Function at 0x436f80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xdc
push 0
push 0
dec ecx
jne 0x436f88
push ecx
push ebx
push esi
push edi
mov esi, eax
mov edi, dword [ebp + 8]
mov edi, dword [edi - 4]
xor eax, eax
push ebp
push 0x438403
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, esi
lea edx, [ebp - 0x340]
mov eax, esi
call fcn.00409400
mov edx, dword [ebp - 0x340]
mov eax, 0x43841c
call fcn.0040519c
dec eax
jne 0x4371a7
lea eax, [ebp - 0x348]
push eax
lea edx, [ebp - 0x34c]
mov eax, esi
call fcn.00409400
mov eax, dword [ebp - 0x34c]
call fcn.00404eb4
sub eax, 0xf
push eax
lea edx, [ebp - 0x350]
mov eax, esi
call fcn.00409400
mov eax, dword [ebp - 0x350]
mov edx, 0x10
pop ecx
call fcn.00405114
mov eax, dword [ebp - 0x348]
lea edx, [ebp - 0x344]
call fcn.00408764
mov edx, dword [ebp - 0x344]
lea eax, [ebp - 0x131]
mov ecx, 0xff
call fcn.00404e90
lea edx, [ebp - 0x131]
mov eax, 0x43842c
call fcn.00402a80
test eax, eax
jle 0x4370d9
lea eax, [ebp - 0x231]
push eax
lea edx, [ebp - 0x131]
mov eax, 0x43842c
call fcn.00402a80
mov ecx, eax
dec ecx
mov edx, 1
lea eax, [ebp - 0x131]
call fcn.00402798
push 0x438438
lea eax, [ebp - 0x458]
lea edx, [ebp - 0x231]
call fcn.00404e58
push dword [ebp - 0x458]
push 0x438444
lea eax, [ebp - 0x454]
mov edx, 3
call fcn.00404f74
mov edx, dword [ebp - 0x454]
lea eax, [ebp - 0x450]
mov ecx, 0xff
call fcn.00404e90
lea eax, [ebp - 0x450]
mov edx, dword [0x47b258]
call fcn.00402a80
test eax, eax
jg 0x4383a5
push 0x438438
lea eax, [ebp - 0x460]
lea edx, [ebp - 0x131]
call fcn.00404e58
push dword [ebp - 0x460]
push 0x438438
lea eax, [ebp - 0x45c]
mov edx, 3
call fcn.00404f74
mov edx, dword [ebp - 0x45c]
lea eax, [ebp - 0x450]
mov ecx, 0xff
call fcn.00404e90
lea eax, [ebp - 0x450]
mov edx, dword [0x47b258]
call fcn.00402a80
test eax, eax
jne 0x4383a5
lea eax, [ebp - 0x468]
mov edx, dword [0x47b258]
call fcn.00404e58
push dword [ebp - 0x468]
lea eax, [ebp - 0x470]
lea edx, [ebp - 0x131]
call fcn.00404e58
mov eax, dword [ebp - 0x470]
lea edx, [ebp - 0x46c]
call fcn.004085cc
push dword [ebp - 0x46c]
push 0x438438
lea eax, [ebp - 0x464]
mov edx, 3
call fcn.00404f74
mov edx, dword [ebp - 0x464]
mov eax, dword [0x47b258]
mov ecx, 0xff
call fcn.00404e90
jmp 0x4383a5
lea edx, [ebp - 0x474]
mov eax, esi
call fcn.00409400
mov edx, dword [ebp - 0x474]
mov eax, 0x438450
call fcn.0040519c
dec eax
je 0x4383a5
lea edx, [ebp - 0x478]
mov eax, esi
call fcn.00409400
mov edx, dword [ebp - 0x478]
mov eax, 0x43845c
call fcn.0040519c
dec eax
je 0x4383a5
mov al, byte [ebx]
cmp al, 0x53
je 0x4371f9
cmp al, 0x73
jne 0x437277
cmp byte [ebx + 1], 0x3a
jne 0x437277
lea eax, [ebp - 0x480]
push eax
lea edx, [ebp - 0x484]
mov eax, esi
call fcn.00409400
lea eax, [ebp - 0x484]
mov edx, 0x438468
call fcn.00404ebc
mov eax, dword [ebp - 0x484]
mov ecx, 0xc
mov edx, 3
call fcn.00405114
mov eax, dword [ebp - 0x480]
lea edx, [ebp - 0x47c]
