Function at 0x41ae80
Capabilities:
Create process on windows
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x422c60
mov esi, edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x9c], ecx
lea ecx, [ebp - 0x18]
call 0x41aeb0
pop ebx
mov edx, dword fs:[0]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov dword [ebp - 0x138], eax
movzx eax, byte [esi + 0x2c]
mov edi, dword [esi + 0x28]
test al, al
sete cl
test edi, edi
sete dl
and dl, cl
je 0x41af05
lea eax, [ebp - 0x144]
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x98], eax
jmp 0x41b84a
test al, al
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x30], dl
mov dword [ebp - 0x118], 0
jne 0x41b0b5
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
je 0x41e2fb
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x110], eax
nop word cs:[eax + eax]
nop dword [eax + eax]
lea eax, [ebp - 0x114]
mov dword [ebp - 0x10], 5
push eax
lea eax, [ebp - 0x558]
push eax
call fcn.00418e40
add esp, 8
cmp byte [ebp - 0x54c], 2
je 0x41b0a3
movsd xmm0, qword [ebp - 0x558]
movsd xmm1, qword [ebp - 0x550]
lea eax, [ebp - 0x548]
lea edx, [ebp - 0xcc]
mov dword [ebp - 0x10], 7
movsd qword [ebp - 0xdc], xmm1
movsd qword [ebp - 0xe4], xmm0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0xdc]
movsd qword [ebp - 0x8c], xmm1
movsd qword [ebp - 0x94], xmm0
add ecx, eax
mov dword [ebp - 0xcc], ecx
lea ecx, [ebp - 0x108]
mov dword [ebp - 0xc8], eax
mov word [ebp - 0xc4], 0
call fcn.0040c8f0
movsd xmm1, qword [ebp - 0x550]
movsd xmm0, qword [ebp - 0x558]
mov eax, dword [ebp - 0x100]
lea ecx, [ebp - 0x6c]
mov byte [ebp - 0x9d], 0
mov dword [ebp - 0x10], 6
lea edx, [ebp - 0x120]
movsd qword [ebp - 0x74], xmm1
movsd xmm1, qword [ebp - 0x108]
movsd qword [ebp - 0x7c], xmm0
mov dword [ecx + 8], eax
lea eax, [ebp - 0x548]
movsd xmm2, qword [eax]
movsd qword [ecx], xmm1
movsd xmm1, qword [eax + 8]
lea eax, [ebp - 0xcc]
lea ecx, [ebp - 0x108]
movsd qword [ebp - 0xcc], xmm2
movsd qword [ebp - 0xc4], xmm1
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.004096a0
add esp, 8
cmp byte [ebp - 0xfc], 2
je 0x41af50
mov eax, dword [ebp - 0x108]
test eax, eax
je 0x41af50
push 1
push eax
push dword [ebp - 0x104]
call fcn.00406dd0
add esp, 0xc
jmp 0x41af50
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov esi, dword [ebp - 0x48]
mov edi, dword [ebp - 0x28]
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
xor edx, edx
test ecx, ecx
sete dl
cmove edi, ecx
add edx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], ecx
mov dword [ebp - 0xf8], edx
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xe8], edi
mov dword [ebp - 0x10], 1
nop dword [eax + eax]
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x10], 1
call fcn.00407280
mov dword [ebp - 0x28], edx
mov edi, eax
test eax, eax
je 0x41b65f
mov eax, dword [ebp - 0x28]
cmp byte [eax + 0xc], 2
jne 0x41b2b0
mov eax, dword [ebp - 0x11c]
test eax, eax
je 0x41b100
mov edx, dword [ebp - 0x120]
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x28], edx
push dword [edi + 0x18]
push dword [edi + 0x14]
mov dword [ebp - 0x24], eax
push eax
call fcn.0040bff0
add esp, 0xc
cmp dword [ebp - 0x94], 0
jne 0x41b100
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x88]
mov byte [ebp - 0x12c], 0
test ecx, ecx
jne 0x41b1b7
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x74], edx
lea ecx, [ebp - 0x558]
lea edx, [ebp - 0x7c]
push eax
call fcn.0040ba10
add esp, 4
jmp 0x41b554
movzx edx, word [eax + 0x1ea]
mov eax, dword [eax + edx*4 + 0x1ec]
dec ecx
jne 0x41b1b0
movzx ecx, word [eax + 0x1ea]
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x10], 1
lea edx, [ebp - 0x114]
dec ecx
mov dword [ebp - 0x10c], ecx
lea ecx, [ebp - 0x558]
push eax
call fcn.0040ba10
add esp, 4
movsd xmm2, qword [ebp - 0x540]
movsd xmm1, qword [ebp - 0x548]
mov eax, dword [ebp - 0x530]
movsd xmm0, qword [ebp - 0x538]
mov edx, dword [ebp - 0x528]
mov ecx, dword [ebp - 0x524]
movsd qword [ebp - 0xb4], xmm2
movsd qword [ebp - 0xbc], xmm1
movsd xmm2, qword [ebp - 0x558]
movsd xmm1, qword [ebp - 0x550]
mov dword [ebp - 0xa4], eax
movsd qword [ebp - 0xac], xmm0
movsd qword [ebp - 0xc4], xmm1
movsd qword [ebp - 0xcc], xmm2
movzx eax, word [edx + 0x1ea]
cmp ecx, eax
mov eax, edx
jb 0x41b43a
nop word [eax + eax]
mov eax, dword [edx + 0xb0]
test eax, eax
je 0x41b438
movzx ecx, word [edx + 0x1e8]
mov edx, eax
cmp cx, word [eax + 0x1ea]
jae 0x41b280
jmp 0x41b43a
mov esi, dword [edi + 8]
mov eax, dword [edi + 4]
test esi, esi
je 0x41b2dc
mov dword [ebp - 0x24], eax
js 0x41e20c
push 1
push esi
call fcn.00406dc0
add esp, 8
mov ebx, eax
test eax, eax
mov eax, dword [ebp - 0x24]
jne 0x41b2e1
jmp 0x41e1ad
mov ebx, 1
push esi
push eax
push ebx
call fcn.00430ff0
add esp, 0xc
movzx eax, byte [edi + 0xc]
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], esi
mov byte [ebp - 0x70], al
mov esi, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
test esi, esi
je 0x41b344
xor ebx, ebx
cmp esi, 0x40000000
setb al
jae 0x41e1bd
mov bl, al
lea edx, [esi + esi]
add ebx, ebx
test edx, edx
js 0x41e1ce
mov dword [ebp - 0x24], edx
je 0x41b34d
push ebx
push edx
mov edi, ecx
call fcn.00406dc0
mov ecx, edi
add esp, 8
mov edi, eax
test edi, edi
jne 0x41b357
jmp 0x41e1df
mov edi, 2
xor eax, eax
jmp 0x41b35a
mov edi, ebx
test edi, edi
je 0x41e1df
mov eax, dword [ebp - 0x24]
push eax
push ecx
push edi
call fcn.00430ff0
add esp, 0xc
movsd xmm0, qword [ebp - 0x7c]
movsd xmm1, qword [ebp - 0x74]
mov eax, dword [ebp - 0x28]
movsd qword [ebp - 0x558], xmm0
movsd qword [ebp - 0x550], xmm1
mov dword [ebp - 0x548], esi
mov dword [ebp - 0x544], edi
mov dword [ebp - 0x540], esi
mov ebx, dword [eax + 8]
mov esi, dword [eax + 4]
test ebx, ebx
je 0x41b3ba
js 0x41e1f7
push 1
push ebx
call fcn.00406dc0
add esp, 8
mov edi, eax
test eax, eax
jne 0x41b3bf
jmp 0x41e216
mov edi, 1
push ebx
push esi
push edi
call fcn.00430ff0
add esp, 0xc
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xcc]
lea edx, [ebp - 0x120]
movzx eax, byte [eax + 0xc]
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], ebx
mov byte [ebp - 0x7d], 0
mov dword [ebp - 0x10], 2
mov byte [ebp - 0x70], al
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x558]
push eax
call fcn.004096a0
add esp, 8
cmp byte [ebp - 0xc0], 2
je 0x41b100
mov eax, dword [ebp - 0xcc]
test eax, eax
je 0x41b100
push 1
push eax
push dword [ebp - 0xc8]
call fcn.00406dd0
add esp, 0xc
jmp 0x41b100
mov eax, edx
lea edx, [ebp - 0xb0]
movsd xmm2, qword [ebp - 0xc4]
movsd xmm0, qword [edx]
movsd xmm1, qword [edx + 8]
lea edx, [ecx + ecx*8]
lea edx, [edx + edx*2]
add edx, ecx
shl ecx, 4
movsd qword [ebp - 0x550], xmm1
movsd qword [ebp - 0x558], xmm0
mov esi, dword [eax + edx + 0xcc]
mov dword [ebp - 0x64], esi
mov esi, dword [ebp - 0xb4]
movsd xmm0, qword [eax + edx + 0xc4]
movsd qword [ebp - 0x6c], xmm0
movsd xmm0, qword [eax + edx + 0xb4]
movsd xmm1, qword [eax + edx + 0xbc]
movsd qword [ebp - 0x74], xmm1
movsd qword [ebp - 0x7c], xmm0
movsd xmm0, qword [ebp - 0xbc]
movsd xmm1, qword [ebp - 0xcc]
mov dword [eax + edx + 0xcc], esi
movsd qword [eax + edx + 0xbc], xmm2
movsd qword [eax + edx + 0xb4], xmm1
movsd qword [eax + edx + 0xc4], xmm0
lea edx, [ebp - 0x60]
movsd xmm0, qword [eax + ecx]
movsd xmm1, qword [eax + ecx + 8]
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm0
movsd xmm0, qword [ebp - 0x558]
movsd xmm1, qword [ebp - 0x550]
movsd qword [eax + ecx + 8], xmm1
movsd qword [eax + ecx], xmm0
movsd xmm1, qword [ebp - 0x74]
mov eax, dword [ebp - 0x54]
movsd xmm0, qword [ebp - 0x7c]
movsd xmm2, qword [ebp - 0x64]
movsd qword [ebp - 0x550], xmm1
movsd xmm1, qword [ebp - 0x6c]
mov dword [ebp - 0x530], eax
movsd qword [ebp - 0x558], xmm0
movsd qword [ebp - 0x540], xmm2
movsd qword [ebp - 0x548], xmm1
movsd xmm1, qword [ebp - 0x5c]
movsd qword [ebp - 0x538], xmm1
movsd xmm2, qword [ebp - 0x540]
movsd xmm1, qword [ebp - 0x548]
mov eax, dword [ebp - 0x530]
movsd xmm0, qword [ebp - 0x538]
dec dword [ebp - 0x118]
cmp byte [ebp - 0x12c], 0
movsd qword [ebp - 0x64], xmm2
movsd qword [ebp - 0x6c], xmm1
movsd xmm2, qword [ebp - 0x558]
movsd xmm1, qword [ebp - 0x550]
mov dword [ebp - 0x54], eax
movsd qword [ebp - 0x5c], xmm0
movsd qword [ebp - 0x74], xmm1
movsd qword [ebp - 0x7c], xmm2
je 0x41b5e8
mov edx, dword [ebp - 0x28]
test edx, edx
je 0x41e29f
mov ecx, dword [ebp - 0x24]
dec edx
mov eax, dword [ecx + 0x1ec]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x120], edx
mov dword [eax + 0xb0], 0
push 4
push 0x21c
push ecx
call fcn.00406dd0
add esp, 0xc
cmp byte [ebp - 0x70], 2
je 0x41b100
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x60]
movzx ebx, byte [ebp - 0x54]
test eax, eax
mov dword [ebp - 0x28], ecx
je 0x41b629
push 1
push eax
push dword [ebp - 0x78]
mov byte [ebp - 0x24], bl
mov ebx, esi
mov esi, edx
call fcn.00406dd0
mov edx, esi
mov esi, ebx
movzx ebx, byte [ebp - 0x24]
add esp, 0xc
test edi, edi
je 0x41b63b
add edi, edi
push 2
push edi
push edx
call fcn.00406dd0
add esp, 0xc
cmp bl, 2
je 0x41b100
test esi, esi
je 0x41b100
push 1
push esi
push dword [ebp - 0x28]
call fcn.00406dd0
add esp, 0xc
jmp 0x41b0f1
movsd xmm0, qword [ebp - 0x120]
mov ecx, dword [ebp - 0x118]
cmp byte [ebp - 0x30], 0
lea eax, [ebp - 0x144]
mov dword [ebp - 0x98], eax
movsd qword [ebp - 0x144], xmm0
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x148], 1
je 0x41b6a6
mov esi, dword [ebp - 0x48]
mov dword [ebp - 0x2c], 0
jmp 0x41b84a
push 1
push 4
call fcn.00406dc0
add esp, 8
test eax, eax
je 0x41e2df
mov ecx, eax
lea edx, [ebp - 0x558]
mov dword [ebp - 0x7c], 4
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], 4
mov dword [eax], 0x48544150
mov byte [ebp - 0x70], 0
mov dword [ebp - 0x10], 0x19
add ecx, 4
mov dword [ebp - 0x558], ecx
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x554], eax
mov word [ebp - 0x550], 0
call fcn.0040c8f0
movsd xmm1, qword [ebp - 0x74]
movsd xmm0, qword [ebp - 0x7c]
mov eax, dword [ebp - 0xc4]
mov edx, dword [ebp - 0x140]
movsd qword [ebp - 0x550], xmm1
movsd xmm1, qword [ebp - 0xcc]
movsd qword [ebp - 0x558], xmm0
mov dword [ebp - 0x540], eax
mov dword [ebp - 0x30], eax
test edx, edx
movsd qword [ebp - 0x548], xmm1
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0x24], eax
je 0x41b808
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x44], eax
movzx esi, word [edx + 0x1ea]
lea ecx, [edx + 0xb4]
lea edi, [edx - 8]
mov dword [ebp - 0x34], edx
lea eax, [esi + esi*8]
mov dword [ebp - 0x50], esi
lea ebx, [eax + eax*2]
add ebx, esi
mov esi, 0xffffffff
nop word [eax + eax]
test ebx, ebx
je 0x41b7c4
lea eax, [ecx + 0x1c]
mov dword [ebp - 0x28], eax
push 1
push dword [ecx + 0x18]
push dword [ecx + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
mov ecx, dword [ebp - 0x28]
add ebx, 0xffffffe4
add edi, 0x10
inc esi
cmp eax, 3
je 0x41b790
cmp eax, 1
jne 0x41b7e2
jmp 0x41b7c7
mov esi, dword [ebp - 0x50]
mov eax, dword [ebp - 0x44]
sub eax, 1
jb 0x41c13a
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov edx, dword [edx + esi*4 + 0x1ec]
jmp 0x41b767
cmp eax, 2
jne 0x41e231
cmp dword [ebp - 0x34], 0
mov esi, dword [ebp - 0x48]
je 0x41b812
mov eax, dword [edi - 4]
mov edi, dword [edi]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x558]
test eax, eax
jne 0x41b81c
jmp 0x41b82d
mov esi, dword [ebp - 0x48]
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x558]
test eax, eax
je 0x41b82d
push 1
push eax
push dword [ebp - 0x554]
call fcn.00406dd0
add esp, 0xc
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x34], edi
test eax, eax
je 0x41b84a
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.00406dd0
add esp, 0xc
mov edi, dword [esi + 0x18]
test edi, edi
je 0x41b89d
mov edx, dword [esi + 0x14]
mov ecx, 0x419770
cmp edi, 4
jb 0x41b873
cmp dword [edx], 0x5c3f5c5c
mov eax, 0x419790
mov dword [ebp - 0x10], 9
cmove ecx, eax
movzx eax, byte [edi + edx - 1]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edi
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 9
mov dword [ebp - 0x30], eax
push eax
call ecx
add esp, 4
mov ebx, dword [ebp - 0x28]
test al, al
je 0x41b91d
mov eax, 0x441be0
mov dword [ebp - 0xe0], 2
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0x148], 0
mov eax, dword [ebp - 0xe0]
mov edx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xdc]
mov dword [edx + 4], ecx
mov dword [edx], eax
mov dword [edx + 8], 2
je 0x41b9cc
mov ecx, dword [ebp - 0x140]
test ecx, ecx
je 0x41b9a1
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x554], edx
mov dword [ebp - 0x550], ecx
mov dword [ebp - 0x544], edx
mov dword [ebp - 0x540], ecx
xor ecx, ecx
jmp 0x41b9a8
mov edi, dword [ebp - 0x24]
xor eax, eax
cmp ebx, 3
mov ecx, 0
jbe 0x41b9f7
movzx ecx, byte [ebx + edi - 4]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x2e
jne 0x41b9f5
movzx ecx, byte [edi + ebx - 3]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x65
jne 0x41b9f5
movzx ecx, byte [edi + ebx - 2]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x78
jne 0x41b9f5
mov edx, dword [ebp - 0x30]
mov ecx, edx
add cl, 0xbf
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, dl
cmp cl, 0x65
sete cl
jmp 0x41b9f7
xor eax, eax
mov ecx, 2
mov dword [ebp - 0x558], ecx
mov dword [ebp - 0x548], ecx
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x538], eax
mov dword [ebp - 0x10], 0
call fcn.00408060
cmp dword [ebp - 0x138], 3
jb 0x41b9e1
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x54c
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
lea edx, [edi + ebx]
mov dword [ebp - 0x30], edx
nop dword [eax]
cmp ebx, eax
je 0x41ba3c
movzx edx, byte [edi + eax]
cmp edx, 0x2f
je 0x41ba13
inc eax
cmp edx, 0x5c
jne 0x41ba00
test cl, cl
je 0x41bb04
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 9
lea ecx, [ebp - 0xe4]
mov edx, edi
push ebx
call fcn.00417840
add esp, 4
jmp 0x41c1aa
xor esi, esi
mov eax, edi
jmp 0x41ba5b
xor esi, esi
test dx, dx
je 0x41bbf0
mov dx, 1
test si, si
jne 0x41ba50
cmp eax, dword [ebp - 0x30]
je 0x41bc3a
movzx ebx, byte [eax]
movzx ecx, bl
test bl, bl
js 0x41ba7d
mov ebx, dword [ebp - 0x28]
inc eax
jmp 0x41bad2
movzx edi, byte [eax + 1]
and ecx, 0x1f
and edi, 0x3f
cmp bl, 0xdf
jbe 0x41bac4
movzx esi, byte [eax + 2]
shl edi, 6
and esi, 0x3f
or esi, edi
cmp bl, 0xf0
jb 0x41badb
movzx edi, byte [eax + 3]
and ecx, 7
shl esi, 6
add eax, 4
shl ecx, 0x12
and edi, 0x3f
or edi, esi
or ecx, edi
mov edi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
cmp ecx, 0xffff
jbe 0x41bad2
jmp 0x41baf1
shl ecx, 6
mov ebx, dword [ebp - 0x28]
add eax, 2
or ecx, edi
mov edi, dword [ebp - 0x24]
xor esi, esi
mov edx, ecx
jmp 0x41ba52
shl ecx, 0xc
add eax, 3
or ecx, esi
mov edi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
cmp ecx, 0xffff
jbe 0x41bad2
and ecx, 0x3ff
or ecx, 0xdc00
mov esi, ecx
jmp 0x41ba52
xor ecx, ecx
test ebx, ebx
setns al
js 0x41e392
mov cl, al
mov dword [ebp - 0x2c], ecx
push ecx
push ebx
call fcn.00406dc0
add esp, 8
test eax, eax
je 0x41e3a7
mov esi, eax
push ebx
push edi
push eax
call fcn.00430ff0
add esp, 0xc
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], ebx
mov byte [ebp - 0x70], 0
mov dword [ebp - 0x10], 0x18
lea eax, [ebp - 0x558]
movsd xmm0, qword [ebp - 0x74]
movsd xmm1, qword [ebp - 0x7c]
movsd qword [ebp - 0x550], xmm0
movsd qword [ebp - 0x558], xmm1
push 4
push str..exeprogram_not_found
push eax
call fcn.00419500
add esp, 0xc
movsd xmm0, qword [ebp - 0x558]
movsd xmm1, qword [ebp - 0x550]
mov byte [ebp - 0x9e], 1
mov dword [ebp - 0x10], 0x17
lea ecx, [ebp - 0x558]
movsd qword [ebp - 0x74], xmm1
movsd qword [ebp - 0x7c], xmm0
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x78]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], eax
push eax
call fcn.0041ec60
add esp, 4
cmp dword [ebp - 0x554], 0
je 0x41bc04
mov eax, dword [ebp - 0x550]
movsd xmm0, qword [ebp - 0x558]
mov dword [ebp - 0xd8], eax
movsd qword [ebp - 0xe0], xmm0
mov dword [ebp - 0xe4], 0
jmp 0x41c195
mov dword [ebp - 0xe0], 2
mov eax, 0x441bb4
jmp 0x41b8ac
mov dword [ebp - 0x10], 0x16
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
call fcn.004126f0
add esp, 8
test eax, eax
je 0x41c090
cmp edx, 2
jne 0x41bc65
movzx ecx, word [eax]
cmp ecx, 0x2e2e
jne 0x41bc65
mov edi, 2
xor ecx, ecx
jmp 0x41bca9
cmp ebx, 7
ja 0x41bcae
mov esi, dword [ebp - 0x34]
lea eax, [ebx - 1]
nop word cs:[eax + eax]
nop
sub eax, 1
setb dl
cmp byte [edi], 0x2e
sete dh
je 0x41bcce
inc edi
test dl, dl
je 0x41bc50
jmp 0x41bcce
xor ebx, ebx
mov edi, eax
nop dword [eax]
cmp edx, ebx
je 0x41c150
cmp byte [edi + edx - 1], 0x2e
lea ecx, [edi - 1]
mov esi, ebx
lea ebx, [ebx + 1]
mov edi, ecx
jne 0x41bc70
mov edi, edx
sub edi, ebx
mov dword [ebp - 0x44], edi
inc edi
mov dword [ebp - 0x34], edi
cmp edx, dword [ebp - 0x34]
jb 0x41e3f7
cmp edx, ebx
jne 0x41c3f2
xor ecx, ecx
mov edi, edx
jmp 0x41c156
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 9
push ebx
push edi
push 0x2e
call fcn.0042c880
add esp, 0xc
mov esi, dword [ebp - 0x34]
cmp eax, 1
sete dh
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 0x84], dh
mov dword [ebp - 0x10], 9
test eax, eax
je 0x41be2d
add esi, eax
mov byte [ebp - 0x1d], 1
lea ecx, [ebp - 0x558]
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0xcc]
mov word [ebp - 0xc4], 0
mov byte [ebp - 0xc0], 1
push eax
push ecx
call fcn.00419030
add esp, 8
jmp 0x41bd3a
lea eax, [ebp - 0xcc]
mov byte [ebp - 0x1d], 1
push eax
lea eax, [ebp - 0x558]
push eax
call fcn.00419030
add esp, 8
movzx eax, byte [ebp - 0x54c]
cmp al, 2
je 0x41be2d
mov esi, dword [ebp - 0x550]
mov edx, dword [ebp - 0x558]
mov ecx, dword [ebp - 0x554]
test esi, esi
jne 0x41bd71
test edx, edx
je 0x41bd20
push 1
push edx
push ecx
call fcn.00406dd0
add esp, 0xc
jmp 0x41bd20
lea edi, [ebp - 0x54b]
lea ebx, [ebp - 0x6f]
mov dword [ebp - 0x10], 0x15
movzx edi, word [edi]
mov word [ebx], di
lea edi, [ebp - 0x54b]
mov ah, byte [edi + 2]
mov byte [ebx + 2], ah
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], esi
mov byte [ebp - 0x70], al
push dword [ebp - 0x28]
push dword [ebp - 0x24]
lea eax, [ebp - 0x7c]
push eax
call fcn.00411570
add esp, 0xc
cmp byte [ebp - 0x84], 0
jne 0x41bdcd
push 3
push str.exeNULcmd.exefallback_RNG_broken:
lea eax, [ebp - 0x7c]
push eax
call fcn.00412190
add esp, 0xc
mov edx, dword [ebp - 0x78]
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x2c], edx
push dword [ebp - 0x74]
call fcn.0041ec60
add esp, 4
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x41bdf9
push 1
push eax
push dword [ebp - 0x2c]
call fcn.00406dd0
add esp, 0xc
mov edi, dword [ebp - 0x554]
test edi, edi
jne 0x41d6af
lea eax, [ebp - 0xcc]
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 9
push eax
lea eax, [ebp - 0x558]
push eax
call fcn.00419030
add esp, 8
jmp 0x41bd3a
lea ecx, [ebp - 0xcc]
mov byte [ebp - 0x1d], 1
call fcn.004192f0
cmp byte [ebp - 0xc0], 2
jne 0x41be9a
cmp byte [ebp - 0xcc], 3
jne 0x41bf88
mov ecx, dword [ebp - 0xc8]
mov eax, dword [ecx]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x10], 0x12
push eax
call dword [ecx]
add esp, 4
mov esi, dword [ebp - 0x2c]
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41be88
push dword [eax + 8]
push ecx
push dword [esi]
call fcn.00406dd0
add esp, 0xc
push 4
push 0xc
push esi
call fcn.00406dd0
add esp, 0xc
jmp 0x41bf88
movsd xmm0, qword [ebp - 0xcc]
movsd xmm1, qword [ebp - 0xc4]
mov byte [ebp - 0x9f], 1
mov dword [ebp - 0x10], 0x13
movsd qword [ebp - 0x7c], xmm0
movsd qword [ebp - 0x74], xmm1
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x2c], ecx
push ecx
push eax
call fcn.004125b0
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
je 0x41bee7
cmp dword [ebp - 0x2c], edx
jb 0x41bee7
mov dword [ebp - 0x74], edx
movsd xmm0, qword [ebp - 0x7c]
movsd xmm1, qword [ebp - 0x74]
mov dword [ebp - 0x10], 0x14
lea edx, [ebp - 0x558]
movsd qword [ebp - 0x550], xmm1
movsd qword [ebp - 0x558], xmm0
push ecx
push eax
push edx
call fcn.00411570
add esp, 0xc
cmp byte [ebp - 0x84], 0
jne 0x41bf38
push 3
push str.exeNULcmd.exefallback_RNG_broken:
lea eax, [ebp - 0x558]
push eax
call fcn.00412190
add esp, 0xc
mov edx, dword [ebp - 0x554]
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x2c], edx
push dword [ebp - 0x550]
call fcn.0041ec60
add esp, 4
mov eax, dword [ebp - 0x558]
test eax, eax
je 0x41bf6d
push 1
push eax
push dword [ebp - 0x2c]
call fcn.00406dd0
add esp, 0xc
mov edi, dword [ebp - 0x104]
test edi, edi
je 0x41bf88
mov ecx, dword [ebp - 0x108]
mov eax, dword [ebp - 0x100]
jmp 0x41c487
mov esi, 0x200
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 2
mov dword [ebp - 0x100], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x34], 0
cmp esi, 0x201
jb 0x41bfde
jmp 0x41bff0
jbe 0x41c098
cmp esi, 0x201
jae 0x41bff0
lea ebx, [ebp - 0x558]
mov dword [ebp - 0x44], 0x200
mov edi, esi
jmp 0x41c037
mov edi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x41c025
mov dword [ebp - 0x10], 0x10
lea ecx, [ebp - 0x108]
mov edx, edi
push esi
call fcn.0043d640
add esp, 4
mov edi, dword [ebp - 0x108]
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x50], eax
mov ebx, dword [ebp - 0x50]
mov dword [ebp - 0x100], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x2c], edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, eax
test eax, eax
jne 0x41c05b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41c1bc
cmp esi, edi
jne 0x41bfd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x41e2bf
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jae 0x41bff0
jmp 0x41bfde
mov ebx, dword [ebp - 0x2c]
jmp 0x41c17c
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x10], 0x10
cmp esi, eax
ja 0x41e3e3
lea eax, [ebp - 0x7c]
push esi
push ebx
push eax
call fcn.00410090
add esp, 0xc
mov dword [ebp - 0x10], 0x11
push dword [ebp - 0x28]
push dword [ebp - 0x24]
lea eax, [ebp - 0x7c]
push eax
call fcn.00411570
add esp, 0xc
cmp byte [ebp - 0x84], 0
jne 0x41c0ed
push 3
push str.exeNULcmd.exefallback_RNG_broken:
lea eax, [ebp - 0x7c]
push eax
call fcn.00412190
add esp, 0xc
mov edx, dword [ebp - 0x78]
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x34], edx
push dword [ebp - 0x74]
call fcn.0041ec60
add esp, 4
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x41c119
push 1
push eax
push dword [ebp - 0x34]
call fcn.00406dd0
add esp, 0xc
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xcc]
mov edi, dword [ebp - 0xc8]
xor ebx, ebx
mov dword [ebp - 0x34], eax
mov al, 1
mov dword [ebp - 0x44], eax
jmp 0x41c1cf
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x558]
test eax, eax
jne 0x41b81c
jmp 0x41b82d
mov ecx, eax
xor eax, eax
mov esi, edx
mov ebx, dword [ebp - 0x2c]
test eax, eax
cmovne ecx, eax
test ecx, ecx
je 0x41c17c
test eax, eax
cmove edi, esi
add ecx, edi
sub ecx, dword [ebp - 0x28]
cmp ebx, ecx
jb 0x41c17c
mov ebx, ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x10], 0x16
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0x16
lea ecx, [ebp - 0xe4]
push ebx
call fcn.00417840
add esp, 4
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x41c1aa
push 1
push eax
push dword [ebp - 0x28]
call fcn.00406dd0
add esp, 0xc
cmp dword [ebp - 0xe4], 0
jne 0x41b8b2
jmp 0x41c499
mov dword [ebp - 0x44], 0
mov bl, 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x41c1ea
add eax, eax
push 2
push eax
push dword [ebp - 0x50]
mov esi, ecx
call fcn.00406dd0
mov ecx, esi
add esp, 0xc
test edi, edi
sete al
or bl, al
cmp bl, 1
jne 0x41c47c
cmp byte [ebp - 0x44], 0
je 0x41c210
test edi, edi
je 0x41c252
test ecx, ecx
je 0x41c252
add ecx, ecx
push 2
push ecx
push edi
jmp 0x41c24a
cmp cl, 3
jne 0x41c252
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [ebp - 0x10], 0xf
push eax
mov dword [ebp - 0x2c], edi
call dword [ecx]
add esp, 4
mov esi, dword [ebp - 0x2c]
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41c245
push dword [eax + 8]
push ecx
push dword [esi]
call fcn.00406dd0
add esp, 0xc
push 4
push 0xc
push esi
call fcn.00406dd0
add esp, 0xc
mov esi, 0x200
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 2
mov dword [ebp - 0x100], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x34], 0
cmp esi, 0x201
jb 0x41c2a2
jmp 0x41c2b3
jbe 0x41c353
cmp esi, 0x201
jae 0x41c2b3
lea ebx, [ebp - 0x558]
mov dword [ebp - 0x44], 0x200
mov edi, esi
jmp 0x41c2fa
mov edi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x41c2e8
mov dword [ebp - 0x10], 0xd
lea ecx, [ebp - 0x108]
mov edx, edi
push esi
call fcn.0043d640
add esp, 4
mov edi, dword [ebp - 0x108]
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x50], eax
mov ebx, dword [ebp - 0x50]
mov dword [ebp - 0x100], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x2c], edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, eax
test eax, eax
jne 0x41c31e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41c40e
cmp esi, edi
jne 0x41c294
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x41e372
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jae 0x41c2b3
jmp 0x41c2a2
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x10], 0xd
cmp esi, eax
ja 0x41e411
lea eax, [ebp - 0x7c]
push esi
push ebx
push eax
call fcn.00410090
add esp, 0xc
mov dword [ebp - 0x10], 0xe
push dword [ebp - 0x28]
push dword [ebp - 0x24]
lea eax, [ebp - 0x7c]
push eax
call fcn.00411570
add esp, 0xc
cmp byte [ebp - 0x84], 0
jne 0x41c3a8
push 3
push str.exeNULcmd.exefallback_RNG_broken:
lea eax, [ebp - 0x7c]
push eax
call fcn.00412190
add esp, 0xc
mov edx, dword [ebp - 0x78]
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x34], edx
push dword [ebp - 0x74]
call fcn.0041ec60
add esp, 4
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x41c3d4
push 1
push eax
push dword [ebp - 0x34]
call fcn.00406dd0
add esp, 0xc
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xcc]
mov edi, dword [ebp - 0xc8]
xor ebx, ebx
mov dword [ebp - 0x34], eax
mov al, 1
mov dword [ebp - 0x44], eax
jmp 0x41c421
mov ebx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x44]
lea ecx, [ecx + edx + 1]
test eax, eax
cmovne ecx, eax
test ecx, ecx
jne 0x41c162
jmp 0x41c17c
mov dword [ebp - 0x44], 0
mov bl, 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x41c43c
add eax, eax
push 2
push eax
push dword [ebp - 0x50]
mov esi, ecx
call fcn.00406dd0
mov ecx, esi
add esp, 0xc
test edi, edi
sete al
or bl, al
cmp bl, 1
jne 0x41c47c
cmp byte [ebp - 0x44], 0
je 0x41d3be
test edi, edi
je 0x41d400
test ecx, ecx
je 0x41d400
add ecx, ecx
push 2
push ecx
push edi
call fcn.00406dd0
add esp, 0xc
mov dword [ebp - 0x10], 9
jmp 0x41d400
mov eax, dword [ebp - 0x34]
test edi, edi
je 0x41d5a0
mov dword [ebp - 0xe0], ecx
mov dword [ebp - 0xdc], edi
mov dword [ebp - 0xd8], eax
mov ecx, dword [ebp - 0xd8]
mov edx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xdc]
cmp ecx, 5
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x124], ecx
jb 0x41c4d6
cmp word [eax + ecx*2 - 0xa], 0x2e
jne 0x41c4d6
cmp word [eax + ecx*2 - 2], 0
je 0x41ccf3
mov dword [ebp - 0x10], 0x1b
mov eax, dword [ebp - 0x48]
xor edx, edx
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 2
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x10], 0x1b
mov ecx, dword [eax + 0x50]
mov dword [ebp - 0x28], ecx
mov ecx, dword [eax + 0x54]
movzx eax, byte [eax + 0x59]
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x7c]
mov byte [ebp - 0x2c], al
call fcn.0040c570
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x30]
mov word [eax + ecx*2], 0x22
inc ecx
mov dword [ebp - 0x558], edx
lea edx, [ebp - 0x558]
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x554], ecx
lea ecx, [ebp - 0x7c]
mov word [ebp - 0x550], 0
call fcn.0040c7c0
mov edx, dword [ebp - 0x74]
cmp edx, dword [ebp - 0x7c]
jne 0x41c565
lea ecx, [ebp - 0x7c]
call fcn.0040c570
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
mov esi, dword [ebp - 0x28]
movzx ecx, byte [ebp - 0x2c]
mov word [eax + edx*2], 0x22
mov eax, dword [ebp - 0x3c]
inc edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x74], edx
lea eax, [eax + eax*4]
lea eax, [esi + eax*4]
mov dword [ebp - 0x24], eax
cmp esi, dword [ebp - 0x24]
je 0x41c5e6
nop dword [eax]
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x28], esi
cmp edx, dword [ebp - 0x7c]
jne 0x41c5a9
lea ecx, [ebp - 0x7c]
call fcn.0040c570
mov edx, dword [ebp - 0x74]
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0xcc]
mov word [eax + edx*2], 0x20
inc edx
mov dword [ebp - 0x74], edx
lea edx, [ebp - 0x7c]
push dword [ebp - 0x30]
push esi
call fcn.004173b0
add esp, 8
movzx ebx, byte [ebp - 0xcc]
cmp bl, 4
jne 0x41c6ef
mov esi, dword [ebp - 0x28]
add esi, 0x14
cmp esi, dword [ebp - 0x24]
jne 0x41c590
movsd xmm0, qword [ebp - 0x12c]
mov esi, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
mov edx, dword [ebp - 0x74]
mov bl, 1
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x2c], ebx
movsd qword [ebp - 0x94], xmm0
mov dword [ebp - 0x8c], esi
mov esi, dword [ebp - 0x8c]
movsd xmm0, qword [ebp - 0x94]
cmp edx, ecx
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x118], esi
movsd qword [ebp - 0x120], xmm0
jne 0x41c66e
lea ecx, [ebp - 0x114]
mov byte [ebp - 0x3d], 1
mov dword [ebp - 0x10], 0x1e
call fcn.0040c570
mov eax, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov esi, dword [ebp - 0x48]
mov word [eax + edx*2], 0
inc edx
mov eax, 0x400
mov ecx, 0x608
mov dword [ebp - 0x10c], edx
cmp byte [esi + 0x58], 0
cmove ecx, eax
or ecx, dword [esi + 0x48]
cmp dword [ebp - 0x148], 0
mov dword [ebp - 0x44], ecx
je 0x41c744
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 2
mov dword [ebp - 0x8c], 0
mov esi, dword [eax + 8]
movsd xmm0, qword [eax]
test esi, esi
mov dword [ebp - 0xdc], esi
movsd qword [ebp - 0xe4], xmm0
je 0x41c791
xor ecx, ecx
mov eax, 2
jmp 0x41c7c8
movzx eax, byte [ebp - 0xc5]
movzx esi, word [ebp - 0xc7]
mov edi, dword [ebp - 0xcb]
shl eax, 0x10
or esi, eax
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x41c71f
add eax, eax
push 2
push eax
push dword [ebp - 0x78]
call fcn.00406dd0
add esp, 0xc
mov ecx, dword [ebp - 0x9c]
shld esi, edi, 8
shl edi, 8
movzx eax, bl
or eax, edi
mov dword [ecx + 4], esi
mov dword [ecx], eax
mov dword [ecx + 8], 2
xor ebx, ebx
jmp 0x41d810
xor edx, edx
mov eax, 2
mov dword [ebp - 0x30], 0
xor ecx, ecx
cmp byte [esi + 0xc], 2
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xdc], edx
jne 0x41cc45
xor edx, edx
mov ecx, 2
xor eax, eax
mov dword [ebp - 0x14c], 0
jmp 0x41cf43
lea ecx, [ebp - 0x94]
xor edx, edx
mov dword [ebp - 0x28], esi
mov byte [ebp - 0x3e], 1
mov dword [ebp - 0x10], 0x1f
call fcn.0040c570
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov esi, dword [ebp - 0x28]
mov word [eax + ecx*2], 0
inc ecx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0xd0], ecx
mov ecx, dword [ebp - 0xe0]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xe4]
xor edx, edx
mov dword [ebp - 0x10], 0x20
test ecx, ecx
sete dl
cmove esi, ecx
add edx, edx
mov dword [ebp - 0x558], edx
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x550], ecx
mov dword [ebp - 0x548], edx
mov dword [ebp - 0x544], eax
mov dword [ebp - 0x540], ecx
lea ecx, [ebp - 0x7c]
lea edx, [ebp - 0x558]
mov dword [ebp - 0x538], esi
call fcn.0040ab30
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x41d5b4
mov eax, dword [ebp - 0x74]
lea edx, [eax + eax*8]
lea edx, [edx + edx*2]
add edx, eax
cmp byte [ecx + edx + 0xc0], 2
je 0x41d5b4
mov esi, dword [ecx + edx + 0xb4]
mov edi, dword [ecx + edx + 0xbc]
shl eax, 4
mov ebx, dword [ecx + edx + 0xc8]
movsd xmm0, qword [ecx + eax]
movsd xmm1, qword [ecx + eax + 8]
mov eax, dword [ecx + edx + 0xc4]
mov dword [ebp - 0x34], esi
mov esi, dword [ecx + edx + 0xb8]
mov edx, dword [ecx + edx + 0xcc]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x98], eax
movsd qword [ebp - 0xc4], xmm1
movsd qword [ebp - 0xcc], xmm0
add edi, esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edi
xor edi, edi
jmp 0x41c8bb
xor edi, edi
test bx, bx
je 0x41cbe3
mov bx, 1
test di, di
jne 0x41c8b0
cmp esi, dword [ebp - 0x28]
je 0x41c953
movzx eax, byte [esi]
movzx ecx, al
test al, al
js 0x41c8da
inc esi
jmp 0x41c927
movzx edx, byte [esi + 1]
and ecx, 0x1f
and edx, 0x3f
cmp al, 0xdf
jbe 0x41c91c
movzx edi, byte [esi + 2]
shl edx, 6
and edi, 0x3f
or edi, edx
cmp al, 0xf0
jb 0x41c92d
movzx eax, byte [esi + 3]
and ecx, 7
shl edi, 6
add esi, 4
shl ecx, 0x12
and eax, 0x3f
or eax, edi
or ecx, eax
mov edx, dword [ebp - 0x24]
cmp ecx, 0xffff
jbe 0x41c927
jmp 0x41c940
shl ecx, 6
add esi, 2
or ecx, edx
mov edx, dword [ebp - 0x24]
xor edi, edi
mov ebx, ecx
jmp 0x41c8b2
shl ecx, 0xc
add esi, 3
or ecx, edi
mov edx, dword [ebp - 0x24]
cmp ecx, 0xffff
jbe 0x41c927
and ecx, 0x3ff
or ecx, 0xdc00
mov edi, ecx
jmp 0x41c8b2
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x41c96b
push 1
push eax
push dword [ebp - 0x50]
call fcn.00406dd0
mov edx, dword [ebp - 0x24]
add esp, 0xc
mov ebx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x98]
mov edi, dword [ebp - 0xd0]
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x7c], ecx
mov ecx, dword [ebp - 0x94]
lea eax, [ebx + edx*2]
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], eax
sub ecx, edi
cmp ecx, edx
mov ecx, dword [ebp - 0x30]
jae 0x41c9c4
mov eax, edx
mov dword [ebp - 0x10], 0x23
lea ecx, [ebp - 0x94]
mov edx, edi
push eax
call fcn.0043d640
add esp, 4
mov ecx, dword [ebp - 0x90]
mov edi, dword [ebp - 0x8c]
mov ebx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x24]
lea eax, [edx + edx]
mov dword [ebp - 0x30], ecx
lea ecx, [ecx + edi*2]
push eax
push ebx
push ecx
mov esi, edx
call fcn.00430ff0
add esp, 0xc
mov eax, dword [ebp - 0x98]
add edi, esi
mov dword [ebp - 0x8c], edi
test eax, eax
je 0x41c9fa
add eax, eax
push 2
push eax
push ebx
call fcn.00406dd0
add esp, 0xc
cmp edi, dword [ebp - 0x94]
jne 0x41ca28
lea ecx, [ebp - 0x94]
mov edx, edi
mov byte [ebp - 0x49], 1
mov dword [ebp - 0x10], 0x21
call fcn.0040c570
mov eax, dword [ebp - 0x90]
mov edi, dword [ebp - 0x8c]
jmp 0x41ca2b
mov eax, dword [ebp - 0x30]
mov word [eax + edi*2], 0x3d
inc edi
mov esi, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc4]
movzx edx, byte [ebp - 0xc0]
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x8c], edi
xor edi, edi
mov byte [ebp - 0x98], dl
lea edx, [esi + ecx]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], edx
jmp 0x41ca75
xor edi, edi
test bx, bx
je 0x41ce67
mov bx, 1
test di, di
jne 0x41ca6a
cmp esi, edx
je 0x41cb01
movzx ecx, byte [esi]
movzx eax, cl
test cl, cl
js 0x41ca8f
inc esi
jmp 0x41cae7
movzx edx, byte [esi + 1]
and eax, 0x1f
and edx, 0x3f
cmp cl, 0xdf
jbe 0x41cac8
movzx edi, byte [esi + 2]
shl edx, 6
and edi, 0x3f
or edi, edx
cmp cl, 0xf0
jb 0x41cad5
movzx ecx, byte [esi + 3]
and eax, 7
shl edi, 6
add esi, 4
shl eax, 0x12
and ecx, 0x3f
or ecx, edi
or eax, ecx
jmp 0x41cadd
shl eax, 6
add esi, 2
or eax, edx
mov edx, dword [ebp - 0x28]
jmp 0x41cae7
shl eax, 0xc
add esi, 3
or eax, edi
mov edx, dword [ebp - 0x28]
cmp eax, 0xffff
ja 0x41caf0
xor edi, edi
mov ebx, eax
jmp 0x41ca6c
and eax, 0x3ff
or eax, 0xdc00
mov edi, eax
jmp 0x41ca6c
movzx ebx, byte [ebp - 0x98]
cmp bl, 2
je 0x41dc62
lea ecx, [ebp - 0xbf]
lea edx, [ebp - 0x6f]
mov dword [ebp - 0x10], 0x22
movzx eax, word [ecx]
mov word [edx], ax
movzx eax, byte [ecx + 2]
mov ecx, dword [ebp - 0x24]
mov byte [edx + 2], al
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x7c], ecx
mov ecx, dword [ebp - 0x3c]
lea edx, [ebp - 0x108]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 0x70], bl
mov dword [ebp - 0x108], ecx
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x104], eax
mov word [ebp - 0x100], 0
call fcn.0040c7c0
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41cb81
push 1
push eax
push dword [ebp - 0x30]
call fcn.00406dd0
add esp, 0xc
mov esi, dword [ebp - 0x8c]
cmp esi, dword [ebp - 0x94]
jne 0x41cbad
lea ecx, [ebp - 0x94]
mov edx, esi
mov byte [ebp - 0x49], 0
mov dword [ebp - 0x10], 0x21
call fcn.0040c570
mov esi, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x90]
lea ecx, [ebp - 0x7c]
lea edx, [ebp - 0x558]
mov word [eax + esi*2], 0
inc esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], 0x20
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0x8c], esi
call fcn.0040ab30
jmp 0x41c828
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x41cbf8
push 1
push eax
push dword [ebp - 0x50]
call fcn.00406dd0
add esp, 0xc
mov eax, dword [ebp - 0xcc]
test eax, eax
je 0x41cc13
push 1
push eax
push dword [ebp - 0xc8]
call fcn.00406dd0
add esp, 0xc
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], 0x441bb4
test ecx, ecx
je 0x41ce3f
mov dword [ebp - 0x30], 2
add ecx, ecx
push 2
push ecx
push eax
call fcn.00406dd0
add esp, 0xc
jmp 0x41ce8b
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
xor ebx, ebx
add ecx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x24], ecx
jmp 0x41cc62
xor ebx, ebx
test di, di
je 0x41ce48
mov di, 1
test bx, bx
jne 0x41cc57
cmp edx, ecx
je 0x41cee2
movzx eax, byte [edx]
movzx esi, al
test al, al
js 0x41cc80
inc edx
jmp 0x41ccd7
movzx ecx, byte [edx + 1]
and esi, 0x1f
and ecx, 0x3f
cmp al, 0xdf
jbe 0x41ccb7
movzx ebx, byte [edx + 2]
shl ecx, 6
and ebx, 0x3f
or ebx, ecx
cmp al, 0xf0
jb 0x41ccc4
movzx eax, byte [edx + 3]
and esi, 7
shl ebx, 6
add edx, 4
shl esi, 0x12
and eax, 0x3f
or eax, ebx
or esi, eax
jmp 0x41cccc
shl esi, 6
add edx, 2
or esi, ecx
mov ecx, dword [ebp - 0x24]
jmp 0x41ccd7
shl esi, 0xc
add edx, 3
or esi, ebx
mov ecx, dword [ebp - 0x24]
cmp esi, 0xffff
ja 0x41cce0
xor ebx, ebx
mov edi, esi
jmp 0x41cc59
and esi, 0x3ff
or esi, 0xdc00
mov ebx, esi
jmp 0x41cc59
movzx edx, word [eax + ecx*2 - 8]
lea esi, [edx - 0x42]
cmp esi, 0x21
ja 0x41c4d6
mov edi, dword [ebp - 0x3c]
add edi, dword [esi*4 + 0x41ebd8]
jmp edi
mov dword [ebp - 0x30], 2
jmp 0x41ce92
mov eax, dword [ebp - 0x9c]
mov dword [eax], 2
mov dword [eax + 4], 0x441bb4
mov dword [eax + 8], 2
jmp 0x41d7af
mov eax, dword [ebp - 0x24]
mov esi, 2
mov dword [ebp - 0x28], 0x441bb4
test eax, eax
je 0x41ce88
push 1
push eax
push dword [ebp - 0x30]
call fcn.00406dd0
add esp, 0xc
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x10], 0x1f
lea ecx, [ebp - 0x558]
mov byte [ebp - 0x3e], 0
mov dword [ebp - 0x10], 0x1f
call fcn.00408060
mov eax, dword [ebp - 0x94]
mov esi, dword [ebp - 0x30]
test eax, eax
je 0x41cec8
add eax, eax
push 2
push eax
push dword [ebp - 0x90]
call fcn.00406dd0
add esp, 0xc
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x9c]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], 2
jmp 0x41d7ca
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x558], ecx
lea ecx, [ebp - 0x7c]
lea edx, [ebp - 0x558]
mov dword [ebp - 0x10], 0x24
mov dword [ebp - 0x554], eax
mov word [ebp - 0x550], 0
call fcn.0040c8f0
mov eax, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x74]
cmp edx, eax
jne 0x41cf2e
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x10], 0x25
call fcn.0040c570
mov eax, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x78]
mov esi, dword [ebp - 0x48]
mov word [ecx + edx*2], 0
inc edx
mov edi, ecx
mov dword [ebp - 0x14c], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xd0], ecx
mov dword [ebp - 0x8c], edx
movups xmmword [ebp - 0xcc], xmm0
push 0x44da78
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [0x44da50]
test eax, 0x7fffffff
je 0x41cf92
mov dword [ebp - 0x10], 0x26
call fcn.0043d8d0
mov esi, dword [ebp - 0x48]
xor al, 1
jmp 0x41cf94
xor eax, eax
movzx ecx, byte [0x44da7c]
test cl, cl
mov byte [ebp - 0x34], cl
je 0x41cfba
mov ecx, 1
mov dword [ebp - 0x104], 0x44da78
mov dword [ebp - 0x10], 0x27
jmp 0x41cfcd
mov dword [ebp - 0x104], 0x44da78
mov dword [ebp - 0x10], 0x27
xor ecx, ecx
mov byte [ebp - 0x100], al
mov dword [ebp - 0x3c], eax
lea eax, [esi + 0x30]
mov ebx, esi
mov esi, dword [esi + 0x30]
mov dword [ebp - 0x108], ecx
xor ecx, ecx
mov edi, dword [ebp - 0x138]
mov edx, 1
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x158], 1
cmp esi, 5
mov dword [ebp - 0x50], edi
cmove eax, ecx
cmp byte [ebp + 0xc], 0
lea ecx, [ebp - 0x134]
cmovne edx, edi
lea edi, [ebp - 0x154]
cmovne edi, ecx
mov ecx, dword [ebx + 0x38]
add eax, 4
cmp esi, 5
cmovne edx, esi
cmove eax, edi
mov esi, 0
mov dword [ebp - 0x130], ecx
cmp ecx, 5
lea ecx, [ebx + 0x38]
cmove ecx, esi
mov dword [ebp - 0xd4], ecx
mov ecx, dword [ebx + 0x40]
add ebx, 0x40
cmp ecx, 5
mov dword [ebp - 0x150], ecx
lea ecx, [ebp - 0x558]
cmove ebx, esi
lea esi, [ebp - 0x7c]
mov dword [ebp - 0x48], ebx
push esi
push 0xfffffffffffffff6
push dword [eax]
call fcn.0041ed80
add esp, 0xc
movzx eax, byte [ebp - 0x558]
cmp al, 4
jne 0x41d354
mov esi, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0x554]
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 0x74]
add esi, 4
cmp edx, 5
mov dword [ebp - 0xd4], ecx
lea ecx, [ebp - 0x134]
cmove esi, ecx
cmove edx, dword [ebp - 0x50]
lea ecx, [ebp - 0x558]
mov esi, dword [esi]
mov dword [ebp - 0x10], 0x28
push eax
push 0xfffffffffffffff5
push esi
call fcn.0041ed80
add esp, 0xc
movzx eax, byte [ebp - 0x558]
mov ecx, dword [ebp - 0x48]
cmp al, 4
jne 0x41d386
mov edi, dword [ebp - 0x150]
add ecx, 4
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x6c]
cmp edi, 5
cmove ecx, edx
mov edx, dword [ebp - 0x554]
cmove edi, dword [ebp - 0x50]
mov esi, dword [ecx]
mov dword [ebp - 0x10], 0x29
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x48], edx
mov edx, edi
push eax
push 0xfffffffffffffff4
push esi
call fcn.0041ed80
add esp, 0xc
movzx eax, byte [ebp - 0x558]
cmp al, 4
jne 0x41d66a
mov ebx, dword [ebp - 0xd4]
mov esi, dword [ebp - 0x554]
mov dword [ebp - 0x550], 0
mov dword [ebp - 0x554], 0
mov dword [ebp - 0x548], 0
mov dword [ebp - 0x54c], 0
mov dword [ebp - 0x540], 0
mov dword [ebp - 0x544], 0
mov dword [ebp - 0x538], 0
mov dword [ebp - 0x53c], 0
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x534], 0
mov dword [ebp - 0x528], 0
mov dword [ebp - 0x52c], 0
mov dword [ebp - 0x520], 0
mov dword [ebp - 0x524], 0
mov dword [ebp - 0x518], 0
mov dword [ebp - 0x51c], 0
mov dword [ebp - 0x558], 0x44
test ebx, ebx
jne 0x41d202
cmp dword [ebp - 0x48], 0
jne 0x41d202
test esi, esi
je 0x41d221
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x52c], pe_nt_image_headers32
mov dword [ebp - 0x520], ebx
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x518], esi
mov edi, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x110]
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x558]
push eax
push dword [ebp - 0x14c]
push dword [ebp - 0x30]
push dword [ebp - 0x44]
push 1
push 0
push 0
mov dword [ebp - 0x30], ecx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41d6d4
mov eax, dword [ebp - 0x9c]
movsd xmm1, qword [ebp - 0x74]
movsd xmm0, qword [ebp - 0x6c]
movsd xmm2, qword [ebp - 0x7c]
mov dword [ebp - 0x2c], edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
movsd qword [eax + 0x10], xmm1
movsd xmm1, qword [ebp - 0xcc]
movsd qword [eax + 0x18], xmm0
movsd qword [eax + 8], xmm2
movsd qword [eax], xmm1
push esi
call edi
push dword [ebp - 0x48]
call edi
push ebx
call edi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x10], 0x26
call fcn.00408240
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41d2d0
add eax, eax
push 2
push eax
push dword [ebp - 0xd0]
call fcn.00406dd0
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
test eax, eax
je 0x41d2ed
add eax, eax
push 2
push eax
push dword [ebp - 0x98]
call fcn.00406dd0
add esp, 0xc
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x41d307
add eax, eax
push 2
push eax
push dword [ebp - 0x30]
call fcn.00406dd0
add esp, 0xc
mov eax, dword [ebp - 0x120]
test eax, eax
je 0x41d31f
add eax, eax
push 2
push eax
push esi
call fcn.00406dd0
add esp, 0xc
cmp byte [ebp - 0x84], 0
je 0x41d345
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x41d345
add eax, eax
push 2
push eax
push dword [ebp - 0x128]
call fcn.00406dd0
add esp, 0xc
cmp dword [ebp - 0x50], 3
jae 0x41b9d5
jmp 0x41b9e1
movzx ecx, byte [ebp - 0x555]
mov edx, dword [ebp - 0x9c]
movzx edi, word [ebp - 0x557]
mov esi, dword [ebp - 0x554]
mov byte [edx + 3], cl
mov word [edx + 1], di
mov byte [edx], al
mov dword [edx + 4], esi
mov dword [edx + 8], 2
jmp 0x41d70e
mov ebx, dword [ebp - 0xd4]
movzx ecx, byte [ebp - 0x555]
mov edx, dword [ebp - 0x9c]
movzx edi, word [ebp - 0x557]
mov esi, dword [ebp - 0x554]
mov byte [edx + 3], cl
mov word [edx + 1], di
mov byte [edx], al
mov dword [edx + 4], esi
mov dword [edx + 8], 2
jmp 0x41d707
cmp cl, 3
jne 0x41d400
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [ebp - 0x10], 0xc
push eax
mov dword [ebp - 0x2c], edi
call dword [ecx]
add esp, 4
mov esi, dword [ebp - 0x2c]
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41d3f3
push dword [eax + 8]
push ecx
push dword [esi]
call fcn.00406dd0
add esp, 0xc
push 4
push 0xc
push esi
call fcn.00406dd0
add esp, 0xc
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 9
lea eax, [ebp - 0x94]
push 4
push str.PATHRUST_MIN_STACKlibrary_std_src_sys_common_thread_info.rs
push eax
call fcn.0040db90
add esp, 0xc
cmp byte [ebp - 0x88], 2
je 0x41d5a0
movsd xmm0, qword [ebp - 0x94]
movsd xmm1, qword [ebp - 0x8c]
movsd qword [ebp - 0x108], xmm0
movsd qword [ebp - 0x100], xmm1
mov ecx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x100]
add eax, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], ecx
mov word [ebp - 0xc4], 0
mov byte [ebp - 0xc0], 1
jmp 0x41d48b
mov edi, dword [ebp - 0x554]
test edi, edi
jne 0x41dbcc
lea eax, [ebp - 0xcc]
mov dword [ebp - 0x10], 0xa
push eax
lea eax, [ebp - 0x558]
push eax
call fcn.00419030
add esp, 8
jmp 0x41d4c0
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x558]
push eax
call fcn.00419030
add esp, 8
movzx eax, byte [ebp - 0x54c]
cmp al, 2
je 0x41d588
mov esi, dword [ebp - 0x550]
mov edx, dword [ebp - 0x558]
mov ecx, dword [ebp - 0x554]
test esi, esi
jne 0x41d4f7
test edx, edx
je 0x41d4aa
push 1
push edx
push ecx
call fcn.00406dd0
add esp, 0xc
jmp 0x41d4aa
lea edi, [ebp - 0x54b]
lea ebx, [ebp - 0x6f]
mov dword [ebp - 0x10], 0xb
movzx edi, word [edi]
mov word [ebx], di
lea edi, [ebp - 0x54b]
mov ah, byte [edi + 2]
mov byte [ebx + 2], ah
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], esi
mov byte [ebp - 0x70], al
push dword [ebp - 0x28]
push dword [ebp - 0x24]
lea eax, [ebp - 0x7c]
push eax
call fcn.00411570
add esp, 0xc
cmp byte [ebp - 0x84], 0
jne 0x41d553
push 3
push str.exeNULcmd.exefallback_RNG_broken:
lea eax, [ebp - 0x7c]
push eax
call fcn.00412190
add esp, 0xc
mov edx, dword [ebp - 0x78]
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x2c], edx
push dword [ebp - 0x74]
call fcn.0041ec60
add esp, 4
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x41d47d
push 1
push eax
push dword [ebp - 0x2c]
call fcn.00406dd0
add esp, 0xc
jmp 0x41d47d
mov eax, dword [ebp - 0x108]
test eax, eax
je 0x41d5a0
push 1
push eax
push dword [ebp - 0x34]
call fcn.00406dd0
add esp, 0xc
mov dword [ebp - 0xe0], 2
mov eax, 0x441c04
jmp 0x41b8ac
lea ecx, [ebp - 0x558]
mov byte [ebp - 0x3e], 0
mov dword [ebp - 0x10], 0x1f
call fcn.00408060
mov edx, dword [ebp - 0xd0]
mov eax, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x94]
jne 0x41d5f6
lea ecx, [ebp - 0x94]
mov byte [ebp - 0x3e], 0
call fcn.0040c570
mov eax, dword [ebp - 0x90]
mov edx, dword [ebp - 0x8c]
mov word [eax + edx*2], 0
mov dword [ebp - 0x30], eax
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x94]
test eax, eax
je 0x41d6c0
inc edx
jmp 0x41c754
mov ebx, dword [ebp - 0xd4]
movzx ecx, byte [ebp - 0x555]
mov edx, dword [ebp - 0x9c]
movzx edi, word [ebp - 0x557]
mov esi, dword [ebp - 0x554]
mov byte [edx + 3], cl
mov word [edx + 1], di
mov byte [edx], al
mov dword [edx + 4], esi
mov dword [edx + 8], 2
jmp 0x41d6fe
mov ecx, dword [ebp - 0x558]
mov eax, dword [ebp - 0x550]
jmp 0x41c487
mov esi, dword [ebp - 0x30]
jmp 0x41cecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x9c]
mov byte [ecx], 0
mov byte [ecx + 3], 0
mov word [ecx + 1], 0
mov dword [ecx + 4], eax
mov dword [ecx + 8], 2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x7c], 0
je 0x41d71d
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x74], 0
je 0x41d72c
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x6c], 0
je 0x41d73b
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x34], 0
je 0x41d761
cmp byte [ebp - 0x3c], 0
jne 0x41d78a
mov eax, dword [0x44da50]
test eax, 0x7fffffff
je 0x41d78a
mov dword [ebp - 0x10], 0x26
call fcn.0043d8d0
jmp 0x41d77f
cmp byte [ebp - 0x3c], 0
jne 0x41d78a
mov eax, dword [0x44da50]
test eax, 0x7fffffff
je 0x41d78a
mov dword [ebp - 0x10], 0x26
call fcn.0043d8d0
test al, al
jne 0x41d78a
mov byte [0x44da7c], 1
push 0x44da78
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41d7af
add eax, eax
push 2
push eax
push dword [ebp - 0xd0]
call fcn.00406dd0
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x98]
test eax, eax
je 0x41d7ca
add eax, eax
push 2
push eax
push ecx
call fcn.00406dd0
add esp, 0xc
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x41d7e7
add eax, eax
push 2
push eax
push dword [ebp - 0x110]
call fcn.00406dd0
add esp, 0xc
mov eax, dword [ebp - 0x120]
test eax, eax
je 0x41d804
add eax, eax
push 2
push eax
push dword [ebp - 0x11c]
call fcn.00406dd0
add esp, 0xc
cmp byte [ebp - 0x2c], 0
mov bl, 1
jne 0x41b9cc
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x41d82d
add eax, eax
push 2
push eax
push dword [ebp - 0x128]
call fcn.00406dd0
add esp, 0xc
cmp dword [ebp - 0x148], 0
sete al
or bl, al
je 0x41b8dd
jmp 0x41b9cc
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x558]
mov ebx, dword [ebp - 0x550]
test eax, eax
je 0x41dbf4
push 1
push eax
push dword [ebp - 0x34]
mov esi, ecx
call fcn.00406dd0
mov ecx, esi
add esp, 0xc
mov eax, ebx
jmp 0x41c487
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
jmp 0x41ce88
push 1
push esi
call fcn.0043e060
add esp, 8
jmp 0x41e481
mov dword [ebp - 0x10], 4
call fcn.00429bb0
jmp 0x41e481
mov dword [ebp - 0x10], 4
call fcn.00429bb0
jmp 0x41e481
mov dword [ebp - 0x10], 4
push ebx
push dword [ebp - 0x24]
call fcn.0043e060
add esp, 8
jmp 0x41e481
mov byte [ebp - 0x7d], 1
mov dword [ebp - 0x10], 2
call fcn.00429bb0
jmp 0x41e481
call fcn.00429bb0
jmp 0x41e481
mov byte [ebp - 0x7d], 1
mov dword [ebp - 0x10], 2
push 1
push ebx
call fcn.0043e060
add esp, 8
jmp 0x41e481
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0xcc]
mov dword [ebp - 0x74], 0x441b54
mov dword [ebp - 0x70], 1
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x10], 0x2e
mov dword [ebp - 0x108], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x104], 0x40f0c0
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], 1
push 0x441b84
lea eax, [ebp - 0x7c]
push eax
call fcn.0043e0e0
add esp, 8
jmp 0x41e481
mov dword [ebp - 0x10], 3
push 0x43ff64
push 0x21
push str.assertion_failed:_self.height___0
call fcn.0043e1a0
add esp, 0xc
jmp 0x41e481
mov dword [ebp - 0x10], 0x10
push 0x442034
push 0x28
push str.internal_error:_entered_unreachable_code4
call fcn.0043e1a0
add esp, 0xc
jmp 0x41e481
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 9
push 1
push 4
call fcn.0043e060
add esp, 8
jmp 0x41e481
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x550], 0x441a0c
mov dword [ebp - 0x54c], 1
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x558], 0
mov dword [ebp - 0x10], 8
mov dword [ebp - 0xcc], eax
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xc8], 0x40f0c0
mov dword [ebp - 0x548], eax
mov dword [ebp - 0x544], 1
lea eax, [ebp - 0x558]
push 0x441a14
push eax
call fcn.0043e0e0
add esp, 8
jmp 0x41e481
mov dword [ebp - 0x10], 0xd
push 0x442034
push 0x28
push str.internal_error:_entered_unreachable_code4
call fcn.0043e1a0
add esp, 0xc
jmp 0x41e481
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 9
call fcn.00429bb0
jmp 0x41e481
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 9
push dword [ebp - 0x2c]
push ebx
call fcn.0043e060
add esp, 8
jmp 0x41e481
push 0x442044
push eax
push esi
call fcn.0043e4e0
add esp, 0xc
jmp 0x41e481
mov dword [ebp - 0x10], 0x16
push 0x43fb3c
push edx
push dword [ebp - 0x34]
call fcn.0043e4c0
add esp, 0xc
jmp 0x41e481
push 0x442044
push eax
push esi
call fcn.0043e4e0
add esp, 0xc
jmp 0x41e481
ud2