Function at 0x467aa8
Capabilities:
Query environment variable

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x1c], eax
jne 0x467ac8
mov dword [ebp - 0x34], 0x7f2bb747
jmp 0x4687b3
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.0045ea6e
test edx, edx
jne 0x467adb
test eax, eax
je 0x467abc
lea eax, [ebp - 0x24]
mov dword [esp], 0xc8
mov dword [esp + 4], eax
call fcn.00468b4c
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x4687b3
mov ebx, dword [ebp - 0x24]
mov ecx, 0x31
lea esi, [ebx + 4]
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx], 0x7f2bb701
mov dword [ebx + 0x5c], 0x12
or eax, 1
mov word [ebx + 0x68], 2
mov dword [ebx + 8], eax
mov dword [esp], 0x4b7ad4
call sub.msvcrt.dll_getenv
test eax, eax
je 0x467b49
xor edi, edi
mov dword [esp], eax
mov dword [esp + 8], edi
mov dword [esp + 4], edi
call sub.msvcrt.dll_strtoul
mov dword [ebx + 0x60], eax
mov eax, dword [ebp + 0xc]
and eax, 0x4000
cmp eax, 1
sbb eax, eax
and eax, 0xfffffffe
add eax, 3
bt dword [ebp + 0xc], 0x13
jae 0x467b66
or eax, 4
or ah, 0x80
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [ebp + 0x14]
call dword [eax + 8]
test eax, eax
jne 0x468797
mov eax, dword [ebx + 4]
mov dword [ebx + 0x88], eax
mov dword [eax + 0x5c], ebx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea edx, [ebx + 0xc]
inc eax
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00468b4c
test eax, eax
jne 0x468797
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
lea eax, [ebp - 0x20]
mov dword [esp], 0x400
mov dword [esp + 4], eax
call fcn.00468b4c
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x468797
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebx + 0x10], eax
mov edi, eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x34]
mov esi, dword [ebp - 0x30]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x30]
mov edi, dword [ebp + 0x10]
mov dword [eax + 0x38], 0x1ef53
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x64]
mov edx, dword [edi + 0x18]
mov edi, eax
and edi, 0x200
mov dword [esi + 0x18], edx
mov dword [ebp - 0x60], edi
je 0x467c43
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 0x1c]
test ecx, ecx
jne 0x467c2f
lea ecx, [edx + 4]
mov esi, dword [ebp - 0x30]
mov dword [esi + 0x1c], ecx
cmp ecx, edx
jae 0x467c49
mov eax, 0x7f2bb747
jmp 0x468797
mov edi, dword [ebp - 0x30]
mov dword [edi + 0x1c], edx
mov esi, dword [ebp + 0x10]
mov edx, dword [esi + 0x14]
test edx, edx
jne 0x467c5f
mov edi, dword [ebp - 0x30]
xor edx, edx
cmp dword [edi + 0x1c], 0
sete dl
mov ecx, dword [ebp - 0x30]
mov esi, dword [ebp + 0x10]
mov dword [ecx + 0x14], edx
mov dx, word [esi + 0x36]
mov edi, ecx
mov word [ecx + 0x36], dx
mov edx, dword [esi + 0x3c]
mov ecx, 1
mov esi, edi
test dx, dx
cmove edx, ecx
mov ecx, esi
mov word [edi + 0x3c], dx
mov edi, dword [ebp + 0x10]
mov edx, dword [edi + 0x5c]
mov dword [esi + 0x5c], edx
mov edx, dword [edi + 0x60]
mov esi, edi
mov edi, ecx
mov dword [ecx + 0x64], eax
mov dword [ecx + 0x60], edx
mov ecx, dword [esi + 0x100]
and edx, 0xfffc1921
mov dword [edi + 0x100], ecx
mov ecx, dword [esi + 0x104]
mov esi, edi
mov dword [edi + 0x104], ecx
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 0x164]
