1
lea eax, [ebp - 0x12c]
mov ecx, 0x53c100
push eax
call fcn.0045d580
mov edx, ecx
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x110], edi
mov dword [ebp - 0x11c], edx
movzx eax, byte [edx]
mov ecx, eax
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x110], connect
sub ecx, 1
je 0x445b6c
sub ecx, 1
je 0x445b5e
mov dword [ebp - 0x110], connect
sub eax, 1
je 0x445b6c
sub eax, 1
je 0x445b5e
mov dword [ebp - 0x110], 1
jmp 0x445b77
mov eax, dword [edx + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x114], eax
jmp 0x445b77
mov eax, dword [edx + 8]
mov eax, dword [eax]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x12c]
call fcn.0045d000
test al, al
je 0x446fc1
lea ecx, [ebp - 0x12c]
call fcn.0045d110
movaps xmm0, xmmword [0x526f40]
mov esi, eax
movups xmmword [ebp - 0x154], xmm0
xor ecx, ecx
nop
movzx eax, byte [ebp + ecx - 0x154]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0x154], al
inc ecx
cmp ecx, 0xf
jb 0x445bb0
lea eax, [ebp - 0x154]
mov ecx, esi
push eax
call fcn.00464510
lea ecx, [ebp - 0x340]
push ecx
mov ecx, eax
call fcn.00464650
mov byte [ebp - 4], 1
xor ecx, ecx
mov dword [ebp - 0xc3], 0xbab3aaad
mov dword [ebp - 0xbf], 0xb3b6b980
mov word [ebp - 0xbb], 0xacba
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp + ecx - 0xc3]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0xc3], al
inc ecx
cmp ecx, 0xa
jb 0x445c11
lea eax, [ebp - 0xc3]
mov ecx, esi
push eax
call fcn.00464510
lea ecx, [ebp - 0x328]
push ecx
mov ecx, eax
call fcn.00464650
mov byte [ebp - 4], 2
xor ecx, ecx
mov dword [ebp - 0xed], 0xbab3aaad
mov dword [ebp - 0xe9], 0xb3b0b980
mov dword [ebp - 0xe5], 0xadbabb
nop dword [eax]
movzx eax, byte [ebp + ecx - 0xed]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0xed], al
inc ecx
cmp ecx, 0xb
jb 0x445c70
lea eax, [ebp - 0xed]
mov ecx, esi
push eax
call fcn.00464510
lea ecx, [ebp - 0x84]
push ecx
mov ecx, eax
call fcn.00464650
mov byte [ebp - 4], 3
xor ecx, ecx
mov dword [ebp - 0xfa], 0xbab3aaad
mov dword [ebp - 0xf6], 0xa5b6ac80
mov dword [ebp - 0xf2], 0xbdb480ba
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp + ecx - 0xfa]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0xfa], al
inc ecx
cmp ecx, 0xc
jb 0x445cd2
lea eax, [ebp - 0xfa]
mov ecx, esi
push eax
call fcn.00464510
mov byte [ebp - 4], 4
xorps xmm0, xmm0
movups xmmword [ebp - 0x144], xmm0
mov dword [ebp - 0x134], 0
lea edx, [ebp - 0x144]
mov dword [ebp - 0x130], 0
or edi, 2
mov ecx, eax
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0xf
mov byte [ebp - 0x144], 0
mov dword [ebp - 0x100], edi
call fcn.00475910
cmp dword [ebp - 0x130], 0x10
lea eax, [ebp - 0x144]
cmovae eax, dword [ebp - 0x144]
push eax
call fcn.004deaf8
and edi, 0xfffffffd
mov dword [ebp - 0x160], eax
add esp, 4
mov dword [ebp - 0x100], edi
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x130]
cmp ecx, 0x10
jb 0x445db8
mov edx, dword [ebp - 0x144]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x445dae
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446fe0
push ecx
push edx
call fcn.004bafb1
add esp, 8
movaps xmm0, xmmword [0x527c70]
xor ecx, ecx
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0xf
mov byte [ebp - 0x144], 0
movups xmmword [ebp - 0x159], xmm0
mov dword [ebp - 0x149], 0xa9acadaa
mov byte [ebp - 0x145], 0
nop dword [eax]
nop dword [eax + eax]
movzx eax, byte [ebp + ecx - 0x159]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0x159], al
inc ecx
cmp ecx, 0x14
jb 0x445e00
lea eax, [ebp - 0x159]
mov ecx, esi
push eax
call fcn.00464510
lea edx, [ebp - 0x14]
mov ecx, eax
call fcn.004759a0
push 0xffffffffffffffe5
mov byte [ebp - 0x15], 0
call fcn.00461130
sub esp, 0x18
mov byte [ebp - 0x16], al
mov edx, esp
mov dword [ebp - 0x228], esp
xorps xmm0, xmm0
lea ecx, [ebp - 0x16]
lea esi, [ecx + 1]
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445e66
sub ecx, esi
lea eax, [ebp - 0x16]
push ecx
push eax
mov ecx, edx
call fcn.00402aa0
mov byte [ebp - 4], 5
sub esp, 0x18
lea eax, [ebp - 0x340]
mov dword [ebp - 0x224], esp
mov ecx, esp
push eax
call fcn.0045fe50
mov byte [ebp - 4], 6
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x234]
call fcn.0040bd90
add esp, 0x30
mov byte [ebp - 4], 7
xor ecx, ecx
mov word [ebp - 0x13], 0xfff3
mov byte [ebp - 0x11], 0
nop dword [eax]
movzx eax, byte [ebp + ecx - 0x13]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 2
jb 0x445ec0
sub esp, 0x18
lea ecx, [ebp - 0x13]
mov edx, esp
mov dword [ebp - 0x220], esp
xorps xmm0, xmm0
lea esi, [ecx + 1]
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445f00
sub ecx, esi
lea eax, [ebp - 0x13]
push ecx
push eax
mov ecx, edx
call fcn.00402aa0
mov byte [ebp - 4], 8
sub esp, 0x18
lea eax, [ebp - 0x328]
mov dword [ebp - 0x21c], esp
mov ecx, esp
push eax
call fcn.0045fe50
mov byte [ebp - 4], 9
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x10c]
call fcn.0040bd90
add esp, 0x30
mov byte [ebp - 4], 0xa
xor ecx, ecx
mov dword [ebp - 0x4c], 0x8c9a9bfa
mov dword [ebp - 0x48], 0x8f908b94
mov word [ebp - 0x44], 0xfa
movzx eax, byte [ebp + ecx - 0x4c]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0x4c], al
inc ecx
cmp ecx, 9
jb 0x445f60
lea edx, [ebp - 0x4c]
lea ecx, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x445f80
mov edi, dword [ebp - 0x70]
lea eax, [ebp - 0x4c]
mov esi, dword [ebp - 0x84]
sub edx, ecx
push edx
mov edx, dword [ebp - 0x74]
lea ecx, [ebp - 0x84]
cmp edi, 0x10
push eax
cmovae ecx, esi
push 0
call fcn.00465860
add esp, 0xc
test eax, eax
jne 0x4460ef
push 0x104
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.004d31f0
add esp, 0xc
lea eax, [ebp - 0x444]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
mov dword [ebp - 0x258], 0
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x254], 0
movups xmmword [ebp - 0x268], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446010
sub ecx, edx
lea eax, [ebp - 0x444]
push ecx
push eax
lea ecx, [ebp - 0x268]
call fcn.00402aa0
mov byte [ebp - 4], 0xb
xor ecx, ecx
mov dword [ebp - 0x56], 0x8c9a9bfa
mov dword [ebp - 0x52], 0x8f908b94
mov word [ebp - 0x4e], 0xfa
nop word [eax + eax]
movzx eax, byte [ebp + ecx - 0x56]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0x56], al
inc ecx
cmp ecx, 9
jb 0x446050
xorps xmm0, xmm0
mov dword [ebp - 0x240], 0
lea ecx, [ebp - 0x56]
mov dword [ebp - 0x23c], 0
movups xmmword [ebp - 0x250], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446090
sub ecx, edx
lea eax, [ebp - 0x56]
push ecx
push eax
lea ecx, [ebp - 0x250]
call fcn.00402aa0
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x268]
push eax
lea edx, [ebp - 0x250]
lea ecx, [ebp - 0x84]
call fcn.004083c0
add esp, 4
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x250]
call fcn.00402890
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x268]
call fcn.00402890
mov edi, dword [ebp - 0x70]
mov esi, dword [ebp - 0x84]
mov dword [ebp - 0x90], 0x9c909bfa
xor ecx, ecx
mov dword [ebp - 0x8c], 0x919a928a
mov dword [ebp - 0x88], 0xfa8c8b
nop
movzx eax, byte [ebp + ecx - 0x90]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0x90], al
inc ecx
cmp ecx, 0xb
jb 0x446110
lea edx, [ebp - 0x90]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x446134
sub edx, ecx
lea eax, [ebp - 0x90]
push edx
mov edx, dword [ebp - 0x74]
lea ecx, [ebp - 0x84]
cmp edi, 0x10
push eax
cmovae ecx, esi
push 0
call fcn.00465860
add esp, 0xc
test eax, eax
jne 0x4462a4
push 0x104
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.004d31f0
add esp, 0xc
lea eax, [ebp - 0x444]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
mov dword [ebp - 0x288], 0
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x284], 0
movups xmmword [ebp - 0x298], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4461b7
sub ecx, edx
lea eax, [ebp - 0x444]
push ecx
push eax
lea ecx, [ebp - 0x298]
call fcn.00402aa0
mov byte [ebp - 4], 0xd
xor ecx, ecx
mov dword [ebp - 0x9c], 0x9c909bfa
mov dword [ebp - 0x98], 0x919a928a
mov dword [ebp - 0x94], 0xfa8c8b
nop word [eax + eax]
movzx eax, byte [ebp + ecx - 0x9c]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0x9c], al
inc ecx
cmp ecx, 0xb
jb 0x446200
xorps xmm0, xmm0
mov dword [ebp - 0x270], 0
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x26c], 0
movups xmmword [ebp - 0x280], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446242
sub ecx, edx
lea eax, [ebp - 0x9c]
push ecx
push eax
lea ecx, [ebp - 0x280]
call fcn.00402aa0
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x298]
push eax
lea edx, [ebp - 0x280]
lea ecx, [ebp - 0x84]
call fcn.004083c0
add esp, 4
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x280]
call fcn.00402890
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x298]
call fcn.00402890
mov edi, dword [ebp - 0x70]
mov esi, dword [ebp - 0x84]
mov dword [ebp - 0xb8], 0x9a8c8afa
xor ecx, ecx
mov dword [ebp - 0xb4], 0x908d8f8d
mov dword [ebp - 0xb0], 0x9a939699
mov word [ebp - 0xac], 0xfa
nop dword [eax]
movzx eax, byte [ebp + ecx - 0xb8]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0xb8], al
inc ecx
cmp ecx, 0xd
jb 0x4462d0
lea edx, [ebp - 0xb8]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4462f4
sub edx, ecx
lea eax, [ebp - 0xb8]
push edx
mov edx, dword [ebp - 0x74]
lea ecx, [ebp - 0x84]
cmp edi, 0x10
push eax
cmovae ecx, esi
push 0
call fcn.00465860
add esp, 0xc
test eax, eax
jne 0x4464f8
push 0x104
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.004d31f0
add esp, 0xc
lea eax, [ebp - 0x444]
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
mov dword [ebp - 0x184], 0
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x180], 0
movups xmmword [ebp - 0x194], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446377
sub ecx, edx
lea eax, [ebp - 0x444]
push ecx
push eax
lea ecx, [ebp - 0x194]
call fcn.00402aa0
mov byte [ebp - 4], 0xf
xor ecx, ecx
mov dword [ebp - 0xaa], 0x9a8c8afa
mov dword [ebp - 0xa6], 0x908d8f8d
mov dword [ebp - 0xa2], 0x9a939699
mov word [ebp - 0x9e], 0xfa
movzx eax, byte [ebp + ecx - 0xaa]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0xaa], al
inc ecx
cmp ecx, 0xd
jb 0x4463c0
xorps xmm0, xmm0
mov dword [ebp - 0x16c], 0
lea ecx, [ebp - 0xaa]
mov dword [ebp - 0x168], 0
movups xmmword [ebp - 0x17c], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446402
sub ecx, edx
lea eax, [ebp - 0xaa]
push ecx
push eax
lea ecx, [ebp - 0x17c]
call fcn.00402aa0
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x194]
push eax
lea edx, [ebp - 0x17c]
lea ecx, [ebp - 0x84]
call fcn.004083c0
add esp, 4
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x168]
cmp ecx, 0x10
jb 0x44647b
mov edx, dword [ebp - 0x17c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x446471
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446fe0
push ecx
push edx
call fcn.004bafb1
add esp, 8
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x168], 0xf
mov byte [ebp - 0x17c], 0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x180]
cmp ecx, 0x10
jb 0x4464d4
mov edx, dword [ebp - 0x194]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4464ca
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446fe0
push ecx
push edx
call fcn.004bafb1
add esp, 8
mov edi, dword [ebp - 0x70]
mov esi, dword [ebp - 0x84]
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x180], 0xf
mov byte [ebp - 0x194], 0
mov dword [ebp - 0x60], 0x8f8f9efa
xor ecx, ecx
mov dword [ebp - 0x5c], 0x9e8b9e9b
mov word [ebp - 0x58], 0xfa
nop
movzx eax, byte [ebp + ecx - 0x60]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0x60], al
inc ecx
cmp ecx, 9
jb 0x446510
lea edx, [ebp - 0x60]
lea ecx, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x446530
sub edx, ecx
lea eax, [ebp - 0x60]
push edx
mov edx, dword [ebp - 0x74]
lea ecx, [ebp - 0x84]
cmp edi, 0x10
push eax
cmovae ecx, esi
push 0
call fcn.00465860
add esp, 0xc
test eax, eax
jne 0x4466d9
push 0x104
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.004d31f0
add esp, 0xc
lea eax, [ebp - 0x444]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
mov dword [ebp - 0x2a0], 0
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x29c], 0
movups xmmword [ebp - 0x2b0], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4465b0
sub ecx, edx
lea eax, [ebp - 0x444]
push ecx
push eax
lea ecx, [ebp - 0x2b0]
call fcn.00402aa0
mov byte [ebp - 4], 0x11
xor ecx, ecx
mov dword [ebp - 0x6a], 0x8f8f9efa
mov dword [ebp - 0x66], 0x9e8b9e9b
mov word [ebp - 0x62], 0xfa
nop word [eax + eax]
movzx eax, byte [ebp + ecx - 0x6a]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0x6a], al
inc ecx
cmp ecx, 9
jb 0x4465f0
xorps xmm0, xmm0
mov dword [ebp - 0x19c], 0
lea ecx, [ebp - 0x6a]
mov dword [ebp - 0x198], 0
movups xmmword [ebp - 0x1ac], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446630
sub ecx, edx
lea eax, [ebp - 0x6a]
push ecx
push eax
lea ecx, [ebp - 0x1ac]
call fcn.00402aa0
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x2b0]
push eax
lea edx, [ebp - 0x1ac]
lea ecx, [ebp - 0x84]
call fcn.004083c0
add esp, 4
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x198]
cmp ecx, 0x10
jb 0x4466a6
mov edx, dword [ebp - 0x1ac]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44669c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446fe0
push ecx
push edx
call fcn.004bafb1
add esp, 8
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x198], 0xf
mov byte [ebp - 0x1ac], 0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2b0]
call fcn.00402890
mov edi, dword [ebp - 0x70]
mov esi, dword [ebp - 0x84]
mov dword [ebp - 0xe1], 0x9c9093fa
xor ecx, ecx
mov dword [ebp - 0xdd], 0x8f9e939e
mov dword [ebp - 0xd9], 0x8b9e9b8f
mov word [ebp - 0xd5], 0xfa9e
mov byte [ebp - 0xd3], 0
nop dword [eax]
movzx eax, byte [ebp + ecx - 0xe1]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0xe1], al
inc ecx
cmp ecx, 0xe
jb 0x446710
lea edx, [ebp - 0xe1]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x446734
