Function at 0x41ff64
Capabilities:
Parse pe header

Disassembly:
push ebp
push ebx
push edi
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x41ff6c
call fcn.004ceb50
mov edx, dword [esp + 0x38]
lea ecx, [esp]
call fcn.0044f000
mov edx, 0x5e60ba
lea ecx, [0xf8154c]
call fcn.0044f008
mov dword [0xf81628], 0
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed448
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x41ffe9
cmp edi, 0xffffffff
je 0x41ffed
xor eax, eax
jmp 0x41fff2
mov eax, 1
or eax, eax
je 0x42007f
mov edx, dword [esp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf815e8]
push eax
call fcn.004ceac0
push dword [0xf817a4]
push dword [0xf815e8]
call fcn.004cc840
mov ebx, eax
and ebx, ebx
jle 0x420050
mov edx, dword [0xf8176c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81740]
push eax
call fcn.004ceac0
jmp 0x420070
mov edx, dword [0xf815e8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81740]
push eax
call fcn.004ceac0
mov dword [0xf81694], 1
jmp 0x420390
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.filesOfficeData
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x4200c4
cmp edi, 0xffffffff
je 0x4200c8
xor eax, eax
jmp 0x4200cd
mov eax, 1
or eax, eax
je 0x420180
mov edx, dword [esp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.files_
push edx
call fcn.004cea70
lea eax, [esp + 4]
push eax
call fcn.004ceac0
mov edx, dword [esp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf815e8]
push eax
call fcn.004ceac0
push dword [0xf817a4]
push dword [0xf815e8]
call fcn.004cc840
mov ebx, eax
and ebx, ebx
jle 0x420151
mov edx, dword [0xf8176c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81740]
push eax
call fcn.004ceac0
jmp 0x420171
mov edx, dword [0xf815e8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81740]
push eax
call fcn.004ceac0
mov dword [0xf81694], 1
jmp 0x420390
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [0xf817a4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed448
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x4201c7
cmp edi, 0xffffffff
je 0x4201cb
xor eax, eax
jmp 0x4201d0
mov eax, 1
or eax, eax
je 0x42027e
mov edx, dword [0xf817a4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [esp + 4]
push eax
call fcn.004ceac0
mov edx, dword [0xf817a4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf815e8]
push eax
call fcn.004ceac0
push dword [0xf817a4]
push dword [0xf815e8]
call fcn.004cc840
mov ebx, eax
and ebx, ebx
jle 0x42024f
mov edx, dword [0xf8176c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81740]
push eax
call fcn.004ceac0
jmp 0x42026f
mov edx, dword [0xf815e8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81740]
push eax
call fcn.004ceac0
mov dword [0xf81694], 1
jmp 0x420390
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [0xf817a4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.filesOfficeData
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x4202c5
cmp edi, 0xffffffff
je 0x4202c9
xor eax, eax
jmp 0x4202ce
mov eax, 1
or eax, eax
je 0x420356
mov edx, dword [0xf817a4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.files_
push edx
call fcn.004cea70
lea eax, [0xf815e8]
push eax
call fcn.004ceac0
mov edx, dword [0xf817a4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.files_
push edx
call fcn.004cea70
lea eax, [esp + 4]
push eax
call fcn.004ceac0
mov dword [0xf81694], 1
mov edx, dword [0xf8176c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81740]
push eax
call fcn.004ceac0
jmp 0x420390
mov edx, dword [0xf8176c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81740]
push eax
call fcn.004ceac0
mov dword [0xf81694], 0
mov edx, 0x5e60ba
lea ecx, [0xf815e8]
call fcn.0044f008
mov ebx, dword [0xf81694]
and ebx, ebx
jle 0x420457
mov edx, dword [0xf81638]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf814f0]
push eax
call fcn.004ceac0
mov dword [esp + 4], 0
jmp 0x4203c8
push dword [0xf81864]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x420408
mov edx, dword [0xf81868]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81864]
mov edx, 0x5e7196
lea ecx, [ebp]
call fcn.0044f008
inc dword [esp + 4]
jno 0x4203c8
mov dword [esp + 4], 0
jmp 0x420412
push dword [0xf81858]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x420452
mov edx, dword [0xf8185c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81858]
mov edx, 0x5e7196
lea ecx, [ebp]
call fcn.0044f008
inc dword [esp + 4]
jno 0x420412
jmp 0x42050b
mov edx, dword [0xf81638]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf814f0]
push eax
call fcn.004ceac0
mov dword [esp + 4], 0
jmp 0x420481
push dword [0xf81864]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x4204c1
mov edx, dword [0xf81868]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81864]
mov edx, 0x5e719a
lea ecx, [ebp]
call fcn.0044f008
inc dword [esp + 4]
jno 0x420481
mov dword [esp + 4], 0
jmp 0x4204cb
push dword [0xf81858]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x42050b
mov edx, dword [0xf8185c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81858]
mov edx, 0x5e719a
lea ecx, [ebp]
call fcn.0044f008
inc dword [esp + 4]
jno 0x4204cb
mov ebx, dword [0xf81694]
and ebx, ebx
jle 0x420645
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4d80
push eax
mov edx, dword [0xf815e8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed448
push edx
call fcn.004cea70
call fcn.004ceb30
push 0
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x420619
push 0
call fcn.004baf70
and eax, eax
je 0x42060f
push 0
call fcn.004badeb
mov ebx, eax
cmp ebx, 1
jne 0x42060a
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.00421d18
lea eax, [esp + 0xc]
push eax
call fcn.004ceac0
push dword [esp + 8]
mov edx, 0x5e60ba
pop ecx
call fcn.0044f3d0
jne 0x42060a
push edx
call fcn.004cea40
pop edx
push eax
mov edx, 0x5e62ec
push edx
call fcn.004cea70
mov edx, dword [esp + 0xc]
push edx
call fcn.004cea70
mov edx, 0x5e6e04
push edx
call fcn.004cea70
lea eax, [esp + 0x10]
push eax
call fcn.004ceac0
jmp 0x42056b
push 0
call fcn.004baf3e
mov edx, dword [0xf8164c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, dword [esp + 0x10]
push edx
call fcn.004cea70
lea eax, [0xf81744]
push eax
call fcn.004ceac0
jmp 0x420665
mov edx, dword [0xf8153c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
lea eax, [0xf81744]
push eax
call fcn.004ceac0
mov ebx, dword [0xf815f8]
and ebx, ebx
jne 0x420680
mov ebx, dword [0xf815fc]
and ebx, ebx
jne 0x420680
mov eax, 1
jmp 0x420682
xor eax, eax
and eax, eax
je 0x4206d3
call fcn.004bd7c4
push 0
call fcn.004bda93
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
add ebx, 0xfffffebe
mov dword [0xf815f8], ebx
push 0
call fcn.004bdab6
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
add ebx, 0xffffff2b
mov dword [0xf815fc], ebx
push 0
call fcn.004b8af1
and eax, eax
je 0x4206e5
xor eax, eax
jmp 0x4206ea
mov eax, 1
and eax, eax
je 0x420b99
push 0x1aa
push 0x284
push dword [0xf815fc]
push dword [0xf815f8]
call fcn.00441c0c
push dword [0xf81794]
call fcn.004c78ad
cdq
push edx
push eax
push 8
call fcn.004b031c
push dword [0xf81470]
call fcn.004c78ad
cdq
push edx
push eax
push 0xa
call fcn.004b031c
push dword [0xf8162c]
call fcn.004c78ad
cdq
push edx
push eax
push 9
call fcn.004b031c
push dword [0xf81534]
call fcn.004c78ad
cdq
push edx
push eax
push 0xb
call fcn.004b031c
push 0
lea eax, [0x415703]
push eax
call fcn.004b95d7
push 0x7d0
push 0x309
push 0
call fcn.004b963d
push 0xea60
push 0x30a
push 0
call fcn.004b963d
push 1
push 0x3c
call fcn.004b02dd
push 1
push 0x3d
call fcn.004b02dd
push 0
push 0x41
call fcn.004b02dd
push dword [0xf81688]
mov edx, 0x5e9262
pop ecx
call fcn.0044f3d0
je 0x420834
mov eax, 0x5ed85e
push eax
push 0x4c
call fcn.004b253c
mov eax, 0x5f5d14
push eax
push 0x4c
call fcn.004b32a4
mov ebx, dword [0xf81694]
and ebx, ebx
jne 0x420822
push dword [0xf81500]
push 0x51
call fcn.004b32a4
jmp 0x420832
push dword [0xf81754]
push 0x51
call fcn.004b32a4
jmp 0x420844
mov eax, str.Windows_10_or_11_only____
push eax
push 0x4c
call fcn.004b32a4
push dword [0xf815b8]
push 0x35
call fcn.004b32a4
push 0
call fcn.004b8c12
push dword [0xf81638]
push 0
call fcn.004b8ac8
call fcn.00438e88
push 0
push 1
push 0x4f
call fcn.004b031c
push 0x4d
call fcn.0043f373
push 0
push 0
push 0x4d
call fcn.004b031c
push dword [0xf8144c]
push 0xffffffff
push 0x4e
call fcn.004b2473
push dword [0xf81530]
push 0xffffffff
push 0x4e
call fcn.004b2473
push dword [0xf81480]
push 0xffffffff
push 0x4e
call fcn.004b2473
push 0
push 1
push 0x4e
call fcn.004b031c
push 1
mov eax, 0x5e77fc
push eax
call fcn.0043ddc0
mov eax, 0x5f3e38
push eax
push 0xffffffff
push 0x45
call fcn.004b2473
mov eax, 0x5f10e8
push eax
push 0xffffffff
push 0x45
call fcn.004b2473
mov eax, 0x5f65c4
push eax
push 0xffffffff
push 0x45
call fcn.004b2473
push 0
push 0
push 0x45
call fcn.004b031c
push dword [0xf81584]
push 0xffffffff
push 0x48
call fcn.004b2473
push dword [0xf814ac]
push 0xffffffff
push 0x48
call fcn.004b2473
push 0
push 0
push 0x48
call fcn.004b031c
mov edx, 0x5e77fc
lea ecx, [0xf81498]
call fcn.0044f008
push 0x3f
call fcn.0043f373
push dword [0xf81544]
push 0xffffffff
push 0x3f
call fcn.004b2473
push 0
push 1
push 0x3f
call fcn.004b031c
call fcn.00447a6d
push 0x47
call fcn.004b2425
mov dword [esp + 4], 0
jmp 0x4209f5
push dword [0xf81864]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x420a3d
mov edx, dword [0xf81868]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81864]
push dword [ebp]
push 0xffffffff
push 0x47
call fcn.004b2473
inc dword [esp + 4]
jno 0x4209f5
push 2
push 0
push 0x47
call fcn.004b0456
push 0x5a
call fcn.004b2425
call fcn.0043fb0d
push 0x260
push 0x2bc
push 0
push 0
call fcn.00412b71
push dword [0xf816ec]
lea eax, [0x416378]
push eax
call fcn.004b95d7
push dword [0xf81724]
call fcn.004c78ad
push eax
push 0
push 0x4d
call fcn.004b3451
push dword [0xf81724]
call fcn.004c78ad
push eax
push 1
push 0x4d
call fcn.004b3451
push dword [0xf81724]
call fcn.004c78ad
push eax
push 2
push 0x4d
call fcn.004b3451
push dword [0xf81724]
call fcn.004c78ad
push eax
push 3
push 0x4d
call fcn.004b3451
push dword [0xf81724]
call fcn.004c78ad
push eax
push 4
push 0x4d
call fcn.004b3451
push dword [0xf81724]
call fcn.004c78ad
push eax
push 5
push 0x4d
call fcn.004b3451
push dword [0xf81724]
call fcn.004c78ad
push eax
push 6
push 0x4d
call fcn.004b3451
push dword [0xf81724]
call fcn.004c78ad
push eax
push 7
push 0x4d
call fcn.004b3451
push dword [0xf81724]
call fcn.004c78ad
push eax
push 8
push 0x4d
call fcn.004b3451
push dword [0xf81724]
call fcn.004c78ad
push eax
push 9
push 0x4d
call fcn.004b3451
call fcn.004b884b
mov ebx, eax
cmp ebx, 0x6e
jl 0x420bb6
push 0
push 0x4c
call fcn.004b2448
jmp 0x420bc5
push 1
push 0x4c
call fcn.004b2448
push 0x36
call fcn.004b347f
push 0x4b
call fcn.004b347f
push 0x35
call fcn.004b347f
push 0x27
call fcn.004b347f
push 0x34
call fcn.004b347f
push 0x37
call fcn.004b347f
push 0xffff0001
push 0xffff0001
push 0xffff0001
push 0x64
push 0x2e
call fcn.004b35d8
push 0
push 0x28
call fcn.004b02dd
push 0x42
call fcn.004b347f
mov ebx, dword [0xf81694]
and ebx, ebx
jle 0x421769
push 0
push 0x40
push 0
call fcn.004c5706
push eax
push 1
push 0x59
call fcn.004b238a
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4d80
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed448
push edx
call fcn.004cea70
call fcn.004ceb30
push 0
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x42135b
push 0
call fcn.004baf70
and eax, eax
je 0x421351
push 0
call fcn.004badeb
mov ebx, eax
cmp ebx, 2
jne 0x42134c
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5ec7ee
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004cc840
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jg 0x420d63
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5eb308
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004cc840
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jg 0x420d63
jmp 0x420d6a
mov eax, 1
jmp 0x420d6c
xor eax, eax
and eax, eax
je 0x42134c
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5ec7ee
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004cc840
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jle 0x420e61
push 0
push 1
push 0x4e
call fcn.004b031c
mov edx, 0x5e77fc
lea ecx, [0xf81498]
call fcn.0044f008
push dword [0xf81638]
push 0
call fcn.004b8ac8
push 0x47
call fcn.004b2425
mov dword [esp + 4], 0
jmp 0x420e00
push dword [0xf81864]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x420e48
mov edx, dword [0xf81868]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81864]
push dword [ebp]
push 0xffffffff
push 0x47
call fcn.004b2473
inc dword [esp + 4]
jno 0x420e00
push 2
push 0
push 0x47
call fcn.004b0456
jmp 0x420f05
push 0
push 0
push 0x4e
call fcn.004b031c
mov edx, 0x5e77ca
lea ecx, [0xf81498]
call fcn.0044f008
push dword [0xf81638]
push 0
call fcn.004b8ac8
push 0x47
call fcn.004b2425
mov dword [esp + 4], 0
jmp 0x420ea9
push dword [0xf81858]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x420ef1
mov edx, dword [0xf8185c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81858]
push dword [ebp]
push 0xffffffff
push 0x47
call fcn.004b2473
inc dword [esp + 4]
jno 0x420ea9
push 2
push 0
push 0x47
call fcn.004b0456
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
lea eax, [esp + 0x14]
push eax
call fcn.004ceac0
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eec56
push edx
call fcn.004cea70
mov edx, dword [esp + 0x18]
push edx
call fcn.004cea70
mov edx, str._stream.x64.x_none.dat
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x420f89
jl 0x420f85
cmp ebx, 0
ja 0x420f89
xor eax, eax
jmp 0x420f8e
mov eax, 1
or eax, eax
je 0x421002
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eec56
push edx
call fcn.004cea70
mov edx, dword [esp + 0x18]
push edx
call fcn.004cea70
mov edx, str._stream.x86.x_none.dat
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x420ff2
jl 0x420fee
cmp ebx, 0
ja 0x420ff2
xor eax, eax
jmp 0x420ff7
mov eax, 1
or eax, eax
je 0x421002
mov eax, 1
jmp 0x421004
xor eax, eax
and eax, eax
je 0x421017
mov dword [0xf81778], 0
jmp 0x42110b
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eec56
push edx
call fcn.004cea70
mov edx, dword [esp + 0x18]
push edx
call fcn.004cea70
mov edx, str._stream.x64.x_none.dat
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x421077
jg 0x421073
cmp ebx, 0x64
jb 0x421077
xor eax, eax
jmp 0x42107c
mov eax, 1
or eax, eax
je 0x42108c
mov dword [0xf81778], 0x56
jmp 0x42110b
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eec56
push edx
call fcn.004cea70
mov edx, dword [esp + 0x18]
push edx
call fcn.004cea70
mov edx, str._stream.x86.x_none.dat
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x4210ec
jg 0x4210e8
cmp ebx, 0x64
jb 0x4210ec
xor eax, eax
jmp 0x4210f1
mov eax, 1
or eax, eax
je 0x421101
mov dword [0xf81778], 0x40
jmp 0x42110b
mov dword [0xf81778], 0
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4d80
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eec56
push edx
call fcn.004cea70
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
pop eax
call fcn.004ceb30
push 1
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x42134c
push 1
call fcn.004baf70
and eax, eax
je 0x421342
push 1
call fcn.004badeb
mov ebx, eax
cmp ebx, 1
jne 0x42133d
push dword [0xf81498]
mov edx, 0x5e77fc
pop ecx
call fcn.0044f3d0
je 0x42127b
mov dword [esp + 4], 0
jmp 0x4211be
push dword [0xf81864]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x421276
push edx
call fcn.004cea40
pop edx
push eax
push 1
push 1
mov edx, dword [0xf81868]
imul edx, dword [esp + 0x10]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81864]
push dword [ebp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 1
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004cc7a0
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jle 0x42126c
mov edx, dword [0xf81868]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81864]
mov edx, 0x5e719a
lea ecx, [ebp]
call fcn.0044f008
mov dword [0xf81628], 1
inc dword [esp + 4]
jno 0x4211be
jmp 0x42133d
mov dword [esp + 4], 0
jmp 0x421285
push dword [0xf81858]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x42133d
push edx
call fcn.004cea40
pop edx
push eax
push 1
push 1
mov edx, dword [0xf8185c]
imul edx, dword [esp + 0x10]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81858]
push dword [ebp]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 1
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004cc7a0
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jle 0x421333
mov edx, dword [0xf8185c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81858]
mov edx, 0x5e719a
lea ecx, [ebp]
call fcn.0044f008
mov dword [0xf81628], 1
inc dword [esp + 4]
jno 0x421285
jmp 0x421176
push 1
call fcn.004baf3e
jmp 0x420cba
push 0
call fcn.004baf3e
mov ebx, dword [0xf81628]
and ebx, ebx
jne 0x421631
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4d80
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed448
push edx
call fcn.004cea70
call fcn.004ceb30
push 0
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x4215fc
push 0
call fcn.004baf70
and eax, eax
je 0x4215f2
push 0
call fcn.004badeb
mov ebx, eax
cmp ebx, 2
jne 0x4215ed
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5ec7ee
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
call fcn.0044f422
add dword [esp], edx
call fcn.004cc840
call fcn.0044f440
mov ebx, eax
and ebx, ebx
jle 0x4215ed
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5f4d80
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5eec56
push edx
call fcn.004cea70
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 0
call fcn.004bad68
pop eax
call fcn.004ceb30
push 1
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bae0f
call fcn.0044f440
and eax, eax
je 0x4215ed
push 1
call fcn.004baf70
and eax, eax
je 0x4215e3
push 1
call fcn.004badeb
mov ebx, eax
cmp ebx, 1
jne 0x4215de
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push 1
call fcn.004bad68
lea eax, [esp + 0x18]
push eax
call fcn.004ceac0
push 1
mov eax, str.stream.x64.x
push eax
push dword [esp + 0x1c]
call fcn.004cc720
mov ebx, eax
and ebx, ebx
jg 0x421510
push 1
mov eax, str.stream.x86.x
push eax
push dword [esp + 0x1c]
call fcn.004cc720
mov ebx, eax
and ebx, ebx
jg 0x421510
jmp 0x421517
mov eax, 1
jmp 0x421519
xor eax, eax
and eax, eax
je 0x421522
jmp 0x4215de
push 1
mov eax, str.stream.x64.
push eax
push dword [esp + 0x1c]
call fcn.004cc720
mov ebx, eax
and ebx, ebx
jg 0x421558
push 1
mov eax, str.stream.x86.
push eax
push dword [esp + 0x1c]
call fcn.004cc720
mov ebx, eax
and ebx, ebx
jg 0x421558
jmp 0x42155f
mov eax, 1
jmp 0x421561
xor eax, eax
and eax, eax
je 0x4215de
push 1
mov eax, 0x5ebf22
push eax
push dword [esp + 0x1c]
call fcn.004cc720
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
and ebx, ebx
jle 0x4215be
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push dword [esp + 0x1c]
call fcn.004cc6f0
mov ebx, eax
add ebx, 0xfffffff1
push ebx
push 0xc
push dword [esp + 0x24]
call fcn.004cc880
lea eax, [0xf8154c]
push eax
call fcn.004ceac0
push 1
call fcn.004baf3e
push 0
call fcn.004baf3e
mov dword [0xf81628], 1
jmp 0x4215fc
jmp 0x42148f
push 1
call fcn.004baf3e
jmp 0x4213b9
push 0
call fcn.004baf3e
mov dword [esp + 0x1c], 0x10
push dword [0xf8154c]
mov edx, 0x5e60ba
pop ecx
call fcn.0044f3d0
jne 0x42162c
push dword [0xf8154c]
push 0xffffffff
push 0x5a
call fcn.004b2473
jmp 0x421750
push 0x5a
call fcn.004b2425
push dword [0xf81498]
mov edx, 0x5e77fc
pop ecx
call fcn.0044f3d0
je 0x4216d2
mov dword [esp + 4], 0
jmp 0x42165c
push dword [0xf81864]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x4216d0
mov edx, dword [0xf81868]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81864]
push dword [ebp]
mov edx, 0x5e719a
pop ecx
call fcn.0044f3d0
je 0x4216ca
mov edx, dword [0xf81868]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81864]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.004b2473
inc dword [esp + 4]
jno 0x42165c
jmp 0x421750
mov dword [esp + 4], 0
jmp 0x4216dc
push dword [0xf81858]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x421750
mov edx, dword [0xf8185c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81858]
push dword [ebp]
mov edx, 0x5e719a
pop ecx
call fcn.0044f3d0
je 0x42174a
mov edx, dword [0xf8185c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81858]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.004b2473
inc dword [esp + 4]
jno 0x4216dc
push 0
push 0
push 0x26
call fcn.004b031c
jmp 0x42185a
mov dword [0xf81778], 0
push 0
push 0
push pe_nt_image_headers32
call fcn.004c5706
push eax
push 1
push 0x59
call fcn.004b238a
push 0x5a
call fcn.004b2425
push dword [0xf81498]
mov edx, 0x5e77fc
pop ecx
call fcn.0044f3d0
je 0x421808
mov dword [esp + 4], 0
jmp 0x4217be
push dword [0xf81864]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x421806
mov edx, dword [0xf81868]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81864]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.004b2473
inc dword [esp + 4]
jno 0x4217be
jmp 0x42185a
mov dword [esp + 4], 0
jmp 0x421812
push dword [0xf81858]
call fcn.004c528b
cmp eax, dword [esp + 4]
jl 0x42185a
mov edx, dword [0xf8185c]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xf81858]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.004b2473
inc dword [esp + 4]
jno 0x421812
mov ebx, dword [0xf81778]
cmp ebx, 0x56
jne 0x42187b
push 0
push 1
push 0x4f
call fcn.004b031c
jmp 0x4218a6
mov ebx, dword [0xf81778]
cmp ebx, 0x40
jne 0x42189c
push 0
push 1
push 0x50
call fcn.004b031c
jmp 0x4218a6
mov dword [0xf81778], 0
mov ebx, dword [0xf81694]
and ebx, ebx
jle 0x4218d0
push 0
call fcn.004b8af1
and eax, eax
je 0x4218ce
push dword [0xf814a4]
push 0x51
call fcn.004b253c
jmp 0x4218ee
push 0
call fcn.004b8af1
and eax, eax
je 0x4218ee
push dword [0xf8176c]
push 0x51
call fcn.004b253c
push dword [0xf815e8]
mov edx, 0x5e60ba
pop ecx
call fcn.0044f3d0
jne 0x421a1a
push dword [0xf815e8]
call fcn.004cc6f0
mov ebx, eax
cmp ebx, 0x1e
jle 0x4219b5
mov dword [esp + 0x20], 1
jmp 0x421925
mov eax, 0x5e7f0a
push eax
push dword [0xf815e8]
call fcn.004ccf40
cmp eax, dword [esp + 0x20]
jl 0x421971
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5e7f0a
push eax
push dword [esp + 0x2c]
push dword [0xf815e8]
call fcn.004cd090
lea eax, [esp + 0x28]
push eax
call fcn.004ceac0
inc dword [esp + 0x20]
jno 0x421925
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
mov edx, 0x5f0822
push edx
call fcn.004cea70
mov edx, dword [esp + 0x2c]
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x55
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004b253c
call fcn.0044f440
jmp 0x421a18
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
mov edx, 0x5fcc86
push edx
call fcn.004cea70
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push dword [0xf815e8]
call fcn.004cc6f0
mov ebx, eax
dec ebx
push ebx
push dword [0xf815e8]
call fcn.004ccff0
pop eax
call fcn.004ceb30
push 0x55
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004b253c
call fcn.0044f440
jmp 0x421a2a
mov eax, 0x5e60ba
push eax
push 0x55
call fcn.004b253c
xor eax, eax
push dword [esp]
call fcn.004cebc0
push dword [esp + 0xc]
call fcn.004cebc0
push dword [esp + 8]
call fcn.004cebc0
push dword [esp + 0x10]
call fcn.004cebc0
push dword [esp + 0x14]
call fcn.004cebc0
push dword [esp + 0x24]
call fcn.004cebc0
add esp, 0x28
pop edi
pop ebx
pop ebp
ret 4