mov word [esi + 0x164], cx
mov ecx, dword [edi + 0x170]
mov edi, dword [ebp + 0x10]
mov dword [esi + 0x170], ecx
mov ecx, dword [ebp + 0x10]
mov cl, byte [ecx + 0x174]
mov byte [esi + 0x174], cl
mov ecx, dword [edi + 0x160]
mov dword [esi + 0x160], ecx
mov ecx, dword [edi + 0x24c]
mov dword [esi + 0x24c], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx + 0x250]
mov dword [esi + 0x250], ecx
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 0x27c]
mov word [esi + 0x27c], cx
mov cx, word [edi + 0x27e]
mov word [esi + 0x27e], cx
jne 0x46877d
test eax, 0xffff0884
jne 0x468784
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x4c]
mov dword [esi + 0x4c], eax
test eax, eax
je 0x467dbd
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x54]
test eax, eax
jne 0x467d5e
mov eax, 0xb
mov esi, dword [ebp - 0x30]
mov dword [esi + 0x54], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x58]
test ax, ax
jne 0x467d73
mov eax, esi
jmp 0x467dc7
mov edi, dword [ebp - 0x30]
mov word [edi + 0x58], ax
cmp ax, 0x9f
jbe 0x467dcd
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x15c]
test ax, ax
jne 0x467d93
mov eax, 0x20
mov ecx, dword [ebp - 0x30]
mov word [ecx + 0x15c], ax
mov eax, dword [ebp + 0x10]
mov ax, word [eax + 0x15e]
test ax, ax
jne 0x467db1
mov eax, 0x20
mov esi, dword [ebp - 0x30]
mov word [esi + 0x15e], ax
jmp 0x467dcd
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x54], 0xb
mov word [eax + 0x58], pe_nt_image_headers32
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp - 0x30]
mov eax, dword [eax + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [ebx + 0x60]
test eax, eax
jne 0x467deb
xor ecx, ecx
mov dword [esp], ecx
call dword [sym.imp.msvcrt.dll_time]
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov edi, 0x400
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x108], eax
mov eax, dword [ecx + 0x18]
mov dword [ecx + 0x48], edx
mov ecx, eax
shl edi, cl
mov dword [ebp - 0x40], edi
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x18], edi
mov edi, dword [ebp - 0x30]
mov edx, dword [edi + 0x1c]
mov ecx, edx
sub ecx, eax
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 0x60], 0
mov dword [ebx + 0x64], ecx
mov edi, dword [eax + 0x20]
je 0x467ec0
mov esi, dword [eax + 0x24]
test edi, edi
je 0x467e5d
test esi, esi
je 0x467e63
mov eax, esi
xor edx, edx
shld edx, eax, cl
shl eax, cl
test cl, 0x20
je 0x467e4b
mov edx, eax
xor eax, eax
test edx, edx
jne 0x467c39
cmp eax, edi
jne 0x467c39
jmp 0x467e90
test esi, esi
jne 0x467e90
jmp 0x467e74
mov esi, edi
xor edi, edi
shrd esi, edi, cl
shr edi, cl
test cl, 0x20
cmovne esi, edi
jmp 0x467e90
mov eax, edx
add eax, 0xf
cmp eax, 0x1f
ja 0x467e86
mov esi, dword [ebp - 0x40]
shl esi, 3
jmp 0x467e90
mov eax, dword [ebp - 0x40]
lea esi, [eax*8 - 8]
mov eax, 0xfff8
cmp esi, eax
cmova esi, eax
mov eax, dword [ebp - 0x30]
xor edi, edi
xor edx, edx
shld edi, esi, cl
mov dword [eax + 0x24], esi
shl esi, cl
and cl, 0x20
cmovne edi, esi
cmovne esi, edx
cmp edi, 0
ja 0x467c39
mov dword [eax + 0x20], esi
jmp 0x467eef
test edi, edi
jne 0x467ece
mov eax, dword [ebp - 0x40]
lea edi, [eax*8]
mov ecx, edx
mov eax, 0x400
shl eax, cl
mov ecx, dword [ebp - 0x30]
cdq
idiv dword [ebp - 0x40]
imul eax, eax, 0xfff8
cmp eax, edi
cmova eax, edi
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
mov eax, dword [ebp + 0x10]
mov esi, 0xffffffff
mov edi, esi
mov dword [esp], eax
call fcn.0045ea6e
mov ecx, dword [ebx + 0x64]
shl esi, cl
test cl, 0x20
je 0x467f0f
mov edi, esi
xor esi, esi
and esi, eax
mov eax, dword [ebp - 0x30]
and edi, edx
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov dword [esp], eax
call fcn.0045eb2e
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.0045eb73
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.0045eb9e
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call fcn.0045eb73
mov edi, eax
mov eax, dword [ebp + 0x10]
mov esi, edx
mov dword [esp], eax
call fcn.0045ea6e
cmp edi, eax
sbb esi, edx
jae 0x467c39
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp - 0x30]
mov ax, word [eax + 0x166]
mov word [edi + 0x166], ax
test byte [edi + 0x60], 8
je 0x4680dc
xor esi, esi
or dword [ebx + 8], 6
mov dword [ebx + 0x1c], esi
jmp 0x468776
mov eax, dword [ebp + 0x10]
mov dx, word [eax + 0xfe]
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0x60]
mov esi, eax
mov dword [ebp - 0x40], eax
and esi, 0x80
setne al
test dx, dx
jne 0x467fbd
movzx edx, al
shl edx, 6
mov ecx, dword [ebp - 0x30]
mov word [ecx + 0xfe], dx
test dx, dx
je 0x468120
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x18]
mov eax, 0x400
mov dword [esp], edi
mov edi, 1
shl eax, cl
test esi, esi
mov ecx, 0x20
cmove edx, ecx
movzx ecx, dx
cdq
idiv ecx
mov dword [esp + 4], eax
call fcn.00468df6
mov ecx, dword [ebx + 0x14]
mov dword [ebx + 0x20], eax
cmp ecx, 0xfff
ja 0x468017
mov eax, 0x1000
xor edx, edx
div ecx
mov edi, eax
test esi, esi
je 0x46812d
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call fcn.0045ea6e
xor ecx, ecx
mov dword [esp + 8], edi
mov dword [esp + 0xc], ecx
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00487e10
test edx, edx
je 0x46812d
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x468054
or eax, 0xffffffff
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x20]
mov dword [edx], eax
mov eax, dword [esi + 0x4c]
mov edx, dword [esi]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
mov eax, 0xc
je 0x468073
mov eax, dword [esi + 0x54]
inc eax
cmp edx, eax
jae 0x468079
mov dword [esi], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x50], eax
mov dword [esp + 4], eax
mov eax, dword [esi]
mov dword [esp], eax
call fcn.00468df6
mov edi, eax
mov eax, dword [ebx + 0x14]
shl eax, 3
cmp eax, edi
jae 0x468227
cmp dword [ebp - 0x60], 0
jne 0x46821d
mov eax, dword [esi + 0x20]
cmp eax, 0xff
jbe 0x46821d
sub eax, 8
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.0045ea6e
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0045eb2e
mov eax, dword [esi + 0x20]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x30]
xor edi, edi
mov esi, dword [eax + 0x20]
mov dword [esp], eax
call fcn.0045ea6e
mov ecx, dword [ebp - 0x30]
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
sub eax, dword [ecx + 0x14]
sbb edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00468e09
mov dword [ebx + 0x1c], eax
mov edi, eax
test eax, eax
jne 0x467f94
mov eax, 0x7f2bb72c
jmp 0x468797
test al, al
je 0x467fd0
jmp 0x46878b
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x468054
mov eax, dword [ebp - 0x20]
xor esi, esi
mov dword [esp], eax
call fcn.0045ea6e
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00487e10
jmp 0x468054
mov eax, dword [ebp - 0x40]
imul edi, eax
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x5c]
add edi, eax
mov eax, dword [ebp - 0x50]
shr edi, cl
mov dword [ebx + 0x28], edi
mov edi, dword [ebp - 0x40]
imul eax, edi
mov dword [esi], eax
mov dword [esi + 0x10], eax
xor eax, eax
test byte [esi + 0x5c], 0x10
jne 0x4682b2
mov edi, dword [ebp + 0x10]
mov ecx, dword [esi + 0x18]
mov dx, word [edi + 0xce]
test dx, dx
cmove edx, eax
mov word [esi + 0xce], dx
movzx eax, dx
mov edx, 0x400
shl edx, cl
shr edx, 2
cmp edx, eax
jb 0x468792
mov edi, dword [ebx + 0x20]
mov edx, dword [ebx + 0x10]
mov dword [ebp - 0x40], edi
mov edi, dword [esi + 0x20]
mov ecx, dword [ebp - 0x40]
add eax, ecx
lea ecx, [edi + edi*2]
shr ecx, 2
cmp ecx, eax
jae 0x4681f0
mov eax, dword [ebp + 0x10]
or dword [edx + 0x60], 0x10
and dword [edx + 0x5c], 0xffffffef
mov ax, word [eax + 0xce]
mov word [esi + 0xce], ax
mov eax, dword [ebx + 0x28]
movzx ecx, word [esi + 0xce]
mov dword [ebp - 0x48], eax
add ecx, eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], ecx
lea ecx, [eax + ecx + 3]
test byte [edx + 0x60], 0x10
je 0x468215
mov ecx, dword [ebp - 0x50]
add ecx, 4
cmp edi, ecx
jae 0x468346
mov eax, 0x7f2bb75b
jmp 0x468797
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x54], eax
mov cl, byte [ebp - 0x54]
mov eax, 0x400
shl eax, cl
cmp dword [ebp - 0x48], 0
mov ecx, pe_nt_image_headers32
mov dword [ebp - 0x38], eax
je 0x468249
movzx ecx, word [esi + 0x58]
mov eax, dword [ebp - 0x38]
cdq
idiv ecx
mov edx, 0x10000
sub edx, eax
mov eax, dword [ebp - 0x38]
cmp edx, edi
cmovbe edi, edx
dec eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edi
cmp dword [ebp - 0x48], 0
mov edi, pe_nt_image_headers32
je 0x468274
movzx edi, word [esi + 0x58]
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x5c]
lea ecx, [eax + 0xa]
mov eax, dword [ebp - 0x58]
imul eax, edi
add eax, edx
mov edx, dword [ebp - 0x38]
shr eax, cl
imul eax, edx
xor edx, edx
div edi
mov edx, 8
cmp eax, edx
cmovb eax, edx
and eax, 0xfffffff8
mov dword [ebp - 0x40], eax
mul dword [ebp - 0x50]
cmp edx, 0
jbe 0x468160
dec dword [ebp - 0x58]
jmp 0x468265
mov edi, dword [ebx + 0x10]
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x18]
mov dword [ebp - 0x40], eax
mov eax, 0x400
shl eax, cl
mov ecx, 0x20
test byte [edi + 0x60], 0x80
je 0x4682d7
movzx ecx, word [edi + 0xfe]
cdq
mov dword [esp], edi
idiv ecx
mov dword [ebp - 0x48], eax
call fcn.0045ea6e
mov ecx, eax
mov eax, edx
mov edx, 0x3ffffe
cmp edx, ecx
mov edx, 0
sbb edx, eax
mov eax, 0xffffffff
jb 0x468309
mov dword [esp], edi
call fcn.0045ea6e
shl eax, 0xa
mov edx, dword [ebp - 0x40]
mov dword [esp + 4], edx
sub eax, dword [edi + 0x14]
mov dword [esp], eax
call fcn.00468df6
mov ecx, dword [ebp - 0x48]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00468df6
mov ecx, dword [edi + 0x18]
mov edx, eax
mov eax, 0x400
sub edx, dword [ebx + 0x20]
shl eax, cl
shr eax, 2
cmp eax, edx
cmova eax, edx
jmp 0x46818d
mov edi, dword [ebp - 0x48]
mov eax, dword [ebx + 0x1c]
add edi, 2
test byte [esi + 0x5d], 2
je 0x468375
cmp eax, 2
mov eax, dword [ebp + 0x10]
jne 0x468366
cmp dword [eax + 0x24c], 0
jmp 0x46836d
cmp dword [eax + 0x250], 0
setne al
movzx eax, al
jmp 0x468382
dec eax
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.004604eb
test eax, eax
je 0x468397
mov eax, dword [ebx + 0x20]
lea edx, [edi + eax + 1]
movzx eax, word [esi + 0xce]
lea edi, [eax + edx]
mov dword [esp], esi
call fcn.0045ea6e
mov ecx, dword [esi + 0x20]
sub eax, dword [esi + 0x14]
sbb edx, 0
mov dword [esp], eax
mov dword [esp + 8], ecx
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
call fcn.00487f30
mov dword [ebp - 0x3c], edx
mov edx, dword [ebx + 0x1c]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
cmp edx, 1
jne 0x4683df
test ecx, ecx
je 0x4684fe
cmp ecx, edi
jb 0x468116
test ecx, ecx
je 0x4684fe
lea eax, [edi + 0x32]
cmp ecx, eax
jae 0x4684fe
mov dword [esp], esi
call fcn.0045ea6e
sub eax, dword [ebp - 0x40]
sbb edx, dword [ebp - 0x3c]
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0045eb2e
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.0045eb73
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
fild qword [ebp - 0x40]
test edx, edx
jns 0x46842e
fadd dword [0x4b7b0c]
mov eax, dword [ebp + 0x10]
fstp qword [ebp - 0x40]
fld qword [ebp - 0x40]
fmul dword [0x4b7b10]
mov dword [esp], eax
fstp qword [ebp - 0x40]
call fcn.0045ea6e
mov dword [ebp - 0x48], eax
test edx, edx
mov dword [ebp - 0x44], edx
fild qword [ebp - 0x48]
fld dword [0x4b7b10]
fstp qword [ebp - 0x48]
jns 0x468464
fadd dword [0x4b7b0c]
fstp qword [ebp - 0x50]
fld qword [ebp - 0x50]
fdivr qword [ebp - 0x40]
mov dword [esp], esi
fstp qword [ebp - 0x40]
call fcn.0045ea6e
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
fild qword [ebp - 0x50]
test edx, edx
jns 0x46848b
fadd dword [0x4b7b0c]
fstp qword [ebp - 0x50]
fld qword [ebp - 0x50]
fmul qword [ebp - 0x40]
fdiv qword [ebp - 0x48]
fld dword [0x4b7b14]
fxch st(1)
fcomi st(1)
jae 0x4684c4
fstp st(1)
fnstcw word [ebp - 0x2a]
mov ax, word [ebp - 0x2a]
or ah, 0xc
mov word [ebp - 0x2c], ax
fldcw word [ebp - 0x2c]
fistp qword [ebp - 0x40]
fldcw word [ebp - 0x2a]
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
jmp 0x4684e9
fnstcw word [ebp - 0x2a]
fsubrp st(1)
mov ax, word [ebp - 0x2a]
or ah, 0xc
mov word [ebp - 0x2c], ax
fldcw word [ebp - 0x2c]
fistp qword [ebp - 0x40]
fldcw word [ebp - 0x2a]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
add edx, 0x80000000
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], esi
call fcn.0045eb9e
jmp 0x4680dc
test byte [esi + 0x5d], 2
je 0x468550
cmp dword [esi + 0x24c], edx
jb 0x468515
lea eax, [edx - 1]
mov dword [esi + 0x24c], eax
cmp dword [esi + 0x250], edx
jb 0x468524
dec edx
mov dword [esi + 0x250], edx
mov eax, dword [esi + 0x24c]
cmp eax, dword [esi + 0x250]
jne 0x46853a
xor edx, edx
mov dword [esi + 0x250], edx
mov edx, dword [esi + 0x250]
cmp edx, eax
jae 0x468550
mov dword [esi + 0x24c], edx
mov dword [esi + 0x250], eax
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea edx, [ebp - 0x1c]
add eax, 0x50
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00468b4c
test eax, eax
jne 0x468797
mov edi, dword [ebp - 0x1c]
mov dword [esp + 4], 0x4b7ae8
mov dword [esp], edi
call sub.msvcrt.dll_strcpy
mov eax, dword [ebx + 0xc]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
lea eax, [ebx + 0x30]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.0045e5e6
test eax, eax
jne 0x468797
mov dword [esp + 4], 0x4b7afa
mov dword [esp], edi
call sub.msvcrt.dll_strcpy
mov eax, dword [ebx + 0xc]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
lea eax, [ebx + 0x2c]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.0045e408
test eax, eax
jne 0x468797
mov eax, dword [ebp - 0x1c]
xor edi, edi
mov dword [esp], eax
call sub.msvcrt.dll_free
lea eax, [ebx + 0x24]
mov dword [ebp - 0x1c], edi
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x20]
mov dword [esp], eax
call fcn.00468ba4
test eax, eax
jne 0x468797
mov ecx, dword [ebx + 0x20]
imul ecx, dword [ebx + 0x14]
mov edi, dword [ebx + 0x24]
rep stosb byte es:[edi], al
xor ecx, ecx
xor edi, edi
mov dword [ebp - 0x40], ecx
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x3c], ecx
mov eax, dword [eax + 0x64]
and eax, 0x410
mov dword [ebp - 0x48], eax
mov eax, dword [esi + 0x54]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x1c]
cmp edi, eax
jae 0x46872b
cmp dword [ebp - 0x48], 0
je 0x4686b4
dec eax
cmp eax, edi
je 0x468671
mov dword [esp + 8], 2
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.0045f222
mov dword [esp + 8], 1
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.0045f222
cmp dword [ebp - 0x30], 0
mov eax, dword [esi + 0x28]
je 0x4686a4
cmp dword [ebp - 0x30], eax
jae 0x46869f
mov edx, dword [ebp - 0x30]
sub eax, edx
xor edx, edx
mov dword [ebp - 0x30], edx
jmp 0x4686a4
sub dword [ebp - 0x30], eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.0045f167
mov eax, dword [ebx + 0x30]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00472a58
mov edx, dword [ebx + 0x10]
cmp byte [edx + 0x174], 0
je 0x4686da
mov edx, dword [ebx + 0x28]
lea eax, [eax + edx + 2]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
add dword [ebp - 0x40], eax
adc dword [ebp - 0x3c], 0
call fcn.0045efe1
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0x28]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.0045f063
xor eax, eax
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.0045f0e5
mov dword [esp + 4], edi
inc edi
mov dword [esp], ebx
call fcn.00461c53
jmp 0x468647
mov ecx, dword [ebx + 0x64]
mov eax, 0xffffffff
xor edi, edi
mov dword [esp], esi
mov edx, eax
shl eax, cl
test cl, 0x20
cmovne edx, eax
cmovne eax, edi
and edx, dword [ebp - 0x3c]
and eax, dword [ebp - 0x40]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0045ec0e
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 0x14]
or dword [esi + 0x160], 1
mov edx, dword [eax + 4]
or dword [ebx + 8], 0x36
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
jmp 0x4687b3
mov eax, 0x7f2bb743
jmp 0x468797
mov eax, 0x7f2bb744
jmp 0x468797
mov eax, 0x7f2bb722
jmp 0x468797
mov eax, 0x7f2bb75d
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov dword [esp], edx
call sub.msvcrt.dll_free
mov dword [esp], ebx
call fcn.004653e6
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret