Function at 0x42000c
Capabilities:
Parse pe header

Disassembly:
push ebp
push ebx
push edi
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x420014
call fcn.004ceb50
mov edx, dword [esp + 0x38]
lea ecx, [esp]
call fcn.0044f000
mov edx, 0x5e60ba
lea ecx, [0xf8151c]
call fcn.0044f008
mov dword [0xf815f8], 0
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed450
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x420091
cmp edi, 0xffffffff
je 0x420095
xor eax, eax
jmp 0x42009a
mov eax, 1
or eax, eax
je 0x420127
mov edx, dword [esp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf815b8]
push eax
call fcn.004ceac0
push dword [0xf81774]
push dword [0xf815b8]
call fcn.004cc840
mov ebx, eax
and ebx, ebx
jle 0x4200f8
mov edx, dword [0xf8173c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81710]
push eax
call fcn.004ceac0
jmp 0x420118
mov edx, dword [0xf815b8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81710]
push eax
call fcn.004ceac0
mov dword [0xf81664], 1
jmp 0x420438
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.filesOfficeData
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x42016c
cmp edi, 0xffffffff
je 0x420170
xor eax, eax
jmp 0x420175
mov eax, 1
or eax, eax
je 0x420228
mov edx, dword [esp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.files_
push edx
call fcn.004cea70
lea eax, [esp + 4]
push eax
call fcn.004ceac0
mov edx, dword [esp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf815b8]
push eax
call fcn.004ceac0
push dword [0xf81774]
push dword [0xf815b8]
call fcn.004cc840
mov ebx, eax
and ebx, ebx
jle 0x4201f9
mov edx, dword [0xf8173c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81710]
push eax
call fcn.004ceac0
jmp 0x420219
mov edx, dword [0xf815b8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81710]
push eax
call fcn.004ceac0
mov dword [0xf81664], 1
jmp 0x420438
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [0xf81774]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed450
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x42026f
cmp edi, 0xffffffff
je 0x420273
xor eax, eax
jmp 0x420278
mov eax, 1
or eax, eax
je 0x420326
mov edx, dword [0xf81774]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [esp + 4]
push eax
call fcn.004ceac0
mov edx, dword [0xf81774]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf815b8]
push eax
call fcn.004ceac0
push dword [0xf81774]
push dword [0xf815b8]
call fcn.004cc840
mov ebx, eax
and ebx, ebx
jle 0x4202f7
mov edx, dword [0xf8173c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81710]
push eax
call fcn.004ceac0
jmp 0x420317
mov edx, dword [0xf815b8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81710]
push eax
call fcn.004ceac0
mov dword [0xf81664], 1
jmp 0x420438
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [0xf81774]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.filesOfficeData
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x42036d
cmp edi, 0xffffffff
je 0x420371
xor eax, eax
jmp 0x420376
mov eax, 1
or eax, eax
je 0x4203fe
mov edx, dword [0xf81774]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.files_
push edx
call fcn.004cea70
lea eax, [0xf815b8]
push eax
call fcn.004ceac0
mov edx, dword [0xf81774]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.files_
push edx
call fcn.004cea70
lea eax, [esp + 4]
push eax
call fcn.004ceac0
mov dword [0xf81664], 1
mov edx, dword [0xf8173c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81710]
push eax
call fcn.004ceac0
jmp 0x420438
mov edx, dword [0xf8173c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81710]
push eax
call fcn.004ceac0
mov dword [0xf81664], 0
mov edx, 0x5e60ba
lea ecx, [0xf815b8]
call fcn.0044f008
mov ebx, dword [0xf81664]
and ebx, ebx
jle 0x4204ff
mov edx, dword [0xf81608]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf814c0]
push eax
call fcn.004ceac0
mov dword [esp + 4], 0
jmp 0x420470
push dword [0xf81834]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x4204b0
mov edx, dword [0xf81838]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81834]
mov edx, 0x5e71a0
lea ecx, [ebp]
call fcn.0044f008
inc dword [esp + 4]
jno 0x420470
mov dword [esp + 4], 0
jmp 0x4204ba
push dword [0xf81828]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x4204fa
mov edx, dword [0xf8182c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81828]
mov edx, 0x5e71a0
lea ecx, [ebp]
call fcn.0044f008
inc dword [esp + 4]
jno 0x4204ba
jmp 0x4205b3
mov edx, dword [0xf81608]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf814c0]
push eax
call fcn.004ceac0
mov dword [esp + 4], 0
jmp 0x420529
push dword [0xf81834]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x420569
mov edx, dword [0xf81838]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81834]
mov edx, 0x5e71a4
lea ecx, [ebp]
call fcn.0044f008
inc dword [esp + 4]
jno 0x420529
mov dword [esp + 4], 0
jmp 0x420573
push dword [0xf81828]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x4205b3
mov edx, dword [0xf8182c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81828]
mov edx, 0x5e71a4
lea ecx, [ebp]
call fcn.0044f008
inc dword [esp + 4]
jno 0x420573
mov ebx, dword [0xf81664]
and ebx, ebx
jle 0x4206ed
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4d66
push eax
mov edx, dword [0xf815b8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed450
push edx
call fcn.004cea70
call fcn.004ceb30
push 0
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x4206c1
push 0
call fcn.004baf70
and eax, eax
je 0x4206b7
push 0
call fcn.004badeb
mov ebx, eax
cmp ebx, 1
jne 0x4206b2
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.00421dc0
lea eax, [esp + 0xc]
push eax
call fcn.004ceac0
push dword [esp + 8]
mov edx, 0x5e60ba
pop ecx
call fcn.0044f3d0
jne 0x4206b2
push edx
call fcn.004cea40
pop edx
push eax
mov edx, 0x5e62ec
push edx
call fcn.004cea70
mov edx, dword [esp + 0xc]
push edx
call fcn.004cea70
mov edx, 0x5e6e0e
push edx
call fcn.004cea70
lea eax, [esp + 0x10]
push eax
call fcn.004ceac0
jmp 0x420613
push 0
call fcn.004baf3e
mov edx, dword [0xf8161c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, dword [esp + 0x10]
push edx
call fcn.004cea70
lea eax, [0xf81714]
push eax
call fcn.004ceac0
jmp 0x42070d
mov edx, dword [0xf8150c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81714]
push eax
call fcn.004ceac0
mov ebx, dword [0xf815c8]
and ebx, ebx
jne 0x420728
mov ebx, dword [0xf815cc]
and ebx, ebx
jne 0x420728
mov eax, 1
jmp 0x42072a
xor eax, eax
and eax, eax
je 0x42077b
call fcn.004bd7c4
push 0
call fcn.004bda93
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
add ebx, 0xfffffebe
mov dword [0xf815c8], ebx
push 0
call fcn.004bdab6
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
add ebx, 0xffffff2b
mov dword [0xf815cc], ebx
push 0
call fcn.004b8af1
and eax, eax
je 0x42078d
xor eax, eax
jmp 0x420792
mov eax, 1
and eax, eax
je 0x420c41
push 0x1aa
push 0x284
push dword [0xf815cc]
push dword [0xf815c8]
call fcn.00441acf
push dword [0xf81764]
call fcn.004c78ad
cdq
push edx
push eax
push 8
call fcn.004b031c
push dword [0xf81440]
call fcn.004c78ad
cdq
push edx
push eax
push 0xa
call fcn.004b031c
push dword [0xf815fc]
call fcn.004c78ad
cdq
push edx
push eax
push 9
call fcn.004b031c
push dword [0xf81504]
call fcn.004c78ad
cdq
push edx
push eax
push 0xb
call fcn.004b031c
push 0
lea eax, [0x4157ab]
push eax
call fcn.004b95d7
push 0x7d0
push 0x309
push 0
call fcn.004b963d
push 0xea60
push 0x30a
push 0
call fcn.004b963d
push 1
push 0x3c
call fcn.004b02dd
push 1
push 0x3d
call fcn.004b02dd
push 0
push 0x41
call fcn.004b02dd
push dword [0xf81658]
mov edx, 0x5e926c
pop ecx
call fcn.0044f3d0
je 0x4208dc
mov eax, 0x5ed866
push eax
push 0x4c
call fcn.004b253c
mov eax, 0x5f5d12
push eax
push 0x4c
call fcn.004b32a4
mov ebx, dword [0xf81664]
and ebx, ebx
jne 0x4208ca
push dword [0xf814d0]
push 0x51
call fcn.004b32a4
jmp 0x4208da
push dword [0xf81724]
push 0x51
call fcn.004b32a4
jmp 0x4208ec
mov eax, str.Windows_10_or_11_only____
push eax
push 0x4c
call fcn.004b32a4
push dword [0xf81588]
push 0x35
call fcn.004b32a4
push 0
call fcn.004b8c12
push dword [0xf81608]
push 0
call fcn.004b8ac8
call fcn.00438d4b
push 0
push 1
push 0x4f
call fcn.004b031c
push 0x4d
call fcn.0043f236
push 0
push 0
push 0x4d
call fcn.004b031c
push dword [0xf8141c]
push 0xffffffff
push 0x4e
call fcn.004b2473
push dword [0xf81500]
push 0xffffffff
push 0x4e
call fcn.004b2473
push dword [0xf81450]
push 0xffffffff
push 0x4e
call fcn.004b2473
push 0
push 1
push 0x4e
call fcn.004b031c
push 1
mov eax, 0x5e7806
push eax
call fcn.0043dc83
mov eax, 0x5f3e1e
push eax
push 0xffffffff
push 0x45
call fcn.004b2473
mov eax, 0x5f10c0
push eax
push 0xffffffff
push 0x45
call fcn.004b2473
mov eax, 0x5f65d4
push eax
push 0xffffffff
push 0x45
call fcn.004b2473
push 0
push 0
push 0x45
call fcn.004b031c
push dword [0xf81554]
push 0xffffffff
push 0x48
call fcn.004b2473
push dword [0xf8147c]
push 0xffffffff
push 0x48
call fcn.004b2473
push 0
push 0
push 0x48
call fcn.004b031c
mov edx, 0x5e7806
lea ecx, [0xf81468]
call fcn.0044f008
push 0x3f
call fcn.0043f236
push dword [0xf81514]
push 0xffffffff
push 0x3f
call fcn.004b2473
push 0
push 1
push 0x3f
call fcn.004b031c
call fcn.00447930
push 0x47
call fcn.004b2425
mov dword [esp + 4], 0
jmp 0x420a9d
push dword [0xf81834]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x420ae5
mov edx, dword [0xf81838]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81834]
push dword [ebp]
push 0xffffffff
push 0x47
call fcn.004b2473
inc dword [esp + 4]
jno 0x420a9d
push 2
push 0
push 0x47
call fcn.004b0456
push 0x5a
call fcn.004b2425
call fcn.0043f9d0
push 0x260
push 0x2bc
push 0
push 0
call fcn.00412c19
push dword [0xf816bc]
lea eax, [0x416420]
push eax
call fcn.004b95d7
push dword [0xf816f4]
call fcn.004c78ad
push eax
push 0
push 0x4d
call fcn.004b3451
push dword [0xf816f4]
call fcn.004c78ad
push eax
push 1
push 0x4d
call fcn.004b3451
push dword [0xf816f4]
call fcn.004c78ad
push eax
push 2
push 0x4d
call fcn.004b3451
push dword [0xf816f4]
call fcn.004c78ad
push eax
push 3
push 0x4d
call fcn.004b3451
push dword [0xf816f4]
call fcn.004c78ad
push eax
push 4
push 0x4d
call fcn.004b3451
push dword [0xf816f4]
call fcn.004c78ad
push eax
push 5
push 0x4d
call fcn.004b3451
push dword [0xf816f4]
call fcn.004c78ad
push eax
push 6
push 0x4d
call fcn.004b3451
push dword [0xf816f4]
call fcn.004c78ad
push eax
push 7
push 0x4d
call fcn.004b3451
push dword [0xf816f4]
call fcn.004c78ad
push eax
push 8
push 0x4d
call fcn.004b3451
push dword [0xf816f4]
call fcn.004c78ad
push eax
push 9
push 0x4d
call fcn.004b3451
call fcn.004b884b
mov ebx, eax
cmp ebx, 0x6e
jl 0x420c5e
push 0
push 0x4c
call fcn.004b2448
jmp 0x420c6d
push 1
push 0x4c
call fcn.004b2448
push 0x36
call fcn.004b347f
push 0x4b
call fcn.004b347f
push 0x35
call fcn.004b347f
push 0x27
call fcn.004b347f
push 0x34
call fcn.004b347f
push 0x37
call fcn.004b347f
push 0xffff0001
push 0xffff0001
push 0xffff0001
push 0x64
push 0x2e
call fcn.004b35d8
push 0
push 0x28
call fcn.004b02dd
push 0x42
call fcn.004b347f
mov ebx, dword [0xf81664]
and ebx, ebx
jle 0x421811
push 0
push 0x40
push 0
call fcn.004c5706
push eax
push 1
push 0x59
call fcn.004b238a
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4d66
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed450
push edx
call fcn.004cea70
call fcn.004ceb30
push 0
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x421403
push 0
call fcn.004baf70
and eax, eax
je 0x4213f9
push 0
call fcn.004badeb
mov ebx, eax
cmp ebx, 2
jne 0x4213f4
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5ec7e6
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004cc840
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jg 0x420e0b
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5eb346
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004cc840
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jg 0x420e0b
jmp 0x420e12
mov eax, 1
jmp 0x420e14
xor eax, eax
and eax, eax
je 0x4213f4
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5ec7e6
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004cc840
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jle 0x420f09
push 0
push 1
push 0x4e
call fcn.004b031c
mov edx, 0x5e7806
lea ecx, [0xf81468]
call fcn.0044f008
push dword [0xf81608]
push 0
call fcn.004b8ac8
push 0x47
call fcn.004b2425
mov dword [esp + 4], 0
jmp 0x420ea8
push dword [0xf81834]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x420ef0
mov edx, dword [0xf81838]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81834]
push dword [ebp]
push 0xffffffff
push 0x47
call fcn.004b2473
inc dword [esp + 4]
jno 0x420ea8
push 2
push 0
push 0x47
call fcn.004b0456
jmp 0x420fad
push 0
push 0
push 0x4e
call fcn.004b031c
mov edx, 0x5e77d4
lea ecx, [0xf81468]
call fcn.0044f008
push dword [0xf81608]
push 0
call fcn.004b8ac8
push 0x47
call fcn.004b2425
mov dword [esp + 4], 0
jmp 0x420f51
push dword [0xf81828]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x420f99
mov edx, dword [0xf8182c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81828]
push dword [ebp]
push 0xffffffff
push 0x47
call fcn.004b2473
inc dword [esp + 4]
jno 0x420f51
push 2
push 0
push 0x47
call fcn.004b0456
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
lea eax, [esp + 0x14]
push eax
call fcn.004ceac0
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eec5e
push edx
call fcn.004cea70
mov edx, dword [esp + 0x18]
push edx
call fcn.004cea70
mov edx, str._stream.x64.x_none.dat
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x421031
jl 0x42102d
cmp ebx, 0
ja 0x421031
xor eax, eax
jmp 0x421036
mov eax, 1
or eax, eax
je 0x4210aa
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eec5e
push edx
call fcn.004cea70
mov edx, dword [esp + 0x18]
push edx
call fcn.004cea70
mov edx, str._stream.x86.x_none.dat
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x42109a
jl 0x421096
cmp ebx, 0
ja 0x42109a
xor eax, eax
jmp 0x42109f
mov eax, 1
or eax, eax
je 0x4210aa
mov eax, 1
jmp 0x4210ac
xor eax, eax
and eax, eax
je 0x4210bf
mov dword [0xf81748], 0
jmp 0x4211b3
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eec5e
push edx
call fcn.004cea70
mov edx, dword [esp + 0x18]
push edx
call fcn.004cea70
mov edx, str._stream.x64.x_none.dat
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x42111f
jg 0x42111b
cmp ebx, 0x64
jb 0x42111f
xor eax, eax
jmp 0x421124
mov eax, 1
or eax, eax
je 0x421134
mov dword [0xf81748], 0x56
jmp 0x4211b3
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eec5e
push edx
call fcn.004cea70
mov edx, dword [esp + 0x18]
push edx
call fcn.004cea70
mov edx, str._stream.x86.x_none.dat
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x421194
jg 0x421190
cmp ebx, 0x64
jb 0x421194
xor eax, eax
jmp 0x421199
mov eax, 1
or eax, eax
je 0x4211a9
mov dword [0xf81748], 0x40
jmp 0x4211b3
mov dword [0xf81748], 0
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4d66
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eec5e
push edx
call fcn.004cea70
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
pop eax
call fcn.004ceb30
push 1
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x4213f4
push 1
call fcn.004baf70
and eax, eax
je 0x4213ea
push 1
call fcn.004badeb
mov ebx, eax
cmp ebx, 1
jne 0x4213e5
push dword [0xf81468]
mov edx, 0x5e7806
pop ecx
call fcn.0044f3d0
je 0x421323
mov dword [esp + 4], 0
jmp 0x421266
push dword [0xf81834]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x42131e
push edx
call fcn.004cea40
pop edx
push eax
push 1
push 1
mov edx, dword [0xf81838]
imul edx, dword [esp + 0x10]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81834]
push dword [ebp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 1
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004cc7a0
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jle 0x421314
mov edx, dword [0xf81838]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81834]
mov edx, 0x5e71a4
lea ecx, [ebp]
call fcn.0044f008
mov dword [0xf815f8], 1
inc dword [esp + 4]
jno 0x421266
jmp 0x4213e5
mov dword [esp + 4], 0
jmp 0x42132d
push dword [0xf81828]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x4213e5
push edx
call fcn.004cea40
pop edx
push eax
push 1
push 1
mov edx, dword [0xf8182c]
imul edx, dword [esp + 0x10]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81828]
push dword [ebp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 1
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004cc7a0
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jle 0x4213db
mov edx, dword [0xf8182c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81828]
mov edx, 0x5e71a4
lea ecx, [ebp]
call fcn.0044f008
mov dword [0xf815f8], 1
inc dword [esp + 4]
jno 0x42132d
jmp 0x42121e
push 1
call fcn.004baf3e
jmp 0x420d62
push 0
call fcn.004baf3e
mov ebx, dword [0xf815f8]
and ebx, ebx
jne 0x4216d9
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4d66
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed450
push edx
call fcn.004cea70
call fcn.004ceb30
push 0
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x4216a4
push 0
call fcn.004baf70
and eax, eax
je 0x42169a
push 0
call fcn.004badeb
mov ebx, eax
cmp ebx, 2
jne 0x421695
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5ec7e6
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004cc840
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jle 0x421695
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4d66
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eec5e
push edx
call fcn.004cea70
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
pop eax
call fcn.004ceb30
push 1
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x421695
push 1
call fcn.004baf70
and eax, eax
je 0x42168b
push 1
call fcn.004badeb
mov ebx, eax
cmp ebx, 1
jne 0x421686
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 1
call fcn.004bad68
lea eax, [esp + 0x18]
push eax
call fcn.004ceac0
push 1
mov eax, str.stream.x64.x
push eax
push dword [esp + 0x1c]
call fcn.004cc720
mov ebx, eax
and ebx, ebx
jg 0x4215b8
push 1
mov eax, str.stream.x86.x
push eax
push dword [esp + 0x1c]
call fcn.004cc720
mov ebx, eax
and ebx, ebx
jg 0x4215b8
jmp 0x4215bf
mov eax, 1
jmp 0x4215c1
xor eax, eax
and eax, eax
je 0x4215ca
jmp 0x421686
push 1
mov eax, str.stream.x64.
push eax
push dword [esp + 0x1c]
call fcn.004cc720
mov ebx, eax
and ebx, ebx
jg 0x421600
push 1
mov eax, str.stream.x86.
push eax
push dword [esp + 0x1c]
call fcn.004cc720
mov ebx, eax
and ebx, ebx
jg 0x421600
jmp 0x421607
mov eax, 1
jmp 0x421609
xor eax, eax
and eax, eax
je 0x421686
push 1
mov eax, 0x5ebf1a
push eax
push dword [esp + 0x1c]
call fcn.004cc720
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
and ebx, ebx
jle 0x421666
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push dword [esp + 0x1c]
call fcn.004cc6f0
mov ebx, eax
add ebx, 0xfffffff1
push ebx
push 0xc
push dword [esp + 0x24]
call fcn.004cc880
lea eax, [0xf8151c]
push eax
call fcn.004ceac0
push 1
call fcn.004baf3e
push 0
call fcn.004baf3e
mov dword [0xf815f8], 1
jmp 0x4216a4
jmp 0x421537
push 1
call fcn.004baf3e
jmp 0x421461
push 0
call fcn.004baf3e
mov dword [esp + 0x1c], 0x10
push dword [0xf8151c]
mov edx, 0x5e60ba
pop ecx
call fcn.0044f3d0
jne 0x4216d4
push dword [0xf8151c]
push 0xffffffff
push 0x5a
call fcn.004b2473
jmp 0x4217f8
push 0x5a
call fcn.004b2425
push dword [0xf81468]
mov edx, 0x5e7806
pop ecx
call fcn.0044f3d0
je 0x42177a
mov dword [esp + 4], 0
jmp 0x421704
push dword [0xf81834]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x421778
mov edx, dword [0xf81838]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81834]
push dword [ebp]
mov edx, 0x5e71a4
pop ecx
call fcn.0044f3d0
je 0x421772
mov edx, dword [0xf81838]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81834]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.004b2473
inc dword [esp + 4]
jno 0x421704
jmp 0x4217f8
mov dword [esp + 4], 0
jmp 0x421784
push dword [0xf81828]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x4217f8
mov edx, dword [0xf8182c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81828]
push dword [ebp]
mov edx, 0x5e71a4
pop ecx
call fcn.0044f3d0
je 0x4217f2
mov edx, dword [0xf8182c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81828]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.004b2473
inc dword [esp + 4]
jno 0x421784
push 0
push 0
push 0x26
call fcn.004b031c
jmp 0x421902
mov dword [0xf81748], 0
push 0
push 0
push pe_nt_image_headers32
call fcn.004c5706
push eax
push 1
push 0x59
call fcn.004b238a
push 0x5a
call fcn.004b2425
push dword [0xf81468]
mov edx, 0x5e7806
pop ecx
call fcn.0044f3d0
je 0x4218b0
mov dword [esp + 4], 0
jmp 0x421866
push dword [0xf81834]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x4218ae
mov edx, dword [0xf81838]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81834]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.004b2473
inc dword [esp + 4]
jno 0x421866
jmp 0x421902
mov dword [esp + 4], 0
jmp 0x4218ba
push dword [0xf81828]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x421902
mov edx, dword [0xf8182c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81828]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.004b2473
inc dword [esp + 4]
jno 0x4218ba
mov ebx, dword [0xf81748]
cmp ebx, 0x56
jne 0x421923
push 0
push 1
push 0x4f
call fcn.004b031c
jmp 0x42194e
mov ebx, dword [0xf81748]
cmp ebx, 0x40
jne 0x421944
push 0
push 1
push 0x50
call fcn.004b031c
jmp 0x42194e
mov dword [0xf81748], 0
mov ebx, dword [0xf81664]
and ebx, ebx
jle 0x421978
push 0
call fcn.004b8af1
and eax, eax
je 0x421976
push dword [0xf81474]
push 0x51
call fcn.004b253c
jmp 0x421996
push 0
call fcn.004b8af1
and eax, eax
je 0x421996
push dword [0xf8173c]
push 0x51
call fcn.004b253c
push dword [0xf815b8]
mov edx, 0x5e60ba
pop ecx
call fcn.0044f3d0
jne 0x421ac2
push dword [0xf815b8]
call fcn.004cc6f0
mov ebx, eax
cmp ebx, 0x1e
jle 0x421a5d
mov dword [esp + 0x20], 1
jmp 0x4219cd
mov eax, 0x5e7f14
push eax
push dword [0xf815b8]
call fcn.004ccf40
cmp eax, dword [esp + 0x20]
jl 0x421a19
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5e7f14
push eax
push dword [esp + 0x2c]
push dword [0xf815b8]
call fcn.004cd090
lea eax, [esp + 0x28]
push eax
call fcn.004ceac0
inc dword [esp + 0x20]
jno 0x4219cd
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
mov edx, str.Office_Folder:
push edx
call fcn.004cea70
mov edx, dword [esp + 0x2c]
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x55
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004b253c
call fcn.0044f440
jmp 0x421ac0
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
mov edx, str.Office_Path:
push edx
call fcn.004cea70
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push dword [0xf815b8]
call fcn.004cc6f0
mov ebx, eax
dec ebx
push ebx
push dword [0xf815b8]
call fcn.004ccff0
pop eax
call fcn.004ceb30
push 0x55
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004b253c
call fcn.0044f440
jmp 0x421ad2
mov eax, 0x5e60ba
push eax
push 0x55
call fcn.004b253c
xor eax, eax
push dword [esp]
call fcn.004cebc0
push dword [esp + 0xc]
call fcn.004cebc0
push dword [esp + 8]
call fcn.004cebc0
push dword [esp + 0x10]
call fcn.004cebc0
push dword [esp + 0x14]
call fcn.004cebc0
push dword [esp + 0x24]
call fcn.004cebc0
add esp, 0x28
pop edi
pop ebx
pop ebp
ret 4