Function at 0x10043319
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov eax, 0x100655bd
call fcn.10063950
sub esp, 0x184
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x6c], cl
je 0x10043370
test cl, cl
je 0x10043362
mov eax, dword [ebp + 0x28]
mov esi, dword [eax]
mov eax, dword [ebp + 0x24]
mov edx, dword [eax]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [edx + esi*4]
cmp eax, dword [ecx + esi*4]
jge 0x10043f97
mov eax, dword [ebp + 0x30]
or dword [eax], 0xffffffff
jmp 0x10043f97
mov eax, dword [ebp + 0x20]
mov dword [eax], 1
jmp 0x10043f97
cmp byte [ebp + 0x18], 0
je 0x10043f77
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 0x2c]
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x30], 0x251d69f4
mov dword [ebp - 0x30], 0x1891f782
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x14], 0x3947
cmp dword [ebp - 0x14], 0x3b13
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x100], edx
jle 0x10043461
mov edi, ebx
mov dword [ebp - 0x18], ebx
mov esi, ebx
mov dword [ebp - 0x24], ebx
mov eax, edi
mov ecx, ebx
cdq
idiv esi
mov dword [ebp - 0x20], ecx
mov eax, edx
mov dword [ebp - 0x1c], eax
mov esi, eax
mov edi, ebx
shl esi, cl
mov eax, esi
lea ecx, [ebp - 0x150]
xor eax, edi
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10043403
mov eax, dword [eax]
push eax
call fcn.1004cf6c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x150]
call fcn.100052fb
inc edi
cmp edi, 0x6b61
jl 0x100433e7
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x2af2
jl 0x100433e1
mov esi, dword [ebp - 0x24]
mov edi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x1fe5
jl 0x100433d2
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x231f
jl 0x100433cd
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, dword [ebp + 0x2c]
mov esi, dword [ebp + 0xc]
cmp dword [ebp - 0x14], 0x38f3
jge 0x10043475
push str.djjfmcfy_arwik_lrkw_oulvrbqwd_pntujbyer_vtuwvo_zqgrhzpes_dwqcoo
call fcn.1004cf6c
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1004348f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x190], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1004347e
lea eax, [ebp - 0x48]
mov edx, 0x5eb
push eax
push ecx
push ebx
call fcn.1004476f
add esp, 0xc
mov dword [ebp - 0x48], 0x13
jmp 0x100434bc
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jne 0x100434c2
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x1c
jge 0x100434b1
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
push 2
pop ecx
mov dword [ebp - 4], ecx
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xf
jne 0x1004367e
mov dword [ebp - 0x50], 0x22124f84
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x50], 3
jg 0x10043676
push ecx
lea ecx, [ebp - 0xc8]
call fcn.10004e2c
push ecx
push ecx
push ebx
push ecx
lea eax, [ebp - 0xc8]
mov byte [ebp - 4], 3
push eax
push 0x706
push 0x5e46
push 0x6d87
lea edx, [ebp - 0x11c]
mov dword [ebp - 0xe0], 8
mov ecx, 0x4b02
call fcn.10041f40
mov eax, dword [ebp - 0xc8]
add esp, 0x20
lea esi, [eax + 4]
mov dword [ebp - 0x1c], esi
mov dword [esi], ebx
cmp dword [esi], 0x15
jle 0x1004364e
mov dword [ebp - 0x14], 0x2374b1b0
mov edx, 0x69e9
xor cl, cl
call fcn.10042fd0
mov dword [ebp - 0x20], 0x6ce
cmp dword [ebp - 0x20], 0x73c
jle 0x100435ea
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [ebp - 0x180]
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100435b4
mov eax, dword [eax]
push eax
call fcn.1004cf6c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x180]
call fcn.100052fb
inc edi
cmp edi, 0x1548
jl 0x10043596
inc esi
cmp esi, 0x7ad9
jl 0x10043594
push 0x18f9
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ebx
jmp 0x10043620
lea eax, [ebp - 0xfc]
mov dword [ebp - 0xfc], 0x38591b6
push eax
lea eax, [ebp - 0x50]
xor dl, dl
push eax
push ecx
push ecx
lea eax, [ebp - 0xe0]
push eax
push ecx
mov ecx, 0x389c
call fcn.10041dcc
add esp, 0x18
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff7
jg 0x100435ef
cmp dword [ebp - 0x20], 0x2f4
jge 0x1004363a
push str.pailoyol_eultzptz_atp_hrtxsuxsm_lzwfq_zprd
call fcn.1004cf6c
pop ecx
mov dword [ebp - 4], 3
inc dword [esi]
mov eax, dword [ebp - 0xc8]
jmp 0x10043566
push eax
mov byte [ebp - 4], 2
call fcn.1004d139
pop ecx
push 2
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xc0], ebx
inc dword [ebp - 0x50]
pop ecx
jmp 0x10043507
inc dword [ebp - 0x18]
jmp 0x100434f3
mov edi, dword [ebp + 0x2c]
cmp dword [edi + 0x14], 8
jb 0x1004368b
mov eax, dword [edi]
jmp 0x1004368d
mov eax, edi
push dword [edi + 0x10]
mov ecx, dword [ebp + 0xc]
push ebx
push eax
call fcn.1002aca2
mov esi, ebx
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x68], eax
cmp esi, 0xffffffff
je 0x10043ac3
cmp esi, dword [ebp - 0xe8]
jae 0x10043ac3
mov dword [ebp - 0x14], 0xc68ec0ae
mov dword [ebp - 0x20], 0xf47a6de
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x58], 0xa6f44401
mov dword [ebp - 0xdc], 0xffffffff
push 0xfffffffffffffffc
pop esi
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0xf0], 0x299e885d
mov dword [ebp - 0x1c], 0xf407293c
mov dword [ebp - 0x58], 0x1295
mov dword [ebp - 0x58], 0x6113
mov dword [ebp - 0x14], 0xfffffff5
cmp dword [ebp - 0x14], 0xfffffffb
jge 0x1004381c
mov dword [ebp - 0x60], 0x6cce57bf
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x18], 0xf2d
cmp dword [ebp - 0x18], 0x1044
jle 0x10043776
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x10080db8
and eax, esi
cdq
push edx
push eax
call fcn.10004c02
inc edi
cmp edi, 0x1e79
jl 0x10043750
inc esi
cmp esi, 0x5fda
jl 0x1004374e
mov edi, dword [ebp + 0x2c]
mov byte [ebp - 4], 6
cmp dword [ebp - 0x18], 0xbd9
jge 0x100437bf
mov edx, str.pzpb_zfi_yagku_cvwjhmc_ssul_ncgvw_mwrt
mov ecx, 0x10080db8
call fcn.10007110
jmp 0x100437bf
mov dword [ebp - 4], 2
mov dword [ebp - 0xd8], 0x3e2f7c62
mov dword [ebp - 0x18], ebx
jmp 0x100437e6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x12c], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100437d5
push ecx
push 0x515e
lea eax, [ebp - 0xd8]
push eax
push 0x2e2
push ecx
push ecx
push 0x5ecf
push 0x2c4a
mov cl, 1
call fcn.10041b2a
add esp, 0x20
inc dword [ebp - 0x14]
jmp 0x10043728
mov dword [ebp - 0x18], 8
cmp dword [ebp - 0x18], 0xfffffff0
jl 0x10043a8f
mov dword [ebp - 0xf4], ebx
lea ecx, [ebp - 0xbc]
push 4
call fcn.10004e2c
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x60], 0x98dc509c
mov dword [ebp - 0xec], 0x187b35f1
mov dword [ebp - 0x28], 9
push 3
call fcn.10004e2c
mov byte [ebp - 4], 9
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x54], 0x499e98c5
mov dword [ebp - 0x80], 0x1dc6
cmp dword [ebp - 0x80], 0x1f23
jle 0x100438f5
mov edi, ebx
mov dword [ebp - 0x4c], ebx
mov esi, ebx
mov eax, edi
mov dword [ebp - 0x64], ebx
mov ecx, esi
mov edi, ebx
sar eax, cl
mov dword [ebp - 0xe4], eax
mov ecx, ebx
mov dword [ebp - 0x64], ebx
mov eax, edi
cdq
idiv ecx
mov ecx, 0x10080db8
and edx, dword [ebp - 0xe4]
mov eax, edx
cdq
push edx
push eax
call fcn.10004c02
mov ecx, dword [ebp - 0x64]
inc ecx
mov dword [ebp - 0x64], ecx
cmp ecx, 0x69fb
jl 0x100438a8
inc edi
cmp edi, 0x7e9d
jl 0x100438a3
mov edi, dword [ebp - 0x4c]
inc esi
cmp esi, 0x204c
jl 0x10043892
inc edi
mov dword [ebp - 0x4c], edi
cmp edi, 0x4940
jl 0x10043890
mov edi, dword [ebp + 0x2c]
mov dword [ebp - 0x4c], 0x267a
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x80], 0x1ade
jge 0x10043945
mov edx, str.eua_lmjtl_qpaci_pqtxfc_yrcgujilw_xcwbleupm_qreso_kfoky_qraa_ubsh_atwbj_vusz
mov ecx, 0x10080db8
call fcn.10007110
jmp 0x10043945
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 9
push ebx
push eax
lea edx, [ebp - 0xbc]
mov ecx, 0xabc
call fcn.10044c75
pop ecx
lea eax, [ebp - 0xa4]
push eax
push 1
lea eax, [ebp - 0x38]
push eax
push ecx
push 0x5446
mov ecx, 0x1541
call fcn.10042008
xor edx, edx
mov dword [ebp - 0x38], ebx
add esp, 0x18
inc edx
cmp dword [ebp - 0x38], 2
jge 0x1004399d
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x108], edx
inc dword [ebp - 0x38]
jmp 0x10043988
inc dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x14], ebx
jne 0x100439ca
mov ecx, ebx
cmp dword [ebp - 0xf0], ebx
je 0x100439cc
mov ecx, edx
mov eax, dword [ebp - 0xdc]
sub ecx, eax
mov dword [ebp - 0x10c], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xa4]
cmp dword [eax], 0xd872
jl 0x100439ee
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
sub ecx, 0x63f4
neg ecx
sbb ecx, ecx
inc ecx
lea eax, [eax + ecx*2]
test eax, eax
je 0x10043a1c
mov esi, edx
cmp dword [ebp - 0x1c], ebx
jne 0x10043a1e
mov esi, ebx
mov ecx, dword [ebp - 0xbc]
mov eax, dword [ecx + 8]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x104]
add eax, esi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push dword [ebp - 0xa4]
mov dword [ebp - 0x104], eax
call fcn.1004d139
mov byte [ebp - 4], 2
push dword [ebp - 0xbc]
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
call fcn.1004d139
pop ecx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], ebx
dec dword [ebp - 0x18]
pop ecx
jmp 0x10043823
mov ecx, dword [ebp - 0x68]
cmp ecx, 0xffffffff
jne 0x10043b78
push 0x5cbb
xor dl, dl
mov ecx, 0x47d8
call fcn.10044cf8
push dword [ebp + 0xc]
lea eax, [ebp - 0x5c]
push ecx
push ecx
push eax
lea ecx, [ebp - 0xb0]
call fcn.10046129
add esp, 0x14
mov dword [ebp - 0x24], 0x3ae35568
mov dword [ebp - 0x24], 0xffffffee
cmp dword [ebp - 0x24], 0xb
jge 0x10043f58
mov dword [ebp - 0x54], 0x34d1
cmp dword [ebp - 0x54], 0x356b
jle 0x10043b49
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x27c4
mov edi, ebx
mov dword [ebp - 0x30], ebx
mov ecx, edi
mov ebx, esi
mov esi, dword [ebp - 0x30]
shl ebx, cl
mov eax, esi
mov ecx, 0x10080db8
xor eax, ebx
cdq
push edx
push eax
call fcn.10004c02
inc esi
cmp esi, 0x676a
jl 0x10043b08
mov esi, dword [ebp - 0x20]
inc edi
push 0
pop ebx
cmp edi, 0x2112
jl 0x10043afc
dec esi
dec dword [ebp - 0x1c]
mov dword [ebp - 0x20], esi
jne 0x10043afa
mov esi, dword [ebp - 0x28]
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 0x4e19
jl 0x10043af0
push 2
lea ecx, [ebp - 0x7c]
call fcn.10004e2c
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x54], 0x3354
jge 0x10043edb
mov edx, str.njhkqhkvr_pfgew_wpv_oiqtr_rxtmghky_rntmqypjf_pxjcmxvz_born_umjbqaosg_cemrr_qbhu
mov ecx, 0x10080db8
call fcn.10007110
jmp 0x10043edb
cmp ecx, dword [ebp - 0x5c]
je 0x10043e99
mov dword [ebp - 0x14], 0xc7c8a6b9
mov dword [ebp - 0x28], 0x719b
cmp dword [ebp - 0x28], 0x7380
jle 0x10043bec
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x1c], 0x7162
mov eax, edi
lea ecx, [ebp - 0x168]
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10043bbd
mov eax, dword [eax]
push eax
call fcn.1004cf6c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x168]
call fcn.100052fb
add edi, esi
dec dword [ebp - 0x1c]
jne 0x10043ba3
inc esi
cmp esi, 0x6dc4
jl 0x10043b9a
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [ebp + 0x2c]
push 4
lea ecx, [ebp - 0xd4]
call fcn.10004e2c
cmp dword [ebp - 0x28], 0x7017
jge 0x10043c0d
push str.tuxq_adaxzauk_kybfo_ocmpftrn_tfpxyak_uoy_rkff_iprfhpo_fktn_mluqc_nzmmka
call fcn.1004cf6c
pop ecx
mov dword [ebp - 4], 0xc
lea edx, [ebp - 0x40]
push 0x23c3
mov dword [ebp - 0x18], 0x8a9017ca
lea ecx, [ebp - 0xd4]
push 0x6568
mov dword [ebp - 0x3c], 0x795e
mov dword [ebp - 0x58], 0x1b16eb2d
push 0x12b8
mov dword [ebp - 0x58], 0x5ee6d54e
mov dword [ebp - 0x84], 0x74307976
push ebx
call fcn.10042425
xor edx, edx
mov dword [ebp - 0x40], ebx
add esp, 0x10
inc edx
jmp 0x10043c70
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x8c], edx
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], edx
jl 0x10043c63
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0xd4]
neg eax
push 0
sbb eax, eax
inc eax
mov ecx, dword [esi + 4]
pop eax
sets al
sub eax, ecx
neg eax
sbb eax, eax
inc eax
imul eax, ecx
cmp dword [ebp - 0x14], eax
jne 0x10043cab
mov eax, edx
cmp dword [esi + 4], ebx
jne 0x10043cad
mov eax, ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jne 0x10043cbc
mov eax, ebx
cmp dword [ebp - 0x3c], ebx
je 0x10043cbe
mov eax, edx
cmp dword [ebp - 0x14], eax
jle 0x10043cca
mov ecx, ebx
cmp dword [ebp - 0x18], ebx
je 0x10043ccc
mov ecx, edx
mov eax, dword [ebp - 0x8c]
sub ecx, eax
add ecx, 0xa74a
je 0x10043d2a
mov dword [ebp - 0xf8], edx
lea eax, [ebp - 0xf8]
mov dword [ebp - 0x3c], 0xfffffffe
mov ecx, 0x7bdf
push 0x1a0b
mov dword [ebp - 0x3c], 0x60d64c9d
push eax
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x3c], edx
xor dl, dl
push 0x41d0
call fcn.10043fec
pop ecx
lea ecx, [ebp - 0x84]
call fcn.10042afd
pop ecx
pop ecx
jmp 0x10043e4e
mov dword [ebp - 0x1c], 0xcb7be74f
mov dword [ebp - 0x24], 0x7bc41bbb
mov dword [ebp - 0x20], 0xf0d602ff
cmp dword [ebp - 0x24], ebx
je 0x10043d4a
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp eax, 1
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, dword [ebp - 0x24]
je 0x10043d74
cmp dword [ebp - 0x20], ebx
je 0x10043d74
xor edx, edx
inc edx
jmp 0x10043d76
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
test eax, eax
sets cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x8c]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
cmp ecx, 0xffffffff
setl dl
xor ecx, ecx
cmp eax, edx
setg cl
cmp ecx, dword [ebp - 0x20]
jg 0x10043e22
push 3
lea ecx, [ebp - 0x98]
call fcn.10004e2c
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0xf
push eax
push 0x1118
lea eax, [ebp - 0x120]
push eax
push ebx
push ecx
mov ecx, 0x156c
call fcn.10042347
add esp, 8
mov byte [ebp + 0x1f], bl
lea ecx, [ebp + 0x1f]
call fcn.100445d5
push ebx
lea edx, [ebp - 0x98]
mov ecx, 0x6bf1
call fcn.10041fdd
add esp, 0x10
cmp dword [ebp - 0x98], 0
je 0x10043e4e
push dword [ebp - 0x98]
call fcn.1004d139
pop ecx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
jmp 0x10043e4e
push 0x7230
push 0x37c7
push ecx
push ecx
mov dword [ebp - 0x1c], 0x573c
mov dl, 1
dec dword [ebp - 0x1c]
push 0xb22
push ecx
lea ecx, [ebp - 0x31]
mov byte [ebp - 0x31], bl
call fcn.10041dcc
add esp, 0x18
mov byte [ebp - 4], 2
push dword [ebp - 0xd4]
call fcn.1004d139
push ecx
push 1
push ecx
push 0x46f3
push dword [ebp + 0xc]
lea eax, [ebp - 0x5c]
mov dword [ebp - 0xd4], ebx
push eax
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xd0], ebx
push eax
mov edx, 0x55b4
mov dword [ebp - 0xcc], ebx
lea ecx, [ebp - 0x68]
call fcn.10041f40
mov ecx, dword [ebp - 0x68]
add esp, 0x20
mov esi, dword [ebp - 0x30]
add esi, ecx
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x5c], esi
jb 0x10043eab
mov eax, dword [edi]
jmp 0x10043ead
mov eax, edi
push dword [edi + 0x10]
mov ecx, dword [ebp + 0xc]
push esi
push eax
call fcn.1002aca2
jmp 0x1004369f
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x44], ebx
jmp 0x10043ef8
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x138], 0x3eb905d0
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 3
jl 0x10043ee7
push 0x54c8
lea eax, [ebp - 0x7c]
push eax
push 0x11e7
push 1
push ecx
lea ecx, [ebp - 0x44]
call fcn.10042347
mov esi, dword [ebp - 0x7c]
add esp, 0x14
mov dword [esi], ebx
push 0x1a74
push ecx
push 1
lea edx, [ebp - 0x29]
mov byte [ebp - 0x29], bl
call fcn.1004476f
add esp, 0xc
inc dword [esi]
cmp dword [esi], 2
jle 0x10043f1f
push esi
mov byte [ebp - 4], 2
call fcn.1004d139
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], ebx
inc dword [ebp - 0x24]
pop ecx
jmp 0x10043ad1
mov ecx, dword [ebp - 0x100]
lea eax, [ebp - 0xb0]
push eax
call fcn.10046874
lea ecx, [ebp - 0xb0]
call fcn.10046c2b
jmp 0x10043f97
mov eax, dword [ebp + 8]
cmp dword [eax], 0xffffffff
je 0x10043f97
push dword [ebp + 0x10]
mov edx, 0x5cba
mov ecx, 0x6140
push eax
push 0
call fcn.10045922
add esp, 0xc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret