Function at 0x420904
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3d4
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x42238d
lea eax, [ebp + 0x10]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1b4], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x204], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
movzx eax, byte [eax]
test eax, eax
je 0x422289
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x180]
movzx eax, byte [eax]
test eax, eax
je 0x420997
push 0xda0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x422284
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x30], 0xe76f5020
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x10], 0
jmp 0x4209be
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x4209d4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x170], 0xdc85
jmp 0x4209b7
mov dword [ebp - 0x10], 0
jmp 0x4209e4
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x4209fa
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2c0], 1
jmp 0x4209dd
mov dword [ebp - 0x30], 3
jmp 0x420a0a
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x420e92
mov dword [ebp - 8], 1
mov dword [ebp - 0xa0], 4
mov dword [ebp - 0x15c], 0xddfdaf0b
mov dword [ebp - 0x238], 0xffff
mov dword [ebp - 0x190], 3
mov dword [ebp - 8], 3
jmp 0x420a53
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x420e66
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x94], 0x20b2de47
mov dword [ebp - 0x24], 3
jmp 0x420a7e
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x420aa3
mov byte [ebp - 0x2a], 0
push 1
push 0x32c5
push 0
push 0
push 1
lea eax, [ebp - 0x2a]
push eax
call fcn.0040e379
add esp, 0x18
jmp 0x420a77
mov eax, 0x4b7c7008
test eax, eax
je 0x420b96
xor eax, eax
inc eax
je 0x420ac7
cmp dword [ebp - 0x30], 0
je 0x420ac7
mov dword [ebp - 0xb4], 1
jmp 0x420ace
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xb4], eax
jge 0x420ae5
mov dword [ebp - 0xa8], 1
jmp 0x420aec
and dword [ebp - 0xa8], 0
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x170]
cmp dword [ebp - 0x24], eax
jne 0x420b10
mov dword [ebp - 0xb0], 1
jmp 0x420b17
and dword [ebp - 0xb0], 0
cmp dword [ebp - 0xb0], 0x5c6a
jne 0x420b2f
mov dword [ebp - 0x10c], 1
jmp 0x420b36
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0x30]
cmp eax, 0xe712c519
jne 0x420b5e
mov dword [ebp - 0x98], 1
jmp 0x420b65
and dword [ebp - 0x98], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x98]
mov dword [ebp + eax - 0x2c0], ecx
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x170]
add eax, dword [ebp - 0x98]
je 0x420b96
mov dword [ebp - 0xbc], 1
jmp 0x420b9d
and dword [ebp - 0xbc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x170]
cmp dword [ebp - 0xbc], eax
jg 0x420bbd
mov dword [ebp - 0x14c], 1
jmp 0x420bc4
and dword [ebp - 0x14c], 0
cmp dword [ebp - 0x14c], 0x9b34
jne 0x420bdc
mov dword [ebp - 0x188], 1
jmp 0x420be3
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x170]
mov dword [ebp - 0x34c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x170]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x170]
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x28], 0xdfa90ef8
cmp dword [ebp - 0x28], 0
je 0x420e1b
push 1
lea ecx, [ebp - 0x268]
call fcn.0043486b
mov dword [ebp - 0x54], 0xcf9e8bfa
mov dword [ebp - 0x78], 0
jmp 0x420c5d
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x420c76
push dword [ebp - 0x78]
lea ecx, [ebp - 0x268]
call fcn.00434959
or dword [eax], 0xffffffff
jmp 0x420c56
push 0
lea ecx, [ebp - 0x268]
call fcn.00434959
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc4]
mov dword [ecx], eax
cmp dword [ebp - 0x54], 0xffffffff
jbe 0x420cac
mov dword [ebp - 0xd4], 1
jmp 0x420cb3
and dword [ebp - 0xd4], 0
cmp dword [ebp - 0x54], 0x3d35555d
jne 0x420cd4
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2c0], 0
jne 0x420cd4
and dword [ebp - 0x114], 0
jmp 0x420cde
mov dword [ebp - 0x114], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c0]
imul eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x54]
jg 0x420d03
mov dword [ebp - 0xcc], 1
jmp 0x420d0a
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0xcc]
add eax, 0x3e27
jne 0x420d29
cmp dword [ebp - 0xa0], 0
jne 0x420d29
and dword [ebp - 0x13c], 0
jmp 0x420d33
mov dword [ebp - 0x13c], 1
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x170]
add eax, dword [ebp - 0x13c]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x94], eax
jle 0x420d60
mov dword [ebp - 0x11c], 1
jmp 0x420d67
and dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x11c]
jle 0x420d81
mov dword [ebp - 0xdc], 1
jmp 0x420d88
and dword [ebp - 0xdc], 0
cmp dword [ebp - 0xdc], 0xfff6
jne 0x420da0
mov dword [ebp - 0xe4], 1
jmp 0x420da7
and dword [ebp - 0xe4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2c0]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
add eax, dword [ebp - 0xe4]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x170]
jne 0x420de1
mov dword [ebp - 0x124], 1
jmp 0x420de8
and dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x1d], 0
push 0
lea eax, [ebp - 0x1d]
push eax
push 0
push 0
push 1
push 0x7d09
call fcn.0040e379
add esp, 0x18
lea ecx, [ebp - 0x268]
call fcn.0043493d
jmp 0x420e61
mov dword [ebp - 0x1f8], 1
lea eax, [ebp - 0x238]
push eax
push 1
push 0x1842
lea eax, [ebp - 0x24]
push eax
push 0x7bb3
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x1f8]
push eax
push 0
call fcn.0040cc1d
add esp, 0x2c
jmp 0x420a4c
mov dword [ebp - 0x28], 3
jmp 0x420e76
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x420e8d
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x170], 0
je 0x420e8b
jmp 0x420e8d
jmp 0x420e6f
jmp 0x420a03
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x60]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0xc], eax
push 3
lea ecx, [ebp - 0x280]
call fcn.0043486b
mov dword [ebp - 0x4c], 0x7df2f4a8
mov dword [ebp - 0xec], 0xffffffff
mov dword [ebp - 0x174], 0xe24b2e80
push 0x7c74
push 0x67a2
push 0x58ad
push 1
push 0x3332
push 0
push 0x35bb
push 0x2d99
push 0x34f
lea eax, [ebp - 0x334]
push eax
push 0x2813
push 0x5fc7
push 0x2c38
lea eax, [ebp - 0x280]
push eax
push 0x44ef
push 0x6b7d
push 0x3168
push 1
call fcn.00423a72
add esp, 0x48
mov dword [ebp - 0x4c], 2
jmp 0x420f3c
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x4210d8
mov dword [ebp - 0x25c], 0xf0ef
mov dword [ebp - 0x258], 0xf0ef
mov dword [ebp - 0x254], 0xf0ef
mov dword [ebp - 0x250], 0xf0ef
lea ecx, [ebp - 0x8d]
call fcn.00434968
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x3a0]
call fcn.0043496b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x364]
call fcn.00434917
mov dword [ebp - 0x198], 0
push 2
lea ecx, [ebp - 0x2a4]
call fcn.0043486b
push 1
push 0
push 1
push 0x4ff1
push 0
lea eax, [ebp - 0x2a4]
push eax
push 0xedf
push 0
push 0x61a
lea eax, [ebp - 0x33c]
push eax
push 0x6a46
call fcn.00420764
add esp, 0x2c
push 0x6a7d
push 1
push 0x115f
push 0x28b7
push 0xc08
push 0x129a
push 0x1f9d
push 0x5d59
push 1
push 0x3d90
push 0x39ad
push 0x762a
lea eax, [ebp - 0xec]
push eax
push 1
push 0x286c
push 1
push 0x6fa2
push 0
push 0x293b
push 0x65f
push 0xaa5
call fcn.004199db
add esp, 0x54
push 0x3291
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x364]
push eax
push 1
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x174]
