Function at 0x48e970
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x498]
sub esp, 0x498
push 0xffffffffffffffff
push 0x4dfd1f
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x5021c0]
xor eax, ebp
mov dword [ebp + 0x494], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 0x4a0]
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xfffffffffffffffc
push esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], 0
call ebx
cmp eax, 0x48e7a0
je 0x49062f
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.0048e3f0
test eax, eax
je 0x49062f
cmp dword [edi + 8], 0
jne 0x48ea06
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [edi + 8], eax
xor eax, eax
lea ecx, [ebp + 0x3dc]
push eax
push 0x4eb5ac
mov dword [ebp + 0x3dc], eax
mov dword [ebp + 0x3e0], eax
mov dword [ebp + 0x3e4], eax
mov dword [ebp + 0x3e8], eax
mov dword [ebp + 0x3ec], eax
mov dword [ebp + 0x3f0], eax
call fcn.00403450
xor eax, eax
mov dword [ebp - 4], 0
push 0x1a
push str.SoftwaregrepWineditorcmd
lea ecx, [ebp + 0x3c4]
mov dword [ebp + 0x3c4], eax
mov dword [ebp + 0x3c8], eax
mov dword [ebp + 0x3cc], eax
mov dword [ebp + 0x3d0], eax
mov dword [ebp + 0x3d4], eax
mov dword [ebp + 0x3d8], eax
call fcn.00403450
sub esp, 0xc
mov byte [ebp - 4], 1
lea eax, [ebp + 0x3c4]
lea ecx, [ebp]
push eax
call fcn.00418ec0
lea eax, [ebp + 0x3dc]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp + 0x44]
mov dword [ebp], vtable.CRegTypedBase_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____class_CRegStdBase_.0
call fcn.004024d0
lea eax, [ebp + 0x3dc]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp + 0x5c]
call fcn.004024d0
mov dword [ebp + 0x78], 0
mov dword [ebp + 0x7c], 0
mov dword [ebp + 0x80], 0xffffffff
mov dword [ebp + 0x84], 0
mov dword [ebp], vtable.CRegStringCommon_class_CRegStdBase_.0
mov byte [ebp - 4], 5
mov ecx, dword [ebp + 0x3d8]
cmp ecx, 7
jbe 0x48eb2c
mov edx, dword [ebp + 0x3c4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x48eb22
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x490656
push ecx
push edx
call fcn.004accfd
add esp, 8
xor eax, eax
mov dword [ebp + 0x3d4], 0
mov dword [ebp + 0x3d8], 7
mov word [ebp + 0x3c4], ax
mov byte [ebp - 4], 6
mov ecx, dword [ebp + 0x3f0]
cmp ecx, 7
jbe 0x48eb8d
mov edx, dword [ebp + 0x3dc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x48eb83
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x490656
push ecx
push edx
call fcn.004accfd
add esp, 8
xor eax, eax
mov dword [ebp + 0x3ec], 0
lea ecx, [ebp]
mov dword [ebp + 0x3f0], 7
mov word [ebp + 0x3dc], ax
call fcn.004178e0
push eax
lea ecx, [ebp + 0x100]
call fcn.004024d0
mov byte [ebp - 4], 7
cmp byte [0x507a10], 0
je 0x48ec6c
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], str.global
push eax
lea eax, [ebp + 0x3b8]
mov dword [ebp - 0x34], 0
push eax
mov ecx, 0x507a48
mov dword [ebp - 0x30], 0
call fcn.00418210
mov esi, dword [ebp + 0x3c0]
lea eax, [ebp - 0x38]
push eax
push esi
call fcn.004182a0
test al, al
je 0x48ec40
cmp esi, dword [0x507a48]
je 0x48ec40
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0x4f05fc
push eax
lea ecx, [esi + 0x1c]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
call fcn.00417f90
cmp eax, dword [esi + 0x1c]
je 0x48ec40
mov edx, dword [eax + 0x1c]
jmp 0x48ec45
mov edx, 0x4eb5ac
mov ecx, edx
lea esi, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48ec50
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp + 0x100]
call fcn.00403a40
mov ecx, dword [edi + 0x1c]
mov eax, 0x4ec4ec4f
sub ecx, dword [edi + 0x18]
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jne 0x48ef0a
cmp dword [ebp + 0x110], 0
mov edi, dword [sym.imp.USER32.dll_InsertMenuW]
je 0x48ed26
call fcn.00411ad0
mov edx, dword [0x507a18]
lea ecx, [ebp + 0x88]
push 0x8d
mov esi, eax
call fcn.0041fc20
push esi
lea edx, [ebp + 0x88]
mov byte [ebp - 4], 8
lea ecx, [ebp + 0xa0]
call fcn.004108d0
add esp, 8
lea eax, [ebp + 0xa0]
cmp dword [ebp + 0xb4], 7
jbe 0x48ecea
mov eax, dword [ebp + 0xa0]
mov esi, dword [ebp - 0x10]
push eax
push 5
push 0x400
push 1
push dword [esi + 8]
call edi
lea ecx, [ebp + 0xa0]
call fcn.004027a0
lea ecx, [ebp + 0x88]
mov byte [ebp - 4], 7
call fcn.004027a0
push 0
push 0
push 0xc00
push 5
push dword [esi + 8]
call edi
call fcn.00411ad0
mov edx, dword [0x507a18]
lea ecx, [ebp + 0xe8]
push 0x8e
mov esi, eax
call fcn.0041fc20
push esi
lea edx, [ebp + 0xe8]
mov byte [ebp - 4], 9
lea ecx, [ebp + 0x1c0]
call fcn.004108d0
add esp, 8
lea eax, [ebp + 0x1c0]
cmp dword [ebp + 0x1d4], 7
jbe 0x48ed71
mov eax, dword [ebp + 0x1c0]
mov ecx, dword [ebp - 0x10]
push eax
push 1
push 0x400
push 1
push dword [ecx + 8]
call edi
lea ecx, [ebp + 0x1c0]
call fcn.004027a0
lea ecx, [ebp + 0xe8]
mov byte [ebp - 4], 7
call fcn.004027a0
call fcn.00411ad0
mov edx, dword [0x507a18]
lea ecx, [ebp + 0xd0]
push 0x8f
mov esi, eax
call fcn.0041fc20
push esi
lea edx, [ebp + 0xd0]
mov byte [ebp - 4], 0xa
lea ecx, [ebp + 0x1a8]
call fcn.004108d0
add esp, 8
lea eax, [ebp + 0x1a8]
cmp dword [ebp + 0x1bc], 7
jbe 0x48ede8
mov eax, dword [ebp + 0x1a8]
push eax
mov eax, dword [ebp - 0x10]
push 2
push 0x400
push 2
push dword [eax + 8]
call edi
lea ecx, [ebp + 0x1a8]
call fcn.004027a0
lea ecx, [ebp + 0xd0]
mov byte [ebp - 4], 7
call fcn.004027a0
call fcn.00411ad0
mov edx, dword [0x507a18]
lea ecx, [ebp + 0xb8]
push 0x91
mov esi, eax
call fcn.0041fc20
push esi
lea edx, [ebp + 0xb8]
mov byte [ebp - 4], 0xb
lea ecx, [ebp + 0x1f0]
call fcn.004108d0
add esp, 8
lea eax, [ebp + 0x1f0]
cmp dword [ebp + 0x204], 7
jbe 0x48ee5f
mov eax, dword [ebp + 0x1f0]
mov esi, dword [ebp - 0x10]
push eax
push 3
push 0x400
push 3
push dword [esi + 8]
call edi
lea ecx, [ebp + 0x1f0]
call fcn.004027a0
lea ecx, [ebp + 0xb8]
mov byte [ebp - 4], 7
call fcn.004027a0
mov eax, dword [esi + 0x24]
cmp eax, dword [esi + 0x28]
je 0x48f117
call fcn.00411ad0
mov edx, dword [0x507a18]
lea ecx, [ebp + 0x214]
push 0x93
mov esi, eax
call fcn.0041fc20
push esi
lea edx, [ebp + 0x214]
mov byte [ebp - 4], 0xc
lea ecx, [ebp + 0x190]
call fcn.004108d0
add esp, 8
lea eax, [ebp + 0x190]
cmp dword [ebp + 0x1a4], 7
jbe 0x48eee2
mov eax, dword [ebp + 0x190]
mov esi, dword [ebp - 0x10]
push eax
push 4
push 0x400
push 4
push dword [esi + 8]
call edi
lea ecx, [ebp + 0x190]
call fcn.004027a0
lea ecx, [ebp + 0x214]
jmp 0x48f10e
jbe 0x48f12a
cmp dword [ebp + 0x110], 0
mov edi, dword [sym.imp.USER32.dll_InsertMenuW]
je 0x48efaa
call fcn.00411ad0
mov edx, dword [0x507a18]
lea ecx, [ebp + 0x214]
push 0x8d
mov esi, eax
call fcn.0041fc20
push esi
lea edx, [ebp + 0x214]
mov byte [ebp - 4], 0xd
lea ecx, [ebp + 0x190]
call fcn.004108d0
add esp, 8
lea eax, [ebp + 0x190]
cmp dword [ebp + 0x1a4], 7
jbe 0x48ef6e
mov eax, dword [ebp + 0x190]
mov esi, dword [ebp - 0x10]
push eax
push 5
push 0x400
push 1
push dword [esi + 8]
call edi
lea ecx, [ebp + 0x190]
call fcn.004027a0
lea ecx, [ebp + 0x214]
mov byte [ebp - 4], 7
call fcn.004027a0
push 0
push 0
push 0xc00
push 5
push dword [esi + 8]
call edi
call fcn.00411ad0
mov edx, dword [0x507a18]
lea ecx, [ebp + 0xb8]
push 0x90
mov esi, eax
call fcn.0041fc20
push esi
lea edx, [ebp + 0xb8]
mov byte [ebp - 4], 0xe
lea ecx, [ebp + 0x1f0]
call fcn.004108d0
add esp, 8
lea eax, [ebp + 0x1f0]
cmp dword [ebp + 0x204], 7
jbe 0x48eff5
mov eax, dword [ebp + 0x1f0]
push eax
mov eax, dword [ebp - 0x10]
push 2
push 0x400
push 2
push dword [eax + 8]
call edi
lea ecx, [ebp + 0x1f0]
call fcn.004027a0
lea ecx, [ebp + 0xb8]
mov byte [ebp - 4], 7
call fcn.004027a0
call fcn.00411ad0
mov edx, dword [0x507a18]
lea ecx, [ebp + 0xd0]
push 0x92
mov esi, eax
call fcn.0041fc20
push esi
lea edx, [ebp + 0xd0]
mov byte [ebp - 4], 0xf
lea ecx, [ebp + 0x1a8]
call fcn.004108d0
add esp, 8
lea eax, [ebp + 0x1a8]
cmp dword [ebp + 0x1bc], 7
jbe 0x48f06c
mov eax, dword [ebp + 0x1a8]
mov esi, dword [ebp - 0x10]
push eax
push 3
push 0x400
push 3
push dword [esi + 8]
call edi
lea ecx, [ebp + 0x1a8]
call fcn.004027a0
lea ecx, [ebp + 0xd0]
mov byte [ebp - 4], 7
call fcn.004027a0
mov eax, dword [esi + 0x24]
cmp eax, dword [esi + 0x28]
je 0x48f117
call fcn.00411ad0
mov edx, dword [0x507a18]
lea ecx, [ebp + 0xe8]
push 0x94
mov esi, eax
call fcn.0041fc20
push esi
lea edx, [ebp + 0xe8]
mov byte [ebp - 4], 0x10
lea ecx, [ebp + 0x1c0]
call fcn.004108d0
add esp, 8
lea eax, [ebp + 0x1c0]
cmp dword [ebp + 0x1d4], 7
jbe 0x48f0eb
mov eax, dword [ebp + 0x1c0]
mov esi, dword [ebp - 0x10]
push eax
push 4
push 0x400
push 4
push dword [esi + 8]
call edi
lea ecx, [ebp + 0x1c0]
call fcn.004027a0
lea ecx, [ebp + 0xe8]
mov byte [ebp - 4], 7
call fcn.004027a0
push 0
push 0
push 0xc00
push 5
push dword [esi + 8]
call edi
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
push dword [edi + 8]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
call dword [sym.imp.USER32.dll_GetMenuItemCount]
push 4
push 0x2710
push 6
push eax
push dword [edi + 8]
push dword [ebp - 0x20]
call esi
mov edi, dword [ebp - 0x1c]
mov esi, dword [sym.imp.USER32.dll_SetWindowLongW]
cmp edi, 1
jle 0x48f190
push 0xfffffffffffffffc
push dword [ebp - 0x24]
call ebx
cmp eax, 0x48e7a0
je 0x48f17a
push 0x48e7a0
push 0xfffffffffffffffc
push dword [ebp - 0x24]
call esi
mov dword [0x507a20], eax
mov eax, dword [ebp - 0x20]
cmp edi, 2
jne 0x48f189
mov dword [0x507a24], eax
jmp 0x48f19a
mov dword [0x507a1c], eax
jmp 0x48f19a
mov dword [0x507a20], 0
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x10]
push 0
push ebx
push 0
push dword [ebp + 0x4a8]
push dword [ebp + 0x4a4]
push 0x100
push dword [edi + 8]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov ecx, dword [0x507a20]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x48f1d5
push ecx
push 0xfffffffffffffffc
push ebx
call esi
mov eax, dword [ebp - 0x18]
cmp eax, 6
jb 0x48f254
cmp eax, 0x2710
ja 0x48f254
add eax, 0xfffffffa
mov dword [ebp + 0x20c], 0
movzx eax, ax
lea edx, [ebp + 0x208]
mov dword [ebp + 0x214], eax
mov eax, dword [ebp - 0x20]
push edx
push eax
mov dword [ebp + 0x210], 0
mov ecx, dword [eax]
mov dword [ebp + 0x218], 0
mov dword [ebp + 0x21c], 0
mov dword [ebp + 0x224], 0
mov dword [ebp + 0x228], 0
mov dword [ebp + 0x208], 0x24
mov dword [ebp + 0x220], 1
call dword [ecx + 0x10]
xor edi, edi
jmp 0x4905cb
dec eax
cmp eax, 4
ja case.default.0x48f25e
jmp dword [eax*4 + 0x49066c]
mov ecx, dword [edi + 0x18]
mov eax, 0x7ffffffe
mov edx, dword [ecx + 0x10]
sub eax, edx
cmp eax, 9
jb 0x49065b
cmp dword [ecx + 0x14], 7
jbe 0x48f283
mov ecx, dword [ecx]
push edx
push ecx
push 9
push str._Select__
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp + 0x214]
call fcn.004069c0
push 0x4eb5fc
lea ecx, [ebp + 0x214]
mov byte [ebp - 4], 0x11
call fcn.00405930
mov edx, eax
xor eax, eax
mov dword [ebp + 0x3ac], eax
mov dword [ebp + 0x3b0], eax
mov dword [ebp + 0x3b4], eax
mov dword [ebp + 0x3b8], eax
mov dword [ebp + 0x3bc], eax
mov dword [ebp + 0x3c0], eax
mov ecx, dword [edx]
mov dword [ebp + 0x3ac], ecx
lea ecx, [ebp + 0x214]
mov eax, dword [edx + 4]
mov dword [ebp + 0x3b0], eax
mov eax, dword [edx + 8]
mov dword [ebp + 0x3b4], eax
mov eax, dword [edx + 0xc]
mov dword [ebp + 0x3b8], eax
mov eax, dword [edx + 0x10]
mov dword [ebp + 0x3bc], eax
mov eax, dword [edx + 0x14]
mov dword [ebp + 0x3c0], eax
xor eax, eax
mov byte [ebp - 4], 7
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov word [edx], ax
call fcn.004027a0
cmp dword [ebp + 0x3c0], 7
lea eax, [ebp + 0x3ac]
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x70], str.explorer.exe
jbe 0x48f390
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x74], str.open
mov dword [ebp - 0x7c], 0x50c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp + 0x3c0]
cmp ecx, 7
jbe case.default.0x48f25e
mov edx, dword [ebp + 0x3ac]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x48f3ec
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x490660
push ecx
push edx
call fcn.004accfd
add esp, 8
jmp case.default.0x48f25e
xor eax, eax
mov ecx, 7
xor edx, edx
mov dword [ebp + 0x3dc], eax
mov dword [ebp + 0x3e0], eax
mov dword [ebp + 0x3e4], eax
mov dword [ebp + 0x3e8], eax
mov dword [ebp + 0x3ec], eax
mov dword [ebp + 0x3f0], ecx
mov word [ebp + 0x3dc], dx
mov byte [ebp - 4], 0x12
mov esi, dword [edi + 0x18]
cmp esi, dword [edi + 0x1c]
je 0x48f476
jmp 0x48f440
test eax, eax
je 0x48f454
push 0x4f0390
lea ecx, [ebp + 0x3dc]
call fcn.00405930
push esi
lea ecx, [ebp + 0x3dc]
call fcn.00404a00