sub edx, ecx
lea eax, [ebp - 0xe1]
push edx
mov edx, dword [ebp - 0x74]
lea ecx, [ebp - 0x84]
cmp edi, 0x10
push eax
cmovae ecx, esi
push 0
call fcn.00465860
add esp, 0xc
test eax, eax
jne 0x4468ae
push 0x104
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.004d31f0
add esp, 0xc
lea eax, [ebp - 0x444]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
mov dword [ebp - 0x2d0], 0
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x2cc], 0
movups xmmword [ebp - 0x2e0], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4467b7
sub ecx, edx
lea eax, [ebp - 0x444]
push ecx
push eax
lea ecx, [ebp - 0x2e0]
call fcn.00402aa0
mov byte [ebp - 4], 0x13
xor ecx, ecx
mov dword [ebp - 0xd2], 0x9c9093fa
mov dword [ebp - 0xce], 0x8f9e939e
mov dword [ebp - 0xca], 0x8b9e9b8f
mov word [ebp - 0xc6], 0xfa9e
mov byte [ebp - 0xc4], 0
nop word [eax + eax]
movzx eax, byte [ebp + ecx - 0xd2]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0xd2], al
inc ecx
cmp ecx, 0xe
jb 0x446810
xorps xmm0, xmm0
mov dword [ebp - 0x2b8], 0
lea ecx, [ebp - 0xd2]
mov dword [ebp - 0x2b4], 0
movups xmmword [ebp - 0x2c8], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446852
sub ecx, edx
lea eax, [ebp - 0xd2]
push ecx
push eax
lea ecx, [ebp - 0x2c8]
call fcn.00402aa0
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x2e0]
push eax
lea edx, [ebp - 0x2c8]
lea ecx, [ebp - 0x84]
call fcn.004083c0
add esp, 4
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x2c8]
call fcn.00402890
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2e0]
call fcn.00402890
mov edi, dword [ebp - 0x70]
mov dword [ebp - 0x39], 0x9c9a8dfa
xor ecx, ecx
mov dword [ebp - 0x35], 0xfa8b919a
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp + ecx - 0x39]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0x39], al
inc ecx
cmp ecx, 8
jb 0x4468c2
lea esi, [ebp - 0x39]
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4468e0
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 0x39]
sub esi, ecx
cmp edi, 0x10
push esi
push eax
lea ecx, [ebp - 0x84]
cmovae ecx, dword [ebp - 0x84]
push 0
call fcn.00465860
add esp, 0xc
test eax, eax
jne 0x446aca
push 0x104
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.004d31f0
add esp, 0xc
lea eax, [ebp - 0x444]
push eax
push 0
push 0
push 8
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
mov dword [ebp - 0x1cc], 0
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x1c8], 0
movups xmmword [ebp - 0x1dc], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446964
sub ecx, edx
lea eax, [ebp - 0x444]
push ecx
push eax
lea ecx, [ebp - 0x1dc]
call fcn.00402aa0
mov byte [ebp - 4], 0x15
xor ecx, ecx
mov dword [ebp - 0x42], 0x9c9a8dfa
mov dword [ebp - 0x3e], 0xfa8b919a
mov byte [ebp - 0x3a], 0
nop dword [eax + eax]
movzx eax, byte [ebp + ecx - 0x42]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0x42], al
inc ecx
cmp ecx, 8
jb 0x4469a0
xorps xmm0, xmm0
mov dword [ebp - 0x1b4], 0
lea ecx, [ebp - 0x42]
mov dword [ebp - 0x1b0], 0
movups xmmword [ebp - 0x1c4], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4469e0
sub ecx, edx
lea eax, [ebp - 0x42]
push ecx
push eax
lea ecx, [ebp - 0x1c4]
call fcn.00402aa0
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x1dc]
push eax
lea edx, [ebp - 0x1c4]
lea ecx, [ebp - 0x84]
call fcn.004083c0
add esp, 4
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x1b0]
cmp ecx, 0x10
jb 0x446a56