push eax
push 0x6502
push 1
push 0x7718
push 0x3ba0
push 0x4f63
push 0x3e00
push 0x4a4b
push 0
push 0x390a
lea eax, [ebp - 0x4c]
push eax
push 0
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0xec]
push eax
push 0x1db
call fcn.0041a100
add esp, 0x50
lea ecx, [ebp - 0x2a4]
call fcn.0043493d
lea ecx, [ebp - 0x364]
call fcn.0043493d
jmp 0x420f35
lea ecx, [ebp - 0x280]
call fcn.0043493d
and dword [ebp - 0x9c], 0
jmp 0x421102
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0xc]
add eax, 0x28
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x9c], eax
jge 0x422284
mov dword [ebp - 0x1a0], 0xfffffffb
push 1
lea ecx, [ebp - 0x2b0]
call fcn.0043486b
mov dword [ebp - 0x40], 0
jmp 0x42113e
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x421154
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x3c8], 0xba2a
jmp 0x421137
lea eax, [ebp - 0x40]
push eax
push 1
push 0x4b2e
lea eax, [ebp - 0x2b0]
push eax
push 0x2679
push 0x1596
push 0x28c0
push 0
push 0x663d
push 0
push 0
push 0x1a31
push 0x7c1b
push 0x264
call fcn.00416476
add esp, 0x38
push 0
push 0x7180
push 0x32d5
push 0x22c5
push 0x4443
lea eax, [ebp - 0x1a0]
push eax
push 1
push 0
push 1
push 0
push 0x3b36
lea eax, [ebp - 0x2b0]
push eax
push 0x510c
call fcn.0041fce5
add esp, 0x34
lea ecx, [ebp - 0x2b0]
call fcn.0043493d
mov dword [ebp - 0x344], 0
mov dword [ebp - 0x2c4], 0xc8094a18
mov dword [ebp - 0x354], 1
mov dword [ebp - 0x37c], 1
mov dword [ebp - 0x384], 0xfe5f36f6
mov dword [ebp - 0x2f8], 0x34d0069
mov dword [ebp - 0x2cc], 0xfffffffb
mov dword [ebp - 0x358], 0x923607a9
mov dword [ebp - 0x2d4], 0xcef054a2
mov dword [ebp - 0x338], 0xfffffffd
mov dword [ebp - 0x2dc], 9
mov dword [ebp - 0x2f4], 0xfffffffd
mov dword [ebp - 0x2e4], 0x868bb4a
mov dword [ebp - 0x2fc], 0
mov dword [ebp - 0x2f0], 0
mov dword [ebp - 0x304], 0xc3837ace
mov dword [ebp - 0x30c], 0x82ca9683
mov dword [ebp - 0x388], 0
mov dword [ebp - 0x300], 0xe637c5b1
mov dword [ebp - 0x340], 0xd13d8c53
mov dword [ebp - 0x308], 0xea7eb8e1
mov dword [ebp - 0x368], 0x20c4365d
mov dword [ebp - 0x310], 1
mov dword [ebp - 0x348], 0x2a42bbd4
mov dword [ebp - 0x318], 1
mov dword [ebp - 0x380], 0x6a37bd55
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x320], 0xfffffffe
mov dword [ebp - 0x68], 0
jmp 0x421308
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x42131e
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x3a8], 0xffffffff
jmp 0x421301
push 1
push 1
push 1
push 0x6953
push 0
push 0x4ad4
push 0x43ec
push 0
lea eax, [ebp - 0x200]
push eax
push 0x6090
push 0x3a32
call fcn.00420764
add esp, 0x2c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
and eax, 0x20000000
je 0x421369
mov dword [ebp - 0x144], 1
jmp 0x421370
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x7c], 7
push 2
lea ecx, [ebp - 0x298]
call fcn.0043486b
push 1
push 0x74b9
push 0
push 1
push 0x2b2f
push 0
push 0x3395
push 0x37b7
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x298]
push eax
push 0x70d9
push 0x5636
call fcn.004290c3
add esp, 0x30
mov dword [ebp - 0x44], 0
jmp 0x4213d9
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x4213ef
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x2ec], 0xfffffffc
jmp 0x4213d2
mov dword [ebp - 0x7c], 0xfffffffb
jmp 0x4213ff
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xfffffff5
jl 0x421517
mov dword [ebp - 0x38], 0x1e2c0d37
mov dword [ebp - 0x38], 0
jmp 0x421420
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jg 0x4214fb
mov dword [ebp - 0x1c], 0x3e64f147
mov dword [ebp - 0x1c], 1
jmp 0x421441
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x421497
mov dword [ebp - 0x1a8], 8
push 1
push 0x1c47
push 0
lea eax, [ebp - 0x1c]
push eax
push 0x7395
push 0x7fa
push 1
push 0x16b9
lea eax, [ebp - 0x298]
push eax
push 1
lea eax, [ebp - 0x1a8]
push eax
push 0
push 0
push 0xf4f
push 0x651a
call fcn.0042b93f
add esp, 0x3c
jmp 0x42143a
mov dword [ebp - 0x1c], 1
jmp 0x4214a7
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x4214f6
mov byte [ebp - 0x2b], 0
movzx eax, byte [ebp - 0x2b]
test eax, eax
je 0x4214f4
push 0x7c98
push 1
push 0x3a88
push 0x7bc2
push 1
push 0x13fd
push 0x2d64
push 0
push 0x48bc
push 0x7664
push 0x1fc4
push 0x5a0c
call fcn.0040cf41
add esp, 0x30
jmp 0x4214a0
jmp 0x421419
mov dword [ebp - 0x38], 0xffffffff
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x38]
mov dword [ebp + eax - 0x2ec], ecx
jmp 0x4213f8
lea ecx, [ebp - 0x298]
call fcn.0043493d
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
and eax, 0x40000000
je 0x42153b
mov dword [ebp - 0xf4], 1
jmp 0x421542
and dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x22c], 0xfffffffb
push 1
lea ecx, [ebp - 0x274]
call fcn.0043486b
mov dword [ebp - 0x48], 0
jmp 0x421575
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x42158b
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x3d4], 0xba2a
jmp 0x42156e
push 1
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x274]
push eax
push 0
push 0
call fcn.00414ce4
add esp, 0x14
push 0x139
push 1
push 1
push 0x78d1
push 0x4cac
push 0x3c4f
lea eax, [ebp - 0x274]
push eax
push 0
push 0x55ac
push 0
lea eax, [ebp - 0x22c]
push eax
push 0x270
push 0x636
push 1
call fcn.00410d33
add esp, 0x38
lea ecx, [ebp - 0x274]
call fcn.0043493d
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
and eax, 0x80000000
je 0x42160b
mov dword [ebp - 0x12c], 1
jmp 0x421612
and dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x1c0], eax
push 0x5e1e
push 0
push 1
push 0x68fb
push 1
push 0x38f1
push 0x382c
call fcn.00409501
add esp, 0x1c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
and eax, 0x2000000
je 0x42186a
push 0x4000
mov eax, dword [ebp - 0xc]
push dword [eax + 0x10]
mov eax, dword [ebp - 0xc]
push dword [eax + 8]
push 0x56f
push 0x43d
call fcn.00407069
pop ecx
pop ecx
call eax
mov dword [ebp - 0x70], 1
mov dword [ebp - 0x70], 0
jmp 0x42168c
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xfffffffd
jle 0x421865
mov dword [ebp - 0x84], 0xffffffff
mov dword [ebp - 0x208], 0x7fe64fd9
mov byte [ebp - 0x29], 0
push 0x3169
push 0x6f4b
lea eax, [ebp - 0x29]
push eax
push 0x517
push 0x3090
push 1
push 1
push 1
push 0x5c2b
push 0x62d0
push 0x1c1a
call fcn.00408601
add esp, 0x2c
mov dword [ebp - 0x84], 0
jmp 0x4216fc
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xfffffff5
jle 0x421860
push 1
lea ecx, [ebp - 0x374]
call fcn.0043486b
push 4
lea ecx, [ebp - 0x214]
call fcn.0043486b
push 0x571a
push 0
push 0x69fa
push 0x3e1c
lea eax, [ebp - 0x374]
push eax
push 0x2f53
lea eax, [ebp - 0x1b0]
push eax
push 0x63c7
push 1
push 0x57e6
push 0x3949
push 0
push 0x3103
push 0x4913
push 0x6a5
call fcn.00413072
add esp, 0x3c
push 0x30b6
push 0
lea eax, [ebp - 0x214]
push eax
push 0x273e
lea eax, [ebp - 0x1b0]
push eax
call fcn.00423ac1
add esp, 0x14
push 1
lea ecx, [ebp - 0x214]
call fcn.00434959
and dword [eax], 0
jmp 0x4217c9
push 1
lea ecx, [ebp - 0x214]
call fcn.00434959
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xfc]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x214]
call fcn.00434959
cmp dword [eax], 0
jg 0x421845
push 0x4bd1
push 0x1cea
push 0x2663
push 1
push 0x5f54
push 0x4963
push 1
push 0
call fcn.004285ea
add esp, 0x20
lea eax, [ebp - 0x208]
push eax
push 0x2d6c
push 0x2bb9
push 0x790a
push 0x4e39
push 0x39fd
push 0x24ed
push 0x16ec
push 0x4aa0
push 0
push 0x74b9
call fcn.00428023
add esp, 0x2c
jmp 0x4217a5
lea ecx, [ebp - 0x214]
call fcn.0043493d
lea ecx, [ebp - 0x374]
call fcn.0043493d
jmp 0x4216ef
jmp 0x421685
jmp 0x4210ec
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x5c], 0
jmp 0x421884
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x42189a
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x3bc], 0xeac8b13e
jmp 0x42187d
mov dword [ebp - 0x8c], 0
jmp 0x4218b3
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jg 0x42190f
mov dword [ebp - 0x1b8], 0xffffffff
push 0x6fe5
push 0x70ab
push 0x53a6
push 0xd9f
push 1
push 0x7130
push 0x6756
push 0x6385
push 0x4a06
push 1
lea eax, [ebp - 0x1b8]
push eax
push 0x4e8a
push 0x5643
push 0
call fcn.0040d0f6
add esp, 0x38
jmp 0x4218a6
push 1
push 0x7ab1
push 1
push 1
push 0x79a9
push 0xa51
push 0
push 0x2939
call fcn.00410c1d
add esp, 0x20
push 0x637d
lea eax, [ebp - 0x234]
push eax
push 0x34dc
push 0x65a8
push 0
lea eax, [ebp - 0x1c0]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x19c]
push eax
push 0x255e
push 1
push 0x1487
push 0x15fb
lea eax, [ebp - 0xc]
push eax
push 0
call fcn.0040d0f6
add esp, 0x38
mov dword [ebp - 0x350], 1
mov dword [ebp - 0x328], 0xac9d73df
mov dword [ebp - 0x378], 0
mov dword [ebp - 0x154], 0xd0e72ee7
mov dword [ebp - 0x1c8], 0xcbb24adc
mov dword [ebp - 0x80], 0
jmp 0x4219c1
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x4219d7
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x3b0], 0x72a8
jmp 0x4219ba
mov dword [ebp - 0x154], 1
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x1c8], eax
push 0x32be
push 1
push 0x4c88
lea eax, [ebp - 0x60]
push eax
push 1
lea eax, [ebp - 0x160]
push eax
push 0x320e
push 1
push 0x1d5
push 0x1248
lea eax, [ebp - 0xc]
push eax
push 0x1c
push 0x4b0e
push 0
push 0x2748
push 1
push 0x7620
push 0x202d
push 0x67e5
push 0x2936
push 0x7936
push 0x175a
push 0x154d
call fcn.0042a87d
add esp, 0x5c
mov dword [ebp - 0x14], 0xd133f29
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x228], 0xfffffffb
mov dword [ebp - 0x248], 0xc8d2
mov dword [ebp - 0x64], 0
jmp 0x421a96
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x421aa9
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 4], 0x1c7bf0b9
jmp 0x421a8f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
mov dword [ebp - 0x330], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 4], 0xa17d0b0a
jbe 0x421ad4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 4], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 4]
cmp dword [ebp + eax - 4], ecx
jl 0x421af6
mov dword [ebp - 0x104], 1
jmp 0x421afd
and dword [ebp - 0x104], 0
mov eax, dword [ebp - 0x104]
add eax, 0x302993b6
jne 0x421b18
or eax, 0xffffffff
jne 0x421b18
and dword [ebp - 0x134], 0
jmp 0x421b22
mov dword [ebp - 0x134], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x134]
sub ecx, dword [ebp + eax - 4]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jg 0x421b47
mov dword [ebp - 0xac], 1
jmp 0x421b4e
and dword [ebp - 0xac], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0xac]
sub edx, dword [ebp + ecx - 4]
cmp dword [ebp + eax - 4], edx
jge 0x421b83
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 4], 0
je 0x421b83
mov dword [ebp - 0xb8], 1
jmp 0x421b8a
and dword [ebp - 0xb8], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 4]
add ecx, dword [ebp - 0xb8]
cmp dword [ebp + eax - 4], ecx
jne 0x421bb2
mov dword [ebp - 0xc0], 1
jmp 0x421bb9
and dword [ebp - 0xc0], 0
cmp dword [ebp - 0xc0], 0x8fdadf86
ja 0x421bd1
mov dword [ebp - 0xc8], 1
jmp 0x421bd8
and dword [ebp - 0xc8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
cmp dword [ebp - 0xc8], eax
jg 0x421bf6
mov dword [ebp - 0xd0], 1
jmp 0x421bfd
and dword [ebp - 0xd0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd0]
sub ecx, dword [ebp + eax - 4]
cmp ecx, dword [ebp - 0x34]
jl 0x421e47
mov dword [ebp - 0x1d0], 0xffffffff
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x14], 0x18
jmp 0x421c37
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 6
je 0x421e1e
mov dword [ebp - 0x23c], 0xb06a83cd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 4], 0
je 0x421c5d
jmp 0x421e1e
mov dword [ebp - 0x34], 0x1c
jmp 0x421c6d
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 9
jl 0x421e19
mov dword [ebp - 0x110], 0xfffffffa
mov dword [ebp - 0x128], 0x43ad33dc
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x23c], eax
jne 0x421ca2
mov dword [ebp - 0xd8], 1
jmp 0x421ca9
and dword [ebp - 0xd8], 0
cmp dword [ebp - 0xd8], 0xfffffffe
jg 0x421cbe
mov dword [ebp - 0xe0], 1
jmp 0x421cc5
and dword [ebp - 0xe0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
cmp eax, dword [ebp - 0xe0]
jne 0x421ce3
mov dword [ebp - 0xe8], 1
jmp 0x421cea
and dword [ebp - 0xe8], 0
cmp dword [ebp - 0xe8], 0xe85d
je 0x421d02
mov dword [ebp - 0xf0], 1
jmp 0x421d09
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x110]
imul ecx, dword [ebp - 0xf0], 0x2c75
imul eax, ecx
test eax, eax
jne 0x421d2c
mov dword [ebp - 0xf8], 1
jmp 0x421d33
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0xf8]
add eax, 0xaea1
cmp eax, 0xfffffff8
jge 0x421d4f
mov dword [ebp - 0x100], 1
jmp 0x421d56
and dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x100]
jg 0x421d76
mov dword [ebp - 0x108], 1
jmp 0x421d7d
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x421da1
cmp dword [ebp - 0x110], 0
je 0x421da1
mov dword [ebp - 0x118], 1
jmp 0x421da8
and dword [ebp - 0x118], 0
mov eax, dword [ebp - 0x118]
shl eax, 1
imul eax, eax, 0xac8e
add eax, 0x32a3f0b1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0
jmp 0x421dce
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x421e14
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 4]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 4]
cmp eax, dword [ebp - 0x6c]
jl 0x421df6
mov dword [ebp - 0x120], 1
jmp 0x421dfd
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x50], eax
jmp 0x421dc7
jmp 0x421c66
jmp 0x421c30
mov byte [ebp - 0x2c], 0
push 1
push 1
push 0x5855
lea eax, [ebp - 0x2c]
push eax
push 0x3a5e
push 1
push 0
push 0x3fde
call fcn.00420904
add esp, 0x20
jmp 0x421e9b
push 0x5e00
push 0x6aaa
push 0x2c53
push 0x45c4
push 1
push 0x3593
push 0
push 1
push 0x7987
push 0x7101
push 0x7bb9
push 0x4aea
push 1
push 1
push 0xefb
push 1
push 0x72e9
lea eax, [ebp - 0x50]
push eax
push 0x79d4
call fcn.00410121
add esp, 0x4c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
add eax, dword [ebp - 0x228]
jne 0x421f5a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 4], 0xfffffffe
je 0x421eca
mov dword [ebp - 0x140], 1
jmp 0x421ed1
and dword [ebp - 0x140], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 4], 0xffffffff
je 0x421eea
mov dword [ebp - 0x130], 1
jmp 0x421ef1
and dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x421f11
xor eax, eax
inc eax
je 0x421f11
mov dword [ebp - 0x138], 1
jmp 0x421f18
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x140], eax
jle 0x421f38
mov dword [ebp - 0x1d8], 1
jmp 0x421f3f
and dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x248], 0
jne 0x421f5a
and dword [ebp - 0x148], 0
jmp 0x421f64
mov dword [ebp - 0x148], 1
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x160], 0
jbe 0x42227f
mov dword [ebp - 0x150], 1
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x1e0], 0x28d9ba5f
push 1
lea ecx, [ebp - 0x224]
call fcn.0043486b
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x2d0], 0xffffffff
mov dword [ebp - 0x74], 0
jmp 0x421fc3
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x421fdf
push dword [ebp - 0x74]
lea ecx, [ebp - 0x224]
call fcn.00434959
mov dword [eax], 3
jmp 0x421fbc
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x42210e
mov dword [ebp - 0x158], 0xbd0a7084
mov dword [ebp - 0x244], 0xfffffffb
mov dword [ebp - 0x1e8], 9
mov dword [ebp - 0x178], 0xc295
push 0x5640
lea eax, [ebp - 0x3c]
push eax
push 0x2f6b
push 0x1f28
push 1
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x158]
push eax
push 0x4f65
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x244]
push eax
push 0x3f64
lea eax, [ebp - 0x58]
push eax
push 0
push 1
lea eax, [ebp - 0x1e8]
push eax
push 0
push 0x5744
push 1
push 0x32a6
push 0x3a64
push 1
push 0x2691
push 0x24bc
push 0x6a61
push 0x2dd
push 0x39b0
push 0x1026
push 0x7589
push 0x2c72
call fcn.00422576
add esp, 0x78
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x58]
push eax
push 0x7b8f
push 1
lea eax, [ebp - 0x224]
push eax
push 0x65b
push 0x1db
push 0
push 1
push 0x5ec1
push 0x4fe8
lea eax, [ebp - 0x178]
push eax
push 0xb5b
push 0x22bd
push 0x5ad
push 0x8a1
push 0x2e2c
call fcn.004128ac
add esp, 0x44
jmp 0x422248
mov dword [ebp - 0x17c], 0xfffffffe
mov dword [ebp - 0x18c], 0x40c8e82
mov dword [ebp - 0x184], 0xdc4d7e3c
push 2
lea ecx, [ebp - 0x28c]
call fcn.0043486b
push 0
push 0x2826
lea eax, [ebp - 0x28c]
push eax
push 0x7aa6
push 0x2c36
lea eax, [ebp - 0x2d8]
push eax
push 1
push 1
call fcn.0042d4c9
add esp, 0x20
mov dword [ebp - 0x3c], 0
jmp 0x422174
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x42223d
mov dword [ebp - 0x194], 4
mov dword [ebp - 0x398], 1
mov dword [ebp - 0x394], 1
mov dword [ebp - 0x390], 1
mov dword [ebp - 0x38c], 1
mov dword [ebp - 0xa4], 0xe429b053
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
push 0x1252
lea eax, [ebp - 0x58]
push eax
push 1
lea eax, [ebp - 0x224]
push eax
push 0x6d59
lea eax, [ebp - 0x3c]
push eax
push 1
push 0
lea eax, [ebp - 0x28c]
push eax
push 0x58b4
push 0x7e17
push 0
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x18c]
push eax
push 0x45bb
lea eax, [ebp - 0x194]
push eax
push 0x23f
push 0x76d0
push 0x3409
call fcn.00416a7c
add esp, 0x54
jmp 0x42216d
lea ecx, [ebp - 0x28c]
call fcn.0043493d
lea ecx, [ebp - 0x224]
call fcn.0043493d
lea eax, [ebp - 0x2e0]
push eax
push dword [ebp - 0x19c]
push dword [ebp - 0x160]
mov eax, dword [ebp - 0xc]
push dword [eax + 8]
push 0x56f
push 0x4c5
call fcn.00407069
pop ecx
pop ecx
call eax
jmp 0x4210ec
jmp 0x42238b
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x1bc]
movzx eax, byte [eax]
test eax, eax
je 0x4222ef
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1d4]
movzx eax, byte [eax]
test eax, eax
je 0x4222ea
push 0
push 0
call fcn.0040e95f
pop ecx
pop ecx
jmp 0x42238b
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
mov dword [eax], 0x1b
jmp 0x422326
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x88]
mov dword [ecx], eax
mov eax, dword [ebp - 0x88]
cmp dword [eax], 9
jle 0x42238b
mov dword [ebp - 0x1f4], 0x50c19791
mov dword [ebp - 0x1ec], 0xdb956746
lea eax, [ebp - 0x1ec]
push eax
push 0x524f
push 0x627a
push 0x1084
lea eax, [ebp - 0x1f4]
push eax
push 0
push 0xa42
push 0
push 0x555b
push 0x40f
push 0x237d
push 1
push 0x1bdc
call fcn.00424ac1
add esp, 0x34
jmp 0x422315
jmp 0x4223b0
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1fc], eax
push 0x7634
push 0
push dword [ebp - 0x1fc]
push 0x4790
call fcn.0040c72f
add esp, 0x10
mov esp, ebp
pop ebp
ret