Function at 0x43f9a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4d91f5
mov eax, dword fs:[0]
push eax
sub esp, 0x388
mov eax, dword [0x536f50]
xor eax, esp
mov dword [esp + 0x384], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x536f50]
xor eax, esp
push eax
lea eax, [esp + 0x39c]
mov dword fs:[0], eax
mov eax, dword [0x53ac30]
mov edx, dword [eax + 0xc]
mov ecx, 0x53ac30
call edx
add eax, 0x10
mov dword [esp + 0x1c], eax
mov eax, dword [0x53ac30]
mov edx, dword [eax + 0xc]
xor esi, esi
mov ecx, 0x53ac30
mov dword [esp + 0x3a4], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x2c], esi
call edx
add eax, 0x10
mov dword [esp + 0x20], eax
push fcn.004018f0
push 0x41aa30
push 0x12
push 4
lea eax, [esp + 0x50]
push eax
lea edi, [esi + 1]
mov byte [esp + 0x3b8], 1
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], esi
call fcn.0047f304
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
mov bl, 2
push str.bKqKpJfLbKtJbK
mov byte [esp + 0x3ac], bl
call fcn.0043f8f0
lea ecx, [esp + 0x18]
push ecx
call fcn.00441140
add esp, 8
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x3a8], 3
call fcn.0042b090
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43faa5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.6KoBsAqEoLcJrD0MXIvMdIuMaEIK8JsIcN5JHJeLeIaLuLnLoM0MTJpLeLaM8NuMfKiMaJeLvM
call fcn.0043f8f0
lea ecx, [esp + 0x18]
push ecx
call fcn.00441140
add esp, 8
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x3a8], 4
call fcn.0042b090
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43fafe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.9D8C6A9BqJcJqJrIlMnIlLcEAM7ByJ
call fcn.0043f8f0
lea ecx, [esp + 0x18]
push ecx
call fcn.00441140
add esp, 8
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x3a8], 5
call fcn.0042b090
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43fb57
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.9D8CaE7BbF9D6CoK9MpKuKkLuMcJ4LmJmI4LuNpNbKrJuKsJpJcExB8CsCeE
call fcn.0043f8f0
lea ecx, [esp + 0x18]
push ecx
call fcn.00441140
add esp, 8
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0x3a8], 6
call fcn.0042b090
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43fbb0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.9DbF8CaE9D9DcEsJoKgMoL3MtJmJ3MuMfKvMoMnIuMfK4LkLlL4LqJtJbKvNtJsJrL7DvD9D6N7B9B
call fcn.0043f8f0
lea ecx, [esp + 0x18]
push ecx
call fcn.00441140
add esp, 8
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x3a8], 7
call fcn.0042b090
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43fc09
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.7D7B4J
call fcn.0043f8f0
lea ecx, [esp + 0x18]
push ecx
call fcn.00441140
add esp, 8
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x3a8], 8
call fcn.0042b090
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43fc62
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.ZMlKdLoMrMbKpLcJ5JmDoEmA
call fcn.0043f8f0
lea ecx, [esp + 0x18]
push ecx
call fcn.00441140
add esp, 8
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x5c]
mov byte [esp + 0x3a8], 9
call fcn.0042b090
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43fcbb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.oBrDmAqJdIZKSKRL4IGIcJcKbKoNlJvLON9KmJmI
call fcn.0043f8f0
lea ecx, [esp + 0x18]
push ecx
call fcn.00441140
add esp, 8
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0x3a8], 0xa
call fcn.0042b090
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43fd14
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.FKrLrLnLlM9KbKuKhImJnJ7LmDoEpDrIfKlB9MzLeL
call fcn.0043f8f0
lea ecx, [esp + 0x18]
push ecx
call fcn.00441140
add esp, 8
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x3a8], 0xb
call fcn.0042b090
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43fd6d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.ZKuNdIrJ8CCM8JpNaL5JJLeLfJdMtIgMpN6KXNrJdIcKcJuMcJlL9KfKoL
call fcn.0043f8f0
lea ecx, [esp + 0x18]
push ecx
call fcn.00441140
add esp, 8
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x68]
mov byte [esp + 0x3a8], 0xc
call fcn.0042b090
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43fdc6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.U29mdHdhcmVcMzYwXDM2MHNlNVxzZTY
call fcn.0043f8f0
lea ecx, [esp + 0x18]
push ecx
call fcn.00440ec0
add esp, 8
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x6c]
mov byte [esp + 0x3a8], 0xd
call fcn.0042b090
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43fe1f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.aG9tZXBhZ2U
call fcn.0043f8f0
lea ecx, [esp + 0x18]
push ecx
call fcn.00440ec0
add esp, 8
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x70]
mov byte [esp + 0x3a8], 0xe
call fcn.0042b090
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43fe78
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.aGFvc291LmNvbQ
call fcn.0043f8f0
lea ecx, [esp + 0x18]
push ecx
call fcn.00440ec0
add esp, 8
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x74]
mov byte [esp + 0x3a8], 0xf
call fcn.0042b090
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43fed1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.c28uY29t
call fcn.0043f8f0
lea ecx, [esp + 0x18]
push ecx
call fcn.00440ec0
add esp, 8
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x78]
mov byte [esp + 0x3a8], 0x10
call fcn.0042b090
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43ff2a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.MzYwMC5jb20
call fcn.0043f8f0
lea ecx, [esp + 0x18]
push ecx
call fcn.00440ec0
add esp, 8
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x7c]
mov byte [esp + 0x3a8], 0x11
call fcn.0042b090
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43ff83
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.aGFvLjM2MC5jbg
call fcn.0043f8f0
lea ecx, [esp + 0x18]
push ecx
call fcn.00440ec0
add esp, 8
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0x3a8], 0x12
call fcn.0042b090
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43ffdf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXDM2MHNlNg
call fcn.0043f8f0
lea ecx, [esp + 0x18]
push ecx
call fcn.00440ec0
add esp, 8
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x84]
mov byte [esp + 0x3a8], 0x13
call fcn.0042b090
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44003b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.RGlzcGxheUljb24
call fcn.0043f8f0
lea ecx, [esp + 0x18]
push ecx
call fcn.00440ec0
add esp, 8
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x88]
mov byte [esp + 0x3a8], 0x14
call fcn.0042b090
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x440097
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esp + 0x68]
lea ecx, [esp + 0x2c]
push ecx
push edx
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x44036d
push 0x400
push esi
lea ecx, [esp + 0x1c]
call fcn.0043f380
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3a8], 0x15
call fcn.0042be70
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4400fc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x40]
push eax
push esi
lea ecx, [esp + 0x7c]
push ecx
push edx
mov dword [esp + 0x54], 0x400
mov dword [esp + 0x50], edi
call fcn.004416e0
add esp, 0x18
test eax, eax
jne 0x440362
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00441a90
add esp, 8
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3a8], 0x16
call fcn.0042be70
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44017d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
cmp dword [eax - 4], edi
jle 0x440197
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [esp + 0x24]
call fcn.004031c0
mov eax, dword [esp + 0x20]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0043f820
lea edx, [esp + 0x2c]
push edx
call fcn.00440ec0
add esp, 8
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x3a8], 0x17
call fcn.0042cce0
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3a8], 0x18
call fcn.0042be70
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], 0x17
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4401ff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x440226
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x70]
cmp eax, esi
je 0x440258
mov ecx, dword [esp + 0x20]
cmp dword [ecx - 0xc], esi
jl 0x44025c
push eax
push ecx
call fcn.0047ab84
add esp, 8
cmp eax, esi
je 0x440258
mov ecx, dword [esp + 0x20]
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
jne 0x4402e2
jmp 0x44025c
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x74]
cmp eax, esi
je 0x440284
cmp dword [ecx - 0xc], esi
jl 0x440284
push eax
push ecx
call fcn.0047ab84
mov ecx, dword [esp + 0x28]
add esp, 8
cmp eax, esi
je 0x440284
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
jne 0x4402e2
mov eax, dword [esp + 0x78]
cmp eax, esi
je 0x4402ac
cmp dword [ecx - 0xc], esi
jl 0x4402ac
push eax
push ecx
call fcn.0047ab84
mov ecx, dword [esp + 0x28]
add esp, 8
cmp eax, esi
je 0x4402ac
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
jne 0x4402e2
mov eax, dword [esp + 0x7c]
cmp eax, esi
je 0x440362
cmp dword [ecx - 0xc], esi
jl 0x440362
push eax
push ecx
call fcn.0047ab84
add esp, 8
cmp eax, esi
je 0x440362
sub eax, dword [esp + 0x20]
sar eax, 1
cmp eax, 0xffffffff
je 0x440362
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push fcn.004018f0
push 0x12
push 4
lea edx, [esp + 0x4c]
push edx
mov byte [esp + 0x3b4], 1
call fcn.0047d699
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x440330
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esp + 0x3a4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44035b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x440cab
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x5c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea edx, [esp + 0x2c]
push edx
push eax
push SysReAllocString
call ebp
mov edi, 0xff
test eax, eax
jne 0x44066d
push edi
push esi
lea ecx, [esp + 0x1c]
call fcn.0043f380
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3a8], 0x19
call fcn.0042be70
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4403d5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x4fbc8f
lea ecx, [esp + 0x18]
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], 1
call fcn.0042cce0
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x40]
push ecx
push esi
push eax
push edx
mov byte [esp + 0x3bc], 0x1a
call fcn.004416e0
add esp, 0x18
test eax, eax
mov eax, dword [esp + 0x14]
sete byte [esp + 0x1b]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x440443
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0x1b], 0
je 0x440655
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00441a90
add esp, 8
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x3a8], 0x1b
call fcn.0042be70
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x440499
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
cmp dword [ecx - 0xc], 0
jge 0x4404a8
or eax, 0xffffffff
jmp 0x4404c7
push 0x4e2340
push ecx
call fcn.0047ab84
mov ecx, dword [esp + 0x24]
add esp, 8
test eax, eax
jne 0x4404c3
or eax, 0xffffffff
jmp 0x4404c7
sub eax, ecx
sar eax, 1
add eax, 1
je 0x440655
cmp dword [ecx - 0xc], 0
jge 0x4404db
or eax, 0xffffffff
jmp 0x4404f8
push 0x4e233c
push ecx
call fcn.0047ab84
add esp, 8
test eax, eax
jne 0x4404f2
or eax, 0xffffffff
jmp 0x4404f8
sub eax, dword [esp + 0x1c]
sar eax, 1
add eax, 1
je 0x440655
push 0x4df5fc
lea ecx, [esp + 0x2c]
call fcn.0042cce0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x3b0], 0x1c
call fcn.00441810
add esp, 0xc
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x3a8], 0x1d
call fcn.0042be70
lea ecx, [esp + 0x14]
call fcn.004018f0
lea ecx, [esp + 0x28]
mov byte [esp + 0x3a4], bl
call fcn.004018f0
push 0x4de910
push 0x4dfd24
lea ecx, [esp + 0x24]