mov edx, dword [ebp - 0x1c4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x446a4c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446fe0
push ecx
push edx
call fcn.004bafb1
add esp, 8
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0x1b0], 0xf
mov byte [ebp - 0x1c4], 0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x1c8]
cmp ecx, 0x10
jb 0x446aaf
mov edx, dword [ebp - 0x1dc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x446aa5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446fe0
push ecx
push edx
call fcn.004bafb1
add esp, 8
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x1c8], 0xf
mov byte [ebp - 0x1dc], 0
mov ecx, dword [ebp - 0x108]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x10c]
sub ecx, esi
imul ecx
mov dword [ebp - 0x30], 0
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x446e8d
xor ecx, ecx
mov dword [ebp - 0x10], ecx
nop dword [eax + eax]
cmp dword [ecx + esi + 0x14], 0x10
lea edi, [ecx + esi]
mov eax, dword [edi + 0x10]
jb 0x446b0f
mov edi, dword [edi]
test eax, eax
je 0x446c40
push eax
push 0x2a
push edi
call fcn.004d49e0
add esp, 0xc
test eax, eax
je 0x446c37
sub eax, edi
cmp eax, 0xffffffff
je 0x446c37
mov dword [ebp - 0x1d], 0xf6f2f1f7
xor ecx, ecx
mov byte [ebp - 0x19], 0
movzx eax, byte [ebp + ecx - 0x1d]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0x1d], al
inc ecx
cmp ecx, 4
jb 0x446b43
xorps xmm0, xmm0
mov dword [ebp - 0x300], 0
lea ecx, [ebp - 0x1d]
mov dword [ebp - 0x2fc], 0
movups xmmword [ebp - 0x310], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446b80
sub ecx, edx
lea eax, [ebp - 0x1d]
push ecx
push eax
lea ecx, [ebp - 0x310]
call fcn.00402aa0
mov byte [ebp - 4], 0x17
push 0xfffffffffffffff5
mov byte [ebp - 0x17], 0
call fcn.00461130
xorps xmm0, xmm0
mov byte [ebp - 0x18], al
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x2e8], 0
movups xmmword [ebp - 0x2f8], xmm0
mov dword [ebp - 0x2e4], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446bd0
sub ecx, edx
lea eax, [ebp - 0x18]
push ecx
push eax
lea ecx, [ebp - 0x2f8]
call fcn.00402aa0
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x310]
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x2f8]
add ecx, dword [ebp - 0x10c]
push eax
call fcn.004083c0
add esp, 4
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x2f8]
call fcn.00402890
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x310]
call fcn.00402890
mov esi, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10]
jmp 0x446b00
mov ecx, dword [ebp - 0x10]
nop word [eax + eax]
lea edi, [ecx + esi]
mov dword [ebp - 0x22], 0xf6f2f1f7
mov byte [ebp - 0x1e], 0
xor ecx, ecx
movzx eax, byte [ebp + ecx - 0x22]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0x22], al
inc ecx
cmp ecx, 4
jb 0x446c50
lea esi, [ebp - 0x22]
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x446c70
mov edx, dword [edi + 0x10]
sub esi, ecx
cmp dword [edi + 0x14], 0x10
jb 0x446c84
mov edi, dword [edi]
push esi
lea eax, [ebp - 0x22]
mov ecx, edi
push eax
push 0
call fcn.00465860
add esp, 0xc
cmp eax, 0xffffffff
je 0x446e58
mov dword [ebp - 0x27], 0xf6f5f1f7
xor ecx, ecx
mov byte [ebp - 0x23], 0
nop dword [eax + eax]
movzx eax, byte [ebp + ecx - 0x27]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 4
jb 0x446cb0
xorps xmm0, xmm0
mov dword [ebp - 0x1fc], 0
lea ecx, [ebp - 0x27]
mov dword [ebp - 0x1f8], 0
movups xmmword [ebp - 0x20c], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446cf0
sub ecx, edx
lea eax, [ebp - 0x27]
push ecx
push eax
lea ecx, [ebp - 0x20c]
call fcn.00402aa0
mov byte [ebp - 4], 0x19
xor ecx, ecx
mov dword [ebp - 0x2c], 0xf6f2f1f7
mov byte [ebp - 0x28], 0
nop word [eax + eax]
movzx eax, byte [ebp + ecx - 0x2c]
push eax
call fcn.00461130
mov byte [ebp + ecx - 0x2c], al
inc ecx
cmp ecx, 4
jb 0x446d20
xorps xmm0, xmm0
mov dword [ebp - 0x1e4], 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1e0], 0
movups xmmword [ebp - 0x1f4], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446d60
sub ecx, edx
lea eax, [ebp - 0x2c]
push ecx
push eax
lea ecx, [ebp - 0x1f4]
call fcn.00402aa0
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x20c]
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x1f4]
add ecx, dword [ebp - 0x10c]
push eax
call fcn.004083c0
add esp, 4
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x1e0]
cmp ecx, 0x10
jb 0x446dd9
mov edx, dword [ebp - 0x1f4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x446dcf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446fe0
push ecx
push edx
call fcn.004bafb1
add esp, 8
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 0xf
mov byte [ebp - 0x1f4], 0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x1f8]
cmp ecx, 0x10
jb 0x446e32
mov edx, dword [ebp - 0x20c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x446e28
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446fe0
push ecx
push edx
call fcn.004bafb1
add esp, 8
mov esi, dword [ebp - 0x10c]
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x1f8], 0xf
mov byte [ebp - 0x20c], 0
jmp 0x446c37
mov ecx, dword [ebp - 0x108]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x10c]
sub ecx, esi
mov edi, dword [ebp - 0x30]
add dword [ebp - 0x10], 0x18
inc edi
imul ecx
mov ecx, dword [ebp - 0x10]
sar edx, 2
mov eax, edx
mov dword [ebp - 0x30], edi
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x446b00
sub esp, 0xc
lea eax, [ebp - 0x10c]
mov ecx, esp
mov dword [ebp - 0x218], esp
push eax
call fcn.0045ed40
mov byte [ebp - 4], 0x1b
sub esp, 0xc
lea eax, [ebp - 0x234]
mov dword [ebp - 0x214], esp
mov ecx, esp
push eax
call fcn.0045ed40
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x164]
mov esi, dword [ebp - 0x160]
push eax
sub esp, 0x18
shl esi, 0xa
lea eax, [ebp + 8]
mov dword [ebp - 0x210], esp
mov ecx, esp
push eax
call fcn.0045fe50
mov byte [ebp - 4], 0x1d
sub esp, 0x18
lea eax, [ebp - 0x84]
mov dword [ebp - 0x238], esp
mov ecx, esp
push eax
call fcn.0045fe50
mov byte [ebp - 4], 0x1e
mov byte [ebp - 4], 0xa
mov edx, esi
mov cl, byte [ebp - 0x14]
call fcn.00444d50
add esp, 0x4c
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x10c]
call fcn.00461d40
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x234]
call fcn.00461d40
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x84]
call fcn.00402890
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x328]
call fcn.00402890
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x340]
call fcn.00402890
mov eax, dword [ebp - 0x12c]
movzx eax, byte [eax]
sub eax, 1
je 0x446f86
sub eax, 1
je 0x446f7d
inc dword [ebp - 0x120]
jmp 0x446fa0
add dword [ebp - 0x124], 0x10
jmp 0x446fa0
mov eax, dword [ebp - 0x128]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], eax
call fcn.00461370
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x12c]
call fcn.0045d000
test al, al
je 0x446fc1
mov edi, dword [ebp - 0x100]
jmp 0x445b91
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402890
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.004d64b0
int3