Function at 0x41eedf
Capabilities:
Parse pe header

Disassembly:
push ebp
push ebx
push edi
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x41eee7
call fcn.004a65d0
mov edx, dword [esp + 0x38]
lea ecx, [esp]
call fcn.0044c000
mov edx, 0x5300ba
lea ecx, [0xec9228]
call fcn.0044c008
mov dword [0xec9304], 0
push edx
call fcn.004a6430
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, 0x536d84
push edx
call fcn.004a6500
call fcn.0044c382
add dword [esp], edx
call fcn.00492903
call fcn.0044c3a0
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x41ef64
cmp edi, 0xffffffff
je 0x41ef68
xor eax, eax
jmp 0x41ef6d
mov eax, 1
or eax, eax
je 0x41effa
mov edx, dword [esp]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
lea eax, [0xec92c4]
push eax
call fcn.004a6470
push dword [0xec947c]
push dword [0xec92c4]
call fcn.004a4210
mov ebx, eax
and ebx, ebx
jle 0x41efcb
mov edx, dword [0xec9444]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
lea eax, [0xec9418]
push eax
call fcn.004a6470
jmp 0x41efeb
mov edx, dword [0xec92c4]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
lea eax, [0xec9418]
push eax
call fcn.004a6470
mov dword [0xec9370], 1
jmp 0x41f30b
push edx
call fcn.004a6430
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, str.filesOfficeData
push edx
call fcn.004a6500
call fcn.0044c382
add dword [esp], edx
call fcn.00492903
call fcn.0044c3a0
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x41f03f
cmp edi, 0xffffffff
je 0x41f043
xor eax, eax
jmp 0x41f048
mov eax, 1
or eax, eax
je 0x41f0fb
mov edx, dword [esp]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, str.files_
push edx
call fcn.004a6500
lea eax, [esp + 4]
push eax
call fcn.004a6470
mov edx, dword [esp]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
lea eax, [0xec92c4]
push eax
call fcn.004a6470
push dword [0xec947c]
push dword [0xec92c4]
call fcn.004a4210
mov ebx, eax
and ebx, ebx
jle 0x41f0cc
mov edx, dword [0xec9444]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
lea eax, [0xec9418]
push eax
call fcn.004a6470
jmp 0x41f0ec
mov edx, dword [0xec92c4]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
lea eax, [0xec9418]
push eax
call fcn.004a6470
mov dword [0xec9370], 1
jmp 0x41f30b
push edx
call fcn.004a6430
pop edx
push eax
mov edx, dword [0xec947c]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, 0x536d84
push edx
call fcn.004a6500
call fcn.0044c382
add dword [esp], edx
call fcn.00492903
call fcn.0044c3a0
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x41f142
cmp edi, 0xffffffff
je 0x41f146
xor eax, eax
jmp 0x41f14b
mov eax, 1
or eax, eax
je 0x41f1f9
mov edx, dword [0xec947c]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
lea eax, [esp + 4]
push eax
call fcn.004a6470
mov edx, dword [0xec947c]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
lea eax, [0xec92c4]
push eax
call fcn.004a6470
push dword [0xec947c]
push dword [0xec92c4]
call fcn.004a4210
mov ebx, eax
and ebx, ebx
jle 0x41f1ca
mov edx, dword [0xec9444]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
lea eax, [0xec9418]
push eax
call fcn.004a6470
jmp 0x41f1ea
mov edx, dword [0xec92c4]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
lea eax, [0xec9418]
push eax
call fcn.004a6470
mov dword [0xec9370], 1
jmp 0x41f30b
push edx
call fcn.004a6430
pop edx
push eax
mov edx, dword [0xec947c]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, str.filesOfficeData
push edx
call fcn.004a6500
call fcn.0044c382
add dword [esp], edx
call fcn.00492903
call fcn.0044c3a0
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x41f240
cmp edi, 0xffffffff
je 0x41f244
xor eax, eax
jmp 0x41f249
mov eax, 1
or eax, eax
je 0x41f2d1
mov edx, dword [0xec947c]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, str.files_
push edx
call fcn.004a6500
lea eax, [0xec92c4]
push eax
call fcn.004a6470
mov edx, dword [0xec947c]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, str.files_
push edx
call fcn.004a6500
lea eax, [esp + 4]
push eax
call fcn.004a6470
mov dword [0xec9370], 1
mov edx, dword [0xec9444]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
lea eax, [0xec9418]
push eax
call fcn.004a6470
jmp 0x41f30b
mov edx, dword [0xec9444]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
lea eax, [0xec9418]
push eax
call fcn.004a6470
mov dword [0xec9370], 0
mov edx, 0x5300ba
lea ecx, [0xec92c4]
call fcn.0044c008
mov ebx, dword [0xec9370]
and ebx, ebx
jle 0x41f3d2
mov edx, dword [0xec9314]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
lea eax, [0xec91d4]
push eax
call fcn.004a6470
mov dword [esp + 4], 0
jmp 0x41f343
push dword [0xec953c]
call fcn.0049cfb7
cmp eax, dword [esp + 4]
jl 0x41f383
mov edx, dword [0xec9540]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xec953c]
mov edx, 0x5310c8
lea ecx, [ebp]
call fcn.0044c008
inc dword [esp + 4]
jno 0x41f343
mov dword [esp + 4], 0
jmp 0x41f38d
push dword [0xec9530]
call fcn.0049cfb7
cmp eax, dword [esp + 4]
jl 0x41f3cd
mov edx, dword [0xec9534]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xec9530]
mov edx, 0x5310c8
lea ecx, [ebp]
call fcn.0044c008
inc dword [esp + 4]
jno 0x41f38d
jmp 0x41f486
mov edx, dword [0xec9314]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
lea eax, [0xec91d4]
push eax
call fcn.004a6470
mov dword [esp + 4], 0
jmp 0x41f3fc
push dword [0xec953c]
call fcn.0049cfb7
cmp eax, dword [esp + 4]
jl 0x41f43c
mov edx, dword [0xec9540]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xec953c]
mov edx, 0x5310cc
lea ecx, [ebp]
call fcn.0044c008
inc dword [esp + 4]
jno 0x41f3fc
mov dword [esp + 4], 0
jmp 0x41f446
push dword [0xec9530]
call fcn.0049cfb7
cmp eax, dword [esp + 4]
jl 0x41f486
mov edx, dword [0xec9534]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xec9530]
mov edx, 0x5310cc
lea ecx, [ebp]
call fcn.0044c008
inc dword [esp + 4]
jno 0x41f446
mov ebx, dword [0xec9370]
and ebx, ebx
jle 0x41f5c0
push edx
call fcn.004a6430
pop edx
push eax
mov eax, 0x53e3be
push eax
mov edx, dword [0xec92c4]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, 0x536d84
push edx
call fcn.004a6500
call fcn.004a6560
push 0
call fcn.0044c382
add dword [esp + 4], edx
call fcn.00492f03
call fcn.0044c3a0
and eax, eax
je 0x41f594
push 0
call fcn.00493062
and eax, eax
je 0x41f58a
push 0
call fcn.00492edf
mov ebx, eax
cmp ebx, 1
jne 0x41f585
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
push 0
call fcn.00492e63
call fcn.0044c382
add dword [esp], edx
call fcn.00420c54
lea eax, [esp + 0xc]
push eax
call fcn.004a6470
push dword [esp + 8]
mov edx, 0x5300ba
pop ecx
call fcn.0044c330
jne 0x41f585
push edx
call fcn.004a6430
pop edx
push eax
mov edx, 0x5302d6
push edx
call fcn.004a6500
mov edx, dword [esp + 0xc]
push edx
call fcn.004a6500
mov edx, 0x530d36
push edx
call fcn.004a6500
lea eax, [esp + 0x10]
push eax
call fcn.004a6470
jmp 0x41f4e6
push 0
call fcn.00493030
mov edx, dword [0xec9328]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, dword [esp + 0x10]
push edx
call fcn.004a6500
lea eax, [0xec941c]
push eax
call fcn.004a6470
jmp 0x41f5e0
mov edx, dword [0xec9218]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
lea eax, [0xec941c]
push eax
call fcn.004a6470
mov ebx, dword [0xec92d4]
and ebx, ebx
jne 0x41f5fb
mov ebx, dword [0xec92d8]
and ebx, ebx
jne 0x41f5fb
mov eax, 1
jmp 0x41f5fd
xor eax, eax
and eax, eax
je 0x41f64e
call fcn.00495784
push 0
call fcn.0049594e
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
add ebx, 0xfffffebe
mov dword [0xec92d4], ebx
push 0
call fcn.00495971
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
add ebx, 0xffffff2b
mov dword [0xec92d8], ebx
push 0
call fcn.00490eef
and eax, eax
je 0x41f660
xor eax, eax
jmp 0x41f665
mov eax, 1
and eax, eax
je 0x41faee
push 0x1aa
push 0x284
push dword [0xec92d8]
push dword [0xec92d4]
call fcn.0043eca6
push dword [0xec946c]
call fcn.0049f596
push eax
push 8
call fcn.00488aaf
push dword [0xec9154]
call fcn.0049f596
push eax
push 0xa
call fcn.00488aaf
push dword [0xec9308]
call fcn.0049f596
push eax
push 9
call fcn.00488aaf
push dword [0xec9210]
call fcn.0049f596
push eax
push 0xb
call fcn.00488aaf
push 0
lea eax, [0x414915]
push eax
call fcn.004919cd
push 0x7d0
push 0x309
push 0
call fcn.00491a33
push 0xea60
push 0x30a
push 0
call fcn.00491a33
push 1
push 0x3c
call fcn.00488a71
push 1
push 0x3d
call fcn.00488a71
push 0
push 0x41
call fcn.00488a71
push dword [0xec9364]
mov edx, 0x533034
pop ecx
call fcn.0044c330
je 0x41f7a7
mov eax, 0x53718a
push eax
push 0x4c
call fcn.0048ab20
mov eax, 0x53f2ea
push eax
push 0x4c
call fcn.0048b8a8
mov ebx, dword [0xec9370]
and ebx, ebx
jne 0x41f795
push dword [0xec91e0]
push 0x51
call fcn.0048b8a8
jmp 0x41f7a5
push dword [0xec942c]
push 0x51
call fcn.0048b8a8
jmp 0x41f7b7
mov eax, str.Windows_10_or_11_only____
push eax
push 0x4c
call fcn.0048b8a8
push dword [0xec9294]
push 0x35
call fcn.0048b8a8
push 0
call fcn.0049100e
push dword [0xec9314]
push 0
call fcn.00490ec6
call fcn.004361de
push 1
push 0x4f
call fcn.00488aaf
push 0x4d
call fcn.0043c425
push 0
push 0x4d
call fcn.00488aaf
push dword [0xec9130]
push 0xffffffff
push 0x4e
call fcn.0048aa57
push dword [0xec920c]
push 0xffffffff
push 0x4e
call fcn.0048aa57
push dword [0xec9164]
push 0xffffffff
push 0x4e
call fcn.0048aa57
push 1
push 0x4e
call fcn.00488aaf
push 1
mov eax, 0x53172e
push eax
call fcn.0043b0d5
mov eax, 0x53d48a
push eax
push 0xffffffff
push 0x45
call fcn.0048aa57
mov eax, 0x53a852
push eax
push 0xffffffff
push 0x45