add esi, 0x68
cmp esi, dword [edi + 0x1c]
je 0x48f470
mov eax, dword [ebp + 0x3ec]
jmp 0x48f440
mov ecx, dword [ebp + 0x3f0]
lea eax, [ebp + 0x3dc]
cmp ecx, 7
jbe 0x48f487
mov eax, dword [ebp + 0x3dc]
mov ecx, eax
mov edx, ebx
call fcn.004193f0
lea ecx, [ebp + 0x3dc]
mov byte [ebp - 4], 7
call fcn.004027a0
jmp case.default.0x48f25e
xor eax, eax
mov ecx, 7
xor edx, edx
mov dword [ebp + 0x3dc], eax
mov dword [ebp + 0x3e0], eax
mov dword [ebp + 0x3e4], eax
mov dword [ebp + 0x3e8], eax
mov dword [ebp + 0x3ec], eax
mov dword [ebp + 0x3f0], ecx
mov word [ebp + 0x3dc], dx
mov byte [ebp - 4], 0x13
mov esi, dword [edi + 0x18]
cmp esi, dword [edi + 0x1c]
je 0x48f476
test eax, eax
je 0x48f4f8
push 0x4f0390
lea ecx, [ebp + 0x3dc]
call fcn.00405930
push esi
lea ecx, [ebp + 0x394]
call fcn.004024d0
mov byte [ebp - 4], 0x14
lea ecx, [ebp + 0x394]
cmp dword [ebp + 0x3a8], 7
mov edi, dword [ebp + 0x394]
seta bl
jbe 0x48f522
mov ecx, edi
mov edx, dword [ebp + 0x3a4]
test edx, edx
je 0x48f554
lea eax, [edx - 1]
cmp eax, 0xffffffff
jb 0x48f537
or eax, 0xffffffff
cmp word [ecx + eax*2], 0x5c
lea eax, [ecx + eax*2]
je 0x48f54e
cmp eax, ecx
je 0x48f554
sub eax, 2
cmp word [eax], 0x5c
jne 0x48f541
sub eax, ecx
sar eax, 1
jmp 0x48f557
or eax, 0xffffffff
xor ecx, ecx
inc eax
mov dword [ebp + 0x3c4], ecx
mov dword [ebp + 0x3c8], ecx
mov dword [ebp + 0x3cc], ecx
mov dword [ebp + 0x3d0], ecx
mov dword [ebp + 0x3d4], ecx
mov dword [ebp + 0x3d8], ecx
cmp edx, eax
jb 0x490665
sub edx, eax
cmp edx, 0xffffffff
jb 0x48f590
or edx, 0xffffffff
lea ecx, [ebp + 0x394]
test bl, bl
je 0x48f59c
mov ecx, edi
lea eax, [ecx + eax*2]
push edx
push eax
lea ecx, [ebp + 0x3c4]
call fcn.00403450
lea ecx, [ebp + 0x394]
call fcn.004027a0
mov eax, dword [ebp + 0x3c4]
lea ecx, [ebp + 0x3dc]
mov dword [ebp + 0x394], eax
mov eax, dword [ebp + 0x3c8]
mov dword [ebp + 0x398], eax
mov eax, dword [ebp + 0x3cc]
mov dword [ebp + 0x39c], eax
mov eax, dword [ebp + 0x3d0]
mov dword [ebp + 0x3a0], eax
mov eax, dword [ebp + 0x3d4]
mov dword [ebp + 0x3a4], eax
mov eax, dword [ebp + 0x3d8]
mov dword [ebp + 0x3a8], eax
lea eax, [ebp + 0x394]
push eax
call fcn.00404a00
lea ecx, [ebp + 0x394]
mov byte [ebp - 4], 0x13
call fcn.004027a0
mov eax, dword [ebp - 0x10]
add esi, 0x68
cmp esi, dword [eax + 0x1c]
je 0x48f636
mov eax, dword [ebp + 0x3ec]
jmp 0x48f4e4
mov ebx, dword [ebp - 0x24]
jmp 0x48f470
xor eax, eax
xor ecx, ecx
mov dword [ebp + 0x3dc], eax
mov dword [ebp + 0x3e0], eax
mov dword [ebp + 0x3e4], eax
mov dword [ebp + 0x3e8], eax
mov dword [ebp + 0x3ec], eax
mov eax, 7
mov dword [ebp + 0x3f0], eax
mov word [ebp + 0x3dc], cx
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 0x15
mov edi, dword [edi + 0x24]
mov dword [ebp - 0x1c], edi
cmp edi, dword [ecx + 0x28]
je 0x48f86b
mov eax, ecx
lea ebx, [ebx]
mov esi, dword [edi + 0x18]
cmp esi, dword [edi + 0x1c]
je 0x48f853
lea esp, [esp]
lea eax, [esi + 4]
push eax
lea ecx, [ebp + 0x37c]
call fcn.004024d0
xor eax, eax
mov byte [ebp - 4], 0x16
push 2
push 0x4f0390
lea ecx, [ebp + 0x3c4]
mov dword [ebp + 0x3c4], eax
mov dword [ebp + 0x3c8], eax
mov dword [ebp + 0x3cc], eax
mov dword [ebp + 0x3d0], eax
mov dword [ebp + 0x3d4], eax
mov dword [ebp + 0x3d8], eax
call fcn.00403450
lea edx, [ebp + 0x3c4]
lea ecx, [ebp + 0x37c]
call fcn.00441850
mov ecx, eax
mov dword [ebp - 0x28], ecx
cmp dword [ecx + 0x14], 7
jbe 0x48f713
mov edx, dword [ecx]
mov ebx, edx
mov ecx, dword [ecx + 0x10]
lea eax, [edx + ecx*2]
jmp 0x48f71b
mov eax, dword [ecx + 0x10]
mov ebx, ecx
lea eax, [ecx + eax*2]
mov dword [ebp - 0x2c], eax
cmp ebx, eax
je 0x48f744
mov edi, eax
movzx eax, word [ebx]
lea ecx, [ebp + 0x3c4]
push 0
push eax
call fcn.00460f60
cmp eax, 0xffffffff
je 0x48f741
add ebx, 2
cmp ebx, edi
jne 0x48f724
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
mov eax, ecx
cmp dword [ecx + 0x14], 7
jbe 0x48f751
mov eax, dword [ecx]
push ebx
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.00412c40
lea ecx, [ebp + 0x3c4]
call fcn.004027a0
mov ebx, dword [ebp + 0x390]
lea ecx, [ebp + 0x37c]
mov edx, dword [ebp + 0x37c]
cmp ebx, 7
seta byte [ebp - 0x11]
