Function at 0x43a000
Capabilities:
Create process on windows
Encode data using base64
Get common file path
Query environment variable
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x520
mov al, byte [edx + 0x24]
mov ebx, dword [edx + 0x20]
mov dword [esp + 0xfc], ecx
mov dword [esp + 0x80], edx
mov dword [esp + 0x100], 2
test al, al
sete cl
test ebx, ebx
sete dl
and dl, cl
mov byte [esp + 7], dl
jne 0x43a8a7
test al, al
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
jne 0x43a23e
mov dword [esp + 0x18], ebx
call sub.KERNEL32.DLL_GetEnvironmentStringsW
test eax, eax
je 0x43ce62
mov edx, eax
mov dword [esp + 0x10], eax
jmp 0x43a084
mov edx, dword [esp + 0xc]
cmp word [edx], 0
jne 0x43a0a0
jmp 0x43a231
mov eax, dword [esp + 0x20]
cmp word [eax + edi*2 + 2], 0
je 0x43a231
xor ecx, ecx
xor edi, edi
nop word cs:[eax + eax]
nop
cmp word [edx + edi*2 + 2], 0
mov eax, ecx
lea edi, [edi + 1]
lea ecx, [ecx - 2]
jne 0x43a0b0
mov dword [esp + 0x20], edx
sub edx, ecx
add edx, 2
cmp edi, 1
je 0x43a090
test edi, edi
je 0x43cda0
neg eax
xor esi, esi
mov ebx, 0xfffffffc
nop
mov ecx, dword [esp + 0x20]
cmp word [ecx + esi*2 + 2], 0x3d
je 0x43a100
inc esi
add ebx, 0xfffffffe
add eax, 0xfffffffe
jne 0x43a0e0
jmp 0x43a090
lea eax, [esi + 1]
cmp esi, edi
mov dword [esp + 0xc], edx
jae 0x43ce12
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0xb0]
push eax
call fcn.0041b780
add esp, 4
lea ecx, [esi + 2]
cmp edi, ecx
jb 0x43ce1d
mov edx, dword [esp + 0x20]
sub edi, esi
lea ecx, [esp + 0x110]
add edi, 0xfffffffe
sub edx, ebx
push edi
call fcn.0041b780
add esp, 4
mov esi, dword [esp + 0xb0]
test esi, esi
je 0x43a231
mov ecx, dword [esp + 0x110]
mov ebx, dword [esp + 0xb8]
mov edx, dword [esp + 0x114]
mov eax, dword [esp + 0xb4]
mov edi, dword [esp + 0x118]
mov dword [esp + 0xb0], esi
mov dword [esp + 8], ecx
lea ecx, [esi + ebx]
mov dword [esp + 0x14], edx
lea edx, [esp + 0xb0]
mov dword [esp + 0x20], eax
mov dword [esp + 0xb4], ecx
lea ecx, [esp + 0x11c]
mov word [esp + 0xb8], 0
call fcn.00432a60
mov eax, dword [esp + 0x20]
mov dword [esp + 0x110], esi
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x34]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x118], ebx
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xb4], eax
lea eax, [esp + 0xb0]
mov dword [esp + 0xb8], edi
push eax
lea eax, [esp + 0x114]
push eax
call fcn.00437300
add esp, 8
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x43a080
cmp dword [esp + 0x60], 0
je 0x43a080
mov edx, 1
call fcn.004076c0
jmp 0x43a080
push dword [esp + 0x10]
call sub.KERNEL32.DLL_FreeEnvironmentStringsW
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x80]
xor edx, edx
mov edi, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
test eax, eax
mov dword [esp + 0xc], eax
sete dl
cmove ebx, eax
add edx, edx
mov dword [esp + 0x18], ebx
jmp 0x43a276
mov edx, dword [esp + 0x20]
xor edi, edi
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x43a890
test edx, edx
je 0x43a2a0
mov esi, dword [esp + 0xc]
cmp edx, 2
je 0x43cd7e
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
jmp 0x43a2c3
mov esi, dword [esp + 0xc]
xor ecx, ecx
test edi, edi
je 0x43a2b9
nop word [eax + eax]
mov esi, dword [esi + 0x194]
dec edi
jne 0x43a2b0
mov dword [esp + 0x20], 1
xor edi, edi
movzx eax, word [esi + 0x192]
cmp ecx, eax
mov eax, ecx
jb 0x43a2ed
mov ecx, dword [esi]
test ecx, ecx
je 0x43cce8
movzx eax, word [esi + 0x190]
inc edi
mov esi, ecx
cmp ax, word [ecx + 0x192]
jae 0x43a2d0
test edi, edi
je 0x43a330
mov ecx, dword [esi + eax*4 + 0x198]
dec edi
mov dword [esp + 0xc], ecx
je 0x43a340
mov ecx, ebx
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x14], 0
nop dword [eax]
mov ebx, dword [ebx + 0x194]
dec edi
jne 0x43a310
mov dword [esp + 0xc], ebx
mov ebx, ecx
jmp 0x43a348
lea ecx, [eax + 1]
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], ecx
jmp 0x43a348
mov dword [esp + 0x14], 0
dec ebx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x18], ebx
lea ebx, [eax + eax*2]
cmp dword [esi + ebx*4 + 0x10c], 0
je 0x43a390
mov ecx, dword [esi + ebx*8 + 0xc]
test ecx, ecx
js 0x43cd01
mov edi, dword [esi + ebx*8 + 4]
mov dword [esp + 0x20], edx
mov dword [esp + 8], ebx
je 0x43a3e0
mov edx, 1
mov ebx, ecx
call fcn.00407660
mov ecx, ebx
test eax, eax
jne 0x43a3e5
jmp 0x43cd94
mov eax, dword [esp + 0x38]
xor edi, edi
test eax, eax
je 0x43a276
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x40]
mov dword [esp + 0x10], edx
push dword [esi + ebx*8 + 0x18]
push dword [esi + ebx*8 + 0x10]
mov dword [esp + 0x10], eax
push eax
call fcn.00437fa0
add esp, 0xc
cmp dword [esp + 0x40], 1
jne 0x43a54b
mov edx, dword [esp + 0x20]
jmp 0x43a276
mov eax, 1
mov dword [esp + 0x10], ecx
push ecx
push edi
mov dword [esp + 0x24], eax
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 8]
xor ebx, ebx
mov ecx, dword [esi + eax*8 + 0x18]
mov eax, ecx
mov edi, ecx
add eax, ecx
setae al
add edi, ecx
jb 0x43cd01
mov bl, al
add ebx, ebx
test edi, edi
js 0x43cd01
mov eax, dword [esp + 8]
mov dword [esp + 0x58], ecx
lea eax, [esi + eax*8 + 0x10]
mov eax, dword [eax]
mov dword [esp + 0x84], eax
je 0x43a450
mov ecx, edi
mov edx, ebx
call fcn.00407660
test eax, eax
jne 0x43a45a
jmp 0x43cd08
mov eax, ebx
test eax, eax
je 0x43cd08
push edi
push dword [esp + 0x88]
push eax
mov edi, eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x11c], edi
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], eax
mov eax, dword [esp + 8]
mov ebx, dword [esi + eax*4 + 0x114]
test ebx, ebx
js 0x43cd01
lea eax, [esi + eax*4 + 0x10c]
mov esi, dword [eax]
je 0x43a4e0
mov ecx, ebx
mov edx, 1
call fcn.00407660
mov edi, eax
test eax, eax
jne 0x43a4e5
jmp 0x43cd92
mov edi, 1
push ebx
push esi
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea ecx, [esp + 0x5c]
lea eax, [esp + 0xb0]
mov dword [esp + 0xb0], edi
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
lea edx, [esp + 0x34]
push eax
lea eax, [esp + 0x114]
push eax
call fcn.00437300
add esp, 8
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x43a270
cmp dword [esp + 0x60], 0
je 0x43a270
mov edx, 1
call fcn.004076c0
jmp 0x43a270
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov byte [esp + 0x88], 0
test ecx, ecx
je 0x43a64b
nop word [eax + eax]
mov eax, dword [eax + edx*4 + 0x194]
dec ecx
je 0x43a583
movzx edx, word [eax + 0x192]
jmp 0x43a570
movzx ecx, word [eax + 0x192]
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], eax
lea edx, [esp + 0xb0]
lea eax, [esp + 0x88]
dec ecx
mov dword [esp + 0xb8], ecx
lea ecx, [esp + 0x110]
push eax
call fcn.004380a0
add esp, 4
movsd xmm1, qword [esp + 0x120]
mov eax, dword [esp + 0x130]
movq xmm0, qword [esp + 0x128]
movsd xmm2, qword [esp + 0x110]
mov ecx, dword [esp + 0x138]
mov edx, dword [esp + 0x13c]
movsd qword [esp + 0x6c], xmm1
movsd xmm1, qword [esp + 0x118]
mov dword [esp + 0x7c], eax
movq qword [esp + 0x74], xmm0
movsd qword [esp + 0x5c], xmm2
mov eax, dword [esp + 0x134]
movsd qword [esp + 0x64], xmm1
movzx esi, word [ecx + 0x192]
cmp edx, esi
jb 0x43a689
nop dword [eax]
mov esi, dword [ecx]
test esi, esi
je 0x43a687
movzx edx, word [ecx + 0x190]
inc eax
mov ecx, esi
cmp dx, word [esi + 0x192]
jae 0x43a630
jmp 0x43a689
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], eax
lea eax, [esp + 0x88]
mov dword [esp + 0xb8], edx
lea ecx, [esp + 0x110]
lea edx, [esp + 0xb0]
push eax
call fcn.004380a0
add esp, 4
jmp 0x43a78f
xor ecx, ecx
lea esi, [edx + edx*2]
test eax, eax
movsd xmm0, qword [ecx + esi*8 + 0x14]
mov dword [esp + 0x1c], esi
movsd qword [esp + 0xc0], xmm0
movsd xmm0, qword [ecx + esi*8 + 4]
movsd xmm1, qword [ecx + esi*8 + 0xc]
movsd qword [esp + 0xb0], xmm0
movsd xmm0, qword [esp + 0x6c]
movsd qword [esp + 0xb8], xmm1
movsd qword [ecx + esi*8 + 0x14], xmm0
movsd xmm0, qword [esp + 0x5c]
movsd xmm1, qword [esp + 0x64]
movsd qword [ecx + esi*8 + 0xc], xmm1
movsd qword [ecx + esi*8 + 4], xmm0
mov ebx, dword [ecx + esi*4 + 0x114]
lea esi, [esp + 0xc8]
mov dword [esi + 8], ebx
mov ebx, esi
mov esi, dword [esp + 0x1c]
movsd xmm0, qword [ecx + esi*4 + 0x10c]
movsd qword [ebx], xmm0
lea ebx, [esp + 0x74]
movq xmm0, qword [ebx]
movq qword [ecx + esi*4 + 0x10c], xmm0
mov ebx, dword [ebx + 8]
mov dword [ecx + esi*4 + 0x114], ebx
je 0x43a739
dec eax
je 0x43a739
mov ecx, dword [ecx + edx*4 + 0x198]
nop
mov ecx, dword [ecx + 0x194]
dec eax
jne 0x43a730
movsd xmm1, qword [esp + 0xc0]
mov eax, dword [esp + 0xd0]
movq xmm0, qword [esp + 0xc8]
movsd xmm2, qword [esp + 0xb0]
movsd qword [esp + 0x120], xmm1
movsd xmm1, qword [esp + 0xb8]
mov dword [esp + 0x130], eax
movq qword [esp + 0x128], xmm0
movsd qword [esp + 0x110], xmm2
movsd qword [esp + 0x118], xmm1
mov eax, dword [esp + 0x114]
dec dword [esp + 0x3c]
mov ebx, dword [esp + 0x110]
mov esi, dword [esp + 0x120]
cmp byte [esp + 0x88], 0
mov edx, dword [esp + 0x20]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x11c]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x128]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x12c]
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 8]
je 0x43a816
mov edx, dword [esp + 0x10]
test edx, edx
je 0x43ce2e
mov ecx, eax
mov eax, dword [eax + 0x194]
dec edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], edx
mov edx, 4
mov dword [eax], 0
call fcn.004076c0
mov edx, dword [esp + 0x20]
test ebx, ebx
je 0x43a276
cmp dword [esp + 0x58], 0
je 0x43a835
mov ecx, ebx
mov edx, 1
call fcn.004076c0
mov edx, dword [esp + 0x20]
test esi, esi
je 0x43a860
cmp dword [esp + 0x84], 0
je 0x43a860
and esi, 0x7fffffff
je 0x43a860
mov ecx, dword [esp + 0x84]
mov edx, 2
call fcn.004076c0
mov edx, dword [esp + 0x20]
cmp dword [esp + 0x1c], 0
je 0x43a276
cmp dword [esp + 0x9c], 0
je 0x43a276
mov ecx, dword [esp + 0x1c]
mov edx, 1
call fcn.004076c0
mov edx, dword [esp + 0x20]
jmp 0x43a276
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dl, byte [esp + 7]
mov dword [esp + 0x84], eax
test dl, dl
mov dword [esp + 0x18], ecx
mov dword [esp + 0xb8], 0
mov dword [esp + 0xb4], 0
mov dword [esp + 0xc0], 0
mov dword [esp + 0xbc], 0
mov dword [esp + 0xc8], 0
mov dword [esp + 0xc4], 0
mov dword [esp + 0xd0], 0
mov dword [esp + 0xcc], 0
mov dword [esp + 0xd8], 0
mov dword [esp + 0xd4], 0
mov dword [esp + 0xe0], 0
mov dword [esp + 0xe4], 0
mov dword [esp + 0xe8], 0xffffffff
mov dword [esp + 0xec], 0xffffffff
mov dword [esp + 0xf0], 0xffffffff
mov dword [esp + 0xb0], 0x44
mov dword [esp + 0xdc], 0x100
je 0x43a979
mov eax, edx
mov dword [esp + 0x1c], 0
jmp 0x43ab3b
mov ecx, 4
mov edx, 1
call fcn.00407660
test eax, eax
je 0x43ce42
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], 4
mov dword [esp + 0x118], 0
lea ecx, [esp + 0x110]
mov edx, 0x450e18
push 4
call fcn.00435d10
add esp, 4
mov ebx, dword [esp + 0x110]
mov eax, dword [esp + 0x118]
mov edi, dword [esp + 0x114]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x110]
add eax, ebx
mov dword [esp + 0x110], ebx
mov dword [esp + 0x114], eax
mov word [esp + 0x118], 0
call fcn.00432a60
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
test esi, esi
mov dword [esp + 0x54], edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x9c], ecx
je 0x43ac39
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x84]
mov dword [esp + 0xac], ebx
mov ebx, esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], esi
mov dword [esp + 8], eax
mov dword [esp + 0x14], ecx
movzx eax, word [ebx + 0x192]
mov edi, 0x108
mov esi, 0xffffffff
mov dword [esp + 0x58], eax
neg eax
mov dword [esp + 0x20], eax
nop word cs:[eax + eax]
nop
mov eax, dword [esp + 0x20]
add eax, esi
cmp eax, 0xffffffff
je 0x43aab0
push 1
push dword [ebx + edi*2 - 0x1f8]
push dword [ebx + edi*2 - 0x200]
push dword [esp + 0x14]
push dword [esp + 0x1c]
call sub.KERNEL32.DLL_CompareStringOrdinal
add edi, 0xc
inc esi
cmp eax, 3
je 0x43aa70
cmp eax, 1
jne 0x43aad1
jmp 0x43aab4
mov esi, dword [esp + 0x58]
mov eax, dword [esp + 0x14]
sub eax, 1
jb 0x43aecc
mov ebx, dword [ebx + esi*4 + 0x194]
mov dword [esp + 0x14], eax
jmp 0x43aa49
cmp eax, 2
jne 0x43cd13
mov eax, dword [ebx + edi - 8]
mov edi, dword [ebx + edi]
mov dword [esp + 0x1c], eax
mov al, byte [esp + 7]
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0xac]
cmp dword [esp + 0x54], 0
je 0x43ab0b
mov ecx, ebx
mov edx, 1
call fcn.004076c0
mov al, byte [esp + 7]
mov ecx, dword [esp + 0x9c]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x43ab3b
cmp dword [esp + 0xc], 0
je 0x43ab3b
and ecx, 0x7fffffff
je 0x43ab3b
mov ecx, dword [esp + 0xc]
mov edx, 2
call fcn.004076c0
mov al, byte [esp + 7]
mov ecx, dword [esp + 0x80]
mov dword [esp + 8], 0x1402
mov ebx, dword [ecx + 8]
mov edi, dword [ecx]
test ebx, ebx
mov dword [esp + 0xf4], edi
mov dword [esp + 0xf8], ebx
je 0x43ab9b
mov ecx, 0x438480
cmp ebx, 4
mov dword [esp + 0x20], 0x451c90
jb 0x43ab86
cmp dword [edi], 0x5c3f5c5c
mov eax, 0x438470
mov ecx, 0x438480
cmove ecx, eax
movzx eax, byte [ebx + edi - 1]
push eax
call ecx
add esp, 4
test al, al
je 0x43abc2
mov al, byte [esp + 7]
jmp 0x43aba3
mov dword [esp + 0x20], 0x451c90
test al, al
mov ecx, dword [esp + 0x18]
je 0x43b64b
cmp dword [esp + 0x100], 3
je 0x43b6a8
jmp 0x43b6c1
xor ecx, ecx
cmp ebx, 4
mov edx, 0
jb 0x43ac57
mov al, byte [ebx + edi - 4]
mov edx, eax
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x2e
jne 0x43ac55
mov al, byte [edi + ebx - 3]
mov edx, eax
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x65
jne 0x43ac55
mov al, byte [edi + ebx - 2]
mov edx, eax
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x78
jne 0x43ac55
mov al, byte [edi + ebx - 1]
mov edx, eax
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x65
sete dl
jmp 0x43ac57
mov al, byte [esp + 7]
mov dword [esp + 0x1c], 0
cmp dword [esp + 0x54], 0
jne 0x43aafb
jmp 0x43ab0b
xor edx, edx
lea eax, [edi + ebx]
mov dword [esp + 0x20], eax
nop
cmp ebx, ecx
je 0x43aca9
movzx eax, byte [edi + ecx]
cmp al, 0x2f
je 0x43ac71
inc ecx
cmp al, 0x5c
jne 0x43ac60
lea ecx, [esp + 0x110]
test dl, dl
je 0x43ad74
mov edx, edi
push ebx
call fcn.00435200
add esp, 4
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x110]
mov edi, dword [esp + 0x118]
mov dword [esp + 0x58], eax
jmp 0x43b3ce
xor eax, eax
mov ecx, edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x58], ebx
jmp 0x43accb
xor eax, eax
test dx, dx
je 0x43ae3e
mov dx, 1
test ax, ax
jne 0x43acc0
cmp ecx, dword [esp + 0x20]
je 0x43aea2
movzx eax, byte [ecx]
test al, al
js 0x43acfa
inc ecx
mov edi, eax
xor eax, eax
mov edx, edi
mov edi, dword [esp + 0xc]
test dx, dx
jne 0x43accb
jmp 0x43ae3e
movzx esi, byte [ecx + 1]
mov edi, eax
and edi, 0x1f
and esi, 0x3f
cmp al, 0xdf
jbe 0x43ad33
movzx ebx, byte [ecx + 2]
shl esi, 6
and ebx, 0x3f
or ebx, esi
cmp al, 0xf0
jb 0x43ad49
movzx eax, byte [ecx + 3]
and edi, 7
shl ebx, 6
add ecx, 4
shl edi, 0x12
and eax, 0x3f
or eax, ebx
or edi, eax
jmp 0x43ad51
shl edi, 6
add ecx, 2
or edi, esi
mov esi, dword [esp + 0x10]
cmp edi, 0xffff
jbe 0x43ace8
jmp 0x43ad61
shl edi, 0xc
add ecx, 3
or edi, ebx
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x58]
cmp edi, 0xffff
jbe 0x43ace8
and edi, 0x3ff
or edi, 0xdc00
mov eax, edi
jmp 0x43acec
mov edx, edi
push ebx
call fcn.00435200
add esp, 4
mov eax, dword [esp + 0x110]
mov ecx, dword [esp + 0x114]
mov edx, dword [esp + 0x118]
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], ecx
mov dword [esp + 0x118], edx
lea ecx, [esp + 0x110]
mov edx, 0x451c98
push 4
call fcn.00435d10
add esp, 4
mov ebx, dword [esp + 0x110]
mov eax, dword [esp + 0x114]
mov edi, dword [esp + 0x118]
lea ecx, [esp + 0x110]
mov dword [esp + 0x58], eax
mov edx, ebx
push edi
call fcn.004384a0
add esp, 4
cmp byte [esp + 0x110], 0
je 0x43ae4f
lea eax, [esp + 0x114]
push eax
call fcn.00419780
add esp, 4
mov ecx, ebx
mov edx, edi
mov dword [esp + 8], edi
call fcn.00436eb0
test eax, eax
mov dword [esp + 0x1c], ebx
je 0x43aebf
mov edi, edx
cmp edx, 2
jne 0x43ae60
movzx ecx, word [eax]
cmp ecx, 0x2e2e
jne 0x43ae60
mov dword [esp + 0x20], 2
xor ecx, ecx
jmp 0x43aefb
mov al, byte [esp + 7]
mov dword [esp + 0x20], 0x451c68
jmp 0x43aba3
cmp byte [esp + 0x111], 0
je 0x43ae04
mov ecx, ebx
jmp 0x43b3ce
mov dword [esp + 0x10], esi
xor esi, esi
mov ecx, eax
nop dword [eax + eax]
cmp edi, esi
je 0x43aed1
cmp byte [ecx + edi - 1], 0x2e
lea ebx, [ecx - 1]
mov edx, esi
lea esi, [esi + 1]
mov ecx, ebx
jne 0x43ae70
mov ecx, edi
sub ecx, esi
mov dword [esp + 0x20], ecx
inc ecx
cmp edi, ecx
jb 0x43cf67
cmp edi, esi
jne 0x43aeef
xor ecx, ecx
mov dword [esp + 0x20], edi
jmp 0x43aef3
cmp ebx, 7
ja 0x43aedd
xor eax, eax
nop dword [eax]
cmp byte [edi + eax], 0x2e
je 0x43af23
inc eax
cmp ebx, eax
jne 0x43aeb0
xor eax, eax
jmp 0x43af28
mov edi, dword [esp + 8]
mov ecx, dword [esp + 0x1c]
jmp 0x43b3ce
jmp 0x43aae5
mov ecx, eax
mov dword [esp + 0x20], edi
xor eax, eax
mov edx, edi
jmp 0x43aef3
mov ecx, 0x2e
mov edx, edi
push ebx
call fcn.0040ac60
add esp, 4
jmp 0x43af28
lea ecx, [ebx + edi + 1]
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 8]
test eax, eax
cmovne ecx, eax
test ecx, ecx
je 0x43af1a
test eax, eax
mov eax, dword [esp + 0x20]
cmove eax, edx
add ecx, eax
sub ecx, ebx
cmp edi, ecx
cmovae edi, ecx
mov ecx, dword [esp + 0x1c]
jmp 0x43b3ce
mov eax, 1
cmp eax, 1
lea eax, [esp + 0xf4]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x88], eax
lea eax, [esp + 0xa3]
sete byte [esp + 0xa3]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x43afff
add ecx, eax
lea esi, [esp + 0x5c]
mov dword [esp + 0x110], eax
lea edx, [esp + 0x110]
mov dword [esp + 0x114], ecx
mov ecx, esi
mov word [esp + 0x118], 0
mov byte [esp + 0x11c], 1
call fcn.004342d0
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x43afff
lea edi, [esp + 0x110]
lea ebx, [esp + 0x88]
jmp 0x43afe3
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], edx
lea ecx, [esp + 0x40]
mov edx, ebx
push esi
call fcn.00438570
add esp, 4
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x43b354
mov ecx, esi
mov edx, edi
call fcn.004342d0
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x43afff
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x60]
test edx, edx
jne 0x43afab
test eax, eax
je 0x43afd2
mov edx, 1
call fcn.004076c0
jmp 0x43afd2
lea ecx, [esp + 0x110]
call fcn.00434ae0
cmp dword [esp + 0x110], 0
je 0x43b161
lea eax, [esp + 0x114]
push eax
call fcn.00419780
add esp, 4
push 0x400
push 0
lea eax, [esp + 0x118]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [0x452bc0]
mov edi, 0x200
mov dword [esp + 0x20], 0
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x14], eax
mov dword [esp + 8], eax
cmp edi, 0x201
jae 0x43b092
jmp 0x43b0d0
cmp ebx, edi
mov edi, ebx
jb 0x43b126
cmp edi, 0x201
jb 0x43b0d0
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x38]
mov eax, edi
sub eax, edx
sub ecx, edx
cmp ecx, eax
jb 0x43b0b4
mov ebx, dword [esp + 8]
mov esi, edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x20], edi
jmp 0x43b0dc
lea ecx, [esp + 0x34]
push eax
call fcn.0041ca60
add esp, 4
mov eax, dword [esp + 0x34]
mov dword [esp + 8], eax
jmp 0x43b0a4
lea ebx, [esp + 0x110]
mov esi, 0x200
mov dword [esp + 0xc], ebx
push 0
call sub.KERNEL32.DLL_SetLastError
push edi
push ebx
call sub.KERNEL32.DLL_GetSystemDirectoryW
mov ebx, eax
test eax, eax
jne 0x43b101
call sub.KERNEL32.DLL_GetLastError
test eax, eax
jne 0x43b1c4
cmp ebx, edi
jne 0x43b080
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x7a
jne 0x43b080
add edi, edi
cmp edi, 0x201
jb 0x43b0d0
jmp 0x43b092
cmp ebx, esi
ja 0x43cf59
mov edx, dword [esp + 0xc]
lea esi, [esp + 0x40]
mov ecx, esi
push ebx
call fcn.0041b780
add esp, 4
lea ecx, [esp + 0x60]
lea edx, [esp + 0x88]
push esi
call fcn.00438570
add esp, 4
mov dword [esp + 0x5c], 0
mov bl, 1
jmp 0x43b1df
mov esi, dword [esp + 0x114]
mov edi, dword [esp + 0x11c]
mov ebx, dword [esp + 0x118]
mov ecx, esi
mov edx, edi
call fcn.004364e0
cmp edi, edx
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], ebx
lea ecx, [esp + 0x40]
cmovb edx, edi
test eax, eax
lea eax, [esp + 0x5c]
cmove edx, edi
mov dword [esp + 0x64], edx
lea edx, [esp + 0x88]
push eax
call fcn.00438570
add esp, 4
mov edi, dword [esp + 0x40]
test edi, edi
je 0x43b029
movq xmm0, qword [esp + 0x44]
jmp 0x43b3b7
call sub.KERNEL32.DLL_GetLastError
xor ebx, ebx
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], 0
mov dword [esp + 0x5c], 1
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x10]
test eax, eax
je 0x43b207
cmp dword [esp + 8], 0
je 0x43b207
and eax, 0x7fffffff
je 0x43b207
mov ecx, dword [esp + 8]
mov edx, 2
call fcn.004076c0
lea eax, [esp + 0x60]
test bl, bl
je 0x43b222
mov edi, dword [esp + 0x60]
test edi, edi
je 0x43b22b
movq xmm0, qword [esp + 0x64]
jmp 0x43b3bb
push eax
call fcn.00419780
add esp, 4
lea eax, [esp + 0x110]
push 0x400
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [0x452bc0]
mov edi, 0x200
mov dword [esp + 0x20], 0
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
cmp edi, 0x201
jae 0x43b292
jmp 0x43b2cb
cmp ebx, edi
mov edi, ebx
jb 0x43b319
cmp edi, 0x201
jb 0x43b2cb
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x38]
mov eax, edi
sub eax, edx
sub ecx, edx
cmp ecx, eax
jb 0x43b2b4
mov ebx, dword [esp + 0x14]
mov esi, edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x20], edi
jmp 0x43b2d7
lea ecx, [esp + 0x34]
push eax
call fcn.0041ca60
add esp, 4
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], eax
jmp 0x43b2a4
lea ebx, [esp + 0x110]
mov esi, 0x200
mov dword [esp + 0xc], ebx
push 0
call sub.KERNEL32.DLL_SetLastError
push edi
push ebx
call sub.KERNEL32.DLL_GetWindowsDirectoryW
mov ebx, eax
test eax, eax
jne 0x43b2f8
call sub.KERNEL32.DLL_GetLastError
test eax, eax
jne 0x43b35e
cmp ebx, edi
jne 0x43b280
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x7a
jne 0x43b280
add edi, edi
cmp edi, 0x201
jb 0x43b2cb
jmp 0x43b292
cmp ebx, esi
ja 0x43cf59
mov edx, dword [esp + 0xc]
lea esi, [esp + 0x40]
mov ecx, esi
push ebx
call fcn.0041b780
add esp, 4
lea ecx, [esp + 0x60]
lea edx, [esp + 0x88]
push esi
call fcn.00438570
add esp, 4
mov dword [esp + 0x5c], 0
mov bl, 1
jmp 0x43b379
movsd xmm0, qword [esp + 0x44]
mov edi, eax
jmp 0x43b3b7
call sub.KERNEL32.DLL_GetLastError
xor ebx, ebx
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], 0
mov dword [esp + 0x5c], 1
mov eax, dword [esp + 0x38]
test eax, eax
je 0x43b39d
cmp dword [esp + 0x14], 0
je 0x43b39d
and eax, 0x7fffffff
je 0x43b39d
mov ecx, dword [esp + 0x14]
mov edx, 2
call fcn.004076c0
test bl, bl
je 0x43bcda
mov edi, dword [esp + 0x60]
test edi, edi
je 0x43bce7
movq xmm0, qword [esp + 0x64]
mov esi, dword [esp + 0x10]
movd dword [esp + 0x58], xmm0
pshufd xmm0, xmm0, 0x55
mov ecx, edi
movd eax, xmm0
mov edi, eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x1c], ecx
mov edx, dword [eax + 0x14]
mov ebx, dword [eax + 0xc]
mov al, byte [eax + 0x51]
mov byte [esp + 0xc], al
mov eax, dword [0x452bc0]
mov dword [esp + 0x20], edx
mov edx, edi
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], 0
mov dword [esp + 0x9c], eax
mov dword [esp + 0x118], 0
call fcn.00436eb0
test eax, eax
mov dword [esp + 8], edi
je 0x43b4e9
cmp edx, 2
jne 0x43b43a
movzx ecx, word [eax]
cmp ecx, 0x2e2e
je 0x43b4e9
add eax, edx
mov ecx, 4
nop word cs:[eax + eax]
nop dword [eax + eax]
lea edi, [edx + ecx]
cmp edi, 4
je 0x43b4e5
cmp byte [eax + ecx - 5], 0x2e
lea edi, [ecx - 1]
mov ecx, edi
jne 0x43b450
lea ecx, [edx + edi - 3]
cmp edx, ecx
jb 0x43cf69
add edx, edi
xor ecx, ecx
lea eax, [eax + edi - 3]
cmp edx, 4
cmove eax, ecx
je 0x43bc4d
test edi, edi
mov edi, dword [esp + 8]
jne 0x43b4eb
mov dl, byte [eax]
mov ecx, edx
add cl, 0xbf
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, dl
cmp cl, 0x62
je 0x43bc71
cmp cl, 0x63
jne 0x43b4e9
mov cl, byte [eax + 1]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x6d
jne 0x43b4e9
mov al, byte [eax + 2]
mov ecx, eax
add cl, 0xbf
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x64
jne 0x43b4e9
jmp 0x43bca9
mov edi, dword [esp + 8]
xor ecx, ecx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x110]
push 0
push edi
call fcn.00438770
add esp, 8
cmp al, 4
jne 0x43b5f7
mov al, byte [esp + 0xc]
mov edi, dword [esp + 0x20]
mov dword [esp + 0x10], esi
xor al, 1
shl edi, 4
movzx eax, al
mov dword [esp + 0xc], eax
jmp 0x43b577
lea eax, [ebx + 0x10]
mov esi, ebx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x110]
mov word [eax + edx*2], 0x20
inc edx
mov eax, dword [esp + 0xc]
mov dword [esp + 0x118], edx
cmp dword [ebx], 1
mov edx, dword [ebx + 4]
mov ebx, 2
cmove eax, ebx
push eax
push dword [esi + 0xc]
call fcn.00438770
add esp, 8
mov ebx, dword [esp + 0x20]
add edi, 0xfffffff0
cmp al, 4
jne 0x43b5f3
test edi, edi
je 0x43b5ae
mov edx, dword [esp + 0x118]
lea ecx, [esp + 0x110]
cmp edx, dword [esp + 0x114]
jne 0x43b530
lea ecx, [esp + 0x110]
call fcn.004329e0
mov edx, dword [esp + 0x118]
lea ecx, [esp + 0x110]
jmp 0x43b530
cmp byte [esp + 0x14], 0
mov esi, dword [esp + 0x10]
je 0x43b6e1
mov edx, dword [esp + 0x118]
cmp edx, dword [esp + 0x114]
jne 0x43b5e0
lea ecx, [esp + 0x110]
call fcn.004329e0
mov edx, dword [esp + 0x118]
mov eax, dword [esp + 0x110]
mov word [eax + edx*2], 0x22
inc edx
jmp 0x43b6e8
mov esi, dword [esp + 0x10]
mov dword [esp + 0x20], edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x114]
test eax, eax
je 0x43b626
mov ecx, dword [esp + 0x110]
test ecx, ecx
je 0x43b626
and eax, 0x7fffffff
je 0x43b626
mov edx, 2
call fcn.004076c0
xor ebx, ebx
cmp dword [esp + 0x58], 0
je 0x43b63d
mov ecx, dword [esp + 0x1c]
mov edx, 1
call fcn.004076c0
or bl, byte [esp + 7]
mov ecx, dword [esp + 0x18]
jne 0x43abaf
test esi, esi
je 0x43b676
mov eax, dword [esp + 0x84]
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], esi
mov dword [esp + 0x124], eax
xor eax, eax
mov dword [esp + 0x128], esi
jmp 0x43b67d
xor ecx, ecx
mov eax, 2
mov dword [esp + 0x110], eax
mov dword [esp + 0x120], eax
mov dword [esp + 0x130], ecx
lea ecx, [esp + 0x110]
call fcn.00437270
cmp dword [esp + 0x100], 3
jne 0x43b6c1
mov edi, 1
push dword [esp + 0x10c]
call sub.KERNEL32.DLL_CloseHandle
test edi, edi
je 0x43c321
mov eax, dword [esp + 0xfc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov dword [eax], 1
jmp 0x43cc9f
mov edx, dword [esp + 0x118]
mov ecx, dword [esp + 0x114]
mov eax, dword [esp + 0x110]
cmp edx, ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], edx
jne 0x43b717
lea ecx, [esp + 0x34]
call fcn.004329e0
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x80]
mov word [eax + edx*2], 0
inc edx
mov eax, 0x400
mov dword [esp + 0x3c], edx
mov edx, 0x608
cmp byte [ecx + 0x50], 0
cmove edx, eax
or edx, dword [ecx + 0x34]
cmp byte [esp + 7], 0
mov dword [esp + 0xac], edx
je 0x43b840
mov eax, dword [0x452bc0]
mov dword [esp + 0xc], 0
xor edx, edx
mov dword [esp + 0xa4], eax
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x54], edx
lea eax, [ecx + 0x28]
mov ecx, dword [ecx + 0x28]
test ecx, ecx
cmove eax, ecx
je 0x43bc56
mov edx, dword [eax]
mov eax, dword [eax + 8]
xor ebx, ebx
add eax, edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], eax
jmp 0x43b7ab
xor ebx, ebx
test si, si
je 0x43bc37
mov si, 1
test bx, bx
jne 0x43b7a0
cmp edx, eax
je 0x43be53
movzx ebx, byte [edx]
test bl, bl
js 0x43b7cc
inc edx
mov edi, ebx
xor ebx, ebx
mov esi, edi
jmp 0x43b7a2
movzx ecx, byte [edx + 1]
mov edi, ebx
and edi, 0x1f
and ecx, 0x3f
cmp bl, 0xdf
jbe 0x43b807
movzx eax, byte [edx + 2]
shl ecx, 6
and eax, 0x3f
or eax, ecx
cmp bl, 0xf0
jb 0x43b819
movzx ecx, byte [edx + 3]
and edi, 7
shl eax, 6
add edx, 4
shl edi, 0x12
and ecx, 0x3f
or ecx, eax
or edi, ecx
jmp 0x43b821
shl edi, 6
add edx, 2
or edi, ecx
cmp edi, 0xffff
jbe 0x43b7c6
jmp 0x43b82d
shl edi, 0xc
add edx, 3
or edi, eax
mov eax, dword [esp + 0x20]
cmp edi, 0xffff
jbe 0x43b7c6
and edi, 0x3ff
or edi, 0xdc00
mov ebx, edi
jmp 0x43b7a2
mov eax, dword [0x452bc0]
mov ecx, dword [esp + 0x18]
xor ebx, ebx
test ecx, ecx
mov edi, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
jne 0x43b887
lea ecx, [esp + 0x40]
xor edx, edx
call fcn.004329e0
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x48]
mov ecx, dword [esp + 0x18]
mov word [edi + ebx*2], 0
inc ebx
mov dword [esp + 0x48], ebx
mov edx, dword [esp + 0x84]
xor eax, eax
test esi, esi
sete al
cmove ecx, esi
add eax, eax
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], edx
mov dword [esp + 0x118], esi
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], edx
mov dword [esp + 0x128], esi
mov dword [esp + 0x130], ecx
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x110]
call fcn.004370a0
mov eax, dword [esp + 0x60]
test eax, eax
je 0x43c0a0
mov ecx, dword [esp + 0x64]
lea esi, [ecx + ecx*2]
mov ecx, dword [eax + esi*8 + 4]
test ecx, ecx
je 0x43c0a0
mov edx, dword [eax + esi*8 + 8]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x104], ebx
xor ebx, ebx
mov dword [esp + 0x108], edi
mov ecx, dword [esp + 0x20]
mov dword [esp + 0xa8], edx
mov edx, dword [eax + esi*8 + 0x10]
mov dword [esp + 0xa4], edx
mov edx, dword [eax + esi*8 + 0x14]
mov dword [esp + 0x90], edx
mov edx, dword [eax + esi*8 + 0x18]
mov dword [esp + 0x94], edx
mov edx, dword [eax + esi*4 + 0x10c]
mov dword [esp + 0x54], edx
mov edx, dword [eax + esi*4 + 0x110]
mov dword [esp + 0x98], edx
mov edx, dword [eax + esi*4 + 0x114]
mov dword [esp + 0x14], edx
mov edx, dword [eax + esi*8 + 0xc]
mov esi, ecx
add edx, ecx
mov dword [esp + 0xc], edx
jmp 0x43b97b
xor ebx, ebx
test ax, ax
je 0x43bbd0
mov ax, 1
test bx, bx
jne 0x43b970
cmp esi, edx
je 0x43ba0f
movzx ebx, byte [esi]
test bl, bl
js 0x43b998
inc esi
mov edi, ebx
jmp 0x43b9f3
movzx edx, byte [esi + 1]
mov edi, ebx
and edi, 0x1f
and edx, 0x3f
cmp bl, 0xdf
jbe 0x43b9d1
movzx ecx, byte [esi + 2]
shl edx, 6
and ecx, 0x3f
or ecx, edx
cmp bl, 0xf0
jb 0x43b9db
movzx edx, byte [esi + 3]
and edi, 7
shl ecx, 6
add esi, 4
shl edi, 0x12
and edx, 0x3f
or edx, ecx
jmp 0x43b9d7
add esi, 2
shl edi, 6
or edi, edx
jmp 0x43b9e3
shl edi, 0xc
add esi, 3
or edi, ecx
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0xc]
cmp edi, 0xffff
ja 0x43b9fc
xor ebx, ebx
mov eax, edi
jmp 0x43b972
and edi, 0x3ff
or edi, 0xdc00
mov ebx, edi
jmp 0x43b972
cmp dword [esp + 0xa8], 0
je 0x43ba23
mov edx, 1
call fcn.004076c0
mov eax, dword [esp + 0x44]
mov ebx, dword [esp + 0x104]
mov ecx, dword [esp + 0x94]
mov edi, dword [esp + 0x108]
sub eax, ebx
lea esi, [ecx + ecx]
cmp eax, ecx
jb 0x43bbae
lea eax, [edi + ebx*2]
push esi
mov esi, dword [esp + 0xa8]
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x94]
add eax, ebx
test dword [esp + 0x90], 0x7fffffff
mov ebx, eax
mov dword [esp + 0x48], eax
je 0x43ba86
mov ecx, esi
mov edx, 2
call fcn.004076c0
cmp ebx, dword [esp + 0x44]
jne 0x43ba9f
lea ecx, [esp + 0x40]
mov edx, ebx
call fcn.004329e0
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x48]
mov eax, dword [esp + 0x54]
mov word [edi + ebx*2], 0x3d
inc ebx
xor esi, esi
mov dword [esp + 0x48], ebx
add dword [esp + 0x14], eax
jmp 0x43bac1
xor esi, esi
test cx, cx
je 0x43bdc8
mov cx, 1
test si, si
jne 0x43bab6
cmp eax, dword [esp + 0x14]
je 0x43bb48
movzx ebx, byte [eax]
test bl, bl
js 0x43badc
inc eax
mov edx, ebx
jmp 0x43bb2f
movzx edi, byte [eax + 1]
mov edx, ebx
and edx, 0x1f
and edi, 0x3f
cmp bl, 0xdf
jbe 0x43bb15
movzx esi, byte [eax + 2]
shl edi, 6
and esi, 0x3f
or esi, edi
cmp bl, 0xf0
jb 0x43bb1f
movzx edi, byte [eax + 3]
and edx, 7
shl esi, 6
add eax, 4
shl edx, 0x12
and edi, 0x3f
or edi, esi
jmp 0x43bb1b
add eax, 2
shl edx, 6
or edx, edi
jmp 0x43bb27
shl edx, 0xc
add eax, 3
or edx, esi
cmp edx, 0xffff
ja 0x43bb35
xor esi, esi
mov ecx, edx
jmp 0x43bab8
and edx, 0x3ff
or edx, 0xdc00
mov esi, edx
jmp 0x43bab8
mov edi, dword [esp + 0x54]
lea ecx, [esp + 0x40]
mov edx, edi
push 0
push dword [esp + 0x18]
call fcn.00432be0
add esp, 8
cmp dword [esp + 0x98], 0
je 0x43bb76
mov ecx, edi
mov edx, 1
call fcn.004076c0
mov ebx, dword [esp + 0x48]
cmp ebx, dword [esp + 0x44]
jne 0x43bb8f
lea ecx, [esp + 0x40]
mov edx, ebx
call fcn.004329e0
mov ebx, dword [esp + 0x48]
mov edi, dword [esp + 0x40]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x110]
mov word [edi + ebx*2], 0
inc ebx
mov dword [esp + 0x48], ebx
jmp 0x43b8d6
lea ecx, [esp + 0x40]
mov edx, ebx
push dword [esp + 0x94]
call fcn.0041ca60
add esp, 4
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x48]
jmp 0x43ba49
cmp dword [esp + 0xa8], 0
je 0x43bbe4
mov edx, 1
call fcn.004076c0
cmp dword [esp + 0x98], 0
mov ecx, dword [esp + 0x54]
mov esi, dword [esp + 0x10]
je 0x43bc04
test ecx, ecx
je 0x43bc04
mov edx, 1
call fcn.004076c0
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0xa4]
test eax, eax
je 0x43bde4
test ecx, ecx
je 0x43bde4
and eax, 0x7fffffff
je 0x43bde4
mov edx, 2
jmp 0x43bddf
mov esi, dword [esp + 0x54]
mov edi, 0x451c68
mov dword [esp + 8], 0x1402
jmp 0x43c2c1
mov edi, dword [esp + 8]
jmp 0x43b4eb
mov dword [esp + 0xa8], 0
mov dword [esp + 0x90], 0
jmp 0x43bebd
mov cl, byte [eax + 1]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x61
jne 0x43b4e9
mov al, byte [eax + 2]
mov ecx, eax
add cl, 0xbf
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x74
jne 0x43b4e9
lea ecx, [esp + 0x110]
xor edx, edx
call fcn.004329e0
mov eax, dword [esp + 0x110]
mov ecx, dword [esp + 0x118]
mov word [eax + ecx*2], 0x22
inc ecx
mov dword [esp + 0x118], ecx
mov cl, 1
jmp 0x43b4eb
lea eax, [esp + 0x60]
push eax
call fcn.00419780
add esp, 4
lea ecx, [esp + 0x34]
mov edx, 0x450e18
push 4
call fcn.00432df0
add esp, 4
mov esi, dword [esp + 0x34]
test esi, esi
je 0x43be36
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
lea edi, [esp + 0x5c]
lea ebx, [esp + 0x110]
mov dword [esp + 0x110], esi
add ecx, esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x114], ecx
mov word [esp + 0x118], 0
mov byte [esp + 0x11c], 1
mov ecx, edi
mov edx, ebx
call fcn.004342d0
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x43be23
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x60]
test edx, edx
jne 0x43bd70
test eax, eax
je 0x43bd3f
mov edx, 1
call fcn.004076c0
jmp 0x43bd3f
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], edx
lea ecx, [esp + 0x40]
lea edx, [esp + 0x88]
push edi
call fcn.00438570
add esp, 4
mov eax, dword [esp + 0x40]
test eax, eax
je 0x43bd3f
movq xmm0, qword [esp + 0x44]
cmp dword [esp + 0x20], 0
mov edi, eax
je 0x43b3b7
mov ecx, esi
mov edx, 1
movdqa xmmword [esp + 0x20], xmm0
call fcn.004076c0
movdqa xmm0, xmmword [esp + 0x20]
jmp 0x43b3b7
cmp dword [esp + 0x98], 0
mov esi, dword [esp + 0x10]
je 0x43bde4
mov ecx, dword [esp + 0x54]
mov edx, 1
call fcn.004076c0
lea ecx, [esp + 0x110]
call fcn.00437270
mov eax, dword [esp + 0x44]
test eax, eax
je 0x43be11
mov ecx, dword [esp + 0x40]
test ecx, ecx
je 0x43be11
and eax, 0x7fffffff
je 0x43be11
mov edx, 2
call fcn.004076c0
mov edi, 0x451c68
mov dword [esp + 8], 0x1402
jmp 0x43c2de
cmp dword [esp + 0x20], 0
je 0x43be36
mov ecx, esi
mov edx, 1
call fcn.004076c0
mov al, byte [esp + 7]
mov esi, dword [esp + 0x10]
mov dword [esp + 8], 2
mov dword [esp + 0x20], 0x451cb0
jmp 0x43aba3
mov edx, dword [esp + 0x14]
mov ecx, eax
mov dword [esp + 0x110], edx
mov dword [esp + 0x114], ecx
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x110]
mov word [esp + 0x118], 0
call fcn.00432a60
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
cmp edx, eax
jne 0x43be9e
lea ecx, [esp + 0x5c]
call fcn.004329e0
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x90], eax
mov word [ecx + edx*2], 0
mov dword [esp + 0x9c], ecx
mov dword [esp + 0xa8], ecx
pxor xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
push 0x45b0d8
call sub.KERNEL32.DLL_AcquireSRWLockExclusive
mov ebx, dword [esp + 0x80]
xor edx, edx
mov dword [esp + 0x110], 0
mov dword [esp + 0x118], 0
mov dword [esp + 0x120], 0
mov dword [esp + 0x88], 1
mov ecx, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
lea eax, [ebx + 0x38]
cmp ecx, 4
mov dword [esp + 0x20], edi
cmove eax, edx
cmp ecx, 4
lea ecx, [esp + 0x88]
lea esi, [eax + 4]
cmovne ecx, eax
lea eax, [esp + 0xf4]
cmovne eax, esi
cmp edi, 4
mov edi, dword [ebx + 0x48]
lea esi, [ebx + 0x40]
cmove esi, edx
add ebx, 0x48
cmp edi, 4
mov dword [esp + 0x14], edi
cmove ebx, edx
mov edx, dword [ecx]
lea ecx, [esp + 0x5c]
mov dword [esp + 0x80], ebx
lea ebx, [esp + 0x110]
push ebx
push 0xfffffffffffffff6
push dword [eax]
call fcn.00438b70
add esp, 0xc
cmp dword [esp + 0x5c], 1
jne 0x43bf90
mov eax, dword [esp + 0x60]
mov edi, dword [esp + 0x64]
mov esi, dword [esp + 0x54]
mov ebx, dword [esp + 0x90]
mov dword [esp + 8], eax
jmp 0x43c25c
cmp dword [esp + 0x20], 4
lea edi, [esp + 0x100]
lea eax, [esi + 4]
mov ecx, dword [esp + 0x60]
lea ebx, [esp + 0x118]
cmove esi, edi
mov dword [esp + 0x98], ecx
lea ecx, [esp + 0x5c]
mov edx, dword [esi]
lea esi, [esp + 0x10c]
cmove eax, esi
push ebx
push 0xfffffffffffffff5
push dword [eax]
call fcn.00438b70
add esp, 0xc
cmp dword [esp + 0x5c], 1
jne 0x43bff4
mov eax, dword [esp + 0x60]
mov edi, dword [esp + 0x64]
mov esi, dword [esp + 0x54]
mov ebx, dword [esp + 0x90]
mov dword [esp + 8], eax
jmp 0x43c250
mov ecx, dword [esp + 0x80]
cmp dword [esp + 0x14], 4
lea eax, [esp + 0x120]
lea ebx, [ecx + 4]
cmovne edi, ecx
lea ecx, [esp + 0x5c]
cmove ebx, esi
mov esi, dword [esp + 0x60]
mov edx, dword [edi]
push eax
push 0xfffffffffffffff4
push dword [ebx]
call fcn.00438b70
add esp, 0xc
cmp dword [esp + 0x5c], 1
mov dword [esp + 0x80], esi
jne 0x43c046
mov eax, dword [esp + 0x60]
mov edi, dword [esp + 0x64]
mov dword [esp + 8], eax
jmp 0x43c239
mov eax, dword [esp + 0x98]
mov ebx, dword [esp + 0x60]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x5c]
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], esi
mov dword [esp + 0xf0], ebx
push dword [esp + 8]
call fcn.004328c0
add esp, 4
mov edi, dword [esp + 0x60]
cmp dword [esp + 0x5c], 1
mov eax, dword [esp + 0x64]
mov dword [esp + 0x94], eax
mov dword [esp + 8], edi
jne 0x43c0e3
mov edi, dword [esp + 0x94]
jmp 0x43c233
lea ecx, [esp + 0x110]
call fcn.00437270
cmp ebx, dword [esp + 0x44]
jne 0x43c0c5
lea ecx, [esp + 0x40]
mov edx, ebx
call fcn.004329e0
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x48]
mov word [edi + ebx*2], 0
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov dword [esp + 0xa4], eax
mov dword [esp + 0xc], eax
jmp 0x43b765
mov esi, dword [esp + 0x34]
lea eax, [esp + 0x40]
lea ecx, [esp + 0xb0]
push eax
push ecx
push dword [esp + 0xb0]
push dword [esp + 0x18]
push dword [esp + 0xbc]
push 1
push 0
push 0
push esi
push dword [esp + 0x84]
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
je 0x43c212
push dword [esp + 0x44]
call sub.KERNEL32.DLL_CloseHandle
mov edx, dword [esp + 0x110]
mov ecx, dword [esp + 0x114]
mov eax, dword [esp + 0x40]
mov edi, ebx
mov dword [esp + 0x18], esi
mov ebx, dword [esp + 0x118]
mov esi, dword [esp + 0x120]
mov dword [esp + 0x20], edx
mov dword [esp + 0xc], ecx
mov edx, dword [esp + 0x11c]
mov ecx, dword [esp + 0x124]
mov dword [esp + 0x84], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x94]
call fcn.004329c0
push edi
call sub.KERNEL32.DLL_CloseHandle
push dword [esp + 0x80]
call sub.KERNEL32.DLL_CloseHandle
push dword [esp + 0x98]
call sub.KERNEL32.DLL_CloseHandle
push 0x45b0d8
call sub.KERNEL32.DLL_ReleaseSRWLockExclusive
mov ecx, dword [esp + 0x9c]
mov edx, dword [esp + 0x90]
call fcn.004329c0
mov ecx, dword [esp + 0xa4]
mov edx, dword [esp + 0x54]
call fcn.004329c0
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x18]
call fcn.004329c0
cmp dword [esp + 0x58], 0
je 0x43c1f2
mov ecx, dword [esp + 0x1c]
mov edx, 1
call fcn.004076c0
cmp dword [esp + 0x100], 3
jne 0x43c316
mov eax, dword [esp + 0x84]
xor edi, edi
mov dword [esp + 8], eax
jmp 0x43b6ad
call sub.KERNEL32.DLL_GetLastError
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x94]
mov esi, eax
call fcn.004329c0
mov dword [esp + 8], 0
mov edi, esi
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov esi, dword [esp + 0x54]
mov ebx, dword [esp + 0x90]
push dword [esp + 0x80]
call sub.KERNEL32.DLL_CloseHandle
push dword [esp + 0x98]
call sub.KERNEL32.DLL_CloseHandle
cmp dword [esp + 0x110], 0
je 0x43c272
push dword [esp + 0x114]
call sub.KERNEL32.DLL_CloseHandle
cmp dword [esp + 0x118], 0
je 0x43c288
push dword [esp + 0x11c]
call sub.KERNEL32.DLL_CloseHandle
cmp dword [esp + 0x120], 0
je 0x43c29e
push dword [esp + 0x124]
call sub.KERNEL32.DLL_CloseHandle
push 0x45b0d8
call sub.KERNEL32.DLL_ReleaseSRWLockExclusive
test ebx, 0x7fffffff
je 0x43c2c1
mov ecx, dword [esp + 0x9c]
mov edx, 2
call fcn.004076c0
test esi, 0x7fffffff
je 0x43c2da
mov ecx, dword [esp + 0xa4]
mov edx, 2
call fcn.004076c0
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x38]
mov bl, 1
mov dword [esp + 0x20], edi
test eax, eax
je 0x43b628
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x43b628
and eax, 0x7fffffff
je 0x43b628
mov edx, 2
call fcn.004076c0
jmp 0x43b628
mov eax, dword [esp + 0x84]
mov dword [esp + 8], eax
cmp dword [esp + 0x20], 0
je 0x43c331
push dword [esp + 0xc]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [0x452bc8]
test ebx, ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x48], 0
je 0x43c664
test esi, esi
je 0x43c8d6
push 0
push 1
push 1
push 0
call sub.KERNEL32.DLL_CreateEventW
test eax, eax
je 0x43ceee
mov ecx, 0x14
mov edx, 4
mov esi, eax
call fcn.00407660
test eax, eax
je 0x43cec9
mov ecx, dword [esp + 0x10]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 0x10], esi
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xb8], eax
lea eax, [esp + 0x34]
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], 0
push 0
push 1
push 1
push 0
call sub.KERNEL32.DLL_CreateEventW
test eax, eax
je 0x43cb74
mov ecx, 0x14
mov edx, 4
mov edi, eax
call fcn.00407660
test eax, eax
je 0x43cec9
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 0x10], edi
mov dword [esp + 0x88], esi
mov dword [esp + 0x114], edi
mov dword [esp + 0x8c], edi
lea ebx, [esp + 0x88]
lea esi, [esp + 0x5c]
lea edi, [esp + 0x110]
mov dword [esp + 0x110], ecx
lea ecx, [esp + 0x40]
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], ecx
mov dword [esp + 0x120], 0
nop word cs:[eax + eax]
nop
push 0xffffffffffffffff
push 0
push ebx
push 2
call sub.KERNEL32.DLL_WaitForMultipleObjects
cmp eax, 1
je 0x43c500
test eax, eax
jne 0x43cca7
mov eax, dword [esp + 0xc0]
test eax, eax
je 0x43c5bd
cmp eax, 1
jne 0x43c552
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0xf4], 0
push 1
lea edx, [esp + 0xf8]
push edx
push ecx
push eax
call sub.KERNEL32.DLL_GetOverlappedResult
test eax, eax
je 0x43c567
mov eax, dword [esp + 0xf4]
jmp 0x43c5a0
mov eax, dword [esp + 0x120]
test eax, eax
je 0x43c639
cmp eax, 1
jne 0x43c55b
mov eax, dword [esp + 0x110]
mov ecx, dword [esp + 0x118]
mov dword [esp + 0xf4], 0
push 1
lea edx, [esp + 0xf8]
push edx
push ecx
push eax
call sub.KERNEL32.DLL_GetOverlappedResult
test eax, eax
je 0x43c5e6
mov eax, dword [esp + 0xf4]
jmp 0x43c620
mov eax, dword [esp + 0xc4]
jmp 0x43c5a0
mov eax, dword [esp + 0x124]
jmp 0x43c620
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], 0
je 0x43c588
mov edi, eax
cmp eax, 0x26
jne 0x43cce4
push esi
call fcn.00419780
add esp, 4
xor eax, eax
lea edi, [esp + 0x110]
nop word [eax + eax]
mov dword [esp + 0xc0], 0
mov ecx, dword [esp + 0xbc]
add dword [ecx + 8], eax
test eax, eax
je 0x43cba0
mov ecx, esi
lea edx, [esp + 0xb0]
call fcn.0043d0c0
cmp byte [esp + 0x5c], 1
je 0x43cb94
cmp byte [esp + 0x5d], 1
je 0x43c490
jmp 0x43cba0
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], 0
je 0x43c607
mov edi, eax
cmp eax, 0x26
jne 0x43cce4
push esi
call fcn.00419780
add esp, 4
xor eax, eax
lea edi, [esp + 0x110]
nop dword [eax]
mov dword [esp + 0x120], 0
mov ecx, dword [esp + 0x11c]
add dword [ecx + 8], eax
test eax, eax
je 0x43c658
mov ecx, esi
mov edx, edi
call fcn.0043d0c0
cmp byte [esp + 0x5c], 1
je 0x43cb94
cmp byte [esp + 0x5d], 1
je 0x43c490
lea ecx, [esp + 0xb0]
jmp 0x43cba7
test esi, esi
je 0x43cbde
xor ebx, ebx
xor edi, edi
mov dword [esp + 0x18], 0
nop dword [eax + eax]
cmp edi, ebx
je 0x43c75f
mov esi, dword [esp + 0x40]
mov dword [esp + 0x20], ebx
sub ebx, edi
mov dword [esp + 0xc], edi
mov eax, ebx
add esi, edi
mov edi, dword [esp + 0x18]
sub eax, edi
jbe 0x43c6c0
mov edi, ebx
je 0x43c6c6
mov ecx, dword [esp + 0x18]
add ecx, esi
push eax
push 0
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, ebx
jmp 0x43c6c6
jb 0x43ce05
mov dword [esp + 0xb0], 0
push 0
lea eax, [esp + 0xb4]
push eax
push ebx
push esi
push dword [esp + 0x24]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x43c77c
call sub.KERNEL32.DLL_GetLastError
mov ecx, eax
mov ebx, eax
mov dword [esp + 0x118], eax
mov dword [esp + 0x114], 0
mov dword [esp + 0x110], 1
call fcn.00419e40
cmp al, 0xb
je 0x43cb42
mov ecx, ebx
call fcn.00419e40
cmp al, 0x23
jne 0x43cdae
lea eax, [esp + 0x110]
mov dword [esp + 0x114], ebx
mov dword [esp + 0x110], 0
push eax
call fcn.00419780
add esp, 4
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0xc]
jmp 0x43c680
lea ecx, [esp + 0x40]
mov edx, ebx
push 0x20
call fcn.0041c980
add esp, 4
mov ebx, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
jmp 0x43c688
mov eax, dword [esp + 0xb0]
mov ecx, edi
sub ecx, eax
jb 0x43ceda
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0xc]
test eax, eax
je 0x43cccf
add edi, eax
mov eax, ebx
mov dword [esp + 0x18], ecx
or eax, edi
mov dword [esp + 0x48], edi
mov eax, ecx
jne 0x43c680
pxor xmm0, xmm0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x88], 0
movdqa xmmword [esp + 0x120], xmm0
movdqa xmmword [esp + 0x110], xmm0
push 0
lea edi, [esp + 0x8c]
push edi
push 0x20
lea eax, [esp + 0x11c]
push eax
push dword [esp + 0x24]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
lea esi, [esp + 0x60]
jne 0x43c87a
call sub.KERNEL32.DLL_GetLastError
mov ecx, eax
mov ebx, eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb0], 1
call fcn.00419e40
cmp al, 0xb
je 0x43ccbf
cmp al, 0x23
mov dword [esp + 0x64], ebx
mov dword [esp + 0x60], 0
mov dword [esp + 0x5c], 1
jne 0x43cdae
push esi
call fcn.00419780
add esp, 4
mov dword [esp + 0x88], 0
push 0
push edi
push 0x20
lea eax, [esp + 0x11c]
push eax
push dword [esp + 0x24]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x43c7fd
mov ebx, dword [esp + 0x88]
test ebx, ebx
je 0x43cccf
cmp ebx, 0x21
jae 0x43ce4c
lea ecx, [esp + 0x40]
xor edx, edx
push ebx
call fcn.0041c980
add esp, 4
mov edi, dword [esp + 0x48]
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
add eax, edi
push ebx
lea ecx, [esp + 0x114]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x20]
add edi, ebx
mov ebx, esi
mov dword [esp + 0x48], edi
mov dword [esp + 0x18], eax
jmp 0x43c680
xor ebx, ebx
xor edi, edi
mov dword [esp + 0x18], 0
nop word cs:[eax + eax]
nop dword [eax]
cmp edi, ebx
je 0x43c9cf
mov esi, dword [esp + 0x34]
mov dword [esp + 0x20], ebx
sub ebx, edi
mov dword [esp + 0xc], edi
mov eax, ebx
add esi, edi
mov edi, dword [esp + 0x18]
sub eax, edi
jbe 0x43c930
mov edi, ebx
je 0x43c936
mov ecx, dword [esp + 0x18]
add ecx, esi
push eax
push 0
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, ebx
jmp 0x43c936
jb 0x43ce05
mov dword [esp + 0xb0], 0
push 0
lea eax, [esp + 0xb4]
push eax
push ebx
push esi
push dword [esp + 0x20]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x43c9ec
call sub.KERNEL32.DLL_GetLastError
mov ecx, eax
mov ebx, eax
mov dword [esp + 0x118], eax
mov dword [esp + 0x114], 0
mov dword [esp + 0x110], 1
call fcn.00419e40
cmp al, 0xb
je 0x43cb58
mov ecx, ebx
call fcn.00419e40
cmp al, 0x23
jne 0x43cdcf
lea eax, [esp + 0x110]
mov dword [esp + 0x114], ebx
mov dword [esp + 0x110], 0
push eax
call fcn.00419780
add esp, 4
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0xc]
jmp 0x43c8f0
lea ecx, [esp + 0x34]
mov edx, ebx
push 0x20
call fcn.0041c980
add esp, 4
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
jmp 0x43c8f8
mov eax, dword [esp + 0xb0]
mov ecx, edi
sub ecx, eax
jb 0x43ceda
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0xc]
test eax, eax
je 0x43cb68
add edi, eax
mov eax, ebx
mov dword [esp + 0x18], ecx
or eax, edi
mov dword [esp + 0x3c], edi
mov eax, ecx
jne 0x43c8f0
pxor xmm0, xmm0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x88], 0
movdqa xmmword [esp + 0x120], xmm0
movdqa xmmword [esp + 0x110], xmm0
push 0
lea edi, [esp + 0x8c]
push edi
push 0x20
lea eax, [esp + 0x11c]
push eax
push dword [esp + 0x20]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
lea esi, [esp + 0x60]
jne 0x43caea
call sub.KERNEL32.DLL_GetLastError
mov ecx, eax
mov ebx, eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb0], 1
call fcn.00419e40
cmp al, 0xb
je 0x43ccd8
cmp al, 0x23
mov dword [esp + 0x64], ebx
mov dword [esp + 0x60], 0
mov dword [esp + 0x5c], 1
jne 0x43cdcf
push esi
call fcn.00419780
add esp, 4
mov dword [esp + 0x88], 0
push 0
push edi
push 0x20
lea eax, [esp + 0x11c]
push eax
push dword [esp + 0x20]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x43ca6d
mov ebx, dword [esp + 0x88]
test ebx, ebx
je 0x43cb68
cmp ebx, 0x21
jae 0x43ce4c
lea ecx, [esp + 0x34]
xor edx, edx
push ebx
call fcn.0041c980
add esp, 4
mov edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x38]
add eax, edi
push ebx
lea ecx, [esp + 0x114]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x20]
add edi, ebx
mov ebx, esi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x18], eax
jmp 0x43c8f0
lea eax, [esp + 0x114]
push eax
call fcn.00419780
add esp, 4
mov eax, dword [esp + 0x14]
jmp 0x43cb6c
lea eax, [esp + 0x114]
push eax
call fcn.00419780
add esp, 4
mov eax, dword [esp + 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle
jmp 0x43cbde
call sub.KERNEL32.DLL_GetLastError
mov edi, eax
push dword [esp + 0x14]
call sub.KERNEL32.DLL_CloseHandle
mov eax, edi
shl edi, 0x18
xor ebx, ebx
shr eax, 8
mov dword [esp + 0x20], eax
jmp 0x43cbc9
mov edi, dword [esp + 0x64]
mov eax, dword [esp + 0x60]
mov ecx, edi
jmp 0x43cbb0
lea ecx, [esp + 0x110]
call fcn.0043d1f0
mov edi, edx
mov ecx, edx
shr ecx, 8
mov ebx, eax
shld edi, eax, 0x18
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x110]
call fcn.0043cf80
lea ecx, [esp + 0xb0]
call fcn.0043cf80
cmp bl, 4
jne 0x43cf15
push 0xffffffffffffffff
mov esi, dword [esp + 0xc]
push esi
call sub.KERNEL32.DLL_WaitForSingleObject
test eax, eax
je 0x43cc3e
call sub.KERNEL32.DLL_GetLastError
mov ecx, dword [esp + 0xfc]
cmp dword [esp + 0x44], 0
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0
mov dword [ecx], 1
je 0x43cc23
mov ecx, dword [esp + 0x40]
test ecx, ecx
je 0x43cc23
mov edx, 1
call fcn.004076c0
cmp dword [esp + 0x38], 0
je 0x43cc96
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x43cc96
mov edx, 1
call fcn.004076c0
jmp 0x43cc96
lea eax, [esp + 0x110]
mov dword [esp + 0x110], 0
push eax
push esi
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
je 0x43cbee
mov edx, dword [esp + 0xfc]
movsd xmm0, qword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x110]
mov esi, dword [esp + 0x48]
movsd qword [edx + 8], xmm0
movq xmm0, qword [esp + 0x40]
mov dword [edx + 0x10], ecx
mov dword [edx + 0x1c], esi
movq qword [edx + 0x14], xmm0
mov dword [edx + 4], eax
mov dword [edx], 0
push dword [esp + 8]
call sub.KERNEL32.DLL_CloseHandle
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.KERNEL32.DLL_GetLastError
mov edi, eax
shr eax, 8
shl edi, 0x18
xor ebx, ebx
mov dword [esp + 0x20], eax
jmp 0x43cbbd
lea eax, [esp + 0xb4]
push eax
call fcn.00419780
add esp, 4
mov eax, dword [esp + 0x14]
jmp 0x43cb6c
lea eax, [esp + 0xb4]
jmp 0x43cb5f
mov eax, edi
jmp 0x43ccae
mov ecx, 0x452ff0
mov edx, 0x2b
push 0x4500a4
call fcn.00408b30
add esp, 4
ud2
call fcn.00407a90
ud2
mov ecx, edi
mov edx, ebx
call fcn.00407ab0
ud2
call sub.KERNEL32.DLL_GetLastError
lea edx, [esp + 0x5c]
lea ecx, [esp + 0x40]
mov dword [esp + 0x110], 0x451c08
mov dword [esp + 0x114], 1
mov dword [esp + 0x118], 0
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x40], edx
mov dword [esp + 0x120], ecx
lea ecx, [esp + 0x110]
mov edx, 0x451c38
mov dword [esp + 0x44], 0x4335a0
mov dword [esp + 0x124], 1
call fcn.00408480
ud2
mov ecx, 0x452ff0
mov edx, 0x2b
push 0x45007c
jmp 0x43ccf7
mov ecx, ebx
mov edx, 1
call fcn.00407ab0
ud2
mov ecx, 1
xor edx, edx
push 0x451ab4
jmp 0x43ce24
xor eax, eax
mov ecx, 0x452c3c
mov edx, 0x2b
mov dword [esp + 0x114], ebx
mov dword [esp + 0x110], eax
push 0x450b8c
jmp 0x43cdee
xor eax, eax
mov ecx, 0x452c3c
mov edx, 0x2b
mov dword [esp + 0x114], ebx
mov dword [esp + 0x110], eax
push 0x450b7c
push 0x450fd8
lea eax, [esp + 0x118]
push eax
call fcn.004092f0
add esp, 0xc
ud2
mov ecx, dword [esp + 0x18]
mov edx, ebx
push 0x4508ac
jmp 0x43ce58
mov ecx, eax
mov edx, edi
push 0x451ac4
jmp 0x43ce58
mov edx, edi
push 0x451ad4
call fcn.00408760
add esp, 4
ud2
mov ecx, 0x45012f
mov edx, 0x21
push 0x450150
jmp 0x43ccf7
mov ecx, 4
jmp 0x43cd94
mov ecx, ebx
mov edx, 0x20
push 0x45094c
call fcn.004087c0
add esp, 4
ud2
call sub.KERNEL32.DLL_GetLastError
lea edx, [esp + 0xb0]
lea ecx, [esp + 0x5c]
mov dword [esp + 0x110], 0x451b08
mov dword [esp + 0x114], 1
mov dword [esp + 0x118], 0
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb0], 0
mov dword [esp + 0x5c], edx
mov dword [esp + 0x120], ecx
lea ecx, [esp + 0x110]
mov edx, 0x451b10
mov dword [esp + 0x60], 0x4335a0
jmp 0x43cd6c
mov ecx, 0x14
mov edx, 4
call fcn.00407ab0
ud2
mov ecx, 0x4508cc
mov edx, 0x27
push 0x4508f4
jmp 0x43ccf7
call sub.KERNEL32.DLL_GetLastError
mov edi, eax
push dword [esp + 0x10]
call sub.KERNEL32.DLL_CloseHandle
push dword [esp + 0x14]
call sub.KERNEL32.DLL_CloseHandle
mov eax, edi
shl edi, 0x18
xor ebx, ebx
shr eax, 8
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov byte [esp + 0x110], bl
mov ecx, 0x452c3c
mov edx, 0x2b
mov dword [esp + 0x111], edi
mov word [esp + 0x115], ax
shr eax, 0x10
mov byte [esp + 0x117], al
lea eax, [esp + 0x110]
push 0x450b6c
push 0x450fd8
jmp 0x43cdfa
mov ecx, ebx
mov edx, esi
push 0x451e54
jmp 0x43ce58
mov edx, edi
push 0x4516e4
jmp 0x43ce24