Function at 0x490b40
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Encode data using base64
Get common file path
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x50c
call 0x490b4f
pop eax
mov esi, dword [edx + 0x50]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x520]
test esi, esi
mov dword [esp + 0xfc], eax
movzx eax, byte [edx + 0x54]
setne cl
or cl, al
cmp cl, 1
mov byte [esp + 0x32], cl
jne 0x490d69
test al, al
mov dword [esp + 0xdc], 0
mov dword [esp + 0xe4], 0
jne 0x490d93
mov dword [esp + 4], esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
test eax, eax
je 0x493ebf
cmp word [eax], 0
mov dword [esp], eax
je 0x490d82
mov esi, dword [esp]
jmp 0x490bdc
cmp word [ebx], 0
mov esi, ebx
je 0x490d82
xor ecx, ecx
mov edx, 0xfffffffe
nop word cs:[eax + eax]
nop dword [eax]
mov ebp, ecx
mov eax, edx
inc ecx
add edx, 2
cmp word [esi + ebp*2], 0
jne 0x490bf0
lea ecx, [ebp + ebp]
cmp ebp, 1
lea ebx, [esi + ecx + 2]
je 0x490bd0
test ebp, ebp
je 0x493764
xor edi, edi
nop word cs:[eax + eax]
cmp word [esi + edi*2 + 2], 0x3d
je 0x490c30
inc edi
add eax, 0xfffffffe
jne 0x490c20
jmp 0x490bd0
cmp edi, ebp
jae 0x493764
lea eax, [edi + 1]
lea ecx, [esp + 0x80]
mov edx, esi
push eax
call fcn.0048a230
add esp, 4
add edi, 2
sub ebp, edi
jb 0x493764
lea edx, [esi + edi*2]
lea ecx, [esp + 0x11c]
push ebp
call fcn.0048a230
add esp, 4
movsd xmm0, qword [esp + 0x80]
movq xmm2, qword [esp + 0x88]
lea eax, [esp + 0x11c]
movsd qword [esp + 0x10c], xmm0
movq qword [esp + 0x114], xmm2
mov esi, dword [esp + 0x10c]
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
mov edi, dword [esp + 0x110]
mov eax, esi
movsd qword [esp + 0xc4], xmm0
movsd qword [esp + 0xcc], xmm1
neg eax
jo 0x490d82
movd eax, xmm2
lea ebp, [esp + 0x80]
lea ecx, [esp + 0x11c]
mov dword [esp + 0x80], edi
movdqu xmmword [esp + 0x4c], xmm2
add eax, edi
mov edx, ebp
mov dword [esp + 0x84], eax
mov word [esp + 0x88], 0
call fcn.00493f60
movups xmm0, xmmword [esp + 0x4c]
lea eax, [esp + 0xc4]
mov dword [esp + 0x10c], esi
mov dword [esp + 0x110], edi
mov ecx, ebp
lea edx, [esp + 0xdc]
movlps qword [esp + 0x114], xmm0
push eax
lea eax, [esp + 0x110]
push eax
call fcn.00494100
add esp, 8
test dword [esp + 0x80], 0x7fffffff
je 0x490bd0
push dword [esp + 0x84]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x490bd0
xor ebp, ebp
mov dword [esp + 0xd4], esi
mov esi, dword [edx + 0x20]
test esi, esi
jne 0x4915a6
jmp 0x4915f7
push dword [esp]
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 4]
mov eax, dword [edx + 0x48]
test esi, esi
setne cl
test eax, eax
setne dl
test dl, cl
je 0x491423
mov ecx, dword [esp + 0x38]
xor edi, edi
mov edx, dword [ecx + 0x4c]
jmp 0x490dd6
push dword [esp + 0xc]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [esp + 4]
mov edx, dword [esp + 8]
xor eax, eax
dec esi
je 0x491423
test edi, edi
je 0x490df0
mov ecx, edx
movzx edx, word [edi + 0x1ea]
cmp ecx, edx
jae 0x490e20
mov ebp, edi
jmp 0x490e41
xor ecx, ecx
mov edi, eax
test edx, edx
je 0x490e09
nop dword [eax + eax]
mov edi, dword [edi + 0x1ec]
dec edx
jne 0x490e00
xor eax, eax
movzx edx, word [edi + 0x1ea]
cmp ecx, edx
jb 0x490de7
nop word cs:[eax + eax]
mov ebp, dword [edi + 0xb0]
test ebp, ebp
je 0x493764
movzx ecx, word [edi + 0x1e8]
inc eax
mov edi, ebp
cmp cx, word [ebp + 0x1ea]
jae 0x490e20
test eax, eax
mov dword [esp + 4], esi
je 0x490e70
mov edi, dword [ebp + ecx*4 + 0x1f0]
mov dword [esp + 8], 0
dec eax
je 0x490e79
nop dword [eax + eax]
mov edi, dword [edi + 0x1ec]
dec eax
jne 0x490e60
jmp 0x490e79
lea eax, [ecx + 1]
mov edi, ebp
mov dword [esp + 8], eax
lea eax, [ecx + ecx*8]
lea eax, [eax + eax*2]
add eax, ecx
shl ecx, 4
lea esi, [ebp + eax + 0xb4]
xor eax, eax
cmp eax, dword [ebp + ecx]
jno 0x490f60
mov eax, dword [esp + 0xdc]
test eax, eax
mov dword [esp + 0x18], eax
je 0x490dc5
mov edx, dword [esi + 0x18]
mov ecx, dword [esp + 0xe0]
mov eax, dword [esi + 0x14]
mov dword [esp], edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x4c], eax
mov dword [esp + 0xd8], ecx
mov dword [esp + 0xc], ecx
lea ecx, [edx + 0xb4]
mov dword [esp + 0x10], edx
movzx edx, word [edx + 0x1ea]
mov ebp, 0xffffffff
lea eax, [edx + edx*8]
mov dword [esp + 0x2c], edx
lea esi, [eax + eax*2]
add esi, edx
nop
test esi, esi
je 0x490f30
lea ebx, [ecx + 0x1c]
push 1
push dword [ecx + 0x18]
push dword [ecx + 0x14]
push dword [esp + 0xc]
push dword [esp + 0x5c]
call dword [sym.imp.kernel32.dll_CompareStringOrdinal]
inc ebp
add esi, 0xffffffe4
cmp eax, 3
mov ecx, ebx
je 0x490ef0
cmp eax, 1
jne 0x490fa0
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x490f40
jmp 0x490dc5
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x490dc5
mov edx, dword [esp + 0x10]
dec eax
mov dword [esp + 0xc], eax
mov edx, dword [edx + ebp*4 + 0x1ec]
jmp 0x490ecd
mov ebx, dword [esi + 8]
add ebp, ecx
test ebx, ebx
js 0x493764
mov ecx, dword [esi + 4]
je 0x4911cc
movzx eax, byte [0x6019e5]
mov dword [esp + 0x4c], ecx
xor ecx, ecx
mov edx, ebx
call fcn.00499510
mov ecx, dword [esp + 0x4c]
test eax, eax
jne 0x4911d1
jmp 0x493764
mov edx, dword [esp + 0xc]
cmp eax, 2
jne 0x493ebf
test edx, edx
mov byte [esp + 0x33], 0
je 0x491326
mov eax, dword [esp + 0x10]
mov eax, dword [eax + ebp*4 + 0x1ec]
dec edx
je 0x490fe1
nop dword [eax + eax]
movzx ecx, word [eax + 0x1ea]
mov eax, dword [eax + ecx*4 + 0x1ec]
dec edx
jne 0x490fd0
movzx ecx, word [eax + 0x1ea]
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], 0
lea eax, [esp + 0x33]
lea edx, [esp + 0xe8]
dec ecx
mov dword [esp + 0xf0], ecx
lea ecx, [esp + 0x10c]
push eax
call fcn.00495150
add esp, 4
mov eax, dword [esp + 0x124]
movsd xmm1, qword [esp + 0x114]
movsd xmm0, qword [esp + 0x11c]
movsd xmm3, qword [esp + 0x10c]
mov ecx, dword [esp + 0x140]
mov dword [esp + 0x74], eax
lea eax, [esp + 0x128]
movsd qword [esp + 0x64], xmm1
movsd qword [esp + 0x6c], xmm0
movsd qword [esp + 0x5c], xmm3
movq xmm2, qword [eax]
movsd xmm1, qword [eax + 8]
mov eax, dword [esp + 0x138]
movq qword [esp + 0x1c], xmm2
movsd qword [esp + 0x24], xmm1
movzx edx, word [eax + 0x1ea]
cmp ecx, edx
jb 0x4910a6
nop word [eax + eax]
movzx ecx, word [eax + 0x1e8]
mov eax, dword [eax + 0xb0]
cmp cx, word [eax + 0x1ea]
jae 0x491090
lea edx, [ecx + ecx*8]
lea edx, [edx + edx*2]
add edx, ecx
shl ecx, 4
mov esi, dword [eax + edx + 0xcc]
mov dword [esp + 0x98], esi
mov esi, dword [esp + 0x74]
movsd xmm0, qword [eax + edx + 0xc4]
movsd qword [esp + 0x90], xmm0
movsd xmm0, qword [eax + edx + 0xb4]
movsd xmm1, qword [eax + edx + 0xbc]
movsd qword [esp + 0x88], xmm1
movsd qword [esp + 0x80], xmm0
mov dword [eax + edx + 0xcc], esi
movsd xmm0, qword [esp + 0x6c]
movsd qword [eax + edx + 0xc4], xmm0
movsd xmm0, qword [esp + 0x5c]
movsd xmm1, qword [esp + 0x64]
movsd qword [eax + edx + 0xbc], xmm1
movsd qword [eax + edx + 0xb4], xmm0
lea edx, [esp + 0x9c]
movsd xmm0, qword [eax + ecx]
movsd xmm1, qword [eax + ecx + 8]
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm0
movsd xmm0, qword [esp + 0x1c]
movsd xmm1, qword [esp + 0x24]
movsd qword [eax + ecx + 8], xmm1
movsd qword [eax + ecx], xmm0
movsd xmm1, qword [esp + 0x88]
movsd xmm0, qword [esp + 0x80]
movq xmm2, qword [esp + 0x98]
mov eax, dword [esp + 0xa8]
movsd qword [esp + 0x114], xmm1
movsd xmm1, qword [esp + 0x90]
movsd qword [esp + 0x10c], xmm0
movq qword [esp + 0x124], xmm2
mov dword [esp + 0x134], eax
movsd qword [esp + 0x11c], xmm1
movsd xmm1, qword [esp + 0xa0]
movsd qword [esp + 0x12c], xmm1
jmp 0x49135e
mov eax, 1
mov dword [esp + 0x4c], ebx
push ebx
push ecx
mov dword [esp + 8], eax
push eax
call fcn.004ef180
add esp, 0xc
mov edx, dword [esi + 0x18]
test edx, edx
js 0x493764
lea ebx, [edx + edx]
cmp ebx, 0x7fffffff
jae 0x493764
movzx ecx, byte [esi + 0xc]
test ebx, ebx
mov byte [esp + 0xc], cl
mov ecx, dword [esi + 0x14]
je 0x491234
movzx eax, byte [0x6019e5]
mov esi, edx
mov dword [esp + 0x2c], ecx
xor ecx, ecx
mov edx, ebx
call fcn.00499510
mov ecx, dword [esp + 0x2c]
test eax, eax
mov dword [esp + 0x10], esi
jne 0x491243
jmp 0x493764
mov eax, 2
mov dword [esp + 0x10], 0
mov esi, edx
push ebx
push ecx
push eax
mov ebx, eax
call fcn.004ef180
add esp, 0xc
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp]
movzx edx, byte [esp + 0xc]
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x114], eax
mov byte [esp + 0x118], dl
mov dword [esp + 0x11c], ecx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], esi
mov ebx, dword [ebp + 8]
test ebx, ebx
js 0x493764
mov esi, dword [ebp + 4]
je 0x4912ba
movzx eax, byte [0x6019e5]
xor ecx, ecx
mov edx, ebx
call fcn.00499510
test eax, eax
jne 0x4912bf
jmp 0x493764
mov eax, 1
push ebx
push esi
push eax
mov esi, eax
call fcn.004ef180
add esp, 0xc
movzx eax, byte [ebp + 0xc]
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], ebx
lea ecx, [esp + 0x5c]
lea edx, [esp + 0xdc]
mov byte [esp + 0x8c], al
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x110]
push eax
call fcn.00494100
add esp, 8
test dword [esp + 0x5c], 0x7fffffff
je 0x490dc5
push dword [esp + 0x60]
jmp 0x490db7
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x10c]
lea edx, [esp + 0x80]
mov dword [esp + 0x80], eax
lea eax, [esp + 0x33]
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], ebp
push eax
call fcn.00495150
add esp, 4
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x12c]
dec dword [esp + 0xe4]
mov ebx, dword [esp + 0x10c]
mov ebp, dword [esp + 0x110]
mov esi, dword [esp + 0x11c]
cmp byte [esp + 0x33], 0
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0xd8]
mov dword [esp], eax
mov dword [esp + 0xc], ecx
je 0x4913e2
test edx, edx
je 0x493764
mov ecx, dword [esp + 0x18]
dec edx
mov eax, dword [ecx + 0x1ec]
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], edx
mov dword [eax + 0xb0], 0
push ecx
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
neg ebx
jo 0x490dc5
jae 0x4913fb
push ebp
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
test esi, esi
je 0x491410
push dword [esp]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
test dword [esp + 0x4c], 0x7fffffff
je 0x490dc5
jmp 0x490db3
mov eax, dword [esp + 0xe0]
mov edi, dword [esp + 0xdc]
mov esi, dword [esp + 0xe4]
xor ecx, ecx
mov edx, 4
xor ebp, ebp
mov dword [esp + 0xf4], eax
movzx eax, byte [0x6019e5]
call fcn.00499510
test eax, eax
je 0x493764
mov ebx, eax
mov dword [eax], 0x48544150
add eax, 4
lea ecx, [esp + 0x11c]
lea edx, [esp + 0x80]
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], eax
mov word [esp + 0x88], 0
call fcn.00493f60
mov eax, dword [esp + 0x120]
test edi, edi
mov dword [esp + 0xf8], edi
mov dword [esp + 0x4c], eax
je 0x491569
mov ebp, dword [esp + 0x124]
mov eax, dword [esp + 0xf4]
mov dword [esp + 0xc], ebx
mov dword [esp + 0xd4], esi
mov dword [esp + 4], eax
movzx edx, word [edi + 0x1ea]
lea ecx, [edi + 0xb4]
mov ebx, 0xffffffff
mov dword [esp], edi
lea eax, [edx + edx*8]
mov dword [esp + 8], edx
lea esi, [eax + eax*2]
add esi, edx
nop word [eax + eax]
test esi, esi
je 0x491520
lea edi, [ecx + 0x1c]
push 1
push dword [ecx + 0x18]
push dword [ecx + 0x14]
push ebp
push dword [esp + 0x5c]
call dword [sym.imp.kernel32.dll_CompareStringOrdinal]
inc ebx
add esi, 0xffffffe4
cmp eax, 3
mov ecx, edi
je 0x4914f0
cmp eax, 1
jne 0x491541
jmp 0x491524
mov ebx, dword [esp + 8]
mov eax, dword [esp + 4]
sub eax, 1
jb 0x491ac0
mov edi, dword [esp]
mov dword [esp + 4], eax
mov edi, dword [edi + ebx*4 + 0x1ec]
jmp 0x4914c9
cmp eax, 2
jne 0x493ebf
mov eax, dword [esp]
shl ebx, 4
mov esi, dword [esp + 0xd4]
mov ebp, dword [eax + ebx + 4]
mov eax, dword [eax + ebx + 8]
mov dword [esp + 0x2c], eax
mov ebx, dword [esp + 0xc]
jmp 0x491569
push ebx
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esp + 0x11c], 0
je 0x491594
push dword [esp + 0x4c]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword [esp + 0x38]
mov dword [esp + 0xd4], esi
mov esi, dword [edx + 0x20]
test esi, esi
je 0x4915f7
mov ecx, dword [edx + 0x1c]
mov eax, 0x4957d0
cmp esi, 4
mov edx, esi
jb 0x4915e0
mov eax, dword [ecx]
mov esi, edx
mov edx, ecx
xor ecx, ecx
bswap eax
cmp eax, 0x5c5c3f5c
setb cl
cmp eax, 0x5c5c3f5d
mov eax, 0x4957d0
adc ecx, 0xffffffff
mov ecx, 0x4957c0
cmove eax, ecx
mov ecx, edx
mov edx, esi
movzx ebx, byte [edx + ecx - 1]
push ebx
mov esi, ecx
mov edi, edx
call eax
add esp, 4
test al, al
je 0x49168c
mov byte [esp + 0xc8], 2
mov dword [esp + 0xcc], 0x5bc144
mov ecx, dword [esp + 0xc8]
mov ebx, dword [esp + 0xcc]
mov eax, dword [esp + 0x48]
cmp byte [esp + 0x32], 0
mov dword [eax + 4], ebx
mov dword [eax], ecx
mov dword [eax + 8], 2
je 0x493e89
mov eax, dword [esp + 0xf8]
test eax, eax
je 0x491723
mov ecx, dword [esp + 0xf4]
mov dword [esp + 0x110], 0
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], ecx
mov dword [esp + 0x120], 0
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], ecx
mov ecx, dword [esp + 0xd4]
mov eax, 1
jmp 0x491727
lea eax, [esi + edi]
cmp edi, 3
mov dword [esp + 0xc], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x78], eax
jbe 0x4917cd
movzx eax, byte [eax - 4]
mov ebp, edi
mov ecx, eax
add cl, 0xbf
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
xor eax, eax
cmp cl, 0x2e
mov ecx, 0
jne 0x491810
mov esi, dword [esp + 0x78]
movzx ecx, byte [esi - 3]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x65
jne 0x491800
movzx ecx, byte [esi - 2]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x78
jne 0x491804
mov ecx, ebx
add cl, 0xbf
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, bl
cmp cl, 0x65
sete cl
jmp 0x491810
xor eax, eax
xor ecx, ecx
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 0x10c], eax
mov dword [esp + 0x11c], eax
mov dword [esp + 0x12c], ecx
nop word cs:[eax + eax]
nop dword [eax]
lea ecx, [esp + 0x80]
lea edx, [esp + 0x10c]
call fcn.00496830
mov ebp, dword [esp + 0x80]
test ebp, ebp
je 0x493e89
mov esi, dword [esp + 0x88]
lea eax, [esi + esi*8]
lea eax, [eax + eax*2]
add eax, esi
cmp dword [ebp + eax + 0xb4], 0
lea edi, [ebp + eax + 0xb4]
je 0x49179f
push dword [edi + 4]
push 0
push dword [0x6019d8]
call ebx
cmp dword [edi + 0x10], 0
je 0x4917b2
push dword [edi + 0x14]
push 0
push dword [0x6019d8]
call ebx
shl esi, 4
cmp dword [ebp + esi], 0
je 0x491750
add ebp, esi
push dword [ebp + 4]
push 0
push dword [0x6019d8]
call ebx
jmp 0x491750
mov ebp, edi
mov eax, edi
mov ecx, esi
nop word cs:[eax + eax]
nop dword [eax]
test eax, eax
je 0x491955
movzx edx, byte [ecx]
cmp edx, 0x2f
je 0x491880
inc ecx
dec eax
cmp edx, 0x5c
jne 0x4917e0
jmp 0x491880
xor ecx, ecx
jmp 0x491810
xor ecx, ecx
nop word cs:[eax + eax]
cmp ebp, eax
je 0x491955
mov edx, dword [esp + 0x14]
movzx edx, byte [edx + eax]
cmp edx, 0x5c
je 0x49182b
inc eax
cmp edx, 0x2f
jne 0x491810
test cl, cl
je 0x491880
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x80]
push ebp
call fcn.0048b210
add esp, 4
mov edx, dword [esp + 0x80]
mov eax, dword [esp + 0x84]
mov ecx, edx
neg ecx
mov ecx, dword [esp + 0x88]
jno 0x491a93
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], ecx
mov dword [esp + 0xc4], 0x80000000
jmp 0x492260
test ebp, ebp
js 0x493764
movzx eax, byte [0x6019e5]
mov edi, ebp
xor ecx, ecx
xor ebp, ebp
mov edx, edi
call fcn.00499510
test eax, eax
je 0x493764
mov esi, eax
push edi
push dword [esp + 0x18]
push eax
call fcn.004ef180
add esp, 0xc
mov dword [esp + 0x10c], edi
mov dword [esp + 0x110], esi
mov dword [esp + 0x114], edi
mov dword [esp + 0x118], 0
lea ecx, [esp + 0x10c]
mov edx, str..exeprogram_not_found
push 4
call fcn.0048b7b0
add esp, 4
mov esi, dword [esp + 0x110]
mov ebx, dword [esp + 0x10c]
mov edi, dword [esp + 0x114]
lea ecx, [esp + 0x80]
mov edx, esi
push edi
call fcn.004957f0
add esp, 4
cmp ebp, dword [esp + 0x80]
jno 0x491a1b
mov ecx, esi
mov edx, edi
mov dword [esp + 0x4c], ebx
call fcn.00490220
test eax, eax
je 0x4921c5
mov ebx, edx
cmp edx, 2
jne 0x491a40
cmp word [eax], 0x2e2e
jne 0x491a40
mov edx, 2
xor ecx, ecx
jmp 0x49219e
mov eax, dword [esp + 0x14]
xor esi, esi
jmp 0x49196b
xor esi, esi
test cx, cx
je 0x491a00
mov cx, 1
test si, si
jne 0x491960
cmp eax, dword [esp + 0x78]
je 0x491a71
movzx edx, byte [eax]
test dl, dl
js 0x491988
inc eax
jmp 0x4919d5
movzx ebx, byte [eax + 1]
mov esi, edx
and esi, 0x1f
and ebx, 0x3f
cmp dl, 0xdf
jbe 0x4919cb
movzx edi, byte [eax + 2]
shl ebx, 6
and edi, 0x3f
or edi, ebx
cmp dl, 0xf0
jb 0x4919db
movzx edx, byte [eax + 3]
and esi, 7
shl edi, 6
add eax, 4
shl esi, 0x12
and edx, 0x3f
or edx, edi
or edx, esi
cmp edx, 0xffff
jbe 0x4919d5
jmp 0x4919ed
shl esi, 6
add eax, 2
or esi, ebx
mov edx, esi
xor esi, esi
mov ecx, edx
jmp 0x491962
shl esi, 0xc
add eax, 3
or edi, esi
mov edx, edi
cmp edx, 0xffff
jbe 0x4919d5
and edx, 0x3ff
or edx, 0xdc00
mov esi, edx
jmp 0x491962
mov dword [esp + 0xc8], 2
mov dword [esp + 0xcc], 0x5bc118
jmp 0x49160a
mov eax, dword [esp + 0x88]
movsd xmm0, qword [esp + 0x80]
mov dword [esp + 0xcc], eax
movsd qword [esp + 0xc4], xmm0
jmp 0x49224d
mov edx, ebx
nop word cs:[eax + eax]
nop dword [eax]
test edx, edx
je 0x491ace
mov ebp, edx
dec edx
cmp byte [eax + ebp - 1], 0x2e
jne 0x491a50
test edx, edx
je 0x49219a
mov ecx, eax
sub ebx, ebp
add ecx, ebp
jmp 0x49219e
cmp ebp, 7
mov dword [esp + 0x34], ebp
ja 0x491ad9
mov eax, dword [esp + 0x14]
mov ecx, ebp
cmp byte [eax], 0x2e
je 0x491af1
inc eax
dec ecx
jne 0x491a80
mov dword [esp + 0x40], 0
jmp 0x491af9
mov dword [esp + 0x10c], edx
mov dword [esp + 0x114], ecx
lea ecx, [esp + 0xc4]
lea edx, [esp + 0x10c]
mov dword [esp + 0x110], eax
call fcn.004958d0
jmp 0x492260
mov esi, dword [esp + 0xd4]
xor ebp, ebp
jmp 0x491563
mov ecx, eax
mov edx, ebx
xor eax, eax
jmp 0x49219e
mov edx, dword [esp + 0x14]
mov ecx, 0x2e
push ebp
call fcn.00415320
add esp, 4
mov dword [esp + 0x40], eax
jmp 0x491af9
mov dword [esp + 0x40], 1
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x4920d1
add dword [esp + 0x2c], ebp
mov cl, 1
mov dword [esp + 8], 0
nop word cs:[eax + eax]
nop dword [eax]
mov byte [esp], cl
xor edx, edx
xor ecx, ecx
mov edi, dword [esp + 8]
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 2
mov dword [esp + 0x64], 0
mov dword [esp + 0x4c], 2
jmp 0x491b5d
mov eax, dword [esp + 0x4c]
mov word [eax + edx*2], bx
inc edx
mov dword [esp + 0x64], edx
mov ebx, edi
mov dword [esp + 0x18], edx
test bx, bx
je 0x491b90
nop dword [eax + eax]
mov dword [esp + 8], 0
xor edi, edi
cmp bx, 0x22
je 0x491c70
jmp 0x491c90
cmp ebp, dword [esp + 0x2c]
je 0x491cd0
movzx ebx, byte [ebp]
test bl, bl
js 0x491bc0
inc ebp
xor edi, edi
cmp bx, 0x22
je 0x491c70
jmp 0x491c90
movzx esi, byte [ebp + 1]
mov eax, ecx
mov ecx, ebx
and ecx, 0x1f
and esi, 0x3f
cmp bl, 0xdf
jbe 0x491c09
movzx edx, byte [ebp + 2]
shl esi, 6
and edx, 0x3f
or edx, esi
cmp bl, 0xf0
jb 0x491c1f
movzx ebx, byte [ebp + 3]
and ecx, 7
shl edx, 6
add ebp, 4
shl ecx, 0x12
and ebx, 0x3f
or ebx, edx
or ebx, ecx
cmp ebx, 0xffff
ja 0x491c31
mov edx, dword [esp + 0x18]
jmp 0x491c13
shl ecx, 6
add ebp, 2
or ecx, esi
mov ebx, ecx
mov ecx, eax
xor edi, edi
cmp bx, 0x22
je 0x491c70
jmp 0x491c90
shl ecx, 0xc
add ebp, 3
or edx, ecx
mov ebx, edx
cmp ebx, 0xffff
jbe 0x491c03
lea ecx, [ebx + 0xff0000]
and ebx, 0x3ff
or ebx, 0xdc00
shr ecx, 0xa
mov edx, ebx
or ecx, 0xd800
mov edi, ebx
mov dword [esp + 8], edx
mov edx, dword [esp + 0x18]
mov ebx, ecx
mov ecx, eax
cmp bx, 0x22
jne 0x491c90
nop word cs:[eax + eax]
nop dword [eax]
xor cl, 1
mov ebx, edi
test bx, bx
jne 0x491b70
jmp 0x491b90
mov esi, ecx
movzx ecx, bx
cmp ecx, 0x3b
mov ecx, esi
jne 0x491ca5
test cl, 1
je 0x4920c6
cmp edx, dword [esp + 0x5c]
jne 0x491b50
lea ecx, [esp + 0x5c]
call fcn.0048af10
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x18]
mov ecx, esi
mov dword [esp + 0x4c], eax
jmp 0x491b50
mov dword [esp + 0x44], 0
movzx ecx, byte [esp]
test edx, edx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
setne al
or cl, al
test cl, 1
je 0x491d29
test edx, edx
js 0x493764
mov esi, dword [esp + 0x60]
je 0x491e38
movzx eax, byte [0x6019e5]
mov edx, dword [esp + 0x18]
xor ecx, ecx
call fcn.00499510
mov edx, dword [esp + 0x18]
test eax, eax
mov dword [esp + 4], eax
jne 0x491e40
jmp 0x493764
mov edx, 0x80000000
cmp dword [esp + 0x5c], 0
je 0x491d4b
push dword [esp + 0x60]
push 0
push dword [0x6019d8]
mov esi, edx
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, esi
mov eax, edx
neg eax
jo 0x4920d1
test ebx, ebx
je 0x491e07
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x10c], edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], ebx
mov dword [esp + 0x118], ecx
lea ecx, [esp + 0x10c]
push dword [esp + 0x34]
call fcn.0048c960
add esp, 4
cmp dword [esp + 0x40], 1
je 0x491dab
lea ecx, [esp + 0x10c]
call fcn.00490330
mov ebp, dword [esp + 0x110]
lea ecx, [esp + 0x80]
mov edx, ebp
push dword [esp + 0x114]
call fcn.004957f0
add esp, 4
cmp dword [esp + 0x10c], 0
je 0x491de3
push ebp
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword [esp + 0x80]
mov eax, edx
neg eax
jno 0x492187
mov eax, dword [esp + 0x44]
mov ebp, dword [esp + 0xc]
mov dword [esp + 0x10], ebx
mov ecx, eax
jmp 0x491b20
mov eax, dword [esp + 0x44]
test edx, edx
mov dword [esp + 0x10], 0
mov ecx, eax
je 0x491b20
push dword [esp + 4]
push 0
push dword [0x6019d8]
mov ebx, eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, ebx
jmp 0x491b20
mov dword [esp + 4], 1
mov eax, dword [esp + 0x3c]
lea edi, [esi + edx*2]
xor ebx, ebx
mov dword [esp + 0x10], edi
and eax, 0xffffff00
inc eax
mov dword [esp + 0x3c], eax
xor eax, eax
jmp 0x491e92
mov eax, dword [esp + 4]
mov edi, edx
lea esi, [ebp + ebx]
add ebx, eax
mov dword [esp + 4], eax
push ebp
lea eax, [esp + 0x20]
push eax
push ebx
call fcn.004ef180
add esp, 0xc
mov ebx, esi
mov edx, edi
mov ebp, dword [esp + 0xc]
mov esi, dword [esp]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x4c]
test al, 1
je 0x491ea0
movzx eax, word [esp + 0xd8]
jmp 0x491eae
cmp esi, edi
je 0x491d2e
movzx eax, word [esi]
add esi, 2
mov ecx, eax
and ecx, 0xf800
cmp ecx, 0xd800
movzx ecx, ax
jne 0x491ee0
cmp ecx, 0xdbff
jbe 0x491f00
mov dword [esp], esi
mov dword [esp + 0x4c], 0
jmp 0x491f8e
cmp ecx, 0x80
mov dword [esp + 0x1c], 0
mov dword [esp], esi
jae 0x491f40
mov ebp, 1
mov byte [esp + 0x1c], al
jmp 0x491f61
cmp esi, edi
je 0x491f83
movzx ebp, word [esi]
add esi, 2
mov dword [esp + 0x18], edx
mov dl, 1
mov dword [esp], esi
mov dword [esp + 0x4c], edx
mov esi, ebp
add esi, 0x2000
movzx esi, si
cmp esi, 0xfbff
ja 0x492056
mov edx, dword [esp + 0x18]
mov word [esp + 0xd8], bp
jmp 0x491f8e
cmp ecx, 0x800
jae 0x491f77
mov ecx, eax
and al, 0x3f
mov ebp, 2
shr ecx, 6
or al, 0x80
or cl, 0xc0
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1d], al
mov dword [esp + 0x4c], 0
mov eax, edx
sub eax, ebx
cmp eax, ebp
jae 0x491e60
jmp 0x491fd4
mov esi, edx
mov dword [esp + 0x4c], 0
jmp 0x491fa0
mov dword [esp + 0x4c], 0
mov dword [esp], edi
and dword [esp + 0x3c], 0xffffff00
mov esi, edx
mov dword [esp + 0x1c], 0
mov edx, ecx
shr ecx, 6
and al, 0x3f
mov ebp, 3
shr edx, 0xc
and cl, 0x3f
or al, 0x80
or dl, 0xe0
or cl, 0x80
mov byte [esp + 0x1c], dl
mov byte [esp + 0x1d], cl
mov byte [esp + 0x1e], al
mov edx, esi
mov eax, edx
sub eax, ebx
cmp eax, ebp
jae 0x491e60
mov esi, ebx
add esi, ebp
jb 0x493764
lea edi, [edx + edx]
mov eax, 8
cmp edi, esi
cmovbe edi, esi
cmp edi, 9
cmovb edi, eax
test edi, edi
js 0x493764
test edx, edx
je 0x492016
mov eax, dword [esp + 4]
mov dword [esp + 0x10c], eax
mov eax, 1
mov dword [esp + 0x114], edx
jmp 0x492018
xor eax, eax
mov dword [esp + 0x110], eax
lea eax, [esp + 0x10c]
lea ecx, [esp + 0x80]
mov edx, 1
push eax
push edi
call fcn.004c61e0
add esp, 8
cmp dword [esp + 0x80], 1
je 0x493764
mov eax, dword [esp + 0x84]
jmp 0x491e6a
movzx ecx, bp
and eax, 0x3ff
mov esi, ebx
mov ebp, 4
mov dword [esp + 0x4c], 0
mov edx, ecx
shl eax, 0xa
and cl, 0x3f
and edx, 0x3c0
lea ebx, [eax + 0x10000]
or cl, 0x80
or edx, eax
mov eax, ebx
shr ebx, 0xc
shr edx, 6
shr eax, 0x12
and bl, 0x3f
and dl, 0x3f
or al, 0xf0
or bl, 0x80
or dl, 0x80
mov byte [esp + 0x1c], al
mov byte [esp + 0x1d], bl
mov ebx, esi
mov byte [esp + 0x1e], dl
mov edx, dword [esp + 0x18]
mov byte [esp + 0x1f], cl
mov eax, edx
sub eax, ebx
cmp eax, ebp
jb 0x491fd4
jmp 0x491e60
mov al, 1
mov dword [esp + 0x44], eax
jmp 0x491cd8
lea ecx, [esp + 0x80]
call fcn.0048b670
mov ebx, dword [esp + 0x80]
mov eax, ebx
neg eax
jno 0x492142
cmp byte [esp + 0x84], 3
jne 0x492fde
mov esi, dword [esp + 0x88]
mov ebx, dword [esi + 4]
mov edi, dword [esi]
mov eax, dword [ebx]
test eax, eax
je 0x492110
push edi
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x49212e
cmp dword [ebx + 8], 9
jb 0x49211f
mov edi, dword [edi - 4]
push edi
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x492fde
mov esi, dword [esp + 0x84]
mov edi, dword [esp + 0x88]
mov ebp, dword [esp + 0x8c]
mov ecx, esi
mov edx, edi
call fcn.0048da70
test eax, eax
je 0x492f55
test edx, edx
je 0x492f53
cmp edi, edx
jbe 0x492f49
cmp byte [esi + edx], 0xbf
jg 0x492f4f
jmp 0x493764
mov ecx, dword [esp + 0x84]
mov ebx, dword [esp + 0x88]
jmp 0x49227f
xor ecx, ecx
mov edx, ebx
test eax, eax
cmovne ecx, eax
test ecx, ecx
je 0x4921c5
test eax, eax
cmove edx, ebx
add ecx, edx
sub ecx, esi
je 0x4921cb
mov ebx, dword [esp + 0x4c]
cmp edi, ecx
jbe 0x4921d1
cmp byte [esi + ecx], 0xbf
jg 0x4921d7
jmp 0x493764
mov ebx, dword [esp + 0x4c]
jmp 0x4921dd
mov ebx, dword [esp + 0x4c]
jmp 0x4921db
jne 0x493764
cmp edi, ecx
jb 0x4921dd
mov edi, ecx
lea ecx, [esp + 0x10c]
mov edx, esi
push edi
call fcn.0048b210
add esp, 4
mov edx, dword [esp + 0x10c]
mov eax, dword [esp + 0x110]
mov ecx, edx
neg ecx
mov ecx, dword [esp + 0x114]
jno 0x492225
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], ecx
mov dword [esp + 0xc4], 0x80000000
jmp 0x49224d
mov dword [esp + 0x10c], edx
mov dword [esp + 0x114], ecx
lea ecx, [esp + 0xc4]
lea edx, [esp + 0x10c]
mov dword [esp + 0x110], eax
call fcn.004958d0
test ebx, ebx
je 0x492260
push esi
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword [esp + 0xc4]
mov ecx, dword [esp + 0xc8]
mov ebx, dword [esp + 0xcc]
mov eax, edx
neg eax
jo 0x491618
cmp ebx, 5
mov dword [esp], edx
mov dword [esp + 0x4c], ecx
jb 0x4922aa
mov eax, dword [esp + 0x4c]
lea eax, [eax + ebx*2]
mov ecx, eax
add ecx, 0xfffffff6
je 0x4922aa
cmp word [ecx], 0x2e
jne 0x4922aa
cmp word [eax - 2], 0
je 0x492c14
mov eax, dword [esp + 0x38]
lea esi, [esp + 0x80]
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 2
mov dword [esp + 0x88], 0
mov ecx, esi
mov ebx, dword [eax + 0x2c]
mov edi, dword [eax + 0x30]
movzx eax, byte [eax + 0x69]
mov byte [esp + 4], al
call fcn.0048af10
mov eax, dword [esp + 0x84]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x78]
mov word [eax], 0x22
mov dword [esp + 0x10c], edx
mov dword [esp + 0x110], ecx
lea edx, [esp + 0x10c]
mov ecx, esi
mov dword [esp + 0x88], 1
mov word [esp + 0x114], 0
call fcn.0048b350
mov esi, dword [esp + 0x88]
cmp esi, dword [esp + 0x80]
jne 0x49234c
lea ecx, [esp + 0x80]
call fcn.0048af10
mov eax, dword [esp + 0x84]
mov word [eax + esi*2], 0x22
inc esi
test edi, edi
mov dword [esp + 0x88], esi
