Function at 0x4367c4
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd88
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x278], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x170]
mov edx, 0x4056a4
call fcn.00403a28
mov ebx, dword [ebp + 8]
add ebx, 0xfffffff0
xor eax, eax
push ebp
push 0x437f18
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, dword [ebx]
inc dword [ebx]
inc dword [ebx]
mov eax, dword [ebx]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0xc]
cmp byte [edx + eax - 1], 0x28
je 0x436827
mov eax, dword [ebx]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 0x14]
jl 0x43680c
mov eax, dword [ebx]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 0x14]
jge 0x437eca
lea eax, [ebp - 4]
call fcn.004034fc
lea eax, [ebp - 0x174]
push eax
mov ecx, dword [ebx]
sub ecx, edi
dec ecx
lea edx, [edi + 1]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00403874
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x10]
call fcn.00405d4c
mov eax, dword [ebp - 0x10]
movzx esi, byte [eax]
cmp esi, 0x4d
jg 0x437613
cmp esi, 0x44
jg 0x436dd6
cmp esi, 0x43
jg 0x436be1
mov edx, 0x437f30
mov eax, dword [ebp - 0x10]
call fcn.00403958
cmp eax, 0x22
ja case.0x4378eb.0
mov al, byte [eax + 0x4368a9]
jmp dword [eax*4 + 0x4368cc]
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x10]
call fcn.00403590
mov eax, dword [ebp - 0x10]
call fcn.00403670
test eax, eax
jle 0x436943
lea edx, [ebp - 0x274]
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
call fcn.00402ab4
lea edx, [ebp - 0x274]
lea eax, [ebp - 4]
call fcn.0040361c
jmp 0x437e88
mov dword [0x441788], 0xb
jmp 0x437e88
push ebp
call fcn.00434dc0
pop ecx
mov edx, eax
lea eax, [ebp - 4]
call fcn.0040360c
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov edx, dword [ebp - 0x174]
mov cx, 0x24
mov eax, dword [0x44177c]
call fcn.004325f0
cmp eax, 6
jne 0x437e88
lea eax, [ebp - 4]
mov edx, 0x437f60
call fcn.00403590
jmp 0x437e88
push ebp
lea edx, [ebp - 0x174]
mov eax, 0x437f6c
call fcn.00434d90
pop ecx
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x10]
call fcn.00405d4c
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
sub al, 0x42
je 0x4369de
sub al, 0x10
je 0x436a2d
sub al, 6
je 0x4369ef
dec al
je 0x436a0e
jmp 0x436a83
push ebp
mov eax, dword [0x4419c8]
call fcn.00434e20
pop ecx
jmp 0x436a83
push ebp
lea edx, [ebp - 0x174]
mov eax, dword [0x4419cc]
call fcn.004329b0
mov eax, dword [ebp - 0x174]
call fcn.00434e20
pop ecx
jmp 0x436a83
push ebp
lea edx, [ebp - 0x174]
mov eax, dword [0x4419d0]
call fcn.004329b0
mov eax, dword [ebp - 0x174]
call fcn.00434e20
pop ecx
jmp 0x436a83
push ebp
call fcn.00434dc0
pop ecx
mov dword [ebp - 8], eax
push ebp
call fcn.00434dc0
pop ecx
mov dword [ebp - 0xc], eax
push ebp
call fcn.00434dc0
pop ecx
mov esi, eax
push ebp
call fcn.00434dc0
pop ecx
mov edx, dword [0x4419d0]
cmp edx, dword [ebp - 8]
jl 0x436a83
mov edx, dword [0x4419cc]
cmp edx, dword [ebp - 0xc]
jl 0x436a83
cmp esi, dword [0x4419d0]
jl 0x436a83
cmp eax, dword [0x4419cc]
jl 0x436a83
push ebp
mov eax, 0x437f60
call fcn.00434e20
pop ecx
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.004038b4
mov eax, dword [ebp - 0x10]
call fcn.00403670
test eax, eax
jne 0x4369c4
jmp 0x437e88
push ebp
mov eax, 3
call fcn.0043590c
pop ecx
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x10]
call fcn.00403590
lea eax, [ebp - 4]
mov edx, 0x437f78
call fcn.00403590
jmp 0x437e88
push ebp
lea edx, [ebp - 0x174]
mov eax, 0x437f84
call fcn.00434d90
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 4]
call fcn.00403590
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.00402908
and eax, 0xff
sub eax, 0x40
lea edx, [ebp - 4]
call fcn.00402738
jmp 0x437e88
push 0x437f90
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
push dword [ebp - 0x174]
push 0x437f9c
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403730
jmp 0x437e88
push 0x437fa8
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
push dword [ebp - 0x174]
push 0x437fb4
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403730
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x174]
call fcn.00403670
mov dword [ebp - 8], eax
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x174]
call fcn.00403670
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
jle 0x437e88
cmp dword [ebp - 0xc], 0
jle 0x437e88
lea eax, [ebp - 4]
mov edx, 0x437f60
call fcn.00403590
jmp 0x437e88
mov edx, 0x437fc0
mov eax, dword [ebp - 0x10]
call fcn.00403958
cmp eax, 0xf
jg 0x436c0f
je 0x436cc5
dec eax
je 0x436c26
sub eax, 3
je 0x436c37
sub eax, 7
je 0x436cb4
jmp case.0x4378eb.0
sub eax, 0x16
je 0x436d02
sub eax, 8
je 0x436d0e
jmp case.0x4378eb.0
push ebp
mov eax, 4
call fcn.00435384
pop ecx
jmp 0x437e88
cmp byte [0x44085c], 0
je 0x436ca5
mov al, byte [0x4419dc]
mov byte [0x441794], al
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x10]
call fcn.00403590
cmp byte [0x441794], 0
je 0x437e88
mov eax, dword [0x4419a4]
mov eax, dword [eax + 0x1b0]
mov edx, dword [ebp - 0x10]
call fcn.004307b8
mov esi, eax
test esi, esi
je 0x437e88
lea eax, [ebp - 4]
mov edx, esi
call fcn.00403628
mov eax, esi
call fcn.00406774
jmp 0x437e88
mov dword [0x441788], 0x16
jmp 0x437e88
push ebp
mov eax, 2
call fcn.00435384
pop ecx
jmp 0x437e88
cmp byte [0x44085c], 0
je 0x436cf3
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov edx, dword [ebp - 0x174]
lea ecx, [ebp - 4]
mov eax, dword [0x4419a4]
call fcn.0043f2f0
jmp 0x437e88
mov dword [0x441788], 0x16
jmp 0x437e88
push ebp
call fcn.004357b4
pop ecx
jmp 0x437e88
cmp byte [0x44085c], 0
je 0x436dc7
push ebp
lea edx, [ebp - 0x174]
mov eax, 0x437fec
call fcn.00434d90
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x10]
call fcn.00403590
push ebp
lea edx, [ebp - 0x278]
mov eax, 0x438008
call fcn.00434d90
pop ecx
mov eax, dword [ebp - 0x278]
lea edx, [ebp - 0x174]
call fcn.00405d4c
mov eax, dword [ebp - 0x174]
mov edx, 0x438018
call fcn.00403958
dec eax
je 0x436d82
sub eax, 6
je 0x436d8b
sub eax, 7
je 0x436d92
sub eax, 9
je 0x436d9b
jmp 0x436da2
mov dword [ebp - 8], 0xd
jmp 0x436da2
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x436da2
mov dword [ebp - 8], 0xb
jmp 0x436da2
mov dword [ebp - 8], 0xe
mov al, byte [ebp - 8]
push eax
mov al, byte [0x438038]
push eax
lea eax, [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov edx, dword [0x4419a4]
call fcn.00432058
mov byte [0x441794], al
jmp 0x437e88
mov dword [0x441788], 0x16
jmp 0x437e88
cmp esi, 0x47
jg 0x437233
mov edx, 0x438044
mov eax, dword [ebp - 0x10]