call fcn.00408764
mov edx, dword [ebp - 0x47c]
lea eax, [ebp - 0x450]
mov ecx, 0xff
call fcn.00404e90
lea edx, [ebp - 0x450]
lea eax, [edi + 0x5b9]
mov cl, 0xc
call fcn.00403044
jmp 0x4383a5
mov al, byte [ebx]
cmp al, 0x45
je 0x437285
cmp al, 0x65
jne 0x4374f4
cmp byte [ebx + 1], 0x2d
jne 0x4374f4
xor eax, eax
mov dword [ebp - 4], eax
mov word [edi + 0x5c6], 0x2a01
jmp 0x4372ff
lea eax, [ebp - 0x488]
lea edx, [edi + 0x5c6]
call fcn.00404e58
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x490]
mov edx, dword [ebp - 4]
mov dl, byte [ebx + edx]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x490]
lea eax, [ebp - 0x48c]
call fcn.00404e58
mov edx, dword [ebp - 0x48c]
pop eax
call fcn.00404ebc
mov edx, dword [ebp - 0x488]
lea eax, [edi + 0x5c6]
mov ecx, 0xff
call fcn.00404e90
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp byte [ebx + eax], 0
jne 0x43729f
lea eax, [ebp - 0x450]
push eax
lea edx, [edi + 0x5c6]
mov eax, 0x438478
call fcn.00402a80
xor edx, edx
mov dl, byte [edi + 0x5c6]
sub edx, eax
push edx
lea edx, [edi + 0x5c6]
mov eax, 0x438478
call fcn.00402a80
mov edx, eax
inc edx
lea eax, [edi + 0x5c6]
pop ecx
call fcn.00402798
lea edx, [ebp - 0x450]
lea eax, [ebp - 0x498]
call fcn.00404e58
mov eax, dword [ebp - 0x498]
lea edx, [ebp - 0x494]
call fcn.00408764
mov edx, dword [ebp - 0x494]
lea eax, [edi + 0x5c6]
mov ecx, 0xff
call fcn.00404e90
lea eax, [ebp - 0x450]
push eax
lea edx, [edi + 0x5c6]
mov eax, 0x438478
call fcn.00402a80
mov ecx, eax
lea eax, [edi + 0x5c6]
mov edx, 1
call fcn.00402798
lea edx, [ebp - 0x450]
lea eax, [ebp - 0x4a0]
call fcn.00404e58
mov eax, dword [ebp - 0x4a0]
lea edx, [ebp - 0x49c]
call fcn.00408764
mov edx, dword [ebp - 0x49c]
lea eax, [edi + 0x5c6]
mov ecx, 0xff
call fcn.00404e90
lea edx, [edi + 0x5c6]
mov eax, 0x43847c
call fcn.00402a80
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jle 0x4374eb
lea eax, [ebp - 0x131]
push eax
mov ecx, dword [ebp - 8]
dec ecx
lea eax, [edi + 0x5c6]
mov edx, 1
call fcn.00402798
lea eax, [ebp - 0x231]
push eax
xor ecx, ecx
mov cl, byte [edi + 0x5c6]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
inc edx
lea eax, [edi + 0x5c6]
call fcn.00402798
lea eax, [ebp - 0x4a4]
lea edx, [ebp - 0x131]
call fcn.00404e58
mov eax, dword [ebp - 0x4a4]
lea edx, [ebp - 0x14]
call fcn.004035dc
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x4a8]
lea edx, [ebp - 0x231]
call fcn.00404e58
mov eax, dword [ebp - 0x4a8]
lea edx, [ebp - 0x18]
call fcn.004035dc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
test eax, eax
jle 0x437494
mov word [edi + 0x5c6], 0x2a01
jmp 0x4374f4
lea edx, [ebp - 0x4b0]
mov eax, dword [ebp - 0xc]
dec eax
call fcn.00408850
push dword [ebp - 0x4b0]
push 0x438488
lea edx, [ebp - 0x4b4]
mov eax, dword [ebp - 0x10]
dec eax
call fcn.00408850
push dword [ebp - 0x4b4]
lea eax, [ebp - 0x4ac]
mov edx, 3
call fcn.00404f74
mov edx, dword [ebp - 0x4ac]
lea eax, [edi + 0x5c6]
mov ecx, 0xff
call fcn.00404e90
jmp 0x4374f4
mov word [edi + 0x5c6], 0x2a01
lea edx, [ebp - 0x4b8]
mov eax, esi
call fcn.00409400
mov edx, dword [ebp - 0x4b8]
mov eax, 0x438494
call fcn.0040519c
dec eax
jne 0x4375c6
lea eax, [ebp - 0x4bc]
push eax
lea edx, [ebp - 0x4c0]
mov eax, esi
call fcn.00409400
mov eax, dword [ebp - 0x4c0]
call fcn.00404eb4
sub eax, 7
push eax
lea edx, [ebp - 0x4c4]
mov eax, esi
call fcn.00409400
mov eax, dword [ebp - 0x4c4]
mov edx, 8
pop ecx
call fcn.00405114
mov edx, dword [ebp - 0x4bc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xb08]
shl eax, 5
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax*8 - 0xb04]
mov ecx, 0xff
call fcn.00404e90
mov eax, dword [ebp + 8]
inc dword [eax - 0xb08]
mov eax, dword [ebp + 8]
cmp dword [eax - 0xb08], 0xa
jle 0x4383a5
push 0
push 0x43849c
mov eax, dword [0x47b1d0]
mov edx, 0x4384c8
call fcn.00409294
push eax
mov eax, dword [edi + 0xc]
push eax
call sub.user32.dll_MessageBoxA_1
mov eax, dword [ebp + 8]
dec dword [eax - 0xb08]
jmp 0x4383a5
lea edx, [ebp - 0x4c8]
mov eax, esi
call fcn.00409400
mov edx, dword [ebp - 0x4c8]
mov eax, 0x438510
call fcn.0040519c
dec eax
jne 0x437890
lea eax, [ebp - 0x4cc]
push eax
lea edx, [ebp - 0x4d0]
mov eax, esi
call fcn.00409400
mov eax, dword [ebp - 0x4d0]
call fcn.00404eb4
sub eax, 6
push eax
lea edx, [ebp - 0x4d4]
mov eax, esi
call fcn.00409400
mov eax, dword [ebp - 0x4d4]
mov edx, 7
pop ecx
call fcn.00405114
mov edx, dword [ebp - 0x4cc]
mov eax, dword [ebp + 8]
mov ebx, dword [eax - 0xb08]
shl ebx, 5
mov eax, dword [ebp + 8]
lea eax, [eax + ebx*8 - 0xb04]
mov ecx, 0xff
call fcn.00404e90
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
lea edx, [eax + ebx*8 - 0xb04]
mov eax, 0x438518
call fcn.00402a80
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jle 0x4376e8
mov eax, dword [ebp + 8]
add eax, 0xfffff3f8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xb08]
shl eax, 5
mov edx, dword [ebp + 8]
lea eax, [edx + eax*8 - 0xb04]
mov ecx, dword [ebp - 4]
dec ecx
mov edx, 1
call fcn.00402798
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xb08]
shl eax, 5
mov edx, dword [ebp + 8]
lea eax, [edx + eax*8 - 0xb04]
push eax
mov eax, dword [ebp + 8]
mov ebx, dword [eax - 0xb08]
shl ebx, 5
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax + ebx*8 - 0xb04]
sub ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
lea eax, [eax + ebx*8 - 0xb04]
mov edx, dword [ebp - 4]
inc edx
call fcn.00402798
jmp 0x43770d
push 0
push 0x43849c
mov eax, dword [0x47b1d0]
mov edx, 0x438524
call fcn.00409294
push eax
mov eax, dword [edi + 0xc]
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x4383a5
mov eax, dword [ebp + 8]
xor ebx, ebx
mov bl, byte [eax - 0xc08]
test ebx, ebx
jle 0x43777e
mov dword [ebp - 4], 1
lea eax, [ebp - 0x450]
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffff3f8
mov ecx, 1
mov edx, dword [ebp - 4]
call fcn.00402798
lea eax, [ebp - 0x450]
mov edx, 0x438590
call fcn.00402a80
test eax, eax
jle 0x437778
push 0
push 0x43849c
mov eax, dword [0x47b1d0]
mov edx, 0x4385a8
call fcn.00409294
push eax
mov eax, dword [edi + 0xc]
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x4383a5
inc dword [ebp - 4]
dec ebx
jne 0x437723
mov dword [ebp - 4], 1
lea eax, [ebp - 0x4dc]
mov edx, dword [0x47b378]
call fcn.00404e58
push dword [ebp - 0x4dc]
push 0
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 4]
lea eax, [edi + 0x60]
mov edx, 2
call fcn.0041a41c
lea edx, [ebp - 0x450]
lea eax, [ebp - 0x4e0]
call fcn.00404e58
push dword [ebp - 0x4e0]
push 0x438614
lea eax, [ebp - 0x4e4]
mov edx, dword [0x47b5d8]
call fcn.00404e58
push dword [ebp - 0x4e4]
push 0x438620
lea eax, [ebp - 0x4e8]
mov edx, dword [ebp + 8]
add edx, 0xfffff3f8
call fcn.00404e58
push dword [ebp - 0x4e8]
lea eax, [ebp - 0x4d8]
mov edx, 6
call fcn.00404f74
mov edx, dword [ebp - 0x4d8]
lea eax, [ebp - 0x33c]
mov ecx, 0xff
call fcn.00404e90
xor eax, eax
mov al, byte [ebp - 0x33c]
cmp ax, 0x104
jbe 0x437860
push 0
push 0x43849c
mov eax, dword [0x47b1d0]
mov edx, 0x43862c
call fcn.00409294
push eax
mov eax, dword [edi + 0xc]
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x4383a5
mov eax, dword [edi + 0xc]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xb08]
mov eax, dword [ebp + 8]
add eax, 0xfffff4fc
lea ecx, [ebp - 0x33c]
call fcn.0041c650
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0xb08], edx
jmp 0x4383a5
mov al, byte [ebx]
cmp al, 0x46
je 0x43789e
cmp al, 0x66
jne 0x4380f0
cmp byte [ebx + 1], 0x3a
jne 0x4380f0
lea eax, [ebp - 0x4f0]
push eax
lea edx, [ebp - 0x4f4]
mov eax, esi
call fcn.00409400
mov eax, dword [ebp - 0x4f4]
call fcn.00404eb4
sub eax, 2
push eax
lea edx, [ebp - 0x4f8]
mov eax, esi
call fcn.00409400
mov eax, dword [ebp - 0x4f8]
mov edx, 3
pop ecx
call fcn.00405114
mov eax, dword [ebp - 0x4f0]
lea edx, [ebp - 0x4ec]
call fcn.00408764
mov edx, dword [ebp - 0x4ec]
mov eax, dword [ebp + 8]
add eax, 0xfffff2f8
mov ecx, 0xff
call fcn.00404e90
mov eax, dword [ebp + 8]
lea edx, [eax - 0xd08]
mov eax, 0x438668
call fcn.00402a80
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jg 0x437951
push 0
push 0x43849c
mov eax, dword [0x47b1d0]
mov edx, 0x438674
call fcn.00409294
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x4383a5
mov eax, dword [ebp + 8]
add eax, 0xfffff1f8
push eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0xd08]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
inc edx
mov eax, dword [ebp + 8]
add eax, 0xfffff2f8
call fcn.00402798
lea eax, [ebp - 0x450]
push eax
mov ecx, dword [ebp - 4]
dec ecx
mov eax, dword [ebp + 8]
add eax, 0xfffff2f8
mov edx, 1
call fcn.00402798
lea edx, [ebp - 0x450]
lea eax, [ebp - 0x500]
call fcn.00404e58
mov eax, dword [ebp - 0x500]
lea edx, [ebp - 0x4fc]
call fcn.00408764
mov edx, dword [ebp - 0x4fc]
mov eax, dword [ebp + 8]
add eax, 0xfffff2f8
mov ecx, 0xff
call fcn.00404e90
mov eax, dword [0x47b1d0]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0x450]
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffff2f8
mov ecx, 1
mov edx, 1
call fcn.00402798
lea eax, [ebp - 0x450]
mov edx, 0x438694
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
jne 0x437a66
lea edx, [ebp - 0x504]
mov eax, dword [0x47b1d0]
call fcn.00409400
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x508]
mov edx, dword [ebp + 8]
add edx, 0xfffff2f8
call fcn.00404e58
mov edx, dword [ebp - 0x508]
pop eax
call fcn.00404ebc
mov edx, dword [ebp - 0x504]
mov eax, dword [ebp + 8]
add eax, 0xfffff2f8
mov ecx, 0xff
call fcn.00404e90
jmp 0x437ada
mov eax, dword [ebp + 8]
lea edx, [eax - 0xd08]
mov eax, 0x43847c
call fcn.00402a80
test eax, eax
jne 0x437ada
lea edx, [ebp - 0x510]
mov eax, dword [0x47b1d0]
call fcn.00409400
push dword [ebp - 0x510]
push 0x4386a0
lea eax, [ebp - 0x514]
mov edx, dword [ebp + 8]
add edx, 0xfffff2f8
call fcn.00404e58
push dword [ebp - 0x514]
lea eax, [ebp - 0x50c]
mov edx, 3
call fcn.00404f74
mov edx, dword [ebp - 0x50c]
mov eax, dword [ebp + 8]
add eax, 0xfffff2f8
mov ecx, 0xff
call fcn.00404e90
lea eax, [ebp - 0x518]
mov edx, dword [ebp + 8]
add edx, 0xfffff2f8
call fcn.00404e58
mov edx, dword [ebp - 0x518]
mov eax, dword [0x47b1d0]
call fcn.00409294
mov edx, dword [0x47b1d0]
mov eax, dword [0x47b1d0]
call fcn.0041bddc
lea edx, [ebp - 0x51c]
mov eax, dword [0x47b1d0]
call fcn.00409400
mov edx, dword [ebp - 0x51c]
mov eax, dword [ebp + 8]
add eax, 0xfffff0f8
mov ecx, 0xff
call fcn.00404e90
mov eax, dword [ebp + 8]
lea edx, [eax - 0xd08]
mov eax, 0x4386a4
call fcn.00402a80
mov edx, dword [ebp + 8]
movzx edx, byte [edx - 0xd08]
sub edx, 9
cmp eax, edx
jne 0x437bb1
mov edx, dword [0x47b378]
lea eax, [ebp - 0x550]
call fcn.00403038
lea edx, [edi + 0x57]
lea eax, [ebp - 0x550]
mov cl, 0x33
call fcn.00403008
lea edx, [ebp - 0x550]
lea eax, [ebp - 0x588]
call fcn.00403038
mov edx, 0x4386b0
lea eax, [ebp - 0x588]
mov cl, 0x37
call fcn.00403008
lea edx, [ebp - 0x588]
mov eax, dword [ebp + 8]
add eax, 0xfffff0f8
call fcn.00403038
mov eax, dword [ebp + 8]
lea edx, [eax - 0xe08]
mov eax, 0x4386b8
call fcn.00402a80
dec eax
jne 0x437e19
lea eax, [ebp - 0x58c]
mov edx, dword [ebp + 8]
add edx, 0xfffff0f8
call fcn.00404e58
mov eax, dword [ebp - 0x58c]
call fcn.00408d38
test al, al
je 0x437cb4
push 0x4386cc
lea eax, [ebp - 0x594]
mov edx, dword [ebp + 8]
add edx, 0xfffff2f8
call fcn.00404e58
push dword [ebp - 0x594]
push 0x4386e0
lea eax, [ebp - 0x598]
mov edx, dword [0x47b5d8]
call fcn.00404e58
push dword [ebp - 0x598]
push 0x4386ec
push 0x4386f8
lea eax, [ebp - 0x590]
mov edx, 6
call fcn.00404f74
mov edx, dword [ebp - 0x590]
mov eax, dword [ebp + 8]
add eax, 0xffffeff8
mov ecx, 0xff
call fcn.00404e90
push 0
push 0x4386fc
push 0x4386fc
push 0x4386fc
mov ecx, dword [0x47b404]
mov eax, dword [ebp + 8]
add eax, 0xffffeff8
xor edx, edx
call fcn.00424674
mov edx, dword [ebp + 8]
mov dword [edx - 0x100c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x100c], 0
jne 0x4383a5
mov eax, dword [edi + 0xc]
call fcn.00424d90
mov edx, dword [ebp + 8]
mov dword [edx - 0x100c], eax
jmp 0x4383a5
push 0x4386cc
lea eax, [ebp - 0x5a0]
mov edx, dword [ebp + 8]
add edx, 0xfffff2f8
call fcn.00404e58
push dword [ebp - 0x5a0]
push 0x4386e0
lea eax, [ebp - 0x5a4]
mov edx, dword [0x47b5d8]
call fcn.00404e58
push dword [ebp - 0x5a4]
push 0x4386ec
push 0x438438
push 0x4386ec
push 0x438708
push 0x4386ec
push 0x438714
lea eax, [ebp - 0x59c]
mov edx, 0xa
call fcn.00404f74
mov edx, dword [ebp - 0x59c]
mov eax, dword [ebp + 8]
add eax, 0xffffeff8
mov ecx, 0xff
call fcn.00404e90
push 0
push 0x4386fc
push 0x4386fc
push 0x4386fc
mov ecx, dword [0x47b404]
mov eax, dword [ebp + 8]
add eax, 0xffffeff8
xor edx, edx
call fcn.00424674
mov edx, dword [ebp + 8]
mov dword [edx - 0x100c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x100c], 0
jne 0x437d81
mov eax, dword [edi + 0xc]
call fcn.00424d90
mov edx, dword [ebp + 8]
mov dword [edx - 0x100c], eax
mov eax, dword [ebp + 8]
mov dword [eax - 0x1008], 0x21205003
push 0
push 0x4386fc
push 0x4386fc
push 0x4386fc
mov ecx, dword [0x47b404]
mov eax, dword [ebp + 8]
add eax, 0xffffeff8
xor edx, edx
call fcn.00424674
mov edx, dword [ebp + 8]
mov dword [edx - 0x100c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x100c], 0
jne 0x437dda
mov eax, dword [edi + 0xc]
call fcn.00424d90
mov edx, dword [ebp + 8]
mov dword [edx - 0x100c], eax
mov eax, dword [ebp + 8]
push dword [eax - 0x1010]
lea eax, [ebp - 0x5a8]
mov edx, dword [ebp + 8]
add edx, 0xfffff0f8
call fcn.00404e58
push dword [ebp - 0x5a8]
push 0x4386e0
mov eax, dword [ebp + 8]
add eax, 0xffffeff0
mov edx, 3
call fcn.00404f74
jmp 0x4383a5
push 0x4386e0
lea eax, [ebp - 0x5b0]
mov edx, dword [ebp + 8]
add edx, 0xfffff0f8
call fcn.00404e58
push dword [ebp - 0x5b0]
push 0x4386e0
lea eax, [ebp - 0x5ac]
mov edx, 3
call fcn.00404f74
mov eax, dword [ebp - 0x5ac]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x1014]
call fcn.0040519c
test eax, eax
jg 0x4383a5
mov eax, dword [ebp + 8]
mov byte [eax - 0x1015], 0
push 0x4386e0
lea eax, [ebp - 0x5b8]
mov edx, dword [ebp + 8]
add edx, 0xfffff0f8
call fcn.00404e58
push dword [ebp - 0x5b8]
push 0x4386e0
lea eax, [ebp - 0x5b4]
mov edx, 3
call fcn.00404f74
mov eax, dword [ebp - 0x5b4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x101c]
call fcn.0040519c
test eax, eax
jne 0x437f03
mov eax, dword [ebp + 8]
push dword [eax - 0x101c]
lea eax, [ebp - 0x5bc]
mov edx, dword [ebp + 8]
add edx, 0xfffff0f8
call fcn.00404e58
push dword [ebp - 0x5bc]
push 0x4386e0
mov eax, dword [ebp + 8]
add eax, 0xffffefe4
mov edx, 3
call fcn.00404f74
mov eax, dword [ebp + 8]
mov byte [eax - 0x1015], 1
lea eax, [ebp - 0x5c0]
mov edx, dword [ebp + 8]
add edx, 0xfffff0f8
call fcn.00404e58
mov edx, dword [ebp - 0x5c0]
mov eax, dword [ebp + 8]
add eax, 0xffffee18
call fcn.00402e0c
mov eax, dword [ebp + 8]
cmp byte [eax - 0x1015], 0
je 0x437f45
mov eax, dword [ebp + 8]
add eax, 0xffffee18
call fcn.00402b9c
jmp 0x437f52
mov eax, dword [ebp + 8]
add eax, 0xffffee18
call fcn.00402ba8
call fcn.00402874
test eax, eax
je 0x43803b
lea eax, [ebp - 0x5c8]
mov edx, dword [ebp + 8]
add edx, 0xfffff0f8
call fcn.00404e58
mov eax, dword [ebp - 0x5c8]
lea edx, [ebp - 0x5c4]
call fcn.00408ff0
mov eax, dword [ebp - 0x5c4]
call fcn.00408d6c
mov eax, dword [ebp + 8]
add eax, 0xffffee18
call fcn.00402b9c
call fcn.00402874
test eax, eax
je 0x43803b
push 0
push 0x43849c
push 0x438720
lea eax, [ebp - 0x5d0]
mov edx, dword [ebp + 8]
add edx, 0xfffff0f8
call fcn.00404e58
push dword [ebp - 0x5d0]
push 0x43873c
lea eax, [ebp - 0x5cc]
mov edx, 3
call fcn.00404f74
mov edx, dword [ebp - 0x5cc]
mov eax, dword [0x47b1d0]
call fcn.00409294
push eax
push 0
call sub.user32.dll_MessageBoxA_1
mov eax, dword [ebp + 8]
push dword [eax - 0x1014]
lea eax, [ebp - 0x5d4]
mov edx, dword [ebp + 8]
add edx, 0xfffff0f8
call fcn.00404e58
push dword [ebp - 0x5d4]
push 0x4386e0
mov eax, dword [ebp + 8]
add eax, 0xffffefec
mov edx, 3
call fcn.00404f74
jmp 0x4383a5
lea eax, [ebp - 0x450]
push eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0xe08]
mov eax, dword [ebp + 8]
add eax, 0xfffff1f8
mov ecx, 1
call fcn.00402798
lea eax, [ebp - 0x450]
mov edx, 0x43874c
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
jne 0x4380b5
lea eax, [ebp - 0x450]
push eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0xe08]
dec ecx
mov eax, dword [ebp + 8]
add eax, 0xfffff1f8
mov edx, 1
call fcn.00402798
lea edx, [ebp - 0x450]
mov eax, dword [ebp + 8]
add eax, 0xffffee18
call fcn.00403848
call fcn.00402ec8
jmp 0x4380d0
mov eax, dword [ebp + 8]
lea edx, [eax - 0xe08]
mov eax, dword [ebp + 8]
add eax, 0xffffee18
call fcn.00403848
call fcn.00403854
call fcn.00402874
test eax, eax
mov eax, dword [ebp + 8]
add eax, 0xffffee18
call fcn.00402fb0
call fcn.00402874
test eax, eax
jmp 0x4383a5
cmp byte [ebx], 0x4e
jne 0x438358
cmp byte [ebx + 1], 0x3a
jne 0x438358
mov dword [ebp - 4], 1
push 0
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 4]
lea eax, [edi + 0x60]
mov edx, 2
call fcn.0041a41c
lea edx, [ebp - 0x450]
lea eax, [ebp - 0x23c]
mov cl, 0xa
call fcn.00403044
lea edx, [ebp - 0x5dc]
mov eax, esi
call fcn.00409400
mov eax, dword [ebp - 0x5dc]
lea edx, [ebp - 0x5d8]
call fcn.00408764
mov edx, dword [ebp - 0x5d8]
lea eax, [ebp - 0x450]
mov ecx, 0xff
call fcn.00404e90
lea edx, [ebp - 0x450]
mov eax, dword [ebp + 8]
add eax, 0xffffed1d
mov cl, 0xfa
call fcn.00403044
mov eax, dword [ebp + 8]
lea edx, [eax - 0x12e3]
mov eax, 0x438750
call fcn.00402a80
push eax
mov eax, dword [ebp + 8]
lea edx, [eax - 0x12e3]
mov eax, 0x43875c
call fcn.00402a80
pop edx
add edx, eax
test edx, edx
jle 0x43825d
lea eax, [ebp - 0x6d8]
push eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x12e3]
mov eax, dword [ebp + 8]
add eax, 0xffffed1d
mov ecx, 1
call fcn.00402798
lea eax, [ebp - 0x6d8]
mov edx, 0x438768
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
jne 0x43825d
lea eax, [ebp - 0x6e0]
mov edx, dword [ebp + 8]
add edx, 0xffffed1d
call fcn.00404e58
push dword [ebp - 0x6e0]
lea eax, [ebp - 0x6e4]
lea edx, [ebp - 0x23c]
call fcn.00404e58
push dword [ebp - 0x6e4]
push 0x438774
lea eax, [ebp - 0x6dc]
mov edx, 3
call fcn.00404f74
mov edx, dword [ebp - 0x6dc]
lea eax, [ebp - 0x450]
mov ecx, 0xff
call fcn.00404e90
lea edx, [ebp - 0x450]
mov eax, dword [ebp + 8]
add eax, 0xffffed1d
mov cl, 0xfa
call fcn.00403044
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x12e3]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x12e8]
lea eax, [edi + 0x437]
call fcn.00427a90
test al, al
jne 0x4383a5
mov eax, dword [edi + 0x44f]
mov edx, 5
call fcn.004102a8
mov byte [edi + 0x6fd], 1
mov eax, esi
call fcn.004091fc
cmp eax, 7
jb 0x438358
mov dword [ebp - 4], 2
lea eax, [ebp - 0x31]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov al, byte [ebx + eax]
call fcn.00402aec
mov edx, dword [ebp - 0x1c]
mov byte [edx], al
inc dword [ebp - 4]
inc dword [ebp - 0x1c]
cmp dword [ebp - 4], 7
jne 0x4382b6
mov byte [ebp - 0x2c], 0
mov edx, 0x438778
lea eax, [ebp - 0x31]
call fcn.004092d4
test eax, eax
jne 0x438358
mov dword [ebp - 4], 7
jmp 0x4382f3
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp byte [ebx + eax], 0x20
je 0x4382f0
xor eax, eax
jmp 0x43830e
mov edx, dword [ebp - 4]
mov dl, byte [ebx + edx]
mov byte [ebp + eax - 0x31], dl
inc dword [ebp - 4]
inc eax
cmp eax, 0x13
jg 0x43831c
mov edx, dword [ebp - 4]
cmp byte [ebx + edx], 0
jne 0x438300
mov byte [ebp + eax - 0x31], 0
mov eax, dword [0x47b408]
cmp byte [eax + 0x18], 0xff
je 0x438337
lea edx, [ebp - 0x31]
lea eax, [ebp - 0x31]
call fcn.0041bddc
lea edx, [ebp - 0x31]
mov eax, dword [edi + 0x44f]
call fcn.00410568
mov eax, esi
call fcn.004091fc
mov edx, eax
inc edx
mov eax, esi
call fcn.004026a8
jmp 0x4383a5
mov eax, dword [edi + 0x43b]
call fcn.0040f174
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 0x12e8]
jle 0x43838f
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x12e8]
push eax
push 0x19a
mov eax, dword [edi + 0x43b]
mov eax, dword [eax + 0xc]
push eax
call sub.user32.dll_SendMessageA
jmp 0x43839c
mov eax, dword [edi + 0x43b]
mov edx, esi
call fcn.0040f0e4
mov eax, dword [ebp + 8]
inc dword [eax - 0x12e8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43840a
lea eax, [ebp - 0x6e4]
mov edx, 3
call fcn.00404c18
lea eax, [ebp - 0x5dc]
mov edx, 0x15
call fcn.00404c18
lea eax, [ebp - 0x51c]
mov edx, 0x23
call fcn.00404c18
lea eax, [ebp - 0x48c]
mov edx, 0xf
call fcn.00404c18
lea eax, [ebp - 0x350]
mov edx, 5
call fcn.00404c18
ret