je 0x4923c9
shl edi, 2
lea ebp, [edi + edi*4]
movzx edi, byte [esp + 4]
mov esi, dword [esp + 0x88]
cmp esi, dword [esp + 0x80]
jne 0x49238c
lea ecx, [esp + 0x80]
call fcn.0048af10
mov eax, dword [esp + 0x84]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x80]
mov word [eax + esi*2], 0x20
inc esi
mov dword [esp + 0x88], esi
push edi
push ebx
call fcn.00495990
add esp, 8
cmp byte [esp + 0x5c], 4
jne 0x49285e
add ebx, 0x14
add ebp, 0xffffffec
jne 0x492370
mov eax, dword [esp + 0x80]
mov edi, dword [esp + 0x84]
mov esi, dword [esp + 0x88]
mov ecx, eax
neg ecx
jo 0x492885
mov ecx, dword [esp]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov ebx, dword [esp + 0xd4]
cmp eax, esi
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], edi
mov dword [esp + 0xf0], esi
jne 0x492432
lea ecx, [esp + 0xe8]
call fcn.0048af10
mov edi, dword [esp + 0xec]
mov ecx, dword [esp + 0x38]
mov word [edi + esi*2], 0
inc esi
mov eax, 0x608
mov edx, 0x400
mov dword [esp + 0xf0], esi
cmp byte [ecx + 0x68], 0
cmovne edx, eax
or edx, dword [ecx + 0x58]
cmp byte [esp + 0x32], 0
mov dword [esp + 0xd8], edx
je 0x4928c0
mov eax, 2
test ebx, ebx
mov ecx, 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 2
mov dword [esp + 0x24], 0
mov dword [esp + 4], 0
jne 0x4924b7
lea ecx, [esp + 0x1c]
call fcn.0048af10
mov eax, dword [esp + 0x20]
mov ecx, 1
mov word [eax], 0
mov dword [esp + 0x24], 1
mov edx, dword [esp + 0xf8]
mov esi, dword [esp + 0xf4]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x18], eax
xor eax, eax
mov ecx, ebx
test edx, edx
setne al
cmove ecx, edx
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], 0
mov dword [esp + 0x114], edx
mov dword [esp + 0x118], esi
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], 0
mov dword [esp + 0x124], edx
mov dword [esp + 0x128], esi
mov dword [esp + 0x12c], ecx
lea ecx, [esp + 0x80]
lea edx, [esp + 0x10c]
call fcn.00496830
mov eax, dword [esp + 0x80]
test eax, eax
je 0x4937e8
mov edx, dword [esp + 0x88]
lea ecx, [edx + edx*8]
lea ecx, [ecx + ecx*2]
add ecx, edx
mov edi, dword [eax + ecx + 0xb4]
mov esi, edi
neg esi
jo 0x4937e8
mov dword [esp + 0x7c], edi
mov edi, dword [eax + ecx + 0xc4]
shl edx, 4
mov esi, dword [eax + ecx + 0xb8]
xor ebx, ebx
mov ebp, dword [eax + edx + 4]
mov dword [esp + 0x78], edi
mov edi, dword [eax + edx]
mov edx, dword [eax + edx + 8]
mov dword [esp + 0x44], esi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x2c], edx
mov edx, dword [eax + ecx + 0xc8]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x14], edx
mov edx, dword [eax + ecx + 0xcc]
mov ecx, dword [eax + ecx + 0xbc]
mov dword [esp + 0x108], edx
add ecx, esi
mov edx, esi
jmp 0x4925cb
xor ebx, ebx
test si, si
je 0x492ae4
mov si, 1
test bx, bx
jne 0x4925c0
cmp edx, ecx
je 0x492652
movzx eax, byte [edx]
test al, al
js 0x4925e2
inc edx
jmp 0x492649
movzx edi, byte [edx + 1]
mov ebp, eax
and ebp, 0x1f
and edi, 0x3f
cmp al, 0xdf
jbe 0x49261b
movzx ebx, byte [edx + 2]
shl edi, 6
and ebx, 0x3f
or ebx, edi
cmp al, 0xf0
jb 0x492627
movzx eax, byte [edx + 3]
and ebp, 7
shl ebx, 6
add edx, 4
shl ebp, 0x12
and eax, 0x3f
or eax, ebx
or eax, ebp
jmp 0x492631
shl ebp, 6
add edx, 2
or ebp, edi
mov eax, ebp
jmp 0x492649
shl ebp, 0xc
add edx, 3
or ebx, ebp
mov eax, ebx
cmp eax, 0xffff
jbe 0x492649
and eax, 0x3ff
or eax, 0xdc00
mov ebx, eax
jmp 0x4925c2
xor ebx, ebx
mov esi, eax
jmp 0x4925c2
cmp dword [esp + 0x7c], 0
je 0x49266b
push dword [esp + 0x44]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x40]
mov esi, dword [esp + 0x108]
sub eax, edx
cmp eax, esi
jb 0x492840
mov ecx, dword [esp + 0x18]
lea eax, [esi + esi]
mov ebp, esi
mov esi, ecx
lea ecx, [ecx + edx*2]
push eax
mov ebx, dword [esp + 0x18]
push ebx
push ecx
mov edi, edx
call fcn.004ef180
mov eax, edi
add esp, 0xc
add eax, ebp
cmp dword [esp + 0x78], 0
mov dword [esp + 0x24], eax
je 0x4926c5
push ebx
push 0
push dword [0x6019d8]
mov edi, eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, edi
cmp eax, dword [esp + 0x1c]
jne 0x4926dc
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.0048af10
mov eax, esi
mov esi, dword [esp + 0x20]
mov word [esi + eax*2], 0x3d
inc eax
mov ecx, dword [esp + 0x34]
and dword [esp + 0x44], 0xffffff00
xor edi, edi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x2c]
lea esi, [ecx + eax]
jmp 0x492709
xor edi, edi
test dx, dx
je 0x492d9d
mov dx, 1
test di, di
jne 0x4926fe
cmp ecx, esi
je 0x492790
movzx eax, byte [ecx]
test al, al
js 0x492720
inc ecx
jmp 0x492787
movzx ebp, byte [ecx + 1]
mov edi, eax
and edi, 0x1f
and ebp, 0x3f
cmp al, 0xdf
jbe 0x492759
movzx ebx, byte [ecx + 2]
shl ebp, 6
and ebx, 0x3f
or ebx, ebp
cmp al, 0xf0
jb 0x492765
movzx eax, byte [ecx + 3]
and edi, 7
shl ebx, 6
add ecx, 4
shl edi, 0x12
and eax, 0x3f
or eax, ebx
or eax, edi
jmp 0x49276f
shl edi, 6
add ecx, 2
or edi, ebp
mov eax, edi
jmp 0x492787
shl edi, 0xc
add ecx, 3
or ebx, edi
mov eax, ebx
cmp eax, 0xffff
jbe 0x492787
and eax, 0x3ff
or eax, 0xdc00
mov edi, eax
jmp 0x492700
xor edi, edi
mov edx, eax
jmp 0x492700
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x3c]
mov eax, ecx
mov edx, edi
shr eax, 8
neg edx
mov dword [esp + 0x104], eax
jo 0x493ec6
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], esi
mov esi, ecx
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x5c]
mov word [esp + 0x64], 0
call fcn.0048b350
test edi, edi
je 0x4927df
push esi
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x80]
cmp edx, dword [esp + 0x1c]
jne 0x492801
mov esi, ecx
lea ecx, [esp + 0x1c]
mov edi, edx
call fcn.0048af10
mov edx, edi
mov ecx, esi
mov eax, dword [esp + 0x20]
mov word [eax + edx*2], 0
inc edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x40], edx
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x44]
mov dword [esp + 4], edx
lea edx, [esp + 0x10c]
call fcn.00496830
mov eax, dword [esp + 0x80]
test eax, eax
jne 0x492542
jmp 0x4937e8
lea ecx, [esp + 0x1c]
push 2
push 2
push esi
call fcn.00500270
add esp, 0xc
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jmp 0x492688
mov edi, dword [esp + 0x5c]
mov esi, dword [esp + 0x60]
cmp dword [esp + 0x80], 0
je 0x492885
push dword [esp + 0x84]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp]
mov bl, 1
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], 2
test edx, edx
je 0x4928b1
push ecx
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
test byte [esp + 0x32], bl
jne 0x491633
jmp 0x493e89
xor edx, edx
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 2
xor eax, eax
mov dword [esp + 0x18], edx
cmp eax, dword [ecx + 0x34]
jno 0x492b46
mov dword [esp + 0x78], 0
mov dword [esp + 0x14], 2
mov dword [esp + 0x3c], 0
xorps xmm0, xmm0
mov cl, 1
xor eax, eax
movzx ebx, byte [esp + 0x524]
movups xmmword [esp + 0x1c], xmm0
lock cmpxchg byte [0x6019cc], cl
jne 0x4938ee
test bl, bl
mov ebx, dword [esp + 0x38]
lea edi, [esp + 0xfc]
lea edx, [esp + 0xdc]
lea eax, [esp + 0x5c]
mov dword [esp + 0x5c], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0xdc], 2
lea ecx, [esp + 0x10c]
cmovne edx, edi
cmp dword [ebx], 6
mov ebp, dword [ebx + 8]
lea esi, [ebx + 0x10]
cmovne edx, ebx
cmp dword [ebx + 0x10], 6
cmove esi, edi
push eax
push 0xfffffffffffffff6
call fcn.004969b0
add esp, 8
movzx eax, byte [esp + 0x10c]
cmp al, 4
jne 0x492d6a
cmp ebp, 6
mov ebp, dword [esp + 0x110]
lea edx, [ebx + 8]
lea eax, [esp + 0x64]
lea ecx, [esp + 0x10c]
cmove edx, edi
push eax
push 0xfffffffffffffff5
call fcn.004969b0
add esp, 8
movzx eax, byte [esp + 0x10c]
cmp al, 4
jne 0x492e9a
mov edi, dword [esp + 0x110]
lea eax, [esp + 0x6c]
lea ecx, [esp + 0x10c]
mov edx, esi
push eax
push 0xfffffffffffffff4
call fcn.004969b0
add esp, 8
movzx eax, byte [esp + 0x10c]
cmp al, 4
jne 0x493798
mov ecx, dword [esp + 0x110]
xorps xmm0, xmm0
test ebp, ebp
mov dword [esp + 0xc0], 0
movups xmmword [esp + 0xb0], xmm0
movups xmmword [esp + 0xa0], xmm0
movups xmmword [esp + 0x90], xmm0
movups xmmword [esp + 0x80], xmm0
jne 0x492a39
test edi, edi
jne 0x492a39
mov eax, 1
test ecx, ecx
je 0x492a5e
mov eax, 0x101
mov dword [esp + 0xac], 0x100
mov dword [esp + 0xb8], ebp
mov dword [esp + 0xbc], edi
mov dword [esp + 0xc0], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0xd8]
mov dword [esp + 0x44], ecx
cmp byte [edx + 0x44], 1
jne 0x492a86
movzx ecx, word [edx + 0x46]
mov dword [esp + 0xac], eax
mov word [esp + 0xb0], cx
mov esi, dword [edx + 0x64]
mov dword [esp + 0x7c], edi
test esi, esi
je 0x493b8a
add edx, 0x5c
lea ecx, [esp + 0xc4]
mov dword [esp + 0x80], 0x48
call fcn.00496f80
mov edx, dword [esp + 0xc8]
mov ecx, dword [esp + 0xcc]
test byte [esp + 0xc4], 1
je 0x493ba2
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x44]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [eax + 8], 2
jmp 0x493ce2
cmp dword [esp + 0x7c], 0
je 0x492afd
push dword [esp + 0x44]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esp + 0x3c], 0
mov esi, dword [esp + 0x14]
je 0x492b1a
push dword [esp + 0x34]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
or dword [esp + 4], 2
cmp dword [esp + 0x78], 0
mov dword [esp + 0x2c], 0x5bc118
je 0x492dd3
push esi
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x492dd3
mov edx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x3c]
xor edi, edi
add ecx, edx
mov dword [esp + 0x3c], edx
jmp 0x492b61
xor edi, edi
test si, si
je 0x492bf1
mov si, 1
test di, di
jne 0x492b56
cmp edx, ecx
je 0x492ed4
movzx ebx, byte [edx]
test bl, bl
js 0x492b7c
inc edx
jmp 0x492be8
movzx eax, byte [edx + 1]
mov edi, ebx
and edi, 0x1f
and eax, 0x3f
cmp bl, 0xdf
jbe 0x492bb7
movzx ebp, byte [edx + 2]
shl eax, 6
and ebp, 0x3f
or ebp, eax
cmp bl, 0xf0
jb 0x492bc3
movzx ebx, byte [edx + 3]
and edi, 7
shl ebp, 6
add edx, 4
shl edi, 0x12
and ebx, 0x3f
or ebx, ebp
or ebx, edi
jmp 0x492bcd
shl edi, 6
add edx, 2
or edi, eax
mov ebx, edi
jmp 0x492be8
shl edi, 0xc
add edx, 3
or ebp, edi
mov ebx, ebp
cmp ebx, 0xffff
jbe 0x492be8
and ebx, 0x3ff
or ebx, 0xdc00
mov edi, ebx
jmp 0x492b58
xor edi, edi
mov esi, ebx
jmp 0x492b58
mov edi, dword [esp + 8]
mov esi, 0x5bc118
mov ecx, 2
mov eax, dword [esp + 0x48]
mov dword [eax + 4], esi
mov dword [eax], ecx
mov dword [eax + 8], 2
jmp 0x493d6b
movzx ecx, word [eax - 8]
lea edx, [ecx - 0x42]
cmp edx, 0x21
ja 0x4922aa
mov esi, dword [esp + 0x7c]
add esi, dword [edx*4 + 0x493ed0]
jmp esi
movzx ecx, byte [esp + 0x10f]
mov edx, dword [esp + 0x48]
movzx edi, word [esp + 0x10d]
mov esi, dword [esp + 0x110]
mov byte [edx + 3], cl
mov word [edx + 1], di
mov byte [edx], al
mov dword [edx + 4], esi
mov dword [edx + 8], 2
jmp 0x493d04
cmp dword [esp + 0x3c], 0
mov esi, 2
mov dword [esp + 0x2c], 0x5bc118
je 0x492dc3
push dword [esp + 0x34]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp + 0x104]
shl eax, 8
or eax, esi
mov dword [esp + 4], eax
lea edi, [esp + 0x10c]
nop word [eax + eax]
lea ecx, [esp + 0x80]
mov edx, edi
call fcn.00496830
mov ebp, dword [esp + 0x80]
test ebp, ebp
je 0x492e60
mov ebx, dword [esp + 0x88]
lea eax, [ebx + ebx*8]
lea eax, [eax + eax*2]
add eax, ebx
cmp dword [ebp + eax + 0xb4], 0
lea esi, [ebp + eax + 0xb4]
je 0x492e2a
push dword [esi + 4]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esi + 0x10], 0
je 0x492e41
push dword [esi + 0x14]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
shl ebx, 4
cmp dword [ebp + ebx], 0
je 0x492de0
add ebp, ebx
push dword [ebp + 4]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x492de0
cmp dword [esp + 0x1c], 0
je 0x492e79
push dword [esp + 0x20]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov edi, dword [esp + 8]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 4]
mov dword [eax + 4], ecx
mov dword [eax], edx
mov dword [eax + 8], 2
jmp 0x493d84
movzx ecx, byte [esp + 0x10f]
mov edx, dword [esp + 0x48]
movzx edi, word [esp + 0x10d]
mov esi, dword [esp + 0x110]
mov byte [edx + 3], cl
mov word [edx + 1], di
mov byte [edx], al
mov dword [edx + 4], esi
mov dword [edx + 8], 2
push ebp
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x493d04
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x10c]
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], ecx
lea ecx, [esp + 0x80]
mov word [esp + 0x114], 0
call fcn.00493f60
mov edx, dword [esp + 0x80]
mov esi, dword [esp + 0x88]
mov edi, dword [esp + 8]
cmp esi, edx
jne 0x492f2c
lea ecx, [esp + 0x80]
call fcn.0048af10
mov edx, dword [esp + 0x80]
mov ecx, dword [esp + 0x84]
mov eax, edx
neg eax
mov word [ecx + esi*2], 0
jno 0x4937d7
inc esi
jmp 0x492bff
jne 0x493764
cmp edi, edx
jb 0x492f55
mov edi, edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x110], esi
mov dword [esp + 0x114], edi
mov dword [esp + 0x118], ebp
lea ecx, [esp + 0x10c]
push dword [esp + 0x34]
call fcn.0048c960
add esp, 4
cmp dword [esp + 0x40], 1
je 0x492f9b
lea ecx, [esp + 0x10c]
call fcn.00490330
mov esi, dword [esp + 0x110]
lea ecx, [esp + 0x5c]
mov edx, esi
push dword [esp + 0x114]
call fcn.004957f0
add esp, 4
cmp dword [esp + 0x10c], 0
je 0x492fd0
push esi
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword [esp + 0x5c]
mov eax, edx
neg eax
jno 0x493386
mov ebx, 0x200
xor esi, esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 2
mov dword [esp + 0x24], 0
mov dword [esp], 2
cmp ebx, 0x201
jb 0x49301e
jmp 0x493040
jbe 0x4930c2
cmp ebx, 0x201
jae 0x493040
mov dword [esp + 0x4c], 0x200
lea ebp, [esp + 0x10c]
mov edi, ebx
jmp 0x493051
sub ebx, esi
jne 0x4930a2
mov ebp, dword [esp]
mov edi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x4c], esi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push edi
push ebp
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov ebx, eax
test eax, eax
jne 0x493075
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x493177
cmp ebx, edi
jne 0x493010
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x493764
lea ebx, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs ebx, eax
cmp ebx, 0x201
jae 0x493040
jmp 0x49301e
lea ecx, [esp + 0x1c]
mov edx, esi
push 2
push 2
push ebx
call fcn.00500270
add esp, 0xc
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov dword [esp], eax
jmp 0x493044
cmp ebx, dword [esp + 0x4c]
ja 0x493764
lea edi, [esp + 0x80]
mov edx, ebp
mov ecx, edi
push ebx
call fcn.0048a230
add esp, 4
mov edx, dword [esp + 0x14]
mov ecx, edi
push dword [esp + 0x34]
call fcn.0048c960
add esp, 4
cmp dword [esp + 0x40], 1
je 0x493105
lea ecx, [esp + 0x80]
call fcn.00490330
mov edi, dword [esp + 0x84]
lea ecx, [esp + 0x5c]
mov edx, edi
push dword [esp + 0x88]
call fcn.004957f0
add esp, 4
cmp dword [esp + 0x80], 0
je 0x49313a
push edi
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
cmp dword [esp + 0x1c], 0
je 0x493167
push dword [esp + 0x20]
push 0
push dword [0x6019d8]
mov esi, ecx
mov edi, edx
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, edi
mov ecx, esi
cmp edx, 0x80000001
jg 0x49227f
je 0x49319a
jmp 0x4931dd
call dword [sym.imp.kernel32.dll_GetLastError]
cmp dword [esp + 0x1c], 0
mov ebx, eax
je 0x493198
push dword [esp + 0x20]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
xor ecx, ecx
cmp cl, 3
jne 0x4931dd
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
mov eax, dword [edi]
test eax, eax
je 0x4931b0
push esi
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x4931ce
cmp dword [edi + 8], 9
jb 0x4931bf
mov esi, dword [esi - 4]
push esi
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
push ebx
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov ebp, dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
mov eax, 0x200
xor esi, esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 2
mov dword [esp + 0x24], 0
mov dword [esp + 4], 2
cmp eax, 0x201
jb 0x49322d
jmp 0x493240
jbe 0x4932d1
cmp eax, 0x201
jae 0x493240
mov dword [esp + 0x4c], 0x200
lea ebx, [esp + 0x10c]
mov edi, eax
jmp 0x493252
sub eax, esi
jne 0x4932ad
mov ebx, dword [esp + 4]
mov edi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x4c], esi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push edi
push ebx
call ebp
test eax, eax
jne 0x493284
mov dword [esp], ebx
mov ebx, esi
mov esi, ebp
mov ebp, eax
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
mov eax, ebp
mov ebp, esi
mov esi, ebx
mov ebx, dword [esp]
test ecx, ecx
jne 0x493393
cmp eax, edi
jne 0x493220
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x493764
lea eax, [edi + edi]
test edi, edi
mov ecx, 0xffffffff
cmovs eax, ecx
cmp eax, 0x201
jae 0x493240
jmp 0x49322d
lea ecx, [esp + 0x1c]
mov edx, esi
push 2
push 2
push eax
call fcn.00500270
add esp, 0xc
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov dword [esp + 4], eax
jmp 0x493244
cmp eax, dword [esp + 0x4c]
ja 0x493764
lea esi, [esp + 0x80]
mov edx, ebx
mov ecx, esi
push eax
call fcn.0048a230
add esp, 4
mov edx, dword [esp + 0x14]
mov ecx, esi
push dword [esp + 0x34]
call fcn.0048c960
add esp, 4
cmp dword [esp + 0x40], 1
je 0x493314
lea ecx, [esp + 0x80]
call fcn.00490330
mov esi, dword [esp + 0x84]
lea ecx, [esp + 0x5c]
mov edx, esi
push dword [esp + 0x88]
call fcn.004957f0
add esp, 4
cmp dword [esp + 0x80], 0
je 0x493349
push esi
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
cmp dword [esp + 0x1c], 0
je 0x493376
push dword [esp + 0x20]
push 0
push dword [0x6019d8]
mov esi, ecx
mov edi, edx
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, edi
mov ecx, esi
cmp edx, 0x80000001
jg 0x49227f
je 0x4933b6
jmp 0x4933f9
mov ecx, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
jmp 0x49227f
call dword [sym.imp.kernel32.dll_GetLastError]
cmp dword [esp + 0x1c], 0
mov ebx, eax
je 0x4933b4
push dword [esp + 0x20]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
xor ecx, ecx
cmp cl, 3
jne 0x4933f9
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
mov eax, dword [edi]
test eax, eax
je 0x4933cc
push esi
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x4933ea
cmp dword [edi + 8], 9
jb 0x4933db
mov esi, dword [esi - 4]
push esi
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
push ebx
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
lea ecx, [esp + 0x80]
mov edx, 0x5bbcc1
push 4
call fcn.0048af90
add esp, 4
mov ecx, dword [esp + 0x80]
mov eax, ecx
neg eax
jo 0x493712
mov esi, dword [esp + 0x84]
mov edx, dword [esp + 0x88]
mov dword [esp + 0xc], ecx
mov byte [esp + 8], 1
mov dword [esp + 0x4c], 0
add edx, esi
mov dword [esp + 0x10], esi
mov dword [esp + 4], edx
jmp 0x493453
mov edx, dword [esp + 4]
mov byte [esp + 8], bl
mov eax, 2
xor ebx, ebx
mov ebp, dword [esp + 0x4c]
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 2
mov dword [esp + 0x64], 0
mov dword [esp], 0
mov edi, ebp
test bp, bp
jne 0x4934a0
jmp 0x4934c0
mov ecx, dword [esp]
mov word [eax + ecx*2], di
inc ecx
mov dword [esp], ecx
mov dword [esp + 0x64], ecx
mov edi, ebp
test bp, bp
je 0x4934c0
nop dword [eax]
mov dword [esp + 0x4c], 0
xor ebp, ebp
cmp di, 0x22
je 0x493538
jmp 0x493588
cmp esi, edx
je 0x4935bc
movzx ecx, byte [esi]
test cl, cl
js 0x4934e0
inc esi
mov edi, ecx
xor ebp, ebp
cmp di, 0x22
je 0x493538
jmp 0x493588
movzx ebp, byte [esi + 1]
mov edi, ecx
and edi, 0x1f
and ebp, 0x3f
cmp cl, 0xdf
jbe 0x493527
movzx edx, byte [esi + 2]
shl ebp, 6
and edx, 0x3f
or edx, ebp
cmp cl, 0xf0
jb 0x49354b
movzx ecx, byte [esi + 3]
and edi, 7
shl edx, 6
add esi, 4
shl edi, 0x12
and ecx, 0x3f
or ecx, edx
or edi, ecx
mov edx, dword [esp + 4]
cmp edi, 0xffff
jbe 0x493530
jmp 0x49355f
shl edi, 6
add esi, 2
or edi, ebp
nop
xor ebp, ebp
cmp di, 0x22
jne 0x493588
xor bl, 1
mov edi, ebp
test bp, bp
jne 0x4934a0
jmp 0x4934c0
shl edi, 0xc
add esi, 3
or edi, edx
mov edx, dword [esp + 4]
cmp edi, 0xffff
jbe 0x493530
lea ecx, [edi + 0xff0000]
and edi, 0x3ff
shr ecx, 0xa
or edi, 0xdc00
or ecx, 0xd800
mov ebp, edi
mov edi, ecx
mov dword [esp + 0x4c], ebp
cmp di, 0x22
je 0x493538
movzx ecx, di
cmp ecx, 0x3b
jne 0x493599
test bl, 1
je 0x4936f2
mov ecx, dword [esp]
cmp ecx, dword [esp + 0x5c]
jne 0x493486
lea ecx, [esp + 0x5c]
call fcn.0048af10
mov edx, dword [esp + 4]
mov eax, dword [esp + 0x60]
jmp 0x493486
xor ebx, ebx
mov edi, dword [esp]
movzx ecx, byte [esp + 8]
test edi, edi
setne al
or cl, al
test cl, 1
je 0x4935e8
mov edx, dword [esp + 0x60]
lea ecx, [esp + 0x10c]
push edi
call fcn.0048a230
add esp, 4
jmp 0x4935f3
mov dword [esp + 0x10c], 0x80000000
cmp dword [esp + 0x5c], 0
je 0x49360c
push dword [esp + 0x60]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp + 0x10c]
mov ecx, eax
neg ecx
jo 0x4936f9
mov edx, dword [esp + 0x114]
mov ecx, dword [esp + 0x110]
test edx, edx
je 0x4936d6
mov edi, dword [esp + 0x118]
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], ecx
mov dword [esp + 0x114], edx
mov edx, dword [esp + 0x14]
mov dword [esp], ebx
lea ecx, [esp + 0x10c]
mov dword [esp + 0x118], edi
push dword [esp + 0x34]
call fcn.0048c960
add esp, 4
cmp dword [esp + 0x40], 1
je 0x493683
lea ecx, [esp + 0x10c]
call fcn.00490330
mov ebx, dword [esp + 0x110]
lea ecx, [esp + 0x5c]
mov edx, ebx
push dword [esp + 0x114]
call fcn.004957f0
add esp, 4
cmp dword [esp + 0x10c], 0
je 0x4936b8
push ebx
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword [esp + 0x5c]
mov eax, edx
neg eax
jno 0x493766
mov edx, dword [esp + 4]
mov eax, dword [esp]
mov byte [esp + 8], al
jmp 0x493453
test eax, eax
je 0x49344b
push ecx
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x49344b
mov bl, 1
jmp 0x4935be
cmp dword [esp + 0xc], 0
je 0x493712
push dword [esp + 0x10]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esp + 0xc8], 2
mov dword [esp + 0xcc], 0x5bc168
jmp 0x49160a
ud2
mov ecx, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
cmp dword [esp + 0xc], 0
je 0x49227f
push dword [esp + 0x10]
push 0
push dword [0x6019d8]
mov esi, ecx
mov edi, edx
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, edi
mov ecx, esi
jmp 0x49227f
movzx ecx, byte [esp + 0x10f]
mov edx, dword [esp + 0x48]
movzx ebx, word [esp + 0x10d]
mov esi, dword [esp + 0x110]
mov byte [edx + 3], cl
mov word [edx + 1], bx
mov byte [edx], al
mov dword [edx + 4], esi
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [edx + 8], 2
push edi
call esi
push ebp
call esi
jmp 0x493d04
mov dword [esp + 0x3c], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x78], ecx
jmp 0x4928f9
lea edi, [esp + 0x10c]
lea ecx, [esp + 0x80]
mov edx, edi
call fcn.00496830
mov ebp, dword [esp + 0x80]
test ebp, ebp
je 0x49386f
mov ebx, dword [esp + 0x88]
lea eax, [ebx + ebx*8]
lea eax, [eax + eax*2]
add eax, ebx
cmp dword [ebp + eax + 0xb4], 0
lea esi, [ebp + eax + 0xb4]
je 0x493839
push dword [esi + 4]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esi + 0x10], 0
je 0x493850
push dword [esi + 0x14]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
shl ebx, 4
cmp dword [ebp + ebx], 0
je 0x4937ef
add ebp, ebx
push dword [ebp + 4]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x4937ef
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x18]
cmp eax, dword [esp + 0x1c]
jne 0x49388a
lea ecx, [esp + 0x1c]
call fcn.0048af10
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 8]
mov word [edx + esi*2], 0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, ecx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
neg eax
jno 0x4928d2
inc esi
mov dword [esp + 0x2c], esi
jmp 0x492e7d
mov ecx, 0x6019cc
call fcn.004ff310
jmp 0x49291b
mov dword [esp + 0x38], esi
mov dword [esp + 0x80], 0x44
lea edx, [esp + 0x80]
jmp 0x493bd2
mov eax, edx
lea edx, [esp + 0x10c]
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ecx
lea esi, [esp + 0x80]
mov ecx, 0x11
or ebx, 0x80000
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov esi, eax
mov dword [esp + 0x150], eax
lea eax, [esp + 0x1c]
push eax
push edx
push dword [esp + 0x80]
push dword [esp + 0x24]
push ebx
push 1
push 0
push 0
push dword [esp + 0x10c]
mov edi, dword [esp + 0x2c]
push edi
call dword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x493c9f
mov eax, dword [esp + 0x48]
movsd xmm1, qword [esp + 0x64]
movsd xmm0, qword [esp + 0x6c]
movsd xmm2, qword [esp + 0x5c]
cmp dword [esp + 0x38], 0
mov ebx, dword [esp + 0x44]
movsd qword [eax + 0x10], xmm1
movsd xmm1, qword [esp + 0x1c]
movsd qword [eax + 0x18], xmm0
movsd qword [eax + 8], xmm2
movsd qword [eax], xmm1
je 0x493c49
mov edx, dword [esp + 0x34]
mov ecx, esi
call fcn.004971a0
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
push ebx
call esi
push dword [esp + 0x7c]
call esi
push ebp
call esi
cmp dword [esp + 0xdc], 4
jae 0x493de6
xor eax, eax
xchg byte [0x6019cc], al
cmp al, 2
jne 0x493e03
push 0x6019cc
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
cmp dword [esp + 0x3c], 0
jne 0x493e0a
jmp 0x493e1c
call dword [sym.imp.kernel32.dll_GetLastError]
movzx ecx, word [esp + 0xc4]
mov edx, dword [esp + 0x48]
cmp dword [esp + 0x38], 0
mov edi, dword [esp + 0x44]
mov word [edx + 1], cx
mov ch, byte [esp + 0xc6]
mov byte [edx + 3], ch
mov byte [edx], 0
mov dword [edx + 4], eax
mov dword [edx + 8], 2
je 0x493ce2
mov edx, dword [esp + 0x34]
mov ecx, esi
call fcn.004971a0
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
push edi
call esi
mov edi, dword [esp + 0xdc]
push dword [esp + 0x7c]
call esi
push ebp
call esi
cmp edi, 4
jae 0x493dda
cmp dword [esp + 0x5c], 0
je 0x493d15
push dword [esp + 0x60]
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [esp + 0x64], 0
mov edi, dword [esp + 8]
je 0x493d2a
push dword [esp + 0x68]
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [esp + 0x6c], 0
je 0x493d3b
push dword [esp + 0x70]
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
xchg byte [0x6019cc], al
cmp al, 2
jne 0x493d52
push 0x6019cc
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
cmp dword [esp + 0x3c], 0
je 0x493d6b
push dword [esp + 0x14]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esp + 0x2c], 0
je 0x493d84
push dword [esp + 4]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esp + 0xe8], 0
je 0x493da3
push dword [esp + 0xec]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esp + 0xc], 0
je 0x493db9
push edi
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp byte [esp + 0x10], 0
je 0x493e89
mov ecx, dword [esp + 0x4c]
xor ebx, ebx
mov edx, dword [esp]
test edx, edx
jne 0x4928a2
jmp 0x4928b1
push dword [esp + 0xe0]
jmp 0x492ec9
push dword [esp + 0xe0]
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
xchg byte [0x6019cc], al
cmp al, 2
je 0x493c79
cmp dword [esp + 0x3c], 0
je 0x493e1c
push dword [esp + 0x14]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esp + 0x2c], 0
je 0x493e35
push dword [esp + 4]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esp + 0xe8], 0
je 0x493e54
push dword [esp + 0xec]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esp + 0xc], 0
je 0x493e6a
push edi
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esp], 0
setne al
test byte [esp + 0x10], al
je 0x493e89
push dword [esp + 0x4c]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esp + 0xfc], 4
jb 0x493ea0
push dword [esp + 0x100]
call dword [sym.imp.kernel32.dll_CloseHandle]
add esp, 0x50c
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0048b4b0
ud2
movzx esi, cl
jmp 0x492dc3