jbe 0x48f787
mov ecx, edx
cmp byte [ebp - 0x11], 0
mov eax, dword [ebp + 0x38c]
lea ecx, [ecx + eax*2]
lea eax, [ebp + 0x37c]
je 0x48f79e
mov eax, edx
cmp eax, ecx
je 0x48f7c6
mov edi, 0x20
cmp word [eax], 0xa
jne 0x48f7b0
mov word [eax], di
add eax, 2
cmp eax, ecx
jne 0x48f7a7
mov ebx, dword [ebp + 0x390]
mov edx, dword [ebp + 0x37c]
mov edi, dword [ebp - 0x1c]
cmp ebx, 7
lea ecx, [ebp + 0x37c]
seta byte [ebp - 0x11]
jbe 0x48f7d7
mov ecx, edx
cmp byte [ebp - 0x11], 0
mov eax, dword [ebp + 0x38c]
lea ecx, [ecx + eax*2]
lea eax, [ebp + 0x37c]
je 0x48f7ee
mov eax, edx
cmp eax, ecx
je 0x48f80a
mov edi, 0x20
cmp word [eax], 0xd
jne 0x48f800
mov word [eax], di
add eax, 2
cmp eax, ecx
jne 0x48f7f7
mov edi, dword [ebp - 0x1c]
cmp dword [ebp + 0x3ec], 0
je 0x48f823
push 0x4f0390
lea ecx, [ebp + 0x3dc]
call fcn.00405930
lea eax, [ebp + 0x37c]
push eax
lea ecx, [ebp + 0x3dc]
call fcn.00404a00
lea ecx, [ebp + 0x37c]
mov byte [ebp - 4], 0x15
call fcn.004027a0
add esi, 0x1c
cmp esi, dword [edi + 0x1c]
jne 0x48f6a0
mov eax, dword [ebp - 0x10]
add edi, 0x24
mov dword [ebp - 0x1c], edi
cmp edi, dword [eax + 0x28]
jne 0x48f690
mov eax, dword [ebp + 0x3f0]
mov ebx, dword [ebp - 0x24]
lea ecx, [ebp + 0x3dc]
cmp eax, 7
jbe 0x48f489
mov ecx, dword [ebp + 0x3dc]
jmp 0x48f489
mov eax, dword [ebp - 0x10]
mov edi, dword [edi + 0x28]
mov ecx, edi
mov esi, dword [eax + 0x24]
sub ecx, esi
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jbe 0x48fe9c
cmp esi, edi
je case.default.0x48f25e
mov eax, dword [ebp - 0x10]
jmp 0x48f8c0
mov edi, dword [esi + 0x18]
cmp edi, dword [esi + 0x1c]
je 0x48fe8b
lea esp, [esp]
lea eax, [ebp + 0x100]
push eax
lea ecx, [ebp + 0x148]
call fcn.004024d0
xor eax, eax
mov byte [ebp - 4], 0x17
push eax
push 0x4eb5ac
lea ecx, [ebp + 0x25c]
mov dword [ebp + 0x25c], eax
mov dword [ebp + 0x260], eax
mov dword [ebp + 0x264], eax
mov dword [ebp + 0x268], eax
mov dword [ebp + 0x26c], eax
mov dword [ebp + 0x270], eax
call fcn.00403450
xor eax, eax
mov byte [ebp - 4], 0x18
push 7
push str.__mode_
lea ecx, [ebp + 0x274]
mov dword [ebp + 0x274], eax
mov dword [ebp + 0x278], eax
mov dword [ebp + 0x27c], eax
mov dword [ebp + 0x280], eax
mov dword [ebp + 0x284], eax
mov dword [ebp + 0x288], eax
call fcn.00403450
lea eax, [ebp + 0x25c]
mov byte [ebp - 4], 0x19
push eax
lea edx, [ebp + 0x274]
lea ecx, [ebp + 0x148]
call fcn.00403c70
mov byte [ebp - 4], 0x18
add esp, 4
mov ecx, dword [ebp + 0x288]
cmp ecx, 7
jbe 0x48f9bc
mov edx, dword [ebp + 0x274]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x48f9b2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x490656
push ecx
push edx
call fcn.004accfd
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp + 0x270]
mov dword [ebp + 0x284], 0
mov dword [ebp + 0x288], 7
mov word [ebp + 0x274], ax
cmp ecx, 7
jbe 0x48fa1d
mov edx, dword [ebp + 0x25c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x48fa13
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x490656
push ecx
push edx
call fcn.004accfd
add esp, 8
xor eax, eax
mov dword [ebp + 0x26c], 0
push eax
push 0x4eb5ac
lea ecx, [ebp + 0x22c]
mov dword [ebp + 0x270], 7
mov word [ebp + 0x25c], ax
mov dword [ebp + 0x22c], eax
mov dword [ebp + 0x230], eax
mov dword [ebp + 0x234], eax
mov dword [ebp + 0x238], eax
mov dword [ebp + 0x23c], eax
mov dword [ebp + 0x240], eax
call fcn.00403450
xor eax, eax
mov byte [ebp - 4], 0x1a
push 0xb
push str.__pattern__
lea ecx, [ebp + 0x244]
mov dword [ebp + 0x244], eax
mov dword [ebp + 0x248], eax
mov dword [ebp + 0x24c], eax
mov dword [ebp + 0x250], eax
mov dword [ebp + 0x254], eax
mov dword [ebp + 0x258], eax
call fcn.00403450
lea eax, [ebp + 0x22c]
mov byte [ebp - 4], 0x1b
push eax
lea edx, [ebp + 0x244]
lea ecx, [ebp + 0x148]
call fcn.00403c70
mov byte [ebp - 4], 0x1a
add esp, 4
mov ecx, dword [ebp + 0x258]
cmp ecx, 7
jbe 0x48fb0e
mov edx, dword [ebp + 0x244]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x48fb04
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x490656
push ecx
push edx
call fcn.004accfd
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp + 0x240]
mov dword [ebp + 0x254], 0
mov dword [ebp + 0x258], 7
mov word [ebp + 0x244], ax
cmp ecx, 7
jbe 0x48fb6f
mov edx, dword [ebp + 0x22c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x48fb65
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x490656
push ecx
push edx
call fcn.004accfd
add esp, 8
xor eax, eax
mov dword [ebp + 0x23c], 0
push 0x50
push eax
mov word [ebp + 0x22c], ax
lea eax, [ebp + 0x3f4]
push eax
mov dword [ebp + 0x240], 7
call fcn.004affe0
push dword [edi]
lea eax, [ebp + 0x3f4]
push 0x4f0694
push eax
call fcn.00490c70
add esp, 0x18
lea ecx, [ebp + 0x3f4]
xor eax, eax
lea edx, [ecx + 2]
mov dword [ebp + 0x160], eax
mov dword [ebp + 0x164], eax
mov dword [ebp + 0x168], eax
mov dword [ebp + 0x16c], eax
mov dword [ebp + 0x170], eax
mov dword [ebp + 0x174], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48fbe0
sub ecx, edx
lea eax, [ebp + 0x3f4]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp + 0x160]
call fcn.00403450
xor eax, eax
mov byte [ebp - 4], 0x1c
push 6
push str._line_
lea ecx, [ebp + 0x178]
mov dword [ebp + 0x178], eax
mov dword [ebp + 0x17c], eax
mov dword [ebp + 0x180], eax
mov dword [ebp + 0x184], eax
mov dword [ebp + 0x188], eax
mov dword [ebp + 0x18c], eax
call fcn.00403450
lea eax, [ebp + 0x160]
mov byte [ebp - 4], 0x1d
push eax
lea edx, [ebp + 0x178]
lea ecx, [ebp + 0x148]
call fcn.00403c70
add esp, 4
lea ecx, [ebp + 0x178]
call fcn.004027a0
lea ecx, [ebp + 0x160]
mov byte [ebp - 4], 0x17
call fcn.004027a0
cmp dword [esi + 0x14], 7
mov edx, esi
jbe 0x48fc81
mov edx, dword [esi]
xor eax, eax
mov ecx, edx
mov dword [ebp + 0x34c], eax
mov dword [ebp + 0x350], eax
mov dword [ebp + 0x354], eax
mov dword [ebp + 0x358], eax
lea ebx, [ecx + 2]
mov dword [ebp + 0x35c], eax
mov dword [ebp + 0x360], eax
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48fcb0
sub ecx, ebx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp + 0x34c]
call fcn.00403450
xor eax, eax
mov byte [ebp - 4], 0x1e
push 6
push str._path_
lea ecx, [ebp + 0x364]
mov dword [ebp + 0x364], eax
mov dword [ebp + 0x368], eax
mov dword [ebp + 0x36c], eax
mov dword [ebp + 0x370], eax
mov dword [ebp + 0x374], eax
mov dword [ebp + 0x378], eax
call fcn.00403450
lea eax, [ebp + 0x34c]
mov byte [ebp - 4], 0x1f
push eax
lea edx, [ebp + 0x364]
lea ecx, [ebp + 0x148]
call fcn.00403c70
mov byte [ebp - 4], 0x1e
add esp, 4
mov ecx, dword [ebp + 0x378]
cmp ecx, 7
jbe 0x48fd6b
mov edx, dword [ebp + 0x364]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x48fd61
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x490656
push ecx
push edx
call fcn.004accfd
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp + 0x360]
mov dword [ebp + 0x374], 0
mov dword [ebp + 0x378], 7
mov word [ebp + 0x364], ax
cmp ecx, 7
jbe 0x48fdcc
mov edx, dword [ebp + 0x34c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x48fdc2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x490656
push ecx
push edx
call fcn.004accfd
add esp, 8
xor eax, eax
mov dword [ebp + 0x35c], 0
mov word [ebp + 0x34c], ax
mov ecx, 0x44
mov dword [ebp + 0x360], 7
lea eax, [ebp - 0xe8]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x48fdf4
mov dword [ebp - 0xe8], 0x44
lea eax, [ebp - 0xa0]
mov ecx, 0x10
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x48fe14
cmp dword [ebp + 0x15c], 7
lea eax, [ebp + 0x148]
jbe 0x48fe34
mov eax, dword [ebp + 0x148]
lea ecx, [ebp - 0xa0]
push ecx
lea ecx, [ebp - 0xe8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x9c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0xa0]
call ebx
lea ecx, [ebp + 0x148]
mov byte [ebp - 4], 7
call fcn.004027a0
add edi, 0x1c
cmp edi, dword [esi + 0x1c]
jne 0x48f8d0
mov eax, dword [ebp - 0x10]
add esi, 0x24
cmp esi, dword [eax + 0x28]
jne 0x48f8c0
jmp case.default.0x48f25e
mov eax, dword [ebp - 0x10]
mov esi, dword [eax + 0x18]
cmp esi, dword [eax + 0x1c]
je case.default.0x48f25e
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x100]
push eax
lea ecx, [ebp + 0x1d8]
call fcn.004024d0
xor eax, eax
mov byte [ebp - 4], 0x20
push eax
push 0x4eb5ac
lea ecx, [ebp + 0x334]
mov dword [ebp + 0x334], eax
mov dword [ebp + 0x338], eax
mov dword [ebp + 0x33c], eax
mov dword [ebp + 0x340], eax
mov dword [ebp + 0x344], eax
mov dword [ebp + 0x348], eax
call fcn.00403450
xor eax, eax
mov byte [ebp - 4], 0x21
push 7
push str.__mode_
lea ecx, [ebp + 0x130]
mov dword [ebp + 0x130], eax
mov dword [ebp + 0x134], eax
mov dword [ebp + 0x138], eax
mov dword [ebp + 0x13c], eax
mov dword [ebp + 0x140], eax
mov dword [ebp + 0x144], eax
call fcn.00403450
lea eax, [ebp + 0x334]
mov byte [ebp - 4], 0x22
push eax
lea edx, [ebp + 0x130]
lea ecx, [ebp + 0x1d8]
call fcn.00403c70
add esp, 4
lea ecx, [ebp + 0x130]
call fcn.004027a0
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp + 0x348]
cmp ecx, 7
jbe 0x48ffa8
mov edx, dword [ebp + 0x334]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x48ff9e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x490656
push ecx
push edx
call fcn.004accfd
add esp, 8
xor eax, eax
mov dword [ebp + 0x344], 0
push eax
push 0x4eb5ac
lea ecx, [ebp + 0x304]
mov dword [ebp + 0x348], 7
mov word [ebp + 0x334], ax
mov dword [ebp + 0x304], eax
mov dword [ebp + 0x308], eax
mov dword [ebp + 0x30c], eax
mov dword [ebp + 0x310], eax
mov dword [ebp + 0x314], eax
mov dword [ebp + 0x318], eax
call fcn.00403450
xor eax, eax
mov byte [ebp - 4], 0x23
push 0xb
push str.__pattern__
lea ecx, [ebp + 0x31c]
mov dword [ebp + 0x31c], eax
mov dword [ebp + 0x320], eax
mov dword [ebp + 0x324], eax
mov dword [ebp + 0x328], eax
mov dword [ebp + 0x32c], eax
mov dword [ebp + 0x330], eax
call fcn.00403450
lea eax, [ebp + 0x304]
mov byte [ebp - 4], 0x24
push eax
lea edx, [ebp + 0x31c]
lea ecx, [ebp + 0x1d8]
call fcn.00403c70
mov byte [ebp - 4], 0x23
add esp, 4
mov ecx, dword [ebp + 0x330]
cmp ecx, 7
jbe 0x490099
mov edx, dword [ebp + 0x31c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x49008f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x490656
push ecx
push edx
call fcn.004accfd
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp + 0x318]
mov dword [ebp + 0x32c], 0
mov dword [ebp + 0x330], 7
mov word [ebp + 0x31c], ax
cmp ecx, 7
jbe 0x4900fa
mov edx, dword [ebp + 0x304]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4900f0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x490656
push ecx
push edx
call fcn.004accfd
add esp, 8
mov edi, dword [esi + 0x20]
xor eax, eax
mov dword [ebp + 0x314], 0
mov dword [ebp + 0x318], 7
mov word [ebp + 0x304], ax
cmp edi, dword [esi + 0x24]
je 0x4902bb
push 0x50
push eax
lea eax, [ebp + 0x444]
push eax
call fcn.004affe0
push dword [edi]
lea eax, [ebp + 0x444]
push 0x4f0694
push eax
call fcn.00490c70
add esp, 0x18
lea ecx, [ebp + 0x444]
xor eax, eax
lea edx, [ecx + 2]
mov dword [ebp + 0x28c], eax
mov dword [ebp + 0x290], eax
mov dword [ebp + 0x294], eax
mov dword [ebp + 0x298], eax
mov dword [ebp + 0x29c], eax
mov dword [ebp + 0x2a0], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x490177
sub ecx, edx
lea eax, [ebp + 0x444]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp + 0x28c]
call fcn.00403450
xor eax, eax
mov byte [ebp - 4], 0x25
push 6
push str._line_
lea ecx, [ebp + 0x2ec]
mov dword [ebp + 0x2ec], eax
mov dword [ebp + 0x2f0], eax
mov dword [ebp + 0x2f4], eax
mov dword [ebp + 0x2f8], eax
mov dword [ebp + 0x2fc], eax
mov dword [ebp + 0x300], eax
call fcn.00403450
lea eax, [ebp + 0x28c]
mov byte [ebp - 4], 0x26
push eax
lea edx, [ebp + 0x2ec]
lea ecx, [ebp + 0x1d8]
call fcn.00403c70
mov byte [ebp - 4], 0x25
add esp, 4
mov ecx, dword [ebp + 0x300]
cmp ecx, 7
jbe 0x490238
mov edx, dword [ebp + 0x2ec]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x49022e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x490656
push ecx
push edx
call fcn.004accfd
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp + 0x2a0]
mov dword [ebp + 0x2fc], 0
mov dword [ebp + 0x300], 7
mov word [ebp + 0x2ec], ax
cmp ecx, 7
jbe 0x490299
mov edx, dword [ebp + 0x28c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x49028f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x490656
push ecx
push edx
call fcn.004accfd
add esp, 8
xor eax, eax
mov dword [ebp + 0x29c], 0
mov dword [ebp + 0x2a0], 7
mov word [ebp + 0x28c], ax
jmp 0x4903be
xor eax, eax
lea ecx, [ebp + 0x118]
push 1
push 0x4ed8f4
mov dword [ebp + 0x118], eax
mov dword [ebp + 0x11c], eax
mov dword [ebp + 0x120], eax
mov dword [ebp + 0x124], eax
mov dword [ebp + 0x128], eax
mov dword [ebp + 0x12c], eax
call fcn.00403450
xor eax, eax
mov byte [ebp - 4], 0x27
push 6
push str._line_
lea ecx, [ebp + 0x2a4]
mov dword [ebp + 0x2a4], eax
mov dword [ebp + 0x2a8], eax
mov dword [ebp + 0x2ac], eax
mov dword [ebp + 0x2b0], eax
mov dword [ebp + 0x2b4], eax
mov dword [ebp + 0x2b8], eax
call fcn.00403450
lea eax, [ebp + 0x118]
mov byte [ebp - 4], 0x28
push eax
lea edx, [ebp + 0x2a4]
lea ecx, [ebp + 0x1d8]
call fcn.00403c70
mov byte [ebp - 4], 0x27
add esp, 4
mov ecx, dword [ebp + 0x2b8]
cmp ecx, 7
jbe 0x490392
mov edx, dword [ebp + 0x2a4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x490388
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x490656
push ecx
push edx
call fcn.004accfd
add esp, 8
xor eax, eax
mov dword [ebp + 0x2b4], 0
lea ecx, [ebp + 0x118]
mov dword [ebp + 0x2b8], 7
mov word [ebp + 0x2a4], ax
mov byte [ebp - 4], 0x20
call fcn.004027a0
cmp dword [esi + 0x14], 7
mov edx, esi
jbe 0x4903c8
mov edx, dword [esi]
xor eax, eax
mov ecx, edx
mov dword [ebp + 0x2d4], eax
mov dword [ebp + 0x2d8], eax
mov dword [ebp + 0x2dc], eax
mov dword [ebp + 0x2e0], eax
lea edi, [ecx + 2]
mov dword [ebp + 0x2e4], eax
mov dword [ebp + 0x2e8], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4903f3
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp + 0x2d4]
call fcn.00403450
xor eax, eax
mov byte [ebp - 4], 0x29
push 6
push str._path_
lea ecx, [ebp + 0x2bc]
mov dword [ebp + 0x2bc], eax
mov dword [ebp + 0x2c0], eax
mov dword [ebp + 0x2c4], eax
mov dword [ebp + 0x2c8], eax
mov dword [ebp + 0x2cc], eax
mov dword [ebp + 0x2d0], eax
call fcn.00403450
lea eax, [ebp + 0x2d4]
mov byte [ebp - 4], 0x2a
push eax
lea edx, [ebp + 0x2bc]
lea ecx, [ebp + 0x1d8]
call fcn.00403c70
mov byte [ebp - 4], 0x29
add esp, 4
mov ecx, dword [ebp + 0x2d0]
cmp ecx, 7
jbe 0x4904ae
mov edx, dword [ebp + 0x2bc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4904a4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x490656
push ecx
push edx
call fcn.004accfd
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp + 0x2e8]
mov dword [ebp + 0x2cc], 0
mov dword [ebp + 0x2d0], 7
mov word [ebp + 0x2bc], ax
cmp ecx, 7
jbe 0x49050f
mov edx, dword [ebp + 0x2d4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x490505
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x490656
push ecx
push edx
call fcn.004accfd
add esp, 8
xor eax, eax
mov dword [ebp + 0x2e4], 0
mov word [ebp + 0x2d4], ax
mov ecx, 0x44
mov dword [ebp + 0x2e8], 7
lea eax, [ebp - 0x12c]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x490537
mov dword [ebp - 0x12c], 0x44
lea eax, [ebp - 0x90]
mov ecx, 0x10
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x490557
cmp dword [ebp + 0x1ec], 7
lea eax, [ebp + 0x1d8]
jbe 0x490577
mov eax, dword [ebp + 0x1d8]
lea ecx, [ebp - 0x90]
push ecx
lea ecx, [ebp - 0x12c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x8c]
call ebx
push dword [ebp - 0x90]
call ebx
lea ecx, [ebp + 0x1d8]
mov byte [ebp - 4], 7
call fcn.004027a0
mov eax, dword [ebp - 0x10]
add esi, 0x68
cmp esi, dword [eax + 0x1c]
jne 0x48feb1
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov esi, dword [ebp - 0x10]
mov dword [0x507a24], 0
mov dword [0x507a1c], 0
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x4905f9
mov eax, dword [ecx]
push 1
call dword [eax + 0x34]
lea ecx, [ebp + 0x100]
mov dword [esi + 0x30], 0
call fcn.004027a0
lea ecx, [ebp + 0x5c]
call fcn.004027a0
lea ecx, [ebp + 0x44]
call fcn.004027a0
lea ecx, [ebp + 0x20]
call fcn.004027a0
lea ecx, [ebp + 8]
call fcn.004027a0
mov eax, edi
jmp 0x490631
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x494]
xor ecx, ebp
call fcn.004accbf
lea esp, [ebp + 0x498]
pop ebp
ret 0xc
call fcn.004b306f
call fcn.004026f0
call fcn.004b306f
call fcn.00404b30
mov edi, edi
dec eax
add bl, bh
dec eax
add byte [esp + esi*8 - 0x9c1ffb8], ah
dec eax
add byte [ebp + 0x550048f8], al
push ebp