Function at 0x424d90
Capabilities:
Create directory
Get common file path
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2a8
mov esi, esp
mov dword [esi + 0x290], ebp
mov dword [esi + 0x294], esp
mov dword [esi + 0x2a0], 0xffffffff
mov dword [esi + 0x29c], 0x5135d0
mov dword [esi + 0x24], ecx
lea eax, [esi + 0x298]
mov ecx, dword fs:[0]
mov dword [esi + 0x298], ecx
mov dword fs:[0], eax
cmp byte [0x6ceef8], 0
je 0x425342
lea ebx, [esi + 0x84]
push ebx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x424e4a
push ebx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x424e4a
mov dword [esi + 0x54], 7
mov dword [esi + 0x50], 0
mov word [esi + 0x40], 0
push ebx
call fcn.005d3244
add esp, 4
mov edi, eax
cmp eax, 7
jbe 0x424e60
sub esp, 0xc
mov al, byte [esi + 0xc]
lea ecx, [esi + 0x40]
mov byte [esp + 4], al
mov dword [esp + 8], ebx
mov dword [esp], edi
call fcn.00405590
jmp 0x424e7c
mov dword [esi + 0x54], 7
mov dword [esi + 0x50], 0
mov word [esi + 0x40], 0
jmp 0x424e7c
mov eax, edi
mov dword [esi + 0x50], edi
lea ecx, [esi + 0x40]
add eax, edi
push eax
push ebx
push ecx
call fcn.0061e340
add esp, 0xc
mov word [esi + edi*2 + 0x40], 0
mov ebx, dword [str.acrord32_sbx]
mov dword [esi + 0x20], 7
mov dword [esi + 0x1c], 0
mov word [esi + 0xc], 0
push ebx
call fcn.005d3244
add esp, 4
mov edi, eax
cmp eax, 7
jbe 0x424ecb
mov dword [esi + 0x2a0], 9
sub esp, 0xc
mov al, byte [esi + 0x58]
lea ecx, [esi + 0xc]
mov byte [esp + 4], al
mov dword [esp + 8], ebx
mov dword [esp], edi
call fcn.00405590
jmp 0x424ee7
mov eax, edi
mov dword [esi + 0x1c], edi
lea ecx, [esi + 0xc]
add eax, edi
push eax
push ebx
push ecx
call fcn.0061e340
add esp, 0xc
mov word [esi + edi*2 + 0xc], 0
mov ebx, dword [esi + 0x50]
cmp dword [esi + 0x54], 7
jbe 0x424ef5
mov edi, dword [esi + 0x40]
jmp 0x424ef8
lea edi, [esi + 0x40]
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x1c]
mov edx, ecx
sub edx, eax
cmp edx, ebx
jae 0x424f3c
mov dword [esi + 0x2a0], 0xa
sub esp, 0x14
mov al, byte [esi + 0x58]
lea ecx, [esi + 0xc]
mov byte [esp + 4], al
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov dword [esp], ebx
mov dword [esp + 8], 0
call fcn.0041ef90
mov edi, eax
jmp 0x424fc5
lea edx, [eax + ebx]
cmp ecx, 7
mov dword [esi + 0x1c], edx
jbe 0x424f4c
mov edx, dword [esi + 0xc]
jmp 0x424f4f
lea edx, [esi + 0xc]
lea ecx, [edi + ebx*2]
mov dword [esi], ebx
cmp ecx, edx
mov dword [esi + 0x80], ecx
jbe 0x424f77
lea ecx, [edx + eax*2]
mov dword [esi], ebx
cmp ecx, edi
jb 0x424f77
mov ecx, edx
mov dword [esi], 0
sub ecx, edi
jbe 0x424f77
sar ecx, 1
mov dword [esi], ecx
mov dword [esi + 0x7c], edi
lea edi, [esi + 0xc]
lea eax, [eax + eax + 2]
lea ecx, [edx + ebx*2]
push eax
push edx
push ecx
mov dword [esi + 8], edx
call fcn.0061e340
add esp, 0xc
mov eax, dword [esi]
add eax, eax
push eax
push dword [esi + 0x7c]
push dword [esi + 8]
call fcn.0061e340
add esp, 0xc
mov edx, dword [esi]
mov eax, dword [esi + 0x80]
mov ecx, dword [esi + 8]
sub ebx, edx
lea eax, [eax + edx*2]
lea ecx, [ecx + edx*2]
add ebx, ebx
push ebx
push eax
push ecx
call fcn.0061e340
add esp, 0xc
movsd xmm0, qword [edi]
movsd xmm1, qword [edi + 8]
movsd qword [esi + 0x84], xmm0
movsd qword [esi + 0x8c], xmm1
movsd xmm0, qword [edi + 0x10]
movsd qword [esi + 0x94], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], 0
mov ecx, dword [esi + 0x20]
cmp ecx, 8
jb 0x425043
mov eax, dword [esi + 0xc]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x42502f
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4258ec
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov dword [esi + 0x2a0], 0xb
lea eax, [esi + 0x70]
mov dword [esi + 0x74], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x2a0], 0xb
push eax
call fcn.00426060
add esp, 4
cmp dword [esi + 0x98], 7
lea ecx, [esi + 0x84]
jbe 0x425083
mov ecx, dword [esi + 0x84]
cmp dword [esi + 0x54], 7
jbe 0x42508e
mov eax, dword [esi + 0x40]
jmp 0x425091
lea eax, [esi + 0x40]
lea edx, [esi + 0x70]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
test eax, eax
jne 0x4250b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x425298
cmp dword [esi + 0x98], 7
jbe 0x4250c3
mov eax, dword [esi + 0x84]
jmp 0x4250c9
lea eax, [esi + 0x84]
push 0
push 0x2000000
push 3
push 0
push 3
push 0x120089
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x6cef00], eax
lea eax, [esi + 0xc]
push str.TEMP
push eax
call fcn.004263b0
add esp, 8
mov dword [esi + 0x2a0], 0xc
lea eax, [esi + 0x58]
push 0x678ee8
push eax
call fcn.004263b0
add esp, 8
cmp dword [esi + 0x98], 7
jbe 0x425124
mov eax, dword [esi + 0x84]
jmp 0x42512a
lea eax, [esi + 0x84]
mov dword [esi + 0x2a0], 0xd
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x4251c7
cmp dword [esi + 0x98], 7
jbe 0x425159
mov eax, dword [esi + 0x84]
jmp 0x42515f
lea eax, [esi + 0x84]
push eax
push 0x678ee8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x4251c7
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
je 0x4251bd
cmp word [eax], 0
mov edi, eax
mov dword [esi], eax
je 0x4251a7
mov ebx, dword [esi]
nop word cs:[eax + eax]
nop
push ebx
call fcn.005d3244
add esp, 4
cmp word [ebx + eax*2 + 2], 0
lea edi, [ebx + eax*2 + 2]
mov ebx, edi
jne 0x425190
mov ebx, dword [esi]
sub edi, ebx
add edi, 2
mov eax, edi
sar eax, 1
cmp eax, 0x3ffffffd
jbe 0x4255e1
mov dword [0x6cef04], 0
mov dword [esi], 0
cmp dword [esi + 0x1c], 0
je 0x4251f5
cmp dword [esi + 0x20], 7
lea eax, [esi + 0xc]
jbe 0x4251df
mov eax, dword [esi + 0xc]
mov dword [esi + 0x2a0], 0xd
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp dword [esi + 0x68], 0
je 0x42521d
cmp dword [esi + 0x6c], 7
lea eax, [esi + 0x58]
jbe 0x425207
mov eax, dword [esi + 0x58]
mov dword [esi + 0x2a0], 0xd
push eax
push 0x678ee8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [esi + 0x6c]
cmp ecx, 8
jb 0x425258
mov eax, dword [esi + 0x58]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x42524e
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425919
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov ecx, dword [esi + 0x20]
cmp ecx, 8
jb 0x425293
mov eax, dword [esi + 0xc]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x425289
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425928
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
cmp byte [esi], 0
jne 0x42529f
mov byte [0x6ceef8], 0
mov eax, dword [esi + 0x74]
test eax, eax
je 0x4252b7
mov dword [esi + 0x2a0], 0xb
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esi + 0x98]
cmp ecx, 8
jb 0x4252f8
mov eax, dword [esi + 0x84]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4252ee
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4258fb
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov ecx, dword [esi + 0x54]
cmp ecx, 8
jb 0x425333
mov eax, dword [esi + 0x40]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x425329
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x42590a
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
cmp byte [0x6ceef8], 0
mov bl, 1
jne 0x4255cb
mov dword [esi + 0x2a0], 0xffffffff
call fcn.00406c70
cmp eax, 3
jge 0x42535a
xor ebx, ebx
jmp 0x4253b8
lea edi, [esi + 0x40]
push 1
push str.TempLow
push 0x1c
push edi
call fcn.00443060
add esp, 0x10
cmp dword [esi + 0x50], 0
mov bl, 1
je 0x4253b8
mov eax, dword [esi + 0x24]
cmp dword [esi + 0x54], 7
mov ecx, dword [eax]
jbe 0x425385
mov edi, dword [esi + 0x40]
mov eax, dword [ecx]
mov dword [esi], ecx
mov ebx, dword [eax + 0x60]
mov ecx, ebx
call dword [0x64689c]
mov ecx, dword [esi]
mov byte [esi + 7], 1
mov dword [esi + 0x2a0], 0x15
push edi
push 0
push 0
call ebx
test eax, eax
mov bl, 1
je 0x4253b8
xor ebx, ebx
jmp 0x425590
lea edi, [esi + 0x84]
push 0x20a
push 0
push edi
call fcn.0061e8c0
add esp, 0xc
mov dword [esi], ebx
mov byte [esi + 7], bl
mov dword [esi + 0x2a0], 0x15
mov dword [esi + 8], edi
push edi
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
mov ebx, 0x658578
js 0x425429
cmp word [esi + 0x84], 0
je 0x425429
mov eax, dword [esi]
mov byte [esi + 7], al
push str.TempAdobeAcrobatDC
lea eax, [esi + 0x84]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
mov ebx, 0x658578
lea ecx, [esi + 0x84]
cmovne ebx, ecx
mov dword [esi + 0x20], 7
mov dword [esi + 0x1c], 0
mov word [esi + 0xc], 0
push ebx
call fcn.005d3244
add esp, 4
mov edi, eax
cmp eax, 7
jbe 0x42546d
mov eax, dword [esi]
mov byte [esi + 7], al
sub esp, 0xc
mov al, byte [esi + 0x58]
lea ecx, [esi + 0xc]
mov byte [esp + 4], al
mov dword [esp + 8], ebx
mov dword [esp], edi
call fcn.00405590
jmp 0x425489
mov eax, edi
mov dword [esi + 0x1c], edi
lea ecx, [esi + 0xc]
add eax, edi
push eax
push ebx
push ecx
call fcn.0061e340
add esp, 0xc
mov word [esi + edi*2 + 0xc], 0
mov ecx, dword [esi + 0x24]
lea eax, [esi + 0xc]
mov dword [esi + 0x2a0], 0x16
push 0
push eax
call fcn.00442b10
test al, al
je 0x425509
push 1
lea eax, [esi + 0x84]
push eax
call fcn.00510430
add esp, 8
cmp dword [esi + 0x94], 0
je 0x42550d
mov eax, dword [esi + 0x24]
cmp dword [esi + 0x98], 7
mov edi, dword [eax]
jbe 0x4254d6
mov eax, dword [esi + 0x84]
mov dword [esi + 8], eax
mov eax, dword [edi]
mov ebx, dword [eax + 0x60]
mov dword [esi + 0x2a0], 0xffffffff
mov ecx, ebx
call dword [0x64689c]
mov dword [esi + 0x2a0], 0x17
mov ecx, edi
push dword [esi + 8]
push 0
push 0
call ebx
test eax, eax
sete bl
jmp 0x42550f
xor ebx, ebx
jmp 0x425550
mov bl, 1
mov ecx, dword [esi + 0x98]
cmp ecx, 8
jb 0x425550
mov eax, dword [esi + 0x84]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x425546
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425955
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov ecx, dword [esi + 0x20]
cmp ecx, 8
jb 0x42558b
mov eax, dword [esi + 0xc]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x425581
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425937
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
cmp byte [esi], 0
je 0x4255cb
mov ecx, dword [esi + 0x54]
cmp ecx, 8
jb 0x4255cb
mov eax, dword [esi + 0x40]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4255c1
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425946
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov eax, dword [esi + 0x298]
mov dword fs:[0], eax
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x68e5f0
push edi
call fcn.005db7ed
add esp, 8
test eax, eax
je 0x425611
test edi, edi
mov dword [esi + 8], eax
je 0x425618
push edi
push ebx
push eax
call fcn.0061e340
add esp, 0xc
mov dword [esi + 0x2a0], 0xd
jmp 0x425618
mov dword [esi + 8], 0
mov dword [esi + 0x2a0], 0xd
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [esi + 8]
test eax, eax
mov dword [0x6cef04], eax
je 0x4251c7
lea eax, [esi + 0x84]
lea ecx, [esi + 0x28]
push 0x678ef0
push eax
mov dword [esi], ecx
push ecx
call fcn.005dfd60
add esp, 0xc
cmp dword [esi + 0x38], 0
je 0x42569b
mov eax, dword [esi + 0x24]
cmp dword [esi + 0x3c], 7
mov edi, dword [eax]
jbe 0x425669
mov eax, dword [esi + 0x28]
mov dword [esi], eax
mov eax, dword [edi]
mov ebx, dword [eax + 0x60]
mov dword [esi + 0x2a0], 0xffffffff
mov ecx, ebx
call dword [0x64689c]
mov dword [esi + 0x2a0], 0x11
mov ecx, edi
push dword [esi]
push 0
push 0
call ebx
test eax, eax
sete bl
jmp 0x42569d
mov bl, 1
mov ecx, dword [esi + 0x3c]
cmp ecx, 8
jb 0x4256d8
mov eax, dword [esi + 0x28]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4256ce
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425964
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
test bl, bl
je 0x4251c7
mov dword [esi + 0x2a0], 0xd
lea eax, [esi + 0x28]
push 0x65857a
lea ecx, [esi + 0x84]
push ecx
mov dword [esi + 8], eax
push eax
call fcn.005dfd60
add esp, 0xc
lea eax, [esi + 0x28]
mov dword [esi + 0x2a0], 0x10
push eax
call fcn.005dfe80
add esp, 4
mov ecx, dword [esi + 0x3c]
cmp ecx, 8
jb 0x425756
mov eax, dword [esi + 0x28]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x42574c
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425973
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov dword [esi + 0x2a0], 0xd
push 0x41dcf0
push 0x6d2734
call fcn.0041dac0
add esp, 8
mov cl, 1
test al, al
mov dword [esi], ecx
je 0x4251cd
lea eax, [esi + 0x40]
push str.JFEAT_temp
push eax
lea eax, [esi + 0x28]
push eax
call fcn.005dfd60
add esp, 0xc
cmp dword [esi + 0x38], 0
je 0x4257d6
mov eax, dword [esi + 0x24]
cmp dword [esi + 0x3c], 7
mov edi, dword [eax]
jbe 0x4257aa
mov eax, dword [esi + 0x28]
mov dword [esi + 8], eax
mov eax, dword [edi]
mov ebx, dword [eax + 0x60]
mov dword [esi + 0x2a0], 0xffffffff
mov ecx, ebx
call dword [0x64689c]
mov dword [esi + 0x2a0], 0xf
mov ecx, edi
push dword [esi + 8]
push 0
push 0
call ebx
mov ecx, dword [esi + 0x3c]
cmp ecx, 8
jb 0x42581b
mov eax, dword [esi + 0x28]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x425807
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425982
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov dword [esi + 0x2a0], 0xd
mov dword [esi + 0x2a0], 0xd
sub esp, 0x1c
movsd xmm0, qword [0x658194]
lea eax, [esi + 0x28]
movsd qword [esp + 0xc], xmm0
movsd xmm0, qword [0x65818c]
movsd qword [esp + 4], xmm0
mov dword [esi + 8], eax
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], str.TempJFEAT_temp
call fcn.00442940
add esp, 0x1c
cmp dword [esi + 0x38], 0
je 0x4258a8
mov eax, dword [esi + 0x24]
cmp dword [esi + 0x3c], 7
mov edi, dword [eax]
jbe 0x42587c
mov eax, dword [esi + 0x28]
mov dword [esi + 8], eax
mov eax, dword [edi]
mov ebx, dword [eax + 0x60]
mov dword [esi + 0x2a0], 0xffffffff
mov ecx, ebx
call dword [0x64689c]
mov dword [esi + 0x2a0], 0xe
mov ecx, edi
push dword [esi + 8]
push 0
push 0
call ebx
mov ecx, dword [esi + 0x3c]
cmp ecx, 8
jb 0x4251cd
mov eax, dword [esi + 0x28]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4258dd
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425991
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
jmp 0x4251cd
mov dword [esi + 0x2a0], 0
call fcn.006207e0
mov dword [esi + 0x2a0], 7
call fcn.006207e0
mov dword [esi + 0x2a0], 8
call fcn.006207e0
mov dword [esi + 0x2a0], 5
call fcn.006207e0
mov dword [esi + 0x2a0], 6
call fcn.006207e0
mov dword [esi + 0x2a0], 0x13
call fcn.006207e0
mov dword [esi + 0x2a0], 0x14
call fcn.006207e0
mov dword [esi + 0x2a0], 0x12
call fcn.006207e0
mov dword [esi + 0x2a0], 1
call fcn.006207e0
mov dword [esi + 0x2a0], 2
call fcn.006207e0
mov dword [esi + 0x2a0], 3
call fcn.006207e0
mov dword [esi + 0x2a0], 4
call fcn.006207e0
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
mov ecx, dword [esi + 0x20]
cmp ecx, 8
jb 0x425a87
mov eax, dword [esi + 0xc]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x425a7d
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425aa0
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 7
mov word [esi + 0xc], 0
add esp, 0x1c
pop ebp
ret
call fcn.006207e0
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
mov ecx, dword [esi + 0x3c]
cmp ecx, 8
jb 0x425af7
mov eax, dword [esi + 0x28]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x425aed
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425b10
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 7
mov word [esi + 0x28], 0
add esp, 0x1c
pop ebp
ret
call fcn.006207e0
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
mov ecx, dword [esi + 0x3c]
cmp ecx, 8
jb 0x425b67
mov eax, dword [esi + 0x28]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x425b5d
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425b80
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 7
mov word [esi + 0x28], 0
add esp, 0x1c
pop ebp
ret
call fcn.006207e0
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
mov ecx, dword [esi + 0x3c]
cmp ecx, 8
jb 0x425bd7
mov eax, dword [esi + 0x28]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x425bcd
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425bf0
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 7
mov word [esi + 0x28], 0
add esp, 0x1c
pop ebp
ret
call fcn.006207e0
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
mov ecx, dword [esi + 0x3c]
cmp ecx, 8
jb 0x425c47
mov eax, dword [esi + 0x28]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x425c3d
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425c60
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 7
mov word [esi + 0x28], 0
add esp, 0x1c
pop ebp
ret
call fcn.006207e0
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
mov ecx, dword [esi + 0x6c]
cmp ecx, 8
jb 0x425cf7
mov eax, dword [esi + 0x58]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x425ced
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425d10
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 7
mov word [esi + 0x58], 0
add esp, 0x1c
pop ebp
ret
call fcn.006207e0
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
mov ecx, dword [esi + 0x20]
cmp ecx, 8
jb 0x425d67
mov eax, dword [esi + 0xc]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x425d5d
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425d80
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 7
mov word [esi + 0xc], 0
add esp, 0x1c
pop ebp
ret
call fcn.006207e0
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
mov ecx, dword [esi + 0x98]
cmp ecx, 8
jb 0x425e1d
mov eax, dword [esi + 0x84]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x425e13
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425e3f
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 7
mov word [esi + 0x84], 0
add esp, 0x1c
pop ebp
ret
call fcn.006207e0
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
mov ecx, dword [esi + 0x54]
cmp ecx, 8
jb 0x425e97
mov eax, dword [esi + 0x40]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x425e8d
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425e9c
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
add esp, 0x1c
pop ebp
ret
call fcn.006207e0
nop word cs:[eax + eax]
nop dword [eax + eax]
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
mov ecx, dword [esi + 0x98]
cmp ecx, 8
jb 0x425f5d
mov eax, dword [esi + 0x84]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x425f53
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425f7f
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 7
mov word [esi + 0x84], 0
add esp, 0x1c
pop ebp
ret
call fcn.006207e0
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
mov ecx, dword [esi + 0x20]
cmp ecx, 8
jb 0x425fd7
mov eax, dword [esi + 0xc]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x425fcd
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x425ff5
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov eax, dword [esi]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 7
mov word [esi + 0xc], 0
mov byte [esi + 7], al
add esp, 0x1c
pop ebp
ret
call fcn.006207e0
nop word [eax + eax]
push ebp
sub esp, 0x1c
lea esi, [ebp - 0x2a4]
mov ebp, dword [esi + 0x290]
cmp byte [esi + 7], 1
jne 0x42604d
mov ecx, dword [esi + 0x54]
cmp ecx, 8
jb 0x42604d
mov eax, dword [esi + 0x40]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x426043
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x426052
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
add esp, 0x1c
pop ebp
ret
call fcn.006207e0
int3