Function at 0x428a30
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x45a96a
push eax
mov eax, 0x144c
mov dword fs:[0], esp
call fcn.004581d0
push ebx
push ebp
mov ebp, dword [esp + 0x1464]
push esi
push edi
mov eax, dword [ebp]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4298ca
mov ecx, dword [0x4641a0]
mov dword [esp + 0x18], ecx
mov ecx, dword [0x467fb0]
mov eax, dword [0x467fac]
mov edx, dword [str.CLSID:]
mov dword [esp + 0x44], ecx
mov ebx, 6
mov dword [esp + 0x40], eax
mov eax, dword [ebp]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x3c], edx
mov dx, word [0x467fb4]
push ebx
push ecx
push eax
mov dword [esp + 0x1470], 0
mov word [esp + 0x54], dx
call dword [0x45d3b8]
test eax, eax
jne 0x428d0f
mov edx, dword [ebp]
mov ecx, ebp
mov eax, dword [edx - 8]
add eax, 0xfffffffa
push eax
lea eax, [esp + 0x14]
push eax
call fcn.0040c6b0
mov ecx, dword [eax]
lea edx, [esp + 0x254]
push ecx
push str.CLSID_sInprocServer32
push 0x208
push edx
mov byte [esp + 0x1474], 1
call fcn.004298f0
mov eax, dword [esp + 0x20]
mov edx, dword [0x4641a4]
mov edi, dword [0x45d1b0]
add esp, 0x10
lea ecx, [eax - 0xc]
mov byte [esp + 0x1464], 0
cmp ecx, edx
je 0x428b37
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x428b37
mov edx, dword [esp + 0x10]
lea eax, [edx - 0xc]
push eax
call fcn.0044c87a
add esp, 4
mov eax, dword [esp + 0x1470]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x469b0c
call fcn.004171e0
push ecx
lea edx, [esp + 0x260]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x1474], 2
call fcn.004171e0
push 0x80000000
lea ecx, [esp + 0x38]
mov byte [esp + 0x1474], 0
call fcn.00421240
lea ecx, [esp + 0x14]
lea edx, [esp + 0x45c]
push ecx
lea ecx, [esp + 0x14]
push edx
push ecx
push eax
mov byte [esp + 0x1474], 3
mov dword [esp + 0x24], 0x1000
call fcn.00428730
add esp, 0x10
test eax, eax
je 0x428bd7
mov eax, dword [esp + 0x10]
cmp eax, 2
je 0x428bbf
cmp eax, 1
jne 0x428bd7
lea edx, [esp + 0x45c]
lea ecx, [esp + 0x18]
push edx
call fcn.00405430
mov esi, 1
jmp 0x428bd9
xor esi, esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x1464], 0
call fcn.00401c80
lea ecx, [esp + 0x2c]
call fcn.00401c80
test esi, esi
je 0x428cd7
mov eax, dword [esp + 0x18]
push eax
call dword [0x45d3c4]
test eax, eax
je 0x428cd7
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x10]
sub eax, edx
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00419850
mov esi, eax
mov ecx, dword [ebp]
mov eax, dword [esi]
cmp ecx, eax
mov byte [esp + 0x1464], 4
je 0x428c77
mov edx, dword [ecx - 0xc]
test edx, edx
jge 0x428c4c
mov edx, dword [0x4641a4]
add ecx, 0xfffffff4
cmp ecx, edx
jne 0x428c53
mov ecx, dword [eax - 0xc]
test ecx, ecx
jge 0x428c61
mov edx, dword [eax - 8]
push eax
push edx
mov ecx, ebp
call fcn.00408770
jmp 0x428c77
mov ecx, ebp
call fcn.00405b60
mov esi, dword [esi]
mov dword [ebp], esi
add esi, 0xfffffff4
push esi
call dword [0x45d1b4]
mov eax, dword [esp + 0x10]
mov edx, dword [0x4641a4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x428ca2
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x428ca2
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.0044c87a
add esp, 4
mov eax, dword [esp + 0x18]
mov edx, dword [0x4641a4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x428ccd
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x428ccd
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.0044c87a
add esp, 4
mov eax, 1
jmp 0x4298cc
mov eax, dword [esp + 0x18]
mov edx, dword [0x4641a4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4298ca
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x4298ca
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.0044c87a
add esp, 4
jmp 0x4298ca
mov al, byte [0x469fb8]
test al, 1
jne 0x428d42
or al, 1
lea ecx, [esp + 0x26]
mov byte [0x469fb8], al
lea eax, [esp + 0x27]
push eax
push 0
push ecx
mov ecx, 0x469fc0
call fcn.00430680
push 0x429b50
call fcn.0045818c
add esp, 4
mov al, byte [0x469da8]
test al, al
jne 0x429826
lea edx, [esp + 0x254]
push 0x104
push edx
call dword [0x45d0e4]
lea eax, [esp + 0x254]
push eax
call dword [0x45d3b0]
mov ecx, dword [0x4641a0]
mov ebp, dword [0x45d1cc]
mov edx, str.systemroot
mov dword [esp + 0x10], ecx
test edx, edx
je 0x428dd9
mov eax, edx
shr eax, 0x10
jne 0x428da3
xor eax, eax
mov ecx, edx
mov ax, cx
lea ecx, [esp + 0x10]
push eax
call fcn.00405950
jmp 0x428dd9
push str.systemroot
call ebp
mov esi, eax
test esi, esi
je 0x428dd9
push esi
lea ecx, [esp + 0x14]
call fcn.00404720
test eax, eax
je 0x428dd9
mov ecx, dword [esp + 0x10]
lea edx, [esi + esi]
push edx
lea eax, [esi + esi + 2]
push str.systemroot
push eax
push ecx
call fcn.00401bc0
add esp, 0x10
mov edx, dword [0x4641a0]
mov dword [esp + 0x14], edx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x146c], bl
call fcn.00430700
lea edx, [esp + 0x28]
push eax
push edx
mov ecx, 0x469fc0
mov byte [esp + 0x146c], 7
call fcn.00430580
mov esi, dword [eax]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1464], bl
call fcn.00430330
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 5
call fcn.00401c80
lea eax, [esp + 0x254]
add esi, 0x10
test eax, eax
je 0x428e50
lea ecx, [esp + 0x254]
push ecx
call ebp
lea edx, [esp + 0x254]
mov ecx, esi
push edx
push eax
call fcn.00408770
mov eax, dword [esp + 0x10]
mov edx, dword [0x4641a4]
mov byte [esp + 0x1464], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x428e97
add eax, 0xfffffff4
push eax
call dword [0x45d1b0]
test eax, eax
jg 0x428e97
mov edx, dword [esp + 0x10]
lea eax, [edx - 0xc]
push eax
call fcn.0044c87a
add esp, 4
mov ebx, 0x45d948
mov eax, dword [ebx + 4]
push 0
lea ecx, [esp + 0x50]
push eax
push ecx
push 0
call dword [0x45d38c]
test eax, eax
je 0x428fc9
mov esi, dword [ebx]
mov edx, dword [0x4641a0]
test esi, esi
mov dword [esp + 0x10], edx
je 0x428f0e
mov eax, esi
shr eax, 0x10
jne 0x428ee0
and esi, 0xffff
lea ecx, [esp + 0x10]
push esi
call fcn.00405950
jmp 0x428f0e
push esi
call ebp
mov edi, eax
test edi, edi
je 0x428f0e
push edi
lea ecx, [esp + 0x14]
call fcn.00404720
test eax, eax
je 0x428f0e
mov eax, dword [esp + 0x10]
lea ecx, [edi + edi]
push ecx
lea edx, [edi + edi + 2]
push esi
push edx
push eax
call fcn.00401bc0
add esp, 0x10
mov ecx, dword [0x4641a0]
mov dword [esp + 0x14], ecx
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x146c], 9
call fcn.00430700
lea ecx, [esp + 0x28]
push eax
push ecx
mov ecx, 0x469fc0
