Function at 0x447cd8
Capabilities:
Accept command line arguments
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x70
push 0
push 0
dec ecx
jne 0x447ce0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x448ca4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x150], 0
jne 0x447d33
mov dl, 1
mov eax, dword [0x42ffec]
call fcn.00437fa0
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x10]
add eax, 0x150
mov edx, ebx
test edx, edx
je 0x447d2e
sub edx, 0xffffffc0
call fcn.0040682c
mov eax, esi
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x150]
call fcn.0040682c
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x174], 0
je 0x448c2c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x150]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x448c2c
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x150]
call fcn.0040682c
lea eax, [ebp - 0x294]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x150]
mov ecx, 0x448cb4
call fcn.00406858
mov eax, dword [ebp - 0x294]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x447ef5
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x29c]
push eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0x1d4]
mov cl, 0x30
mov edx, 4
call fcn.0040a44c
push dword [ebp - 0x29c]
push 0x448ccc
lea eax, [ebp - 0x2a0]
push eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0x1d6]
mov cl, 0x30
mov edx, 2
call fcn.0040a44c
push dword [ebp - 0x2a0]
push 0x448ccc
lea eax, [ebp - 0x2a4]
push eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0x1da]
mov cl, 0x30
mov edx, 2
call fcn.0040a44c
push dword [ebp - 0x2a4]
push 0x448cd8
lea eax, [ebp - 0x2a8]
push eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0x1dc]
mov cl, 0x30
mov edx, 2
call fcn.0040a44c
push dword [ebp - 0x2a8]
push 0x448ce4
lea eax, [ebp - 0x2ac]
push eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0x1de]
mov cl, 0x30
mov edx, 2
call fcn.0040a44c
push dword [ebp - 0x2ac]
push 0x448ce4
lea eax, [ebp - 0x2b0]
push eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0x1e0]
mov cl, 0x30
mov edx, 2
call fcn.0040a44c
push dword [ebp - 0x2b0]
push 0x448cd8
lea eax, [ebp - 0x2b4]
push eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0x1e2]
mov cl, 0x30
mov edx, 1
call fcn.0040a44c
push dword [ebp - 0x2b4]
push 0x448cf0
lea eax, [ebp - 0x298]
mov edx, 0xe
call fcn.00404e9c
mov edx, dword [ebp - 0x298]
mov eax, 0x448cfc
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x447eff
xor eax, eax
push ebp
push 0x447f34
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x2b8]
call fcn.0042b9e0
mov edx, dword [ebp - 0x2b8]
mov eax, 0x448d10
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x447f3e
xor eax, eax
push ebp
push 0x447f73
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x2bc]
call fcn.00446a40
mov edx, dword [ebp - 0x2bc]
mov eax, 0x448d28
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x447f7d
xor eax, eax
push ebp
push 0x447fe4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x1c], 0x104
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x13d]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x13d]
mov ecx, 0x105
call fcn.00404d8c
call fcn.004469a0
test al, al
je 0x447fcb
lea eax, [ebp - 0x14]
mov edx, 0x448d40
call fcn.00404de4
push ebp
mov edx, dword [ebp - 0x14]
mov eax, 0x448d54
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x447fee
xor eax, eax
push ebp
push 0x4480d3
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x448017
lea eax, [ebp - 0x14]
mov edx, 0x448d68
call fcn.00404bb4
jmp 0x44801f
lea eax, [ebp - 0x14]
call fcn.00404b1c
lea eax, [ebp - 0x18]
push eax
push 0x448d74
push dword [ebp - 0x14]
push 0x448d98
lea eax, [ebp - 0x2c0]
mov edx, 3
call fcn.00404e9c
mov edx, dword [ebp - 0x2c0]
mov ecx, 0x448db0
mov eax, 0x80000002
call fcn.0042ba14
lea eax, [ebp - 0x2c4]
push eax
push 0x448d74
push dword [ebp - 0x14]
push 0x448d98
lea eax, [ebp - 0x2c8]
mov edx, 3
call fcn.00404e9c
mov edx, dword [ebp - 0x2c8]
mov ecx, 0x448dd0
mov eax, 0x80000002
call fcn.0042ba14
mov edx, dword [ebp - 0x2c4]
lea eax, [ebp - 0x14]
call fcn.00404bb4
cmp dword [ebp - 0x18], 0
je 0x4480ba
push dword [ebp - 0x14]
push 0x448de8
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404e9c
push ebp
mov edx, dword [ebp - 0x14]
mov eax, 0x448df4
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4480dd
xor eax, eax
push ebp
push 0x448112
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x2cc]
call fcn.00446d6c
mov edx, dword [ebp - 0x2cc]
mov eax, 0x448e10
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44811c
xor eax, eax
push ebp
push 0x448151
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x2d0]
call fcn.00446e18
mov edx, dword [ebp - 0x2d0]
mov eax, 0x448e2c
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44815b
xor eax, eax
push ebp
push 0x448190
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x2d4]
call fcn.00446e60
mov edx, dword [ebp - 0x2d4]
mov eax, 0x448e44
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44819a
xor eax, eax
push ebp
push 0x4481cf
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x2d8]
call fcn.00446eb8
mov edx, dword [ebp - 0x2d8]
mov eax, 0x448e5c
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4481d9
xor eax, eax
push ebp
push 0x448264
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
call fcn.00446fb8
cmp dword [ebp - 0x14], 0
je 0x44825a
call fcn.00447058
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jne 0x448214
push ebp
mov edx, dword [ebp - 0x14]
mov eax, 0x448e74
call fcn.00447bf0
pop ecx
jmp 0x44825a
push ebp
lea eax, [ebp - 0x2e0]
push eax
mov cl, 0x30
mov edx, 1
mov eax, dword [ebp - 0x2c]
call fcn.0040a35c
push dword [ebp - 0x2e0]
push 0x448e88
push dword [ebp - 0x14]
lea eax, [ebp - 0x2dc]
mov edx, 3
call fcn.00404e9c
mov edx, dword [ebp - 0x2dc]
mov eax, 0x448e94
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44826e
xor eax, eax
push ebp
push 0x4482a3
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x2e4]
call fcn.00447144
mov edx, dword [ebp - 0x2e4]
mov eax, 0x448ea8
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4482ad
lea eax, [ebp - 0x304]
call fcn.0040b298
cmp byte [ebp - 0x2f4], 0
je 0x448300
xor eax, eax
push ebp
push 0x4482f6
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x308]
call fcn.0044729c
mov edx, dword [ebp - 0x308]
mov eax, 0x448ec0
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x448300
xor eax, eax
push ebp
push 0x4483e5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x448ed4
push 0x448ee8
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x13d]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.0042b338
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
call fcn.004098bc
mov ebx, eax
mov al, byte [ebp - 0x13d]
call fcn.004098bc
cmp bl, al
je 0x4483b6
push ebp
push ebp
lea edx, [ebp - 0x310]
mov al, byte [ebp - 0x13d]
call fcn.00447a94
pop ecx
push dword [ebp - 0x310]
push 0x448f00
push ebp
lea edx, [ebp - 0x314]
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
call fcn.00447a94
pop ecx
push dword [ebp - 0x314]
lea eax, [ebp - 0x30c]
mov edx, 3
call fcn.00404e9c
mov edx, dword [ebp - 0x30c]
mov eax, 0x448f0c
call fcn.00447bf0
pop ecx
jmp 0x4483db
push ebp
push ebp
lea edx, [ebp - 0x318]
mov al, byte [ebp - 0x13d]
call fcn.00447a94
pop ecx
mov edx, dword [ebp - 0x318]
mov eax, 0x448f0c
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4483ef
xor eax, eax
push ebp
push 0x448424
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x31c]
call fcn.00447350
mov edx, dword [ebp - 0x31c]
mov eax, 0x448f24
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44842e
xor eax, eax
push ebp
push 0x448470
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x320]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040a4dc
mov edx, dword [ebp - 0x320]
mov eax, 0x448f3c
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44847a
xor eax, eax
push ebp
push 0x4484af
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x324]
call fcn.00447514
mov edx, dword [ebp - 0x324]
mov eax, 0x448f50
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4484b9
xor eax, eax
push ebp
push 0x448507
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4e9c7c], 0
je 0x4484fd
call fcn.00402ec8
test eax, eax
jle 0x4484fd
push ebp
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 0x328]
call fcn.00404d14
mov edx, dword [ebp - 0x328]
mov eax, 0x448f6c
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x448511
xor eax, eax
push ebp
push 0x448559
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea edx, [ebp - 0x330]
xor eax, eax
call fcn.0042b338
mov eax, dword [ebp - 0x330]
lea edx, [ebp - 0x32c]
call fcn.0042b368
mov edx, dword [ebp - 0x32c]
mov eax, 0x448f84
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x448563
xor eax, eax
push ebp
push 0x4485bd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.kernel32.dll_GetModuleHandleA_2
cmp eax, dword [0x4ed668]
je 0x4485b3
push ebp
lea edx, [ebp - 0x338]
mov eax, dword [0x4ed668]
call fcn.0042b338
mov eax, dword [ebp - 0x338]
lea edx, [ebp - 0x334]
call fcn.0042b368
mov edx, dword [ebp - 0x334]
mov eax, 0x448f98
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4485c7
xor eax, eax
push ebp
push 0x44880a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4e9cfc], 0
je 0x4485ea
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.0042b338
jmp 0x4485f7
lea edx, [ebp - 0x14]
mov eax, dword [0x4ed668]
call fcn.0042b338
lea eax, [ebp - 0x280]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404fdc
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x448800
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
push ebp
push 0x448780
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x26c]
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x26c]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
cmp byte [0x4e9cfc], 0
jne 0x448669
push 0
call sub.kernel32.dll_GetModuleHandleA_2
cmp eax, dword [0x4ed668]
jne 0x448678
lea eax, [ebp - 0x18]
mov edx, 0x448fb0
call fcn.00404bb4
jmp 0x448685
lea eax, [ebp - 0x18]
mov edx, 0x448fc0
call fcn.00404bb4
push ebp
lea eax, [ebp - 0x340]
push eax
movzx eax, word [ebp - 0x290]
mov cl, 0x30
mov edx, 4
call fcn.0040a44c
push dword [ebp - 0x340]
push 0x448ccc
lea eax, [ebp - 0x344]
push eax
movzx eax, word [ebp - 0x28e]
mov cl, 0x30
mov edx, 2
call fcn.0040a44c
push dword [ebp - 0x344]
push 0x448ccc
lea eax, [ebp - 0x348]
push eax
movzx eax, word [ebp - 0x28a]
mov cl, 0x30
mov edx, 2
call fcn.0040a44c
push dword [ebp - 0x348]
push 0x448f00
lea eax, [ebp - 0x34c]
push eax
movzx eax, word [ebp - 0x288]
mov cl, 0x30
mov edx, 2
call fcn.0040a44c
push dword [ebp - 0x34c]
push 0x448ce4
lea eax, [ebp - 0x350]
push eax
movzx eax, word [ebp - 0x286]
mov cl, 0x30
mov edx, 2
call fcn.0040a44c
push dword [ebp - 0x350]
push 0x448fd0
lea eax, [ebp - 0x33c]
mov edx, 0xa
call fcn.00404e9c
mov eax, dword [ebp - 0x33c]
push eax
lea eax, [ebp - 0x354]
mov ecx, 0x448fdc
mov edx, dword [ebp - 0x18]
call fcn.00404e28
mov eax, dword [ebp - 0x354]
pop edx
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44878a
lea edx, [ebp - 0x358]
mov eax, dword [ebp - 0x10]
call fcn.00433e78
cmp dword [ebp - 0x358], 0
jne 0x4487e0
mov eax, dword [ebp - 0x14]
call fcn.0040b7a4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0
jne 0x4487b9
cmp dword [ebp - 0x28], 0
je 0x448800
push ebp
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x35c]
call fcn.0040b890
mov edx, dword [ebp - 0x35c]
mov eax, 0x448ff0
call fcn.00447bf0
pop ecx
jmp 0x448800
push ebp
lea edx, [ebp - 0x360]
mov eax, dword [ebp - 0x10]
call fcn.00433e78
mov edx, dword [ebp - 0x360]
mov eax, 0x448ff0
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x448814
xor eax, eax
push ebp
push 0x4488a8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x448ff8
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
test ebx, ebx
je 0x44889e
push 0x104
lea eax, [ebp - 0x13d]
push eax
push ebx
call sub.kernel32.dll_GetModuleFileNameA_1
test eax, eax
jbe 0x44889e
lea eax, [ebp - 0x364]
lea edx, [ebp - 0x13d]
mov ecx, 0x105
call fcn.00404d8c
mov eax, dword [ebp - 0x364]
call fcn.0040b7a4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0
jne 0x448879
cmp dword [ebp - 0x28], 0
je 0x44889e
push ebp
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x368]
call fcn.0040b890
mov edx, dword [ebp - 0x368]
mov eax, 0x44900c
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4488b2
xor eax, eax
push ebp
push 0x4488ec
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov edx, 0x449020
mov eax, 0x449034
call fcn.00447bf0
pop ecx
push ebp
mov edx, 0x44904c
mov eax, 0x44905c
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4488f6
lea ecx, [ebp - 0x18]
mov edx, 0x449078
mov eax, dword [ebp - 0x10]
call fcn.004368dc
mov dl, 0x7c
mov eax, dword [ebp - 0x18]
call fcn.0040a864
test eax, eax
jle 0x448a15
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], 1
xor eax, eax
push ebp
push 0x4489ff
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov cl, 0x7c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
call fcn.0040a8d8
mov eax, dword [0x4ee820]
call fcn.00405db4
mov ebx, eax
test ebx, ebx
jl 0x4489f5
inc ebx
mov dword [ebp - 0x30], 0
mov esi, dword [ebp - 0x30]
lea esi, [esi + esi*4]
mov eax, dword [0x4ee820]
mov eax, dword [eax + esi*4]
mov edx, dword [ebp - 0x14]
call fcn.004099e0
test al, al
je 0x4489eb
mov eax, dword [0x4ee820]
cmp byte [eax + esi*4 + 0x10], 0
jne 0x4489f5
mov eax, dword [0x4ee820]
cmp dword [eax + esi*4 + 8], 0
je 0x4489b7
push ebp
mov eax, dword [0x4ee820]
mov ebx, dword [eax + esi*4 + 8]
lea eax, [ebp - 0x36c]
call ebx
mov edx, dword [ebp - 0x36c]
mov eax, dword [0x4ee820]
mov eax, dword [eax + esi*4]
call fcn.00447bf0
pop ecx
jmp 0x4489f5
push ebp
mov eax, dword [0x4ee820]
mov ebx, dword [eax + esi*4 + 0xc]
lea edx, [ebp - 0x370]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4489d3
sub eax, 0xfffffe18
call ebx
mov edx, dword [ebp - 0x370]
mov eax, dword [0x4ee820]
mov eax, dword [eax + esi*4]
call fcn.00447bf0
pop ecx
jmp 0x4489f5
inc dword [ebp - 0x30]
dec ebx
jne 0x44895d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x448a09
inc dword [ebp - 0x2c]
dec dword [ebp - 0x38]
jne 0x448922
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x448a45
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov edx, 0x449088
mov eax, 0x4490a8
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x448a4f
xor eax, eax
push ebp
push 0x448aa5
push dword fs:[eax]
mov dword fs:[eax], esp
add dword [0x4ea518], 1
adc dword [0x4ea51c], 0
push ebp
push dword [0x4ea51c]
push dword [0x4ea518]
lea ecx, [ebp - 0x374]
mov dl, 0x30
mov eax, 1
call fcn.0040a498
mov edx, dword [ebp - 0x374]
mov eax, 0x4490c0
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x448aaf
xor eax, eax
push ebp
push 0x448b93
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x4f], 1
je 0x448b69
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00447904
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.00447898
push ebp
mov edx, dword [ebp - 0x18]
mov eax, 0x4490dc
call fcn.00447bf0
pop ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
call fcn.00404f28
je 0x448b89
lea edx, [ebp - 0x378]
mov eax, dword [ebp - 0x14]
call fcn.0042d468
mov edx, dword [ebp - 0x378]
lea eax, [ebp - 0x14]
call fcn.00404bb4
push 0
lea eax, [ebp - 0x14]
mov ecx, 0x448f00
mov edx, 0x4490f4
call fcn.00409768
push 0
lea eax, [ebp - 0x14]
mov ecx, 0x448f00
mov edx, 0x449100
call fcn.00409768
push 1
lea eax, [ebp - 0x14]
mov ecx, 0x448f00
mov edx, 0x44910c
call fcn.00409768
push ebp
mov edx, dword [ebp - 0x14]
mov eax, 0x449118
call fcn.00447bf0
pop ecx
jmp 0x448b89
push ebp
lea edx, [ebp - 0x37c]
mov eax, dword [ebp - 0x10]
call fcn.00433ee4
mov edx, dword [ebp - 0x37c]
mov eax, 0x449118
call fcn.00447bf0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x448b9d
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
call dword [edx + 0xc]
xor eax, eax
push ebp
push 0x448c1a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x448be9
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [eax + edx*8 + 4]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x2c]
mov edx, dword [eax + edx*8]
mov eax, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x28]
inc dword [ebp - 0x2c]
dec dword [ebp - 0x38]
jne 0x448bc6
lea eax, [ebp - 0x380]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x150]
mov ecx, 0x448cb4
call fcn.00406858
mov eax, dword [ebp - 0x380]
mov edx, dword [ebp - 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x448c24
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
call dword [edx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448cab
lea eax, [ebp - 0x380]
call fcn.00406814
lea eax, [ebp - 0x37c]
mov edx, 0x1e
call fcn.00404b40
lea eax, [ebp - 0x304]
mov edx, dword [0x40b1a8]
call fcn.00405660
lea eax, [ebp - 0x2e4]
mov edx, 0x14
call fcn.00404b40
lea eax, [ebp - 0x294]
call fcn.00406814
lea eax, [ebp - 0x34]
call fcn.00406814
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404b40
lea eax, [ebp - 8]
mov edx, dword [0x447a70]
call fcn.004060b4
ret