Function at 0x4203d0
Capabilities:
Parse pe header

Disassembly:
push ebp
push ebx
push edi
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4203d8
call fcn.004ceb50
mov edx, dword [esp + 0x38]
lea ecx, [esp]
call fcn.0044f000
mov edx, 0x5e60ba
lea ecx, [0xf81138]
call fcn.0044f008
mov dword [0xf81214], 0
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed358
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba73d
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x420455
cmp edi, 0xffffffff
je 0x420459
xor eax, eax
jmp 0x42045e
mov eax, 1
or eax, eax
je 0x4204eb
mov edx, dword [esp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf811d4]
push eax
call fcn.004ceac0
push dword [0xf81394]
push dword [0xf811d4]
call fcn.004ccb90
mov ebx, eax
and ebx, ebx
jle 0x4204bc
mov edx, dword [0xf8135c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81330]
push eax
call fcn.004ceac0
jmp 0x4204dc
mov edx, dword [0xf811d4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81330]
push eax
call fcn.004ceac0
mov dword [0xf81284], 1
jmp 0x4207fc
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.filesOfficeData
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba73d
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x420530
cmp edi, 0xffffffff
je 0x420534
xor eax, eax
jmp 0x420539
mov eax, 1
or eax, eax
je 0x4205ec
mov edx, dword [esp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.files_
push edx
call fcn.004cea70
lea eax, [esp + 4]
push eax
call fcn.004ceac0
mov edx, dword [esp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf811d4]
push eax
call fcn.004ceac0
push dword [0xf81394]
push dword [0xf811d4]
call fcn.004ccb90
mov ebx, eax
and ebx, ebx
jle 0x4205bd
mov edx, dword [0xf8135c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81330]
push eax
call fcn.004ceac0
jmp 0x4205dd
mov edx, dword [0xf811d4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81330]
push eax
call fcn.004ceac0
mov dword [0xf81284], 1
jmp 0x4207fc
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [0xf81394]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed358
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba73d
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x420633
cmp edi, 0xffffffff
je 0x420637
xor eax, eax
jmp 0x42063c
mov eax, 1
or eax, eax
je 0x4206ea
mov edx, dword [0xf81394]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [esp + 4]
push eax
call fcn.004ceac0
mov edx, dword [0xf81394]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf811d4]
push eax
call fcn.004ceac0
push dword [0xf81394]
push dword [0xf811d4]
call fcn.004ccb90
mov ebx, eax
and ebx, ebx
jle 0x4206bb
mov edx, dword [0xf8135c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81330]
push eax
call fcn.004ceac0
jmp 0x4206db
mov edx, dword [0xf811d4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81330]
push eax
call fcn.004ceac0
mov dword [0xf81284], 1
jmp 0x4207fc
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [0xf81394]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.filesOfficeData
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba73d
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x420731
cmp edi, 0xffffffff
je 0x420735
xor eax, eax
jmp 0x42073a
mov eax, 1
or eax, eax
je 0x4207c2
mov edx, dword [0xf81394]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.files_
push edx
call fcn.004cea70
lea eax, [0xf811d4]
push eax
call fcn.004ceac0
mov edx, dword [0xf81394]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.files_
push edx
call fcn.004cea70
lea eax, [esp + 4]
push eax
call fcn.004ceac0
mov dword [0xf81284], 1
mov edx, dword [0xf8135c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81330]
push eax
call fcn.004ceac0
jmp 0x4207fc
mov edx, dword [0xf8135c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81330]
push eax
call fcn.004ceac0
mov dword [0xf81284], 0
mov edx, 0x5e60ba
lea ecx, [0xf811d4]
call fcn.0044f008
mov ebx, dword [0xf81284]