call fcn.0041a140
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.004419c0
add esp, 8
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x3a8], 0x1e
call fcn.0042be70
lea ecx, [esp + 0x14]
mov byte [esp + 0x3a4], bl
call fcn.004018f0
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.004419c0
mov esi, eax
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x3b4], 0x1f
call fcn.004419c0
add esp, 0x10
mov esi, dword [esi]
mov eax, dword [eax]
push esi
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3ac], 0x20
call fcn.0041a140
lea ecx, [esp + 0x14]
call fcn.004018f0
lea ecx, [esp + 0x28]
mov byte [esp + 0x3a4], bl
call fcn.004018f0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00441b10
push 0x4fbc8f
push eax
mov byte [esp + 0x3b4], 0x21
call fcn.0043f7b0
add esp, 0x10
mov byte [esp + 0x1b], al
mov byte [esp + 0x3a4], bl
lea ecx, [esp + 0x14]
call fcn.004018f0
cmp byte [esp + 0x1b], 0
je 0x440655
lea eax, [esp + 0x1c]
push eax
call fcn.00441620
add esp, 4
cmp eax, 0x64
jbe 0x440655
mov dword [esp + 0x34], 1
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x34], 0
jne 0x440c39
xor esi, esi
mov eax, dword [esp + 0x80]
lea edx, [esp + 0x2c]
push edx
push eax
push reloc.WS2_32.dll_accept
call ebp
test eax, eax
jne 0x44089a
push edi
push esi
lea ecx, [esp + 0x1c]
call fcn.0043f380
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3a8], 0x22
call fcn.0042be70
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4406cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x40]
push eax
push esi
lea ecx, [esp + 0x94]
push ecx
push edx
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], 1
call fcn.004416e0
add esp, 0x18
test eax, eax
jne 0x440882
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00441a90
add esp, 8
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x3a8], 0x23
call fcn.0042be70
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x440751
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
cmp dword [eax - 0xc], 0
jge 0x440760
or eax, 0xffffffff
jmp 0x44077d
push 0x4e2340
push eax
call fcn.0047ab84
add esp, 8
test eax, eax
jne 0x440777
or eax, 0xffffffff
jmp 0x44077d
sub eax, dword [esp + 0x1c]
sar eax, 1
add eax, 1
je 0x440882
push 0x4de910
push 0x4dfd24
lea ecx, [esp + 0x24]
call fcn.0041a140
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.004419c0
add esp, 8
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x3a8], 0x24
call fcn.0042be70
lea ecx, [esp + 0x14]
mov byte [esp + 0x3a4], bl
call fcn.004018f0
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.004419c0
mov esi, eax
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x3b4], 0x25
call fcn.004419c0
add esp, 0x10
mov esi, dword [esi]
mov eax, dword [eax]
push esi
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3ac], 0x26
call fcn.0041a140
lea ecx, [esp + 0x14]
call fcn.004018f0
lea ecx, [esp + 0x28]
mov byte [esp + 0x3a4], bl
call fcn.004018f0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x34]
push edx
call fcn.00441b10
push 0x4fbc8f
push eax
mov byte [esp + 0x3b4], 0x27
call fcn.0043f7b0
add esp, 0x10
lea ecx, [esp + 0x30]
mov byte [esp + 0x1b], al
mov byte [esp + 0x3a4], bl
call fcn.004018f0
cmp byte [esp + 0x1b], 0
je 0x440882
lea eax, [esp + 0x1c]
push eax
call fcn.00441620
add esp, 4
cmp eax, 0x64
jbe 0x440882
mov dword [esp + 0x34], 1
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x34], 0
jne 0x440c39
xor esi, esi
push 0x206
lea eax, [esp + 0x92]
xor edx, edx
push esi
push eax
mov word [esp + 0x98], dx
call fcn.0047a920
add esp, 0xc
push esi
push 0x1a
lea ecx, [esp + 0x94]
push ecx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.0043f440
add esp, 0xc
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x3a8], 0x28
call fcn.0042be70
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44091f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x34]
push edx
call fcn.00441b10
push 0x4fbc8f
push eax
mov byte [esp + 0x3b4], 0x29
call fcn.0043f7b0
mov byte [esp + 0x2b], al
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
add esp, 0x10
mov byte [esp + 0x3a4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44096f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0x1b], 0
je 0x44098c
lea ecx, [esp + 0x1c]
push ecx
call fcn.00441620
add esp, 4
cmp eax, 0x64
ja 0x440c31
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x440a46
lea eax, [esp + 0x28]
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x440a3a
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x96]
push edx
mov word [esp + 0x98], cx
call fcn.0047a920
mov ecx, dword [esp + 0x34]
add esp, 0xc
lea eax, [esp + 0x8c]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea edx, [esp + 0x8c]
push edx
call fcn.0043f160
add esp, 4
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x440a00
lea edi, [esp + 0x294]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x440a11
mov edx, dword [esp + 0x28]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
xor esi, esi
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [esp + 0x294]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x440a50
mov ecx, dword [0x4e2328]
mov edx, dword [0x4e232c]
mov dword [eax], ecx
mov ecx, dword [0x4e2330]
mov dword [eax + 4], edx
mov edx, dword [0x4e2334]
mov dword [eax + 8], ecx
mov ecx, dword [0x4e2338]
mov dword [eax + 0xc], edx
lea edx, [esp + 0x294]
push esi
push edx
mov dword [eax + 0x10], ecx
call fcn.0047f2ec
add esp, 8
cmp eax, 0xffffffff
je 0x440c39
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x298]
push ecx
call fcn.0043f0f0
add esp, 4
push eax
call fcn.0043f1b0
lea edx, [esp + 0x94]
push 0
push edx
call fcn.0047f2ec
add esp, 0x10
cmp eax, 0xffffffff
je 0x440c39
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x20]
call fcn.0042b090
lea ecx, [esp + 0x8c]
push ecx
lea edx, [esp + 0x20]
push 0x4e2238
push edx
call fcn.00420c60
mov eax, dword [esp + 0x28]
add esp, 0xc
cmp dword [eax - 0xc], 0
jge 0x440b11
or eax, 0xffffffff
jmp 0x440b2e
push 0x4e2340
push eax
call fcn.0047ab84
add esp, 8
test eax, eax
jne 0x440b28
or eax, 0xffffffff
jmp 0x440b2e
sub eax, dword [esp + 0x1c]
sar eax, 1
add eax, 1
je 0x440c39
push 0x4de910
push 0x4dfd24
lea ecx, [esp + 0x24]
call fcn.0041a140
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.004419c0
add esp, 8
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x3a8], 0x2a
call fcn.0042be70
lea ecx, [esp + 0x30]
mov byte [esp + 0x3a4], bl
call fcn.004018f0
lea edx, [esp + 0x64]
push edx
lea eax, [esp + 0x8c]
push eax
call fcn.004419c0
mov esi, eax
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0x3c]
push edx
mov byte [esp + 0x3b4], 0x2b
call fcn.004419c0
add esp, 0x10
mov esi, dword [esi]
mov eax, dword [eax]
push esi
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3ac], 0x2c
call fcn.0041a140
lea ecx, [esp + 0x30]
call fcn.004018f0
lea ecx, [esp + 0x88]
mov byte [esp + 0x3a4], bl
call fcn.004018f0
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00441b10
push 0x4fbc8f
push eax
mov byte [esp + 0x3b4], 0x2d
call fcn.0043f7b0
add esp, 0x10
lea ecx, [esp + 0x24]
mov byte [esp + 0x1b], al
mov byte [esp + 0x3a4], bl
call fcn.004018f0
cmp byte [esp + 0x1b], 0
je 0x440c39
lea edx, [esp + 0x1c]
push edx
call fcn.00441620
add esp, 4
cmp eax, 0x64
jbe 0x440c39
mov dword [esp + 0x34], 1
push fcn.004018f0
push 0x12
push 4
lea eax, [esp + 0x4c]
push eax
mov byte [esp + 0x3b4], 1
call fcn.0047d699
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x3a4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x440c7c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esp + 0x3a4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x440ca7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x39c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x384]
xor ecx, esp
call fcn.0047a885
add esp, 0x394
ret