call fcn.0048aa57
mov eax, 0x53fb50
push eax
push 0xffffffff
push 0x45
call fcn.0048aa57
push 0
push 0x45
call fcn.00488aaf
push dword [0xec9260]
push 0xffffffff
push 0x48
call fcn.0048aa57
push dword [0xec9190]
push 0xffffffff
push 0x48
call fcn.0048aa57
push 0
push 0x48
call fcn.00488aaf
mov edx, 0x53172e
lea ecx, [0xec917c]
call fcn.0044c008
push 0x3f
call fcn.0043c425
push dword [0xec9220]
push 0xffffffff
push 0x3f
call fcn.0048aa57
push 1
push 0x3f
call fcn.00488aaf
call fcn.004446c5
push 0x47
call fcn.0048aa09
mov dword [esp + 4], 0
jmp 0x41f94a
push dword [0xec953c]
call fcn.0049cfb7
cmp eax, dword [esp + 4]
jl 0x41f992
mov edx, dword [0xec9540]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xec953c]
push dword [ebp]
push 0xffffffff
push 0x47
call fcn.0048aa57
inc dword [esp + 4]
jno 0x41f94a
push 2
push 0
push 0x47
call fcn.00488bda
push 0x5a
call fcn.0048aa09
call fcn.0043cba7
push 0x260
push 0x2bc
push 0
push 0
call fcn.00411e41
push dword [0xec93c8]
lea eax, [0x415580]
push eax
call fcn.004919cd
push dword [0xec93fc]
call fcn.0049f596
push eax
push 0
push 0x4d
call fcn.0048ba55
push dword [0xec93fc]
call fcn.0049f596
push eax
push 1
push 0x4d
call fcn.0048ba55
push dword [0xec93fc]
call fcn.0049f596
push eax
push 2
push 0x4d
call fcn.0048ba55
push dword [0xec93fc]
call fcn.0049f596
push eax
push 3
push 0x4d
call fcn.0048ba55
push dword [0xec93fc]
call fcn.0049f596
push eax
push 4
push 0x4d
call fcn.0048ba55
push dword [0xec93fc]
call fcn.0049f596
push eax
push 5
push 0x4d
call fcn.0048ba55
push dword [0xec93fc]
call fcn.0049f596
push eax
push 6
push 0x4d
call fcn.0048ba55
push dword [0xec93fc]
call fcn.0049f596
push eax
push 7
push 0x4d
call fcn.0048ba55
push dword [0xec93fc]
call fcn.0049f596
push eax
push 8
push 0x4d
call fcn.0048ba55
push dword [0xec93fc]
call fcn.0049f596
push eax
push 9
push 0x4d
call fcn.0048ba55
call fcn.00490c3b
mov ebx, eax
cmp ebx, 0x6e
jl 0x41fb0b
push 0
push 0x4c
call fcn.0048aa2c
jmp 0x41fb1a
push 1
push 0x4c
call fcn.0048aa2c
push 0x36
call fcn.0048ba83
push 0x4b
call fcn.0048ba83
push 0x35
call fcn.0048ba83
push 0x27
call fcn.0048ba83
push 0x34
call fcn.0048ba83
push 0x37
call fcn.0048ba83
push 0xffff0001
push 0xffff0001
push 0xffff0001
push 0x64
push 0x2e
call fcn.0048bbdc
push 0
push 0x28
call fcn.00488a71
push 0x42
call fcn.0048ba83
mov ebx, dword [0xec9370]
and ebx, ebx
jle 0x4206af
push 0
push 0x40
push 0
call fcn.0049d39e
push eax
push 1
push 0x59
call fcn.0048a96f
push edx
call fcn.004a6430
pop edx
push eax
mov eax, 0x53e3be
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, 0x536d84
push edx
call fcn.004a6500
call fcn.004a6560
push 0
call fcn.0044c382
add dword [esp + 4], edx
call fcn.00492f03
call fcn.0044c3a0
and eax, eax
je 0x4202a6
push 0
call fcn.00493062
and eax, eax
je 0x42029c
push 0
call fcn.00492edf
mov ebx, eax
cmp ebx, 2
jne 0x420297
push edx
call fcn.004a6430
pop edx
push eax
mov eax, 0x5361ee
push eax
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
push 0
call fcn.00492e63
call fcn.0044c382
add dword [esp], edx
call fcn.004a4210
call fcn.0044c3a0
mov ebx, eax
and ebx, ebx
jg 0x41fcb8
push edx
call fcn.004a6430
pop edx
push eax
mov eax, 0x534ea2
push eax
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
push 0
call fcn.00492e63
call fcn.0044c382
add dword [esp], edx
call fcn.004a4210
call fcn.0044c3a0
mov ebx, eax
and ebx, ebx
jg 0x41fcb8
jmp 0x41fcbf
mov eax, 1
jmp 0x41fcc1
xor eax, eax
and eax, eax
je 0x420297
push edx
call fcn.004a6430
pop edx
push eax
mov eax, 0x5361ee
push eax
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
push 0
call fcn.00492e63
call fcn.0044c382
add dword [esp], edx
call fcn.004a4210
call fcn.0044c3a0
mov ebx, eax
and ebx, ebx
jle 0x41fdb1
push 1
push 0x4e
call fcn.00488aaf
mov edx, 0x53172e
lea ecx, [0xec917c]
call fcn.0044c008
push dword [0xec9314]
push 0
call fcn.00490ec6
push 0x47
call fcn.0048aa09
mov dword [esp + 4], 0
jmp 0x41fd50
push dword [0xec953c]
call fcn.0049cfb7
cmp eax, dword [esp + 4]
jl 0x41fd98
mov edx, dword [0xec9540]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xec953c]
push dword [ebp]
push 0xffffffff
push 0x47
call fcn.0048aa57
inc dword [esp + 4]
jno 0x41fd50
push 2
push 0
push 0x47
call fcn.00488bda
jmp 0x41fe50
push 0
push 0x4e
call fcn.00488aaf
mov edx, 0x5316fc
lea ecx, [0xec917c]
call fcn.0044c008
push dword [0xec9314]
push 0
call fcn.00490ec6
push 0x47
call fcn.0048aa09
mov dword [esp + 4], 0
jmp 0x41fdf4
push dword [0xec9530]
call fcn.0049cfb7
cmp eax, dword [esp + 4]
jl 0x41fe3c
mov edx, dword [0xec9534]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xec9530]
push dword [ebp]
push 0xffffffff
push 0x47
call fcn.0048aa57
inc dword [esp + 4]
jno 0x41fdf4
push 2
push 0
push 0x47
call fcn.00488bda
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
push 0
call fcn.00492e63
lea eax, [esp + 0x14]
push eax
call fcn.004a6470
push edx
call fcn.004a6430
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, 0x53846a
push edx
call fcn.004a6500
mov edx, dword [esp + 0x18]
push edx
call fcn.004a6500
mov edx, str._stream.x64.x_none.dat
push edx
call fcn.004a6500
call fcn.0044c382
add dword [esp], edx
call fcn.00492903
call fcn.0044c3a0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x41fed4
jl 0x41fed0
cmp ebx, 0
ja 0x41fed4
xor eax, eax
jmp 0x41fed9
mov eax, 1
or eax, eax
je 0x41ff4d
push edx
call fcn.004a6430
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, 0x53846a
push edx
call fcn.004a6500
mov edx, dword [esp + 0x18]
push edx
call fcn.004a6500
mov edx, str._stream.x86.x_none.dat
push edx
call fcn.004a6500
call fcn.0044c382
add dword [esp], edx
call fcn.00492903
call fcn.0044c3a0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x41ff3d
jl 0x41ff39
cmp ebx, 0
ja 0x41ff3d
xor eax, eax
jmp 0x41ff42
mov eax, 1
or eax, eax
je 0x41ff4d
mov eax, 1
jmp 0x41ff4f
xor eax, eax
and eax, eax
je 0x41ff62
mov dword [0xec9450], 0
jmp 0x420056
push edx
call fcn.004a6430
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, 0x53846a
push edx
call fcn.004a6500
mov edx, dword [esp + 0x18]
push edx
call fcn.004a6500
mov edx, str._stream.x64.x_none.dat
push edx
call fcn.004a6500
call fcn.0044c382
add dword [esp], edx
call fcn.00492903
call fcn.0044c3a0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x41ffc2
jg 0x41ffbe
cmp ebx, 0x64
jb 0x41ffc2
xor eax, eax
jmp 0x41ffc7
mov eax, 1
or eax, eax
je 0x41ffd7
mov dword [0xec9450], 0x56
jmp 0x420056
push edx
call fcn.004a6430
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, 0x53846a
push edx
call fcn.004a6500
mov edx, dword [esp + 0x18]
push edx
call fcn.004a6500
mov edx, str._stream.x86.x_none.dat
push edx
call fcn.004a6500
call fcn.0044c382
add dword [esp], edx
call fcn.00492903
call fcn.0044c3a0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x420037
jg 0x420033
cmp ebx, 0x64
jb 0x420037
xor eax, eax
jmp 0x42003c
mov eax, 1
or eax, eax
je 0x42004c
mov dword [0xec9450], 0x40
jmp 0x420056
mov dword [0xec9450], 0
push edx
call fcn.004a6430
pop edx
push eax
mov eax, 0x53e3be
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, 0x53846a
push edx
call fcn.004a6500
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
push 0
call fcn.00492e63
pop eax
call fcn.004a6560
push 1
call fcn.0044c382
add dword [esp + 4], edx
call fcn.00492f03
call fcn.0044c3a0
and eax, eax
je 0x420297
push 1
call fcn.00493062
and eax, eax
je 0x42028d
push 1
call fcn.00492edf
mov ebx, eax
cmp ebx, 1
jne 0x420288
push dword [0xec917c]
mov edx, 0x53172e
pop ecx
call fcn.0044c330
je 0x4201c6
mov dword [esp + 4], 0
jmp 0x420109
push dword [0xec953c]
call fcn.0049cfb7
cmp eax, dword [esp + 4]
jl 0x4201c1
push edx
call fcn.004a6430
pop edx
push eax
push 1
push 1
mov edx, dword [0xec9540]
imul edx, dword [esp + 0x10]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xec953c]
push dword [ebp]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
push 1
call fcn.00492e63
call fcn.0044c382
add dword [esp], edx
call fcn.004a4170
call fcn.0044c3a0
mov ebx, eax
and ebx, ebx
jle 0x4201b7
mov edx, dword [0xec9540]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xec953c]
mov edx, 0x5310cc
lea ecx, [ebp]
call fcn.0044c008
mov dword [0xec9304], 1
inc dword [esp + 4]
jno 0x420109
jmp 0x420288
mov dword [esp + 4], 0
jmp 0x4201d0
push dword [0xec9530]
call fcn.0049cfb7
cmp eax, dword [esp + 4]
jl 0x420288
push edx
call fcn.004a6430
pop edx
push eax
push 1
push 1
mov edx, dword [0xec9534]
imul edx, dword [esp + 0x10]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xec9530]
push dword [ebp]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
push 1
call fcn.00492e63
call fcn.0044c382
add dword [esp], edx
call fcn.004a4170
call fcn.0044c3a0
mov ebx, eax
and ebx, ebx
jle 0x42027e
mov edx, dword [0xec9534]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xec9530]
mov edx, 0x5310cc
lea ecx, [ebp]
call fcn.0044c008
mov dword [0xec9304], 1
inc dword [esp + 4]
jno 0x4201d0
jmp 0x4200c1
push 1
call fcn.00493030
jmp 0x41fc0f
push 0
call fcn.00493030
mov ebx, dword [0xec9304]
and ebx, ebx
jne 0x42057c
push edx
call fcn.004a6430
pop edx
push eax
mov eax, 0x53e3be
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, 0x536d84
push edx
call fcn.004a6500
call fcn.004a6560
push 0
call fcn.0044c382
add dword [esp + 4], edx
call fcn.00492f03
call fcn.0044c3a0
and eax, eax
je 0x420547
push 0
call fcn.00493062
and eax, eax
je 0x42053d
push 0
call fcn.00492edf
mov ebx, eax
cmp ebx, 2
jne 0x420538
push edx
call fcn.004a6430
pop edx
push eax
mov eax, 0x5361ee
push eax
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
push 0
call fcn.00492e63
call fcn.0044c382
add dword [esp], edx
call fcn.004a4210
call fcn.0044c3a0
mov ebx, eax
and ebx, ebx
jle 0x420538
push edx
call fcn.004a6430
pop edx
push eax
mov eax, 0x53e3be
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, 0x53846a
push edx
call fcn.004a6500
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
push 0
call fcn.00492e63
pop eax
call fcn.004a6560
push 1
call fcn.0044c382
add dword [esp + 4], edx
call fcn.00492f03
call fcn.0044c3a0
and eax, eax
je 0x420538
push 1
call fcn.00493062
and eax, eax
je 0x42052e
push 1
call fcn.00492edf
mov ebx, eax
cmp ebx, 1
jne 0x420529
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
push 1
call fcn.00492e63
lea eax, [esp + 0x18]
push eax
call fcn.004a6470
push 1
mov eax, str.stream.x64.x
push eax
push dword [esp + 0x1c]
call fcn.004a4150
mov ebx, eax
and ebx, ebx
jg 0x42045b
push 1
mov eax, str.stream.x86.x
push eax
push dword [esp + 0x1c]
call fcn.004a4150
mov ebx, eax
and ebx, ebx
jg 0x42045b
jmp 0x420462
mov eax, 1
jmp 0x420464
xor eax, eax
and eax, eax
je 0x42046d
jmp 0x420529
push 1
mov eax, str.stream.x64.
push eax
push dword [esp + 0x1c]
call fcn.004a4150
mov ebx, eax
and ebx, ebx
jg 0x4204a3
push 1
mov eax, str.stream.x86.
push eax
push dword [esp + 0x1c]
call fcn.004a4150
mov ebx, eax
and ebx, ebx
jg 0x4204a3
jmp 0x4204aa
mov eax, 1
jmp 0x4204ac
xor eax, eax
and eax, eax
je 0x420529
push 1
mov eax, 0x5359fa
push eax
push dword [esp + 0x1c]
call fcn.004a4150
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
and ebx, ebx
jle 0x420509
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
push dword [esp + 0x1c]
call fcn.004a4120
mov ebx, eax
add ebx, 0xfffffff1
push ebx
push 0xc
push dword [esp + 0x24]
call fcn.004a4230
lea eax, [0xec9228]
push eax
call fcn.004a6470
push 1
call fcn.00493030
push 0
call fcn.00493030
mov dword [0xec9304], 1
jmp 0x420547
jmp 0x4203da
push 1
call fcn.00493030
jmp 0x420304
push 0
call fcn.00493030
mov dword [esp + 0x1c], 0x10
push dword [0xec9228]
mov edx, 0x5300ba
pop ecx
call fcn.0044c330
jne 0x420577
push dword [0xec9228]
push 0xffffffff
push 0x5a
call fcn.0048aa57
jmp 0x42069b
push 0x5a
call fcn.0048aa09
push dword [0xec917c]
mov edx, 0x53172e
pop ecx
call fcn.0044c330
je 0x42061d
mov dword [esp + 4], 0
jmp 0x4205a7
push dword [0xec953c]
call fcn.0049cfb7
cmp eax, dword [esp + 4]
jl 0x42061b
mov edx, dword [0xec9540]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xec953c]
push dword [ebp]
mov edx, 0x5310cc
pop ecx
call fcn.0044c330
je 0x420615
mov edx, dword [0xec9540]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xec953c]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.0048aa57
inc dword [esp + 4]
jno 0x4205a7
jmp 0x42069b
mov dword [esp + 4], 0
jmp 0x420627
push dword [0xec9530]
call fcn.0049cfb7
cmp eax, dword [esp + 4]
jl 0x42069b
mov edx, dword [0xec9534]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
xor eax, eax
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xec9530]
push dword [ebp]
mov edx, 0x5310cc
pop ecx
call fcn.0044c330
je 0x420695
mov edx, dword [0xec9534]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xec9530]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.0048aa57
inc dword [esp + 4]
jno 0x420627
push 0
push 0x26
call fcn.00488aaf
jmp 0x4207a0
mov dword [0xec9450], 0
push 0
push 0
push pe_nt_image_headers32
call fcn.0049d39e
push eax
push 1
push 0x59
call fcn.0048a96f
push 0x5a
call fcn.0048aa09
push dword [0xec917c]
mov edx, 0x53172e
pop ecx
call fcn.0044c330
je 0x42074e
mov dword [esp + 4], 0
jmp 0x420704
push dword [0xec953c]
call fcn.0049cfb7
cmp eax, dword [esp + 4]
jl 0x42074c
mov edx, dword [0xec9540]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xec953c]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.0048aa57
inc dword [esp + 4]
jno 0x420704
jmp 0x4207a0
mov dword [esp + 4], 0
jmp 0x420758
push dword [0xec9530]
call fcn.0049cfb7
cmp eax, dword [esp + 4]
jl 0x4207a0
mov edx, dword [0xec9534]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xec9530]
push dword [ebp]
push 0xffffffff
push 0x5a
call fcn.0048aa57
inc dword [esp + 4]
jno 0x420758
mov ebx, dword [0xec9450]
cmp ebx, 0x56
jne 0x4207bc
push 1
push 0x4f
call fcn.00488aaf
jmp 0x4207e2
mov ebx, dword [0xec9450]
cmp ebx, 0x40
jne 0x4207d8
push 1
push 0x50
call fcn.00488aaf
jmp 0x4207e2
mov dword [0xec9450], 0
mov ebx, dword [0xec9370]
and ebx, ebx
jle 0x42080c
push 0
call fcn.00490eef
and eax, eax
je 0x42080a
push dword [0xec9188]
push 0x51
call fcn.0048ab20
jmp 0x42082a
push 0
call fcn.00490eef
and eax, eax
je 0x42082a
push dword [0xec9444]
push 0x51
call fcn.0048ab20
push dword [0xec92c4]
mov edx, 0x5300ba
pop ecx
call fcn.0044c330
jne 0x420956
push dword [0xec92c4]
call fcn.004a4120
mov ebx, eax
cmp ebx, 0x1e
jle 0x4208f1
mov dword [esp + 0x20], 1
jmp 0x420861
mov eax, 0x531e18
push eax
push dword [0xec92c4]
call fcn.004a4860
cmp eax, dword [esp + 0x20]
jl 0x4208ad
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
mov eax, 0x531e18
push eax
push dword [esp + 0x2c]
push dword [0xec92c4]
call fcn.004a4990
lea eax, [esp + 0x28]
push eax
call fcn.004a6470
inc dword [esp + 0x20]
jno 0x420861
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
mov edx, str.Office_Folder:
push edx
call fcn.004a6500
mov edx, dword [esp + 0x2c]
push edx
call fcn.004a6500
call fcn.004a6560
push 0x55
call fcn.0044c382
add dword [esp + 4], edx
call fcn.0048ab20
call fcn.0044c3a0
jmp 0x420954
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
mov edx, str.Office_Path:
push edx
call fcn.004a6500
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
push dword [0xec92c4]
call fcn.004a4120
mov ebx, eax
dec ebx
push ebx
push dword [0xec92c4]
call fcn.004a48f0
pop eax
call fcn.004a6560
push 0x55
call fcn.0044c382
add dword [esp + 4], edx
call fcn.0048ab20
call fcn.0044c3a0
jmp 0x420966
mov eax, 0x5300ba
push eax
push 0x55
call fcn.0048ab20
xor eax, eax
push dword [esp]
call fcn.004a6630
push dword [esp + 0xc]
call fcn.004a6630
push dword [esp + 8]
call fcn.004a6630
push dword [esp + 0x10]
call fcn.004a6630
push dword [esp + 0x14]
call fcn.004a6630
push dword [esp + 0x24]
call fcn.004a6630
add esp, 0x28
pop edi
pop ebx
pop ebp
ret 4