and ebx, ebx
jle 0x4208c3
mov edx, dword [0xf81228]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf810e0]
push eax
call fcn.004ceac0
mov dword [esp + 4], 0
jmp 0x420834
push dword [0xf81454]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x420874
mov edx, dword [0xf81458]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81454]
mov edx, 0x5e71ae
lea ecx, [ebp]
call fcn.0044f008
inc dword [esp + 4]
jno 0x420834
mov dword [esp + 4], 0
jmp 0x42087e
push dword [0xf81448]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x4208be
mov edx, dword [0xf8144c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81448]
mov edx, 0x5e71ae
lea ecx, [ebp]
call fcn.0044f008
inc dword [esp + 4]
jno 0x42087e
jmp 0x420977
mov edx, dword [0xf81228]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf810e0]
push eax
call fcn.004ceac0
mov dword [esp + 4], 0
jmp 0x4208ed
push dword [0xf81454]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x42092d
mov edx, dword [0xf81458]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81454]
mov edx, 0x5e71b2
lea ecx, [ebp]
call fcn.0044f008
inc dword [esp + 4]
jno 0x4208ed
mov dword [esp + 4], 0
jmp 0x420937
push dword [0xf81448]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x420977
mov edx, dword [0xf8144c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81448]
mov edx, 0x5e71b2
lea ecx, [ebp]
call fcn.0044f008
inc dword [esp + 4]
jno 0x420937
mov ebx, dword [0xf81284]
and ebx, ebx
jle 0x420ab1
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4afa
push eax
mov edx, dword [0xf811d4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed358
push edx
call fcn.004cea70
call fcn.004ceb30
push 0
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x420a85
push 0
call fcn.004baf70
and eax, eax
je 0x420a7b
push 0
call fcn.004badeb
mov ebx, eax
cmp ebx, 1
jne 0x420a76
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.00422184
lea eax, [esp + 0xc]
push eax
call fcn.004ceac0
push dword [esp + 8]
mov edx, 0x5e60ba
pop ecx
call fcn.0044f3d0
jne 0x420a76
push edx
call fcn.004cea40
pop edx
push eax
mov edx, 0x5e62ec
push edx
call fcn.004cea70
mov edx, dword [esp + 0xc]
push edx
call fcn.004cea70
mov edx, 0x5e6e12
push edx
call fcn.004cea70
lea eax, [esp + 0x10]
push eax
call fcn.004ceac0
jmp 0x4209d7
push 0
call fcn.004baf3e
mov edx, dword [0xf8123c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, dword [esp + 0x10]
push edx
call fcn.004cea70
lea eax, [0xf81334]
push eax
call fcn.004ceac0
jmp 0x420ad1
mov edx, dword [0xf81128]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81334]
push eax
call fcn.004ceac0
mov ebx, dword [0xf811e4]
and ebx, ebx
jne 0x420aec
mov ebx, dword [0xf811e8]
and ebx, ebx
jne 0x420aec
mov eax, 1
jmp 0x420aee
xor eax, eax
and eax, eax
je 0x420b3f
call fcn.004bd7c4
push 0
call fcn.004bda93
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
add ebx, 0xfffffebe
mov dword [0xf811e4], ebx
push 0
call fcn.004bdab6
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
add ebx, 0xffffff2b
mov dword [0xf811e8], ebx
push 0
call fcn.004b8af1
and eax, eax
je 0x420b51
xor eax, eax
jmp 0x420b56
mov eax, 1
and eax, eax
je 0x421005
push 0x1aa
push 0x284
push dword [0xf811e8]
push dword [0xf811e4]
call fcn.00441d4d
push dword [0xf81384]
call fcn.004c78ad
cdq
push edx
push eax
push 8
call fcn.004b031c
push dword [0xf81060]
call fcn.004c78ad
cdq
push edx
push eax
push 0xa
call fcn.004b031c
push dword [0xf81218]
call fcn.004c78ad
cdq
push edx
push eax
push 9
call fcn.004b031c
push dword [0xf81120]
call fcn.004c78ad
cdq
push edx
push eax
push 0xb
call fcn.004b031c
push 0
lea eax, [0x4158e9]
push eax
call fcn.004b95d7
push 0x7d0
push 0x309
push 0
call fcn.004b963d
push 0xea60
push 0x30a
push 0
call fcn.004b963d
push 1
push 0x3c
call fcn.004b02dd
push 1
push 0x3d
call fcn.004b02dd
push 0
push 0x41
call fcn.004b02dd
push dword [0xf81278]
mov edx, 0x5e926c
pop ecx
call fcn.0044f3d0
je 0x420ca0
mov eax, 0x5ed76e
push eax
push 0x4c
call fcn.004b253c
mov eax, 0x5f5ab0
push eax
push 0x4c
call fcn.004b32a4
mov ebx, dword [0xf81284]
and ebx, ebx
jne 0x420c8e
push dword [0xf810ec]
push 0x51
call fcn.004b32a4
jmp 0x420c9e
push dword [0xf81344]
push 0x51
call fcn.004b32a4
jmp 0x420cb0
mov eax, str.Windows_10_or_11_only____
push eax
push 0x4c
call fcn.004b32a4
push dword [0xf811a4]
push 0x35
call fcn.004b32a4
push 0
call fcn.004b8c12
push dword [0xf81228]
push 0
call fcn.004b8ac8
call fcn.004390ee
push 0
push 1
push 0x4f
call fcn.004b031c
push 0x4d
call fcn.0043f4b4
push 0
push 0
push 0x4d
call fcn.004b031c
push dword [0xf8103c]
push 0xffffffff
push 0x4e
call fcn.004b2473
push dword [0xf8111c]
push 0xffffffff
push 0x4e
call fcn.004b2473
push dword [0xf81070]
push 0xffffffff
push 0x4e
call fcn.004b2473
push 0
push 1
push 0x4e
call fcn.004b031c
push 1
mov eax, 0x5e7814
push eax
call fcn.0043e026
mov eax, 0x5f3bb2
push eax
push 0xffffffff
push 0x45
call fcn.004b2473
mov eax, 0x5f0f02
push eax
push 0xffffffff
push 0x45
call fcn.004b2473
mov eax, 0x5f6372
push eax
push 0xffffffff
push 0x45
call fcn.004b2473
push 0
push 0
push 0x45
call fcn.004b031c
push dword [0xf81170]
push 0xffffffff
push 0x48
call fcn.004b2473
push dword [0xf8109c]
push 0xffffffff
push 0x48
call fcn.004b2473
push 0
push 0
push 0x48
call fcn.004b031c
mov edx, 0x5e7814
lea ecx, [0xf81088]
call fcn.0044f008
push 0x3f
call fcn.0043f4b4
push dword [0xf81130]
push 0xffffffff
push 0x3f
call fcn.004b2473
push 0
push 1
push 0x3f
call fcn.004b031c
call fcn.00447b88
push 0x47
call fcn.004b2425
mov dword [esp + 4], 0
jmp 0x420e61
push dword [0xf81454]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x420ea9
mov edx, dword [0xf81458]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81454]
push dword [ebp]
push 0xffffffff
push 0x47
call fcn.004b2473
inc dword [esp + 4]
jno 0x420e61
push 2
push 0
push 0x47
call fcn.004b0456
push 0x5a
call fcn.004b2425
call fcn.0043fc4e
push 0x260
push 0x2bc
push 0
push 0
call fcn.00412d57
push dword [0xf812dc]
lea eax, [0x41655e]
push eax
call fcn.004b95d7
push dword [0xf81314]
call fcn.004c78ad
push eax
push 0
push 0x4d
call fcn.004b3451
push dword [0xf81314]
call fcn.004c78ad
push eax
push 1
push 0x4d
call fcn.004b3451
push dword [0xf81314]
call fcn.004c78ad
push eax
push 2
push 0x4d
call fcn.004b3451
push dword [0xf81314]
call fcn.004c78ad
push eax
push 3
push 0x4d
call fcn.004b3451
push dword [0xf81314]
call fcn.004c78ad
push eax
push 4
push 0x4d
call fcn.004b3451
push dword [0xf81314]
call fcn.004c78ad
push eax
push 5
push 0x4d
call fcn.004b3451
push dword [0xf81314]
call fcn.004c78ad
push eax
push 6
push 0x4d
call fcn.004b3451
push dword [0xf81314]
call fcn.004c78ad
push eax
push 7
push 0x4d
call fcn.004b3451
push dword [0xf81314]
call fcn.004c78ad
push eax
push 8
push 0x4d
call fcn.004b3451
push dword [0xf81314]
call fcn.004c78ad
push eax
push 9
push 0x4d
call fcn.004b3451
call fcn.004b884b
mov ebx, eax
cmp ebx, 0x6e
jl 0x421022
push 0
push 0x4c
call fcn.004b2448
jmp 0x421031
push 1
push 0x4c
call fcn.004b2448
push 0x36
call fcn.004b347f
push 0x4b
call fcn.004b347f
push 0x35
call fcn.004b347f
push 0x27
call fcn.004b347f
push 0x34
call fcn.004b347f
push 0x37
call fcn.004b347f
push 0xffff0001
push 0xffff0001
push 0xffff0001
push 0x64
push 0x2e
call fcn.004b35d8
push 0
push 0x28
call fcn.004b02dd
push 0x42
call fcn.004b347f
mov ebx, dword [0xf81284]
and ebx, ebx
jle 0x421bd5
push 0
push 0x40
push 0
call fcn.004c5706
push eax
push 1
push 0x59
call fcn.004b238a
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4afa
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed358
push edx
call fcn.004cea70
call fcn.004ceb30
push 0
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x4217c7
push 0
call fcn.004baf70
and eax, eax
je 0x4217bd
push 0
call fcn.004badeb
mov ebx, eax
cmp ebx, 2
jne 0x4217b8
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5ec6fa
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004ccb90
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jg 0x4211cf
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5eb28e
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004ccb90
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jg 0x4211cf
jmp 0x4211d6
mov eax, 1
jmp 0x4211d8
xor eax, eax
and eax, eax
je 0x4217b8
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5ec6fa
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004ccb90
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jle 0x4212cd
push 0
push 1
push 0x4e
call fcn.004b031c
mov edx, 0x5e7814
lea ecx, [0xf81088]
call fcn.0044f008
push dword [0xf81228]
push 0
call fcn.004b8ac8
push 0x47
call fcn.004b2425
mov dword [esp + 4], 0
jmp 0x42126c
push dword [0xf81454]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x4212b4
mov edx, dword [0xf81458]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81454]
push dword [ebp]
push 0xffffffff
push 0x47
call fcn.004b2473
inc dword [esp + 4]
jno 0x42126c
push 2
push 0
push 0x47
call fcn.004b0456
jmp 0x421371
push 0
push 0
push 0x4e
call fcn.004b031c
mov edx, 0x5e77e2
lea ecx, [0xf81088]
call fcn.0044f008
push dword [0xf81228]
push 0
call fcn.004b8ac8
push 0x47
call fcn.004b2425
mov dword [esp + 4], 0
jmp 0x421315
push dword [0xf81448]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x42135d
mov edx, dword [0xf8144c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81448]
push dword [ebp]
push 0xffffffff
push 0x47
call fcn.004b2473
inc dword [esp + 4]
jno 0x421315
push 2
push 0
push 0x47
call fcn.004b0456
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
lea eax, [esp + 0x14]
push eax
call fcn.004ceac0
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eea94
push edx
call fcn.004cea70
mov edx, dword [esp + 0x18]
push edx
call fcn.004cea70
mov edx, str._stream.x64.x_none.dat
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba73d
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4213f5
jl 0x4213f1
cmp ebx, 0
ja 0x4213f5
xor eax, eax
jmp 0x4213fa
mov eax, 1
or eax, eax
je 0x42146e
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eea94
push edx
call fcn.004cea70
mov edx, dword [esp + 0x18]
push edx
call fcn.004cea70
mov edx, str._stream.x86.x_none.dat
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba73d
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x42145e
jl 0x42145a
cmp ebx, 0
ja 0x42145e
xor eax, eax
jmp 0x421463
mov eax, 1
or eax, eax
je 0x42146e
mov eax, 1
jmp 0x421470
xor eax, eax
and eax, eax
je 0x421483
mov dword [0xf81368], 0
jmp 0x421577
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eea94
push edx
call fcn.004cea70
mov edx, dword [esp + 0x18]
push edx
call fcn.004cea70
mov edx, str._stream.x64.x_none.dat
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba73d
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x4214e3
jg 0x4214df
cmp ebx, 0x64
jb 0x4214e3
xor eax, eax
jmp 0x4214e8
mov eax, 1
or eax, eax
je 0x4214f8
mov dword [0xf81368], 0x56
jmp 0x421577
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eea94
push edx
call fcn.004cea70
mov edx, dword [esp + 0x18]
push edx
call fcn.004cea70
mov edx, str._stream.x86.x_none.dat
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba73d
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x421558
jg 0x421554
cmp ebx, 0x64
jb 0x421558
xor eax, eax
jmp 0x42155d
mov eax, 1
or eax, eax
je 0x42156d
mov dword [0xf81368], 0x40
jmp 0x421577
mov dword [0xf81368], 0
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4afa
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eea94
push edx
call fcn.004cea70
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
pop eax
call fcn.004ceb30
push 1
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x4217b8
push 1
call fcn.004baf70
and eax, eax
je 0x4217ae
push 1
call fcn.004badeb
mov ebx, eax
cmp ebx, 1
jne 0x4217a9
push dword [0xf81088]
mov edx, 0x5e7814
pop ecx
call fcn.0044f3d0
je 0x4216e7
mov dword [esp + 4], 0
jmp 0x42162a
push dword [0xf81454]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x4216e2
push edx
call fcn.004cea40
pop edx
push eax
push 1
push 1
mov edx, dword [0xf81458]
imul edx, dword [esp + 0x10]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81454]
push dword [ebp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 1
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004ccaf0
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jle 0x4216d8
mov edx, dword [0xf81458]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81454]
mov edx, 0x5e71b2
lea ecx, [ebp]
call fcn.0044f008
mov dword [0xf81214], 1
inc dword [esp + 4]
jno 0x42162a
jmp 0x4217a9
mov dword [esp + 4], 0
jmp 0x4216f1
push dword [0xf81448]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x4217a9
push edx
call fcn.004cea40
pop edx
push eax
push 1
push 1
mov edx, dword [0xf8144c]
imul edx, dword [esp + 0x10]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81448]
push dword [ebp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 1
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004ccaf0
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jle 0x42179f
mov edx, dword [0xf8144c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81448]
mov edx, 0x5e71b2
lea ecx, [ebp]
call fcn.0044f008
mov dword [0xf81214], 1
inc dword [esp + 4]
jno 0x4216f1
jmp 0x4215e2
push 1
call fcn.004baf3e
jmp 0x421126
push 0
call fcn.004baf3e
mov ebx, dword [0xf81214]
and ebx, ebx
jne 0x421a9d
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4afa
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed358
push edx
call fcn.004cea70
call fcn.004ceb30
push 0
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x421a68
push 0
call fcn.004baf70
and eax, eax
je 0x421a5e
push 0
call fcn.004badeb
mov ebx, eax
cmp ebx, 2
jne 0x421a59
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5ec6fa
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004ccb90
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jle 0x421a59
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4afa
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eea94
push edx
call fcn.004cea70
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
pop eax
call fcn.004ceb30
push 1
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x421a59
push 1
call fcn.004baf70
and eax, eax
je 0x421a4f
push 1
call fcn.004badeb
mov ebx, eax
cmp ebx, 1
jne 0x421a4a
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 1
call fcn.004bad68
lea eax, [esp + 0x18]
push eax
call fcn.004ceac0
push 1
mov eax, str.stream.x64.x
push eax
push dword [esp + 0x1c]
call fcn.004cca70
mov ebx, eax
and ebx, ebx
jg 0x42197c
push 1
mov eax, str.stream.x86.x
push eax
push dword [esp + 0x1c]
call fcn.004cca70
mov ebx, eax
and ebx, ebx
jg 0x42197c
jmp 0x421983
mov eax, 1
jmp 0x421985
xor eax, eax
and eax, eax
je 0x42198e
jmp 0x421a4a
push 1
mov eax, str.stream.x64.
push eax
push dword [esp + 0x1c]
call fcn.004cca70
mov ebx, eax
and ebx, ebx
jg 0x4219c4
push 1
mov eax, str.stream.x86.
push eax
push dword [esp + 0x1c]
call fcn.004cca70
mov ebx, eax
and ebx, ebx
jg 0x4219c4
jmp 0x4219cb
mov eax, 1
jmp 0x4219cd
xor eax, eax
and eax, eax
je 0x421a4a
push 1
mov eax, 0x5ebe58
push eax
push dword [esp + 0x1c]
call fcn.004cca70
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
and ebx, ebx
jle 0x421a2a
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push dword [esp + 0x1c]
call fcn.004cca40
mov ebx, eax
add ebx, 0xfffffff1
push ebx
push 0xc
push dword [esp + 0x24]
call fcn.004ccbd0
lea eax, [0xf81138]
push eax
call fcn.004ceac0
push 1
call fcn.004baf3e
push 0
call fcn.004baf3e
mov dword [0xf81214], 1
jmp 0x421a68
jmp 0x4218fb
push 1
call fcn.004baf3e
jmp 0x421825
push 0
call fcn.004baf3e
mov dword [esp + 0x1c], 0x10
push dword [0xf81138]
mov edx, 0x5e60ba
pop ecx
call fcn.0044f3d0
jne 0x421a98
push dword [0xf81138]
push 0xffffffff
push 0x5a
call fcn.004b2473
jmp 0x421bbc
push 0x5a
call fcn.004b2425
push dword [0xf81088]
mov edx, 0x5e7814
pop ecx
call fcn.0044f3d0
je 0x421b3e
mov dword [esp + 4], 0
jmp 0x421ac8
push dword [0xf81454]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x421b3c
mov edx, dword [0xf81458]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81454]
push dword [ebp]
mov edx, 0x5e71b2
pop ecx
call fcn.0044f3d0
je 0x421b36
mov edx, dword [0xf81458]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81454]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.004b2473
inc dword [esp + 4]
jno 0x421ac8
jmp 0x421bbc
mov dword [esp + 4], 0
jmp 0x421b48
push dword [0xf81448]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x421bbc
mov edx, dword [0xf8144c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81448]
push dword [ebp]
mov edx, 0x5e71b2
pop ecx
call fcn.0044f3d0
je 0x421bb6
mov edx, dword [0xf8144c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81448]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.004b2473
inc dword [esp + 4]
jno 0x421b48
push 0
push 0
push 0x26
call fcn.004b031c
jmp 0x421cc6
mov dword [0xf81368], 0
push 0
push 0
push pe_nt_image_headers32
call fcn.004c5706
push eax
push 1
push 0x59
call fcn.004b238a
push 0x5a
call fcn.004b2425
push dword [0xf81088]
mov edx, 0x5e7814
pop ecx
call fcn.0044f3d0
je 0x421c74
mov dword [esp + 4], 0
jmp 0x421c2a
push dword [0xf81454]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x421c72
mov edx, dword [0xf81458]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81454]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.004b2473
inc dword [esp + 4]
jno 0x421c2a
jmp 0x421cc6
mov dword [esp + 4], 0
jmp 0x421c7e
push dword [0xf81448]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x421cc6
mov edx, dword [0xf8144c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81448]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.004b2473
inc dword [esp + 4]
jno 0x421c7e
mov ebx, dword [0xf81368]
cmp ebx, 0x56
jne 0x421ce7
push 0
push 1
push 0x4f
call fcn.004b031c
jmp 0x421d12
mov ebx, dword [0xf81368]
cmp ebx, 0x40
jne 0x421d08
push 0
push 1
push 0x50
call fcn.004b031c
jmp 0x421d12
mov dword [0xf81368], 0
mov ebx, dword [0xf81284]
and ebx, ebx
jle 0x421d3c
push 0
call fcn.004b8af1
and eax, eax
je 0x421d3a
push dword [0xf81094]
push 0x51
call fcn.004b253c
jmp 0x421d5a
push 0
call fcn.004b8af1
and eax, eax
je 0x421d5a
push dword [0xf8135c]
push 0x51
call fcn.004b253c
push dword [0xf811d4]
mov edx, 0x5e60ba
pop ecx
call fcn.0044f3d0
jne 0x421e86
push dword [0xf811d4]
call fcn.004cca40
mov ebx, eax
cmp ebx, 0x1e
jle 0x421e21
mov dword [esp + 0x20], 1
jmp 0x421d91
mov eax, 0x5e7f22
push eax
push dword [0xf811d4]
call fcn.004cd290
cmp eax, dword [esp + 0x20]
jl 0x421ddd
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5e7f22
push eax
push dword [esp + 0x2c]
push dword [0xf811d4]
call fcn.004cd3e0
lea eax, [esp + 0x28]
push eax
call fcn.004ceac0
inc dword [esp + 0x20]
jno 0x421d91
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
mov edx, str.Office_Folder:
push edx
call fcn.004cea70
mov edx, dword [esp + 0x2c]
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x55
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004b253c
call fcn.0044f440
jmp 0x421e84
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
mov edx, str.Office_Path:
push edx
call fcn.004cea70
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push dword [0xf811d4]
call fcn.004cca40
mov ebx, eax
dec ebx
push ebx
push dword [0xf811d4]
call fcn.004cd340
pop eax
call fcn.004ceb30
push 0x55
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004b253c
call fcn.0044f440
jmp 0x421e96
mov eax, 0x5e60ba
push eax
push 0x55
call fcn.004b253c
xor eax, eax
push dword [esp]
call fcn.004cebc0
push dword [esp + 0xc]
call fcn.004cebc0
push dword [esp + 8]
call fcn.004cebc0
push dword [esp + 0x10]
call fcn.004cebc0
push dword [esp + 0x14]
call fcn.004cebc0
push dword [esp + 0x24]
call fcn.004cebc0
add esp, 0x28
pop edi
pop ebx
pop ebp
ret 4