call fcn.00403958
cmp eax, 0x53
ja case.0x4378eb.0
mov al, byte [eax + 0x436e02]
jmp dword [eax*4 + 0x436e56]
push ebp
xor eax, eax
call fcn.00435b24
pop ecx
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x10]
call fcn.00403590
mov eax, dword [ebp + 8]
push eax
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x174]
call fcn.0043472c
pop ecx
movzx edx, ax
lea ecx, [ebp - 0x170]
mov eax, dword [ebp - 0x10]
call fcn.004062dc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x437e88
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 0x10]
call fcn.0040635c
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 4]
lea edx, [ebp - 0x170]
call fcn.004348dc
pop ecx
jmp 0x437e88
mov byte [0x441810], 0
push 0xff
push 0x441810
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x174]
call fcn.00403834
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
lea eax, [ebp - 0x174]
mov edx, 0x441810
mov ecx, pe_nt_image_headers32
call fcn.00403658
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 4]
call fcn.004325c8
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 4]
call fcn.00403590
lea eax, [ebp - 4]
mov edx, dword [0x441778]
call fcn.00403590
mov eax, 0x441778
call fcn.004034fc
jmp 0x437e88
lea eax, [ebp - 4]
push eax
push ebp
lea eax, [ebp - 0x278]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x278]
lea edx, [ebp - 0x174]
call fcn.004063cc
mov eax, dword [ebp - 0x174]
mov ecx, 3
mov edx, 2
call fcn.00403874
jmp 0x437e88
push ebp
mov al, 1
call fcn.00435b24
pop ecx
jmp 0x437e88
push ebp
mov eax, 0xb
call fcn.00435384
pop ecx
jmp 0x437e88
push ebp
mov eax, 0xc
call fcn.00435384
pop ecx
jmp 0x437e88
push ebp
mov eax, 0xd
call fcn.00435384
pop ecx
jmp 0x437e88
push ebp
mov eax, 0xe
call fcn.00435384
pop ecx
jmp 0x437e88
push ebp
mov eax, 0xf
call fcn.00435384
pop ecx
jmp 0x437e88
push ebp
mov eax, 0x10
call fcn.00435384
pop ecx
jmp 0x437e88
push ebp
mov eax, 0x15
call fcn.00435384
pop ecx
jmp 0x437e88
cmp byte [0x44085c], 0
je 0x4371a7
mov eax, dword [0x4419a4]
mov esi, dword [eax + 0x1ac]
push ebp
lea edx, [ebp - 0x174]
mov eax, 0x4380a4
call fcn.00434d90
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x10]
call fcn.00403590
mov edx, dword [ebp - 0x10]
mov eax, 0x4380c0
call fcn.00403958
dec eax
jne 0x437121
lea eax, [ebp - 0x278]
push eax
mov ecx, 3
mov edx, 3
mov eax, dword [ebp - 0x10]
call fcn.00403874
mov eax, dword [ebp - 0x278]
lea edx, [ebp - 0x174]
call fcn.00405d4c
push dword [ebp - 0x174]
push 0x4380cc
push dword [ebp - 0x10]
push 0x4380e0
push dword [ebp - 0x10]
lea eax, [esi + 0x30]
mov edx, 5
call fcn.00403730
jmp 0x43712c
lea eax, [esi + 0x30]
mov edx, dword [ebp - 0x10]
call fcn.0040354c
push ebp
lea edx, [ebp - 0x174]
mov eax, 0x4380ec
call fcn.00434d90
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [esi + 0x3c]
call fcn.0040354c
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x10]
call fcn.00403590
mov eax, dword [ebp - 0x10]
call fcn.00403670
test eax, eax
jle 0x43717e
lea eax, [esi + 0x44]
mov edx, dword [ebp - 0x10]
call fcn.0040354c
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x30]
mov byte [0x441794], al
cmp byte [0x441794], 0
je 0x437e88
lea eax, [ebp - 4]
mov edx, dword [esi + 0x44]
call fcn.00403590
jmp 0x437e88
mov dword [0x441788], 0x16
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x10]
call fcn.00403590
lea eax, [ebp - 4]
mov edx, 0x438100
call fcn.00403590
jmp 0x437e88
push ebp
call fcn.004365a0
pop ecx
jmp 0x437e88
push ebp
mov eax, 0x11
call fcn.00435384
pop ecx
jmp 0x437e88
push ebp
mov eax, 0x12
call fcn.00435384
pop ecx
jmp 0x437e88
push ebp
mov eax, 0x13
call fcn.00435384
pop ecx
jmp 0x437e88
push ebp
mov eax, 0x14
call fcn.00435384
pop ecx
jmp 0x437e88
mov edx, 0x43810c
mov eax, dword [ebp - 0x10]
call fcn.00403958
cmp eax, 0x33
ja case.0x4378eb.0
mov al, byte [eax + 0x437256]
jmp dword [eax*4 + 0x43728a]
push ebp
call 0x434f70
pop ecx
jmp 0x437e88
push ebp
call fcn.00434ea4
pop ecx
jmp 0x437e88
push ebp
mov eax, 2
call fcn.0043590c
pop ecx
jmp 0x437e88
push ebp
mov eax, 4
call fcn.0043590c
pop ecx
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x174]
call fcn.00403670
lea edx, [ebp - 4]
call fcn.004329b0
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x10]
call fcn.00403590
mov eax, dword [ebp - 0x10]
call fcn.00403670
test eax, eax
jne 0x437350
mov dword [0x441788], 0xb
jmp 0x4373a7
lea eax, [ebp - 4]
mov edx, pe_nt_image_headers32
call fcn.004039a0
push 0
push 0xfe
mov eax, dword [ebp - 4]
call fcn.00403834
push eax
mov eax, dword [ebp - 0x10]
call fcn.00403834
push eax
call sub.winmm.dll_mciSendStringA
test eax, eax
sete byte [0x441794]
cmp byte [0x441794], 0
jne 0x4373a7
push 0xfe
mov eax, dword [ebp - 4]
call fcn.00403834
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x18]
push eax
call sub.winmm.dll_mciGetErrorStringA
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 4]
call fcn.004325c8
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 4]
call fcn.00403590
jmp 0x437e88
push ebp
mov eax, 5
call fcn.0043590c
pop ecx
jmp 0x437e88
lea eax, [ebp - 4]
mov edx, 0x43814c
call fcn.00403590
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x10]
call fcn.00405d4c
mov eax, dword [ebp - 0x10]
call fcn.00403670
cmp eax, 2
jl 0x437452
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0x46
jne 0x437452
lea eax, [ebp - 0x174]
push eax
mov ecx, 2
mov edx, 2
mov eax, dword [ebp - 0x10]
call fcn.00403874
mov eax, dword [ebp - 0x174]
call fcn.004329d8
add eax, 0xe3
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xf0
jl 0x43746f
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x43746f
mov edx, 0x438158
mov eax, dword [ebp - 0x10]
call fcn.00403958
mov ecx, 5
cdq
idiv ecx
add eax, 0xf0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x437485
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040360c
jmp 0x437e88
mov dword [0x441788], 0xd
jmp 0x437e88
push ebp
call fcn.00434dc0
pop ecx
mov dword [ebp - 8], eax
push ebp
lea edx, [ebp - 0x174]
mov eax, 0x438194
call fcn.00434d90
pop ecx
mov eax, dword [ebp - 0x174]
call fcn.004329d8
mov edx, eax
lea ecx, [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00405f64
jmp 0x437e88
push ebp
lea edx, [ebp - 0x174]
mov eax, 0x437f6c
call fcn.00434d90
pop ecx
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x10]
call fcn.00405d4c
lea eax, [ebp - 0x18]
push eax
call sub.user32.dll_GetCursorPos
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
sub al, 0x58
je 0x437505
dec al
je 0x437522
jmp 0x43753d
push ebp
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 0x18]
call fcn.004329b0
mov eax, dword [ebp - 0x174]
call fcn.00434e20
pop ecx
jmp 0x43753d
push ebp
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 0x14]
call fcn.004329b0
mov eax, dword [ebp - 0x174]
call fcn.00434e20
pop ecx
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.004038b4
mov eax, dword [ebp - 0x10]
call fcn.00403670
test eax, eax
jne 0x4374f6
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x10]
call fcn.00403590
push ebp
lea edx, [ebp - 0x174]
mov eax, dword [0x44177c]
call fcn.00434d90
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 4]
call fcn.00403590
push ebp
lea edx, [ebp - 0x174]
mov eax, 0x437f60
call fcn.00434d90
pop ecx
mov eax, dword [ebp - 0x174]
call fcn.004329d8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x4375c6
xor eax, eax
mov dword [ebp - 8], eax
mov cx, word [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004325f0
lea edx, [ebp - 0x174]
call fcn.004329b0
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 4]
call fcn.00403590
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 4]
call fcn.00405d88
jmp 0x437e88
cmp esi, 0x52
jg 0x4378c2
cmp esi, 0x4f
jg 0x437756
mov edx, 0x4381a0
mov eax, dword [ebp - 0x10]
call fcn.00403958
cmp eax, 0x12
ja case.0x4378eb.0
mov al, byte [eax + 0x437648]
jmp dword [eax*4 + 0x43765b]
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x10]
call fcn.00403590
cmp byte [0x441794], 0
je 0x437e88
lea eax, [ebp - 4]
mov edx, 0x437f60
call fcn.00403590
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 4]
call fcn.00406394
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 4]
call fcn.004063cc
mov eax, dword [ebp - 0x174]
call fcn.00403670
push eax
mov eax, dword [ebp - 4]
call fcn.00403670
mov ecx, eax
pop eax
sub ecx, eax
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00403874
jmp 0x437e88
push ebp
mov eax, 1
call fcn.0043590c
pop ecx
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x174]
call fcn.00403670
test eax, eax
jne 0x437e88
lea eax, [ebp - 4]
mov edx, 0x437f60
call fcn.00403590
jmp 0x437e88
push ebp
xor eax, eax
call fcn.00435384
pop ecx
jmp 0x437e88
mov edx, 0x4381c4
mov eax, dword [ebp - 0x10]
call fcn.00403958
cmp eax, 0x1f
ja case.0x4378eb.0
mov al, byte [eax + 0x437779]
jmp dword [eax*4 + 0x437799]
push ebp
mov eax, 6
call fcn.00435384
pop ecx
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x10]
call fcn.00405d4c
push ebp
lea eax, [ebp - 0x278]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x278]
lea edx, [ebp - 0x174]
call fcn.00405d4c
mov edx, dword [ebp - 0x174]
mov eax, dword [ebp - 0x10]
call fcn.00403958
lea edx, [ebp - 4]
call fcn.004329b0
jmp 0x437e88
push ebp
mov eax, 3
call fcn.00435384
pop ecx
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov edx, dword [ebp - 0x174]
mov cx, 0x21
mov eax, dword [0x44177c]
call fcn.004325f0
dec eax
jne 0x437e88
lea eax, [ebp - 4]
mov edx, 0x437f60
call fcn.00403590
jmp 0x437e88
push ebp
call fcn.004350c4
pop ecx
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x10]
call fcn.00403590
lea edx, [ebp - 4]
mov eax, dword [0x44179c]
call fcn.004329b0
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 4]
call fcn.0040635c
jmp 0x437e88
cmp esi, 0x54
jg 0x437b45
mov edx, 0x4381f0
mov eax, dword [ebp - 0x10]
call fcn.00403958
mov esi, eax
mov eax, esi
cmp eax, 0x35
ja case.0x4378eb.0
mov al, byte [eax + 0x4378f2]
jmp dword [eax*4 + 0x437928]
push ebp
mov eax, 1
call fcn.00435384
pop ecx
jmp 0x437e88
push ebp
mov eax, 5
call fcn.00435384
pop ecx
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 4]
call fcn.00403590
push ebp
lea edx, [ebp - 0x174]
mov eax, 0x438238
call fcn.00434d90
pop ecx
mov eax, dword [ebp - 0x174]
call fcn.004329d8
mov dword [ebp - 8], eax
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x10]
call fcn.00403590
cmp dword [ebp - 8], 0
jle 0x437e88
cmp esi, 0x11
jne 0x4379ee
lea edx, [ebp - 4]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.004038fc
jmp 0x437e88
mov eax, dword [ebp - 0x10]
call fcn.004329d8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x437a08
cmp dword [ebp - 0xc], 0xffff8001
jne 0x437a10
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x437a21
cmp dword [ebp - 0xc], 0
jge 0x437a21
mov eax, dword [ebp - 4]
call fcn.00403670
add dword [ebp - 0xc], eax
cmp esi, 8
jne 0x437a41
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 8]
inc ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00403874
jmp 0x437e88
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 8]
inc ecx
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004038b4
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 4]
call fcn.00433900
jmp 0x437e88
push 0x438244
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
push dword [ebp - 0x174]
push 0x438250
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403730
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 4]
mov ecx, 0x43825c
call fcn.004036bc
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 4]
call fcn.00405e80
jmp 0x437e88
push ebp
call fcn.00436410
pop ecx
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 4]
call fcn.00403590
lea edx, [ebp - 4]
mov eax, 0x441810
call fcn.004329b0
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 4]
call fcn.00432bf8
jmp 0x437e88
mov edx, 0x438268
mov eax, dword [ebp - 0x10]
call fcn.00403958
cmp eax, 0x1f
jg 0x437b8c
je 0x437d15
cmp eax, 0xa
jg 0x437b75
je 0x437c06
dec eax
je 0x437bc5
sub eax, 4
je 0x437be6
jmp case.0x4378eb.0
sub eax, 0x13
je 0x437c8c
sub eax, 6
je 0x437d09
jmp case.0x4378eb.0
cmp eax, 0x34
jg 0x437bae
je 0x437d58
sub eax, 0x26
je 0x437d21
sub eax, 7
je 0x437d4c
jmp case.0x4378eb.0
sub eax, 0x3b
je 0x437d81
sub eax, 8
je 0x437daa
jmp case.0x4378eb.0
push ebp
call fcn.00434dc0
pop ecx
test eax, eax
jne 0x437e88
lea eax, [ebp - 4]
mov edx, 0x437f60
call fcn.00403590
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 4]
call fcn.00405d4c
jmp 0x437e88
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x174]
call fcn.00433ac0
mov dword [ebp - 8], eax
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x10]
call fcn.00403590
cmp dword [ebp - 8], 0
jle 0x437c5c
mov eax, dword [ebp - 0x10]
call fcn.00403670
test eax, eax
jle 0x437c5c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00433be8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x437e88
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 8]
call fcn.004329b0
mov ecx, dword [ebp - 0x174]
lea eax, [ebp - 4]
mov edx, 0x4382c0
call fcn.004036bc
jmp 0x437e88
push ebp
lea edx, [ebp - 0x278]
mov eax, 0x4382cc
call fcn.00434d90
pop ecx
mov eax, dword [ebp - 0x278]
lea edx, [ebp - 0x174]
call fcn.00405d4c
mov eax, dword [ebp - 0x174]
mov edx, 0x4382d8
call fcn.00403780
jne 0x437cd2
push 0xff
push 0x441810
call sub.kernel32.dll_GetSystemDirectoryA
jmp 0x437ce1
push 0xff
push 0x441810
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x174]
mov edx, 0x441810
mov ecx, pe_nt_image_headers32
call fcn.00403658
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 4]
call fcn.004325c8
jmp 0x437e88
push ebp
call fcn.00435c60
pop ecx
jmp 0x437e88
push ebp
call fcn.00435f18
pop ecx
jmp 0x437e88
push ebp
push ebp
lea edx, [ebp - 0x174]
mov eax, 0x4382e4
call fcn.00434d90
pop ecx
mov eax, dword [ebp - 0x174]
push eax
call sub.user32.dll_GetForegroundWindow
pop edx
call fcn.00435de8
pop ecx
jmp 0x437e88
push ebp
call fcn.00436264
pop ecx
jmp 0x437e88
push ebp
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x174]
call fcn.00433ac0
mov edx, 0x4382e4
call fcn.00435de8
pop ecx
jmp 0x437e88
push ebp
push ebp
lea eax, [ebp - 0x174]
call fcn.00434c58
pop ecx
mov eax, dword [ebp - 0x174]
call fcn.00433ac0
mov edx, 0x4382f0
call fcn.00435de8
pop ecx
jmp 0x437e88
push ebp
call fcn.00434dc0
pop ecx
mov dword [ebp - 0x18], eax
push ebp
call fcn.00434dc0
pop ecx
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, 0xffff8001
jne 0x437dd7
mov dword [0x441788], 0xd
jmp 0x437e88
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call sub.user32.dll_WindowFromPoint
lea edx, [ebp - 0x174]
call fcn.004329b0
mov ecx, dword [ebp - 0x174]
lea eax, [ebp - 4]
mov edx, 0x4382c0
call fcn.004036bc
jmp 0x437e88
mov dword [0x441788], 7
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x18], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x18]
cmp eax, dword [0x441930]
jge 0x437e88
mov eax, dword [ebp + 8]
inc dword [eax - 0x18]
lea eax, [ebp - 0x174]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x18]
mov ecx, edx
shl edx, 3
sub edx, ecx
lea edx, [edx*4 + 0x441918]
call fcn.0040361c
mov edx, dword [ebp - 0x174]
mov eax, dword [ebp - 0x10]
call fcn.00405df4
test eax, eax
jne 0x437e7a
xor eax, eax
mov dword [0x441788], eax
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x18]
call fcn.0043668c
pop ecx
mov eax, dword [ebp + 8]
mov dword [eax - 0x18], 0x63
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x18]
cmp eax, dword [0x441930]
jl 0x437e25
mov ecx, dword [ebx]
sub ecx, edi
inc ecx
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
mov edx, edi
call fcn.004038b4
mov eax, dword [ebp + 8]
lea edx, [eax - 0xc]
mov ecx, edi
mov eax, dword [ebp - 4]
call fcn.004038fc
mov eax, dword [ebp - 4]
call fcn.00403670
add edi, eax
dec edi
mov dword [ebx], edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00403670
mov edx, dword [ebp + 8]
mov dword [edx - 0x14], eax
jmp 0x437ed4
mov dword [0x441788], 8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x437f1f
lea eax, [ebp - 0x278]
call fcn.004034fc
lea eax, [ebp - 0x174]
call fcn.004034fc
lea eax, [ebp - 0x170]
mov edx, 0x4056a4
call fcn.00403ae0
lea eax, [ebp - 0x10]
call fcn.004034fc
lea eax, [ebp - 4]
call fcn.004034fc
ret