Function at 0x424c10
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2e6c
call fcn.004ad6f0
mov eax, dword [0x521e28]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2]
cmp eax, 0x25
je 0x424c3f
xor eax, eax
jmp 0x425a24
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 0xa]
cmp ecx, 0x25
jne 0x424d1e
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 2]
cmp edx, 0x72
je 0x424c7d
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 2]
cmp eax, 0x52
jne 0x424d1e
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 4]
cmp ecx, 0x6f
je 0x424ca1
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 4]
cmp edx, 0x4f
jne 0x424d1e
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 6]
cmp eax, 0x6f
je 0x424cc5
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 6]
cmp ecx, 0x4f
jne 0x424d1e
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 8]
cmp edx, 0x74
je 0x424ce9
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 8]
cmp eax, 0x54
jne 0x424d1e
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
add edx, 5
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00426c00
add esp, 8
movzx eax, al
test eax, eax
jne 0x424d14
xor eax, eax
jmp 0x425a24
mov eax, 1
jmp 0x425a24
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 8]
cmp ecx, 0x25
jne 0x424dfa
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 2]
cmp edx, 0x73
je 0x424d5c
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 2]
cmp eax, 0x53
jne 0x424dfa
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 4]
cmp ecx, 0x79
je 0x424d80
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 4]
cmp edx, 0x59
jne 0x424dfa
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 6]
cmp eax, 0x73
je 0x424da4
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 6]
cmp ecx, 0x53
jne 0x424dfa
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
add eax, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
call fcn.00454c50
test eax, eax
je 0x424dd7
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00454cb0
add esp, 8
test eax, eax
jne 0x424dd5
xor eax, eax
jmp 0x425a24
jmp 0x424df0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x424df0
xor eax, eax
jmp 0x425a24
mov eax, 1
jmp 0x425a24
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 0xc]
cmp eax, 0x25
jne 0x424f67
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 2]
cmp ecx, 0x73
je 0x424e38
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 2]
cmp edx, 0x53
jne 0x424f67
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 4]
cmp eax, 0x79
je 0x424e60
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 4]
cmp ecx, 0x59
jne 0x424f67
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 6]
cmp edx, 0x73
je 0x424e88
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 6]
cmp eax, 0x53
jne 0x424f67
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 8]
cmp ecx, 0x33
jne 0x424f67
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 0xa]
cmp edx, 0x32
jne 0x424f67
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, 6
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov dword [ebp - 4], 0
call fcn.00454c50
test eax, eax
je 0x424f44
lea eax, [ebp - 4]
push eax
call fcn.00454da0
add esp, 4
test eax, eax
je 0x424f08
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x424efa
xor eax, eax
jmp 0x425a24
mov eax, dword [ebp - 4]
push eax
call fcn.00454e10
add esp, 4
jmp 0x424f42
push 0
call fcn.00454d30
add esp, 4
test eax, eax
je 0x424f3b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x424f2f
xor eax, eax
jmp 0x425a24
push 1
call fcn.00454d30
add esp, 4
jmp 0x424f42
xor eax, eax
jmp 0x425a24
jmp 0x424f5d
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x424f5d
xor eax, eax
jmp 0x425a24
mov eax, 1
jmp 0x425a24
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 8]
cmp edx, 0x25
jne 0x42500e
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 2]
cmp eax, 0x77
je 0x424fa1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 2]
cmp ecx, 0x57
jne 0x42500e
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 4]
cmp edx, 0x69
je 0x424fc5
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 4]
cmp eax, 0x49
jne 0x42500e
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 6]
cmp ecx, 0x6e
je 0x424fe9
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 6]
cmp edx, 0x4e
jne 0x42500e
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, 4
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, 1
jmp 0x425a24
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 8]
cmp edx, 0x25
jne 0x4250c7
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 2]
cmp eax, 0x74
je 0x425048
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 2]
cmp ecx, 0x54
jne 0x4250c7
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 4]
cmp edx, 0x6d
je 0x42506c
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 4]
cmp eax, 0x4d
jne 0x4250c7
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 6]
cmp ecx, 0x70
je 0x425090
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 6]
cmp edx, 0x50
jne 0x4250c7
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, 4
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00402280
mov eax, 1
jmp 0x425a24
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 6]
cmp ecx, 0x25
jne 0x425178
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 2]
cmp edx, 0x70
je 0x425101
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 2]
cmp eax, 0x50
jne 0x425178
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 4]
cmp ecx, 0x66
je 0x425125
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 4]
cmp edx, 0x46
jne 0x425178
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, 3
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
call fcn.00416580
movzx eax, al
test eax, eax
jne 0x42514a
call fcn.004166d0
movzx ecx, al
test ecx, ecx
je 0x42515e
mov edx, dword [ebp + 0x10]
push edx
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x42516e
push 0
push 0x26
mov eax, dword [ebp + 0x10]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, 1
jmp 0x425a24
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 8]
cmp ecx, 0x25
jne 0x425276
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 2]
cmp edx, 0x61
je 0x4251b6
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 2]
cmp eax, 0x41
jne 0x425276
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 4]
cmp ecx, 0x70
je 0x4251de
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 4]
cmp edx, 0x50
jne 0x425276
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 6]
cmp eax, 0x70
je 0x425202
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 6]
cmp ecx, 0x50
jne 0x425276
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
add eax, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dx, word [0x4f1694]
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004ad2c0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.00421700
add esp, 8
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 0x14]
shl edx, 1
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.00422980
add esp, 0x24
mov eax, 1
jmp 0x425a24
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 0xe]
cmp edx, 0x25
jne 0x4253eb
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 2]
cmp eax, 0x73
je 0x4252b4
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 2]
cmp ecx, 0x53
jne 0x4253eb
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 4]
cmp edx, 0x79
je 0x4252dc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 4]
cmp eax, 0x59
jne 0x4253eb
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 6]
cmp ecx, 0x73
je 0x425304
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 6]
cmp edx, 0x53
jne 0x4253eb
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 8]
cmp eax, 0x61
je 0x42532c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 8]
cmp ecx, 0x41
jne 0x4253eb
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 0xa]
cmp edx, 0x70
je 0x425354
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 0xa]
cmp eax, 0x50
jne 0x4253eb
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 0xc]
cmp ecx, 0x70
je 0x425378
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 0xc]
cmp edx, 0x50
jne 0x4253eb
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, 7
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov ax, word [0x4f1698]
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.004ad2c0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x418]
push edx
call fcn.00421700
add esp, 8
push 0
push 0
mov eax, dword [ebp + 0x14]
shl eax, 1
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x418]
push edx
call fcn.00422980
add esp, 0x24
mov eax, 1
jmp 0x425a24
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 0xe]
cmp eax, 0x25
jne 0x42553c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 2]
cmp ecx, 0x63
je 0x425429
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 2]
cmp edx, 0x43
jne 0x42553c
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 4]
cmp eax, 0x6f
je 0x425451
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 4]
cmp ecx, 0x4f
jne 0x42553c
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 6]
cmp edx, 0x6d
je 0x425479
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 6]
cmp eax, 0x4d
jne 0x42553c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 8]
cmp ecx, 0x6d
je 0x4254a1
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 8]
cmp edx, 0x4d
jne 0x42553c
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 0xa]
cmp eax, 0x6f
je 0x4254c5
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 0xa]
cmp ecx, 0x4f
jne 0x42553c
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 0xc]
cmp edx, 0x6e
je 0x4254e9
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 0xc]
cmp eax, 0x4e
jne 0x42553c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
add edx, 7
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
call fcn.00416580
movzx ecx, al
test ecx, ecx
jne 0x42550e
call fcn.004166d0
movzx edx, al
test edx, edx
je 0x425522
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x425532
push 0
push 0x2b
mov ecx, dword [ebp + 0x10]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, 1
jmp 0x425a24
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 8]
cmp edx, 0x25
jne 0x425641
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 2]
cmp eax, 0x72
je 0x42557a
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 2]
cmp ecx, 0x52
jne 0x425641
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 4]
cmp edx, 0x65
je 0x4255a2
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 4]
cmp eax, 0x45
jne 0x425641
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 6]
cmp ecx, 0x73
je 0x4255c6
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 6]
cmp edx, 0x53
jne 0x425641
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, 4
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov dword [ebp - 0x41c], 0
mov ax, word [0x4f169c]
mov word [ebp - 0x628], ax
push 0x206
push 0
lea ecx, [ebp - 0x626]
push ecx
call fcn.004ad2c0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x628]
push edx
call fcn.00426e00
add esp, 8
lea eax, [ebp - 0x628]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00405230
test eax, eax
jne 0x425636
mov dword [ebp - 0x41c], 1
mov eax, dword [ebp - 0x41c]
jmp 0x425a24
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 0x24]
cmp eax, 0x25
jne 0x425a22
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 2]
cmp ecx, 0x6d
je 0x42567f
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 2]
cmp edx, 0x4d
jne 0x425a22
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 4]
cmp eax, 0x69
je 0x4256a7
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 4]
cmp ecx, 0x49
jne 0x425a22
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 6]
cmp edx, 0x6e
je 0x4256cf
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 6]
cmp eax, 0x4e
jne 0x425a22
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 8]
cmp ecx, 0x69
je 0x4256f7
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 8]
cmp edx, 0x49
jne 0x425a22
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 0xa]
cmp eax, 0x76
je 0x42571f
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 0xa]
cmp ecx, 0x56
jne 0x425a22
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 0xc]
cmp edx, 0x69
je 0x425747
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 0xc]
cmp eax, 0x49
jne 0x425a22
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 0xe]
cmp ecx, 0x65
je 0x42576f
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 0xe]
cmp edx, 0x45
jne 0x425a22
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 0x10]
cmp eax, 0x77
je 0x425797
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 0x10]
cmp ecx, 0x57
jne 0x425a22
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 0x12]
cmp edx, 0x69
je 0x4257bf
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 0x12]
cmp eax, 0x49
jne 0x425a22
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 0x14]
cmp ecx, 0x6d
je 0x4257e7
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 0x14]
cmp edx, 0x4d
jne 0x425a22
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 0x16]
cmp eax, 0x61
je 0x42580f
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 0x16]
cmp ecx, 0x41
jne 0x425a22
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 0x18]
cmp edx, 0x67
je 0x425837
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 0x18]
cmp eax, 0x47
jne 0x425a22
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 0x1a]
cmp ecx, 0x65
je 0x42585f
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 0x1a]
cmp edx, 0x45
jne 0x425a22
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 0x1c]
cmp eax, 0x70
je 0x425887
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 0x1c]
cmp ecx, 0x50
jne 0x425a22
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 0x1e]
cmp edx, 0x61
je 0x4258af
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 0x1e]
cmp eax, 0x41
jne 0x425a22
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 0x20]
cmp ecx, 0x74
je 0x4258d7
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 + 0x20]
cmp edx, 0x54
jne 0x425a22
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 0x22]
cmp eax, 0x68
je 0x4258ff
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 + 0x22]
cmp ecx, 0x48
jne 0x425a22
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
add eax, 0x12
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ebp - 0x2c5c], 0
mov dx, word [0x4f16a0]
mov word [ebp - 0x2e68], dx
push 0x206
push 0
lea eax, [ebp - 0x2e66]
push eax
call fcn.004ad2c0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x2e68]
push ecx
call fcn.00426e00
add esp, 8
mov word [ebp - 0x2c58], 0
push 0x206
push 0
lea edx, [ebp - 0x2c56]
push edx
call fcn.004ad2c0
add esp, 0xc
push 0x2424
push 0
lea eax, [ebp - 0x2a50]
push eax
call fcn.004ad2c0
add esp, 0xc
lea ecx, [ebp - 0x2c58]
push ecx
push 2
call fcn.00428a40
mov eax, dword [ebp - 0x2848]
xor edx, edx
mov ecx, 0xa
div ecx
mov dword [ebp - 0x2e6c], edx
cmp dword [ebp - 0x2e6c], 3
je 0x4259eb
cmp dword [ebp - 0x2e6c], 7
je 0x4259ba
jmp 0x425a1a
push 0x4f16a4
lea edx, [ebp - 0x2e68]
push edx
push 0x4f16ac
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00401cd0
add esp, 0x14
test eax, eax
jne 0x4259e9
mov dword [ebp - 0x2c5c], 1
jmp 0x425a1a
push 0x4f16c0
lea edx, [ebp - 0x2e68]
push edx
push 0x4f16c8
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00401cd0
add esp, 0x14
test eax, eax
jne 0x425a1a
mov dword [ebp - 0x2c5c], 1
mov eax, dword [ebp - 0x2c5c]
jmp 0x425a24
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004ad2aa
mov esp, ebp
pop ebp
ret