mov byte [esp + 0x146c], 0xa
call fcn.00430580
mov esi, dword [eax]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1464], 9
call fcn.00430330
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 8
call fcn.00401c80
lea edx, [esp + 0x4c]
add esi, 0x10
test edx, edx
jne 0x428f7e
xor eax, eax
jmp 0x428f85
lea eax, [esp + 0x4c]
push eax
call ebp
lea ecx, [esp + 0x4c]
push ecx
push eax
mov ecx, esi
call fcn.00408770
mov eax, dword [esp + 0x10]
mov ecx, dword [0x4641a4]
mov byte [esp + 0x1464], 0
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x428fc9
add eax, 0xfffffff4
push eax
call dword [0x45d1b0]
test eax, eax
jg 0x428fc9
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.0044c87a
add esp, 4
add ebx, 8
cmp ebx, 0x45da18
jb 0x428e9c
mov eax, dword [0x469d48]
test eax, eax
je 0x42926c
push 0
lea ecx, [esp + 0x50]
push 0x26
push ecx
push 0
call dword [0x45d38c]
test eax, eax
je 0x42926c
lea edx, [esp + 0x4c]
push edx
call dword [0x45d33c]
lea esi, [esp + eax*2 + 0x44]
push str.__x86_
push esi
call dword [0x45d2f8]
add esp, 0xc
test eax, eax
jne 0x42926c
mov word [esi], ax
mov eax, dword [0x4641a0]
mov ecx, str.programfiles_x64_
mov dword [esp + 0x10], eax
test ecx, ecx
je 0x429087
mov edx, ecx
shr edx, 0x10
jne 0x429051
xor eax, eax
mov ax, cx
lea ecx, [esp + 0x10]
push eax
call fcn.00405950
jmp 0x429087
push str.programfiles_x64_
call ebp
mov esi, eax
test esi, esi
je 0x429087
push esi
lea ecx, [esp + 0x14]
call fcn.00404720
test eax, eax
je 0x429087
mov ecx, dword [esp + 0x10]
lea edx, [esi + esi]
push edx
lea eax, [esi + esi + 2]
push str.programfiles_x64_
push eax
push ecx
call fcn.00401bc0
add esp, 0x10
mov edx, dword [0x4641a0]
mov dword [esp + 0x14], edx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
mov bl, 0xc
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x146c], bl
call fcn.00430700
lea edx, [esp + 0x28]
push eax
push edx
mov ecx, 0x469fc0
mov byte [esp + 0x146c], 0xd
call fcn.00430580
mov esi, dword [eax]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1464], bl
call fcn.00430330
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 0xb
call fcn.00401c80
lea eax, [esp + 0x4c]
add esi, 0x10
test eax, eax
je 0x4290fa
lea ecx, [esp + 0x4c]
push ecx
call ebp
lea edx, [esp + 0x4c]
mov ecx, esi
push edx
push eax
call fcn.00408770
mov eax, dword [esp + 0x10]
mov edx, dword [0x4641a4]
mov byte [esp + 0x1464], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x42913e
add eax, 0xfffffff4
push eax
call dword [0x45d1b0]
test eax, eax
jg 0x42913e
mov edx, dword [esp + 0x10]
lea eax, [edx - 0xc]
push eax
call fcn.0044c87a
add esp, 4
push str.Common_Files
lea eax, [esp + 0x50]
push 0x104
push eax
call fcn.00429960
mov ecx, dword [0x4641a0]
mov edx, str.commonfiles_x64_
test edx, edx
mov dword [esp + 0x10], ecx
je 0x4291b5
mov eax, edx
shr eax, 0x10
jne 0x42917f
xor eax, eax
mov ecx, edx
mov ax, cx
lea ecx, [esp + 0x10]
push eax
call fcn.00405950
jmp 0x4291b5
push str.commonfiles_x64_
call ebp
mov esi, eax
test esi, esi
je 0x4291b5
push esi
lea ecx, [esp + 0x14]
call fcn.00404720
test eax, eax
je 0x4291b5
mov ecx, dword [esp + 0x10]
lea edx, [esi + esi]
push edx
lea eax, [esi + esi + 2]
push str.commonfiles_x64_
push eax
push ecx
call fcn.00401bc0
add esp, 0x10
mov edx, dword [0x4641a0]
mov dword [esp + 0x14], edx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
mov bl, 0xf
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x146c], bl
call fcn.00430700
lea edx, [esp + 0x28]
push eax
push edx
mov ecx, 0x469fc0
mov byte [esp + 0x146c], 0x10
call fcn.00430580
mov esi, dword [eax]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1464], bl
call fcn.00430330
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 0xe
call fcn.00401c80
lea eax, [esp + 0x4c]
add esi, 0x10
test eax, eax
je 0x429228
lea ecx, [esp + 0x4c]
push ecx
call ebp
lea edx, [esp + 0x4c]
mov ecx, esi
push edx
push eax
call fcn.00408770
mov eax, dword [esp + 0x10]
mov edx, dword [0x4641a4]
mov byte [esp + 0x1464], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x42926c
add eax, 0xfffffff4
push eax
call dword [0x45d1b0]
test eax, eax
jg 0x42926c
mov edx, dword [esp + 0x10]
lea eax, [edx - 0xc]
push eax
call fcn.0044c87a
add esp, 4
push 0
lea eax, [esp + 0x50]
push 0x2b
push eax
push 0
call dword [0x45d38c]
test eax, eax
je 0x42967a
lea ecx, [esp + 0x4c]
lea edx, [esp + 0x18]
push ecx
push str._sMicrosoft_SharedOFFICE9
push edx
call fcn.004076f0
mov eax, dword [esp + 0x24]
mov ebp, dword [0x45d3b4]
add esp, 0xc
push eax
call ebp
mov edi, dword [0x45d1b4]
test eax, eax
je 0x429404
mov ecx, dword [0x4641a0]
mov edx, str._office2000commdir_
test edx, edx
mov dword [esp + 0x10], ecx
je 0x42931e
mov eax, edx
shr eax, 0x10
jne 0x4292e4
xor eax, eax
mov ecx, edx
mov ax, cx
lea ecx, [esp + 0x10]
push eax
call fcn.00405950
jmp 0x42931e
push str._office2000commdir_
call dword [0x45d1cc]
mov esi, eax
test esi, esi
je 0x42931e
push esi
lea ecx, [esp + 0x14]
call fcn.00404720
test eax, eax
je 0x42931e
mov ecx, dword [esp + 0x10]
lea edx, [esi + esi]
push edx
lea eax, [esi + esi + 2]
push str._office2000commdir_
push eax
push ecx
call fcn.00401bc0
add esp, 0x10
mov edx, dword [0x4641a0]
mov dword [esp + 0x14], edx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
mov bl, 0x12
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x146c], bl
call fcn.00430700
lea edx, [esp + 0x28]
push eax
push edx
mov ecx, 0x469fc0
mov byte [esp + 0x146c], 0x13
call fcn.00430580
mov esi, dword [eax]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1464], bl
call fcn.00430330
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 0x11
call fcn.00401c80
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 0x18]
add esi, 0x10
cmp eax, ecx
je 0x4293cd
mov edx, dword [eax - 0xc]
test edx, edx
jge 0x4293a1
mov edx, dword [0x4641a4]
add eax, 0xfffffff4
cmp eax, edx
jne 0x4293a8
mov eax, dword [ecx - 0xc]
test eax, eax
jge 0x4293b6
mov eax, dword [ecx - 8]
push ecx
push eax
mov ecx, esi
call fcn.00408770
jmp 0x4293cd
mov ecx, esi
call fcn.00405b60
mov ecx, dword [esp + 0x18]
mov dword [esi], ecx
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call edi
mov eax, dword [esp + 0x10]
mov edx, dword [0x4641a4]
mov byte [esp + 0x1464], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x429404
add eax, 0xfffffff4
push eax
call dword [0x45d1b0]
test eax, eax
jg 0x429404
mov edx, dword [esp + 0x10]
lea eax, [edx - 0xc]
push eax
call fcn.0044c87a
add esp, 4
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x18]
push eax
push str._sMicrosoft_SharedOFFICE10
push ecx
call fcn.004076f0
mov edx, dword [esp + 0x24]
add esp, 0xc
push edx
call ebp
test eax, eax
je 0x42954e
mov eax, dword [0x4641a0]
mov ecx, str._office2002commdir_
test ecx, ecx
mov dword [esp + 0x10], eax
je 0x42948e
mov edx, ecx
shr edx, 0x10
jne 0x429454
xor eax, eax
mov ax, cx
lea ecx, [esp + 0x10]
push eax
call fcn.00405950
jmp 0x42948e
push str._office2002commdir_
call dword [0x45d1cc]
mov esi, eax
test esi, esi
je 0x42948e
push esi
lea ecx, [esp + 0x14]
call fcn.00404720
test eax, eax
je 0x42948e
mov ecx, dword [esp + 0x10]
lea edx, [esi + esi]
push edx
lea eax, [esi + esi + 2]
push str._office2002commdir_
push eax
push ecx
call fcn.00401bc0
add esp, 0x10
mov edx, dword [0x4641a0]
mov dword [esp + 0x14], edx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
mov bl, 0x15
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x146c], bl
call fcn.00430700
lea edx, [esp + 0x28]
push eax
push edx
mov ecx, 0x469fc0
mov byte [esp + 0x146c], 0x16
call fcn.00430580
mov esi, dword [eax]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1464], bl
call fcn.00430330
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 0x14
call fcn.00401c80
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 0x18]
add esi, 0x10
cmp eax, ecx
je 0x42953d
mov edx, dword [eax - 0xc]
test edx, edx
jge 0x429511
mov edx, dword [0x4641a4]
add eax, 0xfffffff4
cmp eax, edx
jne 0x429518
mov eax, dword [ecx - 0xc]
test eax, eax
jge 0x429526
mov eax, dword [ecx - 8]
push ecx
push eax
mov ecx, esi
call fcn.00408770
jmp 0x42953d
mov ecx, esi
call fcn.00405b60
mov ecx, dword [esp + 0x18]
mov dword [esi], ecx
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x1464], 0
call fcn.00401c80
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x18]
push eax
push str._sMicrosoft_SharedOFFICE11
push ecx
call fcn.004076f0
mov edx, dword [esp + 0x24]
add esp, 0xc
push edx
call ebp
test eax, eax
je 0x4295b2
push str._office2003commdir_
lea ecx, [esp + 0x18]
call fcn.004171e0
lea eax, [esp + 0x18]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, 0x469fc0
mov byte [esp + 0x146c], 0x17
call fcn.0042fff0
mov ecx, eax
call fcn.00409c90
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 0
call fcn.00401c80
lea edx, [esp + 0x4c]
lea eax, [esp + 0x18]
push edx
push str._sMicrosoft_SharedOFFICE12
push eax
call fcn.004076f0
mov ecx, dword [esp + 0x24]
add esp, 0xc
push ecx
call ebp
test eax, eax
je 0x429616
push str._office2007commdir_
lea ecx, [esp + 0x18]
call fcn.004171e0
lea edx, [esp + 0x18]
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, 0x469fc0
mov byte [esp + 0x146c], 0x18
call fcn.0042fff0
mov ecx, eax
call fcn.00409c90
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 0
call fcn.00401c80
lea ecx, [esp + 0x4c]
lea edx, [esp + 0x18]
push ecx
push str._sMicrosoft_SharedOFFICE14
push edx
call fcn.004076f0
mov eax, dword [esp + 0x24]
add esp, 0xc
push eax
call ebp
test eax, eax
je 0x42967a
push str._office2010commdir_
lea ecx, [esp + 0x18]
call fcn.004171e0
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, 0x469fc0
mov byte [esp + 0x146c], 0x19
call fcn.0042fff0
mov ecx, eax
call fcn.00409c90
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 0
call fcn.00401c80
mov edi, 0x45d790
mov bl, 0x1b
lea eax, [esp + 0x18]
push eax
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Path
call fcn.004171e0
mov edx, dword [edi + 4]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x1478], 0x1a
call fcn.004171e0
push 0x80000002
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1478], 0
call fcn.00421240
push eax
mov byte [esp + 0x146c], bl
call fcn.00429a00
add esp, 8
lea ecx, [esp + 0x30]
mov esi, eax
mov byte [esp + 0x1464], 0
call fcn.00401c80
lea ecx, [esp + 0x2c]
call fcn.00401c80
test esi, esi
je 0x429757
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx - 8]
test eax, eax
jle 0x429757
cmp word [ecx + eax*2 - 2], 0x5c
jne 0x429717
dec eax
push 1
push eax
lea ecx, [esp + 0x20]
call fcn.0040c9e0
mov eax, dword [edi]
lea ecx, [esp + 0x14]
push eax
call fcn.004171e0
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, 0x469fc0
mov byte [esp + 0x146c], 0x1c
call fcn.0042fff0
mov ecx, eax
call fcn.00409c90
lea ecx, [esp + 0x14]
mov byte [esp + 0x1464], 0
call fcn.00401c80
add edi, 8
cmp edi, 0x45d948
jb 0x429681
mov eax, dword [0x469d4c]
test eax, eax
je 0x429818
mov esi, dword [0x469fd0]
push 0x85
lea ecx, [esp + 0x20]
call fcn.004171e0
mov eax, dword [eax]
push esi
push eax
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x1470], 0x1d
call fcn.00421b40
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.00401c80
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1464], 0
call fcn.00401c80
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x469fc0
call fcn.004306f0
mov eax, dword [esp + 0x10]
mov ecx, dword [0x469fc4]
cmp eax, ecx
je 0x429818
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0xc]
push edx
push eax
lea ecx, [esp + 0x24]
push str._t_s:_t_s_n
push ecx
call fcn.00421b40
add esp, 0x10
lea ecx, [esp + 0x1c]
call fcn.00401c80
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [esp + 0x18]
call fcn.004301e0
mov eax, dword [esp + 0x10]
mov ecx, dword [0x469fc4]
cmp eax, ecx
jne 0x4297d7
mov ebp, dword [esp + 0x146c]
mov byte [0x469da8], 1
mov ecx, ebp
call fcn.00408830
mov eax, dword [ebp]
push eax
call dword [0x45d458]
mov eax, dword [0x469d48]
test eax, eax
je 0x429888
mov eax, dword [esp + 0x1470]
test eax, eax
je 0x429888
mov eax, dword [ebp]
mov esi, dword [0x45d2f8]
push str.programfiles
push eax
call esi
add esp, 8
test eax, eax
jne 0x42986a
push str.programfiles_x64_
jmp 0x429881
mov eax, dword [ebp]
push str.commonfiles
push eax
call esi
add esp, 8
test eax, eax
jne 0x429888
push str.commonfiles_x64_
mov ecx, ebp
call fcn.00405430
lea ecx, [esp + 0x38]
push ebp
push ecx
mov ecx, 0x469fc0
call fcn.00430150
mov eax, dword [esp + 0x38]
mov ecx, dword [0x469fc4]
cmp eax, ecx
je 0x4298c1
add eax, 0x10
mov ecx, ebp
push eax
call fcn.00409c90
lea ecx, [esp + 0x18]
call fcn.00401c80
mov eax, 1
jmp 0x4298cc
lea ecx, [esp + 0x18]
call fcn.00401c80
xor eax, eax
mov ecx, dword [esp + 0x145c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1458
ret